[linux-next] LinuxNextTracking branch, master, updated. next-20180109

batman at open-mesh.org batman at open-mesh.org
Wed Jan 10 00:15:50 CET 2018


The following commit has been merged in the master branch:
commit d8141297a1564f78808e6a893ccdaa5d08da412b
Merge: 6dccf6be91de50c31d8055ec10594cdb54b1fd26 418bb8b3ff50515c6d83fdf6d609331c676de178
Author: Stephen Rothwell <sfr at canb.auug.org.au>
Date:   Tue Jan 9 09:32:00 2018 +1100

    Merge remote-tracking branch 'vfs/for-next'

diff --combined arch/alpha/include/uapi/asm/Kbuild
index 14a2e9af97e9,574fe90c8b58..9afaba5e5503
--- a/arch/alpha/include/uapi/asm/Kbuild
+++ b/arch/alpha/include/uapi/asm/Kbuild
@@@ -1,4 -1,4 +1,5 @@@
  # UAPI Header export list
  include include/uapi/asm-generic/Kbuild.asm
  
 +generic-y += bpf_perf_event.h
+ generic-y += poll.h
diff --combined arch/ia64/include/uapi/asm/Kbuild
index f5c6967a93bb,4c9825edd4a3..c0527cfc48f0
--- a/arch/ia64/include/uapi/asm/Kbuild
+++ b/arch/ia64/include/uapi/asm/Kbuild
@@@ -1,5 -1,5 +1,6 @@@
  # UAPI Header export list
  include include/uapi/asm-generic/Kbuild.asm
  
 +generic-y += bpf_perf_event.h
  generic-y += kvm_para.h
+ generic-y += poll.h
diff --combined arch/m32r/include/uapi/asm/Kbuild
index 451bf6071c6e,21f241553a2e..c3df55aeefe7
--- a/arch/m32r/include/uapi/asm/Kbuild
+++ b/arch/m32r/include/uapi/asm/Kbuild
@@@ -1,6 -1,6 +1,7 @@@
  # UAPI Header export list
  include include/uapi/asm-generic/Kbuild.asm
  
 +generic-y += bpf_perf_event.h
  generic-y += kvm_para.h
+ generic-y += poll.h
  generic-y += siginfo.h
diff --combined arch/mn10300/include/uapi/asm/Kbuild
index 81271d3af47c,162fbdbb5fd5..b04fd1632051
--- a/arch/mn10300/include/uapi/asm/Kbuild
+++ b/arch/mn10300/include/uapi/asm/Kbuild
@@@ -1,5 -1,5 +1,6 @@@
  # UAPI Header export list
  include include/uapi/asm-generic/Kbuild.asm
  
 +generic-y	+= bpf_perf_event.h
+ generic-y	+= poll.h
  generic-y	+= siginfo.h
diff --combined arch/powerpc/kvm/book3s_xive.c
index 0d750d274c4e,8f016ccf5424..6882bc94eba8
--- a/arch/powerpc/kvm/book3s_xive.c
+++ b/arch/powerpc/kvm/book3s_xive.c
@@@ -16,7 -16,7 +16,7 @@@
  #include <linux/delay.h>
  #include <linux/percpu.h>
  #include <linux/cpumask.h>
- #include <asm/uaccess.h>
+ #include <linux/uaccess.h>
  #include <asm/kvm_book3s.h>
  #include <asm/kvm_ppc.h>
  #include <asm/hvcall.h>
@@@ -725,8 -725,7 +725,8 @@@ u64 kvmppc_xive_get_icp(struct kvm_vcp
  
  	/* Return the per-cpu state for state saving/migration */
  	return (u64)xc->cppr << KVM_REG_PPC_ICP_CPPR_SHIFT |
 -	       (u64)xc->mfrr << KVM_REG_PPC_ICP_MFRR_SHIFT;
 +	       (u64)xc->mfrr << KVM_REG_PPC_ICP_MFRR_SHIFT |
 +	       (u64)0xff << KVM_REG_PPC_ICP_PPRI_SHIFT;
  }
  
  int kvmppc_xive_set_icp(struct kvm_vcpu *vcpu, u64 icpval)
@@@ -1559,7 -1558,7 +1559,7 @@@ static int xive_set_source(struct kvmpp
  
  	/*
  	 * Restore P and Q. If the interrupt was pending, we
 -	 * force both P and Q, which will trigger a resend.
 +	 * force Q and !P, which will trigger a resend.
  	 *
  	 * That means that a guest that had both an interrupt
  	 * pending (queued) and Q set will restore with only
@@@ -1567,7 -1566,7 +1567,7 @@@
  	 * is perfectly fine as coalescing interrupts that haven't
  	 * been presented yet is always allowed.
  	 */
 -	if (val & KVM_XICS_PRESENTED || val & KVM_XICS_PENDING)
 +	if (val & KVM_XICS_PRESENTED && !(val & KVM_XICS_PENDING))
  		state->old_p = true;
  	if (val & KVM_XICS_QUEUED || val & KVM_XICS_PENDING)
  		state->old_q = true;
diff --combined arch/riscv/kernel/process.c
index d74d4adf2d54,b01f71d2233b..d7c6ca7c95ae
--- a/arch/riscv/kernel/process.c
+++ b/arch/riscv/kernel/process.c
@@@ -25,9 -25,9 +25,9 @@@
  #include <linux/sched/task_stack.h>
  #include <linux/tick.h>
  #include <linux/ptrace.h>
+ #include <linux/uaccess.h>
  
  #include <asm/unistd.h>
- #include <asm/uaccess.h>
  #include <asm/processor.h>
  #include <asm/csr.h>
  #include <asm/string.h>
@@@ -76,7 -76,7 +76,7 @@@ void show_regs(struct pt_regs *regs
  void start_thread(struct pt_regs *regs, unsigned long pc,
  	unsigned long sp)
  {
 -	regs->sstatus = SR_PIE /* User mode, irqs on */ | SR_FS_INITIAL;
 +	regs->sstatus = SR_SPIE /* User mode, irqs on */ | SR_FS_INITIAL;
  	regs->sepc = pc;
  	regs->sp = sp;
  	set_fs(USER_DS);
@@@ -110,7 -110,7 +110,7 @@@ int copy_thread(unsigned long clone_fla
  		const register unsigned long gp __asm__ ("gp");
  		memset(childregs, 0, sizeof(struct pt_regs));
  		childregs->gp = gp;
 -		childregs->sstatus = SR_PS | SR_PIE; /* Supervisor, irqs on */
 +		childregs->sstatus = SR_SPP | SR_SPIE; /* Supervisor, irqs on */
  
  		p->thread.ra = (unsigned long)ret_from_kernel_thread;
  		p->thread.s[0] = usp; /* fn */
diff --combined arch/riscv/mm/fault.c
index 0713f3c67ab4,81e8c983d1fb..ceebfc29305b
--- a/arch/riscv/mm/fault.c
+++ b/arch/riscv/mm/fault.c
@@@ -29,7 -29,6 +29,6 @@@
  
  #include <asm/pgalloc.h>
  #include <asm/ptrace.h>
- #include <asm/uaccess.h>
  
  /*
   * This routine handles page faults.  It determines the address and the
@@@ -63,7 -62,7 +62,7 @@@ asmlinkage void do_page_fault(struct pt
  		goto vmalloc_fault;
  
  	/* Enable interrupts if they were enabled in the parent context. */
 -	if (likely(regs->sstatus & SR_PIE))
 +	if (likely(regs->sstatus & SR_SPIE))
  		local_irq_enable();
  
  	/*
diff --combined arch/score/include/uapi/asm/Kbuild
index 81271d3af47c,162fbdbb5fd5..b04fd1632051
--- a/arch/score/include/uapi/asm/Kbuild
+++ b/arch/score/include/uapi/asm/Kbuild
@@@ -1,5 -1,5 +1,6 @@@
  # UAPI Header export list
  include include/uapi/asm-generic/Kbuild.asm
  
 +generic-y	+= bpf_perf_event.h
+ generic-y	+= poll.h
  generic-y	+= siginfo.h
diff --combined arch/x86/include/uapi/asm/Kbuild
index 1e901e421f2d,e9f6b8e332bd..322681622d1e
--- a/arch/x86/include/uapi/asm/Kbuild
+++ b/arch/x86/include/uapi/asm/Kbuild
@@@ -1,7 -1,7 +1,8 @@@
  # UAPI Header export list
  include include/uapi/asm-generic/Kbuild.asm
  
 +generic-y += bpf_perf_event.h
  generated-y += unistd_32.h
  generated-y += unistd_64.h
  generated-y += unistd_x32.h
+ generic-y += poll.h
diff --combined crypto/af_alg.c
index 35d4dcea381f,a5748a076ec8..f41047ab60f5
--- a/crypto/af_alg.c
+++ b/crypto/af_alg.c
@@@ -664,7 -664,7 +664,7 @@@ void af_alg_free_areq_sgls(struct af_al
  	unsigned int i;
  
  	list_for_each_entry_safe(rsgl, tmp, &areq->rsgl_list, list) {
 -		ctx->rcvused -= rsgl->sg_num_bytes;
 +		atomic_sub(rsgl->sg_num_bytes, &ctx->rcvused);
  		af_alg_free_sg(&rsgl->sgl);
  		list_del(&rsgl->list);
  		if (rsgl != &areq->first_rsgl)
@@@ -672,15 -672,14 +672,15 @@@
  	}
  
  	tsgl = areq->tsgl;
 -	for_each_sg(tsgl, sg, areq->tsgl_entries, i) {
 -		if (!sg_page(sg))
 -			continue;
 -		put_page(sg_page(sg));
 -	}
 +	if (tsgl) {
 +		for_each_sg(tsgl, sg, areq->tsgl_entries, i) {
 +			if (!sg_page(sg))
 +				continue;
 +			put_page(sg_page(sg));
 +		}
  
 -	if (areq->tsgl && areq->tsgl_entries)
  		sock_kfree_s(sk, tsgl, areq->tsgl_entries * sizeof(*tsgl));
 +	}
  }
  EXPORT_SYMBOL_GPL(af_alg_free_areq_sgls);
  
@@@ -1062,13 -1061,13 +1062,13 @@@ EXPORT_SYMBOL_GPL(af_alg_async_cb)
  /**
   * af_alg_poll - poll system call handler
   */
- unsigned int af_alg_poll(struct file *file, struct socket *sock,
+ __poll_t af_alg_poll(struct file *file, struct socket *sock,
  			 poll_table *wait)
  {
  	struct sock *sk = sock->sk;
  	struct alg_sock *ask = alg_sk(sk);
  	struct af_alg_ctx *ctx = ask->private;
- 	unsigned int mask;
+ 	__poll_t mask;
  
  	sock_poll_wait(file, sk_sleep(sk), wait);
  	mask = 0;
@@@ -1138,6 -1137,12 +1138,6 @@@ int af_alg_get_rsgl(struct sock *sk, st
  		if (!af_alg_readable(sk))
  			break;
  
 -		if (!ctx->used) {
 -			err = af_alg_wait_for_data(sk, flags);
 -			if (err)
 -				return err;
 -		}
 -
  		seglen = min_t(size_t, (maxsize - len),
  			       msg_data_left(msg));
  
@@@ -1163,7 -1168,7 +1163,7 @@@
  
  		areq->last_rsgl = rsgl;
  		len += err;
 -		ctx->rcvused += err;
 +		atomic_add(err, &ctx->rcvused);
  		rsgl->sg_num_bytes = err;
  		iov_iter_advance(&msg->msg_iter, err);
  	}
diff --combined crypto/algif_skcipher.c
index c5c47b680152,9ad167d95103..f50907430c92
--- a/crypto/algif_skcipher.c
+++ b/crypto/algif_skcipher.c
@@@ -72,12 -72,6 +72,12 @@@ static int _skcipher_recvmsg(struct soc
  	int err = 0;
  	size_t len = 0;
  
 +	if (!ctx->used) {
 +		err = af_alg_wait_for_data(sk, flags);
 +		if (err)
 +			return err;
 +	}
 +
  	/* Allocate cipher request for current operation. */
  	areq = af_alg_alloc_areq(sk, sizeof(struct af_alg_async_req) +
  				     crypto_skcipher_reqsize(tfm));
@@@ -125,10 -119,6 +125,10 @@@
  		/* AIO operation */
  		sock_hold(sk);
  		areq->iocb = msg->msg_iocb;
 +
 +		/* Remember output size that will be generated. */
 +		areq->outlen = len;
 +
  		skcipher_request_set_callback(&areq->cra_u.skcipher_req,
  					      CRYPTO_TFM_REQ_MAY_SLEEP,
  					      af_alg_async_cb, areq);
@@@ -137,8 -127,12 +137,8 @@@
  			crypto_skcipher_decrypt(&areq->cra_u.skcipher_req);
  
  		/* AIO operation in progress */
 -		if (err == -EINPROGRESS || err == -EBUSY) {
 -			/* Remember output size that will be generated. */
 -			areq->outlen = len;
 -
 +		if (err == -EINPROGRESS || err == -EBUSY)
  			return -EIOCBQUEUED;
 -		}
  
  		sock_put(sk);
  	} else {
@@@ -193,7 -187,6 +193,6 @@@ out
  	return ret;
  }
  
- 
  static struct proto_ops algif_skcipher_ops = {
  	.family		=	PF_ALG,
  
@@@ -390,7 -383,7 +389,7 @@@ static int skcipher_accept_parent_nokey
  	INIT_LIST_HEAD(&ctx->tsgl_list);
  	ctx->len = len;
  	ctx->used = 0;
 -	ctx->rcvused = 0;
 +	atomic_set(&ctx->rcvused, 0);
  	ctx->more = 0;
  	ctx->merge = 0;
  	ctx->enc = 0;
diff --combined drivers/android/binder.c
index a7ecfde66b7b,fdc951083b07..cc89d0d2b965
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c
@@@ -482,8 -482,7 +482,8 @@@ enum binder_deferred_state 
   * @tsk                   task_struct for group_leader of process
   *                        (invariant after initialized)
   * @files                 files_struct for process
 - *                        (invariant after initialized)
 + *                        (protected by @files_lock)
 + * @files_lock            mutex to protect @files
   * @deferred_work_node:   element for binder_deferred_list
   *                        (protected by binder_deferred_lock)
   * @deferred_work:        bitmap of deferred work to perform
@@@ -531,7 -530,6 +531,7 @@@ struct binder_proc 
  	int pid;
  	struct task_struct *tsk;
  	struct files_struct *files;
 +	struct mutex files_lock;
  	struct hlist_node deferred_work_node;
  	int deferred_work;
  	bool is_dead;
@@@ -879,26 -877,20 +879,26 @@@ static void binder_inc_node_tmpref_iloc
  
  static int task_get_unused_fd_flags(struct binder_proc *proc, int flags)
  {
 -	struct files_struct *files = proc->files;
  	unsigned long rlim_cur;
  	unsigned long irqs;
 +	int ret;
  
 -	if (files == NULL)
 -		return -ESRCH;
 -
 -	if (!lock_task_sighand(proc->tsk, &irqs))
 -		return -EMFILE;
 -
 +	mutex_lock(&proc->files_lock);
 +	if (proc->files == NULL) {
 +		ret = -ESRCH;
 +		goto err;
 +	}
 +	if (!lock_task_sighand(proc->tsk, &irqs)) {
 +		ret = -EMFILE;
 +		goto err;
 +	}
  	rlim_cur = task_rlimit(proc->tsk, RLIMIT_NOFILE);
  	unlock_task_sighand(proc->tsk, &irqs);
  
 -	return __alloc_fd(files, 0, rlim_cur, flags);
 +	ret = __alloc_fd(proc->files, 0, rlim_cur, flags);
 +err:
 +	mutex_unlock(&proc->files_lock);
 +	return ret;
  }
  
  /*
@@@ -907,10 -899,8 +907,10 @@@
  static void task_fd_install(
  	struct binder_proc *proc, unsigned int fd, struct file *file)
  {
 +	mutex_lock(&proc->files_lock);
  	if (proc->files)
  		__fd_install(proc->files, fd, file);
 +	mutex_unlock(&proc->files_lock);
  }
  
  /*
@@@ -920,11 -910,9 +920,11 @@@ static long task_close_fd(struct binder
  {
  	int retval;
  
 -	if (proc->files == NULL)
 -		return -ESRCH;
 -
 +	mutex_lock(&proc->files_lock);
 +	if (proc->files == NULL) {
 +		retval = -ESRCH;
 +		goto err;
 +	}
  	retval = __close_fd(proc->files, fd);
  	/* can't restart close syscall because file table entry was cleared */
  	if (unlikely(retval == -ERESTARTSYS ||
@@@ -932,8 -920,7 +932,8 @@@
  		     retval == -ERESTARTNOHAND ||
  		     retval == -ERESTART_RESTARTBLOCK))
  		retval = -EINTR;
 -
 +err:
 +	mutex_unlock(&proc->files_lock);
  	return retval;
  }
  
@@@ -1961,26 -1948,6 +1961,26 @@@ static void binder_send_failed_reply(st
  }
  
  /**
 + * binder_cleanup_transaction() - cleans up undelivered transaction
 + * @t:		transaction that needs to be cleaned up
 + * @reason:	reason the transaction wasn't delivered
 + * @error_code:	error to return to caller (if synchronous call)
 + */
 +static void binder_cleanup_transaction(struct binder_transaction *t,
 +				       const char *reason,
 +				       uint32_t error_code)
 +{
 +	if (t->buffer->target_node && !(t->flags & TF_ONE_WAY)) {
 +		binder_send_failed_reply(t, error_code);
 +	} else {
 +		binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
 +			"undelivered transaction %d, %s\n",
 +			t->debug_id, reason);
 +		binder_free_transaction(t);
 +	}
 +}
 +
 +/**
   * binder_validate_object() - checks for a valid metadata object in a buffer.
   * @buffer:	binder_buffer that we're parsing.
   * @offset:	offset in the buffer at which to validate an object.
@@@ -4048,20 -4015,12 +4048,20 @@@ retry
  		if (put_user(cmd, (uint32_t __user *)ptr)) {
  			if (t_from)
  				binder_thread_dec_tmpref(t_from);
 +
 +			binder_cleanup_transaction(t, "put_user failed",
 +						   BR_FAILED_REPLY);
 +
  			return -EFAULT;
  		}
  		ptr += sizeof(uint32_t);
  		if (copy_to_user(ptr, &tr, sizeof(tr))) {
  			if (t_from)
  				binder_thread_dec_tmpref(t_from);
 +
 +			binder_cleanup_transaction(t, "copy_to_user failed",
 +						   BR_FAILED_REPLY);
 +
  			return -EFAULT;
  		}
  		ptr += sizeof(tr);
@@@ -4131,9 -4090,15 +4131,9 @@@ static void binder_release_work(struct 
  			struct binder_transaction *t;
  
  			t = container_of(w, struct binder_transaction, work);
 -			if (t->buffer->target_node &&
 -			    !(t->flags & TF_ONE_WAY)) {
 -				binder_send_failed_reply(t, BR_DEAD_REPLY);
 -			} else {
 -				binder_debug(BINDER_DEBUG_DEAD_TRANSACTION,
 -					"undelivered transaction %d\n",
 -					t->debug_id);
 -				binder_free_transaction(t);
 -			}
 +
 +			binder_cleanup_transaction(t, "process died.",
 +						   BR_DEAD_REPLY);
  		} break;
  		case BINDER_WORK_RETURN_ERROR: {
  			struct binder_error *e = container_of(
@@@ -4311,7 -4276,7 +4311,7 @@@ static int binder_thread_release(struc
  	return active_transactions;
  }
  
