Merge tag 'v3.18' into drm-next

Linux 3.18

Backmerge Linus tree into -next as we had conflicts in i915/radeon/nouveau,
and everyone was solving them individually.

* tag 'v3.18': (57 commits)
  Linux 3.18
  watchdog: s3c2410_wdt: Fix the mask bit offset for Exynos7
  uapi: fix to export linux/vm_sockets.h
  i2c: cadence: Set the hardware time-out register to maximum value
  i2c: davinci: generate STP always when NACK is received
  ahci: disable MSI on SAMSUNG 0xa800 SSD
  context_tracking: Restore previous state in schedule_user
  slab: fix nodeid bounds check for non-contiguous node IDs
  lib/genalloc.c: export devm_gen_pool_create() for modules
  mm: fix anon_vma_clone() error treatment
  mm: fix swapoff hang after page migration and fork
  fat: fix oops on corrupted vfat fs
  ipc/sem.c: fully initialize sem_array before making it visible
  drivers/input/evdev.c: don't kfree() a vmalloc address
  cxgb4: Fill in supported link mode for SFP modules
  xen-netfront: Remove BUGs on paged skb data which crosses a page boundary
  mm/vmpressure.c: fix race in vmpressure_work_fn()
  mm: frontswap: invalidate expired data on a dup-store failure
  mm: do not overwrite reserved pages counter at show_mem()
  drm/radeon: kernel panic in drm_calc_vbltimestamp_from_scanoutpos with 3.18.0-rc6
  ...

Conflicts:
	drivers/gpu/drm/i915/intel_display.c
	drivers/gpu/drm/nouveau/nouveau_drm.c
	drivers/gpu/drm/radeon/radeon_cs.c

60 files changed, 356 insertions, 268 deletions

diff --git a/MAINTAINERS b/MAINTAINERS
index 55d3e9b93338..296c02d39c29 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -1838,7 +1838,7 @@ F:	include/net/ax25.h
 F:      net/ax25/
 
 AZ6007 DVB DRIVER
-M:      Mauro Carvalho Chehab <m.chehab@samsung.com>
+M:      Mauro Carvalho Chehab <mchehab@osg.samsung.com>
 L:      linux-media@vger.kernel.org
 W:      http://linuxtv.org
 T:      git git://linuxtv.org/media_tree.git
@@ -2208,7 +2208,7 @@ F:	Documentation/filesystems/btrfs.txt
 F:      fs/btrfs/
 
 BTTV VIDEO4LINUX DRIVER
-M:      Mauro Carvalho Chehab <m.chehab@samsung.com>
+M:      Mauro Carvalho Chehab <mchehab@osg.samsung.com>
 L:      linux-media@vger.kernel.org
 W:      http://linuxtv.org
 T:      git git://linuxtv.org/media_tree.git
@@ -2729,7 +2729,7 @@ F:	drivers/media/common/cx2341x*
 F:      include/media/cx2341x*
 
 CX88 VIDEO4LINUX DRIVER
-M:      Mauro Carvalho Chehab <m.chehab@samsung.com>
+M:      Mauro Carvalho Chehab <mchehab@osg.samsung.com>
 L:      linux-media@vger.kernel.org
 W:      http://linuxtv.org
 T:      git git://linuxtv.org/media_tree.git
@@ -3419,7 +3419,7 @@ F:	fs/ecryptfs/
 EDAC-CORE
 M:      Doug Thompson <dougthompson@xmission.com>
 M:      Borislav Petkov <bp@alien8.de>
-M:      Mauro Carvalho Chehab <m.chehab@samsung.com>
+M:      Mauro Carvalho Chehab <mchehab@osg.samsung.com>
 L:      linux-edac@vger.kernel.org
 W:      bluesmoke.sourceforge.net
 S:      Supported
@@ -3468,7 +3468,7 @@ S:	Maintained
 F:      drivers/edac/e7xxx_edac.c
 
 EDAC-GHES
-M:      Mauro Carvalho Chehab <m.chehab@samsung.com>
+M:      Mauro Carvalho Chehab <mchehab@osg.samsung.com>
 L:      linux-edac@vger.kernel.org
 W:      bluesmoke.sourceforge.net
 S:      Maintained
@@ -3496,21 +3496,21 @@ S:	Maintained
 F:      drivers/edac/i5000_edac.c
 
 EDAC-I5400
-M:      Mauro Carvalho Chehab <m.chehab@samsung.com>
+M:      Mauro Carvalho Chehab <mchehab@osg.samsung.com>
 L:      linux-edac@vger.kernel.org
 W:      bluesmoke.sourceforge.net
 S:      Maintained
 F:      drivers/edac/i5400_edac.c
 
 EDAC-I7300
-M:      Mauro Carvalho Chehab <m.chehab@samsung.com>
+M:      Mauro Carvalho Chehab <mchehab@osg.samsung.com>
 L:      linux-edac@vger.kernel.org
 W:      bluesmoke.sourceforge.net
 S:      Maintained
 F:      drivers/edac/i7300_edac.c
 
 EDAC-I7CORE
-M:      Mauro Carvalho Chehab <m.chehab@samsung.com>
+M:      Mauro Carvalho Chehab <mchehab@osg.samsung.com>
 L:      linux-edac@vger.kernel.org
 W:      bluesmoke.sourceforge.net
 S:      Maintained
@@ -3553,7 +3553,7 @@ S:	Maintained
 F:      drivers/edac/r82600_edac.c
 
 EDAC-SBRIDGE
-M:      Mauro Carvalho Chehab <m.chehab@samsung.com>
+M:      Mauro Carvalho Chehab <mchehab@osg.samsung.com>
 L:      linux-edac@vger.kernel.org
 W:      bluesmoke.sourceforge.net
 S:      Maintained
@@ -3613,7 +3613,7 @@ S:	Maintained
 F:      drivers/net/ethernet/ibm/ehea/
 
 EM28XX VIDEO4LINUX DRIVER
-M:      Mauro Carvalho Chehab <m.chehab@samsung.com>
+M:      Mauro Carvalho Chehab <mchehab@osg.samsung.com>
 L:      linux-media@vger.kernel.org
 W:      http://linuxtv.org
 T:      git git://linuxtv.org/media_tree.git
@@ -5979,7 +5979,7 @@ S:	Maintained
 F:      drivers/media/radio/radio-maxiradio*
 
 MEDIA INPUT INFRASTRUCTURE (V4L/DVB)
-M:      Mauro Carvalho Chehab <m.chehab@samsung.com>
+M:      Mauro Carvalho Chehab <mchehab@osg.samsung.com>
 P:      LinuxTV.org Project
 L:      linux-media@vger.kernel.org
 W:      http://linuxtv.org
@@ -8030,7 +8030,7 @@ S:	Odd Fixes
 F:      drivers/media/i2c/saa6588*
 
 SAA7134 VIDEO4LINUX DRIVER
-M:      Mauro Carvalho Chehab <m.chehab@samsung.com>
+M:      Mauro Carvalho Chehab <mchehab@osg.samsung.com>
 L:      linux-media@vger.kernel.org
 W:      http://linuxtv.org
 T:      git git://linuxtv.org/media_tree.git
@@ -8488,7 +8488,7 @@ S:	Maintained
 F:      drivers/media/radio/si4713/radio-usb-si4713.c
 
 SIANO DVB DRIVER
-M:      Mauro Carvalho Chehab <m.chehab@samsung.com>
+M:      Mauro Carvalho Chehab <mchehab@osg.samsung.com>
 L:      linux-media@vger.kernel.org
 W:      http://linuxtv.org
 T:      git git://linuxtv.org/media_tree.git
@@ -8699,7 +8699,9 @@ S:	Maintained
 F:      drivers/leds/leds-net48xx.c
 
 SOFTLOGIC 6x10 MPEG CODEC
-M:      Ismael Luceno <ismael.luceno@corp.bluecherry.net>
+M:      Bluecherry Maintainers <maintainers@bluecherrydvr.com>
+M:      Andrey Utkin <andrey.utkin@corp.bluecherry.net>
+M:      Andrey Utkin <andrey.krieger.utkin@gmail.com>
 L:      linux-media@vger.kernel.org
 S:      Supported
 F:      drivers/media/pci/solo6x10/
@@ -9173,7 +9175,7 @@ S:	Maintained
 F:      drivers/media/i2c/tda9840*
 
 TEA5761 TUNER DRIVER
-M:      Mauro Carvalho Chehab <m.chehab@samsung.com>
+M:      Mauro Carvalho Chehab <mchehab@osg.samsung.com>
 L:      linux-media@vger.kernel.org
 W:      http://linuxtv.org
 T:      git git://linuxtv.org/media_tree.git
@@ -9181,7 +9183,7 @@ S:	Odd fixes
 F:      drivers/media/tuners/tea5761.*
 
 TEA5767 TUNER DRIVER
-M:      Mauro Carvalho Chehab <m.chehab@samsung.com>
+M:      Mauro Carvalho Chehab <mchehab@osg.samsung.com>
 L:      linux-media@vger.kernel.org
 W:      http://linuxtv.org
 T:      git git://linuxtv.org/media_tree.git
@@ -9493,7 +9495,7 @@ F:	include/linux/shmem_fs.h
 F:      mm/shmem.c
 
 TM6000 VIDEO4LINUX DRIVER
-M:      Mauro Carvalho Chehab <m.chehab@samsung.com>
+M:      Mauro Carvalho Chehab <mchehab@osg.samsung.com>
 L:      linux-media@vger.kernel.org
 W:      http://linuxtv.org
 T:      git git://linuxtv.org/media_tree.git
@@ -10314,7 +10316,7 @@ S:	Maintained
 F:      arch/x86/kernel/cpu/mcheck/*
 
 XC2028/3028 TUNER DRIVER
-M:      Mauro Carvalho Chehab <m.chehab@samsung.com>
+M:      Mauro Carvalho Chehab <mchehab@osg.samsung.com>
 L:      linux-media@vger.kernel.org
 W:      http://linuxtv.org
 T:      git git://linuxtv.org/media_tree.git
diff --git a/Makefile b/Makefile
index ce70361f766e..fd80c6e9bc23 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 3
 PATCHLEVEL = 18
 SUBLEVEL = 0
-EXTRAVERSION = -rc7
+EXTRAVERSION =
 NAME = Diseased Newt
 
 # *DOCUMENTATION*
diff --git a/arch/s390/kernel/nmi.c b/arch/s390/kernel/nmi.c
index dd1c24ceda50..3f51cf4e8f02 100644
--- a/arch/s390/kernel/nmi.c
+++ b/arch/s390/kernel/nmi.c
@@ -54,12 +54,8 @@ void s390_handle_mcck(void)
          */
         local_irq_save(flags);
         local_mcck_disable();
-        /*
-         * Ummm... Does this make sense at all? Copying the percpu struct
-         * and then zapping it one statement later?
-         */
-        memcpy(&mcck, this_cpu_ptr(&cpu_mcck), sizeof(mcck));
-        memset(&mcck, 0, sizeof(struct mcck_struct));
+        mcck = *this_cpu_ptr(&cpu_mcck);
+        memset(this_cpu_ptr(&cpu_mcck), 0, sizeof(mcck));
         clear_cpu_flag(CIF_MCCK_PENDING);
         local_mcck_enable();
         local_irq_restore(flags);
diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
index be1e07d4b596..45abc363dd3e 100644
--- a/arch/x86/boot/compressed/Makefile
+++ b/arch/x86/boot/compressed/Makefile
@@ -76,7 +76,7 @@ suffix-$(CONFIG_KERNEL_XZ)	:= xz
 suffix-$(CONFIG_KERNEL_LZO)     := lzo
 suffix-$(CONFIG_KERNEL_LZ4)     := lz4
 
