Linux patch 4.4.854.4-88

2 files changed, 1515 insertions, 0 deletions

diff --git a/0000_README b/0000_README
index ddf97288..e008a1d3 100644
--- a/0000_README
+++ b/0000_README
@@ -379,6 +379,10 @@ Patch:  1083_linux-4.4.84.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.4.84
 
+Patch:  1084_linux-4.4.85.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.4.85
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.
diff --git a/1084_linux-4.4.85.patch b/1084_linux-4.4.85.patch
new file mode 100644
index 00000000..27aa21d0
--- /dev/null
+++ b/1084_linux-4.4.85.patch
@@ -0,0 +1,1511 @@
+diff --git a/Makefile b/Makefile
+index 9d77ac063ec0..0f3d843f42a7 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 4
+-SUBLEVEL = 84
++SUBLEVEL = 85
+ EXTRAVERSION =
+ NAME = Blurry Fish Butt
+ 
+diff --git a/arch/arc/include/asm/cache.h b/arch/arc/include/asm/cache.h
+index 210ef3e72332..0ddd7144c492 100644
+--- a/arch/arc/include/asm/cache.h
++++ b/arch/arc/include/asm/cache.h
+@@ -88,7 +88,9 @@ extern int ioc_exists;
+ #define ARC_REG_SLC_FLUSH	0x904
+ #define ARC_REG_SLC_INVALIDATE	0x905
+ #define ARC_REG_SLC_RGN_START	0x914
++#define ARC_REG_SLC_RGN_START1	0x915
+ #define ARC_REG_SLC_RGN_END	0x916
++#define ARC_REG_SLC_RGN_END1	0x917
+ 
+ /* Bit val in SLC_CONTROL */
+ #define SLC_CTRL_IM		0x040
+diff --git a/arch/arc/mm/cache.c b/arch/arc/mm/cache.c
+index d81b6d7e11e7..9a84cbdd44b0 100644
+--- a/arch/arc/mm/cache.c
++++ b/arch/arc/mm/cache.c
+@@ -543,6 +543,7 @@ noinline void slc_op(phys_addr_t paddr, unsigned long sz, const int op)
+ 	static DEFINE_SPINLOCK(lock);
+ 	unsigned long flags;
+ 	unsigned int ctrl;
++	phys_addr_t end;
+ 
+ 	spin_lock_irqsave(&lock, flags);
+ 
+@@ -572,8 +573,16 @@ noinline void slc_op(phys_addr_t paddr, unsigned long sz, const int op)
+ 	 * END needs to be setup before START (latter triggers the operation)
+ 	 * END can't be same as START, so add (l2_line_sz - 1) to sz
+ 	 */
+-	write_aux_reg(ARC_REG_SLC_RGN_END, (paddr + sz + l2_line_sz - 1));
+-	write_aux_reg(ARC_REG_SLC_RGN_START, paddr);
++	end = paddr + sz + l2_line_sz - 1;
++	if (is_pae40_enabled())
++		write_aux_reg(ARC_REG_SLC_RGN_END1, upper_32_bits(end));
++
++	write_aux_reg(ARC_REG_SLC_RGN_END, lower_32_bits(end));
++
++	if (is_pae40_enabled())
++		write_aux_reg(ARC_REG_SLC_RGN_START1, upper_32_bits(paddr));
++
++	write_aux_reg(ARC_REG_SLC_RGN_START, lower_32_bits(paddr));
+ 
+ 	while (read_aux_reg(ARC_REG_SLC_CTRL) & SLC_CTRL_BUSY);
+ 
+diff --git a/drivers/acpi/apei/ghes.c b/drivers/acpi/apei/ghes.c
+index eac4f3b02df9..bb81cd05f0bc 100644
+--- a/drivers/acpi/apei/ghes.c
++++ b/drivers/acpi/apei/ghes.c
+@@ -1067,6 +1067,7 @@ static int ghes_remove(struct platform_device *ghes_dev)
+ 		if (list_empty(&ghes_sci))
+ 			unregister_acpi_hed_notifier(&ghes_notifier_sci);
+ 		mutex_unlock(&ghes_list_mutex);
++		synchronize_rcu();
+ 		break;
+ 	case ACPI_HEST_NOTIFY_NMI:
+ 		ghes_nmi_remove(ghes);
+diff --git a/drivers/acpi/ioapic.c b/drivers/acpi/ioapic.c
+index ccdc8db16bb8..fa2cf2dc4e33 100644
+--- a/drivers/acpi/ioapic.c
++++ b/drivers/acpi/ioapic.c
+@@ -45,6 +45,12 @@ static acpi_status setup_res(struct acpi_resource *acpi_res, void *data)
+ 	struct resource *res = data;
+ 	struct resource_win win;
+ 
++	/*
++	 * We might assign this to 'res' later, make sure all pointers are
++	 * cleared before the resource is added to the global list
++	 */
++	memset(&win, 0, sizeof(win));
++
+ 	res->flags = 0;
+ 	if (acpi_dev_filter_resource_type(acpi_res, IORESOURCE_MEM) == 0)
+ 		return AE_OK;
+diff --git a/drivers/android/binder.c b/drivers/android/binder.c
+index 47ddfefe2443..5531f020e561 100644
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -1718,8 +1718,12 @@ static void binder_transaction(struct binder_proc *proc,
+ 	list_add_tail(&t->work.entry, target_list);
+ 	tcomplete->type = BINDER_WORK_TRANSACTION_COMPLETE;
+ 	list_add_tail(&tcomplete->entry, &thread->todo);
+-	if (target_wait)
+-		wake_up_interruptible(target_wait);
++	if (target_wait) {
++		if (reply || !(t->flags & TF_ONE_WAY))
++			wake_up_interruptible_sync(target_wait);
++		else
++			wake_up_interruptible(target_wait);
++	}
+ 	return;
+ 
+ err_get_unused_fd_failed:
+@@ -2865,7 +2869,7 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
+ 	const char *failure_string;
+ 	struct binder_buffer *buffer;
+ 
+-	if (proc->tsk != current)
++	if (proc->tsk != current->group_leader)
+ 		return -EINVAL;
+ 
+ 	if ((vma->vm_end - vma->vm_start) > SZ_4M)
+@@ -2966,8 +2970,8 @@ static int binder_open(struct inode *nodp, struct file *filp)
+ 	proc = kzalloc(sizeof(*proc), GFP_KERNEL);
+ 	if (proc == NULL)
+ 		return -ENOMEM;
+-	get_task_struct(current);
+-	proc->tsk = current;
++	get_task_struct(current->group_leader);
++	proc->tsk = current->group_leader;
+ 	INIT_LIST_HEAD(&proc->todo);
+ 	init_waitqueue_head(&proc->wait);
+ 	proc->default_priority = task_nice(current);
+diff --git a/drivers/gpu/drm/drm_atomic.c b/drivers/gpu/drm/drm_atomic.c
+index 6253775b8d9c..50d74e5ce41b 100644
+--- a/drivers/gpu/drm/drm_atomic.c
++++ b/drivers/gpu/drm/drm_atomic.c
+@@ -1247,6 +1247,9 @@ int drm_atomic_check_only(struct drm_atomic_state *state)
+ 	if (config->funcs->atomic_check)
+ 		ret = config->funcs->atomic_check(state->dev, state);
+ 
++	if (ret)
++		return ret;
++
+ 	if (!state->allow_modeset) {
+ 		for_each_crtc_in_state(state, crtc, crtc_state, i) {
+ 			if (drm_atomic_crtc_needs_modeset(crtc_state)) {
+@@ -1257,7 +1260,7 @@ int drm_atomic_check_only(struct drm_atomic_state *state)
+ 		}
+ 	}
+ 
+-	return ret;
++	return 0;
+ }
+ EXPORT_SYMBOL(drm_atomic_check_only);
+ 
+diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
+index b205224f1a44..9147113139be 100644
+--- a/drivers/gpu/drm/drm_gem.c
++++ b/drivers/gpu/drm/drm_gem.c
+@@ -715,13 +715,13 @@ drm_gem_object_release_handle(int id, void *ptr, void *data)
+ 	struct drm_gem_object *obj = ptr;
+ 	struct drm_device *dev = obj->dev;
+ 
++	if (dev->driver->gem_close_object)
++		dev->driver->gem_close_object(obj, file_priv);
++
+ 	if (drm_core_check_feature(dev, DRIVER_PRIME))
