[gentoo-commits] proj/linux-patches:4.9 commit in: /

["Mike Pagano" <mpagano@gentoo.org>]

commit:     bbda7f22f22fe20352673151651159111604d20a
Author:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
AuthorDate: Sat Apr 27 17:28:53 2019 +0000
Commit:     Mike Pagano <mpagano <AT> gentoo <DOT> org>
CommitDate: Sat Apr 27 17:28:53 2019 +0000
URL:        https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=bbda7f22

Linux patch 4.9.171

Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org>

 0000_README              |    4 +
 1170_linux-4.9.171.patch | 1955 ++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 1959 insertions(+)

diff --git a/0000_README b/0000_README
index ea31894..5425b73 100644
--- a/0000_README
+++ b/0000_README
@@ -723,6 +723,10 @@ Patch:  1169_linux-4.9.170.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.9.170
 
+Patch:  1170_linux-4.9.171.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.9.171
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.

diff --git a/1170_linux-4.9.171.patch b/1170_linux-4.9.171.patch
new file mode 100644
index 0000000..e7cd389
--- /dev/null
+++ b/1170_linux-4.9.171.patch
@@ -0,0 +1,1955 @@
+diff --git a/Makefile b/Makefile
+index 966069dab768..dbdef749e1c8 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 9
+-SUBLEVEL = 170
++SUBLEVEL = 171
+ EXTRAVERSION =
+ NAME = Roaring Lionus
+ 
+@@ -655,8 +655,7 @@ KBUILD_CFLAGS	+= $(call cc-option,-fdata-sections,)
+ endif
+ 
+ ifdef CONFIG_CC_OPTIMIZE_FOR_SIZE
+-KBUILD_CFLAGS	+= $(call cc-option,-Oz,-Os)
+-KBUILD_CFLAGS	+= $(call cc-disable-warning,maybe-uninitialized,)
++KBUILD_CFLAGS	+= -Os $(call cc-disable-warning,maybe-uninitialized,)
+ else
+ ifdef CONFIG_PROFILE_ALL_BRANCHES
+ KBUILD_CFLAGS	+= -O2 $(call cc-disable-warning,maybe-uninitialized,)
+diff --git a/arch/arm64/include/asm/futex.h b/arch/arm64/include/asm/futex.h
+index d7116f5935fb..86a43450f014 100644
+--- a/arch/arm64/include/asm/futex.h
++++ b/arch/arm64/include/asm/futex.h
+@@ -53,7 +53,7 @@
+ static inline int
+ arch_futex_atomic_op_inuser(int op, int oparg, int *oval, u32 __user *uaddr)
+ {
+-	int oldval, ret, tmp;
++	int oldval = 0, ret, tmp;
+ 
+ 	pagefault_disable();
+ 
+diff --git a/arch/x86/crypto/poly1305-avx2-x86_64.S b/arch/x86/crypto/poly1305-avx2-x86_64.S
+index eff2f414e22b..ec234c43b3f4 100644
+--- a/arch/x86/crypto/poly1305-avx2-x86_64.S
++++ b/arch/x86/crypto/poly1305-avx2-x86_64.S
+@@ -321,6 +321,12 @@ ENTRY(poly1305_4block_avx2)
+ 	vpaddq		t2,t1,t1
+ 	vmovq		t1x,d4
+ 
++	# Now do a partial reduction mod (2^130)-5, carrying h0 -> h1 -> h2 ->
++	# h3 -> h4 -> h0 -> h1 to get h0,h2,h3,h4 < 2^26 and h1 < 2^26 + a small
++	# amount.  Careful: we must not assume the carry bits 'd0 >> 26',
++	# 'd1 >> 26', 'd2 >> 26', 'd3 >> 26', and '(d4 >> 26) * 5' fit in 32-bit
++	# integers.  It's true in a single-block implementation, but not here.
++
+ 	# d1 += d0 >> 26
+ 	mov		d0,%rax
+ 	shr		$26,%rax
+@@ -359,16 +365,16 @@ ENTRY(poly1305_4block_avx2)
+ 	# h0 += (d4 >> 26) * 5
+ 	mov		d4,%rax
+ 	shr		$26,%rax
+-	lea		(%eax,%eax,4),%eax
+-	add		%eax,%ebx
++	lea		(%rax,%rax,4),%rax
++	add		%rax,%rbx
+ 	# h4 = d4 & 0x3ffffff
+ 	mov		d4,%rax
+ 	and		$0x3ffffff,%eax
+ 	mov		%eax,h4
+ 
+ 	# h1 += h0 >> 26
+-	mov		%ebx,%eax
+-	shr		$26,%eax
++	mov		%rbx,%rax
++	shr		$26,%rax
+ 	add		%eax,h1
+ 	# h0 = h0 & 0x3ffffff
+ 	andl		$0x3ffffff,%ebx
+diff --git a/arch/x86/crypto/poly1305-sse2-x86_64.S b/arch/x86/crypto/poly1305-sse2-x86_64.S
+index 338c748054ed..639d9760b089 100644
+--- a/arch/x86/crypto/poly1305-sse2-x86_64.S
++++ b/arch/x86/crypto/poly1305-sse2-x86_64.S
+@@ -251,16 +251,16 @@ ENTRY(poly1305_block_sse2)
+ 	# h0 += (d4 >> 26) * 5
+ 	mov		d4,%rax
+ 	shr		$26,%rax
+-	lea		(%eax,%eax,4),%eax
+-	add		%eax,%ebx
++	lea		(%rax,%rax,4),%rax
++	add		%rax,%rbx
+ 	# h4 = d4 & 0x3ffffff
+ 	mov		d4,%rax
+ 	and		$0x3ffffff,%eax
+ 	mov		%eax,h4
+ 
+ 	# h1 += h0 >> 26
+-	mov		%ebx,%eax
+-	shr		$26,%eax
++	mov		%rbx,%rax
++	shr		$26,%rax
+ 	add		%eax,h1
+ 	# h0 = h0 & 0x3ffffff
+ 	andl		$0x3ffffff,%ebx
+@@ -518,6 +518,12 @@ ENTRY(poly1305_2block_sse2)
+ 	paddq		t2,t1
+ 	movq		t1,d4
+ 
++	# Now do a partial reduction mod (2^130)-5, carrying h0 -> h1 -> h2 ->
++	# h3 -> h4 -> h0 -> h1 to get h0,h2,h3,h4 < 2^26 and h1 < 2^26 + a small
++	# amount.  Careful: we must not assume the carry bits 'd0 >> 26',
++	# 'd1 >> 26', 'd2 >> 26', 'd3 >> 26', and '(d4 >> 26) * 5' fit in 32-bit
++	# integers.  It's true in a single-block implementation, but not here.
++
+ 	# d1 += d0 >> 26
+ 	mov		d0,%rax
+ 	shr		$26,%rax
+@@ -556,16 +562,16 @@ ENTRY(poly1305_2block_sse2)
+ 	# h0 += (d4 >> 26) * 5
+ 	mov		d4,%rax
+ 	shr		$26,%rax
+-	lea		(%eax,%eax,4),%eax
+-	add		%eax,%ebx
++	lea		(%rax,%rax,4),%rax
++	add		%rax,%rbx
+ 	# h4 = d4 & 0x3ffffff
+ 	mov		d4,%rax
+ 	and		$0x3ffffff,%eax
+ 	mov		%eax,h4
+ 
+ 	# h1 += h0 >> 26
+-	mov		%ebx,%eax
+-	shr		$26,%eax
++	mov		%rbx,%rax
++	shr		$26,%rax
+ 	add		%eax,h1
+ 	# h0 = h0 & 0x3ffffff
+ 	andl		$0x3ffffff,%ebx
+diff --git a/arch/x86/events/amd/core.c b/arch/x86/events/amd/core.c
+index afb222b63cae..de050d5a4506 100644
+--- a/arch/x86/events/amd/core.c
++++ b/arch/x86/events/amd/core.c
+@@ -113,22 +113,39 @@ static __initconst const u64 amd_hw_cache_event_ids
+ };
+ 
+ /*
+- * AMD Performance Monitor K7 and later.
++ * AMD Performance Monitor K7 and later, up to and including Family 16h:
+  */
+ static const u64 amd_perfmon_event_map[PERF_COUNT_HW_MAX] =
+ {
+-  [PERF_COUNT_HW_CPU_CYCLES]			= 0x0076,
+-  [PERF_COUNT_HW_INSTRUCTIONS]			= 0x00c0,
+-  [PERF_COUNT_HW_CACHE_REFERENCES]		= 0x077d,
+-  [PERF_COUNT_HW_CACHE_MISSES]			= 0x077e,
+-  [PERF_COUNT_HW_BRANCH_INSTRUCTIONS]		= 0x00c2,
+-  [PERF_COUNT_HW_BRANCH_MISSES]			= 0x00c3,
+-  [PERF_COUNT_HW_STALLED_CYCLES_FRONTEND]	= 0x00d0, /* "Decoder empty" event */
+-  [PERF_COUNT_HW_STALLED_CYCLES_BACKEND]	= 0x00d1, /* "Dispatch stalls" event */
++	[PERF_COUNT_HW_CPU_CYCLES]		= 0x0076,
++	[PERF_COUNT_HW_INSTRUCTIONS]		= 0x00c0,
++	[PERF_COUNT_HW_CACHE_REFERENCES]	= 0x077d,
++	[PERF_COUNT_HW_CACHE_MISSES]		= 0x077e,
++	[PERF_COUNT_HW_BRANCH_INSTRUCTIONS]	= 0x00c2,
++	[PERF_COUNT_HW_BRANCH_MISSES]		= 0x00c3,
++	[PERF_COUNT_HW_STALLED_CYCLES_FRONTEND]	= 0x00d0, /* "Decoder empty" event */
++	[PERF_COUNT_HW_STALLED_CYCLES_BACKEND]	= 0x00d1, /* "Dispatch stalls" event */
++};
++
++/*
++ * AMD Performance Monitor Family 17h and later:
++ */
++static const u64 amd_f17h_perfmon_event_map[PERF_COUNT_HW_MAX] =
++{
++	[PERF_COUNT_HW_CPU_CYCLES]		= 0x0076,
++	[PERF_COUNT_HW_INSTRUCTIONS]		= 0x00c0,
++	[PERF_COUNT_HW_CACHE_REFERENCES]	= 0xff60,
++	[PERF_COUNT_HW_BRANCH_INSTRUCTIONS]	= 0x00c2,
++	[PERF_COUNT_HW_BRANCH_MISSES]		= 0x00c3,
++	[PERF_COUNT_HW_STALLED_CYCLES_FRONTEND]	= 0x0287,
++	[PERF_COUNT_HW_STALLED_CYCLES_BACKEND]	= 0x0187,
+ };
+ 
+ static u64 amd_pmu_event_map(int hw_event)
+ {
++	if (boot_cpu_data.x86 >= 0x17)
++		return amd_f17h_perfmon_event_map[hw_event];
++
+ 	return amd_perfmon_event_map[hw_event];
+ }
+ 
+diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
+index 64a70b2e2285..3f3cfeca1083 100644
+--- a/arch/x86/kernel/kprobes/core.c
++++ b/arch/x86/kernel/kprobes/core.c
+@@ -545,6 +545,7 @@ void arch_prepare_kretprobe(struct kretprobe_instance *ri, struct pt_regs *regs)
+ 	unsigned long *sara = stack_addr(regs);
+ 
+ 	ri->ret_addr = (kprobe_opcode_t *) *sara;
++	ri->fp = sara;
+ 
+ 	/* Replace the return addr with trampoline addr */
+ 	*sara = (unsigned long) &kretprobe_trampoline;
+@@ -746,15 +747,21 @@ __visible __used void *trampoline_handler(struct pt_regs *regs)
+ 	unsigned long flags, orig_ret_address = 0;
+ 	unsigned long trampoline_address = (unsigned long)&kretprobe_trampoline;
+ 	kprobe_opcode_t *correct_ret_addr = NULL;
++	void *frame_pointer;
++	bool skipped = false;
+ 
+ 	INIT_HLIST_HEAD(&empty_rp);
+ 	kretprobe_hash_lock(current, &head, &flags);
+ 	/* fixup registers */
+ #ifdef CONFIG_X86_64
+ 	regs->cs = __KERNEL_CS;
++	/* On x86-64, we use pt_regs->sp for return address holder. */
++	frame_pointer = &regs->sp;
+ #else
+ 	regs->cs = __KERNEL_CS | get_kernel_rpl();
+ 	regs->gs = 0;
++	/* On x86-32, we use pt_regs->flags for return address holder. */
++	frame_pointer = &regs->flags;
+ #endif
+ 	regs->ip = trampoline_address;
+ 	regs->orig_ax = ~0UL;
+@@ -776,8 +783,25 @@ __visible __used void *trampoline_handler(struct pt_regs *regs)
+ 		if (ri->task != current)
+ 			/* another task is sharing our hash bucket */
+ 			continue;
++		/*
++		 * Return probes must be pushed on this hash list correct
++		 * order (same as return order) so that it can be poped
++		 * correctly. However, if we find it is pushed it incorrect
++		 * order, this means we find a function which should not be
++		 * probed, because the wrong order entry is pushed on the
++		 * path of processing other kretprobe itself.
