Merge branch 'android-4.14-phoenix' of https://github.com/PhoenixKernel/linux into lineage-21 Change-Id: I2ed4fbc934d7ae843dc203ba401d062bb90a37ac

commit: 9850488201f0b0bcbded1eca53750d2fd6accfbb [log] [tgz]
author: Tim Zimmermann <tim@linux4.de> Fri Jul 26 06:10:45 2024 +0200
committer: Tim Zimmermann <tim@linux4.de> Fri Jul 26 06:10:45 2024 +0200
tree: 0502cbe21786d425060a3d7afdacd4010651e9c4
parent: 47320233b0588873e131d00d1f7103a4b8311a92 [diff]
parent: 96bb20c54464e5d19c856d6dac93850132d2f0b7 [diff]
diff --git a/.elts/config.yaml b/.elts/config.yaml
index c9967f9..2bb1b02 100644
--- a/.elts/config.yaml
+++ b/.elts/config.yaml

@@ -1,5 +1,5 @@
 upstream_repo: git://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
 upstream_base: 4.19.304
 base: 4.14.336
-upstream_version: 4.19.312
-version: 4.14.345
+upstream_version: 4.19.316
+version: 4.14.349

diff --git a/.elts/meta/4.14.346.yaml b/.elts/meta/4.14.346.yaml
new file mode 100644
index 0000000..4b07b66
--- /dev/null
+++ b/.elts/meta/4.14.346.yaml

@@ -0,0 +1,250 @@
+e4f4588b3c0869ac39c79a84669bba92b50c2205:
+  title: 'batman-adv: Avoid infinite loop trying to resize local TT'
+  mainline: b1f532a3b1e6d2e5559c7ace49322922637a28aa
+  upstream: 04720ea2e6c64459a90ca28570ea78335eccd924
+fcab8bb833c33df8d7619a7c8367231f89577f70:
+  title: 'Bluetooth: Fix memory leak in hci_req_sync_complete()'
+  mainline: 45d355a926ab40f3ae7bc0b0a00cb0e3e8a5a810
+  upstream: 89a32741f4217856066c198a4a7267bcdd1edd67
+f67ff0072a70883c601e426a97085753f0ea4d23:
+  title: 'nouveau: fix function cast warning'
+  mainline: 185fdb4697cc9684a02f2fab0530ecdd0c2f15d4
+  upstream: 7b30bcac7f8bd82dcb9ee61d04926d286060a19f
+5f11455435b6294f64eb70b163dba59ba4239ea0:
+  title: 'geneve: fix header validation in geneve[6]_xmit_skb'
+  mainline: d8a6213d70accb403b82924a1c229e733433a5ef
+  upstream: 43be590456e1f3566054ce78ae2dbb68cbe1a536
+016fcada2b407eccf84eb18626994945ee51f78c:
+  title: 'ipv4/route: avoid unused-but-set-variable warning'
+  mainline: cf1b7201df59fb936f40f4a807433fe3f2ce310a
+  upstream: 0b48182b06f631781987c38be150d76b0f483923
+fee87d38713d366ea650216d07a3ac962d2b7f1c:
+  title: 'ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr'
+  mainline: 7633c4da919ad51164acbf1aa322cc1a3ead6129
+  upstream: b4b3b69a19016d4e7fbdbd1dbcc184915eb862e1
+bfa99d232f459aae39a87cb7bc7a28e772325080:
+  title: 'net/mlx5: Properly link new fs rules into the tree'
+  mainline: 7c6782ad4911cbee874e85630226ed389ff2e453
+  upstream: de0139719cdda82806a47580ca0df06fc85e0bd2
+39f0520cea332cf14036a8d90902938fa0f2475c:
+  title: 'tracing: hide unused ftrace_event_id_fops'
+  mainline: 5281ec83454d70d98b71f1836fb16512566c01cd
+  upstream: 8bfa576fe3c6df875a16f3eb27f7ec3fdd7f3168
+79a4cc09e1dd7c1d8d6d3f5906d1cdb04ce14d43:
+  title: 'vhost: Add smp_rmb() in vhost_vq_avail_empty()'
+  mainline: 22e1992cf7b034db5325660e98c41ca5afa5f519
+  upstream: 60bb8b451c6a9dc993c876e1f2abf188f9bc97c1
+f5e66cc721903d6adf93b7e9bb7fe06f6033dce2:
+  title: 'selftests: timers: Fix abs() warning in posix_timers test'
+  mainline: ed366de8ec89d4f960d66c85fc37d9de22f7bf6d
+  upstream: 3004d8f3f9ddb7c43b4af98203c8bb9a31bf8b51
+b1c1aa9e9a32ff9503c37d3a47e7eacc66cd809a:
+  title: 'x86/apic: Force native_apic_mem_read() to use the MOV instruction'
+  mainline: 5ce344beaca688f4cdea07045e0b8f03dc537e74
+  upstream: 38ecf8d8a293c9677a4659ede4810ecacb06dcda
+a3f786dc93abeaa911663b647c4a9a48b021e9c1:
+  title: 'selftests/ftrace: Limit length in subsystem-enable tests'
+  mainline: 1a4ea83a6e67f1415a1f17c1af5e9c814c882bb5
+  upstream: 0a8b2a0410e7fdcd899e58015d025004808559f6
+b13c030fd2b3a061d1659003a770b3986c24f7b5:
+  title: 'kprobes: Fix possible use-after-free issue on kprobe registration'
+  mainline: 325f3fb551f8cd672dbbfc4cf58b14f9ee3fc9e8
+  upstream: b5808d40093403334d939e2c3c417144d12a6f33
+638cc92651d52087ea7e22c3cee5dfaa472e835b:
+  title: 'Revert "tracing/trigger: Fix to return error if failed to alloc snapshot"'
+  mainline: 0958b33ef5a04ed91f61cef4760ac412080c4e08
+  upstream: 34925d01baf3ee62ab21c21efd9e2c44c24c004a
+cf9d94023df9b8d5ee9885351ac7b0bb280a39da:
+  title: 'netfilter: nf_tables: __nft_expr_type_get() selects specific family type'
+  mainline: 9cff126f73a7025bcb0883189b2bed90010a57d4
+  upstream: 97f097a8091261ffa07c8889550c4026e59b6c14
+59c0769283b97b4a2e14c2846703d5ef9a10c86e:
+  title: 'netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()'
+  mainline: f969eb84ce482331a991079ab7a5c4dc3b7f89bf
+  upstream: 939109c0a8e2a006a6cc8209e262d25065f4403a
+eaa8c23a83b5a719ac9bc795481595bbfc02fc18:
+  title: 'tun: limit printing rate when illegal packet received by tun dev'
+  mainline: f8bbc07ac535593139c875ffa19af924b1084540
+  upstream: 68459b8e3ee554ce71878af9eb69659b9462c588
+cfe1ce127436f4025381610721ccca95be5661eb:
+  title: 'drm: nv04: Fix out of bounds access'
+  mainline: cf92bb778eda7830e79452c6917efa8474a30c1e
+  upstream: c2b97f26f081ceec3298151481687071075a25cb
+40aa14ae1d3360c716476ef5bf841e83b4044a74:
+  title: 'comedi: vmk80xx: fix incomplete endpoint checking'
+  mainline: d1718530e3f640b7d5f0050e725216eab57a85d8
+  upstream: 3a63ae0348d990e137cca04eced5b08379969ea9
+e9606f845b0e6e58ea7f0a1cb83f3ca8b6c22c27:
+  title: 'serial/pmac_zilog: Remove flawed mitigation for rx irq flood'
+  mainline: 1be3226445362bfbf461c92a5bcdb1723f2e4907
+  upstream: 69a02273e288011b521ee7c1f3ab2c23fda633ce
+32343abd61668292ae454465c0b9f5afb5560d0d:
+  title: 'USB: serial: option: add Fibocom FM135-GL variants'
+  mainline: 356952b13af5b2c338df1e06889fd1b5e12cbbf4
+  upstream: 9a5402ed97bc701eef3d1f04cad469604aaae0ad
+2f8adbc57c1c78ec6d9d12bf3cd5924e1d11b98b:
+  title: 'USB: serial: option: add support for Fibocom FM650/FG650'
+  mainline: fb1f4584b1215e8c209f6b3a4028ed8351a0e961
+  upstream: 5809919a53225cb041d171661af398de05fd5499
+7a6940c22f654a3953351f2e6d4f990a18293284:
+  title: 'USB: serial: option: add Lonsung U8300/U9300 product'
+  mainline: cf16ffa17c398434a77b8a373e69287c95b60de2
+  upstream: 6efc183ddca84d2d67db97243897c9c01dae3941
+1ce24d37d83eb52cd418553e5e364234d2eb301c:
+  title: 'USB: serial: option: support Quectel EM060K sub-models'
+  mainline: c840244aba7ad2b83ed904378b36bd6aef25511c
+  upstream: 44af06ae8bc16e7b325029dc1da51c68169d395d
+2193ac5e795e5513c453c321c8eeb5a0a5e63a5c:
+  title: 'USB: serial: option: add Rolling RW101-GL and RW135-GL support'
+  mainline: 311f97a4c7c22a01f8897bddf00428dfd0668e79
+  upstream: 19301bdc1d265877e47bba58cb58738e51efb120
+5f912f0cb02da4f3c48151fbaa4490f695556cc5:
+  title: 'USB: serial: option: add Telit FN920C04 rmnet compositions'
+  mainline: 582ee2f9d268d302595db3e36b985e5cbb93284d
+  upstream: 36c159eded196bbca23f0f344202815528545d2d
+519eedb563740160edd7c1a150b730c311d2a1f5:
+  title: 'Revert "usb: cdc-wdm: close race between read and workqueue"'
+  mainline: 1607830dadeefc407e4956336d9fcd9e9defd810
+  upstream: 347cca11bb78b9f3c29b45a9c52e70258bd008bf
+ccbc9d463cf6f7c018cb20bb05bc98483c63eaaa:
+  title: 'usb: dwc2: host: Fix dereference issue in DDMA completion flow.'
+  mainline: eed04fa96c48790c1cce73c8a248e9d460b088f8
+  upstream: 257d313e37d66c3bcc87197fb5b8549129c45dfe
+68e8ffca8bcb4619d8a20a711cf51a3464530790:
+  title: 'speakup: Avoid crash on very long word'
+  mainline: c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1
+  upstream: 756c5cb7c09e537b87b5d3acafcb101b2ccf394f
+8005cde96bd7db2593c25a75b9a2ccb18087cf8e:
+  title: 'fs: sysfs: Fix reference leak in sysfs_break_active_protection()'
+  mainline: a90bca2228c0646fc29a72689d308e5fe03e6d78
+  upstream: f28bba37fe244889b81bb5c508d3f6e5c6e342c5
+66881703734d16aba33608bf449cc2586b6a51fc:
+  title: 'nilfs2: fix OOB in nilfs_set_de_type'
+  mainline: c4a7dc9523b59b3e73fd522c73e95e072f876b16
+  upstream: 054f29e9ca05be3906544c5f2a2c7321c30a4243
+f2b908139433610ec7b0803abd46fcf0b3b43fb4:
+  title: 'arm64: dts: rockchip: fix alphabetical ordering RK3399 puma'
+  mainline: f0abb4b2c7acf3c3e4130dc3f54cd90cf2ae62bc
+  upstream: e0fbabb4865a9f2eebfa8688765fd6fd76185bba
+655536c706fd7a9534ac7aec8a63a178d62fe415:
+  title: 'arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for RK3399 Puma'
+  mainline: 945a7c8570916650a415757d15d83e0fa856a686
+  upstream: 8ada42c66029ee8ec7918b2a5bb2feb9dbe461f1
+ed92aae0da0019d4e7db47d37501752a7affbaa3:
+  title: 'ARC: [plat-hsdk]: Remove misplaced interrupt-cells property'
+  mainline: 61231eb8113ce47991f35024f9c20810b37996bf
+  upstream: 60874cc9e4d57c357266ad8b1b1b3b960be8af77
+61c51e051a59e94a3c62f81c01f949e94958559e:
+  title: 'vxlan: drop packets from invalid src-address'
+  mainline: f58f45c1e5b92975e91754f5407250085a6ae7cf
+  upstream: 961711809db16bcf24853bfb82653d1b1b37f3bf
+8a7045c992202504ab6a4f059f662f83463ace78:
+  title: 'mlxsw: core: Unregister EMAD trap using FORWARD action'
+  mainline: 976c44af48141cd8595601c0af2a19a43c5b228b
+  upstream: 4235cc4d207b535969eef8f3e610f9caafac7295
+52ada5a71f0a8be64f0ddaa20583efcf6e8e0411:
+  title: 'NFC: trf7970a: disable all regulators on removal'
+  mainline: 6bea4f03c6a4e973ef369e15aac88f37981db49e
+  upstream: 33ba7baa3cba4b49190635ff883770dd2ae5a3e5
+49adc83f7ee5de31ecf4715cf3c1ee131b957815:
+  title: 'net: usb: ax88179_178a: stop lying about skb->truesize'
+  mainline: 4ce62d5b2f7aecd4900e7d6115588ad7f9acccca
+  upstream: 571d30b27680591a576c29782617d95820e765ee
+a4fb866fbb951f1c5908c99221021a6e923ee72e:
+  title: 'net: gtp: Fix Use-After-Free in gtp_dellink'
+  mainline: f2a904107ee2b647bb7794a1a82b67740d7c8a64
+  upstream: 07b20d0a3dc13fb1adff10b60021a4924498da58
+7e7531a6b522c9ad6e3967215e54d7724159dd7f:
+  title: 'docs: segmentation-offloads.txt: add SCTP info'
+19b468b254ac2fd06d13219073e6395e3b474567:
+  title: 'bpf: fix bpf_skb_adjust_net/bpf_skb_proto_xlat to deal with gso sctp skbs'
+02cac8715a217aa9d6e76a4dca2e0f2d8242f832:
+  title: 'ipvs: Fix checksumming on GSO of SCTP packets'
+  mainline: e10d3ba4d434ed172914617ed8d74bd411421193
+  upstream: 740a06078ac58840494934ace6055eb879f267fb
+bca56f5107b108ae5c63b5478b0ebaeab77cf5ac:
+  title: 'i40e: Do not use WQ_MEM_RECLAIM flag for workqueue'
+  mainline: 2cc7d150550cc981aceedf008f5459193282425c
+  upstream: 09b54d29f05129b092f7c793a70b689ffb3c7b2c
+c112e92e7e9009b25113d00c387517474d00350f:
+  title: 'serial: core: Provide port lock wrappers'
+  mainline: b0af4bcb49464c221ad5f95d40f2b1b252ceedcc
+  upstream: dcc8ed283f841e217ad23a65453f7b8c6068d6c5
+7b5287213ee5429e42b281d104e07e08d50c2d9a:
+  title: 'serial: mxs-auart: add spinlock around changing cts state'
+  mainline: 54c4ec5f8c471b7c1137a1f769648549c423c026
+  upstream: 56434e295bd446142025913bfdf1587f5e1970ad
+06da784dbd29c1e42dd9ced075d829704914864b:
+  title: 'drm/amdgpu: restrict bo mapping within gpu address limits'
+  mainline: 8b80d74bdb2285d3022b349c8451eb16535f7906
+  upstream: 605134e35a72a8cf1ff1cf433664a2b4a4924488
+5dd0e09eeab9c87b6a91fcf9ef0b10295d68ff2d:
+  title: 'amdgpu: validate offset_in_bo of drm_amdgpu_gem_va'
+  mainline: 9f0bcf49e9895cb005d78b33a5eebfa11711b425
+  upstream: 82aace80cfaab778245bd2f9e31b67953725e4d0
+3e99e112aa1d6c9af57da0446cef785190e95634:
+  title: 'drm/amdgpu: validate the parameters of bo mapping operations more clearly'
+  mainline: 6fef2d4c00b5b8561ad68dd2b68173f5c6af1e75
+  upstream: d4da6b084f1c5625937d49bb6722c5b4aef11b8d
+a039a95bde00995c63312c1870c870187dcaa60f:
+  title: 'Revert "crypto: api - Disallow identical driver names"'
+  mainline: 27016f75f5ed47e2d8e0ca75a8ff1f40bc1a5e27
+  upstream: 69dc8fc8307640b717b37056549d88a664273206
+e3b3f139e8a216c0dc590c0349a0824c1918ed86:
+  title: 'tracing: Show size of requested perf buffer'
+  mainline: a90afe8d020da9298c98fddb19b7a6372e2feb45
+  upstream: 78b92d50fe6ab79d536f4b12c5bde15f2751414d
+edc56d2275828b9e3a8258681c30bb666cfdf8f7:
+  title: 'tracing: Increase PERF_MAX_TRACE_SIZE to handle Sentinel1 and docker together'
+  mainline: e531e90b5ab0f7ce5ff298e165214c1aec6ed187
+  upstream: c8d5402dcd1834747bb3dbd9b6fe51defd3d636b
+75613ba0ee43c74bb35bb8f80961e8e0ea496f9f:
+  title: 'Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old()'
+  mainline: 9bf4e919ccad613b3596eebf1ff37b05b6405307
+  upstream: 92d26492b4acdc05a3ad1f7795b6cae91292b00d
+cccd878ed43e046f7dc286fb677079dd801d2626:
+  title: 'btrfs: fix information leak in btrfs_ioctl_logical_to_ino()'
+  mainline: 2f7ef5bb4a2f3e481ef05fab946edb97c84f67cf
+  upstream: 689efe22e9b5b7d9d523119a9a5c3c17107a0772
+336db5bbf15c2e86555a7b369f8faa7b3d4abe0f:
+  title: 'arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 Puma'
+  mainline: 0ac417b8f124427c90ec8c2ef4f632b821d924cc
+  upstream: 6d5692510d683ab57f81f82fd3d5282e33dd416f
+94db4962aa554ced828a4fbee5e96941a3fb2e7f:
+  title: 'irqchip/gic-v3-its: Prevent double free on error'
+  mainline: c26591afd33adce296c022e3480dea4282b7ef91
+  upstream: f5417ff561b8ac9a7e53c747b8627a7ab58378ae
+98b91fb5ede664960c3890efcd2f952affb11dee:
+  title: 'net: b44: set pause params only when interface is up'
+  mainline: e3eb7dd47bd4806f00e104eb6da092c435f9fb21
+  upstream: 1aeede3a0217741120725c4c9cebf039c6fff7ef
+9485c0dda576f58a9579b81e4d10b72bebda58de:
+  title: 'stackdepot: respect __GFP_NOLOCKDEP allocation flag'
+  mainline: 6fe60465e1d53ea321ee909be26d97529e8f746c
+  upstream: 79b25b1a58d0a6b53dfd685bca8a1984c86710dd
+cd3a5b7416bf89cb599e05f6e81e519211413cba:
+  title: 'mtd: diskonchip: work around ubsan link failure'
+  mainline: 21c9fb611c25d5cd038f6fe485232e7884bb0b3d
+  upstream: 153adb5d7878d18e2b9be173996034f858fbce8e
+063e3bb968e0b88dfd0eca06c56d3eb95b43e40b:
+  title: 'idma64: Don''t try to serve interrupts when device is powered off'
+  mainline: 9140ce47872bfd89fca888c2f992faa51d20c2bc
+  upstream: ffe3f362de3479f5d75a97a7004a279a650ee7cd
+6feb1d6f972701a31a9e48c70c9fe13f96f00ed4:
+  title: 'i2c: add param sanity check to i2c_transfer()'
+c8c86b3d8008e24fba2c5956a2849ed47c9ce817:
+  title: 'i2c: smbus: fix NULL function pointer dereference'
+  mainline: 91811a31b68d3765b3065f4bb6d7d6d84a7cfc9f
+  upstream: 40f1d79f07b49c8a64a861706e5163f2db4bd95d
+674f9950629e4a2071b81cd12e58e5e190754121:
+  title: 'HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up'
+  mainline: 9c0f59e47a90c54d0153f8ddc0f80d7a36207d0e
+  upstream: 21bfca822cfc1e71796124e93b46e0d9fa584401
+67c9c69cedb11331c684e306485b2767c9ed0ffc:
+  title: 'serial: core: fix kernel-doc for uart_port_unlock_irqrestore()'
+  mainline: 29bff582b74ed0bdb7e6986482ad9e6799ea4d2f
+  upstream: 6e5937b23a13ce6bbe8bf17319efa34598f1650a
+7abf8b09720539a0c4f2561eff4002278e8b27c0:
+  title: 'net: fix unused variable warning in do_tcp_setsockopt()'
+7d8091b0ea0bbeab05cfeeacc8251c73a298f4ee:
+  title: Simplify major/minor non-dynamic logic

diff --git a/.elts/meta/4.14.347.yaml b/.elts/meta/4.14.347.yaml
new file mode 100644
index 0000000..dd190ba
--- /dev/null
+++ b/.elts/meta/4.14.347.yaml

@@ -0,0 +1,226 @@
+7a2c5465ee29605fd2c0c2a6d22f8e9787cc93b4:
+  title: 'dmaengine: pl330: issue_pending waits until WFP state'
+  mainline: 22a9d9585812440211b0b34a6bc02ade62314be4
+  upstream: e588495c211a58a593c0b35bde105e50a80f1587
+1be5dfb4ae2059ec9c905e05c28525082863a716:
+  title: 'dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state"'
+  mainline: afc89870ea677bd5a44516eb981f7a259b74280c
+  upstream: 15097ae79c7231684158d7fd6306853e7042979d
+de3ac5d3e761015a4e4ad472aac54347deae0b60:
+  title: 'wifi: nl80211: don''t free NULL coalescing rule'
+  mainline: 801ea33ae82d6a9d954074fbcf8ea9d18f1543a7
+  upstream: 327382dc0f16b268950b96e0052595efd80f7b0a
+52cab27f08d73efcb58ca69bb59475c2809abb21:
+  title: 'net: slightly optimize eth_type_trans'
+  mainline: 45cf7959c30402d7c4ea43568a6f1bab0ba6ca63
+  upstream: a82fcda87f9ba6ca65d8c0020de72237d5462766
+269a33dfbc3eaaf920f438cc933fce8ca1d6293e:
+  title: 'net: create netdev->dev_addr assignment helpers'
+  mainline: 48eab831ae8b9f7002a533fa4235eed63ea1f1a3
+36bdbf757991cf19077cac99ee29f44e4164ffcf:
+  title: 'ethernet: add a helper for assigning port addresses'
+  mainline: e80094a473eefad9d856ce3ab0d7afdbb64800c4
+  upstream: 51fcea1b7c52abc3ff5af354e199731582a34ebf
+ba10f69d1e654aff90e015383bfd641dc8556e5a:
+  title: 'ethernet: Add helper for assigning packet type when dest address does not match device address'
+  mainline: 6e159fd653d7ebf6290358e0330a0cb8a75cf73b
+  upstream: 3d63a6c77b51c1a7cef2987a7f70ec9d91b04d95
+bdf517d3858a65b97d7f0d7df1acbc6ba5766bfd:
+  title: 'pinctrl: core: delete incorrect free in pinctrl_enable()'
+  mainline: 5038a66dad0199de60e5671603ea6623eb9e5c79
+  upstream: 735f4c6b6771eafe336404c157ca683ad72a040d
+525562e5df5cc30f7d0e86974730550a7753941f:
+  title: 'power: rt9455: hide unused rt9455_boost_voltage_values'
+  mainline: 452d8950db3e839aba1bb13bc5378f4bac11fa04
+  upstream: c8d8b7f650b5bfddd9ac8b39fa3455716ddcbaff
+b290fe8f786a5c701623bc3a4522f728ff6511ad:
+  title: 'pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()'
+  mainline: a0cedbcc8852d6c77b00634b81e41f17f29d9404
+  upstream: 06780473cb8a858d1d6cab2673e021b072a852d1
+6e4174bf8ee5e72fa57859378ac90172b5a4ee88:
+  title: 'bna: ensure the copied buf is NUL terminated'
+  mainline: 8c34096c7fdf272fd4c0c37fe411cd2e3ed0ee9f
+  upstream: bd502ba81cd1d515deddad7dbc6b812b14b97147
+945365c6ab9e246eaa46aa79d0e090c43e983191:
+  title: 'nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().'
+  mainline: 4b911a9690d72641879ea6d13cce1de31d346d79
+  upstream: a7c2c3c1caabcb4a3d6c47284c397507aaf54fe9
+f3cbc47fef3fd6e96761cb7986e48698353fc74c:
+  title: 'net l2tp: drop flow hash on forward'
+  mainline: 42f853b42899d9b445763b55c3c8adc72be0f0e1
+  upstream: b6e4b93edc0100a88d7d4f3140bba25a529c5166
+f2c7931f8a50c6da3a1f5ec513b2f8b3c52919e0:
+  title: 'net: dsa: mv88e6xxx: Add number of MACs in the ATU'
+  mainline: d9ea56206c4df77175321874544eb4ca48c0bac8
+  upstream: 4b1f3253bfa5a709d0c0003e3272c5a284a36771
+18b5e4742fea56bceaac0d8ad276711a0f7c8062:
+  title: 'net: dsa: mv88e6xxx: Fix name of switch 88E6141'
+8bba49c34aecc6bed2a9a282710963f4af19460d:
+  title: 'net: dsa: mv88e6xxx: Fix number of databases for 88E6141 / 88E6341'
+  mainline: b9a61c20179fda7bdfe2c1210aa72451991ab81a
+  upstream: 0c27eb63bd9feaf34ec3049873c1b1889b569a85
+74703c09c98e094af2885ff2ff052d66b2731fe4:
+  title: 'net: bridge: fix multicast-to-unicast with fraglist GSO'
+  mainline: 59c878cbcdd80ed39315573b3511d0acfd3501b5
+  upstream: 01386957ca757e31fb66caceb303f71f9e577b83
+f6d438b693a934d982288ee2eee89e9e30bb8a18:
+  title: 'tipc: fix a possible memleak in tipc_buf_append'
+  mainline: 97bf6f81b29a8efaf5d0983251a7450e5794370d
+  upstream: 01cd1b7b685751ee422d00d050292a3d277652d6
+17f4f66e30c9de03ade16f70122bbab83424be13:
+  title: 'scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic'
+  mainline: bb011631435c705cdeddca68d5c85fd40a4320f9
+  upstream: b241595d3d09d24c60cd9e594dc81fa1b0f6b280
+4f09d935a3265126515304a5496b7dee43998e85:
+  title: 'wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc'
+  mainline: 774f8841f55d7ac4044c79812691649da203584a
+  upstream: fd10730c905db4e7984109f1342d9aa43ee63c8f
+b6f6bed5092bdbc36b99ee09a6b07a00bf0f6012:
+  title: 'net: mark racy access on sk->sk_rcvbuf'
+  mainline: c2deb2e971f5d9aca941ef13ee05566979e337a4
+  upstream: 9e7538cb8131946817218f793ceb334c63cfcdb8
+e5f7fdcb7c0455dc9dd4d9de1729261dc7f215a2:
+  title: 'scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload'
+  mainline: c214ed2a4dda35b308b0b28eed804d7ae66401f9
+  upstream: 468f3e3c15076338367b0945b041105b67cf31e3
+7a1f974c7345abc254eaad100b67e2093c68fcba:
+  title: 'ALSA: line6: Zero-initialize message buffers'
+  mainline: c4e51e424e2c772ce1836912a8b0b87cd61bc9d5
+  upstream: c957c9432f957007fef152a3efc9aabe4337ef4a
+c4cefd5df74348cc94d3b934e448c9dd5ab64416:
+  title: 'net: bcmgenet: Reset RBUF on first open'
+  mainline: 0a6380cb4c6b5c1d6dad226ba3130f9090f0ccea
+  upstream: 510e7b18fdad4b55849d7a73b8ff2c3e8ad2f7af
+532051585e477a5ef3e62ad8f006288b18cd5727:
+  title: 'ata: sata_gemini: Check clk_enable() result'
+  mainline: e85006ae7430aef780cc4f0849692e266a102ec0
+  upstream: 47325095299e50d274da30525f7b41d638c22a8e
+3b969e6e4d466989104ad6d6f95296b9e9f37d54:
+  title: 'firewire: ohci: mask bus reset interrupts between ISR and bottom half'
+  mainline: 752e3c53de0fa3b7d817a83050b6699b8e9c6ec9
+  upstream: b3948c69d60279fce5b2eeda92a07d66296c8130
+5c0a4f90868a9e879228c6ed8d058ee8f1c70213:
+  title: 'tools/power turbostat: Fix added raw MSR output'
+  mainline: e5f4e68eed85fa8495d78cd966eecc2b27bb9e53
+  upstream: e13c8b6b8675c7848e54145b77e7c0d2c52a3422
+096fb209120164d95c7046009ee24600fdb0eb43:
+  title: 'tools/power turbostat: Fix Bzy_MHz documentation typo'
+  mainline: 0b13410b52c4636aacb6964a4253a797c0fa0d16
+  upstream: 5225091f94af36e1dddc5bc71abd317dcac4847e
+89b804f254ae731be5f86e671b3ac126f2f452a8:
+  title: 'scsi: target: Fix SELinux error when systemd-modules loads the target module'
+  mainline: 97a54ef596c3fd24ec2b227ba8aaf2cf5415e779
+  upstream: 2c9cb7a564bdd454df694b8e08eecbf925199eac
+3fc20d8d310b70b29dca23bf8733cd18d08e1ec4:
+  title: 'selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior'
+  mainline: 076361362122a6d8a4c45f172ced5576b2d4a50d
+  upstream: 968908c39d985bc636e069769772155f66586664
+99b4d7e3ea1c9056962bafc600bbed0ba6035e91:
+  title: 'fs/9p: only translate RWX permissions for plain 9P2000'
+  mainline: cd25e15e57e68a6b18dc9323047fe9c68b99290b
+  upstream: e90bc596a74bb905e0a45bf346038c3f9d1e868d
+83f6d606db87a09db262083d62866aa1eb8309e2:
+  title: 'fs/9p: translate O_TRUNC into OTRUNC'
+  mainline: 87de39e70503e04ddb58965520b15eb9efa7eef3
+  upstream: 0ce2676013818e62b18504d39211b65d8b54bc24
+8b2c6a57cf512e211fdeb0bd08938647547b7639:
+  title: '9p: explicitly deny setlease attempts'
+  mainline: 7a84602297d36617dbdadeba55a2567031e5165b
+  upstream: 1b90be6698e8d67a2edb8d260e9654d539e7cb51
+48c6238101a2be011c58503b7fbe9c6ded8afac3:
+  title: 'gpio: wcove: Use -ENOTSUPP consistently'
+  mainline: 0c3b532ad3fbf82884a2e7e83e37c7dcdd4d1d99
+  upstream: a0c966b4d7fe7d701d31aebbd3cc32d1e7ee266e
+d7cb3d68d0dd185840ff94aca7e798229de8d0dc:
+  title: 'gpio: crystalcove: Use -ENOTSUPP consistently'
+  mainline: ace0ebe5c98d66889f19e0f30e2518d0c58d0e04
+  upstream: e4c744a9c1da845faecba1532ba70154630b94ed
+7fdb44bf63d8d7e30340c10846aeaeeeb9530ba5:
+  title: 'fs/9p: drop inodes immediately on non-.L too'
+  mainline: 7fd524b9bd1be210fe79035800f4bd78a41b349f
+  upstream: cc3d6fbd645449298d03d96006e3e9bcae00bc1a
+4d26ff1d302a1cfb1a6ec136b4e88b18605a266a:
+  title: 'net:usb:qmi_wwan: support Rolling modules'
+  mainline: d362046021ea122309da8c8e0b6850c792ca97b5
+  upstream: a1a3346ef3e9a7fa0954903355bc4366e72da9a3
+22dc505fb63ec90f4f89fd3f6b58cad1c68e059c:
+  title: 'tcp: remove redundant check on tskb'
+  mainline: d1edc085559744fbda7a55e97eeae8bd6135a11b
+  upstream: 6f7082e284ec3fa32694e5704da510194229ef12
+426be5e0e2e245b5f7aa5c8b735f7350e41e3ba7:
+  title: 'tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets'
+  mainline: 94062790aedb505bdda209b10bea47b294d6394f
+  upstream: 34e41a031fd7523bf1cd00a2adca2370aebea270
+8f75b925397684e4842eed1ae96fa57c441bd283:
+  title: 'Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout'
+  mainline: 483bc08181827fc475643272ffb69c533007e546
+  upstream: 1b33d55fb7355e27f8c82cd4ecd560f162469249
+db1b3cb8b825fb48230e12d00652500c9fa29e2e:
+  title: 'Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout'
+  mainline: adf0398cee86643b8eacde95f17d073d022f782c
+  upstream: e137e2ba96e51902dc2878131823a96bf8e638ae
+5301db4a62df009136d5e53d6c9daf4d35a0049d:
+  title: 'rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation'
+  mainline: 1aec77b2bb2ed1db0f5efc61c4c1ca3813307489
+  upstream: 8ac69ff2d0d5be9734c4402de932aa3dc8549c1a
+ada1bc85dc1c41f4d40845ea46ef94553db632a3:
+  title: 'phonet: fix rtm_phonet_notify() skb allocation'
+  mainline: d8cac8568618dcb8a51af3db1103e8d4cc4aeea7
+  upstream: ec1f71c05caeba0f814df77e0f511d8b4618623a
+b497c0ef92d390bcb8fa79846d2a02509e17d071:
+  title: 'net: bridge: use DEV_STATS_INC()'
+  mainline: 44bdb313da57322c9b3c108eb66981c6ec6509f4
+71ccd14baaa895a643aac754b686592608eda7da:
+  title: 'net: bridge: fix corrupted ethernet header on multicast-to-unicast'
+  mainline: 86b29d830ad69eecff25b22dc96c14c6573718e6
+  upstream: e96b4e3e5e2d03e72d251aa46853cf609f4f8960
+3868d9c979084977fa44b477b1daed205ca5224b:
+  title: 'net/ipv6: Refactor fib6_rule_action'
+fd6963c88a807bea816c6b6eed4896715ac5c552:
+  title: 'ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()'
+  mainline: d101291b2681e5ab938554e3e323f7a7ee33e3aa
+  upstream: 4a5a573387da6a6b23a4cc62147453ff1bc32afa
+40d8d26e718b40b76be38e01998d92e982e6fe36:
+  title: 'af_unix: Do not use atomic ops for unix_sk(sk)->inflight.'
+  mainline: 97af84a6bba2ab2b9c704c08e67de3b5ea551bb2
+  upstream: c8a2b1f7208b0ea0a4ad4355e0510d84f508a9ff
+e987e6352bc9cbc7d925c7110aedd4c254bce439:
+  title: 'af_unix: Fix garbage collector racing against connect()'
+  mainline: 47d8ac011fe1c9251070e1bd64cb10b48193ec51
+  upstream: a36ae0ec2353015f0f6762e59f4c2dbc0c906423
+3e595e41a1d31b9dad72dc959b6e85bae59c62a9:
+  title: 'firewire: nosy: ensure user_length is taken into account when fetching packet contents'
+  mainline: 38762a0763c10c24a4915feee722d7aa6e73eb98
+  upstream: 67f34f093c0f7bf33f5b4ae64d3d695a3b978285
+8ed9c2744b2925a670e1cacb329cf26029bad6b0:
+  title: 'usb: gadget: composite: fix OS descriptors w_value logic'
+  mainline: ec6ce7075ef879b91a8710829016005dc8170f17
+  upstream: c037e0ebc0cabb1906203ca3322ad9dc7eeddc8e
+9c25fd19c4e377b891db0435e4ebcb264714bde7:
+  title: 'usb: gadget: f_fs: Fix a race condition when processing setup packets.'
+  mainline: 0aea736ddb877b93f6d2dd8cf439840d6b4970a9
+  upstream: af3f22e07de457965352950d1a535edbf84444f0
+5fc482f94740a21c8101f0f7f01d7b42a895efc1:
+  title: 'tipc: fix UAF in error path'
+  mainline: 080cbb890286cd794f1ee788bbc5463e2deb7c2b
+  upstream: e19ec8ab0e25bc4803d7cc91c84e84532e2781bd
+8aa195d14b00d30a14b28f066a0c0ca21d1b3bae:
+  title: 'dyndbg: fix old BUG_ON in >control parser'
+  mainline: 00e7d3bea2ce7dac7bee1cf501fb071fd0ea8f6c
+  upstream: 3c718bddddca9cbef177ac475b94c5c91147fb38
+9804a24b7ac34a1ce3cbb9914940853a59997055:
+  title: 'drm/vmwgfx: Fix invalid reads in fence signaled events'
+  mainline: a37ef7613c00f2d72c8fc08bd83fb6cc76926c8c
+  upstream: 2f527e3efd37c7c5e85e8aa86308856b619fa59f
+cc156d9fc5bcab07f124ade0fb47174c7c1efb65:
+  title: 'net: fix out-of-bounds access in ops_init'
+  mainline: a26ff37e624d12e28077e5b24d2b264f62764ad6
+  upstream: 3cdc34d76c4f777579e28ad373979d36c030cfd3
+bade56293ac77e3f0c05d39b9719cf42e75a7077:
+  title: 'af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc().'
+  mainline: 1971d13ffa84a551d29a81fdf5b5ec5be166ac83
+  upstream: b29dcdd0582c00cd6ee0bd7c958d3639aa9db27f
+7410069cb98b2623f694bc855a997f3836900f56:
+  title: 'RDS: IB: Use DEFINE_PER_CPU_SHARED_ALIGNED for rds_ib_stats'
+4a89fa4873851d33bed1eee79f5009cef636e526:
+  title: 'rds: Fix build regression.'

diff --git a/.elts/meta/4.14.348.yaml b/.elts/meta/4.14.348.yaml
new file mode 100644
index 0000000..53eae09c
--- /dev/null
+++ b/.elts/meta/4.14.348.yaml

@@ -0,0 +1,18 @@
+ebc7ed8686acc9ab4fc68b9c9ad601b094c37a9c:
+  title: 'Revert "selftests: mm: fix map_hugetlb failure on 64K page size systems"'
+dcd987848b62bdf1bbc0a44b0af4d42c364e8d1e:
+  title: 'dm: limit the number of targets and parameter size area'
+  mainline: bd504bcfec41a503b32054da5472904b404341a4
+  upstream: 1ddc0c3f4996c4ca1216ede1fa7699a803204590
+30741c3b9f4e080264a6b52a95391902a9b71108:
+  title: 'btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks()'
+  mainline: 9af503d91298c3f2945e73703f0e00995be08c30
+  upstream: 6ffbcb3704046668ede6551b236960597d71a005
+1d8ba83736394d3167acb51f49623624d74ac1e0:
+  title: 'serial: kgdboc: Fix NMI-safety problems from keyboard reset code'
+  mainline: b2aba15ad6f908d1a620fd97f6af5620c3639742
+  upstream: 512b9385201c7dec1b8d490711e9b578ae50525e
+fb341e5794b05a39dfaa8f073dc5a23072b09992:
+  title: 'docs: kernel_include.py: Cope with docutils 0.21'
+  mainline: d43ddd5c91802a46354fa4c4381416ef760676e2
+  upstream: 4b431a786f0ca86614b2d00e17b313956d7ef035

diff --git a/.elts/meta/4.14.349.yaml b/.elts/meta/4.14.349.yaml
new file mode 100644
index 0000000..1266db8
--- /dev/null
+++ b/.elts/meta/4.14.349.yaml

