Linux patch 4.9.2394.9-243

Signed-off-by: Mike Pagano <mpagano@gentoo.org>

2 files changed, 2080 insertions, 0 deletions

diff --git a/0000_README b/0000_README
index c39cf2ba..6245b96b 100644
--- a/0000_README
+++ b/0000_README
@@ -995,6 +995,10 @@ Patch:  1237_linux-4.9.238.patch
 From:   http://www.kernel.org
 Desc:   Linux 4.9.238
 
+Patch:  1238_linux-4.9.239.patch
+From:   http://www.kernel.org
+Desc:   Linux 4.9.239
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.
diff --git a/1238_linux-4.9.239.patch b/1238_linux-4.9.239.patch
new file mode 100644
index 00000000..87fa31f5
--- /dev/null
+++ b/1238_linux-4.9.239.patch
@@ -0,0 +1,2076 @@
+diff --git a/Makefile b/Makefile
+index 41a7d6626e354..82bb1b27d2f57 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 9
+-SUBLEVEL = 238
++SUBLEVEL = 239
+ EXTRAVERSION =
+ NAME = Roaring Lionus
+ 
+diff --git a/drivers/base/dd.c b/drivers/base/dd.c
+index 854d218ea76ac..ff59a1851cb4d 100644
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -343,7 +343,8 @@ static int really_probe(struct device *dev, struct device_driver *drv)
+ 		 drv->bus->name, __func__, drv->name, dev_name(dev));
+ 	if (!list_empty(&dev->devres_head)) {
+ 		dev_crit(dev, "Resources present before probing\n");
+-		return -EBUSY;
++		ret = -EBUSY;
++		goto done;
+ 	}
+ 
+ re_probe:
+@@ -446,7 +447,7 @@ pinctrl_bind_failed:
+ 	ret = 0;
+ done:
+ 	atomic_dec(&probe_count);
+-	wake_up(&probe_waitqueue);
++	wake_up_all(&probe_waitqueue);
+ 	return ret;
+ }
+ 
+diff --git a/drivers/clk/samsung/clk-exynos4.c b/drivers/clk/samsung/clk-exynos4.c
+index 91f9b79e39411..9a9402f568ef6 100644
+--- a/drivers/clk/samsung/clk-exynos4.c
++++ b/drivers/clk/samsung/clk-exynos4.c
+@@ -1060,7 +1060,7 @@ static const struct samsung_gate_clock exynos4210_gate_clks[] __initconst = {
+ 	GATE(CLK_PCIE, "pcie", "aclk133", GATE_IP_FSYS, 14, 0, 0),
+ 	GATE(CLK_SMMU_PCIE, "smmu_pcie", "aclk133", GATE_IP_FSYS, 18, 0, 0),
+ 	GATE(CLK_MODEMIF, "modemif", "aclk100", GATE_IP_PERIL, 28, 0, 0),
+-	GATE(CLK_CHIPID, "chipid", "aclk100", E4210_GATE_IP_PERIR, 0, 0, 0),
++	GATE(CLK_CHIPID, "chipid", "aclk100", E4210_GATE_IP_PERIR, 0, CLK_IGNORE_UNUSED, 0),
+ 	GATE(CLK_SYSREG, "sysreg", "aclk100", E4210_GATE_IP_PERIR, 0,
+ 			CLK_IGNORE_UNUSED, 0),
+ 	GATE(CLK_HDMI_CEC, "hdmi_cec", "aclk100", E4210_GATE_IP_PERIR, 11, 0,
+@@ -1101,7 +1101,7 @@ static const struct samsung_gate_clock exynos4x12_gate_clks[] __initconst = {
+ 		0),
+ 	GATE(CLK_TSADC, "tsadc", "aclk133", E4X12_GATE_BUS_FSYS1, 16, 0, 0),
+ 	GATE(CLK_MIPI_HSI, "mipi_hsi", "aclk133", GATE_IP_FSYS, 10, 0, 0),
+-	GATE(CLK_CHIPID, "chipid", "aclk100", E4X12_GATE_IP_PERIR, 0, 0, 0),
++	GATE(CLK_CHIPID, "chipid", "aclk100", E4X12_GATE_IP_PERIR, 0, CLK_IGNORE_UNUSED, 0),
+ 	GATE(CLK_SYSREG, "sysreg", "aclk100", E4X12_GATE_IP_PERIR, 1,
+ 			CLK_IGNORE_UNUSED, 0),
+ 	GATE(CLK_HDMI_CEC, "hdmi_cec", "aclk100", E4X12_GATE_IP_PERIR, 11, 0,
+diff --git a/drivers/gpio/gpio-tc3589x.c b/drivers/gpio/gpio-tc3589x.c
+index d6e21f1a70a9d..6cc7c5d59e460 100644
+--- a/drivers/gpio/gpio-tc3589x.c
++++ b/drivers/gpio/gpio-tc3589x.c
+@@ -210,7 +210,7 @@ static void tc3589x_gpio_irq_sync_unlock(struct irq_data *d)
+ 				continue;
+ 
+ 			tc3589x_gpio->oldregs[i][j] = new;
+-			tc3589x_reg_write(tc3589x, regmap[i] + j * 8, new);
++			tc3589x_reg_write(tc3589x, regmap[i] + j, new);
+ 		}
+ 	}
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
+index fdf7a18058881..fd97532bf7ebc 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_display.c
+@@ -283,7 +283,7 @@ int amdgpu_crtc_set_config(struct drm_mode_set *set)
+ 	   take the current one */
+ 	if (active && !adev->have_disp_power_ref) {
+ 		adev->have_disp_power_ref = true;
+-		goto out;
++		return ret;
+ 	}
+ 	/* if we have no active crtcs, then drop the power ref
+ 	   we got before */
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+index 05ff98b43c50f..80c60a62d39ef 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+@@ -637,6 +637,7 @@ static int amdgpu_ttm_tt_pin_userptr(struct ttm_tt *ttm)
+ 
+ release_sg:
+ 	kfree(ttm->sg);
++	ttm->sg = NULL;
+ 	return r;
+ }
+ 
+diff --git a/drivers/i2c/busses/i2c-cpm.c b/drivers/i2c/busses/i2c-cpm.c
+index d89bde2c5da25..cf285b97a6422 100644
+--- a/drivers/i2c/busses/i2c-cpm.c
++++ b/drivers/i2c/busses/i2c-cpm.c
+@@ -74,6 +74,9 @@ struct i2c_ram {
+ 	char    res1[4];	/* Reserved */
+ 	ushort  rpbase;		/* Relocation pointer */
+ 	char    res2[2];	/* Reserved */
++	/* The following elements are only for CPM2 */
++	char    res3[4];	/* Reserved */
++	uint    sdmatmp;	/* Internal */
+ };
+ 
+ #define I2COM_START	0x80
+diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
+index e5799639fb544..82ff44637ed78 100644
+--- a/drivers/input/serio/i8042-x86ia64io.h
++++ b/drivers/input/serio/i8042-x86ia64io.h
+@@ -797,6 +797,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nopnp_table[] = {
+ 			DMI_MATCH(DMI_BOARD_VENDOR, "MICRO-STAR INTERNATIONAL CO., LTD"),
+ 		},
+ 	},
++	{
++		/* Acer Aspire 5 A515 */
++		.matches = {
++			DMI_MATCH(DMI_BOARD_NAME, "Grumpy_PK"),
++			DMI_MATCH(DMI_BOARD_VENDOR, "PK"),
++		},
++	},
+ 	{ }
+ };
+ 
+diff --git a/drivers/iommu/exynos-iommu.c b/drivers/iommu/exynos-iommu.c
+index beef59eb94fa7..626b434e7967a 100644
+--- a/drivers/iommu/exynos-iommu.c
++++ b/drivers/iommu/exynos-iommu.c
+@@ -1265,13 +1265,17 @@ static int exynos_iommu_of_xlate(struct device *dev,
+ 		return -ENODEV;
+ 
+ 	data = platform_get_drvdata(sysmmu);
+-	if (!data)
++	if (!data) {
++		put_device(&sysmmu->dev);
+ 		return -ENODEV;
++	}
+ 
+ 	if (!owner) {
+ 		owner = kzalloc(sizeof(*owner), GFP_KERNEL);
+-		if (!owner)
++		if (!owner) {
++			put_device(&sysmmu->dev);
+ 			return -ENOMEM;
++		}
+ 
+ 		INIT_LIST_HEAD(&owner->controllers);
+ 		dev->archdata.iommu = owner;
+diff --git a/drivers/mtd/nand/sunxi_nand.c b/drivers/mtd/nand/sunxi_nand.c
+index ddf3e24cc2898..2cf19372efb90 100644
+--- a/drivers/mtd/nand/sunxi_nand.c
++++ b/drivers/mtd/nand/sunxi_nand.c
+@@ -2108,7 +2108,7 @@ static int sunxi_nand_chip_init(struct device *dev, struct sunxi_nfc *nfc,
+ 	ret = mtd_device_register(mtd, NULL, 0);
+ 	if (ret) {
+ 		dev_err(dev, "failed to register mtd device: %d\n", ret);
+-		nand_release(nand);
++		nand_cleanup(nand);
+ 		return ret;
+ 	}
+ 
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 8322129c3f987..240d7850c8252 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -1129,6 +1129,7 @@ static void bond_setup_by_slave(struct net_device *bond_dev,
+ 
+ 	bond_dev->type		    = slave_dev->type;
+ 	bond_dev->hard_header_len   = slave_dev->hard_header_len;
++	bond_dev->needed_headroom   = slave_dev->needed_headroom;
+ 	bond_dev->addr_len	    = slave_dev->addr_len;
+ 
+ 	memcpy(bond_dev->broadcast, slave_dev->broadcast,
+diff --git a/drivers/net/ethernet/dec/tulip/de2104x.c b/drivers/net/ethernet/dec/tulip/de2104x.c
+index cadcee645f74e..11ce50a057998 100644
+--- a/drivers/net/ethernet/dec/tulip/de2104x.c
++++ b/drivers/net/ethernet/dec/tulip/de2104x.c
+@@ -91,7 +91,7 @@ MODULE_PARM_DESC (rx_copybreak, "de2104x Breakpoint at which Rx packets are copi
+ #define DSL			CONFIG_DE2104X_DSL
+ #endif
+ 
+-#define DE_RX_RING_SIZE		64
++#define DE_RX_RING_SIZE		128
+ #define DE_TX_RING_SIZE		64
+ #define DE_RING_BYTES		\
+ 		((sizeof(struct de_desc) * DE_RX_RING_SIZE) +	\
+diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
+index a5de56bcbac08..93d3152752ff4 100644
+--- a/drivers/net/ethernet/renesas/ravb_main.c
++++ b/drivers/net/ethernet/renesas/ravb_main.c
+@@ -1336,51 +1336,6 @@ static inline int ravb_hook_irq(unsigned int irq, irq_handler_t handler,
+ 	return error;
+ }
+ 
+-/* MDIO bus init function */
+-static int ravb_mdio_init(struct ravb_private *priv)
+-{
+-	struct platform_device *pdev = priv->pdev;
+-	struct device *dev = &pdev->dev;
+-	int error;
+-
+-	/* Bitbang init */
+-	priv->mdiobb.ops = &bb_ops;
+-
+-	/* MII controller setting */
+-	priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb);
+-	if (!priv->mii_bus)
+-		return -ENOMEM;
+-
+-	/* Hook up MII support for ethtool */
+-	priv->mii_bus->name = "ravb_mii";
+-	priv->mii_bus->parent = dev;
+-	snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x",
+-		 pdev->name, pdev->id);
+-
+-	/* Register MDIO bus */
+-	error = of_mdiobus_register(priv->mii_bus, dev->of_node);
+-	if (error)
+-		goto out_free_bus;
+-
+-	return 0;
+-
+-out_free_bus:
+-	free_mdio_bitbang(priv->mii_bus);
+-	return error;
+-}
+-
+-/* MDIO bus release function */
+-static int ravb_mdio_release(struct ravb_private *priv)
+-{
+-	/* Unregister mdio bus */
+-	mdiobus_unregister(priv->mii_bus);
+-
+-	/* Free bitbang info */
+-	free_mdio_bitbang(priv->mii_bus);
+-
+-	return 0;
+-}
+-
+ /* Network device open function for Ethernet AVB */
+ static int ravb_open(struct net_device *ndev)
+ {
+@@ -1389,13 +1344,6 @@ static int ravb_open(struct net_device *ndev)
+ 	struct device *dev = &pdev->dev;