+ 		drm_gem_remove_prime_handles(obj, file_priv);
+ 	drm_vma_node_revoke(&obj->vma_node, file_priv->filp);
+ 
+-	if (dev->driver->gem_close_object)
+-		dev->driver->gem_close_object(obj, file_priv);
+-
+ 	drm_gem_object_handle_unreference_unlocked(obj);
+ 
+ 	return 0;
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
+index 9255b9c096b6..9befd624a5f0 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_crtc.c
+@@ -148,8 +148,8 @@ static void rcar_du_crtc_set_display_timing(struct rcar_du_crtc *rcrtc)
+ 	rcar_du_group_write(rcrtc->group, rcrtc->index % 2 ? OTAR2 : OTAR, 0);
+ 
+ 	/* Signal polarities */
+-	value = ((mode->flags & DRM_MODE_FLAG_PVSYNC) ? 0 : DSMR_VSL)
+-	      | ((mode->flags & DRM_MODE_FLAG_PHSYNC) ? 0 : DSMR_HSL)
++	value = ((mode->flags & DRM_MODE_FLAG_PVSYNC) ? DSMR_VSL : 0)
++	      | ((mode->flags & DRM_MODE_FLAG_PHSYNC) ? DSMR_HSL : 0)
+ 	      | DSMR_DIPM_DE | DSMR_CSPM;
+ 	rcar_du_crtc_write(rcrtc, DSMR, value);
+ 
+@@ -171,7 +171,7 @@ static void rcar_du_crtc_set_display_timing(struct rcar_du_crtc *rcrtc)
+ 					mode->crtc_vsync_start - 1);
+ 	rcar_du_crtc_write(rcrtc, VCR,  mode->crtc_vtotal - 1);
+ 
+-	rcar_du_crtc_write(rcrtc, DESR,  mode->htotal - mode->hsync_start);
++	rcar_du_crtc_write(rcrtc, DESR,  mode->htotal - mode->hsync_start - 1);
+ 	rcar_du_crtc_write(rcrtc, DEWR,  mode->hdisplay);
+ }
+ 
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_kms.c b/drivers/gpu/drm/rcar-du/rcar_du_kms.c
+index 46429c4be8e5..2b75a4891dec 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_kms.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_kms.c
+@@ -642,13 +642,13 @@ static int rcar_du_encoders_init_one(struct rcar_du_device *rcdu,
+ 	}
+ 
+ 	ret = rcar_du_encoder_init(rcdu, enc_type, output, encoder, connector);
+-	of_node_put(encoder);
+-	of_node_put(connector);
+-
+ 	if (ret && ret != -EPROBE_DEFER)
+ 		dev_warn(rcdu->dev,
+-			 "failed to initialize encoder %s (%d), skipping\n",
+-			 encoder->full_name, ret);
++			 "failed to initialize encoder %s on output %u (%d), skipping\n",
++			 of_node_full_name(encoder), output, ret);
++
++	of_node_put(encoder);
++	of_node_put(connector);
+ 
+ 	return ret;
+ }
+diff --git a/drivers/gpu/drm/rcar-du/rcar_du_lvdsenc.c b/drivers/gpu/drm/rcar-du/rcar_du_lvdsenc.c
+index 85043c5bad03..873e04aa9352 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_du_lvdsenc.c
++++ b/drivers/gpu/drm/rcar-du/rcar_du_lvdsenc.c
+@@ -56,11 +56,11 @@ static int rcar_du_lvdsenc_start(struct rcar_du_lvdsenc *lvds,
+ 		return ret;
+ 
+ 	/* PLL clock configuration */
+-	if (freq <= 38000)
++	if (freq < 39000)
+ 		pllcr = LVDPLLCR_CEEN | LVDPLLCR_COSEL | LVDPLLCR_PLLDLYCNT_38M;
+-	else if (freq <= 60000)
++	else if (freq < 61000)
+ 		pllcr = LVDPLLCR_CEEN | LVDPLLCR_COSEL | LVDPLLCR_PLLDLYCNT_60M;
+-	else if (freq <= 121000)
++	else if (freq < 121000)
+ 		pllcr = LVDPLLCR_CEEN | LVDPLLCR_COSEL | LVDPLLCR_PLLDLYCNT_121M;
+ 	else
+ 		pllcr = LVDPLLCR_PLLDLYCNT_150M;
+@@ -102,7 +102,7 @@ static int rcar_du_lvdsenc_start(struct rcar_du_lvdsenc *lvds,
+ 	/* Turn the PLL on, wait for the startup delay, and turn the output
+ 	 * on.
+ 	 */
+-	lvdcr0 |= LVDCR0_PLLEN;
++	lvdcr0 |= LVDCR0_PLLON;
+ 	rcar_lvds_write(lvds, LVDCR0, lvdcr0);
+ 
+ 	usleep_range(100, 150);
+diff --git a/drivers/gpu/drm/rcar-du/rcar_lvds_regs.h b/drivers/gpu/drm/rcar-du/rcar_lvds_regs.h
+index 77cf9289ab65..b1eafd097a79 100644
+--- a/drivers/gpu/drm/rcar-du/rcar_lvds_regs.h
++++ b/drivers/gpu/drm/rcar-du/rcar_lvds_regs.h
+@@ -18,7 +18,7 @@
+ #define LVDCR0_DMD			(1 << 12)
+ #define LVDCR0_LVMD_MASK		(0xf << 8)
+ #define LVDCR0_LVMD_SHIFT		8
+-#define LVDCR0_PLLEN			(1 << 4)
++#define LVDCR0_PLLON			(1 << 4)
+ #define LVDCR0_BEN			(1 << 2)
+ #define LVDCR0_LVEN			(1 << 1)
+ #define LVDCR0_LVRES			(1 << 0)
+diff --git a/drivers/i2c/busses/i2c-designware-platdrv.c b/drivers/i2c/busses/i2c-designware-platdrv.c
+index 6b00061c3746..a2ae2213ef3e 100644
+--- a/drivers/i2c/busses/i2c-designware-platdrv.c
++++ b/drivers/i2c/busses/i2c-designware-platdrv.c
+@@ -294,7 +294,7 @@ static void dw_i2c_plat_complete(struct device *dev)
+ #endif
+ 
+ #ifdef CONFIG_PM
+-static int dw_i2c_plat_suspend(struct device *dev)
++static int dw_i2c_plat_runtime_suspend(struct device *dev)
+ {
+ 	struct platform_device *pdev = to_platform_device(dev);
+ 	struct dw_i2c_dev *i_dev = platform_get_drvdata(pdev);
+@@ -318,11 +318,21 @@ static int dw_i2c_plat_resume(struct device *dev)
+ 	return 0;
+ }
+ 
++#ifdef CONFIG_PM_SLEEP
++static int dw_i2c_plat_suspend(struct device *dev)
++{
++	pm_runtime_resume(dev);
++	return dw_i2c_plat_runtime_suspend(dev);
++}
++#endif
++
+ static const struct dev_pm_ops dw_i2c_dev_pm_ops = {
+ 	.prepare = dw_i2c_plat_prepare,
+ 	.complete = dw_i2c_plat_complete,
+ 	SET_SYSTEM_SLEEP_PM_OPS(dw_i2c_plat_suspend, dw_i2c_plat_resume)
+-	SET_RUNTIME_PM_OPS(dw_i2c_plat_suspend, dw_i2c_plat_resume, NULL)
++	SET_RUNTIME_PM_OPS(dw_i2c_plat_runtime_suspend,
++			   dw_i2c_plat_resume,
++			   NULL)
+ };
+ 
+ #define DW_I2C_DEV_PMOPS (&dw_i2c_dev_pm_ops)
+diff --git a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
+index 0a86ef43e781..a8db38db622e 100644
+--- a/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
++++ b/drivers/iio/common/hid-sensors/hid-sensor-trigger.c
+@@ -36,8 +36,6 @@ static int _hid_sensor_power_state(struct hid_sensor_common *st, bool state)
+ 	s32 poll_value = 0;
+ 
+ 	if (state) {
+-		if (!atomic_read(&st->user_requested_state))
+-			return 0;
+ 		if (sensor_hub_device_open(st->hsdev))
+ 			return -EIO;
+ 
+@@ -84,6 +82,9 @@ static int _hid_sensor_power_state(struct hid_sensor_common *st, bool state)
+ 				       &report_val);
+ 	}
+ 
++	pr_debug("HID_SENSOR %s set power_state %d report_state %d\n",
++		 st->pdev->name, state_val, report_val);
++
+ 	sensor_hub_get_feature(st->hsdev, st->power_state.report_id,
+ 			       st->power_state.index,
+ 			       sizeof(state_val), &state_val);
+@@ -107,6 +108,7 @@ int hid_sensor_power_state(struct hid_sensor_common *st, bool state)
+ 		ret = pm_runtime_get_sync(&st->pdev->dev);
+ 	else {