- static unsigned int binder_poll(struct file *filp,
+ static __poll_t binder_poll(struct file *filp,
  				struct poll_table_struct *wait)
  {
  	struct binder_proc *proc = filp->private_data;
@@@ -4640,9 -4605,7 +4640,9 @@@ static int binder_mmap(struct file *fil
  	ret = binder_alloc_mmap_handler(&proc->alloc, vma);
  	if (ret)
  		return ret;
 +	mutex_lock(&proc->files_lock);
  	proc->files = get_files_struct(current);
 +	mutex_unlock(&proc->files_lock);
  	return 0;
  
  err_bad_arg:
@@@ -4666,7 -4629,6 +4666,7 @@@ static int binder_open(struct inode *no
  	spin_lock_init(&proc->outer_lock);
  	get_task_struct(current->group_leader);
  	proc->tsk = current->group_leader;
 +	mutex_init(&proc->files_lock);
  	INIT_LIST_HEAD(&proc->todo);
  	proc->default_priority = task_nice(current);
  	binder_dev = container_of(filp->private_data, struct binder_device,
@@@ -4919,11 -4881,9 +4919,11 @@@ static void binder_deferred_func(struc
  
  		files = NULL;
  		if (defer & BINDER_DEFERRED_PUT_FILES) {
 +			mutex_lock(&proc->files_lock);
  			files = proc->files;
  			if (files)
  				proc->files = NULL;
 +			mutex_unlock(&proc->files_lock);
  		}
  
  		if (defer & BINDER_DEFERRED_FLUSH)
diff --combined drivers/gpio/gpiolib.c
index 44332b793718,46824c486e1e..a751fa4c722e
--- a/drivers/gpio/gpiolib.c
+++ b/drivers/gpio/gpiolib.c
@@@ -73,8 -73,7 +73,8 @@@ LIST_HEAD(gpio_devices)
  
  static void gpiochip_free_hogs(struct gpio_chip *chip);
  static int gpiochip_add_irqchip(struct gpio_chip *gpiochip,
 -				struct lock_class_key *key);
 +				struct lock_class_key *lock_key,
 +				struct lock_class_key *request_key);
  static void gpiochip_irqchip_remove(struct gpio_chip *gpiochip);
  static int gpiochip_irqchip_init_valid_mask(struct gpio_chip *gpiochip);
  static void gpiochip_irqchip_free_valid_mask(struct gpio_chip *gpiochip);
@@@ -604,11 -603,11 +604,11 @@@ struct lineevent_state 
  	(GPIOEVENT_REQUEST_RISING_EDGE | \
  	GPIOEVENT_REQUEST_FALLING_EDGE)
  
- static unsigned int lineevent_poll(struct file *filep,
+ static __poll_t lineevent_poll(struct file *filep,
  				   struct poll_table_struct *wait)
  {
  	struct lineevent_state *le = filep->private_data;
- 	unsigned int events = 0;
+ 	__poll_t events = 0;
  
  	poll_wait(filep, &le->wait, wait);
  
@@@ -1101,8 -1100,7 +1101,8 @@@ static void gpiochip_setup_devs(void
  }
  
  int gpiochip_add_data_with_key(struct gpio_chip *chip, void *data,
 -			       struct lock_class_key *key)
 +			       struct lock_class_key *lock_key,
 +			       struct lock_class_key *request_key)
  {
  	unsigned long	flags;
  	int		status = 0;
@@@ -1248,7 -1246,7 +1248,7 @@@
  	if (status)
  		goto err_remove_from_list;
  
 -	status = gpiochip_add_irqchip(chip, key);
 +	status = gpiochip_add_irqchip(chip, lock_key, request_key);
  	if (status)
  		goto err_remove_chip;
  
@@@ -1634,7 -1632,7 +1634,7 @@@ int gpiochip_irq_map(struct irq_domain 
  	 * This lock class tells lockdep that GPIO irqs are in a different
  	 * category than their parents, so it won't report false recursion.
  	 */
 -	irq_set_lockdep_class(irq, chip->irq.lock_key);
 +	irq_set_lockdep_class(irq, chip->irq.lock_key, chip->irq.request_key);
  	irq_set_chip_and_handler(irq, chip->irq.chip, chip->irq.handler);
  	/* Chips that use nested thread handlers have them marked */
  	if (chip->irq.threaded)
@@@ -1714,12 -1712,10 +1714,12 @@@ static int gpiochip_to_irq(struct gpio_
  /**
   * gpiochip_add_irqchip() - adds an IRQ chip to a GPIO chip
   * @gpiochip: the GPIO chip to add the IRQ chip to
 - * @lock_key: lockdep class
 + * @lock_key: lockdep class for IRQ lock
 + * @request_key: lockdep class for IRQ request
   */
  static int gpiochip_add_irqchip(struct gpio_chip *gpiochip,
 -				struct lock_class_key *lock_key)
 +				struct lock_class_key *lock_key,
 +				struct lock_class_key *request_key)
  {
  	struct irq_chip *irqchip = gpiochip->irq.chip;
  	const struct irq_domain_ops *ops;
@@@ -1757,7 -1753,6 +1757,7 @@@
  	gpiochip->to_irq = gpiochip_to_irq;
  	gpiochip->irq.default_type = type;
  	gpiochip->irq.lock_key = lock_key;
 +	gpiochip->irq.request_key = request_key;
  
  	if (gpiochip->irq.domain_ops)
  		ops = gpiochip->irq.domain_ops;
@@@ -1855,8 -1850,7 +1855,8 @@@ static void gpiochip_irqchip_remove(str
   * @type: the default type for IRQs on this irqchip, pass IRQ_TYPE_NONE
   * to have the core avoid setting up any default type in the hardware.
   * @threaded: whether this irqchip uses a nested thread handler
 - * @lock_key: lockdep class
 + * @lock_key: lockdep class for IRQ lock
 + * @request_key: lockdep class for IRQ request
   *
   * This function closely associates a certain irqchip with a certain
   * gpiochip, providing an irq domain to translate the local IRQs to
@@@ -1878,8 -1872,7 +1878,8 @@@ int gpiochip_irqchip_add_key(struct gpi
  			     irq_flow_handler_t handler,
  			     unsigned int type,
  			     bool threaded,
 -			     struct lock_class_key *lock_key)
 +			     struct lock_class_key *lock_key,
 +			     struct lock_class_key *request_key)
  {
  	struct device_node *of_node;
  
@@@ -1920,7 -1913,6 +1920,7 @@@
  	gpiochip->irq.default_type = type;
  	gpiochip->to_irq = gpiochip_to_irq;
  	gpiochip->irq.lock_key = lock_key;
 +	gpiochip->irq.request_key = request_key;
  	gpiochip->irq.domain = irq_domain_add_simple(of_node,
  					gpiochip->ngpio, first_irq,
  					&gpiochip_domain_ops, gpiochip);
@@@ -1948,8 -1940,7 +1948,8 @@@ EXPORT_SYMBOL_GPL(gpiochip_irqchip_add_
  #else /* CONFIG_GPIOLIB_IRQCHIP */
  
  static inline int gpiochip_add_irqchip(struct gpio_chip *gpiochip,
 -				       struct lock_class_key *key)
 +				       struct lock_class_key *lock_key,
 +				       struct lock_class_key *request_key)
  {
  	return 0;
  }
diff --combined drivers/md/md.c
index 4e4dee0ec2de,e638d7199bd4..cb1476214f3f
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@@ -7605,9 -7605,7 +7605,9 @@@ static int status_resync(struct seq_fil
  		if (test_bit(MD_RECOVERY_DONE, &mddev->recovery))
  			/* Still cleaning up */
  			resync = max_sectors;
 -	} else
 +	} else if (resync > max_sectors)
 +		resync = max_sectors;
 +	else
  		resync -= atomic_read(&mddev->recovery_active);
  
  	if (resync == 0) {
@@@ -7871,10 -7869,10 +7871,10 @@@ static int md_seq_open(struct inode *in
  }
  
  static int md_unloading;
- static unsigned int mdstat_poll(struct file *filp, poll_table *wait)
+ static __poll_t mdstat_poll(struct file *filp, poll_table *wait)
  {
  	struct seq_file *seq = filp->private_data;
- 	int mask;
+ 	__poll_t mask;
  
  	if (md_unloading)
  		return POLLIN|POLLRDNORM|POLLERR|POLLPRI;
diff --combined drivers/media/dvb-core/dvb_ca_en50221.c
index d48b61eb01f4,dbb527a2befc..3f6c8bd8f869
--- a/drivers/media/dvb-core/dvb_ca_en50221.c
+++ b/drivers/media/dvb-core/dvb_ca_en50221.c
@@@ -206,7 -206,7 +206,7 @@@ static int dvb_ca_en50221_write_data(st
   * @hlen: Number of bytes in haystack.
   * @needle: Buffer to find.
   * @nlen: Number of bytes in needle.
 - * @return Pointer into haystack needle was found at, or NULL if not found.
 + * return: Pointer into haystack needle was found at, or NULL if not found.
   */
  static char *findstr(char *haystack, int hlen, char *needle, int nlen)
  {
@@@ -226,7 -226,7 +226,7 @@@
  /* ************************************************************************** */
  /* EN50221 physical interface functions */
  
 -/**
 +/*
   * dvb_ca_en50221_check_camstatus - Check CAM status.
   */
  static int dvb_ca_en50221_check_camstatus(struct dvb_ca_private *ca, int slot)
@@@ -275,9 -275,9 +275,9 @@@
   * @ca: CA instance.
   * @slot: Slot on interface.
   * @waitfor: Flags to wait for.
 - * @timeout_ms: Timeout in milliseconds.
 + * @timeout_hz: Timeout in milliseconds.
   *
 - * @return 0 on success, nonzero on error.
 + * return: 0 on success, nonzero on error.
   */
  static int dvb_ca_en50221_wait_if_status(struct dvb_ca_private *ca, int slot,
  					 u8 waitfor, int timeout_hz)
@@@ -325,7 -325,7 +325,7 @@@
   * @ca: CA instance.
   * @slot: Slot id.
   *
 - * @return 0 on success, nonzero on failure.
 + * return: 0 on success, nonzero on failure.
   */
  static int dvb_ca_en50221_link_init(struct dvb_ca_private *ca, int slot)
  {
@@@ -397,11 -397,11 +397,11 @@@
   * @ca: CA instance.
   * @slot: Slot id.
   * @address: Address to read from. Updated.
 - * @tupleType: Tuple id byte. Updated.
 - * @tupleLength: Tuple length. Updated.
 + * @tuple_type: Tuple id byte. Updated.
 + * @tuple_length: Tuple length. Updated.
   * @tuple: Dest buffer for tuple (must be 256 bytes). Updated.
   *
 - * @return 0 on success, nonzero on error.
 + * return: 0 on success, nonzero on error.
   */
  static int dvb_ca_en50221_read_tuple(struct dvb_ca_private *ca, int slot,
  				     int *address, int *tuple_type,
@@@ -455,7 -455,7 +455,7 @@@
   * @ca: CA instance.
   * @slot: Slot id.
   *
 - * @return 0 on success, <0 on failure.
 + * return: 0 on success, <0 on failure.
   */
  static int dvb_ca_en50221_parse_attributes(struct dvb_ca_private *ca, int slot)
  {
@@@ -632,11 -632,10 +632,11 @@@ static int dvb_ca_en50221_set_configopt
   * @ca: CA instance.
   * @slot: Slot to read from.
   * @ebuf: If non-NULL, the data will be written to this buffer. If NULL,
 - * the data will be added into the buffering system as a normal fragment.
 + *	  the data will be added into the buffering system as a normal
 + *	  fragment.
   * @ecount: Size of ebuf. Ignored if ebuf is NULL.
   *
 - * @return Number of bytes read, or < 0 on error
 + * return: Number of bytes read, or < 0 on error
   */
  static int dvb_ca_en50221_read_data(struct dvb_ca_private *ca, int slot,
  				    u8 *ebuf, int ecount)
@@@ -785,11 -784,11 +785,11 @@@ exit
   *
   * @ca: CA instance.
   * @slot: Slot to write to.
 - * @ebuf: The data in this buffer is treated as a complete link-level packet to
 - * be written.
 - * @count: Size of ebuf.
 + * @buf: The data in this buffer is treated as a complete link-level packet to
 + * 	 be written.
 + * @bytes_write: Size of ebuf.
   *
 - * @return Number of bytes written, or < 0 on error.
 + * return: Number of bytes written, or < 0 on error.
   */
  static int dvb_ca_en50221_write_data(struct dvb_ca_private *ca, int slot,
  				     u8 *buf, int bytes_write)
@@@ -934,7 -933,7 +934,7 @@@ static int dvb_ca_en50221_slot_shutdown
  /**
   * dvb_ca_en50221_camchange_irq - A CAMCHANGE IRQ has occurred.
   *
 - * @ca: CA instance.
 + * @pubca: CA instance.
   * @slot: Slot concerned.
   * @change_type: One of the DVB_CA_CAMCHANGE_* values.
   */
@@@ -964,7 -963,7 +964,7 @@@ EXPORT_SYMBOL(dvb_ca_en50221_camchange_
  /**
   * dvb_ca_en50221_camready_irq - A CAMREADY IRQ has occurred.
   *
 - * @ca: CA instance.
 + * @pubca: CA instance.
   * @slot: Slot concerned.
   */
  void dvb_ca_en50221_camready_irq(struct dvb_ca_en50221 *pubca, int slot)
@@@ -984,7 -983,7 +984,7 @@@ EXPORT_SYMBOL(dvb_ca_en50221_camready_i
  /**
   * dvb_ca_en50221_frda_irq - An FR or DA IRQ has occurred.
   *
 - * @ca: CA instance.
 + * @pubca: CA instance.
   * @slot: Slot concerned.
   */
  void dvb_ca_en50221_frda_irq(struct dvb_ca_en50221 *pubca, int slot)
@@@ -1092,7 -1091,7 +1092,7 @@@ static void dvb_ca_en50221_thread_updat
   *
   * @ca: CA instance.
   * @slot: Slot to process.
 - * @return: 0 .. no change
 + * return:: 0 .. no change
   *          1 .. CAM state changed
   */
  
@@@ -1297,7 -1296,7 +1297,7 @@@ static void dvb_ca_en50221_thread_state
  	mutex_unlock(&sl->slot_lock);
  }
  
 -/**
 +/*
   * Kernel thread which monitors CA slots for CAM changes, and performs data
   * transfers.
   */
@@@ -1337,11 -1336,12 +1337,11 @@@ static int dvb_ca_en50221_thread(void *
   * Real ioctl implementation.
   * NOTE: CA_SEND_MSG/CA_GET_MSG ioctls have userspace buffers passed to them.
   *
 - * @inode: Inode concerned.
   * @file: File concerned.
   * @cmd: IOCTL command.
 - * @arg: Associated argument.
 + * @parg: Associated argument.
   *
 - * @return 0 on success, <0 on error.
 + * return: 0 on success, <0 on error.
   */
  static int dvb_ca_en50221_io_do_ioctl(struct file *file,
  				      unsigned int cmd, void *parg)
@@@ -1420,11 -1420,12 +1420,11 @@@ out_unlock
  /**
   * Wrapper for ioctl implementation.
   *
 - * @inode: Inode concerned.
   * @file: File concerned.
   * @cmd: IOCTL command.
   * @arg: Associated argument.
   *
 - * @return 0 on success, <0 on error.
 + * return: 0 on success, <0 on error.
   */
  static long dvb_ca_en50221_io_ioctl(struct file *file,
  				    unsigned int cmd, unsigned long arg)
@@@ -1440,7 -1441,7 +1440,7 @@@
   * @count: Size of source buffer.
   * @ppos: Position in file (ignored).
   *
 - * @return Number of bytes read, or <0 on error.
 + * return: Number of bytes read, or <0 on error.
   */
  static ssize_t dvb_ca_en50221_io_write(struct file *file,
  				       const char __user *buf, size_t count,
@@@ -1535,7 -1536,7 +1535,7 @@@ exit
  	return status;
  }
  
 -/**
 +/*
   * Condition for waking up in dvb_ca_en50221_io_read_condition
   */
  static int dvb_ca_en50221_io_read_condition(struct dvb_ca_private *ca,
@@@ -1592,7 -1593,7 +1592,7 @@@ nextslot
   * @count: Size of destination buffer.
   * @ppos: Position in file (ignored).
   *
 - * @return Number of bytes read, or <0 on error.
 + * return: Number of bytes read, or <0 on error.
   */
  static ssize_t dvb_ca_en50221_io_read(struct file *file, char __user *buf,
  				      size_t count, loff_t *ppos)
@@@ -1701,7 -1702,7 +1701,7 @@@ exit
   * @inode: Inode concerned.
   * @file: File concerned.
   *
 - * @return 0 on success, <0 on failure.
 + * return: 0 on success, <0 on failure.
   */
  static int dvb_ca_en50221_io_open(struct inode *inode, struct file *file)
  {
@@@ -1751,7 -1752,7 +1751,7 @@@
   * @inode: Inode concerned.
   * @file: File concerned.
   *
 - * @return 0 on success, <0 on failure.
 + * return: 0 on success, <0 on failure.
   */
  static int dvb_ca_en50221_io_release(struct inode *inode, struct file *file)
  {
@@@ -1780,13 -1781,13 +1780,13 @@@
   * @file: File concerned.
   * @wait: poll wait table.
   *
 - * @return Standard poll mask.
 + * return: Standard poll mask.
   */
- static unsigned int dvb_ca_en50221_io_poll(struct file *file, poll_table *wait)
+ static __poll_t dvb_ca_en50221_io_poll(struct file *file, poll_table *wait)
  {
  	struct dvb_device *dvbdev = file->private_data;
  	struct dvb_ca_private *ca = dvbdev->priv;
- 	unsigned int mask = 0;
+ 	__poll_t mask = 0;
  	int slot;
  	int result = 0;
  
@@@ -1837,11 -1838,11 +1837,11 @@@ static const struct dvb_device dvbdev_c
   * Initialise a new DVB CA EN50221 interface device.
   *
   * @dvb_adapter: DVB adapter to attach the new CA device to.
 - * @ca: The dvb_ca instance.
 + * @pubca: The dvb_ca instance.
   * @flags: Flags describing the CA device (DVB_CA_FLAG_*).
   * @slot_count: Number of slots supported.
   *
 - * @return 0 on success, nonzero on failure
 + * return: 0 on success, nonzero on failure
   */
  int dvb_ca_en50221_init(struct dvb_adapter *dvb_adapter,
  			struct dvb_ca_en50221 *pubca, int flags, int slot_count)
@@@ -1928,7 -1929,8 +1928,7 @@@ EXPORT_SYMBOL(dvb_ca_en50221_init)
  /**
   * Release a DVB CA EN50221 interface device.
   *
 - * @ca_dev: The dvb_device_t instance for the CA device.
 - * @ca: The associated dvb_ca instance.
 + * @pubca: The associated dvb_ca instance.
   */
  void dvb_ca_en50221_release(struct dvb_ca_en50221 *pubca)
  {
diff --combined drivers/media/dvb-core/dvb_frontend.c
index 2afaa8226342,92e2433415f0..48e16fd003a7
--- a/drivers/media/dvb-core/dvb_frontend.c
+++ b/drivers/media/dvb-core/dvb_frontend.c
@@@ -369,14 -369,11 +369,14 @@@ static void dvb_frontend_swzigzag_updat
  }
  
