[gentoo-commits] linux-patches r2802 - genpatches-2.6/trunk/3.14

[Mike Pagano (mpagano)]

Author: mpagano
Date: 2014-06-02 19:45:19 +0000 (Mon, 02 Jun 2014)
New Revision: 2802

Added:
   genpatches-2.6/trunk/3.14/1004_linux-3.14.5.patch
Modified:
   genpatches-2.6/trunk/3.14/0000_README
Log:
Linux patch 3.14.5

Modified: genpatches-2.6/trunk/3.14/0000_README
===================================================================
--- genpatches-2.6/trunk/3.14/0000_README	2014-05-31 20:17:24 UTC (rev 2801)
+++ genpatches-2.6/trunk/3.14/0000_README	2014-06-02 19:45:19 UTC (rev 2802)
@@ -58,6 +58,10 @@
 From:   http://www.kernel.org
 Desc:   Linux 3.14.4
 
+Patch:  1004_linux-3.14.5.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.14.5
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

Added: genpatches-2.6/trunk/3.14/1004_linux-3.14.5.patch
===================================================================
--- genpatches-2.6/trunk/3.14/1004_linux-3.14.5.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.14/1004_linux-3.14.5.patch	2014-06-02 19:45:19 UTC (rev 2802)
@@ -0,0 +1,5450 @@
+diff --git a/Makefile b/Makefile
+index d7c07fd8c944..fa77b0bed2a2 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,8 +1,8 @@
+ VERSION = 3
+ PATCHLEVEL = 14
+-SUBLEVEL = 4
++SUBLEVEL = 5
+ EXTRAVERSION =
+-NAME = Shuffling Zombie Juror
++NAME = Remembering Coco
+ 
+ # *DOCUMENTATION*
+ # To see a list of typical targets execute "make help"
+diff --git a/arch/parisc/include/asm/shmparam.h b/arch/parisc/include/asm/shmparam.h
+index 628ddc22faa8..afe1300ab667 100644
+--- a/arch/parisc/include/asm/shmparam.h
++++ b/arch/parisc/include/asm/shmparam.h
+@@ -1,8 +1,7 @@
+ #ifndef _ASMPARISC_SHMPARAM_H
+ #define _ASMPARISC_SHMPARAM_H
+ 
+-#define __ARCH_FORCE_SHMLBA 	1
+-
+-#define SHMLBA 0x00400000   /* attach addr needs to be 4 Mb aligned */
++#define SHMLBA	   PAGE_SIZE	/* attach addr a multiple of this */
++#define SHM_COLOUR 0x00400000	/* shared mappings colouring */
+ 
+ #endif /* _ASMPARISC_SHMPARAM_H */
+diff --git a/arch/parisc/include/uapi/asm/resource.h b/arch/parisc/include/uapi/asm/resource.h
+index 8b06343b62ed..090483c47dbb 100644
+--- a/arch/parisc/include/uapi/asm/resource.h
++++ b/arch/parisc/include/uapi/asm/resource.h
+@@ -1,7 +1,6 @@
+ #ifndef _ASM_PARISC_RESOURCE_H
+ #define _ASM_PARISC_RESOURCE_H
+ 
+-#define _STK_LIM_MAX	10 * _STK_LIM
+ #include <asm-generic/resource.h>
+ 
+ #endif
+diff --git a/arch/parisc/kernel/cache.c b/arch/parisc/kernel/cache.c
+index a6ffc775a9f8..f6448c7c62b5 100644
+--- a/arch/parisc/kernel/cache.c
++++ b/arch/parisc/kernel/cache.c
+@@ -323,7 +323,8 @@ void flush_dcache_page(struct page *page)
+ 		 * specifically accesses it, of course) */
+ 
+ 		flush_tlb_page(mpnt, addr);
+-		if (old_addr == 0 || (old_addr & (SHMLBA - 1)) != (addr & (SHMLBA - 1))) {
++		if (old_addr == 0 || (old_addr & (SHM_COLOUR - 1))
++				      != (addr & (SHM_COLOUR - 1))) {
+ 			__flush_cache_page(mpnt, addr, page_to_phys(page));
+ 			if (old_addr)
+ 				printk(KERN_ERR "INEQUIVALENT ALIASES 0x%lx and 0x%lx in file %s\n", old_addr, addr, mpnt->vm_file ? (char *)mpnt->vm_file->f_path.dentry->d_name.name : "(null)");
+diff --git a/arch/parisc/kernel/sys_parisc.c b/arch/parisc/kernel/sys_parisc.c
+index b7cadc4a06cd..31ffa9b55322 100644
+--- a/arch/parisc/kernel/sys_parisc.c
++++ b/arch/parisc/kernel/sys_parisc.c
+@@ -45,7 +45,7 @@
+ 
+ static int get_offset(unsigned int last_mmap)
+ {
+-	return (last_mmap & (SHMLBA-1)) >> PAGE_SHIFT;
++	return (last_mmap & (SHM_COLOUR-1)) >> PAGE_SHIFT;
+ }
+ 
+ static unsigned long shared_align_offset(unsigned int last_mmap,
+@@ -57,8 +57,8 @@ static unsigned long shared_align_offset(unsigned int last_mmap,
+ static inline unsigned long COLOR_ALIGN(unsigned long addr,
+ 			 unsigned int last_mmap, unsigned long pgoff)
+ {
+-	unsigned long base = (addr+SHMLBA-1) & ~(SHMLBA-1);
+-	unsigned long off  = (SHMLBA-1) &
++	unsigned long base = (addr+SHM_COLOUR-1) & ~(SHM_COLOUR-1);
++	unsigned long off  = (SHM_COLOUR-1) &
+ 		(shared_align_offset(last_mmap, pgoff) << PAGE_SHIFT);
+ 
+ 	return base + off;
+@@ -101,7 +101,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
+ 	if (flags & MAP_FIXED) {
+ 		if ((flags & MAP_SHARED) && last_mmap &&
+ 		    (addr - shared_align_offset(last_mmap, pgoff))
+-				& (SHMLBA - 1))
++				& (SHM_COLOUR - 1))
+ 			return -EINVAL;
+ 		goto found_addr;
+ 	}
+@@ -122,7 +122,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr,
+ 	info.length = len;
+ 	info.low_limit = mm->mmap_legacy_base;
+ 	info.high_limit = mmap_upper_limit();
+-	info.align_mask = last_mmap ? (PAGE_MASK & (SHMLBA - 1)) : 0;
++	info.align_mask = last_mmap ? (PAGE_MASK & (SHM_COLOUR - 1)) : 0;
+ 	info.align_offset = shared_align_offset(last_mmap, pgoff);
+ 	addr = vm_unmapped_area(&info);
+ 
+@@ -161,7 +161,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+ 	if (flags & MAP_FIXED) {
+ 		if ((flags & MAP_SHARED) && last_mmap &&
+ 		    (addr - shared_align_offset(last_mmap, pgoff))
+-			& (SHMLBA - 1))
++			& (SHM_COLOUR - 1))
+ 			return -EINVAL;
+ 		goto found_addr;
+ 	}
+@@ -182,7 +182,7 @@ arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+ 	info.length = len;
+ 	info.low_limit = PAGE_SIZE;
+ 	info.high_limit = mm->mmap_base;
+-	info.align_mask = last_mmap ? (PAGE_MASK & (SHMLBA - 1)) : 0;
++	info.align_mask = last_mmap ? (PAGE_MASK & (SHM_COLOUR - 1)) : 0;
+ 	info.align_offset = shared_align_offset(last_mmap, pgoff);
+ 	addr = vm_unmapped_area(&info);
+ 	if (!(addr & ~PAGE_MASK))
+diff --git a/arch/parisc/kernel/syscall_table.S b/arch/parisc/kernel/syscall_table.S
+index 80e5dd248934..83ead0ea127d 100644
+--- a/arch/parisc/kernel/syscall_table.S
++++ b/arch/parisc/kernel/syscall_table.S
+@@ -392,7 +392,7 @@
+ 	ENTRY_COMP(vmsplice)
+ 	ENTRY_COMP(move_pages)		/* 295 */
+ 	ENTRY_SAME(getcpu)
+-	ENTRY_SAME(epoll_pwait)
++	ENTRY_COMP(epoll_pwait)
+ 	ENTRY_COMP(statfs64)
+ 	ENTRY_COMP(fstatfs64)
+ 	ENTRY_COMP(kexec_load)		/* 300 */
+diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c
+index a778ee27518a..8e08c6712eb8 100644
+--- a/arch/s390/net/bpf_jit_comp.c
++++ b/arch/s390/net/bpf_jit_comp.c
+@@ -811,7 +811,7 @@ static struct bpf_binary_header *bpf_alloc_binary(unsigned int bpfsize,
+ 		return NULL;
+ 	memset(header, 0, sz);
+ 	header->pages = sz / PAGE_SIZE;
+-	hole = sz - (bpfsize + sizeof(*header));
++	hole = min(sz - (bpfsize + sizeof(*header)), PAGE_SIZE - sizeof(*header));
+ 	/* Insert random number of illegal instructions before BPF code
+ 	 * and make sure the first instruction starts at an even address.
+ 	 */
+diff --git a/arch/x86/include/asm/preempt.h b/arch/x86/include/asm/preempt.h
+index c8b051933b1b..b39e194f6c8d 100644
+--- a/arch/x86/include/asm/preempt.h
++++ b/arch/x86/include/asm/preempt.h
+@@ -5,6 +5,18 @@
+ #include <asm/percpu.h>
+ #include <linux/thread_info.h>
+ 
++#ifdef CONFIG_X86_32
++/*
++ * i386's current_thread_info() depends on ESP and for interrupt/exception
++ * stacks this doesn't yield the actual task thread_info.
++ *
++ * We hard rely on the fact that all the TIF_NEED_RESCHED bits are
++ * the same, therefore use the slightly more expensive version below.
++ */
++#undef tif_need_resched
++#define tif_need_resched() test_tsk_thread_flag(current, TIF_NEED_RESCHED)
++#endif
++
+ DECLARE_PER_CPU(int, __preempt_count);
+ 
+ /*
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 2b8578432d5b..ee0c3b554a38 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -1109,7 +1109,6 @@ static inline u64 get_kernel_ns(void)
+ {
+ 	struct timespec ts;
+ 
+-	WARN_ON(preemptible());
+ 	ktime_get_ts(&ts);
+ 	monotonic_to_bootbased(&ts);
+ 	return timespec_to_ns(&ts);
+diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c
+index 4ed75dd81d05..af2d4317b218 100644
+--- a/arch/x86/net/bpf_jit_comp.c
++++ b/arch/x86/net/bpf_jit_comp.c
+@@ -171,7 +171,7 @@ static struct bpf_binary_header *bpf_alloc_binary(unsigned int proglen,
+ 	memset(header, 0xcc, sz); /* fill whole space with int3 instructions */
+ 
+ 	header->pages = sz / PAGE_SIZE;
+-	hole = sz - (proglen + sizeof(*header));
++	hole = min(sz - (proglen + sizeof(*header)), PAGE_SIZE - sizeof(*header));
+ 
+ 	/* insert a random number of int3 instructions before BPF code */
+ 	*image_ptr = &header->image[prandom_u32() % hole];
+diff --git a/arch/x86/xen/spinlock.c b/arch/x86/xen/spinlock.c
+index 581521c843a5..c570feab9fa2 100644
+--- a/arch/x86/xen/spinlock.c
++++ b/arch/x86/xen/spinlock.c
+@@ -274,7 +274,7 @@ void __init xen_init_spinlocks(void)
+ 		printk(KERN_DEBUG "xen: PV spinlocks disabled\n");
+ 		return;
+ 	}
+-
++	printk(KERN_DEBUG "xen: PV spinlocks enabled\n");
+ 	pv_lock_ops.lock_spinning = PV_CALLEE_SAVE(xen_lock_spinning);
+ 	pv_lock_ops.unlock_kick = xen_unlock_kick;
+ }
+@@ -290,6 +290,9 @@ static __init int xen_init_spinlocks_jump(void)
+ 	if (!xen_pvspin)
+ 		return 0;
+ 
++	if (!xen_domain())
++		return 0;
++
+ 	static_key_slow_inc(&paravirt_ticketlocks_enabled);
+ 	return 0;
+ }
+diff --git a/block/blk-core.c b/block/blk-core.c
+index bfe16d5af9f9..e45b321cf6a0 100644
+--- a/block/blk-core.c
++++ b/block/blk-core.c
+@@ -2353,7 +2353,7 @@ bool blk_update_request(struct request *req, int error, unsigned int nr_bytes)
+ 	if (!req->bio)
+ 		return false;
+ 
+-	trace_block_rq_complete(req->q, req);
++	trace_block_rq_complete(req->q, req, nr_bytes);
+ 
+ 	/*
+ 	 * For fs requests, rq is just carrier of independent bio's
+diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
+index 34898d53395b..7f2d09fbb10b 100644
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -2253,7 +2253,7 @@ out_partial:
+ 	rbd_obj_request_put(obj_request);
+ out_unwind:
+ 	for_each_obj_request_safe(img_request, obj_request, next_obj_request)
+-		rbd_obj_request_put(obj_request);
++		rbd_img_obj_request_del(img_request, obj_request);
+ 
+ 	return -ENOMEM;
+ }
+diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
+index df77e20e3c3d..697f2150a997 100644
+--- a/drivers/gpu/drm/i915/i915_drv.h
++++ b/drivers/gpu/drm/i915/i915_drv.h
+@@ -734,6 +734,7 @@ enum intel_sbi_destination {
+ #define QUIRK_PIPEA_FORCE (1<<0)
+ #define QUIRK_LVDS_SSC_DISABLE (1<<1)
+ #define QUIRK_INVERT_BRIGHTNESS (1<<2)
++#define QUIRK_NO_PCH_PWM_ENABLE (1<<3)
+ 
+ struct intel_fbdev;
+ struct intel_fbc_work;
+diff --git a/drivers/gpu/drm/i915/i915_trace.h b/drivers/gpu/drm/i915/i915_trace.h
+index 6e580c98dede..783ae08200e8 100644
+--- a/drivers/gpu/drm/i915/i915_trace.h
++++ b/drivers/gpu/drm/i915/i915_trace.h
+@@ -238,14 +238,16 @@ TRACE_EVENT(i915_gem_evict_vm,
+ 	    TP_ARGS(vm),
+ 
+ 	    TP_STRUCT__entry(
++			     __field(u32, dev)
+ 			     __field(struct i915_address_space *, vm)
+ 			    ),
+ 
+ 	    TP_fast_assign(
++			   __entry->dev = vm->dev->primary->index;
+ 			   __entry->vm = vm;
+ 			  ),
+ 
+-	    TP_printk("dev=%d, vm=%p", __entry->vm->dev->primary->index, __entry->vm)
++	    TP_printk("dev=%d, vm=%p", __entry->dev, __entry->vm)
+ );
+ 
+ TRACE_EVENT(i915_gem_ring_sync_to,
+diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
+index 9b8a7c7ea7fc..963639d9049b 100644
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -10771,6 +10771,17 @@ static void quirk_invert_brightness(struct drm_device *dev)
+ 	DRM_INFO("applying inverted panel brightness quirk\n");
+ }
+ 
++/*
++ * Some machines (Dell XPS13) suffer broken backlight controls if
++ * BLM_PCH_PWM_ENABLE is set.
++ */
++static void quirk_no_pcm_pwm_enable(struct drm_device *dev)
++{
++	struct drm_i915_private *dev_priv = dev->dev_private;
++	dev_priv->quirks |= QUIRK_NO_PCH_PWM_ENABLE;
++	DRM_INFO("applying no-PCH_PWM_ENABLE quirk\n");
++}
++
+ struct intel_quirk {
+ 	int device;
+ 	int subsystem_vendor;
+@@ -10839,6 +10850,11 @@ static struct intel_quirk intel_quirks[] = {
+ 
+ 	/* Acer Aspire 4736Z */
+ 	{ 0x2a42, 0x1025, 0x0260, quirk_invert_brightness },
++
++	/* Dell XPS13 HD Sandy Bridge */
++	{ 0x0116, 0x1028, 0x052e, quirk_no_pcm_pwm_enable },
++	/* Dell XPS13 HD and XPS13 FHD Ivy Bridge */
++	{ 0x0166, 0x1028, 0x058b, quirk_no_pcm_pwm_enable },
+ };
+ 
+ static void intel_init_quirks(struct drm_device *dev)
+diff --git a/drivers/gpu/drm/i915/intel_panel.c b/drivers/gpu/drm/i915/intel_panel.c
+index 079ea38f14d9..9f1d7a9300e8 100644
+--- a/drivers/gpu/drm/i915/intel_panel.c
++++ b/drivers/gpu/drm/i915/intel_panel.c
+@@ -671,6 +671,10 @@ static void pch_enable_backlight(struct intel_connector *connector)
+ 	pch_ctl2 = panel->backlight.max << 16;
+ 	I915_WRITE(BLC_PWM_PCH_CTL2, pch_ctl2);
+ 
++	/* XXX: transitional */
++	if (dev_priv->quirks & QUIRK_NO_PCH_PWM_ENABLE)
++		return;
++
+ 	pch_ctl1 = 0;
+ 	if (panel->backlight.active_low_pwm)
+ 		pch_ctl1 |= BLM_PCH_POLARITY;
+diff --git a/drivers/gpu/drm/i915/intel_tv.c b/drivers/gpu/drm/i915/intel_tv.c
+index 22cf0f4ba248..99faac555d3b 100644
+--- a/drivers/gpu/drm/i915/intel_tv.c
++++ b/drivers/gpu/drm/i915/intel_tv.c
+@@ -1536,9 +1536,14 @@ static int tv_is_present_in_vbt(struct drm_device *dev)
+ 		/*
+ 		 * If the device type is not TV, continue.
+ 		 */
+-		if (p_child->old.device_type != DEVICE_TYPE_INT_TV &&
+-			p_child->old.device_type != DEVICE_TYPE_TV)
++		switch (p_child->old.device_type) {
++		case DEVICE_TYPE_INT_TV:
++		case DEVICE_TYPE_TV:
++		case DEVICE_TYPE_TV_SVIDEO_COMPOSITE:
++			break;
++		default:
+ 			continue;
++		}
+ 		/* Only when the addin_offset is non-zero, it is regarded
+ 		 * as present.
+ 		 */
+diff --git a/drivers/gpu/drm/qxl/qxl_ttm.c b/drivers/gpu/drm/qxl/qxl_ttm.c
+index c7e7e6590c2b..c82c1d6a965a 100644
+--- a/drivers/gpu/drm/qxl/qxl_ttm.c
++++ b/drivers/gpu/drm/qxl/qxl_ttm.c
+@@ -433,6 +433,7 @@ static int qxl_sync_obj_flush(void *sync_obj)
+ 
+ static void qxl_sync_obj_unref(void **sync_obj)
+ {
++	*sync_obj = NULL;
+ }
+ 
+ static void *qxl_sync_obj_ref(void *sync_obj)
+diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c
+index bbb17841a9e5..986f9e7364ca 100644
+--- a/drivers/gpu/drm/radeon/cik.c
++++ b/drivers/gpu/drm/radeon/cik.c
+@@ -1095,7 +1095,7 @@ static const u32 spectre_golden_registers[] =
+ 	0x8a14, 0xf000003f, 0x00000007,
+ 	0x8b24, 0xffffffff, 0x00ffffff,
+ 	0x28350, 0x3f3f3fff, 0x00000082,
+-	0x28355, 0x0000003f, 0x00000000,
++	0x28354, 0x0000003f, 0x00000000,
+ 	0x3e78, 0x00000001, 0x00000002,
+ 	0x913c, 0xffff03df, 0x00000004,
+ 	0xc768, 0x00000008, 0x00000008,
+@@ -6521,8 +6521,8 @@ void cik_get_csb_buffer(struct radeon_device *rdev, volatile u32 *buffer)
+ 		buffer[count++] = cpu_to_le32(0x00000000);
+ 		break;
+ 	case CHIP_HAWAII:
+-		buffer[count++] = 0x3a00161a;
+-		buffer[count++] = 0x0000002e;
++		buffer[count++] = cpu_to_le32(0x3a00161a);
++		buffer[count++] = cpu_to_le32(0x0000002e);
+ 		break;
+ 	default:
+ 		buffer[count++] = cpu_to_le32(0x00000000);
+diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
+index fbd8b930f2be..6e6f82c53fef 100644
+--- a/drivers/gpu/drm/radeon/radeon_display.c
++++ b/drivers/gpu/drm/radeon/radeon_display.c
+@@ -792,6 +792,7 @@ int radeon_ddc_get_modes(struct radeon_connector *radeon_connector)
+ 	if (radeon_connector->edid) {
+ 		drm_mode_connector_update_edid_property(&radeon_connector->base, radeon_connector->edid);
+ 		ret = drm_add_edid_modes(&radeon_connector->base, radeon_connector->edid);
++		drm_edid_to_eld(&radeon_connector->base, radeon_connector->edid);
+ 		return ret;
+ 	}
+ 	drm_mode_connector_update_edid_property(&radeon_connector->base, NULL);
+diff --git a/drivers/gpu/drm/radeon/radeon_ring.c b/drivers/gpu/drm/radeon/radeon_ring.c
+index 15e44a7281ab..8391fca52a58 100644
+--- a/drivers/gpu/drm/radeon/radeon_ring.c
++++ b/drivers/gpu/drm/radeon/radeon_ring.c
+@@ -257,6 +257,7 @@ int radeon_ib_ring_tests(struct radeon_device *rdev)
+ 		r = radeon_ib_test(rdev, i, ring);
+ 		if (r) {
+ 			ring->ready = false;
++			rdev->needs_reset = false;
+ 
+ 			if (i == RADEON_RING_TYPE_GFX_INDEX) {
+ 				/* oh, oh, that's really bad */
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_context.c b/drivers/gpu/drm/vmwgfx/vmwgfx_context.c
+index 1e80152674b5..4fbcfdb02360 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_context.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_context.c
+@@ -117,10 +117,10 @@ static void vmw_hw_context_destroy(struct vmw_resource *res)
+ 		(void) vmw_context_binding_state_kill
+ 			(&container_of(res, struct vmw_user_context, res)->cbs);
+ 		(void) vmw_gb_context_destroy(res);
++		mutex_unlock(&dev_priv->binding_mutex);
+ 		if (dev_priv->pinned_bo != NULL &&
+ 		    !dev_priv->query_cid_valid)
+ 			__vmw_execbuf_release_pinned_bo(dev_priv, NULL);
+-		mutex_unlock(&dev_priv->binding_mutex);
+ 		mutex_unlock(&dev_priv->cmdbuf_mutex);
+ 		return;
+ 	}
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+index efb575a7996c..a3480c13eb1b 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+@@ -1214,14 +1214,36 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv,
+ 		SVGA3dCmdSurfaceDMA dma;
+ 	} *cmd;
+ 	int ret;
++	SVGA3dCmdSurfaceDMASuffix *suffix;
++	uint32_t bo_size;
+ 
+ 	cmd = container_of(header, struct vmw_dma_cmd, header);
++	suffix = (SVGA3dCmdSurfaceDMASuffix *)((unsigned long) &cmd->dma +
++					       header->size - sizeof(*suffix));
++
++	/* Make sure device and verifier stays in sync. */
++	if (unlikely(suffix->suffixSize != sizeof(*suffix))) {
++		DRM_ERROR("Invalid DMA suffix size.\n");
++		return -EINVAL;
++	}
++
+ 	ret = vmw_translate_guest_ptr(dev_priv, sw_context,
+ 				      &cmd->dma.guest.ptr,
+ 				      &vmw_bo);
+ 	if (unlikely(ret != 0))
+ 		return ret;
+ 
++	/* Make sure DMA doesn't cross BO boundaries. */
++	bo_size = vmw_bo->base.num_pages * PAGE_SIZE;
++	if (unlikely(cmd->dma.guest.ptr.offset > bo_size)) {
++		DRM_ERROR("Invalid DMA offset.\n");
++		return -EINVAL;
++	}
++
++	bo_size -= cmd->dma.guest.ptr.offset;
++	if (unlikely(suffix->maximumOffset > bo_size))
++		suffix->maximumOffset = bo_size;
++
+ 	ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
+ 				user_surface_converter, &cmd->dma.host.sid,
+ 				NULL);
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+index ed5ce2a41bbf..021b5227e783 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
+@@ -147,7 +147,7 @@ static int vmw_fb_check_var(struct fb_var_screeninfo *var,
+ 	}
+ 
+ 	if (!vmw_kms_validate_mode_vram(vmw_priv,
+-					info->fix.line_length,
++					var->xres * var->bits_per_pixel/8,
+ 					var->yoffset + var->yres)) {
+ 		DRM_ERROR("Requested geom can not fit in framebuffer\n");
+ 		return -EINVAL;
+@@ -162,6 +162,8 @@ static int vmw_fb_set_par(struct fb_info *info)
+ 	struct vmw_private *vmw_priv = par->vmw_priv;
+ 	int ret;
+ 
++	info->fix.line_length = info->var.xres * info->var.bits_per_pixel/8;
++
+ 	ret = vmw_kms_write_svga(vmw_priv, info->var.xres, info->var.yres,
+ 				 info->fix.line_length,
+ 				 par->bpp, par->depth);
+@@ -177,6 +179,7 @@ static int vmw_fb_set_par(struct fb_info *info)
+ 		vmw_write(vmw_priv, SVGA_REG_DISPLAY_POSITION_Y, info->var.yoffset);
+ 		vmw_write(vmw_priv, SVGA_REG_DISPLAY_WIDTH, info->var.xres);
+ 		vmw_write(vmw_priv, SVGA_REG_DISPLAY_HEIGHT, info->var.yres);
++		vmw_write(vmw_priv, SVGA_REG_BYTES_PER_LINE, info->fix.line_length);
+ 		vmw_write(vmw_priv, SVGA_REG_DISPLAY_ID, SVGA_ID_INVALID);
+ 	}
+ 
+diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
+index cc32a6f96c64..8a5384ce0352 100644
+--- a/drivers/hid/hid-core.c
++++ b/drivers/hid/hid-core.c
+@@ -718,6 +718,9 @@ static int hid_scan_main(struct hid_parser *parser, struct hid_item *item)
+ 	case HID_MAIN_ITEM_TAG_END_COLLECTION:
+ 		break;
+ 	case HID_MAIN_ITEM_TAG_INPUT:
++		/* ignore constant inputs, they will be ignored by hid-input */
++		if (data & HID_MAIN_ITEM_CONSTANT)
++			break;
+ 		for (i = 0; i < parser->local.usage_index; i++)
+ 			hid_scan_input_usage(parser, parser->local.usage[i]);
+ 		break;
+@@ -1780,8 +1783,6 @@ static const struct hid_device_id hid_have_special_driver[] = {
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_USB) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_DIGITAL_MEDIA_3K) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_WIRELESS_OPTICAL_DESKTOP_3_0) },
+-	{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_2) },
+-	{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TOUCH_COVER_2) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_MONTEREY, USB_DEVICE_ID_GENIUS_KB29E) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN) },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_1) },
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index 22f28d6b33a8..6e12cd0317f6 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -624,8 +624,6 @@
+ #define USB_DEVICE_ID_MS_PRESENTER_8K_USB	0x0713
+ #define USB_DEVICE_ID_MS_DIGITAL_MEDIA_3K	0x0730
+ #define USB_DEVICE_ID_MS_COMFORT_MOUSE_4500	0x076c
+-#define USB_DEVICE_ID_MS_TOUCH_COVER_2	0x07a7
+-#define USB_DEVICE_ID_MS_TYPE_COVER_2	0x07a9
+ 
+ #define USB_VENDOR_ID_MOJO		0x8282
+ #define USB_DEVICE_ID_RETRO_ADAPTER	0x3201
+@@ -830,6 +828,7 @@
+ #define USB_DEVICE_ID_SYNAPTICS_LTS2	0x1d10
+ #define USB_DEVICE_ID_SYNAPTICS_HD	0x0ac3
+ #define USB_DEVICE_ID_SYNAPTICS_QUAD_HD	0x1ac3
++#define USB_DEVICE_ID_SYNAPTICS_TP_V103	0x5710
+ 
+ #define USB_VENDOR_ID_THINGM		0x27b8
+ #define USB_DEVICE_ID_BLINK1		0x01ed
+diff --git a/drivers/hid/hid-microsoft.c b/drivers/hid/hid-microsoft.c
+index 404a3a8a82f1..c6ef6eed3091 100644
+--- a/drivers/hid/hid-microsoft.c
++++ b/drivers/hid/hid-microsoft.c
+@@ -208,10 +208,6 @@ static const struct hid_device_id ms_devices[] = {
+ 		.driver_data = MS_NOGET },
+ 	{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_COMFORT_MOUSE_4500),
+ 		.driver_data = MS_DUPLICATE_USAGES },
+-	{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_2),
+-		.driver_data = 0 },
+-	{ HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TOUCH_COVER_2),
+-		.driver_data = 0 },
+ 
+ 	{ HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_BT),
+ 		.driver_data = MS_PRESENTER },
+diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
+index dbd83878ff99..8e4ddb369883 100644
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -119,6 +119,7 @@ static const struct hid_blacklist {
+ 	{ USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS2, HID_QUIRK_NO_INIT_REPORTS },
+ 	{ USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_HD, HID_QUIRK_NO_INIT_REPORTS },
+ 	{ USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_QUAD_HD, HID_QUIRK_NO_INIT_REPORTS },
++	{ USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_TP_V103, HID_QUIRK_NO_INIT_REPORTS },
+ 
+ 	{ 0, 0 }
+ };
+diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
+index 4a6ca1cb2e78..56e24c072b62 100644
+--- a/drivers/md/raid1.c
++++ b/drivers/md/raid1.c
+@@ -97,6 +97,7 @@ static void * r1buf_pool_alloc(gfp_t gfp_flags, void *data)
+ 	struct pool_info *pi = data;
+ 	struct r1bio *r1_bio;
+ 	struct bio *bio;
++	int need_pages;
+ 	int i, j;
+ 
+ 	r1_bio = r1bio_pool_alloc(gfp_flags, pi);
+@@ -119,15 +120,15 @@ static void * r1buf_pool_alloc(gfp_t gfp_flags, void *data)
+ 	 * RESYNC_PAGES for each bio.
