130 files changed, 734 insertions, 448 deletions

diff --git a/Documentation/networking/bonding.txt b/Documentation/networking/bonding.txt
index 57f52cdce32e..9ba04c0bab8d 100644
--- a/Documentation/networking/bonding.txt
+++ b/Documentation/networking/bonding.txt
@@ -2387,7 +2387,7 @@ broadcast: Like active-backup, there is not much advantage to this
         and packet type ID), so in a "gatewayed" configuration, all
         outgoing traffic will generally use the same device.  Incoming
         traffic may also end up on a single device, but that is
-        dependent upon the balancing policy of the peer's 8023.ad
+        dependent upon the balancing policy of the peer's 802.3ad
         implementation.  In a "local" configuration, traffic will be
         distributed across the devices in the bond.
 
diff --git a/MAINTAINERS b/MAINTAINERS
index 2d3d750b19c0..a74227ad082e 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -5346,9 +5346,7 @@ M:	"J. Bruce Fields" <bfields@fieldses.org>
 L:      linux-fsdevel@vger.kernel.org
 S:      Maintained
 F:      include/linux/fcntl.h
-F:      include/linux/fs.h
 F:      include/uapi/linux/fcntl.h
-F:      include/uapi/linux/fs.h
 F:      fs/fcntl.c
 F:      fs/locks.c
 
@@ -5357,6 +5355,8 @@ M:	Alexander Viro <viro@zeniv.linux.org.uk>
 L:      linux-fsdevel@vger.kernel.org
 S:      Maintained
 F:      fs/*
+F:      include/linux/fs.h
+F:      include/uapi/linux/fs.h
 
 FINTEK F75375S HARDWARE MONITOR AND FAN CONTROLLER DRIVER
 M:      Riku Voipio <riku.voipio@iki.fi>
@@ -7571,7 +7571,7 @@ F:	arch/mips/include/asm/kvm*
 F:      arch/mips/kvm/
 
 KERNEL VIRTUAL MACHINE FOR POWERPC (KVM/powerpc)
-M:      Alexander Graf <agraf@suse.com>
+M:      Paul Mackerras <paulus@ozlabs.org>
 L:      kvm-ppc@vger.kernel.org
 W:      http://www.linux-kvm.org/
 T:      git git://github.com/agraf/linux-2.6.git
diff --git a/arch/Kconfig b/arch/Kconfig
index 1aafb4efbb51..d789a89cb32c 100644
--- a/arch/Kconfig
+++ b/arch/Kconfig
@@ -937,9 +937,6 @@ config STRICT_MODULE_RWX
           and non-text memory will be made non-executable. This provides
           protection against certain security exploits (e.g. writing to text)
 
-config ARCH_WANT_RELAX_ORDER
-        bool
-
 config ARCH_HAS_REFCOUNT
         bool
         help
diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S
index 48da0f5d2f7f..b82586c53560 100644
--- a/arch/powerpc/kernel/exceptions-64s.S
+++ b/arch/powerpc/kernel/exceptions-64s.S
@@ -734,7 +734,29 @@ EXC_REAL(program_check, 0x700, 0x100)
 EXC_VIRT(program_check, 0x4700, 0x100, 0x700)
 TRAMP_KVM(PACA_EXGEN, 0x700)
 EXC_COMMON_BEGIN(program_check_common)
-        EXCEPTION_PROLOG_COMMON(0x700, PACA_EXGEN)
+        /*
+         * It's possible to receive a TM Bad Thing type program check with
+         * userspace register values (in particular r1), but with SRR1 reporting
+         * that we came from the kernel. Normally that would confuse the bad
+         * stack logic, and we would report a bad kernel stack pointer. Instead
+         * we switch to the emergency stack if we're taking a TM Bad Thing from
+         * the kernel.
+         */
+        li      r10,MSR_PR              /* Build a mask of MSR_PR ..    */
+        oris    r10,r10,0x200000@h      /* .. and SRR1_PROGTM           */
+        and     r10,r10,r12             /* Mask SRR1 with that.         */
+        srdi    r10,r10,8               /* Shift it so we can compare   */
+        cmpldi  r10,(0x200000 >> 8)     /* .. with an immediate.        */
+        bne 1f                          /* If != go to normal path.     */
+
+        /* SRR1 had PR=0 and SRR1_PROGTM=1, so use the emergency stack  */
+        andi.   r10,r12,MSR_PR;         /* Set CR0 correctly for label  */
+                                        /* 3 in EXCEPTION_PROLOG_COMMON */
+        mr      r10,r1                  /* Save r1                      */
+        ld      r1,PACAEMERGSP(r13)     /* Use emergency stack          */
+        subi    r1,r1,INT_FRAME_SIZE    /* alloc stack frame            */
+        b 3f                            /* Jump into the macro !!       */
+1:      EXCEPTION_PROLOG_COMMON(0x700, PACA_EXGEN)
         bl      save_nvgprs
         RECONCILE_IRQ_STATE(r10, r11)
         addi    r3,r1,STACK_FRAME_OVERHEAD
diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
index c83c115858c1..b2c002993d78 100644
--- a/arch/powerpc/kernel/signal_64.c
+++ b/arch/powerpc/kernel/signal_64.c
@@ -452,9 +452,20 @@ static long restore_tm_sigcontexts(struct task_struct *tsk,
         if (MSR_TM_RESV(msr))
                 return -EINVAL;
 
-        /* pull in MSR TM from user context */
+        /* pull in MSR TS bits from user context */
         regs->msr = (regs->msr & ~MSR_TS_MASK) | (msr & MSR_TS_MASK);
 
+        /*
+         * Ensure that TM is enabled in regs->msr before we leave the signal
+         * handler. It could be the case that (a) user disabled the TM bit
+         * through the manipulation of the MSR bits in uc_mcontext or (b) the
+         * TM bit was disabled because a sufficient number of context switches
+         * happened whilst in the signal handler and load_tm overflowed,
+         * disabling the TM bit. In either case we can end up with an illegal
+         * TM state leading to a TM Bad Thing when we return to userspace.
+         */
+        regs->msr |= MSR_TM;
+
         /* pull in MSR LE from user context */
         regs->msr = (regs->msr & ~MSR_LE) | (msr & MSR_LE);
 
diff --git a/arch/powerpc/kernel/trace/ftrace_64_mprofile.S b/arch/powerpc/kernel/trace/ftrace_64_mprofile.S
index c98e90b4ea7b..b4e2b7165f79 100644
--- a/arch/powerpc/kernel/trace/ftrace_64_mprofile.S
+++ b/arch/powerpc/kernel/trace/ftrace_64_mprofile.S
@@ -181,34 +181,25 @@ _GLOBAL(ftrace_stub)
          *  - we have no stack frame and can not allocate one
          *  - LR points back to the original caller (in A)
          *  - CTR holds the new NIP in C
-         *  - r0 & r12 are free
-         *
-         * r0 can't be used as the base register for a DS-form load or store, so
-         * we temporarily shuffle r1 (stack pointer) into r0 and then put it back.
+         *  - r0, r11 & r12 are free
          */
 livepatch_handler:
         CURRENT_THREAD_INFO(r12, r1)
 
-        /* Save stack pointer into r0 */
-        mr      r0, r1
-
         /* Allocate 3 x 8 bytes */
-        ld      r1, TI_livepatch_sp(r12)
-        addi    r1, r1, 24
-        std     r1, TI_livepatch_sp(r12)
+        ld      r11, TI_livepatch_sp(r12)
+        addi    r11, r11, 24
+        std     r11, TI_livepatch_sp(r12)
 
         /* Save toc & real LR on livepatch stack */
-        std     r2,  -24(r1)
+        std     r2,  -24(r11)
         mflr    r12
-        std     r12, -16(r1)
+        std     r12, -16(r11)
 
         /* Store stack end marker */
         lis     r12, STACK_END_MAGIC@h
         ori     r12, r12, STACK_END_MAGIC@l
-        std     r12, -8(r1)
-
-        /* Restore real stack pointer */
-        mr      r1, r0
+        std     r12, -8(r11)
 
         /* Put ctr in r12 for global entry and branch there */
         mfctr   r12
@@ -216,36 +207,30 @@ livepatch_handler:
 
         /*
          * Now we are returning from the patched function to the original
-         * caller A. We are free to use r0 and r12, and we can use r2 until we
+         * caller A. We are free to use r11, r12 and we can use r2 until we
          * restore it.
          */
 
         CURRENT_THREAD_INFO(r12, r1)
 
-        /* Save stack pointer into r0 */
-        mr      r0, r1
-
-        ld      r1, TI_livepatch_sp(r12)
+        ld      r11, TI_livepatch_sp(r12)
 
         /* Check stack marker hasn't been trashed */
         lis     r2,  STACK_END_MAGIC@h
         ori     r2,  r2, STACK_END_MAGIC@l
-        ld      r12, -8(r1)
+        ld      r12, -8(r11)
 1:      tdne    r12, r2
         EMIT_BUG_ENTRY 1b, __FILE__, __LINE__ - 1, 0
 
         /* Restore LR & toc from livepatch stack */
-        ld      r12, -16(r1)
+        ld      r12, -16(r11)
         mtlr    r12
-        ld      r2,  -24(r1)
+        ld      r2,  -24(r11)
 
         /* Pop livepatch stack frame */
-        CURRENT_THREAD_INFO(r12, r0)
-        subi    r1, r1, 24
-        std     r1, TI_livepatch_sp(r12)
-
-        /* Restore real stack pointer */
-        mr      r1, r0
+        CURRENT_THREAD_INFO(r12, r1)
+        subi    r11, r11, 24
+        std     r11, TI_livepatch_sp(r12)
 
         /* Return to original caller of live patched function */
         blr
diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c
index 5e8418c28bd8..f208f560aecd 100644
--- a/arch/powerpc/lib/sstep.c
+++ b/arch/powerpc/lib/sstep.c
@@ -1684,11 +1684,13 @@ int analyse_instr(struct instruction_op *op, const struct pt_regs *regs,
  * Logical instructions
  */
                 case 26:        /* cntlzw */
-                        op->val = __builtin_clz((unsigned int) regs->gpr[rd]);
+                        val = (unsigned int) regs->gpr[rd];
+                        op->val = ( val ? __builtin_clz(val) : 32 );
                         goto logical_done;
 #ifdef __powerpc64__
                 case 58:        /* cntlzd */
-                        op->val = __builtin_clzl(regs->gpr[rd]);
+                        val = regs->gpr[rd];
+                        op->val = ( val ? __builtin_clzl(val) : 64 );
                         goto logical_done;
 #endif
                 case 28:        /* and */
diff --git a/arch/powerpc/mm/numa.c b/arch/powerpc/mm/numa.c
index b95c584ce19d..a51df9ef529d 100644
--- a/arch/powerpc/mm/numa.c
+++ b/arch/powerpc/mm/numa.c
@@ -1438,7 +1438,6 @@ out:
 
 int arch_update_cpu_topology(void)
 {
-        lockdep_assert_cpus_held();
         return numa_update_cpu_topology(true);
 }
 
diff --git a/arch/powerpc/perf/imc-pmu.c b/arch/powerpc/perf/imc-pmu.c
index 9ccac86f3463..88126245881b 100644
--- a/arch/powerpc/perf/imc-pmu.c
+++ b/arch/powerpc/perf/imc-pmu.c
@@ -399,6 +399,20 @@ static void nest_imc_counters_release(struct perf_event *event)
 
         /* Take the mutex lock for this node and then decrement the reference count */
         mutex_lock(&ref->lock);
+        if (ref->refc == 0) {
+                /*
+                 * The scenario where this is true is, when perf session is
+                 * started, followed by offlining of all cpus in a given node.
+                 *
+                 * In the cpuhotplug offline path, ppc_nest_imc_cpu_offline()
+                 * function set the ref->count to zero, if the cpu which is
+                 * about to offline is the last cpu in a given node and make
+                 * an OPAL call to disable the engine in that node.
+                 *
+                 */
+                mutex_unlock(&ref->lock);
+                return;
+        }
         ref->refc--;
         if (ref->refc == 0) {
                 rc = opal_imc_counters_stop(OPAL_IMC_COUNTERS_NEST,
@@ -523,8 +537,8 @@ static int core_imc_mem_init(int cpu, int size)
 
         /* We need only vbase for core counters */
         mem_info->vbase = page_address(alloc_pages_node(phys_id,
-                                          GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE,
-                                          get_order(size)));
+                                          GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE |
+                                          __GFP_NOWARN, get_order(size)));
         if (!mem_info->vbase)
                 return -ENOMEM;
 
@@ -646,6 +660,20 @@ static void core_imc_counters_release(struct perf_event *event)
                 return;
 
         mutex_lock(&ref->lock);
+        if (ref->refc == 0) {
+                /*
+                 * The scenario where this is true is, when perf session is
+                 * started, followed by offlining of all cpus in a given core.
+                 *
+                 * In the cpuhotplug offline path, ppc_core_imc_cpu_offline()
+                 * function set the ref->count to zero, if the cpu which is
+                 * about to offline is the last cpu in a given core and make
+                 * an OPAL call to disable the engine in that core.
+                 *
+                 */
+                mutex_unlock(&ref->lock);
+                return;
+        }
         ref->refc--;
         if (ref->refc == 0) {
                 rc = opal_imc_counters_stop(OPAL_IMC_COUNTERS_CORE,
@@ -763,8 +791,8 @@ static int thread_imc_mem_alloc(int cpu_id, int size)
                  * free the memory in cpu offline path.
                  */
                 local_mem = page_address(alloc_pages_node(phys_id,
-                                  GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE,
-                                  get_order(size)));
+                                  GFP_KERNEL | __GFP_ZERO | __GFP_THISNODE |
+                                  __GFP_NOWARN, get_order(size)));
                 if (!local_mem)
                         return -ENOMEM;
 
@@ -1148,7 +1176,8 @@ static void imc_common_cpuhp_mem_free(struct imc_pmu *pmu_ptr)
         }
 
         /* Only free the attr_groups which are dynamically allocated  */
-        kfree(pmu_ptr->attr_groups[IMC_EVENT_ATTR]->attrs);
+        if (pmu_ptr->attr_groups[IMC_EVENT_ATTR])
+                kfree(pmu_ptr->attr_groups[IMC_EVENT_ATTR]->attrs);
         kfree(pmu_ptr->attr_groups[IMC_EVENT_ATTR]);
         kfree(pmu_ptr);
         return;
diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig
index 0be3828752e5..4e83f950713e 100644
--- a/arch/sparc/Kconfig
+++ b/arch/sparc/Kconfig
@@ -44,7 +44,6 @@ config SPARC
         select ARCH_HAS_SG_CHAIN
         select CPU_NO_EFFICIENT_FFS
         select LOCKDEP_SMALL if LOCKDEP
-        select ARCH_WANT_RELAX_ORDER
 
 config SPARC32
         def_bool !64BIT
diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c
index 106d4a029a8a..7a69cf053711 100644
--- a/arch/x86/kvm/mmu.c
+++ b/arch/x86/kvm/mmu.c
@@ -3974,19 +3974,19 @@ static inline bool is_last_gpte(struct kvm_mmu *mmu,
                                 unsigned level, unsigned gpte)
 {
         /*
-         * PT_PAGE_TABLE_LEVEL always terminates.  The RHS has bit 7 set
-         * iff level <= PT_PAGE_TABLE_LEVEL, which for our purpose means
-         * level == PT_PAGE_TABLE_LEVEL; set PT_PAGE_SIZE_MASK in gpte then.
-         */
-        gpte |= level - PT_PAGE_TABLE_LEVEL - 1;
-
-        /*
          * The RHS has bit 7 set iff level < mmu->last_nonleaf_level.
          * If it is clear, there are no large pages at this level, so clear
          * PT_PAGE_SIZE_MASK in gpte if that is the case.
          */
         gpte &= level - mmu->last_nonleaf_level;
 
+        /*
+         * PT_PAGE_TABLE_LEVEL always terminates.  The RHS has bit 7 set
+         * iff level <= PT_PAGE_TABLE_LEVEL, which for our purpose means
+         * level == PT_PAGE_TABLE_LEVEL; set PT_PAGE_SIZE_MASK in gpte then.
+         */
+        gpte |= level - PT_PAGE_TABLE_LEVEL - 1;
+
         return gpte & PT_PAGE_SIZE_MASK;
 }
 
@@ -4555,6 +4555,7 @@ void kvm_init_shadow_ept_mmu(struct kvm_vcpu *vcpu, bool execonly,
 
         update_permission_bitmask(vcpu, context, true);
         update_pkru_bitmask(vcpu, context, true);
+        update_last_nonleaf_level(vcpu, context);
         reset_rsvds_bits_mask_ept(vcpu, context, execonly);
         reset_ept_shadow_zero_bits_mask(vcpu, context, execonly);
 }
diff --git a/arch/x86/kvm/paging_tmpl.h b/arch/x86/kvm/paging_tmpl.h
index 86b68dc5a649..f18d1f8d332b 100644
--- a/arch/x86/kvm/paging_tmpl.h
+++ b/arch/x86/kvm/paging_tmpl.h
@@ -334,10 +334,11 @@ retry_walk:
                 --walker->level;
 
                 index = PT_INDEX(addr, walker->level);
-
                 table_gfn = gpte_to_gfn(pte);
                 offset    = index * sizeof(pt_element_t);
                 pte_gpa   = gfn_to_gpa(table_gfn) + offset;
+
+                BUG_ON(walker->level < 1);
                 walker->table_gfn[walker->level - 1] = table_gfn;
                 walker->pte_gpa[walker->level - 1] = pte_gpa;
 
diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
index a2b804e10c95..95a01609d7ee 100644
--- a/arch/x86/kvm/vmx.c
+++ b/arch/x86/kvm/vmx.c
@@ -11297,7 +11297,7 @@ static void load_vmcs12_host_state(struct kvm_vcpu *vcpu,
 
         /* Same as above - no reason to call set_cr4_guest_host_mask().  */
         vcpu->arch.cr4_guest_owned_bits = ~vmcs_readl(CR4_GUEST_HOST_MASK);
-        kvm_set_cr4(vcpu, vmcs12->host_cr4);
+        vmx_set_cr4(vcpu, vmcs12->host_cr4);
 
         nested_ept_uninit_mmu_context(vcpu);
 
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index 0e7ef69e8531..d669e9d89001 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -93,11 +93,11 @@ int xen_cpuhp_setup(int (*cpu_up_prepare_cb)(unsigned int),
         int rc;
 
         rc = cpuhp_setup_state_nocalls(CPUHP_XEN_PREPARE,
-                                       "x86/xen/hvm_guest:prepare",
+                                       "x86/xen/guest:prepare",
                                        cpu_up_prepare_cb, cpu_dead_cb);
         if (rc >= 0) {
                 rc = cpuhp_setup_state_nocalls(CPUHP_AP_ONLINE_DYN,
-                                               "x86/xen/hvm_guest:online",
+                                               "x86/xen/guest:online",
                                                xen_cpu_up_online, NULL);
                 if (rc < 0)
                         cpuhp_remove_state_nocalls(CPUHP_XEN_PREPARE);
diff --git a/block/bio.c b/block/bio.c
index b38e962fa83e..101c2a9b5481 100644
--- a/block/bio.c
+++ b/block/bio.c
@@ -1239,8 +1239,8 @@ struct bio *bio_copy_user_iov(struct request_queue *q,
          */
         bmd->is_our_pages = map_data ? 0 : 1;
         memcpy(bmd->iov, iter->iov, sizeof(struct iovec) * iter->nr_segs);
-        iov_iter_init(&bmd->iter, iter->type, bmd->iov,
-                        iter->nr_segs, iter->count);
+        bmd->iter = *iter;
+        bmd->iter.iov = bmd->iov;
 
         ret = -ENOMEM;
         bio = bio_kmalloc(gfp_mask, nr_pages);
@@ -1331,6 +1331,7 @@ struct bio *bio_map_user_iov(struct request_queue *q,
         int ret, offset;
         struct iov_iter i;
         struct iovec iov;
+        struct bio_vec *bvec;
 
         iov_for_each(iov, i, *iter) {
                 unsigned long uaddr = (unsigned long) iov.iov_base;
@@ -1375,7 +1376,12 @@ struct bio *bio_map_user_iov(struct request_queue *q,
                 ret = get_user_pages_fast(uaddr, local_nr_pages,
                                 (iter->type & WRITE) != WRITE,
                                 &pages[cur_page]);
-                if (ret < local_nr_pages) {
+                if (unlikely(ret < local_nr_pages)) {
+                        for (j = cur_page; j < page_limit; j++) {
+                                if (!pages[j])
+                                        break;
+                                put_page(pages[j]);
+                        }
                         ret = -EFAULT;
                         goto out_unmap;
                 }
@@ -1383,6 +1389,7 @@ struct bio *bio_map_user_iov(struct request_queue *q,
                 offset = offset_in_page(uaddr);
                 for (j = cur_page; j < page_limit; j++) {
                         unsigned int bytes = PAGE_SIZE - offset;
+                        unsigned short prev_bi_vcnt = bio->bi_vcnt;
 