@@ -0,0 +1,613 @@
+8bb6ee62c33b1f281b98b2dd19f1d7249a1ee5ab:
+  title: 'speakup: Fix sizeof() vs ARRAY_SIZE() bug'
+  mainline: 008ab3c53bc4f0b2f20013c8f6c204a3203d0b8b
+  upstream: 42f0a3f67158ed6b2908d2b9ffbf7e96d23fd358
+a43f1f02b3a93c9a2da8ea92e4d6509d0a61ebd8:
+  title: 'ring-buffer: Fix a race between readers and resize checks'
+  mainline: c2274b908db05529980ec056359fae916939fdaa
+  upstream: b50932ea673b5a089a4bb570a8a868d95c72854e
+39d470c1d65655756f7bc56eef30977466000040:
+  title: 'nilfs2: fix unexpected freezing of nilfs_segctor_sync()'
+  mainline: 936184eadd82906992ff1f5ab3aada70cce44cee
+  upstream: 072980bc50626c4557694ce54e3f6f2bde02b6e0
+6696ef522ef729e48bb88e624f4b450cc48d0008:
+  title: 'nilfs2: fix potential hang in nilfs_detach_log_writer()'
+  mainline: eb85dace897c5986bc2f36b3c783c6abb8a4292e
+  upstream: 911d38be151921a5d152bb55e81fd752384c6830
+478b032b9b295f6e4d224766b1d74f3f8d8015f5:
+  title: 'tty: n_gsm: fix possible out-of-bounds in gsm0_receive()'
+  mainline: 47388e807f85948eefc403a8a5fdc5b406a65d5a
+  upstream: 9513d4148950b05bc99fa7314dc883cc0e1605e5
+0e454ea0aef962c0bc28aaec416c987c472ee16f:
+  title: 'wifi: cfg80211: fix the order of arguments for trace events of the tx_rx_evt class'
+  mainline: 9ef369973cd2c97cce3388d2c0c7e3c056656e8a
+  upstream: 5099e30dde0caffa9f0e2c41d7327fc3ed987fd5
+52bed87bdd7ff234fbf08cffb5805fec3753a574:
+  title: 'net: usb: qmi_wwan: add Telit FN920C04 compositions'
+  mainline: 0b8fe5bd73249dc20be2e88a12041f8920797b59
+  upstream: 25468fffbbd2b0f06b4b12d79ff56cc5c40bfd1f
+1de2264213019b0e94512027fedda73173da635e:
+  title: 'ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating'
+  mainline: 103abab975087e1f01b76fcb54c91dbb65dbc249
+  upstream: 5c50d2e998143ce00c0629dcaabd73c3d962545c
+f5822a115c534c96bcde99428ab661088e193a09:
+  title: 'ASoC: dt-bindings: rt5645: add cbj sleeve gpio property'
+  mainline: 306b38e3fa727d22454a148a364123709e356600
+  upstream: 5af06b6c57a9bbfa9bd5421e28bcd5c571c5821e
+6c8dd658875782d45f021c5015b9ec9bf5f5ff87:
+  title: 'ASoC: da7219-aad: fix usage of device_get_named_child_node()'
+  mainline: e8a6a5ad73acbafd98e8fd3f0cbf6e379771bb76
+  upstream: 6d2d2aaae1faa64c2f803d6f11f4b2df3b3c2cff
+8355ba0b459240e847584f780402073b8236df46:
+  title: 'crypto: bcm - Fix pointer arithmetic'
+  mainline: 2b3460cbf454c6b03d7429e9ffc4fe09322eb1a9
+  upstream: c256b616067bfd6d274c679c06986b78d2402434
+09020d6f62421e7fd4240279ff30dde78a0300bc:
+  title: 'firmware: raspberrypi: Use correct device for DMA mappings'
+  mainline: df518a0ae1b982a4dcf2235464016c0c4576a34d
+  upstream: b7277844e7e367381b2377853afceb58427cf6fb
+78f8f3e6cf95446a03837bb11a67c4c2569ced32:
+  title: 'ecryptfs: Fix buffer size for tag 66 packet'
+  mainline: 85a6a1aff08ec9f5b929d345d066e2830e8818e5
+  upstream: 1c125b9287e58f364d82174efb167414b92b11f1
+7ee6938a59b80751d7919f67a3c4fb585d3829f6:
+  title: 'nilfs2: fix out-of-range warning'
+  mainline: c473bcdd80d4ab2ae79a7a509a6712818366e32a
+  upstream: 7610fd35b74211ab8def4e124095e600a1ae945b
+72d5387b60255610eb6fd5c18bb819fc39cc8917:
+  title: 'parisc: add missing export of __cmpxchg_u8()'
+  mainline: c57e5dccb06decf3cb6c272ab138c033727149b5
+  upstream: 63d5a72afbd1505f180e81bc72e056ceea28b43b
+7eb7c75444aa358909836ea7ff4f692a53b199f9:
+  title: 'crypto: ccp - Remove forward declaration'
+  mainline: 3512dcb4e6c64733871202c01f0ec6b5d84d32ac
+  upstream: 4b713a1581b17a94a21699165a20d82eb0eca2dc
+afb1d97ca2b2cdfa5f46e8eb9fc37934349bc34e:
+  title: 'crypto: ccp - drop platform ifdef checks'
+  mainline: 42c2d7d02977ef09d434b1f5b354f5bc6c1027ab
+  upstream: ce8f89223c9552d18b118596a85fd6cc237bc0e9
+7375909839424727552bd0bb2022ca3db5c6ffe8:
+  title: 'jffs2: prevent xattr node from overflowing the eraseblock'
+  mainline: c6854e5a267c28300ff045480b5a7ee7f6f1d913
+  upstream: 2904e1d9b64f72d291095e3cbb31634f08788b11
+a28a74b9a53b5b25cde8cfbea4c071f7a1c9beed:
+  title: 'null_blk: Fix missing mutex_destroy() at module removal'
+  mainline: 07d1b99825f40f9c0d93e6b99d79a08d0717bac1
+  upstream: 54ee1f7e2ea06e5c5341dc54255881fa5d11b312
+520ccb81e3976c1c21d19d43265958faad0aee46:
+  title: 'nfsd: drop st_mutex before calling move_to_close_lru()'
+  mainline: 56c35f43eef013579c76c007ba1f386d8c2cac14
+  upstream: 52d3370e8022ce28cd8cf4d16c09245aa683d7fb
+6faa6059493e8a857fe5c3b5e12a3ceec730cda3:
+  title: 'wifi: ath10k: poll service ready message before failing'
+  mainline: e57b7d62a1b2f496caf0beba81cec3c90fad80d5
+  upstream: 54e3970b1848856e49f8cd08751dcb010ac3296b
+a2c3254bc18b8f7bea19a00d8e7ea4ec52e941c1:
+  title: 'x86/boot: Ignore relocations in .notes sections in walk_relocs() too'
+  mainline: 76e9762d66373354b45c33b60e9a53ef2a3c5ff2
+  upstream: 2487db16d4b9faead07b7825d33294e9e783791d
+5b61b9cefdb45e69ab265050d603cdd30f3d089b:
+  title: 'scsi: ufs: qcom: Perform read back after writing reset bit'
+  mainline: c4d28e06b0c94636f6e35d003fa9ebac0a94e1ae
+  upstream: e6bfc88b60f0874a00b22f243a94a5e8601d5039
+936e250e7ec6cb3bad3a8aa3a699a625e62cb5a6:
+  title: 'scsi: ufs: core: Perform read back after disabling interrupts'
+  mainline: e4a628877119bd40164a651d20321247b6f94a8b
+  upstream: bf144a2e3b5048e5a9e3baf19f54d5e865d578b4
+c5a8d87d1f0792ab4f65cf240309a4effe22de01:
+  title: 'scsi: ufs: core: Perform read back after disabling UIC_COMMAND_COMPL'
+  mainline: 4bf3855497b60765ca03b983d064b25e99b97657
+  upstream: 8dfd79c1c31660549a03439d42794c138efa5432
+94707145849c4be8019d4f7b2cce86402f9f9127:
+  title: 'irqchip/alpine-msi: Fix off-by-one in allocation error path'
+  mainline: ff3669a71afa06208de58d6bea1cc49d5e3fcbd1
+  upstream: 4654dfa98682444152aac9bcef50e0d5e114a135
+96f2e9bb5b58c10a84e2a0064c7dc88cdcfff4d8:
+  title: 'ACPI: disable -Wstringop-truncation'
+  mainline: a3403d304708f60565582d60af4316289d0316a0
+  upstream: 2e816914b5ba234c3815ca80bffd2f3b3a7de6b0
+8734c83b6dae36fbe4d97f42409e04459426858c:
+  title: 'scsi: libsas: Fix the failure of adding phy with zero-address to port'
+  mainline: 06036a0a5db34642c5dbe22021a767141f010b7a
+  upstream: 2d8f31aa03df040c58a2e4a0382b96269c1bf96a
+784e2dc0d9be9b2e2ff8e3d05713f4d82895a489:
+  title: 'scsi: hpsa: Fix allocation size for Scsi_Host private data'
+  mainline: 504e2bed5d50610c1836046c0c195b0a6dba9c72
+  upstream: 9fc44d44b3b8eadd8b797462c733eb6c63598e6f
+6541bba29a4584f20a372e98ca07659b1b971c3e:
+  title: 'wifi: ath10k: Fix an error code problem in ath10k_dbg_sta_write_peer_debug_trigger()'
+  mainline: c511a9c12674d246916bb16c479d496b76983193
+  upstream: 569da482fdec15251ff113462717182d85bd1665
+d85d76f39ef8f74c3ce4b2084bc1d56b90f808ce:
+  title: 'macintosh/via-macii: Remove BUG_ON assertions'
+  mainline: 5f93d7081a47e1972031ccf57c4b2779eee162fb
+  upstream: 880897e8a5ade054a04575e5d8cc2666da415ab4
+cbe81c90b06ebd1a23367c8c594dbddac39d531c:
+  title: 'm68k/mac: Add mutual exclusion for IOP interrupt polling'
+fad0ed0dd7bf14e6c89489e1db0486828e45f563:
+  title: 'macintosh/via-macii, macintosh/adb-iop: Clean up whitespace'
+  mainline: 47fd2060660e62b169990a6fcd9eb61bc1a85c5c
+  upstream: d0aa752285c9a35ee1ae0f2a4da10c5ceb6c09b6
+82b5124ff8448c3b27d5cf963d835806a4ec8726:
+  title: 'macintosh/via-macii: Fix "BUG: sleeping function called from invalid context"'
+  mainline: d301a71c76ee4c384b4e03cdc320a55f5cf1df05
+  upstream: e4ff8bcfb2841fe4e17e5901578b632adb89036d
+e6c959db704b9f17b53d0d695ac791ddb180649b:
+  title: 'wifi: carl9170: add a proper sanity check for endpoints'
+  mainline: b6dd09b3dac89b45d1ea3e3bd035a3859c0369a0
+  upstream: eb0f2fc3ff5806cc572cd9055ce7c52a01e97645
+0e282a437be278b5a28b5de56553710ca304877a:
+  title: 'wifi: ar5523: enable proper endpoint verification'
+  mainline: e120b6388d7d88635d67dcae6483f39c37111850
+  upstream: 79ddf5f2020fd593d50f1363bb5131283d74f78f
+08d55870d721795f5ca9affb641a9d77a5cde478:
+  title: 'sh: kprobes: Merge arch_copy_kprobe() into arch_prepare_kprobe()'
+  mainline: 1422ae080b66134fe192082d9b721ab7bd93fcc5
+  upstream: 8ed15460d8bbc517bf54b24c7694e6c0ff174968
+3d986276f8b5fa0dc170e1b35f0659b9ba4b2cd0:
+  title: 'Revert "sh: Handle calling csum_partial with misaligned data"'
+  mainline: b5319c96292ff877f6b58d349acf0a9dc8d3b454
+  upstream: 3c37203af733254154602273a970cfb7400c223e
+2461969d18d1b3a8ca40c5203819221813d2fa47:
+  title: 'scsi: bfa: Ensure the copied buf is NUL terminated'
+  mainline: 13d0cecb4626fae67c00c84d3c7851f6b62f7df3
+  upstream: 481fc0c8617304a67649027c4a44723a139a0462
+c2d34a41a30021d6947d93dee2373e98416296b8:
+  title: 'scsi: qedf: Ensure the copied buf is NUL terminated'
+  mainline: d0184a375ee797eb657d74861ba0935b6e405c62
+  upstream: 1f84a2744ad813be23fc4be99fb74bfb24aadb95
+ceee9c23ca78be8cbe0b677623554c14da4a8ffe:
+  title: 'wifi: mwl8k: initialize cmd->addr[] properly'
+  mainline: 1d60eabb82694e58543e2b6366dae3e7465892a5
+  upstream: 6bc4e51e8d8451d40ec092d01119287af2acffcf
+2341a1b273189a5673cfbb6a5badecca8e25d24a:
+  title: 'net: usb: sr9700: stop lying about skb->truesize'
+  mainline: 05417aa9c0c038da2464a0c504b9d4f99814a23b
+  upstream: c0aff9978bb6ead0aec382a2645a563a3dd2df38
+314fdca9aa1eac5417fd9621bf4ebbacfd100e75:
+  title: 'm68k: Fix spinlock race in kernel thread creation'
+  mainline: da89ce46f02470ef08f0f580755d14d547da59ed
+  upstream: 2a8d1d95302c7d52c6ac8fa5cb4a6948ae0d3a14
+4e23b79c4b130dd3049e3c0001d4926dcfacded5:
+  title: 'm68k/mac: Use ''030 reset method on SE/30'
+  mainline: 9c0e91f6b701dce6902408d50c4df9cebe4744f5
+  upstream: c96430d59c71a0e5c641b5267ccf141c501fe15e
+3d47f159d4991609f1a71bb15683f1b8cac8d2a8:
+  title: 'm68k: mac: Fix reboot hang on Mac IIci'
+  mainline: 265a3b322df9a973ff1fc63da70af456ab6ae1d6
+  upstream: 8055e882c57031a5ca7fbf278796c19ded9f9d6f
+be1d9f0e9de4ae6b3c0baed5547aa84be06f6548:
+  title: 'af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg'
+  mainline: 540bf24fba16b88c1b3b9353927204b4f1074e25
+  upstream: fca6072e1a7b1e709ada5604b951513b89b4bd0a
+16d0a15317ccdd42565ee3b0b4414f7134f414ba:
+  title: 'net: usb: smsc95xx: stop lying about skb->truesize'
+  mainline: d50729f1d60bca822ef6d9c1a5fb28d486bd7593
+  upstream: 1010b50b2ebaaa863baeba7572267ac39bbb7adb
+d84c07f0a36edfbb017f66723aff19b75408ec6a:
+  title: 'net: openvswitch: fix overwriting ct original tuple for ICMPv6'
+  mainline: 7c988176b6c16c516474f6fceebe0f055af5eb56
+  upstream: 6a51ac92bf35d34b4996d6eb67e2fe469f573b11
+e990bf08d73df105508439d775a40706fa34e4da:
+  title: 'ipv6: sr: add missing seg6_local_exit'
+  mainline: 3321687e321307629c71b664225b861ebf3e5753
+  upstream: 9acb7ed4ff0e57b29326768aa8780f2ba2310090
+32cc76dc98c3a167b25dfe1548848036fc07d834:
+  title: 'ipv6: sr: fix incorrect unregister order'
+  mainline: 6e370a771d2985107e82d0f6174381c1acb49c20
+  upstream: d55cf7ced48c5054a79829a0b14203710006a277
+a7eb748e89ec4c74a795fd32380019f21ae75895:
+  title: 'ipv6: sr: fix invalid unregister error path'
+  mainline: 160e9d2752181fcf18c662e74022d77d3164cd45
+  upstream: 10610575a3ac2a702bf5c57aa931beaf847949c7
+73bc0203a1791e5252c190a016d46502406d53f0:
+  title: 'mtd: rawnand: hynix: fixed typo'
+  mainline: 6819db94e1cd3ce24a432f3616cd563ed0c4eaba
+  upstream: 80850a39e2548988f4feae26f3fd66286b460278
+4ba8a5fa126c85d319a0f1c773a15c04dde7d74c:
+  title: 'fbdev: shmobile: fix snprintf truncation'
+  mainline: 26c8cfb9d1e4b252336d23dd5127a8cbed414a32
+  upstream: f6100ea560ed320a397d99aad6ad6918f0f1a70a
+43f9acac76b1661328292b13c57936252536a7ee:
+  title: 'drm/mediatek: Add 0 size check to mtk_drm_gem_obj'
+  mainline: 1e4350095e8ab2577ee05f8c3b044e661b5af9a0
+  upstream: 79078880795478d551a05acc41f957700030d364
+27a754ac9d1b146c6690b8cc566be4df02028430:
+  title: 'powerpc/fsl-soc: hide unused const variable'
+  mainline: 01acaf3aa75e1641442cc23d8fe0a7bb4226efb1
+  upstream: b798cfeea12ebfd74c4bba511deb02956c97789e
+a36a6656bdcc519ee8206e91a484c9545e41c428:
+  title: 'media: ngene: Add dvb_ca_en50221_init return value check'
+  mainline: 9bb1fd7eddcab2d28cfc11eb20f1029154dac718
+  upstream: 7394bab35c51cead246ef50d8c2e699e36032aed
+83fe7e17269e69bb85c5dcde3543fe69a7d14907:
+  title: 'media: radio-shark2: Avoid led_names truncations'
+  mainline: 1820e16a3019b6258e6009d34432946a6ddd0a90
+  upstream: cbc12c9693fad0545fb0e753d78979026ae0772a
+d1bafe8dbdd69b5b94c648616261b10f89e9e634:
+  title: 'fbdev: sh7760fb: allow modular build'
+  mainline: 51084f89d687e14d96278241e5200cde4b0985c7
+  upstream: 74bafc897cb6c83b29c66cb39e82936204a5e51f
+8b76f73f5124b83712d6cdcb3ef990263e40c5f0:
+  title: 'ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value'
+  mainline: 58300f8d6a48e58d1843199be743f819e2791ea3
+  upstream: 60c68092723ea420215e9c3d5530038bc6568739
+e39747d5b28a334d3aa4a7d53db14f9f30390923:
+  title: 'x86/insn: Fix PUSH instruction in x86 instruction decoder opcode map'
+  mainline: 59162e0c11d7257cde15f907d19fefe26da66692
+  upstream: ef10bbdf4d59a98cf57ddf943756f14ef3cdbccd
+668cfe934e0081e60581269d5afab127489cdfda:
+  title: 'ext4: avoid excessive credit estimate in ext4_tmpfile()'
+  mainline: 35a1f12f0ca857fee1d7a04ef52cbd5f1f84de13
+  upstream: 1f9e32f9ea3454f79d80c8af7fac54843beba7f6
+0f0c8dcfaaff549a0397d3e63ec093c2ff6d602d:
+  title: 'selftests/kcmp: Make the test output consistent and clear'
+  mainline: ff682226a353d88ffa5db9c2a9b945066776311e
+  upstream: 32b0469d13ebeb008b39613eb5acf529a10e0bde
+eea262830c62f8856fed4c532b5598f83c2972a9:
+  title: 'selftests/kcmp: remove unused open mode'
+  mainline: eb59a58113717df04b8a8229befd8ab1e5dbf86e
+  upstream: 24331545d6ff749a8dbfb09925af86e8cc50dad5
+b3ab7172b68826ae894b394561679727af8e970d:
+  title: 'RDMA/ipoib: Fix use of sizeof()'
+183cb1a936e35c5ae205498945addd70a31a61e0:
+  title: 'RDMA/IPoIB: Fix format truncation compilation errors'
+  mainline: 49ca2b2ef3d003402584c68ae7b3055ba72e750a
+  upstream: b469345f1fca84bed4dea3cae85faa401cf9bf3e
+08f41b353c1621f65bd6f61aa5f5aed2fc1feb11:
+  title: 'netrom: fix possible dead-lock in nr_rt_ioctl()'
+  mainline: e03e7f20ebf7e1611d40d1fdc1bde900fd3335f6
+  upstream: b9d663fbf74290cb68fbc66ae4367bd56837ad1d
+79417a25cb5eb9644fe89e5aae703a6b591669d5:
+  title: 'af_packet: do not call packet_read_pending() from tpacket_destruct_skb()'
+  mainline: 581073f626e387d3e7eed55c48c8495584ead7ba
+  upstream: 4f3ae7d846b4565c0b80d65ed607c3277bc984d4
+03baaba21b3291e6300e4fafb8d2849f0389de3d:
+  title: 'sched/topology: Don''t set SD_BALANCE_WAKE on cpuset domain relax'
+  mainline: 9ae7ab20b4835dbea0e5fc6a5c70171dc354a72e
+  upstream: 046daa54c348ccec12ab38b92923060dd09ef00b
+cd212b4b364b6efe32441d764cabaef2402c8eba:
+  title: 'sched/fair: Allow disabling sched_balance_newidle with sched_relax_domain_level'
+  mainline: a1fd0b9d751f840df23ef0e75b691fc00cfd4743
+  upstream: 454de5ed81766fbbf4777c43392d8b0b35e7e16d
+8d680792eafdefb9e3e547a305a505da085932ff:
+  title: 'greybus: lights: check return of get_channel_from_mode'
+  mainline: a1ba19a1ae7cd1e324685ded4ab563e78fe68648
+  upstream: 8f4a76d477f0cc3c54d512f07f6f88c8e1c1e07b
+0d0f766835c349005332fd8e7b296660a7d6a65a:
+  title: 'dmaengine: idma64: Add check for dma_set_max_seg_size'
+  mainline: 2b1c1cf08a0addb6df42f16b37133dc7a351de29
+  upstream: 12c70cc851b263b8cc9479a23488992eeb4c35e6
+e9c8e448b86118386e2aed7e3bb0e02fdbb68d14:
+  title: 'firmware: dmi-id: add a release callback function'
+  mainline: cf770af5645a41a753c55a053fa1237105b0964a
+  upstream: 20595142ca22ac2c8357564d9e7d52a0ffa471af
+bcbacbcfd59ba38747a001592ffb3aae1118e5de:
+  title: 'serial: max3100: Lock port->lock when calling uart_handle_cts_change()'
+  mainline: 77ab53371a2066fdf9b895246505f5ef5a4b5d47
+  upstream: 44b38924135d2093e2ec1812969464845dd66dc9
+c6cf8b544d9ca71186322b2ede24e7ded577381a:
+  title: 'serial: max3100: Update uart_driver_registered on driver removal'
+  mainline: 712a1fcb38dc7cac6da63ee79a88708fbf9c45ec
+  upstream: 21a61a7fbcfdd3493cede43ebc7c4dfae2147a8b
+647c442cedd75f319c8ce8dc039c2d7baec68317:
+  title: 'serial: max3100: Fix bitwise types'
+  mainline: e60955dbecb97f080848a57524827e2db29c70fd
+  upstream: 2ae8d5726526c05452aff0444b0f305fdf89a32d
+89f965ae0a3f751235963e2597c63fd9ce035113:
+  title: 'greybus: arche-ctrl: move device table to its right location'
+  mainline: 6a0b8c0da8d8d418cde6894a104cf74e6098ddfa
+  upstream: 22e65ed6799f2bfd059d633890d6c7ebe46abc9b
+0328af15e33a89109f97c8abcce2119896607fb4:
+  title: 'usb: gadget: u_audio: Clear uac pointer when freed.'
+  mainline: a2cf936ebef291ef7395172b9e2f624779fb6dc0
+  upstream: a646645af00f65db78fe4a60f753f2b07df35b6e
+5bbc7d325cef8fbd593fd8e71f12343c47028be1:
+  title: 'stm class: Fix a double free in stm_register_device()'
+  mainline: 3df463865ba42b8f88a590326f4c9ea17a1ce459
+  upstream: 6cc30ef8eb6d8f8d6df43152264bbf8835d99931
+16e15c7fd21ec24f98668e5a7bf28ef5c1a0fcaa:
+  title: 'ppdev: Add an error check in register_device'
+  mainline: fbf740aeb86a4fe82ad158d26d711f2f3be79b3e
+  upstream: 65cd017d43f4319a56747d38308b0a24cf57299e
+d1e6203d776319b888b57b1176df438ee85e67f7:
+  title: 'extcon: max8997: select IRQ_DOMAIN instead of depending on it'
+  mainline: b1781d0a1458070d40134e4f3412ec9d70099bec
+  upstream: b463819e3725b60c550145df952080b5d0fe85a7
+46dc390d5714351d5b798312f8edf666e327a1ef:
+  title: 'f2fs: add error prints for debugging mount failure'
+  mainline: 9227d5227b8db354d386f592f159eaa44db1c0b8
+  upstream: 3506e1b893b5c2afa96922f36a01f018e4c4bbba
+3fa32fd0a2737a59698613854994f72051a6d4bb:
+  title: 'libsubcmd: Fix parse-options memory leak'
+  mainline: 230a7a71f92212e723fa435d4ca5922de33ec88a
+  upstream: 3625187a973f16a3df59b803297816fe51d32400
+41c0d9061a68f5979e3244c26854cef37d91382b:
+  title: 'Input: ims-pcu - fix printf string overflow'
+  mainline: bf32bceedd0453c70d9d022e2e29f98e446d7161
+  upstream: 502f295dcccf0ee7c4bddcf1ff2876987aaf89ca
+7dfc577218ae7aeeadc5bdffe5727d57337904ee:
+  title: 'Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation'
+  mainline: 48c0687a322d54ac7e7a685c0b6db78d78f593af
+  upstream: fd4bb5284d34687c82356f07efe957af89ee51fe
+bb75c00bad0d04025b00991fe16db2fc0504ce58:
+  title: 'um: Fix return value in ubd_init()'
+  mainline: 31a5990ed253a66712d7ddc29c92d297a991fdf2
+  upstream: d2640251f94078e1dcf0a26b1815601f6dbd5440
+330646466ce0f4978524457d109ac80ece62c547:
+  title: 'um: Add winch to winch_handlers before registering winch IRQ'
+  mainline: a0fbbd36c156b9f7b2276871d499c9943dfe5101
+  upstream: 66ea9a7c6824821476914bed21a476cd20094f33
+b7d9420c157cdb207a95dfc4a40edd116dedf355:
+  title: 'media: stk1160: fix bounds checking in stk1160_copy_video()'
+  mainline: faa4364bef2ec0060de381ff028d1d836600a381
+  upstream: f6a392266276730bea893b55d12940e32a25f56a
+cd05d6e21092d824ec4d37f39f7583310d0442fa:
+  title: 'powerpc/pseries: Add failure related checks for h_get_mpp and h_get_ppp'
+  mainline: 6d4341638516bf97b9a34947e0bd95035a8230a5
+  upstream: f0f4cb4cc3f43324bab3b5541b27e79cbd15c8d1
+d6c506b111a38e5583e5bdd880cc0c04d7ef3948:
+  title: 'um: Fix the -Wmissing-prototypes warning for __switch_mm'
+  mainline: 2cbade17b18c0f0fd9963f26c9fc9b057eb1cb3a
+  upstream: c08650c13bfc05794855480cc51075fdfcc388e0
+75fd6535ba80c0726e31004af666d80a0b9c3df8:
+  title: 'media: cec: cec-api: add locking in cec_release()'
+  mainline: 42bcaacae924bf18ae387c3f78c202df0b739292
+  upstream: d2cfbc5298add5e0c6cfe8b343f73dfdf01c8b1c
+9da7f2b727fd54add9890e238847acf82d6807a1:
+  title: 'null_blk: Fix the WARNING: modpost: missing MODULE_DESCRIPTION()'
+  mainline: 9e6727f824edcdb8fdd3e6e8a0862eb49546e1cd
+  upstream: 7471d0be031ab830a0fa154437601cff98f7068b
+4e00769cc5020fde90269bdd1e5c24302b0ba6ce:
+  title: 'x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when UNWINDER_FRAME_POINTER=y'
+  mainline: 66ee3636eddcc82ab82b539d08b85fb5ac1dff9b
+  upstream: 28a7a1f9571068bb2ddc8a11f0afe5dfa9863462
+3327ed68607e86e489af26305145830bf3f299a6:
+  title: 'nfc: nci: Fix uninit-value in nci_rx_work'
+  mainline: e4a87abf588536d1cdfb128595e6e680af5cf3ed
+  upstream: 406cfac9debd4a6d3dc5d9258ee086372a8c08b6
+2d5acfc9e45f4597b931857dd92d2f29d2382ad7:
+  title: 'ipv6: sr: fix memleak in seg6_hmac_init_algo'
+  mainline: efb9f4f19f8e37fde43dfecebc80292d179f56c6
+  upstream: afd5730969aec960a2fee4e5ee839a6014643976
+45e0b129726564750a58c06f1b4060b23f158960:
+  title: 'params: lift param_set_uint_minmax to common code'
+  mainline: 2a14c9ae15a38148484a128b84bff7e9ffd90d68
+  upstream: 459de98d7a6b3d504b5e8664f32f59a306dd425c
+cf1096a1c8e1905df5e69949153c2598060457f0:
+  title: 'tcp: Fix shift-out-of-bounds in dctcp_update_alpha().'
+  mainline: 3ebc46ca8675de6378e3f8f40768e180bb8afa66
+  upstream: 06d0fe049b51b0a92a70df8333fd85c4ba3eb2c6
+a629b0579dee6b041fdcad1859fa9f6a86da4ced:
+  title: 'openvswitch: Set the skbuff pkt_type for proper pmtud support.'
+  mainline: 30a92c9e3d6b073932762bef2ac66f4ee784c657
+  upstream: 62a95de44a9bc006e01b0afa1b1e8868dc6de9d1
+0374a08aa5206c6200a88e0a122500dfd1d195f0:
+  title: 'arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY'
+  mainline: ffbf4fb9b5c12ff878a10ea17997147ea4ebea6f
+  upstream: f221bd58db0f6ca087ac0392284f6bce21f4f8ea
+63c5945dbfcb8b6f4c260aef57172893a15ebbb3:
+  title: 'virtio: delete vq in vp_find_vqs_msix() when request_irq() fails'
+  mainline: 89875151fccdd024d571aa884ea97a0128b968b6
+  upstream: cb7a7c8144b434e06aba99b13b045a7efe859587
+273d17ed35348d5e6cabe23d9170c876f95f3946:
+  title: 'net: fec: remove redundant variable ''inc'''
+76ff93a5ccf6378571ba77875039f77752ac8a33:
+  title: 'net: fec: avoid lock evasion when reading pps_enable'
+  mainline: 3b1c92f8e5371700fada307cc8fd2c51fa7bc8c1
+  upstream: 4e4efb8f1b275e85c5c7f69087e392dbae437a8d
+3267e236cb890a2ff6450ba831f3ad66386d6c4b:
+  title: 'nfc: nci: Fix kcov check in nci_rx_work()'
+  mainline: 19e35f24750ddf860c51e51c68cf07ea181b4881
+  upstream: c6c938ef515733a1c7af2c87dbc23138f402ba97
+1a7a9cc0bb2c966cb7edee4a47dc81053e9030d8:
+  title: 'nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()'
+  mainline: 6671e352497ca4bb07a96c48e03907065ff77d8a
+  upstream: 8f02d494cebae48dbd14c582ad4b36846e211b6a
+ac335a5fe30958ed4c81fac6b76e4b6c77f6f95d:
+  title: 'netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()'
+  mainline: dc21c6cc3d6986d938efbf95de62473982c98dec
+  upstream: 8658bd777cbfcb0c13df23d0ea120e70517761b9
+0a359294f4d22e037ff38999b1fdaa688aab6e5f:
+  title: 'spi: Don''t mark message DMA mapped when no transfer in it is'
+  mainline: 9f788ba457b45b0ce422943fcec9fa35c4587764
+  upstream: c7893975764ba3b7a58a186f63dae188f7eddb18
+5584ee5ae01187bdcb286738c27d8cecf7c2b92d:
+  title: 'nvmet: fix ns enable/disable possible hang'
+  mainline: f97914e35fd98b2b18fb8a092e0a0799f73afdfe
+  upstream: 36a935c8785a9ca95b094440a0450cd56b90e70c
+d6e67757cebbeb5857838f51e2c514a3c9fc5557:
+  title: 'net/mlx5e: Use rx_missed_errors instead of rx_dropped for reporting buffer exhaustion'
+  mainline: 5c74195d5dd977e97556e6fa76909b831c241230
+  upstream: 19f9b6cb94eebb4ef2a4a6bca0ef595039d73e04
+5beeab6917b9b59ab2c15744b190b3ad93c58687:
+  title: 'dma-buf/sw-sync: don''t enable IRQ from sync_print_obj()'
+  mainline: b794918961516f667b0c745aebdfebbb8a98df39
+  upstream: 1ff116f68560a25656933d5a18e7619cb6773d8a
+3d00c58ac6d7f0fa0882aafb5b1ca2c3c22838eb:
+  title: 'enic: Validate length of nl attributes in enic_set_vf_port'
+  mainline: e8021b94b0412c37bcc79027c2e382086b6ce449
+  upstream: 2b649d7e0cb42a660f0260ef25fd55fdc9c6c600
+d7936abfc24afa29d587b2bdd0829092dc478ebf:
+  title: 'smsc95xx: remove redundant function arguments'
+  mainline: 368be1ca28f66deba16627e2a02e78adedd023a6
+  upstream: eced17c8715d43ce16f61c5a6a49299fbf37c0a0
+17ddb0fdf87c7f3f7c07e2721f688301411d2792:
+  title: 'smsc95xx: use usbnet->driver_priv'
+  mainline: ad90a73f0236c41f7a2dedc2e75c7b5a364eb93e
+  upstream: bcc526fec891dee22162082b1beeb9068b9eabb0
+e0bd5cab3be56a1437e713a5411c458b80fa039c:
+  title: 'net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM'
+  mainline: 52a2f0608366a629d43dacd3191039c95fef74ba
+  upstream: 85b6bcf9d5e332aa9c4b7820cb3aa748c3df6a80
+4c2d953d579bbc6018f916d7474ca42a0ea2471f:
+  title: 'net:fec: Add fec_enet_deinit()'
+  mainline: bf0497f53c8535f99b72041529d3f7708a6e2c0d
+  upstream: 416b0756721dcee2bb6227a4403e694011c32874
+c00f30ffce7c99732b9610771908b84af2f7e95a:
+  title: 'kconfig: fix comparison to constant symbols, ''m'', ''n'''
+  mainline: aabdc960a283ba78086b0bf66ee74326f49e218e
+  upstream: 6bfda3ef7f6a2c1de30e70d67e901aa966f40c17
+59e5a44b8b298cec43305d8ba650673094448b28:
+  title: 'net: add DEV_STATS_READ() helper'
+  mainline: 0b068c714ca9479d2783cc333fff5bc2d4a6d45c
+f18d1f1dd0f85682cce01581ea7c2596d0d35ead:
+  title: 'ipvlan: properly track tx_errors'
+  mainline: ff672b9ffeb3f82135488ac16c5c5eb4b992999b
+41e5da22e02a94825b061ad86f10c9d6955727fd:
+  title: 'ipvlan: add ipvlan_route_v6_outbound() helper'
+  mainline: 18f039428c7df183b09c69ebf10ffd4e521035d2
+3a016fed8503f04152b170bc324fd7fbbfb155e4:
+  title: 'ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound'
+  mainline: b3dc6e8003b500861fa307e9a3400c52e78e4d3a
+  upstream: 0049a623dfbbb49888de7f0c2f33a582b5ead989
+24212e46bb2a25ec7c7ef9c45a40670608a3a0f8:
+  title: 'ALSA: timer: Simplify timer hw resolution calls'
+804b59ac965568b4ac7b1788ba8b3b324e362693:
+  title: 'ALSA: timer: Set lower bound of start tick time'
+  mainline: 4a63bd179fa8d3fcc44a0d9d71d941ddd62f0c4e
+  upstream: 68396c825c43664b20a3a1ba546844deb2b4e48f
+f642f364e2b4e4302e6b41f1583603a9be83baef:
+  title: 'binder: fix max_thread type inconsistency'
+  mainline: 42316941335644a98335f209daafa4c122f28983
+  upstream: c437184be3c16f7123e5c59b4c85c1101f4dc96b
+5584cc5bd6c850f9738f7b249be3d298f0012a16:
+  title: 'mmc: core: Do not force a retune before RPMB switch'
+  mainline: 67380251e8bbd3302c64fea07f95c31971b91c22
+  upstream: bda1d354bef71be32aaf2c5e6b96eef854b3dd4e
+042d63a09767b3d6d006fc867d77cf610bfcdebf:
+  title: 'fs/nilfs2: convert timers to use timer_setup()'
+705fabd9032429d644eee84edc1d45f740edcc81:
+  title: 'nilfs2: fix use-after-free of timer for log writer thread'
+  mainline: f5d4e04634c9cf68bdf23de08ada0bb92e8befe7
+  upstream: 822ae5a8eac30478578a75f7e064f0584931bf2d
+7e6f3eaf97955faec6cf408b6404a35cf2c82ea0:
+  title: 'vxlan: Fix regression when dropping packets due to invalid src addresses'
+  mainline: 1cd4bc987abb2823836cbb8f887026011ccddc8a
+  upstream: f6141cbc2b5af521b1711e95363302b858a38729
+34358bf261de42b079db6cbd5ae3b074282cd00f:
+  title: 'neighbour: fix unaligned access to pneigh_entry'
+  mainline: ed779fe4c9b5a20b4ab4fd6f3e19807445bb78c7
+  upstream: f451d1a013fd585cbf70a65ca6b9cf3548bb039f
+792524d8e1b344cedcb40983a8756d4793a22e9e:
+  title: 'ata: pata_legacy: make legacy_exit() work again'
+  mainline: d4a89339f17c87c4990070e9116462d16e75894f
+  upstream: 21604179f67bd484790c296565bdc38f7a40fe35
+aa9c43942fc69f5e652d6b4f68e0e2bf75868c7e:
+  title: 'arm64: tegra: Correct Tegra132 I2C alias'
+  mainline: 2633c58e1354d7de2c8e7be8bdb6f68a0a01bad7
+  upstream: 40f76e72ec0ebe27dcff9bfd5de8e65e1a2b8939
+d7263704edf4ee2783b116f64f407752d5b2f2bf:
+  title: 'md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING'
+  mainline: 151f66bb618d1fd0eeb84acb61b4a9fa5d8bb0fa
+  upstream: b32aa95843cac6b12c2c014d40fca18aef24a347
+964fdd7feb56e40a55b89328877b0a7103bb4084:
+  title: 'arm64: dts: hi3798cv200: fix the size of GICR'
+  mainline: 428a575dc9038846ad259466d5ba109858c0a023
+  upstream: 26e62b983a31b304733fb21f4b576a4a1e171297
+35d3fa1859980a84c64c51b04a2ac57ffe5af109:
+  title: 'media: mxl5xx: Move xpt structures off stack'
+  mainline: 526f4527545b2d4ce0733733929fac7b6da09ac6
+  upstream: 772f5e31ed2d6bc5e8698394e4d13b298060c74a
+2046df24d6472a520a62d52a72d84d180b3e363c:
+  title: 'media: v4l2-core: hold videodev_lock until dev reg, finishes'
+  mainline: 1ed4477f2ea4743e7c5e1f9f3722152d14e6eeb1
+  upstream: 1ea3de272f5cc7603610b96316f9ed07bec6c2d0
+293140832f7230044b5f6888d0110714f51b554f:
+  title: 'fbdev: savage: Handle err return when savagefb_check_var failed'
+  mainline: 6ad959b6703e2c4c5d7af03b4cfd5ff608036339
+  upstream: be754cbd77eaf2932408a4e18532e4945274a5c7
+832e81e147209b23bc09678738383b7bc258b448:
+  title: 'netfilter: nf_tables: add nft_set_is_anonymous() helper'
+05084047e524051c0ea37f6b3183017d783e6e20:
+  title: 'netfilter: nf_tables: fix set double-free in abort path'
+  mainline: 40ba1d9b4d19796afc9b7ece872f5f3e8f5e2c13
+c4af59f2d8336214168c4e0778a1a0a62afcbdc4:
+  title: 'netfilter: nf_tables: pass context to nft_set_destroy()'
+  mainline: 0c2a85edd143162b3a698f31e94bf8cdc041da87
+  upstream: 525561faa075cb49905783fd3e4e16b66b218846
+b42c75cd69307b546b719cc59fb421a7c80a980f:
+  title: 'netfilter: nftables: rename set element data activation/deactivation functions'
+  mainline: f8bb7889af58d8e74d2d61c76b1418230f1610fa
+  upstream: 68b10f33a37e942bdc06b9cb313ad4e1b1f612e8
+e4382ad0d81a0f37c3d430a3009f597568a949a4:
+  title: 'netfilter: nf_tables: pass ctx to nf_tables_expr_destroy()'
+50bfcb0af95ae860d93c151604451b9a10af6e06:
+  title: 'netfilter: nf_tables: drop map element references from preparation phase'
+  mainline: 628bd3e49cba1c066228e23d71a852c23e26da73
+  upstream: bc9f791d2593f17e39f87c6e2b3a36549a3705b1
+4538b02484e4c2d0c016ca190c5219fd97f932fb:
+  title: 'netfilter: nf_tables: don''t skip expired elements during walk'
+  mainline: 24138933b97b055d486e8064b4a1721702442a9b
+  upstream: 94313a196b44184b5b52c1876da6a537701b425a
+ea71b10a3d18e5589f44b836a83003a6e741d6bb:
+  title: 'netfilter: nft_dynset: report EOPNOTSUPP on missing set feature'
+  mainline: 95cd4bca7b1f4a25810f3ddfc5e767fb46931789
+  upstream: c5c4746c8cd6d049dcbf39c811172c917ea6fb6e
+fa8b9918795f9be7f4ca95f5440acff86fe946db:
+  title: 'netfilter: nft_dynset: relax superfluous check on set updates'
+  mainline: 7b1394892de8d95748d05e3ee41e85edb4abbfa1
+  upstream: 79e98cd78610560a6a6cf85200eb31331602f9a9
+6658c1ef0cb35d3d594507db800cb44a54db4f75:
+  title: 'KVM: arm64: Allow AArch32 PSTATE.M to be restored as System mode'
+  mainline: dfe6d190f38fc5df5ff2614b463a5195a399c885
+  upstream: 3c9ee8294728633e707c25fe0a321eeac1cc7515
+9d5b95ce1488266fd3dc3951da6c8ce25c366ada:
+  title: 'crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak'
+  mainline: d3b17c6d9dddc2db3670bc9be628b122416a3d26
+  upstream: 0ce5964b82f212f4df6a9813f09a0b5de15bd9c8
+9a9a74f4cdb1295a5a854d2ca6cb87fc19048ef3:
+  title: 'net/9p: fix uninit-value in p9_client_rpc()'
+  mainline: 25460d6f39024cc3b8241b14c7ccf0d6f11a736a
+  upstream: 72c5d8e416ecc46af370a1340b3db5ff0b0cc867
+471ea347bb7d4b16dd62a6642efb111fa36f2da7:
+  title: 'intel_th: pci: Add Meteor Lake-S CPU support'
+  mainline: a4f813c3ec9d1c32bc402becd1f011b3904dd699
+  upstream: 58c0309c73fe1e9c477ed4cc5d02fc9015336979
+9f2edbc910b189e46e7ca3d17680e36fde63276d:
+  title: 'sparc64: Fix number of online CPUs'
+  mainline: 98937707fea8375e8acea0aaa0b68a956dd52719
+  upstream: 180b2e4c1ba4f6e3e4c52d6664cb019f6eac02f8
+f751d9a9f3d6c01908cf9bc9d966a35ecc1a2f64:
+  title: 'kdb: Fix buffer overflow during tab-complete'
+  mainline: e9730744bf3af04cda23799029342aa3cddbc454
+  upstream: fb824a99e148ff272a53d71d84122728b5f00992
+f990953b6d8d752849e6f682628d4632f051b7de:
+  title: 'kdb: Use format-strings rather than ''\0'' injection in kdb_read()'
+  mainline: 09b35989421dfd5573f0b4683c7700a7483c71f9
+  upstream: 4edfbbaca46491b06af14e49dcb79ac661d0bbdc
+fc2a098bc09c4f9968c93222902d72f518ec6953:
+  title: 'kdb: Fix console handling when editing and tab-completing commands'
+  mainline: db2f9c7dc29114f531df4a425d0867d01e1f1e28
+  upstream: 21c068c1bbb4c336741749596d004b1965faab2c
+201f3d45deb9bcf1046483d72642d8457976c7a9:
+  title: 'kdb: Merge identical case statements in kdb_read()'
+  mainline: 6244917f377bf64719551b58592a02a0336a7439
+  upstream: 4a89182788f9af9a290c19098382fb972ebe2783
+c89fb4fb7559ec8e3f74ecbc29ef856a47cc85d4:
+  title: 'kdb: Use format-specifiers rather than memset() for padding in kdb_read()'
+  mainline: c9b51ddb66b1d96e4d364c088da0f1dfb004c574
+  upstream: 2467f3f182eb35627534effd4956fceb2504c127
+212ca5dd4286a76808254db293bd898a062b56e3:
+  title: 'sparc: move struct termio to asm/termios.h'
+  mainline: c32d18e7942d7589b62e301eb426b32623366565
+  upstream: 980a1cd6e092eab9398a78f517809a7dacaa0468
+199f7d837409f78087fde12a33c486d4d866c16e:
+  title: 'ext4: fix mb_cache_entry''s e_refcnt leak in ext4_xattr_block_cache_find()'
+  mainline: 0c0b4a49d3e7f49690a6827a41faeffad5df7e21
+  upstream: 9ad75e78747b5a50dc5a52f0f8e92e920a653f16
+593e234893f02097b207840c7c31b4d91b64ca14:
+  title: 'nfs: fix undefined behavior in nfs_block_bits()'
+  mainline: 3c0a2e0b0ae661457c8505fecc7be5501aa7a715
+  upstream: 74ea538aa24490d7d259c881189bb58dbf1f692c
+aa4a1101113a8425c065d44e33c636cad583327d:
+  title: 'crypto: algif_aead - fix uninitialized ctx->init'
+8949bc46fedc763c195c9a72f69abb9405cac9dc:
+  title: 'x86/kvm: Teardown PV features on boot CPU as well'
+  mainline: 8b79feffeca28c5459458fe78676b081e87c93a4
+227178f3eba56c465bdd554e9786a0699bbf40d4:
+  title: 'x86/kvm: Disable kvmclock on all CPUs on shutdown'
+  mainline: c02027b5742b5aa804ef08a4a9db433295533046
+f07e26ece43c2b61389d2a56226ea19d3bd40c57:
+  title: 'x86/kvm: Disable all PV features on crash'
+  mainline: 3d6b84132d2a57b5a74100f6923a8feb679ac2ce

diff --git a/.elts/upstream/4.19.313.yaml b/.elts/upstream/4.19.313.yaml
new file mode 100644
index 0000000..539dac9
--- /dev/null
+++ b/.elts/upstream/4.19.313.yaml