+ 	 */
+ 	if (test_bit(MD_RECOVERY_REQUESTED, &pi->mddev->recovery))
+-		j = pi->raid_disks;
++		need_pages = pi->raid_disks;
+ 	else
+-		j = 1;
+-	while(j--) {
++		need_pages = 1;
++	for (j = 0; j < need_pages; j++) {
+ 		bio = r1_bio->bios[j];
+ 		bio->bi_vcnt = RESYNC_PAGES;
+ 
+ 		if (bio_alloc_pages(bio, gfp_flags))
+-			goto out_free_bio;
++			goto out_free_pages;
+ 	}
+ 	/* If not user-requests, copy the page pointers to all bios */
+ 	if (!test_bit(MD_RECOVERY_REQUESTED, &pi->mddev->recovery)) {
+@@ -141,6 +142,14 @@ static void * r1buf_pool_alloc(gfp_t gfp_flags, void *data)
+ 
+ 	return r1_bio;
+ 
++out_free_pages:
++	while (--j >= 0) {
++		struct bio_vec *bv;
++
++		bio_for_each_segment_all(bv, r1_bio->bios[j], i)
++			__free_page(bv->bv_page);
++	}
++
+ out_free_bio:
+ 	while (++j < pi->raid_disks)
+ 		bio_put(r1_bio->bios[j]);
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index e5628fc725c3..91ec8cd12478 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -4536,6 +4536,7 @@ static int __init bonding_init(void)
+ out:
+ 	return res;
+ err:
++	bond_destroy_debugfs();
+ 	bond_netlink_fini();
+ err_link:
+ 	unregister_pernet_subsys(&bond_net_ops);
+diff --git a/drivers/net/bonding/bond_options.c b/drivers/net/bonding/bond_options.c
+index 298c26509095..a937a37ae89f 100644
+--- a/drivers/net/bonding/bond_options.c
++++ b/drivers/net/bonding/bond_options.c
+@@ -70,6 +70,7 @@ static struct bond_opt_value bond_fail_over_mac_tbl[] = {
+ static struct bond_opt_value bond_intmax_tbl[] = {
+ 	{ "off",     0,       BOND_VALFLAG_DEFAULT},
+ 	{ "maxval",  INT_MAX, BOND_VALFLAG_MAX},
++	{ NULL,      -1,      0}
+ };
+ 
+ static struct bond_opt_value bond_lacp_rate_tbl[] = {
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index 70a225c8df5c..a210766279d3 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -12294,7 +12294,9 @@ static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *e
+ 	if (tg3_flag(tp, MAX_RXPEND_64) &&
+ 	    tp->rx_pending > 63)
+ 		tp->rx_pending = 63;
+-	tp->rx_jumbo_pending = ering->rx_jumbo_pending;
++
++	if (tg3_flag(tp, JUMBO_RING_ENABLE))
++		tp->rx_jumbo_pending = ering->rx_jumbo_pending;
+ 
+ 	for (i = 0; i < tp->irq_max; i++)
+ 		tp->napi[i].tx_pending = ering->tx_pending;
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_cq.c b/drivers/net/ethernet/mellanox/mlx4/en_cq.c
+index 70e95324a97d..c2cd8d31bcad 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_cq.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_cq.c
+@@ -66,7 +66,6 @@ int mlx4_en_create_cq(struct mlx4_en_priv *priv,
+ 
+ 	cq->ring = ring;
+ 	cq->is_tx = mode;
+-	spin_lock_init(&cq->lock);
+ 
+ 	/* Allocate HW buffers on provided NUMA node.
+ 	 * dev->numa_node is used in mtt range allocation flow.
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+index 84a96f70dfb5..2f83f3489fdb 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+@@ -1315,15 +1315,11 @@ static void mlx4_en_netpoll(struct net_device *dev)
+ {
+ 	struct mlx4_en_priv *priv = netdev_priv(dev);
+ 	struct mlx4_en_cq *cq;
+-	unsigned long flags;
+ 	int i;
+ 
+ 	for (i = 0; i < priv->rx_ring_num; i++) {
+ 		cq = priv->rx_cq[i];
+-		spin_lock_irqsave(&cq->lock, flags);
+-		napi_synchronize(&cq->napi);
+-		mlx4_en_process_rx_cq(dev, cq, 0);
+-		spin_unlock_irqrestore(&cq->lock, flags);
++		napi_schedule(&cq->napi);
+ 	}
+ }
+ #endif
+diff --git a/drivers/net/ethernet/mellanox/mlx4/main.c b/drivers/net/ethernet/mellanox/mlx4/main.c
+index d413e60071d4..95c316bb7a42 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/main.c
++++ b/drivers/net/ethernet/mellanox/mlx4/main.c
+@@ -2399,7 +2399,8 @@ slave_start:
+ 	 * No return code for this call, just warn the user in case of PCI
+ 	 * express device capabilities are under-satisfied by the bus.
+ 	 */
+-	mlx4_check_pcie_caps(dev);
++	if (!mlx4_is_slave(dev))
++		mlx4_check_pcie_caps(dev);
+ 
+ 	/* In master functions, the communication channel must be initialized
+ 	 * after obtaining its address from fw */
+diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+index b57e8c87a34e..72db9bedd765 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+@@ -309,7 +309,6 @@ struct mlx4_en_cq {
+ 	struct mlx4_cq          mcq;
+ 	struct mlx4_hwq_resources wqres;
+ 	int                     ring;
+-	spinlock_t              lock;
+ 	struct net_device      *dev;
+ 	struct napi_struct	napi;
+ 	int size;
+diff --git a/drivers/net/ethernet/sfc/nic.c b/drivers/net/ethernet/sfc/nic.c
+index 79226b19e3c4..cb3fb9dba8fb 100644
+--- a/drivers/net/ethernet/sfc/nic.c
++++ b/drivers/net/ethernet/sfc/nic.c
+@@ -156,13 +156,15 @@ void efx_nic_fini_interrupt(struct efx_nic *efx)
+ 	efx->net_dev->rx_cpu_rmap = NULL;
+ #endif
+ 
+-	/* Disable MSI/MSI-X interrupts */
+-	efx_for_each_channel(channel, efx)
+-		free_irq(channel->irq, &efx->msi_context[channel->channel]);
+-
+-	/* Disable legacy interrupt */
+-	if (efx->legacy_irq)
++	if (EFX_INT_MODE_USE_MSI(efx)) {
++		/* Disable MSI/MSI-X interrupts */
++		efx_for_each_channel(channel, efx)
++			free_irq(channel->irq,
++				 &efx->msi_context[channel->channel]);
++	} else {
++		/* Disable legacy interrupt */
+ 		free_irq(efx->legacy_irq, efx);
++	}
+ }
+ 
+ /* Register dump */
+diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
+index 1831fb7cd017..20bb66944c4a 100644
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -263,11 +263,9 @@ static int macvlan_queue_xmit(struct sk_buff *skb, struct net_device *dev)
+ 	const struct macvlan_dev *vlan = netdev_priv(dev);
+ 	const struct macvlan_port *port = vlan->port;
+ 	const struct macvlan_dev *dest;
+-	__u8 ip_summed = skb->ip_summed;
+ 
+ 	if (vlan->mode == MACVLAN_MODE_BRIDGE) {
+ 		const struct ethhdr *eth = (void *)skb->data;
+-		skb->ip_summed = CHECKSUM_UNNECESSARY;
+ 
+ 		/* send to other bridge ports directly */
+ 		if (is_multicast_ether_addr(eth->h_dest)) {
+@@ -285,7 +283,6 @@ static int macvlan_queue_xmit(struct sk_buff *skb, struct net_device *dev)
+ 	}
+ 
+ xmit_world:
+-	skb->ip_summed = ip_summed;
+ 	skb->dev = vlan->lowerdev;
+ 	return dev_queue_xmit(skb);
+ }
+@@ -461,8 +458,10 @@ static void macvlan_change_rx_flags(struct net_device *dev, int change)
+ 	struct macvlan_dev *vlan = netdev_priv(dev);
+ 	struct net_device *lowerdev = vlan->lowerdev;
+ 
+-	if (change & IFF_ALLMULTI)
+-		dev_set_allmulti(lowerdev, dev->flags & IFF_ALLMULTI ? 1 : -1);
++	if (dev->flags & IFF_UP) {
++		if (change & IFF_ALLMULTI)
++			dev_set_allmulti(lowerdev, dev->flags & IFF_ALLMULTI ? 1 : -1);
++	}
+ }
+ 
+ static void macvlan_set_mac_lists(struct net_device *dev)
+@@ -518,6 +517,11 @@ static struct lock_class_key macvlan_netdev_addr_lock_key;
+ #define MACVLAN_STATE_MASK \
+ 	((1<<__LINK_STATE_NOCARRIER) | (1<<__LINK_STATE_DORMANT))
+ 
++static int macvlan_get_nest_level(struct net_device *dev)
++{
++	return ((struct macvlan_dev *)netdev_priv(dev))->nest_level;
++}
++
+ static void macvlan_set_lockdep_class_one(struct net_device *dev,
+ 					  struct netdev_queue *txq,
+ 					  void *_unused)
+@@ -528,8 +532,9 @@ static void macvlan_set_lockdep_class_one(struct net_device *dev,
+ 
+ static void macvlan_set_lockdep_class(struct net_device *dev)
+ {
+-	lockdep_set_class(&dev->addr_list_lock,
+-			  &macvlan_netdev_addr_lock_key);
++	lockdep_set_class_and_subclass(&dev->addr_list_lock,
++				       &macvlan_netdev_addr_lock_key,
++				       macvlan_get_nest_level(dev));
+ 	netdev_for_each_tx_queue(dev, macvlan_set_lockdep_class_one, NULL);
+ }
+ 
+@@ -731,6 +736,7 @@ static const struct net_device_ops macvlan_netdev_ops = {
+ 	.ndo_fdb_add		= macvlan_fdb_add,
+ 	.ndo_fdb_del		= macvlan_fdb_del,
+ 	.ndo_fdb_dump		= ndo_dflt_fdb_dump,
++	.ndo_get_lock_subclass  = macvlan_get_nest_level,
+ };
+ 
+ void macvlan_common_setup(struct net_device *dev)
+@@ -859,6 +865,7 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
+ 	vlan->dev      = dev;
+ 	vlan->port     = port;
+ 	vlan->set_features = MACVLAN_FEATURES;
++	vlan->nest_level = dev_get_nest_level(lowerdev, netif_is_macvlan) + 1;
+ 
+ 	vlan->mode     = MACVLAN_MODE_VEPA;
+ 	if (data && data[IFLA_MACVLAN_MODE])
+diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
+index ff111a89e17f..3381c4f91a8c 100644
+--- a/drivers/net/macvtap.c
++++ b/drivers/net/macvtap.c
+@@ -322,6 +322,15 @@ static rx_handler_result_t macvtap_handle_frame(struct sk_buff **pskb)
+ 			segs = nskb;
+ 		}
+ 	} else {
++		/* If we receive a partial checksum and the tap side
++		 * doesn't support checksum offload, compute the checksum.
++		 * Note: it doesn't matter which checksum feature to
++		 *        check, we either support them all or none.
++		 */
++		if (skb->ip_summed == CHECKSUM_PARTIAL &&
++		    !(features & NETIF_F_ALL_CSUM) &&
++		    skb_checksum_help(skb))
++			goto drop;
+ 		skb_queue_tail(&q->sk.sk_receive_queue, skb);
+ 	}
+ 
+diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
+index 2f6989b1e0dc..365375408904 100644
+--- a/drivers/net/phy/phy_device.c
++++ b/drivers/net/phy/phy_device.c
+@@ -613,8 +613,8 @@ int phy_attach_direct(struct net_device *dev, struct phy_device *phydev,
+ 	err = phy_init_hw(phydev);
+ 	if (err)
+ 		phy_detach(phydev);
+-
+-	phy_resume(phydev);
++	else
++		phy_resume(phydev);
+ 
+ 	return err;
+ }
+diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
+index cc70ecfc7062..ad4a94e9ff57 100644
+--- a/drivers/net/slip/slip.c
++++ b/drivers/net/slip/slip.c
+@@ -429,13 +429,13 @@ static void slip_write_wakeup(struct tty_struct *tty)
+ 	if (!sl || sl->magic != SLIP_MAGIC || !netif_running(sl->dev))
+ 		return;
+ 
+-	spin_lock(&sl->lock);
++	spin_lock_bh(&sl->lock);
+ 	if (sl->xleft <= 0)  {
+ 		/* Now serial buffer is almost free & we can start
+ 		 * transmission of another packet */
+ 		sl->dev->stats.tx_packets++;
+ 		clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
+-		spin_unlock(&sl->lock);
++		spin_unlock_bh(&sl->lock);
+ 		sl_unlock(sl);
+ 		return;
+ 	}
+@@ -443,7 +443,7 @@ static void slip_write_wakeup(struct tty_struct *tty)
+ 	actual = tty->ops->write(tty, sl->xhead, sl->xleft);
+ 	sl->xleft -= actual;
+ 	sl->xhead += actual;
+-	spin_unlock(&sl->lock);
++	spin_unlock_bh(&sl->lock);
+ }
+ 
+ static void sl_tx_timeout(struct net_device *dev)
+diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
+index c9f3281506af..2e025ddcef21 100644
+--- a/drivers/net/usb/cdc_mbim.c
++++ b/drivers/net/usb/cdc_mbim.c
+@@ -120,6 +120,16 @@ static void cdc_mbim_unbind(struct usbnet *dev, struct usb_interface *intf)
+ 	cdc_ncm_unbind(dev, intf);
+ }
+ 
++/* verify that the ethernet protocol is IPv4 or IPv6 */
++static bool is_ip_proto(__be16 proto)
++{
++	switch (proto) {
++	case htons(ETH_P_IP):
++	case htons(ETH_P_IPV6):
++		return true;
++	}
++	return false;
++}
+ 
+ static struct sk_buff *cdc_mbim_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags)
+ {
+@@ -128,6 +138,7 @@ static struct sk_buff *cdc_mbim_tx_fixup(struct usbnet *dev, struct sk_buff *skb
+ 	struct cdc_ncm_ctx *ctx = info->ctx;
+ 	__le32 sign = cpu_to_le32(USB_CDC_MBIM_NDP16_IPS_SIGN);
+ 	u16 tci = 0;
++	bool is_ip;
+ 	u8 *c;
+ 
+ 	if (!ctx)
+@@ -137,25 +148,32 @@ static struct sk_buff *cdc_mbim_tx_fixup(struct usbnet *dev, struct sk_buff *skb
+ 		if (skb->len <= ETH_HLEN)
+ 			goto error;
+ 
++		/* Some applications using e.g. packet sockets will
++		 * bypass the VLAN acceleration and create tagged
++		 * ethernet frames directly.  We primarily look for
++		 * the accelerated out-of-band tag, but fall back if
++		 * required
++		 */
++		skb_reset_mac_header(skb);
++		if (vlan_get_tag(skb, &tci) < 0 && skb->len > VLAN_ETH_HLEN &&
++		    __vlan_get_tag(skb, &tci) == 0) {
++			is_ip = is_ip_proto(vlan_eth_hdr(skb)->h_vlan_encapsulated_proto);
++			skb_pull(skb, VLAN_ETH_HLEN);
++		} else {
++			is_ip = is_ip_proto(eth_hdr(skb)->h_proto);
++			skb_pull(skb, ETH_HLEN);
++		}
++
+ 		/* mapping VLANs to MBIM sessions:
+ 		 *   no tag     => IPS session <0>
+ 		 *   1 - 255    => IPS session <vlanid>
+ 		 *   256 - 511  => DSS session <vlanid - 256>
+ 		 *   512 - 4095 => unsupported, drop
+ 		 */
+-		vlan_get_tag(skb, &tci);
+-
+ 		switch (tci & 0x0f00) {
+ 		case 0x0000: /* VLAN ID 0 - 255 */
+-			/* verify that datagram is IPv4 or IPv6 */
+-			skb_reset_mac_header(skb);
+-			switch (eth_hdr(skb)->h_proto) {
+-			case htons(ETH_P_IP):
+-			case htons(ETH_P_IPV6):
+-				break;
+-			default:
++			if (!is_ip)
+ 				goto error;
+-			}
+ 			c = (u8 *)&sign;
+ 			c[3] = tci;
+ 			break;
+@@ -169,7 +187,6 @@ static struct sk_buff *cdc_mbim_tx_fixup(struct usbnet *dev, struct sk_buff *skb
+ 				  "unsupported tci=0x%04x\n", tci);
+ 			goto error;
+ 		}
+-		skb_pull(skb, ETH_HLEN);
+ 	}
+ 
+ 	spin_lock_bh(&ctx->mtx);
+@@ -204,17 +221,23 @@ static void do_neigh_solicit(struct usbnet *dev, u8 *buf, u16 tci)
+ 		return;
+ 
+ 	/* need to send the NA on the VLAN dev, if any */
+-	if (tci)
++	rcu_read_lock();
++	if (tci) {
+ 		netdev = __vlan_find_dev_deep(dev->net, htons(ETH_P_8021Q),
+ 					      tci);
+-	else
++		if (!netdev) {
++			rcu_read_unlock();
++			return;
++		}
++	} else {
+ 		netdev = dev->net;
+-	if (!netdev)
+-		return;
++	}
++	dev_hold(netdev);
++	rcu_read_unlock();
+ 
+ 	in6_dev = in6_dev_get(netdev);
+ 	if (!in6_dev)
+-		return;
++		goto out;
+ 	is_router = !!in6_dev->cnf.forwarding;
+ 	in6_dev_put(in6_dev);
+ 
+@@ -224,6 +247,8 @@ static void do_neigh_solicit(struct usbnet *dev, u8 *buf, u16 tci)
+ 				 true /* solicited */,
+ 				 false /* override */,
+ 				 true /* inc_opt */);
++out:
++	dev_put(netdev);
+ }
+ 
+ static bool is_neigh_solicit(u8 *buf, size_t len)
+diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
+index d350d2795e10..75d7d9dbbe35 100644
+--- a/drivers/net/usb/cdc_ncm.c
++++ b/drivers/net/usb/cdc_ncm.c
+@@ -768,7 +768,7 @@ cdc_ncm_fill_tx_frame(struct usbnet *dev, struct sk_buff *skb, __le32 sign)
+ 	    skb_out->len > CDC_NCM_MIN_TX_PKT)
+ 		memset(skb_put(skb_out, ctx->tx_max - skb_out->len), 0,
+ 		       ctx->tx_max - skb_out->len);
+-	else if ((skb_out->len % dev->maxpacket) == 0)
++	else if (skb_out->len < ctx->tx_max && (skb_out->len % dev->maxpacket) == 0)
+ 		*skb_put(skb_out, 1) = 0;	/* force short packet */
+ 
+ 	/* set final frame length */
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 313cb6cd4848..48c4902c0d62 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -662,6 +662,22 @@ static const struct usb_device_id products[] = {
+ 	{QMI_FIXED_INTF(0x05c6, 0x920d, 5)},
+ 	{QMI_FIXED_INTF(0x12d1, 0x140c, 1)},	/* Huawei E173 */
+ 	{QMI_FIXED_INTF(0x12d1, 0x14ac, 1)},	/* Huawei E1820 */
++	{QMI_FIXED_INTF(0x16d8, 0x6003, 0)},	/* CMOTech 6003 */
++	{QMI_FIXED_INTF(0x16d8, 0x6007, 0)},	/* CMOTech CHE-628S */
++	{QMI_FIXED_INTF(0x16d8, 0x6008, 0)},	/* CMOTech CMU-301 */
++	{QMI_FIXED_INTF(0x16d8, 0x6280, 0)},	/* CMOTech CHU-628 */
++	{QMI_FIXED_INTF(0x16d8, 0x7001, 0)},	/* CMOTech CHU-720S */
++	{QMI_FIXED_INTF(0x16d8, 0x7002, 0)},	/* CMOTech 7002 */
++	{QMI_FIXED_INTF(0x16d8, 0x7003, 4)},	/* CMOTech CHU-629K */
++	{QMI_FIXED_INTF(0x16d8, 0x7004, 3)},	/* CMOTech 7004 */
++	{QMI_FIXED_INTF(0x16d8, 0x7006, 5)},	/* CMOTech CGU-629 */
++	{QMI_FIXED_INTF(0x16d8, 0x700a, 4)},	/* CMOTech CHU-629S */
++	{QMI_FIXED_INTF(0x16d8, 0x7211, 0)},	/* CMOTech CHU-720I */
++	{QMI_FIXED_INTF(0x16d8, 0x7212, 0)},	/* CMOTech 7212 */
++	{QMI_FIXED_INTF(0x16d8, 0x7213, 0)},	/* CMOTech 7213 */
++	{QMI_FIXED_INTF(0x16d8, 0x7251, 1)},	/* CMOTech 7251 */
++	{QMI_FIXED_INTF(0x16d8, 0x7252, 1)},	/* CMOTech 7252 */
++	{QMI_FIXED_INTF(0x16d8, 0x7253, 1)},	/* CMOTech 7253 */
+ 	{QMI_FIXED_INTF(0x19d2, 0x0002, 1)},
+ 	{QMI_FIXED_INTF(0x19d2, 0x0012, 1)},
+ 	{QMI_FIXED_INTF(0x19d2, 0x0017, 3)},
+@@ -723,16 +739,28 @@ static const struct usb_device_id products[] = {
+ 	{QMI_FIXED_INTF(0x114f, 0x68a2, 8)},    /* Sierra Wireless MC7750 */
+ 	{QMI_FIXED_INTF(0x1199, 0x68a2, 8)},	/* Sierra Wireless MC7710 in QMI mode */
+ 	{QMI_FIXED_INTF(0x1199, 0x68a2, 19)},	/* Sierra Wireless MC7710 in QMI mode */
++	{QMI_FIXED_INTF(0x1199, 0x68c0, 8)},	/* Sierra Wireless MC73xx */
++	{QMI_FIXED_INTF(0x1199, 0x68c0, 10)},	/* Sierra Wireless MC73xx */
++	{QMI_FIXED_INTF(0x1199, 0x68c0, 11)},	/* Sierra Wireless MC73xx */
+ 	{QMI_FIXED_INTF(0x1199, 0x901c, 8)},    /* Sierra Wireless EM7700 */
++	{QMI_FIXED_INTF(0x1199, 0x901f, 8)},    /* Sierra Wireless EM7355 */
++	{QMI_FIXED_INTF(0x1199, 0x9041, 8)},	/* Sierra Wireless MC7305/MC7355 */
+ 	{QMI_FIXED_INTF(0x1199, 0x9051, 8)},	/* Netgear AirCard 340U */
+ 	{QMI_FIXED_INTF(0x1bbb, 0x011e, 4)},	/* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
++	{QMI_FIXED_INTF(0x1bbb, 0x0203, 2)},	/* Alcatel L800MA */
+ 	{QMI_FIXED_INTF(0x2357, 0x0201, 4)},	/* TP-LINK HSUPA Modem MA180 */
+ 	{QMI_FIXED_INTF(0x2357, 0x9000, 4)},	/* TP-LINK MA260 */
+ 	{QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},	/* Telit LE920 */
+ 	{QMI_FIXED_INTF(0x1bc7, 0x1201, 2)},	/* Telit LE920 */
+ 	{QMI_FIXED_INTF(0x0b3c, 0xc005, 6)},    /* Olivetti Olicard 200 */
++	{QMI_FIXED_INTF(0x0b3c, 0xc00b, 4)},	/* Olivetti Olicard 500 */
+ 	{QMI_FIXED_INTF(0x1e2d, 0x0060, 4)},	/* Cinterion PLxx */
+ 	{QMI_FIXED_INTF(0x1e2d, 0x0053, 4)},	/* Cinterion PHxx,PXxx */
++	{QMI_FIXED_INTF(0x413c, 0x81a2, 8)},	/* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */
++	{QMI_FIXED_INTF(0x413c, 0x81a3, 8)},	/* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */
++	{QMI_FIXED_INTF(0x413c, 0x81a4, 8)},	/* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */
++	{QMI_FIXED_INTF(0x413c, 0x81a8, 8)},	/* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card */
++	{QMI_FIXED_INTF(0x413c, 0x81a9, 8)},	/* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card */
+ 
+ 	/* 4. Gobi 1000 devices */
+ 	{QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},	/* Acer Gobi Modem Device */
+diff --git a/drivers/net/wireless/ti/wl18xx/event.h b/drivers/net/wireless/ti/wl18xx/event.h
+index 398f3d2c0a6c..a76e98eb8372 100644
+--- a/drivers/net/wireless/ti/wl18xx/event.h
++++ b/drivers/net/wireless/ti/wl18xx/event.h
+@@ -68,6 +68,26 @@ struct wl18xx_event_mailbox {
+ 
+ 	/* bitmap of inactive stations (by HLID) */
+ 	__le32 inactive_sta_bitmap;
++
++	/* rx BA win size indicated by RX_BA_WIN_SIZE_CHANGE_EVENT_ID */
++	u8 rx_ba_role_id;
++	u8 rx_ba_link_id;
++	u8 rx_ba_win_size;
++	u8 padding;
++
++	/* smart config */
++	u8 sc_ssid_len;
++	u8 sc_pwd_len;
++	u8 sc_token_len;
++	u8 padding1;
++	u8 sc_ssid[32];
++	u8 sc_pwd[32];
++	u8 sc_token[32];
++
++	/* smart config sync channel */
++	u8 sc_sync_channel;
++	u8 sc_sync_band;
++	u8 padding2[2];
+ } __packed;
+ 
+ int wl18xx_wait_for_event(struct wl1271 *wl, enum wlcore_wait_event event,
+diff --git a/drivers/scsi/megaraid/megaraid_mm.c b/drivers/scsi/megaraid/megaraid_mm.c
+index dfffd0f37916..a70692779a16 100644
+--- a/drivers/scsi/megaraid/megaraid_mm.c
++++ b/drivers/scsi/megaraid/megaraid_mm.c
+@@ -486,6 +486,8 @@ mimd_to_kioc(mimd_t __user *umimd, mraid_mmadp_t *adp, uioc_t *kioc)
+ 
+ 	pthru32->dataxferaddr	= kioc->buf_paddr;
+ 	if (kioc->data_dir & UIOC_WR) {
++		if (pthru32->dataxferlen > kioc->xferlen)
++			return -EINVAL;
+ 		if (copy_from_user(kioc->buf_vaddr, kioc->user_data,
+ 						pthru32->dataxferlen)) {
+ 			return (-EFAULT);
+diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
+index 307a81137607..4109530e92a0 100644
+--- a/drivers/scsi/scsi_scan.c
++++ b/drivers/scsi/scsi_scan.c
+@@ -320,6 +320,7 @@ static void scsi_target_destroy(struct scsi_target *starget)
+ 	struct Scsi_Host *shost = dev_to_shost(dev->parent);
+ 	unsigned long flags;
+ 
++	starget->state = STARGET_DEL;
+ 	transport_destroy_device(dev);
+ 	spin_lock_irqsave(shost->host_lock, flags);
+ 	if (shost->hostt->target_destroy)
+@@ -371,6 +372,37 @@ static struct scsi_target *__scsi_find_target(struct device *parent,
+ }
+ 
+ /**
++ * scsi_target_reap_ref_release - remove target from visibility
++ * @kref: the reap_ref in the target being released
++ *
++ * Called on last put of reap_ref, which is the indication that no device
++ * under this target is visible anymore, so render the target invisible in
++ * sysfs.  Note: we have to be in user context here because the target reaps
++ * should be done in places where the scsi device visibility is being removed.
++ */
++static void scsi_target_reap_ref_release(struct kref *kref)
++{
++	struct scsi_target *starget
++		= container_of(kref, struct scsi_target, reap_ref);
++
++	/*
++	 * if we get here and the target is still in the CREATED state that
++	 * means it was allocated but never made visible (because a scan
++	 * turned up no LUNs), so don't call device_del() on it.
++	 */
++	if (starget->state != STARGET_CREATED) {
++		transport_remove_device(&starget->dev);
++		device_del(&starget->dev);
++	}
++	scsi_target_destroy(starget);
++}
++
++static void scsi_target_reap_ref_put(struct scsi_target *starget)
++{
++	kref_put(&starget->reap_ref, scsi_target_reap_ref_release);
++}
++
++/**
+  * scsi_alloc_target - allocate a new or find an existing target
+  * @parent:	parent of the target (need not be a scsi host)
+  * @channel:	target channel number (zero if no channels)
+@@ -392,7 +424,7 @@ static struct scsi_target *scsi_alloc_target(struct device *parent,
+ 		+ shost->transportt->target_size;
+ 	struct scsi_target *starget;
+ 	struct scsi_target *found_target;
+-	int error;
++	int error, ref_got;
+ 
+ 	starget = kzalloc(size, GFP_KERNEL);
+ 	if (!starget) {
+@@ -401,7 +433,7 @@ static struct scsi_target *scsi_alloc_target(struct device *parent,
+ 	}
+ 	dev = &starget->dev;
+ 	device_initialize(dev);
+-	starget->reap_ref = 1;
++	kref_init(&starget->reap_ref);
+ 	dev->parent = get_device(parent);
+ 	dev_set_name(dev, "target%d:%d:%d", shost->host_no, channel, id);
+ 	dev->bus = &scsi_bus_type;
+@@ -441,29 +473,36 @@ static struct scsi_target *scsi_alloc_target(struct device *parent,
+ 	return starget;
+ 
+  found:
+-	found_target->reap_ref++;
++	/*
++	 * release routine already fired if kref is zero, so if we can still
++	 * take the reference, the target must be alive.  If we can't, it must
++	 * be dying and we need to wait for a new target
++	 */
++	ref_got = kref_get_unless_zero(&found_target->reap_ref);
++
+ 	spin_unlock_irqrestore(shost->host_lock, flags);
+-	if (found_target->state != STARGET_DEL) {
++	if (ref_got) {
+ 		put_device(dev);
+ 		return found_target;
+ 	}
+-	/* Unfortunately, we found a dying target; need to
+-	 * wait until it's dead before we can get a new one */
++	/*
++	 * Unfortunately, we found a dying target; need to wait until it's
++	 * dead before we can get a new one.  There is an anomaly here.  We
++	 * *should* call scsi_target_reap() to balance the kref_get() of the
++	 * reap_ref above.  However, since the target being released, it's
++	 * already invisible and the reap_ref is irrelevant.  If we call
++	 * scsi_target_reap() we might spuriously do another device_del() on
++	 * an already invisible target.
++	 */
+ 	put_device(&found_target->dev);
+-	flush_scheduled_work();
++	/*
++	 * length of time is irrelevant here, we just want to yield the CPU
++	 * for a tick to avoid busy waiting for the target to die.
