[gentoo-commits] proj/linux-patches:4.9 commit in: /

[Mike Pagano]

commit:     b1f78f15534b066a609efad147f4ff8c48575aea
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Dec  8 13:25:01 2018 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Dec  8 13:25:01 2018 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=b1f78f15

proj/linux-patches: Linux patch 4.9.144

Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>

 0000_README              |    4 +
 1143_linux-4.9.144.patch | 5729 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 5733 insertions(+)

diff --git a/0000_README b/0000_README
index d4392f7..094617d 100644
--- a/0000_README
+++ b/0000_README
@@ -615,6 +615,10 @@ Patch:  1142_linux-4.9.143.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.9.143
 
+Patch:  1143_linux-4.9.144.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.9.144
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1143_linux-4.9.144.patch b/1143_linux-4.9.144.patch
new file mode 100644
index 0000000..9c35290
--- /dev/null
+++ b/1143_linux-4.9.144.patch
@@ -0,0 +1,5729 @@
+diff --git a/Makefile b/Makefile
+index 8ec52cd19526..c62b2b529724 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 9
+-SUBLEVEL = 143
++SUBLEVEL = 144
+ EXTRAVERSION =
+ NAME = Roaring Lionus
+ 
+@@ -802,6 +802,9 @@ KBUILD_CFLAGS += $(call cc-option,-Wdeclaration-after-statement,)
+ # disable pointer signed / unsigned warnings in gcc 4.0
+ KBUILD_CFLAGS += $(call cc-disable-warning, pointer-sign)
+ 
++# disable stringop warnings in gcc 8+
++KBUILD_CFLAGS += $(call cc-disable-warning, stringop-truncation)
++
+ # disable invalid "can't wrap" optimizations for signed / pointers
+ KBUILD_CFLAGS	+= $(call cc-option,-fno-strict-overflow)
+ 
+diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig
+index b7b78cb09a37..c7a081c583b9 100644
+--- a/arch/arc/Kconfig
++++ b/arch/arc/Kconfig
+@@ -105,7 +105,7 @@ endmenu
+ 
+ choice
+ 	prompt "ARC Instruction Set"
+-	default ISA_ARCOMPACT
++	default ISA_ARCV2
+ 
+ config ISA_ARCOMPACT
+ 	bool "ARCompact ISA"
+diff --git a/arch/arc/Makefile b/arch/arc/Makefile
+index a3b456008201..fd79faab7892 100644
+--- a/arch/arc/Makefile
++++ b/arch/arc/Makefile
+@@ -8,7 +8,7 @@
+ 
+ UTS_MACHINE := arc
+ 
+-KBUILD_DEFCONFIG := nsim_700_defconfig
++KBUILD_DEFCONFIG := nsim_hs_defconfig
+ 
+ cflags-y	+= -fno-common -pipe -fno-builtin -mmedium-calls -D__linux__
+ cflags-$(CONFIG_ISA_ARCOMPACT)	+= -mA7
+diff --git a/arch/arc/configs/axs101_defconfig b/arch/arc/configs/axs101_defconfig
+index dd623199bb48..cdb00af5aeac 100644
+--- a/arch/arc/configs/axs101_defconfig
++++ b/arch/arc/configs/axs101_defconfig
+@@ -15,6 +15,7 @@ CONFIG_PERF_EVENTS=y
+ # CONFIG_VM_EVENT_COUNTERS is not set
+ # CONFIG_SLUB_DEBUG is not set
+ # CONFIG_COMPAT_BRK is not set
++CONFIG_ISA_ARCOMPACT=y
+ CONFIG_MODULES=y
+ CONFIG_MODULE_FORCE_LOAD=y
+ CONFIG_MODULE_UNLOAD=y
+@@ -96,6 +97,7 @@ CONFIG_VFAT_FS=y
+ CONFIG_NTFS_FS=y
+ CONFIG_TMPFS=y
+ CONFIG_NFS_FS=y
++CONFIG_NFS_V3_ACL=y
+ CONFIG_NLS_CODEPAGE_437=y
+ CONFIG_NLS_ISO8859_1=y
+ # CONFIG_ENABLE_WARN_DEPRECATED is not set
+diff --git a/arch/arc/configs/axs103_defconfig b/arch/arc/configs/axs103_defconfig
+index 2e0d7d74b8ee..02c766d2c1e0 100644
+--- a/arch/arc/configs/axs103_defconfig
++++ b/arch/arc/configs/axs103_defconfig
+@@ -97,6 +97,7 @@ CONFIG_VFAT_FS=y
+ CONFIG_NTFS_FS=y
+ CONFIG_TMPFS=y
+ CONFIG_NFS_FS=y
++CONFIG_NFS_V3_ACL=y
+ CONFIG_NLS_CODEPAGE_437=y
+ CONFIG_NLS_ISO8859_1=y
+ # CONFIG_ENABLE_WARN_DEPRECATED is not set
+diff --git a/arch/arc/configs/axs103_smp_defconfig b/arch/arc/configs/axs103_smp_defconfig
+index ec188fca2cc9..8c16093d639f 100644
+--- a/arch/arc/configs/axs103_smp_defconfig
++++ b/arch/arc/configs/axs103_smp_defconfig
+@@ -98,6 +98,7 @@ CONFIG_VFAT_FS=y
+ CONFIG_NTFS_FS=y
+ CONFIG_TMPFS=y
+ CONFIG_NFS_FS=y
++CONFIG_NFS_V3_ACL=y
+ CONFIG_NLS_CODEPAGE_437=y
+ CONFIG_NLS_ISO8859_1=y
+ # CONFIG_ENABLE_WARN_DEPRECATED is not set
+diff --git a/arch/arc/configs/nps_defconfig b/arch/arc/configs/nps_defconfig
+index ede625c76216..397742c6c84e 100644
+--- a/arch/arc/configs/nps_defconfig
++++ b/arch/arc/configs/nps_defconfig
+@@ -15,6 +15,7 @@ CONFIG_SYSCTL_SYSCALL=y
+ CONFIG_EMBEDDED=y
+ CONFIG_PERF_EVENTS=y
+ # CONFIG_COMPAT_BRK is not set
++CONFIG_ISA_ARCOMPACT=y
+ CONFIG_KPROBES=y
+ CONFIG_MODULES=y
+ CONFIG_MODULE_FORCE_LOAD=y
+@@ -75,6 +76,7 @@ CONFIG_PROC_KCORE=y
+ CONFIG_TMPFS=y
+ # CONFIG_MISC_FILESYSTEMS is not set
+ CONFIG_NFS_FS=y
++CONFIG_NFS_V3_ACL=y
+ CONFIG_ROOT_NFS=y
+ CONFIG_DEBUG_INFO=y
+ # CONFIG_ENABLE_WARN_DEPRECATED is not set
+diff --git a/arch/arc/configs/nsim_700_defconfig b/arch/arc/configs/nsim_700_defconfig
+index df609fce999b..cbc6d068d1f4 100644
+--- a/arch/arc/configs/nsim_700_defconfig
++++ b/arch/arc/configs/nsim_700_defconfig
+@@ -16,6 +16,7 @@ CONFIG_EMBEDDED=y
+ CONFIG_PERF_EVENTS=y
+ # CONFIG_SLUB_DEBUG is not set
+ # CONFIG_COMPAT_BRK is not set
++CONFIG_ISA_ARCOMPACT=y
+ CONFIG_KPROBES=y
+ CONFIG_MODULES=y
+ # CONFIG_LBDAF is not set
+diff --git a/arch/arc/configs/nsimosci_defconfig b/arch/arc/configs/nsimosci_defconfig
+index 5680daa65471..d34b838a71c1 100644
+--- a/arch/arc/configs/nsimosci_defconfig
++++ b/arch/arc/configs/nsimosci_defconfig
+@@ -16,6 +16,7 @@ CONFIG_EMBEDDED=y
+ CONFIG_PERF_EVENTS=y
+ # CONFIG_SLUB_DEBUG is not set
+ # CONFIG_COMPAT_BRK is not set
++CONFIG_ISA_ARCOMPACT=y
+ CONFIG_KPROBES=y
+ CONFIG_MODULES=y
+ # CONFIG_LBDAF is not set
+@@ -70,5 +71,6 @@ CONFIG_EXT2_FS_XATTR=y
+ CONFIG_TMPFS=y
+ # CONFIG_MISC_FILESYSTEMS is not set
+ CONFIG_NFS_FS=y
++CONFIG_NFS_V3_ACL=y
+ # CONFIG_ENABLE_WARN_DEPRECATED is not set
+ # CONFIG_ENABLE_MUST_CHECK is not set
+diff --git a/arch/arc/configs/nsimosci_hs_defconfig b/arch/arc/configs/nsimosci_hs_defconfig
+index 87decc491c58..e8c7dd703f13 100644
+--- a/arch/arc/configs/nsimosci_hs_defconfig
++++ b/arch/arc/configs/nsimosci_hs_defconfig
+@@ -69,5 +69,6 @@ CONFIG_EXT2_FS_XATTR=y
+ CONFIG_TMPFS=y
+ # CONFIG_MISC_FILESYSTEMS is not set
+ CONFIG_NFS_FS=y
++CONFIG_NFS_V3_ACL=y
+ # CONFIG_ENABLE_WARN_DEPRECATED is not set
+ # CONFIG_ENABLE_MUST_CHECK is not set
+diff --git a/arch/arc/configs/nsimosci_hs_smp_defconfig b/arch/arc/configs/nsimosci_hs_smp_defconfig
+index 4d14684dc74a..100d7bf0035b 100644
+--- a/arch/arc/configs/nsimosci_hs_smp_defconfig
++++ b/arch/arc/configs/nsimosci_hs_smp_defconfig
+@@ -80,6 +80,7 @@ CONFIG_EXT2_FS_XATTR=y
+ CONFIG_TMPFS=y
+ # CONFIG_MISC_FILESYSTEMS is not set
+ CONFIG_NFS_FS=y
++CONFIG_NFS_V3_ACL=y
+ # CONFIG_ENABLE_WARN_DEPRECATED is not set
+ # CONFIG_ENABLE_MUST_CHECK is not set
+ CONFIG_FTRACE=y
+diff --git a/arch/arc/configs/tb10x_defconfig b/arch/arc/configs/tb10x_defconfig
+index 4c5118384eb5..493966c0dcbe 100644
+--- a/arch/arc/configs/tb10x_defconfig
++++ b/arch/arc/configs/tb10x_defconfig
+@@ -19,6 +19,7 @@ CONFIG_KALLSYMS_ALL=y
+ # CONFIG_AIO is not set
+ CONFIG_EMBEDDED=y
+ # CONFIG_COMPAT_BRK is not set
++CONFIG_ISA_ARCOMPACT=y
+ CONFIG_SLAB=y
+ CONFIG_MODULES=y
+ CONFIG_MODULE_FORCE_LOAD=y
+diff --git a/arch/arc/configs/vdk_hs38_defconfig b/arch/arc/configs/vdk_hs38_defconfig
+index c0d6a010751a..b1d38afeba70 100644
+--- a/arch/arc/configs/vdk_hs38_defconfig
++++ b/arch/arc/configs/vdk_hs38_defconfig
+@@ -88,6 +88,7 @@ CONFIG_NTFS_FS=y
+ CONFIG_TMPFS=y
+ CONFIG_JFFS2_FS=y
+ CONFIG_NFS_FS=y
++CONFIG_NFS_V3_ACL=y
+ CONFIG_NLS_CODEPAGE_437=y
+ CONFIG_NLS_ISO8859_1=y
+ # CONFIG_ENABLE_WARN_DEPRECATED is not set
+diff --git a/arch/arc/configs/vdk_hs38_smp_defconfig b/arch/arc/configs/vdk_hs38_smp_defconfig
+index 969b206d6c67..2d103f73a265 100644
+--- a/arch/arc/configs/vdk_hs38_smp_defconfig
++++ b/arch/arc/configs/vdk_hs38_smp_defconfig
+@@ -87,6 +87,7 @@ CONFIG_NTFS_FS=y
+ CONFIG_TMPFS=y
+ CONFIG_JFFS2_FS=y
+ CONFIG_NFS_FS=y
++CONFIG_NFS_V3_ACL=y
+ CONFIG_NLS_CODEPAGE_437=y
+ CONFIG_NLS_ISO8859_1=y
+ # CONFIG_ENABLE_WARN_DEPRECATED is not set
+diff --git a/arch/mips/include/asm/syscall.h b/arch/mips/include/asm/syscall.h
+index d87882513ee3..deee3ac8c29f 100644
+--- a/arch/mips/include/asm/syscall.h
++++ b/arch/mips/include/asm/syscall.h
+@@ -51,7 +51,7 @@ static inline unsigned long mips_get_syscall_arg(unsigned long *arg,
+ #ifdef CONFIG_64BIT
+ 	case 4: case 5: case 6: case 7:
+ #ifdef CONFIG_MIPS32_O32
+-		if (test_thread_flag(TIF_32BIT_REGS))
++		if (test_tsk_thread_flag(task, TIF_32BIT_REGS))
+ 			return get_user(*arg, (int *)usp + n);
+ 		else
+ #endif
+diff --git a/arch/mips/ralink/mt7620.c b/arch/mips/ralink/mt7620.c
+index 0696142048d5..9194b04cb689 100644
+--- a/arch/mips/ralink/mt7620.c
++++ b/arch/mips/ralink/mt7620.c
+@@ -81,7 +81,7 @@ static struct rt2880_pmx_func pcie_rst_grp[] = {
+ };
+ static struct rt2880_pmx_func nd_sd_grp[] = {
+ 	FUNC("nand", MT7620_GPIO_MODE_NAND, 45, 15),
+-	FUNC("sd", MT7620_GPIO_MODE_SD, 45, 15)
++	FUNC("sd", MT7620_GPIO_MODE_SD, 47, 13)
+ };
+ 
+ static struct rt2880_pmx_group mt7620a_pinmux_data[] = {
+diff --git a/arch/x86/include/asm/suspend_64.h b/arch/x86/include/asm/suspend_64.h
+index 6136a18152af..2bd96b4df140 100644
+--- a/arch/x86/include/asm/suspend_64.h
++++ b/arch/x86/include/asm/suspend_64.h
+@@ -42,8 +42,7 @@ struct saved_context {
+ 	set_debugreg((thread)->debugreg##register, register)
+ 
+ /* routines for saving/restoring kernel state */
+-extern int acpi_save_state_mem(void);
+-extern char core_restore_code;
+-extern char restore_registers;
++extern char core_restore_code[];
++extern char restore_registers[];
+ 
+ #endif /* _ASM_X86_SUSPEND_64_H */
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index 4bc35ac28d11..fa1b0e3c8a06 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -1333,20 +1333,23 @@ static u64 *avic_get_physical_id_entry(struct kvm_vcpu *vcpu, int index)
+ static int avic_init_access_page(struct kvm_vcpu *vcpu)
+ {
+ 	struct kvm *kvm = vcpu->kvm;
+-	int ret;
++	int ret = 0;
+ 
++	mutex_lock(&kvm->slots_lock);
+ 	if (kvm->arch.apic_access_page_done)
+-		return 0;
++		goto out;
+ 
+-	ret = x86_set_memory_region(kvm,
+-				    APIC_ACCESS_PAGE_PRIVATE_MEMSLOT,
+-				    APIC_DEFAULT_PHYS_BASE,
+-				    PAGE_SIZE);
++	ret = __x86_set_memory_region(kvm,
++				      APIC_ACCESS_PAGE_PRIVATE_MEMSLOT,
++				      APIC_DEFAULT_PHYS_BASE,
++				      PAGE_SIZE);
+ 	if (ret)
+-		return ret;
++		goto out;
+ 
+ 	kvm->arch.apic_access_page_done = true;
+-	return 0;
++out:
++	mutex_unlock(&kvm->slots_lock);
++	return ret;
+ }
+ 
+ static int avic_init_backing_page(struct kvm_vcpu *vcpu)
+diff --git a/arch/x86/power/hibernate_64.c b/arch/x86/power/hibernate_64.c
+index 0cb1dd461529..fef485b789ca 100644
+--- a/arch/x86/power/hibernate_64.c
++++ b/arch/x86/power/hibernate_64.c
+@@ -126,7 +126,7 @@ static int relocate_restore_code(void)
+ 	if (!relocated_restore_code)
+ 		return -ENOMEM;
+ 
+-	memcpy((void *)relocated_restore_code, &core_restore_code, PAGE_SIZE);
++	memcpy((void *)relocated_restore_code, core_restore_code, PAGE_SIZE);
+ 
+ 	/* Make the page containing the relocated code executable */
+ 	pgd = (pgd_t *)__va(read_cr3()) + pgd_index(relocated_restore_code);
+@@ -197,8 +197,8 @@ int arch_hibernation_header_save(void *addr, unsigned int max_size)
+ 
+ 	if (max_size < sizeof(struct restore_data_record))
+ 		return -EOVERFLOW;
+-	rdr->jump_address = (unsigned long)&restore_registers;
+-	rdr->jump_address_phys = __pa_symbol(&restore_registers);
++	rdr->jump_address = (unsigned long)restore_registers;
++	rdr->jump_address_phys = __pa_symbol(restore_registers);
+ 	rdr->cr3 = restore_cr3;
+ 	rdr->magic = RESTORE_MAGIC;
+ 	return 0;
+diff --git a/drivers/android/binder.c b/drivers/android/binder.c
+index 49199bd2ab93..80499f421a29 100644
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -302,6 +302,7 @@ struct binder_proc {
+ 	struct mm_struct *vma_vm_mm;
+ 	struct task_struct *tsk;
+ 	struct files_struct *files;
++	struct mutex files_lock;
+ 	struct hlist_node deferred_work_node;
+ 	int deferred_work;
+ 	void *buffer;
+@@ -375,20 +376,26 @@ binder_defer_work(struct binder_proc *proc, enum binder_deferred_state defer);
+ 
+ static int task_get_unused_fd_flags(struct binder_proc *proc, int flags)
+ {
+-	struct files_struct *files = proc->files;
+ 	unsigned long rlim_cur;
+ 	unsigned long irqs;
++	int ret;
+ 
+-	if (files == NULL)
+-		return -ESRCH;
+-
+-	if (!lock_task_sighand(proc->tsk, &irqs))
+-		return -EMFILE;
+-
++	mutex_lock(&proc->files_lock);
++	if (proc->files == NULL) {
++		ret = -ESRCH;
++		goto err;
++	}
++	if (!lock_task_sighand(proc->tsk, &irqs)) {
++		ret = -EMFILE;
++		goto err;
++	}
+ 	rlim_cur = task_rlimit(proc->tsk, RLIMIT_NOFILE);
+ 	unlock_task_sighand(proc->tsk, &irqs);
+ 
+-	return __alloc_fd(files, 0, rlim_cur, flags);
++	ret = __alloc_fd(proc->files, 0, rlim_cur, flags);
++err:
++	mutex_unlock(&proc->files_lock);
++	return ret;
+ }
+ 
+ /*
+@@ -397,8 +404,10 @@ static int task_get_unused_fd_flags(struct binder_proc *proc, int flags)
+ static void task_fd_install(
+ 	struct binder_proc *proc, unsigned int fd, struct file *file)
+ {
++	mutex_lock(&proc->files_lock);
+ 	if (proc->files)
+ 		__fd_install(proc->files, fd, file);
++	mutex_unlock(&proc->files_lock);
+ }
+ 
+ /*
+@@ -408,9 +417,11 @@ static long task_close_fd(struct binder_proc *proc, unsigned int fd)
+ {
+ 	int retval;
+ 
+-	if (proc->files == NULL)
+-		return -ESRCH;
+-
++	mutex_lock(&proc->files_lock);
++	if (proc->files == NULL) {
++		retval = -ESRCH;
++		goto err;
++	}
+ 	retval = __close_fd(proc->files, fd);
+ 	/* can't restart close syscall because file table entry was cleared */
+ 	if (unlikely(retval == -ERESTARTSYS ||
+@@ -418,7 +429,8 @@ static long task_close_fd(struct binder_proc *proc, unsigned int fd)
+ 		     retval == -ERESTARTNOHAND ||
+ 		     retval == -ERESTART_RESTARTBLOCK))
+ 		retval = -EINTR;
+-
++err:
++	mutex_unlock(&proc->files_lock);
+ 	return retval;
+ }
+ 
+@@ -2946,7 +2958,9 @@ static int binder_mmap(struct file *filp, struct vm_area_struct *vma)
+ 	binder_insert_free_buffer(proc, buffer);
+ 	proc->free_async_space = proc->buffer_size / 2;
+ 	barrier();
++	mutex_lock(&proc->files_lock);
+ 	proc->files = get_files_struct(current);
++	mutex_unlock(&proc->files_lock);
+ 	proc->vma = vma;
+ 	proc->vma_vm_mm = vma->vm_mm;
+ 
+@@ -2982,6 +2996,7 @@ static int binder_open(struct inode *nodp, struct file *filp)
+ 		return -ENOMEM;
+ 	get_task_struct(current->group_leader);
+ 	proc->tsk = current->group_leader;
++	mutex_init(&proc->files_lock);
+ 	INIT_LIST_HEAD(&proc->todo);
+ 	init_waitqueue_head(&proc->wait);
+ 	proc->default_priority = task_nice(current);
+@@ -3220,9 +3235,11 @@ static void binder_deferred_func(struct work_struct *work)
+ 
+ 		files = NULL;
+ 		if (defer & BINDER_DEFERRED_PUT_FILES) {
++			mutex_lock(&proc->files_lock);
+ 			files = proc->files;
+ 			if (files)
+ 				proc->files = NULL;
++			mutex_unlock(&proc->files_lock);
+ 		}
+ 
+ 		if (defer & BINDER_DEFERRED_FLUSH)
+diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c
+index fb9976254224..fabfeeb537ae 100644
+--- a/drivers/gpu/drm/ast/ast_main.c
++++ b/drivers/gpu/drm/ast/ast_main.c
+@@ -556,7 +556,8 @@ int ast_driver_unload(struct drm_device *dev)
+ 	drm_mode_config_cleanup(dev);
+ 
+ 	ast_mm_fini(ast);
+-	pci_iounmap(dev->pdev, ast->ioregs);
++	if (ast->ioregs != ast->regs + AST_IO_MM_OFFSET)
++		pci_iounmap(dev->pdev, ast->ioregs);
+ 	pci_iounmap(dev->pdev, ast->regs);
+ 	kfree(ast);
+ 	return 0;
+diff --git a/drivers/gpu/drm/drm_auth.c b/drivers/gpu/drm/drm_auth.c
+index 6b143514a566..56b2dd9a5b68 100644
+--- a/drivers/gpu/drm/drm_auth.c
++++ b/drivers/gpu/drm/drm_auth.c
+@@ -133,6 +133,7 @@ static int drm_new_set_master(struct drm_device *dev, struct drm_file *fpriv)
+ 
+ 	lockdep_assert_held_once(&dev->master_mutex);
+ 
++	WARN_ON(fpriv->is_master);
+ 	old_master = fpriv->master;
+ 	fpriv->master = drm_master_create(dev);
+ 	if (!fpriv->master) {
+@@ -161,6 +162,7 @@ out_err:
+ 	/* drop references and restore old master on failure */
+ 	drm_master_put(&fpriv->master);
+ 	fpriv->master = old_master;
++	fpriv->is_master = 0;
+ 
+ 	return ret;
+ }
+diff --git a/drivers/gpu/drm/gma500/mdfld_intel_display.c b/drivers/gpu/drm/gma500/mdfld_intel_display.c
+index 92e3f93ee682..06d61e654f59 100644
+--- a/drivers/gpu/drm/gma500/mdfld_intel_display.c
++++ b/drivers/gpu/drm/gma500/mdfld_intel_display.c
+@@ -99,7 +99,7 @@ void mdfldWaitForPipeEnable(struct drm_device *dev, int pipe)
+ 	/* Wait for for the pipe enable to take effect. */
+ 	for (count = 0; count < COUNT_MAX; count++) {
+ 		temp = REG_READ(map->conf);
+-		if ((temp & PIPEACONF_PIPE_STATE) == 1)
++		if (temp & PIPEACONF_PIPE_STATE)
+ 			break;
+ 	}
+ }
+diff --git a/drivers/gpu/drm/mediatek/mtk_hdmi.c b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+index e097780752f6..863d030786e5 100644
+--- a/drivers/gpu/drm/mediatek/mtk_hdmi.c
++++ b/drivers/gpu/drm/mediatek/mtk_hdmi.c
+@@ -1446,8 +1446,7 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi,
+ 	}
+ 
+ 	/* The CEC module handles HDMI hotplug detection */
+-	cec_np = of_find_compatible_node(np->parent, NULL,
+-					 "mediatek,mt8173-cec");
++	cec_np = of_get_compatible_child(np->parent, "mediatek,mt8173-cec");
+ 	if (!cec_np) {
+ 		dev_err(dev, "Failed to find CEC node\n");
+ 		return -EINVAL;
+@@ -1457,8 +1456,10 @@ static int mtk_hdmi_dt_parse_pdata(struct mtk_hdmi *hdmi,
+ 	if (!cec_pdev) {
+ 		dev_err(hdmi->dev, "Waiting for CEC device %s\n",
+ 			cec_np->full_name);
++		of_node_put(cec_np);
+ 		return -EPROBE_DEFER;
+ 	}
++	of_node_put(cec_np);
+ 	hdmi->cec_dev = &cec_pdev->dev;
+ 
+ 	/*
+diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
+index d7da1dca765f..b1daf5c16117 100644
+--- a/drivers/infiniband/hw/mlx5/main.c
++++ b/drivers/infiniband/hw/mlx5/main.c
+@@ -710,31 +710,26 @@ enum mlx5_ib_width {
+ 	MLX5_IB_WIDTH_12X	= 1 << 4
+ };
+ 
+-static int translate_active_width(struct ib_device *ibdev, u8 active_width,
++static void translate_active_width(struct ib_device *ibdev, u8 active_width,
+ 				  u8 *ib_width)
+ {
+ 	struct mlx5_ib_dev *dev = to_mdev(ibdev);
+-	int err = 0;
+ 
+-	if (active_width & MLX5_IB_WIDTH_1X) {
++	if (active_width & MLX5_IB_WIDTH_1X)
+ 		*ib_width = IB_WIDTH_1X;
+-	} else if (active_width & MLX5_IB_WIDTH_2X) {
+-		mlx5_ib_dbg(dev, "active_width %d is not supported by IB spec\n",
+-			    (int)active_width);
+-		err = -EINVAL;
+-	} else if (active_width & MLX5_IB_WIDTH_4X) {
++	else if (active_width & MLX5_IB_WIDTH_4X)
+ 		*ib_width = IB_WIDTH_4X;
+-	} else if (active_width & MLX5_IB_WIDTH_8X) {
++	else if (active_width & MLX5_IB_WIDTH_8X)
+ 		*ib_width = IB_WIDTH_8X;
+-	} else if (active_width & MLX5_IB_WIDTH_12X) {
++	else if (active_width & MLX5_IB_WIDTH_12X)
+ 		*ib_width = IB_WIDTH_12X;
+-	} else {
+-		mlx5_ib_dbg(dev, "Invalid active_width %d\n",
++	else {
++		mlx5_ib_dbg(dev, "Invalid active_width %d, setting width to default value: 4x\n",
+ 			    (int)active_width);
+-		err = -EINVAL;
++		*ib_width = IB_WIDTH_4X;
+ 	}
+ 
+-	return err;
++	return;
+ }
+ 
+ static int mlx5_mtu_to_ib_mtu(int mtu)
+@@ -842,10 +837,8 @@ static int mlx5_query_hca_port(struct ib_device *ibdev, u8 port,
+ 	if (err)
+ 		goto out;
+ 
+-	err = translate_active_width(ibdev, ib_link_width_oper,
+-				     &props->active_width);
+-	if (err)
+-		goto out;
++	translate_active_width(ibdev, ib_link_width_oper, &props->active_width);
++
+ 	err = mlx5_query_port_ib_proto_oper(mdev, &props->active_speed, port);
+ 	if (err)
+ 		goto out;
+diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c
+index bc6f5bb6c524..d46424d4b71e 100644
+--- a/drivers/infiniband/ulp/iser/iser_verbs.c
++++ b/drivers/infiniband/ulp/iser/iser_verbs.c
+@@ -1110,7 +1110,9 @@ u8 iser_check_task_pi_status(struct iscsi_iser_task *iser_task,
+ 					 IB_MR_CHECK_SIG_STATUS, &mr_status);
+ 		if (ret) {
+ 			pr_err("ib_check_mr_status failed, ret %d\n", ret);
+-			goto err;
++			/* Not a lot we can do, return ambiguous guard error */
++			*sector = 0;
++			return 0x1;
+ 		}
+ 
+ 		if (mr_status.fail_status & IB_MR_CHECK_SIG_STATUS) {
+@@ -1138,9 +1140,6 @@ u8 iser_check_task_pi_status(struct iscsi_iser_task *iser_task,
+ 	}
+ 
+ 	return 0;
+-err:
+-	/* Not alot we can do here, return ambiguous guard error */
+-	return 0x1;
+ }
+ 
+ void iser_err_comp(struct ib_wc *wc, const char *type)
+diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c
+index 2e52015634f9..f55dcdf99bc5 100644
+--- a/drivers/input/joystick/xpad.c
++++ b/drivers/input/joystick/xpad.c
+@@ -483,18 +483,18 @@ static const u8 xboxone_hori_init[] = {
+ };
+ 
+ /*
+- * This packet is required for some of the PDP pads to start
++ * This packet is required for most (all?) of the PDP pads to start
+  * sending input reports. These pads include: (0x0e6f:0x02ab),
+- * (0x0e6f:0x02a4).
++ * (0x0e6f:0x02a4), (0x0e6f:0x02a6).
+  */
+ static const u8 xboxone_pdp_init1[] = {
+ 	0x0a, 0x20, 0x00, 0x03, 0x00, 0x01, 0x14
+ };
+ 
+ /*
+- * This packet is required for some of the PDP pads to start
++ * This packet is required for most (all?) of the PDP pads to start
+  * sending input reports. These pads include: (0x0e6f:0x02ab),
+- * (0x0e6f:0x02a4).
++ * (0x0e6f:0x02a4), (0x0e6f:0x02a6).
