Linux patch 5.7.155.7-16

Signed-off-by: Alice Ferrazzi <alicef@gentoo.org>

2 files changed, 2997 insertions, 0 deletions

diff --git a/0000_README b/0000_README
index ff8860b4..dc0ff9b9 100644
--- a/0000_README
+++ b/0000_README
@@ -99,6 +99,10 @@ Patch:  1013_linux-5.7.14.patch
 From:   http://www.kernel.org
 Desc:   Linux 5.7.14
 
+Patch:  1014_linux-5.7.15.patch
+From:   http://www.kernel.org
+Desc:   Linux 5.7.15
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.
diff --git a/1014_linux-5.7.15.patch b/1014_linux-5.7.15.patch
new file mode 100644
index 00000000..56dcf524
--- /dev/null
+++ b/1014_linux-5.7.15.patch
@@ -0,0 +1,2993 @@
+diff --git a/Makefile b/Makefile
+index 70942a6541d8..a2fbdb4c952d 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 5
+ PATCHLEVEL = 7
+-SUBLEVEL = 14
++SUBLEVEL = 15
+ EXTRAVERSION =
+ NAME = Kleptomaniac Octopus
+ 
+diff --git a/arch/arm64/kernel/kaslr.c b/arch/arm64/kernel/kaslr.c
+index e2101440c314..b892670293a9 100644
+--- a/arch/arm64/kernel/kaslr.c
++++ b/arch/arm64/kernel/kaslr.c
+@@ -84,6 +84,7 @@ u64 __init kaslr_early_init(u64 dt_phys)
+ 	void *fdt;
+ 	u64 seed, offset, mask, module_range;
+ 	const u8 *cmdline, *str;
++	unsigned long raw;
+ 	int size;
+ 
+ 	/*
+@@ -122,15 +123,12 @@ u64 __init kaslr_early_init(u64 dt_phys)
+ 	}
+ 
+ 	/*
+-	 * Mix in any entropy obtainable architecturally, open coded
+-	 * since this runs extremely early.
++	 * Mix in any entropy obtainable architecturally if enabled
++	 * and supported.
+ 	 */
+-	if (__early_cpu_has_rndr()) {
+-		unsigned long raw;
+ 
+-		if (__arm64_rndr(&raw))
+-			seed ^= raw;
+-	}
++	if (arch_get_random_seed_long_early(&raw))
++		seed ^= raw;
+ 
+ 	if (!seed) {
+ 		kaslr_status = KASLR_DISABLED_NO_SEED;
+diff --git a/arch/powerpc/include/asm/kasan.h b/arch/powerpc/include/asm/kasan.h
+index 4769bbf7173a..fc900937f653 100644
+--- a/arch/powerpc/include/asm/kasan.h
++++ b/arch/powerpc/include/asm/kasan.h
+@@ -27,10 +27,12 @@
+ 
+ #ifdef CONFIG_KASAN
+ void kasan_early_init(void);
++void kasan_mmu_init(void);
+ void kasan_init(void);
+ void kasan_late_init(void);
+ #else
+ static inline void kasan_init(void) { }
++static inline void kasan_mmu_init(void) { }
+ static inline void kasan_late_init(void) { }
+ #endif
+ 
+diff --git a/arch/powerpc/mm/init_32.c b/arch/powerpc/mm/init_32.c
+index a6991ef8727d..872df48ae41b 100644
+--- a/arch/powerpc/mm/init_32.c
++++ b/arch/powerpc/mm/init_32.c
+@@ -170,6 +170,8 @@ void __init MMU_init(void)
+ 	btext_unmap();
+ #endif
+ 
++	kasan_mmu_init();
++
+ 	setup_kup();
+ 
+ 	/* Shortly after that, the entire linear mapping will be available */
+diff --git a/arch/powerpc/mm/kasan/kasan_init_32.c b/arch/powerpc/mm/kasan/kasan_init_32.c
+index b7c287adfd59..8b15fe09b967 100644
+--- a/arch/powerpc/mm/kasan/kasan_init_32.c
++++ b/arch/powerpc/mm/kasan/kasan_init_32.c
+@@ -131,7 +131,7 @@ static void __init kasan_unmap_early_shadow_vmalloc(void)
+ 	flush_tlb_kernel_range(k_start, k_end);
+ }
+ 
+-static void __init kasan_mmu_init(void)
++void __init kasan_mmu_init(void)
+ {
+ 	int ret;
+ 	struct memblock_region *reg;
+@@ -159,8 +159,6 @@ static void __init kasan_mmu_init(void)
+ 
+ void __init kasan_init(void)
+ {
+-	kasan_mmu_init();
+-
+ 	kasan_remap_early_shadow_ro();
+ 
+ 	clear_page(kasan_early_shadow_page);
+diff --git a/drivers/android/binder.c b/drivers/android/binder.c
+index f50c5f182bb5..5b310eea9e52 100644
+--- a/drivers/android/binder.c
++++ b/drivers/android/binder.c
+@@ -2982,6 +2982,12 @@ static void binder_transaction(struct binder_proc *proc,
+ 			goto err_dead_binder;
+ 		}
+ 		e->to_node = target_node->debug_id;
++		if (WARN_ON(proc == target_proc)) {
++			return_error = BR_FAILED_REPLY;
++			return_error_param = -EINVAL;
++			return_error_line = __LINE__;
++			goto err_invalid_target_handle;
++		}
+ 		if (security_binder_transaction(proc->tsk,
+ 						target_proc->tsk) < 0) {
+ 			return_error = BR_FAILED_REPLY;
+@@ -3635,10 +3641,17 @@ static int binder_thread_write(struct binder_proc *proc,
+ 				struct binder_node *ctx_mgr_node;
+ 				mutex_lock(&context->context_mgr_node_lock);
+ 				ctx_mgr_node = context->binder_context_mgr_node;
+-				if (ctx_mgr_node)
++				if (ctx_mgr_node) {
++					if (ctx_mgr_node->proc == proc) {
++						binder_user_error("%d:%d context manager tried to acquire desc 0\n",
++								  proc->pid, thread->pid);
++						mutex_unlock(&context->context_mgr_node_lock);
++						return -EINVAL;
++					}
+ 					ret = binder_inc_ref_for_node(
+ 							proc, ctx_mgr_node,
+ 							strong, NULL, &rdata);
++				}
+ 				mutex_unlock(&context->context_mgr_node_lock);
+ 			}
+ 			if (ret)
+diff --git a/drivers/atm/atmtcp.c b/drivers/atm/atmtcp.c
+index d9fd70280482..7f814da3c2d0 100644
+--- a/drivers/atm/atmtcp.c
++++ b/drivers/atm/atmtcp.c
+@@ -433,9 +433,15 @@ static int atmtcp_remove_persistent(int itf)
+ 		return -EMEDIUMTYPE;
+ 	}
+ 	dev_data = PRIV(dev);
+-	if (!dev_data->persist) return 0;
++	if (!dev_data->persist) {
++		atm_dev_put(dev);
++		return 0;
++	}
+ 	dev_data->persist = 0;
+-	if (PRIV(dev)->vcc) return 0;
++	if (PRIV(dev)->vcc) {
++		atm_dev_put(dev);
++		return 0;
++	}
+ 	kfree(dev_data);
+ 	atm_dev_put(dev);
+ 	atm_dev_deregister(dev);
+diff --git a/drivers/firmware/qemu_fw_cfg.c b/drivers/firmware/qemu_fw_cfg.c
+index 039e0f91dba8..6945c3c96637 100644
+--- a/drivers/firmware/qemu_fw_cfg.c
++++ b/drivers/firmware/qemu_fw_cfg.c
+@@ -605,8 +605,10 @@ static int fw_cfg_register_file(const struct fw_cfg_file *f)
+ 	/* register entry under "/sys/firmware/qemu_fw_cfg/by_key/" */
+ 	err = kobject_init_and_add(&entry->kobj, &fw_cfg_sysfs_entry_ktype,
+ 				   fw_cfg_sel_ko, "%d", entry->select);
+-	if (err)
+-		goto err_register;
++	if (err) {
++		kobject_put(&entry->kobj);
++		return err;
++	}
+ 
+ 	/* add raw binary content access */
+ 	err = sysfs_create_bin_file(&entry->kobj, &fw_cfg_sysfs_attr_raw);
+@@ -622,7 +624,6 @@ static int fw_cfg_register_file(const struct fw_cfg_file *f)
+ 
+ err_add_raw:
+ 	kobject_del(&entry->kobj);
+-err_register:
+ 	kfree(entry);
+ 	return err;
+ }
+diff --git a/drivers/gpio/gpio-max77620.c b/drivers/gpio/gpio-max77620.c
+index 313bd02dd893..bd6c4faea639 100644
+--- a/drivers/gpio/gpio-max77620.c
++++ b/drivers/gpio/gpio-max77620.c
+@@ -305,8 +305,9 @@ static int max77620_gpio_probe(struct platform_device *pdev)
+ 	gpiochip_irqchip_add_nested(&mgpio->gpio_chip, &max77620_gpio_irqchip,
+ 				    0, handle_edge_irq, IRQ_TYPE_NONE);
+ 
+-	ret = request_threaded_irq(gpio_irq, NULL, max77620_gpio_irqhandler,
+-				   IRQF_ONESHOT, "max77620-gpio", mgpio);
++	ret = devm_request_threaded_irq(&pdev->dev, gpio_irq, NULL,
++					max77620_gpio_irqhandler, IRQF_ONESHOT,
++					"max77620-gpio", mgpio);
+ 	if (ret < 0) {
+ 		dev_err(&pdev->dev, "failed to request IRQ: %d\n", ret);
+ 		return ret;
+diff --git a/drivers/gpu/drm/bochs/bochs_kms.c b/drivers/gpu/drm/bochs/bochs_kms.c
+index 8066d7d370d5..200d55fa9765 100644
+--- a/drivers/gpu/drm/bochs/bochs_kms.c
++++ b/drivers/gpu/drm/bochs/bochs_kms.c
+@@ -143,6 +143,7 @@ int bochs_kms_init(struct bochs_device *bochs)
+ 	bochs->dev->mode_config.preferred_depth = 24;
+ 	bochs->dev->mode_config.prefer_shadow = 0;
+ 	bochs->dev->mode_config.prefer_shadow_fbdev = 1;
++	bochs->dev->mode_config.fbdev_use_iomem = true;
+ 	bochs->dev->mode_config.quirk_addfb_prefer_host_byte_order = true;
+ 
+ 	bochs->dev->mode_config.funcs = &bochs_mode_funcs;
+diff --git a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+index 87b58c1acff4..648eb23d0784 100644
+--- a/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
++++ b/drivers/gpu/drm/bridge/adv7511/adv7511_drv.c
+@@ -1224,6 +1224,7 @@ static int adv7511_probe(struct i2c_client *i2c, const struct i2c_device_id *id)
+ 
+ 	adv7511->bridge.funcs = &adv7511_bridge_funcs;
+ 	adv7511->bridge.of_node = dev->of_node;
++	adv7511->bridge.type = DRM_MODE_CONNECTOR_HDMIA;
+ 
+ 	drm_bridge_add(&adv7511->bridge);
+ 
+diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c
+index c7be39a00d43..4dd12a069474 100644
+--- a/drivers/gpu/drm/drm_fb_helper.c
++++ b/drivers/gpu/drm/drm_fb_helper.c
+@@ -399,7 +399,11 @@ static void drm_fb_helper_dirty_blit_real(struct drm_fb_helper *fb_helper,
+ 	unsigned int y;
+ 
+ 	for (y = clip->y1; y < clip->y2; y++) {
+-		memcpy(dst, src, len);
++		if (!fb_helper->dev->mode_config.fbdev_use_iomem)
++			memcpy(dst, src, len);
++		else
++			memcpy_toio((void __iomem *)dst, src, len);
++
+ 		src += fb->pitches[0];
+ 		dst += fb->pitches[0];
+ 	}
+diff --git a/drivers/gpu/drm/nouveau/dispnv50/disp.c b/drivers/gpu/drm/nouveau/dispnv50/disp.c
+index 2625ed84fc44..5835d19e1c45 100644
+--- a/drivers/gpu/drm/nouveau/dispnv50/disp.c
++++ b/drivers/gpu/drm/nouveau/dispnv50/disp.c
+@@ -2041,7 +2041,7 @@ nv50_disp_atomic_commit_tail(struct drm_atomic_state *state)
+ 	 */
+ 	if (core->assign_windows) {
+ 		core->func->wndw.owner(core);
+-		core->func->update(core, interlock, false);
++		nv50_disp_atomic_commit_core(state, interlock);
+ 		core->assign_windows = false;
+ 		interlock[NV50_DISP_INTERLOCK_CORE] = 0;
+ 	}
+diff --git a/drivers/gpu/drm/nouveau/nouveau_fbcon.c b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+index 24d543a01f43..47883f225941 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
++++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+@@ -315,7 +315,7 @@ nouveau_fbcon_create(struct drm_fb_helper *helper,
+ 	struct nouveau_framebuffer *fb;
+ 	struct nouveau_channel *chan;
+ 	struct nouveau_bo *nvbo;
+-	struct drm_mode_fb_cmd2 mode_cmd;
++	struct drm_mode_fb_cmd2 mode_cmd = {};
+ 	int ret;
+ 
+ 	mode_cmd.width = sizes->surface_width;
+@@ -588,6 +588,7 @@ fini:
+ 	drm_fb_helper_fini(&fbcon->helper);
+ free:
+ 	kfree(fbcon);
++	drm->fbcon = NULL;
+ 	return ret;
+ }
+ 
+diff --git a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c
+index 48a164257d18..3edb33e61908 100644
+--- a/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c
++++ b/drivers/gpu/drm/panel/panel-boe-tv101wum-nl6.c
+@@ -615,9 +615,9 @@ static const struct panel_desc boe_tv101wum_nl6_desc = {
+ static const struct drm_display_mode auo_kd101n80_45na_default_mode = {
+ 	.clock = 157000,
+ 	.hdisplay = 1200,
+-	.hsync_start = 1200 + 80,
+-	.hsync_end = 1200 + 80 + 24,
+-	.htotal = 1200 + 80 + 24 + 36,
++	.hsync_start = 1200 + 60,
++	.hsync_end = 1200 + 60 + 24,
++	.htotal = 1200 + 60 + 24 + 56,
+ 	.vdisplay = 1920,
+ 	.vsync_start = 1920 + 16,
+ 	.vsync_end = 1920 + 16 + 4,
+diff --git a/drivers/i2c/i2c-core-slave.c b/drivers/i2c/i2c-core-slave.c
+index 5427f047faf0..1589179d5eb9 100644
+--- a/drivers/i2c/i2c-core-slave.c
++++ b/drivers/i2c/i2c-core-slave.c
+@@ -18,10 +18,8 @@ int i2c_slave_register(struct i2c_client *client, i2c_slave_cb_t slave_cb)
+ {
+ 	int ret;
+ 
+-	if (!client || !slave_cb) {
+-		WARN(1, "insufficient data\n");
++	if (WARN(IS_ERR_OR_NULL(client) || !slave_cb, "insufficient data\n"))
+ 		return -EINVAL;
+-	}
+ 
+ 	if (!(client->flags & I2C_CLIENT_SLAVE))
+ 		dev_warn(&client->dev, "%s: client slave flag not set. You might see address collisions\n",
+@@ -60,6 +58,9 @@ int i2c_slave_unregister(struct i2c_client *client)
+ {
+ 	int ret;
+ 
++	if (IS_ERR_OR_NULL(client))
++		return -EINVAL;
++
+ 	if (!client->adapter->algo->unreg_slave) {
+ 		dev_err(&client->dev, "%s: not supported by adapter\n", __func__);
+ 		return -EOPNOTSUPP;
+diff --git a/drivers/leds/leds-88pm860x.c b/drivers/leds/leds-88pm860x.c
+index b3044c9a8120..465c3755cf2e 100644
+--- a/drivers/leds/leds-88pm860x.c
++++ b/drivers/leds/leds-88pm860x.c
+@@ -203,21 +203,33 @@ static int pm860x_led_probe(struct platform_device *pdev)
+ 	data->cdev.brightness_set_blocking = pm860x_led_set;
+ 	mutex_init(&data->lock);
+ 
+-	ret = devm_led_classdev_register(chip->dev, &data->cdev);
++	ret = led_classdev_register(chip->dev, &data->cdev);
+ 	if (ret < 0) {
+ 		dev_err(&pdev->dev, "Failed to register LED: %d\n", ret);
+ 		return ret;
+ 	}
+ 	pm860x_led_set(&data->cdev, 0);
++
++	platform_set_drvdata(pdev, data);
++
+ 	return 0;
+ }
+ 
++static int pm860x_led_remove(struct platform_device *pdev)
++{
++	struct pm860x_led *data = platform_get_drvdata(pdev);
++
++	led_classdev_unregister(&data->cdev);
++
++	return 0;
++}
+ 
+ static struct platform_driver pm860x_led_driver = {
+ 	.driver	= {
+ 		.name	= "88pm860x-led",
+ 	},
+ 	.probe	= pm860x_led_probe,
++	.remove	= pm860x_led_remove,