++		 */
++		if (ri->fp != frame_pointer) {
++			if (!skipped)
++				pr_warn("kretprobe is stacked incorrectly. Trying to fixup.\n");
++			skipped = true;
++			continue;
++		}
+ 
+ 		orig_ret_address = (unsigned long)ri->ret_addr;
++		if (skipped)
++			pr_warn("%ps must be blacklisted because of incorrect kretprobe order\n",
++				ri->rp->kp.addr);
+ 
+ 		if (orig_ret_address != trampoline_address)
+ 			/*
+@@ -795,6 +819,8 @@ __visible __used void *trampoline_handler(struct pt_regs *regs)
+ 		if (ri->task != current)
+ 			/* another task is sharing our hash bucket */
+ 			continue;
++		if (ri->fp != frame_pointer)
++			continue;
+ 
+ 		orig_ret_address = (unsigned long)ri->ret_addr;
+ 		if (ri->rp && ri->rp->handler) {
+diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c
+index 510cfc06701a..b636a1e849fd 100644
+--- a/arch/x86/kvm/emulate.c
++++ b/arch/x86/kvm/emulate.c
+@@ -2579,15 +2579,13 @@ static int em_rsm(struct x86_emulate_ctxt *ctxt)
+ 	 * CR0/CR3/CR4/EFER.  It's all a bit more complicated if the vCPU
+ 	 * supports long mode.
+ 	 */
+-	cr4 = ctxt->ops->get_cr(ctxt, 4);
+ 	if (emulator_has_longmode(ctxt)) {
+ 		struct desc_struct cs_desc;
+ 
+ 		/* Zero CR4.PCIDE before CR0.PG.  */
+-		if (cr4 & X86_CR4_PCIDE) {
++		cr4 = ctxt->ops->get_cr(ctxt, 4);
++		if (cr4 & X86_CR4_PCIDE)
+ 			ctxt->ops->set_cr(ctxt, 4, cr4 & ~X86_CR4_PCIDE);
+-			cr4 &= ~X86_CR4_PCIDE;
+-		}
+ 
+ 		/* A 32-bit code segment is required to clear EFER.LMA.  */
+ 		memset(&cs_desc, 0, sizeof(cs_desc));
+@@ -2601,13 +2599,16 @@ static int em_rsm(struct x86_emulate_ctxt *ctxt)
+ 	if (cr0 & X86_CR0_PE)
+ 		ctxt->ops->set_cr(ctxt, 0, cr0 & ~(X86_CR0_PG | X86_CR0_PE));
+ 
+-	/* Now clear CR4.PAE (which must be done before clearing EFER.LME).  */
+-	if (cr4 & X86_CR4_PAE)
+-		ctxt->ops->set_cr(ctxt, 4, cr4 & ~X86_CR4_PAE);
++	if (emulator_has_longmode(ctxt)) {
++		/* Clear CR4.PAE before clearing EFER.LME. */
++		cr4 = ctxt->ops->get_cr(ctxt, 4);
++		if (cr4 & X86_CR4_PAE)
++			ctxt->ops->set_cr(ctxt, 4, cr4 & ~X86_CR4_PAE);
+ 
+-	/* And finally go back to 32-bit mode.  */
+-	efer = 0;
+-	ctxt->ops->set_msr(ctxt, MSR_EFER, efer);
++		/* And finally go back to 32-bit mode.  */
++		efer = 0;
++		ctxt->ops->set_msr(ctxt, MSR_EFER, efer);
++	}
+ 
+ 	smbase = ctxt->ops->get_smbase(ctxt);
+ 	if (emulator_has_longmode(ctxt))
+diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
+index 01eb0451b96d..9a6d258c3c16 100644
+--- a/arch/x86/kvm/svm.c
++++ b/arch/x86/kvm/svm.c
+@@ -3940,14 +3940,25 @@ static int avic_incomplete_ipi_interception(struct vcpu_svm *svm)
+ 		kvm_lapic_reg_write(apic, APIC_ICR, icrl);
+ 		break;
+ 	case AVIC_IPI_FAILURE_TARGET_NOT_RUNNING: {
++		int i;
++		struct kvm_vcpu *vcpu;
++		struct kvm *kvm = svm->vcpu.kvm;
+ 		struct kvm_lapic *apic = svm->vcpu.arch.apic;
+ 
+ 		/*
+-		 * Update ICR high and low, then emulate sending IPI,
+-		 * which is handled when writing APIC_ICR.
++		 * At this point, we expect that the AVIC HW has already
++		 * set the appropriate IRR bits on the valid target
++		 * vcpus. So, we just need to kick the appropriate vcpu.
+ 		 */
+-		kvm_lapic_reg_write(apic, APIC_ICR2, icrh);
+-		kvm_lapic_reg_write(apic, APIC_ICR, icrl);
++		kvm_for_each_vcpu(i, vcpu, kvm) {
++			bool m = kvm_apic_match_dest(vcpu, apic,
++						     icrl & KVM_APIC_SHORT_MASK,
++						     GET_APIC_DEST_FIELD(icrh),
++						     icrl & KVM_APIC_DEST_MASK);
++
++			if (m && !avic_vcpu_is_running(vcpu))
++				kvm_vcpu_wake_up(vcpu);
++		}
+ 		break;
+ 	}
+ 	case AVIC_IPI_FAILURE_INVALID_TARGET:
+diff --git a/crypto/testmgr.h b/crypto/testmgr.h
+index 9033088ca231..ebff33765ac3 100644
+--- a/crypto/testmgr.h
++++ b/crypto/testmgr.h
+@@ -4527,7 +4527,49 @@ static struct hash_testvec poly1305_tv_template[] = {
+ 		.psize		= 80,
+ 		.digest		= "\x13\x00\x00\x00\x00\x00\x00\x00"
+ 				  "\x00\x00\x00\x00\x00\x00\x00\x00",
+-	},
++	}, { /* Regression test for overflow in AVX2 implementation */
++		.plaintext	= "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff\xff\xff\xff\xff"
++				  "\xff\xff\xff\xff",
++		.psize		= 300,
++		.digest		= "\xfb\x5e\x96\xd8\x61\xd5\xc7\xc8"
++				  "\x78\xe5\x87\xcc\x2d\x5a\x22\xe1",
++	}
+ };
+ 
+ /*
+diff --git a/drivers/char/tpm/tpm_i2c_atmel.c b/drivers/char/tpm/tpm_i2c_atmel.c
+index 95ce2e9ccdc6..cc4e642d3180 100644
+--- a/drivers/char/tpm/tpm_i2c_atmel.c
++++ b/drivers/char/tpm/tpm_i2c_atmel.c
+@@ -65,7 +65,15 @@ static int i2c_atmel_send(struct tpm_chip *chip, u8 *buf, size_t len)
+ 	dev_dbg(&chip->dev,
+ 		"%s(buf=%*ph len=%0zx) -> sts=%d\n", __func__,
+ 		(int)min_t(size_t, 64, len), buf, len, status);
+-	return status;
++
++	if (status < 0)
++		return status;
++
++	/* The upper layer does not support incomplete sends. */
++	if (status != len)
++		return -E2BIG;
++
++	return 0;
+ }
+ 
+ static int i2c_atmel_recv(struct tpm_chip *chip, u8 *buf, size_t count)
+diff --git a/drivers/crypto/amcc/crypto4xx_alg.c b/drivers/crypto/amcc/crypto4xx_alg.c
+index 4afca3968773..e3b8bebfdd30 100644
+--- a/drivers/crypto/amcc/crypto4xx_alg.c
++++ b/drivers/crypto/amcc/crypto4xx_alg.c
+@@ -138,7 +138,8 @@ static int crypto4xx_setkey_aes(struct crypto_ablkcipher *cipher,
+ 	sa = (struct dynamic_sa_ctl *) ctx->sa_in;
+ 	ctx->hash_final = 0;
+ 
+-	set_dynamic_sa_command_0(sa, SA_NOT_SAVE_HASH, SA_NOT_SAVE_IV,
++	set_dynamic_sa_command_0(sa, SA_NOT_SAVE_HASH, (cm == CRYPTO_MODE_CBC ?