+  */
+ static const u8 xboxone_pdp_init2[] = {
+ 	0x06, 0x20, 0x00, 0x02, 0x01, 0x00
+@@ -530,12 +530,8 @@ static const struct xboxone_init_packet xboxone_init_packets[] = {
+ 	XBOXONE_INIT_PKT(0x0e6f, 0x0165, xboxone_hori_init),
+ 	XBOXONE_INIT_PKT(0x0f0d, 0x0067, xboxone_hori_init),
+ 	XBOXONE_INIT_PKT(0x0000, 0x0000, xboxone_fw2015_init),
+-	XBOXONE_INIT_PKT(0x0e6f, 0x02ab, xboxone_pdp_init1),
+-	XBOXONE_INIT_PKT(0x0e6f, 0x02ab, xboxone_pdp_init2),
+-	XBOXONE_INIT_PKT(0x0e6f, 0x02a4, xboxone_pdp_init1),
+-	XBOXONE_INIT_PKT(0x0e6f, 0x02a4, xboxone_pdp_init2),
+-	XBOXONE_INIT_PKT(0x0e6f, 0x02a6, xboxone_pdp_init1),
+-	XBOXONE_INIT_PKT(0x0e6f, 0x02a6, xboxone_pdp_init2),
++	XBOXONE_INIT_PKT(0x0e6f, 0x0000, xboxone_pdp_init1),
++	XBOXONE_INIT_PKT(0x0e6f, 0x0000, xboxone_pdp_init2),
+ 	XBOXONE_INIT_PKT(0x24c6, 0x541a, xboxone_rumblebegin_init),
+ 	XBOXONE_INIT_PKT(0x24c6, 0x542a, xboxone_rumblebegin_init),
+ 	XBOXONE_INIT_PKT(0x24c6, 0x543a, xboxone_rumblebegin_init),
+diff --git a/drivers/input/keyboard/matrix_keypad.c b/drivers/input/keyboard/matrix_keypad.c
+index 795fa353de7c..c64d87442a62 100644
+--- a/drivers/input/keyboard/matrix_keypad.c
++++ b/drivers/input/keyboard/matrix_keypad.c
+@@ -405,7 +405,7 @@ matrix_keypad_parse_dt(struct device *dev)
+ 	struct matrix_keypad_platform_data *pdata;
+ 	struct device_node *np = dev->of_node;
+ 	unsigned int *gpios;
+-	int i, nrow, ncol;
++	int ret, i, nrow, ncol;
+ 
+ 	if (!np) {
+ 		dev_err(dev, "device lacks DT data\n");
+@@ -447,12 +447,19 @@ matrix_keypad_parse_dt(struct device *dev)
+ 		return ERR_PTR(-ENOMEM);
+ 	}
+ 
+-	for (i = 0; i < pdata->num_row_gpios; i++)
+-		gpios[i] = of_get_named_gpio(np, "row-gpios", i);
++	for (i = 0; i < nrow; i++) {
++		ret = of_get_named_gpio(np, "row-gpios", i);
++		if (ret < 0)
++			return ERR_PTR(ret);
++		gpios[i] = ret;
++	}
+ 
+-	for (i = 0; i < pdata->num_col_gpios; i++)
+-		gpios[pdata->num_row_gpios + i] =
+-			of_get_named_gpio(np, "col-gpios", i);
++	for (i = 0; i < ncol; i++) {
++		ret = of_get_named_gpio(np, "col-gpios", i);
++		if (ret < 0)
++			return ERR_PTR(ret);
++		gpios[nrow + i] = ret;
++	}
+ 
+ 	pdata->row_gpios = gpios;
+ 	pdata->col_gpios = &gpios[pdata->num_row_gpios];
+@@ -479,10 +486,8 @@ static int matrix_keypad_probe(struct platform_device *pdev)
+ 	pdata = dev_get_platdata(&pdev->dev);
+ 	if (!pdata) {
+ 		pdata = matrix_keypad_parse_dt(&pdev->dev);
+-		if (IS_ERR(pdata)) {
+-			dev_err(&pdev->dev, "no platform data defined\n");
++		if (IS_ERR(pdata))
+ 			return PTR_ERR(pdata);
+-		}
+ 	} else if (!pdata->keymap_data) {
+ 		dev_err(&pdev->dev, "no keymap data defined\n");
+ 		return -EINVAL;
+diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c
+index b3119589a444..471984ec2db0 100644
+--- a/drivers/input/mouse/elan_i2c_core.c
++++ b/drivers/input/mouse/elan_i2c_core.c
+@@ -1253,6 +1253,9 @@ static const struct acpi_device_id elan_acpi_id[] = {
+ 	{ "ELAN0618", 0 },
+ 	{ "ELAN061C", 0 },
+ 	{ "ELAN061D", 0 },
++	{ "ELAN061E", 0 },
++	{ "ELAN0620", 0 },
++	{ "ELAN0621", 0 },
+ 	{ "ELAN0622", 0 },
+ 	{ "ELAN1000", 0 },
+ 	{ }
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_debug.c b/drivers/net/ethernet/qlogic/qed/qed_debug.c
+index 68f19ca57f96..245eb02d0c4e 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_debug.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_debug.c
+@@ -3039,10 +3039,10 @@ static u32 qed_grc_dump_big_ram(struct qed_hwfn *p_hwfn,
+ 		s_big_ram_defs[big_ram_id].num_of_blocks[dev_data->chip_id];
+ 	ram_size = total_blocks * BIG_RAM_BLOCK_SIZE_DWORDS;
+ 
+-	strncpy(type_name, s_big_ram_defs[big_ram_id].instance_name,
+-		strlen(s_big_ram_defs[big_ram_id].instance_name));
+-	strncpy(mem_name, s_big_ram_defs[big_ram_id].instance_name,
+-		strlen(s_big_ram_defs[big_ram_id].instance_name));
++	strscpy(type_name, s_big_ram_defs[big_ram_id].instance_name,
++		sizeof(type_name));
++	strscpy(mem_name, s_big_ram_defs[big_ram_id].instance_name,
++		sizeof(mem_name));
+ 
+ 	/* Dump memory header */
+ 	offset += qed_grc_dump_mem_hdr(p_hwfn,
+diff --git a/drivers/net/wireless/ath/wil6210/wmi.c b/drivers/net/wireless/ath/wil6210/wmi.c
+index 94a356bbb6b9..61419d1b4543 100644
+--- a/drivers/net/wireless/ath/wil6210/wmi.c
++++ b/drivers/net/wireless/ath/wil6210/wmi.c
+@@ -1302,8 +1302,14 @@ int wmi_set_ie(struct wil6210_priv *wil, u8 type, u16 ie_len, const void *ie)
+ 	};
+ 	int rc;
+ 	u16 len = sizeof(struct wmi_set_appie_cmd) + ie_len;
+-	struct wmi_set_appie_cmd *cmd = kzalloc(len, GFP_KERNEL);
++	struct wmi_set_appie_cmd *cmd;
+ 
++	if (len < ie_len) {
++		rc = -EINVAL;
++		goto out;
++	}
++
++	cmd = kzalloc(len, GFP_KERNEL);
+ 	if (!cmd) {
+ 		rc = -ENOMEM;
+ 		goto out;
+diff --git a/drivers/reset/core.c b/drivers/reset/core.c
+index b8ae1dbd4c17..188205a55261 100644
+--- a/drivers/reset/core.c
++++ b/drivers/reset/core.c
+@@ -135,11 +135,16 @@ EXPORT_SYMBOL_GPL(devm_reset_controller_register);
+  * @rstc: reset controller
+  *
+  * Calling this on a shared reset controller is an error.
++ *
++ * If rstc is NULL it is an optional reset and the function will just
++ * return 0.
+  */
+ int reset_control_reset(struct reset_control *rstc)
+ {
+-	if (WARN_ON(IS_ERR_OR_NULL(rstc)) ||
+-	    WARN_ON(rstc->shared))
++	if (!rstc)
++		return 0;
++
++	if (WARN_ON(IS_ERR(rstc)))
+ 		return -EINVAL;
+ 
+ 	if (rstc->rcdev->ops->reset)
+@@ -159,10 +164,16 @@ EXPORT_SYMBOL_GPL(reset_control_reset);
+  *
+  * For shared reset controls a driver cannot expect the hw's registers and
+  * internal state to be reset, but must be prepared for this to happen.
++ *
++ * If rstc is NULL it is an optional reset and the function will just
++ * return 0.
+  */
+ int reset_control_assert(struct reset_control *rstc)
+ {
+-	if (WARN_ON(IS_ERR_OR_NULL(rstc)))
++	if (!rstc)
++		return 0;
++
++	if (WARN_ON(IS_ERR(rstc)))
+ 		return -EINVAL;
+ 
+ 	if (!rstc->rcdev->ops->assert)
+@@ -185,10 +196,16 @@ EXPORT_SYMBOL_GPL(reset_control_assert);
+  * @rstc: reset controller
+  *
+  * After calling this function, the reset is guaranteed to be deasserted.
++ *
++ * If rstc is NULL it is an optional reset and the function will just
++ * return 0.
+  */
+ int reset_control_deassert(struct reset_control *rstc)
+ {
+-	if (WARN_ON(IS_ERR_OR_NULL(rstc)))
++	if (!rstc)
++		return 0;
++
++	if (WARN_ON(IS_ERR(rstc)))
+ 		return -EINVAL;
+ 
+ 	if (!rstc->rcdev->ops->deassert)
+@@ -206,12 +223,15 @@ EXPORT_SYMBOL_GPL(reset_control_deassert);
+ /**
+  * reset_control_status - returns a negative errno if not supported, a
+  * positive value if the reset line is asserted, or zero if the reset
+- * line is not asserted.
++ * line is not asserted or if the desc is NULL (optional reset).
+  * @rstc: reset controller
+  */
+ int reset_control_status(struct reset_control *rstc)
+ {
+-	if (WARN_ON(IS_ERR_OR_NULL(rstc)))
++	if (!rstc)
++		return 0;
++
++	if (WARN_ON(IS_ERR(rstc)))
+ 		return -EINVAL;
+ 
+ 	if (rstc->rcdev->ops->status)
+@@ -221,7 +241,7 @@ int reset_control_status(struct reset_control *rstc)
+ }
+ EXPORT_SYMBOL_GPL(reset_control_status);
+ 
+-static struct reset_control *__reset_control_get(
++static struct reset_control *__reset_control_get_internal(
+ 				struct reset_controller_dev *rcdev,
+ 				unsigned int index, int shared)
+ {
+@@ -254,7 +274,7 @@ static struct reset_control *__reset_control_get(
+ 	return rstc;
+ }
+ 
+-static void __reset_control_put(struct reset_control *rstc)
++static void __reset_control_put_internal(struct reset_control *rstc)
+ {
+ 	lockdep_assert_held(&reset_list_mutex);
+ 
+@@ -268,7 +288,8 @@ static void __reset_control_put(struct reset_control *rstc)
+ }
+ 
+ struct reset_control *__of_reset_control_get(struct device_node *node,
+-				     const char *id, int index, int shared)
++				     const char *id, int index, bool shared,
++				     bool optional)
+ {
+ 	struct reset_control *rstc;
+ 	struct reset_controller_dev *r, *rcdev;
+@@ -282,14 +303,18 @@ struct reset_control *__of_reset_control_get(struct device_node *node,
+ 	if (id) {
+ 		index = of_property_match_string(node,
+ 						 "reset-names", id);
++		if (index == -EILSEQ)
++			return ERR_PTR(index);
+ 		if (index < 0)
+-			return ERR_PTR(-ENOENT);
++			return optional ? NULL : ERR_PTR(-ENOENT);
+ 	}
+ 
+ 	ret = of_parse_phandle_with_args(node, "resets", "#reset-cells",
+ 					 index, &args);
+-	if (ret)
++	if (ret == -EINVAL)
+ 		return ERR_PTR(ret);
++	if (ret)
++		return optional ? NULL : ERR_PTR(ret);
+ 
+ 	mutex_lock(&reset_list_mutex);
+ 	rcdev = NULL;
+@@ -318,7 +343,7 @@ struct reset_control *__of_reset_control_get(struct device_node *node,
+ 	}
+ 
+ 	/* reset_list_mutex also protects the rcdev's reset_control list */
+-	rstc = __reset_control_get(rcdev, rstc_id, shared);
++	rstc = __reset_control_get_internal(rcdev, rstc_id, shared);
+ 
+ 	mutex_unlock(&reset_list_mutex);
+ 
+@@ -326,6 +351,17 @@ struct reset_control *__of_reset_control_get(struct device_node *node,
+ }
+ EXPORT_SYMBOL_GPL(__of_reset_control_get);
+ 
++struct reset_control *__reset_control_get(struct device *dev, const char *id,
++					  int index, bool shared, bool optional)
++{
++	if (dev->of_node)
++		return __of_reset_control_get(dev->of_node, id, index, shared,
++					      optional);
++
++	return optional ? NULL : ERR_PTR(-EINVAL);
++}
++EXPORT_SYMBOL_GPL(__reset_control_get);
++
+ /**
+  * reset_control_put - free the reset controller
+  * @rstc: reset controller
+@@ -333,11 +369,11 @@ EXPORT_SYMBOL_GPL(__of_reset_control_get);
+ 
+ void reset_control_put(struct reset_control *rstc)
+ {
+-	if (IS_ERR(rstc))
++	if (IS_ERR_OR_NULL(rstc))
+ 		return;
+ 
+ 	mutex_lock(&reset_list_mutex);
+-	__reset_control_put(rstc);
++	__reset_control_put_internal(rstc);
+ 	mutex_unlock(&reset_list_mutex);
+ }
+ EXPORT_SYMBOL_GPL(reset_control_put);
+@@ -348,7 +384,8 @@ static void devm_reset_control_release(struct device *dev, void *res)
+ }
+ 
+ struct reset_control *__devm_reset_control_get(struct device *dev,
+-				     const char *id, int index, int shared)
++				     const char *id, int index, bool shared,
++				     bool optional)
+ {
+ 	struct reset_control **ptr, *rstc;
+ 
+@@ -357,8 +394,7 @@ struct reset_control *__devm_reset_control_get(struct device *dev,
+ 	if (!ptr)
+ 		return ERR_PTR(-ENOMEM);
+ 
+-	rstc = __of_reset_control_get(dev ? dev->of_node : NULL,
+-				      id, index, shared);
++	rstc = __reset_control_get(dev, id, index, shared, optional);
+ 	if (!IS_ERR(rstc)) {
+ 		*ptr = rstc;
+ 		devres_add(dev, ptr);
+@@ -374,17 +410,18 @@ EXPORT_SYMBOL_GPL(__devm_reset_control_get);
+  * device_reset - find reset controller associated with the device
+  *                and perform reset
+  * @dev: device to be reset by the controller
++ * @optional: whether it is optional to reset the device
+  *
+- * Convenience wrapper for reset_control_get() and reset_control_reset().
++ * Convenience wrapper for __reset_control_get() and reset_control_reset().
+  * This is useful for the common case of devices with single, dedicated reset
+  * lines.
+  */
+-int device_reset(struct device *dev)
++int __device_reset(struct device *dev, bool optional)
+ {
+ 	struct reset_control *rstc;
+ 	int ret;
+ 
+-	rstc = reset_control_get(dev, NULL);
++	rstc = __reset_control_get(dev, NULL, 0, 0, optional);
+ 	if (IS_ERR(rstc))
+ 		return PTR_ERR(rstc);
+ 
+@@ -394,4 +431,4 @@ int device_reset(struct device *dev)
+ 
+ 	return ret;
+ }
+-EXPORT_SYMBOL_GPL(device_reset);
++EXPORT_SYMBOL_GPL(__device_reset);
+diff --git a/drivers/scsi/bfa/bfa_fcbuild.c b/drivers/scsi/bfa/bfa_fcbuild.c
+index b8dadc9cc993..d3b00a475aeb 100644
+--- a/drivers/scsi/bfa/bfa_fcbuild.c
++++ b/drivers/scsi/bfa/bfa_fcbuild.c
+@@ -1250,8 +1250,8 @@ fc_rspnid_build(struct fchs_s *fchs, void *pyld, u32 s_id, u16 ox_id,
+ 	memset(rspnid, 0, sizeof(struct fcgs_rspnid_req_s));
+ 
+ 	rspnid->dap = s_id;
+-	rspnid->spn_len = (u8) strlen((char *)name);
+-	strncpy((char *)rspnid->spn, (char *)name, rspnid->spn_len);
++	strlcpy(rspnid->spn, name, sizeof(rspnid->spn));
++	rspnid->spn_len = (u8) strlen(rspnid->spn);
+ 
+ 	return sizeof(struct fcgs_rspnid_req_s) + sizeof(struct ct_hdr_s);
+ }
+@@ -1271,8 +1271,8 @@ fc_rsnn_nn_build(struct fchs_s *fchs, void *pyld, u32 s_id,
+ 	memset(rsnn_nn, 0, sizeof(struct fcgs_rsnn_nn_req_s));
+ 
+ 	rsnn_nn->node_name = node_name;
+-	rsnn_nn->snn_len = (u8) strlen((char *)name);
+-	strncpy((char *)rsnn_nn->snn, (char *)name, rsnn_nn->snn_len);
++	strlcpy(rsnn_nn->snn, name, sizeof(rsnn_nn->snn));
++	rsnn_nn->snn_len = (u8) strlen(rsnn_nn->snn);
+ 
+ 	return sizeof(struct fcgs_rsnn_nn_req_s) + sizeof(struct ct_hdr_s);
+ }
+diff --git a/drivers/scsi/bfa/bfa_fcs.c b/drivers/scsi/bfa/bfa_fcs.c
+index 1e7e139d71ea..f602de047087 100644
+--- a/drivers/scsi/bfa/bfa_fcs.c
++++ b/drivers/scsi/bfa/bfa_fcs.c
+@@ -832,23 +832,23 @@ bfa_fcs_fabric_psymb_init(struct bfa_fcs_fabric_s *fabric)
+ 	bfa_ioc_get_adapter_model(&fabric->fcs->bfa->ioc, model);
+ 
+ 	/* Model name/number */
+-	strncpy((char *)&port_cfg->sym_name, model,
+-		BFA_FCS_PORT_SYMBNAME_MODEL_SZ);
+-	strncat((char *)&port_cfg->sym_name, BFA_FCS_PORT_SYMBNAME_SEPARATOR,
+-		sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR));
++	strlcpy(port_cfg->sym_name.symname, model,
++		BFA_SYMNAME_MAXLEN);
++	strlcat(port_cfg->sym_name.symname, BFA_FCS_PORT_SYMBNAME_SEPARATOR,
++		BFA_SYMNAME_MAXLEN);
+ 
+ 	/* Driver Version */
+-	strncat((char *)&port_cfg->sym_name, (char *)driver_info->version,
+-		BFA_FCS_PORT_SYMBNAME_VERSION_SZ);
+-	strncat((char *)&port_cfg->sym_name, BFA_FCS_PORT_SYMBNAME_SEPARATOR,
+-		sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR));
++	strlcat(port_cfg->sym_name.symname, driver_info->version,
++		BFA_SYMNAME_MAXLEN);
++	strlcat(port_cfg->sym_name.symname, BFA_FCS_PORT_SYMBNAME_SEPARATOR,
++		BFA_SYMNAME_MAXLEN);
+ 
+ 	/* Host machine name */
+-	strncat((char *)&port_cfg->sym_name,
+-		(char *)driver_info->host_machine_name,
+-		BFA_FCS_PORT_SYMBNAME_MACHINENAME_SZ);
+-	strncat((char *)&port_cfg->sym_name, BFA_FCS_PORT_SYMBNAME_SEPARATOR,
+-		sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR));
++	strlcat(port_cfg->sym_name.symname,
++		driver_info->host_machine_name,
++		BFA_SYMNAME_MAXLEN);
++	strlcat(port_cfg->sym_name.symname, BFA_FCS_PORT_SYMBNAME_SEPARATOR,
++		BFA_SYMNAME_MAXLEN);
+ 
+ 	/*
+ 	 * Host OS Info :
+@@ -856,24 +856,24 @@ bfa_fcs_fabric_psymb_init(struct bfa_fcs_fabric_s *fabric)
+ 	 * OS name string and instead copy the entire OS info string (64 bytes).
+ 	 */
+ 	if (driver_info->host_os_patch[0] == '\0') {
+-		strncat((char *)&port_cfg->sym_name,
+-			(char *)driver_info->host_os_name,
+-			BFA_FCS_OS_STR_LEN);
+-		strncat((char *)&port_cfg->sym_name,
++		strlcat(port_cfg->sym_name.symname,
++			driver_info->host_os_name,
++			BFA_SYMNAME_MAXLEN);
++		strlcat(port_cfg->sym_name.symname,
+ 			BFA_FCS_PORT_SYMBNAME_SEPARATOR,
+-			sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR));
++			BFA_SYMNAME_MAXLEN);
+ 	} else {
+-		strncat((char *)&port_cfg->sym_name,
+-			(char *)driver_info->host_os_name,
+-			BFA_FCS_PORT_SYMBNAME_OSINFO_SZ);
+-		strncat((char *)&port_cfg->sym_name,
++		strlcat(port_cfg->sym_name.symname,
++			driver_info->host_os_name,
++			BFA_SYMNAME_MAXLEN);
++		strlcat(port_cfg->sym_name.symname,
+ 			BFA_FCS_PORT_SYMBNAME_SEPARATOR,
+-			sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR));
++			BFA_SYMNAME_MAXLEN);
+ 
+ 		/* Append host OS Patch Info */
+-		strncat((char *)&port_cfg->sym_name,
+-			(char *)driver_info->host_os_patch,
+-			BFA_FCS_PORT_SYMBNAME_OSPATCH_SZ);
++		strlcat(port_cfg->sym_name.symname,
++			driver_info->host_os_patch,
++			BFA_SYMNAME_MAXLEN);
+ 	}
+ 
+ 	/* null terminate */
+@@ -893,26 +893,26 @@ bfa_fcs_fabric_nsymb_init(struct bfa_fcs_fabric_s *fabric)
+ 	bfa_ioc_get_adapter_model(&fabric->fcs->bfa->ioc, model);
+ 
+ 	/* Model name/number */
+-	strncpy((char *)&port_cfg->node_sym_name, model,
+-		BFA_FCS_PORT_SYMBNAME_MODEL_SZ);
+-	strncat((char *)&port_cfg->node_sym_name,
++	strlcpy(port_cfg->node_sym_name.symname, model,
++		BFA_SYMNAME_MAXLEN);
++	strlcat(port_cfg->node_sym_name.symname,
+ 			BFA_FCS_PORT_SYMBNAME_SEPARATOR,
+-			sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR));
++			BFA_SYMNAME_MAXLEN);
+ 
+ 	/* Driver Version */
+-	strncat((char *)&port_cfg->node_sym_name, (char *)driver_info->version,
+-		BFA_FCS_PORT_SYMBNAME_VERSION_SZ);
+-	strncat((char *)&port_cfg->node_sym_name,
++	strlcat(port_cfg->node_sym_name.symname, (char *)driver_info->version,
++		BFA_SYMNAME_MAXLEN);
++	strlcat(port_cfg->node_sym_name.symname,
+ 			BFA_FCS_PORT_SYMBNAME_SEPARATOR,
+-			sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR));
++			BFA_SYMNAME_MAXLEN);
+ 
+ 	/* Host machine name */
+-	strncat((char *)&port_cfg->node_sym_name,
+-		(char *)driver_info->host_machine_name,
+-		BFA_FCS_PORT_SYMBNAME_MACHINENAME_SZ);
+-	strncat((char *)&port_cfg->node_sym_name,
++	strlcat(port_cfg->node_sym_name.symname,
++		driver_info->host_machine_name,
++		BFA_SYMNAME_MAXLEN);
++	strlcat(port_cfg->node_sym_name.symname,
+ 			BFA_FCS_PORT_SYMBNAME_SEPARATOR,
+-			sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR));
++			BFA_SYMNAME_MAXLEN);
+ 
+ 	/* null terminate */
+ 	port_cfg->node_sym_name.symname[BFA_SYMNAME_MAXLEN - 1] = 0;
+diff --git a/drivers/scsi/bfa/bfa_fcs_lport.c b/drivers/scsi/bfa/bfa_fcs_lport.c
+index 4ddda72f60e6..eb87949b00c1 100644
+--- a/drivers/scsi/bfa/bfa_fcs_lport.c
++++ b/drivers/scsi/bfa/bfa_fcs_lport.c
+@@ -2631,10 +2631,10 @@ bfa_fcs_fdmi_get_hbaattr(struct bfa_fcs_lport_fdmi_s *fdmi,
+ 	bfa_ioc_get_adapter_fw_ver(&port->fcs->bfa->ioc,
+ 					hba_attr->fw_version);
+ 
+-	strncpy(hba_attr->driver_version, (char *)driver_info->version,
++	strlcpy(hba_attr->driver_version, (char *)driver_info->version,
+ 		sizeof(hba_attr->driver_version));
+ 
+-	strncpy(hba_attr->os_name, driver_info->host_os_name,
++	strlcpy(hba_attr->os_name, driver_info->host_os_name,
+ 		sizeof(hba_attr->os_name));
+ 
+ 	/*
+@@ -2642,23 +2642,23 @@ bfa_fcs_fdmi_get_hbaattr(struct bfa_fcs_lport_fdmi_s *fdmi,
+ 	 * to the os name along with a separator
+ 	 */
+ 	if (driver_info->host_os_patch[0] != '\0') {
+-		strncat(hba_attr->os_name, BFA_FCS_PORT_SYMBNAME_SEPARATOR,
+-			sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR));
+-		strncat(hba_attr->os_name, driver_info->host_os_patch,
+-				sizeof(driver_info->host_os_patch));
++		strlcat(hba_attr->os_name, BFA_FCS_PORT_SYMBNAME_SEPARATOR,
++			sizeof(hba_attr->os_name));
++		strlcat(hba_attr->os_name, driver_info->host_os_patch,
++				sizeof(hba_attr->os_name));
+ 	}
+ 
+ 	/* Retrieve the max frame size from the port attr */
+ 	bfa_fcs_fdmi_get_portattr(fdmi, &fcs_port_attr);
+ 	hba_attr->max_ct_pyld = fcs_port_attr.max_frm_size;
+ 
+-	strncpy(hba_attr->node_sym_name.symname,
++	strlcpy(hba_attr->node_sym_name.symname,
+ 		port->port_cfg.node_sym_name.symname, BFA_SYMNAME_MAXLEN);
+ 	strcpy(hba_attr->vendor_info, "QLogic");
+ 	hba_attr->num_ports =
+ 		cpu_to_be32(bfa_ioc_get_nports(&port->fcs->bfa->ioc));
+ 	hba_attr->fabric_name = port->fabric->lps->pr_nwwn;
+-	strncpy(hba_attr->bios_ver, hba_attr->option_rom_ver, BFA_VERSION_LEN);
++	strlcpy(hba_attr->bios_ver, hba_attr->option_rom_ver, BFA_VERSION_LEN);
+ 
+ }
+ 
+@@ -2725,20 +2725,20 @@ bfa_fcs_fdmi_get_portattr(struct bfa_fcs_lport_fdmi_s *fdmi,
+ 	/*
+ 	 * OS device Name
+ 	 */
+-	strncpy(port_attr->os_device_name, (char *)driver_info->os_device_name,
++	strlcpy(port_attr->os_device_name, driver_info->os_device_name,
+ 		sizeof(port_attr->os_device_name));
+ 
+ 	/*
+ 	 * Host name
+ 	 */
+-	strncpy(port_attr->host_name, (char *)driver_info->host_machine_name,
++	strlcpy(port_attr->host_name, driver_info->host_machine_name,
+ 		sizeof(port_attr->host_name));
+ 
+ 	port_attr->node_name = bfa_fcs_lport_get_nwwn(port);
+ 	port_attr->port_name = bfa_fcs_lport_get_pwwn(port);
+ 
+-	strncpy(port_attr->port_sym_name.symname,
+-		(char *)&bfa_fcs_lport_get_psym_name(port), BFA_SYMNAME_MAXLEN);
++	strlcpy(port_attr->port_sym_name.symname,
++		bfa_fcs_lport_get_psym_name(port).symname, BFA_SYMNAME_MAXLEN);
+ 	bfa_fcs_lport_get_attr(port, &lport_attr);
+ 	port_attr->port_type = cpu_to_be32(lport_attr.port_type);
+ 	port_attr->scos = pport_attr.cos_supported;
+@@ -3218,7 +3218,7 @@ bfa_fcs_lport_ms_gmal_response(void *fcsarg, struct bfa_fcxp_s *fcxp,
+ 					rsp_str[gmal_entry->len-1] = 0;
+ 
+ 				/* copy IP Address to fabric */
+-				strncpy(bfa_fcs_lport_get_fabric_ipaddr(port),
++				strlcpy(bfa_fcs_lport_get_fabric_ipaddr(port),
+ 					gmal_entry->ip_addr,
+ 					BFA_FCS_FABRIC_IPADDR_SZ);
+ 				break;
+@@ -4656,21 +4656,13 @@ bfa_fcs_lport_ns_send_rspn_id(void *ns_cbarg, struct bfa_fcxp_s *fcxp_alloced)
+ 		 * to that of the base port.
+ 		 */
+ 
+-		strncpy((char *)psymbl,
+-			(char *) &
+-			(bfa_fcs_lport_get_psym_name
++		strlcpy(symbl,
++			(char *)&(bfa_fcs_lport_get_psym_name
+ 			 (bfa_fcs_get_base_port(port->fcs))),
+-			strlen((char *) &
+-			       bfa_fcs_lport_get_psym_name(bfa_fcs_get_base_port
+-							  (port->fcs))));
+-
+-		/* Ensure we have a null terminating string. */
+-		((char *)psymbl)[strlen((char *) &
+-			bfa_fcs_lport_get_psym_name(bfa_fcs_get_base_port
+-						(port->fcs)))] = 0;
+-		strncat((char *)psymbl,
+-			(char *) &(bfa_fcs_lport_get_psym_name(port)),
+-		strlen((char *) &bfa_fcs_lport_get_psym_name(port)));
++			sizeof(symbl));
++
++		strlcat(symbl, (char *)&(bfa_fcs_lport_get_psym_name(port)),
++			sizeof(symbl));
+ 	} else {
+ 		psymbl = (u8 *) &(bfa_fcs_lport_get_psym_name(port));
+ 	}
+@@ -5162,7 +5154,6 @@ bfa_fcs_lport_ns_util_send_rspn_id(void *cbarg, struct bfa_fcxp_s *fcxp_alloced)
+ 	struct fchs_s fchs;
+ 	struct bfa_fcxp_s *fcxp;
+ 	u8 symbl[256];
+-	u8 *psymbl = &symbl[0];
+ 	int len;
+ 
+ 	/* Avoid sending RSPN in the following states. */
+@@ -5192,22 +5183,17 @@ bfa_fcs_lport_ns_util_send_rspn_id(void *cbarg, struct bfa_fcxp_s *fcxp_alloced)
+ 		 * For Vports, we append the vport's port symbolic name
+ 		 * to that of the base port.
