Linux patch 3.15.23.15-4

2 files changed, 2459 insertions, 0 deletions

diff --git a/0000_README b/0000_README
index 019dbd26..58bb4676 100644
--- a/0000_README
+++ b/0000_README
@@ -47,6 +47,10 @@ Patch:  1000_linux-3.15.1.patch
 From:   http://www.kernel.org
 Desc:   Linux 3.15.1
 
+Patch:  1001_linux-3.15.2.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.15.2
+
 Patch:  1700_enable-thinkpad-micled.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=449248
 Desc:   Enable mic mute led in thinkpads
diff --git a/1001_linux-3.15.2.patch b/1001_linux-3.15.2.patch
new file mode 100644
index 00000000..3be738a6
--- /dev/null
+++ b/1001_linux-3.15.2.patch
@@ -0,0 +1,2455 @@
+diff --git a/Documentation/ABI/testing/ima_policy b/Documentation/ABI/testing/ima_policy
+index f1c5cc9d17a8..4c3efe434806 100644
+--- a/Documentation/ABI/testing/ima_policy
++++ b/Documentation/ABI/testing/ima_policy
+@@ -23,7 +23,7 @@ Description:
+ 				 [fowner]]
+ 			lsm:	[[subj_user=] [subj_role=] [subj_type=]
+ 				 [obj_user=] [obj_role=] [obj_type=]]
+-			option:	[[appraise_type=]]
++			option:	[[appraise_type=]] [permit_directio]
+ 
+ 		base: 	func:= [BPRM_CHECK][MMAP_CHECK][FILE_CHECK][MODULE_CHECK]
+ 			mask:= [MAY_READ] [MAY_WRITE] [MAY_APPEND] [MAY_EXEC]
+diff --git a/Makefile b/Makefile
+index e2846acd2841..475e0853a2f4 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 15
+-SUBLEVEL = 1
++SUBLEVEL = 2
+ EXTRAVERSION =
+ NAME = Shuffling Zombie Juror
+ 
+diff --git a/arch/arm/mach-at91/sysirq_mask.c b/arch/arm/mach-at91/sysirq_mask.c
+index 2ba694f9626b..f8bc3511a8c8 100644
+--- a/arch/arm/mach-at91/sysirq_mask.c
++++ b/arch/arm/mach-at91/sysirq_mask.c
+@@ -25,24 +25,28 @@
+ 
+ #include "generic.h"
+ 
+-#define AT91_RTC_IDR	0x24	/* Interrupt Disable Register */
+-#define AT91_RTC_IMR	0x28	/* Interrupt Mask Register */
++#define AT91_RTC_IDR		0x24	/* Interrupt Disable Register */
++#define AT91_RTC_IMR		0x28	/* Interrupt Mask Register */
++#define AT91_RTC_IRQ_MASK	0x1f	/* Available IRQs mask */
+ 
+ void __init at91_sysirq_mask_rtc(u32 rtc_base)
+ {
+ 	void __iomem *base;
+-	u32 mask;
+ 
+ 	base = ioremap(rtc_base, 64);
+ 	if (!base)
+ 		return;
+ 
+-	mask = readl_relaxed(base + AT91_RTC_IMR);
+-	if (mask) {
+-		pr_info("AT91: Disabling rtc irq\n");
+-		writel_relaxed(mask, base + AT91_RTC_IDR);
+-		(void)readl_relaxed(base + AT91_RTC_IMR);	/* flush */
+-	}
++	/*
++	 * sam9x5 SoCs have the following errata:
++	 * "RTC: Interrupt Mask Register cannot be used
++	 *  Interrupt Mask Register read always returns 0."
++	 *
++	 * Hence we're not relying on IMR values to disable
++	 * interrupts.
++	 */
++	writel_relaxed(AT91_RTC_IRQ_MASK, base + AT91_RTC_IDR);
++	(void)readl_relaxed(base + AT91_RTC_IMR);	/* flush */
+ 
+ 	iounmap(base);
+ }
+diff --git a/arch/mips/kvm/kvm_mips.c b/arch/mips/kvm/kvm_mips.c
+index da5186fbd77a..5efce56f0df0 100644
+--- a/arch/mips/kvm/kvm_mips.c
++++ b/arch/mips/kvm/kvm_mips.c
+@@ -304,7 +304,7 @@ struct kvm_vcpu *kvm_arch_vcpu_create(struct kvm *kvm, unsigned int id)
+ 	if (cpu_has_veic || cpu_has_vint) {
+ 		size = 0x200 + VECTORSPACING * 64;
+ 	} else {
+-		size = 0x200;
++		size = 0x4000;
+ 	}
+ 
+ 	/* Save Linux EBASE */
+diff --git a/arch/s390/kvm/interrupt.c b/arch/s390/kvm/interrupt.c
+index 200a8f9390b6..0c734baea2d4 100644
+--- a/arch/s390/kvm/interrupt.c
++++ b/arch/s390/kvm/interrupt.c
+@@ -900,7 +900,7 @@ int kvm_s390_inject_vcpu(struct kvm_vcpu *vcpu,
+ 	return 0;
+ }
+ 
+-static void clear_floating_interrupts(struct kvm *kvm)
++void kvm_s390_clear_float_irqs(struct kvm *kvm)
+ {
+ 	struct kvm_s390_float_interrupt *fi;
+ 	struct kvm_s390_interrupt_info	*n, *inti = NULL;
+@@ -1246,7 +1246,7 @@ static int flic_set_attr(struct kvm_device *dev, struct kvm_device_attr *attr)
+ 		break;
+ 	case KVM_DEV_FLIC_CLEAR_IRQS:
+ 		r = 0;
+-		clear_floating_interrupts(dev->kvm);
++		kvm_s390_clear_float_irqs(dev->kvm);
+ 		break;
+ 	case KVM_DEV_FLIC_APF_ENABLE:
+ 		dev->kvm->arch.gmap->pfault_enabled = 1;
+diff --git a/arch/s390/kvm/kvm-s390.c b/arch/s390/kvm/kvm-s390.c
+index 9ae6664ff08c..6c3699ec998e 100644
+--- a/arch/s390/kvm/kvm-s390.c
++++ b/arch/s390/kvm/kvm-s390.c
+@@ -322,6 +322,7 @@ void kvm_arch_vcpu_destroy(struct kvm_vcpu *vcpu)
+ {
+ 	VCPU_EVENT(vcpu, 3, "%s", "free cpu");
+ 	trace_kvm_s390_destroy_vcpu(vcpu->vcpu_id);
++	kvm_s390_clear_local_irqs(vcpu);
+ 	kvm_clear_async_pf_completion_queue(vcpu);
+ 	if (!kvm_is_ucontrol(vcpu->kvm)) {
+ 		clear_bit(63 - vcpu->vcpu_id,
+@@ -372,6 +373,7 @@ void kvm_arch_destroy_vm(struct kvm *kvm)
+ 	if (!kvm_is_ucontrol(kvm))
+ 		gmap_free(kvm->arch.gmap);
+ 	kvm_s390_destroy_adapters(kvm);
++	kvm_s390_clear_float_irqs(kvm);
+ }
+ 
+ /* Section: vcpu related */
+diff --git a/arch/s390/kvm/kvm-s390.h b/arch/s390/kvm/kvm-s390.h
+index 3c1e2274d9ea..604872125309 100644
+--- a/arch/s390/kvm/kvm-s390.h
++++ b/arch/s390/kvm/kvm-s390.h
+@@ -130,6 +130,7 @@ void kvm_s390_tasklet(unsigned long parm);
+ void kvm_s390_deliver_pending_interrupts(struct kvm_vcpu *vcpu);
+ void kvm_s390_deliver_pending_machine_checks(struct kvm_vcpu *vcpu);
+ void kvm_s390_clear_local_irqs(struct kvm_vcpu *vcpu);
++void kvm_s390_clear_float_irqs(struct kvm *kvm);
+ int __must_check kvm_s390_inject_vm(struct kvm *kvm,
+ 				    struct kvm_s390_interrupt *s390int);
+ int __must_check kvm_s390_inject_vcpu(struct kvm_vcpu *vcpu,
+diff --git a/arch/sparc/net/bpf_jit_comp.c b/arch/sparc/net/bpf_jit_comp.c
+index a82c6b2a9780..49cee4af16f4 100644
+--- a/arch/sparc/net/bpf_jit_comp.c
++++ b/arch/sparc/net/bpf_jit_comp.c
+@@ -83,9 +83,9 @@ static void bpf_flush_icache(void *start_, void *end_)
+ #define BNE		(F2(0, 2) | CONDNE)
+ 
+ #ifdef CONFIG_SPARC64
+-#define BNE_PTR		(F2(0, 1) | CONDNE | (2 << 20))
++#define BE_PTR		(F2(0, 1) | CONDE | (2 << 20))
+ #else
+-#define BNE_PTR		BNE
++#define BE_PTR		BE
+ #endif
+ 
+ #define SETHI(K, REG)	\
+@@ -600,7 +600,7 @@ void bpf_jit_compile(struct sk_filter *fp)
+ 			case BPF_S_ANC_IFINDEX:
+ 				emit_skb_loadptr(dev, r_A);
+ 				emit_cmpi(r_A, 0);
+-				emit_branch(BNE_PTR, cleanup_addr + 4);
++				emit_branch(BE_PTR, cleanup_addr + 4);
+ 				emit_nop();
+ 				emit_load32(r_A, struct net_device, ifindex, r_A);
+ 				break;
+@@ -613,7 +613,7 @@ void bpf_jit_compile(struct sk_filter *fp)
+ 			case BPF_S_ANC_HATYPE:
+ 				emit_skb_loadptr(dev, r_A);
+ 				emit_cmpi(r_A, 0);
+-				emit_branch(BNE_PTR, cleanup_addr + 4);
++				emit_branch(BE_PTR, cleanup_addr + 4);
+ 				emit_nop();
+ 				emit_load16(r_A, struct net_device, type, r_A);
+ 				break;
+diff --git a/arch/x86/kvm/lapic.c b/arch/x86/kvm/lapic.c
+index 9736529ade08..006911858174 100644
+--- a/arch/x86/kvm/lapic.c
++++ b/arch/x86/kvm/lapic.c
+@@ -360,6 +360,8 @@ static inline void apic_clear_irr(int vec, struct kvm_lapic *apic)
+ 
+ static inline void apic_set_isr(int vec, struct kvm_lapic *apic)
+ {
++	/* Note that we never get here with APIC virtualization enabled.  */
++
+ 	if (!__apic_test_and_set_vector(vec, apic->regs + APIC_ISR))
+ 		++apic->isr_count;
+ 	BUG_ON(apic->isr_count > MAX_APIC_VECTOR);
+@@ -371,12 +373,48 @@ static inline void apic_set_isr(int vec, struct kvm_lapic *apic)
+ 	apic->highest_isr_cache = vec;
+ }
+ 
++static inline int apic_find_highest_isr(struct kvm_lapic *apic)
++{
++	int result;
++
++	/*
++	 * Note that isr_count is always 1, and highest_isr_cache
++	 * is always -1, with APIC virtualization enabled.
++	 */
++	if (!apic->isr_count)
++		return -1;
++	if (likely(apic->highest_isr_cache != -1))
++		return apic->highest_isr_cache;
++
++	result = find_highest_vector(apic->regs + APIC_ISR);
++	ASSERT(result == -1 || result >= 16);
++
++	return result;
++}
++
+ static inline void apic_clear_isr(int vec, struct kvm_lapic *apic)
+ {
+-	if (__apic_test_and_clear_vector(vec, apic->regs + APIC_ISR))
++	struct kvm_vcpu *vcpu;
++	if (!__apic_test_and_clear_vector(vec, apic->regs + APIC_ISR))
++		return;
++
++	vcpu = apic->vcpu;
++
++	/*
++	 * We do get here for APIC virtualization enabled if the guest
++	 * uses the Hyper-V APIC enlightenment.  In this case we may need
++	 * to trigger a new interrupt delivery by writing the SVI field;
++	 * on the other hand isr_count and highest_isr_cache are unused
++	 * and must be left alone.
++	 */
++	if (unlikely(kvm_apic_vid_enabled(vcpu->kvm)))
++		kvm_x86_ops->hwapic_isr_update(vcpu->kvm,
++					       apic_find_highest_isr(apic));
++	else {
+ 		--apic->isr_count;
+-	BUG_ON(apic->isr_count < 0);
+-	apic->highest_isr_cache = -1;
++		BUG_ON(apic->isr_count < 0);
++		apic->highest_isr_cache = -1;
++	}
+ }
+ 
+ int kvm_lapic_find_highest_irr(struct kvm_vcpu *vcpu)
+@@ -456,22 +494,6 @@ static void pv_eoi_clr_pending(struct kvm_vcpu *vcpu)
+ 	__clear_bit(KVM_APIC_PV_EOI_PENDING, &vcpu->arch.apic_attention);
+ }
+ 
+-static inline int apic_find_highest_isr(struct kvm_lapic *apic)
+-{
+-	int result;
+-
+-	/* Note that isr_count is always 1 with vid enabled */
+-	if (!apic->isr_count)
+-		return -1;
+-	if (likely(apic->highest_isr_cache != -1))
+-		return apic->highest_isr_cache;
+-
+-	result = find_highest_vector(apic->regs + APIC_ISR);
+-	ASSERT(result == -1 || result >= 16);
+-
+-	return result;
+-}
+-
+ void kvm_apic_update_tmr(struct kvm_vcpu *vcpu, u32 *tmr)
+ {
+ 	struct kvm_lapic *apic = vcpu->arch.apic;
+@@ -1605,6 +1627,8 @@ int kvm_get_apic_interrupt(struct kvm_vcpu *vcpu)
+ 	int vector = kvm_apic_has_interrupt(vcpu);
+ 	struct kvm_lapic *apic = vcpu->arch.apic;
+ 
++	/* Note that we never get here with APIC virtualization enabled.  */
++
+ 	if (vector == -1)
+ 		return -1;
+ 
+diff --git a/drivers/hv/connection.c b/drivers/hv/connection.c
+index 2e7801af466e..05827eccc53a 100644
+--- a/drivers/hv/connection.c
++++ b/drivers/hv/connection.c
+@@ -224,8 +224,8 @@ cleanup:
+ 		vmbus_connection.int_page = NULL;
+ 	}
+ 
+-	free_pages((unsigned long)vmbus_connection.monitor_pages[0], 1);
+-	free_pages((unsigned long)vmbus_connection.monitor_pages[1], 1);
++	free_pages((unsigned long)vmbus_connection.monitor_pages[0], 0);
++	free_pages((unsigned long)vmbus_connection.monitor_pages[1], 0);
+ 	vmbus_connection.monitor_pages[0] = NULL;
+ 	vmbus_connection.monitor_pages[1] = NULL;
+ 
+diff --git a/drivers/hv/hv_balloon.c b/drivers/hv/hv_balloon.c
+index 7e6d78dc9437..5e90c5d771a7 100644
+--- a/drivers/hv/hv_balloon.c
++++ b/drivers/hv/hv_balloon.c
+@@ -19,6 +19,7 @@
+ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+ 
+ #include <linux/kernel.h>
++#include <linux/jiffies.h>
+ #include <linux/mman.h>
+ #include <linux/delay.h>
+ #include <linux/init.h>
+@@ -459,6 +460,11 @@ static bool do_hot_add;
+  */
+ static uint pressure_report_delay = 45;
+ 
++/*
++ * The last time we posted a pressure report to host.
