grsecurity-3.1-4.4.8-20160420195720160420

12 files changed, 5695 insertions, 363 deletions

diff --git a/4.4.7/0000_README b/4.4.8/0000_README
index afa79df..50bafae 100644
--- a/4.4.7/0000_README
+++ b/4.4.8/0000_README
@@ -2,7 +2,11 @@ README
 -----------------------------------------------------------------------------
 Individual Patch Descriptions:
 -----------------------------------------------------------------------------
-Patch:	4420_grsecurity-3.1-4.4.7-201604152208.patch
+Patch:	1007_linux-4.4.8.patch
+From:	http://www.kernel.org
+Desc:	Linux 4.4.8
+
+Patch:	4420_grsecurity-3.1-4.4.8-201604201957.patch
 From:	http://www.grsecurity.net
 Desc:	hardened-sources base patch from upstream grsecurity
 
diff --git a/4.4.8/1007_linux-4.4.8.patch b/4.4.8/1007_linux-4.4.8.patch
new file mode 100644
index 0000000..e8c236b
--- /dev/null
+++ b/4.4.8/1007_linux-4.4.8.patch
@@ -0,0 +1,5319 @@
+diff --git a/Documentation/devicetree/bindings/pinctrl/img,pistachio-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/img,pistachio-pinctrl.txt
+index 08a4a32..0326154 100644
+--- a/Documentation/devicetree/bindings/pinctrl/img,pistachio-pinctrl.txt
++++ b/Documentation/devicetree/bindings/pinctrl/img,pistachio-pinctrl.txt
+@@ -134,12 +134,12 @@ mfio80		ddr_debug, mips_trace_data, mips_debug
+ mfio81		dreq0, mips_trace_data, eth_debug
+ mfio82		dreq1, mips_trace_data, eth_debug
+ mfio83		mips_pll_lock, mips_trace_data, usb_debug
+-mfio84		sys_pll_lock, mips_trace_data, usb_debug
+-mfio85		wifi_pll_lock, mips_trace_data, sdhost_debug
+-mfio86		bt_pll_lock, mips_trace_data, sdhost_debug
+-mfio87		rpu_v_pll_lock, dreq2, socif_debug
+-mfio88		rpu_l_pll_lock, dreq3, socif_debug
+-mfio89		audio_pll_lock, dreq4, dreq5
++mfio84		audio_pll_lock, mips_trace_data, usb_debug
++mfio85		rpu_v_pll_lock, mips_trace_data, sdhost_debug
++mfio86		rpu_l_pll_lock, mips_trace_data, sdhost_debug
++mfio87		sys_pll_lock, dreq2, socif_debug
++mfio88		wifi_pll_lock, dreq3, socif_debug
++mfio89		bt_pll_lock, dreq4, dreq5
+ tck
+ trstn
+ tdi
+diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
+index 742f69d..0e4102a 100644
+--- a/Documentation/kernel-parameters.txt
++++ b/Documentation/kernel-parameters.txt
+@@ -3928,6 +3928,8 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
+ 					sector if the number is odd);
+ 				i = IGNORE_DEVICE (don't bind to this
+ 					device);
++				j = NO_REPORT_LUNS (don't use report luns
++					command, uas only);
+ 				l = NOT_LOCKABLE (don't try to lock and
+ 					unlock ejectable media);
+ 				m = MAX_SECTORS_64 (don't transfer more
+diff --git a/Makefile b/Makefile
+index 5a493e7..1928fcd 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 4
+ PATCHLEVEL = 4
+-SUBLEVEL = 7
++SUBLEVEL = 8
+ EXTRAVERSION =
+ NAME = Blurry Fish Butt
+ 
+diff --git a/arch/arm64/include/asm/opcodes.h b/arch/arm64/include/asm/opcodes.h
+index 4e603ea..123f45d 100644
+--- a/arch/arm64/include/asm/opcodes.h
++++ b/arch/arm64/include/asm/opcodes.h
+@@ -1 +1,5 @@
++#ifdef CONFIG_CPU_BIG_ENDIAN
++#define CONFIG_CPU_ENDIAN_BE8 CONFIG_CPU_BIG_ENDIAN
++#endif
++
+ #include <../../arm/include/asm/opcodes.h>
+diff --git a/arch/arm64/kernel/debug-monitors.c b/arch/arm64/kernel/debug-monitors.c
+index 8aee3ae..c1492ba 100644
+--- a/arch/arm64/kernel/debug-monitors.c
++++ b/arch/arm64/kernel/debug-monitors.c
+@@ -186,20 +186,21 @@ static void clear_regs_spsr_ss(struct pt_regs *regs)
+ 
+ /* EL1 Single Step Handler hooks */
+ static LIST_HEAD(step_hook);
+-static DEFINE_RWLOCK(step_hook_lock);
++static DEFINE_SPINLOCK(step_hook_lock);
+ 
+ void register_step_hook(struct step_hook *hook)
+ {
+-	write_lock(&step_hook_lock);
+-	list_add(&hook->node, &step_hook);
+-	write_unlock(&step_hook_lock);
++	spin_lock(&step_hook_lock);
++	list_add_rcu(&hook->node, &step_hook);
++	spin_unlock(&step_hook_lock);
+ }
+ 
+ void unregister_step_hook(struct step_hook *hook)
+ {
+-	write_lock(&step_hook_lock);
+-	list_del(&hook->node);
+-	write_unlock(&step_hook_lock);
++	spin_lock(&step_hook_lock);
++	list_del_rcu(&hook->node);
++	spin_unlock(&step_hook_lock);
++	synchronize_rcu();
+ }
+ 
+ /*
+@@ -213,15 +214,15 @@ static int call_step_hook(struct pt_regs *regs, unsigned int esr)
+ 	struct step_hook *hook;
+ 	int retval = DBG_HOOK_ERROR;
+ 
+-	read_lock(&step_hook_lock);
++	rcu_read_lock();
+ 
+-	list_for_each_entry(hook, &step_hook, node)	{
++	list_for_each_entry_rcu(hook, &step_hook, node)	{
+ 		retval = hook->fn(regs, esr);
+ 		if (retval == DBG_HOOK_HANDLED)
+ 			break;
+ 	}
+ 
+-	read_unlock(&step_hook_lock);
++	rcu_read_unlock();
+ 
+ 	return retval;
+ }
+diff --git a/arch/mips/alchemy/devboards/db1000.c b/arch/mips/alchemy/devboards/db1000.c
+index bdeed9d..433c4b9 100644
+--- a/arch/mips/alchemy/devboards/db1000.c
++++ b/arch/mips/alchemy/devboards/db1000.c
+@@ -503,15 +503,15 @@ int __init db1000_dev_setup(void)
+ 	if (board == BCSR_WHOAMI_DB1500) {
+ 		c0 = AU1500_GPIO2_INT;
+ 		c1 = AU1500_GPIO5_INT;
+-		d0 = AU1500_GPIO0_INT;
+-		d1 = AU1500_GPIO3_INT;
++		d0 = 0;	/* GPIO number, NOT irq! */
++		d1 = 3; /* GPIO number, NOT irq! */
+ 		s0 = AU1500_GPIO1_INT;
+ 		s1 = AU1500_GPIO4_INT;
+ 	} else if (board == BCSR_WHOAMI_DB1100) {
+ 		c0 = AU1100_GPIO2_INT;
+ 		c1 = AU1100_GPIO5_INT;
+-		d0 = AU1100_GPIO0_INT;
+-		d1 = AU1100_GPIO3_INT;
++		d0 = 0; /* GPIO number, NOT irq! */
++		d1 = 3; /* GPIO number, NOT irq! */
+ 		s0 = AU1100_GPIO1_INT;
+ 		s1 = AU1100_GPIO4_INT;
+ 
+@@ -545,15 +545,15 @@ int __init db1000_dev_setup(void)
+ 	} else if (board == BCSR_WHOAMI_DB1000) {
+ 		c0 = AU1000_GPIO2_INT;
+ 		c1 = AU1000_GPIO5_INT;
+-		d0 = AU1000_GPIO0_INT;
+-		d1 = AU1000_GPIO3_INT;
++		d0 = 0; /* GPIO number, NOT irq! */
++		d1 = 3; /* GPIO number, NOT irq! */
+ 		s0 = AU1000_GPIO1_INT;
+ 		s1 = AU1000_GPIO4_INT;
+ 		platform_add_devices(db1000_devs, ARRAY_SIZE(db1000_devs));
+ 	} else if ((board == BCSR_WHOAMI_PB1500) ||
+ 		   (board == BCSR_WHOAMI_PB1500R2)) {
+ 		c0 = AU1500_GPIO203_INT;
+-		d0 = AU1500_GPIO201_INT;
++		d0 = 1; /* GPIO number, NOT irq! */
+ 		s0 = AU1500_GPIO202_INT;
+ 		twosocks = 0;
+ 		flashsize = 64;
+@@ -566,7 +566,7 @@ int __init db1000_dev_setup(void)
+ 		 */
+ 	} else if (board == BCSR_WHOAMI_PB1100) {
+ 		c0 = AU1100_GPIO11_INT;
+-		d0 = AU1100_GPIO9_INT;
++		d0 = 9; /* GPIO number, NOT irq! */
+ 		s0 = AU1100_GPIO10_INT;
+ 		twosocks = 0;
+ 		flashsize = 64;
+@@ -583,7 +583,6 @@ int __init db1000_dev_setup(void)
+ 	} else
+ 		return 0; /* unknown board, no further dev setup to do */
+ 
+-	irq_set_irq_type(d0, IRQ_TYPE_EDGE_BOTH);
+ 	irq_set_irq_type(c0, IRQ_TYPE_LEVEL_LOW);
+ 	irq_set_irq_type(s0, IRQ_TYPE_LEVEL_LOW);
+ 
+@@ -597,7 +596,6 @@ int __init db1000_dev_setup(void)
+ 		c0, d0, /*s0*/0, 0, 0);
+ 
+ 	if (twosocks) {
+-		irq_set_irq_type(d1, IRQ_TYPE_EDGE_BOTH);
+ 		irq_set_irq_type(c1, IRQ_TYPE_LEVEL_LOW);
+ 		irq_set_irq_type(s1, IRQ_TYPE_LEVEL_LOW);
+ 
+diff --git a/arch/mips/alchemy/devboards/db1550.c b/arch/mips/alchemy/devboards/db1550.c
+index 5740bcf..6c37b93 100644
+--- a/arch/mips/alchemy/devboards/db1550.c
++++ b/arch/mips/alchemy/devboards/db1550.c
+@@ -514,7 +514,7 @@ static void __init db1550_devices(void)
+ 		AU1000_PCMCIA_MEM_PHYS_ADDR  + 0x000400000 - 1,
+ 		AU1000_PCMCIA_IO_PHYS_ADDR,
+ 		AU1000_PCMCIA_IO_PHYS_ADDR   + 0x000010000 - 1,
+-		AU1550_GPIO3_INT, AU1550_GPIO0_INT,
++		AU1550_GPIO3_INT, 0,
+ 		/*AU1550_GPIO21_INT*/0, 0, 0);
+ 
+ 	db1x_register_pcmcia_socket(
+@@ -524,7 +524,7 @@ static void __init db1550_devices(void)
+ 		AU1000_PCMCIA_MEM_PHYS_ADDR  + 0x004400000 - 1,
+ 		AU1000_PCMCIA_IO_PHYS_ADDR   + 0x004000000,
+ 		AU1000_PCMCIA_IO_PHYS_ADDR   + 0x004010000 - 1,
+-		AU1550_GPIO5_INT, AU1550_GPIO1_INT,
++		AU1550_GPIO5_INT, 1,
+ 		/*AU1550_GPIO22_INT*/0, 0, 1);
+ 
+ 	platform_device_register(&db1550_nand_dev);
+diff --git a/arch/mips/kernel/unaligned.c b/arch/mips/kernel/unaligned.c
+index 490cea5..5c62065 100644
+--- a/arch/mips/kernel/unaligned.c
++++ b/arch/mips/kernel/unaligned.c
+@@ -885,7 +885,7 @@ static void emulate_load_store_insn(struct pt_regs *regs,
+ {
+ 	union mips_instruction insn;
+ 	unsigned long value;
+-	unsigned int res;
++	unsigned int res, preempted;
+ 	unsigned long origpc;
+ 	unsigned long orig31;
+ 	void __user *fault_addr = NULL;
+@@ -1226,27 +1226,36 @@ static void emulate_load_store_insn(struct pt_regs *regs,
+ 			if (!access_ok(VERIFY_READ, addr, sizeof(*fpr)))
+ 				goto sigbus;
+ 
+-			/*
+-			 * Disable preemption to avoid a race between copying
+-			 * state from userland, migrating to another CPU and
+-			 * updating the hardware vector register below.
+-			 */
+-			preempt_disable();
+-
+-			res = __copy_from_user_inatomic(fpr, addr,
+-							sizeof(*fpr));
+-			if (res)
+-				goto fault;
+-
+-			/*
+-			 * Update the hardware register if it is in use by the
+-			 * task in this quantum, in order to avoid having to
+-			 * save & restore the whole vector context.
+-			 */
+-			if (test_thread_flag(TIF_USEDMSA))
+-				write_msa_wr(wd, fpr, df);
++			do {
++				/*
++				 * If we have live MSA context keep track of
++				 * whether we get preempted in order to avoid
++				 * the register context we load being clobbered
++				 * by the live context as it's saved during
++				 * preemption. If we don't have live context
++				 * then it can't be saved to clobber the value
++				 * we load.
++				 */
++				preempted = test_thread_flag(TIF_USEDMSA);
++
++				res = __copy_from_user_inatomic(fpr, addr,
++								sizeof(*fpr));
++				if (res)
++					goto fault;
+ 
+-			preempt_enable();
++				/*
++				 * Update the hardware register if it is in use
++				 * by the task in this quantum, in order to
++				 * avoid having to save & restore the whole
++				 * vector context.
++				 */
++				preempt_disable();
++				if (test_thread_flag(TIF_USEDMSA)) {
++					write_msa_wr(wd, fpr, df);
++					preempted = 0;
++				}
++				preempt_enable();
++			} while (preempted);
+ 			break;
+ 
+ 		case msa_st_op:
+diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h
+index 0abdd4c..1960b87 100644
+--- a/arch/parisc/include/asm/uaccess.h
++++ b/arch/parisc/include/asm/uaccess.h
+@@ -76,6 +76,7 @@ struct exception_table_entry {
+  */
+ struct exception_data {
+ 	unsigned long fault_ip;
++	unsigned long fault_gp;
+ 	unsigned long fault_space;
+ 	unsigned long fault_addr;
+ };
+diff --git a/arch/parisc/kernel/asm-offsets.c b/arch/parisc/kernel/asm-offsets.c
+index d2f6257..78d30d2 100644
+--- a/arch/parisc/kernel/asm-offsets.c
++++ b/arch/parisc/kernel/asm-offsets.c
+@@ -299,6 +299,7 @@ int main(void)
+ #endif
+ 	BLANK();
+ 	DEFINE(EXCDATA_IP, offsetof(struct exception_data, fault_ip));
++	DEFINE(EXCDATA_GP, offsetof(struct exception_data, fault_gp));
+ 	DEFINE(EXCDATA_SPACE, offsetof(struct exception_data, fault_space));
+ 	DEFINE(EXCDATA_ADDR, offsetof(struct exception_data, fault_addr));
+ 	BLANK();
+diff --git a/arch/parisc/kernel/parisc_ksyms.c b/arch/parisc/kernel/parisc_ksyms.c
+index 568b2c6..3cad8aa 100644
+--- a/arch/parisc/kernel/parisc_ksyms.c
++++ b/arch/parisc/kernel/parisc_ksyms.c
+@@ -47,11 +47,11 @@ EXPORT_SYMBOL(__cmpxchg_u64);
+ EXPORT_SYMBOL(lclear_user);
+ EXPORT_SYMBOL(lstrnlen_user);
+ 
+-/* Global fixups */
+-extern void fixup_get_user_skip_1(void);
+-extern void fixup_get_user_skip_2(void);
+-extern void fixup_put_user_skip_1(void);
+-extern void fixup_put_user_skip_2(void);
++/* Global fixups - defined as int to avoid creation of function pointers */
++extern int fixup_get_user_skip_1;
++extern int fixup_get_user_skip_2;
++extern int fixup_put_user_skip_1;
++extern int fixup_put_user_skip_2;
+ EXPORT_SYMBOL(fixup_get_user_skip_1);
+ EXPORT_SYMBOL(fixup_get_user_skip_2);
+ EXPORT_SYMBOL(fixup_put_user_skip_1);
+diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
+index 553b098..77e2262 100644
+--- a/arch/parisc/kernel/traps.c
++++ b/arch/parisc/kernel/traps.c
+@@ -798,6 +798,9 @@ void notrace handle_interruption(int code, struct pt_regs *regs)
+ 
+ 	    if (fault_space == 0 && !faulthandler_disabled())
+ 	    {
++		/* Clean up and return if in exception table. */
++		if (fixup_exception(regs))
++			return;
+ 		pdc_chassis_send_status(PDC_CHASSIS_DIRECT_PANIC);
+ 		parisc_terminate("Kernel Fault", regs, code, fault_address);
+ 	    }
+diff --git a/arch/parisc/lib/fixup.S b/arch/parisc/lib/fixup.S
+index 536ef66..1052b74 100644
+--- a/arch/parisc/lib/fixup.S
++++ b/arch/parisc/lib/fixup.S
+@@ -26,6 +26,7 @@
+ 
+ #ifdef CONFIG_SMP
+ 	.macro  get_fault_ip t1 t2
++	loadgp
+ 	addil LT%__per_cpu_offset,%r27
+ 	LDREG RT%__per_cpu_offset(%r1),\t1
+ 	/* t2 = smp_processor_id() */
+@@ -40,14 +41,19 @@
+ 	LDREG RT%exception_data(%r1),\t1
+ 	/* t1 = this_cpu_ptr(&exception_data) */
+ 	add,l \t1,\t2,\t1
++	/* %r27 = t1->fault_gp - restore gp */
++	LDREG EXCDATA_GP(\t1), %r27
+ 	/* t1 = t1->fault_ip */
+ 	LDREG EXCDATA_IP(\t1), \t1
+ 	.endm
+ #else
+ 	.macro  get_fault_ip t1 t2
++	loadgp
+ 	/* t1 = this_cpu_ptr(&exception_data) */
+ 	addil LT%exception_data,%r27
+ 	LDREG RT%exception_data(%r1),\t2
++	/* %r27 = t2->fault_gp - restore gp */
++	LDREG EXCDATA_GP(\t2), %r27
+ 	/* t1 = t2->fault_ip */
+ 	LDREG EXCDATA_IP(\t2), \t1
+ 	.endm
+diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
+index a762864..f906444 100644
+--- a/arch/parisc/mm/fault.c
++++ b/arch/parisc/mm/fault.c
+@@ -151,6 +151,7 @@ int fixup_exception(struct pt_regs *regs)
+ 		struct exception_data *d;
+ 		d = this_cpu_ptr(&exception_data);
+ 		d->fault_ip = regs->iaoq[0];
++		d->fault_gp = regs->gr[27];
+ 		d->fault_space = regs->isr;
+ 		d->fault_addr = regs->ior;
+ 
+diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
+index 9833fee..807f159 100644
+--- a/arch/powerpc/mm/hugetlbpage.c
++++ b/arch/powerpc/mm/hugetlbpage.c
+@@ -486,13 +486,13 @@ static void hugepd_free(struct mmu_gather *tlb, void *hugepte)
+ {
+ 	struct hugepd_freelist **batchp;
+ 
+-	batchp = this_cpu_ptr(&hugepd_freelist_cur);
++	batchp = &get_cpu_var(hugepd_freelist_cur);
+ 
+ 	if (atomic_read(&tlb->mm->mm_users) < 2 ||
+ 	    cpumask_equal(mm_cpumask(tlb->mm),
+ 			  cpumask_of(smp_processor_id()))) {
+ 		kmem_cache_free(hugepte_cache, hugepte);
+-        put_cpu_var(hugepd_freelist_cur);
++		put_cpu_var(hugepd_freelist_cur);
+ 		return;
+ 	}
+ 
+diff --git a/arch/x86/include/asm/kvm_host.h b/arch/x86/include/asm/kvm_host.h
+index 30cfd64..9d2abb2 100644
+--- a/arch/x86/include/asm/kvm_host.h
++++ b/arch/x86/include/asm/kvm_host.h
+@@ -41,7 +41,7 @@
+ 
+ #define KVM_PIO_PAGE_OFFSET 1
+ #define KVM_COALESCED_MMIO_PAGE_OFFSET 2
+-#define KVM_HALT_POLL_NS_DEFAULT 500000
++#define KVM_HALT_POLL_NS_DEFAULT 400000
+ 
+ #define KVM_IRQCHIP_NUM_PINS  KVM_IOAPIC_NUM_PINS
+ 
+diff --git a/arch/x86/include/asm/pci_x86.h b/arch/x86/include/asm/pci_x86.h
+index fa1195d..164e3f8 100644
+--- a/arch/x86/include/asm/pci_x86.h
++++ b/arch/x86/include/asm/pci_x86.h
+@@ -93,6 +93,8 @@ extern raw_spinlock_t pci_config_lock;
+ extern int (*pcibios_enable_irq)(struct pci_dev *dev);
+ extern void (*pcibios_disable_irq)(struct pci_dev *dev);
+ 
++extern bool mp_should_keep_irq(struct device *dev);
++
+ struct pci_raw_ops {
+ 	int (*read)(unsigned int domain, unsigned int bus, unsigned int devfn,
+ 						int reg, int len, u32 *val);
+diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
+index 8bfc5fc..7eb4ebd 100644
+--- a/arch/x86/kvm/x86.c
++++ b/arch/x86/kvm/x86.c
+@@ -6024,12 +6024,10 @@ static int inject_pending_event(struct kvm_vcpu *vcpu, bool req_int_win)
+ 	}
+ 
+ 	/* try to inject new event if pending */
+-	if (vcpu->arch.nmi_pending) {
+-		if (kvm_x86_ops->nmi_allowed(vcpu)) {
+-			--vcpu->arch.nmi_pending;
+-			vcpu->arch.nmi_injected = true;
+-			kvm_x86_ops->set_nmi(vcpu);
+-		}
++	if (vcpu->arch.nmi_pending && kvm_x86_ops->nmi_allowed(vcpu)) {
++		--vcpu->arch.nmi_pending;
++		vcpu->arch.nmi_injected = true;
++		kvm_x86_ops->set_nmi(vcpu);
+ 	} else if (kvm_cpu_has_injectable_intr(vcpu)) {
+ 		/*
+ 		 * Because interrupts can be injected asynchronously, we are
+@@ -6474,10 +6472,12 @@ static int vcpu_enter_guest(struct kvm_vcpu *vcpu)
+ 		if (inject_pending_event(vcpu, req_int_win) != 0)
+ 			req_immediate_exit = true;
+ 		/* enable NMI/IRQ window open exits if needed */
+-		else if (vcpu->arch.nmi_pending)
+-			kvm_x86_ops->enable_nmi_window(vcpu);
+-		else if (kvm_cpu_has_injectable_intr(vcpu) || req_int_win)
+-			kvm_x86_ops->enable_irq_window(vcpu);
++		else {
++			if (vcpu->arch.nmi_pending)
++				kvm_x86_ops->enable_nmi_window(vcpu);
++			if (kvm_cpu_has_injectable_intr(vcpu) || req_int_win)
++				kvm_x86_ops->enable_irq_window(vcpu);
++		}
+ 
+ 		if (kvm_lapic_enabled(vcpu)) {
+ 			update_cr8_intercept(vcpu);
+diff --git a/arch/x86/pci/common.c b/arch/x86/pci/common.c
+index eccd4d9..8fd6f44 100644
+--- a/arch/x86/pci/common.c
++++ b/arch/x86/pci/common.c
+@@ -673,28 +673,22 @@ int pcibios_add_device(struct pci_dev *dev)
+ 	return 0;
+ }
+ 
+-int pcibios_alloc_irq(struct pci_dev *dev)
++int pcibios_enable_device(struct pci_dev *dev, int mask)
+ {
+-	/*
+-	 * If the PCI device was already claimed by core code and has
+-	 * MSI enabled, probing of the pcibios IRQ will overwrite
+-	 * dev->irq.  So bail out if MSI is already enabled.
+-	 */
+-	if (pci_dev_msi_enabled(dev))
+-		return -EBUSY;
++	int err;
+ 
+-	return pcibios_enable_irq(dev);
+-}
++	if ((err = pci_enable_resources(dev, mask)) < 0)
++		return err;
+ 
+-void pcibios_free_irq(struct pci_dev *dev)
+-{
+-	if (pcibios_disable_irq)
+-		pcibios_disable_irq(dev);
++	if (!pci_dev_msi_enabled(dev))
++		return pcibios_enable_irq(dev);
++	return 0;
+ }
+ 
+-int pcibios_enable_device(struct pci_dev *dev, int mask)
++void pcibios_disable_device (struct pci_dev *dev)
+ {
+-	return pci_enable_resources(dev, mask);
++	if (!pci_dev_msi_enabled(dev) && pcibios_disable_irq)
++		pcibios_disable_irq(dev);
+ }
+ 
+ int pci_ext_cfg_avail(void)
+diff --git a/arch/x86/pci/intel_mid_pci.c b/arch/x86/pci/intel_mid_pci.c
+index 0d24e7c..8b93e63 100644
+--- a/arch/x86/pci/intel_mid_pci.c
++++ b/arch/x86/pci/intel_mid_pci.c
+@@ -215,7 +215,7 @@ static int intel_mid_pci_irq_enable(struct pci_dev *dev)
+ 	int polarity;
+ 	int ret;
+ 
+-	if (pci_has_managed_irq(dev))
++	if (dev->irq_managed && dev->irq > 0)
+ 		return 0;
+ 
+ 	switch (intel_mid_identify_cpu()) {
+@@ -256,13 +256,10 @@ static int intel_mid_pci_irq_enable(struct pci_dev *dev)
+ 
+ static void intel_mid_pci_irq_disable(struct pci_dev *dev)
+ {
+-	if (pci_has_managed_irq(dev)) {
++	if (!mp_should_keep_irq(&dev->dev) && dev->irq_managed &&
++	    dev->irq > 0) {
+ 		mp_unmap_irq(dev->irq);
+ 		dev->irq_managed = 0;
+-		/*
+-		 * Don't reset dev->irq here, otherwise
+-		 * intel_mid_pci_irq_enable() will fail on next call.
+-		 */
+ 	}
+ }
+ 
+diff --git a/arch/x86/pci/irq.c b/arch/x86/pci/irq.c
+index 32e7034..9bd1154 100644
+--- a/arch/x86/pci/irq.c
++++ b/arch/x86/pci/irq.c
+@@ -1202,7 +1202,7 @@ static int pirq_enable_irq(struct pci_dev *dev)
+ 			struct pci_dev *temp_dev;
+ 			int irq;
+ 
+-			if (pci_has_managed_irq(dev))
++			if (dev->irq_managed && dev->irq > 0)
+ 				return 0;
+ 
+ 			irq = IO_APIC_get_PCI_irq_vector(dev->bus->number,
+@@ -1230,7 +1230,8 @@ static int pirq_enable_irq(struct pci_dev *dev)
+ 			}
+ 			dev = temp_dev;
+ 			if (irq >= 0) {
+-				pci_set_managed_irq(dev, irq);
++				dev->irq_managed = 1;
++				dev->irq = irq;
+ 				dev_info(&dev->dev, "PCI->APIC IRQ transform: "
+ 					 "INT %c -> IRQ %d\n", 'A' + pin - 1, irq);
+ 				return 0;
+@@ -1256,10 +1257,24 @@ static int pirq_enable_irq(struct pci_dev *dev)
+ 	return 0;
+ }
+ 
++bool mp_should_keep_irq(struct device *dev)
++{
++	if (dev->power.is_prepared)
++		return true;
++#ifdef CONFIG_PM
++	if (dev->power.runtime_status == RPM_SUSPENDING)
++		return true;
++#endif
++
++	return false;
++}
++
+ static void pirq_disable_irq(struct pci_dev *dev)
+ {
+-	if (io_apic_assign_pci_irqs && pci_has_managed_irq(dev)) {
++	if (io_apic_assign_pci_irqs && !mp_should_keep_irq(&dev->dev) &&
++	    dev->irq_managed && dev->irq) {
+ 		mp_unmap_irq(dev->irq);
+-		pci_reset_managed_irq(dev);
++		dev->irq = 0;
++		dev->irq_managed = 0;
+ 	}
+ }
+diff --git a/crypto/asymmetric_keys/pkcs7_trust.c b/crypto/asymmetric_keys/pkcs7_trust.c
+index 90d6d47..ecdb5a2 100644
+--- a/crypto/asymmetric_keys/pkcs7_trust.c
++++ b/crypto/asymmetric_keys/pkcs7_trust.c
+@@ -178,6 +178,8 @@ int pkcs7_validate_trust(struct pkcs7_message *pkcs7,
+ 	int cached_ret = -ENOKEY;
+ 	int ret;
+ 
++	*_trusted = false;
++
+ 	for (p = pkcs7->certs; p; p = p->next)
+ 		p->seen = false;
+ 
+diff --git a/drivers/acpi/pci_irq.c b/drivers/acpi/pci_irq.c
+index c933675..8a10a7a 100644
+--- a/drivers/acpi/pci_irq.c
++++ b/drivers/acpi/pci_irq.c
+@@ -409,7 +409,7 @@ int acpi_pci_irq_enable(struct pci_dev *dev)
+ 		return 0;
+ 	}
+ 
+-	if (pci_has_managed_irq(dev))
++	if (dev->irq_managed && dev->irq > 0)
+ 		return 0;
+ 
+ 	entry = acpi_pci_irq_lookup(dev, pin);
+@@ -454,7 +454,8 @@ int acpi_pci_irq_enable(struct pci_dev *dev)
+ 		kfree(entry);
+ 		return rc;
+ 	}
+-	pci_set_managed_irq(dev, rc);
++	dev->irq = rc;
++	dev->irq_managed = 1;
+ 
+ 	if (link)
+ 		snprintf(link_desc, sizeof(link_desc), " -> Link[%s]", link);
+@@ -477,9 +478,17 @@ void acpi_pci_irq_disable(struct pci_dev *dev)
+ 	u8 pin;
+ 
+ 	pin = dev->pin;
+-	if (!pin || !pci_has_managed_irq(dev))
++	if (!pin || !dev->irq_managed || dev->irq <= 0)
+ 		return;
+ 
++	/* Keep IOAPIC pin configuration when suspending */
++	if (dev->dev.power.is_prepared)
++		return;
++#ifdef	CONFIG_PM
++	if (dev->dev.power.runtime_status == RPM_SUSPENDING)
++		return;
++#endif
++
+ 	entry = acpi_pci_irq_lookup(dev, pin);
+ 	if (!entry)
+ 		return;
+@@ -499,6 +508,6 @@ void acpi_pci_irq_disable(struct pci_dev *dev)
+ 	dev_dbg(&dev->dev, "PCI INT %c disabled\n", pin_name(pin));
+ 	if (gsi >= 0) {
+ 		acpi_unregister_gsi(gsi);
+-		pci_reset_managed_irq(dev);
++		dev->irq_managed = 0;
+ 	}
+ }
+diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
+index 81ea69f..fbdddd6 100644
+--- a/drivers/block/rbd.c
++++ b/drivers/block/rbd.c
+@@ -1955,7 +1955,7 @@ static struct ceph_osd_request *rbd_osd_req_create(
+ 
+ 	osdc = &rbd_dev->rbd_client->client->osdc;
+ 	osd_req = ceph_osdc_alloc_request(osdc, snapc, num_ops, false,
+-					  GFP_ATOMIC);
++					  GFP_NOIO);
+ 	if (!osd_req)
+ 		return NULL;	/* ENOMEM */
+ 
+@@ -2004,7 +2004,7 @@ rbd_osd_req_create_copyup(struct rbd_obj_request *obj_request)
+ 	rbd_dev = img_request->rbd_dev;
+ 	osdc = &rbd_dev->rbd_client->client->osdc;
+ 	osd_req = ceph_osdc_alloc_request(osdc, snapc, num_osd_ops,
+-						false, GFP_ATOMIC);
++						false, GFP_NOIO);
+ 	if (!osd_req)
+ 		return NULL;	/* ENOMEM */
+ 
+@@ -2506,7 +2506,7 @@ static int rbd_img_request_fill(struct rbd_img_request *img_request,
+ 					bio_chain_clone_range(&bio_list,
+ 								&bio_offset,
+ 								clone_size,
+-								GFP_ATOMIC);
++								GFP_NOIO);
+ 			if (!obj_request->bio_list)
+ 				goto out_unwind;
+ 		} else if (type == OBJ_REQUEST_PAGES) {
+diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
+index 272110c..ea87033 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v7_0.c
+@@ -898,14 +898,6 @@ static int gmc_v7_0_early_init(void *handle)
+ 	gmc_v7_0_set_gart_funcs(adev);
+ 	gmc_v7_0_set_irq_funcs(adev);
+ 
+-	if (adev->flags & AMD_IS_APU) {
+-		adev->mc.vram_type = AMDGPU_VRAM_TYPE_UNKNOWN;
+-	} else {
+-		u32 tmp = RREG32(mmMC_SEQ_MISC0);
+-		tmp &= MC_SEQ_MISC0__MT__MASK;
+-		adev->mc.vram_type = gmc_v7_0_convert_vram_type(tmp);
+-	}
+-
+ 	return 0;
+ }
+ 
+@@ -926,6 +918,14 @@ static int gmc_v7_0_sw_init(void *handle)
+ 	if (r)
+ 		return r;
+ 
++	if (adev->flags & AMD_IS_APU) {
++		adev->mc.vram_type = AMDGPU_VRAM_TYPE_UNKNOWN;
++	} else {
++		u32 tmp = RREG32(mmMC_SEQ_MISC0);
++		tmp &= MC_SEQ_MISC0__MT__MASK;
++		adev->mc.vram_type = gmc_v7_0_convert_vram_type(tmp);
++	}
++
+ 	r = amdgpu_irq_add_id(adev, 146, &adev->mc.vm_fault);
+ 	if (r)
+ 		return r;
+diff --git a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
+index ba4ad00..0842308 100644
+--- a/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
++++ b/drivers/gpu/drm/amd/amdgpu/gmc_v8_0.c
+@@ -852,14 +852,6 @@ static int gmc_v8_0_early_init(void *handle)
+ 	gmc_v8_0_set_gart_funcs(adev);
+ 	gmc_v8_0_set_irq_funcs(adev);
+ 
+-	if (adev->flags & AMD_IS_APU) {
+-		adev->mc.vram_type = AMDGPU_VRAM_TYPE_UNKNOWN;
+-	} else {
+-		u32 tmp = RREG32(mmMC_SEQ_MISC0);
+-		tmp &= MC_SEQ_MISC0__MT__MASK;
+-		adev->mc.vram_type = gmc_v8_0_convert_vram_type(tmp);
+-	}
+-
+ 	return 0;
+ }
+ 
+@@ -870,6 +862,8 @@ static int gmc_v8_0_late_init(void *handle)
+ 	return amdgpu_irq_get(adev, &adev->mc.vm_fault, 0);
+ }
+ 
++#define mmMC_SEQ_MISC0_FIJI 0xA71
++
+ static int gmc_v8_0_sw_init(void *handle)
+ {
+ 	int r;
+@@ -880,6 +874,19 @@ static int gmc_v8_0_sw_init(void *handle)
+ 	if (r)
+ 		return r;
+ 
++	if (adev->flags & AMD_IS_APU) {
++		adev->mc.vram_type = AMDGPU_VRAM_TYPE_UNKNOWN;
++	} else {
++		u32 tmp;
++
++		if (adev->asic_type == CHIP_FIJI)
++			tmp = RREG32(mmMC_SEQ_MISC0_FIJI);
++		else
++			tmp = RREG32(mmMC_SEQ_MISC0);
++		tmp &= MC_SEQ_MISC0__MT__MASK;
++		adev->mc.vram_type = gmc_v8_0_convert_vram_type(tmp);
++	}
++
+ 	r = amdgpu_irq_add_id(adev, 146, &adev->mc.vm_fault);
+ 	if (r)
+ 		return r;
+diff --git a/drivers/gpu/drm/drm_dp_helper.c b/drivers/gpu/drm/drm_dp_helper.c
+index 9535c5b..7e5a972 100644
+--- a/drivers/gpu/drm/drm_dp_helper.c
++++ b/drivers/gpu/drm/drm_dp_helper.c
+@@ -178,7 +178,7 @@ static int drm_dp_dpcd_access(struct drm_dp_aux *aux, u8 request,
+ {
+ 	struct drm_dp_aux_msg msg;
+ 	unsigned int retry;
+-	int err;
++	int err = 0;
+ 
+ 	memset(&msg, 0, sizeof(msg));
+ 	msg.address = offset;
+@@ -186,6 +186,8 @@ static int drm_dp_dpcd_access(struct drm_dp_aux *aux, u8 request,
+ 	msg.buffer = buffer;
+ 	msg.size = size;
+ 
++	mutex_lock(&aux->hw_mutex);
++
+ 	/*
+ 	 * The specification doesn't give any recommendation on how often to
+ 	 * retry native transactions. We used to retry 7 times like for
+@@ -194,25 +196,24 @@ static int drm_dp_dpcd_access(struct drm_dp_aux *aux, u8 request,
+ 	 */
+ 	for (retry = 0; retry < 32; retry++) {
+ 
+-		mutex_lock(&aux->hw_mutex);
+ 		err = aux->transfer(aux, &msg);
+-		mutex_unlock(&aux->hw_mutex);
+ 		if (err < 0) {
+ 			if (err == -EBUSY)
+ 				continue;
+ 
+-			return err;
++			goto unlock;
+ 		}
+ 
+ 
+ 		switch (msg.reply & DP_AUX_NATIVE_REPLY_MASK) {
+ 		case DP_AUX_NATIVE_REPLY_ACK:
+ 			if (err < size)
+-				return -EPROTO;
+-			return err;
++				err = -EPROTO;
++			goto unlock;
+ 
+ 		case DP_AUX_NATIVE_REPLY_NACK:
+-			return -EIO;
++			err = -EIO;
++			goto unlock;
+ 
+ 		case DP_AUX_NATIVE_REPLY_DEFER:
+ 			usleep_range(AUX_RETRY_INTERVAL, AUX_RETRY_INTERVAL + 100);
+@@ -221,7 +222,11 @@ static int drm_dp_dpcd_access(struct drm_dp_aux *aux, u8 request,
+ 	}
+ 
+ 	DRM_DEBUG_KMS("too many retries, giving up\n");
+-	return -EIO;
++	err = -EIO;
++
++unlock:
++	mutex_unlock(&aux->hw_mutex);
++	return err;
+ }
+ 
+ /**
+@@ -543,9 +548,7 @@ static int drm_dp_i2c_do_msg(struct drm_dp_aux *aux, struct drm_dp_aux_msg *msg)
+ 	int max_retries = max(7, drm_dp_i2c_retry_count(msg, dp_aux_i2c_speed_khz));
+ 
+ 	for (retry = 0, defer_i2c = 0; retry < (max_retries + defer_i2c); retry++) {
+-		mutex_lock(&aux->hw_mutex);
+ 		ret = aux->transfer(aux, msg);
+-		mutex_unlock(&aux->hw_mutex);
+ 		if (ret < 0) {
+ 			if (ret == -EBUSY)
+ 				continue;
+@@ -684,6 +687,8 @@ static int drm_dp_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs,
+ 
+ 	memset(&msg, 0, sizeof(msg));
+ 
++	mutex_lock(&aux->hw_mutex);
++
+ 	for (i = 0; i < num; i++) {
+ 		msg.address = msgs[i].addr;
+ 		drm_dp_i2c_msg_set_request(&msg, &msgs[i]);
+@@ -738,6 +743,8 @@ static int drm_dp_i2c_xfer(struct i2c_adapter *adapter, struct i2c_msg *msgs,
+ 	msg.size = 0;
+ 	(void)drm_dp_i2c_do_msg(aux, &msg);
+ 
++	mutex_unlock(&aux->hw_mutex);
++
+ 	return err;
+ }
+ 
+diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c
+index a82b891..7285adb 100644
+--- a/drivers/gpu/drm/radeon/si_dpm.c
++++ b/drivers/gpu/drm/radeon/si_dpm.c
+@@ -2926,9 +2926,11 @@ static struct si_dpm_quirk si_dpm_quirk_list[] = {
+ 	/* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */
+ 	{ PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 },
+ 	{ PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 },
++	{ PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0x2015, 0, 120000 },
+ 	{ PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 90000 },
+ 	{ PCI_VENDOR_ID_ATI, 0x6811, 0x1462, 0x2015, 0, 120000 },
+ 	{ PCI_VENDOR_ID_ATI, 0x6811, 0x1043, 0x2015, 0, 120000 },
++	{ PCI_VENDOR_ID_ATI, 0x6811, 0x148c, 0x2015, 0, 120000 },
+ 	{ 0, 0, 0, 0 },
+ };
+ 
+@@ -3008,6 +3010,10 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev,
+ 		}
+ 		++p;
+ 	}
++	/* limit mclk on all R7 370 parts for stability */
++	if (rdev->pdev->device == 0x6811 &&
++	    rdev->pdev->revision == 0x81)
++		max_mclk = 120000;
+ 
+ 	if (rps->vce_active) {
+ 		rps->evclk = rdev->pm.dpm.vce_states[rdev->pm.dpm.vce_level].evclk;
+diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
+index 62c7b1d..73e41a8 100644
+--- a/drivers/gpu/drm/udl/udl_fb.c
++++ b/drivers/gpu/drm/udl/udl_fb.c
+@@ -539,7 +539,7 @@ static int udlfb_create(struct drm_fb_helper *helper,
+ out_destroy_fbi:
+ 	drm_fb_helper_release_fbi(helper);
+ out_gfree:
+-	drm_gem_object_unreference(&ufbdev->ufb.obj->base);
++	drm_gem_object_unreference_unlocked(&ufbdev->ufb.obj->base);
+ out:
+ 	return ret;
+ }
+diff --git a/drivers/gpu/drm/udl/udl_gem.c b/drivers/gpu/drm/udl/udl_gem.c
+index 2a0a784..d7528e0 100644
+--- a/drivers/gpu/drm/udl/udl_gem.c
++++ b/drivers/gpu/drm/udl/udl_gem.c
+@@ -52,7 +52,7 @@ udl_gem_create(struct drm_file *file,
+ 		return ret;
+ 	}
+ 
+-	drm_gem_object_unreference(&obj->base);
++	drm_gem_object_unreference_unlocked(&obj->base);
+ 	*handle_p = handle;
+ 	return 0;
+ }
+diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c
+index 5dd426f..0df32fe 100644
+--- a/drivers/hid/usbhid/hid-core.c
++++ b/drivers/hid/usbhid/hid-core.c
+@@ -951,14 +951,6 @@ static int usbhid_output_report(struct hid_device *hid, __u8 *buf, size_t count)
+ 	return ret;
+ }
+ 
+-static void usbhid_restart_queues(struct usbhid_device *usbhid)
+-{
+-	if (usbhid->urbout && !test_bit(HID_OUT_RUNNING, &usbhid->iofl))
+-		usbhid_restart_out_queue(usbhid);
+-	if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl))
+-		usbhid_restart_ctrl_queue(usbhid);
+-}
+-
+ static void hid_free_buffers(struct usb_device *dev, struct hid_device *hid)
+ {
+ 	struct usbhid_device *usbhid = hid->driver_data;
+@@ -1404,6 +1396,37 @@ static void hid_cease_io(struct usbhid_device *usbhid)
+ 	usb_kill_urb(usbhid->urbout);
+ }
+ 
++static void hid_restart_io(struct hid_device *hid)
++{
++	struct usbhid_device *usbhid = hid->driver_data;
++	int clear_halt = test_bit(HID_CLEAR_HALT, &usbhid->iofl);
++	int reset_pending = test_bit(HID_RESET_PENDING, &usbhid->iofl);
++
++	spin_lock_irq(&usbhid->lock);
++	clear_bit(HID_SUSPENDED, &usbhid->iofl);
++	usbhid_mark_busy(usbhid);
++
++	if (clear_halt || reset_pending)
++		schedule_work(&usbhid->reset_work);
++	usbhid->retry_delay = 0;
++	spin_unlock_irq(&usbhid->lock);
++
++	if (reset_pending || !test_bit(HID_STARTED, &usbhid->iofl))
++		return;
++
++	if (!clear_halt) {
++		if (hid_start_in(hid) < 0)
++			hid_io_error(hid);
++	}
++
++	spin_lock_irq(&usbhid->lock);
++	if (usbhid->urbout && !test_bit(HID_OUT_RUNNING, &usbhid->iofl))
++		usbhid_restart_out_queue(usbhid);
++	if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl))
++		usbhid_restart_ctrl_queue(usbhid);
++	spin_unlock_irq(&usbhid->lock);
++}
++
+ /* Treat USB reset pretty much the same as suspend/resume */
+ static int hid_pre_reset(struct usb_interface *intf)
+ {
+@@ -1453,14 +1476,14 @@ static int hid_post_reset(struct usb_interface *intf)
+ 		return 1;
+ 	}
+ 
++	/* No need to do another reset or clear a halted endpoint */
+ 	spin_lock_irq(&usbhid->lock);
+ 	clear_bit(HID_RESET_PENDING, &usbhid->iofl);
++	clear_bit(HID_CLEAR_HALT, &usbhid->iofl);
+ 	spin_unlock_irq(&usbhid->lock);
+ 	hid_set_idle(dev, intf->cur_altsetting->desc.bInterfaceNumber, 0, 0);
+-	status = hid_start_in(hid);
+-	if (status < 0)
+-		hid_io_error(hid);
+-	usbhid_restart_queues(usbhid);
++
++	hid_restart_io(hid);
+ 
+ 	return 0;
+ }
+@@ -1483,25 +1506,9 @@ void usbhid_put_power(struct hid_device *hid)
+ #ifdef CONFIG_PM
+ static int hid_resume_common(struct hid_device *hid, bool driver_suspended)
+ {
+-	struct usbhid_device *usbhid = hid->driver_data;
+-	int status;
+-
+-	spin_lock_irq(&usbhid->lock);
+-	clear_bit(HID_SUSPENDED, &usbhid->iofl);
+-	usbhid_mark_busy(usbhid);
+-
+-	if (test_bit(HID_CLEAR_HALT, &usbhid->iofl) ||
+-			test_bit(HID_RESET_PENDING, &usbhid->iofl))
+-		schedule_work(&usbhid->reset_work);
+-	usbhid->retry_delay = 0;
+-
+-	usbhid_restart_queues(usbhid);
+-	spin_unlock_irq(&usbhid->lock);
+-
+-	status = hid_start_in(hid);
+-	if (status < 0)
+-		hid_io_error(hid);
++	int status = 0;
+ 
++	hid_restart_io(hid);
+ 	if (driver_suspended && hid->driver && hid->driver->resume)
+ 		status = hid->driver->resume(hid);
+ 	return status;
+@@ -1570,12 +1577,8 @@ static int hid_suspend(struct usb_interface *intf, pm_message_t message)
+ static int hid_resume(struct usb_interface *intf)
+ {
+ 	struct hid_device *hid = usb_get_intfdata (intf);
+-	struct usbhid_device *usbhid = hid->driver_data;
+ 	int status;
+ 
+-	if (!test_bit(HID_STARTED, &usbhid->iofl))
+-		return 0;
+-
+ 	status = hid_resume_common(hid, true);
+ 	dev_dbg(&intf->dev, "resume status %d\n", status);
+ 	return 0;
+@@ -1584,10 +1587,8 @@ static int hid_resume(struct usb_interface *intf)
+ static int hid_reset_resume(struct usb_interface *intf)
+ {
+ 	struct hid_device *hid = usb_get_intfdata(intf);
+-	struct usbhid_device *usbhid = hid->driver_data;
+ 	int status;
+ 
+-	clear_bit(HID_SUSPENDED, &usbhid->iofl);
+ 	status = hid_post_reset(intf);
+ 	if (status >= 0 && hid->driver && hid->driver->reset_resume) {
+ 		int ret = hid->driver->reset_resume(hid);
+diff --git a/drivers/hid/wacom_wac.c b/drivers/hid/wacom_wac.c
+index 01a4f05..3c0f47a 100644
+--- a/drivers/hid/wacom_wac.c
++++ b/drivers/hid/wacom_wac.c
+@@ -2493,6 +2493,17 @@ void wacom_setup_device_quirks(struct wacom *wacom)
+ 	}
+ 
+ 	/*
++	 * Hack for the Bamboo One:
++	 * the device presents a PAD/Touch interface as most Bamboos and even
++	 * sends ghosts PAD data on it. However, later, we must disable this
++	 * ghost interface, and we can not detect it unless we set it here
++	 * to WACOM_DEVICETYPE_PAD or WACOM_DEVICETYPE_TOUCH.
++	 */
++	if (features->type == BAMBOO_PEN &&
++	    features->pktlen == WACOM_PKGLEN_BBTOUCH3)
++		features->device_type |= WACOM_DEVICETYPE_PAD;
++
++	/*
+ 	 * Raw Wacom-mode pen and touch events both come from interface
+ 	 * 0, whose HID descriptor has an application usage of 0xFF0D
+ 	 * (i.e., WACOM_VENDORDEFINED_PEN). We route pen packets back
+diff --git a/drivers/hwmon/max1111.c b/drivers/hwmon/max1111.c
+index 36544c4..303d0c9 100644
+--- a/drivers/hwmon/max1111.c
++++ b/drivers/hwmon/max1111.c
+@@ -85,6 +85,9 @@ static struct max1111_data *the_max1111;
+ 
+ int max1111_read_channel(int channel)
+ {
++	if (!the_max1111 || !the_max1111->spi)
++		return -ENODEV;
++
+ 	return max1111_read(&the_max1111->spi->dev, channel);
+ }
+ EXPORT_SYMBOL(max1111_read_channel);
+@@ -258,6 +261,9 @@ static int max1111_remove(struct spi_device *spi)
+ {
+ 	struct max1111_data *data = spi_get_drvdata(spi);
+ 
++#ifdef CONFIG_SHARPSL_PM
++	the_max1111 = NULL;
++#endif
+ 	hwmon_device_unregister(data->hwmon_dev);
+ 	sysfs_remove_group(&spi->dev.kobj, &max1110_attr_group);
+ 	sysfs_remove_group(&spi->dev.kobj, &max1111_attr_group);
+diff --git a/drivers/iio/accel/bmc150-accel-core.c b/drivers/iio/accel/bmc150-accel-core.c
+index 2d33f1e..291c61a 100644
+--- a/drivers/iio/accel/bmc150-accel-core.c
++++ b/drivers/iio/accel/bmc150-accel-core.c
+@@ -547,7 +547,7 @@ static int bmc150_accel_get_axis(struct bmc150_accel_data *data,
+ {
+ 	int ret;
+ 	int axis = chan->scan_index;
+-	unsigned int raw_val;
++	__le16 raw_val;
+ 
+ 	mutex_lock(&data->mutex);
+ 	ret = bmc150_accel_set_power_state(data, true);
+@@ -557,14 +557,14 @@ static int bmc150_accel_get_axis(struct bmc150_accel_data *data,
+ 	}
+ 
+ 	ret = regmap_bulk_read(data->regmap, BMC150_ACCEL_AXIS_TO_REG(axis),
+-			       &raw_val, 2);
++			       &raw_val, sizeof(raw_val));
+ 	if (ret < 0) {
+ 		dev_err(data->dev, "Error reading axis %d\n", axis);
+ 		bmc150_accel_set_power_state(data, false);
+ 		mutex_unlock(&data->mutex);
+ 		return ret;
+ 	}
