Merge tag 'v4.4'

Linux 4.4

35 files changed, 1004 insertions, 148 deletions

diff --git a/lib/842/842.h b/lib/842/842.h
index 7c200030acf7..e0a122bc1cdb 100644
--- a/lib/842/842.h
+++ b/lib/842/842.h
@@ -76,6 +76,7 @@
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/bitops.h>
+#include <linux/crc32.h>
 #include <asm/unaligned.h>
 
 #include <linux/sw842.h>
@@ -98,6 +99,7 @@
 #define I2_BITS         (8)
 #define I4_BITS         (9)
 #define I8_BITS         (8)
+#define CRC_BITS        (32)
 
 #define REPEAT_BITS_MAX         (0x3f)
 #define SHORT_DATA_BITS_MAX     (0x7)
diff --git a/lib/842/842_compress.c b/lib/842/842_compress.c
index 7ce68948e68c..4051339bdfbd 100644
--- a/lib/842/842_compress.c
+++ b/lib/842/842_compress.c
@@ -490,6 +490,7 @@ int sw842_compress(const u8 *in, unsigned int ilen,
         int ret;
         u64 last, next, pad, total;
         u8 repeat_count = 0;
+        u32 crc;
 
         BUILD_BUG_ON(sizeof(*p) > SW842_MEM_COMPRESS);
 
@@ -580,6 +581,18 @@ skip_comp:
         if (ret)
                 return ret;
 
+        /*
+         * crc(0:31) is appended to target data starting with the next
+         * bit after End of stream template.
+         * nx842 calculates CRC for data in big-endian format. So doing
+         * same here so that sw842 decompression can be used for both
+         * compressed data.
+         */
+        crc = crc32_be(0, in, ilen);
+        ret = add_bits(p, crc, CRC_BITS);
+        if (ret)
+                return ret;
+
         if (p->bit) {
                 p->out++;
                 p->olen--;
diff --git a/lib/842/842_decompress.c b/lib/842/842_decompress.c
index 5446ff0c9ba0..8881dad2a6a0 100644
--- a/lib/842/842_decompress.c
+++ b/lib/842/842_decompress.c
@@ -285,6 +285,7 @@ int sw842_decompress(const u8 *in, unsigned int ilen,
         struct sw842_param p;
         int ret;
         u64 op, rep, tmp, bytes, total;
+        u64 crc;
 
         p.in = (u8 *)in;
         p.bit = 0;
@@ -375,6 +376,22 @@ int sw842_decompress(const u8 *in, unsigned int ilen,
                 }
         } while (op != OP_END);
 
+        /*
+         * crc(0:31) is saved in compressed data starting with the
+         * next bit after End of stream template.
+         */
+        ret = next_bits(&p, &crc, CRC_BITS);
+        if (ret)
+                return ret;
+
+        /*
+         * Validate CRC saved in compressed data.
+         */
+        if (crc != (u64)crc32_be(0, out, total - p.olen)) {
+                pr_debug("CRC mismatch for decompression\n");
+                return -EINVAL;
+        }
+
         if (unlikely((total - p.olen) > UINT_MAX))
                 return -ENOSPC;
 
diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 1d1521c26302..8c15b29d5adc 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -312,6 +312,15 @@ config DEBUG_SECTION_MISMATCH
           - Enable verbose reporting from modpost in order to help resolve
             the section mismatches that are reported.
 
+config SECTION_MISMATCH_WARN_ONLY
+        bool "Make section mismatch errors non-fatal"
+        default y
+        help
+          If you say N here, the build process will fail if there are any
+          section mismatch, instead of just throwing warnings.
+
+          If unsure, say Y.
+
 #
 # Select this config option from the architecture Kconfig, if it
 # is preferred to always offer frame pointers as a config
@@ -1686,6 +1695,9 @@ config TEST_STRING_HELPERS
 config TEST_KSTRTOX
         tristate "Test kstrto*() family of functions at runtime"
 
+config TEST_PRINTF
+        tristate "Test printf() family of functions at runtime"
+
 config TEST_RHASHTABLE
         tristate "Perform selftest on resizable hash table"
         default n
diff --git a/lib/Kconfig.kasan b/lib/Kconfig.kasan
index 39f24d6721e5..0fee5acd5aa0 100644
--- a/lib/Kconfig.kasan
+++ b/lib/Kconfig.kasan
@@ -15,8 +15,7 @@ config KASAN
           global variables requires gcc 5.0 or later.
           This feature consumes about 1/8 of available memory and brings about
           ~x3 performance slowdown.
-          For better error detection enable CONFIG_STACKTRACE,
-          and add slub_debug=U to boot cmdline.
+          For better error detection enable CONFIG_STACKTRACE.
 
 choice
         prompt "Instrumentation type"
diff --git a/lib/Makefile b/lib/Makefile
index 13a7c6ae3fec..7f1de26613d2 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -26,7 +26,8 @@ obj-y += bcd.o div64.o sort.o parser.o halfmd4.o debug_locks.o random32.o \
          bust_spinlocks.o kasprintf.o bitmap.o scatterlist.o \
          gcd.o lcm.o list_sort.o uuid.o flex_array.o iov_iter.o clz_ctz.o \
          bsearch.o find_bit.o llist.o memweight.o kfifo.o \
-         percpu-refcount.o percpu_ida.o rhashtable.o reciprocal_div.o
+         percpu-refcount.o percpu_ida.o rhashtable.o reciprocal_div.o \
+         once.o
 obj-y += string_helpers.o
 obj-$(CONFIG_TEST_STRING_HELPERS) += test-string_helpers.o
 obj-y += hexdump.o
@@ -41,6 +42,7 @@ obj-$(CONFIG_TEST_RHASHTABLE) += test_rhashtable.o
 obj-$(CONFIG_TEST_USER_COPY) += test_user_copy.o
 obj-$(CONFIG_TEST_STATIC_KEYS) += test_static_keys.o
 obj-$(CONFIG_TEST_STATIC_KEYS) += test_static_key_base.o
+obj-$(CONFIG_TEST_PRINTF) += test_printf.o
 
 ifeq ($(CONFIG_DEBUG_KOBJECT),y)
 CFLAGS_kobject.o += -DDEBUG
diff --git a/lib/btree.c b/lib/btree.c
index 4264871ea1a0..f93a945274af 100644
--- a/lib/btree.c
+++ b/lib/btree.c
@@ -5,7 +5,7 @@
  *
  * Copyright (c) 2007-2008 Joern Engel <joern@logfs.org>
  * Bits and pieces stolen from Peter Zijlstra's code, which is
- * Copyright 2007, Red Hat Inc. Peter Zijlstra <pzijlstr@redhat.com>
+ * Copyright 2007, Red Hat Inc. Peter Zijlstra
  * GPLv2
  *
  * see http://programming.kicks-ass.net/kernel-patches/vma_lookup/btree.patch
diff --git a/lib/devres.c b/lib/devres.c
index f13a2468ff39..8c85672639d3 100644
--- a/lib/devres.c
+++ b/lib/devres.c
@@ -418,7 +418,7 @@ void pcim_iounmap_regions(struct pci_dev *pdev, int mask)
         if (!iomap)
                 return;
 
-        for (i = 0; i < DEVICE_COUNT_RESOURCE; i++) {
+        for (i = 0; i < PCIM_IOMAP_MAX; i++) {
                 if (!(mask & (1 << i)))
                         continue;
 
diff --git a/lib/digsig.c b/lib/digsig.c
index ae05ea393fc8..07be6c1ef4e2 100644
--- a/lib/digsig.c
+++ b/lib/digsig.c
@@ -79,12 +79,13 @@ static int digsig_verify_rsa(struct key *key,
         unsigned char *out1 = NULL;
         const char *m;
         MPI in = NULL, res = NULL, pkey[2];
-        uint8_t *p, *datap, *endp;
-        struct user_key_payload *ukp;
+        uint8_t *p, *datap;
+        const uint8_t *endp;
+        const struct user_key_payload *ukp;
         struct pubkey_hdr *pkh;
 
         down_read(&key->sem);
-        ukp = key->payload.data;
+        ukp = user_key_payload(key);
 
         if (ukp->datalen < sizeof(*pkh))
                 goto err1;
diff --git a/lib/div64.c b/lib/div64.c
index 19ea7ed4b948..62a698a432bc 100644
--- a/lib/div64.c
+++ b/lib/div64.c
@@ -162,7 +162,7 @@ s64 div64_s64(s64 dividend, s64 divisor)
 {
         s64 quot, t;
 
-        quot = div64_u64(abs64(dividend), abs64(divisor));
+        quot = div64_u64(abs(dividend), abs(divisor));
         t = (dividend ^ divisor) >> 63;
 
         return (quot ^ t) - t;
diff --git a/lib/dma-debug.c b/lib/dma-debug.c
index dace71fe41f7..d34bd24c2c84 100644
--- a/lib/dma-debug.c
+++ b/lib/dma-debug.c
@@ -100,7 +100,7 @@ static LIST_HEAD(free_entries);
 static DEFINE_SPINLOCK(free_entries_lock);
 