++ */
++static unsigned long last_post_time;
++
+ module_param(hot_add, bool, (S_IRUGO | S_IWUSR));
+ MODULE_PARM_DESC(hot_add, "If set attempt memory hot_add");
+ 
+@@ -542,6 +548,7 @@ struct hv_dynmem_device {
+ 
+ static struct hv_dynmem_device dm_device;
+ 
++static void post_status(struct hv_dynmem_device *dm);
+ #ifdef CONFIG_MEMORY_HOTPLUG
+ 
+ static void hv_bring_pgs_online(unsigned long start_pfn, unsigned long size)
+@@ -612,7 +619,7 @@ static void hv_mem_hot_add(unsigned long start, unsigned long size,
+ 		 * have not been "onlined" within the allowed time.
+ 		 */
+ 		wait_for_completion_timeout(&dm_device.ol_waitevent, 5*HZ);
+-
++		post_status(&dm_device);
+ 	}
+ 
+ 	return;
+@@ -951,11 +958,17 @@ static void post_status(struct hv_dynmem_device *dm)
+ {
+ 	struct dm_status status;
+ 	struct sysinfo val;
++	unsigned long now = jiffies;
++	unsigned long last_post = last_post_time;
+ 
+ 	if (pressure_report_delay > 0) {
+ 		--pressure_report_delay;
+ 		return;
+ 	}
++
++	if (!time_after(now, (last_post_time + HZ)))
++		return;
++
+ 	si_meminfo(&val);
+ 	memset(&status, 0, sizeof(struct dm_status));
+ 	status.hdr.type = DM_STATUS_REPORT;
+@@ -983,6 +996,14 @@ static void post_status(struct hv_dynmem_device *dm)
+ 	if (status.hdr.trans_id != atomic_read(&trans_id))
+ 		return;
+ 
++	/*
++	 * If the last post time that we sampled has changed,
++	 * we have raced, don't post the status.
++	 */
++	if (last_post != last_post_time)
++		return;
++
++	last_post_time = jiffies;
+ 	vmbus_sendpacket(dm->dev->channel, &status,
+ 				sizeof(struct dm_status),
+ 				(unsigned long)NULL,
+@@ -1117,7 +1138,7 @@ static void balloon_up(struct work_struct *dummy)
+ 
+ 			if (ret == -EAGAIN)
+ 				msleep(20);
+-
++			post_status(&dm_device);
+ 		} while (ret == -EAGAIN);
+ 
+ 		if (ret) {
+@@ -1144,8 +1165,10 @@ static void balloon_down(struct hv_dynmem_device *dm,
+ 	struct dm_unballoon_response resp;
+ 	int i;
+ 
+-	for (i = 0; i < range_count; i++)
++	for (i = 0; i < range_count; i++) {
+ 		free_balloon_pages(dm, &range_array[i]);
++		post_status(&dm_device);
++	}
+ 
+ 	if (req->more_pages == 1)
+ 		return;
+diff --git a/drivers/iio/adc/at91_adc.c b/drivers/iio/adc/at91_adc.c
+index 89777ed9abd8..be0b2accf895 100644
+--- a/drivers/iio/adc/at91_adc.c
++++ b/drivers/iio/adc/at91_adc.c
+@@ -322,12 +322,11 @@ static int at91_adc_channel_init(struct iio_dev *idev)
+ 	return idev->num_channels;
+ }
+ 
+-static u8 at91_adc_get_trigger_value_by_name(struct iio_dev *idev,
++static int at91_adc_get_trigger_value_by_name(struct iio_dev *idev,
+ 					     struct at91_adc_trigger *triggers,
+ 					     const char *trigger_name)
+ {
+ 	struct at91_adc_state *st = iio_priv(idev);
+-	u8 value = 0;
+ 	int i;
+ 
+ 	for (i = 0; i < st->trigger_number; i++) {
+@@ -340,15 +339,16 @@ static u8 at91_adc_get_trigger_value_by_name(struct iio_dev *idev,
+ 			return -ENOMEM;
+ 
+ 		if (strcmp(trigger_name, name) == 0) {
+-			value = triggers[i].value;
+ 			kfree(name);
+-			break;
++			if (triggers[i].value == 0)
++				return -EINVAL;
++			return triggers[i].value;
+ 		}
+ 
+ 		kfree(name);
+ 	}
+ 
+-	return value;
++	return -EINVAL;
+ }
+ 
+ static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state)
+@@ -358,14 +358,14 @@ static int at91_adc_configure_trigger(struct iio_trigger *trig, bool state)
+ 	struct iio_buffer *buffer = idev->buffer;
+ 	struct at91_adc_reg_desc *reg = st->registers;
+ 	u32 status = at91_adc_readl(st, reg->trigger_register);
+-	u8 value;
++	int value;
+ 	u8 bit;
+ 
+ 	value = at91_adc_get_trigger_value_by_name(idev,
+ 						   st->trigger_list,
+ 						   idev->trig->name);
+-	if (value == 0)
+-		return -EINVAL;
++	if (value < 0)
++		return value;
+ 
+ 	if (state) {
+ 		st->buffer = kmalloc(idev->scan_bytes, GFP_KERNEL);
+diff --git a/drivers/iio/adc/max1363.c b/drivers/iio/adc/max1363.c
+index 9cf3229a7272..1b3b74be5c20 100644
+--- a/drivers/iio/adc/max1363.c
++++ b/drivers/iio/adc/max1363.c
+@@ -1252,8 +1252,8 @@ static const struct max1363_chip_info max1363_chip_info_tbl[] = {
+ 		.num_modes = ARRAY_SIZE(max1238_mode_list),
+ 		.default_mode = s0to11,
+ 		.info = &max1238_info,
+-		.channels = max1238_channels,
+-		.num_channels = ARRAY_SIZE(max1238_channels),
++		.channels = max1038_channels,
++		.num_channels = ARRAY_SIZE(max1038_channels),
+ 	},
+ 	[max11605] = {
+ 		.bits = 8,
+@@ -1262,8 +1262,8 @@ static const struct max1363_chip_info max1363_chip_info_tbl[] = {
+ 		.num_modes = ARRAY_SIZE(max1238_mode_list),
+ 		.default_mode = s0to11,
+ 		.info = &max1238_info,
+-		.channels = max1238_channels,
+-		.num_channels = ARRAY_SIZE(max1238_channels),
++		.channels = max1038_channels,
++		.num_channels = ARRAY_SIZE(max1038_channels),
+ 	},
+ 	[max11606] = {
+ 		.bits = 10,
+@@ -1312,8 +1312,8 @@ static const struct max1363_chip_info max1363_chip_info_tbl[] = {
+ 		.num_modes = ARRAY_SIZE(max1238_mode_list),
+ 		.default_mode = s0to11,
+ 		.info = &max1238_info,
+-		.channels = max1238_channels,
+-		.num_channels = ARRAY_SIZE(max1238_channels),
++		.channels = max1138_channels,
++		.num_channels = ARRAY_SIZE(max1138_channels),
+ 	},
+ 	[max11611] = {
+ 		.bits = 10,
+@@ -1322,8 +1322,8 @@ static const struct max1363_chip_info max1363_chip_info_tbl[] = {
+ 		.num_modes = ARRAY_SIZE(max1238_mode_list),
+ 		.default_mode = s0to11,
+ 		.info = &max1238_info,
+-		.channels = max1238_channels,
+-		.num_channels = ARRAY_SIZE(max1238_channels),
++		.channels = max1138_channels,
++		.num_channels = ARRAY_SIZE(max1138_channels),
+ 	},
+ 	[max11612] = {
+ 		.bits = 12,
+diff --git a/drivers/iio/adc/men_z188_adc.c b/drivers/iio/adc/men_z188_adc.c
+index 6989c16aec2b..b58d6302521f 100644
+--- a/drivers/iio/adc/men_z188_adc.c
++++ b/drivers/iio/adc/men_z188_adc.c
+@@ -121,8 +121,8 @@ static int men_z188_probe(struct mcb_device *dev,
+ 	indio_dev->num_channels = ARRAY_SIZE(z188_adc_iio_channels);
+ 
+ 	mem = mcb_request_mem(dev, "z188-adc");
+-	if (!mem)
+-		return -ENOMEM;
++	if (IS_ERR(mem))
++		return PTR_ERR(mem);
+ 
+ 	adc->base = ioremap(mem->start, resource_size(mem));
+ 	if (adc->base == NULL)
+diff --git a/drivers/iio/magnetometer/ak8975.c b/drivers/iio/magnetometer/ak8975.c
+index 74866d1efd1b..2a524acabec8 100644
+--- a/drivers/iio/magnetometer/ak8975.c
++++ b/drivers/iio/magnetometer/ak8975.c
+@@ -352,8 +352,6 @@ static int ak8975_read_axis(struct iio_dev *indio_dev, int index, int *val)
+ {
+ 	struct ak8975_data *data = iio_priv(indio_dev);
+ 	struct i2c_client *client = data->client;
+-	u16 meas_reg;
+-	s16 raw;
+ 	int ret;
+ 
+ 	mutex_lock(&data->lock);
+@@ -401,16 +399,11 @@ static int ak8975_read_axis(struct iio_dev *indio_dev, int index, int *val)
+ 		dev_err(&client->dev, "Read axis data fails\n");
+ 		goto exit;
+ 	}
+-	meas_reg = ret;
+ 
+ 	mutex_unlock(&data->lock);
+ 
+-	/* Endian conversion of the measured values. */
+-	raw = (s16) (le16_to_cpu(meas_reg));
+-
+ 	/* Clamp to valid range. */
+-	raw = clamp_t(s16, raw, -4096, 4095);
+-	*val = raw;
++	*val = clamp_t(s16, ret, -4096, 4095);
+ 	return IIO_VAL_INT;
+ 
+ exit:
+diff --git a/drivers/iio/pressure/mpl3115.c b/drivers/iio/pressure/mpl3115.c
+index ba6d0c520e63..01b2e0b18878 100644
+--- a/drivers/iio/pressure/mpl3115.c
++++ b/drivers/iio/pressure/mpl3115.c
+@@ -98,7 +98,7 @@ static int mpl3115_read_raw(struct iio_dev *indio_dev,
+ 			mutex_unlock(&data->lock);
+ 			if (ret < 0)
+ 				return ret;
+-			*val = sign_extend32(be32_to_cpu(tmp) >> 12, 23);
++			*val = be32_to_cpu(tmp) >> 12;
+ 			return IIO_VAL_INT;
+ 		case IIO_TEMP: /* in 0.0625 celsius / LSB */
+ 			mutex_lock(&data->lock);
+@@ -112,7 +112,7 @@ static int mpl3115_read_raw(struct iio_dev *indio_dev,
+ 			mutex_unlock(&data->lock);
+ 			if (ret < 0)
+ 				return ret;
+-			*val = sign_extend32(be32_to_cpu(tmp) >> 20, 15);
++			*val = sign_extend32(be32_to_cpu(tmp) >> 20, 11);
+ 			return IIO_VAL_INT;
+ 		default:
+ 			return -EINVAL;
+@@ -185,7 +185,7 @@ static const struct iio_chan_spec mpl3115_channels[] = {
+ 			BIT(IIO_CHAN_INFO_SCALE),
+ 		.scan_index = 0,
+ 		.scan_type = {
+-			.sign = 's',
++			.sign = 'u',
+ 			.realbits = 20,
+ 			.storagebits = 32,
+ 			.shift = 12,
+diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
+index 6a9509ccd33b..08ed9a30c3a7 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -307,6 +307,27 @@ static const u16 sh_eth_offset_fast_sh4[SH_ETH_MAX_REGISTER_OFFSET] = {
+ };
+ 
+ static const u16 sh_eth_offset_fast_sh3_sh2[SH_ETH_MAX_REGISTER_OFFSET] = {
++	[EDMR]		= 0x0000,
++	[EDTRR]		= 0x0004,
++	[EDRRR]		= 0x0008,
++	[TDLAR]		= 0x000c,
++	[RDLAR]		= 0x0010,
++	[EESR]		= 0x0014,
++	[EESIPR]	= 0x0018,
++	[TRSCER]	= 0x001c,
++	[RMFCR]		= 0x0020,
++	[TFTR]		= 0x0024,
++	[FDR]		= 0x0028,
++	[RMCR]		= 0x002c,
++	[EDOCR]		= 0x0030,
++	[FCFTR]		= 0x0034,
++	[RPADIR]	= 0x0038,
++	[TRIMD]		= 0x003c,
++	[RBWAR]		= 0x0040,
++	[RDFAR]		= 0x0044,
++	[TBRAR]		= 0x004c,
++	[TDFAR]		= 0x0050,
++
+ 	[ECMR]		= 0x0160,
+ 	[ECSR]		= 0x0164,
+ 	[ECSIPR]	= 0x0168,
+@@ -546,7 +567,6 @@ static struct sh_eth_cpu_data sh7757_data = {
+ 	.register_type	= SH_ETH_REG_FAST_SH4,
+ 
+ 	.eesipr_value	= DMAC_M_RFRMER | DMAC_M_ECI | 0x003fffff,
+-	.rmcr_value	= RMCR_RNC,
+ 
+ 	.tx_check	= EESR_FTC | EESR_CND | EESR_DLC | EESR_CD | EESR_RTO,
+ 	.eesr_err_check	= EESR_TWB | EESR_TABT | EESR_RABT | EESR_RFE |
+@@ -624,7 +644,6 @@ static struct sh_eth_cpu_data sh7757_data_giga = {
+ 			  EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE |
+ 			  EESR_TDE | EESR_ECI,
+ 	.fdr_value	= 0x0000072f,
+-	.rmcr_value	= RMCR_RNC,
+ 
+ 	.irq_flags	= IRQF_SHARED,
+ 	.apr		= 1,
+@@ -752,7 +771,6 @@ static struct sh_eth_cpu_data r8a7740_data = {
+ 			  EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE |
+ 			  EESR_TDE | EESR_ECI,
+ 	.fdr_value	= 0x0000070f,
+-	.rmcr_value	= RMCR_RNC,
+ 
+ 	.apr		= 1,
+ 	.mpr		= 1,
+@@ -784,7 +802,6 @@ static struct sh_eth_cpu_data r7s72100_data = {
+ 			  EESR_RFE | EESR_RDE | EESR_RFRMER | EESR_TFE |
+ 			  EESR_TDE | EESR_ECI,
+ 	.fdr_value	= 0x0000070f,
+-	.rmcr_value	= RMCR_RNC,
+ 
+ 	.no_psr		= 1,
+ 	.apr		= 1,
+@@ -833,9 +850,6 @@ static void sh_eth_set_default_cpu_data(struct sh_eth_cpu_data *cd)
+ 	if (!cd->fdr_value)
+ 		cd->fdr_value = DEFAULT_FDR_INIT;
+ 
+-	if (!cd->rmcr_value)
+-		cd->rmcr_value = DEFAULT_RMCR_VALUE;
+-
+ 	if (!cd->tx_check)
+ 		cd->tx_check = DEFAULT_TX_CHECK;
+ 
+@@ -1287,8 +1301,8 @@ static int sh_eth_dev_init(struct net_device *ndev, bool start)
+ 	sh_eth_write(ndev, mdp->cd->fdr_value, FDR);
+ 	sh_eth_write(ndev, 0, TFTR);
+ 
+-	/* Frame recv control */
+-	sh_eth_write(ndev, mdp->cd->rmcr_value, RMCR);
++	/* Frame recv control (enable multiple-packets per rx irq) */
++	sh_eth_write(ndev, RMCR_RNC, RMCR);
+ 
+ 	sh_eth_write(ndev, DESC_I_RINT8 | DESC_I_RINT5 | DESC_I_TINT2, TRSCER);
+ 
+diff --git a/drivers/net/ethernet/renesas/sh_eth.h b/drivers/net/ethernet/renesas/sh_eth.h
+index d55e37cd5fec..b37c427144ee 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.h
++++ b/drivers/net/ethernet/renesas/sh_eth.h
+@@ -319,7 +319,6 @@ enum TD_STS_BIT {
+ enum RMCR_BIT {
+ 	RMCR_RNC = 0x00000001,
+ };
+-#define DEFAULT_RMCR_VALUE	0x00000000
+ 
+ /* ECMR */
+ enum FELIC_MODE_BIT {
+@@ -466,7 +465,6 @@ struct sh_eth_cpu_data {
+ 	unsigned long fdr_value;
+ 	unsigned long fcftr_value;
+ 	unsigned long rpadir_value;
+-	unsigned long rmcr_value;
+ 
+ 	/* interrupt checking mask */
+ 	unsigned long tx_check;
+diff --git a/drivers/net/ethernet/sfc/io.h b/drivers/net/ethernet/sfc/io.h
+index 4d3f119b67b3..afb94aa2c15e 100644
+--- a/drivers/net/ethernet/sfc/io.h
++++ b/drivers/net/ethernet/sfc/io.h
+@@ -66,10 +66,17 @@
+ #define EFX_USE_QWORD_IO 1
+ #endif
+ 
++/* Hardware issue requires that only 64-bit naturally aligned writes
++ * are seen by hardware. Its not strictly necessary to restrict to
++ * x86_64 arch, but done for safety since unusual write combining behaviour
++ * can break PIO.