+ 	int error;
+ 
+-	/* MDIO bus init */
+-	error = ravb_mdio_init(priv);
+-	if (error) {
+-		netdev_err(ndev, "failed to initialize MDIO\n");
+-		return error;
+-	}
+-
+ 	napi_enable(&priv->napi[RAVB_BE]);
+ 	napi_enable(&priv->napi[RAVB_NC]);
+ 
+@@ -1473,7 +1421,6 @@ out_free_irq:
+ out_napi_off:
+ 	napi_disable(&priv->napi[RAVB_NC]);
+ 	napi_disable(&priv->napi[RAVB_BE]);
+-	ravb_mdio_release(priv);
+ 	return error;
+ }
+ 
+@@ -1771,8 +1718,6 @@ static int ravb_close(struct net_device *ndev)
+ 	ravb_ring_free(ndev, RAVB_BE);
+ 	ravb_ring_free(ndev, RAVB_NC);
+ 
+-	ravb_mdio_release(priv);
+-
+ 	return 0;
+ }
+ 
+@@ -1875,6 +1820,51 @@ static const struct net_device_ops ravb_netdev_ops = {
+ 	.ndo_change_mtu		= eth_change_mtu,
+ };
+ 
++/* MDIO bus init function */
++static int ravb_mdio_init(struct ravb_private *priv)
++{
++	struct platform_device *pdev = priv->pdev;
++	struct device *dev = &pdev->dev;
++	int error;
++
++	/* Bitbang init */
++	priv->mdiobb.ops = &bb_ops;
++
++	/* MII controller setting */
++	priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb);
++	if (!priv->mii_bus)
++		return -ENOMEM;
++
++	/* Hook up MII support for ethtool */
++	priv->mii_bus->name = "ravb_mii";
++	priv->mii_bus->parent = dev;
++	snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x",
++		 pdev->name, pdev->id);
++
++	/* Register MDIO bus */
++	error = of_mdiobus_register(priv->mii_bus, dev->of_node);
++	if (error)
++		goto out_free_bus;
++
++	return 0;
++
++out_free_bus:
++	free_mdio_bitbang(priv->mii_bus);
++	return error;
++}
++
++/* MDIO bus release function */
++static int ravb_mdio_release(struct ravb_private *priv)
++{
++	/* Unregister mdio bus */
++	mdiobus_unregister(priv->mii_bus);
++
++	/* Free bitbang info */
++	free_mdio_bitbang(priv->mii_bus);
++
++	return 0;
++}
++
+ static const struct of_device_id ravb_match_table[] = {
+ 	{ .compatible = "renesas,etheravb-r8a7790", .data = (void *)RCAR_GEN2 },
+ 	{ .compatible = "renesas,etheravb-r8a7794", .data = (void *)RCAR_GEN2 },
+@@ -2079,6 +2069,13 @@ static int ravb_probe(struct platform_device *pdev)
+ 		eth_hw_addr_random(ndev);
+ 	}
+ 
++	/* MDIO bus init */
++	error = ravb_mdio_init(priv);
++	if (error) {
++		dev_err(&pdev->dev, "failed to initialize MDIO\n");
++		goto out_dma_free;
++	}
++
+ 	netif_napi_add(ndev, &priv->napi[RAVB_BE], ravb_poll, 64);
+ 	netif_napi_add(ndev, &priv->napi[RAVB_NC], ravb_poll, 64);
+ 
+@@ -2098,6 +2095,8 @@ static int ravb_probe(struct platform_device *pdev)
+ out_napi_del:
+ 	netif_napi_del(&priv->napi[RAVB_NC]);
+ 	netif_napi_del(&priv->napi[RAVB_BE]);
++	ravb_mdio_release(priv);
++out_dma_free:
+ 	dma_free_coherent(ndev->dev.parent, priv->desc_bat_size, priv->desc_bat,
+ 			  priv->desc_bat_dma);
+ 
+@@ -2130,6 +2129,7 @@ static int ravb_remove(struct platform_device *pdev)
+ 	unregister_netdev(ndev);
+ 	netif_napi_del(&priv->napi[RAVB_NC]);
+ 	netif_napi_del(&priv->napi[RAVB_BE]);
++	ravb_mdio_release(priv);
+ 	pm_runtime_disable(&pdev->dev);
+ 	free_netdev(ndev);
+ 	platform_set_drvdata(pdev, NULL);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
+index 3519a8a589dda..c8673e231a880 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
+@@ -678,23 +678,16 @@ static int stmmac_ethtool_op_set_eee(struct net_device *dev,
+ 	struct stmmac_priv *priv = netdev_priv(dev);
+ 	int ret;
+ 
+-	if (!edata->eee_enabled) {
++	if (!priv->dma_cap.eee)
++		return -EOPNOTSUPP;
++
++	if (!edata->eee_enabled)
+ 		stmmac_disable_eee_mode(priv);
+-	} else {
+-		/* We are asking for enabling the EEE but it is safe
+-		 * to verify all by invoking the eee_init function.
+-		 * In case of failure it will return an error.
+-		 */
+-		edata->eee_enabled = stmmac_eee_init(priv);
+-		if (!edata->eee_enabled)
+-			return -EOPNOTSUPP;
+-	}
+ 
+ 	ret = phy_ethtool_set_eee(dev->phydev, edata);
+ 	if (ret)
+ 		return ret;
+ 
+-	priv->eee_enabled = edata->eee_enabled;
+ 	priv->tx_lpi_timer = edata->tx_lpi_timer;
+ 	return 0;
+ }
+diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
+index 5defa29069ca3..774b9db0c811f 100644
+--- a/drivers/net/macsec.c
++++ b/drivers/net/macsec.c
+@@ -1087,6 +1087,7 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb)
+ 	struct macsec_rx_sa *rx_sa;
+ 	struct macsec_rxh_data *rxd;
+ 	struct macsec_dev *macsec;
++	unsigned int len;
+ 	sci_t sci;
+ 	u32 pn;
+ 	bool cbit;
+@@ -1242,9 +1243,10 @@ deliver:
+ 	macsec_rxsc_put(rx_sc);
+ 
+ 	skb_orphan(skb);
++	len = skb->len;
+ 	ret = gro_cells_receive(&macsec->gro_cells, skb);
+ 	if (ret == NET_RX_SUCCESS)
+-		count_rx(dev, skb->len);
++		count_rx(dev, len);
+ 	else
+ 		macsec->secy.netdev->stats.rx_dropped++;
+ 
+diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
+index 2651c8d8de2f8..032017bd0ced5 100644
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -135,6 +135,7 @@ config MDIO_THUNDER
+ 	depends on 64BIT
+ 	depends on PCI
+ 	select MDIO_CAVIUM
++	select MDIO_DEVRES
+ 	help
+ 	  This driver supports the MDIO interfaces found on Cavium
+ 	  ThunderX SoCs when the MDIO bus device appears as a PCI
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index cea6d2eabe7e6..001dea7aaba3d 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -299,7 +299,7 @@ inst_rollback:
+ 	for (i--; i >= 0; i--)
+ 		__team_option_inst_del_option(team, dst_opts[i]);
+ 
+-	i = option_count - 1;
++	i = option_count;
+ alloc_rollback:
+ 	for (i--; i >= 0; i--)
+ 		kfree(dst_opts[i]);
+@@ -2085,6 +2085,7 @@ static void team_setup_by_port(struct net_device *dev,
+ 	dev->header_ops	= port_dev->header_ops;
+ 	dev->type = port_dev->type;
+ 	dev->hard_header_len = port_dev->hard_header_len;
++	dev->needed_headroom = port_dev->needed_headroom;
+ 	dev->addr_len = port_dev->addr_len;
+ 	dev->mtu = port_dev->mtu;
+ 	memcpy(dev->broadcast, port_dev->broadcast, port_dev->addr_len);
+diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c
+index 4f4f71b2966ba..9ccbdf1431063 100644
+--- a/drivers/net/usb/rndis_host.c
++++ b/drivers/net/usb/rndis_host.c
+@@ -213,7 +213,7 @@ int rndis_command(struct usbnet *dev, struct rndis_msg_hdr *buf, int buflen)
+ 			dev_dbg(&info->control->dev,
+ 				"rndis response error, code %d\n", retval);
+ 		}
+-		msleep(20);
++		msleep(40);
+ 	}
+ 	dev_dbg(&info->control->dev, "rndis response timeout\n");
+ 	return -ETIMEDOUT;
+diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
+index 9504800217edd..4455493723681 100644
+--- a/drivers/net/usb/rtl8150.c
++++ b/drivers/net/usb/rtl8150.c
+@@ -277,12 +277,20 @@ static int write_mii_word(rtl8150_t * dev, u8 phy, __u8 indx, u16 reg)
+ 		return 1;
+ }
+ 
+-static inline void set_ethernet_addr(rtl8150_t * dev)
++static void set_ethernet_addr(rtl8150_t *dev)
+ {
+-	u8 node_id[6];
++	u8 node_id[ETH_ALEN];
++	int ret;
++
++	ret = get_registers(dev, IDR, sizeof(node_id), node_id);
+ 
+-	get_registers(dev, IDR, sizeof(node_id), node_id);
+-	memcpy(dev->netdev->dev_addr, node_id, sizeof(node_id));
++	if (ret == sizeof(node_id)) {
++		ether_addr_copy(dev->netdev->dev_addr, node_id);
++	} else {
++		eth_hw_addr_random(dev->netdev);
++		netdev_notice(dev->netdev, "Assigned a random MAC address: %pM\n",
++			      dev->netdev->dev_addr);
++	}
+ }
+ 
+ static int rtl8150_set_mac_address(struct net_device *netdev, void *p)
+diff --git a/drivers/net/wan/hdlc_cisco.c b/drivers/net/wan/hdlc_cisco.c
+index 7f99fb666f196..1587789ba9343 100644
+--- a/drivers/net/wan/hdlc_cisco.c
++++ b/drivers/net/wan/hdlc_cisco.c
+@@ -120,6 +120,7 @@ static void cisco_keepalive_send(struct net_device *dev, u32 type,
+ 	skb_put(skb, sizeof(struct cisco_packet));
+ 	skb->priority = TC_PRIO_CONTROL;
+ 	skb->dev = dev;
++	skb->protocol = htons(ETH_P_HDLC);
+ 	skb_reset_network_header(skb);
+ 
+ 	dev_queue_xmit(skb);
+diff --git a/drivers/net/wan/hdlc_fr.c b/drivers/net/wan/hdlc_fr.c
+index b6e0cfb095d35..bba19d068207a 100644
+--- a/drivers/net/wan/hdlc_fr.c
++++ b/drivers/net/wan/hdlc_fr.c
+@@ -435,6 +435,8 @@ static netdev_tx_t pvc_xmit(struct sk_buff *skb, struct net_device *dev)
+ 			if (pvc->state.fecn) /* TX Congestion counter */
+ 				dev->stats.tx_compressed++;
+ 			skb->dev = pvc->frad;
++			skb->protocol = htons(ETH_P_HDLC);
++			skb_reset_network_header(skb);
+ 			dev_queue_xmit(skb);
+ 			return NETDEV_TX_OK;
+ 		}
+@@ -557,6 +559,7 @@ static void fr_lmi_send(struct net_device *dev, int fullrep)
+ 	skb_put(skb, i);
+ 	skb->priority = TC_PRIO_CONTROL;
+ 	skb->dev = dev;
++	skb->protocol = htons(ETH_P_HDLC);
+ 	skb_reset_network_header(skb);
+ 
+ 	dev_queue_xmit(skb);
+diff --git a/drivers/net/wan/hdlc_ppp.c b/drivers/net/wan/hdlc_ppp.c
+index 63546d1317982..35589ee0cde11 100644
+--- a/drivers/net/wan/hdlc_ppp.c
++++ b/drivers/net/wan/hdlc_ppp.c
+@@ -254,6 +254,7 @@ static void ppp_tx_cp(struct net_device *dev, u16 pid, u8 code,
+ 
+ 	skb->priority = TC_PRIO_CONTROL;
+ 	skb->dev = dev;
++	skb->protocol = htons(ETH_P_HDLC);
+ 	skb_reset_network_header(skb);