+ 		pm_runtime_mark_last_busy(&st->pdev->dev);
++		pm_runtime_use_autosuspend(&st->pdev->dev);
+ 		ret = pm_runtime_put_autosuspend(&st->pdev->dev);
+ 	}
+ 	if (ret < 0) {
+@@ -175,8 +177,6 @@ int hid_sensor_setup_trigger(struct iio_dev *indio_dev, const char *name,
+ 	/* Default to 3 seconds, but can be changed from sysfs */
+ 	pm_runtime_set_autosuspend_delay(&attrb->pdev->dev,
+ 					 3000);
+-	pm_runtime_use_autosuspend(&attrb->pdev->dev);
+-
+ 	return ret;
+ error_unreg_trigger:
+ 	iio_trigger_unregister(trig);
+diff --git a/drivers/iio/imu/adis16480.c b/drivers/iio/imu/adis16480.c
+index 2485b88ee1b6..1880105cc8c4 100644
+--- a/drivers/iio/imu/adis16480.c
++++ b/drivers/iio/imu/adis16480.c
+@@ -696,7 +696,7 @@ static const struct adis16480_chip_info adis16480_chip_info[] = {
+ 		.gyro_max_val = IIO_RAD_TO_DEGREE(22500),
+ 		.gyro_max_scale = 450,
+ 		.accel_max_val = IIO_M_S_2_TO_G(12500),
+-		.accel_max_scale = 5,
++		.accel_max_scale = 10,
+ 	},
+ 	[ADIS16485] = {
+ 		.channels = adis16485_channels,
+diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
+index 98d4e515587a..681dce15fbc8 100644
+--- a/drivers/input/mouse/elan_i2c_core.c
++++ b/drivers/input/mouse/elan_i2c_core.c
+@@ -1234,6 +1234,7 @@ static const struct acpi_device_id elan_acpi_id[] = {
+ 	{ "ELAN0000", 0 },
+ 	{ "ELAN0100", 0 },
+ 	{ "ELAN0600", 0 },
++	{ "ELAN0602", 0 },
+ 	{ "ELAN0605", 0 },
+ 	{ "ELAN0608", 0 },
+ 	{ "ELAN0605", 0 },
+diff --git a/drivers/input/mouse/trackpoint.c b/drivers/input/mouse/trackpoint.c
+index 354d47ecd66a..ce6ff9b301bb 100644
+--- a/drivers/input/mouse/trackpoint.c
++++ b/drivers/input/mouse/trackpoint.c
+@@ -265,7 +265,8 @@ static int trackpoint_start_protocol(struct psmouse *psmouse, unsigned char *fir
+ 	if (ps2_command(&psmouse->ps2dev, param, MAKE_PS2_CMD(0, 2, TP_READ_ID)))
+ 		return -1;
+ 
+-	if (param[0] != TP_MAGIC_IDENT)
++	/* add new TP ID. */
++	if (!(param[0] & TP_MAGIC_IDENT))
+ 		return -1;
+ 
+ 	if (firmware_id)
+diff --git a/drivers/input/mouse/trackpoint.h b/drivers/input/mouse/trackpoint.h
+index 5617ed3a7d7a..88055755f82e 100644
+--- a/drivers/input/mouse/trackpoint.h
++++ b/drivers/input/mouse/trackpoint.h
+@@ -21,8 +21,9 @@
+ #define TP_COMMAND		0xE2	/* Commands start with this */
+ 
+ #define TP_READ_ID		0xE1	/* Sent for device identification */
+-#define TP_MAGIC_IDENT		0x01	/* Sent after a TP_READ_ID followed */
++#define TP_MAGIC_IDENT		0x03	/* Sent after a TP_READ_ID followed */
+ 					/* by the firmware ID */
++					/* Firmware ID includes 0x1, 0x2, 0x3 */
+ 
+ 
+ /*
+diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
+index a2661381ddfc..d2774197fe58 100644
+--- a/drivers/misc/mei/hw-me-regs.h
++++ b/drivers/misc/mei/hw-me-regs.h
+@@ -125,6 +125,11 @@
+ #define MEI_DEV_ID_KBP        0xA2BA  /* Kaby Point */
+ #define MEI_DEV_ID_KBP_2      0xA2BB  /* Kaby Point 2 */
+ 
++#define MEI_DEV_ID_LBG        0xA1BA  /* Lewisburg (SPT) */
++
++#define MEI_DEV_ID_BXT_M      0x1A9A  /* Broxton M */
++#define MEI_DEV_ID_APL_I      0x5A9A  /* Apollo Lake I */
++
+ /*
+  * MEI HW Section
+  */
+diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
+index 01e20384ac44..adab5bbb642a 100644
+--- a/drivers/misc/mei/pci-me.c
++++ b/drivers/misc/mei/pci-me.c
+@@ -86,10 +86,14 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
+ 	{MEI_PCI_DEVICE(MEI_DEV_ID_SPT_2, mei_me_pch8_cfg)},
+ 	{MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H, mei_me_pch8_sps_cfg)},
+ 	{MEI_PCI_DEVICE(MEI_DEV_ID_SPT_H_2, mei_me_pch8_sps_cfg)},
++	{MEI_PCI_DEVICE(MEI_DEV_ID_LBG, mei_me_pch8_cfg)},
+ 
+ 	{MEI_PCI_DEVICE(MEI_DEV_ID_KBP, mei_me_pch8_cfg)},
+ 	{MEI_PCI_DEVICE(MEI_DEV_ID_KBP_2, mei_me_pch8_cfg)},
+ 
++	{MEI_PCI_DEVICE(MEI_DEV_ID_BXT_M, mei_me_pch8_cfg)},
++	{MEI_PCI_DEVICE(MEI_DEV_ID_APL_I, mei_me_pch8_cfg)},
++
+ 	/* required last entry */
+ 	{0, }
+ };
+diff --git a/drivers/ntb/ntb_transport.c b/drivers/ntb/ntb_transport.c
+index ecc6fb9ca92f..3bbdf60f8908 100644
+--- a/drivers/ntb/ntb_transport.c
++++ b/drivers/ntb/ntb_transport.c
+@@ -599,7 +599,7 @@ static int ntb_transport_setup_qp_mw(struct ntb_transport_ctx *nt,
+ 	if (!mw->virt_addr)
+ 		return -ENOMEM;
+ 
+-	if (qp_count % mw_count && mw_num + 1 < qp_count / mw_count)
++	if (mw_num < qp_count % mw_count)
+ 		num_qps_mw = qp_count / mw_count + 1;
+ 	else
+ 		num_qps_mw = qp_count / mw_count;
+@@ -947,7 +947,7 @@ static int ntb_transport_init_queue(struct ntb_transport_ctx *nt,
+ 	qp->event_handler = NULL;
+ 	ntb_qp_link_down_reset(qp);
+ 
+-	if (qp_count % mw_count && mw_num + 1 < qp_count / mw_count)
++	if (mw_num < qp_count % mw_count)
+ 		num_qps_mw = qp_count / mw_count + 1;
+ 	else
+ 		num_qps_mw = qp_count / mw_count;
+@@ -1065,8 +1065,8 @@ static int ntb_transport_probe(struct ntb_client *self, struct ntb_dev *ndev)
+ 	qp_count = ilog2(qp_bitmap);
+ 	if (max_num_clients && max_num_clients < qp_count)
+ 		qp_count = max_num_clients;
+-	else if (mw_count < qp_count)
+-		qp_count = mw_count;
++	else if (nt->mw_count < qp_count)
++		qp_count = nt->mw_count;
+ 
+ 	qp_bitmap &= BIT_ULL(qp_count) - 1;
+ 
+diff --git a/drivers/staging/rtl8188eu/os_dep/usb_intf.c b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+index 02c3feef4e36..c2d2c17550a7 100644
+--- a/drivers/staging/rtl8188eu/os_dep/usb_intf.c
++++ b/drivers/staging/rtl8188eu/os_dep/usb_intf.c
+@@ -49,6 +49,7 @@ static struct usb_device_id rtw_usb_id_tbl[] = {
+ 	{USB_DEVICE(0x2001, 0x3311)}, /* DLink GO-USB-N150 REV B1 */
+ 	{USB_DEVICE(0x2357, 0x010c)}, /* TP-Link TL-WN722N v2 */
+ 	{USB_DEVICE(0x0df6, 0x0076)}, /* Sitecom N150 v2 */
++	{USB_DEVICE(USB_VENDER_ID_REALTEK, 0xffef)}, /* Rosewill RNX-N150NUB */
+ 	{}	/* Terminating entry */
+ };
+ 
+diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c
+index 26a3b389a265..fa8df3fef6fc 100644
+--- a/fs/cifs/dir.c
++++ b/fs/cifs/dir.c
+@@ -183,15 +183,20 @@ cifs_bp_rename_retry:
+ }
+ 
+ /*
++ * Don't allow path components longer than the server max.
+  * Don't allow the separator character in a path component.
+  * The VFS will not allow "/", but "\" is allowed by posix.
