[gentoo-commits] proj/linux-patches:4.14 commit in: /

[Mike Pagano]

commit:     112e032ffd1ab1fd8f367da3dd7aa1048a8f281f
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Wed Feb 27 11:21:48 2019 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Wed Feb 27 11:21:48 2019 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=112e032f

proj/linux-patches: Linux patch 4.14.104

Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>

 0000_README               |    4 +
 1103_linux-4.14.104.patch | 1953 +++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 1957 insertions(+)

diff --git a/0000_README b/0000_README
index f326b57..26d07a8 100644
--- a/0000_README
+++ b/0000_README
@@ -455,6 +455,10 @@ Patch:  1102_4.14.103.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.14.103
 
+Patch:  1103_4.14.104.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.14.104
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1103_linux-4.14.104.patch b/1103_linux-4.14.104.patch
new file mode 100644
index 0000000..3db32e7
--- /dev/null
+++ b/1103_linux-4.14.104.patch
@@ -0,0 +1,1953 @@
+diff --git a/Makefile b/Makefile
+index 52d150b1f5efa..967692b8941fc 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 14
+-SUBLEVEL = 103
++SUBLEVEL = 104
+ EXTRAVERSION =
+ NAME = Petit Gorille
+ 
+diff --git a/arch/arc/include/asm/cache.h b/arch/arc/include/asm/cache.h
+index ff7d3232764a2..db681cf4959c8 100644
+--- a/arch/arc/include/asm/cache.h
++++ b/arch/arc/include/asm/cache.h
+@@ -52,6 +52,17 @@
+ #define cache_line_size()	SMP_CACHE_BYTES
+ #define ARCH_DMA_MINALIGN	SMP_CACHE_BYTES
+ 
++/*
++ * Make sure slab-allocated buffers are 64-bit aligned when atomic64_t uses
++ * ARCv2 64-bit atomics (LLOCKD/SCONDD). This guarantess runtime 64-bit
++ * alignment for any atomic64_t embedded in buffer.
++ * Default ARCH_SLAB_MINALIGN is __alignof__(long long) which has a relaxed
++ * value of 4 (and not 8) in ARC ABI.
++ */
++#if defined(CONFIG_ARC_HAS_LL64) && defined(CONFIG_ARC_HAS_LLSC)
++#define ARCH_SLAB_MINALIGN	8
++#endif
++
+ extern void arc_cache_init(void);
+ extern char *arc_cache_mumbojumbo(int cpu_id, char *buf, int len);
+ extern void read_decode_cache_bcr(void);
+diff --git a/arch/arc/kernel/head.S b/arch/arc/kernel/head.S
+index 8b90d25a15cca..1f945d0f40daa 100644
+--- a/arch/arc/kernel/head.S
++++ b/arch/arc/kernel/head.S
+@@ -17,6 +17,7 @@
+ #include <asm/entry.h>
+ #include <asm/arcregs.h>
+ #include <asm/cache.h>
++#include <asm/irqflags.h>
+ 
+ .macro CPU_EARLY_SETUP
+ 
+@@ -47,6 +48,15 @@
+ 	sr	r5, [ARC_REG_DC_CTRL]
+ 
+ 1:
++
++#ifdef CONFIG_ISA_ARCV2
++	; Unaligned access is disabled at reset, so re-enable early as
++	; gcc 7.3.1 (ARC GNU 2018.03) onwards generates unaligned access
++	; by default
++	lr	r5, [status32]
++	bset	r5, r5, STATUS_AD_BIT
++	kflag	r5
++#endif
+ .endm
+ 
+ 	.section .init.text, "ax",@progbits
+@@ -93,9 +103,9 @@ ENTRY(stext)
+ #ifdef CONFIG_ARC_UBOOT_SUPPORT
+ 	; Uboot - kernel ABI
+ 	;    r0 = [0] No uboot interaction, [1] cmdline in r2, [2] DTB in r2
+-	;    r1 = magic number (board identity, unused as of now
++	;    r1 = magic number (always zero as of now)
+ 	;    r2 = pointer to uboot provided cmdline or external DTB in mem
+-	; These are handled later in setup_arch()
++	; These are handled later in handle_uboot_args()
+ 	st	r0, [@uboot_tag]
+ 	st	r2, [@uboot_arg]
+ #endif
+diff --git a/arch/arc/kernel/setup.c b/arch/arc/kernel/setup.c
+index fb83844daeea3..709649e5f9bc1 100644
+--- a/arch/arc/kernel/setup.c
++++ b/arch/arc/kernel/setup.c
+@@ -414,43 +414,80 @@ void setup_processor(void)
+ 	arc_chk_core_config();
+ }
+ 
+-static inline int is_kernel(unsigned long addr)
++static inline bool uboot_arg_invalid(unsigned long addr)
+ {
+-	if (addr >= (unsigned long)_stext && addr <= (unsigned long)_end)
+-		return 1;
+-	return 0;
++	/*
++	 * Check that it is a untranslated address (although MMU is not enabled
++	 * yet, it being a high address ensures this is not by fluke)
++	 */
++	if (addr < PAGE_OFFSET)
++		return true;
++
++	/* Check that address doesn't clobber resident kernel image */
++	return addr >= (unsigned long)_stext && addr <= (unsigned long)_end;
+ }
+ 
+-void __init setup_arch(char **cmdline_p)
++#define IGNORE_ARGS		"Ignore U-boot args: "
++
++/* uboot_tag values for U-boot - kernel ABI revision 0; see head.S */
++#define UBOOT_TAG_NONE		0
++#define UBOOT_TAG_CMDLINE	1
++#define UBOOT_TAG_DTB		2
++
++void __init handle_uboot_args(void)
+ {
++	bool use_embedded_dtb = true;
++	bool append_cmdline = false;
++
+ #ifdef CONFIG_ARC_UBOOT_SUPPORT
+-	/* make sure that uboot passed pointer to cmdline/dtb is valid */
+-	if (uboot_tag && is_kernel((unsigned long)uboot_arg))
+-		panic("Invalid uboot arg\n");
++	/* check that we know this tag */
++	if (uboot_tag != UBOOT_TAG_NONE &&
++	    uboot_tag != UBOOT_TAG_CMDLINE &&
++	    uboot_tag != UBOOT_TAG_DTB) {
++		pr_warn(IGNORE_ARGS "invalid uboot tag: '%08x'\n", uboot_tag);
++		goto ignore_uboot_args;
++	}
++
++	if (uboot_tag != UBOOT_TAG_NONE &&
++            uboot_arg_invalid((unsigned long)uboot_arg)) {
++		pr_warn(IGNORE_ARGS "invalid uboot arg: '%px'\n", uboot_arg);
++		goto ignore_uboot_args;
++	}
++
++	/* see if U-boot passed an external Device Tree blob */
++	if (uboot_tag == UBOOT_TAG_DTB) {
++		machine_desc = setup_machine_fdt((void *)uboot_arg);
+ 
+-	/* See if u-boot passed an external Device Tree blob */
+-	machine_desc = setup_machine_fdt(uboot_arg);	/* uboot_tag == 2 */
+-	if (!machine_desc)
++		/* external Device Tree blob is invalid - use embedded one */
++		use_embedded_dtb = !machine_desc;
++	}
++
++	if (uboot_tag == UBOOT_TAG_CMDLINE)
++		append_cmdline = true;
++
++ignore_uboot_args:
+ #endif
+-	{
+-		/* No, so try the embedded one */
++
++	if (use_embedded_dtb) {
+ 		machine_desc = setup_machine_fdt(__dtb_start);
+ 		if (!machine_desc)
+ 			panic("Embedded DT invalid\n");
++	}
+ 
+-		/*
+-		 * If we are here, it is established that @uboot_arg didn't
+-		 * point to DT blob. Instead if u-boot says it is cmdline,
+-		 * append to embedded DT cmdline.
+-		 * setup_machine_fdt() would have populated @boot_command_line
+-		 */
+-		if (uboot_tag == 1) {
+-			/* Ensure a whitespace between the 2 cmdlines */
+-			strlcat(boot_command_line, " ", COMMAND_LINE_SIZE);
+-			strlcat(boot_command_line, uboot_arg,
+-				COMMAND_LINE_SIZE);
+-		}
++	/*
++	 * NOTE: @boot_command_line is populated by setup_machine_fdt() so this
++	 * append processing can only happen after.
++	 */
++	if (append_cmdline) {
++		/* Ensure a whitespace between the 2 cmdlines */
++		strlcat(boot_command_line, " ", COMMAND_LINE_SIZE);
++		strlcat(boot_command_line, uboot_arg, COMMAND_LINE_SIZE);
+ 	}
++}
++
++void __init setup_arch(char **cmdline_p)
++{
++	handle_uboot_args();
+ 
+ 	/* Save unparsed command line copy for /proc/cmdline */
+ 	*cmdline_p = boot_command_line;
+diff --git a/arch/arm/probes/kprobes/opt-arm.c b/arch/arm/probes/kprobes/opt-arm.c
+index 2c118a6ab3587..0dc23fc227ed2 100644
+--- a/arch/arm/probes/kprobes/opt-arm.c
++++ b/arch/arm/probes/kprobes/opt-arm.c
+@@ -247,7 +247,7 @@ int arch_prepare_optimized_kprobe(struct optimized_kprobe *op, struct kprobe *or
+ 	}
+ 
+ 	/* Copy arch-dep-instance from template. */
+-	memcpy(code, (unsigned char *)optprobe_template_entry,
++	memcpy(code, (unsigned long *)&optprobe_template_entry,
+ 			TMPL_END_IDX * sizeof(kprobe_opcode_t));
+ 
+ 	/* Adjust buffer according to instruction. */
+diff --git a/arch/mips/configs/ath79_defconfig b/arch/mips/configs/ath79_defconfig
+index 25ed914933e5c..8a22978be1e6d 100644
+--- a/arch/mips/configs/ath79_defconfig
++++ b/arch/mips/configs/ath79_defconfig
+@@ -72,6 +72,7 @@ CONFIG_SERIAL_8250_CONSOLE=y
+ # CONFIG_SERIAL_8250_PCI is not set
+ CONFIG_SERIAL_8250_NR_UARTS=1
+ CONFIG_SERIAL_8250_RUNTIME_UARTS=1
++CONFIG_SERIAL_OF_PLATFORM=y
+ CONFIG_SERIAL_AR933X=y
+ CONFIG_SERIAL_AR933X_CONSOLE=y
+ # CONFIG_HW_RANDOM is not set
+diff --git a/arch/mips/jazz/jazzdma.c b/arch/mips/jazz/jazzdma.c
+index d626a9a391cc9..e3c3d9483e140 100644
+--- a/arch/mips/jazz/jazzdma.c
++++ b/arch/mips/jazz/jazzdma.c
+@@ -72,14 +72,15 @@ static int __init vdma_init(void)
+ 						    get_order(VDMA_PGTBL_SIZE));
+ 	BUG_ON(!pgtbl);
+ 	dma_cache_wback_inv((unsigned long)pgtbl, VDMA_PGTBL_SIZE);
+-	pgtbl = (VDMA_PGTBL_ENTRY *)KSEG1ADDR(pgtbl);
++	pgtbl = (VDMA_PGTBL_ENTRY *)CKSEG1ADDR((unsigned long)pgtbl);
+ 
+ 	/*
+ 	 * Clear the R4030 translation table
+ 	 */
+ 	vdma_pgtbl_init();
+ 
+-	r4030_write_reg32(JAZZ_R4030_TRSTBL_BASE, CPHYSADDR(pgtbl));
++	r4030_write_reg32(JAZZ_R4030_TRSTBL_BASE,
++			  CPHYSADDR((unsigned long)pgtbl));
+ 	r4030_write_reg32(JAZZ_R4030_TRSTBL_LIM, VDMA_PGTBL_SIZE);
+ 	r4030_write_reg32(JAZZ_R4030_TRSTBL_INV, 0);
+ 
+diff --git a/arch/mips/net/ebpf_jit.c b/arch/mips/net/ebpf_jit.c
+index 962b0259b4b6e..dd537cba44494 100644
+--- a/arch/mips/net/ebpf_jit.c
++++ b/arch/mips/net/ebpf_jit.c
+@@ -348,12 +348,15 @@ static int build_int_epilogue(struct jit_ctx *ctx, int dest_reg)
+ 	const struct bpf_prog *prog = ctx->skf;
+ 	int stack_adjust = ctx->stack_size;
+ 	int store_offset = stack_adjust - 8;
++	enum reg_val_type td;
+ 	int r0 = MIPS_R_V0;
+ 
+-	if (dest_reg == MIPS_R_RA &&
+-	    get_reg_val_type(ctx, prog->len, BPF_REG_0) == REG_32BIT_ZERO_EX)
++	if (dest_reg == MIPS_R_RA) {
+ 		/* Don't let zero extended value escape. */
+-		emit_instr(ctx, sll, r0, r0, 0);
++		td = get_reg_val_type(ctx, prog->len, BPF_REG_0);
++		if (td == REG_64BIT || td == REG_32BIT_ZERO_EX)
++			emit_instr(ctx, sll, r0, r0, 0);
++	}
+ 
+ 	if (ctx->flags & EBPF_SAVE_RA) {
+ 		emit_instr(ctx, ld, MIPS_R_RA, store_offset, MIPS_R_SP);
+diff --git a/arch/parisc/kernel/ptrace.c b/arch/parisc/kernel/ptrace.c
+index 1a2be6e639b5a..eca5b2a1c7e10 100644
+--- a/arch/parisc/kernel/ptrace.c
++++ b/arch/parisc/kernel/ptrace.c
+@@ -312,15 +312,29 @@ long compat_arch_ptrace(struct task_struct *child, compat_long_t request,
+ 
+ long do_syscall_trace_enter(struct pt_regs *regs)
+ {
+-	if (test_thread_flag(TIF_SYSCALL_TRACE) &&
+-	    tracehook_report_syscall_entry(regs)) {
++	if (test_thread_flag(TIF_SYSCALL_TRACE)) {
++		int rc = tracehook_report_syscall_entry(regs);
++
+ 		/*
+-		 * Tracing decided this syscall should not happen or the
+-		 * debugger stored an invalid system call number. Skip
+-		 * the system call and the system call restart handling.