@@ -0,0 +1,308 @@
+04720ea2e6c64459a90ca28570ea78335eccd924:
+  title: 'batman-adv: Avoid infinite loop trying to resize local TT'
+  mainline: b1f532a3b1e6d2e5559c7ace49322922637a28aa
+  backport: e4f4588b3c0869ac39c79a84669bba92b50c2205
+89a32741f4217856066c198a4a7267bcdd1edd67:
+  title: 'Bluetooth: Fix memory leak in hci_req_sync_complete()'
+  mainline: 45d355a926ab40f3ae7bc0b0a00cb0e3e8a5a810
+  backport: fcab8bb833c33df8d7619a7c8367231f89577f70
+7b30bcac7f8bd82dcb9ee61d04926d286060a19f:
+  title: 'nouveau: fix function cast warning'
+  mainline: 185fdb4697cc9684a02f2fab0530ecdd0c2f15d4
+  backport: f67ff0072a70883c601e426a97085753f0ea4d23
+43be590456e1f3566054ce78ae2dbb68cbe1a536:
+  title: 'geneve: fix header validation in geneve[6]_xmit_skb'
+  mainline: d8a6213d70accb403b82924a1c229e733433a5ef
+  backport: 5f11455435b6294f64eb70b163dba59ba4239ea0
+3e2c1fbbb372005e98ac75a239ca02da3ef9ba5b:
+  title: 'ipv6: fib: hide unused ''pn'' variable'
+  mainline: 74043489fcb5e5ca4074133582b5b8011b67f9e7
+  skipped: should not be applied to 4.14
+0b48182b06f631781987c38be150d76b0f483923:
+  title: 'ipv4/route: avoid unused-but-set-variable warning'
+  mainline: cf1b7201df59fb936f40f4a807433fe3f2ce310a
+  backport: 016fcada2b407eccf84eb18626994945ee51f78c
+b4b3b69a19016d4e7fbdbd1dbcc184915eb862e1:
+  title: 'ipv6: fix race condition between ipv6_get_ifaddr and ipv6_del_addr'
+  mainline: 7633c4da919ad51164acbf1aa322cc1a3ead6129
+  backport: fee87d38713d366ea650216d07a3ac962d2b7f1c
+de0139719cdda82806a47580ca0df06fc85e0bd2:
+  title: 'net/mlx5: Properly link new fs rules into the tree'
+  mainline: 7c6782ad4911cbee874e85630226ed389ff2e453
+  backport: bfa99d232f459aae39a87cb7bc7a28e772325080
+8bfa576fe3c6df875a16f3eb27f7ec3fdd7f3168:
+  title: 'tracing: hide unused ftrace_event_id_fops'
+  mainline: 5281ec83454d70d98b71f1836fb16512566c01cd
+  backport: 39f0520cea332cf14036a8d90902938fa0f2475c
+60bb8b451c6a9dc993c876e1f2abf188f9bc97c1:
+  title: 'vhost: Add smp_rmb() in vhost_vq_avail_empty()'
+  mainline: 22e1992cf7b034db5325660e98c41ca5afa5f519
+  backport: 79a4cc09e1dd7c1d8d6d3f5906d1cdb04ce14d43
+3004d8f3f9ddb7c43b4af98203c8bb9a31bf8b51:
+  title: 'selftests: timers: Fix abs() warning in posix_timers test'
+  mainline: ed366de8ec89d4f960d66c85fc37d9de22f7bf6d
+  backport: f5e66cc721903d6adf93b7e9bb7fe06f6033dce2
+38ecf8d8a293c9677a4659ede4810ecacb06dcda:
+  title: 'x86/apic: Force native_apic_mem_read() to use the MOV instruction'
+  mainline: 5ce344beaca688f4cdea07045e0b8f03dc537e74
+  backport: b1c1aa9e9a32ff9503c37d3a47e7eacc66cd809a
+f9392292ff4c01b092c12d1bfdae5471496cca1e:
+  title: 'btrfs: record delayed inode root in transaction'
+  mainline: 71537e35c324ea6fbd68377a4f26bb93a831ae35
+  skipped: fixes patch not in branch
+0a8b2a0410e7fdcd899e58015d025004808559f6:
+  title: 'selftests/ftrace: Limit length in subsystem-enable tests'
+  mainline: 1a4ea83a6e67f1415a1f17c1af5e9c814c882bb5
+  backport: a3f786dc93abeaa911663b647c4a9a48b021e9c1
+b5808d40093403334d939e2c3c417144d12a6f33:
+  title: 'kprobes: Fix possible use-after-free issue on kprobe registration'
+  mainline: 325f3fb551f8cd672dbbfc4cf58b14f9ee3fc9e8
+  backport: b13c030fd2b3a061d1659003a770b3986c24f7b5
+34925d01baf3ee62ab21c21efd9e2c44c24c004a:
+  title: 'Revert "tracing/trigger: Fix to return error if failed to alloc snapshot"'
+  mainline: 0958b33ef5a04ed91f61cef4760ac412080c4e08
+  backport: 638cc92651d52087ea7e22c3cee5dfaa472e835b
+97f097a8091261ffa07c8889550c4026e59b6c14:
+  title: 'netfilter: nf_tables: __nft_expr_type_get() selects specific family type'
+  mainline: 9cff126f73a7025bcb0883189b2bed90010a57d4
+  backport: cf9d94023df9b8d5ee9885351ac7b0bb280a39da
+939109c0a8e2a006a6cc8209e262d25065f4403a:
+  title: 'netfilter: nf_tables: Fix potential data-race in __nft_expr_type_get()'
+  mainline: f969eb84ce482331a991079ab7a5c4dc3b7f89bf
+  backport: 59c0769283b97b4a2e14c2846703d5ef9a10c86e
+68459b8e3ee554ce71878af9eb69659b9462c588:
+  title: 'tun: limit printing rate when illegal packet received by tun dev'
+  mainline: f8bbc07ac535593139c875ffa19af924b1084540
+  backport: eaa8c23a83b5a719ac9bc795481595bbfc02fc18
+4d0f5f7f583875236ccc649825cdc7cdadccd1f9:
+  title: 'RDMA/mlx5: Fix port number for counter query in multi-port configuration'
+  mainline: be121ffb384f53e966ee7299ffccc6eeb61bc73d
+  skipped: fixes patch not in branch
+c2b97f26f081ceec3298151481687071075a25cb:
+  title: 'drm: nv04: Fix out of bounds access'
+  mainline: cf92bb778eda7830e79452c6917efa8474a30c1e
+  backport: cfe1ce127436f4025381610721ccca95be5661eb
+3a63ae0348d990e137cca04eced5b08379969ea9:
+  title: 'comedi: vmk80xx: fix incomplete endpoint checking'
+  mainline: d1718530e3f640b7d5f0050e725216eab57a85d8
+  backport: 40aa14ae1d3360c716476ef5bf841e83b4044a74
+69a02273e288011b521ee7c1f3ab2c23fda633ce:
+  title: 'serial/pmac_zilog: Remove flawed mitigation for rx irq flood'
+  mainline: 1be3226445362bfbf461c92a5bcdb1723f2e4907
+  backport: e9606f845b0e6e58ea7f0a1cb83f3ca8b6c22c27
+9a5402ed97bc701eef3d1f04cad469604aaae0ad:
+  title: 'USB: serial: option: add Fibocom FM135-GL variants'
+  mainline: 356952b13af5b2c338df1e06889fd1b5e12cbbf4
+  backport: 32343abd61668292ae454465c0b9f5afb5560d0d
+5809919a53225cb041d171661af398de05fd5499:
+  title: 'USB: serial: option: add support for Fibocom FM650/FG650'
+  mainline: fb1f4584b1215e8c209f6b3a4028ed8351a0e961
+  backport: 2f8adbc57c1c78ec6d9d12bf3cd5924e1d11b98b
+6efc183ddca84d2d67db97243897c9c01dae3941:
+  title: 'USB: serial: option: add Lonsung U8300/U9300 product'
+  mainline: cf16ffa17c398434a77b8a373e69287c95b60de2
+  backport: 7a6940c22f654a3953351f2e6d4f990a18293284
+44af06ae8bc16e7b325029dc1da51c68169d395d:
+  title: 'USB: serial: option: support Quectel EM060K sub-models'
+  mainline: c840244aba7ad2b83ed904378b36bd6aef25511c
+  backport: 1ce24d37d83eb52cd418553e5e364234d2eb301c
+19301bdc1d265877e47bba58cb58738e51efb120:
+  title: 'USB: serial: option: add Rolling RW101-GL and RW135-GL support'
+  mainline: 311f97a4c7c22a01f8897bddf00428dfd0668e79
+  backport: 2193ac5e795e5513c453c321c8eeb5a0a5e63a5c
+36c159eded196bbca23f0f344202815528545d2d:
+  title: 'USB: serial: option: add Telit FN920C04 rmnet compositions'
+  mainline: 582ee2f9d268d302595db3e36b985e5cbb93284d
+  backport: 5f912f0cb02da4f3c48151fbaa4490f695556cc5
+347cca11bb78b9f3c29b45a9c52e70258bd008bf:
+  title: 'Revert "usb: cdc-wdm: close race between read and workqueue"'
+  mainline: 1607830dadeefc407e4956336d9fcd9e9defd810
+  backport: 519eedb563740160edd7c1a150b730c311d2a1f5
+257d313e37d66c3bcc87197fb5b8549129c45dfe:
+  title: 'usb: dwc2: host: Fix dereference issue in DDMA completion flow.'
+  mainline: eed04fa96c48790c1cce73c8a248e9d460b088f8
+  backport: ccbc9d463cf6f7c018cb20bb05bc98483c63eaaa
+756c5cb7c09e537b87b5d3acafcb101b2ccf394f:
+  title: 'speakup: Avoid crash on very long word'
+  mainline: c8d2f34ea96ea3bce6ba2535f867f0d4ee3b22e1
+  backport: 68e8ffca8bcb4619d8a20a711cf51a3464530790
+f28bba37fe244889b81bb5c508d3f6e5c6e342c5:
+  title: 'fs: sysfs: Fix reference leak in sysfs_break_active_protection()'
+  mainline: a90bca2228c0646fc29a72689d308e5fe03e6d78
+  backport: 8005cde96bd7db2593c25a75b9a2ccb18087cf8e
+bba8ec5e9b16649d85bc9e9086bf7ae5b5716ff9:
+  title: 'nouveau: fix instmem race condition around ptr stores'
+  mainline: fff1386cc889d8fb4089d285f883f8cba62d82ce
+  skipped: fixes patch not in branch
+054f29e9ca05be3906544c5f2a2c7321c30a4243:
+  title: 'nilfs2: fix OOB in nilfs_set_de_type'
+  mainline: c4a7dc9523b59b3e73fd522c73e95e072f876b16
+  backport: 66881703734d16aba33608bf449cc2586b6a51fc
+d74f1a1f913b4a1592dec3cc30640ddd9f8aeda4:
+  title: 'tracing: Remove hist trigger synth_var_refs'
+  mainline: 912201345f7c39e6b0ac283207be2b6641fa47b9
+  skipped: commit did not cherry-pick cleanly
+3dc763bdb05ea12afafb5af62cf37e88d8f7f6dd:
+  title: 'tracing: Use var_refs[] for hist trigger reference checking'
+  mainline: e4f6d245031e04bdd12db390298acec0474a1a46
+  skipped: commit did not cherry-pick cleanly
+e0fbabb4865a9f2eebfa8688765fd6fd76185bba:
+  title: 'arm64: dts: rockchip: fix alphabetical ordering RK3399 puma'
+  mainline: f0abb4b2c7acf3c3e4130dc3f54cd90cf2ae62bc
+  backport: f2b908139433610ec7b0803abd46fcf0b3b43fb4
+8ada42c66029ee8ec7918b2a5bb2feb9dbe461f1:
+  title: 'arm64: dts: rockchip: enable internal pull-up on PCIE_WAKE# for RK3399 Puma'
+  mainline: 945a7c8570916650a415757d15d83e0fa856a686
+  backport: 655536c706fd7a9534ac7aec8a63a178d62fe415
+19e43d5a9e9439dcf2cbb7a8ecb7cfd725968f8f:
+  title: 'arm64: dts: mediatek: mt7622: fix IR nodename'
+  mainline: 800dc93c3941e372c94278bf4059e6e82f60bd66
+  skipped: fixes patch not in branch
+f81938d0666c0e812d72b8ba9127fb7577ab393a:
+  title: 'arm64: dts: mediatek: mt7622: fix ethernet controller "compatible"'
+  mainline: 208add29ce5b7291f6c466e4dfd9cbf61c72888e
+  skipped: fixes patch not in branch
+084db3d6ec6f934b7678afac57fcdb32b7c99dbf:
+  title: 'arm64: dts: mediatek: mt7622: drop "reset-names" from thermal block'
+  mainline: ecb5b0034f5bcc35003b4b965cf50c6e98316e79
+  skipped: fixes patch not in branch
+60874cc9e4d57c357266ad8b1b1b3b960be8af77:
+  title: 'ARC: [plat-hsdk]: Remove misplaced interrupt-cells property'
+  mainline: 61231eb8113ce47991f35024f9c20810b37996bf
+  backport: ed92aae0da0019d4e7db47d37501752a7affbaa3
+961711809db16bcf24853bfb82653d1b1b37f3bf:
+  title: 'vxlan: drop packets from invalid src-address'
+  mainline: f58f45c1e5b92975e91754f5407250085a6ae7cf
+  backport: 61c51e051a59e94a3c62f81c01f949e94958559e
+4235cc4d207b535969eef8f3e610f9caafac7295:
+  title: 'mlxsw: core: Unregister EMAD trap using FORWARD action'
+  mainline: 976c44af48141cd8595601c0af2a19a43c5b228b
+  backport: 8a7045c992202504ab6a4f059f662f83463ace78
+33ba7baa3cba4b49190635ff883770dd2ae5a3e5:
+  title: 'NFC: trf7970a: disable all regulators on removal'
+  mainline: 6bea4f03c6a4e973ef369e15aac88f37981db49e
+  backport: 52ada5a71f0a8be64f0ddaa20583efcf6e8e0411
+571d30b27680591a576c29782617d95820e765ee:
+  title: 'net: usb: ax88179_178a: stop lying about skb->truesize'
+  mainline: 4ce62d5b2f7aecd4900e7d6115588ad7f9acccca
+  backport: 49adc83f7ee5de31ecf4715cf3c1ee131b957815
+07b20d0a3dc13fb1adff10b60021a4924498da58:
+  title: 'net: gtp: Fix Use-After-Free in gtp_dellink'
+  mainline: f2a904107ee2b647bb7794a1a82b67740d7c8a64
+  backport: a4fb866fbb951f1c5908c99221021a6e923ee72e
+740a06078ac58840494934ace6055eb879f267fb:
+  title: 'ipvs: Fix checksumming on GSO of SCTP packets'
+  mainline: e10d3ba4d434ed172914617ed8d74bd411421193
+  backport: 02cac8715a217aa9d6e76a4dca2e0f2d8242f832
+fb885da71cc33a6487f142e016e7cd44d70cb8a6:
+  title: 'net: openvswitch: ovs_ct_exit to be done under ovs_lock'
+  mainline: 27de77cec985233bdf6546437b9761853265c505
+  skipped: fixes patch not in branch
+2db9a8c0a01fa1c762c1e61a13c212c492752994:
+  title: 'net: openvswitch: Fix Use-After-Free in ovs_ct_exit'
+  mainline: 5ea7b72d4fac2fdbc0425cd8f2ea33abe95235b2
+  skipped: fixes patch not in branch
+09b54d29f05129b092f7c793a70b689ffb3c7b2c:
+  title: 'i40e: Do not use WQ_MEM_RECLAIM flag for workqueue'
+  mainline: 2cc7d150550cc981aceedf008f5459193282425c
+  backport: bca56f5107b108ae5c63b5478b0ebaeab77cf5ac
+dcc8ed283f841e217ad23a65453f7b8c6068d6c5:
+  title: 'serial: core: Provide port lock wrappers'
+  mainline: b0af4bcb49464c221ad5f95d40f2b1b252ceedcc
+  backport: c112e92e7e9009b25113d00c387517474d00350f
+56434e295bd446142025913bfdf1587f5e1970ad:
+  title: 'serial: mxs-auart: add spinlock around changing cts state'
+  mainline: 54c4ec5f8c471b7c1137a1f769648549c423c026
+  backport: 7b5287213ee5429e42b281d104e07e08d50c2d9a
+605134e35a72a8cf1ff1cf433664a2b4a4924488:
+  title: 'drm/amdgpu: restrict bo mapping within gpu address limits'
+  mainline: 8b80d74bdb2285d3022b349c8451eb16535f7906
+  backport: 06da784dbd29c1e42dd9ced075d829704914864b
+82aace80cfaab778245bd2f9e31b67953725e4d0:
+  title: 'amdgpu: validate offset_in_bo of drm_amdgpu_gem_va'
+  mainline: 9f0bcf49e9895cb005d78b33a5eebfa11711b425
+  backport: 5dd0e09eeab9c87b6a91fcf9ef0b10295d68ff2d
+d4da6b084f1c5625937d49bb6722c5b4aef11b8d:
+  title: 'drm/amdgpu: validate the parameters of bo mapping operations more clearly'
+  mainline: 6fef2d4c00b5b8561ad68dd2b68173f5c6af1e75
+  backport: 3e99e112aa1d6c9af57da0446cef785190e95634
+69dc8fc8307640b717b37056549d88a664273206:
+  title: 'Revert "crypto: api - Disallow identical driver names"'
+  mainline: 27016f75f5ed47e2d8e0ca75a8ff1f40bc1a5e27
+  backport: a039a95bde00995c63312c1870c870187dcaa60f
+78b92d50fe6ab79d536f4b12c5bde15f2751414d:
+  title: 'tracing: Show size of requested perf buffer'
+  mainline: a90afe8d020da9298c98fddb19b7a6372e2feb45
+  backport: e3b3f139e8a216c0dc590c0349a0824c1918ed86
+c8d5402dcd1834747bb3dbd9b6fe51defd3d636b:
+  title: 'tracing: Increase PERF_MAX_TRACE_SIZE to handle Sentinel1 and docker together'
+  mainline: e531e90b5ab0f7ce5ff298e165214c1aec6ed187
+  backport: edc56d2275828b9e3a8258681c30bb666cfdf8f7
+92d26492b4acdc05a3ad1f7795b6cae91292b00d:
+  title: 'Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old()'
+  mainline: 9bf4e919ccad613b3596eebf1ff37b05b6405307
+  backport: 75613ba0ee43c74bb35bb8f80961e8e0ea496f9f
+689efe22e9b5b7d9d523119a9a5c3c17107a0772:
+  title: 'btrfs: fix information leak in btrfs_ioctl_logical_to_ino()'
+  mainline: 2f7ef5bb4a2f3e481ef05fab946edb97c84f67cf
+  backport: cccd878ed43e046f7dc286fb677079dd801d2626
+6d5692510d683ab57f81f82fd3d5282e33dd416f:
+  title: 'arm64: dts: rockchip: enable internal pull-up for Q7_THRM# on RK3399 Puma'
+  mainline: 0ac417b8f124427c90ec8c2ef4f632b821d924cc
+  backport: 336db5bbf15c2e86555a7b369f8faa7b3d4abe0f
+f5417ff561b8ac9a7e53c747b8627a7ab58378ae:
+  title: 'irqchip/gic-v3-its: Prevent double free on error'
+  mainline: c26591afd33adce296c022e3480dea4282b7ef91
+  backport: 94db4962aa554ced828a4fbee5e96941a3fb2e7f
+1aeede3a0217741120725c4c9cebf039c6fff7ef:
+  title: 'net: b44: set pause params only when interface is up'
+  mainline: e3eb7dd47bd4806f00e104eb6da092c435f9fb21
+  backport: 98b91fb5ede664960c3890efcd2f952affb11dee
+79b25b1a58d0a6b53dfd685bca8a1984c86710dd:
+  title: 'stackdepot: respect __GFP_NOLOCKDEP allocation flag'
+  mainline: 6fe60465e1d53ea321ee909be26d97529e8f746c
+  backport: 9485c0dda576f58a9579b81e4d10b72bebda58de
+153adb5d7878d18e2b9be173996034f858fbce8e:
+  title: 'mtd: diskonchip: work around ubsan link failure'
+  mainline: 21c9fb611c25d5cd038f6fe485232e7884bb0b3d
+  backport: cd3a5b7416bf89cb599e05f6e81e519211413cba
+9f06ebd1daf5914afb21b95781cf637a025e9f9a:
+  title: 'tcp: Clean up kernel listener''s reqsk in inet_twsk_purge()'
+  mainline: 740ea3c4a0b2e326b23d7cdf05472a0e92aa39bc
+  skipped: fixes patch not in branch
+4212fa80f700b06358a13cc7ea9d25788beff877:
+  title: 'tcp: Fix NEW_SYN_RECV handling in inet_twsk_purge()'
+  mainline: 1c4e97dd2d3c9a3e84f7e26346aa39bc426d3249
+  skipped: fixes patch not in branch
+2628eb4bcc87953b3d10b5babde75853f38ad8fe:
+  title: 'dmaengine: owl: fix register access functions'
+  mainline: 43c633ef93a5d293c96ebcedb40130df13128428
+  skipped: fixes patch not in branch
+ffe3f362de3479f5d75a97a7004a279a650ee7cd:
+  title: 'idma64: Don''t try to serve interrupts when device is powered off'
+  mainline: 9140ce47872bfd89fca888c2f992faa51d20c2bc
+  backport: 063e3bb968e0b88dfd0eca06c56d3eb95b43e40b
+40f1d79f07b49c8a64a861706e5163f2db4bd95d:
+  title: 'i2c: smbus: fix NULL function pointer dereference'
+  mainline: 91811a31b68d3765b3065f4bb6d7d6d84a7cfc9f
+  backport: c8c86b3d8008e24fba2c5956a2849ed47c9ce817
+21bfca822cfc1e71796124e93b46e0d9fa584401:
+  title: 'HID: i2c-hid: remove I2C_HID_READ_PENDING flag to prevent lock-up'
+  mainline: 9c0f59e47a90c54d0153f8ddc0f80d7a36207d0e
+  backport: 674f9950629e4a2071b81cd12e58e5e190754121
+9bc1f1791de3cb5e3073bd8c5811d0d02b7dde31:
+  title: 'Revert "loop: Remove sector_t truncation checks"'
+  mainline: 083a6a50783ef54256eec3499e6575237e0e3d53
+  skipped: reverted patch is not in branch
+271b53d629d6329f1d99177b0590dce7c3cbf28b:
+  title: 'Revert "y2038: rusage: use __kernel_old_timeval"'
+  mainline: bdd565f817a74b9e30edec108f7cb1dbc762b8a6
+  skipped: reverted patch is not in branch
+4fc0b7838c253cf443de3a40a9acb224377740e6:
+  title: 'udp: preserve the connected status if only UDP cmsg'
+  mainline: 680d11f6e5427b6af1321932286722d24a8b16c1
+  skipped: fixes patch not in branch
+6e5937b23a13ce6bbe8bf17319efa34598f1650a:
+  title: 'serial: core: fix kernel-doc for uart_port_unlock_irqrestore()'
+  mainline: 29bff582b74ed0bdb7e6986482ad9e6799ea4d2f
+  backport: 67c9c69cedb11331c684e306485b2767c9ed0ffc

diff --git a/.elts/upstream/4.19.314.yaml b/.elts/upstream/4.19.314.yaml
new file mode 100644
index 0000000..e3bfa85
--- /dev/null
+++ b/.elts/upstream/4.19.314.yaml

@@ -0,0 +1,244 @@
+e588495c211a58a593c0b35bde105e50a80f1587:
+  title: 'dmaengine: pl330: issue_pending waits until WFP state'
+  mainline: 22a9d9585812440211b0b34a6bc02ade62314be4
+  backport: 7a2c5465ee29605fd2c0c2a6d22f8e9787cc93b4
+15097ae79c7231684158d7fd6306853e7042979d:
+  title: 'dmaengine: Revert "dmaengine: pl330: issue_pending waits until WFP state"'
+  mainline: afc89870ea677bd5a44516eb981f7a259b74280c
+  backport: 1be5dfb4ae2059ec9c905e05c28525082863a716
+327382dc0f16b268950b96e0052595efd80f7b0a:
+  title: 'wifi: nl80211: don''t free NULL coalescing rule'
+  mainline: 801ea33ae82d6a9d954074fbcf8ea9d18f1543a7
+  backport: de3ac5d3e761015a4e4ad472aac54347deae0b60
+c8fd5450e40b07e5a9805b74f97a8f83c23516c6:
+  title: 'drm/amdkfd: change system memory overcommit limit'
+  mainline: 5d240da93edc29adb68320c5e475dc9c7fcad5dd
+  skipped: code is not present in 4.14
+b0b59d1e86b7997fa625585432220c796064df64:
+  title: 'drm/amdgpu: Fix leak when GPU memory allocation fails'
+  mainline: 25e9227c6afd200bed6774c866980b8e36d033af
+  skipped: code is not present in 4.14
+a82fcda87f9ba6ca65d8c0020de72237d5462766:
+  title: 'net: slightly optimize eth_type_trans'
+  mainline: 45cf7959c30402d7c4ea43568a6f1bab0ba6ca63
+  backport: 52cab27f08d73efcb58ca69bb59475c2809abb21
+51fcea1b7c52abc3ff5af354e199731582a34ebf:
+  title: 'ethernet: add a helper for assigning port addresses'
+  mainline: e80094a473eefad9d856ce3ab0d7afdbb64800c4
+  backport: 36bdbf757991cf19077cac99ee29f44e4164ffcf
+3d63a6c77b51c1a7cef2987a7f70ec9d91b04d95:
+  title: 'ethernet: Add helper for assigning packet type when dest address does not match device address'
+  mainline: 6e159fd653d7ebf6290358e0330a0cb8a75cf73b
+  backport: ba10f69d1e654aff90e015383bfd641dc8556e5a
+735f4c6b6771eafe336404c157ca683ad72a040d:
+  title: 'pinctrl: core: delete incorrect free in pinctrl_enable()'
+  mainline: 5038a66dad0199de60e5671603ea6623eb9e5c79
+  backport: bdf517d3858a65b97d7f0d7df1acbc6ba5766bfd
+c8d8b7f650b5bfddd9ac8b39fa3455716ddcbaff:
+  title: 'power: rt9455: hide unused rt9455_boost_voltage_values'
+  mainline: 452d8950db3e839aba1bb13bc5378f4bac11fa04
+  backport: 525562e5df5cc30f7d0e86974730550a7753941f
+06780473cb8a858d1d6cab2673e021b072a852d1:
+  title: 'pinctrl: devicetree: fix refcount leak in pinctrl_dt_to_map()'
+  mainline: a0cedbcc8852d6c77b00634b81e41f17f29d9404
+  backport: b290fe8f786a5c701623bc3a4522f728ff6511ad
+655cbe1d4efe7c0844fce26c916cbf546be2abab:
+  title: 's390/mm: Fix storage key clearing for guest huge pages'
+  mainline: 843c3280686fc1a83d89ee1e0b5599c9f6b09d0c
+  skipped: fixes patch not in branch
+fd7600f333253e8c264f72736316bf8c4a253000:
+  title: 's390/mm: Fix clearing storage keys for huge pages'
+  mainline: 412050af2ea39407fe43324b0be4ab641530ce88
+  skipped: fixes patch not in branch
+bd502ba81cd1d515deddad7dbc6b812b14b97147:
+  title: 'bna: ensure the copied buf is NUL terminated'
+  mainline: 8c34096c7fdf272fd4c0c37fe411cd2e3ed0ee9f
+  backport: 6e4174bf8ee5e72fa57859378ac90172b5a4ee88
+a7c2c3c1caabcb4a3d6c47284c397507aaf54fe9:
+  title: 'nsh: Restore skb->{protocol,data,mac_header} for outer header in nsh_gso_segment().'
+  mainline: 4b911a9690d72641879ea6d13cce1de31d346d79
+  backport: 945365c6ab9e246eaa46aa79d0e090c43e983191
+b6e4b93edc0100a88d7d4f3140bba25a529c5166:
+  title: 'net l2tp: drop flow hash on forward'
+  mainline: 42f853b42899d9b445763b55c3c8adc72be0f0e1
+  backport: f3cbc47fef3fd6e96761cb7986e48698353fc74c
+4b1f3253bfa5a709d0c0003e3272c5a284a36771:
+  title: 'net: dsa: mv88e6xxx: Add number of MACs in the ATU'
+  mainline: d9ea56206c4df77175321874544eb4ca48c0bac8
+  backport: f2c7931f8a50c6da3a1f5ec513b2f8b3c52919e0
+0c27eb63bd9feaf34ec3049873c1b1889b569a85:
+  title: 'net: dsa: mv88e6xxx: Fix number of databases for 88E6141 / 88E6341'
+  mainline: b9a61c20179fda7bdfe2c1210aa72451991ab81a
+  backport: 8bba49c34aecc6bed2a9a282710963f4af19460d
+01386957ca757e31fb66caceb303f71f9e577b83:
+  title: 'net: bridge: fix multicast-to-unicast with fraglist GSO'
+  mainline: 59c878cbcdd80ed39315573b3511d0acfd3501b5
+  backport: 74703c09c98e094af2885ff2ff052d66b2731fe4
+01cd1b7b685751ee422d00d050292a3d277652d6:
+  title: 'tipc: fix a possible memleak in tipc_buf_append'
+  mainline: 97bf6f81b29a8efaf5d0983251a7450e5794370d
+  backport: f6d438b693a934d982288ee2eee89e9e30bb8a18
+b241595d3d09d24c60cd9e594dc81fa1b0f6b280:
+  title: 'scsi: lpfc: Update lpfc_ramp_down_queue_handler() logic'
+  mainline: bb011631435c705cdeddca68d5c85fd40a4320f9
+  backport: 17f4f66e30c9de03ade16f70122bbab83424be13
+9ad9c16eb4fb56bf0ff33c3b06b101e400a87586:
+  title: 'gfs2: Fix invalid metadata access in punch_hole'
+  mainline: c95346ac918c5badf51b9a7ac58a26d3bd5bb224
+  skipped: too invasive backport
+fd10730c905db4e7984109f1342d9aa43ee63c8f:
+  title: 'wifi: mac80211: fix ieee80211_bss_*_flags kernel-doc'
+  mainline: 774f8841f55d7ac4044c79812691649da203584a
+  backport: 4f09d935a3265126515304a5496b7dee43998e85
+9e7538cb8131946817218f793ceb334c63cfcdb8:
+  title: 'net: mark racy access on sk->sk_rcvbuf'
+  mainline: c2deb2e971f5d9aca941ef13ee05566979e337a4
+  backport: b6f6bed5092bdbc36b99ee09a6b07a00bf0f6012
+468f3e3c15076338367b0945b041105b67cf31e3:
+  title: 'scsi: bnx2fc: Remove spin_lock_bh while releasing resources after upload'
+  mainline: c214ed2a4dda35b308b0b28eed804d7ae66401f9
+  backport: e5f7fdcb7c0455dc9dd4d9de1729261dc7f215a2
+c957c9432f957007fef152a3efc9aabe4337ef4a:
+  title: 'ALSA: line6: Zero-initialize message buffers'
+  mainline: c4e51e424e2c772ce1836912a8b0b87cd61bc9d5
+  backport: 7a1f974c7345abc254eaad100b67e2093c68fcba
+510e7b18fdad4b55849d7a73b8ff2c3e8ad2f7af:
+  title: 'net: bcmgenet: Reset RBUF on first open'
+  mainline: 0a6380cb4c6b5c1d6dad226ba3130f9090f0ccea
+  backport: c4cefd5df74348cc94d3b934e448c9dd5ab64416
+47325095299e50d274da30525f7b41d638c22a8e:
+  title: 'ata: sata_gemini: Check clk_enable() result'
+  mainline: e85006ae7430aef780cc4f0849692e266a102ec0
+  backport: 532051585e477a5ef3e62ad8f006288b18cd5727
+b3948c69d60279fce5b2eeda92a07d66296c8130:
+  title: 'firewire: ohci: mask bus reset interrupts between ISR and bottom half'
+  mainline: 752e3c53de0fa3b7d817a83050b6699b8e9c6ec9
+  backport: 3b969e6e4d466989104ad6d6f95296b9e9f37d54
+e13c8b6b8675c7848e54145b77e7c0d2c52a3422:
+  title: 'tools/power turbostat: Fix added raw MSR output'
+  mainline: e5f4e68eed85fa8495d78cd966eecc2b27bb9e53
+  backport: 5c0a4f90868a9e879228c6ed8d058ee8f1c70213
+5225091f94af36e1dddc5bc71abd317dcac4847e:
+  title: 'tools/power turbostat: Fix Bzy_MHz documentation typo'
+  mainline: 0b13410b52c4636aacb6964a4253a797c0fa0d16
+  backport: 096fb209120164d95c7046009ee24600fdb0eb43
+6cc901559e108dfb0b8818bfa6f5d9728ad3c8a0:
+  title: 'btrfs: make btrfs_clear_delalloc_extent() free delalloc reserve'
+  mainline: 3c6f0c5ecc8910d4ffb0dfe85609ebc0c91c8f34
+  skipped: not applicable
+958e39ae2d334b3d1f6d10cb1eea705608a744eb:
+  title: 'btrfs: always clear PERTRANS metadata during commit'
+  mainline: 6e68de0bb0ed59e0554a0c15ede7308c47351e2d
+  skipped: not applicable
+2c9cb7a564bdd454df694b8e08eecbf925199eac:
+  title: 'scsi: target: Fix SELinux error when systemd-modules loads the target module'
+  mainline: 97a54ef596c3fd24ec2b227ba8aaf2cf5415e779
+  backport: 89b804f254ae731be5f86e671b3ac126f2f452a8
+968908c39d985bc636e069769772155f66586664:
+  title: 'selftests: timers: Fix valid-adjtimex signed left-shift undefined behavior'
+  mainline: 076361362122a6d8a4c45f172ced5576b2d4a50d
+  backport: 3fc20d8d310b70b29dca23bf8733cd18d08e1ec4
+e90bc596a74bb905e0a45bf346038c3f9d1e868d:
+  title: 'fs/9p: only translate RWX permissions for plain 9P2000'
+  mainline: cd25e15e57e68a6b18dc9323047fe9c68b99290b
+  backport: 99b4d7e3ea1c9056962bafc600bbed0ba6035e91
+0ce2676013818e62b18504d39211b65d8b54bc24:
+  title: 'fs/9p: translate O_TRUNC into OTRUNC'
+  mainline: 87de39e70503e04ddb58965520b15eb9efa7eef3
+  backport: 83f6d606db87a09db262083d62866aa1eb8309e2
+1b90be6698e8d67a2edb8d260e9654d539e7cb51:
+  title: '9p: explicitly deny setlease attempts'
+  mainline: 7a84602297d36617dbdadeba55a2567031e5165b
+  backport: 8b2c6a57cf512e211fdeb0bd08938647547b7639
+a0c966b4d7fe7d701d31aebbd3cc32d1e7ee266e:
+  title: 'gpio: wcove: Use -ENOTSUPP consistently'
+  mainline: 0c3b532ad3fbf82884a2e7e83e37c7dcdd4d1d99
+  backport: 48c6238101a2be011c58503b7fbe9c6ded8afac3
+e4c744a9c1da845faecba1532ba70154630b94ed:
+  title: 'gpio: crystalcove: Use -ENOTSUPP consistently'
+  mainline: ace0ebe5c98d66889f19e0f30e2518d0c58d0e04
+  backport: d7cb3d68d0dd185840ff94aca7e798229de8d0dc
+cc3d6fbd645449298d03d96006e3e9bcae00bc1a:
+  title: 'fs/9p: drop inodes immediately on non-.L too'
+  mainline: 7fd524b9bd1be210fe79035800f4bd78a41b349f
+  backport: 7fdb44bf63d8d7e30340c10846aeaeeeb9530ba5
+a1a3346ef3e9a7fa0954903355bc4366e72da9a3:
+  title: 'net:usb:qmi_wwan: support Rolling modules'
+  mainline: d362046021ea122309da8c8e0b6850c792ca97b5
+  backport: 4d26ff1d302a1cfb1a6ec136b4e88b18605a266a
+6f7082e284ec3fa32694e5704da510194229ef12:
+  title: 'tcp: remove redundant check on tskb'
+  mainline: d1edc085559744fbda7a55e97eeae8bd6135a11b
+  backport: 22dc505fb63ec90f4f89fd3f6b58cad1c68e059c
+34e41a031fd7523bf1cd00a2adca2370aebea270:
+  title: 'tcp: defer shutdown(SEND_SHUTDOWN) for TCP_SYN_RECV sockets'
+  mainline: 94062790aedb505bdda209b10bea47b294d6394f
+  backport: 426be5e0e2e245b5f7aa5c8b735f7350e41e3ba7
+84546cc1aeeb4df3e444b18a4293c9823f974be9:
+  title: 'tcp: Use refcount_inc_not_zero() in tcp_twsk_unique().'
+  mainline: f2db7230f73a80dbb179deab78f88a7947f0ab7e
+  skipped: fixes patch not in branch
+1b33d55fb7355e27f8c82cd4ecd560f162469249:
+  title: 'Bluetooth: Fix use-after-free bugs caused by sco_sock_timeout'
+  mainline: 483bc08181827fc475643272ffb69c533007e546
+  backport: 8f75b925397684e4842eed1ae96fa57c441bd283
+e137e2ba96e51902dc2878131823a96bf8e638ae:
+  title: 'Bluetooth: l2cap: fix null-ptr-deref in l2cap_chan_timeout'
+  mainline: adf0398cee86643b8eacde95f17d073d022f782c
+  backport: db1b3cb8b825fb48230e12d00652500c9fa29e2e
+8ac69ff2d0d5be9734c4402de932aa3dc8549c1a:
+  title: 'rtnetlink: Correct nested IFLA_VF_VLAN_LIST attribute validation'
+  mainline: 1aec77b2bb2ed1db0f5efc61c4c1ca3813307489
+  backport: 5301db4a62df009136d5e53d6c9daf4d35a0049d
+ec1f71c05caeba0f814df77e0f511d8b4618623a:
+  title: 'phonet: fix rtm_phonet_notify() skb allocation'
+  mainline: d8cac8568618dcb8a51af3db1103e8d4cc4aeea7
+  backport: ada1bc85dc1c41f4d40845ea46ef94553db632a3
+e96b4e3e5e2d03e72d251aa46853cf609f4f8960:
+  title: 'net: bridge: fix corrupted ethernet header on multicast-to-unicast'
+  mainline: 86b29d830ad69eecff25b22dc96c14c6573718e6
+  backport: 71ccd14baaa895a643aac754b686592608eda7da
+4a5a573387da6a6b23a4cc62147453ff1bc32afa:
+  title: 'ipv6: fib6_rules: avoid possible NULL dereference in fib6_rule_action()'
+  mainline: d101291b2681e5ab938554e3e323f7a7ee33e3aa
+  backport: fd6963c88a807bea816c6b6eed4896715ac5c552
+c8a2b1f7208b0ea0a4ad4355e0510d84f508a9ff:
+  title: 'af_unix: Do not use atomic ops for unix_sk(sk)->inflight.'
+  mainline: 97af84a6bba2ab2b9c704c08e67de3b5ea551bb2
+  backport: 40d8d26e718b40b76be38e01998d92e982e6fe36
+a36ae0ec2353015f0f6762e59f4c2dbc0c906423:
+  title: 'af_unix: Fix garbage collector racing against connect()'
+  mainline: 47d8ac011fe1c9251070e1bd64cb10b48193ec51
+  backport: e987e6352bc9cbc7d925c7110aedd4c254bce439
+67f34f093c0f7bf33f5b4ae64d3d695a3b978285:
+  title: 'firewire: nosy: ensure user_length is taken into account when fetching packet contents'
+  mainline: 38762a0763c10c24a4915feee722d7aa6e73eb98
+  backport: 3e595e41a1d31b9dad72dc959b6e85bae59c62a9
+c037e0ebc0cabb1906203ca3322ad9dc7eeddc8e:
+  title: 'usb: gadget: composite: fix OS descriptors w_value logic'
+  mainline: ec6ce7075ef879b91a8710829016005dc8170f17
+  backport: 8ed9c2744b2925a670e1cacb329cf26029bad6b0
+af3f22e07de457965352950d1a535edbf84444f0:
+  title: 'usb: gadget: f_fs: Fix a race condition when processing setup packets.'
+  mainline: 0aea736ddb877b93f6d2dd8cf439840d6b4970a9
+  backport: 9c25fd19c4e377b891db0435e4ebcb264714bde7
+e19ec8ab0e25bc4803d7cc91c84e84532e2781bd:
+  title: 'tipc: fix UAF in error path'
+  mainline: 080cbb890286cd794f1ee788bbc5463e2deb7c2b
+  backport: 5fc482f94740a21c8101f0f7f01d7b42a895efc1
+3c718bddddca9cbef177ac475b94c5c91147fb38:
+  title: 'dyndbg: fix old BUG_ON in >control parser'
+  mainline: 00e7d3bea2ce7dac7bee1cf501fb071fd0ea8f6c
+  backport: 8aa195d14b00d30a14b28f066a0c0ca21d1b3bae
+2f527e3efd37c7c5e85e8aa86308856b619fa59f:
+  title: 'drm/vmwgfx: Fix invalid reads in fence signaled events'
+  mainline: a37ef7613c00f2d72c8fc08bd83fb6cc76926c8c
+  backport: 9804a24b7ac34a1ce3cbb9914940853a59997055
+3cdc34d76c4f777579e28ad373979d36c030cfd3:
+  title: 'net: fix out-of-bounds access in ops_init'
+  mainline: a26ff37e624d12e28077e5b24d2b264f62764ad6
+  backport: cc156d9fc5bcab07f124ade0fb47174c7c1efb65
+b29dcdd0582c00cd6ee0bd7c958d3639aa9db27f:
+  title: 'af_unix: Suppress false-positive lockdep splat for spin_lock() in __unix_gc().'
+  mainline: 1971d13ffa84a551d29a81fdf5b5ec5be166ac83
+  backport: bade56293ac77e3f0c05d39b9719cf42e75a7077

diff --git a/.elts/upstream/4.19.315.yaml b/.elts/upstream/4.19.315.yaml
new file mode 100644
index 0000000..307359f
--- /dev/null
+++ b/.elts/upstream/4.19.315.yaml

@@ -0,0 +1,70 @@
+aa62ab6ada92ba8780aa9355184720ee950242a7:
+  title: 'Revert "selftests: mm: fix map_hugetlb failure on 64K page size systems"'
+1ddc0c3f4996c4ca1216ede1fa7699a803204590:
+  title: 'dm: limit the number of targets and parameter size area'
+  mainline: bd504bcfec41a503b32054da5472904b404341a4
+  backport: dcd987848b62bdf1bbc0a44b0af4d42c364e8d1e
+6ffbcb3704046668ede6551b236960597d71a005:
+  title: 'btrfs: add missing mutex_unlock in btrfs_relocate_sys_chunks()'
+  mainline: 9af503d91298c3f2945e73703f0e00995be08c30
+  backport: 30741c3b9f4e080264a6b52a95391902a9b71108
+e57b1e9a69dfc0cad4f338115a11ea676ec52447:
+  title: 'tracing: Simplify creation and deletion of synthetic events'
+  mainline: faacb361f271be4baf2d807e2eeaba87e059225f
+  skipped: not applicable to 4.14
+7d00580499a839de612fa06340141c5ae1018fb2:
+  title: 'tracing: Add unified dynamic event framework'
+  mainline: 5448d44c38557fc15d1c53b608a9c9f0e1ca8f86
+  skipped: not applicable to 4.14
+73b24eeb0eb3b349b33f8e2d8f5ef9c839b51fde:
+  title: 'tracing: Use dyn_event framework for synthetic events'
+  mainline: 7bbab38d07f3185fddf6fce126e2239010efdfce
+  skipped: not applicable to 4.14
+8f7139ab2b533aa03c5c8b7cd5f3119405e605e7:
+  title: 'tracing: Remove unneeded synth_event_mutex'
+  mainline: 0e2b81f7b52a1c1a8c46986f9ca01eb7b3c421f8
+  skipped: not applicable to 4.14
+13b957b785b0c58b99608c8b677368ed14e973ce:
+  title: 'tracing: Consolidate trace_add/remove_event_call back to the nolock functions'
+  mainline: 7e1413edd6194a9807aa5f3ac0378b9b4b9da879
+  skipped: not applicable to 4.14
+1415e7a48bb2a4418495fa2c6d94bbcb0b23ff33:
+  title: 'string.h: Add str_has_prefix() helper function'
+  mainline: 72921427d46bf9731a1ab7864adc64c43dfae29f
+  skipped: not applicable to 4.14
+03aacb9039bfd4ec096e6b2c91cd749242ed968e:
+  title: 'tracing: Use str_has_prefix() helper for histogram code'
+  mainline: 754481e6954cbef53f8bc4412ad48dde611e21d3
+  skipped: not applicable to 4.14
+b2aba66d3117e19481a4ac2f7263b78e1a2f5d7e:
+  title: 'tracing: Use str_has_prefix() instead of using fixed sizes'
+  mainline: b6b2735514bcd70ad1556a33892a636b20ece671
+  skipped: not applicable to 4.14
+647c999c9e03097855e64a409a297cef6422ab65:
+  title: 'tracing: Have the historgram use the result of str_has_prefix() for len of prefix'
+  mainline: 036876fa56204ae0fa59045bd6bbb2691a060633
+  skipped: not applicable to 4.14
+5dc8fe9c75f4ad8dfadef2e269b6e8f67a75c330:
+  title: 'tracing: Refactor hist trigger action code'
+  mainline: 7d18a10c316783357fb1b2b649cfcf97c70a7bee
+  skipped: not applicable to 4.14
+93b9409a082d1662b5ec8d5b6a6c47ab5dbecd9f:
+  title: 'tracing: Split up onmatch action data'
+  mainline: c3e49506a0f426a850675e39419879214060ca8b
+  skipped: not applicable to 4.14
+19ff3696807411eb05a3ece07397416ddb6c8263:
+  title: 'tracing: Generalize hist trigger onmax and save action'
+  mainline: 466f4528fbc692ea56deca278fa6aeb79e6e8b21
+  skipped: not applicable to 4.14
+3fe17266dba8f84e12758f1f6d057e733d2b52a8:
+  title: 'tracing: Remove unnecessary var_ref destroy in track_data_destroy()'
+  mainline: ff9d31d0d46672e201fc9ff59c42f1eef5f00c77
+  skipped: not applicable to 4.14
+512b9385201c7dec1b8d490711e9b578ae50525e:
+  title: 'serial: kgdboc: Fix NMI-safety problems from keyboard reset code'
+  mainline: b2aba15ad6f908d1a620fd97f6af5620c3639742
+  backport: 1d8ba83736394d3167acb51f49623624d74ac1e0
+4b431a786f0ca86614b2d00e17b313956d7ef035:
+  title: 'docs: kernel_include.py: Cope with docutils 0.21'
+  mainline: d43ddd5c91802a46354fa4c4381416ef760676e2
+  backport: fb341e5794b05a39dfaa8f073dc5a23072b09992

diff --git a/.elts/upstream/4.19.316.yaml b/.elts/upstream/4.19.316.yaml
new file mode 100644
index 0000000..a74d962
--- /dev/null
+++ b/.elts/upstream/4.19.316.yaml