 /* Global disable flag - will be set in case of an error */
-static u32 global_disable __read_mostly;
+static bool global_disable __read_mostly;
 
 /* Early initialization disable flag, set at the end of dma_debug_init */
 static bool dma_debug_initialized __read_mostly;
@@ -1249,6 +1249,14 @@ static void check_sync(struct device *dev,
                                 dir2name[entry->direction],
                                 dir2name[ref->direction]);
 
+        if (ref->sg_call_ents && ref->type == dma_debug_sg &&
+            ref->sg_call_ents != entry->sg_call_ents) {
+                err_printk(ref->dev, entry, "DMA-API: device driver syncs "
+                           "DMA sg list with different entry count "
+                           "[map count=%d] [sync count=%d]\n",
+                           entry->sg_call_ents, ref->sg_call_ents);
+        }
+
 out:
         put_hash_bucket(bucket, &flags);
 }
@@ -1456,7 +1464,7 @@ void debug_dma_alloc_coherent(struct device *dev, size_t size,
         entry->type      = dma_debug_coherent;
         entry->dev       = dev;
         entry->pfn       = page_to_pfn(virt_to_page(virt));
-        entry->offset    = (size_t) virt & PAGE_MASK;
+        entry->offset    = (size_t) virt & ~PAGE_MASK;
         entry->size      = size;
         entry->dev_addr  = dma_addr;
         entry->direction = DMA_BIDIRECTIONAL;
@@ -1472,7 +1480,7 @@ void debug_dma_free_coherent(struct device *dev, size_t size,
                 .type           = dma_debug_coherent,
                 .dev            = dev,
                 .pfn            = page_to_pfn(virt_to_page(virt)),
-                .offset         = (size_t) virt & PAGE_MASK,
+                .offset         = (size_t) virt & ~PAGE_MASK,
                 .dev_addr       = addr,
                 .size           = size,
                 .direction      = DMA_BIDIRECTIONAL,
diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c
index e491e02eff54..e3952e9c8ec0 100644
--- a/lib/dynamic_debug.c
+++ b/lib/dynamic_debug.c
@@ -42,7 +42,7 @@ extern struct _ddebug __stop___verbose[];
 
 struct ddebug_table {
         struct list_head link;
-        char *mod_name;
+        const char *mod_name;
         unsigned int num_ddebugs;
         struct _ddebug *ddebugs;
 };
@@ -841,12 +841,12 @@ int ddebug_add_module(struct _ddebug *tab, unsigned int n,
                              const char *name)
 {
         struct ddebug_table *dt;
-        char *new_name;
+        const char *new_name;
 
         dt = kzalloc(sizeof(*dt), GFP_KERNEL);
         if (dt == NULL)
                 return -ENOMEM;
-        new_name = kstrdup(name, GFP_KERNEL);
+        new_name = kstrdup_const(name, GFP_KERNEL);
         if (new_name == NULL) {
                 kfree(dt);
                 return -ENOMEM;
@@ -907,7 +907,7 @@ int ddebug_dyndbg_module_param_cb(char *param, char *val, const char *module)
 static void ddebug_table_free(struct ddebug_table *dt)
 {
         list_del_init(&dt->link);
-        kfree(dt->mod_name);
+        kfree_const(dt->mod_name);
         kfree(dt);
 }
 
diff --git a/lib/halfmd4.c b/lib/halfmd4.c
index a8fe6274a13c..137e861d9690 100644
--- a/lib/halfmd4.c
+++ b/lib/halfmd4.c
@@ -1,6 +1,7 @@
 #include <linux/compiler.h>
 #include <linux/export.h>
 #include <linux/cryptohash.h>
+#include <linux/bitops.h>
 
 /* F, G and H are basic MD4 functions: selection, majority, parity */
 #define F(x, y, z) ((z) ^ ((x) & ((y) ^ (z))))
@@ -14,7 +15,7 @@
  * Rotation is separate from addition to prevent recomputation
  */
 #define ROUND(f, a, b, c, d, x, s)      \
-        (a += f(b, c, d) + x, a = (a << s) | (a >> (32 - s)))
+        (a += f(b, c, d) + x, a = rol32(a, s))
 #define K1 0
 #define K2 013240474631UL
 #define K3 015666365641UL
diff --git a/lib/hexdump.c b/lib/hexdump.c
index 8d74c20d8595..992457b1284c 100644
--- a/lib/hexdump.c
+++ b/lib/hexdump.c
@@ -169,11 +169,15 @@ int hex_dump_to_buffer(const void *buf, size_t len, int rowsize, int groupsize,
                 }
         } else {
                 for (j = 0; j < len; j++) {
-                        if (linebuflen < lx + 3)
+                        if (linebuflen < lx + 2)
                                 goto overflow2;
                         ch = ptr[j];
                         linebuf[lx++] = hex_asc_hi(ch);
+                        if (linebuflen < lx + 2)
+                                goto overflow2;
                         linebuf[lx++] = hex_asc_lo(ch);
+                        if (linebuflen < lx + 2)
+                                goto overflow2;
                         linebuf[lx++] = ' ';
                 }
                 if (j)
diff --git a/lib/idr.c b/lib/idr.c
index 5335c43adf46..6098336df267 100644
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -399,7 +399,7 @@ void idr_preload(gfp_t gfp_mask)
          * allocation guarantee.  Disallow usage from those contexts.
          */
         WARN_ON_ONCE(in_interrupt());
-        might_sleep_if(gfp_mask & __GFP_WAIT);
+        might_sleep_if(gfpflags_allow_blocking(gfp_mask));
 
         preempt_disable();
 
@@ -453,7 +453,7 @@ int idr_alloc(struct idr *idr, void *ptr, int start, int end, gfp_t gfp_mask)
         struct idr_layer *pa[MAX_IDR_LEVEL + 1];
         int id;
 
-        might_sleep_if(gfp_mask & __GFP_WAIT);
+        might_sleep_if(gfpflags_allow_blocking(gfp_mask));
 
         /* sanity checks */
         if (WARN_ON_ONCE(start < 0))
diff --git a/lib/iommu-common.c b/lib/iommu-common.c
index b1c93e94ca7a..858dc1aae478 100644
--- a/lib/iommu-common.c
+++ b/lib/iommu-common.c
@@ -11,10 +11,6 @@
 #include <linux/dma-mapping.h>
 #include <linux/hash.h>
 
-#ifndef DMA_ERROR_CODE
-#define DMA_ERROR_CODE (~(dma_addr_t)0x0)
-#endif
-
 static unsigned long iommu_large_alloc = 15;
 
 static  DEFINE_PER_CPU(unsigned int, iommu_hash_common);
@@ -123,7 +119,7 @@ unsigned long iommu_tbl_range_alloc(struct device *dev,
         /* Sanity check */
         if (unlikely(npages == 0)) {
                 WARN_ON_ONCE(1);
-                return DMA_ERROR_CODE;
+                return IOMMU_ERROR_CODE;
         }
 
         if (largealloc) {
@@ -206,7 +202,7 @@ unsigned long iommu_tbl_range_alloc(struct device *dev,
                         goto again;
                 } else {
                         /* give up */
-                        n = DMA_ERROR_CODE;
+                        n = IOMMU_ERROR_CODE;
                         goto bail;
                 }
         }
@@ -259,7 +255,7 @@ void iommu_tbl_range_free(struct iommu_map_table *iommu, u64 dma_addr,
         unsigned long flags;
         unsigned long shift = iommu->table_shift;
 
-        if (entry == DMA_ERROR_CODE) /* use default addr->entry mapping */
+        if (entry == IOMMU_ERROR_CODE) /* use default addr->entry mapping */
                 entry = (dma_addr - iommu->table_map_base) >> shift;
         pool = get_pool(iommu, entry);
 
diff --git a/lib/is_single_threaded.c b/lib/is_single_threaded.c
index bd2bea963364..391fd23976a2 100644
--- a/lib/is_single_threaded.c
+++ b/lib/is_single_threaded.c
@@ -36,8 +36,7 @@ bool current_is_single_threaded(void)
                 if (unlikely(p == task->group_leader))
                         continue;
 
-                t = p;
-                do {
+                for_each_thread(p, t) {
                         if (unlikely(t->mm == mm))
                                 goto found;
                         if (likely(t->mm))
@@ -48,7 +47,7 @@ bool current_is_single_threaded(void)
                          * forked before exiting.
                          */
                         smp_rmb();
-                } while_each_thread(p, t);
+                }
         }
         ret = true;
 found:
diff --git a/lib/kasprintf.c b/lib/kasprintf.c
index 32f12150fc4f..f194e6e593e1 100644
--- a/lib/kasprintf.c
+++ b/lib/kasprintf.c
@@ -31,6 +31,22 @@ char *kvasprintf(gfp_t gfp, const char *fmt, va_list ap)
 }
 EXPORT_SYMBOL(kvasprintf);
 