++	 */
++	msleep(1);
+ 	goto retry;
+ }
+ 
+-static void scsi_target_reap_usercontext(struct work_struct *work)
+-{
+-	struct scsi_target *starget =
+-		container_of(work, struct scsi_target, ew.work);
+-
+-	transport_remove_device(&starget->dev);
+-	device_del(&starget->dev);
+-	scsi_target_destroy(starget);
+-}
+-
+ /**
+  * scsi_target_reap - check to see if target is in use and destroy if not
+  * @starget: target to be checked
+@@ -474,28 +513,13 @@ static void scsi_target_reap_usercontext(struct work_struct *work)
+  */
+ void scsi_target_reap(struct scsi_target *starget)
+ {
+-	struct Scsi_Host *shost = dev_to_shost(starget->dev.parent);
+-	unsigned long flags;
+-	enum scsi_target_state state;
+-	int empty = 0;
+-
+-	spin_lock_irqsave(shost->host_lock, flags);
+-	state = starget->state;
+-	if (--starget->reap_ref == 0 && list_empty(&starget->devices)) {
+-		empty = 1;
+-		starget->state = STARGET_DEL;
+-	}
+-	spin_unlock_irqrestore(shost->host_lock, flags);
+-
+-	if (!empty)
+-		return;
+-
+-	BUG_ON(state == STARGET_DEL);
+-	if (state == STARGET_CREATED)
+-		scsi_target_destroy(starget);
+-	else
+-		execute_in_process_context(scsi_target_reap_usercontext,
+-					   &starget->ew);
++	/*
++	 * serious problem if this triggers: STARGET_DEL is only set in the if
++	 * the reap_ref drops to zero, so we're trying to do another final put
++	 * on an already released kref
++	 */
++	BUG_ON(starget->state == STARGET_DEL);
++	scsi_target_reap_ref_put(starget);
+ }
+ 
+ /**
+@@ -1532,6 +1556,10 @@ struct scsi_device *__scsi_add_device(struct Scsi_Host *shost, uint channel,
+ 	}
+ 	mutex_unlock(&shost->scan_mutex);
+ 	scsi_autopm_put_target(starget);
++	/*
++	 * paired with scsi_alloc_target().  Target will be destroyed unless
++	 * scsi_probe_and_add_lun made an underlying device visible
++	 */
+ 	scsi_target_reap(starget);
+ 	put_device(&starget->dev);
+ 
+@@ -1612,8 +1640,10 @@ static void __scsi_scan_target(struct device *parent, unsigned int channel,
+ 
+  out_reap:
+ 	scsi_autopm_put_target(starget);
+-	/* now determine if the target has any children at all
+-	 * and if not, nuke it */
++	/*
++	 * paired with scsi_alloc_target(): determine if the target has
++	 * any children at all and if not, nuke it
++	 */
+ 	scsi_target_reap(starget);
+ 
+ 	put_device(&starget->dev);
+diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
+index 9117d0bf408e..665acbf83693 100644
+--- a/drivers/scsi/scsi_sysfs.c
++++ b/drivers/scsi/scsi_sysfs.c
+@@ -383,17 +383,14 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
+ {
+ 	struct scsi_device *sdev;
+ 	struct device *parent;
+-	struct scsi_target *starget;
+ 	struct list_head *this, *tmp;
+ 	unsigned long flags;
+ 
+ 	sdev = container_of(work, struct scsi_device, ew.work);
+ 
+ 	parent = sdev->sdev_gendev.parent;
+-	starget = to_scsi_target(parent);
+ 
+ 	spin_lock_irqsave(sdev->host->host_lock, flags);
+-	starget->reap_ref++;
+ 	list_del(&sdev->siblings);
+ 	list_del(&sdev->same_target_siblings);
+ 	list_del(&sdev->starved_entry);
+@@ -413,8 +410,6 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
+ 	/* NULL queue means the device can't be used */
+ 	sdev->request_queue = NULL;
+ 
+-	scsi_target_reap(scsi_target(sdev));
+-
+ 	kfree(sdev->inquiry);
+ 	kfree(sdev);
+ 
+@@ -1071,6 +1066,13 @@ void __scsi_remove_device(struct scsi_device *sdev)
+ 		sdev->host->hostt->slave_destroy(sdev);
+ 	transport_destroy_device(dev);
+ 
++	/*
++	 * Paired with the kref_get() in scsi_sysfs_initialize().  We have
++	 * remoed sysfs visibility from the device, so make the target
++	 * invisible if this was the last device underneath it.
++	 */
++	scsi_target_reap(scsi_target(sdev));
++
+ 	put_device(dev);
+ }
+ 
+@@ -1133,7 +1135,7 @@ void scsi_remove_target(struct device *dev)
+ 			continue;
+ 		if (starget->dev.parent == dev || &starget->dev == dev) {
+ 			/* assuming new targets arrive at the end */
+-			starget->reap_ref++;
++			kref_get(&starget->reap_ref);
+ 			spin_unlock_irqrestore(shost->host_lock, flags);
+ 			if (last)
+ 				scsi_target_reap(last);
+@@ -1217,6 +1219,12 @@ void scsi_sysfs_device_initialize(struct scsi_device *sdev)
+ 	list_add_tail(&sdev->same_target_siblings, &starget->devices);
+ 	list_add_tail(&sdev->siblings, &shost->__devices);
+ 	spin_unlock_irqrestore(shost->host_lock, flags);
++	/*
++	 * device can now only be removed via __scsi_remove_device() so hold
++	 * the target.  Target will be held in CREATED state until something
++	 * beneath it becomes visible (in which case it moves to RUNNING)
++	 */
++	kref_get(&starget->reap_ref);
+ }
+ 
+ int scsi_is_sdev_device(const struct device *dev)
+diff --git a/drivers/tty/serial/omap-serial.c b/drivers/tty/serial/omap-serial.c
+index 77f035158d6c..db8434d3def9 100644
+--- a/drivers/tty/serial/omap-serial.c
++++ b/drivers/tty/serial/omap-serial.c
+@@ -225,14 +225,19 @@ static inline void serial_omap_enable_wakeirq(struct uart_omap_port *up,
+ 	if (enable)
+ 		enable_irq(up->wakeirq);
+ 	else
+-		disable_irq(up->wakeirq);
++		disable_irq_nosync(up->wakeirq);
+ }
+ 
+ static void serial_omap_enable_wakeup(struct uart_omap_port *up, bool enable)
+ {
+ 	struct omap_uart_port_info *pdata = dev_get_platdata(up->dev);
+ 
++	if (enable == up->wakeups_enabled)
++		return;
++
+ 	serial_omap_enable_wakeirq(up, enable);
++	up->wakeups_enabled = enable;
++
+ 	if (!pdata || !pdata->enable_wakeup)
+ 		return;
+ 
+@@ -1488,6 +1493,11 @@ static int serial_omap_suspend(struct device *dev)
+ 	uart_suspend_port(&serial_omap_reg, &up->port);
+ 	flush_work(&up->qos_work);
+ 
++	if (device_may_wakeup(dev))
++		serial_omap_enable_wakeup(up, true);
++	else
++		serial_omap_enable_wakeup(up, false);
++
+ 	return 0;
+ }
+ 
+@@ -1495,6 +1505,9 @@ static int serial_omap_resume(struct device *dev)
+ {
+ 	struct uart_omap_port *up = dev_get_drvdata(dev);
+ 
++	if (device_may_wakeup(dev))
++		serial_omap_enable_wakeup(up, false);
++
+ 	uart_resume_port(&serial_omap_reg, &up->port);
+ 
+ 	return 0;
+@@ -1870,17 +1883,7 @@ static int serial_omap_runtime_suspend(struct device *dev)
+ 
+ 	up->context_loss_cnt = serial_omap_get_context_loss_count(up);
+ 
+-	if (device_may_wakeup(dev)) {
+-		if (!up->wakeups_enabled) {
+-			serial_omap_enable_wakeup(up, true);
+-			up->wakeups_enabled = true;
+-		}
+-	} else {
+-		if (up->wakeups_enabled) {
+-			serial_omap_enable_wakeup(up, false);
+-			up->wakeups_enabled = false;
+-		}
+-	}
++	serial_omap_enable_wakeup(up, true);
+ 
+ 	up->latency = PM_QOS_CPU_DMA_LAT_DEFAULT_VALUE;
+ 	schedule_work(&up->qos_work);
+@@ -1894,6 +1897,8 @@ static int serial_omap_runtime_resume(struct device *dev)
+ 
+ 	int loss_cnt = serial_omap_get_context_loss_count(up);
+ 
++	serial_omap_enable_wakeup(up, false);
++
+ 	if (loss_cnt < 0) {
+ 		dev_dbg(dev, "serial_omap_get_context_loss_count failed : %d\n",
+ 			loss_cnt);
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 900f7ff805ee..7783acabe443 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1652,13 +1652,27 @@ static const struct usb_device_id acm_ids[] = {
+ 	},
+ 	/* Motorola H24 HSPA module: */
+ 	{ USB_DEVICE(0x22b8, 0x2d91) }, /* modem                                */
+-	{ USB_DEVICE(0x22b8, 0x2d92) }, /* modem           + diagnostics        */
+-	{ USB_DEVICE(0x22b8, 0x2d93) }, /* modem + AT port                      */
+-	{ USB_DEVICE(0x22b8, 0x2d95) }, /* modem + AT port + diagnostics        */
+-	{ USB_DEVICE(0x22b8, 0x2d96) }, /* modem                         + NMEA */
+-	{ USB_DEVICE(0x22b8, 0x2d97) }, /* modem           + diagnostics + NMEA */
+-	{ USB_DEVICE(0x22b8, 0x2d99) }, /* modem + AT port               + NMEA */
+-	{ USB_DEVICE(0x22b8, 0x2d9a) }, /* modem + AT port + diagnostics + NMEA */
++	{ USB_DEVICE(0x22b8, 0x2d92),   /* modem           + diagnostics        */
++	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
++	},
++	{ USB_DEVICE(0x22b8, 0x2d93),   /* modem + AT port                      */
++	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
++	},
++	{ USB_DEVICE(0x22b8, 0x2d95),   /* modem + AT port + diagnostics        */
++	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
++	},
++	{ USB_DEVICE(0x22b8, 0x2d96),   /* modem                         + NMEA */
++	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
++	},
++	{ USB_DEVICE(0x22b8, 0x2d97),   /* modem           + diagnostics + NMEA */
++	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
++	},
++	{ USB_DEVICE(0x22b8, 0x2d99),   /* modem + AT port               + NMEA */
++	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
++	},
++	{ USB_DEVICE(0x22b8, 0x2d9a),   /* modem + AT port + diagnostics + NMEA */
++	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
++	},
+ 
+ 	{ USB_DEVICE(0x0572, 0x1329), /* Hummingbird huc56s (Conexant) */
+ 	.driver_info = NO_UNION_NORMAL, /* union descriptor misplaced on
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index 95fa1217afdd..762e4a5f5ae9 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -104,6 +104,7 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(0x10C4, 0x8218) }, /* Lipowsky Industrie Elektronik GmbH, HARP-1 */
+ 	{ USB_DEVICE(0x10C4, 0x822B) }, /* Modem EDGE(GSM) Comander 2 */
+ 	{ USB_DEVICE(0x10C4, 0x826B) }, /* Cygnal Integrated Products, Inc., Fasttrax GPS demonstration module */
++	{ USB_DEVICE(0x10C4, 0x8281) }, /* Nanotec Plug & Drive */
+ 	{ USB_DEVICE(0x10C4, 0x8293) }, /* Telegesis ETRX2USB */
+ 	{ USB_DEVICE(0x10C4, 0x82F9) }, /* Procyon AVS */
+ 	{ USB_DEVICE(0x10C4, 0x8341) }, /* Siemens MC35PU GPRS Modem */
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 44ab12986805..7c6e1dedeb06 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -909,6 +909,39 @@ static const struct usb_device_id id_table_combined[] = {
+ 	{ USB_DEVICE(FTDI_VID, FTDI_Z3X_PID) },
+ 	/* Cressi Devices */
+ 	{ USB_DEVICE(FTDI_VID, FTDI_CRESSI_PID) },
++	/* Brainboxes Devices */
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_001_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_012_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_023_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_034_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_101_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_1_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_2_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_3_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_4_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_5_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_6_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_7_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_8_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_257_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_1_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_2_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_3_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_4_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_313_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_324_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_346_1_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_346_2_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_357_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_606_1_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_606_2_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_606_3_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_701_1_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_701_2_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_1_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_2_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_3_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_4_PID) },
+ 	{ }					/* Terminating entry */
+ };
+ 
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index e599fbfcde5f..993c93df6874 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -1326,3 +1326,40 @@
+  * Manufacturer: Cressi
+  */
+ #define FTDI_CRESSI_PID		0x87d0
++
++/*
++ * Brainboxes devices
++ */
++#define BRAINBOXES_VID			0x05d1
++#define BRAINBOXES_VX_001_PID		0x1001 /* VX-001 ExpressCard 1 Port RS232 */
++#define BRAINBOXES_VX_012_PID		0x1002 /* VX-012 ExpressCard 2 Port RS232 */
++#define BRAINBOXES_VX_023_PID		0x1003 /* VX-023 ExpressCard 1 Port RS422/485 */
++#define BRAINBOXES_VX_034_PID		0x1004 /* VX-034 ExpressCard 2 Port RS422/485 */
++#define BRAINBOXES_US_101_PID		0x1011 /* US-101 1xRS232 */
++#define BRAINBOXES_US_324_PID		0x1013 /* US-324 1xRS422/485 1Mbaud */
++#define BRAINBOXES_US_606_1_PID		0x2001 /* US-606 6 Port RS232 Serial Port 1 and 2 */
++#define BRAINBOXES_US_606_2_PID		0x2002 /* US-606 6 Port RS232 Serial Port 3 and 4 */
++#define BRAINBOXES_US_606_3_PID		0x2003 /* US-606 6 Port RS232 Serial Port 4 and 6 */
++#define BRAINBOXES_US_701_1_PID		0x2011 /* US-701 4xRS232 1Mbaud Port 1 and 2 */
++#define BRAINBOXES_US_701_2_PID		0x2012 /* US-701 4xRS422 1Mbaud Port 3 and 4 */
++#define BRAINBOXES_US_279_1_PID		0x2021 /* US-279 8xRS422 1Mbaud Port 1 and 2 */
++#define BRAINBOXES_US_279_2_PID		0x2022 /* US-279 8xRS422 1Mbaud Port 3 and 4 */
++#define BRAINBOXES_US_279_3_PID		0x2023 /* US-279 8xRS422 1Mbaud Port 5 and 6 */
++#define BRAINBOXES_US_279_4_PID		0x2024 /* US-279 8xRS422 1Mbaud Port 7 and 8 */
++#define BRAINBOXES_US_346_1_PID		0x3011 /* US-346 4xRS422/485 1Mbaud Port 1 and 2 */
++#define BRAINBOXES_US_346_2_PID		0x3012 /* US-346 4xRS422/485 1Mbaud Port 3 and 4 */
++#define BRAINBOXES_US_257_PID		0x5001 /* US-257 2xRS232 1Mbaud */
++#define BRAINBOXES_US_313_PID		0x6001 /* US-313 2xRS422/485 1Mbaud */
++#define BRAINBOXES_US_357_PID		0x7001 /* US_357 1xRS232/422/485 */
++#define BRAINBOXES_US_842_1_PID		0x8001 /* US-842 8xRS422/485 1Mbaud Port 1 and 2 */
++#define BRAINBOXES_US_842_2_PID		0x8002 /* US-842 8xRS422/485 1Mbaud Port 3 and 4 */
++#define BRAINBOXES_US_842_3_PID		0x8003 /* US-842 8xRS422/485 1Mbaud Port 5 and 6 */
++#define BRAINBOXES_US_842_4_PID		0x8004 /* US-842 8xRS422/485 1Mbaud Port 7 and 8 */
++#define BRAINBOXES_US_160_1_PID		0x9001 /* US-160 16xRS232 1Mbaud Port 1 and 2 */
++#define BRAINBOXES_US_160_2_PID		0x9002 /* US-160 16xRS232 1Mbaud Port 3 and 4 */
++#define BRAINBOXES_US_160_3_PID		0x9003 /* US-160 16xRS232 1Mbaud Port 5 and 6 */
++#define BRAINBOXES_US_160_4_PID		0x9004 /* US-160 16xRS232 1Mbaud Port 7 and 8 */
++#define BRAINBOXES_US_160_5_PID		0x9005 /* US-160 16xRS232 1Mbaud Port 9 and 10 */
++#define BRAINBOXES_US_160_6_PID		0x9006 /* US-160 16xRS232 1Mbaud Port 11 and 12 */
++#define BRAINBOXES_US_160_7_PID		0x9007 /* US-160 16xRS232 1Mbaud Port 13 and 14 */
++#define BRAINBOXES_US_160_8_PID		0x9008 /* US-160 16xRS232 1Mbaud Port 15 and 16 */
+diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
+index a2db5be9c305..df90dae53eb9 100644
+--- a/drivers/usb/serial/io_ti.c
++++ b/drivers/usb/serial/io_ti.c
+@@ -28,6 +28,7 @@
+ #include <linux/spinlock.h>
+ #include <linux/mutex.h>
+ #include <linux/serial.h>
++#include <linux/swab.h>
+ #include <linux/kfifo.h>
+ #include <linux/ioctl.h>
+ #include <linux/firmware.h>
+@@ -280,7 +281,7 @@ static int read_download_mem(struct usb_device *dev, int start_address,
+ {
+ 	int status = 0;
+ 	__u8 read_length;
+-	__be16 be_start_address;
++	u16 be_start_address;
+ 
+ 	dev_dbg(&dev->dev, "%s - @ %x for %d\n", __func__, start_address, length);
+ 
+@@ -296,10 +297,14 @@ static int read_download_mem(struct usb_device *dev, int start_address,
+ 		if (read_length > 1) {
+ 			dev_dbg(&dev->dev, "%s - @ %x for %d\n", __func__, start_address, read_length);
+ 		}
+-		be_start_address = cpu_to_be16(start_address);
++		/*
++		 * NOTE: Must use swab as wIndex is sent in little-endian
++		 *       byte order regardless of host byte order.
++		 */
++		be_start_address = swab16((u16)start_address);
+ 		status = ti_vread_sync(dev, UMPC_MEMORY_READ,
+ 					(__u16)address_type,
+-					(__force __u16)be_start_address,
++					be_start_address,
+ 					buffer, read_length);
+ 
+ 		if (status) {
+@@ -394,7 +399,7 @@ static int write_i2c_mem(struct edgeport_serial *serial,
+ 	struct device *dev = &serial->serial->dev->dev;
+ 	int status = 0;
+ 	int write_length;
+-	__be16 be_start_address;
++	u16 be_start_address;
+ 
+ 	/* We can only send a maximum of 1 aligned byte page at a time */
+ 
+@@ -409,11 +414,16 @@ static int write_i2c_mem(struct edgeport_serial *serial,
+ 		__func__, start_address, write_length);
+ 	usb_serial_debug_data(dev, __func__, write_length, buffer);
+ 
+-	/* Write first page */
+-	be_start_address = cpu_to_be16(start_address);
++	/*
++	 * Write first page.
++	 *
++	 * NOTE: Must use swab as wIndex is sent in little-endian byte order
++	 *       regardless of host byte order.
++	 */
++	be_start_address = swab16((u16)start_address);
+ 	status = ti_vsend_sync(serial->serial->dev,
+ 				UMPC_MEMORY_WRITE, (__u16)address_type,
+-				(__force __u16)be_start_address,
++				be_start_address,
+ 				buffer,	write_length);
+ 	if (status) {
+ 		dev_dbg(dev, "%s - ERROR %d\n", __func__, status);
+@@ -436,11 +446,16 @@ static int write_i2c_mem(struct edgeport_serial *serial,
+ 			__func__, start_address, write_length);
+ 		usb_serial_debug_data(dev, __func__, write_length, buffer);
+ 
+-		/* Write next page */
+-		be_start_address = cpu_to_be16(start_address);
++		/*
++		 * Write next page.
++		 *
++		 * NOTE: Must use swab as wIndex is sent in little-endian byte
++		 *       order regardless of host byte order.
++		 */
++		be_start_address = swab16((u16)start_address);
+ 		status = ti_vsend_sync(serial->serial->dev, UMPC_MEMORY_WRITE,
+ 				(__u16)address_type,
+-				(__force __u16)be_start_address,
++				be_start_address,
+ 				buffer, write_length);
+ 		if (status) {
+ 			dev_err(dev, "%s - ERROR %d\n", __func__, status);
+@@ -585,8 +600,8 @@ static int get_descriptor_addr(struct edgeport_serial *serial,
+ 		if (rom_desc->Type == desc_type)
+ 			return start_address;
+ 
+-		start_address = start_address + sizeof(struct ti_i2c_desc)
+-							+ rom_desc->Size;
++		start_address = start_address + sizeof(struct ti_i2c_desc) +
++						le16_to_cpu(rom_desc->Size);
+ 
+ 	} while ((start_address < TI_MAX_I2C_SIZE) && rom_desc->Type);
+ 
+@@ -599,7 +614,7 @@ static int valid_csum(struct ti_i2c_desc *rom_desc, __u8 *buffer)
+ 	__u16 i;
+ 	__u8 cs = 0;
+ 
+-	for (i = 0; i < rom_desc->Size; i++)
++	for (i = 0; i < le16_to_cpu(rom_desc->Size); i++)
+ 		cs = (__u8)(cs + buffer[i]);
+ 
+ 	if (cs != rom_desc->CheckSum) {
+@@ -650,7 +665,7 @@ static int check_i2c_image(struct edgeport_serial *serial)
+ 			break;
+ 
+ 		if ((start_address + sizeof(struct ti_i2c_desc) +
+-					rom_desc->Size) > TI_MAX_I2C_SIZE) {
++			le16_to_cpu(rom_desc->Size)) > TI_MAX_I2C_SIZE) {
+ 			status = -ENODEV;
+ 			dev_dbg(dev, "%s - structure too big, erroring out.\n", __func__);
+ 			break;
+@@ -665,7 +680,8 @@ static int check_i2c_image(struct edgeport_serial *serial)
+ 			/* Read the descriptor data */
+ 			status = read_rom(serial, start_address +
+ 						sizeof(struct ti_i2c_desc),
+-						rom_desc->Size, buffer);
++						le16_to_cpu(rom_desc->Size),
++						buffer);
+ 			if (status)
+ 				break;
+ 
+@@ -674,7 +690,7 @@ static int check_i2c_image(struct edgeport_serial *serial)
+ 				break;
+ 		}
+ 		start_address = start_address + sizeof(struct ti_i2c_desc) +
+-								rom_desc->Size;
++						le16_to_cpu(rom_desc->Size);
+ 
+ 	} while ((rom_desc->Type != I2C_DESC_TYPE_ION) &&
+ 				(start_address < TI_MAX_I2C_SIZE));
+@@ -712,7 +728,7 @@ static int get_manuf_info(struct edgeport_serial *serial, __u8 *buffer)
+ 
+ 	/* Read the descriptor data */
+ 	status = read_rom(serial, start_address+sizeof(struct ti_i2c_desc),
+-						rom_desc->Size, buffer);
++					le16_to_cpu(rom_desc->Size), buffer);
+ 	if (status)
+ 		goto exit;
+ 
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 68fc9fe65936..f213ee978516 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -234,8 +234,31 @@ static void option_instat_callback(struct urb *urb);
+ #define QUALCOMM_VENDOR_ID			0x05C6
+ 
+ #define CMOTECH_VENDOR_ID			0x16d8
+-#define CMOTECH_PRODUCT_6008			0x6008
+-#define CMOTECH_PRODUCT_6280			0x6280
++#define CMOTECH_PRODUCT_6001			0x6001
++#define CMOTECH_PRODUCT_CMU_300			0x6002
++#define CMOTECH_PRODUCT_6003			0x6003
++#define CMOTECH_PRODUCT_6004			0x6004
++#define CMOTECH_PRODUCT_6005			0x6005
++#define CMOTECH_PRODUCT_CGU_628A		0x6006
++#define CMOTECH_PRODUCT_CHE_628S		0x6007
++#define CMOTECH_PRODUCT_CMU_301			0x6008
++#define CMOTECH_PRODUCT_CHU_628			0x6280
++#define CMOTECH_PRODUCT_CHU_628S		0x6281
++#define CMOTECH_PRODUCT_CDU_680			0x6803
++#define CMOTECH_PRODUCT_CDU_685A		0x6804
++#define CMOTECH_PRODUCT_CHU_720S		0x7001
++#define CMOTECH_PRODUCT_7002			0x7002
++#define CMOTECH_PRODUCT_CHU_629K		0x7003
++#define CMOTECH_PRODUCT_7004			0x7004
++#define CMOTECH_PRODUCT_7005			0x7005
++#define CMOTECH_PRODUCT_CGU_629			0x7006
++#define CMOTECH_PRODUCT_CHU_629S		0x700a
++#define CMOTECH_PRODUCT_CHU_720I		0x7211
++#define CMOTECH_PRODUCT_7212			0x7212
++#define CMOTECH_PRODUCT_7213			0x7213
++#define CMOTECH_PRODUCT_7251			0x7251
++#define CMOTECH_PRODUCT_7252			0x7252
++#define CMOTECH_PRODUCT_7253			0x7253
+ 
+ #define TELIT_VENDOR_ID				0x1bc7
+ #define TELIT_PRODUCT_UC864E			0x1003
+@@ -243,6 +266,7 @@ static void option_instat_callback(struct urb *urb);
+ #define TELIT_PRODUCT_CC864_DUAL		0x1005
+ #define TELIT_PRODUCT_CC864_SINGLE		0x1006
+ #define TELIT_PRODUCT_DE910_DUAL		0x1010
++#define TELIT_PRODUCT_UE910_V2			0x1012
+ #define TELIT_PRODUCT_LE920			0x1200
+ 
+ /* ZTE PRODUCTS */
+@@ -286,6 +310,7 @@ static void option_instat_callback(struct urb *urb);
+ #define ALCATEL_PRODUCT_X060S_X200		0x0000
+ #define ALCATEL_PRODUCT_X220_X500D		0x0017
+ #define ALCATEL_PRODUCT_L100V			0x011e
++#define ALCATEL_PRODUCT_L800MA			0x0203
+ 
+ #define PIRELLI_VENDOR_ID			0x1266
+ #define PIRELLI_PRODUCT_C100_1			0x1002
+@@ -348,6 +373,7 @@ static void option_instat_callback(struct urb *urb);
+ #define OLIVETTI_PRODUCT_OLICARD100		0xc000
+ #define OLIVETTI_PRODUCT_OLICARD145		0xc003
+ #define OLIVETTI_PRODUCT_OLICARD200		0xc005
++#define OLIVETTI_PRODUCT_OLICARD500		0xc00b
+ 
+ /* Celot products */
+ #define CELOT_VENDOR_ID				0x211f
+@@ -501,6 +527,10 @@ static const struct option_blacklist_info huawei_cdc12_blacklist = {
+ 	.reserved = BIT(1) | BIT(2),
+ };
+ 
++static const struct option_blacklist_info net_intf0_blacklist = {
++	.reserved = BIT(0),
++};
++
+ static const struct option_blacklist_info net_intf1_blacklist = {
+ 	.reserved = BIT(1),
+ };
+@@ -1034,13 +1064,53 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
+ 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
+ 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
+-	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6280) }, /* BP3-USB & BP3-EXT HSDPA */
+-	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6008) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6004) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6005) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CGU_628A) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHE_628S),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_301),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_628),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_628S) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CDU_680) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CDU_685A) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_720S),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7002),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_629K),
++	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7004),
++	  .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7005) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CGU_629),
++	  .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_629S),
++	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_720I),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7212),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7213),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7251),
++	  .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7252),
++	  .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7253),
++	  .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864E) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864G) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_DUAL) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) },
++	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
+ 		.driver_info = (kernel_ulong_t)&telit_le920_blacklist },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
+@@ -1498,6 +1568,8 @@ static const struct usb_device_id option_ids[] = {
+ 	  .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
+ 	{ USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_L100V),
+ 	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
++	{ USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_L800MA),
++	  .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
+ 	{ USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) },
+ 	{ USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) },
+ 	{ USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14),
+@@ -1543,6 +1615,9 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200),
+ 		.driver_info = (kernel_ulong_t)&net_intf6_blacklist
+ 	},
++	{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD500),
++		.driver_info = (kernel_ulong_t)&net_intf4_blacklist
++	},
+ 	{ USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/
+ 	{ USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) },
+diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
+index 968a40201e5f..7ed681a714a5 100644
+--- a/drivers/usb/serial/qcserial.c
++++ b/drivers/usb/serial/qcserial.c
+@@ -136,9 +136,18 @@ static const struct usb_device_id id_table[] = {
+ 	{USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x68a2, 0)},	/* Sierra Wireless MC7710 Device Management */
+ 	{USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x68a2, 2)},	/* Sierra Wireless MC7710 NMEA */
+ 	{USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x68a2, 3)},	/* Sierra Wireless MC7710 Modem */
++	{USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x68c0, 0)},	/* Sierra Wireless MC73xx Device Management */
++	{USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x68c0, 2)},	/* Sierra Wireless MC73xx NMEA */
++	{USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x68c0, 3)},	/* Sierra Wireless MC73xx Modem */
+ 	{USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901c, 0)},	/* Sierra Wireless EM7700 Device Management */
+ 	{USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901c, 2)},	/* Sierra Wireless EM7700 NMEA */
+ 	{USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901c, 3)},	/* Sierra Wireless EM7700 Modem */
++	{USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901f, 0)},	/* Sierra Wireless EM7355 Device Management */
++	{USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901f, 2)},	/* Sierra Wireless EM7355 NMEA */
++	{USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901f, 3)},	/* Sierra Wireless EM7355 Modem */
++	{USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9041, 0)},	/* Sierra Wireless MC7305/MC7355 Device Management */
++	{USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9041, 2)},	/* Sierra Wireless MC7305/MC7355 NMEA */
++	{USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9041, 3)},	/* Sierra Wireless MC7305/MC7355 Modem */
+ 	{USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 0)},	/* Netgear AirCard 340U Device Management */
+ 	{USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 2)},	/* Netgear AirCard 340U NMEA */
+ 	{USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 3)},	/* Netgear AirCard 340U Modem */
+diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
+index a9eb6221a815..6b192e602ce0 100644
+--- a/drivers/usb/serial/sierra.c
++++ b/drivers/usb/serial/sierra.c
+@@ -291,7 +291,6 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(0x0f3d, 0x68A3), 	/* Airprime/Sierra Wireless Direct IP modems */
+ 	  .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
+ 	},
+-       { USB_DEVICE(0x413C, 0x08133) }, /* Dell Computer Corp. Wireless 5720 VZW Mobile Broadband (EVDO Rev-A) Minicard GPS Port */
+ 
+ 	{ }
+ };
+diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
+index 7c9dc28640bb..b169b0f9b3a2 100644
+--- a/drivers/usb/serial/usb-serial.c
++++ b/drivers/usb/serial/usb-serial.c
+@@ -1348,10 +1348,12 @@ static int usb_serial_register(struct usb_serial_driver *driver)
+ static void usb_serial_deregister(struct usb_serial_driver *device)
+ {
+ 	pr_info("USB Serial deregistering driver %s\n", device->description);
++
+ 	mutex_lock(&table_lock);
+ 	list_del(&device->driver_list);
+-	usb_serial_bus_deregister(device);
+ 	mutex_unlock(&table_lock);
++
++	usb_serial_bus_deregister(device);
+ }
+ 
+ /**
+diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c
+index 640fe0173236..b078440e822f 100644
+--- a/drivers/usb/serial/usb_wwan.c
++++ b/drivers/usb/serial/usb_wwan.c
+@@ -466,6 +466,9 @@ int usb_wwan_port_probe(struct usb_serial_port *port)
+ 	int err;
+ 	int i;
+ 
++	if (!port->bulk_in_size || !port->bulk_out_size)
++		return -ENODEV;
++
+ 	portdata = kzalloc(sizeof(*portdata), GFP_KERNEL);
+ 	if (!portdata)
+ 		return -ENOMEM;
+@@ -473,9 +476,6 @@ int usb_wwan_port_probe(struct usb_serial_port *port)
+ 	init_usb_anchor(&portdata->delayed);
+ 
+ 	for (i = 0; i < N_IN_URB; i++) {
+-		if (!port->bulk_in_size)
+-			break;
+-
+ 		buffer = (u8 *)__get_free_page(GFP_KERNEL);
+ 		if (!buffer)
+ 			goto bail_out_error;
+@@ -489,9 +489,6 @@ int usb_wwan_port_probe(struct usb_serial_port *port)
+ 	}
+ 
+ 	for (i = 0; i < N_OUT_URB; i++) {
+-		if (!port->bulk_out_size)
+-			break;
+-
+ 		buffer = kmalloc(OUT_BUFLEN, GFP_KERNEL);
+ 		if (!buffer)
+ 			goto bail_out_error2;
+diff --git a/drivers/xen/events/events_fifo.c b/drivers/xen/events/events_fifo.c
+index 1de2a191b395..640b3cf1a338 100644
+--- a/drivers/xen/events/events_fifo.c
++++ b/drivers/xen/events/events_fifo.c
+@@ -66,7 +66,22 @@ static DEFINE_PER_CPU(struct evtchn_fifo_queue, cpu_queue);
+ static event_word_t *event_array[MAX_EVENT_ARRAY_PAGES] __read_mostly;
+ static unsigned event_array_pages __read_mostly;
+ 
++/*
++ * sync_set_bit() and friends must be unsigned long aligned on non-x86
++ * platforms.