  /**
 - * Performs automatic twiddling of frontend parameters.
 + * dvb_frontend_swzigzag_autotune - Performs automatic twiddling of frontend
 + *	parameters.
   *
 - * @param fe The frontend concerned.
 - * @param check_wrapped Checks if an iteration has completed. DO NOT SET ON THE FIRST ATTEMPT
 - * @returns Number of complete iterations that have been performed.
 + * @fe: The frontend concerned.
 + * @check_wrapped: Checks if an iteration has completed.
 + *		   DO NOT SET ON THE FIRST ATTEMPT.
 + *
 + * return: Number of complete iterations that have been performed.
   */
  static int dvb_frontend_swzigzag_autotune(struct dvb_frontend *fe, int check_wrapped)
  {
@@@ -1256,7 -1253,7 +1256,7 @@@ dtv_property_legacy_params_sync(struct 
   * dtv_get_frontend - calls a callback for retrieving DTV parameters
   * @fe:		struct dvb_frontend pointer
   * @c:		struct dtv_frontend_properties pointer (DVBv5 cache)
 - * @p_out	struct dvb_frontend_parameters pointer (DVBv3 FE struct)
 + * @p_out:	struct dvb_frontend_parameters pointer (DVBv3 FE struct)
   *
   * This routine calls either the DVBv3 or DVBv5 get_frontend call.
   * If c is not null, it will update the DVBv5 cache struct pointed by it.
@@@ -2470,7 -2467,7 +2470,7 @@@ static int dvb_frontend_handle_ioctl(st
  }
  
  
- static unsigned int dvb_frontend_poll(struct file *file, struct poll_table_struct *wait)
+ static __poll_t dvb_frontend_poll(struct file *file, struct poll_table_struct *wait)
  {
  	struct dvb_device *dvbdev = file->private_data;
  	struct dvb_frontend *fe = dvbdev->priv;
diff --combined drivers/media/platform/sh_veu.c
index dedc1b024f6f,15cf51f5d280..976ea0bb5b6c
--- a/drivers/media/platform/sh_veu.c
+++ b/drivers/media/platform/sh_veu.c
@@@ -267,7 -267,7 +267,7 @@@ static void sh_veu_process(struct sh_ve
  	sh_veu_reg_write(veu, VEU_EIER, 1); /* enable interrupt in VEU */
  }
  
 -/**
 +/*
   * sh_veu_device_run() - prepares and starts the device
   *
   * This will be called by the framework when it decides to schedule a particular
@@@ -1016,7 -1016,7 +1016,7 @@@ static int sh_veu_release(struct file *
  	return 0;
  }
  
- static unsigned int sh_veu_poll(struct file *file,
+ static __poll_t sh_veu_poll(struct file *file,
  				struct poll_table_struct *wait)
  {
  	struct sh_veu_file *veu_file = file->private_data;
diff --combined drivers/media/radio/radio-si476x.c
index 540ac887a63c,248bd0ffc978..49293dd707b9
--- a/drivers/media/radio/radio-si476x.c
+++ b/drivers/media/radio/radio-si476x.c
@@@ -158,7 -158,7 +158,7 @@@ enum si476x_ctrl_idx 
  };
  static struct v4l2_ctrl_config si476x_ctrls[] = {
  
 -	/**
 +	/*
  	 * SI476X during its station seeking(or tuning) process uses several
  	 * parameters to detrmine if "the station" is valid:
  	 *
@@@ -197,7 -197,7 +197,7 @@@
  		.step	= 2,
  	},
  
 -	/**
 +	/*
  	 * #V4L2_CID_SI476X_HARMONICS_COUNT -- number of harmonics
  	 * built-in power-line noise supression filter is to reject
  	 * during AM-mode operation.
@@@ -213,7 -213,7 +213,7 @@@
  		.step	= 1,
  	},
  
 -	/**
 +	/*
  	 * #V4L2_CID_SI476X_DIVERSITY_MODE -- configuration which
  	 * two tuners working in diversity mode are to work in.
  	 *
@@@ -237,7 -237,7 +237,7 @@@
  		.max	= ARRAY_SIZE(phase_diversity_modes) - 1,
  	},
  
 -	/**
 +	/*
  	 * #V4L2_CID_SI476X_INTERCHIP_LINK -- inter-chip link in
  	 * diversity mode indicator. Allows user to determine if two
  	 * chips working in diversity mode have established a link
@@@ -296,15 -296,11 +296,15 @@@ struct si476x_radio_ops 
  /**
   * struct si476x_radio - radio device
   *
 - * @core: Pointer to underlying core device
 + * @v4l2dev: Pointer to V4L2 device created by V4L2 subsystem
   * @videodev: Pointer to video device created by V4L2 subsystem
 + * @ctrl_handler: V4L2 controls handler
 + * @core: Pointer to underlying core device
   * @ops: Vtable of functions. See struct si476x_radio_ops for details
 - * @kref: Reference counter
 - * @core_lock: An r/w semaphore to brebvent the deletion of underlying
 + * @debugfs: pointer to &strucd dentry for debugfs
 + * @audmode: audio mode, as defined for the rxsubchans field
 + *	     at videodev2.h
 + *
   * core structure is the radio device is being used
   */
  struct si476x_radio {
@@@ -1153,12 -1149,12 +1153,12 @@@ static ssize_t si476x_radio_fops_read(s
  	return rval;
  }
  
- static unsigned int si476x_radio_fops_poll(struct file *file,
+ static __poll_t si476x_radio_fops_poll(struct file *file,
  				struct poll_table_struct *pts)
  {
  	struct si476x_radio *radio = video_drvdata(file);
- 	unsigned long req_events = poll_requested_events(pts);
- 	unsigned int err = v4l2_ctrl_poll(file, pts);
+ 	__poll_t req_events = poll_requested_events(pts);
+ 	__poll_t err = v4l2_ctrl_poll(file, pts);
  
  	if (req_events & (POLLIN | POLLRDNORM)) {
  		if (atomic_read(&radio->core->is_alive))
diff --combined drivers/media/radio/radio-wl1273.c
index 3cbdc085c65d,4cd4241fc7be..f92b0f9241a9
--- a/drivers/media/radio/radio-wl1273.c
+++ b/drivers/media/radio/radio-wl1273.c
@@@ -1089,7 -1089,7 +1089,7 @@@ out
  	return r;
  }
  
- static unsigned int wl1273_fm_fops_poll(struct file *file,
+ static __poll_t wl1273_fm_fops_poll(struct file *file,
  					struct poll_table_struct *pts)
  {
  	struct wl1273_device *radio = video_get_drvdata(video_devdata(file));
@@@ -1330,7 -1330,7 +1330,7 @@@ static int wl1273_fm_vidioc_s_input(str
  
  /**
   * wl1273_fm_set_tx_power() -	Set the transmission power value.
 - * @core:			A pointer to the device struct.
 + * @radio:			A pointer to the device struct.
   * @power:			The new power value.
   */
  static int wl1273_fm_set_tx_power(struct wl1273_device *radio, u16 power)
diff --combined drivers/media/v4l2-core/v4l2-mem2mem.c
index bc580fbe18fa,a879d11866bd..186156f8952a
--- a/drivers/media/v4l2-core/v4l2-mem2mem.c
+++ b/drivers/media/v4l2-core/v4l2-mem2mem.c
@@@ -183,7 -183,6 +183,7 @@@ EXPORT_SYMBOL(v4l2_m2m_get_curr_priv)
  
  /**
   * v4l2_m2m_try_run() - select next job to perform and run it if possible
 + * @m2m_dev: per-device context
   *
   * Get next transaction (if present) from the waiting jobs list and run it.
   */
@@@ -282,7 -281,6 +282,7 @@@ EXPORT_SYMBOL_GPL(v4l2_m2m_try_schedule
  
  /**
   * v4l2_m2m_cancel_job() - cancel pending jobs for the context
 + * @m2m_ctx: m2m context with jobs to be canceled
   *
   * In case of streamoff or release called on any context,
   * 1] If the context is currently running, then abort job will be called
@@@ -500,14 -498,14 +500,14 @@@ int v4l2_m2m_streamoff(struct file *fil
  }
  EXPORT_SYMBOL_GPL(v4l2_m2m_streamoff);
  
- unsigned int v4l2_m2m_poll(struct file *file, struct v4l2_m2m_ctx *m2m_ctx,
+ __poll_t v4l2_m2m_poll(struct file *file, struct v4l2_m2m_ctx *m2m_ctx,
  			   struct poll_table_struct *wait)
  {
  	struct video_device *vfd = video_devdata(file);
- 	unsigned long req_events = poll_requested_events(wait);
+ 	__poll_t req_events = poll_requested_events(wait);
  	struct vb2_queue *src_q, *dst_q;
  	struct vb2_buffer *src_vb = NULL, *dst_vb = NULL;
- 	unsigned int rc = 0;
+ 	__poll_t rc = 0;
  	unsigned long flags;
  
  	if (test_bit(V4L2_FL_USES_V4L2_FH, &vfd->flags)) {
@@@ -794,11 -792,11 +794,11 @@@ int v4l2_m2m_fop_mmap(struct file *file
  }
  EXPORT_SYMBOL_GPL(v4l2_m2m_fop_mmap);
  
- unsigned int v4l2_m2m_fop_poll(struct file *file, poll_table *wait)
+ __poll_t v4l2_m2m_fop_poll(struct file *file, poll_table *wait)
  {
  	struct v4l2_fh *fh = file->private_data;
  	struct v4l2_m2m_ctx *m2m_ctx = fh->m2m_ctx;
- 	unsigned int ret;
+ 	__poll_t ret;
  
  	if (m2m_ctx->q_lock)
  		mutex_lock(m2m_ctx->q_lock);
diff --combined drivers/media/v4l2-core/videobuf-core.c
index e87fb13b22dc,0c5b12b8bb52..9a89d3ae170f
--- a/drivers/media/v4l2-core/videobuf-core.c
+++ b/drivers/media/v4l2-core/videobuf-core.c
@@@ -222,7 -222,7 +222,7 @@@ int videobuf_queue_is_busy(struct video
  }
  EXPORT_SYMBOL_GPL(videobuf_queue_is_busy);
  
 -/**
 +/*
   * __videobuf_free() - free all the buffers and their control structures
   *
   * This function can only be called if streaming/reading is off, i.e. no buffers
@@@ -1118,13 -1118,13 +1118,13 @@@ done
  }
  EXPORT_SYMBOL_GPL(videobuf_read_stream);
  
- unsigned int videobuf_poll_stream(struct file *file,
+ __poll_t videobuf_poll_stream(struct file *file,
  				  struct videobuf_queue *q,
  				  poll_table *wait)
  {
- 	unsigned long req_events = poll_requested_events(wait);
+ 	__poll_t req_events = poll_requested_events(wait);
  	struct videobuf_buffer *buf = NULL;
- 	unsigned int rc = 0;
+ 	__poll_t rc = 0;
  
  	videobuf_queue_lock(q);
  	if (q->streaming) {
diff --combined drivers/media/v4l2-core/videobuf2-core.c
index a8589d96ef72,dc1f683c3b71..0d9f772d6d03
--- a/drivers/media/v4l2-core/videobuf2-core.c
+++ b/drivers/media/v4l2-core/videobuf2-core.c
@@@ -188,7 -188,7 +188,7 @@@ module_param(debug, int, 0644)
  static void __vb2_queue_cancel(struct vb2_queue *q);
  static void __enqueue_in_driver(struct vb2_buffer *vb);
  
 -/**
 +/*
   * __vb2_buf_mem_alloc() - allocate video memory for the given buffer
   */
  static int __vb2_buf_mem_alloc(struct vb2_buffer *vb)
@@@ -229,7 -229,7 +229,7 @@@ free
  	return ret;
  }
  
 -/**
 +/*
   * __vb2_buf_mem_free() - free memory of the given buffer
   */
  static void __vb2_buf_mem_free(struct vb2_buffer *vb)
@@@ -243,7 -243,7 +243,7 @@@
  	}
  }
  
 -/**
 +/*
   * __vb2_buf_userptr_put() - release userspace memory associated with
   * a USERPTR buffer
   */
@@@ -258,7 -258,7 +258,7 @@@ static void __vb2_buf_userptr_put(struc
  	}
  }
  
 -/**
 +/*
   * __vb2_plane_dmabuf_put() - release memory associated with
   * a DMABUF shared plane
   */
@@@ -277,7 -277,7 +277,7 @@@ static void __vb2_plane_dmabuf_put(stru
  	p->dbuf_mapped = 0;
  }
  
 -/**
 +/*
   * __vb2_buf_dmabuf_put() - release memory associated with
   * a DMABUF shared buffer
   */
@@@ -289,7 -289,7 +289,7 @@@ static void __vb2_buf_dmabuf_put(struc
  		__vb2_plane_dmabuf_put(vb, &vb->planes[plane]);
  }
  
 -/**
 +/*
   * __setup_offsets() - setup unique offsets ("cookies") for every plane in
   * the buffer.
   */
@@@ -317,7 -317,7 +317,7 @@@ static void __setup_offsets(struct vb2_
  	}
  }
  
 -/**
 +/*
   * __vb2_queue_alloc() - allocate videobuf buffer structures and (for MMAP type)
   * video buffer memory for all buffers/planes on the queue and initializes the
   * queue
@@@ -386,7 -386,7 +386,7 @@@ static int __vb2_queue_alloc(struct vb2
  	return buffer;
  }
  
 -/**
 +/*
   * __vb2_free_mem() - release all video buffer memory for a given queue
   */
  static void __vb2_free_mem(struct vb2_queue *q, unsigned int buffers)
@@@ -410,7 -410,7 +410,7 @@@
  	}
  }
  
 -/**
 +/*
   * __vb2_queue_free() - free buffers at the end of the queue - video memory and
   * related information, if no buffers are left return the queue to an
   * uninitialized state. Might be called even if the queue has already been freed.
@@@ -544,7 -544,7 +544,7 @@@ bool vb2_buffer_in_use(struct vb2_queu
  }
  EXPORT_SYMBOL(vb2_buffer_in_use);
  
 -/**
 +/*
   * __buffers_in_use() - return true if any buffers on the queue are in use and
   * the queue cannot be freed (by the means of REQBUFS(0)) call
   */
@@@ -564,7 -564,7 +564,7 @@@ void vb2_core_querybuf(struct vb2_queu
  }
  EXPORT_SYMBOL_GPL(vb2_core_querybuf);
  
 -/**
 +/*
   * __verify_userptr_ops() - verify that all memory operations required for
   * USERPTR queue type have been provided
   */
@@@ -577,7 -577,7 +577,7 @@@ static int __verify_userptr_ops(struct 
  	return 0;
  }
  
 -/**
 +/*
   * __verify_mmap_ops() - verify that all memory operations required for
   * MMAP queue type have been provided
   */
@@@ -590,7 -590,7 +590,7 @@@ static int __verify_mmap_ops(struct vb2
  	return 0;
  }
  
 -/**
 +/*
   * __verify_dmabuf_ops() - verify that all memory operations required for
   * DMABUF queue type have been provided
   */
@@@ -953,7 -953,7 +953,7 @@@ void vb2_discard_done(struct vb2_queue 
  }
  EXPORT_SYMBOL_GPL(vb2_discard_done);
  
 -/**
 +/*
   * __prepare_mmap() - prepare an MMAP buffer
   */
  static int __prepare_mmap(struct vb2_buffer *vb, const void *pb)
@@@ -966,7 -966,7 +966,7 @@@
  	return ret ? ret : call_vb_qop(vb, buf_prepare, vb);
  }
  
 -/**
 +/*
   * __prepare_userptr() - prepare a USERPTR buffer
   */
  static int __prepare_userptr(struct vb2_buffer *vb, const void *pb)
@@@ -1082,7 -1082,7 +1082,7 @@@ err
  	return ret;
  }
  
 -/**
 +/*
   * __prepare_dmabuf() - prepare a DMABUF buffer
   */
  static int __prepare_dmabuf(struct vb2_buffer *vb, const void *pb)
@@@ -1215,7 -1215,7 +1215,7 @@@ err
  	return ret;
  }
  
 -/**
 +/*
   * __enqueue_in_driver() - enqueue a vb2_buffer in driver for processing
   */
  static void __enqueue_in_driver(struct vb2_buffer *vb)
@@@ -1298,7 -1298,7 +1298,7 @@@ int vb2_core_prepare_buf(struct vb2_que
  }
  EXPORT_SYMBOL_GPL(vb2_core_prepare_buf);
  
 -/**
 +/*
   * vb2_start_streaming() - Attempt to start streaming.
   * @q:		videobuf2 queue
   *
@@@ -1427,7 -1427,7 +1427,7 @@@ int vb2_core_qbuf(struct vb2_queue *q, 
  }
  EXPORT_SYMBOL_GPL(vb2_core_qbuf);
  
 -/**
 +/*
   * __vb2_wait_for_done_vb() - wait for a buffer to become available
   * for dequeuing
   *
@@@ -1502,7 -1502,7 +1502,7 @@@ static int __vb2_wait_for_done_vb(struc
  	return 0;
  }
  
 -/**
 +/*
   * __vb2_get_done_vb() - get a buffer ready for dequeuing
   *
   * Will sleep if required for nonblocking == false.
@@@ -1553,7 -1553,7 +1553,7 @@@ int vb2_wait_for_all_buffers(struct vb2
  }
  EXPORT_SYMBOL_GPL(vb2_wait_for_all_buffers);
  
 -/**
 +/*
   * __vb2_dqbuf() - bring back the buffer to the DEQUEUED state
   */
  static void __vb2_dqbuf(struct vb2_buffer *vb)
@@@ -1625,7 -1625,7 +1625,7 @@@ int vb2_core_dqbuf(struct vb2_queue *q
  }
  EXPORT_SYMBOL_GPL(vb2_core_dqbuf);
  
 -/**
 +/*
   * __vb2_queue_cancel() - cancel and stop (pause) streaming
   *
   * Removes all queued buffers from driver's queue and all buffers queued by
@@@ -1773,7 -1773,7 +1773,7 @@@ int vb2_core_streamoff(struct vb2_queu
  }
  EXPORT_SYMBOL_GPL(vb2_core_streamoff);
  
 -/**
 +/*
   * __find_plane_by_offset() - find plane associated with the given offset off
   */
  static int __find_plane_by_offset(struct vb2_queue *q, unsigned long off,
@@@ -2018,10 -2018,10 +2018,10 @@@ void vb2_core_queue_release(struct vb2_
  }
  EXPORT_SYMBOL_GPL(vb2_core_queue_release);
  
- unsigned int vb2_core_poll(struct vb2_queue *q, struct file *file,
+ __poll_t vb2_core_poll(struct vb2_queue *q, struct file *file,
  		poll_table *wait)
  {
- 	unsigned long req_events = poll_requested_events(wait);
+ 	__poll_t req_events = poll_requested_events(wait);
  	struct vb2_buffer *vb = NULL;
  	unsigned long flags;
  
@@@ -2104,7 -2104,7 +2104,7 @@@
  }
  EXPORT_SYMBOL_GPL(vb2_core_poll);
  
