[gentoo-commits] proj/linux-patches:4.4 commit in: /

[Mike Pagano]

commit:     8c82d3d13c673549699980d0c10fd76f0469585f
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Sep 15 10:09:16 2018 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Sep 15 10:09:16 2018 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=8c82d3d1

Linux patch 4.4.156

 0000_README              |    4 +
 1155_linux-4.4.156.patch | 1864 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 1868 insertions(+)

diff --git a/0000_README b/0000_README
index 6b63ef8..6a3a701 100644
--- a/0000_README
+++ b/0000_README
@@ -663,6 +663,10 @@ Patch:  1154_linux-4.4.155.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.4.155
 
+Patch:  1155_linux-4.4.156.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.4.156
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1155_linux-4.4.156.patch b/1155_linux-4.4.156.patch
new file mode 100644
index 0000000..9615eee
--- /dev/null
+++ b/1155_linux-4.4.156.patch
@@ -0,0 +1,1864 @@
+diff --git a/Makefile b/Makefile
+index 2d9f89ec8397..6dd5924a7ea5 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 4
+-SUBLEVEL = 155
++SUBLEVEL = 156
+ EXTRAVERSION =
+ NAME = Blurry Fish Butt
+ 
+diff --git a/arch/arm/configs/imx_v6_v7_defconfig b/arch/arm/configs/imx_v6_v7_defconfig
+index b3490c1c49d1..4187f69f6630 100644
+--- a/arch/arm/configs/imx_v6_v7_defconfig
++++ b/arch/arm/configs/imx_v6_v7_defconfig
+@@ -261,7 +261,6 @@ CONFIG_USB_STORAGE=y
+ CONFIG_USB_CHIPIDEA=y
+ CONFIG_USB_CHIPIDEA_UDC=y
+ CONFIG_USB_CHIPIDEA_HOST=y
+-CONFIG_USB_CHIPIDEA_ULPI=y
+ CONFIG_USB_SERIAL=m
+ CONFIG_USB_SERIAL_GENERIC=y
+ CONFIG_USB_SERIAL_FTDI_SIO=m
+@@ -288,7 +287,6 @@ CONFIG_USB_G_NCM=m
+ CONFIG_USB_GADGETFS=m
+ CONFIG_USB_MASS_STORAGE=m
+ CONFIG_USB_G_SERIAL=m
+-CONFIG_USB_ULPI_BUS=y
+ CONFIG_MMC=y
+ CONFIG_MMC_SDHCI=y
+ CONFIG_MMC_SDHCI_PLTFM=y
+diff --git a/arch/arm/include/asm/arch_gicv3.h b/arch/arm/include/asm/arch_gicv3.h
+index 7da5503c0591..e08d15184056 100644
+--- a/arch/arm/include/asm/arch_gicv3.h
++++ b/arch/arm/include/asm/arch_gicv3.h
+@@ -117,6 +117,7 @@ static inline u32 gic_read_iar(void)
+ 	u32 irqstat;
+ 
+ 	asm volatile("mrc " __stringify(ICC_IAR1) : "=r" (irqstat));
++	dsb(sy);
+ 	return irqstat;
+ }
+ 
+diff --git a/arch/powerpc/platforms/pseries/ras.c b/arch/powerpc/platforms/pseries/ras.c
+index f5313a78e5d6..9795e52bab3d 100644
+--- a/arch/powerpc/platforms/pseries/ras.c
++++ b/arch/powerpc/platforms/pseries/ras.c
+@@ -311,7 +311,7 @@ static struct rtas_error_log *fwnmi_get_errinfo(struct pt_regs *regs)
+ 		int len, error_log_length;
+ 
+ 		error_log_length = 8 + rtas_error_extended_log_length(h);
+-		len = max_t(int, error_log_length, RTAS_ERROR_LOG_MAX);
++		len = min_t(int, error_log_length, RTAS_ERROR_LOG_MAX);
+ 		memset(global_mce_data_buf, 0, RTAS_ERROR_LOG_MAX);
+ 		memcpy(global_mce_data_buf, h, len);
+ 		errhdr = (struct rtas_error_log *)global_mce_data_buf;
+diff --git a/arch/powerpc/sysdev/mpic_msgr.c b/arch/powerpc/sysdev/mpic_msgr.c
+index 3f165d972a0e..994fe73c2ed0 100644
+--- a/arch/powerpc/sysdev/mpic_msgr.c
++++ b/arch/powerpc/sysdev/mpic_msgr.c
+@@ -196,7 +196,7 @@ static int mpic_msgr_probe(struct platform_device *dev)
+ 
+ 	/* IO map the message register block. */
+ 	of_address_to_resource(np, 0, &rsrc);
+-	msgr_block_addr = ioremap(rsrc.start, rsrc.end - rsrc.start);
++	msgr_block_addr = ioremap(rsrc.start, resource_size(&rsrc));
+ 	if (!msgr_block_addr) {
+ 		dev_err(&dev->dev, "Failed to iomap MPIC message registers");
+ 		return -EFAULT;
+diff --git a/arch/s390/lib/mem.S b/arch/s390/lib/mem.S
+index 16c5998b9792..4254c477e8e0 100644
+--- a/arch/s390/lib/mem.S
++++ b/arch/s390/lib/mem.S
+@@ -26,7 +26,7 @@
+  */
+ ENTRY(memset)
+ 	ltgr	%r4,%r4
+-	bzr	%r14
++	jz	.Lmemset_exit
+ 	ltgr	%r3,%r3
+ 	jnz	.Lmemset_fill
+ 	aghi	%r4,-1
+@@ -41,12 +41,13 @@ ENTRY(memset)
+ .Lmemset_clear_rest:
+ 	larl	%r3,.Lmemset_xc
+ 	ex	%r4,0(%r3)
++.Lmemset_exit:
+ 	BR_EX	%r14
+ .Lmemset_fill:
+ 	stc	%r3,0(%r2)
+ 	cghi	%r4,1
+ 	lgr	%r1,%r2
+-	ber	%r14
++	je	.Lmemset_fill_exit
+ 	aghi	%r4,-2
+ 	srlg	%r3,%r4,8
+ 	ltgr	%r3,%r3
+@@ -58,6 +59,7 @@ ENTRY(memset)
+ .Lmemset_fill_rest:
+ 	larl	%r3,.Lmemset_mvc
+ 	ex	%r4,0(%r3)
++.Lmemset_fill_exit:
+ 	BR_EX	%r14
+ .Lmemset_xc:
+ 	xc	0(1,%r1),0(%r1)
+@@ -71,7 +73,7 @@ ENTRY(memset)
+  */
+ ENTRY(memcpy)
+ 	ltgr	%r4,%r4
+-	bzr	%r14
++	jz	.Lmemcpy_exit
+ 	aghi	%r4,-1
+ 	srlg	%r5,%r4,8
+ 	ltgr	%r5,%r5
+@@ -80,6 +82,7 @@ ENTRY(memcpy)
+ .Lmemcpy_rest:
+ 	larl	%r5,.Lmemcpy_mvc
+ 	ex	%r4,0(%r5)
++.Lmemcpy_exit:
+ 	BR_EX	%r14
+ .Lmemcpy_loop:
+ 	mvc	0(256,%r1),0(%r3)
+diff --git a/arch/x86/include/asm/pgtable-3level.h b/arch/x86/include/asm/pgtable-3level.h
+index 5c686382d84b..095dbc25122a 100644
+--- a/arch/x86/include/asm/pgtable-3level.h
++++ b/arch/x86/include/asm/pgtable-3level.h
+@@ -1,6 +1,8 @@
+ #ifndef _ASM_X86_PGTABLE_3LEVEL_H
+ #define _ASM_X86_PGTABLE_3LEVEL_H
+ 
++#include <asm/atomic64_32.h>
++
+ /*
+  * Intel Physical Address Extension (PAE) Mode - three-level page
+  * tables on PPro+ CPUs.