++ */
++#ifdef CONFIG_X86_64
+ /* PIO is a win only if write-combining is possible */
+ #ifdef ARCH_HAS_IOREMAP_WC
+ #define EFX_USE_PIO 1
+ #endif
++#endif
+ 
+ #ifdef EFX_USE_QWORD_IO
+ static inline void _efx_writeq(struct efx_nic *efx, __le64 value,
+diff --git a/drivers/net/ethernet/sfc/tx.c b/drivers/net/ethernet/sfc/tx.c
+index fa9475300411..ede8dcca0ff3 100644
+--- a/drivers/net/ethernet/sfc/tx.c
++++ b/drivers/net/ethernet/sfc/tx.c
+@@ -189,6 +189,18 @@ struct efx_short_copy_buffer {
+ 	u8 buf[L1_CACHE_BYTES];
+ };
+ 
++/* Copy in explicit 64-bit writes. */
++static void efx_memcpy_64(void __iomem *dest, void *src, size_t len)
++{
++	u64 *src64 = src;
++	u64 __iomem *dest64 = dest;
++	size_t l64 = len / 8;
++	size_t i;
++
++	for (i = 0; i < l64; i++)
++		writeq(src64[i], &dest64[i]);
++}
++
+ /* Copy to PIO, respecting that writes to PIO buffers must be dword aligned.
+  * Advances piobuf pointer. Leaves additional data in the copy buffer.
+  */
+@@ -198,7 +210,7 @@ static void efx_memcpy_toio_aligned(struct efx_nic *efx, u8 __iomem **piobuf,
+ {
+ 	int block_len = len & ~(sizeof(copy_buf->buf) - 1);
+ 
+-	memcpy_toio(*piobuf, data, block_len);
++	efx_memcpy_64(*piobuf, data, block_len);
+ 	*piobuf += block_len;
+ 	len -= block_len;
+ 
+@@ -230,7 +242,7 @@ static void efx_memcpy_toio_aligned_cb(struct efx_nic *efx, u8 __iomem **piobuf,
+ 		if (copy_buf->used < sizeof(copy_buf->buf))
+ 			return;
+ 
+-		memcpy_toio(*piobuf, copy_buf->buf, sizeof(copy_buf->buf));
++		efx_memcpy_64(*piobuf, copy_buf->buf, sizeof(copy_buf->buf));
+ 		*piobuf += sizeof(copy_buf->buf);
+ 		data += copy_to_buf;
+ 		len -= copy_to_buf;
+@@ -245,7 +257,7 @@ static void efx_flush_copy_buffer(struct efx_nic *efx, u8 __iomem *piobuf,
+ {
+ 	/* if there's anything in it, write the whole buffer, including junk */
+ 	if (copy_buf->used)
+-		memcpy_toio(piobuf, copy_buf->buf, sizeof(copy_buf->buf));
++		efx_memcpy_64(piobuf, copy_buf->buf, sizeof(copy_buf->buf));
+ }
+ 
+ /* Traverse skb structure and copy fragments in to PIO buffer.
+@@ -304,8 +316,8 @@ efx_enqueue_skb_pio(struct efx_tx_queue *tx_queue, struct sk_buff *skb)
+ 		 */
+ 		BUILD_BUG_ON(L1_CACHE_BYTES >
+ 			     SKB_DATA_ALIGN(sizeof(struct skb_shared_info)));
+-		memcpy_toio(tx_queue->piobuf, skb->data,
+-			    ALIGN(skb->len, L1_CACHE_BYTES));
++		efx_memcpy_64(tx_queue->piobuf, skb->data,
++			      ALIGN(skb->len, L1_CACHE_BYTES));
+ 	}
+ 
+ 	EFX_POPULATE_QWORD_5(buffer->option,
+diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
+index d53e299ae1d9..7eec598c5cb6 100644
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -1036,7 +1036,6 @@ static int macvlan_device_event(struct notifier_block *unused,
+ 		list_for_each_entry_safe(vlan, next, &port->vlans, list)
+ 			vlan->dev->rtnl_link_ops->dellink(vlan->dev, &list_kill);
+ 		unregister_netdevice_many(&list_kill);
+-		list_del(&list_kill);
+ 		break;
+ 	case NETDEV_PRE_TYPE_CHANGE:
+ 		/* Forbid underlaying device to change its type. */
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index dc4bf06948c7..cf62d7e8329f 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -763,7 +763,12 @@ static const struct usb_device_id products[] = {
+ 	{QMI_FIXED_INTF(0x2357, 0x9000, 4)},	/* TP-LINK MA260 */
+ 	{QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},	/* Telit LE920 */
+ 	{QMI_FIXED_INTF(0x1bc7, 0x1201, 2)},	/* Telit LE920 */
+-	{QMI_FIXED_INTF(0x0b3c, 0xc005, 6)},    /* Olivetti Olicard 200 */
++	{QMI_FIXED_INTF(0x0b3c, 0xc000, 4)},	/* Olivetti Olicard 100 */
++	{QMI_FIXED_INTF(0x0b3c, 0xc001, 4)},	/* Olivetti Olicard 120 */
++	{QMI_FIXED_INTF(0x0b3c, 0xc002, 4)},	/* Olivetti Olicard 140 */
++	{QMI_FIXED_INTF(0x0b3c, 0xc004, 6)},	/* Olivetti Olicard 155 */
++	{QMI_FIXED_INTF(0x0b3c, 0xc005, 6)},	/* Olivetti Olicard 200 */
++	{QMI_FIXED_INTF(0x0b3c, 0xc00a, 6)},	/* Olivetti Olicard 160 */
+ 	{QMI_FIXED_INTF(0x0b3c, 0xc00b, 4)},	/* Olivetti Olicard 500 */
+ 	{QMI_FIXED_INTF(0x1e2d, 0x0060, 4)},	/* Cinterion PLxx */
+ 	{QMI_FIXED_INTF(0x1e2d, 0x0053, 4)},	/* Cinterion PHxx,PXxx */
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index 4dbb2ed85b97..77dcf92ea350 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -2275,9 +2275,9 @@ static void vxlan_setup(struct net_device *dev)
+ 	eth_hw_addr_random(dev);
+ 	ether_setup(dev);
+ 	if (vxlan->default_dst.remote_ip.sa.sa_family == AF_INET6)
+-		dev->hard_header_len = ETH_HLEN + VXLAN6_HEADROOM;
++		dev->needed_headroom = ETH_HLEN + VXLAN6_HEADROOM;
+ 	else
+-		dev->hard_header_len = ETH_HLEN + VXLAN_HEADROOM;
++		dev->needed_headroom = ETH_HLEN + VXLAN_HEADROOM;
+ 
+ 	dev->netdev_ops = &vxlan_netdev_ops;
+ 	dev->destructor = free_netdev;
+@@ -2660,8 +2660,7 @@ static int vxlan_newlink(struct net *net, struct net_device *dev,
+ 		if (!tb[IFLA_MTU])
+ 			dev->mtu = lowerdev->mtu - (use_ipv6 ? VXLAN6_HEADROOM : VXLAN_HEADROOM);
+ 
+-		/* update header length based on lower device */
+-		dev->hard_header_len = lowerdev->hard_header_len +
++		dev->needed_headroom = lowerdev->hard_header_len +
+ 				       (use_ipv6 ? VXLAN6_HEADROOM : VXLAN_HEADROOM);
+ 	} else if (use_ipv6)
+ 		vxlan->flags |= VXLAN_F_IPV6;
+diff --git a/drivers/rtc/rtc-at91rm9200.c b/drivers/rtc/rtc-at91rm9200.c
+index 3281c90691c3..44fe83ee9bee 100644
+--- a/drivers/rtc/rtc-at91rm9200.c
++++ b/drivers/rtc/rtc-at91rm9200.c
+@@ -48,6 +48,7 @@ struct at91_rtc_config {
+ 
+ static const struct at91_rtc_config *at91_rtc_config;
+ static DECLARE_COMPLETION(at91_rtc_updated);
++static DECLARE_COMPLETION(at91_rtc_upd_rdy);
+ static unsigned int at91_alarm_year = AT91_RTC_EPOCH;
+ static void __iomem *at91_rtc_regs;
+ static int irq;
+@@ -161,6 +162,8 @@ static int at91_rtc_settime(struct device *dev, struct rtc_time *tm)
+ 		1900 + tm->tm_year, tm->tm_mon, tm->tm_mday,
+ 		tm->tm_hour, tm->tm_min, tm->tm_sec);
+ 
++	wait_for_completion(&at91_rtc_upd_rdy);
++
+ 	/* Stop Time/Calendar from counting */
+ 	cr = at91_rtc_read(AT91_RTC_CR);
+ 	at91_rtc_write(AT91_RTC_CR, cr | AT91_RTC_UPDCAL | AT91_RTC_UPDTIM);
+@@ -183,7 +186,9 @@ static int at91_rtc_settime(struct device *dev, struct rtc_time *tm)
+ 
+ 	/* Restart Time/Calendar */
+ 	cr = at91_rtc_read(AT91_RTC_CR);
++	at91_rtc_write(AT91_RTC_SCCR, AT91_RTC_SECEV);
+ 	at91_rtc_write(AT91_RTC_CR, cr & ~(AT91_RTC_UPDCAL | AT91_RTC_UPDTIM));
++	at91_rtc_write_ier(AT91_RTC_SECEV);
+ 
+ 	return 0;
+ }
+@@ -290,8 +295,10 @@ static irqreturn_t at91_rtc_interrupt(int irq, void *dev_id)
+ 	if (rtsr) {		/* this interrupt is shared!  Is it ours? */
+ 		if (rtsr & AT91_RTC_ALARM)
+ 			events |= (RTC_AF | RTC_IRQF);
+-		if (rtsr & AT91_RTC_SECEV)
+-			events |= (RTC_UF | RTC_IRQF);
++		if (rtsr & AT91_RTC_SECEV) {
++			complete(&at91_rtc_upd_rdy);
++			at91_rtc_write_idr(AT91_RTC_SECEV);
++		}
+ 		if (rtsr & AT91_RTC_ACKUPD)
+ 			complete(&at91_rtc_updated);
+ 
+@@ -413,6 +420,11 @@ static int __init at91_rtc_probe(struct platform_device *pdev)
+ 		return PTR_ERR(rtc);
+ 	platform_set_drvdata(pdev, rtc);
+ 
++	/* enable SECEV interrupt in order to initialize at91_rtc_upd_rdy
++	 * completion.