++ */
++#if !defined(CONFIG_X86) && BITS_PER_LONG > 32
++
++#define BM(w) (unsigned long *)((unsigned long)w & ~0x7UL)
++#define EVTCHN_FIFO_BIT(b, w) \
++    (((unsigned long)w & 0x4UL) ? (EVTCHN_FIFO_ ##b + 32) : EVTCHN_FIFO_ ##b)
++
++#else
++
+ #define BM(w) ((unsigned long *)(w))
++#define EVTCHN_FIFO_BIT(b, w) EVTCHN_FIFO_ ##b
++
++#endif
+ 
+ static inline event_word_t *event_word_from_port(unsigned port)
+ {
+@@ -161,33 +176,38 @@ static void evtchn_fifo_bind_to_cpu(struct irq_info *info, unsigned cpu)
+ static void evtchn_fifo_clear_pending(unsigned port)
+ {
+ 	event_word_t *word = event_word_from_port(port);
+-	sync_clear_bit(EVTCHN_FIFO_PENDING, BM(word));
++	sync_clear_bit(EVTCHN_FIFO_BIT(PENDING, word), BM(word));
+ }
+ 
+ static void evtchn_fifo_set_pending(unsigned port)
+ {
+ 	event_word_t *word = event_word_from_port(port);
+-	sync_set_bit(EVTCHN_FIFO_PENDING, BM(word));
++	sync_set_bit(EVTCHN_FIFO_BIT(PENDING, word), BM(word));
+ }
+ 
+ static bool evtchn_fifo_is_pending(unsigned port)
+ {
+ 	event_word_t *word = event_word_from_port(port);
+-	return sync_test_bit(EVTCHN_FIFO_PENDING, BM(word));
++	return sync_test_bit(EVTCHN_FIFO_BIT(PENDING, word), BM(word));
+ }
+ 
+ static bool evtchn_fifo_test_and_set_mask(unsigned port)
+ {
+ 	event_word_t *word = event_word_from_port(port);
+-	return sync_test_and_set_bit(EVTCHN_FIFO_MASKED, BM(word));
++	return sync_test_and_set_bit(EVTCHN_FIFO_BIT(MASKED, word), BM(word));
+ }
+ 
+ static void evtchn_fifo_mask(unsigned port)
+ {
+ 	event_word_t *word = event_word_from_port(port);
+-	sync_set_bit(EVTCHN_FIFO_MASKED, BM(word));
++	sync_set_bit(EVTCHN_FIFO_BIT(MASKED, word), BM(word));
+ }
+ 
++static bool evtchn_fifo_is_masked(unsigned port)
++{
++	event_word_t *word = event_word_from_port(port);
++	return sync_test_bit(EVTCHN_FIFO_BIT(MASKED, word), BM(word));
++}
+ /*
+  * Clear MASKED, spinning if BUSY is set.
+  */
+@@ -211,7 +231,7 @@ static void evtchn_fifo_unmask(unsigned port)
+ 	BUG_ON(!irqs_disabled());
+ 
+ 	clear_masked(word);
+-	if (sync_test_bit(EVTCHN_FIFO_PENDING, BM(word))) {
++	if (evtchn_fifo_is_pending(port)) {
+ 		struct evtchn_unmask unmask = { .port = port };
+ 		(void)HYPERVISOR_event_channel_op(EVTCHNOP_unmask, &unmask);
+ 	}
+@@ -247,7 +267,7 @@ static void handle_irq_for_port(unsigned port)
+ 
+ static void consume_one_event(unsigned cpu,
+ 			      struct evtchn_fifo_control_block *control_block,
+-			      unsigned priority, uint32_t *ready)
++			      unsigned priority, unsigned long *ready)
+ {
+ 	struct evtchn_fifo_queue *q = &per_cpu(cpu_queue, cpu);
+ 	uint32_t head;
+@@ -277,10 +297,9 @@ static void consume_one_event(unsigned cpu,
+ 	 * copy of the ready word.
+ 	 */
+ 	if (head == 0)
+-		clear_bit(priority, BM(ready));
++		clear_bit(priority, ready);
+ 
+-	if (sync_test_bit(EVTCHN_FIFO_PENDING, BM(word))
+-	    && !sync_test_bit(EVTCHN_FIFO_MASKED, BM(word)))
++	if (evtchn_fifo_is_pending(port) && !evtchn_fifo_is_masked(port))
+ 		handle_irq_for_port(port);
+ 
+ 	q->head[priority] = head;
+@@ -289,7 +308,7 @@ static void consume_one_event(unsigned cpu,
+ static void evtchn_fifo_handle_events(unsigned cpu)
+ {
+ 	struct evtchn_fifo_control_block *control_block;
+-	uint32_t ready;
++	unsigned long ready;
+ 	unsigned q;
+ 
+ 	control_block = per_cpu(cpu_control_block, cpu);
+diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
+index 849f6132b327..7c6b73c72210 100644
+--- a/fs/cifs/cifsfs.c
++++ b/fs/cifs/cifsfs.c
+@@ -253,6 +253,11 @@ cifs_alloc_inode(struct super_block *sb)
+ 	cifs_set_oplock_level(cifs_inode, 0);
+ 	cifs_inode->delete_pending = false;
+ 	cifs_inode->invalid_mapping = false;
++	clear_bit(CIFS_INODE_PENDING_OPLOCK_BREAK, &cifs_inode->flags);
++	clear_bit(CIFS_INODE_PENDING_WRITERS, &cifs_inode->flags);
++	clear_bit(CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2, &cifs_inode->flags);
++	spin_lock_init(&cifs_inode->writers_lock);
++	cifs_inode->writers = 0;
+ 	cifs_inode->vfs_inode.i_blkbits = 14;  /* 2**14 = CIFS_MAX_MSGSIZE */
+ 	cifs_inode->server_eof = 0;
+ 	cifs_inode->uniqueid = 0;
+@@ -731,19 +736,26 @@ static ssize_t cifs_file_aio_write(struct kiocb *iocb, const struct iovec *iov,
+ 				   unsigned long nr_segs, loff_t pos)
+ {
+ 	struct inode *inode = file_inode(iocb->ki_filp);
++	struct cifsInodeInfo *cinode = CIFS_I(inode);
+ 	ssize_t written;
+ 	int rc;
+ 
++	written = cifs_get_writer(cinode);
++	if (written)
++		return written;
++
+ 	written = generic_file_aio_write(iocb, iov, nr_segs, pos);
+ 
+ 	if (CIFS_CACHE_WRITE(CIFS_I(inode)))
+-		return written;
++		goto out;
+ 
+ 	rc = filemap_fdatawrite(inode->i_mapping);
+ 	if (rc)
+ 		cifs_dbg(FYI, "cifs_file_aio_write: %d rc on %p inode\n",
+ 			 rc, inode);
+ 
++out:
++	cifs_put_writer(cinode);
+ 	return written;
+ }
+ 
+diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
+index c0f3718b77a8..30f6e9251a4a 100644
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -228,6 +228,8 @@ struct smb_version_operations {
+ 	/* verify the message */
+ 	int (*check_message)(char *, unsigned int);
+ 	bool (*is_oplock_break)(char *, struct TCP_Server_Info *);
++	void (*downgrade_oplock)(struct TCP_Server_Info *,
++					struct cifsInodeInfo *, bool);
+ 	/* process transaction2 response */
+ 	bool (*check_trans2)(struct mid_q_entry *, struct TCP_Server_Info *,
+ 			     char *, int);
+@@ -1113,6 +1115,12 @@ struct cifsInodeInfo {
+ 	unsigned int epoch;		/* used to track lease state changes */
+ 	bool delete_pending;		/* DELETE_ON_CLOSE is set */
+ 	bool invalid_mapping;		/* pagecache is invalid */
++	unsigned long flags;
++#define CIFS_INODE_PENDING_OPLOCK_BREAK   (0) /* oplock break in progress */
++#define CIFS_INODE_PENDING_WRITERS	  (1) /* Writes in progress */
++#define CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2 (2) /* Downgrade oplock to L2 */
++	spinlock_t writers_lock;
++	unsigned int writers;		/* Number of writers on this inode */
+ 	unsigned long time;		/* jiffies of last update of inode */
+ 	u64  server_eof;		/* current file size on server -- protected by i_lock */
+ 	u64  uniqueid;			/* server inode number */
+diff --git a/fs/cifs/cifsproto.h b/fs/cifs/cifsproto.h
+index acc4ee8ed075..ca7980a1e303 100644
+--- a/fs/cifs/cifsproto.h
++++ b/fs/cifs/cifsproto.h
+@@ -127,6 +127,9 @@ extern u64 cifs_UnixTimeToNT(struct timespec);
+ extern struct timespec cnvrtDosUnixTm(__le16 le_date, __le16 le_time,
+ 				      int offset);
+ extern void cifs_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock);
++extern int cifs_get_writer(struct cifsInodeInfo *cinode);
++extern void cifs_put_writer(struct cifsInodeInfo *cinode);
++extern void cifs_done_oplock_break(struct cifsInodeInfo *cinode);
+ extern int cifs_unlock_range(struct cifsFileInfo *cfile,
+ 			     struct file_lock *flock, const unsigned int xid);
+ extern int cifs_push_mandatory_locks(struct cifsFileInfo *cfile);
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 834fce759d80..87c4dd072cde 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -2608,12 +2608,20 @@ cifs_strict_writev(struct kiocb *iocb, const struct iovec *iov,
+ 	struct cifs_tcon *tcon = tlink_tcon(cfile->tlink);
+ 	ssize_t written;
+ 
++	written = cifs_get_writer(cinode);
++	if (written)
++		return written;
++
+ 	if (CIFS_CACHE_WRITE(cinode)) {
+ 		if (cap_unix(tcon->ses) &&
+ 		(CIFS_UNIX_FCNTL_CAP & le64_to_cpu(tcon->fsUnixInfo.Capability))
+-		    && ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NOPOSIXBRL) == 0))
+-			return generic_file_aio_write(iocb, iov, nr_segs, pos);
+-		return cifs_writev(iocb, iov, nr_segs, pos);
++		  && ((cifs_sb->mnt_cifs_flags & CIFS_MOUNT_NOPOSIXBRL) == 0)) {
++			written = generic_file_aio_write(
++					iocb, iov, nr_segs, pos);
++			goto out;
++		}
++		written = cifs_writev(iocb, iov, nr_segs, pos);
++		goto out;
+ 	}
+ 	/*
+ 	 * For non-oplocked files in strict cache mode we need to write the data
+@@ -2633,6 +2641,8 @@ cifs_strict_writev(struct kiocb *iocb, const struct iovec *iov,
+ 			 inode);
+ 		cinode->oplock = 0;
+ 	}
++out:
++	cifs_put_writer(cinode);
+ 	return written;
+ }
+ 
+@@ -3644,6 +3654,13 @@ static int cifs_launder_page(struct page *page)
+ 	return rc;
+ }
+ 
++static int
++cifs_pending_writers_wait(void *unused)
++{
++	schedule();
++	return 0;
++}
++
+ void cifs_oplock_break(struct work_struct *work)
+ {
+ 	struct cifsFileInfo *cfile = container_of(work, struct cifsFileInfo,
+@@ -3651,8 +3668,15 @@ void cifs_oplock_break(struct work_struct *work)
+ 	struct inode *inode = cfile->dentry->d_inode;
+ 	struct cifsInodeInfo *cinode = CIFS_I(inode);
+ 	struct cifs_tcon *tcon = tlink_tcon(cfile->tlink);
++	struct TCP_Server_Info *server = tcon->ses->server;
+ 	int rc = 0;
+ 
++	wait_on_bit(&cinode->flags, CIFS_INODE_PENDING_WRITERS,
++			cifs_pending_writers_wait, TASK_UNINTERRUPTIBLE);
++
++	server->ops->downgrade_oplock(server, cinode,
++		test_bit(CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2, &cinode->flags));
++
+ 	if (!CIFS_CACHE_WRITE(cinode) && CIFS_CACHE_READ(cinode) &&
+ 						cifs_has_mand_locks(cinode)) {
+ 		cifs_dbg(FYI, "Reset oplock to None for inode=%p due to mand locks\n",
+@@ -3689,6 +3713,7 @@ void cifs_oplock_break(struct work_struct *work)
+ 							     cinode);
+ 		cifs_dbg(FYI, "Oplock release rc = %d\n", rc);
+ 	}
++	cifs_done_oplock_break(cinode);
+ }
+ 
+ /*
+diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
+index 2f9f3790679d..3b0c62e622da 100644
+--- a/fs/cifs/misc.c
++++ b/fs/cifs/misc.c
+@@ -466,8 +466,22 @@ is_valid_oplock_break(char *buffer, struct TCP_Server_Info *srv)
+ 				cifs_dbg(FYI, "file id match, oplock break\n");
+ 				pCifsInode = CIFS_I(netfile->dentry->d_inode);
+ 
+-				cifs_set_oplock_level(pCifsInode,
+-					pSMB->OplockLevel ? OPLOCK_READ : 0);
++				set_bit(CIFS_INODE_PENDING_OPLOCK_BREAK,
++					&pCifsInode->flags);
++
++				/*
++				 * Set flag if the server downgrades the oplock
++				 * to L2 else clear.
++				 */
++				if (pSMB->OplockLevel)
++					set_bit(
++					   CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
++					   &pCifsInode->flags);
++				else
++					clear_bit(
++					   CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
++					   &pCifsInode->flags);
++
+ 				queue_work(cifsiod_wq,
+ 					   &netfile->oplock_break);
+ 				netfile->oplock_break_cancelled = false;
+@@ -551,6 +565,62 @@ void cifs_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock)
+ 		cinode->oplock = 0;
+ }
+ 
++static int
++cifs_oplock_break_wait(void *unused)
++{
++	schedule();
++	return signal_pending(current) ? -ERESTARTSYS : 0;
++}
++
++/*
++ * We wait for oplock breaks to be processed before we attempt to perform
++ * writes.
++ */
++int cifs_get_writer(struct cifsInodeInfo *cinode)
++{
++	int rc;
++
++start:
++	rc = wait_on_bit(&cinode->flags, CIFS_INODE_PENDING_OPLOCK_BREAK,
++				   cifs_oplock_break_wait, TASK_KILLABLE);
++	if (rc)
++		return rc;
++
++	spin_lock(&cinode->writers_lock);
++	if (!cinode->writers)
++		set_bit(CIFS_INODE_PENDING_WRITERS, &cinode->flags);
++	cinode->writers++;
++	/* Check to see if we have started servicing an oplock break */
++	if (test_bit(CIFS_INODE_PENDING_OPLOCK_BREAK, &cinode->flags)) {
++		cinode->writers--;
++		if (cinode->writers == 0) {
++			clear_bit(CIFS_INODE_PENDING_WRITERS, &cinode->flags);
++			wake_up_bit(&cinode->flags, CIFS_INODE_PENDING_WRITERS);
++		}
++		spin_unlock(&cinode->writers_lock);
++		goto start;
++	}
++	spin_unlock(&cinode->writers_lock);
++	return 0;
++}
++
++void cifs_put_writer(struct cifsInodeInfo *cinode)
++{
++	spin_lock(&cinode->writers_lock);
++	cinode->writers--;
++	if (cinode->writers == 0) {
++		clear_bit(CIFS_INODE_PENDING_WRITERS, &cinode->flags);
++		wake_up_bit(&cinode->flags, CIFS_INODE_PENDING_WRITERS);
++	}
++	spin_unlock(&cinode->writers_lock);
++}
++
++void cifs_done_oplock_break(struct cifsInodeInfo *cinode)
++{
++	clear_bit(CIFS_INODE_PENDING_OPLOCK_BREAK, &cinode->flags);
++	wake_up_bit(&cinode->flags, CIFS_INODE_PENDING_OPLOCK_BREAK);
++}
++
+ bool
+ backup_cred(struct cifs_sb_info *cifs_sb)
+ {
+diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c
+index 526fb89f9230..d1fdfa848703 100644
+--- a/fs/cifs/smb1ops.c
++++ b/fs/cifs/smb1ops.c
+@@ -372,6 +372,16 @@ coalesce_t2(char *second_buf, struct smb_hdr *target_hdr)
+ 	return 0;
+ }
+ 
++static void
++cifs_downgrade_oplock(struct TCP_Server_Info *server,
++			struct cifsInodeInfo *cinode, bool set_level2)
++{
++	if (set_level2)
++		cifs_set_oplock_level(cinode, OPLOCK_READ);
++	else
++		cifs_set_oplock_level(cinode, 0);
++}
++
+ static bool
+ cifs_check_trans2(struct mid_q_entry *mid, struct TCP_Server_Info *server,
+ 		  char *buf, int malformed)
+@@ -1019,6 +1029,7 @@ struct smb_version_operations smb1_operations = {
+ 	.clear_stats = cifs_clear_stats,
+ 	.print_stats = cifs_print_stats,
+ 	.is_oplock_break = is_valid_oplock_break,
++	.downgrade_oplock = cifs_downgrade_oplock,
+ 	.check_trans2 = cifs_check_trans2,
+ 	.need_neg = cifs_need_neg,
+ 	.negotiate = cifs_negotiate,
+diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
+index fb3966265b6e..b8021fde987d 100644
+--- a/fs/cifs/smb2misc.c
++++ b/fs/cifs/smb2misc.c
+@@ -575,9 +575,21 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)
+ 				else
+ 					cfile->oplock_break_cancelled = false;
+ 
+-				server->ops->set_oplock_level(cinode,
+-				  rsp->OplockLevel ? SMB2_OPLOCK_LEVEL_II : 0,
+-				  0, NULL);
++				set_bit(CIFS_INODE_PENDING_OPLOCK_BREAK,
++					&cinode->flags);
++
++				/*
++				 * Set flag if the server downgrades the oplock
++				 * to L2 else clear.
++				 */
++				if (rsp->OplockLevel)
++					set_bit(
++					   CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
++					   &cinode->flags);
++				else
++					clear_bit(
++					   CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
++					   &cinode->flags);
+ 
+ 				queue_work(cifsiod_wq, &cfile->oplock_break);
+ 
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index 192f51a12cf1..35ddc3ed119d 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -905,6 +905,17 @@ smb2_query_symlink(const unsigned int xid, struct cifs_tcon *tcon,
+ }
+ 
+ static void
++smb2_downgrade_oplock(struct TCP_Server_Info *server,
++			struct cifsInodeInfo *cinode, bool set_level2)
++{
++	if (set_level2)
++		server->ops->set_oplock_level(cinode, SMB2_OPLOCK_LEVEL_II,
++						0, NULL);
++	else
++		server->ops->set_oplock_level(cinode, 0, 0, NULL);
++}
++
++static void
+ smb2_set_oplock_level(struct cifsInodeInfo *cinode, __u32 oplock,
+ 		      unsigned int epoch, bool *purge_cache)
+ {
+@@ -1110,6 +1121,7 @@ struct smb_version_operations smb20_operations = {
+ 	.clear_stats = smb2_clear_stats,
+ 	.print_stats = smb2_print_stats,
+ 	.is_oplock_break = smb2_is_valid_oplock_break,
++	.downgrade_oplock = smb2_downgrade_oplock,
+ 	.need_neg = smb2_need_neg,
+ 	.negotiate = smb2_negotiate,
+ 	.negotiate_wsize = smb2_negotiate_wsize,
+@@ -1184,6 +1196,7 @@ struct smb_version_operations smb21_operations = {
+ 	.clear_stats = smb2_clear_stats,
+ 	.print_stats = smb2_print_stats,
+ 	.is_oplock_break = smb2_is_valid_oplock_break,
++	.downgrade_oplock = smb2_downgrade_oplock,
+ 	.need_neg = smb2_need_neg,
+ 	.negotiate = smb2_negotiate,
+ 	.negotiate_wsize = smb2_negotiate_wsize,
+@@ -1259,6 +1272,7 @@ struct smb_version_operations smb30_operations = {
+ 	.print_stats = smb2_print_stats,
+ 	.dump_share_caps = smb2_dump_share_caps,
+ 	.is_oplock_break = smb2_is_valid_oplock_break,
++	.downgrade_oplock = smb2_downgrade_oplock,
+ 	.need_neg = smb2_need_neg,
+ 	.negotiate = smb2_negotiate,
+ 	.negotiate_wsize = smb2_negotiate_wsize,
+diff --git a/fs/file_table.c b/fs/file_table.c
+index 5b24008ea4f6..79ecae62209a 100644
+--- a/fs/file_table.c
++++ b/fs/file_table.c
+@@ -209,10 +209,10 @@ static void drop_file_write_access(struct file *file)
+ 	struct dentry *dentry = file->f_path.dentry;
+ 	struct inode *inode = dentry->d_inode;
+ 
+-	put_write_access(inode);
+-
+ 	if (special_file(inode->i_mode))
+ 		return;
++
++	put_write_access(inode);
+ 	if (file_check_writeable(file) != 0)
+ 		return;
+ 	__mnt_drop_write(mnt);
+diff --git a/fs/open.c b/fs/open.c
+index b9ed8b25c108..2ed7325f713e 100644
+--- a/fs/open.c
++++ b/fs/open.c
+@@ -641,23 +641,12 @@ out:
+ static inline int __get_file_write_access(struct inode *inode,
+ 					  struct vfsmount *mnt)
+ {
+-	int error;
+-	error = get_write_access(inode);
++	int error = get_write_access(inode);
+ 	if (error)
+ 		return error;
+-	/*
+-	 * Do not take mount writer counts on
+-	 * special files since no writes to
+-	 * the mount itself will occur.
+-	 */
+-	if (!special_file(inode->i_mode)) {
+-		/*
+-		 * Balanced in __fput()
+-		 */
+-		error = __mnt_want_write(mnt);
+-		if (error)
+-			put_write_access(inode);
+-	}
++	error = __mnt_want_write(mnt);
++	if (error)
++		put_write_access(inode);
+ 	return error;
+ }
+ 
+@@ -690,12 +679,11 @@ static int do_dentry_open(struct file *f,
+ 
+ 	path_get(&f->f_path);
+ 	inode = f->f_inode = f->f_path.dentry->d_inode;
+-	if (f->f_mode & FMODE_WRITE) {
++	if (f->f_mode & FMODE_WRITE && !special_file(inode->i_mode)) {
+ 		error = __get_file_write_access(inode, f->f_path.mnt);
+ 		if (error)
+ 			goto cleanup_file;
+-		if (!special_file(inode->i_mode))
+-			file_take_write(f);
++		file_take_write(f);
+ 	}
+ 
+ 	f->f_mapping = inode->i_mapping;
+@@ -742,7 +730,6 @@ static int do_dentry_open(struct file *f,
+ cleanup_all:
+ 	fops_put(f->f_op);
+ 	if (f->f_mode & FMODE_WRITE) {
+-		put_write_access(inode);
+ 		if (!special_file(inode->i_mode)) {
+ 			/*
+ 			 * We don't consider this a real
+@@ -750,6 +737,7 @@ cleanup_all:
+ 			 * because it all happenend right
+ 			 * here, so just reset the state.
+ 			 */
++			put_write_access(inode);
+ 			file_reset_write(f);
+ 			__mnt_drop_write(f->f_path.mnt);
+ 		}
+diff --git a/fs/super.c b/fs/super.c
+index 80d5cf2ca765..7624267b2043 100644
+--- a/fs/super.c
++++ b/fs/super.c
+@@ -802,7 +802,10 @@ void emergency_remount(void)
+ 
+ static DEFINE_IDA(unnamed_dev_ida);
+ static DEFINE_SPINLOCK(unnamed_dev_lock);/* protects the above */
+-static int unnamed_dev_start = 0; /* don't bother trying below it */
++/* Many userspace utilities consider an FSID of 0 invalid.
++ * Always return at least 1 from get_anon_bdev.
++ */
++static int unnamed_dev_start = 1;
+ 
+ int get_anon_bdev(dev_t *p)
+ {
+diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
+index 34c7bdc06014..38a743705cc6 100644
+--- a/include/asm-generic/pgtable.h
++++ b/include/asm-generic/pgtable.h
+@@ -680,24 +680,35 @@ static inline int pmd_numa(pmd_t pmd)
+ #ifndef pte_mknonnuma
+ static inline pte_t pte_mknonnuma(pte_t pte)
+ {
+-	pte = pte_clear_flags(pte, _PAGE_NUMA);
+-	return pte_set_flags(pte, _PAGE_PRESENT|_PAGE_ACCESSED);
++	pteval_t val = pte_val(pte);
++
++	val &= ~_PAGE_NUMA;
++	val |= (_PAGE_PRESENT|_PAGE_ACCESSED);
++	return __pte(val);
+ }
+ #endif
+ 
+ #ifndef pmd_mknonnuma
+ static inline pmd_t pmd_mknonnuma(pmd_t pmd)
+ {
+-	pmd = pmd_clear_flags(pmd, _PAGE_NUMA);
+-	return pmd_set_flags(pmd, _PAGE_PRESENT|_PAGE_ACCESSED);
++	pmdval_t val = pmd_val(pmd);
++
++	val &= ~_PAGE_NUMA;
++	val |= (_PAGE_PRESENT|_PAGE_ACCESSED);
++
++	return __pmd(val);
+ }
+ #endif
+ 
+ #ifndef pte_mknuma
+ static inline pte_t pte_mknuma(pte_t pte)
+ {
+-	pte = pte_set_flags(pte, _PAGE_NUMA);
+-	return pte_clear_flags(pte, _PAGE_PRESENT);
++	pteval_t val = pte_val(pte);
++
++	val &= ~_PAGE_PRESENT;
++	val |= _PAGE_NUMA;
++
++	return __pte(val);
+ }
+ #endif
+ 
+@@ -716,8 +727,12 @@ static inline void ptep_set_numa(struct mm_struct *mm, unsigned long addr,
+ #ifndef pmd_mknuma
+ static inline pmd_t pmd_mknuma(pmd_t pmd)
+ {
+-	pmd = pmd_set_flags(pmd, _PAGE_NUMA);
+-	return pmd_clear_flags(pmd, _PAGE_PRESENT);
++	pmdval_t val = pmd_val(pmd);
++
++	val &= ~_PAGE_PRESENT;
++	val |= _PAGE_NUMA;
++
++	return __pmd(val);
+ }
+ #endif
+ 
+diff --git a/include/linux/if_macvlan.h b/include/linux/if_macvlan.h
+index 7c8b20b120ea..a9a53b12397b 100644
+--- a/include/linux/if_macvlan.h
++++ b/include/linux/if_macvlan.h
+@@ -56,6 +56,7 @@ struct macvlan_dev {
+ 	int			numqueues;
+ 	netdev_features_t	tap_features;
+ 	int			minor;
++	int			nest_level;
+ };
+ 
+ static inline void macvlan_count_rx(const struct macvlan_dev *vlan,
+diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h
+index bbedfb56bd66..72ba6f5cbc8d 100644
+--- a/include/linux/if_vlan.h
++++ b/include/linux/if_vlan.h
+@@ -73,7 +73,7 @@ static inline struct vlan_ethhdr *vlan_eth_hdr(const struct sk_buff *skb)
+ /* found in socket.c */
+ extern void vlan_ioctl_set(int (*hook)(struct net *, void __user *));
+ 
+-static inline int is_vlan_dev(struct net_device *dev)
++static inline bool is_vlan_dev(struct net_device *dev)
+ {
+         return dev->priv_flags & IFF_802_1Q_VLAN;
+ }
+@@ -158,6 +158,7 @@ struct vlan_dev_priv {
+ #ifdef CONFIG_NET_POLL_CONTROLLER
+ 	struct netpoll				*netpoll;
+ #endif
++	unsigned int				nest_level;
+ };
+ 
+ static inline struct vlan_dev_priv *vlan_dev_priv(const struct net_device *dev)
+diff --git a/include/linux/net.h b/include/linux/net.h
+index 94734a6259a4..17d83393afcc 100644
+--- a/include/linux/net.h
++++ b/include/linux/net.h
+@@ -248,24 +248,17 @@ do {								\
+ bool __net_get_random_once(void *buf, int nbytes, bool *done,
+ 			   struct static_key *done_key);
+ 
+-#ifdef HAVE_JUMP_LABEL
+-#define ___NET_RANDOM_STATIC_KEY_INIT ((struct static_key) \
+-		{ .enabled = ATOMIC_INIT(0), .entries = (void *)1 })
+-#else /* !HAVE_JUMP_LABEL */
+-#define ___NET_RANDOM_STATIC_KEY_INIT STATIC_KEY_INIT_FALSE
+-#endif /* HAVE_JUMP_LABEL */
+-
+ #define net_get_random_once(buf, nbytes)				\
+ 	({								\
+ 		bool ___ret = false;					\
+ 		static bool ___done = false;				\
+-		static struct static_key ___done_key =			\
+-			___NET_RANDOM_STATIC_KEY_INIT;			\
+-		if (!static_key_true(&___done_key))			\
++		static struct static_key ___once_key =			\
++			STATIC_KEY_INIT_TRUE;				\
++		if (static_key_true(&___once_key))			\
+ 			___ret = __net_get_random_once(buf,		\
+ 						       nbytes,		\
+ 						       &___done,	\
+-						       &___done_key);	\
++						       &___once_key);	\
+ 		___ret;							\
+ 	})
+ 
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index daafd9561cbc..911718fa92ed 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -1145,6 +1145,7 @@ struct net_device_ops {
+ 	netdev_tx_t		(*ndo_dfwd_start_xmit) (struct sk_buff *skb,
+ 							struct net_device *dev,
+ 							void *priv);
++	int			(*ndo_get_lock_subclass)(struct net_device *dev);
+ };
+ 
+ /*
+@@ -2861,7 +2862,12 @@ static inline void netif_addr_lock(struct net_device *dev)
+ 
+ static inline void netif_addr_lock_nested(struct net_device *dev)
+ {
+-	spin_lock_nested(&dev->addr_list_lock, SINGLE_DEPTH_NESTING);
++	int subclass = SINGLE_DEPTH_NESTING;
++
++	if (dev->netdev_ops->ndo_get_lock_subclass)
++		subclass = dev->netdev_ops->ndo_get_lock_subclass(dev);
++
++	spin_lock_nested(&dev->addr_list_lock, subclass);
+ }
+ 
+ static inline void netif_addr_lock_bh(struct net_device *dev)
+@@ -2988,6 +2994,14 @@ void *netdev_lower_get_next_private_rcu(struct net_device *dev,
+ 	     priv; \
+ 	     priv = netdev_lower_get_next_private_rcu(dev, &(iter)))
+ 
++void *netdev_lower_get_next(struct net_device *dev,
++				struct list_head **iter);
++#define netdev_for_each_lower_dev(dev, ldev, iter) \
++	for (iter = &(dev)->adj_list.lower, \
++	     ldev = netdev_lower_get_next(dev, &(iter)); \
++	     ldev; \
++	     ldev = netdev_lower_get_next(dev, &(iter)))
++
+ void *netdev_adjacent_get_private(struct list_head *adj_list);
+ void *netdev_lower_get_first_private_rcu(struct net_device *dev);
+ struct net_device *netdev_master_upper_dev_get(struct net_device *dev);
+@@ -3003,6 +3017,8 @@ void netdev_upper_dev_unlink(struct net_device *dev,
+ void netdev_adjacent_rename_links(struct net_device *dev, char *oldname);
+ void *netdev_lower_dev_get_private(struct net_device *dev,
+ 				   struct net_device *lower_dev);
++int dev_get_nest_level(struct net_device *dev,
++		       bool (*type_check)(struct net_device *dev));
+ int skb_checksum_help(struct sk_buff *skb);
+ struct sk_buff *__skb_gso_segment(struct sk_buff *skb,
+ 				  netdev_features_t features, bool tx_path);
+diff --git a/include/linux/preempt.h b/include/linux/preempt.h
+index de83b4eb1642..1841b58cf173 100644
+--- a/include/linux/preempt.h
++++ b/include/linux/preempt.h
+@@ -15,6 +15,8 @@
+  */
+ #define PREEMPT_NEED_RESCHED	0x80000000
+ 
++#define tif_need_resched() test_thread_flag(TIF_NEED_RESCHED)
++
+ #include <asm/preempt.h>
+ 
+ #if defined(CONFIG_DEBUG_PREEMPT) || defined(CONFIG_PREEMPT_TRACER)
+diff --git a/include/linux/rtnetlink.h b/include/linux/rtnetlink.h
+index 8e3e66ac0a52..953937ea5233 100644
+--- a/include/linux/rtnetlink.h
++++ b/include/linux/rtnetlink.h
+@@ -4,6 +4,7 @@
+ 
+ #include <linux/mutex.h>
+ #include <linux/netdevice.h>
++#include <linux/wait.h>
+ #include <uapi/linux/rtnetlink.h>
+ 
+ extern int rtnetlink_send(struct sk_buff *skb, struct net *net, u32 pid, u32 group, int echo);
+@@ -22,6 +23,10 @@ extern void rtnl_lock(void);
+ extern void rtnl_unlock(void);
+ extern int rtnl_trylock(void);
+ extern int rtnl_is_locked(void);
++
++extern wait_queue_head_t netdev_unregistering_wq;
++extern struct mutex net_mutex;
++
+ #ifdef CONFIG_PROVE_LOCKING
+ extern int lockdep_rtnl_is_held(void);
+ #else
+diff --git a/include/linux/sched.h b/include/linux/sched.h
+index a781dec1cd0b..ccd0c6f24f2c 100644
+--- a/include/linux/sched.h
++++ b/include/linux/sched.h
+@@ -1688,6 +1688,24 @@ static inline pid_t task_tgid_vnr(struct task_struct *tsk)
+ }
+ 
+ 
++static int pid_alive(const struct task_struct *p);
++static inline pid_t task_ppid_nr_ns(const struct task_struct *tsk, struct pid_namespace *ns)
++{
++	pid_t pid = 0;
++
++	rcu_read_lock();
++	if (pid_alive(tsk))
++		pid = task_tgid_nr_ns(rcu_dereference(tsk->real_parent), ns);
++	rcu_read_unlock();
++
++	return pid;
++}
++
++static inline pid_t task_ppid_nr(const struct task_struct *tsk)
++{
++	return task_ppid_nr_ns(tsk, &init_pid_ns);
++}
++
+ static inline pid_t task_pgrp_nr_ns(struct task_struct *tsk,
+ 					struct pid_namespace *ns)
+ {
+@@ -1727,7 +1745,7 @@ static inline pid_t task_pgrp_nr(struct task_struct *tsk)
+  *
+  * Return: 1 if the process is alive. 0 otherwise.