+ 		 */
+-		strncpy((char *)psymbl, (char *)&(bfa_fcs_lport_get_psym_name
++		strlcpy(symbl, (char *)&(bfa_fcs_lport_get_psym_name
+ 			(bfa_fcs_get_base_port(port->fcs))),
+-			strlen((char *)&bfa_fcs_lport_get_psym_name(
+-			bfa_fcs_get_base_port(port->fcs))));
+-
+-		/* Ensure we have a null terminating string. */
+-		((char *)psymbl)[strlen((char *)&bfa_fcs_lport_get_psym_name(
+-		 bfa_fcs_get_base_port(port->fcs)))] = 0;
++			sizeof(symbl));
+ 
+-		strncat((char *)psymbl,
++		strlcat(symbl,
+ 			(char *)&(bfa_fcs_lport_get_psym_name(port)),
+-			strlen((char *)&bfa_fcs_lport_get_psym_name(port)));
++			sizeof(symbl));
+ 	}
+ 
+ 	len = fc_rspnid_build(&fchs, bfa_fcxp_get_reqbuf(fcxp),
+-			      bfa_fcs_lport_get_fcid(port), 0, psymbl);
++			      bfa_fcs_lport_get_fcid(port), 0, symbl);
+ 
+ 	bfa_fcxp_send(fcxp, NULL, port->fabric->vf_id, port->lp_tag, BFA_FALSE,
+ 		      FC_CLASS_3, len, &fchs, NULL, NULL, FC_MAX_PDUSZ, 0);
+diff --git a/drivers/scsi/bfa/bfa_ioc.c b/drivers/scsi/bfa/bfa_ioc.c
+index a1ada4a31c97..16750416d3c0 100644
+--- a/drivers/scsi/bfa/bfa_ioc.c
++++ b/drivers/scsi/bfa/bfa_ioc.c
+@@ -2803,7 +2803,7 @@ void
+ bfa_ioc_get_adapter_manufacturer(struct bfa_ioc_s *ioc, char *manufacturer)
+ {
+ 	memset((void *)manufacturer, 0, BFA_ADAPTER_MFG_NAME_LEN);
+-	strncpy(manufacturer, BFA_MFG_NAME, BFA_ADAPTER_MFG_NAME_LEN);
++	strlcpy(manufacturer, BFA_MFG_NAME, BFA_ADAPTER_MFG_NAME_LEN);
+ }
+ 
+ void
+diff --git a/drivers/scsi/bfa/bfa_svc.c b/drivers/scsi/bfa/bfa_svc.c
+index 12de292175ef..225883d2aeef 100644
+--- a/drivers/scsi/bfa/bfa_svc.c
++++ b/drivers/scsi/bfa/bfa_svc.c
+@@ -366,8 +366,8 @@ bfa_plog_str(struct bfa_plog_s *plog, enum bfa_plog_mid mid,
+ 		lp.eid = event;
+ 		lp.log_type = BFA_PL_LOG_TYPE_STRING;
+ 		lp.misc = misc;
+-		strncpy(lp.log_entry.string_log, log_str,
+-			BFA_PL_STRING_LOG_SZ - 1);
++		strlcpy(lp.log_entry.string_log, log_str,
++			BFA_PL_STRING_LOG_SZ);
+ 		lp.log_entry.string_log[BFA_PL_STRING_LOG_SZ - 1] = '\0';
+ 		bfa_plog_add(plog, &lp);
+ 	}
+diff --git a/drivers/scsi/bfa/bfad.c b/drivers/scsi/bfa/bfad.c
+index e70410beb83a..389f8ef0b095 100644
+--- a/drivers/scsi/bfa/bfad.c
++++ b/drivers/scsi/bfa/bfad.c
+@@ -983,20 +983,20 @@ bfad_start_ops(struct bfad_s *bfad) {
+ 
+ 	/* Fill the driver_info info to fcs*/
+ 	memset(&driver_info, 0, sizeof(driver_info));
+-	strncpy(driver_info.version, BFAD_DRIVER_VERSION,
+-		sizeof(driver_info.version) - 1);
++	strlcpy(driver_info.version, BFAD_DRIVER_VERSION,
++		sizeof(driver_info.version));
+ 	if (host_name)
+-		strncpy(driver_info.host_machine_name, host_name,
+-			sizeof(driver_info.host_machine_name) - 1);
++		strlcpy(driver_info.host_machine_name, host_name,
++			sizeof(driver_info.host_machine_name));
+ 	if (os_name)
+-		strncpy(driver_info.host_os_name, os_name,
+-			sizeof(driver_info.host_os_name) - 1);
++		strlcpy(driver_info.host_os_name, os_name,
++			sizeof(driver_info.host_os_name));
+ 	if (os_patch)
+-		strncpy(driver_info.host_os_patch, os_patch,
+-			sizeof(driver_info.host_os_patch) - 1);
++		strlcpy(driver_info.host_os_patch, os_patch,
++			sizeof(driver_info.host_os_patch));
+ 
+-	strncpy(driver_info.os_device_name, bfad->pci_name,
+-		sizeof(driver_info.os_device_name) - 1);
++	strlcpy(driver_info.os_device_name, bfad->pci_name,
++		sizeof(driver_info.os_device_name));
+ 
+ 	/* FCS driver info init */
+ 	spin_lock_irqsave(&bfad->bfad_lock, flags);
+diff --git a/drivers/scsi/bfa/bfad_attr.c b/drivers/scsi/bfa/bfad_attr.c
+index 13db3b7bc873..d0a504af5b4f 100644
+--- a/drivers/scsi/bfa/bfad_attr.c
++++ b/drivers/scsi/bfa/bfad_attr.c
+@@ -843,7 +843,7 @@ bfad_im_symbolic_name_show(struct device *dev, struct device_attribute *attr,
+ 	char symname[BFA_SYMNAME_MAXLEN];
+ 
+ 	bfa_fcs_lport_get_attr(&bfad->bfa_fcs.fabric.bport, &port_attr);
+-	strncpy(symname, port_attr.port_cfg.sym_name.symname,
++	strlcpy(symname, port_attr.port_cfg.sym_name.symname,
+ 			BFA_SYMNAME_MAXLEN);
+ 	return snprintf(buf, PAGE_SIZE, "%s\n", symname);
+ }
+diff --git a/drivers/scsi/bfa/bfad_bsg.c b/drivers/scsi/bfa/bfad_bsg.c
+index d1ad0208dfe7..a3bd23685824 100644
+--- a/drivers/scsi/bfa/bfad_bsg.c
++++ b/drivers/scsi/bfa/bfad_bsg.c
+@@ -127,7 +127,7 @@ bfad_iocmd_ioc_get_attr(struct bfad_s *bfad, void *cmd)
+ 
+ 	/* fill in driver attr info */
+ 	strcpy(iocmd->ioc_attr.driver_attr.driver, BFAD_DRIVER_NAME);
+-	strncpy(iocmd->ioc_attr.driver_attr.driver_ver,
++	strlcpy(iocmd->ioc_attr.driver_attr.driver_ver,
+ 		BFAD_DRIVER_VERSION, BFA_VERSION_LEN);
+ 	strcpy(iocmd->ioc_attr.driver_attr.fw_ver,
+ 		iocmd->ioc_attr.adapter_attr.fw_ver);
+@@ -315,9 +315,9 @@ bfad_iocmd_port_get_attr(struct bfad_s *bfad, void *cmd)
+ 	iocmd->attr.port_type = port_attr.port_type;
+ 	iocmd->attr.loopback = port_attr.loopback;
+ 	iocmd->attr.authfail = port_attr.authfail;
+-	strncpy(iocmd->attr.port_symname.symname,
++	strlcpy(iocmd->attr.port_symname.symname,
+ 		port_attr.port_cfg.sym_name.symname,
+-		sizeof(port_attr.port_cfg.sym_name.symname));
++		sizeof(iocmd->attr.port_symname.symname));
+ 
+ 	iocmd->status = BFA_STATUS_OK;
+ 	return 0;
+diff --git a/drivers/scsi/csiostor/csio_lnode.c b/drivers/scsi/csiostor/csio_lnode.c
+index c00b2ff72b55..be5ee2d37815 100644
+--- a/drivers/scsi/csiostor/csio_lnode.c
++++ b/drivers/scsi/csiostor/csio_lnode.c
+@@ -238,14 +238,23 @@ csio_osname(uint8_t *buf, size_t buf_len)
+ }
+ 
+ static inline void
+-csio_append_attrib(uint8_t **ptr, uint16_t type, uint8_t *val, uint16_t len)
++csio_append_attrib(uint8_t **ptr, uint16_t type, void *val, size_t val_len)
+ {
++	uint16_t len;
+ 	struct fc_fdmi_attr_entry *ae = (struct fc_fdmi_attr_entry *)*ptr;
++
++	if (WARN_ON(val_len > U16_MAX))
++		return;
++
++	len = val_len;
++
+ 	ae->type = htons(type);
+ 	len += 4;		/* includes attribute type and length */
+ 	len = (len + 3) & ~3;	/* should be multiple of 4 bytes */
+ 	ae->len = htons(len);
+-	memcpy(ae->value, val, len);
++	memcpy(ae->value, val, val_len);
++	if (len > val_len)
++		memset(ae->value + val_len, 0, len - val_len);
+ 	*ptr += len;
+ }
+ 
+@@ -335,7 +344,7 @@ csio_ln_fdmi_rhba_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req)
+ 	numattrs++;
+ 	val = htonl(FC_PORTSPEED_1GBIT | FC_PORTSPEED_10GBIT);
+ 	csio_append_attrib(&pld, FC_FDMI_PORT_ATTR_SUPPORTEDSPEED,
+-			   (uint8_t *)&val,
++			   &val,
+ 			   FC_FDMI_PORT_ATTR_SUPPORTEDSPEED_LEN);
+ 	numattrs++;
+ 
+@@ -346,23 +355,22 @@ csio_ln_fdmi_rhba_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req)
+ 	else
+ 		val = htonl(CSIO_HBA_PORTSPEED_UNKNOWN);
+ 	csio_append_attrib(&pld, FC_FDMI_PORT_ATTR_CURRENTPORTSPEED,
+-			   (uint8_t *)&val,
+-			   FC_FDMI_PORT_ATTR_CURRENTPORTSPEED_LEN);
++			   &val, FC_FDMI_PORT_ATTR_CURRENTPORTSPEED_LEN);
+ 	numattrs++;
+ 
+ 	mfs = ln->ln_sparm.csp.sp_bb_data;
+ 	csio_append_attrib(&pld, FC_FDMI_PORT_ATTR_MAXFRAMESIZE,
+-			   (uint8_t *)&mfs, FC_FDMI_PORT_ATTR_MAXFRAMESIZE_LEN);
++			   &mfs, sizeof(mfs));
+ 	numattrs++;
+ 
+ 	strcpy(buf, "csiostor");
+ 	csio_append_attrib(&pld, FC_FDMI_PORT_ATTR_OSDEVICENAME, buf,
+-			   (uint16_t)strlen(buf));
++			   strlen(buf));
+ 	numattrs++;
+ 
+ 	if (!csio_hostname(buf, sizeof(buf))) {
+ 		csio_append_attrib(&pld, FC_FDMI_PORT_ATTR_HOSTNAME,
+-				   buf, (uint16_t)strlen(buf));
++				   buf, strlen(buf));
+ 		numattrs++;
+ 	}
+ 	attrib_blk->numattrs = htonl(numattrs);
+@@ -444,33 +452,32 @@ csio_ln_fdmi_dprt_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req)
+ 
+ 	strcpy(buf, "Chelsio Communications");
+ 	csio_append_attrib(&pld, FC_FDMI_HBA_ATTR_MANUFACTURER, buf,
+-			   (uint16_t)strlen(buf));
++			   strlen(buf));
+ 	numattrs++;
+ 	csio_append_attrib(&pld, FC_FDMI_HBA_ATTR_SERIALNUMBER,
+-			   hw->vpd.sn, (uint16_t)sizeof(hw->vpd.sn));
++			   hw->vpd.sn, sizeof(hw->vpd.sn));
+ 	numattrs++;
+ 	csio_append_attrib(&pld, FC_FDMI_HBA_ATTR_MODEL, hw->vpd.id,
+-			   (uint16_t)sizeof(hw->vpd.id));
++			   sizeof(hw->vpd.id));
+ 	numattrs++;
+ 	csio_append_attrib(&pld, FC_FDMI_HBA_ATTR_MODELDESCRIPTION,
+-			   hw->model_desc, (uint16_t)strlen(hw->model_desc));
++			   hw->model_desc, strlen(hw->model_desc));
+ 	numattrs++;
+ 	csio_append_attrib(&pld, FC_FDMI_HBA_ATTR_HARDWAREVERSION,
+-			   hw->hw_ver, (uint16_t)sizeof(hw->hw_ver));
++			   hw->hw_ver, sizeof(hw->hw_ver));
+ 	numattrs++;
+ 	csio_append_attrib(&pld, FC_FDMI_HBA_ATTR_FIRMWAREVERSION,
+-			   hw->fwrev_str, (uint16_t)strlen(hw->fwrev_str));
++			   hw->fwrev_str, strlen(hw->fwrev_str));
+ 	numattrs++;
+ 
+ 	if (!csio_osname(buf, sizeof(buf))) {
+ 		csio_append_attrib(&pld, FC_FDMI_HBA_ATTR_OSNAMEVERSION,
+-				   buf, (uint16_t)strlen(buf));
++				   buf, strlen(buf));
+ 		numattrs++;
+ 	}
+ 
+ 	csio_append_attrib(&pld, FC_FDMI_HBA_ATTR_MAXCTPAYLOAD,
+-			   (uint8_t *)&maxpayload,
+-			   FC_FDMI_HBA_ATTR_MAXCTPAYLOAD_LEN);
++			   &maxpayload, FC_FDMI_HBA_ATTR_MAXCTPAYLOAD_LEN);
+ 	len = (uint32_t)(pld - (uint8_t *)cmd);
+ 	numattrs++;
+ 	attrib_blk->numattrs = htonl(numattrs);
+@@ -1794,6 +1801,8 @@ csio_ln_mgmt_submit_req(struct csio_ioreq *io_req,
+ 	struct csio_mgmtm *mgmtm = csio_hw_to_mgmtm(hw);
+ 	int rv;
+ 
++	BUG_ON(pld_len > pld->len);
++
+ 	io_req->io_cbfn = io_cbfn;	/* Upper layer callback handler */
+ 	io_req->fw_handle = (uintptr_t) (io_req);
+ 	io_req->eq_idx = mgmtm->eq_idx;
+diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c
+index 43d4b30cbf65..282ea00d0f87 100644
+--- a/drivers/scsi/scsi_devinfo.c
++++ b/drivers/scsi/scsi_devinfo.c
+@@ -33,7 +33,6 @@ struct scsi_dev_info_list_table {
+ };
+ 
+ 
+-static const char spaces[] = "                "; /* 16 of them */
+ static unsigned scsi_default_dev_flags;
+ static LIST_HEAD(scsi_dev_info_list);
+ static char scsi_dev_flags[256];
+@@ -298,20 +297,13 @@ static void scsi_strcpy_devinfo(char *name, char *to, size_t to_length,
+ 	size_t from_length;
+ 
+ 	from_length = strlen(from);
+-	strncpy(to, from, min(to_length, from_length));
+-	if (from_length < to_length) {
+-		if (compatible) {
+-			/*
+-			 * NUL terminate the string if it is short.
+-			 */
+-			to[from_length] = '\0';
+-		} else {
+-			/* 
+-			 * space pad the string if it is short. 
+-			 */
+-			strncpy(&to[from_length], spaces,
+-				to_length - from_length);
+-		}
++	/* this zero-pads the destination */
++	strncpy(to, from, to_length);
++	if (from_length < to_length && !compatible) {
++		/*
++		 * space pad the string if it is short.
++		 */
++		memset(&to[from_length], ' ', to_length - from_length);
+ 	}
+ 	if (from_length > to_length)
+ 		 printk(KERN_WARNING "%s: %s string '%s' is too long\n",
+diff --git a/drivers/staging/rts5208/sd.c b/drivers/staging/rts5208/sd.c
+index 9e63bdf2afe7..4e233f3e7215 100644
+--- a/drivers/staging/rts5208/sd.c
++++ b/drivers/staging/rts5208/sd.c
+@@ -4110,12 +4110,6 @@ RTY_SEND_CMD:
+ 					rtsx_trace(chip);
+ 					return STATUS_FAIL;
+ 				}
+-
+-			} else if (rsp_type == SD_RSP_TYPE_R0) {
+-				if ((ptr[3] & 0x1E) != 0x03) {
+-					rtsx_trace(chip);
+-					return STATUS_FAIL;
+-				}
+ 			}
+ 		}
+ 	}
+diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c
+index 2db68dfe497d..c448225ef5ca 100644
+--- a/drivers/tty/serial/kgdboc.c
++++ b/drivers/tty/serial/kgdboc.c
+@@ -131,24 +131,6 @@ static void kgdboc_unregister_kbd(void)
+ #define kgdboc_restore_input()
+ #endif /* ! CONFIG_KDB_KEYBOARD */
+ 
+-static int kgdboc_option_setup(char *opt)
+-{
+-	if (!opt) {
+-		pr_err("kgdboc: config string not provided\n");
+-		return -EINVAL;
+-	}
+-
+-	if (strlen(opt) >= MAX_CONFIG_LEN) {
+-		printk(KERN_ERR "kgdboc: config string too long\n");
+-		return -ENOSPC;
+-	}
+-	strcpy(config, opt);
+-
+-	return 0;
+-}
+-
+-__setup("kgdboc=", kgdboc_option_setup);
+-
+ static void cleanup_kgdboc(void)
+ {
+ 	if (kgdb_unregister_nmi_console())
+@@ -162,15 +144,13 @@ static int configure_kgdboc(void)
+ {
+ 	struct tty_driver *p;
+ 	int tty_line = 0;
+-	int err;
++	int err = -ENODEV;
+ 	char *cptr = config;
+ 	struct console *cons;
+ 
+-	err = kgdboc_option_setup(config);
+-	if (err || !strlen(config) || isspace(config[0]))
++	if (!strlen(config) || isspace(config[0]))
+ 		goto noconfig;
+ 
+-	err = -ENODEV;
+ 	kgdboc_io_ops.is_console = 0;
+ 	kgdb_tty_driver = NULL;
+ 
+@@ -318,6 +298,25 @@ static struct kgdb_io kgdboc_io_ops = {
+ };
+ 
+ #ifdef CONFIG_KGDB_SERIAL_CONSOLE
++static int kgdboc_option_setup(char *opt)
++{
++	if (!opt) {
++		pr_err("config string not provided\n");
++		return -EINVAL;
++	}
++
++	if (strlen(opt) >= MAX_CONFIG_LEN) {
++		pr_err("config string too long\n");
++		return -ENOSPC;
++	}
++	strcpy(config, opt);
++
++	return 0;
++}
++
++__setup("kgdboc=", kgdboc_option_setup);
++
++
+ /* This is only available if kgdboc is a built in for early debugging */
+ static int __init kgdboc_early_init(char *opt)
+ {
+diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c
+index ff4d6cac7ac0..ab89fa3b4118 100644
+--- a/drivers/usb/gadget/udc/dummy_hcd.c
++++ b/drivers/usb/gadget/udc/dummy_hcd.c
+@@ -379,11 +379,10 @@ static void set_link_state_by_speed(struct dummy_hcd *dum_hcd)
+ 			     USB_PORT_STAT_CONNECTION) == 0)
+ 				dum_hcd->port_status |=
+ 					(USB_PORT_STAT_C_CONNECTION << 16);
+-			if ((dum_hcd->port_status &
+-			     USB_PORT_STAT_ENABLE) == 1 &&
+-				(dum_hcd->port_status &
+-				 USB_SS_PORT_LS_U0) == 1 &&
+-				dum_hcd->rh_state != DUMMY_RH_SUSPENDED)
++			if ((dum_hcd->port_status & USB_PORT_STAT_ENABLE) &&
++			    (dum_hcd->port_status &
++			     USB_PORT_STAT_LINK_STATE) == USB_SS_PORT_LS_U0 &&
++			    dum_hcd->rh_state != DUMMY_RH_SUSPENDED)
+ 				dum_hcd->active = 1;
+ 		}
+ 	} else {
+diff --git a/fs/btrfs/Makefile b/fs/btrfs/Makefile
+index 128ce17a80b0..076ccfb44c28 100644
+--- a/fs/btrfs/Makefile
++++ b/fs/btrfs/Makefile
+@@ -9,7 +9,7 @@ btrfs-y += super.o ctree.o extent-tree.o print-tree.o root-tree.o dir-item.o \
+ 	   export.o tree-log.o free-space-cache.o zlib.o lzo.o \
+ 	   compression.o delayed-ref.o relocation.o delayed-inode.o scrub.o \
+ 	   reada.o backref.o ulist.o qgroup.o send.o dev-replace.o raid56.o \
+-	   uuid-tree.o props.o hash.o free-space-tree.o
++	   uuid-tree.o props.o hash.o free-space-tree.o tree-checker.o
+ 
+ btrfs-$(CONFIG_BTRFS_FS_POSIX_ACL) += acl.o
+ btrfs-$(CONFIG_BTRFS_FS_CHECK_INTEGRITY) += check-integrity.o
+diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
+index 86245b884fce..a423c36bcd72 100644
+--- a/fs/btrfs/ctree.h
++++ b/fs/btrfs/ctree.h
+@@ -1415,7 +1415,7 @@ do {                                                                   \
+ #define BTRFS_INODE_ROOT_ITEM_INIT	(1 << 31)
+ 
+ struct btrfs_map_token {
+-	struct extent_buffer *eb;
++	const struct extent_buffer *eb;
+ 	char *kaddr;
+ 	unsigned long offset;
+ };
+@@ -1449,18 +1449,19 @@ static inline void btrfs_init_map_token (struct btrfs_map_token *token)
+ 			   sizeof(((type *)0)->member)))
+ 
+ #define DECLARE_BTRFS_SETGET_BITS(bits)					\
+-u##bits btrfs_get_token_##bits(struct extent_buffer *eb, void *ptr,	\
+-			       unsigned long off,			\
+-                              struct btrfs_map_token *token);		\
+-void btrfs_set_token_##bits(struct extent_buffer *eb, void *ptr,	\
++u##bits btrfs_get_token_##bits(const struct extent_buffer *eb,		\
++			       const void *ptr, unsigned long off,	\
++			       struct btrfs_map_token *token);		\
++void btrfs_set_token_##bits(struct extent_buffer *eb, const void *ptr,	\
+ 			    unsigned long off, u##bits val,		\
+ 			    struct btrfs_map_token *token);		\
+-static inline u##bits btrfs_get_##bits(struct extent_buffer *eb, void *ptr, \
++static inline u##bits btrfs_get_##bits(const struct extent_buffer *eb,	\
++				       const void *ptr,			\
+ 				       unsigned long off)		\
+ {									\
+ 	return btrfs_get_token_##bits(eb, ptr, off, NULL);		\
+ }									\
+-static inline void btrfs_set_##bits(struct extent_buffer *eb, void *ptr, \
++static inline void btrfs_set_##bits(struct extent_buffer *eb, void *ptr,\
+ 				    unsigned long off, u##bits val)	\
+ {									\
+        btrfs_set_token_##bits(eb, ptr, off, val, NULL);			\
+@@ -1472,7 +1473,8 @@ DECLARE_BTRFS_SETGET_BITS(32)
+ DECLARE_BTRFS_SETGET_BITS(64)
+ 
+ #define BTRFS_SETGET_FUNCS(name, type, member, bits)			\
+-static inline u##bits btrfs_##name(struct extent_buffer *eb, type *s)	\
++static inline u##bits btrfs_##name(const struct extent_buffer *eb,	\
++				   const type *s)			\
+ {									\
+ 	BUILD_BUG_ON(sizeof(u##bits) != sizeof(((type *)0))->member);	\
+ 	return btrfs_get_##bits(eb, s, offsetof(type, member));		\
+@@ -1483,7 +1485,8 @@ static inline void btrfs_set_##name(struct extent_buffer *eb, type *s,	\
+ 	BUILD_BUG_ON(sizeof(u##bits) != sizeof(((type *)0))->member);	\
+ 	btrfs_set_##bits(eb, s, offsetof(type, member), val);		\
+ }									\
+-static inline u##bits btrfs_token_##name(struct extent_buffer *eb, type *s, \
++static inline u##bits btrfs_token_##name(const struct extent_buffer *eb,\
++					 const type *s,			\
+ 					 struct btrfs_map_token *token)	\
+ {									\
+ 	BUILD_BUG_ON(sizeof(u##bits) != sizeof(((type *)0))->member);	\
+@@ -1498,9 +1501,9 @@ static inline void btrfs_set_token_##name(struct extent_buffer *eb,	\
+ }
+ 
+ #define BTRFS_SETGET_HEADER_FUNCS(name, type, member, bits)		\
+-static inline u##bits btrfs_##name(struct extent_buffer *eb)		\
++static inline u##bits btrfs_##name(const struct extent_buffer *eb)	\
+ {									\
+-	type *p = page_address(eb->pages[0]);				\
++	const type *p = page_address(eb->pages[0]);			\
+ 	u##bits res = le##bits##_to_cpu(p->member);			\
+ 	return res;							\
+ }									\
+@@ -1512,7 +1515,7 @@ static inline void btrfs_set_##name(struct extent_buffer *eb,		\
+ }
+ 
+ #define BTRFS_SETGET_STACK_FUNCS(name, type, member, bits)		\
+-static inline u##bits btrfs_##name(type *s)				\
++static inline u##bits btrfs_##name(const type *s)			\
+ {									\
+ 	return le##bits##_to_cpu(s->member);				\
+ }									\
+@@ -1818,7 +1821,7 @@ static inline unsigned long btrfs_node_key_ptr_offset(int nr)
+ 		sizeof(struct btrfs_key_ptr) * nr;
+ }
+ 
+-void btrfs_node_key(struct extent_buffer *eb,
++void btrfs_node_key(const struct extent_buffer *eb,
+ 		    struct btrfs_disk_key *disk_key, int nr);
+ 
+ static inline void btrfs_set_node_key(struct extent_buffer *eb,
+@@ -1847,28 +1850,28 @@ static inline struct btrfs_item *btrfs_item_nr(int nr)
+ 	return (struct btrfs_item *)btrfs_item_nr_offset(nr);
+ }
+ 
+-static inline u32 btrfs_item_end(struct extent_buffer *eb,
++static inline u32 btrfs_item_end(const struct extent_buffer *eb,
+ 				 struct btrfs_item *item)
+ {
+ 	return btrfs_item_offset(eb, item) + btrfs_item_size(eb, item);
+ }
+ 
+-static inline u32 btrfs_item_end_nr(struct extent_buffer *eb, int nr)
++static inline u32 btrfs_item_end_nr(const struct extent_buffer *eb, int nr)
+ {
+ 	return btrfs_item_end(eb, btrfs_item_nr(nr));
+ }
+ 
+-static inline u32 btrfs_item_offset_nr(struct extent_buffer *eb, int nr)
++static inline u32 btrfs_item_offset_nr(const struct extent_buffer *eb, int nr)
+ {
+ 	return btrfs_item_offset(eb, btrfs_item_nr(nr));
+ }
+ 
+-static inline u32 btrfs_item_size_nr(struct extent_buffer *eb, int nr)
++static inline u32 btrfs_item_size_nr(const struct extent_buffer *eb, int nr)
+ {
+ 	return btrfs_item_size(eb, btrfs_item_nr(nr));
+ }
+ 
+-static inline void btrfs_item_key(struct extent_buffer *eb,
++static inline void btrfs_item_key(const struct extent_buffer *eb,
+ 			   struct btrfs_disk_key *disk_key, int nr)
+ {
+ 	struct btrfs_item *item = btrfs_item_nr(nr);
+@@ -1904,8 +1907,8 @@ BTRFS_SETGET_STACK_FUNCS(stack_dir_name_len, struct btrfs_dir_item,
+ BTRFS_SETGET_STACK_FUNCS(stack_dir_transid, struct btrfs_dir_item,
+ 			 transid, 64);
+ 
+-static inline void btrfs_dir_item_key(struct extent_buffer *eb,
+-				      struct btrfs_dir_item *item,
++static inline void btrfs_dir_item_key(const struct extent_buffer *eb,
++				      const struct btrfs_dir_item *item,
+ 				      struct btrfs_disk_key *key)
+ {
+ 	read_eb_member(eb, item, struct btrfs_dir_item, location, key);
+@@ -1913,7 +1916,7 @@ static inline void btrfs_dir_item_key(struct extent_buffer *eb,
+ 
+ static inline void btrfs_set_dir_item_key(struct extent_buffer *eb,
+ 					  struct btrfs_dir_item *item,
+-					  struct btrfs_disk_key *key)
++					  const struct btrfs_disk_key *key)
+ {
+ 	write_eb_member(eb, item, struct btrfs_dir_item, location, key);
+ }
+@@ -1925,8 +1928,8 @@ BTRFS_SETGET_FUNCS(free_space_bitmaps, struct btrfs_free_space_header,
+ BTRFS_SETGET_FUNCS(free_space_generation, struct btrfs_free_space_header,
+ 		   generation, 64);
+ 
+-static inline void btrfs_free_space_key(struct extent_buffer *eb,
+-					struct btrfs_free_space_header *h,
++static inline void btrfs_free_space_key(const struct extent_buffer *eb,
++					const struct btrfs_free_space_header *h,
+ 					struct btrfs_disk_key *key)
+ {
+ 	read_eb_member(eb, h, struct btrfs_free_space_header, location, key);
+@@ -1934,7 +1937,7 @@ static inline void btrfs_free_space_key(struct extent_buffer *eb,
+ 
+ static inline void btrfs_set_free_space_key(struct extent_buffer *eb,
+ 					    struct btrfs_free_space_header *h,
+-					    struct btrfs_disk_key *key)
++					    const struct btrfs_disk_key *key)
+ {
+ 	write_eb_member(eb, h, struct btrfs_free_space_header, location, key);
+ }
+@@ -1961,25 +1964,25 @@ static inline void btrfs_cpu_key_to_disk(struct btrfs_disk_key *disk,
+ 	disk->objectid = cpu_to_le64(cpu->objectid);
+ }
+ 
+-static inline void btrfs_node_key_to_cpu(struct extent_buffer *eb,
+-				  struct btrfs_key *key, int nr)
++static inline void btrfs_node_key_to_cpu(const struct extent_buffer *eb,
++					 struct btrfs_key *key, int nr)
+ {
+ 	struct btrfs_disk_key disk_key;
+ 	btrfs_node_key(eb, &disk_key, nr);
+ 	btrfs_disk_key_to_cpu(key, &disk_key);
+ }
+ 
+-static inline void btrfs_item_key_to_cpu(struct extent_buffer *eb,
+-				  struct btrfs_key *key, int nr)
++static inline void btrfs_item_key_to_cpu(const struct extent_buffer *eb,
++					 struct btrfs_key *key, int nr)
+ {
+ 	struct btrfs_disk_key disk_key;
+ 	btrfs_item_key(eb, &disk_key, nr);
+ 	btrfs_disk_key_to_cpu(key, &disk_key);
+ }
+ 
+-static inline void btrfs_dir_item_key_to_cpu(struct extent_buffer *eb,
+-				      struct btrfs_dir_item *item,
+-				      struct btrfs_key *key)
++static inline void btrfs_dir_item_key_to_cpu(const struct extent_buffer *eb,
++					     const struct btrfs_dir_item *item,
++					     struct btrfs_key *key)
+ {
+ 	struct btrfs_disk_key disk_key;
+ 	btrfs_dir_item_key(eb, item, &disk_key);
+@@ -2012,7 +2015,7 @@ BTRFS_SETGET_STACK_FUNCS(stack_header_nritems, struct btrfs_header,
+ 			 nritems, 32);
+ BTRFS_SETGET_STACK_FUNCS(stack_header_bytenr, struct btrfs_header, bytenr, 64);
+ 
+-static inline int btrfs_header_flag(struct extent_buffer *eb, u64 flag)
++static inline int btrfs_header_flag(const struct extent_buffer *eb, u64 flag)
+ {
+ 	return (btrfs_header_flags(eb) & flag) == flag;
+ }
+@@ -2031,7 +2034,7 @@ static inline int btrfs_clear_header_flag(struct extent_buffer *eb, u64 flag)
+ 	return (flags & flag) == flag;
+ }
+ 
+-static inline int btrfs_header_backref_rev(struct extent_buffer *eb)
++static inline int btrfs_header_backref_rev(const struct extent_buffer *eb)
+ {
+ 	u64 flags = btrfs_header_flags(eb);
+ 	return flags >> BTRFS_BACKREF_REV_SHIFT;
+@@ -2051,12 +2054,12 @@ static inline unsigned long btrfs_header_fsid(void)
+ 	return offsetof(struct btrfs_header, fsid);
+ }
+ 
+-static inline unsigned long btrfs_header_chunk_tree_uuid(struct extent_buffer *eb)
++static inline unsigned long btrfs_header_chunk_tree_uuid(const struct extent_buffer *eb)
+ {
+ 	return offsetof(struct btrfs_header, chunk_tree_uuid);
+ }
+ 
+-static inline int btrfs_is_leaf(struct extent_buffer *eb)
++static inline int btrfs_is_leaf(const struct extent_buffer *eb)
+ {
+ 	return btrfs_header_level(eb) == 0;
+ }
+@@ -2090,12 +2093,12 @@ BTRFS_SETGET_STACK_FUNCS(root_stransid, struct btrfs_root_item,
+ BTRFS_SETGET_STACK_FUNCS(root_rtransid, struct btrfs_root_item,
+ 			 rtransid, 64);
+ 
+-static inline bool btrfs_root_readonly(struct btrfs_root *root)
++static inline bool btrfs_root_readonly(const struct btrfs_root *root)
+ {
+ 	return (root->root_item.flags & cpu_to_le64(BTRFS_ROOT_SUBVOL_RDONLY)) != 0;
+ }
+ 
+-static inline bool btrfs_root_dead(struct btrfs_root *root)
++static inline bool btrfs_root_dead(const struct btrfs_root *root)
+ {
+ 	return (root->root_item.flags & cpu_to_le64(BTRFS_ROOT_SUBVOL_DEAD)) != 0;
+ }
+@@ -2152,51 +2155,51 @@ BTRFS_SETGET_STACK_FUNCS(backup_num_devices, struct btrfs_root_backup,
+ /* struct btrfs_balance_item */
+ BTRFS_SETGET_FUNCS(balance_flags, struct btrfs_balance_item, flags, 64);
+ 
+-static inline void btrfs_balance_data(struct extent_buffer *eb,
+-				      struct btrfs_balance_item *bi,
++static inline void btrfs_balance_data(const struct extent_buffer *eb,
++				      const struct btrfs_balance_item *bi,
+ 				      struct btrfs_disk_balance_args *ba)
+ {
+ 	read_eb_member(eb, bi, struct btrfs_balance_item, data, ba);
+ }
+ 
+ static inline void btrfs_set_balance_data(struct extent_buffer *eb,
+-					  struct btrfs_balance_item *bi,
+-					  struct btrfs_disk_balance_args *ba)
++				  struct btrfs_balance_item *bi,
++				  const struct btrfs_disk_balance_args *ba)
+ {
+ 	write_eb_member(eb, bi, struct btrfs_balance_item, data, ba);
+ }
+ 
+-static inline void btrfs_balance_meta(struct extent_buffer *eb,
+-				      struct btrfs_balance_item *bi,
++static inline void btrfs_balance_meta(const struct extent_buffer *eb,
++				      const struct btrfs_balance_item *bi,
+ 				      struct btrfs_disk_balance_args *ba)
+ {
+ 	read_eb_member(eb, bi, struct btrfs_balance_item, meta, ba);
+ }
+ 
+ static inline void btrfs_set_balance_meta(struct extent_buffer *eb,
+-					  struct btrfs_balance_item *bi,
+-					  struct btrfs_disk_balance_args *ba)
++				  struct btrfs_balance_item *bi,
++				  const struct btrfs_disk_balance_args *ba)
+ {
+ 	write_eb_member(eb, bi, struct btrfs_balance_item, meta, ba);
+ }
+ 
+-static inline void btrfs_balance_sys(struct extent_buffer *eb,
+-				     struct btrfs_balance_item *bi,
++static inline void btrfs_balance_sys(const struct extent_buffer *eb,
++				     const struct btrfs_balance_item *bi,
+ 				     struct btrfs_disk_balance_args *ba)
+ {
+ 	read_eb_member(eb, bi, struct btrfs_balance_item, sys, ba);
+ }
+ 
+ static inline void btrfs_set_balance_sys(struct extent_buffer *eb,
+-					 struct btrfs_balance_item *bi,
+-					 struct btrfs_disk_balance_args *ba)
++				 struct btrfs_balance_item *bi,
++				 const struct btrfs_disk_balance_args *ba)
+ {
+ 	write_eb_member(eb, bi, struct btrfs_balance_item, sys, ba);
+ }
+ 
+ static inline void
+ btrfs_disk_balance_args_to_cpu(struct btrfs_balance_args *cpu,
+-			       struct btrfs_disk_balance_args *disk)
++			       const struct btrfs_disk_balance_args *disk)
+ {
+ 	memset(cpu, 0, sizeof(*cpu));
+ 
+@@ -2216,7 +2219,7 @@ btrfs_disk_balance_args_to_cpu(struct btrfs_balance_args *cpu,
+ 
+ static inline void
+ btrfs_cpu_balance_args_to_disk(struct btrfs_disk_balance_args *disk,
+-			       struct btrfs_balance_args *cpu)
++			       const struct btrfs_balance_args *cpu)
+ {
+ 	memset(disk, 0, sizeof(*disk));
+ 
+@@ -2284,7 +2287,7 @@ BTRFS_SETGET_STACK_FUNCS(super_magic, struct btrfs_super_block, magic, 64);
+ BTRFS_SETGET_STACK_FUNCS(super_uuid_tree_generation, struct btrfs_super_block,
+ 			 uuid_tree_generation, 64);
+ 
+-static inline int btrfs_super_csum_size(struct btrfs_super_block *s)
++static inline int btrfs_super_csum_size(const struct btrfs_super_block *s)
+ {
+ 	u16 t = btrfs_super_csum_type(s);
+ 	/*
+@@ -2303,8 +2306,8 @@ static inline unsigned long btrfs_leaf_data(struct extent_buffer *l)
+  * this returns the address of the start of the last item,
+  * which is the stop of the leaf data stack
+  */
+-static inline unsigned int leaf_data_end(struct btrfs_root *root,
+-					 struct extent_buffer *leaf)
++static inline unsigned int leaf_data_end(const struct btrfs_root *root,
++					 const struct extent_buffer *leaf)
+ {
+ 	u32 nr = btrfs_header_nritems(leaf);
+ 
+@@ -2329,7 +2332,7 @@ BTRFS_SETGET_STACK_FUNCS(stack_file_extent_compression,
+ 			 struct btrfs_file_extent_item, compression, 8);
+ 
+ static inline unsigned long
+-btrfs_file_extent_inline_start(struct btrfs_file_extent_item *e)
++btrfs_file_extent_inline_start(const struct btrfs_file_extent_item *e)
+ {
+ 	return (unsigned long)e + BTRFS_FILE_EXTENT_INLINE_DATA_START;
+ }
+@@ -2363,8 +2366,9 @@ BTRFS_SETGET_FUNCS(file_extent_other_encoding, struct btrfs_file_extent_item,
+  * size of any extent headers.  If a file is compressed on disk, this is
+  * the compressed size
+  */
+-static inline u32 btrfs_file_extent_inline_item_len(struct extent_buffer *eb,
+-						    struct btrfs_item *e)
++static inline u32 btrfs_file_extent_inline_item_len(
++						const struct extent_buffer *eb,
++						struct btrfs_item *e)
+ {
+ 	return btrfs_item_size(eb, e) - BTRFS_FILE_EXTENT_INLINE_DATA_START;
+ }
+@@ -2372,9 +2376,9 @@ static inline u32 btrfs_file_extent_inline_item_len(struct extent_buffer *eb,
+ /* this returns the number of file bytes represented by the inline item.
