[gentoo-commits] proj/linux-patches:4.14 commit in: /

[Mike Pagano]

commit:     7ecc929baefbf40295eeec0c6de3dda1343a74df
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Sep 29 13:35:19 2018 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Sep 29 13:35:19 2018 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=7ecc929b

Linux patch 4.14.73

Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>

 0000_README              |    4 +
 1072_linux-4.14.73.patch | 1830 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 1834 insertions(+)

diff --git a/0000_README b/0000_README
index ce833af..08015af 100644
--- a/0000_README
+++ b/0000_README
@@ -331,6 +331,10 @@ Patch:  1071_linux-4.14.72.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.14.72
 
+Patch:  1072_linux-4.14.73.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.14.73
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1072_linux-4.14.73.patch b/1072_linux-4.14.73.patch
new file mode 100644
index 0000000..9020dd3
--- /dev/null
+++ b/1072_linux-4.14.73.patch
@@ -0,0 +1,1830 @@
+diff --git a/Makefile b/Makefile
+index 734722bda173..89f30ca964b6 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 14
+-SUBLEVEL = 72
++SUBLEVEL = 73
+ EXTRAVERSION =
+ NAME = Petit Gorille
+ 
+diff --git a/arch/x86/xen/pmu.c b/arch/x86/xen/pmu.c
+index 7d00d4ad44d4..95997e6c0696 100644
+--- a/arch/x86/xen/pmu.c
++++ b/arch/x86/xen/pmu.c
+@@ -478,7 +478,7 @@ static void xen_convert_regs(const struct xen_pmu_regs *xen_regs,
+ irqreturn_t xen_pmu_irq_handler(int irq, void *dev_id)
+ {
+ 	int err, ret = IRQ_NONE;
+-	struct pt_regs regs;
++	struct pt_regs regs = {0};
+ 	const struct xen_pmu_data *xenpmu_data = get_xenpmu_data();
+ 	uint8_t xenpmu_flags = get_xenpmu_flags();
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
+index fd435a96481c..e8d9479615c9 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
+@@ -715,12 +715,14 @@ static int amdgpu_cgs_get_firmware_info(struct cgs_device *cgs_device,
+ 				break;
+ 			case CHIP_POLARIS10:
+ 				if (type == CGS_UCODE_ID_SMU) {
+-					if ((adev->pdev->device == 0x67df) &&
+-					    ((adev->pdev->revision == 0xe0) ||
+-					     (adev->pdev->revision == 0xe3) ||
+-					     (adev->pdev->revision == 0xe4) ||
+-					     (adev->pdev->revision == 0xe5) ||
+-					     (adev->pdev->revision == 0xe7) ||
++					if (((adev->pdev->device == 0x67df) &&
++					     ((adev->pdev->revision == 0xe0) ||
++					      (adev->pdev->revision == 0xe3) ||
++					      (adev->pdev->revision == 0xe4) ||
++					      (adev->pdev->revision == 0xe5) ||
++					      (adev->pdev->revision == 0xe7) ||
++					      (adev->pdev->revision == 0xef))) ||
++					    ((adev->pdev->device == 0x6fdf) &&
+ 					     (adev->pdev->revision == 0xef))) {
+ 						info->is_kicker = true;
+ 						strcpy(fw_name, "amdgpu/polaris10_k_smc.bin");
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+index 0f16986ec5bc..4dd68d821353 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
+@@ -500,6 +500,7 @@ static const struct pci_device_id pciidlist[] = {
+ 	{0x1002, 0x67CA, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10},
+ 	{0x1002, 0x67CC, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10},
+ 	{0x1002, 0x67CF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10},
++	{0x1002, 0x6FDF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10},
+ 	/* Polaris12 */
+ 	{0x1002, 0x6980, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
+ 	{0x1002, 0x6981, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
+diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
+index 430830d63a33..2c6d19683688 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_connector.c
++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
+@@ -570,12 +570,16 @@ nouveau_connector_detect(struct drm_connector *connector, bool force)
+ 		nv_connector->edid = NULL;
+ 	}
+ 
+-	/* Outputs are only polled while runtime active, so acquiring a
+-	 * runtime PM ref here is unnecessary (and would deadlock upon
+-	 * runtime suspend because it waits for polling to finish).
++	/* Outputs are only polled while runtime active, so resuming the
++	 * device here is unnecessary (and would deadlock upon runtime suspend
++	 * because it waits for polling to finish). We do however, want to
++	 * prevent the autosuspend timer from elapsing during this operation
++	 * if possible.
+ 	 */
+-	if (!drm_kms_helper_is_poll_worker()) {
+-		ret = pm_runtime_get_sync(connector->dev->dev);
++	if (drm_kms_helper_is_poll_worker()) {
++		pm_runtime_get_noresume(dev->dev);
++	} else {
++		ret = pm_runtime_get_sync(dev->dev);
+ 		if (ret < 0 && ret != -EACCES)
+ 			return conn_status;
+ 	}
+@@ -653,10 +657,8 @@ detect_analog:
+ 
+  out:
+ 
+-	if (!drm_kms_helper_is_poll_worker()) {
+-		pm_runtime_mark_last_busy(connector->dev->dev);
+-		pm_runtime_put_autosuspend(connector->dev->dev);
+-	}
++	pm_runtime_mark_last_busy(dev->dev);
++	pm_runtime_put_autosuspend(dev->dev);
+ 
+ 	return conn_status;
+ }
+@@ -1120,6 +1122,26 @@ nouveau_connector_hotplug(struct nvif_notify *notify)
+ 	const struct nvif_notify_conn_rep_v0 *rep = notify->data;
+ 	const char *name = connector->name;
+ 	struct nouveau_encoder *nv_encoder;
++	int ret;
++
++	ret = pm_runtime_get(drm->dev->dev);
++	if (ret == 0) {
++		/* We can't block here if there's a pending PM request
++		 * running, as we'll deadlock nouveau_display_fini() when it
++		 * calls nvif_put() on our nvif_notify struct. So, simply
++		 * defer the hotplug event until the device finishes resuming
++		 */
++		NV_DEBUG(drm, "Deferring HPD on %s until runtime resume\n",
++			 name);
++		schedule_work(&drm->hpd_work);
++
++		pm_runtime_put_noidle(drm->dev->dev);
++		return NVIF_NOTIFY_KEEP;
++	} else if (ret != 1 && ret != -EACCES) {
++		NV_WARN(drm, "HPD on %s dropped due to RPM failure: %d\n",
++			name, ret);
++		return NVIF_NOTIFY_DROP;
++	}
+ 
+ 	if (rep->mask & NVIF_NOTIFY_CONN_V0_IRQ) {
+ 		NV_DEBUG(drm, "service %s\n", name);
+@@ -1137,6 +1159,8 @@ nouveau_connector_hotplug(struct nvif_notify *notify)
+ 		drm_helper_hpd_irq_event(connector->dev);
+ 	}
+ 
++	pm_runtime_mark_last_busy(drm->dev->dev);
++	pm_runtime_put_autosuspend(drm->dev->dev);
+ 	return NVIF_NOTIFY_KEEP;
+ }
+ 
+diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
+index caf53503c0f7..2612702c3a3f 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_display.c
++++ b/drivers/gpu/drm/nouveau/nouveau_display.c
+@@ -356,8 +356,6 @@ nouveau_display_hpd_work(struct work_struct *work)
+ 	pm_runtime_get_sync(drm->dev->dev);
+ 
+ 	drm_helper_hpd_irq_event(drm->dev);
+-	/* enable polling for external displays */
+-	drm_kms_helper_poll_enable(drm->dev);
+ 
+ 	pm_runtime_mark_last_busy(drm->dev->dev);
+ 	pm_runtime_put_sync(drm->dev->dev);
+@@ -380,15 +378,29 @@ nouveau_display_acpi_ntfy(struct notifier_block *nb, unsigned long val,
+ {
+ 	struct nouveau_drm *drm = container_of(nb, typeof(*drm), acpi_nb);
+ 	struct acpi_bus_event *info = data;
++	int ret;
+ 
+ 	if (!strcmp(info->device_class, ACPI_VIDEO_CLASS)) {
+ 		if (info->type == ACPI_VIDEO_NOTIFY_PROBE) {
+-			/*
+-			 * This may be the only indication we receive of a
+-			 * connector hotplug on a runtime suspended GPU,
+-			 * schedule hpd_work to check.
+-			 */
+-			schedule_work(&drm->hpd_work);
++			ret = pm_runtime_get(drm->dev->dev);
++			if (ret == 1 || ret == -EACCES) {
++				/* If the GPU is already awake, or in a state
++				 * where we can't wake it up, it can handle
++				 * it's own hotplug events.
++				 */
++				pm_runtime_put_autosuspend(drm->dev->dev);
++			} else if (ret == 0) {
++				/* This may be the only indication we receive
++				 * of a connector hotplug on a runtime
++				 * suspended GPU, schedule hpd_work to check.