+-	*val = sign_extend32(raw_val >> chan->scan_type.shift,
++	*val = sign_extend32(le16_to_cpu(raw_val) >> chan->scan_type.shift,
+ 			     chan->scan_type.realbits - 1);
+ 	ret = bmc150_accel_set_power_state(data, false);
+ 	mutex_unlock(&data->mutex);
+@@ -988,6 +988,7 @@ static const struct iio_event_spec bmc150_accel_event = {
+ 		.realbits = (bits),					\
+ 		.storagebits = 16,					\
+ 		.shift = 16 - (bits),					\
++		.endianness = IIO_LE,					\
+ 	},								\
+ 	.event_spec = &bmc150_accel_event,				\
+ 	.num_event_specs = 1						\
+diff --git a/drivers/iio/gyro/bmg160_core.c b/drivers/iio/gyro/bmg160_core.c
+index 02ff789..acb3b30 100644
+--- a/drivers/iio/gyro/bmg160_core.c
++++ b/drivers/iio/gyro/bmg160_core.c
+@@ -452,7 +452,7 @@ static int bmg160_get_temp(struct bmg160_data *data, int *val)
+ static int bmg160_get_axis(struct bmg160_data *data, int axis, int *val)
+ {
+ 	int ret;
+-	unsigned int raw_val;
++	__le16 raw_val;
+ 
+ 	mutex_lock(&data->mutex);
+ 	ret = bmg160_set_power_state(data, true);
+@@ -462,7 +462,7 @@ static int bmg160_get_axis(struct bmg160_data *data, int axis, int *val)
+ 	}
+ 
+ 	ret = regmap_bulk_read(data->regmap, BMG160_AXIS_TO_REG(axis), &raw_val,
+-			       2);
++			       sizeof(raw_val));
+ 	if (ret < 0) {
+ 		dev_err(data->dev, "Error reading axis %d\n", axis);
+ 		bmg160_set_power_state(data, false);
+@@ -470,7 +470,7 @@ static int bmg160_get_axis(struct bmg160_data *data, int axis, int *val)
+ 		return ret;
+ 	}
+ 
+-	*val = sign_extend32(raw_val, 15);
++	*val = sign_extend32(le16_to_cpu(raw_val), 15);
+ 	ret = bmg160_set_power_state(data, false);
+ 	mutex_unlock(&data->mutex);
+ 	if (ret < 0)
+@@ -733,6 +733,7 @@ static const struct iio_event_spec bmg160_event = {
+ 		.sign = 's',						\
+ 		.realbits = 16,					\
+ 		.storagebits = 16,					\
++		.endianness = IIO_LE,					\
+ 	},								\
+ 	.event_spec = &bmg160_event,					\
+ 	.num_event_specs = 1						\
+@@ -780,7 +781,7 @@ static irqreturn_t bmg160_trigger_handler(int irq, void *p)
+ 			mutex_unlock(&data->mutex);
+ 			goto err;
+ 		}
+-		data->buffer[i++] = ret;
++		data->buffer[i++] = val;
+ 	}
+ 	mutex_unlock(&data->mutex);
+ 
+diff --git a/drivers/iio/magnetometer/st_magn.h b/drivers/iio/magnetometer/st_magn.h
+index 06a4d9c..9daca46 100644
+--- a/drivers/iio/magnetometer/st_magn.h
++++ b/drivers/iio/magnetometer/st_magn.h
+@@ -44,6 +44,7 @@ static inline int st_magn_allocate_ring(struct iio_dev *indio_dev)
+ static inline void st_magn_deallocate_ring(struct iio_dev *indio_dev)
+ {
+ }
++#define ST_MAGN_TRIGGER_SET_STATE NULL
+ #endif /* CONFIG_IIO_BUFFER */
+ 
+ #endif /* ST_MAGN_H */
+diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
+index 0e3b009..515bb8b 100644
+--- a/drivers/iommu/iommu.c
++++ b/drivers/iommu/iommu.c
+@@ -848,7 +848,8 @@ struct iommu_group *iommu_group_get_for_dev(struct device *dev)
+ 	if (!group->default_domain) {
+ 		group->default_domain = __iommu_domain_alloc(dev->bus,
+ 							     IOMMU_DOMAIN_DMA);
+-		group->domain = group->default_domain;
++		if (!group->domain)
++			group->domain = group->default_domain;
+ 	}
+ 
+ 	ret = iommu_group_add_device(group, dev);
+diff --git a/drivers/media/platform/coda/coda-common.c b/drivers/media/platform/coda/coda-common.c
+index 15516a6..323aad3 100644
+--- a/drivers/media/platform/coda/coda-common.c
++++ b/drivers/media/platform/coda/coda-common.c
+@@ -2119,14 +2119,12 @@ static int coda_probe(struct platform_device *pdev)
+ 
+ 	pdev_id = of_id ? of_id->data : platform_get_device_id(pdev);
+ 
+-	if (of_id) {
++	if (of_id)
+ 		dev->devtype = of_id->data;
+-	} else if (pdev_id) {
++	else if (pdev_id)
+ 		dev->devtype = &coda_devdata[pdev_id->driver_data];
+-	} else {
+-		ret = -EINVAL;
+-		goto err_v4l2_register;
+-	}
++	else
++		return -EINVAL;
+ 
+ 	spin_lock_init(&dev->irqlock);
+ 	INIT_LIST_HEAD(&dev->instances);
+diff --git a/drivers/media/platform/vsp1/vsp1_sru.c b/drivers/media/platform/vsp1/vsp1_sru.c
+index 6310aca..d41ae95 100644
+--- a/drivers/media/platform/vsp1/vsp1_sru.c
++++ b/drivers/media/platform/vsp1/vsp1_sru.c
+@@ -154,6 +154,7 @@ static int sru_s_stream(struct v4l2_subdev *subdev, int enable)
+ 	mutex_lock(sru->ctrls.lock);
+ 	ctrl0 |= vsp1_sru_read(sru, VI6_SRU_CTRL0)
+ 	       & (VI6_SRU_CTRL0_PARAM0_MASK | VI6_SRU_CTRL0_PARAM1_MASK);
++	vsp1_sru_write(sru, VI6_SRU_CTRL0, ctrl0);
+ 	mutex_unlock(sru->ctrls.lock);
+ 
+ 	vsp1_sru_write(sru, VI6_SRU_CTRL1, VI6_SRU_CTRL1_PARAM5);
+diff --git a/drivers/media/usb/au0828/au0828-core.c b/drivers/media/usb/au0828/au0828-core.c
+index 0934024..d91ded7 100644
+--- a/drivers/media/usb/au0828/au0828-core.c
++++ b/drivers/media/usb/au0828/au0828-core.c
+@@ -159,7 +159,7 @@ static void au0828_usb_disconnect(struct usb_interface *interface)
+ 	   Set the status so poll routines can check and avoid
+ 	   access after disconnect.
+ 	*/
+-	dev->dev_state = DEV_DISCONNECTED;
++	set_bit(DEV_DISCONNECTED, &dev->dev_state);
+ 
+ 	au0828_rc_unregister(dev);
+ 	/* Digital TV */
+diff --git a/drivers/media/usb/au0828/au0828-input.c b/drivers/media/usb/au0828/au0828-input.c
+index b0f0679..3d6687f 100644
+--- a/drivers/media/usb/au0828/au0828-input.c
++++ b/drivers/media/usb/au0828/au0828-input.c
+@@ -130,7 +130,7 @@ static int au0828_get_key_au8522(struct au0828_rc *ir)
+ 	bool first = true;
+ 
+ 	/* do nothing if device is disconnected */
+-	if (ir->dev->dev_state == DEV_DISCONNECTED)
++	if (test_bit(DEV_DISCONNECTED, &ir->dev->dev_state))
+ 		return 0;
+ 
+ 	/* Check IR int */
+@@ -260,7 +260,7 @@ static void au0828_rc_stop(struct rc_dev *rc)
+ 	cancel_delayed_work_sync(&ir->work);
+ 
+ 	/* do nothing if device is disconnected */
+-	if (ir->dev->dev_state != DEV_DISCONNECTED) {
++	if (!test_bit(DEV_DISCONNECTED, &ir->dev->dev_state)) {
+ 		/* Disable IR */
+ 		au8522_rc_clear(ir, 0xe0, 1 << 4);
+ 	}
+diff --git a/drivers/media/usb/au0828/au0828-video.c b/drivers/media/usb/au0828/au0828-video.c
+index 45c622e..7b2fe1b 100644
+--- a/drivers/media/usb/au0828/au0828-video.c
++++ b/drivers/media/usb/au0828/au0828-video.c
+@@ -104,14 +104,13 @@ static inline void print_err_status(struct au0828_dev *dev,
+ 
+ static int check_dev(struct au0828_dev *dev)
+ {
+-	if (dev->dev_state & DEV_DISCONNECTED) {
++	if (test_bit(DEV_DISCONNECTED, &dev->dev_state)) {
+ 		pr_info("v4l2 ioctl: device not present\n");
+ 		return -ENODEV;
+ 	}
+ 
+-	if (dev->dev_state & DEV_MISCONFIGURED) {
+-		pr_info("v4l2 ioctl: device is misconfigured; "
+-		       "close and open it again\n");
++	if (test_bit(DEV_MISCONFIGURED, &dev->dev_state)) {
++		pr_info("v4l2 ioctl: device is misconfigured; close and open it again\n");
+ 		return -EIO;
+ 	}
+ 	return 0;
+@@ -519,8 +518,8 @@ static inline int au0828_isoc_copy(struct au0828_dev *dev, struct urb *urb)
+ 	if (!dev)
+ 		return 0;
+ 
+-	if ((dev->dev_state & DEV_DISCONNECTED) ||
+-	    (dev->dev_state & DEV_MISCONFIGURED))
++	if (test_bit(DEV_DISCONNECTED, &dev->dev_state) ||
++	    test_bit(DEV_MISCONFIGURED, &dev->dev_state))
+ 		return 0;
+ 
+ 	if (urb->status < 0) {
+@@ -766,10 +765,10 @@ static int au0828_stream_interrupt(struct au0828_dev *dev)
+ 	int ret = 0;
+ 
+ 	dev->stream_state = STREAM_INTERRUPT;
+-	if (dev->dev_state == DEV_DISCONNECTED)
++	if (test_bit(DEV_DISCONNECTED, &dev->dev_state))
+ 		return -ENODEV;
+ 	else if (ret) {
+-		dev->dev_state = DEV_MISCONFIGURED;
++		set_bit(DEV_MISCONFIGURED, &dev->dev_state);
+ 		dprintk(1, "%s device is misconfigured!\n", __func__);
+ 		return ret;
+ 	}
+@@ -958,7 +957,7 @@ static int au0828_v4l2_open(struct file *filp)
+ 	int ret;
+ 
+ 	dprintk(1,
+-		"%s called std_set %d dev_state %d stream users %d users %d\n",
++		"%s called std_set %d dev_state %ld stream users %d users %d\n",
+ 		__func__, dev->std_set_in_tuner_core, dev->dev_state,
+ 		dev->streaming_users, dev->users);
+ 
+@@ -977,7 +976,7 @@ static int au0828_v4l2_open(struct file *filp)
+ 		au0828_analog_stream_enable(dev);
+ 		au0828_analog_stream_reset(dev);
+ 		dev->stream_state = STREAM_OFF;
+-		dev->dev_state |= DEV_INITIALIZED;
++		set_bit(DEV_INITIALIZED, &dev->dev_state);
+ 	}
+ 	dev->users++;
+ 	mutex_unlock(&dev->lock);
+@@ -991,7 +990,7 @@ static int au0828_v4l2_close(struct file *filp)
+ 	struct video_device *vdev = video_devdata(filp);
+ 
+ 	dprintk(1,
+-		"%s called std_set %d dev_state %d stream users %d users %d\n",
++		"%s called std_set %d dev_state %ld stream users %d users %d\n",
+ 		__func__, dev->std_set_in_tuner_core, dev->dev_state,
+ 		dev->streaming_users, dev->users);
+ 
+@@ -1007,7 +1006,7 @@ static int au0828_v4l2_close(struct file *filp)
+ 		del_timer_sync(&dev->vbi_timeout);
+ 	}
+ 
+-	if (dev->dev_state == DEV_DISCONNECTED)
++	if (test_bit(DEV_DISCONNECTED, &dev->dev_state))
+ 		goto end;
+ 
+ 	if (dev->users == 1) {
+@@ -1036,7 +1035,7 @@ static void au0828_init_tuner(struct au0828_dev *dev)
+ 		.type = V4L2_TUNER_ANALOG_TV,
+ 	};
+ 
+-	dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
++	dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
+ 		dev->std_set_in_tuner_core, dev->dev_state);
+ 
+ 	if (dev->std_set_in_tuner_core)
+@@ -1108,7 +1107,7 @@ static int vidioc_querycap(struct file *file, void  *priv,
+ 	struct video_device *vdev = video_devdata(file);
+ 	struct au0828_dev *dev = video_drvdata(file);
+ 
+-	dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
++	dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
+ 		dev->std_set_in_tuner_core, dev->dev_state);
+ 
+ 	strlcpy(cap->driver, "au0828", sizeof(cap->driver));
+@@ -1151,7 +1150,7 @@ static int vidioc_g_fmt_vid_cap(struct file *file, void *priv,
+ {
+ 	struct au0828_dev *dev = video_drvdata(file);
+ 
+-	dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
++	dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
+ 		dev->std_set_in_tuner_core, dev->dev_state);
+ 
+ 	f->fmt.pix.width = dev->width;
+@@ -1170,7 +1169,7 @@ static int vidioc_try_fmt_vid_cap(struct file *file, void *priv,
+ {
+ 	struct au0828_dev *dev = video_drvdata(file);
+ 
+-	dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
++	dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
+ 		dev->std_set_in_tuner_core, dev->dev_state);
+ 
+ 	return au0828_set_format(dev, VIDIOC_TRY_FMT, f);
+@@ -1182,7 +1181,7 @@ static int vidioc_s_fmt_vid_cap(struct file *file, void *priv,
+ 	struct au0828_dev *dev = video_drvdata(file);
+ 	int rc;
+ 
+-	dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
++	dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
+ 		dev->std_set_in_tuner_core, dev->dev_state);
+ 
+ 	rc = check_dev(dev);
+@@ -1204,7 +1203,7 @@ static int vidioc_s_std(struct file *file, void *priv, v4l2_std_id norm)
+ {
+ 	struct au0828_dev *dev = video_drvdata(file);
+ 
+-	dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
++	dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
+ 		dev->std_set_in_tuner_core, dev->dev_state);
+ 
+ 	if (norm == dev->std)
+@@ -1236,7 +1235,7 @@ static int vidioc_g_std(struct file *file, void *priv, v4l2_std_id *norm)
+ {
+ 	struct au0828_dev *dev = video_drvdata(file);
+ 
+-	dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
++	dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
+ 		dev->std_set_in_tuner_core, dev->dev_state);
+ 
+ 	*norm = dev->std;
+@@ -1259,7 +1258,7 @@ static int vidioc_enum_input(struct file *file, void *priv,
+ 		[AU0828_VMUX_DEBUG] = "tv debug"
+ 	};
+ 
+-	dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
++	dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
+ 		dev->std_set_in_tuner_core, dev->dev_state);
+ 
+ 	tmp = input->index;
+@@ -1289,7 +1288,7 @@ static int vidioc_g_input(struct file *file, void *priv, unsigned int *i)
+ {
+ 	struct au0828_dev *dev = video_drvdata(file);
+ 
+-	dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
++	dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
+ 		dev->std_set_in_tuner_core, dev->dev_state);
+ 
+ 	*i = dev->ctrl_input;
+@@ -1300,7 +1299,7 @@ static void au0828_s_input(struct au0828_dev *dev, int index)
+ {
+ 	int i;
+ 
+-	dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
++	dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
+ 		dev->std_set_in_tuner_core, dev->dev_state);
+ 
+ 	switch (AUVI_INPUT(index).type) {
+@@ -1385,7 +1384,7 @@ static int vidioc_g_audio(struct file *file, void *priv, struct v4l2_audio *a)
+ {
+ 	struct au0828_dev *dev = video_drvdata(file);
+ 
+-	dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
++	dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
+ 		dev->std_set_in_tuner_core, dev->dev_state);
+ 
+ 	a->index = dev->ctrl_ainput;
+@@ -1405,7 +1404,7 @@ static int vidioc_s_audio(struct file *file, void *priv, const struct v4l2_audio
+ 	if (a->index != dev->ctrl_ainput)
+ 		return -EINVAL;
+ 
+-	dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
++	dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
+ 		dev->std_set_in_tuner_core, dev->dev_state);
+ 	return 0;
+ }
+@@ -1417,7 +1416,7 @@ static int vidioc_g_tuner(struct file *file, void *priv, struct v4l2_tuner *t)
+ 	if (t->index != 0)
+ 		return -EINVAL;
+ 
+-	dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
++	dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
+ 		dev->std_set_in_tuner_core, dev->dev_state);
+ 
+ 	strcpy(t->name, "Auvitek tuner");
+@@ -1437,7 +1436,7 @@ static int vidioc_s_tuner(struct file *file, void *priv,
+ 	if (t->index != 0)
+ 		return -EINVAL;
+ 
+-	dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
++	dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
+ 		dev->std_set_in_tuner_core, dev->dev_state);
+ 
+ 	au0828_init_tuner(dev);
+@@ -1459,7 +1458,7 @@ static int vidioc_g_frequency(struct file *file, void *priv,
+ 
+ 	if (freq->tuner != 0)
+ 		return -EINVAL;
+-	dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
++	dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
+ 		dev->std_set_in_tuner_core, dev->dev_state);
+ 	freq->frequency = dev->ctrl_freq;
+ 	return 0;
+@@ -1474,7 +1473,7 @@ static int vidioc_s_frequency(struct file *file, void *priv,
+ 	if (freq->tuner != 0)
+ 		return -EINVAL;
+ 
+-	dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
++	dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
+ 		dev->std_set_in_tuner_core, dev->dev_state);
+ 
+ 	au0828_init_tuner(dev);
+@@ -1500,7 +1499,7 @@ static int vidioc_g_fmt_vbi_cap(struct file *file, void *priv,
+ {
+ 	struct au0828_dev *dev = video_drvdata(file);
+ 
+-	dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
++	dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
+ 		dev->std_set_in_tuner_core, dev->dev_state);
+ 
+ 	format->fmt.vbi.samples_per_line = dev->vbi_width;
+@@ -1526,7 +1525,7 @@ static int vidioc_cropcap(struct file *file, void *priv,
+ 	if (cc->type != V4L2_BUF_TYPE_VIDEO_CAPTURE)
+ 		return -EINVAL;
+ 
+-	dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
++	dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
+ 		dev->std_set_in_tuner_core, dev->dev_state);
+ 
+ 	cc->bounds.left = 0;
+@@ -1548,7 +1547,7 @@ static int vidioc_g_register(struct file *file, void *priv,
+ {
+ 	struct au0828_dev *dev = video_drvdata(file);
+ 
+-	dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
++	dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
+ 		dev->std_set_in_tuner_core, dev->dev_state);
+ 
+ 	reg->val = au0828_read(dev, reg->reg);
+@@ -1561,7 +1560,7 @@ static int vidioc_s_register(struct file *file, void *priv,
+ {
+ 	struct au0828_dev *dev = video_drvdata(file);
+ 
+-	dprintk(1, "%s called std_set %d dev_state %d\n", __func__,
++	dprintk(1, "%s called std_set %d dev_state %ld\n", __func__,
+ 		dev->std_set_in_tuner_core, dev->dev_state);
+ 
+ 	return au0828_writereg(dev, reg->reg, reg->val);
+diff --git a/drivers/media/usb/au0828/au0828.h b/drivers/media/usb/au0828/au0828.h
+index 60b5939..d1b6405a 100644
+--- a/drivers/media/usb/au0828/au0828.h
++++ b/drivers/media/usb/au0828/au0828.h
+@@ -21,6 +21,7 @@
+ 
+ #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
+ 
++#include <linux/bitops.h>
+ #include <linux/usb.h>
+ #include <linux/i2c.h>
+ #include <linux/i2c-algo-bit.h>
+@@ -122,9 +123,9 @@ enum au0828_stream_state {
+ 
+ /* device state */
+ enum au0828_dev_state {
+-	DEV_INITIALIZED = 0x01,
+-	DEV_DISCONNECTED = 0x02,
+-	DEV_MISCONFIGURED = 0x04
++	DEV_INITIALIZED = 0,
++	DEV_DISCONNECTED = 1,
++	DEV_MISCONFIGURED = 2
+ };
+ 
+ struct au0828_dev;
+@@ -248,7 +249,7 @@ struct au0828_dev {
+ 	int input_type;
+ 	int std_set_in_tuner_core;
+ 	unsigned int ctrl_input;
+-	enum au0828_dev_state dev_state;
++	long unsigned int dev_state; /* defined at enum au0828_dev_state */;
+ 	enum au0828_stream_state stream_state;
+ 	wait_queue_head_t open;
+ 
+diff --git a/drivers/media/usb/usbvision/usbvision-video.c b/drivers/media/usb/usbvision/usbvision-video.c
+index b693206..d1dc1a1 100644
+--- a/drivers/media/usb/usbvision/usbvision-video.c
++++ b/drivers/media/usb/usbvision/usbvision-video.c
+@@ -1463,9 +1463,23 @@ static int usbvision_probe(struct usb_interface *intf,
+ 
+ 	if (usbvision_device_data[model].interface >= 0)
+ 		interface = &dev->actconfig->interface[usbvision_device_data[model].interface]->altsetting[0];
+-	else
++	else if (ifnum < dev->actconfig->desc.bNumInterfaces)
+ 		interface = &dev->actconfig->interface[ifnum]->altsetting[0];
++	else {
++		dev_err(&intf->dev, "interface %d is invalid, max is %d\n",
++		    ifnum, dev->actconfig->desc.bNumInterfaces - 1);
++		ret = -ENODEV;
++		goto err_usb;
++	}
++
++	if (interface->desc.bNumEndpoints < 2) {
++		dev_err(&intf->dev, "interface %d has %d endpoints, but must"
++		    " have minimum 2\n", ifnum, interface->desc.bNumEndpoints);
++		ret = -ENODEV;
++		goto err_usb;
++	}
+ 	endpoint = &interface->endpoint[1].desc;
++
+ 	if (!usb_endpoint_xfer_isoc(endpoint)) {
+ 		dev_err(&intf->dev, "%s: interface %d. has non-ISO endpoint!\n",
+ 		    __func__, ifnum);
+diff --git a/drivers/mmc/host/sdhci-pci-core.c b/drivers/mmc/host/sdhci-pci-core.c
+index 45ee07d..6101548 100644
+--- a/drivers/mmc/host/sdhci-pci-core.c
++++ b/drivers/mmc/host/sdhci-pci-core.c
+@@ -390,6 +390,7 @@ static int byt_sd_probe_slot(struct sdhci_pci_slot *slot)
+ 	slot->cd_idx = 0;
+ 	slot->cd_override_level = true;
+ 	if (slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_BXT_SD ||
++	    slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_BXTM_SD ||
+ 	    slot->chip->pdev->device == PCI_DEVICE_ID_INTEL_APL_SD)
+ 		slot->host->mmc_host_ops.get_cd = bxt_get_cd;
+ 
+@@ -1173,6 +1174,30 @@ static const struct pci_device_id pci_ids[] = {
+ 
+ 	{
+ 		.vendor		= PCI_VENDOR_ID_INTEL,
++		.device		= PCI_DEVICE_ID_INTEL_BXTM_EMMC,
++		.subvendor	= PCI_ANY_ID,
++		.subdevice	= PCI_ANY_ID,
++		.driver_data	= (kernel_ulong_t)&sdhci_intel_byt_emmc,
++	},
++
++	{
++		.vendor		= PCI_VENDOR_ID_INTEL,
++		.device		= PCI_DEVICE_ID_INTEL_BXTM_SDIO,
++		.subvendor	= PCI_ANY_ID,
++		.subdevice	= PCI_ANY_ID,
++		.driver_data	= (kernel_ulong_t)&sdhci_intel_byt_sdio,
++	},
++
++	{
++		.vendor		= PCI_VENDOR_ID_INTEL,
++		.device		= PCI_DEVICE_ID_INTEL_BXTM_SD,
++		.subvendor	= PCI_ANY_ID,
++		.subdevice	= PCI_ANY_ID,
++		.driver_data	= (kernel_ulong_t)&sdhci_intel_byt_sd,
++	},
++
++	{
++		.vendor		= PCI_VENDOR_ID_INTEL,
+ 		.device		= PCI_DEVICE_ID_INTEL_APL_EMMC,
+ 		.subvendor	= PCI_ANY_ID,
+ 		.subdevice	= PCI_ANY_ID,
+diff --git a/drivers/mmc/host/sdhci-pci.h b/drivers/mmc/host/sdhci-pci.h
+index d1a0b4d..89e7151 100644
+--- a/drivers/mmc/host/sdhci-pci.h
++++ b/drivers/mmc/host/sdhci-pci.h
+@@ -28,6 +28,9 @@
+ #define PCI_DEVICE_ID_INTEL_BXT_SD	0x0aca
+ #define PCI_DEVICE_ID_INTEL_BXT_EMMC	0x0acc
+ #define PCI_DEVICE_ID_INTEL_BXT_SDIO	0x0ad0
++#define PCI_DEVICE_ID_INTEL_BXTM_SD	0x1aca
++#define PCI_DEVICE_ID_INTEL_BXTM_EMMC	0x1acc
++#define PCI_DEVICE_ID_INTEL_BXTM_SDIO	0x1ad0
+ #define PCI_DEVICE_ID_INTEL_APL_SD	0x5aca
+ #define PCI_DEVICE_ID_INTEL_APL_EMMC	0x5acc
+ #define PCI_DEVICE_ID_INTEL_APL_SDIO	0x5ad0
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 28bbca0..b3d70a7 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -3260,6 +3260,30 @@ static int bond_close(struct net_device *bond_dev)
+ 	return 0;
+ }
+ 
++/* fold stats, assuming all rtnl_link_stats64 fields are u64, but
++ * that some drivers can provide 32bit values only.
++ */
++static void bond_fold_stats(struct rtnl_link_stats64 *_res,
++			    const struct rtnl_link_stats64 *_new,
++			    const struct rtnl_link_stats64 *_old)
++{
++	const u64 *new = (const u64 *)_new;
++	const u64 *old = (const u64 *)_old;
++	u64 *res = (u64 *)_res;
++	int i;
++
++	for (i = 0; i < sizeof(*_res) / sizeof(u64); i++) {
++		u64 nv = new[i];
++		u64 ov = old[i];
++
++		/* detects if this particular field is 32bit only */
++		if (((nv | ov) >> 32) == 0)
++			res[i] += (u32)nv - (u32)ov;
++		else
++			res[i] += nv - ov;
++	}
++}
++
+ static struct rtnl_link_stats64 *bond_get_stats(struct net_device *bond_dev,
+ 						struct rtnl_link_stats64 *stats)
+ {
+@@ -3268,43 +3292,23 @@ static struct rtnl_link_stats64 *bond_get_stats(struct net_device *bond_dev,
+ 	struct list_head *iter;
+ 	struct slave *slave;
+ 
++	spin_lock(&bond->stats_lock);
+ 	memcpy(stats, &bond->bond_stats, sizeof(*stats));
+ 
+-	bond_for_each_slave(bond, slave, iter) {
+-		const struct rtnl_link_stats64 *sstats =
++	rcu_read_lock();
++	bond_for_each_slave_rcu(bond, slave, iter) {
++		const struct rtnl_link_stats64 *new =
+ 			dev_get_stats(slave->dev, &temp);
+-		struct rtnl_link_stats64 *pstats = &slave->slave_stats;
+-
+-		stats->rx_packets +=  sstats->rx_packets - pstats->rx_packets;
+-		stats->rx_bytes += sstats->rx_bytes - pstats->rx_bytes;
+-		stats->rx_errors += sstats->rx_errors - pstats->rx_errors;
+-		stats->rx_dropped += sstats->rx_dropped - pstats->rx_dropped;
+-
+-		stats->tx_packets += sstats->tx_packets - pstats->tx_packets;;
+-		stats->tx_bytes += sstats->tx_bytes - pstats->tx_bytes;
+-		stats->tx_errors += sstats->tx_errors - pstats->tx_errors;
+-		stats->tx_dropped += sstats->tx_dropped - pstats->tx_dropped;
+-
+-		stats->multicast += sstats->multicast - pstats->multicast;
+-		stats->collisions += sstats->collisions - pstats->collisions;
+-
+-		stats->rx_length_errors += sstats->rx_length_errors - pstats->rx_length_errors;
+-		stats->rx_over_errors += sstats->rx_over_errors - pstats->rx_over_errors;
+-		stats->rx_crc_errors += sstats->rx_crc_errors - pstats->rx_crc_errors;
+-		stats->rx_frame_errors += sstats->rx_frame_errors - pstats->rx_frame_errors;
+-		stats->rx_fifo_errors += sstats->rx_fifo_errors - pstats->rx_fifo_errors;
+-		stats->rx_missed_errors += sstats->rx_missed_errors - pstats->rx_missed_errors;
+-
+-		stats->tx_aborted_errors += sstats->tx_aborted_errors - pstats->tx_aborted_errors;
+-		stats->tx_carrier_errors += sstats->tx_carrier_errors - pstats->tx_carrier_errors;
+-		stats->tx_fifo_errors += sstats->tx_fifo_errors - pstats->tx_fifo_errors;
+-		stats->tx_heartbeat_errors += sstats->tx_heartbeat_errors - pstats->tx_heartbeat_errors;
+-		stats->tx_window_errors += sstats->tx_window_errors - pstats->tx_window_errors;
++
++		bond_fold_stats(stats, new, &slave->slave_stats);
+ 
+ 		/* save off the slave stats for the next run */
+-		memcpy(pstats, sstats, sizeof(*sstats));
++		memcpy(&slave->slave_stats, new, sizeof(*new));
+ 	}
++	rcu_read_unlock();
++
+ 	memcpy(&bond->bond_stats, stats, sizeof(*stats));
++	spin_unlock(&bond->stats_lock);
+ 
+ 	return stats;
+ }
+@@ -4118,6 +4122,7 @@ void bond_setup(struct net_device *bond_dev)
+ 	struct bonding *bond = netdev_priv(bond_dev);
+ 
+ 	spin_lock_init(&bond->mode_lock);
++	spin_lock_init(&bond->stats_lock);
+ 	bond->params = bonding_defaults;
+ 
+ 	/* Initialize pointers */
+diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+index 17f017a..0fb3f8d 100644
+--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
++++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+@@ -1197,7 +1197,7 @@ static unsigned int __bcmgenet_tx_reclaim(struct net_device *dev,
+ 			dev->stats.tx_bytes += tx_cb_ptr->skb->len;
+ 			dma_unmap_single(&dev->dev,
+ 					 dma_unmap_addr(tx_cb_ptr, dma_addr),
+-					 tx_cb_ptr->skb->len,
++					 dma_unmap_len(tx_cb_ptr, dma_len),
+ 					 DMA_TO_DEVICE);
+ 			bcmgenet_free_cb(tx_cb_ptr);
+ 		} else if (dma_unmap_addr(tx_cb_ptr, dma_addr)) {
+@@ -1308,7 +1308,7 @@ static int bcmgenet_xmit_single(struct net_device *dev,
+ 	}
+ 
+ 	dma_unmap_addr_set(tx_cb_ptr, dma_addr, mapping);
+-	dma_unmap_len_set(tx_cb_ptr, dma_len, skb->len);
++	dma_unmap_len_set(tx_cb_ptr, dma_len, skb_len);
+ 	length_status = (skb_len << DMA_BUFLENGTH_SHIFT) | dma_desc_flags |
+ 			(priv->hw_params->qtag_mask << DMA_TX_QTAG_SHIFT) |
+ 			DMA_TX_APPEND_CRC;
+diff --git a/drivers/net/ethernet/jme.c b/drivers/net/ethernet/jme.c
+index 060dd39..973dade 100644
+--- a/drivers/net/ethernet/jme.c
++++ b/drivers/net/ethernet/jme.c
+@@ -3312,13 +3312,14 @@ jme_resume(struct device *dev)
+ 		jme_reset_phy_processor(jme);
+ 	jme_phy_calibration(jme);
+ 	jme_phy_setEA(jme);
+-	jme_start_irq(jme);
+ 	netif_device_attach(netdev);
+ 
+ 	atomic_inc(&jme->link_changing);
+ 
+ 	jme_reset_link(jme);
+ 
++	jme_start_irq(jme);
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+index cad6c44..d314d96 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
++++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
+@@ -3132,7 +3132,7 @@ static int verify_qp_parameters(struct mlx4_dev *dev,
+ 		case QP_TRANS_RTS2RTS:
+ 		case QP_TRANS_SQD2SQD:
+ 		case QP_TRANS_SQD2RTS:
+-			if (slave != mlx4_master_func_num(dev))
++			if (slave != mlx4_master_func_num(dev)) {
+ 				if (optpar & MLX4_QP_OPTPAR_PRIMARY_ADDR_PATH) {
+ 					port = (qp_ctx->pri_path.sched_queue >> 6 & 1) + 1;
+ 					if (dev->caps.port_mask[port] != MLX4_PORT_TYPE_IB)
+@@ -3151,6 +3151,7 @@ static int verify_qp_parameters(struct mlx4_dev *dev,
+ 					if (qp_ctx->alt_path.mgid_index >= num_gids)
+ 						return -EINVAL;
+ 				}
++			}
+ 			break;
+ 		default:
+ 			break;
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
+index 4365c8b..605f641 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum.h
+@@ -61,6 +61,8 @@ struct mlxsw_sp {
+ #define MLXSW_SP_DEFAULT_LEARNING_INTERVAL 100
+ 		unsigned int interval; /* ms */
+ 	} fdb_notify;
++#define MLXSW_SP_MIN_AGEING_TIME 10
++#define MLXSW_SP_MAX_AGEING_TIME 1000000
+ #define MLXSW_SP_DEFAULT_AGEING_TIME 300
+ 	u32 ageing_time;
+ 	struct {
+diff --git a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+index 7dbeafa..d4c4c2b 100644
+--- a/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
++++ b/drivers/net/ethernet/mellanox/mlxsw/spectrum_switchdev.c
+@@ -232,8 +232,13 @@ static int mlxsw_sp_port_attr_br_ageing_set(struct mlxsw_sp_port *mlxsw_sp_port,
+ 	unsigned long ageing_jiffies = clock_t_to_jiffies(ageing_clock_t);
+ 	u32 ageing_time = jiffies_to_msecs(ageing_jiffies) / 1000;
+ 
+-	if (switchdev_trans_ph_prepare(trans))
+-		return 0;
++	if (switchdev_trans_ph_prepare(trans)) {
++		if (ageing_time < MLXSW_SP_MIN_AGEING_TIME ||
++		    ageing_time > MLXSW_SP_MAX_AGEING_TIME)
++			return -ERANGE;
++		else
++			return 0;
++	}
+ 
+ 	return mlxsw_sp_ageing_set(mlxsw_sp, ageing_time);
+ }
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+index 46bbea8..55007f1 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic.h
+@@ -566,6 +566,7 @@ struct qlcnic_adapter_stats {
+ 	u64  tx_dma_map_error;
+ 	u64  spurious_intr;
+ 	u64  mac_filter_limit_overrun;
++	u64  mbx_spurious_intr;
+ };
+ 
+ /*
+@@ -1099,7 +1100,7 @@ struct qlcnic_mailbox {
+ 	unsigned long		status;
+ 	spinlock_t		queue_lock;	/* Mailbox queue lock */
+ 	spinlock_t		aen_lock;	/* Mailbox response/AEN lock */
+-	atomic_t		rsp_status;
++	u32			rsp_status;
+ 	u32			num_cmds;
+ };
+ 
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+index 37a731b..f9640d5ce 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_83xx_hw.c
+@@ -491,7 +491,7 @@ irqreturn_t qlcnic_83xx_clear_legacy_intr(struct qlcnic_adapter *adapter)
+ 
+ static inline void qlcnic_83xx_notify_mbx_response(struct qlcnic_mailbox *mbx)
+ {
+-	atomic_set(&mbx->rsp_status, QLC_83XX_MBX_RESPONSE_ARRIVED);
++	mbx->rsp_status = QLC_83XX_MBX_RESPONSE_ARRIVED;
+ 	complete(&mbx->completion);
+ }
+ 
+@@ -510,7 +510,7 @@ static void qlcnic_83xx_poll_process_aen(struct qlcnic_adapter *adapter)
+ 	if (event &  QLCNIC_MBX_ASYNC_EVENT) {
+ 		__qlcnic_83xx_process_aen(adapter);
+ 	} else {
+-		if (atomic_read(&mbx->rsp_status) != rsp_status)
++		if (mbx->rsp_status != rsp_status)
+ 			qlcnic_83xx_notify_mbx_response(mbx);
+ 	}
+ out:
+@@ -1023,7 +1023,7 @@ static void qlcnic_83xx_process_aen(struct qlcnic_adapter *adapter)
+ 		if (event &  QLCNIC_MBX_ASYNC_EVENT) {
+ 			__qlcnic_83xx_process_aen(adapter);
+ 		} else {
+-			if (atomic_read(&mbx->rsp_status) != rsp_status)
++			if (mbx->rsp_status != rsp_status)
+ 				qlcnic_83xx_notify_mbx_response(mbx);
+ 		}
+ 	}
+@@ -2338,9 +2338,9 @@ static void qlcnic_83xx_handle_link_aen(struct qlcnic_adapter *adapter,
+ 
+ static irqreturn_t qlcnic_83xx_handle_aen(int irq, void *data)
+ {
++	u32 mask, resp, event, rsp_status = QLC_83XX_MBX_RESPONSE_ARRIVED;
+ 	struct qlcnic_adapter *adapter = data;
+ 	struct qlcnic_mailbox *mbx;
+-	u32 mask, resp, event;
+ 	unsigned long flags;
+ 
+ 	mbx = adapter->ahw->mailbox;
+@@ -2350,10 +2350,14 @@ static irqreturn_t qlcnic_83xx_handle_aen(int irq, void *data)
+ 		goto out;
+ 
+ 	event = readl(QLCNIC_MBX_FW(adapter->ahw, 0));
+-	if (event &  QLCNIC_MBX_ASYNC_EVENT)
++	if (event &  QLCNIC_MBX_ASYNC_EVENT) {
+ 		__qlcnic_83xx_process_aen(adapter);
+-	else
+-		qlcnic_83xx_notify_mbx_response(mbx);
++	} else {
++		if (mbx->rsp_status != rsp_status)
++			qlcnic_83xx_notify_mbx_response(mbx);
++		else
++			adapter->stats.mbx_spurious_intr++;
++	}
+ 
+ out:
+ 	mask = QLCRDX(adapter->ahw, QLCNIC_DEF_INT_MASK);
+@@ -4050,10 +4054,10 @@ static void qlcnic_83xx_mailbox_worker(struct work_struct *work)
+ 	struct qlcnic_adapter *adapter = mbx->adapter;
+ 	const struct qlcnic_mbx_ops *mbx_ops = mbx->ops;
+ 	struct device *dev = &adapter->pdev->dev;
+-	atomic_t *rsp_status = &mbx->rsp_status;
+ 	struct list_head *head = &mbx->cmd_q;
+ 	struct qlcnic_hardware_context *ahw;
+ 	struct qlcnic_cmd_args *cmd = NULL;
++	unsigned long flags;
+ 
+ 	ahw = adapter->ahw;
+ 
+@@ -4063,7 +4067,9 @@ static void qlcnic_83xx_mailbox_worker(struct work_struct *work)
+ 			return;
+ 		}
+ 
+-		atomic_set(rsp_status, QLC_83XX_MBX_RESPONSE_WAIT);
++		spin_lock_irqsave(&mbx->aen_lock, flags);
++		mbx->rsp_status = QLC_83XX_MBX_RESPONSE_WAIT;
++		spin_unlock_irqrestore(&mbx->aen_lock, flags);
+ 
+ 		spin_lock(&mbx->queue_lock);
+ 
+diff --git a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+index 494e810..0a2318c 100644
+--- a/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
++++ b/drivers/net/ethernet/qlogic/qlcnic/qlcnic_ethtool.c
+@@ -59,7 +59,8 @@ static const struct qlcnic_stats qlcnic_gstrings_stats[] = {
+ 	 QLC_OFF(stats.mac_filter_limit_overrun)},
+ 	{"spurious intr", QLC_SIZEOF(stats.spurious_intr),
+ 	 QLC_OFF(stats.spurious_intr)},
+-
++	{"mbx spurious intr", QLC_SIZEOF(stats.mbx_spurious_intr),
++	 QLC_OFF(stats.mbx_spurious_intr)},
+ };
+ 
+ static const char qlcnic_device_gstrings_stats[][ETH_GSTRING_LEN] = {
+diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
+index 9979764..b28e73e 100644
+--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c
++++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c
+@@ -1648,7 +1648,18 @@ static void ql_process_mac_rx_skb(struct ql_adapter *qdev,
+ 		return;
+ 	}
+ 	skb_reserve(new_skb, NET_IP_ALIGN);
++
++	pci_dma_sync_single_for_cpu(qdev->pdev,
++				    dma_unmap_addr(sbq_desc, mapaddr),
++				    dma_unmap_len(sbq_desc, maplen),
++				    PCI_DMA_FROMDEVICE);
++
+ 	memcpy(skb_put(new_skb, length), skb->data, length);
++
++	pci_dma_sync_single_for_device(qdev->pdev,
++				       dma_unmap_addr(sbq_desc, mapaddr),
++				       dma_unmap_len(sbq_desc, maplen),
++				       PCI_DMA_FROMDEVICE);
+ 	skb = new_skb;
+ 
+ 	/* Frame error, so drop the packet. */
+diff --git a/drivers/net/ethernet/qualcomm/qca_spi.c b/drivers/net/ethernet/qualcomm/qca_spi.c
+index 689a4a5..1ef0393 100644
+--- a/drivers/net/ethernet/qualcomm/qca_spi.c
++++ b/drivers/net/ethernet/qualcomm/qca_spi.c
+@@ -811,7 +811,7 @@ qcaspi_netdev_setup(struct net_device *dev)
+ 	dev->netdev_ops = &qcaspi_netdev_ops;
+ 	qcaspi_set_ethtool_ops(dev);
+ 	dev->watchdog_timeo = QCASPI_TX_TIMEOUT;
+-	dev->flags = IFF_MULTICAST;
++	dev->priv_flags &= ~IFF_TX_SKB_SHARING;
+ 	dev->tx_queue_len = 100;
+ 
+ 	qca = netdev_priv(dev);
+diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c
+index 6a8fc0f..36fc942 100644
+--- a/drivers/net/ethernet/renesas/sh_eth.c
++++ b/drivers/net/ethernet/renesas/sh_eth.c
+@@ -1185,11 +1185,8 @@ static void sh_eth_ring_format(struct net_device *ndev)
+ 			break;
+ 		sh_eth_set_receive_align(skb);
+ 
+-		/* RX descriptor */
+-		rxdesc = &mdp->rx_ring[i];
+ 		/* The size of the buffer is a multiple of 32 bytes. */
+ 		buf_len = ALIGN(mdp->rx_buf_sz, 32);
+-		rxdesc->len = cpu_to_edmac(mdp, buf_len << 16);
+ 		dma_addr = dma_map_single(&ndev->dev, skb->data, buf_len,
+ 					  DMA_FROM_DEVICE);
+ 		if (dma_mapping_error(&ndev->dev, dma_addr)) {
+@@ -1197,6 +1194,10 @@ static void sh_eth_ring_format(struct net_device *ndev)
+ 			break;
+ 		}
+ 		mdp->rx_skbuff[i] = skb;
++
++		/* RX descriptor */
++		rxdesc = &mdp->rx_ring[i];
++		rxdesc->len = cpu_to_edmac(mdp, buf_len << 16);
+ 		rxdesc->addr = cpu_to_edmac(mdp, dma_addr);
+ 		rxdesc->status = cpu_to_edmac(mdp, RD_RACT | RD_RFP);
+ 
+@@ -1212,7 +1213,8 @@ static void sh_eth_ring_format(struct net_device *ndev)
+ 	mdp->dirty_rx = (u32) (i - mdp->num_rx_ring);
+ 
+ 	/* Mark the last entry as wrapping the ring. */
+-	rxdesc->status |= cpu_to_edmac(mdp, RD_RDLE);
++	if (rxdesc)
++		rxdesc->status |= cpu_to_edmac(mdp, RD_RDLE);
+ 
+ 	memset(mdp->tx_ring, 0, tx_ringsize);
+ 
+diff --git a/drivers/net/ethernet/rocker/rocker.c b/drivers/net/ethernet/rocker/rocker.c
+index 52ec3d6..2b34622 100644
+--- a/drivers/net/ethernet/rocker/rocker.c
++++ b/drivers/net/ethernet/rocker/rocker.c
+@@ -239,6 +239,7 @@ struct rocker {
+ 	struct {
+ 		u64 id;
+ 	} hw;
++	unsigned long ageing_time;
+ 	spinlock_t cmd_ring_lock;		/* for cmd ring accesses */
+ 	struct rocker_dma_ring_info cmd_ring;
+ 	struct rocker_dma_ring_info event_ring;
+@@ -3704,7 +3705,7 @@ static void rocker_fdb_cleanup(unsigned long data)
+ 	struct rocker_port *rocker_port;
+ 	struct rocker_fdb_tbl_entry *entry;
+ 	struct hlist_node *tmp;
+-	unsigned long next_timer = jiffies + BR_MIN_AGEING_TIME;
++	unsigned long next_timer = jiffies + rocker->ageing_time;
+ 	unsigned long expires;
+ 	unsigned long lock_flags;
+ 	int flags = ROCKER_OP_FLAG_NOWAIT | ROCKER_OP_FLAG_REMOVE |
+@@ -4367,8 +4368,12 @@ static int rocker_port_bridge_ageing_time(struct rocker_port *rocker_port,
+ 					  struct switchdev_trans *trans,
+ 					  u32 ageing_time)
+ {
++	struct rocker *rocker = rocker_port->rocker;
++
+ 	if (!switchdev_trans_ph_prepare(trans)) {
+ 		rocker_port->ageing_time = clock_t_to_jiffies(ageing_time);
++		if (rocker_port->ageing_time < rocker->ageing_time)
++			rocker->ageing_time = rocker_port->ageing_time;
+ 		mod_timer(&rocker_port->rocker->fdb_cleanup_timer, jiffies);
+ 	}
+ 
+@@ -5206,10 +5211,13 @@ static int rocker_probe(struct pci_dev *pdev, const struct pci_device_id *id)
+ 		goto err_init_tbls;
+ 	}
+ 
++	rocker->ageing_time = BR_DEFAULT_AGEING_TIME;
+ 	setup_timer(&rocker->fdb_cleanup_timer, rocker_fdb_cleanup,
+ 		    (unsigned long) rocker);
+ 	mod_timer(&rocker->fdb_cleanup_timer, jiffies);
+ 
++	rocker->ageing_time = BR_DEFAULT_AGEING_TIME;
++
+ 	err = rocker_probe_ports(rocker);
+ 	if (err) {
+ 		dev_err(&pdev->dev, "failed to probe ports\n");
+diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
+index 0fc5219..159a687 100644
+--- a/drivers/net/macvtap.c
++++ b/drivers/net/macvtap.c
+@@ -760,6 +760,8 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
+ 			macvtap16_to_cpu(q, vnet_hdr.hdr_len) : GOODCOPY_LEN;
+ 		if (copylen > good_linear)
+ 			copylen = good_linear;
++		else if (copylen < ETH_HLEN)
++			copylen = ETH_HLEN;
+ 		linear = copylen;
+ 		i = *from;
+ 		iov_iter_advance(&i, copylen);
+@@ -769,10 +771,11 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m,
+ 
+ 	if (!zerocopy) {
+ 		copylen = len;
+-		if (macvtap16_to_cpu(q, vnet_hdr.hdr_len) > good_linear)
++		linear = macvtap16_to_cpu(q, vnet_hdr.hdr_len);
++		if (linear > good_linear)
+ 			linear = good_linear;
+-		else
+-			linear = macvtap16_to_cpu(q, vnet_hdr.hdr_len);
++		else if (linear < ETH_HLEN)
++			linear = ETH_HLEN;