++		 * As tracesys_next does not set %r28 to -ENOSYS
++		 * when %r20 is set to -1, initialize it here.
+ 		 */
+-		regs->gr[20] = -1UL;
+-		goto out;
++		regs->gr[28] = -ENOSYS;
++
++		if (rc) {
++			/*
++			 * A nonzero return code from
++			 * tracehook_report_syscall_entry() tells us
++			 * to prevent the syscall execution.  Skip
++			 * the syscall call and the syscall restart handling.
++			 *
++			 * Note that the tracer may also just change
++			 * regs->gr[20] to an invalid syscall number,
++			 * that is handled by tracesys_next.
++			 */
++			regs->gr[20] = -1UL;
++			return -1;
++		}
+ 	}
+ 
+ 	/* Do the secure computing check after ptrace. */
+@@ -344,7 +358,6 @@ long do_syscall_trace_enter(struct pt_regs *regs)
+ 			regs->gr[24] & 0xffffffff,
+ 			regs->gr[23] & 0xffffffff);
+ 
+-out:
+ 	/*
+ 	 * Sign extend the syscall number to 64bit since it may have been
+ 	 * modified by a compat ptrace call
+diff --git a/arch/x86/xen/enlighten_pv.c b/arch/x86/xen/enlighten_pv.c
+index fd173e6425ccf..481d7920ea244 100644
+--- a/arch/x86/xen/enlighten_pv.c
++++ b/arch/x86/xen/enlighten_pv.c
+@@ -900,10 +900,7 @@ static u64 xen_read_msr_safe(unsigned int msr, int *err)
+ 	val = native_read_msr_safe(msr, err);
+ 	switch (msr) {
+ 	case MSR_IA32_APICBASE:
+-#ifdef CONFIG_X86_X2APIC
+-		if (!(cpuid_ecx(1) & (1 << (X86_FEATURE_X2APIC & 31))))
+-#endif
+-			val &= ~X2APIC_ENABLE;
++		val &= ~X2APIC_ENABLE;
+ 		break;
+ 	}
+ 	return val;
+diff --git a/drivers/atm/he.c b/drivers/atm/he.c
+index e58538c293777..7ba243691004e 100644
+--- a/drivers/atm/he.c
++++ b/drivers/atm/he.c
+@@ -717,7 +717,7 @@ static int he_init_cs_block_rcm(struct he_dev *he_dev)
+ 			instead of '/ 512', use '>> 9' to prevent a call
+ 			to divdu3 on x86 platforms
+ 		*/
+-		rate_cps = (unsigned long long) (1 << exp) * (man + 512) >> 9;
++		rate_cps = (unsigned long long) (1UL << exp) * (man + 512) >> 9;
+ 
+ 		if (rate_cps < 10)
+ 			rate_cps = 10;	/* 2.2.1 minimum payload rate is 10 cps */
+diff --git a/drivers/gpu/drm/i915/intel_fbdev.c b/drivers/gpu/drm/i915/intel_fbdev.c
+index da2d309574ba9..14eb8a0645622 100644
+--- a/drivers/gpu/drm/i915/intel_fbdev.c
++++ b/drivers/gpu/drm/i915/intel_fbdev.c
+@@ -326,8 +326,8 @@ static bool intel_fb_initial_config(struct drm_fb_helper *fb_helper,
+ 				    bool *enabled, int width, int height)
+ {
+ 	struct drm_i915_private *dev_priv = to_i915(fb_helper->dev);
+-	unsigned long conn_configured, conn_seq, mask;
+ 	unsigned int count = min(fb_helper->connector_count, BITS_PER_LONG);
++	unsigned long conn_configured, conn_seq;
+ 	int i, j;
+ 	bool *save_enabled;
+ 	bool fallback = true, ret = true;
+@@ -345,10 +345,9 @@ static bool intel_fb_initial_config(struct drm_fb_helper *fb_helper,
+ 		drm_modeset_backoff(&ctx);
+ 
+ 	memcpy(save_enabled, enabled, count);
+-	mask = GENMASK(count - 1, 0);
++	conn_seq = GENMASK(count - 1, 0);
+ 	conn_configured = 0;
+ retry:
+-	conn_seq = conn_configured;
+ 	for (i = 0; i < count; i++) {
+ 		struct drm_fb_helper_connector *fb_conn;
+ 		struct drm_connector *connector;
+@@ -361,7 +360,8 @@ retry:
+ 		if (conn_configured & BIT(i))
+ 			continue;
+ 
+-		if (conn_seq == 0 && !connector->has_tile)
++		/* First pass, only consider tiled connectors */
++		if (conn_seq == GENMASK(count - 1, 0) && !connector->has_tile)
+ 			continue;
+ 
+ 		if (connector->status == connector_status_connected)
+@@ -465,8 +465,10 @@ retry:
+ 		conn_configured |= BIT(i);
+ 	}
+ 
+-	if ((conn_configured & mask) != mask && conn_configured != conn_seq)
++	if (conn_configured != conn_seq) { /* repeat until no more are found */
++		conn_seq = conn_configured;
+ 		goto retry;
++	}
+ 
+ 	/*
+ 	 * If the BIOS didn't enable everything it could, fall back to have the
+diff --git a/drivers/gpu/drm/meson/meson_drv.c b/drivers/gpu/drm/meson/meson_drv.c
+index 4ad8223c60eae..5deb44ac67915 100644
+--- a/drivers/gpu/drm/meson/meson_drv.c
++++ b/drivers/gpu/drm/meson/meson_drv.c
+@@ -345,8 +345,10 @@ static int meson_probe_remote(struct platform_device *pdev,
+ 		remote_node = of_graph_get_remote_port_parent(ep);
+ 		if (!remote_node ||
+ 		    remote_node == parent || /* Ignore parent endpoint */
+-		    !of_device_is_available(remote_node))
++		    !of_device_is_available(remote_node)) {
++			of_node_put(remote_node);
+ 			continue;
++		}
+ 
+ 		count += meson_probe_remote(pdev, match, remote, remote_node);
+ 
+@@ -365,10 +367,13 @@ static int meson_drv_probe(struct platform_device *pdev)
+ 
+ 	for_each_endpoint_of_node(np, ep) {
+ 		remote = of_graph_get_remote_port_parent(ep);
+-		if (!remote || !of_device_is_available(remote))
++		if (!remote || !of_device_is_available(remote)) {
++			of_node_put(remote);
+ 			continue;
++		}
+ 
+ 		count += meson_probe_remote(pdev, &match, np, remote);
++		of_node_put(remote);
+ 	}
+ 
+ 	if (count && !match)
+diff --git a/drivers/hwmon/tmp421.c b/drivers/hwmon/tmp421.c
+index e36399213324d..ceb3db6f3fdda 100644
+--- a/drivers/hwmon/tmp421.c
++++ b/drivers/hwmon/tmp421.c
+@@ -88,7 +88,7 @@ static const struct of_device_id tmp421_of_match[] = {
+ 		.data = (void *)2
+ 	},
+ 	{
+-		.compatible = "ti,tmp422",
++		.compatible = "ti,tmp442",
+ 		.data = (void *)3
+ 	},
+ 	{ },
+diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
+index ade98c234dcb3..3f5b5893792cd 100644
+--- a/drivers/infiniband/ulp/srp/ib_srp.c
++++ b/drivers/infiniband/ulp/srp/ib_srp.c
+@@ -2669,7 +2669,6 @@ static int srp_reset_device(struct scsi_cmnd *scmnd)
+ {
+ 	struct srp_target_port *target = host_to_target(scmnd->device->host);
+ 	struct srp_rdma_ch *ch;
+-	int i, j;
+ 	u8 status;
+ 
+ 	shost_printk(KERN_ERR, target->scsi_host, "SRP reset_device called\n");
+@@ -2681,15 +2680,6 @@ static int srp_reset_device(struct scsi_cmnd *scmnd)
+ 	if (status)
+ 		return FAILED;
+ 
+-	for (i = 0; i < target->ch_count; i++) {
+-		ch = &target->ch[i];
+-		for (j = 0; j < target->req_ring_size; ++j) {
+-			struct srp_request *req = &ch->req_ring[j];
+-
+-			srp_finish_req(ch, req, scmnd->device, DID_RESET << 16);
+-		}
+-	}
+-
+ 	return SUCCESS;
+ }
+ 
+diff --git a/drivers/isdn/hardware/avm/b1.c b/drivers/isdn/hardware/avm/b1.c
+index b1833d08a5fea..40a099f33bfc4 100644
+--- a/drivers/isdn/hardware/avm/b1.c
++++ b/drivers/isdn/hardware/avm/b1.c
+@@ -423,7 +423,7 @@ void b1_parse_version(avmctrl_info *cinfo)
+ 	int i, j;
+ 
+ 	for (j = 0; j < AVM_MAXVERSION; j++)
+-		cinfo->version[j] = "\0\0" + 1;
++		cinfo->version[j] = "";
+ 	for (i = 0, j = 0;
+ 	     j < AVM_MAXVERSION && i < cinfo->versionlen;
+ 	     j++, i += cinfo->versionbuf[i] + 1)
+diff --git a/drivers/isdn/i4l/isdn_tty.c b/drivers/isdn/i4l/isdn_tty.c
+index d30130c8d0f3d..b107452e16df7 100644
+--- a/drivers/isdn/i4l/isdn_tty.c
++++ b/drivers/isdn/i4l/isdn_tty.c
+@@ -1456,15 +1456,19 @@ isdn_tty_set_termios(struct tty_struct *tty, struct ktermios *old_termios)
+ {
+ 	modem_info *info = (modem_info *) tty->driver_data;
+ 
++	mutex_lock(&modem_info_mutex);
+ 	if (!old_termios)
+ 		isdn_tty_change_speed(info);
+ 	else {
+ 		if (tty->termios.c_cflag == old_termios->c_cflag &&
+ 		    tty->termios.c_ispeed == old_termios->c_ispeed &&
+-		    tty->termios.c_ospeed == old_termios->c_ospeed)
++		    tty->termios.c_ospeed == old_termios->c_ospeed) {
++			mutex_unlock(&modem_info_mutex);
+ 			return;
++		}
+ 		isdn_tty_change_speed(info);
+ 	}
++	mutex_unlock(&modem_info_mutex);
+ }
+ 
+ /*
+diff --git a/drivers/leds/leds-lp5523.c b/drivers/leds/leds-lp5523.c
+index 924e50aefb003..13838d72e2971 100644
+--- a/drivers/leds/leds-lp5523.c
++++ b/drivers/leds/leds-lp5523.c
+@@ -318,7 +318,9 @@ static int lp5523_init_program_engine(struct lp55xx_chip *chip)
+ 
+ 	/* Let the programs run for couple of ms and check the engine status */
+ 	usleep_range(3000, 6000);
+-	lp55xx_read(chip, LP5523_REG_STATUS, &status);
++	ret = lp55xx_read(chip, LP5523_REG_STATUS, &status);
++	if (ret)
++		return ret;
+ 	status &= LP5523_ENG_STATUS_MASK;
+ 
+ 	if (status != LP5523_ENG_STATUS_MASK) {
+diff --git a/drivers/mfd/ab8500-core.c b/drivers/mfd/ab8500-core.c
+index 30d09d1771717..11ab17f64c649 100644