+/*
+ * If fmt contains no % (or is exactly %s), use kstrdup_const. If fmt
+ * (or the sole vararg) points to rodata, we will then save a memory
+ * allocation and string copy. In any case, the return value should be
+ * freed using kfree_const().
+ */
+const char *kvasprintf_const(gfp_t gfp, const char *fmt, va_list ap)
+{
+        if (!strchr(fmt, '%'))
+                return kstrdup_const(fmt, gfp);
+        if (!strcmp(fmt, "%s"))
+                return kstrdup_const(va_arg(ap, const char*), gfp);
+        return kvasprintf(gfp, fmt, ap);
+}
+EXPORT_SYMBOL(kvasprintf_const);
+
 char *kasprintf(gfp_t gfp, const char *fmt, ...)
 {
         va_list ap;
diff --git a/lib/kobject.c b/lib/kobject.c
index 3e3a5c3cb330..7cbccd2b4c72 100644
--- a/lib/kobject.c
+++ b/lib/kobject.c
@@ -257,18 +257,32 @@ static int kobject_add_internal(struct kobject *kobj)
 int kobject_set_name_vargs(struct kobject *kobj, const char *fmt,
                                   va_list vargs)
 {
-        char *s;
+        const char *s;
 
         if (kobj->name && !fmt)
                 return 0;
 
-        s = kvasprintf(GFP_KERNEL, fmt, vargs);
+        s = kvasprintf_const(GFP_KERNEL, fmt, vargs);
         if (!s)
                 return -ENOMEM;
 
-        /* ewww... some of these buggers have '/' in the name ... */
-        strreplace(s, '/', '!');
-        kfree(kobj->name);
+        /*
+         * ewww... some of these buggers have '/' in the name ... If
+         * that's the case, we need to make sure we have an actual
+         * allocated copy to modify, since kvasprintf_const may have
+         * returned something from .rodata.
+         */
+        if (strchr(s, '/')) {
+                char *t;
+
+                t = kstrdup(s, GFP_KERNEL);
+                kfree_const(s);
+                if (!t)
+                        return -ENOMEM;
+                strreplace(t, '/', '!');
+                s = t;
+        }
+        kfree_const(kobj->name);
         kobj->name = s;
 
         return 0;
@@ -466,7 +480,7 @@ int kobject_rename(struct kobject *kobj, const char *new_name)
         envp[0] = devpath_string;
         envp[1] = NULL;
 
-        name = dup_name = kstrdup(new_name, GFP_KERNEL);
+        name = dup_name = kstrdup_const(new_name, GFP_KERNEL);
         if (!name) {
                 error = -ENOMEM;
                 goto out;
@@ -486,7 +500,7 @@ int kobject_rename(struct kobject *kobj, const char *new_name)
         kobject_uevent_env(kobj, KOBJ_MOVE, envp);
 
 out:
-        kfree(dup_name);
+        kfree_const(dup_name);
         kfree(devpath_string);
         kfree(devpath);
         kobject_put(kobj);
@@ -568,6 +582,7 @@ void kobject_del(struct kobject *kobj)
         kobject_put(kobj->parent);
         kobj->parent = NULL;
 }
+EXPORT_SYMBOL(kobject_del);
 
 /**
  * kobject_get - increment refcount for object.
@@ -584,6 +599,7 @@ struct kobject *kobject_get(struct kobject *kobj)
         }
         return kobj;
 }
+EXPORT_SYMBOL(kobject_get);
 
 static struct kobject * __must_check kobject_get_unless_zero(struct kobject *kobj)
 {
@@ -632,7 +648,7 @@ static void kobject_cleanup(struct kobject *kobj)
         /* free name if we allocated it */
         if (name) {
                 pr_debug("kobject: '%s': free name\n", name);
-                kfree(name);
+                kfree_const(name);
         }
 }
 
@@ -675,6 +691,7 @@ void kobject_put(struct kobject *kobj)
                 kref_put(&kobj->kref, kobject_release);
         }
 }
+EXPORT_SYMBOL(kobject_put);
 
 static void dynamic_kobj_release(struct kobject *kobj)
 {
@@ -803,6 +820,7 @@ int kset_register(struct kset *k)
         kobject_uevent(&k->kobj, KOBJ_ADD);
         return 0;
 }
+EXPORT_SYMBOL(kset_register);
 
 /**
  * kset_unregister - remove a kset.
@@ -815,6 +833,7 @@ void kset_unregister(struct kset *k)
         kobject_del(&k->kobj);
         kobject_put(&k->kobj);
 }
+EXPORT_SYMBOL(kset_unregister);
 
 /**
  * kset_find_obj - search for object in kset.
@@ -1051,10 +1070,3 @@ void kobj_ns_drop(enum kobj_ns_type type, void *ns)
                 kobj_ns_ops_tbl[type]->drop_ns(ns);
         spin_unlock(&kobj_ns_type_lock);
 }
-
-EXPORT_SYMBOL(kobject_get);
-EXPORT_SYMBOL(kobject_put);
-EXPORT_SYMBOL(kobject_del);
-
-EXPORT_SYMBOL(kset_register);
-EXPORT_SYMBOL(kset_unregister);
diff --git a/lib/llist.c b/lib/llist.c
index 0b0e9779d675..ae5872b1df0c 100644
--- a/lib/llist.c
+++ b/lib/llist.c
@@ -66,12 +66,12 @@ struct llist_node *llist_del_first(struct llist_head *head)
 {
         struct llist_node *entry, *old_entry, *next;
 
-        entry = head->first;
+        entry = smp_load_acquire(&head->first);
         for (;;) {
                 if (entry == NULL)
                         return NULL;
                 old_entry = entry;
-                next = entry->next;
+                next = READ_ONCE(entry->next);
                 entry = cmpxchg(&head->first, old_entry, next);
                 if (entry == old_entry)
                         break;
diff --git a/lib/mpi/longlong.h b/lib/mpi/longlong.h
index a89d041592c8..b90e255c2a68 100644
--- a/lib/mpi/longlong.h
+++ b/lib/mpi/longlong.h
@@ -19,7 +19,7 @@
  * the Free Software Foundation, Inc., 59 Temple Place - Suite 330, Boston,
  * MA 02111-1307, USA. */
 
-#include <asm-generic/bitops/count_zeros.h>
+#include <linux/count_zeros.h>
 
 /* You have to define the following before including this file:
  *
diff --git a/lib/mpi/mpicoder.c b/lib/mpi/mpicoder.c
index 95c52a95259e..3db76b8c1115 100644
--- a/lib/mpi/mpicoder.c
+++ b/lib/mpi/mpicoder.c
@@ -19,7 +19,7 @@
  */
 
 #include <linux/bitops.h>
-#include <asm-generic/bitops/count_zeros.h>
+#include <linux/count_zeros.h>
 #include "mpi-internal.h"
 
