[gentoo-commits] proj/linux-patches:4.15 commit in: /

[Alice Ferrazzi]

commit:     d37109d7587a6faca28251272766319005a4c30b
Author:     Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
AuthorDate: Sun Feb 25 13:45:54 2018 +0000
Commit:     Alice Ferrazzi <alicef <AT> gentoo <DOT> org>
CommitDate: Sun Feb 25 13:45:54 2018 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=d37109d7

linux kernel 4.15.6

 0000_README             |    4 +
 1005_linux-4.15.6.patch | 1556 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 1560 insertions(+)

diff --git a/0000_README b/0000_README
index f22a6fe..828cfeb 100644
--- a/0000_README
+++ b/0000_README
@@ -63,6 +63,10 @@ Patch:  1004_linux-4.15.5.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.15.5
 
+Patch:  1005_linux-4.15.6.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.15.6
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1005_linux-4.15.6.patch b/1005_linux-4.15.6.patch
new file mode 100644
index 0000000..dc80bb9
--- /dev/null
+++ b/1005_linux-4.15.6.patch
@@ -0,0 +1,1556 @@
+diff --git a/Makefile b/Makefile
+index 28c537fbe328..51563c76bdf6 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 15
+-SUBLEVEL = 5
++SUBLEVEL = 6
+ EXTRAVERSION =
+ NAME = Fearless Coyote
+ 
+diff --git a/arch/arm/common/bL_switcher_dummy_if.c b/arch/arm/common/bL_switcher_dummy_if.c
+index 4c10c6452678..f4dc1714a79e 100644
+--- a/arch/arm/common/bL_switcher_dummy_if.c
++++ b/arch/arm/common/bL_switcher_dummy_if.c
+@@ -57,3 +57,7 @@ static struct miscdevice bL_switcher_device = {
+ 	&bL_switcher_fops
+ };
+ module_misc_device(bL_switcher_device);
++
++MODULE_AUTHOR("Nicolas Pitre <nico@××××××.org>");
++MODULE_LICENSE("GPL v2");
++MODULE_DESCRIPTION("big.LITTLE switcher dummy user interface");
+diff --git a/arch/arm64/boot/dts/mediatek/mt8173.dtsi b/arch/arm64/boot/dts/mediatek/mt8173.dtsi
+index 26396ef53bde..ea407aff1251 100644
+--- a/arch/arm64/boot/dts/mediatek/mt8173.dtsi
++++ b/arch/arm64/boot/dts/mediatek/mt8173.dtsi
+@@ -81,6 +81,7 @@
+ 			reg = <0x000>;
+ 			enable-method = "psci";
+ 			cpu-idle-states = <&CPU_SLEEP_0>;
++			#cooling-cells = <2>;
+ 		};
+ 
+ 		cpu1: cpu@1 {
+@@ -97,6 +98,7 @@
+ 			reg = <0x100>;
+ 			enable-method = "psci";
+ 			cpu-idle-states = <&CPU_SLEEP_0>;
++			#cooling-cells = <2>;
+ 		};
+ 
+ 		cpu3: cpu@101 {
+diff --git a/arch/x86/crypto/twofish-x86_64-asm_64-3way.S b/arch/x86/crypto/twofish-x86_64-asm_64-3way.S
+index 1c3b7ceb36d2..e7273a606a07 100644
+--- a/arch/x86/crypto/twofish-x86_64-asm_64-3way.S
++++ b/arch/x86/crypto/twofish-x86_64-asm_64-3way.S
+@@ -55,29 +55,31 @@
+ #define RAB1bl %bl
+ #define RAB2bl %cl
+ 
++#define CD0 0x0(%rsp)
++#define CD1 0x8(%rsp)
++#define CD2 0x10(%rsp)
++
++# used only before/after all rounds
+ #define RCD0 %r8
+ #define RCD1 %r9
+ #define RCD2 %r10
+ 
+-#define RCD0d %r8d
+-#define RCD1d %r9d
+-#define RCD2d %r10d
+-
+-#define RX0 %rbp
+-#define RX1 %r11
+-#define RX2 %r12
++# used only during rounds
++#define RX0 %r8
++#define RX1 %r9
++#define RX2 %r10
+ 
+-#define RX0d %ebp
+-#define RX1d %r11d
+-#define RX2d %r12d
++#define RX0d %r8d
++#define RX1d %r9d
++#define RX2d %r10d
+ 
+-#define RY0 %r13
+-#define RY1 %r14
+-#define RY2 %r15
++#define RY0 %r11
++#define RY1 %r12
++#define RY2 %r13
+ 
+-#define RY0d %r13d
+-#define RY1d %r14d
+-#define RY2d %r15d
++#define RY0d %r11d
++#define RY1d %r12d
++#define RY2d %r13d
+ 
+ #define RT0 %rdx
+ #define RT1 %rsi
+@@ -85,6 +87,8 @@
+ #define RT0d %edx
+ #define RT1d %esi
+ 
++#define RT1bl %sil
++
+ #define do16bit_ror(rot, op1, op2, T0, T1, tmp1, tmp2, ab, dst) \
+ 	movzbl ab ## bl,		tmp2 ## d; \
+ 	movzbl ab ## bh,		tmp1 ## d; \
+@@ -92,6 +96,11 @@
+ 	op1##l T0(CTX, tmp2, 4),	dst ## d; \
+ 	op2##l T1(CTX, tmp1, 4),	dst ## d;
+ 
++#define swap_ab_with_cd(ab, cd, tmp)	\
++	movq cd, tmp;			\
++	movq ab, cd;			\
++	movq tmp, ab;
++
+ /*
+  * Combined G1 & G2 function. Reordered with help of rotates to have moves
+  * at begining.
+@@ -110,15 +119,15 @@
+ 	/* G1,2 && G2,2 */ \
+ 	do16bit_ror(32, xor, xor, Tx2, Tx3, RT0, RT1, ab ## 0, x ## 0); \
+ 	do16bit_ror(16, xor, xor, Ty3, Ty0, RT0, RT1, ab ## 0, y ## 0); \
+-	xchgq cd ## 0, ab ## 0; \
++	swap_ab_with_cd(ab ## 0, cd ## 0, RT0); \
+ 	\
+ 	do16bit_ror(32, xor, xor, Tx2, Tx3, RT0, RT1, ab ## 1, x ## 1); \
+ 	do16bit_ror(16, xor, xor, Ty3, Ty0, RT0, RT1, ab ## 1, y ## 1); \
+-	xchgq cd ## 1, ab ## 1; \
++	swap_ab_with_cd(ab ## 1, cd ## 1, RT0); \
+ 	\
+ 	do16bit_ror(32, xor, xor, Tx2, Tx3, RT0, RT1, ab ## 2, x ## 2); \
+ 	do16bit_ror(16, xor, xor, Ty3, Ty0, RT0, RT1, ab ## 2, y ## 2); \
+-	xchgq cd ## 2, ab ## 2;
++	swap_ab_with_cd(ab ## 2, cd ## 2, RT0);
+ 
+ #define enc_round_end(ab, x, y, n) \
+ 	addl y ## d,			x ## d; \
+@@ -168,6 +177,16 @@
+ 	decrypt_round3(ba, dc, (n*2)+1); \
+ 	decrypt_round3(ba, dc, (n*2));
+ 
++#define push_cd()	\
++	pushq RCD2;	\
++	pushq RCD1;	\
++	pushq RCD0;
++
++#define pop_cd()	\
++	popq RCD0;	\
++	popq RCD1;	\
++	popq RCD2;
++
+ #define inpack3(in, n, xy, m) \
+ 	movq 4*(n)(in),			xy ## 0; \
+ 	xorq w+4*m(CTX),		xy ## 0; \
+@@ -223,11 +242,8 @@ ENTRY(__twofish_enc_blk_3way)
+ 	 *	%rdx: src, RIO
+ 	 *	%rcx: bool, if true: xor output
+ 	 */
+-	pushq %r15;
+-	pushq %r14;
+ 	pushq %r13;
+ 	pushq %r12;
+-	pushq %rbp;
+ 	pushq %rbx;
+ 