+ 	skb_queue_tail(&tx_queue, skb);
+ }
+diff --git a/drivers/net/wan/lapbether.c b/drivers/net/wan/lapbether.c
+index c6db9a4e7c457..ef746ba74ab4c 100644
+--- a/drivers/net/wan/lapbether.c
++++ b/drivers/net/wan/lapbether.c
+@@ -201,8 +201,6 @@ static void lapbeth_data_transmit(struct net_device *ndev, struct sk_buff *skb)
+ 	struct net_device *dev;
+ 	int size = skb->len;
+ 
+-	skb->protocol = htons(ETH_P_X25);
+-
+ 	ptr = skb_push(skb, 2);
+ 
+ 	*ptr++ = size % 256;
+@@ -213,6 +211,8 @@ static void lapbeth_data_transmit(struct net_device *ndev, struct sk_buff *skb)
+ 
+ 	skb->dev = dev = lapbeth->ethdev;
+ 
++	skb->protocol = htons(ETH_P_DEC);
++
+ 	skb_reset_network_header(skb);
+ 
+ 	dev_hard_header(skb, dev, ETH_P_DEC, bcast_addr, NULL, 0);
+diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
+index b65ce7519411a..379f9633f78e1 100644
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -2476,7 +2476,7 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
+  */
+ static int hotkey_kthread(void *data)
+ {
+-	struct tp_nvram_state s[2];
++	struct tp_nvram_state s[2] = { 0 };
+ 	u32 poll_mask, event_mask;
+ 	unsigned int si, so;
+ 	unsigned long t;
+@@ -6640,8 +6640,10 @@ static int __init tpacpi_query_bcl_levels(acpi_handle handle)
+ 	list_for_each_entry(child, &device->children, node) {
+ 		acpi_status status = acpi_evaluate_object(child->handle, "_BCL",
+ 							  NULL, &buffer);
+-		if (ACPI_FAILURE(status))
++		if (ACPI_FAILURE(status)) {
++			buffer.length = ACPI_ALLOCATE_BUFFER;
+ 			continue;
++		}
+ 
+ 		obj = (union acpi_object *)buffer.pointer;
+ 		if (!obj || (obj->type != ACPI_TYPE_PACKAGE)) {
+diff --git a/drivers/usb/gadget/function/f_ncm.c b/drivers/usb/gadget/function/f_ncm.c
+index b69747367bd75..0061bf130598e 100644
+--- a/drivers/usb/gadget/function/f_ncm.c
++++ b/drivers/usb/gadget/function/f_ncm.c
+@@ -1217,7 +1217,6 @@ static int ncm_unwrap_ntb(struct gether *port,
+ 	const struct ndp_parser_opts *opts = ncm->parser_opts;
+ 	unsigned	crc_len = ncm->is_crc ? sizeof(uint32_t) : 0;
+ 	int		dgram_counter;
+-	bool		ndp_after_header;
+ 
+ 	/* dwSignature */
+ 	if (get_unaligned_le32(tmp) != opts->nth_sign) {
+@@ -1244,7 +1243,6 @@ static int ncm_unwrap_ntb(struct gether *port,
+ 	}
+ 
+ 	ndp_index = get_ncm(&tmp, opts->ndp_index);
+-	ndp_after_header = false;
+ 
+ 	/* Run through all the NDP's in the NTB */
+ 	do {
+@@ -1260,8 +1258,6 @@ static int ncm_unwrap_ntb(struct gether *port,
+ 			     ndp_index);
+ 			goto err;
+ 		}
+-		if (ndp_index == opts->nth_size)
+-			ndp_after_header = true;
+ 
+ 		/*
+ 		 * walk through NDP
+@@ -1340,37 +1336,13 @@ static int ncm_unwrap_ntb(struct gether *port,
+ 			index2 = get_ncm(&tmp, opts->dgram_item_len);
+ 			dg_len2 = get_ncm(&tmp, opts->dgram_item_len);
+ 
+-			if (index2 == 0 || dg_len2 == 0)
+-				break;
+-
+ 			/* wDatagramIndex[1] */
+-			if (ndp_after_header) {
+-				if (index2 < opts->nth_size + opts->ndp_size) {
+-					INFO(port->func.config->cdev,
+-					     "Bad index: %#X\n", index2);
+-					goto err;
+-				}
+-			} else {
+-				if (index2 < opts->nth_size + opts->dpe_size) {
+-					INFO(port->func.config->cdev,
+-					     "Bad index: %#X\n", index2);
+-					goto err;
+-				}
+-			}
+ 			if (index2 > block_len - opts->dpe_size) {
+ 				INFO(port->func.config->cdev,
+ 				     "Bad index: %#X\n", index2);
+ 				goto err;
+ 			}
+ 
+-			/* wDatagramLength[1] */
+-			if ((dg_len2 < 14 + crc_len) ||
+-					(dg_len2 > frame_max)) {
+-				INFO(port->func.config->cdev,
+-				     "Bad dgram length: %#X\n", dg_len);
+-				goto err;
+-			}
+-
+ 			/*
+ 			 * Copy the data into a new skb.
+ 			 * This ensures the truesize is correct
+@@ -1387,6 +1359,8 @@ static int ncm_unwrap_ntb(struct gether *port,
+ 			ndp_len -= 2 * (opts->dgram_item_len * 2);
+ 
+ 			dgram_counter++;
++			if (index2 == 0 || dg_len2 == 0)
++				break;
+ 		} while (ndp_len > 2 * (opts->dgram_item_len * 2));
+ 	} while (ndp_index);
+ 
+diff --git a/drivers/video/console/fbcon.c b/drivers/video/console/fbcon.c
+index 4b7d0f9a820aa..44df6f6fd0636 100644
+--- a/drivers/video/console/fbcon.c
++++ b/drivers/video/console/fbcon.c
+@@ -2234,6 +2234,9 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font)
+ 
+ 	if (font->width <= 8) {
+ 		j = vc->vc_font.height;
++		if (font->charcount * j > FNTSIZE(fontdata))
++			return -EINVAL;
++
+ 		for (i = 0; i < font->charcount; i++) {
+ 			memcpy(data, fontdata, j);
+ 			memset(data + j, 0, 32 - j);
+@@ -2242,6 +2245,9 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font)
+ 		}
+ 	} else if (font->width <= 16) {
+ 		j = vc->vc_font.height * 2;
++		if (font->charcount * j > FNTSIZE(fontdata))
++			return -EINVAL;
++
+ 		for (i = 0; i < font->charcount; i++) {
+ 			memcpy(data, fontdata, j);
+ 			memset(data + j, 0, 64 - j);
+@@ -2249,6 +2255,9 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font)
+ 			fontdata += j;
+ 		}
+ 	} else if (font->width <= 24) {
++		if (font->charcount * (vc->vc_font.height * sizeof(u32)) > FNTSIZE(fontdata))
++			return -EINVAL;
++
+ 		for (i = 0; i < font->charcount; i++) {
+ 			for (j = 0; j < vc->vc_font.height; j++) {
+ 				*data++ = fontdata[0];
+@@ -2261,6 +2270,9 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font)
+ 		}
+ 	} else {
+ 		j = vc->vc_font.height * 4;
++		if (font->charcount * j > FNTSIZE(fontdata))
++			return -EINVAL;
++
+ 		for (i = 0; i < font->charcount; i++) {
+ 			memcpy(data, fontdata, j);
+ 			memset(data + j, 0, 128 - j);
+diff --git a/drivers/video/console/fbcon.h b/drivers/video/console/fbcon.h
+index 5ebdccd070eb8..701eecab33171 100644
+--- a/drivers/video/console/fbcon.h
++++ b/drivers/video/console/fbcon.h
+@@ -151,13 +151,6 @@ static inline int attr_col_ec(int shift, struct vc_data *vc,
+ #define attr_bgcol_ec(bgshift, vc, info) attr_col_ec(bgshift, vc, info, 0)
+ #define attr_fgcol_ec(fgshift, vc, info) attr_col_ec(fgshift, vc, info, 1)
+ 
+-/* Font */
+-#define REFCOUNT(fd)	(((int *)(fd))[-1])
+-#define FNTSIZE(fd)	(((int *)(fd))[-2])
+-#define FNTCHARCNT(fd)	(((int *)(fd))[-3])
+-#define FNTSUM(fd)	(((int *)(fd))[-4])
+-#define FONT_EXTRA_WORDS 4
+-
+     /*
+      *  Scroll Method
+      */
+diff --git a/drivers/video/console/fbcon_rotate.c b/drivers/video/console/fbcon_rotate.c
+index db6528f2d3f29..0e33210819454 100644
+--- a/drivers/video/console/fbcon_rotate.c
++++ b/drivers/video/console/fbcon_rotate.c
+@@ -14,6 +14,7 @@
+ #include <linux/fb.h>
+ #include <linux/vt_kern.h>
+ #include <linux/console.h>
++#include <linux/font.h>
+ #include <asm/types.h>
+ #include "fbcon.h"
+ #include "fbcon_rotate.h"
+diff --git a/drivers/video/console/newport_con.c b/drivers/video/console/newport_con.c
+index 33bddf3f30406..1a3a2f1d9817d 100644
+--- a/drivers/video/console/newport_con.c
++++ b/drivers/video/console/newport_con.c
+@@ -35,12 +35,6 @@
+ 
+ #define FONT_DATA ((unsigned char *)font_vga_8x16.data)
+ 
+-/* borrowed from fbcon.c */
+-#define REFCOUNT(fd)	(((int *)(fd))[-1])
+-#define FNTSIZE(fd)	(((int *)(fd))[-2])
+-#define FNTCHARCNT(fd)	(((int *)(fd))[-3])
+-#define FONT_EXTRA_WORDS 3
+-
+ static unsigned char *font_data[MAX_NR_CONSOLES];
+ 
+ static struct newport_regs *npregs;
+@@ -522,6 +516,7 @@ static int newport_set_font(int unit, struct console_font *op)
+ 	FNTSIZE(new_data) = size;
+ 	FNTCHARCNT(new_data) = op->charcount;
+ 	REFCOUNT(new_data) = 0;	/* usage counter */
++	FNTSUM(new_data) = 0;
+ 
+ 	p = new_data;
+ 	for (i = 0; i < op->charcount; i++) {
+diff --git a/drivers/video/console/tileblit.c b/drivers/video/console/tileblit.c
+index 3c0b242dba5f0..691717276c3e2 100644
+--- a/drivers/video/console/tileblit.c
++++ b/drivers/video/console/tileblit.c
+@@ -13,6 +13,7 @@
+ #include <linux/fb.h>
+ #include <linux/vt_kern.h>
+ #include <linux/console.h>
++#include <linux/font.h>
+ #include <asm/types.h>
+ #include "fbcon.h"
+ 
+diff --git a/fs/eventpoll.c b/fs/eventpoll.c
+index 8c40d6652a9a9..865afb58266a7 100644
+--- a/fs/eventpoll.c
++++ b/fs/eventpoll.c
+@@ -222,8 +222,7 @@ struct eventpoll {
+ 	struct file *file;
+ 
+ 	/* used to optimize loop detection check */
+-	int visited;
+-	struct list_head visited_list_link;
++	u64 gen;
+ };
+ 
+ /* Wait structure used by the poll hooks */
+@@ -267,6 +266,8 @@ static long max_user_watches __read_mostly;
+  */
+ static DEFINE_MUTEX(epmutex);
+ 
++static u64 loop_check_gen = 0;
++
+ /* Used to check for epoll file descriptor inclusion loops */
+ static struct nested_calls poll_loop_ncalls;
+ 
+@@ -282,9 +283,6 @@ static struct kmem_cache *epi_cache __read_mostly;
+ /* Slab cache used to allocate "struct eppoll_entry" */
+ static struct kmem_cache *pwq_cache __read_mostly;
+ 
+-/* Visited nodes during ep_loop_check(), so we can unset them when we finish */
+-static LIST_HEAD(visited_list);
+-
+ /*
+  * List of files with newly added links, where we may need to limit the number
+  * of emanating paths. Protected by the epmutex.