++				 */
++				NV_DEBUG(drm, "ACPI requested connector reprobe\n");
++				schedule_work(&drm->hpd_work);
++				pm_runtime_put_noidle(drm->dev->dev);
++			} else {
++				NV_WARN(drm, "Dropped ACPI reprobe event due to RPM error: %d\n",
++					ret);
++			}
+ 
+ 			/* acpi-video should not generate keypresses for this */
+ 			return NOTIFY_BAD;
+@@ -412,6 +424,11 @@ nouveau_display_init(struct drm_device *dev)
+ 	if (ret)
+ 		return ret;
+ 
++	/* enable connector detection and polling for connectors without HPD
++	 * support
++	 */
++	drm_kms_helper_poll_enable(dev);
++
+ 	/* enable hotplug interrupts */
+ 	drm_connector_list_iter_begin(dev, &conn_iter);
+ 	nouveau_for_each_non_mst_connector_iter(connector, &conn_iter) {
+@@ -426,7 +443,7 @@ nouveau_display_init(struct drm_device *dev)
+ }
+ 
+ void
+-nouveau_display_fini(struct drm_device *dev, bool suspend)
++nouveau_display_fini(struct drm_device *dev, bool suspend, bool runtime)
+ {
+ 	struct nouveau_display *disp = nouveau_display(dev);
+ 	struct nouveau_drm *drm = nouveau_drm(dev);
+@@ -451,6 +468,9 @@ nouveau_display_fini(struct drm_device *dev, bool suspend)
+ 	}
+ 	drm_connector_list_iter_end(&conn_iter);
+ 
++	if (!runtime)
++		cancel_work_sync(&drm->hpd_work);
++
+ 	drm_kms_helper_poll_disable(dev);
+ 	disp->fini(dev);
+ }
+@@ -640,11 +660,11 @@ nouveau_display_suspend(struct drm_device *dev, bool runtime)
+ 			}
+ 		}
+ 
+-		nouveau_display_fini(dev, true);
++		nouveau_display_fini(dev, true, runtime);
+ 		return 0;
+ 	}
+ 
+-	nouveau_display_fini(dev, true);
++	nouveau_display_fini(dev, true, runtime);
+ 
+ 	list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
+ 		struct nouveau_framebuffer *nouveau_fb;
+diff --git a/drivers/gpu/drm/nouveau/nouveau_display.h b/drivers/gpu/drm/nouveau/nouveau_display.h
+index 34cd144681b9..5e7dae79c2ee 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_display.h
++++ b/drivers/gpu/drm/nouveau/nouveau_display.h
+@@ -64,7 +64,7 @@ nouveau_display(struct drm_device *dev)
+ int  nouveau_display_create(struct drm_device *dev);
+ void nouveau_display_destroy(struct drm_device *dev);
+ int  nouveau_display_init(struct drm_device *dev);
+-void nouveau_display_fini(struct drm_device *dev, bool suspend);
++void nouveau_display_fini(struct drm_device *dev, bool suspend, bool runtime);
+ int  nouveau_display_suspend(struct drm_device *dev, bool runtime);
+ void nouveau_display_resume(struct drm_device *dev, bool runtime);
+ int  nouveau_display_vblank_enable(struct drm_device *, unsigned int);
+diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
+index d6f13d7254de..7d3c7bb0ebfa 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
++++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
+@@ -546,7 +546,7 @@ nouveau_drm_unload(struct drm_device *dev)
+ 	nouveau_debugfs_fini(drm);
+ 
+ 	if (dev->mode_config.num_crtc)
+-		nouveau_display_fini(dev, false);
++		nouveau_display_fini(dev, false, false);
+ 	nouveau_display_destroy(dev);
+ 
+ 	nouveau_bios_takedown(dev);
+diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
+index 8746eeeec44d..491f1892b50e 100644
+--- a/drivers/gpu/drm/udl/udl_fb.c
++++ b/drivers/gpu/drm/udl/udl_fb.c
+@@ -432,9 +432,11 @@ static void udl_fbdev_destroy(struct drm_device *dev,
+ {
+ 	drm_fb_helper_unregister_fbi(&ufbdev->helper);
+ 	drm_fb_helper_fini(&ufbdev->helper);
+-	drm_framebuffer_unregister_private(&ufbdev->ufb.base);
+-	drm_framebuffer_cleanup(&ufbdev->ufb.base);
+-	drm_gem_object_put_unlocked(&ufbdev->ufb.obj->base);
++	if (ufbdev->ufb.obj) {
++		drm_framebuffer_unregister_private(&ufbdev->ufb.base);
++		drm_framebuffer_cleanup(&ufbdev->ufb.base);
++		drm_gem_object_put_unlocked(&ufbdev->ufb.obj->base);
++	}
+ }
+ 
+ int udl_fbdev_init(struct drm_device *dev)
+diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
+index 17590cb2b80d..502c7eb708c2 100644
+--- a/drivers/gpu/drm/vc4/vc4_plane.c
++++ b/drivers/gpu/drm/vc4/vc4_plane.c
+@@ -329,6 +329,9 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state)
+ 	vc4_state->y_scaling[0] = vc4_get_scaling_mode(vc4_state->src_h[0],
+ 						       vc4_state->crtc_h);
+ 
++	vc4_state->is_unity = (vc4_state->x_scaling[0] == VC4_SCALING_NONE &&
++			       vc4_state->y_scaling[0] == VC4_SCALING_NONE);
++
+ 	if (num_planes > 1) {
+ 		vc4_state->is_yuv = true;
+ 
+@@ -344,24 +347,17 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state)
+ 			vc4_get_scaling_mode(vc4_state->src_h[1],
+ 					     vc4_state->crtc_h);
+ 
+-		/* YUV conversion requires that scaling be enabled,
+-		 * even on a plane that's otherwise 1:1.  Choose TPZ
+-		 * for simplicity.
++		/* YUV conversion requires that horizontal scaling be enabled,
++		 * even on a plane that's otherwise 1:1. Looks like only PPF
++		 * works in that case, so let's pick that one.
+ 		 */
+-		if (vc4_state->x_scaling[0] == VC4_SCALING_NONE)
+-			vc4_state->x_scaling[0] = VC4_SCALING_TPZ;
+-		if (vc4_state->y_scaling[0] == VC4_SCALING_NONE)
+-			vc4_state->y_scaling[0] = VC4_SCALING_TPZ;
++		if (vc4_state->is_unity)
++			vc4_state->x_scaling[0] = VC4_SCALING_PPF;
+ 	} else {
+ 		vc4_state->x_scaling[1] = VC4_SCALING_NONE;
+ 		vc4_state->y_scaling[1] = VC4_SCALING_NONE;
+ 	}
+ 
+-	vc4_state->is_unity = (vc4_state->x_scaling[0] == VC4_SCALING_NONE &&
+-			       vc4_state->y_scaling[0] == VC4_SCALING_NONE &&
+-			       vc4_state->x_scaling[1] == VC4_SCALING_NONE &&
+-			       vc4_state->y_scaling[1] == VC4_SCALING_NONE);
+-
+ 	/* No configuring scaling on the cursor plane, since it gets
+ 	   non-vblank-synced updates, and scaling requires requires
+ 	   LBM changes which have to be vblank-synced.
+@@ -639,7 +635,10 @@ static int vc4_plane_mode_set(struct drm_plane *plane,
+ 		vc4_dlist_write(vc4_state, SCALER_CSC2_ITR_R_601_5);
+ 	}
+ 
+-	if (!vc4_state->is_unity) {
++	if (vc4_state->x_scaling[0] != VC4_SCALING_NONE ||
++	    vc4_state->x_scaling[1] != VC4_SCALING_NONE ||
++	    vc4_state->y_scaling[0] != VC4_SCALING_NONE ||
++	    vc4_state->y_scaling[1] != VC4_SCALING_NONE) {
+ 		/* LBM Base Address. */
+ 		if (vc4_state->y_scaling[0] != VC4_SCALING_NONE ||
+ 		    vc4_state->y_scaling[1] != VC4_SCALING_NONE) {
+diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
+index a8a8f65a1e51..24952af51a54 100644
+--- a/drivers/infiniband/hw/cxgb4/qp.c
++++ b/drivers/infiniband/hw/cxgb4/qp.c
+@@ -1395,6 +1395,12 @@ static void flush_qp(struct c4iw_qp *qhp)
+ 	schp = to_c4iw_cq(qhp->ibqp.send_cq);
+ 
+ 	if (qhp->ibqp.uobject) {
++
++		/* for user qps, qhp->wq.flushed is protected by qhp->mutex */
++		if (qhp->wq.flushed)
++			return;
++
++		qhp->wq.flushed = 1;
+ 		t4_set_wq_in_error(&qhp->wq);
+ 		t4_set_cq_in_error(&rchp->cq);
+ 		spin_lock_irqsave(&rchp->comp_handler_lock, flag);
+diff --git a/drivers/misc/vmw_balloon.c b/drivers/misc/vmw_balloon.c
+index 5f8b583c6e41..f74166aa9a0d 100644
+--- a/drivers/misc/vmw_balloon.c
++++ b/drivers/misc/vmw_balloon.c
+@@ -45,6 +45,7 @@
+ #include <linux/seq_file.h>
+ #include <linux/vmw_vmci_defs.h>
+ #include <linux/vmw_vmci_api.h>
++#include <linux/io.h>
+ #include <asm/hypervisor.h>
+ 
+ MODULE_AUTHOR("VMware, Inc.");
+diff --git a/drivers/net/appletalk/ipddp.c b/drivers/net/appletalk/ipddp.c
+index 9375cef22420..3d27616d9c85 100644
+--- a/drivers/net/appletalk/ipddp.c
++++ b/drivers/net/appletalk/ipddp.c
+@@ -283,8 +283,12 @@ static int ipddp_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+                 case SIOCFINDIPDDPRT:
+ 			spin_lock_bh(&ipddp_route_lock);
+ 			rp = __ipddp_find_route(&rcp);
+-			if (rp)
+-				memcpy(&rcp2, rp, sizeof(rcp2));
++			if (rp) {
++				memset(&rcp2, 0, sizeof(rcp2));
++				rcp2.ip    = rp->ip;
++				rcp2.at    = rp->at;
++				rcp2.flags = rp->flags;
++			}
+ 			spin_unlock_bh(&ipddp_route_lock);
+ 
+ 			if (rp) {
+diff --git a/drivers/net/ethernet/hp/hp100.c b/drivers/net/ethernet/hp/hp100.c
+index c8c7ad2eff77..9b5a68b65432 100644
+--- a/drivers/net/ethernet/hp/hp100.c
++++ b/drivers/net/ethernet/hp/hp100.c
+@@ -2634,7 +2634,7 @@ static int hp100_login_to_vg_hub(struct net_device *dev, u_short force_relogin)
+ 		/* Wait for link to drop */
+ 		time = jiffies + (HZ / 10);
+ 		do {
+-			if (~(hp100_inb(VG_LAN_CFG_1) & HP100_LINK_UP_ST))
++			if (!(hp100_inb(VG_LAN_CFG_1) & HP100_LINK_UP_ST))
+ 				break;
+ 			if (!in_interrupt())
+ 				schedule_timeout_interruptible(1);
+diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
+index 71e2aef6b7a1..951892da3352 100644
+--- a/drivers/net/ppp/pppoe.c
++++ b/drivers/net/ppp/pppoe.c
+@@ -429,6 +429,9 @@ static int pppoe_rcv(struct sk_buff *skb, struct net_device *dev,
+ 	if (!skb)
+ 		goto out;
+ 
++	if (skb_mac_header_len(skb) < ETH_HLEN)
++		goto drop;
++
+ 	if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr)))
+ 		goto drop;
+ 
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 31684f3382f6..c5d4b35bb72a 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -1205,13 +1205,13 @@ static const struct usb_device_id products[] = {
+ 	{QMI_FIXED_INTF(0x1199, 0x9061, 8)},	/* Sierra Wireless Modem */