++				 SA_SAVE_IV : SA_NOT_SAVE_IV),
+ 				 SA_LOAD_HASH_FROM_SA, SA_LOAD_IV_FROM_STATE,
+ 				 SA_NO_HEADER_PROC, SA_HASH_ALG_NULL,
+ 				 SA_CIPHER_ALG_AES, SA_PAD_TYPE_ZERO,
+diff --git a/drivers/crypto/amcc/crypto4xx_core.c b/drivers/crypto/amcc/crypto4xx_core.c
+index c7524bbbaf98..7d066fa9f2ad 100644
+--- a/drivers/crypto/amcc/crypto4xx_core.c
++++ b/drivers/crypto/amcc/crypto4xx_core.c
+@@ -646,6 +646,15 @@ static u32 crypto4xx_ablkcipher_done(struct crypto4xx_device *dev,
+ 		addr = dma_map_page(dev->core_dev->device, sg_page(dst),
+ 				    dst->offset, dst->length, DMA_FROM_DEVICE);
+ 	}
++
++	if (pd_uinfo->sa_va->sa_command_0.bf.save_iv == SA_SAVE_IV) {
++		struct crypto_skcipher *skcipher = crypto_skcipher_reqtfm(req);
++
++		crypto4xx_memcpy_from_le32((u32 *)req->iv,
++			pd_uinfo->sr_va->save_iv,
++			crypto_skcipher_ivsize(skcipher));
++	}
++
+ 	crypto4xx_ret_sg_desc(dev, pd_uinfo);
+ 	if (ablk_req->base.complete != NULL)
+ 		ablk_req->base.complete(&ablk_req->base, 0);
+diff --git a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+index 1d645c9ab417..cac262a912c1 100644
+--- a/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
++++ b/drivers/hid/i2c-hid/i2c-hid-dmi-quirks.c
+@@ -337,7 +337,8 @@ static const struct dmi_system_id i2c_hid_dmi_desc_override_table[] = {
+ 			DMI_EXACT_MATCH(DMI_PRODUCT_NAME, "FlexBook edge11 - M-FBE11"),
+ 		},
+ 		.driver_data = (void *)&sipodev_desc
+-	}
++	},
++	{ }	/* Terminate list */
+ };
+ 
+ 
+diff --git a/drivers/iio/accel/kxcjk-1013.c b/drivers/iio/accel/kxcjk-1013.c
+index 784636800361..780f886ccbfe 100644
+--- a/drivers/iio/accel/kxcjk-1013.c
++++ b/drivers/iio/accel/kxcjk-1013.c
+@@ -1340,6 +1340,8 @@ static int kxcjk1013_resume(struct device *dev)
+ 
+ 	mutex_lock(&data->mutex);
+ 	ret = kxcjk1013_set_mode(data, OPERATION);
++	if (ret == 0)
++		ret = kxcjk1013_set_range(data, data->range);
+ 	mutex_unlock(&data->mutex);
+ 
+ 	return ret;
+diff --git a/drivers/iio/adc/ad_sigma_delta.c b/drivers/iio/adc/ad_sigma_delta.c
+index 22c4c17cd996..a1d072ecb717 100644
+--- a/drivers/iio/adc/ad_sigma_delta.c
++++ b/drivers/iio/adc/ad_sigma_delta.c
+@@ -121,6 +121,7 @@ static int ad_sd_read_reg_raw(struct ad_sigma_delta *sigma_delta,
+ 	if (sigma_delta->info->has_registers) {
+ 		data[0] = reg << sigma_delta->info->addr_shift;
+ 		data[0] |= sigma_delta->info->read_mask;
++		data[0] |= sigma_delta->comm;
+ 		spi_message_add_tail(&t[0], &m);
+ 	}
+ 	spi_message_add_tail(&t[1], &m);
+diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
+index e3e2155b0386..dd9f2280927b 100644
+--- a/drivers/iio/adc/at91_adc.c
++++ b/drivers/iio/adc/at91_adc.c
+@@ -704,23 +704,29 @@ static int at91_adc_read_raw(struct iio_dev *idev,
+ 		ret = wait_event_interruptible_timeout(st->wq_data_avail,
+ 						       st->done,
+ 						       msecs_to_jiffies(1000));
+-		if (ret == 0)
+-			ret = -ETIMEDOUT;
+-		if (ret < 0) {
+-			mutex_unlock(&st->lock);
+-			return ret;
+-		}
+-
+-		*val = st->last_value;
+ 
++		/* Disable interrupts, regardless if adc conversion was
++		 * successful or not
++		 */
+ 		at91_adc_writel(st, AT91_ADC_CHDR,
+ 				AT91_ADC_CH(chan->channel));
+ 		at91_adc_writel(st, AT91_ADC_IDR, BIT(chan->channel));
+ 
+-		st->last_value = 0;
+-		st->done = false;
++		if (ret > 0) {
++			/* a valid conversion took place */
++			*val = st->last_value;
++			st->last_value = 0;
++			st->done = false;
++			ret = IIO_VAL_INT;
++		} else if (ret == 0) {
++			/* conversion timeout */
++			dev_err(&idev->dev, "ADC Channel %d timeout.\n",
++				chan->channel);
++			ret = -ETIMEDOUT;
++		}
++
+ 		mutex_unlock(&st->lock);
+-		return IIO_VAL_INT;
++		return ret;
+ 
+ 	case IIO_CHAN_INFO_SCALE:
+ 		*val = st->vref_mv;
+diff --git a/drivers/iio/gyro/bmg160_core.c b/drivers/iio/gyro/bmg160_core.c
+index 821919dd245b..b5a5517e3ce1 100644
+--- a/drivers/iio/gyro/bmg160_core.c
++++ b/drivers/iio/gyro/bmg160_core.c
+@@ -583,11 +583,10 @@ static int bmg160_read_raw(struct iio_dev *indio_dev,
+ 	case IIO_CHAN_INFO_LOW_PASS_FILTER_3DB_FREQUENCY:
+ 		return bmg160_get_filter(data, val);
+ 	case IIO_CHAN_INFO_SCALE:
+-		*val = 0;
+ 		switch (chan->type) {
+ 		case IIO_TEMP:
+-			*val2 = 500000;
+-			return IIO_VAL_INT_PLUS_MICRO;
++			*val = 500;
++			return IIO_VAL_INT;
+ 		case IIO_ANGL_VEL:
+ 		{
+ 			int i;
+@@ -595,6 +594,7 @@ static int bmg160_read_raw(struct iio_dev *indio_dev,
+ 			for (i = 0; i < ARRAY_SIZE(bmg160_scale_table); ++i) {
+ 				if (bmg160_scale_table[i].dps_range ==
+ 							data->dps_range) {
++					*val = 0;
+ 					*val2 = bmg160_scale_table[i].scale;
+ 					return IIO_VAL_INT_PLUS_MICRO;
+ 				}
+diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
+index 6bf58d27b6fc..df306caba296 100644
+--- a/drivers/mmc/host/sdhci.c
++++ b/drivers/mmc/host/sdhci.c
+@@ -944,8 +944,7 @@ static bool sdhci_needs_reset(struct sdhci_host *host, struct mmc_request *mrq)
+ 	return (!(host->flags & SDHCI_DEVICE_DEAD) &&
+ 		((mrq->cmd && mrq->cmd->error) ||
+ 		 (mrq->sbc && mrq->sbc->error) ||
+-		 (mrq->data && ((mrq->data->error && !mrq->data->stop) ||
+-				(mrq->data->stop && mrq->data->stop->error))) ||
++		 (mrq->data && mrq->data->stop && mrq->data->stop->error) ||
+ 		 (host->quirks & SDHCI_QUIRK_RESET_AFTER_REQUEST)));
+ }
+ 
+@@ -997,6 +996,16 @@ static void sdhci_finish_data(struct sdhci_host *host)
+ 	host->data = NULL;
+ 	host->data_cmd = NULL;
+ 
++	/*
++	 * The controller needs a reset of internal state machines upon error
++	 * conditions.
++	 */
++	if (data->error) {
++		if (!host->cmd || host->cmd == data_cmd)
++			sdhci_do_reset(host, SDHCI_RESET_CMD);
++		sdhci_do_reset(host, SDHCI_RESET_DATA);
++	}
++
+ 	if ((host->flags & (SDHCI_REQ_USE_DMA | SDHCI_USE_ADMA)) ==
+ 	    (SDHCI_REQ_USE_DMA | SDHCI_USE_ADMA))
+ 		sdhci_adma_table_post(host, data);
+@@ -1021,17 +1030,6 @@ static void sdhci_finish_data(struct sdhci_host *host)
+ 	if (data->stop &&
+ 	    (data->error ||
+ 	     !data->mrq->sbc)) {
+-
+-		/*
+-		 * The controller needs a reset of internal state machines
+-		 * upon error conditions.
+-		 */
+-		if (data->error) {
+-			if (!host->cmd || host->cmd == data_cmd)
+-				sdhci_do_reset(host, SDHCI_RESET_CMD);
+-			sdhci_do_reset(host, SDHCI_RESET_DATA);
+-		}
+-
+ 		/*
+ 		 * 'cap_cmd_during_tfr' request must not use the command line
+ 		 * after mmc_command_done() has been called. It is upper layer's
+@@ -2457,7 +2455,7 @@ static void sdhci_timeout_data_timer(unsigned long data)
+  *                                                                           *
+ \*****************************************************************************/
+ 
+-static void sdhci_cmd_irq(struct sdhci_host *host, u32 intmask)
++static void sdhci_cmd_irq(struct sdhci_host *host, u32 intmask, u32 *intmask_p)
+ {
+ 	if (!host->cmd) {
+ 		/*
+@@ -2480,20 +2478,12 @@ static void sdhci_cmd_irq(struct sdhci_host *host, u32 intmask)
+ 		else
+ 			host->cmd->error = -EILSEQ;
+ 
+-		/*
+-		 * If this command initiates a data phase and a response
+-		 * CRC error is signalled, the card can start transferring
+-		 * data - the card may have received the command without
+-		 * error.  We must not terminate the mmc_request early.
+-		 *
+-		 * If the card did not receive the command or returned an
+-		 * error which prevented it sending data, the data phase
+-		 * will time out.
+-		 */
++		/* Treat data command CRC error the same as data CRC error */
+ 		if (host->cmd->data &&
+ 		    (intmask & (SDHCI_INT_CRC | SDHCI_INT_TIMEOUT)) ==
+ 		     SDHCI_INT_CRC) {
+ 			host->cmd = NULL;
++			*intmask_p |= SDHCI_INT_DATA_CRC;
+ 			return;
+ 		}
+ 
+@@ -2722,7 +2712,7 @@ static irqreturn_t sdhci_irq(int irq, void *dev_id)
+ 		}
+ 
+ 		if (intmask & SDHCI_INT_CMD_MASK)
+-			sdhci_cmd_irq(host, intmask & SDHCI_INT_CMD_MASK);
++			sdhci_cmd_irq(host, intmask & SDHCI_INT_CMD_MASK, &intmask);
+ 
+ 		if (intmask & SDHCI_INT_DATA_MASK)
+ 			sdhci_data_irq(host, intmask & SDHCI_INT_DATA_MASK);
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 24a3433f3944..93169729dfc9 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -3134,8 +3134,12 @@ static int bond_netdev_event(struct notifier_block *this,
+ 		return NOTIFY_DONE;
+ 
+ 	if (event_dev->flags & IFF_MASTER) {
++		int ret;
++
+ 		netdev_dbg(event_dev, "IFF_MASTER\n");
+-		return bond_master_netdev_event(event, event_dev);
++		ret = bond_master_netdev_event(event, event_dev);
++		if (ret != NOTIFY_DONE)
++			return ret;
+ 	}
+ 
+ 	if (event_dev->flags & IFF_SLAVE) {
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index 375b6810bf46..b8874faaa813 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -1251,6 +1251,23 @@ static int team_port_add(struct team *team, struct net_device *port_dev)
+ 		goto err_option_port_add;
+ 	}
+ 
++	/* set promiscuity level to new slave */
++	if (dev->flags & IFF_PROMISC) {
++		err = dev_set_promiscuity(port_dev, 1);
++		if (err)
++			goto err_set_slave_promisc;
++	}
++
++	/* set allmulti level to new slave */
++	if (dev->flags & IFF_ALLMULTI) {
++		err = dev_set_allmulti(port_dev, 1);
++		if (err) {
++			if (dev->flags & IFF_PROMISC)
++				dev_set_promiscuity(port_dev, -1);
++			goto err_set_slave_promisc;
++		}
++	}
++
+ 	netif_addr_lock_bh(dev);
+ 	dev_uc_sync_multiple(port_dev, dev);
+ 	dev_mc_sync_multiple(port_dev, dev);
+@@ -1267,6 +1284,9 @@ static int team_port_add(struct team *team, struct net_device *port_dev)
+ 
+ 	return 0;
+ 
++err_set_slave_promisc:
++	__team_option_inst_del_port(team, port);
++
+ err_option_port_add:
+ 	team_upper_dev_unlink(team, port);
+ 
+@@ -1312,6 +1332,12 @@ static int team_port_del(struct team *team, struct net_device *port_dev)
+ 
+ 	team_port_disable(team, port);
+ 	list_del_rcu(&port->list);
++
++	if (dev->flags & IFF_PROMISC)
++		dev_set_promiscuity(port_dev, -1);
++	if (dev->flags & IFF_ALLMULTI)
++		dev_set_allmulti(port_dev, -1);
++
+ 	team_upper_dev_unlink(team, port);
+ 	netdev_rx_handler_unregister(port_dev);
+ 	team_port_disable_netpoll(port);
+diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00.h b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+index f68d492129c6..822833a52dd3 100644
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00.h
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00.h
+@@ -669,7 +669,6 @@ enum rt2x00_state_flags {
+ 	CONFIG_CHANNEL_HT40,
+ 	CONFIG_POWERSAVING,
+ 	CONFIG_HT_DISABLED,
+-	CONFIG_QOS_DISABLED,
+ 	CONFIG_MONITORING,
+ 
+ 	/*
+diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
+index 987c7c4f43cd..55036ce5465c 100644
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00mac.c
+@@ -666,18 +666,8 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
+ 			rt2x00dev->intf_associated--;
+ 
+ 		rt2x00leds_led_assoc(rt2x00dev, !!rt2x00dev->intf_associated);
+-
+-		clear_bit(CONFIG_QOS_DISABLED, &rt2x00dev->flags);
+ 	}
+ 
+-	/*
+-	 * Check for access point which do not support 802.11e . We have to
+-	 * generate data frames sequence number in S/W for such AP, because
+-	 * of H/W bug.