+@@ -142,10 +144,7 @@ static inline pte_t native_ptep_get_and_clear(pte_t *ptep)
+ {
+ 	pte_t res;
+ 
+-	/* xchg acts as a barrier before the setting of the high bits */
+-	res.pte_low = xchg(&ptep->pte_low, 0);
+-	res.pte_high = ptep->pte_high;
+-	ptep->pte_high = 0;
++	res.pte = (pteval_t)atomic64_xchg((atomic64_t *)ptep, 0);
+ 
+ 	return res;
+ }
+diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
+index 68a55273ce0f..a67d7f210b7c 100644
+--- a/arch/x86/include/asm/pgtable.h
++++ b/arch/x86/include/asm/pgtable.h
+@@ -385,7 +385,7 @@ static inline pmd_t pfn_pmd(unsigned long page_nr, pgprot_t pgprot)
+ 
+ static inline pud_t pfn_pud(unsigned long page_nr, pgprot_t pgprot)
+ {
+-	phys_addr_t pfn = page_nr << PAGE_SHIFT;
++	phys_addr_t pfn = (phys_addr_t)page_nr << PAGE_SHIFT;
+ 	pfn ^= protnone_mask(pgprot_val(pgprot));
+ 	pfn &= PHYSICAL_PUD_PAGE_MASK;
+ 	return __pud(pfn | massage_pgprot(pgprot));
+diff --git a/drivers/irqchip/irq-bcm7038-l1.c b/drivers/irqchip/irq-bcm7038-l1.c
+index d7af88534971..6fb34bf0f352 100644
+--- a/drivers/irqchip/irq-bcm7038-l1.c
++++ b/drivers/irqchip/irq-bcm7038-l1.c
+@@ -216,6 +216,7 @@ static int bcm7038_l1_set_affinity(struct irq_data *d,
+ 	return 0;
+ }
+ 
++#ifdef CONFIG_SMP
+ static void bcm7038_l1_cpu_offline(struct irq_data *d)
+ {
+ 	struct cpumask *mask = irq_data_get_affinity_mask(d);
+@@ -240,6 +241,7 @@ static void bcm7038_l1_cpu_offline(struct irq_data *d)
+ 	}
+ 	irq_set_affinity_locked(d, &new_affinity, false);
+ }
++#endif
+ 
+ static int __init bcm7038_l1_init_one(struct device_node *dn,
+ 				      unsigned int idx,
+@@ -292,7 +294,9 @@ static struct irq_chip bcm7038_l1_irq_chip = {
+ 	.irq_mask		= bcm7038_l1_mask,
+ 	.irq_unmask		= bcm7038_l1_unmask,
+ 	.irq_set_affinity	= bcm7038_l1_set_affinity,
++#ifdef CONFIG_SMP
+ 	.irq_cpu_offline	= bcm7038_l1_cpu_offline,
++#endif
+ };
+ 
+ static int bcm7038_l1_map(struct irq_domain *d, unsigned int virq,
+diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
+index 82e00e3ad0e0..c3d7a1461043 100644
+--- a/drivers/irqchip/irq-gic-v3-its.c
++++ b/drivers/irqchip/irq-gic-v3-its.c
+@@ -67,7 +67,10 @@ struct its_node {
+ 	unsigned long		phys_base;
+ 	struct its_cmd_block	*cmd_base;
+ 	struct its_cmd_block	*cmd_write;
+-	void			*tables[GITS_BASER_NR_REGS];
++	struct {
++		void		*base;
++		u32		order;
++	} tables[GITS_BASER_NR_REGS];
+ 	struct its_collection	*collections;
+ 	struct list_head	its_device_list;
+ 	u64			flags;
+@@ -77,6 +80,9 @@ struct its_node {
+ 
+ #define ITS_ITT_ALIGN		SZ_256
+ 
++/* Convert page order to size in bytes */
++#define PAGE_ORDER_TO_SIZE(o)	(PAGE_SIZE << (o))
++
+ struct event_lpi_map {
+ 	unsigned long		*lpi_map;
+ 	u16			*col_map;
+@@ -816,9 +822,10 @@ static void its_free_tables(struct its_node *its)
+ 	int i;
+ 
+ 	for (i = 0; i < GITS_BASER_NR_REGS; i++) {
+-		if (its->tables[i]) {
+-			free_page((unsigned long)its->tables[i]);
+-			its->tables[i] = NULL;
++		if (its->tables[i].base) {
++			free_pages((unsigned long)its->tables[i].base,
++				   its->tables[i].order);
++			its->tables[i].base = NULL;
+ 		}
+ 	}
+ }
+@@ -851,7 +858,6 @@ static int its_alloc_tables(const char *node_name, struct its_node *its)
+ 		u64 type = GITS_BASER_TYPE(val);
+ 		u64 entry_size = GITS_BASER_ENTRY_SIZE(val);
+ 		int order = get_order(psz);
+-		int alloc_size;
+ 		int alloc_pages;
+ 		u64 tmp;
+ 		void *base;
+@@ -883,8 +889,8 @@ static int its_alloc_tables(const char *node_name, struct its_node *its)
+ 			}
+ 		}
+ 
+-		alloc_size = (1 << order) * PAGE_SIZE;
+-		alloc_pages = (alloc_size / psz);
++retry_alloc_baser:
++		alloc_pages = (PAGE_ORDER_TO_SIZE(order) / psz);
+ 		if (alloc_pages > GITS_BASER_PAGES_MAX) {
+ 			alloc_pages = GITS_BASER_PAGES_MAX;
+ 			order = get_order(GITS_BASER_PAGES_MAX * psz);
+@@ -898,7 +904,8 @@ static int its_alloc_tables(const char *node_name, struct its_node *its)
+ 			goto out_free;
+ 		}
+ 
+-		its->tables[i] = base;
++		its->tables[i].base = base;
++		its->tables[i].order = order;
+ 
+ retry_baser:
+ 		val = (virt_to_phys(base) 				 |
+@@ -936,7 +943,7 @@ retry_baser:
+ 			shr = tmp & GITS_BASER_SHAREABILITY_MASK;
+ 			if (!shr) {
+ 				cache = GITS_BASER_nC;
+-				__flush_dcache_area(base, alloc_size);
++				__flush_dcache_area(base, PAGE_ORDER_TO_SIZE(order));
+ 			}
+ 			goto retry_baser;
+ 		}
+@@ -947,13 +954,16 @@ retry_baser:
+ 			 * size and retry. If we reach 4K, then
+ 			 * something is horribly wrong...
+ 			 */
++			free_pages((unsigned long)base, order);
++			its->tables[i].base = NULL;
++
+ 			switch (psz) {
+ 			case SZ_16K:
+ 				psz = SZ_4K;
+-				goto retry_baser;
++				goto retry_alloc_baser;
+ 			case SZ_64K:
+ 				psz = SZ_16K;
+-				goto retry_baser;
++				goto retry_alloc_baser;
+ 			}
+ 		}
+ 
+@@ -966,7 +976,7 @@ retry_baser:
+ 		}
+ 
+ 		pr_info("ITS: allocated %d %s @%lx (psz %dK, shr %d)\n",
+-			(int)(alloc_size / entry_size),
++			(int)(PAGE_ORDER_TO_SIZE(order) / entry_size),
+ 			its_base_type_string[type],
+ 			(unsigned long)virt_to_phys(base),
+ 			psz / SZ_1K, (int)shr >> GITS_BASER_SHAREABILITY_SHIFT);
+diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c
+index cebd8efe651a..5fe968a4338a 100644
+--- a/drivers/irqchip/irq-gic.c
++++ b/drivers/irqchip/irq-gic.c
+@@ -336,7 +336,7 @@ static void __exception_irq_entry gic_handle_irq(struct pt_regs *regs)
+ 		irqstat = readl_relaxed(cpu_base + GIC_CPU_INTACK);
+ 		irqnr = irqstat & GICC_IAR_INT_ID_MASK;
+ 
+-		if (likely(irqnr > 15 && irqnr < 1021)) {
++		if (likely(irqnr > 15 && irqnr < 1020)) {
+ 			if (static_key_true(&supports_deactivate))
+ 				writel_relaxed(irqstat, cpu_base + GIC_CPU_EOI);
+ 			handle_domain_irq(gic->domain, irqnr, regs);
+diff --git a/drivers/md/dm-kcopyd.c b/drivers/md/dm-kcopyd.c
+index 1452ed9aacb4..54c308e6704f 100644
+--- a/drivers/md/dm-kcopyd.c
++++ b/drivers/md/dm-kcopyd.c
+@@ -454,6 +454,8 @@ static int run_complete_job(struct kcopyd_job *job)
+ 	if (atomic_dec_and_test(&kc->nr_jobs))
+ 		wake_up(&kc->destroyq);
+ 
++	cond_resched();
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/mfd/sm501.c b/drivers/mfd/sm501.c
+index c646784c5a7d..fbec711c4195 100644
+--- a/drivers/mfd/sm501.c
++++ b/drivers/mfd/sm501.c
+@@ -714,6 +714,7 @@ sm501_create_subdev(struct sm501_devdata *sm, char *name,
+ 	smdev->pdev.name = name;
+ 	smdev->pdev.id = sm->pdev_id;
+ 	smdev->pdev.dev.parent = sm->dev;
++	smdev->pdev.dev.coherent_dma_mask = 0xffffffff;
+ 
+ 	if (res_count) {
+ 		smdev->pdev.resource = (struct resource *)(smdev+1);
+diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
+index adab5bbb642a..d5b84d68f988 100644
+--- a/drivers/misc/mei/pci-me.c
++++ b/drivers/misc/mei/pci-me.c
+@@ -230,8 +230,11 @@ static int mei_me_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	if (!pci_dev_run_wake(pdev))
+ 		mei_me_set_pm_domain(dev);
+ 
+-	if (mei_pg_is_enabled(dev))
++	if (mei_pg_is_enabled(dev)) {
+ 		pm_runtime_put_noidle(&pdev->dev);
++		if (hw->d0i3_supported)
++			pm_runtime_allow(&pdev->dev);
++	}
+ 
+ 	dev_dbg(&pdev->dev, "initialization successful.\n");
+ 
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.h b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
+index cef53f2d9854..ce20bc939b38 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
+@@ -185,6 +185,9 @@ struct bcmgenet_mib_counters {
+ #define UMAC_MAC1			0x010
+ #define UMAC_MAX_FRAME_LEN		0x014
+ 
++#define UMAC_MODE			0x44
++#define  MODE_LINK_STATUS		(1 << 5)
++
+ #define UMAC_EEE_CTRL			0x064
+ #define  EN_LPI_RX_PAUSE		(1 << 0)
+ #define  EN_LPI_TX_PFC			(1 << 1)
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+index e96d1f95bb47..4c73feca4842 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
+@@ -167,8 +167,14 @@ void bcmgenet_mii_setup(struct net_device *dev)
+ static int bcmgenet_fixed_phy_link_update(struct net_device *dev,
+ 					  struct fixed_phy_status *status)
+ {
+-	if (dev && dev->phydev && status)
+-		status->link = dev->phydev->link;