+ 	}
+ 
+ 	skb = macvtap_alloc_skb(&q->sk, MACVTAP_RESERVE, copylen,
+diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
+index 9a863c6..174e06e 100644
+--- a/drivers/net/ppp/ppp_generic.c
++++ b/drivers/net/ppp/ppp_generic.c
+@@ -567,7 +567,7 @@ static int get_filter(void __user *arg, struct sock_filter **p)
+ 
+ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ {
+-	struct ppp_file *pf = file->private_data;
++	struct ppp_file *pf;
+ 	struct ppp *ppp;
+ 	int err = -EFAULT, val, val2, i;
+ 	struct ppp_idle idle;
+@@ -577,9 +577,14 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ 	void __user *argp = (void __user *)arg;
+ 	int __user *p = argp;
+ 
+-	if (!pf)
+-		return ppp_unattached_ioctl(current->nsproxy->net_ns,
+-					pf, file, cmd, arg);
++	mutex_lock(&ppp_mutex);
++
++	pf = file->private_data;
++	if (!pf) {
++		err = ppp_unattached_ioctl(current->nsproxy->net_ns,
++					   pf, file, cmd, arg);
++		goto out;
++	}
+ 
+ 	if (cmd == PPPIOCDETACH) {
+ 		/*
+@@ -594,7 +599,6 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ 		 * this fd and reopening /dev/ppp.
+ 		 */
+ 		err = -EINVAL;
+-		mutex_lock(&ppp_mutex);
+ 		if (pf->kind == INTERFACE) {
+ 			ppp = PF_TO_PPP(pf);
+ 			rtnl_lock();
+@@ -608,15 +612,13 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ 		} else
+ 			pr_warn("PPPIOCDETACH file->f_count=%ld\n",
+ 				atomic_long_read(&file->f_count));
+-		mutex_unlock(&ppp_mutex);
+-		return err;
++		goto out;
+ 	}
+ 
+ 	if (pf->kind == CHANNEL) {
+ 		struct channel *pch;
+ 		struct ppp_channel *chan;
+ 
+-		mutex_lock(&ppp_mutex);
+ 		pch = PF_TO_CHANNEL(pf);
+ 
+ 		switch (cmd) {
+@@ -638,17 +640,16 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ 				err = chan->ops->ioctl(chan, cmd, arg);
+ 			up_read(&pch->chan_sem);
+ 		}
+-		mutex_unlock(&ppp_mutex);
+-		return err;
++		goto out;
+ 	}
+ 
+ 	if (pf->kind != INTERFACE) {
+ 		/* can't happen */
+ 		pr_err("PPP: not interface or channel??\n");
+-		return -EINVAL;
++		err = -EINVAL;
++		goto out;
+ 	}
+ 
+-	mutex_lock(&ppp_mutex);
+ 	ppp = PF_TO_PPP(pf);
+ 	switch (cmd) {
+ 	case PPPIOCSMRU:
+@@ -823,7 +824,10 @@ static long ppp_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
+ 	default:
+ 		err = -ENOTTY;
+ 	}
++
++out:
+ 	mutex_unlock(&ppp_mutex);
++
+ 	return err;
+ }
+ 
+@@ -836,7 +840,6 @@ static int ppp_unattached_ioctl(struct net *net, struct ppp_file *pf,
+ 	struct ppp_net *pn;
+ 	int __user *p = (int __user *)arg;
+ 
+-	mutex_lock(&ppp_mutex);
+ 	switch (cmd) {
+ 	case PPPIOCNEWUNIT:
+ 		/* Create a new ppp unit */
+@@ -886,7 +889,7 @@ static int ppp_unattached_ioctl(struct net *net, struct ppp_file *pf,
+ 	default:
+ 		err = -ENOTTY;
+ 	}
+-	mutex_unlock(&ppp_mutex);
++
+ 	return err;
+ }
+ 
+@@ -2290,7 +2293,7 @@ int ppp_register_net_channel(struct net *net, struct ppp_channel *chan)
+ 
+ 	pch->ppp = NULL;
+ 	pch->chan = chan;
+-	pch->chan_net = net;
++	pch->chan_net = get_net(net);
+ 	chan->ppp = pch;
+ 	init_ppp_file(&pch->file, CHANNEL);
+ 	pch->file.hdrlen = chan->hdrlen;
+@@ -2387,6 +2390,8 @@ ppp_unregister_channel(struct ppp_channel *chan)
+ 	spin_lock_bh(&pn->all_channels_lock);
+ 	list_del(&pch->list);
+ 	spin_unlock_bh(&pn->all_channels_lock);
++	put_net(pch->chan_net);
++	pch->chan_net = NULL;
+ 
+ 	pch->file.dead = 1;
+ 	wake_up_interruptible(&pch->file.rwait);
+@@ -2803,6 +2808,7 @@ static struct ppp *ppp_create_interface(struct net *net, int unit,
+ 
+ out2:
+ 	mutex_unlock(&pn->all_ppp_mutex);
++	rtnl_unlock();
+ 	free_netdev(dev);
+ out1:
+ 	*retp = ret;
+diff --git a/drivers/net/tun.c b/drivers/net/tun.c
+index f0db770..2d186bd 100644
+--- a/drivers/net/tun.c
++++ b/drivers/net/tun.c
+@@ -621,7 +621,8 @@ static int tun_attach(struct tun_struct *tun, struct file *file, bool skip_filte
+ 
+ 	/* Re-attach the filter to persist device */
+ 	if (!skip_filter && (tun->filter_attached == true)) {
+-		err = sk_attach_filter(&tun->fprog, tfile->socket.sk);
++		err = __sk_attach_filter(&tun->fprog, tfile->socket.sk,
++					 lockdep_rtnl_is_held());
+ 		if (!err)
+ 			goto out;
+ 	}
+@@ -1000,7 +1001,6 @@ static void tun_net_init(struct net_device *dev)
+ 		/* Zero header length */
+ 		dev->type = ARPHRD_NONE;
+ 		dev->flags = IFF_POINTOPOINT | IFF_NOARP | IFF_MULTICAST;
+-		dev->tx_queue_len = TUN_READQ_SIZE;  /* We prefer our own queue length */
+ 		break;
+ 
+ 	case IFF_TAP:
+@@ -1012,7 +1012,6 @@ static void tun_net_init(struct net_device *dev)
+ 
+ 		eth_hw_addr_random(dev);
+ 
+-		dev->tx_queue_len = TUN_READQ_SIZE;  /* We prefer our own queue length */
+ 		break;
+ 	}
+ }
+@@ -1463,6 +1462,8 @@ static void tun_setup(struct net_device *dev)
+ 
+ 	dev->ethtool_ops = &tun_ethtool_ops;
+ 	dev->destructor = tun_free_netdev;
++	/* We prefer our own queue length */
++	dev->tx_queue_len = TUN_READQ_SIZE;
+ }
+ 
+ /* Trivial set of netlink ops to allow deleting tun or tap
+@@ -1804,7 +1805,7 @@ static void tun_detach_filter(struct tun_struct *tun, int n)
+ 
+ 	for (i = 0; i < n; i++) {
+ 		tfile = rtnl_dereference(tun->tfiles[i]);
+-		sk_detach_filter(tfile->socket.sk);
++		__sk_detach_filter(tfile->socket.sk, lockdep_rtnl_is_held());
+ 	}
+ 
+ 	tun->filter_attached = false;
+@@ -1817,7 +1818,8 @@ static int tun_attach_filter(struct tun_struct *tun)
+ 
+ 	for (i = 0; i < tun->numqueues; i++) {
+ 		tfile = rtnl_dereference(tun->tfiles[i]);
+-		ret = sk_attach_filter(&tun->fprog, tfile->socket.sk);
++		ret = __sk_attach_filter(&tun->fprog, tfile->socket.sk,
++					 lockdep_rtnl_is_held());
+ 		if (ret) {
+ 			tun_detach_filter(tun, i);
+ 			return ret;
+diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
+index 3da70bf..7cba2c3 100644
+--- a/drivers/net/usb/cdc_ether.c
++++ b/drivers/net/usb/cdc_ether.c
+@@ -160,6 +160,12 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
+ 	info->u = header.usb_cdc_union_desc;
+ 	info->header = header.usb_cdc_header_desc;
+ 	info->ether = header.usb_cdc_ether_desc;
++	if (!info->u) {
++		if (rndis)
++			goto skip;
++		else /* in that case a quirk is mandatory */
++			goto bad_desc;
++	}
+ 	/* we need a master/control interface (what we're
+ 	 * probed with) and a slave/data interface; union
+ 	 * descriptors sort this all out.
+@@ -256,7 +262,7 @@ skip:
+ 			goto bad_desc;
+ 		}
+ 
+-	} else if (!info->header || !info->u || (!rndis && !info->ether)) {
++	} else if (!info->header || (!rndis && !info->ether)) {
+ 		dev_dbg(&intf->dev, "missing cdc %s%s%sdescriptor\n",
+ 			info->header ? "" : "header ",
+ 			info->u ? "" : "union ",
+diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c
+index e8a1144..8c2bb77 100644
+--- a/drivers/net/usb/cdc_ncm.c
++++ b/drivers/net/usb/cdc_ncm.c
+@@ -794,7 +794,11 @@ int cdc_ncm_bind_common(struct usbnet *dev, struct usb_interface *intf, u8 data_
+ 
+ 	iface_no = ctx->data->cur_altsetting->desc.bInterfaceNumber;
+ 
+-	/* reset data interface */
++	/* Reset data interface. Some devices will not reset properly
++	 * unless they are configured first.  Toggle the altsetting to
++	 * force a reset
++	 */
++	usb_set_interface(dev->udev, iface_no, data_altsetting);
+ 	temp = usb_set_interface(dev->udev, iface_no, 0);
+ 	if (temp) {
+ 		dev_dbg(&intf->dev, "set interface failed\n");
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 982e0acd..a34f491 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -699,6 +699,7 @@ static const struct usb_device_id products[] = {
+ 	{QMI_FIXED_INTF(0x19d2, 0x1426, 2)},	/* ZTE MF91 */
+ 	{QMI_FIXED_INTF(0x19d2, 0x1428, 2)},	/* Telewell TW-LTE 4G v2 */
+ 	{QMI_FIXED_INTF(0x19d2, 0x2002, 4)},	/* ZTE (Vodafone) K3765-Z */
++	{QMI_FIXED_INTF(0x2001, 0x7e19, 4)},	/* D-Link DWM-221 B1 */
+ 	{QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)},    /* Sierra Wireless MC7700 */
+ 	{QMI_FIXED_INTF(0x114f, 0x68a2, 8)},    /* Sierra Wireless MC7750 */
+ 	{QMI_FIXED_INTF(0x1199, 0x68a2, 8)},	/* Sierra Wireless MC7710 in QMI mode */
+@@ -718,8 +719,10 @@ static const struct usb_device_id products[] = {
+ 	{QMI_FIXED_INTF(0x1199, 0x9061, 8)},	/* Sierra Wireless Modem */
+ 	{QMI_FIXED_INTF(0x1199, 0x9070, 8)},	/* Sierra Wireless MC74xx/EM74xx */
+ 	{QMI_FIXED_INTF(0x1199, 0x9070, 10)},	/* Sierra Wireless MC74xx/EM74xx */
+-	{QMI_FIXED_INTF(0x1199, 0x9071, 8)},	/* Sierra Wireless MC74xx/EM74xx */
+-	{QMI_FIXED_INTF(0x1199, 0x9071, 10)},	/* Sierra Wireless MC74xx/EM74xx */
++	{QMI_FIXED_INTF(0x1199, 0x9071, 8)},	/* Sierra Wireless MC74xx */
++	{QMI_FIXED_INTF(0x1199, 0x9071, 10)},	/* Sierra Wireless MC74xx */
++	{QMI_FIXED_INTF(0x1199, 0x9079, 8)},	/* Sierra Wireless EM74xx */
++	{QMI_FIXED_INTF(0x1199, 0x9079, 10)},	/* Sierra Wireless EM74xx */
+ 	{QMI_FIXED_INTF(0x1bbb, 0x011e, 4)},	/* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
+ 	{QMI_FIXED_INTF(0x1bbb, 0x0203, 2)},	/* Alcatel L800MA */
+ 	{QMI_FIXED_INTF(0x2357, 0x0201, 4)},	/* TP-LINK HSUPA Modem MA180 */
+diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
+index 0744bf2..c2ea4e5 100644
+--- a/drivers/net/usb/usbnet.c
++++ b/drivers/net/usb/usbnet.c
+@@ -1766,6 +1766,13 @@ out3:
+ 	if (info->unbind)
+ 		info->unbind (dev, udev);
+ out1:
++	/* subdrivers must undo all they did in bind() if they
++	 * fail it, but we may fail later and a deferred kevent
++	 * may trigger an error resubmitting itself and, worse,
++	 * schedule a timer. So we kill it all just in case.
++	 */
++	cancel_work_sync(&dev->kevent);
++	del_timer_sync(&dev->delay);
+ 	free_netdev(net);
+ out:
+ 	return status;
+diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
+index 0a242b2..903bda4 100644
+--- a/drivers/net/vrf.c
++++ b/drivers/net/vrf.c
+@@ -114,20 +114,23 @@ static struct dst_ops vrf_dst_ops = {
+ #if IS_ENABLED(CONFIG_IPV6)
+ static bool check_ipv6_frame(const struct sk_buff *skb)
+ {
+-	const struct ipv6hdr *ipv6h = (struct ipv6hdr *)skb->data;
+-	size_t hlen = sizeof(*ipv6h);
++	const struct ipv6hdr *ipv6h;
++	struct ipv6hdr _ipv6h;
+ 	bool rc = true;
+ 
+-	if (skb->len < hlen)
++	ipv6h = skb_header_pointer(skb, 0, sizeof(_ipv6h), &_ipv6h);
++	if (!ipv6h)
+ 		goto out;
+ 
+ 	if (ipv6h->nexthdr == NEXTHDR_ICMP) {
+ 		const struct icmp6hdr *icmph;
++		struct icmp6hdr _icmph;
+ 
+-		if (skb->len < hlen + sizeof(*icmph))
++		icmph = skb_header_pointer(skb, sizeof(_ipv6h),
++					   sizeof(_icmph), &_icmph);
++		if (!icmph)
+ 			goto out;
+ 
+-		icmph = (struct icmp6hdr *)(skb->data + sizeof(*ipv6h));
+ 		switch (icmph->icmp6_type) {
+ 		case NDISC_ROUTER_SOLICITATION:
+ 		case NDISC_ROUTER_ADVERTISEMENT:
+diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
+index e0fcda4..3c0df70 100644
+--- a/drivers/net/vxlan.c
++++ b/drivers/net/vxlan.c
+@@ -1306,8 +1306,10 @@ static int vxlan_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
+ 		gbp = (struct vxlanhdr_gbp *)vxh;
+ 		md->gbp = ntohs(gbp->policy_id);
+ 
+-		if (tun_dst)
++		if (tun_dst) {
+ 			tun_dst->u.tun_info.key.tun_flags |= TUNNEL_VXLAN_OPT;
++			tun_dst->u.tun_info.options_len = sizeof(*md);
++		}
+ 
+ 		if (gbp->dont_learn)
+ 			md->gbp |= VXLAN_GBP_DONT_LEARN;
+diff --git a/drivers/net/wan/farsync.c b/drivers/net/wan/farsync.c
+index 44541dbc..69b994f 100644
+--- a/drivers/net/wan/farsync.c
++++ b/drivers/net/wan/farsync.c
+@@ -2516,7 +2516,7 @@ fst_add_one(struct pci_dev *pdev, const struct pci_device_id *ent)
+                 dev->mem_start   = card->phys_mem
+                                  + BUF_OFFSET ( txBuffer[i][0][0]);
+                 dev->mem_end     = card->phys_mem
+-                                 + BUF_OFFSET ( txBuffer[i][NUM_TX_BUFFER][0]);
++                                 + BUF_OFFSET ( txBuffer[i][NUM_TX_BUFFER - 1][LEN_RX_BUFFER - 1]);
+                 dev->base_addr   = card->pci_conf;
+                 dev->irq         = card->irq;
+ 
+diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c b/drivers/net/wireless/ath/ath9k/eeprom.c
+index cc81482..113a43f 100644
+--- a/drivers/net/wireless/ath/ath9k/eeprom.c
++++ b/drivers/net/wireless/ath/ath9k/eeprom.c
+@@ -403,10 +403,9 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah,
+ 
+ 	if (match) {
+ 		if (AR_SREV_9287(ah)) {
+-			/* FIXME: array overrun? */
+ 			for (i = 0; i < numXpdGains; i++) {
+ 				minPwrT4[i] = data_9287[idxL].pwrPdg[i][0];
+-				maxPwrT4[i] = data_9287[idxL].pwrPdg[i][4];
++				maxPwrT4[i] = data_9287[idxL].pwrPdg[i][intercepts - 1];
+ 				ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
+ 						data_9287[idxL].pwrPdg[i],
+ 						data_9287[idxL].vpdPdg[i],
+@@ -416,7 +415,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah,
+ 		} else if (eeprom_4k) {
+ 			for (i = 0; i < numXpdGains; i++) {
+ 				minPwrT4[i] = data_4k[idxL].pwrPdg[i][0];
+-				maxPwrT4[i] = data_4k[idxL].pwrPdg[i][4];
++				maxPwrT4[i] = data_4k[idxL].pwrPdg[i][intercepts - 1];
+ 				ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
+ 						data_4k[idxL].pwrPdg[i],
+ 						data_4k[idxL].vpdPdg[i],
+@@ -426,7 +425,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah,
+ 		} else {
+ 			for (i = 0; i < numXpdGains; i++) {
+ 				minPwrT4[i] = data_def[idxL].pwrPdg[i][0];
+-				maxPwrT4[i] = data_def[idxL].pwrPdg[i][4];
++				maxPwrT4[i] = data_def[idxL].pwrPdg[i][intercepts - 1];
+ 				ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i],
+ 						data_def[idxL].pwrPdg[i],
+ 						data_def[idxL].vpdPdg[i],
+diff --git a/drivers/nvdimm/bus.c b/drivers/nvdimm/bus.c
+index 496b9b6..5f47356 100644
+--- a/drivers/nvdimm/bus.c
++++ b/drivers/nvdimm/bus.c
+@@ -335,7 +335,7 @@ static const struct nd_cmd_desc __nd_cmd_dimm_descs[] = {
+ 	[ND_CMD_IMPLEMENTED] = { },
+ 	[ND_CMD_SMART] = {
+ 		.out_num = 2,
+-		.out_sizes = { 4, 8, },
++		.out_sizes = { 4, 128, },
+ 	},
+ 	[ND_CMD_SMART_THRESHOLD] = {
+ 		.out_num = 2,
+diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c
+index 71805a1..9d39745 100644
+--- a/drivers/nvdimm/pfn_devs.c
++++ b/drivers/nvdimm/pfn_devs.c
+@@ -275,7 +275,7 @@ int nd_pfn_validate(struct nd_pfn *nd_pfn)
+ 	} else {
+ 		/* from init we validate */
+ 		if (memcmp(nd_pfn->uuid, pfn_sb->uuid, 16) != 0)
+-			return -EINVAL;
++			return -ENODEV;
+ 	}
+ 
+ 	/*
+diff --git a/drivers/pcmcia/db1xxx_ss.c b/drivers/pcmcia/db1xxx_ss.c
+index 4c2fa05..944674e 100644
+--- a/drivers/pcmcia/db1xxx_ss.c
++++ b/drivers/pcmcia/db1xxx_ss.c
+@@ -56,6 +56,7 @@ struct db1x_pcmcia_sock {
+ 	int	stschg_irq;	/* card-status-change irq */
+ 	int	card_irq;	/* card irq */
+ 	int	eject_irq;	/* db1200/pb1200 have these */
++	int	insert_gpio;	/* db1000 carddetect gpio */
+ 
+ #define BOARD_TYPE_DEFAULT	0	/* most boards */
+ #define BOARD_TYPE_DB1200	1	/* IRQs aren't gpios */
+@@ -83,7 +84,7 @@ static int db1200_card_inserted(struct db1x_pcmcia_sock *sock)
+ /* carddetect gpio: low-active */
+ static int db1000_card_inserted(struct db1x_pcmcia_sock *sock)
+ {
+-	return !gpio_get_value(irq_to_gpio(sock->insert_irq));
++	return !gpio_get_value(sock->insert_gpio);
+ }
+ 
+ static int db1x_card_inserted(struct db1x_pcmcia_sock *sock)
+@@ -457,9 +458,15 @@ static int db1x_pcmcia_socket_probe(struct platform_device *pdev)
+ 	r = platform_get_resource_byname(pdev, IORESOURCE_IRQ, "card");
+ 	sock->card_irq = r ? r->start : 0;
+ 
+-	/* insert: irq which triggers on card insertion/ejection */
++	/* insert: irq which triggers on card insertion/ejection
++	 * BIG FAT NOTE: on DB1000/1100/1500/1550 we pass a GPIO here!
++	 */
+ 	r = platform_get_resource_byname(pdev, IORESOURCE_IRQ, "insert");
+ 	sock->insert_irq = r ? r->start : -1;
++	if (sock->board_type == BOARD_TYPE_DEFAULT) {
++		sock->insert_gpio = r ? r->start : -1;
++		sock->insert_irq = r ? gpio_to_irq(r->start) : -1;
++	}
+ 
+ 	/* stschg: irq which trigger on card status change (optional) */
+ 	r = platform_get_resource_byname(pdev, IORESOURCE_IRQ, "stschg");
+diff --git a/drivers/pinctrl/freescale/pinctrl-imx.c b/drivers/pinctrl/freescale/pinctrl-imx.c
+index a5bb939..1029aa7 100644
+--- a/drivers/pinctrl/freescale/pinctrl-imx.c
++++ b/drivers/pinctrl/freescale/pinctrl-imx.c
+@@ -726,19 +726,18 @@ int imx_pinctrl_probe(struct platform_device *pdev,
+ 
+ 	if (of_property_read_bool(dev_np, "fsl,input-sel")) {
+ 		np = of_parse_phandle(dev_np, "fsl,input-sel", 0);
+-		if (np) {
+-			ipctl->input_sel_base = of_iomap(np, 0);
+-			if (IS_ERR(ipctl->input_sel_base)) {
+-				of_node_put(np);
+-				dev_err(&pdev->dev,
+-					"iomuxc input select base address not found\n");
+-				return PTR_ERR(ipctl->input_sel_base);
+-			}
+-		} else {
++		if (!np) {
+ 			dev_err(&pdev->dev, "iomuxc fsl,input-sel property not found\n");
+ 			return -EINVAL;
+ 		}
++
++		ipctl->input_sel_base = of_iomap(np, 0);
+ 		of_node_put(np);
++		if (!ipctl->input_sel_base) {
++			dev_err(&pdev->dev,
++				"iomuxc input select base address not found\n");
++			return -ENOMEM;
++		}
+ 	}
+ 
+ 	imx_pinctrl_desc.name = dev_name(&pdev->dev);
+diff --git a/drivers/pinctrl/nomadik/pinctrl-nomadik.c b/drivers/pinctrl/nomadik/pinctrl-nomadik.c
+index eebfae0..f844b4a 100644
+--- a/drivers/pinctrl/nomadik/pinctrl-nomadik.c
++++ b/drivers/pinctrl/nomadik/pinctrl-nomadik.c
+@@ -995,7 +995,7 @@ static void nmk_gpio_dbg_show_one(struct seq_file *s,
+ 		int val;
+ 
+ 		if (pull)
+-			pullidx = data_out ? 1 : 2;
++			pullidx = data_out ? 2 : 1;
+ 
+ 		seq_printf(s, " gpio-%-3d (%-20.20s) in  %s %s",
+ 			   gpio,
+diff --git a/drivers/pinctrl/pinctrl-pistachio.c b/drivers/pinctrl/pinctrl-pistachio.c
+index 85c9046..6b1a47f 100644
+--- a/drivers/pinctrl/pinctrl-pistachio.c
++++ b/drivers/pinctrl/pinctrl-pistachio.c
+@@ -469,27 +469,27 @@ static const char * const pistachio_mips_pll_lock_groups[] = {
+ 	"mfio83",
+ };
+ 
+-static const char * const pistachio_sys_pll_lock_groups[] = {
++static const char * const pistachio_audio_pll_lock_groups[] = {
+ 	"mfio84",
+ };
+ 
+-static const char * const pistachio_wifi_pll_lock_groups[] = {
++static const char * const pistachio_rpu_v_pll_lock_groups[] = {
+ 	"mfio85",
+ };
+ 
+-static const char * const pistachio_bt_pll_lock_groups[] = {
++static const char * const pistachio_rpu_l_pll_lock_groups[] = {
+ 	"mfio86",
+ };
+ 
+-static const char * const pistachio_rpu_v_pll_lock_groups[] = {
++static const char * const pistachio_sys_pll_lock_groups[] = {
+ 	"mfio87",
+ };
+ 
+-static const char * const pistachio_rpu_l_pll_lock_groups[] = {
++static const char * const pistachio_wifi_pll_lock_groups[] = {
+ 	"mfio88",
+ };
+ 
+-static const char * const pistachio_audio_pll_lock_groups[] = {
++static const char * const pistachio_bt_pll_lock_groups[] = {
+ 	"mfio89",
+ };
+ 
+@@ -559,12 +559,12 @@ enum pistachio_mux_option {
+ 	PISTACHIO_FUNCTION_DREQ4,
+ 	PISTACHIO_FUNCTION_DREQ5,
+ 	PISTACHIO_FUNCTION_MIPS_PLL_LOCK,
++	PISTACHIO_FUNCTION_AUDIO_PLL_LOCK,
++	PISTACHIO_FUNCTION_RPU_V_PLL_LOCK,
++	PISTACHIO_FUNCTION_RPU_L_PLL_LOCK,
+ 	PISTACHIO_FUNCTION_SYS_PLL_LOCK,
+ 	PISTACHIO_FUNCTION_WIFI_PLL_LOCK,
+ 	PISTACHIO_FUNCTION_BT_PLL_LOCK,
+-	PISTACHIO_FUNCTION_RPU_V_PLL_LOCK,
+-	PISTACHIO_FUNCTION_RPU_L_PLL_LOCK,
+-	PISTACHIO_FUNCTION_AUDIO_PLL_LOCK,
+ 	PISTACHIO_FUNCTION_DEBUG_RAW_CCA_IND,
+ 	PISTACHIO_FUNCTION_DEBUG_ED_SEC20_CCA_IND,
+ 	PISTACHIO_FUNCTION_DEBUG_ED_SEC40_CCA_IND,
+@@ -620,12 +620,12 @@ static const struct pistachio_function pistachio_functions[] = {
+ 	FUNCTION(dreq4),
+ 	FUNCTION(dreq5),
+ 	FUNCTION(mips_pll_lock),
++	FUNCTION(audio_pll_lock),
++	FUNCTION(rpu_v_pll_lock),
++	FUNCTION(rpu_l_pll_lock),
+ 	FUNCTION(sys_pll_lock),
+ 	FUNCTION(wifi_pll_lock),
+ 	FUNCTION(bt_pll_lock),
+-	FUNCTION(rpu_v_pll_lock),
+-	FUNCTION(rpu_l_pll_lock),
+-	FUNCTION(audio_pll_lock),
+ 	FUNCTION(debug_raw_cca_ind),
+ 	FUNCTION(debug_ed_sec20_cca_ind),
+ 	FUNCTION(debug_ed_sec40_cca_ind),
+diff --git a/drivers/pinctrl/sh-pfc/core.c b/drivers/pinctrl/sh-pfc/core.c
+index 181ea98..2b0d702 100644
+--- a/drivers/pinctrl/sh-pfc/core.c
++++ b/drivers/pinctrl/sh-pfc/core.c
+@@ -545,7 +545,9 @@ static int sh_pfc_probe(struct platform_device *pdev)
+ 			return ret;
+ 	}
+ 
+-	pinctrl_provide_dummies();
++	/* Enable dummy states for those platforms without pinctrl support */
++	if (!of_have_populated_dt())
++		pinctrl_provide_dummies();
+ 
+ 	ret = sh_pfc_init_ranges(pfc);
+ 	if (ret < 0)
+diff --git a/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c b/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c
+index 00265f0..8b381d6 100644
+--- a/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c
++++ b/drivers/pinctrl/sunxi/pinctrl-sun8i-a33.c
+@@ -485,6 +485,7 @@ static const struct sunxi_pinctrl_desc sun8i_a33_pinctrl_data = {
+ 	.pins = sun8i_a33_pins,
+ 	.npins = ARRAY_SIZE(sun8i_a33_pins),
+ 	.irq_banks = 2,
++	.irq_bank_base = 1,
+ };
+ 
+ static int sun8i_a33_pinctrl_probe(struct platform_device *pdev)
+diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.c b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+index dead97d..a4a5b50 100644
+--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.c
++++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.c
+@@ -578,7 +578,7 @@ static void sunxi_pinctrl_irq_release_resources(struct irq_data *d)
+ static int sunxi_pinctrl_irq_set_type(struct irq_data *d, unsigned int type)
+ {
+ 	struct sunxi_pinctrl *pctl = irq_data_get_irq_chip_data(d);
+-	u32 reg = sunxi_irq_cfg_reg(d->hwirq);
++	u32 reg = sunxi_irq_cfg_reg(d->hwirq, pctl->desc->irq_bank_base);
+ 	u8 index = sunxi_irq_cfg_offset(d->hwirq);
+ 	unsigned long flags;
+ 	u32 regval;
+@@ -625,7 +625,8 @@ static int sunxi_pinctrl_irq_set_type(struct irq_data *d, unsigned int type)
+ static void sunxi_pinctrl_irq_ack(struct irq_data *d)
+ {
+ 	struct sunxi_pinctrl *pctl = irq_data_get_irq_chip_data(d);
+-	u32 status_reg = sunxi_irq_status_reg(d->hwirq);
++	u32 status_reg = sunxi_irq_status_reg(d->hwirq,
++					      pctl->desc->irq_bank_base);
+ 	u8 status_idx = sunxi_irq_status_offset(d->hwirq);
+ 
+ 	/* Clear the IRQ */
+@@ -635,7 +636,7 @@ static void sunxi_pinctrl_irq_ack(struct irq_data *d)
+ static void sunxi_pinctrl_irq_mask(struct irq_data *d)
+ {
+ 	struct sunxi_pinctrl *pctl = irq_data_get_irq_chip_data(d);
+-	u32 reg = sunxi_irq_ctrl_reg(d->hwirq);
++	u32 reg = sunxi_irq_ctrl_reg(d->hwirq, pctl->desc->irq_bank_base);
+ 	u8 idx = sunxi_irq_ctrl_offset(d->hwirq);
+ 	unsigned long flags;
+ 	u32 val;
+@@ -652,7 +653,7 @@ static void sunxi_pinctrl_irq_mask(struct irq_data *d)
+ static void sunxi_pinctrl_irq_unmask(struct irq_data *d)
+ {
+ 	struct sunxi_pinctrl *pctl = irq_data_get_irq_chip_data(d);
+-	u32 reg = sunxi_irq_ctrl_reg(d->hwirq);
++	u32 reg = sunxi_irq_ctrl_reg(d->hwirq, pctl->desc->irq_bank_base);
+ 	u8 idx = sunxi_irq_ctrl_offset(d->hwirq);
+ 	unsigned long flags;
+ 	u32 val;
+@@ -744,7 +745,7 @@ static void sunxi_pinctrl_irq_handler(struct irq_desc *desc)
+ 	if (bank == pctl->desc->irq_banks)
+ 		return;
+ 
+-	reg = sunxi_irq_status_reg_from_bank(bank);
++	reg = sunxi_irq_status_reg_from_bank(bank, pctl->desc->irq_bank_base);
+ 	val = readl(pctl->membase + reg);
+ 
+ 	if (val) {
+@@ -1023,9 +1024,11 @@ int sunxi_pinctrl_init(struct platform_device *pdev,
+ 
+ 	for (i = 0; i < pctl->desc->irq_banks; i++) {
+ 		/* Mask and clear all IRQs before registering a handler */
+-		writel(0, pctl->membase + sunxi_irq_ctrl_reg_from_bank(i));
++		writel(0, pctl->membase + sunxi_irq_ctrl_reg_from_bank(i,
++						pctl->desc->irq_bank_base));
+ 		writel(0xffffffff,
+-			pctl->membase + sunxi_irq_status_reg_from_bank(i));
++		       pctl->membase + sunxi_irq_status_reg_from_bank(i,
++						pctl->desc->irq_bank_base));
+ 
+ 		irq_set_chained_handler_and_data(pctl->irq[i],
+ 						 sunxi_pinctrl_irq_handler,
+diff --git a/drivers/pinctrl/sunxi/pinctrl-sunxi.h b/drivers/pinctrl/sunxi/pinctrl-sunxi.h
+index e248e81..0afce1a 100644
+--- a/drivers/pinctrl/sunxi/pinctrl-sunxi.h
++++ b/drivers/pinctrl/sunxi/pinctrl-sunxi.h
+@@ -97,6 +97,7 @@ struct sunxi_pinctrl_desc {
+ 	int				npins;
+ 	unsigned			pin_base;
+ 	unsigned			irq_banks;
++	unsigned			irq_bank_base;
+ 	bool				irq_read_needs_mux;
+ };
+ 
+@@ -233,12 +234,12 @@ static inline u32 sunxi_pull_offset(u16 pin)
+ 	return pin_num * PULL_PINS_BITS;
+ }
+ 
+-static inline u32 sunxi_irq_cfg_reg(u16 irq)
++static inline u32 sunxi_irq_cfg_reg(u16 irq, unsigned bank_base)
+ {
+ 	u8 bank = irq / IRQ_PER_BANK;
+ 	u8 reg = (irq % IRQ_PER_BANK) / IRQ_CFG_IRQ_PER_REG * 0x04;
+ 
+-	return IRQ_CFG_REG + bank * IRQ_MEM_SIZE + reg;
++	return IRQ_CFG_REG + (bank_base + bank) * IRQ_MEM_SIZE + reg;
+ }
+ 
+ static inline u32 sunxi_irq_cfg_offset(u16 irq)
+@@ -247,16 +248,16 @@ static inline u32 sunxi_irq_cfg_offset(u16 irq)
+ 	return irq_num * IRQ_CFG_IRQ_BITS;
+ }
+ 
+-static inline u32 sunxi_irq_ctrl_reg_from_bank(u8 bank)
++static inline u32 sunxi_irq_ctrl_reg_from_bank(u8 bank, unsigned bank_base)
+ {
+-	return IRQ_CTRL_REG + bank * IRQ_MEM_SIZE;
++	return IRQ_CTRL_REG + (bank_base + bank) * IRQ_MEM_SIZE;
+ }
+ 
+-static inline u32 sunxi_irq_ctrl_reg(u16 irq)
++static inline u32 sunxi_irq_ctrl_reg(u16 irq, unsigned bank_base)
+ {
+ 	u8 bank = irq / IRQ_PER_BANK;
+ 
+-	return sunxi_irq_ctrl_reg_from_bank(bank);
++	return sunxi_irq_ctrl_reg_from_bank(bank, bank_base);
+ }
+ 
+ static inline u32 sunxi_irq_ctrl_offset(u16 irq)
+@@ -265,16 +266,16 @@ static inline u32 sunxi_irq_ctrl_offset(u16 irq)
+ 	return irq_num * IRQ_CTRL_IRQ_BITS;
+ }
+ 
+-static inline u32 sunxi_irq_status_reg_from_bank(u8 bank)
++static inline u32 sunxi_irq_status_reg_from_bank(u8 bank, unsigned bank_base)
+ {
+-	return IRQ_STATUS_REG + bank * IRQ_MEM_SIZE;
++	return IRQ_STATUS_REG + (bank_base + bank) * IRQ_MEM_SIZE;
+ }
+ 
+-static inline u32 sunxi_irq_status_reg(u16 irq)
++static inline u32 sunxi_irq_status_reg(u16 irq, unsigned bank_base)
+ {
+ 	u8 bank = irq / IRQ_PER_BANK;
+ 
+-	return sunxi_irq_status_reg_from_bank(bank);
++	return sunxi_irq_status_reg_from_bank(bank, bank_base);
+ }
+ 
+ static inline u32 sunxi_irq_status_offset(u16 irq)
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index cc84ea7..0d7c6e8 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -1275,18 +1275,19 @@ static int sd_getgeo(struct block_device *bdev, struct hd_geometry *geo)
+ 	struct scsi_disk *sdkp = scsi_disk(bdev->bd_disk);
+ 	struct scsi_device *sdp = sdkp->device;
+ 	struct Scsi_Host *host = sdp->host;
++	sector_t capacity = logical_to_sectors(sdp, sdkp->capacity);
+ 	int diskinfo[4];
+ 
+ 	/* default to most commonly used values */
+-        diskinfo[0] = 0x40;	/* 1 << 6 */
+-       	diskinfo[1] = 0x20;	/* 1 << 5 */
+-       	diskinfo[2] = sdkp->capacity >> 11;
+-	
++	diskinfo[0] = 0x40;	/* 1 << 6 */
++	diskinfo[1] = 0x20;	/* 1 << 5 */
++	diskinfo[2] = capacity >> 11;
++
+ 	/* override with calculated, extended default, or driver values */
+ 	if (host->hostt->bios_param)
+-		host->hostt->bios_param(sdp, bdev, sdkp->capacity, diskinfo);
++		host->hostt->bios_param(sdp, bdev, capacity, diskinfo);
+ 	else
+-		scsicam_bios_param(bdev, sdkp->capacity, diskinfo);
++		scsicam_bios_param(bdev, capacity, diskinfo);
+ 
+ 	geo->heads = diskinfo[0];
+ 	geo->sectors = diskinfo[1];
+@@ -2337,14 +2338,6 @@ got_data:
+ 	if (sdkp->capacity > 0xffffffff)
+ 		sdp->use_16_for_rw = 1;
+ 
+-	/* Rescale capacity to 512-byte units */
+-	if (sector_size == 4096)
+-		sdkp->capacity <<= 3;
+-	else if (sector_size == 2048)
+-		sdkp->capacity <<= 2;
+-	else if (sector_size == 1024)
+-		sdkp->capacity <<= 1;
+-
+ 	blk_queue_physical_block_size(sdp->request_queue,
+ 				      sdkp->physical_block_size);
+ 	sdkp->device->sector_size = sector_size;
+@@ -2812,11 +2805,6 @@ static int sd_try_extended_inquiry(struct scsi_device *sdp)
+ 	return 0;
+ }
+ 
+-static inline u32 logical_to_sectors(struct scsi_device *sdev, u32 blocks)
+-{
+-	return blocks << (ilog2(sdev->sector_size) - 9);
+-}
+-
+ /**
+  *	sd_revalidate_disk - called the first time a new disk is seen,
+  *	performs disk spin up, read_capacity, etc.
+@@ -2900,7 +2888,7 @@ static int sd_revalidate_disk(struct gendisk *disk)
+ 	/* Combine with controller limits */
+ 	q->limits.max_sectors = min(rw_max, queue_max_hw_sectors(q));
+ 
+-	set_capacity(disk, sdkp->capacity);
++	set_capacity(disk, logical_to_sectors(sdp, sdkp->capacity));
+ 	sd_config_write_same(sdkp);
+ 	kfree(buffer);
+ 
+diff --git a/drivers/scsi/sd.h b/drivers/scsi/sd.h
+index 5f2a84a..654630b 100644
+--- a/drivers/scsi/sd.h
++++ b/drivers/scsi/sd.h
+@@ -65,7 +65,7 @@ struct scsi_disk {
+ 	struct device	dev;
+ 	struct gendisk	*disk;
+ 	atomic_t	openers;
+-	sector_t	capacity;	/* size in 512-byte sectors */
++	sector_t	capacity;	/* size in logical blocks */
+ 	u32		max_xfer_blocks;
+ 	u32		opt_xfer_blocks;
+ 	u32		max_ws_blocks;
+@@ -146,6 +146,11 @@ static inline int scsi_medium_access_command(struct scsi_cmnd *scmd)
+ 	return 0;
+ }
+ 
++static inline sector_t logical_to_sectors(struct scsi_device *sdev, sector_t blocks)
++{
++	return blocks << (ilog2(sdev->sector_size) - 9);
++}
++
+ /*
+  * A DIF-capable target device can be formatted with different
+  * protection schemes.  Currently 0 through 3 are defined:
+diff --git a/drivers/staging/android/ion/ion.c b/drivers/staging/android/ion/ion.c
+index e237e9f..df56021 100644
+--- a/drivers/staging/android/ion/ion.c
++++ b/drivers/staging/android/ion/ion.c
+@@ -251,8 +251,10 @@ static struct ion_buffer *ion_buffer_create(struct ion_heap *heap,
+ 	 * memory coming from the heaps is ready for dma, ie if it has a
+ 	 * cached mapping that mapping has been invalidated
+ 	 */
+-	for_each_sg(buffer->sg_table->sgl, sg, buffer->sg_table->nents, i)
++	for_each_sg(buffer->sg_table->sgl, sg, buffer->sg_table->nents, i) {
+ 		sg_dma_address(sg) = sg_phys(sg);
++		sg_dma_len(sg) = sg->length;
++	}
+ 	mutex_lock(&dev->buffer_lock);
+ 	ion_buffer_add(dev, buffer);
+ 	mutex_unlock(&dev->buffer_lock);
+diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
+index 2a27488..84df093 100644
+--- a/drivers/usb/core/hub.c
++++ b/drivers/usb/core/hub.c
+@@ -5392,6 +5392,7 @@ static int usb_reset_and_verify_device(struct usb_device *udev)
+ 	}
+ 
+ 	bos = udev->bos;
++	udev->bos = NULL;
+ 
+ 	for (i = 0; i < SET_CONFIG_TRIES; ++i) {
+ 
+@@ -5484,11 +5485,8 @@ done:
+ 	usb_set_usb2_hardware_lpm(udev, 1);
+ 	usb_unlocked_enable_lpm(udev);
+ 	usb_enable_ltm(udev);
+-	/* release the new BOS descriptor allocated  by hub_port_init() */
+-	if (udev->bos != bos) {
+-		usb_release_bos_descriptor(udev);
+-		udev->bos = bos;
+-	}
++	usb_release_bos_descriptor(udev);
++	udev->bos = bos;
+ 	return 0;
+ 
+ re_enumerate:
+diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c
+index c0f5c65..f1893e0 100644
+--- a/drivers/usb/renesas_usbhs/fifo.c
++++ b/drivers/usb/renesas_usbhs/fifo.c
+@@ -190,7 +190,8 @@ static int usbhsf_pkt_handler(struct usbhs_pipe *pipe, int type)
+ 		goto __usbhs_pkt_handler_end;
+ 	}
+ 
+-	ret = func(pkt, &is_done);
++	if (likely(func))
++		ret = func(pkt, &is_done);
+ 
+ 	if (is_done)
+ 		__usbhsf_pkt_del(pkt);
+@@ -889,6 +890,7 @@ static int usbhsf_dma_prepare_push(struct usbhs_pkt *pkt, int *is_done)
+ 
+ 	pkt->trans = len;
+ 
++	usbhsf_tx_irq_ctrl(pipe, 0);
+ 	INIT_WORK(&pkt->work, xfer_work);
+ 	schedule_work(&pkt->work);
+ 
+diff --git a/drivers/usb/renesas_usbhs/mod_gadget.c b/drivers/usb/renesas_usbhs/mod_gadget.c
+index 8f7a78e..fa14198 100644
+--- a/drivers/usb/renesas_usbhs/mod_gadget.c
++++ b/drivers/usb/renesas_usbhs/mod_gadget.c
+@@ -158,10 +158,14 @@ static void usbhsg_queue_done(struct usbhs_priv *priv, struct usbhs_pkt *pkt)
+ 	struct usbhs_pipe *pipe = pkt->pipe;
+ 	struct usbhsg_uep *uep = usbhsg_pipe_to_uep(pipe);
+ 	struct usbhsg_request *ureq = usbhsg_pkt_to_ureq(pkt);
++	unsigned long flags;
+ 
+ 	ureq->req.actual = pkt->actual;
+ 
+-	usbhsg_queue_pop(uep, ureq, 0);
++	usbhs_lock(priv, flags);
++	if (uep)
++		__usbhsg_queue_pop(uep, ureq, 0);
++	usbhs_unlock(priv, flags);
+ }
+ 
+ static void usbhsg_queue_push(struct usbhsg_uep *uep,
+diff --git a/drivers/usb/storage/uas.c b/drivers/usb/storage/uas.c
+index ce0cd6e..9baf081 100644
+--- a/drivers/usb/storage/uas.c
++++ b/drivers/usb/storage/uas.c
+@@ -2,7 +2,7 @@
+  * USB Attached SCSI
+  * Note that this is not the same as the USB Mass Storage driver
+  *
+- * Copyright Hans de Goede <hdegoede@redhat.com> for Red Hat, Inc. 2013 - 2014
++ * Copyright Hans de Goede <hdegoede@redhat.com> for Red Hat, Inc. 2013 - 2016
+  * Copyright Matthew Wilcox for Intel Corp, 2010
+  * Copyright Sarah Sharp for Intel Corp, 2010
+  *
+@@ -757,6 +757,17 @@ static int uas_eh_bus_reset_handler(struct scsi_cmnd *cmnd)
+ 	return SUCCESS;
+ }
+ 
++static int uas_target_alloc(struct scsi_target *starget)
++{
++	struct uas_dev_info *devinfo = (struct uas_dev_info *)
++			dev_to_shost(starget->dev.parent)->hostdata;
++
++	if (devinfo->flags & US_FL_NO_REPORT_LUNS)
++		starget->no_report_luns = 1;
++
++	return 0;
++}
++
+ static int uas_slave_alloc(struct scsi_device *sdev)
+ {
+ 	struct uas_dev_info *devinfo =
+@@ -800,7 +811,6 @@ static int uas_slave_configure(struct scsi_device *sdev)
+ 	if (devinfo->flags & US_FL_BROKEN_FUA)
+ 		sdev->broken_fua = 1;
+ 
+-	scsi_change_queue_depth(sdev, devinfo->qdepth - 2);
+ 	return 0;
+ }
+ 
+@@ -808,6 +818,7 @@ static struct scsi_host_template uas_host_template = {
+ 	.module = THIS_MODULE,
+ 	.name = "uas",
+ 	.queuecommand = uas_queuecommand,
++	.target_alloc = uas_target_alloc,
+ 	.slave_alloc = uas_slave_alloc,
+ 	.slave_configure = uas_slave_configure,
+ 	.eh_abort_handler = uas_eh_abort_handler,
+@@ -932,6 +943,12 @@ static int uas_probe(struct usb_interface *intf, const struct usb_device_id *id)
+ 	if (result)
+ 		goto set_alt0;
+ 
++	/*
++	 * 1 tag is reserved for untagged commands +
++	 * 1 tag to avoid off by one errors in some bridge firmwares
++	 */
++	shost->can_queue = devinfo->qdepth - 2;
++
+ 	usb_set_intfdata(intf, shost);
+ 	result = scsi_add_host(shost, &intf->dev);
+ 	if (result)
+diff --git a/drivers/usb/storage/unusual_uas.h b/drivers/usb/storage/unusual_uas.h
+index ccc113e..53341a7 100644
+--- a/drivers/usb/storage/unusual_uas.h
++++ b/drivers/usb/storage/unusual_uas.h
+@@ -64,6 +64,13 @@ UNUSUAL_DEV(0x0bc2, 0x3312, 0x0000, 0x9999,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_NO_ATA_1X),
+ 
++/* Reported-by: David Webb <djw@noc.ac.uk> */
++UNUSUAL_DEV(0x0bc2, 0x331a, 0x0000, 0x9999,
++		"Seagate",
++		"Expansion Desk",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_NO_REPORT_LUNS),
++
+ /* Reported-by: Hans de Goede <hdegoede@redhat.com> */
+ UNUSUAL_DEV(0x0bc2, 0x3320, 0x0000, 0x9999,
+ 		"Seagate",
+diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
+index 43576ed..9de988a 100644
+--- a/drivers/usb/storage/usb.c
++++ b/drivers/usb/storage/usb.c
+@@ -482,7 +482,7 @@ void usb_stor_adjust_quirks(struct usb_device *udev, unsigned long *fflags)
+ 			US_FL_NO_READ_DISC_INFO | US_FL_NO_READ_CAPACITY_16 |
+ 			US_FL_INITIAL_READ10 | US_FL_WRITE_CACHE |
+ 			US_FL_NO_ATA_1X | US_FL_NO_REPORT_OPCODES |
+-			US_FL_MAX_SECTORS_240);
++			US_FL_MAX_SECTORS_240 | US_FL_NO_REPORT_LUNS);
+ 
+ 	p = quirks;
+ 	while (*p) {
+@@ -532,6 +532,9 @@ void usb_stor_adjust_quirks(struct usb_device *udev, unsigned long *fflags)
+ 		case 'i':
+ 			f |= US_FL_IGNORE_DEVICE;
+ 			break;
++		case 'j':
++			f |= US_FL_NO_REPORT_LUNS;
++			break;
+ 		case 'l':
+ 			f |= US_FL_NOT_LOCKABLE;
+ 			break;
+diff --git a/drivers/virtio/virtio_pci_modern.c b/drivers/virtio/virtio_pci_modern.c
+index 8e5cf19..4469202 100644
+--- a/drivers/virtio/virtio_pci_modern.c
++++ b/drivers/virtio/virtio_pci_modern.c
+@@ -17,6 +17,7 @@
+  *
+  */
+ 
++#include <linux/delay.h>
+ #define VIRTIO_PCI_NO_LEGACY
+ #include "virtio_pci_common.h"
+ 
+@@ -271,9 +272,13 @@ static void vp_reset(struct virtio_device *vdev)
+ 	struct virtio_pci_device *vp_dev = to_vp_device(vdev);
+ 	/* 0 status means a reset. */
+ 	vp_iowrite8(0, &vp_dev->common->device_status);
+-	/* Flush out the status write, and flush in device writes,
+-	 * including MSI-X interrupts, if any. */
+-	vp_ioread8(&vp_dev->common->device_status);
++	/* After writing 0 to device_status, the driver MUST wait for a read of
++	 * device_status to return 0 before reinitializing the device.
++	 * This will flush out the status write, and flush in device writes,
++	 * including MSI-X interrupts, if any.
++	 */
++	while (vp_ioread8(&vp_dev->common->device_status))
++		msleep(1);
+ 	/* Flush pending VQ/configuration callbacks. */
+ 	vp_synchronize_vectors(vdev);
+ }
+diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
+index 524c221..4436778 100644
+--- a/drivers/xen/events/events_base.c
++++ b/drivers/xen/events/events_base.c
+@@ -484,9 +484,19 @@ static void eoi_pirq(struct irq_data *data)
+ 	struct physdev_eoi eoi = { .irq = pirq_from_irq(data->irq) };
+ 	int rc = 0;
+ 
+-	irq_move_irq(data);