+-	 */
+-	if (changes & BSS_CHANGED_QOS && !bss_conf->qos)
+-		set_bit(CONFIG_QOS_DISABLED, &rt2x00dev->flags);
+-
+ 	/*
+ 	 * When the erp information has changed, we should perform
+ 	 * additional configuration steps. For all other changes we are done.
+diff --git a/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c b/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
+index 68b620b2462f..9a15a69b96a6 100644
+--- a/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
++++ b/drivers/net/wireless/ralink/rt2x00/rt2x00queue.c
+@@ -201,15 +201,18 @@ static void rt2x00queue_create_tx_descriptor_seq(struct rt2x00_dev *rt2x00dev,
+ 	if (!rt2x00_has_cap_flag(rt2x00dev, REQUIRE_SW_SEQNO)) {
+ 		/*
+ 		 * rt2800 has a H/W (or F/W) bug, device incorrectly increase
+-		 * seqno on retransmited data (non-QOS) frames. To workaround
+-		 * the problem let's generate seqno in software if QOS is
+-		 * disabled.
++		 * seqno on retransmitted data (non-QOS) and management frames.
++		 * To workaround the problem let's generate seqno in software.
++		 * Except for beacons which are transmitted periodically by H/W
++		 * hence hardware has to assign seqno for them.
+ 		 */
+-		if (test_bit(CONFIG_QOS_DISABLED, &rt2x00dev->flags))
+-			__clear_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags);
+-		else
++	    	if (ieee80211_is_beacon(hdr->frame_control)) {
++			__set_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags);
+ 			/* H/W will generate sequence number */
+ 			return;
++		}
++
++		__clear_bit(ENTRY_TXD_GENERATE_SEQ, &txdesc->flags);
+ 	}
+ 
+ 	/*
+diff --git a/drivers/scsi/libfc/fc_rport.c b/drivers/scsi/libfc/fc_rport.c
+index e3ffd244603e..97aeaddd600d 100644
+--- a/drivers/scsi/libfc/fc_rport.c
++++ b/drivers/scsi/libfc/fc_rport.c
+@@ -1935,7 +1935,6 @@ static void fc_rport_recv_logo_req(struct fc_lport *lport, struct fc_frame *fp)
+ 		FC_RPORT_DBG(rdata, "Received LOGO request while in state %s\n",
+ 			     fc_rport_state(rdata));
+ 
+-		rdata->flags &= ~FC_RP_STARTED;
+ 		fc_rport_enter_delete(rdata, RPORT_EV_STOP);
+ 		mutex_unlock(&rdata->rp_mutex);
+ 		kref_put(&rdata->kref, rdata->local_port->tt.rport_destroy);
+diff --git a/drivers/staging/comedi/drivers/ni_usb6501.c b/drivers/staging/comedi/drivers/ni_usb6501.c
+index 5036eebb9162..2f174a34d9e9 100644
+--- a/drivers/staging/comedi/drivers/ni_usb6501.c
++++ b/drivers/staging/comedi/drivers/ni_usb6501.c
+@@ -472,10 +472,8 @@ static int ni6501_alloc_usb_buffers(struct comedi_device *dev)
+ 
+ 	size = usb_endpoint_maxp(devpriv->ep_tx);
+ 	devpriv->usb_tx_buf = kzalloc(size, GFP_KERNEL);
+-	if (!devpriv->usb_tx_buf) {
+-		kfree(devpriv->usb_rx_buf);
++	if (!devpriv->usb_tx_buf)
+ 		return -ENOMEM;
+-	}
+ 
+ 	return 0;
+ }
+@@ -527,6 +525,9 @@ static int ni6501_auto_attach(struct comedi_device *dev,
+ 	if (!devpriv)
+ 		return -ENOMEM;
+ 
++	mutex_init(&devpriv->mut);
++	usb_set_intfdata(intf, devpriv);
++
+ 	ret = ni6501_find_endpoints(dev);
+ 	if (ret)
+ 		return ret;
+@@ -535,9 +536,6 @@ static int ni6501_auto_attach(struct comedi_device *dev,
+ 	if (ret)
+ 		return ret;
+ 
+-	mutex_init(&devpriv->mut);
+-	usb_set_intfdata(intf, devpriv);
+-
+ 	ret = comedi_alloc_subdevices(dev, 2);
+ 	if (ret)
+ 		return ret;
+diff --git a/drivers/staging/comedi/drivers/vmk80xx.c b/drivers/staging/comedi/drivers/vmk80xx.c
+index a004aed0147a..1800eb3ae017 100644
+--- a/drivers/staging/comedi/drivers/vmk80xx.c
++++ b/drivers/staging/comedi/drivers/vmk80xx.c
+@@ -691,10 +691,8 @@ static int vmk80xx_alloc_usb_buffers(struct comedi_device *dev)
+ 
+ 	size = usb_endpoint_maxp(devpriv->ep_tx);
+ 	devpriv->usb_tx_buf = kzalloc(size, GFP_KERNEL);
+-	if (!devpriv->usb_tx_buf) {
+-		kfree(devpriv->usb_rx_buf);
++	if (!devpriv->usb_tx_buf)
+ 		return -ENOMEM;
+-	}
+ 
+ 	return 0;
+ }
+@@ -809,6 +807,8 @@ static int vmk80xx_auto_attach(struct comedi_device *dev,
+ 
+ 	devpriv->model = board->model;
+ 
++	sema_init(&devpriv->limit_sem, 8);
++
+ 	ret = vmk80xx_find_usb_endpoints(dev);
+ 	if (ret)
+ 		return ret;
+@@ -817,8 +817,6 @@ static int vmk80xx_auto_attach(struct comedi_device *dev,
+ 	if (ret)
+ 		return ret;
+ 
+-	sema_init(&devpriv->limit_sem, 8);
+-
+ 	usb_set_intfdata(intf, devpriv);
+ 
+ 	if (devpriv->model == VMK8055_MODEL)
+diff --git a/drivers/staging/iio/adc/ad7192.c b/drivers/staging/iio/adc/ad7192.c
+index 4dc9ca3a11b4..b82a4ab77860 100644
+--- a/drivers/staging/iio/adc/ad7192.c
++++ b/drivers/staging/iio/adc/ad7192.c
+@@ -109,10 +109,10 @@
+ #define AD7192_CH_AIN3		BIT(6) /* AIN3 - AINCOM */
+ #define AD7192_CH_AIN4		BIT(7) /* AIN4 - AINCOM */
+ 
+-#define AD7193_CH_AIN1P_AIN2M	0x000  /* AIN1(+) - AIN2(-) */
+-#define AD7193_CH_AIN3P_AIN4M	0x001  /* AIN3(+) - AIN4(-) */
+-#define AD7193_CH_AIN5P_AIN6M	0x002  /* AIN5(+) - AIN6(-) */
+-#define AD7193_CH_AIN7P_AIN8M	0x004  /* AIN7(+) - AIN8(-) */
++#define AD7193_CH_AIN1P_AIN2M	0x001  /* AIN1(+) - AIN2(-) */
++#define AD7193_CH_AIN3P_AIN4M	0x002  /* AIN3(+) - AIN4(-) */
++#define AD7193_CH_AIN5P_AIN6M	0x004  /* AIN5(+) - AIN6(-) */
++#define AD7193_CH_AIN7P_AIN8M	0x008  /* AIN7(+) - AIN8(-) */
+ #define AD7193_CH_TEMP		0x100 /* Temp senseor */
+ #define AD7193_CH_AIN2P_AIN2M	0x200 /* AIN2(+) - AIN2(-) */
+ #define AD7193_CH_AIN1		0x401 /* AIN1 - AINCOM */
+diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
+index 2383caf88b67..a54dbfe664cd 100644
+--- a/drivers/vhost/vhost.c
++++ b/drivers/vhost/vhost.c
+@@ -863,8 +863,12 @@ static int vhost_new_umem_range(struct vhost_umem *umem,
+ 				u64 start, u64 size, u64 end,
+ 				u64 userspace_addr, int perm)
+ {
+-	struct vhost_umem_node *tmp, *node = kmalloc(sizeof(*node), GFP_ATOMIC);
++	struct vhost_umem_node *tmp, *node;
+ 
++	if (!size)
++		return -EFAULT;
++
++	node = kmalloc(sizeof(*node), GFP_ATOMIC);
+ 	if (!node)
+ 		return -ENOMEM;
+ 
+diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
+index 4ed4736b5bc6..5367b684c1f7 100644
+--- a/fs/cifs/cifsglob.h
++++ b/fs/cifs/cifsglob.h
+@@ -1157,6 +1157,7 @@ cifsFileInfo_get_locked(struct cifsFileInfo *cifs_file)
+ }
+ 
+ struct cifsFileInfo *cifsFileInfo_get(struct cifsFileInfo *cifs_file);
++void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_hdlr);
+ void cifsFileInfo_put(struct cifsFileInfo *cifs_file);
+ 
+ #define CIFS_CACHE_READ_FLG	1
+@@ -1651,6 +1652,7 @@ GLOBAL_EXTERN spinlock_t gidsidlock;
+ #endif /* CONFIG_CIFS_ACL */
+ 
+ void cifs_oplock_break(struct work_struct *work);
++void cifs_queue_oplock_break(struct cifsFileInfo *cfile);
+ 
+ extern const struct slow_work_ops cifs_oplock_break_ops;
+ extern struct workqueue_struct *cifsiod_wq;
+diff --git a/fs/cifs/file.c b/fs/cifs/file.c
+index 7d295bf283ca..e7f1773b25d6 100644
+--- a/fs/cifs/file.c
++++ b/fs/cifs/file.c
+@@ -358,12 +358,30 @@ cifsFileInfo_get(struct cifsFileInfo *cifs_file)
+ 	return cifs_file;
+ }
+ 
+-/*
+- * Release a reference on the file private data. This may involve closing
+- * the filehandle out on the server. Must be called without holding
+- * tcon->open_file_lock and cifs_file->file_info_lock.