                         if (len <= 0)
                                 break;
@@ -1397,6 +1404,13 @@ struct bio *bio_map_user_iov(struct request_queue *q,
                                             bytes)
                                 break;
 
+                        /*
+                         * check if vector was merged with previous
+                         * drop page reference if needed
+                         */
+                        if (bio->bi_vcnt == prev_bi_vcnt)
+                                put_page(pages[j]);
+
                         len -= bytes;
                         offset = 0;
                 }
@@ -1423,10 +1437,8 @@ struct bio *bio_map_user_iov(struct request_queue *q,
         return bio;
 
  out_unmap:
-        for (j = 0; j < nr_pages; j++) {
-                if (!pages[j])
-                        break;
-                put_page(pages[j]);
+        bio_for_each_segment_all(bvec, bio, j) {
+                put_page(bvec->bv_page);
         }
  out:
         kfree(pages);
diff --git a/crypto/shash.c b/crypto/shash.c
index 5e31c8d776df..325a14da5827 100644
--- a/crypto/shash.c
+++ b/crypto/shash.c
@@ -41,7 +41,7 @@ static int shash_setkey_unaligned(struct crypto_shash *tfm, const u8 *key,
         int err;
 
         absize = keylen + (alignmask & ~(crypto_tfm_ctx_alignment() - 1));
-        buffer = kmalloc(absize, GFP_KERNEL);
+        buffer = kmalloc(absize, GFP_ATOMIC);
         if (!buffer)
                 return -ENOMEM;
 
@@ -275,12 +275,14 @@ static int shash_async_finup(struct ahash_request *req)
 
 int shash_ahash_digest(struct ahash_request *req, struct shash_desc *desc)
 {
-        struct scatterlist *sg = req->src;
-        unsigned int offset = sg->offset;
         unsigned int nbytes = req->nbytes;
+        struct scatterlist *sg;
+        unsigned int offset;
         int err;
 
-        if (nbytes < min(sg->length, ((unsigned int)(PAGE_SIZE)) - offset)) {
+        if (nbytes &&
+            (sg = req->src, offset = sg->offset,
+             nbytes < min(sg->length, ((unsigned int)(PAGE_SIZE)) - offset))) {
                 void *data;
 
                 data = kmap_atomic(sg_page(sg));
diff --git a/crypto/skcipher.c b/crypto/skcipher.c
index 4faa0fd53b0c..d5692e35fab1 100644
--- a/crypto/skcipher.c
+++ b/crypto/skcipher.c
@@ -426,14 +426,9 @@ static int skcipher_copy_iv(struct skcipher_walk *walk)
 
 static int skcipher_walk_first(struct skcipher_walk *walk)
 {
-        walk->nbytes = 0;
-
         if (WARN_ON_ONCE(in_irq()))
                 return -EDEADLK;
 
-        if (unlikely(!walk->total))
-                return 0;
-
         walk->buffer = NULL;
         if (unlikely(((unsigned long)walk->iv & walk->alignmask))) {
                 int err = skcipher_copy_iv(walk);
@@ -452,10 +447,15 @@ static int skcipher_walk_skcipher(struct skcipher_walk *walk,
 {
         struct crypto_skcipher *tfm = crypto_skcipher_reqtfm(req);
 
+        walk->total = req->cryptlen;
+        walk->nbytes = 0;
+
+        if (unlikely(!walk->total))
+                return 0;
+
         scatterwalk_start(&walk->in, req->src);
         scatterwalk_start(&walk->out, req->dst);
 
-        walk->total = req->cryptlen;
         walk->iv = req->iv;
         walk->oiv = req->iv;
 
@@ -509,6 +509,11 @@ static int skcipher_walk_aead_common(struct skcipher_walk *walk,
         struct crypto_aead *tfm = crypto_aead_reqtfm(req);
         int err;
 
+        walk->nbytes = 0;
+
+        if (unlikely(!walk->total))
+                return 0;
+
         walk->flags &= ~SKCIPHER_WALK_PHYS;
 
         scatterwalk_start(&walk->in, req->src);
diff --git a/crypto/xts.c b/crypto/xts.c
index d86c11a8c882..e31828ed0046 100644
--- a/crypto/xts.c
+++ b/crypto/xts.c
@@ -554,8 +554,10 @@ static int create(struct crypto_template *tmpl, struct rtattr **tb)
                 ctx->name[len - 1] = 0;
 
                 if (snprintf(inst->alg.base.cra_name, CRYPTO_MAX_ALG_NAME,
-                             "xts(%s)", ctx->name) >= CRYPTO_MAX_ALG_NAME)
-                        return -ENAMETOOLONG;
+                             "xts(%s)", ctx->name) >= CRYPTO_MAX_ALG_NAME) {
+                        err = -ENAMETOOLONG;
+                        goto err_drop_spawn;
+                }
         } else
                 goto err_drop_spawn;
 
diff --git a/drivers/acpi/property.c b/drivers/acpi/property.c
index 3fb8ff513461..e26ea209b63e 100644
--- a/drivers/acpi/property.c
+++ b/drivers/acpi/property.c
@@ -571,10 +571,9 @@ static int acpi_data_get_property_array(const struct acpi_device_data *data,
  *     }
  * }
  *
- * Calling this function with index %2 return %-ENOENT and with index %3
- * returns the last entry. If the property does not contain any more values
- * %-ENODATA is returned. The NULL entry must be single integer and
- * preferably contain value %0.
+ * Calling this function with index %2 or index %3 return %-ENOENT. If the
+ * property does not contain any more values %-ENOENT is returned. The NULL
+ * entry must be single integer and preferably contain value %0.
  *
  * Return: %0 on success, negative error code on failure.
  */
@@ -590,11 +589,11 @@ int __acpi_node_get_property_reference(const struct fwnode_handle *fwnode,
 
         data = acpi_device_data_of_node(fwnode);
         if (!data)
-                return -EINVAL;
+                return -ENOENT;
 
         ret = acpi_data_get_property(data, propname, ACPI_TYPE_ANY, &obj);
         if (ret)
-                return ret;
+                return ret == -EINVAL ? -ENOENT : -EINVAL;
 
         /*
          * The simplest case is when the value is a single reference.  Just
@@ -606,7 +605,7 @@ int __acpi_node_get_property_reference(const struct fwnode_handle *fwnode,
 
                 ret = acpi_bus_get_device(obj->reference.handle, &device);
                 if (ret)
-                        return ret;
+                        return ret == -ENODEV ? -EINVAL : ret;
 
                 args->adev = device;
                 args->nargs = 0;
@@ -622,8 +621,10 @@ int __acpi_node_get_property_reference(const struct fwnode_handle *fwnode,
          * The index argument is then used to determine which reference
          * the caller wants (along with the arguments).
          */
-        if (obj->type != ACPI_TYPE_PACKAGE || index >= obj->package.count)
-                return -EPROTO;
+        if (obj->type != ACPI_TYPE_PACKAGE)
+                return -EINVAL;
+        if (index >= obj->package.count)
+                return -ENOENT;
 
         element = obj->package.elements;
         end = element + obj->package.count;
@@ -635,7 +636,7 @@ int __acpi_node_get_property_reference(const struct fwnode_handle *fwnode,
                         ret = acpi_bus_get_device(element->reference.handle,
                                                   &device);
                         if (ret)
-                                return -ENODEV;
+                                return -EINVAL;
 
                         nargs = 0;
                         element++;
@@ -649,11 +650,11 @@ int __acpi_node_get_property_reference(const struct fwnode_handle *fwnode,
                                 else if (type == ACPI_TYPE_LOCAL_REFERENCE)
                                         break;
                                 else
-                                        return -EPROTO;
+                                        return -EINVAL;
                         }
 
                         if (nargs > MAX_ACPI_REFERENCE_ARGS)
-                                return -EPROTO;
+                                return -EINVAL;
 
                         if (idx == index) {
                                 args->adev = device;
@@ -670,13 +671,13 @@ int __acpi_node_get_property_reference(const struct fwnode_handle *fwnode,
                                 return -ENOENT;
                         element++;
                 } else {
-                        return -EPROTO;
+                        return -EINVAL;
                 }
 
                 idx++;
         }
 
-        return -ENODATA;
+        return -ENOENT;
 }
 EXPORT_SYMBOL_GPL(__acpi_node_get_property_reference);
 
diff --git a/drivers/base/property.c b/drivers/base/property.c
index d0b65bbe7e15..7ed99c1b2a8b 100644
--- a/drivers/base/property.c
+++ b/drivers/base/property.c
@@ -21,6 +21,7 @@
 #include <linux/phy.h>
 
 struct property_set {
+        struct device *dev;
         struct fwnode_handle fwnode;
         const struct property_entry *properties;
 };
@@ -682,6 +683,10 @@ EXPORT_SYMBOL_GPL(fwnode_property_match_string);
  * Caller is responsible to call fwnode_handle_put() on the returned
  * args->fwnode pointer.
  *
+ * Returns: %0 on success
+ *          %-ENOENT when the index is out of bounds, the index has an empty
+ *                   reference or the property was not found
+ *          %-EINVAL on parse error
  */
 int fwnode_property_get_reference_args(const struct fwnode_handle *fwnode,
                                        const char *prop, const char *nargs_prop,
@@ -891,6 +896,7 @@ static struct property_set *pset_copy_set(const struct property_set *pset)
 void device_remove_properties(struct device *dev)
 {
         struct fwnode_handle *fwnode;
+        struct property_set *pset;
 
         fwnode = dev_fwnode(dev);
         if (!fwnode)
@@ -900,16 +906,16 @@ void device_remove_properties(struct device *dev)
          * the pset. If there is no real firmware node (ACPI/DT) primary
          * will hold the pset.
          */
-        if (is_pset_node(fwnode)) {
+        pset = to_pset_node(fwnode);
+        if (pset) {
                 set_primary_fwnode(dev, NULL);
-                pset_free_set(to_pset_node(fwnode));
         } else {
-                fwnode = fwnode->secondary;
-                if (!IS_ERR(fwnode) && is_pset_node(fwnode)) {
+                pset = to_pset_node(fwnode->secondary);
+                if (pset && dev == pset->dev)
                         set_secondary_fwnode(dev, NULL);
-                        pset_free_set(to_pset_node(fwnode));
-                }
         }
+        if (pset && dev == pset->dev)
+                pset_free_set(pset);
 }
 EXPORT_SYMBOL_GPL(device_remove_properties);
 
@@ -938,6 +944,7 @@ int device_add_properties(struct device *dev,
 
         p->fwnode.ops = &pset_fwnode_ops;
         set_secondary_fwnode(dev, &p->fwnode);
+        p->dev = dev;
         return 0;
 }
 EXPORT_SYMBOL_GPL(device_add_properties);
diff --git a/drivers/crypto/axis/artpec6_crypto.c b/drivers/crypto/axis/artpec6_crypto.c
index d9fbbf01062b..0f9754e07719 100644
--- a/drivers/crypto/axis/artpec6_crypto.c
+++ b/drivers/crypto/axis/artpec6_crypto.c
@@ -349,8 +349,6 @@ struct artpec6_crypto_aead_req_ctx {
 /* The crypto framework makes it hard to avoid this global. */
 static struct device *artpec6_crypto_dev;
 
-static struct dentry *dbgfs_root;
-
 #ifdef CONFIG_FAULT_INJECTION
 static DECLARE_FAULT_ATTR(artpec6_crypto_fail_status_read);
 static DECLARE_FAULT_ATTR(artpec6_crypto_fail_dma_array_full);
@@ -2984,6 +2982,8 @@ struct dbgfs_u32 {
         char *desc;
 };
 
+static struct dentry *dbgfs_root;
+
 static void artpec6_crypto_init_debugfs(void)
 {
         dbgfs_root = debugfs_create_dir("artpec6_crypto", NULL);
diff --git a/drivers/crypto/stm32/stm32-hash.c b/drivers/crypto/stm32/stm32-hash.c
index b585ce54a802..4835dd4a9e50 100644
--- a/drivers/crypto/stm32/stm32-hash.c
+++ b/drivers/crypto/stm32/stm32-hash.c
@@ -553,9 +553,9 @@ static int stm32_hash_dma_send(struct stm32_hash_dev *hdev)
 {
         struct stm32_hash_request_ctx *rctx = ahash_request_ctx(hdev->req);
         struct scatterlist sg[1], *tsg;
-        int err = 0, len = 0, reg, ncp;
+        int err = 0, len = 0, reg, ncp = 0;
         unsigned int i;
-        const u32 *buffer = (const u32 *)rctx->buffer;
+        u32 *buffer = (void *)rctx->buffer;
 
         rctx->sg = hdev->req->src;
         rctx->total = hdev->req->nbytes;
@@ -620,10 +620,13 @@ static int stm32_hash_dma_send(struct stm32_hash_dev *hdev)
                 reg |= HASH_CR_DMAA;
                 stm32_hash_write(hdev, HASH_CR, reg);
 
-                for (i = 0; i < DIV_ROUND_UP(ncp, sizeof(u32)); i++)
-                        stm32_hash_write(hdev, HASH_DIN, buffer[i]);
-
-                stm32_hash_set_nblw(hdev, ncp);
+                if (ncp) {
+                        memset(buffer + ncp, 0,
+                               DIV_ROUND_UP(ncp, sizeof(u32)) - ncp);
+                        writesl(hdev->io_base + HASH_DIN, buffer,
+                                DIV_ROUND_UP(ncp, sizeof(u32)));
+                }
+                stm32_hash_set_nblw(hdev, DIV_ROUND_UP(ncp, sizeof(u32)));
                 reg = stm32_hash_read(hdev, HASH_STR);
                 reg |= HASH_STR_DCAL;
                 stm32_hash_write(hdev, HASH_STR, reg);
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index 3388d54ba114..3f80f167ed56 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -453,7 +453,8 @@ config GPIO_TS4800
 config GPIO_THUNDERX
         tristate "Cavium ThunderX/OCTEON-TX GPIO"
         depends on ARCH_THUNDER || (64BIT && COMPILE_TEST)
-        depends on PCI_MSI && IRQ_DOMAIN_HIERARCHY
+        depends on PCI_MSI
+        select IRQ_DOMAIN_HIERARCHY
         select IRQ_FASTEOI_HIERARCHY_HANDLERS
         help
           Say yes here to support the on-chip GPIO lines on the ThunderX
diff --git a/drivers/gpio/gpio-omap.c b/drivers/gpio/gpio-omap.c
index dbf869fb63ce..3233b72b6828 100644
--- a/drivers/gpio/gpio-omap.c
+++ b/drivers/gpio/gpio-omap.c
@@ -518,7 +518,13 @@ static int omap_gpio_irq_type(struct irq_data *d, unsigned type)
         if (type & (IRQ_TYPE_LEVEL_LOW | IRQ_TYPE_LEVEL_HIGH))
                 irq_set_handler_locked(d, handle_level_irq);
         else if (type & (IRQ_TYPE_EDGE_FALLING | IRQ_TYPE_EDGE_RISING))
-                irq_set_handler_locked(d, handle_edge_irq);
+                /*
+                 * Edge IRQs are already cleared/acked in irq_handler and
+                 * not need to be masked, as result handle_edge_irq()
+                 * logic is excessed here and may cause lose of interrupts.
+                 * So just use handle_simple_irq.
+                 */
+                irq_set_handler_locked(d, handle_simple_irq);
 
         return 0;
 
@@ -678,7 +684,7 @@ static void omap_gpio_free(struct gpio_chip *chip, unsigned offset)
 static irqreturn_t omap_gpio_irq_handler(int irq, void *gpiobank)
 {
         void __iomem *isr_reg = NULL;
-        u32 isr;
+        u32 enabled, isr, level_mask;
         unsigned int bit;
         struct gpio_bank *bank = gpiobank;
         unsigned long wa_lock_flags;
@@ -691,23 +697,21 @@ static irqreturn_t omap_gpio_irq_handler(int irq, void *gpiobank)
         pm_runtime_get_sync(bank->chip.parent);
 
         while (1) {
-                u32 isr_saved, level_mask = 0;
-                u32 enabled;
-
                 raw_spin_lock_irqsave(&bank->lock, lock_flags);
 
                 enabled = omap_get_gpio_irqbank_mask(bank);
-                isr_saved = isr = readl_relaxed(isr_reg) & enabled;
+                isr = readl_relaxed(isr_reg) & enabled;
 
                 if (bank->level_mask)
                         level_mask = bank->level_mask & enabled;
+                else
+                        level_mask = 0;
 
                 /* clear edge sensitive interrupts before handler(s) are
                 called so that we don't miss any interrupt occurred while
                 executing them */
-                omap_disable_gpio_irqbank(bank, isr_saved & ~level_mask);
-                omap_clear_gpio_irqbank(bank, isr_saved & ~level_mask);
-                omap_enable_gpio_irqbank(bank, isr_saved & ~level_mask);
+                if (isr & ~level_mask)
+                        omap_clear_gpio_irqbank(bank, isr & ~level_mask);
 
                 raw_spin_unlock_irqrestore(&bank->lock, lock_flags);
 
@@ -1010,7 +1014,7 @@ static void omap_gpio_set(struct gpio_chip *chip, unsigned offset, int value)
 
 /*---------------------------------------------------------------------*/
 
-static void __init omap_gpio_show_rev(struct gpio_bank *bank)
+static void omap_gpio_show_rev(struct gpio_bank *bank)
 {
         static bool called;
         u32 rev;
diff --git a/drivers/gpio/gpiolib-acpi.c b/drivers/gpio/gpiolib-acpi.c
index 4d2113530735..eb4528c87c0b 100644
--- a/drivers/gpio/gpiolib-acpi.c
+++ b/drivers/gpio/gpiolib-acpi.c
@@ -203,7 +203,7 @@ static acpi_status acpi_gpiochip_request_interrupt(struct acpi_resource *ares,
 
         if (pin <= 255) {
                 char ev_name[5];
-                sprintf(ev_name, "_%c%02X",
+                sprintf(ev_name, "_%c%02hhX",
                         agpio->triggering == ACPI_EDGE_SENSITIVE ? 'E' : 'L',
                         pin);
                 if (ACPI_SUCCESS(acpi_get_handle(handle, ev_name, &evt_handle)))
diff --git a/drivers/hid/Kconfig b/drivers/hid/Kconfig
index 0a3117cc29e7..374301fcbc86 100644
--- a/drivers/hid/Kconfig
+++ b/drivers/hid/Kconfig
@@ -281,6 +281,7 @@ config HID_ELECOM
         Support for ELECOM devices:
           - BM084 Bluetooth Mouse
           - DEFT Trackball (Wired and wireless)
+          - HUGE Trackball (Wired and wireless)
 
 config HID_ELO
         tristate "ELO USB 4000/4500 touchscreen"
diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
index 9bc91160819b..330ca983828b 100644
--- a/drivers/hid/hid-core.c
+++ b/drivers/hid/hid-core.c
@@ -2032,6 +2032,8 @@ static const struct hid_device_id hid_have_special_driver[] = {
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_DEFT_WIRED) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_DEFT_WIRELESS) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_HUGE_WIRED) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_HUGE_WIRELESS) },
 #endif
 #if IS_ENABLED(CONFIG_HID_ELO)
         { HID_USB_DEVICE(USB_VENDOR_ID_ELO, 0x0009) },
diff --git a/drivers/hid/hid-elecom.c b/drivers/hid/hid-elecom.c
index e2c7465df69f..54aeea57d209 100644
--- a/drivers/hid/hid-elecom.c
+++ b/drivers/hid/hid-elecom.c
@@ -3,6 +3,7 @@
  *  Copyright (c) 2010 Richard Nauber <Richard.Nauber@gmail.com>
  *  Copyright (c) 2016 Yuxuan Shui <yshuiv7@gmail.com>
  *  Copyright (c) 2017 Diego Elio Pettenò <flameeyes@flameeyes.eu>
+ *  Copyright (c) 2017 Alex Manoussakis <amanou@gnu.org>
  */
 