++	 */
++	at91_rtc_write_ier(AT91_RTC_SECEV);
++
+ 	dev_info(&pdev->dev, "AT91 Real Time Clock driver.\n");
+ 	return 0;
+ }
+diff --git a/drivers/staging/iio/adc/mxs-lradc.c b/drivers/staging/iio/adc/mxs-lradc.c
+index dae8d1a9038e..52d7517b342e 100644
+--- a/drivers/staging/iio/adc/mxs-lradc.c
++++ b/drivers/staging/iio/adc/mxs-lradc.c
+@@ -846,6 +846,14 @@ static int mxs_lradc_read_single(struct iio_dev *iio_dev, int chan, int *val)
+ 			LRADC_CTRL1);
+ 	mxs_lradc_reg_clear(lradc, 0xff, LRADC_CTRL0);
+ 
++	/* Enable / disable the divider per requirement */
++	if (test_bit(chan, &lradc->is_divided))
++		mxs_lradc_reg_set(lradc, 1 << LRADC_CTRL2_DIVIDE_BY_TWO_OFFSET,
++			LRADC_CTRL2);
++	else
++		mxs_lradc_reg_clear(lradc,
++			1 << LRADC_CTRL2_DIVIDE_BY_TWO_OFFSET, LRADC_CTRL2);
++
+ 	/* Clean the slot's previous content, then set new one. */
+ 	mxs_lradc_reg_clear(lradc, LRADC_CTRL4_LRADCSELECT_MASK(0),
+ 			LRADC_CTRL4);
+@@ -961,15 +969,11 @@ static int mxs_lradc_write_raw(struct iio_dev *iio_dev,
+ 		if (val == scale_avail[MXS_LRADC_DIV_DISABLED].integer &&
+ 		    val2 == scale_avail[MXS_LRADC_DIV_DISABLED].nano) {
+ 			/* divider by two disabled */
+-			writel(1 << LRADC_CTRL2_DIVIDE_BY_TWO_OFFSET,
+-			       lradc->base + LRADC_CTRL2 + STMP_OFFSET_REG_CLR);
+ 			clear_bit(chan->channel, &lradc->is_divided);
+ 			ret = 0;
+ 		} else if (val == scale_avail[MXS_LRADC_DIV_ENABLED].integer &&
+ 			   val2 == scale_avail[MXS_LRADC_DIV_ENABLED].nano) {
+ 			/* divider by two enabled */
+-			writel(1 << LRADC_CTRL2_DIVIDE_BY_TWO_OFFSET,
+-			       lradc->base + LRADC_CTRL2 + STMP_OFFSET_REG_SET);
+ 			set_bit(chan->channel, &lradc->is_divided);
+ 			ret = 0;
+ 		}
+diff --git a/drivers/staging/iio/light/tsl2x7x_core.c b/drivers/staging/iio/light/tsl2x7x_core.c
+index 9e0f2a9c73ae..ab338e3ddd05 100644
+--- a/drivers/staging/iio/light/tsl2x7x_core.c
++++ b/drivers/staging/iio/light/tsl2x7x_core.c
+@@ -667,9 +667,13 @@ static int tsl2x7x_chip_on(struct iio_dev *indio_dev)
+ 	chip->tsl2x7x_config[TSL2X7X_PRX_COUNT] =
+ 			chip->tsl2x7x_settings.prox_pulse_count;
+ 	chip->tsl2x7x_config[TSL2X7X_PRX_MINTHRESHLO] =
+-	chip->tsl2x7x_settings.prox_thres_low;
++			(chip->tsl2x7x_settings.prox_thres_low) & 0xFF;
++	chip->tsl2x7x_config[TSL2X7X_PRX_MINTHRESHHI] =
++			(chip->tsl2x7x_settings.prox_thres_low >> 8) & 0xFF;
+ 	chip->tsl2x7x_config[TSL2X7X_PRX_MAXTHRESHLO] =
+-			chip->tsl2x7x_settings.prox_thres_high;
++			(chip->tsl2x7x_settings.prox_thres_high) & 0xFF;
++	chip->tsl2x7x_config[TSL2X7X_PRX_MAXTHRESHHI] =
++			(chip->tsl2x7x_settings.prox_thres_high >> 8) & 0xFF;
+ 
+ 	/* and make sure we're not already on */
+ 	if (chip->tsl2x7x_chip_status == TSL2X7X_CHIP_WORKING) {
+diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
+index de77d9aa22c6..6689de6c5591 100644
+--- a/drivers/target/iscsi/iscsi_target_auth.c
++++ b/drivers/target/iscsi/iscsi_target_auth.c
+@@ -314,6 +314,16 @@ static int chap_server_compute_md5(
+ 		goto out;
+ 	}
+ 	/*
++	 * During mutual authentication, the CHAP_C generated by the
++	 * initiator must not match the original CHAP_C generated by
++	 * the target.
++	 */
++	if (!memcmp(challenge_binhex, chap->challenge, CHAP_CHALLENGE_LENGTH)) {
++		pr_err("initiator CHAP_C matches target CHAP_C, failing"
++		       " login attempt\n");
++		goto out;
++	}
++	/*
+ 	 * Generate CHAP_N and CHAP_R for mutual authentication.
+ 	 */
+ 	tfm = crypto_alloc_hash("md5", 0, CRYPTO_ALG_ASYNC);
+diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
+index 789aa9eb0a1e..a51dd4efc23b 100644
+--- a/drivers/target/target_core_transport.c
++++ b/drivers/target/target_core_transport.c
+@@ -2407,6 +2407,10 @@ static void target_release_cmd_kref(struct kref *kref)
+  */
+ int target_put_sess_cmd(struct se_session *se_sess, struct se_cmd *se_cmd)
+ {
++	if (!se_sess) {
++		se_cmd->se_tfo->release_cmd(se_cmd);
++		return 1;
++	}
+ 	return kref_put_spinlock_irqsave(&se_cmd->cmd_kref, target_release_cmd_kref,
+ 			&se_sess->sess_cmd_lock);
+ }
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 904efb6035b0..6bbd203f1861 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -122,13 +122,23 @@ static void acm_release_minor(struct acm *acm)
+ static int acm_ctrl_msg(struct acm *acm, int request, int value,
+ 							void *buf, int len)
+ {
+-	int retval = usb_control_msg(acm->dev, usb_sndctrlpipe(acm->dev, 0),
++	int retval;
++
++	retval = usb_autopm_get_interface(acm->control);
++	if (retval)
++		return retval;
++
++	retval = usb_control_msg(acm->dev, usb_sndctrlpipe(acm->dev, 0),
+ 		request, USB_RT_ACM, value,
+ 		acm->control->altsetting[0].desc.bInterfaceNumber,
+ 		buf, len, 5000);
++
+ 	dev_dbg(&acm->control->dev,
+ 			"%s - rq 0x%02x, val %#x, len %#x, result %d\n",
+ 			__func__, request, value, len, retval);
++
++	usb_autopm_put_interface(acm->control);
++
+ 	return retval < 0 ? retval : 0;
+ }
+ 
+@@ -496,6 +506,7 @@ static int acm_port_activate(struct tty_port *port, struct tty_struct *tty)
+ {
+ 	struct acm *acm = container_of(port, struct acm, port);
+ 	int retval = -ENODEV;
++	int i;
+ 
+ 	dev_dbg(&acm->control->dev, "%s\n", __func__);
+ 
+@@ -515,21 +526,17 @@ static int acm_port_activate(struct tty_port *port, struct tty_struct *tty)
+ 	acm->control->needs_remote_wakeup = 1;
+ 
+ 	acm->ctrlurb->dev = acm->dev;
+-	if (usb_submit_urb(acm->ctrlurb, GFP_KERNEL)) {
++	retval = usb_submit_urb(acm->ctrlurb, GFP_KERNEL);
++	if (retval) {
+ 		dev_err(&acm->control->dev,
+ 			"%s - usb_submit_urb(ctrl irq) failed\n", __func__);
+-		usb_autopm_put_interface(acm->control);
+ 		goto error_submit_urb;
+ 	}
+ 
+ 	acm->ctrlout = ACM_CTRL_DTR | ACM_CTRL_RTS;
+-	if (acm_set_control(acm, acm->ctrlout) < 0 &&
+-	    (acm->ctrl_caps & USB_CDC_CAP_LINE)) {
+-		usb_autopm_put_interface(acm->control);
++	retval = acm_set_control(acm, acm->ctrlout);
++	if (retval < 0 && (acm->ctrl_caps & USB_CDC_CAP_LINE))
+ 		goto error_set_control;
+-	}
+-
+-	usb_autopm_put_interface(acm->control);
+ 
+ 	/*
+ 	 * Unthrottle device in case the TTY was closed while throttled.
+@@ -539,23 +546,30 @@ static int acm_port_activate(struct tty_port *port, struct tty_struct *tty)
+ 	acm->throttle_req = 0;
+ 	spin_unlock_irq(&acm->read_lock);
+ 
+-	if (acm_submit_read_urbs(acm, GFP_KERNEL))
++	retval = acm_submit_read_urbs(acm, GFP_KERNEL);
++	if (retval)
+ 		goto error_submit_read_urbs;
+ 
++	usb_autopm_put_interface(acm->control);
++
+ 	mutex_unlock(&acm->mutex);
+ 
+ 	return 0;
+ 
+ error_submit_read_urbs:
++	for (i = 0; i < acm->rx_buflimit; i++)
++		usb_kill_urb(acm->read_urbs[i]);
+ 	acm->ctrlout = 0;
+ 	acm_set_control(acm, acm->ctrlout);
+ error_set_control:
+ 	usb_kill_urb(acm->ctrlurb);
+ error_submit_urb:
++	usb_autopm_put_interface(acm->control);
+ error_get_interface:
+ disconnected:
+ 	mutex_unlock(&acm->mutex);
+-	return retval;
++
++	return usb_translate_errors(retval);
+ }
+ 
+ static void acm_port_destruct(struct tty_port *port)
+@@ -573,21 +587,35 @@ static void acm_port_destruct(struct tty_port *port)
+ static void acm_port_shutdown(struct tty_port *port)
+ {
+ 	struct acm *acm = container_of(port, struct acm, port);
++	struct urb *urb;
++	struct acm_wb *wb;
+ 	int i;
++	int pm_err;
+ 
+ 	dev_dbg(&acm->control->dev, "%s\n", __func__);
+ 
+ 	mutex_lock(&acm->mutex);
+ 	if (!acm->disconnected) {
+-		usb_autopm_get_interface(acm->control);
++		pm_err = usb_autopm_get_interface(acm->control);
+ 		acm_set_control(acm, acm->ctrlout = 0);
++
++		for (;;) {
++			urb = usb_get_from_anchor(&acm->delayed);
++			if (!urb)
++				break;
++			wb = urb->context;
++			wb->use = 0;
++			usb_autopm_put_interface_async(acm->control);
++		}
++
+ 		usb_kill_urb(acm->ctrlurb);
+ 		for (i = 0; i < ACM_NW; i++)
+ 			usb_kill_urb(acm->wb[i].urb);
+ 		for (i = 0; i < acm->rx_buflimit; i++)
+ 			usb_kill_urb(acm->read_urbs[i]);
+ 		acm->control->needs_remote_wakeup = 0;
+-		usb_autopm_put_interface(acm->control);
++		if (!pm_err)
++			usb_autopm_put_interface(acm->control);
+ 	}
+ 	mutex_unlock(&acm->mutex);
+ }
+@@ -646,14 +674,17 @@ static int acm_tty_write(struct tty_struct *tty,
+ 	memcpy(wb->buf, buf, count);
+ 	wb->len = count;
+ 
+-	usb_autopm_get_interface_async(acm->control);
++	stat = usb_autopm_get_interface_async(acm->control);
++	if (stat) {
++		wb->use = 0;
++		spin_unlock_irqrestore(&acm->write_lock, flags);
++		return stat;
++	}
++
+ 	if (acm->susp_count) {
+-		if (!acm->delayed_wb)
+-			acm->delayed_wb = wb;
+-		else
+-			usb_autopm_put_interface_async(acm->control);
++		usb_anchor_urb(wb->urb, &acm->delayed);
+ 		spin_unlock_irqrestore(&acm->write_lock, flags);
+-		return count;	/* A white lie */
++		return count;
+ 	}
+ 	usb_mark_last_busy(acm->dev);
+ 
+@@ -1269,6 +1300,7 @@ made_compressed_probe:
+ 		acm->bInterval = epread->bInterval;
+ 	tty_port_init(&acm->port);
+ 	acm->port.ops = &acm_port_ops;
++	init_usb_anchor(&acm->delayed);
+ 
+ 	buf = usb_alloc_coherent(usb_dev, ctrlsize, GFP_KERNEL, &acm->ctrl_dma);
+ 	if (!buf) {
+@@ -1514,18 +1546,15 @@ static int acm_suspend(struct usb_interface *intf, pm_message_t message)
+ 	struct acm *acm = usb_get_intfdata(intf);
+ 	int cnt;
+ 
++	spin_lock_irq(&acm->read_lock);
++	spin_lock(&acm->write_lock);
+ 	if (PMSG_IS_AUTO(message)) {
+-		int b;
+-
+-		spin_lock_irq(&acm->write_lock);
+-		b = acm->transmitting;
+-		spin_unlock_irq(&acm->write_lock);
+-		if (b)
++		if (acm->transmitting) {
++			spin_unlock(&acm->write_lock);
++			spin_unlock_irq(&acm->read_lock);
+ 			return -EBUSY;
++		}
+ 	}
+-
+-	spin_lock_irq(&acm->read_lock);
+-	spin_lock(&acm->write_lock);
+ 	cnt = acm->susp_count++;
+ 	spin_unlock(&acm->write_lock);
+ 	spin_unlock_irq(&acm->read_lock);
+@@ -1533,8 +1562,7 @@ static int acm_suspend(struct usb_interface *intf, pm_message_t message)
+ 	if (cnt)
+ 		return 0;
+ 
+-	if (test_bit(ASYNCB_INITIALIZED, &acm->port.flags))
+-		stop_data_traffic(acm);
++	stop_data_traffic(acm);
+ 
+ 	return 0;
+ }
+@@ -1542,29 +1570,24 @@ static int acm_suspend(struct usb_interface *intf, pm_message_t message)
+ static int acm_resume(struct usb_interface *intf)
+ {
+ 	struct acm *acm = usb_get_intfdata(intf);
+-	struct acm_wb *wb;
++	struct urb *urb;
+ 	int rv = 0;
+-	int cnt;
+ 
+ 	spin_lock_irq(&acm->read_lock);
+-	acm->susp_count -= 1;
+-	cnt = acm->susp_count;
+-	spin_unlock_irq(&acm->read_lock);
++	spin_lock(&acm->write_lock);
+ 
+-	if (cnt)
+-		return 0;
++	if (--acm->susp_count)
++		goto out;
+ 
+ 	if (test_bit(ASYNCB_INITIALIZED, &acm->port.flags)) {
+-		rv = usb_submit_urb(acm->ctrlurb, GFP_NOIO);
+-
+-		spin_lock_irq(&acm->write_lock);
+-		if (acm->delayed_wb) {
+-			wb = acm->delayed_wb;
+-			acm->delayed_wb = NULL;
+-			spin_unlock_irq(&acm->write_lock);