+--- a/drivers/mfd/ab8500-core.c
++++ b/drivers/mfd/ab8500-core.c
+@@ -261,7 +261,7 @@ static int get_register_interruptible(struct ab8500 *ab8500, u8 bank,
+ 	mutex_unlock(&ab8500->lock);
+ 	dev_vdbg(ab8500->dev, "rd: addr %#x => data %#x\n", addr, ret);
+ 
+-	return ret;
++	return (ret < 0) ? ret : 0;
+ }
+ 
+ static int ab8500_get_register(struct device *dev, u8 bank,
+diff --git a/drivers/mfd/bd9571mwv.c b/drivers/mfd/bd9571mwv.c
+index 64e088dfe7b05..98192d4863e4c 100644
+--- a/drivers/mfd/bd9571mwv.c
++++ b/drivers/mfd/bd9571mwv.c
+@@ -57,6 +57,7 @@ static const struct regmap_access_table bd9571mwv_writable_table = {
+ };
+ 
+ static const struct regmap_range bd9571mwv_volatile_yes_ranges[] = {
++	regmap_reg_range(BD9571MWV_DVFS_MONIVDAC, BD9571MWV_DVFS_MONIVDAC),
+ 	regmap_reg_range(BD9571MWV_GPIO_IN, BD9571MWV_GPIO_IN),
+ 	regmap_reg_range(BD9571MWV_GPIO_INT, BD9571MWV_GPIO_INT),
+ 	regmap_reg_range(BD9571MWV_INT_INTREQ, BD9571MWV_INT_INTREQ),
+diff --git a/drivers/mfd/db8500-prcmu.c b/drivers/mfd/db8500-prcmu.c
+index 5970b8def5487..aec20e1c7d3d5 100644
+--- a/drivers/mfd/db8500-prcmu.c
++++ b/drivers/mfd/db8500-prcmu.c
+@@ -2584,7 +2584,7 @@ static struct irq_chip prcmu_irq_chip = {
+ 	.irq_unmask	= prcmu_irq_unmask,
+ };
+ 
+-static __init char *fw_project_name(u32 project)
++static char *fw_project_name(u32 project)
+ {
+ 	switch (project) {
+ 	case PRCMU_FW_PROJECT_U8500:
+@@ -2732,7 +2732,7 @@ void __init db8500_prcmu_early_init(u32 phy_base, u32 size)
+ 	INIT_WORK(&mb0_transfer.mask_work, prcmu_mask_work);
+ }
+ 
+-static void __init init_prcm_registers(void)
++static void init_prcm_registers(void)
+ {
+ 	u32 val;
+ 
+diff --git a/drivers/mfd/mc13xxx-core.c b/drivers/mfd/mc13xxx-core.c
+index d7f54e492aa61..6c16f170529f5 100644
+--- a/drivers/mfd/mc13xxx-core.c
++++ b/drivers/mfd/mc13xxx-core.c
+@@ -274,7 +274,9 @@ int mc13xxx_adc_do_conversion(struct mc13xxx *mc13xxx, unsigned int mode,
+ 
+ 	mc13xxx->adcflags |= MC13XXX_ADC_WORKING;
+ 
+-	mc13xxx_reg_read(mc13xxx, MC13XXX_ADC0, &old_adc0);
++	ret = mc13xxx_reg_read(mc13xxx, MC13XXX_ADC0, &old_adc0);
++	if (ret)
++		goto out;
+ 
+ 	adc0 = MC13XXX_ADC0_ADINC1 | MC13XXX_ADC0_ADINC2;
+ 	adc1 = MC13XXX_ADC1_ADEN | MC13XXX_ADC1_ADTRIGIGN | MC13XXX_ADC1_ASC;
+diff --git a/drivers/mfd/mt6397-core.c b/drivers/mfd/mt6397-core.c
+index 04a601f6aebe5..0afadea996bbd 100644
+--- a/drivers/mfd/mt6397-core.c
++++ b/drivers/mfd/mt6397-core.c
+@@ -309,8 +309,7 @@ static int mt6397_probe(struct platform_device *pdev)
+ 
+ 	default:
+ 		dev_err(&pdev->dev, "unsupported chip: %d\n", id);
+-		ret = -ENODEV;
+-		break;
++		return -ENODEV;
+ 	}
+ 
+ 	if (ret) {
+diff --git a/drivers/mfd/qcom_rpm.c b/drivers/mfd/qcom_rpm.c
+index 52fafea06067e..8d420c37b2a61 100644
+--- a/drivers/mfd/qcom_rpm.c
++++ b/drivers/mfd/qcom_rpm.c
+@@ -638,6 +638,10 @@ static int qcom_rpm_probe(struct platform_device *pdev)
+ 		return -EFAULT;
+ 	}
+ 
++	writel(fw_version[0], RPM_CTRL_REG(rpm, 0));
++	writel(fw_version[1], RPM_CTRL_REG(rpm, 1));
++	writel(fw_version[2], RPM_CTRL_REG(rpm, 2));
++
+ 	dev_info(&pdev->dev, "RPM firmware %u.%u.%u\n", fw_version[0],
+ 							fw_version[1],
+ 							fw_version[2]);
+diff --git a/drivers/mfd/ti_am335x_tscadc.c b/drivers/mfd/ti_am335x_tscadc.c
+index 7dc1cbcd2fb89..5894d6c16fab8 100644
+--- a/drivers/mfd/ti_am335x_tscadc.c
++++ b/drivers/mfd/ti_am335x_tscadc.c
+@@ -265,8 +265,9 @@ static	int ti_tscadc_probe(struct platform_device *pdev)
+ 		cell->pdata_size = sizeof(tscadc);
+ 	}
+ 
+-	err = mfd_add_devices(&pdev->dev, pdev->id, tscadc->cells,
+-			tscadc->used_cells, NULL, 0, NULL);
++	err = mfd_add_devices(&pdev->dev, PLATFORM_DEVID_AUTO,
++			      tscadc->cells, tscadc->used_cells, NULL,
++			      0, NULL);
+ 	if (err < 0)
+ 		goto err_disable_clk;
+ 
+diff --git a/drivers/mfd/tps65218.c b/drivers/mfd/tps65218.c
+index 13834a0d28172..612f5ecda78fa 100644
+--- a/drivers/mfd/tps65218.c
++++ b/drivers/mfd/tps65218.c
+@@ -243,9 +243,9 @@ static int tps65218_probe(struct i2c_client *client,
+ 
+ 	mutex_init(&tps->tps_lock);
+ 
+-	ret = regmap_add_irq_chip(tps->regmap, tps->irq,
+-			IRQF_ONESHOT, 0, &tps65218_irq_chip,
+-			&tps->irq_data);
++	ret = devm_regmap_add_irq_chip(&client->dev, tps->regmap, tps->irq,
++				       IRQF_ONESHOT, 0, &tps65218_irq_chip,
++				       &tps->irq_data);
+ 	if (ret < 0)
+ 		return ret;
+ 
+@@ -261,26 +261,9 @@ static int tps65218_probe(struct i2c_client *client,
+ 			      ARRAY_SIZE(tps65218_cells), NULL, 0,
+ 			      regmap_irq_get_domain(tps->irq_data));
+ 
+-	if (ret < 0)
+-		goto err_irq;
+-
+-	return 0;
+-
+-err_irq:
+-	regmap_del_irq_chip(tps->irq, tps->irq_data);
+-
+ 	return ret;
+ }
+ 
+-static int tps65218_remove(struct i2c_client *client)
+-{
+-	struct tps65218 *tps = i2c_get_clientdata(client);
+-
+-	regmap_del_irq_chip(tps->irq, tps->irq_data);
+-
+-	return 0;
+-}
+-
+ static const struct i2c_device_id tps65218_id_table[] = {
+ 	{ "tps65218", TPS65218 },
+ 	{ },
+@@ -293,7 +276,6 @@ static struct i2c_driver tps65218_driver = {
+ 		.of_match_table = of_tps65218_match_table,
+ 	},
+ 	.probe		= tps65218_probe,
+-	.remove		= tps65218_remove,
+ 	.id_table       = tps65218_id_table,
+ };
+ 
+diff --git a/drivers/mfd/twl-core.c b/drivers/mfd/twl-core.c
+index d3133a371e277..8f993272901d5 100644
+--- a/drivers/mfd/twl-core.c
++++ b/drivers/mfd/twl-core.c
+@@ -979,7 +979,7 @@ add_children(struct twl4030_platform_data *pdata, unsigned irq_base,
+  * letting it generate the right frequencies for USB, MADC, and
+  * other purposes.
+  */
+-static inline int __init protect_pm_master(void)
++static inline int protect_pm_master(void)
+ {
+ 	int e = 0;
+ 
+@@ -988,7 +988,7 @@ static inline int __init protect_pm_master(void)
+ 	return e;
+ }
+ 
+-static inline int __init unprotect_pm_master(void)
++static inline int unprotect_pm_master(void)
+ {
+ 	int e = 0;
+ 
+diff --git a/drivers/mfd/wm5110-tables.c b/drivers/mfd/wm5110-tables.c
+index 1ee68bd440fbc..16c6e2accfaa5 100644
+--- a/drivers/mfd/wm5110-tables.c
++++ b/drivers/mfd/wm5110-tables.c
+@@ -1618,6 +1618,7 @@ static const struct reg_default wm5110_reg_default[] = {
+ 	{ 0x00000ECD, 0x0000 },    /* R3789  - HPLPF4_2 */
+ 	{ 0x00000EE0, 0x0000 },    /* R3808  - ASRC_ENABLE */
+ 	{ 0x00000EE2, 0x0000 },    /* R3810  - ASRC_RATE1 */
++	{ 0x00000EE3, 0x4000 },    /* R3811  - ASRC_RATE2 */
+ 	{ 0x00000EF0, 0x0000 },    /* R3824  - ISRC 1 CTRL 1 */
+ 	{ 0x00000EF1, 0x0000 },    /* R3825  - ISRC 1 CTRL 2 */
+ 	{ 0x00000EF2, 0x0000 },    /* R3826  - ISRC 1 CTRL 3 */
+@@ -2869,6 +2870,7 @@ static bool wm5110_readable_register(struct device *dev, unsigned int reg)
+ 	case ARIZONA_ASRC_ENABLE:
+ 	case ARIZONA_ASRC_STATUS:
+ 	case ARIZONA_ASRC_RATE1:
++	case ARIZONA_ASRC_RATE2:
+ 	case ARIZONA_ISRC_1_CTRL_1:
+ 	case ARIZONA_ISRC_1_CTRL_2:
+ 	case ARIZONA_ISRC_1_CTRL_3:
+diff --git a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
+index a185a8be79993..53904f257b19d 100644
+--- a/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
++++ b/drivers/net/ethernet/hisilicon/hns/hns_ae_adapt.c
+@@ -147,12 +147,10 @@ static void hns_ae_put_handle(struct hnae_handle *handle)
+ 	struct hnae_vf_cb *vf_cb = hns_ae_get_vf_cb(handle);
+ 	int i;
+ 
+-	vf_cb->mac_cb	 = NULL;
+-
+-	kfree(vf_cb);
+-
+ 	for (i = 0; i < handle->q_num; i++)
+ 		hns_ae_get_ring_pair(handle->qs[i])->used_by_vf = 0;
++
++	kfree(vf_cb);
+ }
+ 
+ static int hns_ae_wait_flow_down(struct hnae_handle *handle)
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+index ab2a9dbb46c7f..8fcf9dd42740f 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+@@ -623,13 +623,27 @@ static int get_fixed_ipv6_csum(__wsum hw_checksum, struct sk_buff *skb,
+ 	return 0;
+ }
+ #endif
++
++#define short_frame(size) ((size) <= ETH_ZLEN + ETH_FCS_LEN)
++
+ static int check_csum(struct mlx4_cqe *cqe, struct sk_buff *skb, void *va,
+ 		      netdev_features_t dev_features)
+ {
+ 	__wsum hw_checksum = 0;
++	void *hdr;
++
++	/* CQE csum doesn't cover padding octets in short ethernet
++	 * frames. And the pad field is appended prior to calculating
++	 * and appending the FCS field.