-RUN_SIZE = $(shell objdump -h vmlinux | \
+RUN_SIZE = $(shell $(OBJDUMP) -h vmlinux | \
              perl $(srctree)/arch/x86/tools/calc_run_size.pl)
 quiet_cmd_mkpiggy = MKPIGGY $@
       cmd_mkpiggy = $(obj)/mkpiggy $< $(RUN_SIZE) > $@ || ( rm -f $@ ; false )
diff --git a/arch/x86/kernel/cpu/microcode/core.c b/arch/x86/kernel/cpu/microcode/core.c
index 2ce9051174e6..08fe6e8a726e 100644
--- a/arch/x86/kernel/cpu/microcode/core.c
+++ b/arch/x86/kernel/cpu/microcode/core.c
@@ -465,6 +465,7 @@ static void mc_bp_resume(void)
 
         if (uci->valid && uci->mc)
                 microcode_ops->apply_microcode(cpu);
+#ifdef CONFIG_X86_64
         else if (!uci->mc)
                 /*
                  * We might resume and not have applied late microcode but still
@@ -473,6 +474,7 @@ static void mc_bp_resume(void)
                  * applying patches early on the APs.
                  */
                 load_ucode_ap();
+#endif
 }
 
 static struct syscore_ops mc_syscore_ops = {
diff --git a/block/bio-integrity.c b/block/bio-integrity.c
index 0984232e429f..5cbd5d9ea61d 100644
--- a/block/bio-integrity.c
+++ b/block/bio-integrity.c
@@ -216,9 +216,10 @@ static int bio_integrity_process(struct bio *bio,
 {
         struct blk_integrity *bi = bdev_get_integrity(bio->bi_bdev);
         struct blk_integrity_iter iter;
-        struct bio_vec *bv;
+        struct bvec_iter bviter;
+        struct bio_vec bv;
         struct bio_integrity_payload *bip = bio_integrity(bio);
-        unsigned int i, ret = 0;
+        unsigned int ret = 0;
         void *prot_buf = page_address(bip->bip_vec->bv_page) +
                 bip->bip_vec->bv_offset;
 
@@ -227,11 +228,11 @@ static int bio_integrity_process(struct bio *bio,
         iter.seed = bip_get_seed(bip);
         iter.prot_buf = prot_buf;
 
-        bio_for_each_segment_all(bv, bio, i) {
-                void *kaddr = kmap_atomic(bv->bv_page);
+        bio_for_each_segment(bv, bio, bviter) {
+                void *kaddr = kmap_atomic(bv.bv_page);
 
-                iter.data_buf = kaddr + bv->bv_offset;
-                iter.data_size = bv->bv_len;
+                iter.data_buf = kaddr + bv.bv_offset;
+                iter.data_size = bv.bv_len;
 
                 ret = proc_fn(&iter);
                 if (ret) {
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index 807a88a0f394..9d75ead2a1f9 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -1164,7 +1164,8 @@ static bool acpi_video_device_in_dod(struct acpi_video_device *device)
                 return true;
 
         for (i = 0; i < video->attached_count; i++) {
-                if (video->attached_array[i].bind_info == device)
+                if ((video->attached_array[i].value.int_val & 0xfff) ==
+                    (device->device_id & 0xfff))
                         return true;
         }
 
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index e45f83789809..49f1e6890587 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -321,6 +321,9 @@ static const struct pci_device_id ahci_pci_tbl[] = {
         { PCI_VDEVICE(INTEL, 0x8c87), board_ahci }, /* 9 Series RAID */
         { PCI_VDEVICE(INTEL, 0x8c8e), board_ahci }, /* 9 Series RAID */
         { PCI_VDEVICE(INTEL, 0x8c8f), board_ahci }, /* 9 Series RAID */
+        { PCI_VDEVICE(INTEL, 0x9d03), board_ahci }, /* Sunrise Point-LP AHCI */
+        { PCI_VDEVICE(INTEL, 0x9d05), board_ahci }, /* Sunrise Point-LP RAID */
+        { PCI_VDEVICE(INTEL, 0x9d07), board_ahci }, /* Sunrise Point-LP RAID */
         { PCI_VDEVICE(INTEL, 0xa103), board_ahci }, /* Sunrise Point-H AHCI */
         { PCI_VDEVICE(INTEL, 0xa103), board_ahci }, /* Sunrise Point-H RAID */
         { PCI_VDEVICE(INTEL, 0xa105), board_ahci }, /* Sunrise Point-H RAID */
@@ -492,6 +495,7 @@ static const struct pci_device_id ahci_pci_tbl[] = {
          * enabled.  https://bugzilla.kernel.org/show_bug.cgi?id=60731
          */
         { PCI_VDEVICE(SAMSUNG, 0x1600), board_ahci_nomsi },
+        { PCI_VDEVICE(SAMSUNG, 0xa800), board_ahci_nomsi },
 
         /* Enmotus */
         { PCI_DEVICE(0x1c44, 0x8000), board_ahci },
diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
index 07bc7e4dbd04..65071591b143 100644
--- a/drivers/ata/sata_fsl.c
+++ b/drivers/ata/sata_fsl.c
@@ -1488,7 +1488,7 @@ static int sata_fsl_probe(struct platform_device *ofdev)
         host_priv->csr_base = csr_base;
 
         irq = irq_of_parse_and_map(ofdev->dev.of_node, 0);
-        if (irq < 0) {
+        if (!irq) {
                 dev_err(&ofdev->dev, "invalid irq from platform\n");
                 goto error_exit_with_cleanup;
         }
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 6289babd03b0..63247c64b1e0 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -4565,7 +4565,6 @@ static void ironlake_crtc_disable(struct drm_crtc *crtc)
                 ironlake_fdi_disable(crtc);
 
                 ironlake_disable_pch_transcoder(dev_priv, pipe);
-                intel_set_pch_fifo_underrun_reporting(dev_priv, pipe, true);
 
                 if (HAS_PCH_CPT(dev)) {
                         /* disable TRANS_DP_CTL */
@@ -4636,8 +4635,6 @@ static void haswell_crtc_disable(struct drm_crtc *crtc)
 
         if (intel_crtc->config.has_pch_encoder) {
                 lpt_disable_pch_transcoder(dev_priv);
-                intel_set_pch_fifo_underrun_reporting(dev_priv, TRANSCODER_A,
-                                                      true);
                 intel_ddi_fdi_disable(crtc);
         }
 
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index c03d457a5150..14654d628ca4 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -899,6 +899,17 @@ void intel_lvds_init(struct drm_device *dev)
         int pipe;
         u8 pin;
 
+        /*
+         * Unlock registers and just leave them unlocked. Do this before
+         * checking quirk lists to avoid bogus WARNINGs.
+         */
+        if (HAS_PCH_SPLIT(dev)) {
+                I915_WRITE(PCH_PP_CONTROL,
+                           I915_READ(PCH_PP_CONTROL) | PANEL_UNLOCK_REGS);
+        } else {
+                I915_WRITE(PP_CONTROL,
+                           I915_READ(PP_CONTROL) | PANEL_UNLOCK_REGS);
+        }
         if (!intel_lvds_supported(dev))
                 return;
 
@@ -1097,17 +1108,6 @@ out:
         lvds_encoder->a3_power = I915_READ(lvds_encoder->reg) &
                                  LVDS_A3_POWER_MASK;
 
-        /*
-         * Unlock registers and just
-         * leave them unlocked
-         */
-        if (HAS_PCH_SPLIT(dev)) {
-                I915_WRITE(PCH_PP_CONTROL,
-                           I915_READ(PCH_PP_CONTROL) | PANEL_UNLOCK_REGS);
-        } else {
-                I915_WRITE(PP_CONTROL,
-                           I915_READ(PP_CONTROL) | PANEL_UNLOCK_REGS);
-        }
         lvds_connector->lid_notifier.notifier_call = intel_lid_notify;
         if (acpi_lid_notifier_register(&lvds_connector->lid_notifier)) {
                 DRM_DEBUG_KMS("lid notifier registration failed\n");
diff --git a/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c b/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c
index cd05677ad4b7..72a40f95d048 100644
--- a/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c
+++ b/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c
@@ -218,7 +218,6 @@ nvc0_identify(struct nouveau_device *device)
                 device->oclass[NVDEV_ENGINE_BSP    ] = &nvc0_bsp_oclass;
                 device->oclass[NVDEV_ENGINE_PPP    ] = &nvc0_ppp_oclass;
                 device->oclass[NVDEV_ENGINE_COPY0  ] = &nvc0_copy0_oclass;
-                device->oclass[NVDEV_ENGINE_COPY1  ] = &nvc0_copy1_oclass;
                 device->oclass[NVDEV_ENGINE_DISP   ] =  nva3_disp_oclass;
                 device->oclass[NVDEV_ENGINE_PERFMON] = &nvc0_perfmon_oclass;
                 break;
diff --git a/drivers/gpu/drm/nouveau/core/engine/fifo/nv04.c b/drivers/gpu/drm/nouveau/core/engine/fifo/nv04.c
index 5ae6a43893b5..1931057f9962 100644
--- a/drivers/gpu/drm/nouveau/core/engine/fifo/nv04.c
+++ b/drivers/gpu/drm/nouveau/core/engine/fifo/nv04.c
@@ -551,8 +551,8 @@ nv04_fifo_intr(struct nouveau_subdev *subdev)
                         }
 
                         if (status & 0x40000000) {
-                                nouveau_fifo_uevent(&priv->base);
                                 nv_wr32(priv, 0x002100, 0x40000000);
+                                nouveau_fifo_uevent(&priv->base);
                                 status &= ~0x40000000;
                         }
                 }
diff --git a/drivers/gpu/drm/nouveau/core/engine/fifo/nvc0.c b/drivers/gpu/drm/nouveau/core/engine/fifo/nvc0.c
index 1fe1f8fbda0c..074d434c3077 100644
--- a/drivers/gpu/drm/nouveau/core/engine/fifo/nvc0.c
+++ b/drivers/gpu/drm/nouveau/core/engine/fifo/nvc0.c
@@ -740,6 +740,8 @@ nvc0_fifo_intr_engine_unit(struct nvc0_fifo_priv *priv, int engn)
         u32 inte = nv_rd32(priv, 0x002628);
         u32 unkn;
 