+ 	{QMI_FIXED_INTF(0x1199, 0x9063, 8)},	/* Sierra Wireless EM7305 */
+ 	{QMI_FIXED_INTF(0x1199, 0x9063, 10)},	/* Sierra Wireless EM7305 */
+-	{QMI_FIXED_INTF(0x1199, 0x9071, 8)},	/* Sierra Wireless MC74xx */
+-	{QMI_FIXED_INTF(0x1199, 0x9071, 10)},	/* Sierra Wireless MC74xx */
+-	{QMI_FIXED_INTF(0x1199, 0x9079, 8)},	/* Sierra Wireless EM74xx */
+-	{QMI_FIXED_INTF(0x1199, 0x9079, 10)},	/* Sierra Wireless EM74xx */
+-	{QMI_FIXED_INTF(0x1199, 0x907b, 8)},	/* Sierra Wireless EM74xx */
+-	{QMI_FIXED_INTF(0x1199, 0x907b, 10)},	/* Sierra Wireless EM74xx */
+-	{QMI_FIXED_INTF(0x1199, 0x9091, 8)},	/* Sierra Wireless EM7565 */
++	{QMI_QUIRK_SET_DTR(0x1199, 0x9071, 8)},	/* Sierra Wireless MC74xx */
++	{QMI_QUIRK_SET_DTR(0x1199, 0x9071, 10)},/* Sierra Wireless MC74xx */
++	{QMI_QUIRK_SET_DTR(0x1199, 0x9079, 8)},	/* Sierra Wireless EM74xx */
++	{QMI_QUIRK_SET_DTR(0x1199, 0x9079, 10)},/* Sierra Wireless EM74xx */
++	{QMI_QUIRK_SET_DTR(0x1199, 0x907b, 8)},	/* Sierra Wireless EM74xx */
++	{QMI_QUIRK_SET_DTR(0x1199, 0x907b, 10)},/* Sierra Wireless EM74xx */
++	{QMI_QUIRK_SET_DTR(0x1199, 0x9091, 8)},	/* Sierra Wireless EM7565 */
+ 	{QMI_FIXED_INTF(0x1bbb, 0x011e, 4)},	/* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
+ 	{QMI_FIXED_INTF(0x1bbb, 0x0203, 2)},	/* Alcatel L800MA */
+ 	{QMI_FIXED_INTF(0x2357, 0x0201, 4)},	/* TP-LINK HSUPA Modem MA180 */
+diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
+index d80343429de5..1a40fc3517a8 100644
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -907,7 +907,11 @@ static RING_IDX xennet_fill_frags(struct netfront_queue *queue,
+ 			BUG_ON(pull_to <= skb_headlen(skb));
+ 			__pskb_pull_tail(skb, pull_to - skb_headlen(skb));
+ 		}
+-		BUG_ON(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS);
++		if (unlikely(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS)) {
++			queue->rx.rsp_cons = ++cons;
++			kfree_skb(nskb);
++			return ~0U;
++		}
+ 
+ 		skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
+ 				skb_frag_page(nfrag),
+@@ -1044,6 +1048,8 @@ err:
+ 		skb->len += rx->status;
+ 
+ 		i = xennet_fill_frags(queue, skb, &tmpq);
++		if (unlikely(i == ~0U))
++			goto err;
+ 
+ 		if (rx->flags & XEN_NETRXF_csum_blank)
+ 			skb->ip_summed = CHECKSUM_PARTIAL;
+diff --git a/drivers/pci/host/pci-aardvark.c b/drivers/pci/host/pci-aardvark.c
+index 9bfc22b5da4b..5f3048e75bec 100644
+--- a/drivers/pci/host/pci-aardvark.c
++++ b/drivers/pci/host/pci-aardvark.c
+@@ -954,6 +954,7 @@ static int advk_pcie_probe(struct platform_device *pdev)
+ 
+ 	bus = bridge->bus;
+ 
++	pci_bus_size_bridges(bus);
+ 	pci_bus_assign_resources(bus);
+ 
+ 	list_for_each_entry(child, &bus->children, node)
+diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
+index ec2911c4ee42..35c9b2f4b293 100644
+--- a/drivers/pci/quirks.c
++++ b/drivers/pci/quirks.c
+@@ -4388,11 +4388,6 @@ static int pci_quirk_qcom_rp_acs(struct pci_dev *dev, u16 acs_flags)
+  *
+  * 0x9d10-0x9d1b PCI Express Root port #{1-12}
+  *
+- * The 300 series chipset suffers from the same bug so include those root
+- * ports here as well.
+- *
+- * 0xa32c-0xa343 PCI Express Root port #{0-24}
+- *
+  * [1] http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-datasheet-vol-2.html
+  * [2] http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-datasheet-vol-1.html
+  * [3] http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-spec-update.html
+@@ -4410,7 +4405,6 @@ static bool pci_quirk_intel_spt_pch_acs_match(struct pci_dev *dev)
+ 	case 0xa110 ... 0xa11f: case 0xa167 ... 0xa16a: /* Sunrise Point */
+ 	case 0xa290 ... 0xa29f: case 0xa2e7 ... 0xa2ee: /* Union Point */
+ 	case 0x9d10 ... 0x9d1b: /* 7th & 8th Gen Mobile */
+-	case 0xa32c ... 0xa343:				/* 300 series */
+ 		return true;
+ 	}
+ 
+diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c
+index 4eb8e1a472b2..e335b18da20f 100644
+--- a/drivers/platform/x86/alienware-wmi.c
++++ b/drivers/platform/x86/alienware-wmi.c
+@@ -519,6 +519,7 @@ static acpi_status alienware_wmax_command(struct wmax_basic_args *in_args,
+ 		if (obj && obj->type == ACPI_TYPE_INTEGER)
+ 			*out_data = (u32) obj->integer.value;
+ 	}
++	kfree(output.pointer);
+ 	return status;
+ 
+ }
+diff --git a/drivers/rpmsg/rpmsg_core.c b/drivers/rpmsg/rpmsg_core.c
+index cec4c3223044..dffa3aab7178 100644
+--- a/drivers/rpmsg/rpmsg_core.c
++++ b/drivers/rpmsg/rpmsg_core.c
+@@ -23,7 +23,6 @@
+ #include <linux/module.h>
+ #include <linux/rpmsg.h>
+ #include <linux/of_device.h>
+-#include <linux/pm_domain.h>
+ #include <linux/slab.h>
+ 
+ #include "rpmsg_internal.h"
+@@ -419,10 +418,6 @@ static int rpmsg_dev_probe(struct device *dev)
+ 	struct rpmsg_endpoint *ept = NULL;
+ 	int err;
+ 
+-	err = dev_pm_domain_attach(dev, true);
+-	if (err)
+-		goto out;
+-
+ 	if (rpdrv->callback) {
+ 		strncpy(chinfo.name, rpdev->id.name, RPMSG_NAME_SIZE);
+ 		chinfo.src = rpdev->src;
+@@ -464,8 +459,6 @@ static int rpmsg_dev_remove(struct device *dev)
+ 
+ 	rpdrv->remove(rpdev);
+ 
+-	dev_pm_domain_detach(dev, true);
+-
+ 	if (rpdev->ept)
+ 		rpmsg_destroy_ept(rpdev->ept);
+ 
+diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
+index f85d30dc9187..670dbb7a8500 100644
+--- a/drivers/spi/spi.c
++++ b/drivers/spi/spi.c
+@@ -2108,8 +2108,17 @@ int spi_register_controller(struct spi_controller *ctlr)
+ 	 */
+ 	if (ctlr->num_chipselect == 0)
+ 		return -EINVAL;
+-	/* allocate dynamic bus number using Linux idr */
+-	if ((ctlr->bus_num < 0) && ctlr->dev.of_node) {
++	if (ctlr->bus_num >= 0) {
++		/* devices with a fixed bus num must check-in with the num */
++		mutex_lock(&board_lock);
++		id = idr_alloc(&spi_master_idr, ctlr, ctlr->bus_num,
++			ctlr->bus_num + 1, GFP_KERNEL);
++		mutex_unlock(&board_lock);
++		if (WARN(id < 0, "couldn't get idr"))
++			return id == -ENOSPC ? -EBUSY : id;
++		ctlr->bus_num = id;
++	} else if (ctlr->dev.of_node) {
++		/* allocate dynamic bus number using Linux idr */
+ 		id = of_alias_get_id(ctlr->dev.of_node, "spi");
+ 		if (id >= 0) {
+ 			ctlr->bus_num = id;
+diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
+index 9518ffd8b8ba..4e680d753941 100644
+--- a/drivers/target/iscsi/iscsi_target_auth.c
++++ b/drivers/target/iscsi/iscsi_target_auth.c
+@@ -26,27 +26,6 @@
+ #include "iscsi_target_nego.h"
+ #include "iscsi_target_auth.h"
+ 
+-static int chap_string_to_hex(unsigned char *dst, unsigned char *src, int len)
+-{
+-	int j = DIV_ROUND_UP(len, 2), rc;
+-
+-	rc = hex2bin(dst, src, j);
+-	if (rc < 0)
+-		pr_debug("CHAP string contains non hex digit symbols\n");
+-
+-	dst[j] = '\0';
+-	return j;
+-}
+-
+-static void chap_binaryhex_to_asciihex(char *dst, char *src, int src_len)
+-{
+-	int i;
+-
+-	for (i = 0; i < src_len; i++) {
+-		sprintf(&dst[i*2], "%02x", (int) src[i] & 0xff);
+-	}
+-}
+-
+ static int chap_gen_challenge(
+ 	struct iscsi_conn *conn,
+ 	int caller,
+@@ -62,7 +41,7 @@ static int chap_gen_challenge(
+ 	ret = get_random_bytes_wait(chap->challenge, CHAP_CHALLENGE_LENGTH);
+ 	if (unlikely(ret))
+ 		return ret;
+-	chap_binaryhex_to_asciihex(challenge_asciihex, chap->challenge,
++	bin2hex(challenge_asciihex, chap->challenge,
+ 				CHAP_CHALLENGE_LENGTH);
+ 	/*
+ 	 * Set CHAP_C, and copy the generated challenge into c_str.
+@@ -248,9 +227,16 @@ static int chap_server_compute_md5(
+ 		pr_err("Could not find CHAP_R.\n");
+ 		goto out;
+ 	}
++	if (strlen(chap_r) != MD5_SIGNATURE_SIZE * 2) {
++		pr_err("Malformed CHAP_R\n");
++		goto out;
++	}
++	if (hex2bin(client_digest, chap_r, MD5_SIGNATURE_SIZE) < 0) {
++		pr_err("Malformed CHAP_R\n");
++		goto out;
++	}
+ 
+ 	pr_debug("[server] Got CHAP_R=%s\n", chap_r);
+-	chap_string_to_hex(client_digest, chap_r, strlen(chap_r));
+ 
+ 	tfm = crypto_alloc_shash("md5", 0, 0);
+ 	if (IS_ERR(tfm)) {
+@@ -294,7 +280,7 @@ static int chap_server_compute_md5(
+ 		goto out;
+ 	}
+ 
+-	chap_binaryhex_to_asciihex(response, server_digest, MD5_SIGNATURE_SIZE);
++	bin2hex(response, server_digest, MD5_SIGNATURE_SIZE);
+ 	pr_debug("[server] MD5 Server Digest: %s\n", response);
+ 
+ 	if (memcmp(server_digest, client_digest, MD5_SIGNATURE_SIZE) != 0) {
+@@ -349,9 +335,7 @@ static int chap_server_compute_md5(
+ 		pr_err("Could not find CHAP_C.\n");
+ 		goto out;
+ 	}
+-	pr_debug("[server] Got CHAP_C=%s\n", challenge);
+-	challenge_len = chap_string_to_hex(challenge_binhex, challenge,
+-				strlen(challenge));
++	challenge_len = DIV_ROUND_UP(strlen(challenge), 2);
+ 	if (!challenge_len) {
+ 		pr_err("Unable to convert incoming challenge\n");
+ 		goto out;
+@@ -360,6 +344,11 @@ static int chap_server_compute_md5(
+ 		pr_err("CHAP_C exceeds maximum binary size of 1024 bytes\n");
+ 		goto out;
+ 	}
++	if (hex2bin(challenge_binhex, challenge, challenge_len) < 0) {
++		pr_err("Malformed CHAP_C\n");
++		goto out;
++	}
++	pr_debug("[server] Got CHAP_C=%s\n", challenge);
+ 	/*
+ 	 * During mutual authentication, the CHAP_C generated by the
+ 	 * initiator must not match the original CHAP_C generated by
+@@ -413,7 +402,7 @@ static int chap_server_compute_md5(
+ 	/*
+ 	 * Convert response from binary hex to ascii hext.