++	struct bcmgenet_priv *priv;
++	u32 reg;
++
++	if (dev && dev->phydev && status) {
++		priv = netdev_priv(dev);
++		reg = bcmgenet_umac_readl(priv, UMAC_MODE);
++		status->link = !!(reg & MODE_LINK_STATUS);
++	}
+ 
+ 	return 0;
+ }
+diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
+index b20bce2c7da1..0433fdebda25 100644
+--- a/drivers/net/ethernet/cisco/enic/enic_main.c
++++ b/drivers/net/ethernet/cisco/enic/enic_main.c
+@@ -2683,7 +2683,6 @@ static int enic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 	 */
+ 
+ 	enic->port_mtu = enic->config.mtu;
+-	(void)enic_change_mtu(netdev, enic->port_mtu);
+ 
+ 	err = enic_set_mac_addr(netdev, enic->mac_addr);
+ 	if (err) {
+@@ -2732,6 +2731,7 @@ static int enic_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
+ 		netdev->features |= NETIF_F_HIGHDMA;
+ 
+ 	netdev->priv_flags |= IFF_UNICAST_FLT;
++	netdev->mtu = enic->port_mtu;
+ 
+ 	err = register_netdev(netdev);
+ 	if (err) {
+diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
+index b28e73ea2c25..f39ad0e66637 100644
+--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c
++++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
+@@ -2388,26 +2388,20 @@ static int qlge_update_hw_vlan_features(struct net_device *ndev,
+ 	return status;
+ }
+ 
+-static netdev_features_t qlge_fix_features(struct net_device *ndev,
+-	netdev_features_t features)
+-{
+-	int err;
+-
+-	/* Update the behavior of vlan accel in the adapter */
+-	err = qlge_update_hw_vlan_features(ndev, features);
+-	if (err)
+-		return err;
+-
+-	return features;
+-}
+-
+ static int qlge_set_features(struct net_device *ndev,
+ 	netdev_features_t features)
+ {
+ 	netdev_features_t changed = ndev->features ^ features;
++	int err;
++
++	if (changed & NETIF_F_HW_VLAN_CTAG_RX) {
++		/* Update the behavior of vlan accel in the adapter */
++		err = qlge_update_hw_vlan_features(ndev, features);
++		if (err)
++			return err;
+ 
+-	if (changed & NETIF_F_HW_VLAN_CTAG_RX)
+ 		qlge_vlan_mode(ndev, features);
++	}
+ 
+ 	return 0;
+ }
+@@ -4720,7 +4714,6 @@ static const struct net_device_ops qlge_netdev_ops = {
+ 	.ndo_set_mac_address	= qlge_set_mac_address,
+ 	.ndo_validate_addr	= eth_validate_addr,
+ 	.ndo_tx_timeout		= qlge_tx_timeout,
+-	.ndo_fix_features	= qlge_fix_features,
+ 	.ndo_set_features	= qlge_set_features,
+ 	.ndo_vlan_rx_add_vid	= qlge_vlan_rx_add_vid,
+ 	.ndo_vlan_rx_kill_vid	= qlge_vlan_rx_kill_vid,
+diff --git a/drivers/pci/host/pci-mvebu.c b/drivers/pci/host/pci-mvebu.c
+index 379d08f76146..d0a4652bb9ac 100644
+--- a/drivers/pci/host/pci-mvebu.c
++++ b/drivers/pci/host/pci-mvebu.c
+@@ -1235,7 +1235,7 @@ static int mvebu_pcie_probe(struct platform_device *pdev)
+ 		pcie->realio.start = PCIBIOS_MIN_IO;
+ 		pcie->realio.end = min_t(resource_size_t,
+ 					 IO_SPACE_LIMIT,
+-					 resource_size(&pcie->io));
++					 resource_size(&pcie->io) - 1);
+ 	} else
+ 		pcie->realio = pcie->io;
+ 
+diff --git a/drivers/platform/x86/asus-nb-wmi.c b/drivers/platform/x86/asus-nb-wmi.c
+index 0e0403e024c5..852d2de7f69f 100644
+--- a/drivers/platform/x86/asus-nb-wmi.c
++++ b/drivers/platform/x86/asus-nb-wmi.c
+@@ -392,6 +392,7 @@ static const struct key_entry asus_nb_wmi_keymap[] = {
+ 	{ KE_KEY, 0xC4, { KEY_KBDILLUMUP } },
+ 	{ KE_KEY, 0xC5, { KEY_KBDILLUMDOWN } },
+ 	{ KE_IGNORE, 0xC6, },  /* Ambient Light Sensor notification */
++	{ KE_KEY, 0xFA, { KEY_PROG2 } },           /* Lid flip action */
+ 	{ KE_END, 0},
+ };
+ 
+diff --git a/drivers/s390/block/dasd_eckd.c b/drivers/s390/block/dasd_eckd.c
+index 21d174e9ebdb..dac2f6883e28 100644
+--- a/drivers/s390/block/dasd_eckd.c
++++ b/drivers/s390/block/dasd_eckd.c
+@@ -2101,8 +2101,11 @@ static int dasd_eckd_basic_to_ready(struct dasd_device *device)
+ 
+ static int dasd_eckd_online_to_ready(struct dasd_device *device)
+ {
+-	cancel_work_sync(&device->reload_device);
+-	cancel_work_sync(&device->kick_validate);
++	if (cancel_work_sync(&device->reload_device))
++		dasd_put_device(device);
++	if (cancel_work_sync(&device->kick_validate))
++		dasd_put_device(device);
++
+ 	return 0;
+ };
+ 
+diff --git a/drivers/scsi/aic94xx/aic94xx_init.c b/drivers/scsi/aic94xx/aic94xx_init.c
+index 662b2321d1b0..913ebb6d0d29 100644
+--- a/drivers/scsi/aic94xx/aic94xx_init.c
++++ b/drivers/scsi/aic94xx/aic94xx_init.c
+@@ -1031,8 +1031,10 @@ static int __init aic94xx_init(void)
+ 
+ 	aic94xx_transport_template =
+ 		sas_domain_attach_transport(&aic94xx_transport_functions);
+-	if (!aic94xx_transport_template)
++	if (!aic94xx_transport_template) {
++		err = -ENOMEM;
+ 		goto out_destroy_caches;
++	}
+ 
+ 	err = pci_register_driver(&aic94xx_pci_driver);
+ 	if (err)
+diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c
+index 47cb163da9a0..4adb1138af09 100644
+--- a/drivers/staging/android/ion/ion.c
++++ b/drivers/staging/android/ion/ion.c
+@@ -449,18 +449,6 @@ static struct ion_handle *ion_handle_get_by_id_nolock(struct ion_client *client,
+ 	return ERR_PTR(-EINVAL);
+ }
+ 
+-struct ion_handle *ion_handle_get_by_id(struct ion_client *client,
+-						int id)
+-{
+-	struct ion_handle *handle;
+-
+-	mutex_lock(&client->lock);
+-	handle = ion_handle_get_by_id_nolock(client, id);
+-	mutex_unlock(&client->lock);
+-
+-	return handle;
+-}
+-
+ static bool ion_handle_validate(struct ion_client *client,
+ 				struct ion_handle *handle)
+ {
+@@ -1138,24 +1126,28 @@ static struct dma_buf_ops dma_buf_ops = {
+ 	.kunmap = ion_dma_buf_kunmap,
+ };
+ 
+-struct dma_buf *ion_share_dma_buf(struct ion_client *client,
+-						struct ion_handle *handle)
++static struct dma_buf *__ion_share_dma_buf(struct ion_client *client,
++					   struct ion_handle *handle,
++					   bool lock_client)
+ {
+ 	DEFINE_DMA_BUF_EXPORT_INFO(exp_info);
+ 	struct ion_buffer *buffer;
+ 	struct dma_buf *dmabuf;
+ 	bool valid_handle;
+ 
+-	mutex_lock(&client->lock);
++	if (lock_client)
++		mutex_lock(&client->lock);
+ 	valid_handle = ion_handle_validate(client, handle);
+ 	if (!valid_handle) {
+ 		WARN(1, "%s: invalid handle passed to share.\n", __func__);
+-		mutex_unlock(&client->lock);
++		if (lock_client)
++			mutex_unlock(&client->lock);
+ 		return ERR_PTR(-EINVAL);
+ 	}
+ 	buffer = handle->buffer;
+ 	ion_buffer_get(buffer);
+-	mutex_unlock(&client->lock);
++	if (lock_client)
++		mutex_unlock(&client->lock);
+ 
+ 	exp_info.ops = &dma_buf_ops;
+ 	exp_info.size = buffer->size;
+@@ -1170,14 +1162,21 @@ struct dma_buf *ion_share_dma_buf(struct ion_client *client,
+ 
+ 	return dmabuf;
+ }
++
++struct dma_buf *ion_share_dma_buf(struct ion_client *client,
++				  struct ion_handle *handle)
++{
++	return __ion_share_dma_buf(client, handle, true);
++}
+ EXPORT_SYMBOL(ion_share_dma_buf);
+ 
+-int ion_share_dma_buf_fd(struct ion_client *client, struct ion_handle *handle)
++static int __ion_share_dma_buf_fd(struct ion_client *client,
++				  struct ion_handle *handle, bool lock_client)
+ {
+ 	struct dma_buf *dmabuf;
+ 	int fd;
+ 
+-	dmabuf = ion_share_dma_buf(client, handle);
++	dmabuf = __ion_share_dma_buf(client, handle, lock_client);
+ 	if (IS_ERR(dmabuf))
+ 		return PTR_ERR(dmabuf);
+ 
+@@ -1187,8 +1186,19 @@ int ion_share_dma_buf_fd(struct ion_client *client, struct ion_handle *handle)
+ 
+ 	return fd;
+ }
++
++int ion_share_dma_buf_fd(struct ion_client *client, struct ion_handle *handle)
++{
++	return __ion_share_dma_buf_fd(client, handle, true);
++}
+ EXPORT_SYMBOL(ion_share_dma_buf_fd);
+ 
++static int ion_share_dma_buf_fd_nolock(struct ion_client *client,
++				       struct ion_handle *handle)
++{
++	return __ion_share_dma_buf_fd(client, handle, false);
++}
++
+ struct ion_handle *ion_import_dma_buf(struct ion_client *client, int fd)
+ {
+ 	struct dma_buf *dmabuf;
+@@ -1335,11 +1345,15 @@ static long ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
+ 	{
+ 		struct ion_handle *handle;
+ 
+-		handle = ion_handle_get_by_id(client, data.handle.handle);
+-		if (IS_ERR(handle))
++		mutex_lock(&client->lock);
