12 files changed, 276 insertions, 205 deletions

diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 0d9e81779e37..7117ac61174e 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -219,6 +219,14 @@ config DEBUG_INFO_DWARF4
           But it significantly improves the success of resolving
           variables in gdb on optimized code.
 
+config DEBUG_INFO_BTF
+        bool "Generate BTF typeinfo"
+        depends on DEBUG_INFO
+        help
+          Generate deduplicated BTF type information from DWARF debug info.
+          Turning this on expects presence of pahole tool, which will convert
+          DWARF type info into equivalent deduplicated BTF type info.
+
 config GDB_SCRIPTS
         bool "Provide GDB scripts for kernel debugging"
         depends on DEBUG_INFO
@@ -753,9 +761,9 @@ endmenu # "Memory Debugging"
 config ARCH_HAS_KCOV
         bool
         help
-          KCOV does not have any arch-specific code, but currently it is enabled
-          only for x86_64. KCOV requires testing on other archs, and most likely
-          disabling of instrumentation for some early boot code.
+          An architecture should select this when it can successfully
+          build and run with CONFIG_KCOV. This typically requires
+          disabling instrumentation for some early boot code.
 
 config CC_HAS_SANCOV_TRACE_PC
         def_bool $(cc-option,-fsanitize-coverage=trace-pc)
diff --git a/lib/Makefile b/lib/Makefile
index 4e066120a0d6..3b08673e8881 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -213,7 +213,7 @@ KCOV_INSTRUMENT_stackdepot.o := n
 libfdt_files = fdt.o fdt_ro.o fdt_wip.o fdt_rw.o fdt_sw.o fdt_strerror.o \
                fdt_empty_tree.o
 $(foreach file, $(libfdt_files), \
-        $(eval CFLAGS_$(file) = -I$(src)/../scripts/dtc/libfdt))
+        $(eval CFLAGS_$(file) = -I $(srctree)/scripts/dtc/libfdt))
 lib-$(CONFIG_LIBFDT) += $(libfdt_files)
 
 obj-$(CONFIG_RBTREE_TEST) += rbtree_test.o
diff --git a/lib/iov_iter.c b/lib/iov_iter.c
index ea36dc355da1..b396d328a764 100644
--- a/lib/iov_iter.c
+++ b/lib/iov_iter.c
@@ -1528,6 +1528,7 @@ EXPORT_SYMBOL(csum_and_copy_to_iter);
 size_t hash_and_copy_to_iter(const void *addr, size_t bytes, void *hashp,
                 struct iov_iter *i)
 {
+#ifdef CONFIG_CRYPTO
         struct ahash_request *hash = hashp;
         struct scatterlist sg;
         size_t copied;
@@ -1537,6 +1538,9 @@ size_t hash_and_copy_to_iter(const void *addr, size_t bytes, void *hashp,
         ahash_request_set_crypt(hash, &sg, NULL, copied);
         crypto_ahash_update(hash);
         return copied;
+#else
+        return 0;
+#endif
 }
 EXPORT_SYMBOL(hash_and_copy_to_iter);
 
diff --git a/lib/lzo/lzo1x_compress.c b/lib/lzo/lzo1x_compress.c
index 4525fb094844..a8ede77afe0d 100644
--- a/lib/lzo/lzo1x_compress.c
+++ b/lib/lzo/lzo1x_compress.c
@@ -291,13 +291,14 @@ int lzogeneric1x_1_compress(const unsigned char *in, size_t in_len,
 {
         const unsigned char *ip = in;
         unsigned char *op = out;
+        unsigned char *data_start;
         size_t l = in_len;
         size_t t = 0;
         signed char state_offset = -2;
         unsigned int m4_max_offset;
 
-        // LZO v0 will never write 17 as first byte,
-        // so this is used to version the bitstream
+        // LZO v0 will never write 17 as first byte (except for zero-length
+        // input), so this is used to version the bitstream
         if (bitstream_version > 0) {
                 *op++ = 17;
                 *op++ = bitstream_version;
@@ -306,6 +307,8 @@ int lzogeneric1x_1_compress(const unsigned char *in, size_t in_len,
                 m4_max_offset = M4_MAX_OFFSET_V0;
         }
 
+        data_start = op;
+
         while (l > 20) {
                 size_t ll = l <= (m4_max_offset + 1) ? l : (m4_max_offset + 1);
                 uintptr_t ll_end = (uintptr_t) ip + ll;
@@ -324,7 +327,7 @@ int lzogeneric1x_1_compress(const unsigned char *in, size_t in_len,
         if (t > 0) {
                 const unsigned char *ii = in + in_len - t;
 
-                if (op == out && t <= 238) {
+                if (op == data_start && t <= 238) {
                         *op++ = (17 + t);
                 } else if (t <= 3) {
                         op[state_offset] |= t;
diff --git a/lib/lzo/lzo1x_decompress_safe.c b/lib/lzo/lzo1x_decompress_safe.c
index 6d2600ea3b55..9e07e9ef1aad 100644
--- a/lib/lzo/lzo1x_decompress_safe.c
+++ b/lib/lzo/lzo1x_decompress_safe.c
@@ -54,11 +54,9 @@ int lzo1x_decompress_safe(const unsigned char *in, size_t in_len,
         if (unlikely(in_len < 3))
                 goto input_overrun;
 