+  */
+ static int
+-check_name(struct dentry *direntry)
++check_name(struct dentry *direntry, struct cifs_tcon *tcon)
+ {
+ 	struct cifs_sb_info *cifs_sb = CIFS_SB(direntry->d_sb);
+ 	int i;
+ 
++	if (unlikely(direntry->d_name.len >
++		     tcon->fsAttrInfo.MaxPathNameComponentLength))
++		return -ENAMETOOLONG;
++
+ 	if (!(cifs_sb->mnt_cifs_flags & CIFS_MOUNT_POSIX_PATHS)) {
+ 		for (i = 0; i < direntry->d_name.len; i++) {
+ 			if (direntry->d_name.name[i] == '\\') {
+@@ -489,10 +494,6 @@ cifs_atomic_open(struct inode *inode, struct dentry *direntry,
+ 		return finish_no_open(file, res);
+ 	}
+ 
+-	rc = check_name(direntry);
+-	if (rc)
+-		return rc;
+-
+ 	xid = get_xid();
+ 
+ 	cifs_dbg(FYI, "parent inode = 0x%p name is: %pd and dentry = 0x%p\n",
+@@ -505,6 +506,11 @@ cifs_atomic_open(struct inode *inode, struct dentry *direntry,
+ 	}
+ 
+ 	tcon = tlink_tcon(tlink);
++
++	rc = check_name(direntry, tcon);
++	if (rc)
++		goto out_free_xid;
++
+ 	server = tcon->ses->server;
+ 
+ 	if (server->ops->new_lease_key)
+@@ -765,7 +771,7 @@ cifs_lookup(struct inode *parent_dir_inode, struct dentry *direntry,
+ 	}
+ 	pTcon = tlink_tcon(tlink);
+ 
+-	rc = check_name(direntry);
++	rc = check_name(direntry, pTcon);
+ 	if (rc)
+ 		goto lookup_out;
+ 
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index f4afa3b1cc56..6c484ddf26a9 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -2768,8 +2768,8 @@ copy_fs_info_to_kstatfs(struct smb2_fs_full_size_info *pfs_inf,
+ 	kst->f_bsize = le32_to_cpu(pfs_inf->BytesPerSector) *
+ 			  le32_to_cpu(pfs_inf->SectorsPerAllocationUnit);
+ 	kst->f_blocks = le64_to_cpu(pfs_inf->TotalAllocationUnits);
+-	kst->f_bfree  = le64_to_cpu(pfs_inf->ActualAvailableAllocationUnits);
+-	kst->f_bavail = le64_to_cpu(pfs_inf->CallerAvailableAllocationUnits);
++	kst->f_bfree  = kst->f_bavail =
++			le64_to_cpu(pfs_inf->CallerAvailableAllocationUnits);
+ 	return;
+ }
+ 
+diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
+index 3f68a25f2169..544672b440de 100644
+--- a/fs/nfsd/nfs4xdr.c
++++ b/fs/nfsd/nfs4xdr.c
+@@ -129,7 +129,7 @@ static void next_decode_page(struct nfsd4_compoundargs *argp)
+ 	argp->p = page_address(argp->pagelist[0]);
+ 	argp->pagelist++;
+ 	if (argp->pagelen < PAGE_SIZE) {
+-		argp->end = argp->p + (argp->pagelen>>2);
++		argp->end = argp->p + XDR_QUADLEN(argp->pagelen);
+ 		argp->pagelen = 0;
+ 	} else {
+ 		argp->end = argp->p + (PAGE_SIZE>>2);
+@@ -1246,9 +1246,7 @@ nfsd4_decode_write(struct nfsd4_compoundargs *argp, struct nfsd4_write *write)
+ 		argp->pagelen -= pages * PAGE_SIZE;
+ 		len -= pages * PAGE_SIZE;
+ 
+-		argp->p = (__be32 *)page_address(argp->pagelist[0]);
+-		argp->pagelist++;
+-		argp->end = argp->p + XDR_QUADLEN(PAGE_SIZE);
++		next_decode_page(argp);
+ 	}
+ 	argp->p += XDR_QUADLEN(len);
+ 
+diff --git a/include/net/ip.h b/include/net/ip.h
+index b450d8653b30..7476bb10ff37 100644
+--- a/include/net/ip.h
++++ b/include/net/ip.h
+@@ -314,7 +314,7 @@ static inline unsigned int ip_dst_mtu_maybe_forward(const struct dst_entry *dst,
+ 	    !forwarding)
+ 		return dst_mtu(dst);
+ 
+-	return min(dst->dev->mtu, IP_MAX_MTU);
++	return min(READ_ONCE(dst->dev->mtu), IP_MAX_MTU);
+ }
+ 
+ static inline unsigned int ip_skb_dst_mtu(const struct sk_buff *skb)
+@@ -327,7 +327,7 @@ static inline unsigned int ip_skb_dst_mtu(const struct sk_buff *skb)
+ 		return ip_dst_mtu_maybe_forward(skb_dst(skb), forwarding);
+ 	}
+ 
+-	return min(skb_dst(skb)->dev->mtu, IP_MAX_MTU);
++	return min(READ_ONCE(skb_dst(skb)->dev->mtu), IP_MAX_MTU);
+ }
+ 
+ u32 ip_idents_reserve(u32 hash, int segs);
+diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
+index e5bba897d206..7a5d6a073165 100644
+--- a/include/net/sch_generic.h
++++ b/include/net/sch_generic.h
+@@ -717,8 +717,11 @@ static inline struct Qdisc *qdisc_replace(struct Qdisc *sch, struct Qdisc *new,
+ 	old = *pold;
+ 	*pold = new;
+ 	if (old != NULL) {
+-		qdisc_tree_reduce_backlog(old, old->q.qlen, old->qstats.backlog);
++		unsigned int qlen = old->q.qlen;
++		unsigned int backlog = old->qstats.backlog;
++
+ 		qdisc_reset(old);
++		qdisc_tree_reduce_backlog(old, qlen, backlog);
+ 	}
+ 	sch_tree_unlock(sch);
+ 
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index 784ab8fe8714..3697063dd09a 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -8473,28 +8473,27 @@ SYSCALL_DEFINE5(perf_event_open,
+ 			goto err_context;
+ 
+ 		/*
+-		 * Do not allow to attach to a group in a different
+-		 * task or CPU context:
++		 * Make sure we're both events for the same CPU;
++		 * grouping events for different CPUs is broken; since
++		 * you can never concurrently schedule them anyhow.
+ 		 */
+-		if (move_group) {
+-			/*
+-			 * Make sure we're both on the same task, or both
+-			 * per-cpu events.
+-			 */
+-			if (group_leader->ctx->task != ctx->task)
+-				goto err_context;
++		if (group_leader->cpu != event->cpu)
++			goto err_context;
+ 
+-			/*
+-			 * Make sure we're both events for the same CPU;
+-			 * grouping events for different CPUs is broken; since
+-			 * you can never concurrently schedule them anyhow.
+-			 */
+-			if (group_leader->cpu != event->cpu)
+-				goto err_context;
+-		} else {
+-			if (group_leader->ctx != ctx)
+-				goto err_context;
+-		}
++		/*
++		 * Make sure we're both on the same task, or both
++		 * per-CPU events.
++		 */
++		if (group_leader->ctx->task != ctx->task)
++			goto err_context;
++
++		/*
++		 * Do not allow to attach to a group in a different task
++		 * or CPU context. If we're moving SW events, we'll fix
++		 * this up later, so allow that.
++		 */
++		if (!move_group && group_leader->ctx != ctx)
++			goto err_context;
+ 
+ 		/*
+ 		 * Only a group leader can be exclusive or pinned
+diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
+index 6816302542b2..f0e5408499b6 100644
+--- a/kernel/trace/trace_events_filter.c
++++ b/kernel/trace/trace_events_filter.c
+@@ -1979,6 +1979,10 @@ static int create_filter(struct trace_event_call *call,
+ 		if (err && set_str)
+ 			append_filter_err(ps, filter);
+ 	}
++	if (err && !set_str) {
++		free_event_filter(filter);
++		filter = NULL;
++	}
+ 	create_filter_finish(ps);
+ 
+ 	*filterp = filter;
+diff --git a/net/bluetooth/bnep/core.c b/net/bluetooth/bnep/core.c
+index 1641367e54ca..69f56073b337 100644
+--- a/net/bluetooth/bnep/core.c
++++ b/net/bluetooth/bnep/core.c
+@@ -484,16 +484,16 @@ static int bnep_session(void *arg)
+ 	struct net_device *dev = s->dev;
+ 	struct sock *sk = s->sock->sk;
+ 	struct sk_buff *skb;
+-	wait_queue_t wait;
++	DEFINE_WAIT_FUNC(wait, woken_wake_function);
+ 
+ 	BT_DBG("");
+ 
+ 	set_user_nice(current, -15);
+ 
+-	init_waitqueue_entry(&wait, current);
+ 	add_wait_queue(sk_sleep(sk), &wait);
+ 	while (1) {
+-		set_current_state(TASK_INTERRUPTIBLE);
++		/* Ensure session->terminate is updated */
++		smp_mb__before_atomic();
+ 
+ 		if (atomic_read(&s->terminate))
+ 			break;
+@@ -515,9 +515,8 @@ static int bnep_session(void *arg)
+ 				break;
+ 		netif_wake_queue(dev);
+ 
+-		schedule();
++		wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
+ 	}
+-	__set_current_state(TASK_RUNNING);
+ 	remove_wait_queue(sk_sleep(sk), &wait);
+ 
+ 	/* Cleanup session */
+@@ -663,7 +662,7 @@ int bnep_del_connection(struct bnep_conndel_req *req)
+ 	s = __bnep_get_session(req->dst);
+ 	if (s) {
+ 		atomic_inc(&s->terminate);
+-		wake_up_process(s->task);
++		wake_up_interruptible(sk_sleep(s->sock->sk));
+ 	} else
+ 		err = -ENOENT;
+ 
+diff --git a/net/bluetooth/cmtp/core.c b/net/bluetooth/cmtp/core.c
+index 298ed37010e6..3a39fd523e40 100644
+--- a/net/bluetooth/cmtp/core.c
++++ b/net/bluetooth/cmtp/core.c
+@@ -281,16 +281,16 @@ static int cmtp_session(void *arg)
+ 	struct cmtp_session *session = arg;
+ 	struct sock *sk = session->sock->sk;
+ 	struct sk_buff *skb;
+-	wait_queue_t wait;
++	DEFINE_WAIT_FUNC(wait, woken_wake_function);
+ 
+ 	BT_DBG("session %p", session);
+ 
+ 	set_user_nice(current, -15);
+ 
+-	init_waitqueue_entry(&wait, current);
+ 	add_wait_queue(sk_sleep(sk), &wait);
+ 	while (1) {
+-		set_current_state(TASK_INTERRUPTIBLE);
++		/* Ensure session->terminate is updated */
++		smp_mb__before_atomic();
+ 
+ 		if (atomic_read(&session->terminate))
+ 			break;
+@@ -307,9 +307,8 @@ static int cmtp_session(void *arg)
+ 
+ 		cmtp_process_transmit(session);
+ 
+-		schedule();
++		wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
+ 	}
+-	__set_current_state(TASK_RUNNING);
+ 	remove_wait_queue(sk_sleep(sk), &wait);
+ 
+ 	down_write(&cmtp_session_sem);
+@@ -394,7 +393,7 @@ int cmtp_add_connection(struct cmtp_connadd_req *req, struct socket *sock)
+ 		err = cmtp_attach_device(session);
+ 		if (err < 0) {
+ 			atomic_inc(&session->terminate);
+-			wake_up_process(session->task);
++			wake_up_interruptible(sk_sleep(session->sock->sk));
+ 			up_write(&cmtp_session_sem);
+ 			return err;
+ 		}
+@@ -432,7 +431,11 @@ int cmtp_del_connection(struct cmtp_conndel_req *req)
+ 
+ 		/* Stop session thread */
+ 		atomic_inc(&session->terminate);
+-		wake_up_process(session->task);
++
++		/* Ensure session->terminate is updated */
++		smp_mb__after_atomic();
++
++		wake_up_interruptible(sk_sleep(session->sock->sk));
+ 	} else
+ 		err = -ENOENT;
+ 
+diff --git a/net/bluetooth/hidp/core.c b/net/bluetooth/hidp/core.c
+index 0bec4588c3c8..1fc076420d1e 100644
+--- a/net/bluetooth/hidp/core.c
++++ b/net/bluetooth/hidp/core.c
+@@ -36,6 +36,7 @@
+ #define VERSION "1.2"
+ 
+ static DECLARE_RWSEM(hidp_session_sem);
++static DECLARE_WAIT_QUEUE_HEAD(hidp_session_wq);
+ static LIST_HEAD(hidp_session_list);
+ 
+ static unsigned char hidp_keycode[256] = {
+@@ -1068,12 +1069,12 @@ static int hidp_session_start_sync(struct hidp_session *session)
+  * Wake up session thread and notify it to stop. This is asynchronous and
+  * returns immediately. Call this whenever a runtime error occurs and you want
+  * the session to stop.