+ 	pushq %rcx; /* bool xor */
+@@ -235,40 +251,36 @@ ENTRY(__twofish_enc_blk_3way)
+ 
+ 	inpack_enc3();
+ 
+-	encrypt_cycle3(RAB, RCD, 0);
+-	encrypt_cycle3(RAB, RCD, 1);
+-	encrypt_cycle3(RAB, RCD, 2);
+-	encrypt_cycle3(RAB, RCD, 3);
+-	encrypt_cycle3(RAB, RCD, 4);
+-	encrypt_cycle3(RAB, RCD, 5);
+-	encrypt_cycle3(RAB, RCD, 6);
+-	encrypt_cycle3(RAB, RCD, 7);
++	push_cd();
++	encrypt_cycle3(RAB, CD, 0);
++	encrypt_cycle3(RAB, CD, 1);
++	encrypt_cycle3(RAB, CD, 2);
++	encrypt_cycle3(RAB, CD, 3);
++	encrypt_cycle3(RAB, CD, 4);
++	encrypt_cycle3(RAB, CD, 5);
++	encrypt_cycle3(RAB, CD, 6);
++	encrypt_cycle3(RAB, CD, 7);
++	pop_cd();
+ 
+ 	popq RIO; /* dst */
+-	popq %rbp; /* bool xor */
++	popq RT1; /* bool xor */
+ 
+-	testb %bpl, %bpl;
++	testb RT1bl, RT1bl;
+ 	jnz .L__enc_xor3;
+ 
+ 	outunpack_enc3(mov);
+ 
+ 	popq %rbx;
+-	popq %rbp;
+ 	popq %r12;
+ 	popq %r13;
+-	popq %r14;
+-	popq %r15;
+ 	ret;
+ 
+ .L__enc_xor3:
+ 	outunpack_enc3(xor);
+ 
+ 	popq %rbx;
+-	popq %rbp;
+ 	popq %r12;
+ 	popq %r13;
+-	popq %r14;
+-	popq %r15;
+ 	ret;
+ ENDPROC(__twofish_enc_blk_3way)
+ 
+@@ -278,35 +290,31 @@ ENTRY(twofish_dec_blk_3way)
+ 	 *	%rsi: dst
+ 	 *	%rdx: src, RIO
+ 	 */
+-	pushq %r15;
+-	pushq %r14;
+ 	pushq %r13;
+ 	pushq %r12;
+-	pushq %rbp;
+ 	pushq %rbx;
+ 
+ 	pushq %rsi; /* dst */
+ 
+ 	inpack_dec3();
+ 
+-	decrypt_cycle3(RAB, RCD, 7);
+-	decrypt_cycle3(RAB, RCD, 6);
+-	decrypt_cycle3(RAB, RCD, 5);
+-	decrypt_cycle3(RAB, RCD, 4);
+-	decrypt_cycle3(RAB, RCD, 3);
+-	decrypt_cycle3(RAB, RCD, 2);
+-	decrypt_cycle3(RAB, RCD, 1);
+-	decrypt_cycle3(RAB, RCD, 0);
++	push_cd();
++	decrypt_cycle3(RAB, CD, 7);
++	decrypt_cycle3(RAB, CD, 6);
++	decrypt_cycle3(RAB, CD, 5);
++	decrypt_cycle3(RAB, CD, 4);
++	decrypt_cycle3(RAB, CD, 3);
++	decrypt_cycle3(RAB, CD, 2);
++	decrypt_cycle3(RAB, CD, 1);
++	decrypt_cycle3(RAB, CD, 0);
++	pop_cd();
+ 
+ 	popq RIO; /* dst */
+ 
+ 	outunpack_dec3();
+ 
+ 	popq %rbx;
+-	popq %rbp;
+ 	popq %r12;
+ 	popq %r13;
+-	popq %r14;
+-	popq %r15;
+ 	ret;
+ ENDPROC(twofish_dec_blk_3way)
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index ac381437c291..17f4eca37d22 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -2939,6 +2939,12 @@ void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu)
+ 	pagefault_enable();
+ 	kvm_x86_ops->vcpu_put(vcpu);
+ 	vcpu->arch.last_host_tsc = rdtsc();
++	/*
++	 * If userspace has set any breakpoints or watchpoints, dr6 is restored
++	 * on every vmexit, but if not, we might have a stale dr6 from the
++	 * guest. do_debug expects dr6 to be cleared after it runs, do the same.
++	 */
++	set_debugreg(0, 6);
+ }
+ 
+ static int kvm_vcpu_ioctl_get_lapic(struct kvm_vcpu *vcpu,
+diff --git a/block/blk-map.c b/block/blk-map.c
+index d3a94719f03f..db9373bd31ac 100644
+--- a/block/blk-map.c
++++ b/block/blk-map.c
+@@ -119,7 +119,7 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,
+ 	unsigned long align = q->dma_pad_mask | queue_dma_alignment(q);
+ 	struct bio *bio = NULL;
+ 	struct iov_iter i;
+-	int ret;
++	int ret = -EINVAL;
+ 
+ 	if (!iter_is_iovec(iter))
+ 		goto fail;
+@@ -148,7 +148,7 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,
+ 	__blk_rq_unmap_user(bio);
+ fail:
+ 	rq->bio = NULL;
+-	return -EINVAL;
++	return ret;
+ }
+ EXPORT_SYMBOL(blk_rq_map_user_iov);
+ 
+diff --git a/drivers/android/binder.c b/drivers/android/binder.c
+index ec0917fb7cca..255eabdca2a4 100644
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -1933,8 +1933,14 @@ static void binder_send_failed_reply(struct binder_transaction *t,
+ 					&target_thread->todo);
+ 				wake_up_interruptible(&target_thread->wait);
+ 			} else {
+-				WARN(1, "Unexpected reply error: %u\n",
+-						target_thread->reply_error.cmd);
++				/*
++				 * Cannot get here for normal operation, but
++				 * we can if multiple synchronous transactions
++				 * are sent without blocking for responses.
++				 * Just ignore the 2nd error in this case.
++				 */
++				pr_warn("Unexpected reply error: %u\n",
++					target_thread->reply_error.cmd);
+ 			}
+ 			binder_inner_proc_unlock(target_thread->proc);
+ 			binder_thread_dec_tmpref(target_thread);
+@@ -2135,7 +2141,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
+ 	int debug_id = buffer->debug_id;
+ 
+ 	binder_debug(BINDER_DEBUG_TRANSACTION,
+-		     "%d buffer release %d, size %zd-%zd, failed at %p\n",
++		     "%d buffer release %d, size %zd-%zd, failed at %pK\n",
+ 		     proc->pid, buffer->debug_id,
+ 		     buffer->data_size, buffer->offsets_size, failed_at);
+ 
+@@ -3647,7 +3653,7 @@ static int binder_thread_write(struct binder_proc *proc,
+ 				}
+ 			}
+ 			binder_debug(BINDER_DEBUG_DEAD_BINDER,
+-				     "%d:%d BC_DEAD_BINDER_DONE %016llx found %p\n",
++				     "%d:%d BC_DEAD_BINDER_DONE %016llx found %pK\n",
+ 				     proc->pid, thread->pid, (u64)cookie,
+ 				     death);
+ 			if (death == NULL) {
+@@ -4316,6 +4322,15 @@ static int binder_thread_release(struct binder_proc *proc,
+ 
+ 	binder_inner_proc_unlock(thread->proc);
+ 
++	/*
++	 * This is needed to avoid races between wake_up_poll() above and
++	 * and ep_remove_waitqueue() called for other reasons (eg the epoll file
++	 * descriptor being closed); ep_remove_waitqueue() holds an RCU read
++	 * lock, so we can be sure it's done after calling synchronize_rcu().