++	if (!VALID_EVTCHN(evtchn))
++		return;
+ 
+-	if (VALID_EVTCHN(evtchn))
++	if (unlikely(irqd_is_setaffinity_pending(data))) {
++		int masked = test_and_set_mask(evtchn);
++
++		clear_evtchn(evtchn);
++
++		irq_move_masked_irq(data);
++
++		if (!masked)
++			unmask_evtchn(evtchn);
++	} else
+ 		clear_evtchn(evtchn);
+ 
+ 	if (pirq_needs_eoi(data->irq)) {
+@@ -1357,9 +1367,19 @@ static void ack_dynirq(struct irq_data *data)
+ {
+ 	int evtchn = evtchn_from_irq(data->irq);
+ 
+-	irq_move_irq(data);
++	if (!VALID_EVTCHN(evtchn))
++		return;
+ 
+-	if (VALID_EVTCHN(evtchn))
++	if (unlikely(irqd_is_setaffinity_pending(data))) {
++		int masked = test_and_set_mask(evtchn);
++
++		clear_evtchn(evtchn);
++
++		irq_move_masked_irq(data);
++
++		if (!masked)
++			unmask_evtchn(evtchn);
++	} else
+ 		clear_evtchn(evtchn);
+ }
+ 
+diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
+index 0f09526..5e5db36 100644
+--- a/fs/btrfs/file.c
++++ b/fs/btrfs/file.c
+@@ -1885,7 +1885,7 @@ static int start_ordered_ops(struct inode *inode, loff_t start, loff_t end)
+  */
+ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
+ {
+-	struct dentry *dentry = file->f_path.dentry;
++	struct dentry *dentry = file_dentry(file);
+ 	struct inode *inode = d_inode(dentry);
+ 	struct btrfs_root *root = BTRFS_I(inode)->root;
+ 	struct btrfs_trans_handle *trans;
+diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
+index 323e12c..0e044d7 100644
+--- a/fs/btrfs/tree-log.c
++++ b/fs/btrfs/tree-log.c
+@@ -4406,6 +4406,127 @@ static int btrfs_log_trailing_hole(struct btrfs_trans_handle *trans,
+ 	return ret;
+ }
+ 
++/*
++ * When we are logging a new inode X, check if it doesn't have a reference that
++ * matches the reference from some other inode Y created in a past transaction
++ * and that was renamed in the current transaction. If we don't do this, then at
++ * log replay time we can lose inode Y (and all its files if it's a directory):
++ *
++ * mkdir /mnt/x
++ * echo "hello world" > /mnt/x/foobar
++ * sync
++ * mv /mnt/x /mnt/y
++ * mkdir /mnt/x                 # or touch /mnt/x
++ * xfs_io -c fsync /mnt/x
++ * <power fail>
++ * mount fs, trigger log replay
++ *
++ * After the log replay procedure, we would lose the first directory and all its
++ * files (file foobar).
++ * For the case where inode Y is not a directory we simply end up losing it:
++ *
++ * echo "123" > /mnt/foo
++ * sync
++ * mv /mnt/foo /mnt/bar
++ * echo "abc" > /mnt/foo
++ * xfs_io -c fsync /mnt/foo
++ * <power fail>
++ *
++ * We also need this for cases where a snapshot entry is replaced by some other
++ * entry (file or directory) otherwise we end up with an unreplayable log due to
++ * attempts to delete the snapshot entry (entry of type BTRFS_ROOT_ITEM_KEY) as
++ * if it were a regular entry:
++ *
++ * mkdir /mnt/x
++ * btrfs subvolume snapshot /mnt /mnt/x/snap
++ * btrfs subvolume delete /mnt/x/snap
++ * rmdir /mnt/x
++ * mkdir /mnt/x
++ * fsync /mnt/x or fsync some new file inside it
++ * <power fail>
++ *
++ * The snapshot delete, rmdir of x, mkdir of a new x and the fsync all happen in
++ * the same transaction.
++ */
++static int btrfs_check_ref_name_override(struct extent_buffer *eb,
++					 const int slot,
++					 const struct btrfs_key *key,
++					 struct inode *inode)
++{
++	int ret;
++	struct btrfs_path *search_path;
++	char *name = NULL;
++	u32 name_len = 0;
++	u32 item_size = btrfs_item_size_nr(eb, slot);
++	u32 cur_offset = 0;
++	unsigned long ptr = btrfs_item_ptr_offset(eb, slot);
++
++	search_path = btrfs_alloc_path();
++	if (!search_path)
++		return -ENOMEM;
++	search_path->search_commit_root = 1;
++	search_path->skip_locking = 1;
++
++	while (cur_offset < item_size) {
++		u64 parent;
++		u32 this_name_len;
++		u32 this_len;
++		unsigned long name_ptr;
++		struct btrfs_dir_item *di;
++
++		if (key->type == BTRFS_INODE_REF_KEY) {
++			struct btrfs_inode_ref *iref;
++
++			iref = (struct btrfs_inode_ref *)(ptr + cur_offset);
++			parent = key->offset;
++			this_name_len = btrfs_inode_ref_name_len(eb, iref);
++			name_ptr = (unsigned long)(iref + 1);
++			this_len = sizeof(*iref) + this_name_len;
++		} else {
++			struct btrfs_inode_extref *extref;
++
++			extref = (struct btrfs_inode_extref *)(ptr +
++							       cur_offset);
++			parent = btrfs_inode_extref_parent(eb, extref);
++			this_name_len = btrfs_inode_extref_name_len(eb, extref);
++			name_ptr = (unsigned long)&extref->name;
++			this_len = sizeof(*extref) + this_name_len;
++		}
++
++		if (this_name_len > name_len) {
++			char *new_name;
++
++			new_name = krealloc(name, this_name_len, GFP_NOFS);
++			if (!new_name) {
++				ret = -ENOMEM;
++				goto out;
++			}
++			name_len = this_name_len;
++			name = new_name;
++		}
++
++		read_extent_buffer(eb, name, name_ptr, this_name_len);
++		di = btrfs_lookup_dir_item(NULL, BTRFS_I(inode)->root,
++					   search_path, parent,
++					   name, this_name_len, 0);
++		if (di && !IS_ERR(di)) {
++			ret = 1;
++			goto out;
++		} else if (IS_ERR(di)) {
++			ret = PTR_ERR(di);
++			goto out;
++		}
++		btrfs_release_path(search_path);
++
++		cur_offset += this_len;
++	}
++	ret = 0;
++out:
++	btrfs_free_path(search_path);
++	kfree(name);
++	return ret;
++}
++
+ /* log a single inode in the tree log.
+  * At least one parent directory for this inode must exist in the tree
+  * or be logged already.
+@@ -4578,6 +4699,22 @@ again:
+ 		if (min_key.type == BTRFS_INODE_ITEM_KEY)
+ 			need_log_inode_item = false;
+ 
++		if ((min_key.type == BTRFS_INODE_REF_KEY ||
++		     min_key.type == BTRFS_INODE_EXTREF_KEY) &&
++		    BTRFS_I(inode)->generation == trans->transid) {
++			ret = btrfs_check_ref_name_override(path->nodes[0],
++							    path->slots[0],
++							    &min_key, inode);
++			if (ret < 0) {
++				err = ret;
++				goto out_unlock;
++			} else if (ret > 0) {
++				err = 1;
++				btrfs_set_log_full_commit(root->fs_info, trans);
++				goto out_unlock;
++			}
++		}
++
+ 		/* Skip xattrs, we log them later with btrfs_log_all_xattrs() */
+ 		if (min_key.type == BTRFS_XATTR_ITEM_KEY) {
+ 			if (ins_nr == 0)
+diff --git a/fs/dcache.c b/fs/dcache.c
+index 877bcbb..18effa3 100644
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -1666,7 +1666,8 @@ void d_set_d_op(struct dentry *dentry, const struct dentry_operations *op)
+ 				DCACHE_OP_REVALIDATE	|
+ 				DCACHE_OP_WEAK_REVALIDATE	|
+ 				DCACHE_OP_DELETE	|
+-				DCACHE_OP_SELECT_INODE));
++				DCACHE_OP_SELECT_INODE	|
++				DCACHE_OP_REAL));
+ 	dentry->d_op = op;
+ 	if (!op)
+ 		return;
+@@ -1684,6 +1685,8 @@ void d_set_d_op(struct dentry *dentry, const struct dentry_operations *op)
+ 		dentry->d_flags |= DCACHE_OP_PRUNE;
+ 	if (op->d_select_inode)
+ 		dentry->d_flags |= DCACHE_OP_SELECT_INODE;
++	if (op->d_real)
++		dentry->d_flags |= DCACHE_OP_REAL;
+ 
+ }
+ EXPORT_SYMBOL(d_set_d_op);
+diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
+index cc7ca4e..d4156e1 100644
+--- a/fs/ext4/ext4.h
++++ b/fs/ext4/ext4.h
+@@ -850,6 +850,29 @@ do {									       \
+ #include "extents_status.h"
+ 
+ /*
++ * Lock subclasses for i_data_sem in the ext4_inode_info structure.
++ *
++ * These are needed to avoid lockdep false positives when we need to
++ * allocate blocks to the quota inode during ext4_map_blocks(), while
++ * holding i_data_sem for a normal (non-quota) inode.  Since we don't
++ * do quota tracking for the quota inode, this avoids deadlock (as
++ * well as infinite recursion, since it isn't turtles all the way
++ * down...)
++ *
++ *  I_DATA_SEM_NORMAL - Used for most inodes
++ *  I_DATA_SEM_OTHER  - Used by move_inode.c for the second normal inode
++ *			  where the second inode has larger inode number
++ *			  than the first
++ *  I_DATA_SEM_QUOTA  - Used for quota inodes only
++ */
++enum {
++	I_DATA_SEM_NORMAL = 0,
++	I_DATA_SEM_OTHER,
++	I_DATA_SEM_QUOTA,
++};
++
++
++/*
+  * fourth extended file system inode data in memory
+  */
+ struct ext4_inode_info {
+diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c
+index e032a04..9bdbf98 100644
+--- a/fs/ext4/move_extent.c
++++ b/fs/ext4/move_extent.c
+@@ -60,10 +60,10 @@ ext4_double_down_write_data_sem(struct inode *first, struct inode *second)
+ {
+ 	if (first < second) {
+ 		down_write(&EXT4_I(first)->i_data_sem);
+-		down_write_nested(&EXT4_I(second)->i_data_sem, SINGLE_DEPTH_NESTING);
++		down_write_nested(&EXT4_I(second)->i_data_sem, I_DATA_SEM_OTHER);
+ 	} else {
+ 		down_write(&EXT4_I(second)->i_data_sem);
+-		down_write_nested(&EXT4_I(first)->i_data_sem, SINGLE_DEPTH_NESTING);
++		down_write_nested(&EXT4_I(first)->i_data_sem, I_DATA_SEM_OTHER);
+ 
+ 	}
+ }
+@@ -483,6 +483,13 @@ mext_check_arguments(struct inode *orig_inode,
+ 		return -EBUSY;
+ 	}
+ 
++	if (IS_NOQUOTA(orig_inode) || IS_NOQUOTA(donor_inode)) {
++		ext4_debug("ext4 move extent: The argument files should "
++			"not be quota files [ino:orig %lu, donor %lu]\n",
++			orig_inode->i_ino, donor_inode->i_ino);
++		return -EBUSY;
++	}
++
+ 	/* Ext4 move extent supports only extent based file */
+ 	if (!(ext4_test_inode_flag(orig_inode, EXT4_INODE_EXTENTS))) {
+ 		ext4_debug("ext4 move extent: orig file is not extents "
+diff --git a/fs/ext4/super.c b/fs/ext4/super.c
+index c9ab67d..ba1cf0b 100644
+--- a/fs/ext4/super.c
++++ b/fs/ext4/super.c
+@@ -1292,9 +1292,9 @@ static int set_qf_name(struct super_block *sb, int qtype, substring_t *args)
+ 		return -1;
+ 	}
+ 	if (ext4_has_feature_quota(sb)) {
+-		ext4_msg(sb, KERN_ERR, "Cannot set journaled quota options "
+-			 "when QUOTA feature is enabled");
+-		return -1;
++		ext4_msg(sb, KERN_INFO, "Journaled quota options "
++			 "ignored when QUOTA feature is enabled");
++		return 1;
+ 	}
+ 	qname = match_strdup(args);
+ 	if (!qname) {
+@@ -1657,10 +1657,10 @@ static int handle_mount_opt(struct super_block *sb, char *opt, int token,
+ 			return -1;
+ 		}
+ 		if (ext4_has_feature_quota(sb)) {
+-			ext4_msg(sb, KERN_ERR,
+-				 "Cannot set journaled quota options "
++			ext4_msg(sb, KERN_INFO,
++				 "Quota format mount options ignored "
+ 				 "when QUOTA feature is enabled");
+-			return -1;
++			return 1;
+ 		}
+ 		sbi->s_jquota_fmt = m->mount_opt;
+ #endif
+@@ -1721,11 +1721,11 @@ static int parse_options(char *options, struct super_block *sb,
+ #ifdef CONFIG_QUOTA
+ 	if (ext4_has_feature_quota(sb) &&
+ 	    (test_opt(sb, USRQUOTA) || test_opt(sb, GRPQUOTA))) {
+-		ext4_msg(sb, KERN_ERR, "Cannot set quota options when QUOTA "
+-			 "feature is enabled");
+-		return 0;
+-	}
+-	if (sbi->s_qf_names[USRQUOTA] || sbi->s_qf_names[GRPQUOTA]) {
++		ext4_msg(sb, KERN_INFO, "Quota feature enabled, usrquota and grpquota "
++			 "mount options ignored.");
++		clear_opt(sb, USRQUOTA);
++		clear_opt(sb, GRPQUOTA);
++	} else if (sbi->s_qf_names[USRQUOTA] || sbi->s_qf_names[GRPQUOTA]) {
+ 		if (test_opt(sb, USRQUOTA) && sbi->s_qf_names[USRQUOTA])
+ 			clear_opt(sb, USRQUOTA);
+ 
+@@ -4936,6 +4936,20 @@ static int ext4_quota_on_mount(struct super_block *sb, int type)
+ 					EXT4_SB(sb)->s_jquota_fmt, type);
+ }
+ 
++static void lockdep_set_quota_inode(struct inode *inode, int subclass)
++{
++	struct ext4_inode_info *ei = EXT4_I(inode);
++
++	/* The first argument of lockdep_set_subclass has to be
++	 * *exactly* the same as the argument to init_rwsem() --- in
++	 * this case, in init_once() --- or lockdep gets unhappy
++	 * because the name of the lock is set using the
++	 * stringification of the argument to init_rwsem().
++	 */
++	(void) ei;	/* shut up clang warning if !CONFIG_LOCKDEP */
++	lockdep_set_subclass(&ei->i_data_sem, subclass);
++}
++
+ /*
+  * Standard function to be called on quota_on
+  */
+@@ -4975,8 +4989,12 @@ static int ext4_quota_on(struct super_block *sb, int type, int format_id,
+ 		if (err)
+ 			return err;
+ 	}
+-
+-	return dquot_quota_on(sb, type, format_id, path);
++	lockdep_set_quota_inode(path->dentry->d_inode, I_DATA_SEM_QUOTA);
++	err = dquot_quota_on(sb, type, format_id, path);
++	if (err)
++		lockdep_set_quota_inode(path->dentry->d_inode,
++					     I_DATA_SEM_NORMAL);
++	return err;
+ }
+ 
+ static int ext4_quota_enable(struct super_block *sb, int type, int format_id,
+@@ -5002,8 +5020,11 @@ static int ext4_quota_enable(struct super_block *sb, int type, int format_id,
+ 
+ 	/* Don't account quota for quota files to avoid recursion */
+ 	qf_inode->i_flags |= S_NOQUOTA;
++	lockdep_set_quota_inode(qf_inode, I_DATA_SEM_QUOTA);
+ 	err = dquot_enable(qf_inode, type, format_id, flags);
+ 	iput(qf_inode);
++	if (err)
++		lockdep_set_quota_inode(qf_inode, I_DATA_SEM_NORMAL);
+ 
+ 	return err;
+ }
+diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c
+index ce5a218..5fc2162 100644
+--- a/fs/nfs/dir.c
++++ b/fs/nfs/dir.c
+@@ -377,7 +377,7 @@ int nfs_readdir_xdr_filler(struct page **pages, nfs_readdir_descriptor_t *desc,
+  again:
+ 	timestamp = jiffies;
+ 	gencount = nfs_inc_attr_generation_counter();
+-	error = NFS_PROTO(inode)->readdir(file->f_path.dentry, cred, entry->cookie, pages,
++	error = NFS_PROTO(inode)->readdir(file_dentry(file), cred, entry->cookie, pages,
+ 					  NFS_SERVER(inode)->dtsize, desc->plus);
+ 	if (error < 0) {
+ 		/* We requested READDIRPLUS, but the server doesn't grok it */
+@@ -560,7 +560,7 @@ int nfs_readdir_page_filler(nfs_readdir_descriptor_t *desc, struct nfs_entry *en
+ 		count++;
+ 
+ 		if (desc->plus != 0)
+-			nfs_prime_dcache(desc->file->f_path.dentry, entry);
++			nfs_prime_dcache(file_dentry(desc->file), entry);
+ 
+ 		status = nfs_readdir_add_to_array(entry, page);
+ 		if (status != 0)
+@@ -864,7 +864,7 @@ static bool nfs_dir_mapping_need_revalidate(struct inode *dir)
+  */
+ static int nfs_readdir(struct file *file, struct dir_context *ctx)
+ {
+-	struct dentry	*dentry = file->f_path.dentry;
++	struct dentry	*dentry = file_dentry(file);
+ 	struct inode	*inode = d_inode(dentry);
+ 	nfs_readdir_descriptor_t my_desc,
+ 			*desc = &my_desc;
+diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
+index 3e2071a..f714b98 100644
+--- a/fs/nfs/inode.c
++++ b/fs/nfs/inode.c
+@@ -927,7 +927,7 @@ int nfs_open(struct inode *inode, struct file *filp)
+ {
+ 	struct nfs_open_context *ctx;
+ 
+-	ctx = alloc_nfs_open_context(filp->f_path.dentry, filp->f_mode);
++	ctx = alloc_nfs_open_context(file_dentry(filp), filp->f_mode);
+ 	if (IS_ERR(ctx))
+ 		return PTR_ERR(ctx);
+ 	nfs_file_set_open_context(filp, ctx);
+diff --git a/fs/nfs/nfs4file.c b/fs/nfs/nfs4file.c
+index db9b5fe..679e003 100644
+--- a/fs/nfs/nfs4file.c
++++ b/fs/nfs/nfs4file.c
+@@ -26,7 +26,7 @@ static int
+ nfs4_file_open(struct inode *inode, struct file *filp)
+ {
+ 	struct nfs_open_context *ctx;
+-	struct dentry *dentry = filp->f_path.dentry;
++	struct dentry *dentry = file_dentry(filp);
+ 	struct dentry *parent = NULL;
+ 	struct inode *dir;
+ 	unsigned openflags = filp->f_flags;
+@@ -57,7 +57,7 @@ nfs4_file_open(struct inode *inode, struct file *filp)
+ 	parent = dget_parent(dentry);
+ 	dir = d_inode(parent);
+ 
+-	ctx = alloc_nfs_open_context(filp->f_path.dentry, filp->f_mode);
++	ctx = alloc_nfs_open_context(file_dentry(filp), filp->f_mode);
+ 	err = PTR_ERR(ctx);
+ 	if (IS_ERR(ctx))
+ 		goto out;
+diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
+index 000b2ed..a1acc60 100644
+--- a/fs/overlayfs/super.c
++++ b/fs/overlayfs/super.c
+@@ -276,6 +276,37 @@ static void ovl_dentry_release(struct dentry *dentry)
+ 	}
+ }
+ 
++static struct dentry *ovl_d_real(struct dentry *dentry, struct inode *inode)
++{
++	struct dentry *real;
++
++	if (d_is_dir(dentry)) {
++		if (!inode || inode == d_inode(dentry))
++			return dentry;
++		goto bug;
++	}
++
++	real = ovl_dentry_upper(dentry);
++	if (real && (!inode || inode == d_inode(real)))
++		return real;
++
++	real = ovl_dentry_lower(dentry);
++	if (!real)
++		goto bug;
++
++	if (!inode || inode == d_inode(real))
++		return real;
++
++	/* Handle recursion */
++	if (real->d_flags & DCACHE_OP_REAL)
++		return real->d_op->d_real(real, inode);
++
++bug:
++	WARN(1, "ovl_d_real(%pd4, %s:%lu\n): real dentry not found\n", dentry,
++	     inode ? inode->i_sb->s_id : "NULL", inode ? inode->i_ino : 0);
++	return dentry;
++}
++
+ static int ovl_dentry_revalidate(struct dentry *dentry, unsigned int flags)
+ {
+ 	struct ovl_entry *oe = dentry->d_fsdata;
+@@ -320,11 +351,13 @@ static int ovl_dentry_weak_revalidate(struct dentry *dentry, unsigned int flags)
+ static const struct dentry_operations ovl_dentry_operations = {
+ 	.d_release = ovl_dentry_release,
+ 	.d_select_inode = ovl_d_select_inode,
++	.d_real = ovl_d_real,
+ };
+ 
+ static const struct dentry_operations ovl_reval_dentry_operations = {
+ 	.d_release = ovl_dentry_release,
+ 	.d_select_inode = ovl_d_select_inode,
++	.d_real = ovl_d_real,
+ 	.d_revalidate = ovl_dentry_revalidate,
+ 	.d_weak_revalidate = ovl_dentry_weak_revalidate,
+ };
+diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
+index 22ab246..eeae401 100644
+--- a/include/linux/compiler-gcc.h
++++ b/include/linux/compiler-gcc.h
+@@ -199,7 +199,7 @@
+ #define unreachable() __builtin_unreachable()
+ 
+ /* Mark a function definition as prohibited from being cloned. */
+-#define __noclone	__attribute__((__noclone__))
++#define __noclone	__attribute__((__noclone__, __optimize__("no-tracer")))
+ 
+ #endif /* GCC_VERSION >= 40500 */
+ 
+diff --git a/include/linux/dcache.h b/include/linux/dcache.h
+index 8a2e009..f513dd8 100644
+--- a/include/linux/dcache.h
++++ b/include/linux/dcache.h
+@@ -161,6 +161,7 @@ struct dentry_operations {
+ 	struct vfsmount *(*d_automount)(struct path *);
+ 	int (*d_manage)(struct dentry *, bool);
+ 	struct inode *(*d_select_inode)(struct dentry *, unsigned);
++	struct dentry *(*d_real)(struct dentry *, struct inode *);
+ } ____cacheline_aligned;
+ 
+ /*
+@@ -227,6 +228,7 @@ struct dentry_operations {
+ #define DCACHE_MAY_FREE			0x00800000
+ #define DCACHE_FALLTHRU			0x01000000 /* Fall through to lower layer */
+ #define DCACHE_OP_SELECT_INODE		0x02000000 /* Unioned entry: dcache op selects inode */
++#define DCACHE_OP_REAL			0x08000000
+ 
+ extern seqlock_t rename_lock;
+ 
+@@ -582,4 +584,12 @@ static inline struct dentry *d_backing_dentry(struct dentry *upper)
+ 	return upper;
+ }
+ 
++static inline struct dentry *d_real(struct dentry *dentry)
++{
++	if (unlikely(dentry->d_flags & DCACHE_OP_REAL))
++		return dentry->d_op->d_real(dentry, NULL);
++	else
++		return dentry;
++}
++
+ #endif	/* __LINUX_DCACHE_H */
+diff --git a/include/linux/filter.h b/include/linux/filter.h
+index 5972ffe..5110d42 100644
+--- a/include/linux/filter.h
++++ b/include/linux/filter.h
+@@ -446,8 +446,12 @@ int bpf_prog_create_from_user(struct bpf_prog **pfp, struct sock_fprog *fprog,
+ void bpf_prog_destroy(struct bpf_prog *fp);
+ 
+ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk);
++int __sk_attach_filter(struct sock_fprog *fprog, struct sock *sk,
++		       bool locked);
+ int sk_attach_bpf(u32 ufd, struct sock *sk);
+ int sk_detach_filter(struct sock *sk);
++int __sk_detach_filter(struct sock *sk, bool locked);
++
+ int sk_get_filter(struct sock *sk, struct sock_filter __user *filter,
+ 		  unsigned int len);
+ 
+diff --git a/include/linux/fs.h b/include/linux/fs.h
+index 22c5a0c..ab3d8d9 100644
+--- a/include/linux/fs.h
++++ b/include/linux/fs.h
+@@ -1207,6 +1207,16 @@ static inline struct inode *file_inode(const struct file *f)
+ 	return f->f_inode;
+ }
+ 
++static inline struct dentry *file_dentry(const struct file *file)
++{
++	struct dentry *dentry = file->f_path.dentry;
++
++	if (unlikely(dentry->d_flags & DCACHE_OP_REAL))
++		return dentry->d_op->d_real(dentry, file_inode(file));
++	else
++		return dentry;
++}
++
+ static inline int locks_lock_file_wait(struct file *filp, struct file_lock *fl)
+ {
+ 	return locks_lock_inode_wait(file_inode(filp), fl);
+diff --git a/include/linux/if_bridge.h b/include/linux/if_bridge.h
+index a338a688..dcb89e3 100644
+--- a/include/linux/if_bridge.h
++++ b/include/linux/if_bridge.h
+@@ -46,10 +46,6 @@ struct br_ip_list {
+ #define BR_LEARNING_SYNC	BIT(9)
+ #define BR_PROXYARP_WIFI	BIT(10)
+ 
+-/* values as per ieee8021QBridgeFdbAgingTime */
+-#define BR_MIN_AGEING_TIME	(10 * HZ)
+-#define BR_MAX_AGEING_TIME	(1000000 * HZ)
+-
+ #define BR_DEFAULT_AGEING_TIME	(300 * HZ)
+ 
+ extern void brioctl_set(int (*ioctl_hook)(struct net *, unsigned int, void __user *));
+diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
+index 3143c84..04c068e 100644
+--- a/include/linux/netdevice.h
++++ b/include/linux/netdevice.h
+@@ -265,6 +265,7 @@ struct header_ops {
+ 	void	(*cache_update)(struct hh_cache *hh,
+ 				const struct net_device *dev,
+ 				const unsigned char *haddr);
++	bool	(*validate)(const char *ll_header, unsigned int len);
+ };
+ 
+ /* These flag bits are private to the generic network queueing
+@@ -1398,8 +1399,7 @@ enum netdev_priv_flags {
+  *	@dma:		DMA channel
+  *	@mtu:		Interface MTU value
+  *	@type:		Interface hardware type
+- *	@hard_header_len: Hardware header length, which means that this is the
+- *			  minimum size of a packet.
++ *	@hard_header_len: Maximum hardware header length.
+  *
+  *	@needed_headroom: Extra headroom the hardware may need, but not in all
+  *			  cases can this be guaranteed
+@@ -2493,6 +2493,24 @@ static inline int dev_parse_header(const struct sk_buff *skb,
+ 	return dev->header_ops->parse(skb, haddr);
+ }
+ 
++/* ll_header must have at least hard_header_len allocated */
++static inline bool dev_validate_header(const struct net_device *dev,
++				       char *ll_header, int len)
++{
++	if (likely(len >= dev->hard_header_len))
++		return true;
++
++	if (capable(CAP_SYS_RAWIO)) {
++		memset(ll_header + len, 0, dev->hard_header_len - len);
++		return true;
++	}
++
++	if (dev->header_ops && dev->header_ops->validate)
++		return dev->header_ops->validate(ll_header, len);
++
++	return false;
++}
++
+ typedef int gifconf_func_t(struct net_device * dev, char __user * bufptr, int len);
+ int register_gifconf(unsigned int family, gifconf_func_t *gifconf);
+ static inline int unregister_gifconf(unsigned int family)
+diff --git a/include/linux/pci.h b/include/linux/pci.h
+index 4e554bf..e89c7ee 100644
+--- a/include/linux/pci.h
++++ b/include/linux/pci.h
+@@ -989,23 +989,6 @@ static inline int pci_is_managed(struct pci_dev *pdev)
+ 	return pdev->is_managed;
+ }
+ 
+-static inline void pci_set_managed_irq(struct pci_dev *pdev, unsigned int irq)
+-{
+-	pdev->irq = irq;
+-	pdev->irq_managed = 1;
+-}
+-
+-static inline void pci_reset_managed_irq(struct pci_dev *pdev)
+-{
+-	pdev->irq = 0;
+-	pdev->irq_managed = 0;
+-}
+-
+-static inline bool pci_has_managed_irq(struct pci_dev *pdev)
+-{
+-	return pdev->irq_managed && pdev->irq > 0;
+-}
+-
+ void pci_disable_device(struct pci_dev *dev);
+ 
+ extern unsigned int pcibios_max_latency;
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index 75f136a..4fde618 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -1908,6 +1908,30 @@ static inline void skb_reserve(struct sk_buff *skb, int len)
+ 	skb->tail += len;
+ }
+ 
++/**
++ *	skb_tailroom_reserve - adjust reserved_tailroom
++ *	@skb: buffer to alter
++ *	@mtu: maximum amount of headlen permitted
++ *	@needed_tailroom: minimum amount of reserved_tailroom
++ *
++ *	Set reserved_tailroom so that headlen can be as large as possible but
++ *	not larger than mtu and tailroom cannot be smaller than
++ *	needed_tailroom.
++ *	The required headroom should already have been reserved before using
++ *	this function.
++ */
++static inline void skb_tailroom_reserve(struct sk_buff *skb, unsigned int mtu,
++					unsigned int needed_tailroom)
++{
++	SKB_LINEAR_ASSERT(skb);
++	if (mtu < skb_tailroom(skb) - needed_tailroom)
++		/* use at most mtu */
++		skb->reserved_tailroom = skb_tailroom(skb) - mtu;
++	else
++		/* use up to all available space */
++		skb->reserved_tailroom = needed_tailroom;
++}
++
+ #define ENCAP_TYPE_ETHER	0
+ #define ENCAP_TYPE_IPPROTO	1
+ 
+@@ -2724,6 +2748,23 @@ static inline void skb_postpull_rcsum(struct sk_buff *skb,
+ 
+ unsigned char *skb_pull_rcsum(struct sk_buff *skb, unsigned int len);
+ 
++static inline void skb_postpush_rcsum(struct sk_buff *skb,
++				      const void *start, unsigned int len)
++{
++	/* For performing the reverse operation to skb_postpull_rcsum(),
++	 * we can instead of ...
++	 *
++	 *   skb->csum = csum_add(skb->csum, csum_partial(start, len, 0));
++	 *
++	 * ... just use this equivalent version here to save a few
++	 * instructions. Feeding csum of 0 in csum_partial() and later
++	 * on adding skb->csum is equivalent to feed skb->csum in the
++	 * first place.
++	 */
++	if (skb->ip_summed == CHECKSUM_COMPLETE)
++		skb->csum = csum_partial(start, len, skb->csum);
++}
++
+ /**
+  *	pskb_trim_rcsum - trim received skb and update checksum
+  *	@skb: buffer to trim
+diff --git a/include/linux/usb_usual.h b/include/linux/usb_usual.h
+index 7f5f78b..245f57d 100644
+--- a/include/linux/usb_usual.h
++++ b/include/linux/usb_usual.h
+@@ -79,6 +79,8 @@
+ 		/* Cannot handle MI_REPORT_SUPPORTED_OPERATION_CODES */	\
+ 	US_FLAG(MAX_SECTORS_240,	0x08000000)		\
+ 		/* Sets max_sectors to 240 */			\
++	US_FLAG(NO_REPORT_LUNS,	0x10000000)			\
++		/* Cannot handle REPORT_LUNS */			\
+ 
+ #define US_FLAG(name, value)	US_FL_##name = value ,
+ enum { US_DO_ALL_FLAGS };
+diff --git a/include/net/bonding.h b/include/net/bonding.h
+index c1740a2..93abe5f 100644
+--- a/include/net/bonding.h
++++ b/include/net/bonding.h
+@@ -214,6 +214,7 @@ struct bonding {
+ 	 * ALB mode (6) - to sync the use and modifications of its hash table
+ 	 */
+ 	spinlock_t mode_lock;
++	spinlock_t stats_lock;
+ 	u8	 send_peer_notif;
+ 	u8       igmp_retrans;
+ #ifdef CONFIG_PROC_FS
+diff --git a/kernel/bpf/helpers.c b/kernel/bpf/helpers.c
+index 4504ca6..50da680 100644
+--- a/kernel/bpf/helpers.c
++++ b/kernel/bpf/helpers.c
+@@ -166,7 +166,7 @@ static u64 bpf_get_current_comm(u64 r1, u64 size, u64 r3, u64 r4, u64 r5)
+ 	if (!task)
+ 		return -EINVAL;
+ 
+-	memcpy(buf, task->comm, min_t(size_t, size, sizeof(task->comm)));
++	strlcpy(buf, task->comm, min_t(size_t, size, sizeof(task->comm)));
+ 	return 0;
+ }
+ 
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index faf2067..1e889a0 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -1580,14 +1580,14 @@ event_sched_out(struct perf_event *event,
+ 
+ 	perf_pmu_disable(event->pmu);
+ 
++	event->tstamp_stopped = tstamp;
++	event->pmu->del(event, 0);
++	event->oncpu = -1;
+ 	event->state = PERF_EVENT_STATE_INACTIVE;
+ 	if (event->pending_disable) {
+ 		event->pending_disable = 0;
+ 		event->state = PERF_EVENT_STATE_OFF;
+ 	}
+-	event->tstamp_stopped = tstamp;
+-	event->pmu->del(event, 0);
+-	event->oncpu = -1;
+ 
+ 	if (!is_software_event(event))
+ 		cpuctx->active_oncpu--;
+@@ -8583,7 +8583,12 @@ err_context:
+ 	perf_unpin_context(ctx);
+ 	put_ctx(ctx);
+ err_alloc:
+-	free_event(event);
++	/*
++	 * If event_file is set, the fput() above will have called ->release()
++	 * and that will take care of freeing the event.
++	 */
++	if (!event_file)
++		free_event(event);
+ err_cpus:
+ 	put_online_cpus();
+ err_task:
+diff --git a/mm/page_isolation.c b/mm/page_isolation.c
+index 4568fd5..00c9646 100644
+--- a/mm/page_isolation.c
++++ b/mm/page_isolation.c
+@@ -283,11 +283,11 @@ struct page *alloc_migrate_target(struct page *page, unsigned long private,
+ 	 * now as a simple work-around, we use the next node for destination.
+ 	 */
+ 	if (PageHuge(page)) {
+-		nodemask_t src = nodemask_of_node(page_to_nid(page));
+-		nodemask_t dst;
+-		nodes_complement(dst, src);
++		int node = next_online_node(page_to_nid(page));
++		if (node == MAX_NUMNODES)
++			node = first_online_node;
+ 		return alloc_huge_page_node(page_hstate(compound_head(page)),
+-					    next_node(page_to_nid(page), dst));
++					    node);
+ 	}
+ 
+ 	if (PageHighMem(page))
+diff --git a/net/ax25/ax25_ip.c b/net/ax25/ax25_ip.c
+index b563a3f..2fa3be9 100644
+--- a/net/ax25/ax25_ip.c
++++ b/net/ax25/ax25_ip.c
+@@ -228,8 +228,23 @@ netdev_tx_t ax25_ip_xmit(struct sk_buff *skb)
+ }
+ #endif
+ 
++static bool ax25_validate_header(const char *header, unsigned int len)
++{
++	ax25_digi digi;
++
++	if (!len)
++		return false;
++
++	if (header[0])
++		return true;
++
++	return ax25_addr_parse(header + 1, len - 1, NULL, NULL, &digi, NULL,
++			       NULL);
++}
++
+ const struct header_ops ax25_header_ops = {
+ 	.create = ax25_hard_header,
++	.validate = ax25_validate_header,
+ };
+ 
+ EXPORT_SYMBOL(ax25_header_ops);
+diff --git a/net/bridge/br_stp.c b/net/bridge/br_stp.c
+index 5f3f645..eff69cb 100644
+--- a/net/bridge/br_stp.c
++++ b/net/bridge/br_stp.c
+@@ -567,6 +567,14 @@ int br_set_max_age(struct net_bridge *br, unsigned long val)
+ 
+ }
+ 
++/* Set time interval that dynamic forwarding entries live
++ * For pure software bridge, allow values outside the 802.1
++ * standard specification for special cases:
++ *  0 - entry never ages (all permanant)
++ *  1 - entry disappears (no persistance)
++ *
++ * Offloaded switch entries maybe more restrictive
++ */
+ int br_set_ageing_time(struct net_bridge *br, u32 ageing_time)
+ {
+ 	struct switchdev_attr attr = {
+@@ -577,11 +585,8 @@ int br_set_ageing_time(struct net_bridge *br, u32 ageing_time)
+ 	unsigned long t = clock_t_to_jiffies(ageing_time);
+ 	int err;
+ 
+-	if (t < BR_MIN_AGEING_TIME || t > BR_MAX_AGEING_TIME)
+-		return -ERANGE;
+-
+ 	err = switchdev_port_attr_set(br->dev, &attr);
+-	if (err)
++	if (err && err != -EOPNOTSUPP)
+ 		return err;
+ 
+ 	br->ageing_time = t;
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 37157c4..f393a22 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -1139,7 +1139,8 @@ void bpf_prog_destroy(struct bpf_prog *fp)
+ }
+ EXPORT_SYMBOL_GPL(bpf_prog_destroy);
+ 
+-static int __sk_attach_prog(struct bpf_prog *prog, struct sock *sk)
++static int __sk_attach_prog(struct bpf_prog *prog, struct sock *sk,
++			    bool locked)
+ {
+ 	struct sk_filter *fp, *old_fp;
+ 
+@@ -1155,10 +1156,8 @@ static int __sk_attach_prog(struct bpf_prog *prog, struct sock *sk)
+ 		return -ENOMEM;
+ 	}
+ 
+-	old_fp = rcu_dereference_protected(sk->sk_filter,
+-					   sock_owned_by_user(sk));
++	old_fp = rcu_dereference_protected(sk->sk_filter, locked);
+ 	rcu_assign_pointer(sk->sk_filter, fp);
+-
+ 	if (old_fp)
+ 		sk_filter_uncharge(sk, old_fp);
+ 
+@@ -1175,7 +1174,8 @@ static int __sk_attach_prog(struct bpf_prog *prog, struct sock *sk)
+  * occurs or there is insufficient memory for the filter a negative
+  * errno code is returned. On success the return is zero.
+  */
+-int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
++int __sk_attach_filter(struct sock_fprog *fprog, struct sock *sk,
++		       bool locked)
+ {
+ 	unsigned int fsize = bpf_classic_proglen(fprog);
+ 	unsigned int bpf_fsize = bpf_prog_size(fprog->len);
+@@ -1213,7 +1213,7 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
+ 	if (IS_ERR(prog))
+ 		return PTR_ERR(prog);
+ 
+-	err = __sk_attach_prog(prog, sk);
++	err = __sk_attach_prog(prog, sk, locked);
+ 	if (err < 0) {
+ 		__bpf_prog_release(prog);
+ 		return err;
+@@ -1221,7 +1221,12 @@ int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
+ 
+ 	return 0;
+ }
+-EXPORT_SYMBOL_GPL(sk_attach_filter);
++EXPORT_SYMBOL_GPL(__sk_attach_filter);
++
++int sk_attach_filter(struct sock_fprog *fprog, struct sock *sk)
++{
++	return __sk_attach_filter(fprog, sk, sock_owned_by_user(sk));
++}
+ 
+ int sk_attach_bpf(u32 ufd, struct sock *sk)
+ {
+@@ -1240,7 +1245,7 @@ int sk_attach_bpf(u32 ufd, struct sock *sk)
+ 		return -EINVAL;
+ 	}
+ 
+-	err = __sk_attach_prog(prog, sk);
++	err = __sk_attach_prog(prog, sk, sock_owned_by_user(sk));
+ 	if (err < 0) {
+ 		bpf_prog_put(prog);
+ 		return err;
+@@ -1913,7 +1918,7 @@ static int __init register_sk_filter_ops(void)
+ }
+ late_initcall(register_sk_filter_ops);
+ 
+-int sk_detach_filter(struct sock *sk)
++int __sk_detach_filter(struct sock *sk, bool locked)
+ {
+ 	int ret = -ENOENT;
+ 	struct sk_filter *filter;
+@@ -1921,8 +1926,7 @@ int sk_detach_filter(struct sock *sk)
+ 	if (sock_flag(sk, SOCK_FILTER_LOCKED))
+ 		return -EPERM;
+ 
+-	filter = rcu_dereference_protected(sk->sk_filter,
+-					   sock_owned_by_user(sk));
++	filter = rcu_dereference_protected(sk->sk_filter, locked);
+ 	if (filter) {
+ 		RCU_INIT_POINTER(sk->sk_filter, NULL);
+ 		sk_filter_uncharge(sk, filter);
+@@ -1931,7 +1935,12 @@ int sk_detach_filter(struct sock *sk)
+ 
+ 	return ret;
+ }
+-EXPORT_SYMBOL_GPL(sk_detach_filter);
++EXPORT_SYMBOL_GPL(__sk_detach_filter);
++
++int sk_detach_filter(struct sock *sk)
++{
++	return __sk_detach_filter(sk, sock_owned_by_user(sk));
++}
+ 
+ int sk_get_filter(struct sock *sk, struct sock_filter __user *ubuf,
+ 		  unsigned int len)
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index 34ba7a0..ca966f7 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -905,6 +905,7 @@ static noinline size_t if_nlmsg_size(const struct net_device *dev,
+ 	       + rtnl_link_get_af_size(dev, ext_filter_mask) /* IFLA_AF_SPEC */
+ 	       + nla_total_size(MAX_PHYS_ITEM_ID_LEN) /* IFLA_PHYS_PORT_ID */
+ 	       + nla_total_size(MAX_PHYS_ITEM_ID_LEN) /* IFLA_PHYS_SWITCH_ID */
++	       + nla_total_size(IFNAMSIZ) /* IFLA_PHYS_PORT_NAME */
+ 	       + nla_total_size(1); /* IFLA_PROTO_DOWN */
+ 
+ }
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 5bf88f5..8616d11 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -2948,6 +2948,24 @@ int skb_append_pagefrags(struct sk_buff *skb, struct page *page,
+ EXPORT_SYMBOL_GPL(skb_append_pagefrags);
+ 
+ /**
++ *	skb_push_rcsum - push skb and update receive checksum
++ *	@skb: buffer to update
++ *	@len: length of data pulled
++ *
++ *	This function performs an skb_push on the packet and updates
++ *	the CHECKSUM_COMPLETE checksum.  It should be used on
++ *	receive path processing instead of skb_push unless you know
++ *	that the checksum difference is zero (e.g., a valid IP header)
++ *	or you are setting ip_summed to CHECKSUM_NONE.
++ */
++static unsigned char *skb_push_rcsum(struct sk_buff *skb, unsigned len)
++{
++	skb_push(skb, len);
++	skb_postpush_rcsum(skb, skb->data, len);
++	return skb->data;
++}
++
++/**
+  *	skb_pull_rcsum - pull skb and update receive checksum
+  *	@skb: buffer to update
+  *	@len: length of data pulled
+@@ -4084,9 +4102,9 @@ struct sk_buff *skb_checksum_trimmed(struct sk_buff *skb,
+ 	if (!pskb_may_pull(skb_chk, offset))
+ 		goto err;
+ 
+-	__skb_pull(skb_chk, offset);
++	skb_pull_rcsum(skb_chk, offset);
+ 	ret = skb_chkf(skb_chk);
+-	__skb_push(skb_chk, offset);
++	skb_push_rcsum(skb_chk, offset);
+ 
+ 	if (ret)
+ 		goto err;
+diff --git a/net/dccp/ipv4.c b/net/dccp/ipv4.c
+index 902d606..8be8f27 100644
+--- a/net/dccp/ipv4.c
++++ b/net/dccp/ipv4.c
+@@ -204,8 +204,6 @@ void dccp_req_err(struct sock *sk, u64 seq)
+ 	 * ICMPs are not backlogged, hence we cannot get an established
+ 	 * socket here.
+ 	 */
+-	WARN_ON(req->sk);
+-
+ 	if (!between48(seq, dccp_rsk(req)->dreq_iss, dccp_rsk(req)->dreq_gss)) {
+ 		NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
+ 	} else {
+diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
+index f6303b1..0212591 100644
+--- a/net/ipv4/devinet.c
++++ b/net/ipv4/devinet.c
+@@ -334,6 +334,9 @@ static void __inet_del_ifa(struct in_device *in_dev, struct in_ifaddr **ifap,
+ 
+ 	ASSERT_RTNL();
+ 
++	if (in_dev->dead)
++		goto no_promotions;
++
+ 	/* 1. Deleting primary ifaddr forces deletion all secondaries
+ 	 * unless alias promotion is set
+ 	 **/
+@@ -380,6 +383,7 @@ static void __inet_del_ifa(struct in_device *in_dev, struct in_ifaddr **ifap,
+ 			fib_del_ifaddr(ifa, ifa1);
+ 	}
+ 
++no_promotions:
+ 	/* 2. Unlink it */
+ 
+ 	*ifap = ifa1->ifa_next;
+diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
+index 4734475..8a9246d 100644
+--- a/net/ipv4/fib_frontend.c
++++ b/net/ipv4/fib_frontend.c
+@@ -280,7 +280,6 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb)
+ 	struct in_device *in_dev;
+ 	struct fib_result res;
+ 	struct rtable *rt;
+-	struct flowi4 fl4;
+ 	struct net *net;
+ 	int scope;
+ 
+@@ -296,14 +295,13 @@ __be32 fib_compute_spec_dst(struct sk_buff *skb)
+ 
+ 	scope = RT_SCOPE_UNIVERSE;
+ 	if (!ipv4_is_zeronet(ip_hdr(skb)->saddr)) {
+-		fl4.flowi4_oif = 0;
+-		fl4.flowi4_iif = LOOPBACK_IFINDEX;
+-		fl4.daddr = ip_hdr(skb)->saddr;
+-		fl4.saddr = 0;
+-		fl4.flowi4_tos = RT_TOS(ip_hdr(skb)->tos);
+-		fl4.flowi4_scope = scope;
+-		fl4.flowi4_mark = IN_DEV_SRC_VMARK(in_dev) ? skb->mark : 0;
+-		fl4.flowi4_tun_key.tun_id = 0;
++		struct flowi4 fl4 = {
++			.flowi4_iif = LOOPBACK_IFINDEX,
++			.daddr = ip_hdr(skb)->saddr,
++			.flowi4_tos = RT_TOS(ip_hdr(skb)->tos),
++			.flowi4_scope = scope,
++			.flowi4_mark = IN_DEV_SRC_VMARK(in_dev) ? skb->mark : 0,