+@@ -1262,7 +1260,7 @@ static int reverse_path_check(void)
+ 
+ static int ep_create_wakeup_source(struct epitem *epi)
+ {
+-	const char *name;
++	struct name_snapshot n;
+ 	struct wakeup_source *ws;
+ 
+ 	if (!epi->ep->ws) {
+@@ -1271,8 +1269,9 @@ static int ep_create_wakeup_source(struct epitem *epi)
+ 			return -ENOMEM;
+ 	}
+ 
+-	name = epi->ffd.file->f_path.dentry->d_name.name;
+-	ws = wakeup_source_register(name);
++	take_dentry_name_snapshot(&n, epi->ffd.file->f_path.dentry);
++	ws = wakeup_source_register(n.name);
++	release_dentry_name_snapshot(&n);
+ 
+ 	if (!ws)
+ 		return -ENOMEM;
+@@ -1332,6 +1331,22 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
+ 		RCU_INIT_POINTER(epi->ws, NULL);
+ 	}
+ 
++	/* Add the current item to the list of active epoll hook for this file */
++	spin_lock(&tfile->f_lock);
++	list_add_tail_rcu(&epi->fllink, &tfile->f_ep_links);
++	spin_unlock(&tfile->f_lock);
++
++	/*
++	 * Add the current item to the RB tree. All RB tree operations are
++	 * protected by "mtx", and ep_insert() is called with "mtx" held.
++	 */
++	ep_rbtree_insert(ep, epi);
++
++	/* now check if we've created too many backpaths */
++	error = -EINVAL;
++	if (full_check && reverse_path_check())
++		goto error_remove_epi;
++
+ 	/* Initialize the poll table using the queue callback */
+ 	epq.epi = epi;
+ 	init_poll_funcptr(&epq.pt, ep_ptable_queue_proc);
+@@ -1354,22 +1369,6 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
+ 	if (epi->nwait < 0)
+ 		goto error_unregister;
+ 
+-	/* Add the current item to the list of active epoll hook for this file */
+-	spin_lock(&tfile->f_lock);
+-	list_add_tail_rcu(&epi->fllink, &tfile->f_ep_links);
+-	spin_unlock(&tfile->f_lock);
+-
+-	/*
+-	 * Add the current item to the RB tree. All RB tree operations are
+-	 * protected by "mtx", and ep_insert() is called with "mtx" held.
+-	 */
+-	ep_rbtree_insert(ep, epi);
+-
+-	/* now check if we've created too many backpaths */
+-	error = -EINVAL;
+-	if (full_check && reverse_path_check())
+-		goto error_remove_epi;
+-
+ 	/* We have to drop the new item inside our item list to keep track of it */
+ 	spin_lock_irqsave(&ep->lock, flags);
+ 
+@@ -1395,6 +1394,8 @@ static int ep_insert(struct eventpoll *ep, struct epoll_event *event,
+ 
+ 	return 0;
+ 
++error_unregister:
++	ep_unregister_pollwait(ep, epi);
+ error_remove_epi:
+ 	spin_lock(&tfile->f_lock);
+ 	list_del_rcu(&epi->fllink);
+@@ -1402,9 +1403,6 @@ error_remove_epi:
+ 
+ 	rb_erase(&epi->rbn, &ep->rbr);
+ 
+-error_unregister:
+-	ep_unregister_pollwait(ep, epi);
+-
+ 	/*
+ 	 * We need to do this because an event could have been arrived on some
+ 	 * allocated wait queue. Note that we don't care about the ep->ovflist
+@@ -1725,13 +1723,12 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests)
+ 	struct epitem *epi;
+ 
+ 	mutex_lock_nested(&ep->mtx, call_nests + 1);
+-	ep->visited = 1;
+-	list_add(&ep->visited_list_link, &visited_list);
++	ep->gen = loop_check_gen;
+ 	for (rbp = rb_first(&ep->rbr); rbp; rbp = rb_next(rbp)) {
+ 		epi = rb_entry(rbp, struct epitem, rbn);
+ 		if (unlikely(is_file_epoll(epi->ffd.file))) {
+ 			ep_tovisit = epi->ffd.file->private_data;
+-			if (ep_tovisit->visited)
++			if (ep_tovisit->gen == loop_check_gen)
+ 				continue;
+ 			error = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
+ 					ep_loop_check_proc, epi->ffd.file,
+@@ -1772,18 +1769,8 @@ static int ep_loop_check_proc(void *priv, void *cookie, int call_nests)
+  */
+ static int ep_loop_check(struct eventpoll *ep, struct file *file)
+ {
+-	int ret;
+-	struct eventpoll *ep_cur, *ep_next;
+-
+-	ret = ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
++	return ep_call_nested(&poll_loop_ncalls, EP_MAX_NESTS,
+ 			      ep_loop_check_proc, file, ep, current);
+-	/* clear visited list */
+-	list_for_each_entry_safe(ep_cur, ep_next, &visited_list,
+-							visited_list_link) {
+-		ep_cur->visited = 0;
+-		list_del(&ep_cur->visited_list_link);
+-	}
+-	return ret;
+ }
+ 
+ static void clear_tfile_check_list(void)
+@@ -1940,6 +1927,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
+ 	mutex_lock_nested(&ep->mtx, 0);
+ 	if (op == EPOLL_CTL_ADD) {
+ 		if (!list_empty(&f.file->f_ep_links) ||
++				ep->gen == loop_check_gen ||
+ 						is_file_epoll(tf.file)) {
+ 			full_check = 1;
+ 			mutex_unlock(&ep->mtx);
+@@ -2000,6 +1988,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
+ error_tgt_fput:
+ 	if (full_check) {
+ 		clear_tfile_check_list();
++		loop_check_gen++;
+ 		mutex_unlock(&epmutex);
+ 	}
+ 
+diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
+index 2517fcd423b68..d405b5a14073a 100644
+--- a/fs/nfs/dir.c
++++ b/fs/nfs/dir.c
+@@ -583,6 +583,9 @@ int nfs_readdir_page_filler(nfs_readdir_descriptor_t *desc, struct nfs_entry *en
+ 	xdr_set_scratch_buffer(&stream, page_address(scratch), PAGE_SIZE);
+ 
+ 	do {
++		if (entry->label)
++			entry->label->len = NFS4_MAXLABELLEN;
++
+ 		status = xdr_decode(desc, entry, &stream);
+ 		if (status != 0) {
+ 			if (status == -EAGAIN)
+diff --git a/include/linux/font.h b/include/linux/font.h
+index d6821769dd1e1..f85e70bd4793e 100644
+--- a/include/linux/font.h
++++ b/include/linux/font.h
+@@ -57,4 +57,17 @@ extern const struct font_desc *get_default_font(int xres, int yres,
+ /* Max. length for the name of a predefined font */
+ #define MAX_FONT_NAME	32
+ 
++/* Extra word getters */
++#define REFCOUNT(fd)	(((int *)(fd))[-1])
++#define FNTSIZE(fd)	(((int *)(fd))[-2])
++#define FNTCHARCNT(fd)	(((int *)(fd))[-3])
++#define FNTSUM(fd)	(((int *)(fd))[-4])
++
++#define FONT_EXTRA_WORDS 4
++
++struct font_data {
++	unsigned int extra[FONT_EXTRA_WORDS];
++	const unsigned char data[];
++} __packed;
++
+ #endif /* _VIDEO_FONT_H */
+diff --git a/include/linux/khugepaged.h b/include/linux/khugepaged.h
+index 1e032a1ddb3ea..60af12869ac7f 100644
+--- a/include/linux/khugepaged.h
++++ b/include/linux/khugepaged.h
+@@ -13,6 +13,7 @@ extern int __khugepaged_enter(struct mm_struct *mm);
+ extern void __khugepaged_exit(struct mm_struct *mm);
+ extern int khugepaged_enter_vma_merge(struct vm_area_struct *vma,
+ 				      unsigned long vm_flags);
++extern void khugepaged_min_free_kbytes_update(void);
+ 
+ #define khugepaged_enabled()					       \
+ 	(transparent_hugepage_flags &				       \
+@@ -70,6 +71,10 @@ static inline int khugepaged_enter_vma_merge(struct vm_area_struct *vma,
+ {
+ 	return 0;
+ }
++
++static inline void khugepaged_min_free_kbytes_update(void)
++{
++}
+ #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
+ 
+ #endif /* _LINUX_KHUGEPAGED_H */
+diff --git a/include/net/xfrm.h b/include/net/xfrm.h
+index 9e2f260cbb518..b2a405c93a342 100644
+--- a/include/net/xfrm.h
++++ b/include/net/xfrm.h
+@@ -1726,21 +1726,17 @@ static inline int xfrm_replay_state_esn_len(struct xfrm_replay_state_esn *replay
+ static inline int xfrm_replay_clone(struct xfrm_state *x,
+ 				     struct xfrm_state *orig)
+ {
+-	x->replay_esn = kzalloc(xfrm_replay_state_esn_len(orig->replay_esn),
++
++	x->replay_esn = kmemdup(orig->replay_esn,
++				xfrm_replay_state_esn_len(orig->replay_esn),
+ 				GFP_KERNEL);
+ 	if (!x->replay_esn)
+ 		return -ENOMEM;
+-
+-	x->replay_esn->bmp_len = orig->replay_esn->bmp_len;
+-	x->replay_esn->replay_window = orig->replay_esn->replay_window;
+-
+-	x->preplay_esn = kmemdup(x->replay_esn,
+-				 xfrm_replay_state_esn_len(x->replay_esn),
++	x->preplay_esn = kmemdup(orig->preplay_esn,
++				 xfrm_replay_state_esn_len(orig->preplay_esn),
+ 				 GFP_KERNEL);
+-	if (!x->preplay_esn) {
+-		kfree(x->replay_esn);
++	if (!x->preplay_esn)
+ 		return -ENOMEM;
+-	}
+ 
+ 	return 0;
+ }
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index b562467d2d498..7aad4d22b4223 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -94,7 +94,7 @@ static void remote_function(void *data)
+  * retry due to any failures in smp_call_function_single(), such as if the
+  * task_cpu() goes offline concurrently.