-        if (likely(*ip == 17)) {
+        if (likely(in_len >= 5) && likely(*ip == 17)) {
                 bitstream_version = ip[1];
                 ip += 2;
-                if (unlikely(in_len < 5))
-                        goto input_overrun;
         } else {
                 bitstream_version = 0;
         }
diff --git a/lib/nlattr.c b/lib/nlattr.c
index d26de6156b97..29f6336e2422 100644
--- a/lib/nlattr.c
+++ b/lib/nlattr.c
@@ -69,7 +69,8 @@ static int validate_nla_bitfield32(const struct nlattr *nla,
 
 static int nla_validate_array(const struct nlattr *head, int len, int maxtype,
                               const struct nla_policy *policy,
-                              struct netlink_ext_ack *extack)
+                              struct netlink_ext_ack *extack,
+                              unsigned int validate)
 {
         const struct nlattr *entry;
         int rem;
@@ -86,8 +87,8 @@ static int nla_validate_array(const struct nlattr *head, int len, int maxtype,
                         return -ERANGE;
                 }
 
-                ret = nla_validate(nla_data(entry), nla_len(entry),
-                                   maxtype, policy, extack);
+                ret = __nla_validate(nla_data(entry), nla_len(entry),
+                                     maxtype, policy, validate, extack);
                 if (ret < 0)
                         return ret;
         }
@@ -154,13 +155,17 @@ static int nla_validate_int_range(const struct nla_policy *pt,
 }
 
 static int validate_nla(const struct nlattr *nla, int maxtype,
-                        const struct nla_policy *policy,
+                        const struct nla_policy *policy, unsigned int validate,
                         struct netlink_ext_ack *extack)
 {
+        u16 strict_start_type = policy[0].strict_start_type;
         const struct nla_policy *pt;
         int minlen = 0, attrlen = nla_len(nla), type = nla_type(nla);
         int err = -ERANGE;
 
+        if (strict_start_type && type >= strict_start_type)
+                validate |= NL_VALIDATE_STRICT;
+
         if (type <= 0 || type > maxtype)
                 return 0;
 
@@ -172,6 +177,11 @@ static int validate_nla(const struct nlattr *nla, int maxtype,
             (pt->type == NLA_EXACT_LEN_WARN && attrlen != pt->len)) {
                 pr_warn_ratelimited("netlink: '%s': attribute type %d has an invalid length.\n",
                                     current->comm, type);
+                if (validate & NL_VALIDATE_STRICT_ATTRS) {
+                        NL_SET_ERR_MSG_ATTR(extack, nla,
+                                            "invalid attribute length");
+                        return -EINVAL;
+                }
         }
 
         switch (pt->type) {
@@ -244,8 +254,9 @@ static int validate_nla(const struct nlattr *nla, int maxtype,
                 if (attrlen < NLA_HDRLEN)
                         goto out_err;
                 if (pt->validation_data) {
-                        err = nla_validate(nla_data(nla), nla_len(nla), pt->len,
-                                           pt->validation_data, extack);
+                        err = __nla_validate(nla_data(nla), nla_len(nla), pt->len,
+                                             pt->validation_data, validate,
+                                             extack);
                         if (err < 0) {
                                 /*
                                  * return directly to preserve the inner
@@ -268,7 +279,7 @@ static int validate_nla(const struct nlattr *nla, int maxtype,
 
                         err = nla_validate_array(nla_data(nla), nla_len(nla),
                                                  pt->len, pt->validation_data,
-                                                 extack);
+                                                 extack, validate);
                         if (err < 0) {
                                 /*
                                  * return directly to preserve the inner
@@ -278,10 +289,23 @@ static int validate_nla(const struct nlattr *nla, int maxtype,
                         }
                 }
                 break;
+
+        case NLA_UNSPEC:
+                if (validate & NL_VALIDATE_UNSPEC) {
+                        NL_SET_ERR_MSG_ATTR(extack, nla,
+                                            "Unsupported attribute");
+                        return -EINVAL;
+                }
+                /* fall through */
+        case NLA_MIN_LEN:
+                if (attrlen < pt->len)
+                        goto out_err;
+                break;
+
         default:
                 if (pt->len)
                         minlen = pt->len;
-                else if (pt->type != NLA_UNSPEC)
+                else
                         minlen = nla_attr_minlen[pt->type];
 