+ };
+ 
+ module_platform_driver(pm860x_led_driver);
+diff --git a/drivers/leds/leds-da903x.c b/drivers/leds/leds-da903x.c
+index ed1b303f699f..2b5fb00438a2 100644
+--- a/drivers/leds/leds-da903x.c
++++ b/drivers/leds/leds-da903x.c
+@@ -110,12 +110,23 @@ static int da903x_led_probe(struct platform_device *pdev)
+ 	led->flags = pdata->flags;
+ 	led->master = pdev->dev.parent;
+ 
+-	ret = devm_led_classdev_register(led->master, &led->cdev);
++	ret = led_classdev_register(led->master, &led->cdev);
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "failed to register LED %d\n", id);
+ 		return ret;
+ 	}
+ 
++	platform_set_drvdata(pdev, led);
++
++	return 0;
++}
++
++static int da903x_led_remove(struct platform_device *pdev)
++{
++	struct da903x_led *led = platform_get_drvdata(pdev);
++
++	led_classdev_unregister(&led->cdev);
++
+ 	return 0;
+ }
+ 
+@@ -124,6 +135,7 @@ static struct platform_driver da903x_led_driver = {
+ 		.name	= "da903x-led",
+ 	},
+ 	.probe		= da903x_led_probe,
++	.remove		= da903x_led_remove,
+ };
+ 
+ module_platform_driver(da903x_led_driver);
+diff --git a/drivers/leds/leds-lm3533.c b/drivers/leds/leds-lm3533.c
+index 9504ad405aef..b3edee703193 100644
+--- a/drivers/leds/leds-lm3533.c
++++ b/drivers/leds/leds-lm3533.c
+@@ -694,7 +694,7 @@ static int lm3533_led_probe(struct platform_device *pdev)
+ 
+ 	platform_set_drvdata(pdev, led);
+ 
+-	ret = devm_led_classdev_register(pdev->dev.parent, &led->cdev);
++	ret = led_classdev_register(pdev->dev.parent, &led->cdev);
+ 	if (ret) {
+ 		dev_err(&pdev->dev, "failed to register LED %d\n", pdev->id);
+ 		return ret;
+@@ -704,13 +704,18 @@ static int lm3533_led_probe(struct platform_device *pdev)
+ 
+ 	ret = lm3533_led_setup(led, pdata);
+ 	if (ret)
+-		return ret;
++		goto err_deregister;
+ 
+ 	ret = lm3533_ctrlbank_enable(&led->cb);
+ 	if (ret)
+-		return ret;
++		goto err_deregister;
+ 
+ 	return 0;
++
++err_deregister:
++	led_classdev_unregister(&led->cdev);
++
++	return ret;
+ }
+ 
+ static int lm3533_led_remove(struct platform_device *pdev)
+@@ -720,6 +725,7 @@ static int lm3533_led_remove(struct platform_device *pdev)
+ 	dev_dbg(&pdev->dev, "%s\n", __func__);
+ 
+ 	lm3533_ctrlbank_disable(&led->cb);
++	led_classdev_unregister(&led->cdev);
+ 
+ 	return 0;
+ }
+diff --git a/drivers/leds/leds-lm36274.c b/drivers/leds/leds-lm36274.c
+index 836b60c9a2b8..db842eeb7ca2 100644
+--- a/drivers/leds/leds-lm36274.c
++++ b/drivers/leds/leds-lm36274.c
+@@ -133,7 +133,7 @@ static int lm36274_probe(struct platform_device *pdev)
+ 	lm36274_data->pdev = pdev;
+ 	lm36274_data->dev = lmu->dev;
+ 	lm36274_data->regmap = lmu->regmap;
+-	dev_set_drvdata(&pdev->dev, lm36274_data);
++	platform_set_drvdata(pdev, lm36274_data);
+ 
+ 	ret = lm36274_parse_dt(lm36274_data);
+ 	if (ret) {
+@@ -147,8 +147,16 @@ static int lm36274_probe(struct platform_device *pdev)
+ 		return ret;
+ 	}
+ 
+-	return devm_led_classdev_register(lm36274_data->dev,
+-					 &lm36274_data->led_dev);
++	return led_classdev_register(lm36274_data->dev, &lm36274_data->led_dev);
++}
++
++static int lm36274_remove(struct platform_device *pdev)
++{
++	struct lm36274 *lm36274_data = platform_get_drvdata(pdev);
++
++	led_classdev_unregister(&lm36274_data->led_dev);
++
++	return 0;
+ }
+ 
+ static const struct of_device_id of_lm36274_leds_match[] = {
+@@ -159,6 +167,7 @@ MODULE_DEVICE_TABLE(of, of_lm36274_leds_match);
+ 
+ static struct platform_driver lm36274_driver = {
+ 	.probe  = lm36274_probe,
++	.remove = lm36274_remove,
+ 	.driver = {
+ 		.name = "lm36274-leds",
+ 	},
+diff --git a/drivers/leds/leds-wm831x-status.c b/drivers/leds/leds-wm831x-status.c
+index 082df7f1dd90..67f4235cb28a 100644
+--- a/drivers/leds/leds-wm831x-status.c
++++ b/drivers/leds/leds-wm831x-status.c
+@@ -269,12 +269,23 @@ static int wm831x_status_probe(struct platform_device *pdev)
+ 	drvdata->cdev.blink_set = wm831x_status_blink_set;
+ 	drvdata->cdev.groups = wm831x_status_groups;
+ 
+-	ret = devm_led_classdev_register(wm831x->dev, &drvdata->cdev);
++	ret = led_classdev_register(wm831x->dev, &drvdata->cdev);
+ 	if (ret < 0) {
+ 		dev_err(&pdev->dev, "Failed to register LED: %d\n", ret);
+ 		return ret;
+ 	}
+ 
++	platform_set_drvdata(pdev, drvdata);
++
++	return 0;
++}
++
++static int wm831x_status_remove(struct platform_device *pdev)
++{
++	struct wm831x_status *drvdata = platform_get_drvdata(pdev);
++
++	led_classdev_unregister(&drvdata->cdev);
++
+ 	return 0;
+ }
+ 
+@@ -283,6 +294,7 @@ static struct platform_driver wm831x_status_driver = {
+ 		   .name = "wm831x-status",
+ 		   },
+ 	.probe = wm831x_status_probe,
++	.remove = wm831x_status_remove,
+ };
+ 
+ module_platform_driver(wm831x_status_driver);
+diff --git a/drivers/misc/lkdtm/heap.c b/drivers/misc/lkdtm/heap.c
+index 3c5cec85edce..1323bc16f113 100644
+--- a/drivers/misc/lkdtm/heap.c
++++ b/drivers/misc/lkdtm/heap.c
+@@ -58,11 +58,12 @@ void lkdtm_READ_AFTER_FREE(void)
+ 	int *base, *val, saw;
+ 	size_t len = 1024;
+ 	/*
+-	 * The slub allocator uses the first word to store the free
+-	 * pointer in some configurations. Use the middle of the
+-	 * allocation to avoid running into the freelist
++	 * The slub allocator will use the either the first word or
++	 * the middle of the allocation to store the free pointer,
++	 * depending on configurations. Store in the second word to
++	 * avoid running into the freelist.
+ 	 */
+-	size_t offset = (len / sizeof(*base)) / 2;
++	size_t offset = sizeof(*base);
+ 
+ 	base = kmalloc(len, GFP_KERNEL);
+ 	if (!base) {
+diff --git a/drivers/mtd/mtdchar.c b/drivers/mtd/mtdchar.c
+index c5935b2f9cd1..b40f46a43fc6 100644
+--- a/drivers/mtd/mtdchar.c
++++ b/drivers/mtd/mtdchar.c
+@@ -355,9 +355,6 @@ static int mtdchar_writeoob(struct file *file, struct mtd_info *mtd,
+ 	uint32_t retlen;
+ 	int ret = 0;
+ 
+-	if (!(file->f_mode & FMODE_WRITE))
+-		return -EPERM;
+-
+ 	if (length > 4096)
+ 		return -EINVAL;
+ 
+@@ -643,6 +640,48 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg)
+ 
+ 	pr_debug("MTD_ioctl\n");
+ 
++	/*
++	 * Check the file mode to require "dangerous" commands to have write
++	 * permissions.
++	 */
++	switch (cmd) {
++	/* "safe" commands */
++	case MEMGETREGIONCOUNT:
++	case MEMGETREGIONINFO:
++	case MEMGETINFO:
++	case MEMREADOOB:
++	case MEMREADOOB64:
++	case MEMLOCK:
++	case MEMUNLOCK:
++	case MEMISLOCKED:
++	case MEMGETOOBSEL:
++	case MEMGETBADBLOCK:
++	case MEMSETBADBLOCK:
++	case OTPSELECT:
++	case OTPGETREGIONCOUNT:
++	case OTPGETREGIONINFO:
++	case OTPLOCK:
++	case ECCGETLAYOUT:
++	case ECCGETSTATS:
++	case MTDFILEMODE:
++	case BLKPG:
++	case BLKRRPART:
++		break;
++
++	/* "dangerous" commands */
++	case MEMERASE:
++	case MEMERASE64:
++	case MEMWRITEOOB:
++	case MEMWRITEOOB64:
++	case MEMWRITE:
++		if (!(file->f_mode & FMODE_WRITE))
++			return -EPERM;
++		break;
++
++	default:
++		return -ENOTTY;
++	}
++
+ 	switch (cmd) {
+ 	case MEMGETREGIONCOUNT:
+ 		if (copy_to_user(argp, &(mtd->numeraseregions), sizeof(int)))
+@@ -690,9 +729,6 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg)
+ 	{
+ 		struct erase_info *erase;
+ 
+-		if(!(file->f_mode & FMODE_WRITE))
+-			return -EPERM;
+-
+ 		erase=kzalloc(sizeof(struct erase_info),GFP_KERNEL);
+ 		if (!erase)
+ 			ret = -ENOMEM;
+@@ -985,9 +1021,6 @@ static int mtdchar_ioctl(struct file *file, u_int cmd, u_long arg)
+ 		ret = 0;
+ 		break;
+ 	}
+-
+-	default:
+-		ret = -ENOTTY;
+ 	}
+ 
+ 	return ret;
+@@ -1031,6 +1064,11 @@ static long mtdchar_compat_ioctl(struct file *file, unsigned int cmd,
+ 		struct mtd_oob_buf32 buf;
+ 		struct mtd_oob_buf32 __user *buf_user = argp;
+ 
++		if (!(file->f_mode & FMODE_WRITE)) {
++			ret = -EPERM;
++			break;
++		}
++
+ 		if (copy_from_user(&buf, argp, sizeof(buf)))
+ 			ret = -EFAULT;
+ 		else
+diff --git a/drivers/net/ethernet/cadence/macb_main.c b/drivers/net/ethernet/cadence/macb_main.c
+index f1f0976e7669..3a157be857b0 100644
+--- a/drivers/net/ethernet/cadence/macb_main.c
++++ b/drivers/net/ethernet/cadence/macb_main.c
+@@ -578,7 +578,7 @@ static void macb_mac_config(struct phylink_config *config, unsigned int mode,
+ 	if (bp->caps & MACB_CAPS_MACB_IS_EMAC) {
+ 		if (state->interface == PHY_INTERFACE_MODE_RMII)
+ 			ctrl |= MACB_BIT(RM9200_RMII);
+-	} else {
++	} else if (macb_is_gem(bp)) {
+ 		ctrl &= ~(GEM_BIT(SGMIIEN) | GEM_BIT(PCSSEL));
+ 
+ 		if (state->interface == PHY_INTERFACE_MODE_SGMII)
+@@ -639,10 +639,13 @@ static void macb_mac_link_up(struct phylink_config *config,
+ 		ctrl |= MACB_BIT(FD);
+ 
+ 	if (!(bp->caps & MACB_CAPS_MACB_IS_EMAC)) {
+-		ctrl &= ~(GEM_BIT(GBE) | MACB_BIT(PAE));
++		ctrl &= ~MACB_BIT(PAE);
++		if (macb_is_gem(bp)) {
++			ctrl &= ~GEM_BIT(GBE);
+ 
+-		if (speed == SPEED_1000)
+-			ctrl |= GEM_BIT(GBE);
++			if (speed == SPEED_1000)
++				ctrl |= GEM_BIT(GBE);
++		}
+ 
+ 		/* We do not support MLO_PAUSE_RX yet */
+ 		if (tx_pause)
+diff --git a/drivers/net/ethernet/cavium/thunder/nicvf_main.c b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+index b4b33368698f..ae48f2e9265f 100644
+--- a/drivers/net/ethernet/cavium/thunder/nicvf_main.c
++++ b/drivers/net/ethernet/cavium/thunder/nicvf_main.c
+@@ -2041,11 +2041,11 @@ static void nicvf_set_rx_mode_task(struct work_struct *work_arg)
+ 	/* Save message data locally to prevent them from
+ 	 * being overwritten by next ndo_set_rx_mode call().
+ 	 */
+-	spin_lock(&nic->rx_mode_wq_lock);
++	spin_lock_bh(&nic->rx_mode_wq_lock);
+ 	mode = vf_work->mode;
+ 	mc = vf_work->mc;
+ 	vf_work->mc = NULL;
+-	spin_unlock(&nic->rx_mode_wq_lock);
++	spin_unlock_bh(&nic->rx_mode_wq_lock);
+ 
+ 	__nicvf_set_rx_mode_task(mode, mc, nic);
+ }
+diff --git a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
+index 72fa9c4e058f..b7031f8562e0 100644
+--- a/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
++++ b/drivers/net/ethernet/freescale/dpaa2/dpaa2-eth.c
+@@ -2120,7 +2120,7 @@ close:
+ free:
+ 	fsl_mc_object_free(dpcon);
+ 
+-	return NULL;
++	return ERR_PTR(err);
+ }
+ 
+ static void free_dpcon(struct dpaa2_eth_priv *priv,
+@@ -2144,8 +2144,8 @@ alloc_channel(struct dpaa2_eth_priv *priv)
+ 		return NULL;
+ 
+ 	channel->dpcon = setup_dpcon(priv);
+-	if (IS_ERR_OR_NULL(channel->dpcon)) {
+-		err = PTR_ERR_OR_ZERO(channel->dpcon);
++	if (IS_ERR(channel->dpcon)) {
++		err = PTR_ERR(channel->dpcon);
+ 		goto err_setup;
+ 	}
+ 
+diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c
+index b46bff8fe056..b35d599fc78e 100644
+--- a/drivers/net/ethernet/intel/igb/igb_main.c
++++ b/drivers/net/ethernet/intel/igb/igb_main.c
+@@ -6224,9 +6224,18 @@ static void igb_reset_task(struct work_struct *work)
+ 	struct igb_adapter *adapter;
+ 	adapter = container_of(work, struct igb_adapter, reset_task);
+ 
++	rtnl_lock();
++	/* If we're already down or resetting, just bail */
++	if (test_bit(__IGB_DOWN, &adapter->state) ||
++	    test_bit(__IGB_RESETTING, &adapter->state)) {
++		rtnl_unlock();
++		return;
++	}
++
+ 	igb_dump(adapter);
+ 	netdev_err(adapter->netdev, "Reset adapter\n");
+ 	igb_reinit_locked(adapter);
++	rtnl_unlock();
+ }
+ 
+ /**
+diff --git a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+index 24f4d8e0da98..ee72397813d4 100644
+--- a/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
++++ b/drivers/net/ethernet/marvell/mvpp2/mvpp2_main.c
+@@ -2981,6 +2981,7 @@ static int mvpp2_rx(struct mvpp2_port *port, struct napi_struct *napi,
+ 		err = mvpp2_rx_refill(port, bm_pool, pool);
+ 		if (err) {
+ 			netdev_err(port->dev, "failed to refill BM pools\n");
++			dev_kfree_skb_any(skb);
+ 			goto err_drop_frame;
+ 		}
+ 
+diff --git a/drivers/net/ethernet/mediatek/mtk_eth_soc.c b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+index b743d8b56c84..82f5690ff4d3 100644
+--- a/drivers/net/ethernet/mediatek/mtk_eth_soc.c
++++ b/drivers/net/ethernet/mediatek/mtk_eth_soc.c
+@@ -171,11 +171,21 @@ static int mt7621_gmac0_rgmii_adjust(struct mtk_eth *eth,
+ 	return 0;
+ }
+ 
+-static void mtk_gmac0_rgmii_adjust(struct mtk_eth *eth, int speed)
++static void mtk_gmac0_rgmii_adjust(struct mtk_eth *eth,
++				   phy_interface_t interface, int speed)
+ {
+ 	u32 val;
+ 	int ret;
+ 
++	if (interface == PHY_INTERFACE_MODE_TRGMII) {
++		mtk_w32(eth, TRGMII_MODE, INTF_MODE);
++		val = 500000000;
++		ret = clk_set_rate(eth->clks[MTK_CLK_TRGPLL], val);
++		if (ret)
++			dev_err(eth->dev, "Failed to set trgmii pll: %d\n", ret);
++		return;
++	}
++
+ 	val = (speed == SPEED_1000) ?