+-			acm_start_wb(acm, wb);
+-		} else {
+-			spin_unlock_irq(&acm->write_lock);
++		rv = usb_submit_urb(acm->ctrlurb, GFP_ATOMIC);
++
++		for (;;) {
++			urb = usb_get_from_anchor(&acm->delayed);
++			if (!urb)
++				break;
++
++			acm_start_wb(acm, urb->context);
+ 		}
+ 
+ 		/*
+@@ -1572,12 +1595,14 @@ static int acm_resume(struct usb_interface *intf)
+ 		 * do the write path at all cost
+ 		 */
+ 		if (rv < 0)
+-			goto err_out;
++			goto out;
+ 
+-		rv = acm_submit_read_urbs(acm, GFP_NOIO);
++		rv = acm_submit_read_urbs(acm, GFP_ATOMIC);
+ 	}
++out:
++	spin_unlock(&acm->write_lock);
++	spin_unlock_irq(&acm->read_lock);
+ 
+-err_out:
+ 	return rv;
+ }
+ 
+diff --git a/drivers/usb/class/cdc-acm.h b/drivers/usb/class/cdc-acm.h
+index e38dc785808f..80826f843e04 100644
+--- a/drivers/usb/class/cdc-acm.h
++++ b/drivers/usb/class/cdc-acm.h
+@@ -120,7 +120,7 @@ struct acm {
+ 	unsigned int throttled:1;			/* actually throttled */
+ 	unsigned int throttle_req:1;			/* throttle requested */
+ 	u8 bInterval;
+-	struct acm_wb *delayed_wb;			/* write queued for a device about to be woken */
++	struct usb_anchor delayed;			/* writes queued for a device about to be woken */
+ };
+ 
+ #define CDC_DATA_INTERFACE_TYPE	0x0a
+diff --git a/include/sound/core.h b/include/sound/core.h
+index d3f5f818e0b9..88c9fbb7ed90 100644
+--- a/include/sound/core.h
++++ b/include/sound/core.h
+@@ -116,6 +116,8 @@ struct snd_card {
+ 	int user_ctl_count;		/* count of all user controls */
+ 	struct list_head controls;	/* all controls for this card */
+ 	struct list_head ctl_files;	/* active control files */
++	struct mutex user_ctl_lock;	/* protects user controls against
++					   concurrent access */
+ 
+ 	struct snd_info_entry *proc_root;	/* root for soundcard specific files */
+ 	struct snd_info_entry *proc_id;	/* the card id */
+diff --git a/include/uapi/sound/compress_offload.h b/include/uapi/sound/compress_offload.h
+index 5759810e1c1b..21eed488783f 100644
+--- a/include/uapi/sound/compress_offload.h
++++ b/include/uapi/sound/compress_offload.h
+@@ -80,7 +80,7 @@ struct snd_compr_tstamp {
+ struct snd_compr_avail {
+ 	__u64 avail;
+ 	struct snd_compr_tstamp tstamp;
+-};
++} __attribute__((packed));
+ 
+ enum snd_compr_direction {
+ 	SND_COMPRESS_PLAYBACK = 0,
+diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c
+index df6839e3ce08..99a03acb7d47 100644
+--- a/lib/lz4/lz4_decompress.c
++++ b/lib/lz4/lz4_decompress.c
+@@ -72,6 +72,8 @@ static int lz4_uncompress(const char *source, char *dest, int osize)
+ 			len = *ip++;
+ 			for (; len == 255; length += 255)
+ 				len = *ip++;
++			if (unlikely(length > (size_t)(length + len)))
++				goto _output_error;
+ 			length += len;
+ 		}
+ 
+diff --git a/lib/lzo/lzo1x_decompress_safe.c b/lib/lzo/lzo1x_decompress_safe.c
+index 569985d522d5..8563081e8da3 100644
+--- a/lib/lzo/lzo1x_decompress_safe.c
++++ b/lib/lzo/lzo1x_decompress_safe.c
+@@ -19,11 +19,31 @@
+ #include <linux/lzo.h>
+ #include "lzodefs.h"
+ 
+-#define HAVE_IP(x)      ((size_t)(ip_end - ip) >= (size_t)(x))
+-#define HAVE_OP(x)      ((size_t)(op_end - op) >= (size_t)(x))
+-#define NEED_IP(x)      if (!HAVE_IP(x)) goto input_overrun
+-#define NEED_OP(x)      if (!HAVE_OP(x)) goto output_overrun
+-#define TEST_LB(m_pos)  if ((m_pos) < out) goto lookbehind_overrun
++#define HAVE_IP(t, x)					\
++	(((size_t)(ip_end - ip) >= (size_t)(t + x)) &&	\
++	 (((t + x) >= t) && ((t + x) >= x)))
++
++#define HAVE_OP(t, x)					\
++	(((size_t)(op_end - op) >= (size_t)(t + x)) &&	\
++	 (((t + x) >= t) && ((t + x) >= x)))
++
++#define NEED_IP(t, x)					\
++	do {						\
++		if (!HAVE_IP(t, x))			\
++			goto input_overrun;		\
++	} while (0)
++
++#define NEED_OP(t, x)					\
++	do {						\
++		if (!HAVE_OP(t, x))			\
++			goto output_overrun;		\
++	} while (0)
++
++#define TEST_LB(m_pos)					\
++	do {						\
++		if ((m_pos) < out)			\
++			goto lookbehind_overrun;	\
++	} while (0)
+ 
+ int lzo1x_decompress_safe(const unsigned char *in, size_t in_len,
+ 			  unsigned char *out, size_t *out_len)
+@@ -58,14 +78,14 @@ int lzo1x_decompress_safe(const unsigned char *in, size_t in_len,
+ 					while (unlikely(*ip == 0)) {
+ 						t += 255;
+ 						ip++;
+-						NEED_IP(1);
++						NEED_IP(1, 0);
+ 					}
+ 					t += 15 + *ip++;
+ 				}
+ 				t += 3;
+ copy_literal_run:
+ #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
+-				if (likely(HAVE_IP(t + 15) && HAVE_OP(t + 15))) {
++				if (likely(HAVE_IP(t, 15) && HAVE_OP(t, 15))) {
+ 					const unsigned char *ie = ip + t;
+ 					unsigned char *oe = op + t;
+ 					do {
+@@ -81,8 +101,8 @@ copy_literal_run:
+ 				} else
+ #endif
+ 				{
+-					NEED_OP(t);
+-					NEED_IP(t + 3);
++					NEED_OP(t, 0);
++					NEED_IP(t, 3);
+ 					do {
+ 						*op++ = *ip++;
+ 					} while (--t > 0);
+@@ -95,7 +115,7 @@ copy_literal_run:
+ 				m_pos -= t >> 2;
+ 				m_pos -= *ip++ << 2;
+ 				TEST_LB(m_pos);
+-				NEED_OP(2);
++				NEED_OP(2, 0);
+ 				op[0] = m_pos[0];
+ 				op[1] = m_pos[1];
+ 				op += 2;
+@@ -119,10 +139,10 @@ copy_literal_run:
+ 				while (unlikely(*ip == 0)) {
+ 					t += 255;
+ 					ip++;
+-					NEED_IP(1);
++					NEED_IP(1, 0);
+ 				}
+ 				t += 31 + *ip++;
+-				NEED_IP(2);
++				NEED_IP(2, 0);
+ 			}
+ 			m_pos = op - 1;
+ 			next = get_unaligned_le16(ip);
+@@ -137,10 +157,10 @@ copy_literal_run:
+ 				while (unlikely(*ip == 0)) {
+ 					t += 255;
+ 					ip++;
+-					NEED_IP(1);
++					NEED_IP(1, 0);
+ 				}
+ 				t += 7 + *ip++;
+-				NEED_IP(2);
++				NEED_IP(2, 0);
+ 			}
+ 			next = get_unaligned_le16(ip);
+ 			ip += 2;
+@@ -154,7 +174,7 @@ copy_literal_run:
+ #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
+ 		if (op - m_pos >= 8) {
+ 			unsigned char *oe = op + t;
+-			if (likely(HAVE_OP(t + 15))) {
++			if (likely(HAVE_OP(t, 15))) {
+ 				do {
+ 					COPY8(op, m_pos);
+ 					op += 8;
+@@ -164,7 +184,7 @@ copy_literal_run:
+ 					m_pos += 8;
+ 				} while (op < oe);
+ 				op = oe;
+-				if (HAVE_IP(6)) {
++				if (HAVE_IP(6, 0)) {
+ 					state = next;
+ 					COPY4(op, ip);
+ 					op += next;
+@@ -172,7 +192,7 @@ copy_literal_run:
+ 					continue;
+ 				}
+ 			} else {
+-				NEED_OP(t);
++				NEED_OP(t, 0);
+ 				do {
+ 					*op++ = *m_pos++;
+ 				} while (op < oe);
+@@ -181,7 +201,7 @@ copy_literal_run:
+ #endif
+ 		{
+ 			unsigned char *oe = op + t;
+-			NEED_OP(t);
++			NEED_OP(t, 0);
+ 			op[0] = m_pos[0];
+ 			op[1] = m_pos[1];
+ 			op += 2;
+@@ -194,15 +214,15 @@ match_next:
+ 		state = next;
+ 		t = next;
+ #if defined(CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS)
+-		if (likely(HAVE_IP(6) && HAVE_OP(4))) {
++		if (likely(HAVE_IP(6, 0) && HAVE_OP(4, 0))) {
+ 			COPY4(op, ip);
+ 			op += t;
+ 			ip += t;
+ 		} else
+ #endif
+ 		{
+-			NEED_IP(t + 3);
+-			NEED_OP(t);
++			NEED_IP(t, 3);
++			NEED_OP(t, 0);
+ 			while (t > 0) {
+ 				*op++ = *ip++;
+ 				t--;
+diff --git a/mm/shmem.c b/mm/shmem.c
+index 9f70e02111c6..a2801ba8ae2d 100644
+--- a/mm/shmem.c
++++ b/mm/shmem.c
+@@ -1728,6 +1728,9 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset,
+ 	pgoff_t start, index, end;
+ 	int error;
+ 
++	if (mode & ~(FALLOC_FL_KEEP_SIZE | FALLOC_FL_PUNCH_HOLE))
++		return -EOPNOTSUPP;
++
+ 	mutex_lock(&inode->i_mutex);
+ 
+ 	if (mode & FALLOC_FL_PUNCH_HOLE) {
+diff --git a/mm/slab.c b/mm/slab.c
+index 19d92181ce24..9432556ab912 100644
+--- a/mm/slab.c
++++ b/mm/slab.c
+@@ -386,6 +386,39 @@ static void **dbg_userword(struct kmem_cache *cachep, void *objp)
+ 
+ #endif
+ 
++#define OBJECT_FREE (0)
++#define OBJECT_ACTIVE (1)
++
++#ifdef CONFIG_DEBUG_SLAB_LEAK
++
++static void set_obj_status(struct page *page, int idx, int val)
++{
++	int freelist_size;
++	char *status;
++	struct kmem_cache *cachep = page->slab_cache;
++
++	freelist_size = cachep->num * sizeof(freelist_idx_t);
++	status = (char *)page->freelist + freelist_size;
++	status[idx] = val;
++}
++
++static inline unsigned int get_obj_status(struct page *page, int idx)
++{
++	int freelist_size;
++	char *status;
++	struct kmem_cache *cachep = page->slab_cache;
++
++	freelist_size = cachep->num * sizeof(freelist_idx_t);
++	status = (char *)page->freelist + freelist_size;
++
++	return status[idx];
++}
++
++#else
++static inline void set_obj_status(struct page *page, int idx, int val) {}
++
++#endif
++
+ /*
+  * Do not go above this order unless 0 objects fit into the slab or
+  * overridden on the command line.
+@@ -576,12 +609,30 @@ static inline struct array_cache *cpu_cache_get(struct kmem_cache *cachep)
+ 	return cachep->array[smp_processor_id()];
+ }
+ 
++static size_t calculate_freelist_size(int nr_objs, size_t align)
++{
++	size_t freelist_size;
++
++	freelist_size = nr_objs * sizeof(freelist_idx_t);
++	if (IS_ENABLED(CONFIG_DEBUG_SLAB_LEAK))
++		freelist_size += nr_objs * sizeof(char);
++
++	if (align)
++		freelist_size = ALIGN(freelist_size, align);
++
++	return freelist_size;
++}
++
+ static int calculate_nr_objs(size_t slab_size, size_t buffer_size,
+ 				size_t idx_size, size_t align)
+ {
+ 	int nr_objs;
++	size_t remained_size;
+ 	size_t freelist_size;
++	int extra_space = 0;
+ 
++	if (IS_ENABLED(CONFIG_DEBUG_SLAB_LEAK))
++		extra_space = sizeof(char);
+ 	/*
+ 	 * Ignore padding for the initial guess. The padding
+ 	 * is at most @align-1 bytes, and @buffer_size is at
+@@ -590,14 +641,15 @@ static int calculate_nr_objs(size_t slab_size, size_t buffer_size,
+ 	 * into the memory allocation when taking the padding
+ 	 * into account.
+ 	 */
+-	nr_objs = slab_size / (buffer_size + idx_size);
++	nr_objs = slab_size / (buffer_size + idx_size + extra_space);
+ 
+ 	/*
+ 	 * This calculated number will be either the right
+ 	 * amount, or one greater than what we want.
+ 	 */
+-	freelist_size = slab_size - nr_objs * buffer_size;
+-	if (freelist_size < ALIGN(nr_objs * idx_size, align))
++	remained_size = slab_size - nr_objs * buffer_size;
++	freelist_size = calculate_freelist_size(nr_objs, align);
++	if (remained_size < freelist_size)
+ 		nr_objs--;
+ 
+ 	return nr_objs;
+@@ -635,7 +687,7 @@ static void cache_estimate(unsigned long gfporder, size_t buffer_size,
+ 	} else {
+ 		nr_objs = calculate_nr_objs(slab_size, buffer_size,
+ 					sizeof(freelist_idx_t), align);
+-		mgmt_size = ALIGN(nr_objs * sizeof(freelist_idx_t), align);
++		mgmt_size = calculate_freelist_size(nr_objs, align);
+ 	}
+ 	*num = nr_objs;
+ 	*left_over = slab_size - nr_objs*buffer_size - mgmt_size;
+@@ -2032,13 +2084,16 @@ static size_t calculate_slab_order(struct kmem_cache *cachep,
+ 			break;
+ 
+ 		if (flags & CFLGS_OFF_SLAB) {
++			size_t freelist_size_per_obj = sizeof(freelist_idx_t);
+ 			/*
+ 			 * Max number of objs-per-slab for caches which
+ 			 * use off-slab slabs. Needed to avoid a possible
+ 			 * looping condition in cache_grow().