                 if (attrlen < minlen)
@@ -315,37 +339,75 @@ out_err:
         return err;
 }
 
+static int __nla_validate_parse(const struct nlattr *head, int len, int maxtype,
+                                const struct nla_policy *policy,
+                                unsigned int validate,
+                                struct netlink_ext_ack *extack,
+                                struct nlattr **tb)
+{
+        const struct nlattr *nla;
+        int rem;
+
+        if (tb)
+                memset(tb, 0, sizeof(struct nlattr *) * (maxtype + 1));
+
+        nla_for_each_attr(nla, head, len, rem) {
+                u16 type = nla_type(nla);
+
+                if (type == 0 || type > maxtype) {
+                        if (validate & NL_VALIDATE_MAXTYPE) {
+                                NL_SET_ERR_MSG(extack, "Unknown attribute type");
+                                return -EINVAL;
+                        }
+                        continue;
+                }
+                if (policy) {
+                        int err = validate_nla(nla, maxtype, policy,
+                                               validate, extack);
+
+                        if (err < 0)
+                                return err;
+                }
+
+                if (tb)
+                        tb[type] = (struct nlattr *)nla;
+        }
+
+        if (unlikely(rem > 0)) {
+                pr_warn_ratelimited("netlink: %d bytes leftover after parsing attributes in process `%s'.\n",
+                                    rem, current->comm);
+                NL_SET_ERR_MSG(extack, "bytes leftover after parsing attributes");
+                if (validate & NL_VALIDATE_TRAILING)
+                        return -EINVAL;
+        }
+
+        return 0;
+}
+
 /**
- * nla_validate - Validate a stream of attributes
+ * __nla_validate - Validate a stream of attributes
  * @head: head of attribute stream
  * @len: length of attribute stream
  * @maxtype: maximum attribute type to be expected
  * @policy: validation policy
+ * @validate: validation strictness
  * @extack: extended ACK report struct
  *
  * Validates all attributes in the specified attribute stream against the
- * specified policy. Attributes with a type exceeding maxtype will be
- * ignored. See documenation of struct nla_policy for more details.
+ * specified policy. Validation depends on the validate flags passed, see
+ * &enum netlink_validation for more details on that.
+ * See documenation of struct nla_policy for more details.
  *
  * Returns 0 on success or a negative error code.
  */
-int nla_validate(const struct nlattr *head, int len, int maxtype,
-                 const struct nla_policy *policy,
-                 struct netlink_ext_ack *extack)
+int __nla_validate(const struct nlattr *head, int len, int maxtype,
+                   const struct nla_policy *policy, unsigned int validate,
+                   struct netlink_ext_ack *extack)
 {
-        const struct nlattr *nla;
-        int rem;
-
-        nla_for_each_attr(nla, head, len, rem) {
-                int err = validate_nla(nla, maxtype, policy, extack);
-
-                if (err < 0)
-                        return err;
-        }
-
-        return 0;
+        return __nla_validate_parse(head, len, maxtype, policy, validate,
+                                    extack, NULL);
 }
-EXPORT_SYMBOL(nla_validate);
+EXPORT_SYMBOL(__nla_validate);
 
 /**
  * nla_policy_len - Determin the max. length of a policy
@@ -377,76 +439,30 @@ nla_policy_len(const struct nla_policy *p, int n)
 EXPORT_SYMBOL(nla_policy_len);
 
 /**
- * nla_parse - Parse a stream of attributes into a tb buffer
+ * __nla_parse - Parse a stream of attributes into a tb buffer
  * @tb: destination array with maxtype+1 elements
  * @maxtype: maximum attribute type to be expected
  * @head: head of attribute stream
  * @len: length of attribute stream
  * @policy: validation policy
+ * @validate: validation strictness
+ * @extack: extended ACK pointer
  *
  * Parses a stream of attributes and stores a pointer to each attribute in
- * the tb array accessible via the attribute type. Attributes with a type
- * exceeding maxtype will be silently ignored for backwards compatibility
- * reasons. policy may be set to NULL if no validation is required.
+ * the tb array accessible via the attribute type.
+ * Validation is controlled by the @validate parameter.
  *
  * Returns 0 on success or a negative error code.
  */
-static int __nla_parse(struct nlattr **tb, int maxtype,
-                       const struct nlattr *head, int len,
-                       bool strict, const struct nla_policy *policy,
-                       struct netlink_ext_ack *extack)
-{
-        const struct nlattr *nla;
-        int rem;
-
-        memset(tb, 0, sizeof(struct nlattr *) * (maxtype + 1));
-
-        nla_for_each_attr(nla, head, len, rem) {
-                u16 type = nla_type(nla);
-
-                if (type == 0 || type > maxtype) {
-                        if (strict) {
-                                NL_SET_ERR_MSG(extack, "Unknown attribute type");
-                                return -EINVAL;
-                        }
-                        continue;
-                }
-                if (policy) {
-                        int err = validate_nla(nla, maxtype, policy, extack);
-
-                        if (err < 0)
-                                return err;
-                }
-
-                tb[type] = (struct nlattr *)nla;
-        }
-
-        if (unlikely(rem > 0)) {
-                pr_warn_ratelimited("netlink: %d bytes leftover after parsing attributes in process `%s'.\n",
-                                    rem, current->comm);
-                NL_SET_ERR_MSG(extack, "bytes leftover after parsing attributes");
-                if (strict)
-                        return -EINVAL;
-        }
-
-        return 0;
-}
-
-int nla_parse(struct nlattr **tb, int maxtype, const struct nlattr *head,
-              int len, const struct nla_policy *policy,
-              struct netlink_ext_ack *extack)
-{
-        return __nla_parse(tb, maxtype, head, len, false, policy, extack);
-}
-EXPORT_SYMBOL(nla_parse);
-
-int nla_parse_strict(struct nlattr **tb, int maxtype, const struct nlattr *head,
-                     int len, const struct nla_policy *policy,
-                     struct netlink_ext_ack *extack)
+int __nla_parse(struct nlattr **tb, int maxtype,
+                const struct nlattr *head, int len,
+                const struct nla_policy *policy, unsigned int validate,
+                struct netlink_ext_ack *extack)
 {
-        return __nla_parse(tb, maxtype, head, len, true, policy, extack);
+        return __nla_validate_parse(head, len, maxtype, policy, validate,
+                                    extack, tb);
 }
-EXPORT_SYMBOL(nla_parse_strict);
+EXPORT_SYMBOL(__nla_parse);
 