 #define MAX_EXTERN_MPI_BITS 16384
@@ -319,3 +319,202 @@ int mpi_set_buffer(MPI a, const void *xbuffer, unsigned nbytes, int sign)
         return 0;
 }
 EXPORT_SYMBOL_GPL(mpi_set_buffer);
+
+/**
+ * mpi_write_to_sgl() - Funnction exports MPI to an sgl (msb first)
+ *
+ * This function works in the same way as the mpi_read_buffer, but it
+ * takes an sgl instead of u8 * buf.
+ *
+ * @a:          a multi precision integer
+ * @sgl:        scatterlist to write to. Needs to be at least
+ *              mpi_get_size(a) long.
+ * @nbytes:     in/out param - it has the be set to the maximum number of
+ *              bytes that can be written to sgl. This has to be at least
+ *              the size of the integer a. On return it receives the actual
+ *              length of the data written.
+ * @sign:       if not NULL, it will be set to the sign of a.
+ *
+ * Return:      0 on success or error code in case of error
+ */
+int mpi_write_to_sgl(MPI a, struct scatterlist *sgl, unsigned *nbytes,
+                     int *sign)
+{
+        u8 *p, *p2;
+        mpi_limb_t alimb, alimb2;
+        unsigned int n = mpi_get_size(a);
+        int i, x, y = 0, lzeros = 0, buf_len;
+
+        if (!nbytes || *nbytes < n)
+                return -EINVAL;
+
+        if (sign)
+                *sign = a->sign;
+
+        p = (void *)&a->d[a->nlimbs] - 1;
+
+        for (i = a->nlimbs * sizeof(alimb) - 1; i >= 0; i--, p--) {
+                if (!*p)
+                        lzeros++;
+                else
+                        break;
+        }
+
+        *nbytes = n - lzeros;
+        buf_len = sgl->length;
+        p2 = sg_virt(sgl);
+
+        for (i = a->nlimbs - 1; i >= 0; i--) {
+                alimb = a->d[i];
+                p = (u8 *)&alimb2;
+#if BYTES_PER_MPI_LIMB == 4
+                *p++ = alimb >> 24;
+                *p++ = alimb >> 16;
+                *p++ = alimb >> 8;
+                *p++ = alimb;
+#elif BYTES_PER_MPI_LIMB == 8
+                *p++ = alimb >> 56;
+                *p++ = alimb >> 48;
+                *p++ = alimb >> 40;
+                *p++ = alimb >> 32;
+                *p++ = alimb >> 24;
+                *p++ = alimb >> 16;
+                *p++ = alimb >> 8;
+                *p++ = alimb;
+#else
+#error please implement for this limb size.
+#endif
+                if (lzeros > 0) {
+                        if (lzeros >= sizeof(alimb)) {
+                                p -= sizeof(alimb);
+                                continue;
+                        } else {
+                                mpi_limb_t *limb1 = (void *)p - sizeof(alimb);
+                                mpi_limb_t *limb2 = (void *)p - sizeof(alimb)
+                                                        + lzeros;
+                                *limb1 = *limb2;
+                                p -= lzeros;
+                                y = lzeros;
+                        }
+                        lzeros -= sizeof(alimb);
+                }
+
+                p = p - (sizeof(alimb) - y);
+
+                for (x = 0; x < sizeof(alimb) - y; x++) {
+                        if (!buf_len) {
+                                sgl = sg_next(sgl);
+                                if (!sgl)
+                                        return -EINVAL;
+                                buf_len = sgl->length;
+                                p2 = sg_virt(sgl);
+                        }
+                        *p2++ = *p++;
+                        buf_len--;
+                }
+                y = 0;
+        }
+        return 0;
+}
+EXPORT_SYMBOL_GPL(mpi_write_to_sgl);
+
+/*
+ * mpi_read_raw_from_sgl() - Function allocates an MPI and populates it with
+ *                           data from the sgl
+ *
+ * This function works in the same way as the mpi_read_raw_data, but it
+ * takes an sgl instead of void * buffer. i.e. it allocates
+ * a new MPI and reads the content of the sgl to the MPI.
+ *
+ * @sgl:        scatterlist to read from
+ * @len:        number of bytes to read
+ *
+ * Return:      Pointer to a new MPI or NULL on error
+ */
+MPI mpi_read_raw_from_sgl(struct scatterlist *sgl, unsigned int len)
+{
+        struct scatterlist *sg;
+        int x, i, j, z, lzeros, ents;
+        unsigned int nbits, nlimbs, nbytes;
+        mpi_limb_t a;
+        MPI val = NULL;
+
+        lzeros = 0;
+        ents = sg_nents(sgl);
+
+        for_each_sg(sgl, sg, ents, i) {
+                const u8 *buff = sg_virt(sg);
+                int len = sg->length;
+
+                while (len && !*buff) {
+                        lzeros++;
+                        len--;
+                        buff++;
+                }
+
+                if (len && *buff)
+                        break;
+
+                ents--;
+                lzeros = 0;
+        }
+
+        sgl = sg;
+
+        if (!ents)
+                nbytes = 0;
+        else
+                nbytes = len - lzeros;
+
+        nbits = nbytes * 8;
+        if (nbits > MAX_EXTERN_MPI_BITS) {
+                pr_info("MPI: mpi too large (%u bits)\n", nbits);
+                return NULL;
+        }
+
+        if (nbytes > 0)
+                nbits -= count_leading_zeros(*(u8 *)(sg_virt(sgl) + lzeros));
+        else
+                nbits = 0;
+
+        nlimbs = DIV_ROUND_UP(nbytes, BYTES_PER_MPI_LIMB);
+        val = mpi_alloc(nlimbs);
+        if (!val)
+                return NULL;
+
+        val->nbits = nbits;
+        val->sign = 0;
+        val->nlimbs = nlimbs;
+
+        if (nbytes == 0)
+                return val;
+
+        j = nlimbs - 1;
+        a = 0;
+        z = 0;
+        x = BYTES_PER_MPI_LIMB - nbytes % BYTES_PER_MPI_LIMB;
+        x %= BYTES_PER_MPI_LIMB;
+
+        for_each_sg(sgl, sg, ents, i) {
+                const u8 *buffer = sg_virt(sg) + lzeros;
+                int len = sg->length - lzeros;
+                int buf_shift = x;
+
+                if  (sg_is_last(sg) && (len % BYTES_PER_MPI_LIMB))
+                        len += BYTES_PER_MPI_LIMB - (len % BYTES_PER_MPI_LIMB);
+
+                for (; x < len + buf_shift; x++) {
+                        a <<= 8;
+                        a |= *buffer++;
+                        if (((z + x + 1) % BYTES_PER_MPI_LIMB) == 0) {
+                                val->d[j--] = a;
+                                a = 0;
+                        }
+                }
+                z += x;
+                x = 0;
+                lzeros = 0;
+        }
+        return val;
+}
+EXPORT_SYMBOL_GPL(mpi_read_raw_from_sgl);
diff --git a/lib/nmi_backtrace.c b/lib/nmi_backtrace.c
index 88d3d32e5923..6019c53c669e 100644
--- a/lib/nmi_backtrace.c
+++ b/lib/nmi_backtrace.c
@@ -43,6 +43,12 @@ static void print_seq_line(struct nmi_seq_buf *s, int start, int end)
         printk("%.*s", (end - start) + 1, buf);
 }
 
+/*
+ * When raise() is called it will be is passed a pointer to the
+ * backtrace_mask. Architectures that call nmi_cpu_backtrace()
+ * directly from their raise() functions may rely on the mask
+ * they are passed being updated as a side effect of this call.
+ */
 void nmi_trigger_all_cpu_backtrace(bool include_self,
                                    void (*raise)(cpumask_t *mask))
 {
@@ -149,7 +155,10 @@ bool nmi_cpu_backtrace(struct pt_regs *regs)
                 /* Replace printk to write into the NMI seq */
                 this_cpu_write(printk_func, nmi_vprintk);
                 pr_warn("NMI backtrace for cpu %d\n", cpu);
-                show_regs(regs);
+                if (regs)
+                        show_regs(regs);
+                else
+                        dump_stack();
                 this_cpu_write(printk_func, printk_func_save);
 
                 cpumask_clear_cpu(cpu, to_cpumask(backtrace_mask));
diff --git a/lib/once.c b/lib/once.c
new file mode 100644
index 000000000000..05c8604627eb
--- /dev/null
+++ b/lib/once.c
@@ -0,0 +1,62 @@
+#include <linux/slab.h>
+#include <linux/spinlock.h>
+#include <linux/once.h>
+#include <linux/random.h>
+
+struct once_work {
+        struct work_struct work;
+        struct static_key *key;
+};
+
+static void once_deferred(struct work_struct *w)
+{
+        struct once_work *work;
+
+        work = container_of(w, struct once_work, work);
+        BUG_ON(!static_key_enabled(work->key));
+        static_key_slow_dec(work->key);
+        kfree(work);
+}
+
+static void once_disable_jump(struct static_key *key)
+{
+        struct once_work *w;
+
+        w = kmalloc(sizeof(*w), GFP_ATOMIC);
+        if (!w)
+                return;
+
+        INIT_WORK(&w->work, once_deferred);
+        w->key = key;
+        schedule_work(&w->work);
+}
+
+static DEFINE_SPINLOCK(once_lock);
+
+bool __do_once_start(bool *done, unsigned long *flags)
+        __acquires(once_lock)
+{
+        spin_lock_irqsave(&once_lock, *flags);
+        if (*done) {
+                spin_unlock_irqrestore(&once_lock, *flags);
+                /* Keep sparse happy by restoring an even lock count on
+                 * this lock. In case we return here, we don't call into
+                 * __do_once_done but return early in the DO_ONCE() macro.
+                 */
+                __acquire(once_lock);
+                return false;
+        }
+
+        return true;
+}
+EXPORT_SYMBOL(__do_once_start);
+
+void __do_once_done(bool *done, struct static_key *once_key,
+                    unsigned long *flags)
+        __releases(once_lock)
+{
+        *done = true;
+        spin_unlock_irqrestore(&once_lock, *flags);
+        once_disable_jump(once_key);
+}
+EXPORT_SYMBOL(__do_once_done);
diff --git a/lib/percpu_ida.c b/lib/percpu_ida.c
index f75715131f20..6d40944960de 100644
--- a/lib/percpu_ida.c
+++ b/lib/percpu_ida.c
@@ -135,7 +135,7 @@ static inline unsigned alloc_local_tag(struct percpu_ida_cpu *tags)
  * TASK_UNINTERRUPTIBLE | TASK_INTERRUPTIBLE, of course).
  *
  * @gfp indicates whether or not to wait until a free id is available (it's not
- * used for internal memory allocations); thus if passed __GFP_WAIT we may sleep
+ * used for internal memory allocations); thus if passed __GFP_RECLAIM we may sleep
  * however long it takes until another thread frees an id (same semantics as a
  * mempool).
  *
diff --git a/lib/proportions.c b/lib/proportions.c
index 6f724298f67a..efa54f259ea9 100644
--- a/lib/proportions.c
+++ b/lib/proportions.c
@@ -1,7 +1,7 @@
 /*
  * Floating proportions
  *
- *  Copyright (C) 2007 Red Hat, Inc., Peter Zijlstra <pzijlstr@redhat.com>
+ *  Copyright (C) 2007 Red Hat, Inc., Peter Zijlstra
  *
  * Description:
  *
diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index f9ebe1c82060..fcf5d98574ce 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -188,7 +188,7 @@ radix_tree_node_alloc(struct radix_tree_root *root)
          * preloading in the interrupt anyway as all the allocations have to
          * be atomic. So just do normal allocation when in interrupt.
          */
-        if (!(gfp_mask & __GFP_WAIT) && !in_interrupt()) {
+        if (!gfpflags_allow_blocking(gfp_mask) && !in_interrupt()) {
                 struct radix_tree_preload *rtp;
 