+ 		INTF_MODE_RGMII_1000 : INTF_MODE_RGMII_10_100;
+ 	mtk_w32(eth, val, INTF_MODE);
+@@ -262,10 +272,9 @@ static void mtk_mac_config(struct phylink_config *config, unsigned int mode,
+ 							      state->interface))
+ 					goto err_phy;
+ 			} else {
+-				if (state->interface !=
+-				    PHY_INTERFACE_MODE_TRGMII)
+-					mtk_gmac0_rgmii_adjust(mac->hw,
+-							       state->speed);
++				mtk_gmac0_rgmii_adjust(mac->hw,
++						       state->interface,
++						       state->speed);
+ 
+ 				/* mt7623_pad_clk_setup */
+ 				for (i = 0 ; i < NUM_TRGMII_CTRL; i++)
+diff --git a/drivers/net/ethernet/mscc/ocelot.c b/drivers/net/ethernet/mscc/ocelot.c
+index efb3965a3e42..76dbf9ac8ad5 100644
+--- a/drivers/net/ethernet/mscc/ocelot.c
++++ b/drivers/net/ethernet/mscc/ocelot.c
+@@ -749,21 +749,21 @@ void ocelot_get_txtstamp(struct ocelot *ocelot)
+ 
+ 		spin_unlock_irqrestore(&port->tx_skbs.lock, flags);
+ 
+-		/* Next ts */
+-		ocelot_write(ocelot, SYS_PTP_NXT_PTP_NXT, SYS_PTP_NXT);
++		/* Get the h/w timestamp */
++		ocelot_get_hwtimestamp(ocelot, &ts);
+ 
+ 		if (unlikely(!skb_match))
+ 			continue;
+ 
+-		/* Get the h/w timestamp */
+-		ocelot_get_hwtimestamp(ocelot, &ts);
+-
+ 		/* Set the timestamp into the skb */
+ 		memset(&shhwtstamps, 0, sizeof(shhwtstamps));
+ 		shhwtstamps.hwtstamp = ktime_set(ts.tv_sec, ts.tv_nsec);
+ 		skb_tstamp_tx(skb_match, &shhwtstamps);
+ 
+ 		dev_kfree_skb_any(skb_match);
++
++		/* Next ts */
++		ocelot_write(ocelot, SYS_PTP_NXT_PTP_NXT, SYS_PTP_NXT);
+ 	}
+ }
+ EXPORT_SYMBOL(ocelot_get_txtstamp);
+diff --git a/drivers/net/hyperv/netvsc_drv.c b/drivers/net/hyperv/netvsc_drv.c
+index ebcfbae05690..b8b7fc13b3dc 100644
+--- a/drivers/net/hyperv/netvsc_drv.c
++++ b/drivers/net/hyperv/netvsc_drv.c
+@@ -532,12 +532,13 @@ static int netvsc_xmit(struct sk_buff *skb, struct net_device *net, bool xdp_tx)
+ 	u32 hash;
+ 	struct hv_page_buffer pb[MAX_PAGE_BUFFER_COUNT];
+ 
+-	/* if VF is present and up then redirect packets
+-	 * already called with rcu_read_lock_bh
++	/* If VF is present and up then redirect packets to it.
++	 * Skip the VF if it is marked down or has no carrier.
++	 * If netpoll is in uses, then VF can not be used either.
+ 	 */
+ 	vf_netdev = rcu_dereference_bh(net_device_ctx->vf_netdev);
+ 	if (vf_netdev && netif_running(vf_netdev) &&
+-	    !netpoll_tx_running(net))
++	    netif_carrier_ok(vf_netdev) && !netpoll_tx_running(net))
+ 		return netvsc_vf_xmit(net, vf_netdev, skb);
+ 
+ 	/* We will atmost need two pages to describe the rndis
+diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
+index 5f123a8cf68e..d2fdb5430d27 100644
+--- a/drivers/net/usb/hso.c
++++ b/drivers/net/usb/hso.c
+@@ -2261,12 +2261,14 @@ static int hso_serial_common_create(struct hso_serial *serial, int num_urbs,
+ 
+ 	minor = get_free_serial_index();
+ 	if (minor < 0)
+-		goto exit;
++		goto exit2;
+ 
+ 	/* register our minor number */
+ 	serial->parent->dev = tty_port_register_device_attr(&serial->port,
+ 			tty_drv, minor, &serial->parent->interface->dev,
+ 			serial->parent, hso_serial_dev_groups);
++	if (IS_ERR(serial->parent->dev))
++		goto exit2;
+ 
+ 	/* fill in specific data for later use */
+ 	serial->minor = minor;
+@@ -2311,6 +2313,7 @@ static int hso_serial_common_create(struct hso_serial *serial, int num_urbs,
+ 	return 0;
+ exit:
+ 	hso_serial_tty_unregister(serial);
++exit2:
+ 	hso_serial_common_free(serial);
+ 	return -1;
+ }
+diff --git a/drivers/net/usb/lan78xx.c b/drivers/net/usb/lan78xx.c
+index ee062b27cfa7..442507f25aad 100644
+--- a/drivers/net/usb/lan78xx.c
++++ b/drivers/net/usb/lan78xx.c
+@@ -377,10 +377,6 @@ struct lan78xx_net {
+ 	struct tasklet_struct	bh;
+ 	struct delayed_work	wq;
+ 
+-	struct usb_host_endpoint *ep_blkin;
+-	struct usb_host_endpoint *ep_blkout;
+-	struct usb_host_endpoint *ep_intr;
+-
+ 	int			msg_enable;
+ 
+ 	struct urb		*urb_intr;
+@@ -2860,78 +2856,12 @@ lan78xx_start_xmit(struct sk_buff *skb, struct net_device *net)
+ 	return NETDEV_TX_OK;
+ }
+ 
+-static int
+-lan78xx_get_endpoints(struct lan78xx_net *dev, struct usb_interface *intf)
+-{
+-	int tmp;
+-	struct usb_host_interface *alt = NULL;
+-	struct usb_host_endpoint *in = NULL, *out = NULL;
+-	struct usb_host_endpoint *status = NULL;
+-
+-	for (tmp = 0; tmp < intf->num_altsetting; tmp++) {
+-		unsigned ep;
+-
+-		in = NULL;
+-		out = NULL;
+-		status = NULL;
+-		alt = intf->altsetting + tmp;
+-
+-		for (ep = 0; ep < alt->desc.bNumEndpoints; ep++) {
+-			struct usb_host_endpoint *e;
+-			int intr = 0;
+-
+-			e = alt->endpoint + ep;
+-			switch (e->desc.bmAttributes) {
+-			case USB_ENDPOINT_XFER_INT:
+-				if (!usb_endpoint_dir_in(&e->desc))
+-					continue;
+-				intr = 1;
+-				/* FALLTHROUGH */
+-			case USB_ENDPOINT_XFER_BULK:
+-				break;
+-			default:
+-				continue;
+-			}
+-			if (usb_endpoint_dir_in(&e->desc)) {
+-				if (!intr && !in)
+-					in = e;
+-				else if (intr && !status)
+-					status = e;
+-			} else {
+-				if (!out)
+-					out = e;
+-			}
+-		}
+-		if (in && out)
+-			break;
+-	}
+-	if (!alt || !in || !out)
+-		return -EINVAL;
+-
+-	dev->pipe_in = usb_rcvbulkpipe(dev->udev,
+-				       in->desc.bEndpointAddress &
+-				       USB_ENDPOINT_NUMBER_MASK);
+-	dev->pipe_out = usb_sndbulkpipe(dev->udev,
+-					out->desc.bEndpointAddress &
+-					USB_ENDPOINT_NUMBER_MASK);
+-	dev->ep_intr = status;
+-
+-	return 0;
+-}
+-
+ static int lan78xx_bind(struct lan78xx_net *dev, struct usb_interface *intf)
+ {
+ 	struct lan78xx_priv *pdata = NULL;
+ 	int ret;
+ 	int i;
+ 
+-	ret = lan78xx_get_endpoints(dev, intf);
+-	if (ret) {
+-		netdev_warn(dev->net, "lan78xx_get_endpoints failed: %d\n",
+-			    ret);
+-		return ret;
+-	}
+-
+ 	dev->data[0] = (unsigned long)kzalloc(sizeof(*pdata), GFP_KERNEL);
+ 
+ 	pdata = (struct lan78xx_priv *)(dev->data[0]);
+@@ -3700,6 +3630,7 @@ static void lan78xx_stat_monitor(struct timer_list *t)
+ static int lan78xx_probe(struct usb_interface *intf,
+ 			 const struct usb_device_id *id)
+ {
++	struct usb_host_endpoint *ep_blkin, *ep_blkout, *ep_intr;
+ 	struct lan78xx_net *dev;
+ 	struct net_device *netdev;
+ 	struct usb_device *udev;
+@@ -3748,6 +3679,34 @@ static int lan78xx_probe(struct usb_interface *intf,
+ 
+ 	mutex_init(&dev->stats.access_lock);
+ 
++	if (intf->cur_altsetting->desc.bNumEndpoints < 3) {
++		ret = -ENODEV;
++		goto out2;
++	}
++
++	dev->pipe_in = usb_rcvbulkpipe(udev, BULK_IN_PIPE);
++	ep_blkin = usb_pipe_endpoint(udev, dev->pipe_in);
++	if (!ep_blkin || !usb_endpoint_is_bulk_in(&ep_blkin->desc)) {
++		ret = -ENODEV;
++		goto out2;
++	}
++
++	dev->pipe_out = usb_sndbulkpipe(udev, BULK_OUT_PIPE);
++	ep_blkout = usb_pipe_endpoint(udev, dev->pipe_out);
++	if (!ep_blkout || !usb_endpoint_is_bulk_out(&ep_blkout->desc)) {
++		ret = -ENODEV;
++		goto out2;
++	}
++
++	ep_intr = &intf->cur_altsetting->endpoint[2];
++	if (!usb_endpoint_is_int_in(&ep_intr->desc)) {
++		ret = -ENODEV;
++		goto out2;
++	}
++
++	dev->pipe_intr = usb_rcvintpipe(dev->udev,
++					usb_endpoint_num(&ep_intr->desc));
++
+ 	ret = lan78xx_bind(dev, intf);
+ 	if (ret < 0)
+ 		goto out2;
+@@ -3759,23 +3718,7 @@ static int lan78xx_probe(struct usb_interface *intf,
+ 	netdev->max_mtu = MAX_SINGLE_PACKET_SIZE;
+ 	netif_set_gso_max_size(netdev, MAX_SINGLE_PACKET_SIZE - MAX_HEADER);
+ 
+-	if (intf->cur_altsetting->desc.bNumEndpoints < 3) {
+-		ret = -ENODEV;
+-		goto out3;
+-	}
+-
+-	dev->ep_blkin = (intf->cur_altsetting)->endpoint + 0;
+-	dev->ep_blkout = (intf->cur_altsetting)->endpoint + 1;
+-	dev->ep_intr = (intf->cur_altsetting)->endpoint + 2;
+-
+-	dev->pipe_in = usb_rcvbulkpipe(udev, BULK_IN_PIPE);
+-	dev->pipe_out = usb_sndbulkpipe(udev, BULK_OUT_PIPE);
+-
+-	dev->pipe_intr = usb_rcvintpipe(dev->udev,
+-					dev->ep_intr->desc.bEndpointAddress &
+-					USB_ENDPOINT_NUMBER_MASK);
+-	period = dev->ep_intr->desc.bInterval;
+-
++	period = ep_intr->desc.bInterval;
+ 	maxp = usb_maxpacket(dev->udev, dev->pipe_intr, 0);
+ 	buf = kmalloc(maxp, GFP_KERNEL);
+ 	if (buf) {
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index 6e64bc8d601f..b78bb5c558ff 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -1225,6 +1225,7 @@ static int vxlan_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb,
+ 	for (h = 0; h < FDB_HASH_SIZE; ++h) {
+ 		struct vxlan_fdb *f;
+ 
++		rcu_read_lock();
+ 		hlist_for_each_entry_rcu(f, &vxlan->fdb_head[h], hlist) {
+ 			struct vxlan_rdst *rd;
+ 
+@@ -1237,12 +1238,15 @@ static int vxlan_fdb_dump(struct sk_buff *skb, struct netlink_callback *cb,
+ 						     cb->nlh->nlmsg_seq,
+ 						     RTM_NEWNEIGH,
+ 						     NLM_F_MULTI, rd);
+-				if (err < 0)
++				if (err < 0) {
++					rcu_read_unlock();
+ 					goto out;
++				}
+ skip:
+ 				*idx += 1;
+ 			}
+ 		}
++		rcu_read_unlock();
+ 	}
+ out:
+ 	return err;
+@@ -2546,7 +2550,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
+ 		ndst = &rt->dst;
+ 		skb_tunnel_check_pmtu(skb, ndst, VXLAN_HEADROOM);
+ 
+-		tos = ip_tunnel_ecn_encap(RT_TOS(tos), old_iph, skb);
++		tos = ip_tunnel_ecn_encap(tos, old_iph, skb);
+ 		ttl = ttl ? : ip4_dst_hoplimit(&rt->dst);
+ 		err = vxlan_build_skb(skb, ndst, sizeof(struct iphdr),
+ 				      vni, md, flags, udp_sum);
+@@ -2586,7 +2590,7 @@ static void vxlan_xmit_one(struct sk_buff *skb, struct net_device *dev,
+ 
+ 		skb_tunnel_check_pmtu(skb, ndst, VXLAN6_HEADROOM);
+ 
+-		tos = ip_tunnel_ecn_encap(RT_TOS(tos), old_iph, skb);
++		tos = ip_tunnel_ecn_encap(tos, old_iph, skb);
+ 		ttl = ttl ? : ip6_dst_hoplimit(ndst);
+ 		skb_scrub_packet(skb, xnet);
+ 		err = vxlan_build_skb(skb, ndst, sizeof(struct ipv6hdr),
+diff --git a/drivers/nvme/host/pci.c b/drivers/nvme/host/pci.c
+index 10d65f27879f..45e29c6c3234 100644
+--- a/drivers/nvme/host/pci.c
++++ b/drivers/nvme/host/pci.c
+@@ -3130,6 +3130,8 @@ static const struct pci_device_id nvme_id_table[] = {
+ 	{ PCI_DEVICE(0x1cc1, 0x8201),   /* ADATA SX8200PNP 512GB */
+ 		.driver_data = NVME_QUIRK_NO_DEEPEST_PS |
+ 				NVME_QUIRK_IGNORE_DEV_SUBNQN, },
++	{ PCI_DEVICE(0x1c5c, 0x1504),   /* SK Hynix PC400 */
++		.driver_data = NVME_QUIRK_DISABLE_WRITE_ZEROES, },
+ 	{ PCI_DEVICE_CLASS(PCI_CLASS_STORAGE_EXPRESS, 0xffffff) },
+ 	{ PCI_DEVICE(PCI_VENDOR_ID_APPLE, 0x2001),
+ 		.driver_data = NVME_QUIRK_SINGLE_VECTOR },
+diff --git a/drivers/pci/controller/pci-tegra.c b/drivers/pci/controller/pci-tegra.c
+index 3e64ba6a36a8..a4bea7c7fb12 100644
+--- a/drivers/pci/controller/pci-tegra.c
++++ b/drivers/pci/controller/pci-tegra.c
+@@ -181,13 +181,6 @@
+ 
+ #define AFI_PEXBIAS_CTRL_0		0x168
+ 
+-#define RP_PRIV_XP_DL		0x00000494
+-#define  RP_PRIV_XP_DL_GEN2_UPD_FC_TSHOLD	(0x1ff << 1)
+-
+-#define RP_RX_HDR_LIMIT		0x00000e00
+-#define  RP_RX_HDR_LIMIT_PW_MASK	(0xff << 8)
+-#define  RP_RX_HDR_LIMIT_PW		(0x0e << 8)
+-
+ #define RP_ECTL_2_R1	0x00000e84
+ #define  RP_ECTL_2_R1_RX_CTLE_1C_MASK		0xffff
+ 
+@@ -323,7 +316,6 @@ struct tegra_pcie_soc {
+ 	bool program_uphy;
+ 	bool update_clamp_threshold;
+ 	bool program_deskew_time;
+-	bool raw_violation_fixup;
+ 	bool update_fc_timer;
+ 	bool has_cache_bars;
+ 	struct {
+@@ -659,23 +651,6 @@ static void tegra_pcie_apply_sw_fixup(struct tegra_pcie_port *port)
+ 		writel(value, port->base + RP_VEND_CTL0);
+ 	}
+ 
+-	/* Fixup for read after write violation. */
+-	if (soc->raw_violation_fixup) {
+-		value = readl(port->base + RP_RX_HDR_LIMIT);
+-		value &= ~RP_RX_HDR_LIMIT_PW_MASK;
+-		value |= RP_RX_HDR_LIMIT_PW;
+-		writel(value, port->base + RP_RX_HDR_LIMIT);
+-
+-		value = readl(port->base + RP_PRIV_XP_DL);
+-		value |= RP_PRIV_XP_DL_GEN2_UPD_FC_TSHOLD;
+-		writel(value, port->base + RP_PRIV_XP_DL);
+-
+-		value = readl(port->base + RP_VEND_XP);
+-		value &= ~RP_VEND_XP_UPDATE_FC_THRESHOLD_MASK;
+-		value |= soc->update_fc_threshold;
+-		writel(value, port->base + RP_VEND_XP);
+-	}
+-
+ 	if (soc->update_fc_timer) {
+ 		value = readl(port->base + RP_VEND_XP);
+ 		value &= ~RP_VEND_XP_UPDATE_FC_THRESHOLD_MASK;
+@@ -2416,7 +2391,6 @@ static const struct tegra_pcie_soc tegra20_pcie = {
+ 	.program_uphy = true,
+ 	.update_clamp_threshold = false,
+ 	.program_deskew_time = false,
+-	.raw_violation_fixup = false,
+ 	.update_fc_timer = false,
+ 	.has_cache_bars = true,
+ 	.ectl.enable = false,
+@@ -2446,7 +2420,6 @@ static const struct tegra_pcie_soc tegra30_pcie = {
+ 	.program_uphy = true,
+ 	.update_clamp_threshold = false,
+ 	.program_deskew_time = false,
+-	.raw_violation_fixup = false,
+ 	.update_fc_timer = false,
+ 	.has_cache_bars = false,
+ 	.ectl.enable = false,
+@@ -2459,8 +2432,6 @@ static const struct tegra_pcie_soc tegra124_pcie = {
+ 	.pads_pll_ctl = PADS_PLL_CTL_TEGRA30,
+ 	.tx_ref_sel = PADS_PLL_CTL_TXCLKREF_BUF_EN,
+ 	.pads_refclk_cfg0 = 0x44ac44ac,
+-	/* FC threshold is bit[25:18] */
+-	.update_fc_threshold = 0x03fc0000,
+ 	.has_pex_clkreq_en = true,
+ 	.has_pex_bias_ctrl = true,
+ 	.has_intr_prsnt_sense = true,
+@@ -2470,7 +2441,6 @@ static const struct tegra_pcie_soc tegra124_pcie = {
+ 	.program_uphy = true,
+ 	.update_clamp_threshold = true,
+ 	.program_deskew_time = false,
+-	.raw_violation_fixup = true,
+ 	.update_fc_timer = false,
+ 	.has_cache_bars = false,
+ 	.ectl.enable = false,
+@@ -2494,7 +2464,6 @@ static const struct tegra_pcie_soc tegra210_pcie = {
+ 	.program_uphy = true,
+ 	.update_clamp_threshold = true,
+ 	.program_deskew_time = true,
+-	.raw_violation_fixup = false,
+ 	.update_fc_timer = true,
+ 	.has_cache_bars = false,
+ 	.ectl = {
+@@ -2536,7 +2505,6 @@ static const struct tegra_pcie_soc tegra186_pcie = {
+ 	.program_uphy = false,
+ 	.update_clamp_threshold = false,
+ 	.program_deskew_time = false,
+-	.raw_violation_fixup = false,
+ 	.update_fc_timer = false,
+ 	.has_cache_bars = false,
+ 	.ectl.enable = false,
+diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
+index 52740b60d786..7ca32ede5e17 100644
+--- a/drivers/scsi/ufs/ufshcd.c
++++ b/drivers/scsi/ufs/ufshcd.c
+@@ -1908,8 +1908,11 @@ static void ufshcd_clk_scaling_update_busy(struct ufs_hba *hba)
+ static inline
+ void ufshcd_send_command(struct ufs_hba *hba, unsigned int task_tag)
+ {
+-	hba->lrb[task_tag].issue_time_stamp = ktime_get();
+-	hba->lrb[task_tag].compl_time_stamp = ktime_set(0, 0);
++	struct ufshcd_lrb *lrbp = &hba->lrb[task_tag];
++
++	lrbp->issue_time_stamp = ktime_get();
++	lrbp->compl_time_stamp = ktime_set(0, 0);
++	ufshcd_vops_setup_xfer_req(hba, task_tag, (lrbp->cmd ? true : false));
+ 	ufshcd_add_command_trace(hba, task_tag, "send");
+ 	ufshcd_clk_scaling_start_busy(hba);
+ 	__set_bit(task_tag, &hba->outstanding_reqs);
+@@ -2519,7 +2522,6 @@ static int ufshcd_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *cmd)
+ 
+ 	/* issue command to the controller */
+ 	spin_lock_irqsave(hba->host->host_lock, flags);
+-	ufshcd_vops_setup_xfer_req(hba, tag, true);
+ 	ufshcd_send_command(hba, tag);
+ out_unlock:
+ 	spin_unlock_irqrestore(hba->host->host_lock, flags);
+@@ -2706,7 +2708,6 @@ static int ufshcd_exec_dev_cmd(struct ufs_hba *hba,
+ 	/* Make sure descriptors are ready before ringing the doorbell */
+ 	wmb();
+ 	spin_lock_irqsave(hba->host->host_lock, flags);
+-	ufshcd_vops_setup_xfer_req(hba, tag, false);
+ 	ufshcd_send_command(hba, tag);
+ 	spin_unlock_irqrestore(hba->host->host_lock, flags);
+ 
+diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c
+index 8044510d8ec6..d0d195bc3436 100644
+--- a/drivers/staging/android/ashmem.c
++++ b/drivers/staging/android/ashmem.c
+@@ -95,6 +95,15 @@ static DEFINE_MUTEX(ashmem_mutex);
+ static struct kmem_cache *ashmem_area_cachep __read_mostly;
+ static struct kmem_cache *ashmem_range_cachep __read_mostly;
+ 
++/*
++ * A separate lockdep class for the backing shmem inodes to resolve the lockdep
++ * warning about the race between kswapd taking fs_reclaim before inode_lock
++ * and write syscall taking inode_lock and then fs_reclaim.