 -/**
 +/*
   * struct vb2_fileio_buf - buffer context used by file io emulator
   *
   * vb2 provides a compatibility layer and emulator of file io (read and
@@@ -2118,7 -2118,7 +2118,7 @@@ struct vb2_fileio_buf 
  	unsigned int queued:1;
  };
  
 -/**
 +/*
   * struct vb2_fileio_data - queue context used by file io emulator
   *
   * @cur_index:	the index of the buffer currently being read from or
@@@ -2155,7 -2155,7 +2155,7 @@@ struct vb2_fileio_data 
  	unsigned write_immediately:1;
  };
  
 -/**
 +/*
   * __vb2_init_fileio() - initialize file io emulator
   * @q:		videobuf2 queue
   * @read:	mode selector (1 means read, 0 means write)
@@@ -2274,7 -2274,7 +2274,7 @@@ err_kfree
  	return ret;
  }
  
 -/**
 +/*
   * __vb2_cleanup_fileio() - free resourced used by file io emulator
   * @q:		videobuf2 queue
   */
@@@ -2293,7 -2293,7 +2293,7 @@@ static int __vb2_cleanup_fileio(struct 
  	return 0;
  }
  
 -/**
 +/*
   * __vb2_perform_fileio() - perform a single file io (read or write) operation
   * @q:		videobuf2 queue
   * @data:	pointed to target userspace buffer
diff --combined drivers/media/v4l2-core/videobuf2-v4l2.c
index 4075314a6989,d2b3a74d14fd..a49f7eb98c2e
--- a/drivers/media/v4l2-core/videobuf2-v4l2.c
+++ b/drivers/media/v4l2-core/videobuf2-v4l2.c
@@@ -49,7 -49,7 +49,7 @@@ module_param(debug, int, 0644)
  #define V4L2_BUFFER_OUT_FLAGS	(V4L2_BUF_FLAG_PFRAME | V4L2_BUF_FLAG_BFRAME | \
  				 V4L2_BUF_FLAG_KEYFRAME | V4L2_BUF_FLAG_TIMECODE)
  
 -/**
 +/*
   * __verify_planes_array() - verify that the planes array passed in struct
   * v4l2_buffer from userspace can be safely used
   */
@@@ -78,7 -78,7 +78,7 @@@ static int __verify_planes_array_core(s
  	return __verify_planes_array(vb, pb);
  }
  
 -/**
 +/*
   * __verify_length() - Verify that the bytesused value for each plane fits in
   * the plane length and that the data offset doesn't exceed the bytesused value.
   */
@@@ -181,7 -181,7 +181,7 @@@ static int vb2_queue_or_prepare_buf(str
  	return __verify_planes_array(q->bufs[b->index], b);
  }
  
 -/**
 +/*
   * __fill_v4l2_buffer() - fill in a struct v4l2_buffer with information to be
   * returned to userspace
   */
@@@ -286,7 -286,7 +286,7 @@@ static void __fill_v4l2_buffer(struct v
  		q->last_buffer_dequeued = true;
  }
  
 -/**
 +/*
   * __fill_vb2_buffer() - fill a vb2_buffer with information provided in a
   * v4l2_buffer by the userspace. It also verifies that struct
   * v4l2_buffer has a valid number of planes.
@@@ -446,7 -446,7 +446,7 @@@ static const struct vb2_buf_ops v4l2_bu
  	.copy_timestamp		= __copy_timestamp,
  };
  
 -/**
 +/*
   * vb2_querybuf() - query video buffer information
   * @q:		videobuf queue
   * @b:		buffer struct passed from userspace to vidioc_querybuf handler
@@@ -671,11 -671,11 +671,11 @@@ void vb2_queue_release(struct vb2_queu
  }
  EXPORT_SYMBOL_GPL(vb2_queue_release);
  
- unsigned int vb2_poll(struct vb2_queue *q, struct file *file, poll_table *wait)
+ __poll_t vb2_poll(struct vb2_queue *q, struct file *file, poll_table *wait)
  {
  	struct video_device *vfd = video_devdata(file);
- 	unsigned long req_events = poll_requested_events(wait);
- 	unsigned int res = 0;
+ 	__poll_t req_events = poll_requested_events(wait);
+ 	__poll_t res = 0;
  
  	if (test_bit(V4L2_FL_USES_V4L2_FH, &vfd->flags)) {
  		struct v4l2_fh *fh = file->private_data;
@@@ -904,12 -904,12 +904,12 @@@ exit
  }
  EXPORT_SYMBOL_GPL(vb2_fop_read);
  
- unsigned int vb2_fop_poll(struct file *file, poll_table *wait)
+ __poll_t vb2_fop_poll(struct file *file, poll_table *wait)
  {
  	struct video_device *vdev = video_devdata(file);
  	struct vb2_queue *q = vdev->queue;
  	struct mutex *lock = q->lock ? q->lock : vdev->lock;
- 	unsigned res;
+ 	__poll_t res;
  	void *fileio;
  
  	/*
diff --combined drivers/net/ethernet/broadcom/tg3.c
index 8995cfefbfcf,5bd4a65a45dd..86ff8b49ee57
--- a/drivers/net/ethernet/broadcom/tg3.c
+++ b/drivers/net/ethernet/broadcom/tg3.c
@@@ -4,13 -4,11 +4,13 @@@
   * Copyright (C) 2001, 2002, 2003, 2004 David S. Miller (davem at redhat.com)
   * Copyright (C) 2001, 2002, 2003 Jeff Garzik (jgarzik at pobox.com)
   * Copyright (C) 2004 Sun Microsystems Inc.
 - * Copyright (C) 2005-2014 Broadcom Corporation.
 + * Copyright (C) 2005-2016 Broadcom Corporation.
 + * Copyright (C) 2016-2017 Broadcom Limited.
   *
   * Firmware is:
   *	Derived from proprietary unpublished source code,
 - *	Copyright (C) 2000-2003 Broadcom Corporation.
 + *	Copyright (C) 2000-2016 Broadcom Corporation.
 + *	Copyright (C) 2016-2017 Broadcom Ltd.
   *
   *	Permission is hereby granted for the distribution of this firmware
   *	data in hexadecimal or equivalent format, provided this copyright
@@@ -3744,7 -3742,7 +3744,7 @@@ static int tg3_load_firmware_cpu(struc
  	}
  
  	do {
- 		u32 *fw_data = (u32 *)(fw_hdr + 1);
+ 		__be32 *fw_data = (__be32 *)(fw_hdr + 1);
  		for (i = 0; i < tg3_fw_data_len(tp, fw_hdr); i++)
  			write_op(tp, cpu_scratch_base +
  				     (be32_to_cpu(fw_hdr->base_addr) & 0xffff) +
@@@ -10054,16 -10052,6 +10054,16 @@@ static int tg3_reset_hw(struct tg3 *tp
  
  	tw32(GRC_MODE, tp->grc_mode | val);
  
 +	/* On one of the AMD platform, MRRS is restricted to 4000 because of
 +	 * south bridge limitation. As a workaround, Driver is setting MRRS
 +	 * to 2048 instead of default 4096.
 +	 */
 +	if (tp->pdev->subsystem_vendor == PCI_VENDOR_ID_DELL &&
 +	    tp->pdev->subsystem_device == TG3PCI_SUBDEVICE_ID_DELL_5762) {
 +		val = tr32(TG3PCI_DEV_STATUS_CTRL) & ~MAX_READ_REQ_MASK;
 +		tw32(TG3PCI_DEV_STATUS_CTRL, val | MAX_READ_REQ_SIZE_2048);
 +	}
 +
  	/* Setup the timer prescalar register.  Clock is always 66Mhz. */
  	val = tr32(GRC_MISC_CFG);
  	val &= ~0xff;
@@@ -14237,10 -14225,7 +14237,10 @@@ static int tg3_change_mtu(struct net_de
  	/* Reset PHY, otherwise the read DMA engine will be in a mode that
  	 * breaks all requests to 256 bytes.
  	 */
 -	if (tg3_asic_rev(tp) == ASIC_REV_57766)
 +	if (tg3_asic_rev(tp) == ASIC_REV_57766 ||
 +	    tg3_asic_rev(tp) == ASIC_REV_5717 ||
 +	    tg3_asic_rev(tp) == ASIC_REV_5719 ||
 +	    tg3_asic_rev(tp) == ASIC_REV_5720)
  		reset_phy = true;
  
  	err = tg3_restart_hw(tp, reset_phy);
diff --combined drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
index 7e089bf906b4,5532a14de82b..5bbcaf8298f6
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_descs.c
@@@ -241,12 -241,13 +241,13 @@@ static int dwmac4_rx_check_timestamp(vo
  	u32 own, ctxt;
  	int ret = 1;
  
- 	own = p->des3 & RDES3_OWN;
- 	ctxt = ((p->des3 & RDES3_CONTEXT_DESCRIPTOR)
+ 	own = le32_to_cpu(p->des3) & RDES3_OWN;
+ 	ctxt = ((le32_to_cpu(p->des3) & RDES3_CONTEXT_DESCRIPTOR)
  		>> RDES3_CONTEXT_DESCRIPTOR_SHIFT);
  
  	if (likely(!own && ctxt)) {
- 		if ((p->des0 == 0xffffffff) && (p->des1 == 0xffffffff))
+ 		if ((p->des0 == cpu_to_le32(0xffffffff)) &&
+ 		    (p->des1 == cpu_to_le32(0xffffffff)))
  			/* Corrupted value */
  			ret = -EINVAL;
  		else
@@@ -258,20 -259,19 +259,20 @@@
  	return ret;
  }
  
 -static int dwmac4_wrback_get_rx_timestamp_status(void *desc, u32 ats)
 +static int dwmac4_wrback_get_rx_timestamp_status(void *desc, void *next_desc,
 +						 u32 ats)
  {
  	struct dma_desc *p = (struct dma_desc *)desc;
  	int ret = -EINVAL;
  
  	/* Get the status from normal w/b descriptor */
- 	if (likely(p->des3 & TDES3_RS1V)) {
+ 	if (likely(p->des3 & cpu_to_le32(TDES3_RS1V))) {
  		if (likely(le32_to_cpu(p->des1) & RDES1_TIMESTAMP_AVAILABLE)) {
  			int i = 0;
  
  			/* Check if timestamp is OK from context descriptor */
  			do {
 -				ret = dwmac4_rx_check_timestamp(desc);
 +				ret = dwmac4_rx_check_timestamp(next_desc);
  				if (ret < 0)
  					goto exit;
  				i++;
diff --combined drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index c0af0bc4e714,0a7ae94b5e00..323464576fc0
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@@ -364,15 -364,9 +364,15 @@@ static void stmmac_eee_ctrl_timer(struc
  bool stmmac_eee_init(struct stmmac_priv *priv)
  {
  	struct net_device *ndev = priv->dev;
 +	int interface = priv->plat->interface;
  	unsigned long flags;
  	bool ret = false;
  
 +	if ((interface != PHY_INTERFACE_MODE_MII) &&
 +	    (interface != PHY_INTERFACE_MODE_GMII) &&
 +	    !phy_interface_mode_is_rgmii(interface))
 +		goto out;
 +
  	/* Using PCS we cannot dial with the phy registers at this stage
  	 * so we do not support extra feature like EEE.
  	 */
@@@ -488,7 -482,7 +488,7 @@@ static void stmmac_get_rx_hwtstamp(stru
  		desc = np;
  
  	/* Check if timestamp is available */
 -	if (priv->hw->desc->get_rx_timestamp_status(desc, priv->adv_ts)) {
 +	if (priv->hw->desc->get_rx_timestamp_status(p, np, priv->adv_ts)) {
  		ns = priv->hw->desc->get_timestamp(desc, priv->adv_ts);
  		netdev_dbg(priv->dev, "get valid RX hw timestamp %llu\n", ns);
  		shhwtstamp = skb_hwtstamps(skb);
@@@ -2539,7 -2533,7 +2539,7 @@@ static int stmmac_hw_setup(struct net_d
  	}
  
  	if (priv->hw->pcs && priv->hw->mac->pcs_ctrl_ane)
- 		priv->hw->mac->pcs_ctrl_ane(priv->hw, 1, priv->hw->ps, 0);
+ 		priv->hw->mac->pcs_ctrl_ane(priv->ioaddr, 1, priv->hw->ps, 0);
  
  	/* set TX and RX rings length */
  	stmmac_set_rings_length(priv);
@@@ -2594,7 -2588,6 +2594,7 @@@ static int stmmac_open(struct net_devic
  
  	priv->dma_buf_sz = STMMAC_ALIGN(buf_sz);
  	priv->rx_copybreak = STMMAC_RX_COPYBREAK;
 +	priv->mss = 0;
  
  	ret = alloc_dma_desc_resources(priv);
  	if (ret < 0) {
diff --combined drivers/net/tap.c
index 0a886fda0129,c4e91c73568e..f39c6f876e67
--- a/drivers/net/tap.c
+++ b/drivers/net/tap.c
@@@ -572,10 -572,10 +572,10 @@@ static int tap_release(struct inode *in
  	return 0;
  }
  
- static unsigned int tap_poll(struct file *file, poll_table *wait)
+ static __poll_t tap_poll(struct file *file, poll_table *wait)
  {
  	struct tap_queue *q = file->private_data;
- 	unsigned int mask = POLLERR;
+ 	__poll_t mask = POLLERR;
  
  	if (!q)
  		goto out;
@@@ -829,11 -829,8 +829,11 @@@ static ssize_t tap_do_read(struct tap_q
  	DEFINE_WAIT(wait);
  	ssize_t ret = 0;
  
 -	if (!iov_iter_count(to))
 +	if (!iov_iter_count(to)) {
 +		if (skb)
 +			kfree_skb(skb);
  		return 0;
 +	}
  
  	if (skb)
  		goto put;
@@@ -1157,14 -1154,11 +1157,14 @@@ static int tap_recvmsg(struct socket *s
  		       size_t total_len, int flags)
  {
  	struct tap_queue *q = container_of(sock, struct tap_queue, sock);
 +	struct sk_buff *skb = m->msg_control;
  	int ret;
 -	if (flags & ~(MSG_DONTWAIT|MSG_TRUNC))
 +	if (flags & ~(MSG_DONTWAIT|MSG_TRUNC)) {
 +		if (skb)
 +			kfree_skb(skb);
  		return -EINVAL;
 -	ret = tap_do_read(q, &m->msg_iter, flags & MSG_DONTWAIT,
 -			  m->msg_control);
 +	}
 +	ret = tap_do_read(q, &m->msg_iter, flags & MSG_DONTWAIT, skb);
  	if (ret > total_len) {
  		m->msg_flags |= MSG_TRUNC;
  		ret = flags & MSG_TRUNC ? ret : total_len;
diff --combined drivers/net/tun.c
index 4f4a842a1c9c,130b049ac3da..2ffe5dba7e09
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@@ -1248,12 -1248,12 +1248,12 @@@ static void tun_net_init(struct net_dev
  /* Character device part */
  
  /* Poll */
- static unsigned int tun_chr_poll(struct file *file, poll_table *wait)
+ static __poll_t tun_chr_poll(struct file *file, poll_table *wait)
  {
  	struct tun_file *tfile = file->private_data;
  	struct tun_struct *tun = tun_get(tfile);
  	struct sock *sk;
- 	unsigned int mask = 0;
+ 	__poll_t mask = 0;
  
  	if (!tun)
  		return POLLERR;
@@@ -1952,11 -1952,8 +1952,11 @@@ static ssize_t tun_do_read(struct tun_s
  
  	tun_debug(KERN_INFO, tun, "tun_do_read\n");
  
 -	if (!iov_iter_count(to))
 +	if (!iov_iter_count(to)) {
 +		if (skb)
 +			kfree_skb(skb);
  		return 0;
 +	}
  
  	if (!skb) {
  		/* Read frames from ring */
@@@ -2072,24 -2069,22 +2072,24 @@@ static int tun_recvmsg(struct socket *s
  {
  	struct tun_file *tfile = container_of(sock, struct tun_file, socket);
  	struct tun_struct *tun = tun_get(tfile);
 +	struct sk_buff *skb = m->msg_control;
  	int ret;
  
 -	if (!tun)
 -		return -EBADFD;
 +	if (!tun) {
 +		ret = -EBADFD;
 +		goto out_free_skb;
 +	}
  
  	if (flags & ~(MSG_DONTWAIT|MSG_TRUNC|MSG_ERRQUEUE)) {
  		ret = -EINVAL;
 -		goto out;
 +		goto out_put_tun;
  	}
  	if (flags & MSG_ERRQUEUE) {
  		ret = sock_recv_errqueue(sock->sk, m, total_len,
  					 SOL_PACKET, TUN_TX_TIMESTAMP);
  		goto out;
  	}
 -	ret = tun_do_read(tun, tfile, &m->msg_iter, flags & MSG_DONTWAIT,
 -			  m->msg_control);
 +	ret = tun_do_read(tun, tfile, &m->msg_iter, flags & MSG_DONTWAIT, skb);
  	if (ret > (ssize_t)total_len) {
  		m->msg_flags |= MSG_TRUNC;
  		ret = flags & MSG_TRUNC ? ret : total_len;
@@@ -2097,13 -2092,6 +2097,13 @@@
  out:
  	tun_put(tun);
  	return ret;
 +
 +out_put_tun:
 +	tun_put(tun);
 +out_free_skb:
 +	if (skb)
 +		kfree_skb(skb);
 +	return ret;
  }
  
  static int tun_peek_len(struct socket *sock)
diff --combined drivers/staging/lustre/lnet/lnet/lib-socket.c
index 7d49d4865298,984d76843b19..ed46aaca0ba3
--- a/drivers/staging/lustre/lnet/lnet/lib-socket.c
+++ b/drivers/staging/lustre/lnet/lnet/lib-socket.c
@@@ -71,12 -71,16 +71,12 @@@ lnet_sock_ioctl(int cmd, unsigned long 
  	}
  
  	sock_filp = sock_alloc_file(sock, 0, NULL);
 -	if (IS_ERR(sock_filp)) {
 -		sock_release(sock);
 -		rc = PTR_ERR(sock_filp);
 -		goto out;
 -	}
 +	if (IS_ERR(sock_filp))
 +		return PTR_ERR(sock_filp);
  
  	rc = kernel_sock_unlocked_ioctl(sock_filp, cmd, arg);
  
  	fput(sock_filp);
 -out:
  	return rc;
  }
  
@@@ -314,19 -318,20 +314,20 @@@ lnet_sock_read(struct socket *sock, voi
  	long jiffies_left = timeout * msecs_to_jiffies(MSEC_PER_SEC);
  	unsigned long then;
  	struct timeval tv;
+ 	struct kvec  iov = {
+ 		.iov_base = buffer,
+ 		.iov_len  = nob
+ 	};
+ 	struct msghdr msg = {
+ 		.msg_flags = 0
+ 	};
  
  	LASSERT(nob > 0);
  	LASSERT(jiffies_left > 0);
  
- 	for (;;) {
- 		struct kvec  iov = {
- 			.iov_base = buffer,
- 			.iov_len  = nob
- 		};
- 		struct msghdr msg = {
- 			.msg_flags = 0
- 		};
+ 	iov_iter_kvec(&msg.msg_iter, READ | ITER_KVEC, &iov, 1, nob);
  