+ 	 */
+-	chap_binaryhex_to_asciihex(response, digest, MD5_SIGNATURE_SIZE);
++	bin2hex(response, digest, MD5_SIGNATURE_SIZE);
+ 	*nr_out_len += sprintf(nr_out_ptr + *nr_out_len, "CHAP_R=0x%s",
+ 			response);
+ 	*nr_out_len += 1;
+diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c
+index 2d2b420598b2..7b34b0ddbf0e 100644
+--- a/drivers/tty/vt/vt_ioctl.c
++++ b/drivers/tty/vt/vt_ioctl.c
+@@ -32,6 +32,8 @@
+ #include <asm/io.h>
+ #include <linux/uaccess.h>
+ 
++#include <linux/nospec.h>
++
+ #include <linux/kbd_kern.h>
+ #include <linux/vt_kern.h>
+ #include <linux/kbd_diacr.h>
+@@ -700,6 +702,8 @@ int vt_ioctl(struct tty_struct *tty,
+ 		if (vsa.console == 0 || vsa.console > MAX_NR_CONSOLES)
+ 			ret = -ENXIO;
+ 		else {
++			vsa.console = array_index_nospec(vsa.console,
++							 MAX_NR_CONSOLES + 1);
+ 			vsa.console--;
+ 			console_lock();
+ 			ret = vc_allocate(vsa.console);
+diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c
+index d5babc9f222b..dc676714454a 100644
+--- a/fs/ext4/dir.c
++++ b/fs/ext4/dir.c
+@@ -75,7 +75,7 @@ int __ext4_check_dir_entry(const char *function, unsigned int line,
+ 	else if (unlikely(rlen < EXT4_DIR_REC_LEN(de->name_len)))
+ 		error_msg = "rec_len is too small for name_len";
+ 	else if (unlikely(((char *) de - buf) + rlen > size))
+-		error_msg = "directory entry across range";
++		error_msg = "directory entry overrun";
+ 	else if (unlikely(le32_to_cpu(de->inode) >
+ 			le32_to_cpu(EXT4_SB(dir->i_sb)->s_es->s_inodes_count)))
+ 		error_msg = "inode out of bounds";
+@@ -84,18 +84,16 @@ int __ext4_check_dir_entry(const char *function, unsigned int line,
+ 
+ 	if (filp)
+ 		ext4_error_file(filp, function, line, bh->b_blocknr,
+-				"bad entry in directory: %s - offset=%u(%u), "
+-				"inode=%u, rec_len=%d, name_len=%d",
+-				error_msg, (unsigned) (offset % size),
+-				offset, le32_to_cpu(de->inode),
+-				rlen, de->name_len);
++				"bad entry in directory: %s - offset=%u, "
++				"inode=%u, rec_len=%d, name_len=%d, size=%d",
++				error_msg, offset, le32_to_cpu(de->inode),
++				rlen, de->name_len, size);
+ 	else
+ 		ext4_error_inode(dir, function, line, bh->b_blocknr,
+-				"bad entry in directory: %s - offset=%u(%u), "
+-				"inode=%u, rec_len=%d, name_len=%d",
+-				error_msg, (unsigned) (offset % size),
+-				offset, le32_to_cpu(de->inode),
+-				rlen, de->name_len);
++				"bad entry in directory: %s - offset=%u, "
++				"inode=%u, rec_len=%d, name_len=%d, size=%d",
++				 error_msg, offset, le32_to_cpu(de->inode),
++				 rlen, de->name_len, size);
+ 
+ 	return 1;
+ }
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index 0abb30d19fa1..c96778c39885 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -714,6 +714,9 @@ struct fsxattr {
+ /* Max physical block we can address w/o extents */
+ #define EXT4_MAX_BLOCK_FILE_PHYS	0xFFFFFFFF
+ 
++/* Max logical block we can support */
++#define EXT4_MAX_LOGICAL_BLOCK		0xFFFFFFFF
++
+ /*
+  * Structure of an inode on the disk
+  */
+diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
+index b549cfd2d7d3..4e1d62ba0703 100644
+--- a/fs/ext4/inline.c
++++ b/fs/ext4/inline.c
+@@ -1759,6 +1759,7 @@ bool empty_inline_dir(struct inode *dir, int *has_inline_data)
+ {
+ 	int err, inline_size;
+ 	struct ext4_iloc iloc;
++	size_t inline_len;
+ 	void *inline_pos;
+ 	unsigned int offset;
+ 	struct ext4_dir_entry_2 *de;
+@@ -1786,8 +1787,9 @@ bool empty_inline_dir(struct inode *dir, int *has_inline_data)
+ 		goto out;
+ 	}
+ 
++	inline_len = ext4_get_inline_size(dir);
+ 	offset = EXT4_INLINE_DOTDOT_SIZE;
+-	while (offset < dir->i_size) {
++	while (offset < inline_len) {
+ 		de = ext4_get_inline_entry(dir, &iloc, offset,
+ 					   &inline_pos, &inline_size);
+ 		if (ext4_check_dir_entry(dir, NULL, de,
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index f9baa59de0e2..9808df52ceca 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -3407,11 +3407,16 @@ static int ext4_iomap_begin(struct inode *inode, loff_t offset, loff_t length,
+ {
+ 	struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
+ 	unsigned int blkbits = inode->i_blkbits;
+-	unsigned long first_block = offset >> blkbits;
+-	unsigned long last_block = (offset + length - 1) >> blkbits;
++	unsigned long first_block, last_block;
+ 	struct ext4_map_blocks map;
+ 	int ret;
+ 
++	if ((offset >> blkbits) > EXT4_MAX_LOGICAL_BLOCK)
++		return -EINVAL;
++	first_block = offset >> blkbits;
++	last_block = min_t(loff_t, (offset + length - 1) >> blkbits,
++			   EXT4_MAX_LOGICAL_BLOCK);
++
+ 	if (WARN_ON_ONCE(ext4_has_inline_data(inode)))
+ 		return -ERANGE;
+ 
+diff --git a/fs/ext4/mmp.c b/fs/ext4/mmp.c
+index 638ad4743477..38e6a846aac1 100644
+--- a/fs/ext4/mmp.c
++++ b/fs/ext4/mmp.c
+@@ -49,7 +49,6 @@ static int write_mmp_block(struct super_block *sb, struct buffer_head *bh)
+ 	 */
+ 	sb_start_write(sb);
+ 	ext4_mmp_csum_set(sb, mmp);
+-	mark_buffer_dirty(bh);
+ 	lock_buffer(bh);
+ 	bh->b_end_io = end_buffer_write_sync;
+ 	get_bh(bh);
+diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
+index 1db39e12e02b..eb0d8ee39827 100644
+--- a/fs/ext4/namei.c
++++ b/fs/ext4/namei.c
+@@ -3514,6 +3514,12 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
+ 	int credits;
+ 	u8 old_file_type;
+ 
++	if (new.inode && new.inode->i_nlink == 0) {
++		EXT4_ERROR_INODE(new.inode,
++				 "target of rename is already freed");
++		return -EFSCORRUPTED;
++	}
++
+ 	if ((ext4_test_inode_flag(new_dir, EXT4_INODE_PROJINHERIT)) &&
+ 	    (!projid_eq(EXT4_I(new_dir)->i_projid,
+ 			EXT4_I(old_dentry->d_inode)->i_projid)))
+diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
+index 823c0b82dfeb..e344e606c054 100644
+--- a/fs/ext4/resize.c
++++ b/fs/ext4/resize.c
+@@ -19,6 +19,7 @@
+ 
+ int ext4_resize_begin(struct super_block *sb)
+ {
++	struct ext4_sb_info *sbi = EXT4_SB(sb);
+ 	int ret = 0;
+ 
+ 	if (!capable(CAP_SYS_RESOURCE))
+@@ -29,7 +30,7 @@ int ext4_resize_begin(struct super_block *sb)
+          * because the user tools have no way of handling this.  Probably a
+          * bad time to do it anyways.
+          */
+-	if (EXT4_SB(sb)->s_sbh->b_blocknr !=
++	if (EXT4_B2C(sbi, sbi->s_sbh->b_blocknr) !=
+ 	    le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block)) {
+ 		ext4_warning(sb, "won't resize using backup superblock at %llu",
+ 			(unsigned long long)EXT4_SB(sb)->s_sbh->b_blocknr);
+@@ -1956,6 +1957,26 @@ retry:
+ 		}
+ 	}
+ 
++	/*
++	 * Make sure the last group has enough space so that it's
++	 * guaranteed to have enough space for all metadata blocks
++	 * that it might need to hold.  (We might not need to store
++	 * the inode table blocks in the last block group, but there
++	 * will be cases where this might be needed.)