++		};
+ 		if (!fib_lookup(net, &fl4, &res, 0))
+ 			return FIB_RES_PREFSRC(net, res);
+ 	} else {
+@@ -922,6 +920,9 @@ void fib_del_ifaddr(struct in_ifaddr *ifa, struct in_ifaddr *iprim)
+ 		subnet = 1;
+ 	}
+ 
++	if (in_dev->dead)
++		goto no_promotions;
++
+ 	/* Deletion is more complicated than add.
+ 	 * We should take care of not to delete too much :-)
+ 	 *
+@@ -997,6 +998,7 @@ void fib_del_ifaddr(struct in_ifaddr *ifa, struct in_ifaddr *iprim)
+ 		}
+ 	}
+ 
++no_promotions:
+ 	if (!(ok & BRD_OK))
+ 		fib_magic(RTM_DELROUTE, RTN_BROADCAST, ifa->ifa_broadcast, 32, prim);
+ 	if (subnet && ifa->ifa_prefixlen < 31) {
+diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c
+index 05e4cba..b3086cf 100644
+--- a/net/ipv4/igmp.c
++++ b/net/ipv4/igmp.c
+@@ -356,9 +356,8 @@ static struct sk_buff *igmpv3_newpack(struct net_device *dev, unsigned int mtu)
+ 	skb_dst_set(skb, &rt->dst);
+ 	skb->dev = dev;
+ 
+-	skb->reserved_tailroom = skb_end_offset(skb) -
+-				 min(mtu, skb_end_offset(skb));
+ 	skb_reserve(skb, hlen);
++	skb_tailroom_reserve(skb, mtu, tlen);
+ 
+ 	skb_reset_network_header(skb);
+ 	pip = ip_hdr(skb);
+diff --git a/net/ipv4/ip_output.c b/net/ipv4/ip_output.c
+index 49f0285..f2ad521 100644
+--- a/net/ipv4/ip_output.c
++++ b/net/ipv4/ip_output.c
+@@ -1237,13 +1237,16 @@ ssize_t	ip_append_page(struct sock *sk, struct flowi4 *fl4, struct page *page,
+ 	if (!skb)
+ 		return -EINVAL;
+ 
+-	cork->length += size;
+ 	if ((size + skb->len > mtu) &&
+ 	    (sk->sk_protocol == IPPROTO_UDP) &&
+ 	    (rt->dst.dev->features & NETIF_F_UFO)) {
++		if (skb->ip_summed != CHECKSUM_PARTIAL)
++			return -EOPNOTSUPP;
++
+ 		skb_shinfo(skb)->gso_size = mtu - fragheaderlen;
+ 		skb_shinfo(skb)->gso_type = SKB_GSO_UDP;
+ 	}
++	cork->length += size;
+ 
+ 	while (size > 0) {
+ 		if (skb_is_gso(skb)) {
+diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c
+index cbb51f3..ce30c8b 100644
+--- a/net/ipv4/ip_tunnel.c
++++ b/net/ipv4/ip_tunnel.c
+@@ -663,6 +663,8 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+ 	inner_iph = (const struct iphdr *)skb_inner_network_header(skb);
+ 	connected = (tunnel->parms.iph.daddr != 0);
+ 
++	memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
++
+ 	dst = tnl_params->daddr;
+ 	if (dst == 0) {
+ 		/* NBMA tunnel */
+@@ -760,7 +762,6 @@ void ip_tunnel_xmit(struct sk_buff *skb, struct net_device *dev,
+ 				tunnel->err_time + IPTUNNEL_ERR_TIMEO)) {
+ 			tunnel->err_count--;
+ 
+-			memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
+ 			dst_link_failure(skb);
+ 		} else
+ 			tunnel->err_count = 0;
+diff --git a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
+index c6eb421..ea91058 100644
+--- a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
++++ b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
+@@ -108,10 +108,18 @@ static int masq_inet_event(struct notifier_block *this,
+ 			   unsigned long event,
+ 			   void *ptr)
+ {
+-	struct net_device *dev = ((struct in_ifaddr *)ptr)->ifa_dev->dev;
++	struct in_device *idev = ((struct in_ifaddr *)ptr)->ifa_dev;
+ 	struct netdev_notifier_info info;
+ 
+-	netdev_notifier_info_init(&info, dev);
++	/* The masq_dev_notifier will catch the case of the device going
++	 * down.  So if the inetdev is dead and being destroyed we have
++	 * no work to do.  Otherwise this is an individual address removal
++	 * and we have to perform the flush.
++	 */
++	if (idev->dead)
++		return NOTIFY_DONE;
++
++	netdev_notifier_info_init(&info, idev->dev);
+ 	return masq_device_event(this, event, &info);
+ }
+ 
+diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
+index 8c7e631..048418b 100644
+--- a/net/ipv4/tcp_ipv4.c
++++ b/net/ipv4/tcp_ipv4.c
+@@ -320,8 +320,6 @@ void tcp_req_err(struct sock *sk, u32 seq, bool abort)
+ 	/* ICMPs are not backlogged, hence we cannot get
+ 	 * an established socket here.
+ 	 */
+-	WARN_ON(req->sk);
+-
+ 	if (seq != tcp_rsk(req)->snt_isn) {
+ 		NET_INC_STATS_BH(net, LINUX_MIB_OUTOFWINDOWICMPS);
+ 	} else if (abort) {
+diff --git a/net/ipv4/tcp_metrics.c b/net/ipv4/tcp_metrics.c
+index c8cbc2b..a726d78 100644
+--- a/net/ipv4/tcp_metrics.c
++++ b/net/ipv4/tcp_metrics.c
+@@ -550,7 +550,7 @@ reset:
+ 	 */
+ 	if (crtt > tp->srtt_us) {
+ 		/* Set RTO like tcp_rtt_estimator(), but from cached RTT. */
+-		crtt /= 8 * USEC_PER_MSEC;
++		crtt /= 8 * USEC_PER_SEC / HZ;
+ 		inet_csk(sk)->icsk_rto = crtt + max(2 * crtt, tcp_rto_min(sk));
+ 	} else if (tp->srtt_us == 0) {
+ 		/* RFC6298: 5.7 We've failed to get a valid RTT sample from
+diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
+index ac6b196..9475a27 100644
+--- a/net/ipv4/tcp_minisocks.c
++++ b/net/ipv4/tcp_minisocks.c
+@@ -458,7 +458,7 @@ struct sock *tcp_create_openreq_child(const struct sock *sk,
+ 
+ 		newtp->rcv_wup = newtp->copied_seq =
+ 		newtp->rcv_nxt = treq->rcv_isn + 1;
+-		newtp->segs_in = 0;
++		newtp->segs_in = 1;
+ 
+ 		newtp->snd_sml = newtp->snd_una =
+ 		newtp->snd_nxt = newtp->snd_up = treq->snt_isn + 1;
+@@ -818,6 +818,7 @@ int tcp_child_process(struct sock *parent, struct sock *child,
+ 	int ret = 0;
+ 	int state = child->sk_state;
+ 
++	tcp_sk(child)->segs_in += max_t(u16, 1, skb_shinfo(skb)->gso_segs);
+ 	if (!sock_owned_by_user(child)) {
+ 		ret = tcp_rcv_state_process(child, skb);
+ 		/* Wakeup parent, send SIGIO */
+diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
+index 7f8ab46..21fbb54 100644
+--- a/net/ipv4/udp.c
++++ b/net/ipv4/udp.c
+@@ -1990,10 +1990,14 @@ void udp_v4_early_demux(struct sk_buff *skb)
+ 		if (!in_dev)
+ 			return;
+ 
+-		ours = ip_check_mc_rcu(in_dev, iph->daddr, iph->saddr,
+-				       iph->protocol);
+-		if (!ours)
+-			return;
++		/* we are supposed to accept bcast packets */
++		if (skb->pkt_type == PACKET_MULTICAST) {
++			ours = ip_check_mc_rcu(in_dev, iph->daddr, iph->saddr,
++					       iph->protocol);
++			if (!ours)
++				return;
++		}
++
+ 		sk = __udp4_lib_mcast_demux_lookup(net, uh->dest, iph->daddr,
+ 						   uh->source, iph->saddr, dif);
+ 	} else if (skb->pkt_type == PACKET_HOST) {
+diff --git a/net/ipv4/udp_tunnel.c b/net/ipv4/udp_tunnel.c
+index aba4286..280a9bd 100644
+--- a/net/ipv4/udp_tunnel.c
++++ b/net/ipv4/udp_tunnel.c
+@@ -89,6 +89,8 @@ int udp_tunnel_xmit_skb(struct rtable *rt, struct sock *sk, struct sk_buff *skb,
+ 	uh->source = src_port;
+ 	uh->len = htons(skb->len);
+ 
++	memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
++
+ 	udp_set_csum(nocheck, skb, src, dst, skb->len);
+ 
+ 	return iptunnel_xmit(sk, rt, skb, src, dst, IPPROTO_UDP,
+diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c
+index 5c5d23e..9508a20 100644
+--- a/net/ipv6/exthdrs_core.c
++++ b/net/ipv6/exthdrs_core.c
+@@ -257,7 +257,11 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset,
+ 						*fragoff = _frag_off;
+ 					return hp->nexthdr;
+ 				}
+-				return -ENOENT;
++				if (!found)
++					return -ENOENT;
++				if (fragoff)
++					*fragoff = _frag_off;
++				break;
+ 			}
+ 			hdrlen = 8;
+ 		} else if (nexthdr == NEXTHDR_AUTH) {
+diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
+index e5ea177..4650c68 100644
+--- a/net/ipv6/ip6_gre.c
++++ b/net/ipv6/ip6_gre.c
+@@ -778,6 +778,8 @@ static inline int ip6gre_xmit_ipv4(struct sk_buff *skb, struct net_device *dev)
+ 	__u32 mtu;
+ 	int err;
+ 
++	memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
++
+ 	if (!(t->parms.flags & IP6_TNL_F_IGN_ENCAP_LIMIT))
+ 		encap_limit = t->parms.encap_limit;
+ 
+diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
+index 31144c4..a175152 100644
+--- a/net/ipv6/ip6_output.c
++++ b/net/ipv6/ip6_output.c
+@@ -1091,8 +1091,8 @@ static inline int ip6_ufo_append_data(struct sock *sk,
+ 			int getfrag(void *from, char *to, int offset, int len,
+ 			int odd, struct sk_buff *skb),
+ 			void *from, int length, int hh_len, int fragheaderlen,
+-			int transhdrlen, int mtu, unsigned int flags,
+-			const struct flowi6 *fl6)
++			int exthdrlen, int transhdrlen, int mtu,
++			unsigned int flags, const struct flowi6 *fl6)
+ 
+ {
+ 	struct sk_buff *skb;
+@@ -1117,7 +1117,7 @@ static inline int ip6_ufo_append_data(struct sock *sk,
+ 		skb_put(skb, fragheaderlen + transhdrlen);
+ 
+ 		/* initialize network header pointer */
+-		skb_reset_network_header(skb);
++		skb_set_network_header(skb, exthdrlen);
+ 
+ 		/* initialize protocol header pointer */
+ 		skb->transport_header = skb->network_header + fragheaderlen;
+@@ -1359,7 +1359,7 @@ emsgsize:
+ 	    (rt->dst.dev->features & NETIF_F_UFO) &&
+ 	    (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk)) {
+ 		err = ip6_ufo_append_data(sk, queue, getfrag, from, length,
+-					  hh_len, fragheaderlen,
++					  hh_len, fragheaderlen, exthdrlen,
+ 					  transhdrlen, mtu, flags, fl6);
+ 		if (err)
+ 			goto error;
+diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
+index 137fca4..3991b21 100644
+--- a/net/ipv6/ip6_tunnel.c
++++ b/net/ipv6/ip6_tunnel.c
+@@ -343,12 +343,12 @@ static int ip6_tnl_create2(struct net_device *dev)
+ 
+ 	t = netdev_priv(dev);
+ 
++	dev->rtnl_link_ops = &ip6_link_ops;
+ 	err = register_netdevice(dev);
+ 	if (err < 0)
+ 		goto out;
+ 
+ 	strcpy(t->parms.name, dev->name);
+-	dev->rtnl_link_ops = &ip6_link_ops;
+ 
+ 	dev_hold(dev);
+ 	ip6_tnl_link(ip6n, t);
+@@ -1180,6 +1180,8 @@ ip4ip6_tnl_xmit(struct sk_buff *skb, struct net_device *dev)
+ 	u8 tproto;
+ 	int err;
+ 
++	memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
++
+ 	tproto = ACCESS_ONCE(t->parms.proto);
+ 	if (tproto != IPPROTO_IPIP && tproto != 0)
+ 		return -1;
+diff --git a/net/ipv6/mcast.c b/net/ipv6/mcast.c
+index 5ee56d0..d64ee7e 100644
+--- a/net/ipv6/mcast.c
++++ b/net/ipv6/mcast.c
+@@ -1574,9 +1574,8 @@ static struct sk_buff *mld_newpack(struct inet6_dev *idev, unsigned int mtu)
+ 		return NULL;
+ 
+ 	skb->priority = TC_PRIO_CONTROL;
+-	skb->reserved_tailroom = skb_end_offset(skb) -
+-				 min(mtu, skb_end_offset(skb));
+ 	skb_reserve(skb, hlen);
++	skb_tailroom_reserve(skb, mtu, tlen);
+ 
+ 	if (__ipv6_get_lladdr(idev, &addr_buf, IFA_F_TENTATIVE)) {
+ 		/* <draft-ietf-magma-mld-source-05.txt>:
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index 9da3287..6665e1a 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -837,8 +837,8 @@ start_lookup:
+ 		flush_stack(stack, count, skb, count - 1);
+ 	} else {
+ 		if (!inner_flushed)
+-			UDP_INC_STATS_BH(net, UDP_MIB_IGNOREDMULTI,
+-					 proto == IPPROTO_UDPLITE);
++			UDP6_INC_STATS_BH(net, UDP_MIB_IGNOREDMULTI,
++					  proto == IPPROTO_UDPLITE);
+ 		consume_skb(skb);
+ 	}
+ 	return 0;
+@@ -916,11 +916,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+ 		ret = udpv6_queue_rcv_skb(sk, skb);
+ 		sock_put(sk);
+ 
+-		/* a return value > 0 means to resubmit the input, but
+-		 * it wants the return to be -protocol, or 0
+-		 */
++		/* a return value > 0 means to resubmit the input */
+ 		if (ret > 0)
+-			return -ret;
++			return ret;
+ 
+ 		return 0;
+ 	}
+diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
+index ec22078..42de4cc 100644
+--- a/net/l2tp/l2tp_ip.c
++++ b/net/l2tp/l2tp_ip.c
+@@ -123,12 +123,11 @@ static int l2tp_ip_recv(struct sk_buff *skb)
+ 	struct l2tp_tunnel *tunnel = NULL;
+ 	int length;
+ 
+-	/* Point to L2TP header */
+-	optr = ptr = skb->data;
+-
+ 	if (!pskb_may_pull(skb, 4))
+ 		goto discard;
+ 
++	/* Point to L2TP header */
++	optr = ptr = skb->data;
+ 	session_id = ntohl(*((__be32 *) ptr));
+ 	ptr += 4;
+ 
+@@ -156,6 +155,9 @@ static int l2tp_ip_recv(struct sk_buff *skb)
+ 		if (!pskb_may_pull(skb, length))
+ 			goto discard;
+ 
++		/* Point to L2TP header */
++		optr = ptr = skb->data;
++		ptr += 4;
+ 		pr_debug("%s: ip recv\n", tunnel->name);
+ 		print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length);
+ 	}
+diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
+index a2c8747..9ee4ddb 100644
+--- a/net/l2tp/l2tp_ip6.c
++++ b/net/l2tp/l2tp_ip6.c
+@@ -135,12 +135,11 @@ static int l2tp_ip6_recv(struct sk_buff *skb)
+ 	struct l2tp_tunnel *tunnel = NULL;
+ 	int length;
+ 
+-	/* Point to L2TP header */
+-	optr = ptr = skb->data;
+-
+ 	if (!pskb_may_pull(skb, 4))
+ 		goto discard;
+ 
++	/* Point to L2TP header */
++	optr = ptr = skb->data;
+ 	session_id = ntohl(*((__be32 *) ptr));
+ 	ptr += 4;
+ 
+@@ -168,6 +167,9 @@ static int l2tp_ip6_recv(struct sk_buff *skb)
+ 		if (!pskb_may_pull(skb, length))
+ 			goto discard;
+ 
++		/* Point to L2TP header */
++		optr = ptr = skb->data;
++		ptr += 4;
+ 		pr_debug("%s: ip recv\n", tunnel->name);
+ 		print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length);
+ 	}
+diff --git a/net/mac80211/ibss.c b/net/mac80211/ibss.c
+index 6a12b0f..980e9e9 100644
+--- a/net/mac80211/ibss.c
++++ b/net/mac80211/ibss.c
+@@ -7,6 +7,7 @@
+  * Copyright 2007, Michael Wu <flamingice@sourmilk.net>
+  * Copyright 2009, Johannes Berg <johannes@sipsolutions.net>
+  * Copyright 2013-2014  Intel Mobile Communications GmbH
++ * Copyright(c) 2016 Intel Deutschland GmbH
+  *
+  * This program is free software; you can redistribute it and/or modify
+  * it under the terms of the GNU General Public License version 2 as
+@@ -1484,14 +1485,21 @@ static void ieee80211_sta_find_ibss(struct ieee80211_sub_if_data *sdata)
+ 
+ 		sdata_info(sdata, "Trigger new scan to find an IBSS to join\n");
+ 
+-		num = ieee80211_ibss_setup_scan_channels(local->hw.wiphy,
+-							 &ifibss->chandef,
+-							 channels,
+-							 ARRAY_SIZE(channels));
+ 		scan_width = cfg80211_chandef_to_scan_width(&ifibss->chandef);
+-		ieee80211_request_ibss_scan(sdata, ifibss->ssid,
+-					    ifibss->ssid_len, channels, num,
+-					    scan_width);
++
++		if (ifibss->fixed_channel) {
++			num = ieee80211_ibss_setup_scan_channels(local->hw.wiphy,
++								 &ifibss->chandef,
++								 channels,
++								 ARRAY_SIZE(channels));
++			ieee80211_request_ibss_scan(sdata, ifibss->ssid,
++						    ifibss->ssid_len, channels,
++						    num, scan_width);
++		} else {
++			ieee80211_request_ibss_scan(sdata, ifibss->ssid,
++						    ifibss->ssid_len, NULL,
++						    0, scan_width);
++		}
+ 	} else {
+ 		int interval = IEEE80211_SCAN_INTERVAL;
+ 
+diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
+index c9e325d..7a2b791 100644
+--- a/net/mac80211/iface.c
++++ b/net/mac80211/iface.c
+@@ -977,7 +977,10 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
+ 	if (sdata->vif.txq) {
+ 		struct txq_info *txqi = to_txq_info(sdata->vif.txq);
+ 
++		spin_lock_bh(&txqi->queue.lock);
+ 		ieee80211_purge_tx_queue(&local->hw, &txqi->queue);
++		spin_unlock_bh(&txqi->queue.lock);
++
+ 		atomic_set(&sdata->txqs_len[txqi->txq.ac], 0);
+ 	}
+ 
+diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
+index 4cbf36c..a3bb8f7 100644
+--- a/net/mac80211/rx.c
++++ b/net/mac80211/rx.c
+@@ -2250,7 +2250,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
+ 	struct ieee80211_local *local = rx->local;
+ 	struct ieee80211_sub_if_data *sdata = rx->sdata;
+ 	struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh;
+-	u16 q, hdrlen;
++	u16 ac, q, hdrlen;
+ 
+ 	hdr = (struct ieee80211_hdr *) skb->data;
+ 	hdrlen = ieee80211_hdrlen(hdr->frame_control);
+@@ -2319,7 +2319,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx)
+ 	    ether_addr_equal(sdata->vif.addr, hdr->addr3))
+ 		return RX_CONTINUE;
+ 
+-	q = ieee80211_select_queue_80211(sdata, skb, hdr);
++	ac = ieee80211_select_queue_80211(sdata, skb, hdr);
++	q = sdata->vif.hw_queue[ac];
+ 	if (ieee80211_queue_stopped(&local->hw, q)) {
+ 		IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion);
+ 		return RX_DROP_MONITOR;
+diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
+index f91d187..67066d0 100644
+--- a/net/mac80211/sta_info.c
++++ b/net/mac80211/sta_info.c
+@@ -256,11 +256,11 @@ void sta_info_free(struct ieee80211_local *local, struct sta_info *sta)
+ }
+ 
+ /* Caller must hold local->sta_mtx */
+-static void sta_info_hash_add(struct ieee80211_local *local,
+-			      struct sta_info *sta)
++static int sta_info_hash_add(struct ieee80211_local *local,
++			     struct sta_info *sta)
+ {
+-	rhashtable_insert_fast(&local->sta_hash, &sta->hash_node,
+-			       sta_rht_params);
++	return rhashtable_insert_fast(&local->sta_hash, &sta->hash_node,
++				      sta_rht_params);
+ }
+ 
+ static void sta_deliver_ps_frames(struct work_struct *wk)
+@@ -484,11 +484,17 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)
+ {
+ 	struct ieee80211_local *local = sta->local;
+ 	struct ieee80211_sub_if_data *sdata = sta->sdata;
+-	struct station_info sinfo;
++	struct station_info *sinfo;
+ 	int err = 0;
+ 
+ 	lockdep_assert_held(&local->sta_mtx);
+ 
++	sinfo = kzalloc(sizeof(struct station_info), GFP_KERNEL);
++	if (!sinfo) {
++		err = -ENOMEM;
++		goto out_err;
++	}
++
+ 	/* check if STA exists already */
+ 	if (sta_info_get_bss(sdata, sta->sta.addr)) {
+ 		err = -EEXIST;
+@@ -503,7 +509,9 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)
+ 	set_sta_flag(sta, WLAN_STA_BLOCK_BA);
+ 
+ 	/* make the station visible */
+-	sta_info_hash_add(local, sta);
++	err = sta_info_hash_add(local, sta);
++	if (err)
++		goto out_drop_sta;
+ 
+ 	list_add_tail_rcu(&sta->list, &local->sta_list);
+ 
+@@ -520,10 +528,9 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)
+ 	ieee80211_sta_debugfs_add(sta);
+ 	rate_control_add_sta_debugfs(sta);
+ 
+-	memset(&sinfo, 0, sizeof(sinfo));
+-	sinfo.filled = 0;
+-	sinfo.generation = local->sta_generation;
+-	cfg80211_new_sta(sdata->dev, sta->sta.addr, &sinfo, GFP_KERNEL);
++	sinfo->generation = local->sta_generation;
++	cfg80211_new_sta(sdata->dev, sta->sta.addr, sinfo, GFP_KERNEL);
++	kfree(sinfo);
+ 
+ 	sta_dbg(sdata, "Inserted STA %pM\n", sta->sta.addr);
+ 
+@@ -538,6 +545,7 @@ static int sta_info_insert_finish(struct sta_info *sta) __acquires(RCU)
+  out_remove:
+ 	sta_info_hash_del(local, sta);
+ 	list_del_rcu(&sta->list);
++ out_drop_sta:
+ 	local->num_sta--;
+ 	synchronize_net();
+ 	__cleanup_single_sta(sta);
+@@ -882,7 +890,7 @@ static void __sta_info_destroy_part2(struct sta_info *sta)
+ {
+ 	struct ieee80211_local *local = sta->local;
+ 	struct ieee80211_sub_if_data *sdata = sta->sdata;
+-	struct station_info sinfo = {};
++	struct station_info *sinfo;
+ 	int ret;
+ 
+ 	/*
+@@ -920,8 +928,11 @@ static void __sta_info_destroy_part2(struct sta_info *sta)
+ 
+ 	sta_dbg(sdata, "Removed STA %pM\n", sta->sta.addr);
+ 
+-	sta_set_sinfo(sta, &sinfo);
+-	cfg80211_del_sta_sinfo(sdata->dev, sta->sta.addr, &sinfo, GFP_KERNEL);
++	sinfo = kzalloc(sizeof(*sinfo), GFP_KERNEL);
++	if (sinfo)
++		sta_set_sinfo(sta, sinfo);
++	cfg80211_del_sta_sinfo(sdata->dev, sta->sta.addr, sinfo, GFP_KERNEL);
++	kfree(sinfo);
+ 
+ 	rate_control_remove_sta_debugfs(sta);
+ 	ieee80211_sta_debugfs_remove(sta);
+diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
+index c32fc41..881bc20 100644
+--- a/net/mpls/af_mpls.c
++++ b/net/mpls/af_mpls.c
+@@ -518,6 +518,9 @@ static struct net_device *find_outdev(struct net *net,
+ 	if (!dev)
+ 		return ERR_PTR(-ENODEV);
+ 
++	if (IS_ERR(dev))
++		return dev;
++
+ 	/* The caller is holding rtnl anyways, so release the dev reference */
+ 	dev_put(dev);
+ 
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 992396a..da1ae0e1 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -1916,6 +1916,10 @@ retry:
+ 		goto retry;
+ 	}
+ 
++	if (!dev_validate_header(dev, skb->data, len)) {
++		err = -EINVAL;
++		goto out_unlock;
++	}
+ 	if (len > (dev->mtu + dev->hard_header_len + extra_len) &&
+ 	    !packet_extra_vlan_len_allowed(dev, skb)) {
+ 		err = -EMSGSIZE;
+@@ -2326,18 +2330,6 @@ static void tpacket_destruct_skb(struct sk_buff *skb)
+ 	sock_wfree(skb);
+ }
+ 
+-static bool ll_header_truncated(const struct net_device *dev, int len)
+-{
+-	/* net device doesn't like empty head */
+-	if (unlikely(len < dev->hard_header_len)) {
+-		net_warn_ratelimited("%s: packet size is too short (%d < %d)\n",
+-				     current->comm, len, dev->hard_header_len);
+-		return true;
+-	}
+-
+-	return false;
+-}
+-
+ static void tpacket_set_protocol(const struct net_device *dev,
+ 				 struct sk_buff *skb)
+ {
+@@ -2420,19 +2412,19 @@ static int tpacket_fill_skb(struct packet_sock *po, struct sk_buff *skb,
+ 		if (unlikely(err < 0))
+ 			return -EINVAL;
+ 	} else if (dev->hard_header_len) {
+-		if (ll_header_truncated(dev, tp_len))
+-			return -EINVAL;
++		int hdrlen = min_t(int, dev->hard_header_len, tp_len);
+ 
+ 		skb_push(skb, dev->hard_header_len);
+-		err = skb_store_bits(skb, 0, data,
+-				dev->hard_header_len);
++		err = skb_store_bits(skb, 0, data, hdrlen);
+ 		if (unlikely(err))
+ 			return err;
++		if (!dev_validate_header(dev, skb->data, hdrlen))
++			return -EINVAL;
+ 		if (!skb->protocol)
+ 			tpacket_set_protocol(dev, skb);
+ 
+-		data += dev->hard_header_len;
+-		to_write -= dev->hard_header_len;
++		data += hdrlen;
++		to_write -= hdrlen;
+ 	}
+ 
+ 	offset = offset_in_page(data);
+@@ -2763,9 +2755,6 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
+ 		offset = dev_hard_header(skb, dev, ntohs(proto), addr, NULL, len);
+ 		if (unlikely(offset < 0))
+ 			goto out_free;
+-	} else {
+-		if (ll_header_truncated(dev, len))
+-			goto out_free;
+ 	}
+ 
+ 	/* Returns -EFAULT on error */
+@@ -2773,6 +2762,12 @@ static int packet_snd(struct socket *sock, struct msghdr *msg, size_t len)
+ 	if (err)
+ 		goto out_free;
+ 
++	if (sock->type == SOCK_RAW &&
++	    !dev_validate_header(dev, skb->data, len)) {
++		err = -EINVAL;
++		goto out_free;
++	}
++
+ 	sock_tx_timestamp(sk, &skb_shinfo(skb)->tx_flags);
+ 
+ 	if (!gso_type && (len > dev->mtu + reserve + extra_len) &&
+diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
+index ec52912..ce46f1c 100644
+--- a/net/sctp/ipv6.c
++++ b/net/sctp/ipv6.c
+@@ -526,6 +526,8 @@ static int sctp_v6_cmp_addr(const union sctp_addr *addr1,
+ 		}
+ 		return 0;
+ 	}
++	if (addr1->v6.sin6_port != addr2->v6.sin6_port)
++		return 0;
+ 	if (!ipv6_addr_equal(&addr1->v6.sin6_addr, &addr2->v6.sin6_addr))
+ 		return 0;
+ 	/* If this is a linklocal address, compare the scope_id. */
+diff --git a/net/socket.c b/net/socket.c
+index d730ef9..263b334 100644
+--- a/net/socket.c
++++ b/net/socket.c
+@@ -2238,31 +2238,31 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen,
+ 			break;
+ 	}
+ 
+-out_put:
+-	fput_light(sock->file, fput_needed);
+-
+ 	if (err == 0)
+-		return datagrams;
++		goto out_put;
+ 
+-	if (datagrams != 0) {
++	if (datagrams == 0) {
++		datagrams = err;
++		goto out_put;
++	}
++
++	/*
++	 * We may return less entries than requested (vlen) if the
++	 * sock is non block and there aren't enough datagrams...
++	 */
++	if (err != -EAGAIN) {
+ 		/*
+-		 * We may return less entries than requested (vlen) if the
+-		 * sock is non block and there aren't enough datagrams...
++		 * ... or  if recvmsg returns an error after we
++		 * received some datagrams, where we record the
++		 * error to return on the next call or if the
++		 * app asks about it using getsockopt(SO_ERROR).
+ 		 */
+-		if (err != -EAGAIN) {
+-			/*
+-			 * ... or  if recvmsg returns an error after we
+-			 * received some datagrams, where we record the
+-			 * error to return on the next call or if the
+-			 * app asks about it using getsockopt(SO_ERROR).
+-			 */
+-			sock->sk->sk_err = -err;
+-		}
+-
+-		return datagrams;
++		sock->sk->sk_err = -err;
+ 	}
++out_put:
++	fput_light(sock->file, fput_needed);
+ 
+-	return err;
++	return datagrams;
+ }
+ 
+ SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg,
+diff --git a/net/tipc/socket.c b/net/tipc/socket.c
+index b53246f..e53003c 100644
+--- a/net/tipc/socket.c
++++ b/net/tipc/socket.c
+@@ -673,7 +673,7 @@ static int tipc_sendmcast(struct  socket *sock, struct tipc_name_seq *seq,
+ 	struct tipc_sock *tsk = tipc_sk(sk);
+ 	struct net *net = sock_net(sk);
+ 	struct tipc_msg *mhdr = &tsk->phdr;
+-	struct sk_buff_head *pktchain = &sk->sk_write_queue;
++	struct sk_buff_head pktchain;
+ 	struct iov_iter save = msg->msg_iter;
+ 	uint mtu;
+ 	int rc;
+@@ -687,14 +687,16 @@ static int tipc_sendmcast(struct  socket *sock, struct tipc_name_seq *seq,
+ 	msg_set_nameupper(mhdr, seq->upper);
+ 	msg_set_hdr_sz(mhdr, MCAST_H_SIZE);
+ 
++	skb_queue_head_init(&pktchain);
++
+ new_mtu:
+ 	mtu = tipc_bcast_get_mtu(net);
+-	rc = tipc_msg_build(mhdr, msg, 0, dsz, mtu, pktchain);
++	rc = tipc_msg_build(mhdr, msg, 0, dsz, mtu, &pktchain);
+ 	if (unlikely(rc < 0))
+ 		return rc;
+ 
+ 	do {
+-		rc = tipc_bcast_xmit(net, pktchain);
++		rc = tipc_bcast_xmit(net, &pktchain);
+ 		if (likely(!rc))
+ 			return dsz;
+ 
+@@ -704,7 +706,7 @@ new_mtu:
+ 			if (!rc)
+ 				continue;
+ 		}
+-		__skb_queue_purge(pktchain);
++		__skb_queue_purge(&pktchain);
+ 		if (rc == -EMSGSIZE) {
+ 			msg->msg_iter = save;
+ 			goto new_mtu;
+@@ -863,7 +865,7 @@ static int __tipc_sendmsg(struct socket *sock, struct msghdr *m, size_t dsz)
+ 	struct net *net = sock_net(sk);
+ 	struct tipc_msg *mhdr = &tsk->phdr;
+ 	u32 dnode, dport;
+-	struct sk_buff_head *pktchain = &sk->sk_write_queue;
++	struct sk_buff_head pktchain;
+ 	struct sk_buff *skb;
+ 	struct tipc_name_seq *seq;
+ 	struct iov_iter save;
+@@ -924,17 +926,18 @@ static int __tipc_sendmsg(struct socket *sock, struct msghdr *m, size_t dsz)
+ 		msg_set_hdr_sz(mhdr, BASIC_H_SIZE);
+ 	}
+ 
++	skb_queue_head_init(&pktchain);
+ 	save = m->msg_iter;
+ new_mtu:
+ 	mtu = tipc_node_get_mtu(net, dnode, tsk->portid);
+-	rc = tipc_msg_build(mhdr, m, 0, dsz, mtu, pktchain);
++	rc = tipc_msg_build(mhdr, m, 0, dsz, mtu, &pktchain);
+ 	if (rc < 0)
+ 		return rc;
+ 
+ 	do {
+-		skb = skb_peek(pktchain);
++		skb = skb_peek(&pktchain);
+ 		TIPC_SKB_CB(skb)->wakeup_pending = tsk->link_cong;
+-		rc = tipc_node_xmit(net, pktchain, dnode, tsk->portid);
++		rc = tipc_node_xmit(net, &pktchain, dnode, tsk->portid);
+ 		if (likely(!rc)) {
+ 			if (sock->state != SS_READY)
+ 				sock->state = SS_CONNECTING;
+@@ -946,7 +949,7 @@ new_mtu:
+ 			if (!rc)
+ 				continue;
+ 		}
+-		__skb_queue_purge(pktchain);
++		__skb_queue_purge(&pktchain);
+ 		if (rc == -EMSGSIZE) {
+ 			m->msg_iter = save;
+ 			goto new_mtu;
+@@ -1016,7 +1019,7 @@ static int __tipc_send_stream(struct socket *sock, struct msghdr *m, size_t dsz)
+ 	struct net *net = sock_net(sk);
+ 	struct tipc_sock *tsk = tipc_sk(sk);
+ 	struct tipc_msg *mhdr = &tsk->phdr;
+-	struct sk_buff_head *pktchain = &sk->sk_write_queue;
++	struct sk_buff_head pktchain;
+ 	DECLARE_SOCKADDR(struct sockaddr_tipc *, dest, m->msg_name);
+ 	u32 portid = tsk->portid;
+ 	int rc = -EINVAL;
+@@ -1044,17 +1047,19 @@ static int __tipc_send_stream(struct socket *sock, struct msghdr *m, size_t dsz)
+ 
+ 	timeo = sock_sndtimeo(sk, m->msg_flags & MSG_DONTWAIT);
+ 	dnode = tsk_peer_node(tsk);
++	skb_queue_head_init(&pktchain);
+ 
+ next:
+ 	save = m->msg_iter;
+ 	mtu = tsk->max_pkt;
+ 	send = min_t(uint, dsz - sent, TIPC_MAX_USER_MSG_SIZE);
+-	rc = tipc_msg_build(mhdr, m, sent, send, mtu, pktchain);
++	rc = tipc_msg_build(mhdr, m, sent, send, mtu, &pktchain);
+ 	if (unlikely(rc < 0))
+ 		return rc;
++
+ 	do {
+ 		if (likely(!tsk_conn_cong(tsk))) {
+-			rc = tipc_node_xmit(net, pktchain, dnode, portid);
++			rc = tipc_node_xmit(net, &pktchain, dnode, portid);
+ 			if (likely(!rc)) {
+ 				tsk->sent_unacked++;
+ 				sent += send;
+@@ -1063,7 +1068,7 @@ next:
+ 				goto next;
+ 			}
+ 			if (rc == -EMSGSIZE) {
+-				__skb_queue_purge(pktchain);
++				__skb_queue_purge(&pktchain);
+ 				tsk->max_pkt = tipc_node_get_mtu(net, dnode,
+ 								 portid);
+ 				m->msg_iter = save;
+@@ -1077,7 +1082,7 @@ next:
+ 		rc = tipc_wait_for_sndpkt(sock, &timeo);
+ 	} while (!rc);
+ 
+-	__skb_queue_purge(pktchain);
++	__skb_queue_purge(&pktchain);
+ 	return sent ? sent : rc;
+ }
+ 
+diff --git a/net/xfrm/xfrm_input.c b/net/xfrm/xfrm_input.c
+index ad7f5b3..1c4ad47 100644
+--- a/net/xfrm/xfrm_input.c
++++ b/net/xfrm/xfrm_input.c
+@@ -292,12 +292,15 @@ int xfrm_input(struct sk_buff *skb, int nexthdr, __be32 spi, int encap_type)
+ 		XFRM_SKB_CB(skb)->seq.input.hi = seq_hi;
+ 
+ 		skb_dst_force(skb);
++		dev_hold(skb->dev);
+ 
+ 		nexthdr = x->type->input(x, skb);
+ 
+ 		if (nexthdr == -EINPROGRESS)
+ 			return 0;
+ resume:
++		dev_put(skb->dev);
++
+ 		spin_lock(&x->lock);
+ 		if (nexthdr <= 0) {
+ 			if (nexthdr == -EBADMSG) {
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index f24c9fc..b982d1b 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -1051,8 +1051,8 @@ static int snd_timer_s_start(struct snd_timer * timer)
+ 		njiff += timer->sticks - priv->correction;
+ 		priv->correction = 0;
+ 	}
+-	priv->last_expires = priv->tlist.expires = njiff;
+-	add_timer(&priv->tlist);
++	priv->last_expires = njiff;
++	mod_timer(&priv->tlist, njiff);
+ 	return 0;
+ }
+ 
+diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
+index 6968b79..1402ba9 100644
+--- a/sound/pci/hda/patch_realtek.c
++++ b/sound/pci/hda/patch_realtek.c
+@@ -3801,6 +3801,10 @@ static void alc_headset_mode_mic_in(struct hda_codec *codec, hda_nid_t hp_pin,
+ 
+ static void alc_headset_mode_default(struct hda_codec *codec)
+ {
++	static struct coef_fw coef0225[] = {
++		UPDATE_COEF(0x45, 0x3f<<10, 0x34<<10),
++		{}
++	};
+ 	static struct coef_fw coef0255[] = {
+ 		WRITE_COEF(0x45, 0xc089),
+ 		WRITE_COEF(0x45, 0xc489),
+@@ -3842,6 +3846,9 @@ static void alc_headset_mode_default(struct hda_codec *codec)
+ 	};
+ 
+ 	switch (codec->core.vendor_id) {
++	case 0x10ec0225:
++		alc_process_coef_fw(codec, coef0225);
++		break;
+ 	case 0x10ec0255:
+ 	case 0x10ec0256:
+ 		alc_process_coef_fw(codec, coef0255);
+@@ -4750,6 +4757,10 @@ enum {
+ 	ALC293_FIXUP_LENOVO_SPK_NOISE,
+ 	ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY,
+ 	ALC255_FIXUP_DELL_SPK_NOISE,
++	ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
++	ALC280_FIXUP_HP_HEADSET_MIC,
++	ALC221_FIXUP_HP_FRONT_MIC,
++	ALC292_FIXUP_TPT460,
+ };
+ 
+ static const struct hda_fixup alc269_fixups[] = {
+@@ -5375,6 +5386,36 @@ static const struct hda_fixup alc269_fixups[] = {
+ 		.chained = true,
+ 		.chain_id = ALC255_FIXUP_DELL1_MIC_NO_PRESENCE
+ 	},
++	[ALC225_FIXUP_DELL1_MIC_NO_PRESENCE] = {
++		.type = HDA_FIXUP_VERBS,
++		.v.verbs = (const struct hda_verb[]) {
++			/* Disable pass-through path for FRONT 14h */
++			{ 0x20, AC_VERB_SET_COEF_INDEX, 0x36 },
++			{ 0x20, AC_VERB_SET_PROC_COEF, 0x57d7 },
++			{}
++		},
++		.chained = true,
++		.chain_id = ALC269_FIXUP_DELL1_MIC_NO_PRESENCE
++	},
++	[ALC280_FIXUP_HP_HEADSET_MIC] = {
++		.type = HDA_FIXUP_FUNC,
++		.v.func = alc_fixup_disable_aamix,
++		.chained = true,
++		.chain_id = ALC269_FIXUP_HEADSET_MIC,
++	},
++	[ALC221_FIXUP_HP_FRONT_MIC] = {
++		.type = HDA_FIXUP_PINS,
++		.v.pins = (const struct hda_pintbl[]) {
++			{ 0x19, 0x02a19020 }, /* Front Mic */
++			{ }
++		},
++	},
++	[ALC292_FIXUP_TPT460] = {
++		.type = HDA_FIXUP_FUNC,
++		.v.func = alc_fixup_tpt440_dock,
++		.chained = true,
++		.chain_id = ALC293_FIXUP_LENOVO_SPK_NOISE,
++	},
+ };
+ 
+ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+@@ -5479,6 +5520,8 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x103c, 0x2335, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ 	SND_PCI_QUIRK(0x103c, 0x2336, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
+ 	SND_PCI_QUIRK(0x103c, 0x2337, "HP", ALC269_FIXUP_HP_MUTE_LED_MIC1),
++	SND_PCI_QUIRK(0x103c, 0x221c, "HP EliteBook 755 G2", ALC280_FIXUP_HP_HEADSET_MIC),
++	SND_PCI_QUIRK(0x103c, 0x8256, "HP", ALC221_FIXUP_HP_FRONT_MIC),
+ 	SND_PCI_QUIRK(0x1043, 0x103f, "ASUS TX300", ALC282_FIXUP_ASUS_TX300),
+ 	SND_PCI_QUIRK(0x1043, 0x106d, "Asus K53BE", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+ 	SND_PCI_QUIRK(0x1043, 0x115d, "Asus 1015E", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
+@@ -5527,7 +5570,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x17aa, 0x2218, "Thinkpad X1 Carbon 2nd", ALC292_FIXUP_TPT440_DOCK),
+ 	SND_PCI_QUIRK(0x17aa, 0x2223, "ThinkPad T550", ALC292_FIXUP_TPT440_DOCK),
+ 	SND_PCI_QUIRK(0x17aa, 0x2226, "ThinkPad X250", ALC292_FIXUP_TPT440_DOCK),
+-	SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC293_FIXUP_LENOVO_SPK_NOISE),
++	SND_PCI_QUIRK(0x17aa, 0x2233, "Thinkpad", ALC292_FIXUP_TPT460),
+ 	SND_PCI_QUIRK(0x17aa, 0x30bb, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
+ 	SND_PCI_QUIRK(0x17aa, 0x30e2, "ThinkCentre AIO", ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY),
+ 	SND_PCI_QUIRK(0x17aa, 0x3902, "Lenovo E50-80", ALC269_FIXUP_DMIC_THINKPAD_ACPI),
+@@ -5622,6 +5665,7 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
+ 	{.id = ALC283_FIXUP_SENSE_COMBO_JACK, .name = "alc283-sense-combo"},
+ 	{.id = ALC292_FIXUP_TPT440_DOCK, .name = "tpt440-dock"},
+ 	{.id = ALC292_FIXUP_TPT440, .name = "tpt440"},
++	{.id = ALC292_FIXUP_TPT460, .name = "tpt460"},
+ 	{}
+ };
+ #define ALC225_STANDARD_PINS \
+@@ -5648,10 +5692,10 @@ static const struct hda_model_fixup alc269_fixup_models[] = {
+ 	{0x21, 0x03211020}
+ 
+ static const struct snd_hda_pin_quirk alc269_pin_fixup_tbl[] = {
+-	SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
++	SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
+ 		ALC225_STANDARD_PINS,
+ 		{0x14, 0x901701a0}),
+-	SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC269_FIXUP_DELL1_MIC_NO_PRESENCE,
++	SND_HDA_PIN_QUIRK(0x10ec0225, 0x1028, "Dell", ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
+ 		ALC225_STANDARD_PINS,
+ 		{0x14, 0x901701b0}),
+ 	SND_HDA_PIN_QUIRK(0x10ec0255, 0x1028, "Dell", ALC255_FIXUP_DELL2_MIC_NO_PRESENCE,
+@@ -6379,6 +6423,7 @@ enum {
+ 	ALC668_FIXUP_AUTO_MUTE,
+ 	ALC668_FIXUP_DELL_DISABLE_AAMIX,
+ 	ALC668_FIXUP_DELL_XPS13,
++	ALC662_FIXUP_ASUS_Nx50,
+ };
+ 
+ static const struct hda_fixup alc662_fixups[] = {
+@@ -6619,6 +6664,12 @@ static const struct hda_fixup alc662_fixups[] = {
+ 		.type = HDA_FIXUP_FUNC,
+ 		.v.func = alc_fixup_bass_chmap,
+ 	},
++	[ALC662_FIXUP_ASUS_Nx50] = {
++		.type = HDA_FIXUP_FUNC,
++		.v.func = alc_fixup_auto_mute_via_amp,
++		.chained = true,
++		.chain_id = ALC662_FIXUP_BASS_1A
++	},
+ };
+ 
+ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
+@@ -6641,8 +6692,9 @@ static const struct snd_pci_quirk alc662_fixup_tbl[] = {
+ 	SND_PCI_QUIRK(0x1028, 0x0698, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x1028, 0x069f, "Dell", ALC668_FIXUP_DELL_MIC_NO_PRESENCE),
+ 	SND_PCI_QUIRK(0x103c, 0x1632, "HP RP5800", ALC662_FIXUP_HP_RP5800),
+-	SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_BASS_1A),
++	SND_PCI_QUIRK(0x1043, 0x11cd, "Asus N550", ALC662_FIXUP_ASUS_Nx50),
+ 	SND_PCI_QUIRK(0x1043, 0x13df, "Asus N550JX", ALC662_FIXUP_BASS_1A),
++	SND_PCI_QUIRK(0x1043, 0x129d, "Asus N750", ALC662_FIXUP_ASUS_Nx50),
+ 	SND_PCI_QUIRK(0x1043, 0x1477, "ASUS N56VZ", ALC662_FIXUP_BASS_MODE4_CHMAP),
+ 	SND_PCI_QUIRK(0x1043, 0x15a7, "ASUS UX51VZH", ALC662_FIXUP_BASS_16),
+ 	SND_PCI_QUIRK(0x1043, 0x1b73, "ASUS N55SF", ALC662_FIXUP_BASS_16),
+diff --git a/sound/usb/mixer_maps.c b/sound/usb/mixer_maps.c
+index ddca654..1f8fb0d9 100644
+--- a/sound/usb/mixer_maps.c
++++ b/sound/usb/mixer_maps.c
+@@ -349,6 +349,16 @@ static struct usbmix_name_map bose_companion5_map[] = {
+ };
+ 
+ /*
++ * Dell usb dock with ALC4020 codec had a firmware problem where it got
++ * screwed up when zero volume is passed; just skip it as a workaround
++ */
++static const struct usbmix_name_map dell_alc4020_map[] = {
++	{ 16, NULL },
++	{ 19, NULL },
++	{ 0 }
++};
++
++/*
+  * Control map entries
+  */
+ 
+@@ -431,6 +441,10 @@ static struct usbmix_ctl_map usbmix_ctl_maps[] = {
+ 		.map = aureon_51_2_map,
+ 	},
+ 	{
++		.id = USB_ID(0x0bda, 0x4014),
++		.map = dell_alc4020_map,
++	},
++	{
+ 		.id = USB_ID(0x0dba, 0x1000),
+ 		.map = mbox1_map,
+ 	},
+diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
+index cd7eac2..001fb4d 100644
+--- a/sound/usb/quirks.c
++++ b/sound/usb/quirks.c
+@@ -1135,9 +1135,11 @@ bool snd_usb_get_sample_rate_quirk(struct snd_usb_audio *chip)
+ 	case USB_ID(0x045E, 0x076F): /* MS Lifecam HD-6000 */
+ 	case USB_ID(0x045E, 0x0772): /* MS Lifecam Studio */
+ 	case USB_ID(0x045E, 0x0779): /* MS Lifecam HD-3000 */
++	case USB_ID(0x047F, 0x0415): /* Plantronics BT-300 */
+ 	case USB_ID(0x047F, 0xAA05): /* Plantronics DA45 */
+ 	case USB_ID(0x04D8, 0xFEEA): /* Benchmark DAC1 Pre */
+ 	case USB_ID(0x074D, 0x3553): /* Outlaw RR2150 (Micronas UAC3553B) */
++	case USB_ID(0x1de7, 0x0014): /* Phoenix Audio TMX320 */
+ 	case USB_ID(0x21B4, 0x0081): /* AudioQuest DragonFly */
+ 		return true;
+ 	}
diff --git a/4.4.7/4420_grsecurity-3.1-4.4.7-201604152208.patch b/4.4.8/4420_grsecurity-3.1-4.4.8-201604201957.patch
index e6ad811..a90771e 100644
--- a/4.4.7/4420_grsecurity-3.1-4.4.7-201604152208.patch
+++ b/4.4.8/4420_grsecurity-3.1-4.4.8-201604201957.patch
@@ -311,7 +311,7 @@ index 13f888a..250729b 100644
  	A typical pattern in a Kbuild file looks like this:
  
 diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
-index 742f69d..541f1c4 100644
+index 0e4102a..d24a808 100644
 --- a/Documentation/kernel-parameters.txt
 +++ b/Documentation/kernel-parameters.txt
 @@ -1282,6 +1282,12 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
@@ -449,7 +449,7 @@ index af70d15..ccd3786 100644
  
  A toggle value indicating if modules are allowed to be loaded
 diff --git a/Makefile b/Makefile
-index 5a493e7..70a9fb1 100644
+index 1928fcd..e58439b 100644
 --- a/Makefile
 +++ b/Makefile
 @@ -298,7 +298,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \
@@ -6732,6 +6732,134 @@ index ca9a810..e00a026 100644
  
  	force_sig_info(SIGFPE, &info, current);
  	exception_exit(prev_state);
+diff --git a/arch/mips/lib/ashldi3.c b/arch/mips/lib/ashldi3.c
+index beb80f31..4809f0b 100644
+--- a/arch/mips/lib/ashldi3.c
++++ b/arch/mips/lib/ashldi3.c
+@@ -2,7 +2,11 @@
+ 
+ #include "libgcc.h"
+ 
+-long long __ashldi3(long long u, word_type b)
++#ifdef CONFIG_64BIT
++DWtype __ashlti3(DWtype u, word_type b)
++#else
++DWtype __ashldi3(DWtype u, word_type b)
++#endif
+ {
+ 	DWunion uu, w;
+ 	word_type bm;
+@@ -11,19 +15,22 @@ long long __ashldi3(long long u, word_type b)
+ 		return u;
+ 
+ 	uu.ll = u;
+-	bm = 32 - b;
++	bm = BITS_PER_LONG - b;
+ 
+ 	if (bm <= 0) {
+ 		w.s.low = 0;
+-		w.s.high = (unsigned int) uu.s.low << -bm;
++		w.s.high = (unsigned long) uu.s.low << -bm;
+ 	} else {
+-		const unsigned int carries = (unsigned int) uu.s.low >> bm;
++		const unsigned long carries = (unsigned long) uu.s.low >> bm;
+ 
+-		w.s.low = (unsigned int) uu.s.low << b;
+-		w.s.high = ((unsigned int) uu.s.high << b) | carries;
++		w.s.low = (unsigned long) uu.s.low << b;
++		w.s.high = ((unsigned long) uu.s.high << b) | carries;
+ 	}
+ 
+ 	return w.ll;
+ }
+-
++#ifdef CONFIG_64BIT
++EXPORT_SYMBOL(__ashlti3);
++#else
+ EXPORT_SYMBOL(__ashldi3);
++#endif
+diff --git a/arch/mips/lib/ashrdi3.c b/arch/mips/lib/ashrdi3.c
+index c884a91..3c4ff03 100644
+--- a/arch/mips/lib/ashrdi3.c
++++ b/arch/mips/lib/ashrdi3.c
+@@ -2,7 +2,11 @@
+ 
+ #include "libgcc.h"
+ 
+-long long __ashrdi3(long long u, word_type b)
++#ifdef CONFIG_64BIT
++DWtype __ashrti3(DWtype u, word_type b)
++#else
++DWtype __ashrdi3(DWtype u, word_type b)
++#endif
+ {
+ 	DWunion uu, w;
+ 	word_type bm;
+@@ -11,21 +15,24 @@ long long __ashrdi3(long long u, word_type b)
+ 		return u;
+ 
+ 	uu.ll = u;
+-	bm = 32 - b;
++	bm = BITS_PER_LONG - b;
+ 
+ 	if (bm <= 0) {
+ 		/* w.s.high = 1..1 or 0..0 */
+ 		w.s.high =
+-		    uu.s.high >> 31;
++		    uu.s.high >> (BITS_PER_LONG - 1);
+ 		w.s.low = uu.s.high >> -bm;
+ 	} else {
+-		const unsigned int carries = (unsigned int) uu.s.high << bm;
++		const unsigned long carries = (unsigned long) uu.s.high << bm;
+ 
+ 		w.s.high = uu.s.high >> b;
+-		w.s.low = ((unsigned int) uu.s.low >> b) | carries;
++		w.s.low = ((unsigned long) uu.s.low >> b) | carries;
+ 	}
+ 
+ 	return w.ll;
+ }
+-
++#ifdef CONFIG_64BIT
++EXPORT_SYMBOL(__ashrti3);
++#else
+ EXPORT_SYMBOL(__ashrdi3);
++#endif
+diff --git a/arch/mips/lib/libgcc.h b/arch/mips/lib/libgcc.h
+index 05909d58..b03284b 100644
+--- a/arch/mips/lib/libgcc.h
++++ b/arch/mips/lib/libgcc.h
+@@ -5,13 +5,19 @@
+ 
+ typedef int word_type __attribute__ ((mode (__word__)));
+ 
++#ifdef CONFIG_64BIT
++typedef int DWtype __attribute__((mode(TI)));
++#else
++typedef long long DWtype;
++#endif
++
+ #ifdef __BIG_ENDIAN
+ struct DWstruct {
+-	int high, low;
++	long high, low;
+ };
+ #elif defined(__LITTLE_ENDIAN)
+ struct DWstruct {
+-	int low, high;
++	long low, high;
+ };
+ #else
+ #error I feel sick.
+@@ -19,7 +25,7 @@ struct DWstruct {
+ 
+ typedef union {
+ 	struct DWstruct s;
+-	long long ll;
++	DWtype ll;
+ } DWunion;
+ 
+ #endif /* __ASM_LIBGCC_H */
 diff --git a/arch/mips/mm/fault.c b/arch/mips/mm/fault.c
 index 4b88fa0..b16bc17 100644
 --- a/arch/mips/mm/fault.c
@@ -7118,10 +7246,10 @@ index 291cee2..2ac33db 100644
  #define PAGE_KERNEL_EXEC	__pgprot(_PAGE_KERNEL_EXEC)
  #define PAGE_KERNEL_RWX	__pgprot(_PAGE_KERNEL_RWX)
 diff --git a/arch/parisc/include/asm/uaccess.h b/arch/parisc/include/asm/uaccess.h
-index 0abdd4c..1af92f0 100644
+index 1960b87..e8f57e3 100644
 --- a/arch/parisc/include/asm/uaccess.h
 +++ b/arch/parisc/include/asm/uaccess.h
-@@ -243,10 +243,10 @@ static inline unsigned long __must_check copy_from_user(void *to,
+@@ -244,10 +244,10 @@ static inline unsigned long __must_check copy_from_user(void *to,
                                            const void __user *from,
                                            unsigned long n)
  {
@@ -7310,7 +7438,7 @@ index 5aba01a..47cdd5a 100644
  		mm->mmap_base = mm->mmap_legacy_base;
  		mm->get_unmapped_area = arch_get_unmapped_area;
 diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c
-index 553b098..eedc047 100644
+index 77e2262..ec65037 100644
 --- a/arch/parisc/kernel/traps.c
 +++ b/arch/parisc/kernel/traps.c
 @@ -722,9 +722,7 @@ void notrace handle_interruption(int code, struct pt_regs *regs)
@@ -7325,7 +7453,7 @@ index 553b098..eedc047 100644
  				fault_space = regs->iasq[0];
  