++		handle = ion_handle_get_by_id_nolock(client, data.handle.handle);
++		if (IS_ERR(handle)) {
++			mutex_unlock(&client->lock);
+ 			return PTR_ERR(handle);
+-		data.fd.fd = ion_share_dma_buf_fd(client, handle);
+-		ion_handle_put(handle);
++		}
++		data.fd.fd = ion_share_dma_buf_fd_nolock(client, handle);
++		ion_handle_put_nolock(handle);
++		mutex_unlock(&client->lock);
+ 		if (data.fd.fd < 0)
+ 			ret = data.fd.fd;
+ 		break;
+diff --git a/drivers/staging/comedi/drivers/ni_mio_common.c b/drivers/staging/comedi/drivers/ni_mio_common.c
+index 8f181caffca3..619c989c5f37 100644
+--- a/drivers/staging/comedi/drivers/ni_mio_common.c
++++ b/drivers/staging/comedi/drivers/ni_mio_common.c
+@@ -5275,11 +5275,11 @@ static int ni_E_init(struct comedi_device *dev,
+ 	/* Digital I/O (PFI) subdevice */
+ 	s = &dev->subdevices[NI_PFI_DIO_SUBDEV];
+ 	s->type		= COMEDI_SUBD_DIO;
+-	s->subdev_flags	= SDF_READABLE | SDF_WRITABLE | SDF_INTERNAL;
+ 	s->maxdata	= 1;
+ 	if (devpriv->is_m_series) {
+ 		s->n_chan	= 16;
+ 		s->insn_bits	= ni_pfi_insn_bits;
++		s->subdev_flags	= SDF_READABLE | SDF_WRITABLE | SDF_INTERNAL;
+ 
+ 		ni_writew(dev, s->state, NI_M_PFI_DO_REG);
+ 		for (i = 0; i < NUM_PFI_OUTPUT_SELECT_REGS; ++i) {
+@@ -5288,6 +5288,7 @@ static int ni_E_init(struct comedi_device *dev,
+ 		}
+ 	} else {
+ 		s->n_chan	= 10;
++		s->subdev_flags	= SDF_INTERNAL;
+ 	}
+ 	s->insn_config	= ni_pfi_insn_config;
+ 
+diff --git a/fs/btrfs/dev-replace.c b/fs/btrfs/dev-replace.c
+index 1e668fb7dd4c..176a27bc63aa 100644
+--- a/fs/btrfs/dev-replace.c
++++ b/fs/btrfs/dev-replace.c
+@@ -573,6 +573,12 @@ static int btrfs_dev_replace_finishing(struct btrfs_fs_info *fs_info,
+ 
+ 	btrfs_rm_dev_replace_unblocked(fs_info);
+ 
++	/*
++	 * Increment dev_stats_ccnt so that btrfs_run_dev_stats() will
++	 * update on-disk dev stats value during commit transaction
++	 */
++	atomic_inc(&tgt_device->dev_stats_ccnt);
++
+ 	/*
+ 	 * this is again a consistent state where no dev_replace procedure
+ 	 * is running, the target device is part of the filesystem, the
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index d106b981d86f..ae6e3a30e61e 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -1011,8 +1011,9 @@ static int btree_writepages(struct address_space *mapping,
+ 
+ 		fs_info = BTRFS_I(mapping->host)->root->fs_info;
+ 		/* this is a bit racy, but that's ok */
+-		ret = percpu_counter_compare(&fs_info->dirty_metadata_bytes,
+-					     BTRFS_DIRTY_METADATA_THRESH);
++		ret = __percpu_counter_compare(&fs_info->dirty_metadata_bytes,
++					     BTRFS_DIRTY_METADATA_THRESH,
++					     fs_info->dirty_metadata_batch);
+ 		if (ret < 0)
+ 			return 0;
+ 	}
+@@ -3987,8 +3988,9 @@ static void __btrfs_btree_balance_dirty(struct btrfs_root *root,
+ 	if (flush_delayed)
+ 		btrfs_balance_delayed_items(root);
+ 
+-	ret = percpu_counter_compare(&root->fs_info->dirty_metadata_bytes,
+-				     BTRFS_DIRTY_METADATA_THRESH);
++	ret = __percpu_counter_compare(&root->fs_info->dirty_metadata_bytes,
++				     BTRFS_DIRTY_METADATA_THRESH,
++				     root->fs_info->dirty_metadata_batch);
+ 	if (ret > 0) {
+ 		balance_dirty_pages_ratelimited(
+ 				   root->fs_info->btree_inode->i_mapping);
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index 493c7354ec0b..a72f941ca750 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -10410,7 +10410,7 @@ void btrfs_delete_unused_bgs(struct btrfs_fs_info *fs_info)
+ 		/* Don't want to race with allocators so take the groups_sem */
+ 		down_write(&space_info->groups_sem);
+ 		spin_lock(&block_group->lock);
+-		if (block_group->reserved ||
++		if (block_group->reserved || block_group->pinned ||
+ 		    btrfs_block_group_used(&block_group->item) ||
+ 		    block_group->ro ||
+ 		    list_is_singular(&block_group->list)) {
+diff --git a/fs/btrfs/relocation.c b/fs/btrfs/relocation.c
+index 9ebe027cc4b7..cfe913d2d3df 100644
+--- a/fs/btrfs/relocation.c
++++ b/fs/btrfs/relocation.c
+@@ -1318,18 +1318,19 @@ static void __del_reloc_root(struct btrfs_root *root)
+ 	struct mapping_node *node = NULL;
+ 	struct reloc_control *rc = root->fs_info->reloc_ctl;
+ 
+-	spin_lock(&rc->reloc_root_tree.lock);
+-	rb_node = tree_search(&rc->reloc_root_tree.rb_root,
+-			      root->node->start);
+-	if (rb_node) {
+-		node = rb_entry(rb_node, struct mapping_node, rb_node);
+-		rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
++	if (rc) {
++		spin_lock(&rc->reloc_root_tree.lock);
++		rb_node = tree_search(&rc->reloc_root_tree.rb_root,
++				      root->node->start);
++		if (rb_node) {
++			node = rb_entry(rb_node, struct mapping_node, rb_node);
++			rb_erase(&node->rb_node, &rc->reloc_root_tree.rb_root);
++		}
++		spin_unlock(&rc->reloc_root_tree.lock);
++		if (!node)
++			return;
++		BUG_ON((struct btrfs_root *)node->data != root);
+ 	}
+-	spin_unlock(&rc->reloc_root_tree.lock);
+-
+-	if (!node)
+-		return;
+-	BUG_ON((struct btrfs_root *)node->data != root);
+ 
+ 	spin_lock(&root->fs_info->trans_lock);
+ 	list_del_init(&root->root_list);
+diff --git a/fs/cifs/cifs_debug.c b/fs/cifs/cifs_debug.c
+index bcbe42fb7e92..0e72a14228f8 100644
+--- a/fs/cifs/cifs_debug.c
++++ b/fs/cifs/cifs_debug.c
+@@ -285,6 +285,10 @@ static ssize_t cifs_stats_proc_write(struct file *file,
+ 		atomic_set(&totBufAllocCount, 0);
+ 		atomic_set(&totSmBufAllocCount, 0);
+ #endif /* CONFIG_CIFS_STATS2 */
++		spin_lock(&GlobalMid_Lock);
++		GlobalMaxActiveXid = 0;
++		GlobalCurrentXid = 0;
++		spin_unlock(&GlobalMid_Lock);
+ 		spin_lock(&cifs_tcp_ses_lock);
+ 		list_for_each(tmp1, &cifs_tcp_ses_list) {
+ 			server = list_entry(tmp1, struct TCP_Server_Info,
+@@ -297,6 +301,10 @@ static ssize_t cifs_stats_proc_write(struct file *file,
+ 							  struct cifs_tcon,
+ 							  tcon_list);
+ 					atomic_set(&tcon->num_smbs_sent, 0);
++					spin_lock(&tcon->stat_lock);
++					tcon->bytes_read = 0;
++					tcon->bytes_written = 0;
++					spin_unlock(&tcon->stat_lock);
+ 					if (server->ops->clear_stats)
+ 						server->ops->clear_stats(tcon);
+ 				}
+diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
+index 76ccf20fbfb7..0e62bf1ebbd7 100644
+--- a/fs/cifs/smb2misc.c
++++ b/fs/cifs/smb2misc.c
+@@ -184,6 +184,13 @@ smb2_check_message(char *buf, unsigned int length)
+ 		if (clc_len == 4 + len + 1)
+ 			return 0;
+ 
++		/*
++		 * Some windows servers (win2016) will pad also the final
++		 * PDU in a compound to 8 bytes.
++		 */
++		if (((clc_len + 7) & ~7) == len)
++			return 0;
++
+ 		/*
+ 		 * MacOS server pads after SMB2.1 write response with 3 bytes
+ 		 * of junk. Other servers match RFC1001 len to actual
+diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
+index 5f5ba807b414..52d79fb04115 100644
+--- a/fs/cifs/smb2pdu.c
++++ b/fs/cifs/smb2pdu.c
+@@ -315,7 +315,7 @@ small_smb2_init(__le16 smb2_command, struct cifs_tcon *tcon,
+ 	smb2_hdr_assemble((struct smb2_hdr *) *request_buf, smb2_command, tcon);
+ 
+ 	if (tcon != NULL) {
+-#ifdef CONFIG_CIFS_STATS2
++#ifdef CONFIG_CIFS_STATS
+ 		uint16_t com_code = le16_to_cpu(smb2_command);
+ 		cifs_stats_inc(&tcon->stats.smb2_stats.smb2_com_sent[com_code]);
+ #endif
+diff --git a/fs/dcache.c b/fs/dcache.c
+index 807efaab838e..141651b0c766 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -278,7 +278,8 @@ void take_dentry_name_snapshot(struct name_snapshot *name, struct dentry *dentry
+ 		spin_unlock(&dentry->d_lock);
+ 		name->name = p->name;
+ 	} else {
+-		memcpy(name->inline_name, dentry->d_iname, DNAME_INLINE_LEN);
++		memcpy(name->inline_name, dentry->d_iname,
++		       dentry->d_name.len + 1);
+ 		spin_unlock(&dentry->d_lock);
+ 		name->name = name->inline_name;
+ 	}
+diff --git a/fs/fat/cache.c b/fs/fat/cache.c
+index 93fc62232ec2..9ae2c4d7e921 100644
+--- a/fs/fat/cache.c
++++ b/fs/fat/cache.c
+@@ -224,7 +224,8 @@ static inline void cache_init(struct fat_cache_id *cid, int fclus, int dclus)
+ int fat_get_cluster(struct inode *inode, int cluster, int *fclus, int *dclus)
+ {
+ 	struct super_block *sb = inode->i_sb;