++	 */
++	if (thread->looper & BINDER_LOOPER_STATE_POLL)
++		synchronize_rcu();
++
+ 	if (send_reply)
+ 		binder_send_failed_reply(send_reply, BR_DEAD_REPLY);
+ 	binder_release_work(proc, &thread->todo);
+@@ -4331,6 +4346,8 @@ static unsigned int binder_poll(struct file *filp,
+ 	bool wait_for_proc_work;
+ 
+ 	thread = binder_get_thread(proc);
++	if (!thread)
++		return POLLERR;
+ 
+ 	binder_inner_proc_lock(thread->proc);
+ 	thread->looper |= BINDER_LOOPER_STATE_POLL;
+@@ -4974,7 +4991,7 @@ static void print_binder_transaction_ilocked(struct seq_file *m,
+ 	spin_lock(&t->lock);
+ 	to_proc = t->to_proc;
+ 	seq_printf(m,
+-		   "%s %d: %p from %d:%d to %d:%d code %x flags %x pri %ld r%d",
++		   "%s %d: %pK from %d:%d to %d:%d code %x flags %x pri %ld r%d",
+ 		   prefix, t->debug_id, t,
+ 		   t->from ? t->from->proc->pid : 0,
+ 		   t->from ? t->from->pid : 0,
+@@ -4998,7 +5015,7 @@ static void print_binder_transaction_ilocked(struct seq_file *m,
+ 	}
+ 	if (buffer->target_node)
+ 		seq_printf(m, " node %d", buffer->target_node->debug_id);
+-	seq_printf(m, " size %zd:%zd data %p\n",
++	seq_printf(m, " size %zd:%zd data %pK\n",
+ 		   buffer->data_size, buffer->offsets_size,
+ 		   buffer->data);
+ }
+diff --git a/drivers/crypto/s5p-sss.c b/drivers/crypto/s5p-sss.c
+index 142c6020cec7..5c0496d1ed41 100644
+--- a/drivers/crypto/s5p-sss.c
++++ b/drivers/crypto/s5p-sss.c
+@@ -1926,15 +1926,21 @@ static void s5p_aes_crypt_start(struct s5p_aes_dev *dev, unsigned long mode)
+ 	uint32_t aes_control;
+ 	unsigned long flags;
+ 	int err;
++	u8 *iv;
+ 
+ 	aes_control = SSS_AES_KEY_CHANGE_MODE;
+ 	if (mode & FLAGS_AES_DECRYPT)
+ 		aes_control |= SSS_AES_MODE_DECRYPT;
+ 
+-	if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CBC)
++	if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CBC) {
+ 		aes_control |= SSS_AES_CHAIN_MODE_CBC;
+-	else if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CTR)
++		iv = req->info;
++	} else if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CTR) {
+ 		aes_control |= SSS_AES_CHAIN_MODE_CTR;
++		iv = req->info;
++	} else {
++		iv = NULL; /* AES_ECB */
++	}
+ 
+ 	if (dev->ctx->keylen == AES_KEYSIZE_192)
+ 		aes_control |= SSS_AES_KEY_SIZE_192;
+@@ -1965,7 +1971,7 @@ static void s5p_aes_crypt_start(struct s5p_aes_dev *dev, unsigned long mode)
+ 		goto outdata_error;
+ 
+ 	SSS_AES_WRITE(dev, AES_CONTROL, aes_control);
+-	s5p_set_aes(dev, dev->ctx->aes_key, req->info, dev->ctx->keylen);
++	s5p_set_aes(dev, dev->ctx->aes_key, iv, dev->ctx->keylen);
+ 
+ 	s5p_set_dma_indata(dev,  dev->sg_src);
+ 	s5p_set_dma_outdata(dev, dev->sg_dst);
+diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+index 8289ee482f49..09bd6c6c176c 100644
+--- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
++++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
+@@ -3648,6 +3648,12 @@ static int pvr2_send_request_ex(struct pvr2_hdw *hdw,
+ 				  hdw);
+ 		hdw->ctl_write_urb->actual_length = 0;
+ 		hdw->ctl_write_pend_flag = !0;
++		if (usb_urb_ep_type_check(hdw->ctl_write_urb)) {
++			pvr2_trace(
++				PVR2_TRACE_ERROR_LEGS,
++				"Invalid write control endpoint");
++			return -EINVAL;
++		}
+ 		status = usb_submit_urb(hdw->ctl_write_urb,GFP_KERNEL);
+ 		if (status < 0) {
+ 			pvr2_trace(PVR2_TRACE_ERROR_LEGS,
+@@ -3672,6 +3678,12 @@ status);
+ 				  hdw);
+ 		hdw->ctl_read_urb->actual_length = 0;
+ 		hdw->ctl_read_pend_flag = !0;
++		if (usb_urb_ep_type_check(hdw->ctl_read_urb)) {
++			pvr2_trace(
++				PVR2_TRACE_ERROR_LEGS,
++				"Invalid read control endpoint");
++			return -EINVAL;
++		}
+ 		status = usb_submit_urb(hdw->ctl_read_urb,GFP_KERNEL);
+ 		if (status < 0) {
+ 			pvr2_trace(PVR2_TRACE_ERROR_LEGS,
+diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
+index 0ccccbaf530d..e4b10b2d1a08 100644
+--- a/drivers/misc/mei/hw-me-regs.h
++++ b/drivers/misc/mei/hw-me-regs.h
+@@ -132,6 +132,11 @@
+ #define MEI_DEV_ID_KBP        0xA2BA  /* Kaby Point */
+ #define MEI_DEV_ID_KBP_2      0xA2BB  /* Kaby Point 2 */
+ 
++#define MEI_DEV_ID_CNP_LP     0x9DE0  /* Cannon Point LP */
++#define MEI_DEV_ID_CNP_LP_4   0x9DE4  /* Cannon Point LP 4 (iTouch) */
++#define MEI_DEV_ID_CNP_H      0xA360  /* Cannon Point H */
++#define MEI_DEV_ID_CNP_H_4    0xA364  /* Cannon Point H 4 (iTouch) */
++
+ /*
+  * MEI HW Section
+  */
+diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
+index 4a0ccda4d04b..ea4e152270a3 100644
+--- a/drivers/misc/mei/pci-me.c
++++ b/drivers/misc/mei/pci-me.c
+@@ -98,6 +98,11 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
+ 	{MEI_PCI_DEVICE(MEI_DEV_ID_KBP, MEI_ME_PCH8_CFG)},
+ 	{MEI_PCI_DEVICE(MEI_DEV_ID_KBP_2, MEI_ME_PCH8_CFG)},
+ 
++	{MEI_PCI_DEVICE(MEI_DEV_ID_CNP_LP, MEI_ME_PCH8_CFG)},
++	{MEI_PCI_DEVICE(MEI_DEV_ID_CNP_LP_4, MEI_ME_PCH8_CFG)},
++	{MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H, MEI_ME_PCH8_CFG)},
++	{MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H_4, MEI_ME_PCH8_CFG)},
++
+ 	/* required last entry */
+ 	{0, }
+ };
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index a8ec589d1359..e29cd5c7d39f 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -1317,27 +1317,23 @@ static struct sk_buff *tun_napi_alloc_frags(struct tun_file *tfile,
+ 	skb->truesize += skb->data_len;
+ 
+ 	for (i = 1; i < it->nr_segs; i++) {
++		struct page_frag *pfrag = &current->task_frag;
+ 		size_t fragsz = it->iov[i].iov_len;
+-		unsigned long offset;
+-		struct page *page;
+-		void *data;
+ 
+ 		if (fragsz == 0 || fragsz > PAGE_SIZE) {
+ 			err = -EINVAL;
+ 			goto free;
+ 		}
+ 
+-		local_bh_disable();
+-		data = napi_alloc_frag(fragsz);
+-		local_bh_enable();
+-		if (!data) {
++		if (!skb_page_frag_refill(fragsz, pfrag, GFP_KERNEL)) {
+ 			err = -ENOMEM;
+ 			goto free;
+ 		}
+ 
+-		page = virt_to_head_page(data);
+-		offset = data - page_address(page);
+-		skb_fill_page_desc(skb, i - 1, page, offset, fragsz);
++		skb_fill_page_desc(skb, i - 1, pfrag->page,
++				   pfrag->offset, fragsz);
++		page_ref_inc(pfrag->page);
++		pfrag->offset += fragsz;
+ 	}
+ 
+ 	return skb;
+diff --git a/drivers/soc/qcom/rmtfs_mem.c b/drivers/soc/qcom/rmtfs_mem.c
+index ce35ff748adf..0a43b2e8906f 100644
+--- a/drivers/soc/qcom/rmtfs_mem.c
++++ b/drivers/soc/qcom/rmtfs_mem.c
+@@ -267,3 +267,7 @@ static void qcom_rmtfs_mem_exit(void)
+ 	unregister_chrdev_region(qcom_rmtfs_mem_major, QCOM_RMTFS_MEM_DEV_MAX);
+ }
+ module_exit(qcom_rmtfs_mem_exit);
++
++MODULE_AUTHOR("Linaro Ltd");
++MODULE_DESCRIPTION("Qualcomm Remote Filesystem memory driver");
++MODULE_LICENSE("GPL v2");
+diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c
+index 372ce9913e6d..e7541dc90473 100644