 diff --git a/arch/parisc/mm/fault.c b/arch/parisc/mm/fault.c
-index a762864..664087f 100644
+index f906444..0bb73ae 100644
 --- a/arch/parisc/mm/fault.c
 +++ b/arch/parisc/mm/fault.c
 @@ -16,6 +16,7 @@
@@ -7462,7 +7590,7 @@ index a762864..664087f 100644
  int fixup_exception(struct pt_regs *regs)
  {
  	const struct exception_table_entry *fix;
-@@ -234,8 +345,33 @@ retry:
+@@ -235,8 +346,33 @@ retry:
  
  good_area:
  
@@ -14047,6 +14175,23 @@ index acc066c..1559cc4 100644
 +	pax_force_retaddr
  	ret;
  ENDPROC(serpent_dec_blk_8way)
+diff --git a/arch/x86/crypto/sha-mb/sha1_mb.c b/arch/x86/crypto/sha-mb/sha1_mb.c
+index a841e97..8381c09d 100644
+--- a/arch/x86/crypto/sha-mb/sha1_mb.c
++++ b/arch/x86/crypto/sha-mb/sha1_mb.c
+@@ -453,10 +453,10 @@ static int sha_complete_job(struct mcryptd_hash_request_ctx *rctx,
+ 
+ 			req = cast_mcryptd_ctx_to_req(req_ctx);
+ 			if (irqs_disabled())
+-				rctx->complete(&req->base, ret);
++				req_ctx->complete(&req->base, ret);
+ 			else {
+ 				local_bh_disable();
+-				rctx->complete(&req->base, ret);
++				req_ctx->complete(&req->base, ret);
+ 				local_bh_enable();
+ 			}
+ 		}
 diff --git a/arch/x86/crypto/sha1_ssse3_asm.S b/arch/x86/crypto/sha1_ssse3_asm.S
 index a410950..9dfe7ad 100644
 --- a/arch/x86/crypto/sha1_ssse3_asm.S
@@ -29880,7 +30025,7 @@ index f34ab71..049ebd8 100644
  	.disabled_by_bios = vmx_disabled_by_bios,
  	.hardware_setup = hardware_setup,
 diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
-index 8bfc5fc..d94e9e3 100644
+index 7eb4ebd..9431608 100644
 --- a/arch/x86/kvm/x86.c
 +++ b/arch/x86/kvm/x86.c
 @@ -1937,8 +1937,8 @@ static int xen_hvm_config(struct kvm_vcpu *vcpu, u64 data)
@@ -29939,7 +30084,7 @@ index 8bfc5fc..d94e9e3 100644
  			guest_xsave->region, sizeof(struct fxregs_state));
  	}
  	return 0;
-@@ -6364,6 +6366,7 @@ void kvm_arch_mmu_notifier_invalidate_page(struct kvm *kvm,
+@@ -6362,6 +6364,7 @@ void kvm_arch_mmu_notifier_invalidate_page(struct kvm *kvm,
   * exiting to the userspace.  Otherwise, the value will be returned to the
   * userspace.
   */
@@ -35473,10 +35618,10 @@ index 71e8a67..6a313bb 100644
  struct op_counter_config;
  
 diff --git a/arch/x86/pci/intel_mid_pci.c b/arch/x86/pci/intel_mid_pci.c
-index 0d24e7c..d937be3 100644
+index 8b93e63..9cf21c3 100644
 --- a/arch/x86/pci/intel_mid_pci.c
 +++ b/arch/x86/pci/intel_mid_pci.c
-@@ -283,7 +283,7 @@ int __init intel_mid_pci_init(void)
+@@ -280,7 +280,7 @@ int __init intel_mid_pci_init(void)
  	pci_mmcfg_late_init();
  	pcibios_enable_irq = intel_mid_pci_irq_enable;
  	pcibios_disable_irq = intel_mid_pci_irq_disable;
@@ -35486,7 +35631,7 @@ index 0d24e7c..d937be3 100644
  	/* Continue with standard init */
  	return 1;
 diff --git a/arch/x86/pci/irq.c b/arch/x86/pci/irq.c
-index 32e7034..bf2dd06 100644
+index 9bd1154..e9d4656 100644
 --- a/arch/x86/pci/irq.c
 +++ b/arch/x86/pci/irq.c
 @@ -51,7 +51,7 @@ struct irq_router {
@@ -37260,19 +37405,6 @@ index 0774799..7afc734 100644
  	if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len))
  		goto error;
  
-diff --git a/crypto/asymmetric_keys/pkcs7_trust.c b/crypto/asymmetric_keys/pkcs7_trust.c
-index 90d6d47..ecdb5a2 100644
---- a/crypto/asymmetric_keys/pkcs7_trust.c
-+++ b/crypto/asymmetric_keys/pkcs7_trust.c
-@@ -178,6 +178,8 @@ int pkcs7_validate_trust(struct pkcs7_message *pkcs7,
- 	int cached_ret = -ENOKEY;
- 	int ret;
- 
-+	*_trusted = false;
-+
- 	for (p = pkcs7->certs; p; p = p->next)
- 		p->seen = false;
- 
 diff --git a/crypto/cryptd.c b/crypto/cryptd.c
 index c81861b..dbf894f 100644
 --- a/crypto/cryptd.c
@@ -39776,7 +39908,7 @@ index d06c62e..cd04d96 100644
  	if (ti.nwa_v) {
  		pd->nwa = be32_to_cpu(ti.next_writable);
 diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
-index 81ea69f..55a949d 100644
+index fbdddd6..060ff07 100644
 --- a/drivers/block/rbd.c
 +++ b/drivers/block/rbd.c
 @@ -64,7 +64,7 @@
@@ -41209,6 +41341,34 @@ index 832a2c3..1794080 100644
  	.attrs = cpuidle_default_attrs,
  	.name = "cpuidle",
  };
+diff --git a/drivers/crypto/ccp/ccp-crypto-aes-cmac.c b/drivers/crypto/ccp/ccp-crypto-aes-cmac.c
+index 3d9acc5..60fc0fa 100644
+--- a/drivers/crypto/ccp/ccp-crypto-aes-cmac.c
++++ b/drivers/crypto/ccp/ccp-crypto-aes-cmac.c
+@@ -225,6 +225,9 @@ static int ccp_aes_cmac_export(struct ahash_request *req, void *out)
+ 	struct ccp_aes_cmac_req_ctx *rctx = ahash_request_ctx(req);
+ 	struct ccp_aes_cmac_exp_ctx state;
+ 
++	/* Don't let anything leak to 'out' */
++	memset(&state, 0, sizeof(state));
++
+ 	state.null_msg = rctx->null_msg;
+ 	memcpy(state.iv, rctx->iv, sizeof(state.iv));
+ 	state.buf_count = rctx->buf_count;
+diff --git a/drivers/crypto/ccp/ccp-crypto-sha.c b/drivers/crypto/ccp/ccp-crypto-sha.c
+index 8ef06fa..ab9945f 100644
+--- a/drivers/crypto/ccp/ccp-crypto-sha.c
++++ b/drivers/crypto/ccp/ccp-crypto-sha.c
+@@ -212,6 +212,9 @@ static int ccp_sha_export(struct ahash_request *req, void *out)
+ 	struct ccp_sha_req_ctx *rctx = ahash_request_ctx(req);
+ 	struct ccp_sha_exp_ctx state;
+ 
++	/* Don't let anything leak to 'out' */
++	memset(&state, 0, sizeof(state));
++
+ 	state.type = rctx->type;
+ 	state.msg_bits = rctx->msg_bits;
+ 	state.first = rctx->first;
 diff --git a/drivers/crypto/hifn_795x.c b/drivers/crypto/hifn_795x.c
 index ca5c71a..df88d0c 100644
 --- a/drivers/crypto/hifn_795x.c
@@ -44794,7 +44954,7 @@ index 624d941..106fa1f 100644
  			 nr_free, shrink_pages);
  	}
 diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
-index 62c7b1d..46d7a6a 100644
+index 73e41a8..46d7a6a 100644
 --- a/drivers/gpu/drm/udl/udl_fb.c
 +++ b/drivers/gpu/drm/udl/udl_fb.c
 @@ -367,7 +367,6 @@ static int udl_fb_release(struct fb_info *info, int user)
@@ -44805,28 +44965,6 @@ index 62c7b1d..46d7a6a 100644
  	}
  
  	pr_warn("released /dev/fb%d user=%d count=%d\n",
-@@ -539,7 +538,7 @@ static int udlfb_create(struct drm_fb_helper *helper,
- out_destroy_fbi:
- 	drm_fb_helper_release_fbi(helper);
- out_gfree:
--	drm_gem_object_unreference(&ufbdev->ufb.obj->base);
-+	drm_gem_object_unreference_unlocked(&ufbdev->ufb.obj->base);
- out:
- 	return ret;
- }
-diff --git a/drivers/gpu/drm/udl/udl_gem.c b/drivers/gpu/drm/udl/udl_gem.c
-index 2a0a784..d7528e0 100644
---- a/drivers/gpu/drm/udl/udl_gem.c
-+++ b/drivers/gpu/drm/udl/udl_gem.c
-@@ -52,7 +52,7 @@ udl_gem_create(struct drm_file *file,
- 		return ret;
- 	}
- 
--	drm_gem_object_unreference(&obj->base);
-+	drm_gem_object_unreference_unlocked(&obj->base);
- 	*handle_p = handle;
- 	return 0;
- }
 diff --git a/drivers/gpu/drm/via/via_dma.c b/drivers/gpu/drm/via/via_dma.c
 index d17d8f2..67e8e48b 100644
 --- a/drivers/gpu/drm/via/via_dma.c
@@ -45424,30 +45562,6 @@ index 17ae2eb..21b71dd 100644
  	int ret, i;
  	int in_i = 1, temp_i = 1, curr_i = 1, humidity_i = 1;
  	enum iio_chan_type type;
-diff --git a/drivers/hwmon/max1111.c b/drivers/hwmon/max1111.c
-index 36544c4..303d0c9 100644
---- a/drivers/hwmon/max1111.c
-+++ b/drivers/hwmon/max1111.c
-@@ -85,6 +85,9 @@ static struct max1111_data *the_max1111;
- 
- int max1111_read_channel(int channel)
- {
-+	if (!the_max1111 || !the_max1111->spi)
-+		return -ENODEV;
-+
- 	return max1111_read(&the_max1111->spi->dev, channel);
- }
- EXPORT_SYMBOL(max1111_read_channel);
-@@ -258,6 +261,9 @@ static int max1111_remove(struct spi_device *spi)
- {
- 	struct max1111_data *data = spi_get_drvdata(spi);
- 
-+#ifdef CONFIG_SHARPSL_PM
-+	the_max1111 = NULL;
-+#endif
- 	hwmon_device_unregister(data->hwmon_dev);
- 	sysfs_remove_group(&spi->dev.kobj, &max1110_attr_group);
- 	sysfs_remove_group(&spi->dev.kobj, &max1111_attr_group);
 diff --git a/drivers/hwmon/nct6683.c b/drivers/hwmon/nct6683.c
 index 37f0170..414ec2c 100644
 --- a/drivers/hwmon/nct6683.c
@@ -45678,7 +45792,7 @@ index 37a8a90..4724cbd 100644
  {
  	ide_hwif_t *hwif = drive->hwif;
 diff --git a/drivers/idle/intel_idle.c b/drivers/idle/intel_idle.c
-index 146eed70b..4e6a8d5 100644
+index 146eed70b..7679efd 100644
 --- a/drivers/idle/intel_idle.c
 +++ b/drivers/idle/intel_idle.c
 @@ -1060,8 +1060,10 @@ static void sklh_idle_state_table_update(void)
@@ -45688,8 +45802,8 @@ index 146eed70b..4e6a8d5 100644
 -	skl_cstates[5].disabled = 1;	/* C8-SKL */
 -	skl_cstates[6].disabled = 1;	/* C9-SKL */
 +	pax_open_kernel();
-+	*(bool **)&skl_cstates[5].disabled = 1;	/* C8-SKL */
-+	*(bool **)&skl_cstates[6].disabled = 1;	/* C9-SKL */
++	*(bool *)&skl_cstates[5].disabled = 1;	/* C8-SKL */
++	*(bool *)&skl_cstates[6].disabled = 1;	/* C9-SKL */
 +	pax_close_kernel();
  }
  /*
@@ -47388,10 +47502,10 @@ index ac9e234..a2f206e 100644
  
  /**
 diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
-index 0e3b009..5b97b84 100644
+index 515bb8b..c2bb880 100644
 --- a/drivers/iommu/iommu.c
 +++ b/drivers/iommu/iommu.c
-@@ -956,7 +956,7 @@ static int iommu_bus_notifier(struct notifier_block *nb,
+@@ -957,7 +957,7 @@ static int iommu_bus_notifier(struct notifier_block *nb,
  static int iommu_bus_init(struct bus_type *bus, const struct iommu_ops *ops)
  {
  	int err;
@@ -52621,6 +52735,19 @@ index e5ba040..d47531c 100644
  	smp_mb();
  
  	/* need lock to prevent incorrect read while modifying cyclecounter */
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_rx.c b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+index e7a5000..982753a 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_rx.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_rx.c
+@@ -61,7 +61,7 @@ static int mlx4_alloc_pages(struct mlx4_en_priv *priv,
+ 		gfp_t gfp = _gfp;
+ 
+ 		if (order)
+-			gfp |= __GFP_COMP | __GFP_NOWARN;
++			gfp |= __GFP_COMP | __GFP_NOWARN | __GFP_NOMEMALLOC;
+ 		page = alloc_pages(gfp, order);
+ 		if (likely(page))
+ 			break;
 diff --git a/drivers/net/ethernet/mellanox/mlx4/en_tx.c b/drivers/net/ethernet/mellanox/mlx4/en_tx.c
 index 4421bf54..c07afb0 100644
 --- a/drivers/net/ethernet/mellanox/mlx4/en_tx.c
@@ -52798,10 +52925,10 @@ index 79ef799..59bbd1f 100644
  	int (*set_speed)(struct net_device *, u8 aneg, u16 sp, u8 dpx, u32 adv);
  	int (*get_settings)(struct net_device *, struct ethtool_cmd *);
 diff --git a/drivers/net/ethernet/rocker/rocker.c b/drivers/net/ethernet/rocker/rocker.c
-index 52ec3d6..ed19f16 100644
+index 2b34622..c406e81 100644
 --- a/drivers/net/ethernet/rocker/rocker.c
 +++ b/drivers/net/ethernet/rocker/rocker.c
-@@ -5410,7 +5410,7 @@ out:
+@@ -5418,7 +5418,7 @@ out:
  	return NOTIFY_DONE;
  }
  
@@ -52810,7 +52937,7 @@ index 52ec3d6..ed19f16 100644
  	.notifier_call = rocker_netdevice_event,
  };
  
-@@ -5453,7 +5453,7 @@ static int rocker_netevent_event(struct notifier_block *unused,
+@@ -5461,7 +5461,7 @@ static int rocker_netevent_event(struct notifier_block *unused,
  	return NOTIFY_DONE;
  }
  
@@ -53255,7 +53382,7 @@ index 06c8bfe..a081f70 100644
  };
  
 diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c
-index 0fc5219..cfe16bb 100644
+index 159a687..2f1fae5 100644
 --- a/drivers/net/macvtap.c
 +++ b/drivers/net/macvtap.c
 @@ -485,7 +485,7 @@ static void macvtap_setup(struct net_device *dev)
@@ -53267,7 +53394,7 @@ index 0fc5219..cfe16bb 100644
  	.kind		= "macvtap",
  	.setup		= macvtap_setup,
  	.newlink	= macvtap_newlink,
-@@ -1091,7 +1091,7 @@ static long macvtap_ioctl(struct file *file, unsigned int cmd,
+@@ -1094,7 +1094,7 @@ static long macvtap_ioctl(struct file *file, unsigned int cmd,
  
  		ret = 0;
  		u = q->flags;
@@ -53276,7 +53403,7 @@ index 0fc5219..cfe16bb 100644
  		    put_user(u, &ifr->ifr_flags))
  			ret = -EFAULT;
  		macvtap_put_vlan(vlan);
-@@ -1174,8 +1174,8 @@ static long macvtap_ioctl(struct file *file, unsigned int cmd,
+@@ -1177,8 +1177,8 @@ static long macvtap_ioctl(struct file *file, unsigned int cmd,
  		}
  		ret = 0;
  		u = vlan->dev->type;
@@ -53287,7 +53414,7 @@ index 0fc5219..cfe16bb 100644
  		    put_user(u, &ifr->ifr_hwaddr.sa_family))
  			ret = -EFAULT;
  		macvtap_put_vlan(vlan);
-@@ -1309,7 +1309,7 @@ static int macvtap_device_event(struct notifier_block *unused,
+@@ -1312,7 +1312,7 @@ static int macvtap_device_event(struct notifier_block *unused,
  	return NOTIFY_DONE;
  }
  
@@ -53341,10 +53468,10 @@ index 0bfbaba..c81a3588 100644
  
  	r = get_phy_id(bus, addr, &phy_id, is_c45, &c45_ids);
 diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
-index 9a863c6..accd789 100644
+index 174e06e..51e015c 100644
 --- a/drivers/net/ppp/ppp_generic.c
 +++ b/drivers/net/ppp/ppp_generic.c
-@@ -1045,7 +1045,6 @@ ppp_net_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+@@ -1048,7 +1048,6 @@ ppp_net_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
  	void __user *addr = (void __user *) ifr->ifr_ifru.ifru_data;
  	struct ppp_stats stats;
  	struct ppp_comp_stats cstats;
@@ -53352,7 +53479,7 @@ index 9a863c6..accd789 100644
  
  	switch (cmd) {
  	case SIOCGPPPSTATS:
-@@ -1067,8 +1066,7 @@ ppp_net_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
+@@ -1070,8 +1069,7 @@ ppp_net_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
  		break;
  
  	case SIOCGPPPVER:
@@ -53362,24 +53489,6 @@ index 9a863c6..accd789 100644
  			break;
  		err = 0;
  		break;
-@@ -2290,7 +2288,7 @@ int ppp_register_net_channel(struct net *net, struct ppp_channel *chan)
- 
- 	pch->ppp = NULL;
- 	pch->chan = chan;
--	pch->chan_net = net;
-+	pch->chan_net = get_net(net);
- 	chan->ppp = pch;
- 	init_ppp_file(&pch->file, CHANNEL);
- 	pch->file.hdrlen = chan->hdrlen;
-@@ -2387,6 +2385,8 @@ ppp_unregister_channel(struct ppp_channel *chan)
- 	spin_lock_bh(&pn->all_channels_lock);
- 	list_del(&pch->list);
- 	spin_unlock_bh(&pn->all_channels_lock);
-+	put_net(pch->chan_net);
-+	pch->chan_net = NULL;
- 
- 	pch->file.dead = 1;
- 	wake_up_interruptible(&pch->file.rwait);
 diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
 index f7e8c79..d5531cd 100644
 --- a/drivers/net/ppp/pptp.c
@@ -53428,10 +53537,10 @@ index 59fefca..b1422b1 100644
  };
  
 diff --git a/drivers/net/tun.c b/drivers/net/tun.c
-index f0db770..f237a01 100644
+index 2d186bd..519779a 100644
 --- a/drivers/net/tun.c
 +++ b/drivers/net/tun.c
-@@ -1473,7 +1473,7 @@ static int tun_validate(struct nlattr *tb[], struct nlattr *data[])
+@@ -1474,7 +1474,7 @@ static int tun_validate(struct nlattr *tb[], struct nlattr *data[])
  	return -EINVAL;
  }
  
@@ -53440,7 +53549,7 @@ index f0db770..f237a01 100644
  	.kind		= DRV_NAME,
  	.priv_size	= sizeof(struct tun_struct),
  	.setup		= tun_setup,
-@@ -1872,7 +1872,7 @@ unlock:
+@@ -1874,7 +1874,7 @@ unlock:
  }
  
  static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
@@ -53449,7 +53558,7 @@ index f0db770..f237a01 100644
  {
  	struct tun_file *tfile = file->private_data;
  	struct tun_struct *tun;
-@@ -1886,6 +1886,9 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
+@@ -1888,6 +1888,9 @@ static long __tun_chr_ioctl(struct file *file, unsigned int cmd,
  	int le;
  	int ret;
  
@@ -53599,10 +53708,10 @@ index f94ab78..675a3a4 100644
  #define VIRTNET_DRIVER_VERSION "1.0.0"
  
 diff --git a/drivers/net/vrf.c b/drivers/net/vrf.c
-index 0a242b2..eaf24af 100644
+index 903bda4..ee77e53 100644
 --- a/drivers/net/vrf.c
 +++ b/drivers/net/vrf.c
-@@ -939,7 +939,7 @@ static const struct nla_policy vrf_nl_policy[IFLA_VRF_MAX + 1] = {
+@@ -942,7 +942,7 @@ static const struct nla_policy vrf_nl_policy[IFLA_VRF_MAX + 1] = {
  	[IFLA_VRF_TABLE] = { .type = NLA_U32 },
  };
  
@@ -53611,7 +53720,7 @@ index 0a242b2..eaf24af 100644
  	.kind		= DRV_NAME,
  	.priv_size	= sizeof(struct net_vrf),
  
-@@ -973,7 +973,7 @@ out:
+@@ -976,7 +976,7 @@ out:
  	return NOTIFY_DONE;
  }
  
@@ -53621,10 +53730,10 @@ index 0a242b2..eaf24af 100644
  };
  
 diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
-index e0fcda4..b548741 100644
+index 3c0df70..a884dac 100644
 --- a/drivers/net/vxlan.c
 +++ b/drivers/net/vxlan.c
-@@ -3144,7 +3144,7 @@ static struct net *vxlan_get_link_net(const struct net_device *dev)
+@@ -3146,7 +3146,7 @@ static struct net *vxlan_get_link_net(const struct net_device *dev)
  	return vxlan->net;
  }
  
@@ -53633,7 +53742,7 @@ index e0fcda4..b548741 100644
  	.kind		= "vxlan",
  	.maxtype	= IFLA_VXLAN_MAX,
  	.policy		= vxlan_policy,
-@@ -3192,7 +3192,7 @@ static int vxlan_lowerdev_event(struct notifier_block *unused,
+@@ -3194,7 +3194,7 @@ static int vxlan_lowerdev_event(struct notifier_block *unused,
  	return NOTIFY_DONE;
  }
  
@@ -55216,7 +55325,7 @@ index 3f155e7..0f4b1f0 100644
  		    &proc_bus_pci_dev_operations);
  	proc_initialized = 1;
 diff --git a/drivers/pinctrl/nomadik/pinctrl-nomadik.c b/drivers/pinctrl/nomadik/pinctrl-nomadik.c
-index eebfae0..f4713a8 100644
+index f844b4a..5e43134 100644
 --- a/drivers/pinctrl/nomadik/pinctrl-nomadik.c
 +++ b/drivers/pinctrl/nomadik/pinctrl-nomadik.c
 @@ -1212,7 +1212,7 @@ static int nmk_gpio_probe(struct platform_device *dev)
@@ -57425,7 +57534,7 @@ index e3cd3ec..00560ec 100644
  
  	transport_setup_device(&rport->dev);
 diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
-index cc84ea7..92bb10f 100644
+index 0d7c6e8..288e969 100644
 --- a/drivers/scsi/sd.c
 +++ b/drivers/scsi/sd.c
 @@ -112,7 +112,7 @@ static int sd_resume(struct device *);
@@ -57437,7 +57546,7 @@ index cc84ea7..92bb10f 100644
  static int sd_eh_action(struct scsi_cmnd *, int);
  static void sd_read_capacity(struct scsi_disk *sdkp, unsigned char *buffer);
  static void scsi_disk_release(struct device *cdev);
-@@ -1756,7 +1756,7 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd)
+@@ -1757,7 +1757,7 @@ static unsigned int sd_completed_bytes(struct scsi_cmnd *scmd)
   *
   *	Note: potentially run from within an ISR. Must not block.
   **/
@@ -57446,7 +57555,7 @@ index cc84ea7..92bb10f 100644
  {
  	int result = SCpnt->result;
  	unsigned int good_bytes = result ? 0 : scsi_bufflen(SCpnt);
-@@ -3100,7 +3100,7 @@ static int sd_probe(struct device *dev)
+@@ -3088,7 +3088,7 @@ static int sd_probe(struct device *dev)
  	sdkp->disk = gd;
  	sdkp->index = index;
  	atomic_set(&sdkp->openers, 0);
@@ -60255,7 +60364,7 @@ index 1c102d6..d15688e 100644
  			wake_up(&usb_kill_urb_queue);
  		usb_put_urb(urb);
 diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
-index 2a27488..436ee88 100644
+index 84df093..f2238d4 100644
 --- a/drivers/usb/core/hub.c
 +++ b/drivers/usb/core/hub.c
 @@ -26,6 +26,7 @@
@@ -60710,10 +60819,10 @@ index 5e67f63..2ef08d6 100644
  		const u8 *scdd;
  		u8 fm_ili;
 diff --git a/drivers/usb/storage/usb.c b/drivers/usb/storage/usb.c
-index 43576ed..583589d 100644
+index 9de988a..4a45fdc 100644
 --- a/drivers/usb/storage/usb.c
 +++ b/drivers/usb/storage/usb.c
-@@ -912,7 +912,7 @@ static void usb_stor_scan_dwork(struct work_struct *work)
+@@ -915,7 +915,7 @@ static void usb_stor_scan_dwork(struct work_struct *work)
  	clear_bit(US_FLIDX_SCAN_PENDING, &us->dflags);
  }
  
@@ -60735,6 +60844,28 @@ index da0ad32..50b5bbe 100644
  
  
  /* Dynamic bitflag definitions (us->dflags): used in set_bit() etc. */
+diff --git a/drivers/usb/usbip/usbip_common.c b/drivers/usb/usbip/usbip_common.c
+index facaaf0..e40da77 100644
+--- a/drivers/usb/usbip/usbip_common.c
++++ b/drivers/usb/usbip/usbip_common.c
+@@ -741,6 +741,17 @@ int usbip_recv_xbuff(struct usbip_device *ud, struct urb *urb)
+ 	if (!(size > 0))
+ 		return 0;
+ 
++	if (size > urb->transfer_buffer_length) {
++		/* should not happen, probably malicious packet */
++		if (ud->side == USBIP_STUB) {
++			usbip_event_add(ud, SDEV_EVENT_ERROR_TCP);
++			return 0;
++		} else {
++			usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
++			return -EPIPE;
++		}
++	}
++
+ 	ret = usbip_recv(ud->tcp_socket, urb->transfer_buffer, size);
+ 	if (ret != size) {
+ 		dev_err(&urb->dev->dev, "recv xbuf, %d\n", ret);
 diff --git a/drivers/usb/usbip/vhci.h b/drivers/usb/usbip/vhci.h
 index a863a98..d272795 100644
 --- a/drivers/usb/usbip/vhci.h
@@ -64384,10 +64515,10 @@ index 3c14e43..2630570 100644
 +4 4 4  4 4 4  4 4 4  4 4 4  4 4 4  4 4 4
 +4 4 4  4 4 4
 diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c
-index 524c221..004dace 100644
+index 4436778..bfcd027 100644
 --- a/drivers/xen/events/events_base.c
 +++ b/drivers/xen/events/events_base.c
-@@ -1565,7 +1565,7 @@ void xen_irq_resume(void)
+@@ -1585,7 +1585,7 @@ void xen_irq_resume(void)
  	restore_pirqs();
  }
  
@@ -64396,7 +64527,7 @@ index 524c221..004dace 100644
  	.name			= "xen-dyn",
  
  	.irq_disable		= disable_dynirq,
-@@ -1579,7 +1579,7 @@ static struct irq_chip xen_dynamic_chip __read_mostly = {
+@@ -1599,7 +1599,7 @@ static struct irq_chip xen_dynamic_chip __read_mostly = {
  	.irq_retrigger		= retrigger_dynirq,
  };
  
@@ -64405,7 +64536,7 @@ index 524c221..004dace 100644
  	.name			= "xen-pirq",
  
  	.irq_startup		= startup_pirq,
-@@ -1599,7 +1599,7 @@ static struct irq_chip xen_pirq_chip __read_mostly = {
+@@ -1619,7 +1619,7 @@ static struct irq_chip xen_pirq_chip __read_mostly = {
  	.irq_retrigger		= retrigger_dynirq,
  };
  
@@ -78157,7 +78288,7 @@ index 6a98bdd..fed3da6 100644
  		RB_CLEAR_NODE(&merge->rb_node);
  		em->mod_len = (merge->mod_start + merge->mod_len) - em->mod_start;
 diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
-index 0f09526..000f57d 100644
+index 5e5db36..b5ac5d4 100644
 --- a/fs/btrfs/file.c
 +++ b/fs/btrfs/file.c
 @@ -1912,7 +1912,7 @@ int btrfs_sync_file(struct file *file, loff_t start, loff_t end, int datasync)
@@ -78401,7 +78532,7 @@ index be8eae8..f884717 100644
  	spin_lock_init(&cur_trans->delayed_refs.lock);
  
 diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
-index 323e12c..f9bab4a 100644
+index 0e044d7..21ad436 100644
 --- a/fs/btrfs/tree-log.c
 +++ b/fs/btrfs/tree-log.c
 @@ -172,7 +172,7 @@ static int start_log_trans(struct btrfs_trans_handle *trans,
@@ -80151,7 +80282,7 @@ index dfc87c5..9e773ba 100644
  		return 0;
  	while (nr) {
 diff --git a/fs/dcache.c b/fs/dcache.c
-index 877bcbb..7ec5109 100644
+index 18effa3..58ad60d 100644
 --- a/fs/dcache.c
 +++ b/fs/dcache.c
 @@ -328,8 +328,9 @@ static inline void dentry_rcuwalk_invalidate(struct dentry *dentry)
@@ -80360,7 +80491,7 @@ index 877bcbb..7ec5109 100644
  	INIT_HLIST_BL_NODE(&dentry->d_hash);
  	INIT_LIST_HEAD(&dentry->d_lru);
  	INIT_LIST_HEAD(&dentry->d_subdirs);
-@@ -2317,7 +2323,7 @@ struct dentry *__d_lookup(const struct dentry *parent, const struct qstr *name)
+@@ -2320,7 +2326,7 @@ struct dentry *__d_lookup(const struct dentry *parent, const struct qstr *name)
  				goto next;
  		}
  
@@ -80369,7 +80500,7 @@ index 877bcbb..7ec5109 100644
  		found = dentry;
  		spin_unlock(&dentry->d_lock);
  		break;
-@@ -2385,7 +2391,7 @@ again:
+@@ -2388,7 +2394,7 @@ again:
  	spin_lock(&dentry->d_lock);
  	inode = dentry->d_inode;
  	isdir = S_ISDIR(inode->i_mode);
@@ -80378,7 +80509,7 @@ index 877bcbb..7ec5109 100644
  		if (!spin_trylock(&inode->i_lock)) {
  			spin_unlock(&dentry->d_lock);
  			cpu_relax();
-@@ -3333,7 +3339,7 @@ static enum d_walk_ret d_genocide_kill(void *data, struct dentry *dentry)
+@@ -3336,7 +3342,7 @@ static enum d_walk_ret d_genocide_kill(void *data, struct dentry *dentry)
  
  		if (!(dentry->d_flags & DCACHE_GENOCIDE)) {
  			dentry->d_flags |= DCACHE_GENOCIDE;
@@ -80387,7 +80518,7 @@ index 877bcbb..7ec5109 100644
  		}
  	}
  	return D_WALK_CONTINUE;
-@@ -3441,7 +3447,8 @@ void __init vfs_caches_init_early(void)
+@@ -3444,7 +3450,8 @@ void __init vfs_caches_init_early(void)
  void __init vfs_caches_init(void)
  {
  	names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
@@ -81392,10 +81523,10 @@ index fe1f50f..3f4c870 100644
  		if (free_clusters >= (nclusters + dirty_clusters +
  				      resv_clusters))
 diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
-index cc7ca4e..8c14386 100644
+index d4156e1..968858a 100644
 --- a/fs/ext4/ext4.h
 +++ b/fs/ext4/ext4.h
-@@ -910,6 +910,15 @@ struct ext4_inode_info {
+@@ -933,6 +933,15 @@ struct ext4_inode_info {
  	 * by other means, so we have i_data_sem.
  	 */
  	struct rw_semaphore i_data_sem;
@@ -81411,7 +81542,7 @@ index cc7ca4e..8c14386 100644
  	struct inode vfs_inode;
  	struct jbd2_inode *jinode;
  
-@@ -1351,19 +1360,19 @@ struct ext4_sb_info {
+@@ -1374,19 +1383,19 @@ struct ext4_sb_info {
  	unsigned long s_mb_last_start;
  
  	/* stats for buddy allocator */
@@ -81441,7 +81572,7 @@ index cc7ca4e..8c14386 100644
  	atomic_t s_lock_busy;
  
  	/* locality groups */
-@@ -2484,6 +2493,7 @@ extern int ext4_chunk_trans_blocks(struct inode *, int nrblocks);
+@@ -2507,6 +2516,7 @@ extern int ext4_chunk_trans_blocks(struct inode *, int nrblocks);
  extern int ext4_zero_partial_blocks(handle_t *handle, struct inode *inode,
  			     loff_t lstart, loff_t lend);
  extern int ext4_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf);
@@ -81449,7 +81580,7 @@ index cc7ca4e..8c14386 100644
  extern qsize_t *ext4_get_reserved_space(struct inode *inode);
  extern void ext4_da_update_reserve_space(struct inode *inode,
  					int used, int quota_claim);
-@@ -2848,6 +2858,9 @@ static inline int ext4_update_inode_size(struct inode *inode, loff_t newsize)
+@@ -2871,6 +2881,9 @@ static inline int ext4_update_inode_size(struct inode *inode, loff_t newsize)
  	return changed;
  }
  
@@ -82151,7 +82282,7 @@ index 34038e3..322fe62 100644
  		err = ext4_handle_dirty_metadata(handle, NULL, bh);
  		if (unlikely(err))
 diff --git a/fs/ext4/super.c b/fs/ext4/super.c
-index c9ab67d..74fc72e 100644
+index ba1cf0b..375d641 100644
 --- a/fs/ext4/super.c
 +++ b/fs/ext4/super.c
 @@ -958,6 +958,7 @@ static void init_once(void *foo)
@@ -85263,7 +85394,7 @@ index 646cdac..cdfa595 100644
  static struct callback_op callback_ops[];
  
 diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
-index 3e2071a..c09f4b6 100644
+index f714b98..352e5f8 100644
 --- a/fs/nfs/inode.c
 +++ b/fs/nfs/inode.c
 @@ -1284,16 +1284,16 @@ static int nfs_check_inode_attributes(struct inode *inode, struct nfs_fattr *fat
@@ -85952,7 +86083,7 @@ index 05ac9a9..c60faca 100644
  	if (ovl_open_need_copy_up(file_flags, type, realpath.dentry)) {
  		err = ovl_want_write(dentry);
 diff --git a/fs/overlayfs/super.c b/fs/overlayfs/super.c
-index 000b2ed..0be081d 100644
+index a1acc60..52c2657 100644
 --- a/fs/overlayfs/super.c
 +++ b/fs/overlayfs/super.c
 @@ -175,7 +175,7 @@ void ovl_path_lower(struct dentry *dentry, struct path *path)
@@ -85964,7 +86095,7 @@ index 000b2ed..0be081d 100644
  }
  
  int ovl_want_write(struct dentry *dentry)
-@@ -884,8 +884,8 @@ static unsigned int ovl_split_lowerdirs(char *str)
+@@ -917,8 +917,8 @@ static unsigned int ovl_split_lowerdirs(char *str)
  
  static int ovl_fill_super(struct super_block *sb, void *data, int silent)
  {
@@ -101703,7 +101834,7 @@ index a76c917..63b52db 100644
  asmlinkage long compat_sys_lookup_dcookie(u32, u32, char __user *, compat_size_t);
  /*
 diff --git a/include/linux/compiler-gcc.h b/include/linux/compiler-gcc.h
-index 22ab246..bfa81b0 100644
+index eeae401..4bf36c1 100644
 --- a/include/linux/compiler-gcc.h
 +++ b/include/linux/compiler-gcc.h
 @@ -116,8 +116,8 @@
@@ -102255,7 +102386,7 @@ index 653589e..4ef254a 100644
  	return c | 0x20;
  }
 diff --git a/include/linux/dcache.h b/include/linux/dcache.h
-index 8a2e009..c3e6d63 100644
+index f513dd8..b264e06 100644
 --- a/include/linux/dcache.h
 +++ b/include/linux/dcache.h
 @@ -123,6 +123,9 @@ struct dentry {
@@ -102277,7 +102408,7 @@ index 8a2e009..c3e6d63 100644
  
  /*
   * dentry->d_lock spinlock nesting subclasses:
-@@ -321,7 +324,7 @@ extern struct dentry *__d_lookup_rcu(const struct dentry *parent,
+@@ -323,7 +326,7 @@ extern struct dentry *__d_lookup_rcu(const struct dentry *parent,
  
  static inline unsigned d_count(const struct dentry *dentry)
  {
@@ -102286,7 +102417,7 @@ index 8a2e009..c3e6d63 100644
  }
  
  /*
-@@ -350,7 +353,7 @@ extern char *dentry_path(struct dentry *, char *, int);
+@@ -352,7 +355,7 @@ extern char *dentry_path(struct dentry *, char *, int);
  static inline struct dentry *dget_dlock(struct dentry *dentry)
  {
  	if (dentry)
@@ -102462,7 +102593,7 @@ index 5295535..9852c7e 100644
  int iterate_fd(struct files_struct *, unsigned,
  		int (*)(const void *, struct file *, unsigned),
 diff --git a/include/linux/fs.h b/include/linux/fs.h
-index 22c5a0c..264567c 100644
+index ab3d8d9..7e062a6 100644
 --- a/include/linux/fs.h
 +++ b/include/linux/fs.h
 @@ -439,7 +439,7 @@ struct address_space {
@@ -102510,7 +102641,7 @@ index 22c5a0c..264567c 100644
  
  struct file_lock_context {
  	spinlock_t		flc_lock;
-@@ -1373,7 +1373,7 @@ struct super_block {
+@@ -1383,7 +1383,7 @@ struct super_block {
  	/* s_inode_list_lock protects s_inodes */
  	spinlock_t		s_inode_list_lock ____cacheline_aligned_in_smp;
  	struct list_head	s_inodes;	/* all inodes */
@@ -102519,7 +102650,7 @@ index 22c5a0c..264567c 100644
  
  extern struct timespec current_fs_time(struct super_block *sb);
  
-@@ -1629,7 +1629,8 @@ struct file_operations {
+@@ -1639,7 +1639,8 @@ struct file_operations {
  #ifndef CONFIG_MMU
  	unsigned (*mmap_capabilities)(struct file *);
  #endif
@@ -102529,7 +102660,7 @@ index 22c5a0c..264567c 100644
  
  struct inode_operations {
  	struct dentry * (*lookup) (struct inode *,struct dentry *, unsigned int);
-@@ -2336,7 +2337,7 @@ extern int register_chrdev_region(dev_t, unsigned, const char *);
+@@ -2346,7 +2347,7 @@ extern int register_chrdev_region(dev_t, unsigned, const char *);
  extern int __register_chrdev(unsigned int major, unsigned int baseminor,
  			     unsigned int count, const char *name,
  			     const struct file_operations *fops);
@@ -102538,7 +102669,7 @@ index 22c5a0c..264567c 100644
  				unsigned int count, const char *name);
  extern void unregister_chrdev_region(dev_t, unsigned);
  extern void chrdev_show(struct seq_file *,off_t);
-@@ -2764,8 +2765,6 @@ extern int vfs_lstat(const char __user *, struct kstat *);
+@@ -2774,8 +2775,6 @@ extern int vfs_lstat(const char __user *, struct kstat *);
  extern int vfs_fstat(unsigned int, struct kstat *);
  extern int vfs_fstatat(int , const char __user *, struct kstat *, int);
  
@@ -102547,7 +102678,7 @@ index 22c5a0c..264567c 100644
  extern int __generic_block_fiemap(struct inode *inode,
  				  struct fiemap_extent_info *fieinfo,
  				  loff_t start, loff_t len,
-@@ -3026,4 +3025,14 @@ static inline bool dir_relax(struct inode *inode)
+@@ -3036,4 +3035,14 @@ static inline bool dir_relax(struct inode *inode)
  
  extern bool path_noexec(const struct path *path);
  
@@ -105478,10 +105609,10 @@ index 0b4ac7d..d4dc945 100644
  struct iovec;
  struct kvec;
 diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
-index 3143c84..a709abf 100644
+index 04c068e..828eebe 100644
 --- a/include/linux/netdevice.h
 +++ b/include/linux/netdevice.h
-@@ -1237,6 +1237,7 @@ struct net_device_ops {
+@@ -1238,6 +1238,7 @@ struct net_device_ops {
  	int			(*ndo_fill_metadata_dst)(struct net_device *dev,
  						       struct sk_buff *skb);
  };
@@ -106998,7 +107129,7 @@ index 92557bb..53fa513 100644
  
  static inline void disallow_signal(int sig)
 diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
-index 75f136a..fa3b724 100644
+index 4fde618..6d6edb3 100644
 --- a/include/linux/skbuff.h
 +++ b/include/linux/skbuff.h
 @@ -809,7 +809,7 @@ struct sk_buff *__alloc_skb(unsigned int size, gfp_t priority, int flags,
@@ -107010,7 +107141,7 @@ index 75f136a..fa3b724 100644
  					gfp_t priority)
  {
  	return __alloc_skb(size, priority, 0, NUMA_NO_NODE);
-@@ -2080,7 +2080,7 @@ static inline int skb_checksum_start_offset(const struct sk_buff *skb)
+@@ -2104,7 +2104,7 @@ static inline int skb_checksum_start_offset(const struct sk_buff *skb)
  	return skb->csum_start - skb_headroom(skb);
  }
  
@@ -107019,7 +107150,7 @@ index 75f136a..fa3b724 100644
  {
  	return skb_transport_header(skb) - skb->data;
  }
-@@ -2095,7 +2095,7 @@ static inline u32 skb_inner_network_header_len(const struct sk_buff *skb)
+@@ -2119,7 +2119,7 @@ static inline u32 skb_inner_network_header_len(const struct sk_buff *skb)
  	return skb->inner_transport_header - skb->inner_network_header;
  }
  