+-	const int limit = sb->s_maxbytes >> MSDOS_SB(sb)->cluster_bits;
++	struct msdos_sb_info *sbi = MSDOS_SB(sb);
++	const int limit = sb->s_maxbytes >> sbi->cluster_bits;
+ 	struct fat_entry fatent;
+ 	struct fat_cache_id cid;
+ 	int nr;
+@@ -233,6 +234,12 @@ int fat_get_cluster(struct inode *inode, int cluster, int *fclus, int *dclus)
+ 
+ 	*fclus = 0;
+ 	*dclus = MSDOS_I(inode)->i_start;
++	if (!fat_valid_entry(sbi, *dclus)) {
++		fat_fs_error_ratelimit(sb,
++			"%s: invalid start cluster (i_pos %lld, start %08x)",
++			__func__, MSDOS_I(inode)->i_pos, *dclus);
++		return -EIO;
++	}
+ 	if (cluster == 0)
+ 		return 0;
+ 
+@@ -249,9 +256,8 @@ int fat_get_cluster(struct inode *inode, int cluster, int *fclus, int *dclus)
+ 		/* prevent the infinite loop of cluster chain */
+ 		if (*fclus > limit) {
+ 			fat_fs_error_ratelimit(sb,
+-					"%s: detected the cluster chain loop"
+-					" (i_pos %lld)", __func__,
+-					MSDOS_I(inode)->i_pos);
++				"%s: detected the cluster chain loop (i_pos %lld)",
++				__func__, MSDOS_I(inode)->i_pos);
+ 			nr = -EIO;
+ 			goto out;
+ 		}
+@@ -261,9 +267,8 @@ int fat_get_cluster(struct inode *inode, int cluster, int *fclus, int *dclus)
+ 			goto out;
+ 		else if (nr == FAT_ENT_FREE) {
+ 			fat_fs_error_ratelimit(sb,
+-				       "%s: invalid cluster chain (i_pos %lld)",
+-				       __func__,
+-				       MSDOS_I(inode)->i_pos);
++				"%s: invalid cluster chain (i_pos %lld)",
++				__func__, MSDOS_I(inode)->i_pos);
+ 			nr = -EIO;
+ 			goto out;
+ 		} else if (nr == FAT_ENT_EOF) {
+diff --git a/fs/fat/fat.h b/fs/fat/fat.h
+index be5e15323bab..1849b1adb6b9 100644
+--- a/fs/fat/fat.h
++++ b/fs/fat/fat.h
+@@ -344,6 +344,11 @@ static inline void fatent_brelse(struct fat_entry *fatent)
+ 	fatent->fat_inode = NULL;
+ }
+ 
++static inline bool fat_valid_entry(struct msdos_sb_info *sbi, int entry)
++{
++	return FAT_START_ENT <= entry && entry < sbi->max_cluster;
++}
++
+ extern void fat_ent_access_init(struct super_block *sb);
+ extern int fat_ent_read(struct inode *inode, struct fat_entry *fatent,
+ 			int entry);
+diff --git a/fs/fat/fatent.c b/fs/fat/fatent.c
+index 8226557130a2..a70e37c47a78 100644
+--- a/fs/fat/fatent.c
++++ b/fs/fat/fatent.c
+@@ -23,7 +23,7 @@ static void fat12_ent_blocknr(struct super_block *sb, int entry,
+ {
+ 	struct msdos_sb_info *sbi = MSDOS_SB(sb);
+ 	int bytes = entry + (entry >> 1);
+-	WARN_ON(entry < FAT_START_ENT || sbi->max_cluster <= entry);
++	WARN_ON(!fat_valid_entry(sbi, entry));
+ 	*offset = bytes & (sb->s_blocksize - 1);
+ 	*blocknr = sbi->fat_start + (bytes >> sb->s_blocksize_bits);
+ }
+@@ -33,7 +33,7 @@ static void fat_ent_blocknr(struct super_block *sb, int entry,
+ {
+ 	struct msdos_sb_info *sbi = MSDOS_SB(sb);
+ 	int bytes = (entry << sbi->fatent_shift);
+-	WARN_ON(entry < FAT_START_ENT || sbi->max_cluster <= entry);
++	WARN_ON(!fat_valid_entry(sbi, entry));
+ 	*offset = bytes & (sb->s_blocksize - 1);
+ 	*blocknr = sbi->fat_start + (bytes >> sb->s_blocksize_bits);
+ }
+@@ -353,7 +353,7 @@ int fat_ent_read(struct inode *inode, struct fat_entry *fatent, int entry)
+ 	int err, offset;
+ 	sector_t blocknr;
+ 
+-	if (entry < FAT_START_ENT || sbi->max_cluster <= entry) {
++	if (!fat_valid_entry(sbi, entry)) {
+ 		fatent_brelse(fatent);
+ 		fat_fs_error(sb, "invalid access to FAT (entry 0x%08x)", entry);
+ 		return -EIO;
+diff --git a/fs/hfs/brec.c b/fs/hfs/brec.c
+index 6fc766df0461..2a6f3c67cb3f 100644
+--- a/fs/hfs/brec.c
++++ b/fs/hfs/brec.c
+@@ -74,9 +74,10 @@ int hfs_brec_insert(struct hfs_find_data *fd, void *entry, int entry_len)
+ 	if (!fd->bnode) {
+ 		if (!tree->root)
+ 			hfs_btree_inc_height(tree);
+-		fd->bnode = hfs_bnode_find(tree, tree->leaf_head);
+-		if (IS_ERR(fd->bnode))
+-			return PTR_ERR(fd->bnode);
++		node = hfs_bnode_find(tree, tree->leaf_head);
++		if (IS_ERR(node))
++			return PTR_ERR(node);
++		fd->bnode = node;
+ 		fd->record = -1;
+ 	}
+ 	new_node = NULL;
+diff --git a/fs/hfsplus/dir.c b/fs/hfsplus/dir.c
+index d0f39dcbb58e..2b6e2ad57bf9 100644
+--- a/fs/hfsplus/dir.c
++++ b/fs/hfsplus/dir.c
+@@ -77,13 +77,13 @@ again:
+ 				cpu_to_be32(HFSP_HARDLINK_TYPE) &&
+ 				entry.file.user_info.fdCreator ==
+ 				cpu_to_be32(HFSP_HFSPLUS_CREATOR) &&
++				HFSPLUS_SB(sb)->hidden_dir &&
+ 				(entry.file.create_date ==
+ 					HFSPLUS_I(HFSPLUS_SB(sb)->hidden_dir)->
+ 						create_date ||
+ 				entry.file.create_date ==
+ 					HFSPLUS_I(d_inode(sb->s_root))->
+-						create_date) &&
+-				HFSPLUS_SB(sb)->hidden_dir) {
++						create_date)) {
+ 			struct qstr str;
+ 			char name[32];
+ 
+diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
+index fa40e756c501..422e00dc5f3b 100644
+--- a/fs/hfsplus/super.c
++++ b/fs/hfsplus/super.c
+@@ -521,8 +521,10 @@ static int hfsplus_fill_super(struct super_block *sb, void *data, int silent)
+ 		goto out_put_root;
+ 	if (!hfs_brec_read(&fd, &entry, sizeof(entry))) {
+ 		hfs_find_exit(&fd);
+-		if (entry.type != cpu_to_be16(HFSPLUS_FOLDER))
++		if (entry.type != cpu_to_be16(HFSPLUS_FOLDER)) {
++			err = -EINVAL;
+ 			goto out_put_root;
++		}
+ 		inode = hfsplus_iget(sb, be32_to_cpu(entry.folder.id));
+ 		if (IS_ERR(inode)) {
+ 			err = PTR_ERR(inode);
+diff --git a/fs/overlayfs/copy_up.c b/fs/overlayfs/copy_up.c
+index 63a0d0ba36de..64c5386d0c1b 100644
+--- a/fs/overlayfs/copy_up.c
++++ b/fs/overlayfs/copy_up.c
+@@ -317,7 +317,6 @@ int ovl_copy_up_one(struct dentry *parent, struct dentry *dentry,
+ 	struct dentry *upperdir;
+ 	struct dentry *upperdentry;
+ 	const struct cred *old_cred;
+-	struct cred *override_cred;
+ 	char *link = NULL;
+ 
+ 	if (WARN_ON(!workdir))
+@@ -336,28 +335,7 @@ int ovl_copy_up_one(struct dentry *parent, struct dentry *dentry,
+ 			return PTR_ERR(link);
+ 	}
+ 
+-	err = -ENOMEM;
+-	override_cred = prepare_creds();
+-	if (!override_cred)
+-		goto out_free_link;
+-
+-	override_cred->fsuid = stat->uid;
+-	override_cred->fsgid = stat->gid;
+-	/*
+-	 * CAP_SYS_ADMIN for copying up extended attributes
+-	 * CAP_DAC_OVERRIDE for create
+-	 * CAP_FOWNER for chmod, timestamp update
+-	 * CAP_FSETID for chmod
+-	 * CAP_CHOWN for chown
+-	 * CAP_MKNOD for mknod
+-	 */
+-	cap_raise(override_cred->cap_effective, CAP_SYS_ADMIN);
+-	cap_raise(override_cred->cap_effective, CAP_DAC_OVERRIDE);
+-	cap_raise(override_cred->cap_effective, CAP_FOWNER);
+-	cap_raise(override_cred->cap_effective, CAP_FSETID);
+-	cap_raise(override_cred->cap_effective, CAP_CHOWN);
+-	cap_raise(override_cred->cap_effective, CAP_MKNOD);
+-	old_cred = override_creds(override_cred);
++	old_cred = ovl_override_creds(dentry->d_sb);
+ 
+ 	err = -EIO;
+ 	if (lock_rename(workdir, upperdir) != NULL) {
+@@ -380,9 +358,7 @@ int ovl_copy_up_one(struct dentry *parent, struct dentry *dentry,
+ out_unlock:
+ 	unlock_rename(workdir, upperdir);
+ 	revert_creds(old_cred);
+-	put_cred(override_cred);
+ 
+-out_free_link:
+ 	if (link)
+ 		free_page((unsigned long) link);
+ 
+diff --git a/fs/overlayfs/dir.c b/fs/overlayfs/dir.c
+index 327177df03a5..f8aa54272121 100644
+--- a/fs/overlayfs/dir.c
++++ b/fs/overlayfs/dir.c
+@@ -408,28 +408,13 @@ static int ovl_create_or_link(struct dentry *dentry, int mode, dev_t rdev,
+ 		err = ovl_create_upper(dentry, inode, &stat, link, hardlink);
+ 	} else {
+ 		const struct cred *old_cred;
+-		struct cred *override_cred;
+ 
+-		err = -ENOMEM;
+-		override_cred = prepare_creds();
+-		if (!override_cred)
+-			goto out_iput;
+-
+-		/*
+-		 * CAP_SYS_ADMIN for setting opaque xattr
+-		 * CAP_DAC_OVERRIDE for create in workdir, rename
+-		 * CAP_FOWNER for removing whiteout from sticky dir
+-		 */
+-		cap_raise(override_cred->cap_effective, CAP_SYS_ADMIN);
+-		cap_raise(override_cred->cap_effective, CAP_DAC_OVERRIDE);
+-		cap_raise(override_cred->cap_effective, CAP_FOWNER);
+-		old_cred = override_creds(override_cred);
++		old_cred = ovl_override_creds(dentry->d_sb);
+ 
+ 		err = ovl_create_over_whiteout(dentry, inode, &stat, link,
+ 					       hardlink);
+ 
+ 		revert_creds(old_cred);
+-		put_cred(override_cred);