++ * Note that such race is impossible because ashmem does not support write
++ * syscalls operating on the backing shmem.
++ */
++static struct lock_class_key backing_shmem_inode_class;
++
+ static inline unsigned long range_size(struct ashmem_range *range)
+ {
+ 	return range->pgend - range->pgstart + 1;
+@@ -396,6 +405,7 @@ static int ashmem_mmap(struct file *file, struct vm_area_struct *vma)
+ 	if (!asma->file) {
+ 		char *name = ASHMEM_NAME_DEF;
+ 		struct file *vmfile;
++		struct inode *inode;
+ 
+ 		if (asma->name[ASHMEM_NAME_PREFIX_LEN] != '\0')
+ 			name = asma->name;
+@@ -407,6 +417,8 @@ static int ashmem_mmap(struct file *file, struct vm_area_struct *vma)
+ 			goto out;
+ 		}
+ 		vmfile->f_mode |= FMODE_LSEEK;
++		inode = file_inode(vmfile);
++		lockdep_set_class(&inode->i_rwsem, &backing_shmem_inode_class);
+ 		asma->file = vmfile;
+ 		/*
+ 		 * override mmap operation of the vmfile so that it can't be
+diff --git a/drivers/staging/rtl8188eu/core/rtw_mlme.c b/drivers/staging/rtl8188eu/core/rtw_mlme.c
+index 9de2d421f6b1..4f2abe1e14d5 100644
+--- a/drivers/staging/rtl8188eu/core/rtw_mlme.c
++++ b/drivers/staging/rtl8188eu/core/rtw_mlme.c
+@@ -1729,9 +1729,11 @@ int rtw_restruct_sec_ie(struct adapter *adapter, u8 *in_ie, u8 *out_ie, uint in_
+ 	if ((ndisauthmode == Ndis802_11AuthModeWPA) ||
+ 	    (ndisauthmode == Ndis802_11AuthModeWPAPSK))
+ 		authmode = _WPA_IE_ID_;
+-	if ((ndisauthmode == Ndis802_11AuthModeWPA2) ||
++	else if ((ndisauthmode == Ndis802_11AuthModeWPA2) ||
+ 	    (ndisauthmode == Ndis802_11AuthModeWPA2PSK))
+ 		authmode = _WPA2_IE_ID_;
++	else
++		authmode = 0x0;
+ 
+ 	if (check_fwstate(pmlmepriv, WIFI_UNDER_WPS)) {
+ 		memcpy(out_ie + ielength, psecuritypriv->wps_ie, psecuritypriv->wps_ie_len);
+diff --git a/drivers/staging/rtl8712/hal_init.c b/drivers/staging/rtl8712/hal_init.c
+index 40145c0338e4..42c0a3c947f1 100644
+--- a/drivers/staging/rtl8712/hal_init.c
++++ b/drivers/staging/rtl8712/hal_init.c
+@@ -33,7 +33,6 @@ static void rtl871x_load_fw_cb(const struct firmware *firmware, void *context)
+ {
+ 	struct _adapter *adapter = context;
+ 
+-	complete(&adapter->rtl8712_fw_ready);
+ 	if (!firmware) {
+ 		struct usb_device *udev = adapter->dvobjpriv.pusbdev;
+ 		struct usb_interface *usb_intf = adapter->pusb_intf;
+@@ -41,11 +40,13 @@ static void rtl871x_load_fw_cb(const struct firmware *firmware, void *context)
+ 		dev_err(&udev->dev, "r8712u: Firmware request failed\n");
+ 		usb_put_dev(udev);
+ 		usb_set_intfdata(usb_intf, NULL);
++		complete(&adapter->rtl8712_fw_ready);
+ 		return;
+ 	}
+ 	adapter->fw = firmware;
+ 	/* firmware available - start netdev */
+ 	register_netdev(adapter->pnetdev);
++	complete(&adapter->rtl8712_fw_ready);
+ }
+ 
+ static const char firmware_file[] = "rtlwifi/rtl8712u.bin";
+diff --git a/drivers/staging/rtl8712/usb_intf.c b/drivers/staging/rtl8712/usb_intf.c
+index a87562f632a7..2fcd65260f4c 100644
+--- a/drivers/staging/rtl8712/usb_intf.c
++++ b/drivers/staging/rtl8712/usb_intf.c
+@@ -595,13 +595,17 @@ static void r871xu_dev_remove(struct usb_interface *pusb_intf)
+ 	if (pnetdev) {
+ 		struct _adapter *padapter = netdev_priv(pnetdev);
+ 
+-		usb_set_intfdata(pusb_intf, NULL);
+-		release_firmware(padapter->fw);
+ 		/* never exit with a firmware callback pending */
+ 		wait_for_completion(&padapter->rtl8712_fw_ready);
++		pnetdev = usb_get_intfdata(pusb_intf);
++		usb_set_intfdata(pusb_intf, NULL);
++		if (!pnetdev)
++			goto firmware_load_fail;
++		release_firmware(padapter->fw);
+ 		if (drvpriv.drv_registered)
+ 			padapter->surprise_removed = true;
+-		unregister_netdev(pnetdev); /* will call netdev_close() */
++		if (pnetdev->reg_state != NETREG_UNINITIALIZED)
++			unregister_netdev(pnetdev); /* will call netdev_close() */
+ 		flush_scheduled_work();
+ 		udelay(1);
+ 		/* Stop driver mlme relation timer */
+@@ -614,6 +618,7 @@ static void r871xu_dev_remove(struct usb_interface *pusb_intf)
+ 		 */
+ 		usb_put_dev(udev);
+ 	}
++firmware_load_fail:
+ 	/* If we didn't unplug usb dongle and remove/insert module, driver
+ 	 * fails on sitesurvey for the first time when device is up.
+ 	 * Reset usb port for sitesurvey fail issue.
+diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
+index 51251c1be059..040497de6e87 100644
+--- a/drivers/usb/host/xhci-pci.c
++++ b/drivers/usb/host/xhci-pci.c
+@@ -56,7 +56,10 @@
+ #define PCI_DEVICE_ID_AMD_PROMONTORYA_3			0x43ba
+ #define PCI_DEVICE_ID_AMD_PROMONTORYA_2			0x43bb
+ #define PCI_DEVICE_ID_AMD_PROMONTORYA_1			0x43bc
++#define PCI_DEVICE_ID_ASMEDIA_1042_XHCI			0x1042
+ #define PCI_DEVICE_ID_ASMEDIA_1042A_XHCI		0x1142
++#define PCI_DEVICE_ID_ASMEDIA_1142_XHCI			0x1242
++#define PCI_DEVICE_ID_ASMEDIA_2142_XHCI			0x2142
+ 
+ static const char hcd_name[] = "xhci_hcd";
+ 
+@@ -250,13 +253,14 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
+ 		xhci->quirks |= XHCI_LPM_SUPPORT;
+ 
+ 	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+-			pdev->device == 0x1042)
++		pdev->device == PCI_DEVICE_ID_ASMEDIA_1042_XHCI)
+ 		xhci->quirks |= XHCI_BROKEN_STREAMS;
+ 	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+-			pdev->device == 0x1142)
++		pdev->device == PCI_DEVICE_ID_ASMEDIA_1042A_XHCI)
+ 		xhci->quirks |= XHCI_TRUST_TX_LENGTH;
+ 	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+-			pdev->device == 0x2142)
++	    (pdev->device == PCI_DEVICE_ID_ASMEDIA_1142_XHCI ||
++	     pdev->device == PCI_DEVICE_ID_ASMEDIA_2142_XHCI))
+ 		xhci->quirks |= XHCI_NO_64BIT_SUPPORT;
+ 
+ 	if (pdev->vendor == PCI_VENDOR_ID_ASMEDIA &&
+diff --git a/drivers/usb/misc/iowarrior.c b/drivers/usb/misc/iowarrior.c
+index dce20301e367..103c69c692ba 100644
+--- a/drivers/usb/misc/iowarrior.c
++++ b/drivers/usb/misc/iowarrior.c
+@@ -2,8 +2,9 @@
+ /*
+  *  Native support for the I/O-Warrior USB devices
+  *
+- *  Copyright (c) 2003-2005  Code Mercenaries GmbH
+- *  written by Christian Lucht <lucht@codemercs.com>
++ *  Copyright (c) 2003-2005, 2020  Code Mercenaries GmbH
++ *  written by Christian Lucht <lucht@codemercs.com> and
++ *  Christoph Jung <jung@codemercs.com>
+  *
+  *  based on
+ 
+@@ -802,14 +803,28 @@ static int iowarrior_probe(struct usb_interface *interface,
+ 
+ 	/* we have to check the report_size often, so remember it in the endianness suitable for our machine */
+ 	dev->report_size = usb_endpoint_maxp(dev->int_in_endpoint);
+-	if ((dev->interface->cur_altsetting->desc.bInterfaceNumber == 0) &&
+-	    ((dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56) ||
+-	     (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW56AM) ||
+-	     (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW28) ||
+-	     (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW28L) ||
+-	     (dev->product_id == USB_DEVICE_ID_CODEMERCS_IOW100)))
+-		/* IOWarrior56 has wMaxPacketSize different from report size */
+-		dev->report_size = 7;
++
++	/*
++	 * Some devices need the report size to be different than the
++	 * endpoint size.
++	 */
++	if (dev->interface->cur_altsetting->desc.bInterfaceNumber == 0) {
++		switch (dev->product_id) {
++		case USB_DEVICE_ID_CODEMERCS_IOW56:
++		case USB_DEVICE_ID_CODEMERCS_IOW56AM:
++			dev->report_size = 7;
++			break;
++
++		case USB_DEVICE_ID_CODEMERCS_IOW28:
++		case USB_DEVICE_ID_CODEMERCS_IOW28L:
++			dev->report_size = 4;
++			break;
++
++		case USB_DEVICE_ID_CODEMERCS_IOW100:
++			dev->report_size = 13;
++			break;
++		}
++	}
+ 
+ 	/* create the urb and buffer for reading */
+ 	dev->int_in_urb = usb_alloc_urb(0, GFP_KERNEL);
+diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
+index d147feae83e6..0f60363c1bbc 100644
+--- a/drivers/usb/serial/qcserial.c
++++ b/drivers/usb/serial/qcserial.c
+@@ -155,6 +155,7 @@ static const struct usb_device_id id_table[] = {
+ 	{DEVICE_SWI(0x1199, 0x9056)},	/* Sierra Wireless Modem */
+ 	{DEVICE_SWI(0x1199, 0x9060)},	/* Sierra Wireless Modem */
+ 	{DEVICE_SWI(0x1199, 0x9061)},	/* Sierra Wireless Modem */
++	{DEVICE_SWI(0x1199, 0x9062)},	/* Sierra Wireless EM7305 QDL */
+ 	{DEVICE_SWI(0x1199, 0x9063)},	/* Sierra Wireless EM7305 */
+ 	{DEVICE_SWI(0x1199, 0x9070)},	/* Sierra Wireless MC74xx */
+ 	{DEVICE_SWI(0x1199, 0x9071)},	/* Sierra Wireless MC74xx */
+diff --git a/drivers/video/console/vgacon.c b/drivers/video/console/vgacon.c
+index 998b0de1812f..e9254b3085a3 100644
+--- a/drivers/video/console/vgacon.c
++++ b/drivers/video/console/vgacon.c
+@@ -251,6 +251,10 @@ static void vgacon_scrollback_update(struct vc_data *c, int t, int count)
+ 	p = (void *) (c->vc_origin + t * c->vc_size_row);
+ 
+ 	while (count--) {
++		if ((vgacon_scrollback_cur->tail + c->vc_size_row) >
++		    vgacon_scrollback_cur->size)
++			vgacon_scrollback_cur->tail = 0;
++
+ 		scr_memcpyw(vgacon_scrollback_cur->data +
+ 			    vgacon_scrollback_cur->tail,
+ 			    p, c->vc_size_row);
+diff --git a/drivers/video/fbdev/omap2/omapfb/dss/dss.c b/drivers/video/fbdev/omap2/omapfb/dss/dss.c
+index 7252d22dd117..bfc5c4c5a26a 100644
+--- a/drivers/video/fbdev/omap2/omapfb/dss/dss.c
++++ b/drivers/video/fbdev/omap2/omapfb/dss/dss.c
+@@ -833,7 +833,7 @@ static const struct dss_features omap34xx_dss_feats = {
+ };
+ 
+ static const struct dss_features omap3630_dss_feats = {
+-	.fck_div_max		=	32,
++	.fck_div_max		=	31,
+ 	.dss_fck_multiplier	=	1,
+ 	.parent_clk_name	=	"dpll4_ck",
+ 	.dpi_select_source	=	&dss_dpi_select_source_omap2_omap3,
+diff --git a/fs/io_uring.c b/fs/io_uring.c
+index 4e09af1d5d22..fb9dc865c9ea 100644
+--- a/fs/io_uring.c
++++ b/fs/io_uring.c
+@@ -4260,10 +4260,9 @@ static void io_poll_task_handler(struct io_kiocb *req, struct io_kiocb **nxt)
+ 
+ 	hash_del(&req->hash_node);
+ 	io_poll_complete(req, req->result, 0);
+-	req->flags |= REQ_F_COMP_LOCKED;
+-	io_put_req_find_next(req, nxt);
+ 	spin_unlock_irq(&ctx->completion_lock);
+ 
++	io_put_req_find_next(req, nxt);
+ 	io_cqring_ev_posted(ctx);
+ }
+ 
+diff --git a/fs/xattr.c b/fs/xattr.c
+index 91608d9bfc6a..95f38f57347f 100644
+--- a/fs/xattr.c
++++ b/fs/xattr.c
+@@ -204,10 +204,22 @@ int __vfs_setxattr_noperm(struct dentry *dentry, const char *name,
+ 	return error;
+ }
+ 
+-
++/**
++ * __vfs_setxattr_locked: set an extended attribute while holding the inode
++ * lock
++ *
++ *  @dentry - object to perform setxattr on
++ *  @name - xattr name to set
++ *  @value - value to set @name to
++ *  @size - size of @value
++ *  @flags - flags to pass into filesystem operations
++ *  @delegated_inode - on return, will contain an inode pointer that
++ *  a delegation was broken on, NULL if none.