++	 *
++	 * Detecting these padded frames requires to verify and parse
++	 * IP headers, so we simply force all those small frames to skip
++	 * checksum complete.
++	 */
++	if (short_frame(skb->len))
++		return -EINVAL;
+ 
+-	void *hdr = (u8 *)va + sizeof(struct ethhdr);
+-
++	hdr = (u8 *)va + sizeof(struct ethhdr);
+ 	hw_checksum = csum_unfold((__force __sum16)cqe->checksum);
+ 
+ 	if (cqe->vlan_my_qpn & cpu_to_be32(MLX4_CQE_CVLAN_PRESENT_MASK) &&
+@@ -817,6 +831,11 @@ xdp_drop_no_cnt:
+ 		skb_record_rx_queue(skb, cq_ring);
+ 
+ 		if (likely(dev->features & NETIF_F_RXCSUM)) {
++			/* TODO: For IP non TCP/UDP packets when csum complete is
++			 * not an option (not supported or any other reason) we can
++			 * actually check cqe IPOK status bit and report
++			 * CHECKSUM_UNNECESSARY rather than CHECKSUM_NONE
++			 */
+ 			if (cqe->status & cpu_to_be16(MLX4_CQE_STATUS_TCP |
+ 						      MLX4_CQE_STATUS_UDP)) {
+ 				if ((cqe->status & cpu_to_be16(MLX4_CQE_STATUS_IPOK)) &&
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+index 281911698f72f..e69674d38f167 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rep.c
+@@ -125,6 +125,7 @@ static void mlx5e_rep_update_sw_counters(struct mlx5e_priv *priv)
+ 
+ 			s->tx_packets		+= sq_stats->packets;
+ 			s->tx_bytes		+= sq_stats->bytes;
++			s->tx_queue_dropped	+= sq_stats->dropped;
+ 		}
+ 	}
+ }
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+index 9e0be077df9c1..47003ea4ed651 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_tc.c
+@@ -81,6 +81,7 @@ struct mlx5e_tc_flow_parse_attr {
+ 	struct ip_tunnel_info tun_info;
+ 	struct mlx5_flow_spec spec;
+ 	int num_mod_hdr_actions;
++	int max_mod_hdr_actions;
+ 	void *mod_hdr_actions;
+ 	int mirred_ifindex;
+ };
+@@ -1128,9 +1129,9 @@ static struct mlx5_fields fields[] = {
+ 	OFFLOAD(UDP_DPORT, 2, udp.dest,   0),
+ };
+ 
+-/* On input attr->num_mod_hdr_actions tells how many HW actions can be parsed at
+- * max from the SW pedit action. On success, it says how many HW actions were
+- * actually parsed.
++/* On input attr->max_mod_hdr_actions tells how many HW actions can be parsed at
++ * max from the SW pedit action. On success, attr->num_mod_hdr_actions
++ * says how many HW actions were actually parsed.
+  */
+ static int offload_pedit_fields(struct pedit_headers *masks,
+ 				struct pedit_headers *vals,
+@@ -1153,9 +1154,11 @@ static int offload_pedit_fields(struct pedit_headers *masks,
+ 	add_vals = &vals[TCA_PEDIT_KEY_EX_CMD_ADD];
+ 
+ 	action_size = MLX5_UN_SZ_BYTES(set_action_in_add_action_in_auto);
+-	action = parse_attr->mod_hdr_actions;
+-	max_actions = parse_attr->num_mod_hdr_actions;
+-	nactions = 0;
++	action = parse_attr->mod_hdr_actions +
++		 parse_attr->num_mod_hdr_actions * action_size;
++
++	max_actions = parse_attr->max_mod_hdr_actions;
++	nactions = parse_attr->num_mod_hdr_actions;
+ 
+ 	for (i = 0; i < ARRAY_SIZE(fields); i++) {
+ 		f = &fields[i];
+@@ -1260,7 +1263,7 @@ static int alloc_mod_hdr_actions(struct mlx5e_priv *priv,
+ 	if (!parse_attr->mod_hdr_actions)
+ 		return -ENOMEM;
+ 
+-	parse_attr->num_mod_hdr_actions = max_actions;
++	parse_attr->max_mod_hdr_actions = max_actions;
+ 	return 0;
+ }
+ 
+@@ -1304,9 +1307,11 @@ static int parse_tc_pedit_action(struct mlx5e_priv *priv,
+ 			goto out_err;
+ 	}
+ 
+-	err = alloc_mod_hdr_actions(priv, a, namespace, parse_attr);
+-	if (err)
+-		goto out_err;
++	if (!parse_attr->mod_hdr_actions) {
++		err = alloc_mod_hdr_actions(priv, a, namespace, parse_attr);
++		if (err)
++			goto out_err;
++	}
+ 
+ 	err = offload_pedit_fields(masks, vals, parse_attr);
+ 	if (err < 0)
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+index f33fb95c41895..3ba9f2c079b2a 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+@@ -1086,7 +1086,7 @@ mlxsw_sp_bridge_port_fdb_flush(struct mlxsw_sp *mlxsw_sp,
+ static enum mlxsw_reg_sfd_rec_policy mlxsw_sp_sfd_rec_policy(bool dynamic)
+ {
+ 	return dynamic ? MLXSW_REG_SFD_REC_POLICY_DYNAMIC_ENTRY_INGRESS :
+-			 MLXSW_REG_SFD_REC_POLICY_STATIC_ENTRY;
++			 MLXSW_REG_SFD_REC_POLICY_DYNAMIC_ENTRY_MLAG;
+ }
+ 
+ static enum mlxsw_reg_sfd_op mlxsw_sp_sfd_op(bool adding)
+@@ -1098,7 +1098,7 @@ static enum mlxsw_reg_sfd_op mlxsw_sp_sfd_op(bool adding)
+ static int __mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port,
+ 				     const char *mac, u16 fid, bool adding,
+ 				     enum mlxsw_reg_sfd_rec_action action,
+-				     bool dynamic)
++				     enum mlxsw_reg_sfd_rec_policy policy)
+ {
+ 	char *sfd_pl;
+ 	u8 num_rec;
+@@ -1109,8 +1109,7 @@ static int __mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port,
+ 		return -ENOMEM;
+ 
+ 	mlxsw_reg_sfd_pack(sfd_pl, mlxsw_sp_sfd_op(adding), 0);
+-	mlxsw_reg_sfd_uc_pack(sfd_pl, 0, mlxsw_sp_sfd_rec_policy(dynamic),
+-			      mac, fid, action, local_port);
++	mlxsw_reg_sfd_uc_pack(sfd_pl, 0, policy, mac, fid, action, local_port);
+ 	num_rec = mlxsw_reg_sfd_num_rec_get(sfd_pl);
+ 	err = mlxsw_reg_write(mlxsw_sp->core, MLXSW_REG(sfd), sfd_pl);
+ 	if (err)
+@@ -1129,7 +1128,8 @@ static int mlxsw_sp_port_fdb_uc_op(struct mlxsw_sp *mlxsw_sp, u8 local_port,
+ 				   bool dynamic)
+ {
+ 	return __mlxsw_sp_port_fdb_uc_op(mlxsw_sp, local_port, mac, fid, adding,
+-					 MLXSW_REG_SFD_REC_ACTION_NOP, dynamic);
++					 MLXSW_REG_SFD_REC_ACTION_NOP,
++					 mlxsw_sp_sfd_rec_policy(dynamic));
+ }
+ 
+ int mlxsw_sp_rif_fdb_op(struct mlxsw_sp *mlxsw_sp, const char *mac, u16 fid,
+@@ -1137,7 +1137,7 @@ int mlxsw_sp_rif_fdb_op(struct mlxsw_sp *mlxsw_sp, const char *mac, u16 fid,
+ {
+ 	return __mlxsw_sp_port_fdb_uc_op(mlxsw_sp, 0, mac, fid, adding,
+ 					 MLXSW_REG_SFD_REC_ACTION_FORWARD_IP_ROUTER,
+-					 false);
++					 MLXSW_REG_SFD_REC_POLICY_STATIC_ENTRY);
+ }
+ 
+ static int mlxsw_sp_port_fdb_uc_lag_op(struct mlxsw_sp *mlxsw_sp, u16 lag_id,
+diff --git a/drivers/net/ethernet/qlogic/qed/qed_ll2.c b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+index b73bcbeb5f279..cef619f0ce10b 100644
+--- a/drivers/net/ethernet/qlogic/qed/qed_ll2.c
++++ b/drivers/net/ethernet/qlogic/qed/qed_ll2.c
+@@ -1487,6 +1487,10 @@ static void qed_ll2_post_rx_buffer_notify_fw(struct qed_hwfn *p_hwfn,
+ 	cq_prod = qed_chain_get_prod_idx(&p_rx->rcq_chain);
+ 	rx_prod.bd_prod = cpu_to_le16(bd_prod);
+ 	rx_prod.cqe_prod = cpu_to_le16(cq_prod);
++
++	/* Make sure chain element is updated before ringing the doorbell */
++	dma_wmb();
++
+ 	DIRECT_REG_WR(p_rx->set_prod_addr, *((u32 *)&rx_prod));
+ }
+ 
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
+index c54a50dbd5ac2..d819e8eaba122 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_pci.c
+@@ -299,7 +299,17 @@ static int stmmac_pci_probe(struct pci_dev *pdev,
+  */
+ static void stmmac_pci_remove(struct pci_dev *pdev)
+ {
++	int i;
++
+ 	stmmac_dvr_remove(&pdev->dev);
++
++	for (i = 0; i <= PCI_STD_RESOURCE_END; i++) {
++		if (pci_resource_len(pdev, i) == 0)
++			continue;
++		pcim_iounmap_regions(pdev, BIT(i));
++		break;
++	}
++
+ 	pci_disable_device(pdev);
+ }
+ 
+diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
+index 70ce7da26d1ff..afe335583832b 100644
+--- a/drivers/net/phy/phylink.c
++++ b/drivers/net/phy/phylink.c
+@@ -487,6 +487,17 @@ static void phylink_run_resolve(struct phylink *pl)
+ 		queue_work(system_power_efficient_wq, &pl->resolve);
+ }
+ 
++static void phylink_run_resolve_and_disable(struct phylink *pl, int bit)
++{
++	unsigned long state = pl->phylink_disable_state;
++
++	set_bit(bit, &pl->phylink_disable_state);
++	if (state == 0) {
++		queue_work(system_power_efficient_wq, &pl->resolve);
++		flush_work(&pl->resolve);
++	}
++}
++
+ static const struct sfp_upstream_ops sfp_phylink_ops;
+ 
+ static int phylink_register_sfp(struct phylink *pl, struct device_node *np)
+@@ -776,9 +787,7 @@ void phylink_stop(struct phylink *pl)
+ 	if (pl->sfp_bus)
+ 		sfp_upstream_stop(pl->sfp_bus);
+ 
+-	set_bit(PHYLINK_DISABLE_STOPPED, &pl->phylink_disable_state);
+-	queue_work(system_power_efficient_wq, &pl->resolve);
+-	flush_work(&pl->resolve);
++	phylink_run_resolve_and_disable(pl, PHYLINK_DISABLE_STOPPED);
+ }
+ EXPORT_SYMBOL_GPL(phylink_stop);
+ 
+@@ -1433,9 +1442,7 @@ static void phylink_sfp_link_down(void *upstream)
+ 
+ 	WARN_ON(!lockdep_rtnl_is_held());
+ 
+-	set_bit(PHYLINK_DISABLE_LINK, &pl->phylink_disable_state);