@@ -0,0 +1,830 @@
+bfaadbda9b75e4726783f8ca55ceac1fedbf2deb:
+  title: 'x86/tsc: Trust initial offset in architectural TSC-adjust MSRs'
+  mainline: 455f9075f14484f358b3c1d6845b4a438de198a7
+  skipped: commit did not cherry-pick cleanly
+42f0a3f67158ed6b2908d2b9ffbf7e96d23fd358:
+  title: 'speakup: Fix sizeof() vs ARRAY_SIZE() bug'
+  mainline: 008ab3c53bc4f0b2f20013c8f6c204a3203d0b8b
+  backport: 8bb6ee62c33b1f281b98b2dd19f1d7249a1ee5ab
+b50932ea673b5a089a4bb570a8a868d95c72854e:
+  title: 'ring-buffer: Fix a race between readers and resize checks'
+  mainline: c2274b908db05529980ec056359fae916939fdaa
+  backport: a43f1f02b3a93c9a2da8ea92e4d6509d0a61ebd8
+0ca720bd1834c4577426d1fb5a75faa19aa089bf:
+  title: 'net: smc91x: Fix m68k kernel compilation for ColdFire CPU'
+  mainline: 5eefb477d21a26183bc3499aeefa991198315a2d
+  skipped: fixes patch not in branch
+072980bc50626c4557694ce54e3f6f2bde02b6e0:
+  title: 'nilfs2: fix unexpected freezing of nilfs_segctor_sync()'
+  mainline: 936184eadd82906992ff1f5ab3aada70cce44cee
+  backport: 39d470c1d65655756f7bc56eef30977466000040
+911d38be151921a5d152bb55e81fd752384c6830:
+  title: 'nilfs2: fix potential hang in nilfs_detach_log_writer()'
+  mainline: eb85dace897c5986bc2f36b3c783c6abb8a4292e
+  backport: 6696ef522ef729e48bb88e624f4b450cc48d0008
+9513d4148950b05bc99fa7314dc883cc0e1605e5:
+  title: 'tty: n_gsm: fix possible out-of-bounds in gsm0_receive()'
+  mainline: 47388e807f85948eefc403a8a5fdc5b406a65d5a
+  backport: 478b032b9b295f6e4d224766b1d74f3f8d8015f5
+5099e30dde0caffa9f0e2c41d7327fc3ed987fd5:
+  title: 'wifi: cfg80211: fix the order of arguments for trace events of the tx_rx_evt class'
+  mainline: 9ef369973cd2c97cce3388d2c0c7e3c056656e8a
+  backport: 0e454ea0aef962c0bc28aaec416c987c472ee16f
+25468fffbbd2b0f06b4b12d79ff56cc5c40bfd1f:
+  title: 'net: usb: qmi_wwan: add Telit FN920C04 compositions'
+  mainline: 0b8fe5bd73249dc20be2e88a12041f8920797b59
+  backport: 52bed87bdd7ff234fbf08cffb5805fec3753a574
+074218a00cf59abff526b79dcd34d461ce81ae4c:
+  title: 'drm/amd/display: Set color_mgmt_changed to true on unsuspend'
+  mainline: 2eb9dd497a698dc384c0dd3e0311d541eb2e13dd
+  skipped: file is not in 4.14.y
+5c50d2e998143ce00c0629dcaabd73c3d962545c:
+  title: 'ASoC: rt5645: Fix the electric noise due to the CBJ contacts floating'
+  mainline: 103abab975087e1f01b76fcb54c91dbb65dbc249
+  backport: 1de2264213019b0e94512027fedda73173da635e
+5af06b6c57a9bbfa9bd5421e28bcd5c571c5821e:
+  title: 'ASoC: dt-bindings: rt5645: add cbj sleeve gpio property'
+  mainline: 306b38e3fa727d22454a148a364123709e356600
+  backport: f5822a115c534c96bcde99428ab661088e193a09
+6d2d2aaae1faa64c2f803d6f11f4b2df3b3c2cff:
+  title: 'ASoC: da7219-aad: fix usage of device_get_named_child_node()'
+  mainline: e8a6a5ad73acbafd98e8fd3f0cbf6e379771bb76
+  backport: 6c8dd658875782d45f021c5015b9ec9bf5f5ff87
+c256b616067bfd6d274c679c06986b78d2402434:
+  title: 'crypto: bcm - Fix pointer arithmetic'
+  mainline: 2b3460cbf454c6b03d7429e9ffc4fe09322eb1a9
+  backport: 8355ba0b459240e847584f780402073b8236df46
+b7277844e7e367381b2377853afceb58427cf6fb:
+  title: 'firmware: raspberrypi: Use correct device for DMA mappings'
+  mainline: df518a0ae1b982a4dcf2235464016c0c4576a34d
+  backport: 09020d6f62421e7fd4240279ff30dde78a0300bc
+1c125b9287e58f364d82174efb167414b92b11f1:
+  title: 'ecryptfs: Fix buffer size for tag 66 packet'
+  mainline: 85a6a1aff08ec9f5b929d345d066e2830e8818e5
+  backport: 78f8f3e6cf95446a03837bb11a67c4c2569ced32
+7610fd35b74211ab8def4e124095e600a1ae945b:
+  title: 'nilfs2: fix out-of-range warning'
+  mainline: c473bcdd80d4ab2ae79a7a509a6712818366e32a
+  backport: 7ee6938a59b80751d7919f67a3c4fb585d3829f6
+63d5a72afbd1505f180e81bc72e056ceea28b43b:
+  title: 'parisc: add missing export of __cmpxchg_u8()'
+  mainline: c57e5dccb06decf3cb6c272ab138c033727149b5
+  backport: 72d5387b60255610eb6fd5c18bb819fc39cc8917
+4b713a1581b17a94a21699165a20d82eb0eca2dc:
+  title: 'crypto: ccp - Remove forward declaration'
+  mainline: 3512dcb4e6c64733871202c01f0ec6b5d84d32ac
+  backport: 7eb7c75444aa358909836ea7ff4f692a53b199f9
+ce8f89223c9552d18b118596a85fd6cc237bc0e9:
+  title: 'crypto: ccp - drop platform ifdef checks'
+  mainline: 42c2d7d02977ef09d434b1f5b354f5bc6c1027ab
+  backport: afb1d97ca2b2cdfa5f46e8eb9fc37934349bc34e
+77edda3c53d696fa30fa0352e18aad485716ffad:
+  title: 's390/cio: fix tracepoint subchannel type field'
+  mainline: 8692a24d0fae19f674d51726d179ad04ba95d958
+  skipped: fixes patch not in branch
+2904e1d9b64f72d291095e3cbb31634f08788b11:
+  title: 'jffs2: prevent xattr node from overflowing the eraseblock'
+  mainline: c6854e5a267c28300ff045480b5a7ee7f6f1d913
+  backport: 7375909839424727552bd0bb2022ca3db5c6ffe8
+54ee1f7e2ea06e5c5341dc54255881fa5d11b312:
+  title: 'null_blk: Fix missing mutex_destroy() at module removal'
+  mainline: 07d1b99825f40f9c0d93e6b99d79a08d0717bac1
+  backport: a28a74b9a53b5b25cde8cfbea4c071f7a1c9beed
+d4b9c764d48fa41caa24cfb4275f3aa9fb4bd798:
+  title: 'md: fix resync softlockup when bitmap size is less than array size'
+  mainline: f0e729af2eb6bee9eb58c4df1087f14ebaefe26b
+  skipped: fixes patch not in branch
+eb984e08100e42c20f05e425590ee1e78e092b9d:
+  title: 'power: supply: cros_usbpd: provide ID table for avoiding fallback match'
+  mainline: 0f8678c34cbfdc63569a9b0ede1fe235ec6ec693
+  skipped: file is not in 4.14.y
+52d3370e8022ce28cd8cf4d16c09245aa683d7fb:
+  title: 'nfsd: drop st_mutex before calling move_to_close_lru()'
+  mainline: 56c35f43eef013579c76c007ba1f386d8c2cac14
+  backport: 520ccb81e3976c1c21d19d43265958faad0aee46
+54e3970b1848856e49f8cd08751dcb010ac3296b:
+  title: 'wifi: ath10k: poll service ready message before failing'
+  mainline: e57b7d62a1b2f496caf0beba81cec3c90fad80d5
+  backport: 6faa6059493e8a857fe5c3b5e12a3ceec730cda3
+2487db16d4b9faead07b7825d33294e9e783791d:
+  title: 'x86/boot: Ignore relocations in .notes sections in walk_relocs() too'
+  mainline: 76e9762d66373354b45c33b60e9a53ef2a3c5ff2
+  backport: a2c3254bc18b8f7bea19a00d8e7ea4ec52e941c1
+6780fe28e415c84f81ee7fc30027e57105f0b136:
+  title: 'qed: avoid truncating work queue length'
+  mainline: 954fd908f177604d4cce77e2a88cc50b29bad5ff
+  skipped: fixes patch not in branch
+e6bfc88b60f0874a00b22f243a94a5e8601d5039:
+  title: 'scsi: ufs: qcom: Perform read back after writing reset bit'
+  mainline: c4d28e06b0c94636f6e35d003fa9ebac0a94e1ae
+  backport: 5b61b9cefdb45e69ab265050d603cdd30f3d089b
+ea2cebd3b66bffa2630e413553776a4dbdca641a:
+  title: 'scsi: ufs: cleanup struct utp_task_req_desc'
+  mainline: 391e388f853dad5d1d7462a31bb50ff2446e37f0
+  skipped: commit did not cherry-pick cleanly
+359975cbf2551e40130cc604e2753f65585b68d0:
+  title: 'scsi: ufs: add a low-level __ufshcd_issue_tm_cmd helper'
+  mainline: c6049cd98212dfe39f67fb411d18d53df0ad9436
+  skipped: commit did not cherry-pick cleanly
+bf144a2e3b5048e5a9e3baf19f54d5e865d578b4:
+  title: 'scsi: ufs: core: Perform read back after disabling interrupts'
+  mainline: e4a628877119bd40164a651d20321247b6f94a8b
+  backport: 936e250e7ec6cb3bad3a8aa3a699a625e62cb5a6
+8dfd79c1c31660549a03439d42794c138efa5432:
+  title: 'scsi: ufs: core: Perform read back after disabling UIC_COMMAND_COMPL'
+  mainline: 4bf3855497b60765ca03b983d064b25e99b97657
+  backport: c5a8d87d1f0792ab4f65cf240309a4effe22de01
+4654dfa98682444152aac9bcef50e0d5e114a135:
+  title: 'irqchip/alpine-msi: Fix off-by-one in allocation error path'
+  mainline: ff3669a71afa06208de58d6bea1cc49d5e3fcbd1
+  backport: 94707145849c4be8019d4f7b2cce86402f9f9127
+2e816914b5ba234c3815ca80bffd2f3b3a7de6b0:
+  title: 'ACPI: disable -Wstringop-truncation'
+  mainline: a3403d304708f60565582d60af4316289d0316a0
+  backport: 96f2e9bb5b58c10a84e2a0064c7dc88cdcfff4d8
+2d8f31aa03df040c58a2e4a0382b96269c1bf96a:
+  title: 'scsi: libsas: Fix the failure of adding phy with zero-address to port'
+  mainline: 06036a0a5db34642c5dbe22021a767141f010b7a
+  backport: 8734c83b6dae36fbe4d97f42409e04459426858c
+9fc44d44b3b8eadd8b797462c733eb6c63598e6f:
+  title: 'scsi: hpsa: Fix allocation size for Scsi_Host private data'
+  mainline: 504e2bed5d50610c1836046c0c195b0a6dba9c72
+  backport: 784e2dc0d9be9b2e2ff8e3d05713f4d82895a489
+8b434681a6e7b2cae1452f1932d59c069236e9d2:
+  title: 'x86/purgatory: Switch to the position-independent small code model'
+  mainline: cba786af84a0f9716204e09f518ce3b7ada8555e
+  skipped: fixes patch not in branch
+569da482fdec15251ff113462717182d85bd1665:
+  title: 'wifi: ath10k: Fix an error code problem in ath10k_dbg_sta_write_peer_debug_trigger()'
+  mainline: c511a9c12674d246916bb16c479d496b76983193
+  backport: 6541bba29a4584f20a372e98ca07659b1b971c3e
+7020f6ad57cfd532a106542c2015710170270d21:
+  title: 'wifi: ath10k: populate board data for WCN3990'
+  mainline: f1f1b5b055c9f27a2f90fd0f0521f5920e9b3c18
+  skipped: fixes patch not in branch
+880897e8a5ade054a04575e5d8cc2666da415ab4:
+  title: 'macintosh/via-macii: Remove BUG_ON assertions'
+  mainline: 5f93d7081a47e1972031ccf57c4b2779eee162fb
+  backport: d85d76f39ef8f74c3ce4b2084bc1d56b90f808ce
+d0aa752285c9a35ee1ae0f2a4da10c5ceb6c09b6:
+  title: 'macintosh/via-macii, macintosh/adb-iop: Clean up whitespace'
+  mainline: 47fd2060660e62b169990a6fcd9eb61bc1a85c5c
+  backport: fad0ed0dd7bf14e6c89489e1db0486828e45f563
+e4ff8bcfb2841fe4e17e5901578b632adb89036d:
+  title: 'macintosh/via-macii: Fix "BUG: sleeping function called from invalid context"'
+  mainline: d301a71c76ee4c384b4e03cdc320a55f5cf1df05
+  backport: 82b5124ff8448c3b27d5cf963d835806a4ec8726
+eb0f2fc3ff5806cc572cd9055ce7c52a01e97645:
+  title: 'wifi: carl9170: add a proper sanity check for endpoints'
+  mainline: b6dd09b3dac89b45d1ea3e3bd035a3859c0369a0
+  backport: e6c959db704b9f17b53d0d695ac791ddb180649b
+79ddf5f2020fd593d50f1363bb5131283d74f78f:
+  title: 'wifi: ar5523: enable proper endpoint verification'
+  mainline: e120b6388d7d88635d67dcae6483f39c37111850
+  backport: 0e282a437be278b5a28b5de56553710ca304877a
+8ed15460d8bbc517bf54b24c7694e6c0ff174968:
+  title: 'sh: kprobes: Merge arch_copy_kprobe() into arch_prepare_kprobe()'
+  mainline: 1422ae080b66134fe192082d9b721ab7bd93fcc5
+  backport: 08d55870d721795f5ca9affb641a9d77a5cde478
+3c37203af733254154602273a970cfb7400c223e:
+  title: 'Revert "sh: Handle calling csum_partial with misaligned data"'
+  mainline: b5319c96292ff877f6b58d349acf0a9dc8d3b454
+  backport: 3d986276f8b5fa0dc170e1b35f0659b9ba4b2cd0
+481fc0c8617304a67649027c4a44723a139a0462:
+  title: 'scsi: bfa: Ensure the copied buf is NUL terminated'
+  mainline: 13d0cecb4626fae67c00c84d3c7851f6b62f7df3
+  backport: 2461969d18d1b3a8ca40c5203819221813d2fa47
+1f84a2744ad813be23fc4be99fb74bfb24aadb95:
+  title: 'scsi: qedf: Ensure the copied buf is NUL terminated'
+  mainline: d0184a375ee797eb657d74861ba0935b6e405c62
+  backport: c2d34a41a30021d6947d93dee2373e98416296b8
+6bc4e51e8d8451d40ec092d01119287af2acffcf:
+  title: 'wifi: mwl8k: initialize cmd->addr[] properly'
+  mainline: 1d60eabb82694e58543e2b6366dae3e7465892a5
+  backport: ceee9c23ca78be8cbe0b677623554c14da4a8ffe
+c0aff9978bb6ead0aec382a2645a563a3dd2df38:
+  title: 'net: usb: sr9700: stop lying about skb->truesize'
+  mainline: 05417aa9c0c038da2464a0c504b9d4f99814a23b
+  backport: 2341a1b273189a5673cfbb6a5badecca8e25d24a
+2a8d1d95302c7d52c6ac8fa5cb4a6948ae0d3a14:
+  title: 'm68k: Fix spinlock race in kernel thread creation'
+  mainline: da89ce46f02470ef08f0f580755d14d547da59ed
+  backport: 314fdca9aa1eac5417fd9621bf4ebbacfd100e75
+c96430d59c71a0e5c641b5267ccf141c501fe15e:
+  title: 'm68k/mac: Use ''030 reset method on SE/30'
+  mainline: 9c0e91f6b701dce6902408d50c4df9cebe4744f5
+  backport: 4e23b79c4b130dd3049e3c0001d4926dcfacded5
+8055e882c57031a5ca7fbf278796c19ded9f9d6f:
+  title: 'm68k: mac: Fix reboot hang on Mac IIci'
+  mainline: 265a3b322df9a973ff1fc63da70af456ab6ae1d6
+  backport: 3d47f159d4991609f1a71bb15683f1b8cac8d2a8
+0a60bdd5ac8a51ac9c04bd19fee30c1c4f178dc3:
+  title: 'net: ethernet: cortina: Locking fixes'
+  mainline: 812552808f7ff71133fc59768cdc253c5b8ca1bf
+  skipped: fixes patch not in branch
+fca6072e1a7b1e709ada5604b951513b89b4bd0a:
+  title: 'af_unix: Fix data races in unix_release_sock/unix_stream_sendmsg'
+  mainline: 540bf24fba16b88c1b3b9353927204b4f1074e25
+  backport: be1d9f0e9de4ae6b3c0baed5547aa84be06f6548
+1010b50b2ebaaa863baeba7572267ac39bbb7adb:
+  title: 'net: usb: smsc95xx: stop lying about skb->truesize'
+  mainline: d50729f1d60bca822ef6d9c1a5fb28d486bd7593
+  backport: 16d0a15317ccdd42565ee3b0b4414f7134f414ba
+6a51ac92bf35d34b4996d6eb67e2fe469f573b11:
+  title: 'net: openvswitch: fix overwriting ct original tuple for ICMPv6'
+  mainline: 7c988176b6c16c516474f6fceebe0f055af5eb56
+  backport: d84c07f0a36edfbb017f66723aff19b75408ec6a
+9acb7ed4ff0e57b29326768aa8780f2ba2310090:
+  title: 'ipv6: sr: add missing seg6_local_exit'
+  mainline: 3321687e321307629c71b664225b861ebf3e5753
+  backport: e990bf08d73df105508439d775a40706fa34e4da
+d55cf7ced48c5054a79829a0b14203710006a277:
+  title: 'ipv6: sr: fix incorrect unregister order'
+  mainline: 6e370a771d2985107e82d0f6174381c1acb49c20
+  backport: 32cc76dc98c3a167b25dfe1548848036fc07d834
+10610575a3ac2a702bf5c57aa931beaf847949c7:
+  title: 'ipv6: sr: fix invalid unregister error path'
+  mainline: 160e9d2752181fcf18c662e74022d77d3164cd45
+  backport: a7eb748e89ec4c74a795fd32380019f21ae75895
+604c506ca43fce52bb882cff9c1fdf2ec3b4029c:
+  title: 'drm/amd/display: Fix potential index out of bounds in color transformation function'
+  mainline: 63ae548f1054a0b71678d0349c7dc9628ddd42ca
+  skipped: fixes patch not in branch
+80850a39e2548988f4feae26f3fd66286b460278:
+  title: 'mtd: rawnand: hynix: fixed typo'
+  mainline: 6819db94e1cd3ce24a432f3616cd563ed0c4eaba
+  backport: 73bc0203a1791e5252c190a016d46502406d53f0
+f6100ea560ed320a397d99aad6ad6918f0f1a70a:
+  title: 'fbdev: shmobile: fix snprintf truncation'
+  mainline: 26c8cfb9d1e4b252336d23dd5127a8cbed414a32
+  backport: 4ba8a5fa126c85d319a0f1c773a15c04dde7d74c
+79078880795478d551a05acc41f957700030d364:
+  title: 'drm/mediatek: Add 0 size check to mtk_drm_gem_obj'
+  mainline: 1e4350095e8ab2577ee05f8c3b044e661b5af9a0
+  backport: 43f9acac76b1661328292b13c57936252536a7ee
+b798cfeea12ebfd74c4bba511deb02956c97789e:
+  title: 'powerpc/fsl-soc: hide unused const variable'
+  mainline: 01acaf3aa75e1641442cc23d8fe0a7bb4226efb1
+  backport: 27a754ac9d1b146c6690b8cc566be4df02028430
+6891334b1458739701885fef2909daef754654fa:
+  title: 'fbdev: sisfb: hide unused variables'
+  mainline: 688cf598665851b9e8cb5083ff1d208ce43d10ff
+  skipped: fixes patch not in branch
+7394bab35c51cead246ef50d8c2e699e36032aed:
+  title: 'media: ngene: Add dvb_ca_en50221_init return value check'
+  mainline: 9bb1fd7eddcab2d28cfc11eb20f1029154dac718
+  backport: a36a6656bdcc519ee8206e91a484c9545e41c428
+cbc12c9693fad0545fb0e753d78979026ae0772a:
+  title: 'media: radio-shark2: Avoid led_names truncations'
+  mainline: 1820e16a3019b6258e6009d34432946a6ddd0a90
+  backport: 83fe7e17269e69bb85c5dcde3543fe69a7d14907
+74bafc897cb6c83b29c66cb39e82936204a5e51f:
+  title: 'fbdev: sh7760fb: allow modular build'
+  mainline: 51084f89d687e14d96278241e5200cde4b0985c7
+  backport: d1bafe8dbdd69b5b94c648616261b10f89e9e634
+b6cc5dd06336ed8bb3a7a1fc5aaf7d5e88bc0818:
+  title: 'drm/arm/malidp: fix a possible null pointer dereference'
+  mainline: a1f95aede6285dba6dd036d907196f35ae3a11ea
+  skipped: fixes patch not in branch
+60c68092723ea420215e9c3d5530038bc6568739:
+  title: 'ASoC: tracing: Export SND_SOC_DAPM_DIR_OUT to its value'
+  mainline: 58300f8d6a48e58d1843199be743f819e2791ea3
+  backport: 8b76f73f5124b83712d6cdcb3ef990263e40c5f0
+9b7b7f640f078cfe90319190b59efcde3acc1952:
+  title: 'RDMA/hns: Use complete parentheses in macros'
+  mainline: 4125269bb9b22e1d8cdf4412c81be8074dbc61ca
+  skipped: fixes patch not in branch
+ef10bbdf4d59a98cf57ddf943756f14ef3cdbccd:
+  title: 'x86/insn: Fix PUSH instruction in x86 instruction decoder opcode map'
+  mainline: 59162e0c11d7257cde15f907d19fefe26da66692
+  backport: e39747d5b28a334d3aa4a7d53db14f9f30390923
+1f9e32f9ea3454f79d80c8af7fac54843beba7f6:
+  title: 'ext4: avoid excessive credit estimate in ext4_tmpfile()'
+  mainline: 35a1f12f0ca857fee1d7a04ef52cbd5f1f84de13
+  backport: 668cfe934e0081e60581269d5afab127489cdfda
+ab8466d4e26806a4ae82c282762c4545eecf45ef:
+  title: 'SUNRPC: Fix gss_free_in_token_pages()'
+  mainline: bafa6b4d95d97877baa61883ff90f7e374427fae
+  skipped: fixes patch not in branch
+32b0469d13ebeb008b39613eb5acf529a10e0bde:
+  title: 'selftests/kcmp: Make the test output consistent and clear'
+  mainline: ff682226a353d88ffa5db9c2a9b945066776311e
+  backport: 0f0c8dcfaaff549a0397d3e63ec093c2ff6d602d
+24331545d6ff749a8dbfb09925af86e8cc50dad5:
+  title: 'selftests/kcmp: remove unused open mode'
+  mainline: eb59a58113717df04b8a8229befd8ab1e5dbf86e
+  backport: eea262830c62f8856fed4c532b5598f83c2972a9
+b469345f1fca84bed4dea3cae85faa401cf9bf3e:
+  title: 'RDMA/IPoIB: Fix format truncation compilation errors'
+  mainline: 49ca2b2ef3d003402584c68ae7b3055ba72e750a
+  backport: 183cb1a936e35c5ae205498945addd70a31a61e0
+b9d663fbf74290cb68fbc66ae4367bd56837ad1d:
+  title: 'netrom: fix possible dead-lock in nr_rt_ioctl()'
+  mainline: e03e7f20ebf7e1611d40d1fdc1bde900fd3335f6
+  backport: 08f41b353c1621f65bd6f61aa5f5aed2fc1feb11
+4f3ae7d846b4565c0b80d65ed607c3277bc984d4:
+  title: 'af_packet: do not call packet_read_pending() from tpacket_destruct_skb()'
+  mainline: 581073f626e387d3e7eed55c48c8495584ead7ba
+  backport: 79417a25cb5eb9644fe89e5aae703a6b591669d5
+046daa54c348ccec12ab38b92923060dd09ef00b:
+  title: 'sched/topology: Don''t set SD_BALANCE_WAKE on cpuset domain relax'
+  mainline: 9ae7ab20b4835dbea0e5fc6a5c70171dc354a72e
+  backport: 03baaba21b3291e6300e4fafb8d2849f0389de3d
+454de5ed81766fbbf4777c43392d8b0b35e7e16d:
+  title: 'sched/fair: Allow disabling sched_balance_newidle with sched_relax_domain_level'
+  mainline: a1fd0b9d751f840df23ef0e75b691fc00cfd4743
+  backport: cd212b4b364b6efe32441d764cabaef2402c8eba
+8f4a76d477f0cc3c54d512f07f6f88c8e1c1e07b:
+  title: 'greybus: lights: check return of get_channel_from_mode'
+  mainline: a1ba19a1ae7cd1e324685ded4ab563e78fe68648
+  backport: 8d680792eafdefb9e3e547a305a505da085932ff
+12c70cc851b263b8cc9479a23488992eeb4c35e6:
+  title: 'dmaengine: idma64: Add check for dma_set_max_seg_size'
+  mainline: 2b1c1cf08a0addb6df42f16b37133dc7a351de29
+  backport: 0d0f766835c349005332fd8e7b296660a7d6a65a
+20595142ca22ac2c8357564d9e7d52a0ffa471af:
+  title: 'firmware: dmi-id: add a release callback function'
+  mainline: cf770af5645a41a753c55a053fa1237105b0964a
+  backport: e9c8e448b86118386e2aed7e3bb0e02fdbb68d14
+44b38924135d2093e2ec1812969464845dd66dc9:
+  title: 'serial: max3100: Lock port->lock when calling uart_handle_cts_change()'
+  mainline: 77ab53371a2066fdf9b895246505f5ef5a4b5d47
+  backport: bcbacbcfd59ba38747a001592ffb3aae1118e5de
+21a61a7fbcfdd3493cede43ebc7c4dfae2147a8b:
+  title: 'serial: max3100: Update uart_driver_registered on driver removal'
+  mainline: 712a1fcb38dc7cac6da63ee79a88708fbf9c45ec
+  backport: c6cf8b544d9ca71186322b2ede24e7ded577381a
+2ae8d5726526c05452aff0444b0f305fdf89a32d:
+  title: 'serial: max3100: Fix bitwise types'
+  mainline: e60955dbecb97f080848a57524827e2db29c70fd
+  backport: 647c442cedd75f319c8ce8dc039c2d7baec68317
+22e65ed6799f2bfd059d633890d6c7ebe46abc9b:
+  title: 'greybus: arche-ctrl: move device table to its right location'
+  mainline: 6a0b8c0da8d8d418cde6894a104cf74e6098ddfa
+  backport: 89f965ae0a3f751235963e2597c63fd9ce035113
+2822594f2dac6e493379885cef54fd179d8de8c5:
+  title: 'microblaze: Remove gcc flag for non existing early_printk.c file'
+  mainline: edc66cf0c4164aa3daf6cc55e970bb94383a6a57
+  skipped: fixes patch not in branch
+d481ddb83d2d92c31479cdfaa7fdd97a73697992:
+  title: 'microblaze: Remove early printk call from cpuinfo-static.c'
+  mainline: 58d647506c92ccd3cfa0c453c68ddd14f40bf06f
+  skipped: fixes patch not in branch
+a646645af00f65db78fe4a60f753f2b07df35b6e:
+  title: 'usb: gadget: u_audio: Clear uac pointer when freed.'
+  mainline: a2cf936ebef291ef7395172b9e2f624779fb6dc0
+  backport: 0328af15e33a89109f97c8abcce2119896607fb4
+6cc30ef8eb6d8f8d6df43152264bbf8835d99931:
+  title: 'stm class: Fix a double free in stm_register_device()'
+  mainline: 3df463865ba42b8f88a590326f4c9ea17a1ce459
+  backport: 5bbc7d325cef8fbd593fd8e71f12343c47028be1
+1e4805ba1b7800f2acfdd0b2e6588e4b64d6c493:
+  title: 'ppdev: Remove usage of the deprecated ida_simple_xx() API'
+  mainline: d8407f71ebeaeb6f50bd89791837873e44609708
+  skipped: new API does not exist in 4.14
+65cd017d43f4319a56747d38308b0a24cf57299e:
+  title: 'ppdev: Add an error check in register_device'
+  mainline: fbf740aeb86a4fe82ad158d26d711f2f3be79b3e
+  backport: 16e15c7fd21ec24f98668e5a7bf28ef5c1a0fcaa
+b463819e3725b60c550145df952080b5d0fe85a7:
+  title: 'extcon: max8997: select IRQ_DOMAIN instead of depending on it'
+  mainline: b1781d0a1458070d40134e4f3412ec9d70099bec
+  backport: d1e6203d776319b888b57b1176df438ee85e67f7
+3506e1b893b5c2afa96922f36a01f018e4c4bbba:
+  title: 'f2fs: add error prints for debugging mount failure'
+  mainline: 9227d5227b8db354d386f592f159eaa44db1c0b8
+  backport: 46dc390d5714351d5b798312f8edf666e327a1ef
+bc14bb3ef307947fc3110bca8a34a85a63300b6c:
+  title: 'f2fs: fix to release node block count in error path of f2fs_new_node_page()'
+  mainline: 0fa4e57c1db263effd72d2149d4e21da0055c316
+  skipped: fixes patch not in branch
+82b6263b330a2b94a0b1d5c5d5543db7e24340ec:
+  title: 'serial: sh-sci: Extract sci_dma_rx_chan_invalidate()'
+  mainline: 11b3770d54b28dcd905155a6d4aa551187ff00eb
+  skipped: dependency for a patch not needed for 4.14.y
+03023fd058fab714309a8d91ccdf1b3c5bb816d3:
+  title: 'serial: sh-sci: protect invalidating RXDMA on shutdown'
+  mainline: aae20f6e34cd0cbd67a1d0e5877561c40109a81b
+  skipped: fixes patch not in branch
+3625187a973f16a3df59b803297816fe51d32400:
+  title: 'libsubcmd: Fix parse-options memory leak'
+  mainline: 230a7a71f92212e723fa435d4ca5922de33ec88a
+  backport: 3fa32fd0a2737a59698613854994f72051a6d4bb
+502f295dcccf0ee7c4bddcf1ff2876987aaf89ca:
+  title: 'Input: ims-pcu - fix printf string overflow'
+  mainline: bf32bceedd0453c70d9d022e2e29f98e446d7161
+  backport: 41c0d9061a68f5979e3244c26854cef37d91382b
+fd4bb5284d34687c82356f07efe957af89ee51fe:
+  title: 'Input: pm8xxx-vibrator - correct VIB_MAX_LEVELS calculation'
+  mainline: 48c0687a322d54ac7e7a685c0b6db78d78f593af
+  backport: 7dfc577218ae7aeeadc5bdffe5727d57337904ee
+732e700a1689fbdb8ac94faeb7765e81456b0a95:
+  title: 'drm/msm/dpu: use kms stored hw mdp block'
+  mainline: 57250ca5433306774e7f83b11503609ed1bf28cf
+  skipped: file is not in 4.14.y
+d2640251f94078e1dcf0a26b1815601f6dbd5440:
+  title: 'um: Fix return value in ubd_init()'
+  mainline: 31a5990ed253a66712d7ddc29c92d297a991fdf2
+  backport: bb75c00bad0d04025b00991fe16db2fc0504ce58
+66ea9a7c6824821476914bed21a476cd20094f33:
+  title: 'um: Add winch to winch_handlers before registering winch IRQ'
+  mainline: a0fbbd36c156b9f7b2276871d499c9943dfe5101
+  backport: 330646466ce0f4978524457d109ac80ece62c547
+f6a392266276730bea893b55d12940e32a25f56a:
+  title: 'media: stk1160: fix bounds checking in stk1160_copy_video()'
+  mainline: faa4364bef2ec0060de381ff028d1d836600a381
+  backport: b7d9420c157cdb207a95dfc4a40edd116dedf355
+f0f4cb4cc3f43324bab3b5541b27e79cbd15c8d1:
+  title: 'powerpc/pseries: Add failure related checks for h_get_mpp and h_get_ppp'
+  mainline: 6d4341638516bf97b9a34947e0bd95035a8230a5
+  backport: cd05d6e21092d824ec4d37f39f7583310d0442fa
+c08650c13bfc05794855480cc51075fdfcc388e0:
+  title: 'um: Fix the -Wmissing-prototypes warning for __switch_mm'
+  mainline: 2cbade17b18c0f0fd9963f26c9fc9b057eb1cb3a
+  backport: d6c506b111a38e5583e5bdd880cc0c04d7ef3948
+896dfd4d74f84c854d3a24d889e54a44329d313e:
+  title: 'media: cec: cec-adap: always cancel work in cec_transmit_msg_fh'
+  mainline: 9fe2816816a3c765dff3b88af5b5c3d9bbb911ce
+  skipped: fixes patch not in branch
+d2cfbc5298add5e0c6cfe8b343f73dfdf01c8b1c:
+  title: 'media: cec: cec-api: add locking in cec_release()'
+  mainline: 42bcaacae924bf18ae387c3f78c202df0b739292
+  backport: 75fd6535ba80c0726e31004af666d80a0b9c3df8
+7471d0be031ab830a0fa154437601cff98f7068b:
+  title: 'null_blk: Fix the WARNING: modpost: missing MODULE_DESCRIPTION()'
+  mainline: 9e6727f824edcdb8fdd3e6e8a0862eb49546e1cd
+  backport: 9da7f2b727fd54add9890e238847acf82d6807a1
+28a7a1f9571068bb2ddc8a11f0afe5dfa9863462:
+  title: 'x86/kconfig: Select ARCH_WANT_FRAME_POINTERS again when UNWINDER_FRAME_POINTER=y'
+  mainline: 66ee3636eddcc82ab82b539d08b85fb5ac1dff9b
+  backport: 4e00769cc5020fde90269bdd1e5c24302b0ba6ce
+406cfac9debd4a6d3dc5d9258ee086372a8c08b6:
+  title: 'nfc: nci: Fix uninit-value in nci_rx_work'
+  mainline: e4a87abf588536d1cdfb128595e6e680af5cf3ed
+  backport: 3327ed68607e86e489af26305145830bf3f299a6
+afd5730969aec960a2fee4e5ee839a6014643976:
+  title: 'ipv6: sr: fix memleak in seg6_hmac_init_algo'
+  mainline: efb9f4f19f8e37fde43dfecebc80292d179f56c6
+  backport: 2d5acfc9e45f4597b931857dd92d2f29d2382ad7
+459de98d7a6b3d504b5e8664f32f59a306dd425c:
+  title: 'params: lift param_set_uint_minmax to common code'
+  mainline: 2a14c9ae15a38148484a128b84bff7e9ffd90d68
+  backport: 45e0b129726564750a58c06f1b4060b23f158960
+06d0fe049b51b0a92a70df8333fd85c4ba3eb2c6:
+  title: 'tcp: Fix shift-out-of-bounds in dctcp_update_alpha().'
+  mainline: 3ebc46ca8675de6378e3f8f40768e180bb8afa66
+  backport: cf1096a1c8e1905df5e69949153c2598060457f0
+62a95de44a9bc006e01b0afa1b1e8868dc6de9d1:
+  title: 'openvswitch: Set the skbuff pkt_type for proper pmtud support.'
+  mainline: 30a92c9e3d6b073932762bef2ac66f4ee784c657
+  backport: a629b0579dee6b041fdcad1859fa9f6a86da4ced
+f221bd58db0f6ca087ac0392284f6bce21f4f8ea:
+  title: 'arm64: asm-bug: Add .align 2 to the end of __BUG_ENTRY'
+  mainline: ffbf4fb9b5c12ff878a10ea17997147ea4ebea6f
+  backport: 0374a08aa5206c6200a88e0a122500dfd1d195f0
+cb7a7c8144b434e06aba99b13b045a7efe859587:
+  title: 'virtio: delete vq in vp_find_vqs_msix() when request_irq() fails'
+  mainline: 89875151fccdd024d571aa884ea97a0128b968b6
+  backport: 63c5945dbfcb8b6f4c260aef57172893a15ebbb3
+4e4efb8f1b275e85c5c7f69087e392dbae437a8d:
+  title: 'net: fec: avoid lock evasion when reading pps_enable'
+  mainline: 3b1c92f8e5371700fada307cc8fd2c51fa7bc8c1
+  backport: 76ff93a5ccf6378571ba77875039f77752ac8a33
+c6c938ef515733a1c7af2c87dbc23138f402ba97:
+  title: 'nfc: nci: Fix kcov check in nci_rx_work()'
+  mainline: 19e35f24750ddf860c51e51c68cf07ea181b4881
+  backport: 3267e236cb890a2ff6450ba831f3ad66386d6c4b
+8f02d494cebae48dbd14c582ad4b36846e211b6a:
+  title: 'nfc: nci: Fix handling of zero-length payload packets in nci_rx_work()'
+  mainline: 6671e352497ca4bb07a96c48e03907065ff77d8a
+  backport: 1a7a9cc0bb2c966cb7edee4a47dc81053e9030d8
+8658bd777cbfcb0c13df23d0ea120e70517761b9:
+  title: 'netfilter: nfnetlink_queue: acquire rcu_read_lock() in instance_destroy_rcu()'
+  mainline: dc21c6cc3d6986d938efbf95de62473982c98dec
+  backport: ac335a5fe30958ed4c81fac6b76e4b6c77f6f95d
+c7893975764ba3b7a58a186f63dae188f7eddb18:
+  title: 'spi: Don''t mark message DMA mapped when no transfer in it is'
+  mainline: 9f788ba457b45b0ce422943fcec9fa35c4587764
+  backport: 0a359294f4d22e037ff38999b1fdaa688aab6e5f
+36a935c8785a9ca95b094440a0450cd56b90e70c:
+  title: 'nvmet: fix ns enable/disable possible hang'
+  mainline: f97914e35fd98b2b18fb8a092e0a0799f73afdfe
+  backport: 5584ee5ae01187bdcb286738c27d8cecf7c2b92d
+19f9b6cb94eebb4ef2a4a6bca0ef595039d73e04:
+  title: 'net/mlx5e: Use rx_missed_errors instead of rx_dropped for reporting buffer exhaustion'
+  mainline: 5c74195d5dd977e97556e6fa76909b831c241230
+  backport: d6e67757cebbeb5857838f51e2c514a3c9fc5557
+1ff116f68560a25656933d5a18e7619cb6773d8a:
+  title: 'dma-buf/sw-sync: don''t enable IRQ from sync_print_obj()'
+  mainline: b794918961516f667b0c745aebdfebbb8a98df39
+  backport: 5beeab6917b9b59ab2c15744b190b3ad93c58687
+2b649d7e0cb42a660f0260ef25fd55fdc9c6c600:
+  title: 'enic: Validate length of nl attributes in enic_set_vf_port'
+  mainline: e8021b94b0412c37bcc79027c2e382086b6ce449
+  backport: 3d00c58ac6d7f0fa0882aafb5b1ca2c3c22838eb
+eced17c8715d43ce16f61c5a6a49299fbf37c0a0:
+  title: 'smsc95xx: remove redundant function arguments'
+  mainline: 368be1ca28f66deba16627e2a02e78adedd023a6
+  backport: d7936abfc24afa29d587b2bdd0829092dc478ebf
+bcc526fec891dee22162082b1beeb9068b9eabb0:
+  title: 'smsc95xx: use usbnet->driver_priv'
+  mainline: ad90a73f0236c41f7a2dedc2e75c7b5a364eb93e
+  backport: 17ddb0fdf87c7f3f7c07e2721f688301411d2792
+85b6bcf9d5e332aa9c4b7820cb3aa748c3df6a80:
+  title: 'net: usb: smsc95xx: fix changing LED_SEL bit value updated from EEPROM'
+  mainline: 52a2f0608366a629d43dacd3191039c95fef74ba
+  backport: e0bd5cab3be56a1437e713a5411c458b80fa039c
+416b0756721dcee2bb6227a4403e694011c32874:
+  title: 'net:fec: Add fec_enet_deinit()'
+  mainline: bf0497f53c8535f99b72041529d3f7708a6e2c0d
+  backport: 4c2d953d579bbc6018f916d7474ca42a0ea2471f
+6bfda3ef7f6a2c1de30e70d67e901aa966f40c17:
+  title: 'kconfig: fix comparison to constant symbols, ''m'', ''n'''
+  mainline: aabdc960a283ba78086b0bf66ee74326f49e218e
+  backport: c00f30ffce7c99732b9610771908b84af2f7e95a
+0049a623dfbbb49888de7f0c2f33a582b5ead989:
+  title: 'ipvlan: Dont Use skb->sk in ipvlan_process_v{4,6}_outbound'
+  mainline: b3dc6e8003b500861fa307e9a3400c52e78e4d3a
+  backport: 3a016fed8503f04152b170bc324fd7fbbfb155e4
+68396c825c43664b20a3a1ba546844deb2b4e48f:
+  title: 'ALSA: timer: Set lower bound of start tick time'
+  mainline: 4a63bd179fa8d3fcc44a0d9d71d941ddd62f0c4e
+  backport: 804b59ac965568b4ac7b1788ba8b3b324e362693
+a40209d355afe4ed6d533507838c9e5cd70a76d8:
+  title: 'genirq/cpuhotplug, x86/vector: Prevent vector leak during CPU offline'
+  mainline: a6c11c0a5235fb144a65e0cb2ffd360ddc1f6c32
+  skipped: too risky to backport
+57ff6c0a175930856213b2aa39f8c845a53e5b1c:
+  title: 'SUNRPC: Fix loop termination condition in gss_free_in_token_pages()'
+  mainline: 4a77c3dead97339478c7422eb07bf4bf63577008
+  skipped: fixes patch not in branch
+c437184be3c16f7123e5c59b4c85c1101f4dc96b:
+  title: 'binder: fix max_thread type inconsistency'
+  mainline: 42316941335644a98335f209daafa4c122f28983
+  backport: f642f364e2b4e4302e6b41f1583603a9be83baef
+bda1d354bef71be32aaf2c5e6b96eef854b3dd4e:
+  title: 'mmc: core: Do not force a retune before RPMB switch'
+  mainline: 67380251e8bbd3302c64fea07f95c31971b91c22
+  backport: 5584cc5bd6c850f9738f7b249be3d298f0012a16
+822ae5a8eac30478578a75f7e064f0584931bf2d:
+  title: 'nilfs2: fix use-after-free of timer for log writer thread'
+  mainline: f5d4e04634c9cf68bdf23de08ada0bb92e8befe7
+  backport: 705fabd9032429d644eee84edc1d45f740edcc81
+f6141cbc2b5af521b1711e95363302b858a38729:
+  title: 'vxlan: Fix regression when dropping packets due to invalid src addresses'
+  mainline: 1cd4bc987abb2823836cbb8f887026011ccddc8a
+  backport: 7e6f3eaf97955faec6cf408b6404a35cf2c82ea0
+f451d1a013fd585cbf70a65ca6b9cf3548bb039f:
+  title: 'neighbour: fix unaligned access to pneigh_entry'
+  mainline: ed779fe4c9b5a20b4ab4fd6f3e19807445bb78c7
+  backport: 34358bf261de42b079db6cbd5ae3b074282cd00f
+21604179f67bd484790c296565bdc38f7a40fe35:
+  title: 'ata: pata_legacy: make legacy_exit() work again'
+  mainline: d4a89339f17c87c4990070e9116462d16e75894f
+  backport: 792524d8e1b344cedcb40983a8756d4793a22e9e
+40f76e72ec0ebe27dcff9bfd5de8e65e1a2b8939:
+  title: 'arm64: tegra: Correct Tegra132 I2C alias'
+  mainline: 2633c58e1354d7de2c8e7be8bdb6f68a0a01bad7
+  backport: aa9c43942fc69f5e652d6b4f68e0e2bf75868c7e
+b32aa95843cac6b12c2c014d40fca18aef24a347:
+  title: 'md/raid5: fix deadlock that raid5d() wait for itself to clear MD_SB_CHANGE_PENDING'
+  mainline: 151f66bb618d1fd0eeb84acb61b4a9fa5d8bb0fa
+  backport: d7263704edf4ee2783b116f64f407752d5b2f2bf
+e9b77b537a198235a518f71a274348afd1288467:
+  title: 'wifi: rtl8xxxu: Fix the TX power of RTL8192CU, RTL8723AU'
+  mainline: 08b5d052d17a89bb8706b2888277d0b682dc1610
+  skipped: u32_get_bits() does not build
+26e62b983a31b304733fb21f4b576a4a1e171297:
+  title: 'arm64: dts: hi3798cv200: fix the size of GICR'
+  mainline: 428a575dc9038846ad259466d5ba109858c0a023
+  backport: 964fdd7feb56e40a55b89328877b0a7103bb4084
+772f5e31ed2d6bc5e8698394e4d13b298060c74a:
+  title: 'media: mxl5xx: Move xpt structures off stack'
+  mainline: 526f4527545b2d4ce0733733929fac7b6da09ac6
+  backport: 35d3fa1859980a84c64c51b04a2ac57ffe5af109
+1ea3de272f5cc7603610b96316f9ed07bec6c2d0:
+  title: 'media: v4l2-core: hold videodev_lock until dev reg, finishes'
+  mainline: 1ed4477f2ea4743e7c5e1f9f3722152d14e6eeb1
+  backport: 2046df24d6472a520a62d52a72d84d180b3e363c
+be754cbd77eaf2932408a4e18532e4945274a5c7:
+  title: 'fbdev: savage: Handle err return when savagefb_check_var failed'
+  mainline: 6ad959b6703e2c4c5d7af03b4cfd5ff608036339
+  backport: 293140832f7230044b5f6888d0110714f51b554f
+525561faa075cb49905783fd3e4e16b66b218846:
+  title: 'netfilter: nf_tables: pass context to nft_set_destroy()'
+  mainline: 0c2a85edd143162b3a698f31e94bf8cdc041da87
+  backport: c4af59f2d8336214168c4e0778a1a0a62afcbdc4
+68b10f33a37e942bdc06b9cb313ad4e1b1f612e8:
+  title: 'netfilter: nftables: rename set element data activation/deactivation functions'
+  mainline: f8bb7889af58d8e74d2d61c76b1418230f1610fa
+  backport: b42c75cd69307b546b719cc59fb421a7c80a980f
+bc9f791d2593f17e39f87c6e2b3a36549a3705b1:
+  title: 'netfilter: nf_tables: drop map element references from preparation phase'
+  mainline: 628bd3e49cba1c066228e23d71a852c23e26da73
+  backport: 50bfcb0af95ae860d93c151604451b9a10af6e06
+c6d5477753caa9ab0c5c043bf5d0fad29d1e596d:
+  title: 'netfilter: nft_set_rbtree: allow loose matching of closing element in interval'
+  mainline: 3b18d5eba491b2328b31efa4235724a2354af010
+  skipped: fixes patch not in branch
+1302ba27fdc84ba0786301575dbcd2e1eddbcdc0:
+  title: 'netfilter: nft_set_rbtree: Add missing expired checks'
+  mainline: 340eaff651160234bdbce07ef34b92a8e45cd540
+  skipped: fixes patch not in branch
+7ab87a326f20c52ff4d9972052d085be951c704b:
+  title: 'netfilter: nft_set_rbtree: Switch to node list walk for overlap detection'
+  mainline: c9e6978e2725a7d4b6cd23b2facd3f11422c0643
+  skipped: fixes patch not in branch
+b76db53ee8802ee5683f8cb401d7e2ec6f9b3d56:
+  title: 'netfilter: nft_set_rbtree: fix null deref on element insertion'
+  mainline: 61ae320a29b0540c16931816299eb86bf2b66c08
+  skipped: fixes patch not in branch
+8284a79136c384059e85e278da2210b809730287:
+  title: 'netfilter: nft_set_rbtree: fix overlap expiration walk'
+  mainline: f718863aca469a109895cb855e6b81fff4827d71
+  skipped: fixes patch not in branch
+94313a196b44184b5b52c1876da6a537701b425a:
+  title: 'netfilter: nf_tables: don''t skip expired elements during walk'
+  mainline: 24138933b97b055d486e8064b4a1721702442a9b
+  backport: 4538b02484e4c2d0c016ca190c5219fd97f932fb
+8da1b048f9a501d3d7d38c188ba09d7d0d5b8c27:
+  title: 'netfilter: nf_tables: GC transaction API to avoid race with control plane'
+  mainline: 5f68718b34a531a556f2f50300ead2862278da26
+  skipped: too risky to backport
+cb4d00b563675ba8ff6ef94b077f58d816f68ba3:
+  title: 'netfilter: nf_tables: adapt set backend to use GC transaction API'
+  mainline: f6c383b8c31a93752a52697f8430a71dcbc46adf
+  skipped: too risky to backport
+a35a20e083be2b507c30cc216b59d1a57f381d9b:
+  title: 'netfilter: nf_tables: remove busy mark and gc batch API'
+  mainline: a2dd0233cbc4d8a0abb5f64487487ffc9265beb5
+  skipped: too risky to backport
+e7b86599fa945f3ce2bcbb95b4bbf1febbd3b087:
+  title: 'netfilter: nf_tables: fix GC transaction races with netns and netlink event exit path'
+  mainline: 6a33d8b73dfac0a41f3877894b38082bd0c9a5bc
+  skipped: too risky to backport
+9a3f450ed90c72b6b80fd6e8974cbe8683c7365f:
+  title: 'netfilter: nf_tables: GC transaction race with netns dismantle'
+  mainline: 02c6c24402bf1c1e986899c14ba22a10b510916b
+  skipped: too risky to backport
+f85ca36090cbb252bcbc95fc74c2853fc792694f:
+  title: 'netfilter: nf_tables: GC transaction race with abort path'
+  mainline: 720344340fb9be2765bbaab7b292ece0a4570eae
+  skipped: too risky to backport
+9c22bd1ab442c552e9481f1157589362887a7f47:
+  title: 'netfilter: nf_tables: defer gc run if previous batch is still pending'
+  mainline: 8e51830e29e12670b4c10df070a4ea4c9593e961
+  skipped: too risky to backport
+9db9feb841f7449772f9393c16b9ef4536d8c127:
+  title: 'netfilter: nft_set_rbtree: skip sync GC for new elements in this transaction'
+  mainline: 2ee52ae94baabf7ee09cf2a8d854b990dac5d0e4
+  skipped: too risky to backport
+b3558703731028be2aee61baf341e53a3734e2a9:
+  title: 'netfilter: nft_set_rbtree: use read spinlock to avoid datapath contention'
+  mainline: 96b33300fba880ec0eafcf3d82486f3463b4b6da
+  skipped: too risky to backport
+b6a744ba74f2388034c422f57568451bb6111d00:
+  title: 'netfilter: nft_set_hash: try later when GC hits EAGAIN on iteration'
+  mainline: b079155faae94e9b3ab9337e82100a914ebb4e8d
+  skipped: too risky to backport
+7cf055b43756b10aa2b851c927c940f5ed652125:
+  title: 'netfilter: nf_tables: fix memleak when more than 255 elements expired'
+  mainline: cf5000a7787cbc10341091d37245a42c119d26c5
+  skipped: too risky to backport
+88c795491bf45a8c08a0f94c9ca4f13722e51013:
+  title: 'netfilter: nf_tables: unregister flowtable hooks on netns exit'
+  mainline: 6069da443bf65f513bb507bb21e2f87cfb1ad0b6
+  skipped: fixes patch not in branch
+c73955a09408e7374d9abfd0e78ce3de9cda0635:
+  title: 'netfilter: nf_tables: double hook unregistration in netns path'
+  mainline: f9a43007d3f7ba76d5e7f9421094f00f2ef202f8
+  skipped: fixes patch not in branch
+2565d90ab654f775d8865512f2a6aa3940182038:
+  title: 'netfilter: nftables: update table flags from the commit phase'
+  mainline: 0ce7cf4127f14078ca598ba9700d813178a59409
+  skipped: too risky to backport
+bf8083bbf8fa202e6e5316bbd99759ab82bfe7a3:
+  title: 'netfilter: nf_tables: fix table flag updates'
+  mainline: 179d9ba5559a756f4322583388b3213fe4e391b0
+  skipped: too risky to backport
+746523b4a3927fb922c82a6e997c4d1ba74c7f13:
+  title: 'netfilter: nf_tables: disable toggling dormant table state more than once'
+  mainline: c9bd26513b3a11b3adb3c2ed8a31a01a87173ff1
+  skipped: too risky to backport
+a118e0d82bb4b7760db8f704c05e2b8713b9bcc1:
+  title: 'netfilter: nf_tables: bogus EBUSY when deleting flowtable after flush (for 4.19)'
+6a67f972de8994ee1c3092b19b6f5569b66b9904:
+  title: 'netfilter: nft_dynset: fix timeouts later than 23 days'
+  mainline: 917d80d376ffbaa9725fde9e3c0282f63643f278
+  skipped: too risky to backport
+28a97c43c9e32f437ebb8d6126f9bb7f3ca9521a:
+  title: 'netfilter: nftables: exthdr: fix 4-byte stack OOB write'
+  mainline: fd94d9dadee58e09b49075240fe83423eb1dcd36
+  skipped: commit is already present in branch
+c5c4746c8cd6d049dcbf39c811172c917ea6fb6e:
+  title: 'netfilter: nft_dynset: report EOPNOTSUPP on missing set feature'
+  mainline: 95cd4bca7b1f4a25810f3ddfc5e767fb46931789
+  backport: ea71b10a3d18e5589f44b836a83003a6e741d6bb
+79e98cd78610560a6a6cf85200eb31331602f9a9:
+  title: 'netfilter: nft_dynset: relax superfluous check on set updates'
+  mainline: 7b1394892de8d95748d05e3ee41e85edb4abbfa1
+  backport: fa8b9918795f9be7f4ca95f5440acff86fe946db
+451dc4678c1342fc5c3a2d23e1d8e120e58f6304:
+  title: 'netfilter: nf_tables: mark newset as dead on transaction abort'
+  mainline: 08e4c8c5919fd405a4d709b4ba43d836894a26eb
+  skipped: too risky to backport
+18f1f50558e1736d34597fdf08554aee94f59405:
+  title: 'netfilter: nf_tables: skip dead set elements in netlink dump'
+  mainline: 6b1ca88e4bb63673dc9f9c7f23c899f22c3cb17a
+  skipped: too risky to backport
+a5bbd579c81ffb9f65cb280fa89be9ec9c01029b:
+  title: 'netfilter: nf_tables: validate NFPROTO_* family'
+  mainline: d0009effa8862c20a13af4cb7475d9771b905693
+  skipped: too risky to backport
+c60d252949caf9aba537525195edae6bbabc35eb:
+  title: 'netfilter: nft_set_rbtree: skip end interval element from gc'
+  mainline: 60c0c230c6f046da536d3df8b39a20b9a9fd6af0
+  skipped: fixes patch not in branch
+a6411f3c48f991c19aaf9a24fce36865fbba28d7:
+  title: 'netfilter: nf_tables: set dormant flag on hook register failure'
+  mainline: bccebf64701735533c8db37773eeacc6566cc8ec
+  skipped: fixes issue not in 4.14
+d8853cfe273c181b2e45528db7300536e860b758:
+  title: 'netfilter: nf_tables: allow NFPROTO_INET in nft_(match/target)_validate()'
+  mainline: 7e0f122c65912740327e4c54472acaa5f85868cb
+  skipped: too risky to backport
+845083249d6a392f3a88804e1669bdb936ee129f:
+  title: 'netfilter: nf_tables: do not compare internal table flags on updates'
+  mainline: 4a0e7f2decbf9bd72461226f1f5f7dcc4b08f139
+  skipped: too risky to backport
+d75a589bb92af1abf3b779cfcd1977ca11b27033:
+  title: 'netfilter: nf_tables: mark set as dead when unbinding anonymous set with timeout'
+  mainline: 552705a3650bbf46a22b1adedc1b04181490fc36
+  skipped: too risky to backport
+6d12f21f8bbe23fde25b77c2bf5973c136b8bef8:
+  title: 'netfilter: nf_tables: reject new basechain after table flag update'
+  mainline: 994209ddf4f430946f6247616b2e33d179243769
+  skipped: too risky to backport
+e75faf01e22ec7dc671640fa0e0968964fafd2fc:
+  title: 'netfilter: nf_tables: discard table flag update with pending basechain deletion'
+  mainline: 1bc83a019bbe268be3526406245ec28c2458a518
+  skipped: too risky to backport
+3c9ee8294728633e707c25fe0a321eeac1cc7515:
+  title: 'KVM: arm64: Allow AArch32 PSTATE.M to be restored as System mode'
+  mainline: dfe6d190f38fc5df5ff2614b463a5195a399c885
+  backport: 6658c1ef0cb35d3d594507db800cb44a54db4f75
+0ce5964b82f212f4df6a9813f09a0b5de15bd9c8:
+  title: 'crypto: qat - Fix ADF_DEV_RESET_SYNC memory leak'
+  mainline: d3b17c6d9dddc2db3670bc9be628b122416a3d26
+  backport: 9d5b95ce1488266fd3dc3951da6c8ce25c366ada
+72c5d8e416ecc46af370a1340b3db5ff0b0cc867:
+  title: 'net/9p: fix uninit-value in p9_client_rpc()'
+  mainline: 25460d6f39024cc3b8241b14c7ccf0d6f11a736a
+  backport: 9a9a74f4cdb1295a5a854d2ca6cb87fc19048ef3
+58c0309c73fe1e9c477ed4cc5d02fc9015336979:
+  title: 'intel_th: pci: Add Meteor Lake-S CPU support'
+  mainline: a4f813c3ec9d1c32bc402becd1f011b3904dd699
+  backport: 471ea347bb7d4b16dd62a6642efb111fa36f2da7
+180b2e4c1ba4f6e3e4c52d6664cb019f6eac02f8:
+  title: 'sparc64: Fix number of online CPUs'
+  mainline: 98937707fea8375e8acea0aaa0b68a956dd52719
+  backport: 9f2edbc910b189e46e7ca3d17680e36fde63276d
+fb824a99e148ff272a53d71d84122728b5f00992:
+  title: 'kdb: Fix buffer overflow during tab-complete'
+  mainline: e9730744bf3af04cda23799029342aa3cddbc454
+  backport: f751d9a9f3d6c01908cf9bc9d966a35ecc1a2f64
+4edfbbaca46491b06af14e49dcb79ac661d0bbdc:
+  title: 'kdb: Use format-strings rather than ''\0'' injection in kdb_read()'
+  mainline: 09b35989421dfd5573f0b4683c7700a7483c71f9
+  backport: f990953b6d8d752849e6f682628d4632f051b7de
+21c068c1bbb4c336741749596d004b1965faab2c:
+  title: 'kdb: Fix console handling when editing and tab-completing commands'
+  mainline: db2f9c7dc29114f531df4a425d0867d01e1f1e28
+  backport: fc2a098bc09c4f9968c93222902d72f518ec6953
+4a89182788f9af9a290c19098382fb972ebe2783:
+  title: 'kdb: Merge identical case statements in kdb_read()'
+  mainline: 6244917f377bf64719551b58592a02a0336a7439
+  backport: 201f3d45deb9bcf1046483d72642d8457976c7a9
+2467f3f182eb35627534effd4956fceb2504c127:
+  title: 'kdb: Use format-specifiers rather than memset() for padding in kdb_read()'
+  mainline: c9b51ddb66b1d96e4d364c088da0f1dfb004c574
+  backport: c89fb4fb7559ec8e3f74ecbc29ef856a47cc85d4
+051c0bde9f0450a2ec3d62a86d2a0d2fad117f13:
+  title: 'net: fix __dst_negative_advice() race'
+  mainline: 92f1655aa2b2294d0b49925f3b875a634bd3b59e
+  skipped: fixes patch not in branch
+980a1cd6e092eab9398a78f517809a7dacaa0468:
+  title: 'sparc: move struct termio to asm/termios.h'
+  mainline: c32d18e7942d7589b62e301eb426b32623366565
+  backport: 212ca5dd4286a76808254db293bd898a062b56e3
+9ad75e78747b5a50dc5a52f0f8e92e920a653f16:
+  title: 'ext4: fix mb_cache_entry''s e_refcnt leak in ext4_xattr_block_cache_find()'
+  mainline: 0c0b4a49d3e7f49690a6827a41faeffad5df7e21
+  backport: 199f7d837409f78087fde12a33c486d4d866c16e
+2062e3f1f2374102f8014d7ca286b9aa527bd558:
+  title: 's390/ap: Fix crash in AP internal function modify_bitmap()'
+  mainline: d4f9d5a99a3fd1b1c691b7a1a6f8f3f25f4116c9
+  skipped: depends on missing commit 3d8f60d38e249f989a7fca9c2370c31c3d5487e1
+74ea538aa24490d7d259c881189bb58dbf1f692c:
+  title: 'nfs: fix undefined behavior in nfs_block_bits()'
+  mainline: 3c0a2e0b0ae661457c8505fecc7be5501aa7a715
+  backport: 593e234893f02097b207840c7c31b4d91b64ca14