+--- a/drivers/staging/android/ashmem.c
++++ b/drivers/staging/android/ashmem.c
+@@ -710,30 +710,32 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd,
+ 	size_t pgstart, pgend;
+ 	int ret = -EINVAL;
+ 
++	mutex_lock(&ashmem_mutex);
++
+ 	if (unlikely(!asma->file))
+-		return -EINVAL;
++		goto out_unlock;
+ 
+-	if (unlikely(copy_from_user(&pin, p, sizeof(pin))))
+-		return -EFAULT;
++	if (unlikely(copy_from_user(&pin, p, sizeof(pin)))) {
++		ret = -EFAULT;
++		goto out_unlock;
++	}
+ 
+ 	/* per custom, you can pass zero for len to mean "everything onward" */
+ 	if (!pin.len)
+ 		pin.len = PAGE_ALIGN(asma->size) - pin.offset;
+ 
+ 	if (unlikely((pin.offset | pin.len) & ~PAGE_MASK))
+-		return -EINVAL;
++		goto out_unlock;
+ 
+ 	if (unlikely(((__u32)-1) - pin.offset < pin.len))
+-		return -EINVAL;
++		goto out_unlock;
+ 
+ 	if (unlikely(PAGE_ALIGN(asma->size) < pin.offset + pin.len))
+-		return -EINVAL;
++		goto out_unlock;
+ 
+ 	pgstart = pin.offset / PAGE_SIZE;
+ 	pgend = pgstart + (pin.len / PAGE_SIZE) - 1;
+ 
+-	mutex_lock(&ashmem_mutex);
+-
+ 	switch (cmd) {
+ 	case ASHMEM_PIN:
+ 		ret = ashmem_pin(asma, pgstart, pgend);
+@@ -746,6 +748,7 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd,
+ 		break;
+ 	}
+ 
++out_unlock:
+ 	mutex_unlock(&ashmem_mutex);
+ 
+ 	return ret;
+diff --git a/drivers/staging/android/ion/ion-ioctl.c b/drivers/staging/android/ion/ion-ioctl.c
+index c78989351f9c..6cfed48f376e 100644
+--- a/drivers/staging/android/ion/ion-ioctl.c
++++ b/drivers/staging/android/ion/ion-ioctl.c
+@@ -70,8 +70,10 @@ long ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+ 		return -EFAULT;
+ 
+ 	ret = validate_ioctl_arg(cmd, &data);
+-	if (WARN_ON_ONCE(ret))
++	if (ret) {
++		pr_warn_once("%s: ioctl validate failed\n", __func__);
+ 		return ret;
++	}
+ 
+ 	if (!(dir & _IOC_WRITE))
+ 		memset(&data, 0, sizeof(data));
+diff --git a/drivers/staging/android/ion/ion_system_heap.c b/drivers/staging/android/ion/ion_system_heap.c
+index 4dc5d7a589c2..b6ece18e6a88 100644
+--- a/drivers/staging/android/ion/ion_system_heap.c
++++ b/drivers/staging/android/ion/ion_system_heap.c
+@@ -371,7 +371,7 @@ static int ion_system_contig_heap_allocate(struct ion_heap *heap,
+ 	unsigned long i;
+ 	int ret;
+ 
+-	page = alloc_pages(low_order_gfp_flags, order);
++	page = alloc_pages(low_order_gfp_flags | __GFP_NOWARN, order);
+ 	if (!page)
+ 		return -ENOMEM;
+ 
+diff --git a/drivers/staging/fsl-mc/bus/Kconfig b/drivers/staging/fsl-mc/bus/Kconfig
+index 504c987447f2..eee1c1b277fa 100644
+--- a/drivers/staging/fsl-mc/bus/Kconfig
++++ b/drivers/staging/fsl-mc/bus/Kconfig
+@@ -8,7 +8,7 @@
+ 
+ config FSL_MC_BUS
+ 	bool "QorIQ DPAA2 fsl-mc bus driver"
+-	depends on OF && (ARCH_LAYERSCAPE || (COMPILE_TEST && (ARM || ARM64 || X86 || PPC)))
++	depends on OF && (ARCH_LAYERSCAPE || (COMPILE_TEST && (ARM || ARM64 || X86_LOCAL_APIC || PPC)))
+ 	select GENERIC_MSI_IRQ_DOMAIN
+ 	help
+ 	  Driver to enable the bus infrastructure for the QorIQ DPAA2
+diff --git a/drivers/staging/iio/adc/ad7192.c b/drivers/staging/iio/adc/ad7192.c
+index cadfb96734ed..d4da2807eb55 100644
+--- a/drivers/staging/iio/adc/ad7192.c
++++ b/drivers/staging/iio/adc/ad7192.c
+@@ -141,6 +141,8 @@
+ #define AD7192_GPOCON_P1DAT	BIT(1) /* P1 state */
+ #define AD7192_GPOCON_P0DAT	BIT(0) /* P0 state */
+ 
++#define AD7192_EXT_FREQ_MHZ_MIN	2457600
++#define AD7192_EXT_FREQ_MHZ_MAX	5120000
+ #define AD7192_INT_FREQ_MHZ	4915200
+ 
+ /* NOTE:
+@@ -218,6 +220,12 @@ static int ad7192_calibrate_all(struct ad7192_state *st)
+ 				ARRAY_SIZE(ad7192_calib_arr));
+ }
+ 
++static inline bool ad7192_valid_external_frequency(u32 freq)
++{
++	return (freq >= AD7192_EXT_FREQ_MHZ_MIN &&
++		freq <= AD7192_EXT_FREQ_MHZ_MAX);
++}
++
+ static int ad7192_setup(struct ad7192_state *st,
+ 			const struct ad7192_platform_data *pdata)
+ {
+@@ -243,17 +251,20 @@ static int ad7192_setup(struct ad7192_state *st,
+ 			 id);
+ 
+ 	switch (pdata->clock_source_sel) {
+-	case AD7192_CLK_EXT_MCLK1_2:
+-	case AD7192_CLK_EXT_MCLK2:
+-		st->mclk = AD7192_INT_FREQ_MHZ;
+-		break;
+ 	case AD7192_CLK_INT:
+ 	case AD7192_CLK_INT_CO:
+-		if (pdata->ext_clk_hz)
+-			st->mclk = pdata->ext_clk_hz;
+-		else
+-			st->mclk = AD7192_INT_FREQ_MHZ;
++		st->mclk = AD7192_INT_FREQ_MHZ;
+ 		break;
++	case AD7192_CLK_EXT_MCLK1_2:
++	case AD7192_CLK_EXT_MCLK2:
++		if (ad7192_valid_external_frequency(pdata->ext_clk_hz)) {
++			st->mclk = pdata->ext_clk_hz;
++			break;
++		}
++		dev_err(&st->sd.spi->dev, "Invalid frequency setting %u\n",
++			pdata->ext_clk_hz);
++		ret = -EINVAL;
++		goto out;
+ 	default:
+ 		ret = -EINVAL;
+ 		goto out;
+diff --git a/drivers/staging/iio/impedance-analyzer/ad5933.c b/drivers/staging/iio/impedance-analyzer/ad5933.c
+index 2b28fb9c0048..3bcf49466361 100644
+--- a/drivers/staging/iio/impedance-analyzer/ad5933.c
++++ b/drivers/staging/iio/impedance-analyzer/ad5933.c
+@@ -648,8 +648,6 @@ static int ad5933_register_ring_funcs_and_init(struct iio_dev *indio_dev)
+ 	/* Ring buffer functions - here trigger setup related */
+ 	indio_dev->setup_ops = &ad5933_ring_setup_ops;
+ 
+-	indio_dev->modes |= INDIO_BUFFER_HARDWARE;
+-
+ 	return 0;
+ }
+ 
+@@ -762,7 +760,7 @@ static int ad5933_probe(struct i2c_client *client,
+ 	indio_dev->dev.parent = &client->dev;
+ 	indio_dev->info = &ad5933_info;
+ 	indio_dev->name = id->name;
+-	indio_dev->modes = INDIO_DIRECT_MODE;
++	indio_dev->modes = (INDIO_BUFFER_SOFTWARE | INDIO_DIRECT_MODE);
+ 	indio_dev->channels = ad5933_channels;
+ 	indio_dev->num_channels = ARRAY_SIZE(ad5933_channels);
+ 
+diff --git a/drivers/usb/host/xhci-debugfs.c b/drivers/usb/host/xhci-debugfs.c
+index e26e685d8a57..5851052d4668 100644
+--- a/drivers/usb/host/xhci-debugfs.c
++++ b/drivers/usb/host/xhci-debugfs.c
+@@ -211,7 +211,7 @@ static void xhci_ring_dump_segment(struct seq_file *s,
+ static int xhci_ring_trb_show(struct seq_file *s, void *unused)
+ {
+ 	int			i;
+-	struct xhci_ring	*ring = s->private;
++	struct xhci_ring	*ring = *(struct xhci_ring **)s->private;
+ 	struct xhci_segment	*seg = ring->first_seg;
+ 
+ 	for (i = 0; i < ring->num_segs; i++) {
+@@ -387,7 +387,7 @@ void xhci_debugfs_create_endpoint(struct xhci_hcd *xhci,
+ 
+ 	snprintf(epriv->name, sizeof(epriv->name), "ep%02d", ep_index);
+ 	epriv->root = xhci_debugfs_create_ring_dir(xhci,
+-						   &dev->eps[ep_index].new_ring,
++						   &dev->eps[ep_index].ring,
+ 						   epriv->name,
+ 						   spriv->root);
+ 	spriv->eps[ep_index] = epriv;
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index da6dbe3ebd8b..5c1326154e66 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -652,8 +652,6 @@ static void xhci_stop(struct usb_hcd *hcd)