+  * If an item is compressed, this is the uncompressed size
+  */
+-static inline u32 btrfs_file_extent_inline_len(struct extent_buffer *eb,
+-					       int slot,
+-					       struct btrfs_file_extent_item *fi)
++static inline u32 btrfs_file_extent_inline_len(const struct extent_buffer *eb,
++					int slot,
++					const struct btrfs_file_extent_item *fi)
+ {
+ 	struct btrfs_map_token token;
+ 
+@@ -2396,8 +2400,8 @@ static inline u32 btrfs_file_extent_inline_len(struct extent_buffer *eb,
+ 
+ 
+ /* btrfs_dev_stats_item */
+-static inline u64 btrfs_dev_stats_value(struct extent_buffer *eb,
+-					struct btrfs_dev_stats_item *ptr,
++static inline u64 btrfs_dev_stats_value(const struct extent_buffer *eb,
++					const struct btrfs_dev_stats_item *ptr,
+ 					int index)
+ {
+ 	u64 val;
+diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
+index 57d375c68e46..77b32415d9f2 100644
+--- a/fs/btrfs/disk-io.c
++++ b/fs/btrfs/disk-io.c
+@@ -50,6 +50,7 @@
+ #include "sysfs.h"
+ #include "qgroup.h"
+ #include "compression.h"
++#include "tree-checker.h"
+ 
+ #ifdef CONFIG_X86
+ #include <asm/cpufeature.h>
+@@ -452,9 +453,9 @@ static int btree_read_extent_buffer_pages(struct btrfs_root *root,
+ 	int mirror_num = 0;
+ 	int failed_mirror = 0;
+ 
+-	clear_bit(EXTENT_BUFFER_CORRUPT, &eb->bflags);
+ 	io_tree = &BTRFS_I(root->fs_info->btree_inode)->io_tree;
+ 	while (1) {
++		clear_bit(EXTENT_BUFFER_CORRUPT, &eb->bflags);
+ 		ret = read_extent_buffer_pages(io_tree, eb, WAIT_COMPLETE,
+ 					       btree_get_extent, mirror_num);
+ 		if (!ret) {
+@@ -465,14 +466,6 @@ static int btree_read_extent_buffer_pages(struct btrfs_root *root,
+ 				ret = -EIO;
+ 		}
+ 
+-		/*
+-		 * This buffer's crc is fine, but its contents are corrupted, so
+-		 * there is no reason to read the other copies, they won't be
+-		 * any less wrong.
+-		 */
+-		if (test_bit(EXTENT_BUFFER_CORRUPT, &eb->bflags))
+-			break;
+-
+ 		num_copies = btrfs_num_copies(root->fs_info,
+ 					      eb->start, eb->len);
+ 		if (num_copies == 1)
+@@ -546,145 +539,6 @@ static int check_tree_block_fsid(struct btrfs_fs_info *fs_info,
+ 	return ret;
+ }
+ 
+-#define CORRUPT(reason, eb, root, slot)				\
+-	btrfs_crit(root->fs_info, "corrupt %s, %s: block=%llu,"	\
+-		   " root=%llu, slot=%d",			\
+-		   btrfs_header_level(eb) == 0 ? "leaf" : "node",\
+-		   reason, btrfs_header_bytenr(eb), root->objectid, slot)
+-
+-static noinline int check_leaf(struct btrfs_root *root,
+-			       struct extent_buffer *leaf)
+-{
+-	struct btrfs_key key;
+-	struct btrfs_key leaf_key;
+-	u32 nritems = btrfs_header_nritems(leaf);
+-	int slot;
+-
+-	/*
+-	 * Extent buffers from a relocation tree have a owner field that
+-	 * corresponds to the subvolume tree they are based on. So just from an
+-	 * extent buffer alone we can not find out what is the id of the
+-	 * corresponding subvolume tree, so we can not figure out if the extent
+-	 * buffer corresponds to the root of the relocation tree or not. So skip
+-	 * this check for relocation trees.
+-	 */
+-	if (nritems == 0 && !btrfs_header_flag(leaf, BTRFS_HEADER_FLAG_RELOC)) {
+-		struct btrfs_root *check_root;
+-
+-		key.objectid = btrfs_header_owner(leaf);
+-		key.type = BTRFS_ROOT_ITEM_KEY;
+-		key.offset = (u64)-1;
+-
+-		check_root = btrfs_get_fs_root(root->fs_info, &key, false);
+-		/*
+-		 * The only reason we also check NULL here is that during
+-		 * open_ctree() some roots has not yet been set up.
+-		 */
+-		if (!IS_ERR_OR_NULL(check_root)) {
+-			struct extent_buffer *eb;
+-
+-			eb = btrfs_root_node(check_root);
+-			/* if leaf is the root, then it's fine */
+-			if (leaf != eb) {
+-				CORRUPT("non-root leaf's nritems is 0",
+-					leaf, check_root, 0);
+-				free_extent_buffer(eb);
+-				return -EIO;
+-			}
+-			free_extent_buffer(eb);
+-		}
+-		return 0;
+-	}
+-
+-	if (nritems == 0)
+-		return 0;
+-
+-	/* Check the 0 item */
+-	if (btrfs_item_offset_nr(leaf, 0) + btrfs_item_size_nr(leaf, 0) !=
+-	    BTRFS_LEAF_DATA_SIZE(root)) {
+-		CORRUPT("invalid item offset size pair", leaf, root, 0);
+-		return -EIO;
+-	}
+-
+-	/*
+-	 * Check to make sure each items keys are in the correct order and their
+-	 * offsets make sense.  We only have to loop through nritems-1 because
+-	 * we check the current slot against the next slot, which verifies the
+-	 * next slot's offset+size makes sense and that the current's slot
+-	 * offset is correct.
+-	 */
+-	for (slot = 0; slot < nritems - 1; slot++) {
+-		btrfs_item_key_to_cpu(leaf, &leaf_key, slot);
+-		btrfs_item_key_to_cpu(leaf, &key, slot + 1);
+-
+-		/* Make sure the keys are in the right order */
+-		if (btrfs_comp_cpu_keys(&leaf_key, &key) >= 0) {
+-			CORRUPT("bad key order", leaf, root, slot);
+-			return -EIO;
+-		}
+-
+-		/*
+-		 * Make sure the offset and ends are right, remember that the
+-		 * item data starts at the end of the leaf and grows towards the
+-		 * front.
+-		 */
+-		if (btrfs_item_offset_nr(leaf, slot) !=
+-			btrfs_item_end_nr(leaf, slot + 1)) {
+-			CORRUPT("slot offset bad", leaf, root, slot);
+-			return -EIO;
+-		}
+-
+-		/*
+-		 * Check to make sure that we don't point outside of the leaf,
+-		 * just in case all the items are consistent to each other, but
+-		 * all point outside of the leaf.
+-		 */
+-		if (btrfs_item_end_nr(leaf, slot) >
+-		    BTRFS_LEAF_DATA_SIZE(root)) {
+-			CORRUPT("slot end outside of leaf", leaf, root, slot);
+-			return -EIO;
+-		}
+-	}
+-
+-	return 0;
+-}
+-
+-static int check_node(struct btrfs_root *root, struct extent_buffer *node)
+-{
+-	unsigned long nr = btrfs_header_nritems(node);
+-	struct btrfs_key key, next_key;
+-	int slot;
+-	u64 bytenr;
+-	int ret = 0;
+-
+-	if (nr == 0 || nr > BTRFS_NODEPTRS_PER_BLOCK(root)) {
+-		btrfs_crit(root->fs_info,
+-			   "corrupt node: block %llu root %llu nritems %lu",
+-			   node->start, root->objectid, nr);
+-		return -EIO;
+-	}
+-
+-	for (slot = 0; slot < nr - 1; slot++) {
+-		bytenr = btrfs_node_blockptr(node, slot);
+-		btrfs_node_key_to_cpu(node, &key, slot);
+-		btrfs_node_key_to_cpu(node, &next_key, slot + 1);
+-
+-		if (!bytenr) {
+-			CORRUPT("invalid item slot", node, root, slot);
+-			ret = -EIO;
+-			goto out;
+-		}
+-
+-		if (btrfs_comp_cpu_keys(&key, &next_key) >= 0) {
+-			CORRUPT("bad key order", node, root, slot);
+-			ret = -EIO;
+-			goto out;
+-		}
+-	}
+-out:
+-	return ret;
+-}
+-
+ static int btree_readpage_end_io_hook(struct btrfs_io_bio *io_bio,
+ 				      u64 phy_offset, struct page *page,
+ 				      u64 start, u64 end, int mirror)
+@@ -750,12 +604,12 @@ static int btree_readpage_end_io_hook(struct btrfs_io_bio *io_bio,
+ 	 * that we don't try and read the other copies of this block, just
+ 	 * return -EIO.
+ 	 */
+-	if (found_level == 0 && check_leaf(root, eb)) {
++	if (found_level == 0 && btrfs_check_leaf_full(root, eb)) {
+ 		set_bit(EXTENT_BUFFER_CORRUPT, &eb->bflags);
+ 		ret = -EIO;
+ 	}
+ 
+-	if (found_level > 0 && check_node(root, eb))
++	if (found_level > 0 && btrfs_check_node(root, eb))
+ 		ret = -EIO;
+ 
+ 	if (!ret)
+@@ -4086,7 +3940,13 @@ void btrfs_mark_buffer_dirty(struct extent_buffer *buf)
+ 				     buf->len,
+ 				     root->fs_info->dirty_metadata_batch);
+ #ifdef CONFIG_BTRFS_FS_CHECK_INTEGRITY
+-	if (btrfs_header_level(buf) == 0 && check_leaf(root, buf)) {
++	/*
++	 * Since btrfs_mark_buffer_dirty() can be called with item pointer set
++	 * but item data not updated.
++	 * So here we should only check item pointers, not item data.
++	 */
++	if (btrfs_header_level(buf) == 0 &&
++	    btrfs_check_leaf_relaxed(root, buf)) {
+ 		btrfs_print_leaf(root, buf);
+ 		ASSERT(0);
+ 	}
+diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
+index a775307f3b6b..7938c48c72ff 100644
+--- a/fs/btrfs/extent-tree.c
++++ b/fs/btrfs/extent-tree.c
+@@ -9896,6 +9896,8 @@ static int find_first_block_group(struct btrfs_root *root,
+ 	int ret = 0;
+ 	struct btrfs_key found_key;
+ 	struct extent_buffer *leaf;
++	struct btrfs_block_group_item bg;
++	u64 flags;
+ 	int slot;
+ 
+ 	ret = btrfs_search_slot(NULL, root, key, path, 0, 0);
+@@ -9930,8 +9932,32 @@ static int find_first_block_group(struct btrfs_root *root,
+ 			"logical %llu len %llu found bg but no related chunk",
+ 					  found_key.objectid, found_key.offset);
+ 				ret = -ENOENT;
++			} else if (em->start != found_key.objectid ||
++				   em->len != found_key.offset) {
++				btrfs_err(root->fs_info,
++		"block group %llu len %llu mismatch with chunk %llu len %llu",
++					  found_key.objectid, found_key.offset,
++					  em->start, em->len);
++				ret = -EUCLEAN;
+ 			} else {
+-				ret = 0;
++				read_extent_buffer(leaf, &bg,
++					btrfs_item_ptr_offset(leaf, slot),
++					sizeof(bg));
++				flags = btrfs_block_group_flags(&bg) &
++					BTRFS_BLOCK_GROUP_TYPE_MASK;
++
++				if (flags != (em->map_lookup->type &
++					      BTRFS_BLOCK_GROUP_TYPE_MASK)) {
++					btrfs_err(root->fs_info,
++"block group %llu len %llu type flags 0x%llx mismatch with chunk type flags 0x%llx",
++						found_key.objectid,
++						found_key.offset, flags,
++						(BTRFS_BLOCK_GROUP_TYPE_MASK &
++						 em->map_lookup->type));
++					ret = -EUCLEAN;
++				} else {
++					ret = 0;
++				}
+ 			}
+ 			free_extent_map(em);
+ 			goto out;
+@@ -10159,6 +10185,62 @@ btrfs_create_block_group_cache(struct btrfs_root *root, u64 start, u64 size)
+ 	return cache;
+ }
+ 
++
++/*
++ * Iterate all chunks and verify that each of them has the corresponding block
++ * group
++ */
++static int check_chunk_block_group_mappings(struct btrfs_fs_info *fs_info)
++{
++	struct btrfs_mapping_tree *map_tree = &fs_info->mapping_tree;
++	struct extent_map *em;
++	struct btrfs_block_group_cache *bg;
++	u64 start = 0;
++	int ret = 0;
++
++	while (1) {
++		read_lock(&map_tree->map_tree.lock);
++		/*
++		 * lookup_extent_mapping will return the first extent map
++		 * intersecting the range, so setting @len to 1 is enough to
++		 * get the first chunk.
++		 */
++		em = lookup_extent_mapping(&map_tree->map_tree, start, 1);
++		read_unlock(&map_tree->map_tree.lock);
++		if (!em)
++			break;
++
++		bg = btrfs_lookup_block_group(fs_info, em->start);
++		if (!bg) {
++			btrfs_err(fs_info,
++	"chunk start=%llu len=%llu doesn't have corresponding block group",
++				     em->start, em->len);
++			ret = -EUCLEAN;
++			free_extent_map(em);
++			break;
++		}
++		if (bg->key.objectid != em->start ||
++		    bg->key.offset != em->len ||
++		    (bg->flags & BTRFS_BLOCK_GROUP_TYPE_MASK) !=
++		    (em->map_lookup->type & BTRFS_BLOCK_GROUP_TYPE_MASK)) {
++			btrfs_err(fs_info,
++"chunk start=%llu len=%llu flags=0x%llx doesn't match block group start=%llu len=%llu flags=0x%llx",
++				em->start, em->len,
++				em->map_lookup->type & BTRFS_BLOCK_GROUP_TYPE_MASK,
++				bg->key.objectid, bg->key.offset,
++				bg->flags & BTRFS_BLOCK_GROUP_TYPE_MASK);
++			ret = -EUCLEAN;
++			free_extent_map(em);
++			btrfs_put_block_group(bg);
++			break;
++		}
++		start = em->start + em->len;
++		free_extent_map(em);
++		btrfs_put_block_group(bg);
++	}
++	return ret;
++}
++
+ int btrfs_read_block_groups(struct btrfs_root *root)
+ {
+ 	struct btrfs_path *path;
+@@ -10343,7 +10425,7 @@ int btrfs_read_block_groups(struct btrfs_root *root)
+ 	}
+ 
+ 	init_global_block_rsv(info);
+-	ret = 0;
++	ret = check_chunk_block_group_mappings(info);
+ error:
+ 	btrfs_free_path(path);
+ 	return ret;
+diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
+index 5feaef9bcbda..793d4d571d8d 100644
+--- a/fs/btrfs/extent_io.c
++++ b/fs/btrfs/extent_io.c
+@@ -5442,9 +5442,8 @@ unlock_exit:
+ 	return ret;
+ }
+ 
+-void read_extent_buffer(struct extent_buffer *eb, void *dstv,
+-			unsigned long start,
+-			unsigned long len)
++void read_extent_buffer(const struct extent_buffer *eb, void *dstv,
++			unsigned long start, unsigned long len)
+ {
+ 	size_t cur;
+ 	size_t offset;
+@@ -5473,9 +5472,9 @@ void read_extent_buffer(struct extent_buffer *eb, void *dstv,
+ 	}
+ }
+ 
+-int read_extent_buffer_to_user(struct extent_buffer *eb, void __user *dstv,
+-			unsigned long start,
+-			unsigned long len)
++int read_extent_buffer_to_user(const struct extent_buffer *eb,
++			       void __user *dstv,
++			       unsigned long start, unsigned long len)
+ {
+ 	size_t cur;
+ 	size_t offset;
+@@ -5515,10 +5514,10 @@ int read_extent_buffer_to_user(struct extent_buffer *eb, void __user *dstv,
+  * return 1 if the item spans two pages.
+  * return -EINVAL otherwise.
+  */
+-int map_private_extent_buffer(struct extent_buffer *eb, unsigned long start,
+-			       unsigned long min_len, char **map,
+-			       unsigned long *map_start,
+-			       unsigned long *map_len)
++int map_private_extent_buffer(const struct extent_buffer *eb,
++			      unsigned long start, unsigned long min_len,
++			      char **map, unsigned long *map_start,
++			      unsigned long *map_len)
+ {
+ 	size_t offset = start & (PAGE_SIZE - 1);
+ 	char *kaddr;
+@@ -5552,9 +5551,8 @@ int map_private_extent_buffer(struct extent_buffer *eb, unsigned long start,
+ 	return 0;
+ }
+ 
+-int memcmp_extent_buffer(struct extent_buffer *eb, const void *ptrv,
+-			  unsigned long start,
+-			  unsigned long len)
++int memcmp_extent_buffer(const struct extent_buffer *eb, const void *ptrv,
++			 unsigned long start, unsigned long len)
+ {
+ 	size_t cur;
+ 	size_t offset;
+diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
+index ab31d145227e..9ecdc9584df7 100644
+--- a/fs/btrfs/extent_io.h
++++ b/fs/btrfs/extent_io.h
+@@ -396,14 +396,13 @@ static inline void extent_buffer_get(struct extent_buffer *eb)
+ 	atomic_inc(&eb->refs);
+ }
+ 
+-int memcmp_extent_buffer(struct extent_buffer *eb, const void *ptrv,
+-			  unsigned long start,
+-			  unsigned long len);
+-void read_extent_buffer(struct extent_buffer *eb, void *dst,
++int memcmp_extent_buffer(const struct extent_buffer *eb, const void *ptrv,
++			 unsigned long start, unsigned long len);
++void read_extent_buffer(const struct extent_buffer *eb, void *dst,
+ 			unsigned long start,
+ 			unsigned long len);
+-int read_extent_buffer_to_user(struct extent_buffer *eb, void __user *dst,
+-			       unsigned long start,
++int read_extent_buffer_to_user(const struct extent_buffer *eb,
++			       void __user *dst, unsigned long start,
+ 			       unsigned long len);
+ void write_extent_buffer(struct extent_buffer *eb, const void *src,
+ 			 unsigned long start, unsigned long len);
+@@ -428,10 +427,10 @@ void set_extent_buffer_uptodate(struct extent_buffer *eb);
+ void clear_extent_buffer_uptodate(struct extent_buffer *eb);
+ int extent_buffer_uptodate(struct extent_buffer *eb);
+ int extent_buffer_under_io(struct extent_buffer *eb);
+-int map_private_extent_buffer(struct extent_buffer *eb, unsigned long offset,
+-		      unsigned long min_len, char **map,
+-		      unsigned long *map_start,
+-		      unsigned long *map_len);
++int map_private_extent_buffer(const struct extent_buffer *eb,
++			      unsigned long offset, unsigned long min_len,
++			      char **map, unsigned long *map_start,
++			      unsigned long *map_len);
+ void extent_range_clear_dirty_for_io(struct inode *inode, u64 start, u64 end);
+ void extent_range_redirty_for_io(struct inode *inode, u64 start, u64 end);
+ void extent_clear_unlock_delalloc(struct inode *inode, u64 start, u64 end,
+diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c
+index 5ca0dbb9074d..69a3c11af9d4 100644
+--- a/fs/btrfs/free-space-cache.c
++++ b/fs/btrfs/free-space-cache.c
+@@ -2464,6 +2464,7 @@ void btrfs_dump_free_space(struct btrfs_block_group_cache *block_group,
+ 	struct rb_node *n;
+ 	int count = 0;
+ 
++	spin_lock(&ctl->tree_lock);
+ 	for (n = rb_first(&ctl->free_space_offset); n; n = rb_next(n)) {
+ 		info = rb_entry(n, struct btrfs_free_space, offset_index);
+ 		if (info->bytes >= bytes && !block_group->ro)
+@@ -2473,6 +2474,7 @@ void btrfs_dump_free_space(struct btrfs_block_group_cache *block_group,
+ 			   info->offset, info->bytes,
+ 		       (info->bitmap) ? "yes" : "no");
+ 	}
++	spin_unlock(&ctl->tree_lock);
+ 	btrfs_info(block_group->fs_info, "block group has cluster?: %s",
+ 	       list_empty(&block_group->cluster_list) ? "no" : "yes");
+ 	btrfs_info(block_group->fs_info,
+diff --git a/fs/btrfs/struct-funcs.c b/fs/btrfs/struct-funcs.c
+index 875c757e73e2..5e2b92d83617 100644
+--- a/fs/btrfs/struct-funcs.c
++++ b/fs/btrfs/struct-funcs.c
+@@ -50,8 +50,8 @@ static inline void put_unaligned_le8(u8 val, void *p)
+  */
+ 
+ #define DEFINE_BTRFS_SETGET_BITS(bits)					\
+-u##bits btrfs_get_token_##bits(struct extent_buffer *eb, void *ptr,	\
+-			       unsigned long off,			\
++u##bits btrfs_get_token_##bits(const struct extent_buffer *eb,		\
++			       const void *ptr, unsigned long off,	\
+ 			       struct btrfs_map_token *token)		\
+ {									\
+ 	unsigned long part_offset = (unsigned long)ptr;			\
+@@ -90,7 +90,8 @@ u##bits btrfs_get_token_##bits(struct extent_buffer *eb, void *ptr,	\
+ 	return res;							\
+ }									\
+ void btrfs_set_token_##bits(struct extent_buffer *eb,			\
+-			    void *ptr, unsigned long off, u##bits val,	\
++			    const void *ptr, unsigned long off,		\
++			    u##bits val,				\
+ 			    struct btrfs_map_token *token)		\
+ {									\
+ 	unsigned long part_offset = (unsigned long)ptr;			\
+@@ -133,7 +134,7 @@ DEFINE_BTRFS_SETGET_BITS(16)
+ DEFINE_BTRFS_SETGET_BITS(32)
+ DEFINE_BTRFS_SETGET_BITS(64)
+ 
+-void btrfs_node_key(struct extent_buffer *eb,
++void btrfs_node_key(const struct extent_buffer *eb,
+ 		    struct btrfs_disk_key *disk_key, int nr)
+ {
+ 	unsigned long ptr = btrfs_node_key_ptr_offset(nr);
+diff --git a/fs/btrfs/tree-checker.c b/fs/btrfs/tree-checker.c
+new file mode 100644
+index 000000000000..7b69ba78e600
+--- /dev/null
++++ b/fs/btrfs/tree-checker.c
+@@ -0,0 +1,649 @@
++/*
++ * Copyright (C) Qu Wenruo 2017.  All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public
++ * License v2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public
++ * License along with this program.
++ */
++
++/*
++ * The module is used to catch unexpected/corrupted tree block data.
++ * Such behavior can be caused either by a fuzzed image or bugs.
++ *
++ * The objective is to do leaf/node validation checks when tree block is read
++ * from disk, and check *every* possible member, so other code won't
++ * need to checking them again.
++ *
++ * Due to the potential and unwanted damage, every checker needs to be
++ * carefully reviewed otherwise so it does not prevent mount of valid images.
++ */
++
++#include "ctree.h"
++#include "tree-checker.h"
++#include "disk-io.h"
++#include "compression.h"
++#include "hash.h"
++#include "volumes.h"
++
++#define CORRUPT(reason, eb, root, slot)					\
++	btrfs_crit(root->fs_info,					\
++		   "corrupt %s, %s: block=%llu, root=%llu, slot=%d",	\
++		   btrfs_header_level(eb) == 0 ? "leaf" : "node",	\
++		   reason, btrfs_header_bytenr(eb), root->objectid, slot)
++
++/*
++ * Error message should follow the following format:
++ * corrupt <type>: <identifier>, <reason>[, <bad_value>]
++ *
++ * @type:	leaf or node
++ * @identifier:	the necessary info to locate the leaf/node.
++ * 		It's recommened to decode key.objecitd/offset if it's
++ * 		meaningful.
++ * @reason:	describe the error
++ * @bad_value:	optional, it's recommened to output bad value and its
++ *		expected value (range).
++ *
++ * Since comma is used to separate the components, only space is allowed
++ * inside each component.
++ */
++
++/*
++ * Append generic "corrupt leaf/node root=%llu block=%llu slot=%d: " to @fmt.
++ * Allows callers to customize the output.
++ */
++__printf(4, 5)
++static void generic_err(const struct btrfs_root *root,
++			const struct extent_buffer *eb, int slot,
++			const char *fmt, ...)
++{
++	struct va_format vaf;
++	va_list args;
++
++	va_start(args, fmt);
++
++	vaf.fmt = fmt;
++	vaf.va = &args;
++
++	btrfs_crit(root->fs_info,
++		"corrupt %s: root=%llu block=%llu slot=%d, %pV",
++		btrfs_header_level(eb) == 0 ? "leaf" : "node",
++		root->objectid, btrfs_header_bytenr(eb), slot, &vaf);
++	va_end(args);
++}
++
++static int check_extent_data_item(struct btrfs_root *root,
++				  struct extent_buffer *leaf,
++				  struct btrfs_key *key, int slot)
++{
++	struct btrfs_file_extent_item *fi;
++	u32 sectorsize = root->sectorsize;
++	u32 item_size = btrfs_item_size_nr(leaf, slot);
++
++	if (!IS_ALIGNED(key->offset, sectorsize)) {
++		CORRUPT("unaligned key offset for file extent",
++			leaf, root, slot);
++		return -EUCLEAN;
++	}
++
++	fi = btrfs_item_ptr(leaf, slot, struct btrfs_file_extent_item);
++
++	if (btrfs_file_extent_type(leaf, fi) > BTRFS_FILE_EXTENT_TYPES) {
++		CORRUPT("invalid file extent type", leaf, root, slot);
++		return -EUCLEAN;
++	}
++
++	/*
++	 * Support for new compression/encrption must introduce incompat flag,
++	 * and must be caught in open_ctree().
++	 */
++	if (btrfs_file_extent_compression(leaf, fi) > BTRFS_COMPRESS_TYPES) {
++		CORRUPT("invalid file extent compression", leaf, root, slot);
++		return -EUCLEAN;
++	}
++	if (btrfs_file_extent_encryption(leaf, fi)) {
++		CORRUPT("invalid file extent encryption", leaf, root, slot);
++		return -EUCLEAN;
++	}
++	if (btrfs_file_extent_type(leaf, fi) == BTRFS_FILE_EXTENT_INLINE) {
++		/* Inline extent must have 0 as key offset */
++		if (key->offset) {
++			CORRUPT("inline extent has non-zero key offset",
++				leaf, root, slot);
++			return -EUCLEAN;
++		}
++
++		/* Compressed inline extent has no on-disk size, skip it */
++		if (btrfs_file_extent_compression(leaf, fi) !=
++		    BTRFS_COMPRESS_NONE)
++			return 0;
++
++		/* Uncompressed inline extent size must match item size */
++		if (item_size != BTRFS_FILE_EXTENT_INLINE_DATA_START +
++		    btrfs_file_extent_ram_bytes(leaf, fi)) {
++			CORRUPT("plaintext inline extent has invalid size",
++				leaf, root, slot);
++			return -EUCLEAN;
++		}
++		return 0;
++	}
++
++	/* Regular or preallocated extent has fixed item size */
++	if (item_size != sizeof(*fi)) {
++		CORRUPT(
++		"regluar or preallocated extent data item size is invalid",
++			leaf, root, slot);
++		return -EUCLEAN;
++	}
++	if (!IS_ALIGNED(btrfs_file_extent_ram_bytes(leaf, fi), sectorsize) ||
++	    !IS_ALIGNED(btrfs_file_extent_disk_bytenr(leaf, fi), sectorsize) ||
++	    !IS_ALIGNED(btrfs_file_extent_disk_num_bytes(leaf, fi), sectorsize) ||
++	    !IS_ALIGNED(btrfs_file_extent_offset(leaf, fi), sectorsize) ||
++	    !IS_ALIGNED(btrfs_file_extent_num_bytes(leaf, fi), sectorsize)) {
++		CORRUPT(
++		"regular or preallocated extent data item has unaligned value",
++			leaf, root, slot);
++		return -EUCLEAN;
++	}
++
++	return 0;
++}
++
++static int check_csum_item(struct btrfs_root *root, struct extent_buffer *leaf,
++			   struct btrfs_key *key, int slot)
++{
++	u32 sectorsize = root->sectorsize;
++	u32 csumsize = btrfs_super_csum_size(root->fs_info->super_copy);
++
++	if (key->objectid != BTRFS_EXTENT_CSUM_OBJECTID) {
++		CORRUPT("invalid objectid for csum item", leaf, root, slot);
++		return -EUCLEAN;
++	}
++	if (!IS_ALIGNED(key->offset, sectorsize)) {
++		CORRUPT("unaligned key offset for csum item", leaf, root, slot);
++		return -EUCLEAN;
++	}
++	if (!IS_ALIGNED(btrfs_item_size_nr(leaf, slot), csumsize)) {
++		CORRUPT("unaligned csum item size", leaf, root, slot);
++		return -EUCLEAN;
++	}
++	return 0;
++}
++
++/*
++ * Customized reported for dir_item, only important new info is key->objectid,
++ * which represents inode number
++ */
++__printf(4, 5)
++static void dir_item_err(const struct btrfs_root *root,
++			 const struct extent_buffer *eb, int slot,
++			 const char *fmt, ...)
++{
++	struct btrfs_key key;
++	struct va_format vaf;
++	va_list args;
++
++	btrfs_item_key_to_cpu(eb, &key, slot);
++	va_start(args, fmt);
++
++	vaf.fmt = fmt;
++	vaf.va = &args;
++
++	btrfs_crit(root->fs_info,
++	"corrupt %s: root=%llu block=%llu slot=%d ino=%llu, %pV",
++		btrfs_header_level(eb) == 0 ? "leaf" : "node", root->objectid,
++		btrfs_header_bytenr(eb), slot, key.objectid, &vaf);
++	va_end(args);
++}
++
++static int check_dir_item(struct btrfs_root *root,
++			  struct extent_buffer *leaf,
++			  struct btrfs_key *key, int slot)
++{
++	struct btrfs_dir_item *di;
++	u32 item_size = btrfs_item_size_nr(leaf, slot);
++	u32 cur = 0;
++
++	di = btrfs_item_ptr(leaf, slot, struct btrfs_dir_item);
++	while (cur < item_size) {
++		u32 name_len;
++		u32 data_len;
++		u32 max_name_len;
++		u32 total_size;
++		u32 name_hash;
++		u8 dir_type;
++
++		/* header itself should not cross item boundary */
++		if (cur + sizeof(*di) > item_size) {
++			dir_item_err(root, leaf, slot,
++		"dir item header crosses item boundary, have %zu boundary %u",
++				cur + sizeof(*di), item_size);
++			return -EUCLEAN;
++		}
++
++		/* dir type check */
++		dir_type = btrfs_dir_type(leaf, di);
++		if (dir_type >= BTRFS_FT_MAX) {
++			dir_item_err(root, leaf, slot,
++			"invalid dir item type, have %u expect [0, %u)",
++				dir_type, BTRFS_FT_MAX);
++			return -EUCLEAN;
++		}
++
++		if (key->type == BTRFS_XATTR_ITEM_KEY &&
++		    dir_type != BTRFS_FT_XATTR) {
++			dir_item_err(root, leaf, slot,
++		"invalid dir item type for XATTR key, have %u expect %u",
++				dir_type, BTRFS_FT_XATTR);
++			return -EUCLEAN;
++		}
++		if (dir_type == BTRFS_FT_XATTR &&
++		    key->type != BTRFS_XATTR_ITEM_KEY) {
++			dir_item_err(root, leaf, slot,
++			"xattr dir type found for non-XATTR key");
++			return -EUCLEAN;
++		}
++		if (dir_type == BTRFS_FT_XATTR)
++			max_name_len = XATTR_NAME_MAX;
++		else
++			max_name_len = BTRFS_NAME_LEN;
++
++		/* Name/data length check */
++		name_len = btrfs_dir_name_len(leaf, di);
++		data_len = btrfs_dir_data_len(leaf, di);
++		if (name_len > max_name_len) {
++			dir_item_err(root, leaf, slot,
++			"dir item name len too long, have %u max %u",
++				name_len, max_name_len);
++			return -EUCLEAN;
++		}
++		if (name_len + data_len > BTRFS_MAX_XATTR_SIZE(root)) {
++			dir_item_err(root, leaf, slot,
++			"dir item name and data len too long, have %u max %u",
++				name_len + data_len,
++				BTRFS_MAX_XATTR_SIZE(root));
++			return -EUCLEAN;
++		}
++
++		if (data_len && dir_type != BTRFS_FT_XATTR) {
++			dir_item_err(root, leaf, slot,
++			"dir item with invalid data len, have %u expect 0",
++				data_len);
++			return -EUCLEAN;
++		}
++
++		total_size = sizeof(*di) + name_len + data_len;
++
++		/* header and name/data should not cross item boundary */
++		if (cur + total_size > item_size) {
++			dir_item_err(root, leaf, slot,
++		"dir item data crosses item boundary, have %u boundary %u",
++				cur + total_size, item_size);
++			return -EUCLEAN;
++		}
++
++		/*
++		 * Special check for XATTR/DIR_ITEM, as key->offset is name
++		 * hash, should match its name
++		 */
++		if (key->type == BTRFS_DIR_ITEM_KEY ||
++		    key->type == BTRFS_XATTR_ITEM_KEY) {
++			char namebuf[max(BTRFS_NAME_LEN, XATTR_NAME_MAX)];
++
++			read_extent_buffer(leaf, namebuf,
++					(unsigned long)(di + 1), name_len);
++			name_hash = btrfs_name_hash(namebuf, name_len);
++			if (key->offset != name_hash) {
++				dir_item_err(root, leaf, slot,
++		"name hash mismatch with key, have 0x%016x expect 0x%016llx",
++					name_hash, key->offset);
++				return -EUCLEAN;
++			}
++		}
++		cur += total_size;
++		di = (struct btrfs_dir_item *)((void *)di + total_size);
++	}
++	return 0;
++}
++
++__printf(4, 5)
++__cold
++static void block_group_err(const struct btrfs_fs_info *fs_info,
++			    const struct extent_buffer *eb, int slot,
++			    const char *fmt, ...)