++ */
+ int
+-vfs_setxattr(struct dentry *dentry, const char *name, const void *value,
+-		size_t size, int flags)
++__vfs_setxattr_locked(struct dentry *dentry, const char *name,
++		const void *value, size_t size, int flags,
++		struct inode **delegated_inode)
+ {
+ 	struct inode *inode = dentry->d_inode;
+ 	int error;
+@@ -216,15 +228,40 @@ vfs_setxattr(struct dentry *dentry, const char *name, const void *value,
+ 	if (error)
+ 		return error;
+ 
+-	inode_lock(inode);
+ 	error = security_inode_setxattr(dentry, name, value, size, flags);
+ 	if (error)
+ 		goto out;
+ 
++	error = try_break_deleg(inode, delegated_inode);
++	if (error)
++		goto out;
++
+ 	error = __vfs_setxattr_noperm(dentry, name, value, size, flags);
+ 
+ out:
++	return error;
++}
++EXPORT_SYMBOL_GPL(__vfs_setxattr_locked);
++
++int
++vfs_setxattr(struct dentry *dentry, const char *name, const void *value,
++		size_t size, int flags)
++{
++	struct inode *inode = dentry->d_inode;
++	struct inode *delegated_inode = NULL;
++	int error;
++
++retry_deleg:
++	inode_lock(inode);
++	error = __vfs_setxattr_locked(dentry, name, value, size, flags,
++	    &delegated_inode);
+ 	inode_unlock(inode);
++
++	if (delegated_inode) {
++		error = break_deleg_wait(&delegated_inode);
++		if (!error)
++			goto retry_deleg;
++	}
+ 	return error;
+ }
+ EXPORT_SYMBOL_GPL(vfs_setxattr);
+@@ -378,8 +415,18 @@ __vfs_removexattr(struct dentry *dentry, const char *name)
+ }
+ EXPORT_SYMBOL(__vfs_removexattr);
+ 
++/**
++ * __vfs_removexattr_locked: set an extended attribute while holding the inode
++ * lock
++ *
++ *  @dentry - object to perform setxattr on
++ *  @name - name of xattr to remove
++ *  @delegated_inode - on return, will contain an inode pointer that
++ *  a delegation was broken on, NULL if none.
++ */
+ int
+-vfs_removexattr(struct dentry *dentry, const char *name)
++__vfs_removexattr_locked(struct dentry *dentry, const char *name,
++		struct inode **delegated_inode)
+ {
+ 	struct inode *inode = dentry->d_inode;
+ 	int error;
+@@ -388,11 +435,14 @@ vfs_removexattr(struct dentry *dentry, const char *name)
+ 	if (error)
+ 		return error;
+ 
+-	inode_lock(inode);
+ 	error = security_inode_removexattr(dentry, name);
+ 	if (error)
+ 		goto out;
+ 
++	error = try_break_deleg(inode, delegated_inode);
++	if (error)
++		goto out;
++
+ 	error = __vfs_removexattr(dentry, name);
+ 
+ 	if (!error) {
+@@ -401,12 +451,32 @@ vfs_removexattr(struct dentry *dentry, const char *name)
+ 	}
+ 
+ out:
++	return error;
++}
++EXPORT_SYMBOL_GPL(__vfs_removexattr_locked);
++
++int
++vfs_removexattr(struct dentry *dentry, const char *name)
++{
++	struct inode *inode = dentry->d_inode;
++	struct inode *delegated_inode = NULL;
++	int error;
++
++retry_deleg:
++	inode_lock(inode);
++	error = __vfs_removexattr_locked(dentry, name, &delegated_inode);
+ 	inode_unlock(inode);
++
++	if (delegated_inode) {
++		error = break_deleg_wait(&delegated_inode);
++		if (!error)
++			goto retry_deleg;
++	}
++
+ 	return error;
+ }
+ EXPORT_SYMBOL_GPL(vfs_removexattr);
+ 
+-
+ /*
+  * Extended attribute SET operations
+  */
+diff --git a/include/drm/drm_mode_config.h b/include/drm/drm_mode_config.h
+index 3bcbe30339f0..198b9d060008 100644
+--- a/include/drm/drm_mode_config.h
++++ b/include/drm/drm_mode_config.h
+@@ -865,6 +865,18 @@ struct drm_mode_config {
+ 	 */
+ 	bool prefer_shadow_fbdev;
+ 
++	/**
++	 * @fbdev_use_iomem:
++	 *
++	 * Set to true if framebuffer reside in iomem.
++	 * When set to true memcpy_toio() is used when copying the framebuffer in
++	 * drm_fb_helper.drm_fb_helper_dirty_blit_real().
++	 *
++	 * FIXME: This should be replaced with a per-mapping is_iomem
++	 * flag (like ttm does), and then used everywhere in fbdev code.
++	 */
++	bool fbdev_use_iomem;
++
+ 	/**
+ 	 * @quirk_addfb_prefer_xbgr_30bpp:
+ 	 *
+diff --git a/include/linux/rhashtable.h b/include/linux/rhashtable.h
+index e3def7bbe932..83ad875a7ea2 100644
+--- a/include/linux/rhashtable.h
++++ b/include/linux/rhashtable.h
+@@ -84,7 +84,7 @@ struct bucket_table {
+ 
+ 	struct lockdep_map	dep_map;
+ 
+-	struct rhash_lock_head *buckets[] ____cacheline_aligned_in_smp;
++	struct rhash_lock_head __rcu *buckets[] ____cacheline_aligned_in_smp;
+ };
+ 
+ /*
+@@ -261,13 +261,12 @@ void rhashtable_free_and_destroy(struct rhashtable *ht,
+ 				 void *arg);
+ void rhashtable_destroy(struct rhashtable *ht);
+ 
+-struct rhash_lock_head **rht_bucket_nested(const struct bucket_table *tbl,
+-					   unsigned int hash);
+-struct rhash_lock_head **__rht_bucket_nested(const struct bucket_table *tbl,
+-					     unsigned int hash);
+-struct rhash_lock_head **rht_bucket_nested_insert(struct rhashtable *ht,
+-						  struct bucket_table *tbl,
+-						  unsigned int hash);
++struct rhash_lock_head __rcu **rht_bucket_nested(
++	const struct bucket_table *tbl, unsigned int hash);
++struct rhash_lock_head __rcu **__rht_bucket_nested(
++	const struct bucket_table *tbl, unsigned int hash);
++struct rhash_lock_head __rcu **rht_bucket_nested_insert(
++	struct rhashtable *ht, struct bucket_table *tbl, unsigned int hash);
+ 
+ #define rht_dereference(p, ht) \
+ 	rcu_dereference_protected(p, lockdep_rht_mutex_is_held(ht))
+@@ -284,21 +283,21 @@ struct rhash_lock_head **rht_bucket_nested_insert(struct rhashtable *ht,
+ #define rht_entry(tpos, pos, member) \
+ 	({ tpos = container_of(pos, typeof(*tpos), member); 1; })
+ 
+-static inline struct rhash_lock_head *const *rht_bucket(
++static inline struct rhash_lock_head __rcu *const *rht_bucket(
+ 	const struct bucket_table *tbl, unsigned int hash)
+ {
+ 	return unlikely(tbl->nest) ? rht_bucket_nested(tbl, hash) :
+ 				     &tbl->buckets[hash];
+ }
+ 
+-static inline struct rhash_lock_head **rht_bucket_var(
++static inline struct rhash_lock_head __rcu **rht_bucket_var(
+ 	struct bucket_table *tbl, unsigned int hash)
+ {
+ 	return unlikely(tbl->nest) ? __rht_bucket_nested(tbl, hash) :
+ 				     &tbl->buckets[hash];
+ }
+ 
+-static inline struct rhash_lock_head **rht_bucket_insert(
++static inline struct rhash_lock_head __rcu **rht_bucket_insert(
+ 	struct rhashtable *ht, struct bucket_table *tbl, unsigned int hash)
+ {
+ 	return unlikely(tbl->nest) ? rht_bucket_nested_insert(ht, tbl, hash) :
+@@ -325,7 +324,7 @@ static inline struct rhash_lock_head **rht_bucket_insert(
+  */
+ 
+ static inline void rht_lock(struct bucket_table *tbl,
+-			    struct rhash_lock_head **bkt)
++			    struct rhash_lock_head __rcu **bkt)
+ {
+ 	local_bh_disable();
+ 	bit_spin_lock(0, (unsigned long *)bkt);
+@@ -333,7 +332,7 @@ static inline void rht_lock(struct bucket_table *tbl,
+ }
+ 
+ static inline void rht_lock_nested(struct bucket_table *tbl,
+-				   struct rhash_lock_head **bucket,
++				   struct rhash_lock_head __rcu **bucket,
+ 				   unsigned int subclass)
+ {
+ 	local_bh_disable();
+@@ -342,7 +341,7 @@ static inline void rht_lock_nested(struct bucket_table *tbl,
+ }
+ 
+ static inline void rht_unlock(struct bucket_table *tbl,
+-			      struct rhash_lock_head **bkt)
++			      struct rhash_lock_head __rcu **bkt)
+ {
+ 	lock_map_release(&tbl->dep_map);
+ 	bit_spin_unlock(0, (unsigned long *)bkt);
+@@ -365,48 +364,41 @@ static inline struct rhash_head *__rht_ptr(
+  *            access is guaranteed, such as when destroying the table.
+  */
+ static inline struct rhash_head *rht_ptr_rcu(
+-	struct rhash_lock_head *const *p)
++	struct rhash_lock_head __rcu *const *bkt)
+ {
+-	struct rhash_lock_head __rcu *const *bkt = (void *)p;
+ 	return __rht_ptr(rcu_dereference(*bkt), bkt);
+ }
+ 
+ static inline struct rhash_head *rht_ptr(
+-	struct rhash_lock_head *const *p,
++	struct rhash_lock_head __rcu *const *bkt,
+ 	struct bucket_table *tbl,
+ 	unsigned int hash)
+ {
+-	struct rhash_lock_head __rcu *const *bkt = (void *)p;
+ 	return __rht_ptr(rht_dereference_bucket(*bkt, tbl, hash), bkt);
+ }
+ 
+ static inline struct rhash_head *rht_ptr_exclusive(
+-	struct rhash_lock_head *const *p)
++	struct rhash_lock_head __rcu *const *bkt)
+ {
+-	struct rhash_lock_head __rcu *const *bkt = (void *)p;
+ 	return __rht_ptr(rcu_dereference_protected(*bkt, 1), bkt);
+ }
+ 
+-static inline void rht_assign_locked(struct rhash_lock_head **bkt,
++static inline void rht_assign_locked(struct rhash_lock_head __rcu **bkt,
+ 				     struct rhash_head *obj)
+ {
+-	struct rhash_head __rcu **p = (struct rhash_head __rcu **)bkt;
+-
+ 	if (rht_is_a_nulls(obj))
+ 		obj = NULL;
+-	rcu_assign_pointer(*p, (void *)((unsigned long)obj | BIT(0)));
++	rcu_assign_pointer(*bkt, (void *)((unsigned long)obj | BIT(0)));
+ }
+ 
+ static inline void rht_assign_unlock(struct bucket_table *tbl,
+-				     struct rhash_lock_head **bkt,
++				     struct rhash_lock_head __rcu **bkt,
+ 				     struct rhash_head *obj)
+ {
+-	struct rhash_head __rcu **p = (struct rhash_head __rcu **)bkt;
+-
+ 	if (rht_is_a_nulls(obj))
+ 		obj = NULL;
+ 	lock_map_release(&tbl->dep_map);
+-	rcu_assign_pointer(*p, obj);
++	rcu_assign_pointer(*bkt, (void *)obj);
+ 	preempt_enable();
+ 	__release(bitlock);
+ 	local_bh_enable();
+@@ -594,7 +586,7 @@ static inline struct rhash_head *__rhashtable_lookup(
+ 		.ht = ht,
+ 		.key = key,
+ 	};
+-	struct rhash_lock_head *const *bkt;
++	struct rhash_lock_head __rcu *const *bkt;
+ 	struct bucket_table *tbl;
+ 	struct rhash_head *he;
+ 	unsigned int hash;
+@@ -710,7 +702,7 @@ static inline void *__rhashtable_insert_fast(
+ 		.ht = ht,
+ 		.key = key,
+ 	};
+-	struct rhash_lock_head **bkt;
++	struct rhash_lock_head __rcu **bkt;
+ 	struct rhash_head __rcu **pprev;
+ 	struct bucket_table *tbl;
+ 	struct rhash_head *head;
+@@ -996,7 +988,7 @@ static inline int __rhashtable_remove_fast_one(
+ 	struct rhash_head *obj, const struct rhashtable_params params,
+ 	bool rhlist)
+ {
+-	struct rhash_lock_head **bkt;
++	struct rhash_lock_head __rcu **bkt;
+ 	struct rhash_head __rcu **pprev;
+ 	struct rhash_head *he;
+ 	unsigned int hash;
+@@ -1148,7 +1140,7 @@ static inline int __rhashtable_replace_fast(
+ 	struct rhash_head *obj_old, struct rhash_head *obj_new,
+ 	const struct rhashtable_params params)
+ {
+-	struct rhash_lock_head **bkt;
++	struct rhash_lock_head __rcu **bkt;
+ 	struct rhash_head __rcu **pprev;
+ 	struct rhash_head *he;
+ 	unsigned int hash;
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index 7e737a94bc63..7f348591647a 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -283,6 +283,7 @@ struct nf_bridge_info {
+  */
+ struct tc_skb_ext {
+ 	__u32 chain;
++	__u16 mru;
+ };
+ #endif
+ 
+diff --git a/include/linux/xattr.h b/include/linux/xattr.h
+index c5afaf8ca7a2..902b740b6cac 100644
+--- a/include/linux/xattr.h
++++ b/include/linux/xattr.h
+@@ -52,8 +52,10 @@ ssize_t vfs_getxattr(struct dentry *, const char *, void *, size_t);
+ ssize_t vfs_listxattr(struct dentry *d, char *list, size_t size);
+ int __vfs_setxattr(struct dentry *, struct inode *, const char *, const void *, size_t, int);
+ int __vfs_setxattr_noperm(struct dentry *, const char *, const void *, size_t, int);
++int __vfs_setxattr_locked(struct dentry *, const char *, const void *, size_t, int, struct inode **);
+ int vfs_setxattr(struct dentry *, const char *, const void *, size_t, int);
+ int __vfs_removexattr(struct dentry *, const char *);
++int __vfs_removexattr_locked(struct dentry *, const char *, struct inode **);
+ int vfs_removexattr(struct dentry *, const char *);
+ 
+ ssize_t generic_listxattr(struct dentry *dentry, char *buffer, size_t buffer_size);
+diff --git a/include/net/addrconf.h b/include/net/addrconf.h
+index e0eabe58aa8b..d9c76c6d8f72 100644
+--- a/include/net/addrconf.h
++++ b/include/net/addrconf.h
+@@ -276,6 +276,7 @@ int ipv6_sock_ac_join(struct sock *sk, int ifindex,
+ 		      const struct in6_addr *addr);
+ int ipv6_sock_ac_drop(struct sock *sk, int ifindex,
+ 		      const struct in6_addr *addr);
++void __ipv6_sock_ac_close(struct sock *sk);
+ void ipv6_sock_ac_close(struct sock *sk);
+ 
+ int __ipv6_dev_ac_inc(struct inet6_dev *idev, const struct in6_addr *addr);
+diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
+index 8428aa614265..f6bcd3960ba8 100644
+--- a/include/net/sch_generic.h
++++ b/include/net/sch_generic.h
+@@ -380,6 +380,7 @@ struct qdisc_skb_cb {
+ 	};
+ #define QDISC_CB_PRIV_LEN 20
+ 	unsigned char		data[QDISC_CB_PRIV_LEN];
++	u16			mru;
+ };