+ 			 */
++			if (IS_ENABLED(CONFIG_DEBUG_SLAB_LEAK))
++				freelist_size_per_obj += sizeof(char);
+ 			offslab_limit = size;
+-			offslab_limit /= sizeof(freelist_idx_t);
++			offslab_limit /= freelist_size_per_obj;
+ 
+  			if (num > offslab_limit)
+ 				break;
+@@ -2285,8 +2340,7 @@ __kmem_cache_create (struct kmem_cache *cachep, unsigned long flags)
+ 	if (!cachep->num)
+ 		return -E2BIG;
+ 
+-	freelist_size =
+-		ALIGN(cachep->num * sizeof(freelist_idx_t), cachep->align);
++	freelist_size = calculate_freelist_size(cachep->num, cachep->align);
+ 
+ 	/*
+ 	 * If the slab has been placed off-slab, and we have enough space then
+@@ -2299,7 +2353,7 @@ __kmem_cache_create (struct kmem_cache *cachep, unsigned long flags)
+ 
+ 	if (flags & CFLGS_OFF_SLAB) {
+ 		/* really off slab. No need for manual alignment */
+-		freelist_size = cachep->num * sizeof(freelist_idx_t);
++		freelist_size = calculate_freelist_size(cachep->num, 0);
+ 
+ #ifdef CONFIG_PAGE_POISONING
+ 		/* If we're going to use the generic kernel_map_pages()
+@@ -2625,6 +2679,7 @@ static void cache_init_objs(struct kmem_cache *cachep,
+ 		if (cachep->ctor)
+ 			cachep->ctor(objp);
+ #endif
++		set_obj_status(page, i, OBJECT_FREE);
+ 		set_free_obj(page, i, i);
+ 	}
+ }
+@@ -2833,6 +2888,7 @@ static void *cache_free_debugcheck(struct kmem_cache *cachep, void *objp,
+ 	BUG_ON(objnr >= cachep->num);
+ 	BUG_ON(objp != index_to_obj(cachep, page, objnr));
+ 
++	set_obj_status(page, objnr, OBJECT_FREE);
+ 	if (cachep->flags & SLAB_POISON) {
+ #ifdef CONFIG_DEBUG_PAGEALLOC
+ 		if ((cachep->size % PAGE_SIZE)==0 && OFF_SLAB(cachep)) {
+@@ -2966,6 +3022,8 @@ static inline void cache_alloc_debugcheck_before(struct kmem_cache *cachep,
+ static void *cache_alloc_debugcheck_after(struct kmem_cache *cachep,
+ 				gfp_t flags, void *objp, unsigned long caller)
+ {
++	struct page *page;
++
+ 	if (!objp)
+ 		return objp;
+ 	if (cachep->flags & SLAB_POISON) {
+@@ -2996,6 +3054,9 @@ static void *cache_alloc_debugcheck_after(struct kmem_cache *cachep,
+ 		*dbg_redzone1(cachep, objp) = RED_ACTIVE;
+ 		*dbg_redzone2(cachep, objp) = RED_ACTIVE;
+ 	}
++
++	page = virt_to_head_page(objp);
++	set_obj_status(page, obj_to_index(cachep, page, objp), OBJECT_ACTIVE);
+ 	objp += obj_offset(cachep);
+ 	if (cachep->ctor && cachep->flags & SLAB_POISON)
+ 		cachep->ctor(objp);
+@@ -4232,21 +4293,12 @@ static void handle_slab(unsigned long *n, struct kmem_cache *c,
+ 						struct page *page)
+ {
+ 	void *p;
+-	int i, j;
++	int i;
+ 
+ 	if (n[0] == n[1])
+ 		return;
+ 	for (i = 0, p = page->s_mem; i < c->num; i++, p += c->size) {
+-		bool active = true;
+-
+-		for (j = page->active; j < c->num; j++) {
+-			/* Skip freed item */
+-			if (get_free_obj(page, j) == i) {
+-				active = false;
+-				break;
+-			}
+-		}
+-		if (!active)
++		if (get_obj_status(page, i) != OBJECT_ACTIVE)
+ 			continue;
+ 
+ 		if (!add_caller(n, (unsigned long)*dbg_userword(c, p)))
+diff --git a/net/core/dev.c b/net/core/dev.c
+index fb8b0546485b..a30bef1882f5 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -6613,6 +6613,9 @@ EXPORT_SYMBOL(unregister_netdevice_queue);
+ /**
+  *	unregister_netdevice_many - unregister many devices
+  *	@head: list of devices
++ *
++ *  Note: As most callers use a stack allocated list_head,
++ *  we force a list_del() to make sure stack wont be corrupted later.
+  */
+ void unregister_netdevice_many(struct list_head *head)
+ {
+@@ -6622,6 +6625,7 @@ void unregister_netdevice_many(struct list_head *head)
+ 		rollback_registered_many(head);
+ 		list_for_each_entry(dev, head, unreg_list)
+ 			net_set_todo(dev);
++		list_del(head);
+ 	}
+ }
+ EXPORT_SYMBOL(unregister_netdevice_many);
+@@ -7077,7 +7081,6 @@ static void __net_exit default_device_exit_batch(struct list_head *net_list)
+ 		}
+ 	}
+ 	unregister_netdevice_many(&dev_kill_list);
+-	list_del(&dev_kill_list);
+ 	rtnl_unlock();
+ }
+ 
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index 2d8d8fcfa060..1999ed832267 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -1234,6 +1234,7 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
+ 	struct nlattr *tb[IFLA_MAX+1];
+ 	u32 ext_filter_mask = 0;
+ 	int err;
++	int hdrlen;
+ 
+ 	s_h = cb->args[0];
+ 	s_idx = cb->args[1];
+@@ -1241,8 +1242,17 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
+ 	rcu_read_lock();
+ 	cb->seq = net->dev_base_seq;
+ 
+-	if (nlmsg_parse(cb->nlh, sizeof(struct ifinfomsg), tb, IFLA_MAX,
+-			ifla_policy) >= 0) {
++	/* A hack to preserve kernel<->userspace interface.
++	 * The correct header is ifinfomsg. It is consistent with rtnl_getlink.
++	 * However, before Linux v3.9 the code here assumed rtgenmsg and that's
++	 * what iproute2 < v3.9.0 used.
++	 * We can detect the old iproute2. Even including the IFLA_EXT_MASK
++	 * attribute, its netlink message is shorter than struct ifinfomsg.
++	 */
++	hdrlen = nlmsg_len(cb->nlh) < sizeof(struct ifinfomsg) ?
++		 sizeof(struct rtgenmsg) : sizeof(struct ifinfomsg);
++
++	if (nlmsg_parse(cb->nlh, hdrlen, tb, IFLA_MAX, ifla_policy) >= 0) {
+ 
+ 		if (tb[IFLA_EXT_MASK])
+ 			ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
+@@ -1744,7 +1754,6 @@ static int rtnl_dellink(struct sk_buff *skb, struct nlmsghdr *nlh)
+ 
+ 	ops->dellink(dev, &list_kill);
+ 	unregister_netdevice_many(&list_kill);
+-	list_del(&list_kill);
+ 	return 0;
+ }
+ 
+@@ -2095,9 +2104,13 @@ static u16 rtnl_calcit(struct sk_buff *skb, struct nlmsghdr *nlh)
+ 	struct nlattr *tb[IFLA_MAX+1];
+ 	u32 ext_filter_mask = 0;
+ 	u16 min_ifinfo_dump_size = 0;
++	int hdrlen;
++
++	/* Same kernel<->userspace interface hack as in rtnl_dump_ifinfo. */
++	hdrlen = nlmsg_len(nlh) < sizeof(struct ifinfomsg) ?
++		 sizeof(struct rtgenmsg) : sizeof(struct ifinfomsg);
+ 
+-	if (nlmsg_parse(nlh, sizeof(struct ifinfomsg), tb, IFLA_MAX,
+-			ifla_policy) >= 0) {
++	if (nlmsg_parse(nlh, hdrlen, tb, IFLA_MAX, ifla_policy) >= 0) {
+ 		if (tb[IFLA_EXT_MASK])
+ 			ext_filter_mask = nla_get_u32(tb[IFLA_EXT_MASK]);
+ 	}
+diff --git a/net/ipv4/datagram.c b/net/ipv4/datagram.c
+index 8b5134c582f1..a3095fdefbed 100644
+--- a/net/ipv4/datagram.c
++++ b/net/ipv4/datagram.c
+@@ -86,18 +86,26 @@ out:
+ }
+ EXPORT_SYMBOL(ip4_datagram_connect);
+ 
++/* Because UDP xmit path can manipulate sk_dst_cache without holding
++ * socket lock, we need to use sk_dst_set() here,
++ * even if we own the socket lock.
++ */
+ void ip4_datagram_release_cb(struct sock *sk)
+ {
+ 	const struct inet_sock *inet = inet_sk(sk);
+ 	const struct ip_options_rcu *inet_opt;
+ 	__be32 daddr = inet->inet_daddr;
++	struct dst_entry *dst;
+ 	struct flowi4 fl4;
+ 	struct rtable *rt;
+ 
+-	if (! __sk_dst_get(sk) || __sk_dst_check(sk, 0))
+-		return;
+-
+ 	rcu_read_lock();
++
++	dst = __sk_dst_get(sk);
++	if (!dst || !dst->obsolete || dst->ops->check(dst, 0)) {
++		rcu_read_unlock();
++		return;
++	}
+ 	inet_opt = rcu_dereference(inet->inet_opt);
+ 	if (inet_opt && inet_opt->opt.srr)
+ 		daddr = inet_opt->opt.faddr;
+@@ -105,8 +113,10 @@ void ip4_datagram_release_cb(struct sock *sk)
+ 				   inet->inet_saddr, inet->inet_dport,
+ 				   inet->inet_sport, sk->sk_protocol,
+ 				   RT_CONN_FLAGS(sk), sk->sk_bound_dev_if);
+-	if (!IS_ERR(rt))
+-		__sk_dst_set(sk, &rt->dst);
++
++	dst = !IS_ERR(rt) ? &rt->dst : NULL;
++	sk_dst_set(sk, dst);
++
+ 	rcu_read_unlock();
+ }
+ EXPORT_SYMBOL_GPL(ip4_datagram_release_cb);
+diff --git a/net/ipv4/ipip.c b/net/ipv4/ipip.c
+index 812b18351462..62eaa005e146 100644
+--- a/net/ipv4/ipip.c
++++ b/net/ipv4/ipip.c
+@@ -149,13 +149,13 @@ static int ipip_err(struct sk_buff *skb, u32 info)
+ 
+ 	if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
+ 		ipv4_update_pmtu(skb, dev_net(skb->dev), info,
+-				 t->dev->ifindex, 0, IPPROTO_IPIP, 0);
++				 t->parms.link, 0, IPPROTO_IPIP, 0);
+ 		err = 0;
+ 		goto out;
+ 	}
+ 
+ 	if (type == ICMP_REDIRECT) {
+-		ipv4_redirect(skb, dev_net(skb->dev), t->dev->ifindex, 0,
++		ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0,
+ 			      IPPROTO_IPIP, 0);
+ 		err = 0;
+ 		goto out;
+@@ -486,4 +486,5 @@ static void __exit ipip_fini(void)
+ module_init(ipip_init);
+ module_exit(ipip_fini);
+ MODULE_LICENSE("GPL");
++MODULE_ALIAS_RTNL_LINK("ipip");
+ MODULE_ALIAS_NETDEV("tunl0");
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 4468e1adc094..54a5fe92de5a 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -1834,6 +1834,10 @@ static struct sock *__udp4_lib_mcast_demux_lookup(struct net *net,
+ 	unsigned int count, slot = udp_hashfn(net, hnum, udp_table.mask);
+ 	struct udp_hslot *hslot = &udp_table.hash[slot];
+ 
++	/* Do not bother scanning a too big list */
++	if (hslot->count > 10)
++		return NULL;
++
+ 	rcu_read_lock();
+ begin:
+ 	count = 0;
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index f6a66bb4114d..afa082458360 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -61,6 +61,7 @@
+ MODULE_AUTHOR("Ville Nuorvala");
+ MODULE_DESCRIPTION("IPv6 tunneling device");
+ MODULE_LICENSE("GPL");
++MODULE_ALIAS_RTNL_LINK("ip6tnl");
+ MODULE_ALIAS_NETDEV("ip6tnl0");
+ 
+ #ifdef IP6_TNL_DEBUG
+diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
+index e5a453ca302e..4f408176dc64 100644
+--- a/net/ipv6/sit.c
++++ b/net/ipv6/sit.c
+@@ -560,12 +560,12 @@ static int ipip6_err(struct sk_buff *skb, u32 info)
+ 
+ 	if (type == ICMP_DEST_UNREACH && code == ICMP_FRAG_NEEDED) {
+ 		ipv4_update_pmtu(skb, dev_net(skb->dev), info,
+-				 t->dev->ifindex, 0, IPPROTO_IPV6, 0);
++				 t->parms.link, 0, IPPROTO_IPV6, 0);
+ 		err = 0;
+ 		goto out;
+ 	}
+ 	if (type == ICMP_REDIRECT) {
+-		ipv4_redirect(skb, dev_net(skb->dev), t->dev->ifindex, 0,
++		ipv4_redirect(skb, dev_net(skb->dev), t->parms.link, 0,
+ 			      IPPROTO_IPV6, 0);
+ 		err = 0;
+ 		goto out;
+@@ -1828,4 +1828,5 @@ xfrm_tunnel_failed:
+ module_init(sit_init);
+ module_exit(sit_cleanup);
+ MODULE_LICENSE("GPL");
++MODULE_ALIAS_RTNL_LINK("sit");
+ MODULE_ALIAS_NETDEV("sit0");
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index 1e586d92260e..20b63d2ab70f 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -716,15 +716,15 @@ static struct sock *udp_v6_mcast_next(struct net *net, struct sock *sk,
+ 				if (inet->inet_dport != rmt_port)
+ 					continue;
+ 			}
+-			if (!ipv6_addr_any(&sk->sk_v6_daddr) &&
+-			    !ipv6_addr_equal(&sk->sk_v6_daddr, rmt_addr))
++			if (!ipv6_addr_any(&s->sk_v6_daddr) &&
++			    !ipv6_addr_equal(&s->sk_v6_daddr, rmt_addr))
+ 				continue;
+ 
+ 			if (s->sk_bound_dev_if && s->sk_bound_dev_if != dif)
+ 				continue;
+ 
+-			if (!ipv6_addr_any(&sk->sk_v6_rcv_saddr)) {
+-				if (!ipv6_addr_equal(&sk->sk_v6_rcv_saddr, loc_addr))
++			if (!ipv6_addr_any(&s->sk_v6_rcv_saddr)) {
++				if (!ipv6_addr_equal(&s->sk_v6_rcv_saddr, loc_addr))
+ 					continue;
+ 			}
+ 			if (!inet6_mc_check(s, loc_addr, rmt_addr))
+diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
+index b8d331e7d883..34799e06ee01 100644
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -1758,7 +1758,6 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local)
+ 	}
+ 	mutex_unlock(&local->iflist_mtx);
+ 	unregister_netdevice_many(&unreg_list);
+-	list_del(&unreg_list);
+ 
+ 	list_for_each_entry_safe(sdata, tmp, &wdev_list, list) {
+ 		list_del(&sdata->list);
+diff --git a/net/sctp/associola.c b/net/sctp/associola.c
+index 39579c3e0d14..0b999987b658 100644
+--- a/net/sctp/associola.c
++++ b/net/sctp/associola.c
+@@ -330,7 +330,7 @@ void sctp_association_free(struct sctp_association *asoc)
+ 	/* Only real associations count against the endpoint, so
+ 	 * don't bother for if this is a temporary association.