++{
++	struct btrfs_key key;
++	struct va_format vaf;
++	va_list args;
++
++	btrfs_item_key_to_cpu(eb, &key, slot);
++	va_start(args, fmt);
++
++	vaf.fmt = fmt;
++	vaf.va = &args;
++
++	btrfs_crit(fs_info,
++	"corrupt %s: root=%llu block=%llu slot=%d bg_start=%llu bg_len=%llu, %pV",
++		btrfs_header_level(eb) == 0 ? "leaf" : "node",
++		btrfs_header_owner(eb), btrfs_header_bytenr(eb), slot,
++		key.objectid, key.offset, &vaf);
++	va_end(args);
++}
++
++static int check_block_group_item(struct btrfs_fs_info *fs_info,
++				  struct extent_buffer *leaf,
++				  struct btrfs_key *key, int slot)
++{
++	struct btrfs_block_group_item bgi;
++	u32 item_size = btrfs_item_size_nr(leaf, slot);
++	u64 flags;
++	u64 type;
++
++	/*
++	 * Here we don't really care about alignment since extent allocator can
++	 * handle it.  We care more about the size, as if one block group is
++	 * larger than maximum size, it's must be some obvious corruption.
++	 */
++	if (key->offset > BTRFS_MAX_DATA_CHUNK_SIZE || key->offset == 0) {
++		block_group_err(fs_info, leaf, slot,
++			"invalid block group size, have %llu expect (0, %llu]",
++				key->offset, BTRFS_MAX_DATA_CHUNK_SIZE);
++		return -EUCLEAN;
++	}
++
++	if (item_size != sizeof(bgi)) {
++		block_group_err(fs_info, leaf, slot,
++			"invalid item size, have %u expect %zu",
++				item_size, sizeof(bgi));
++		return -EUCLEAN;
++	}
++
++	read_extent_buffer(leaf, &bgi, btrfs_item_ptr_offset(leaf, slot),
++			   sizeof(bgi));
++	if (btrfs_block_group_chunk_objectid(&bgi) !=
++	    BTRFS_FIRST_CHUNK_TREE_OBJECTID) {
++		block_group_err(fs_info, leaf, slot,
++		"invalid block group chunk objectid, have %llu expect %llu",
++				btrfs_block_group_chunk_objectid(&bgi),
++				BTRFS_FIRST_CHUNK_TREE_OBJECTID);
++		return -EUCLEAN;
++	}
++
++	if (btrfs_block_group_used(&bgi) > key->offset) {
++		block_group_err(fs_info, leaf, slot,
++			"invalid block group used, have %llu expect [0, %llu)",
++				btrfs_block_group_used(&bgi), key->offset);
++		return -EUCLEAN;
++	}
++
++	flags = btrfs_block_group_flags(&bgi);
++	if (hweight64(flags & BTRFS_BLOCK_GROUP_PROFILE_MASK) > 1) {
++		block_group_err(fs_info, leaf, slot,
++"invalid profile flags, have 0x%llx (%lu bits set) expect no more than 1 bit set",
++			flags & BTRFS_BLOCK_GROUP_PROFILE_MASK,
++			hweight64(flags & BTRFS_BLOCK_GROUP_PROFILE_MASK));
++		return -EUCLEAN;
++	}
++
++	type = flags & BTRFS_BLOCK_GROUP_TYPE_MASK;
++	if (type != BTRFS_BLOCK_GROUP_DATA &&
++	    type != BTRFS_BLOCK_GROUP_METADATA &&
++	    type != BTRFS_BLOCK_GROUP_SYSTEM &&
++	    type != (BTRFS_BLOCK_GROUP_METADATA |
++			   BTRFS_BLOCK_GROUP_DATA)) {
++		block_group_err(fs_info, leaf, slot,
++"invalid type, have 0x%llx (%lu bits set) expect either 0x%llx, 0x%llx, 0x%llx or 0x%llx",
++			type, hweight64(type),
++			BTRFS_BLOCK_GROUP_DATA, BTRFS_BLOCK_GROUP_METADATA,
++			BTRFS_BLOCK_GROUP_SYSTEM,
++			BTRFS_BLOCK_GROUP_METADATA | BTRFS_BLOCK_GROUP_DATA);
++		return -EUCLEAN;
++	}
++	return 0;
++}
++
++/*
++ * Common point to switch the item-specific validation.
++ */
++static int check_leaf_item(struct btrfs_root *root,
++			   struct extent_buffer *leaf,
++			   struct btrfs_key *key, int slot)
++{
++	int ret = 0;
++
++	switch (key->type) {
++	case BTRFS_EXTENT_DATA_KEY:
++		ret = check_extent_data_item(root, leaf, key, slot);
++		break;
++	case BTRFS_EXTENT_CSUM_KEY:
++		ret = check_csum_item(root, leaf, key, slot);
++		break;
++	case BTRFS_DIR_ITEM_KEY:
++	case BTRFS_DIR_INDEX_KEY:
++	case BTRFS_XATTR_ITEM_KEY:
++		ret = check_dir_item(root, leaf, key, slot);
++		break;
++	case BTRFS_BLOCK_GROUP_ITEM_KEY:
++		ret = check_block_group_item(root->fs_info, leaf, key, slot);
++		break;
++	}
++	return ret;
++}
++
++static int check_leaf(struct btrfs_root *root, struct extent_buffer *leaf,
++		      bool check_item_data)
++{
++	struct btrfs_fs_info *fs_info = root->fs_info;
++	/* No valid key type is 0, so all key should be larger than this key */
++	struct btrfs_key prev_key = {0, 0, 0};
++	struct btrfs_key key;
++	u32 nritems = btrfs_header_nritems(leaf);
++	int slot;
++
++	if (btrfs_header_level(leaf) != 0) {
++		generic_err(root, leaf, 0,
++			"invalid level for leaf, have %d expect 0",
++			btrfs_header_level(leaf));
++		return -EUCLEAN;
++	}
++
++	/*
++	 * Extent buffers from a relocation tree have a owner field that
++	 * corresponds to the subvolume tree they are based on. So just from an
++	 * extent buffer alone we can not find out what is the id of the
++	 * corresponding subvolume tree, so we can not figure out if the extent
++	 * buffer corresponds to the root of the relocation tree or not. So
++	 * skip this check for relocation trees.
++	 */
++	if (nritems == 0 && !btrfs_header_flag(leaf, BTRFS_HEADER_FLAG_RELOC)) {
++		u64 owner = btrfs_header_owner(leaf);
++		struct btrfs_root *check_root;
++
++		/* These trees must never be empty */
++		if (owner == BTRFS_ROOT_TREE_OBJECTID ||
++		    owner == BTRFS_CHUNK_TREE_OBJECTID ||
++		    owner == BTRFS_EXTENT_TREE_OBJECTID ||
++		    owner == BTRFS_DEV_TREE_OBJECTID ||
++		    owner == BTRFS_FS_TREE_OBJECTID ||
++		    owner == BTRFS_DATA_RELOC_TREE_OBJECTID) {
++			generic_err(root, leaf, 0,
++			"invalid root, root %llu must never be empty",
++				    owner);
++			return -EUCLEAN;
++		}
++		key.objectid = owner;
++		key.type = BTRFS_ROOT_ITEM_KEY;
++		key.offset = (u64)-1;
++
++		check_root = btrfs_get_fs_root(fs_info, &key, false);
++		/*
++		 * The only reason we also check NULL here is that during
++		 * open_ctree() some roots has not yet been set up.
++		 */
++		if (!IS_ERR_OR_NULL(check_root)) {
++			struct extent_buffer *eb;
++
++			eb = btrfs_root_node(check_root);
++			/* if leaf is the root, then it's fine */
++			if (leaf != eb) {
++				CORRUPT("non-root leaf's nritems is 0",
++					leaf, check_root, 0);
++				free_extent_buffer(eb);
++				return -EUCLEAN;
++			}
++			free_extent_buffer(eb);
++		}
++		return 0;
++	}
++
++	if (nritems == 0)
++		return 0;
++
++	/*
++	 * Check the following things to make sure this is a good leaf, and
++	 * leaf users won't need to bother with similar sanity checks:
++	 *
++	 * 1) key ordering
++	 * 2) item offset and size
++	 *    No overlap, no hole, all inside the leaf.
++	 * 3) item content
++	 *    If possible, do comprehensive sanity check.
++	 *    NOTE: All checks must only rely on the item data itself.
++	 */
++	for (slot = 0; slot < nritems; slot++) {
++		u32 item_end_expected;
++		int ret;
++
++		btrfs_item_key_to_cpu(leaf, &key, slot);
++
++		/* Make sure the keys are in the right order */
++		if (btrfs_comp_cpu_keys(&prev_key, &key) >= 0) {
++			CORRUPT("bad key order", leaf, root, slot);
++			return -EUCLEAN;
++		}
++
++		/*
++		 * Make sure the offset and ends are right, remember that the
++		 * item data starts at the end of the leaf and grows towards the
++		 * front.
++		 */
++		if (slot == 0)
++			item_end_expected = BTRFS_LEAF_DATA_SIZE(root);
++		else
++			item_end_expected = btrfs_item_offset_nr(leaf,
++								 slot - 1);
++		if (btrfs_item_end_nr(leaf, slot) != item_end_expected) {
++			CORRUPT("slot offset bad", leaf, root, slot);
++			return -EUCLEAN;
++		}
++
++		/*
++		 * Check to make sure that we don't point outside of the leaf,
++		 * just in case all the items are consistent to each other, but
++		 * all point outside of the leaf.
++		 */
++		if (btrfs_item_end_nr(leaf, slot) >
++		    BTRFS_LEAF_DATA_SIZE(root)) {
++			CORRUPT("slot end outside of leaf", leaf, root, slot);
++			return -EUCLEAN;
++		}
++
++		/* Also check if the item pointer overlaps with btrfs item. */
++		if (btrfs_item_nr_offset(slot) + sizeof(struct btrfs_item) >
++		    btrfs_item_ptr_offset(leaf, slot)) {
++			CORRUPT("slot overlap with its data", leaf, root, slot);
++			return -EUCLEAN;
++		}
++
++		if (check_item_data) {
++			/*
++			 * Check if the item size and content meet other
++			 * criteria
++			 */
++			ret = check_leaf_item(root, leaf, &key, slot);
++			if (ret < 0)
++				return ret;
++		}
++
++		prev_key.objectid = key.objectid;
++		prev_key.type = key.type;
++		prev_key.offset = key.offset;
++	}
++
++	return 0;
++}
++
++int btrfs_check_leaf_full(struct btrfs_root *root, struct extent_buffer *leaf)
++{
++	return check_leaf(root, leaf, true);
++}
++
++int btrfs_check_leaf_relaxed(struct btrfs_root *root,
++			     struct extent_buffer *leaf)
++{
++	return check_leaf(root, leaf, false);
++}
++
++int btrfs_check_node(struct btrfs_root *root, struct extent_buffer *node)
++{
++	unsigned long nr = btrfs_header_nritems(node);
++	struct btrfs_key key, next_key;
++	int slot;
++	int level = btrfs_header_level(node);
++	u64 bytenr;
++	int ret = 0;
++
++	if (level <= 0 || level >= BTRFS_MAX_LEVEL) {
++		generic_err(root, node, 0,
++			"invalid level for node, have %d expect [1, %d]",
++			level, BTRFS_MAX_LEVEL - 1);
++		return -EUCLEAN;
++	}
++	if (nr == 0 || nr > BTRFS_NODEPTRS_PER_BLOCK(root)) {
++		btrfs_crit(root->fs_info,
++"corrupt node: root=%llu block=%llu, nritems too %s, have %lu expect range [1,%u]",
++			   root->objectid, node->start,
++			   nr == 0 ? "small" : "large", nr,
++			   BTRFS_NODEPTRS_PER_BLOCK(root));
++		return -EUCLEAN;
++	}
++
++	for (slot = 0; slot < nr - 1; slot++) {
++		bytenr = btrfs_node_blockptr(node, slot);
++		btrfs_node_key_to_cpu(node, &key, slot);
++		btrfs_node_key_to_cpu(node, &next_key, slot + 1);
++
++		if (!bytenr) {
++			generic_err(root, node, slot,
++				"invalid NULL node pointer");
++			ret = -EUCLEAN;
++			goto out;
++		}
++		if (!IS_ALIGNED(bytenr, root->sectorsize)) {
++			generic_err(root, node, slot,
++			"unaligned pointer, have %llu should be aligned to %u",
++				bytenr, root->sectorsize);
++			ret = -EUCLEAN;
++			goto out;
++		}
++
++		if (btrfs_comp_cpu_keys(&key, &next_key) >= 0) {
++			generic_err(root, node, slot,
++	"bad key order, current (%llu %u %llu) next (%llu %u %llu)",
++				key.objectid, key.type, key.offset,
++				next_key.objectid, next_key.type,
++				next_key.offset);
++			ret = -EUCLEAN;
++			goto out;
++		}
++	}
++out:
++	return ret;
++}
+diff --git a/fs/btrfs/tree-checker.h b/fs/btrfs/tree-checker.h
+new file mode 100644
+index 000000000000..3d53e8d6fda0
+--- /dev/null
++++ b/fs/btrfs/tree-checker.h
+@@ -0,0 +1,38 @@
++/*
++ * Copyright (C) Qu Wenruo 2017.  All rights reserved.
++ *
++ * This program is free software; you can redistribute it and/or
++ * modify it under the terms of the GNU General Public
++ * License v2 as published by the Free Software Foundation.
++ *
++ * This program is distributed in the hope that it will be useful,
++ * but WITHOUT ANY WARRANTY; without even the implied warranty of
++ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the GNU
++ * General Public License for more details.
++ *
++ * You should have received a copy of the GNU General Public
++ * License along with this program.
++ */
++
++#ifndef __BTRFS_TREE_CHECKER__
++#define __BTRFS_TREE_CHECKER__
++
++#include "ctree.h"
++#include "extent_io.h"
++
++/*
++ * Comprehensive leaf checker.
++ * Will check not only the item pointers, but also every possible member
++ * in item data.
++ */
++int btrfs_check_leaf_full(struct btrfs_root *root, struct extent_buffer *leaf);
++
++/*
++ * Less strict leaf checker.
++ * Will only check item pointers, not reading item data.
++ */
++int btrfs_check_leaf_relaxed(struct btrfs_root *root,
++			     struct extent_buffer *leaf);
++int btrfs_check_node(struct btrfs_root *root, struct extent_buffer *node);
++
++#endif
+diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
+index 76017e1b3c0f..5aa2749eaf42 100644
+--- a/fs/btrfs/volumes.c
++++ b/fs/btrfs/volumes.c
+@@ -4656,7 +4656,7 @@ static int __btrfs_alloc_chunk(struct btrfs_trans_handle *trans,
+ 
+ 	if (type & BTRFS_BLOCK_GROUP_DATA) {
+ 		max_stripe_size = SZ_1G;
+-		max_chunk_size = 10 * max_stripe_size;
++		max_chunk_size = BTRFS_MAX_DATA_CHUNK_SIZE;
+ 		if (!devs_max)
+ 			devs_max = BTRFS_MAX_DEVS(info->chunk_root);
+ 	} else if (type & BTRFS_BLOCK_GROUP_METADATA) {
+@@ -6370,6 +6370,8 @@ static int btrfs_check_chunk_valid(struct btrfs_root *root,
+ 	u16 num_stripes;
+ 	u16 sub_stripes;
+ 	u64 type;
++	u64 features;
++	bool mixed = false;
+ 
+ 	length = btrfs_chunk_length(leaf, chunk);
+ 	stripe_len = btrfs_chunk_stripe_len(leaf, chunk);
+@@ -6410,6 +6412,32 @@ static int btrfs_check_chunk_valid(struct btrfs_root *root,
+ 			  btrfs_chunk_type(leaf, chunk));
+ 		return -EIO;
+ 	}
++
++	if ((type & BTRFS_BLOCK_GROUP_TYPE_MASK) == 0) {
++		btrfs_err(root->fs_info, "missing chunk type flag: 0x%llx", type);
++		return -EIO;
++	}
++
++	if ((type & BTRFS_BLOCK_GROUP_SYSTEM) &&
++	    (type & (BTRFS_BLOCK_GROUP_METADATA | BTRFS_BLOCK_GROUP_DATA))) {
++		btrfs_err(root->fs_info,
++			"system chunk with data or metadata type: 0x%llx", type);
++		return -EIO;
++	}
++
++	features = btrfs_super_incompat_flags(root->fs_info->super_copy);
++	if (features & BTRFS_FEATURE_INCOMPAT_MIXED_GROUPS)
++		mixed = true;
++
++	if (!mixed) {
++		if ((type & BTRFS_BLOCK_GROUP_METADATA) &&
++		    (type & BTRFS_BLOCK_GROUP_DATA)) {
++			btrfs_err(root->fs_info,
++			"mixed chunk type in non-mixed mode: 0x%llx", type);
++			return -EIO;
++		}
++	}
++
+ 	if ((type & BTRFS_BLOCK_GROUP_RAID10 && sub_stripes != 2) ||
+ 	    (type & BTRFS_BLOCK_GROUP_RAID1 && num_stripes < 1) ||
+ 	    (type & BTRFS_BLOCK_GROUP_RAID5 && num_stripes < 2) ||
+diff --git a/fs/btrfs/volumes.h b/fs/btrfs/volumes.h
+index 09ed29c67848..9c09aa29d6bd 100644
+--- a/fs/btrfs/volumes.h
++++ b/fs/btrfs/volumes.h
+@@ -24,6 +24,8 @@
+ #include <linux/btrfs.h>
+ #include "async-thread.h"
+ 
++#define BTRFS_MAX_DATA_CHUNK_SIZE	(10ULL * SZ_1G)
++
+ extern struct mutex uuid_mutex;
+ 
+ #define BTRFS_STRIPE_LEN	SZ_64K
+diff --git a/fs/ceph/mds_client.c b/fs/ceph/mds_client.c
+index 3d2639c30018..6cbd0d805c9d 100644
+--- a/fs/ceph/mds_client.c
++++ b/fs/ceph/mds_client.c
+@@ -3983,14 +3983,24 @@ static struct ceph_auth_handshake *get_authorizer(struct ceph_connection *con,
+ 	return auth;
+ }
+ 
++static int add_authorizer_challenge(struct ceph_connection *con,
++				    void *challenge_buf, int challenge_buf_len)
++{
++	struct ceph_mds_session *s = con->private;
++	struct ceph_mds_client *mdsc = s->s_mdsc;
++	struct ceph_auth_client *ac = mdsc->fsc->client->monc.auth;
++
++	return ceph_auth_add_authorizer_challenge(ac, s->s_auth.authorizer,
++					    challenge_buf, challenge_buf_len);
++}
+ 
+-static int verify_authorizer_reply(struct ceph_connection *con, int len)
++static int verify_authorizer_reply(struct ceph_connection *con)
+ {
+ 	struct ceph_mds_session *s = con->private;
+ 	struct ceph_mds_client *mdsc = s->s_mdsc;
+ 	struct ceph_auth_client *ac = mdsc->fsc->client->monc.auth;
+ 
+-	return ceph_auth_verify_authorizer_reply(ac, s->s_auth.authorizer, len);
++	return ceph_auth_verify_authorizer_reply(ac, s->s_auth.authorizer);
+ }
+ 
+ static int invalidate_authorizer(struct ceph_connection *con)
+@@ -4046,6 +4056,7 @@ static const struct ceph_connection_operations mds_con_ops = {
+ 	.put = con_put,
+ 	.dispatch = dispatch,
+ 	.get_authorizer = get_authorizer,
++	.add_authorizer_challenge = add_authorizer_challenge,
+ 	.verify_authorizer_reply = verify_authorizer_reply,
+ 	.invalidate_authorizer = invalidate_authorizer,
+ 	.peer_reset = peer_reset,
+diff --git a/fs/f2fs/checkpoint.c b/fs/f2fs/checkpoint.c
+index aee2a066a446..0b061bbf1639 100644
+--- a/fs/f2fs/checkpoint.c
++++ b/fs/f2fs/checkpoint.c
+@@ -69,6 +69,7 @@ static struct page *__get_meta_page(struct f2fs_sb_info *sbi, pgoff_t index,
+ 		.old_blkaddr = index,
+ 		.new_blkaddr = index,
+ 		.encrypted_page = NULL,
++		.is_meta = is_meta,
+ 	};
+ 
+ 	if (unlikely(!is_meta))
+@@ -85,8 +86,10 @@ repeat:
+ 	fio.page = page;
+ 
+ 	if (f2fs_submit_page_bio(&fio)) {
+-		f2fs_put_page(page, 1);
+-		goto repeat;
++		memset(page_address(page), 0, PAGE_SIZE);
++		f2fs_stop_checkpoint(sbi, false);
++		f2fs_bug_on(sbi, 1);
++		return page;
+ 	}
+ 
+ 	lock_page(page);
+@@ -117,7 +120,8 @@ struct page *get_tmp_page(struct f2fs_sb_info *sbi, pgoff_t index)
+ 	return __get_meta_page(sbi, index, false);
+ }
+ 
+-bool is_valid_blkaddr(struct f2fs_sb_info *sbi, block_t blkaddr, int type)
++bool f2fs_is_valid_blkaddr(struct f2fs_sb_info *sbi,
++					block_t blkaddr, int type)
+ {
+ 	switch (type) {
+ 	case META_NAT:
+@@ -137,8 +141,20 @@ bool is_valid_blkaddr(struct f2fs_sb_info *sbi, block_t blkaddr, int type)
+ 			return false;
+ 		break;
+ 	case META_POR:
++	case DATA_GENERIC:
+ 		if (unlikely(blkaddr >= MAX_BLKADDR(sbi) ||
+-			blkaddr < MAIN_BLKADDR(sbi)))
++			blkaddr < MAIN_BLKADDR(sbi))) {
++			if (type == DATA_GENERIC) {
++				f2fs_msg(sbi->sb, KERN_WARNING,
++					"access invalid blkaddr:%u", blkaddr);
++				WARN_ON(1);
++			}
++			return false;
++		}
++		break;
++	case META_GENERIC:
++		if (unlikely(blkaddr < SEG0_BLKADDR(sbi) ||
++			blkaddr >= MAIN_BLKADDR(sbi)))
+ 			return false;
+ 		break;
+ 	default:
+@@ -162,6 +178,7 @@ int ra_meta_pages(struct f2fs_sb_info *sbi, block_t start, int nrpages,
+ 		.op = REQ_OP_READ,
+ 		.op_flags = sync ? (READ_SYNC | REQ_META | REQ_PRIO) : REQ_RAHEAD,
+ 		.encrypted_page = NULL,
++		.is_meta = (type != META_POR),
+ 	};
+ 	struct blk_plug plug;
+ 
+@@ -171,7 +188,7 @@ int ra_meta_pages(struct f2fs_sb_info *sbi, block_t start, int nrpages,
+ 	blk_start_plug(&plug);
+ 	for (; nrpages-- > 0; blkno++) {
+ 
+-		if (!is_valid_blkaddr(sbi, blkno, type))
++		if (!f2fs_is_valid_blkaddr(sbi, blkno, type))
+ 			goto out;
+ 
+ 		switch (type) {
+@@ -706,6 +723,14 @@ static struct page *validate_checkpoint(struct f2fs_sb_info *sbi,
+ 					&cp_page_1, version);
+ 	if (err)
+ 		return NULL;
++
++	if (le32_to_cpu(cp_block->cp_pack_total_block_count) >
++					sbi->blocks_per_seg) {
++		f2fs_msg(sbi->sb, KERN_WARNING,
++			"invalid cp_pack_total_block_count:%u",
++			le32_to_cpu(cp_block->cp_pack_total_block_count));
++		goto invalid_cp;
++	}
+ 	pre_version = *version;
+ 
+ 	cp_addr += le32_to_cpu(cp_block->cp_pack_total_block_count) - 1;
+@@ -769,15 +794,15 @@ int get_valid_checkpoint(struct f2fs_sb_info *sbi)
+ 	cp_block = (struct f2fs_checkpoint *)page_address(cur_page);
+ 	memcpy(sbi->ckpt, cp_block, blk_size);
+ 
+-	/* Sanity checking of checkpoint */
+-	if (sanity_check_ckpt(sbi))
+-		goto fail_no_cp;
+-
+ 	if (cur_page == cp1)
+ 		sbi->cur_cp_pack = 1;
+ 	else
+ 		sbi->cur_cp_pack = 2;
+ 
++	/* Sanity checking of checkpoint */
++	if (sanity_check_ckpt(sbi))
++		goto free_fail_no_cp;
++
+ 	if (cp_blks <= 1)
+ 		goto done;
+ 
+@@ -799,6 +824,9 @@ done:
+ 	f2fs_put_page(cp2, 1);
+ 	return 0;
+ 
++free_fail_no_cp:
++	f2fs_put_page(cp1, 1);
++	f2fs_put_page(cp2, 1);
+ fail_no_cp:
+ 	kfree(sbi->ckpt);
+ 	return -EINVAL;
+diff --git a/fs/f2fs/data.c b/fs/f2fs/data.c
+index ae354ac67da1..9041805096e0 100644
+--- a/fs/f2fs/data.c
++++ b/fs/f2fs/data.c
+@@ -240,6 +240,10 @@ int f2fs_submit_page_bio(struct f2fs_io_info *fio)
+ 	struct page *page = fio->encrypted_page ?
+ 			fio->encrypted_page : fio->page;
+ 
++	if (!f2fs_is_valid_blkaddr(fio->sbi, fio->new_blkaddr,
++			__is_meta_io(fio) ? META_GENERIC : DATA_GENERIC))
++		return -EFAULT;
++
+ 	trace_f2fs_submit_page_bio(page, fio);
+ 	f2fs_trace_ios(fio, 0);
+ 
+@@ -266,9 +270,9 @@ void f2fs_submit_page_mbio(struct f2fs_io_info *fio)
+ 
+ 	io = is_read ? &sbi->read_io : &sbi->write_io[btype];
+ 
+-	if (fio->old_blkaddr != NEW_ADDR)
+-		verify_block_addr(sbi, fio->old_blkaddr);
+-	verify_block_addr(sbi, fio->new_blkaddr);
++	if (__is_valid_data_blkaddr(fio->old_blkaddr))
++		verify_block_addr(fio, fio->old_blkaddr);
++	verify_block_addr(fio, fio->new_blkaddr);
+ 
+ 	down_write(&io->io_rwsem);
+ 
+@@ -722,7 +726,13 @@ next_dnode:
+ next_block:
+ 	blkaddr = datablock_addr(dn.node_page, dn.ofs_in_node);
+ 
+-	if (blkaddr == NEW_ADDR || blkaddr == NULL_ADDR) {
++	if (__is_valid_data_blkaddr(blkaddr) &&
++		!f2fs_is_valid_blkaddr(sbi, blkaddr, DATA_GENERIC)) {
++		err = -EFAULT;
++		goto sync_out;
++	}
++
++	if (!is_valid_data_blkaddr(sbi, blkaddr)) {
+ 		if (create) {
+ 			if (unlikely(f2fs_cp_error(sbi))) {
+ 				err = -EIO;
+@@ -985,6 +995,9 @@ static struct bio *f2fs_grab_bio(struct inode *inode, block_t blkaddr,
+ 	struct block_device *bdev = sbi->sb->s_bdev;
+ 	struct bio *bio;
+ 
++	if (!f2fs_is_valid_blkaddr(sbi, blkaddr, DATA_GENERIC))
++		return ERR_PTR(-EFAULT);
++
+ 	if (f2fs_encrypted_inode(inode) && S_ISREG(inode->i_mode)) {
+ 		ctx = fscrypt_get_ctx(inode, GFP_NOFS);
+ 		if (IS_ERR(ctx))
+@@ -1084,6 +1097,10 @@ got_it:
+ 				SetPageUptodate(page);
+ 				goto confused;
+ 			}
++
++			if (!f2fs_is_valid_blkaddr(F2FS_I_SB(inode), block_nr,
++								DATA_GENERIC))
++				goto set_error_page;
+ 		} else {
+ 			zero_user_segment(page, 0, PAGE_SIZE);
+ 			if (!PageUptodate(page))
+@@ -1212,11 +1229,17 @@ retry_encrypt:
+ 
+ 	set_page_writeback(page);
+ 
++	if (__is_valid_data_blkaddr(fio->old_blkaddr) &&
++		!f2fs_is_valid_blkaddr(fio->sbi, fio->old_blkaddr,
++							DATA_GENERIC)) {
++		err = -EFAULT;
++		goto out_writepage;
++	}
+ 	/*
+ 	 * If current allocation needs SSR,
+ 	 * it had better in-place writes for updated data.