+- * Note: wake_up_process() performs any necessary memory-barriers for us.
++ * Note: wake_up_interruptible() performs any necessary memory-barriers for us.
+  */
+ static void hidp_session_terminate(struct hidp_session *session)
+ {
+ 	atomic_inc(&session->terminate);
+-	wake_up_process(session->task);
++	wake_up_interruptible(&hidp_session_wq);
+ }
+ 
+ /*
+@@ -1180,7 +1181,9 @@ static void hidp_session_run(struct hidp_session *session)
+ 	struct sock *ctrl_sk = session->ctrl_sock->sk;
+ 	struct sock *intr_sk = session->intr_sock->sk;
+ 	struct sk_buff *skb;
++	DEFINE_WAIT_FUNC(wait, woken_wake_function);
+ 
++	add_wait_queue(&hidp_session_wq, &wait);
+ 	for (;;) {
+ 		/*
+ 		 * This thread can be woken up two ways:
+@@ -1188,12 +1191,10 @@ static void hidp_session_run(struct hidp_session *session)
+ 		 *    session->terminate flag and wakes this thread up.
+ 		 *  - Via modifying the socket state of ctrl/intr_sock. This
+ 		 *    thread is woken up by ->sk_state_changed().
+-		 *
+-		 * Note: set_current_state() performs any necessary
+-		 * memory-barriers for us.
+ 		 */
+-		set_current_state(TASK_INTERRUPTIBLE);
+ 
++		/* Ensure session->terminate is updated */
++		smp_mb__before_atomic();
+ 		if (atomic_read(&session->terminate))
+ 			break;
+ 
+@@ -1227,11 +1228,22 @@ static void hidp_session_run(struct hidp_session *session)
+ 		hidp_process_transmit(session, &session->ctrl_transmit,
+ 				      session->ctrl_sock);
+ 
+-		schedule();
++		wait_woken(&wait, TASK_INTERRUPTIBLE, MAX_SCHEDULE_TIMEOUT);
+ 	}
++	remove_wait_queue(&hidp_session_wq, &wait);
+ 
+ 	atomic_inc(&session->terminate);
+-	set_current_state(TASK_RUNNING);
++
++	/* Ensure session->terminate is updated */
++	smp_mb__after_atomic();
++}
++
++static int hidp_session_wake_function(wait_queue_t *wait,
++				      unsigned int mode,
++				      int sync, void *key)
++{
++	wake_up_interruptible(&hidp_session_wq);
++	return false;
+ }
+ 
+ /*
+@@ -1244,7 +1256,8 @@ static void hidp_session_run(struct hidp_session *session)
+ static int hidp_session_thread(void *arg)
+ {
+ 	struct hidp_session *session = arg;
+-	wait_queue_t ctrl_wait, intr_wait;
++	DEFINE_WAIT_FUNC(ctrl_wait, hidp_session_wake_function);
++	DEFINE_WAIT_FUNC(intr_wait, hidp_session_wake_function);
+ 
+ 	BT_DBG("session %p", session);
+ 
+@@ -1254,8 +1267,6 @@ static int hidp_session_thread(void *arg)
+ 	set_user_nice(current, -15);
+ 	hidp_set_timer(session);
+ 
+-	init_waitqueue_entry(&ctrl_wait, current);
+-	init_waitqueue_entry(&intr_wait, current);
+ 	add_wait_queue(sk_sleep(session->ctrl_sock->sk), &ctrl_wait);
+ 	add_wait_queue(sk_sleep(session->intr_sock->sk), &intr_wait);
+ 	/* This memory barrier is paired with wq_has_sleeper(). See
+diff --git a/net/dccp/proto.c b/net/dccp/proto.c
+index 9fe25bf63296..b68168fcc06a 100644
+--- a/net/dccp/proto.c
++++ b/net/dccp/proto.c
+@@ -24,6 +24,7 @@
+ #include <net/checksum.h>
+ 
+ #include <net/inet_sock.h>
++#include <net/inet_common.h>
+ #include <net/sock.h>
+ #include <net/xfrm.h>
+ 
+@@ -170,6 +171,15 @@ const char *dccp_packet_name(const int type)
+ 
+ EXPORT_SYMBOL_GPL(dccp_packet_name);
+ 
++static void dccp_sk_destruct(struct sock *sk)
++{
++	struct dccp_sock *dp = dccp_sk(sk);
++
++	ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
++	dp->dccps_hc_tx_ccid = NULL;
++	inet_sock_destruct(sk);
++}
++
+ int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized)
+ {
+ 	struct dccp_sock *dp = dccp_sk(sk);
+@@ -179,6 +189,7 @@ int dccp_init_sock(struct sock *sk, const __u8 ctl_sock_initialized)
+ 	icsk->icsk_syn_retries	= sysctl_dccp_request_retries;
+ 	sk->sk_state		= DCCP_CLOSED;
+ 	sk->sk_write_space	= dccp_write_space;
++	sk->sk_destruct		= dccp_sk_destruct;
+ 	icsk->icsk_sync_mss	= dccp_sync_mss;
+ 	dp->dccps_mss_cache	= 536;
+ 	dp->dccps_rate_last	= jiffies;
+@@ -201,10 +212,7 @@ void dccp_destroy_sock(struct sock *sk)
+ {
+ 	struct dccp_sock *dp = dccp_sk(sk);
+ 
+-	/*
+-	 * DCCP doesn't use sk_write_queue, just sk_send_head
+-	 * for retransmissions
+-	 */
++	__skb_queue_purge(&sk->sk_write_queue);
+ 	if (sk->sk_send_head != NULL) {
+ 		kfree_skb(sk->sk_send_head);
+ 		sk->sk_send_head = NULL;
+@@ -222,8 +230,7 @@ void dccp_destroy_sock(struct sock *sk)
+ 		dp->dccps_hc_rx_ackvec = NULL;
+ 	}
+ 	ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
+-	ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
+-	dp->dccps_hc_rx_ccid = dp->dccps_hc_tx_ccid = NULL;
++	dp->dccps_hc_rx_ccid = NULL;
+ 
+ 	/* clean up feature negotiation state */
+ 	dccp_feat_list_purge(&dp->dccps_featneg);
+diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
+index b2504712259f..313e3c11a15a 100644
+--- a/net/ipv4/fib_semantics.c
++++ b/net/ipv4/fib_semantics.c
+@@ -1044,15 +1044,17 @@ struct fib_info *fib_create_info(struct fib_config *cfg)
+ 	fi = kzalloc(sizeof(*fi)+nhs*sizeof(struct fib_nh), GFP_KERNEL);
+ 	if (!fi)
+ 		goto failure;
+-	fib_info_cnt++;
+ 	if (cfg->fc_mx) {
+ 		fi->fib_metrics = kzalloc(sizeof(*fi->fib_metrics), GFP_KERNEL);
+-		if (!fi->fib_metrics)
+-			goto failure;
++		if (unlikely(!fi->fib_metrics)) {
++			kfree(fi);
++			return ERR_PTR(err);
++		}
+ 		atomic_set(&fi->fib_metrics->refcnt, 1);
+-	} else
++	} else {
+ 		fi->fib_metrics = (struct dst_metrics *)&dst_default_metrics;
+-
++	}
++	fib_info_cnt++;
+ 	fi->fib_net = net;
+ 	fi->fib_protocol = cfg->fc_protocol;
+ 	fi->fib_scope = cfg->fc_scope;
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index c295d882c6e0..0294f7c99c85 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -1241,7 +1241,7 @@ static unsigned int ipv4_mtu(const struct dst_entry *dst)
+ 	if (mtu)
+ 		return mtu;
+ 
+-	mtu = dst->dev->mtu;
++	mtu = READ_ONCE(dst->dev->mtu);
+ 
+ 	if (unlikely(dst_metric_locked(dst, RTAX_MTU))) {
+ 		if (rt->rt_uses_gateway && mtu > 576)
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index f0dabd125c43..c4bbf704ff9c 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -3028,8 +3028,7 @@ void tcp_rearm_rto(struct sock *sk)
+ 			/* delta may not be positive if the socket is locked
+ 			 * when the retrans timer fires and is rescheduled.