++	 */
++	if ((ext4_group_first_block_no(sb, n_group) +
++	     ext4_group_overhead_blocks(sb, n_group) + 2 +
++	     sbi->s_itb_per_group + sbi->s_cluster_ratio) >= n_blocks_count) {
++		n_blocks_count = ext4_group_first_block_no(sb, n_group);
++		n_group--;
++		n_blocks_count_retry = 0;
++		if (resize_inode) {
++			iput(resize_inode);
++			resize_inode = NULL;
++		}
++		goto retry;
++	}
++
+ 	/* extend the last group */
+ 	if (n_group == o_group)
+ 		add = n_blocks_count - o_blocks_count;
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index b4fb085261fd..9dbd27f7b778 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -2085,6 +2085,8 @@ static int _ext4_show_options(struct seq_file *seq, struct super_block *sb,
+ 		SEQ_OPTS_PRINT("max_dir_size_kb=%u", sbi->s_max_dir_size_kb);
+ 	if (test_opt(sb, DATA_ERR_ABORT))
+ 		SEQ_OPTS_PUTS("data_err=abort");
++	if (DUMMY_ENCRYPTION_ENABLED(sbi))
++		SEQ_OPTS_PUTS("test_dummy_encryption");
+ 
+ 	ext4_show_quota_options(seq, sb);
+ 	return 0;
+@@ -4311,11 +4313,13 @@ no_journal:
+ 	block = ext4_count_free_clusters(sb);
+ 	ext4_free_blocks_count_set(sbi->s_es, 
+ 				   EXT4_C2B(sbi, block));
++	ext4_superblock_csum_set(sb);
+ 	err = percpu_counter_init(&sbi->s_freeclusters_counter, block,
+ 				  GFP_KERNEL);
+ 	if (!err) {
+ 		unsigned long freei = ext4_count_free_inodes(sb);
+ 		sbi->s_es->s_free_inodes_count = cpu_to_le32(freei);
++		ext4_superblock_csum_set(sb);
+ 		err = percpu_counter_init(&sbi->s_freeinodes_counter, freei,
+ 					  GFP_KERNEL);
+ 	}
+diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c
+index d9ebe11c8990..1d098c3c00e0 100644
+--- a/fs/ocfs2/buffer_head_io.c
++++ b/fs/ocfs2/buffer_head_io.c
+@@ -342,6 +342,7 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr,
+ 				 * for this bh as it's not marked locally
+ 				 * uptodate. */
+ 				status = -EIO;
++				clear_buffer_needs_validate(bh);
+ 				put_bh(bh);
+ 				bhs[i] = NULL;
+ 				continue;
+diff --git a/fs/ubifs/xattr.c b/fs/ubifs/xattr.c
+index d47f16c0d582..c13eae819cbc 100644
+--- a/fs/ubifs/xattr.c
++++ b/fs/ubifs/xattr.c
+@@ -152,12 +152,6 @@ static int create_xattr(struct ubifs_info *c, struct inode *host,
+ 	ui->data_len = size;
+ 
+ 	mutex_lock(&host_ui->ui_mutex);
+-
+-	if (!host->i_nlink) {
+-		err = -ENOENT;
+-		goto out_noent;
+-	}
+-
+ 	host->i_ctime = current_time(host);
+ 	host_ui->xattr_cnt += 1;
+ 	host_ui->xattr_size += CALC_DENT_SIZE(fname_len(nm));
+@@ -189,7 +183,6 @@ out_cancel:
+ 	host_ui->xattr_size -= CALC_XATTR_BYTES(size);
+ 	host_ui->xattr_names -= fname_len(nm);
+ 	host_ui->flags &= ~UBIFS_CRYPT_FL;
+-out_noent:
+ 	mutex_unlock(&host_ui->ui_mutex);
+ out_free:
+ 	make_bad_inode(inode);
+@@ -241,12 +234,6 @@ static int change_xattr(struct ubifs_info *c, struct inode *host,
+ 	mutex_unlock(&ui->ui_mutex);
+ 
+ 	mutex_lock(&host_ui->ui_mutex);
+-
+-	if (!host->i_nlink) {
+-		err = -ENOENT;
+-		goto out_noent;
+-	}
+-
+ 	host->i_ctime = current_time(host);
+ 	host_ui->xattr_size -= CALC_XATTR_BYTES(old_size);
+ 	host_ui->xattr_size += CALC_XATTR_BYTES(size);
+@@ -268,7 +255,6 @@ static int change_xattr(struct ubifs_info *c, struct inode *host,
+ out_cancel:
+ 	host_ui->xattr_size -= CALC_XATTR_BYTES(size);
+ 	host_ui->xattr_size += CALC_XATTR_BYTES(old_size);
+-out_noent:
+ 	mutex_unlock(&host_ui->ui_mutex);
+ 	make_bad_inode(inode);
+ out_free:
+@@ -497,12 +483,6 @@ static int remove_xattr(struct ubifs_info *c, struct inode *host,
+ 		return err;
+ 
+ 	mutex_lock(&host_ui->ui_mutex);
+-
+-	if (!host->i_nlink) {
+-		err = -ENOENT;
+-		goto out_noent;
+-	}
+-
+ 	host->i_ctime = current_time(host);
+ 	host_ui->xattr_cnt -= 1;
+ 	host_ui->xattr_size -= CALC_DENT_SIZE(fname_len(nm));
+@@ -522,7 +502,6 @@ out_cancel:
+ 	host_ui->xattr_size += CALC_DENT_SIZE(fname_len(nm));
+ 	host_ui->xattr_size += CALC_XATTR_BYTES(ui->data_len);
+ 	host_ui->xattr_names += fname_len(nm);
+-out_noent:
+ 	mutex_unlock(&host_ui->ui_mutex);
+ 	ubifs_release_budget(c, &req);
+ 	make_bad_inode(inode);
+@@ -562,9 +541,6 @@ static int ubifs_xattr_remove(struct inode *host, const char *name)
+ 
+ 	ubifs_assert(inode_is_locked(host));
+ 
+-	if (!host->i_nlink)
+-		return -ENOENT;
+-
+ 	if (fname_len(&nm) > UBIFS_MAX_NLEN)
+ 		return -ENAMETOOLONG;
+ 
+diff --git a/include/net/nfc/hci.h b/include/net/nfc/hci.h
+index 316694dafa5b..008f466d1da7 100644
+--- a/include/net/nfc/hci.h
++++ b/include/net/nfc/hci.h
+@@ -87,7 +87,7 @@ struct nfc_hci_pipe {
+  * According to specification 102 622 chapter 4.4 Pipes,
+  * the pipe identifier is 7 bits long.
+  */
+-#define NFC_HCI_MAX_PIPES		127
++#define NFC_HCI_MAX_PIPES		128
+ struct nfc_hci_init_data {
+ 	u8 gate_count;
+ 	struct nfc_hci_gate gates[NFC_HCI_MAX_CUSTOM_GATES];
+diff --git a/include/net/tls.h b/include/net/tls.h
+index 48940a883d9a..86ed3dd80fe7 100644
+--- a/include/net/tls.h
++++ b/include/net/tls.h
+@@ -79,11 +79,13 @@ enum {
+ 	TLS_PENDING_CLOSED_RECORD
+ };
+ 
++union tls_crypto_context {
++	struct tls_crypto_info info;
++	struct tls12_crypto_info_aes_gcm_128 aes_gcm_128;
++};
++
+ struct tls_context {
+-	union {
+-		struct tls_crypto_info crypto_send;
+-		struct tls12_crypto_info_aes_gcm_128 crypto_send_aes_gcm_128;
+-	};
++	union tls_crypto_context crypto_send;
+ 
+ 	void *priv_ctx;
+ 
+@@ -208,8 +210,8 @@ static inline void tls_fill_prepend(struct tls_context *ctx,
+ 	 * size KTLS_DTLS_HEADER_SIZE + KTLS_DTLS_NONCE_EXPLICIT_SIZE
+ 	 */
+ 	buf[0] = record_type;
+-	buf[1] = TLS_VERSION_MINOR(ctx->crypto_send.version);
+-	buf[2] = TLS_VERSION_MAJOR(ctx->crypto_send.version);
++	buf[1] = TLS_VERSION_MINOR(ctx->crypto_send.info.version);
++	buf[2] = TLS_VERSION_MAJOR(ctx->crypto_send.info.version);
+ 	/* we can use IV for nonce explicit according to spec */
+ 	buf[3] = pkt_len >> 8;
+ 	buf[4] = pkt_len & 0xFF;
+diff --git a/include/uapi/linux/keyctl.h b/include/uapi/linux/keyctl.h
+index 910cc4334b21..7b8c9e19bad1 100644
+--- a/include/uapi/linux/keyctl.h
++++ b/include/uapi/linux/keyctl.h
+@@ -65,7 +65,7 @@
+ 
+ /* keyctl structures */
+ struct keyctl_dh_params {
+-	__s32 dh_private;
++	__s32 private;
+ 	__s32 prime;
+ 	__s32 base;
+ };
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index a5e20ceb0b5a..b2d699f28304 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -9137,7 +9137,8 @@ static inline bool vruntime_normalized(struct task_struct *p)
+ 	 * - A task which has been woken up by try_to_wake_up() and
+ 	 *   waiting for actually being woken up by sched_ttwu_pending().
+ 	 */
+-	if (!se->sum_exec_runtime || p->state == TASK_WAKING)
++	if (!se->sum_exec_runtime ||
++	    (p->state == TASK_WAKING && p->sched_remote_wakeup))
+ 		return true;
+ 
+ 	return false;
+diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
+index ea3c062e7e1c..a8fa0a896b78 100644
+--- a/kernel/time/tick-sched.c
++++ b/kernel/time/tick-sched.c
+@@ -908,7 +908,7 @@ static bool can_stop_idle_tick(int cpu, struct tick_sched *ts)
+ 	if (unlikely(local_softirq_pending() && cpu_online(cpu))) {
+ 		static int ratelimit;
+ 
+-		if (ratelimit < 10 &&
++		if (ratelimit < 10 && !in_softirq() &&
+ 		    (local_softirq_pending() & SOFTIRQ_STOP_IDLE_MASK)) {
+ 			pr_warn("NOHZ: local_softirq_pending %02x\n",
+ 				(unsigned int) local_softirq_pending());
+diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
+index fd7809004297..a1d5e0949dcf 100644
+--- a/kernel/trace/ring_buffer.c
++++ b/kernel/trace/ring_buffer.c
+@@ -1479,6 +1479,8 @@ rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned long nr_pages)
+ 	tmp_iter_page = first_page;
+ 
+ 	do {
++		cond_resched();
++
+ 		to_remove_page = tmp_iter_page;
+ 		rb_inc_page(cpu_buffer, &tmp_iter_page);
+ 
+diff --git a/mm/shmem.c b/mm/shmem.c
+index f383298b7280..ea786a504e1b 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -2207,6 +2207,8 @@ static struct inode *shmem_get_inode(struct super_block *sb, const struct inode
+ 			mpol_shared_policy_init(&info->policy, NULL);
+ 			break;
+ 		}
++
++		lockdep_annotate_inode_mutex_key(inode);
+ 	} else
+ 		shmem_free_inode(sb);
+ 	return inode;
+diff --git a/net/core/neighbour.c b/net/core/neighbour.c
+index 514d697d4691..dcb89cbc2730 100644
+--- a/net/core/neighbour.c
++++ b/net/core/neighbour.c
+@@ -1174,6 +1174,12 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
+ 		lladdr = neigh->ha;
+ 	}
+ 
++	/* Update confirmed timestamp for neighbour entry after we
++	 * received ARP packet even if it doesn't change IP to MAC binding.
++	 */
++	if (new & NUD_CONNECTED)
++		neigh->confirmed = jiffies;
++
+ 	/* If entry was valid and address is not changed,
+ 	   do not change entry state, if new one is STALE.