+ 	for (;;) {
  		/* Set receive timeout to remaining time */
  		jiffies_to_timeval(jiffies_left, &tv);
  		rc = kernel_setsockopt(sock, SOL_SOCKET, SO_RCVTIMEO,
@@@ -338,7 -343,7 +339,7 @@@
  		}
  
  		then = jiffies;
- 		rc = kernel_recvmsg(sock, &msg, &iov, 1, nob, 0);
+ 		rc = sock_recvmsg(sock, &msg, 0);
  		jiffies_left -= jiffies - then;
  
  		if (rc < 0)
@@@ -347,10 -352,7 +348,7 @@@
  		if (!rc)
  			return -ECONNRESET;
  
- 		buffer = ((char *)buffer) + rc;
- 		nob -= rc;
- 
- 		if (!nob)
+ 		if (!msg_data_left(&msg))
  			return 0;
  
  		if (jiffies_left <= 0)
diff --combined drivers/tty/n_tty.c
index 539b49adb6af,081bbbb7d49c..478a9b40fd03
--- a/drivers/tty/n_tty.c
+++ b/drivers/tty/n_tty.c
@@@ -1762,7 -1762,7 +1762,7 @@@ static void n_tty_set_termios(struct tt
  {
  	struct n_tty_data *ldata = tty->disc_data;
  
 -	if (!old || (old->c_lflag ^ tty->termios.c_lflag) & ICANON) {
 +	if (!old || (old->c_lflag ^ tty->termios.c_lflag) & (ICANON | EXTPROC)) {
  		bitmap_zero(ldata->read_flags, N_TTY_BUF_SIZE);
  		ldata->line_start = ldata->read_tail;
  		if (!L_ICANON(tty) || !read_cnt(ldata)) {
@@@ -2368,10 -2368,10 +2368,10 @@@ break_out
   *	Called without the kernel lock held - fine
   */
  
- static unsigned int n_tty_poll(struct tty_struct *tty, struct file *file,
+ static __poll_t n_tty_poll(struct tty_struct *tty, struct file *file,
  							poll_table *wait)
  {
- 	unsigned int mask = 0;
+ 	__poll_t mask = 0;
  
  	poll_wait(file, &tty->read_wait, wait);
  	poll_wait(file, &tty->write_wait, wait);
@@@ -2425,7 -2425,7 +2425,7 @@@ static int n_tty_ioctl(struct tty_struc
  		return put_user(tty_chars_in_buffer(tty), (int __user *) arg);
  	case TIOCINQ:
  		down_write(&tty->termios_rwsem);
 -		if (L_ICANON(tty))
 +		if (L_ICANON(tty) && !L_EXTPROC(tty))
  			retval = inq_canon(ldata);
  		else
  			retval = read_cnt(ldata);
diff --combined drivers/usb/core/devio.c
index a3fad4ec9870,929a7380be66..31404fc93d99
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@@ -1442,18 -1442,14 +1442,18 @@@ static int proc_do_submiturb(struct usb
  	int number_of_packets = 0;
  	unsigned int stream_id = 0;
  	void *buf;
 -
 -	if (uurb->flags & ~(USBDEVFS_URB_ISO_ASAP |
 -				USBDEVFS_URB_SHORT_NOT_OK |
 +	unsigned long mask =	USBDEVFS_URB_SHORT_NOT_OK |
  				USBDEVFS_URB_BULK_CONTINUATION |
  				USBDEVFS_URB_NO_FSBR |
  				USBDEVFS_URB_ZERO_PACKET |
 -				USBDEVFS_URB_NO_INTERRUPT))
 -		return -EINVAL;
 +				USBDEVFS_URB_NO_INTERRUPT;
 +	/* USBDEVFS_URB_ISO_ASAP is a special case */
 +	if (uurb->type == USBDEVFS_URB_TYPE_ISO)
 +		mask |= USBDEVFS_URB_ISO_ASAP;
 +
 +	if (uurb->flags & ~mask)
 +			return -EINVAL;
 +
  	if ((unsigned int)uurb->buffer_length >= USBFS_XFER_MAX)
  		return -EINVAL;
  	if (uurb->buffer_length > 0 && !uurb->buffer)
@@@ -2572,11 -2568,11 +2572,11 @@@ static long usbdev_compat_ioctl(struct 
  #endif
  
  /* No kernel lock - fine */
- static unsigned int usbdev_poll(struct file *file,
+ static __poll_t usbdev_poll(struct file *file,
  				struct poll_table_struct *wait)
  {
  	struct usb_dev_state *ps = file->private_data;
- 	unsigned int mask = 0;
+ 	__poll_t mask = 0;
  
  	poll_wait(file, &ps->wait, wait);
  	if (file->f_mode & FMODE_WRITE && !list_empty(&ps->async_completed))
diff --combined drivers/usb/gadget/function/f_fs.c
index b6cf5ab5a0a1,17efadd6b395..b540935891af
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c
@@@ -638,10 -638,10 +638,10 @@@ static long ffs_ep0_ioctl(struct file *
  	return ret;
  }
  
- static unsigned int ffs_ep0_poll(struct file *file, poll_table *wait)
+ static __poll_t ffs_ep0_poll(struct file *file, poll_table *wait)
  {
  	struct ffs_data *ffs = file->private_data;
- 	unsigned int mask = POLLWRNORM;
+ 	__poll_t mask = POLLWRNORM;
  	int ret;
  
  	poll_wait(file, &ffs->ev.waitq, wait);
@@@ -1012,7 -1012,7 +1012,7 @@@ static ssize_t ffs_epfile_io(struct fil
  		else
  			ret = ep->status;
  		goto error_mutex;
 -	} else if (!(req = usb_ep_alloc_request(ep->ep, GFP_KERNEL))) {
 +	} else if (!(req = usb_ep_alloc_request(ep->ep, GFP_ATOMIC))) {
  		ret = -ENOMEM;
  	} else {
  		req->buf      = data;
@@@ -2282,18 -2282,9 +2282,18 @@@ static int __ffs_data_do_os_desc(enum f
  		int i;
  
  		if (len < sizeof(*d) ||
 -		    d->bFirstInterfaceNumber >= ffs->interfaces_count ||
 -		    !d->Reserved1)
 +		    d->bFirstInterfaceNumber >= ffs->interfaces_count)
  			return -EINVAL;
 +		if (d->Reserved1 != 1) {
 +			/*
 +			 * According to the spec, Reserved1 must be set to 1
 +			 * but older kernels incorrectly rejected non-zero
 +			 * values.  We fix it here to avoid returning EINVAL
 +			 * in response to values we used to accept.
 +			 */
 +			pr_debug("usb_ext_compat_desc::Reserved1 forced to 1\n");
 +			d->Reserved1 = 1;
 +		}
  		for (i = 0; i < ARRAY_SIZE(d->Reserved2); ++i)
  			if (d->Reserved2[i])
  				return -EINVAL;
diff --combined drivers/vhost/net.c
index c7bdeb655646,0ed445a17c54..9524ee16878a
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@@ -778,6 -778,16 +778,6 @@@ static void handle_rx(struct vhost_net 
  		/* On error, stop handling until the next kick. */
  		if (unlikely(headcount < 0))
  			goto out;
 -		if (nvq->rx_array)
 -			msg.msg_control = vhost_net_buf_consume(&nvq->rxq);
 -		/* On overrun, truncate and discard */
 -		if (unlikely(headcount > UIO_MAXIOV)) {
 -			iov_iter_init(&msg.msg_iter, READ, vq->iov, 1, 1);
 -			err = sock->ops->recvmsg(sock, &msg,
 -						 1, MSG_DONTWAIT | MSG_TRUNC);
 -			pr_debug("Discarded rx packet: len %zd\n", sock_len);
 -			continue;
 -		}
  		/* OK, now we need to know about added descriptors. */
  		if (!headcount) {
  			if (unlikely(vhost_enable_notify(&net->dev, vq))) {
@@@ -790,16 -800,6 +790,16 @@@
  			 * they refilled. */
  			goto out;
  		}
 +		if (nvq->rx_array)
 +			msg.msg_control = vhost_net_buf_consume(&nvq->rxq);
 +		/* On overrun, truncate and discard */
 +		if (unlikely(headcount > UIO_MAXIOV)) {
 +			iov_iter_init(&msg.msg_iter, READ, vq->iov, 1, 1);
 +			err = sock->ops->recvmsg(sock, &msg,
 +						 1, MSG_DONTWAIT | MSG_TRUNC);
 +			pr_debug("Discarded rx packet: len %zd\n", sock_len);
 +			continue;
 +		}
  		/* We don't need to be notified again. */
  		iov_iter_init(&msg.msg_iter, READ, vq->iov, in, vhost_len);
  		fixup = msg.msg_iter;
@@@ -1353,7 -1353,7 +1353,7 @@@ static ssize_t vhost_net_chr_write_iter
  	return vhost_chr_write_iter(dev, from);
  }
  
- static unsigned int vhost_net_chr_poll(struct file *file, poll_table *wait)
+ static __poll_t vhost_net_chr_poll(struct file *file, poll_table *wait)
  {
  	struct vhost_net *n = file->private_data;
  	struct vhost_dev *dev = &n->dev;
diff --combined drivers/xen/pvcalls-front.c
index 4c789e61554b,74c854955a6b..78804e71f9a6
--- a/drivers/xen/pvcalls-front.c
+++ b/drivers/xen/pvcalls-front.c
@@@ -805,7 -805,7 +805,7 @@@ int pvcalls_front_accept(struct socket 
  		pvcalls_exit();
  		return ret;
  	}
 -	map2 = kzalloc(sizeof(*map2), GFP_KERNEL);
 +	map2 = kzalloc(sizeof(*map2), GFP_ATOMIC);
  	if (map2 == NULL) {
  		clear_bit(PVCALLS_FLAG_ACCEPT_INFLIGHT,
  			  (void *)&map->passive.flags);
@@@ -878,7 -878,7 +878,7 @@@ received
  	return ret;
  }
  
- static unsigned int pvcalls_front_poll_passive(struct file *file,
+ static __poll_t pvcalls_front_poll_passive(struct file *file,
  					       struct pvcalls_bedata *bedata,
  					       struct sock_mapping *map,
  					       poll_table *wait)
@@@ -935,12 -935,12 +935,12 @@@
  	return 0;
  }
  
- static unsigned int pvcalls_front_poll_active(struct file *file,
+ static __poll_t pvcalls_front_poll_active(struct file *file,
  					      struct pvcalls_bedata *bedata,
  					      struct sock_mapping *map,
  					      poll_table *wait)
  {
- 	unsigned int mask = 0;
+ 	__poll_t mask = 0;
  	int32_t in_error, out_error;
  	struct pvcalls_data_intf *intf = map->active.ring;
  
@@@ -958,12 -958,12 +958,12 @@@
  	return mask;
  }
  
- unsigned int pvcalls_front_poll(struct file *file, struct socket *sock,
+ __poll_t pvcalls_front_poll(struct file *file, struct socket *sock,
  			       poll_table *wait)
  {
  	struct pvcalls_bedata *bedata;
  	struct sock_mapping *map;
- 	int ret;
+ 	__poll_t ret;
  
  	pvcalls_enter();
  	if (!pvcalls_front_dev) {
@@@ -1103,7 -1103,7 +1103,7 @@@ static int pvcalls_front_remove(struct 
  			kfree(map);
  		}
  	}
 -	if (bedata->ref >= 0)
 +	if (bedata->ref != -1)
  		gnttab_end_foreign_access(bedata->ref, 0, 0);
  	kfree(bedata->ring.sring);
  	kfree(bedata);
@@@ -1128,8 -1128,6 +1128,8 @@@ static int pvcalls_front_probe(struct x
  	}
  
  	versions = xenbus_read(XBT_NIL, dev->otherend, "versions", &len);
 +	if (IS_ERR(versions))
 +		return PTR_ERR(versions);
  	if (!len)
  		return -EINVAL;
  	if (strcmp(versions, "1")) {
diff --combined fs/userfaultfd.c
index 41a75f9f23fd,c0a5d9c47c6d..743eaa646898
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c
@@@ -570,14 -570,11 +570,14 @@@ out
  static void userfaultfd_event_wait_completion(struct userfaultfd_ctx *ctx,
  					      struct userfaultfd_wait_queue *ewq)
  {
 +	struct userfaultfd_ctx *release_new_ctx;
 +
  	if (WARN_ON_ONCE(current->flags & PF_EXITING))
  		goto out;
  
  	ewq->ctx = ctx;
  	init_waitqueue_entry(&ewq->wq, current);
 +	release_new_ctx = NULL;
  
  	spin_lock(&ctx->event_wqh.lock);
  	/*
@@@ -604,7 -601,8 +604,7 @@@
  				new = (struct userfaultfd_ctx *)
  					(unsigned long)
  					ewq->msg.arg.reserved.reserved1;
 -
 -				userfaultfd_ctx_put(new);
 +				release_new_ctx = new;
  			}
  			break;
  		}
@@@ -619,20 -617,6 +619,20 @@@
  	__set_current_state(TASK_RUNNING);
  	spin_unlock(&ctx->event_wqh.lock);
  
 +	if (release_new_ctx) {
 +		struct vm_area_struct *vma;
 +		struct mm_struct *mm = release_new_ctx->mm;
 +
 +		/* the various vma->vm_userfaultfd_ctx still points to it */
 +		down_write(&mm->mmap_sem);
 +		for (vma = mm->mmap; vma; vma = vma->vm_next)
 +			if (vma->vm_userfaultfd_ctx.ctx == release_new_ctx)
 +				vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX;
 +		up_write(&mm->mmap_sem);
 +
 +		userfaultfd_ctx_put(release_new_ctx);
 +	}
 +
  	/*
  	 * ctx may go away after this if the userfault pseudo fd is
  	 * already released.
@@@ -937,10 -921,10 +937,10 @@@ static inline struct userfaultfd_wait_q
  	return find_userfault_in(&ctx->event_wqh);
  }
  
- static unsigned int userfaultfd_poll(struct file *file, poll_table *wait)
+ static __poll_t userfaultfd_poll(struct file *file, poll_table *wait)
  {
  	struct userfaultfd_ctx *ctx = file->private_data;
- 	unsigned int ret;
+ 	__poll_t ret;
  
  	poll_wait(file, &ctx->fd_wqh, wait);
  
diff --combined include/crypto/if_alg.h
index f38227a78eae,a50bdb9d7cfd..482461d8931d
--- a/include/crypto/if_alg.h
+++ b/include/crypto/if_alg.h
@@@ -18,7 -18,6 +18,7 @@@
  #include <linux/if_alg.h>
  #include <linux/scatterlist.h>
  #include <linux/types.h>
 +#include <linux/atomic.h>
  #include <net/sock.h>
  
  #include <crypto/aead.h>
@@@ -151,7 -150,7 +151,7 @@@ struct af_alg_ctx 
  	struct crypto_wait wait;
  
  	size_t used;
 -	size_t rcvused;
 +	atomic_t rcvused;
  
  	bool more;
  	bool merge;
@@@ -216,7 -215,7 +216,7 @@@ static inline int af_alg_rcvbuf(struct 
  	struct af_alg_ctx *ctx = ask->private;
  
  	return max_t(int, max_t(int, sk->sk_rcvbuf & PAGE_MASK, PAGE_SIZE) -
 -			  ctx->rcvused, 0);
 +		     atomic_read(&ctx->rcvused), 0);
  }
  
  /**
@@@ -245,7 -244,7 +245,7 @@@ ssize_t af_alg_sendpage(struct socket *
  			int offset, size_t size, int flags);
  void af_alg_free_resources(struct af_alg_async_req *areq);
  void af_alg_async_cb(struct crypto_async_request *_req, int err);
- unsigned int af_alg_poll(struct file *file, struct socket *sock,
+ __poll_t af_alg_poll(struct file *file, struct socket *sock,
  			 poll_table *wait);
  struct af_alg_async_req *af_alg_alloc_areq(struct sock *sk,
  					   unsigned int areqlen);
diff --combined include/linux/fs.h
index 05762c5693c9,3e52d1383d60..e57af143fadd
--- a/include/linux/fs.h
+++ b/include/linux/fs.h
@@@ -1309,6 -1309,7 +1309,6 @@@ extern int send_sigurg(struct fown_stru
  #define UMOUNT_UNUSED	0x80000000	/* Flag guaranteed to be unused */
  
  /* sb->s_iflags */
 -#define SB_I_CGROUPWB	0x00000001	/* cgroup-aware writeback enabled */
  #define SB_I_NOEXEC	0x00000002	/* Ignore executables on this fs */
  #define SB_I_NODEV	0x00000004	/* Ignore devices on this fs */
  
@@@ -1358,7 -1359,7 +1358,7 @@@ struct super_block 
  
  	const struct fscrypt_operations	*s_cop;
  
- 	struct hlist_bl_head	s_anon;		/* anonymous dentries for (nfs) exporting */
+ 	struct hlist_bl_head	s_roots;	/* alternate root dentries for NFS */
  	struct list_head	s_mounts;	/* list of mounts; _not_ for fs use */
  	struct block_device	*s_bdev;
  	struct backing_dev_info *s_bdi;
@@@ -1607,6 -1608,10 +1607,10 @@@ extern int vfs_whiteout(struct inode *
  extern struct dentry *vfs_tmpfile(struct dentry *dentry, umode_t mode,
  				  int open_flag);
  
+ int vfs_mkobj(struct dentry *, umode_t,
+ 		int (*f)(struct dentry *, umode_t, void *),
+ 		void *);
+ 
  /*
   * VFS file helper functions.
   */
@@@ -1697,7 -1702,7 +1701,7 @@@ struct file_operations 
  	ssize_t (*write_iter) (struct kiocb *, struct iov_iter *);
  	int (*iterate) (struct file *, struct dir_context *);
  	int (*iterate_shared) (struct file *, struct dir_context *);
- 	unsigned int (*poll) (struct file *, struct poll_table_struct *);
+ 	__poll_t (*poll) (struct file *, struct poll_table_struct *);
  	long (*unlocked_ioctl) (struct file *, unsigned int, unsigned long);
  	long (*compat_ioctl) (struct file *, unsigned int, unsigned long);
  	int (*mmap) (struct file *, struct vm_area_struct *);
@@@ -1855,7 -1860,6 +1859,7 @@@ struct super_operations 
  #define S_DAX		0	/* Make all the DAX code disappear */
  #endif
  #define S_ENCRYPTED	16384	/* Encrypted file (using fs/crypto/) */
 +#define S_CGROUPWB	32768	/* Enable cgroup writeback for this inode */
  
  /*
   * Note that nosuid etc flags are inode-specific: setting some file-system
@@@ -1896,7 -1900,6 +1900,7 @@@ static inline bool sb_rdonly(const stru
  #define IS_NOSEC(inode)		((inode)->i_flags & S_NOSEC)
  #define IS_DAX(inode)		((inode)->i_flags & S_DAX)
  #define IS_ENCRYPTED(inode)	((inode)->i_flags & S_ENCRYPTED)
 +#define IS_CGROUPWB(inode)	((inode)->i_flags & S_CGROUPWB)
  