+ 		return;
+ 	}
+ 
+-	xhci_debugfs_exit(xhci);
+-
+ 	spin_lock_irq(&xhci->lock);
+ 	xhci->xhc_state |= XHCI_STATE_HALTED;
+ 	xhci->cmd_ring_state = CMD_RING_STATE_STOPPED;
+@@ -685,6 +683,7 @@ static void xhci_stop(struct usb_hcd *hcd)
+ 
+ 	xhci_dbg_trace(xhci, trace_xhci_dbg_init, "cleaning up memory");
+ 	xhci_mem_cleanup(xhci);
++	xhci_debugfs_exit(xhci);
+ 	xhci_dbg_trace(xhci, trace_xhci_dbg_init,
+ 			"xhci_stop completed - status = %x",
+ 			readl(&xhci->op_regs->status));
+@@ -1018,6 +1017,7 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
+ 
+ 		xhci_dbg(xhci, "cleaning up memory\n");
+ 		xhci_mem_cleanup(xhci);
++		xhci_debugfs_exit(xhci);
+ 		xhci_dbg(xhci, "xhci_stop completed - status = %x\n",
+ 			    readl(&xhci->op_regs->status));
+ 
+@@ -3551,12 +3551,10 @@ static void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
+ 		virt_dev->eps[i].ep_state &= ~EP_STOP_CMD_PENDING;
+ 		del_timer_sync(&virt_dev->eps[i].stop_cmd_timer);
+ 	}
+-
++	xhci_debugfs_remove_slot(xhci, udev->slot_id);
+ 	ret = xhci_disable_slot(xhci, udev->slot_id);
+-	if (ret) {
+-		xhci_debugfs_remove_slot(xhci, udev->slot_id);
++	if (ret)
+ 		xhci_free_virt_device(xhci, udev->slot_id);
+-	}
+ }
+ 
+ int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id)
+diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c
+index e31a6f204397..86037e5b1101 100644
+--- a/drivers/usb/usbip/stub_dev.c
++++ b/drivers/usb/usbip/stub_dev.c
+@@ -73,6 +73,7 @@ static ssize_t store_sockfd(struct device *dev, struct device_attribute *attr,
+ 			goto err;
+ 
+ 		sdev->ud.tcp_socket = socket;
++		sdev->ud.sockfd = sockfd;
+ 
+ 		spin_unlock_irq(&sdev->ud.lock);
+ 
+@@ -172,6 +173,7 @@ static void stub_shutdown_connection(struct usbip_device *ud)
+ 	if (ud->tcp_socket) {
+ 		sockfd_put(ud->tcp_socket);
+ 		ud->tcp_socket = NULL;
++		ud->sockfd = -1;
+ 	}
+ 
+ 	/* 3. free used data */
+@@ -266,6 +268,7 @@ static struct stub_device *stub_device_alloc(struct usb_device *udev)
+ 	sdev->ud.status		= SDEV_ST_AVAILABLE;
+ 	spin_lock_init(&sdev->ud.lock);
+ 	sdev->ud.tcp_socket	= NULL;
++	sdev->ud.sockfd		= -1;
+ 
+ 	INIT_LIST_HEAD(&sdev->priv_init);
+ 	INIT_LIST_HEAD(&sdev->priv_tx);
+diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
+index c3e1008aa491..20e3d4609583 100644
+--- a/drivers/usb/usbip/vhci_hcd.c
++++ b/drivers/usb/usbip/vhci_hcd.c
+@@ -984,6 +984,7 @@ static void vhci_shutdown_connection(struct usbip_device *ud)
+ 	if (vdev->ud.tcp_socket) {
+ 		sockfd_put(vdev->ud.tcp_socket);
+ 		vdev->ud.tcp_socket = NULL;
++		vdev->ud.sockfd = -1;
+ 	}
+ 	pr_info("release socket\n");
+ 
+@@ -1030,6 +1031,7 @@ static void vhci_device_reset(struct usbip_device *ud)
+ 	if (ud->tcp_socket) {
+ 		sockfd_put(ud->tcp_socket);
+ 		ud->tcp_socket = NULL;
++		ud->sockfd = -1;
+ 	}
+ 	ud->status = VDEV_ST_NULL;
+ 
+diff --git a/drivers/video/fbdev/mmp/core.c b/drivers/video/fbdev/mmp/core.c
+index a0f496049db7..3a6bb6561ba0 100644
+--- a/drivers/video/fbdev/mmp/core.c
++++ b/drivers/video/fbdev/mmp/core.c
+@@ -23,6 +23,7 @@
+ #include <linux/slab.h>
+ #include <linux/dma-mapping.h>
+ #include <linux/export.h>
++#include <linux/module.h>
+ #include <video/mmp_disp.h>
+ 
+ static struct mmp_overlay *path_get_overlay(struct mmp_path *path,
+@@ -249,3 +250,7 @@ void mmp_unregister_path(struct mmp_path *path)
+ 	mutex_unlock(&disp_lock);
+ }
+ EXPORT_SYMBOL_GPL(mmp_unregister_path);
++
++MODULE_AUTHOR("Zhou Zhu <zzhu3@×××××××.com>");
++MODULE_DESCRIPTION("Marvell MMP display framework");
++MODULE_LICENSE("GPL");
+diff --git a/include/linux/ptr_ring.h b/include/linux/ptr_ring.h
+index d72b2e7dd500..59c77c1388ae 100644
+--- a/include/linux/ptr_ring.h
++++ b/include/linux/ptr_ring.h
+@@ -451,9 +451,14 @@ static inline int ptr_ring_consume_batched_bh(struct ptr_ring *r,
+ 	__PTR_RING_PEEK_CALL_v; \
+ })
+ 
++/* Not all gfp_t flags (besides GFP_KERNEL) are allowed. See
++ * documentation for vmalloc for which of them are legal.
++ */
+ static inline void **__ptr_ring_init_queue_alloc(unsigned int size, gfp_t gfp)
+ {
+-	return kcalloc(size, sizeof(void *), gfp);
++	if (size * sizeof(void *) > KMALLOC_MAX_SIZE)
++		return NULL;
++	return kvmalloc_array(size, sizeof(void *), gfp | __GFP_ZERO);
+ }
+ 
+ static inline void __ptr_ring_set_size(struct ptr_ring *r, int size)
+@@ -586,7 +591,7 @@ static inline int ptr_ring_resize(struct ptr_ring *r, int size, gfp_t gfp,
+ 	spin_unlock(&(r)->producer_lock);
+ 	spin_unlock_irqrestore(&(r)->consumer_lock, flags);
+ 
+-	kfree(old);
++	kvfree(old);
+ 
+ 	return 0;
+ }
+@@ -626,7 +631,7 @@ static inline int ptr_ring_resize_multiple(struct ptr_ring **rings,
+ 	}
+ 
+ 	for (i = 0; i < nrings; ++i)
+-		kfree(queues[i]);
++		kvfree(queues[i]);
+ 
+ 	kfree(queues);
+ 
+@@ -634,7 +639,7 @@ static inline int ptr_ring_resize_multiple(struct ptr_ring **rings,
+ 
+ nomem:
+ 	while (--i >= 0)
+-		kfree(queues[i]);
++		kvfree(queues[i]);
+ 
+ 	kfree(queues);
+ 
+@@ -649,7 +654,7 @@ static inline void ptr_ring_cleanup(struct ptr_ring *r, void (*destroy)(void *))
+ 	if (destroy)
+ 		while ((ptr = ptr_ring_consume(r)))
+ 			destroy(ptr);
+-	kfree(r->queue);
++	kvfree(r->queue);
+ }
+ 
+ #endif /* _LINUX_PTR_RING_H  */
+diff --git a/kernel/kcov.c b/kernel/kcov.c
+index 7594c033d98a..2c16f1ab5e10 100644
+--- a/kernel/kcov.c
++++ b/kernel/kcov.c
+@@ -358,7 +358,8 @@ static int kcov_ioctl_locked(struct kcov *kcov, unsigned int cmd,
+ 		 */
+ 		if (kcov->mode != KCOV_MODE_INIT || !kcov->area)
+ 			return -EINVAL;
+-		if (kcov->t != NULL)
++		t = current;
++		if (kcov->t != NULL || t->kcov != NULL)
+ 			return -EBUSY;
+ 		if (arg == KCOV_TRACE_PC)
+ 			kcov->mode = KCOV_MODE_TRACE_PC;
+@@ -370,7 +371,6 @@ static int kcov_ioctl_locked(struct kcov *kcov, unsigned int cmd,
+ #endif
+ 		else
+ 			return -EINVAL;
+-		t = current;
+ 		/* Cache in task struct for performance. */
+ 		t->kcov_size = kcov->size;
+ 		t->kcov_area = kcov->area;
+diff --git a/mm/vmalloc.c b/mm/vmalloc.c
+index 673942094328..ebff729cc956 100644
+--- a/mm/vmalloc.c
++++ b/mm/vmalloc.c
+@@ -1943,11 +1943,15 @@ void *vmalloc_exec(unsigned long size)
+ }
+ 
+ #if defined(CONFIG_64BIT) && defined(CONFIG_ZONE_DMA32)
+-#define GFP_VMALLOC32 GFP_DMA32 | GFP_KERNEL
++#define GFP_VMALLOC32 (GFP_DMA32 | GFP_KERNEL)
+ #elif defined(CONFIG_64BIT) && defined(CONFIG_ZONE_DMA)
+-#define GFP_VMALLOC32 GFP_DMA | GFP_KERNEL
++#define GFP_VMALLOC32 (GFP_DMA | GFP_KERNEL)
+ #else
+-#define GFP_VMALLOC32 GFP_KERNEL
++/*
++ * 64b systems should always have either DMA or DMA32 zones. For others
++ * GFP_DMA32 should do the right thing and use the normal zone.