+ 			 */
+-			if (delta > 0)
+-				rto = delta;
++			rto = max(delta, 1);
+ 		}
+ 		inet_csk_reset_xmit_timer(sk, ICSK_TIME_RETRANS, rto,
+ 					  TCP_RTO_MAX);
+diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
+index f60e8caea767..aad8cdf15472 100644
+--- a/net/ipv6/ip6_fib.c
++++ b/net/ipv6/ip6_fib.c
+@@ -892,6 +892,8 @@ add:
+ 		}
+ 		nsiblings = iter->rt6i_nsiblings;
+ 		fib6_purge_rt(iter, fn, info->nl_net);
++		if (fn->rr_ptr == iter)
++			fn->rr_ptr = NULL;
+ 		rt6_release(iter);
+ 
+ 		if (nsiblings) {
+@@ -904,6 +906,8 @@ add:
+ 				if (rt6_qualify_for_ecmp(iter)) {
+ 					*ins = iter->dst.rt6_next;
+ 					fib6_purge_rt(iter, fn, info->nl_net);
++					if (fn->rr_ptr == iter)
++						fn->rr_ptr = NULL;
+ 					rt6_release(iter);
+ 					nsiblings--;
+ 				} else {
+@@ -992,7 +996,7 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt,
+ 			/* Create subtree root node */
+ 			sfn = node_alloc();
+ 			if (!sfn)
+-				goto st_failure;
++				goto failure;
+ 
+ 			sfn->leaf = info->nl_net->ipv6.ip6_null_entry;
+ 			atomic_inc(&info->nl_net->ipv6.ip6_null_entry->rt6i_ref);
+@@ -1008,12 +1012,12 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt,
+ 
+ 			if (IS_ERR(sn)) {
+ 				/* If it is failed, discard just allocated
+-				   root, and then (in st_failure) stale node
++				   root, and then (in failure) stale node
+ 				   in main tree.
+ 				 */
+ 				node_free(sfn);
+ 				err = PTR_ERR(sn);
+-				goto st_failure;
++				goto failure;
+ 			}
+ 
+ 			/* Now link new subtree to main tree */
+@@ -1027,7 +1031,7 @@ int fib6_add(struct fib6_node *root, struct rt6_info *rt,
+ 
+ 			if (IS_ERR(sn)) {
+ 				err = PTR_ERR(sn);
+-				goto st_failure;
++				goto failure;
+ 			}
+ 		}
+ 
+@@ -1069,22 +1073,22 @@ out:
+ 			atomic_inc(&pn->leaf->rt6i_ref);
+ 		}
+ #endif
+-		if (!(rt->dst.flags & DST_NOCACHE))
+-			dst_free(&rt->dst);
++		goto failure;
+ 	}
+ 	return err;
+ 
+-#ifdef CONFIG_IPV6_SUBTREES
+-	/* Subtree creation failed, probably main tree node
+-	   is orphan. If it is, shoot it.
++failure:
++	/* fn->leaf could be NULL if fn is an intermediate node and we
++	 * failed to add the new route to it in both subtree creation
++	 * failure and fib6_add_rt2node() failure case.
++	 * In both cases, fib6_repair_tree() should be called to fix
++	 * fn->leaf.
+ 	 */
+-st_failure:
+ 	if (fn && !(fn->fn_flags & (RTN_RTINFO|RTN_ROOT)))
+ 		fib6_repair_tree(info->nl_net, fn);
+ 	if (!(rt->dst.flags & DST_NOCACHE))
+ 		dst_free(&rt->dst);
+ 	return err;
+-#endif
+ }
+ 
+ /*
+diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
+index 8d2f7c9b491d..4a116d766c15 100644
+--- a/net/irda/af_irda.c
++++ b/net/irda/af_irda.c
+@@ -2227,7 +2227,7 @@ static int irda_getsockopt(struct socket *sock, int level, int optname,
+ {
+ 	struct sock *sk = sock->sk;
+ 	struct irda_sock *self = irda_sk(sk);
+-	struct irda_device_list list;
++	struct irda_device_list list = { 0 };
+ 	struct irda_device_info *discoveries;
+ 	struct irda_ias_set *	ias_opt;	/* IAS get/query params */
+ 	struct ias_object *	ias_obj;	/* Object in IAS */
+diff --git a/net/key/af_key.c b/net/key/af_key.c
+index 2e1050ec2cf0..94bf810ad242 100644
+--- a/net/key/af_key.c
++++ b/net/key/af_key.c
+@@ -228,7 +228,7 @@ static int pfkey_broadcast_one(struct sk_buff *skb, struct sk_buff **skb2,
+ #define BROADCAST_ONE		1
+ #define BROADCAST_REGISTERED	2
+ #define BROADCAST_PROMISC_ONLY	4
+-static int pfkey_broadcast(struct sk_buff *skb,
++static int pfkey_broadcast(struct sk_buff *skb, gfp_t allocation,
+ 			   int broadcast_flags, struct sock *one_sk,
+ 			   struct net *net)
+ {
+@@ -278,7 +278,7 @@ static int pfkey_broadcast(struct sk_buff *skb,
+ 	rcu_read_unlock();
+ 
+ 	if (one_sk != NULL)
+-		err = pfkey_broadcast_one(skb, &skb2, GFP_KERNEL, one_sk);
++		err = pfkey_broadcast_one(skb, &skb2, allocation, one_sk);
+ 
+ 	kfree_skb(skb2);
+ 	kfree_skb(skb);
+@@ -311,7 +311,7 @@ static int pfkey_do_dump(struct pfkey_sock *pfk)
+ 		hdr = (struct sadb_msg *) pfk->dump.skb->data;
+ 		hdr->sadb_msg_seq = 0;
+ 		hdr->sadb_msg_errno = rc;
+-		pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE,
++		pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE,
+ 				&pfk->sk, sock_net(&pfk->sk));
+ 		pfk->dump.skb = NULL;
+ 	}
+@@ -355,7 +355,7 @@ static int pfkey_error(const struct sadb_msg *orig, int err, struct sock *sk)
+ 	hdr->sadb_msg_len = (sizeof(struct sadb_msg) /
+ 			     sizeof(uint64_t));
+ 
+-	pfkey_broadcast(skb, BROADCAST_ONE, sk, sock_net(sk));
++	pfkey_broadcast(skb, GFP_KERNEL, BROADCAST_ONE, sk, sock_net(sk));
+ 
+ 	return 0;
+ }
+@@ -1396,7 +1396,7 @@ static int pfkey_getspi(struct sock *sk, struct sk_buff *skb, const struct sadb_
+ 
+ 	xfrm_state_put(x);
+ 
+-	pfkey_broadcast(resp_skb, BROADCAST_ONE, sk, net);
++	pfkey_broadcast(resp_skb, GFP_KERNEL, BROADCAST_ONE, sk, net);
+ 
+ 	return 0;
+ }
+@@ -1483,7 +1483,7 @@ static int key_notify_sa(struct xfrm_state *x, const struct km_event *c)
+ 	hdr->sadb_msg_seq = c->seq;
+ 	hdr->sadb_msg_pid = c->portid;
+ 
+-	pfkey_broadcast(skb, BROADCAST_ALL, NULL, xs_net(x));
++	pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, xs_net(x));
+ 
+ 	return 0;
+ }
+@@ -1596,7 +1596,7 @@ static int pfkey_get(struct sock *sk, struct sk_buff *skb, const struct sadb_msg
+ 	out_hdr->sadb_msg_reserved = 0;
+ 	out_hdr->sadb_msg_seq = hdr->sadb_msg_seq;
+ 	out_hdr->sadb_msg_pid = hdr->sadb_msg_pid;
+-	pfkey_broadcast(out_skb, BROADCAST_ONE, sk, sock_net(sk));
++	pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk, sock_net(sk));
+ 
+ 	return 0;
+ }
+@@ -1701,8 +1701,8 @@ static int pfkey_register(struct sock *sk, struct sk_buff *skb, const struct sad
+ 		return -ENOBUFS;
+ 	}
+ 
+-	pfkey_broadcast(supp_skb, BROADCAST_REGISTERED, sk, sock_net(sk));
+-
++	pfkey_broadcast(supp_skb, GFP_KERNEL, BROADCAST_REGISTERED, sk,
++			sock_net(sk));
+ 	return 0;
+ }
+ 
+@@ -1720,7 +1720,8 @@ static int unicast_flush_resp(struct sock *sk, const struct sadb_msg *ihdr)
+ 	hdr->sadb_msg_errno = (uint8_t) 0;
+ 	hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
+ 
+-	return pfkey_broadcast(skb, BROADCAST_ONE, sk, sock_net(sk));
++	return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ONE, sk,