+ 
+ typedef void tcf_chain_head_change_t(struct tcf_proto *tp_head, void *priv);
+@@ -459,7 +460,7 @@ static inline void qdisc_cb_private_validate(const struct sk_buff *skb, int sz)
+ {
+ 	struct qdisc_skb_cb *qcb;
+ 
+-	BUILD_BUG_ON(sizeof(skb->cb) < offsetof(struct qdisc_skb_cb, data) + sz);
++	BUILD_BUG_ON(sizeof(skb->cb) < sizeof(*qcb));
+ 	BUILD_BUG_ON(sizeof(qcb->data) < sz);
+ }
+ 
+diff --git a/kernel/bpf/btf.c b/kernel/bpf/btf.c
+index d1f5d428c9fe..6cafc596631c 100644
+--- a/kernel/bpf/btf.c
++++ b/kernel/bpf/btf.c
+@@ -4011,6 +4011,11 @@ static int __btf_resolve_helper_id(struct bpf_verifier_log *log, void *fn,
+ 	const char *tname, *sym;
+ 	u32 btf_id, i;
+ 
++	if (!btf_vmlinux) {
++		bpf_log(log, "btf_vmlinux doesn't exist\n");
++		return -EINVAL;
++	}
++
+ 	if (IS_ERR(btf_vmlinux)) {
+ 		bpf_log(log, "btf_vmlinux is malformed\n");
+ 		return -EINVAL;
+diff --git a/lib/rhashtable.c b/lib/rhashtable.c
+index bdb7e4cadf05..da531dacb496 100644
+--- a/lib/rhashtable.c
++++ b/lib/rhashtable.c
+@@ -31,7 +31,7 @@
+ 
+ union nested_table {
+ 	union nested_table __rcu *table;
+-	struct rhash_lock_head *bucket;
++	struct rhash_lock_head __rcu *bucket;
+ };
+ 
+ static u32 head_hashfn(struct rhashtable *ht,
+@@ -213,7 +213,7 @@ static struct bucket_table *rhashtable_last_table(struct rhashtable *ht,
+ }
+ 
+ static int rhashtable_rehash_one(struct rhashtable *ht,
+-				 struct rhash_lock_head **bkt,
++				 struct rhash_lock_head __rcu **bkt,
+ 				 unsigned int old_hash)
+ {
+ 	struct bucket_table *old_tbl = rht_dereference(ht->tbl, ht);
+@@ -266,7 +266,7 @@ static int rhashtable_rehash_chain(struct rhashtable *ht,
+ 				    unsigned int old_hash)
+ {
+ 	struct bucket_table *old_tbl = rht_dereference(ht->tbl, ht);
+-	struct rhash_lock_head **bkt = rht_bucket_var(old_tbl, old_hash);
++	struct rhash_lock_head __rcu **bkt = rht_bucket_var(old_tbl, old_hash);
+ 	int err;
+ 
+ 	if (!bkt)
+@@ -476,7 +476,7 @@ fail:
+ }
+ 
+ static void *rhashtable_lookup_one(struct rhashtable *ht,
+-				   struct rhash_lock_head **bkt,
++				   struct rhash_lock_head __rcu **bkt,
+ 				   struct bucket_table *tbl, unsigned int hash,
+ 				   const void *key, struct rhash_head *obj)
+ {
+@@ -526,12 +526,10 @@ static void *rhashtable_lookup_one(struct rhashtable *ht,
+ 	return ERR_PTR(-ENOENT);
+ }
+ 
+-static struct bucket_table *rhashtable_insert_one(struct rhashtable *ht,
+-						  struct rhash_lock_head **bkt,
+-						  struct bucket_table *tbl,
+-						  unsigned int hash,
+-						  struct rhash_head *obj,
+-						  void *data)
++static struct bucket_table *rhashtable_insert_one(
++	struct rhashtable *ht, struct rhash_lock_head __rcu **bkt,
++	struct bucket_table *tbl, unsigned int hash, struct rhash_head *obj,
++	void *data)
+ {
+ 	struct bucket_table *new_tbl;
+ 	struct rhash_head *head;
+@@ -582,7 +580,7 @@ static void *rhashtable_try_insert(struct rhashtable *ht, const void *key,
+ {
+ 	struct bucket_table *new_tbl;
+ 	struct bucket_table *tbl;
+-	struct rhash_lock_head **bkt;
++	struct rhash_lock_head __rcu **bkt;
+ 	unsigned int hash;
+ 	void *data;
+ 
+@@ -1164,8 +1162,8 @@ void rhashtable_destroy(struct rhashtable *ht)
+ }
+ EXPORT_SYMBOL_GPL(rhashtable_destroy);
+ 
+-struct rhash_lock_head **__rht_bucket_nested(const struct bucket_table *tbl,
+-					     unsigned int hash)
++struct rhash_lock_head __rcu **__rht_bucket_nested(
++	const struct bucket_table *tbl, unsigned int hash)
+ {
+ 	const unsigned int shift = PAGE_SHIFT - ilog2(sizeof(void *));
+ 	unsigned int index = hash & ((1 << tbl->nest) - 1);
+@@ -1193,10 +1191,10 @@ struct rhash_lock_head **__rht_bucket_nested(const struct bucket_table *tbl,
+ }
+ EXPORT_SYMBOL_GPL(__rht_bucket_nested);
+ 
+-struct rhash_lock_head **rht_bucket_nested(const struct bucket_table *tbl,
+-					   unsigned int hash)
++struct rhash_lock_head __rcu **rht_bucket_nested(
++	const struct bucket_table *tbl, unsigned int hash)
+ {
+-	static struct rhash_lock_head *rhnull;
++	static struct rhash_lock_head __rcu *rhnull;
+ 
+ 	if (!rhnull)
+ 		INIT_RHT_NULLS_HEAD(rhnull);
+@@ -1204,9 +1202,8 @@ struct rhash_lock_head **rht_bucket_nested(const struct bucket_table *tbl,
+ }
+ EXPORT_SYMBOL_GPL(rht_bucket_nested);
+ 
+-struct rhash_lock_head **rht_bucket_nested_insert(struct rhashtable *ht,
+-						  struct bucket_table *tbl,
+-						  unsigned int hash)
++struct rhash_lock_head __rcu **rht_bucket_nested_insert(
++	struct rhashtable *ht, struct bucket_table *tbl, unsigned int hash)
+ {
+ 	const unsigned int shift = PAGE_SHIFT - ilog2(sizeof(void *));
+ 	unsigned int index = hash & ((1 << tbl->nest) - 1);
+diff --git a/net/9p/trans_fd.c b/net/9p/trans_fd.c
+index 3f67803123be..12ecacf0c55f 100644
+--- a/net/9p/trans_fd.c
++++ b/net/9p/trans_fd.c
+@@ -816,20 +816,28 @@ static int p9_fd_open(struct p9_client *client, int rfd, int wfd)
+ 		return -ENOMEM;
+ 
+ 	ts->rd = fget(rfd);
++	if (!ts->rd)
++		goto out_free_ts;
++	if (!(ts->rd->f_mode & FMODE_READ))
++		goto out_put_rd;
+ 	ts->wr = fget(wfd);
+-	if (!ts->rd || !ts->wr) {
+-		if (ts->rd)
+-			fput(ts->rd);
+-		if (ts->wr)
+-			fput(ts->wr);
+-		kfree(ts);
+-		return -EIO;
+-	}
++	if (!ts->wr)
++		goto out_put_rd;
++	if (!(ts->wr->f_mode & FMODE_WRITE))
++		goto out_put_wr;
+ 
+ 	client->trans = ts;
+ 	client->status = Connected;
+ 
+ 	return 0;
++
++out_put_wr:
++	fput(ts->wr);
++out_put_rd:
++	fput(ts->rd);
++out_free_ts:
++	kfree(ts);
++	return -EIO;
+ }
+ 
+ static int p9_socket_open(struct p9_client *client, struct socket *csocket)
+diff --git a/net/appletalk/atalk_proc.c b/net/appletalk/atalk_proc.c
+index 550c6ca007cc..9c1241292d1d 100644
+--- a/net/appletalk/atalk_proc.c
++++ b/net/appletalk/atalk_proc.c
+@@ -229,6 +229,8 @@ int __init atalk_proc_init(void)
+ 				     sizeof(struct aarp_iter_state), NULL))
+ 		goto out;
+ 
++	return 0;
++
+ out:
+ 	remove_proc_subtree("atalk", init_net.proc_net);
+ 	return -ENOMEM;
+diff --git a/net/bluetooth/hci_event.c b/net/bluetooth/hci_event.c
+index fe75f435171c..2e481ee9fb52 100644
+--- a/net/bluetooth/hci_event.c
++++ b/net/bluetooth/hci_event.c
+@@ -2487,7 +2487,7 @@ static void hci_inquiry_result_evt(struct hci_dev *hdev, struct sk_buff *skb)
+ 
+ 	BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
+ 
+-	if (!num_rsp)
++	if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1)
+ 		return;
+ 
+ 	if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
+@@ -4143,6 +4143,9 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
+ 		struct inquiry_info_with_rssi_and_pscan_mode *info;
+ 		info = (void *) (skb->data + 1);
+ 
++		if (skb->len < num_rsp * sizeof(*info) + 1)
++			goto unlock;
++
+ 		for (; num_rsp; num_rsp--, info++) {
+ 			u32 flags;
+ 
+@@ -4164,6 +4167,9 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
+ 	} else {
+ 		struct inquiry_info_with_rssi *info = (void *) (skb->data + 1);
+ 
++		if (skb->len < num_rsp * sizeof(*info) + 1)
++			goto unlock;
++
+ 		for (; num_rsp; num_rsp--, info++) {
+ 			u32 flags;
+ 
+@@ -4184,6 +4190,7 @@ static void hci_inquiry_result_with_rssi_evt(struct hci_dev *hdev,
+ 		}
+ 	}
+ 
++unlock:
+ 	hci_dev_unlock(hdev);
+ }
+ 
+@@ -4346,7 +4353,7 @@ static void hci_extended_inquiry_result_evt(struct hci_dev *hdev,
+ 
+ 	BT_DBG("%s num_rsp %d", hdev->name, num_rsp);
+ 
+-	if (!num_rsp)
++	if (!num_rsp || skb->len < num_rsp * sizeof(*info) + 1)
+ 		return;
+ 
+ 	if (hci_dev_test_flag(hdev, HCI_PERIODIC_INQ))
+diff --git a/net/bridge/br_device.c b/net/bridge/br_device.c
+index 0e3dbc5f3c34..22a0b3173456 100644
+--- a/net/bridge/br_device.c
++++ b/net/bridge/br_device.c
+@@ -36,6 +36,8 @@ netdev_tx_t br_dev_xmit(struct sk_buff *skb, struct net_device *dev)
+ 	const unsigned char *dest;
+ 	u16 vid = 0;
+ 
++	memset(skb->cb, 0, sizeof(struct br_input_skb_cb));
++
+ 	rcu_read_lock();
+ 	nf_ops = rcu_dereference(nf_br_ops);
+ 	if (nf_ops && nf_ops->br_dev_xmit_hook(skb)) {
+diff --git a/net/core/devlink.c b/net/core/devlink.c
+index 899edcee7dab..8547da27ea47 100644
+--- a/net/core/devlink.c
++++ b/net/core/devlink.c
+@@ -1065,7 +1065,9 @@ static int devlink_nl_cmd_sb_pool_get_dumpit(struct sk_buff *msg,
+ 						   devlink_sb,
+ 						   NETLINK_CB(cb->skb).portid,
+ 						   cb->nlh->nlmsg_seq);
+-			if (err && err != -EOPNOTSUPP) {
++			if (err == -EOPNOTSUPP) {
++				err = 0;
++			} else if (err) {
+ 				mutex_unlock(&devlink->lock);
+ 				goto out;
+ 			}
+@@ -1266,7 +1268,9 @@ static int devlink_nl_cmd_sb_port_pool_get_dumpit(struct sk_buff *msg,
+ 							devlink, devlink_sb,
+ 							NETLINK_CB(cb->skb).portid,
+ 							cb->nlh->nlmsg_seq);
+-			if (err && err != -EOPNOTSUPP) {
++			if (err == -EOPNOTSUPP) {
++				err = 0;
++			} else if (err) {
+ 				mutex_unlock(&devlink->lock);
+ 				goto out;
+ 			}
+@@ -1498,7 +1502,9 @@ devlink_nl_cmd_sb_tc_pool_bind_get_dumpit(struct sk_buff *msg,
+ 							   devlink_sb,
+ 							   NETLINK_CB(cb->skb).portid,
+ 							   cb->nlh->nlmsg_seq);
+-			if (err && err != -EOPNOTSUPP) {
++			if (err == -EOPNOTSUPP) {
++				err = 0;
++			} else if (err) {
+ 				mutex_unlock(&devlink->lock);
+ 				goto out;
+ 			}
+@@ -3299,7 +3305,9 @@ static int devlink_nl_cmd_param_get_dumpit(struct sk_buff *msg,
+ 						    NETLINK_CB(cb->skb).portid,
+ 						    cb->nlh->nlmsg_seq,
+ 						    NLM_F_MULTI);
+-			if (err && err != -EOPNOTSUPP) {
++			if (err == -EOPNOTSUPP) {
++				err = 0;
++			} else if (err) {
+ 				mutex_unlock(&devlink->lock);
+ 				goto out;
+ 			}
+@@ -3569,7 +3577,9 @@ static int devlink_nl_cmd_port_param_get_dumpit(struct sk_buff *msg,
+ 						NETLINK_CB(cb->skb).portid,
+ 						cb->nlh->nlmsg_seq,
+ 						NLM_F_MULTI);
+-				if (err && err != -EOPNOTSUPP) {
++				if (err == -EOPNOTSUPP) {
++					err = 0;
++				} else if (err) {
+ 					mutex_unlock(&devlink->lock);
+ 					goto out;
+ 				}
+@@ -4479,7 +4489,9 @@ static int devlink_nl_cmd_info_get_dumpit(struct sk_buff *msg,
+ 					   cb->nlh->nlmsg_seq, NLM_F_MULTI,
+ 					   cb->extack);
+ 		mutex_unlock(&devlink->lock);
+-		if (err && err != -EOPNOTSUPP)
++		if (err == -EOPNOTSUPP)
++			err = 0;
++		else if (err)
+ 			break;
+ 		idx++;
+ 	}
+diff --git a/net/ipv4/fib_trie.c b/net/ipv4/fib_trie.c
+index 248f1c1959a6..3c65f71d0e82 100644
+--- a/net/ipv4/fib_trie.c
++++ b/net/ipv4/fib_trie.c
+@@ -1864,7 +1864,7 @@ struct fib_table *fib_trie_unmerge(struct fib_table *oldtb)
+ 	while ((l = leaf_walk_rcu(&tp, key)) != NULL) {
+ 		struct key_vector *local_l = NULL, *local_tp;
+ 
+-		hlist_for_each_entry_rcu(fa, &l->leaf, fa_list) {
++		hlist_for_each_entry(fa, &l->leaf, fa_list) {
+ 			struct fib_alias *new_fa;
+ 
+ 			if (local_tb->tb_id != fa->tb_id)
+diff --git a/net/ipv4/gre_offload.c b/net/ipv4/gre_offload.c
+index 2e6d1b7a7bc9..e0a246575887 100644
+--- a/net/ipv4/gre_offload.c
++++ b/net/ipv4/gre_offload.c
+@@ -15,12 +15,12 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
+ 				       netdev_features_t features)
+ {
+ 	int tnl_hlen = skb_inner_mac_header(skb) - skb_transport_header(skb);
++	bool need_csum, need_recompute_csum, gso_partial;
+ 	struct sk_buff *segs = ERR_PTR(-EINVAL);
+ 	u16 mac_offset = skb->mac_header;
+ 	__be16 protocol = skb->protocol;
+ 	u16 mac_len = skb->mac_len;
+ 	int gre_offset, outer_hlen;
+-	bool need_csum, gso_partial;
+ 
+ 	if (!skb->encapsulation)
+ 		goto out;
+@@ -41,6 +41,7 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
+ 	skb->protocol = skb->inner_protocol;
+ 
+ 	need_csum = !!(skb_shinfo(skb)->gso_type & SKB_GSO_GRE_CSUM);
++	need_recompute_csum = skb->csum_not_inet;
+ 	skb->encap_hdr_csum = need_csum;
+ 
+ 	features &= skb->dev->hw_enc_features;
+@@ -98,7 +99,15 @@ static struct sk_buff *gre_gso_segment(struct sk_buff *skb,
+ 		}
+ 
+ 		*(pcsum + 1) = 0;
+-		*pcsum = gso_make_checksum(skb, 0);
++		if (need_recompute_csum && !skb_is_gso(skb)) {
++			__wsum csum;
++
++			csum = skb_checksum(skb, gre_offset,
++					    skb->len - gre_offset, 0);
++			*pcsum = csum_fold(csum);
++		} else {
++			*pcsum = gso_make_checksum(skb, 0);
++		}
+ 	} while ((skb = skb->next));
+ out:
+ 	return segs;
+diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
+index 32ac66a8c657..afee982734be 100644
+--- a/net/ipv4/tcp_input.c
++++ b/net/ipv4/tcp_input.c
+@@ -2945,6 +2945,8 @@ static bool tcp_ack_update_rtt(struct sock *sk, const int flag,