+        nv_wr32(priv, 0x0025a8 + (engn * 0x04), intr);
+
         for (unkn = 0; unkn < 8; unkn++) {
                 u32 ints = (intr >> (unkn * 0x04)) & inte;
                 if (ints & 0x1) {
@@ -751,8 +753,6 @@ nvc0_fifo_intr_engine_unit(struct nvc0_fifo_priv *priv, int engn)
                         nv_mask(priv, 0x002628, ints, 0);
                 }
         }
-
-        nv_wr32(priv, 0x0025a8 + (engn * 0x04), intr);
 }
 
 static void
diff --git a/drivers/gpu/drm/nouveau/core/engine/fifo/nve0.c b/drivers/gpu/drm/nouveau/core/engine/fifo/nve0.c
index fc9ef663f25a..6a8db7c80bd1 100644
--- a/drivers/gpu/drm/nouveau/core/engine/fifo/nve0.c
+++ b/drivers/gpu/drm/nouveau/core/engine/fifo/nve0.c
@@ -982,8 +982,8 @@ nve0_fifo_intr(struct nouveau_subdev *subdev)
         }
 
         if (stat & 0x80000000) {
-                nve0_fifo_intr_engine(priv);
                 nv_wr32(priv, 0x002100, 0x80000000);
+                nve0_fifo_intr_engine(priv);
                 stat &= ~0x80000000;
         }
 
diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
index afb93bb72f97..65910e3aed0c 100644
--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
+++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
@@ -664,7 +664,6 @@ nouveau_pmops_suspend(struct device *dev)
 
         pci_save_state(pdev);
         pci_disable_device(pdev);
-        pci_ignore_hotplug(pdev);
         pci_set_power_state(pdev, PCI_D3hot);
         return 0;
 }
@@ -732,6 +731,7 @@ nouveau_pmops_runtime_suspend(struct device *dev)
         ret = nouveau_do_suspend(drm_dev, true);
         pci_save_state(pdev);
         pci_disable_device(pdev);
+        pci_ignore_hotplug(pdev);
         pci_set_power_state(pdev, PCI_D3cold);
         drm_dev->switch_power_state = DRM_SWITCH_POWER_DYNAMIC_OFF;
         return ret;
diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.c b/drivers/gpu/drm/nouveau/nouveau_fence.c
index 515cd9aebb99..f32a434724e3 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fence.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fence.c
@@ -52,20 +52,24 @@ nouveau_fctx(struct nouveau_fence *fence)
         return container_of(fence->base.lock, struct nouveau_fence_chan, lock);
 }
 
-static void
+static int
 nouveau_fence_signal(struct nouveau_fence *fence)
 {
+        int drop = 0;
+
         fence_signal_locked(&fence->base);
         list_del(&fence->head);
+        rcu_assign_pointer(fence->channel, NULL);
 
         if (test_bit(FENCE_FLAG_USER_BITS, &fence->base.flags)) {
                 struct nouveau_fence_chan *fctx = nouveau_fctx(fence);
 
                 if (!--fctx->notify_ref)
-                        nvif_notify_put(&fctx->notify);
+                        drop = 1;
         }
 
         fence_put(&fence->base);
+        return drop;
 }
 
 static struct nouveau_fence *
@@ -88,16 +92,23 @@ nouveau_fence_context_del(struct nouveau_fence_chan *fctx)
 {
         struct nouveau_fence *fence;
 
-        nvif_notify_fini(&fctx->notify);
-
         spin_lock_irq(&fctx->lock);
         while (!list_empty(&fctx->pending)) {
                 fence = list_entry(fctx->pending.next, typeof(*fence), head);
 
-                nouveau_fence_signal(fence);
-                fence->channel = NULL;
+                if (nouveau_fence_signal(fence))
+                        nvif_notify_put(&fctx->notify);
         }
         spin_unlock_irq(&fctx->lock);
+
+        nvif_notify_fini(&fctx->notify);
+        fctx->dead = 1;
+
+        /*
+         * Ensure that all accesses to fence->channel complete before freeing
+         * the channel.
+         */
+        synchronize_rcu();
 }
 
 static void
@@ -112,21 +123,23 @@ nouveau_fence_context_free(struct nouveau_fence_chan *fctx)
         kref_put(&fctx->fence_ref, nouveau_fence_context_put);
 }
 
-static void
+static int
 nouveau_fence_update(struct nouveau_channel *chan, struct nouveau_fence_chan *fctx)
 {
         struct nouveau_fence *fence;
-
+        int drop = 0;
         u32 seq = fctx->read(chan);
 
         while (!list_empty(&fctx->pending)) {
                 fence = list_entry(fctx->pending.next, typeof(*fence), head);
 
                 if ((int)(seq - fence->base.seqno) < 0)
-                        return;
+                        break;
 
-                nouveau_fence_signal(fence);
+                drop |= nouveau_fence_signal(fence);
         }
+
+        return drop;
 }
 
 static int
@@ -135,18 +148,21 @@ nouveau_fence_wait_uevent_handler(struct nvif_notify *notify)
         struct nouveau_fence_chan *fctx =
                 container_of(notify, typeof(*fctx), notify);
         unsigned long flags;
+        int ret = NVIF_NOTIFY_KEEP;
 
         spin_lock_irqsave(&fctx->lock, flags);
         if (!list_empty(&fctx->pending)) {
                 struct nouveau_fence *fence;
+                struct nouveau_channel *chan;
 
                 fence = list_entry(fctx->pending.next, typeof(*fence), head);
-                nouveau_fence_update(fence->channel, fctx);
+                chan = rcu_dereference_protected(fence->channel, lockdep_is_held(&fctx->lock));
+                if (nouveau_fence_update(fence->channel, fctx))
+                        ret = NVIF_NOTIFY_DROP;
         }
         spin_unlock_irqrestore(&fctx->lock, flags);
 
-        /* Always return keep here. NVIF refcount is handled with nouveau_fence_update */
-        return NVIF_NOTIFY_KEEP;
+        return ret;
 }
 
 void
@@ -262,7 +278,10 @@ nouveau_fence_emit(struct nouveau_fence *fence, struct nouveau_channel *chan)
         if (!ret) {
                 fence_get(&fence->base);
                 spin_lock_irq(&fctx->lock);
-                nouveau_fence_update(chan, fctx);
+
+                if (nouveau_fence_update(chan, fctx))
+                        nvif_notify_put(&fctx->notify);
+
                 list_add_tail(&fence->head, &fctx->pending);
                 spin_unlock_irq(&fctx->lock);
         }
@@ -276,13 +295,16 @@ nouveau_fence_done(struct nouveau_fence *fence)
         if (fence->base.ops == &nouveau_fence_ops_legacy ||
             fence->base.ops == &nouveau_fence_ops_uevent) {
                 struct nouveau_fence_chan *fctx = nouveau_fctx(fence);
+                struct nouveau_channel *chan;
                 unsigned long flags;
 
                 if (test_bit(FENCE_FLAG_SIGNALED_BIT, &fence->base.flags))
                         return true;
 
                 spin_lock_irqsave(&fctx->lock, flags);
-                nouveau_fence_update(fence->channel, fctx);
+                chan = rcu_dereference_protected(fence->channel, lockdep_is_held(&fctx->lock));
+                if (chan && nouveau_fence_update(chan, fctx))
+                        nvif_notify_put(&fctx->notify);
                 spin_unlock_irqrestore(&fctx->lock, flags);
         }
         return fence_is_signaled(&fence->base);
@@ -387,12 +409,18 @@ nouveau_fence_sync(struct nouveau_bo *nvbo, struct nouveau_channel *chan, bool e
 
         if (fence && (!exclusive || !fobj || !fobj->shared_count)) {
                 struct nouveau_channel *prev = NULL;
+                bool must_wait = true;
 
                 f = nouveau_local_fence(fence, chan->drm);
-                if (f)
-                        prev = f->channel;
+                if (f) {
+                        rcu_read_lock();
+                        prev = rcu_dereference(f->channel);
+                        if (prev && (prev == chan || fctx->sync(f, prev, chan) == 0))
+                                must_wait = false;
+                        rcu_read_unlock();
+                }
 
-                if (!prev || (prev != chan && (ret = fctx->sync(f, prev, chan))))
+                if (must_wait)
                         ret = fence_wait(fence, intr);
 
                 return ret;
@@ -403,19 +431,22 @@ nouveau_fence_sync(struct nouveau_bo *nvbo, struct nouveau_channel *chan, bool e
 
         for (i = 0; i < fobj->shared_count && !ret; ++i) {
                 struct nouveau_channel *prev = NULL;
+                bool must_wait = true;
 
                 fence = rcu_dereference_protected(fobj->shared[i],
                                                 reservation_object_held(resv));
 
                 f = nouveau_local_fence(fence, chan->drm);
-                if (f)
-                        prev = f->channel;
+                if (f) {
+                        rcu_read_lock();
+                        prev = rcu_dereference(f->channel);
+                        if (prev && (prev == chan || fctx->sync(f, prev, chan) == 0))
+                                must_wait = false;
+                        rcu_read_unlock();
+                }
 
-                if (!prev || (prev != chan && (ret = fctx->sync(f, prev, chan))))
+                if (must_wait)
                         ret = fence_wait(fence, intr);
-
-                if (ret)
-                        break;
         }
 
         return ret;
@@ -463,7 +494,7 @@ static const char *nouveau_fence_get_timeline_name(struct fence *f)
         struct nouveau_fence *fence = from_fence(f);
         struct nouveau_fence_chan *fctx = nouveau_fctx(fence);
 
-        return fence->channel ? fctx->name : "dead channel";
+        return !fctx->dead ? fctx->name : "dead channel";
 }
 
 /*
@@ -476,9 +507,16 @@ static bool nouveau_fence_is_signaled(struct fence *f)
 {
         struct nouveau_fence *fence = from_fence(f);
         struct nouveau_fence_chan *fctx = nouveau_fctx(fence);
-        struct nouveau_channel *chan = fence->channel;
+        struct nouveau_channel *chan;
+        bool ret = false;
+
+        rcu_read_lock();
+        chan = rcu_dereference(fence->channel);
+        if (chan)
+                ret = (int)(fctx->read(chan) - fence->base.seqno) >= 0;
+        rcu_read_unlock();
 
-        return (int)(fctx->read(chan) - fence->base.seqno) >= 0;
+        return ret;
 }
 
 static bool nouveau_fence_no_signaling(struct fence *f)
diff --git a/drivers/gpu/drm/nouveau/nouveau_fence.h b/drivers/gpu/drm/nouveau/nouveau_fence.h
index 943b0b17b1fc..96e461c6f68f 100644
--- a/drivers/gpu/drm/nouveau/nouveau_fence.h
+++ b/drivers/gpu/drm/nouveau/nouveau_fence.h
@@ -14,7 +14,7 @@ struct nouveau_fence {
 
         bool sysmem;
 
-        struct nouveau_channel *channel;
+        struct nouveau_channel __rcu *channel;
         unsigned long timeout;
 };
 