++/**
++ * cifsFileInfo_put - release a reference of file priv data
++ *
++ * Always potentially wait for oplock handler. See _cifsFileInfo_put().
+  */
+ void cifsFileInfo_put(struct cifsFileInfo *cifs_file)
++{
++	_cifsFileInfo_put(cifs_file, true);
++}
++
++/**
++ * _cifsFileInfo_put - release a reference of file priv data
++ *
++ * This may involve closing the filehandle @cifs_file out on the
++ * server. Must be called without holding tcon->open_file_lock and
++ * cifs_file->file_info_lock.
++ *
++ * If @wait_for_oplock_handler is true and we are releasing the last
++ * reference, wait for any running oplock break handler of the file
++ * and cancel any pending one. If calling this function from the
++ * oplock break handler, you need to pass false.
++ *
++ */
++void _cifsFileInfo_put(struct cifsFileInfo *cifs_file, bool wait_oplock_handler)
+ {
+ 	struct inode *inode = d_inode(cifs_file->dentry);
+ 	struct cifs_tcon *tcon = tlink_tcon(cifs_file->tlink);
+@@ -411,7 +429,8 @@ void cifsFileInfo_put(struct cifsFileInfo *cifs_file)
+ 
+ 	spin_unlock(&tcon->open_file_lock);
+ 
+-	oplock_break_cancelled = cancel_work_sync(&cifs_file->oplock_break);
++	oplock_break_cancelled = wait_oplock_handler ?
++		cancel_work_sync(&cifs_file->oplock_break) : false;
+ 
+ 	if (!tcon->need_reconnect && !cifs_file->invalidHandle) {
+ 		struct TCP_Server_Info *server = tcon->ses->server;
+@@ -3913,6 +3932,7 @@ void cifs_oplock_break(struct work_struct *work)
+ 							     cinode);
+ 		cifs_dbg(FYI, "Oplock release rc = %d\n", rc);
+ 	}
++	_cifsFileInfo_put(cfile, false /* do not wait for ourself */);
+ 	cifs_done_oplock_break(cinode);
+ }
+ 
+diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
+index 50559a80acf8..5e75df69062d 100644
+--- a/fs/cifs/misc.c
++++ b/fs/cifs/misc.c
+@@ -494,8 +494,7 @@ is_valid_oplock_break(char *buffer, struct TCP_Server_Info *srv)
+ 					   CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
+ 					   &pCifsInode->flags);
+ 
+-				queue_work(cifsoplockd_wq,
+-					   &netfile->oplock_break);
++				cifs_queue_oplock_break(netfile);
+ 				netfile->oplock_break_cancelled = false;
+ 
+ 				spin_unlock(&tcon->open_file_lock);
+@@ -592,6 +591,28 @@ void cifs_put_writer(struct cifsInodeInfo *cinode)
+ 	spin_unlock(&cinode->writers_lock);
+ }
+ 
++/**
++ * cifs_queue_oplock_break - queue the oplock break handler for cfile
++ *
++ * This function is called from the demultiplex thread when it
++ * receives an oplock break for @cfile.
++ *
++ * Assumes the tcon->open_file_lock is held.
++ * Assumes cfile->file_info_lock is NOT held.
++ */
++void cifs_queue_oplock_break(struct cifsFileInfo *cfile)
++{
++	/*
++	 * Bump the handle refcount now while we hold the
++	 * open_file_lock to enforce the validity of it for the oplock
++	 * break handler. The matching put is done at the end of the
++	 * handler.
++	 */
++	cifsFileInfo_get(cfile);
++
++	queue_work(cifsoplockd_wq, &cfile->oplock_break);
++}
++
+ void cifs_done_oplock_break(struct cifsInodeInfo *cinode)
+ {
+ 	clear_bit(CIFS_INODE_PENDING_OPLOCK_BREAK, &cinode->flags);
+diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
+index 244d27bb8fba..9994d15a32fc 100644
+--- a/fs/cifs/smb2misc.c
++++ b/fs/cifs/smb2misc.c
+@@ -512,7 +512,7 @@ smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp,
+ 			clear_bit(CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
+ 				  &cinode->flags);
+ 
+-		queue_work(cifsoplockd_wq, &cfile->oplock_break);
++		cifs_queue_oplock_break(cfile);
+ 		kfree(lw);
+ 		return true;
+ 	}
+@@ -656,8 +656,8 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)
+ 					   CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
+ 					   &cinode->flags);
+ 				spin_unlock(&cfile->file_info_lock);
+-				queue_work(cifsoplockd_wq,
+-					   &cfile->oplock_break);
++
++				cifs_queue_oplock_break(cfile);
+ 
+ 				spin_unlock(&tcon->open_file_lock);
+ 				spin_unlock(&cifs_tcp_ses_lock);
+diff --git a/include/linux/kprobes.h b/include/linux/kprobes.h
+index e23392517db9..cb527c78de9f 100644
+--- a/include/linux/kprobes.h
++++ b/include/linux/kprobes.h
+@@ -197,6 +197,7 @@ struct kretprobe_instance {
+ 	struct kretprobe *rp;
+ 	kprobe_opcode_t *ret_addr;
+ 	struct task_struct *task;
++	void *fp;
+ 	char data[0];
+ };
+ 
+diff --git a/kernel/kprobes.c b/kernel/kprobes.c
+index f580352cc6e5..e2845dd53b30 100644
+--- a/kernel/kprobes.c
++++ b/kernel/kprobes.c
+@@ -668,7 +668,6 @@ static void unoptimize_kprobe(struct kprobe *p, bool force)
+ static int reuse_unused_kprobe(struct kprobe *ap)
+ {
+ 	struct optimized_kprobe *op;
+-	int ret;
+ 
+ 	BUG_ON(!kprobe_unused(ap));
+ 	/*
+@@ -682,9 +681,8 @@ static int reuse_unused_kprobe(struct kprobe *ap)
+ 	/* Enable the probe again */
+ 	ap->flags &= ~KPROBE_FLAG_DISABLED;
+ 	/* Optimize it again (remove from op->list) */
+-	ret = kprobe_optready(ap);
+-	if (ret)
+-		return ret;
++	if (!kprobe_optready(ap))
++		return -EINVAL;
+ 
+ 	optimize_kprobe(ap);
+ 	return 0;
+diff --git a/kernel/locking/lockdep.c b/kernel/locking/lockdep.c
+index d5b779d7e79f..26fc428476b9 100644
+--- a/kernel/locking/lockdep.c
++++ b/kernel/locking/lockdep.c
+@@ -3446,9 +3446,6 @@ __lock_set_class(struct lockdep_map *lock, const char *name,
+ 	unsigned int depth;
+ 	int i;
+ 
+-	if (unlikely(!debug_locks))
+-		return 0;
+-
+ 	depth = curr->lockdep_depth;
+ 	/*
+ 	 * This function is about (re)setting the class of a held lock,
+diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
+index 1c630d94f86b..4b1e0669740c 100644
+--- a/kernel/sched/fair.c
++++ b/kernel/sched/fair.c
+@@ -4347,12 +4347,15 @@ static enum hrtimer_restart sched_cfs_slack_timer(struct hrtimer *timer)
+ 	return HRTIMER_NORESTART;
+ }
+ 
++extern const u64 max_cfs_quota_period;
++
+ static enum hrtimer_restart sched_cfs_period_timer(struct hrtimer *timer)
+ {
+ 	struct cfs_bandwidth *cfs_b =
+ 		container_of(timer, struct cfs_bandwidth, period_timer);
+ 	int overrun;
+ 	int idle = 0;
++	int count = 0;
+ 
+ 	raw_spin_lock(&cfs_b->lock);
+ 	for (;;) {
+@@ -4360,6 +4363,28 @@ static enum hrtimer_restart sched_cfs_period_timer(struct hrtimer *timer)
+ 		if (!overrun)
+ 			break;
+ 
++		if (++count > 3) {
++			u64 new, old = ktime_to_ns(cfs_b->period);
++
++			new = (old * 147) / 128; /* ~115% */
++			new = min(new, max_cfs_quota_period);
++
++			cfs_b->period = ns_to_ktime(new);
++
++			/* since max is 1s, this is limited to 1e9^2, which fits in u64 */
++			cfs_b->quota *= new;
++			cfs_b->quota = div64_u64(cfs_b->quota, old);
++
++			pr_warn_ratelimited(
++        "cfs_period_timer[cpu%d]: period too short, scaling up (new cfs_period_us %lld, cfs_quota_us = %lld)\n",
++	                        smp_processor_id(),
++	                        div_u64(new, NSEC_PER_USEC),
++                                div_u64(cfs_b->quota, NSEC_PER_USEC));
++
++			/* reset count so we don't come right back in here */
++			count = 0;
++		}
++
+ 		idle = do_sched_cfs_period_timer(cfs_b, overrun);
+ 	}
+ 	if (idle)
+diff --git a/kernel/sysctl.c b/kernel/sysctl.c
+index 5515d578095b..cf0aeaae567e 100644
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -124,6 +124,7 @@ static int zero;
+ static int __maybe_unused one = 1;
+ static int __maybe_unused two = 2;
+ static int __maybe_unused four = 4;
++static unsigned long zero_ul;
+ static unsigned long one_ul = 1;
+ static unsigned long long_max = LONG_MAX;
+ static int one_hundred = 100;
+@@ -1683,7 +1684,7 @@ static struct ctl_table fs_table[] = {
+ 		.maxlen		= sizeof(files_stat.max_files),
+ 		.mode		= 0644,
+ 		.proc_handler	= proc_doulongvec_minmax,
+-		.extra1		= &zero,
++		.extra1		= &zero_ul,
+ 		.extra2		= &long_max,
+ 	},
+ 	{
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 8f4227d4cd39..0043aef0ed8d 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -32,6 +32,7 @@
+ #include <linux/list.h>
+ #include <linux/hash.h>
+ #include <linux/rcupdate.h>
++#include <linux/kprobes.h>
+ 
+ #include <trace/events/sched.h>
+ 
+@@ -5246,7 +5247,7 @@ void ftrace_reset_array_ops(struct trace_array *tr)
+ 	tr->ops->func = ftrace_stub;
+ }
+ 
+-static inline void
++static nokprobe_inline void
+ __ftrace_ops_list_func(unsigned long ip, unsigned long parent_ip,
+ 		       struct ftrace_ops *ignored, struct pt_regs *regs)
+ {
+@@ -5309,11 +5310,13 @@ static void ftrace_ops_list_func(unsigned long ip, unsigned long parent_ip,
+ {
+ 	__ftrace_ops_list_func(ip, parent_ip, NULL, regs);
+ }
++NOKPROBE_SYMBOL(ftrace_ops_list_func);
+ #else
+ static void ftrace_ops_no_ops(unsigned long ip, unsigned long parent_ip)
+ {
+ 	__ftrace_ops_list_func(ip, parent_ip, NULL, NULL);
+ }
++NOKPROBE_SYMBOL(ftrace_ops_no_ops);
+ #endif
+ 
+ /*
+@@ -5343,6 +5346,7 @@ static void ftrace_ops_assist_func(unsigned long ip, unsigned long parent_ip,
+ 	preempt_enable_notrace();
+ 	trace_clear_recursion(bit);
+ }
++NOKPROBE_SYMBOL(ftrace_ops_assist_func);
+ 
+ /**
+  * ftrace_ops_get_func - get the function a trampoline should call
+diff --git a/mm/percpu.c b/mm/percpu.c
+index 3794cfc88689..0462a2a00f05 100644
+--- a/mm/percpu.c
++++ b/mm/percpu.c
+@@ -2048,8 +2048,8 @@ int __init pcpu_embed_first_chunk(size_t reserved_size, size_t dyn_size,
+ 		ai->groups[group].base_offset = areas[group] - base;
+ 	}
+ 
+-	pr_info("Embedded %zu pages/cpu @%p s%zu r%zu d%zu u%zu\n",