+  *
+- * returns @func return value or -ESRCH when the process isn't running
++ * returns @func return value or -ESRCH or -ENXIO when the process isn't running
+  */
+ static int
+ task_function_call(struct task_struct *p, remote_function_f func, void *info)
+@@ -110,7 +110,8 @@ task_function_call(struct task_struct *p, remote_function_f func, void *info)
+ 	for (;;) {
+ 		ret = smp_call_function_single(task_cpu(p), remote_function,
+ 					       &data, 1);
+-		ret = !ret ? data.ret : -EAGAIN;
++		if (!ret)
++			ret = data.ret;
+ 
+ 		if (ret != -EAGAIN)
+ 			break;
+diff --git a/kernel/kmod.c b/kernel/kmod.c
+index e4e5e98002fe3..3f3bbae4cec33 100644
+--- a/kernel/kmod.c
++++ b/kernel/kmod.c
+@@ -28,6 +28,7 @@
+ #include <linux/cred.h>
+ #include <linux/file.h>
+ #include <linux/fdtable.h>
++#include <linux/fs_struct.h>
+ #include <linux/workqueue.h>
+ #include <linux/security.h>
+ #include <linux/mount.h>
+@@ -222,6 +223,14 @@ static int call_usermodehelper_exec_async(void *data)
+ 	flush_signal_handlers(current, 1);
+ 	spin_unlock_irq(&current->sighand->siglock);
+ 
++	/*
++	 * Initial kernel threads share ther FS with init, in order to
++	 * get the init root directory. But we've now created a new
++	 * thread that is going to execve a user process and has its own
++	 * 'struct fs_struct'. Reset umask to the default.
++	 */
++	current->fs->umask = 0022;
++
+ 	/*
+ 	 * Our parent (unbound workqueue) runs with elevated scheduling
+ 	 * priority. Avoid propagating that into the userspace child.
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index 4d1be82e7011a..51e47e18764e3 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -5334,17 +5334,15 @@ static void ftrace_ops_assist_func(unsigned long ip, unsigned long parent_ip,
+ {
+ 	int bit;
+ 
+-	if ((op->flags & FTRACE_OPS_FL_RCU) && !rcu_is_watching())
+-		return;
+-
+ 	bit = trace_test_and_set_recursion(TRACE_LIST_START, TRACE_LIST_MAX);
+ 	if (bit < 0)
+ 		return;
+ 
+ 	preempt_disable_notrace();
+ 
+-	if (!(op->flags & FTRACE_OPS_FL_PER_CPU) ||
+-	    !ftrace_function_local_disabled(op)) {
++	if ((!(op->flags & FTRACE_OPS_FL_RCU) || rcu_is_watching()) &&
++	    (!(op->flags & FTRACE_OPS_FL_PER_CPU) ||
++	     !ftrace_function_local_disabled(op))) {
+ 		op->func(ip, parent_ip, op, regs);
+ 	}
+ 
+diff --git a/lib/fonts/font_10x18.c b/lib/fonts/font_10x18.c
+index 6be72bb218ee4..87e904f550c15 100644
+--- a/lib/fonts/font_10x18.c
++++ b/lib/fonts/font_10x18.c
+@@ -7,8 +7,8 @@
+ 
+ #define FONTDATAMAX 9216
+ 
+-static const unsigned char fontdata_10x18[FONTDATAMAX] = {
+-
++static struct font_data fontdata_10x18 = {
++	{ 0, 0, FONTDATAMAX, 0 }, {
+ 	/* 0 0x00 '^@' */
+ 	0x00, 0x00, /* 0000000000 */
+ 	0x00, 0x00, /* 0000000000 */
+@@ -5128,8 +5128,7 @@ static const unsigned char fontdata_10x18[FONTDATAMAX] = {
+ 	0x00, 0x00, /* 0000000000 */
+ 	0x00, 0x00, /* 0000000000 */
+ 	0x00, 0x00, /* 0000000000 */
+-
+-};
++} };
+ 
+ 
+ const struct font_desc font_10x18 = {
+@@ -5137,7 +5136,7 @@ const struct font_desc font_10x18 = {
+ 	.name	= "10x18",
+ 	.width	= 10,
+ 	.height	= 18,
+-	.data	= fontdata_10x18,
++	.data	= fontdata_10x18.data,
+ #ifdef __sparc__
+ 	.pref	= 5,
+ #else
+diff --git a/lib/fonts/font_6x10.c b/lib/fonts/font_6x10.c
+index b20620904d314..896ffa987c97b 100644
+--- a/lib/fonts/font_6x10.c
++++ b/lib/fonts/font_6x10.c
+@@ -1,7 +1,9 @@
+ #include <linux/font.h>
+ 
+-static const unsigned char fontdata_6x10[] = {
++#define FONTDATAMAX 2560
+ 
++static struct font_data fontdata_6x10 = {
++	{ 0, 0, FONTDATAMAX, 0 }, {
+ 	/* 0 0x00 '^@' */
+ 	0x00, /* 00000000 */
+ 	0x00, /* 00000000 */
+@@ -3073,14 +3075,13 @@ static const unsigned char fontdata_6x10[] = {
+ 	0x00, /* 00000000 */
+ 	0x00, /* 00000000 */
+ 	0x00, /* 00000000 */
+-
+-};
++} };
+ 
+ const struct font_desc font_6x10 = {
+ 	.idx	= FONT6x10_IDX,
+ 	.name	= "6x10",
+ 	.width	= 6,
+ 	.height	= 10,
+-	.data	= fontdata_6x10,
++	.data	= fontdata_6x10.data,
+ 	.pref	= 0,
+ };
+diff --git a/lib/fonts/font_6x11.c b/lib/fonts/font_6x11.c
+index 46e86e67aa6aa..eb46a59307d2e 100644
+--- a/lib/fonts/font_6x11.c
++++ b/lib/fonts/font_6x11.c
+@@ -8,8 +8,8 @@
+ 
+ #define FONTDATAMAX (11*256)
+ 
+-static const unsigned char fontdata_6x11[FONTDATAMAX] = {
+-
++static struct font_data fontdata_6x11 = {
++	{ 0, 0, FONTDATAMAX, 0 }, {
+ 	/* 0 0x00 '^@' */
+ 	0x00, /* 00000000 */
+ 	0x00, /* 00000000 */
+@@ -3337,8 +3337,7 @@ static const unsigned char fontdata_6x11[FONTDATAMAX] = {
+ 	0x00, /* 00000000 */
+ 	0x00, /* 00000000 */
+ 	0x00, /* 00000000 */
+-
+-};
++} };
+ 
+ 
+ const struct font_desc font_vga_6x11 = {
+@@ -3346,7 +3345,7 @@ const struct font_desc font_vga_6x11 = {
+ 	.name	= "ProFont6x11",
+ 	.width	= 6,
+ 	.height	= 11,
+-	.data	= fontdata_6x11,
++	.data	= fontdata_6x11.data,
+ 	/* Try avoiding this font if possible unless on MAC */
+ 	.pref	= -2000,
+ };
+diff --git a/lib/fonts/font_7x14.c b/lib/fonts/font_7x14.c
+index 3b7dbf9c060b3..c88b3bba001bd 100644
+--- a/lib/fonts/font_7x14.c
++++ b/lib/fonts/font_7x14.c
+@@ -7,8 +7,8 @@
+ 
+ #define FONTDATAMAX 3584
+ 
+-static const unsigned char fontdata_7x14[FONTDATAMAX] = {
+-
++static struct font_data fontdata_7x14 = {
++	{ 0, 0, FONTDATAMAX, 0 }, {
+ 	/* 0 0x00 '^@' */
+ 	0x00, /* 0000000 */
+ 	0x00, /* 0000000 */
+@@ -4104,8 +4104,7 @@ static const unsigned char fontdata_7x14[FONTDATAMAX] = {
+ 	0x00, /* 0000000 */
+ 	0x00, /* 0000000 */
+ 	0x00, /* 0000000 */
+-
+-};
++} };
+ 
+ 
+ const struct font_desc font_7x14 = {
+@@ -4113,6 +4112,6 @@ const struct font_desc font_7x14 = {
+ 	.name	= "7x14",
+ 	.width	= 7,
+ 	.height	= 14,
+-	.data	= fontdata_7x14,
++	.data	= fontdata_7x14.data,
+ 	.pref	= 0,
+ };
+diff --git a/lib/fonts/font_8x16.c b/lib/fonts/font_8x16.c
+index 00a0c67a5c7d0..ba53e2643670b 100644
+--- a/lib/fonts/font_8x16.c
++++ b/lib/fonts/font_8x16.c
+@@ -9,8 +9,8 @@
+ 
+ #define FONTDATAMAX 4096
+ 
+-static const unsigned char fontdata_8x16[FONTDATAMAX] = {
+-
++static struct font_data fontdata_8x16 = {
++	{ 0, 0, FONTDATAMAX, 0 }, {
+ 	/* 0 0x00 '^@' */
+ 	0x00, /* 00000000 */
+ 	0x00, /* 00000000 */
+@@ -4618,8 +4618,7 @@ static const unsigned char fontdata_8x16[FONTDATAMAX] = {
+ 	0x00, /* 00000000 */
+ 	0x00, /* 00000000 */
+ 	0x00, /* 00000000 */
+-
+-};
++} };
+ 
+ 
+ const struct font_desc font_vga_8x16 = {
+@@ -4627,7 +4626,7 @@ const struct font_desc font_vga_8x16 = {
+ 	.name	= "VGA8x16",
+ 	.width	= 8,
+ 	.height	= 16,
+-	.data	= fontdata_8x16,
++	.data	= fontdata_8x16.data,
+ 	.pref	= 0,
+ };
+ EXPORT_SYMBOL(font_vga_8x16);
+diff --git a/lib/fonts/font_8x8.c b/lib/fonts/font_8x8.c
+index 9f56efe2cee72..4d28b81e8237c 100644
+--- a/lib/fonts/font_8x8.c
++++ b/lib/fonts/font_8x8.c
+@@ -8,8 +8,8 @@
+ 
+ #define FONTDATAMAX 2048
+ 
+-static const unsigned char fontdata_8x8[FONTDATAMAX] = {
+-
++static struct font_data fontdata_8x8 = {