@@ -47,7 +47,7 @@ struct nouveau_fence_chan {
         char name[32];
 
         struct nvif_notify notify;
-        int notify_ref;
+        int notify_ref, dead;
 };
 
 struct nouveau_fence_priv {
diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
index 9648e28c4501..c830863bc98a 100644
--- a/drivers/gpu/drm/radeon/radeon_cs.c
+++ b/drivers/gpu/drm/radeon/radeon_cs.c
@@ -241,7 +241,6 @@ static int radeon_cs_sync_rings(struct radeon_cs_parser *p)
                 resv = reloc->robj->tbo.resv;
                 r = radeon_sync_resv(p->rdev, &p->ib.sync, resv,
                                      reloc->tv.shared);
-
                 if (r)
                         return r;
         }
diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
index f4dd26ae33e5..3cf9c1fa6475 100644
--- a/drivers/gpu/drm/radeon/radeon_kms.c
+++ b/drivers/gpu/drm/radeon/radeon_kms.c
@@ -800,6 +800,8 @@ int radeon_get_vblank_timestamp_kms(struct drm_device *dev, int crtc,
 
         /* Get associated drm_crtc: */
         drmcrtc = &rdev->mode_info.crtcs[crtc]->base;
+        if (!drmcrtc)
+                return -EINVAL;
 
         /* Helper routine in DRM core does all the work: */
         return drm_calc_vbltimestamp_from_scanoutpos(dev, crtc, max_error,
diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
index 0a8ef9ef1519..7d68223eb469 100644
--- a/drivers/gpu/drm/radeon/radeon_object.c
+++ b/drivers/gpu/drm/radeon/radeon_object.c
@@ -233,6 +233,13 @@ int radeon_bo_create(struct radeon_device *rdev,
         if (!(rdev->flags & RADEON_IS_PCIE))
                 bo->flags &= ~(RADEON_GEM_GTT_WC | RADEON_GEM_GTT_UC);
 
+#ifdef CONFIG_X86_32
+        /* XXX: Write-combined CPU mappings of GTT seem broken on 32-bit
+         * See https://bugs.freedesktop.org/show_bug.cgi?id=84627
+         */
+        bo->flags &= ~RADEON_GEM_GTT_WC;
+#endif
+
         radeon_ttm_placement_from_domain(bo, domain);
         /* Kernel allocation are uninterruptible */
         down_read(&rdev->pm.mclk_lock);
diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c
index 63f3f03ecc9b..c604f4c3ac0d 100644
--- a/drivers/i2c/busses/i2c-cadence.c
+++ b/drivers/i2c/busses/i2c-cadence.c
@@ -111,6 +111,8 @@
 #define CDNS_I2C_DIVA_MAX       4
 #define CDNS_I2C_DIVB_MAX       64
 
+#define CDNS_I2C_TIMEOUT_MAX    0xFF
+
 #define cdns_i2c_readreg(offset)       readl_relaxed(id->membase + offset)
 #define cdns_i2c_writereg(val, offset) writel_relaxed(val, id->membase + offset)
 
@@ -852,6 +854,15 @@ static int cdns_i2c_probe(struct platform_device *pdev)
                 goto err_clk_dis;
         }
 
+        /*
+         * Cadence I2C controller has a bug wherein it generates
+         * invalid read transaction after HW timeout in master receiver mode.
+         * HW timeout is not used by this driver and the interrupt is disabled.
+         * But the feature itself cannot be disabled. Hence maximum value
+         * is written to this register to reduce the chances of error.
+         */
+        cdns_i2c_writereg(CDNS_I2C_TIMEOUT_MAX, CDNS_I2C_TIME_OUT_OFFSET);
+
         dev_info(&pdev->dev, "%u kHz mmio %08lx irq %d\n",
                  id->i2c_clk / 1000, (unsigned long)r_mem->start, id->irq);
 
diff --git a/drivers/i2c/busses/i2c-davinci.c b/drivers/i2c/busses/i2c-davinci.c
index d15b7c9b9219..01f0cd87a4a5 100644
--- a/drivers/i2c/busses/i2c-davinci.c
+++ b/drivers/i2c/busses/i2c-davinci.c
@@ -407,11 +407,9 @@ i2c_davinci_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg, int stop)
         if (dev->cmd_err & DAVINCI_I2C_STR_NACK) {
                 if (msg->flags & I2C_M_IGNORE_NAK)
                         return msg->len;
-                if (stop) {
-                        w = davinci_i2c_read_reg(dev, DAVINCI_I2C_MDR_REG);
-                        w |= DAVINCI_I2C_MDR_STP;
-                        davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, w);
-                }
+                w = davinci_i2c_read_reg(dev, DAVINCI_I2C_MDR_REG);
+                w |= DAVINCI_I2C_MDR_STP;
+                davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, w);
                 return -EREMOTEIO;
         }
         return -EIO;
diff --git a/drivers/i2c/busses/i2c-designware-core.c b/drivers/i2c/busses/i2c-designware-core.c
index edca99dbba23..23628b7bfb8d 100644
--- a/drivers/i2c/busses/i2c-designware-core.c
+++ b/drivers/i2c/busses/i2c-designware-core.c
@@ -359,7 +359,7 @@ int i2c_dw_init(struct dw_i2c_dev *dev)
         }
 
         /* Configure Tx/Rx FIFO threshold levels */
-        dw_writel(dev, dev->tx_fifo_depth - 1, DW_IC_TX_TL);
+        dw_writel(dev, dev->tx_fifo_depth / 2, DW_IC_TX_TL);
         dw_writel(dev, 0, DW_IC_RX_TL);
 
         /* configure the i2c master */
diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
index 26942c159de1..277a2288d4a8 100644
--- a/drivers/i2c/busses/i2c-omap.c
+++ b/drivers/i2c/busses/i2c-omap.c
@@ -922,14 +922,12 @@ omap_i2c_isr_thread(int this_irq, void *dev_id)
                 if (stat & OMAP_I2C_STAT_NACK) {
                         err |= OMAP_I2C_STAT_NACK;
                         omap_i2c_ack_stat(dev, OMAP_I2C_STAT_NACK);
-                        break;
                 }
 
                 if (stat & OMAP_I2C_STAT_AL) {
                         dev_err(dev->dev, "Arbitration lost\n");
                         err |= OMAP_I2C_STAT_AL;
                         omap_i2c_ack_stat(dev, OMAP_I2C_STAT_AL);
-                        break;
                 }
 
                 /*
@@ -954,11 +952,13 @@ omap_i2c_isr_thread(int this_irq, void *dev_id)
                         if (dev->fifo_size)
                                 num_bytes = dev->buf_len;
 
-                        omap_i2c_receive_data(dev, num_bytes, true);
-
-                        if (dev->errata & I2C_OMAP_ERRATA_I207)
+                        if (dev->errata & I2C_OMAP_ERRATA_I207) {
                                 i2c_omap_errata_i207(dev, stat);
+                                num_bytes = (omap_i2c_read_reg(dev,
+                                        OMAP_I2C_BUFSTAT_REG) >> 8) & 0x3F;
+                        }
 
+                        omap_i2c_receive_data(dev, num_bytes, true);
                         omap_i2c_ack_stat(dev, OMAP_I2C_STAT_RDR);
                         continue;
                 }
diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
index bc203485716d..8afa28e4570e 100644
--- a/drivers/input/evdev.c
+++ b/drivers/input/evdev.c
@@ -421,7 +421,7 @@ static int evdev_open(struct inode *inode, struct file *file)
 
  err_free_client:
         evdev_detach_client(evdev, client);
-        kfree(client);
+        kvfree(client);
         return error;
 }
 
diff --git a/drivers/media/i2c/smiapp/smiapp-core.c b/drivers/media/i2c/smiapp/smiapp-core.c
index 932ed9be9ff3..b10aaeda2bb4 100644
--- a/drivers/media/i2c/smiapp/smiapp-core.c
+++ b/drivers/media/i2c/smiapp/smiapp-core.c
@@ -2190,7 +2190,7 @@ static int smiapp_set_selection(struct v4l2_subdev *subdev,
                 ret = smiapp_set_compose(subdev, fh, sel);
                 break;
         default:
-                BUG();
+                ret = -EINVAL;
         }
 
         mutex_unlock(&sensor->mutex);
diff --git a/drivers/media/pci/cx23885/cx23885-core.c b/drivers/media/pci/cx23885/cx23885-core.c
index 331eddac7222..3bd386c371f7 100644
--- a/drivers/media/pci/cx23885/cx23885-core.c
+++ b/drivers/media/pci/cx23885/cx23885-core.c
@@ -1078,7 +1078,7 @@ static __le32 *cx23885_risc_field(__le32 *rp, struct scatterlist *sglist,
         for (line = 0; line < lines; line++) {
                 while (offset && offset >= sg_dma_len(sg)) {
                         offset -= sg_dma_len(sg);
-                        sg++;
+                        sg = sg_next(sg);
                 }
 
                 if (lpi && line > 0 && !(line % lpi))
@@ -1101,14 +1101,14 @@ static __le32 *cx23885_risc_field(__le32 *rp, struct scatterlist *sglist,
                         *(rp++) = cpu_to_le32(0); /* bits 63-32 */
                         todo -= (sg_dma_len(sg)-offset);
                         offset = 0;
-                        sg++;
+                        sg = sg_next(sg);
                         while (todo > sg_dma_len(sg)) {
                                 *(rp++) = cpu_to_le32(RISC_WRITE|
                                                     sg_dma_len(sg));
                                 *(rp++) = cpu_to_le32(sg_dma_address(sg));
                                 *(rp++) = cpu_to_le32(0); /* bits 63-32 */
                                 todo -= sg_dma_len(sg);
-                                sg++;
+                                sg = sg_next(sg);
                         }
                         *(rp++) = cpu_to_le32(RISC_WRITE|RISC_EOL|todo);
                         *(rp++) = cpu_to_le32(sg_dma_address(sg));
diff --git a/drivers/media/pci/solo6x10/solo6x10-core.c b/drivers/media/pci/solo6x10/solo6x10-core.c
index 172583d736fe..8cbe6b49f4c2 100644
--- a/drivers/media/pci/solo6x10/solo6x10-core.c
+++ b/drivers/media/pci/solo6x10/solo6x10-core.c
@@ -105,11 +105,8 @@ static irqreturn_t solo_isr(int irq, void *data)
         if (!status)
                 return IRQ_NONE;
 
-        if (status & ~solo_dev->irq_mask) {
-                solo_reg_write(solo_dev, SOLO_IRQ_STAT,
-                               status & ~solo_dev->irq_mask);
-                status &= solo_dev->irq_mask;
-        }
+        /* Acknowledge all interrupts immediately */
+        solo_reg_write(solo_dev, SOLO_IRQ_STAT, status);
 
         if (status & SOLO_IRQ_PCI_ERR)
                 solo_p2m_error_isr(solo_dev);
@@ -132,9 +129,6 @@ static irqreturn_t solo_isr(int irq, void *data)
         if (status & SOLO_IRQ_G723)
                 solo_g723_isr(solo_dev);
 