+-	queue_work(system_power_efficient_wq, &pl->resolve);
+-	flush_work(&pl->resolve);
++	phylink_run_resolve_and_disable(pl, PHYLINK_DISABLE_LINK);
+ }
+ 
+ static void phylink_sfp_link_up(void *upstream)
+diff --git a/drivers/net/phy/sfp-bus.c b/drivers/net/phy/sfp-bus.c
+index 7ae815bee52d5..be6016e21d877 100644
+--- a/drivers/net/phy/sfp-bus.c
++++ b/drivers/net/phy/sfp-bus.c
+@@ -276,6 +276,7 @@ static int sfp_register_bus(struct sfp_bus *bus)
+ 				return ret;
+ 		}
+ 	}
++	bus->socket_ops->attach(bus->sfp);
+ 	if (bus->started)
+ 		bus->socket_ops->start(bus->sfp);
+ 	bus->registered = true;
+@@ -289,6 +290,7 @@ static void sfp_unregister_bus(struct sfp_bus *bus)
+ 	if (bus->registered) {
+ 		if (bus->started)
+ 			bus->socket_ops->stop(bus->sfp);
++		bus->socket_ops->detach(bus->sfp);
+ 		if (bus->phydev && ops && ops->disconnect_phy)
+ 			ops->disconnect_phy(bus->upstream);
+ 	}
+diff --git a/drivers/net/phy/sfp.c b/drivers/net/phy/sfp.c
+index 3165bc7b8e1e4..a1b68b19d9124 100644
+--- a/drivers/net/phy/sfp.c
++++ b/drivers/net/phy/sfp.c
+@@ -114,6 +114,7 @@ struct sfp {
+ 
+ 	struct gpio_desc *gpio[GPIO_MAX];
+ 
++	bool attached;
+ 	unsigned int state;
+ 	struct delayed_work poll;
+ 	struct delayed_work timeout;
+@@ -500,7 +501,7 @@ static void sfp_sm_event(struct sfp *sfp, unsigned int event)
+ 	 */
+ 	switch (sfp->sm_mod_state) {
+ 	default:
+-		if (event == SFP_E_INSERT) {
++		if (event == SFP_E_INSERT && sfp->attached) {
+ 			sfp_module_tx_disable(sfp);
+ 			sfp_sm_ins_next(sfp, SFP_MOD_PROBE, T_PROBE_INIT);
+ 		}
+@@ -628,6 +629,19 @@ static void sfp_sm_event(struct sfp *sfp, unsigned int event)
+ 	mutex_unlock(&sfp->sm_mutex);
+ }
+ 
++static void sfp_attach(struct sfp *sfp)
++{
++	sfp->attached = true;
++	if (sfp->state & SFP_F_PRESENT)
++		sfp_sm_event(sfp, SFP_E_INSERT);
++}
++
++static void sfp_detach(struct sfp *sfp)
++{
++	sfp->attached = false;
++	sfp_sm_event(sfp, SFP_E_REMOVE);
++}
++
+ static void sfp_start(struct sfp *sfp)
+ {
+ 	sfp_sm_event(sfp, SFP_E_DEV_UP);
+@@ -687,6 +701,8 @@ static int sfp_module_eeprom(struct sfp *sfp, struct ethtool_eeprom *ee,
+ }
+ 
+ static const struct sfp_socket_ops sfp_module_ops = {
++	.attach = sfp_attach,
++	.detach = sfp_detach,
+ 	.start = sfp_start,
+ 	.stop = sfp_stop,
+ 	.module_info = sfp_module_info,
+@@ -829,10 +845,6 @@ static int sfp_probe(struct platform_device *pdev)
+ 		sfp->set_state = sfp_gpio_set_state;
+ 	}
+ 
+-	sfp->sfp_bus = sfp_register_socket(sfp->dev, sfp, &sfp_module_ops);
+-	if (!sfp->sfp_bus)
+-		return -ENOMEM;
+-
+ 	/* Get the initial state, and always signal TX disable,
+ 	 * since the network interface will not be up.
+ 	 */
+@@ -843,10 +855,6 @@ static int sfp_probe(struct platform_device *pdev)
+ 		sfp->state |= SFP_F_RATE_SELECT;
+ 	sfp_set_state(sfp, sfp->state);
+ 	sfp_module_tx_disable(sfp);
+-	rtnl_lock();
+-	if (sfp->state & SFP_F_PRESENT)
+-		sfp_sm_event(sfp, SFP_E_INSERT);
+-	rtnl_unlock();
+ 
+ 	for (i = 0; i < GPIO_MAX; i++) {
+ 		if (gpio_flags[i] != GPIOD_IN || !sfp->gpio[i])
+@@ -879,6 +887,10 @@ static int sfp_remove(struct platform_device *pdev)
+ 
+ 	sfp_unregister_socket(sfp->sfp_bus);
+ 
++	sfp->sfp_bus = sfp_register_socket(sfp->dev, sfp, &sfp_module_ops);
++	if (!sfp->sfp_bus)
++		return -ENOMEM;
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/net/phy/sfp.h b/drivers/net/phy/sfp.h
+index 31b0acf337e27..64f54b0bbd8c4 100644
+--- a/drivers/net/phy/sfp.h
++++ b/drivers/net/phy/sfp.h
+@@ -7,6 +7,8 @@
+ struct sfp;
+ 
+ struct sfp_socket_ops {
++	void (*attach)(struct sfp *sfp);
++	void (*detach)(struct sfp *sfp);
+ 	void (*start)(struct sfp *sfp);
+ 	void (*stop)(struct sfp *sfp);
+ 	int (*module_info)(struct sfp *sfp, struct ethtool_modinfo *modinfo);
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index bd455a6cc82cf..bb96153f496e0 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -261,17 +261,6 @@ static void __team_option_inst_mark_removed_port(struct team *team,
+ 	}
+ }
+ 
+-static bool __team_option_inst_tmp_find(const struct list_head *opts,
+-					const struct team_option_inst *needle)
+-{
+-	struct team_option_inst *opt_inst;
+-
+-	list_for_each_entry(opt_inst, opts, tmp_list)
+-		if (opt_inst == needle)
+-			return true;
+-	return false;
+-}
+-
+ static int __team_options_register(struct team *team,
+ 				   const struct team_option *option,
+ 				   size_t option_count)
+@@ -2457,7 +2446,6 @@ static int team_nl_cmd_options_set(struct sk_buff *skb, struct genl_info *info)
+ 	int err = 0;
+ 	int i;
+ 	struct nlattr *nl_option;
+-	LIST_HEAD(opt_inst_list);
+ 
+ 	rtnl_lock();
+ 
+@@ -2477,6 +2465,7 @@ static int team_nl_cmd_options_set(struct sk_buff *skb, struct genl_info *info)
+ 		struct nlattr *opt_attrs[TEAM_ATTR_OPTION_MAX + 1];
+ 		struct nlattr *attr;
+ 		struct nlattr *attr_data;
++		LIST_HEAD(opt_inst_list);
+ 		enum team_option_type opt_type;
+ 		int opt_port_ifindex = 0; /* != 0 for per-port options */
+ 		u32 opt_array_index = 0;
+@@ -2581,23 +2570,17 @@ static int team_nl_cmd_options_set(struct sk_buff *skb, struct genl_info *info)
+ 			if (err)
+ 				goto team_put;
+ 			opt_inst->changed = true;
+-
+-			/* dumb/evil user-space can send us duplicate opt,
+-			 * keep only the last one
+-			 */
+-			if (__team_option_inst_tmp_find(&opt_inst_list,
+-							opt_inst))
+-				continue;
+-
+ 			list_add(&opt_inst->tmp_list, &opt_inst_list);
+ 		}
+ 		if (!opt_found) {
+ 			err = -ENOENT;
+ 			goto team_put;
+ 		}
+-	}
+ 
+-	err = team_nl_send_event_options_get(team, &opt_inst_list);
++		err = team_nl_send_event_options_get(team, &opt_inst_list);
++		if (err)
++			break;
++	}
+ 
+ team_put:
+ 	team_nl_team_put(team);
+diff --git a/drivers/phy/tegra/xusb.c b/drivers/phy/tegra/xusb.c
+index 63e916d4d0696..11aa5902a9ac1 100644
+--- a/drivers/phy/tegra/xusb.c
++++ b/drivers/phy/tegra/xusb.c
+@@ -418,7 +418,7 @@ tegra_xusb_port_find_lane(struct tegra_xusb_port *port,
+ {
+ 	struct tegra_xusb_lane *lane, *match = ERR_PTR(-ENODEV);
+ 
+-	for (map = map; map->type; map++) {
++	for (; map->type; map++) {
+ 		if (port->index != map->port)
+ 			continue;
+ 
+diff --git a/drivers/pinctrl/pinctrl-max77620.c b/drivers/pinctrl/pinctrl-max77620.c
+index b8d2180a2bea4..baef91aaf9b87 100644
+--- a/drivers/pinctrl/pinctrl-max77620.c
++++ b/drivers/pinctrl/pinctrl-max77620.c
+@@ -34,14 +34,12 @@ enum max77620_pin_ppdrv {
+ 	MAX77620_PIN_PP_DRV,
+ };
+ 
+-enum max77620_pinconf_param {
+-	MAX77620_ACTIVE_FPS_SOURCE = PIN_CONFIG_END + 1,
+-	MAX77620_ACTIVE_FPS_POWER_ON_SLOTS,
+-	MAX77620_ACTIVE_FPS_POWER_DOWN_SLOTS,
+-	MAX77620_SUSPEND_FPS_SOURCE,
+-	MAX77620_SUSPEND_FPS_POWER_ON_SLOTS,
+-	MAX77620_SUSPEND_FPS_POWER_DOWN_SLOTS,
+-};
++#define MAX77620_ACTIVE_FPS_SOURCE		(PIN_CONFIG_END + 1)
++#define MAX77620_ACTIVE_FPS_POWER_ON_SLOTS	(PIN_CONFIG_END + 2)
++#define MAX77620_ACTIVE_FPS_POWER_DOWN_SLOTS	(PIN_CONFIG_END + 3)
++#define MAX77620_SUSPEND_FPS_SOURCE		(PIN_CONFIG_END + 4)
++#define MAX77620_SUSPEND_FPS_POWER_ON_SLOTS	(PIN_CONFIG_END + 5)
++#define MAX77620_SUSPEND_FPS_POWER_DOWN_SLOTS	(PIN_CONFIG_END + 6)
+ 
+ struct max77620_pin_function {
+ 	const char *name;
+diff --git a/drivers/scsi/isci/init.c b/drivers/scsi/isci/init.c
+index 922e3e56c90d9..c71e0f3b146ab 100644
+--- a/drivers/scsi/isci/init.c
++++ b/drivers/scsi/isci/init.c
+@@ -591,6 +591,13 @@ static struct isci_host *isci_host_alloc(struct pci_dev *pdev, int id)
+ 	shost->max_lun = ~0;
+ 	shost->max_cmd_len = MAX_COMMAND_SIZE;
+ 
++	/* turn on DIF support */
++	scsi_host_set_prot(shost,
++			   SHOST_DIF_TYPE1_PROTECTION |
++			   SHOST_DIF_TYPE2_PROTECTION |
++			   SHOST_DIF_TYPE3_PROTECTION);
++	scsi_host_set_guard(shost, SHOST_DIX_GUARD_CRC);
++
+ 	err = scsi_add_host(shost, &pdev->dev);
+ 	if (err)
+ 		goto err_shost;
+@@ -678,13 +685,6 @@ static int isci_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ 			goto err_host_alloc;
+ 		}
+ 		pci_info->hosts[i] = h;
+-
+-		/* turn on DIF support */
+-		scsi_host_set_prot(to_shost(h),
+-				   SHOST_DIF_TYPE1_PROTECTION |
+-				   SHOST_DIF_TYPE2_PROTECTION |
+-				   SHOST_DIF_TYPE3_PROTECTION);
+-		scsi_host_set_guard(to_shost(h), SHOST_DIX_GUARD_CRC);
+ 	}
+ 
+ 	err = isci_setup_interrupts(pdev);