 /*
@@ -32,9 +33,11 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                 break;
         case USB_DEVICE_ID_ELECOM_DEFT_WIRED:
         case USB_DEVICE_ID_ELECOM_DEFT_WIRELESS:
-                /* The DEFT trackball has eight buttons, but its descriptor only
-                 * reports five, disabling the three Fn buttons on the top of
-                 * the mouse.
+        case USB_DEVICE_ID_ELECOM_HUGE_WIRED:
+        case USB_DEVICE_ID_ELECOM_HUGE_WIRELESS:
+                /* The DEFT/HUGE trackball has eight buttons, but its descriptor
+                 * only reports five, disabling the three Fn buttons on the top
+                 * of the mouse.
                  *
                  * Apply the following diff to the descriptor:
                  *
@@ -62,7 +65,7 @@ static __u8 *elecom_report_fixup(struct hid_device *hdev, __u8 *rdesc,
                  * End Collection,                     End Collection,
                  */
                 if (*rsize == 213 && rdesc[13] == 5 && rdesc[21] == 5) {
-                        hid_info(hdev, "Fixing up Elecom DEFT Fn buttons\n");
+                        hid_info(hdev, "Fixing up Elecom DEFT/HUGE Fn buttons\n");
                         rdesc[13] = 8; /* Button/Variable Report Count */
                         rdesc[21] = 8; /* Button/Variable Usage Maximum */
                         rdesc[29] = 0; /* Button/Constant Report Count */
@@ -76,6 +79,8 @@ static const struct hid_device_id elecom_devices[] = {
         { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_BM084) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_DEFT_WIRED) },
         { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_DEFT_WIRELESS) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_HUGE_WIRED) },
+        { HID_USB_DEVICE(USB_VENDOR_ID_ELECOM, USB_DEVICE_ID_ELECOM_HUGE_WIRELESS) },
         { }
 };
 MODULE_DEVICE_TABLE(hid, elecom_devices);
diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
index a98919199858..be2e005c3c51 100644
--- a/drivers/hid/hid-ids.h
+++ b/drivers/hid/hid-ids.h
@@ -368,6 +368,8 @@
 #define USB_DEVICE_ID_ELECOM_BM084      0x0061
 #define USB_DEVICE_ID_ELECOM_DEFT_WIRED 0x00fe
 #define USB_DEVICE_ID_ELECOM_DEFT_WIRELESS      0x00ff
+#define USB_DEVICE_ID_ELECOM_HUGE_WIRED 0x010c
+#define USB_DEVICE_ID_ELECOM_HUGE_WIRELESS      0x010d
 
 #define USB_VENDOR_ID_DREAM_CHEEKY      0x1d34
 #define USB_DEVICE_ID_DREAM_CHEEKY_WN   0x0004
diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
index 089bad8a9a21..045b5da9b992 100644
--- a/drivers/hid/usbhid/hid-core.c
+++ b/drivers/hid/usbhid/hid-core.c
@@ -975,6 +975,8 @@ static int usbhid_parse(struct hid_device *hid)
         unsigned int rsize = 0;
         char *rdesc;
         int ret, n;
+        int num_descriptors;
+        size_t offset = offsetof(struct hid_descriptor, desc);
 
         quirks = usbhid_lookup_quirk(le16_to_cpu(dev->descriptor.idVendor),
                         le16_to_cpu(dev->descriptor.idProduct));
@@ -997,10 +999,18 @@ static int usbhid_parse(struct hid_device *hid)
                 return -ENODEV;
         }
 
+        if (hdesc->bLength < sizeof(struct hid_descriptor)) {
+                dbg_hid("hid descriptor is too short\n");
+                return -EINVAL;
+        }
+
         hid->version = le16_to_cpu(hdesc->bcdHID);
         hid->country = hdesc->bCountryCode;
 
-        for (n = 0; n < hdesc->bNumDescriptors; n++)
+        num_descriptors = min_t(int, hdesc->bNumDescriptors,
+               (hdesc->bLength - offset) / sizeof(struct hid_class_descriptor));
+
+        for (n = 0; n < num_descriptors; n++)
                 if (hdesc->desc[n].bDescriptorType == HID_DT_REPORT)
                         rsize = le16_to_cpu(hdesc->desc[n].wDescriptorLength);
 
diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
index 49b80da51ba7..805ab45e9b5a 100644
--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
@@ -565,8 +565,10 @@ static inline bool nicvf_xdp_rx(struct nicvf *nic, struct bpf_prog *prog,
                 return true;
         default:
                 bpf_warn_invalid_xdp_action(action);
+                /* fall through */
         case XDP_ABORTED:
                 trace_xdp_exception(nic->netdev, prog, action);
+                /* fall through */
         case XDP_DROP:
                 /* Check if it's a recycled page, if not
                  * unmap the DMA mapping.
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_82598.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_82598.c
index 523f9d05a810..8a32eb7d47b9 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_82598.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_82598.c
@@ -175,31 +175,9 @@ static s32 ixgbe_init_phy_ops_82598(struct ixgbe_hw *hw)
  **/
 static s32 ixgbe_start_hw_82598(struct ixgbe_hw *hw)
 {
-#ifndef CONFIG_SPARC
-        u32 regval;
-        u32 i;
-#endif
         s32 ret_val;
 
         ret_val = ixgbe_start_hw_generic(hw);
-
-#ifndef CONFIG_SPARC
-        /* Disable relaxed ordering */
-        for (i = 0; ((i < hw->mac.max_tx_queues) &&
-             (i < IXGBE_DCA_MAX_QUEUES_82598)); i++) {
-                regval = IXGBE_READ_REG(hw, IXGBE_DCA_TXCTRL(i));
-                regval &= ~IXGBE_DCA_TXCTRL_DESC_WRO_EN;
-                IXGBE_WRITE_REG(hw, IXGBE_DCA_TXCTRL(i), regval);
-        }
-
-        for (i = 0; ((i < hw->mac.max_rx_queues) &&
-             (i < IXGBE_DCA_MAX_QUEUES_82598)); i++) {
-                regval = IXGBE_READ_REG(hw, IXGBE_DCA_RXCTRL(i));
-                regval &= ~(IXGBE_DCA_RXCTRL_DATA_WRO_EN |
-                            IXGBE_DCA_RXCTRL_HEAD_WRO_EN);
-                IXGBE_WRITE_REG(hw, IXGBE_DCA_RXCTRL(i), regval);
-        }
-#endif
         if (ret_val)
                 return ret_val;
 
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
index 2c19070d2a0b..6e6ab6f6875e 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_common.c
@@ -366,25 +366,6 @@ s32 ixgbe_start_hw_gen2(struct ixgbe_hw *hw)
         }
         IXGBE_WRITE_FLUSH(hw);
 
-#ifndef CONFIG_ARCH_WANT_RELAX_ORDER
-        /* Disable relaxed ordering */
-        for (i = 0; i < hw->mac.max_tx_queues; i++) {
-                u32 regval;
-
-                regval = IXGBE_READ_REG(hw, IXGBE_DCA_TXCTRL_82599(i));
-                regval &= ~IXGBE_DCA_TXCTRL_DESC_WRO_EN;
-                IXGBE_WRITE_REG(hw, IXGBE_DCA_TXCTRL_82599(i), regval);
-        }
-
-        for (i = 0; i < hw->mac.max_rx_queues; i++) {
-                u32 regval;
-
-                regval = IXGBE_READ_REG(hw, IXGBE_DCA_RXCTRL(i));
-                regval &= ~(IXGBE_DCA_RXCTRL_DATA_WRO_EN |
-                            IXGBE_DCA_RXCTRL_HEAD_WRO_EN);
-                IXGBE_WRITE_REG(hw, IXGBE_DCA_RXCTRL(i), regval);
-        }
-#endif
         return 0;
 }
 
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
index 72c565712a5f..c3e7a8191128 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
@@ -1048,7 +1048,7 @@ static int ixgbe_set_ringparam(struct net_device *netdev,
 {
         struct ixgbe_adapter *adapter = netdev_priv(netdev);
         struct ixgbe_ring *temp_ring;
-        int i, err = 0;
+        int i, j, err = 0;
         u32 new_rx_count, new_tx_count;
 
         if ((ring->rx_mini_pending) || (ring->rx_jumbo_pending))
@@ -1085,8 +1085,8 @@ static int ixgbe_set_ringparam(struct net_device *netdev,
         }
 
         /* allocate temporary buffer to store rings in */
-        i = max_t(int, adapter->num_tx_queues, adapter->num_rx_queues);
-        i = max_t(int, i, adapter->num_xdp_queues);
+        i = max_t(int, adapter->num_tx_queues + adapter->num_xdp_queues,
+                  adapter->num_rx_queues);
         temp_ring = vmalloc(i * sizeof(struct ixgbe_ring));
 
         if (!temp_ring) {
@@ -1118,8 +1118,8 @@ static int ixgbe_set_ringparam(struct net_device *netdev,
                         }
                 }
 
-                for (i = 0; i < adapter->num_xdp_queues; i++) {
-                        memcpy(&temp_ring[i], adapter->xdp_ring[i],
+                for (j = 0; j < adapter->num_xdp_queues; j++, i++) {
+                        memcpy(&temp_ring[i], adapter->xdp_ring[j],
                                sizeof(struct ixgbe_ring));
 
                         temp_ring[i].count = new_tx_count;
@@ -1139,10 +1139,10 @@ static int ixgbe_set_ringparam(struct net_device *netdev,
                         memcpy(adapter->tx_ring[i], &temp_ring[i],
                                sizeof(struct ixgbe_ring));
                 }
-                for (i = 0; i < adapter->num_xdp_queues; i++) {
-                        ixgbe_free_tx_resources(adapter->xdp_ring[i]);
+                for (j = 0; j < adapter->num_xdp_queues; j++, i++) {
+                        ixgbe_free_tx_resources(adapter->xdp_ring[j]);
 
-                        memcpy(adapter->xdp_ring[i], &temp_ring[i],
+                        memcpy(adapter->xdp_ring[j], &temp_ring[i],
                                sizeof(struct ixgbe_ring));
                 }
 
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index d962368d08d0..4d76afd13868 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -4881,7 +4881,7 @@ static void ixgbe_clear_udp_tunnel_port(struct ixgbe_adapter *adapter, u32 mask)
                                 IXGBE_FLAG_GENEVE_OFFLOAD_CAPABLE)))
                 return;
 
-        vxlanctrl = IXGBE_READ_REG(hw, IXGBE_VXLANCTRL) && ~mask;
+        vxlanctrl = IXGBE_READ_REG(hw, IXGBE_VXLANCTRL) & ~mask;
         IXGBE_WRITE_REG(hw, IXGBE_VXLANCTRL, vxlanctrl);
 
         if (mask & IXGBE_VXLANCTRL_VXLAN_UDPPORT_MASK)
@@ -8529,6 +8529,10 @@ static int ixgbe_ioctl(struct net_device *netdev, struct ifreq *req, int cmd)
                 return ixgbe_ptp_set_ts_config(adapter, req);
         case SIOCGHWTSTAMP:
                 return ixgbe_ptp_get_ts_config(adapter, req);
+        case SIOCGMIIPHY:
+                if (!adapter->hw.phy.ops.read_reg)
+                        return -EOPNOTSUPP;
+                /* fall through */
         default:
                 return mdio_mii_ioctl(&adapter->hw.phy.mdio, if_mii(req), cmd);
         }
diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
index 032089efc1a0..c16718d296d3 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_router.c
@@ -3505,20 +3505,6 @@ static int mlxsw_sp_fib_lpm_tree_link(struct mlxsw_sp *mlxsw_sp,
 static void mlxsw_sp_fib_lpm_tree_unlink(struct mlxsw_sp *mlxsw_sp,
                                          struct mlxsw_sp_fib *fib)
 {
-        struct mlxsw_sp_prefix_usage req_prefix_usage = {{ 0 } };
-        struct mlxsw_sp_lpm_tree *lpm_tree;
-
-        /* Aggregate prefix lengths across all virtual routers to make
-         * sure we only have used prefix lengths in the LPM tree.
-         */
-        mlxsw_sp_vrs_prefixes(mlxsw_sp, fib->proto, &req_prefix_usage);
-        lpm_tree = mlxsw_sp_lpm_tree_get(mlxsw_sp, &req_prefix_usage,
-                                         fib->proto);
-        if (IS_ERR(lpm_tree))
-                goto err_tree_get;
-        mlxsw_sp_vrs_lpm_tree_replace(mlxsw_sp, fib, lpm_tree);
-
-err_tree_get:
         if (!mlxsw_sp_prefix_usage_none(&fib->prefix_usage))
                 return;
         mlxsw_sp_vr_lpm_tree_unbind(mlxsw_sp, fib);
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index c3f77e3b7819..e365866600ba 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -1339,7 +1339,17 @@ ppp_get_stats64(struct net_device *dev, struct rtnl_link_stats64 *stats64)
 
 static int ppp_dev_init(struct net_device *dev)
 {
+        struct ppp *ppp;
+
         netdev_lockdep_set_classes(dev);
+
+        ppp = netdev_priv(dev);
+        /* Let the netdevice take a reference on the ppp file. This ensures
+         * that ppp_destroy_interface() won't run before the device gets
+         * unregistered.
+         */
+        atomic_inc(&ppp->file.refcnt);
+
         return 0;
 }
 
@@ -1362,6 +1372,15 @@ static void ppp_dev_uninit(struct net_device *dev)
         wake_up_interruptible(&ppp->file.rwait);
 }
 
+static void ppp_dev_priv_destructor(struct net_device *dev)
+{
+        struct ppp *ppp;
+
+        ppp = netdev_priv(dev);
+        if (atomic_dec_and_test(&ppp->file.refcnt))
+                ppp_destroy_interface(ppp);
+}
+
 static const struct net_device_ops ppp_netdev_ops = {
         .ndo_init        = ppp_dev_init,
         .ndo_uninit      = ppp_dev_uninit,
@@ -1387,6 +1406,7 @@ static void ppp_setup(struct net_device *dev)
         dev->tx_queue_len = 3;
         dev->type = ARPHRD_PPP;
         dev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST;
+        dev->priv_destructor = ppp_dev_priv_destructor;
         netif_keep_dst(dev);
 }
 
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 29c7e2ec0dcb..52ea80bcd639 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -560,6 +560,7 @@ static const struct driver_info wwan_info = {
 #define NVIDIA_VENDOR_ID        0x0955
 #define HP_VENDOR_ID            0x03f0
 #define MICROSOFT_VENDOR_ID     0x045e
+#define UBLOX_VENDOR_ID         0x1546
 
 static const struct usb_device_id       products[] = {
 /* BLACKLIST !!
@@ -869,6 +870,18 @@ static const struct usb_device_id	products[] = {
                                       USB_CDC_PROTO_NONE),
         .driver_info = (unsigned long)&zte_cdc_info,
 }, {
+        /* U-blox TOBY-L2 */
+        USB_DEVICE_AND_INTERFACE_INFO(UBLOX_VENDOR_ID, 0x1143, USB_CLASS_COMM,
+                                      USB_CDC_SUBCLASS_ETHERNET,
+                                      USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long)&wwan_info,
+}, {
+        /* U-blox SARA-U2 */
+        USB_DEVICE_AND_INTERFACE_INFO(UBLOX_VENDOR_ID, 0x1104, USB_CLASS_COMM,
+                                      USB_CDC_SUBCLASS_ETHERNET,
+                                      USB_CDC_PROTO_NONE),
+        .driver_info = (unsigned long)&wwan_info,
+}, {
         USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_ETHERNET,
                         USB_CDC_PROTO_NONE),
         .driver_info = (unsigned long) &cdc_info,
diff --git a/drivers/pinctrl/Kconfig b/drivers/pinctrl/Kconfig
index 1778cf4f81c7..82cd8b08d71f 100644
--- a/drivers/pinctrl/Kconfig
+++ b/drivers/pinctrl/Kconfig
@@ -100,6 +100,7 @@ config PINCTRL_AMD
         tristate "AMD GPIO pin control"
         depends on GPIOLIB
         select GPIOLIB_IRQCHIP
+        select PINMUX
         select PINCONF
         select GENERIC_PINCONF
         help
diff --git a/drivers/pinctrl/bcm/pinctrl-bcm2835.c b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
index 0944310225db..ff782445dfb7 100644
--- a/drivers/pinctrl/bcm/pinctrl-bcm2835.c
+++ b/drivers/pinctrl/bcm/pinctrl-bcm2835.c
@@ -373,16 +373,12 @@ static void bcm2835_gpio_irq_handle_bank(struct bcm2835_pinctrl *pc,
         unsigned long events;
         unsigned offset;
         unsigned gpio;
-        unsigned int type;
 
         events = bcm2835_gpio_rd(pc, GPEDS0 + bank * 4);
         events &= mask;
         events &= pc->enabled_irq_map[bank];
         for_each_set_bit(offset, &events, 32) {
                 gpio = (32 * bank) + offset;
-                /* FIXME: no clue why the code looks up the type here */
-                type = pc->irq_type[gpio];
-
                 generic_handle_irq(irq_linear_revmap(pc->gpio_chip.irqdomain,
                                                      gpio));
         }
diff --git a/drivers/pinctrl/intel/pinctrl-cherryview.c b/drivers/pinctrl/intel/pinctrl-cherryview.c
index 04e929fd0ffe..fadbca907c7c 100644
--- a/drivers/pinctrl/intel/pinctrl-cherryview.c
+++ b/drivers/pinctrl/intel/pinctrl-cherryview.c
@@ -1577,6 +1577,7 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
         struct gpio_chip *chip = &pctrl->chip;
         bool need_valid_mask = !dmi_check_system(chv_no_valid_mask);
         int ret, i, offset;
+        int irq_base;
 
         *chip = chv_gpio_chip;
 
@@ -1622,7 +1623,18 @@ static int chv_gpio_probe(struct chv_pinctrl *pctrl, int irq)
         /* Clear all interrupts */
         chv_writel(0xffff, pctrl->regs + CHV_INTSTAT);
 
-        ret = gpiochip_irqchip_add(chip, &chv_gpio_irqchip, 0,
+        if (!need_valid_mask) {
+                irq_base = devm_irq_alloc_descs(pctrl->dev, -1, 0,
+                                                chip->ngpio, NUMA_NO_NODE);
+                if (irq_base < 0) {
+                        dev_err(pctrl->dev, "Failed to allocate IRQ numbers\n");
+                        return irq_base;
+                }
+        } else {
+                irq_base = 0;
+        }
+
+        ret = gpiochip_irqchip_add(chip, &chv_gpio_irqchip, irq_base,
                                    handle_bad_irq, IRQ_TYPE_NONE);
         if (ret) {
                 dev_err(pctrl->dev, "failed to add IRQ chip\n");
diff --git a/drivers/remoteproc/Kconfig b/drivers/remoteproc/Kconfig
index df63e44526ac..bf04479456a0 100644
--- a/drivers/remoteproc/Kconfig
+++ b/drivers/remoteproc/Kconfig
@@ -109,6 +109,7 @@ config QCOM_Q6V5_PIL
         depends on OF && ARCH_QCOM
         depends on QCOM_SMEM
         depends on RPMSG_QCOM_SMD || (COMPILE_TEST && RPMSG_QCOM_SMD=n)
+        depends on RPMSG_QCOM_GLINK_SMEM || RPMSG_QCOM_GLINK_SMEM=n
         select MFD_SYSCON
         select QCOM_RPROC_COMMON
         select QCOM_SCM
@@ -120,6 +121,7 @@ config QCOM_WCNSS_PIL
         tristate "Qualcomm WCNSS Peripheral Image Loader"
         depends on OF && ARCH_QCOM
         depends on RPMSG_QCOM_SMD || (COMPILE_TEST && RPMSG_QCOM_SMD=n)
+        depends on RPMSG_QCOM_GLINK_SMEM || RPMSG_QCOM_GLINK_SMEM=n
         depends on QCOM_SMEM
         select QCOM_MDT_LOADER
         select QCOM_RPROC_COMMON
diff --git a/drivers/remoteproc/imx_rproc.c b/drivers/remoteproc/imx_rproc.c
index 612d91403341..633268e9d550 100644
--- a/drivers/remoteproc/imx_rproc.c
+++ b/drivers/remoteproc/imx_rproc.c
@@ -264,15 +264,14 @@ static int imx_rproc_addr_init(struct imx_rproc *priv,
                 if (!(att->flags & ATT_OWN))
                         continue;
 