-        /* Clear all interrupts handled */
-        solo_reg_write(solo_dev, SOLO_IRQ_STAT, status);
-
         return IRQ_HANDLED;
 }
 
diff --git a/drivers/media/rc/ir-rc6-decoder.c b/drivers/media/rc/ir-rc6-decoder.c
index f1f098e22f7e..d16bc67af732 100644
--- a/drivers/media/rc/ir-rc6-decoder.c
+++ b/drivers/media/rc/ir-rc6-decoder.c
@@ -259,8 +259,8 @@ again:
                         case 32:
                                 if ((scancode & RC6_6A_LCC_MASK) == RC6_6A_MCE_CC) {
                                         protocol = RC_TYPE_RC6_MCE;
-                                        scancode &= ~RC6_6A_MCE_TOGGLE_MASK;
                                         toggle = !!(scancode & RC6_6A_MCE_TOGGLE_MASK);
+                                        scancode &= ~RC6_6A_MCE_TOGGLE_MASK;
                                 } else {
                                         protocol = RC_BIT_RC6_6A_32;
                                         toggle = 0;
diff --git a/drivers/media/usb/s2255/s2255drv.c b/drivers/media/usb/s2255/s2255drv.c
index ccc00099b261..1c0dbf428a3a 100644
--- a/drivers/media/usb/s2255/s2255drv.c
+++ b/drivers/media/usb/s2255/s2255drv.c
@@ -632,7 +632,7 @@ static void s2255_fillbuff(struct s2255_vc *vc,
                         break;
                 case V4L2_PIX_FMT_JPEG:
                 case V4L2_PIX_FMT_MJPEG:
-                        buf->vb.v4l2_buf.length = jpgsize;
+                        vb2_set_plane_payload(&buf->vb, 0, jpgsize);
                         memcpy(vbuf, tmpbuf, jpgsize);
                         break;
                 case V4L2_PIX_FMT_YUV422P:
diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c
index c13d83e15ace..45f09a66e6c9 100644
--- a/drivers/net/bonding/bond_netlink.c
+++ b/drivers/net/bonding/bond_netlink.c
@@ -225,7 +225,12 @@ static int bond_changelink(struct net_device *bond_dev,
 
                 bond_option_arp_ip_targets_clear(bond);
                 nla_for_each_nested(attr, data[IFLA_BOND_ARP_IP_TARGET], rem) {
-                        __be32 target = nla_get_be32(attr);
+                        __be32 target;
+
+                        if (nla_len(attr) < sizeof(target))
+                                return -EINVAL;
+
+                        target = nla_get_be32(attr);
 
                         bond_opt_initval(&newval, (__force u64)target);
                         err = __bond_opt_set(bond, BOND_OPT_ARP_TARGETS,
diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
index 8520d5529df8..279873cb6e3a 100644
--- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
+++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_main.c
@@ -2442,9 +2442,13 @@ static unsigned int from_fw_linkcaps(unsigned int type, unsigned int caps)
                      SUPPORTED_10000baseKR_Full | SUPPORTED_1000baseKX_Full |
                      SUPPORTED_10000baseKX4_Full;
         else if (type == FW_PORT_TYPE_FIBER_XFI ||
-                 type == FW_PORT_TYPE_FIBER_XAUI || type == FW_PORT_TYPE_SFP)
+                 type == FW_PORT_TYPE_FIBER_XAUI || type == FW_PORT_TYPE_SFP) {
                 v |= SUPPORTED_FIBRE;
-        else if (type == FW_PORT_TYPE_BP40_BA)
+                if (caps & FW_PORT_CAP_SPEED_1G)
+                        v |= SUPPORTED_1000baseT_Full;
+                if (caps & FW_PORT_CAP_SPEED_10G)
+                        v |= SUPPORTED_10000baseT_Full;
+        } else if (type == FW_PORT_TYPE_BP40_BA)
                 v |= SUPPORTED_40000baseSR4_Full;
 
         if (caps & FW_PORT_CAP_ANEG)
diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
index 60e9c2cd051e..b5db6b3f939f 100644
--- a/drivers/net/ethernet/renesas/sh_eth.c
+++ b/drivers/net/ethernet/renesas/sh_eth.c
@@ -917,21 +917,13 @@ static int sh_eth_reset(struct net_device *ndev)
         return ret;
 }
 
-#if defined(CONFIG_CPU_SH4) || defined(CONFIG_ARCH_SHMOBILE)
 static void sh_eth_set_receive_align(struct sk_buff *skb)
 {
-        int reserve;
+        uintptr_t reserve = (uintptr_t)skb->data & (SH_ETH_RX_ALIGN - 1);
 
-        reserve = SH4_SKB_RX_ALIGN - ((u32)skb->data & (SH4_SKB_RX_ALIGN - 1));
         if (reserve)
-                skb_reserve(skb, reserve);
+                skb_reserve(skb, SH_ETH_RX_ALIGN - reserve);
 }
-#else
-static void sh_eth_set_receive_align(struct sk_buff *skb)
-{
-        skb_reserve(skb, SH2_SH3_SKB_RX_ALIGN);
-}
-#endif
 
 
 /* CPU <-> EDMAC endian convert */
@@ -1119,6 +1111,7 @@ static void sh_eth_ring_format(struct net_device *ndev)
         struct sh_eth_txdesc *txdesc = NULL;
         int rx_ringsize = sizeof(*rxdesc) * mdp->num_rx_ring;
         int tx_ringsize = sizeof(*txdesc) * mdp->num_tx_ring;
+        int skbuff_size = mdp->rx_buf_sz + SH_ETH_RX_ALIGN - 1;
 
         mdp->cur_rx = 0;
         mdp->cur_tx = 0;
@@ -1131,21 +1124,21 @@ static void sh_eth_ring_format(struct net_device *ndev)
         for (i = 0; i < mdp->num_rx_ring; i++) {
                 /* skb */
                 mdp->rx_skbuff[i] = NULL;
-                skb = netdev_alloc_skb(ndev, mdp->rx_buf_sz);
+                skb = netdev_alloc_skb(ndev, skbuff_size);
                 mdp->rx_skbuff[i] = skb;
                 if (skb == NULL)
                         break;
-                dma_map_single(&ndev->dev, skb->data, mdp->rx_buf_sz,
-                               DMA_FROM_DEVICE);
                 sh_eth_set_receive_align(skb);
 
                 /* RX descriptor */
                 rxdesc = &mdp->rx_ring[i];
+                /* The size of the buffer is a multiple of 16 bytes. */
+                rxdesc->buffer_length = ALIGN(mdp->rx_buf_sz, 16);
+                dma_map_single(&ndev->dev, skb->data, rxdesc->buffer_length,
+                               DMA_FROM_DEVICE);
                 rxdesc->addr = virt_to_phys(PTR_ALIGN(skb->data, 4));
                 rxdesc->status = cpu_to_edmac(mdp, RD_RACT | RD_RFP);
 
-                /* The size of the buffer is 16 byte boundary. */
-                rxdesc->buffer_length = ALIGN(mdp->rx_buf_sz, 16);
                 /* Rx descriptor address set */
                 if (i == 0) {
                         sh_eth_write(ndev, mdp->rx_desc_dma, RDLAR);
@@ -1397,6 +1390,7 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
         struct sk_buff *skb;
         u16 pkt_len = 0;
         u32 desc_status;
+        int skbuff_size = mdp->rx_buf_sz + SH_ETH_RX_ALIGN - 1;
 
         rxdesc = &mdp->rx_ring[entry];
         while (!(rxdesc->status & cpu_to_edmac(mdp, RD_RACT))) {
@@ -1448,7 +1442,7 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
                         if (mdp->cd->rpadir)
                                 skb_reserve(skb, NET_IP_ALIGN);
                         dma_sync_single_for_cpu(&ndev->dev, rxdesc->addr,
-                                                mdp->rx_buf_sz,
+                                                ALIGN(mdp->rx_buf_sz, 16),
                                                 DMA_FROM_DEVICE);
                         skb_put(skb, pkt_len);
                         skb->protocol = eth_type_trans(skb, ndev);
@@ -1468,13 +1462,13 @@ static int sh_eth_rx(struct net_device *ndev, u32 intr_status, int *quota)
                 rxdesc->buffer_length = ALIGN(mdp->rx_buf_sz, 16);
 
                 if (mdp->rx_skbuff[entry] == NULL) {
-                        skb = netdev_alloc_skb(ndev, mdp->rx_buf_sz);
+                        skb = netdev_alloc_skb(ndev, skbuff_size);
                         mdp->rx_skbuff[entry] = skb;
                         if (skb == NULL)
                                 break;  /* Better luck next round. */
-                        dma_map_single(&ndev->dev, skb->data, mdp->rx_buf_sz,
-                                       DMA_FROM_DEVICE);
                         sh_eth_set_receive_align(skb);
+                        dma_map_single(&ndev->dev, skb->data,
+                                       rxdesc->buffer_length, DMA_FROM_DEVICE);
 
                         skb_checksum_none_assert(skb);
                         rxdesc->addr = virt_to_phys(PTR_ALIGN(skb->data, 4));
@@ -2042,6 +2036,8 @@ static int sh_eth_open(struct net_device *ndev)
         if (ret)
                 goto out_free_irq;
 
+        mdp->is_opened = 1;
+
         return ret;
 
 out_free_irq:
@@ -2131,6 +2127,36 @@ static int sh_eth_start_xmit(struct sk_buff *skb, struct net_device *ndev)
         return NETDEV_TX_OK;
 }
 
+static struct net_device_stats *sh_eth_get_stats(struct net_device *ndev)
+{
+        struct sh_eth_private *mdp = netdev_priv(ndev);
+
+        if (sh_eth_is_rz_fast_ether(mdp))
+                return &ndev->stats;
+
+        if (!mdp->is_opened)
+                return &ndev->stats;
+
+        ndev->stats.tx_dropped += sh_eth_read(ndev, TROCR);
+        sh_eth_write(ndev, 0, TROCR);   /* (write clear) */
+        ndev->stats.collisions += sh_eth_read(ndev, CDCR);
+        sh_eth_write(ndev, 0, CDCR);    /* (write clear) */
+        ndev->stats.tx_carrier_errors += sh_eth_read(ndev, LCCR);
+        sh_eth_write(ndev, 0, LCCR);    /* (write clear) */
+
+        if (sh_eth_is_gether(mdp)) {
+                ndev->stats.tx_carrier_errors += sh_eth_read(ndev, CERCR);
+                sh_eth_write(ndev, 0, CERCR);   /* (write clear) */
+                ndev->stats.tx_carrier_errors += sh_eth_read(ndev, CEECR);
+                sh_eth_write(ndev, 0, CEECR);   /* (write clear) */
+        } else {
+                ndev->stats.tx_carrier_errors += sh_eth_read(ndev, CNDCR);
+                sh_eth_write(ndev, 0, CNDCR);   /* (write clear) */
+        }
+
+        return &ndev->stats;
+}
+
 /* device close function */
 static int sh_eth_close(struct net_device *ndev)
 {
@@ -2145,6 +2171,7 @@ static int sh_eth_close(struct net_device *ndev)
         sh_eth_write(ndev, 0, EDTRR);
         sh_eth_write(ndev, 0, EDRRR);
 