++ */
++#define GFP_VMALLOC32 GFP_DMA32 | GFP_KERNEL
+ #endif
+ 
+ /**
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 613fb4066be7..c8c102a3467f 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -2815,7 +2815,7 @@ struct sk_buff *__skb_gso_segment(struct sk_buff *skb,
+ 
+ 	segs = skb_mac_gso_segment(skb, features);
+ 
+-	if (unlikely(skb_needs_check(skb, tx_path)))
++	if (unlikely(skb_needs_check(skb, tx_path) && !IS_ERR(segs)))
+ 		skb_warn_bad_offload(skb);
+ 
+ 	return segs;
+diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
+index 9834cfa21b21..0a3f88f08727 100644
+--- a/net/core/gen_estimator.c
++++ b/net/core/gen_estimator.c
+@@ -159,7 +159,11 @@ int gen_new_estimator(struct gnet_stats_basic_packed *bstats,
+ 	est->intvl_log = intvl_log;
+ 	est->cpu_bstats = cpu_bstats;
+ 
++	if (stats_lock)
++		local_bh_disable();
+ 	est_fetch_counters(est, &b);
++	if (stats_lock)
++		local_bh_enable();
+ 	est->last_bytes = b.bytes;
+ 	est->last_packets = b.packets;
+ 	old = rcu_dereference_protected(*rate_est, 1);
+diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
+index 518cea17b811..ea9b55309483 100644
+--- a/net/decnet/af_decnet.c
++++ b/net/decnet/af_decnet.c
+@@ -1338,6 +1338,12 @@ static int dn_setsockopt(struct socket *sock, int level, int optname, char __use
+ 	lock_sock(sk);
+ 	err = __dn_setsockopt(sock, level, optname, optval, optlen, 0);
+ 	release_sock(sk);
++#ifdef CONFIG_NETFILTER
++	/* we need to exclude all possible ENOPROTOOPTs except default case */
++	if (err == -ENOPROTOOPT && optname != DSO_LINKINFO &&
++	    optname != DSO_STREAM && optname != DSO_SEQPACKET)
++		err = nf_setsockopt(sk, PF_DECnet, optname, optval, optlen);
++#endif
+ 
+ 	return err;
+ }
+@@ -1445,15 +1451,6 @@ static int __dn_setsockopt(struct socket *sock, int level,int optname, char __us
+ 		dn_nsp_send_disc(sk, 0x38, 0, sk->sk_allocation);
+ 		break;
+ 
+-	default:
+-#ifdef CONFIG_NETFILTER
+-		return nf_setsockopt(sk, PF_DECnet, optname, optval, optlen);
+-#endif
+-	case DSO_LINKINFO:
+-	case DSO_STREAM:
+-	case DSO_SEQPACKET:
+-		return -ENOPROTOOPT;
+-
+ 	case DSO_MAXWINDOW:
+ 		if (optlen != sizeof(unsigned long))
+ 			return -EINVAL;
+@@ -1501,6 +1498,12 @@ static int __dn_setsockopt(struct socket *sock, int level,int optname, char __us
+ 			return -EINVAL;
+ 		scp->info_loc = u.info;
+ 		break;
++
++	case DSO_LINKINFO:
++	case DSO_STREAM:
++	case DSO_SEQPACKET:
++	default:
++		return -ENOPROTOOPT;
+ 	}
+ 
+ 	return 0;
+@@ -1514,6 +1517,20 @@ static int dn_getsockopt(struct socket *sock, int level, int optname, char __use
+ 	lock_sock(sk);
+ 	err = __dn_getsockopt(sock, level, optname, optval, optlen, 0);
+ 	release_sock(sk);
++#ifdef CONFIG_NETFILTER
++	if (err == -ENOPROTOOPT && optname != DSO_STREAM &&
++	    optname != DSO_SEQPACKET && optname != DSO_CONACCEPT &&
++	    optname != DSO_CONREJECT) {
++		int len;
++
++		if (get_user(len, optlen))
++			return -EFAULT;
++
++		err = nf_getsockopt(sk, PF_DECnet, optname, optval, &len);
++		if (err >= 0)
++			err = put_user(len, optlen);
++	}
++#endif
+ 
+ 	return err;
+ }
+@@ -1579,26 +1596,6 @@ static int __dn_getsockopt(struct socket *sock, int level,int optname, char __us
+ 		r_data = &link;
+ 		break;
+ 
+-	default:
+-#ifdef CONFIG_NETFILTER
+-	{
+-		int ret, len;
+-
+-		if (get_user(len, optlen))
+-			return -EFAULT;
+-
+-		ret = nf_getsockopt(sk, PF_DECnet, optname, optval, &len);
+-		if (ret >= 0)
+-			ret = put_user(len, optlen);
+-		return ret;
+-	}
+-#endif
+-	case DSO_STREAM:
+-	case DSO_SEQPACKET:
+-	case DSO_CONACCEPT:
+-	case DSO_CONREJECT:
+-		return -ENOPROTOOPT;
+-
+ 	case DSO_MAXWINDOW:
+ 		if (r_len > sizeof(unsigned long))
+ 			r_len = sizeof(unsigned long);
+@@ -1630,6 +1627,13 @@ static int __dn_getsockopt(struct socket *sock, int level,int optname, char __us
+ 			r_len = sizeof(unsigned char);
+ 		r_data = &scp->info_rem;
+ 		break;
++
++	case DSO_STREAM:
++	case DSO_SEQPACKET:
++	case DSO_CONACCEPT:
++	case DSO_CONREJECT:
++	default:
++		return -ENOPROTOOPT;
+ 	}
+ 
+ 	if (r_data) {
+diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
+index 60fb1eb7d7d8..c7df4969f80a 100644
+--- a/net/ipv4/ip_sockglue.c
++++ b/net/ipv4/ip_sockglue.c
+@@ -1251,11 +1251,8 @@ int ip_setsockopt(struct sock *sk, int level,
+ 	if (err == -ENOPROTOOPT && optname != IP_HDRINCL &&
+ 			optname != IP_IPSEC_POLICY &&
+ 			optname != IP_XFRM_POLICY &&
+-			!ip_mroute_opt(optname)) {
+-		lock_sock(sk);
++			!ip_mroute_opt(optname))
+ 		err = nf_setsockopt(sk, PF_INET, optname, optval, optlen);
+-		release_sock(sk);
+-	}
+ #endif
+ 	return err;
+ }
+@@ -1280,12 +1277,9 @@ int compat_ip_setsockopt(struct sock *sk, int level, int optname,
+ 	if (err == -ENOPROTOOPT && optname != IP_HDRINCL &&
+ 			optname != IP_IPSEC_POLICY &&
+ 			optname != IP_XFRM_POLICY &&
+-			!ip_mroute_opt(optname)) {
+-		lock_sock(sk);
+-		err = compat_nf_setsockopt(sk, PF_INET, optname,
+-					   optval, optlen);
+-		release_sock(sk);
+-	}
++			!ip_mroute_opt(optname))
++		err = compat_nf_setsockopt(sk, PF_INET, optname, optval,
++					   optlen);
+ #endif
+ 	return err;
+ }
+diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
+index 69060e3abe85..1e4a7209a3d2 100644
+--- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
++++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
+@@ -431,7 +431,7 @@ static int clusterip_tg_check(const struct xt_tgchk_param *par)
+ 	struct ipt_clusterip_tgt_info *cipinfo = par->targinfo;
+ 	const struct ipt_entry *e = par->entryinfo;
+ 	struct clusterip_config *config;
+-	int ret;
++	int ret, i;
+ 
+ 	if (par->nft_compat) {
+ 		pr_err("cannot use CLUSTERIP target from nftables compat\n");
+@@ -450,8 +450,18 @@ static int clusterip_tg_check(const struct xt_tgchk_param *par)
+ 		pr_info("Please specify destination IP\n");
+ 		return -EINVAL;
+ 	}
+-
+-	/* FIXME: further sanity checks */
++	if (cipinfo->num_local_nodes > ARRAY_SIZE(cipinfo->local_nodes)) {
++		pr_info("bad num_local_nodes %u\n", cipinfo->num_local_nodes);
++		return -EINVAL;
++	}
++	for (i = 0; i < cipinfo->num_local_nodes; i++) {
++		if (cipinfo->local_nodes[i] - 1 >=
++		    sizeof(config->local_nodes) * 8) {
++			pr_info("bad local_nodes[%d] %u\n",
++				i, cipinfo->local_nodes[i]);
++			return -EINVAL;
++		}
++	}
+ 
+ 	config = clusterip_config_find_get(par->net, e->ip.dst.s_addr, 1);
+ 	if (!config) {
+diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+index 89af9d88ca21..a5727036a8a8 100644
+--- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
++++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
+@@ -218,15 +218,19 @@ getorigdst(struct sock *sk, int optval, void __user *user, int *len)
+ 	struct nf_conntrack_tuple tuple;
+ 
+ 	memset(&tuple, 0, sizeof(tuple));
++
++	lock_sock(sk);
+ 	tuple.src.u3.ip = inet->inet_rcv_saddr;
+ 	tuple.src.u.tcp.port = inet->inet_sport;
+ 	tuple.dst.u3.ip = inet->inet_daddr;