+  */
+-static inline int pid_alive(struct task_struct *p)
++static inline int pid_alive(const struct task_struct *p)
+ {
+ 	return p->pids[PIDTYPE_PID].pid != NULL;
+ }
+diff --git a/include/linux/sock_diag.h b/include/linux/sock_diag.h
+index 54f91d35e5fd..302ab805b0bb 100644
+--- a/include/linux/sock_diag.h
++++ b/include/linux/sock_diag.h
+@@ -23,7 +23,7 @@ int sock_diag_check_cookie(void *sk, __u32 *cookie);
+ void sock_diag_save_cookie(void *sk, __u32 *cookie);
+ 
+ int sock_diag_put_meminfo(struct sock *sk, struct sk_buff *skb, int attr);
+-int sock_diag_put_filterinfo(struct user_namespace *user_ns, struct sock *sk,
++int sock_diag_put_filterinfo(struct sock *sk,
+ 			     struct sk_buff *skb, int attrtype);
+ 
+ #endif
+diff --git a/include/linux/thread_info.h b/include/linux/thread_info.h
+index fddbe2023a5d..a629e4b23217 100644
+--- a/include/linux/thread_info.h
++++ b/include/linux/thread_info.h
+@@ -118,8 +118,6 @@ static inline __deprecated void set_need_resched(void)
+ 	 */
+ }
+ 
+-#define tif_need_resched() test_thread_flag(TIF_NEED_RESCHED)
+-
+ #if defined TIF_RESTORE_SIGMASK && !defined HAVE_SET_RESTORE_SIGMASK
+ /*
+  * An arch can define its own version of set_restore_sigmask() to get the
+diff --git a/include/net/af_vsock.h b/include/net/af_vsock.h
+index 7d64d3609ec9..428277869400 100644
+--- a/include/net/af_vsock.h
++++ b/include/net/af_vsock.h
+@@ -155,7 +155,11 @@ struct vsock_transport {
+ 
+ /**** CORE ****/
+ 
+-int vsock_core_init(const struct vsock_transport *t);
++int __vsock_core_init(const struct vsock_transport *t, struct module *owner);
++static inline int vsock_core_init(const struct vsock_transport *t)
++{
++	return __vsock_core_init(t, THIS_MODULE);
++}
+ void vsock_core_exit(void);
+ 
+ /**** UTILS ****/
+diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
+index 017badb1aec7..2e74c6cfa612 100644
+--- a/include/net/ip6_route.h
++++ b/include/net/ip6_route.h
+@@ -32,6 +32,11 @@ struct route_info {
+ #define RT6_LOOKUP_F_SRCPREF_PUBLIC	0x00000010
+ #define RT6_LOOKUP_F_SRCPREF_COA	0x00000020
+ 
++/* We do not (yet ?) support IPv6 jumbograms (RFC 2675)
++ * Unlike IPv4, hdr->seg_len doesn't include the IPv6 header
++ */
++#define IP6_MAX_MTU (0xFFFF + sizeof(struct ipv6hdr))
++
+ /*
+  * rt6_srcprefs2flags() and rt6_flags2srcprefs() translate
+  * between IPV6_ADDR_PREFERENCES socket option values
+diff --git a/include/net/netfilter/nf_conntrack_extend.h b/include/net/netfilter/nf_conntrack_extend.h
+index 956b175523ff..55d15049ab2f 100644
+--- a/include/net/netfilter/nf_conntrack_extend.h
++++ b/include/net/netfilter/nf_conntrack_extend.h
+@@ -47,8 +47,8 @@ enum nf_ct_ext_id {
+ /* Extensions: optional stuff which isn't permanently in struct. */
+ struct nf_ct_ext {
+ 	struct rcu_head rcu;
+-	u8 offset[NF_CT_EXT_NUM];
+-	u8 len;
++	u16 offset[NF_CT_EXT_NUM];
++	u16 len;
+ 	char data[0];
+ };
+ 
+diff --git a/include/net/netfilter/nf_tables_core.h b/include/net/netfilter/nf_tables_core.h
+index cf2b7ae2b9d8..a75fc8e27cd6 100644
+--- a/include/net/netfilter/nf_tables_core.h
++++ b/include/net/netfilter/nf_tables_core.h
+@@ -13,6 +13,16 @@ struct nft_cmp_fast_expr {
+ 	u8			len;
+ };
+ 
++/* Calculate the mask for the nft_cmp_fast expression. On big endian the
++ * mask needs to include the *upper* bytes when interpreting that data as
++ * something smaller than the full u32, therefore a cpu_to_le32 is done.
++ */
++static inline u32 nft_cmp_fast_mask(unsigned int len)
++{
++	return cpu_to_le32(~0U >> (FIELD_SIZEOF(struct nft_cmp_fast_expr,
++						data) * BITS_PER_BYTE - len));
++}
++
+ extern const struct nft_expr_ops nft_cmp_fast_ops;
+ 
+ int nft_cmp_module_init(void);
+diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
+index 6ee76c804893..0dfcc92600e8 100644
+--- a/include/net/sctp/structs.h
++++ b/include/net/sctp/structs.h
+@@ -1241,6 +1241,7 @@ struct sctp_endpoint {
+ 	/* SCTP-AUTH: endpoint shared keys */
+ 	struct list_head endpoint_shared_keys;
+ 	__u16 active_key_id;
++	__u8  auth_enable;
+ };
+ 
+ /* Recover the outter endpoint structure. */
+@@ -1269,7 +1270,8 @@ struct sctp_endpoint *sctp_endpoint_is_match(struct sctp_endpoint *,
+ int sctp_has_association(struct net *net, const union sctp_addr *laddr,
+ 			 const union sctp_addr *paddr);
+ 
+-int sctp_verify_init(struct net *net, const struct sctp_association *asoc,
++int sctp_verify_init(struct net *net, const struct sctp_endpoint *ep,
++		     const struct sctp_association *asoc,
+ 		     sctp_cid_t, sctp_init_chunk_t *peer_init,
+ 		     struct sctp_chunk *chunk, struct sctp_chunk **err_chunk);
+ int sctp_process_init(struct sctp_association *, struct sctp_chunk *chunk,
+@@ -1653,6 +1655,17 @@ struct sctp_association {
+ 	/* This is the last advertised value of rwnd over a SACK chunk. */
+ 	__u32 a_rwnd;
+ 
++	/* Number of bytes by which the rwnd has slopped.  The rwnd is allowed
++	 * to slop over a maximum of the association's frag_point.
++	 */
++	__u32 rwnd_over;
++
++	/* Keeps treack of rwnd pressure.  This happens when we have
++	 * a window, but not recevie buffer (i.e small packets).  This one
++	 * is releases slowly (1 PMTU at a time ).
++	 */
++	__u32 rwnd_press;
++
+ 	/* This is the sndbuf size in use for the association.
+ 	 * This corresponds to the sndbuf size for the association,
+ 	 * as specified in the sk->sndbuf.
+@@ -1881,7 +1894,8 @@ void sctp_assoc_update(struct sctp_association *old,
+ __u32 sctp_association_get_next_tsn(struct sctp_association *);
+ 
+ void sctp_assoc_sync_pmtu(struct sock *, struct sctp_association *);
+-void sctp_assoc_rwnd_update(struct sctp_association *, bool);
++void sctp_assoc_rwnd_increase(struct sctp_association *, unsigned int);
++void sctp_assoc_rwnd_decrease(struct sctp_association *, unsigned int);
+ void sctp_assoc_set_primary(struct sctp_association *,
+ 			    struct sctp_transport *);
+ void sctp_assoc_del_nonprimary_peers(struct sctp_association *,
+diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
+index d65fbec2533d..b4f1effc9216 100644
+--- a/include/scsi/scsi_device.h
++++ b/include/scsi/scsi_device.h
+@@ -257,7 +257,7 @@ struct scsi_target {
+ 	struct list_head	siblings;
+ 	struct list_head	devices;
+ 	struct device		dev;
+-	unsigned int		reap_ref; /* protected by the host lock */
++	struct kref		reap_ref; /* last put renders target invisible */
+ 	unsigned int		channel;
+ 	unsigned int		id; /* target id ... replace
+ 				     * scsi_device.id eventually */
+@@ -284,7 +284,6 @@ struct scsi_target {
+ #define SCSI_DEFAULT_TARGET_BLOCKED	3
+ 
+ 	char			scsi_level;
+-	struct execute_work	ew;
+ 	enum scsi_target_state	state;
+ 	void 			*hostdata; /* available to low-level driver */
+ 	unsigned long		starget_data[0]; /* for the transport */
+diff --git a/include/trace/events/block.h b/include/trace/events/block.h
+index e76ae19a8d6f..e8a5eca1dbe5 100644
+--- a/include/trace/events/block.h
++++ b/include/trace/events/block.h
+@@ -132,6 +132,7 @@ DEFINE_EVENT(block_rq_with_error, block_rq_requeue,
+  * block_rq_complete - block IO operation completed by device driver
+  * @q: queue containing the block operation request
+  * @rq: block operations request
++ * @nr_bytes: number of completed bytes
+  *
+  * The block_rq_complete tracepoint event indicates that some portion
+  * of operation request has been completed by the device driver.  If
+@@ -139,11 +140,37 @@ DEFINE_EVENT(block_rq_with_error, block_rq_requeue,
+  * do for the request. If @rq->bio is non-NULL then there is
+  * additional work required to complete the request.
+  */
+-DEFINE_EVENT(block_rq_with_error, block_rq_complete,
++TRACE_EVENT(block_rq_complete,
+ 
+-	TP_PROTO(struct request_queue *q, struct request *rq),
++	TP_PROTO(struct request_queue *q, struct request *rq,
++		 unsigned int nr_bytes),
+ 
+-	TP_ARGS(q, rq)
++	TP_ARGS(q, rq, nr_bytes),
++
++	TP_STRUCT__entry(
++		__field(  dev_t,	dev			)
++		__field(  sector_t,	sector			)
++		__field(  unsigned int,	nr_sector		)
++		__field(  int,		errors			)
++		__array(  char,		rwbs,	RWBS_LEN	)
++		__dynamic_array( char,	cmd,	blk_cmd_buf_len(rq)	)
++	),
++
++	TP_fast_assign(
++		__entry->dev	   = rq->rq_disk ? disk_devt(rq->rq_disk) : 0;
++		__entry->sector    = blk_rq_pos(rq);
++		__entry->nr_sector = nr_bytes >> 9;
++		__entry->errors    = rq->errors;
++
++		blk_fill_rwbs(__entry->rwbs, rq->cmd_flags, nr_bytes);
++		blk_dump_cmd(__get_str(cmd), rq);
++	),
++
++	TP_printk("%d,%d %s (%s) %llu + %u [%d]",
++		  MAJOR(__entry->dev), MINOR(__entry->dev),
++		  __entry->rwbs, __get_str(cmd),
++		  (unsigned long long)__entry->sector,
++		  __entry->nr_sector, __entry->errors)
+ );
+ 
+ DECLARE_EVENT_CLASS(block_rq,
+diff --git a/init/Kconfig b/init/Kconfig
+index d56cb03c1b49..93c5ef0c5210 100644
+--- a/init/Kconfig
++++ b/init/Kconfig
+@@ -1621,6 +1621,18 @@ config MMAP_ALLOW_UNINITIALIZED
+ 
+ 	  See Documentation/nommu-mmap.txt for more information.
+ 
++config SYSTEM_TRUSTED_KEYRING
++	bool "Provide system-wide ring of trusted keys"
++	depends on KEYS
++	help
++	  Provide a system keyring to which trusted keys can be added.  Keys in
++	  the keyring are considered to be trusted.  Keys may be added at will
++	  by the kernel from compiled-in data and from hardware key stores, but
++	  userspace may only add extra keys if those keys can be verified by
++	  keys already in the keyring.
++
++	  Keys in this keyring are used by module signature checking.
++
+ config PROFILING
+ 	bool "Profiling support"
+ 	help
+@@ -1656,18 +1668,6 @@ config BASE_SMALL
+ 	default 0 if BASE_FULL
+ 	default 1 if !BASE_FULL
+ 
+-config SYSTEM_TRUSTED_KEYRING
+-	bool "Provide system-wide ring of trusted keys"
+-	depends on KEYS
+-	help
+-	  Provide a system keyring to which trusted keys can be added.  Keys in
+-	  the keyring are considered to be trusted.  Keys may be added at will
+-	  by the kernel from compiled-in data and from hardware key stores, but
+-	  userspace may only add extra keys if those keys can be verified by
+-	  keys already in the keyring.
+-
+-	  Keys in this keyring are used by module signature checking.
+-
+ menuconfig MODULES
+ 	bool "Enable loadable module support"
+ 	option modules
+diff --git a/kernel/audit.c b/kernel/audit.c
+index 95a20f3f52f1..d5f31c17813a 100644
+--- a/kernel/audit.c
++++ b/kernel/audit.c
+@@ -1829,10 +1829,10 @@ void audit_log_task_info(struct audit_buffer *ab, struct task_struct *tsk)
+ 	spin_unlock_irq(&tsk->sighand->siglock);
+ 
+ 	audit_log_format(ab,
+-			 " ppid=%ld pid=%d auid=%u uid=%u gid=%u"
++			 " ppid=%d pid=%d auid=%u uid=%u gid=%u"
+ 			 " euid=%u suid=%u fsuid=%u"
+ 			 " egid=%u sgid=%u fsgid=%u tty=%s ses=%u",
+-			 sys_getppid(),
++			 task_ppid_nr(tsk),
+ 			 tsk->pid,
+ 			 from_kuid(&init_user_ns, audit_get_loginuid(tsk)),
+ 			 from_kuid(&init_user_ns, cred->uid),
+diff --git a/kernel/auditsc.c b/kernel/auditsc.c
+index 7aef2f4b6c64..3b29605ea1b2 100644
+--- a/kernel/auditsc.c
++++ b/kernel/auditsc.c
+@@ -459,7 +459,7 @@ static int audit_filter_rules(struct task_struct *tsk,
+ 		case AUDIT_PPID:
+ 			if (ctx) {
+ 				if (!ctx->ppid)
+-					ctx->ppid = sys_getppid();
++					ctx->ppid = task_ppid_nr(tsk);
+ 				result = audit_comparator(ctx->ppid, f->op, f->val);
+ 			}
+ 			break;
+diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
+index 20b2fe37d105..0de9d7f5045c 100644
+--- a/kernel/time/tick-common.c
++++ b/kernel/time/tick-common.c
+@@ -276,7 +276,7 @@ static bool tick_check_preferred(struct clock_event_device *curdev,
+ bool tick_check_replacement(struct clock_event_device *curdev,
+ 			    struct clock_event_device *newdev)
+ {
+-	if (tick_check_percpu(curdev, newdev, smp_processor_id()))
++	if (!tick_check_percpu(curdev, newdev, smp_processor_id()))
+ 		return false;
+ 
+ 	return tick_check_preferred(curdev, newdev);
+diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
+index 9f8af69c67ec..6558b7ac112d 100644
+--- a/kernel/time/tick-sched.c
++++ b/kernel/time/tick-sched.c
+@@ -84,6 +84,9 @@ static void tick_do_update_jiffies64(ktime_t now)
+ 
+ 		/* Keep the tick_next_period variable up to date */
+ 		tick_next_period = ktime_add(last_jiffies_update, tick_period);
++	} else {
++		write_sequnlock(&jiffies_lock);
++		return;
+ 	}
+ 	write_sequnlock(&jiffies_lock);
+ 	update_wall_time();
+@@ -967,7 +970,7 @@ static void tick_nohz_switch_to_nohz(void)
+ 	struct tick_sched *ts = &__get_cpu_var(tick_cpu_sched);
+ 	ktime_t next;
+ 
+-	if (!tick_nohz_active)
++	if (!tick_nohz_enabled)
+ 		return;
+ 
+ 	local_irq_disable();
+diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
+index b418cb0d7242..4f3a3c03eadb 100644
+--- a/kernel/trace/blktrace.c
++++ b/kernel/trace/blktrace.c
+@@ -702,6 +702,7 @@ void blk_trace_shutdown(struct request_queue *q)
+  * blk_add_trace_rq - Add a trace for a request oriented action
+  * @q:		queue the io is for
+  * @rq:		the source request
++ * @nr_bytes:	number of completed bytes
+  * @what:	the action
+  *
+  * Description:
+@@ -709,7 +710,7 @@ void blk_trace_shutdown(struct request_queue *q)
+  *
+  **/
+ static void blk_add_trace_rq(struct request_queue *q, struct request *rq,
+-			     u32 what)
++			     unsigned int nr_bytes, u32 what)
+ {
+ 	struct blk_trace *bt = q->blk_trace;
+ 
+@@ -718,11 +719,11 @@ static void blk_add_trace_rq(struct request_queue *q, struct request *rq,
+ 
+ 	if (rq->cmd_type == REQ_TYPE_BLOCK_PC) {
+ 		what |= BLK_TC_ACT(BLK_TC_PC);
+-		__blk_add_trace(bt, 0, blk_rq_bytes(rq), rq->cmd_flags,
++		__blk_add_trace(bt, 0, nr_bytes, rq->cmd_flags,
+ 				what, rq->errors, rq->cmd_len, rq->cmd);
+ 	} else  {
+ 		what |= BLK_TC_ACT(BLK_TC_FS);
+-		__blk_add_trace(bt, blk_rq_pos(rq), blk_rq_bytes(rq),
++		__blk_add_trace(bt, blk_rq_pos(rq), nr_bytes,
+ 				rq->cmd_flags, what, rq->errors, 0, NULL);
+ 	}
+ }
+@@ -730,33 +731,34 @@ static void blk_add_trace_rq(struct request_queue *q, struct request *rq,
+ static void blk_add_trace_rq_abort(void *ignore,
+ 				   struct request_queue *q, struct request *rq)
+ {
+-	blk_add_trace_rq(q, rq, BLK_TA_ABORT);
++	blk_add_trace_rq(q, rq, blk_rq_bytes(rq), BLK_TA_ABORT);
+ }
+ 
+ static void blk_add_trace_rq_insert(void *ignore,
+ 				    struct request_queue *q, struct request *rq)
+ {
+-	blk_add_trace_rq(q, rq, BLK_TA_INSERT);
++	blk_add_trace_rq(q, rq, blk_rq_bytes(rq), BLK_TA_INSERT);
+ }
+ 
+ static void blk_add_trace_rq_issue(void *ignore,
+ 				   struct request_queue *q, struct request *rq)
+ {
+-	blk_add_trace_rq(q, rq, BLK_TA_ISSUE);
++	blk_add_trace_rq(q, rq, blk_rq_bytes(rq), BLK_TA_ISSUE);
+ }
+ 
+ static void blk_add_trace_rq_requeue(void *ignore,
+ 				     struct request_queue *q,
+ 				     struct request *rq)
+ {
+-	blk_add_trace_rq(q, rq, BLK_TA_REQUEUE);
++	blk_add_trace_rq(q, rq, blk_rq_bytes(rq), BLK_TA_REQUEUE);
+ }
+ 
+ static void blk_add_trace_rq_complete(void *ignore,
+ 				      struct request_queue *q,
+-				      struct request *rq)
++				      struct request *rq,
++				      unsigned int nr_bytes)
+ {
+-	blk_add_trace_rq(q, rq, BLK_TA_COMPLETE);
++	blk_add_trace_rq(q, rq, nr_bytes, BLK_TA_COMPLETE);
+ }
+ 
+ /**
+diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
+index 8efbb69b04f0..6d6a789e579e 100644
+--- a/kernel/trace/trace_events_trigger.c
++++ b/kernel/trace/trace_events_trigger.c
+@@ -77,7 +77,7 @@ event_triggers_call(struct ftrace_event_file *file, void *rec)
+ 			data->ops->func(data);
+ 			continue;
+ 		}
+-		filter = rcu_dereference(data->filter);
++		filter = rcu_dereference_sched(data->filter);
+ 		if (filter && !filter_match_preds(filter, rec))
+ 			continue;
+ 		if (data->cmd_ops->post_trigger) {
+diff --git a/kernel/trace/trace_uprobe.c b/kernel/trace/trace_uprobe.c
+index 79e52d93860b..bd0c9b133b54 100644
+--- a/kernel/trace/trace_uprobe.c
++++ b/kernel/trace/trace_uprobe.c
+@@ -728,9 +728,15 @@ static int uprobe_buffer_enable(void)
+ 
+ static void uprobe_buffer_disable(void)
+ {
++	int cpu;
++
+ 	BUG_ON(!mutex_is_locked(&event_mutex));
+ 
+ 	if (--uprobe_buffer_refcnt == 0) {
++		for_each_possible_cpu(cpu)
++			free_page((unsigned long)per_cpu_ptr(uprobe_cpu_buffer,
++							     cpu)->buf);
++
+ 		free_percpu(uprobe_cpu_buffer);
+ 		uprobe_cpu_buffer = NULL;
+ 	}
+diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
+index 031cc5655a51..63630aef3bd3 100644
+--- a/kernel/tracepoint.c
++++ b/kernel/tracepoint.c
+@@ -641,6 +641,9 @@ static int tracepoint_module_coming(struct module *mod)
+ 	struct tp_module *tp_mod, *iter;
+ 	int ret = 0;
+ 
++	if (!mod->num_tracepoints)
++		return 0;
++
+ 	/*
+ 	 * We skip modules that taint the kernel, especially those with different
+ 	 * module headers (for forced load), to make sure we don't cause a crash.
+@@ -684,6 +687,9 @@ static int tracepoint_module_going(struct module *mod)
+ {
+ 	struct tp_module *pos;
+ 
++	if (!mod->num_tracepoints)
++		return 0;
++
+ 	mutex_lock(&tracepoints_mutex);
+ 	tracepoint_update_probe_range(mod->tracepoints_ptrs,
+ 		mod->tracepoints_ptrs + mod->num_tracepoints);
+diff --git a/mm/huge_memory.c b/mm/huge_memory.c
+index 1546655a2d78..1c42d0c36d0b 100644
+--- a/mm/huge_memory.c
++++ b/mm/huge_memory.c
+@@ -1611,16 +1611,23 @@ pmd_t *page_check_address_pmd(struct page *page,
+ 			      enum page_check_address_pmd_flag flag,
+ 			      spinlock_t **ptl)
+ {
++	pgd_t *pgd;
++	pud_t *pud;
+ 	pmd_t *pmd;
+ 
+ 	if (address & ~HPAGE_PMD_MASK)
+ 		return NULL;
+ 
+-	pmd = mm_find_pmd(mm, address);
+-	if (!pmd)
++	pgd = pgd_offset(mm, address);
++	if (!pgd_present(*pgd))
+ 		return NULL;
++	pud = pud_offset(pgd, address);
++	if (!pud_present(*pud))
++		return NULL;
++	pmd = pmd_offset(pud, address);
++
+ 	*ptl = pmd_lock(mm, pmd);
+-	if (pmd_none(*pmd))
++	if (!pmd_present(*pmd))
+ 		goto unlock;
+ 	if (pmd_page(*pmd) != page)
+ 		goto unlock;
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 2de3c845f03a..06a9bc0a3120 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -1134,6 +1134,7 @@ static void return_unused_surplus_pages(struct hstate *h,
+ 	while (nr_pages--) {
+ 		if (!free_pool_huge_page(h, &node_states[N_MEMORY], 1))
+ 			break;
++		cond_resched_lock(&hugetlb_lock);
+ 	}
+ }
+ 
+diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
+index 175273f38cb1..44ebd5c2cd4a 100644
+--- a/net/8021q/vlan.c
++++ b/net/8021q/vlan.c
+@@ -169,6 +169,7 @@ int register_vlan_dev(struct net_device *dev)
+ 	if (err < 0)
+ 		goto out_uninit_mvrp;
+ 
++	vlan->nest_level = dev_get_nest_level(real_dev, is_vlan_dev) + 1;
+ 	err = register_netdevice(dev);
+ 	if (err < 0)
+ 		goto out_uninit_mvrp;
+diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
+index 27bfe2f8e2de..cc0d21895420 100644
+--- a/net/8021q/vlan_dev.c
++++ b/net/8021q/vlan_dev.c
+@@ -524,6 +524,11 @@ static void vlan_dev_set_lockdep_class(struct net_device *dev, int subclass)
+ 	netdev_for_each_tx_queue(dev, vlan_dev_set_lockdep_one, &subclass);
+ }
+ 
++static int vlan_dev_get_lock_subclass(struct net_device *dev)
++{
++	return vlan_dev_priv(dev)->nest_level;
++}
++
+ static const struct header_ops vlan_header_ops = {
+ 	.create	 = vlan_dev_hard_header,
+ 	.rebuild = vlan_dev_rebuild_header,
+@@ -559,7 +564,7 @@ static const struct net_device_ops vlan_netdev_ops;
+ static int vlan_dev_init(struct net_device *dev)
+ {
+ 	struct net_device *real_dev = vlan_dev_priv(dev)->real_dev;
+-	int subclass = 0, i;
++	int i;
+ 
+ 	netif_carrier_off(dev);
+ 
+@@ -608,10 +613,7 @@ static int vlan_dev_init(struct net_device *dev)
+ 
+ 	SET_NETDEV_DEVTYPE(dev, &vlan_type);
+ 
+-	if (is_vlan_dev(real_dev))
+-		subclass = 1;
+-
+-	vlan_dev_set_lockdep_class(dev, subclass);
++	vlan_dev_set_lockdep_class(dev, vlan_dev_get_lock_subclass(dev));
+ 
+ 	vlan_dev_priv(dev)->vlan_pcpu_stats = alloc_percpu(struct vlan_pcpu_stats);
+ 	if (!vlan_dev_priv(dev)->vlan_pcpu_stats)
+@@ -791,6 +793,7 @@ static const struct net_device_ops vlan_netdev_ops = {
+ 	.ndo_netpoll_cleanup	= vlan_dev_netpoll_cleanup,
+ #endif
+ 	.ndo_fix_features	= vlan_dev_fix_features,
++	.ndo_get_lock_subclass  = vlan_dev_get_lock_subclass,
+ };
+ 
+ void vlan_setup(struct net_device *dev)
+diff --git a/net/batman-adv/bat_iv_ogm.c b/net/batman-adv/bat_iv_ogm.c
+index 8323bced8e5b..d074d06ce094 100644
+--- a/net/batman-adv/bat_iv_ogm.c
++++ b/net/batman-adv/bat_iv_ogm.c
+@@ -1545,6 +1545,8 @@ out_neigh:
+ 	if ((orig_neigh_node) && (!is_single_hop_neigh))
+ 		batadv_orig_node_free_ref(orig_neigh_node);
+ out:
++	if (router_ifinfo)
++		batadv_neigh_ifinfo_free_ref(router_ifinfo);
+ 	if (router)
+ 		batadv_neigh_node_free_ref(router);
+ 	if (router_router)
+diff --git a/net/batman-adv/distributed-arp-table.c b/net/batman-adv/distributed-arp-table.c
+index edee50411892..bd8219a7dddf 100644
+--- a/net/batman-adv/distributed-arp-table.c
++++ b/net/batman-adv/distributed-arp-table.c
+@@ -940,8 +940,7 @@ bool batadv_dat_snoop_outgoing_arp_request(struct batadv_priv *bat_priv,
+ 		 * additional DAT answer may trigger kernel warnings about
+ 		 * a packet coming from the wrong port.