+ 		u32 delta = tcp_time_stamp(tp) - tp->rx_opt.rcv_tsecr;
+ 
+ 		if (likely(delta < INT_MAX / (USEC_PER_SEC / TCP_TS_HZ))) {
++			if (!delta)
++				delta = 1;
+ 			seq_rtt_us = delta * (USEC_PER_SEC / TCP_TS_HZ);
+ 			ca_rtt_us = seq_rtt_us;
+ 		}
+diff --git a/net/ipv6/anycast.c b/net/ipv6/anycast.c
+index fed91ab7ec46..cf3a88a10ddd 100644
+--- a/net/ipv6/anycast.c
++++ b/net/ipv6/anycast.c
+@@ -183,7 +183,7 @@ int ipv6_sock_ac_drop(struct sock *sk, int ifindex, const struct in6_addr *addr)
+ 	return 0;
+ }
+ 
+-void ipv6_sock_ac_close(struct sock *sk)
++void __ipv6_sock_ac_close(struct sock *sk)
+ {
+ 	struct ipv6_pinfo *np = inet6_sk(sk);
+ 	struct net_device *dev = NULL;
+@@ -191,10 +191,7 @@ void ipv6_sock_ac_close(struct sock *sk)
+ 	struct net *net = sock_net(sk);
+ 	int	prev_index;
+ 
+-	if (!np->ipv6_ac_list)
+-		return;
+-
+-	rtnl_lock();
++	ASSERT_RTNL();
+ 	pac = np->ipv6_ac_list;
+ 	np->ipv6_ac_list = NULL;
+ 
+@@ -211,6 +208,16 @@ void ipv6_sock_ac_close(struct sock *sk)
+ 		sock_kfree_s(sk, pac, sizeof(*pac));
+ 		pac = next;
+ 	}
++}
++
++void ipv6_sock_ac_close(struct sock *sk)
++{
++	struct ipv6_pinfo *np = inet6_sk(sk);
++
++	if (!np->ipv6_ac_list)
++		return;
++	rtnl_lock();
++	__ipv6_sock_ac_close(sk);
+ 	rtnl_unlock();
+ }
+ 
+diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
+index ff187fd2083f..f99d1641f602 100644
+--- a/net/ipv6/ipv6_sockglue.c
++++ b/net/ipv6/ipv6_sockglue.c
+@@ -205,6 +205,7 @@ static int do_ipv6_setsockopt(struct sock *sk, int level, int optname,
+ 
+ 			fl6_free_socklist(sk);
+ 			__ipv6_sock_mc_close(sk);
++			__ipv6_sock_ac_close(sk);
+ 
+ 			/*
+ 			 * Sock is moving from IPv6 to IPv4 (sk_prot), so
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index e8a184acf668..de25836e4dde 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -3677,14 +3677,14 @@ static struct fib6_info *ip6_route_info_create(struct fib6_config *cfg,
+ 	rt->fib6_src.plen = cfg->fc_src_len;
+ #endif
+ 	if (nh) {
+-		if (!nexthop_get(nh)) {
+-			NL_SET_ERR_MSG(extack, "Nexthop has been deleted");
+-			goto out;
+-		}
+ 		if (rt->fib6_src.plen) {
+ 			NL_SET_ERR_MSG(extack, "Nexthops can not be used with source routing");
+ 			goto out;
+ 		}
++		if (!nexthop_get(nh)) {
++			NL_SET_ERR_MSG(extack, "Nexthop has been deleted");
++			goto out;
++		}
+ 		rt->nh = nh;
+ 		fib6_nh = nexthop_fib6_nh(rt->nh);
+ 	} else {
+diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
+index 4bf4f629975d..54e200b1b742 100644
+--- a/net/mptcp/protocol.c
++++ b/net/mptcp/protocol.c
+@@ -802,7 +802,6 @@ fallback:
+ 
+ 	mptcp_set_timeout(sk, ssk);
+ 	if (copied) {
+-		ret = copied;
+ 		tcp_push(ssk, msg->msg_flags, mss_now, tcp_sk(ssk)->nonagle,
+ 			 size_goal);
+ 
+@@ -815,7 +814,7 @@ fallback:
+ 	release_sock(ssk);
+ out:
+ 	release_sock(sk);
+-	return ret;
++	return copied ? : ret;
+ }
+ 
+ static void mptcp_wait_data(struct sock *sk, long *timeo)
+diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
+index 0112ead58fd8..bb6ccde6bf49 100644
+--- a/net/mptcp/subflow.c
++++ b/net/mptcp/subflow.c
+@@ -999,6 +999,12 @@ int mptcp_subflow_create_socket(struct sock *sk, struct socket **new_sock)
+ 	struct socket *sf;
+ 	int err;
+ 
++	/* un-accepted server sockets can reach here - on bad configuration
++	 * bail early to avoid greater trouble later
++	 */
++	if (unlikely(!sk->sk_socket))
++		return -EINVAL;
++
+ 	err = sock_create_kern(net, sk->sk_family, SOCK_STREAM, IPPROTO_TCP,
+ 			       &sf);
+ 	if (err)
+diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
+index 4340f25fe390..98d393e70de3 100644
+--- a/net/openvswitch/conntrack.c
++++ b/net/openvswitch/conntrack.c
+@@ -276,10 +276,6 @@ void ovs_ct_fill_key(const struct sk_buff *skb, struct sw_flow_key *key)
+ 	ovs_ct_update_key(skb, NULL, key, false, false);
+ }
+ 
+-#define IN6_ADDR_INITIALIZER(ADDR) \
+-	{ (ADDR).s6_addr32[0], (ADDR).s6_addr32[1], \
+-	  (ADDR).s6_addr32[2], (ADDR).s6_addr32[3] }
+-
+ int ovs_ct_put_key(const struct sw_flow_key *swkey,
+ 		   const struct sw_flow_key *output, struct sk_buff *skb)
+ {
+@@ -301,24 +297,30 @@ int ovs_ct_put_key(const struct sw_flow_key *swkey,
+ 
+ 	if (swkey->ct_orig_proto) {
+ 		if (swkey->eth.type == htons(ETH_P_IP)) {
+-			struct ovs_key_ct_tuple_ipv4 orig = {
+-				output->ipv4.ct_orig.src,
+-				output->ipv4.ct_orig.dst,
+-				output->ct.orig_tp.src,
+-				output->ct.orig_tp.dst,
+-				output->ct_orig_proto,
+-			};
++			struct ovs_key_ct_tuple_ipv4 orig;
++
++			memset(&orig, 0, sizeof(orig));
++			orig.ipv4_src = output->ipv4.ct_orig.src;
++			orig.ipv4_dst = output->ipv4.ct_orig.dst;
++			orig.src_port = output->ct.orig_tp.src;
++			orig.dst_port = output->ct.orig_tp.dst;
++			orig.ipv4_proto = output->ct_orig_proto;
++
+ 			if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV4,
+ 				    sizeof(orig), &orig))
+ 				return -EMSGSIZE;
+ 		} else if (swkey->eth.type == htons(ETH_P_IPV6)) {
+-			struct ovs_key_ct_tuple_ipv6 orig = {
+-				IN6_ADDR_INITIALIZER(output->ipv6.ct_orig.src),
+-				IN6_ADDR_INITIALIZER(output->ipv6.ct_orig.dst),
+-				output->ct.orig_tp.src,
+-				output->ct.orig_tp.dst,
+-				output->ct_orig_proto,
+-			};
++			struct ovs_key_ct_tuple_ipv6 orig;
++
++			memset(&orig, 0, sizeof(orig));
++			memcpy(orig.ipv6_src, output->ipv6.ct_orig.src.s6_addr32,
++			       sizeof(orig.ipv6_src));
++			memcpy(orig.ipv6_dst, output->ipv6.ct_orig.dst.s6_addr32,
++			       sizeof(orig.ipv6_dst));
++			orig.src_port = output->ct.orig_tp.src;
++			orig.dst_port = output->ct.orig_tp.dst;
++			orig.ipv6_proto = output->ct_orig_proto;
++
+ 			if (nla_put(skb, OVS_KEY_ATTR_CT_ORIG_TUPLE_IPV6,
+ 				    sizeof(orig), &orig))
+ 				return -EMSGSIZE;
+diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
+index 9d375e74b607..03942c30d83e 100644
+--- a/net/openvswitch/flow.c
++++ b/net/openvswitch/flow.c
+@@ -890,6 +890,7 @@ int ovs_flow_key_extract(const struct ip_tunnel_info *tun_info,
+ 	if (static_branch_unlikely(&tc_recirc_sharing_support)) {
+ 		tc_ext = skb_ext_find(skb, TC_SKB_EXT);
+ 		key->recirc_id = tc_ext ? tc_ext->chain : 0;
++		OVS_CB(skb)->mru = tc_ext ? tc_ext->mru : 0;
+ 	} else {
+ 		key->recirc_id = 0;
+ 	}
+diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c
+index f07970207b54..38a46167523f 100644
+--- a/net/rxrpc/call_object.c
++++ b/net/rxrpc/call_object.c
+@@ -288,7 +288,7 @@ struct rxrpc_call *rxrpc_new_client_call(struct rxrpc_sock *rx,
+ 	 */
+ 	ret = rxrpc_connect_call(rx, call, cp, srx, gfp);
+ 	if (ret < 0)
+-		goto error;
++		goto error_attached_to_socket;
+ 
+ 	trace_rxrpc_call(call->debug_id, rxrpc_call_connected,
+ 			 atomic_read(&call->usage), here, NULL);
+@@ -308,18 +308,29 @@ struct rxrpc_call *rxrpc_new_client_call(struct rxrpc_sock *rx,
+ error_dup_user_ID:
+ 	write_unlock(&rx->call_lock);
+ 	release_sock(&rx->sk);
+-	ret = -EEXIST;
+-
+-error:
+ 	__rxrpc_set_call_completion(call, RXRPC_CALL_LOCAL_ERROR,
+-				    RX_CALL_DEAD, ret);
++				    RX_CALL_DEAD, -EEXIST);
+ 	trace_rxrpc_call(call->debug_id, rxrpc_call_error,
+-			 atomic_read(&call->usage), here, ERR_PTR(ret));
++			 atomic_read(&call->usage), here, ERR_PTR(-EEXIST));
+ 	rxrpc_release_call(rx, call);
+ 	mutex_unlock(&call->user_mutex);
+ 	rxrpc_put_call(call, rxrpc_call_put);
+-	_leave(" = %d", ret);
+-	return ERR_PTR(ret);
++	_leave(" = -EEXIST");
++	return ERR_PTR(-EEXIST);
++
++	/* We got an error, but the call is attached to the socket and is in
++	 * need of release.  However, we might now race with recvmsg() when
++	 * completing the call queues it.  Return 0 from sys_sendmsg() and
++	 * leave the error to recvmsg() to deal with.
++	 */
++error_attached_to_socket:
++	trace_rxrpc_call(call->debug_id, rxrpc_call_error,
++			 atomic_read(&call->usage), here, ERR_PTR(ret));
++	set_bit(RXRPC_CALL_DISCONNECTED, &call->flags);
++	__rxrpc_set_call_completion(call, RXRPC_CALL_LOCAL_ERROR,
++				    RX_CALL_DEAD, ret);
++	_leave(" = c=%08x [err]", call->debug_id);
++	return call;
+ }
+ 
+ /*
+diff --git a/net/rxrpc/conn_object.c b/net/rxrpc/conn_object.c
+index 19e141eeed17..8cbe0bf20ed5 100644
+--- a/net/rxrpc/conn_object.c
++++ b/net/rxrpc/conn_object.c
+@@ -212,9 +212,11 @@ void rxrpc_disconnect_call(struct rxrpc_call *call)
+ 
+ 	call->peer->cong_cwnd = call->cong_cwnd;
+ 
+-	spin_lock_bh(&conn->params.peer->lock);
+-	hlist_del_rcu(&call->error_link);
+-	spin_unlock_bh(&conn->params.peer->lock);
++	if (!hlist_unhashed(&call->error_link)) {
++		spin_lock_bh(&call->peer->lock);
++		hlist_del_rcu(&call->error_link);
++		spin_unlock_bh(&call->peer->lock);
++	}
+ 
+ 	if (rxrpc_is_client_call(call))
+ 		return rxrpc_disconnect_client_call(call);
+diff --git a/net/rxrpc/recvmsg.c b/net/rxrpc/recvmsg.c
+index 6896a33ef842..4f48e3bdd4b4 100644
+--- a/net/rxrpc/recvmsg.c
++++ b/net/rxrpc/recvmsg.c
+@@ -541,7 +541,7 @@ try_again:
+ 			goto error_unlock_call;
+ 	}
+ 
+-	if (msg->msg_name) {
++	if (msg->msg_name && call->peer) {
+ 		struct sockaddr_rxrpc *srx = msg->msg_name;
+ 		size_t len = sizeof(call->peer->srx);
+ 
+diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
+index 49d03c8c64da..1a340eb0abf7 100644
+--- a/net/rxrpc/sendmsg.c
++++ b/net/rxrpc/sendmsg.c
+@@ -683,6 +683,9 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len)
+ 		if (IS_ERR(call))
+ 			return PTR_ERR(call);
+ 		/* ... and we have the call lock. */
++		ret = 0;
++		if (READ_ONCE(call->state) == RXRPC_CALL_COMPLETE)
++			goto out_put_unlock;
+ 	} else {
+ 		switch (READ_ONCE(call->state)) {
+ 		case RXRPC_CALL_UNINITIALISED:
+diff --git a/net/sched/act_ct.c b/net/sched/act_ct.c
+index e191f2728389..417526d7741b 100644
+--- a/net/sched/act_ct.c
++++ b/net/sched/act_ct.c
+@@ -704,8 +704,10 @@ static int tcf_ct_handle_fragments(struct net *net, struct sk_buff *skb,
+ 		if (err && err != -EINPROGRESS)
+ 			goto out_free;
+ 
+-		if (!err)
++		if (!err) {
+ 			*defrag = true;
++			cb.mru = IPCB(skb)->frag_max_size;
++		}
+ 	} else { /* NFPROTO_IPV6 */
+ #if IS_ENABLED(CONFIG_NF_DEFRAG_IPV6)
+ 		enum ip6_defrag_users user = IP6_DEFRAG_CONNTRACK_IN + zone;
+@@ -715,8 +717,10 @@ static int tcf_ct_handle_fragments(struct net *net, struct sk_buff *skb,
+ 		if (err && err != -EINPROGRESS)
+ 			goto out_free;
+ 
+-		if (!err)
++		if (!err) {
+ 			*defrag = true;
++			cb.mru = IP6CB(skb)->frag_max_size;
++		}
+ #else
+ 		err = -EOPNOTSUPP;
+ 		goto out_free;
+diff --git a/net/sched/cls_api.c b/net/sched/cls_api.c
+index 58d469a66896..2ef39483a8bb 100644
+--- a/net/sched/cls_api.c
++++ b/net/sched/cls_api.c
+@@ -1679,6 +1679,7 @@ int tcf_classify_ingress(struct sk_buff *skb,
+ 		if (WARN_ON_ONCE(!ext))
+ 			return TC_ACT_SHOT;
+ 		ext->chain = last_executed_chain;
++		ext->mru = qdisc_skb_cb(skb)->mru;
+ 	}
+ 
+ 	return ret;
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 7ae6b90e0d26..970f05c4150e 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -13190,13 +13190,13 @@ static int nl80211_vendor_cmd(struct sk_buff *skb, struct genl_info *info)
+ 				if (!wdev_running(wdev))
+ 					return -ENETDOWN;
+ 			}
+-
+-			if (!vcmd->doit)
+-				return -EOPNOTSUPP;
+ 		} else {
+ 			wdev = NULL;
+ 		}
+ 
++		if (!vcmd->doit)
++			return -EOPNOTSUPP;
++
+ 		if (info->attrs[NL80211_ATTR_VENDOR_DATA]) {
+ 			data = nla_data(info->attrs[NL80211_ATTR_VENDOR_DATA]);
+ 			len = nla_len(info->attrs[NL80211_ATTR_VENDOR_DATA]);
+diff --git a/scripts/coccinelle/misc/add_namespace.cocci b/scripts/coccinelle/misc/add_namespace.cocci
+index 99e93a6c2e24..cbf1614163cb 100644
+--- a/scripts/coccinelle/misc/add_namespace.cocci
++++ b/scripts/coccinelle/misc/add_namespace.cocci
+@@ -6,6 +6,7 @@
+ /// add a missing namespace tag to a module source file.
+ ///
+ 
++virtual nsdeps
+ virtual report
+ 
+ @has_ns_import@
+@@ -16,10 +17,15 @@ MODULE_IMPORT_NS(ns);
+ 
+ // Add missing imports, but only adjacent to a MODULE_LICENSE statement.
+ // That ensures we are adding it only to the main module source file.
+-@do_import depends on !has_ns_import@
++@do_import depends on !has_ns_import && nsdeps@
+ declarer name MODULE_LICENSE;
+ expression license;
+ identifier virtual.ns;
+ @@
+ MODULE_LICENSE(license);
+ + MODULE_IMPORT_NS(ns);
++
++// Dummy rule for report mode that would otherwise be empty and make spatch
++// fail ("No rules apply.")