 /**
  * nla_find - Find a specific attribute in a stream of attributes
diff --git a/lib/raid6/Makefile b/lib/raid6/Makefile
index 4e90d443d1b0..e723eacf7868 100644
--- a/lib/raid6/Makefile
+++ b/lib/raid6/Makefile
@@ -39,7 +39,7 @@ endif
 ifeq ($(CONFIG_KERNEL_MODE_NEON),y)
 NEON_FLAGS := -ffreestanding
 ifeq ($(ARCH),arm)
-NEON_FLAGS += -mfloat-abi=softfp -mfpu=neon
+NEON_FLAGS += -march=armv7-a -mfloat-abi=softfp -mfpu=neon
 endif
 CFLAGS_recov_neon_inner.o += $(NEON_FLAGS)
 ifeq ($(ARCH),arm64)
diff --git a/lib/rhashtable.c b/lib/rhashtable.c
index f65e43fb1ff8..6529fe1b45c1 100644
--- a/lib/rhashtable.c
+++ b/lib/rhashtable.c
@@ -31,11 +31,10 @@
 
 #define HASH_DEFAULT_SIZE       64UL
 #define HASH_MIN_SIZE           4U
-#define BUCKET_LOCKS_PER_CPU    32UL
 
 union nested_table {
         union nested_table __rcu *table;
-        struct rhash_head __rcu *bucket;
+        struct rhash_lock_head __rcu *bucket;
 };
 
 static u32 head_hashfn(struct rhashtable *ht,
@@ -56,9 +55,11 @@ EXPORT_SYMBOL_GPL(lockdep_rht_mutex_is_held);
 
 int lockdep_rht_bucket_is_held(const struct bucket_table *tbl, u32 hash)
 {
-        spinlock_t *lock = rht_bucket_lock(tbl, hash);
-
-        return (debug_locks) ? lockdep_is_held(lock) : 1;
+        if (!debug_locks)
+                return 1;
+        if (unlikely(tbl->nest))
+                return 1;
+        return bit_spin_is_locked(0, (unsigned long *)&tbl->buckets[hash]);
 }
 EXPORT_SYMBOL_GPL(lockdep_rht_bucket_is_held);
 #else
@@ -104,7 +105,6 @@ static void bucket_table_free(const struct bucket_table *tbl)
         if (tbl->nest)
                 nested_bucket_table_free(tbl);
 
-        free_bucket_spinlocks(tbl->locks);
         kvfree(tbl);
 }
 
@@ -131,9 +131,11 @@ static union nested_table *nested_table_alloc(struct rhashtable *ht,
                         INIT_RHT_NULLS_HEAD(ntbl[i].bucket);
         }
 
-        rcu_assign_pointer(*prev, ntbl);
-
-        return ntbl;
+        if (cmpxchg(prev, NULL, ntbl) == NULL)
+                return ntbl;
+        /* Raced with another thread. */
+        kfree(ntbl);
+        return rcu_dereference(*prev);
 }
 
 static struct bucket_table *nested_bucket_table_alloc(struct rhashtable *ht,
@@ -169,11 +171,11 @@ static struct bucket_table *bucket_table_alloc(struct rhashtable *ht,
                                                gfp_t gfp)
 {
         struct bucket_table *tbl = NULL;
-        size_t size, max_locks;
+        size_t size;
         int i;
+        static struct lock_class_key __key;
 
-        size = sizeof(*tbl) + nbuckets * sizeof(tbl->buckets[0]);
-        tbl = kvzalloc(size, gfp);
+        tbl = kvzalloc(struct_size(tbl, buckets, nbuckets), gfp);
 
         size = nbuckets;
 
@@ -185,17 +187,9 @@ static struct bucket_table *bucket_table_alloc(struct rhashtable *ht,
         if (tbl == NULL)
                 return NULL;
 
-        tbl->size = size;
-
-        max_locks = size >> 1;
-        if (tbl->nest)
-                max_locks = min_t(size_t, max_locks, 1U << tbl->nest);
+        lockdep_init_map(&tbl->dep_map, "rhashtable_bucket", &__key, 0);
 