+ 	}
+ 
+ 	if (!err)
+@@ -659,32 +644,11 @@ static int ovl_do_remove(struct dentry *dentry, bool is_dir)
+ 	if (OVL_TYPE_PURE_UPPER(type)) {
+ 		err = ovl_remove_upper(dentry, is_dir);
+ 	} else {
+-		const struct cred *old_cred;
+-		struct cred *override_cred;
+-
+-		err = -ENOMEM;
+-		override_cred = prepare_creds();
+-		if (!override_cred)
+-			goto out_drop_write;
+-
+-		/*
+-		 * CAP_SYS_ADMIN for setting xattr on whiteout, opaque dir
+-		 * CAP_DAC_OVERRIDE for create in workdir, rename
+-		 * CAP_FOWNER for removing whiteout from sticky dir
+-		 * CAP_FSETID for chmod of opaque dir
+-		 * CAP_CHOWN for chown of opaque dir
+-		 */
+-		cap_raise(override_cred->cap_effective, CAP_SYS_ADMIN);
+-		cap_raise(override_cred->cap_effective, CAP_DAC_OVERRIDE);
+-		cap_raise(override_cred->cap_effective, CAP_FOWNER);
+-		cap_raise(override_cred->cap_effective, CAP_FSETID);
+-		cap_raise(override_cred->cap_effective, CAP_CHOWN);
+-		old_cred = override_creds(override_cred);
++		const struct cred *old_cred = ovl_override_creds(dentry->d_sb);
+ 
+ 		err = ovl_remove_and_whiteout(dentry, is_dir);
+ 
+ 		revert_creds(old_cred);
+-		put_cred(override_cred);
+ 	}
+ out_drop_write:
+ 	ovl_drop_write(dentry);
+@@ -723,7 +687,6 @@ static int ovl_rename2(struct inode *olddir, struct dentry *old,
+ 	bool new_is_dir = false;
+ 	struct dentry *opaquedir = NULL;
+ 	const struct cred *old_cred = NULL;
+-	struct cred *override_cred = NULL;
+ 
+ 	err = -EINVAL;
+ 	if (flags & ~(RENAME_EXCHANGE | RENAME_NOREPLACE))
+@@ -792,26 +755,8 @@ static int ovl_rename2(struct inode *olddir, struct dentry *old,
+ 	old_opaque = !OVL_TYPE_PURE_UPPER(old_type);
+ 	new_opaque = !OVL_TYPE_PURE_UPPER(new_type);
+ 
+-	if (old_opaque || new_opaque) {
+-		err = -ENOMEM;
+-		override_cred = prepare_creds();
+-		if (!override_cred)
+-			goto out_drop_write;
+-
+-		/*
+-		 * CAP_SYS_ADMIN for setting xattr on whiteout, opaque dir
+-		 * CAP_DAC_OVERRIDE for create in workdir
+-		 * CAP_FOWNER for removing whiteout from sticky dir
+-		 * CAP_FSETID for chmod of opaque dir
+-		 * CAP_CHOWN for chown of opaque dir
+-		 */
+-		cap_raise(override_cred->cap_effective, CAP_SYS_ADMIN);
+-		cap_raise(override_cred->cap_effective, CAP_DAC_OVERRIDE);
+-		cap_raise(override_cred->cap_effective, CAP_FOWNER);
+-		cap_raise(override_cred->cap_effective, CAP_FSETID);
+-		cap_raise(override_cred->cap_effective, CAP_CHOWN);
+-		old_cred = override_creds(override_cred);
+-	}
++	if (old_opaque || new_opaque)
++		old_cred = ovl_override_creds(old->d_sb);
+ 
+ 	if (overwrite && OVL_TYPE_MERGE_OR_LOWER(new_type) && new_is_dir) {
+ 		opaquedir = ovl_check_empty_and_clear(new);
+@@ -942,10 +887,8 @@ out_dput_old:
+ out_unlock:
+ 	unlock_rename(new_upperdir, old_upperdir);
+ out_revert_creds:
+-	if (old_opaque || new_opaque) {
++	if (old_opaque || new_opaque)
+ 		revert_creds(old_cred);
+-		put_cred(override_cred);
+-	}
+ out_drop_write:
+ 	ovl_drop_write(old);
+ out:
+diff --git a/fs/overlayfs/overlayfs.h b/fs/overlayfs/overlayfs.h
+index 28316b292b8a..27a42975d7cd 100644
+--- a/fs/overlayfs/overlayfs.h
++++ b/fs/overlayfs/overlayfs.h
+@@ -150,6 +150,7 @@ void ovl_drop_write(struct dentry *dentry);
+ bool ovl_dentry_is_opaque(struct dentry *dentry);
+ void ovl_dentry_set_opaque(struct dentry *dentry, bool opaque);
+ bool ovl_is_whiteout(struct dentry *dentry);
++const struct cred *ovl_override_creds(struct super_block *sb);
+ void ovl_dentry_update(struct dentry *dentry, struct dentry *upperdentry);
+ struct dentry *ovl_lookup(struct inode *dir, struct dentry *dentry,
+ 			  unsigned int flags);
+@@ -164,6 +165,8 @@ int ovl_check_empty_dir(struct dentry *dentry, struct list_head *list);
+ void ovl_cleanup_whiteouts(struct dentry *upper, struct list_head *list);
+ void ovl_cache_free(struct list_head *list);
+ int ovl_check_d_type_supported(struct path *realpath);
++void ovl_workdir_cleanup(struct inode *dir, struct vfsmount *mnt,
++			 struct dentry *dentry, int level);
+ 
+ /* inode.c */
+ int ovl_setattr(struct dentry *dentry, struct iattr *attr);
+diff --git a/fs/overlayfs/readdir.c b/fs/overlayfs/readdir.c
+index 0c59955c4653..da999e73c97a 100644
+--- a/fs/overlayfs/readdir.c
++++ b/fs/overlayfs/readdir.c
+@@ -36,7 +36,8 @@ struct ovl_dir_cache {
+ 
+ struct ovl_readdir_data {
+ 	struct dir_context ctx;
+-	bool is_merge;
++	struct dentry *dentry;
++	bool is_lowest;
+ 	struct rb_root root;
+ 	struct list_head *list;
+ 	struct list_head middle;
+@@ -140,9 +141,9 @@ static int ovl_cache_entry_add_rb(struct ovl_readdir_data *rdd,
+ 	return 0;
+ }
+ 
+-static int ovl_fill_lower(struct ovl_readdir_data *rdd,
+-			  const char *name, int namelen,
+-			  loff_t offset, u64 ino, unsigned int d_type)
++static int ovl_fill_lowest(struct ovl_readdir_data *rdd,
++			   const char *name, int namelen,
++			   loff_t offset, u64 ino, unsigned int d_type)
+ {
+ 	struct ovl_cache_entry *p;
+ 
+@@ -194,10 +195,10 @@ static int ovl_fill_merge(struct dir_context *ctx, const char *name,
+ 		container_of(ctx, struct ovl_readdir_data, ctx);
+ 
+ 	rdd->count++;
+-	if (!rdd->is_merge)
++	if (!rdd->is_lowest)
+ 		return ovl_cache_entry_add_rb(rdd, name, namelen, ino, d_type);
+ 	else
+-		return ovl_fill_lower(rdd, name, namelen, offset, ino, d_type);
++		return ovl_fill_lowest(rdd, name, namelen, offset, ino, d_type);
+ }
+ 
+ static int ovl_check_whiteouts(struct dentry *dir, struct ovl_readdir_data *rdd)
+@@ -206,17 +207,8 @@ static int ovl_check_whiteouts(struct dentry *dir, struct ovl_readdir_data *rdd)
+ 	struct ovl_cache_entry *p;
+ 	struct dentry *dentry;
+ 	const struct cred *old_cred;
+-	struct cred *override_cred;
+-
+-	override_cred = prepare_creds();
+-	if (!override_cred)
+-		return -ENOMEM;
+ 
+-	/*
+-	 * CAP_DAC_OVERRIDE for lookup
+-	 */
+-	cap_raise(override_cred->cap_effective, CAP_DAC_OVERRIDE);
+-	old_cred = override_creds(override_cred);
++	old_cred = ovl_override_creds(rdd->dentry->d_sb);
+ 
+ 	err = mutex_lock_killable(&dir->d_inode->i_mutex);
+ 	if (!err) {
+@@ -232,7 +224,6 @@ static int ovl_check_whiteouts(struct dentry *dir, struct ovl_readdir_data *rdd)
+ 		mutex_unlock(&dir->d_inode->i_mutex);
+ 	}
+ 	revert_creds(old_cred);
+-	put_cred(override_cred);
+ 
+ 	return err;
+ }
+@@ -257,7 +248,7 @@ static inline int ovl_dir_read(struct path *realpath,
+ 			err = rdd->err;
+ 	} while (!err && rdd->count);
+ 
+-	if (!err && rdd->first_maybe_whiteout)
++	if (!err && rdd->first_maybe_whiteout && rdd->dentry)
+ 		err = ovl_check_whiteouts(realpath->dentry, rdd);
+ 
+ 	fput(realfile);
+@@ -288,9 +279,10 @@ static int ovl_dir_read_merged(struct dentry *dentry, struct list_head *list)
+ 	struct path realpath;
+ 	struct ovl_readdir_data rdd = {
+ 		.ctx.actor = ovl_fill_merge,
++		.dentry = dentry,
+ 		.list = list,
+ 		.root = RB_ROOT,
+-		.is_merge = false,
++		.is_lowest = false,
+ 	};
+ 	int idx, next;
+ 
+@@ -307,7 +299,7 @@ static int ovl_dir_read_merged(struct dentry *dentry, struct list_head *list)
+ 			 * allows offsets to be reasonably constant
+ 			 */
+ 			list_add(&rdd.middle, rdd.list);
+-			rdd.is_merge = true;
++			rdd.is_lowest = true;
+ 			err = ovl_dir_read(&realpath, &rdd);
+ 			list_del(&rdd.middle);
+ 		}
+@@ -618,3 +610,64 @@ int ovl_check_d_type_supported(struct path *realpath)
+ 
+ 	return rdd.d_type_supported;
+ }
++
++static void ovl_workdir_cleanup_recurse(struct path *path, int level)
++{
++	int err;
++	struct inode *dir = path->dentry->d_inode;
++	LIST_HEAD(list);
++	struct ovl_cache_entry *p;
++	struct ovl_readdir_data rdd = {
++		.ctx.actor = ovl_fill_merge,
++		.dentry = NULL,
++		.list = &list,
++		.root = RB_ROOT,
++		.is_lowest = false,
++	};
++
++	err = ovl_dir_read(path, &rdd);
++	if (err)
++		goto out;
++
++	inode_lock_nested(dir, I_MUTEX_PARENT);
++	list_for_each_entry(p, &list, l_node) {
++		struct dentry *dentry;
++
++		if (p->name[0] == '.') {
++			if (p->len == 1)
++				continue;
++			if (p->len == 2 && p->name[1] == '.')