diff --git a/Documentation/devicetree/bindings/sound/rt5645.txt b/Documentation/devicetree/bindings/sound/rt5645.txt
index 7cee1f5..525d36f 100644
--- a/Documentation/devicetree/bindings/sound/rt5645.txt
+++ b/Documentation/devicetree/bindings/sound/rt5645.txt

@@ -16,6 +16,11 @@
   a GPIO spec for the external headphone detect pin. If jd-mode = 0,
   we will get the JD status by getting the value of hp-detect-gpios.
 
+- cbj-sleeve-gpios:
+  a GPIO spec to control the external combo jack circuit to tie the sleeve/ring2
+  contacts to the ground or floating. It could avoid some electric noise from the
+  active speaker jacks.
+
 - realtek,in2-differential
   Boolean. Indicate MIC2 input are differential, rather than single-ended.
 
@@ -64,6 +69,7 @@
 	compatible = "realtek,rt5650";
 	reg = <0x1a>;
 	hp-detect-gpios = <&gpio 19 0>;
+	cbj-sleeve-gpios = <&gpio 20 0>;
 	interrupt-parent = <&gpio>;
 	interrupts = <7 IRQ_TYPE_EDGE_FALLING>;
 	realtek,dmic-en = "true";

diff --git a/Documentation/networking/segmentation-offloads.txt b/Documentation/networking/segmentation-offloads.txt
index 2f09455..cb0e64c 100644
--- a/Documentation/networking/segmentation-offloads.txt
+++ b/Documentation/networking/segmentation-offloads.txt

@@ -13,6 +13,7 @@
  * Generic Segmentation Offload - GSO
  * Generic Receive Offload - GRO
  * Partial Generic Segmentation Offload - GSO_PARTIAL
+ * SCTP accelleration with GSO - GSO_BY_FRAGS
 
 TCP Segmentation Offload
 ========================
@@ -128,3 +129,35 @@
 is the outer IPv4 ID field.  It is up to the device drivers to guarantee
 that the IPv4 ID field is incremented in the case that a given header does
 not have the DF bit set.
+
+SCTP accelleration with GSO
+===========================
+
+SCTP - despite the lack of hardware support - can still take advantage of
+GSO to pass one large packet through the network stack, rather than
+multiple small packets.
+
+This requires a different approach to other offloads, as SCTP packets
+cannot be just segmented to (P)MTU. Rather, the chunks must be contained in
+IP segments, padding respected. So unlike regular GSO, SCTP can't just
+generate a big skb, set gso_size to the fragmentation point and deliver it
+to IP layer.
+
+Instead, the SCTP protocol layer builds an skb with the segments correctly
+padded and stored as chained skbs, and skb_segment() splits based on those.
+To signal this, gso_size is set to the special value GSO_BY_FRAGS.
+
+Therefore, any code in the core networking stack must be aware of the
+possibility that gso_size will be GSO_BY_FRAGS and handle that case
+appropriately.
+
+There are a couple of helpers to make this easier:
+
+ - For size checks, the skb_gso_validate_*_len family of helpers correctly
+   considers GSO_BY_FRAGS.
+
+ - For manipulating packets, skb_increase_gso_size and skb_decrease_gso_size
+   will check for GSO_BY_FRAGS and WARN if asked to manipulate these skbs.
+
+This also affects drivers with the NETIF_F_FRAGLIST & NETIF_F_GSO_SCTP bits
+set. Note also that NETIF_F_GSO_SCTP is included in NETIF_F_GSO_SOFTWARE.

diff --git a/Documentation/sphinx/kernel_include.py b/Documentation/sphinx/kernel_include.py
index f523aa6..cf601bd 100755
--- a/Documentation/sphinx/kernel_include.py
+++ b/Documentation/sphinx/kernel_include.py

@@ -94,7 +94,6 @@
         # HINT: this is the only line I had to change / commented out:
         #path = utils.relative_path(None, path)
 
-        path = nodes.reprunicode(path)
         encoding = self.options.get(
             'encoding', self.state.document.settings.input_encoding)
         e_handler=self.state.document.settings.input_encoding_error_handler

diff --git a/Documentation/sysctl/vm.txt b/Documentation/sysctl/vm.txt
index 1d1f2cb..ec47a2b 100644
--- a/Documentation/sysctl/vm.txt
+++ b/Documentation/sysctl/vm.txt

@@ -60,6 +60,7 @@
 - stat_interval
 - stat_refresh
 - swappiness
+- unprivileged_userfaultfd
 - user_reserve_kbytes
 - vfs_cache_pressure
 - watermark_scale_factor
@@ -820,6 +821,22 @@
 
 ==============================================================
 
+unprivileged_userfaultfd
+
+This flag controls the mode in which unprivileged users can use the
+userfaultfd system calls. Set this to 0 to restrict unprivileged users
+to handle page faults in user mode only. In this case, users without
+SYS_CAP_PTRACE must pass UFFD_USER_MODE_ONLY in order for userfaultfd to
+succeed. Prohibiting use of userfaultfd for handling faults from kernel
+mode may make certain vulnerabilities more difficult to exploit.
+
+Set this to 1 to allow unprivileged users to use the userfaultfd system
+calls without any restrictions.
+
+The default value is 0.
+
+==============================================================
+
 - user_reserve_kbytes
 
 When overcommit_memory is set to 2, "never overcommit" mode, reserve

diff --git a/Documentation/vm/userfaultfd.txt b/Documentation/vm/userfaultfd.txt
index bb2f945..d0bad1c 100644
--- a/Documentation/vm/userfaultfd.txt
+++ b/Documentation/vm/userfaultfd.txt

@@ -56,36 +56,36 @@
 
 The uffdio_api.features bitmask returned by the UFFDIO_API ioctl
 defines what memory types are supported by the userfaultfd and what
-events, except page fault notifications, may be generated.
+events, except page fault notifications, may be generated:
 
-If the kernel supports registering userfaultfd ranges on hugetlbfs
-virtual memory areas, UFFD_FEATURE_MISSING_HUGETLBFS will be set in
-uffdio_api.features. Similarly, UFFD_FEATURE_MISSING_SHMEM will be
-set if the kernel supports registering userfaultfd ranges on shared
-memory (covering all shmem APIs, i.e. tmpfs, IPCSHM, /dev/zero
-MAP_SHARED, memfd_create, etc).
+- The UFFD_FEATURE_EVENT_* flags indicate that various other events
+  other than page faults are supported. These events are described in more
+  detail below in the Non-cooperative userfaultfd section.
 
-The userland application that wants to use userfaultfd with hugetlbfs
-or shared memory need to set the corresponding flag in
-uffdio_api.features to enable those features.
+- UFFD_FEATURE_MISSING_HUGETLBFS and UFFD_FEATURE_MISSING_SHMEM
+  indicate that the kernel supports UFFDIO_REGISTER_MODE_MISSING
+  registrations for hugetlbfs and shared memory (covering all shmem APIs,
+  i.e. tmpfs, IPCSHM, /dev/zero, MAP_SHARED, memfd_create,
+  etc) virtual memory areas, respectively.
 
-If the userland desires to receive notifications for events other than
-page faults, it has to verify that uffdio_api.features has appropriate
-UFFD_FEATURE_EVENT_* bits set. These events are described in more
-detail below in "Non-cooperative userfaultfd" section.
+- UFFD_FEATURE_MINOR_HUGETLBFS indicates that the kernel supports
+  UFFDIO_REGISTER_MODE_MINOR registration for hugetlbfs virtual memory
+  areas.
 
-Once the userfaultfd has been enabled the UFFDIO_REGISTER ioctl should
-be invoked (if present in the returned uffdio_api.ioctls bitmask) to
-register a memory range in the userfaultfd by setting the
+The userland application should set the feature flags it intends to use
+when invoking the UFFDIO_API ioctl, to request that those features be
+enabled if supported.
+
+Once the userfaultfd API has been enabled the UFFDIO_REGISTER
+ioctl should be invoked (if present in the returned uffdio_api.ioctls
+bitmask) to register a memory range in the userfaultfd by setting the
 uffdio_register structure accordingly. The uffdio_register.mode
 bitmask will specify to the kernel which kind of faults to track for
-the range (UFFDIO_REGISTER_MODE_MISSING would track missing
-pages). The UFFDIO_REGISTER ioctl will return the
+the range. The UFFDIO_REGISTER ioctl will return the
 uffdio_register.ioctls bitmask of ioctls that are suitable to resolve
 userfaults on the range registered. Not all ioctls will necessarily be
-supported for all memory types depending on the underlying virtual
-memory backend (anonymous memory vs tmpfs vs real filebacked
-mappings).
+supported for all memory types (e.g. anonymous memory vs. shmem vs.
+hugetlbfs), or all types of intercepted faults.
 
 Userland can use the uffdio_register.ioctls to manage the virtual
 address space in the background (to add or potentially also remove
@@ -93,13 +93,60 @@
 could be triggering just before userland maps in the background the
 user-faulted page.
 
-The primary ioctl to resolve userfaults is UFFDIO_COPY. That
-atomically copies a page into the userfault registered range and wakes
-up the blocked userfaults (unless uffdio_copy.mode &
-UFFDIO_COPY_MODE_DONTWAKE is set). Other ioctl works similarly to
-UFFDIO_COPY. They're atomic as in guaranteeing that nothing can see an
-half copied page since it'll keep userfaulting until the copy has
-finished.
+Resolving Userfaults
+--------------------
+
+There are three basic ways to resolve userfaults:
+
+- UFFDIO_COPY atomically copies some existing page contents from
+  userspace.
+
+- UFFDIO_ZEROPAGE atomically zeros the new page.
+
+- UFFDIO_CONTINUE maps an existing, previously-populated page.
+
+These operations are atomic in the sense that they guarantee nothing can
+see a half-populated page, since readers will keep userfaulting until the
+operation has finished.
+
+By default, these wake up userfaults blocked on the range in question.
+They support a UFFDIO_*_MODE_DONTWAKE mode flag, which indicates
+that waking will be done separately at some later time.
+
+Which ioctl to choose depends on the kind of page fault, and what we'd
+like to do to resolve it:
+
+- For UFFDIO_REGISTER_MODE_MISSING faults, the fault needs to be
+  resolved by either providing a new page (UFFDIO_COPY), or mapping
+  the zero page (UFFDIO_ZEROPAGE). By default, the kernel would map
+  the zero page for a missing fault. With userfaultfd, userspace can
+  decide what content to provide before the faulting thread continues.
+
+- For UFFDIO_REGISTER_MODE_MINOR faults, there is an existing page (in
+  the page cache). Userspace has the option of modifying the page's
+  contents before resolving the fault. Once the contents are correct
+  (modified or not), userspace asks the kernel to map the page and let the
+  faulting thread continue with UFFDIO_CONTINUE.
+
+Notes:
+
+- You can tell which kind of fault occurred by examining
+  pagefault.flags within the uffd_msg, checking for the
+  UFFD_PAGEFAULT_FLAG_* flags.
+
+- None of the page-delivering ioctls default to the range that you
+  registered with.  You must fill in all fields for the appropriate
+  ioctl struct including the range.
+
+- You get the address of the access that triggered the missing page
+  event out of a struct uffd_msg that you read in the thread from the
+  uffd.  You can supply as many pages as you want with these IOCTLs.
+  Keep in mind that unless you used DONTWAKE then the first of any of
+  those IOCTLs wakes up the faulting thread.
+
+- Be sure to test for all errors including
+  (pollfd[0].revents & POLLERR).  This can happen, e.g. when ranges
+  supplied were incorrect.
 
 == QEMU/KVM ==
 

diff --git a/Makefile b/Makefile
index a75486f..88eb8a5 100644
--- a/Makefile
+++ b/Makefile

@@ -1,7 +1,7 @@
 # SPDX-License-Identifier: GPL-2.0
 VERSION = 4
 PATCHLEVEL = 14
-SUBLEVEL = 345
+SUBLEVEL = 349
 EXTRAVERSION = -openela
 NAME = Petit Gorille
 

diff --git a/arch/arc/boot/dts/hsdk.dts b/arch/arc/boot/dts/hsdk.dts
index 75aa3a8..b047617 100644
--- a/arch/arc/boot/dts/hsdk.dts
+++ b/arch/arc/boot/dts/hsdk.dts

@@ -158,7 +158,6 @@
 		};
 
 		ethernet@8000 {
-			#interrupt-cells = <1>;
 			compatible = "snps,dwmac";
 			reg = <0x8000 0x2000>;
 			interrupts = <10>;

diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig
index eed849a..13c6bf6 100644
--- a/arch/arm64/Kconfig
+++ b/arch/arm64/Kconfig

@@ -127,6 +127,7 @@
 	select SPARSE_IRQ
 	select SYSCTL_EXCEPTION_TRACE
 	select THREAD_INFO_IN_TASK
+	select HAVE_ARCH_USERFAULTFD_MINOR if USERFAULTFD
 	help
 	  ARM 64-bit (AArch64) Linux support.
 

diff --git a/arch/arm64/boot/dts/hisilicon/hi3798cv200.dtsi b/arch/arm64/boot/dts/hisilicon/hi3798cv200.dtsi
index 75865f8a..0ffdc92 100644
--- a/arch/arm64/boot/dts/hisilicon/hi3798cv200.dtsi
+++ b/arch/arm64/boot/dts/hisilicon/hi3798cv200.dtsi

@@ -58,7 +58,7 @@
 	gic: interrupt-controller@f1001000 {
 		compatible = "arm,gic-400";
 		reg = <0x0 0xf1001000 0x0 0x1000>,  /* GICD */
-		      <0x0 0xf1002000 0x0 0x100>;   /* GICC */
+		      <0x0 0xf1002000 0x0 0x2000>;  /* GICC */
 		#address-cells = <0>;
 		#interrupt-cells = <3>;
 		interrupt-controller;

diff --git a/arch/arm64/boot/dts/nvidia/tegra132-norrin.dts b/arch/arm64/boot/dts/nvidia/tegra132-norrin.dts
index a0385a3..dc7bfc9 100644
--- a/arch/arm64/boot/dts/nvidia/tegra132-norrin.dts
+++ b/arch/arm64/boot/dts/nvidia/tegra132-norrin.dts

@@ -9,8 +9,8 @@
 	compatible = "nvidia,norrin", "nvidia,tegra132", "nvidia,tegra124";
 
 	aliases {
-		rtc0 = "/i2c@7000d000/as3722@40";
-		rtc1 = "/rtc@7000e000";
+		rtc0 = &as3722;
+		rtc1 = &tegra_rtc;
 		serial0 = &uarta;
 	};
 

diff --git a/arch/arm64/boot/dts/nvidia/tegra132.dtsi b/arch/arm64/boot/dts/nvidia/tegra132.dtsi
index fa5a7c4b..d99ffa4 100644
--- a/arch/arm64/boot/dts/nvidia/tegra132.dtsi
+++ b/arch/arm64/boot/dts/nvidia/tegra132.dtsi

@@ -569,7 +569,7 @@
 		status = "disabled";
 	};
 
-	rtc@7000e000 {
+	tegra_rtc: rtc@7000e000 {
 		compatible = "nvidia,tegra124-rtc", "nvidia,tegra20-rtc";
 		reg = <0x0 0x7000e000 0x0 0x100>;
 		interrupts = <GIC_SPI 2 IRQ_TYPE_LEVEL_HIGH>;

diff --git a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
index c5981b9..58bf798 100644
--- a/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi
+++ b/arch/arm64/boot/dts/rockchip/rk3399-puma.dtsi

@@ -442,16 +442,22 @@
 	gpio1830-supply = <&vcc_1v8>;
 };
 
-&pmu_io_domains {
-	status = "okay";
-	pmu1830-supply = <&vcc_1v8>;
-};
-
-&pwm2 {
-	status = "okay";
+&pcie_clkreqn_cpm {
+	rockchip,pins =
+		<2 RK_PD2 RK_FUNC_GPIO &pcfg_pull_up>;
 };
 
 &pinctrl {
+	pinctrl-names = "default";
+	pinctrl-0 = <&q7_thermal_pin>;
+
+	gpios {
+		q7_thermal_pin: q7-thermal-pin {
+			rockchip,pins =
+				<0 RK_PA3 RK_FUNC_GPIO &pcfg_pull_up>;
+		};
+	};
+
 	i2c8 {
 		i2c8_xfer_a: i2c8-xfer {
 			rockchip,pins =
@@ -482,6 +488,15 @@
 	};
 };
 
+&pmu_io_domains {
+	status = "okay";
+	pmu1830-supply = <&vcc_1v8>;
+};
+
+&pwm2 {
+	status = "okay";
+};
+
 &sdhci {
 	/*
 	 * Signal integrity isn't great at 200MHz but 100MHz has proven stable

diff --git a/arch/arm64/include/asm/asm-bug.h b/arch/arm64/include/asm/asm-bug.h
index 636e755..63ea62f 100644
--- a/arch/arm64/include/asm/asm-bug.h
+++ b/arch/arm64/include/asm/asm-bug.h

@@ -39,6 +39,7 @@
 	0:	.long 1f - 0b;				\
 _BUGVERBOSE_LOCATION(__FILE__, __LINE__)		\
 		.short flags; 				\
+		.align 2;				\
 		.popsection;				\
 	1:
 #else

diff --git a/arch/arm64/kernel/vmlinux.lds.S b/arch/arm64/kernel/vmlinux.lds.S
index a074dfd..68acae3 100644
--- a/arch/arm64/kernel/vmlinux.lds.S
+++ b/arch/arm64/kernel/vmlinux.lds.S

@@ -134,6 +134,7 @@
 			IDMAP_TEXT
 			HIBERNATE_TEXT
 			TRAMP_TEXT
+			*(.text..L.cfi.jumptable .text..L.cfi.jumptable.*)
 			*(.fixup)
 			*(.gnu.warning)
 		. = ALIGN(16);

diff --git a/arch/arm64/kvm/guest.c b/arch/arm64/kvm/guest.c
index 8ae0f40..fdc98b9 100644
--- a/arch/arm64/kvm/guest.c
+++ b/arch/arm64/kvm/guest.c

@@ -175,6 +175,7 @@
 		case COMPAT_PSR_MODE_SVC:
 		case COMPAT_PSR_MODE_ABT:
 		case COMPAT_PSR_MODE_UND:
+		case COMPAT_PSR_MODE_SYS:
 			if (!vcpu_el1_is_32bit(vcpu))
 				return -EINVAL;
 			break;

diff --git a/arch/arm64/mm/hugetlbpage.c b/arch/arm64/mm/hugetlbpage.c
index 9f6ae96..54fae25 100644
--- a/arch/arm64/mm/hugetlbpage.c
+++ b/arch/arm64/mm/hugetlbpage.c

@@ -203,7 +203,7 @@
 		set_pte(ptep, pte);
 }
 
-pte_t *huge_pte_alloc(struct mm_struct *mm,
+pte_t *huge_pte_alloc(struct mm_struct *mm, struct vm_area_struct *vma,
 		      unsigned long addr, unsigned long sz)
 {
 	pgd_t *pgd;
@@ -231,9 +231,8 @@
 		 */
 		pte = pte_alloc_map(mm, pmd, addr);
 	} else if (sz == PMD_SIZE) {
-		if (IS_ENABLED(CONFIG_ARCH_WANT_HUGE_PMD_SHARE) &&
-		    pud_none(*pud))
-			pte = huge_pmd_share(mm, addr, pud);
+		if (want_pmd_share(vma, addr) && pud_none(READ_ONCE(*pud)))
+			ptep = huge_pmd_share(mm, vma, addr, pud);
 		else
 			pte = (pte_t *)pmd_alloc(mm, pud, addr);
 	} else if (sz == (PMD_SIZE * CONT_PMDS)) {

diff --git a/arch/ia64/mm/hugetlbpage.c b/arch/ia64/mm/hugetlbpage.c
index d16e419..7529ff1 100644
--- a/arch/ia64/mm/hugetlbpage.c
+++ b/arch/ia64/mm/hugetlbpage.c

@@ -26,7 +26,8 @@
 EXPORT_SYMBOL(hpage_shift);
 
 pte_t *
-huge_pte_alloc(struct mm_struct *mm, unsigned long addr, unsigned long sz)
+huge_pte_alloc(struct mm_struct *mm, struct vm_area_struct *vma,
+	       unsigned long addr, unsigned long sz)
 {
 	unsigned long taddr = htlbpage_to_page(addr);
 	pgd_t *pgd;

diff --git a/arch/m68k/include/asm/mac_iop.h b/arch/m68k/include/asm/mac_iop.h
index 73dae2a..32f1c79 100644
--- a/arch/m68k/include/asm/mac_iop.h
+++ b/arch/m68k/include/asm/mac_iop.h

@@ -159,6 +159,7 @@
 extern void iop_upload_code(uint, __u8 *, uint, __u16);
 extern void iop_download_code(uint, __u8 *, uint, __u16);
 extern __u8 *iop_compare_code(uint, __u8 *, uint, __u16);
+extern void iop_ism_irq_poll(uint);
 
 extern void iop_register_interrupts(void);
 

diff --git a/arch/m68k/kernel/entry.S b/arch/m68k/kernel/entry.S
index 9a66657..417d8f0 100644
--- a/arch/m68k/kernel/entry.S
+++ b/arch/m68k/kernel/entry.S

@@ -425,7 +425,9 @@
 	movec	%a0,%dfc
 
 	/* restore status register */
-	movew	%a1@(TASK_THREAD+THREAD_SR),%sr
+	movew	%a1@(TASK_THREAD+THREAD_SR),%d0
+	oriw	#0x0700,%d0
+	movew	%d0,%sr
 
 	rts
 

diff --git a/arch/m68k/mac/iop.c b/arch/m68k/mac/iop.c
index 0b94f66..9c80ed8 100644
--- a/arch/m68k/mac/iop.c
+++ b/arch/m68k/mac/iop.c

@@ -589,3 +589,12 @@
 	}
 	return IRQ_HANDLED;
 }
+
+void iop_ism_irq_poll(uint iop_num)
+{
+	unsigned long flags;
+
+	local_irq_save(flags);
+	iop_ism_irq(0, (void *)iop_num);
+	local_irq_restore(flags);
+}

diff --git a/arch/m68k/mac/misc.c b/arch/m68k/mac/misc.c
index 4956eda..d4cb7b5 100644
--- a/arch/m68k/mac/misc.c
+++ b/arch/m68k/mac/misc.c

@@ -483,41 +483,19 @@
 
 void mac_reset(void)
 {
-	if (macintosh_config->adb_type == MAC_ADB_II) {
-		unsigned long flags;
-
-		/* need ROMBASE in booter */
-		/* indeed, plus need to MAP THE ROM !! */
-
-		if (mac_bi_data.rombase == 0)
-			mac_bi_data.rombase = 0x40800000;
-
-		/* works on some */
-		rom_reset = (void *) (mac_bi_data.rombase + 0xa);
-
-		if (macintosh_config->ident == MAC_MODEL_SE30) {
-			/*
-			 * MSch: Machines known to crash on ROM reset ...
-			 */
-		} else {
-			local_irq_save(flags);
-
-			rom_reset();
-
-			local_irq_restore(flags);
-		}
 #ifdef CONFIG_ADB_CUDA
-	} else if (macintosh_config->adb_type == MAC_ADB_EGRET ||
-	           macintosh_config->adb_type == MAC_ADB_CUDA) {
+	if (macintosh_config->adb_type == MAC_ADB_EGRET ||
+	    macintosh_config->adb_type == MAC_ADB_CUDA) {
 		cuda_restart();
+	} else
 #endif
 #ifdef CONFIG_ADB_PMU68K
-	} else if (macintosh_config->adb_type == MAC_ADB_PB1
-		|| macintosh_config->adb_type == MAC_ADB_PB2) {
+	if (macintosh_config->adb_type == MAC_ADB_PB1 ||
+	    macintosh_config->adb_type == MAC_ADB_PB2) {
 		pmu_restart();
+	} else
 #endif
-	} else if (CPU_IS_030) {
-
+	if (CPU_IS_030) {
 		/* 030-specific reset routine.  The idea is general, but the
 		 * specific registers to reset are '030-specific.  Until I
 		 * have a non-030 machine, I can't test anything else.
@@ -564,6 +542,18 @@
 		    "jmp %/a0@\n\t" /* jump to the reset vector */
 		    ".chip 68k"
 		    : : "r" (offset), "a" (rombase) : "a0");
+	} else {
+		/* need ROMBASE in booter */
+		/* indeed, plus need to MAP THE ROM !! */
+
+		if (mac_bi_data.rombase == 0)
+			mac_bi_data.rombase = 0x40800000;
+
+		/* works on some */
+		rom_reset = (void *)(mac_bi_data.rombase + 0xa);
+
+		local_irq_disable();
+		rom_reset();
 	}
 
 	/* should never get here */

diff --git a/arch/mips/mm/hugetlbpage.c b/arch/mips/mm/hugetlbpage.c
index cef1522..cba32ef 100644
--- a/arch/mips/mm/hugetlbpage.c
+++ b/arch/mips/mm/hugetlbpage.c

@@ -21,8 +21,8 @@
 #include <asm/tlb.h>
 #include <asm/tlbflush.h>
 
-pte_t *huge_pte_alloc(struct mm_struct *mm, unsigned long addr,
-		      unsigned long sz)
+pte_t *huge_pte_alloc(struct mm_struct *mm, struct vm_area_struct *vma,
+		      unsigned long addr, unsigned long sz)
 {
 	pgd_t *pgd;
 	pud_t *pud;

diff --git a/arch/parisc/kernel/parisc_ksyms.c b/arch/parisc/kernel/parisc_ksyms.c
index 7baa226..e0d4b7d 100644
--- a/arch/parisc/kernel/parisc_ksyms.c
+++ b/arch/parisc/kernel/parisc_ksyms.c

@@ -34,6 +34,7 @@
 #include <linux/atomic.h>
 EXPORT_SYMBOL(__xchg8);
 EXPORT_SYMBOL(__xchg32);
+EXPORT_SYMBOL(__cmpxchg_u8);
 EXPORT_SYMBOL(__cmpxchg_u32);
 EXPORT_SYMBOL(__cmpxchg_u64);
 #ifdef CONFIG_SMP

diff --git a/arch/parisc/mm/hugetlbpage.c b/arch/parisc/mm/hugetlbpage.c
index d77479a..5cf323f 100644
--- a/arch/parisc/mm/hugetlbpage.c
+++ b/arch/parisc/mm/hugetlbpage.c

@@ -45,7 +45,7 @@
 }
 
 
-pte_t *huge_pte_alloc(struct mm_struct *mm,
+pte_t *huge_pte_alloc(struct mm_struct *mm, struct vm_area_struct *vma,
 			unsigned long addr, unsigned long sz)
 {
 	pgd_t *pgd;

diff --git a/arch/powerpc/include/asm/hvcall.h b/arch/powerpc/include/asm/hvcall.h
index 15cef59..63907b4 100644
--- a/arch/powerpc/include/asm/hvcall.h
+++ b/arch/powerpc/include/asm/hvcall.h

@@ -422,7 +422,7 @@
 	unsigned long backing_mem;
 };
 
-int h_get_mpp(struct hvcall_mpp_data *);
+long h_get_mpp(struct hvcall_mpp_data *mpp_data);
 
 struct hvcall_mpp_x_data {
 	unsigned long coalesced_bytes;

diff --git a/arch/powerpc/mm/hugetlbpage.c b/arch/powerpc/mm/hugetlbpage.c
index e2d929d..ad08e13 100644
--- a/arch/powerpc/mm/hugetlbpage.c
+++ b/arch/powerpc/mm/hugetlbpage.c

@@ -134,7 +134,8 @@
  * At this point we do the placement change only for BOOK3S 64. This would
  * possibly work on other subarchs.
  */
-pte_t *huge_pte_alloc(struct mm_struct *mm, unsigned long addr, unsigned long sz)
+pte_t *huge_pte_alloc(struct mm_struct *mm, struct vm_area_struct *vma,
+		      unsigned long addr, unsigned long sz)
 {
 	pgd_t *pg;
 	pud_t *pu;

diff --git a/arch/powerpc/platforms/pseries/lpar.c b/arch/powerpc/platforms/pseries/lpar.c
index 215b14a..ae75f53 100644
--- a/arch/powerpc/platforms/pseries/lpar.c
+++ b/arch/powerpc/platforms/pseries/lpar.c

@@ -937,10 +937,10 @@
  * h_get_mpp
  * H_GET_MPP hcall returns info in 7 parms
  */
-int h_get_mpp(struct hvcall_mpp_data *mpp_data)
+long h_get_mpp(struct hvcall_mpp_data *mpp_data)
 {
-	int rc;
-	unsigned long retbuf[PLPAR_HCALL9_BUFSIZE];
+	unsigned long retbuf[PLPAR_HCALL9_BUFSIZE] = {0};
+	long rc;
 
 	rc = plpar_hcall9(H_GET_MPP, retbuf);
 

diff --git a/arch/powerpc/platforms/pseries/lparcfg.c b/arch/powerpc/platforms/pseries/lparcfg.c
index f40dabf..9324be1 100644
--- a/arch/powerpc/platforms/pseries/lparcfg.c
+++ b/arch/powerpc/platforms/pseries/lparcfg.c

@@ -112,8 +112,8 @@
  */
 static unsigned int h_get_ppp(struct hvcall_ppp_data *ppp_data)
 {
-	unsigned long rc;
-	unsigned long retbuf[PLPAR_HCALL9_BUFSIZE];
+	unsigned long retbuf[PLPAR_HCALL9_BUFSIZE] = {0};
+	long rc;
 
 	rc = plpar_hcall9(H_GET_PPP, retbuf);
 
@@ -159,7 +159,7 @@
 	struct hvcall_ppp_data ppp_data;
 	struct device_node *root;
 	const __be32 *perf_level;
-	int rc;
+	long rc;
 
 	rc = h_get_ppp(&ppp_data);
 	if (rc)

diff --git a/arch/powerpc/sysdev/fsl_msi.c b/arch/powerpc/sysdev/fsl_msi.c
index d43d3d1..6a686e5 100644
--- a/arch/powerpc/sysdev/fsl_msi.c
+++ b/arch/powerpc/sysdev/fsl_msi.c

@@ -576,10 +576,12 @@
 	.msiir_offset = 0x38,
 };
 
+#ifdef CONFIG_EPAPR_PARAVIRT
 static const struct fsl_msi_feature vmpic_msi_feature = {
 	.fsl_pic_ip = FSL_PIC_IP_VMPIC,
 	.msiir_offset = 0,
 };
+#endif
 
 static const struct of_device_id fsl_of_msi_ids[] = {
 	{

diff --git a/arch/s390/mm/hugetlbpage.c b/arch/s390/mm/hugetlbpage.c
index 777a441..c689a48 100644
--- a/arch/s390/mm/hugetlbpage.c
+++ b/arch/s390/mm/hugetlbpage.c

@@ -162,7 +162,7 @@
 	return pte;
 }
 
-pte_t *huge_pte_alloc(struct mm_struct *mm,
+pte_t *huge_pte_alloc(struct mm_struct *mm, struct vm_area_struct *vma,
 			unsigned long addr, unsigned long sz)
 {
 	pgd_t *pgdp;

diff --git a/arch/sh/kernel/kprobes.c b/arch/sh/kernel/kprobes.c
index 52a5e11..a655029 100644
--- a/arch/sh/kernel/kprobes.c
+++ b/arch/sh/kernel/kprobes.c

@@ -47,17 +47,12 @@
 	if (OPCODE_RTE(opcode))
 		return -EFAULT;	/* Bad breakpoint */
 
+	memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
 	p->opcode = opcode;
 
 	return 0;
 }
 
-void __kprobes arch_copy_kprobe(struct kprobe *p)
-{
-	memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
-	p->opcode = *p->addr;
-}
-
 void __kprobes arch_arm_kprobe(struct kprobe *p)
 {
 	*p->addr = BREAKPOINT_INSTRUCTION;

diff --git a/arch/sh/lib/checksum.S b/arch/sh/lib/checksum.S
index 356c8ec9..1fc361b 100644
--- a/arch/sh/lib/checksum.S
+++ b/arch/sh/lib/checksum.S

@@ -36,7 +36,8 @@
  */
 
 /*	
- * asmlinkage __wsum csum_partial(const void *buf, int len, __wsum sum);
+ * unsigned int csum_partial(const unsigned char *buf, int len,
+ *                           unsigned int sum);
  */
 
 .text
@@ -48,31 +49,11 @@
 	   * Fortunately, it is easy to convert 2-byte alignment to 4-byte
 	   * alignment for the unrolled loop.
 	   */
+	mov	r5, r1
 	mov	r4, r0
-	tst	#3, r0		! Check alignment.
-	bt/s	2f		! Jump if alignment is ok.
-	 mov	r4, r7		! Keep a copy to check for alignment
+	tst	#2, r0		! Check alignment.
+	bt	2f		! Jump if alignment is ok.
 	!
-	tst	#1, r0		! Check alignment.
-	bt	21f		! Jump if alignment is boundary of 2bytes.
-
-	! buf is odd
-	tst	r5, r5
-	add	#-1, r5
-	bt	9f
-	mov.b	@r4+, r0
-	extu.b	r0, r0
-	addc	r0, r6		! t=0 from previous tst
-	mov	r6, r0
-	shll8	r6
-	shlr16	r0
-	shlr8	r0
-	or	r0, r6
-	mov	r4, r0
-	tst	#2, r0
-	bt	2f
-21:
-	! buf is 2 byte aligned (len could be 0)
 	add	#-2, r5		! Alignment uses up two bytes.
 	cmp/pz	r5		!
 	bt/s	1f		! Jump if we had at least two bytes.
@@ -80,17 +61,16 @@
 	bra	6f
 	 add	#2, r5		! r5 was < 2.  Deal with it.
 1:
+	mov	r5, r1		! Save new len for later use.
 	mov.w	@r4+, r0
 	extu.w	r0, r0
 	addc	r0, r6
 	bf	2f
 	add	#1, r6
 2:
-	! buf is 4 byte aligned (len could be 0)
-	mov	r5, r1
 	mov	#-5, r0
-	shld	r0, r1
-	tst	r1, r1
+	shld	r0, r5
+	tst	r5, r5
 	bt/s	4f		! if it's =0, go to 4f
 	 clrt
 	.align	2
@@ -112,31 +92,30 @@
 	addc	r0, r6
 	addc	r2, r6
 	movt	r0
-	dt	r1
+	dt	r5
 	bf/s	3b
 	 cmp/eq	#1, r0
-	! here, we know r1==0
-	addc	r1, r6			! add carry to r6
+	! here, we know r5==0
+	addc	r5, r6			! add carry to r6
 4:
-	mov	r5, r0
+	mov	r1, r0
 	and	#0x1c, r0
 	tst	r0, r0
-	bt	6f
-	! 4 bytes or more remaining
-	mov	r0, r1
-	shlr2	r1
+	bt/s	6f
+	 mov	r0, r5
+	shlr2	r5
 	mov	#0, r2
 5:
 	addc	r2, r6
 	mov.l	@r4+, r2
 	movt	r0
-	dt	r1
+	dt	r5
 	bf/s	5b
 	 cmp/eq	#1, r0
 	addc	r2, r6
-	addc	r1, r6		! r1==0 here, so it means add carry-bit
+	addc	r5, r6		! r5==0 here, so it means add carry-bit
 6:
-	! 3 bytes or less remaining
+	mov	r1, r5
 	mov	#3, r0
 	and	r0, r5
 	tst	r5, r5
@@ -162,16 +141,6 @@
 	mov	#0, r0
 	addc	r0, r6
 9:
-	! Check if the buffer was misaligned, if so realign sum
-	mov	r7, r0
-	tst	#1, r0
-	bt	10f
-	mov	r6, r0
-	shll8	r6
-	shlr16	r0
-	shlr8	r0
-	or	r0, r6
-10:
 	rts
 	 mov	r6, r0
 

diff --git a/arch/sh/mm/hugetlbpage.c b/arch/sh/mm/hugetlbpage.c
index 960deb1..1f4fb22 100644
--- a/arch/sh/mm/hugetlbpage.c
+++ b/arch/sh/mm/hugetlbpage.c

@@ -22,7 +22,7 @@
 #include <asm/tlbflush.h>
 #include <asm/cacheflush.h>
 
-pte_t *huge_pte_alloc(struct mm_struct *mm,
+pte_t *huge_pte_alloc(struct mm_struct *mm, struct vm_area_struct *vma,
 			unsigned long addr, unsigned long sz)
 {
 	pgd_t *pgd;

diff --git a/arch/sparc/include/asm/smp_64.h b/arch/sparc/include/asm/smp_64.h
index e75783b..16ab904 100644
--- a/arch/sparc/include/asm/smp_64.h
+++ b/arch/sparc/include/asm/smp_64.h

@@ -47,7 +47,6 @@
 int hard_smp_processor_id(void);
 #define raw_smp_processor_id() (current_thread_info()->cpu)
 
-void smp_fill_in_cpu_possible_map(void);
 void smp_fill_in_sib_core_maps(void);
 void cpu_play_dead(void);
 
@@ -77,7 +76,6 @@
 #define smp_fill_in_sib_core_maps() do { } while (0)
 #define smp_fetch_global_regs() do { } while (0)
 #define smp_fetch_global_pmu() do { } while (0)
-#define smp_fill_in_cpu_possible_map() do { } while (0)
 #define smp_init_cpu_poke() do { } while (0)
 #define scheduler_poke() do { } while (0)
 

diff --git a/arch/sparc/include/uapi/asm/termbits.h b/arch/sparc/include/uapi/asm/termbits.h
index ce5ad5d..0614e17 100644
--- a/arch/sparc/include/uapi/asm/termbits.h
+++ b/arch/sparc/include/uapi/asm/termbits.h

@@ -13,16 +13,6 @@
 typedef unsigned long   tcflag_t;
 #endif
 
-#define NCC 8
-struct termio {
-	unsigned short c_iflag;		/* input mode flags */
-	unsigned short c_oflag;		/* output mode flags */
-	unsigned short c_cflag;		/* control mode flags */
-	unsigned short c_lflag;		/* local mode flags */
-	unsigned char c_line;		/* line discipline */
-	unsigned char c_cc[NCC];	/* control characters */
-};
-
 #define NCCS 17
 struct termios {
 	tcflag_t c_iflag;		/* input mode flags */

diff --git a/arch/sparc/include/uapi/asm/termios.h b/arch/sparc/include/uapi/asm/termios.h
index ee86f4093..cceb322 100644
--- a/arch/sparc/include/uapi/asm/termios.h
+++ b/arch/sparc/include/uapi/asm/termios.h

@@ -40,5 +40,14 @@
 	unsigned short ws_ypixel;
 };
 
+#define NCC 8
+struct termio {
+	unsigned short c_iflag;		/* input mode flags */
+	unsigned short c_oflag;		/* output mode flags */
+	unsigned short c_cflag;		/* control mode flags */
+	unsigned short c_lflag;		/* local mode flags */
+	unsigned char c_line;		/* line discipline */
+	unsigned char c_cc[NCC];	/* control characters */
+};
 
 #endif /* _UAPI_SPARC_TERMIOS_H */

diff --git a/arch/sparc/kernel/prom_64.c b/arch/sparc/kernel/prom_64.c
index baeaeed..4bc0821 100644
--- a/arch/sparc/kernel/prom_64.c
+++ b/arch/sparc/kernel/prom_64.c

@@ -479,7 +479,9 @@
 	ncpus_probed++;
 #ifdef CONFIG_SMP
 	set_cpu_present(cpuid, true);
-	set_cpu_possible(cpuid, true);
+
+	if (num_possible_cpus() < nr_cpu_ids)
+		set_cpu_possible(cpuid, true);
 #endif
 	return NULL;
 }

diff --git a/arch/sparc/kernel/setup_64.c b/arch/sparc/kernel/setup_64.c
index 34f7a53..8210b499 100644
--- a/arch/sparc/kernel/setup_64.c
+++ b/arch/sparc/kernel/setup_64.c