+ 	 */
+-	if (unlikely(fio->old_blkaddr != NEW_ADDR &&
++	if (unlikely(is_valid_data_blkaddr(fio->sbi, fio->old_blkaddr) &&
+ 			!is_cold_data(page) &&
+ 			!IS_ATOMIC_WRITTEN_PAGE(page) &&
+ 			need_inplace_update(inode))) {
+diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
+index 88e111ab068b..9c380885b0fc 100644
+--- a/fs/f2fs/f2fs.h
++++ b/fs/f2fs/f2fs.h
+@@ -145,7 +145,7 @@ struct cp_control {
+ };
+ 
+ /*
+- * For CP/NAT/SIT/SSA readahead
++ * indicate meta/data type
+  */
+ enum {
+ 	META_CP,
+@@ -153,6 +153,8 @@ enum {
+ 	META_SIT,
+ 	META_SSA,
+ 	META_POR,
++	DATA_GENERIC,
++	META_GENERIC,
+ };
+ 
+ /* for the list of ino */
+@@ -694,6 +696,7 @@ struct f2fs_io_info {
+ 	block_t old_blkaddr;	/* old block address before Cow */
+ 	struct page *page;	/* page to be written */
+ 	struct page *encrypted_page;	/* encrypted page */
++	bool is_meta;		/* indicate borrow meta inode mapping or not */
+ };
+ 
+ #define is_read_io(rw) (rw == READ)
+@@ -1929,6 +1932,39 @@ static inline void *f2fs_kvzalloc(size_t size, gfp_t flags)
+ 	(pgofs - ADDRS_PER_INODE(inode) + ADDRS_PER_BLOCK) /	\
+ 	ADDRS_PER_BLOCK * ADDRS_PER_BLOCK + ADDRS_PER_INODE(inode))
+ 
++#define __is_meta_io(fio) (PAGE_TYPE_OF_BIO(fio->type) == META &&	\
++				(!is_read_io(fio->op) || fio->is_meta))
++
++bool f2fs_is_valid_blkaddr(struct f2fs_sb_info *sbi,
++					block_t blkaddr, int type);
++void f2fs_msg(struct super_block *sb, const char *level, const char *fmt, ...);
++static inline void verify_blkaddr(struct f2fs_sb_info *sbi,
++					block_t blkaddr, int type)
++{
++	if (!f2fs_is_valid_blkaddr(sbi, blkaddr, type)) {
++		f2fs_msg(sbi->sb, KERN_ERR,
++			"invalid blkaddr: %u, type: %d, run fsck to fix.",
++			blkaddr, type);
++		f2fs_bug_on(sbi, 1);
++	}
++}
++
++static inline bool __is_valid_data_blkaddr(block_t blkaddr)
++{
++	if (blkaddr == NEW_ADDR || blkaddr == NULL_ADDR)
++		return false;
++	return true;
++}
++
++static inline bool is_valid_data_blkaddr(struct f2fs_sb_info *sbi,
++						block_t blkaddr)
++{
++	if (!__is_valid_data_blkaddr(blkaddr))
++		return false;
++	verify_blkaddr(sbi, blkaddr, DATA_GENERIC);
++	return true;
++}
++
+ /*
+  * file.c
+  */
+@@ -2114,7 +2150,8 @@ void f2fs_stop_checkpoint(struct f2fs_sb_info *, bool);
+ struct page *grab_meta_page(struct f2fs_sb_info *, pgoff_t);
+ struct page *get_meta_page(struct f2fs_sb_info *, pgoff_t);
+ struct page *get_tmp_page(struct f2fs_sb_info *, pgoff_t);
+-bool is_valid_blkaddr(struct f2fs_sb_info *, block_t, int);
++bool f2fs_is_valid_blkaddr(struct f2fs_sb_info *sbi,
++					block_t blkaddr, int type);
+ int ra_meta_pages(struct f2fs_sb_info *, block_t, int, int, bool);
+ void ra_meta_pages_cond(struct f2fs_sb_info *, pgoff_t);
+ long sync_meta_pages(struct f2fs_sb_info *, enum page_type, long);
+diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
+index 594e6e20d6dd..b768f495603e 100644
+--- a/fs/f2fs/file.c
++++ b/fs/f2fs/file.c
+@@ -310,13 +310,13 @@ static pgoff_t __get_first_dirty_index(struct address_space *mapping,
+ 	return pgofs;
+ }
+ 
+-static bool __found_offset(block_t blkaddr, pgoff_t dirty, pgoff_t pgofs,
+-							int whence)
++static bool __found_offset(struct f2fs_sb_info *sbi, block_t blkaddr,
++				pgoff_t dirty, pgoff_t pgofs, int whence)
+ {
+ 	switch (whence) {
+ 	case SEEK_DATA:
+ 		if ((blkaddr == NEW_ADDR && dirty == pgofs) ||
+-			(blkaddr != NEW_ADDR && blkaddr != NULL_ADDR))
++			is_valid_data_blkaddr(sbi, blkaddr))
+ 			return true;
+ 		break;
+ 	case SEEK_HOLE:
+@@ -378,7 +378,15 @@ static loff_t f2fs_seek_block(struct file *file, loff_t offset, int whence)
+ 			block_t blkaddr;
+ 			blkaddr = datablock_addr(dn.node_page, dn.ofs_in_node);
+ 
+-			if (__found_offset(blkaddr, dirty, pgofs, whence)) {
++			if (__is_valid_data_blkaddr(blkaddr) &&
++				!f2fs_is_valid_blkaddr(F2FS_I_SB(inode),
++						blkaddr, DATA_GENERIC)) {
++				f2fs_put_dnode(&dn);
++				goto fail;
++			}
++
++			if (__found_offset(F2FS_I_SB(inode), blkaddr, dirty,
++							pgofs, whence)) {
+ 				f2fs_put_dnode(&dn);
+ 				goto found;
+ 			}
+@@ -481,6 +489,11 @@ int truncate_data_blocks_range(struct dnode_of_data *dn, int count)
+ 
+ 		dn->data_blkaddr = NULL_ADDR;
+ 		set_data_blkaddr(dn);
++
++		if (__is_valid_data_blkaddr(blkaddr) &&
++			!f2fs_is_valid_blkaddr(sbi, blkaddr, DATA_GENERIC))
++			continue;
++
+ 		invalidate_blocks(sbi, blkaddr);
+ 		if (dn->ofs_in_node == 0 && IS_INODE(dn->node_page))
+ 			clear_inode_flag(dn->inode, FI_FIRST_BLOCK_WRITTEN);
+diff --git a/fs/f2fs/inode.c b/fs/f2fs/inode.c
+index d7369895a78a..1de02c31756b 100644
+--- a/fs/f2fs/inode.c
++++ b/fs/f2fs/inode.c
+@@ -59,13 +59,16 @@ static void __get_inode_rdev(struct inode *inode, struct f2fs_inode *ri)
+ 	}
+ }
+ 
+-static bool __written_first_block(struct f2fs_inode *ri)
++static int __written_first_block(struct f2fs_sb_info *sbi,
++					struct f2fs_inode *ri)
+ {
+ 	block_t addr = le32_to_cpu(ri->i_addr[0]);
+ 
+-	if (addr != NEW_ADDR && addr != NULL_ADDR)
+-		return true;
+-	return false;
++	if (!__is_valid_data_blkaddr(addr))
++		return 1;
++	if (!f2fs_is_valid_blkaddr(sbi, addr, DATA_GENERIC))
++		return -EFAULT;
++	return 0;
+ }
+ 
+ static void __set_inode_rdev(struct inode *inode, struct f2fs_inode *ri)
+@@ -103,12 +106,57 @@ static void __recover_inline_status(struct inode *inode, struct page *ipage)
+ 	return;
+ }
+ 
++static bool sanity_check_inode(struct inode *inode, struct page *node_page)
++{
++	struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
++	unsigned long long iblocks;
++
++	iblocks = le64_to_cpu(F2FS_INODE(node_page)->i_blocks);
++	if (!iblocks) {
++		set_sbi_flag(sbi, SBI_NEED_FSCK);
++		f2fs_msg(sbi->sb, KERN_WARNING,
++			"%s: corrupted inode i_blocks i_ino=%lx iblocks=%llu, "
++			"run fsck to fix.",
++			__func__, inode->i_ino, iblocks);
++		return false;
++	}
++
++	if (ino_of_node(node_page) != nid_of_node(node_page)) {
++		set_sbi_flag(sbi, SBI_NEED_FSCK);
++		f2fs_msg(sbi->sb, KERN_WARNING,
++			"%s: corrupted inode footer i_ino=%lx, ino,nid: "
++			"[%u, %u] run fsck to fix.",
++			__func__, inode->i_ino,
++			ino_of_node(node_page), nid_of_node(node_page));
++		return false;
++	}
++
++	if (F2FS_I(inode)->extent_tree) {
++		struct extent_info *ei = &F2FS_I(inode)->extent_tree->largest;
++
++		if (ei->len &&
++			(!f2fs_is_valid_blkaddr(sbi, ei->blk, DATA_GENERIC) ||
++			!f2fs_is_valid_blkaddr(sbi, ei->blk + ei->len - 1,
++							DATA_GENERIC))) {
++			set_sbi_flag(sbi, SBI_NEED_FSCK);
++			f2fs_msg(sbi->sb, KERN_WARNING,
++				"%s: inode (ino=%lx) extent info [%u, %u, %u] "
++				"is incorrect, run fsck to fix",
++				__func__, inode->i_ino,
++				ei->blk, ei->fofs, ei->len);
++			return false;
++		}
++	}
++	return true;
++}
++
+ static int do_read_inode(struct inode *inode)
+ {
+ 	struct f2fs_sb_info *sbi = F2FS_I_SB(inode);
+ 	struct f2fs_inode_info *fi = F2FS_I(inode);
+ 	struct page *node_page;
+ 	struct f2fs_inode *ri;
++	int err;
+ 
+ 	/* Check if ino is within scope */
+ 	if (check_nid_range(sbi, inode->i_ino)) {
+@@ -152,6 +200,11 @@ static int do_read_inode(struct inode *inode)
+ 
+ 	get_inline_info(inode, ri);
+ 
++	if (!sanity_check_inode(inode, node_page)) {
++		f2fs_put_page(node_page, 1);
++		return -EINVAL;
++	}
++
+ 	/* check data exist */
+ 	if (f2fs_has_inline_data(inode) && !f2fs_exist_data(inode))
+ 		__recover_inline_status(inode, node_page);
+@@ -159,7 +212,12 @@ static int do_read_inode(struct inode *inode)
+ 	/* get rdev by using inline_info */
+ 	__get_inode_rdev(inode, ri);
+ 
+-	if (__written_first_block(ri))
++	err = __written_first_block(sbi, ri);
++	if (err < 0) {
++		f2fs_put_page(node_page, 1);
++		return err;
++	}
++	if (!err)
+ 		set_inode_flag(inode, FI_FIRST_BLOCK_WRITTEN);
+ 
+ 	if (!need_inode_block_update(sbi, inode->i_ino))
+diff --git a/fs/f2fs/node.c b/fs/f2fs/node.c
+index addff6a3b176..f4fe54047fb7 100644
+--- a/fs/f2fs/node.c
++++ b/fs/f2fs/node.c
+@@ -304,8 +304,7 @@ static void set_node_addr(struct f2fs_sb_info *sbi, struct node_info *ni,
+ 			new_blkaddr == NULL_ADDR);
+ 	f2fs_bug_on(sbi, nat_get_blkaddr(e) == NEW_ADDR &&
+ 			new_blkaddr == NEW_ADDR);
+-	f2fs_bug_on(sbi, nat_get_blkaddr(e) != NEW_ADDR &&
+-			nat_get_blkaddr(e) != NULL_ADDR &&
++	f2fs_bug_on(sbi, is_valid_data_blkaddr(sbi, nat_get_blkaddr(e)) &&
+ 			new_blkaddr == NEW_ADDR);
+ 
+ 	/* increment version no as node is removed */
+@@ -320,7 +319,7 @@ static void set_node_addr(struct f2fs_sb_info *sbi, struct node_info *ni,
+ 
+ 	/* change address */
+ 	nat_set_blkaddr(e, new_blkaddr);
+-	if (new_blkaddr == NEW_ADDR || new_blkaddr == NULL_ADDR)
++	if (!is_valid_data_blkaddr(sbi, new_blkaddr))
+ 		set_nat_flag(e, IS_CHECKPOINTED, false);
+ 	__set_nat_cache_dirty(nm_i, e);
+ 
+@@ -1606,6 +1605,12 @@ static int f2fs_write_node_page(struct page *page,
+ 		return 0;
+ 	}
+ 
++	if (__is_valid_data_blkaddr(ni.blk_addr) &&
++		!f2fs_is_valid_blkaddr(sbi, ni.blk_addr, DATA_GENERIC)) {
++		up_read(&sbi->node_write);
++		goto redirty_out;
++	}
++
+ 	set_page_writeback(page);
+ 	fio.old_blkaddr = ni.blk_addr;
+ 	write_node_page(nid, &fio);
+@@ -1704,8 +1709,9 @@ static void __del_from_free_nid_list(struct f2fs_nm_info *nm_i,
+ static int add_free_nid(struct f2fs_sb_info *sbi, nid_t nid, bool build)
+ {
+ 	struct f2fs_nm_info *nm_i = NM_I(sbi);
+-	struct free_nid *i;
++	struct free_nid *i, *e;
+ 	struct nat_entry *ne;
++	int err = -EINVAL;
+ 
+ 	if (!available_free_memory(sbi, FREE_NIDS))
+ 		return -1;
+@@ -1714,35 +1720,58 @@ static int add_free_nid(struct f2fs_sb_info *sbi, nid_t nid, bool build)
+ 	if (unlikely(nid == 0))
+ 		return 0;
+ 
+-	if (build) {
+-		/* do not add allocated nids */
+-		ne = __lookup_nat_cache(nm_i, nid);
+-		if (ne && (!get_nat_flag(ne, IS_CHECKPOINTED) ||
+-				nat_get_blkaddr(ne) != NULL_ADDR))
+-			return 0;
+-	}
+-
+ 	i = f2fs_kmem_cache_alloc(free_nid_slab, GFP_NOFS);
+ 	i->nid = nid;
+ 	i->state = NID_NEW;
+ 
+-	if (radix_tree_preload(GFP_NOFS)) {
+-		kmem_cache_free(free_nid_slab, i);
+-		return 0;
+-	}
++	if (radix_tree_preload(GFP_NOFS))
++		goto err;
+ 
+ 	spin_lock(&nm_i->free_nid_list_lock);
+-	if (radix_tree_insert(&nm_i->free_nid_root, i->nid, i)) {
+-		spin_unlock(&nm_i->free_nid_list_lock);
+-		radix_tree_preload_end();
+-		kmem_cache_free(free_nid_slab, i);
+-		return 0;
++
++	if (build) {
++		/*
++		 *   Thread A             Thread B
++		 *  - f2fs_create
++		 *   - f2fs_new_inode
++		 *    - alloc_nid
++		 *     - __insert_nid_to_list(ALLOC_NID_LIST)
++		 *                     - f2fs_balance_fs_bg
++		 *                      - build_free_nids
++		 *                       - __build_free_nids
++		 *                        - scan_nat_page
++		 *                         - add_free_nid
++		 *                          - __lookup_nat_cache
++		 *  - f2fs_add_link
++		 *   - init_inode_metadata
++		 *    - new_inode_page
++		 *     - new_node_page
++		 *      - set_node_addr
++		 *  - alloc_nid_done
++		 *   - __remove_nid_from_list(ALLOC_NID_LIST)
++		 *                         - __insert_nid_to_list(FREE_NID_LIST)
++		 */
++		ne = __lookup_nat_cache(nm_i, nid);
++		if (ne && (!get_nat_flag(ne, IS_CHECKPOINTED) ||
++				nat_get_blkaddr(ne) != NULL_ADDR))
++			goto err_out;
++
++		e = __lookup_free_nid_list(nm_i, nid);
++		if (e)
++			goto err_out;
+ 	}
++	if (radix_tree_insert(&nm_i->free_nid_root, i->nid, i))
++		goto err_out;
++	err = 0;
+ 	list_add_tail(&i->list, &nm_i->free_nid_list);
+ 	nm_i->fcnt++;
++err_out:
+ 	spin_unlock(&nm_i->free_nid_list_lock);
+ 	radix_tree_preload_end();
+-	return 1;
++err:
++	if (err)
++		kmem_cache_free(free_nid_slab, i);
++	return !err;
+ }
+ 
+ static void remove_free_nid(struct f2fs_nm_info *nm_i, nid_t nid)
+diff --git a/fs/f2fs/recovery.c b/fs/f2fs/recovery.c
+index 98c1a63a4614..ab4cbb4be423 100644
+--- a/fs/f2fs/recovery.c
++++ b/fs/f2fs/recovery.c
+@@ -236,7 +236,7 @@ static int find_fsync_dnodes(struct f2fs_sb_info *sbi, struct list_head *head)
+ 	while (1) {
+ 		struct fsync_inode_entry *entry;
+ 
+-		if (!is_valid_blkaddr(sbi, blkaddr, META_POR))
++		if (!f2fs_is_valid_blkaddr(sbi, blkaddr, META_POR))
+ 			return 0;
+ 
+ 		page = get_tmp_page(sbi, blkaddr);
+@@ -468,7 +468,7 @@ retry_dn:
+ 		}
+ 
+ 		/* dest is valid block, try to recover from src to dest */
+-		if (is_valid_blkaddr(sbi, dest, META_POR)) {
++		if (f2fs_is_valid_blkaddr(sbi, dest, META_POR)) {
+ 
+ 			if (src == NULL_ADDR) {
+ 				err = reserve_new_block(&dn);
+@@ -527,7 +527,7 @@ static int recover_data(struct f2fs_sb_info *sbi, struct list_head *inode_list,
+ 	while (1) {
+ 		struct fsync_inode_entry *entry;
+ 
+-		if (!is_valid_blkaddr(sbi, blkaddr, META_POR))
++		if (!f2fs_is_valid_blkaddr(sbi, blkaddr, META_POR))
+ 			break;
+ 
+ 		ra_meta_pages_cond(sbi, blkaddr);
+diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
+index 35d48ef0573c..2fb99a081de8 100644
+--- a/fs/f2fs/segment.c
++++ b/fs/f2fs/segment.c
+@@ -493,6 +493,9 @@ int create_flush_cmd_control(struct f2fs_sb_info *sbi)
+ 	init_waitqueue_head(&fcc->flush_wait_queue);
+ 	init_llist_head(&fcc->issue_list);
+ 	SM_I(sbi)->cmd_control_info = fcc;
++	if (!test_opt(sbi, FLUSH_MERGE))
++		return err;
++
+ 	fcc->f2fs_issue_flush = kthread_run(issue_flush_thread, sbi,
+ 				"f2fs_flush-%u:%u", MAJOR(dev), MINOR(dev));
+ 	if (IS_ERR(fcc->f2fs_issue_flush)) {
+@@ -941,7 +944,7 @@ bool is_checkpointed_data(struct f2fs_sb_info *sbi, block_t blkaddr)
+ 	struct seg_entry *se;
+ 	bool is_cp = false;
+ 
+-	if (blkaddr == NEW_ADDR || blkaddr == NULL_ADDR)
++	if (!is_valid_data_blkaddr(sbi, blkaddr))
+ 		return true;
+ 
+ 	mutex_lock(&sit_i->sentry_lock);
+@@ -1665,7 +1668,7 @@ void f2fs_wait_on_encrypted_page_writeback(struct f2fs_sb_info *sbi,
+ {
+ 	struct page *cpage;
+ 
+-	if (blkaddr == NEW_ADDR || blkaddr == NULL_ADDR)
++	if (!is_valid_data_blkaddr(sbi, blkaddr))
+ 		return;
+ 
+ 	cpage = find_lock_page(META_MAPPING(sbi), blkaddr);
+@@ -2319,7 +2322,7 @@ static int build_curseg(struct f2fs_sb_info *sbi)
+ 	return restore_curseg_summaries(sbi);
+ }
+ 
+-static void build_sit_entries(struct f2fs_sb_info *sbi)
++static int build_sit_entries(struct f2fs_sb_info *sbi)
+ {
+ 	struct sit_info *sit_i = SIT_I(sbi);
+ 	struct curseg_info *curseg = CURSEG_I(sbi, CURSEG_COLD_DATA);
+@@ -2330,6 +2333,7 @@ static void build_sit_entries(struct f2fs_sb_info *sbi)
+ 	unsigned int i, start, end;
+ 	unsigned int readed, start_blk = 0;
+ 	int nrpages = MAX_BIO_BLOCKS(sbi) * 8;
++	int err = 0;
+ 
+ 	do {
+ 		readed = ra_meta_pages(sbi, start_blk, nrpages, META_SIT, true);
+@@ -2347,7 +2351,9 @@ static void build_sit_entries(struct f2fs_sb_info *sbi)
+ 			sit = sit_blk->entries[SIT_ENTRY_OFFSET(sit_i, start)];
+ 			f2fs_put_page(page, 1);
+ 
+-			check_block_count(sbi, start, &sit);
++			err = check_block_count(sbi, start, &sit);
++			if (err)
++				return err;
+ 			seg_info_from_raw_sit(se, &sit);
+ 
+ 			/* build discard map only one time */
+@@ -2370,12 +2376,23 @@ static void build_sit_entries(struct f2fs_sb_info *sbi)
+ 		unsigned int old_valid_blocks;
+ 
+ 		start = le32_to_cpu(segno_in_journal(journal, i));
++		if (start >= MAIN_SEGS(sbi)) {
++			f2fs_msg(sbi->sb, KERN_ERR,
++					"Wrong journal entry on segno %u",
++					start);
++			set_sbi_flag(sbi, SBI_NEED_FSCK);
++			err = -EINVAL;
++			break;
++		}
++
+ 		se = &sit_i->sentries[start];
+ 		sit = sit_in_journal(journal, i);
+ 
+ 		old_valid_blocks = se->valid_blocks;
+ 
+-		check_block_count(sbi, start, &sit);
++		err = check_block_count(sbi, start, &sit);
++		if (err)
++			break;
+ 		seg_info_from_raw_sit(se, &sit);
+ 
+ 		if (f2fs_discard_en(sbi)) {
+@@ -2390,6 +2407,7 @@ static void build_sit_entries(struct f2fs_sb_info *sbi)
+ 				se->valid_blocks - old_valid_blocks;
+ 	}
+ 	up_read(&curseg->journal_rwsem);
++	return err;
+ }
+ 
+ static void init_free_segmap(struct f2fs_sb_info *sbi)
+@@ -2539,7 +2557,7 @@ int build_segment_manager(struct f2fs_sb_info *sbi)
+ 
+ 	INIT_LIST_HEAD(&sm_info->sit_entry_set);
+ 
+-	if (test_opt(sbi, FLUSH_MERGE) && !f2fs_readonly(sbi->sb)) {
++	if (!f2fs_readonly(sbi->sb)) {
+ 		err = create_flush_cmd_control(sbi);
+ 		if (err)
+ 			return err;
+@@ -2556,7 +2574,9 @@ int build_segment_manager(struct f2fs_sb_info *sbi)
+ 		return err;
+ 
+ 	/* reinit free segmap based on SIT */
+-	build_sit_entries(sbi);
++	err = build_sit_entries(sbi);
++	if (err)
++		return err;
+ 
+ 	init_free_segmap(sbi);
+ 	err = build_dirty_segmap(sbi);
+diff --git a/fs/f2fs/segment.h b/fs/f2fs/segment.h
+index 3d9b9e98c4c2..893723978f5e 100644
+--- a/fs/f2fs/segment.h
++++ b/fs/f2fs/segment.h
+@@ -18,6 +18,8 @@
+ #define DEF_RECLAIM_PREFREE_SEGMENTS	5	/* 5% over total segments */
+ #define DEF_MAX_RECLAIM_PREFREE_SEGMENTS	4096	/* 8GB in maximum */
+ 
++#define F2FS_MIN_SEGMENTS	9 /* SB + 2 (CP + SIT + NAT) + SSA + MAIN */
++
+ /* L: Logical segment # in volume, R: Relative segment # in main area */
+ #define GET_L2R_SEGNO(free_i, segno)	(segno - free_i->start_segno)
+ #define GET_R2L_SEGNO(free_i, segno)	(segno + free_i->start_segno)
+@@ -47,13 +49,19 @@
+ 	 (secno == CURSEG_I(sbi, CURSEG_COLD_NODE)->segno /		\
+ 	  sbi->segs_per_sec))	\
+ 
+-#define MAIN_BLKADDR(sbi)	(SM_I(sbi)->main_blkaddr)
+-#define SEG0_BLKADDR(sbi)	(SM_I(sbi)->seg0_blkaddr)
++#define MAIN_BLKADDR(sbi)						\
++	(SM_I(sbi) ? SM_I(sbi)->main_blkaddr : 				\
++		le32_to_cpu(F2FS_RAW_SUPER(sbi)->main_blkaddr))
++#define SEG0_BLKADDR(sbi)						\
++	(SM_I(sbi) ? SM_I(sbi)->seg0_blkaddr : 				\
++		le32_to_cpu(F2FS_RAW_SUPER(sbi)->segment0_blkaddr))
+ 
+ #define MAIN_SEGS(sbi)	(SM_I(sbi)->main_segments)
+ #define MAIN_SECS(sbi)	(sbi->total_sections)
+ 
+-#define TOTAL_SEGS(sbi)	(SM_I(sbi)->segment_count)
++#define TOTAL_SEGS(sbi)							\
++	(SM_I(sbi) ? SM_I(sbi)->segment_count : 				\
++		le32_to_cpu(F2FS_RAW_SUPER(sbi)->segment_count))
+ #define TOTAL_BLKS(sbi)	(TOTAL_SEGS(sbi) << sbi->log_blocks_per_seg)
+ 
+ #define MAX_BLKADDR(sbi)	(SEG0_BLKADDR(sbi) + TOTAL_BLKS(sbi))
+@@ -73,7 +81,7 @@
+ 	(GET_SEGOFF_FROM_SEG0(sbi, blk_addr) & (sbi->blocks_per_seg - 1))
+ 
+ #define GET_SEGNO(sbi, blk_addr)					\
+-	(((blk_addr == NULL_ADDR) || (blk_addr == NEW_ADDR)) ?		\
++	((!is_valid_data_blkaddr(sbi, blk_addr)) ?			\
+ 	NULL_SEGNO : GET_L2R_SEGNO(FREE_I(sbi),			\
+ 		GET_SEGNO_FROM_SEG0(sbi, blk_addr)))
+ #define GET_SECNO(sbi, segno)					\
+@@ -589,16 +597,20 @@ static inline void check_seg_range(struct f2fs_sb_info *sbi, unsigned int segno)
+ 	f2fs_bug_on(sbi, segno > TOTAL_SEGS(sbi) - 1);
+ }
+ 
+-static inline void verify_block_addr(struct f2fs_sb_info *sbi, block_t blk_addr)
++static inline void verify_block_addr(struct f2fs_io_info *fio, block_t blk_addr)
+ {
+-	BUG_ON(blk_addr < SEG0_BLKADDR(sbi)
+-			|| blk_addr >= MAX_BLKADDR(sbi));
++	struct f2fs_sb_info *sbi = fio->sbi;
++
++	if (__is_meta_io(fio))
++		verify_blkaddr(sbi, blk_addr, META_GENERIC);
++	else
++		verify_blkaddr(sbi, blk_addr, DATA_GENERIC);
+ }
+ 
+ /*
+  * Summary block is always treated as an invalid block
+  */
+-static inline void check_block_count(struct f2fs_sb_info *sbi,
++static inline int check_block_count(struct f2fs_sb_info *sbi,
+ 		int segno, struct f2fs_sit_entry *raw_sit)
+ {
+ #ifdef CONFIG_F2FS_CHECK_FS
+@@ -620,11 +632,25 @@ static inline void check_block_count(struct f2fs_sb_info *sbi,
+ 		cur_pos = next_pos;
+ 		is_valid = !is_valid;
+ 	} while (cur_pos < sbi->blocks_per_seg);
+-	BUG_ON(GET_SIT_VBLOCKS(raw_sit) != valid_blocks);
++
++	if (unlikely(GET_SIT_VBLOCKS(raw_sit) != valid_blocks)) {
++		f2fs_msg(sbi->sb, KERN_ERR,
++				"Mismatch valid blocks %d vs. %d",
++					GET_SIT_VBLOCKS(raw_sit), valid_blocks);
++		set_sbi_flag(sbi, SBI_NEED_FSCK);
++		return -EINVAL;
++	}
+ #endif
+ 	/* check segment usage, and check boundary of a given segment number */
+-	f2fs_bug_on(sbi, GET_SIT_VBLOCKS(raw_sit) > sbi->blocks_per_seg
+-					|| segno > TOTAL_SEGS(sbi) - 1);
++	if (unlikely(GET_SIT_VBLOCKS(raw_sit) > sbi->blocks_per_seg
++					|| segno > TOTAL_SEGS(sbi) - 1)) {
++		f2fs_msg(sbi->sb, KERN_ERR,
++				"Wrong valid blocks %d or segno %u",
++					GET_SIT_VBLOCKS(raw_sit), segno);
++		set_sbi_flag(sbi, SBI_NEED_FSCK);
++		return -EINVAL;
++	}
++	return 0;
+ }
+ 
+ static inline pgoff_t current_sit_addr(struct f2fs_sb_info *sbi,
+diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
+index 91bf72334722..c8f408d8a582 100644
+--- a/fs/f2fs/super.c
++++ b/fs/f2fs/super.c
+@@ -1337,6 +1337,8 @@ static inline bool sanity_check_area_boundary(struct f2fs_sb_info *sbi,
+ static int sanity_check_raw_super(struct f2fs_sb_info *sbi,
+ 				struct buffer_head *bh)
+ {
++	block_t segment_count, segs_per_sec, secs_per_zone;
++	block_t total_sections, blocks_per_seg;
+ 	struct f2fs_super_block *raw_super = (struct f2fs_super_block *)
+ 					(bh->b_data + F2FS_SUPER_OFFSET);
+ 	struct super_block *sb = sbi->sb;
+@@ -1393,6 +1395,68 @@ static int sanity_check_raw_super(struct f2fs_sb_info *sbi,
+ 		return 1;
+ 	}
+ 
++	segment_count = le32_to_cpu(raw_super->segment_count);
++	segs_per_sec = le32_to_cpu(raw_super->segs_per_sec);
++	secs_per_zone = le32_to_cpu(raw_super->secs_per_zone);
++	total_sections = le32_to_cpu(raw_super->section_count);
++
++	/* blocks_per_seg should be 512, given the above check */
++	blocks_per_seg = 1 << le32_to_cpu(raw_super->log_blocks_per_seg);
++
++	if (segment_count > F2FS_MAX_SEGMENT ||
++				segment_count < F2FS_MIN_SEGMENTS) {
++		f2fs_msg(sb, KERN_INFO,
++			"Invalid segment count (%u)",
++			segment_count);
++		return 1;
++	}
++
++	if (total_sections > segment_count ||
++			total_sections < F2FS_MIN_SEGMENTS ||
++			segs_per_sec > segment_count || !segs_per_sec) {
++		f2fs_msg(sb, KERN_INFO,
++			"Invalid segment/section count (%u, %u x %u)",
++			segment_count, total_sections, segs_per_sec);
++		return 1;
++	}
++
++	if ((segment_count / segs_per_sec) < total_sections) {
++		f2fs_msg(sb, KERN_INFO,
++			"Small segment_count (%u < %u * %u)",
++			segment_count, segs_per_sec, total_sections);
++		return 1;
++	}
++
++	if (segment_count > (le32_to_cpu(raw_super->block_count) >> 9)) {
++		f2fs_msg(sb, KERN_INFO,
++			"Wrong segment_count / block_count (%u > %u)",
++			segment_count, le32_to_cpu(raw_super->block_count));
++		return 1;
++	}
++
++	if (secs_per_zone > total_sections || !secs_per_zone) {
++		f2fs_msg(sb, KERN_INFO,
++			"Wrong secs_per_zone / total_sections (%u, %u)",
++			secs_per_zone, total_sections);
++		return 1;
++	}
++	if (le32_to_cpu(raw_super->extension_count) > F2FS_MAX_EXTENSION) {
++		f2fs_msg(sb, KERN_INFO,
++			"Corrupted extension count (%u > %u)",
++			le32_to_cpu(raw_super->extension_count),
++			F2FS_MAX_EXTENSION);
++		return 1;
++	}
++
++	if (le32_to_cpu(raw_super->cp_payload) >
++				(blocks_per_seg - F2FS_CP_PACKS)) {
++		f2fs_msg(sb, KERN_INFO,
++			"Insane cp_payload (%u > %u)",
++			le32_to_cpu(raw_super->cp_payload),
++			blocks_per_seg - F2FS_CP_PACKS);
++		return 1;
++	}
++
+ 	/* check reserved ino info */
+ 	if (le32_to_cpu(raw_super->node_ino) != 1 ||
+ 		le32_to_cpu(raw_super->meta_ino) != 2 ||
+@@ -1405,13 +1469,6 @@ static int sanity_check_raw_super(struct f2fs_sb_info *sbi,
+ 		return 1;
+ 	}
+ 
+-	if (le32_to_cpu(raw_super->segment_count) > F2FS_MAX_SEGMENT) {
+-		f2fs_msg(sb, KERN_INFO,
+-			"Invalid segment count (%u)",
+-			le32_to_cpu(raw_super->segment_count));
+-		return 1;
+-	}
+-
+ 	/* check CP/SIT/NAT/SSA/MAIN_AREA area boundary */
+ 	if (sanity_check_area_boundary(sbi, bh))
+ 		return 1;
+@@ -1424,10 +1481,14 @@ int sanity_check_ckpt(struct f2fs_sb_info *sbi)
+ 	unsigned int total, fsmeta;
+ 	struct f2fs_super_block *raw_super = F2FS_RAW_SUPER(sbi);
+ 	struct f2fs_checkpoint *ckpt = F2FS_CKPT(sbi);
++	unsigned int ovp_segments, reserved_segments;
+ 	unsigned int main_segs, blocks_per_seg;
+ 	unsigned int sit_segs, nat_segs;
+ 	unsigned int sit_bitmap_size, nat_bitmap_size;
+ 	unsigned int log_blocks_per_seg;
++	unsigned int segment_count_main;
++	unsigned int cp_pack_start_sum, cp_payload;
++	block_t user_block_count;
+ 	int i;
+ 
+ 	total = le32_to_cpu(raw_super->segment_count);
+@@ -1442,6 +1503,26 @@ int sanity_check_ckpt(struct f2fs_sb_info *sbi)
+ 	if (unlikely(fsmeta >= total))
+ 		return 1;
+ 
++	ovp_segments = le32_to_cpu(ckpt->overprov_segment_count);
++	reserved_segments = le32_to_cpu(ckpt->rsvd_segment_count);
++
++	if (unlikely(fsmeta < F2FS_MIN_SEGMENTS ||
++			ovp_segments == 0 || reserved_segments == 0)) {
++		f2fs_msg(sbi->sb, KERN_ERR,
++			"Wrong layout: check mkfs.f2fs version");
++		return 1;
++	}
++
++	user_block_count = le64_to_cpu(ckpt->user_block_count);
++	segment_count_main = le32_to_cpu(raw_super->segment_count_main);
++	log_blocks_per_seg = le32_to_cpu(raw_super->log_blocks_per_seg);
++	if (!user_block_count || user_block_count >=
++			segment_count_main << log_blocks_per_seg) {
++		f2fs_msg(sbi->sb, KERN_ERR,
++			"Wrong user_block_count: %u", user_block_count);
++		return 1;
++	}
++
+ 	main_segs = le32_to_cpu(raw_super->segment_count_main);
+ 	blocks_per_seg = sbi->blocks_per_seg;
+ 
+@@ -1458,7 +1539,6 @@ int sanity_check_ckpt(struct f2fs_sb_info *sbi)
+ 
+ 	sit_bitmap_size = le32_to_cpu(ckpt->sit_ver_bitmap_bytesize);
+ 	nat_bitmap_size = le32_to_cpu(ckpt->nat_ver_bitmap_bytesize);
+-	log_blocks_per_seg = le32_to_cpu(raw_super->log_blocks_per_seg);
+ 
+ 	if (sit_bitmap_size != ((sit_segs / 2) << log_blocks_per_seg) / 8 ||
+ 		nat_bitmap_size != ((nat_segs / 2) << log_blocks_per_seg) / 8) {
+@@ -1468,6 +1548,17 @@ int sanity_check_ckpt(struct f2fs_sb_info *sbi)
+ 		return 1;
+ 	}
+ 
++	cp_pack_start_sum = __start_sum_addr(sbi);
++	cp_payload = __cp_payload(sbi);
++	if (cp_pack_start_sum < cp_payload + 1 ||
++		cp_pack_start_sum > blocks_per_seg - 1 -
++			NR_CURSEG_TYPE) {
++		f2fs_msg(sbi->sb, KERN_ERR,
++			"Wrong cp_pack_start_sum: %u",
++			cp_pack_start_sum);
++		return 1;
++	}
++
+ 	if (unlikely(f2fs_cp_error(sbi))) {
+ 		f2fs_msg(sbi->sb, KERN_ERR, "A bug case: need to run fsck");
+ 		return 1;
+diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
+index 2c2f182cde03..f53c139c312e 100644
+--- a/fs/hugetlbfs/inode.c
++++ b/fs/hugetlbfs/inode.c
+@@ -118,6 +118,16 @@ static void huge_pagevec_release(struct pagevec *pvec)
+ 	pagevec_reinit(pvec);
+ }
+ 
++/*
++ * Mask used when checking the page offset value passed in via system
++ * calls.  This value will be converted to a loff_t which is signed.