+-		PFN_DOWN(size_sum), base, ai->static_size, ai->reserved_size,
++	pr_info("Embedded %zu pages/cpu s%zu r%zu d%zu u%zu\n",
++		PFN_DOWN(size_sum), ai->static_size, ai->reserved_size,
+ 		ai->dyn_size, ai->unit_size);
+ 
+ 	rc = pcpu_setup_first_chunk(ai, base);
+@@ -2162,8 +2162,8 @@ int __init pcpu_page_first_chunk(size_t reserved_size,
+ 	}
+ 
+ 	/* we're ready, commit */
+-	pr_info("%d %s pages/cpu @%p s%zu r%zu d%zu\n",
+-		unit_pages, psize_str, vm.addr, ai->static_size,
++	pr_info("%d %s pages/cpu s%zu r%zu d%zu\n",
++		unit_pages, psize_str, ai->static_size,
+ 		ai->reserved_size, ai->dyn_size);
+ 
+ 	rc = pcpu_setup_first_chunk(ai, vm.addr);
+diff --git a/mm/vmstat.c b/mm/vmstat.c
+index 5e6a4d76659d..9af8d369e112 100644
+--- a/mm/vmstat.c
++++ b/mm/vmstat.c
+@@ -1075,13 +1075,8 @@ const char * const vmstat_text[] = {
+ #endif
+ #endif /* CONFIG_MEMORY_BALLOON */
+ #ifdef CONFIG_DEBUG_TLBFLUSH
+-#ifdef CONFIG_SMP
+ 	"nr_tlb_remote_flush",
+ 	"nr_tlb_remote_flush_received",
+-#else
+-	"", /* nr_tlb_remote_flush */
+-	"", /* nr_tlb_remote_flush_received */
+-#endif /* CONFIG_SMP */
+ 	"nr_tlb_local_flush_all",
+ 	"nr_tlb_local_flush_one",
+ #endif /* CONFIG_DEBUG_TLBFLUSH */
+diff --git a/net/atm/lec.c b/net/atm/lec.c
+index 1e84c5226c84..704892d79bf1 100644
+--- a/net/atm/lec.c
++++ b/net/atm/lec.c
+@@ -721,7 +721,10 @@ static int lec_vcc_attach(struct atm_vcc *vcc, void __user *arg)
+ 
+ static int lec_mcast_attach(struct atm_vcc *vcc, int arg)
+ {
+-	if (arg < 0 || arg >= MAX_LEC_ITF || !dev_lec[arg])
++	if (arg < 0 || arg >= MAX_LEC_ITF)
++		return -EINVAL;
++	arg = array_index_nospec(arg, MAX_LEC_ITF);
++	if (!dev_lec[arg])
+ 		return -EINVAL;
+ 	vcc->proto_data = dev_lec[arg];
+ 	return lec_mcast_make(netdev_priv(dev_lec[arg]), vcc);
+@@ -739,6 +742,7 @@ static int lecd_attach(struct atm_vcc *vcc, int arg)
+ 		i = arg;
+ 	if (arg >= MAX_LEC_ITF)
+ 		return -EINVAL;
++	i = array_index_nospec(arg, MAX_LEC_ITF);
+ 	if (!dev_lec[i]) {
+ 		int size;
+ 
+diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
+index 267b46af407f..c615dff40ab4 100644
+--- a/net/bridge/br_input.c
++++ b/net/bridge/br_input.c
+@@ -231,13 +231,10 @@ static void __br_handle_local_finish(struct sk_buff *skb)
+ /* note: already called with rcu_read_lock */
+ static int br_handle_local_finish(struct net *net, struct sock *sk, struct sk_buff *skb)
+ {
+-	struct net_bridge_port *p = br_port_get_rcu(skb->dev);
+-
+ 	__br_handle_local_finish(skb);
+ 
+-	BR_INPUT_SKB_CB(skb)->brdev = p->br->dev;
+-	br_pass_frame_up(skb);
+-	return 0;
++	/* return 1 to signal the okfn() was called so it's ok to use the skb */
++	return 1;
+ }
+ 
+ /*
+@@ -308,10 +305,18 @@ rx_handler_result_t br_handle_frame(struct sk_buff **pskb)
+ 				goto forward;
+ 		}
+ 
+-		/* Deliver packet to local host only */
+-		NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN, dev_net(skb->dev),
+-			NULL, skb, skb->dev, NULL, br_handle_local_finish);
+-		return RX_HANDLER_CONSUMED;
++		/* The else clause should be hit when nf_hook():
++		 *   - returns < 0 (drop/error)
++		 *   - returns = 0 (stolen/nf_queue)
++		 * Thus return 1 from the okfn() to signal the skb is ok to pass
++		 */
++		if (NF_HOOK(NFPROTO_BRIDGE, NF_BR_LOCAL_IN,
++			    dev_net(skb->dev), NULL, skb, skb->dev, NULL,
++			    br_handle_local_finish) == 1) {
++			return RX_HANDLER_PASS;
++		} else {
++			return RX_HANDLER_CONSUMED;
++		}
+ 	}
+ 
+ forward:
+diff --git a/net/bridge/br_multicast.c b/net/bridge/br_multicast.c
+index 2136e45f5277..964ffff90432 100644
+--- a/net/bridge/br_multicast.c
++++ b/net/bridge/br_multicast.c
+@@ -1983,7 +1983,8 @@ static void br_multicast_start_querier(struct net_bridge *br,
+ 
+ 	__br_multicast_open(br, query);
+ 
+-	list_for_each_entry(port, &br->port_list, list) {
++	rcu_read_lock();
++	list_for_each_entry_rcu(port, &br->port_list, list) {
+ 		if (port->state == BR_STATE_DISABLED ||
+ 		    port->state == BR_STATE_BLOCKING)
+ 			continue;
+@@ -1995,6 +1996,7 @@ static void br_multicast_start_querier(struct net_bridge *br,
+ 			br_multicast_enable(&port->ip6_own_query);
+ #endif
+ 	}
++	rcu_read_unlock();
+ }
+ 
+ int br_multicast_toggle(struct net_bridge *br, unsigned long val)
+diff --git a/net/ipv4/fou.c b/net/ipv4/fou.c
+index 030d1531e897..17acc89f9dec 100644
+--- a/net/ipv4/fou.c
++++ b/net/ipv4/fou.c
+@@ -119,6 +119,7 @@ static int gue_udp_recv(struct sock *sk, struct sk_buff *skb)
+ 	struct guehdr *guehdr;
+ 	void *data;
+ 	u16 doffset = 0;
++	u8 proto_ctype;
+ 
+ 	if (!fou)
+ 		return 1;
+@@ -210,13 +211,14 @@ static int gue_udp_recv(struct sock *sk, struct sk_buff *skb)
+ 	if (unlikely(guehdr->control))
+ 		return gue_control_message(skb, guehdr);
+ 
++	proto_ctype = guehdr->proto_ctype;
+ 	__skb_pull(skb, sizeof(struct udphdr) + hdrlen);
+ 	skb_reset_transport_header(skb);
+ 
+ 	if (iptunnel_pull_offloads(skb))
+ 		goto drop;
+ 
+-	return -guehdr->proto_ctype;
++	return -proto_ctype;
+ 
+ drop:
+ 	kfree_skb(skb);
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index c42fb2330b45..0e2cf9634541 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -1170,9 +1170,23 @@ static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie)
+ 
+ static void ipv4_link_failure(struct sk_buff *skb)
+ {
++	struct ip_options opt;
+ 	struct rtable *rt;
++	int res;
++
++	/* Recompile ip options since IPCB may not be valid anymore.
++	 */
++	memset(&opt, 0, sizeof(opt));
++	opt.optlen = ip_hdr(skb)->ihl*4 - sizeof(struct iphdr);
++
++	rcu_read_lock();
++	res = __ip_options_compile(dev_net(skb->dev), &opt, skb, NULL);
++	rcu_read_unlock();
++
++	if (res)
++		return;
+ 
+-	icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0);
++	__icmp_send(skb, ICMP_DEST_UNREACH, ICMP_HOST_UNREACH, 0, &opt);
+ 
+ 	rt = skb_rtable(skb);
+ 	if (rt)
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index cd4f13dda49e..e238539c3497 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -389,11 +389,12 @@ static int __tcp_grow_window(const struct sock *sk, const struct sk_buff *skb)
+ static void tcp_grow_window(struct sock *sk, const struct sk_buff *skb)
+ {
+ 	struct tcp_sock *tp = tcp_sk(sk);
++	int room;
++
++	room = min_t(int, tp->window_clamp, tcp_space(sk)) - tp->rcv_ssthresh;
+ 
+ 	/* Check #1 */
+-	if (tp->rcv_ssthresh < tp->window_clamp &&
+-	    (int)tp->rcv_ssthresh < tcp_space(sk) &&
+-	    !tcp_under_memory_pressure(sk)) {
++	if (room > 0 && !tcp_under_memory_pressure(sk)) {
+ 		int incr;
+ 
+ 		/* Check #2. Increase window, if skb with such overhead
+@@ -406,8 +407,7 @@ static void tcp_grow_window(struct sock *sk, const struct sk_buff *skb)
+ 
+ 		if (incr) {
+ 			incr = max_t(int, incr, 2 * skb->len);
+-			tp->rcv_ssthresh = min(tp->rcv_ssthresh + incr,
+-					       tp->window_clamp);
++			tp->rcv_ssthresh += min(room, incr);
+ 			inet_csk(sk)->icsk_ack.quick |= 1;
+ 		}
+ 	}
+diff --git a/net/mac80211/driver-ops.h b/net/mac80211/driver-ops.h
+index 49c8a9c9b91f..1a169de60192 100644
+--- a/net/mac80211/driver-ops.h
++++ b/net/mac80211/driver-ops.h
+@@ -1163,6 +1163,9 @@ static inline void drv_wake_tx_queue(struct ieee80211_local *local,
+ {
+ 	struct ieee80211_sub_if_data *sdata = vif_to_sdata(txq->txq.vif);
+ 
++	if (local->in_reconfig)
++		return;
++
+ 	if (!check_sdata_in_driver(sdata))
+ 		return;
+ 
+diff --git a/scripts/mod/file2alias.c b/scripts/mod/file2alias.c
+index 29d6699d5a06..55b4c0dc2b93 100644
+--- a/scripts/mod/file2alias.c
++++ b/scripts/mod/file2alias.c
+@@ -47,49 +47,9 @@ typedef struct {
+ struct devtable {
+ 	const char *device_id; /* name of table, __mod_<name>__*_device_table. */
+ 	unsigned long id_size;
+-	void *function;
++	int (*do_entry)(const char *filename, void *symval, char *alias);
+ };
+ 
+-#define ___cat(a,b) a ## b
+-#define __cat(a,b) ___cat(a,b)
+-
+-/* we need some special handling for this host tool running eventually on
+- * Darwin. The Mach-O section handling is a bit different than ELF section
+- * handling. The differnces in detail are:
+- *  a) we have segments which have sections
+- *  b) we need a API call to get the respective section symbols */
+-#if defined(__MACH__)
+-#include <mach-o/getsect.h>
+-
+-#define INIT_SECTION(name)  do {					\
+-		unsigned long name ## _len;				\
+-		char *__cat(pstart_,name) = getsectdata("__TEXT",	\
+-			#name, &__cat(name,_len));			\
+-		char *__cat(pstop_,name) = __cat(pstart_,name) +	\
+-			__cat(name, _len);				\
+-		__cat(__start_,name) = (void *)__cat(pstart_,name);	\
+-		__cat(__stop_,name) = (void *)__cat(pstop_,name);	\
+-	} while (0)
+-#define SECTION(name)   __attribute__((section("__TEXT, " #name)))
+-
+-struct devtable **__start___devtable, **__stop___devtable;
+-#else
+-#define INIT_SECTION(name) /* no-op for ELF */
+-#define SECTION(name)   __attribute__((section(#name)))
+-
+-/* We construct a table of pointers in an ELF section (pointers generally
+- * go unpadded by gcc).  ld creates boundary syms for us. */
+-extern struct devtable *__start___devtable[], *__stop___devtable[];
+-#endif /* __MACH__ */
+-
+-#if !defined(__used)
+-# if __GNUC__ == 3 && __GNUC_MINOR__ < 3
+-#  define __used			__attribute__((__unused__))
+-# else
+-#  define __used			__attribute__((__used__))
+-# endif
+-#endif
+-
+ /* Define a variable f that holds the value of field f of struct devid
+  * based at address m.