@@ -688,7 +688,6 @@
 
 	paging_init();
 	init_sparc64_elf_hwcap();
-	smp_fill_in_cpu_possible_map();
 	/*
 	 * Once the OF device tree and MDESC have been setup and nr_cpus has
 	 * been parsed, we know the list of possible cpus.  Therefore we can

diff --git a/arch/sparc/kernel/smp_64.c b/arch/sparc/kernel/smp_64.c
index 9882505..4d8ffc1 100644
--- a/arch/sparc/kernel/smp_64.c
+++ b/arch/sparc/kernel/smp_64.c

@@ -1213,20 +1213,6 @@
 		xcall_deliver_impl = hypervisor_xcall_deliver;
 }
 
-void __init smp_fill_in_cpu_possible_map(void)
-{
-	int possible_cpus = num_possible_cpus();
-	int i;
-
-	if (possible_cpus > nr_cpu_ids)
-		possible_cpus = nr_cpu_ids;
-
-	for (i = 0; i < possible_cpus; i++)
-		set_cpu_possible(i, true);
-	for (; i < NR_CPUS; i++)
-		set_cpu_possible(i, false);
-}
-
 void smp_fill_in_sib_core_maps(void)
 {
 	unsigned int i;

diff --git a/arch/sparc/mm/hugetlbpage.c b/arch/sparc/mm/hugetlbpage.c
index 5078b7f..c572e57 100644
--- a/arch/sparc/mm/hugetlbpage.c
+++ b/arch/sparc/mm/hugetlbpage.c

@@ -261,7 +261,7 @@
 	return size;
 }
 
-pte_t *huge_pte_alloc(struct mm_struct *mm,
+pte_t *huge_pte_alloc(struct mm_struct *mm, struct vm_area_struct *vma,
 			unsigned long addr, unsigned long sz)
 {
 	pgd_t *pgd;

diff --git a/arch/um/drivers/line.c b/arch/um/drivers/line.c
index 7e524ef..71e2648 100644
--- a/arch/um/drivers/line.c
+++ b/arch/um/drivers/line.c

@@ -683,24 +683,26 @@
 		goto cleanup;
 	}
 
-	*winch = ((struct winch) { .list  	= LIST_HEAD_INIT(winch->list),
-				   .fd  	= fd,
+	*winch = ((struct winch) { .fd  	= fd,
 				   .tty_fd 	= tty_fd,
 				   .pid  	= pid,
 				   .port 	= port,
 				   .stack	= stack });
 
+	spin_lock(&winch_handler_lock);
+	list_add(&winch->list, &winch_handlers);
+	spin_unlock(&winch_handler_lock);
+
 	if (um_request_irq(WINCH_IRQ, fd, IRQ_READ, winch_interrupt,
 			   IRQF_SHARED, "winch", winch) < 0) {
 		printk(KERN_ERR "register_winch_irq - failed to register "
 		       "IRQ\n");
+		spin_lock(&winch_handler_lock);
+		list_del(&winch->list);
+		spin_unlock(&winch_handler_lock);
 		goto out_free;
 	}
 
-	spin_lock(&winch_handler_lock);
-	list_add(&winch->list, &winch_handlers);
-	spin_unlock(&winch_handler_lock);
-
 	return;
 
  out_free:

diff --git a/arch/um/drivers/ubd_kern.c b/arch/um/drivers/ubd_kern.c
index b55fe9b..0a16ab9 100644
--- a/arch/um/drivers/ubd_kern.c
+++ b/arch/um/drivers/ubd_kern.c

@@ -1147,7 +1147,7 @@
 
 	if (irq_req_buffer == NULL) {
 		printk(KERN_ERR "Failed to initialize ubd buffering\n");
-		return -1;
+		return -ENOMEM;
 	}
 	io_req_buffer = kmalloc(
 			sizeof(struct io_thread_req *) * UBD_REQ_BUFFER_SIZE,
@@ -1158,7 +1158,7 @@
 
 	if (io_req_buffer == NULL) {
 		printk(KERN_ERR "Failed to initialize ubd buffering\n");
-		return -1;
+		return -ENOMEM;
 	}
 	platform_driver_register(&ubd_driver);
 	mutex_lock(&ubd_lock);

diff --git a/arch/um/include/asm/mmu.h b/arch/um/include/asm/mmu.h
index da70544..21fbe54 100644
--- a/arch/um/include/asm/mmu.h
+++ b/arch/um/include/asm/mmu.h

@@ -15,8 +15,6 @@
 	struct page *stub_pages[2];
 } mm_context_t;
 
-extern void __switch_mm(struct mm_id * mm_idp);
-
 /* Avoid tangled inclusion with asm/ldt.h */
 extern long init_new_ldt(struct mm_context *to_mm, struct mm_context *from_mm);
 extern void free_ldt(struct mm_context *mm);

diff --git a/arch/um/include/shared/skas/mm_id.h b/arch/um/include/shared/skas/mm_id.h
index 48dd098..169482e 100644
--- a/arch/um/include/shared/skas/mm_id.h
+++ b/arch/um/include/shared/skas/mm_id.h

@@ -14,4 +14,6 @@
 	unsigned long stack;
 };
 
+void __switch_mm(struct mm_id *mm_idp);
+
 #endif

diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index d52dca0..1de188d 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig

@@ -119,6 +119,7 @@
 	select HAVE_ARCH_TRACEHOOK
 	select HAVE_ARCH_TRANSPARENT_HUGEPAGE
 	select HAVE_ARCH_TRANSPARENT_HUGEPAGE_PUD if X86_64
+	select HAVE_ARCH_USERFAULTFD_MINOR	if X86_64 && USERFAULTFD
 	select HAVE_ARCH_VMAP_STACK		if X86_64
 	select HAVE_ARCH_WITHIN_STACK_FRAMES
 	select HAVE_CC_STACKPROTECTOR

diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
index bec0952..46906a0 100644
--- a/arch/x86/Kconfig.debug
+++ b/arch/x86/Kconfig.debug

@@ -384,6 +384,7 @@
 
 config UNWINDER_FRAME_POINTER
 	bool "Frame pointer unwinder"
+	select ARCH_WANT_FRAME_POINTERS
 	select FRAME_POINTER
 	---help---
 	  This option enables the frame pointer unwinder for unwinding kernel
@@ -411,8 +412,4 @@
 
 endchoice
 
-config FRAME_POINTER
-	depends on !UNWINDER_ORC && !UNWINDER_GUESS
-	bool
-
 endmenu

diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h
index 95f59f5..a3e0302 100644
--- a/arch/x86/include/asm/apic.h
+++ b/arch/x86/include/asm/apic.h

@@ -11,6 +11,7 @@
 #include <asm/mpspec.h>
 #include <asm/msr.h>
 #include <asm/hardirq.h>
+#include <asm/io.h>
 
 #define ARCH_APICTIMER_STOPS_ON_C3	1
 
@@ -101,7 +102,7 @@
 
 static inline u32 native_apic_mem_read(u32 reg)
 {
-	return *((volatile u32 *)(APIC_BASE + reg));
+	return readl((void __iomem *)(APIC_BASE + reg));
 }
 
 extern void native_apic_wait_icr_idle(void);

diff --git a/arch/x86/include/asm/kvm_para.h b/arch/x86/include/asm/kvm_para.h
index c373e44..ec51eee 100644
--- a/arch/x86/include/asm/kvm_para.h
+++ b/arch/x86/include/asm/kvm_para.h

@@ -6,7 +6,6 @@
 #include <asm/alternative.h>
 #include <uapi/asm/kvm_para.h>
 
-extern void kvmclock_init(void);
 extern int kvm_register_clock(char *txt);
 
 #ifdef CONFIG_KVM_GUEST
@@ -86,13 +85,14 @@
 }
 
 #ifdef CONFIG_KVM_GUEST
+void kvmclock_init(void);
+void kvmclock_disable(void);
 bool kvm_para_available(void);
 unsigned int kvm_arch_para_features(void);
 void __init kvm_guest_init(void);
 void kvm_async_pf_task_wait(u32 token, int interrupt_kernel);
 void kvm_async_pf_task_wake(u32 token);
 u32 kvm_read_and_reset_pf_reason(void);
-extern void kvm_disable_steal_time(void);
 
 #ifdef CONFIG_PARAVIRT_SPINLOCKS
 void __init kvm_spinlock_init(void);
@@ -122,10 +122,6 @@
 	return 0;
 }
 
-static inline void kvm_disable_steal_time(void)
-{
-	return;
-}
 #endif
 
 #endif /* _ASM_X86_KVM_PARA_H */

diff --git a/arch/x86/kernel/kvm.c b/arch/x86/kernel/kvm.c
index 5853eb5..c4c885b 100644
--- a/arch/x86/kernel/kvm.c
+++ b/arch/x86/kernel/kvm.c

@@ -37,6 +37,7 @@
 #include <linux/debugfs.h>
 #include <linux/nmi.h>
 #include <linux/swait.h>
+#include <linux/syscore_ops.h>
 #include <asm/timer.h>
 #include <asm/cpu.h>
 #include <asm/traps.h>
@@ -46,6 +47,7 @@
 #include <asm/apicdef.h>
 #include <asm/hypervisor.h>
 #include <asm/kvm_guest.h>
+#include <asm/reboot.h>
 
 static int kvmapf = 1;
 
@@ -376,6 +378,14 @@
 	       smp_processor_id());
 }
 
+static void kvm_disable_steal_time(void)
+{
+	if (!has_steal_clock)
+		return;
+
+	wrmsr(MSR_KVM_STEAL_TIME, 0, 0);
+}
+
 static void kvm_pv_guest_cpu_reboot(void *unused)
 {
 	/*
@@ -418,12 +428,25 @@
 	return steal;
 }
 
-void kvm_disable_steal_time(void)
+static void kvm_guest_cpu_offline(bool shutdown)
 {
-	if (!has_steal_clock)
-		return;
+	kvm_disable_steal_time();
+	if (kvm_para_has_feature(KVM_FEATURE_PV_EOI))
+		wrmsrl(MSR_KVM_PV_EOI_EN, 0);
+	kvm_pv_disable_apf();
+	if (!shutdown)
+		apf_task_wake_all();
+	kvmclock_disable();
+}
 
-	wrmsr(MSR_KVM_STEAL_TIME, 0, 0);
+static int kvm_cpu_online(unsigned int cpu)
+{
+	unsigned long flags;
+
+	local_irq_save(flags);
+	kvm_guest_cpu_init();
+	local_irq_restore(flags);
+	return 0;
 }
 
 #ifdef CONFIG_SMP
@@ -434,37 +457,54 @@
 	kvm_spinlock_init();
 }
 
-static void kvm_guest_cpu_offline(void)
-{
-	kvm_disable_steal_time();
-	if (kvm_para_has_feature(KVM_FEATURE_PV_EOI))
-		wrmsrl(MSR_KVM_PV_EOI_EN, 0);
-	kvm_pv_disable_apf();
-	apf_task_wake_all();
-}
-
-static int kvm_cpu_online(unsigned int cpu)
-{
-	local_irq_disable();
-	kvm_guest_cpu_init();
-	local_irq_enable();
-	return 0;
-}
-
 static int kvm_cpu_down_prepare(unsigned int cpu)
 {
-	local_irq_disable();
-	kvm_guest_cpu_offline();
-	local_irq_enable();
+	unsigned long flags;
+
+	local_irq_save(flags);
+	kvm_guest_cpu_offline(false);
+	local_irq_restore(flags);
 	return 0;
 }
+
 #endif
 
+static int kvm_suspend(void)
+{
+	kvm_guest_cpu_offline(false);
+
+	return 0;
+}
+
+static void kvm_resume(void)
+{
+	kvm_cpu_online(raw_smp_processor_id());
+}
+
+static struct syscore_ops kvm_syscore_ops = {
+	.suspend	= kvm_suspend,
+	.resume		= kvm_resume,
+};
+
 static void __init kvm_apf_trap_init(void)
 {
 	update_intr_gate(X86_TRAP_PF, async_page_fault);
 }
 
+/*
+ * After a PV feature is registered, the host will keep writing to the
+ * registered memory location. If the guest happens to shutdown, this memory
+ * won't be valid. In cases like kexec, in which you install a new kernel, this
+ * means a random memory location will be kept being written.
+ */
+#ifdef CONFIG_KEXEC_CORE
+static void kvm_crash_shutdown(struct pt_regs *regs)
+{
+	kvm_guest_cpu_offline(true);
+	native_machine_crash_shutdown(regs);
+}
+#endif
+
 void __init kvm_guest_init(void)
 {
 	int i;
@@ -499,6 +539,12 @@
 	kvm_guest_cpu_init();
 #endif
 
+#ifdef CONFIG_KEXEC_CORE
+	machine_ops.crash_shutdown = kvm_crash_shutdown;
+#endif
+
+	register_syscore_ops(&kvm_syscore_ops);
+
 	/*
 	 * Hard lockup detection is enabled by default. Disable it, as guests
 	 * can get false positives too easily, for example if the host is

diff --git a/arch/x86/kernel/kvmclock.c b/arch/x86/kernel/kvmclock.c
index 08806d6..9b8524c 100644
--- a/arch/x86/kernel/kvmclock.c
+++ b/arch/x86/kernel/kvmclock.c

@@ -28,7 +28,6 @@
 #include <linux/sched/clock.h>
 
 #include <asm/x86_init.h>
-#include <asm/reboot.h>
 #include <asm/kvmclock.h>
 
 static int kvmclock __ro_after_init = 1;
@@ -220,28 +219,9 @@
 }
 #endif
 
-/*
- * After the clock is registered, the host will keep writing to the
- * registered memory location. If the guest happens to shutdown, this memory
- * won't be valid. In cases like kexec, in which you install a new kernel, this
- * means a random memory location will be kept being written. So before any
- * kind of shutdown from our side, we unregister the clock by writing anything
- * that does not have the 'enable' bit set in the msr
- */
-#ifdef CONFIG_KEXEC_CORE
-static void kvm_crash_shutdown(struct pt_regs *regs)
+void kvmclock_disable(void)
 {
 	native_write_msr(msr_kvm_system_time, 0, 0);
-	kvm_disable_steal_time();
-	native_machine_crash_shutdown(regs);
-}
-#endif
-
-static void kvm_shutdown(void)
-{
-	native_write_msr(msr_kvm_system_time, 0, 0);
-	kvm_disable_steal_time();
-	native_machine_shutdown();
 }
 
 void __init kvmclock_init(void)
@@ -297,10 +277,6 @@
 #endif
 	x86_platform.save_sched_clock_state = kvm_save_sched_clock_state;
 	x86_platform.restore_sched_clock_state = kvm_restore_sched_clock_state;
-	machine_ops.shutdown  = kvm_shutdown;
-#ifdef CONFIG_KEXEC_CORE
-	machine_ops.crash_shutdown  = kvm_crash_shutdown;
-#endif
 	kvm_get_preset_lpj();
 	clocksource_register_hz(&kvm_clock, NSEC_PER_SEC);
 	pv_info.name = "KVM";

diff --git a/arch/x86/lib/x86-opcode-map.txt b/arch/x86/lib/x86-opcode-map.txt
index 5cb9f00..996a3a2 100644
--- a/arch/x86/lib/x86-opcode-map.txt
+++ b/arch/x86/lib/x86-opcode-map.txt

@@ -148,7 +148,7 @@
 65: SEG=GS (Prefix)
 66: Operand-Size (Prefix)
 67: Address-Size (Prefix)
-68: PUSH Iz (d64)
+68: PUSH Iz
 69: IMUL Gv,Ev,Iz
 6a: PUSH Ib (d64)
 6b: IMUL Gv,Ev,Ib

diff --git a/arch/x86/tools/relocs.c b/arch/x86/tools/relocs.c
index 2703ff6..bb15d0a 100644
--- a/arch/x86/tools/relocs.c
+++ b/arch/x86/tools/relocs.c

@@ -672,6 +672,15 @@
 		if (!(sec_applies->shdr.sh_flags & SHF_ALLOC)) {
 			continue;
 		}
+
+		/*
+		 * Do not perform relocations in .notes sections; any
+		 * values there are meant for pre-boot consumption (e.g.
+		 * startup_xen).
+		 */
+		if (sec_applies->shdr.sh_type == SHT_NOTE)
+			continue;
+
 		sh_symtab = sec_symtab->symtab;
 		sym_strtab = sec_symtab->link->strtab;
 		for (j = 0; j < sec->shdr.sh_size/sizeof(Elf_Rel); j++) {

diff --git a/crypto/algapi.c b/crypto/algapi.c
index 1d920a7..a416e88 100644
--- a/crypto/algapi.c
+++ b/crypto/algapi.c

@@ -230,7 +230,6 @@
 		}
 
 		if (!strcmp(q->cra_driver_name, alg->cra_name) ||
-		    !strcmp(q->cra_driver_name, alg->cra_driver_name) ||
 		    !strcmp(q->cra_name, alg->cra_driver_name))
 			goto err;
 	}

diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
index eea987f..0c9db7e 100644
--- a/crypto/algif_aead.c
+++ b/crypto/algif_aead.c

@@ -568,12 +568,6 @@
 
 	INIT_LIST_HEAD(&ctx->tsgl_list);
 	ctx->len = len;
-	ctx->used = 0;
-	atomic_set(&ctx->rcvused, 0);
-	ctx->more = 0;
-	ctx->merge = 0;
-	ctx->enc = 0;
-	ctx->aead_assoclen = 0;
 	af_alg_init_completion(&ctx->completion);
 
 	ask->private = ctx;

diff --git a/crypto/algif_skcipher.c b/crypto/algif_skcipher.c
index 8ce6f8c..0c5d64d 100644
--- a/crypto/algif_skcipher.c
+++ b/crypto/algif_skcipher.c

@@ -371,6 +371,7 @@
 	ctx = sock_kmalloc(sk, len, GFP_KERNEL);
 	if (!ctx)
 		return -ENOMEM;
+	memset(ctx, 0, len);
 
 	ctx->iv = sock_kmalloc(sk, crypto_skcipher_ivsize(skcipher),
 			       GFP_KERNEL);
@@ -378,16 +379,10 @@
 		sock_kfree_s(sk, ctx, len);
 		return -ENOMEM;
 	}
-
 	memset(ctx->iv, 0, crypto_skcipher_ivsize(skcipher));
 
 	INIT_LIST_HEAD(&ctx->tsgl_list);
 	ctx->len = len;
-	ctx->used = 0;
-	atomic_set(&ctx->rcvused, 0);
-	ctx->more = 0;
-	ctx->merge = 0;
-	ctx->enc = 0;
 	af_alg_init_completion(&ctx->completion);
 
 	ask->private = ctx;

diff --git a/drivers/acpi/acpica/Makefile b/drivers/acpi/acpica/Makefile
index 1e8e4e7..8410d09 100644
--- a/drivers/acpi/acpica/Makefile
+++ b/drivers/acpi/acpica/Makefile

@@ -5,6 +5,7 @@
 
 ccflags-y			:= -D_LINUX -DBUILDING_ACPICA
 ccflags-$(CONFIG_ACPI_DEBUG)	+= -DACPI_DEBUG_OUTPUT
+CFLAGS_tbfind.o 		+= $(call cc-disable-warning, stringop-truncation)
 
 # use acpi.o to put all files here into acpi.o modparam namespace
 obj-y	+= acpi.o

diff --git a/drivers/android/binder.c b/drivers/android/binder.c
index 208ecaa..f4c772fd 100644
--- a/drivers/android/binder.c
+++ b/drivers/android/binder.c

@@ -543,7 +543,7 @@
 	struct list_head todo;
 	struct binder_stats stats;
 	struct list_head delivered_death;
-	int max_threads;
+	u32 max_threads;
 	int requested_threads;
 	int requested_threads_started;
 	int tmp_ref;
@@ -5305,7 +5305,7 @@
 			goto err;
 		break;
 	case BINDER_SET_MAX_THREADS: {
-		int max_threads;
+		u32 max_threads;
 
 		if (copy_from_user(&max_threads, ubuf,
 				   sizeof(max_threads))) {

diff --git a/drivers/ata/pata_legacy.c b/drivers/ata/pata_legacy.c
index c72d3cf..9d898fc 100644
--- a/drivers/ata/pata_legacy.c
+++ b/drivers/ata/pata_legacy.c

@@ -128,8 +128,6 @@
 static struct legacy_probe probe_list[NR_HOST];
 static struct legacy_data legacy_data[NR_HOST];
 static struct ata_host *legacy_host[NR_HOST];
-static int nr_legacy_host;
-
 
 static int probe_all;		/* Set to check all ISA port ranges */
 static int ht6560a;		/* HT 6560A on primary 1, second 2, both 3 */
@@ -1253,9 +1251,11 @@
 {
 	int i;
 
-	for (i = 0; i < nr_legacy_host; i++) {
+	for (i = 0; i < NR_HOST; i++) {
 		struct legacy_data *ld = &legacy_data[i];
-		ata_host_detach(legacy_host[i]);
+
+		if (legacy_host[i])
+			ata_host_detach(legacy_host[i]);
 		platform_device_unregister(ld->platform_dev);
 	}
 }

diff --git a/drivers/ata/sata_gemini.c b/drivers/ata/sata_gemini.c
index 64b4394..f7b4ed5 100644
--- a/drivers/ata/sata_gemini.c
+++ b/drivers/ata/sata_gemini.c

@@ -200,7 +200,10 @@
 		pclk = sg->sata0_pclk;
 	else
 		pclk = sg->sata1_pclk;
-	clk_enable(pclk);
+	ret = clk_enable(pclk);
+	if (ret)
+		return ret;
+
 	msleep(10);
 
 	/* Do not keep clocking a bridge that is not online */

diff --git a/drivers/block/null_blk.c b/drivers/block/null_blk.c
index b499e72..a0ff9ec 100644
--- a/drivers/block/null_blk.c
+++ b/drivers/block/null_blk.c

@@ -2053,10 +2053,13 @@
 		blk_mq_free_tag_set(&tag_set);
 
 	kmem_cache_destroy(ppa_cache);
+
+	mutex_destroy(&lock);
 }
 
 module_init(null_init);
 module_exit(null_exit);
 
 MODULE_AUTHOR("Jens Axboe <axboe@kernel.dk>");
+MODULE_DESCRIPTION("multi queue aware block test driver");
 MODULE_LICENSE("GPL");

diff --git a/drivers/char/ppdev.c b/drivers/char/ppdev.c
index 0023bde..a673c72 100644
--- a/drivers/char/ppdev.c
+++ b/drivers/char/ppdev.c

@@ -300,28 +300,35 @@
 	if (!port) {
 		pr_warn("%s: no associated port!\n", name);
 		rc = -ENXIO;
-		goto err;
+		goto err_free_name;
 	}
 
 	index = ida_simple_get(&ida_index, 0, 0, GFP_KERNEL);
+	if (index < 0) {
+		pr_warn("%s: failed to get index!\n", name);
+		rc = index;
+		goto err_put_port;
+	}
+
 	memset(&ppdev_cb, 0, sizeof(ppdev_cb));
 	ppdev_cb.irq_func = pp_irq;
 	ppdev_cb.flags = (pp->flags & PP_EXCL) ? PARPORT_FLAG_EXCL : 0;
 	ppdev_cb.private = pp;
 	pdev = parport_register_dev_model(port, name, &ppdev_cb, index);
-	parport_put_port(port);
 
 	if (!pdev) {
 		pr_warn("%s: failed to register device!\n", name);
 		rc = -ENXIO;
 		ida_simple_remove(&ida_index, index);
-		goto err;
+		goto err_put_port;
 	}
 
 	pp->pdev = pdev;
 	pp->index = index;
 	dev_dbg(&pdev->dev, "registered pardevice\n");
-err:
+err_put_port:
+	parport_put_port(port);
+err_free_name:
 	kfree(name);
 	return rc;
 }

diff --git a/drivers/crypto/bcm/spu2.c b/drivers/crypto/bcm/spu2.c
index bf7ac62..0f60233 100644
--- a/drivers/crypto/bcm/spu2.c
+++ b/drivers/crypto/bcm/spu2.c

@@ -506,7 +506,7 @@
 	if (hash_iv_len) {
 		packet_log("  Hash IV Length %u bytes\n", hash_iv_len);
 		packet_dump("  hash IV: ", ptr, hash_iv_len);
-		ptr += ciph_key_len;
+		ptr += hash_iv_len;
 	}
 
 	if (ciph_iv_len) {

diff --git a/drivers/crypto/ccp/sp-platform.c b/drivers/crypto/ccp/sp-platform.c
index 71734f2..8494f7d 100644
--- a/drivers/crypto/ccp/sp-platform.c
+++ b/drivers/crypto/ccp/sp-platform.c

@@ -33,30 +33,47 @@
 	unsigned int irq_count;
 };
 
-static const struct acpi_device_id sp_acpi_match[];
-static const struct of_device_id sp_of_match[];
+static const struct sp_dev_vdata dev_vdata[] = {
+	{
+		.bar = 0,
+#ifdef CONFIG_CRYPTO_DEV_SP_CCP
+		.ccp_vdata = &ccpv3_platform,
+#endif
+	},
+};
+
+static const struct acpi_device_id sp_acpi_match[] = {
+	{ "AMDI0C00", (kernel_ulong_t)&dev_vdata[0] },
+	{ },
+};
+MODULE_DEVICE_TABLE(acpi, sp_acpi_match);
+
+static const struct of_device_id sp_of_match[] = {
+	{ .compatible = "amd,ccp-seattle-v1a",
+	  .data = (const void *)&dev_vdata[0] },
+	{ },
+};
+MODULE_DEVICE_TABLE(of, sp_of_match);
 
 static struct sp_dev_vdata *sp_get_of_version(struct platform_device *pdev)
 {
-#ifdef CONFIG_OF
 	const struct of_device_id *match;
 
 	match = of_match_node(sp_of_match, pdev->dev.of_node);
 	if (match && match->data)
 		return (struct sp_dev_vdata *)match->data;
-#endif
+
 	return NULL;
 }
 
 static struct sp_dev_vdata *sp_get_acpi_version(struct platform_device *pdev)
 {
-#ifdef CONFIG_ACPI
 	const struct acpi_device_id *match;
 
 	match = acpi_match_device(sp_acpi_match, &pdev->dev);
 	if (match && match->driver_data)
 		return (struct sp_dev_vdata *)match->driver_data;
-#endif
+
 	return NULL;
 }
 
@@ -201,41 +218,11 @@
 }
 #endif
 
-static const struct sp_dev_vdata dev_vdata[] = {
-	{
-		.bar = 0,
-#ifdef CONFIG_CRYPTO_DEV_SP_CCP
-		.ccp_vdata = &ccpv3_platform,
-#endif
-	},
-};
-
-#ifdef CONFIG_ACPI
-static const struct acpi_device_id sp_acpi_match[] = {
-	{ "AMDI0C00", (kernel_ulong_t)&dev_vdata[0] },
-	{ },
-};
-MODULE_DEVICE_TABLE(acpi, sp_acpi_match);
-#endif
-
-#ifdef CONFIG_OF
-static const struct of_device_id sp_of_match[] = {
-	{ .compatible = "amd,ccp-seattle-v1a",
-	  .data = (const void *)&dev_vdata[0] },
-	{ },
-};
-MODULE_DEVICE_TABLE(of, sp_of_match);
-#endif
-
 static struct platform_driver sp_platform_driver = {
 	.driver = {
 		.name = "ccp",
-#ifdef CONFIG_ACPI
 		.acpi_match_table = sp_acpi_match,
-#endif
-#ifdef CONFIG_OF
 		.of_match_table = sp_of_match,
-#endif
 	},
 	.probe = sp_platform_probe,
 	.remove = sp_platform_remove,

diff --git a/drivers/crypto/qat/qat_common/adf_aer.c b/drivers/crypto/qat/qat_common/adf_aer.c
index b41c29a..e3f85e0 100644
--- a/drivers/crypto/qat/qat_common/adf_aer.c
+++ b/drivers/crypto/qat/qat_common/adf_aer.c

@@ -139,8 +139,7 @@
 	if (adf_dev_init(accel_dev) || adf_dev_start(accel_dev)) {
 		/* The device hanged and we can't restart it so stop here */
 		dev_err(&GET_DEV(accel_dev), "Restart device failed\n");
-		if (reset_data->mode == ADF_DEV_RESET_ASYNC ||
-		    completion_done(&reset_data->compl))
+		if (reset_data->mode == ADF_DEV_RESET_ASYNC)
 			kfree(reset_data);
 		WARN(1, "QAT: device restart failed. Device is unusable\n");
 		return;
@@ -148,16 +147,8 @@
 	adf_dev_restarted_notify(accel_dev);
 	clear_bit(ADF_STATUS_RESTARTING, &accel_dev->status);
 
-	/*
-	 * The dev is back alive. Notify the caller if in sync mode
-	 *
-	 * If device restart will take a more time than expected,
-	 * the schedule_reset() function can timeout and exit. This can be
-	 * detected by calling the completion_done() function. In this case
-	 * the reset_data structure needs to be freed here.
-	 */
-	if (reset_data->mode == ADF_DEV_RESET_ASYNC ||
-	    completion_done(&reset_data->compl))
+	/* The dev is back alive. Notify the caller if in sync mode */
+	if (reset_data->mode == ADF_DEV_RESET_ASYNC)
 		kfree(reset_data);
 	else
 		complete(&reset_data->compl);
@@ -192,10 +183,10 @@
 		if (!timeout) {
 			dev_err(&GET_DEV(accel_dev),
 				"Reset device timeout expired\n");
+			cancel_work_sync(&reset_data->reset_work);
 			ret = -EFAULT;
-		} else {
-			kfree(reset_data);
 		}
+		kfree(reset_data);
 		return ret;
 	}
 	return 0;

diff --git a/drivers/dma-buf/sync_debug.c b/drivers/dma-buf/sync_debug.c
index c4c8ecb..cfe31e5 100644
--- a/drivers/dma-buf/sync_debug.c
+++ b/drivers/dma-buf/sync_debug.c

@@ -119,12 +119,12 @@
 
 	seq_printf(s, "%s: %d\n", obj->name, obj->value);
 
-	spin_lock_irq(&obj->lock);
+	spin_lock(&obj->lock); /* Caller already disabled IRQ. */
 	list_for_each(pos, &obj->pt_list) {
 		struct sync_pt *pt = container_of(pos, struct sync_pt, link);
 		sync_print_fence(s, &pt->base, false);
 	}
-	spin_unlock_irq(&obj->lock);
+	spin_unlock(&obj->lock);
 }
 
 static void sync_print_sync_file(struct seq_file *s,

diff --git a/drivers/dma/idma64.c b/drivers/dma/idma64.c
index f17a4c7..bd32286 100644
--- a/drivers/dma/idma64.c
+++ b/drivers/dma/idma64.c

@@ -172,6 +172,10 @@
 	u32 status_err;
 	unsigned short i;
 
+	/* Since IRQ may be shared, check if DMA controller is powered on */
+	if (status == GENMASK(31, 0))
+		return IRQ_NONE;
+
 	dev_vdbg(idma64->dma.dev, "%s: status=%#x\n", __func__, status);
 
 	/* Check if we have any interrupt from the DMA controller */
@@ -591,7 +595,9 @@
 
 	idma64->dma.dev = chip->sysdev;
 
-	dma_set_max_seg_size(idma64->dma.dev, IDMA64C_CTLH_BLOCK_TS_MASK);
+	ret = dma_set_max_seg_size(idma64->dma.dev, IDMA64C_CTLH_BLOCK_TS_MASK);
+	if (ret)
+		return ret;
 
 	ret = dma_async_device_register(&idma64->dma);
 	if (ret)

diff --git a/drivers/extcon/Kconfig b/drivers/extcon/Kconfig
index c77a9c2..e8e5a6b 100644
--- a/drivers/extcon/Kconfig
+++ b/drivers/extcon/Kconfig

@@ -116,7 +116,8 @@
 
 config EXTCON_MAX8997
 	tristate "Maxim MAX8997 EXTCON Support"
-	depends on MFD_MAX8997 && IRQ_DOMAIN
+	depends on MFD_MAX8997
+	select IRQ_DOMAIN
 	help
 	  If you say yes here you get support for the MUIC device of
 	  Maxim MAX8997 PMIC. The MAX8997 MUIC is a USB port accessory

diff --git a/drivers/firewire/nosy.c b/drivers/firewire/nosy.c
index 646dca0..3f7c1c5 100644
--- a/drivers/firewire/nosy.c
+++ b/drivers/firewire/nosy.c

@@ -161,10 +161,12 @@
 	if (atomic_read(&buffer->size) == 0)
 		return -ENODEV;
 
-	/* FIXME: Check length <= user_length. */
+	length = buffer->head->length;
+
+	if (length > user_length)
+		return 0;
 
 	end = buffer->data + buffer->capacity;
-	length = buffer->head->length;
 
 	if (&buffer->head->data[length] < end) {
 		if (copy_to_user(data, buffer->head->data, length))

diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
index 6303dc9..995161a 100644
--- a/drivers/firewire/ohci.c
+++ b/drivers/firewire/ohci.c

@@ -2068,6 +2068,8 @@
 
 	ohci->generation = generation;
 	reg_write(ohci, OHCI1394_IntEventClear, OHCI1394_busReset);
+	if (param_debug & OHCI_PARAM_DEBUG_BUSRESETS)
+		reg_write(ohci, OHCI1394_IntMaskSet, OHCI1394_busReset);
 
 	if (ohci->quirks & QUIRK_RESET_PACKET)
 		ohci->request_generation = generation;
@@ -2134,12 +2136,14 @@
 		return IRQ_NONE;
 
 	/*
-	 * busReset and postedWriteErr must not be cleared yet
+	 * busReset and postedWriteErr events must not be cleared yet
 	 * (OHCI 1.1 clauses 7.2.3.2 and 13.2.8.1)
 	 */
 	reg_write(ohci, OHCI1394_IntEventClear,
 		  event & ~(OHCI1394_busReset | OHCI1394_postedWriteErr));
 	log_irqs(ohci, event);
+	if (event & OHCI1394_busReset)
+		reg_write(ohci, OHCI1394_IntMaskClear, OHCI1394_busReset);
 
 	if (event & OHCI1394_selfIDComplete)
 		queue_work(selfid_workqueue, &ohci->bus_reset_work);

diff --git a/drivers/firmware/dmi-id.c b/drivers/firmware/dmi-id.c
index 951b6c7..13563a9 100644
--- a/drivers/firmware/dmi-id.c
+++ b/drivers/firmware/dmi-id.c

@@ -160,9 +160,14 @@
 	return 0;
 }
 
+static void dmi_dev_release(struct device *dev)
+{
+	kfree(dev);
+}
+
 static struct class dmi_class = {
 	.name = "dmi",
-	.dev_release = (void(*)(struct device *)) kfree,
+	.dev_release = dmi_dev_release,
 	.dev_uevent = dmi_dev_uevent,
 };
 

diff --git a/drivers/firmware/raspberrypi.c b/drivers/firmware/raspberrypi.c
index dd506cd..a1bb471 100644
--- a/drivers/firmware/raspberrypi.c
+++ b/drivers/firmware/raspberrypi.c

@@ -11,6 +11,7 @@
 
 #include <linux/dma-mapping.h>
 #include <linux/mailbox_client.h>
+#include <linux/mailbox_controller.h>
 #include <linux/module.h>
 #include <linux/of_platform.h>
 #include <linux/platform_device.h>
@@ -88,8 +89,8 @@
 	if (size & 3)
 		return -EINVAL;
 
-	buf = dma_alloc_coherent(fw->cl.dev, PAGE_ALIGN(size), &bus_addr,
-				 GFP_ATOMIC);
+	buf = dma_alloc_coherent(fw->chan->mbox->dev, PAGE_ALIGN(size),
+				 &bus_addr, GFP_ATOMIC);
 	if (!buf)
 		return -ENOMEM;
 
@@ -117,7 +118,7 @@
 		ret = -EINVAL;
 	}
 
-	dma_free_coherent(fw->cl.dev, PAGE_ALIGN(size), buf, bus_addr);
+	dma_free_coherent(fw->chan->mbox->dev, PAGE_ALIGN(size), buf, bus_addr);
 
 	return ret;
 }

diff --git a/drivers/gpio/gpio-crystalcove.c b/drivers/gpio/gpio-crystalcove.c
index e60156e..c7ac13d 100644
--- a/drivers/gpio/gpio-crystalcove.c
+++ b/drivers/gpio/gpio-crystalcove.c

@@ -99,7 +99,7 @@
 		case 0x5e:
 			return GPIOPANELCTL;
 		default:
-			return -EOPNOTSUPP;
+			return -ENOTSUPP;
 		}
 	}
 

diff --git a/drivers/gpio/gpio-wcove.c b/drivers/gpio/gpio-wcove.c
index 85341ea..e099632 100644
--- a/drivers/gpio/gpio-wcove.c
+++ b/drivers/gpio/gpio-wcove.c

@@ -110,7 +110,7 @@
 	unsigned int reg;
 
 	if (gpio >= WCOVE_GPIO_NUM)
-		return -EOPNOTSUPP;
+		return -ENOTSUPP;
 
 	if (reg_type == CTRL_IN)
 		reg = GPIO_IN_CTRL_BASE + gpio;

diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
index d52e0bc..e589192 100644
--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c
+++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_vm.c

@@ -27,6 +27,7 @@
  */
 #include <linux/dma-fence-array.h>
 #include <linux/interval_tree_generic.h>
+#include <linux/overflow.h>
 #include <drm/drmP.h>
 #include <drm/amdgpu_drm.h>
 #include "amdgpu.h"
@@ -2049,6 +2050,37 @@
 	return bo_va;
 }
 
+/* Validate operation parameters to prevent potential abuse */
+static int amdgpu_vm_verify_parameters(struct amdgpu_device *adev,
+					  struct amdgpu_bo *bo,
+					  uint64_t saddr,
+					  uint64_t offset,
+					  uint64_t size)
+{
+	uint64_t tmp, lpfn;
+
+	if (saddr & AMDGPU_GPU_PAGE_MASK
+	    || offset & AMDGPU_GPU_PAGE_MASK
+	    || size & AMDGPU_GPU_PAGE_MASK)
+		return -EINVAL;
+
+	if (check_add_overflow(saddr, size, &tmp)
+	    || check_add_overflow(offset, size, &tmp)
+	    || size == 0 /* which also leads to end < begin */)
+		return -EINVAL;
+
+	/* make sure object fit at this offset */
+	if (bo && offset + size > amdgpu_bo_size(bo))
+		return -EINVAL;
+
+	/* Ensure last pfn not exceed max_pfn */
+	lpfn = (saddr + size - 1) >> AMDGPU_GPU_PAGE_SHIFT;
+	if (lpfn >= adev->vm_manager.max_pfn)
+		return -EINVAL;
+
+	return 0;
+}
+
 /**
  * amdgpu_vm_bo_map - map bo inside a vm
  *
@@ -2072,20 +2104,14 @@
 	struct amdgpu_bo *bo = bo_va->base.bo;
 	struct amdgpu_vm *vm = bo_va->base.vm;
 	uint64_t eaddr;
+	int r;
 
-	/* validate the parameters */
-	if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK ||
-	    size == 0 || size & ~PAGE_MASK)
-		return -EINVAL;
-
-	/* make sure object fit at this offset */
-	eaddr = saddr + size - 1;
-	if (saddr >= eaddr ||
-	    (bo && offset + size > amdgpu_bo_size(bo)))
-		return -EINVAL;
+	r = amdgpu_vm_verify_parameters(adev, bo, saddr, offset, size);
+	if (r)
+		return r;
 
 	saddr /= AMDGPU_GPU_PAGE_SIZE;
-	eaddr /= AMDGPU_GPU_PAGE_SIZE;
+	eaddr = saddr + (size - 1) / AMDGPU_GPU_PAGE_SIZE;
 
 	tmp = amdgpu_vm_it_iter_first(&vm->va, saddr, eaddr);
 	if (tmp) {
@@ -2141,16 +2167,9 @@
 	uint64_t eaddr;
 	int r;
 
-	/* validate the parameters */
-	if (saddr & ~PAGE_MASK || offset & ~PAGE_MASK ||
-	    size == 0 || size & ~PAGE_MASK)
-		return -EINVAL;
-
-	/* make sure object fit at this offset */
-	eaddr = saddr + size - 1;
-	if (saddr >= eaddr ||
-	    (bo && offset + size > amdgpu_bo_size(bo)))
-		return -EINVAL;
+	r = amdgpu_vm_verify_parameters(adev, bo, saddr, offset, size);
+	if (r)
+		return r;
 
 	/* Allocate all the needed memory */
 	mapping = kmalloc(sizeof(*mapping), GFP_KERNEL);
@@ -2164,7 +2183,7 @@
 	}
 
 	saddr /= AMDGPU_GPU_PAGE_SIZE;
-	eaddr /= AMDGPU_GPU_PAGE_SIZE;
+	eaddr = saddr + (size - 1) / AMDGPU_GPU_PAGE_SIZE;
 
 	mapping->start = saddr;
 	mapping->last = eaddr;
@@ -2250,10 +2269,14 @@
 	struct amdgpu_bo_va_mapping *before, *after, *tmp, *next;
 	LIST_HEAD(removed);
 	uint64_t eaddr;
+	int r;
 
-	eaddr = saddr + size - 1;
+	r = amdgpu_vm_verify_parameters(adev, NULL, saddr, 0, size);
+	if (r)
+		return r;
+
 	saddr /= AMDGPU_GPU_PAGE_SIZE;
-	eaddr /= AMDGPU_GPU_PAGE_SIZE;
+	eaddr = saddr + (size - 1) / AMDGPU_GPU_PAGE_SIZE;
 
 	/* Allocate all the needed memory */
 	before = kzalloc(sizeof(*before), GFP_KERNEL);

diff --git a/drivers/gpu/drm/mediatek/mtk_drm_gem.c b/drivers/gpu/drm/mediatek/mtk_drm_gem.c
index 1818980..46436e6 100644
--- a/drivers/gpu/drm/mediatek/mtk_drm_gem.c
+++ b/drivers/gpu/drm/mediatek/mtk_drm_gem.c

@@ -26,6 +26,9 @@
 
 	size = round_up(size, PAGE_SIZE);
 
+	if (size == 0)
+		return ERR_PTR(-EINVAL);
+
 	mtk_gem_obj = kzalloc(sizeof(*mtk_gem_obj), GFP_KERNEL);
 	if (!mtk_gem_obj)
 		return ERR_PTR(-ENOMEM);

diff --git a/drivers/gpu/drm/nouveau/nouveau_bios.c b/drivers/gpu/drm/nouveau/nouveau_bios.c
index dd6fba5..870c462 100644
--- a/drivers/gpu/drm/nouveau/nouveau_bios.c
+++ b/drivers/gpu/drm/nouveau/nouveau_bios.c

@@ -25,6 +25,7 @@
 #include <drm/drmP.h>
 
 #include "nouveau_drv.h"
+#include "nouveau_bios.h"
 #include "nouveau_reg.h"
 #include "dispnv04/hw.h"
 #include "nouveau_encoder.h"
@@ -1670,7 +1671,7 @@
 	 */
 	if (nv_match_device(dev, 0x0201, 0x1462, 0x8851)) {
 		if (*conn == 0xf2005014 && *conf == 0xffffffff) {
-			fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 1, 1, 1);
+			fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 1, 1, DCB_OUTPUT_B);
 			return false;
 		}
 	}
@@ -1756,26 +1757,26 @@
 #ifdef __powerpc__
 	/* Apple iMac G4 NV17 */
 	if (of_machine_is_compatible("PowerMac4,5")) {
-		fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 0, all_heads, 1);
-		fabricate_dcb_output(dcb, DCB_OUTPUT_ANALOG, 1, all_heads, 2);
+		fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS, 0, all_heads, DCB_OUTPUT_B);
+		fabricate_dcb_output(dcb, DCB_OUTPUT_ANALOG, 1, all_heads, DCB_OUTPUT_C);
 		return;
 	}
 #endif
 
 	/* Make up some sane defaults */
 	fabricate_dcb_output(dcb, DCB_OUTPUT_ANALOG,
-			     bios->legacy.i2c_indices.crt, 1, 1);
+			     bios->legacy.i2c_indices.crt, 1, DCB_OUTPUT_B);
 
 	if (nv04_tv_identify(dev, bios->legacy.i2c_indices.tv) >= 0)
 		fabricate_dcb_output(dcb, DCB_OUTPUT_TV,
 				     bios->legacy.i2c_indices.tv,
-				     all_heads, 0);
+				     all_heads, DCB_OUTPUT_A);
 
 	else if (bios->tmds.output0_script_ptr ||
 		 bios->tmds.output1_script_ptr)
 		fabricate_dcb_output(dcb, DCB_OUTPUT_TMDS,
 				     bios->legacy.i2c_indices.panel,
-				     all_heads, 1);
+				     all_heads, DCB_OUTPUT_B);
 }
 
 static int

diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowof.c b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowof.c
index 4bf486b..cb05f7f 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowof.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/bios/shadowof.c

@@ -66,11 +66,16 @@
 	return ERR_PTR(-EINVAL);
 }
 
+static void of_fini(void *p)
+{
+	kfree(p);
+}
+
 const struct nvbios_source
 nvbios_of = {
 	.name = "OpenFirmware",
 	.init = of_init,
-	.fini = (void(*)(void *))kfree,
+	.fini = of_fini,
 	.read = of_read,
 	.size = of_size,
 	.rw = false,

diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
index 7d24826..4504411c 100644
--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
+++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c

@@ -1045,7 +1045,7 @@
 	}
 
 	event->event.base.type = DRM_VMW_EVENT_FENCE_SIGNALED;
-	event->event.base.length = sizeof(*event);
+	event->event.base.length = sizeof(event->event);
 	event->event.user_data = user_data;
 
 	ret = drm_event_reserve_init(dev, file_priv, &event->base, &event->event.base);

diff --git a/drivers/hid/i2c-hid/i2c-hid-core.c b/drivers/hid/i2c-hid/i2c-hid-core.c
index 9a070d6..67ae749 100644
--- a/drivers/hid/i2c-hid/i2c-hid-core.c
+++ b/drivers/hid/i2c-hid/i2c-hid-core.c

@@ -51,7 +51,6 @@
 /* flags */
 #define I2C_HID_STARTED		0
 #define I2C_HID_RESET_PENDING	1
-#define I2C_HID_READ_PENDING	2
 
 #define I2C_HID_PWR_ON		0x00
 #define I2C_HID_PWR_SLEEP	0x01
@@ -237,7 +236,6 @@
 		msg[1].len = data_len;
 		msg[1].buf = buf_recv;
 		msg_num = 2;
-		set_bit(I2C_HID_READ_PENDING, &ihid->flags);
 	}
 
 	if (wait)
@@ -245,9 +243,6 @@
 
 	ret = i2c_transfer(client->adapter, msg, msg_num);
 
-	if (data_len > 0)
-		clear_bit(I2C_HID_READ_PENDING, &ihid->flags);
-
 	if (ret != msg_num)
 		return ret < 0 ? ret : -EIO;
 
@@ -500,9 +495,6 @@
 {
 	struct i2c_hid *ihid = dev_id;
 