+ 		 */
+-		if (batadv_is_my_client(bat_priv, dat_entry->mac_addr,
+-					BATADV_NO_FLAGS)) {
++		if (batadv_is_my_client(bat_priv, dat_entry->mac_addr, vid)) {
+ 			ret = true;
+ 			goto out;
+ 		}
+diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c
+index 88df9b1d552d..cc1cfd60c094 100644
+--- a/net/batman-adv/fragmentation.c
++++ b/net/batman-adv/fragmentation.c
+@@ -418,12 +418,13 @@ bool batadv_frag_send_packet(struct sk_buff *skb,
+ 			     struct batadv_neigh_node *neigh_node)
+ {
+ 	struct batadv_priv *bat_priv;
+-	struct batadv_hard_iface *primary_if;
++	struct batadv_hard_iface *primary_if = NULL;
+ 	struct batadv_frag_packet frag_header;
+ 	struct sk_buff *skb_fragment;
+ 	unsigned mtu = neigh_node->if_incoming->net_dev->mtu;
+ 	unsigned header_size = sizeof(frag_header);
+ 	unsigned max_fragment_size, max_packet_size;
++	bool ret = false;
+ 
+ 	/* To avoid merge and refragmentation at next-hops we never send
+ 	 * fragments larger than BATADV_FRAG_MAX_FRAG_SIZE
+@@ -483,7 +484,11 @@ bool batadv_frag_send_packet(struct sk_buff *skb,
+ 			   skb->len + ETH_HLEN);
+ 	batadv_send_skb_packet(skb, neigh_node->if_incoming, neigh_node->addr);
+ 
+-	return true;
++	ret = true;
++
+ out_err:
+-	return false;
++	if (primary_if)
++		batadv_hardif_free_ref(primary_if);
++
++	return ret;
+ }
+diff --git a/net/batman-adv/gateway_client.c b/net/batman-adv/gateway_client.c
+index 55cf2260d295..36b9ae61f5e8 100644
+--- a/net/batman-adv/gateway_client.c
++++ b/net/batman-adv/gateway_client.c
+@@ -42,8 +42,10 @@
+ 
+ static void batadv_gw_node_free_ref(struct batadv_gw_node *gw_node)
+ {
+-	if (atomic_dec_and_test(&gw_node->refcount))
++	if (atomic_dec_and_test(&gw_node->refcount)) {
++		batadv_orig_node_free_ref(gw_node->orig_node);
+ 		kfree_rcu(gw_node, rcu);
++	}
+ }
+ 
+ static struct batadv_gw_node *
+@@ -408,9 +410,14 @@ static void batadv_gw_node_add(struct batadv_priv *bat_priv,
+ 	if (gateway->bandwidth_down == 0)
+ 		return;
+ 
++	if (!atomic_inc_not_zero(&orig_node->refcount))
++		return;
++
+ 	gw_node = kzalloc(sizeof(*gw_node), GFP_ATOMIC);
+-	if (!gw_node)
++	if (!gw_node) {
++		batadv_orig_node_free_ref(orig_node);
+ 		return;
++	}
+ 
+ 	INIT_HLIST_NODE(&gw_node->list);
+ 	gw_node->orig_node = orig_node;
+diff --git a/net/batman-adv/originator.c b/net/batman-adv/originator.c
+index 853941629dc1..abf612d7d0ae 100644
+--- a/net/batman-adv/originator.c
++++ b/net/batman-adv/originator.c
+@@ -500,12 +500,17 @@ batadv_neigh_node_get(const struct batadv_orig_node *orig_node,
+ static void batadv_orig_ifinfo_free_rcu(struct rcu_head *rcu)
+ {
+ 	struct batadv_orig_ifinfo *orig_ifinfo;
++	struct batadv_neigh_node *router;
+ 
+ 	orig_ifinfo = container_of(rcu, struct batadv_orig_ifinfo, rcu);
+ 
+ 	if (orig_ifinfo->if_outgoing != BATADV_IF_DEFAULT)
+ 		batadv_hardif_free_ref_now(orig_ifinfo->if_outgoing);
+ 
++	/* this is the last reference to this object */
++	router = rcu_dereference_protected(orig_ifinfo->router, true);
++	if (router)
++		batadv_neigh_node_free_ref_now(router);
+ 	kfree(orig_ifinfo);
+ }
+ 
+@@ -697,6 +702,47 @@ free_orig_node:
+ }
+ 
+ /**
++ * batadv_purge_neigh_ifinfo - purge obsolete ifinfo entries from neighbor
++ * @bat_priv: the bat priv with all the soft interface information
++ * @neigh: orig node which is to be checked
++ */
++static void
++batadv_purge_neigh_ifinfo(struct batadv_priv *bat_priv,
++			  struct batadv_neigh_node *neigh)
++{
++	struct batadv_neigh_ifinfo *neigh_ifinfo;
++	struct batadv_hard_iface *if_outgoing;
++	struct hlist_node *node_tmp;
++
++	spin_lock_bh(&neigh->ifinfo_lock);
++
++	/* for all ifinfo objects for this neighinator */
++	hlist_for_each_entry_safe(neigh_ifinfo, node_tmp,
++				  &neigh->ifinfo_list, list) {
++		if_outgoing = neigh_ifinfo->if_outgoing;
++
++		/* always keep the default interface */
++		if (if_outgoing == BATADV_IF_DEFAULT)
++			continue;
++
++		/* don't purge if the interface is not (going) down */
++		if ((if_outgoing->if_status != BATADV_IF_INACTIVE) &&
++		    (if_outgoing->if_status != BATADV_IF_NOT_IN_USE) &&
++		    (if_outgoing->if_status != BATADV_IF_TO_BE_REMOVED))
++			continue;
++
++		batadv_dbg(BATADV_DBG_BATMAN, bat_priv,
++			   "neighbor/ifinfo purge: neighbor %pM, iface: %s\n",
++			   neigh->addr, if_outgoing->net_dev->name);
++
++		hlist_del_rcu(&neigh_ifinfo->list);
++		batadv_neigh_ifinfo_free_ref(neigh_ifinfo);
++	}
++
++	spin_unlock_bh(&neigh->ifinfo_lock);
++}
++
++/**
+  * batadv_purge_orig_ifinfo - purge obsolete ifinfo entries from originator
+  * @bat_priv: the bat priv with all the soft interface information
+  * @orig_node: orig node which is to be checked
+@@ -795,6 +841,11 @@ batadv_purge_orig_neighbors(struct batadv_priv *bat_priv,
+ 
+ 			hlist_del_rcu(&neigh_node->list);
+ 			batadv_neigh_node_free_ref(neigh_node);
++		} else {
++			/* only necessary if not the whole neighbor is to be
++			 * deleted, but some interface has been removed.
++			 */
++			batadv_purge_neigh_ifinfo(bat_priv, neigh_node);
+ 		}
+ 	}
+ 
+@@ -852,7 +903,7 @@ static bool batadv_purge_orig_node(struct batadv_priv *bat_priv,
+ {
+ 	struct batadv_neigh_node *best_neigh_node;
+ 	struct batadv_hard_iface *hard_iface;
+-	bool changed;
++	bool changed_ifinfo, changed_neigh;
+ 
+ 	if (batadv_has_timed_out(orig_node->last_seen,
+ 				 2 * BATADV_PURGE_TIMEOUT)) {
+@@ -862,10 +913,10 @@ static bool batadv_purge_orig_node(struct batadv_priv *bat_priv,
+ 			   jiffies_to_msecs(orig_node->last_seen));
+ 		return true;
+ 	}
+-	changed = batadv_purge_orig_ifinfo(bat_priv, orig_node);
+-	changed = changed || batadv_purge_orig_neighbors(bat_priv, orig_node);
++	changed_ifinfo = batadv_purge_orig_ifinfo(bat_priv, orig_node);
++	changed_neigh = batadv_purge_orig_neighbors(bat_priv, orig_node);
+ 
+-	if (!changed)
++	if (!changed_ifinfo && !changed_neigh)
+ 		return false;
+ 
+ 	/* first for NULL ... */
+@@ -1023,7 +1074,8 @@ int batadv_orig_hardif_seq_print_text(struct seq_file *seq, void *offset)
+ 	bat_priv->bat_algo_ops->bat_orig_print(bat_priv, seq, hard_iface);
+ 
+ out:
+-	batadv_hardif_free_ref(hard_iface);
++	if (hard_iface)
++		batadv_hardif_free_ref(hard_iface);
+ 	return 0;
+ }
+ 
+diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
+index d0cca3c65f01..7985deaff52f 100644
+--- a/net/bridge/br_input.c
++++ b/net/bridge/br_input.c
+@@ -73,7 +73,7 @@ int br_handle_frame_finish(struct sk_buff *skb)
+ 		goto drop;
+ 
+ 	if (!br_allowed_ingress(p->br, nbp_get_vlan_info(p), skb, &vid))
+-		goto drop;
++		goto out;
+ 
+ 	/* insert into forwarding database after filtering to avoid spoofing */
+ 	br = p->br;
+diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
+index e74b6d530cb6..e8844d975b32 100644
+--- a/net/bridge/br_netlink.c
++++ b/net/bridge/br_netlink.c
+@@ -445,6 +445,20 @@ static int br_validate(struct nlattr *tb[], struct nlattr *data[])
+ 	return 0;
+ }
+ 
++static int br_dev_newlink(struct net *src_net, struct net_device *dev,
++			  struct nlattr *tb[], struct nlattr *data[])
++{
++	struct net_bridge *br = netdev_priv(dev);
++
++	if (tb[IFLA_ADDRESS]) {
++		spin_lock_bh(&br->lock);
++		br_stp_change_bridge_id(br, nla_data(tb[IFLA_ADDRESS]));
++		spin_unlock_bh(&br->lock);
++	}
++
++	return register_netdevice(dev);
++}
++
+ static size_t br_get_link_af_size(const struct net_device *dev)
+ {
+ 	struct net_port_vlans *pv;
+@@ -473,6 +487,7 @@ struct rtnl_link_ops br_link_ops __read_mostly = {
+ 	.priv_size	= sizeof(struct net_bridge),
+ 	.setup		= br_dev_setup,
+ 	.validate	= br_validate,
++	.newlink	= br_dev_newlink,
+ 	.dellink	= br_dev_delete,
+ };
+ 
+diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
+index f23c74b3a953..ba7757b7737d 100644
+--- a/net/bridge/br_vlan.c
++++ b/net/bridge/br_vlan.c
+@@ -170,7 +170,7 @@ bool br_allowed_ingress(struct net_bridge *br, struct net_port_vlans *v,
+ 	 * rejected.
+ 	 */
+ 	if (!v)
+-		return false;
++		goto drop;
+ 
+ 	/* If vlan tx offload is disabled on bridge device and frame was
+ 	 * sent from vlan device on the bridge device, it does not have
+@@ -193,7 +193,7 @@ bool br_allowed_ingress(struct net_bridge *br, struct net_port_vlans *v,
+ 		 * vlan untagged or priority-tagged traffic belongs to.
+ 		 */
+ 		if (pvid == VLAN_N_VID)
+-			return false;
++			goto drop;
+ 
+ 		/* PVID is set on this port.  Any untagged or priority-tagged
+ 		 * ingress frame is considered to belong to this vlan.
+@@ -216,7 +216,8 @@ bool br_allowed_ingress(struct net_bridge *br, struct net_port_vlans *v,
+ 	/* Frame had a valid vlan tag.  See if vlan is allowed */
+ 	if (test_bit(*vid, v->vlan_bitmap))
+ 		return true;
+-
++drop:
++	kfree_skb(skb);
+ 	return false;
+ }
+ 
+diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
+index 0e474b13463b..1059ed3bc255 100644
+--- a/net/bridge/netfilter/ebtables.c
++++ b/net/bridge/netfilter/ebtables.c
+@@ -1044,10 +1044,9 @@ static int do_replace_finish(struct net *net, struct ebt_replace *repl,
+ 	if (repl->num_counters &&
+ 	   copy_to_user(repl->counters, counterstmp,
+ 	   repl->num_counters * sizeof(struct ebt_counter))) {
+-		ret = -EFAULT;
++		/* Silent error, can't fail, new table is already in place */
++		net_warn_ratelimited("ebtables: counters copy to user failed while replacing table\n");
+ 	}
+-	else
+-		ret = 0;
+ 
+ 	/* decrease module count and free resources */
+ 	EBT_ENTRY_ITERATE(table->entries, table->entries_size,
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 45fa2f11f84d..fccc195e0fc8 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -2289,7 +2289,7 @@ EXPORT_SYMBOL(skb_checksum_help);
+ __be16 skb_network_protocol(struct sk_buff *skb, int *depth)
+ {
+ 	__be16 type = skb->protocol;
+-	int vlan_depth = ETH_HLEN;
++	int vlan_depth = skb->mac_len;
+ 
+ 	/* Tunnel gso handlers can set protocol to ethernet. */
+ 	if (type == htons(ETH_P_TEB)) {
+@@ -3944,6 +3944,7 @@ static enum gro_result dev_gro_receive(struct napi_struct *napi, struct sk_buff
+ 	}
+ 	NAPI_GRO_CB(skb)->count = 1;
+ 	NAPI_GRO_CB(skb)->age = jiffies;
++	NAPI_GRO_CB(skb)->last = skb;
+ 	skb_shinfo(skb)->gso_size = skb_gro_len(skb);
+ 	skb->next = napi->gro_list;
+ 	napi->gro_list = skb;
+@@ -4050,6 +4051,7 @@ static void napi_reuse_skb(struct napi_struct *napi, struct sk_buff *skb)
+ 	skb->vlan_tci = 0;
+ 	skb->dev = napi->dev;
+ 	skb->skb_iif = 0;
++	skb->truesize = SKB_TRUESIZE(skb_end_offset(skb));
+ 
+ 	napi->skb = skb;
+ }
+@@ -4605,6 +4607,32 @@ void *netdev_lower_get_next_private_rcu(struct net_device *dev,
+ EXPORT_SYMBOL(netdev_lower_get_next_private_rcu);
+ 
+ /**
++ * netdev_lower_get_next - Get the next device from the lower neighbour
++ *                         list
++ * @dev: device
++ * @iter: list_head ** of the current position
++ *
++ * Gets the next netdev_adjacent from the dev's lower neighbour
++ * list, starting from iter position. The caller must hold RTNL lock or
++ * its own locking that guarantees that the neighbour lower
++ * list will remain unchainged.
++ */
++void *netdev_lower_get_next(struct net_device *dev, struct list_head **iter)
++{
++	struct netdev_adjacent *lower;
++
++	lower = list_entry((*iter)->next, struct netdev_adjacent, list);
++
++	if (&lower->list == &dev->adj_list.lower)
++		return NULL;
++
++	*iter = &lower->list;
++
++	return lower->dev;
++}
++EXPORT_SYMBOL(netdev_lower_get_next);
++
++/**
+  * netdev_lower_get_first_private_rcu - Get the first ->private from the
+  *				       lower neighbour list, RCU
+  *				       variant
+@@ -5054,6 +5082,30 @@ void *netdev_lower_dev_get_private(struct net_device *dev,
+ }
+ EXPORT_SYMBOL(netdev_lower_dev_get_private);
+ 
++
++int dev_get_nest_level(struct net_device *dev,
++		       bool (*type_check)(struct net_device *dev))
++{
++	struct net_device *lower = NULL;
++	struct list_head *iter;
++	int max_nest = -1;
++	int nest;
++
++	ASSERT_RTNL();
++
++	netdev_for_each_lower_dev(dev, lower, iter) {
++		nest = dev_get_nest_level(lower, type_check);
++		if (max_nest < nest)
++			max_nest = nest;
++	}
++
++	if (type_check(dev))
++		max_nest++;
++
++	return max_nest;
++}
++EXPORT_SYMBOL(dev_get_nest_level);
++
+ static void dev_change_rx_flags(struct net_device *dev, int flags)
+ {
+ 	const struct net_device_ops *ops = dev->netdev_ops;
+@@ -5523,7 +5575,7 @@ static int dev_new_index(struct net *net)
+ 
+ /* Delayed registration/unregisteration */
+ static LIST_HEAD(net_todo_list);
+-static DECLARE_WAIT_QUEUE_HEAD(netdev_unregistering_wq);
++DECLARE_WAIT_QUEUE_HEAD(netdev_unregistering_wq);
+ 
+ static void net_set_todo(struct net_device *dev)
+ {
+diff --git a/net/core/filter.c b/net/core/filter.c
+index ad30d626a5bd..ebce437678fc 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -355,6 +355,8 @@ load_b:
+ 
+ 			if (skb_is_nonlinear(skb))
+ 				return 0;
++			if (skb->len < sizeof(struct nlattr))
++				return 0;
+ 			if (A > skb->len - sizeof(struct nlattr))
+ 				return 0;
+ 
+@@ -371,11 +373,13 @@ load_b:
+ 
+ 			if (skb_is_nonlinear(skb))
+ 				return 0;
++			if (skb->len < sizeof(struct nlattr))
++				return 0;
+ 			if (A > skb->len - sizeof(struct nlattr))
+ 				return 0;
+ 
+ 			nla = (struct nlattr *)&skb->data[A];
+-			if (nla->nla_len > A - skb->len)
++			if (nla->nla_len > skb->len - A)
+ 				return 0;
+ 
+ 			nla = nla_find_nested(nla, X);
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index e16129019c66..7d95f69635c6 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -1247,8 +1247,8 @@ void __neigh_set_probe_once(struct neighbour *neigh)
+ 	neigh->updated = jiffies;
+ 	if (!(neigh->nud_state & NUD_FAILED))
+ 		return;
+-	neigh->nud_state = NUD_PROBE;
+-	atomic_set(&neigh->probes, NEIGH_VAR(neigh->parms, UCAST_PROBES));
++	neigh->nud_state = NUD_INCOMPLETE;
++	atomic_set(&neigh->probes, neigh_max_probes(neigh));
+ 	neigh_add_timer(neigh,
+ 			jiffies + NEIGH_VAR(neigh->parms, RETRANS_TIME));
+ }
+diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
+index 81d3a9a08453..7c8ffd974961 100644
+--- a/net/core/net_namespace.c
++++ b/net/core/net_namespace.c
+@@ -24,7 +24,7 @@
+ 
+ static LIST_HEAD(pernet_list);
+ static struct list_head *first_device = &pernet_list;
+-static DEFINE_MUTEX(net_mutex);
++DEFINE_MUTEX(net_mutex);
+ 
+ LIST_HEAD(net_namespace_list);
+ EXPORT_SYMBOL_GPL(net_namespace_list);
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index 120eecc0f5a4..83b9d6ae5119 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -353,15 +353,46 @@ void __rtnl_link_unregister(struct rtnl_link_ops *ops)
+ }
+ EXPORT_SYMBOL_GPL(__rtnl_link_unregister);
+ 
++/* Return with the rtnl_lock held when there are no network
++ * devices unregistering in any network namespace.
++ */
++static void rtnl_lock_unregistering_all(void)
++{
++	struct net *net;
++	bool unregistering;
++	DEFINE_WAIT(wait);
++
++	for (;;) {
++		prepare_to_wait(&netdev_unregistering_wq, &wait,
++				TASK_UNINTERRUPTIBLE);
++		unregistering = false;
++		rtnl_lock();
++		for_each_net(net) {
++			if (net->dev_unreg_count > 0) {
++				unregistering = true;
++				break;
++			}
++		}
++		if (!unregistering)
++			break;
++		__rtnl_unlock();
++		schedule();
++	}
++	finish_wait(&netdev_unregistering_wq, &wait);
++}
++
+ /**
+  * rtnl_link_unregister - Unregister rtnl_link_ops from rtnetlink.
+  * @ops: struct rtnl_link_ops * to unregister
+  */
+ void rtnl_link_unregister(struct rtnl_link_ops *ops)
+ {
+-	rtnl_lock();
++	/* Close the race with cleanup_net() */
++	mutex_lock(&net_mutex);
++	rtnl_lock_unregistering_all();
+ 	__rtnl_link_unregister(ops);
+ 	rtnl_unlock();
++	mutex_unlock(&net_mutex);
+ }
+ EXPORT_SYMBOL_GPL(rtnl_link_unregister);
+ 
+@@ -774,7 +805,8 @@ static inline int rtnl_vfinfo_size(const struct net_device *dev,
+ 		return 0;
+ }
+ 
+-static size_t rtnl_port_size(const struct net_device *dev)
++static size_t rtnl_port_size(const struct net_device *dev,
++			     u32 ext_filter_mask)
+ {
+ 	size_t port_size = nla_total_size(4)		/* PORT_VF */
+ 		+ nla_total_size(PORT_PROFILE_MAX)	/* PORT_PROFILE */
+@@ -790,7 +822,8 @@ static size_t rtnl_port_size(const struct net_device *dev)
+ 	size_t port_self_size = nla_total_size(sizeof(struct nlattr))
+ 		+ port_size;
+ 
+-	if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent)
++	if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent ||
++	    !(ext_filter_mask & RTEXT_FILTER_VF))
+ 		return 0;
+ 	if (dev_num_vf(dev->dev.parent))
+ 		return port_self_size + vf_ports_size +
+@@ -825,7 +858,7 @@ static noinline size_t if_nlmsg_size(const struct net_device *dev,
+ 	       + nla_total_size(ext_filter_mask
+ 			        & RTEXT_FILTER_VF ? 4 : 0) /* IFLA_NUM_VF */
+ 	       + rtnl_vfinfo_size(dev, ext_filter_mask) /* IFLA_VFINFO_LIST */
+-	       + rtnl_port_size(dev) /* IFLA_VF_PORTS + IFLA_PORT_SELF */
++	       + rtnl_port_size(dev, ext_filter_mask) /* IFLA_VF_PORTS + IFLA_PORT_SELF */
+ 	       + rtnl_link_get_size(dev) /* IFLA_LINKINFO */
+ 	       + rtnl_link_get_af_size(dev) /* IFLA_AF_SPEC */
+ 	       + nla_total_size(MAX_PHYS_PORT_ID_LEN); /* IFLA_PHYS_PORT_ID */
+@@ -887,11 +920,13 @@ static int rtnl_port_self_fill(struct sk_buff *skb, struct net_device *dev)
+ 	return 0;
+ }
+ 
+-static int rtnl_port_fill(struct sk_buff *skb, struct net_device *dev)
++static int rtnl_port_fill(struct sk_buff *skb, struct net_device *dev,
++			  u32 ext_filter_mask)
+ {
+ 	int err;
+ 
+-	if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent)
++	if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent ||
++	    !(ext_filter_mask & RTEXT_FILTER_VF))
+ 		return 0;
+ 
+ 	err = rtnl_port_self_fill(skb, dev);
+@@ -1076,7 +1111,7 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
+ 		nla_nest_end(skb, vfinfo);
+ 	}
+ 
+-	if (rtnl_port_fill(skb, dev))
++	if (rtnl_port_fill(skb, dev, ext_filter_mask))
+ 		goto nla_put_failure;
+ 
+ 	if (dev->rtnl_link_ops || rtnl_have_link_slave_info(dev)) {
+@@ -1130,6 +1165,7 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
+ 	struct hlist_head *head;
+ 	struct nlattr *tb[IFLA_MAX+1];
+ 	u32 ext_filter_mask = 0;
++	int err;
+ 
+ 	s_h = cb->args[0];
+ 	s_idx = cb->args[1];
+@@ -1150,11 +1186,17 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
+ 		hlist_for_each_entry_rcu(dev, head, index_hlist) {
+ 			if (idx < s_idx)
+ 				goto cont;
+-			if (rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
+-					     NETLINK_CB(cb->skb).portid,
+-					     cb->nlh->nlmsg_seq, 0,
+-					     NLM_F_MULTI,
+-					     ext_filter_mask) <= 0)
++			err = rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
++					       NETLINK_CB(cb->skb).portid,
++					       cb->nlh->nlmsg_seq, 0,
++					       NLM_F_MULTI,
++					       ext_filter_mask);
++			/* If we ran out of room on the first message,
++			 * we're in trouble
++			 */
++			WARN_ON((err == -EMSGSIZE) && (skb->len == 0));
++
++			if (err <= 0)
+ 				goto out;
+ 
+ 			nl_dump_check_consistent(cb, nlmsg_hdr(skb));
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 90b96a11b974..e5ae776ee9b4 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -3076,7 +3076,7 @@ int skb_gro_receive(struct sk_buff **head, struct sk_buff *skb)
+ 	if (unlikely(p->len + len >= 65536))
+ 		return -E2BIG;
+ 
+-	lp = NAPI_GRO_CB(p)->last ?: p;
++	lp = NAPI_GRO_CB(p)->last;
+ 	pinfo = skb_shinfo(lp);
+ 
+ 	if (headlen <= offset) {
+@@ -3192,7 +3192,7 @@ merge:
+ 
+ 	__skb_pull(skb, offset);
+ 
+-	if (!NAPI_GRO_CB(p)->last)
++	if (NAPI_GRO_CB(p)->last == p)
+ 		skb_shinfo(p)->frag_list = skb;
+ 	else
+ 		NAPI_GRO_CB(p)->last->next = skb;
+@@ -3951,12 +3951,14 @@ EXPORT_SYMBOL_GPL(skb_scrub_packet);
+ unsigned int skb_gso_transport_seglen(const struct sk_buff *skb)
+ {
+ 	const struct skb_shared_info *shinfo = skb_shinfo(skb);
+-	unsigned int hdr_len;
+ 
+ 	if (likely(shinfo->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)))
+-		hdr_len = tcp_hdrlen(skb);
+-	else
+-		hdr_len = sizeof(struct udphdr);
+-	return hdr_len + shinfo->gso_size;
++		return tcp_hdrlen(skb) + shinfo->gso_size;
++
++	/* UFO sets gso_size to the size of the fragmentation
++	 * payload, i.e. the size of the L4 (UDP) header is already
++	 * accounted for.