-        if (alloc_bucket_spinlocks(&tbl->locks, &tbl->locks_mask, max_locks,
-                                   ht->p.locks_mul, gfp) < 0) {
-                bucket_table_free(tbl);
-                return NULL;
-        }
+        tbl->size = size;
 
         rcu_head_init(&tbl->rcu);
         INIT_LIST_HEAD(&tbl->walkers);
@@ -221,14 +215,15 @@ static struct bucket_table *rhashtable_last_table(struct rhashtable *ht,
         return new_tbl;
 }
 
-static int rhashtable_rehash_one(struct rhashtable *ht, unsigned int old_hash)
+static int rhashtable_rehash_one(struct rhashtable *ht,
+                                 struct rhash_lock_head __rcu **bkt,
+                                 unsigned int old_hash)
 {
         struct bucket_table *old_tbl = rht_dereference(ht->tbl, ht);
         struct bucket_table *new_tbl = rhashtable_last_table(ht, old_tbl);
-        struct rhash_head __rcu **pprev = rht_bucket_var(old_tbl, old_hash);
         int err = -EAGAIN;
         struct rhash_head *head, *next, *entry;
-        spinlock_t *new_bucket_lock;
+        struct rhash_head __rcu **pprev = NULL;
         unsigned int new_hash;
 
         if (new_tbl->nest)
@@ -236,7 +231,8 @@ static int rhashtable_rehash_one(struct rhashtable *ht, unsigned int old_hash)
 
         err = -ENOENT;
 
-        rht_for_each(entry, old_tbl, old_hash) {
+        rht_for_each_from(entry, rht_ptr(bkt, old_tbl, old_hash),
+                          old_tbl, old_hash) {
                 err = 0;
                 next = rht_dereference_bucket(entry->next, old_tbl, old_hash);
 
@@ -251,18 +247,19 @@ static int rhashtable_rehash_one(struct rhashtable *ht, unsigned int old_hash)
 
         new_hash = head_hashfn(ht, new_tbl, entry);
 
-        new_bucket_lock = rht_bucket_lock(new_tbl, new_hash);
+        rht_lock_nested(new_tbl, &new_tbl->buckets[new_hash], SINGLE_DEPTH_NESTING);
 
-        spin_lock_nested(new_bucket_lock, SINGLE_DEPTH_NESTING);
-        head = rht_dereference_bucket(new_tbl->buckets[new_hash],
-                                      new_tbl, new_hash);
+        head = rht_ptr(new_tbl->buckets + new_hash, new_tbl, new_hash);
 
         RCU_INIT_POINTER(entry->next, head);
 
-        rcu_assign_pointer(new_tbl->buckets[new_hash], entry);
-        spin_unlock(new_bucket_lock);
+        rht_assign_unlock(new_tbl, &new_tbl->buckets[new_hash], entry);
 
-        rcu_assign_pointer(*pprev, next);
+        if (pprev)
+                rcu_assign_pointer(*pprev, next);
+        else
+                /* Need to preserved the bit lock. */
+                rht_assign_locked(bkt, next);
 
 out:
         return err;
@@ -272,19 +269,19 @@ static int rhashtable_rehash_chain(struct rhashtable *ht,
                                     unsigned int old_hash)
 {
         struct bucket_table *old_tbl = rht_dereference(ht->tbl, ht);
-        spinlock_t *old_bucket_lock;
+        struct rhash_lock_head __rcu **bkt = rht_bucket_var(old_tbl, old_hash);
         int err;
 
-        old_bucket_lock = rht_bucket_lock(old_tbl, old_hash);
+        if (!bkt)
+                return 0;
+        rht_lock(old_tbl, bkt);
 
-        spin_lock_bh(old_bucket_lock);
-        while (!(err = rhashtable_rehash_one(ht, old_hash)))
+        while (!(err = rhashtable_rehash_one(ht, bkt, old_hash)))
                 ;
 
         if (err == -ENOENT)
                 err = 0;
-
-        spin_unlock_bh(old_bucket_lock);
+        rht_unlock(old_tbl, bkt);
 
         return err;
 }
@@ -419,8 +416,12 @@ static void rht_deferred_worker(struct work_struct *work)
         else if (tbl->nest)
                 err = rhashtable_rehash_alloc(ht, tbl, tbl->size);
 
-        if (!err)
-                err = rhashtable_rehash_table(ht);
+        if (!err || err == -EEXIST) {
+                int nerr;
+
+                nerr = rhashtable_rehash_table(ht);
+                err = err ?: nerr;
+        }
 
         mutex_unlock(&ht->mutex);
 
@@ -477,6 +478,7 @@ fail:
 }
 
 static void *rhashtable_lookup_one(struct rhashtable *ht,
+                                   struct rhash_lock_head __rcu **bkt,
                                    struct bucket_table *tbl, unsigned int hash,
                                    const void *key, struct rhash_head *obj)
 {
@@ -484,13 +486,12 @@ static void *rhashtable_lookup_one(struct rhashtable *ht,
                 .ht = ht,
                 .key = key,
         };
-        struct rhash_head __rcu **pprev;
+        struct rhash_head __rcu **pprev = NULL;
         struct rhash_head *head;
         int elasticity;
 
         elasticity = RHT_ELASTICITY;
-        pprev = rht_bucket_var(tbl, hash);
-        rht_for_each_from(head, *pprev, tbl, hash) {
+        rht_for_each_from(head, rht_ptr(bkt, tbl, hash), tbl, hash) {
                 struct rhlist_head *list;
                 struct rhlist_head *plist;
 