++				continue;
++		}
++		dentry = lookup_one_len(p->name, path->dentry, p->len);
++		if (IS_ERR(dentry))
++			continue;
++		if (dentry->d_inode)
++			ovl_workdir_cleanup(dir, path->mnt, dentry, level);
++		dput(dentry);
++	}
++	inode_unlock(dir);
++out:
++	ovl_cache_free(&list);
++}
++
++void ovl_workdir_cleanup(struct inode *dir, struct vfsmount *mnt,
++			 struct dentry *dentry, int level)
++{
++	int err;
++
++	if (!d_is_dir(dentry) || level > 1) {
++		ovl_cleanup(dir, dentry);
++		return;
++	}
++
++	err = ovl_do_rmdir(dir, dentry);
++	if (err) {
++		struct path path = { .mnt = mnt, .dentry = dentry };
++
++		inode_unlock(dir);
++		ovl_workdir_cleanup_recurse(&path, level + 1);
++		inode_lock_nested(dir, I_MUTEX_PARENT);
++		ovl_cleanup(dir, dentry);
++	}
++}
+diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
+index 0035cb80ecd1..fa20c95bd456 100644
+--- a/fs/overlayfs/super.c
++++ b/fs/overlayfs/super.c
+@@ -42,6 +42,8 @@ struct ovl_fs {
+ 	long lower_namelen;
+ 	/* pathnames of lower and upper dirs, for show_options */
+ 	struct ovl_config config;
++	/* creds of process who forced instantiation of super block */
++	const struct cred *creator_cred;
+ };
+ 
+ struct ovl_dir_cache;
+@@ -246,6 +248,13 @@ bool ovl_is_whiteout(struct dentry *dentry)
+ 	return inode && IS_WHITEOUT(inode);
+ }
+ 
++const struct cred *ovl_override_creds(struct super_block *sb)
++{
++	struct ovl_fs *ofs = sb->s_fs_info;
++
++	return override_creds(ofs->creator_cred);
++}
++
+ static bool ovl_is_opaquedir(struct dentry *dentry)
+ {
+ 	int res;
+@@ -587,6 +596,7 @@ static void ovl_put_super(struct super_block *sb)
+ 	kfree(ufs->config.lowerdir);
+ 	kfree(ufs->config.upperdir);
+ 	kfree(ufs->config.workdir);
++	put_cred(ufs->creator_cred);
+ 	kfree(ufs);
+ }
+ 
+@@ -774,7 +784,7 @@ retry:
+ 				goto out_dput;
+ 
+ 			retried = true;
+-			ovl_cleanup(dir, work);
++			ovl_workdir_cleanup(dir, mnt, work, 0);
+ 			dput(work);
+ 			goto retry;
+ 		}
+@@ -1107,10 +1117,14 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
+ 	else
+ 		sb->s_d_op = &ovl_dentry_operations;
+ 
++	ufs->creator_cred = prepare_creds();
++	if (!ufs->creator_cred)
++		goto out_put_lower_mnt;
++
+ 	err = -ENOMEM;
+ 	oe = ovl_alloc_entry(numlower);
+ 	if (!oe)
+-		goto out_put_lower_mnt;
++		goto out_put_cred;
+ 
+ 	root_dentry = d_make_root(ovl_new_inode(sb, S_IFDIR, oe));
+ 	if (!root_dentry)
+@@ -1143,6 +1157,8 @@ static int ovl_fill_super(struct super_block *sb, void *data, int silent)
+ 
+ out_free_oe:
+ 	kfree(oe);
++out_put_cred:
++	put_cred(ufs->creator_cred);
+ out_put_lower_mnt:
+ 	for (i = 0; i < ufs->numlower; i++)
+ 		mntput(ufs->lower_mnt[i]);
+diff --git a/fs/reiserfs/reiserfs.h b/fs/reiserfs/reiserfs.h
+index 6ca00471afbf..d920a646b578 100644
+--- a/fs/reiserfs/reiserfs.h
++++ b/fs/reiserfs/reiserfs.h
+@@ -270,7 +270,7 @@ struct reiserfs_journal_list {
+ 
+ 	struct mutex j_commit_mutex;
+ 	unsigned int j_trans_id;
+-	time_t j_timestamp;
++	time64_t j_timestamp; /* write-only but useful for crash dump analysis */
+ 	struct reiserfs_list_bitmap *j_list_bitmap;
+ 	struct buffer_head *j_commit_bh;	/* commit buffer head */
+ 	struct reiserfs_journal_cnode *j_realblock;
+diff --git a/kernel/fork.c b/kernel/fork.c
+index ac00f14208b7..37ec96fe739d 100644
+--- a/kernel/fork.c
++++ b/kernel/fork.c
+@@ -1109,7 +1109,9 @@ static int copy_sighand(unsigned long clone_flags, struct task_struct *tsk)
+ 		return -ENOMEM;
+ 
+ 	atomic_set(&sig->count, 1);
++	spin_lock_irq(&current->sighand->siglock);
+ 	memcpy(sig->action, current->sighand->action, sizeof(sig->action));
++	spin_unlock_irq(&current->sighand->siglock);
+ 	return 0;
+ }
+ 
+diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
+index e4453d9f788c..3c74e13a95dc 100644
+--- a/kernel/irq/chip.c
++++ b/kernel/irq/chip.c
+@@ -338,7 +338,6 @@ void handle_nested_irq(unsigned int irq)
+ 	raw_spin_lock_irq(&desc->lock);
+ 
+ 	desc->istate &= ~(IRQS_REPLAY | IRQS_WAITING);
+-	kstat_incr_irqs_this_cpu(desc);
+ 
+ 	action = desc->action;
+ 	if (unlikely(!action || irqd_irq_disabled(&desc->irq_data))) {
+@@ -346,6 +345,7 @@ void handle_nested_irq(unsigned int irq)
+ 		goto out_unlock;
+ 	}
+ 
++	kstat_incr_irqs_this_cpu(desc);
+ 	irqd_set(&desc->irq_data, IRQD_IRQ_INPROGRESS);
+ 	raw_spin_unlock_irq(&desc->lock);
+ 
+@@ -412,13 +412,13 @@ void handle_simple_irq(struct irq_desc *desc)
+ 		goto out_unlock;
+ 
+ 	desc->istate &= ~(IRQS_REPLAY | IRQS_WAITING);
+-	kstat_incr_irqs_this_cpu(desc);
+ 
+ 	if (unlikely(!desc->action || irqd_irq_disabled(&desc->irq_data))) {
+ 		desc->istate |= IRQS_PENDING;
+ 		goto out_unlock;
+ 	}
+ 
++	kstat_incr_irqs_this_cpu(desc);
+ 	handle_irq_event(desc);
+ 
+ out_unlock:
+@@ -462,7 +462,6 @@ void handle_level_irq(struct irq_desc *desc)
+ 		goto out_unlock;
+ 
+ 	desc->istate &= ~(IRQS_REPLAY | IRQS_WAITING);
+-	kstat_incr_irqs_this_cpu(desc);
+ 
+ 	/*
+ 	 * If its disabled or no action available
+@@ -473,6 +472,7 @@ void handle_level_irq(struct irq_desc *desc)
+ 		goto out_unlock;
+ 	}
+ 
++	kstat_incr_irqs_this_cpu(desc);
+ 	handle_irq_event(desc);
+ 
+ 	cond_unmask_irq(desc);
+@@ -532,7 +532,6 @@ void handle_fasteoi_irq(struct irq_desc *desc)
+ 		goto out;
+ 
+ 	desc->istate &= ~(IRQS_REPLAY | IRQS_WAITING);
+-	kstat_incr_irqs_this_cpu(desc);
+ 
+ 	/*
+ 	 * If its disabled or no action available
+@@ -544,6 +543,7 @@ void handle_fasteoi_irq(struct irq_desc *desc)
+ 		goto out;
+ 	}
+ 
++	kstat_incr_irqs_this_cpu(desc);
+ 	if (desc->istate & IRQS_ONESHOT)
+ 		mask_irq(desc);
+ 
+diff --git a/lib/debugobjects.c b/lib/debugobjects.c
+index 547f7f923dbc..a26328ec39f1 100644
+--- a/lib/debugobjects.c
++++ b/lib/debugobjects.c
+@@ -295,9 +295,12 @@ static void debug_object_is_on_stack(void *addr, int onstack)
+ 
+ 	limit++;
+ 	if (is_on_stack)
+-		pr_warn("object is on stack, but not annotated\n");
++		pr_warn("object %p is on stack %p, but NOT annotated.\n", addr,
++			 task_stack_page(current));
+ 	else
+-		pr_warn("object is not on stack, but annotated\n");
++		pr_warn("object %p is NOT on stack %p, but annotated.\n", addr,
++			 task_stack_page(current));
++
+ 	WARN_ON(1);
+ }
+ 
+diff --git a/mm/fadvise.c b/mm/fadvise.c
+index b8a5bc66b0c0..001877e32f0c 100644
+--- a/mm/fadvise.c
++++ b/mm/fadvise.c
+@@ -68,8 +68,12 @@ SYSCALL_DEFINE4(fadvise64_64, int, fd, loff_t, offset, loff_t, len, int, advice)
+ 		goto out;
+ 	}
+ 
+-	/* Careful about overflows. Len == 0 means "as much as possible" */
+-	endbyte = offset + len;
++	/*
++	 * Careful about overflows. Len == 0 means "as much as possible".  Use
++	 * unsigned math because signed overflows are undefined and UBSan
++	 * complains.
++	 */
++	endbyte = (u64)offset + (u64)len;
+ 	if (!len || endbyte < len)
+ 		endbyte = -1;
+ 	else
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index 0127b788272f..c4ea57ee2fd1 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -1393,12 +1393,12 @@ int do_huge_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma,
+ 
+ 	/* Migration could have started since the pmd_trans_migrating check */
+ 	if (!page_locked) {
++		page_nid = -1;
+ 		if (!get_page_unless_zero(page))
+ 			goto out_unlock;
+ 		spin_unlock(ptl);
+ 		wait_on_page_locked(page);
+ 		put_page(page);
+-		page_nid = -1;
+ 		goto out;
+ 	}
+ 
+diff --git a/net/9p/trans_virtio.c b/net/9p/trans_virtio.c
+index 6018a1c0dc28..2a15b6aa9cdd 100644
+--- a/net/9p/trans_virtio.c
++++ b/net/9p/trans_virtio.c
+@@ -574,7 +574,7 @@ static int p9_virtio_probe(struct virtio_device *vdev)
+ 	chan->vq = virtio_find_single_vq(vdev, req_done, "requests");
+ 	if (IS_ERR(chan->vq)) {
+ 		err = PTR_ERR(chan->vq);
+-		goto out_free_vq;
++		goto out_free_chan;
+ 	}
+ 	chan->vq->vdev->priv = chan;
+ 	spin_lock_init(&chan->lock);
+@@ -627,6 +627,7 @@ out_free_tag:
+ 	kfree(tag);
+ out_free_vq:
+ 	vdev->config->del_vqs(vdev);
++out_free_chan:
+ 	kfree(chan);
+ fail:
+ 	return err;
+diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
+index 4c1c94fa8f08..d270870bf492 100644
+--- a/net/ipv4/tcp_minisocks.c
++++ b/net/ipv4/tcp_minisocks.c
+@@ -200,8 +200,9 @@ kill:
+ 				inet_twsk_deschedule_put(tw);
+ 				return TCP_TW_SUCCESS;
+ 			}
++		} else {
++			inet_twsk_reschedule(tw, TCP_TIMEWAIT_LEN);
+ 		}
+-		inet_twsk_reschedule(tw, TCP_TIMEWAIT_LEN);
+ 
+ 		if (tmp_opt.saw_tstamp) {
+ 			tcptw->tw_ts_recent	  = tmp_opt.rcv_tsval;
+diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