+  */
+@@ -102,16 +62,6 @@ extern struct devtable *__start___devtable[], *__stop___devtable[];
+ #define DEF_FIELD_ADDR(m, devid, f) \
+ 	typeof(((struct devid *)0)->f) *f = ((m) + OFF_##devid##_##f)
+ 
+-/* Add a table entry.  We test function type matches while we're here. */
+-#define ADD_TO_DEVTABLE(device_id, type, function) \
+-	static struct devtable __cat(devtable,__LINE__) = {	\
+-		device_id + 0*sizeof((function)((const char *)NULL,	\
+-						(void *)NULL,		\
+-						(char *)NULL)),		\
+-		SIZE_##type, (function) };				\
+-	static struct devtable *SECTION(__devtable) __used \
+-		__cat(devtable_ptr,__LINE__) = &__cat(devtable,__LINE__)
+-
+ #define ADD(str, sep, cond, field)                              \
+ do {                                                            \
+         strcat(str, sep);                                       \
+@@ -431,7 +381,6 @@ static int do_hid_entry(const char *filename,
+ 
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("hid", hid_device_id, do_hid_entry);
+ 
+ /* Looks like: ieee1394:venNmoNspNverN */
+ static int do_ieee1394_entry(const char *filename,
+@@ -456,7 +405,6 @@ static int do_ieee1394_entry(const char *filename,
+ 	add_wildcard(alias);
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("ieee1394", ieee1394_device_id, do_ieee1394_entry);
+ 
+ /* Looks like: pci:vNdNsvNsdNbcNscNiN. */
+ static int do_pci_entry(const char *filename,
+@@ -500,7 +448,6 @@ static int do_pci_entry(const char *filename,
+ 	add_wildcard(alias);
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("pci", pci_device_id, do_pci_entry);
+ 
+ /* looks like: "ccw:tNmNdtNdmN" */
+ static int do_ccw_entry(const char *filename,
+@@ -524,7 +471,6 @@ static int do_ccw_entry(const char *filename,
+ 	add_wildcard(alias);
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("ccw", ccw_device_id, do_ccw_entry);
+ 
+ /* looks like: "ap:tN" */
+ static int do_ap_entry(const char *filename,
+@@ -535,7 +481,6 @@ static int do_ap_entry(const char *filename,
+ 	sprintf(alias, "ap:t%02X*", dev_type);
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("ap", ap_device_id, do_ap_entry);
+ 
+ /* looks like: "css:tN" */
+ static int do_css_entry(const char *filename,
+@@ -546,7 +491,6 @@ static int do_css_entry(const char *filename,
+ 	sprintf(alias, "css:t%01X", type);
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("css", css_device_id, do_css_entry);
+ 
+ /* Looks like: "serio:tyNprNidNexN" */
+ static int do_serio_entry(const char *filename,
+@@ -566,7 +510,6 @@ static int do_serio_entry(const char *filename,
+ 	add_wildcard(alias);
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("serio", serio_device_id, do_serio_entry);
+ 
+ /* looks like: "acpi:ACPI0003" or "acpi:PNP0C0B" or "acpi:LNXVIDEO" or
+  *             "acpi:bbsspp" (bb=base-class, ss=sub-class, pp=prog-if)
+@@ -604,7 +547,6 @@ static int do_acpi_entry(const char *filename,
+ 	}
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("acpi", acpi_device_id, do_acpi_entry);
+ 
+ /* looks like: "pnp:dD" */
+ static void do_pnp_device_entry(void *symval, unsigned long size,
+@@ -725,7 +667,6 @@ static int do_pcmcia_entry(const char *filename,
+ 	add_wildcard(alias);
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("pcmcia", pcmcia_device_id, do_pcmcia_entry);
+ 
+ static int do_vio_entry(const char *filename, void *symval,
+ 		char *alias)
+@@ -745,7 +686,6 @@ static int do_vio_entry(const char *filename, void *symval,
+ 	add_wildcard(alias);
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("vio", vio_device_id, do_vio_entry);
+ 
+ #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
+ 
+@@ -818,7 +758,6 @@ static int do_input_entry(const char *filename, void *symval,
+ 		do_input(alias, *swbit, 0, INPUT_DEVICE_ID_SW_MAX);
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("input", input_device_id, do_input_entry);
+ 
+ static int do_eisa_entry(const char *filename, void *symval,
+ 		char *alias)
+@@ -830,7 +769,6 @@ static int do_eisa_entry(const char *filename, void *symval,
+ 		strcat(alias, "*");
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("eisa", eisa_device_id, do_eisa_entry);
+ 
+ /* Looks like: parisc:tNhvNrevNsvN */
+ static int do_parisc_entry(const char *filename, void *symval,
+@@ -850,7 +788,6 @@ static int do_parisc_entry(const char *filename, void *symval,
+ 	add_wildcard(alias);
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("parisc", parisc_device_id, do_parisc_entry);
+ 
+ /* Looks like: sdio:cNvNdN. */
+ static int do_sdio_entry(const char *filename,
+@@ -867,7 +804,6 @@ static int do_sdio_entry(const char *filename,
+ 	add_wildcard(alias);
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("sdio", sdio_device_id, do_sdio_entry);
+ 
+ /* Looks like: ssb:vNidNrevN. */
+ static int do_ssb_entry(const char *filename,
+@@ -884,7 +820,6 @@ static int do_ssb_entry(const char *filename,
+ 	add_wildcard(alias);
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("ssb", ssb_device_id, do_ssb_entry);
+ 
+ /* Looks like: bcma:mNidNrevNclN. */
+ static int do_bcma_entry(const char *filename,
+@@ -903,7 +838,6 @@ static int do_bcma_entry(const char *filename,
+ 	add_wildcard(alias);
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("bcma", bcma_device_id, do_bcma_entry);
+ 
+ /* Looks like: virtio:dNvN */
+ static int do_virtio_entry(const char *filename, void *symval,
+@@ -919,7 +853,6 @@ static int do_virtio_entry(const char *filename, void *symval,
+ 	add_wildcard(alias);
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("virtio", virtio_device_id, do_virtio_entry);
+ 
+ /*
+  * Looks like: vmbus:guid
+@@ -942,7 +875,6 @@ static int do_vmbus_entry(const char *filename, void *symval,
+ 
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("vmbus", hv_vmbus_device_id, do_vmbus_entry);
+ 
+ /* Looks like: i2c:S */
+ static int do_i2c_entry(const char *filename, void *symval,
+@@ -953,7 +885,6 @@ static int do_i2c_entry(const char *filename, void *symval,
+ 
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("i2c", i2c_device_id, do_i2c_entry);
+ 
+ /* Looks like: spi:S */
+ static int do_spi_entry(const char *filename, void *symval,
+@@ -964,7 +895,6 @@ static int do_spi_entry(const char *filename, void *symval,
+ 
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("spi", spi_device_id, do_spi_entry);
+ 
+ static const struct dmifield {
+ 	const char *prefix;
+@@ -1019,7 +949,6 @@ static int do_dmi_entry(const char *filename, void *symval,
+ 	strcat(alias, ":");
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("dmi", dmi_system_id, do_dmi_entry);
+ 
+ static int do_platform_entry(const char *filename,
+ 			     void *symval, char *alias)
+@@ -1028,7 +957,6 @@ static int do_platform_entry(const char *filename,
+ 	sprintf(alias, PLATFORM_MODULE_PREFIX "%s", *name);
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("platform", platform_device_id, do_platform_entry);
+ 
+ static int do_mdio_entry(const char *filename,
+ 			 void *symval, char *alias)
+@@ -1053,7 +981,6 @@ static int do_mdio_entry(const char *filename,
+ 
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("mdio", mdio_device_id, do_mdio_entry);
+ 
+ /* Looks like: zorro:iN. */
+ static int do_zorro_entry(const char *filename, void *symval,
+@@ -1064,7 +991,6 @@ static int do_zorro_entry(const char *filename, void *symval,
+ 	ADD(alias, "i", id != ZORRO_WILDCARD, id);
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("zorro", zorro_device_id, do_zorro_entry);
+ 
+ /* looks like: "pnp:dD" */
+ static int do_isapnp_entry(const char *filename,
+@@ -1080,7 +1006,6 @@ static int do_isapnp_entry(const char *filename,
+ 		(function >> 12) & 0x0f, (function >> 8) & 0x0f);
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("isapnp", isapnp_device_id, do_isapnp_entry);
+ 
+ /* Looks like: "ipack:fNvNdN". */
+ static int do_ipack_entry(const char *filename,
+@@ -1096,7 +1021,6 @@ static int do_ipack_entry(const char *filename,
+ 	add_wildcard(alias);
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("ipack", ipack_device_id, do_ipack_entry);
+ 
+ /*
+  * Append a match expression for a single masked hex digit.