-                if (b > IMX7D_RPROC_MEM_MAX)
+                if (b >= IMX7D_RPROC_MEM_MAX)
                         break;
 
                 priv->mem[b].cpu_addr = devm_ioremap(&pdev->dev,
                                                      att->sa, att->size);
-                if (IS_ERR(priv->mem[b].cpu_addr)) {
+                if (!priv->mem[b].cpu_addr) {
                         dev_err(dev, "devm_ioremap_resource failed\n");
-                        err = PTR_ERR(priv->mem[b].cpu_addr);
-                        return err;
+                        return -ENOMEM;
                 }
                 priv->mem[b].sys_addr = att->sa;
                 priv->mem[b].size = att->size;
@@ -296,7 +295,7 @@ static int imx_rproc_addr_init(struct imx_rproc *priv,
                         return err;
                 }
 
-                if (b > IMX7D_RPROC_MEM_MAX)
+                if (b >= IMX7D_RPROC_MEM_MAX)
                         break;
 
                 priv->mem[b].cpu_addr = devm_ioremap_resource(&pdev->dev, &res);
diff --git a/drivers/rpmsg/qcom_glink_native.c b/drivers/rpmsg/qcom_glink_native.c
index 5a5e927ea50f..5dcc9bf1c5bc 100644
--- a/drivers/rpmsg/qcom_glink_native.c
+++ b/drivers/rpmsg/qcom_glink_native.c
@@ -635,19 +635,18 @@ qcom_glink_alloc_intent(struct qcom_glink *glink,
         unsigned long flags;
 
         intent = kzalloc(sizeof(*intent), GFP_KERNEL);
-
         if (!intent)
                 return NULL;
 
         intent->data = kzalloc(size, GFP_KERNEL);
         if (!intent->data)
-                return NULL;
+                goto free_intent;
 
         spin_lock_irqsave(&channel->intent_lock, flags);
         ret = idr_alloc_cyclic(&channel->liids, intent, 1, -1, GFP_ATOMIC);
         if (ret < 0) {
                 spin_unlock_irqrestore(&channel->intent_lock, flags);
-                return NULL;
+                goto free_data;
         }
         spin_unlock_irqrestore(&channel->intent_lock, flags);
 
@@ -656,6 +655,12 @@ qcom_glink_alloc_intent(struct qcom_glink *glink,
         intent->reuse = reuseable;
 
         return intent;
+
+free_data:
+        kfree(intent->data);
+free_intent:
+        kfree(intent);
+        return NULL;
 }
 
 static void qcom_glink_handle_rx_done(struct qcom_glink *glink,
@@ -1197,7 +1202,7 @@ static int qcom_glink_request_intent(struct qcom_glink *glink,
 
         ret = qcom_glink_tx(glink, &cmd, sizeof(cmd), NULL, 0, true);
         if (ret)
-                return ret;
+                goto unlock;
 
         ret = wait_for_completion_timeout(&channel->intent_req_comp, 10 * HZ);
         if (!ret) {
@@ -1207,6 +1212,7 @@ static int qcom_glink_request_intent(struct qcom_glink *glink,
                 ret = channel->intent_req_result ? 0 : -ECANCELED;
         }
 
+unlock:
         mutex_unlock(&channel->intent_req_lock);
         return ret;
 }
diff --git a/fs/9p/vfs_addr.c b/fs/9p/vfs_addr.c
index adaf6f6dd858..e1cbdfdb7c68 100644
--- a/fs/9p/vfs_addr.c
+++ b/fs/9p/vfs_addr.c
@@ -310,9 +310,13 @@ static int v9fs_write_end(struct file *filp, struct address_space *mapping,
 
         p9_debug(P9_DEBUG_VFS, "filp %p, mapping %p\n", filp, mapping);
 
-        if (unlikely(copied < len && !PageUptodate(page))) {
-                copied = 0;
-                goto out;
+        if (!PageUptodate(page)) {
+                if (unlikely(copied < len)) {
+                        copied = 0;
+                        goto out;
+                } else if (len == PAGE_SIZE) {
+                        SetPageUptodate(page);
+                }
         }
         /*
          * No need to use i_size_read() here, the i_size
diff --git a/fs/direct-io.c b/fs/direct-io.c
index 62cf812ed0e5..96415c65bbdc 100644
--- a/fs/direct-io.c
+++ b/fs/direct-io.c
@@ -866,7 +866,8 @@ out:
          */
         if (sdio->boundary) {
                 ret = dio_send_cur_page(dio, sdio, map_bh);
-                dio_bio_submit(dio, sdio);
+                if (sdio->bio)
+                        dio_bio_submit(dio, sdio);
                 put_page(sdio->cur_page);
                 sdio->cur_page = NULL;
         }
diff --git a/fs/f2fs/f2fs.h b/fs/f2fs/f2fs.h
index 9a7c90386947..4b4a72f392be 100644
--- a/fs/f2fs/f2fs.h
+++ b/fs/f2fs/f2fs.h
@@ -2525,7 +2525,7 @@ void invalidate_blocks(struct f2fs_sb_info *sbi, block_t addr);
 bool is_checkpointed_data(struct f2fs_sb_info *sbi, block_t blkaddr);
 void refresh_sit_entry(struct f2fs_sb_info *sbi, block_t old, block_t new);
 void stop_discard_thread(struct f2fs_sb_info *sbi);
-void f2fs_wait_discard_bios(struct f2fs_sb_info *sbi);
+void f2fs_wait_discard_bios(struct f2fs_sb_info *sbi, bool umount);
 void clear_prefree_segments(struct f2fs_sb_info *sbi, struct cp_control *cpc);
 void release_discard_addrs(struct f2fs_sb_info *sbi);
 int npages_for_summary_flush(struct f2fs_sb_info *sbi, bool for_ra);
diff --git a/fs/f2fs/segment.c b/fs/f2fs/segment.c
index 621b9b3d320b..c695ff462ee6 100644
--- a/fs/f2fs/segment.c
+++ b/fs/f2fs/segment.c
@@ -1210,11 +1210,11 @@ void stop_discard_thread(struct f2fs_sb_info *sbi)
 }
 
 /* This comes from f2fs_put_super and f2fs_trim_fs */
-void f2fs_wait_discard_bios(struct f2fs_sb_info *sbi)
+void f2fs_wait_discard_bios(struct f2fs_sb_info *sbi, bool umount)
 {
         __issue_discard_cmd(sbi, false);
         __drop_discard_cmd(sbi);
-        __wait_discard_cmd(sbi, false);
+        __wait_discard_cmd(sbi, !umount);
 }
 
 static void mark_discard_range_all(struct f2fs_sb_info *sbi)
@@ -2244,7 +2244,7 @@ int f2fs_trim_fs(struct f2fs_sb_info *sbi, struct fstrim_range *range)
         }
         /* It's time to issue all the filed discards */
         mark_discard_range_all(sbi);
-        f2fs_wait_discard_bios(sbi);
+        f2fs_wait_discard_bios(sbi, false);
 out:
         range->len = F2FS_BLK_TO_BYTES(cpc.trimmed);
         return err;
diff --git a/fs/f2fs/super.c b/fs/f2fs/super.c
index 89f61eb3d167..933c3d529e65 100644
--- a/fs/f2fs/super.c
+++ b/fs/f2fs/super.c
@@ -801,7 +801,7 @@ static void f2fs_put_super(struct super_block *sb)
         }
 
         /* be sure to wait for any on-going discard commands */
-        f2fs_wait_discard_bios(sbi);
+        f2fs_wait_discard_bios(sbi, true);
 
         if (f2fs_discard_en(sbi) && !sbi->discard_blks) {
                 struct cp_control cpc = {
diff --git a/fs/nfs/client.c b/fs/nfs/client.c
index efebe6cf4378..22880ef6d8dd 100644
--- a/fs/nfs/client.c
+++ b/fs/nfs/client.c
@@ -218,7 +218,6 @@ static void nfs_cb_idr_remove_locked(struct nfs_client *clp)
 static void pnfs_init_server(struct nfs_server *server)
 {
         rpc_init_wait_queue(&server->roc_rpcwaitq, "pNFS ROC");
-        rpc_init_wait_queue(&server->uoc_rpcwaitq, "NFS UOC");
 }
 
 #else
@@ -888,6 +887,7 @@ struct nfs_server *nfs_alloc_server(void)
         ida_init(&server->openowner_id);
         ida_init(&server->lockowner_id);
         pnfs_init_server(server);
+        rpc_init_wait_queue(&server->uoc_rpcwaitq, "NFS UOC");
 
         return server;
 }
diff --git a/fs/nfs/filelayout/filelayout.c b/fs/nfs/filelayout/filelayout.c
index 44c638b7876c..508126eb49f9 100644
--- a/fs/nfs/filelayout/filelayout.c
+++ b/fs/nfs/filelayout/filelayout.c
@@ -745,7 +745,8 @@ filelayout_free_lseg(struct pnfs_layout_segment *lseg)
         struct nfs4_filelayout_segment *fl = FILELAYOUT_LSEG(lseg);
 
         dprintk("--> %s\n", __func__);
-        nfs4_fl_put_deviceid(fl->dsaddr);
+        if (fl->dsaddr != NULL)
+                nfs4_fl_put_deviceid(fl->dsaddr);
         /* This assumes a single RW lseg */
         if (lseg->pls_range.iomode == IOMODE_RW) {
                 struct nfs4_filelayout *flo;
diff --git a/fs/nfs/nfs4idmap.c b/fs/nfs/nfs4idmap.c
index dd5d27da8c0c..30426c1a1bbd 100644
--- a/fs/nfs/nfs4idmap.c
+++ b/fs/nfs/nfs4idmap.c
@@ -274,7 +274,7 @@ static struct key *nfs_idmap_request_key(const char *name, size_t namelen,
         ssize_t ret;
 
         ret = nfs_idmap_get_desc(name, namelen, type, strlen(type), &desc);
-        if (ret <= 0)
+        if (ret < 0)
                 return ERR_PTR(ret);
 
         rkey = request_key(&key_type_id_resolver, desc, "");
diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c
index 6c61e2b99635..f90090e8c959 100644
--- a/fs/nfs/nfs4proc.c
+++ b/fs/nfs/nfs4proc.c
@@ -8399,8 +8399,7 @@ nfs4_layoutget_handle_exception(struct rpc_task *task,
                 lo = NFS_I(inode)->layout;
                 /* If the open stateid was bad, then recover it. */
                 if (!lo || test_bit(NFS_LAYOUT_INVALID_STID, &lo->plh_flags) ||
-                    nfs4_stateid_match_other(&lgp->args.stateid,
-                                        &lgp->args.ctx->state->stateid)) {
+                    !nfs4_stateid_match_other(&lgp->args.stateid, &lo->plh_stateid)) {
                         spin_unlock(&inode->i_lock);
                         exception->state = lgp->args.ctx->state;
                         exception->stateid = &lgp->args.stateid;
diff --git a/fs/nfs/nfs4xdr.c b/fs/nfs/nfs4xdr.c
index 37c8af003275..14ed9791ec9c 100644
--- a/fs/nfs/nfs4xdr.c
+++ b/fs/nfs/nfs4xdr.c
@@ -1842,8 +1842,8 @@ static void encode_create_session(struct xdr_stream *xdr,
          * Assumes OPEN is the biggest non-idempotent compound.
          * 2 is the verifier.
          */
-        max_resp_sz_cached = (NFS4_dec_open_sz + RPC_REPHDRSIZE +
-                              RPC_MAX_AUTH_SIZE + 2) * XDR_UNIT;
+        max_resp_sz_cached = (NFS4_dec_open_sz + RPC_REPHDRSIZE + 2)
+                                * XDR_UNIT + RPC_MAX_AUTH_SIZE;
 
         encode_op_hdr(xdr, OP_CREATE_SESSION, decode_create_session_maxsz, hdr);
         p = reserve_space(xdr, 16 + 2*28 + 20 + clnt->cl_nodelen + 12);
diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
index 3c69db7d4905..8487486ec496 100644
--- a/fs/nfsd/nfs4proc.c
+++ b/fs/nfsd/nfs4proc.c
@@ -927,6 +927,13 @@ nfsd4_secinfo_release(union nfsd4_op_u *u)
                 exp_put(u->secinfo.si_exp);
 }
 
+static void
+nfsd4_secinfo_no_name_release(union nfsd4_op_u *u)
+{
+        if (u->secinfo_no_name.sin_exp)
+                exp_put(u->secinfo_no_name.sin_exp);
+}
+
 static __be32
 nfsd4_setattr(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate,
               union nfsd4_op_u *u)
@@ -2375,7 +2382,7 @@ static const struct nfsd4_operation nfsd4_ops[] = {
         },
         [OP_SECINFO_NO_NAME] = {
                 .op_func = nfsd4_secinfo_no_name,
-                .op_release = nfsd4_secinfo_release,
+                .op_release = nfsd4_secinfo_no_name_release,
                 .op_flags = OP_HANDLES_WRONGSEC,
                 .op_name = "OP_SECINFO_NO_NAME",
                 .op_rsize_bop = nfsd4_secinfo_rsize,
diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c
index 50b0556a124f..52ad15192e72 100644
--- a/fs/quota/dquot.c
+++ b/fs/quota/dquot.c
@@ -1297,21 +1297,18 @@ static int dquot_add_space(struct dquot *dquot, qsize_t space,
         spin_lock(&dquot->dq_dqb_lock);
         if (!sb_has_quota_limits_enabled(sb, dquot->dq_id.type) ||
             test_bit(DQ_FAKE_B, &dquot->dq_flags))
-                goto add;
+                goto finish;
 
         tspace = dquot->dq_dqb.dqb_curspace + dquot->dq_dqb.dqb_rsvspace
                 + space + rsv_space;
 
-        if (flags & DQUOT_SPACE_NOFAIL)
-                goto add;
-
         if (dquot->dq_dqb.dqb_bhardlimit &&
             tspace > dquot->dq_dqb.dqb_bhardlimit &&
             !ignore_hardlimit(dquot)) {
                 if (flags & DQUOT_SPACE_WARN)
                         prepare_warning(warn, dquot, QUOTA_NL_BHARDWARN);
                 ret = -EDQUOT;
-                goto out;
+                goto finish;
         }
 
         if (dquot->dq_dqb.dqb_bsoftlimit &&
@@ -1322,7 +1319,7 @@ static int dquot_add_space(struct dquot *dquot, qsize_t space,
                 if (flags & DQUOT_SPACE_WARN)
                         prepare_warning(warn, dquot, QUOTA_NL_BSOFTLONGWARN);
                 ret = -EDQUOT;
-                goto out;
+                goto finish;
         }
 
         if (dquot->dq_dqb.dqb_bsoftlimit &&
@@ -1338,13 +1335,21 @@ static int dquot_add_space(struct dquot *dquot, qsize_t space,
                          * be always printed
                          */
                         ret = -EDQUOT;
-                        goto out;
+                        goto finish;
                 }
         }
-add:
-        dquot->dq_dqb.dqb_rsvspace += rsv_space;
-        dquot->dq_dqb.dqb_curspace += space;
-out:
+finish:
+        /*
+         * We have to be careful and go through warning generation & grace time
+         * setting even if DQUOT_SPACE_NOFAIL is set. That's why we check it
+         * only here...
+         */
+        if (flags & DQUOT_SPACE_NOFAIL)
+                ret = 0;
+        if (!ret) {
+                dquot->dq_dqb.dqb_rsvspace += rsv_space;
+                dquot->dq_dqb.dqb_curspace += space;
+        }
         spin_unlock(&dquot->dq_dqb_lock);
         return ret;
 }
diff --git a/fs/xfs/libxfs/xfs_alloc.c b/fs/xfs/libxfs/xfs_alloc.c
index 744dcaec34cc..f965ce832bc0 100644
--- a/fs/xfs/libxfs/xfs_alloc.c
+++ b/fs/xfs/libxfs/xfs_alloc.c
@@ -1584,6 +1584,10 @@ xfs_alloc_ag_vextent_small(
 
                                 bp = xfs_btree_get_bufs(args->mp, args->tp,
                                         args->agno, fbno, 0);
+                                if (!bp) {
+                                        error = -EFSCORRUPTED;
+                                        goto error0;
+                                }
                                 xfs_trans_binval(args->tp, bp);
                         }
                         args->len = 1;
@@ -2141,6 +2145,10 @@ xfs_alloc_fix_freelist(
                 if (error)
                         goto out_agbp_relse;
                 bp = xfs_btree_get_bufs(mp, tp, args->agno, bno, 0);
+                if (!bp) {
+                        error = -EFSCORRUPTED;
+                        goto out_agbp_relse;
+                }
                 xfs_trans_binval(tp, bp);
         }
 
diff --git a/fs/xfs/libxfs/xfs_bmap.c b/fs/xfs/libxfs/xfs_bmap.c
index 044a363119be..def32fa1c225 100644
--- a/fs/xfs/libxfs/xfs_bmap.c
+++ b/fs/xfs/libxfs/xfs_bmap.c
@@ -1477,14 +1477,14 @@ xfs_bmap_isaeof(
         int                     is_empty;
         int                     error;
 
-        bma->aeof = 0;
+        bma->aeof = false;
         error = xfs_bmap_last_extent(NULL, bma->ip, whichfork, &rec,
                                      &is_empty);
         if (error)
                 return error;
 
         if (is_empty) {
-                bma->aeof = 1;
+                bma->aeof = true;
                 return 0;
         }
 
diff --git a/fs/xfs/libxfs/xfs_ialloc.c b/fs/xfs/libxfs/xfs_ialloc.c
index 988bb3f31446..dfd643909f85 100644
--- a/fs/xfs/libxfs/xfs_ialloc.c
+++ b/fs/xfs/libxfs/xfs_ialloc.c
@@ -1962,7 +1962,7 @@ xfs_difree_inobt(
         if (!(mp->m_flags & XFS_MOUNT_IKEEP) &&
             rec.ir_free == XFS_INOBT_ALL_FREE &&
             mp->m_sb.sb_inopblock <= XFS_INODES_PER_CHUNK) {
-                xic->deleted = 1;
+                xic->deleted = true;
                 xic->first_ino = XFS_AGINO_TO_INO(mp, agno, rec.ir_startino);
                 xic->alloc = xfs_inobt_irec_to_allocmask(&rec);
 
@@ -1989,7 +1989,7 @@ xfs_difree_inobt(
 
                 xfs_difree_inode_chunk(mp, agno, &rec, dfops);
         } else {
-                xic->deleted = 0;
+                xic->deleted = false;
 
                 error = xfs_inobt_update(cur, &rec);
                 if (error) {
diff --git a/fs/xfs/libxfs/xfs_log_format.h b/fs/xfs/libxfs/xfs_log_format.h
index 8372e9bcd7b6..71de185735e0 100644
--- a/fs/xfs/libxfs/xfs_log_format.h
+++ b/fs/xfs/libxfs/xfs_log_format.h
@@ -270,6 +270,7 @@ typedef struct xfs_inode_log_format {
         uint32_t                ilf_fields;     /* flags for fields logged */
         uint16_t                ilf_asize;      /* size of attr d/ext/root */
         uint16_t                ilf_dsize;      /* size of data/ext/root */
+        uint32_t                ilf_pad;        /* pad for 64 bit boundary */
         uint64_t                ilf_ino;        /* inode number */
         union {
                 uint32_t        ilfu_rdev;      /* rdev value for dev inode*/
@@ -280,29 +281,17 @@ typedef struct xfs_inode_log_format {
         int32_t                 ilf_boffset;    /* off of inode in buffer */
 } xfs_inode_log_format_t;
 
-typedef struct xfs_inode_log_format_32 {
-        uint16_t                ilf_type;       /* inode log item type */
-        uint16_t                ilf_size;       /* size of this item */
-        uint32_t                ilf_fields;     /* flags for fields logged */
-        uint16_t                ilf_asize;      /* size of attr d/ext/root */
-        uint16_t                ilf_dsize;      /* size of data/ext/root */
-        uint64_t                ilf_ino;        /* inode number */
-        union {
-                uint32_t        ilfu_rdev;      /* rdev value for dev inode*/
-                uuid_t          ilfu_uuid;      /* mount point value */
-        } ilf_u;
-        int64_t                 ilf_blkno;      /* blkno of inode buffer */
-        int32_t                 ilf_len;        /* len of inode buffer */
-        int32_t                 ilf_boffset;    /* off of inode in buffer */
-} __attribute__((packed)) xfs_inode_log_format_32_t;
-
-typedef struct xfs_inode_log_format_64 {
+/*
+ * Old 32 bit systems will log in this format without the 64 bit
+ * alignment padding. Recovery will detect this and convert it to the
+ * correct format.
+ */
+struct xfs_inode_log_format_32 {
         uint16_t                ilf_type;       /* inode log item type */
         uint16_t                ilf_size;       /* size of this item */
         uint32_t                ilf_fields;     /* flags for fields logged */
         uint16_t                ilf_asize;      /* size of attr d/ext/root */
         uint16_t                ilf_dsize;      /* size of data/ext/root */
-        uint32_t                ilf_pad;        /* pad for 64 bit boundary */
         uint64_t                ilf_ino;        /* inode number */
         union {
                 uint32_t        ilfu_rdev;      /* rdev value for dev inode*/
@@ -311,7 +300,7 @@ typedef struct xfs_inode_log_format_64 {
         int64_t                 ilf_blkno;      /* blkno of inode buffer */
         int32_t                 ilf_len;        /* len of inode buffer */
         int32_t                 ilf_boffset;    /* off of inode in buffer */
-} xfs_inode_log_format_64_t;
+} __attribute__((packed));
 
 
 /*
diff --git a/fs/xfs/xfs_acl.c b/fs/xfs/xfs_acl.c
index 7034e17535de..3354140de07e 100644
--- a/fs/xfs/xfs_acl.c
+++ b/fs/xfs/xfs_acl.c
@@ -247,6 +247,8 @@ xfs_set_mode(struct inode *inode, umode_t mode)
 int
 xfs_set_acl(struct inode *inode, struct posix_acl *acl, int type)
 {
+        umode_t mode;
+        bool set_mode = false;
         int error = 0;
 
         if (!acl)
@@ -257,16 +259,24 @@ xfs_set_acl(struct inode *inode, struct posix_acl *acl, int type)
                 return error;
 
         if (type == ACL_TYPE_ACCESS) {
-                umode_t mode;
-
                 error = posix_acl_update_mode(inode, &mode, &acl);
                 if (error)
                         return error;
-                error = xfs_set_mode(inode, mode);
-                if (error)
-                        return error;
+                set_mode = true;
         }
 
  set_acl:
-        return __xfs_set_acl(inode, acl, type);
+        error =  __xfs_set_acl(inode, acl, type);
+        if (error)
+                return error;
+
+        /*
+         * We set the mode after successfully updating the ACL xattr because the
+         * xattr update can fail at ENOSPC and we don't want to change the mode
+         * if the ACL update hasn't been applied.
+         */
+        if (set_mode)
+                error = xfs_set_mode(inode, mode);
+
+        return error;
 }
diff --git a/fs/xfs/xfs_attr_inactive.c b/fs/xfs/xfs_attr_inactive.c
index ebd66b19fbfc..e3a950ed35a8 100644
--- a/fs/xfs/xfs_attr_inactive.c
+++ b/fs/xfs/xfs_attr_inactive.c
@@ -302,6 +302,8 @@ xfs_attr3_node_inactive(
                                                  &bp, XFS_ATTR_FORK);
                         if (error)
                                 return error;
+                        node = bp->b_addr;
+                        btree = dp->d_ops->node_tree_p(node);
                         child_fsb = be32_to_cpu(btree[i + 1].before);
                         xfs_trans_brelse(*trans, bp);
                 }
diff --git a/fs/xfs/xfs_bmap_util.c b/fs/xfs/xfs_bmap_util.c
index e9db7fc95b70..6503cfa44262 100644
--- a/fs/xfs/xfs_bmap_util.c
+++ b/fs/xfs/xfs_bmap_util.c
@@ -84,6 +84,7 @@ xfs_zero_extent(
                 GFP_NOFS, 0);
 }
 
+#ifdef CONFIG_XFS_RT
 int
 xfs_bmap_rtalloc(
         struct xfs_bmalloca     *ap)    /* bmap alloc argument struct */
@@ -190,6 +191,7 @@ xfs_bmap_rtalloc(
         }
         return 0;
 }
+#endif /* CONFIG_XFS_RT */
 
 /*
  * Check if the endoff is outside the last extent. If so the caller will grow
diff --git a/fs/xfs/xfs_bmap_util.h b/fs/xfs/xfs_bmap_util.h
index 0eaa81dc49be..7d330b3c77c3 100644
--- a/fs/xfs/xfs_bmap_util.h
+++ b/fs/xfs/xfs_bmap_util.h
@@ -28,7 +28,20 @@ struct xfs_mount;
 struct xfs_trans;
 struct xfs_bmalloca;
 
+#ifdef CONFIG_XFS_RT
 int     xfs_bmap_rtalloc(struct xfs_bmalloca *ap);
+#else /* !CONFIG_XFS_RT */
+/*
+ * Attempts to allocate RT extents when RT is disable indicates corruption and
+ * should trigger a shutdown.
+ */
+static inline int
+xfs_bmap_rtalloc(struct xfs_bmalloca *ap)
+{
+        return -EFSCORRUPTED;
+}
+#endif /* CONFIG_XFS_RT */
+
 int     xfs_bmap_eof(struct xfs_inode *ip, xfs_fileoff_t endoff,
                      int whichfork, int *eof);
 int     xfs_bmap_punch_delalloc_range(struct xfs_inode *ip,
diff --git a/fs/xfs/xfs_file.c b/fs/xfs/xfs_file.c
index 309e26c9dddb..56d0e526870c 100644
--- a/fs/xfs/xfs_file.c
+++ b/fs/xfs/xfs_file.c
@@ -764,7 +764,7 @@ xfs_file_fallocate(
         enum xfs_prealloc_flags flags = 0;
         uint                    iolock = XFS_IOLOCK_EXCL;
         loff_t                  new_size = 0;
-        bool                    do_file_insert = 0;
+        bool                    do_file_insert = false;
 
         if (!S_ISREG(inode->i_mode))
                 return -EINVAL;
@@ -825,7 +825,7 @@ xfs_file_fallocate(
                         error = -EINVAL;
                         goto out_unlock;
                 }
-                do_file_insert = 1;
+                do_file_insert = true;
         } else {
                 flags |= XFS_PREALLOC_SET;
 
diff --git a/fs/xfs/xfs_fsmap.c b/fs/xfs/xfs_fsmap.c
index 814ed729881d..560e0b40ac1b 100644
--- a/fs/xfs/xfs_fsmap.c
+++ b/fs/xfs/xfs_fsmap.c
@@ -521,6 +521,7 @@ __xfs_getfsmap_rtdev(
         return query_fn(tp, info);
 }
 
+#ifdef CONFIG_XFS_RT
 /* Actually query the realtime bitmap. */
 STATIC int
 xfs_getfsmap_rtdev_rtbitmap_query(
@@ -561,6 +562,7 @@ xfs_getfsmap_rtdev_rtbitmap(
         return __xfs_getfsmap_rtdev(tp, keys, xfs_getfsmap_rtdev_rtbitmap_query,
                         info);
 }
+#endif /* CONFIG_XFS_RT */
 
 /* Execute a getfsmap query against the regular data device. */
 STATIC int
@@ -795,7 +797,15 @@ xfs_getfsmap_check_keys(
         return false;
 }
 
+/*
+ * There are only two devices if we didn't configure RT devices at build time.
+ */
+#ifdef CONFIG_XFS_RT
 #define XFS_GETFSMAP_DEVS       3
+#else
+#define XFS_GETFSMAP_DEVS       2
+#endif /* CONFIG_XFS_RT */
+
 /*
  * Get filesystem's extents as described in head, and format for
  * output.  Calls formatter to fill the user's buffer until all
@@ -853,10 +863,12 @@ xfs_getfsmap(
                 handlers[1].dev = new_encode_dev(mp->m_logdev_targp->bt_dev);
                 handlers[1].fn = xfs_getfsmap_logdev;
         }
+#ifdef CONFIG_XFS_RT
         if (mp->m_rtdev_targp) {
                 handlers[2].dev = new_encode_dev(mp->m_rtdev_targp->bt_dev);
                 handlers[2].fn = xfs_getfsmap_rtdev_rtbitmap;
         }
+#endif /* CONFIG_XFS_RT */
 
         xfs_sort(handlers, XFS_GETFSMAP_DEVS, sizeof(struct xfs_getfsmap_dev),
                         xfs_getfsmap_dev_compare);
diff --git a/fs/xfs/xfs_inode_item.c b/fs/xfs/xfs_inode_item.c
index a705f34b58fa..9bbc2d7cc8cb 100644
--- a/fs/xfs/xfs_inode_item.c
+++ b/fs/xfs/xfs_inode_item.c
@@ -364,6 +364,9 @@ xfs_inode_to_log_dinode(
         to->di_dmstate = from->di_dmstate;
         to->di_flags = from->di_flags;
 
+        /* log a dummy value to ensure log structure is fully initialised */
+        to->di_next_unlinked = NULLAGINO;
+
         if (from->di_version == 3) {
                 to->di_changecount = inode->i_version;
                 to->di_crtime.t_sec = from->di_crtime.t_sec;
@@ -404,6 +407,11 @@ xfs_inode_item_format_core(
  * the second with the on-disk inode structure, and a possible third and/or
  * fourth with the inode data/extents/b-tree root and inode attributes
  * data/extents/b-tree root.
+ *
+ * Note: Always use the 64 bit inode log format structure so we don't
+ * leave an uninitialised hole in the format item on 64 bit systems. Log
+ * recovery on 32 bit systems handles this just fine, so there's no reason
+ * for not using an initialising the properly padded structure all the time.
  */
 STATIC void
 xfs_inode_item_format(
@@ -412,8 +420,8 @@ xfs_inode_item_format(
 {
         struct xfs_inode_log_item *iip = INODE_ITEM(lip);
         struct xfs_inode        *ip = iip->ili_inode;
-        struct xfs_inode_log_format *ilf;
         struct xfs_log_iovec    *vecp = NULL;
+        struct xfs_inode_log_format *ilf;
 
         ASSERT(ip->i_d.di_version > 1);
 
@@ -425,7 +433,17 @@ xfs_inode_item_format(
         ilf->ilf_boffset = ip->i_imap.im_boffset;
         ilf->ilf_fields = XFS_ILOG_CORE;
         ilf->ilf_size = 2; /* format + core */
-        xlog_finish_iovec(lv, vecp, sizeof(struct xfs_inode_log_format));
+
+        /*
+         * make sure we don't leak uninitialised data into the log in the case
+         * when we don't log every field in the inode.
+         */
+        ilf->ilf_dsize = 0;
+        ilf->ilf_asize = 0;
+        ilf->ilf_pad = 0;
+        uuid_copy(&ilf->ilf_u.ilfu_uuid, &uuid_null);
+
+        xlog_finish_iovec(lv, vecp, sizeof(*ilf));
 
         xfs_inode_item_format_core(ip, lv, &vecp);
         xfs_inode_item_format_data_fork(iip, ilf, lv, &vecp);
@@ -855,44 +873,29 @@ xfs_istale_done(
 }
 
 /*
- * convert an xfs_inode_log_format struct from either 32 or 64 bit versions
- * (which can have different field alignments) to the native version
+ * convert an xfs_inode_log_format struct from the old 32 bit version
+ * (which can have different field alignments) to the native 64 bit version
  */
 int
 xfs_inode_item_format_convert(
-        xfs_log_iovec_t         *buf,
-        xfs_inode_log_format_t  *in_f)
+        struct xfs_log_iovec            *buf,
+        struct xfs_inode_log_format     *in_f)
 {
-        if (buf->i_len == sizeof(xfs_inode_log_format_32_t)) {
-                xfs_inode_log_format_32_t *in_f32 = buf->i_addr;
-
-                in_f->ilf_type = in_f32->ilf_type;
-                in_f->ilf_size = in_f32->ilf_size;
-                in_f->ilf_fields = in_f32->ilf_fields;
-                in_f->ilf_asize = in_f32->ilf_asize;
-                in_f->ilf_dsize = in_f32->ilf_dsize;
-                in_f->ilf_ino = in_f32->ilf_ino;
-                /* copy biggest field of ilf_u */
-                uuid_copy(&in_f->ilf_u.ilfu_uuid, &in_f32->ilf_u.ilfu_uuid);
-                in_f->ilf_blkno = in_f32->ilf_blkno;
-                in_f->ilf_len = in_f32->ilf_len;
-                in_f->ilf_boffset = in_f32->ilf_boffset;
-                return 0;
-        } else if (buf->i_len == sizeof(xfs_inode_log_format_64_t)){
-                xfs_inode_log_format_64_t *in_f64 = buf->i_addr;
-
-                in_f->ilf_type = in_f64->ilf_type;
-                in_f->ilf_size = in_f64->ilf_size;
-                in_f->ilf_fields = in_f64->ilf_fields;
-                in_f->ilf_asize = in_f64->ilf_asize;
-                in_f->ilf_dsize = in_f64->ilf_dsize;
-                in_f->ilf_ino = in_f64->ilf_ino;
-                /* copy biggest field of ilf_u */
-                uuid_copy(&in_f->ilf_u.ilfu_uuid, &in_f64->ilf_u.ilfu_uuid);
-                in_f->ilf_blkno = in_f64->ilf_blkno;
-                in_f->ilf_len = in_f64->ilf_len;
-                in_f->ilf_boffset = in_f64->ilf_boffset;
-                return 0;
-        }
-        return -EFSCORRUPTED;
+        struct xfs_inode_log_format_32  *in_f32 = buf->i_addr;
+
+        if (buf->i_len != sizeof(*in_f32))
+                return -EFSCORRUPTED;
+
+        in_f->ilf_type = in_f32->ilf_type;
+        in_f->ilf_size = in_f32->ilf_size;
+        in_f->ilf_fields = in_f32->ilf_fields;
+        in_f->ilf_asize = in_f32->ilf_asize;
+        in_f->ilf_dsize = in_f32->ilf_dsize;
+        in_f->ilf_ino = in_f32->ilf_ino;
+        /* copy biggest field of ilf_u */
+        uuid_copy(&in_f->ilf_u.ilfu_uuid, &in_f32->ilf_u.ilfu_uuid);
+        in_f->ilf_blkno = in_f32->ilf_blkno;
+        in_f->ilf_len = in_f32->ilf_len;
+        in_f->ilf_boffset = in_f32->ilf_boffset;
+        return 0;
 }
diff --git a/fs/xfs/xfs_log.c b/fs/xfs/xfs_log.c
index c5107c7bc4bf..dc95a49d62e7 100644
--- a/fs/xfs/xfs_log.c
+++ b/fs/xfs/xfs_log.c
@@ -2515,7 +2515,7 @@ next_lv:
                                 if (lv)
                                         vecp = lv->lv_iovecp;
                         }
-                        if (record_cnt == 0 && ordered == false) {
+                        if (record_cnt == 0 && !ordered) {
                                 if (!lv)
                                         return 0;
                                 break;
diff --git a/fs/xfs/xfs_mount.c b/fs/xfs/xfs_mount.c
index ea7d4b4e50d0..e9727d0a541a 100644
--- a/fs/xfs/xfs_mount.c
+++ b/fs/xfs/xfs_mount.c
@@ -704,7 +704,7 @@ xfs_mountfs(
         xfs_set_maxicount(mp);
 
         /* enable fail_at_unmount as default */
-        mp->m_fail_unmount = 1;
+        mp->m_fail_unmount = true;
 
         error = xfs_sysfs_init(&mp->m_kobj, &xfs_mp_ktype, NULL, mp->m_fsname);
         if (error)
diff --git a/fs/xfs/xfs_ondisk.h b/fs/xfs/xfs_ondisk.h
index 0c381d71b242..0492436a053f 100644
--- a/fs/xfs/xfs_ondisk.h
+++ b/fs/xfs/xfs_ondisk.h
@@ -134,7 +134,7 @@ xfs_check_ondisk_structs(void)
         XFS_CHECK_STRUCT_SIZE(struct xfs_icreate_log,           28);
         XFS_CHECK_STRUCT_SIZE(struct xfs_ictimestamp,           8);
         XFS_CHECK_STRUCT_SIZE(struct xfs_inode_log_format_32,   52);
-        XFS_CHECK_STRUCT_SIZE(struct xfs_inode_log_format_64,   56);
+        XFS_CHECK_STRUCT_SIZE(struct xfs_inode_log_format,      56);
         XFS_CHECK_STRUCT_SIZE(struct xfs_qoff_logformat,        20);
         XFS_CHECK_STRUCT_SIZE(struct xfs_trans_header,          16);
 }
diff --git a/include/linux/bpf.h b/include/linux/bpf.h
index 8390859e79e7..f1af7d63d678 100644
--- a/include/linux/bpf.h
+++ b/include/linux/bpf.h
@@ -368,6 +368,11 @@ static inline void __bpf_prog_uncharge(struct user_struct *user, u32 pages)
 {
 }
 
+static inline int bpf_obj_get_user(const char __user *pathname)
+{
+        return -EOPNOTSUPP;
+}
+
 static inline struct net_device  *__dev_map_lookup_elem(struct bpf_map *map,
                                                        u32 key)
 {
diff --git a/include/linux/netfilter_bridge/ebtables.h b/include/linux/netfilter_bridge/ebtables.h
index 2c2a5514b0df..528b24c78308 100644
--- a/include/linux/netfilter_bridge/ebtables.h
+++ b/include/linux/netfilter_bridge/ebtables.h
@@ -108,9 +108,10 @@ struct ebt_table {
 
 #define EBT_ALIGN(s) (((s) + (__alignof__(struct _xt_align)-1)) & \
                      ~(__alignof__(struct _xt_align)-1))
-extern struct ebt_table *ebt_register_table(struct net *net,
-                                            const struct ebt_table *table,
-                                            const struct nf_hook_ops *);
+extern int ebt_register_table(struct net *net,
+                              const struct ebt_table *table,
+                              const struct nf_hook_ops *ops,
+                              struct ebt_table **res);
 extern void ebt_unregister_table(struct net *net, struct ebt_table *table,
                                  const struct nf_hook_ops *);
 extern unsigned int ebt_do_table(struct sk_buff *skb,
diff --git a/include/sound/seq_virmidi.h b/include/sound/seq_virmidi.h
index a03acd0d398a..695257ae64ac 100644
--- a/include/sound/seq_virmidi.h
+++ b/include/sound/seq_virmidi.h
@@ -60,6 +60,7 @@ struct snd_virmidi_dev {
         int port;                       /* created/attached port */
         unsigned int flags;             /* SNDRV_VIRMIDI_* */
         rwlock_t filelist_lock;
+        struct rw_semaphore filelist_sem;
         struct list_head filelist;
 };
 
diff --git a/include/uapi/linux/netfilter/xt_bpf.h b/include/uapi/linux/netfilter/xt_bpf.h
index b97725af2ac0..da161b56c79e 100644
--- a/include/uapi/linux/netfilter/xt_bpf.h
+++ b/include/uapi/linux/netfilter/xt_bpf.h
@@ -23,6 +23,7 @@ enum xt_bpf_modes {
         XT_BPF_MODE_FD_PINNED,
         XT_BPF_MODE_FD_ELF,
 };
+#define XT_BPF_MODE_PATH_PINNED XT_BPF_MODE_FD_PINNED
 
 struct xt_bpf_info_v1 {
         __u16 mode;
diff --git a/kernel/bpf/inode.c b/kernel/bpf/inode.c
index e833ed914358..be1dde967208 100644
--- a/kernel/bpf/inode.c
+++ b/kernel/bpf/inode.c
@@ -363,6 +363,7 @@ out:
         putname(pname);
         return ret;
 }
+EXPORT_SYMBOL_GPL(bpf_obj_get_user);
 
 static void bpf_evict_inode(struct inode *inode)
 {
diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index b914fbe1383e..8b8d6ba39e23 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c
@@ -653,6 +653,10 @@ static void mark_reg_read(const struct bpf_verifier_state *state, u32 regno)
 {
         struct bpf_verifier_state *parent = state->parent;
 
+        if (regno == BPF_REG_FP)
+                /* We don't need to worry about FP liveness because it's read-only */
+                return;
+
         while (parent) {
                 /* if read wasn't screened by an earlier write ... */
                 if (state->regs[regno].live & REG_LIVE_WRITTEN)
@@ -2345,6 +2349,7 @@ static int check_alu_op(struct bpf_verifier_env *env, struct bpf_insn *insn)
                                  * copy register state to dest reg
                                  */
                                 regs[insn->dst_reg] = regs[insn->src_reg];
+                                regs[insn->dst_reg].live |= REG_LIVE_WRITTEN;
                         } else {
                                 /* R1 = (u32) R2 */
                                 if (is_pointer_value(env, insn->src_reg)) {
diff --git a/kernel/exit.c b/kernel/exit.c
index f2cd53e92147..cf28528842bc 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -1610,6 +1610,9 @@ SYSCALL_DEFINE5(waitid, int, which, pid_t, upid, struct siginfo __user *,
         if (!infop)
                 return err;
 
+        if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop)))
+                goto Efault;
+
         user_access_begin();
         unsafe_put_user(signo, &infop->si_signo, Efault);
         unsafe_put_user(0, &infop->si_errno, Efault);
@@ -1735,6 +1738,9 @@ COMPAT_SYSCALL_DEFINE5(waitid,
         if (!infop)
                 return err;
 
+        if (!access_ok(VERIFY_WRITE, infop, sizeof(*infop)))
+                goto Efault;
+
         user_access_begin();
         unsafe_put_user(signo, &infop->si_signo, Efault);
         unsafe_put_user(0, &infop->si_errno, Efault);
diff --git a/kernel/livepatch/core.c b/kernel/livepatch/core.c
index b9628e43c78f..bf8c8fd72589 100644
--- a/kernel/livepatch/core.c
+++ b/kernel/livepatch/core.c
@@ -830,6 +830,41 @@ int klp_register_patch(struct klp_patch *patch)
 }
 EXPORT_SYMBOL_GPL(klp_register_patch);
 
+/*
+ * Remove parts of patches that touch a given kernel module. The list of
+ * patches processed might be limited. When limit is NULL, all patches
+ * will be handled.
+ */
+static void klp_cleanup_module_patches_limited(struct module *mod,
+                                               struct klp_patch *limit)
+{
+        struct klp_patch *patch;
+        struct klp_object *obj;
+
+        list_for_each_entry(patch, &klp_patches, list) {
+                if (patch == limit)
+                        break;
+
+                klp_for_each_object(patch, obj) {
+                        if (!klp_is_module(obj) || strcmp(obj->name, mod->name))
+                                continue;
+
+                        /*
+                         * Only unpatch the module if the patch is enabled or
+                         * is in transition.
+                         */
+                        if (patch->enabled || patch == klp_transition_patch) {
+                                pr_notice("reverting patch '%s' on unloading module '%s'\n",
+                                          patch->mod->name, obj->mod->name);
+                                klp_unpatch_object(obj);
+                        }
+
+                        klp_free_object_loaded(obj);
+                        break;
+                }
+        }
+}
+
 int klp_module_coming(struct module *mod)
 {
         int ret;
@@ -894,7 +929,7 @@ err:
         pr_warn("patch '%s' failed for module '%s', refusing to load module '%s'\n",
                 patch->mod->name, obj->mod->name, obj->mod->name);
         mod->klp_alive = false;
-        klp_free_object_loaded(obj);
+        klp_cleanup_module_patches_limited(mod, patch);
         mutex_unlock(&klp_mutex);
 
         return ret;
@@ -902,9 +937,6 @@ err:
 
 void klp_module_going(struct module *mod)
 {
-        struct klp_patch *patch;
-        struct klp_object *obj;
-
         if (WARN_ON(mod->state != MODULE_STATE_GOING &&
                     mod->state != MODULE_STATE_COMING))
                 return;
@@ -917,25 +949,7 @@ void klp_module_going(struct module *mod)
          */
         mod->klp_alive = false;
 
-        list_for_each_entry(patch, &klp_patches, list) {
-                klp_for_each_object(patch, obj) {
-                        if (!klp_is_module(obj) || strcmp(obj->name, mod->name))
-                                continue;
-
-                        /*
-                         * Only unpatch the module if the patch is enabled or
-                         * is in transition.
-                         */
-                        if (patch->enabled || patch == klp_transition_patch) {
-                                pr_notice("reverting patch '%s' on unloading module '%s'\n",
-                                          patch->mod->name, obj->mod->name);
-                                klp_unpatch_object(obj);
-                        }
-
-                        klp_free_object_loaded(obj);
-                        break;
-                }
-        }
+        klp_cleanup_module_patches_limited(mod, NULL);
 
         mutex_unlock(&klp_mutex);
 }
diff --git a/kernel/seccomp.c b/kernel/seccomp.c
index bb3a38005b9c..0ae832e13b97 100644
--- a/kernel/seccomp.c
+++ b/kernel/seccomp.c
@@ -473,7 +473,7 @@ static long seccomp_attach_filter(unsigned int flags,
         return 0;
 }
 
-void __get_seccomp_filter(struct seccomp_filter *filter)
+static void __get_seccomp_filter(struct seccomp_filter *filter)
 {
         /* Reference count is bounded by the number of total processes. */
         refcount_inc(&filter->usage);
diff --git a/net/bridge/netfilter/ebtable_broute.c b/net/bridge/netfilter/ebtable_broute.c
index 2585b100ebbb..276b60262981 100644
--- a/net/bridge/netfilter/ebtable_broute.c
+++ b/net/bridge/netfilter/ebtable_broute.c
@@ -65,8 +65,8 @@ static int ebt_broute(struct sk_buff *skb)
 
 static int __net_init broute_net_init(struct net *net)
 {
-        net->xt.broute_table = ebt_register_table(net, &broute_table, NULL);
-        return PTR_ERR_OR_ZERO(net->xt.broute_table);
+        return ebt_register_table(net, &broute_table, NULL,
+                                  &net->xt.broute_table);
 }
 
 static void __net_exit broute_net_exit(struct net *net)
diff --git a/net/bridge/netfilter/ebtable_filter.c b/net/bridge/netfilter/ebtable_filter.c
index 45a00dbdbcad..c41da5fac84f 100644
--- a/net/bridge/netfilter/ebtable_filter.c
+++ b/net/bridge/netfilter/ebtable_filter.c
@@ -93,8 +93,8 @@ static const struct nf_hook_ops ebt_ops_filter[] = {
 
 static int __net_init frame_filter_net_init(struct net *net)
 {
-        net->xt.frame_filter = ebt_register_table(net, &frame_filter, ebt_ops_filter);
-        return PTR_ERR_OR_ZERO(net->xt.frame_filter);
+        return ebt_register_table(net, &frame_filter, ebt_ops_filter,
+                                  &net->xt.frame_filter);
 }
 
 static void __net_exit frame_filter_net_exit(struct net *net)
diff --git a/net/bridge/netfilter/ebtable_nat.c b/net/bridge/netfilter/ebtable_nat.c
index 57cd5bb154e7..08df7406ecb3 100644
--- a/net/bridge/netfilter/ebtable_nat.c
+++ b/net/bridge/netfilter/ebtable_nat.c
@@ -93,8 +93,8 @@ static const struct nf_hook_ops ebt_ops_nat[] = {
 
 static int __net_init frame_nat_net_init(struct net *net)
 {
-        net->xt.frame_nat = ebt_register_table(net, &frame_nat, ebt_ops_nat);
-        return PTR_ERR_OR_ZERO(net->xt.frame_nat);
+        return ebt_register_table(net, &frame_nat, ebt_ops_nat,
+                                  &net->xt.frame_nat);
 }
 
 static void __net_exit frame_nat_net_exit(struct net *net)
diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
index 83951f978445..3b3dcf719e07 100644
--- a/net/bridge/netfilter/ebtables.c
+++ b/net/bridge/netfilter/ebtables.c
@@ -1169,9 +1169,8 @@ static void __ebt_unregister_table(struct net *net, struct ebt_table *table)
         kfree(table);
 }
 
-struct ebt_table *
-ebt_register_table(struct net *net, const struct ebt_table *input_table,
-                   const struct nf_hook_ops *ops)
+int ebt_register_table(struct net *net, const struct ebt_table *input_table,
+                       const struct nf_hook_ops *ops, struct ebt_table **res)
 {
         struct ebt_table_info *newinfo;
         struct ebt_table *t, *table;
@@ -1183,7 +1182,7 @@ ebt_register_table(struct net *net, const struct ebt_table *input_table,
             repl->entries == NULL || repl->entries_size == 0 ||
             repl->counters != NULL || input_table->private != NULL) {
                 BUGPRINT("Bad table data for ebt_register_table!!!\n");
-                return ERR_PTR(-EINVAL);
+                return -EINVAL;
         }
 
         /* Don't add one table to multiple lists. */
@@ -1252,16 +1251,18 @@ ebt_register_table(struct net *net, const struct ebt_table *input_table,
         list_add(&table->list, &net->xt.tables[NFPROTO_BRIDGE]);
         mutex_unlock(&ebt_mutex);
 
+        WRITE_ONCE(*res, table);
+
         if (!ops)
-                return table;
+                return 0;
 
         ret = nf_register_net_hooks(net, ops, hweight32(table->valid_hooks));
         if (ret) {
                 __ebt_unregister_table(net, table);
-                return ERR_PTR(ret);
+                *res = NULL;
         }
 
-        return table;
+        return ret;
 free_unlock:
         mutex_unlock(&ebt_mutex);
 free_chainstack:
@@ -1276,7 +1277,7 @@ free_newinfo:
 free_table:
         kfree(table);
 out:
-        return ERR_PTR(ret);
+        return ret;
 }
 
 void ebt_unregister_table(struct net *net, struct ebt_table *table,
diff --git a/net/ipv4/gre_offload.c b/net/ipv4/gre_offload.c
index 416bb304a281..1859c473b21a 100644
--- a/net/ipv4/gre_offload.c
+++ b/net/ipv4/gre_offload.c
@@ -86,7 +86,7 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
                 greh = (struct gre_base_hdr *)skb_transport_header(skb);
                 pcsum = (__sum16 *)(greh + 1);
 
-                if (gso_partial) {
+                if (gso_partial && skb_is_gso(skb)) {
                         unsigned int partial_adj;
 
                         /* Adjust checksum to account for the fact that
diff --git a/net/ipv4/netfilter/ipt_SYNPROXY.c b/net/ipv4/netfilter/ipt_SYNPROXY.c
index 811689e523c3..f75fc6b53115 100644
--- a/net/ipv4/netfilter/ipt_SYNPROXY.c
+++ b/net/ipv4/netfilter/ipt_SYNPROXY.c
@@ -330,7 +330,8 @@ static unsigned int ipv4_synproxy_hook(void *priv,
         if (synproxy == NULL)
                 return NF_ACCEPT;
 
-        if (nf_is_loopback_packet(skb))
+        if (nf_is_loopback_packet(skb) ||
+            ip_hdr(skb)->protocol != IPPROTO_TCP)
                 return NF_ACCEPT;
 
         thoff = ip_hdrlen(skb);
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index ac6fde5d45f1..3d9f1c2f81c5 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -2513,7 +2513,7 @@ struct dst_entry *ipv4_blackhole_route(struct net *net, struct dst_entry *dst_or
         struct rtable *ort = (struct rtable *) dst_orig;
         struct rtable *rt;
 
-        rt = dst_alloc(&ipv4_dst_blackhole_ops, NULL, 1, DST_OBSOLETE_NONE, 0);
+        rt = dst_alloc(&ipv4_dst_blackhole_ops, NULL, 1, DST_OBSOLETE_DEAD, 0);
         if (rt) {
                 struct dst_entry *new = &rt->dst;
 
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 5676237d2b0f..e45177ceb0ee 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -2240,20 +2240,16 @@ int udp_v4_early_demux(struct sk_buff *skb)
         iph = ip_hdr(skb);
         uh = udp_hdr(skb);
 
-        if (skb->pkt_type == PACKET_BROADCAST ||
-            skb->pkt_type == PACKET_MULTICAST) {
+        if (skb->pkt_type == PACKET_MULTICAST) {
                 in_dev = __in_dev_get_rcu(skb->dev);
 
                 if (!in_dev)
                         return 0;
 
-                /* we are supposed to accept bcast packets */
-                if (skb->pkt_type == PACKET_MULTICAST) {
-                        ours = ip_check_mc_rcu(in_dev, iph->daddr, iph->saddr,
-                                               iph->protocol);
-                        if (!ours)
-                                return 0;
-                }
+                ours = ip_check_mc_rcu(in_dev, iph->daddr, iph->saddr,
+                                       iph->protocol);
+                if (!ours)
+                        return 0;
 
                 sk = __udp4_lib_mcast_demux_lookup(net, uh->dest, iph->daddr,
                                                    uh->source, iph->saddr,
diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index 97658bfc1b58..e360d55be555 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -120,7 +120,7 @@ static struct sk_buff *__skb_udp_tunnel_segment(struct sk_buff *skb,
                  * will be using a length value equal to only one MSS sized
                  * segment instead of the entire frame.
                  */
-                if (gso_partial) {
+                if (gso_partial && skb_is_gso(skb)) {
                         uh->len = htons(skb_shinfo(skb)->gso_size +
                                         SKB_GSO_CB(skb)->data_offset +
                                         skb->head - (unsigned char *)uh);
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index 96861c702c06..4a96ebbf8eda 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -3820,8 +3820,8 @@ static void addrconf_dad_begin(struct inet6_ifaddr *ifp)
                 goto out;
 
         if (dev->flags&(IFF_NOARP|IFF_LOOPBACK) ||
-            dev_net(dev)->ipv6.devconf_all->accept_dad < 1 ||
-            idev->cnf.accept_dad < 1 ||
+            (dev_net(dev)->ipv6.devconf_all->accept_dad < 1 &&
+             idev->cnf.accept_dad < 1) ||
             !(ifp->flags&IFA_F_TENTATIVE) ||
             ifp->flags & IFA_F_NODAD) {
                 bump_id = ifp->flags & IFA_F_TENTATIVE;
diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
index cdb3728faca7..4a87f9428ca5 100644
--- a/net/ipv6/ip6_offload.c
+++ b/net/ipv6/ip6_offload.c
@@ -105,7 +105,7 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
 
         for (skb = segs; skb; skb = skb->next) {
                 ipv6h = (struct ipv6hdr *)(skb_mac_header(skb) + nhoff);
-                if (gso_partial)
+                if (gso_partial && skb_is_gso(skb))
                         payload_len = skb_shinfo(skb)->gso_size +
                                       SKB_GSO_CB(skb)->data_offset +
                                       skb->head - (unsigned char *)(ipv6h + 1);
diff --git a/net/ipv6/netfilter/ip6t_SYNPROXY.c b/net/ipv6/netfilter/ip6t_SYNPROXY.c
index a5cd43d75393..437af8c95277 100644
--- a/net/ipv6/netfilter/ip6t_SYNPROXY.c
+++ b/net/ipv6/netfilter/ip6t_SYNPROXY.c
@@ -353,7 +353,7 @@ static unsigned int ipv6_synproxy_hook(void *priv,
         nexthdr = ipv6_hdr(skb)->nexthdr;
         thoff = ipv6_skip_exthdr(skb, sizeof(struct ipv6hdr), &nexthdr,
                                  &frag_off);
-        if (thoff < 0)
+        if (thoff < 0 || nexthdr != IPPROTO_TCP)
                 return NF_ACCEPT;
 
         th = skb_header_pointer(skb, thoff, sizeof(_th), &_th);
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 26cc9f483b6d..a96d5b385d8f 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -1325,7 +1325,7 @@ struct dst_entry *ip6_blackhole_route(struct net *net, struct dst_entry *dst_ori
         struct dst_entry *new = NULL;
 
         rt = dst_alloc(&ip6_dst_blackhole_ops, loopback_dev, 1,
-                       DST_OBSOLETE_NONE, 0);
+                       DST_OBSOLETE_DEAD, 0);
         if (rt) {
                 rt6_info_init(rt);
 
diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
index e495b5e484b1..cf84f7b37cd9 100644
--- a/net/netfilter/ipset/ip_set_core.c
+++ b/net/netfilter/ipset/ip_set_core.c
@@ -1191,14 +1191,17 @@ static int ip_set_swap(struct net *net, struct sock *ctnl, struct sk_buff *skb,
               from->family == to->family))
                 return -IPSET_ERR_TYPE_MISMATCH;
 
-        if (from->ref_netlink || to->ref_netlink)
+        write_lock_bh(&ip_set_ref_lock);
+
+        if (from->ref_netlink || to->ref_netlink) {
+                write_unlock_bh(&ip_set_ref_lock);
                 return -EBUSY;
+        }
 
         strncpy(from_name, from->name, IPSET_MAXNAMELEN);
         strncpy(from->name, to->name, IPSET_MAXNAMELEN);
         strncpy(to->name, from_name, IPSET_MAXNAMELEN);
 
-        write_lock_bh(&ip_set_ref_lock);
         swap(from->ref, to->ref);
         ip_set(inst, from_id) = to;
         ip_set(inst, to_id) = from;
@@ -2072,25 +2075,28 @@ static struct pernet_operations ip_set_net_ops = {
 static int __init
 ip_set_init(void)
 {
-        int ret = nfnetlink_subsys_register(&ip_set_netlink_subsys);
+        int ret = register_pernet_subsys(&ip_set_net_ops);
+
+        if (ret) {
+                pr_err("ip_set: cannot register pernet_subsys.\n");
+                return ret;
+        }
 
+        ret = nfnetlink_subsys_register(&ip_set_netlink_subsys);
         if (ret != 0) {
                 pr_err("ip_set: cannot register with nfnetlink.\n");
+                unregister_pernet_subsys(&ip_set_net_ops);
                 return ret;
         }
+
         ret = nf_register_sockopt(&so_set);
         if (ret != 0) {
                 pr_err("SO_SET registry failed: %d\n", ret);
                 nfnetlink_subsys_unregister(&ip_set_netlink_subsys);
+                unregister_pernet_subsys(&ip_set_net_ops);
                 return ret;
         }
-        ret = register_pernet_subsys(&ip_set_net_ops);
-        if (ret) {
-                pr_err("ip_set: cannot register pernet_subsys.\n");
-                nf_unregister_sockopt(&so_set);
-                nfnetlink_subsys_unregister(&ip_set_netlink_subsys);
-                return ret;
-        }
+
         pr_info("ip_set: protocol %u\n", IPSET_PROTOCOL);
         return 0;
 }
@@ -2098,9 +2104,10 @@ ip_set_init(void)
 static void __exit
 ip_set_fini(void)
 {
-        unregister_pernet_subsys(&ip_set_net_ops);
         nf_unregister_sockopt(&so_set);
         nfnetlink_subsys_unregister(&ip_set_netlink_subsys);
+
+        unregister_pernet_subsys(&ip_set_net_ops);
         pr_debug("these are the famous last words\n");
 }
 
diff --git a/net/netfilter/ipset/ip_set_hash_ip.c b/net/netfilter/ipset/ip_set_hash_ip.c
index 20bfbd315f61..613eb212cb48 100644
--- a/net/netfilter/ipset/ip_set_hash_ip.c
+++ b/net/netfilter/ipset/ip_set_hash_ip.c
@@ -123,13 +123,12 @@ hash_ip4_uadt(struct ip_set *set, struct nlattr *tb[],
                 return ret;
 
         ip &= ip_set_hostmask(h->netmask);
+        e.ip = htonl(ip);
+        if (e.ip == 0)
+                return -IPSET_ERR_HASH_ELEM;
 
-        if (adt == IPSET_TEST) {
-                e.ip = htonl(ip);
-                if (e.ip == 0)
-                        return -IPSET_ERR_HASH_ELEM;
+        if (adt == IPSET_TEST)
                 return adtfn(set, &e, &ext, &ext, flags);
-        }
 
         ip_to = ip;
         if (tb[IPSET_ATTR_IP_TO]) {
@@ -148,17 +147,20 @@ hash_ip4_uadt(struct ip_set *set, struct nlattr *tb[],
 
         hosts = h->netmask == 32 ? 1 : 2 << (32 - h->netmask - 1);
 
-        if (retried)
+        if (retried) {
                 ip = ntohl(h->next.ip);
-        for (; !before(ip_to, ip); ip += hosts) {
                 e.ip = htonl(ip);
-                if (e.ip == 0)
-                        return -IPSET_ERR_HASH_ELEM;
+        }
+        for (; ip <= ip_to;) {
                 ret = adtfn(set, &e, &ext, &ext, flags);
-
                 if (ret && !ip_set_eexist(ret, flags))
                         return ret;
 
+                ip += hosts;
+                e.ip = htonl(ip);
+                if (e.ip == 0)
+                        return 0;
+
                 ret = 0;
         }
         return ret;
diff --git a/net/netfilter/ipset/ip_set_hash_ipmark.c b/net/netfilter/ipset/ip_set_hash_ipmark.c
index b64cf14e8352..f3ba8348cf9d 100644
--- a/net/netfilter/ipset/ip_set_hash_ipmark.c
+++ b/net/netfilter/ipset/ip_set_hash_ipmark.c
@@ -149,7 +149,7 @@ hash_ipmark4_uadt(struct ip_set *set, struct nlattr *tb[],
 
         if (retried)
                 ip = ntohl(h->next.ip);
-        for (; !before(ip_to, ip); ip++) {
+        for (; ip <= ip_to; ip++) {
                 e.ip = htonl(ip);
                 ret = adtfn(set, &e, &ext, &ext, flags);
 
diff --git a/net/netfilter/ipset/ip_set_hash_ipport.c b/net/netfilter/ipset/ip_set_hash_ipport.c
index f438740e6c6a..ddb8039ec1d2 100644
--- a/net/netfilter/ipset/ip_set_hash_ipport.c
+++ b/net/netfilter/ipset/ip_set_hash_ipport.c
@@ -178,7 +178,7 @@ hash_ipport4_uadt(struct ip_set *set, struct nlattr *tb[],
 
         if (retried)
                 ip = ntohl(h->next.ip);
-        for (; !before(ip_to, ip); ip++) {
+        for (; ip <= ip_to; ip++) {
                 p = retried && ip == ntohl(h->next.ip) ? ntohs(h->next.port)
                                                        : port;
                 for (; p <= port_to; p++) {
diff --git a/net/netfilter/ipset/ip_set_hash_ipportip.c b/net/netfilter/ipset/ip_set_hash_ipportip.c
index 6215fb898c50..a7f4d7a85420 100644
--- a/net/netfilter/ipset/ip_set_hash_ipportip.c
+++ b/net/netfilter/ipset/ip_set_hash_ipportip.c
@@ -185,7 +185,7 @@ hash_ipportip4_uadt(struct ip_set *set, struct nlattr *tb[],
 
         if (retried)
                 ip = ntohl(h->next.ip);
-        for (; !before(ip_to, ip); ip++) {
+        for (; ip <= ip_to; ip++) {
                 p = retried && ip == ntohl(h->next.ip) ? ntohs(h->next.port)
                                                        : port;
                 for (; p <= port_to; p++) {
diff --git a/net/netfilter/ipset/ip_set_hash_ipportnet.c b/net/netfilter/ipset/ip_set_hash_ipportnet.c
index 5ab1b99a53c2..a2f19b9906e9 100644
--- a/net/netfilter/ipset/ip_set_hash_ipportnet.c
+++ b/net/netfilter/ipset/ip_set_hash_ipportnet.c
@@ -271,7 +271,7 @@ hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
 
         if (retried)
                 ip = ntohl(h->next.ip);
-        for (; !before(ip_to, ip); ip++) {
+        for (; ip <= ip_to; ip++) {
                 e.ip = htonl(ip);
                 p = retried && ip == ntohl(h->next.ip) ? ntohs(h->next.port)
                                                        : port;
@@ -281,7 +281,7 @@ hash_ipportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
                               ip == ntohl(h->next.ip) &&
                               p == ntohs(h->next.port)
                                 ? ntohl(h->next.ip2) : ip2_from;
-                        while (!after(ip2, ip2_to)) {
+                        while (ip2 <= ip2_to) {
                                 e.ip2 = htonl(ip2);
                                 ip2_last = ip_set_range_to_cidr(ip2, ip2_to,
                                                                 &cidr);
diff --git a/net/netfilter/ipset/ip_set_hash_net.c b/net/netfilter/ipset/ip_set_hash_net.c
index 5d9e895452e7..1c67a1761e45 100644
--- a/net/netfilter/ipset/ip_set_hash_net.c
+++ b/net/netfilter/ipset/ip_set_hash_net.c
@@ -193,7 +193,7 @@ hash_net4_uadt(struct ip_set *set, struct nlattr *tb[],
         }
         if (retried)
                 ip = ntohl(h->next.ip);
-        while (!after(ip, ip_to)) {
+        while (ip <= ip_to) {
                 e.ip = htonl(ip);
                 last = ip_set_range_to_cidr(ip, ip_to, &e.cidr);
                 ret = adtfn(set, &e, &ext, &ext, flags);
diff --git a/net/netfilter/ipset/ip_set_hash_netiface.c b/net/netfilter/ipset/ip_set_hash_netiface.c
index 44cf11939c91..d417074f1c1a 100644
--- a/net/netfilter/ipset/ip_set_hash_netiface.c
+++ b/net/netfilter/ipset/ip_set_hash_netiface.c
@@ -255,7 +255,7 @@ hash_netiface4_uadt(struct ip_set *set, struct nlattr *tb[],
 
         if (retried)
                 ip = ntohl(h->next.ip);
-        while (!after(ip, ip_to)) {
+        while (ip <= ip_to) {
                 e.ip = htonl(ip);
                 last = ip_set_range_to_cidr(ip, ip_to, &e.cidr);
                 ret = adtfn(set, &e, &ext, &ext, flags);
diff --git a/net/netfilter/ipset/ip_set_hash_netnet.c b/net/netfilter/ipset/ip_set_hash_netnet.c
index db614e13b193..7f9ae2e9645b 100644
--- a/net/netfilter/ipset/ip_set_hash_netnet.c
+++ b/net/netfilter/ipset/ip_set_hash_netnet.c
@@ -250,13 +250,13 @@ hash_netnet4_uadt(struct ip_set *set, struct nlattr *tb[],
         if (retried)
                 ip = ntohl(h->next.ip[0]);
 
-        while (!after(ip, ip_to)) {
+        while (ip <= ip_to) {
                 e.ip[0] = htonl(ip);
                 last = ip_set_range_to_cidr(ip, ip_to, &e.cidr[0]);
                 ip2 = (retried &&
                        ip == ntohl(h->next.ip[0])) ? ntohl(h->next.ip[1])
                                                    : ip2_from;
-                while (!after(ip2, ip2_to)) {
+                while (ip2 <= ip2_to) {
                         e.ip[1] = htonl(ip2);
                         last2 = ip_set_range_to_cidr(ip2, ip2_to, &e.cidr[1]);
                         ret = adtfn(set, &e, &ext, &ext, flags);
diff --git a/net/netfilter/ipset/ip_set_hash_netport.c b/net/netfilter/ipset/ip_set_hash_netport.c
index 54b64b6cd0cd..e6ef382febe4 100644
--- a/net/netfilter/ipset/ip_set_hash_netport.c
+++ b/net/netfilter/ipset/ip_set_hash_netport.c
@@ -241,7 +241,7 @@ hash_netport4_uadt(struct ip_set *set, struct nlattr *tb[],
 
         if (retried)
                 ip = ntohl(h->next.ip);
-        while (!after(ip, ip_to)) {
+        while (ip <= ip_to) {
                 e.ip = htonl(ip);
                 last = ip_set_range_to_cidr(ip, ip_to, &cidr);
                 e.cidr = cidr - 1;
diff --git a/net/netfilter/ipset/ip_set_hash_netportnet.c b/net/netfilter/ipset/ip_set_hash_netportnet.c
index aff846960ac4..8602f2595a1a 100644
--- a/net/netfilter/ipset/ip_set_hash_netportnet.c
+++ b/net/netfilter/ipset/ip_set_hash_netportnet.c
@@ -291,7 +291,7 @@ hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
         if (retried)
                 ip = ntohl(h->next.ip[0]);
 
-        while (!after(ip, ip_to)) {
+        while (ip <= ip_to) {
                 e.ip[0] = htonl(ip);
                 ip_last = ip_set_range_to_cidr(ip, ip_to, &e.cidr[0]);
                 p = retried && ip == ntohl(h->next.ip[0]) ? ntohs(h->next.port)
@@ -301,7 +301,7 @@ hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
                         ip2 = (retried && ip == ntohl(h->next.ip[0]) &&
                                p == ntohs(h->next.port)) ? ntohl(h->next.ip[1])
                                                          : ip2_from;
-                        while (!after(ip2, ip2_to)) {
+                        while (ip2 <= ip2_to) {
                                 e.ip[1] = htonl(ip2);
                                 ip2_last = ip_set_range_to_cidr(ip2, ip2_to,
                                                                 &e.cidr[1]);
diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
index 90d396814798..4527921b1c3a 100644
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -921,6 +921,7 @@ ip_vs_prepare_tunneled_skb(struct sk_buff *skb, int skb_af,
 {
         struct sk_buff *new_skb = NULL;
         struct iphdr *old_iph = NULL;
+        __u8 old_dsfield;
 #ifdef CONFIG_IP_VS_IPV6
         struct ipv6hdr *old_ipv6h = NULL;
 #endif
@@ -945,7 +946,7 @@ ip_vs_prepare_tunneled_skb(struct sk_buff *skb, int skb_af,
                         *payload_len =
                                 ntohs(old_ipv6h->payload_len) +
                                 sizeof(*old_ipv6h);
-                *dsfield = ipv6_get_dsfield(old_ipv6h);
+                old_dsfield = ipv6_get_dsfield(old_ipv6h);
                 *ttl = old_ipv6h->hop_limit;
                 if (df)
                         *df = 0;
@@ -960,12 +961,15 @@ ip_vs_prepare_tunneled_skb(struct sk_buff *skb, int skb_af,
 
                 /* fix old IP header checksum */
                 ip_send_check(old_iph);
-                *dsfield = ipv4_get_dsfield(old_iph);
+                old_dsfield = ipv4_get_dsfield(old_iph);
                 *ttl = old_iph->ttl;
                 if (payload_len)
                         *payload_len = ntohs(old_iph->tot_len);
         }
 
+        /* Implement full-functionality option for ECN encapsulation */
+        *dsfield = INET_ECN_encapsulate(old_dsfield, old_dsfield);
+
         return skb;
 error:
         kfree_skb(skb);
diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index 929927171426..64e1ee091225 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c
@@ -1048,7 +1048,7 @@ static int nf_tables_fill_chain_info(struct sk_buff *skb, struct net *net,
                 if (nla_put_string(skb, NFTA_CHAIN_TYPE, basechain->type->name))
                         goto nla_put_failure;
 
-                if (nft_dump_stats(skb, nft_base_chain(chain)->stats))
+                if (basechain->stats && nft_dump_stats(skb, basechain->stats))
                         goto nla_put_failure;
         }
 
@@ -1487,8 +1487,8 @@ static int nf_tables_updchain(struct nft_ctx *ctx, u8 genmask, u8 policy,
 
                 chain2 = nf_tables_chain_lookup(table, nla[NFTA_CHAIN_NAME],
                                                 genmask);
-                if (IS_ERR(chain2))
-                        return PTR_ERR(chain2);
+                if (!IS_ERR(chain2))
+                        return -EEXIST;
         }
 
         if (nla[NFTA_CHAIN_COUNTERS]) {
@@ -2741,8 +2741,10 @@ cont:
         list_for_each_entry(i, &ctx->table->sets, list) {
                 if (!nft_is_active_next(ctx->net, i))
                         continue;
-                if (!strcmp(set->name, i->name))
+                if (!strcmp(set->name, i->name)) {
+                        kfree(set->name);
                         return -ENFILE;
+                }
         }
         return 0;
 }
diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
index c83a3b5e1c6c..d8571f414208 100644
--- a/net/netfilter/x_tables.c
+++ b/net/netfilter/x_tables.c
@@ -892,7 +892,7 @@ void *xt_copy_counters_from_user(const void __user *user, unsigned int len,
                 if (copy_from_user(&compat_tmp, user, sizeof(compat_tmp)) != 0)
                         return ERR_PTR(-EFAULT);
 
-                strlcpy(info->name, compat_tmp.name, sizeof(info->name));
+                memcpy(info->name, compat_tmp.name, sizeof(info->name) - 1);
                 info->num_counters = compat_tmp.num_counters;
                 user += sizeof(compat_tmp);
         } else
@@ -905,9 +905,9 @@ void *xt_copy_counters_from_user(const void __user *user, unsigned int len,
                 if (copy_from_user(info, user, sizeof(*info)) != 0)
                         return ERR_PTR(-EFAULT);
 
-                info->name[sizeof(info->name) - 1] = '\0';
                 user += sizeof(*info);
         }
+        info->name[sizeof(info->name) - 1] = '\0';
 
         size = sizeof(struct xt_counters);
         size *= info->num_counters;
diff --git a/net/netfilter/xt_bpf.c b/net/netfilter/xt_bpf.c
index 38986a95216c..29123934887b 100644
--- a/net/netfilter/xt_bpf.c
+++ b/net/netfilter/xt_bpf.c
@@ -8,6 +8,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/syscalls.h>
 #include <linux/skbuff.h>
 #include <linux/filter.h>
 #include <linux/bpf.h>
@@ -49,6 +50,22 @@ static int __bpf_mt_check_fd(int fd, struct bpf_prog **ret)
         return 0;
 }
 
+static int __bpf_mt_check_path(const char *path, struct bpf_prog **ret)
+{
+        mm_segment_t oldfs = get_fs();
+        int retval, fd;
+
+        set_fs(KERNEL_DS);
+        fd = bpf_obj_get_user(path);
+        set_fs(oldfs);
+        if (fd < 0)
+                return fd;
+
+        retval = __bpf_mt_check_fd(fd, ret);
+        sys_close(fd);
+        return retval;
+}
+
 static int bpf_mt_check(const struct xt_mtchk_param *par)
 {
         struct xt_bpf_info *info = par->matchinfo;
@@ -66,9 +83,10 @@ static int bpf_mt_check_v1(const struct xt_mtchk_param *par)
                 return __bpf_mt_check_bytecode(info->bpf_program,
                                                info->bpf_program_num_elem,
                                                &info->filter);
-        else if (info->mode == XT_BPF_MODE_FD_PINNED ||
-                 info->mode == XT_BPF_MODE_FD_ELF)
+        else if (info->mode == XT_BPF_MODE_FD_ELF)
                 return __bpf_mt_check_fd(info->fd, &info->filter);
+        else if (info->mode == XT_BPF_MODE_PATH_PINNED)
+                return __bpf_mt_check_path(info->path, &info->filter);
         else
                 return -EINVAL;
 }
diff --git a/net/netfilter/xt_socket.c b/net/netfilter/xt_socket.c
index e75ef39669c5..575d2153e3b8 100644
--- a/net/netfilter/xt_socket.c
+++ b/net/netfilter/xt_socket.c
@@ -76,7 +76,7 @@ socket_match(const struct sk_buff *skb, struct xt_action_param *par,
                         transparent = nf_sk_is_transparent(sk);
 
                 if (info->flags & XT_SOCKET_RESTORESKMARK && !wildcard &&
-                    transparent)
+                    transparent && sk_fullsock(sk))
                         pskb->mark = sk->sk_mark;
 
                 if (sk != skb->sk)
@@ -133,7 +133,7 @@ socket_mt6_v1_v2_v3(const struct sk_buff *skb, struct xt_action_param *par)
                         transparent = nf_sk_is_transparent(sk);
 
                 if (info->flags & XT_SOCKET_RESTORESKMARK && !wildcard &&
-                    transparent)
+                    transparent && sk_fullsock(sk))
                         pskb->mark = sk->sk_mark;
 
                 if (sk != skb->sk)
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 94c11cf0459d..f34750691c5c 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -2266,16 +2266,17 @@ int __netlink_dump_start(struct sock *ssk, struct sk_buff *skb,
         cb->min_dump_alloc = control->min_dump_alloc;
         cb->skb = skb;
 
+        if (cb->start) {
+                ret = cb->start(cb);
+                if (ret)
+                        goto error_unlock;
+        }
+
         nlk->cb_running = true;
 
         mutex_unlock(nlk->cb_mutex);
 
-        ret = 0;
-        if (cb->start)
-                ret = cb->start(cb);
-
-        if (!ret)
-                ret = netlink_dump(sk);
+        ret = netlink_dump(sk);
 
         sock_put(sk);
 
diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 9b5de31aa429..c1841f234a71 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c
@@ -2203,7 +2203,7 @@ static void xs_udp_setup_socket(struct work_struct *work)
         struct sock_xprt *transport =
                 container_of(work, struct sock_xprt, connect_worker.work);
         struct rpc_xprt *xprt = &transport->xprt;
-        struct socket *sock = transport->sock;
+        struct socket *sock;
         int status = -EIO;
 
         sock = xs_create_sock(xprt, transport,
diff --git a/net/tipc/bcast.c b/net/tipc/bcast.c
index 7d99029df342..a140dd4a84af 100644
--- a/net/tipc/bcast.c
+++ b/net/tipc/bcast.c
@@ -233,7 +233,7 @@ static int tipc_bcast_xmit(struct net *net, struct sk_buff_head *pkts,
         struct sk_buff_head xmitq;
         int rc = 0;
 
-        __skb_queue_head_init(&xmitq);
+        skb_queue_head_init(&xmitq);
         tipc_bcast_lock(net);
         if (tipc_link_bc_peers(l))
                 rc = tipc_link_xmit(l, pkts, &xmitq);
@@ -263,7 +263,7 @@ static int tipc_rcast_xmit(struct net *net, struct sk_buff_head *pkts,
         u32 dst, selector;
 
         selector = msg_link_selector(buf_msg(skb_peek(pkts)));
-        __skb_queue_head_init(&_pkts);
+        skb_queue_head_init(&_pkts);
 
         list_for_each_entry_safe(n, tmp, &dests->list, list) {
                 dst = n->value;
diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index 121e59a1d0e7..17146c16ee2d 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c
@@ -568,6 +568,14 @@ bool tipc_msg_lookup_dest(struct net *net, struct sk_buff *skb, int *err)
         msg_set_destnode(msg, dnode);
         msg_set_destport(msg, dport);
         *err = TIPC_OK;
+
+        if (!skb_cloned(skb))
+                return true;
+
+        /* Unclone buffer in case it was bundled */
+        if (pskb_expand_head(skb, BUF_HEADROOM, BUF_TAILROOM, GFP_ATOMIC))
+                return false;
+
         return true;
 }
 
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 690874293cfc..d396cb61a280 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -549,6 +549,14 @@ nl80211_nan_srf_policy[NL80211_NAN_SRF_ATTR_MAX + 1] = {
         [NL80211_NAN_SRF_MAC_ADDRS] = { .type = NLA_NESTED },
 };
 
+/* policy for packet pattern attributes */
+static const struct nla_policy
+nl80211_packet_pattern_policy[MAX_NL80211_PKTPAT + 1] = {
+        [NL80211_PKTPAT_MASK] = { .type = NLA_BINARY, },
+        [NL80211_PKTPAT_PATTERN] = { .type = NLA_BINARY, },
+        [NL80211_PKTPAT_OFFSET] = { .type = NLA_U32 },
+};
+
 static int nl80211_prepare_wdev_dump(struct sk_buff *skb,
                                      struct netlink_callback *cb,
                                      struct cfg80211_registered_device **rdev,
@@ -10532,7 +10540,8 @@ static int nl80211_set_wowlan(struct sk_buff *skb, struct genl_info *info)
                         u8 *mask_pat;
 
                         nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
-                                         NULL, info->extack);
+                                         nl80211_packet_pattern_policy,
+                                         info->extack);
                         err = -EINVAL;
                         if (!pat_tb[NL80211_PKTPAT_MASK] ||
                             !pat_tb[NL80211_PKTPAT_PATTERN])
@@ -10781,7 +10790,8 @@ static int nl80211_parse_coalesce_rule(struct cfg80211_registered_device *rdev,
                             rem) {
                 u8 *mask_pat;
 
-                nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat, NULL, NULL);
+                nla_parse_nested(pat_tb, MAX_NL80211_PKTPAT, pat,
+                                 nl80211_packet_pattern_policy, NULL);
                 if (!pat_tb[NL80211_PKTPAT_MASK] ||
                     !pat_tb[NL80211_PKTPAT_PATTERN])
                         return -EINVAL;
diff --git a/net/xfrm/xfrm_device.c b/net/xfrm/xfrm_device.c
index acf00104ef31..30e5746085b8 100644
--- a/net/xfrm/xfrm_device.c
+++ b/net/xfrm/xfrm_device.c
@@ -91,6 +91,7 @@ int xfrm_dev_state_add(struct net *net, struct xfrm_state *x,
         }
 
         if (!dev->xfrmdev_ops || !dev->xfrmdev_ops->xdo_dev_state_add) {
+                xso->dev = NULL;
                 dev_put(dev);
                 return 0;
         }
diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
index 2515cd2bc5db..8ac9d32fb79d 100644
--- a/net/xfrm/xfrm_input.c
+++ b/net/xfrm/xfrm_input.c
@@ -429,7 +429,8 @@ resume:
         nf_reset(skb);
 
         if (decaps) {
-                skb->sp->olen = 0;
+                if (skb->sp)
+                        skb->sp->olen = 0;
                 skb_dst_drop(skb);
                 gro_cells_receive(&gro_cells, skb);
                 return 0;
@@ -440,7 +441,8 @@ resume:
 
                 err = x->inner_mode->afinfo->transport_finish(skb, xfrm_gro || async);
                 if (xfrm_gro) {
-                        skb->sp->olen = 0;
+                        if (skb->sp)
+                                skb->sp->olen = 0;
                         skb_dst_drop(skb);
                         gro_cells_receive(&gro_cells, skb);
                         return err;
diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
index 0dab1cd79ce4..12213477cd3a 100644
--- a/net/xfrm/xfrm_state.c
+++ b/net/xfrm/xfrm_state.c
@@ -732,12 +732,12 @@ restart:
                         }
                 }
         }
+out:
+        spin_unlock_bh(&net->xfrm.xfrm_state_lock);
         if (cnt) {
                 err = 0;
                 xfrm_policy_cache_flush();
         }
-out:
-        spin_unlock_bh(&net->xfrm.xfrm_state_lock);
         return err;
 }
 EXPORT_SYMBOL(xfrm_state_flush);
diff --git a/net/xfrm/xfrm_user.c b/net/xfrm/xfrm_user.c
index 2bfbd9121e3b..b997f1395357 100644
--- a/net/xfrm/xfrm_user.c
+++ b/net/xfrm/xfrm_user.c
@@ -657,6 +657,7 @@ static int xfrm_add_sa(struct sk_buff *skb, struct nlmsghdr *nlh,
 
         if (err < 0) {
                 x->km.state = XFRM_STATE_DEAD;
+                xfrm_dev_state_delete(x);
                 __xfrm_state_put(x);
                 goto out;
         }
diff --git a/scripts/faddr2line b/scripts/faddr2line
index 29df825d375c..2f6ce802397d 100755
--- a/scripts/faddr2line
+++ b/scripts/faddr2line
@@ -103,11 +103,12 @@ __faddr2line() {
 
         # Go through each of the object's symbols which match the func name.
         # In rare cases there might be duplicates.
+        file_end=$(size -Ax $objfile | awk '$1 == ".text" {print $2}')
         while read symbol; do
                 local fields=($symbol)
                 local sym_base=0x${fields[0]}
                 local sym_type=${fields[1]}
-                local sym_end=0x${fields[3]}
+                local sym_end=${fields[3]}
 
                 # calculate the size
                 local sym_size=$(($sym_end - $sym_base))
@@ -157,7 +158,7 @@ __faddr2line() {
                 addr2line -fpie $objfile $addr | sed "s; $dir_prefix\(\./\)*; ;"
                 DONE=1
 
-        done < <(nm -n $objfile | awk -v fn=$func '$3 == fn { found=1; line=$0; start=$1; next } found == 1 { found=0; print line, $1 }')
+        done < <(nm -n $objfile | awk -v fn=$func -v end=$file_end '$3 == fn { found=1; line=$0; start=$1; next } found == 1 { found=0; print line, "0x"$1 } END {if (found == 1) print line, end; }')
 }
 
 [[ $# -lt 2 ]] && usage
diff --git a/sound/core/seq/seq_clientmgr.c b/sound/core/seq/seq_clientmgr.c
index ea2d0ae85bd3..6c9cba2166d9 100644
--- a/sound/core/seq/seq_clientmgr.c
+++ b/sound/core/seq/seq_clientmgr.c
@@ -1259,6 +1259,7 @@ static int snd_seq_ioctl_create_port(struct snd_seq_client *client, void *arg)
         struct snd_seq_port_info *info = arg;
         struct snd_seq_client_port *port;
         struct snd_seq_port_callback *callback;
+        int port_idx;
 
         /* it is not allowed to create the port for an another client */
         if (info->addr.client != client->number)
@@ -1269,7 +1270,9 @@ static int snd_seq_ioctl_create_port(struct snd_seq_client *client, void *arg)
                 return -ENOMEM;
 
         if (client->type == USER_CLIENT && info->kernel) {
-                snd_seq_delete_port(client, port->addr.port);
+                port_idx = port->addr.port;
+                snd_seq_port_unlock(port);
+                snd_seq_delete_port(client, port_idx);
                 return -EINVAL;
         }
         if (client->type == KERNEL_CLIENT) {
@@ -1290,6 +1293,7 @@ static int snd_seq_ioctl_create_port(struct snd_seq_client *client, void *arg)
 
         snd_seq_set_port_info(port, info);
         snd_seq_system_client_ev_port_start(port->addr.client, port->addr.port);
+        snd_seq_port_unlock(port);
 
         return 0;
 }
diff --git a/sound/core/seq/seq_ports.c b/sound/core/seq/seq_ports.c
index 0a7020c82bfc..d21ece9f8d73 100644
--- a/sound/core/seq/seq_ports.c
+++ b/sound/core/seq/seq_ports.c
@@ -122,7 +122,9 @@ static void port_subs_info_init(struct snd_seq_port_subs_info *grp)
 }
 
 
-/* create a port, port number is returned (-1 on failure) */
+/* create a port, port number is returned (-1 on failure);
+ * the caller needs to unref the port via snd_seq_port_unlock() appropriately
+ */
 struct snd_seq_client_port *snd_seq_create_port(struct snd_seq_client *client,
                                                 int port)
 {
@@ -151,6 +153,7 @@ struct snd_seq_client_port *snd_seq_create_port(struct snd_seq_client *client,
         snd_use_lock_init(&new_port->use_lock);
         port_subs_info_init(&new_port->c_src);
         port_subs_info_init(&new_port->c_dest);
+        snd_use_lock_use(&new_port->use_lock);
 
         num = port >= 0 ? port : 0;
         mutex_lock(&client->ports_mutex);
@@ -165,9 +168,9 @@ struct snd_seq_client_port *snd_seq_create_port(struct snd_seq_client *client,
         list_add_tail(&new_port->list, &p->list);
         client->num_ports++;
         new_port->addr.port = num;      /* store the port number in the port */
+        sprintf(new_port->name, "port-%d", num);
         write_unlock_irqrestore(&client->ports_lock, flags);
         mutex_unlock(&client->ports_mutex);
-        sprintf(new_port->name, "port-%d", num);
 
         return new_port;
 }
diff --git a/sound/core/seq/seq_virmidi.c b/sound/core/seq/seq_virmidi.c
index 8d93a4021c78..f48a4cd24ffc 100644
--- a/sound/core/seq/seq_virmidi.c
+++ b/sound/core/seq/seq_virmidi.c
@@ -77,13 +77,17 @@ static void snd_virmidi_init_event(struct snd_virmidi *vmidi,
  * decode input event and put to read buffer of each opened file
  */
 static int snd_virmidi_dev_receive_event(struct snd_virmidi_dev *rdev,
-                                         struct snd_seq_event *ev)
+                                         struct snd_seq_event *ev,
+                                         bool atomic)
 {
         struct snd_virmidi *vmidi;
         unsigned char msg[4];
         int len;
 
-        read_lock(&rdev->filelist_lock);
+        if (atomic)
+                read_lock(&rdev->filelist_lock);
+        else
+                down_read(&rdev->filelist_sem);
         list_for_each_entry(vmidi, &rdev->filelist, list) {
                 if (!vmidi->trigger)
                         continue;
@@ -97,7 +101,10 @@ static int snd_virmidi_dev_receive_event(struct snd_virmidi_dev *rdev,
                                 snd_rawmidi_receive(vmidi->substream, msg, len);
                 }
         }
-        read_unlock(&rdev->filelist_lock);
+        if (atomic)
+                read_unlock(&rdev->filelist_lock);
+        else
+                up_read(&rdev->filelist_sem);
 
         return 0;
 }
@@ -115,7 +122,7 @@ int snd_virmidi_receive(struct snd_rawmidi *rmidi, struct snd_seq_event *ev)
         struct snd_virmidi_dev *rdev;
 
         rdev = rmidi->private_data;
-        return snd_virmidi_dev_receive_event(rdev, ev);
+        return snd_virmidi_dev_receive_event(rdev, ev, true);
 }
 #endif  /*  0  */
 
@@ -130,7 +137,7 @@ static int snd_virmidi_event_input(struct snd_seq_event *ev, int direct,
         rdev = private_data;
         if (!(rdev->flags & SNDRV_VIRMIDI_USE))
                 return 0; /* ignored */
-        return snd_virmidi_dev_receive_event(rdev, ev);
+        return snd_virmidi_dev_receive_event(rdev, ev, atomic);
 }
 
 /*
@@ -209,7 +216,6 @@ static int snd_virmidi_input_open(struct snd_rawmidi_substream *substream)
         struct snd_virmidi_dev *rdev = substream->rmidi->private_data;
         struct snd_rawmidi_runtime *runtime = substream->runtime;
         struct snd_virmidi *vmidi;
-        unsigned long flags;
 
         vmidi = kzalloc(sizeof(*vmidi), GFP_KERNEL);
         if (vmidi == NULL)
@@ -223,9 +229,11 @@ static int snd_virmidi_input_open(struct snd_rawmidi_substream *substream)
         vmidi->client = rdev->client;
         vmidi->port = rdev->port;       
         runtime->private_data = vmidi;
-        write_lock_irqsave(&rdev->filelist_lock, flags);
+        down_write(&rdev->filelist_sem);
+        write_lock_irq(&rdev->filelist_lock);
         list_add_tail(&vmidi->list, &rdev->filelist);
-        write_unlock_irqrestore(&rdev->filelist_lock, flags);
+        write_unlock_irq(&rdev->filelist_lock);
+        up_write(&rdev->filelist_sem);
         vmidi->rdev = rdev;
         return 0;
 }
@@ -264,9 +272,11 @@ static int snd_virmidi_input_close(struct snd_rawmidi_substream *substream)
         struct snd_virmidi_dev *rdev = substream->rmidi->private_data;
         struct snd_virmidi *vmidi = substream->runtime->private_data;
 
+        down_write(&rdev->filelist_sem);
         write_lock_irq(&rdev->filelist_lock);
         list_del(&vmidi->list);
         write_unlock_irq(&rdev->filelist_lock);
+        up_write(&rdev->filelist_sem);
         snd_midi_event_free(vmidi->parser);
         substream->runtime->private_data = NULL;
         kfree(vmidi);
@@ -520,6 +530,7 @@ int snd_virmidi_new(struct snd_card *card, int device, struct snd_rawmidi **rrmi
         rdev->rmidi = rmidi;
         rdev->device = device;
         rdev->client = -1;
+        init_rwsem(&rdev->filelist_sem);
         rwlock_init(&rdev->filelist_lock);
         INIT_LIST_HEAD(&rdev->filelist);
         rdev->seq_mode = SNDRV_VIRMIDI_SEQ_DISPATCH;
diff --git a/sound/usb/caiaq/device.c b/sound/usb/caiaq/device.c
index 0fb6b1b79261..d8409d9ae55b 100644
--- a/sound/usb/caiaq/device.c
+++ b/sound/usb/caiaq/device.c
@@ -469,10 +469,12 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
 
         err = snd_usb_caiaq_send_command(cdev, EP1_CMD_GET_DEVICE_INFO, NULL, 0);
         if (err)
-                return err;
+                goto err_kill_urb;
 
-        if (!wait_event_timeout(cdev->ep1_wait_queue, cdev->spec_received, HZ))
-                return -ENODEV;
+        if (!wait_event_timeout(cdev->ep1_wait_queue, cdev->spec_received, HZ)) {
+                err = -ENODEV;
+                goto err_kill_urb;
+        }
 
         usb_string(usb_dev, usb_dev->descriptor.iManufacturer,
                    cdev->vendor_name, CAIAQ_USB_STR_LEN);
@@ -507,6 +509,10 @@ static int init_card(struct snd_usb_caiaqdev *cdev)
 
         setup_card(cdev);
         return 0;
+
+ err_kill_urb:
+        usb_kill_urb(&cdev->ep1_in_urb);
+        return err;
 }
 
 static int snd_probe(struct usb_interface *intf,
diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c
index 0ff5a7d2e19f..c8f723c3a033 100644
--- a/sound/usb/line6/driver.c
+++ b/sound/usb/line6/driver.c
@@ -779,9 +779,10 @@ int line6_probe(struct usb_interface *interface,
         return 0;
 
  error:
-        if (line6->disconnect)
-                line6->disconnect(line6);
-        snd_card_free(card);
+        /* we can call disconnect callback here because no close-sync is
+         * needed yet at this point
+         */
+        line6_disconnect(interface);
         return ret;
 }
 EXPORT_SYMBOL_GPL(line6_probe);
diff --git a/sound/usb/line6/podhd.c b/sound/usb/line6/podhd.c
index 956f847a96e4..451007c27743 100644
--- a/sound/usb/line6/podhd.c
+++ b/sound/usb/line6/podhd.c
@@ -301,7 +301,8 @@ static void podhd_disconnect(struct usb_line6 *line6)
 
                 intf = usb_ifnum_to_if(line6->usbdev,
                                         pod->line6.properties->ctrl_if);
-                usb_driver_release_interface(&podhd_driver, intf);
+                if (intf)
+                        usb_driver_release_interface(&podhd_driver, intf);
         }
 }
 
@@ -317,6 +318,9 @@ static int podhd_init(struct usb_line6 *line6,
 
         line6->disconnect = podhd_disconnect;
 
+        init_timer(&pod->startup_timer);
+        INIT_WORK(&pod->startup_work, podhd_startup_workqueue);
+
         if (pod->line6.properties->capabilities & LINE6_CAP_CONTROL) {
                 /* claim the data interface */
                 intf = usb_ifnum_to_if(line6->usbdev,
@@ -358,8 +362,6 @@ static int podhd_init(struct usb_line6 *line6,
         }
 
         /* init device and delay registering */
-        init_timer(&pod->startup_timer);
-        INIT_WORK(&pod->startup_work, podhd_startup_workqueue);
         podhd_startup(pod);
         return 0;
 }
diff --git a/sound/usb/mixer.c b/sound/usb/mixer.c
index 9732edf77f86..91bc8f18791e 100644
--- a/sound/usb/mixer.c
+++ b/sound/usb/mixer.c
@@ -2234,6 +2234,9 @@ static int parse_audio_unit(struct mixer_build *state, int unitid)
 
 static void snd_usb_mixer_free(struct usb_mixer_interface *mixer)
 {
+        /* kill pending URBs */
+        snd_usb_mixer_disconnect(mixer);
+
         kfree(mixer->id_elems);
         if (mixer->urb) {
                 kfree(mixer->urb->transfer_buffer);
@@ -2584,8 +2587,13 @@ _error:
 
 void snd_usb_mixer_disconnect(struct usb_mixer_interface *mixer)
 {
-        usb_kill_urb(mixer->urb);
-        usb_kill_urb(mixer->rc_urb);
+        if (mixer->disconnected)
+                return;
+        if (mixer->urb)
+                usb_kill_urb(mixer->urb);
+        if (mixer->rc_urb)
+                usb_kill_urb(mixer->rc_urb);
+        mixer->disconnected = true;
 }
 
 #ifdef CONFIG_PM
diff --git a/sound/usb/mixer.h b/sound/usb/mixer.h
index 2b4b067646ab..545d99b09706 100644
--- a/sound/usb/mixer.h
+++ b/sound/usb/mixer.h
@@ -22,6 +22,8 @@ struct usb_mixer_interface {
         struct urb *rc_urb;
         struct usb_ctrlrequest *rc_setup_packet;
         u8 rc_buffer[6];
+
+        bool disconnected;
 };
 
 #define MAX_CHANNELS    16      /* max logical channels */
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index b8cb57aeec77..9ddaae3784f5 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1138,6 +1138,7 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
         case USB_ID(0x047F, 0x0415): /* Plantronics BT-300 */
         case USB_ID(0x047F, 0xAA05): /* Plantronics DA45 */
         case USB_ID(0x047F, 0xC022): /* Plantronics C310 */
+        case USB_ID(0x047F, 0xC02F): /* Plantronics P610 */
         case USB_ID(0x047F, 0xC036): /* Plantronics C520-M */
         case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */
         case USB_ID(0x0556, 0x0014): /* Phoenix Audio TMX320VC */
diff --git a/tools/testing/selftests/mqueue/Makefile b/tools/testing/selftests/mqueue/Makefile
index 0f5e347b068d..152823b6cb21 100644
--- a/tools/testing/selftests/mqueue/Makefile
+++ b/tools/testing/selftests/mqueue/Makefile
@@ -5,8 +5,8 @@ TEST_GEN_PROGS := mq_open_tests mq_perf_tests
 include ../lib.mk
 
 override define RUN_TESTS
-        $(OUTPUT)/mq_open_tests /test1 || echo "selftests: mq_open_tests [FAIL]"
-        $(OUTPUT)//mq_perf_tests || echo "selftests: mq_perf_tests [FAIL]"
+        @$(OUTPUT)/mq_open_tests /test1 || echo "selftests: mq_open_tests [FAIL]"
+        @$(OUTPUT)/mq_perf_tests || echo "selftests: mq_perf_tests [FAIL]"
 endef
 
 override define EMIT_TESTS
diff --git a/tools/testing/selftests/networking/timestamping/rxtimestamp.c b/tools/testing/selftests/networking/timestamping/rxtimestamp.c
index 00f286661dcd..dd4162fc0419 100644
--- a/tools/testing/selftests/networking/timestamping/rxtimestamp.c
+++ b/tools/testing/selftests/networking/timestamping/rxtimestamp.c
@@ -341,7 +341,7 @@ int main(int argc, char **argv)
                         return 0;
                 case 'n':
                         t = atoi(optarg);
-                        if (t > ARRAY_SIZE(test_cases))
+                        if (t >= ARRAY_SIZE(test_cases))
                                 error(1, 0, "Invalid test case: %d", t);
                         all_tests = false;
                         test_cases[t].enabled = true;
diff --git a/tools/testing/selftests/x86/Makefile b/tools/testing/selftests/x86/Makefile
index 97f187e2663f..0a74a20ca32b 100644
--- a/tools/testing/selftests/x86/Makefile
+++ b/tools/testing/selftests/x86/Makefile
@@ -20,7 +20,7 @@ BINARIES_64 := $(TARGETS_C_64BIT_ALL:%=%_64)
 BINARIES_32 := $(patsubst %,$(OUTPUT)/%,$(BINARIES_32))
 BINARIES_64 := $(patsubst %,$(OUTPUT)/%,$(BINARIES_64))
 
-CFLAGS := -O2 -g -std=gnu99 -pthread -Wall
+CFLAGS := -O2 -g -std=gnu99 -pthread -Wall -no-pie
 
 UNAME_M := $(shell uname -m)
 CAN_BUILD_I386 := $(shell ./check_cc.sh $(CC) trivial_32bit_program.c -m32)