++	 */
++	return shinfo->gso_size;
+ }
+ EXPORT_SYMBOL_GPL(skb_gso_transport_seglen);
+diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c
+index a0e9cf6379de..6a7fae228634 100644
+--- a/net/core/sock_diag.c
++++ b/net/core/sock_diag.c
+@@ -49,7 +49,7 @@ int sock_diag_put_meminfo(struct sock *sk, struct sk_buff *skb, int attrtype)
+ }
+ EXPORT_SYMBOL_GPL(sock_diag_put_meminfo);
+ 
+-int sock_diag_put_filterinfo(struct user_namespace *user_ns, struct sock *sk,
++int sock_diag_put_filterinfo(struct sock *sk,
+ 			     struct sk_buff *skb, int attrtype)
+ {
+ 	struct nlattr *attr;
+@@ -57,7 +57,7 @@ int sock_diag_put_filterinfo(struct user_namespace *user_ns, struct sock *sk,
+ 	unsigned int len;
+ 	int err = 0;
+ 
+-	if (!ns_capable(user_ns, CAP_NET_ADMIN)) {
++	if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) {
+ 		nla_reserve(skb, attrtype, 0);
+ 		return 0;
+ 	}
+diff --git a/net/core/utils.c b/net/core/utils.c
+index 2f737bf90b3f..eed34338736c 100644
+--- a/net/core/utils.c
++++ b/net/core/utils.c
+@@ -348,8 +348,8 @@ static void __net_random_once_deferred(struct work_struct *w)
+ {
+ 	struct __net_random_once_work *work =
+ 		container_of(w, struct __net_random_once_work, work);
+-	if (!static_key_enabled(work->key))
+-		static_key_slow_inc(work->key);
++	BUG_ON(!static_key_enabled(work->key));
++	static_key_slow_dec(work->key);
+ 	kfree(work);
+ }
+ 
+@@ -367,7 +367,7 @@ static void __net_random_once_disable_jump(struct static_key *key)
+ }
+ 
+ bool __net_get_random_once(void *buf, int nbytes, bool *done,
+-			   struct static_key *done_key)
++			   struct static_key *once_key)
+ {
+ 	static DEFINE_SPINLOCK(lock);
+ 	unsigned long flags;
+@@ -382,7 +382,7 @@ bool __net_get_random_once(void *buf, int nbytes, bool *done,
+ 	*done = true;
+ 	spin_unlock_irqrestore(&lock, flags);
+ 
+-	__net_random_once_disable_jump(done_key);
++	__net_random_once_disable_jump(once_key);
+ 
+ 	return true;
+ }
+diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
+index b53f0bf84dca..9d43468722ed 100644
+--- a/net/ipv4/fib_semantics.c
++++ b/net/ipv4/fib_semantics.c
+@@ -820,13 +820,13 @@ struct fib_info *fib_create_info(struct fib_config *cfg)
+ 	fi = kzalloc(sizeof(*fi)+nhs*sizeof(struct fib_nh), GFP_KERNEL);
+ 	if (fi == NULL)
+ 		goto failure;
++	fib_info_cnt++;
+ 	if (cfg->fc_mx) {
+ 		fi->fib_metrics = kzalloc(sizeof(u32) * RTAX_MAX, GFP_KERNEL);
+ 		if (!fi->fib_metrics)
+ 			goto failure;
+ 	} else
+ 		fi->fib_metrics = (u32 *) dst_default_metrics;
+-	fib_info_cnt++;
+ 
+ 	fi->fib_net = hold_net(net);
+ 	fi->fib_protocol = cfg->fc_protocol;
+diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
+index f3869c186d97..1c6bd4359cbd 100644
+--- a/net/ipv4/ip_forward.c
++++ b/net/ipv4/ip_forward.c
+@@ -42,12 +42,12 @@
+ static bool ip_may_fragment(const struct sk_buff *skb)
+ {
+ 	return unlikely((ip_hdr(skb)->frag_off & htons(IP_DF)) == 0) ||
+-	       !skb->local_df;
++		skb->local_df;
+ }
+ 
+ static bool ip_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
+ {
+-	if (skb->len <= mtu || skb->local_df)
++	if (skb->len <= mtu)
+ 		return false;
+ 
+ 	if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu)
+diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
+index ec4f762efda5..94213c891565 100644
+--- a/net/ipv4/ip_gre.c
++++ b/net/ipv4/ip_gre.c
+@@ -463,6 +463,7 @@ static const struct net_device_ops ipgre_netdev_ops = {
+ static void ipgre_tunnel_setup(struct net_device *dev)
+ {
+ 	dev->netdev_ops		= &ipgre_netdev_ops;
++	dev->type		= ARPHRD_IPGRE;
+ 	ip_tunnel_setup(dev, ipgre_net_id);
+ }
+ 
+@@ -501,7 +502,6 @@ static int ipgre_tunnel_init(struct net_device *dev)
+ 	memcpy(dev->dev_addr, &iph->saddr, 4);
+ 	memcpy(dev->broadcast, &iph->daddr, 4);
+ 
+-	dev->type		= ARPHRD_IPGRE;
+ 	dev->flags		= IFF_NOARP;
+ 	dev->priv_flags		&= ~IFF_XMIT_DST_RELEASE;
+ 	dev->addr_len		= 4;
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index a82a22d8f77f..0c3a5d17b4a9 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -438,6 +438,8 @@ int ip_tunnel_rcv(struct ip_tunnel *tunnel, struct sk_buff *skb,
+ 		tunnel->i_seqno = ntohl(tpi->seq) + 1;
+ 	}
+ 
++	skb_reset_network_header(skb);
++
+ 	err = IP_ECN_decapsulate(iph, skb);
+ 	if (unlikely(err)) {
+ 		if (log_ecn_error)
+@@ -534,9 +536,10 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+ 	unsigned int max_headroom;	/* The extra header space needed */
+ 	__be32 dst;
+ 	int err;
+-	bool connected = true;
++	bool connected;
+ 
+ 	inner_iph = (const struct iphdr *)skb_inner_network_header(skb);
++	connected = (tunnel->parms.iph.daddr != 0);
+ 
+ 	dst = tnl_params->daddr;
+ 	if (dst == 0) {
+@@ -872,6 +875,7 @@ int ip_tunnel_init_net(struct net *net, int ip_tnl_net_id,
+ 	 */
+ 	if (!IS_ERR(itn->fb_tunnel_dev)) {
+ 		itn->fb_tunnel_dev->features |= NETIF_F_NETNS_LOCAL;
++		itn->fb_tunnel_dev->mtu = ip_tunnel_bind_dev(itn->fb_tunnel_dev);
+ 		ip_tunnel_add(itn, netdev_priv(itn->fb_tunnel_dev));
+ 	}
+ 	rtnl_unlock();
+diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
+index 48eafae51769..e4a8f76c8995 100644
+--- a/net/ipv4/ip_vti.c
++++ b/net/ipv4/ip_vti.c
+@@ -207,6 +207,7 @@ static const struct net_device_ops vti_netdev_ops = {
+ static void vti_tunnel_setup(struct net_device *dev)
+ {
+ 	dev->netdev_ops		= &vti_netdev_ops;
++	dev->type		= ARPHRD_TUNNEL;
+ 	ip_tunnel_setup(dev, vti_net_id);
+ }
+ 
+@@ -218,7 +219,6 @@ static int vti_tunnel_init(struct net_device *dev)
+ 	memcpy(dev->dev_addr, &iph->saddr, 4);
+ 	memcpy(dev->broadcast, &iph->daddr, 4);
+ 
+-	dev->type		= ARPHRD_TUNNEL;
+ 	dev->hard_header_len	= LL_MAX_HEADER + sizeof(struct iphdr);
+ 	dev->mtu		= ETH_DATA_LEN;
+ 	dev->flags		= IFF_NOARP;
+diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
+index 59da7cde0724..f95b6f93814b 100644
+--- a/net/ipv4/netfilter/arp_tables.c
++++ b/net/ipv4/netfilter/arp_tables.c
+@@ -1044,8 +1044,10 @@ static int __do_replace(struct net *net, const char *name,
+ 
+ 	xt_free_table_info(oldinfo);
+ 	if (copy_to_user(counters_ptr, counters,
+-			 sizeof(struct xt_counters) * num_counters) != 0)
+-		ret = -EFAULT;
++			 sizeof(struct xt_counters) * num_counters) != 0) {
++		/* Silent error, can't fail, new table is already in place */
++		net_warn_ratelimited("arptables: counters copy to user failed while replacing table\n");
++	}
+ 	vfree(counters);
+ 	xt_table_unlock(t);
+ 	return ret;
+diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
+index 718dfbd30cbe..99e810f84671 100644
+--- a/net/ipv4/netfilter/ip_tables.c
++++ b/net/ipv4/netfilter/ip_tables.c
+@@ -1231,8 +1231,10 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
+ 
+ 	xt_free_table_info(oldinfo);
+ 	if (copy_to_user(counters_ptr, counters,
+-			 sizeof(struct xt_counters) * num_counters) != 0)
+-		ret = -EFAULT;
++			 sizeof(struct xt_counters) * num_counters) != 0) {
++		/* Silent error, can't fail, new table is already in place */
++		net_warn_ratelimited("iptables: counters copy to user failed while replacing table\n");
++	}
+ 	vfree(counters);
+ 	xt_table_unlock(t);
+ 	return ret;
+diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
+index 2d11c094296e..e21934b06d4c 100644
+--- a/net/ipv4/ping.c
++++ b/net/ipv4/ping.c
+@@ -252,26 +252,33 @@ int ping_init_sock(struct sock *sk)
+ {
+ 	struct net *net = sock_net(sk);
+ 	kgid_t group = current_egid();
+-	struct group_info *group_info = get_current_groups();
+-	int i, j, count = group_info->ngroups;
++	struct group_info *group_info;
++	int i, j, count;
+ 	kgid_t low, high;
++	int ret = 0;
+ 
+ 	inet_get_ping_group_range_net(net, &low, &high);
+ 	if (gid_lte(low, group) && gid_lte(group, high))
+ 		return 0;
+ 
++	group_info = get_current_groups();
++	count = group_info->ngroups;
+ 	for (i = 0; i < group_info->nblocks; i++) {
+ 		int cp_count = min_t(int, NGROUPS_PER_BLOCK, count);
+ 		for (j = 0; j < cp_count; j++) {
+ 			kgid_t gid = group_info->blocks[i][j];
+ 			if (gid_lte(low, gid) && gid_lte(gid, high))
+-				return 0;
++				goto out_release_group;
+ 		}
+ 
+ 		count -= cp_count;
+ 	}
+ 
+-	return -EACCES;
++	ret = -EACCES;
++
++out_release_group:
++	put_group_info(group_info);
++	return ret;
+ }
+ EXPORT_SYMBOL_GPL(ping_init_sock);
+ 
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 4c011ec69ed4..134437309b1e 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -1526,7 +1526,7 @@ static int __mkroute_input(struct sk_buff *skb,
+ 	struct in_device *out_dev;
+ 	unsigned int flags = 0;
+ 	bool do_cache;
+-	u32 itag;
++	u32 itag = 0;
+ 
+ 	/* get a working reference to the output device */
+ 	out_dev = __in_dev_get_rcu(FIB_RES_DEV(*res));
+@@ -2364,7 +2364,7 @@ static int rt_fill_info(struct net *net,  __be32 dst, __be32 src,
+ 			}
+ 		} else
+ #endif
+-			if (nla_put_u32(skb, RTA_IIF, rt->rt_iif))
++			if (nla_put_u32(skb, RTA_IIF, skb->dev->ifindex))
+ 				goto nla_put_failure;
+ 	}
+ 
+diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
+index 828e4c3ffbaf..121a9a22dc98 100644
+--- a/net/ipv4/tcp_cubic.c
++++ b/net/ipv4/tcp_cubic.c
+@@ -409,7 +409,7 @@ static void bictcp_acked(struct sock *sk, u32 cnt, s32 rtt_us)
+ 		ratio -= ca->delayed_ack >> ACK_RATIO_SHIFT;
+ 		ratio += cnt;
+ 
+-		ca->delayed_ack = min(ratio, ACK_RATIO_LIMIT);
++		ca->delayed_ack = clamp(ratio, 1U, ACK_RATIO_LIMIT);
+ 	}
+ 
+ 	/* Some calls are for duplicates without timetamps */
+diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c
+index 075602fc6b6a..1e55f5eba185 100644
+--- a/net/ipv6/ip6_fib.c
++++ b/net/ipv6/ip6_fib.c
+@@ -1418,7 +1418,7 @@ static int fib6_walk_continue(struct fib6_walker_t *w)
+ 
+ 				if (w->skip) {
+ 					w->skip--;
+-					continue;
++					goto skip;
+ 				}
+ 
+ 				err = w->func(w);
+@@ -1428,6 +1428,7 @@ static int fib6_walk_continue(struct fib6_walker_t *w)
+ 				w->count++;
+ 				continue;
+ 			}
++skip:
+ 			w->state = FWS_U;
+ 		case FWS_U:
+ 			if (fn == w->root)
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index f3ffb43f59c0..2465d18e8a26 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -1566,6 +1566,15 @@ static int ip6gre_changelink(struct net_device *dev, struct nlattr *tb[],
+ 	return 0;
+ }
+ 
++static void ip6gre_dellink(struct net_device *dev, struct list_head *head)
++{
++	struct net *net = dev_net(dev);
++	struct ip6gre_net *ign = net_generic(net, ip6gre_net_id);
++
++	if (dev != ign->fb_tunnel_dev)
++		unregister_netdevice_queue(dev, head);
++}
++
+ static size_t ip6gre_get_size(const struct net_device *dev)
+ {
+ 	return
+@@ -1643,6 +1652,7 @@ static struct rtnl_link_ops ip6gre_link_ops __read_mostly = {
+ 	.validate	= ip6gre_tunnel_validate,
+ 	.newlink	= ip6gre_newlink,
+ 	.changelink	= ip6gre_changelink,
++	.dellink	= ip6gre_dellink,
+ 	.get_size	= ip6gre_get_size,
+ 	.fill_info	= ip6gre_fill_info,
+ };
+diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
+index 59f95affceb0..b2f091566f88 100644
+--- a/net/ipv6/ip6_offload.c
++++ b/net/ipv6/ip6_offload.c
+@@ -196,7 +196,6 @@ static struct sk_buff **ipv6_gro_receive(struct sk_buff **head,
+ 	unsigned int off;
+ 	u16 flush = 1;
+ 	int proto;
+-	__wsum csum;
+ 
+ 	off = skb_gro_offset(skb);
+ 	hlen = off + sizeof(*iph);
+@@ -264,13 +263,10 @@ static struct sk_buff **ipv6_gro_receive(struct sk_buff **head,
+ 
+ 	NAPI_GRO_CB(skb)->flush |= flush;
+ 
+-	csum = skb->csum;
+-	skb_postpull_rcsum(skb, iph, skb_network_header_len(skb));
++	skb_gro_postpull_rcsum(skb, iph, nlen);
+ 
+ 	pp = ops->callbacks.gro_receive(head, skb);
+ 
+-	skb->csum = csum;
+-
+ out_unlock:
+ 	rcu_read_unlock();
+ 
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 3702d179506d..a62b610307ec 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -344,12 +344,16 @@ static unsigned int ip6_dst_mtu_forward(const struct dst_entry *dst)
+ 
+ static bool ip6_pkt_too_big(const struct sk_buff *skb, unsigned int mtu)
+ {
+-	if (skb->len <= mtu || skb->local_df)
++	if (skb->len <= mtu)
+ 		return false;
+ 
++	/* ipv6 conntrack defrag sets max_frag_size + local_df */
+ 	if (IP6CB(skb)->frag_max_size && IP6CB(skb)->frag_max_size > mtu)
+ 		return true;
+ 
++	if (skb->local_df)
++		return false;
++
+ 	if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu)
+ 		return false;
+ 
+@@ -1225,7 +1229,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
+ 		unsigned int maxnonfragsize, headersize;
+ 
+ 		headersize = sizeof(struct ipv6hdr) +
+-			     (opt ? opt->tot_len : 0) +
++			     (opt ? opt->opt_flen + opt->opt_nflen : 0) +
+ 			     (dst_allfrag(&rt->dst) ?
+ 			      sizeof(struct frag_hdr) : 0) +
+ 			     rt->rt6i_nfheader_len;
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index 5db8d310f9c0..0e51f68ab163 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -1564,7 +1564,7 @@ static int ip6_tnl_validate(struct nlattr *tb[], struct nlattr *data[])
+ {
+ 	u8 proto;
+ 
+-	if (!data)
++	if (!data || !data[IFLA_IPTUN_PROTO])
+ 		return 0;
+ 
+ 	proto = nla_get_u8(data[IFLA_IPTUN_PROTO]);
+diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
+index 710238f58aa9..e080fbbbc0e5 100644
+--- a/net/ipv6/netfilter/ip6_tables.c
++++ b/net/ipv6/netfilter/ip6_tables.c
+@@ -1241,8 +1241,10 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
+ 
+ 	xt_free_table_info(oldinfo);
+ 	if (copy_to_user(counters_ptr, counters,
+-			 sizeof(struct xt_counters) * num_counters) != 0)
+-		ret = -EFAULT;
++			 sizeof(struct xt_counters) * num_counters) != 0) {
++		/* Silent error, can't fail, new table is already in place */
++		net_warn_ratelimited("ip6tables: counters copy to user failed while replacing table\n");
++	}
+ 	vfree(counters);
+ 	xt_table_unlock(t);
+ 	return ret;
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index fba54a407bb2..7cc1102e298c 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -1342,7 +1342,7 @@ static unsigned int ip6_mtu(const struct dst_entry *dst)
+ 	unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);
+ 
+ 	if (mtu)
+-		return mtu;
++		goto out;
+ 
+ 	mtu = IPV6_MIN_MTU;
+ 
+@@ -1352,7 +1352,8 @@ static unsigned int ip6_mtu(const struct dst_entry *dst)
+ 		mtu = idev->cnf.mtu6;
+ 	rcu_read_unlock();
+ 
+-	return mtu;
++out:
++	return min_t(unsigned int, mtu, IP6_MAX_MTU);
+ }
+ 
+ static struct dst_entry *icmp6_dst_gc_list;
+diff --git a/net/ipv6/tcpv6_offload.c b/net/ipv6/tcpv6_offload.c
+index 0d78132ff18a..8517d3cd1aed 100644
+--- a/net/ipv6/tcpv6_offload.c
++++ b/net/ipv6/tcpv6_offload.c
+@@ -42,7 +42,7 @@ static struct sk_buff **tcp6_gro_receive(struct sk_buff **head,
+ 	if (NAPI_GRO_CB(skb)->flush)
+ 		goto skip_csum;
+ 
+-	wsum = skb->csum;
++	wsum = NAPI_GRO_CB(skb)->csum;
+ 
+ 	switch (skb->ip_summed) {
+ 	case CHECKSUM_NONE:
+diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
+index 5990919356a5..ec6606325cda 100644
+--- a/net/l2tp/l2tp_ppp.c
++++ b/net/l2tp/l2tp_ppp.c
+@@ -756,9 +756,9 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
+ 	session->deref = pppol2tp_session_sock_put;
+ 
+ 	/* If PMTU discovery was enabled, use the MTU that was discovered */
+-	dst = sk_dst_get(sk);
++	dst = sk_dst_get(tunnel->sock);
+ 	if (dst != NULL) {
+-		u32 pmtu = dst_mtu(__sk_dst_get(sk));
++		u32 pmtu = dst_mtu(__sk_dst_get(tunnel->sock));
+ 		if (pmtu != 0)
+ 			session->mtu = session->mru = pmtu -
+ 				PPPOL2TP_HEADER_OVERHEAD;
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index adce01e8bb57..c68e5e0628df 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -1934,7 +1934,8 @@ static const struct nft_set_ops *nft_select_set_ops(const struct nlattr * const
+ 
+ static const struct nla_policy nft_set_policy[NFTA_SET_MAX + 1] = {
+ 	[NFTA_SET_TABLE]		= { .type = NLA_STRING },
+-	[NFTA_SET_NAME]			= { .type = NLA_STRING },
++	[NFTA_SET_NAME]			= { .type = NLA_STRING,
++					    .len = IFNAMSIZ - 1 },
+ 	[NFTA_SET_FLAGS]		= { .type = NLA_U32 },
+ 	[NFTA_SET_KEY_TYPE]		= { .type = NLA_U32 },
+ 	[NFTA_SET_KEY_LEN]		= { .type = NLA_U32 },
+diff --git a/net/netfilter/nf_tables_core.c b/net/netfilter/nf_tables_core.c
+index 90998a6ff8b9..804105391b9a 100644
+--- a/net/netfilter/nf_tables_core.c
++++ b/net/netfilter/nf_tables_core.c
+@@ -25,9 +25,8 @@ static void nft_cmp_fast_eval(const struct nft_expr *expr,
+ 			      struct nft_data data[NFT_REG_MAX + 1])
+ {
+ 	const struct nft_cmp_fast_expr *priv = nft_expr_priv(expr);
+-	u32 mask;
++	u32 mask = nft_cmp_fast_mask(priv->len);
+ 
+-	mask = ~0U >> (sizeof(priv->data) * BITS_PER_BYTE - priv->len);
+ 	if ((data[priv->sreg].data[0] & mask) == priv->data)
+ 		return;
+ 	data[NFT_REG_VERDICT].verdict = NFT_BREAK;
+diff --git a/net/netfilter/nft_cmp.c b/net/netfilter/nft_cmp.c
+index 954925db414d..e2b3f51c81f1 100644
+--- a/net/netfilter/nft_cmp.c
++++ b/net/netfilter/nft_cmp.c
+@@ -128,7 +128,7 @@ static int nft_cmp_fast_init(const struct nft_ctx *ctx,
+ 	BUG_ON(err < 0);
+ 	desc.len *= BITS_PER_BYTE;
+ 
+-	mask = ~0U >> (sizeof(priv->data) * BITS_PER_BYTE - desc.len);
++	mask = nft_cmp_fast_mask(desc.len);
+ 	priv->data = data.data[0] & mask;
+ 	priv->len  = desc.len;
+ 	return 0;
+diff --git a/net/packet/diag.c b/net/packet/diag.c
+index 533ce4ff108a..435ff99ba8c7 100644
+--- a/net/packet/diag.c
++++ b/net/packet/diag.c
+@@ -172,7 +172,7 @@ static int sk_diag_fill(struct sock *sk, struct sk_buff *skb,
+ 		goto out_nlmsg_trim;
+ 
+ 	if ((req->pdiag_show & PACKET_SHOW_FILTER) &&
+-	    sock_diag_put_filterinfo(user_ns, sk, skb, PACKET_DIAG_FILTER))
++	    sock_diag_put_filterinfo(sk, skb, PACKET_DIAG_FILTER))
+ 		goto out_nlmsg_trim;
+ 
+ 	return nlmsg_end(skb, nlh);
+diff --git a/net/sched/cls_tcindex.c b/net/sched/cls_tcindex.c
+index eed8404443d8..f435a88d899a 100644
+--- a/net/sched/cls_tcindex.c
++++ b/net/sched/cls_tcindex.c
+@@ -188,6 +188,12 @@ static const struct nla_policy tcindex_policy[TCA_TCINDEX_MAX + 1] = {
+ 	[TCA_TCINDEX_CLASSID]		= { .type = NLA_U32 },
+ };
+ 
++static void tcindex_filter_result_init(struct tcindex_filter_result *r)
++{
++	memset(r, 0, sizeof(*r));
++	tcf_exts_init(&r->exts, TCA_TCINDEX_ACT, TCA_TCINDEX_POLICE);
++}
++
+ static int
+ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
+ 		  u32 handle, struct tcindex_data *p,
+@@ -207,15 +213,11 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
+ 		return err;
+ 
+ 	memcpy(&cp, p, sizeof(cp));
+-	memset(&new_filter_result, 0, sizeof(new_filter_result));
+-	tcf_exts_init(&new_filter_result.exts, TCA_TCINDEX_ACT, TCA_TCINDEX_POLICE);
++	tcindex_filter_result_init(&new_filter_result);
+ 
++	tcindex_filter_result_init(&cr);
+ 	if (old_r)
+-		memcpy(&cr, r, sizeof(cr));
+-	else {
+-		memset(&cr, 0, sizeof(cr));
+-		tcf_exts_init(&cr.exts, TCA_TCINDEX_ACT, TCA_TCINDEX_POLICE);
+-	}
++		cr.res = r->res;
+ 
+ 	if (tb[TCA_TCINDEX_HASH])
+ 		cp.hash = nla_get_u32(tb[TCA_TCINDEX_HASH]);
+@@ -267,9 +269,14 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
+ 	err = -ENOMEM;
+ 	if (!cp.perfect && !cp.h) {
+ 		if (valid_perfect_hash(&cp)) {
++			int i;
++
+ 			cp.perfect = kcalloc(cp.hash, sizeof(*r), GFP_KERNEL);
+ 			if (!cp.perfect)
+ 				goto errout;
++			for (i = 0; i < cp.hash; i++)
++				tcf_exts_init(&cp.perfect[i].exts, TCA_TCINDEX_ACT,
++					      TCA_TCINDEX_POLICE);
+ 			balloc = 1;
+ 		} else {
+ 			cp.h = kcalloc(cp.hash, sizeof(f), GFP_KERNEL);
+@@ -295,14 +302,17 @@ tcindex_set_parms(struct net *net, struct tcf_proto *tp, unsigned long base,
+ 		tcf_bind_filter(tp, &cr.res, base);
+ 	}
+ 
+-	tcf_exts_change(tp, &cr.exts, &e);
++	if (old_r)
++		tcf_exts_change(tp, &r->exts, &e);
++	else
++		tcf_exts_change(tp, &cr.exts, &e);
+ 
+ 	tcf_tree_lock(tp);
+ 	if (old_r && old_r != r)
+-		memset(old_r, 0, sizeof(*old_r));
++		tcindex_filter_result_init(old_r);
+ 
+ 	memcpy(p, &cp, sizeof(cp));
+-	memcpy(r, &cr, sizeof(cr));
++	r->res = cr.res;
+ 
+ 	if (r == &new_filter_result) {
+ 		struct tcindex_filter **fp;
+diff --git a/net/sched/sch_hhf.c b/net/sched/sch_hhf.c
+index 647680b1c625..039977830783 100644
+--- a/net/sched/sch_hhf.c
++++ b/net/sched/sch_hhf.c
+@@ -553,11 +553,6 @@ static int hhf_change(struct Qdisc *sch, struct nlattr *opt)
+ 	if (err < 0)
+ 		return err;
+ 
+-	sch_tree_lock(sch);
+-
+-	if (tb[TCA_HHF_BACKLOG_LIMIT])
+-		sch->limit = nla_get_u32(tb[TCA_HHF_BACKLOG_LIMIT]);
+-
+ 	if (tb[TCA_HHF_QUANTUM])
+ 		new_quantum = nla_get_u32(tb[TCA_HHF_QUANTUM]);
+ 
+@@ -567,6 +562,12 @@ static int hhf_change(struct Qdisc *sch, struct nlattr *opt)
+ 	non_hh_quantum = (u64)new_quantum * new_hhf_non_hh_weight;
+ 	if (non_hh_quantum > INT_MAX)
+ 		return -EINVAL;
++
++	sch_tree_lock(sch);
++
++	if (tb[TCA_HHF_BACKLOG_LIMIT])
++		sch->limit = nla_get_u32(tb[TCA_HHF_BACKLOG_LIMIT]);
++
+ 	q->quantum = new_quantum;
+ 	q->hhf_non_hh_weight = new_hhf_non_hh_weight;
+ 
+diff --git a/net/sctp/associola.c b/net/sctp/associola.c
+index ee13d28d39d1..878e17aafbe5 100644
+--- a/net/sctp/associola.c
++++ b/net/sctp/associola.c
+@@ -1396,35 +1396,44 @@ static inline bool sctp_peer_needs_update(struct sctp_association *asoc)
+ 	return false;
+ }
+ 
+-/* Update asoc's rwnd for the approximated state in the buffer,
+- * and check whether SACK needs to be sent.
+- */
+-void sctp_assoc_rwnd_update(struct sctp_association *asoc, bool update_peer)
++/* Increase asoc's rwnd by len and send any window update SACK if needed. */
++void sctp_assoc_rwnd_increase(struct sctp_association *asoc, unsigned int len)
+ {
+-	int rx_count;
+ 	struct sctp_chunk *sack;
+ 	struct timer_list *timer;
+ 
+-	if (asoc->ep->rcvbuf_policy)
+-		rx_count = atomic_read(&asoc->rmem_alloc);
+-	else
+-		rx_count = atomic_read(&asoc->base.sk->sk_rmem_alloc);
++	if (asoc->rwnd_over) {
++		if (asoc->rwnd_over >= len) {
++			asoc->rwnd_over -= len;
++		} else {
++			asoc->rwnd += (len - asoc->rwnd_over);
++			asoc->rwnd_over = 0;
++		}
++	} else {
++		asoc->rwnd += len;
++	}
+ 
+-	if ((asoc->base.sk->sk_rcvbuf - rx_count) > 0)
+-		asoc->rwnd = (asoc->base.sk->sk_rcvbuf - rx_count) >> 1;
+-	else
+-		asoc->rwnd = 0;
++	/* If we had window pressure, start recovering it
++	 * once our rwnd had reached the accumulated pressure
++	 * threshold.  The idea is to recover slowly, but up
++	 * to the initial advertised window.
++	 */
++	if (asoc->rwnd_press && asoc->rwnd >= asoc->rwnd_press) {
++		int change = min(asoc->pathmtu, asoc->rwnd_press);
++		asoc->rwnd += change;
++		asoc->rwnd_press -= change;
++	}
+ 
+-	pr_debug("%s: asoc:%p rwnd=%u, rx_count=%d, sk_rcvbuf=%d\n",
+-		 __func__, asoc, asoc->rwnd, rx_count,
+-		 asoc->base.sk->sk_rcvbuf);
++	pr_debug("%s: asoc:%p rwnd increased by %d to (%u, %u) - %u\n",
++		 __func__, asoc, len, asoc->rwnd, asoc->rwnd_over,
++		 asoc->a_rwnd);
+ 
+ 	/* Send a window update SACK if the rwnd has increased by at least the
+ 	 * minimum of the association's PMTU and half of the receive buffer.
+ 	 * The algorithm used is similar to the one described in
+ 	 * Section 4.2.3.3 of RFC 1122.
+ 	 */
+-	if (update_peer && sctp_peer_needs_update(asoc)) {
++	if (sctp_peer_needs_update(asoc)) {
+ 		asoc->a_rwnd = asoc->rwnd;
+ 
+ 		pr_debug("%s: sending window update SACK- asoc:%p rwnd:%u "
+@@ -1446,6 +1455,45 @@ void sctp_assoc_rwnd_update(struct sctp_association *asoc, bool update_peer)
+ 	}
+ }
+ 
++/* Decrease asoc's rwnd by len. */
++void sctp_assoc_rwnd_decrease(struct sctp_association *asoc, unsigned int len)
++{
++	int rx_count;
++	int over = 0;
++
++	if (unlikely(!asoc->rwnd || asoc->rwnd_over))
++		pr_debug("%s: association:%p has asoc->rwnd:%u, "
++			 "asoc->rwnd_over:%u!\n", __func__, asoc,
++			 asoc->rwnd, asoc->rwnd_over);
++
++	if (asoc->ep->rcvbuf_policy)
++		rx_count = atomic_read(&asoc->rmem_alloc);
++	else
++		rx_count = atomic_read(&asoc->base.sk->sk_rmem_alloc);
++
++	/* If we've reached or overflowed our receive buffer, announce
++	 * a 0 rwnd if rwnd would still be positive.  Store the
++	 * the potential pressure overflow so that the window can be restored
++	 * back to original value.
++	 */
++	if (rx_count >= asoc->base.sk->sk_rcvbuf)
++		over = 1;
++
++	if (asoc->rwnd >= len) {
++		asoc->rwnd -= len;
++		if (over) {
++			asoc->rwnd_press += asoc->rwnd;
++			asoc->rwnd = 0;
++		}
++	} else {
++		asoc->rwnd_over = len - asoc->rwnd;
++		asoc->rwnd = 0;
++	}
++
++	pr_debug("%s: asoc:%p rwnd decreased by %d to (%u, %u, %u)\n",
++		 __func__, asoc, len, asoc->rwnd, asoc->rwnd_over,
++		 asoc->rwnd_press);
++}
+ 
+ /* Build the bind address list for the association based on info from the
+  * local endpoint and the remote peer.
+diff --git a/net/sctp/auth.c b/net/sctp/auth.c
+index 683c7d1b1306..0e8529113dc5 100644
+--- a/net/sctp/auth.c
++++ b/net/sctp/auth.c
+@@ -386,14 +386,13 @@ nomem:
+  */
+ int sctp_auth_asoc_init_active_key(struct sctp_association *asoc, gfp_t gfp)
+ {
+-	struct net *net = sock_net(asoc->base.sk);
+ 	struct sctp_auth_bytes	*secret;
+ 	struct sctp_shared_key *ep_key;
+ 
+ 	/* If we don't support AUTH, or peer is not capable
+ 	 * we don't need to do anything.