++	{ 0, 0, FONTDATAMAX, 0 }, {
+ 	/* 0 0x00 '^@' */
+ 	0x00, /* 00000000 */
+ 	0x00, /* 00000000 */
+@@ -2569,8 +2569,7 @@ static const unsigned char fontdata_8x8[FONTDATAMAX] = {
+ 	0x00, /* 00000000 */
+ 	0x00, /* 00000000 */
+ 	0x00, /* 00000000 */
+-
+-};
++} };
+ 
+ 
+ const struct font_desc font_vga_8x8 = {
+@@ -2578,6 +2577,6 @@ const struct font_desc font_vga_8x8 = {
+ 	.name	= "VGA8x8",
+ 	.width	= 8,
+ 	.height	= 8,
+-	.data	= fontdata_8x8,
++	.data	= fontdata_8x8.data,
+ 	.pref	= 0,
+ };
+diff --git a/lib/fonts/font_acorn_8x8.c b/lib/fonts/font_acorn_8x8.c
+index 639e31ae1100a..957398b762d38 100644
+--- a/lib/fonts/font_acorn_8x8.c
++++ b/lib/fonts/font_acorn_8x8.c
+@@ -2,7 +2,10 @@
+ 
+ #include <linux/font.h>
+ 
+-static const unsigned char acorndata_8x8[] = {
++#define FONTDATAMAX 2048
++
++static struct font_data acorndata_8x8 = {
++{ 0, 0, FONTDATAMAX, 0 }, {
+ /* 00 */  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* ^@ */
+ /* 01 */  0x7e, 0x81, 0xa5, 0x81, 0xbd, 0x99, 0x81, 0x7e, /* ^A */
+ /* 02 */  0x7e, 0xff, 0xbd, 0xff, 0xc3, 0xe7, 0xff, 0x7e, /* ^B */
+@@ -259,14 +262,14 @@ static const unsigned char acorndata_8x8[] = {
+ /* FD */  0x38, 0x04, 0x18, 0x20, 0x3c, 0x00, 0x00, 0x00,
+ /* FE */  0x00, 0x00, 0x3c, 0x3c, 0x3c, 0x3c, 0x00, 0x00,
+ /* FF */  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+-};
++} };
+ 
+ const struct font_desc font_acorn_8x8 = {
+ 	.idx	= ACORN8x8_IDX,
+ 	.name	= "Acorn8x8",
+ 	.width	= 8,
+ 	.height	= 8,
+-	.data	= acorndata_8x8,
++	.data	= acorndata_8x8.data,
+ #ifdef CONFIG_ARCH_ACORN
+ 	.pref	= 20,
+ #else
+diff --git a/lib/fonts/font_mini_4x6.c b/lib/fonts/font_mini_4x6.c
+index 838caa1cfef70..1449876c6a270 100644
+--- a/lib/fonts/font_mini_4x6.c
++++ b/lib/fonts/font_mini_4x6.c
+@@ -43,8 +43,8 @@ __END__;
+ 
+ #define FONTDATAMAX 1536
+ 
+-static const unsigned char fontdata_mini_4x6[FONTDATAMAX] = {
+-
++static struct font_data fontdata_mini_4x6 = {
++	{ 0, 0, FONTDATAMAX, 0 }, {
+ 	/*{*/
+ 	  	/*   Char 0: ' '  */
+ 	0xee,	/*=  [*** ]       */
+@@ -2145,14 +2145,14 @@ static const unsigned char fontdata_mini_4x6[FONTDATAMAX] = {
+ 	0xee,	/*=   [*** ]        */
+ 	0x00,	/*=   [    ]        */
+ 	/*}*/
+-};
++} };
+ 
+ const struct font_desc font_mini_4x6 = {
+ 	.idx	= MINI4x6_IDX,
+ 	.name	= "MINI4x6",
+ 	.width	= 4,
+ 	.height	= 6,
+-	.data	= fontdata_mini_4x6,
++	.data	= fontdata_mini_4x6.data,
+ 	.pref	= 3,
+ };
+ 
+diff --git a/lib/fonts/font_pearl_8x8.c b/lib/fonts/font_pearl_8x8.c
+index dc6ad539ca4e4..4649314333bb0 100644
+--- a/lib/fonts/font_pearl_8x8.c
++++ b/lib/fonts/font_pearl_8x8.c
+@@ -13,8 +13,8 @@
+ 
+ #define FONTDATAMAX 2048
+ 
+-static const unsigned char fontdata_pearl8x8[FONTDATAMAX] = {
+-
++static struct font_data fontdata_pearl8x8 = {
++   { 0, 0, FONTDATAMAX, 0 }, {
+    /* 0 0x00 '^@' */
+    0x00, /* 00000000 */
+    0x00, /* 00000000 */
+@@ -2574,14 +2574,13 @@ static const unsigned char fontdata_pearl8x8[FONTDATAMAX] = {
+    0x00, /* 00000000 */
+    0x00, /* 00000000 */
+    0x00, /* 00000000 */
+-
+-};
++} };
+ 
+ const struct font_desc font_pearl_8x8 = {
+ 	.idx	= PEARL8x8_IDX,
+ 	.name	= "PEARL8x8",
+ 	.width	= 8,
+ 	.height	= 8,
+-	.data	= fontdata_pearl8x8,
++	.data	= fontdata_pearl8x8.data,
+ 	.pref	= 2,
+ };
+diff --git a/lib/fonts/font_sun12x22.c b/lib/fonts/font_sun12x22.c
+index d3643853c33af..c6967cdf4207b 100644
+--- a/lib/fonts/font_sun12x22.c
++++ b/lib/fonts/font_sun12x22.c
+@@ -2,8 +2,8 @@
+ 
+ #define FONTDATAMAX 11264
+ 
+-static const unsigned char fontdata_sun12x22[FONTDATAMAX] = {
+-
++static struct font_data fontdata_sun12x22 = {
++	{ 0, 0, FONTDATAMAX, 0 }, {
+ 	/* 0 0x00 '^@' */
+ 	0x00, 0x00, /* 000000000000 */
+ 	0x00, 0x00, /* 000000000000 */
+@@ -6147,8 +6147,7 @@ static const unsigned char fontdata_sun12x22[FONTDATAMAX] = {
+ 	0x00, 0x00, /* 000000000000 */
+ 	0x00, 0x00, /* 000000000000 */
+ 	0x00, 0x00, /* 000000000000 */
+-
+-};
++} };
+ 
+ 
+ const struct font_desc font_sun_12x22 = {
+@@ -6156,7 +6155,7 @@ const struct font_desc font_sun_12x22 = {
+ 	.name	= "SUN12x22",
+ 	.width	= 12,
+ 	.height	= 22,
+-	.data	= fontdata_sun12x22,
++	.data	= fontdata_sun12x22.data,
+ #ifdef __sparc__
+ 	.pref	= 5,
+ #else
+diff --git a/lib/fonts/font_sun8x16.c b/lib/fonts/font_sun8x16.c
+index 268151325b83e..7d979e5788999 100644
+--- a/lib/fonts/font_sun8x16.c
++++ b/lib/fonts/font_sun8x16.c
+@@ -2,7 +2,8 @@
+ 
+ #define FONTDATAMAX 4096
+ 
+-static const unsigned char fontdata_sun8x16[FONTDATAMAX] = {
++static struct font_data fontdata_sun8x16 = {
++{ 0, 0, FONTDATAMAX, 0 }, {
+ /* */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+ /* */ 0x00,0x00,0x7e,0x81,0xa5,0x81,0x81,0xbd,0x99,0x81,0x81,0x7e,0x00,0x00,0x00,0x00,
+ /* */ 0x00,0x00,0x7e,0xff,0xdb,0xff,0xff,0xc3,0xe7,0xff,0xff,0x7e,0x00,0x00,0x00,0x00,
+@@ -259,14 +260,14 @@ static const unsigned char fontdata_sun8x16[FONTDATAMAX] = {
+ /* */ 0x00,0x70,0xd8,0x30,0x60,0xc8,0xf8,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+ /* */ 0x00,0x00,0x00,0x00,0x7c,0x7c,0x7c,0x7c,0x7c,0x7c,0x7c,0x00,0x00,0x00,0x00,0x00,
+ /* */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+-};
++} };
+ 
+ const struct font_desc font_sun_8x16 = {
+ 	.idx	= SUN8x16_IDX,
+ 	.name	= "SUN8x16",
+ 	.width	= 8,
+ 	.height	= 16,
+-	.data	= fontdata_sun8x16,
++	.data	= fontdata_sun8x16.data,
+ #ifdef __sparc__
+ 	.pref	= 10,
+ #else
+diff --git a/lib/random32.c b/lib/random32.c
+index 889dab44bd747..d5c3137d93f49 100644
+--- a/lib/random32.c
++++ b/lib/random32.c
+@@ -47,7 +47,7 @@ static inline void prandom_state_selftest(void)
+ }
+ #endif
+ 
+-DEFINE_PER_CPU(struct rnd_state, net_rand_state);
++DEFINE_PER_CPU(struct rnd_state, net_rand_state)  __latent_entropy;
+ 
+ /**
+  *	prandom_u32_state - seeded pseudo-random number generator.
+diff --git a/mm/khugepaged.c b/mm/khugepaged.c
+index 1538e5e5c628a..753b0e2fef368 100644
+--- a/mm/khugepaged.c
++++ b/mm/khugepaged.c
+@@ -50,6 +50,9 @@ enum scan_result {
+ #define CREATE_TRACE_POINTS
+ #include <trace/events/huge_memory.h>
+ 
++static struct task_struct *khugepaged_thread __read_mostly;
++static DEFINE_MUTEX(khugepaged_mutex);
++
+ /* default scan 8*512 pte (or vmas) every 30 second */
+ static unsigned int khugepaged_pages_to_scan __read_mostly;
+ static unsigned int khugepaged_pages_collapsed;
+@@ -802,6 +805,18 @@ static struct page *khugepaged_alloc_hugepage(bool *wait)
+ 
+ static bool khugepaged_prealloc_page(struct page **hpage, bool *wait)
+ {
++	/*
++	 * If the hpage allocated earlier was briefly exposed in page cache
++	 * before collapse_file() failed, it is possible that racing lookups
++	 * have not yet completed, and would then be unpleasantly surprised by
++	 * finding the hpage reused for the same mapping at a different offset.
++	 * Just release the previous allocation if there is any danger of that.