+ 	 */
+-	if (!asoc->temp) {
++	if (!list_empty(&asoc->asocs)) {
+ 		list_del(&asoc->asocs);
+ 
+ 		/* Decrement the backlog value for a TCP-style listening
+diff --git a/security/integrity/evm/evm_main.c b/security/integrity/evm/evm_main.c
+index 6e0bd933b6a9..3b312ed51618 100644
+--- a/security/integrity/evm/evm_main.c
++++ b/security/integrity/evm/evm_main.c
+@@ -287,12 +287,20 @@ out:
+  * @xattr_value: pointer to the new extended attribute value
+  * @xattr_value_len: pointer to the new extended attribute value length
+  *
+- * Updating 'security.evm' requires CAP_SYS_ADMIN privileges and that
+- * the current value is valid.
++ * Before allowing the 'security.evm' protected xattr to be updated,
++ * verify the existing value is valid.  As only the kernel should have
++ * access to the EVM encrypted key needed to calculate the HMAC, prevent
++ * userspace from writing HMAC value.  Writing 'security.evm' requires
++ * requires CAP_SYS_ADMIN privileges.
+  */
+ int evm_inode_setxattr(struct dentry *dentry, const char *xattr_name,
+ 		       const void *xattr_value, size_t xattr_value_len)
+ {
++	const struct evm_ima_xattr_data *xattr_data = xattr_value;
++
++	if ((strcmp(xattr_name, XATTR_NAME_EVM) == 0)
++	    && (xattr_data->type == EVM_XATTR_HMAC))
++		return -EPERM;
+ 	return evm_protect_xattr(dentry, xattr_name, xattr_value,
+ 				 xattr_value_len);
+ }
+diff --git a/security/integrity/ima/ima_api.c b/security/integrity/ima/ima_api.c
+index ba9e4d792dd5..d9cd5ce14d2b 100644
+--- a/security/integrity/ima/ima_api.c
++++ b/security/integrity/ima/ima_api.c
+@@ -199,6 +199,7 @@ int ima_collect_measurement(struct integrity_iint_cache *iint,
+ 			    struct evm_ima_xattr_data **xattr_value,
+ 			    int *xattr_len)
+ {
++	const char *audit_cause = "failed";
+ 	struct inode *inode = file_inode(file);
+ 	const char *filename = file->f_dentry->d_name.name;
+ 	int result = 0;
+@@ -213,6 +214,12 @@ int ima_collect_measurement(struct integrity_iint_cache *iint,
+ 	if (!(iint->flags & IMA_COLLECTED)) {
+ 		u64 i_version = file_inode(file)->i_version;
+ 
++		if (file->f_flags & O_DIRECT) {
++			audit_cause = "failed(directio)";
++			result = -EACCES;
++			goto out;
++		}
++
+ 		/* use default hash algorithm */
+ 		hash.hdr.algo = ima_hash_algo;
+ 
+@@ -233,9 +240,10 @@ int ima_collect_measurement(struct integrity_iint_cache *iint,
+ 				result = -ENOMEM;
+ 		}
+ 	}
++out:
+ 	if (result)
+ 		integrity_audit_msg(AUDIT_INTEGRITY_DATA, inode,
+-				    filename, "collect_data", "failed",
++				    filename, "collect_data", audit_cause,
+ 				    result, 0);
+ 	return result;
+ }
+diff --git a/security/integrity/ima/ima_crypto.c b/security/integrity/ima/ima_crypto.c
+index 1bde8e627766..ccd0ac8fa9a0 100644
+--- a/security/integrity/ima/ima_crypto.c
++++ b/security/integrity/ima/ima_crypto.c
+@@ -27,6 +27,36 @@
+ 
+ static struct crypto_shash *ima_shash_tfm;
+ 
++/**
++ * ima_kernel_read - read file content
++ *
++ * This is a function for reading file content instead of kernel_read().
++ * It does not perform locking checks to ensure it cannot be blocked.
++ * It does not perform security checks because it is irrelevant for IMA.
++ *
++ */
++static int ima_kernel_read(struct file *file, loff_t offset,
++			   char *addr, unsigned long count)
++{
++	mm_segment_t old_fs;
++	char __user *buf = addr;
++	ssize_t ret;
++
++	if (!(file->f_mode & FMODE_READ))
++		return -EBADF;
++	if (!file->f_op->read && !file->f_op->aio_read)
++		return -EINVAL;
++
++	old_fs = get_fs();
++	set_fs(get_ds());
++	if (file->f_op->read)
++		ret = file->f_op->read(file, buf, count, &offset);
++	else
++		ret = do_sync_read(file, buf, count, &offset);
++	set_fs(old_fs);
++	return ret;
++}
++
+ int ima_init_crypto(void)
+ {
+ 	long rc;
+@@ -104,7 +134,7 @@ static int ima_calc_file_hash_tfm(struct file *file,
+ 	while (offset < i_size) {
+ 		int rbuf_len;
+ 
+-		rbuf_len = kernel_read(file, offset, rbuf, PAGE_SIZE);
++		rbuf_len = ima_kernel_read(file, offset, rbuf, PAGE_SIZE);
+ 		if (rbuf_len < 0) {
+ 			rc = rbuf_len;
+ 			break;
+diff --git a/security/integrity/ima/ima_main.c b/security/integrity/ima/ima_main.c
+index 52ac6cf41f88..dcc98cf542d8 100644
+--- a/security/integrity/ima/ima_main.c
++++ b/security/integrity/ima/ima_main.c
+@@ -214,8 +214,11 @@ static int process_measurement(struct file *file, const char *filename,
+ 		xattr_ptr = &xattr_value;
+ 
+ 	rc = ima_collect_measurement(iint, file, xattr_ptr, &xattr_len);
+-	if (rc != 0)
++	if (rc != 0) {
++		if (file->f_flags & O_DIRECT)
++			rc = (iint->flags & IMA_PERMIT_DIRECTIO) ? 0 : -EACCES;
+ 		goto out_digsig;
++	}
+ 
+ 	pathname = filename ?: ima_d_path(&file->f_path, &pathbuf);
+ 
+diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
+index 93873a450ff7..40a7488f6721 100644
+--- a/security/integrity/ima/ima_policy.c
++++ b/security/integrity/ima/ima_policy.c
+@@ -353,7 +353,7 @@ enum {
+ 	Opt_obj_user, Opt_obj_role, Opt_obj_type,
+ 	Opt_subj_user, Opt_subj_role, Opt_subj_type,
+ 	Opt_func, Opt_mask, Opt_fsmagic, Opt_uid, Opt_fowner,
+-	Opt_appraise_type, Opt_fsuuid
++	Opt_appraise_type, Opt_fsuuid, Opt_permit_directio
+ };
+ 
+ static match_table_t policy_tokens = {
+@@ -375,6 +375,7 @@ static match_table_t policy_tokens = {
+ 	{Opt_uid, "uid=%s"},
+ 	{Opt_fowner, "fowner=%s"},
+ 	{Opt_appraise_type, "appraise_type=%s"},
++	{Opt_permit_directio, "permit_directio"},
+ 	{Opt_err, NULL}
+ };
+ 
+@@ -622,6 +623,9 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry)
+ 			else
+ 				result = -EINVAL;
+ 			break;
++		case Opt_permit_directio:
++			entry->flags |= IMA_PERMIT_DIRECTIO;
++			break;
+ 		case Opt_err:
+ 			ima_log_string(ab, "UNKNOWN", p);
+ 			result = -EINVAL;
+diff --git a/security/integrity/integrity.h b/security/integrity/integrity.h
+index 2fb5e53e927f..33c0a70f6b15 100644
+--- a/security/integrity/integrity.h
++++ b/security/integrity/integrity.h
+@@ -30,6 +30,7 @@
+ #define IMA_ACTION_FLAGS	0xff000000
+ #define IMA_DIGSIG		0x01000000
+ #define IMA_DIGSIG_REQUIRED	0x02000000
++#define IMA_PERMIT_DIRECTIO	0x04000000
+ 
+ #define IMA_DO_MASK		(IMA_MEASURE | IMA_APPRAISE | IMA_AUDIT | \
+ 				 IMA_APPRAISE_SUBMASK)
+diff --git a/sound/core/control.c b/sound/core/control.c
+index f038f5afafe2..f0b0e14497a5 100644
+--- a/sound/core/control.c
++++ b/sound/core/control.c
+@@ -288,6 +288,10 @@ static bool snd_ctl_remove_numid_conflict(struct snd_card *card,
+ {
+ 	struct snd_kcontrol *kctl;
+ 
++	/* Make sure that the ids assigned to the control do not wrap around */
++	if (card->last_numid >= UINT_MAX - count)
++		card->last_numid = 0;
++
+ 	list_for_each_entry(kctl, &card->controls, list) {
+ 		if (kctl->id.numid < card->last_numid + 1 + count &&
+ 		    kctl->id.numid + kctl->count > card->last_numid + 1) {
+@@ -330,6 +334,7 @@ int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol)
+ {
+ 	struct snd_ctl_elem_id id;
+ 	unsigned int idx;
++	unsigned int count;
+ 	int err = -EINVAL;
+ 
+ 	if (! kcontrol)
+@@ -337,6 +342,9 @@ int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol)
+ 	if (snd_BUG_ON(!card || !kcontrol->info))
+ 		goto error;
+ 	id = kcontrol->id;
++	if (id.index > UINT_MAX - kcontrol->count)
++		goto error;
++
+ 	down_write(&card->controls_rwsem);
+ 	if (snd_ctl_find_id(card, &id)) {
+ 		up_write(&card->controls_rwsem);
+@@ -358,8 +366,9 @@ int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol)
+ 	card->controls_count += kcontrol->count;
+ 	kcontrol->id.numid = card->last_numid + 1;
+ 	card->last_numid += kcontrol->count;
++	count = kcontrol->count;
+ 	up_write(&card->controls_rwsem);
+-	for (idx = 0; idx < kcontrol->count; idx++, id.index++, id.numid++)
++	for (idx = 0; idx < count; idx++, id.index++, id.numid++)
+ 		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id);
+ 	return 0;
+ 
+@@ -388,6 +397,7 @@ int snd_ctl_replace(struct snd_card *card, struct snd_kcontrol *kcontrol,
+ 		    bool add_on_replace)
+ {
+ 	struct snd_ctl_elem_id id;
++	unsigned int count;
+ 	unsigned int idx;
+ 	struct snd_kcontrol *old;
+ 	int ret;
+@@ -423,8 +433,9 @@ add:
+ 	card->controls_count += kcontrol->count;
+ 	kcontrol->id.numid = card->last_numid + 1;
+ 	card->last_numid += kcontrol->count;
++	count = kcontrol->count;
+ 	up_write(&card->controls_rwsem);
+-	for (idx = 0; idx < kcontrol->count; idx++, id.index++, id.numid++)
++	for (idx = 0; idx < count; idx++, id.index++, id.numid++)
+ 		snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id);
+ 	return 0;
+ 
+@@ -897,9 +908,9 @@ static int snd_ctl_elem_write(struct snd_card *card, struct snd_ctl_file *file,
+ 			result = kctl->put(kctl, control);
+ 		}
+ 		if (result > 0) {
++			struct snd_ctl_elem_id id = control->id;
+ 			up_read(&card->controls_rwsem);
+-			snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE,
+-				       &control->id);
++			snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_VALUE, &id);
+ 			return 0;
+ 		}
+ 	}
+@@ -991,6 +1002,7 @@ static int snd_ctl_elem_unlock(struct snd_ctl_file *file,
+ 
+ struct user_element {
+ 	struct snd_ctl_elem_info info;
++	struct snd_card *card;
+ 	void *elem_data;		/* element data */
+ 	unsigned long elem_data_size;	/* size of element data in bytes */
+ 	void *tlv_data;			/* TLV data */
+@@ -1034,7 +1046,9 @@ static int snd_ctl_elem_user_get(struct snd_kcontrol *kcontrol,
+ {
+ 	struct user_element *ue = kcontrol->private_data;
+ 
++	mutex_lock(&ue->card->user_ctl_lock);
+ 	memcpy(&ucontrol->value, ue->elem_data, ue->elem_data_size);
++	mutex_unlock(&ue->card->user_ctl_lock);
+ 	return 0;
+ }
+ 
+@@ -1043,10 +1057,12 @@ static int snd_ctl_elem_user_put(struct snd_kcontrol *kcontrol,
+ {
+ 	int change;
+ 	struct user_element *ue = kcontrol->private_data;
+-	
++
++	mutex_lock(&ue->card->user_ctl_lock);
+ 	change = memcmp(&ucontrol->value, ue->elem_data, ue->elem_data_size) != 0;
+ 	if (change)
+ 		memcpy(ue->elem_data, &ucontrol->value, ue->elem_data_size);
++	mutex_unlock(&ue->card->user_ctl_lock);
+ 	return change;
+ }
+ 
+@@ -1066,19 +1082,32 @@ static int snd_ctl_elem_user_tlv(struct snd_kcontrol *kcontrol,
+ 		new_data = memdup_user(tlv, size);
+ 		if (IS_ERR(new_data))
+ 			return PTR_ERR(new_data);
++		mutex_lock(&ue->card->user_ctl_lock);
+ 		change = ue->tlv_data_size != size;
+ 		if (!change)
+ 			change = memcmp(ue->tlv_data, new_data, size);
+ 		kfree(ue->tlv_data);
+ 		ue->tlv_data = new_data;
+ 		ue->tlv_data_size = size;
++		mutex_unlock(&ue->card->user_ctl_lock);
+ 	} else {
+-		if (! ue->tlv_data_size || ! ue->tlv_data)
+-			return -ENXIO;
+-		if (size < ue->tlv_data_size)
+-			return -ENOSPC;
++		int ret = 0;
++
++		mutex_lock(&ue->card->user_ctl_lock);
++		if (!ue->tlv_data_size || !ue->tlv_data) {