+diff --git a/drivers/scsi/qedi/qedi_iscsi.c b/drivers/scsi/qedi/qedi_iscsi.c
+index a02b34ea5cab1..45f044f35cea8 100644
+--- a/drivers/scsi/qedi/qedi_iscsi.c
++++ b/drivers/scsi/qedi/qedi_iscsi.c
+@@ -961,6 +961,7 @@ static int qedi_ep_poll(struct iscsi_endpoint *ep, int timeout_ms)
+ 
+ 	qedi_ep = ep->dd_data;
+ 	if (qedi_ep->state == EP_STATE_IDLE ||
++	    qedi_ep->state == EP_STATE_OFLDCONN_NONE ||
+ 	    qedi_ep->state == EP_STATE_OFLDCONN_FAILED)
+ 		return -1;
+ 
+@@ -1043,6 +1044,7 @@ static void qedi_ep_disconnect(struct iscsi_endpoint *ep)
+ 
+ 	switch (qedi_ep->state) {
+ 	case EP_STATE_OFLDCONN_START:
++	case EP_STATE_OFLDCONN_NONE:
+ 		goto ep_release_conn;
+ 	case EP_STATE_OFLDCONN_FAILED:
+ 			break;
+@@ -1233,6 +1235,7 @@ static int qedi_set_path(struct Scsi_Host *shost, struct iscsi_path *path_data)
+ 
+ 	if (!is_valid_ether_addr(&path_data->mac_addr[0])) {
+ 		QEDI_NOTICE(&qedi->dbg_ctx, "dst mac NOT VALID\n");
++		qedi_ep->state = EP_STATE_OFLDCONN_NONE;
+ 		ret = -EIO;
+ 		goto set_path_exit;
+ 	}
+diff --git a/drivers/scsi/qedi/qedi_iscsi.h b/drivers/scsi/qedi/qedi_iscsi.h
+index 3247287cb0e7e..812b4b68e6e48 100644
+--- a/drivers/scsi/qedi/qedi_iscsi.h
++++ b/drivers/scsi/qedi/qedi_iscsi.h
+@@ -59,6 +59,7 @@ enum {
+ 	EP_STATE_OFLDCONN_FAILED        = 0x2000,
+ 	EP_STATE_CONNECT_FAILED         = 0x4000,
+ 	EP_STATE_DISCONN_TIMEDOUT       = 0x8000,
++	EP_STATE_OFLDCONN_NONE          = 0x10000,
+ };
+ 
+ struct qedi_conn;
+diff --git a/drivers/scsi/qla4xxx/ql4_os.c b/drivers/scsi/qla4xxx/ql4_os.c
+index a6aa08d9a171c..22dc70a2138e2 100644
+--- a/drivers/scsi/qla4xxx/ql4_os.c
++++ b/drivers/scsi/qla4xxx/ql4_os.c
+@@ -7241,6 +7241,8 @@ static int qla4xxx_sysfs_ddb_tgt_create(struct scsi_qla_host *ha,
+ 
+ 	rc = qla4xxx_copy_from_fwddb_param(fnode_sess, fnode_conn,
+ 					   fw_ddb_entry);
++	if (rc)
++		goto free_sess;
+ 
+ 	ql4_printk(KERN_INFO, ha, "%s: sysfs entry %s created\n",
+ 		   __func__, fnode_sess->dev.kobj.name);
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 21c81c1feac59..66540491839ea 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -7520,6 +7520,8 @@ out:
+ 	trace_ufshcd_system_resume(dev_name(hba->dev), ret,
+ 		ktime_to_us(ktime_sub(ktime_get(), start)),
+ 		hba->curr_dev_pwr_mode, hba->uic_link_state);
++	if (!ret)
++		hba->is_sys_suspended = false;
+ 	return ret;
+ }
+ EXPORT_SYMBOL(ufshcd_system_resume);
+diff --git a/drivers/xen/pvcalls-back.c b/drivers/xen/pvcalls-back.c
+index 169293c25a915..abd6dbc29ac28 100644
+--- a/drivers/xen/pvcalls-back.c
++++ b/drivers/xen/pvcalls-back.c
+@@ -164,9 +164,10 @@ static void pvcalls_conn_back_read(void *opaque)
+ 
+ 	/* write the data, then modify the indexes */
+ 	virt_wmb();
+-	if (ret < 0)
++	if (ret < 0) {
++		atomic_set(&map->read, 0);
+ 		intf->in_error = ret;
+-	else
++	} else
+ 		intf->in_prod = prod + ret;
+ 	/* update the indexes, then notify the other end */
+ 	virt_wmb();
+@@ -290,13 +291,11 @@ static int pvcalls_back_socket(struct xenbus_device *dev,
+ static void pvcalls_sk_state_change(struct sock *sock)
+ {
+ 	struct sock_mapping *map = sock->sk_user_data;
+-	struct pvcalls_data_intf *intf;
+ 
+ 	if (map == NULL)
+ 		return;
+ 
+-	intf = map->ring;
+-	intf->in_error = -ENOTCONN;
++	atomic_inc(&map->read);
+ 	notify_remote_via_irq(map->irq);
+ }
+ 
+diff --git a/fs/ceph/snap.c b/fs/ceph/snap.c
+index 8a2ca41e4b97c..9b6207c84b689 100644
+--- a/fs/ceph/snap.c
++++ b/fs/ceph/snap.c
+@@ -616,7 +616,8 @@ int __ceph_finish_cap_snap(struct ceph_inode_info *ci,
+ 	     capsnap->size);
+ 
+ 	spin_lock(&mdsc->snap_flush_lock);
+-	list_add_tail(&ci->i_snap_flush_item, &mdsc->snap_flush_list);
++	if (list_empty(&ci->i_snap_flush_item))
++		list_add_tail(&ci->i_snap_flush_item, &mdsc->snap_flush_list);
+ 	spin_unlock(&mdsc->snap_flush_lock);
+ 	return 1;  /* caller may want to ceph_flush_snaps */
+ }
+diff --git a/fs/proc/base.c b/fs/proc/base.c
+index 9063738ff1f03..64695dcf89f3b 100644
+--- a/fs/proc/base.c
++++ b/fs/proc/base.c
+@@ -1108,10 +1108,6 @@ static int __set_oom_adj(struct file *file, int oom_adj, bool legacy)
+ 
+ 			task_lock(p);
+ 			if (!p->vfork_done && process_shares_mm(p, mm)) {
+-				pr_info("updating oom_score_adj for %d (%s) from %d to %d because it shares mm with %d (%s). Report if this is unexpected.\n",
+-						task_pid_nr(p), p->comm,
+-						p->signal->oom_score_adj, oom_adj,
+-						task_pid_nr(task), task->comm);
+ 				p->signal->oom_score_adj = oom_adj;
+ 				if (!legacy && has_capability_noaudit(current, CAP_SYS_RESOURCE))
+ 					p->signal->oom_score_adj_min = (short)oom_adj;
+diff --git a/include/keys/user-type.h b/include/keys/user-type.h
+index e098cbe27db54..12babe9915944 100644
+--- a/include/keys/user-type.h
++++ b/include/keys/user-type.h
+@@ -31,7 +31,7 @@
+ struct user_key_payload {
+ 	struct rcu_head	rcu;		/* RCU destructor */
+ 	unsigned short	datalen;	/* length of this data */
+-	char		data[0];	/* actual data */
++	char		data[0] __aligned(__alignof__(u64)); /* actual data */
+ };
+ 
+ extern struct key_type key_type_user;
+diff --git a/include/linux/qed/qed_chain.h b/include/linux/qed/qed_chain.h
+index 59ddf9af909e4..2dd0a9ed5b361 100644
+--- a/include/linux/qed/qed_chain.h
++++ b/include/linux/qed/qed_chain.h
+@@ -663,6 +663,37 @@ out:
+ static inline void qed_chain_set_prod(struct qed_chain *p_chain,
+ 				      u32 prod_idx, void *p_prod_elem)
+ {
++	if (p_chain->mode == QED_CHAIN_MODE_PBL) {
++		u32 cur_prod, page_mask, page_cnt, page_diff;
++
++		cur_prod = is_chain_u16(p_chain) ? p_chain->u.chain16.prod_idx :
++			   p_chain->u.chain32.prod_idx;
++
++		/* Assume that number of elements in a page is power of 2 */
++		page_mask = ~p_chain->elem_per_page_mask;
++
++		/* Use "cur_prod - 1" and "prod_idx - 1" since producer index
++		 * reaches the first element of next page before the page index
++		 * is incremented. See qed_chain_produce().
++		 * Index wrap around is not a problem because the difference
++		 * between current and given producer indices is always
++		 * positive and lower than the chain's capacity.
++		 */
++		page_diff = (((cur_prod - 1) & page_mask) -
++			     ((prod_idx - 1) & page_mask)) /
++			    p_chain->elem_per_page;
++
++		page_cnt = qed_chain_get_page_cnt(p_chain);
++		if (is_chain_u16(p_chain))
++			p_chain->pbl.c.u16.prod_page_idx =
++				(p_chain->pbl.c.u16.prod_page_idx -
++				 page_diff + page_cnt) % page_cnt;
++		else
++			p_chain->pbl.c.u32.prod_page_idx =
++				(p_chain->pbl.c.u32.prod_page_idx -
++				 page_diff + page_cnt) % page_cnt;
++	}
++
+ 	if (is_chain_u16(p_chain))
+ 		p_chain->u.chain16.prod_idx = (u16) prod_idx;
+ 	else
+diff --git a/include/linux/sched/sysctl.h b/include/linux/sched/sysctl.h
+index d6a18a3839cc2..1c1a1512ec553 100644
+--- a/include/linux/sched/sysctl.h
++++ b/include/linux/sched/sysctl.h
+@@ -38,9 +38,9 @@ extern unsigned int sysctl_numa_balancing_scan_period_max;
+ extern unsigned int sysctl_numa_balancing_scan_size;
+ 
+ #ifdef CONFIG_SCHED_DEBUG
+-extern unsigned int sysctl_sched_migration_cost;
+-extern unsigned int sysctl_sched_nr_migrate;
+-extern unsigned int sysctl_sched_time_avg;
++extern __read_mostly unsigned int sysctl_sched_migration_cost;
++extern __read_mostly unsigned int sysctl_sched_nr_migrate;
++extern __read_mostly unsigned int sysctl_sched_time_avg;
+ 
+ int sched_proc_update_handler(struct ctl_table *table, int write,
+ 		void __user *buffer, size_t *length,
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index 50a4a5968f3a1..3172e14d93984 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -2377,7 +2377,7 @@ static inline void skb_probe_transport_header(struct sk_buff *skb,
+ 		return;
+ 	else if (skb_flow_dissect_flow_keys(skb, &keys, 0))
+ 		skb_set_transport_header(skb, keys.control.thoff);
+-	else
++	else if (offset_hint >= 0)
+ 		skb_set_transport_header(skb, offset_hint);
+ }
+ 
+diff --git a/include/linux/virtio_net.h b/include/linux/virtio_net.h
+index cb462f9ab7dd5..e0348cb0a1dd7 100644
+--- a/include/linux/virtio_net.h
++++ b/include/linux/virtio_net.h
+@@ -57,6 +57,25 @@ static inline int virtio_net_hdr_to_skb(struct sk_buff *skb,
+ 
+ 		if (!skb_partial_csum_set(skb, start, off))
+ 			return -EINVAL;
++	} else {
++		/* gso packets without NEEDS_CSUM do not set transport_offset.