++ * Therefore, we want to check the upper PAGE_SHIFT + 1 bits of the
++ * value.  The extra bit (- 1 in the shift value) is to take the sign
++ * bit into account.
++ */
++#define PGOFF_LOFFT_MAX \
++	(((1UL << (PAGE_SHIFT + 1)) - 1) <<  (BITS_PER_LONG - (PAGE_SHIFT + 1)))
++
+ static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma)
+ {
+ 	struct inode *inode = file_inode(file);
+@@ -136,17 +146,31 @@ static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma)
+ 	vma->vm_flags |= VM_HUGETLB | VM_DONTEXPAND;
+ 	vma->vm_ops = &hugetlb_vm_ops;
+ 
++	/*
++	 * page based offset in vm_pgoff could be sufficiently large to
++	 * overflow a loff_t when converted to byte offset.  This can
++	 * only happen on architectures where sizeof(loff_t) ==
++	 * sizeof(unsigned long).  So, only check in those instances.
++	 */
++	if (sizeof(unsigned long) == sizeof(loff_t)) {
++		if (vma->vm_pgoff & PGOFF_LOFFT_MAX)
++			return -EINVAL;
++	}
++
++	/* must be huge page aligned */
+ 	if (vma->vm_pgoff & (~huge_page_mask(h) >> PAGE_SHIFT))
+ 		return -EINVAL;
+ 
+ 	vma_len = (loff_t)(vma->vm_end - vma->vm_start);
++	len = vma_len + ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
++	/* check for overflow */
++	if (len < vma_len)
++		return -EINVAL;
+ 
+ 	inode_lock(inode);
+ 	file_accessed(file);
+ 
+ 	ret = -ENOMEM;
+-	len = vma_len + ((loff_t)vma->vm_pgoff << PAGE_SHIFT);
+-
+ 	if (hugetlb_reserve_pages(inode,
+ 				vma->vm_pgoff >> huge_page_order(h),
+ 				len >> huge_page_shift(h), vma,
+@@ -155,7 +179,7 @@ static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma)
+ 
+ 	ret = 0;
+ 	if (vma->vm_flags & VM_WRITE && inode->i_size < len)
+-		inode->i_size = len;
++		i_size_write(inode, len);
+ out:
+ 	inode_unlock(inode);
+ 
+diff --git a/fs/kernfs/symlink.c b/fs/kernfs/symlink.c
+index 9b43ca02b7ab..80317b04c84a 100644
+--- a/fs/kernfs/symlink.c
++++ b/fs/kernfs/symlink.c
+@@ -88,7 +88,7 @@ static int kernfs_get_target_path(struct kernfs_node *parent,
+ 		int slen = strlen(kn->name);
+ 
+ 		len -= slen;
+-		strncpy(s + len, kn->name, slen);
++		memcpy(s + len, kn->name, slen);
+ 		if (len)
+ 			s[--len] = '/';
+ 
+diff --git a/fs/udf/super.c b/fs/udf/super.c
+index 12467ad608cd..03369a89600e 100644
+--- a/fs/udf/super.c
++++ b/fs/udf/super.c
+@@ -929,16 +929,20 @@ static int udf_load_pvoldesc(struct super_block *sb, sector_t block)
+ 	}
+ 
+ 	ret = udf_dstrCS0toUTF8(outstr, 31, pvoldesc->volIdent, 32);
+-	if (ret < 0)
+-		goto out_bh;
+-
+-	strncpy(UDF_SB(sb)->s_volume_ident, outstr, ret);
++	if (ret < 0) {
++		strcpy(UDF_SB(sb)->s_volume_ident, "InvalidName");
++		pr_warn("incorrect volume identification, setting to "
++			"'InvalidName'\n");
++	} else {
++		strncpy(UDF_SB(sb)->s_volume_ident, outstr, ret);
++	}
+ 	udf_debug("volIdent[] = '%s'\n", UDF_SB(sb)->s_volume_ident);
+ 
+ 	ret = udf_dstrCS0toUTF8(outstr, 127, pvoldesc->volSetIdent, 128);
+-	if (ret < 0)
++	if (ret < 0) {
++		ret = 0;
+ 		goto out_bh;
+-
++	}
+ 	outstr[ret] = 0;
+ 	udf_debug("volSetIdent[] = '%s'\n", outstr);
+ 
+diff --git a/fs/udf/unicode.c b/fs/udf/unicode.c
+index 3a3be23689b3..61a1738895b7 100644
+--- a/fs/udf/unicode.c
++++ b/fs/udf/unicode.c
+@@ -341,6 +341,11 @@ try_again:
+ 	return u_len;
+ }
+ 
++/*
++ * Convert CS0 dstring to output charset. Warning: This function may truncate
++ * input string if it is too long as it is used for informational strings only
++ * and it is better to truncate the string than to refuse mounting a media.
++ */
+ int udf_dstrCS0toUTF8(uint8_t *utf_o, int o_len,
+ 		      const uint8_t *ocu_i, int i_len)
+ {
+@@ -349,9 +354,12 @@ int udf_dstrCS0toUTF8(uint8_t *utf_o, int o_len,
+ 	if (i_len > 0) {
+ 		s_len = ocu_i[i_len - 1];
+ 		if (s_len >= i_len) {
+-			pr_err("incorrect dstring lengths (%d/%d)\n",
+-			       s_len, i_len);
+-			return -EINVAL;
++			pr_warn("incorrect dstring lengths (%d/%d),"
++				" truncating\n", s_len, i_len);
++			s_len = i_len - 1;
++			/* 2-byte encoding? Need to round properly... */
++			if (ocu_i[0] == 16)
++				s_len -= (s_len - 1) & 2;
+ 		}
+ 	}
+ 
+diff --git a/fs/xfs/libxfs/xfs_attr.c b/fs/xfs/libxfs/xfs_attr.c
+index 6622d46ddec3..9687208c676f 100644
+--- a/fs/xfs/libxfs/xfs_attr.c
++++ b/fs/xfs/libxfs/xfs_attr.c
+@@ -487,7 +487,14 @@ xfs_attr_shortform_addname(xfs_da_args_t *args)
+ 		if (args->flags & ATTR_CREATE)
+ 			return retval;
+ 		retval = xfs_attr_shortform_remove(args);
+-		ASSERT(retval == 0);
++		if (retval)
++			return retval;
++		/*
++		 * Since we have removed the old attr, clear ATTR_REPLACE so
++		 * that the leaf format add routine won't trip over the attr
++		 * not being around.
++		 */
++		args->flags &= ~ATTR_REPLACE;
+ 	}
+ 
+ 	if (args->namelen >= XFS_ATTR_SF_ENTSIZE_MAX ||
+diff --git a/include/linux/bpf_verifier.h b/include/linux/bpf_verifier.h
+index 070fc49e39e2..5031defe59c5 100644
+--- a/include/linux/bpf_verifier.h
++++ b/include/linux/bpf_verifier.h
+@@ -71,6 +71,7 @@ struct bpf_insn_aux_data {
+ 		enum bpf_reg_type ptr_type;     /* pointer type for load/store insns */
+ 		struct bpf_map *map_ptr;        /* pointer for call insn into lookup_elem */
+ 	};
++	int sanitize_stack_off; /* stack slot to be cleared */
+ 	bool seen; /* this insn was processed by the verifier */
+ };
+ 
+diff --git a/include/linux/ceph/auth.h b/include/linux/ceph/auth.h
+index 374bb1c4ef52..035f26a04364 100644
+--- a/include/linux/ceph/auth.h
++++ b/include/linux/ceph/auth.h
+@@ -63,8 +63,12 @@ struct ceph_auth_client_ops {
+ 	/* ensure that an existing authorizer is up to date */
+ 	int (*update_authorizer)(struct ceph_auth_client *ac, int peer_type,
+ 				 struct ceph_auth_handshake *auth);
++	int (*add_authorizer_challenge)(struct ceph_auth_client *ac,
++					struct ceph_authorizer *a,
++					void *challenge_buf,
++					int challenge_buf_len);
+ 	int (*verify_authorizer_reply)(struct ceph_auth_client *ac,
+-				       struct ceph_authorizer *a, size_t len);
++				       struct ceph_authorizer *a);
+ 	void (*invalidate_authorizer)(struct ceph_auth_client *ac,
+ 				      int peer_type);
+ 
+@@ -117,9 +121,12 @@ void ceph_auth_destroy_authorizer(struct ceph_authorizer *a);
+ extern int ceph_auth_update_authorizer(struct ceph_auth_client *ac,
+ 				       int peer_type,
+ 				       struct ceph_auth_handshake *a);
++int ceph_auth_add_authorizer_challenge(struct ceph_auth_client *ac,
++				       struct ceph_authorizer *a,
++				       void *challenge_buf,
++				       int challenge_buf_len);
+ extern int ceph_auth_verify_authorizer_reply(struct ceph_auth_client *ac,
+-					     struct ceph_authorizer *a,
+-					     size_t len);
++					     struct ceph_authorizer *a);
+ extern void ceph_auth_invalidate_authorizer(struct ceph_auth_client *ac,
+ 					    int peer_type);
+ 
+diff --git a/include/linux/ceph/ceph_features.h b/include/linux/ceph/ceph_features.h
+index ae2f66833762..cf765db39c95 100644
+--- a/include/linux/ceph/ceph_features.h
++++ b/include/linux/ceph/ceph_features.h
+@@ -76,6 +76,7 @@
+ // duplicated since it was introduced at the same time as CEPH_FEATURE_CRUSH_TUNABLES5
+ #define CEPH_FEATURE_NEW_OSDOPREPLY_ENCODING   (1ULL<<58) /* New, v7 encoding */
+ #define CEPH_FEATURE_FS_FILE_LAYOUT_V2       (1ULL<<58) /* file_layout_t */
++#define CEPH_FEATURE_CEPHX_V2	(1ULL<<61) // *do not share this bit*
+ 
+ /*
+  * The introduction of CEPH_FEATURE_OSD_SNAPMAPPER caused the feature
+@@ -124,7 +125,8 @@ static inline u64 ceph_sanitize_features(u64 features)
+ 	 CEPH_FEATURE_MSGR_KEEPALIVE2 |		\
+ 	 CEPH_FEATURE_CRUSH_V4 |		\
+ 	 CEPH_FEATURE_CRUSH_TUNABLES5 |		\
+-	 CEPH_FEATURE_NEW_OSDOPREPLY_ENCODING)
++	 CEPH_FEATURE_NEW_OSDOPREPLY_ENCODING |	\
++	 CEPH_FEATURE_CEPHX_V2)
+ 
+ #define CEPH_FEATURES_REQUIRED_DEFAULT   \
+ 	(CEPH_FEATURE_NOSRCADDR |	 \
+diff --git a/include/linux/ceph/messenger.h b/include/linux/ceph/messenger.h
+index 8dbd7879fdc6..5e1c9c80d536 100644
+--- a/include/linux/ceph/messenger.h
++++ b/include/linux/ceph/messenger.h
+@@ -30,7 +30,10 @@ struct ceph_connection_operations {
+ 	struct ceph_auth_handshake *(*get_authorizer) (
+ 				struct ceph_connection *con,
+ 			       int *proto, int force_new);
+-	int (*verify_authorizer_reply) (struct ceph_connection *con, int len);
++	int (*add_authorizer_challenge)(struct ceph_connection *con,
++					void *challenge_buf,
++					int challenge_buf_len);
++	int (*verify_authorizer_reply) (struct ceph_connection *con);
+ 	int (*invalidate_authorizer)(struct ceph_connection *con);
+ 
+ 	/* there was some error on the socket (disconnect, whatever) */
+@@ -200,9 +203,8 @@ struct ceph_connection {
+ 				 attempt for this connection, client */
+ 	u32 peer_global_seq;  /* peer's global seq for this connection */
+ 
++	struct ceph_auth_handshake *auth;
+ 	int auth_retry;       /* true if we need a newer authorizer */
+-	void *auth_reply_buf;   /* where to put the authorizer reply */
+-	int auth_reply_buf_len;
+ 
+ 	struct mutex mutex;
+ 
+diff --git a/include/linux/ceph/msgr.h b/include/linux/ceph/msgr.h
+index 0fe2656ac415..063f9d7f1b74 100644
+--- a/include/linux/ceph/msgr.h
++++ b/include/linux/ceph/msgr.h
+@@ -90,7 +90,7 @@ struct ceph_entity_inst {
+ #define CEPH_MSGR_TAG_SEQ           13 /* 64-bit int follows with seen seq number */
+ #define CEPH_MSGR_TAG_KEEPALIVE2    14 /* keepalive2 byte + ceph_timespec */
+ #define CEPH_MSGR_TAG_KEEPALIVE2_ACK 15 /* keepalive2 reply */
+-
++#define CEPH_MSGR_TAG_CHALLENGE_AUTHORIZER 16  /* cephx v2 doing server challenge */
+ 
+ /*
+  * connection negotiation
+diff --git a/include/linux/reset.h b/include/linux/reset.h
+index 5daff15722d3..7e99690dbc81 100644
+--- a/include/linux/reset.h
++++ b/include/linux/reset.h
+@@ -13,76 +13,82 @@ int reset_control_deassert(struct reset_control *rstc);
+ int reset_control_status(struct reset_control *rstc);
+ 
+ struct reset_control *__of_reset_control_get(struct device_node *node,
+-				     const char *id, int index, int shared);
++				     const char *id, int index, bool shared,
++				     bool optional);
++struct reset_control *__reset_control_get(struct device *dev, const char *id,
++					  int index, bool shared,
++					  bool optional);
+ void reset_control_put(struct reset_control *rstc);
++int __device_reset(struct device *dev, bool optional);
+ struct reset_control *__devm_reset_control_get(struct device *dev,
+-				     const char *id, int index, int shared);
+-
+-int __must_check device_reset(struct device *dev);
+-
+-static inline int device_reset_optional(struct device *dev)
+-{
+-	return device_reset(dev);
+-}
++				     const char *id, int index, bool shared,
++				     bool optional);
+ 
+ #else
+ 
+ static inline int reset_control_reset(struct reset_control *rstc)
+ {
+-	WARN_ON(1);
+ 	return 0;
+ }
+ 
+ static inline int reset_control_assert(struct reset_control *rstc)
+ {
+-	WARN_ON(1);
+ 	return 0;
+ }
+ 
+ static inline int reset_control_deassert(struct reset_control *rstc)
+ {
+-	WARN_ON(1);
+ 	return 0;
+ }
+ 
+ static inline int reset_control_status(struct reset_control *rstc)
+ {
+-	WARN_ON(1);
+ 	return 0;
+ }
+ 
+ static inline void reset_control_put(struct reset_control *rstc)
+ {
+-	WARN_ON(1);
+ }
+ 
+-static inline int __must_check device_reset(struct device *dev)
++static inline int __device_reset(struct device *dev, bool optional)
+ {
+-	WARN_ON(1);
+-	return -ENOTSUPP;
++	return optional ? 0 : -ENOTSUPP;
+ }
+ 
+-static inline int device_reset_optional(struct device *dev)
++static inline struct reset_control *__of_reset_control_get(
++					struct device_node *node,
++					const char *id, int index, bool shared,
++					bool optional)
+ {
+-	return -ENOTSUPP;
++	return optional ? NULL : ERR_PTR(-ENOTSUPP);
+ }
+ 
+-static inline struct reset_control *__of_reset_control_get(
+-					struct device_node *node,
+-					const char *id, int index, int shared)
++static inline struct reset_control *__reset_control_get(
++					struct device *dev, const char *id,
++					int index, bool shared, bool optional)
+ {
+-	return ERR_PTR(-ENOTSUPP);
++	return optional ? NULL : ERR_PTR(-ENOTSUPP);
+ }
+ 
+ static inline struct reset_control *__devm_reset_control_get(
+-					struct device *dev,
+-					const char *id, int index, int shared)
++					struct device *dev, const char *id,
++					int index, bool shared, bool optional)
+ {
+-	return ERR_PTR(-ENOTSUPP);
++	return optional ? NULL : ERR_PTR(-ENOTSUPP);
+ }
+ 
+ #endif /* CONFIG_RESET_CONTROLLER */
+ 
++static inline int __must_check device_reset(struct device *dev)
++{
++	return __device_reset(dev, false);
++}
++
++static inline int device_reset_optional(struct device *dev)
++{
++	return __device_reset(dev, true);
++}
++
+ /**
+  * reset_control_get_exclusive - Lookup and obtain an exclusive reference
+  *                               to a reset controller.
+@@ -101,10 +107,7 @@ static inline struct reset_control *__devm_reset_control_get(
+ static inline struct reset_control *
+ __must_check reset_control_get_exclusive(struct device *dev, const char *id)
+ {
+-#ifndef CONFIG_RESET_CONTROLLER
+-	WARN_ON(1);
+-#endif
+-	return __of_reset_control_get(dev ? dev->of_node : NULL, id, 0, 0);
++	return __reset_control_get(dev, id, 0, false, false);
+ }
+ 
+ /**
+@@ -132,19 +135,19 @@ __must_check reset_control_get_exclusive(struct device *dev, const char *id)
+ static inline struct reset_control *reset_control_get_shared(
+ 					struct device *dev, const char *id)
+ {
+-	return __of_reset_control_get(dev ? dev->of_node : NULL, id, 0, 1);
++	return __reset_control_get(dev, id, 0, true, false);
+ }
+ 
+ static inline struct reset_control *reset_control_get_optional_exclusive(
+ 					struct device *dev, const char *id)
+ {
+-	return __of_reset_control_get(dev ? dev->of_node : NULL, id, 0, 0);
++	return __reset_control_get(dev, id, 0, false, true);
+ }
+ 
+ static inline struct reset_control *reset_control_get_optional_shared(
+ 					struct device *dev, const char *id)
+ {
+-	return __of_reset_control_get(dev ? dev->of_node : NULL, id, 0, 1);
++	return __reset_control_get(dev, id, 0, true, true);
+ }
+ 
+ /**
+@@ -160,7 +163,7 @@ static inline struct reset_control *reset_control_get_optional_shared(
+ static inline struct reset_control *of_reset_control_get_exclusive(
+ 				struct device_node *node, const char *id)
+ {
+-	return __of_reset_control_get(node, id, 0, 0);
++	return __of_reset_control_get(node, id, 0, false, false);
+ }
+ 
+ /**
+@@ -185,7 +188,7 @@ static inline struct reset_control *of_reset_control_get_exclusive(
+ static inline struct reset_control *of_reset_control_get_shared(
+ 				struct device_node *node, const char *id)
+ {
+-	return __of_reset_control_get(node, id, 0, 1);
++	return __of_reset_control_get(node, id, 0, true, false);
+ }
+ 
+ /**
+@@ -202,7 +205,7 @@ static inline struct reset_control *of_reset_control_get_shared(
+ static inline struct reset_control *of_reset_control_get_exclusive_by_index(
+ 					struct device_node *node, int index)
+ {
+-	return __of_reset_control_get(node, NULL, index, 0);
++	return __of_reset_control_get(node, NULL, index, false, false);
+ }
+ 
+ /**
+@@ -230,7 +233,7 @@ static inline struct reset_control *of_reset_control_get_exclusive_by_index(
+ static inline struct reset_control *of_reset_control_get_shared_by_index(
+ 					struct device_node *node, int index)
+ {
+-	return __of_reset_control_get(node, NULL, index, 1);
++	return __of_reset_control_get(node, NULL, index, true, false);
+ }
+ 
+ /**
+@@ -249,10 +252,7 @@ static inline struct reset_control *
+ __must_check devm_reset_control_get_exclusive(struct device *dev,
+ 					      const char *id)
+ {
+-#ifndef CONFIG_RESET_CONTROLLER
+-	WARN_ON(1);
+-#endif
+-	return __devm_reset_control_get(dev, id, 0, 0);
++	return __devm_reset_control_get(dev, id, 0, false, false);
+ }
+ 
+ /**
+@@ -267,19 +267,19 @@ __must_check devm_reset_control_get_exclusive(struct device *dev,
+ static inline struct reset_control *devm_reset_control_get_shared(
+ 					struct device *dev, const char *id)
+ {
+-	return __devm_reset_control_get(dev, id, 0, 1);
++	return __devm_reset_control_get(dev, id, 0, true, false);
+ }
+ 
+ static inline struct reset_control *devm_reset_control_get_optional_exclusive(
+ 					struct device *dev, const char *id)
+ {
+-	return __devm_reset_control_get(dev, id, 0, 0);
++	return __devm_reset_control_get(dev, id, 0, false, true);
+ }
+ 
+ static inline struct reset_control *devm_reset_control_get_optional_shared(
+ 					struct device *dev, const char *id)
+ {
+-	return __devm_reset_control_get(dev, id, 0, 1);
++	return __devm_reset_control_get(dev, id, 0, true, true);
+ }
+ 
+ /**
+@@ -297,7 +297,7 @@ static inline struct reset_control *devm_reset_control_get_optional_shared(
+ static inline struct reset_control *
+ devm_reset_control_get_exclusive_by_index(struct device *dev, int index)
+ {
+-	return __devm_reset_control_get(dev, NULL, index, 0);
++	return __devm_reset_control_get(dev, NULL, index, false, false);
+ }
+ 
+ /**
+@@ -313,7 +313,7 @@ devm_reset_control_get_exclusive_by_index(struct device *dev, int index)
+ static inline struct reset_control *
+ devm_reset_control_get_shared_by_index(struct device *dev, int index)
+ {
+-	return __devm_reset_control_get(dev, NULL, index, 1);
++	return __devm_reset_control_get(dev, NULL, index, true, false);
+ }
+ 
+ /*
+diff --git a/include/uapi/linux/btrfs_tree.h b/include/uapi/linux/btrfs_tree.h
+index c794c9af6c0f..a1ded2a1bf1d 100644
+--- a/include/uapi/linux/btrfs_tree.h
++++ b/include/uapi/linux/btrfs_tree.h
+@@ -730,6 +730,7 @@ struct btrfs_balance_item {
+ #define BTRFS_FILE_EXTENT_INLINE 0
+ #define BTRFS_FILE_EXTENT_REG 1
+ #define BTRFS_FILE_EXTENT_PREALLOC 2
++#define BTRFS_FILE_EXTENT_TYPES	2
+ 
+ struct btrfs_file_extent_item {
+ 	/*
+diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
+index dafa2708ce9e..1438b7396cb4 100644
+--- a/kernel/bpf/verifier.c
++++ b/kernel/bpf/verifier.c
+@@ -540,10 +540,11 @@ static bool is_spillable_regtype(enum bpf_reg_type type)
+ /* check_stack_read/write functions track spill/fill of registers,
+  * stack boundary and alignment are checked in check_mem_access()
+  */
+-static int check_stack_write(struct bpf_verifier_state *state, int off,
+-			     int size, int value_regno)
++static int check_stack_write(struct bpf_verifier_env *env,
++			     struct bpf_verifier_state *state, int off,
++			     int size, int value_regno, int insn_idx)
+ {
+-	int i;
++	int i, spi = (MAX_BPF_STACK + off) / BPF_REG_SIZE;
+ 	/* caller checked that off % size == 0 and -MAX_BPF_STACK <= off < 0,
+ 	 * so it's aligned access and [off, off + size) are within stack limits
+ 	 */
+@@ -558,15 +559,37 @@ static int check_stack_write(struct bpf_verifier_state *state, int off,
+ 		}
+ 
+ 		/* save register state */
+-		state->spilled_regs[(MAX_BPF_STACK + off) / BPF_REG_SIZE] =
+-			state->regs[value_regno];
+-
+-		for (i = 0; i < BPF_REG_SIZE; i++)
++		state->spilled_regs[spi] = state->regs[value_regno];
++
++		for (i = 0; i < BPF_REG_SIZE; i++) {
++			if (state->stack_slot_type[MAX_BPF_STACK + off + i] == STACK_MISC &&
++			    !env->allow_ptr_leaks) {
++				int *poff = &env->insn_aux_data[insn_idx].sanitize_stack_off;
++				int soff = (-spi - 1) * BPF_REG_SIZE;
++
++				/* detected reuse of integer stack slot with a pointer
++				 * which means either llvm is reusing stack slot or
++				 * an attacker is trying to exploit CVE-2018-3639
++				 * (speculative store bypass)
++				 * Have to sanitize that slot with preemptive
++				 * store of zero.
++				 */
++				if (*poff && *poff != soff) {
++					/* disallow programs where single insn stores
++					 * into two different stack slots, since verifier
++					 * cannot sanitize them
++					 */
++					verbose("insn %d cannot access two stack slots fp%d and fp%d",
++						insn_idx, *poff, soff);
++					return -EINVAL;
++				}
++				*poff = soff;
++			}
+ 			state->stack_slot_type[MAX_BPF_STACK + off + i] = STACK_SPILL;
++		}
+ 	} else {
+ 		/* regular write of data into stack */
+-		state->spilled_regs[(MAX_BPF_STACK + off) / BPF_REG_SIZE] =
+-			(struct bpf_reg_state) {};
++		state->spilled_regs[spi] = (struct bpf_reg_state) {};
+ 
+ 		for (i = 0; i < size; i++)
+ 			state->stack_slot_type[MAX_BPF_STACK + off + i] = STACK_MISC;
+@@ -747,7 +770,7 @@ static int check_ptr_alignment(struct bpf_verifier_env *env,
+  * if t==write && value_regno==-1, some unknown value is stored into memory
+  * if t==read && value_regno==-1, don't care what we read from memory
+  */
+-static int check_mem_access(struct bpf_verifier_env *env, u32 regno, int off,
++static int check_mem_access(struct bpf_verifier_env *env, int insn_idx, u32 regno, int off,
+ 			    int bpf_size, enum bpf_access_type t,
+ 			    int value_regno)
+ {
+@@ -843,7 +866,8 @@ static int check_mem_access(struct bpf_verifier_env *env, u32 regno, int off,
+ 				verbose("attempt to corrupt spilled pointer on stack\n");
+ 				return -EACCES;
+ 			}
+-			err = check_stack_write(state, off, size, value_regno);
++			err = check_stack_write(env, state, off, size,
++						value_regno, insn_idx);
+ 		} else {
+ 			err = check_stack_read(state, off, size, value_regno);
+ 		}
+@@ -877,7 +901,7 @@ static int check_mem_access(struct bpf_verifier_env *env, u32 regno, int off,
+ 	return err;
+ }
+ 
+-static int check_xadd(struct bpf_verifier_env *env, struct bpf_insn *insn)
++static int check_xadd(struct bpf_verifier_env *env, int insn_idx, struct bpf_insn *insn)
+ {
+ 	struct bpf_reg_state *regs = env->cur_state.regs;
+ 	int err;
+@@ -910,13 +934,13 @@ static int check_xadd(struct bpf_verifier_env *env, struct bpf_insn *insn)
+ 	}
+ 
+ 	/* check whether atomic_add can read the memory */
+-	err = check_mem_access(env, insn->dst_reg, insn->off,
++	err = check_mem_access(env, insn_idx, insn->dst_reg, insn->off,
+ 			       BPF_SIZE(insn->code), BPF_READ, -1);
+ 	if (err)
+ 		return err;
+ 
+ 	/* check whether atomic_add can write into the same memory */
+-	return check_mem_access(env, insn->dst_reg, insn->off,
++	return check_mem_access(env, insn_idx, insn->dst_reg, insn->off,
+ 				BPF_SIZE(insn->code), BPF_WRITE, -1);
+ }
+ 
+@@ -1272,7 +1296,7 @@ static int check_call(struct bpf_verifier_env *env, int func_id, int insn_idx)
+ 	 * is inferred from register state.
+ 	 */
+ 	for (i = 0; i < meta.access_size; i++) {
+-		err = check_mem_access(env, meta.regno, i, BPF_B, BPF_WRITE, -1);
++		err = check_mem_access(env, insn_idx, meta.regno, i, BPF_B, BPF_WRITE, -1);
+ 		if (err)
+ 			return err;
+ 	}
+@@ -2938,7 +2962,7 @@ static int do_check(struct bpf_verifier_env *env)
+ 			/* check that memory (src_reg + off) is readable,
+ 			 * the state of dst_reg will be updated by this func
+ 			 */
+-			err = check_mem_access(env, insn->src_reg, insn->off,
++			err = check_mem_access(env, insn_idx, insn->src_reg, insn->off,
+ 					       BPF_SIZE(insn->code), BPF_READ,
+ 					       insn->dst_reg);
+ 			if (err)
+@@ -2978,7 +3002,7 @@ static int do_check(struct bpf_verifier_env *env)
+ 			enum bpf_reg_type *prev_dst_type, dst_reg_type;
+ 
+ 			if (BPF_MODE(insn->code) == BPF_XADD) {
+-				err = check_xadd(env, insn);
++				err = check_xadd(env, insn_idx, insn);
+ 				if (err)
+ 					return err;
+ 				insn_idx++;
+@@ -2997,7 +3021,7 @@ static int do_check(struct bpf_verifier_env *env)
+ 			dst_reg_type = regs[insn->dst_reg].type;
+ 
+ 			/* check that memory (dst_reg + off) is writeable */
+-			err = check_mem_access(env, insn->dst_reg, insn->off,
++			err = check_mem_access(env, insn_idx, insn->dst_reg, insn->off,
+ 					       BPF_SIZE(insn->code), BPF_WRITE,
+ 					       insn->src_reg);
+ 			if (err)
+@@ -3032,7 +3056,7 @@ static int do_check(struct bpf_verifier_env *env)
+ 			}
+ 
+ 			/* check that memory (dst_reg + off) is writeable */
+-			err = check_mem_access(env, insn->dst_reg, insn->off,
++			err = check_mem_access(env, insn_idx, insn->dst_reg, insn->off,
+ 					       BPF_SIZE(insn->code), BPF_WRITE,
+ 					       -1);
+ 			if (err)
+@@ -3369,6 +3393,34 @@ static int convert_ctx_accesses(struct bpf_verifier_env *env)
+ 		else
+ 			continue;
+ 
++		if (type == BPF_WRITE &&
++		    env->insn_aux_data[i + delta].sanitize_stack_off) {
++			struct bpf_insn patch[] = {
++				/* Sanitize suspicious stack slot with zero.