++			ret = -ENXIO;
++			goto err_unlock;
++		}
++		if (size < ue->tlv_data_size) {
++			ret = -ENOSPC;
++			goto err_unlock;
++		}
+ 		if (copy_to_user(tlv, ue->tlv_data, ue->tlv_data_size))
+-			return -EFAULT;
++			ret = -EFAULT;
++err_unlock:
++		mutex_unlock(&ue->card->user_ctl_lock);
++		if (ret)
++			return ret;
+ 	}
+ 	return change;
+ }
+@@ -1136,8 +1165,6 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file,
+ 	struct user_element *ue;
+ 	int idx, err;
+ 
+-	if (!replace && card->user_ctl_count >= MAX_USER_CONTROLS)
+-		return -ENOMEM;
+ 	if (info->count < 1)
+ 		return -EINVAL;
+ 	access = info->access == 0 ? SNDRV_CTL_ELEM_ACCESS_READWRITE :
+@@ -1146,21 +1173,16 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file,
+ 				 SNDRV_CTL_ELEM_ACCESS_TLV_READWRITE));
+ 	info->id.numid = 0;
+ 	memset(&kctl, 0, sizeof(kctl));
+-	down_write(&card->controls_rwsem);
+-	_kctl = snd_ctl_find_id(card, &info->id);
+-	err = 0;
+-	if (_kctl) {
+-		if (replace)
+-			err = snd_ctl_remove(card, _kctl);
+-		else
+-			err = -EBUSY;
+-	} else {
+-		if (replace)
+-			err = -ENOENT;
++
++	if (replace) {
++		err = snd_ctl_remove_user_ctl(file, &info->id);
++		if (err)
++			return err;
+ 	}
+-	up_write(&card->controls_rwsem);
+-	if (err < 0)
+-		return err;
++
++	if (card->user_ctl_count >= MAX_USER_CONTROLS)
++		return -ENOMEM;
++
+ 	memcpy(&kctl.id, &info->id, sizeof(info->id));
+ 	kctl.count = info->owner ? info->owner : 1;
+ 	access |= SNDRV_CTL_ELEM_ACCESS_USER;
+@@ -1210,6 +1232,7 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file,
+ 	ue = kzalloc(sizeof(struct user_element) + private_size, GFP_KERNEL);
+ 	if (ue == NULL)
+ 		return -ENOMEM;
++	ue->card = card;
+ 	ue->info = *info;
+ 	ue->info.access = 0;
+ 	ue->elem_data = (char *)ue + sizeof(*ue);
+@@ -1321,8 +1344,9 @@ static int snd_ctl_tlv_ioctl(struct snd_ctl_file *file,
+ 		}
+ 		err = kctl->tlv.c(kctl, op_flag, tlv.length, _tlv->tlv);
+ 		if (err > 0) {
++			struct snd_ctl_elem_id id = kctl->id;
+ 			up_read(&card->controls_rwsem);
+-			snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_TLV, &kctl->id);
++			snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_TLV, &id);
+ 			return 0;
+ 		}
+ 	} else {
+diff --git a/sound/core/init.c b/sound/core/init.c
+index 5ee83845c5de..7bdfd19e24a8 100644
+--- a/sound/core/init.c
++++ b/sound/core/init.c
+@@ -232,6 +232,7 @@ int snd_card_new(struct device *parent, int idx, const char *xid,
+ 	INIT_LIST_HEAD(&card->devices);
+ 	init_rwsem(&card->controls_rwsem);
+ 	rwlock_init(&card->ctl_files_rwlock);
++	mutex_init(&card->user_ctl_lock);
+ 	INIT_LIST_HEAD(&card->controls);
+ 	INIT_LIST_HEAD(&card->ctl_files);
+ 	spin_lock_init(&card->files_lock);
+diff --git a/sound/pci/hda/patch_hdmi.c b/sound/pci/hda/patch_hdmi.c
+index b4218a19df22..8867ab3a71d4 100644
+--- a/sound/pci/hda/patch_hdmi.c
++++ b/sound/pci/hda/patch_hdmi.c
+@@ -1598,10 +1598,18 @@ static bool hdmi_present_sense(struct hdmi_spec_per_pin *per_pin, int repoll)
+ 		 * Re-setup pin and infoframe. This is needed e.g. when
+ 		 * - sink is first plugged-in (infoframe is not set up if !monitor_present)
+ 		 * - transcoder can change during stream playback on Haswell
++		 *   and this can make HW reset converter selection on a pin.
+ 		 */
+-		if (eld->eld_valid && !old_eld_valid && per_pin->setup)
++		if (eld->eld_valid && !old_eld_valid && per_pin->setup) {
++			if (is_haswell_plus(codec) || is_valleyview(codec)) {
++				intel_verify_pin_cvt_connect(codec, per_pin);
++				intel_not_share_assigned_cvt(codec, pin_nid,
++							per_pin->mux_idx);
++			}
++
+ 			hdmi_setup_audio_infoframe(codec, per_pin,
+ 						   per_pin->non_pcm);
++		}
+ 	}
+ 
+ 	if (eld_changed)
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index d943508a7f48..10014ed541cf 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -4114,6 +4114,7 @@ enum {
+ 	ALC269_FIXUP_HEADSET_MIC,
+ 	ALC269_FIXUP_QUANTA_MUTE,
+ 	ALC269_FIXUP_LIFEBOOK,
++	ALC269_FIXUP_LIFEBOOK_EXTMIC,
+ 	ALC269_FIXUP_AMIC,
+ 	ALC269_FIXUP_DMIC,
+ 	ALC269VB_FIXUP_AMIC,
+@@ -4243,6 +4244,13 @@ static const struct hda_fixup alc269_fixups[] = {
+ 		.chained = true,
+ 		.chain_id = ALC269_FIXUP_QUANTA_MUTE
+ 	},
++	[ALC269_FIXUP_LIFEBOOK_EXTMIC] = {
++		.type = HDA_FIXUP_PINS,
++		.v.pins = (const struct hda_pintbl[]) {
++			{ 0x19, 0x01a1903c }, /* headset mic, with jack detect */
++			{ }
++		},
++	},
+ 	[ALC269_FIXUP_AMIC] = {
+ 		.type = HDA_FIXUP_PINS,
+ 		.v.pins = (const struct hda_pintbl[]) {
+@@ -4633,14 +4641,24 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x103c, 0x1983, "HP Pavilion", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ 	SND_PCI_QUIRK(0x103c, 0x218b, "HP", ALC269_FIXUP_LIMIT_INT_MIC_BOOST_MUTE_LED),
+ 	/* ALC282 */
++	SND_PCI_QUIRK(0x103c, 0x220d, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
++	SND_PCI_QUIRK(0x103c, 0x220e, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ 	SND_PCI_QUIRK(0x103c, 0x220f, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
++	SND_PCI_QUIRK(0x103c, 0x2210, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
++	SND_PCI_QUIRK(0x103c, 0x2211, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
++	SND_PCI_QUIRK(0x103c, 0x2212, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ 	SND_PCI_QUIRK(0x103c, 0x2213, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
++	SND_PCI_QUIRK(0x103c, 0x2214, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ 	SND_PCI_QUIRK(0x103c, 0x2266, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ 	SND_PCI_QUIRK(0x103c, 0x2267, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ 	SND_PCI_QUIRK(0x103c, 0x2268, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ 	SND_PCI_QUIRK(0x103c, 0x2269, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ 	SND_PCI_QUIRK(0x103c, 0x226a, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ 	SND_PCI_QUIRK(0x103c, 0x226b, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
++	SND_PCI_QUIRK(0x103c, 0x226c, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
++	SND_PCI_QUIRK(0x103c, 0x226d, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
++	SND_PCI_QUIRK(0x103c, 0x226e, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
++	SND_PCI_QUIRK(0x103c, 0x226f, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ 	SND_PCI_QUIRK(0x103c, 0x227a, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ 	SND_PCI_QUIRK(0x103c, 0x227b, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ 	SND_PCI_QUIRK(0x103c, 0x229e, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+@@ -4680,6 +4698,10 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x103c, 0x22c8, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ 	SND_PCI_QUIRK(0x103c, 0x22c3, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ 	SND_PCI_QUIRK(0x103c, 0x22c4, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
++	SND_PCI_QUIRK(0x103c, 0x2334, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
++	SND_PCI_QUIRK(0x103c, 0x2335, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
++	SND_PCI_QUIRK(0x103c, 0x2336, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
++	SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ 	SND_PCI_QUIRK_VENDOR(0x103c, "HP", ALC269_FIXUP_HP_MUTE_LED),
+ 	SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
+ 	SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+@@ -4702,6 +4724,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x104d, 0x9084, "Sony VAIO", ALC275_FIXUP_SONY_HWEQ),
+ 	SND_PCI_QUIRK_VENDOR(0x104d, "Sony VAIO", ALC269_FIXUP_SONY_VAIO),
+ 	SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook", ALC269_FIXUP_LIFEBOOK),
++	SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
+ 	SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE),
+ 	SND_PCI_QUIRK(0x17aa, 0x215e, "Thinkpad L512", ALC269_FIXUP_SKU_IGNORE),
+ 	SND_PCI_QUIRK(0x17aa, 0x21b8, "Thinkpad Edge 14", ALC269_FIXUP_SKU_IGNORE),
+@@ -5809,6 +5832,7 @@ static const struct hda_codec_preset snd_hda_preset_realtek[] = {
+ 	{ .id = 0x10ec0670, .name = "ALC670", .patch = patch_alc662 },
+ 	{ .id = 0x10ec0671, .name = "ALC671", .patch = patch_alc662 },
+ 	{ .id = 0x10ec0680, .name = "ALC680", .patch = patch_alc680 },
++	{ .id = 0x10ec0867, .name = "ALC891", .patch = patch_alc882 },
+ 	{ .id = 0x10ec0880, .name = "ALC880", .patch = patch_alc880 },
+ 	{ .id = 0x10ec0882, .name = "ALC882", .patch = patch_alc882 },
+ 	{ .id = 0x10ec0883, .name = "ALC883", .patch = patch_alc882 },
+diff --git a/sound/soc/codecs/max98090.c b/sound/soc/codecs/max98090.c
+index f7b0b37aa858..0757e655bfe3 100644
+--- a/sound/soc/codecs/max98090.c
++++ b/sound/soc/codecs/max98090.c
+@@ -255,6 +255,7 @@ static struct reg_default max98090_reg[] = {
+ static bool max98090_volatile_register(struct device *dev, unsigned int reg)
+ {
+ 	switch (reg) {
++	case M98090_REG_SOFTWARE_RESET:
+ 	case M98090_REG_DEVICE_STATUS:
+ 	case M98090_REG_JACK_STATUS:
+ 	case M98090_REG_REVISION_ID:
+@@ -2373,6 +2374,8 @@ static int max98090_runtime_resume(struct device *dev)
+ 
+ 	regcache_cache_only(max98090->regmap, false);
+ 
++	max98090_reset(max98090);
++
+ 	regcache_sync(max98090->regmap);
+ 
+ 	return 0;
+diff --git a/sound/soc/codecs/tlv320aic3x.c b/sound/soc/codecs/tlv320aic3x.c
+index d7349bc89ad3..e12fafbb1e09 100644
+--- a/sound/soc/codecs/tlv320aic3x.c
++++ b/sound/soc/codecs/tlv320aic3x.c
+@@ -169,7 +169,7 @@ static int snd_soc_dapm_put_volsw_aic3x(struct snd_kcontrol *kcontrol,
+ 	mask <<= shift;
+ 	val <<= shift;
+ 
+-	change = snd_soc_test_bits(codec, val, mask, reg);
++	change = snd_soc_test_bits(codec, reg, mask, val);
+ 	if (change) {
+ 		update.kcontrol = kcontrol;
+ 		update.reg = reg;
+diff --git a/sound/soc/soc-dapm.c b/sound/soc/soc-dapm.c
+index 6d6ceee447d5..ebb03a886593 100644
+--- a/sound/soc/soc-dapm.c
++++ b/sound/soc/soc-dapm.c
+@@ -2857,22 +2857,19 @@ int snd_soc_dapm_put_volsw(struct snd_kcontrol *kcontrol,
+ 	mutex_lock_nested(&card->dapm_mutex, SND_SOC_DAPM_CLASS_RUNTIME);
+ 
+ 	change = dapm_kcontrol_set_value(kcontrol, val);
+-
+-	if (reg != SND_SOC_NOPM) {
+-		mask = mask << shift;
+-		val = val << shift;
+-
+-		change = snd_soc_test_bits(codec, reg, mask, val);
+-	}
+-
+ 	if (change) {
+ 		if (reg != SND_SOC_NOPM) {
+-			update.kcontrol = kcontrol;
+-			update.reg = reg;
+-			update.mask = mask;
+-			update.val = val;
++			mask = mask << shift;
++			val = val << shift;
++
++			if (snd_soc_test_bits(codec, reg, mask, val)) {
++				update.kcontrol = kcontrol;
++				update.reg = reg;
++				update.mask = mask;
++				update.val = val;
++				card->update = &update;
++			}
+ 
+-			card->update = &update;
+ 		}
+ 
+ 		ret = soc_dapm_mixer_update_power(card, kcontrol, connect);