++		 * probe and drop if does not match one of the above types.
++		 */
++		if (gso_type && skb->network_header) {
++			if (!skb->protocol)
++				virtio_net_hdr_set_proto(skb, hdr);
++retry:
++			skb_probe_transport_header(skb, -1);
++			if (!skb_transport_header_was_set(skb)) {
++				/* UFO does not specify ipv4 or 6: try both */
++				if (gso_type & SKB_GSO_UDP &&
++				    skb->protocol == htons(ETH_P_IP)) {
++					skb->protocol = htons(ETH_P_IPV6);
++					goto retry;
++				}
++				return -EINVAL;
++			}
++		}
+ 	}
+ 
+ 	if (hdr->gso_type != VIRTIO_NET_HDR_GSO_NONE) {
+diff --git a/include/uapi/linux/inet_diag.h b/include/uapi/linux/inet_diag.h
+index 817d807e9481d..f7df51ffd2a49 100644
+--- a/include/uapi/linux/inet_diag.h
++++ b/include/uapi/linux/inet_diag.h
+@@ -135,15 +135,21 @@ enum {
+ 	INET_DIAG_TCLASS,
+ 	INET_DIAG_SKMEMINFO,
+ 	INET_DIAG_SHUTDOWN,
+-	INET_DIAG_DCTCPINFO,
+-	INET_DIAG_PROTOCOL,  /* response attribute only */
++
++	/*
++	 * Next extenstions cannot be requested in struct inet_diag_req_v2:
++	 * its field idiag_ext has only 8 bits.
++	 */
++
++	INET_DIAG_DCTCPINFO,	/* request as INET_DIAG_VEGASINFO */
++	INET_DIAG_PROTOCOL,	/* response attribute only */
+ 	INET_DIAG_SKV6ONLY,
+ 	INET_DIAG_LOCALS,
+ 	INET_DIAG_PEERS,
+ 	INET_DIAG_PAD,
+-	INET_DIAG_MARK,
+-	INET_DIAG_BBRINFO,
+-	INET_DIAG_CLASS_ID,
++	INET_DIAG_MARK,		/* only with CAP_NET_ADMIN */
++	INET_DIAG_BBRINFO,	/* request as INET_DIAG_VEGASINFO */
++	INET_DIAG_CLASS_ID,	/* request as INET_DIAG_TCLASS */
+ 	INET_DIAG_MD5SIG,
+ 	__INET_DIAG_MAX,
+ };
+diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
+index e9cbb96cd99e4..bd6e6142473f2 100644
+--- a/kernel/trace/trace.c
++++ b/kernel/trace/trace.c
+@@ -3381,6 +3381,8 @@ static void print_func_help_header_irq(struct trace_buffer *buf, struct seq_file
+ 	const char tgid_space[] = "          ";
+ 	const char space[] = "  ";
+ 
++	print_event_info(buf, m);
++
+ 	seq_printf(m, "#                          %s  _-----=> irqs-off\n",
+ 		   tgid ? tgid_space : space);
+ 	seq_printf(m, "#                          %s / _----=> need-resched\n",
+diff --git a/mm/mempolicy.c b/mm/mempolicy.c
+index 1b93535d875f3..1331645a3794e 100644
+--- a/mm/mempolicy.c
++++ b/mm/mempolicy.c
+@@ -1325,7 +1325,7 @@ static int copy_nodes_to_user(unsigned long __user *mask, unsigned long maxnode,
+ 			      nodemask_t *nodes)
+ {
+ 	unsigned long copy = ALIGN(maxnode-1, 64) / 8;
+-	const int nbytes = BITS_TO_LONGS(MAX_NUMNODES) * sizeof(long);
++	unsigned int nbytes = BITS_TO_LONGS(nr_node_ids) * sizeof(long);
+ 
+ 	if (copy > nbytes) {
+ 		if (copy > PAGE_SIZE)
+@@ -1486,7 +1486,7 @@ SYSCALL_DEFINE5(get_mempolicy, int __user *, policy,
+ 	int uninitialized_var(pval);
+ 	nodemask_t nodes;
+ 
+-	if (nmask != NULL && maxnode < MAX_NUMNODES)
++	if (nmask != NULL && maxnode < nr_node_ids)
+ 		return -EINVAL;
+ 
+ 	err = do_get_mempolicy(&pval, &nodes, addr, flags);
+@@ -1515,7 +1515,7 @@ COMPAT_SYSCALL_DEFINE5(get_mempolicy, int __user *, policy,
+ 	unsigned long nr_bits, alloc_size;
+ 	DECLARE_BITMAP(bm, MAX_NUMNODES);
+ 
+-	nr_bits = min_t(unsigned long, maxnode-1, MAX_NUMNODES);
++	nr_bits = min_t(unsigned long, maxnode-1, nr_node_ids);
+ 	alloc_size = ALIGN(nr_bits, BITS_PER_LONG) / 8;
+ 
+ 	if (nmask)
+diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
+index 3a80beef247c3..7c883420485b8 100644
+--- a/net/batman-adv/soft-interface.c
++++ b/net/batman-adv/soft-interface.c
+@@ -219,6 +219,8 @@ static int batadv_interface_tx(struct sk_buff *skb,
+ 
+ 	switch (ntohs(ethhdr->h_proto)) {
+ 	case ETH_P_8021Q:
++		if (!pskb_may_pull(skb, sizeof(*vhdr)))
++			goto dropped;
+ 		vhdr = vlan_eth_hdr(skb);
+ 
+ 		/* drop batman-in-batman packets to prevent loops */
+diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
+index a813dfe2dc2cf..8dc5c8d69bcd7 100644
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -1390,14 +1390,7 @@ static void br_multicast_query_received(struct net_bridge *br,
+ 		return;
+ 
+ 	br_multicast_update_query_timer(br, query, max_delay);
+-
+-	/* Based on RFC4541, section 2.1.1 IGMP Forwarding Rules,
+-	 * the arrival port for IGMP Queries where the source address
+-	 * is 0.0.0.0 should not be added to router port list.
+-	 */
+-	if ((saddr->proto == htons(ETH_P_IP) && saddr->u.ip4) ||
+-	    saddr->proto == htons(ETH_P_IPV6))
+-		br_multicast_mark_router(br, port);
++	br_multicast_mark_router(br, port);
+ }
+ 
+ static int br_ip4_multicast_query(struct net_bridge *br,
+diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
+index 5fd222dc64b3e..081a41c753413 100644
+--- a/net/ceph/messenger.c
++++ b/net/ceph/messenger.c
+@@ -2057,6 +2057,8 @@ static int process_connect(struct ceph_connection *con)
+ 	dout("process_connect on %p tag %d\n", con, (int)con->in_tag);
+ 
+ 	if (con->auth) {
++		int len = le32_to_cpu(con->in_reply.authorizer_len);
++
+ 		/*
+ 		 * Any connection that defines ->get_authorizer()
+ 		 * should also define ->add_authorizer_challenge() and
+@@ -2066,8 +2068,7 @@ static int process_connect(struct ceph_connection *con)
+ 		 */
+ 		if (con->in_reply.tag == CEPH_MSGR_TAG_CHALLENGE_AUTHORIZER) {
+ 			ret = con->ops->add_authorizer_challenge(
+-				    con, con->auth->authorizer_reply_buf,
+-				    le32_to_cpu(con->in_reply.authorizer_len));
++				    con, con->auth->authorizer_reply_buf, len);
+ 			if (ret < 0)
+ 				return ret;
+ 
+@@ -2077,10 +2078,12 @@ static int process_connect(struct ceph_connection *con)
+ 			return 0;
+ 		}
+ 
+-		ret = con->ops->verify_authorizer_reply(con);
+-		if (ret < 0) {
+-			con->error_msg = "bad authorize reply";
+-			return ret;
++		if (len) {
++			ret = con->ops->verify_authorizer_reply(con);
++			if (ret < 0) {
++				con->error_msg = "bad authorize reply";
++				return ret;
++			}
+ 		}
+ 	}
+ 
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 542fd04bc44da..41ede90fc28f5 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -3102,7 +3102,10 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock,
+ 			sk->sk_rcvlowat = val ? : 1;
+ 			break;
+ 		case SO_MARK:
+-			sk->sk_mark = val;
++			if (sk->sk_mark != val) {
++				sk->sk_mark = val;
++				sk_dst_reset(sk);
++			}
+ 			break;
+ 		default:
+ 			ret = -EINVAL;
+@@ -3128,7 +3131,7 @@ BPF_CALL_5(bpf_setsockopt, struct bpf_sock_ops_kern *, bpf_sock,
+ 			/* Only some options are supported */
+ 			switch (optname) {
+ 			case TCP_BPF_IW:
+-				if (val <= 0 || tp->data_segs_out > 0)
++				if (val <= 0 || tp->data_segs_out > tp->syn_data)
+ 					ret = -EINVAL;
+ 				else
+ 					tp->snd_cwnd = val;
+diff --git a/net/ipv4/inet_diag.c b/net/ipv4/inet_diag.c
+index 857ec3dbb742b..33edccfebc304 100644
+--- a/net/ipv4/inet_diag.c
++++ b/net/ipv4/inet_diag.c
+@@ -109,6 +109,7 @@ static size_t inet_sk_attr_size(struct sock *sk,
+ 		+ nla_total_size(1) /* INET_DIAG_TOS */
+ 		+ nla_total_size(1) /* INET_DIAG_TCLASS */
+ 		+ nla_total_size(4) /* INET_DIAG_MARK */
++		+ nla_total_size(4) /* INET_DIAG_CLASS_ID */
+ 		+ nla_total_size(sizeof(struct inet_diag_meminfo))
+ 		+ nla_total_size(sizeof(struct inet_diag_msg))
+ 		+ nla_total_size(SK_MEMINFO_VARS * sizeof(u32))
+@@ -288,12 +289,19 @@ int inet_sk_diag_fill(struct sock *sk, struct inet_connection_sock *icsk,
+ 			goto errout;
+ 	}
+ 
+-	if (ext & (1 << (INET_DIAG_CLASS_ID - 1))) {
++	if (ext & (1 << (INET_DIAG_CLASS_ID - 1)) ||
++	    ext & (1 << (INET_DIAG_TCLASS - 1))) {
+ 		u32 classid = 0;
+ 
+ #ifdef CONFIG_SOCK_CGROUP_DATA
+ 		classid = sock_cgroup_classid(&sk->sk_cgrp_data);
+ #endif
++		/* Fallback to socket priority if class id isn't set.
++		 * Classful qdiscs use it as direct reference to class.
++		 * For cgroup2 classid is always zero.