+        sh_eth_get_stats(ndev);
         /* PHY Disconnect */
         if (mdp->phydev) {
                 phy_stop(mdp->phydev);
@@ -2163,36 +2190,9 @@ static int sh_eth_close(struct net_device *ndev)
 
         pm_runtime_put_sync(&mdp->pdev->dev);
 
-        return 0;
-}
-
-static struct net_device_stats *sh_eth_get_stats(struct net_device *ndev)
-{
-        struct sh_eth_private *mdp = netdev_priv(ndev);
-
-        if (sh_eth_is_rz_fast_ether(mdp))
-                return &ndev->stats;
+        mdp->is_opened = 0;
 
-        pm_runtime_get_sync(&mdp->pdev->dev);
-
-        ndev->stats.tx_dropped += sh_eth_read(ndev, TROCR);
-        sh_eth_write(ndev, 0, TROCR);   /* (write clear) */
-        ndev->stats.collisions += sh_eth_read(ndev, CDCR);
-        sh_eth_write(ndev, 0, CDCR);    /* (write clear) */
-        ndev->stats.tx_carrier_errors += sh_eth_read(ndev, LCCR);
-        sh_eth_write(ndev, 0, LCCR);    /* (write clear) */
-        if (sh_eth_is_gether(mdp)) {
-                ndev->stats.tx_carrier_errors += sh_eth_read(ndev, CERCR);
-                sh_eth_write(ndev, 0, CERCR);   /* (write clear) */
-                ndev->stats.tx_carrier_errors += sh_eth_read(ndev, CEECR);
-                sh_eth_write(ndev, 0, CEECR);   /* (write clear) */
-        } else {
-                ndev->stats.tx_carrier_errors += sh_eth_read(ndev, CNDCR);
-                sh_eth_write(ndev, 0, CNDCR);   /* (write clear) */
-        }
-        pm_runtime_put_sync(&mdp->pdev->dev);
-
-        return &ndev->stats;
+        return 0;
 }
 
 /* ioctl to device function */
diff --git a/drivers/net/ethernet/renesas/sh_eth.h b/drivers/net/ethernet/renesas/sh_eth.h
index b37c427144ee..22301bf9c21d 100644
--- a/drivers/net/ethernet/renesas/sh_eth.h
+++ b/drivers/net/ethernet/renesas/sh_eth.h
@@ -162,9 +162,9 @@ enum {
 
 /* Driver's parameters */
 #if defined(CONFIG_CPU_SH4) || defined(CONFIG_ARCH_SHMOBILE)
-#define SH4_SKB_RX_ALIGN        32
+#define SH_ETH_RX_ALIGN         32
 #else
-#define SH2_SH3_SKB_RX_ALIGN    2
+#define SH_ETH_RX_ALIGN         2
 #endif
 
 /* Register's bits
@@ -522,6 +522,7 @@ struct sh_eth_private {
 
         unsigned no_ether_link:1;
         unsigned ether_link_active_low:1;
+        unsigned is_opened:1;
 };
 
 static inline void sh_eth_soft_swap(char *src, int len)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
index 5b0da3986216..58a1a0a423d4 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_platform.c
@@ -265,6 +265,15 @@ static int stmmac_pltfr_probe(struct platform_device *pdev)
 
         plat_dat = dev_get_platdata(&pdev->dev);
 
+        if (!plat_dat)
+                plat_dat = devm_kzalloc(&pdev->dev,
+                                        sizeof(struct plat_stmmacenet_data),
+                                        GFP_KERNEL);
+        if (!plat_dat) {
+                pr_err("%s: ERROR: no memory", __func__);
+                return  -ENOMEM;
+        }
+
         /* Set default value for multicast hash bins */
         plat_dat->multicast_filter_bins = HASH_TABLE_SIZE;
 
@@ -272,15 +281,6 @@ static int stmmac_pltfr_probe(struct platform_device *pdev)
         plat_dat->unicast_filter_entries = 1;
 
         if (pdev->dev.of_node) {
-                if (!plat_dat)
-                        plat_dat = devm_kzalloc(&pdev->dev,
-                                        sizeof(struct plat_stmmacenet_data),
-                                        GFP_KERNEL);
-                if (!plat_dat) {
-                        pr_err("%s: ERROR: no memory", __func__);
-                        return  -ENOMEM;
-                }
-
                 ret = stmmac_probe_config_dt(pdev, plat_dat, &mac);
                 if (ret) {
                         pr_err("%s: main dt probe failed", __func__);
diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
index cca871346a0f..ece8d1804d13 100644
--- a/drivers/net/xen-netfront.c
+++ b/drivers/net/xen-netfront.c
@@ -496,9 +496,6 @@ static void xennet_make_frags(struct sk_buff *skb, struct netfront_queue *queue,
                 len = skb_frag_size(frag);
                 offset = frag->page_offset;
 
-                /* Data must not cross a page boundary. */
-                BUG_ON(len + offset > PAGE_SIZE<<compound_order(page));
-
                 /* Skip unused frames from start of page */
                 page += offset >> PAGE_SHIFT;
                 offset &= ~PAGE_MASK;
@@ -506,8 +503,6 @@ static void xennet_make_frags(struct sk_buff *skb, struct netfront_queue *queue,
                 while (len > 0) {
                         unsigned long bytes;
 
-                        BUG_ON(offset >= PAGE_SIZE);
-
                         bytes = PAGE_SIZE - offset;
                         if (bytes > len)
                                 bytes = len;
diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
index 30e97bcc4f88..d134710de96d 100644
--- a/drivers/of/fdt.c
+++ b/drivers/of/fdt.c
@@ -964,8 +964,6 @@ void __init __weak early_init_dt_add_memory_arch(u64 base, u64 size)
 int __init __weak early_init_dt_reserve_memory_arch(phys_addr_t base,
                                         phys_addr_t size, bool nomap)
 {
-        if (memblock_is_region_reserved(base, size))
-                return -EBUSY;
         if (nomap)
                 return memblock_remove(base, size);
         return memblock_reserve(base, size);
diff --git a/drivers/pci/host/pci-tegra.c b/drivers/pci/host/pci-tegra.c
index 3d43874319be..19bb19c7db4a 100644
--- a/drivers/pci/host/pci-tegra.c
+++ b/drivers/pci/host/pci-tegra.c
@@ -276,6 +276,7 @@ struct tegra_pcie {
 
         struct resource all;
         struct resource io;
+        struct resource pio;
         struct resource mem;
         struct resource prefetch;
         struct resource busn;
@@ -658,7 +659,6 @@ static int tegra_pcie_setup(int nr, struct pci_sys_data *sys)
 {
         struct tegra_pcie *pcie = sys_to_pcie(sys);
         int err;
-        phys_addr_t io_start;
 
         err = devm_request_resource(pcie->dev, &pcie->all, &pcie->mem);
         if (err < 0)
@@ -668,14 +668,12 @@ static int tegra_pcie_setup(int nr, struct pci_sys_data *sys)
         if (err)
                 return err;
 
-        io_start = pci_pio_to_address(pcie->io.start);
-
         pci_add_resource_offset(&sys->resources, &pcie->mem, sys->mem_offset);
         pci_add_resource_offset(&sys->resources, &pcie->prefetch,
                                 sys->mem_offset);
         pci_add_resource(&sys->resources, &pcie->busn);
 
-        pci_ioremap_io(nr * SZ_64K, io_start);
+        pci_ioremap_io(pcie->pio.start, pcie->io.start);
 
         return 1;
 }
@@ -786,7 +784,6 @@ static irqreturn_t tegra_pcie_isr(int irq, void *arg)
 static void tegra_pcie_setup_translations(struct tegra_pcie *pcie)
 {
         u32 fpci_bar, size, axi_address;
-        phys_addr_t io_start = pci_pio_to_address(pcie->io.start);
 
         /* Bar 0: type 1 extended configuration space */
         fpci_bar = 0xfe100000;
@@ -799,7 +796,7 @@ static void tegra_pcie_setup_translations(struct tegra_pcie *pcie)
         /* Bar 1: downstream IO bar */
         fpci_bar = 0xfdfc0000;
         size = resource_size(&pcie->io);
-        axi_address = io_start;
+        axi_address = pcie->io.start;
         afi_writel(pcie, axi_address, AFI_AXI_BAR1_START);
         afi_writel(pcie, size >> 12, AFI_AXI_BAR1_SZ);
         afi_writel(pcie, fpci_bar, AFI_FPCI_BAR1);
@@ -1690,8 +1687,23 @@ static int tegra_pcie_parse_dt(struct tegra_pcie *pcie)
 
                 switch (res.flags & IORESOURCE_TYPE_BITS) {
                 case IORESOURCE_IO:
-                        memcpy(&pcie->io, &res, sizeof(res));
-                        pcie->io.name = np->full_name;
+                        memcpy(&pcie->pio, &res, sizeof(res));
+                        pcie->pio.name = np->full_name;
+
+                        /*
+                         * The Tegra PCIe host bridge uses this to program the
+                         * mapping of the I/O space to the physical address,
+                         * so we override the .start and .end fields here that
+                         * of_pci_range_to_resource() converted to I/O space.
+                         * We also set the IORESOURCE_MEM type to clarify that
+                         * the resource is in the physical memory space.
+                         */
+                        pcie->io.start = range.cpu_addr;
+                        pcie->io.end = range.cpu_addr + range.size - 1;
+                        pcie->io.flags = IORESOURCE_MEM;
+                        pcie->io.name = "I/O";
+
+                        memcpy(&res, &pcie->io, sizeof(res));
                         break;
 
                 case IORESOURCE_MEM:
diff --git a/drivers/watchdog/s3c2410_wdt.c b/drivers/watchdog/s3c2410_wdt.c
index 8532c3e2aea7..1626dc66e763 100644
--- a/drivers/watchdog/s3c2410_wdt.c
+++ b/drivers/watchdog/s3c2410_wdt.c
@@ -161,7 +161,7 @@ static const struct s3c2410_wdt_variant drv_data_exynos5420 = {
 static const struct s3c2410_wdt_variant drv_data_exynos7 = {
         .disable_reg = EXYNOS5_WDT_DISABLE_REG_OFFSET,
         .mask_reset_reg = EXYNOS5_WDT_MASK_RESET_REG_OFFSET,
-        .mask_bit = 0,
+        .mask_bit = 23,
         .rst_stat_reg = EXYNOS5_RST_STAT_REG_OFFSET,
         .rst_stat_bit = 23,     /* A57 WDTRESET */
         .quirks = QUIRK_HAS_PMU_CONFIG | QUIRK_HAS_RST_STAT,
diff --git a/fs/fat/namei_vfat.c b/fs/fat/namei_vfat.c
index 6df8d3d885e5..b8b92c2f9683 100644
--- a/fs/fat/namei_vfat.c
+++ b/fs/fat/namei_vfat.c
@@ -736,7 +736,12 @@ static struct dentry *vfat_lookup(struct inode *dir, struct dentry *dentry,
         }
 
         alias = d_find_alias(inode);
-        if (alias && !vfat_d_anon_disconn(alias)) {
+        /*
+         * Checking "alias->d_parent == dentry->d_parent" to make sure
+         * FS is not corrupted (especially double linked dir).
+         */
+        if (alias && alias->d_parent == dentry->d_parent &&
+            !vfat_d_anon_disconn(alias)) {
                 /*
                  * This inode has non anonymous-DCACHE_DISCONNECTED
                  * dentry. This means, the user did ->lookup() by an
@@ -755,12 +760,9 @@ static struct dentry *vfat_lookup(struct inode *dir, struct dentry *dentry,
 
 out:
         mutex_unlock(&MSDOS_SB(sb)->s_lock);
-        dentry->d_time = dentry->d_parent->d_inode->i_version;
-        dentry = d_splice_alias(inode, dentry);
-        if (dentry)
-                dentry->d_time = dentry->d_parent->d_inode->i_version;
-        return dentry;
-
+        if (!inode)
+                dentry->d_time = dir->i_version;
+        return d_splice_alias(inode, dentry);
 error:
         mutex_unlock(&MSDOS_SB(sb)->s_lock);
         return ERR_PTR(err);
@@ -793,7 +795,6 @@ static int vfat_create(struct inode *dir, struct dentry *dentry, umode_t mode,
         inode->i_mtime = inode->i_atime = inode->i_ctime = ts;
         /* timestamp is already written, so mark_inode_dirty() is unneeded. */
 