+index 6aca9a6b2303..60d4052d97a6 100644
+--- a/net/ipv6/ip6_vti.c
++++ b/net/ipv6/ip6_vti.c
+@@ -470,7 +470,7 @@ vti6_xmit(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
+ 	}
+ 
+ 	mtu = dst_mtu(dst);
+-	if (!skb->ignore_df && skb->len > mtu) {
++	if (skb->len > mtu) {
+ 		skb_dst(skb)->ops->update_pmtu(dst, NULL, skb, mtu);
+ 
+ 		if (skb->protocol == htons(ETH_P_IPV6)) {
+diff --git a/net/irda/af_irda.c b/net/irda/af_irda.c
+index 4a116d766c15..7cc9db38e1b6 100644
+--- a/net/irda/af_irda.c
++++ b/net/irda/af_irda.c
+@@ -774,6 +774,13 @@ static int irda_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len)
+ 		return -EINVAL;
+ 
+ 	lock_sock(sk);
++
++	/* Ensure that the socket is not already bound */
++	if (self->ias_obj) {
++		err = -EINVAL;
++		goto out;
++	}
++
+ #ifdef CONFIG_IRDA_ULTRA
+ 	/* Special care for Ultra sockets */
+ 	if ((sk->sk_type == SOCK_DGRAM) &&
+@@ -2020,7 +2027,11 @@ static int irda_setsockopt(struct socket *sock, int level, int optname,
+ 			err = -EINVAL;
+ 			goto out;
+ 		}
+-		irias_insert_object(ias_obj);
++
++		/* Only insert newly allocated objects */
++		if (free_ias)
++			irias_insert_object(ias_obj);
++
+ 		kfree(ias_opt);
+ 		break;
+ 	case IRLMP_IAS_DEL:
+diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
+index dd1649caa2b2..ac212542a217 100644
+--- a/net/netfilter/ipvs/ip_vs_core.c
++++ b/net/netfilter/ipvs/ip_vs_core.c
+@@ -1809,13 +1809,20 @@ ip_vs_in(struct netns_ipvs *ipvs, unsigned int hooknum, struct sk_buff *skb, int
+ 	if (cp->dest && !(cp->dest->flags & IP_VS_DEST_F_AVAILABLE)) {
+ 		/* the destination server is not available */
+ 
+-		if (sysctl_expire_nodest_conn(ipvs)) {
++		__u32 flags = cp->flags;
++
++		/* when timer already started, silently drop the packet.*/
++		if (timer_pending(&cp->timer))
++			__ip_vs_conn_put(cp);
++		else
++			ip_vs_conn_put(cp);
++
++		if (sysctl_expire_nodest_conn(ipvs) &&
++		    !(flags & IP_VS_CONN_F_ONE_PACKET)) {
+ 			/* try to expire the connection immediately */
+ 			ip_vs_conn_expire_now(cp);
+ 		}
+-		/* don't restart its timer, and silently
+-		   drop the packet. */
+-		__ip_vs_conn_put(cp);
++
+ 		return NF_DROP;
+ 	}
+ 
+diff --git a/net/sched/sch_hhf.c b/net/sched/sch_hhf.c
+index 45d4b2f22f62..aff2a1b46f7f 100644
+--- a/net/sched/sch_hhf.c
++++ b/net/sched/sch_hhf.c
+@@ -501,6 +501,9 @@ static void hhf_destroy(struct Qdisc *sch)
+ 		hhf_free(q->hhf_valid_bits[i]);
+ 	}
+ 
++	if (!q->hh_flows)
++		return;
++
+ 	for (i = 0; i < HH_FLOWS_CNT; i++) {
+ 		struct hh_flow_state *flow, *next;
+ 		struct list_head *head = &q->hh_flows[i];
+diff --git a/net/sched/sch_htb.c b/net/sched/sch_htb.c
+index 87b02ed3d5f2..daa01d5604c2 100644
+--- a/net/sched/sch_htb.c
++++ b/net/sched/sch_htb.c
+@@ -1025,6 +1025,9 @@ static int htb_init(struct Qdisc *sch, struct nlattr *opt)
+ 	int err;
+ 	int i;
+ 
++	qdisc_watchdog_init(&q->watchdog, sch);
++	INIT_WORK(&q->work, htb_work_func);
++
+ 	if (!opt)
+ 		return -EINVAL;
+ 
+@@ -1045,8 +1048,6 @@ static int htb_init(struct Qdisc *sch, struct nlattr *opt)
+ 	for (i = 0; i < TC_HTB_NUMPRIO; i++)
+ 		INIT_LIST_HEAD(q->drops + i);
+ 
+-	qdisc_watchdog_init(&q->watchdog, sch);
+-	INIT_WORK(&q->work, htb_work_func);
+ 	__skb_queue_head_init(&q->direct_queue);
+ 
+ 	if (tb[TCA_HTB_DIRECT_QLEN])
+diff --git a/net/sched/sch_multiq.c b/net/sched/sch_multiq.c
+index bcdd54bb101c..cef36ad691dd 100644
+--- a/net/sched/sch_multiq.c
++++ b/net/sched/sch_multiq.c
+@@ -254,7 +254,7 @@ static int multiq_tune(struct Qdisc *sch, struct nlattr *opt)
+ static int multiq_init(struct Qdisc *sch, struct nlattr *opt)
+ {
+ 	struct multiq_sched_data *q = qdisc_priv(sch);
+-	int i, err;
++	int i;
+ 
+ 	q->queues = NULL;
+ 
+@@ -269,12 +269,7 @@ static int multiq_init(struct Qdisc *sch, struct nlattr *opt)
+ 	for (i = 0; i < q->max_bands; i++)
+ 		q->queues[i] = &noop_qdisc;
+ 
+-	err = multiq_tune(sch, opt);
+-
+-	if (err)
+-		kfree(q->queues);
+-
+-	return err;
++	return multiq_tune(sch, opt);
+ }
+ 
+ static int multiq_dump(struct Qdisc *sch, struct sk_buff *skb)
+diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
+index b7c29d5b6f04..743ff23885da 100644
+--- a/net/sched/sch_netem.c
++++ b/net/sched/sch_netem.c
+@@ -943,11 +943,11 @@ static int netem_init(struct Qdisc *sch, struct nlattr *opt)
+ 	struct netem_sched_data *q = qdisc_priv(sch);
+ 	int ret;
+ 
++	qdisc_watchdog_init(&q->watchdog, sch);
++
+ 	if (!opt)
+ 		return -EINVAL;
+ 
+-	qdisc_watchdog_init(&q->watchdog, sch);
+-
+ 	q->loss_model = CLG_RANDOM;
+ 	ret = netem_change(sch, opt);
+ 	if (ret)
+diff --git a/net/sched/sch_tbf.c b/net/sched/sch_tbf.c
+index c2fbde742f37..a06c9d6bfc9c 100644
+--- a/net/sched/sch_tbf.c
++++ b/net/sched/sch_tbf.c
+@@ -432,12 +432,13 @@ static int tbf_init(struct Qdisc *sch, struct nlattr *opt)
+ {
+ 	struct tbf_sched_data *q = qdisc_priv(sch);
+ 
++	qdisc_watchdog_init(&q->watchdog, sch);
++	q->qdisc = &noop_qdisc;
++
+ 	if (opt == NULL)
+ 		return -EINVAL;
+ 
+ 	q->t_c = ktime_get_ns();
+-	qdisc_watchdog_init(&q->watchdog, sch);
+-	q->qdisc = &noop_qdisc;
+ 
+ 	return tbf_change(sch, opt);
+ }
+diff --git a/scripts/depmod.sh b/scripts/depmod.sh
+index ea1e96921e3b..baedaef53ca0 100755
+--- a/scripts/depmod.sh
++++ b/scripts/depmod.sh
+@@ -15,9 +15,9 @@ if ! test -r System.map ; then
+ fi
+ 
+ if [ -z $(command -v $DEPMOD) ]; then
+-	echo "'make modules_install' requires $DEPMOD. Please install it." >&2
++	echo "Warning: 'make modules_install' requires $DEPMOD. Please install it." >&2
+ 	echo "This is probably in the kmod package." >&2
+-	exit 1
++	exit 0
+ fi
+ 
+ # older versions of depmod don't support -P <symbol-prefix>
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index bd5151915e5a..064fbfbbb22c 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -649,7 +649,7 @@ static void handle_modversions(struct module *mod, struct elf_info *info,
+ 			if (ELF_ST_TYPE(sym->st_info) == STT_SPARC_REGISTER)
+ 				break;
+ 			if (symname[0] == '.') {
+-				char *munged = strdup(symname);
++				char *munged = NOFAIL(strdup(symname));
+ 				munged[0] = '_';
+ 				munged[1] = toupper(munged[1]);
+ 				symname = munged;
+@@ -1311,7 +1311,7 @@ static Elf_Sym *find_elf_symbol2(struct elf_info *elf, Elf_Addr addr,
+ static char *sec2annotation(const char *s)
+ {
+ 	if (match(s, init_exit_sections)) {
+-		char *p = malloc(20);
++		char *p = NOFAIL(malloc(20));
+ 		char *r = p;
+ 
+ 		*p++ = '_';
+@@ -1331,7 +1331,7 @@ static char *sec2annotation(const char *s)
+ 			strcat(p, " ");
+ 		return r;
+ 	} else {
+-		return strdup("");
++		return NOFAIL(strdup(""));
+ 	}
+ }
+ 
+@@ -2032,7 +2032,7 @@ void buf_write(struct buffer *buf, const char *s, int len)
+ {
+ 	if (buf->size - buf->pos < len) {
+ 		buf->size += len + SZ;
+-		buf->p = realloc(buf->p, buf->size);
++		buf->p = NOFAIL(realloc(buf->p, buf->size));
+ 	}
+ 	strncpy(buf->p + buf->pos, s, len);
+ 	buf->pos += len;
+diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
+index a18aecb49935..2b770d3f05d4 100644
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -2431,6 +2431,7 @@ static int wm8994_set_dai_sysclk(struct snd_soc_dai *dai,
+ 			snd_soc_update_bits(codec, WM8994_POWER_MANAGEMENT_2,
+ 					    WM8994_OPCLK_ENA, 0);
+ 		}
++		break;
+ 
+ 	default:
+ 		return -EINVAL;
+diff --git a/tools/testing/selftests/powerpc/harness.c b/tools/testing/selftests/powerpc/harness.c
+index f45cee80c58b..af2b1e66e35e 100644
+--- a/tools/testing/selftests/powerpc/harness.c
++++ b/tools/testing/selftests/powerpc/harness.c
+@@ -85,13 +85,13 @@ wait:
+ 	return status;
+ }
+ 
+-static void alarm_handler(int signum)
++static void sig_handler(int signum)
+ {
+-	/* Jut wake us up from waitpid */
++	/* Just wake us up from waitpid */
+ }
+ 
+-static struct sigaction alarm_action = {
+-	.sa_handler = alarm_handler,
++static struct sigaction sig_action = {
++	.sa_handler = sig_handler,
+ };
+ 
+ int test_harness(int (test_function)(void), char *name)
+@@ -101,8 +101,14 @@ int test_harness(int (test_function)(void), char *name)
+ 	test_start(name);
+ 	test_set_git_version(GIT_VERSION);
+ 
+-	if (sigaction(SIGALRM, &alarm_action, NULL)) {
+-		perror("sigaction");
++	if (sigaction(SIGINT, &sig_action, NULL)) {
++		perror("sigaction (sigint)");
++		test_error(name);
++		return 1;
++	}
++
++	if (sigaction(SIGALRM, &sig_action, NULL)) {
++		perror("sigaction (sigalrm)");
+ 		test_error(name);
+ 		return 1;
+ 	}