++	 */
++	if (*hpage && page_count(*hpage) > 1) {
++		put_page(*hpage);
++		*hpage = NULL;
++	}
++
+ 	if (!*hpage)
+ 		*hpage = khugepaged_alloc_hugepage(wait);
+ 
+@@ -1936,8 +1951,6 @@ static void set_recommended_min_free_kbytes(void)
+ 
+ int start_stop_khugepaged(void)
+ {
+-	static struct task_struct *khugepaged_thread __read_mostly;
+-	static DEFINE_MUTEX(khugepaged_mutex);
+ 	int err = 0;
+ 
+ 	mutex_lock(&khugepaged_mutex);
+@@ -1964,3 +1977,11 @@ fail:
+ 	mutex_unlock(&khugepaged_mutex);
+ 	return err;
+ }
++
++void khugepaged_min_free_kbytes_update(void)
++{
++	mutex_lock(&khugepaged_mutex);
++	if (khugepaged_enabled() && khugepaged_thread)
++		set_recommended_min_free_kbytes();
++	mutex_unlock(&khugepaged_mutex);
++}
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 458523bc73916..b0c451e3b59f3 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -64,6 +64,7 @@
+ #include <linux/page_owner.h>
+ #include <linux/kthread.h>
+ #include <linux/memcontrol.h>
++#include <linux/khugepaged.h>
+ 
+ #include <asm/sections.h>
+ #include <asm/tlbflush.h>
+@@ -6785,6 +6786,8 @@ int __meminit init_per_zone_wmark_min(void)
+ 	setup_min_slab_ratio();
+ #endif
+ 
++	khugepaged_min_free_kbytes_update();
++
+ 	return 0;
+ }
+ postcore_initcall(init_per_zone_wmark_min)
+diff --git a/net/mac80211/vht.c b/net/mac80211/vht.c
+index 43e45bb660bcd..b1d3fa708e16b 100644
+--- a/net/mac80211/vht.c
++++ b/net/mac80211/vht.c
+@@ -170,10 +170,7 @@ ieee80211_vht_cap_ie_to_sta_vht_cap(struct ieee80211_sub_if_data *sdata,
+ 	/* take some capabilities as-is */
+ 	cap_info = le32_to_cpu(vht_cap_ie->vht_cap_info);
+ 	vht_cap->cap = cap_info;
+-	vht_cap->cap &= IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_3895 |
+-			IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_7991 |
+-			IEEE80211_VHT_CAP_MAX_MPDU_LENGTH_11454 |
+-			IEEE80211_VHT_CAP_RXLDPC |
++	vht_cap->cap &= IEEE80211_VHT_CAP_RXLDPC |
+ 			IEEE80211_VHT_CAP_VHT_TXOP_PS |
+ 			IEEE80211_VHT_CAP_HTC_VHT |
+ 			IEEE80211_VHT_CAP_MAX_A_MPDU_LENGTH_EXPONENT_MASK |
+@@ -182,6 +179,9 @@ ieee80211_vht_cap_ie_to_sta_vht_cap(struct ieee80211_sub_if_data *sdata,
+ 			IEEE80211_VHT_CAP_RX_ANTENNA_PATTERN |
+ 			IEEE80211_VHT_CAP_TX_ANTENNA_PATTERN;
+ 
++	vht_cap->cap |= min_t(u32, cap_info & IEEE80211_VHT_CAP_MAX_MPDU_MASK,
++			      own_cap.cap & IEEE80211_VHT_CAP_MAX_MPDU_MASK);
++
+ 	/* and some based on our own capabilities */
+ 	switch (own_cap.cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK) {
+ 	case IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ:
+diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
+index 5e28702c801fd..a25be03f60f59 100644
+--- a/net/netfilter/nf_conntrack_netlink.c
++++ b/net/netfilter/nf_conntrack_netlink.c
+@@ -1031,6 +1031,8 @@ ctnetlink_parse_tuple(const struct nlattr * const cda[],
+ 	if (!tb[CTA_TUPLE_IP])
+ 		return -EINVAL;
+ 
++	if (l3num != NFPROTO_IPV4 && l3num != NFPROTO_IPV6)
++		return -EOPNOTSUPP;
+ 	tuple->src.l3num = l3num;
+ 
+ 	err = ctnetlink_parse_tuple_ip(tb[CTA_TUPLE_IP], tuple);
+diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
+index beb2897d8ddf5..cff76ffcaac28 100644
+--- a/net/openvswitch/conntrack.c
++++ b/net/openvswitch/conntrack.c
+@@ -709,15 +709,19 @@ static int ovs_ct_nat(struct net *net, struct sw_flow_key *key,
+ 	}
+ 	err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, maniptype);
+ 
+-	if (err == NF_ACCEPT &&
+-	    ct->status & IPS_SRC_NAT && ct->status & IPS_DST_NAT) {
+-		if (maniptype == NF_NAT_MANIP_SRC)
+-			maniptype = NF_NAT_MANIP_DST;
+-		else
+-			maniptype = NF_NAT_MANIP_SRC;
+-
+-		err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range,
+-					 maniptype);
++	if (err == NF_ACCEPT && ct->status & IPS_DST_NAT) {
++		if (ct->status & IPS_SRC_NAT) {
++			if (maniptype == NF_NAT_MANIP_SRC)
++				maniptype = NF_NAT_MANIP_DST;
++			else
++				maniptype = NF_NAT_MANIP_SRC;
++
++			err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range,
++						 maniptype);
++		} else if (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) {
++			err = ovs_ct_nat_execute(skb, ct, ctinfo, NULL,
++						 NF_NAT_MANIP_SRC);
++		}
+ 	}
+ 
+ 	/* Mark NAT done if successful and update the flow key. */
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index fb643945e4244..b5b79f5015415 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -2161,7 +2161,8 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
+ 	int skb_len = skb->len;
+ 	unsigned int snaplen, res;
+ 	unsigned long status = TP_STATUS_USER;
+-	unsigned short macoff, netoff, hdrlen;
++	unsigned short macoff, hdrlen;
++	unsigned int netoff;
+ 	struct sk_buff *copy_skb = NULL;
+ 	struct timespec ts;
+ 	__u32 ts_status;
+@@ -2223,6 +2224,12 @@ static int tpacket_rcv(struct sk_buff *skb, struct net_device *dev,
+ 		}
+ 		macoff = netoff - maclen;
+ 	}
++	if (netoff > USHRT_MAX) {
++		spin_lock(&sk->sk_receive_queue.lock);
++		po->stats.stats1.tp_drops++;
++		spin_unlock(&sk->sk_receive_queue.lock);
++		goto drop_n_restore;
++	}
+ 	if (po->tp_version <= TPACKET_V2) {
+ 		if (macoff + snaplen > po->rx_ring.frame_size) {
+ 			if (po->copy_thresh &&
+diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c
+index b099b64366f35..ec02dd7c12ef4 100644
+--- a/net/rxrpc/conn_event.c
++++ b/net/rxrpc/conn_event.c
+@@ -309,18 +309,18 @@ static int rxrpc_process_event(struct rxrpc_connection *conn,
+ 			return ret;
+ 
+ 		spin_lock(&conn->channel_lock);
+-		spin_lock(&conn->state_lock);
++		spin_lock_bh(&conn->state_lock);
+ 
+ 		if (conn->state == RXRPC_CONN_SERVICE_CHALLENGING) {
+ 			conn->state = RXRPC_CONN_SERVICE;
+-			spin_unlock(&conn->state_lock);
++			spin_unlock_bh(&conn->state_lock);
+ 			for (loop = 0; loop < RXRPC_MAXCALLS; loop++)
+ 				rxrpc_call_is_secure(
+ 					rcu_dereference_protected(
+ 						conn->channels[loop].call,
+ 						lockdep_is_held(&conn->channel_lock)));
+ 		} else {
+-			spin_unlock(&conn->state_lock);
++			spin_unlock_bh(&conn->state_lock);
+ 		}
+ 
+ 		spin_unlock(&conn->channel_lock);
+diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c
+index 7fc340726d034..fa475b02bdceb 100644
+--- a/net/rxrpc/key.c
++++ b/net/rxrpc/key.c
+@@ -899,7 +899,7 @@ int rxrpc_request_key(struct rxrpc_sock *rx, char __user *optval, int optlen)
+ 
+ 	_enter("");
+ 
+-	if (optlen <= 0 || optlen > PAGE_SIZE - 1)
++	if (optlen <= 0 || optlen > PAGE_SIZE - 1 || rx->securities)
+ 		return -EINVAL;
+ 
+ 	description = memdup_user_nul(optval, optlen);
+@@ -1104,7 +1104,8 @@ static long rxrpc_read(const struct key *key,
+ 			break;
+ 
+ 		default: /* we have a ticket we can't encode */
+-			BUG();
++			pr_err("Unsupported key token type (%u)\n",
++			       token->security_index);
+ 			continue;
+ 		}
+ 
+@@ -1139,6 +1140,14 @@ static long rxrpc_read(const struct key *key,
+ 			goto fault;					\
+ 		xdr += (_l + 3) >> 2;					\
+ 	} while(0)
++#define ENCODE_BYTES(l, s)						\
++	do {								\
++		u32 _l = (l);						\
++		memcpy(xdr, (s), _l);					\
++		if (_l & 3)						\
++			memcpy((u8 *)xdr + _l, &zero, 4 - (_l & 3));	\
++		xdr += (_l + 3) >> 2;					\
++	} while(0)
+ #define ENCODE64(x)					\
+ 	do {						\
+ 		__be64 y = cpu_to_be64(x);		\
+@@ -1167,7 +1176,7 @@ static long rxrpc_read(const struct key *key,
+ 		case RXRPC_SECURITY_RXKAD:
+ 			ENCODE(token->kad->vice_id);
+ 			ENCODE(token->kad->kvno);
+-			ENCODE_DATA(8, token->kad->session_key);
++			ENCODE_BYTES(8, token->kad->session_key);
+ 			ENCODE(token->kad->start);
+ 			ENCODE(token->kad->expiry);
+ 			ENCODE(token->kad->primary_flag);
+@@ -1217,7 +1226,6 @@ static long rxrpc_read(const struct key *key,
+ 			break;
+ 
+ 		default:
+-			BUG();
+ 			break;
+ 		}
+ 
+diff --git a/net/sctp/auth.c b/net/sctp/auth.c
+index f99d4855d3de3..6ab11ee3d3a56 100644
+--- a/net/sctp/auth.c
++++ b/net/sctp/auth.c
+@@ -494,6 +494,7 @@ int sctp_auth_init_hmacs(struct sctp_endpoint *ep, gfp_t gfp)
+ out_err:
+ 	/* Clean up any successful allocations */
+ 	sctp_auth_destroy_hmacs(ep->auth_hmacs);
++	ep->auth_hmacs = NULL;
+ 	return -ENOMEM;
+ }
+ 
+diff --git a/net/vmw_vsock/virtio_transport.c b/net/vmw_vsock/virtio_transport.c
+index 0bd5a60f3bdeb..67aba63b5c96d 100644
+--- a/net/vmw_vsock/virtio_transport.c
++++ b/net/vmw_vsock/virtio_transport.c
+@@ -39,6 +39,7 @@ struct virtio_vsock {
+ 	 * must be accessed with tx_lock held.
+ 	 */
+ 	struct mutex tx_lock;
++	bool tx_run;
+ 
+ 	struct work_struct send_pkt_work;
+ 	spinlock_t send_pkt_list_lock;
+@@ -50,6 +51,7 @@ struct virtio_vsock {
+ 	 * must be accessed with rx_lock held.
+ 	 */
+ 	struct mutex rx_lock;
++	bool rx_run;
+ 	int rx_buf_nr;
+ 	int rx_buf_max_nr;
+ 
+@@ -57,24 +59,28 @@ struct virtio_vsock {
+ 	 * vqs[VSOCK_VQ_EVENT] must be accessed with event_lock held.