-        dentry->d_time = dentry->d_parent->d_inode->i_version;
         d_instantiate(dentry, inode);
 out:
         mutex_unlock(&MSDOS_SB(sb)->s_lock);
@@ -824,6 +825,7 @@ static int vfat_rmdir(struct inode *dir, struct dentry *dentry)
         clear_nlink(inode);
         inode->i_mtime = inode->i_atime = CURRENT_TIME_SEC;
         fat_detach(inode);
+        dentry->d_time = dir->i_version;
 out:
         mutex_unlock(&MSDOS_SB(sb)->s_lock);
 
@@ -849,6 +851,7 @@ static int vfat_unlink(struct inode *dir, struct dentry *dentry)
         clear_nlink(inode);
         inode->i_mtime = inode->i_atime = CURRENT_TIME_SEC;
         fat_detach(inode);
+        dentry->d_time = dir->i_version;
 out:
         mutex_unlock(&MSDOS_SB(sb)->s_lock);
 
@@ -889,7 +892,6 @@ static int vfat_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
         inode->i_mtime = inode->i_atime = inode->i_ctime = ts;
         /* timestamp is already written, so mark_inode_dirty() is unneeded. */
 
-        dentry->d_time = dentry->d_parent->d_inode->i_version;
         d_instantiate(dentry, inode);
 
         mutex_unlock(&MSDOS_SB(sb)->s_lock);
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index e4dc74713a43..1df94fabe4eb 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -1853,13 +1853,12 @@ int jbd2_journal_set_features (journal_t *journal, unsigned long compat,
                                 journal->j_chksum_driver = NULL;
                                 return 0;
                         }
-                }
 
-                /* Precompute checksum seed for all metadata */
-                if (jbd2_journal_has_csum_v2or3(journal))
+                        /* Precompute checksum seed for all metadata */
                         journal->j_csum_seed = jbd2_chksum(journal, ~0,
                                                            sb->s_uuid,
                                                            sizeof(sb->s_uuid));
+                }
         }
 
         /* If enabling v1 checksums, downgrade superblock */
diff --git a/include/uapi/linux/Kbuild b/include/uapi/linux/Kbuild
index 4c94f31a8c99..8523f9bb72f2 100644
--- a/include/uapi/linux/Kbuild
+++ b/include/uapi/linux/Kbuild
@@ -427,7 +427,7 @@ header-y += virtio_net.h
 header-y += virtio_pci.h
 header-y += virtio_ring.h
 header-y += virtio_rng.h
-header=y += vm_sockets.h
+header-y += vm_sockets.h
 header-y += vt.h
 header-y += wait.h
 header-y += wanrouter.h
diff --git a/ipc/sem.c b/ipc/sem.c
index 454f6c6020a8..53c3310f41c6 100644
--- a/ipc/sem.c
+++ b/ipc/sem.c
@@ -507,13 +507,6 @@ static int newary(struct ipc_namespace *ns, struct ipc_params *params)
                 return retval;
         }
 
-        id = ipc_addid(&sem_ids(ns), &sma->sem_perm, ns->sc_semmni);
-        if (id < 0) {
-                ipc_rcu_putref(sma, sem_rcu_free);
-                return id;
-        }
-        ns->used_sems += nsems;
-
         sma->sem_base = (struct sem *) &sma[1];
 
         for (i = 0; i < nsems; i++) {
@@ -528,6 +521,14 @@ static int newary(struct ipc_namespace *ns, struct ipc_params *params)
         INIT_LIST_HEAD(&sma->list_id);
         sma->sem_nsems = nsems;
         sma->sem_ctime = get_seconds();
+
+        id = ipc_addid(&sem_ids(ns), &sma->sem_perm, ns->sc_semmni);
+        if (id < 0) {
+                ipc_rcu_putref(sma, sem_rcu_free);
+                return id;
+        }
+        ns->used_sems += nsems;
+
         sem_unlock(sma, -1);
         rcu_read_unlock();
 
diff --git a/kernel/sched/core.c b/kernel/sched/core.c
index 24beb9bb4c3e..89e7283015a6 100644
--- a/kernel/sched/core.c
+++ b/kernel/sched/core.c
@@ -2874,10 +2874,14 @@ asmlinkage __visible void __sched schedule_user(void)
          * or we have been woken up remotely but the IPI has not yet arrived,
          * we haven't yet exited the RCU idle mode. Do it here manually until
          * we find a better solution.
+         *
+         * NB: There are buggy callers of this function.  Ideally we
+         * should warn if prev_state != IN_USER, but that will trigger
+         * too frequently to make sense yet.
          */
-        user_exit();
+        enum ctx_state prev_state = exception_enter();
         schedule();
-        user_enter();
+        exception_exit(prev_state);
 }
 #endif
 
diff --git a/lib/genalloc.c b/lib/genalloc.c
index cce4dd68c40d..2e65d206b01c 100644
--- a/lib/genalloc.c
+++ b/lib/genalloc.c
@@ -598,6 +598,7 @@ struct gen_pool *devm_gen_pool_create(struct device *dev, int min_alloc_order,
 
         return pool;
 }
+EXPORT_SYMBOL(devm_gen_pool_create);
 
 /**
  * dev_get_gen_pool - Obtain the gen_pool (if any) for a device
diff --git a/lib/show_mem.c b/lib/show_mem.c
index 09225796991a..5e256271b47b 100644
--- a/lib/show_mem.c
+++ b/lib/show_mem.c
@@ -28,7 +28,7 @@ void show_mem(unsigned int filter)
                                 continue;
 
                         total += zone->present_pages;
-                        reserved = zone->present_pages - zone->managed_pages;
+                        reserved += zone->present_pages - zone->managed_pages;
 
                         if (is_highmem_idx(zoneid))
                                 highmem += zone->present_pages;
diff --git a/mm/frontswap.c b/mm/frontswap.c
index c30eec536f03..f2a3571c6e22 100644
--- a/mm/frontswap.c
+++ b/mm/frontswap.c
@@ -244,8 +244,10 @@ int __frontswap_store(struct page *page)
                   the (older) page from frontswap
                  */
                 inc_frontswap_failed_stores();
-                if (dup)
+                if (dup) {
                         __frontswap_clear(sis, offset);
+                        frontswap_ops->invalidate_page(type, offset);
+                }
         }
         if (frontswap_writethrough_enabled)
                 /* report failure so swap also writes to swap device */
diff --git a/mm/memory.c b/mm/memory.c
index 655fd3d34bb0..d3cb2ef66ee2 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -816,20 +816,20 @@ copy_one_pte(struct mm_struct *dst_mm, struct mm_struct *src_mm,
                 if (!pte_file(pte)) {
                         swp_entry_t entry = pte_to_swp_entry(pte);
 
-                        if (swap_duplicate(entry) < 0)
-                                return entry.val;
-
-                        /* make sure dst_mm is on swapoff's mmlist. */
-                        if (unlikely(list_empty(&dst_mm->mmlist))) {
-                                spin_lock(&mmlist_lock);
-                                if (list_empty(&dst_mm->mmlist))
-                                        list_add(&dst_mm->mmlist,
-                                                 &src_mm->mmlist);
-                                spin_unlock(&mmlist_lock);
-                        }
-                        if (likely(!non_swap_entry(entry)))
+                        if (likely(!non_swap_entry(entry))) {
+                                if (swap_duplicate(entry) < 0)
+                                        return entry.val;
+
+                                /* make sure dst_mm is on swapoff's mmlist. */
+                                if (unlikely(list_empty(&dst_mm->mmlist))) {
+                                        spin_lock(&mmlist_lock);
+                                        if (list_empty(&dst_mm->mmlist))
+                                                list_add(&dst_mm->mmlist,
+                                                         &src_mm->mmlist);
+                                        spin_unlock(&mmlist_lock);
+                                }
                                 rss[MM_SWAPENTS]++;
-                        else if (is_migration_entry(entry)) {
+                        } else if (is_migration_entry(entry)) {
                                 page = migration_entry_to_page(entry);
 
                                 if (PageAnon(page))
diff --git a/mm/mmap.c b/mm/mmap.c
index 87e82b38453c..ae919891a087 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -776,8 +776,11 @@ again:			remove_next = 1 + (end > next->vm_end);
                  * shrinking vma had, to cover any anon pages imported.
                  */
                 if (exporter && exporter->anon_vma && !importer->anon_vma) {
-                        if (anon_vma_clone(importer, exporter))
-                                return -ENOMEM;
+                        int error;
+
+                        error = anon_vma_clone(importer, exporter);
+                        if (error)
+                                return error;
                         importer->anon_vma = exporter->anon_vma;
                 }
         }
@@ -2469,7 +2472,8 @@ static int __split_vma(struct mm_struct *mm, struct vm_area_struct *vma,
         if (err)
                 goto out_free_vma;
 
-        if (anon_vma_clone(new, vma))
+        err = anon_vma_clone(new, vma);
+        if (err)
                 goto out_free_mpol;
 
         if (new->vm_file)
diff --git a/mm/rmap.c b/mm/rmap.c
index d3eb1e02d1c6..a2a1eab077b0 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -274,6 +274,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
 {
         struct anon_vma_chain *avc;
         struct anon_vma *anon_vma;
+        int error;
 