@@ -512,7 +513,11 @@ static void *rhashtable_lookup_one(struct rhashtable *ht,
                 RCU_INIT_POINTER(list->next, plist);
                 head = rht_dereference_bucket(head->next, tbl, hash);
                 RCU_INIT_POINTER(list->rhead.next, head);
-                rcu_assign_pointer(*pprev, obj);
+                if (pprev)
+                        rcu_assign_pointer(*pprev, obj);
+                else
+                        /* Need to preserve the bit lock */
+                        rht_assign_locked(bkt, obj);
 
                 return NULL;
         }
@@ -524,12 +529,12 @@ static void *rhashtable_lookup_one(struct rhashtable *ht,
 }
 
 static struct bucket_table *rhashtable_insert_one(struct rhashtable *ht,
+                                                  struct rhash_lock_head __rcu **bkt,
                                                   struct bucket_table *tbl,
                                                   unsigned int hash,
                                                   struct rhash_head *obj,
                                                   void *data)
 {
-        struct rhash_head __rcu **pprev;
         struct bucket_table *new_tbl;
         struct rhash_head *head;
 
@@ -552,11 +557,7 @@ static struct bucket_table *rhashtable_insert_one(struct rhashtable *ht,
         if (unlikely(rht_grow_above_100(ht, tbl)))
                 return ERR_PTR(-EAGAIN);
 
-        pprev = rht_bucket_insert(ht, tbl, hash);
-        if (!pprev)
-                return ERR_PTR(-ENOMEM);
-
-        head = rht_dereference_bucket(*pprev, tbl, hash);
+        head = rht_ptr(bkt, tbl, hash);
 
         RCU_INIT_POINTER(obj->next, head);
         if (ht->rhlist) {
@@ -566,7 +567,10 @@ static struct bucket_table *rhashtable_insert_one(struct rhashtable *ht,
                 RCU_INIT_POINTER(list->next, NULL);
         }
 
-        rcu_assign_pointer(*pprev, obj);
+        /* bkt is always the head of the list, so it holds
+         * the lock, which we need to preserve
+         */
+        rht_assign_locked(bkt, obj);
 
         atomic_inc(&ht->nelems);
         if (rht_grow_above_75(ht, tbl))
@@ -580,6 +584,7 @@ static void *rhashtable_try_insert(struct rhashtable *ht, const void *key,
 {
         struct bucket_table *new_tbl;
         struct bucket_table *tbl;
+        struct rhash_lock_head __rcu **bkt;
         unsigned int hash;
         void *data;
 
@@ -588,14 +593,25 @@ static void *rhashtable_try_insert(struct rhashtable *ht, const void *key,
         do {
                 tbl = new_tbl;
                 hash = rht_head_hashfn(ht, tbl, obj, ht->p);
-                spin_lock_bh(rht_bucket_lock(tbl, hash));
-
-                data = rhashtable_lookup_one(ht, tbl, hash, key, obj);
-                new_tbl = rhashtable_insert_one(ht, tbl, hash, obj, data);
-                if (PTR_ERR(new_tbl) != -EEXIST)
-                        data = ERR_CAST(new_tbl);
-
-                spin_unlock_bh(rht_bucket_lock(tbl, hash));
+                if (rcu_access_pointer(tbl->future_tbl))
+                        /* Failure is OK */
+                        bkt = rht_bucket_var(tbl, hash);
+                else
+                        bkt = rht_bucket_insert(ht, tbl, hash);
+                if (bkt == NULL) {
+                        new_tbl = rht_dereference_rcu(tbl->future_tbl, ht);
+                        data = ERR_PTR(-EAGAIN);
+                } else {
+                        rht_lock(tbl, bkt);
+                        data = rhashtable_lookup_one(ht, bkt, tbl,
+                                                     hash, key, obj);
+                        new_tbl = rhashtable_insert_one(ht, bkt, tbl,
+                                                        hash, obj, data);
+                        if (PTR_ERR(new_tbl) != -EEXIST)
+                                data = ERR_CAST(new_tbl);
+
+                        rht_unlock(tbl, bkt);
+                }
         } while (!IS_ERR_OR_NULL(new_tbl));
 
         if (PTR_ERR(data) == -EAGAIN)
@@ -1022,11 +1038,6 @@ int rhashtable_init(struct rhashtable *ht,
 
         size = rounded_hashtable_size(&ht->p);
 
-        if (params->locks_mul)
-                ht->p.locks_mul = roundup_pow_of_two(params->locks_mul);
-        else
-                ht->p.locks_mul = BUCKET_LOCKS_PER_CPU;
-
         ht->key_len = ht->p.key_len;
         if (!params->hashfn) {
                 ht->p.hashfn = jhash;
@@ -1128,7 +1139,7 @@ restart:
                         struct rhash_head *pos, *next;
 