+ 	 */
+@@ -1195,15 +1201,12 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
+ 		}
+ 	}
+ 
+-	/* Update timestamps only once we know we will make a change to the
++	/* Update timestamp only once we know we will make a change to the
+ 	 * neighbour entry. Otherwise we risk to move the locktime window with
+ 	 * noop updates and ignore relevant ARP updates.
+ 	 */
+-	if (new != old || lladdr != neigh->ha) {
+-		if (new & NUD_CONNECTED)
+-			neigh->confirmed = jiffies;
++	if (new != old || lladdr != neigh->ha)
+ 		neigh->updated = jiffies;
+-	}
+ 
+ 	if (new != old) {
+ 		neigh_del_timer(neigh);
+diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
+index b9d9a2b8792c..f31c09873d0f 100644
+--- a/net/ipv4/af_inet.c
++++ b/net/ipv4/af_inet.c
+@@ -1307,6 +1307,7 @@ struct sk_buff *inet_gso_segment(struct sk_buff *skb,
+ 		if (encap)
+ 			skb_reset_inner_headers(skb);
+ 		skb->network_header = (u8 *)iph - skb->head;
++		skb_reset_mac_len(skb);
+ 	} while ((skb = skb->next));
+ 
+ out:
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 5752bf7593dc..3de413867991 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -2049,6 +2049,28 @@ static inline int udp4_csum_init(struct sk_buff *skb, struct udphdr *uh,
+ 							 inet_compute_pseudo);
+ }
+ 
++/* wrapper for udp_queue_rcv_skb tacking care of csum conversion and
++ * return code conversion for ip layer consumption
++ */
++static int udp_unicast_rcv_skb(struct sock *sk, struct sk_buff *skb,
++			       struct udphdr *uh)
++{
++	int ret;
++
++	if (inet_get_convert_csum(sk) && uh->check && !IS_UDPLITE(sk))
++		skb_checksum_try_convert(skb, IPPROTO_UDP, uh->check,
++					 inet_compute_pseudo);
++
++	ret = udp_queue_rcv_skb(sk, skb);
++
++	/* a return value > 0 means to resubmit the input, but
++	 * it wants the return to be -protocol, or 0
++	 */
++	if (ret > 0)
++		return -ret;
++	return 0;
++}
++
+ /*
+  *	All we need to do is get the socket, and then do a checksum.
+  */
+@@ -2095,14 +2117,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+ 		if (unlikely(sk->sk_rx_dst != dst))
+ 			udp_sk_rx_dst_set(sk, dst);
+ 
+-		ret = udp_queue_rcv_skb(sk, skb);
++		ret = udp_unicast_rcv_skb(sk, skb, uh);
+ 		sock_put(sk);
+-		/* a return value > 0 means to resubmit the input, but
+-		 * it wants the return to be -protocol, or 0
+-		 */
+-		if (ret > 0)
+-			return -ret;
+-		return 0;
++		return ret;
+ 	}
+ 
+ 	if (rt->rt_flags & (RTCF_BROADCAST|RTCF_MULTICAST))
+@@ -2110,22 +2127,8 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+ 						saddr, daddr, udptable, proto);
+ 
+ 	sk = __udp4_lib_lookup_skb(skb, uh->source, uh->dest, udptable);
+-	if (sk) {
+-		int ret;
+-
+-		if (inet_get_convert_csum(sk) && uh->check && !IS_UDPLITE(sk))
+-			skb_checksum_try_convert(skb, IPPROTO_UDP, uh->check,
+-						 inet_compute_pseudo);
+-
+-		ret = udp_queue_rcv_skb(sk, skb);
+-
+-		/* a return value > 0 means to resubmit the input, but
+-		 * it wants the return to be -protocol, or 0
+-		 */
+-		if (ret > 0)
+-			return -ret;
+-		return 0;
+-	}
++	if (sk)
++		return udp_unicast_rcv_skb(sk, skb, uh);
+ 
+ 	if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
+ 		goto drop;
+diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
+index 4a87f9428ca5..e3698b6d8231 100644
+--- a/net/ipv6/ip6_offload.c
++++ b/net/ipv6/ip6_offload.c
+@@ -113,6 +113,7 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
+ 			payload_len = skb->len - nhoff - sizeof(*ipv6h);
+ 		ipv6h->payload_len = htons(payload_len);
+ 		skb->network_header = (u8 *)ipv6h - skb->head;
++		skb_reset_mac_len(skb);
+ 
+ 		if (udpfrag) {
+ 			int err = ip6_find_1stfragopt(skb, &prevhdr);
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 1da021527fcd..9ab1e0fcbc13 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -219,12 +219,10 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
+ 				kfree_skb(skb);
+ 				return -ENOBUFS;
+ 			}
++			if (skb->sk)
++				skb_set_owner_w(skb2, skb->sk);
+ 			consume_skb(skb);
+ 			skb = skb2;
+-			/* skb_set_owner_w() changes sk->sk_wmem_alloc atomically,
+-			 * it is safe to call in our context (socket lock not held)
+-			 */
+-			skb_set_owner_w(skb, (struct sock *)sk);
+ 		}
+ 		if (opt->opt_flen)
+ 			ipv6_push_frag_opts(skb, opt, &proto);
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index 330d5ea8451b..5cee941ab0a9 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -780,6 +780,28 @@ static void udp6_sk_rx_dst_set(struct sock *sk, struct dst_entry *dst)
+ 	}
+ }
+ 
++/* wrapper for udp_queue_rcv_skb tacking care of csum conversion and
++ * return code conversion for ip layer consumption
++ */
++static int udp6_unicast_rcv_skb(struct sock *sk, struct sk_buff *skb,
++				struct udphdr *uh)
++{
++	int ret;
++
++	if (inet_get_convert_csum(sk) && uh->check && !IS_UDPLITE(sk))
++		skb_checksum_try_convert(skb, IPPROTO_UDP, uh->check,
++					 ip6_compute_pseudo);
++
++	ret = udpv6_queue_rcv_skb(sk, skb);
++
++	/* a return value > 0 means to resubmit the input, but
++	 * it wants the return to be -protocol, or 0
++	 */
++	if (ret > 0)
++		return -ret;
++	return 0;
++}
++
+ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+ 		   int proto)
+ {
+@@ -831,13 +853,14 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+ 		if (unlikely(sk->sk_rx_dst != dst))
+ 			udp6_sk_rx_dst_set(sk, dst);
+ 
+-		ret = udpv6_queue_rcv_skb(sk, skb);
+-		sock_put(sk);
++		if (!uh->check && !udp_sk(sk)->no_check6_rx) {
++			sock_put(sk);
++			goto report_csum_error;
++		}
+ 
+-		/* a return value > 0 means to resubmit the input */
+-		if (ret > 0)
+-			return ret;
+-		return 0;
++		ret = udp6_unicast_rcv_skb(sk, skb, uh);
++		sock_put(sk);
++		return ret;
+ 	}
+ 
+ 	/*
+@@ -850,30 +873,13 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+ 	/* Unicast */
+ 	sk = __udp6_lib_lookup_skb(skb, uh->source, uh->dest, udptable);
+ 	if (sk) {
+-		int ret;
+-
+-		if (!uh->check && !udp_sk(sk)->no_check6_rx) {
+-			udp6_csum_zero_error(skb);
+-			goto csum_error;
+-		}
+-
+-		if (inet_get_convert_csum(sk) && uh->check && !IS_UDPLITE(sk))
+-			skb_checksum_try_convert(skb, IPPROTO_UDP, uh->check,
+-						 ip6_compute_pseudo);
+-
+-		ret = udpv6_queue_rcv_skb(sk, skb);
+-
+-		/* a return value > 0 means to resubmit the input */
+-		if (ret > 0)
+-			return ret;
+-
+-		return 0;
++		if (!uh->check && !udp_sk(sk)->no_check6_rx)
++			goto report_csum_error;
++		return udp6_unicast_rcv_skb(sk, skb, uh);
+ 	}
+ 
+-	if (!uh->check) {
+-		udp6_csum_zero_error(skb);
+-		goto csum_error;
+-	}
++	if (!uh->check)
++		goto report_csum_error;
+ 
+ 	if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
+ 		goto discard;
+@@ -894,6 +900,9 @@ short_packet:
+ 			    ulen, skb->len,
+ 			    daddr, ntohs(uh->dest));
+ 	goto discard;
++
++report_csum_error:
++	udp6_csum_zero_error(skb);
+ csum_error:
+ 	__UDP6_INC_STATS(net, UDP_MIB_CSUMERRORS, proto == IPPROTO_UDPLITE);
+ discard:
+diff --git a/net/nfc/hci/core.c b/net/nfc/hci/core.c
+index b740fef0acc5..6bf14f4f4b42 100644
+--- a/net/nfc/hci/core.c
++++ b/net/nfc/hci/core.c
+@@ -209,6 +209,11 @@ void nfc_hci_cmd_received(struct nfc_hci_dev *hdev, u8 pipe, u8 cmd,
+ 		}
+ 		create_info = (struct hci_create_pipe_resp *)skb->data;
+ 
++		if (create_info->pipe >= NFC_HCI_MAX_PIPES) {
++			status = NFC_HCI_ANY_E_NOK;
++			goto exit;
++		}
++
+ 		/* Save the new created pipe and bind with local gate,
+ 		 * the description for skb->data[3] is destination gate id
+ 		 * but since we received this cmd from host controller, we
+@@ -232,6 +237,11 @@ void nfc_hci_cmd_received(struct nfc_hci_dev *hdev, u8 pipe, u8 cmd,
+ 		}
+ 		delete_info = (struct hci_delete_pipe_noti *)skb->data;
+ 
++		if (delete_info->pipe >= NFC_HCI_MAX_PIPES) {
++			status = NFC_HCI_ANY_E_NOK;