         /* Don't bother if the parent process has no anon_vma here. */
         if (!pvma->anon_vma)
@@ -283,8 +284,9 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
          * First, attach the new VMA to the parent VMA's anon_vmas,
          * so rmap can find non-COWed pages in child processes.
          */
-        if (anon_vma_clone(vma, pvma))
-                return -ENOMEM;
+        error = anon_vma_clone(vma, pvma);
+        if (error)
+                return error;
 
         /* Then add our own anon_vma. */
         anon_vma = anon_vma_alloc();
diff --git a/mm/slab.c b/mm/slab.c
index eb2b2ea30130..f34e053ec46e 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -3076,7 +3076,7 @@ static void *____cache_alloc_node(struct kmem_cache *cachep, gfp_t flags,
         void *obj;
         int x;
 
-        VM_BUG_ON(nodeid > num_online_nodes());
+        VM_BUG_ON(nodeid < 0 || nodeid >= MAX_NUMNODES);
         n = get_node(cachep, nodeid);
         BUG_ON(!n);
 
diff --git a/mm/vmpressure.c b/mm/vmpressure.c
index d4042e75f7c7..c5afd573d7da 100644
--- a/mm/vmpressure.c
+++ b/mm/vmpressure.c
@@ -165,6 +165,7 @@ static void vmpressure_work_fn(struct work_struct *work)
         unsigned long scanned;
         unsigned long reclaimed;
 
+        spin_lock(&vmpr->sr_lock);
         /*
          * Several contexts might be calling vmpressure(), so it is
          * possible that the work was rescheduled again before the old
@@ -173,11 +174,12 @@ static void vmpressure_work_fn(struct work_struct *work)
          * here. No need for any locks here since we don't care if
          * vmpr->reclaimed is in sync.
          */
-        if (!vmpr->scanned)
+        scanned = vmpr->scanned;
+        if (!scanned) {
+                spin_unlock(&vmpr->sr_lock);
                 return;
+        }
 
-        spin_lock(&vmpr->sr_lock);
-        scanned = vmpr->scanned;
         reclaimed = vmpr->reclaimed;
         vmpr->scanned = 0;
         vmpr->reclaimed = 0;
diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index b9b7dfaf202b..76321ea442c3 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c
@@ -1498,6 +1498,7 @@ static int do_setlink(const struct sk_buff *skb,
                         goto errout;
                 }
                 if (!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN)) {
+                        put_net(net);
                         err = -EPERM;
                         goto errout;
                 }
diff --git a/security/keys/internal.h b/security/keys/internal.h
index b8960c4959a5..200e37867336 100644
--- a/security/keys/internal.h
+++ b/security/keys/internal.h
@@ -117,6 +117,7 @@ struct keyring_search_context {
 #define KEYRING_SEARCH_NO_UPDATE_TIME   0x0004  /* Don't update times */
 #define KEYRING_SEARCH_NO_CHECK_PERM    0x0008  /* Don't check permissions */
 #define KEYRING_SEARCH_DETECT_TOO_DEEP  0x0010  /* Give an error on excessive depth */
+#define KEYRING_SEARCH_SKIP_EXPIRED     0x0020  /* Ignore expired keys (intention to replace) */
 
         int (*iterator)(const void *object, void *iterator_data);
 
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index eff88a5f5d40..4743d71e4aa6 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -26,6 +26,8 @@
 #include <asm/uaccess.h>
 #include "internal.h"
 
+#define KEY_MAX_DESC_SIZE 4096
+
 static int key_get_type_from_user(char *type,
                                   const char __user *_type,
                                   unsigned len)
@@ -78,7 +80,7 @@ SYSCALL_DEFINE5(add_key, const char __user *, _type,
 
         description = NULL;
         if (_description) {
-                description = strndup_user(_description, PAGE_SIZE);
+                description = strndup_user(_description, KEY_MAX_DESC_SIZE);
                 if (IS_ERR(description)) {
                         ret = PTR_ERR(description);
                         goto error;
@@ -177,7 +179,7 @@ SYSCALL_DEFINE4(request_key, const char __user *, _type,
                 goto error;
 
         /* pull the description into kernel space */
-        description = strndup_user(_description, PAGE_SIZE);
+        description = strndup_user(_description, KEY_MAX_DESC_SIZE);
         if (IS_ERR(description)) {
                 ret = PTR_ERR(description);
                 goto error;
@@ -287,7 +289,7 @@ long keyctl_join_session_keyring(const char __user *_name)
         /* fetch the name from userspace */
         name = NULL;
         if (_name) {
-                name = strndup_user(_name, PAGE_SIZE);
+                name = strndup_user(_name, KEY_MAX_DESC_SIZE);
                 if (IS_ERR(name)) {
                         ret = PTR_ERR(name);
                         goto error;
@@ -562,8 +564,9 @@ long keyctl_describe_key(key_serial_t keyid,
 {
         struct key *key, *instkey;
         key_ref_t key_ref;
-        char *tmpbuf;
+        char *infobuf;
         long ret;
+        int desclen, infolen;
 
         key_ref = lookup_user_key(keyid, KEY_LOOKUP_PARTIAL, KEY_NEED_VIEW);
         if (IS_ERR(key_ref)) {
@@ -586,38 +589,31 @@ long keyctl_describe_key(key_serial_t keyid,
         }
 
 okay:
-        /* calculate how much description we're going to return */
-        ret = -ENOMEM;
-        tmpbuf = kmalloc(PAGE_SIZE, GFP_KERNEL);
-        if (!tmpbuf)
-                goto error2;
-
         key = key_ref_to_ptr(key_ref);
+        desclen = strlen(key->description);
 
-        ret = snprintf(tmpbuf, PAGE_SIZE - 1,
-                       "%s;%d;%d;%08x;%s",
-                       key->type->name,
-                       from_kuid_munged(current_user_ns(), key->uid),
-                       from_kgid_munged(current_user_ns(), key->gid),
-                       key->perm,
-                       key->description ?: "");
-
-        /* include a NUL char at the end of the data */
-        if (ret > PAGE_SIZE - 1)
-                ret = PAGE_SIZE - 1;
-        tmpbuf[ret] = 0;
-        ret++;
+        /* calculate how much information we're going to return */
+        ret = -ENOMEM;
+        infobuf = kasprintf(GFP_KERNEL,
+                            "%s;%d;%d;%08x;",
+                            key->type->name,
+                            from_kuid_munged(current_user_ns(), key->uid),
+                            from_kgid_munged(current_user_ns(), key->gid),
+                            key->perm);
+        if (!infobuf)
+                goto error2;
+        infolen = strlen(infobuf);
+        ret = infolen + desclen + 1;
 
         /* consider returning the data */
-        if (buffer && buflen > 0) {
-                if (buflen > ret)
-                        buflen = ret;
-
-                if (copy_to_user(buffer, tmpbuf, buflen) != 0)
+        if (buffer && buflen >= ret) {
+                if (copy_to_user(buffer, infobuf, infolen) != 0 ||
+                    copy_to_user(buffer + infolen, key->description,
+                                 desclen + 1) != 0)
                         ret = -EFAULT;
         }
 
-        kfree(tmpbuf);
+        kfree(infobuf);
 error2:
         key_ref_put(key_ref);
 error:
@@ -649,7 +645,7 @@ long keyctl_keyring_search(key_serial_t ringid,
         if (ret < 0)
                 goto error;
 
-        description = strndup_user(_description, PAGE_SIZE);
+        description = strndup_user(_description, KEY_MAX_DESC_SIZE);
         if (IS_ERR(description)) {
                 ret = PTR_ERR(description);
                 goto error;
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index 8177010174f7..e72548b5897e 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -546,7 +546,8 @@ static int keyring_search_iterator(const void *object, void *iterator_data)
                 }
 
                 if (key->expiry && ctx->now.tv_sec >= key->expiry) {
-                        ctx->result = ERR_PTR(-EKEYEXPIRED);
+                        if (!(ctx->flags & KEYRING_SEARCH_SKIP_EXPIRED))
+                                ctx->result = ERR_PTR(-EKEYEXPIRED);
                         kleave(" = %d [expire]", ctx->skipped_ret);
                         goto skipped;
                 }
@@ -628,6 +629,10 @@ static bool search_nested_keyrings(struct key *keyring,
                ctx->index_key.type->name,
                ctx->index_key.description);
 
+#define STATE_CHECKS (KEYRING_SEARCH_NO_STATE_CHECK | KEYRING_SEARCH_DO_STATE_CHECK)
+        BUG_ON((ctx->flags & STATE_CHECKS) == 0 ||
+               (ctx->flags & STATE_CHECKS) == STATE_CHECKS);
+
         if (ctx->index_key.description)
                 ctx->index_key.desc_len = strlen(ctx->index_key.description);
 
@@ -637,7 +642,6 @@ static bool search_nested_keyrings(struct key *keyring,
         if (ctx->match_data.lookup_type == KEYRING_SEARCH_LOOKUP_ITERATE ||
             keyring_compare_object(keyring, &ctx->index_key)) {
                 ctx->skipped_ret = 2;
-                ctx->flags |= KEYRING_SEARCH_DO_STATE_CHECK;
                 switch (ctx->iterator(keyring_key_to_ptr(keyring), ctx)) {
                 case 1:
                         goto found;
@@ -649,8 +653,6 @@ static bool search_nested_keyrings(struct key *keyring,
         }
 
         ctx->skipped_ret = 0;
-        if (ctx->flags & KEYRING_SEARCH_NO_STATE_CHECK)
-                ctx->flags &= ~KEYRING_SEARCH_DO_STATE_CHECK;
 
         /* Start processing a new keyring */
 descend_to_keyring:
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index bb4337c7ae1b..0c7aea4dea54 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -516,6 +516,8 @@ struct key *request_key_and_link(struct key_type *type,
                 .match_data.cmp         = key_default_cmp,
                 .match_data.raw_data    = description,
                 .match_data.lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
+                .flags                  = (KEYRING_SEARCH_DO_STATE_CHECK |
+                                           KEYRING_SEARCH_SKIP_EXPIRED),
         };
         struct key *key;
         key_ref_t key_ref;
diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c
index 6639e2cb8853..5d672f7580dd 100644
--- a/security/keys/request_key_auth.c
+++ b/security/keys/request_key_auth.c
@@ -249,6 +249,7 @@ struct key *key_get_instantiation_authkey(key_serial_t target_id)
                 .match_data.cmp         = key_default_cmp,
                 .match_data.raw_data    = description,
                 .match_data.lookup_type = KEYRING_SEARCH_LOOKUP_DIRECT,
+                .flags                  = KEYRING_SEARCH_DO_STATE_CHECK,
         };
         struct key *authkey;
         key_ref_t authkey_ref;
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 14f16be3f374..b118a5be18df 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -4790,6 +4790,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
         SND_PCI_QUIRK(0x1028, 0x0638, "Dell Inspiron 5439", ALC290_FIXUP_MONO_SPEAKERS_HSJACK),
         SND_PCI_QUIRK(0x1028, 0x064a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x064b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x06d9, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
+        SND_PCI_QUIRK(0x1028, 0x06da, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x1028, 0x164b, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
         SND_PCI_QUIRK(0x103c, 0x1586, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC2),