+ 	tuple.dst.u.tcp.port = inet->inet_dport;
+ 	tuple.src.l3num = PF_INET;
+ 	tuple.dst.protonum = sk->sk_protocol;
++	release_sock(sk);
+ 
+ 	/* We only do TCP and SCTP at the moment: is there a better way? */
+-	if (sk->sk_protocol != IPPROTO_TCP && sk->sk_protocol != IPPROTO_SCTP) {
++	if (tuple.dst.protonum != IPPROTO_TCP &&
++	    tuple.dst.protonum != IPPROTO_SCTP) {
+ 		pr_debug("SO_ORIGINAL_DST: Not a TCP/SCTP socket\n");
+ 		return -ENOPROTOOPT;
+ 	}
+diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
+index e8ffb5b5d84e..d78d41fc4b1a 100644
+--- a/net/ipv6/ipv6_sockglue.c
++++ b/net/ipv6/ipv6_sockglue.c
+@@ -923,12 +923,8 @@ int ipv6_setsockopt(struct sock *sk, int level, int optname,
+ #ifdef CONFIG_NETFILTER
+ 	/* we need to exclude all possible ENOPROTOOPTs except default case */
+ 	if (err == -ENOPROTOOPT && optname != IPV6_IPSEC_POLICY &&
+-			optname != IPV6_XFRM_POLICY) {
+-		lock_sock(sk);
+-		err = nf_setsockopt(sk, PF_INET6, optname, optval,
+-				optlen);
+-		release_sock(sk);
+-	}
++			optname != IPV6_XFRM_POLICY)
++		err = nf_setsockopt(sk, PF_INET6, optname, optval, optlen);
+ #endif
+ 	return err;
+ }
+@@ -958,12 +954,9 @@ int compat_ipv6_setsockopt(struct sock *sk, int level, int optname,
+ #ifdef CONFIG_NETFILTER
+ 	/* we need to exclude all possible ENOPROTOOPTs except default case */
+ 	if (err == -ENOPROTOOPT && optname != IPV6_IPSEC_POLICY &&
+-	    optname != IPV6_XFRM_POLICY) {
+-		lock_sock(sk);
+-		err = compat_nf_setsockopt(sk, PF_INET6, optname,
+-					   optval, optlen);
+-		release_sock(sk);
+-	}
++	    optname != IPV6_XFRM_POLICY)
++		err = compat_nf_setsockopt(sk, PF_INET6, optname, optval,
++					   optlen);
+ #endif
+ 	return err;
+ }
+diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+index 3b80a38f62b8..5863579800c1 100644
+--- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
++++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
+@@ -226,20 +226,27 @@ static const struct nf_hook_ops ipv6_conntrack_ops[] = {
+ static int
+ ipv6_getorigdst(struct sock *sk, int optval, void __user *user, int *len)
+ {
+-	const struct inet_sock *inet = inet_sk(sk);
++	struct nf_conntrack_tuple tuple = { .src.l3num = NFPROTO_IPV6 };
+ 	const struct ipv6_pinfo *inet6 = inet6_sk(sk);
++	const struct inet_sock *inet = inet_sk(sk);
+ 	const struct nf_conntrack_tuple_hash *h;
+ 	struct sockaddr_in6 sin6;
+-	struct nf_conntrack_tuple tuple = { .src.l3num = NFPROTO_IPV6 };
+ 	struct nf_conn *ct;
++	__be32 flow_label;
++	int bound_dev_if;
+ 
++	lock_sock(sk);
+ 	tuple.src.u3.in6 = sk->sk_v6_rcv_saddr;
+ 	tuple.src.u.tcp.port = inet->inet_sport;
+ 	tuple.dst.u3.in6 = sk->sk_v6_daddr;
+ 	tuple.dst.u.tcp.port = inet->inet_dport;
+ 	tuple.dst.protonum = sk->sk_protocol;
++	bound_dev_if = sk->sk_bound_dev_if;
++	flow_label = inet6->flow_label;
++	release_sock(sk);
+ 
+-	if (sk->sk_protocol != IPPROTO_TCP && sk->sk_protocol != IPPROTO_SCTP)
++	if (tuple.dst.protonum != IPPROTO_TCP &&
++	    tuple.dst.protonum != IPPROTO_SCTP)
+ 		return -ENOPROTOOPT;
+ 
+ 	if (*len < 0 || (unsigned int) *len < sizeof(sin6))
+@@ -257,14 +264,13 @@ ipv6_getorigdst(struct sock *sk, int optval, void __user *user, int *len)
+ 
+ 	sin6.sin6_family = AF_INET6;
+ 	sin6.sin6_port = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u.tcp.port;
+-	sin6.sin6_flowinfo = inet6->flow_label & IPV6_FLOWINFO_MASK;
++	sin6.sin6_flowinfo = flow_label & IPV6_FLOWINFO_MASK;
+ 	memcpy(&sin6.sin6_addr,
+ 		&ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3.in6,
+ 					sizeof(sin6.sin6_addr));
+ 
+ 	nf_ct_put(ct);
+-	sin6.sin6_scope_id = ipv6_iface_scope_id(&sin6.sin6_addr,
+-						 sk->sk_bound_dev_if);
++	sin6.sin6_scope_id = ipv6_iface_scope_id(&sin6.sin6_addr, bound_dev_if);
+ 	return copy_to_user(user, &sin6, sizeof(sin6)) ? -EFAULT : 0;
+ }
+ 
+diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
+index 55802e97f906..d7070d18db20 100644
+--- a/net/netfilter/x_tables.c
++++ b/net/netfilter/x_tables.c
+@@ -39,7 +39,6 @@ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("Harald Welte <laforge@×××××××××.org>");
+ MODULE_DESCRIPTION("{ip,ip6,arp,eb}_tables backend module");
+ 
+-#define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
+ #define XT_PCPU_BLOCK_SIZE 4096
+ 
+ struct compat_delta {
+@@ -210,6 +209,9 @@ xt_request_find_match(uint8_t nfproto, const char *name, uint8_t revision)
+ {
+ 	struct xt_match *match;
+ 
++	if (strnlen(name, XT_EXTENSION_MAXNAMELEN) == XT_EXTENSION_MAXNAMELEN)
++		return ERR_PTR(-EINVAL);
++
+ 	match = xt_find_match(nfproto, name, revision);
+ 	if (IS_ERR(match)) {
+ 		request_module("%st_%s", xt_prefix[nfproto], name);
+@@ -252,6 +254,9 @@ struct xt_target *xt_request_find_target(u8 af, const char *name, u8 revision)
+ {
+ 	struct xt_target *target;
+ 
++	if (strnlen(name, XT_EXTENSION_MAXNAMELEN) == XT_EXTENSION_MAXNAMELEN)
++		return ERR_PTR(-EINVAL);
++
+ 	target = xt_find_target(af, name, revision);
+ 	if (IS_ERR(target)) {
+ 		request_module("%st_%s", xt_prefix[af], name);
+@@ -1000,7 +1005,7 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size)
+ 		return NULL;
+ 
+ 	/* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */
+-	if ((SMP_ALIGN(size) >> PAGE_SHIFT) + 2 > totalram_pages)
++	if ((size >> PAGE_SHIFT) + 2 > totalram_pages)
+ 		return NULL;
+ 
+ 	info = kvmalloc(sz, GFP_KERNEL);
+diff --git a/net/netfilter/xt_RATEEST.c b/net/netfilter/xt_RATEEST.c
+index 498b54fd04d7..141c295191f6 100644
+--- a/net/netfilter/xt_RATEEST.c
++++ b/net/netfilter/xt_RATEEST.c
+@@ -39,23 +39,31 @@ static void xt_rateest_hash_insert(struct xt_rateest *est)
+ 	hlist_add_head(&est->list, &rateest_hash[h]);
+ }
+ 
+-struct xt_rateest *xt_rateest_lookup(const char *name)
++static struct xt_rateest *__xt_rateest_lookup(const char *name)
+ {
+ 	struct xt_rateest *est;
+ 	unsigned int h;
+ 
+ 	h = xt_rateest_hash(name);
+-	mutex_lock(&xt_rateest_mutex);
+ 	hlist_for_each_entry(est, &rateest_hash[h], list) {
+ 		if (strcmp(est->name, name) == 0) {
+ 			est->refcnt++;
+-			mutex_unlock(&xt_rateest_mutex);
+ 			return est;
+ 		}
+ 	}
+-	mutex_unlock(&xt_rateest_mutex);
++
+ 	return NULL;
+ }
++
++struct xt_rateest *xt_rateest_lookup(const char *name)
++{
++	struct xt_rateest *est;
++
++	mutex_lock(&xt_rateest_mutex);
++	est = __xt_rateest_lookup(name);
++	mutex_unlock(&xt_rateest_mutex);
++	return est;
++}
+ EXPORT_SYMBOL_GPL(xt_rateest_lookup);
+ 
+ void xt_rateest_put(struct xt_rateest *est)
+@@ -100,8 +108,10 @@ static int xt_rateest_tg_checkentry(const struct xt_tgchk_param *par)
+ 
+ 	net_get_random_once(&jhash_rnd, sizeof(jhash_rnd));
+ 
+-	est = xt_rateest_lookup(info->name);
++	mutex_lock(&xt_rateest_mutex);
++	est = __xt_rateest_lookup(info->name);
+ 	if (est) {
++		mutex_unlock(&xt_rateest_mutex);
+ 		/*
+ 		 * If estimator parameters are specified, they must match the
+ 		 * existing estimator.