+@@ -1167,7 +1091,6 @@ static int do_amba_entry(const char *filename,
+ 
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("amba", amba_id, do_amba_entry);
+ 
+ /*
+  * looks like: "mipscdmm:tN"
+@@ -1183,7 +1106,6 @@ static int do_mips_cdmm_entry(const char *filename,
+ 	sprintf(alias, "mipscdmm:t%02X*", type);
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("mipscdmm", mips_cdmm_device_id, do_mips_cdmm_entry);
+ 
+ /* LOOKS like cpu:type:x86,venVVVVfamFFFFmodMMMM:feature:*,FEAT,*
+  * All fields are numbers. It would be nicer to use strings for vendor
+@@ -1208,7 +1130,6 @@ static int do_x86cpu_entry(const char *filename, void *symval,
+ 		sprintf(alias + strlen(alias), "%04X*", feature);
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("x86cpu", x86_cpu_id, do_x86cpu_entry);
+ 
+ /* LOOKS like cpu:type:*:feature:*FEAT* */
+ static int do_cpu_entry(const char *filename, void *symval, char *alias)
+@@ -1218,7 +1139,6 @@ static int do_cpu_entry(const char *filename, void *symval, char *alias)
+ 	sprintf(alias, "cpu:type:*:feature:*%04X*", feature);
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("cpu", cpu_feature, do_cpu_entry);
+ 
+ /* Looks like: mei:S:uuid:N:* */
+ static int do_mei_entry(const char *filename, void *symval,
+@@ -1237,7 +1157,6 @@ static int do_mei_entry(const char *filename, void *symval,
+ 
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("mei", mei_cl_device_id, do_mei_entry);
+ 
+ /* Looks like: rapidio:vNdNavNadN */
+ static int do_rio_entry(const char *filename,
+@@ -1257,7 +1176,6 @@ static int do_rio_entry(const char *filename,
+ 	add_wildcard(alias);
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("rapidio", rio_device_id, do_rio_entry);
+ 
+ /* Looks like: ulpi:vNpN */
+ static int do_ulpi_entry(const char *filename, void *symval,
+@@ -1270,7 +1188,6 @@ static int do_ulpi_entry(const char *filename, void *symval,
+ 
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("ulpi", ulpi_device_id, do_ulpi_entry);
+ 
+ /* Looks like: hdaudio:vNrNaN */
+ static int do_hda_entry(const char *filename, void *symval, char *alias)
+@@ -1287,7 +1204,6 @@ static int do_hda_entry(const char *filename, void *symval, char *alias)
+ 	add_wildcard(alias);
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("hdaudio", hda_device_id, do_hda_entry);
+ 
+ /* Looks like: fsl-mc:vNdN */
+ static int do_fsl_mc_entry(const char *filename, void *symval,
+@@ -1299,7 +1215,6 @@ static int do_fsl_mc_entry(const char *filename, void *symval,
+ 	sprintf(alias, "fsl-mc:v%08Xd%s", vendor, *obj_type);
+ 	return 1;
+ }
+-ADD_TO_DEVTABLE("fslmc", fsl_mc_device_id, do_fsl_mc_entry);
+ 
+ /* Does namelen bytes of name exactly match the symbol? */
+ static bool sym_is(const char *name, unsigned namelen, const char *symbol)
+@@ -1313,12 +1228,11 @@ static bool sym_is(const char *name, unsigned namelen, const char *symbol)
+ static void do_table(void *symval, unsigned long size,
+ 		     unsigned long id_size,
+ 		     const char *device_id,
+-		     void *function,
++		     int (*do_entry)(const char *filename, void *symval, char *alias),
+ 		     struct module *mod)
+ {
+ 	unsigned int i;
+ 	char alias[500];
+-	int (*do_entry)(const char *, void *entry, char *alias) = function;
+ 
+ 	device_id_check(mod->name, device_id, size, id_size, symval);
+ 	/* Leave last one: it's the terminator. */
+@@ -1332,6 +1246,44 @@ static void do_table(void *symval, unsigned long size,
+ 	}
+ }
+ 
++static const struct devtable devtable[] = {
++	{"hid", SIZE_hid_device_id, do_hid_entry},
++	{"ieee1394", SIZE_ieee1394_device_id, do_ieee1394_entry},
++	{"pci", SIZE_pci_device_id, do_pci_entry},
++	{"ccw", SIZE_ccw_device_id, do_ccw_entry},
++	{"ap", SIZE_ap_device_id, do_ap_entry},
++	{"css", SIZE_css_device_id, do_css_entry},
++	{"serio", SIZE_serio_device_id, do_serio_entry},
++	{"acpi", SIZE_acpi_device_id, do_acpi_entry},
++	{"pcmcia", SIZE_pcmcia_device_id, do_pcmcia_entry},
++	{"vio", SIZE_vio_device_id, do_vio_entry},
++	{"input", SIZE_input_device_id, do_input_entry},
++	{"eisa", SIZE_eisa_device_id, do_eisa_entry},
++	{"parisc", SIZE_parisc_device_id, do_parisc_entry},
++	{"sdio", SIZE_sdio_device_id, do_sdio_entry},
++	{"ssb", SIZE_ssb_device_id, do_ssb_entry},
++	{"bcma", SIZE_bcma_device_id, do_bcma_entry},
++	{"virtio", SIZE_virtio_device_id, do_virtio_entry},
++	{"vmbus", SIZE_hv_vmbus_device_id, do_vmbus_entry},
++	{"i2c", SIZE_i2c_device_id, do_i2c_entry},
++	{"spi", SIZE_spi_device_id, do_spi_entry},
++	{"dmi", SIZE_dmi_system_id, do_dmi_entry},
++	{"platform", SIZE_platform_device_id, do_platform_entry},
++	{"mdio", SIZE_mdio_device_id, do_mdio_entry},
++	{"zorro", SIZE_zorro_device_id, do_zorro_entry},
++	{"isapnp", SIZE_isapnp_device_id, do_isapnp_entry},
++	{"ipack", SIZE_ipack_device_id, do_ipack_entry},
++	{"amba", SIZE_amba_id, do_amba_entry},
++	{"mipscdmm", SIZE_mips_cdmm_device_id, do_mips_cdmm_entry},
++	{"x86cpu", SIZE_x86_cpu_id, do_x86cpu_entry},
++	{"cpu", SIZE_cpu_feature, do_cpu_entry},
++	{"mei", SIZE_mei_cl_device_id, do_mei_entry},
++	{"rapidio", SIZE_rio_device_id, do_rio_entry},
++	{"ulpi", SIZE_ulpi_device_id, do_ulpi_entry},
++	{"hdaudio", SIZE_hda_device_id, do_hda_entry},
++	{"fslmc", SIZE_fsl_mc_device_id, do_fsl_mc_entry},
++};
++
+ /* Create MODULE_ALIAS() statements.
+  * At this time, we cannot write the actual output C source yet,
+  * so we write into the mod->dev_table_buf buffer. */
+@@ -1386,13 +1338,14 @@ void handle_moddevtable(struct module *mod, struct elf_info *info,
+ 	else if (sym_is(name, namelen, "pnp_card"))
+ 		do_pnp_card_entries(symval, sym->st_size, mod);
+ 	else {
+-		struct devtable **p;
+-		INIT_SECTION(__devtable);
++		int i;
++
++		for (i = 0; i < ARRAY_SIZE(devtable); i++) {
++			const struct devtable *p = &devtable[i];
+ 
+-		for (p = __start___devtable; p < __stop___devtable; p++) {
+-			if (sym_is(name, namelen, (*p)->device_id)) {
+-				do_table(symval, sym->st_size, (*p)->id_size,
+-					 (*p)->device_id, (*p)->function, mod);
++			if (sym_is(name, namelen, p->device_id)) {
++				do_table(symval, sym->st_size, p->id_size,
++					 p->device_id, p->do_entry, mod);
+ 				break;
+ 			}
+ 		}
+diff --git a/security/device_cgroup.c b/security/device_cgroup.c
+index 03c1652c9a1f..db3bdc91c520 100644
+--- a/security/device_cgroup.c
++++ b/security/device_cgroup.c
+@@ -568,7 +568,7 @@ static int propagate_exception(struct dev_cgroup *devcg_root,
+ 		    devcg->behavior == DEVCG_DEFAULT_ALLOW) {
+ 			rc = dev_exception_add(devcg, ex);
+ 			if (rc)
+-				break;
++				return rc;
+ 		} else {
+ 			/*
+ 			 * in the other possible cases:
+diff --git a/sound/core/info.c b/sound/core/info.c
+index 8ab72e0f5932..358a6947342d 100644
+--- a/sound/core/info.c
++++ b/sound/core/info.c
+@@ -724,8 +724,11 @@ snd_info_create_entry(const char *name, struct snd_info_entry *parent)
+ 	INIT_LIST_HEAD(&entry->children);
+ 	INIT_LIST_HEAD(&entry->list);
+ 	entry->parent = parent;
+-	if (parent)
++	if (parent) {
++		mutex_lock(&parent->access);
+ 		list_add_tail(&entry->list, &parent->children);
++		mutex_unlock(&parent->access);
++	}
+ 	return entry;
+ }
+ 
+@@ -809,7 +812,12 @@ void snd_info_free_entry(struct snd_info_entry * entry)
+ 	list_for_each_entry_safe(p, n, &entry->children, list)
+ 		snd_info_free_entry(p);
+ 
+-	list_del(&entry->list);
++	p = entry->parent;
++	if (p) {
++		mutex_lock(&p->access);
++		list_del(&entry->list);
++		mutex_unlock(&p->access);
++	}
+ 	kfree(entry->name);
+ 	if (entry->private_free)
+ 		entry->private_free(entry);
+diff --git a/sound/core/init.c b/sound/core/init.c
+index 6bda8436d765..02e96c580cb7 100644
+--- a/sound/core/init.c
++++ b/sound/core/init.c
+@@ -408,14 +408,7 @@ int snd_card_disconnect(struct snd_card *card)
+ 	card->shutdown = 1;
+ 	spin_unlock(&card->files_lock);
+ 
+-	/* phase 1: disable fops (user space) operations for ALSA API */
+-	mutex_lock(&snd_card_mutex);
+-	snd_cards[card->number] = NULL;
+-	clear_bit(card->number, snd_cards_lock);
+-	mutex_unlock(&snd_card_mutex);
+-	
+-	/* phase 2: replace file->f_op with special dummy operations */
+-	
++	/* replace file->f_op with special dummy operations */
+ 	spin_lock(&card->files_lock);
+ 	list_for_each_entry(mfile, &card->files_list, list) {
+ 		/* it's critical part, use endless loop */
+@@ -431,7 +424,7 @@ int snd_card_disconnect(struct snd_card *card)
+ 	}
+ 	spin_unlock(&card->files_lock);	
+ 
+-	/* phase 3: notify all connected devices about disconnection */
++	/* notify all connected devices about disconnection */
+ 	/* at this point, they cannot respond to any calls except release() */
+ 
+ #if IS_ENABLED(CONFIG_SND_MIXER_OSS)
+@@ -447,6 +440,13 @@ int snd_card_disconnect(struct snd_card *card)
+ 		device_del(&card->card_dev);
+ 		card->registered = false;
+ 	}
++
++	/* disable fops (user space) operations for ALSA API */
++	mutex_lock(&snd_card_mutex);
++	snd_cards[card->number] = NULL;
++	clear_bit(card->number, snd_cards_lock);
++	mutex_unlock(&snd_card_mutex);
++
+ #ifdef CONFIG_PM
+ 	wake_up(&card->power_sleep);
+ #endif