++		 */
++		if (!classid)
++			classid = sk->sk_priority;
+ 
+ 		if (nla_put_u32(skb, INET_DIAG_CLASS_ID, classid))
+ 			goto errout;
+diff --git a/net/ipv6/netfilter.c b/net/ipv6/netfilter.c
+index 1f8b1a433b5d6..a776fbc3b2a9f 100644
+--- a/net/ipv6/netfilter.c
++++ b/net/ipv6/netfilter.c
+@@ -24,9 +24,11 @@ int ip6_route_me_harder(struct net *net, struct sk_buff *skb)
+ 	struct sock *sk = sk_to_full_sk(skb->sk);
+ 	unsigned int hh_len;
+ 	struct dst_entry *dst;
++	int strict = (ipv6_addr_type(&iph->daddr) &
++		      (IPV6_ADDR_MULTICAST | IPV6_ADDR_LINKLOCAL));
+ 	struct flowi6 fl6 = {
+ 		.flowi6_oif = sk && sk->sk_bound_dev_if ? sk->sk_bound_dev_if :
+-			rt6_need_strict(&iph->daddr) ? skb_dst(skb)->dev->ifindex : 0,
++			strict ? skb_dst(skb)->dev->ifindex : 0,
+ 		.flowi6_mark = skb->mark,
+ 		.flowi6_uid = sock_net_uid(net, sk),
+ 		.daddr = iph->daddr,
+diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
+index c814077709562..fdeb90dd1c824 100644
+--- a/net/ipv6/seg6.c
++++ b/net/ipv6/seg6.c
+@@ -220,9 +220,7 @@ static int seg6_genl_get_tunsrc(struct sk_buff *skb, struct genl_info *info)
+ 	rcu_read_unlock();
+ 
+ 	genlmsg_end(msg, hdr);
+-	genlmsg_reply(msg, info);
+-
+-	return 0;
++	return genlmsg_reply(msg, info);
+ 
+ nla_put_failure:
+ 	rcu_read_unlock();
+diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
+index 5d00a38cd1cbd..2e55f9894548e 100644
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -540,7 +540,8 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
+ 	}
+ 
+ 	err = 0;
+-	if (!ip6_err_gen_icmpv6_unreach(skb, iph->ihl * 4, type, data_len))
++	if (__in6_dev_get(skb->dev) &&
++	    !ip6_err_gen_icmpv6_unreach(skb, iph->ihl * 4, type, data_len))
+ 		goto out;
+ 
+ 	if (t->parms.iph.daddr == 0)
+diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
+index 63558335e41ee..ebc8045ddee68 100644
+--- a/net/mac80211/cfg.c
++++ b/net/mac80211/cfg.c
+@@ -884,6 +884,7 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
+ 		      BSS_CHANGED_P2P_PS |
+ 		      BSS_CHANGED_TXPOWER;
+ 	int err;
++	int prev_beacon_int;
+ 
+ 	old = sdata_dereference(sdata->u.ap.beacon, sdata);
+ 	if (old)
+@@ -906,6 +907,7 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
+ 
+ 	sdata->needed_rx_chains = sdata->local->rx_chains;
+ 
++	prev_beacon_int = sdata->vif.bss_conf.beacon_int;
+ 	sdata->vif.bss_conf.beacon_int = params->beacon_interval;
+ 
+ 	mutex_lock(&local->mtx);
+@@ -914,8 +916,10 @@ static int ieee80211_start_ap(struct wiphy *wiphy, struct net_device *dev,
+ 	if (!err)
+ 		ieee80211_vif_copy_chanctx_to_vlans(sdata, false);
+ 	mutex_unlock(&local->mtx);
+-	if (err)
++	if (err) {
++		sdata->vif.bss_conf.beacon_int = prev_beacon_int;
+ 		return err;
++	}
+ 
+ 	/*
+ 	 * Apply control port protocol, this allows us to
+diff --git a/net/mac80211/mesh_pathtbl.c b/net/mac80211/mesh_pathtbl.c
+index 97269caafecd7..1ce068865629b 100644
+--- a/net/mac80211/mesh_pathtbl.c
++++ b/net/mac80211/mesh_pathtbl.c
+@@ -448,17 +448,15 @@ struct mesh_path *mesh_path_add(struct ieee80211_sub_if_data *sdata,
+ 
+ 	} while (unlikely(ret == -EEXIST && !mpath));
+ 
+-	if (ret && ret != -EEXIST)
+-		return ERR_PTR(ret);
+-
+-	/* At this point either new_mpath was added, or we found a
+-	 * matching entry already in the table; in the latter case
+-	 * free the unnecessary new entry.
+-	 */
+-	if (ret == -EEXIST) {
++	if (ret) {
+ 		kfree(new_mpath);
++
++		if (ret != -EEXIST)
++			return ERR_PTR(ret);
++
+ 		new_mpath = mpath;
+ 	}
++
+ 	sdata->u.mesh.mesh_paths_generation++;
+ 	return new_mpath;
+ }
+@@ -488,6 +486,9 @@ int mpp_path_add(struct ieee80211_sub_if_data *sdata,
+ 					    &new_mpath->rhash,
+ 					    mesh_rht_params);
+ 
++	if (ret)
++		kfree(new_mpath);
++
+ 	sdata->u.mesh.mpp_paths_generation++;
+ 	return ret;
+ }
+diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
+index 623ec29ade26b..c445d57e3a5bc 100644
+--- a/net/netfilter/nf_tables_api.c
++++ b/net/netfilter/nf_tables_api.c
+@@ -304,6 +304,9 @@ static int nft_delrule_by_chain(struct nft_ctx *ctx)
+ 	int err;
+ 
+ 	list_for_each_entry(rule, &ctx->chain->rules, list) {
++		if (!nft_is_active_next(ctx->net, rule))
++			continue;
++
+ 		err = nft_delrule(ctx, rule);
+ 		if (err < 0)
+ 			return err;
+@@ -4046,6 +4049,8 @@ err6:
+ err5:
+ 	kfree(trans);
+ err4:
++	if (obj)
++		obj->use--;
+ 	kfree(elem.priv);
+ err3:
+ 	if (nla[NFTA_SET_ELEM_DATA] != NULL)
+diff --git a/net/netfilter/nft_compat.c b/net/netfilter/nft_compat.c
+index 7533c2fd6b769..7344ec7fff2a7 100644
+--- a/net/netfilter/nft_compat.c
++++ b/net/netfilter/nft_compat.c
+@@ -277,6 +277,7 @@ nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
+ {
+ 	struct xt_target *target = expr->ops->data;
+ 	void *info = nft_expr_priv(expr);
++	struct module *me = target->me;
+ 	struct xt_tgdtor_param par;
+ 
+ 	par.net = ctx->net;
+@@ -287,7 +288,7 @@ nft_target_destroy(const struct nft_ctx *ctx, const struct nft_expr *expr)
+ 		par.target->destroy(&par);
+ 
+ 	if (nft_xt_put(container_of(expr->ops, struct nft_xt, ops)))
+-		module_put(target->me);
++		module_put(me);
+ }
+ 
+ static int nft_target_dump(struct sk_buff *skb, const struct nft_expr *expr)
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 44a093c755677..a2bd5917a2a9b 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -4313,7 +4313,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u,
+ 		rb->frames_per_block = req->tp_block_size / req->tp_frame_size;
+ 		if (unlikely(rb->frames_per_block == 0))
+ 			goto out;
+-		if (unlikely(req->tp_block_size > UINT_MAX / req->tp_block_nr))
++		if (unlikely(rb->frames_per_block > UINT_MAX / req->tp_block_nr))
+ 			goto out;
+ 		if (unlikely((rb->frames_per_block * req->tp_block_nr) !=
+ 					req->tp_frame_nr))
+diff --git a/net/sctp/offload.c b/net/sctp/offload.c
+index 35bc7106d1827..055e1ab1e9630 100644
+--- a/net/sctp/offload.c
++++ b/net/sctp/offload.c
+@@ -36,6 +36,7 @@ static __le32 sctp_gso_make_checksum(struct sk_buff *skb)
+ {
+ 	skb->ip_summed = CHECKSUM_NONE;
+ 	skb->csum_not_inet = 0;
++	gso_reset_checksum(skb, ~0);
+ 	return sctp_compute_cksum(skb, skb_transport_offset(skb));
+ }
+ 
+diff --git a/net/sctp/sctp_diag.c b/net/sctp/sctp_diag.c
+index a72a7d925d463..75274a60b77ab 100644
+--- a/net/sctp/sctp_diag.c
++++ b/net/sctp/sctp_diag.c
+@@ -225,6 +225,7 @@ static size_t inet_assoc_attr_size(struct sctp_association *asoc)
+ 		+ nla_total_size(1) /* INET_DIAG_TOS */
+ 		+ nla_total_size(1) /* INET_DIAG_TCLASS */
+ 		+ nla_total_size(4) /* INET_DIAG_MARK */
++		+ nla_total_size(4) /* INET_DIAG_CLASS_ID */
+ 		+ nla_total_size(addrlen * asoc->peer.transport_count)
+ 		+ nla_total_size(addrlen * addrcnt)
+ 		+ nla_total_size(sizeof(struct inet_diag_meminfo))
+diff --git a/security/keys/key.c b/security/keys/key.c
+index 83bf4b4afd49d..87172f99f73e0 100644
+--- a/security/keys/key.c
++++ b/security/keys/key.c
+@@ -265,8 +265,8 @@ struct key *key_alloc(struct key_type *type, const char *desc,
+ 
+ 		spin_lock(&user->lock);
+ 		if (!(flags & KEY_ALLOC_QUOTA_OVERRUN)) {
+-			if (user->qnkeys + 1 >= maxkeys ||
+-			    user->qnbytes + quotalen >= maxbytes ||
++			if (user->qnkeys + 1 > maxkeys ||
++			    user->qnbytes + quotalen > maxbytes ||
+ 			    user->qnbytes + quotalen < user->qnbytes)
+ 				goto no_quota;
+ 		}
+diff --git a/security/keys/keyring.c b/security/keys/keyring.c
+index 36f842ec87f04..359b9cba3d0de 100644
+--- a/security/keys/keyring.c
++++ b/security/keys/keyring.c
+@@ -661,9 +661,6 @@ static bool search_nested_keyrings(struct key *keyring,
+ 	BUG_ON((ctx->flags & STATE_CHECKS) == 0 ||
+ 	       (ctx->flags & STATE_CHECKS) == STATE_CHECKS);
+ 
+-	if (ctx->index_key.description)
+-		ctx->index_key.desc_len = strlen(ctx->index_key.description);
+-
+ 	/* Check to see if this top-level keyring is what we are looking for
+ 	 * and whether it is valid or not.
+ 	 */
+@@ -921,6 +918,7 @@ key_ref_t keyring_search(key_ref_t keyring,
+ 	struct keyring_search_context ctx = {
+ 		.index_key.type		= type,
+ 		.index_key.description	= description,
++		.index_key.desc_len	= strlen(description),
+ 		.cred			= current_cred(),
+ 		.match_data.cmp		= key_default_cmp,
+ 		.match_data.raw_data	= description,
+diff --git a/security/keys/proc.c b/security/keys/proc.c
+index 6d1fcbba1e096..0ee9a36e68151 100644
+--- a/security/keys/proc.c
++++ b/security/keys/proc.c
+@@ -188,8 +188,7 @@ static int proc_keys_show(struct seq_file *m, void *v)
+ 	int rc;
+ 
+ 	struct keyring_search_context ctx = {
+-		.index_key.type		= key->type,
+-		.index_key.description	= key->description,
++		.index_key		= key->index_key,
+ 		.cred			= m->file->f_cred,
+ 		.match_data.cmp		= lookup_user_key_possessed,
+ 		.match_data.raw_data	= key,
+diff --git a/security/keys/request_key.c b/security/keys/request_key.c
+index 7dc7413821542..c707fdbb34294 100644
+--- a/security/keys/request_key.c
++++ b/security/keys/request_key.c
+@@ -545,6 +545,7 @@ struct key *request_key_and_link(struct key_type *type,
+ 	struct keyring_search_context ctx = {
+ 		.index_key.type		= type,
+ 		.index_key.description	= description,
++		.index_key.desc_len	= strlen(description),
+ 		.cred			= current_cred(),
+ 		.match_data.cmp		= key_default_cmp,
+ 		.match_data.raw_data	= description,
+diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c
+index 424e1d90412ea..6797843154f03 100644
+--- a/security/keys/request_key_auth.c
++++ b/security/keys/request_key_auth.c
+@@ -246,7 +246,7 @@ struct key *key_get_instantiation_authkey(key_serial_t target_id)
+ 	struct key *authkey;
+ 	key_ref_t authkey_ref;
+ 
+-	sprintf(description, "%x", target_id);
++	ctx.index_key.desc_len = sprintf(description, "%x", target_id);
+ 
+ 	authkey_ref = search_process_keyrings(&ctx);
+