                         cond_resched();
-                        for (pos = rht_dereference(*rht_bucket(tbl, i), ht),
+                        for (pos = rht_ptr_exclusive(rht_bucket(tbl, i)),
                              next = !rht_is_a_nulls(pos) ?
                                         rht_dereference(pos->next, ht) : NULL;
                              !rht_is_a_nulls(pos);
@@ -1155,11 +1166,10 @@ void rhashtable_destroy(struct rhashtable *ht)
 }
 EXPORT_SYMBOL_GPL(rhashtable_destroy);
 
-struct rhash_head __rcu **rht_bucket_nested(const struct bucket_table *tbl,
-                                            unsigned int hash)
+struct rhash_lock_head __rcu **__rht_bucket_nested(const struct bucket_table *tbl,
+                                                   unsigned int hash)
 {
         const unsigned int shift = PAGE_SHIFT - ilog2(sizeof(void *));
-        static struct rhash_head __rcu *rhnull;
         unsigned int index = hash & ((1 << tbl->nest) - 1);
         unsigned int size = tbl->size >> tbl->nest;
         unsigned int subhash = hash;
@@ -1177,20 +1187,28 @@ struct rhash_head __rcu **rht_bucket_nested(const struct bucket_table *tbl,
                 subhash >>= shift;
         }
 
-        if (!ntbl) {
-                if (!rhnull)
-                        INIT_RHT_NULLS_HEAD(rhnull);
-                return &rhnull;
-        }
+        if (!ntbl)
+                return NULL;
 
         return &ntbl[subhash].bucket;
 
 }
+EXPORT_SYMBOL_GPL(__rht_bucket_nested);
+
+struct rhash_lock_head __rcu **rht_bucket_nested(const struct bucket_table *tbl,
+                                                 unsigned int hash)
+{
+        static struct rhash_lock_head __rcu *rhnull;
+
+        if (!rhnull)
+                INIT_RHT_NULLS_HEAD(rhnull);
+        return __rht_bucket_nested(tbl, hash) ?: &rhnull;
+}
 EXPORT_SYMBOL_GPL(rht_bucket_nested);
 
-struct rhash_head __rcu **rht_bucket_nested_insert(struct rhashtable *ht,
-                                                   struct bucket_table *tbl,
-                                                   unsigned int hash)
+struct rhash_lock_head __rcu **rht_bucket_nested_insert(struct rhashtable *ht,
+                                                        struct bucket_table *tbl,
+                                                        unsigned int hash)
 {
         const unsigned int shift = PAGE_SHIFT - ilog2(sizeof(void *));
         unsigned int index = hash & ((1 << tbl->nest) - 1);
diff --git a/lib/sbitmap.c b/lib/sbitmap.c
index 5b382c1244ed..155fe38756ec 100644
--- a/lib/sbitmap.c
+++ b/lib/sbitmap.c
@@ -591,6 +591,17 @@ EXPORT_SYMBOL_GPL(sbitmap_queue_wake_up);
 void sbitmap_queue_clear(struct sbitmap_queue *sbq, unsigned int nr,
                          unsigned int cpu)
 {
+        /*
+         * Once the clear bit is set, the bit may be allocated out.
+         *
+         * Orders READ/WRITE on the asssociated instance(such as request
+         * of blk_mq) by this bit for avoiding race with re-allocation,
+         * and its pair is the memory barrier implied in __sbitmap_get_word.
+         *
+         * One invariant is that the clear bit has to be zero when the bit
+         * is in use.
+         */
+        smp_mb__before_atomic();
         sbitmap_deferred_clear_bit(&sbq->sb, nr);
 
         /*
diff --git a/lib/string.c b/lib/string.c
index 38e4ca08e757..3ab861c1a857 100644
--- a/lib/string.c
+++ b/lib/string.c
@@ -866,6 +866,26 @@ __visible int memcmp(const void *cs, const void *ct, size_t count)
 EXPORT_SYMBOL(memcmp);
 #endif
 
+#ifndef __HAVE_ARCH_BCMP
+/**
+ * bcmp - returns 0 if and only if the buffers have identical contents.
+ * @a: pointer to first buffer.
+ * @b: pointer to second buffer.
+ * @len: size of buffers.
+ *
+ * The sign or magnitude of a non-zero return value has no particular
+ * meaning, and architectures may implement their own more efficient bcmp(). So
+ * while this particular implementation is a simple (tail) call to memcmp, do
+ * not rely on anything but whether the return value is zero or non-zero.
+ */
+#undef bcmp
+int bcmp(const void *a, const void *b, size_t len)
+{
+        return memcmp(a, b, len);
+}
+EXPORT_SYMBOL(bcmp);
+#endif
+
 #ifndef __HAVE_ARCH_MEMSCAN
 /**
  * memscan - Find a character in an area of memory.
diff --git a/lib/syscall.c b/lib/syscall.c
index 1a7077f20eae..fb328e7ccb08 100644
--- a/lib/syscall.c
+++ b/lib/syscall.c
@@ -5,16 +5,14 @@
 #include <linux/export.h>
 #include <asm/syscall.h>
 