                 /*
@@ -249,7 +249,7 @@ radix_tree_node_free(struct radix_tree_node *node)
  * with preemption not disabled.
  *
  * To make use of this facility, the radix tree must be initialised without
- * __GFP_WAIT being passed to INIT_RADIX_TREE().
+ * __GFP_DIRECT_RECLAIM being passed to INIT_RADIX_TREE().
  */
 static int __radix_tree_preload(gfp_t gfp_mask)
 {
@@ -286,12 +286,12 @@ out:
  * with preemption not disabled.
  *
  * To make use of this facility, the radix tree must be initialised without
- * __GFP_WAIT being passed to INIT_RADIX_TREE().
+ * __GFP_DIRECT_RECLAIM being passed to INIT_RADIX_TREE().
  */
 int radix_tree_preload(gfp_t gfp_mask)
 {
         /* Warn on non-sensical use... */
-        WARN_ON_ONCE(!(gfp_mask & __GFP_WAIT));
+        WARN_ON_ONCE(!gfpflags_allow_blocking(gfp_mask));
         return __radix_tree_preload(gfp_mask);
 }
 EXPORT_SYMBOL(radix_tree_preload);
@@ -303,7 +303,7 @@ EXPORT_SYMBOL(radix_tree_preload);
  */
 int radix_tree_maybe_preload(gfp_t gfp_mask)
 {
-        if (gfp_mask & __GFP_WAIT)
+        if (gfpflags_allow_blocking(gfp_mask))
                 return __radix_tree_preload(gfp_mask);
         /* Preloading doesn't help anything with this gfp mask, skip it */
         preempt_disable();
diff --git a/lib/random32.c b/lib/random32.c
index 0bee183fa18f..12111910ccd0 100644
--- a/lib/random32.c
+++ b/lib/random32.c
@@ -181,7 +181,7 @@ void prandom_seed(u32 entropy)
          * No locking on the CPUs, but then somewhat random results are, well,
          * expected.
          */
-        for_each_possible_cpu (i) {
+        for_each_possible_cpu(i) {
                 struct rnd_state *state = &per_cpu(net_rand_state, i);
 
                 state->s1 = __seed(state->s1 ^ entropy, 2U);
@@ -201,7 +201,7 @@ static int __init prandom_init(void)
         prandom_state_selftest();
 
         for_each_possible_cpu(i) {
-                struct rnd_state *state = &per_cpu(net_rand_state,i);
+                struct rnd_state *state = &per_cpu(net_rand_state, i);
                 u32 weak_seed = (i + jiffies) ^ random_get_entropy();
 
                 prandom_seed_early(state, weak_seed, true);
@@ -238,13 +238,30 @@ static void __init __prandom_start_seed_timer(void)
         add_timer(&seed_timer);
 }
 
+void prandom_seed_full_state(struct rnd_state __percpu *pcpu_state)
+{
+        int i;
+
+        for_each_possible_cpu(i) {
+                struct rnd_state *state = per_cpu_ptr(pcpu_state, i);
+                u32 seeds[4];
+
+                get_random_bytes(&seeds, sizeof(seeds));
+                state->s1 = __seed(seeds[0],   2U);
+                state->s2 = __seed(seeds[1],   8U);
+                state->s3 = __seed(seeds[2],  16U);
+                state->s4 = __seed(seeds[3], 128U);
+
+                prandom_warmup(state);
+        }
+}
+
 /*
  *      Generate better values after random number generator
  *      is fully initialized.
  */
 static void __prandom_reseed(bool late)
 {
-        int i;
         unsigned long flags;
         static bool latch = false;
         static DEFINE_SPINLOCK(lock);
@@ -266,19 +283,7 @@ static void __prandom_reseed(bool late)
                 goto out;
 
         latch = true;
-
-        for_each_possible_cpu(i) {
-                struct rnd_state *state = &per_cpu(net_rand_state,i);
-                u32 seeds[4];
-
-                get_random_bytes(&seeds, sizeof(seeds));
-                state->s1 = __seed(seeds[0],   2U);
-                state->s2 = __seed(seeds[1],   8U);
-                state->s3 = __seed(seeds[2],  16U);
-                state->s4 = __seed(seeds[3], 128U);
-
-                prandom_warmup(state);
-        }
+        prandom_seed_full_state(&net_rand_state);
 out:
         spin_unlock_irqrestore(&lock, flags);
 }
diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index a54ff8949f91..51282f579760 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -389,33 +389,31 @@ static bool rhashtable_check_elasticity(struct rhashtable *ht,
         return false;
 }
 
-int rhashtable_insert_rehash(struct rhashtable *ht)
+int rhashtable_insert_rehash(struct rhashtable *ht,
+                             struct bucket_table *tbl)
 {
         struct bucket_table *old_tbl;
         struct bucket_table *new_tbl;
-        struct bucket_table *tbl;
         unsigned int size;
         int err;
 
         old_tbl = rht_dereference_rcu(ht->tbl, ht);
-        tbl = rhashtable_last_table(ht, old_tbl);
 
         size = tbl->size;
 
+        err = -EBUSY;
+
         if (rht_grow_above_75(ht, tbl))
                 size *= 2;
         /* Do not schedule more than one rehash */
         else if (old_tbl != tbl)
-                return -EBUSY;
+                goto fail;
+
+        err = -ENOMEM;
 
         new_tbl = bucket_table_alloc(ht, size, GFP_ATOMIC);
-        if (new_tbl == NULL) {
-                /* Schedule async resize/rehash to try allocation
-                 * non-atomic context.
-                 */
-                schedule_work(&ht->run_work);
-                return -ENOMEM;
-        }
+        if (new_tbl == NULL)
+                goto fail;
 
         err = rhashtable_rehash_attach(ht, tbl, new_tbl);
         if (err) {
@@ -426,12 +424,24 @@ int rhashtable_insert_rehash(struct rhashtable *ht)
                 schedule_work(&ht->run_work);
 
         return err;
+
+fail:
+        /* Do not fail the insert if someone else did a rehash. */
+        if (likely(rcu_dereference_raw(tbl->future_tbl)))
+                return 0;
+
+        /* Schedule async rehash to retry allocation in process context. */
+        if (err == -ENOMEM)
+                schedule_work(&ht->run_work);
+
+        return err;
 }
 EXPORT_SYMBOL_GPL(rhashtable_insert_rehash);
 
-int rhashtable_insert_slow(struct rhashtable *ht, const void *key,
-                           struct rhash_head *obj,
-                           struct bucket_table *tbl)
+struct bucket_table *rhashtable_insert_slow(struct rhashtable *ht,
+                                            const void *key,
+                                            struct rhash_head *obj,
+                                            struct bucket_table *tbl)
 {
         struct rhash_head *head;
         unsigned int hash;
@@ -467,7 +477,12 @@ int rhashtable_insert_slow(struct rhashtable *ht, const void *key,
 exit:
         spin_unlock(rht_bucket_lock(tbl, hash));
 
-        return err;
+        if (err == 0)
+                return NULL;
+        else if (err == -EAGAIN)
+                return tbl;
+        else
+                return ERR_PTR(err);
 }
 EXPORT_SYMBOL_GPL(rhashtable_insert_slow);
 
@@ -503,10 +518,11 @@ int rhashtable_walk_init(struct rhashtable *ht, struct rhashtable_iter *iter)
         if (!iter->walker)
                 return -ENOMEM;
 
-        mutex_lock(&ht->mutex);
-        iter->walker->tbl = rht_dereference(ht->tbl, ht);
+        spin_lock(&ht->lock);
+        iter->walker->tbl =
+                rcu_dereference_protected(ht->tbl, lockdep_is_held(&ht->lock));
         list_add(&iter->walker->list, &iter->walker->tbl->walkers);
-        mutex_unlock(&ht->mutex);
+        spin_unlock(&ht->lock);
 
         return 0;
 }
@@ -520,10 +536,10 @@ EXPORT_SYMBOL_GPL(rhashtable_walk_init);
  */
 void rhashtable_walk_exit(struct rhashtable_iter *iter)
 {
-        mutex_lock(&iter->ht->mutex);
+        spin_lock(&iter->ht->lock);
         if (iter->walker->tbl)
                 list_del(&iter->walker->list);
-        mutex_unlock(&iter->ht->mutex);
+        spin_unlock(&iter->ht->lock);
         kfree(iter->walker);
 }
 EXPORT_SYMBOL_GPL(rhashtable_walk_exit);
@@ -547,14 +563,12 @@ int rhashtable_walk_start(struct rhashtable_iter *iter)
 {
         struct rhashtable *ht = iter->ht;
 