++@script:python depends on report@
++@@
+diff --git a/scripts/nsdeps b/scripts/nsdeps
+index 03a8e7cbe6c7..dab4c1a0e27d 100644
+--- a/scripts/nsdeps
++++ b/scripts/nsdeps
+@@ -29,7 +29,7 @@ fi
+ 
+ generate_deps_for_ns() {
+ 	$SPATCH --very-quiet --in-place --sp-file \
+-		$srctree/scripts/coccinelle/misc/add_namespace.cocci -D ns=$1 $2
++		$srctree/scripts/coccinelle/misc/add_namespace.cocci -D nsdeps -D ns=$1 $2
+ }
+ 
+ generate_deps() {
+diff --git a/security/integrity/ima/Kconfig b/security/integrity/ima/Kconfig
+index edde88dbe576..62dc11a5af01 100644
+--- a/security/integrity/ima/Kconfig
++++ b/security/integrity/ima/Kconfig
+@@ -232,7 +232,7 @@ config IMA_APPRAISE_REQUIRE_POLICY_SIGS
+ 
+ config IMA_APPRAISE_BOOTPARAM
+ 	bool "ima_appraise boot parameter"
+-	depends on IMA_APPRAISE && !IMA_ARCH_POLICY
++	depends on IMA_APPRAISE
+ 	default y
+ 	help
+ 	  This option enables the different "ima_appraise=" modes
+diff --git a/security/integrity/ima/ima_appraise.c b/security/integrity/ima/ima_appraise.c
+index a9649b04b9f1..28a59508c6bd 100644
+--- a/security/integrity/ima/ima_appraise.c
++++ b/security/integrity/ima/ima_appraise.c
+@@ -19,6 +19,12 @@
+ static int __init default_appraise_setup(char *str)
+ {
+ #ifdef CONFIG_IMA_APPRAISE_BOOTPARAM
++	if (arch_ima_get_secureboot()) {
++		pr_info("Secure boot enabled: ignoring ima_appraise=%s boot parameter option",
++			str);
++		return 1;
++	}
++
+ 	if (strncmp(str, "off", 3) == 0)
+ 		ima_appraise = 0;
+ 	else if (strncmp(str, "log", 3) == 0)
+diff --git a/security/smack/smackfs.c b/security/smack/smackfs.c
+index c21b656b3263..840a192e9337 100644
+--- a/security/smack/smackfs.c
++++ b/security/smack/smackfs.c
+@@ -2720,7 +2720,6 @@ static int smk_open_relabel_self(struct inode *inode, struct file *file)
+ static ssize_t smk_write_relabel_self(struct file *file, const char __user *buf,
+ 				size_t count, loff_t *ppos)
+ {
+-	struct task_smack *tsp = smack_cred(current_cred());
+ 	char *data;
+ 	int rc;
+ 	LIST_HEAD(list_tmp);
+@@ -2745,11 +2744,21 @@ static ssize_t smk_write_relabel_self(struct file *file, const char __user *buf,
+ 	kfree(data);
+ 
+ 	if (!rc || (rc == -EINVAL && list_empty(&list_tmp))) {
++		struct cred *new;
++		struct task_smack *tsp;
++
++		new = prepare_creds();
++		if (!new) {
++			rc = -ENOMEM;
++			goto out;
++		}
++		tsp = smack_cred(new);
+ 		smk_destroy_label_list(&tsp->smk_relabel);
+ 		list_splice(&list_tmp, &tsp->smk_relabel);
++		commit_creds(new);
+ 		return count;
+ 	}
+-
++out:
+ 	smk_destroy_label_list(&list_tmp);
+ 	return rc;
+ }
+diff --git a/sound/core/seq/oss/seq_oss.c b/sound/core/seq/oss/seq_oss.c
+index 17f913657304..c8b9c0b315d8 100644
+--- a/sound/core/seq/oss/seq_oss.c
++++ b/sound/core/seq/oss/seq_oss.c
+@@ -168,10 +168,16 @@ static long
+ odev_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ {
+ 	struct seq_oss_devinfo *dp;
++	long rc;
++
+ 	dp = file->private_data;
+ 	if (snd_BUG_ON(!dp))
+ 		return -ENXIO;
+-	return snd_seq_oss_ioctl(dp, cmd, arg);
++
++	mutex_lock(&register_mutex);
++	rc = snd_seq_oss_ioctl(dp, cmd, arg);
++	mutex_unlock(&register_mutex);
++	return rc;
+ }
+ 
+ #ifdef CONFIG_COMPAT
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index 7e3ae4534df9..803978d69e3c 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -2935,6 +2935,10 @@ static int hda_codec_runtime_suspend(struct device *dev)
+ 	struct hda_codec *codec = dev_to_hda_codec(dev);
+ 	unsigned int state;
+ 
++	/* Nothing to do if card registration fails and the component driver never probes */
++	if (!codec->card)
++		return 0;
++
+ 	cancel_delayed_work_sync(&codec->jackpoll_work);
+ 	state = hda_call_codec_suspend(codec);
+ 	if (codec->link_down_at_suspend ||
+@@ -2949,6 +2953,10 @@ static int hda_codec_runtime_resume(struct device *dev)
+ {
+ 	struct hda_codec *codec = dev_to_hda_codec(dev);
+ 
++	/* Nothing to do if card registration fails and the component driver never probes */
++	if (!codec->card)
++		return 0;
++
+ 	codec_display_power(codec, true);
+ 	snd_hdac_codec_link_up(&codec->core);
+ 	hda_call_codec_resume(codec);
+diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
+index 9d14c40c07ea..a8b5db70050c 100644
+--- a/sound/pci/hda/hda_intel.c
++++ b/sound/pci/hda/hda_intel.c
+@@ -2354,7 +2354,6 @@ static int azx_probe_continue(struct azx *chip)
+ 
+ 	if (azx_has_pm_runtime(chip)) {
+ 		pm_runtime_use_autosuspend(&pci->dev);
+-		pm_runtime_allow(&pci->dev);
+ 		pm_runtime_put_autosuspend(&pci->dev);
+ 	}
+ 
+diff --git a/sound/pci/hda/patch_ca0132.c b/sound/pci/hda/patch_ca0132.c
+index 34fe753a46fb..6dfa864d3fe7 100644
+--- a/sound/pci/hda/patch_ca0132.c
++++ b/sound/pci/hda/patch_ca0132.c
+@@ -1182,6 +1182,7 @@ static const struct snd_pci_quirk ca0132_quirks[] = {
+ 	SND_PCI_QUIRK(0x1458, 0xA036, "Gigabyte GA-Z170X-Gaming 7", QUIRK_R3DI),
+ 	SND_PCI_QUIRK(0x3842, 0x1038, "EVGA X99 Classified", QUIRK_R3DI),
+ 	SND_PCI_QUIRK(0x1102, 0x0013, "Recon3D", QUIRK_R3D),
++	SND_PCI_QUIRK(0x1102, 0x0018, "Recon3D", QUIRK_R3D),
+ 	SND_PCI_QUIRK(0x1102, 0x0051, "Sound Blaster AE-5", QUIRK_AE5),
+ 	{}
+ };
+@@ -4671,7 +4672,7 @@ static int ca0132_alt_select_in(struct hda_codec *codec)
+ 			tmp = FLOAT_ONE;
+ 			break;
+ 		case QUIRK_AE5:
+-			ca0113_mmio_command_set(codec, 0x48, 0x28, 0x00);
++			ca0113_mmio_command_set(codec, 0x30, 0x28, 0x00);
+ 			tmp = FLOAT_THREE;
+ 			break;
+ 		default:
+@@ -4717,7 +4718,7 @@ static int ca0132_alt_select_in(struct hda_codec *codec)
+ 			r3di_gpio_mic_set(codec, R3DI_REAR_MIC);
+ 			break;
+ 		case QUIRK_AE5:
+-			ca0113_mmio_command_set(codec, 0x48, 0x28, 0x00);
++			ca0113_mmio_command_set(codec, 0x30, 0x28, 0x00);
+ 			break;
+ 		default:
+ 			break;
+@@ -4756,7 +4757,7 @@ static int ca0132_alt_select_in(struct hda_codec *codec)
+ 			tmp = FLOAT_ONE;
+ 			break;
+ 		case QUIRK_AE5:
+-			ca0113_mmio_command_set(codec, 0x48, 0x28, 0x3f);
++			ca0113_mmio_command_set(codec, 0x30, 0x28, 0x3f);
+ 			tmp = FLOAT_THREE;
+ 			break;
+ 		default:
+@@ -5748,6 +5749,11 @@ static int ca0132_switch_get(struct snd_kcontrol *kcontrol,
+ 		return 0;
+ 	}
+ 
++	if (nid == ZXR_HEADPHONE_GAIN) {
++		*valp = spec->zxr_gain_set;
++		return 0;
++	}
++
+ 	return 0;
+ }
+ 
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index d8d018536484..b27d88c86067 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -6131,6 +6131,11 @@ enum {
+ 	ALC289_FIXUP_ASUS_GA502,
+ 	ALC256_FIXUP_ACER_MIC_NO_PRESENCE,
+ 	ALC285_FIXUP_HP_GPIO_AMP_INIT,
++	ALC269_FIXUP_CZC_B20,
++	ALC269_FIXUP_CZC_TMI,
++	ALC269_FIXUP_CZC_L101,
++	ALC269_FIXUP_LEMOTE_A1802,
++	ALC269_FIXUP_LEMOTE_A190X,
+ };
+ 
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -7369,6 +7374,89 @@ static const struct hda_fixup alc269_fixups[] = {
+ 		.chained = true,
+ 		.chain_id = ALC285_FIXUP_HP_GPIO_LED
+ 	},
++	[ALC269_FIXUP_CZC_B20] = {
++		.type = HDA_FIXUP_PINS,
++		.v.pins = (const struct hda_pintbl[]) {
++			{ 0x12, 0x411111f0 },
++			{ 0x14, 0x90170110 }, /* speaker */
++			{ 0x15, 0x032f1020 }, /* HP out */
++			{ 0x17, 0x411111f0 },
++			{ 0x18, 0x03ab1040 }, /* mic */
++			{ 0x19, 0xb7a7013f },
++			{ 0x1a, 0x0181305f },
++			{ 0x1b, 0x411111f0 },
++			{ 0x1d, 0x411111f0 },
++			{ 0x1e, 0x411111f0 },
++			{ }
++		},
++		.chain_id = ALC269_FIXUP_DMIC,
++	},
++	[ALC269_FIXUP_CZC_TMI] = {
++		.type = HDA_FIXUP_PINS,
++		.v.pins = (const struct hda_pintbl[]) {
++			{ 0x12, 0x4000c000 },
++			{ 0x14, 0x90170110 }, /* speaker */
++			{ 0x15, 0x0421401f }, /* HP out */
++			{ 0x17, 0x411111f0 },
++			{ 0x18, 0x04a19020 }, /* mic */
++			{ 0x19, 0x411111f0 },
++			{ 0x1a, 0x411111f0 },
++			{ 0x1b, 0x411111f0 },
++			{ 0x1d, 0x40448505 },
++			{ 0x1e, 0x411111f0 },
++			{ 0x20, 0x8000ffff },
++			{ }
++		},
++		.chain_id = ALC269_FIXUP_DMIC,
++	},
++	[ALC269_FIXUP_CZC_L101] = {
++		.type = HDA_FIXUP_PINS,
++		.v.pins = (const struct hda_pintbl[]) {
++			{ 0x12, 0x40000000 },
++			{ 0x14, 0x01014010 }, /* speaker */
++			{ 0x15, 0x411111f0 }, /* HP out */
++			{ 0x16, 0x411111f0 },
++			{ 0x18, 0x01a19020 }, /* mic */
++			{ 0x19, 0x02a19021 },
++			{ 0x1a, 0x0181302f },
++			{ 0x1b, 0x0221401f },
++			{ 0x1c, 0x411111f0 },
++			{ 0x1d, 0x4044c601 },
++			{ 0x1e, 0x411111f0 },
++			{ }
++		},
++		.chain_id = ALC269_FIXUP_DMIC,
++	},
++	[ALC269_FIXUP_LEMOTE_A1802] = {
++		.type = HDA_FIXUP_PINS,
++		.v.pins = (const struct hda_pintbl[]) {
++			{ 0x12, 0x40000000 },
++			{ 0x14, 0x90170110 }, /* speaker */
++			{ 0x17, 0x411111f0 },
++			{ 0x18, 0x03a19040 }, /* mic1 */
++			{ 0x19, 0x90a70130 }, /* mic2 */
++			{ 0x1a, 0x411111f0 },
++			{ 0x1b, 0x411111f0 },
++			{ 0x1d, 0x40489d2d },
++			{ 0x1e, 0x411111f0 },
++			{ 0x20, 0x0003ffff },
++			{ 0x21, 0x03214020 },
++			{ }
++		},
++		.chain_id = ALC269_FIXUP_DMIC,
++	},
++	[ALC269_FIXUP_LEMOTE_A190X] = {
++		.type = HDA_FIXUP_PINS,
++		.v.pins = (const struct hda_pintbl[]) {
++			{ 0x14, 0x99130110 }, /* speaker */
++			{ 0x15, 0x0121401f }, /* HP out */
++			{ 0x18, 0x01a19c20 }, /* rear  mic */
++			{ 0x19, 0x99a3092f }, /* front mic */
++			{ 0x1b, 0x0201401f }, /* front lineout */
++			{ }
++		},
++		.chain_id = ALC269_FIXUP_DMIC,
++	},
+ };
+ 
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -7658,9 +7746,14 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K),
+ 	SND_PCI_QUIRK(0x17aa, 0x9e54, "LENOVO NB", ALC269_FIXUP_LENOVO_EAPD),
+ 	SND_PCI_QUIRK(0x19e5, 0x3204, "Huawei MACH-WX9", ALC256_FIXUP_HUAWEI_MACH_WX9_PINS),
++	SND_PCI_QUIRK(0x1b35, 0x1235, "CZC B20", ALC269_FIXUP_CZC_B20),
++	SND_PCI_QUIRK(0x1b35, 0x1236, "CZC TMI", ALC269_FIXUP_CZC_TMI),
++	SND_PCI_QUIRK(0x1b35, 0x1237, "CZC L101", ALC269_FIXUP_CZC_L101),
+ 	SND_PCI_QUIRK(0x1b7d, 0xa831, "Ordissimo EVE2 ", ALC269VB_FIXUP_ORDISSIMO_EVE2), /* Also known as Malata PC-B1303 */
+ 	SND_PCI_QUIRK(0x1d72, 0x1901, "RedmiBook 14", ALC256_FIXUP_ASUS_HEADSET_MIC),
+ 	SND_PCI_QUIRK(0x10ec, 0x118c, "Medion EE4254 MD62100", ALC256_FIXUP_MEDION_HEADSET_NO_PRESENCE),
++	SND_PCI_QUIRK(0x1c06, 0x2013, "Lemote A1802", ALC269_FIXUP_LEMOTE_A1802),
++	SND_PCI_QUIRK(0x1c06, 0x2015, "Lemote A190X", ALC269_FIXUP_LEMOTE_A190X),
+ 
+ #if 0
+ 	/* Below is a quirk table taken from the old code.
+@@ -8916,6 +9009,7 @@ enum {
+ 	ALC662_FIXUP_LED_GPIO1,
+ 	ALC662_FIXUP_IDEAPAD,
+ 	ALC272_FIXUP_MARIO,
++	ALC662_FIXUP_CZC_ET26,
+ 	ALC662_FIXUP_CZC_P10T,
+ 	ALC662_FIXUP_SKU_IGNORE,
+ 	ALC662_FIXUP_HP_RP5800,
+@@ -8985,6 +9079,25 @@ static const struct hda_fixup alc662_fixups[] = {
+ 		.type = HDA_FIXUP_FUNC,
+ 		.v.func = alc272_fixup_mario,
+ 	},
++	[ALC662_FIXUP_CZC_ET26] = {
++		.type = HDA_FIXUP_PINS,
++		.v.pins = (const struct hda_pintbl[]) {
++			{0x12, 0x403cc000},
++			{0x14, 0x90170110}, /* speaker */
++			{0x15, 0x411111f0},
++			{0x16, 0x411111f0},
++			{0x18, 0x01a19030}, /* mic */
++			{0x19, 0x90a7013f}, /* int-mic */
++			{0x1a, 0x01014020},
++			{0x1b, 0x0121401f},
++			{0x1c, 0x411111f0},
++			{0x1d, 0x411111f0},
++			{0x1e, 0x40478e35},
++			{}
++		},
++		.chained = true,
++		.chain_id = ALC662_FIXUP_SKU_IGNORE
++	},
+ 	[ALC662_FIXUP_CZC_P10T] = {
+ 		.type = HDA_FIXUP_VERBS,
+ 		.v.verbs = (const struct hda_verb[]) {
+@@ -9368,6 +9481,7 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1849, 0x5892, "ASRock B150M", ALC892_FIXUP_ASROCK_MOBO),
+ 	SND_PCI_QUIRK(0x19da, 0xa130, "Zotac Z68", ALC662_FIXUP_ZOTAC_Z68),
+ 	SND_PCI_QUIRK(0x1b0a, 0x01b8, "ACER Veriton", ALC662_FIXUP_ACER_VERITON),
++	SND_PCI_QUIRK(0x1b35, 0x1234, "CZC ET26", ALC662_FIXUP_CZC_ET26),
+ 	SND_PCI_QUIRK(0x1b35, 0x2206, "CZC P10T", ALC662_FIXUP_CZC_P10T),
+ 	SND_PCI_QUIRK(0x1025, 0x0566, "Acer Aspire Ethos 8951G", ALC669_FIXUP_ACER_ASPIRE_ETHOS),
+ 
+diff --git a/tools/lib/traceevent/event-parse.c b/tools/lib/traceevent/event-parse.c
+index 010e60d5a081..cb0d29865ee9 100644
+--- a/tools/lib/traceevent/event-parse.c
++++ b/tools/lib/traceevent/event-parse.c
+@@ -2861,6 +2861,7 @@ process_dynamic_array_len(struct tep_event *event, struct tep_print_arg *arg,
+ 	if (read_expected(TEP_EVENT_DELIM, ")") < 0)
+ 		goto out_err;
+ 
++	free_token(token);
+ 	type = read_token(&token);
+ 	*tok = token;
+ 
+diff --git a/tools/testing/selftests/net/msg_zerocopy.c b/tools/testing/selftests/net/msg_zerocopy.c
+index 4b02933cab8a..bdc03a2097e8 100644
+--- a/tools/testing/selftests/net/msg_zerocopy.c
++++ b/tools/testing/selftests/net/msg_zerocopy.c
+@@ -125,9 +125,8 @@ static int do_setcpu(int cpu)
+ 	CPU_ZERO(&mask);
+ 	CPU_SET(cpu, &mask);
+ 	if (sched_setaffinity(0, sizeof(mask), &mask))
+-		error(1, 0, "setaffinity %d", cpu);
+-
+-	if (cfg_verbose)
++		fprintf(stderr, "cpu: unable to pin, may increase variance.\n");
++	else if (cfg_verbose)
+ 		fprintf(stderr, "cpu: %u\n", cpu);
+ 
+ 	return 0;