++			       sock_net(sk));
+ }
+ 
+ static int key_notify_sa_flush(const struct km_event *c)
+@@ -1741,7 +1742,7 @@ static int key_notify_sa_flush(const struct km_event *c)
+ 	hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
+ 	hdr->sadb_msg_reserved = 0;
+ 
+-	pfkey_broadcast(skb, BROADCAST_ALL, NULL, c->net);
++	pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
+ 
+ 	return 0;
+ }
+@@ -1798,7 +1799,7 @@ static int dump_sa(struct xfrm_state *x, int count, void *ptr)
+ 	out_hdr->sadb_msg_pid = pfk->dump.msg_portid;
+ 
+ 	if (pfk->dump.skb)
+-		pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE,
++		pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE,
+ 				&pfk->sk, sock_net(&pfk->sk));
+ 	pfk->dump.skb = out_skb;
+ 
+@@ -1886,7 +1887,7 @@ static int pfkey_promisc(struct sock *sk, struct sk_buff *skb, const struct sadb
+ 		new_hdr->sadb_msg_errno = 0;
+ 	}
+ 
+-	pfkey_broadcast(skb, BROADCAST_ALL, NULL, sock_net(sk));
++	pfkey_broadcast(skb, GFP_KERNEL, BROADCAST_ALL, NULL, sock_net(sk));
+ 	return 0;
+ }
+ 
+@@ -2219,7 +2220,7 @@ static int key_notify_policy(struct xfrm_policy *xp, int dir, const struct km_ev
+ 	out_hdr->sadb_msg_errno = 0;
+ 	out_hdr->sadb_msg_seq = c->seq;
+ 	out_hdr->sadb_msg_pid = c->portid;
+-	pfkey_broadcast(out_skb, BROADCAST_ALL, NULL, xp_net(xp));
++	pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ALL, NULL, xp_net(xp));
+ 	return 0;
+ 
+ }
+@@ -2439,7 +2440,7 @@ static int key_pol_get_resp(struct sock *sk, struct xfrm_policy *xp, const struc
+ 	out_hdr->sadb_msg_errno = 0;
+ 	out_hdr->sadb_msg_seq = hdr->sadb_msg_seq;
+ 	out_hdr->sadb_msg_pid = hdr->sadb_msg_pid;
+-	pfkey_broadcast(out_skb, BROADCAST_ONE, sk, xp_net(xp));
++	pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_ONE, sk, xp_net(xp));
+ 	err = 0;
+ 
+ out:
+@@ -2695,7 +2696,7 @@ static int dump_sp(struct xfrm_policy *xp, int dir, int count, void *ptr)
+ 	out_hdr->sadb_msg_pid = pfk->dump.msg_portid;
+ 
+ 	if (pfk->dump.skb)
+-		pfkey_broadcast(pfk->dump.skb, BROADCAST_ONE,
++		pfkey_broadcast(pfk->dump.skb, GFP_ATOMIC, BROADCAST_ONE,
+ 				&pfk->sk, sock_net(&pfk->sk));
+ 	pfk->dump.skb = out_skb;
+ 
+@@ -2752,7 +2753,7 @@ static int key_notify_policy_flush(const struct km_event *c)
+ 	hdr->sadb_msg_satype = SADB_SATYPE_UNSPEC;
+ 	hdr->sadb_msg_len = (sizeof(struct sadb_msg) / sizeof(uint64_t));
+ 	hdr->sadb_msg_reserved = 0;
+-	pfkey_broadcast(skb_out, BROADCAST_ALL, NULL, c->net);
++	pfkey_broadcast(skb_out, GFP_ATOMIC, BROADCAST_ALL, NULL, c->net);
+ 	return 0;
+ 
+ }
+@@ -2814,7 +2815,7 @@ static int pfkey_process(struct sock *sk, struct sk_buff *skb, const struct sadb
+ 	void *ext_hdrs[SADB_EXT_MAX];
+ 	int err;
+ 
+-	pfkey_broadcast(skb_clone(skb, GFP_KERNEL),
++	pfkey_broadcast(skb_clone(skb, GFP_KERNEL), GFP_KERNEL,
+ 			BROADCAST_PROMISC_ONLY, NULL, sock_net(sk));
+ 
+ 	memset(ext_hdrs, 0, sizeof(ext_hdrs));
+@@ -3036,7 +3037,8 @@ static int key_notify_sa_expire(struct xfrm_state *x, const struct km_event *c)
+ 	out_hdr->sadb_msg_seq = 0;
+ 	out_hdr->sadb_msg_pid = 0;
+ 
+-	pfkey_broadcast(out_skb, BROADCAST_REGISTERED, NULL, xs_net(x));
++	pfkey_broadcast(out_skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL,
++			xs_net(x));
+ 	return 0;
+ }
+ 
+@@ -3226,7 +3228,8 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct
+ 		       xfrm_ctx->ctx_len);
+ 	}
+ 
+-	return pfkey_broadcast(skb, BROADCAST_REGISTERED, NULL, xs_net(x));
++	return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL,
++			       xs_net(x));
+ }
+ 
+ static struct xfrm_policy *pfkey_compile_policy(struct sock *sk, int opt,
+@@ -3424,7 +3427,8 @@ static int pfkey_send_new_mapping(struct xfrm_state *x, xfrm_address_t *ipaddr,
+ 	n_port->sadb_x_nat_t_port_port = sport;
+ 	n_port->sadb_x_nat_t_port_reserved = 0;
+ 
+-	return pfkey_broadcast(skb, BROADCAST_REGISTERED, NULL, xs_net(x));
++	return pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_REGISTERED, NULL,
++			       xs_net(x));
+ }
+ 
+ #ifdef CONFIG_NET_KEY_MIGRATE
+@@ -3616,7 +3620,7 @@ static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
+ 	}
+ 
+ 	/* broadcast migrate message to sockets */
+-	pfkey_broadcast(skb, BROADCAST_ALL, NULL, &init_net);
++	pfkey_broadcast(skb, GFP_ATOMIC, BROADCAST_ALL, NULL, &init_net);
+ 
+ 	return 0;
+ 
+diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
+index 0915d448ba23..075b0d22f213 100644
+--- a/net/sched/act_ipt.c
++++ b/net/sched/act_ipt.c
+@@ -34,6 +34,7 @@ static int ipt_init_target(struct xt_entry_target *t, char *table, unsigned int
+ {
+ 	struct xt_tgchk_param par;
+ 	struct xt_target *target;
++	struct ipt_entry e = {};
+ 	int ret = 0;
+ 
+ 	target = xt_request_find_target(AF_INET, t->u.user.name,
+@@ -44,6 +45,7 @@ static int ipt_init_target(struct xt_entry_target *t, char *table, unsigned int
+ 	t->u.kernel.target = target;
+ 	memset(&par, 0, sizeof(par));
+ 	par.table     = table;
++	par.entryinfo = &e;
+ 	par.target    = target;
+ 	par.targinfo  = t->data;
+ 	par.hook_mask = hook;
+diff --git a/net/sched/sch_sfq.c b/net/sched/sch_sfq.c
+index 4431e2833e45..3f2c3eed04da 100644
+--- a/net/sched/sch_sfq.c
++++ b/net/sched/sch_sfq.c
+@@ -434,6 +434,7 @@ congestion_drop:
+ 		qdisc_drop(head, sch);
+ 
+ 		slot_queue_add(slot, skb);
++		qdisc_tree_reduce_backlog(sch, 0, delta);
+ 		return NET_XMIT_CN;
+ 	}
+ 
+@@ -465,8 +466,10 @@ enqueue:
+ 	/* Return Congestion Notification only if we dropped a packet
+ 	 * from this flow.
+ 	 */
+-	if (qlen != slot->qlen)
++	if (qlen != slot->qlen) {
++		qdisc_tree_reduce_backlog(sch, 0, dropped - qdisc_pkt_len(skb));
+ 		return NET_XMIT_CN;
++	}
+ 
+ 	/* As we dropped a packet, better let upper stack know this */
+ 	qdisc_tree_reduce_backlog(sch, 1, dropped);
+diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
+index 7527c168e471..e33e9bd4ed5a 100644
+--- a/net/sctp/ipv6.c
++++ b/net/sctp/ipv6.c
+@@ -510,7 +510,9 @@ static void sctp_v6_to_addr(union sctp_addr *addr, struct in6_addr *saddr,
+ {
+ 	addr->sa.sa_family = AF_INET6;
+ 	addr->v6.sin6_port = port;
++	addr->v6.sin6_flowinfo = 0;
+ 	addr->v6.sin6_addr = *saddr;
++	addr->v6.sin6_scope_id = 0;
+ }
+ 
+ /* Compare addresses exactly.