-        mutex_lock(&ht->mutex);
+        rcu_read_lock();
 
+        spin_lock(&ht->lock);
         if (iter->walker->tbl)
                 list_del(&iter->walker->list);
-
-        rcu_read_lock();
-
-        mutex_unlock(&ht->mutex);
+        spin_unlock(&ht->lock);
 
         if (!iter->walker->tbl) {
                 iter->walker->tbl = rht_dereference_rcu(ht->tbl, ht);
@@ -723,9 +737,6 @@ int rhashtable_init(struct rhashtable *ht,
         if (params->nulls_base && params->nulls_base < (1U << RHT_BASE_SHIFT))
                 return -EINVAL;
 
-        if (params->nelem_hint)
-                size = rounded_hashtable_size(params);
-
         memset(ht, 0, sizeof(*ht));
         mutex_init(&ht->mutex);
         spin_lock_init(&ht->lock);
@@ -745,6 +756,9 @@ int rhashtable_init(struct rhashtable *ht,
 
         ht->p.min_size = max(ht->p.min_size, HASH_MIN_SIZE);
 
+        if (params->nelem_hint)
+                size = rounded_hashtable_size(&ht->p);
+
         /* The maximum (not average) chain length grows with the
          * size of the hash table, at a rate of (log N)/(log log N).
          * The value of 16 is selected so that even if the hash
diff --git a/lib/string.c b/lib/string.c
index 84775ba873b9..0323c0d5629a 100644
--- a/lib/string.c
+++ b/lib/string.c
@@ -904,7 +904,7 @@ void *memchr_inv(const void *start, int c, size_t bytes)
 
         value64 = value;
 #if defined(CONFIG_ARCH_HAS_FAST_MULTIPLIER) && BITS_PER_LONG == 64
-        value64 *= 0x0101010101010101;
+        value64 *= 0x0101010101010101ULL;
 #elif defined(CONFIG_ARCH_HAS_FAST_MULTIPLIER)
         value64 *= 0x01010101;
         value64 |= value64 << 32;
diff --git a/lib/test-string_helpers.c b/lib/test-string_helpers.c
index 8e376efd88a4..98866a770770 100644
--- a/lib/test-string_helpers.c
+++ b/lib/test-string_helpers.c
@@ -326,6 +326,39 @@ out:
         kfree(out_test);
 }
 
+#define string_get_size_maxbuf 16
+#define test_string_get_size_one(size, blk_size, units, exp_result)            \
+        do {                                                                   \
+                BUILD_BUG_ON(sizeof(exp_result) >= string_get_size_maxbuf);    \
+                __test_string_get_size((size), (blk_size), (units),            \
+                                       (exp_result));                          \
+        } while (0)
+
+
+static __init void __test_string_get_size(const u64 size, const u64 blk_size,
+                                          const enum string_size_units units,
+                                          const char *exp_result)
+{
+        char buf[string_get_size_maxbuf];
+
+        string_get_size(size, blk_size, units, buf, sizeof(buf));
+        if (!memcmp(buf, exp_result, strlen(exp_result) + 1))
+                return;
+
+        buf[sizeof(buf) - 1] = '\0';
+        pr_warn("Test 'test_string_get_size_one' failed!\n");
+        pr_warn("string_get_size(size = %llu, blk_size = %llu, units = %d\n",
+                size, blk_size, units);
+        pr_warn("expected: '%s', got '%s'\n", exp_result, buf);
+}
+
+static __init void test_string_get_size(void)
+{
+        test_string_get_size_one(16384, 512, STRING_UNITS_2, "8.00 MiB");
+        test_string_get_size_one(8192, 4096, STRING_UNITS_10, "32.7 MB");
+        test_string_get_size_one(1, 512, STRING_UNITS_10, "512 B");
+}
+
 static int __init test_string_helpers_init(void)
 {
         unsigned int i;
@@ -344,6 +377,9 @@ static int __init test_string_helpers_init(void)
         for (i = 0; i < (ESCAPE_ANY_NP | ESCAPE_HEX) + 1; i++)
                 test_string_escape("escape 1", escape1, i, TEST_STRING_2_DICT_1);
 
+        /* Test string_get_size() */
+        test_string_get_size();
+
         return -EINVAL;
 }
 module_init(test_string_helpers_init);
diff --git a/lib/test_bpf.c b/lib/test_bpf.c
index d1377390b3ad..10cd1860e5b0 100644
--- a/lib/test_bpf.c
+++ b/lib/test_bpf.c
@@ -5056,6 +5056,36 @@ static struct bpf_test tests[] = {
                 { {0x1, 0x0 } },
         },
         {
+                "MOD default X",
+                .u.insns = {
+                        /*
+                         * A = 0x42
+                         * A = A mod X ; this halt the filter execution if X is 0
+                         * ret 0x42
+                         */
+                        BPF_STMT(BPF_LD | BPF_IMM, 0x42),
+                        BPF_STMT(BPF_ALU | BPF_MOD | BPF_X, 0),
+                        BPF_STMT(BPF_RET | BPF_K, 0x42),
+                },
+                CLASSIC | FLAG_NO_DATA,
+                {},
+                { {0x1, 0x0 } },
+        },
+        {
+                "MOD default A",
+                .u.insns = {
+                        /*
+                         * A = A mod 1
+                         * ret A
+                         */
+                        BPF_STMT(BPF_ALU | BPF_MOD | BPF_K, 0x1),
+                        BPF_STMT(BPF_RET | BPF_A, 0x0),
+                },
+                CLASSIC | FLAG_NO_DATA,
+                {},
+                { {0x1, 0x0 } },
+        },
+        {
                 "JMP EQ default A",
                 .u.insns = {
                         /*
diff --git a/lib/test_kasan.c b/lib/test_kasan.c
index c1efb1b61017..c32f3b0048dc 100644
--- a/lib/test_kasan.c
+++ b/lib/test_kasan.c
@@ -138,6 +138,71 @@ static noinline void __init kmalloc_oob_16(void)
         kfree(ptr2);
 }
 