  #define IS_WHITEOUT(inode)	(S_ISCHR(inode->i_mode) && \
  				 (inode)->i_rdev == WHITEOUT_DEV)
@@@ -2993,7 -2996,6 +2997,7 @@@ enum 
  };
  
  void dio_end_io(struct bio *bio);
 +void dio_warn_stale_pagecache(struct file *filp);
  
  ssize_t __blockdev_direct_IO(struct kiocb *iocb, struct inode *inode,
  			     struct block_device *bdev, struct iov_iter *iter,
diff --combined include/linux/skbuff.h
index a38c80e9f91e,07564bb28c1f..a87e43d16f44
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@@ -1406,7 -1406,8 +1406,7 @@@ static inline struct sk_buff *skb_get(s
  }
  
  /*
 - * If users == 1, we are the only owner and are can avoid redundant
 - * atomic change.
 + * If users == 1, we are the only owner and can avoid redundant atomic changes.
   */
  
  /**
@@@ -3241,7 -3242,7 +3241,7 @@@ struct sk_buff *__skb_recv_datagram(str
  				    int *peeked, int *off, int *err);
  struct sk_buff *skb_recv_datagram(struct sock *sk, unsigned flags, int noblock,
  				  int *err);
- unsigned int datagram_poll(struct file *file, struct socket *sock,
+ __poll_t datagram_poll(struct file *file, struct socket *sock,
  			   struct poll_table_struct *wait);
  int skb_copy_datagram_iter(const struct sk_buff *from, int offset,
  			   struct iov_iter *to, int size);
diff --combined include/net/sock.h
index 7a7b14e9628a,b33078333518..4fd74e0d1bbb
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@@ -685,7 -685,11 +685,7 @@@ static inline void sk_add_node_rcu(stru
  
  static inline void __sk_nulls_add_node_rcu(struct sock *sk, struct hlist_nulls_head *list)
  {
 -	if (IS_ENABLED(CONFIG_IPV6) && sk->sk_reuseport &&
 -	    sk->sk_family == AF_INET6)
 -		hlist_nulls_add_tail_rcu(&sk->sk_nulls_node, list);
 -	else
 -		hlist_nulls_add_head_rcu(&sk->sk_nulls_node, list);
 +	hlist_nulls_add_head_rcu(&sk->sk_nulls_node, list);
  }
  
  static inline void sk_nulls_add_node_rcu(struct sock *sk, struct hlist_nulls_head *list)
@@@ -1514,11 -1518,6 +1514,11 @@@ static inline bool sock_owned_by_user(c
  	return sk->sk_lock.owned;
  }
  
 +static inline bool sock_owned_by_user_nocheck(const struct sock *sk)
 +{
 +	return sk->sk_lock.owned;
 +}
 +
  /* no reclassification while locks are held */
  static inline bool sock_allow_reclassification(const struct sock *csk)
  {
@@@ -1583,7 -1582,7 +1583,7 @@@ int sock_no_connect(struct socket *, st
  int sock_no_socketpair(struct socket *, struct socket *);
  int sock_no_accept(struct socket *, struct socket *, int, bool);
  int sock_no_getname(struct socket *, struct sockaddr *, int *, int);
- unsigned int sock_no_poll(struct file *, struct socket *,
+ __poll_t sock_no_poll(struct file *, struct socket *,
  			  struct poll_table_struct *);
  int sock_no_ioctl(struct socket *, unsigned int, unsigned long);
  int sock_no_listen(struct socket *, int);
diff --combined include/net/tcp.h
index 6da880d2f022,a6343271c629..50b21a49d870
--- a/include/net/tcp.h
+++ b/include/net/tcp.h
@@@ -387,7 -387,7 +387,7 @@@ bool tcp_peer_is_proven(struct request_
  void tcp_close(struct sock *sk, long timeout);
  void tcp_init_sock(struct sock *sk);
  void tcp_init_transfer(struct sock *sk, int bpf_op);
- unsigned int tcp_poll(struct file *file, struct socket *sock,
+ __poll_t tcp_poll(struct file *file, struct socket *sock,
  		      struct poll_table_struct *wait);
  int tcp_getsockopt(struct sock *sk, int level, int optname,
  		   char __user *optval, int __user *optlen);
@@@ -844,11 -844,12 +844,11 @@@ static inline int tcp_v6_sdif(const str
  }
  #endif
  
 -/* TCP_SKB_CB reference means this can not be used from early demux */
  static inline bool inet_exact_dif_match(struct net *net, struct sk_buff *skb)
  {
  #if IS_ENABLED(CONFIG_NET_L3_MASTER_DEV)
  	if (!net->ipv4.sysctl_tcp_l3mdev_accept &&
 -	    skb && ipv4_l3mdev_skb(TCP_SKB_CB(skb)->header.h4.flags))
 +	    skb && ipv4_l3mdev_skb(IPCB(skb)->flags))
  		return true;
  #endif
  	return false;
@@@ -1055,7 -1056,7 +1055,7 @@@ void tcp_rate_skb_sent(struct sock *sk
  void tcp_rate_skb_delivered(struct sock *sk, struct sk_buff *skb,
  			    struct rate_sample *rs);
  void tcp_rate_gen(struct sock *sk, u32 delivered, u32 lost,
 -		  struct rate_sample *rs);
 +		  bool is_sack_reneg, struct rate_sample *rs);
  void tcp_rate_check_app_limited(struct sock *sk);
  
  /* These functions determine how the current flow behaves in respect of SACK
diff --combined kernel/events/core.c
index 64ec2c9d2c44,857c40d98d2c..56d2b99de409
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@@ -4511,11 -4511,11 +4511,11 @@@ perf_read(struct file *file, char __use
  	return ret;
  }
  
- static unsigned int perf_poll(struct file *file, poll_table *wait)
+ static __poll_t perf_poll(struct file *file, poll_table *wait)
  {
  	struct perf_event *event = file->private_data;
  	struct ring_buffer *rb;
- 	unsigned int events = POLLHUP;
+ 	__poll_t events = POLLHUP;
  
  	poll_wait(file, &event->waitq, wait);
  
@@@ -4904,7 -4904,6 +4904,7 @@@ void perf_event_update_userpage(struct 
  unlock:
  	rcu_read_unlock();
  }
 +EXPORT_SYMBOL_GPL(perf_event_update_userpage);
  
  static int perf_mmap_fault(struct vm_fault *vmf)
  {
@@@ -6640,7 -6639,6 +6640,7 @@@ static void perf_event_namespaces_outpu
  	struct perf_namespaces_event *namespaces_event = data;
  	struct perf_output_handle handle;
  	struct perf_sample_data sample;
 +	u16 header_size = namespaces_event->event_id.header.size;
  	int ret;
  
  	if (!perf_event_namespaces_match(event))
@@@ -6651,7 -6649,7 +6651,7 @@@
  	ret = perf_output_begin(&handle, event,
  				namespaces_event->event_id.header.size);
  	if (ret)
 -		return;
 +		goto out;
  
  	namespaces_event->event_id.pid = perf_event_pid(event,
  							namespaces_event->task);
@@@ -6663,8 -6661,6 +6663,8 @@@
  	perf_event__output_id_sample(event, &handle, &sample);
  
  	perf_output_end(&handle);
 +out:
 +	namespaces_event->event_id.header.size = header_size;
  }
  
  static void perf_fill_ns_link_info(struct perf_ns_link_info *ns_link_info,
@@@ -7991,11 -7987,11 +7991,11 @@@ static void bpf_overflow_handler(struc
  {
  	struct bpf_perf_event_data_kern ctx = {
  		.data = data,
 -		.regs = regs,
  		.event = event,
  	};
  	int ret = 0;
  
 +	ctx.regs = perf_arch_bpf_user_pt_regs(regs);
  	preempt_disable();
  	if (unlikely(__this_cpu_inc_return(bpf_prog_active) != 1))
  		goto out;
diff --combined kernel/printk/printk.c
index b9006617710f,8aa27be96012..c2e713f6ae2e
--- a/kernel/printk/printk.c
+++ b/kernel/printk/printk.c
@@@ -920,10 -920,10 +920,10 @@@ static loff_t devkmsg_llseek(struct fil
  	return ret;
  }
  
- static unsigned int devkmsg_poll(struct file *file, poll_table *wait)
+ static __poll_t devkmsg_poll(struct file *file, poll_table *wait)
  {
  	struct devkmsg_user *user = file->private_data;
- 	int ret = 0;
+ 	__poll_t ret = 0;
  
  	if (!user)
  		return POLLERR|POLLNVAL;
@@@ -3141,6 -3141,9 +3141,6 @@@ void dump_stack_print_info(const char *
  void show_regs_print_info(const char *log_lvl)
  {
  	dump_stack_print_info(log_lvl);
 -
 -	printk("%stask: %p task.stack: %p\n",
 -	       log_lvl, current, task_stack_page(current));
  }
  
  #endif
diff --combined kernel/trace/ring_buffer.c
index 9ab18995ff1e,d24d48713ef3..d399b4072951
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@@ -280,8 -280,6 +280,8 @@@ EXPORT_SYMBOL_GPL(ring_buffer_event_dat
  /* Missed count stored at end */
  #define RB_MISSED_STORED	(1 << 30)
  
 +#define RB_MISSED_FLAGS		(RB_MISSED_EVENTS|RB_MISSED_STORED)
 +
  struct buffer_data_page {
  	u64		 time_stamp;	/* page time stamp */
  	local_t		 commit;	/* write committed index */
@@@ -333,9 -331,7 +333,9 @@@ static void rb_init_page(struct buffer_
   */
  size_t ring_buffer_page_len(void *page)
  {
 -	return local_read(&((struct buffer_data_page *)page)->commit)
 +	struct buffer_data_page *bpage = page;
 +
 +	return (local_read(&bpage->commit) & ~RB_MISSED_FLAGS)
  		+ BUF_PAGE_HDR_SIZE;
  }
  
@@@ -630,7 -626,7 +630,7 @@@ int ring_buffer_wait(struct ring_buffe
   * Returns POLLIN | POLLRDNORM if data exists in the buffers,
   * zero otherwise.
   */
- int ring_buffer_poll_wait(struct ring_buffer *buffer, int cpu,
+ __poll_t ring_buffer_poll_wait(struct ring_buffer *buffer, int cpu,
  			  struct file *filp, poll_table *poll_table)
  {
  	struct ring_buffer_per_cpu *cpu_buffer;
@@@ -1803,6 -1799,12 +1803,6 @@@ void ring_buffer_change_overwrite(struc
  }
  EXPORT_SYMBOL_GPL(ring_buffer_change_overwrite);
  
 -static __always_inline void *
 -__rb_data_page_index(struct buffer_data_page *bpage, unsigned index)
 -{
 -	return bpage->data + index;
 -}
 -
  static __always_inline void *__rb_page_index(struct buffer_page *bpage, unsigned index)
  {
  	return bpage->page->data + index;
@@@ -4404,13 -4406,8 +4404,13 @@@ void ring_buffer_free_read_page(struct 
  {
  	struct ring_buffer_per_cpu *cpu_buffer = buffer->buffers[cpu];
  	struct buffer_data_page *bpage = data;
 +	struct page *page = virt_to_page(bpage);
  	unsigned long flags;
  
 +	/* If the page is still in use someplace else, we can't reuse it */
 +	if (page_ref_count(page) > 1)
 +		goto out;
 +
  	local_irq_save(flags);
  	arch_spin_lock(&cpu_buffer->lock);
  
@@@ -4422,7 -4419,6 +4422,7 @@@
  	arch_spin_unlock(&cpu_buffer->lock);
  	local_irq_restore(flags);
  
 + out:
  	free_page((unsigned long)bpage);
  }
  EXPORT_SYMBOL_GPL(ring_buffer_free_read_page);
diff --combined kernel/trace/trace.c
index 2a8d8a294345,1e2a45e87b93..ec54e2e14b71
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@@ -362,7 -362,7 +362,7 @@@ trace_ignore_this_task(struct trace_pid
  }
  
  /**
 - * trace_pid_filter_add_remove - Add or remove a task from a pid_list
 + * trace_pid_filter_add_remove_task - Add or remove a task from a pid_list
   * @pid_list: The list to modify
   * @self: The current task for fork or NULL for exit
   * @task: The task to add or remove
@@@ -925,7 -925,7 +925,7 @@@ static void tracing_snapshot_instance(s
  }
  
  /**
 - * trace_snapshot - take a snapshot of the current buffer.
 + * tracing_snapshot - take a snapshot of the current buffer.
   *
   * This causes a swap between the snapshot buffer and the current live
   * tracing buffer. You can use this to take snapshots of the live
@@@ -1004,9 -1004,9 +1004,9 @@@ int tracing_alloc_snapshot(void
  EXPORT_SYMBOL_GPL(tracing_alloc_snapshot);
  
  /**
 - * trace_snapshot_alloc - allocate and take a snapshot of the current buffer.
 + * tracing_snapshot_alloc - allocate and take a snapshot of the current buffer.
   *
 - * This is similar to trace_snapshot(), but it will allocate the
 + * This is similar to tracing_snapshot(), but it will allocate the
   * snapshot buffer if it isn't already allocated. Use this only
   * where it is safe to sleep, as the allocation may sleep.
   *
@@@ -1303,7 -1303,7 +1303,7 @@@ unsigned long __read_mostly	tracing_thr
  /*
   * Copy the new maximum trace into the separate maximum-trace
   * structure. (this way the maximum trace is permanently saved,
 - * for later retrieval via /sys/kernel/debug/tracing/latency_trace)
 + * for later retrieval via /sys/kernel/tracing/tracing_max_latency)
   */
  static void
  __update_max_tr(struct trace_array *tr, struct task_struct *tsk, int cpu)
@@@ -2415,7 -2415,7 +2415,7 @@@ trace_process_export(struct trace_expor
  
  	entry = ring_buffer_event_data(event);
  	size = ring_buffer_event_length(event);
 -	export->write(entry, size);
 +	export->write(export, entry, size);
  }
  
  static DEFINE_MUTEX(ftrace_export_lock);
@@@ -4178,30 -4178,37 +4178,30 @@@ static const struct file_operations sho
  	.llseek		= seq_lseek,
  };
  
 -/*
 - * The tracer itself will not take this lock, but still we want
 - * to provide a consistent cpumask to user-space:
 - */
 -static DEFINE_MUTEX(tracing_cpumask_update_lock);
 -
 -/*
 - * Temporary storage for the character representation of the
 - * CPU bitmask (and one more byte for the newline):
 - */
 -static char mask_str[NR_CPUS + 1];
 -
  static ssize_t
  tracing_cpumask_read(struct file *filp, char __user *ubuf,
  		     size_t count, loff_t *ppos)
  {
  	struct trace_array *tr = file_inode(filp)->i_private;
 +	char *mask_str;
  	int len;
  
 -	mutex_lock(&tracing_cpumask_update_lock);
 +	len = snprintf(NULL, 0, "%*pb\n",
 +		       cpumask_pr_args(tr->tracing_cpumask)) + 1;
 +	mask_str = kmalloc(len, GFP_KERNEL);
 +	if (!mask_str)
 +		return -ENOMEM;
  
 -	len = snprintf(mask_str, count, "%*pb\n",
 +	len = snprintf(mask_str, len, "%*pb\n",
  		       cpumask_pr_args(tr->tracing_cpumask));
  	if (len >= count) {
  		count = -EINVAL;
  		goto out_err;
  	}
 -	count = simple_read_from_buffer(ubuf, count, ppos, mask_str, NR_CPUS+1);
 +	count = simple_read_from_buffer(ubuf, count, ppos, mask_str, len);
  
  out_err:
 -	mutex_unlock(&tracing_cpumask_update_lock);
 +	kfree(mask_str);
  
  	return count;
  }
@@@ -4221,6 -4228,8 +4221,6 @@@ tracing_cpumask_write(struct file *filp
  	if (err)
  		goto err_unlock;
  
 -	mutex_lock(&tracing_cpumask_update_lock);
 -
  	local_irq_disable();
  	arch_spin_lock(&tr->max_lock);
  	for_each_tracing_cpu(cpu) {
@@@ -4243,6 -4252,8 +4243,6 @@@
  	local_irq_enable();
  
  	cpumask_copy(tr->tracing_cpumask, tracing_cpumask_new);
 -
 -	mutex_unlock(&tracing_cpumask_update_lock);
  	free_cpumask_var(tracing_cpumask_new);
  
  	return count;
@@@ -5621,7 -5632,7 +5621,7 @@@ static int tracing_release_pipe(struct 
  	return 0;
  }
  
- static unsigned int
+ static __poll_t
  trace_poll(struct trace_iterator *iter, struct file *filp, poll_table *poll_table)
  {
  	struct trace_array *tr = iter->tr;
@@@ -5640,7 -5651,7 +5640,7 @@@
  					     filp, poll_table);
  }
  
- static unsigned int
+ static __poll_t
  tracing_poll_pipe(struct file *filp, poll_table *poll_table)
  {
  	struct trace_iterator *iter = filp->private_data;
@@@ -6594,7 -6605,7 +6594,7 @@@ static int tracing_buffers_open(struct 
  	return ret;
  }
  
- static unsigned int
+ static __poll_t
  tracing_buffers_poll(struct file *filp, poll_table *poll_table)
  {
  	struct ftrace_buffer_info *info = filp->private_data;
@@@ -6769,7 -6780,7 +6769,7 @@@ tracing_buffers_splice_read(struct fil
  		.spd_release	= buffer_spd_release,
  	};
  	struct buffer_ref *ref;
 -	int entries, size, i;
 +	int entries, i;
  	ssize_t ret = 0;
  
  #ifdef CONFIG_TRACER_MAX_TRACE
@@@ -6823,6 -6834,14 +6823,6 @@@
  			break;
  		}
  
 -		/*
 -		 * zero out any left over data, this is going to
 -		 * user land.
 -		 */
 -		size = ring_buffer_page_len(ref->page);
 -		if (size < PAGE_SIZE)
 -			memset(ref->page + size, 0, PAGE_SIZE - size);
 -
  		page = virt_to_page(ref->page);
  
  		spd.pages[i] = page;
@@@ -7580,7 -7599,6 +7580,7 @@@ allocate_trace_buffer(struct trace_arra
  	buf->data = alloc_percpu(struct trace_array_cpu);
  	if (!buf->data) {
  		ring_buffer_free(buf->buffer);
 +		buf->buffer = NULL;
  		return -ENOMEM;
  	}
  
@@@ -7604,9 -7622,7 +7604,9 @@@ static int allocate_trace_buffers(struc
  				    allocate_snapshot ? size : 1);
  	if (WARN_ON(ret)) {
  		ring_buffer_free(tr->trace_buffer.buffer);
 +		tr->trace_buffer.buffer = NULL;
  		free_percpu(tr->trace_buffer.data);
 +		tr->trace_buffer.data = NULL;
  		return -ENOMEM;
  	}
  	tr->allocated_snapshot = allocate_snapshot;
diff --combined mm/gup.c
index e0d82b6706d7,17ee7a18aa11..9e17d8db2d6b
--- a/mm/gup.c
+++ b/mm/gup.c
@@@ -66,7 -66,7 +66,7 @@@ static int follow_pfn_pte(struct vm_are
   */
  static inline bool can_follow_write_pte(pte_t pte, unsigned int flags)
  {
 -	return pte_access_permitted(pte, WRITE) ||
 +	return pte_write(pte) ||
  		((flags & FOLL_FORCE) && (flags & FOLL_COW) && pte_dirty(pte));
  }
  