++			goto exit;
++		}
++
+ 		hdev->pipes[delete_info->pipe].gate = NFC_HCI_INVALID_GATE;
+ 		hdev->pipes[delete_info->pipe].dest_host = NFC_HCI_INVALID_HOST;
+ 		break;
+diff --git a/net/sched/act_sample.c b/net/sched/act_sample.c
+index 53752b9327d0..a859b55d7899 100644
+--- a/net/sched/act_sample.c
++++ b/net/sched/act_sample.c
+@@ -64,7 +64,7 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla,
+ 
+ 	if (!exists) {
+ 		ret = tcf_idr_create(tn, parm->index, est, a,
+-				     &act_sample_ops, bind, false);
++				     &act_sample_ops, bind, true);
+ 		if (ret)
+ 			return ret;
+ 		ret = ACT_P_CREATED;
+diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
+index 055b9992d8c7..efa2cdba99d3 100644
+--- a/net/tls/tls_main.c
++++ b/net/tls/tls_main.c
+@@ -218,6 +218,15 @@ static void tls_write_space(struct sock *sk)
+ 	ctx->sk_write_space(sk);
+ }
+ 
++static void tls_ctx_free(struct tls_context *ctx)
++{
++	if (!ctx)
++		return;
++
++	memzero_explicit(&ctx->crypto_send, sizeof(ctx->crypto_send));
++	kfree(ctx);
++}
++
+ static void tls_sk_proto_close(struct sock *sk, long timeout)
+ {
+ 	struct tls_context *ctx = tls_get_ctx(sk);
+@@ -246,7 +255,7 @@ static void tls_sk_proto_close(struct sock *sk, long timeout)
+ 	kfree(ctx->iv);
+ 
+ 	sk_proto_close = ctx->sk_proto_close;
+-	kfree(ctx);
++	tls_ctx_free(ctx);
+ 
+ 	release_sock(sk);
+ 	sk_proto_close(sk, timeout);
+@@ -274,7 +283,7 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
+ 	}
+ 
+ 	/* get user crypto info */
+-	crypto_info = &ctx->crypto_send;
++	crypto_info = &ctx->crypto_send.info;
+ 
+ 	if (!TLS_CRYPTO_INFO_READY(crypto_info)) {
+ 		rc = -EBUSY;
+@@ -371,7 +380,7 @@ static int do_tls_setsockopt_tx(struct sock *sk, char __user *optval,
+ 	}
+ 
+ 	/* get user crypto info */
+-	crypto_info = &ctx->crypto_send;
++	crypto_info = &ctx->crypto_send.info;
+ 
+ 	/* Currently we don't support set crypto info more than one time */
+ 	if (TLS_CRYPTO_INFO_READY(crypto_info)) {
+@@ -416,7 +425,7 @@ static int do_tls_setsockopt_tx(struct sock *sk, char __user *optval,
+ 	goto out;
+ 
+ err_crypto_info:
+-	memset(crypto_info, 0, sizeof(*crypto_info));
++	memzero_explicit(crypto_info, sizeof(union tls_crypto_context));
+ out:
+ 	return rc;
+ }
+diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
+index b81aa6d7dc45..6ae9ca567d6c 100644
+--- a/net/tls/tls_sw.c
++++ b/net/tls/tls_sw.c
+@@ -661,7 +661,6 @@ static void tls_sw_free_resources(struct sock *sk)
+ 
+ int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx)
+ {
+-	char keyval[TLS_CIPHER_AES_GCM_128_KEY_SIZE];
+ 	struct tls_crypto_info *crypto_info;
+ 	struct tls12_crypto_info_aes_gcm_128 *gcm_128_info;
+ 	struct tls_sw_context *sw_ctx;
+@@ -688,7 +687,7 @@ int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx)
+ 	ctx->priv_ctx = (struct tls_offload_context *)sw_ctx;
+ 	ctx->free_resources = tls_sw_free_resources;
+ 
+-	crypto_info = &ctx->crypto_send;
++	crypto_info = &ctx->crypto_send.info;
+ 	switch (crypto_info->cipher_type) {
+ 	case TLS_CIPHER_AES_GCM_128: {
+ 		nonce_size = TLS_CIPHER_AES_GCM_128_IV_SIZE;
+@@ -753,9 +752,7 @@ int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx)
+ 
+ 	ctx->push_pending_record = tls_sw_push_pending_record;
+ 
+-	memcpy(keyval, gcm_128_info->key, TLS_CIPHER_AES_GCM_128_KEY_SIZE);
+-
+-	rc = crypto_aead_setkey(sw_ctx->aead_send, keyval,
++	rc = crypto_aead_setkey(sw_ctx->aead_send, gcm_128_info->key,
+ 				TLS_CIPHER_AES_GCM_128_KEY_SIZE);
+ 	if (rc)
+ 		goto free_aead;
+diff --git a/security/keys/dh.c b/security/keys/dh.c
+index 35543f04e759..d1ea9f325f94 100644
+--- a/security/keys/dh.c
++++ b/security/keys/dh.c
+@@ -307,7 +307,7 @@ long __keyctl_dh_compute(struct keyctl_dh_params __user *params,
+ 	}
+ 	dh_inputs.g_size = dlen;
+ 
+-	dlen = dh_data_from_key(pcopy.dh_private, &dh_inputs.key);
++	dlen = dh_data_from_key(pcopy.private, &dh_inputs.key);
+ 	if (dlen < 0) {
+ 		ret = dlen;
+ 		goto out2;
+diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c
+index 730ea91d9be8..93676354f87f 100644
+--- a/sound/firewire/bebob/bebob.c
++++ b/sound/firewire/bebob/bebob.c
+@@ -263,6 +263,8 @@ do_registration(struct work_struct *work)
+ error:
+ 	mutex_unlock(&devices_mutex);
+ 	snd_bebob_stream_destroy_duplex(bebob);
++	kfree(bebob->maudio_special_quirk);
++	bebob->maudio_special_quirk = NULL;
+ 	snd_card_free(bebob->card);
+ 	dev_info(&bebob->unit->device,
+ 		 "Sound card registration failed: %d\n", err);
+diff --git a/sound/firewire/bebob/bebob_maudio.c b/sound/firewire/bebob/bebob_maudio.c
+index bd55620c6a47..c266997ad299 100644
+--- a/sound/firewire/bebob/bebob_maudio.c
++++ b/sound/firewire/bebob/bebob_maudio.c
+@@ -96,17 +96,13 @@ int snd_bebob_maudio_load_firmware(struct fw_unit *unit)
+ 	struct fw_device *device = fw_parent_device(unit);
+ 	int err, rcode;
+ 	u64 date;
+-	__le32 cues[3] = {
+-		cpu_to_le32(MAUDIO_BOOTLOADER_CUE1),
+-		cpu_to_le32(MAUDIO_BOOTLOADER_CUE2),
+-		cpu_to_le32(MAUDIO_BOOTLOADER_CUE3)
+-	};
++	__le32 *cues;
+ 
+ 	/* check date of software used to build */
+ 	err = snd_bebob_read_block(unit, INFO_OFFSET_SW_DATE,
+ 				   &date, sizeof(u64));
+ 	if (err < 0)
+-		goto end;
++		return err;
+ 	/*
+ 	 * firmware version 5058 or later has date later than "20070401", but
+ 	 * 'date' is not null-terminated.
+@@ -114,20 +110,28 @@ int snd_bebob_maudio_load_firmware(struct fw_unit *unit)
+ 	if (date < 0x3230303730343031LL) {
+ 		dev_err(&unit->device,
+ 			"Use firmware version 5058 or later\n");
+-		err = -ENOSYS;
+-		goto end;
++		return -ENXIO;
+ 	}
+ 
++	cues = kmalloc_array(3, sizeof(*cues), GFP_KERNEL);
++	if (!cues)
++		return -ENOMEM;
++
++	cues[0] = cpu_to_le32(MAUDIO_BOOTLOADER_CUE1);
++	cues[1] = cpu_to_le32(MAUDIO_BOOTLOADER_CUE2);
++	cues[2] = cpu_to_le32(MAUDIO_BOOTLOADER_CUE3);
++
+ 	rcode = fw_run_transaction(device->card, TCODE_WRITE_BLOCK_REQUEST,
+ 				   device->node_id, device->generation,
+ 				   device->max_speed, BEBOB_ADDR_REG_REQ,
+-				   cues, sizeof(cues));
++				   cues, 3 * sizeof(*cues));
++	kfree(cues);
+ 	if (rcode != RCODE_COMPLETE) {
+ 		dev_err(&unit->device,
+ 			"Failed to send a cue to load firmware\n");
+ 		err = -EIO;
+ 	}
+-end:
++
+ 	return err;
+ }
+ 
+@@ -290,10 +294,6 @@ snd_bebob_maudio_special_discover(struct snd_bebob *bebob, bool is1814)
+ 		bebob->midi_output_ports = 2;
+ 	}
+ end:
+-	if (err < 0) {
+-		kfree(params);
+-		bebob->maudio_special_quirk = NULL;
+-	}
+ 	mutex_unlock(&bebob->mutex);
+ 	return err;
+ }
+diff --git a/sound/firewire/digi00x/digi00x.c b/sound/firewire/digi00x/digi00x.c
+index 1f5e1d23f31a..ef689997d6a5 100644
+--- a/sound/firewire/digi00x/digi00x.c
++++ b/sound/firewire/digi00x/digi00x.c
+@@ -49,6 +49,7 @@ static void dg00x_free(struct snd_dg00x *dg00x)
+ 	fw_unit_put(dg00x->unit);
+ 
+ 	mutex_destroy(&dg00x->mutex);
++	kfree(dg00x);
+ }
+ 
+ static void dg00x_card_free(struct snd_card *card)
+diff --git a/sound/firewire/fireface/ff-protocol-ff400.c b/sound/firewire/fireface/ff-protocol-ff400.c
+index 12aa15df435d..9f5036442ab9 100644
+--- a/sound/firewire/fireface/ff-protocol-ff400.c
++++ b/sound/firewire/fireface/ff-protocol-ff400.c
+@@ -146,6 +146,7 @@ static int ff400_switch_fetching_mode(struct snd_ff *ff, bool enable)
+ {
+ 	__le32 *reg;
+ 	int i;
++	int err;
+ 
+ 	reg = kzalloc(sizeof(__le32) * 18, GFP_KERNEL);
+ 	if (reg == NULL)
+@@ -163,9 +164,11 @@ static int ff400_switch_fetching_mode(struct snd_ff *ff, bool enable)
+ 			reg[i] = cpu_to_le32(0x00000001);
+ 	}
+ 
+-	return snd_fw_transaction(ff->unit, TCODE_WRITE_BLOCK_REQUEST,
+-				  FF400_FETCH_PCM_FRAMES, reg,
+-				  sizeof(__le32) * 18, 0);
++	err = snd_fw_transaction(ff->unit, TCODE_WRITE_BLOCK_REQUEST,
++				 FF400_FETCH_PCM_FRAMES, reg,