@@ -107028,7 +107159,7 @@ index 75f136a..fa3b724 100644
  {
  	return skb_network_header(skb) - skb->data;
  }
-@@ -2155,7 +2155,7 @@ static inline int pskb_network_may_pull(struct sk_buff *skb, unsigned int len)
+@@ -2179,7 +2179,7 @@ static inline int pskb_network_may_pull(struct sk_buff *skb, unsigned int len)
   * NET_IP_ALIGN(2) + ethernet_header(14) + IP_header(20/40) + ports(8)
   */
  #ifndef NET_SKB_PAD
@@ -107037,7 +107168,7 @@ index 75f136a..fa3b724 100644
  #endif
  
  int ___pskb_trim(struct sk_buff *skb, unsigned int len);
-@@ -2795,9 +2795,9 @@ struct sk_buff *skb_recv_datagram(struct sock *sk, unsigned flags, int noblock,
+@@ -2836,9 +2836,9 @@ struct sk_buff *skb_recv_datagram(struct sock *sk, unsigned flags, int noblock,
  				  int *err);
  unsigned int datagram_poll(struct file *file, struct socket *sock,
  			   struct poll_table_struct *wait);
@@ -107049,7 +107180,7 @@ index 75f136a..fa3b724 100644
  					struct msghdr *msg, int size)
  {
  	return skb_copy_datagram_iter(from, offset, &msg->msg_iter, size);
-@@ -3326,6 +3326,9 @@ static inline void nf_reset(struct sk_buff *skb)
+@@ -3367,6 +3367,9 @@ static inline void nf_reset(struct sk_buff *skb)
  	nf_bridge_put(skb->nf_bridge);
  	skb->nf_bridge = NULL;
  #endif
@@ -108331,10 +108462,10 @@ index 5289929..b4c41b3 100644
  struct l2cap_conn {
  	struct hci_conn		*hcon;
 diff --git a/include/net/bonding.h b/include/net/bonding.h
-index c1740a2..ec57070 100644
+index 93abe5f..65b0405 100644
 --- a/include/net/bonding.h
 +++ b/include/net/bonding.h
-@@ -668,7 +668,7 @@ extern struct rtnl_link_ops bond_link_ops;
+@@ -669,7 +669,7 @@ extern struct rtnl_link_ops bond_link_ops;
  
  static inline void bond_tx_drop(struct net_device *dev, struct sk_buff *skb)
  {
@@ -111262,7 +111393,7 @@ index 41213454..861e178 100644
  #ifdef CONFIG_MODULE_UNLOAD
  		{
 diff --git a/kernel/events/core.c b/kernel/events/core.c
-index faf2067..d7d38d0 100644
+index 1e889a0..78b25c2 100644
 --- a/kernel/events/core.c
 +++ b/kernel/events/core.c
 @@ -175,8 +175,15 @@ static struct srcu_struct pmus_srcu;
@@ -111384,7 +111515,7 @@ index faf2067..d7d38d0 100644
  	err = perf_copy_attr(attr_uptr, &attr);
  	if (err)
  		return err;
-@@ -8735,10 +8747,10 @@ static void sync_child_event(struct perf_event *child_event,
+@@ -8740,10 +8752,10 @@ static void sync_child_event(struct perf_event *child_event,
  	/*
  	 * Add back the child's count to the parent's count:
  	 */
@@ -124648,7 +124779,7 @@ index b94b1d2..da3ed7c 100644
  EXPORT_SYMBOL(dev_load);
  
 diff --git a/net/core/filter.c b/net/core/filter.c
-index 37157c4..3cdff69 100644
+index f393a22..a106bc8 100644
 --- a/net/core/filter.c
 +++ b/net/core/filter.c
 @@ -580,7 +580,11 @@ do_pass:
@@ -124938,7 +125069,7 @@ index 4da4d51..ef1aa60 100644
  		pr_warn("cannot create /proc/net/%s\n", PG_PROC_DIR);
  		return -ENODEV;
 diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
-index 34ba7a0..5ebb8ef 100644
+index ca966f7..34ad6fa 100644
 --- a/net/core/rtnetlink.c
 +++ b/net/core/rtnetlink.c
 @@ -61,7 +61,7 @@ struct rtnl_link {
@@ -124976,7 +125107,7 @@ index 34ba7a0..5ebb8ef 100644
  }
  EXPORT_SYMBOL_GPL(__rtnl_link_unregister);
  
-@@ -1233,7 +1236,7 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
+@@ -1234,7 +1237,7 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
  	    (dev->ifalias &&
  	     nla_put_string(skb, IFLA_IFALIAS, dev->ifalias)) ||
  	    nla_put_u32(skb, IFLA_CARRIER_CHANGES,
@@ -124985,7 +125116,7 @@ index 34ba7a0..5ebb8ef 100644
  	    nla_put_u8(skb, IFLA_PROTO_DOWN, dev->proto_down))
  		goto nla_put_failure;
  
-@@ -3385,7 +3388,7 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
+@@ -3386,7 +3389,7 @@ static int rtnetlink_rcv_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
  		__rtnl_unlock();
  		rtnl = net->rtnl;
  		{
@@ -125047,7 +125178,7 @@ index dce0acb..69f6cac 100644
  		if (!err)
  			err = put_user(SCM_RIGHTS, &cm->cmsg_type);
 diff --git a/net/core/skbuff.c b/net/core/skbuff.c
-index 5bf88f5..008242b 100644
+index 8616d11..8b30348 100644
 --- a/net/core/skbuff.c
 +++ b/net/core/skbuff.c
 @@ -971,7 +971,8 @@ static void skb_headers_offset_update(struct sk_buff *skb, int off)
@@ -125069,7 +125200,7 @@ index 5bf88f5..008242b 100644
  		.update  = csum_partial_ext,
  		.combine = csum_block_add_ext,
  	};
-@@ -3320,12 +3321,14 @@ void __init skb_init(void)
+@@ -3338,12 +3339,14 @@ void __init skb_init(void)
  	skbuff_head_cache = kmem_cache_create("skbuff_head_cache",
  					      sizeof(struct sk_buff),
  					      0,
@@ -125526,7 +125657,7 @@ index 59b3e0e..ff060b8 100644
  	struct dst_entry *dst = NULL;
  
 diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
-index f6303b1..329a13a 100644
+index 0212591..329a13a 100644
 --- a/net/ipv4/devinet.c
 +++ b/net/ipv4/devinet.c
 @@ -69,7 +69,8 @@
@@ -125549,25 +125680,7 @@ index f6303b1..329a13a 100644
  		[IPV4_DEVCONF_SEND_REDIRECTS - 1] = 1,
  		[IPV4_DEVCONF_SECURE_REDIRECTS - 1] = 1,
  		[IPV4_DEVCONF_SHARED_MEDIA - 1] = 1,
-@@ -334,6 +336,9 @@ static void __inet_del_ifa(struct in_device *in_dev, struct in_ifaddr **ifap,
- 
- 	ASSERT_RTNL();
- 
-+	if (in_dev->dead)
-+		goto no_promotions;
-+
- 	/* 1. Deleting primary ifaddr forces deletion all secondaries
- 	 * unless alias promotion is set
- 	 **/
-@@ -380,6 +385,7 @@ static void __inet_del_ifa(struct in_device *in_dev, struct in_ifaddr **ifap,
- 			fib_del_ifaddr(ifa, ifa1);
- 	}
- 
-+no_promotions:
- 	/* 2. Unlink it */
- 
- 	*ifap = ifa1->ifa_next;
-@@ -1579,7 +1585,7 @@ static int inet_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
+@@ -1583,7 +1585,7 @@ static int inet_dump_ifaddr(struct sk_buff *skb, struct netlink_callback *cb)
  		idx = 0;
  		head = &net->dev_index_head[h];
  		rcu_read_lock();
@@ -125576,7 +125689,7 @@ index f6303b1..329a13a 100644
  			  net->dev_base_seq;
  		hlist_for_each_entry_rcu(dev, head, index_hlist) {
  			if (idx < s_idx)
-@@ -1907,7 +1913,7 @@ static int inet_netconf_dump_devconf(struct sk_buff *skb,
+@@ -1911,7 +1913,7 @@ static int inet_netconf_dump_devconf(struct sk_buff *skb,
  		idx = 0;
  		head = &net->dev_index_head[h];
  		rcu_read_lock();
@@ -125585,7 +125698,7 @@ index f6303b1..329a13a 100644
  			  net->dev_base_seq;
  		hlist_for_each_entry_rcu(dev, head, index_hlist) {
  			if (idx < s_idx)
-@@ -2148,7 +2154,7 @@ static int ipv4_doint_and_flush(struct ctl_table *ctl, int write,
+@@ -2152,7 +2154,7 @@ static int ipv4_doint_and_flush(struct ctl_table *ctl, int write,
  #define DEVINET_SYSCTL_FLUSHING_ENTRY(attr, name) \
  	DEVINET_SYSCTL_COMPLEX_ENTRY(attr, name, ipv4_doint_and_flush)
  
@@ -125594,7 +125707,7 @@ index f6303b1..329a13a 100644
  	struct ctl_table_header *sysctl_header;
  	struct ctl_table devinet_vars[__IPV4_DEVCONF_MAX];
  } devinet_sysctl = {
-@@ -2282,7 +2288,7 @@ static __net_init int devinet_init_net(struct net *net)
+@@ -2286,7 +2288,7 @@ static __net_init int devinet_init_net(struct net *net)
  	int err;
  	struct ipv4_devconf *all, *dflt;
  #ifdef CONFIG_SYSCTL
@@ -125603,7 +125716,7 @@ index f6303b1..329a13a 100644
  	struct ctl_table_header *forw_hdr;
  #endif
  
-@@ -2300,7 +2306,7 @@ static __net_init int devinet_init_net(struct net *net)
+@@ -2304,7 +2306,7 @@ static __net_init int devinet_init_net(struct net *net)
  			goto err_alloc_dflt;
  
  #ifdef CONFIG_SYSCTL
@@ -125612,7 +125725,7 @@ index f6303b1..329a13a 100644
  		if (!tbl)
  			goto err_alloc_ctl;
  
-@@ -2320,7 +2326,10 @@ static __net_init int devinet_init_net(struct net *net)
+@@ -2324,7 +2326,10 @@ static __net_init int devinet_init_net(struct net *net)
  		goto err_reg_dflt;
  
  	err = -ENOMEM;
@@ -125624,7 +125737,7 @@ index f6303b1..329a13a 100644
  	if (!forw_hdr)
  		goto err_reg_ctl;
  	net->ipv4.forw_hdr = forw_hdr;
-@@ -2336,8 +2345,7 @@ err_reg_ctl:
+@@ -2340,8 +2345,7 @@ err_reg_ctl:
  err_reg_dflt:
  	__devinet_sysctl_unregister(all);
  err_reg_all:
@@ -125635,28 +125748,10 @@ index f6303b1..329a13a 100644
  #endif
  	if (dflt != &ipv4_devconf_dflt)
 diff --git a/net/ipv4/fib_frontend.c b/net/ipv4/fib_frontend.c
-index 4734475..abceb0a 100644
+index 8a9246d..d4f958b 100644
 --- a/net/ipv4/fib_frontend.c
 +++ b/net/ipv4/fib_frontend.c
-@@ -922,6 +922,9 @@ void fib_del_ifaddr(struct in_ifaddr *ifa, struct in_ifaddr *iprim)
- 		subnet = 1;
- 	}
- 
-+	if (in_dev->dead)
-+		goto no_promotions;
-+
- 	/* Deletion is more complicated than add.
- 	 * We should take care of not to delete too much :-)
- 	 *
-@@ -997,6 +1000,7 @@ void fib_del_ifaddr(struct in_ifaddr *ifa, struct in_ifaddr *iprim)
- 		}
- 	}
- 
-+no_promotions:
- 	if (!(ok & BRD_OK))
- 		fib_magic(RTM_DELROUTE, RTN_BROADCAST, ifa->ifa_broadcast, 32, prim);
- 	if (subnet && ifa->ifa_prefixlen < 31) {
-@@ -1133,12 +1137,12 @@ static int fib_inetaddr_event(struct notifier_block *this, unsigned long event,
+@@ -1135,12 +1135,12 @@ static int fib_inetaddr_event(struct notifier_block *this, unsigned long event,
  #ifdef CONFIG_IP_ROUTE_MULTIPATH
  		fib_sync_up(dev, RTNH_F_DEAD);
  #endif
@@ -125671,7 +125766,7 @@ index 4734475..abceb0a 100644
  		if (!ifa->ifa_dev->ifa_list) {
  			/* Last address was deleted from this interface.
  			 * Disable IP.
-@@ -1178,7 +1182,7 @@ static int fib_netdev_event(struct notifier_block *this, unsigned long event, vo
+@@ -1180,7 +1180,7 @@ static int fib_netdev_event(struct notifier_block *this, unsigned long event, vo
  #ifdef CONFIG_IP_ROUTE_MULTIPATH
  		fib_sync_up(dev, RTNH_F_DEAD);
  #endif
@@ -126391,31 +126486,6 @@ index 4a9e6db..06174e1 100644
  	if (!cn->procdir) {
  		pr_err("Unable to proc dir entry\n");
  		return -ENOMEM;
-diff --git a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
-index c6eb421..ea91058 100644
---- a/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
-+++ b/net/ipv4/netfilter/nf_nat_masquerade_ipv4.c
-@@ -108,10 +108,18 @@ static int masq_inet_event(struct notifier_block *this,
- 			   unsigned long event,
- 			   void *ptr)
- {
--	struct net_device *dev = ((struct in_ifaddr *)ptr)->ifa_dev->dev;
-+	struct in_device *idev = ((struct in_ifaddr *)ptr)->ifa_dev;
- 	struct netdev_notifier_info info;
- 
--	netdev_notifier_info_init(&info, dev);
-+	/* The masq_dev_notifier will catch the case of the device going
-+	 * down.  So if the inetdev is dead and being destroyed we have
-+	 * no work to do.  Otherwise this is an individual address removal
-+	 * and we have to perform the flush.
-+	 */
-+	if (idev->dead)
-+		return NOTIFY_DONE;
-+
-+	netdev_notifier_info_init(&info, idev->dev);
- 	return masq_device_event(this, event, &info);
- }
- 
 diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
 index aa67e0e..3c65672 100644
 --- a/net/ipv4/ping.c
@@ -126853,7 +126923,7 @@ index d4c5115..f949b08 100644
  		write_pnet(&ireq->ireq_net, sock_net(sk_listener));
  		ireq->ireq_family = sk_listener->sk_family;
 diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c
-index 8c7e631..d1dfdaf 100644
+index 048418b..bb14e83 100644
 --- a/net/ipv4/tcp_ipv4.c
 +++ b/net/ipv4/tcp_ipv4.c
 @@ -89,6 +89,10 @@ int sysctl_tcp_tw_reuse __read_mostly;
@@ -126867,7 +126937,7 @@ index 8c7e631..d1dfdaf 100644
  #ifdef CONFIG_TCP_MD5SIG
  static int tcp_v4_md5_hash_hdr(char *md5_hash, const struct tcp_md5sig_key *key,
  			       __be32 daddr, __be32 saddr, const struct tcphdr *th);
-@@ -1420,6 +1424,9 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
+@@ -1418,6 +1422,9 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb)
  	return 0;
  
  reset:
@@ -126877,7 +126947,7 @@ index 8c7e631..d1dfdaf 100644
  	tcp_v4_send_reset(rsk, skb);
  discard:
  	kfree_skb(skb);
-@@ -1585,12 +1592,19 @@ int tcp_v4_rcv(struct sk_buff *skb)
+@@ -1583,12 +1590,19 @@ int tcp_v4_rcv(struct sk_buff *skb)
  
  lookup:
  	sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
@@ -126900,7 +126970,7 @@ index 8c7e631..d1dfdaf 100644
  
  	if (sk->sk_state == TCP_NEW_SYN_RECV) {
  		struct request_sock *req = inet_reqsk(sk);
-@@ -1675,6 +1689,10 @@ csum_error:
+@@ -1673,6 +1687,10 @@ csum_error:
  bad_packet:
  		TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
  	} else {
@@ -126912,7 +126982,7 @@ index 8c7e631..d1dfdaf 100644
  	}
  
 diff --git a/net/ipv4/tcp_minisocks.c b/net/ipv4/tcp_minisocks.c
-index ac6b196..e94c1ea 100644
+index 9475a27..8bc7bde 100644
 --- a/net/ipv4/tcp_minisocks.c
 +++ b/net/ipv4/tcp_minisocks.c
 @@ -27,6 +27,10 @@
@@ -126981,7 +127051,7 @@ index 193ba1f..aeda727 100644
  				  syn_set ? 0 : icsk->icsk_user_timeout, syn_set)) {
  		/* Has it gone just too far? */
 diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
-index 7f8ab46..6d152f7 100644
+index 21fbb54..45345d8 100644
 --- a/net/ipv4/udp.c
 +++ b/net/ipv4/udp.c
 @@ -87,6 +87,7 @@
@@ -127089,7 +127159,7 @@ index 7f8ab46..6d152f7 100644
  	icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
  
  	/*
-@@ -2440,7 +2464,7 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
+@@ -2444,7 +2468,7 @@ static void udp4_format_sock(struct sock *sp, struct seq_file *f,
  		from_kuid_munged(seq_user_ns(f), sock_i_uid(sp)),
  		0, sock_i_ino(sp),
  		atomic_read(&sp->sk_refcnt), sp,
@@ -127398,7 +127468,7 @@ index 0c7e276..68d9b36 100644
  	return new;
  }
 diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
-index e5ea177..54bf9fb 100644
+index 4650c68..5b6762e 100644
 --- a/net/ipv6/ip6_gre.c
 +++ b/net/ipv6/ip6_gre.c
 @@ -71,8 +71,8 @@ struct ip6gre_net {
@@ -127412,7 +127482,7 @@ index e5ea177..54bf9fb 100644
  static int ip6gre_tunnel_init(struct net_device *dev);
  static void ip6gre_tunnel_setup(struct net_device *dev);
  static void ip6gre_tunnel_link(struct ip6gre_net *ign, struct ip6_tnl *t);
-@@ -1302,7 +1302,7 @@ static void ip6gre_fb_tunnel_init(struct net_device *dev)
+@@ -1304,7 +1304,7 @@ static void ip6gre_fb_tunnel_init(struct net_device *dev)
  }
  
  
@@ -127421,7 +127491,7 @@ index e5ea177..54bf9fb 100644
  	.handler     = ip6gre_rcv,
  	.err_handler = ip6gre_err,
  	.flags       = INET6_PROTO_NOPOLICY|INET6_PROTO_FINAL,
-@@ -1656,7 +1656,7 @@ static const struct nla_policy ip6gre_policy[IFLA_GRE_MAX + 1] = {
+@@ -1658,7 +1658,7 @@ static const struct nla_policy ip6gre_policy[IFLA_GRE_MAX + 1] = {
  	[IFLA_GRE_FLAGS]       = { .type = NLA_U32 },
  };
  
@@ -127430,7 +127500,7 @@ index e5ea177..54bf9fb 100644
  	.kind		= "ip6gre",
  	.maxtype	= IFLA_GRE_MAX,
  	.policy		= ip6gre_policy,
-@@ -1671,7 +1671,7 @@ static struct rtnl_link_ops ip6gre_link_ops __read_mostly = {
+@@ -1673,7 +1673,7 @@ static struct rtnl_link_ops ip6gre_link_ops __read_mostly = {
  	.get_link_net	= ip6_tnl_get_link_net,
  };
  
@@ -127439,41 +127509,8 @@ index e5ea177..54bf9fb 100644
  	.kind		= "ip6gretap",
  	.maxtype	= IFLA_GRE_MAX,
  	.policy		= ip6gre_policy,
-diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
-index 31144c4..a175152 100644
---- a/net/ipv6/ip6_output.c
-+++ b/net/ipv6/ip6_output.c
-@@ -1091,8 +1091,8 @@ static inline int ip6_ufo_append_data(struct sock *sk,
- 			int getfrag(void *from, char *to, int offset, int len,
- 			int odd, struct sk_buff *skb),
- 			void *from, int length, int hh_len, int fragheaderlen,
--			int transhdrlen, int mtu, unsigned int flags,
--			const struct flowi6 *fl6)
-+			int exthdrlen, int transhdrlen, int mtu,
-+			unsigned int flags, const struct flowi6 *fl6)
- 
- {
- 	struct sk_buff *skb;
-@@ -1117,7 +1117,7 @@ static inline int ip6_ufo_append_data(struct sock *sk,
- 		skb_put(skb, fragheaderlen + transhdrlen);
- 
- 		/* initialize network header pointer */
--		skb_reset_network_header(skb);
-+		skb_set_network_header(skb, exthdrlen);
- 
- 		/* initialize protocol header pointer */
- 		skb->transport_header = skb->network_header + fragheaderlen;
-@@ -1359,7 +1359,7 @@ emsgsize:
- 	    (rt->dst.dev->features & NETIF_F_UFO) &&
- 	    (sk->sk_type == SOCK_DGRAM) && !udp_get_no_check6_tx(sk)) {
- 		err = ip6_ufo_append_data(sk, queue, getfrag, from, length,
--					  hh_len, fragheaderlen,
-+					  hh_len, fragheaderlen, exthdrlen,
- 					  transhdrlen, mtu, flags, fl6);
- 		if (err)
- 			goto error;
 diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
-index 137fca4..dcda1fa 100644
+index 3991b21..4e8e990 100644
 --- a/net/ipv6/ip6_tunnel.c
 +++ b/net/ipv6/ip6_tunnel.c
 @@ -80,7 +80,7 @@ static u32 HASH(const struct in6_addr *addr1, const struct in6_addr *addr2)
@@ -127485,21 +127522,7 @@ index 137fca4..dcda1fa 100644
  
  static int ip6_tnl_net_id __read_mostly;
  struct ip6_tnl_net {
-@@ -343,12 +343,12 @@ static int ip6_tnl_create2(struct net_device *dev)
- 
- 	t = netdev_priv(dev);
- 
-+	dev->rtnl_link_ops = &ip6_link_ops;
- 	err = register_netdevice(dev);
- 	if (err < 0)
- 		goto out;
- 
- 	strcpy(t->parms.name, dev->name);
--	dev->rtnl_link_ops = &ip6_link_ops;
- 
- 	dev_hold(dev);
- 	ip6_tnl_link(ip6n, t);
-@@ -1841,7 +1841,7 @@ static const struct nla_policy ip6_tnl_policy[IFLA_IPTUN_MAX + 1] = {
+@@ -1843,7 +1843,7 @@ static const struct nla_policy ip6_tnl_policy[IFLA_IPTUN_MAX + 1] = {
  	[IFLA_IPTUN_PROTO]		= { .type = NLA_U8 },
  };
  
@@ -128141,7 +128164,7 @@ index b8d4056..9509e20 100644
  	}
  
 diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
-index 9da3287..87089a6 100644
+index 6665e1a..e84ef29 100644
 --- a/net/ipv6/udp.c
 +++ b/net/ipv6/udp.c
 @@ -76,6 +76,10 @@ static u32 udp6_ehashfn(const struct net *net,
@@ -128182,7 +128205,7 @@ index 9da3287..87089a6 100644
  			UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
  					  IS_UDPLITE(sk));
  			UDP6_INC_STATS_BH(sock_net(sk), UDP_MIB_INERRORS,
-@@ -937,6 +941,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
+@@ -935,6 +939,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
  		goto csum_error;
  
  	UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
@@ -128482,10 +128505,10 @@ index e253c26..609e848 100644
  }
  
 diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c
-index ec22078..0822b6e 100644
+index 42de4cc..f00aa3e 100644
 --- a/net/l2tp/l2tp_ip.c
 +++ b/net/l2tp/l2tp_ip.c
-@@ -608,7 +608,7 @@ static struct inet_protosw l2tp_ip_protosw = {
+@@ -610,7 +610,7 @@ static struct inet_protosw l2tp_ip_protosw = {
  	.ops		= &l2tp_ip_ops,
  };
  
@@ -128495,10 +128518,10 @@ index ec22078..0822b6e 100644
  	.netns_ok	= 1,
  };
 diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c
-index a2c8747..f1fc10b 100644
+index 9ee4ddb..3f4b9d4 100644
 --- a/net/l2tp/l2tp_ip6.c
 +++ b/net/l2tp/l2tp_ip6.c
-@@ -759,7 +759,7 @@ static struct inet_protosw l2tp_ip6_protosw = {
+@@ -761,7 +761,7 @@ static struct inet_protosw l2tp_ip6_protosw = {
  	.ops		= &l2tp_ip6_ops,
  };
  
@@ -128606,7 +128629,7 @@ index 6837a46..f8aaf7d 100644
  	/* number of interfaces with corresponding FIF_ flags */
  	int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll,
 diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c
-index c9e325d..afa762a 100644
+index 7a2b791..3297152 100644
 --- a/net/mac80211/iface.c
 +++ b/net/mac80211/iface.c
 @@ -551,7 +551,7 @@ int ieee80211_do_open(struct wireless_dev *wdev, bool coming_up)
@@ -128654,7 +128677,7 @@ index c9e325d..afa762a 100644
  
  	switch (sdata->vif.type) {
  	case NL80211_IFTYPE_AP_VLAN:
-@@ -981,7 +981,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
+@@ -984,7 +984,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
  		atomic_set(&sdata->txqs_len[txqi->txq.ac], 0);
  	}
  
@@ -128663,7 +128686,7 @@ index c9e325d..afa762a 100644
  		ieee80211_clear_tx_pending(local);
  
  	/*
-@@ -1024,7 +1024,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
+@@ -1027,7 +1027,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
  	if (cancel_scan)
  		flush_delayed_work(&local->scan_work);
  
@@ -128672,7 +128695,7 @@ index c9e325d..afa762a 100644
  		ieee80211_stop_device(local);
  
  		/* no reconfiguring after stop! */
-@@ -1035,7 +1035,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
+@@ -1038,7 +1038,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata,
  	ieee80211_configure_filter(local);
  	ieee80211_hw_config(local, hw_reconf_flags);
  
@@ -128681,7 +128704,7 @@ index c9e325d..afa762a 100644
  		ieee80211_add_virtual_monitor(local);
  }
  
-@@ -1895,8 +1895,8 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local)
+@@ -1898,8 +1898,8 @@ void ieee80211_remove_interfaces(struct ieee80211_local *local)
  	 */
  	cfg80211_shutdown_all_interfaces(local->hw.wiphy);
  
@@ -128763,7 +128786,7 @@ index a4e2f4e..02bfac1 100644
  
  	if (ieee80211_hw_check(&local->hw, HAS_RATE_CONTROL)) {
 diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c
-index f91d187..373ad96 100644
+index 67066d0..9d015cc 100644
 --- a/net/mac80211/sta_info.c
 +++ b/net/mac80211/sta_info.c
 @@ -348,7 +348,7 @@ struct sta_info *sta_info_alloc(struct ieee80211_sub_if_data *sdata,
@@ -128909,10 +128932,10 @@ index 7079cd3..c299f08 100644
  	/* defaults per 802.15.4-2011 */
  	wpan_dev->min_be = 3;
 diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
-index c32fc41..f8dcf21 100644
+index 881bc20..a01db58 100644
 --- a/net/mpls/af_mpls.c
 +++ b/net/mpls/af_mpls.c
-@@ -828,7 +828,7 @@ static int mpls_dev_sysctl_register(struct net_device *dev,
+@@ -831,7 +831,7 @@ static int mpls_dev_sysctl_register(struct net_device *dev,
  				    struct mpls_dev *mdev)
  {
  	char path[sizeof("net/mpls/conf/") + IFNAMSIZ];
@@ -128921,7 +128944,7 @@ index c32fc41..f8dcf21 100644
  	int i;
  
  	table = kmemdup(&mpls_dev_table, sizeof(mpls_dev_table), GFP_KERNEL);
-@@ -1489,7 +1489,7 @@ static int mpls_platform_labels(struct ctl_table *table, int write,
+@@ -1492,7 +1492,7 @@ static int mpls_platform_labels(struct ctl_table *table, int write,
  	struct net *net = table->data;
  	int platform_labels = net->mpls.platform_labels;
  	int ret;
@@ -128930,7 +128953,7 @@ index c32fc41..f8dcf21 100644
  		.procname	= table->procname,
  		.data		= &platform_labels,
  		.maxlen		= sizeof(int),
-@@ -1519,7 +1519,7 @@ static const struct ctl_table mpls_table[] = {
+@@ -1522,7 +1522,7 @@ static const struct ctl_table mpls_table[] = {
  
  static int mpls_net_init(struct net *net)
  {
@@ -129979,7 +130002,7 @@ index ec76398..52091dd 100644
  };
  
 diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
-index 992396a..d0b3a3d 100644
+index da1ae0e1..3eb11c3 100644
 --- a/net/packet/af_packet.c
 +++ b/net/packet/af_packet.c
 @@ -278,7 +278,7 @@ static int packet_direct_xmit(struct sk_buff *skb)
@@ -130025,7 +130048,7 @@ index 992396a..d0b3a3d 100644
  	}
  
  	mutex_lock(&fanout_mutex);
-@@ -2071,7 +2071,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
+@@ -2075,7 +2075,7 @@ static int packet_rcv(struct sk_buff *skb, struct net_device *dev,
  drop_n_acct:
  	spin_lock(&sk->sk_receive_queue.lock);
  	po->stats.stats1.tp_drops++;
@@ -130034,7 +130057,7 @@ index 992396a..d0b3a3d 100644
  	spin_unlock(&sk->sk_receive_queue.lock);
  
  drop_n_restore:
-@@ -3441,6 +3441,7 @@ static int packet_mc_add(struct sock *sk, struct packet_mreq_max *mreq)
+@@ -3436,6 +3436,7 @@ static int packet_mc_add(struct sock *sk, struct packet_mreq_max *mreq)
  	i->ifindex = mreq->mr_ifindex;
  	i->alen = mreq->mr_alen;
  	memcpy(i->addr, mreq->mr_address, i->alen);
@@ -130042,7 +130065,7 @@ index 992396a..d0b3a3d 100644
  	i->count = 1;
  	i->next = po->mclist;
  	po->mclist = i;
-@@ -3770,7 +3771,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+@@ -3765,7 +3766,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
  	case PACKET_HDRLEN:
  		if (len > sizeof(int))
  			len = sizeof(int);
@@ -130051,7 +130074,7 @@ index 992396a..d0b3a3d 100644
  			return -EFAULT;
  		switch (val) {
  		case TPACKET_V1:
-@@ -3805,9 +3806,9 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+@@ -3800,9 +3801,9 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
  	case PACKET_ROLLOVER_STATS:
  		if (!po->rollover)
  			return -EINVAL;
@@ -130064,7 +130087,7 @@ index 992396a..d0b3a3d 100644
  		data = &rstats;
  		lv = sizeof(rstats);
  		break;
-@@ -3825,7 +3826,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
+@@ -3820,7 +3821,7 @@ static int packet_getsockopt(struct socket *sock, int level, int optname,
  		len = lv;
  	if (put_user(len, optlen))
  		return -EFAULT;
@@ -130694,10 +130717,10 @@ index 871cdf9..401c607 100644
  
  	return error;
 diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c
-index ec52912..059504b 100644
+index ce46f1c..47ef3e1 100644
 --- a/net/sctp/ipv6.c
 +++ b/net/sctp/ipv6.c
-@@ -987,7 +987,7 @@ static const struct inet6_protocol sctpv6_protocol = {
+@@ -989,7 +989,7 @@ static const struct inet6_protocol sctpv6_protocol = {
  	.flags        = INET6_PROTO_NOPOLICY | INET6_PROTO_FINAL,
  };
  
@@ -130706,7 +130729,7 @@ index ec52912..059504b 100644
  	.sa_family	   = AF_INET6,
  	.sctp_xmit	   = sctp_v6_xmit,
  	.setsockopt	   = ipv6_setsockopt,
-@@ -1017,7 +1017,7 @@ static struct sctp_af sctp_af_inet6 = {
+@@ -1019,7 +1019,7 @@ static struct sctp_af sctp_af_inet6 = {
  #endif
  };
  
@@ -130715,7 +130738,7 @@ index ec52912..059504b 100644
  	.event_msgname = sctp_inet6_event_msgname,
  	.skb_msgname   = sctp_inet6_skb_msgname,
  	.af_supported  = sctp_inet6_af_supported,
-@@ -1044,7 +1044,7 @@ void sctp_v6_pf_init(void)
+@@ -1046,7 +1046,7 @@ void sctp_v6_pf_init(void)
  
  void sctp_v6_pf_exit(void)
  {
@@ -131083,7 +131106,7 @@ index 3e0fc51..289fe22 100644
  
  	table = kmemdup(sctp_net_table, sizeof(sctp_net_table), GFP_KERNEL);
 diff --git a/net/socket.c b/net/socket.c
-index d730ef9..5f02959 100644
+index 263b334..bcfd0d6 100644
 --- a/net/socket.c
 +++ b/net/socket.c
 @@ -89,6 +89,7 @@
@@ -135087,21 +135110,6 @@ index 175f9e4..3518d31 100644
  }
  
  #endif	/* modular kernel */
-diff --git a/sound/core/timer.c b/sound/core/timer.c
-index f24c9fc..b982d1b 100644
---- a/sound/core/timer.c
-+++ b/sound/core/timer.c
-@@ -1051,8 +1051,8 @@ static int snd_timer_s_start(struct snd_timer * timer)
- 		njiff += timer->sticks - priv->correction;
- 		priv->correction = 0;
- 	}
--	priv->last_expires = priv->tlist.expires = njiff;
--	add_timer(&priv->tlist);
-+	priv->last_expires = njiff;
-+	mod_timer(&priv->tlist, njiff);
- 	return 0;
- }
- 
 diff --git a/sound/drivers/mts64.c b/sound/drivers/mts64.c
 index 2a008a9..a1efb3f 100644
 --- a/sound/drivers/mts64.c
@@ -139780,10 +139788,10 @@ index 0000000..5598420
 +}
 diff --git a/tools/gcc/latent_entropy_plugin.c b/tools/gcc/latent_entropy_plugin.c
 new file mode 100644
-index 0000000..6fbcd39
+index 0000000..50d373c
 --- /dev/null
 +++ b/tools/gcc/latent_entropy_plugin.c
-@@ -0,0 +1,421 @@
+@@ -0,0 +1,422 @@
 +/*
 + * Copyright 2012-2016 by the PaX Team <pageexec@freemail.hu>
 + * Licensed under the GPL v2
@@ -139812,7 +139820,7 @@ index 0000000..6fbcd39
 +static GTY(()) tree latent_entropy_decl;
 +
 +static struct plugin_info latent_entropy_plugin_info = {
-+	.version	= "201602181345",
++	.version	= "201604022010",
 +	.help		= NULL
 +};
 +
@@ -139865,7 +139873,8 @@ index 0000000..6fbcd39
 +		switch (TREE_CODE(type)) {
 +		default:
 +			*no_add_attrs = true;
-+			error("variable %qD with %qE attribute must be an integer or a fixed length integer array type or a fixed sized structure with integer fields", *node, name);
++			error("variable %qD with %qE attribute must be an integer or a fixed length integer array type"
++				"or a fixed sized structure with integer fields", *node, name);
 +			break;
 +
 +		case RECORD_TYPE: {
@@ -139984,11 +139993,11 @@ index 0000000..6fbcd39
 +
 +static bool latent_entropy_gate(void)
 +{
-+	// don't bother with noreturn functions for now
++	/* don't bother with noreturn functions for now */
 +	if (TREE_THIS_VOLATILE(current_function_decl))
 +		return false;
 +
-+	// gcc-4.5 doesn't discover some trivial noreturn functions
++	/* gcc-4.5 doesn't discover some trivial noreturn functions */
 +	if (EDGE_COUNT(EXIT_BLOCK_PTR_FOR_FN(cfun)->preds) == 0)
 +		return false;
 +
@@ -140046,11 +140055,11 @@ index 0000000..6fbcd39
 +	gimple assign;
 +	tree addxorrol, temp;
 +
-+	// 1. create temporary copy of latent_entropy
++	/* 1. create temporary copy of latent_entropy */
 +	temp = create_tmp_var(unsigned_intDI_type_node, "temp_latent_entropy");
 +	add_referenced_var(temp);
 +
-+	// 2. read...
++	/* 2. read... */
 +	temp = make_ssa_name(temp, NULL);
 +	assign = gimple_build_assign(temp, latent_entropy_decl);
 +	SSA_NAME_DEF_STMT(temp) = assign;
@@ -140059,7 +140068,7 @@ index 0000000..6fbcd39
 +	gsi_insert_after(&gsi, assign, GSI_NEW_STMT);
 +	update_stmt(assign);
 +
-+	// 3. ...modify...
++	/* 3. ...modify... */
 +	addxorrol = fold_build2_loc(UNKNOWN_LOCATION, get_op(NULL), unsigned_intDI_type_node, temp, rhs);
 +	temp = make_ssa_name(SSA_NAME_VAR(temp), NULL);
 +	assign = gimple_build_assign(temp, addxorrol);
@@ -140067,7 +140076,7 @@ index 0000000..6fbcd39
 +	gsi_insert_after(&gsi, assign, GSI_NEW_STMT);
 +	update_stmt(assign);
 +
-+	// 4. ...write latent_entropy
++	/* 4. ...write latent_entropy */
 +	assign = gimple_build_assign(latent_entropy_decl, temp);
 +	gsi_insert_after(&gsi, assign, GSI_NEW_STMT);
 +	update_stmt(assign);
@@ -140102,12 +140111,12 @@ index 0000000..6fbcd39
 +
 +//fprintf(stderr, "latent_entropy: %s\n", IDENTIFIER_POINTER(DECL_NAME(current_function_decl)));
 +
-+	// 1. create local entropy variable
++	/* 1. create local entropy variable */
 +	local_entropy = create_tmp_var(unsigned_intDI_type_node, "local_entropy");
 +	add_referenced_var(local_entropy);
 +	mark_sym_for_renaming(local_entropy);
 +
-+	// 2. initialize local entropy variable
++	/* 2. initialize local entropy variable */
 +	gcc_assert(single_succ_p(ENTRY_BLOCK_PTR_FOR_FN(cfun)));
 +	bb = single_succ(ENTRY_BLOCK_PTR_FOR_FN(cfun));
 +	if (!single_pred_p(bb)) {
@@ -140125,14 +140134,14 @@ index 0000000..6fbcd39
 +//debug_bb(bb);
 +	bb = bb->next_bb;
 +
-+	// 3. instrument each BB with an operation on the local entropy variable
++	/* 3. instrument each BB with an operation on the local entropy variable */
 +	while (bb != EXIT_BLOCK_PTR_FOR_FN(cfun)) {
 +		perturb_local_entropy(bb, local_entropy);
 +//debug_bb(bb);
 +		bb = bb->next_bb;
 +	};
 +
-+	// 4. mix local entropy into the global entropy variable
++	/* 4. mix local entropy into the global entropy variable */
 +	gcc_assert(single_pred_p(EXIT_BLOCK_PTR_FOR_FN(cfun)));
 +	perturb_latent_entropy(single_pred(EXIT_BLOCK_PTR_FOR_FN(cfun)), local_entropy);
 +//debug_bb(single_pred(EXIT_BLOCK_PTR_FOR_FN(cfun)));
@@ -140148,7 +140157,7 @@ index 0000000..6fbcd39
 +	if (in_lto_p)
 +		return;
 +
-+	// extern volatile u64 latent_entropy
++	/* extern volatile u64 latent_entropy */
 +	gcc_assert(TYPE_PRECISION(long_long_unsigned_type_node) == 64);
 +	latent_entropy_type = build_qualified_type(long_long_unsigned_type_node, TYPE_QUALS(long_long_unsigned_type_node) | TYPE_QUAL_VOLATILE);
 +	latent_entropy_decl = build_decl(UNKNOWN_LOCATION, VAR_DECL, get_identifier("latent_entropy"), latent_entropy_type);
@@ -140180,7 +140189,7 @@ index 0000000..6fbcd39
 +	latent_entropy_pass_info.pass				= make_latent_entropy_pass();
 +	latent_entropy_pass_info.reference_pass_name		= "optimized";
 +	latent_entropy_pass_info.ref_pass_instance_number	= 1;
-+	latent_entropy_pass_info.pos_op 			= PASS_POS_INSERT_BEFORE;
++	latent_entropy_pass_info.pos_op				= PASS_POS_INSERT_BEFORE;
 +	static const struct ggc_root_tab gt_ggc_r_gt_latent_entropy[] = {
 +		{
 +			.base = &latent_entropy_decl,
diff --git a/4.4.7/4425_grsec_remove_EI_PAX.patch b/4.4.8/4425_grsec_remove_EI_PAX.patch
index 2a1aa6c..2a1aa6c 100644
--- a/4.4.7/4425_grsec_remove_EI_PAX.patch
+++ b/4.4.8/4425_grsec_remove_EI_PAX.patch
diff --git a/4.4.7/4427_force_XATTR_PAX_tmpfs.patch b/4.4.8/4427_force_XATTR_PAX_tmpfs.patch
index f6aea64..f6aea64 100644
--- a/4.4.7/4427_force_XATTR_PAX_tmpfs.patch
+++ b/4.4.8/4427_force_XATTR_PAX_tmpfs.patch
diff --git a/4.4.7/4430_grsec-remove-localversion-grsec.patch b/4.4.8/4430_grsec-remove-localversion-grsec.patch
index 31cf878..31cf878 100644
--- a/4.4.7/4430_grsec-remove-localversion-grsec.patch
+++ b/4.4.8/4430_grsec-remove-localversion-grsec.patch
diff --git a/4.4.7/4435_grsec-mute-warnings.patch b/4.4.8/4435_grsec-mute-warnings.patch
index b7564e4..b7564e4 100644
--- a/4.4.7/4435_grsec-mute-warnings.patch
+++ b/4.4.8/4435_grsec-mute-warnings.patch
diff --git a/4.4.7/4440_grsec-remove-protected-paths.patch b/4.4.8/4440_grsec-remove-protected-paths.patch
index 741546d..741546d 100644
--- a/4.4.7/4440_grsec-remove-protected-paths.patch
+++ b/4.4.8/4440_grsec-remove-protected-paths.patch
diff --git a/4.4.7/4450_grsec-kconfig-default-gids.patch b/4.4.8/4450_grsec-kconfig-default-gids.patch
index 79a866b..79a866b 100644
--- a/4.4.7/4450_grsec-kconfig-default-gids.patch
+++ b/4.4.8/4450_grsec-kconfig-default-gids.patch
diff --git a/4.4.7/4465_selinux-avc_audit-log-curr_ip.patch b/4.4.8/4465_selinux-avc_audit-log-curr_ip.patch
index 7248385..7248385 100644
--- a/4.4.7/4465_selinux-avc_audit-log-curr_ip.patch
+++ b/4.4.8/4465_selinux-avc_audit-log-curr_ip.patch
diff --git a/4.4.7/4470_disable-compat_vdso.patch b/4.4.8/4470_disable-compat_vdso.patch
index 281aad9..742df26 100644
--- a/4.4.7/4470_disable-compat_vdso.patch
+++ b/4.4.8/4470_disable-compat_vdso.patch
@@ -26,7 +26,7 @@ Closes bug: http://bugs.gentoo.org/show_bug.cgi?id=210138
 diff -urp a/arch/x86/Kconfig b/arch/x86/Kconfig
 --- a/arch/x86/Kconfig	2009-07-31 01:36:57.323857684 +0100
 +++ b/arch/x86/Kconfig	2009-07-31 01:51:39.395749681 +0100
-@@ -2009,29 +2009,8 @@
+@@ -2010,29 +2010,8 @@
  
  config COMPAT_VDSO
  	def_bool n
diff --git a/4.4.7/4475_emutramp_default_on.patch b/4.4.8/4475_emutramp_default_on.patch
index afd6019..afd6019 100644
--- a/4.4.7/4475_emutramp_default_on.patch
+++ b/4.4.8/4475_emutramp_default_on.patch