-static int collect_syscall(struct task_struct *target, long *callno,
-                           unsigned long args[6], unsigned int maxargs,
-                           unsigned long *sp, unsigned long *pc)
+static int collect_syscall(struct task_struct *target, struct syscall_info *info)
 {
         struct pt_regs *regs;
 
         if (!try_get_task_stack(target)) {
                 /* Task has no stack, so the task isn't in a syscall. */
-                *sp = *pc = 0;
-                *callno = -1;
+                memset(info, 0, sizeof(*info));
+                info->data.nr = -1;
                 return 0;
         }
 
@@ -24,12 +22,13 @@ static int collect_syscall(struct task_struct *target, long *callno,
                 return -EAGAIN;
         }
 
-        *sp = user_stack_pointer(regs);
-        *pc = instruction_pointer(regs);
+        info->sp = user_stack_pointer(regs);
+        info->data.instruction_pointer = instruction_pointer(regs);
 
-        *callno = syscall_get_nr(target, regs);
-        if (*callno != -1L && maxargs > 0)
-                syscall_get_arguments(target, regs, 0, maxargs, args);
+        info->data.nr = syscall_get_nr(target, regs);
+        if (info->data.nr != -1L)
+                syscall_get_arguments(target, regs,
+                                      (unsigned long *)&info->data.args[0]);
 
         put_task_stack(target);
         return 0;
@@ -38,41 +37,35 @@ static int collect_syscall(struct task_struct *target, long *callno,
 /**
  * task_current_syscall - Discover what a blocked task is doing.
  * @target:             thread to examine
- * @callno:             filled with system call number or -1
- * @args:               filled with @maxargs system call arguments
- * @maxargs:            number of elements in @args to fill
- * @sp:                 filled with user stack pointer
- * @pc:                 filled with user PC
+ * @info:               structure with the following fields:
+ *                       .sp        - filled with user stack pointer
+ *                       .data.nr   - filled with system call number or -1
+ *                       .data.args - filled with @maxargs system call arguments
+ *                       .data.instruction_pointer - filled with user PC
  *
- * If @target is blocked in a system call, returns zero with *@callno
- * set to the the call's number and @args filled in with its arguments.
- * Registers not used for system call arguments may not be available and
- * it is not kosher to use &struct user_regset calls while the system
+ * If @target is blocked in a system call, returns zero with @info.data.nr
+ * set to the the call's number and @info.data.args filled in with its
+ * arguments. Registers not used for system call arguments may not be available
+ * and it is not kosher to use &struct user_regset calls while the system
  * call is still in progress.  Note we may get this result if @target
  * has finished its system call but not yet returned to user mode, such
  * as when it's stopped for signal handling or syscall exit tracing.
  *
  * If @target is blocked in the kernel during a fault or exception,
- * returns zero with *@callno set to -1 and does not fill in @args.
- * If so, it's now safe to examine @target using &struct user_regset
- * get() calls as long as we're sure @target won't return to user mode.
+ * returns zero with *@info.data.nr set to -1 and does not fill in
+ * @info.data.args. If so, it's now safe to examine @target using
+ * &struct user_regset get() calls as long as we're sure @target won't return
+ * to user mode.
  *
  * Returns -%EAGAIN if @target does not remain blocked.
- *
- * Returns -%EINVAL if @maxargs is too large (maximum is six).
  */
-int task_current_syscall(struct task_struct *target, long *callno,
-                         unsigned long args[6], unsigned int maxargs,
-                         unsigned long *sp, unsigned long *pc)
+int task_current_syscall(struct task_struct *target, struct syscall_info *info)
 {
         long state;
         unsigned long ncsw;
 
-        if (unlikely(maxargs > 6))
-                return -EINVAL;
-
         if (target == current)
-                return collect_syscall(target, callno, args, maxargs, sp, pc);
+                return collect_syscall(target, info);
 
         state = target->state;
         if (unlikely(!state))
@@ -80,7 +73,7 @@ int task_current_syscall(struct task_struct *target, long *callno,
 
         ncsw = wait_task_inactive(target, state);
         if (unlikely(!ncsw) ||
-            unlikely(collect_syscall(target, callno, args, maxargs, sp, pc)) ||
+            unlikely(collect_syscall(target, info)) ||
             unlikely(wait_task_inactive(target, state) != ncsw))
                 return -EAGAIN;
 
diff --git a/lib/test_rhashtable.c b/lib/test_rhashtable.c
index 3bd2e91bfc29..084fe5a6ac57 100644
--- a/lib/test_rhashtable.c
+++ b/lib/test_rhashtable.c
@@ -500,7 +500,7 @@ static unsigned int __init print_ht(struct rhltable *rhlt)
                 struct rhash_head *pos, *next;
                 struct test_obj_rhl *p;
 
-                pos = rht_dereference(tbl->buckets[i], ht);
+                pos = rht_ptr_exclusive(tbl->buckets + i);
                 next = !rht_is_a_nulls(pos) ? rht_dereference(pos->next, ht) : NULL;
 
                 if (!rht_is_a_nulls(pos)) {