@@@ -848,7 -848,7 +848,7 @@@ static __always_inline long __get_user_
  						unsigned long nr_pages,
  						struct page **pages,
  						struct vm_area_struct **vmas,
- 						int *locked, bool notify_drop,
+ 						int *locked,
  						unsigned int flags)
  {
  	long ret, pages_done;
@@@ -922,7 -922,7 +922,7 @@@
  		pages++;
  		start += PAGE_SIZE;
  	}
- 	if (notify_drop && lock_dropped && *locked) {
+ 	if (lock_dropped && *locked) {
  		/*
  		 * We must let the caller know we temporarily dropped the lock
  		 * and so the critical section protected by it was lost.
@@@ -959,36 -959,12 +959,12 @@@ long get_user_pages_locked(unsigned lon
  			   int *locked)
  {
  	return __get_user_pages_locked(current, current->mm, start, nr_pages,
- 				       pages, NULL, locked, true,
+ 				       pages, NULL, locked,
  				       gup_flags | FOLL_TOUCH);
  }
  EXPORT_SYMBOL(get_user_pages_locked);
  
  /*
-  * Same as get_user_pages_unlocked(...., FOLL_TOUCH) but it allows for
-  * tsk, mm to be specified.
-  *
-  * NOTE: here FOLL_TOUCH is not set implicitly and must be set by the
-  * caller if required (just like with __get_user_pages). "FOLL_GET"
-  * is set implicitly if "pages" is non-NULL.
-  */
- static __always_inline long __get_user_pages_unlocked(struct task_struct *tsk,
- 		struct mm_struct *mm, unsigned long start,
- 		unsigned long nr_pages, struct page **pages,
- 		unsigned int gup_flags)
- {
- 	long ret;
- 	int locked = 1;
- 
- 	down_read(&mm->mmap_sem);
- 	ret = __get_user_pages_locked(tsk, mm, start, nr_pages, pages, NULL,
- 				      &locked, false, gup_flags);
- 	if (locked)
- 		up_read(&mm->mmap_sem);
- 	return ret;
- }
- 
- /*
   * get_user_pages_unlocked() is suitable to replace the form:
   *
   *      down_read(&mm->mmap_sem);
@@@ -1006,8 -982,16 +982,16 @@@
  long get_user_pages_unlocked(unsigned long start, unsigned long nr_pages,
  			     struct page **pages, unsigned int gup_flags)
  {
- 	return __get_user_pages_unlocked(current, current->mm, start, nr_pages,
- 					 pages, gup_flags | FOLL_TOUCH);
+ 	struct mm_struct *mm = current->mm;
+ 	int locked = 1;
+ 	long ret;
+ 
+ 	down_read(&mm->mmap_sem);
+ 	ret = __get_user_pages_locked(current, mm, start, nr_pages, pages, NULL,
+ 				      &locked, gup_flags | FOLL_TOUCH);
+ 	if (locked)
+ 		up_read(&mm->mmap_sem);
+ 	return ret;
  }
  EXPORT_SYMBOL(get_user_pages_unlocked);
  
@@@ -1073,7 -1057,7 +1057,7 @@@ long get_user_pages_remote(struct task_
  		struct vm_area_struct **vmas, int *locked)
  {
  	return __get_user_pages_locked(tsk, mm, start, nr_pages, pages, vmas,
- 				       locked, true,
+ 				       locked,
  				       gup_flags | FOLL_TOUCH | FOLL_REMOTE);
  }
  EXPORT_SYMBOL(get_user_pages_remote);
@@@ -1090,7 -1074,7 +1074,7 @@@ long get_user_pages(unsigned long start
  		struct vm_area_struct **vmas)
  {
  	return __get_user_pages_locked(current, current->mm, start, nr_pages,
- 				       pages, vmas, NULL, false,
+ 				       pages, vmas, NULL,
  				       gup_flags | FOLL_TOUCH);
  }
  EXPORT_SYMBOL(get_user_pages);
diff --combined net/9p/trans_fd.c
index 80f5c79053a4,439014113a5c..d6f7f7cb79c4
--- a/net/9p/trans_fd.c
+++ b/net/9p/trans_fd.c
@@@ -228,32 -228,31 +228,31 @@@ static void p9_conn_cancel(struct p9_co
  	}
  }
  
- static int
- p9_fd_poll(struct p9_client *client, struct poll_table_struct *pt)
+ static __poll_t
+ p9_fd_poll(struct p9_client *client, struct poll_table_struct *pt, int *err)
  {
- 	int ret, n;
+ 	__poll_t ret, n;
  	struct p9_trans_fd *ts = NULL;
  
  	if (client && client->status == Connected)
  		ts = client->trans;
  
- 	if (!ts)
- 		return -EREMOTEIO;
+ 	if (!ts) {
+ 		if (err)
+ 			*err = -EREMOTEIO;
+ 		return POLLERR;
+ 	}
  
  	if (!ts->rd->f_op->poll)
- 		return -EIO;
- 
- 	if (!ts->wr->f_op->poll)
- 		return -EIO;
- 
- 	ret = ts->rd->f_op->poll(ts->rd, pt);
- 	if (ret < 0)
- 		return ret;
+ 		ret = DEFAULT_POLLMASK;
+ 	else
+ 		ret = ts->rd->f_op->poll(ts->rd, pt);
  
  	if (ts->rd != ts->wr) {
- 		n = ts->wr->f_op->poll(ts->wr, pt);
- 		if (n < 0)
- 			return n;
+ 		if (!ts->wr->f_op->poll)
+ 			n = DEFAULT_POLLMASK;
+ 		else
+ 			n = ts->wr->f_op->poll(ts->wr, pt);
  		ret = (ret & ~POLLOUT) | (n & ~POLLIN);
  	}
  
@@@ -298,7 -297,8 +297,8 @@@ static int p9_fd_read(struct p9_client 
  
  static void p9_read_work(struct work_struct *work)
  {
- 	int n, err;
+ 	__poll_t n;
+ 	int err;
  	struct p9_conn *m;
  	int status = REQ_STATUS_ERROR;
  
@@@ -398,7 -398,7 +398,7 @@@ end_clear
  		if (test_and_clear_bit(Rpending, &m->wsched))
  			n = POLLIN;
  		else
- 			n = p9_fd_poll(m->client, NULL);
+ 			n = p9_fd_poll(m->client, NULL, NULL);
  
  		if ((n & POLLIN) && !test_and_set_bit(Rworksched, &m->wsched)) {
  			p9_debug(P9_DEBUG_TRANS, "sched read work %p\n", m);
@@@ -448,7 -448,8 +448,8 @@@ static int p9_fd_write(struct p9_clien
  
  static void p9_write_work(struct work_struct *work)
  {
- 	int n, err;
+ 	__poll_t n;
+ 	int err;
  	struct p9_conn *m;
  	struct p9_req_t *req;
  
@@@ -506,7 -507,7 +507,7 @@@ end_clear
  		if (test_and_clear_bit(Wpending, &m->wsched))
  			n = POLLOUT;
  		else
- 			n = p9_fd_poll(m->client, NULL);
+ 			n = p9_fd_poll(m->client, NULL, NULL);
  
  		if ((n & POLLOUT) &&
  		   !test_and_set_bit(Wworksched, &m->wsched)) {
@@@ -581,7 -582,7 +582,7 @@@ p9_pollwait(struct file *filp, wait_que
  
  static void p9_conn_create(struct p9_client *client)
  {
- 	int n;
+ 	__poll_t n;
  	struct p9_trans_fd *ts = client->trans;
  	struct p9_conn *m = &ts->conn;
  
@@@ -597,7 -598,7 +598,7 @@@
  	INIT_LIST_HEAD(&m->poll_pending_link);
  	init_poll_funcptr(&m->pt, p9_pollwait);
  
- 	n = p9_fd_poll(client, &m->pt);
+ 	n = p9_fd_poll(client, &m->pt, NULL);
  	if (n & POLLIN) {
  		p9_debug(P9_DEBUG_TRANS, "mux %p can read\n", m);
  		set_bit(Rpending, &m->wsched);
@@@ -617,17 -618,16 +618,16 @@@
  
  static void p9_poll_mux(struct p9_conn *m)
  {
- 	int n;
+ 	__poll_t n;
+ 	int err = -ECONNRESET;
  
  	if (m->err < 0)
  		return;
  
- 	n = p9_fd_poll(m->client, NULL);
- 	if (n < 0 || n & (POLLERR | POLLHUP | POLLNVAL)) {
+ 	n = p9_fd_poll(m->client, NULL, &err);
+ 	if (n & (POLLERR | POLLHUP | POLLNVAL)) {
  		p9_debug(P9_DEBUG_TRANS, "error mux %p err %d\n", m, n);
- 		if (n >= 0)
- 			n = -ECONNRESET;
- 		p9_conn_cancel(m, n);
+ 		p9_conn_cancel(m, err);
  	}
  
  	if (n & POLLIN) {
@@@ -663,7 -663,7 +663,7 @@@
  
  static int p9_fd_request(struct p9_client *client, struct p9_req_t *req)
  {
- 	int n;
+ 	__poll_t n;
  	struct p9_trans_fd *ts = client->trans;
  	struct p9_conn *m = &ts->conn;
  
@@@ -680,7 -680,7 +680,7 @@@
  	if (test_and_clear_bit(Wpending, &m->wsched))
  		n = POLLOUT;
  	else
- 		n = p9_fd_poll(m->client, NULL);
+ 		n = p9_fd_poll(m->client, NULL, NULL);
  
  	if (n & POLLOUT && !test_and_set_bit(Wworksched, &m->wsched))
  		schedule_work(&m->wq);
@@@ -839,6 -839,7 +839,6 @@@ static int p9_socket_open(struct p9_cli
  	if (IS_ERR(file)) {
  		pr_err("%s (%d): failed to map fd\n",
  		       __func__, task_pid_nr(current));
 -		sock_release(csocket);
  		kfree(p);
  		return PTR_ERR(file);
  	}
diff --combined net/dccp/proto.c
index 9d43c1f40274,cfa9ca9939ce..8b8db3d481bd
--- a/net/dccp/proto.c
+++ b/net/dccp/proto.c
@@@ -259,7 -259,6 +259,7 @@@ int dccp_disconnect(struct sock *sk, in
  {
  	struct inet_connection_sock *icsk = inet_csk(sk);
  	struct inet_sock *inet = inet_sk(sk);
 +	struct dccp_sock *dp = dccp_sk(sk);
  	int err = 0;
  	const int old_state = sk->sk_state;
  
@@@ -279,10 -278,6 +279,10 @@@
  		sk->sk_err = ECONNRESET;
  
  	dccp_clear_xmit_timers(sk);
 +	ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
 +	ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
 +	dp->dccps_hc_rx_ccid = NULL;
 +	dp->dccps_hc_tx_ccid = NULL;
  
  	__skb_queue_purge(&sk->sk_receive_queue);
  	__skb_queue_purge(&sk->sk_write_queue);
@@@ -318,10 -313,10 +318,10 @@@ EXPORT_SYMBOL_GPL(dccp_disconnect)
   *	take care of normal races (between the test and the event) and we don't
   *	go look at any of the socket buffers directly.
   */
- unsigned int dccp_poll(struct file *file, struct socket *sock,
+ __poll_t dccp_poll(struct file *file, struct socket *sock,
  		       poll_table *wait)
  {
- 	unsigned int mask;
+ 	__poll_t mask;
  	struct sock *sk = sock->sk;
  
  	sock_poll_wait(file, sk_sleep(sk), wait);
diff --combined net/ipv4/tcp.c
index f08eebe60446,0b8ca689353b..c4a7ee7f6721
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@@ -493,9 -493,9 +493,9 @@@ static void tcp_tx_timestamp(struct soc
   *	take care of normal races (between the test and the event) and we don't
   *	go look at any of the socket buffers directly.
   */
- unsigned int tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
+ __poll_t tcp_poll(struct file *file, struct socket *sock, poll_table *wait)
  {
- 	unsigned int mask;
+ 	__poll_t mask;
  	struct sock *sk = sock->sk;
  	const struct tcp_sock *tp = tcp_sk(sk);
  	int state;
@@@ -2412,7 -2412,6 +2412,7 @@@ int tcp_disconnect(struct sock *sk, in
  	tp->snd_cwnd_cnt = 0;
  	tp->window_clamp = 0;
  	tcp_set_ca_state(sk, TCP_CA_Open);
 +	tp->is_sack_reneg = 0;
  	tcp_clear_retrans(tp);
  	inet_csk_delack_init(sk);
  	/* Initialize rcv_mss to TCP_MIN_MSS to avoid division by 0
diff --combined net/rxrpc/af_rxrpc.c
index dcd818fa837e,50ae1e2557fe..21ad6a3a465c
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@@ -729,12 -729,12 +729,12 @@@ static int rxrpc_getsockopt(struct sock
  /*
   * permit an RxRPC socket to be polled
   */
- static unsigned int rxrpc_poll(struct file *file, struct socket *sock,
+ static __poll_t rxrpc_poll(struct file *file, struct socket *sock,
  			       poll_table *wait)
  {
  	struct sock *sk = sock->sk;
  	struct rxrpc_sock *rx = rxrpc_sk(sk);
- 	unsigned int mask;
+ 	__poll_t mask;
  
  	sock_poll_wait(file, sk_sleep(sk), wait);
  	mask = 0;
@@@ -860,7 -860,6 +860,7 @@@ static void rxrpc_sock_destructor(struc
  static int rxrpc_release_sock(struct sock *sk)
  {
  	struct rxrpc_sock *rx = rxrpc_sk(sk);
 +	struct rxrpc_net *rxnet = rxrpc_net(sock_net(&rx->sk));
  
  	_enter("%p{%d,%d}", sk, sk->sk_state, refcount_read(&sk->sk_refcnt));
  
@@@ -896,8 -895,8 +896,8 @@@
  	rxrpc_release_calls_on_socket(rx);
  	flush_workqueue(rxrpc_workqueue);
  	rxrpc_purge_queue(&sk->sk_receive_queue);
 -	rxrpc_queue_work(&rx->local->rxnet->service_conn_reaper);
 -	rxrpc_queue_work(&rx->local->rxnet->client_conn_reaper);
 +	rxrpc_queue_work(&rxnet->service_conn_reaper);
 +	rxrpc_queue_work(&rxnet->client_conn_reaper);
  
  	rxrpc_put_local(rx->local);
  	rx->local = NULL;
diff --combined net/sctp/socket.c
index b4fb6e4886d2,3a1b134ff592..8f7536de5f41
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@@ -3891,17 -3891,13 +3891,17 @@@ static int sctp_setsockopt_reset_stream
  	struct sctp_association *asoc;
  	int retval = -EINVAL;
  
 -	if (optlen < sizeof(struct sctp_reset_streams))
 +	if (optlen < sizeof(*params))
  		return -EINVAL;
  
  	params = memdup_user(optval, optlen);
  	if (IS_ERR(params))
  		return PTR_ERR(params);
  
 +	if (params->srs_number_streams * sizeof(__u16) >
 +	    optlen - sizeof(*params))
 +		goto out;
 +
  	asoc = sctp_id2assoc(sk, params->srs_assoc_id);
  	if (!asoc)
  		goto out;
@@@ -4498,7 -4494,7 +4498,7 @@@ static int sctp_init_sock(struct sock *
  	SCTP_DBG_OBJCNT_INC(sock);
  
  	local_bh_disable();
 -	percpu_counter_inc(&sctp_sockets_allocated);
 +	sk_sockets_allocated_inc(sk);
  	sock_prot_inuse_add(net, sk->sk_prot, 1);
  
  	/* Nothing can fail after this block, otherwise
@@@ -4542,7 -4538,7 +4542,7 @@@ static void sctp_destroy_sock(struct so
  	}
  	sctp_endpoint_free(sp->ep);
  	local_bh_disable();
 -	percpu_counter_dec(&sctp_sockets_allocated);
 +	sk_sockets_allocated_dec(sk);
  	sock_prot_inuse_add(sock_net(sk), sk->sk_prot, -1);
  	local_bh_enable();
  }
@@@ -5084,6 -5080,7 +5084,6 @@@ static int sctp_getsockopt_peeloff_comm
  	*newfile = sock_alloc_file(newsock, 0, NULL);
  	if (IS_ERR(*newfile)) {
  		put_unused_fd(retval);
 -		sock_release(newsock);
  		retval = PTR_ERR(*newfile);
  		*newfile = NULL;
  		return retval;
@@@ -7500,11 -7497,11 +7500,11 @@@ out
   * here, again, by modeling the current TCP/UDP code.  We don't have
   * a good way to test with it yet.
   */
- unsigned int sctp_poll(struct file *file, struct socket *sock, poll_table *wait)
+ __poll_t sctp_poll(struct file *file, struct socket *sock, poll_table *wait)
  {
  	struct sock *sk = sock->sk;
  	struct sctp_sock *sp = sctp_sk(sk);
- 	unsigned int mask;
+ 	__poll_t mask;
  
  	poll_wait(file, sk_sleep(sk), wait);
  
diff --combined net/socket.c
index 05f361faec45,3e5e4f13046c..092baa464afc
--- a/net/socket.c
+++ b/net/socket.c
@@@ -118,7 -118,7 +118,7 @@@ static ssize_t sock_write_iter(struct k
  static int sock_mmap(struct file *file, struct vm_area_struct *vma);
  
  static int sock_close(struct inode *inode, struct file *file);
- static unsigned int sock_poll(struct file *file,
+ static __poll_t sock_poll(struct file *file,
  			      struct poll_table_struct *wait);
  static long sock_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
  #ifdef CONFIG_COMPAT
@@@ -406,10 -406,8 +406,10 @@@ struct file *sock_alloc_file(struct soc
  		name.len = strlen(name.name);
  	}
  	path.dentry = d_alloc_pseudo(sock_mnt->mnt_sb, &name);
 -	if (unlikely(!path.dentry))
 +	if (unlikely(!path.dentry)) {
 +		sock_release(sock);
  		return ERR_PTR(-ENOMEM);
 +	}
  	path.mnt = mntget(sock_mnt);
  
  	d_instantiate(path.dentry, SOCK_INODE(sock));
@@@ -417,11 -415,9 +417,11 @@@
  	file = alloc_file(&path, FMODE_READ | FMODE_WRITE,
  		  &socket_file_ops);
  	if (IS_ERR(file)) {
 -		/* drop dentry, keep inode */
 +		/* drop dentry, keep inode for a bit */
  		ihold(d_inode(path.dentry));
  		path_put(&path);
 +		/* ... and now kill it properly */
 +		sock_release(sock);
  		return file;
  	}
  
@@@ -1095,9 -1091,9 +1095,9 @@@ out_release
  EXPORT_SYMBOL(sock_create_lite);
  
  /* No kernel lock held - perfect */
- static unsigned int sock_poll(struct file *file, poll_table *wait)
+ static __poll_t sock_poll(struct file *file, poll_table *wait)
  {
- 	unsigned int busy_flag = 0;
+ 	__poll_t busy_flag = 0;
  	struct socket *sock;
  
  	/*
@@@ -1334,9 -1330,19 +1334,9 @@@ SYSCALL_DEFINE3(socket, int, family, in
  
  	retval = sock_create(family, type, protocol, &sock);
  	if (retval < 0)
 -		goto out;
 -
 -	retval = sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK));
 -	if (retval < 0)
 -		goto out_release;
 -
 -out:
 -	/* It may be already another descriptor 8) Not kernel problem. */
 -	return retval;
 +		return retval;
  
 -out_release:
 -	sock_release(sock);
 -	return retval;
 +	return sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK));
  }
  