+static noinline void __init kmalloc_oob_memset_2(void)
+{
+        char *ptr;
+        size_t size = 8;
+
+        pr_info("out-of-bounds in memset2\n");
+        ptr = kmalloc(size, GFP_KERNEL);
+        if (!ptr) {
+                pr_err("Allocation failed\n");
+                return;
+        }
+
+        memset(ptr+7, 0, 2);
+        kfree(ptr);
+}
+
+static noinline void __init kmalloc_oob_memset_4(void)
+{
+        char *ptr;
+        size_t size = 8;
+
+        pr_info("out-of-bounds in memset4\n");
+        ptr = kmalloc(size, GFP_KERNEL);
+        if (!ptr) {
+                pr_err("Allocation failed\n");
+                return;
+        }
+
+        memset(ptr+5, 0, 4);
+        kfree(ptr);
+}
+
+
+static noinline void __init kmalloc_oob_memset_8(void)
+{
+        char *ptr;
+        size_t size = 8;
+
+        pr_info("out-of-bounds in memset8\n");
+        ptr = kmalloc(size, GFP_KERNEL);
+        if (!ptr) {
+                pr_err("Allocation failed\n");
+                return;
+        }
+
+        memset(ptr+1, 0, 8);
+        kfree(ptr);
+}
+
+static noinline void __init kmalloc_oob_memset_16(void)
+{
+        char *ptr;
+        size_t size = 16;
+
+        pr_info("out-of-bounds in memset16\n");
+        ptr = kmalloc(size, GFP_KERNEL);
+        if (!ptr) {
+                pr_err("Allocation failed\n");
+                return;
+        }
+
+        memset(ptr+1, 0, 16);
+        kfree(ptr);
+}
+
 static noinline void __init kmalloc_oob_in_memset(void)
 {
         char *ptr;
@@ -264,6 +329,10 @@ static int __init kmalloc_tests_init(void)
         kmalloc_oob_krealloc_less();
         kmalloc_oob_16();
         kmalloc_oob_in_memset();
+        kmalloc_oob_memset_2();
+        kmalloc_oob_memset_4();
+        kmalloc_oob_memset_8();
+        kmalloc_oob_memset_16();
         kmalloc_uaf();
         kmalloc_uaf_memset();
         kmalloc_uaf2();
diff --git a/lib/test_printf.c b/lib/test_printf.c
new file mode 100644
index 000000000000..c5a666af9ba5
--- /dev/null
+++ b/lib/test_printf.c
@@ -0,0 +1,362 @@
+/*
+ * Test cases for printf facility.
+ */
+
+#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/printk.h>
+#include <linux/random.h>
+#include <linux/slab.h>
+#include <linux/string.h>
+
+#include <linux/socket.h>
+#include <linux/in.h>
+
+#define BUF_SIZE 256
+#define FILL_CHAR '$'
+
+#define PTR1 ((void*)0x01234567)
+#define PTR2 ((void*)(long)(int)0xfedcba98)
+
+#if BITS_PER_LONG == 64
+#define PTR1_ZEROES "000000000"
+#define PTR1_SPACES "         "
+#define PTR1_STR "1234567"
+#define PTR2_STR "fffffffffedcba98"
+#define PTR_WIDTH 16
+#else
+#define PTR1_ZEROES "0"
+#define PTR1_SPACES " "
+#define PTR1_STR "1234567"
+#define PTR2_STR "fedcba98"
+#define PTR_WIDTH 8
+#endif
+#define PTR_WIDTH_STR stringify(PTR_WIDTH)
+
+static unsigned total_tests __initdata;
+static unsigned failed_tests __initdata;
+static char *test_buffer __initdata;
+
+static int __printf(4, 0) __init
+do_test(int bufsize, const char *expect, int elen,
+        const char *fmt, va_list ap)
+{
+        va_list aq;
+        int ret, written;
+
+        total_tests++;
+
+        memset(test_buffer, FILL_CHAR, BUF_SIZE);
+        va_copy(aq, ap);
+        ret = vsnprintf(test_buffer, bufsize, fmt, aq);
+        va_end(aq);
+
+        if (ret != elen) {
+                pr_warn("vsnprintf(buf, %d, \"%s\", ...) returned %d, expected %d\n",
+                        bufsize, fmt, ret, elen);
+                return 1;
+        }
+
+        if (!bufsize) {
+                if (memchr_inv(test_buffer, FILL_CHAR, BUF_SIZE)) {
+                        pr_warn("vsnprintf(buf, 0, \"%s\", ...) wrote to buffer\n",
+                                fmt);
+                        return 1;
+                }
+                return 0;
+        }
+
+        written = min(bufsize-1, elen);
+        if (test_buffer[written]) {
+                pr_warn("vsnprintf(buf, %d, \"%s\", ...) did not nul-terminate buffer\n",
+                        bufsize, fmt);
+                return 1;
+        }
+
+        if (memcmp(test_buffer, expect, written)) {
+                pr_warn("vsnprintf(buf, %d, \"%s\", ...) wrote '%s', expected '%.*s'\n",
+                        bufsize, fmt, test_buffer, written, expect);
+                return 1;
+        }
+        return 0;
+}
+
+static void __printf(3, 4) __init
+__test(const char *expect, int elen, const char *fmt, ...)
+{
+        va_list ap;
+        int rand;
+        char *p;
+
+        BUG_ON(elen >= BUF_SIZE);
+
+        va_start(ap, fmt);
+
+        /*
+         * Every fmt+args is subjected to four tests: Three where we
+         * tell vsnprintf varying buffer sizes (plenty, not quite
+         * enough and 0), and then we also test that kvasprintf would
+         * be able to print it as expected.
+         */
+        failed_tests += do_test(BUF_SIZE, expect, elen, fmt, ap);
+        rand = 1 + prandom_u32_max(elen+1);
+        /* Since elen < BUF_SIZE, we have 1 <= rand <= BUF_SIZE. */
+        failed_tests += do_test(rand, expect, elen, fmt, ap);
+        failed_tests += do_test(0, expect, elen, fmt, ap);
+
+        p = kvasprintf(GFP_KERNEL, fmt, ap);
+        if (p) {
+                if (memcmp(p, expect, elen+1)) {
+                        pr_warn("kvasprintf(..., \"%s\", ...) returned '%s', expected '%s'\n",
+                                fmt, p, expect);
+                        failed_tests++;
+                }
+                kfree(p);
+        }
+        va_end(ap);
+}
+
+#define test(expect, fmt, ...)                                  \
+        __test(expect, strlen(expect), fmt, ##__VA_ARGS__)
+
+static void __init
+test_basic(void)
+{
+        /* Work around annoying "warning: zero-length gnu_printf format string". */
+        char nul = '\0';
+
+        test("", &nul);
+        test("100%", "100%%");
+        test("xxx%yyy", "xxx%cyyy", '%');
+        __test("xxx\0yyy", 7, "xxx%cyyy", '\0');
+}
+
+static void __init
+test_number(void)
+{
+        test("0x1234abcd  ", "%#-12x", 0x1234abcd);
+        test("  0x1234abcd", "%#12x", 0x1234abcd);
+        test("0|001| 12|+123| 1234|-123|-1234", "%d|%03d|%3d|%+d|% d|%+d|% d", 0, 1, 12, 123, 1234, -123, -1234);
+}
+
+static void __init
+test_string(void)
+{
+        test("", "%s%.0s", "", "123");
+        test("ABCD|abc|123", "%s|%.3s|%.*s", "ABCD", "abcdef", 3, "123456");
+        test("1  |  2|3  |  4|5  ", "%-3s|%3s|%-*s|%*s|%*s", "1", "2", 3, "3", 3, "4", -3, "5");
+        /*
+         * POSIX and C99 say that a missing precision should be
+         * treated as a precision of 0. However, the kernel's printf
+         * implementation treats this case as if the . wasn't
+         * present. Let's add a test case documenting the current
+         * behaviour; should anyone ever feel the need to follow the
+         * standards more closely, this can be revisited.
+         */
+        test("a||", "%.s|%.0s|%.*s", "a", "b", 0, "c");
+        test("a  |   |   ", "%-3.s|%-3.0s|%-3.*s", "a", "b", 0, "c");
+}
+
+static void __init
+plain(void)
+{
+        test(PTR1_ZEROES PTR1_STR " " PTR2_STR, "%p %p", PTR1, PTR2);
+        /*
+         * The field width is overloaded for some %p extensions to
+         * pass another piece of information. For plain pointers, the
+         * behaviour is slightly odd: One cannot pass either the 0
+         * flag nor a precision to %p without gcc complaining, and if
+         * one explicitly gives a field width, the number is no longer
+         * zero-padded.
+         */
+        test("|" PTR1_STR PTR1_SPACES "  |  " PTR1_SPACES PTR1_STR "|",
+             "|%-*p|%*p|", PTR_WIDTH+2, PTR1, PTR_WIDTH+2, PTR1);
+        test("|" PTR2_STR "  |  " PTR2_STR "|",
+             "|%-*p|%*p|", PTR_WIDTH+2, PTR2, PTR_WIDTH+2, PTR2);
+
+        /*
+         * Unrecognized %p extensions are treated as plain %p, but the
+         * alphanumeric suffix is ignored (that is, does not occur in
+         * the output.)
+         */
+        test("|"PTR1_ZEROES PTR1_STR"|", "|%p0y|", PTR1);
+        test("|"PTR2_STR"|", "|%p0y|", PTR2);
+}
+
+static void __init
+symbol_ptr(void)
+{
+}
+
+static void __init
+kernel_ptr(void)
+{
+}
+
+static void __init
+struct_resource(void)
+{
+}
+
+static void __init
+addr(void)
+{
+}
+
+static void __init
+escaped_str(void)
+{
+}
+
+static void __init
+hex_string(void)
+{
+        const char buf[3] = {0xc0, 0xff, 0xee};
+
+        test("c0 ff ee|c0:ff:ee|c0-ff-ee|c0ffee",
+             "%3ph|%3phC|%3phD|%3phN", buf, buf, buf, buf);
+        test("c0 ff ee|c0:ff:ee|c0-ff-ee|c0ffee",
+             "%*ph|%*phC|%*phD|%*phN", 3, buf, 3, buf, 3, buf, 3, buf);
+}
+
+static void __init
+mac(void)
+{
+        const u8 addr[6] = {0x2d, 0x48, 0xd6, 0xfc, 0x7a, 0x05};
+
+        test("2d:48:d6:fc:7a:05", "%pM", addr);
+        test("05:7a:fc:d6:48:2d", "%pMR", addr);
+        test("2d-48-d6-fc-7a-05", "%pMF", addr);
+        test("2d48d6fc7a05", "%pm", addr);
+        test("057afcd6482d", "%pmR", addr);
+}
+
+static void __init
+ip4(void)
+{
+        struct sockaddr_in sa;
+
+        sa.sin_family = AF_INET;
+        sa.sin_port = cpu_to_be16(12345);
+        sa.sin_addr.s_addr = cpu_to_be32(0x7f000001);
+
+        test("127.000.000.001|127.0.0.1", "%pi4|%pI4", &sa.sin_addr, &sa.sin_addr);
+        test("127.000.000.001|127.0.0.1", "%piS|%pIS", &sa, &sa);
+        sa.sin_addr.s_addr = cpu_to_be32(0x01020304);
+        test("001.002.003.004:12345|1.2.3.4:12345", "%piSp|%pISp", &sa, &sa);
+}
+
+static void __init
+ip6(void)
+{
+}
+
+static void __init
+ip(void)
+{
+        ip4();
+        ip6();
+}
+
+static void __init
+uuid(void)
+{
+        const char uuid[16] = {0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x6, 0x7,
+                               0x8, 0x9, 0xa, 0xb, 0xc, 0xd, 0xe, 0xf};
+
+        test("00010203-0405-0607-0809-0a0b0c0d0e0f", "%pUb", uuid);
+        test("00010203-0405-0607-0809-0A0B0C0D0E0F", "%pUB", uuid);
+        test("03020100-0504-0706-0809-0a0b0c0d0e0f", "%pUl", uuid);
+        test("03020100-0504-0706-0809-0A0B0C0D0E0F", "%pUL", uuid);
+}
+
+static void __init
+dentry(void)
+{
+}
+
+static void __init
+struct_va_format(void)
+{
+}
+
+static void __init
+struct_clk(void)
+{
+}
+
+static void __init
+bitmap(void)
+{
+        DECLARE_BITMAP(bits, 20);
+        const int primes[] = {2,3,5,7,11,13,17,19};
+        int i;
+
+        bitmap_zero(bits, 20);
+        test("00000|00000", "%20pb|%*pb", bits, 20, bits);
+        test("|", "%20pbl|%*pbl", bits, 20, bits);
+
+        for (i = 0; i < ARRAY_SIZE(primes); ++i)
+                set_bit(primes[i], bits);
+        test("a28ac|a28ac", "%20pb|%*pb", bits, 20, bits);
+        test("2-3,5,7,11,13,17,19|2-3,5,7,11,13,17,19", "%20pbl|%*pbl", bits, 20, bits);
+
+        bitmap_fill(bits, 20);
+        test("fffff|fffff", "%20pb|%*pb", bits, 20, bits);
+        test("0-19|0-19", "%20pbl|%*pbl", bits, 20, bits);
+}
+
+static void __init
+netdev_features(void)
+{
+}
+
+static void __init
+test_pointer(void)
+{
+        plain();
+        symbol_ptr();
+        kernel_ptr();
+        struct_resource();
+        addr();
+        escaped_str();
+        hex_string();
+        mac();
+        ip();
+        uuid();
+        dentry();
+        struct_va_format();
+        struct_clk();
+        bitmap();
+        netdev_features();
+}
+
+static int __init
+test_printf_init(void)
+{
+        test_buffer = kmalloc(BUF_SIZE, GFP_KERNEL);
+        if (!test_buffer)
+                return -ENOMEM;
+
+        test_basic();
+        test_number();
+        test_string();
+        test_pointer();
+
+        kfree(test_buffer);
+
+        if (failed_tests == 0)
+                pr_info("all %u tests passed\n", total_tests);
+        else
+                pr_warn("failed %u out of %u tests\n", failed_tests, total_tests);
+
+        return failed_tests ? -EINVAL : 0;
+}
+
+module_init(test_printf_init);
+
+MODULE_AUTHOR("Rasmus Villemoes <linux@rasmusvillemoes.dk>");
+MODULE_LICENSE("GPL");
diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index 95cd63b43b99..f9cee8e1233c 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -1449,6 +1449,8 @@ int kptr_restrict __read_mostly;
  *        (legacy clock framework) of the clock
  * - 'Cr' For a clock, it prints the current rate of the clock
  *
+ * ** Please update also Documentation/printk-formats.txt when making changes **
+ *
  * Note: The difference between 'S' and 'F' is that on ia64 and ppc64
  * function pointers are really function descriptors, which contain a
  * pointer to the real address.
@@ -1457,7 +1459,7 @@ static noinline_for_stack
 char *pointer(const char *fmt, char *buf, char *end, void *ptr,
               struct printf_spec spec)
 {
-        int default_width = 2 * sizeof(void *) + (spec.flags & SPECIAL ? 2 : 0);
+        const int default_width = 2 * sizeof(void *);
 