+@@ -139,11 +149,13 @@ static int xt_rateest_tg_checkentry(const struct xt_tgchk_param *par)
+ 
+ 	info->est = est;
+ 	xt_rateest_hash_insert(est);
++	mutex_unlock(&xt_rateest_mutex);
+ 	return 0;
+ 
+ err2:
+ 	kfree(est);
+ err1:
++	mutex_unlock(&xt_rateest_mutex);
+ 	return ret;
+ }
+ 
+diff --git a/net/netfilter/xt_cgroup.c b/net/netfilter/xt_cgroup.c
+index 1db1ce59079f..891f4e7e8ea7 100644
+--- a/net/netfilter/xt_cgroup.c
++++ b/net/netfilter/xt_cgroup.c
+@@ -52,6 +52,7 @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param *par)
+ 		return -EINVAL;
+ 	}
+ 
++	info->priv = NULL;
+ 	if (info->has_path) {
+ 		cgrp = cgroup_get_from_path(info->path);
+ 		if (IS_ERR(cgrp)) {
+diff --git a/net/rds/connection.c b/net/rds/connection.c
+index 7ee2d5d68b78..9efc82c665b5 100644
+--- a/net/rds/connection.c
++++ b/net/rds/connection.c
+@@ -366,6 +366,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp)
+ 	 * to the conn hash, so we never trigger a reconnect on this
+ 	 * conn - the reconnect is always triggered by the active peer. */
+ 	cancel_delayed_work_sync(&cp->cp_conn_w);
++	if (conn->c_destroy_in_prog)
++		return;
+ 	rcu_read_lock();
+ 	if (!hlist_unhashed(&conn->c_hash_node)) {
+ 		rcu_read_unlock();
+@@ -445,7 +447,6 @@ void rds_conn_destroy(struct rds_connection *conn)
+ 	 */
+ 	rds_cong_remove_conn(conn);
+ 
+-	put_net(conn->c_net);
+ 	kfree(conn->c_path);
+ 	kmem_cache_free(rds_conn_slab, conn);
+ 
+diff --git a/net/rds/rds.h b/net/rds/rds.h
+index c349c71babff..d09f6c1facb4 100644
+--- a/net/rds/rds.h
++++ b/net/rds/rds.h
+@@ -150,7 +150,7 @@ struct rds_connection {
+ 
+ 	/* Protocol version */
+ 	unsigned int		c_version;
+-	struct net		*c_net;
++	possible_net_t		c_net;
+ 
+ 	struct list_head	c_map_item;
+ 	unsigned long		c_map_queued;
+@@ -165,13 +165,13 @@ struct rds_connection {
+ static inline
+ struct net *rds_conn_net(struct rds_connection *conn)
+ {
+-	return conn->c_net;
++	return read_pnet(&conn->c_net);
+ }
+ 
+ static inline
+ void rds_conn_net_set(struct rds_connection *conn, struct net *net)
+ {
+-	conn->c_net = get_net(net);
++	write_pnet(&conn->c_net, net);
+ }
+ 
+ #define RDS_FLAG_CONG_BITMAP	0x01
+diff --git a/net/rds/tcp.c b/net/rds/tcp.c
+index ab7356e0ba83..4df21e47d2ab 100644
+--- a/net/rds/tcp.c
++++ b/net/rds/tcp.c
+@@ -307,7 +307,8 @@ static void rds_tcp_conn_free(void *arg)
+ 	rdsdebug("freeing tc %p\n", tc);
+ 
+ 	spin_lock_irqsave(&rds_tcp_conn_lock, flags);
+-	list_del(&tc->t_tcp_node);
++	if (!tc->t_tcp_node_detached)
++		list_del(&tc->t_tcp_node);
+ 	spin_unlock_irqrestore(&rds_tcp_conn_lock, flags);
+ 
+ 	kmem_cache_free(rds_tcp_conn_slab, tc);
+@@ -528,12 +529,16 @@ static void rds_tcp_kill_sock(struct net *net)
+ 	rds_tcp_listen_stop(lsock, &rtn->rds_tcp_accept_w);
+ 	spin_lock_irq(&rds_tcp_conn_lock);
+ 	list_for_each_entry_safe(tc, _tc, &rds_tcp_conn_list, t_tcp_node) {
+-		struct net *c_net = tc->t_cpath->cp_conn->c_net;
++		struct net *c_net = read_pnet(&tc->t_cpath->cp_conn->c_net);
+ 
+ 		if (net != c_net || !tc->t_sock)
+ 			continue;
+-		if (!list_has_conn(&tmp_list, tc->t_cpath->cp_conn))
++		if (!list_has_conn(&tmp_list, tc->t_cpath->cp_conn)) {
+ 			list_move_tail(&tc->t_tcp_node, &tmp_list);
++		} else {
++			list_del(&tc->t_tcp_node);
++			tc->t_tcp_node_detached = true;
++		}
+ 	}
+ 	spin_unlock_irq(&rds_tcp_conn_lock);
+ 	list_for_each_entry_safe(tc, _tc, &tmp_list, t_tcp_node) {
+@@ -587,7 +592,7 @@ static void rds_tcp_sysctl_reset(struct net *net)
+ 
+ 	spin_lock_irq(&rds_tcp_conn_lock);
+ 	list_for_each_entry_safe(tc, _tc, &rds_tcp_conn_list, t_tcp_node) {
+-		struct net *c_net = tc->t_cpath->cp_conn->c_net;
++		struct net *c_net = read_pnet(&tc->t_cpath->cp_conn->c_net);
+ 
+ 		if (net != c_net || !tc->t_sock)
+ 			continue;
+diff --git a/net/rds/tcp.h b/net/rds/tcp.h
+index 864ca7d8f019..c6fa080e9b6d 100644
+--- a/net/rds/tcp.h
++++ b/net/rds/tcp.h
+@@ -12,6 +12,7 @@ struct rds_tcp_incoming {
+ struct rds_tcp_connection {
+ 
+ 	struct list_head	t_tcp_node;
++	bool			t_tcp_node_detached;
+ 	struct rds_conn_path	*t_cpath;
+ 	/* t_conn_path_lock synchronizes the connection establishment between
+ 	 * rds_tcp_accept_one and rds_tcp_conn_path_connect
+diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
+index 33cfe5d3d6cb..8900ea5cbabf 100644
+--- a/security/selinux/ss/services.c
++++ b/security/selinux/ss/services.c
+@@ -867,6 +867,9 @@ int security_bounded_transition(u32 old_sid, u32 new_sid)
+ 	int index;
+ 	int rc;
+ 
++	if (!ss_initialized)
++		return 0;
++
+ 	read_lock(&policy_rwlock);
+ 
+ 	rc = -EINVAL;
+@@ -1413,27 +1416,25 @@ static int security_context_to_sid_core(const char *scontext, u32 scontext_len,
+ 	if (!scontext_len)
+ 		return -EINVAL;
+ 
++	/* Copy the string to allow changes and ensure a NUL terminator */
++	scontext2 = kmemdup_nul(scontext, scontext_len, gfp_flags);
++	if (!scontext2)
++		return -ENOMEM;
++
+ 	if (!ss_initialized) {
+ 		int i;
+ 
+ 		for (i = 1; i < SECINITSID_NUM; i++) {
+-			if (!strcmp(initial_sid_to_string[i], scontext)) {
++			if (!strcmp(initial_sid_to_string[i], scontext2)) {
+ 				*sid = i;
+-				return 0;
++				goto out;
+ 			}
+ 		}
+ 		*sid = SECINITSID_KERNEL;
+-		return 0;
++		goto out;
+ 	}
+ 	*sid = SECSID_NULL;
+ 
+-	/* Copy the string so that we can modify the copy as we parse it. */
+-	scontext2 = kmalloc(scontext_len + 1, gfp_flags);
+-	if (!scontext2)
+-		return -ENOMEM;
+-	memcpy(scontext2, scontext, scontext_len);
+-	scontext2[scontext_len] = 0;
+-
+ 	if (force) {
+ 		/* Save another copy for storing in uninterpreted form */
+ 		rc = -ENOMEM;
+diff --git a/sound/soc/ux500/mop500.c b/sound/soc/ux500/mop500.c
+index 070a6880980e..c60a57797640 100644
+--- a/sound/soc/ux500/mop500.c
++++ b/sound/soc/ux500/mop500.c
+@@ -163,3 +163,7 @@ static struct platform_driver snd_soc_mop500_driver = {
+ };
+ 
+ module_platform_driver(snd_soc_mop500_driver);
++
++MODULE_LICENSE("GPL v2");
++MODULE_DESCRIPTION("ASoC MOP500 board driver");
++MODULE_AUTHOR("Ola Lilja");
+diff --git a/sound/soc/ux500/ux500_pcm.c b/sound/soc/ux500/ux500_pcm.c
+index f12c01dddc8d..d35ba7700f46 100644
+--- a/sound/soc/ux500/ux500_pcm.c
++++ b/sound/soc/ux500/ux500_pcm.c
+@@ -165,3 +165,8 @@ int ux500_pcm_unregister_platform(struct platform_device *pdev)
+ 	return 0;
+ }
+ EXPORT_SYMBOL_GPL(ux500_pcm_unregister_platform);
++
++MODULE_AUTHOR("Ola Lilja");
++MODULE_AUTHOR("Roger Nilsson");
++MODULE_DESCRIPTION("ASoC UX500 driver");
++MODULE_LICENSE("GPL v2");