  /*
@@@ -1360,72 -1366,87 +1360,72 @@@ SYSCALL_DEFINE4(socketpair, int, family
  		flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
  
  	/*
 +	 * reserve descriptors and make sure we won't fail
 +	 * to return them to userland.
 +	 */
 +	fd1 = get_unused_fd_flags(flags);
 +	if (unlikely(fd1 < 0))
 +		return fd1;
 +
 +	fd2 = get_unused_fd_flags(flags);
 +	if (unlikely(fd2 < 0)) {
 +		put_unused_fd(fd1);
 +		return fd2;
 +	}
 +
 +	err = put_user(fd1, &usockvec[0]);
 +	if (err)
 +		goto out;
 +
 +	err = put_user(fd2, &usockvec[1]);
 +	if (err)
 +		goto out;
 +
 +	/*
  	 * Obtain the first socket and check if the underlying protocol
  	 * supports the socketpair call.
  	 */
  
  	err = sock_create(family, type, protocol, &sock1);
 -	if (err < 0)
 +	if (unlikely(err < 0))
  		goto out;
  
  	err = sock_create(family, type, protocol, &sock2);
 -	if (err < 0)
 -		goto out_release_1;
 -
 -	err = sock1->ops->socketpair(sock1, sock2);
 -	if (err < 0)
 -		goto out_release_both;
 -
 -	fd1 = get_unused_fd_flags(flags);
 -	if (unlikely(fd1 < 0)) {
 -		err = fd1;
 -		goto out_release_both;
 +	if (unlikely(err < 0)) {
 +		sock_release(sock1);
 +		goto out;
  	}
  
 -	fd2 = get_unused_fd_flags(flags);
 -	if (unlikely(fd2 < 0)) {
 -		err = fd2;
 -		goto out_put_unused_1;
 +	err = sock1->ops->socketpair(sock1, sock2);
 +	if (unlikely(err < 0)) {
 +		sock_release(sock2);
 +		sock_release(sock1);
 +		goto out;
  	}
  
  	newfile1 = sock_alloc_file(sock1, flags, NULL);
  	if (IS_ERR(newfile1)) {
  		err = PTR_ERR(newfile1);
 -		goto out_put_unused_both;
 +		sock_release(sock2);
 +		goto out;
  	}
  
  	newfile2 = sock_alloc_file(sock2, flags, NULL);
  	if (IS_ERR(newfile2)) {
  		err = PTR_ERR(newfile2);
 -		goto out_fput_1;
 +		fput(newfile1);
 +		goto out;
  	}
  
 -	err = put_user(fd1, &usockvec[0]);
 -	if (err)
 -		goto out_fput_both;
 -
 -	err = put_user(fd2, &usockvec[1]);
 -	if (err)
 -		goto out_fput_both;
 -
  	audit_fd_pair(fd1, fd2);
  
  	fd_install(fd1, newfile1);
  	fd_install(fd2, newfile2);
 -	/* fd1 and fd2 may be already another descriptors.
 -	 * Not kernel problem.
 -	 */
 -
  	return 0;
  
 -out_fput_both:
 -	fput(newfile2);
 -	fput(newfile1);
 -	put_unused_fd(fd2);
 -	put_unused_fd(fd1);
 -	goto out;
 -
 -out_fput_1:
 -	fput(newfile1);
 -	put_unused_fd(fd2);
 -	put_unused_fd(fd1);
 -	sock_release(sock2);
 -	goto out;
 -
 -out_put_unused_both:
 +out:
  	put_unused_fd(fd2);
 -out_put_unused_1:
  	put_unused_fd(fd1);
 -out_release_both:
 -	sock_release(sock2);
 -out_release_1:
 -	sock_release(sock1);
 -out:
  	return err;
  }
  
@@@ -1541,6 -1562,7 +1541,6 @@@ SYSCALL_DEFINE4(accept4, int, fd, struc
  	if (IS_ERR(newfile)) {
  		err = PTR_ERR(newfile);
  		put_unused_fd(newfd);
 -		sock_release(newsock);
  		goto out_put;
  	}
  
diff --combined net/tipc/server.c
index d60c30342327,0c3b74d1e722..78a292a84afc
--- a/net/tipc/server.c
+++ b/net/tipc/server.c
@@@ -264,8 -264,8 +264,8 @@@ static int tipc_receive_from_sock(struc
  	iov.iov_base = buf;
  	iov.iov_len = s->max_rcvbuf_size;
  	msg.msg_name = &addr;
- 	ret = kernel_recvmsg(con->sock, &msg, &iov, 1, iov.iov_len,
- 			     MSG_DONTWAIT);
+ 	iov_iter_kvec(&msg.msg_iter, READ | ITER_KVEC, &iov, 1, iov.iov_len);
+ 	ret = sock_recvmsg(con->sock, &msg, MSG_DONTWAIT);
  	if (ret <= 0) {
  		kmem_cache_free(s->rcvbuf_cache, buf);
  		goto out_close;
@@@ -314,7 -314,6 +314,7 @@@ static int tipc_accept_from_sock(struc
  	newcon->usr_data = s->tipc_conn_new(newcon->conid);
  	if (!newcon->usr_data) {
  		sock_release(newsock);
 +		conn_put(newcon);
  		return -ENOMEM;
  	}
  
@@@ -512,7 -511,7 +512,7 @@@ bool tipc_topsrv_kern_subscr(struct ne
  	s = con->server;
  	scbr = s->tipc_conn_new(*conid);
  	if (!scbr) {
 -		tipc_close_conn(con);
 +		conn_put(con);
  		return false;
  	}
  
diff --combined net/tipc/socket.c
index 3b4084480377,d94d25855190..2aa46e8cd8fe
--- a/net/tipc/socket.c
+++ b/net/tipc/socket.c
@@@ -710,13 -710,13 +710,13 @@@ static int tipc_getname(struct socket *
   * imply that the operation will succeed, merely that it should be performed
   * and will not block.
   */
- static unsigned int tipc_poll(struct file *file, struct socket *sock,
+ static __poll_t tipc_poll(struct file *file, struct socket *sock,
  			      poll_table *wait)
  {
  	struct sock *sk = sock->sk;
  	struct tipc_sock *tsk = tipc_sk(sk);
  	struct tipc_group *grp = tsk->group;
- 	u32 revents = 0;
+ 	__poll_t revents = 0;
  
  	sock_poll_wait(file, sk_sleep(sk), wait);
  
@@@ -727,11 -727,11 +727,11 @@@
  
  	switch (sk->sk_state) {
  	case TIPC_ESTABLISHED:
 +	case TIPC_CONNECTING:
  		if (!tsk->cong_link_cnt && !tsk_conn_cong(tsk))
  			revents |= POLLOUT;
  		/* fall thru' */
  	case TIPC_LISTEN:
 -	case TIPC_CONNECTING:
  		if (!skb_queue_empty(&sk->sk_receive_queue))
  			revents |= POLLIN | POLLRDNORM;
  		break;
@@@ -1140,7 -1140,7 +1140,7 @@@ void tipc_sk_mcast_rcv(struct net *net
  				__skb_dequeue(arrvq);
  				__skb_queue_tail(inputq, skb);
  			}
 -			refcount_dec(&skb->users);
 +			kfree_skb(skb);
  			spin_unlock_bh(&inputq->lock);
  			continue;
  		}
diff --combined sound/core/oss/pcm_oss.c
index c2db7e905f7d,caa4d0c949bf..cb17a8cb45f5
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@@ -455,6 -455,7 +455,6 @@@ static int snd_pcm_hw_param_near(struc
  		v = snd_pcm_hw_param_last(pcm, params, var, dir);
  	else
  		v = snd_pcm_hw_param_first(pcm, params, var, dir);
 -	snd_BUG_ON(v < 0);
  	return v;
  }
  
@@@ -1334,11 -1335,8 +1334,11 @@@ static ssize_t snd_pcm_oss_write1(struc
  
  	if ((tmp = snd_pcm_oss_make_ready(substream)) < 0)
  		return tmp;
 -	mutex_lock(&runtime->oss.params_lock);
  	while (bytes > 0) {
 +		if (mutex_lock_interruptible(&runtime->oss.params_lock)) {
 +			tmp = -ERESTARTSYS;
 +			break;
 +		}
  		if (bytes < runtime->oss.period_bytes || runtime->oss.buffer_used > 0) {
  			tmp = bytes;
  			if (tmp + runtime->oss.buffer_used > runtime->oss.period_bytes)
@@@ -1382,18 -1380,14 +1382,18 @@@
  			xfer += tmp;
  			if ((substream->f_flags & O_NONBLOCK) != 0 &&
  			    tmp != runtime->oss.period_bytes)
 -				break;
 +				tmp = -EAGAIN;
  		}
 -	}
 -	mutex_unlock(&runtime->oss.params_lock);
 -	return xfer;
 -
   err:
 -	mutex_unlock(&runtime->oss.params_lock);
 +		mutex_unlock(&runtime->oss.params_lock);
 +		if (tmp < 0)
 +			break;
 +		if (signal_pending(current)) {
 +			tmp = -ERESTARTSYS;
 +			break;
 +		}
 +		tmp = 0;
 +	}
  	return xfer > 0 ? (snd_pcm_sframes_t)xfer : tmp;
  }
  
@@@ -1441,11 -1435,8 +1441,11 @@@ static ssize_t snd_pcm_oss_read1(struc
  
  	if ((tmp = snd_pcm_oss_make_ready(substream)) < 0)
  		return tmp;
 -	mutex_lock(&runtime->oss.params_lock);
  	while (bytes > 0) {
 +		if (mutex_lock_interruptible(&runtime->oss.params_lock)) {
 +			tmp = -ERESTARTSYS;
 +			break;
 +		}
  		if (bytes < runtime->oss.period_bytes || runtime->oss.buffer_used > 0) {
  			if (runtime->oss.buffer_used == 0) {
  				tmp = snd_pcm_oss_read2(substream, runtime->oss.buffer, runtime->oss.period_bytes, 1);
@@@ -1476,16 -1467,12 +1476,16 @@@
  			bytes -= tmp;
  			xfer += tmp;
  		}
 -	}
 -	mutex_unlock(&runtime->oss.params_lock);
 -	return xfer;
 -
   err:
 -	mutex_unlock(&runtime->oss.params_lock);
 +		mutex_unlock(&runtime->oss.params_lock);
 +		if (tmp < 0)
 +			break;
 +		if (signal_pending(current)) {
 +			tmp = -ERESTARTSYS;
 +			break;
 +		}
 +		tmp = 0;
 +	}
  	return xfer > 0 ? (snd_pcm_sframes_t)xfer : tmp;
  }
  
@@@ -2686,10 -2673,10 +2686,10 @@@ static int snd_pcm_oss_capture_ready(st
  						runtime->oss.period_frames;
  }
  
- static unsigned int snd_pcm_oss_poll(struct file *file, poll_table * wait)
+ static __poll_t snd_pcm_oss_poll(struct file *file, poll_table * wait)
  {
  	struct snd_pcm_oss_file *pcm_oss_file;
- 	unsigned int mask;
+ 	__poll_t mask;
  	struct snd_pcm_substream *psubstream = NULL, *csubstream = NULL;
  	
  	pcm_oss_file = file->private_data;
diff --combined sound/core/pcm_native.c
index f08772568c17,6077dd6a0901..3f13e8da0812
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@@ -2580,7 -2580,7 +2580,7 @@@ static snd_pcm_sframes_t forward_appl_p
  	return ret < 0 ? ret : frames;
  }
  
 -/* decrease the appl_ptr; returns the processed frames or a negative error */
 +/* decrease the appl_ptr; returns the processed frames or zero for error */
  static snd_pcm_sframes_t rewind_appl_ptr(struct snd_pcm_substream *substream,
  					 snd_pcm_uframes_t frames,
  					 snd_pcm_sframes_t avail)
@@@ -2597,12 -2597,7 +2597,12 @@@
  	if (appl_ptr < 0)
  		appl_ptr += runtime->boundary;
  	ret = pcm_lib_apply_appl_ptr(substream, appl_ptr);
 -	return ret < 0 ? ret : frames;
 +	/* NOTE: we return zero for errors because PulseAudio gets depressed
 +	 * upon receiving an error from rewind ioctl and stops processing
 +	 * any longer.  Returning zero means that no rewind is done, so
 +	 * it's not absolutely wrong to answer like that.
 +	 */
 +	return ret < 0 ? 0 : frames;
  }
  
  static snd_pcm_sframes_t snd_pcm_playback_rewind(struct snd_pcm_substream *substream,
@@@ -3135,12 -3130,12 +3135,12 @@@ static ssize_t snd_pcm_writev(struct ki
  	return result;
  }
  
- static unsigned int snd_pcm_playback_poll(struct file *file, poll_table * wait)
+ static __poll_t snd_pcm_playback_poll(struct file *file, poll_table * wait)
  {
  	struct snd_pcm_file *pcm_file;
  	struct snd_pcm_substream *substream;
  	struct snd_pcm_runtime *runtime;
-         unsigned int mask;
+         __poll_t mask;
  	snd_pcm_uframes_t avail;
  
  	pcm_file = file->private_data;
@@@ -3174,12 -3169,12 +3174,12 @@@
  	return mask;
  }
  
- static unsigned int snd_pcm_capture_poll(struct file *file, poll_table * wait)
+ static __poll_t snd_pcm_capture_poll(struct file *file, poll_table * wait)
  {
  	struct snd_pcm_file *pcm_file;
  	struct snd_pcm_substream *substream;
  	struct snd_pcm_runtime *runtime;
-         unsigned int mask;
+         __poll_t mask;
  	snd_pcm_uframes_t avail;
  
  	pcm_file = file->private_data;
diff --combined sound/core/rawmidi.c
index f055ca10bbc1,e7e4930732a3..fae21311723f
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@@ -579,14 -579,15 +579,14 @@@ static int snd_rawmidi_info_user(struc
  	return 0;
  }
  
 -int snd_rawmidi_info_select(struct snd_card *card, struct snd_rawmidi_info *info)
 +static int __snd_rawmidi_info_select(struct snd_card *card,
 +				     struct snd_rawmidi_info *info)
  {
  	struct snd_rawmidi *rmidi;
  	struct snd_rawmidi_str *pstr;
  	struct snd_rawmidi_substream *substream;
  
 -	mutex_lock(&register_mutex);
  	rmidi = snd_rawmidi_search(card, info->device);
 -	mutex_unlock(&register_mutex);
  	if (!rmidi)
  		return -ENXIO;
  	if (info->stream < 0 || info->stream > 1)
@@@ -602,16 -603,6 +602,16 @@@
  	}
  	return -ENXIO;
  }
 +
 +int snd_rawmidi_info_select(struct snd_card *card, struct snd_rawmidi_info *info)
 +{
 +	int ret;
 +
 +	mutex_lock(&register_mutex);
 +	ret = __snd_rawmidi_info_select(card, info);
 +	mutex_unlock(&register_mutex);
 +	return ret;
 +}
  EXPORT_SYMBOL(snd_rawmidi_info_select);
  
  static int snd_rawmidi_info_select_user(struct snd_card *card,
@@@ -1366,11 -1357,11 +1366,11 @@@ static ssize_t snd_rawmidi_write(struc
  	return result;
  }
  
- static unsigned int snd_rawmidi_poll(struct file *file, poll_table * wait)
+ static __poll_t snd_rawmidi_poll(struct file *file, poll_table * wait)
  {
  	struct snd_rawmidi_file *rfile;
  	struct snd_rawmidi_runtime *runtime;
- 	unsigned int mask;
+ 	__poll_t mask;
  
  	rfile = file->private_data;
  	if (rfile->input != NULL) {
diff --combined virt/kvm/kvm_main.c
index 210bf820385a,7b4d46432c85..d6b9370806f8
--- a/virt/kvm/kvm_main.c
+++ b/virt/kvm/kvm_main.c
@@@ -135,11 -135,6 +135,11 @@@ static void kvm_uevent_notify_change(un
  static unsigned long long kvm_createvm_count;
  static unsigned long long kvm_active_vms;
  
 +__weak void kvm_arch_mmu_notifier_invalidate_range(struct kvm *kvm,
 +		unsigned long start, unsigned long end)
 +{
 +}
 +
  bool kvm_is_reserved_pfn(kvm_pfn_t pfn)
  {
  	if (pfn_valid(pfn))
@@@ -365,9 -360,6 +365,9 @@@ static void kvm_mmu_notifier_invalidate
  		kvm_flush_remote_tlbs(kvm);
  
  	spin_unlock(&kvm->mmu_lock);
 +
 +	kvm_arch_mmu_notifier_invalidate_range(kvm, start, end);
 +
  	srcu_read_unlock(&kvm->srcu, idx);
  }
  
@@@ -1322,17 -1314,6 +1322,6 @@@ unsigned long kvm_vcpu_gfn_to_hva_prot(
  	return gfn_to_hva_memslot_prot(slot, gfn, writable);
  }
  
- static int get_user_page_nowait(unsigned long start, int write,
- 		struct page **page)
- {
- 	int flags = FOLL_NOWAIT | FOLL_HWPOISON;
- 
- 	if (write)
- 		flags |= FOLL_WRITE;
- 
- 	return get_user_pages(start, 1, flags, page, NULL);
- }
- 
  static inline int check_user_page_hwpoison(unsigned long addr)
  {
  	int rc, flags = FOLL_HWPOISON | FOLL_WRITE;
@@@ -1381,7 -1362,8 +1370,8 @@@ static bool hva_to_pfn_fast(unsigned lo
  static int hva_to_pfn_slow(unsigned long addr, bool *async, bool write_fault,
  			   bool *writable, kvm_pfn_t *pfn)
  {
- 	struct page *page[1];
+ 	unsigned int flags = FOLL_HWPOISON;
+ 	struct page *page;
  	int npages = 0;
  
  	might_sleep();
@@@ -1389,35 -1371,26 +1379,26 @@@
  	if (writable)
  		*writable = write_fault;
  
- 	if (async) {
- 		down_read(&current->mm->mmap_sem);
- 		npages = get_user_page_nowait(addr, write_fault, page);
- 		up_read(&current->mm->mmap_sem);
- 	} else {
- 		unsigned int flags = FOLL_HWPOISON;
- 
- 		if (write_fault)
- 			flags |= FOLL_WRITE;
+ 	if (write_fault)
+ 		flags |= FOLL_WRITE;
+ 	if (async)
+ 		flags |= FOLL_NOWAIT;
  
- 		npages = get_user_pages_unlocked(addr, 1, page, flags);
- 	}
+ 	npages = get_user_pages_unlocked(addr, 1, &page, flags);
  	if (npages != 1)
  		return npages;
  
  	/* map read fault as writable if possible */
  	if (unlikely(!write_fault) && writable) {
- 		struct page *wpage[1];
+ 		struct page *wpage;
  
- 		npages = __get_user_pages_fast(addr, 1, 1, wpage);
- 		if (npages == 1) {
+ 		if (__get_user_pages_fast(addr, 1, 1, &wpage) == 1) {
  			*writable = true;
- 			put_page(page[0]);
- 			page[0] = wpage[0];
+ 			put_page(page);
+ 			page = wpage;
  		}
- 
- 		npages = 1;
  	}
- 	*pfn = page_to_pfn(page[0]);
+ 	*pfn = page_to_pfn(page);
  	return npages;
  }
  

-- 
LinuxNextTracking


More information about the linux-merge mailing list