++				 * There are no memory dependencies for this store,
++				 * since it's only using frame pointer and immediate
++				 * constant of zero
++				 */
++				BPF_ST_MEM(BPF_DW, BPF_REG_FP,
++					   env->insn_aux_data[i + delta].sanitize_stack_off,
++					   0),
++				/* the original STX instruction will immediately
++				 * overwrite the same stack slot with appropriate value
++				 */
++				*insn,
++			};
++
++			cnt = ARRAY_SIZE(patch);
++			new_prog = bpf_patch_insn_data(env, i + delta, patch, cnt);
++			if (!new_prog)
++				return -ENOMEM;
++
++			delta    += cnt - 1;
++			env->prog = new_prog;
++			insn      = new_prog->insnsi + i + delta;
++			continue;
++		}
++
+ 		if (env->insn_aux_data[i + delta].ptr_type != PTR_TO_CTX)
+ 			continue;
+ 
+diff --git a/kernel/debug/kdb/kdb_support.c b/kernel/debug/kdb/kdb_support.c
+index 2aed4a33521b..61cd704a21c8 100644
+--- a/kernel/debug/kdb/kdb_support.c
++++ b/kernel/debug/kdb/kdb_support.c
+@@ -129,13 +129,13 @@ int kdbnearsym(unsigned long addr, kdb_symtab_t *symtab)
+ 		}
+ 		if (i >= ARRAY_SIZE(kdb_name_table)) {
+ 			debug_kfree(kdb_name_table[0]);
+-			memcpy(kdb_name_table, kdb_name_table+1,
++			memmove(kdb_name_table, kdb_name_table+1,
+ 			       sizeof(kdb_name_table[0]) *
+ 			       (ARRAY_SIZE(kdb_name_table)-1));
+ 		} else {
+ 			debug_kfree(knt1);
+ 			knt1 = kdb_name_table[i];
+-			memcpy(kdb_name_table+i, kdb_name_table+i+1,
++			memmove(kdb_name_table+i, kdb_name_table+i+1,
+ 			       sizeof(kdb_name_table[0]) *
+ 			       (ARRAY_SIZE(kdb_name_table)-i-1));
+ 		}
+diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c
+index a1de021dccba..fbfab5722254 100644
+--- a/kernel/events/uprobes.c
++++ b/kernel/events/uprobes.c
+@@ -608,7 +608,7 @@ static int prepare_uprobe(struct uprobe *uprobe, struct file *file,
+ 	BUG_ON((uprobe->offset & ~PAGE_MASK) +
+ 			UPROBE_SWBP_INSN_SIZE > PAGE_SIZE);
+ 
+-	smp_wmb(); /* pairs with rmb() in find_active_uprobe() */
++	smp_wmb(); /* pairs with the smp_rmb() in handle_swbp() */
+ 	set_bit(UPROBE_COPY_INSN, &uprobe->flags);
+ 
+  out:
+@@ -1902,10 +1902,18 @@ static void handle_swbp(struct pt_regs *regs)
+ 	 * After we hit the bp, _unregister + _register can install the
+ 	 * new and not-yet-analyzed uprobe at the same address, restart.
+ 	 */
+-	smp_rmb(); /* pairs with wmb() in install_breakpoint() */
+ 	if (unlikely(!test_bit(UPROBE_COPY_INSN, &uprobe->flags)))
+ 		goto out;
+ 
++	/*
++	 * Pairs with the smp_wmb() in prepare_uprobe().
++	 *
++	 * Guarantees that if we see the UPROBE_COPY_INSN bit set, then
++	 * we must also see the stores to &uprobe->arch performed by the
++	 * prepare_uprobe() call.
++	 */
++	smp_rmb();
++
+ 	/* Tracing handlers use ->utask to communicate with fetch methods */
+ 	if (!get_utask())
+ 		goto out;
+diff --git a/lib/kobject.c b/lib/kobject.c
+index b733a83e5294..f58c7f2b229c 100644
+--- a/lib/kobject.c
++++ b/lib/kobject.c
+@@ -127,7 +127,7 @@ static void fill_kobj_path(struct kobject *kobj, char *path, int length)
+ 		int cur = strlen(kobject_name(parent));
+ 		/* back up enough to print this name with '/' */
+ 		length -= cur;
+-		strncpy(path + length, kobject_name(parent), cur);
++		memcpy(path + length, kobject_name(parent), cur);
+ 		*(path + --length) = '/';
+ 	}
+ 
+diff --git a/lib/test_hexdump.c b/lib/test_hexdump.c
+index 3f415d8101f3..1c3c513add77 100644
+--- a/lib/test_hexdump.c
++++ b/lib/test_hexdump.c
+@@ -81,7 +81,7 @@ static void __init test_hexdump_prepare_test(size_t len, int rowsize,
+ 		const char *q = *result++;
+ 		size_t amount = strlen(q);
+ 
+-		strncpy(p, q, amount);
++		memcpy(p, q, amount);
+ 		p += amount;
+ 
+ 		*p++ = ' ';
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index 5e3a4db36310..3e50fcfe6ad8 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -4170,6 +4170,12 @@ int hugetlb_reserve_pages(struct inode *inode,
+ 	struct resv_map *resv_map;
+ 	long gbl_reserve;
+ 
++	/* This should never happen */
++	if (from > to) {
++		VM_WARN(1, "%s called with a negative range\n", __func__);
++		return -EINVAL;
++	}
++
+ 	/*
+ 	 * Only apply hugepage reservation if asked. At fault time, an
+ 	 * attempt will be made for VM_NORESERVE to allocate a page
+@@ -4259,7 +4265,9 @@ int hugetlb_reserve_pages(struct inode *inode,
+ 	return 0;
+ out_err:
+ 	if (!vma || vma->vm_flags & VM_MAYSHARE)
+-		region_abort(resv_map, from, to);
++		/* Don't call region_abort if region_chg failed */
++		if (chg >= 0)
++			region_abort(resv_map, from, to);
+ 	if (vma && is_vma_resv_set(vma, HPAGE_RESV_OWNER))
+ 		kref_put(&resv_map->refs, resv_map_release);
+ 	return ret;
+diff --git a/mm/truncate.c b/mm/truncate.c
+index 9c809e7d73c3..befdc6f575d2 100644
+--- a/mm/truncate.c
++++ b/mm/truncate.c
+@@ -443,9 +443,13 @@ void truncate_inode_pages_final(struct address_space *mapping)
+ 		 */
+ 		spin_lock_irq(&mapping->tree_lock);
+ 		spin_unlock_irq(&mapping->tree_lock);
+-
+-		truncate_inode_pages(mapping, 0);
+ 	}
++
++	/*
++	 * Cleancache needs notification even if there are no pages or shadow
++	 * entries.
++	 */
++	truncate_inode_pages(mapping, 0);
+ }
+ EXPORT_SYMBOL(truncate_inode_pages_final);
+ 
+diff --git a/net/ceph/auth.c b/net/ceph/auth.c
+index c822b3ae1bd3..8e79dca81748 100644
+--- a/net/ceph/auth.c
++++ b/net/ceph/auth.c
+@@ -314,14 +314,30 @@ int ceph_auth_update_authorizer(struct ceph_auth_client *ac,
+ }
+ EXPORT_SYMBOL(ceph_auth_update_authorizer);
+ 
++int ceph_auth_add_authorizer_challenge(struct ceph_auth_client *ac,
++				       struct ceph_authorizer *a,
++				       void *challenge_buf,
++				       int challenge_buf_len)
++{
++	int ret = 0;
++
++	mutex_lock(&ac->mutex);
++	if (ac->ops && ac->ops->add_authorizer_challenge)
++		ret = ac->ops->add_authorizer_challenge(ac, a, challenge_buf,
++							challenge_buf_len);
++	mutex_unlock(&ac->mutex);
++	return ret;
++}
++EXPORT_SYMBOL(ceph_auth_add_authorizer_challenge);
++
+ int ceph_auth_verify_authorizer_reply(struct ceph_auth_client *ac,
+-				      struct ceph_authorizer *a, size_t len)
++				      struct ceph_authorizer *a)
+ {
+ 	int ret = 0;
+ 
+ 	mutex_lock(&ac->mutex);
+ 	if (ac->ops && ac->ops->verify_authorizer_reply)
+-		ret = ac->ops->verify_authorizer_reply(ac, a, len);
++		ret = ac->ops->verify_authorizer_reply(ac, a);
+ 	mutex_unlock(&ac->mutex);
+ 	return ret;
+ }
+diff --git a/net/ceph/auth_x.c b/net/ceph/auth_x.c
+index b216131915e7..29e23b5cb2ed 100644
+--- a/net/ceph/auth_x.c
++++ b/net/ceph/auth_x.c
+@@ -8,6 +8,7 @@
+ 
+ #include <linux/ceph/decode.h>
+ #include <linux/ceph/auth.h>
++#include <linux/ceph/ceph_features.h>
+ #include <linux/ceph/libceph.h>
+ #include <linux/ceph/messenger.h>
+ 
+@@ -69,25 +70,40 @@ static int ceph_x_encrypt(struct ceph_crypto_key *secret, void *buf,
+ 	return sizeof(u32) + ciphertext_len;
+ }
+ 
++static int __ceph_x_decrypt(struct ceph_crypto_key *secret, void *p,
++			    int ciphertext_len)
++{
++	struct ceph_x_encrypt_header *hdr = p;
++	int plaintext_len;
++	int ret;
++
++	ret = ceph_crypt(secret, false, p, ciphertext_len, ciphertext_len,
++			 &plaintext_len);
++	if (ret)
++		return ret;
++
++	if (le64_to_cpu(hdr->magic) != CEPHX_ENC_MAGIC) {
++		pr_err("%s bad magic\n", __func__);
++		return -EINVAL;
++	}
++
++	return plaintext_len - sizeof(*hdr);
++}
++
+ static int ceph_x_decrypt(struct ceph_crypto_key *secret, void **p, void *end)
+ {
+-	struct ceph_x_encrypt_header *hdr = *p + sizeof(u32);
+-	int ciphertext_len, plaintext_len;
++	int ciphertext_len;
+ 	int ret;
+ 
+ 	ceph_decode_32_safe(p, end, ciphertext_len, e_inval);
+ 	ceph_decode_need(p, end, ciphertext_len, e_inval);
+ 
+-	ret = ceph_crypt(secret, false, *p, end - *p, ciphertext_len,
+-			 &plaintext_len);
+-	if (ret)
++	ret = __ceph_x_decrypt(secret, *p, ciphertext_len);
++	if (ret < 0)
+ 		return ret;
+ 
+-	if (hdr->struct_v != 1 || le64_to_cpu(hdr->magic) != CEPHX_ENC_MAGIC)
+-		return -EPERM;
+-
+ 	*p += ciphertext_len;
+-	return plaintext_len - sizeof(struct ceph_x_encrypt_header);
++	return ret;
+ 
+ e_inval:
+ 	return -EINVAL;
+@@ -271,6 +287,51 @@ bad:
+ 	return -EINVAL;
+ }
+ 
++/*
++ * Encode and encrypt the second part (ceph_x_authorize_b) of the
++ * authorizer.  The first part (ceph_x_authorize_a) should already be
++ * encoded.
++ */
++static int encrypt_authorizer(struct ceph_x_authorizer *au,
++			      u64 *server_challenge)
++{
++	struct ceph_x_authorize_a *msg_a;
++	struct ceph_x_authorize_b *msg_b;
++	void *p, *end;
++	int ret;
++
++	msg_a = au->buf->vec.iov_base;
++	WARN_ON(msg_a->ticket_blob.secret_id != cpu_to_le64(au->secret_id));
++	p = (void *)(msg_a + 1) + le32_to_cpu(msg_a->ticket_blob.blob_len);
++	end = au->buf->vec.iov_base + au->buf->vec.iov_len;
++
++	msg_b = p + ceph_x_encrypt_offset();
++	msg_b->struct_v = 2;
++	msg_b->nonce = cpu_to_le64(au->nonce);
++	if (server_challenge) {
++		msg_b->have_challenge = 1;
++		msg_b->server_challenge_plus_one =
++		    cpu_to_le64(*server_challenge + 1);
++	} else {
++		msg_b->have_challenge = 0;
++		msg_b->server_challenge_plus_one = 0;
++	}
++
++	ret = ceph_x_encrypt(&au->session_key, p, end - p, sizeof(*msg_b));
++	if (ret < 0)
++		return ret;
++
++	p += ret;
++	if (server_challenge) {
++		WARN_ON(p != end);
++	} else {
++		WARN_ON(p > end);
++		au->buf->vec.iov_len = p - au->buf->vec.iov_base;
++	}
++
++	return 0;
++}
++
+ static void ceph_x_authorizer_cleanup(struct ceph_x_authorizer *au)
+ {
+ 	ceph_crypto_key_destroy(&au->session_key);
+@@ -287,7 +348,6 @@ static int ceph_x_build_authorizer(struct ceph_auth_client *ac,
+ 	int maxlen;
+ 	struct ceph_x_authorize_a *msg_a;
+ 	struct ceph_x_authorize_b *msg_b;
+-	void *p, *end;
+ 	int ret;
+ 	int ticket_blob_len =
+ 		(th->ticket_blob ? th->ticket_blob->vec.iov_len : 0);
+@@ -331,21 +391,13 @@ static int ceph_x_build_authorizer(struct ceph_auth_client *ac,
+ 	dout(" th %p secret_id %lld %lld\n", th, th->secret_id,
+ 	     le64_to_cpu(msg_a->ticket_blob.secret_id));
+ 
+-	p = msg_a + 1;
+-	p += ticket_blob_len;
+-	end = au->buf->vec.iov_base + au->buf->vec.iov_len;
+-
+-	msg_b = p + ceph_x_encrypt_offset();
+-	msg_b->struct_v = 1;
+ 	get_random_bytes(&au->nonce, sizeof(au->nonce));
+-	msg_b->nonce = cpu_to_le64(au->nonce);
+-	ret = ceph_x_encrypt(&au->session_key, p, end - p, sizeof(*msg_b));
+-	if (ret < 0)
++	ret = encrypt_authorizer(au, NULL);
++	if (ret) {
++		pr_err("failed to encrypt authorizer: %d", ret);
+ 		goto out_au;
++	}
+ 
+-	p += ret;
+-	WARN_ON(p > end);
+-	au->buf->vec.iov_len = p - au->buf->vec.iov_base;
+ 	dout(" built authorizer nonce %llx len %d\n", au->nonce,
+ 	     (int)au->buf->vec.iov_len);
+ 	return 0;
+@@ -622,8 +674,56 @@ static int ceph_x_update_authorizer(
+ 	return 0;
+ }
+ 
++static int decrypt_authorize_challenge(struct ceph_x_authorizer *au,
++				       void *challenge_buf,
++				       int challenge_buf_len,
++				       u64 *server_challenge)
++{
++	struct ceph_x_authorize_challenge *ch =
++	    challenge_buf + sizeof(struct ceph_x_encrypt_header);
++	int ret;
++
++	/* no leading len */
++	ret = __ceph_x_decrypt(&au->session_key, challenge_buf,
++			       challenge_buf_len);
++	if (ret < 0)
++		return ret;
++	if (ret < sizeof(*ch)) {
++		pr_err("bad size %d for ceph_x_authorize_challenge\n", ret);
++		return -EINVAL;
++	}
++
++	*server_challenge = le64_to_cpu(ch->server_challenge);
++	return 0;
++}
++
++static int ceph_x_add_authorizer_challenge(struct ceph_auth_client *ac,
++					   struct ceph_authorizer *a,
++					   void *challenge_buf,
++					   int challenge_buf_len)
++{
++	struct ceph_x_authorizer *au = (void *)a;
++	u64 server_challenge;
++	int ret;
++
++	ret = decrypt_authorize_challenge(au, challenge_buf, challenge_buf_len,
++					  &server_challenge);
++	if (ret) {
++		pr_err("failed to decrypt authorize challenge: %d", ret);
++		return ret;
++	}
++
++	ret = encrypt_authorizer(au, &server_challenge);
++	if (ret) {
++		pr_err("failed to encrypt authorizer w/ challenge: %d", ret);
++		return ret;
++	}
++
++	return 0;
++}
++
+ static int ceph_x_verify_authorizer_reply(struct ceph_auth_client *ac,
+-					  struct ceph_authorizer *a, size_t len)
++					  struct ceph_authorizer *a)
+ {
+ 	struct ceph_x_authorizer *au = (void *)a;
+ 	void *p = au->enc_buf;
+@@ -633,8 +733,10 @@ static int ceph_x_verify_authorizer_reply(struct ceph_auth_client *ac,
+ 	ret = ceph_x_decrypt(&au->session_key, &p, p + CEPHX_AU_ENC_BUF_LEN);
+ 	if (ret < 0)
+ 		return ret;
+-	if (ret != sizeof(*reply))
+-		return -EPERM;
++	if (ret < sizeof(*reply)) {
++		pr_err("bad size %d for ceph_x_authorize_reply\n", ret);
++		return -EINVAL;
++	}
+ 
+ 	if (au->nonce + 1 != le64_to_cpu(reply->nonce_plus_one))
+ 		ret = -EPERM;
+@@ -700,26 +802,64 @@ static int calc_signature(struct ceph_x_authorizer *au, struct ceph_msg *msg,
+ 			  __le64 *psig)
+ {
+ 	void *enc_buf = au->enc_buf;
+-	struct {
+-		__le32 len;
+-		__le32 header_crc;
+-		__le32 front_crc;
+-		__le32 middle_crc;
+-		__le32 data_crc;
+-	} __packed *sigblock = enc_buf + ceph_x_encrypt_offset();
+ 	int ret;
+ 
+-	sigblock->len = cpu_to_le32(4*sizeof(u32));
+-	sigblock->header_crc = msg->hdr.crc;
+-	sigblock->front_crc = msg->footer.front_crc;
+-	sigblock->middle_crc = msg->footer.middle_crc;
+-	sigblock->data_crc =  msg->footer.data_crc;
+-	ret = ceph_x_encrypt(&au->session_key, enc_buf, CEPHX_AU_ENC_BUF_LEN,
+-			     sizeof(*sigblock));
+-	if (ret < 0)
+-		return ret;
++	if (msg->con->peer_features & CEPH_FEATURE_CEPHX_V2) {
++		struct {
++			__le32 len;
++			__le32 header_crc;
++			__le32 front_crc;
++			__le32 middle_crc;
++			__le32 data_crc;
++		} __packed *sigblock = enc_buf + ceph_x_encrypt_offset();
++
++		sigblock->len = cpu_to_le32(4*sizeof(u32));
++		sigblock->header_crc = msg->hdr.crc;
++		sigblock->front_crc = msg->footer.front_crc;
++		sigblock->middle_crc = msg->footer.middle_crc;
++		sigblock->data_crc =  msg->footer.data_crc;
++
++		ret = ceph_x_encrypt(&au->session_key, enc_buf,
++				     CEPHX_AU_ENC_BUF_LEN, sizeof(*sigblock));
++		if (ret < 0)
++			return ret;
++
++		*psig = *(__le64 *)(enc_buf + sizeof(u32));
++	} else {
++		struct {
++			__le32 header_crc;
++			__le32 front_crc;
++			__le32 front_len;
++			__le32 middle_crc;
++			__le32 middle_len;
++			__le32 data_crc;
++			__le32 data_len;
++			__le32 seq_lower_word;
++		} __packed *sigblock = enc_buf;
++		struct {
++			__le64 a, b, c, d;
++		} __packed *penc = enc_buf;
++		int ciphertext_len;
++
++		sigblock->header_crc = msg->hdr.crc;
++		sigblock->front_crc = msg->footer.front_crc;
++		sigblock->front_len = msg->hdr.front_len;
++		sigblock->middle_crc = msg->footer.middle_crc;
++		sigblock->middle_len = msg->hdr.middle_len;
++		sigblock->data_crc =  msg->footer.data_crc;
++		sigblock->data_len = msg->hdr.data_len;
++		sigblock->seq_lower_word = *(__le32 *)&msg->hdr.seq;
++
++		/* no leading len, no ceph_x_encrypt_header */
++		ret = ceph_crypt(&au->session_key, true, enc_buf,
++				 CEPHX_AU_ENC_BUF_LEN, sizeof(*sigblock),
++				 &ciphertext_len);
++		if (ret)
++			return ret;
++
++		*psig = penc->a ^ penc->b ^ penc->c ^ penc->d;
++	}
+ 
+-	*psig = *(__le64 *)(enc_buf + sizeof(u32));
+ 	return 0;
+ }
+ 
+@@ -774,6 +914,7 @@ static const struct ceph_auth_client_ops ceph_x_ops = {
+ 	.handle_reply = ceph_x_handle_reply,
+ 	.create_authorizer = ceph_x_create_authorizer,
+ 	.update_authorizer = ceph_x_update_authorizer,
++	.add_authorizer_challenge = ceph_x_add_authorizer_challenge,
+ 	.verify_authorizer_reply = ceph_x_verify_authorizer_reply,
+ 	.invalidate_authorizer = ceph_x_invalidate_authorizer,
+ 	.reset =  ceph_x_reset,
+diff --git a/net/ceph/auth_x_protocol.h b/net/ceph/auth_x_protocol.h
+index 671d30576c4f..a7cd203aacc2 100644
+--- a/net/ceph/auth_x_protocol.h
++++ b/net/ceph/auth_x_protocol.h
+@@ -69,6 +69,13 @@ struct ceph_x_authorize_a {
+ struct ceph_x_authorize_b {
+ 	__u8 struct_v;
+ 	__le64 nonce;
++	__u8 have_challenge;
++	__le64 server_challenge_plus_one;
++} __attribute__ ((packed));
++
++struct ceph_x_authorize_challenge {
++	__u8 struct_v;
++	__le64 server_challenge;
+ } __attribute__ ((packed));
+ 
+ struct ceph_x_authorize_reply {
+diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
+index 68acf94fae72..5a8075d9f2e7 100644
+--- a/net/ceph/messenger.c
++++ b/net/ceph/messenger.c
+@@ -1394,30 +1394,26 @@ static void prepare_write_keepalive(struct ceph_connection *con)
+  * Connection negotiation.
+  */
+ 
+-static struct ceph_auth_handshake *get_connect_authorizer(struct ceph_connection *con,
+-						int *auth_proto)
++static int get_connect_authorizer(struct ceph_connection *con)
+ {
+ 	struct ceph_auth_handshake *auth;
++	int auth_proto;
+ 
+ 	if (!con->ops->get_authorizer) {
++		con->auth = NULL;
+ 		con->out_connect.authorizer_protocol = CEPH_AUTH_UNKNOWN;
+ 		con->out_connect.authorizer_len = 0;
+-		return NULL;
++		return 0;
+ 	}
+ 
+-	/* Can't hold the mutex while getting authorizer */
+-	mutex_unlock(&con->mutex);
+-	auth = con->ops->get_authorizer(con, auth_proto, con->auth_retry);
+-	mutex_lock(&con->mutex);
+-
++	auth = con->ops->get_authorizer(con, &auth_proto, con->auth_retry);
+ 	if (IS_ERR(auth))
+-		return auth;
+-	if (con->state != CON_STATE_NEGOTIATING)
+-		return ERR_PTR(-EAGAIN);
++		return PTR_ERR(auth);
+ 
+-	con->auth_reply_buf = auth->authorizer_reply_buf;
+-	con->auth_reply_buf_len = auth->authorizer_reply_buf_len;
+-	return auth;
++	con->auth = auth;
++	con->out_connect.authorizer_protocol = cpu_to_le32(auth_proto);
++	con->out_connect.authorizer_len = cpu_to_le32(auth->authorizer_buf_len);
++	return 0;
+ }
+ 
+ /*
+@@ -1433,12 +1429,22 @@ static void prepare_write_banner(struct ceph_connection *con)
+ 	con_flag_set(con, CON_FLAG_WRITE_PENDING);
+ }
+ 
++static void __prepare_write_connect(struct ceph_connection *con)
++{
++	con_out_kvec_add(con, sizeof(con->out_connect), &con->out_connect);
++	if (con->auth)
++		con_out_kvec_add(con, con->auth->authorizer_buf_len,
++				 con->auth->authorizer_buf);
++
++	con->out_more = 0;
++	con_flag_set(con, CON_FLAG_WRITE_PENDING);
++}
++
+ static int prepare_write_connect(struct ceph_connection *con)
+ {
+ 	unsigned int global_seq = get_global_seq(con->msgr, 0);
+ 	int proto;
+-	int auth_proto;
+-	struct ceph_auth_handshake *auth;
++	int ret;
+ 
+ 	switch (con->peer_name.type) {
+ 	case CEPH_ENTITY_TYPE_MON:
+@@ -1465,24 +1471,11 @@ static int prepare_write_connect(struct ceph_connection *con)
+ 	con->out_connect.protocol_version = cpu_to_le32(proto);
+ 	con->out_connect.flags = 0;
+ 
+-	auth_proto = CEPH_AUTH_UNKNOWN;
+-	auth = get_connect_authorizer(con, &auth_proto);
+-	if (IS_ERR(auth))
+-		return PTR_ERR(auth);
+-
+-	con->out_connect.authorizer_protocol = cpu_to_le32(auth_proto);
+-	con->out_connect.authorizer_len = auth ?
+-		cpu_to_le32(auth->authorizer_buf_len) : 0;
+-
+-	con_out_kvec_add(con, sizeof (con->out_connect),
+-					&con->out_connect);
+-	if (auth && auth->authorizer_buf_len)
+-		con_out_kvec_add(con, auth->authorizer_buf_len,
+-					auth->authorizer_buf);
+-
+-	con->out_more = 0;
+-	con_flag_set(con, CON_FLAG_WRITE_PENDING);
++	ret = get_connect_authorizer(con);
++	if (ret)
++		return ret;
+ 
++	__prepare_write_connect(con);
+ 	return 0;
+ }
+ 
+@@ -1743,11 +1736,21 @@ static int read_partial_connect(struct ceph_connection *con)
+ 	if (ret <= 0)
+ 		goto out;
+ 
+-	size = le32_to_cpu(con->in_reply.authorizer_len);
+-	end += size;
+-	ret = read_partial(con, end, size, con->auth_reply_buf);
+-	if (ret <= 0)
+-		goto out;
++	if (con->auth) {
++		size = le32_to_cpu(con->in_reply.authorizer_len);
++		if (size > con->auth->authorizer_reply_buf_len) {
++			pr_err("authorizer reply too big: %d > %zu\n", size,
++			       con->auth->authorizer_reply_buf_len);
++			ret = -EINVAL;
++			goto out;
++		}
++
++		end += size;
++		ret = read_partial(con, end, size,
++				   con->auth->authorizer_reply_buf);
++		if (ret <= 0)
++			goto out;
++	}
+ 
+ 	dout("read_partial_connect %p tag %d, con_seq = %u, g_seq = %u\n",
+ 	     con, (int)con->in_reply.tag,
+@@ -1755,7 +1758,6 @@ static int read_partial_connect(struct ceph_connection *con)
+ 	     le32_to_cpu(con->in_reply.global_seq));
+ out:
+ 	return ret;
+-
+ }
+ 
+ /*
+@@ -2039,13 +2041,28 @@ static int process_connect(struct ceph_connection *con)
+ 
+ 	dout("process_connect on %p tag %d\n", con, (int)con->in_tag);
+ 
+-	if (con->auth_reply_buf) {
++	if (con->auth) {
+ 		/*
+ 		 * Any connection that defines ->get_authorizer()
+-		 * should also define ->verify_authorizer_reply().
++		 * should also define ->add_authorizer_challenge() and
++		 * ->verify_authorizer_reply().
++		 *
+ 		 * See get_connect_authorizer().
+ 		 */
+-		ret = con->ops->verify_authorizer_reply(con, 0);
++		if (con->in_reply.tag == CEPH_MSGR_TAG_CHALLENGE_AUTHORIZER) {
++			ret = con->ops->add_authorizer_challenge(
++				    con, con->auth->authorizer_reply_buf,
++				    le32_to_cpu(con->in_reply.authorizer_len));
++			if (ret < 0)
++				return ret;
++
++			con_out_kvec_reset(con);
++			__prepare_write_connect(con);
++			prepare_read_connect(con);
++			return 0;
++		}
++
++		ret = con->ops->verify_authorizer_reply(con);
+ 		if (ret < 0) {
+ 			con->error_msg = "bad authorize reply";
+ 			return ret;
+diff --git a/net/ceph/osd_client.c b/net/ceph/osd_client.c
+index 0ffeb60cfe67..70ccb0716fc5 100644
+--- a/net/ceph/osd_client.c
++++ b/net/ceph/osd_client.c
+@@ -4478,14 +4478,24 @@ static struct ceph_auth_handshake *get_authorizer(struct ceph_connection *con,
+ 	return auth;
+ }
+ 
++static int add_authorizer_challenge(struct ceph_connection *con,
++				    void *challenge_buf, int challenge_buf_len)
++{
++	struct ceph_osd *o = con->private;
++	struct ceph_osd_client *osdc = o->o_osdc;
++	struct ceph_auth_client *ac = osdc->client->monc.auth;
++
++	return ceph_auth_add_authorizer_challenge(ac, o->o_auth.authorizer,
++					    challenge_buf, challenge_buf_len);
++}
+ 
+-static int verify_authorizer_reply(struct ceph_connection *con, int len)
++static int verify_authorizer_reply(struct ceph_connection *con)
+ {
+ 	struct ceph_osd *o = con->private;
+ 	struct ceph_osd_client *osdc = o->o_osdc;
+ 	struct ceph_auth_client *ac = osdc->client->monc.auth;
+ 
+-	return ceph_auth_verify_authorizer_reply(ac, o->o_auth.authorizer, len);
++	return ceph_auth_verify_authorizer_reply(ac, o->o_auth.authorizer);
+ }
+ 
+ static int invalidate_authorizer(struct ceph_connection *con)
+@@ -4519,6 +4529,7 @@ static const struct ceph_connection_operations osd_con_ops = {
+ 	.put = put_osd_con,
+ 	.dispatch = dispatch,
+ 	.get_authorizer = get_authorizer,
++	.add_authorizer_challenge = add_authorizer_challenge,
+ 	.verify_authorizer_reply = verify_authorizer_reply,
+ 	.invalidate_authorizer = invalidate_authorizer,
+ 	.alloc_msg = alloc_msg,
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index d8d99c21a9c1..e6ee6acac80c 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -261,8 +261,8 @@ static struct net_device *__ip_tunnel_create(struct net *net,
+ 	} else {
+ 		if (strlen(ops->kind) > (IFNAMSIZ - 3))
+ 			goto failed;
+-		strlcpy(name, ops->kind, IFNAMSIZ);
+-		strncat(name, "%d", 2);
++		strcpy(name, ops->kind);
++		strcat(name, "%d");
+ 	}
+ 
+ 	ASSERT_RTNL();
+diff --git a/net/tipc/subscr.c b/net/tipc/subscr.c
+index c2646446e157..d62affeb2a38 100644
+--- a/net/tipc/subscr.c
++++ b/net/tipc/subscr.c
+@@ -389,7 +389,7 @@ int tipc_topsrv_start(struct net *net)
+ 	topsrv->tipc_conn_new		= tipc_subscrb_connect_cb;
+ 	topsrv->tipc_conn_release	= tipc_subscrb_release_cb;
+ 
+-	strncpy(topsrv->name, name, strlen(name) + 1);
++	strscpy(topsrv->name, name, sizeof(topsrv->name));
+ 	tn->topsrv = topsrv;
+ 	atomic_set(&tn->subscription_count, 0);
+ 
+diff --git a/scripts/Makefile.extrawarn b/scripts/Makefile.extrawarn
+index fb3522fd8702..d08b6fbdfa85 100644
+--- a/scripts/Makefile.extrawarn
++++ b/scripts/Makefile.extrawarn
+@@ -10,6 +10,8 @@
+ # are not supported by all versions of the compiler
+ # ==========================================================================
+ 
++KBUILD_CFLAGS += $(call cc-disable-warning, packed-not-aligned)
++
+ ifeq ("$(origin W)", "command line")
+   export KBUILD_ENABLE_EXTRA_GCC_CHECKS := $(W)
+ endif
+@@ -25,6 +27,7 @@ warning-1 += -Wold-style-definition
+ warning-1 += $(call cc-option, -Wmissing-include-dirs)
+ warning-1 += $(call cc-option, -Wunused-but-set-variable)
+ warning-1 += $(call cc-option, -Wunused-const-variable)
++warning-1 += $(call cc-option, -Wpacked-not-aligned)
+ warning-1 += $(call cc-disable-warning, missing-field-initializers)
+ warning-1 += $(call cc-disable-warning, sign-compare)
+ 
+diff --git a/scripts/unifdef.c b/scripts/unifdef.c
+index 7493c0ee51cc..db00e3e30a59 100644
+--- a/scripts/unifdef.c
++++ b/scripts/unifdef.c
+@@ -395,7 +395,7 @@ usage(void)
+  * When we have processed a group that starts off with a known-false
+  * #if/#elif sequence (which has therefore been deleted) followed by a
+  * #elif that we don't understand and therefore must keep, we edit the
+- * latter into a #if to keep the nesting correct. We use strncpy() to
++ * latter into a #if to keep the nesting correct. We use memcpy() to
+  * overwrite the 4 byte token "elif" with "if  " without a '\0' byte.
+  *
+  * When we find a true #elif in a group, the following block will
+@@ -450,7 +450,7 @@ static void Idrop (void) { Fdrop();  ignoreon(); }
+ static void Itrue (void) { Ftrue();  ignoreon(); }
+ static void Ifalse(void) { Ffalse(); ignoreon(); }
+ /* modify this line */
+-static void Mpass (void) { strncpy(keyword, "if  ", 4); Pelif(); }
++static void Mpass (void) { memcpy(keyword, "if  ", 4); Pelif(); }
+ static void Mtrue (void) { keywordedit("else");  state(IS_TRUE_MIDDLE); }
+ static void Melif (void) { keywordedit("endif"); state(IS_FALSE_TRAILER); }
+ static void Melse (void) { keywordedit("endif"); state(IS_FALSE_ELSE); }
+diff --git a/sound/pci/trident/trident.c b/sound/pci/trident/trident.c
+index cedf13b64803..2f18b1cdc2cd 100644
+--- a/sound/pci/trident/trident.c
++++ b/sound/pci/trident/trident.c
+@@ -123,7 +123,7 @@ static int snd_trident_probe(struct pci_dev *pci,
+ 	} else {
+ 		strcpy(card->shortname, "Trident ");
+ 	}
+-	strcat(card->shortname, card->driver);
++	strcat(card->shortname, str);
+ 	sprintf(card->longname, "%s PCI Audio at 0x%lx, irq %d",
+ 		card->shortname, trident->port, trident->irq);
+