++				 sizeof(__le32) * 18, 0);
++	kfree(reg);
++	return err;
+ }
+ 
+ static void ff400_dump_sync_status(struct snd_ff *ff,
+diff --git a/sound/firewire/fireworks/fireworks.c b/sound/firewire/fireworks/fireworks.c
+index 71a0613d3da0..f2d073365cf6 100644
+--- a/sound/firewire/fireworks/fireworks.c
++++ b/sound/firewire/fireworks/fireworks.c
+@@ -301,6 +301,8 @@ error:
+ 	snd_efw_transaction_remove_instance(efw);
+ 	snd_efw_stream_destroy_duplex(efw);
+ 	snd_card_free(efw->card);
++	kfree(efw->resp_buf);
++	efw->resp_buf = NULL;
+ 	dev_info(&efw->unit->device,
+ 		 "Sound card registration failed: %d\n", err);
+ }
+diff --git a/sound/firewire/oxfw/oxfw.c b/sound/firewire/oxfw/oxfw.c
+index 413ab6313bb6..a315d5b6b86b 100644
+--- a/sound/firewire/oxfw/oxfw.c
++++ b/sound/firewire/oxfw/oxfw.c
+@@ -136,6 +136,7 @@ static void oxfw_free(struct snd_oxfw *oxfw)
+ 
+ 	kfree(oxfw->spec);
+ 	mutex_destroy(&oxfw->mutex);
++	kfree(oxfw);
+ }
+ 
+ /*
+@@ -213,6 +214,7 @@ static int detect_quirks(struct snd_oxfw *oxfw)
+ static void do_registration(struct work_struct *work)
+ {
+ 	struct snd_oxfw *oxfw = container_of(work, struct snd_oxfw, dwork.work);
++	int i;
+ 	int err;
+ 
+ 	if (oxfw->registered)
+@@ -275,7 +277,15 @@ error:
+ 	snd_oxfw_stream_destroy_simplex(oxfw, &oxfw->rx_stream);
+ 	if (oxfw->has_output)
+ 		snd_oxfw_stream_destroy_simplex(oxfw, &oxfw->tx_stream);
++	for (i = 0; i < SND_OXFW_STREAM_FORMAT_ENTRIES; ++i) {
++		kfree(oxfw->tx_stream_formats[i]);
++		oxfw->tx_stream_formats[i] = NULL;
++		kfree(oxfw->rx_stream_formats[i]);
++		oxfw->rx_stream_formats[i] = NULL;
++	}
+ 	snd_card_free(oxfw->card);
++	kfree(oxfw->spec);
++	oxfw->spec = NULL;
+ 	dev_info(&oxfw->unit->device,
+ 		 "Sound card registration failed: %d\n", err);
+ }
+diff --git a/sound/firewire/tascam/tascam.c b/sound/firewire/tascam/tascam.c
+index 44ad41fb7374..d3fdc463a884 100644
+--- a/sound/firewire/tascam/tascam.c
++++ b/sound/firewire/tascam/tascam.c
+@@ -93,6 +93,7 @@ static void tscm_free(struct snd_tscm *tscm)
+ 	fw_unit_put(tscm->unit);
+ 
+ 	mutex_destroy(&tscm->mutex);
++	kfree(tscm);
+ }
+ 
+ static void tscm_card_free(struct snd_card *card)
+diff --git a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c
+index a2b56b188be4..d68bb40d3676 100644
+--- a/sound/pci/emu10k1/emufx.c
++++ b/sound/pci/emu10k1/emufx.c
+@@ -2547,7 +2547,7 @@ static int snd_emu10k1_fx8010_ioctl(struct snd_hwdep * hw, struct file *file, un
+ 		emu->support_tlv = 1;
+ 		return put_user(SNDRV_EMU10K1_VERSION, (int __user *)argp);
+ 	case SNDRV_EMU10K1_IOCTL_INFO:
+-		info = kmalloc(sizeof(*info), GFP_KERNEL);
++		info = kzalloc(sizeof(*info), GFP_KERNEL);
+ 		if (!info)
+ 			return -ENOMEM;
+ 		snd_emu10k1_fx8010_info(emu, info);
+diff --git a/sound/soc/codecs/cs4265.c b/sound/soc/codecs/cs4265.c
+index fd966bb851cb..6e8eb1f5a041 100644
+--- a/sound/soc/codecs/cs4265.c
++++ b/sound/soc/codecs/cs4265.c
+@@ -157,8 +157,8 @@ static const struct snd_kcontrol_new cs4265_snd_controls[] = {
+ 	SOC_SINGLE("Validity Bit Control Switch", CS4265_SPDIF_CTL2,
+ 				3, 1, 0),
+ 	SOC_ENUM("SPDIF Mono/Stereo", spdif_mono_stereo_enum),
+-	SOC_SINGLE("MMTLR Data Switch", 0,
+-				1, 1, 0),
++	SOC_SINGLE("MMTLR Data Switch", CS4265_SPDIF_CTL2,
++				0, 1, 0),
+ 	SOC_ENUM("Mono Channel Select", spdif_mono_select_enum),
+ 	SND_SOC_BYTES("C Data Buffer", CS4265_C_DATA_BUFF, 24),
+ };
+diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
+index 107133297e8d..9896e736fa5c 100644
+--- a/sound/soc/sh/rcar/core.c
++++ b/sound/soc/sh/rcar/core.c
+@@ -925,12 +925,23 @@ static void rsnd_soc_dai_shutdown(struct snd_pcm_substream *substream,
+ 	rsnd_dai_call(nolock_stop, io, priv);
+ }
+ 
++static int rsnd_soc_dai_prepare(struct snd_pcm_substream *substream,
++				struct snd_soc_dai *dai)
++{
++	struct rsnd_priv *priv = rsnd_dai_to_priv(dai);
++	struct rsnd_dai *rdai = rsnd_dai_to_rdai(dai);
++	struct rsnd_dai_stream *io = rsnd_rdai_to_io(rdai, substream);
++
++	return rsnd_dai_call(prepare, io, priv);
++}
++
+ static const struct snd_soc_dai_ops rsnd_soc_dai_ops = {
+ 	.startup	= rsnd_soc_dai_startup,
+ 	.shutdown	= rsnd_soc_dai_shutdown,
+ 	.trigger	= rsnd_soc_dai_trigger,
+ 	.set_fmt	= rsnd_soc_dai_set_fmt,
+ 	.set_tdm_slot	= rsnd_soc_set_dai_tdm_slot,
++	.prepare	= rsnd_soc_dai_prepare,
+ };
+ 
+ void rsnd_parse_connect_common(struct rsnd_dai *rdai,
+diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h
+index c5de71f2dc8c..1768a0ae469d 100644
+--- a/sound/soc/sh/rcar/rsnd.h
++++ b/sound/soc/sh/rcar/rsnd.h
+@@ -283,6 +283,9 @@ struct rsnd_mod_ops {
+ 	int (*nolock_stop)(struct rsnd_mod *mod,
+ 		    struct rsnd_dai_stream *io,
+ 		    struct rsnd_priv *priv);
++	int (*prepare)(struct rsnd_mod *mod,
++		       struct rsnd_dai_stream *io,
++		       struct rsnd_priv *priv);
+ };
+ 
+ struct rsnd_dai_stream;
+@@ -312,6 +315,7 @@ struct rsnd_mod {
+  * H	0: fallback
+  * H	0: hw_params
+  * H	0: pointer
++ * H	0: prepare
+  */
+ #define __rsnd_mod_shift_nolock_start	0
+ #define __rsnd_mod_shift_nolock_stop	0
+@@ -326,6 +330,7 @@ struct rsnd_mod {
+ #define __rsnd_mod_shift_fallback	28 /* always called */
+ #define __rsnd_mod_shift_hw_params	28 /* always called */
+ #define __rsnd_mod_shift_pointer	28 /* always called */
++#define __rsnd_mod_shift_prepare	28 /* always called */
+ 
+ #define __rsnd_mod_add_probe		0
+ #define __rsnd_mod_add_remove		0
+@@ -340,6 +345,7 @@ struct rsnd_mod {
+ #define __rsnd_mod_add_fallback		0
+ #define __rsnd_mod_add_hw_params	0
+ #define __rsnd_mod_add_pointer		0
++#define __rsnd_mod_add_prepare		0
+ 
+ #define __rsnd_mod_call_probe		0
+ #define __rsnd_mod_call_remove		0
+@@ -354,6 +360,7 @@ struct rsnd_mod {
+ #define __rsnd_mod_call_pointer		0
+ #define __rsnd_mod_call_nolock_start	0
+ #define __rsnd_mod_call_nolock_stop	1
++#define __rsnd_mod_call_prepare		0
+ 
+ #define rsnd_mod_to_priv(mod) ((mod)->priv)
+ #define rsnd_mod_id(mod) ((mod) ? (mod)->id : -1)
+diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c
+index f0fb85fda42d..34223c8c28a8 100644
+--- a/sound/soc/sh/rcar/ssi.c
++++ b/sound/soc/sh/rcar/ssi.c
+@@ -280,7 +280,7 @@ static int rsnd_ssi_master_clk_start(struct rsnd_mod *mod,
+ 	if (rsnd_ssi_is_multi_slave(mod, io))
+ 		return 0;
+ 
+-	if (ssi->usrcnt > 1) {
++	if (ssi->rate) {
+ 		if (ssi->rate != rate) {
+ 			dev_err(dev, "SSI parent/child should use same rate\n");
+ 			return -EINVAL;
+@@ -482,7 +482,6 @@ static int rsnd_ssi_init(struct rsnd_mod *mod,
+ 			 struct rsnd_priv *priv)
+ {
+ 	struct rsnd_ssi *ssi = rsnd_mod_to_ssi(mod);
+-	int ret;
+ 
+ 	if (!rsnd_ssi_is_run_mods(mod, io))
+ 		return 0;
+@@ -493,10 +492,6 @@ static int rsnd_ssi_init(struct rsnd_mod *mod,
+ 
+ 	rsnd_mod_power_on(mod);
+ 
+-	ret = rsnd_ssi_master_clk_start(mod, io);
+-	if (ret < 0)
+-		return ret;
+-
+ 	rsnd_ssi_config_init(mod, io);
+ 
+ 	rsnd_ssi_register_setup(mod);
+@@ -847,6 +842,13 @@ static int rsnd_ssi_pointer(struct rsnd_mod *mod,
+ 	return 0;
+ }
+ 
++static int rsnd_ssi_prepare(struct rsnd_mod *mod,
++			    struct rsnd_dai_stream *io,
++			    struct rsnd_priv *priv)
++{
++	return rsnd_ssi_master_clk_start(mod, io);
++}
++
+ static struct rsnd_mod_ops rsnd_ssi_pio_ops = {
+ 	.name	= SSI_NAME,
+ 	.probe	= rsnd_ssi_common_probe,
+@@ -859,6 +861,7 @@ static struct rsnd_mod_ops rsnd_ssi_pio_ops = {
+ 	.pointer= rsnd_ssi_pointer,
+ 	.pcm_new = rsnd_ssi_pcm_new,
+ 	.hw_params = rsnd_ssi_hw_params,
++	.prepare = rsnd_ssi_prepare,
+ };
+ 
+ static int rsnd_ssi_dma_probe(struct rsnd_mod *mod,
+@@ -935,6 +938,7 @@ static struct rsnd_mod_ops rsnd_ssi_dma_ops = {
+ 	.pcm_new = rsnd_ssi_pcm_new,
+ 	.fallback = rsnd_ssi_fallback,
+ 	.hw_params = rsnd_ssi_hw_params,
++	.prepare = rsnd_ssi_prepare,
+ };
+ 
+ int rsnd_ssi_is_dma_mode(struct rsnd_mod *mod)