+ 	 */
+ 	struct mutex event_lock;
++	bool event_run;
+ 	struct virtio_vsock_event event_list[8];
+ 
+ 	u32 guest_cid;
+ };
+ 
+-static struct virtio_vsock *virtio_vsock_get(void)
+-{
+-	return the_virtio_vsock;
+-}
+-
+ static u32 virtio_transport_get_local_cid(void)
+ {
+-	struct virtio_vsock *vsock = virtio_vsock_get();
++	struct virtio_vsock *vsock;
++	u32 ret;
+ 
+-	if (!vsock)
+-		return VMADDR_CID_ANY;
++	rcu_read_lock();
++	vsock = rcu_dereference(the_virtio_vsock);
++	if (!vsock) {
++		ret = VMADDR_CID_ANY;
++		goto out_rcu;
++	}
+ 
+-	return vsock->guest_cid;
++	ret = vsock->guest_cid;
++out_rcu:
++	rcu_read_unlock();
++	return ret;
+ }
+ 
+ static void
+@@ -88,6 +94,9 @@ virtio_transport_send_pkt_work(struct work_struct *work)
+ 
+ 	mutex_lock(&vsock->tx_lock);
+ 
++	if (!vsock->tx_run)
++		goto out;
++
+ 	vq = vsock->vqs[VSOCK_VQ_TX];
+ 
+ 	for (;;) {
+@@ -144,6 +153,7 @@ virtio_transport_send_pkt_work(struct work_struct *work)
+ 	if (added)
+ 		virtqueue_kick(vq);
+ 
++out:
+ 	mutex_unlock(&vsock->tx_lock);
+ 
+ 	if (restart_rx)
+@@ -156,10 +166,12 @@ virtio_transport_send_pkt(struct virtio_vsock_pkt *pkt)
+ 	struct virtio_vsock *vsock;
+ 	int len = pkt->len;
+ 
+-	vsock = virtio_vsock_get();
++	rcu_read_lock();
++	vsock = rcu_dereference(the_virtio_vsock);
+ 	if (!vsock) {
+ 		virtio_transport_free_pkt(pkt);
+-		return -ENODEV;
++		len = -ENODEV;
++		goto out_rcu;
+ 	}
+ 
+ 	if (pkt->reply)
+@@ -170,6 +182,9 @@ virtio_transport_send_pkt(struct virtio_vsock_pkt *pkt)
+ 	spin_unlock_bh(&vsock->send_pkt_list_lock);
+ 
+ 	queue_work(virtio_vsock_workqueue, &vsock->send_pkt_work);
++
++out_rcu:
++	rcu_read_unlock();
+ 	return len;
+ }
+ 
+@@ -222,6 +237,10 @@ static void virtio_transport_tx_work(struct work_struct *work)
+ 
+ 	vq = vsock->vqs[VSOCK_VQ_TX];
+ 	mutex_lock(&vsock->tx_lock);
++
++	if (!vsock->tx_run)
++		goto out;
++
+ 	do {
+ 		struct virtio_vsock_pkt *pkt;
+ 		unsigned int len;
+@@ -232,6 +251,8 @@ static void virtio_transport_tx_work(struct work_struct *work)
+ 			added = true;
+ 		}
+ 	} while (!virtqueue_enable_cb(vq));
++
++out:
+ 	mutex_unlock(&vsock->tx_lock);
+ 
+ 	if (added)
+@@ -260,6 +281,9 @@ static void virtio_transport_rx_work(struct work_struct *work)
+ 
+ 	mutex_lock(&vsock->rx_lock);
+ 
++	if (!vsock->rx_run)
++		goto out;
++
+ 	do {
+ 		virtqueue_disable_cb(vq);
+ 		for (;;) {
+@@ -368,6 +392,9 @@ static void virtio_transport_event_work(struct work_struct *work)
+ 
+ 	mutex_lock(&vsock->event_lock);
+ 
++	if (!vsock->event_run)
++		goto out;
++
+ 	do {
+ 		struct virtio_vsock_event *event;
+ 		unsigned int len;
+@@ -382,7 +409,7 @@ static void virtio_transport_event_work(struct work_struct *work)
+ 	} while (!virtqueue_enable_cb(vq));
+ 
+ 	virtqueue_kick(vsock->vqs[VSOCK_VQ_EVENT]);
+-
++out:
+ 	mutex_unlock(&vsock->event_lock);
+ }
+ 
+@@ -478,7 +505,8 @@ static int virtio_vsock_probe(struct virtio_device *vdev)
+ 		return ret;
+ 
+ 	/* Only one virtio-vsock device per guest is supported */
+-	if (the_virtio_vsock) {
++	if (rcu_dereference_protected(the_virtio_vsock,
++				lockdep_is_held(&the_virtio_vsock_mutex))) {
+ 		ret = -EBUSY;
+ 		goto out;
+ 	}
+@@ -502,8 +530,6 @@ static int virtio_vsock_probe(struct virtio_device *vdev)
+ 	vsock->rx_buf_max_nr = 0;
+ 	atomic_set(&vsock->queued_replies, 0);
+ 
+-	vdev->priv = vsock;
+-	the_virtio_vsock = vsock;
+ 	mutex_init(&vsock->tx_lock);
+ 	mutex_init(&vsock->rx_lock);
+ 	mutex_init(&vsock->event_lock);
+@@ -514,14 +540,23 @@ static int virtio_vsock_probe(struct virtio_device *vdev)
+ 	INIT_WORK(&vsock->event_work, virtio_transport_event_work);
+ 	INIT_WORK(&vsock->send_pkt_work, virtio_transport_send_pkt_work);
+ 
++	mutex_lock(&vsock->tx_lock);
++	vsock->tx_run = true;
++	mutex_unlock(&vsock->tx_lock);
++
+ 	mutex_lock(&vsock->rx_lock);
+ 	virtio_vsock_rx_fill(vsock);
++	vsock->rx_run = true;
+ 	mutex_unlock(&vsock->rx_lock);
+ 
+ 	mutex_lock(&vsock->event_lock);
+ 	virtio_vsock_event_fill(vsock);
++	vsock->event_run = true;
+ 	mutex_unlock(&vsock->event_lock);
+ 
++	vdev->priv = vsock;
++	rcu_assign_pointer(the_virtio_vsock, vsock);
++
+ 	mutex_unlock(&the_virtio_vsock_mutex);
+ 	return 0;
+ 
+@@ -536,6 +571,12 @@ static void virtio_vsock_remove(struct virtio_device *vdev)
+ 	struct virtio_vsock *vsock = vdev->priv;
+ 	struct virtio_vsock_pkt *pkt;
+ 
++	mutex_lock(&the_virtio_vsock_mutex);
++
++	vdev->priv = NULL;
++	rcu_assign_pointer(the_virtio_vsock, NULL);
++	synchronize_rcu();
++
+ 	flush_work(&vsock->rx_work);
+ 	flush_work(&vsock->tx_work);
+ 	flush_work(&vsock->event_work);
+@@ -544,6 +585,24 @@ static void virtio_vsock_remove(struct virtio_device *vdev)
+ 	/* Reset all connected sockets when the device disappear */
+ 	vsock_for_each_connected_socket(virtio_vsock_reset_sock);
+ 
++	/* Stop all work handlers to make sure no one is accessing the device,
++	 * so we can safely call vdev->config->reset().
++	 */
++	mutex_lock(&vsock->rx_lock);
++	vsock->rx_run = false;
++	mutex_unlock(&vsock->rx_lock);
++
++	mutex_lock(&vsock->tx_lock);
++	vsock->tx_run = false;
++	mutex_unlock(&vsock->tx_lock);
++
++	mutex_lock(&vsock->event_lock);
++	vsock->event_run = false;
++	mutex_unlock(&vsock->event_lock);
++
++	/* Flush all device writes and interrupts, device will not use any
++	 * more buffers.
++	 */
+ 	vdev->config->reset(vdev);
+ 
+ 	mutex_lock(&vsock->rx_lock);
+@@ -565,12 +624,11 @@ static void virtio_vsock_remove(struct virtio_device *vdev)
+ 	}
+ 	spin_unlock_bh(&vsock->send_pkt_list_lock);
+ 
+-	mutex_lock(&the_virtio_vsock_mutex);
+-	the_virtio_vsock = NULL;
+-	mutex_unlock(&the_virtio_vsock_mutex);
+-
++	/* Delete virtqueues and flush outstanding callbacks if any */
+ 	vdev->config->del_vqs(vdev);
+ 
++	mutex_unlock(&the_virtio_vsock_mutex);
++
+ 	kfree(vsock);
+ }
+ 
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index e107754e29a77..1eb77161d5e64 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -3283,6 +3283,9 @@ static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
+ 	if (err)
+ 		return err;
+ 
++	if (key.idx < 0)
++		return -EINVAL;
++
+ 	if (info->attrs[NL80211_ATTR_MAC])
+ 		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
+ 
+diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
+index 3734ad56b456c..0eb85765d35a1 100644
+--- a/net/xfrm/xfrm_state.c
++++ b/net/xfrm/xfrm_state.c
+@@ -761,7 +761,8 @@ static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x,
+ 	 */
+ 	if (x->km.state == XFRM_STATE_VALID) {
+ 		if ((x->sel.family &&
+-		     !xfrm_selector_match(&x->sel, fl, x->sel.family)) ||
++		     (x->sel.family != family ||
++		      !xfrm_selector_match(&x->sel, fl, family))) ||
+ 		    !security_xfrm_state_pol_flow_match(x, pol, fl))
+ 			return;
+ 
+@@ -774,7 +775,9 @@ static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x,
+ 		*acq_in_progress = 1;
+ 	} else if (x->km.state == XFRM_STATE_ERROR ||
+ 		   x->km.state == XFRM_STATE_EXPIRED) {
+-		if (xfrm_selector_match(&x->sel, fl, x->sel.family) &&
++		if ((!x->sel.family ||
++		     (x->sel.family == family &&
++		      xfrm_selector_match(&x->sel, fl, family))) &&
+ 		    security_xfrm_state_pol_flow_match(x, pol, fl))
+ 			*error = -ESRCH;
+ 	}
+@@ -813,7 +816,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
+ 		    tmpl->mode == x->props.mode &&
+ 		    tmpl->id.proto == x->id.proto &&
+ 		    (tmpl->id.spi == x->id.spi || !tmpl->id.spi))
+-			xfrm_state_look_at(pol, x, fl, encap_family,
++			xfrm_state_look_at(pol, x, fl, family,
+ 					   &best, &acquire_in_progress, &error);
+ 	}
+ 	if (best || acquire_in_progress)
+@@ -829,7 +832,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
+ 		    tmpl->mode == x->props.mode &&
+ 		    tmpl->id.proto == x->id.proto &&
+ 		    (tmpl->id.spi == x->id.spi || !tmpl->id.spi))
+-			xfrm_state_look_at(pol, x, fl, encap_family,
++			xfrm_state_look_at(pol, x, fl, family,
+ 					   &best, &acquire_in_progress, &error);
+ 	}
+ 
+@@ -1244,7 +1247,7 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig)
+ 	x->tfcpad = orig->tfcpad;
+ 	x->replay_maxdiff = orig->replay_maxdiff;
+ 	x->replay_maxage = orig->replay_maxage;
+-	x->curlft.add_time = orig->curlft.add_time;
++	memcpy(&x->curlft, &orig->curlft, sizeof(x->curlft));
+ 	x->km.state = orig->km.state;
+ 	x->km.seq = orig->km.seq;
+ 	x->replay = orig->replay;
+diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
+index cd2900ac473fc..280448114add1 100644
+--- a/tools/perf/builtin-top.c
++++ b/tools/perf/builtin-top.c
+@@ -633,7 +633,9 @@ repeat:
+ 	delay_msecs = top->delay_secs * MSEC_PER_SEC;
+ 	set_term_quiet_input(&save);
+ 	/* trash return*/
+-	getc(stdin);
++	clearerr(stdin);
++	if (poll(&stdin_poll, 1, 0) > 0)
++		getc(stdin);
+ 
+ 	while (!done) {
+ 		perf_top__print_sym_table(top);