+ 	 */
+-	if (!net->sctp.auth_enable || !asoc->peer.auth_capable)
++	if (!asoc->ep->auth_enable || !asoc->peer.auth_capable)
+ 		return 0;
+ 
+ 	/* If the key_id is non-zero and we couldn't find an
+@@ -440,16 +439,16 @@ struct sctp_shared_key *sctp_auth_get_shkey(
+  */
+ int sctp_auth_init_hmacs(struct sctp_endpoint *ep, gfp_t gfp)
+ {
+-	struct net *net = sock_net(ep->base.sk);
+ 	struct crypto_hash *tfm = NULL;
+ 	__u16   id;
+ 
+-	/* if the transforms are already allocted, we are done */
+-	if (!net->sctp.auth_enable) {
++	/* If AUTH extension is disabled, we are done */
++	if (!ep->auth_enable) {
+ 		ep->auth_hmacs = NULL;
+ 		return 0;
+ 	}
+ 
++	/* If the transforms are already allocated, we are done */
+ 	if (ep->auth_hmacs)
+ 		return 0;
+ 
+@@ -665,12 +664,10 @@ static int __sctp_auth_cid(sctp_cid_t chunk, struct sctp_chunks_param *param)
+ /* Check if peer requested that this chunk is authenticated */
+ int sctp_auth_send_cid(sctp_cid_t chunk, const struct sctp_association *asoc)
+ {
+-	struct net  *net;
+ 	if (!asoc)
+ 		return 0;
+ 
+-	net = sock_net(asoc->base.sk);
+-	if (!net->sctp.auth_enable || !asoc->peer.auth_capable)
++	if (!asoc->ep->auth_enable || !asoc->peer.auth_capable)
+ 		return 0;
+ 
+ 	return __sctp_auth_cid(chunk, asoc->peer.peer_chunks);
+@@ -679,12 +676,10 @@ int sctp_auth_send_cid(sctp_cid_t chunk, const struct sctp_association *asoc)
+ /* Check if we requested that peer authenticate this chunk. */
+ int sctp_auth_recv_cid(sctp_cid_t chunk, const struct sctp_association *asoc)
+ {
+-	struct net *net;
+ 	if (!asoc)
+ 		return 0;
+ 
+-	net = sock_net(asoc->base.sk);
+-	if (!net->sctp.auth_enable)
++	if (!asoc->ep->auth_enable)
+ 		return 0;
+ 
+ 	return __sctp_auth_cid(chunk,
+diff --git a/net/sctp/endpointola.c b/net/sctp/endpointola.c
+index 8e5fdea05216..3d9f429858dc 100644
+--- a/net/sctp/endpointola.c
++++ b/net/sctp/endpointola.c
+@@ -68,7 +68,8 @@ static struct sctp_endpoint *sctp_endpoint_init(struct sctp_endpoint *ep,
+ 	if (!ep->digest)
+ 		return NULL;
+ 
+-	if (net->sctp.auth_enable) {
++	ep->auth_enable = net->sctp.auth_enable;
++	if (ep->auth_enable) {
+ 		/* Allocate space for HMACS and CHUNKS authentication
+ 		 * variables.  There are arrays that we encode directly
+ 		 * into parameters to make the rest of the operations easier.
+diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
+index 4e1d0fcb028e..a62a215dd22e 100644
+--- a/net/sctp/protocol.c
++++ b/net/sctp/protocol.c
+@@ -491,8 +491,13 @@ static void sctp_v4_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
+ 			continue;
+ 		if ((laddr->state == SCTP_ADDR_SRC) &&
+ 		    (AF_INET == laddr->a.sa.sa_family)) {
+-			fl4->saddr = laddr->a.v4.sin_addr.s_addr;
+ 			fl4->fl4_sport = laddr->a.v4.sin_port;
++			flowi4_update_output(fl4,
++					     asoc->base.sk->sk_bound_dev_if,
++					     RT_CONN_FLAGS(asoc->base.sk),
++					     daddr->v4.sin_addr.s_addr,
++					     laddr->a.v4.sin_addr.s_addr);
++
+ 			rt = ip_route_output_key(sock_net(sk), fl4);
+ 			if (!IS_ERR(rt)) {
+ 				dst = &rt->dst;
+diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
+index 3a1767ef3201..fee5552ddf92 100644
+--- a/net/sctp/sm_make_chunk.c
++++ b/net/sctp/sm_make_chunk.c
+@@ -219,6 +219,7 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
+ 			     gfp_t gfp, int vparam_len)
+ {
+ 	struct net *net = sock_net(asoc->base.sk);
++	struct sctp_endpoint *ep = asoc->ep;
+ 	sctp_inithdr_t init;
+ 	union sctp_params addrs;
+ 	size_t chunksize;
+@@ -278,7 +279,7 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
+ 	chunksize += vparam_len;
+ 
+ 	/* Account for AUTH related parameters */
+-	if (net->sctp.auth_enable) {
++	if (ep->auth_enable) {
+ 		/* Add random parameter length*/
+ 		chunksize += sizeof(asoc->c.auth_random);
+ 
+@@ -363,7 +364,7 @@ struct sctp_chunk *sctp_make_init(const struct sctp_association *asoc,
+ 	}
+ 
+ 	/* Add SCTP-AUTH chunks to the parameter list */
+-	if (net->sctp.auth_enable) {
++	if (ep->auth_enable) {
+ 		sctp_addto_chunk(retval, sizeof(asoc->c.auth_random),
+ 				 asoc->c.auth_random);
+ 		if (auth_hmacs)
+@@ -2010,7 +2011,7 @@ static void sctp_process_ext_param(struct sctp_association *asoc,
+ 			/* if the peer reports AUTH, assume that he
+ 			 * supports AUTH.
+ 			 */
+-			if (net->sctp.auth_enable)
++			if (asoc->ep->auth_enable)
+ 				asoc->peer.auth_capable = 1;
+ 			break;
+ 		case SCTP_CID_ASCONF:
+@@ -2102,6 +2103,7 @@ static sctp_ierror_t sctp_process_unk_param(const struct sctp_association *asoc,
+  * 	SCTP_IERROR_NO_ERROR - continue with the chunk
+  */
+ static sctp_ierror_t sctp_verify_param(struct net *net,
++					const struct sctp_endpoint *ep,
+ 					const struct sctp_association *asoc,
+ 					union sctp_params param,
+ 					sctp_cid_t cid,
+@@ -2152,7 +2154,7 @@ static sctp_ierror_t sctp_verify_param(struct net *net,
+ 		goto fallthrough;
+ 
+ 	case SCTP_PARAM_RANDOM:
+-		if (!net->sctp.auth_enable)
++		if (!ep->auth_enable)
+ 			goto fallthrough;
+ 
+ 		/* SCTP-AUTH: Secion 6.1
+@@ -2169,7 +2171,7 @@ static sctp_ierror_t sctp_verify_param(struct net *net,
+ 		break;
+ 
+ 	case SCTP_PARAM_CHUNKS:
+-		if (!net->sctp.auth_enable)
++		if (!ep->auth_enable)
+ 			goto fallthrough;
+ 
+ 		/* SCTP-AUTH: Section 3.2
+@@ -2185,7 +2187,7 @@ static sctp_ierror_t sctp_verify_param(struct net *net,
+ 		break;
+ 
+ 	case SCTP_PARAM_HMAC_ALGO:
+-		if (!net->sctp.auth_enable)
++		if (!ep->auth_enable)
+ 			goto fallthrough;
+ 
+ 		hmacs = (struct sctp_hmac_algo_param *)param.p;
+@@ -2220,10 +2222,9 @@ fallthrough:
+ }
+ 
+ /* Verify the INIT packet before we process it.  */
+-int sctp_verify_init(struct net *net, const struct sctp_association *asoc,
+-		     sctp_cid_t cid,
+-		     sctp_init_chunk_t *peer_init,
+-		     struct sctp_chunk *chunk,
++int sctp_verify_init(struct net *net, const struct sctp_endpoint *ep,
++		     const struct sctp_association *asoc, sctp_cid_t cid,
++		     sctp_init_chunk_t *peer_init, struct sctp_chunk *chunk,
+ 		     struct sctp_chunk **errp)
+ {
+ 	union sctp_params param;
+@@ -2264,8 +2265,8 @@ int sctp_verify_init(struct net *net, const struct sctp_association *asoc,
+ 
+ 	/* Verify all the variable length parameters */
+ 	sctp_walk_params(param, peer_init, init_hdr.params) {
+-
+-		result = sctp_verify_param(net, asoc, param, cid, chunk, errp);
++		result = sctp_verify_param(net, ep, asoc, param, cid,
++					   chunk, errp);
+ 		switch (result) {
+ 		case SCTP_IERROR_ABORT:
+ 		case SCTP_IERROR_NOMEM:
+@@ -2497,6 +2498,7 @@ static int sctp_process_param(struct sctp_association *asoc,
+ 	struct sctp_af *af;
+ 	union sctp_addr_param *addr_param;
+ 	struct sctp_transport *t;
++	struct sctp_endpoint *ep = asoc->ep;
+ 
+ 	/* We maintain all INIT parameters in network byte order all the
+ 	 * time.  This allows us to not worry about whether the parameters
+@@ -2636,7 +2638,7 @@ do_addr_param:
+ 		goto fall_through;
+ 
+ 	case SCTP_PARAM_RANDOM:
+-		if (!net->sctp.auth_enable)
++		if (!ep->auth_enable)
+ 			goto fall_through;
+ 
+ 		/* Save peer's random parameter */
+@@ -2649,7 +2651,7 @@ do_addr_param:
+ 		break;
+ 
+ 	case SCTP_PARAM_HMAC_ALGO:
+-		if (!net->sctp.auth_enable)
++		if (!ep->auth_enable)
+ 			goto fall_through;
+ 
+ 		/* Save peer's HMAC list */
+@@ -2665,7 +2667,7 @@ do_addr_param:
+ 		break;
+ 
+ 	case SCTP_PARAM_CHUNKS:
+-		if (!net->sctp.auth_enable)
++		if (!ep->auth_enable)
+ 			goto fall_through;
+ 
+ 		asoc->peer.peer_chunks = kmemdup(param.p,
+diff --git a/net/sctp/sm_sideeffect.c b/net/sctp/sm_sideeffect.c
+index 5d6883ff00c3..fef2acdf4a2e 100644
+--- a/net/sctp/sm_sideeffect.c
++++ b/net/sctp/sm_sideeffect.c
+@@ -496,11 +496,10 @@ static void sctp_do_8_2_transport_strike(sctp_cmd_seq_t *commands,
+ 
+ 	/* If the transport error count is greater than the pf_retrans
+ 	 * threshold, and less than pathmaxrtx, and if the current state
+-	 * is not SCTP_UNCONFIRMED, then mark this transport as Partially
+-	 * Failed, see SCTP Quick Failover Draft, section 5.1
++	 * is SCTP_ACTIVE, then mark this transport as Partially Failed,
++	 * see SCTP Quick Failover Draft, section 5.1
+ 	 */
+-	if ((transport->state != SCTP_PF) &&
+-	   (transport->state != SCTP_UNCONFIRMED) &&
++	if ((transport->state == SCTP_ACTIVE) &&
+ 	   (asoc->pf_retrans < transport->pathmaxrxt) &&
+ 	   (transport->error_count > asoc->pf_retrans)) {
+ 
+diff --git a/net/sctp/sm_statefuns.c b/net/sctp/sm_statefuns.c
+index 01e002430c85..5170a1ff95a1 100644
+--- a/net/sctp/sm_statefuns.c
++++ b/net/sctp/sm_statefuns.c
+@@ -357,7 +357,7 @@ sctp_disposition_t sctp_sf_do_5_1B_init(struct net *net,
+ 
+ 	/* Verify the INIT chunk before processing it. */
+ 	err_chunk = NULL;
+-	if (!sctp_verify_init(net, asoc, chunk->chunk_hdr->type,
++	if (!sctp_verify_init(net, ep, asoc, chunk->chunk_hdr->type,
+ 			      (sctp_init_chunk_t *)chunk->chunk_hdr, chunk,
+ 			      &err_chunk)) {
+ 		/* This chunk contains fatal error. It is to be discarded.
+@@ -524,7 +524,7 @@ sctp_disposition_t sctp_sf_do_5_1C_ack(struct net *net,
+ 
+ 	/* Verify the INIT chunk before processing it. */
+ 	err_chunk = NULL;
+-	if (!sctp_verify_init(net, asoc, chunk->chunk_hdr->type,
++	if (!sctp_verify_init(net, ep, asoc, chunk->chunk_hdr->type,
+ 			      (sctp_init_chunk_t *)chunk->chunk_hdr, chunk,
+ 			      &err_chunk)) {
+ 
+@@ -1430,7 +1430,7 @@ static sctp_disposition_t sctp_sf_do_unexpected_init(
+ 
+ 	/* Verify the INIT chunk before processing it. */
+ 	err_chunk = NULL;
+-	if (!sctp_verify_init(net, asoc, chunk->chunk_hdr->type,
++	if (!sctp_verify_init(net, ep, asoc, chunk->chunk_hdr->type,
+ 			      (sctp_init_chunk_t *)chunk->chunk_hdr, chunk,
+ 			      &err_chunk)) {
+ 		/* This chunk contains fatal error. It is to be discarded.
+@@ -6178,7 +6178,7 @@ static int sctp_eat_data(const struct sctp_association *asoc,
+ 	 * PMTU.  In cases, such as loopback, this might be a rather
+ 	 * large spill over.
+ 	 */
+-	if ((!chunk->data_accepted) && (!asoc->rwnd ||
++	if ((!chunk->data_accepted) && (!asoc->rwnd || asoc->rwnd_over ||
+ 	    (datalen > asoc->rwnd + asoc->frag_point))) {
+ 
+ 		/* If this is the next TSN, consider reneging to make
+diff --git a/net/sctp/socket.c b/net/sctp/socket.c
+index 981aaf8b6ace..604a6acdf92e 100644
+--- a/net/sctp/socket.c
++++ b/net/sctp/socket.c
+@@ -2115,6 +2115,12 @@ static int sctp_recvmsg(struct kiocb *iocb, struct sock *sk,
+ 		sctp_skb_pull(skb, copied);
+ 		skb_queue_head(&sk->sk_receive_queue, skb);
+ 
++		/* When only partial message is copied to the user, increase
++		 * rwnd by that amount. If all the data in the skb is read,
++		 * rwnd is updated when the event is freed.
++		 */
++		if (!sctp_ulpevent_is_notification(event))
++			sctp_assoc_rwnd_increase(event->asoc, copied);
+ 		goto out;
+ 	} else if ((event->msg_flags & MSG_NOTIFICATION) ||
+ 		   (event->msg_flags & MSG_EOR))
+@@ -3315,10 +3321,10 @@ static int sctp_setsockopt_auth_chunk(struct sock *sk,
+ 				      char __user *optval,
+ 				      unsigned int optlen)
+ {
+-	struct net *net = sock_net(sk);
++	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
+ 	struct sctp_authchunk val;
+ 
+-	if (!net->sctp.auth_enable)
++	if (!ep->auth_enable)
+ 		return -EACCES;
+ 
+ 	if (optlen != sizeof(struct sctp_authchunk))
+@@ -3335,7 +3341,7 @@ static int sctp_setsockopt_auth_chunk(struct sock *sk,
+ 	}
+ 
+ 	/* add this chunk id to the endpoint */
+-	return sctp_auth_ep_add_chunkid(sctp_sk(sk)->ep, val.sauth_chunk);
++	return sctp_auth_ep_add_chunkid(ep, val.sauth_chunk);
+ }
+ 
+ /*
+@@ -3348,12 +3354,12 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk,
+ 				      char __user *optval,
+ 				      unsigned int optlen)
+ {
+-	struct net *net = sock_net(sk);
++	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
+ 	struct sctp_hmacalgo *hmacs;
+ 	u32 idents;
+ 	int err;
+ 
+-	if (!net->sctp.auth_enable)
++	if (!ep->auth_enable)
+ 		return -EACCES;
+ 
+ 	if (optlen < sizeof(struct sctp_hmacalgo))
+@@ -3370,7 +3376,7 @@ static int sctp_setsockopt_hmac_ident(struct sock *sk,
+ 		goto out;
+ 	}
+ 
+-	err = sctp_auth_ep_set_hmacs(sctp_sk(sk)->ep, hmacs);
++	err = sctp_auth_ep_set_hmacs(ep, hmacs);
+ out:
+ 	kfree(hmacs);
+ 	return err;
+@@ -3386,12 +3392,12 @@ static int sctp_setsockopt_auth_key(struct sock *sk,
+ 				    char __user *optval,
+ 				    unsigned int optlen)
+ {
+-	struct net *net = sock_net(sk);
++	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
+ 	struct sctp_authkey *authkey;
+ 	struct sctp_association *asoc;
+ 	int ret;
+ 
+-	if (!net->sctp.auth_enable)
++	if (!ep->auth_enable)
+ 		return -EACCES;
+ 
+ 	if (optlen <= sizeof(struct sctp_authkey))
+@@ -3412,7 +3418,7 @@ static int sctp_setsockopt_auth_key(struct sock *sk,
+ 		goto out;
+ 	}
+ 
+-	ret = sctp_auth_set_key(sctp_sk(sk)->ep, asoc, authkey);
++	ret = sctp_auth_set_key(ep, asoc, authkey);
+ out:
+ 	kzfree(authkey);
+ 	return ret;
+@@ -3428,11 +3434,11 @@ static int sctp_setsockopt_active_key(struct sock *sk,
+ 				      char __user *optval,
+ 				      unsigned int optlen)
+ {
+-	struct net *net = sock_net(sk);
++	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
+ 	struct sctp_authkeyid val;
+ 	struct sctp_association *asoc;
+ 
+-	if (!net->sctp.auth_enable)
++	if (!ep->auth_enable)
+ 		return -EACCES;
+ 
+ 	if (optlen != sizeof(struct sctp_authkeyid))
+@@ -3444,8 +3450,7 @@ static int sctp_setsockopt_active_key(struct sock *sk,
+ 	if (!asoc && val.scact_assoc_id && sctp_style(sk, UDP))
+ 		return -EINVAL;
+ 
+-	return sctp_auth_set_active_key(sctp_sk(sk)->ep, asoc,
+-					val.scact_keynumber);
++	return sctp_auth_set_active_key(ep, asoc, val.scact_keynumber);
+ }
+ 
+ /*
+@@ -3457,11 +3462,11 @@ static int sctp_setsockopt_del_key(struct sock *sk,
+ 				   char __user *optval,
+ 				   unsigned int optlen)
+ {
+-	struct net *net = sock_net(sk);
++	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
+ 	struct sctp_authkeyid val;
+ 	struct sctp_association *asoc;
+ 
+-	if (!net->sctp.auth_enable)
++	if (!ep->auth_enable)
+ 		return -EACCES;
+ 
+ 	if (optlen != sizeof(struct sctp_authkeyid))
+@@ -3473,8 +3478,7 @@ static int sctp_setsockopt_del_key(struct sock *sk,
+ 	if (!asoc && val.scact_assoc_id && sctp_style(sk, UDP))
+ 		return -EINVAL;
+ 
+-	return sctp_auth_del_key_id(sctp_sk(sk)->ep, asoc,
+-				    val.scact_keynumber);
++	return sctp_auth_del_key_id(ep, asoc, val.scact_keynumber);
+ 
+ }
+ 
+@@ -5381,16 +5385,16 @@ static int sctp_getsockopt_maxburst(struct sock *sk, int len,
+ static int sctp_getsockopt_hmac_ident(struct sock *sk, int len,
+ 				    char __user *optval, int __user *optlen)
+ {
+-	struct net *net = sock_net(sk);
++	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
+ 	struct sctp_hmacalgo  __user *p = (void __user *)optval;
+ 	struct sctp_hmac_algo_param *hmacs;
+ 	__u16 data_len = 0;
+ 	u32 num_idents;
+ 
+-	if (!net->sctp.auth_enable)
++	if (!ep->auth_enable)
+ 		return -EACCES;
+ 
+-	hmacs = sctp_sk(sk)->ep->auth_hmacs_list;
++	hmacs = ep->auth_hmacs_list;
+ 	data_len = ntohs(hmacs->param_hdr.length) - sizeof(sctp_paramhdr_t);
+ 
+ 	if (len < sizeof(struct sctp_hmacalgo) + data_len)
+@@ -5411,11 +5415,11 @@ static int sctp_getsockopt_hmac_ident(struct sock *sk, int len,
+ static int sctp_getsockopt_active_key(struct sock *sk, int len,
+ 				    char __user *optval, int __user *optlen)
+ {
+-	struct net *net = sock_net(sk);
++	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
+ 	struct sctp_authkeyid val;
+ 	struct sctp_association *asoc;
+ 
+-	if (!net->sctp.auth_enable)
++	if (!ep->auth_enable)
+ 		return -EACCES;
+ 
+ 	if (len < sizeof(struct sctp_authkeyid))
+@@ -5430,7 +5434,7 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len,
+ 	if (asoc)
+ 		val.scact_keynumber = asoc->active_key_id;
+ 	else
+-		val.scact_keynumber = sctp_sk(sk)->ep->active_key_id;
++		val.scact_keynumber = ep->active_key_id;
+ 
+ 	len = sizeof(struct sctp_authkeyid);
+ 	if (put_user(len, optlen))
+@@ -5444,7 +5448,7 @@ static int sctp_getsockopt_active_key(struct sock *sk, int len,
+ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,
+ 				    char __user *optval, int __user *optlen)
+ {
+-	struct net *net = sock_net(sk);
++	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
+ 	struct sctp_authchunks __user *p = (void __user *)optval;
+ 	struct sctp_authchunks val;
+ 	struct sctp_association *asoc;
+@@ -5452,7 +5456,7 @@ static int sctp_getsockopt_peer_auth_chunks(struct sock *sk, int len,
+ 	u32    num_chunks = 0;
+ 	char __user *to;
+ 
+-	if (!net->sctp.auth_enable)
++	if (!ep->auth_enable)
+ 		return -EACCES;
+ 
+ 	if (len < sizeof(struct sctp_authchunks))
+@@ -5489,7 +5493,7 @@ num:
+ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
+ 				    char __user *optval, int __user *optlen)
+ {
+-	struct net *net = sock_net(sk);
++	struct sctp_endpoint *ep = sctp_sk(sk)->ep;
+ 	struct sctp_authchunks __user *p = (void __user *)optval;
+ 	struct sctp_authchunks val;
+ 	struct sctp_association *asoc;
+@@ -5497,7 +5501,7 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
+ 	u32    num_chunks = 0;
+ 	char __user *to;
+ 
+-	if (!net->sctp.auth_enable)
++	if (!ep->auth_enable)
+ 		return -EACCES;
+ 
+ 	if (len < sizeof(struct sctp_authchunks))
+@@ -5514,7 +5518,7 @@ static int sctp_getsockopt_local_auth_chunks(struct sock *sk, int len,
+ 	if (asoc)
+ 		ch = (struct sctp_chunks_param *)asoc->c.auth_chunks;
+ 	else
+-		ch = sctp_sk(sk)->ep->auth_chunk_list;
++		ch = ep->auth_chunk_list;
+ 
+ 	if (!ch)
+ 		goto num;
+@@ -6593,6 +6597,46 @@ static void __sctp_write_space(struct sctp_association *asoc)
+ 	}
+ }
+ 
++static void sctp_wake_up_waiters(struct sock *sk,
++				 struct sctp_association *asoc)
++{
++	struct sctp_association *tmp = asoc;
++
++	/* We do accounting for the sndbuf space per association,
++	 * so we only need to wake our own association.
++	 */
++	if (asoc->ep->sndbuf_policy)
++		return __sctp_write_space(asoc);
++
++	/* If association goes down and is just flushing its
++	 * outq, then just normally notify others.
++	 */
++	if (asoc->base.dead)
++		return sctp_write_space(sk);
++
++	/* Accounting for the sndbuf space is per socket, so we
++	 * need to wake up others, try to be fair and in case of
++	 * other associations, let them have a go first instead
++	 * of just doing a sctp_write_space() call.
++	 *
++	 * Note that we reach sctp_wake_up_waiters() only when
++	 * associations free up queued chunks, thus we are under
++	 * lock and the list of associations on a socket is
++	 * guaranteed not to change.
++	 */
++	for (tmp = list_next_entry(tmp, asocs); 1;
++	     tmp = list_next_entry(tmp, asocs)) {
++		/* Manually skip the head element. */
++		if (&tmp->asocs == &((sctp_sk(sk))->ep->asocs))
++			continue;
++		/* Wake up association. */
++		__sctp_write_space(tmp);
++		/* We've reached the end. */
++		if (tmp == asoc)
++			break;
++	}
++}
++
+ /* Do accounting for the sndbuf space.
+  * Decrement the used sndbuf space of the corresponding association by the
+  * data size which was just transmitted(freed).
+@@ -6620,7 +6664,7 @@ static void sctp_wfree(struct sk_buff *skb)
+ 	sk_mem_uncharge(sk, skb->truesize);
+ 
+ 	sock_wfree(skb);
+-	__sctp_write_space(asoc);
++	sctp_wake_up_waiters(sk, asoc);
+ 
+ 	sctp_association_put(asoc);
+ }
+diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c
+index 35c8923b5554..c82fdc1eab7c 100644
+--- a/net/sctp/sysctl.c
++++ b/net/sctp/sysctl.c
+@@ -64,6 +64,9 @@ static int proc_sctp_do_rto_min(struct ctl_table *ctl, int write,
+ static int proc_sctp_do_rto_max(struct ctl_table *ctl, int write,
+ 				void __user *buffer, size_t *lenp,
+ 				loff_t *ppos);
++static int proc_sctp_do_auth(struct ctl_table *ctl, int write,
++			     void __user *buffer, size_t *lenp,
++			     loff_t *ppos);
+ 
+ static struct ctl_table sctp_table[] = {
+ 	{
+@@ -266,7 +269,7 @@ static struct ctl_table sctp_net_table[] = {
+ 		.data		= &init_net.sctp.auth_enable,
+ 		.maxlen		= sizeof(int),
+ 		.mode		= 0644,
+-		.proc_handler	= proc_dointvec,
++		.proc_handler	= proc_sctp_do_auth,
+ 	},
+ 	{
+ 		.procname	= "addr_scope_policy",
+@@ -400,6 +403,37 @@ static int proc_sctp_do_rto_max(struct ctl_table *ctl, int write,
+ 	return ret;
+ }
+ 
++static int proc_sctp_do_auth(struct ctl_table *ctl, int write,
++			     void __user *buffer, size_t *lenp,
++			     loff_t *ppos)
++{
++	struct net *net = current->nsproxy->net_ns;
++	struct ctl_table tbl;
++	int new_value, ret;
++
++	memset(&tbl, 0, sizeof(struct ctl_table));
++	tbl.maxlen = sizeof(unsigned int);
++
++	if (write)
++		tbl.data = &new_value;
++	else
++		tbl.data = &net->sctp.auth_enable;
++
++	ret = proc_dointvec(&tbl, write, buffer, lenp, ppos);
++
++	if (write) {
++		struct sock *sk = net->sctp.ctl_sock;
++
++		net->sctp.auth_enable = new_value;
++		/* Update the value in the control socket */
++		lock_sock(sk);
++		sctp_sk(sk)->ep->auth_enable = new_value;
++		release_sock(sk);
++	}
++
++	return ret;
++}
++
+ int sctp_sysctl_net_register(struct net *net)
+ {
+ 	struct ctl_table *table = sctp_net_table;
+diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c
+index 8d198ae03606..85c64658bd0b 100644
+--- a/net/sctp/ulpevent.c
++++ b/net/sctp/ulpevent.c
+@@ -989,7 +989,7 @@ static void sctp_ulpevent_receive_data(struct sctp_ulpevent *event,
+ 	skb = sctp_event2skb(event);
+ 	/* Set the owner and charge rwnd for bytes received.  */
+ 	sctp_ulpevent_set_owner(event, asoc);
+-	sctp_assoc_rwnd_update(asoc, false);
++	sctp_assoc_rwnd_decrease(asoc, skb_headlen(skb));
+ 
+ 	if (!skb->data_len)
+ 		return;
+@@ -1011,7 +1011,6 @@ static void sctp_ulpevent_release_data(struct sctp_ulpevent *event)
+ {
+ 	struct sk_buff *skb, *frag;
+ 	unsigned int	len;
+-	struct sctp_association *asoc;
+ 
+ 	/* Current stack structures assume that the rcv buffer is
+ 	 * per socket.   For UDP style sockets this is not true as
+@@ -1036,11 +1035,8 @@ static void sctp_ulpevent_release_data(struct sctp_ulpevent *event)
+ 	}
+ 
+ done:
+-	asoc = event->asoc;
+-	sctp_association_hold(asoc);
++	sctp_assoc_rwnd_increase(event->asoc, len);
+ 	sctp_ulpevent_release_owner(event);
+-	sctp_assoc_rwnd_update(asoc, true);
+-	sctp_association_put(asoc);
+ }
+ 
+ static void sctp_ulpevent_release_frag_data(struct sctp_ulpevent *event)
+diff --git a/net/vmw_vsock/af_vsock.c b/net/vmw_vsock/af_vsock.c
+index 5adfd94c5b85..85d232bed87d 100644
+--- a/net/vmw_vsock/af_vsock.c
++++ b/net/vmw_vsock/af_vsock.c
+@@ -1925,9 +1925,23 @@ static struct miscdevice vsock_device = {
+ 	.fops		= &vsock_device_ops,
+ };
+ 
+-static int __vsock_core_init(void)
++int __vsock_core_init(const struct vsock_transport *t, struct module *owner)
+ {
+-	int err;
++	int err = mutex_lock_interruptible(&vsock_register_mutex);
++
++	if (err)
++		return err;
++
++	if (transport) {
++		err = -EBUSY;
++		goto err_busy;
++	}
++
++	/* Transport must be the owner of the protocol so that it can't
++	 * unload while there are open sockets.
++	 */
++	vsock_proto.owner = owner;
++	transport = t;
+ 
+ 	vsock_init_tables();
+ 
+@@ -1951,36 +1965,19 @@ static int __vsock_core_init(void)
+ 		goto err_unregister_proto;
+ 	}
+ 
++	mutex_unlock(&vsock_register_mutex);
+ 	return 0;
+ 
+ err_unregister_proto:
+ 	proto_unregister(&vsock_proto);
+ err_misc_deregister:
+ 	misc_deregister(&vsock_device);
+-	return err;
+-}
+-
+-int vsock_core_init(const struct vsock_transport *t)
+-{
+-	int retval = mutex_lock_interruptible(&vsock_register_mutex);
+-	if (retval)
+-		return retval;
+-
+-	if (transport) {
+-		retval = -EBUSY;
+-		goto out;
+-	}
+-
+-	transport = t;
+-	retval = __vsock_core_init();
+-	if (retval)
+-		transport = NULL;
+-
+-out:
++	transport = NULL;
++err_busy:
+ 	mutex_unlock(&vsock_register_mutex);
+-	return retval;
++	return err;
+ }
+-EXPORT_SYMBOL_GPL(vsock_core_init);
++EXPORT_SYMBOL_GPL(__vsock_core_init);
+ 
+ void vsock_core_exit(void)
+ {
+@@ -2000,5 +1997,5 @@ EXPORT_SYMBOL_GPL(vsock_core_exit);
+ 
+ MODULE_AUTHOR("VMware, Inc.");
+ MODULE_DESCRIPTION("VMware Virtual Socket Family");
+-MODULE_VERSION("1.0.0.0-k");
++MODULE_VERSION("1.0.1.0-k");
+ MODULE_LICENSE("GPL v2");
+diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c
+index 1587ea392ad6..30e8e0c3f117 100644
+--- a/tools/lib/traceevent/event-parse.c
++++ b/tools/lib/traceevent/event-parse.c
+@@ -4321,6 +4321,7 @@ static void pretty_print(struct trace_seq *s, void *data, int size, struct event
+ 					      format, len_arg, arg);
+ 				trace_seq_terminate(&p);
+ 				trace_seq_puts(s, p.buffer);
++				trace_seq_destroy(&p);
+ 				arg = arg->next;
+ 				break;
+ 			default: