11 files changed, 142 insertions, 96 deletions

diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index b19c491cbc4e..dfdad67d8f6c 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -219,7 +219,8 @@ config FRAME_WARN
         range 0 8192
         default 0 if KASAN
         default 2048 if GCC_PLUGIN_LATENT_ENTROPY
-        default 1024 if !64BIT
+        default 1280 if (!64BIT && PARISC)
+        default 1024 if (!64BIT && !PARISC)
         default 2048 if 64BIT
         help
           Tell gcc to warn at build time for stack frames larger than this.
@@ -1091,8 +1092,8 @@ config PROVE_LOCKING
         select DEBUG_MUTEXES
         select DEBUG_RT_MUTEXES if RT_MUTEXES
         select DEBUG_LOCK_ALLOC
-        select LOCKDEP_CROSSRELEASE
-        select LOCKDEP_COMPLETIONS
+        select LOCKDEP_CROSSRELEASE if BROKEN
+        select LOCKDEP_COMPLETIONS if BROKEN
         select TRACE_IRQFLAGS
         default n
         help
@@ -1589,6 +1590,54 @@ config LATENCYTOP
 
 source kernel/trace/Kconfig
 
+config PROVIDE_OHCI1394_DMA_INIT
+        bool "Remote debugging over FireWire early on boot"
+        depends on PCI && X86
+        help
+          If you want to debug problems which hang or crash the kernel early
+          on boot and the crashing machine has a FireWire port, you can use
+          this feature to remotely access the memory of the crashed machine
+          over FireWire. This employs remote DMA as part of the OHCI1394
+          specification which is now the standard for FireWire controllers.
+
+          With remote DMA, you can monitor the printk buffer remotely using
+          firescope and access all memory below 4GB using fireproxy from gdb.
+          Even controlling a kernel debugger is possible using remote DMA.
+
+          Usage:
+
+          If ohci1394_dma=early is used as boot parameter, it will initialize
+          all OHCI1394 controllers which are found in the PCI config space.
+
+          As all changes to the FireWire bus such as enabling and disabling
+          devices cause a bus reset and thereby disable remote DMA for all
+          devices, be sure to have the cable plugged and FireWire enabled on
+          the debugging host before booting the debug target for debugging.
+
+          This code (~1k) is freed after boot. By then, the firewire stack
+          in charge of the OHCI-1394 controllers should be used instead.
+
+          See Documentation/debugging-via-ohci1394.txt for more information.
+
+config DMA_API_DEBUG
+        bool "Enable debugging of DMA-API usage"
+        depends on HAVE_DMA_API_DEBUG
+        help
+          Enable this option to debug the use of the DMA API by device drivers.
+          With this option you will be able to detect common bugs in device
+          drivers like double-freeing of DMA mappings or freeing mappings that
+          were never allocated.
+
+          This also attempts to catch cases where a page owned by DMA is
+          accessed by the cpu in a way that could cause data corruption.  For
+          example, this enables cow_user_page() to check that the source page is
+          not undergoing DMA.
+
+          This option causes a performance degradation.  Use only if you want to
+          debug device drivers and dma interactions.
+
+          If unsure, say N.
+
 menu "Runtime Testing"
 
 config LKDTM
@@ -1748,56 +1797,6 @@ config TEST_PARMAN
 
           If unsure, say N.
 
-endmenu # runtime tests
-
-config PROVIDE_OHCI1394_DMA_INIT
-        bool "Remote debugging over FireWire early on boot"
-        depends on PCI && X86
-        help
-          If you want to debug problems which hang or crash the kernel early
-          on boot and the crashing machine has a FireWire port, you can use
-          this feature to remotely access the memory of the crashed machine
-          over FireWire. This employs remote DMA as part of the OHCI1394
-          specification which is now the standard for FireWire controllers.
-
-          With remote DMA, you can monitor the printk buffer remotely using
-          firescope and access all memory below 4GB using fireproxy from gdb.
-          Even controlling a kernel debugger is possible using remote DMA.
-
-          Usage:
-
-          If ohci1394_dma=early is used as boot parameter, it will initialize
-          all OHCI1394 controllers which are found in the PCI config space.
-
-          As all changes to the FireWire bus such as enabling and disabling
-          devices cause a bus reset and thereby disable remote DMA for all
-          devices, be sure to have the cable plugged and FireWire enabled on
-          the debugging host before booting the debug target for debugging.
-
-          This code (~1k) is freed after boot. By then, the firewire stack
-          in charge of the OHCI-1394 controllers should be used instead.
-
-          See Documentation/debugging-via-ohci1394.txt for more information.
-
-config DMA_API_DEBUG
-        bool "Enable debugging of DMA-API usage"
-        depends on HAVE_DMA_API_DEBUG
-        help
-          Enable this option to debug the use of the DMA API by device drivers.
-          With this option you will be able to detect common bugs in device
-          drivers like double-freeing of DMA mappings or freeing mappings that
-          were never allocated.
-
-          This also attempts to catch cases where a page owned by DMA is
-          accessed by the cpu in a way that could cause data corruption.  For
-          example, this enables cow_user_page() to check that the source page is
-          not undergoing DMA.
-
-          This option causes a performance degradation.  Use only if you want to
-          debug device drivers and dma interactions.
-
-          If unsure, say N.
-
 config TEST_LKM
         tristate "Test module loading with 'hello world' module"
         default n
@@ -1872,18 +1871,6 @@ config TEST_UDELAY
 
           If unsure, say N.
 
-config MEMTEST
-        bool "Memtest"
-        depends on HAVE_MEMBLOCK
-        ---help---
-          This option adds a kernel parameter 'memtest', which allows memtest
-          to be set.
-                memtest=0, mean disabled; -- default
-                memtest=1, mean do 1 test pattern;
-                ...
-                memtest=17, mean do 17 test patterns.
-          If you are unsure how to answer this question, answer N.
-
 config TEST_STATIC_KEYS
         tristate "Test static keys"
         default n
@@ -1893,16 +1880,6 @@ config TEST_STATIC_KEYS
 
           If unsure, say N.
 
-config BUG_ON_DATA_CORRUPTION
-        bool "Trigger a BUG when data corruption is detected"
-        select DEBUG_LIST
-        help
-          Select this option if the kernel should BUG when it encounters
-          data corruption in kernel memory structures when they get checked
-          for validity.
-
-          If unsure, say N.
-
 config TEST_KMOD
         tristate "kmod stress tester"
         default n
@@ -1940,6 +1917,29 @@ config TEST_DEBUG_VIRTUAL
 
           If unsure, say N.
 
+endmenu # runtime tests
+
+config MEMTEST
+        bool "Memtest"
+        depends on HAVE_MEMBLOCK
+        ---help---
+          This option adds a kernel parameter 'memtest', which allows memtest
+          to be set.
+                memtest=0, mean disabled; -- default
+                memtest=1, mean do 1 test pattern;
+                ...
+                memtest=17, mean do 17 test patterns.
+          If you are unsure how to answer this question, answer N.
+
+config BUG_ON_DATA_CORRUPTION
+        bool "Trigger a BUG when data corruption is detected"
+        select DEBUG_LIST
+        help
+          Select this option if the kernel should BUG when it encounters
+          data corruption in kernel memory structures when they get checked
+          for validity.
+
+          If unsure, say N.
 
 source "samples/Kconfig"
 
diff --git a/lib/digsig.c b/lib/digsig.c
index 03d7c63837ae..6ba6fcd92dd1 100644
--- a/lib/digsig.c
+++ b/lib/digsig.c
@@ -87,6 +87,12 @@ static int digsig_verify_rsa(struct key *key,
         down_read(&key->sem);
         ukp = user_key_payload_locked(key);
 
+        if (!ukp) {
+                /* key was revoked before we acquired its semaphore */
+                err = -EKEYREVOKED;
+                goto err1;
+        }
+
         if (ukp->datalen < sizeof(*pkh))
                 goto err1;
 
diff --git a/lib/idr.c b/lib/idr.c
index f9adf4805fd7..edd9b2be1651 100644
--- a/lib/idr.c
+++ b/lib/idr.c
@@ -146,8 +146,8 @@ EXPORT_SYMBOL(idr_get_next_ext);
  * idr_alloc() and idr_remove() (as long as the ID being removed is not
  * the one being replaced!).
  *
- * Returns: 0 on success.  %-ENOENT indicates that @id was not found.
- * %-EINVAL indicates that @id or @ptr were not valid.
+ * Returns: the old value on success.  %-ENOENT indicates that @id was not
+ * found.  %-EINVAL indicates that @id or @ptr were not valid.
  */
 void *idr_replace(struct idr *idr, void *ptr, int id)
 {
diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index 52c8dd6d8e82..1c1c06ddc20a 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -687,8 +687,10 @@ EXPORT_SYMBOL(_copy_from_iter_full_nocache);
 
 static inline bool page_copy_sane(struct page *page, size_t offset, size_t n)
 {
-        size_t v = n + offset;
-        if (likely(n <= v && v <= (PAGE_SIZE << compound_order(page))))
+        struct page *head = compound_head(page);
+        size_t v = n + offset + page_address(page) - page_address(head);
+
+        if (likely(n <= v && v <= (PAGE_SIZE << compound_order(head))))
                 return true;
         WARN_ON(1);
         return false;
diff --git a/lib/kobject_uevent.c b/lib/kobject_uevent.c
index e590523ea476..f237a09a5862 100644
--- a/lib/kobject_uevent.c
+++ b/lib/kobject_uevent.c
@@ -294,6 +294,26 @@ static void cleanup_uevent_env(struct subprocess_info *info)
 }
 #endif
 
+static void zap_modalias_env(struct kobj_uevent_env *env)
+{
+        static const char modalias_prefix[] = "MODALIAS=";
+        int i;
+
+        for (i = 0; i < env->envp_idx;) {
+                if (strncmp(env->envp[i], modalias_prefix,
+                            sizeof(modalias_prefix) - 1)) {
+                        i++;
+                        continue;
+                }
+
+                if (i != env->envp_idx - 1)
+                        memmove(&env->envp[i], &env->envp[i + 1],
+                                sizeof(env->envp[i]) * env->envp_idx - 1);
+
+                env->envp_idx--;
+        }
+}
+
 /**
  * kobject_uevent_env - send an uevent with environmental data
  *
@@ -409,16 +429,29 @@ int kobject_uevent_env(struct kobject *kobj, enum kobject_action action,
                 }
         }
 
-        /*
-         * Mark "add" and "remove" events in the object to ensure proper
-         * events to userspace during automatic cleanup. If the object did
-         * send an "add" event, "remove" will automatically generated by
-         * the core, if not already done by the caller.
-         */
-        if (action == KOBJ_ADD)
+        switch (action) {
+        case KOBJ_ADD:
+                /*
+                 * Mark "add" event so we can make sure we deliver "remove"
+                 * event to userspace during automatic cleanup. If
+                 * the object did send an "add" event, "remove" will
+                 * automatically generated by the core, if not already done
+                 * by the caller.
+                 */
                 kobj->state_add_uevent_sent = 1;
-        else if (action == KOBJ_REMOVE)
+                break;
+
+        case KOBJ_REMOVE:
                 kobj->state_remove_uevent_sent = 1;
+                break;
+
+        case KOBJ_UNBIND:
+                zap_modalias_env(env);
+                break;
+
+        default:
+                break;
+        }
 
         mutex_lock(&uevent_sock_mutex);
         /* we will send an event, so request a new sequence number */
diff --git a/lib/locking-selftest.c b/lib/locking-selftest.c
index cd0b5c964bd0..2b827b8a1d8c 100644
--- a/lib/locking-selftest.c
+++ b/lib/locking-selftest.c
@@ -2031,11 +2031,13 @@ void locking_selftest(void)
         print_testname("mixed read-lock/lock-write ABBA");
         pr_cont("             |");
         dotest(rlock_ABBA1, FAILURE, LOCKTYPE_RWLOCK);
+#ifdef CONFIG_PROVE_LOCKING
         /*
          * Lockdep does indeed fail here, but there's nothing we can do about
          * that now.  Don't kill lockdep for it.
          */
         unexpected_testcase_failures--;
+#endif
 
         pr_cont("             |");
         dotest(rwsem_ABBA1, FAILURE, LOCKTYPE_RWSEM);
diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c
index bd3574312b82..141734d255e4 100644
--- a/lib/lz4/lz4_decompress.c
+++ b/lib/lz4/lz4_decompress.c
@@ -85,8 +85,8 @@ static FORCE_INLINE int LZ4_decompress_generic(
         const BYTE * const lowLimit = lowPrefix - dictSize;
 
         const BYTE * const dictEnd = (const BYTE *)dictStart + dictSize;
-        const unsigned int dec32table[] = { 0, 1, 2, 1, 4, 4, 4, 4 };
-        const int dec64table[] = { 0, 0, 0, -1, 0, 1, 2, 3 };
+        static const unsigned int dec32table[] = { 0, 1, 2, 1, 4, 4, 4, 4 };
+        static const int dec64table[] = { 0, 0, 0, -1, 0, 1, 2, 3 };
 
         const int safeDecode = (endOnInput == endOnInputSize);
         const int checkOffset = ((safeDecode) && (dictSize < (int)(64 * KB)));
diff --git a/lib/ratelimit.c b/lib/ratelimit.c
index 08f8043cac61..d01f47135239 100644
--- a/lib/ratelimit.c
+++ b/lib/ratelimit.c
@@ -48,7 +48,9 @@ int ___ratelimit(struct ratelimit_state *rs, const char *func)
         if (time_is_before_jiffies(rs->begin + rs->interval)) {
                 if (rs->missed) {
                         if (!(rs->flags & RATELIMIT_MSG_ON_RELEASE)) {
-                                pr_warn("%s: %d callbacks suppressed\n", func, rs->missed);
+                                printk_deferred(KERN_WARNING
+                                                "%s: %d callbacks suppressed\n",
+                                                func, rs->missed);
                                 rs->missed = 0;
                         }
                 }
diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index 707ca5d677c6..ddd7dde87c3c 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -735,9 +735,9 @@ EXPORT_SYMBOL_GPL(rhashtable_walk_exit);
  * rhashtable_walk_start - Start a hash table walk
  * @iter:       Hash table iterator
  *
- * Start a hash table walk.  Note that we take the RCU lock in all
- * cases including when we return an error.  So you must always call
- * rhashtable_walk_stop to clean up.
+ * Start a hash table walk at the current iterator position.  Note that we take
+ * the RCU lock in all cases including when we return an error.  So you must
+ * always call rhashtable_walk_stop to clean up.
  *
  * Returns zero if successful.
  *
@@ -846,7 +846,8 @@ EXPORT_SYMBOL_GPL(rhashtable_walk_next);
  * rhashtable_walk_stop - Finish a hash table walk
  * @iter:       Hash table iterator
  *
- * Finish a hash table walk.
+ * Finish a hash table walk.  Does not reset the iterator to the start of the
+ * hash table.
  */
 void rhashtable_walk_stop(struct rhashtable_iter *iter)
         __releases(RCU)
diff --git a/lib/ts_fsm.c b/lib/ts_fsm.c
index 5696a35184e4..69557c74ef9f 100644
--- a/lib/ts_fsm.c
+++ b/lib/ts_fsm.c
@@ -11,7 +11,7 @@
  * ==========================================================================
  *
  *   A finite state machine consists of n states (struct ts_fsm_token)
- *   representing the pattern as a finite automation. The data is read
+ *   representing the pattern as a finite automaton. The data is read
  *   sequentially on an octet basis. Every state token specifies the number
  *   of recurrences and the type of value accepted which can be either a
  *   specific character or ctype based set of characters. The available
diff --git a/lib/ts_kmp.c b/lib/ts_kmp.c
index 632f783e65f1..ffbe66cbb0ed 100644
--- a/lib/ts_kmp.c
+++ b/lib/ts_kmp.c
@@ -27,7 +27,7 @@
  *
  *   [1] Cormen, Leiserson, Rivest, Stein
  *       Introdcution to Algorithms, 2nd Edition, MIT Press
- *   [2] See finite automation theory
+ *   [2] See finite automaton theory
  */
 
 #include <linux/module.h>