         if (!ptr && *fmt != 'K') {
                 /*
@@ -1769,14 +1771,14 @@ qualifier:
 
         case 'n':
                 /*
-                 * Since %n poses a greater security risk than utility, treat
-                 * it as an invalid format specifier. Warn about its use so
-                 * that new instances don't get added.
+                 * Since %n poses a greater security risk than
+                 * utility, treat it as any other invalid or
+                 * unsupported format specifier.
                  */
-                WARN_ONCE(1, "Please remove ignored %%n in '%s'\n", fmt);
                 /* Fall-through */
 
         default:
+                WARN_ONCE(1, "Please remove unsupported %%%c in format string\n", *fmt);
                 spec->type = FORMAT_TYPE_INVALID;
                 return fmt - start;
         }
@@ -1811,41 +1813,16 @@ qualifier:
  * @fmt: The format string to use
  * @args: Arguments for the format string
  *
- * This function follows C99 vsnprintf, but has some extensions:
- * %pS output the name of a text symbol with offset
- * %ps output the name of a text symbol without offset
- * %pF output the name of a function pointer with its offset
- * %pf output the name of a function pointer without its offset
- * %pB output the name of a backtrace symbol with its offset
- * %pR output the address range in a struct resource with decoded flags
- * %pr output the address range in a struct resource with raw flags
- * %pb output the bitmap with field width as the number of bits
- * %pbl output the bitmap as range list with field width as the number of bits
- * %pM output a 6-byte MAC address with colons
- * %pMR output a 6-byte MAC address with colons in reversed order
- * %pMF output a 6-byte MAC address with dashes
- * %pm output a 6-byte MAC address without colons
- * %pmR output a 6-byte MAC address without colons in reversed order
- * %pI4 print an IPv4 address without leading zeros
- * %pi4 print an IPv4 address with leading zeros
- * %pI6 print an IPv6 address with colons
- * %pi6 print an IPv6 address without colons
- * %pI6c print an IPv6 address as specified by RFC 5952
- * %pIS depending on sa_family of 'struct sockaddr *' print IPv4/IPv6 address
- * %piS depending on sa_family of 'struct sockaddr *' print IPv4/IPv6 address
- * %pU[bBlL] print a UUID/GUID in big or little endian using lower or upper
- *   case.
- * %*pE[achnops] print an escaped buffer
- * %*ph[CDN] a variable-length hex string with a separator (supports up to 64
- *           bytes of the input)
- * %pC output the name (Common Clock Framework) or address (legacy clock
- *     framework) of a clock
- * %pCn output the name (Common Clock Framework) or address (legacy clock
- *      framework) of a clock
- * %pCr output the current rate of a clock
- * %n is ignored
+ * This function generally follows C99 vsnprintf, but has some
+ * extensions and a few limitations:
+ *
+ * %n is unsupported
+ * %p* is handled by pointer()
  *
- * ** Please update Documentation/printk-formats.txt when making changes **
+ * See pointer() or Documentation/printk-formats.txt for more
+ * extensive description.
+ *
+ * ** Please update the documentation in both places when making changes **
  *
  * The return value is the number of characters which would
  * be generated for the given input, excluding the trailing
@@ -1944,10 +1921,15 @@ int vsnprintf(char *buf, size_t size, const char *fmt, va_list args)
                         break;
 
                 case FORMAT_TYPE_INVALID:
-                        if (str < end)
-                                *str = '%';
-                        ++str;
-                        break;
+                        /*
+                         * Presumably the arguments passed gcc's type
+                         * checking, but there is no safe or sane way
+                         * for us to continue parsing the format and
+                         * fetching from the va_list; the remaining
+                         * specifiers and arguments would be out of
+                         * sync.
+                         */
+                        goto out;
 
                 default:
                         switch (spec.type) {
@@ -1992,6 +1974,7 @@ int vsnprintf(char *buf, size_t size, const char *fmt, va_list args)
                 }
         }
 
+out:
         if (size > 0) {
                 if (str < end)
                         *str = '\0';
@@ -2189,9 +2172,10 @@ do {									\
 
                 switch (spec.type) {
                 case FORMAT_TYPE_NONE:
-                case FORMAT_TYPE_INVALID:
                 case FORMAT_TYPE_PERCENT_CHAR:
                         break;
+                case FORMAT_TYPE_INVALID:
+                        goto out;
 
                 case FORMAT_TYPE_WIDTH:
                 case FORMAT_TYPE_PRECISION:
@@ -2253,6 +2237,7 @@ do {									\
                 }
         }
 
+out:
         return (u32 *)(PTR_ALIGN(str, sizeof(u32))) - bin_buf;
 #undef save_arg
 }
@@ -2286,7 +2271,7 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
         char *str, *end;
         const char *args = (const char *)bin_buf;
 
-        if (WARN_ON_ONCE((int) size < 0))
+        if (WARN_ON_ONCE(size > INT_MAX))
                 return 0;
 
         str = buf;
@@ -2375,12 +2360,14 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
                         break;
 
                 case FORMAT_TYPE_PERCENT_CHAR:
-                case FORMAT_TYPE_INVALID:
                         if (str < end)
                                 *str = '%';
                         ++str;
                         break;
 
+                case FORMAT_TYPE_INVALID:
+                        goto out;
+
                 default: {
                         unsigned long long num;
 
@@ -2423,6 +2410,7 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
                 } /* switch(spec.type) */
         } /* while(*fmt) */
 
+out:
         if (size > 0) {
                 if (str < end)
                         *str = '\0';