-	if (test_bit(I2C_HID_READ_PENDING, &ihid->flags))
-		return IRQ_HANDLED;
-
 	i2c_hid_get_input(ihid);
 
 	return IRQ_HANDLED;

diff --git a/drivers/hwtracing/intel_th/pci.c b/drivers/hwtracing/intel_th/pci.c
index 3c5eba9..625e6dc 100644
--- a/drivers/hwtracing/intel_th/pci.c
+++ b/drivers/hwtracing/intel_th/pci.c

@@ -259,6 +259,11 @@
 		.driver_data = (kernel_ulong_t)&intel_th_2x,
 	},
 	{
+		/* Meteor Lake-S CPU */
+		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0xae24),
+		.driver_data = (kernel_ulong_t)&intel_th_2x,
+	},
+	{
 		/* Raptor Lake-S */
 		PCI_DEVICE(PCI_VENDOR_ID_INTEL, 0x7a26),
 		.driver_data = (kernel_ulong_t)&intel_th_2x,

diff --git a/drivers/hwtracing/stm/core.c b/drivers/hwtracing/stm/core.c
index c592cef..a5b8e3f 100644
--- a/drivers/hwtracing/stm/core.c
+++ b/drivers/hwtracing/stm/core.c

@@ -710,8 +710,11 @@
 		return -ENOMEM;
 
 	stm->major = register_chrdev(0, stm_data->name, &stm_fops);
-	if (stm->major < 0)
-		goto err_free;
+	if (stm->major < 0) {
+		err = stm->major;
+		vfree(stm);
+		return err;
+	}
 
 	device_initialize(&stm->dev);
 	stm->dev.devt = MKDEV(stm->major, 0);
@@ -755,10 +758,8 @@
 err_device:
 	unregister_chrdev(stm->major, stm_data->name);
 
-	/* matches device_initialize() above */
+	/* calls stm_device_release() */
 	put_device(&stm->dev);
-err_free:
-	vfree(stm);
 
 	return err;
 }

diff --git a/drivers/i2c/i2c-core-base.c b/drivers/i2c/i2c-core-base.c
index e1f4454..16ea6a6 100644
--- a/drivers/i2c/i2c-core-base.c
+++ b/drivers/i2c/i2c-core-base.c

@@ -1854,13 +1854,21 @@
  * Returns negative errno, else the number of messages executed.
  *
  * Adapter lock must be held when calling this function. No debug logging
- * takes place. adap->algo->master_xfer existence isn't checked.
+ * takes place.
  */
 int __i2c_transfer(struct i2c_adapter *adap, struct i2c_msg *msgs, int num)
 {
 	unsigned long orig_jiffies;
 	int ret, try;
 
+	if (!adap->algo->master_xfer) {
+		dev_dbg(&adap->dev, "I2C level transfers not supported\n");
+		return -EOPNOTSUPP;
+	}
+
+	if (WARN_ON(!msgs || num < 1))
+		return -EINVAL;
+
 	if (adap->quirks && i2c_check_for_quirks(adap, msgs, num))
 		return -EOPNOTSUPP;
 

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
index 0e85b34..945e209 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c

@@ -362,7 +362,7 @@
 	if (!rx->rx_ring)
 		return -ENOMEM;
 
-	t = kmalloc(sizeof *t, GFP_KERNEL);
+	t = kmalloc(sizeof(*t), GFP_KERNEL);
 	if (!t) {
 		ret = -ENOMEM;
 		goto err_free_1;
@@ -431,7 +431,7 @@
 	data.mtu = cpu_to_be32(IPOIB_CM_BUF_SIZE);
 
 	rep.private_data = &data;
-	rep.private_data_len = sizeof data;
+	rep.private_data_len = sizeof(data);
 	rep.flow_control = 0;
 	rep.rnr_retry_count = req->rnr_retry_count;
 	rep.srq = ipoib_cm_has_srq(dev);
@@ -449,7 +449,7 @@
 	int ret;
 
 	ipoib_dbg(priv, "REQ arrived\n");
-	p = kzalloc(sizeof *p, GFP_KERNEL);
+	p = kzalloc(sizeof(*p), GFP_KERNEL);
 	if (!p)
 		return -ENOMEM;
 	p->dev = dev;
@@ -656,7 +656,7 @@
 	}
 
 	ipoib_cm_dma_unmap_rx(priv, frags, rx_ring[wr_id].mapping);
-	memcpy(rx_ring[wr_id].mapping, mapping, (frags + 1) * sizeof *mapping);
+	memcpy(rx_ring[wr_id].mapping, mapping, (frags + 1) * sizeof(*mapping));
 
 	ipoib_dbg_data(priv, "received %d bytes, SLID 0x%04x\n",
 		       wc->byte_len, wc->slid);
@@ -1086,7 +1086,7 @@
 	req.qp_num			= qp->qp_num;
 	req.qp_type			= qp->qp_type;
 	req.private_data		= &data;
-	req.private_data_len		= sizeof data;
+	req.private_data_len		= sizeof(data);
 	req.flow_control		= 0;
 
 	req.starting_psn		= 0; /* FIXME */
@@ -1143,7 +1143,7 @@
 		ret = -ENOMEM;
 		goto err_tx;
 	}
-	memset(p->tx_ring, 0, ipoib_sendq_size * sizeof *p->tx_ring);
+	memset(p->tx_ring, 0, ipoib_sendq_size * sizeof(*p->tx_ring));
 
 	p->qp = ipoib_cm_create_tx_qp(p->dev, p);
 	memalloc_noio_restore(noio_flag);
@@ -1295,7 +1295,7 @@
 	struct ipoib_dev_priv *priv = ipoib_priv(dev);
 	struct ipoib_cm_tx *tx;
 
-	tx = kzalloc(sizeof *tx, GFP_ATOMIC);
+	tx = kzalloc(sizeof(*tx), GFP_ATOMIC);
 	if (!tx)
 		return NULL;
 
@@ -1360,7 +1360,7 @@
 				neigh->daddr + QPN_AND_OPTIONS_OFFSET);
 			goto free_neigh;
 		}
-		memcpy(&pathrec, &p->path->pathrec, sizeof pathrec);
+		memcpy(&pathrec, &p->path->pathrec, sizeof(pathrec));
 
 		spin_unlock_irqrestore(&priv->lock, flags);
 		netif_tx_unlock_bh(dev);

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_fs.c b/drivers/infiniband/ulp/ipoib/ipoib_fs.c
index 11f74cb..2315245 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_fs.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_fs.c

@@ -262,15 +262,15 @@
 void ipoib_create_debug_files(struct net_device *dev)
 {
 	struct ipoib_dev_priv *priv = ipoib_priv(dev);
-	char name[IFNAMSIZ + sizeof "_path"];
+	char name[IFNAMSIZ + sizeof("_path")];
 
-	snprintf(name, sizeof name, "%s_mcg", dev->name);
+	snprintf(name, sizeof(name), "%s_mcg", dev->name);
 	priv->mcg_dentry = debugfs_create_file(name, S_IFREG | S_IRUGO,
 					       ipoib_root, dev, &ipoib_mcg_fops);
 	if (!priv->mcg_dentry)
 		ipoib_warn(priv, "failed to create mcg debug file\n");
 
-	snprintf(name, sizeof name, "%s_path", dev->name);
+	snprintf(name, sizeof(name), "%s_path", dev->name);
 	priv->path_dentry = debugfs_create_file(name, S_IFREG | S_IRUGO,
 						ipoib_root, dev, &ipoib_path_fops);
 	if (!priv->path_dentry)

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index 8e1f48f..d30387e 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c

@@ -57,7 +57,7 @@
 	struct ipoib_ah *ah;
 	struct ib_ah *vah;
 
-	ah = kmalloc(sizeof *ah, GFP_KERNEL);
+	ah = kmalloc(sizeof(*ah), GFP_KERNEL);
 	if (!ah)
 		return ERR_PTR(-ENOMEM);
 
@@ -202,7 +202,7 @@
 	}
 
 	memcpy(mapping, priv->rx_ring[wr_id].mapping,
-	       IPOIB_UD_RX_SG * sizeof *mapping);
+	       IPOIB_UD_RX_SG * sizeof(*mapping));
 
 	/*
 	 * If we can't allocate a new RX buffer, dump

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index caae4bf..86044aa 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c

@@ -636,7 +636,7 @@
 {
 	struct ipoib_path_iter *iter;
 
-	iter = kmalloc(sizeof *iter, GFP_KERNEL);
+	iter = kmalloc(sizeof(*iter), GFP_KERNEL);
 	if (!iter)
 		return NULL;
 
@@ -866,7 +866,7 @@
 	if (!priv->broadcast)
 		return NULL;
 
-	path = kzalloc(sizeof *path, GFP_ATOMIC);
+	path = kzalloc(sizeof(*path), GFP_ATOMIC);
 	if (!path)
 		return NULL;
 
@@ -1184,7 +1184,7 @@
 {
 	struct ipoib_header *header;
 
-	header = skb_push(skb, sizeof *header);
+	header = skb_push(skb, sizeof(*header));
 
 	header->proto = htons(type);
 	header->reserved = 0;
@@ -1352,7 +1352,7 @@
 {
 	struct ipoib_neigh *neigh;
 
-	neigh = kzalloc(sizeof *neigh, GFP_ATOMIC);
+	neigh = kzalloc(sizeof(*neigh), GFP_ATOMIC);
 	if (!neigh)
 		return NULL;
 
@@ -2329,7 +2329,7 @@
 	int p;
 	int count = 0;
 
-	dev_list = kmalloc(sizeof *dev_list, GFP_KERNEL);
+	dev_list = kmalloc(sizeof(*dev_list), GFP_KERNEL);
 	if (!dev_list)
 		return;
 

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
index 25d7d92..d3ecda2 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_multicast.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_multicast.c

@@ -140,7 +140,7 @@
 {
 	struct ipoib_mcast *mcast;
 
-	mcast = kzalloc(sizeof *mcast, can_sleep ? GFP_KERNEL : GFP_ATOMIC);
+	mcast = kzalloc(sizeof(*mcast), can_sleep ? GFP_KERNEL : GFP_ATOMIC);
 	if (!mcast)
 		return NULL;
 
@@ -916,7 +916,7 @@
 		if (!ipoib_mcast_addr_is_valid(ha->addr, dev->broadcast))
 			continue;
 
-		memcpy(mgid.raw, ha->addr + 4, sizeof mgid);
+		memcpy(mgid.raw, ha->addr + 4, sizeof(mgid));
 
 		mcast = __ipoib_mcast_find(dev, &mgid);
 		if (!mcast || test_bit(IPOIB_MCAST_FLAG_SENDONLY, &mcast->flags)) {
@@ -997,7 +997,7 @@
 {
 	struct ipoib_mcast_iter *iter;
 
-	iter = kmalloc(sizeof *iter, GFP_KERNEL);
+	iter = kmalloc(sizeof(*iter), GFP_KERNEL);
 	if (!iter)
 		return NULL;
 

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_verbs.c b/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
index bb64baf..0dd6b48 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_verbs.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_verbs.c

@@ -52,7 +52,7 @@
 
 	if (set_qkey) {
 		ret = -ENOMEM;
-		qp_attr = kmalloc(sizeof *qp_attr, GFP_KERNEL);
+		qp_attr = kmalloc(sizeof(*qp_attr), GFP_KERNEL);
 		if (!qp_attr)
 			goto out;
 

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
index 55a9b71..248eb73 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c

@@ -130,8 +130,12 @@
 	if (test_bit(IPOIB_FLAG_GOING_DOWN, &ppriv->flags))
 		return -EPERM;
 
-	snprintf(intf_name, sizeof intf_name, "%s.%04x",
-		 ppriv->dev->name, pkey);
+	/* If you increase IFNAMSIZ, update snprintf below
+	 * to allow longer names.
+	 */
+	BUILD_BUG_ON(IFNAMSIZ != 16);
+	snprintf(intf_name, sizeof(intf_name), "%.10s.%04x", ppriv->dev->name,
+		 pkey);
 
 	if (!mutex_trylock(&ppriv->sysfs_mutex))
 		return restart_syscall();

diff --git a/drivers/input/misc/ims-pcu.c b/drivers/input/misc/ims-pcu.c
index ae47312..9629cfa 100644
--- a/drivers/input/misc/ims-pcu.c
+++ b/drivers/input/misc/ims-pcu.c

@@ -47,8 +47,8 @@
 #define IMS_PCU_PART_NUMBER_LEN		15
 #define IMS_PCU_SERIAL_NUMBER_LEN	8
 #define IMS_PCU_DOM_LEN			8
-#define IMS_PCU_FW_VERSION_LEN		(9 + 1)
-#define IMS_PCU_BL_VERSION_LEN		(9 + 1)
+#define IMS_PCU_FW_VERSION_LEN		16
+#define IMS_PCU_BL_VERSION_LEN		16
 #define IMS_PCU_BL_RESET_REASON_LEN	(2 + 1)
 
 #define IMS_PCU_PCU_B_DEVICE_ID		5

diff --git a/drivers/input/misc/pm8xxx-vibrator.c b/drivers/input/misc/pm8xxx-vibrator.c
index 27b3db1..97bf7d9 100644
--- a/drivers/input/misc/pm8xxx-vibrator.c
+++ b/drivers/input/misc/pm8xxx-vibrator.c

@@ -22,7 +22,8 @@
 
 #define VIB_MAX_LEVEL_mV	(3100)
 #define VIB_MIN_LEVEL_mV	(1200)
-#define VIB_MAX_LEVELS		(VIB_MAX_LEVEL_mV - VIB_MIN_LEVEL_mV)
+#define VIB_PER_STEP_mV		(100)
+#define VIB_MAX_LEVELS		(VIB_MAX_LEVEL_mV - VIB_MIN_LEVEL_mV + VIB_PER_STEP_mV)
 
 #define MAX_FF_SPEED		0xff
 
@@ -126,10 +127,10 @@
 		vib->active = true;
 		vib->level = ((VIB_MAX_LEVELS * vib->speed) / MAX_FF_SPEED) +
 						VIB_MIN_LEVEL_mV;
-		vib->level /= 100;
+		vib->level /= VIB_PER_STEP_mV;
 	} else {
 		vib->active = false;
-		vib->level = VIB_MIN_LEVEL_mV / 100;
+		vib->level = VIB_MIN_LEVEL_mV / VIB_PER_STEP_mV;
 	}
 
 	pm8xxx_vib_set(vib, vib->active);

diff --git a/drivers/irqchip/irq-alpine-msi.c b/drivers/irqchip/irq-alpine-msi.c
index 5e03574..2d81770 100644
--- a/drivers/irqchip/irq-alpine-msi.c
+++ b/drivers/irqchip/irq-alpine-msi.c

@@ -165,7 +165,7 @@
 	return 0;
 
 err_sgi:
-	irq_domain_free_irqs_parent(domain, virq, i - 1);
+	irq_domain_free_irqs_parent(domain, virq, i);
 	alpine_msix_free_sgi(priv, sgi, nr_irqs);
 	return err;
 }

diff --git a/drivers/irqchip/irq-gic-v3-its.c b/drivers/irqchip/irq-gic-v3-its.c
index 3325188..932a6d4 100644
--- a/drivers/irqchip/irq-gic-v3-its.c
+++ b/drivers/irqchip/irq-gic-v3-its.c

@@ -2728,13 +2728,8 @@
 		set_bit(i, bitmap);
 	}
 
-	if (err) {
-		if (i > 0)
-			its_vpe_irq_domain_free(domain, virq, i);
-
-		its_lpi_free_chunks(bitmap, base, nr_ids);
-		its_free_prop_table(vprop_page);
-	}
+	if (err)
+		its_vpe_irq_domain_free(domain, virq, i);
 
 	return err;
 }

diff --git a/drivers/macintosh/adb-iop.c b/drivers/macintosh/adb-iop.c
index dbc4a3e..9febd84 100644
--- a/drivers/macintosh/adb-iop.c
+++ b/drivers/macintosh/adb-iop.c

@@ -20,18 +20,16 @@
 #include <linux/init.h>
 #include <linux/proc_fs.h>
 
-#include <asm/macintosh.h> 
-#include <asm/macints.h> 
+#include <asm/macintosh.h>
+#include <asm/macints.h>
 #include <asm/mac_iop.h>
 #include <asm/mac_oss.h>
 #include <asm/adb_iop.h>
 
-#include <linux/adb.h> 
+#include <linux/adb.h>
 
 /*#define DEBUG_ADB_IOP*/
 
-extern void iop_ism_irq(int, void *);
-
 static struct adb_request *current_req;
 static struct adb_request *last_req;
 #if 0
@@ -40,9 +38,9 @@
 #endif
 
 static enum adb_iop_state {
-    idle,
-    sending,
-    awaiting_reply
+	idle,
+	sending,
+	awaiting_reply
 } adb_iop_state;
 
 static void adb_iop_start(void);
@@ -68,7 +66,8 @@
 {
 	req->complete = 1;
 	current_req = req->next;
-	if (req->done) (*req->done)(req);
+	if (req->done)
+		(*req->done)(req);
 	adb_iop_state = state;
 }
 
@@ -102,7 +101,7 @@
 
 static void adb_iop_listen(struct iop_msg *msg)
 {
-	struct adb_iopmsg *amsg = (struct adb_iopmsg *) msg->message;
+	struct adb_iopmsg *amsg = (struct adb_iopmsg *)msg->message;
 	struct adb_request *req;
 	unsigned long flags;
 #ifdef DEBUG_ADB_IOP
@@ -115,9 +114,9 @@
 
 #ifdef DEBUG_ADB_IOP
 	printk("adb_iop_listen %p: rcvd packet, %d bytes: %02X %02X", req,
-		(uint) amsg->count + 2, (uint) amsg->flags, (uint) amsg->cmd);
+	       (uint)amsg->count + 2, (uint)amsg->flags, (uint)amsg->cmd);
 	for (i = 0; i < amsg->count; i++)
-		printk(" %02X", (uint) amsg->data[i]);
+		printk(" %02X", (uint)amsg->data[i]);
 	printk("\n");
 #endif
 
@@ -170,14 +169,15 @@
 
 	/* get the packet to send */
 	req = current_req;
-	if (!req) return;
+	if (!req)
+		return;
 
 	local_irq_save(flags);
 
 #ifdef DEBUG_ADB_IOP
 	printk("adb_iop_start %p: sending packet, %d bytes:", req, req->nbytes);
-	for (i = 0 ; i < req->nbytes ; i++)
-		printk(" %02X", (uint) req->data[i]);
+	for (i = 0; i < req->nbytes; i++)
+		printk(" %02X", (uint)req->data[i]);
 	printk("\n");
 #endif
 
@@ -198,13 +198,14 @@
 	/* Now send it. The IOP manager will call adb_iop_complete */
 	/* when the packet has been sent.                          */
 
-	iop_send_message(ADB_IOP, ADB_CHAN, req,
-			 sizeof(amsg), (__u8 *) &amsg, adb_iop_complete);
+	iop_send_message(ADB_IOP, ADB_CHAN, req, sizeof(amsg), (__u8 *)&amsg,
+			 adb_iop_complete);
 }
 
 int adb_iop_probe(void)
 {
-	if (!iop_ism_present) return -ENODEV;
+	if (!iop_ism_present)
+		return -ENODEV;
 	return 0;
 }
 
@@ -220,10 +221,12 @@
 	int err;
 
 	err = adb_iop_write(req);
-	if (err) return err;
+	if (err)
+		return err;
 
 	if (sync) {
-		while (!req->complete) adb_iop_poll();
+		while (!req->complete)
+			adb_iop_poll();
 	}
 	return 0;
 }
@@ -253,7 +256,9 @@
 	}
 
 	local_irq_restore(flags);
-	if (adb_iop_state == idle) adb_iop_start();
+
+	if (adb_iop_state == idle)
+		adb_iop_start();
 	return 0;
 }
 
@@ -265,8 +270,9 @@
 
 void adb_iop_poll(void)
 {
-	if (adb_iop_state == idle) adb_iop_start();
-	iop_ism_irq(0, (void *) ADB_IOP);
+	if (adb_iop_state == idle)
+		adb_iop_start();
+	iop_ism_irq_poll(ADB_IOP);
 }
 
 int adb_iop_reset_bus(void)

diff --git a/drivers/macintosh/via-macii.c b/drivers/macintosh/via-macii.c
index 4ba06a1..552d60f 100644
--- a/drivers/macintosh/via-macii.c
+++ b/drivers/macintosh/via-macii.c

@@ -12,7 +12,7 @@
  *
  * 1999-08-02 (jmt) - Initial rewrite for Unified ADB.
  * 2000-03-29 Tony Mantler <tonym@mac.linux-m68k.org>
- * 				- Big overhaul, should actually work now.
+ *            - Big overhaul, should actually work now.
  * 2006-12-31 Finn Thain - Another overhaul.
  *
  * Suggested reading:
@@ -23,7 +23,7 @@
  * Apple's "ADB Analyzer" bus sniffer is invaluable:
  *   ftp://ftp.apple.com/developer/Tool_Chest/Devices_-_Hardware/Apple_Desktop_Bus/
  */
- 
+
 #include <stdarg.h>
 #include <linux/types.h>
 #include <linux/errno.h>
@@ -77,7 +77,7 @@
 #define ST_ODD		0x20		/* ADB state: odd data byte */
 #define ST_IDLE		0x30		/* ADB state: idle, nothing to send */
 
-static int  macii_init_via(void);
+static int macii_init_via(void);
 static void macii_start(void);
 static irqreturn_t macii_interrupt(int irq, void *arg);
 static void macii_queue_poll(void);
@@ -120,27 +120,11 @@
 static int command_byte;         /* the most recent command byte transmitted */
 static int autopoll_devs;      /* bits set are device addresses to be polled */
 
-/* Sanity check for request queue. Doesn't check for cycles. */
-static int request_is_queued(struct adb_request *req) {
-	struct adb_request *cur;
-	unsigned long flags;
-	local_irq_save(flags);
-	cur = current_req;
-	while (cur) {
-		if (cur == req) {
-			local_irq_restore(flags);
-			return 1;
-		}
-		cur = cur->next;
-	}
-	local_irq_restore(flags);
-	return 0;
-}
-
 /* Check for MacII style ADB */
 static int macii_probe(void)
 {
-	if (macintosh_config->adb_type != MAC_ADB_II) return -ENODEV;
+	if (macintosh_config->adb_type != MAC_ADB_II)
+		return -ENODEV;
 
 	via = via1;
 
@@ -151,25 +135,22 @@
 /* Initialize the driver */
 int macii_init(void)
 {
-	unsigned long flags;
 	int err;
-	
-	local_irq_save(flags);
-	
+
 	err = macii_init_via();
-	if (err) goto out;
+	if (err)
+		return err;
 
 	err = request_irq(IRQ_MAC_ADB, macii_interrupt, 0, "ADB",
 			  macii_interrupt);
-	if (err) goto out;
+	if (err)
+		return err;
 
 	macii_state = idle;
-out:
-	local_irq_restore(flags);
-	return err;
+	return 0;
 }
 
-/* initialize the hardware */	
+/* initialize the hardware */
 static int macii_init_via(void)
 {
 	unsigned char x;
@@ -179,7 +160,7 @@
 
 	/* Set up state: idle */
 	via[B] |= ST_IDLE;
-	last_status = via[B] & (ST_MASK|CTLR_IRQ);
+	last_status = via[B] & (ST_MASK | CTLR_IRQ);
 
 	/* Shift register on input */
 	via[ACR] = (via[ACR] & ~SR_CTRL) | SR_EXT;
@@ -205,7 +186,8 @@
 	int next_device;
 	static struct adb_request req;
 
-	if (!autopoll_devs) return;
+	if (!autopoll_devs)
+		return;
 
 	device_mask = (1 << (((command_byte & 0xF0) >> 4) + 1)) - 1;
 	if (autopoll_devs & ~device_mask)
@@ -213,10 +195,7 @@
 	else
 		next_device = ffs(autopoll_devs) - 1;
 
-	BUG_ON(request_is_queued(&req));
-
-	adb_request(&req, NULL, ADBREQ_NOSEND, 1,
-	            ADB_READREG(next_device, 0));
+	adb_request(&req, NULL, ADBREQ_NOSEND, 1, ADB_READREG(next_device, 0));
 
 	req.sent = 0;
 	req.complete = 0;
@@ -237,18 +216,13 @@
 	int err;
 	unsigned long flags;
 
-	BUG_ON(request_is_queued(req));
-
 	local_irq_save(flags);
 	err = macii_write(req);
 	local_irq_restore(flags);
 
-	if (!err && sync) {
-		while (!req->complete) {
+	if (!err && sync)
+		while (!req->complete)
 			macii_poll();
-		}
-		BUG_ON(request_is_queued(req));
-	}
 
 	return err;
 }
@@ -260,7 +234,7 @@
 		req->complete = 1;
 		return -EINVAL;
 	}
-	
+
 	req->next = NULL;
 	req->sent = 0;
 	req->complete = 0;
@@ -272,7 +246,8 @@
 	} else {
 		current_req = req;
 		last_req = req;
-		if (macii_state == idle) macii_start();
+		if (macii_state == idle)
+			macii_start();
 	}
 	return 0;
 }
@@ -287,7 +262,8 @@
 	/* bit 1 == device 1, and so on. */
 	autopoll_devs = devs & 0xFFFE;
 
-	if (!autopoll_devs) return 0;
+	if (!autopoll_devs)
+		return 0;
 
 	local_irq_save(flags);
 
@@ -304,7 +280,8 @@
 	return err;
 }
 
-static inline int need_autopoll(void) {
+static inline int need_autopoll(void)
+{
 	/* Was the last command Talk Reg 0
 	 * and is the target on the autopoll list?
 	 */
@@ -326,9 +303,6 @@
 static int macii_reset_bus(void)
 {
 	static struct adb_request req;
-	
-	if (request_is_queued(&req))
-		return 0;
 
 	/* Command = 0, Address = ignored */
 	adb_request(&req, NULL, 0, 1, ADB_BUSRESET);
@@ -346,10 +320,6 @@
 
 	req = current_req;
 
-	BUG_ON(req == NULL);
-
-	BUG_ON(macii_state != idle);
-
 	/* Now send it. Be careful though, that first byte of the request
 	 * is actually ADB_PACKET; the real data begins at index 1!
 	 * And req->nbytes is the number of bytes of real data plus one.
@@ -375,7 +345,7 @@
  * to be activity on the ADB bus. The chip will poll to achieve this.
  *
  * The basic ADB state machine was left unchanged from the original MacII code
- * by Alan Cox, which was based on the CUDA driver for PowerMac. 
+ * by Alan Cox, which was based on the CUDA driver for PowerMac.
  * The syntax of the ADB status lines is totally different on MacII,
  * though. MacII uses the states Command -> Even -> Odd -> Even ->...-> Idle
  * for sending and Idle -> Even -> Odd -> Even ->...-> Idle for receiving.
@@ -387,7 +357,6 @@
 static irqreturn_t macii_interrupt(int irq, void *arg)
 {
 	int x;
-	static int entered;
 	struct adb_request *req;
 
 	if (!arg) {
@@ -398,153 +367,150 @@
 			return IRQ_NONE;
 	}
 
-	BUG_ON(entered++);
-
 	last_status = status;
-	status = via[B] & (ST_MASK|CTLR_IRQ);
+	status = via[B] & (ST_MASK | CTLR_IRQ);
 
 	switch (macii_state) {
-		case idle:
-			if (reading_reply) {
-				reply_ptr = current_req->reply;
-			} else {
-				BUG_ON(current_req != NULL);
-				reply_ptr = reply_buf;
-			}
+	case idle:
+		if (reading_reply) {
+			reply_ptr = current_req->reply;
+		} else {
+			WARN_ON(current_req);
+			reply_ptr = reply_buf;
+		}
 
-			x = via[SR];
+		x = via[SR];
 
-			if ((status & CTLR_IRQ) && (x == 0xFF)) {
-				/* Bus timeout without SRQ sequence:
-				 *     data is "FF" while CTLR_IRQ is "H"
-				 */
-				reply_len = 0;
-				srq_asserted = 0;
-				macii_state = read_done;
-			} else {
-				macii_state = reading;
-				*reply_ptr = x;
-				reply_len = 1;
-			}
-
-			/* set ADB state = even for first data byte */
-			via[B] = (via[B] & ~ST_MASK) | ST_EVEN;
-			break;
-
-		case sending:
-			req = current_req;
-			if (data_index >= req->nbytes) {
-				req->sent = 1;
-				macii_state = idle;
-
-				if (req->reply_expected) {
-					reading_reply = 1;
-				} else {
-					req->complete = 1;
-					current_req = req->next;
-					if (req->done) (*req->done)(req);
-
-					if (current_req)
-						macii_start();
-					else
-						if (need_autopoll())
-							macii_autopoll(autopoll_devs);
-				}
-
-				if (macii_state == idle) {
-					/* reset to shift in */
-					via[ACR] &= ~SR_OUT;
-					x = via[SR];
-					/* set ADB state idle - might get SRQ */
-					via[B] = (via[B] & ~ST_MASK) | ST_IDLE;
-				}
-			} else {
-				via[SR] = req->data[data_index++];
-
-				if ( (via[B] & ST_MASK) == ST_CMD ) {
-					/* just sent the command byte, set to EVEN */
-					via[B] = (via[B] & ~ST_MASK) | ST_EVEN;
-				} else {
-					/* invert state bits, toggle ODD/EVEN */
-					via[B] ^= ST_MASK;
-				}
-			}
-			break;
-
-		case reading:
-			x = via[SR];
-			BUG_ON((status & ST_MASK) == ST_CMD ||
-			       (status & ST_MASK) == ST_IDLE);
-
-			/* Bus timeout with SRQ sequence:
-			 *     data is "XX FF"      while CTLR_IRQ is "L L"
-			 * End of packet without SRQ sequence:
-			 *     data is "XX...YY 00" while CTLR_IRQ is "L...H L"
-			 * End of packet SRQ sequence:
-			 *     data is "XX...YY 00" while CTLR_IRQ is "L...L L"
-			 * (where XX is the first response byte and
-			 * YY is the last byte of valid response data.)
+		if ((status & CTLR_IRQ) && (x == 0xFF)) {
+			/* Bus timeout without SRQ sequence:
+			 *     data is "FF" while CTLR_IRQ is "H"
 			 */
-
+			reply_len = 0;
 			srq_asserted = 0;
-			if (!(status & CTLR_IRQ)) {
-				if (x == 0xFF) {
-					if (!(last_status & CTLR_IRQ)) {
-						macii_state = read_done;
-						reply_len = 0;
-						srq_asserted = 1;
-					}
-				} else if (x == 0x00) {
-					macii_state = read_done;
-					if (!(last_status & CTLR_IRQ))
-						srq_asserted = 1;
-				}
-			}
+			macii_state = read_done;
+		} else {
+			macii_state = reading;
+			*reply_ptr = x;
+			reply_len = 1;
+		}
 
-			if (macii_state == reading) {
-				BUG_ON(reply_len > 15);
-				reply_ptr++;
-				*reply_ptr = x;
-				reply_len++;
-			}
+		/* set ADB state = even for first data byte */
+		via[B] = (via[B] & ~ST_MASK) | ST_EVEN;
+		break;
 
-			/* invert state bits, toggle ODD/EVEN */
-			via[B] ^= ST_MASK;
-			break;
-
-		case read_done:
-			x = via[SR];
-
-			if (reading_reply) {
-				reading_reply = 0;
-				req = current_req;
-				req->reply_len = reply_len;
-				req->complete = 1;
-				current_req = req->next;
-				if (req->done) (*req->done)(req);
-			} else if (reply_len && autopoll_devs)
-				adb_input(reply_buf, reply_len, 0);
-
+	case sending:
+		req = current_req;
+		if (data_index >= req->nbytes) {
+			req->sent = 1;
 			macii_state = idle;
 
-			/* SRQ seen before, initiate poll now */
-			if (srq_asserted)
-				macii_queue_poll();
+			if (req->reply_expected) {
+				reading_reply = 1;
+			} else {
+				req->complete = 1;
+				current_req = req->next;
+				if (req->done)
+					(*req->done)(req);
 
-			if (current_req)
-				macii_start();
-			else
-				if (need_autopoll())
+				if (current_req)
+					macii_start();
+				else if (need_autopoll())
 					macii_autopoll(autopoll_devs);
+			}
 
-			if (macii_state == idle)
+			if (macii_state == idle) {
+				/* reset to shift in */
+				via[ACR] &= ~SR_OUT;
+				x = via[SR];
+				/* set ADB state idle - might get SRQ */
 				via[B] = (via[B] & ~ST_MASK) | ST_IDLE;
-			break;
+			}
+		} else {
+			via[SR] = req->data[data_index++];
 
-		default:
+			if ((via[B] & ST_MASK) == ST_CMD) {
+				/* just sent the command byte, set to EVEN */
+				via[B] = (via[B] & ~ST_MASK) | ST_EVEN;
+			} else {
+				/* invert state bits, toggle ODD/EVEN */
+				via[B] ^= ST_MASK;
+			}
+		}
+		break;
+
+	case reading:
+		x = via[SR];
+		WARN_ON((status & ST_MASK) == ST_CMD ||
+			(status & ST_MASK) == ST_IDLE);
+
+		/* Bus timeout with SRQ sequence:
+		 *     data is "XX FF"      while CTLR_IRQ is "L L"
+		 * End of packet without SRQ sequence:
+		 *     data is "XX...YY 00" while CTLR_IRQ is "L...H L"
+		 * End of packet SRQ sequence:
+		 *     data is "XX...YY 00" while CTLR_IRQ is "L...L L"
+		 * (where XX is the first response byte and
+		 * YY is the last byte of valid response data.)
+		 */
+
+		srq_asserted = 0;
+		if (!(status & CTLR_IRQ)) {
+			if (x == 0xFF) {
+				if (!(last_status & CTLR_IRQ)) {
+					macii_state = read_done;
+					reply_len = 0;
+					srq_asserted = 1;
+				}
+			} else if (x == 0x00) {
+				macii_state = read_done;
+				if (!(last_status & CTLR_IRQ))
+					srq_asserted = 1;
+			}
+		}
+
+		if (macii_state == reading &&
+		    reply_len < ARRAY_SIZE(reply_buf)) {
+			reply_ptr++;
+			*reply_ptr = x;
+			reply_len++;
+		}
+
+		/* invert state bits, toggle ODD/EVEN */
+		via[B] ^= ST_MASK;
+		break;
+
+	case read_done:
+		x = via[SR];
+
+		if (reading_reply) {
+			reading_reply = 0;
+			req = current_req;
+			req->reply_len = reply_len;
+			req->complete = 1;
+			current_req = req->next;
+			if (req->done)
+				(*req->done)(req);
+		} else if (reply_len && autopoll_devs)
+			adb_input(reply_buf, reply_len, 0);
+
+		macii_state = idle;
+
+		/* SRQ seen before, initiate poll now */
+		if (srq_asserted)
+			macii_queue_poll();
+
+		if (current_req)
+			macii_start();
+		else if (need_autopoll())
+			macii_autopoll(autopoll_devs);
+
+		if (macii_state == idle)
+			via[B] = (via[B] & ~ST_MASK) | ST_IDLE;
+		break;
+
+	default:
 		break;
 	}
 
-	entered--;
 	return IRQ_HANDLED;
 }

diff --git a/drivers/md/dm-core.h b/drivers/md/dm-core.h
index 6a14f94..4e0a912 100644
--- a/drivers/md/dm-core.h
+++ b/drivers/md/dm-core.h

@@ -18,6 +18,8 @@
 #include "dm.h"
 
 #define DM_RESERVED_MAX_IOS		1024
+#define DM_MAX_TARGETS			1048576
+#define DM_MAX_TARGET_PARAMS		1024
 
 struct dm_kobject_holder {
 	struct kobject kobj;

diff --git a/drivers/md/dm-ioctl.c b/drivers/md/dm-ioctl.c
index 3e37910..bc36930 100644
--- a/drivers/md/dm-ioctl.c
+++ b/drivers/md/dm-ioctl.c

@@ -1733,7 +1733,8 @@
 	if (copy_from_user(param_kernel, user, minimum_data_size))
 		return -EFAULT;
 
-	if (param_kernel->data_size < minimum_data_size)
+	if (unlikely(param_kernel->data_size < minimum_data_size) ||
+	    unlikely(param_kernel->data_size > DM_MAX_TARGETS * DM_MAX_TARGET_PARAMS))
 		return -EINVAL;
 
 	secure_data = param_kernel->flags & DM_SECURE_DATA_FLAG;

diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
index 304b5e4..651d00c 100644
--- a/drivers/md/dm-table.c
+++ b/drivers/md/dm-table.c

@@ -189,7 +189,12 @@
 int dm_table_create(struct dm_table **result, fmode_t mode,
 		    unsigned num_targets, struct mapped_device *md)
 {
-	struct dm_table *t = kzalloc(sizeof(*t), GFP_KERNEL);
+	struct dm_table *t;
+
+	if (num_targets > DM_MAX_TARGETS)
+		return -EOVERFLOW;
+
+	t = kzalloc(sizeof(*t), GFP_KERNEL);
 
 	if (!t)
 		return -ENOMEM;
@@ -204,7 +209,7 @@
 
 	if (!num_targets) {
 		kfree(t);
-		return -ENOMEM;
+		return -EOVERFLOW;
 	}
 
 	if (alloc_targets(t, num_targets)) {

diff --git a/drivers/md/raid5.c b/drivers/md/raid5.c
index d2ac3d1..a8b3beb 100644
--- a/drivers/md/raid5.c
+++ b/drivers/md/raid5.c

@@ -44,7 +44,6 @@
  */
 
 #include <linux/blkdev.h>
-#include <linux/delay.h>
 #include <linux/kthread.h>
 #include <linux/raid/pq.h>
 #include <linux/async_tx.h>
@@ -6273,6 +6272,9 @@
 		int batch_size, released;
 		unsigned int offset;
 
+		if (test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags))
+			break;
+
 		released = release_stripe_list(conf, conf->temp_inactive_list);
 		if (released)
 			clear_bit(R5_DID_ALLOC, &conf->cache_state);
@@ -6309,18 +6311,7 @@
 			spin_unlock_irq(&conf->device_lock);
 			md_check_recovery(mddev);
 			spin_lock_irq(&conf->device_lock);
-
-			/*
-			 * Waiting on MD_SB_CHANGE_PENDING below may deadlock
-			 * seeing md_check_recovery() is needed to clear
-			 * the flag when using mdmon.
-			 */
-			continue;
 		}
-
-		wait_event_lock_irq(mddev->sb_wait,
-			!test_bit(MD_SB_CHANGE_PENDING, &mddev->sb_flags),
-			conf->device_lock);
 	}
 	pr_debug("%d stripes handled\n", handled);
 

diff --git a/drivers/media/cec/cec-api.c b/drivers/media/cec/cec-api.c
index 66ef06f..65297cd 100644
--- a/drivers/media/cec/cec-api.c
+++ b/drivers/media/cec/cec-api.c

@@ -645,6 +645,8 @@
 		list_del(&data->xfer_list);
 	}
 	mutex_unlock(&adap->lock);
+
+	mutex_lock(&fh->lock);
 	while (!list_empty(&fh->msgs)) {
 		struct cec_msg_entry *entry =
 			list_first_entry(&fh->msgs, struct cec_msg_entry, list);
@@ -662,6 +664,7 @@
 			kfree(entry);
 		}
 	}
+	mutex_unlock(&fh->lock);
 	kfree(fh);
 
 	cec_put_device(devnode);

diff --git a/drivers/media/dvb-core/dvbdev.c b/drivers/media/dvb-core/dvbdev.c
index 6e3c023..fd59027 100644
--- a/drivers/media/dvb-core/dvbdev.c
+++ b/drivers/media/dvb-core/dvbdev.c

@@ -69,22 +69,20 @@
 #else
 #define DVB_MAX_IDS		4
 
-static int nums2minor(int num, enum dvb_device_type type, int id)
-{
-	int n = (num << 6) | (id << 4);
+static const u8 minor_type[] = {
+       [DVB_DEVICE_VIDEO]      = 0,
+       [DVB_DEVICE_AUDIO]      = 1,
+       [DVB_DEVICE_SEC]        = 2,
+       [DVB_DEVICE_FRONTEND]   = 3,
+       [DVB_DEVICE_DEMUX]      = 4,
+       [DVB_DEVICE_DVR]        = 5,
+       [DVB_DEVICE_CA]         = 6,
+       [DVB_DEVICE_NET]        = 7,
+       [DVB_DEVICE_OSD]        = 8,
+};
 
-	switch (type) {
-	case DVB_DEVICE_VIDEO:		return n;
-	case DVB_DEVICE_AUDIO:		return n | 1;
-	case DVB_DEVICE_SEC:		return n | 2;
-	case DVB_DEVICE_FRONTEND:	return n | 3;
-	case DVB_DEVICE_DEMUX:		return n | 4;
-	case DVB_DEVICE_DVR:		return n | 5;
-	case DVB_DEVICE_CA:		return n | 6;
-	case DVB_DEVICE_NET:		return n | 7;
-	case DVB_DEVICE_OSD:		return n | 8;
-	}
-}
+#define nums2minor(num, type, id) \
+       (((num) << 6) | ((id) << 4) | minor_type[type])
 
 #define MAX_DVB_MINORS		(DVB_MAX_ADAPTERS*64)
 #endif

diff --git a/drivers/media/dvb-frontends/mxl5xx.c b/drivers/media/dvb-frontends/mxl5xx.c
index 676c96c..802d402 100644
--- a/drivers/media/dvb-frontends/mxl5xx.c
+++ b/drivers/media/dvb-frontends/mxl5xx.c

@@ -1367,57 +1367,57 @@
 	u32 nco_count_min = 0;
 	u32 clk_type = 0;
 
-	struct MXL_REG_FIELD_T xpt_sync_polarity[MXL_HYDRA_DEMOD_MAX] = {
+	static const struct MXL_REG_FIELD_T xpt_sync_polarity[MXL_HYDRA_DEMOD_MAX] = {
 		{0x90700010, 8, 1}, {0x90700010, 9, 1},
 		{0x90700010, 10, 1}, {0x90700010, 11, 1},
 		{0x90700010, 12, 1}, {0x90700010, 13, 1},
 		{0x90700010, 14, 1}, {0x90700010, 15, 1} };
-	struct MXL_REG_FIELD_T xpt_clock_polarity[MXL_HYDRA_DEMOD_MAX] = {
+	static const struct MXL_REG_FIELD_T xpt_clock_polarity[MXL_HYDRA_DEMOD_MAX] = {
 		{0x90700010, 16, 1}, {0x90700010, 17, 1},
 		{0x90700010, 18, 1}, {0x90700010, 19, 1},
 		{0x90700010, 20, 1}, {0x90700010, 21, 1},
 		{0x90700010, 22, 1}, {0x90700010, 23, 1} };
-	struct MXL_REG_FIELD_T xpt_valid_polarity[MXL_HYDRA_DEMOD_MAX] = {
+	static const struct MXL_REG_FIELD_T xpt_valid_polarity[MXL_HYDRA_DEMOD_MAX] = {
 		{0x90700014, 0, 1}, {0x90700014, 1, 1},
 		{0x90700014, 2, 1}, {0x90700014, 3, 1},
 		{0x90700014, 4, 1}, {0x90700014, 5, 1},
 		{0x90700014, 6, 1}, {0x90700014, 7, 1} };
-	struct MXL_REG_FIELD_T xpt_ts_clock_phase[MXL_HYDRA_DEMOD_MAX] = {
+	static const struct MXL_REG_FIELD_T xpt_ts_clock_phase[MXL_HYDRA_DEMOD_MAX] = {
 		{0x90700018, 0, 3}, {0x90700018, 4, 3},
 		{0x90700018, 8, 3}, {0x90700018, 12, 3},
 		{0x90700018, 16, 3}, {0x90700018, 20, 3},
 		{0x90700018, 24, 3}, {0x90700018, 28, 3} };
-	struct MXL_REG_FIELD_T xpt_lsb_first[MXL_HYDRA_DEMOD_MAX] = {
+	static const struct MXL_REG_FIELD_T xpt_lsb_first[MXL_HYDRA_DEMOD_MAX] = {
 		{0x9070000C, 16, 1}, {0x9070000C, 17, 1},
 		{0x9070000C, 18, 1}, {0x9070000C, 19, 1},
 		{0x9070000C, 20, 1}, {0x9070000C, 21, 1},
 		{0x9070000C, 22, 1}, {0x9070000C, 23, 1} };
-	struct MXL_REG_FIELD_T xpt_sync_byte[MXL_HYDRA_DEMOD_MAX] = {
+	static const struct MXL_REG_FIELD_T xpt_sync_byte[MXL_HYDRA_DEMOD_MAX] = {
 		{0x90700010, 0, 1}, {0x90700010, 1, 1},
 		{0x90700010, 2, 1}, {0x90700010, 3, 1},
 		{0x90700010, 4, 1}, {0x90700010, 5, 1},
 		{0x90700010, 6, 1}, {0x90700010, 7, 1} };
-	struct MXL_REG_FIELD_T xpt_enable_output[MXL_HYDRA_DEMOD_MAX] = {
+	static const struct MXL_REG_FIELD_T xpt_enable_output[MXL_HYDRA_DEMOD_MAX] = {
 		{0x9070000C, 0, 1}, {0x9070000C, 1, 1},
 		{0x9070000C, 2, 1}, {0x9070000C, 3, 1},
 		{0x9070000C, 4, 1}, {0x9070000C, 5, 1},
 		{0x9070000C, 6, 1}, {0x9070000C, 7, 1} };
-	struct MXL_REG_FIELD_T xpt_err_replace_sync[MXL_HYDRA_DEMOD_MAX] = {
+	static const struct MXL_REG_FIELD_T xpt_err_replace_sync[MXL_HYDRA_DEMOD_MAX] = {
 		{0x9070000C, 24, 1}, {0x9070000C, 25, 1},
 		{0x9070000C, 26, 1}, {0x9070000C, 27, 1},
 		{0x9070000C, 28, 1}, {0x9070000C, 29, 1},
 		{0x9070000C, 30, 1}, {0x9070000C, 31, 1} };
-	struct MXL_REG_FIELD_T xpt_err_replace_valid[MXL_HYDRA_DEMOD_MAX] = {
+	static const struct MXL_REG_FIELD_T xpt_err_replace_valid[MXL_HYDRA_DEMOD_MAX] = {
 		{0x90700014, 8, 1}, {0x90700014, 9, 1},
 		{0x90700014, 10, 1}, {0x90700014, 11, 1},
 		{0x90700014, 12, 1}, {0x90700014, 13, 1},
 		{0x90700014, 14, 1}, {0x90700014, 15, 1} };
-	struct MXL_REG_FIELD_T xpt_continuous_clock[MXL_HYDRA_DEMOD_MAX] = {
+	static const struct MXL_REG_FIELD_T xpt_continuous_clock[MXL_HYDRA_DEMOD_MAX] = {
 		{0x907001D4, 0, 1}, {0x907001D4, 1, 1},
 		{0x907001D4, 2, 1}, {0x907001D4, 3, 1},
 		{0x907001D4, 4, 1}, {0x907001D4, 5, 1},
 		{0x907001D4, 6, 1}, {0x907001D4, 7, 1} };
-	struct MXL_REG_FIELD_T xpt_nco_clock_rate[MXL_HYDRA_DEMOD_MAX] = {
+	static const struct MXL_REG_FIELD_T xpt_nco_clock_rate[MXL_HYDRA_DEMOD_MAX] = {
 		{0x90700044, 16, 80}, {0x90700044, 16, 81},
 		{0x90700044, 16, 82}, {0x90700044, 16, 83},
 		{0x90700044, 16, 84}, {0x90700044, 16, 85},

diff --git a/drivers/media/pci/ngene/ngene-core.c b/drivers/media/pci/ngene/ngene-core.c
index 96d0cbf..714096b 100644
--- a/drivers/media/pci/ngene/ngene-core.c
+++ b/drivers/media/pci/ngene/ngene-core.c