+diff --git a/net/tipc/netlink_compat.c b/net/tipc/netlink_compat.c
+index a0c90572d0e5..f86c6555a539 100644
+--- a/net/tipc/netlink_compat.c
++++ b/net/tipc/netlink_compat.c
+@@ -258,13 +258,15 @@ static int tipc_nl_compat_dumpit(struct tipc_nl_compat_cmd_dump *cmd,
+ 	arg = nlmsg_new(0, GFP_KERNEL);
+ 	if (!arg) {
+ 		kfree_skb(msg->rep);
++		msg->rep = NULL;
+ 		return -ENOMEM;
+ 	}
+ 
+ 	err = __tipc_nl_compat_dumpit(cmd, msg, arg);
+-	if (err)
++	if (err) {
+ 		kfree_skb(msg->rep);
+-
++		msg->rep = NULL;
++	}
+ 	kfree_skb(arg);
+ 
+ 	return err;
+diff --git a/sound/core/control.c b/sound/core/control.c
+index b4fe9b002512..bd01d492f46a 100644
+--- a/sound/core/control.c
++++ b/sound/core/control.c
+@@ -1126,7 +1126,7 @@ static int snd_ctl_elem_user_tlv(struct snd_kcontrol *kcontrol,
+ 		mutex_lock(&ue->card->user_ctl_lock);
+ 		change = ue->tlv_data_size != size;
+ 		if (!change)
+-			change = memcmp(ue->tlv_data, new_data, size);
++			change = memcmp(ue->tlv_data, new_data, size) != 0;
+ 		kfree(ue->tlv_data);
+ 		ue->tlv_data = new_data;
+ 		ue->tlv_data_size = size;
+diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c
+index 46f7b023f69c..ac5de4365e15 100644
+--- a/sound/pci/hda/patch_conexant.c
++++ b/sound/pci/hda/patch_conexant.c
+@@ -854,6 +854,7 @@ static const struct snd_pci_quirk cxt5066_fixups[] = {
+ 	SND_PCI_QUIRK(0x17aa, 0x390b, "Lenovo G50-80", CXT_FIXUP_STEREO_DMIC),
+ 	SND_PCI_QUIRK(0x17aa, 0x3975, "Lenovo U300s", CXT_FIXUP_STEREO_DMIC),
+ 	SND_PCI_QUIRK(0x17aa, 0x3977, "Lenovo IdeaPad U310", CXT_FIXUP_STEREO_DMIC),
++	SND_PCI_QUIRK(0x17aa, 0x3978, "Lenovo G50-70", CXT_FIXUP_STEREO_DMIC),
+ 	SND_PCI_QUIRK(0x17aa, 0x397b, "Lenovo S205", CXT_FIXUP_STEREO_DMIC),
+ 	SND_PCI_QUIRK_VENDOR(0x17aa, "Thinkpad", CXT_FIXUP_THINKPAD_ACPI),
+ 	SND_PCI_QUIRK(0x1c06, 0x2011, "Lemote A1004", CXT_PINCFG_LEMOTE_A1004),
+diff --git a/sound/soc/generic/simple-card.c b/sound/soc/generic/simple-card.c
+index 54c33204541f..ff6fcd9f92f7 100644
+--- a/sound/soc/generic/simple-card.c
++++ b/sound/soc/generic/simple-card.c
+@@ -100,7 +100,7 @@ static int asoc_simple_card_hw_params(struct snd_pcm_substream *substream,
+ 		if (ret && ret != -ENOTSUPP)
+ 			goto err;
+ 	}
+-
++	return 0;
+ err:
+ 	return ret;
+ }
+diff --git a/sound/soc/sh/rcar/adg.c b/sound/soc/sh/rcar/adg.c
+index 2a5b3a293cd2..b123734f9fbd 100644
+--- a/sound/soc/sh/rcar/adg.c
++++ b/sound/soc/sh/rcar/adg.c
+@@ -437,7 +437,7 @@ static void rsnd_adg_get_clkout(struct rsnd_priv *priv,
+ 	struct device *dev = rsnd_priv_to_dev(priv);
+ 	struct device_node *np = dev->of_node;
+ 	u32 ckr, rbgx, rbga, rbgb;
+-	u32 rate, req_rate, div;
++	u32 rate, req_rate = 0, div;
+ 	uint32_t count = 0;
+ 	unsigned long req_48kHz_rate, req_441kHz_rate;
+ 	int i;
+diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
+index deed48ef28b8..362446c36c9e 100644
+--- a/sound/soc/sh/rcar/core.c
++++ b/sound/soc/sh/rcar/core.c
+@@ -192,19 +192,16 @@ void rsnd_mod_interrupt(struct rsnd_mod *mod,
+ 	struct rsnd_priv *priv = rsnd_mod_to_priv(mod);
+ 	struct rsnd_dai_stream *io;
+ 	struct rsnd_dai *rdai;
+-	int i, j;
+-
+-	for_each_rsnd_dai(rdai, priv, j) {
++	int i;
+ 
+-		for (i = 0; i < RSND_MOD_MAX; i++) {
+-			io = &rdai->playback;
+-			if (mod == io->mod[i])
+-				callback(mod, io);
++	for_each_rsnd_dai(rdai, priv, i) {
++		io = &rdai->playback;
++		if (mod == io->mod[mod->type])
++			callback(mod, io);
+ 
+-			io = &rdai->capture;
+-			if (mod == io->mod[i])
+-				callback(mod, io);
+-		}
++		io = &rdai->capture;
++		if (mod == io->mod[mod->type])
++			callback(mod, io);
+ 	}
+ }
+ 
+@@ -1019,7 +1016,7 @@ static int rsnd_kctrl_put(struct snd_kcontrol *kctrl,
+ 		}
+ 	}
+ 
+-	if (change)
++	if (change && cfg->update)
+ 		cfg->update(cfg->io, mod);
+ 
+ 	return change;
+diff --git a/sound/soc/sh/rcar/src.c b/sound/soc/sh/rcar/src.c
+index 68b439ed22d7..460d29cbaaa5 100644
+--- a/sound/soc/sh/rcar/src.c
++++ b/sound/soc/sh/rcar/src.c
+@@ -691,13 +691,27 @@ static int _rsnd_src_stop_gen2(struct rsnd_mod *mod)
+ {
+ 	rsnd_src_irq_disable_gen2(mod);
+ 
+-	rsnd_mod_write(mod, SRC_CTRL, 0);
++	/*
++	 * stop SRC output only
++	 * see rsnd_src_quit_gen2
++	 */
++	rsnd_mod_write(mod, SRC_CTRL, 0x01);
+ 
+ 	rsnd_src_error_record_gen2(mod);
+ 
+ 	return rsnd_src_stop(mod);
+ }
+ 
++static int rsnd_src_quit_gen2(struct rsnd_mod *mod,
++			      struct rsnd_dai_stream *io,
++			      struct rsnd_priv *priv)
++{
++	/* stop both out/in */
++	rsnd_mod_write(mod, SRC_CTRL, 0);
++
++	return 0;
++}
++
+ static void __rsnd_src_interrupt_gen2(struct rsnd_mod *mod,
+ 				      struct rsnd_dai_stream *io)
+ {
+@@ -971,7 +985,7 @@ static struct rsnd_mod_ops rsnd_src_gen2_ops = {
+ 	.probe	= rsnd_src_probe_gen2,
+ 	.remove	= rsnd_src_remove_gen2,
+ 	.init	= rsnd_src_init_gen2,
+-	.quit	= rsnd_src_quit,
++	.quit	= rsnd_src_quit_gen2,
+ 	.start	= rsnd_src_start_gen2,
+ 	.stop	= rsnd_src_stop_gen2,
+ 	.hw_params = rsnd_src_hw_params,
+diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c
+index 1427ec21bd7e..c62a2947ac14 100644
+--- a/sound/soc/sh/rcar/ssi.c
++++ b/sound/soc/sh/rcar/ssi.c
+@@ -39,6 +39,7 @@
+ #define	SCKP		(1 << 13)	/* Serial Bit Clock Polarity */
+ #define	SWSP		(1 << 12)	/* Serial WS Polarity */
+ #define	SDTA		(1 << 10)	/* Serial Data Alignment */
++#define	PDTA		(1 <<  9)	/* Parallel Data Alignment */
+ #define	DEL		(1 <<  8)	/* Serial Data Delay */
+ #define	CKDV(v)		(v <<  4)	/* Serial Clock Division Ratio */
+ #define	TRMD		(1 <<  1)	/* Transmit/Receive Mode Select */
+@@ -286,7 +287,7 @@ static int rsnd_ssi_init(struct rsnd_mod *mod,
+ 	struct snd_pcm_runtime *runtime = rsnd_io_to_runtime(io);
+ 	u32 cr;
+ 
+-	cr = FORCE;
++	cr = FORCE | PDTA;
+ 
+ 	/*
+ 	 * always use 32bit system word for easy clock calculation.