@@ -1499,7 +1499,9 @@
 	}
 
 	if (dev->ci.en && (io & NGENE_IO_TSOUT)) {
-		dvb_ca_en50221_init(adapter, dev->ci.en, 0, 1);
+		ret = dvb_ca_en50221_init(adapter, dev->ci.en, 0, 1);
+		if (ret != 0)
+			goto err;
 		set_transfer(chan, 1);
 		chan->dev->channel[2].DataFormatFlags = DF_SWAP32;
 		set_transfer(&chan->dev->channel[2], 1);

diff --git a/drivers/media/radio/radio-shark2.c b/drivers/media/radio/radio-shark2.c
index 5356941..fda9881 100644
--- a/drivers/media/radio/radio-shark2.c
+++ b/drivers/media/radio/radio-shark2.c

@@ -62,7 +62,7 @@
 #ifdef SHARK_USE_LEDS
 	struct work_struct led_work;
 	struct led_classdev leds[NO_LEDS];
-	char led_names[NO_LEDS][32];
+	char led_names[NO_LEDS][64];
 	atomic_t brightness[NO_LEDS];
 	unsigned long brightness_new;
 #endif

diff --git a/drivers/media/usb/stk1160/stk1160-video.c b/drivers/media/usb/stk1160/stk1160-video.c
index 8a6cdbc..4f16e15 100644
--- a/drivers/media/usb/stk1160/stk1160-video.c
+++ b/drivers/media/usb/stk1160/stk1160-video.c

@@ -109,7 +109,7 @@
 static inline
 void stk1160_copy_video(struct stk1160 *dev, u8 *src, int len)
 {
-	int linesdone, lineoff, lencopy;
+	int linesdone, lineoff, lencopy, offset;
 	int bytesperline = dev->width * 2;
 	struct stk1160_buffer *buf = dev->isoc_ctl.buf;
 	u8 *dst = buf->mem;
@@ -149,8 +149,13 @@
 	 * Check if we have enough space left in the buffer.
 	 * In that case, we force loop exit after copy.
 	 */
-	if (lencopy > buf->bytesused - buf->length) {
-		lencopy = buf->bytesused - buf->length;
+	offset = dst - (u8 *)buf->mem;
+	if (offset > buf->length) {
+		dev_warn_ratelimited(dev->dev, "out of bounds offset\n");
+		return;
+	}
+	if (lencopy > buf->length - offset) {
+		lencopy = buf->length - offset;
 		remain = lencopy;
 	}
 
@@ -192,8 +197,13 @@
 		 * Check if we have enough space left in the buffer.
 		 * In that case, we force loop exit after copy.
 		 */
-		if (lencopy > buf->bytesused - buf->length) {
-			lencopy = buf->bytesused - buf->length;
+		offset = dst - (u8 *)buf->mem;
+		if (offset > buf->length) {
+			dev_warn_ratelimited(dev->dev, "offset out of bounds\n");
+			return;
+		}
+		if (lencopy > buf->length - offset) {
+			lencopy = buf->length - offset;
 			remain = lencopy;
 		}
 

diff --git a/drivers/media/v4l2-core/v4l2-dev.c b/drivers/media/v4l2-core/v4l2-dev.c
index c647ba6..1375446 100644
--- a/drivers/media/v4l2-core/v4l2-dev.c
+++ b/drivers/media/v4l2-core/v4l2-dev.c

@@ -969,8 +969,10 @@
 	vdev->dev.devt = MKDEV(VIDEO_MAJOR, vdev->minor);
 	vdev->dev.parent = vdev->dev_parent;
 	dev_set_name(&vdev->dev, "%s%d", name_base, vdev->num);
+	mutex_lock(&videodev_lock);
 	ret = device_register(&vdev->dev);
 	if (ret < 0) {
+		mutex_unlock(&videodev_lock);
 		printk(KERN_ERR "%s: device_register failed\n", __func__);
 		goto cleanup;
 	}
@@ -990,6 +992,7 @@
 
 	/* Part 6: Activate this minor. The char device can now be used. */
 	set_bit(V4L2_FL_REGISTERED, &vdev->flags);
+	mutex_unlock(&videodev_lock);
 
 	return 0;
 

diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
index 9c5cde2..e7c3270 100644
--- a/drivers/mmc/core/host.c
+++ b/drivers/mmc/core/host.c

@@ -69,13 +69,12 @@
 
 /*
  * Pause re-tuning for a small set of operations.  The pause begins after the
- * next command and after first doing re-tuning.
+ * next command.
  */
 void mmc_retune_pause(struct mmc_host *host)
 {
 	if (!host->retune_paused) {
 		host->retune_paused = 1;
-		mmc_retune_needed(host);
 		mmc_retune_hold(host);
 	}
 }

diff --git a/drivers/mtd/nand/diskonchip.c b/drivers/mtd/nand/diskonchip.c
index 4f48a9b..a844a5e 100644
--- a/drivers/mtd/nand/diskonchip.c
+++ b/drivers/mtd/nand/diskonchip.c

@@ -54,7 +54,7 @@
 	0xe8000, 0xea000, 0xec000, 0xee000,
 #endif
 #endif
-	0xffffffff };
+};
 
 static struct mtd_info *doclist = NULL;
 
@@ -1673,7 +1673,7 @@
 		if (ret < 0)
 			goto outerr;
 	} else {
-		for (i = 0; (doc_locations[i] != 0xffffffff); i++) {
+		for (i = 0; i < ARRAY_SIZE(doc_locations); i++) {
 			doc_probe(doc_locations[i]);
 		}
 	}

diff --git a/drivers/mtd/nand/nand_hynix.c b/drivers/mtd/nand/nand_hynix.c
index 985751e..9863701 100644
--- a/drivers/mtd/nand/nand_hynix.c
+++ b/drivers/mtd/nand/nand_hynix.c

@@ -359,7 +359,7 @@
 	if (ret)
 		pr_warn("failed to initialize read-retry infrastructure");
 
-	return 0;
+	return ret;
 }
 
 static void hynix_nand_extract_oobsize(struct nand_chip *chip,

diff --git a/drivers/net/dsa/mv88e6xxx/chip.c b/drivers/net/dsa/mv88e6xxx/chip.c
index e8f6d70..0f64fc3 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.c
+++ b/drivers/net/dsa/mv88e6xxx/chip.c

@@ -3254,6 +3254,7 @@
 		.family = MV88E6XXX_FAMILY_6097,
 		.name = "Marvell 88E6085",
 		.num_databases = 4096,
+		.num_macs = 8192,
 		.num_ports = 10,
 		.max_vid = 4095,
 		.port_base_addr = 0x10,
@@ -3274,6 +3275,7 @@
 		.family = MV88E6XXX_FAMILY_6095,
 		.name = "Marvell 88E6095/88E6095F",
 		.num_databases = 256,
+		.num_macs = 8192,
 		.num_ports = 11,
 		.max_vid = 4095,
 		.port_base_addr = 0x10,
@@ -3292,6 +3294,7 @@
 		.family = MV88E6XXX_FAMILY_6097,
 		.name = "Marvell 88E6097/88E6097F",
 		.num_databases = 4096,
+		.num_macs = 8192,
 		.num_ports = 11,
 		.max_vid = 4095,
 		.port_base_addr = 0x10,
@@ -3312,6 +3315,7 @@
 		.family = MV88E6XXX_FAMILY_6165,
 		.name = "Marvell 88E6123",
 		.num_databases = 4096,
+		.num_macs = 1024,
 		.num_ports = 3,
 		.max_vid = 4095,
 		.port_base_addr = 0x10,
@@ -3332,6 +3336,7 @@
 		.family = MV88E6XXX_FAMILY_6185,
 		.name = "Marvell 88E6131",
 		.num_databases = 256,
+		.num_macs = 8192,
 		.num_ports = 8,
 		.max_vid = 4095,
 		.port_base_addr = 0x10,
@@ -3348,8 +3353,9 @@
 	[MV88E6141] = {
 		.prod_num = MV88E6XXX_PORT_SWITCH_ID_PROD_6141,
 		.family = MV88E6XXX_FAMILY_6341,
-		.name = "Marvell 88E6341",
-		.num_databases = 4096,
+		.name = "Marvell 88E6141",
+		.num_databases = 256,
+		.num_macs = 2048,
 		.num_ports = 6,
 		.max_vid = 4095,
 		.port_base_addr = 0x10,
@@ -3369,6 +3375,7 @@
 		.family = MV88E6XXX_FAMILY_6165,
 		.name = "Marvell 88E6161",
 		.num_databases = 4096,
+		.num_macs = 1024,
 		.num_ports = 6,
 		.max_vid = 4095,
 		.port_base_addr = 0x10,
@@ -3389,6 +3396,7 @@
 		.family = MV88E6XXX_FAMILY_6165,
 		.name = "Marvell 88E6165",
 		.num_databases = 4096,
+		.num_macs = 8192,
 		.num_ports = 6,
 		.max_vid = 4095,
 		.port_base_addr = 0x10,
@@ -3409,6 +3417,7 @@
 		.family = MV88E6XXX_FAMILY_6351,
 		.name = "Marvell 88E6171",
 		.num_databases = 4096,
+		.num_macs = 8192,
 		.num_ports = 7,
 		.max_vid = 4095,
 		.port_base_addr = 0x10,
@@ -3429,6 +3438,7 @@
 		.family = MV88E6XXX_FAMILY_6352,
 		.name = "Marvell 88E6172",
 		.num_databases = 4096,
+		.num_macs = 8192,
 		.num_ports = 7,
 		.max_vid = 4095,
 		.port_base_addr = 0x10,
@@ -3449,6 +3459,7 @@
 		.family = MV88E6XXX_FAMILY_6351,
 		.name = "Marvell 88E6175",
 		.num_databases = 4096,
+		.num_macs = 8192,
 		.num_ports = 7,
 		.max_vid = 4095,
 		.port_base_addr = 0x10,
@@ -3469,6 +3480,7 @@
 		.family = MV88E6XXX_FAMILY_6352,
 		.name = "Marvell 88E6176",
 		.num_databases = 4096,
+		.num_macs = 8192,
 		.num_ports = 7,
 		.max_vid = 4095,
 		.port_base_addr = 0x10,
@@ -3489,6 +3501,7 @@
 		.family = MV88E6XXX_FAMILY_6185,
 		.name = "Marvell 88E6185",
 		.num_databases = 256,
+		.num_macs = 8192,
 		.num_ports = 10,
 		.max_vid = 4095,
 		.port_base_addr = 0x10,
@@ -3507,6 +3520,7 @@
 		.family = MV88E6XXX_FAMILY_6390,
 		.name = "Marvell 88E6190",
 		.num_databases = 4096,
+		.num_macs = 16384,
 		.num_ports = 11,	/* 10 + Z80 */
 		.max_vid = 8191,
 		.port_base_addr = 0x0,
@@ -3527,6 +3541,7 @@
 		.family = MV88E6XXX_FAMILY_6390,
 		.name = "Marvell 88E6190X",
 		.num_databases = 4096,
+		.num_macs = 16384,
 		.num_ports = 11,	/* 10 + Z80 */
 		.max_vid = 8191,
 		.port_base_addr = 0x0,
@@ -3547,6 +3562,7 @@
 		.family = MV88E6XXX_FAMILY_6390,
 		.name = "Marvell 88E6191",
 		.num_databases = 4096,
+		.num_macs = 16384,
 		.num_ports = 11,	/* 10 + Z80 */
 		.max_vid = 8191,
 		.port_base_addr = 0x0,
@@ -3567,6 +3583,7 @@
 		.family = MV88E6XXX_FAMILY_6352,
 		.name = "Marvell 88E6240",
 		.num_databases = 4096,
+		.num_macs = 8192,
 		.num_ports = 7,
 		.max_vid = 4095,
 		.port_base_addr = 0x10,
@@ -3607,6 +3624,7 @@
 		.family = MV88E6XXX_FAMILY_6320,
 		.name = "Marvell 88E6320",
 		.num_databases = 4096,
+		.num_macs = 8192,
 		.num_ports = 7,
 		.max_vid = 4095,
 		.port_base_addr = 0x10,
@@ -3626,6 +3644,7 @@
 		.family = MV88E6XXX_FAMILY_6320,
 		.name = "Marvell 88E6321",
 		.num_databases = 4096,
+		.num_macs = 8192,
 		.num_ports = 7,
 		.max_vid = 4095,
 		.port_base_addr = 0x10,
@@ -3643,7 +3662,8 @@
 		.prod_num = MV88E6XXX_PORT_SWITCH_ID_PROD_6341,
 		.family = MV88E6XXX_FAMILY_6341,
 		.name = "Marvell 88E6341",
-		.num_databases = 4096,
+		.num_databases = 256,
+		.num_macs = 2048,
 		.num_ports = 6,
 		.max_vid = 4095,
 		.port_base_addr = 0x10,
@@ -3663,6 +3683,7 @@
 		.family = MV88E6XXX_FAMILY_6351,
 		.name = "Marvell 88E6350",
 		.num_databases = 4096,
+		.num_macs = 8192,
 		.num_ports = 7,
 		.max_vid = 4095,
 		.port_base_addr = 0x10,
@@ -3683,6 +3704,7 @@
 		.family = MV88E6XXX_FAMILY_6351,
 		.name = "Marvell 88E6351",
 		.num_databases = 4096,
+		.num_macs = 8192,
 		.num_ports = 7,
 		.max_vid = 4095,
 		.port_base_addr = 0x10,
@@ -3703,6 +3725,7 @@
 		.family = MV88E6XXX_FAMILY_6352,
 		.name = "Marvell 88E6352",
 		.num_databases = 4096,
+		.num_macs = 8192,
 		.num_ports = 7,
 		.max_vid = 4095,
 		.port_base_addr = 0x10,
@@ -3722,6 +3745,7 @@
 		.family = MV88E6XXX_FAMILY_6390,
 		.name = "Marvell 88E6390",
 		.num_databases = 4096,
+		.num_macs = 16384,
 		.num_ports = 11,	/* 10 + Z80 */
 		.max_vid = 8191,
 		.port_base_addr = 0x0,
@@ -3741,6 +3765,7 @@
 		.family = MV88E6XXX_FAMILY_6390,
 		.name = "Marvell 88E6390X",
 		.num_databases = 4096,
+		.num_macs = 16384,
 		.num_ports = 11,	/* 10 + Z80 */
 		.max_vid = 8191,
 		.port_base_addr = 0x0,

diff --git a/drivers/net/dsa/mv88e6xxx/chip.h b/drivers/net/dsa/mv88e6xxx/chip.h
index 0913eec..c230a6f 100644
--- a/drivers/net/dsa/mv88e6xxx/chip.h
+++ b/drivers/net/dsa/mv88e6xxx/chip.h

@@ -104,6 +104,7 @@
 	u16 prod_num;
 	const char *name;
 	unsigned int num_databases;
+	unsigned int num_macs;
 	unsigned int num_ports;
 	unsigned int max_vid;
 	unsigned int port_base_addr;
@@ -379,6 +380,11 @@
 	return chip->info->num_databases;
 }
 
+static inline unsigned int mv88e6xxx_num_macs(struct  mv88e6xxx_chip *chip)
+{
+	return chip->info->num_macs;
+}
+
 static inline unsigned int mv88e6xxx_num_ports(struct mv88e6xxx_chip *chip)
 {
 	return chip->info->num_ports;

diff --git a/drivers/net/ethernet/broadcom/b44.c b/drivers/net/ethernet/broadcom/b44.c
index fb49b0e..9f815a0 100644
--- a/drivers/net/ethernet/broadcom/b44.c
+++ b/drivers/net/ethernet/broadcom/b44.c

@@ -2035,12 +2035,14 @@
 		bp->flags |= B44_FLAG_TX_PAUSE;
 	else
 		bp->flags &= ~B44_FLAG_TX_PAUSE;
-	if (bp->flags & B44_FLAG_PAUSE_AUTO) {
-		b44_halt(bp);
-		b44_init_rings(bp);
-		b44_init_hw(bp, B44_FULL_RESET);
-	} else {
-		__b44_set_flow_ctrl(bp, bp->flags);
+	if (netif_running(dev)) {
+		if (bp->flags & B44_FLAG_PAUSE_AUTO) {
+			b44_halt(bp);
+			b44_init_rings(bp);
+			b44_init_hw(bp, B44_FULL_RESET);
+		} else {
+			__b44_set_flow_ctrl(bp, bp->flags);
+		}
 	}
 	spin_unlock_irq(&bp->lock);
 

diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.c b/drivers/net/ethernet/broadcom/genet/bcmgenet.c
index 445e892..da240c5 100644
--- a/drivers/net/ethernet/broadcom/genet/bcmgenet.c
+++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.c

@@ -2805,7 +2805,7 @@
 }
 
 /* Returns a reusable dma control register value */
-static u32 bcmgenet_dma_disable(struct bcmgenet_priv *priv)
+static u32 bcmgenet_dma_disable(struct bcmgenet_priv *priv, bool flush_rx)
 {
 	unsigned int i;
 	u32 reg;
@@ -2830,6 +2830,14 @@
 	udelay(10);
 	bcmgenet_umac_writel(priv, 0, UMAC_TX_FLUSH);
 
+	if (flush_rx) {
+		reg = bcmgenet_rbuf_ctrl_get(priv);
+		bcmgenet_rbuf_ctrl_set(priv, reg | BIT(0));
+		udelay(10);
+		bcmgenet_rbuf_ctrl_set(priv, reg);
+		udelay(10);
+	}
+
 	return dma_ctrl;
 }
 
@@ -2931,8 +2939,8 @@
 
 	bcmgenet_set_hw_addr(priv, dev->dev_addr);
 
-	/* Disable RX/TX DMA and flush TX queues */
-	dma_ctrl = bcmgenet_dma_disable(priv);
+	/* Disable RX/TX DMA and flush TX and RX queues */
+	dma_ctrl = bcmgenet_dma_disable(priv, true);
 
 	/* Reinitialize TDMA and RDMA and SW housekeeping */
 	ret = bcmgenet_init_dma(priv);
@@ -3729,7 +3737,7 @@
 		bcmgenet_power_up(priv, GENET_POWER_WOL_MAGIC);
 
 	/* Disable RX/TX DMA and flush TX queues */
-	dma_ctrl = bcmgenet_dma_disable(priv);
+	dma_ctrl = bcmgenet_dma_disable(priv, false);
 
 	/* Reinitialize TDMA and RDMA and SW housekeeping */
 	ret = bcmgenet_init_dma(priv);

diff --git a/drivers/net/ethernet/brocade/bna/bnad_debugfs.c b/drivers/net/ethernet/brocade/bna/bnad_debugfs.c
index cebfe3b..cb60b0f 100644
--- a/drivers/net/ethernet/brocade/bna/bnad_debugfs.c
+++ b/drivers/net/ethernet/brocade/bna/bnad_debugfs.c

@@ -320,7 +320,7 @@
 	void *kern_buf;
 
 	/* Copy the user space buf */
-	kern_buf = memdup_user(buf, nbytes);
+	kern_buf = memdup_user_nul(buf, nbytes);
 	if (IS_ERR(kern_buf))
 		return PTR_ERR(kern_buf);
 
@@ -380,7 +380,7 @@
 	void *kern_buf;
 
 	/* Copy the user space buf */
-	kern_buf = memdup_user(buf, nbytes);
+	kern_buf = memdup_user_nul(buf, nbytes);
 	if (IS_ERR(kern_buf))
 		return PTR_ERR(kern_buf);
 

diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
index f0bbc0f..fa882e9 100644
--- a/drivers/net/ethernet/cisco/enic/enic_main.c
+++ b/drivers/net/ethernet/cisco/enic/enic_main.c

@@ -1108,18 +1108,30 @@
 	pp->request = nla_get_u8(port[IFLA_PORT_REQUEST]);
 
 	if (port[IFLA_PORT_PROFILE]) {
+		if (nla_len(port[IFLA_PORT_PROFILE]) != PORT_PROFILE_MAX) {
+			memcpy(pp, &prev_pp, sizeof(*pp));
+			return -EINVAL;
+		}
 		pp->set |= ENIC_SET_NAME;
 		memcpy(pp->name, nla_data(port[IFLA_PORT_PROFILE]),
 			PORT_PROFILE_MAX);
 	}
 
 	if (port[IFLA_PORT_INSTANCE_UUID]) {
+		if (nla_len(port[IFLA_PORT_INSTANCE_UUID]) != PORT_UUID_MAX) {
+			memcpy(pp, &prev_pp, sizeof(*pp));
+			return -EINVAL;
+		}
 		pp->set |= ENIC_SET_INSTANCE;
 		memcpy(pp->instance_uuid,
 			nla_data(port[IFLA_PORT_INSTANCE_UUID]), PORT_UUID_MAX);
 	}
 
 	if (port[IFLA_PORT_HOST_UUID]) {
+		if (nla_len(port[IFLA_PORT_HOST_UUID]) != PORT_UUID_MAX) {
+			memcpy(pp, &prev_pp, sizeof(*pp));
+			return -EINVAL;
+		}
 		pp->set |= ENIC_SET_HOST;
 		memcpy(pp->host_uuid,
 			nla_data(port[IFLA_PORT_HOST_UUID]), PORT_UUID_MAX);

diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
index 4b16989..22cec34 100644
--- a/drivers/net/ethernet/freescale/fec_main.c
+++ b/drivers/net/ethernet/freescale/fec_main.c

@@ -3224,6 +3224,14 @@
 	return 0;
 }
 
+static void fec_enet_deinit(struct net_device *ndev)
+{
+	struct fec_enet_private *fep = netdev_priv(ndev);
+
+	netif_napi_del(&fep->napi);
+	fec_enet_free_queue(ndev);
+}
+
 #ifdef CONFIG_OF
 static int fec_reset_phy(struct platform_device *pdev)
 {
@@ -3536,6 +3544,7 @@
 	fec_enet_mii_remove(fep);
 failed_mii_init:
 failed_irq:
+	fec_enet_deinit(ndev);
 failed_init:
 	fec_ptp_stop(pdev);
 failed_reset:
@@ -3596,6 +3605,7 @@
 	pm_runtime_put_noidle(&pdev->dev);
 	pm_runtime_disable(&pdev->dev);
 
+	fec_enet_deinit(ndev);
 	free_netdev(ndev);
 	return 0;
 }

diff --git a/drivers/net/ethernet/freescale/fec_ptp.c b/drivers/net/ethernet/freescale/fec_ptp.c
index e22a69f..b42c688 100644
--- a/drivers/net/ethernet/freescale/fec_ptp.c
+++ b/drivers/net/ethernet/freescale/fec_ptp.c

@@ -111,7 +111,6 @@
 {
 	unsigned long flags;
 	u32 val, tempval;
-	int inc;
 	struct timespec64 ts;
 	u64 ns;
 	val = 0;
@@ -121,15 +120,13 @@
 		return -EINVAL;
 	}
 
-	if (fep->pps_enable == enable)
-		return 0;
-
-	fep->pps_channel = DEFAULT_PPS_CHANNEL;
-	fep->reload_period = PPS_OUPUT_RELOAD_PERIOD;
-	inc = fep->ptp_inc;
-
 	spin_lock_irqsave(&fep->tmreg_lock, flags);
 
+	if (fep->pps_enable == enable) {
+		spin_unlock_irqrestore(&fep->tmreg_lock, flags);
+		return 0;
+	}
+
 	if (enable) {
 		/* clear capture or output compare interrupt status if have.
 		 */
@@ -462,6 +459,9 @@
 	int ret = 0;
 
 	if (rq->type == PTP_CLK_REQ_PPS) {
+		fep->pps_channel = DEFAULT_PPS_CHANNEL;
+		fep->reload_period = PPS_OUPUT_RELOAD_PERIOD;
+
 		ret = fec_ptp_enable_pps(fep, on);
 
 		return ret;

diff --git a/drivers/net/ethernet/intel/i40e/i40e_main.c b/drivers/net/ethernet/intel/i40e/i40e_main.c
index 8a397449..751c931 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_main.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_main.c

@@ -12261,7 +12261,7 @@
 	 * since we need to be able to guarantee forward progress even under
 	 * memory pressure.
 	 */
-	i40e_wq = alloc_workqueue("%s", WQ_MEM_RECLAIM, 0, i40e_driver_name);
+	i40e_wq = alloc_workqueue("%s", 0, 0, i40e_driver_name);
 	if (!i40e_wq) {
 		pr_err("%s: Failed to create workqueue\n", i40e_driver_name);
 		return -ENOMEM;

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
index e03b1f4..707c87f 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c

@@ -3152,7 +3152,7 @@
 		stats->tx_dropped = sstats->tx_queue_dropped;
 	}
 
-	stats->rx_dropped = priv->stats.qcnt.rx_out_of_buffer;
+	stats->rx_missed_errors = priv->stats.qcnt.rx_out_of_buffer;
 
 	stats->rx_length_errors =
 		PPORT_802_3_GET(pstats, a_in_range_length_errors) +

diff --git a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
index 24f70c3..32f8b55 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/fs_core.c

@@ -1390,8 +1390,9 @@
 	list_add_tail(&fte->node.list, &fg->node.children);
 	trace_mlx5_fs_set_fte(fte, true);
 add_rules:
+	/* Link newly added rules into the tree. */
 	for (i = 0; i < handle->num_rules; i++) {
-		if (atomic_read(&handle->rule[i]->node.refcount) == 1) {
+		if (!handle->rule[i]->node.parent) {
 			tree_add_node(&handle->rule[i]->node, &fte->node);
 			trace_mlx5_fs_add_rule(handle->rule[i]);
 		}

diff --git a/drivers/net/ethernet/mellanox/mlxsw/core.c b/drivers/net/ethernet/mellanox/mlxsw/core.c
index 45cc30d..da52d6e 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/core.c
+++ b/drivers/net/ethernet/mellanox/mlxsw/core.c

@@ -593,7 +593,7 @@
 
 static const struct mlxsw_listener mlxsw_emad_rx_listener =
 	MLXSW_RXL(mlxsw_emad_rx_listener_func, ETHEMAD, TRAP_TO_CPU, false,
-		  EMAD, DISCARD);
+		  EMAD, FORWARD);
 
 static int mlxsw_emad_init(struct mlxsw_core *mlxsw_core)
 {

diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index b2aad1a..a152b29 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c

@@ -848,7 +848,7 @@
 	__be16 df;
 	int err;
 
-	if (!pskb_inet_may_pull(skb))
+	if (!skb_vlan_inet_prepare(skb))
 		return -EINVAL;
 
 	sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);
@@ -898,7 +898,7 @@
 	__be16 sport;
 	int err;
 
-	if (!pskb_inet_may_pull(skb))
+	if (!skb_vlan_inet_prepare(skb))
 		return -EINVAL;
 
 	sport = udp_flow_src_port(geneve->net, skb, 1, USHRT_MAX, true);

diff --git a/drivers/net/gtp.c b/drivers/net/gtp.c
index a222736..902da53 100644
--- a/drivers/net/gtp.c
+++ b/drivers/net/gtp.c

@@ -709,11 +709,12 @@
 static void gtp_dellink(struct net_device *dev, struct list_head *head)
 {
 	struct gtp_dev *gtp = netdev_priv(dev);
+	struct hlist_node *next;
 	struct pdp_ctx *pctx;
 	int i;
 
 	for (i = 0; i < gtp->hash_size; i++)
-		hlist_for_each_entry_rcu(pctx, &gtp->tid_hash[i], hlist_tid)
+		hlist_for_each_entry_safe(pctx, next, &gtp->tid_hash[i], hlist_tid)
 			pdp_context_delete(pctx);
 
 	gtp_encap_disable(gtp);

diff --git a/drivers/net/ipvlan/ipvlan_core.c b/drivers/net/ipvlan/ipvlan_core.c
index 6283cbc..ab9beca 100644
--- a/drivers/net/ipvlan/ipvlan_core.c
+++ b/drivers/net/ipvlan/ipvlan_core.c

@@ -369,7 +369,7 @@
 	return addr;
 }
 
-static int ipvlan_process_v4_outbound(struct sk_buff *skb)
+static noinline_for_stack int ipvlan_process_v4_outbound(struct sk_buff *skb)
 {
 	const struct iphdr *ip4h = ip_hdr(skb);
 	struct net_device *dev = skb->dev;
@@ -397,26 +397,23 @@
 
 	memset(IPCB(skb), 0, sizeof(*IPCB(skb)));
 
-	err = ip_local_out(net, skb->sk, skb);
+	err = ip_local_out(net, NULL, skb);
 	if (unlikely(net_xmit_eval(err)))
-		dev->stats.tx_errors++;
+		DEV_STATS_INC(dev, tx_errors);
 	else
 		ret = NET_XMIT_SUCCESS;
 	goto out;
 err:
-	dev->stats.tx_errors++;
+	DEV_STATS_INC(dev, tx_errors);
 	kfree_skb(skb);
 out:
 	return ret;
 }
 
-static int ipvlan_process_v6_outbound(struct sk_buff *skb)
+static noinline_for_stack int
+ipvlan_route_v6_outbound(struct net_device *dev, struct sk_buff *skb)
 {
 	const struct ipv6hdr *ip6h = ipv6_hdr(skb);
-	struct net_device *dev = skb->dev;
-	struct net *net = dev_net(dev);
-	struct dst_entry *dst;
-	int err, ret = NET_XMIT_DROP;
 	struct flowi6 fl6 = {
 		.flowi6_oif = dev->ifindex,
 		.daddr = ip6h->daddr,
@@ -426,27 +423,38 @@
 		.flowi6_mark = skb->mark,
 		.flowi6_proto = ip6h->nexthdr,
 	};
+	struct dst_entry *dst;
+	int err;
 
-	dst = ip6_route_output(net, NULL, &fl6);
-	if (dst->error) {
-		ret = dst->error;
+	dst = ip6_route_output(dev_net(dev), NULL, &fl6);
+	err = dst->error;
+	if (err) {
 		dst_release(dst);
-		goto err;
+		return err;
 	}
 	skb_dst_set(skb, dst);
+	return 0;
+}
+
+static int ipvlan_process_v6_outbound(struct sk_buff *skb)
+{
+	struct net_device *dev = skb->dev;
+	int err, ret = NET_XMIT_DROP;
+
+	err = ipvlan_route_v6_outbound(dev, skb);
+	if (unlikely(err)) {
+		DEV_STATS_INC(dev, tx_errors);
+		kfree_skb(skb);
+		return err;
+	}
 
 	memset(IP6CB(skb), 0, sizeof(*IP6CB(skb)));
 
-	err = ip6_local_out(net, skb->sk, skb);
+	err = ip6_local_out(dev_net(dev), NULL, skb);
 	if (unlikely(net_xmit_eval(err)))
-		dev->stats.tx_errors++;
+		DEV_STATS_INC(dev, tx_errors);
 	else
 		ret = NET_XMIT_SUCCESS;
-	goto out;
-err:
-	dev->stats.tx_errors++;
-	kfree_skb(skb);
-out:
 	return ret;
 }
 

diff --git a/drivers/net/ipvlan/ipvlan_main.c b/drivers/net/ipvlan/ipvlan_main.c
index 11b7006..70131c4 100644
--- a/drivers/net/ipvlan/ipvlan_main.c
+++ b/drivers/net/ipvlan/ipvlan_main.c

@@ -388,6 +388,7 @@
 		s->rx_dropped = rx_errs;
 		s->tx_dropped = tx_drps;
 	}
+	s->tx_errors = DEV_STATS_READ(dev, tx_errors);
 }
 
 static int ipvlan_vlan_rx_add_vid(struct net_device *dev, __be16 proto, u16 vid)

diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
index 577b7804..893f542 100644
--- a/drivers/net/macsec.c
+++ b/drivers/net/macsec.c

@@ -2945,8 +2945,8 @@
 		s->tx_bytes   += tmp.tx_bytes;
 	}
 
-	s->rx_dropped = dev->stats.rx_dropped;
-	s->tx_dropped = dev->stats.tx_dropped;
+	s->rx_dropped = DEV_STATS_READ(dev, rx_dropped);
+	s->tx_dropped = DEV_STATS_READ(dev, tx_dropped);
 }
 
 static int macsec_get_iflink(const struct net_device *dev)

diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index b2c5c62..afb2e3e 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c

@@ -1777,14 +1777,16 @@
 					    tun_is_little_endian(tun), true,
 					    vlan_hlen)) {
 			struct skb_shared_info *sinfo = skb_shinfo(skb);
-			pr_err("unexpected GSO type: "
-			       "0x%x, gso_size %d, hdr_len %d\n",
-			       sinfo->gso_type, tun16_to_cpu(tun, gso.gso_size),
-			       tun16_to_cpu(tun, gso.hdr_len));
-			print_hex_dump(KERN_ERR, "tun: ",
-				       DUMP_PREFIX_NONE,
-				       16, 1, skb->head,
-				       min((int)tun16_to_cpu(tun, gso.hdr_len), 64), true);
+
+			if (net_ratelimit()) {
+				netdev_err(tun->dev, "unexpected GSO type: 0x%x, gso_size %d, hdr_len %d\n",
+					   sinfo->gso_type, tun16_to_cpu(tun, gso.gso_size),
+					   tun16_to_cpu(tun, gso.hdr_len));
+				print_hex_dump(KERN_ERR, "tun: ",
+					       DUMP_PREFIX_NONE,
+					       16, 1, skb->head,
+					       min((int)tun16_to_cpu(tun, gso.hdr_len), 64), true);
+			}
 			WARN_ON_ONCE(1);
 			return -EINVAL;
 		}

diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
index 2de80ec..686ee0b 100644
--- a/drivers/net/usb/ax88179_178a.c
+++ b/drivers/net/usb/ax88179_178a.c

@@ -1465,21 +1465,16 @@
 			/* Skip IP alignment pseudo header */
 			skb_pull(skb, 2);
 
-			skb->truesize = SKB_TRUESIZE(pkt_len_plus_padd);
 			ax88179_rx_checksum(skb, pkt_hdr);
 			return 1;
 		}
 
-		ax_skb = skb_clone(skb, GFP_ATOMIC);
+		ax_skb = netdev_alloc_skb_ip_align(dev->net, pkt_len);
 		if (!ax_skb)
 			return 0;
-		skb_trim(ax_skb, pkt_len);
+		skb_put(ax_skb, pkt_len);
+		memcpy(ax_skb->data, skb->data + 2, pkt_len);
 
-		/* Skip IP alignment pseudo header */
-		skb_pull(ax_skb, 2);
-
-		skb->truesize = pkt_len_plus_padd +
-				SKB_DATA_ALIGN(sizeof(struct sk_buff));
 		ax88179_rx_checksum(ax_skb, pkt_hdr);
 		usbnet_skb_return(dev, ax_skb);
 

diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index c6a1129..ec09ef9 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c

@@ -1315,6 +1315,9 @@
 	{QMI_QUIRK_SET_DTR(0x1bc7, 0x1060, 2)},	/* Telit LN920 */
 	{QMI_QUIRK_SET_DTR(0x1bc7, 0x1070, 2)},	/* Telit FN990 */
 	{QMI_QUIRK_SET_DTR(0x1bc7, 0x1080, 2)}, /* Telit FE990 */
+	{QMI_QUIRK_SET_DTR(0x1bc7, 0x10a0, 0)}, /* Telit FN920C04 */
+	{QMI_QUIRK_SET_DTR(0x1bc7, 0x10a4, 0)}, /* Telit FN920C04 */
+	{QMI_QUIRK_SET_DTR(0x1bc7, 0x10a9, 0)}, /* Telit FN920C04 */
 	{QMI_FIXED_INTF(0x1bc7, 0x1100, 3)},	/* Telit ME910 */
 	{QMI_FIXED_INTF(0x1bc7, 0x1101, 3)},	/* Telit ME910 dual modem */
 	{QMI_FIXED_INTF(0x1bc7, 0x1200, 5)},	/* Telit LE920 */
@@ -1372,6 +1375,7 @@
 	{QMI_FIXED_INTF(0x0489, 0xe0b5, 0)},	/* Foxconn T77W968 LTE with eSIM support*/
 	{QMI_FIXED_INTF(0x2692, 0x9025, 4)},    /* Cellient MPL200 (rebranded Qualcomm 05c6:9025) */
 	{QMI_QUIRK_SET_DTR(0x1546, 0x1342, 4)},	/* u-blox LARA-L6 */
+	{QMI_QUIRK_SET_DTR(0x33f8, 0x0104, 4)}, /* Rolling RW101 RMNET */
 
 	/* 4. Gobi 1000 devices */
 	{QMI_GOBI1K_DEVICE(0x05c6, 0x9212)},	/* Acer Gobi Modem Device */

diff --git a/drivers/net/usb/smsc95xx.c b/drivers/net/usb/smsc95xx.c
index e70eac5..038a221 100644
--- a/drivers/net/usb/smsc95xx.c
+++ b/drivers/net/usb/smsc95xx.c

@@ -273,16 +273,18 @@
 	mutex_unlock(&dev->phy_mutex);
 }
 
-static int smsc95xx_mdio_read_nopm(struct net_device *netdev, int phy_id,
-				   int idx)
+static int smsc95xx_mdio_read_nopm(struct usbnet *dev, int idx)
 {
-	return __smsc95xx_mdio_read(netdev, phy_id, idx, 1);
+	struct mii_if_info *mii = &dev->mii;
+
+	return __smsc95xx_mdio_read(dev->net, mii->phy_id, idx, 1);
 }
 
-static void smsc95xx_mdio_write_nopm(struct net_device *netdev, int phy_id,
-				     int idx, int regval)
+static void smsc95xx_mdio_write_nopm(struct usbnet *dev, int idx, int regval)
 {
-	__smsc95xx_mdio_write(netdev, phy_id, idx, regval, 1);
+	struct mii_if_info *mii = &dev->mii;
+
+	__smsc95xx_mdio_write(dev->net, mii->phy_id, idx, regval, 1);
 }
 
 static int smsc95xx_mdio_read(struct net_device *netdev, int phy_id, int idx)
@@ -467,7 +469,7 @@
 static void smsc95xx_set_multicast(struct net_device *netdev)
 {
 	struct usbnet *dev = netdev_priv(netdev);
-	struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]);
+	struct smsc95xx_priv *pdata = dev->driver_priv;
 	unsigned long flags;
 	int ret;
 
@@ -562,7 +564,7 @@
 
 static int smsc95xx_link_reset(struct usbnet *dev)
 {
-	struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]);
+	struct smsc95xx_priv *pdata = dev->driver_priv;
 	struct mii_if_info *mii = &dev->mii;
 	struct ethtool_cmd ecmd = { .cmd = ETHTOOL_GSET };
 	unsigned long flags;
@@ -632,7 +634,7 @@
 
 static void set_carrier(struct usbnet *dev, bool link)
 {
-	struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]);
+	struct smsc95xx_priv *pdata = dev->driver_priv;
 
 	if (pdata->link_ok == link)
 		return;
@@ -761,7 +763,7 @@
 				     struct ethtool_wolinfo *wolinfo)
 {
 	struct usbnet *dev = netdev_priv(net);
-	struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]);
+	struct smsc95xx_priv *pdata = dev->driver_priv;
 
 	wolinfo->supported = SUPPORTED_WAKE;
 	wolinfo->wolopts = pdata->wolopts;
@@ -771,7 +773,7 @@
 				    struct ethtool_wolinfo *wolinfo)
 {
 	struct usbnet *dev = netdev_priv(net);
-	struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]);
+	struct smsc95xx_priv *pdata = dev->driver_priv;
 	int ret;
 
 	if (wolinfo->wolopts & ~SUPPORTED_WAKE)
@@ -810,7 +812,7 @@
 static void set_mdix_status(struct net_device *net, __u8 mdix_ctrl)
 {
 	struct usbnet *dev = netdev_priv(net);
-	struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]);
+	struct smsc95xx_priv *pdata = dev->driver_priv;
 	int buf;
 
 	if ((pdata->chip_id == ID_REV_CHIP_ID_9500A_) ||
@@ -859,7 +861,7 @@
 				       struct ethtool_link_ksettings *cmd)
 {
 	struct usbnet *dev = netdev_priv(net);
-	struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]);
+	struct smsc95xx_priv *pdata = dev->driver_priv;
 	int retval;
 
 	retval = usbnet_get_link_ksettings(net, cmd);
@@ -874,7 +876,7 @@
 				       const struct ethtool_link_ksettings *cmd)
 {
 	struct usbnet *dev = netdev_priv(net);
-	struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]);
+	struct smsc95xx_priv *pdata = dev->driver_priv;
 	int retval;
 
 	if (pdata->mdix_ctrl != cmd->base.eth_tp_mdix_ctrl)
@@ -956,7 +958,7 @@
 /* starts the TX path */
 static int smsc95xx_start_tx_path(struct usbnet *dev)
 {
-	struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]);
+	struct smsc95xx_priv *pdata = dev->driver_priv;
 	unsigned long flags;
 	int ret;
 
@@ -976,7 +978,7 @@
 /* Starts the Receive path */
 static int smsc95xx_start_rx_path(struct usbnet *dev, int in_pm)
 {
-	struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]);
+	struct smsc95xx_priv *pdata = dev->driver_priv;
 	unsigned long flags;
 
 	spin_lock_irqsave(&pdata->mac_cr_lock, flags);
@@ -1033,8 +1035,8 @@
 
 static int smsc95xx_reset(struct usbnet *dev)
 {
-	struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]);
-	u32 read_buf, write_buf, burst_cap;
+	struct smsc95xx_priv *pdata = dev->driver_priv;
+	u32 read_buf, burst_cap;
 	int ret = 0, timeout;
 
 	netif_dbg(dev, ifup, dev->net, "entering smsc95xx_reset\n");
@@ -1176,10 +1178,13 @@
 		return ret;
 	netif_dbg(dev, ifup, dev->net, "ID_REV = 0x%08x\n", read_buf);
 
+	ret = smsc95xx_read_reg(dev, LED_GPIO_CFG, &read_buf);
+	if (ret < 0)
+		return ret;
 	/* Configure GPIO pins as LED outputs */
-	write_buf = LED_GPIO_CFG_SPD_LED | LED_GPIO_CFG_LNK_LED |
-		LED_GPIO_CFG_FDX_LED;
-	ret = smsc95xx_write_reg(dev, LED_GPIO_CFG, write_buf);
+	read_buf |= LED_GPIO_CFG_SPD_LED | LED_GPIO_CFG_LNK_LED |
+		    LED_GPIO_CFG_FDX_LED;
+	ret = smsc95xx_write_reg(dev, LED_GPIO_CFG, read_buf);
 	if (ret < 0)
 		return ret;
 
@@ -1261,7 +1266,7 @@
 
 static int smsc95xx_bind(struct usbnet *dev, struct usb_interface *intf)
 {
-	struct smsc95xx_priv *pdata = NULL;
+	struct smsc95xx_priv *pdata;
 	u32 val;
 	int ret;
 
@@ -1273,13 +1278,12 @@
 		return ret;
 	}
 
-	dev->data[0] = (unsigned long)kzalloc(sizeof(struct smsc95xx_priv),
-					      GFP_KERNEL);
-
-	pdata = (struct smsc95xx_priv *)(dev->data[0]);
+	pdata = kzalloc(sizeof(*pdata), GFP_KERNEL);
 	if (!pdata)
 		return -ENOMEM;
 
+	dev->driver_priv = pdata;
+
 	spin_lock_init(&pdata->mac_cr_lock);
 
 	/* LAN95xx devices do not alter the computed checksum of 0 to 0xffff.
@@ -1342,15 +1346,11 @@
 
 static void smsc95xx_unbind(struct usbnet *dev, struct usb_interface *intf)
 {
-	struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]);
+	struct smsc95xx_priv *pdata = dev->driver_priv;
 
-	if (pdata) {
-		cancel_delayed_work_sync(&pdata->carrier_check);
-		netif_dbg(dev, ifdown, dev->net, "free pdata\n");
-		kfree(pdata);
-		pdata = NULL;
-		dev->data[0] = 0;
-	}
+	cancel_delayed_work_sync(&pdata->carrier_check);
+	netif_dbg(dev, ifdown, dev->net, "free pdata\n");
+	kfree(pdata);
 }
 
 static u32 smsc_crc(const u8 *buffer, size_t len, int filter)
@@ -1361,39 +1361,37 @@
 
 static int smsc95xx_enable_phy_wakeup_interrupts(struct usbnet *dev, u16 mask)
 {
-	struct mii_if_info *mii = &dev->mii;
 	int ret;
 
 	netdev_dbg(dev->net, "enabling PHY wakeup interrupts\n");
 
 	/* read to clear */
-	ret = smsc95xx_mdio_read_nopm(dev->net, mii->phy_id, PHY_INT_SRC);
+	ret = smsc95xx_mdio_read_nopm(dev, PHY_INT_SRC);
 	if (ret < 0)
 		return ret;
 
 	/* enable interrupt source */
-	ret = smsc95xx_mdio_read_nopm(dev->net, mii->phy_id, PHY_INT_MASK);
+	ret = smsc95xx_mdio_read_nopm(dev, PHY_INT_MASK);
 	if (ret < 0)
 		return ret;
 
 	ret |= mask;
 
-	smsc95xx_mdio_write_nopm(dev->net, mii->phy_id, PHY_INT_MASK, ret);
+	smsc95xx_mdio_write_nopm(dev, PHY_INT_MASK, ret);
 
 	return 0;
 }
 
 static int smsc95xx_link_ok_nopm(struct usbnet *dev)
 {
-	struct mii_if_info *mii = &dev->mii;
 	int ret;
 
 	/* first, a dummy read, needed to latch some MII phys */
-	ret = smsc95xx_mdio_read_nopm(dev->net, mii->phy_id, MII_BMSR);
+	ret = smsc95xx_mdio_read_nopm(dev, MII_BMSR);
 	if (ret < 0)
 		return ret;
 
-	ret = smsc95xx_mdio_read_nopm(dev->net, mii->phy_id, MII_BMSR);
+	ret = smsc95xx_mdio_read_nopm(dev, MII_BMSR);
 	if (ret < 0)
 		return ret;
 
@@ -1402,7 +1400,7 @@
 
 static int smsc95xx_enter_suspend0(struct usbnet *dev)
 {
-	struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]);
+	struct smsc95xx_priv *pdata = dev->driver_priv;
 	u32 val;
 	int ret;
 
@@ -1441,8 +1439,7 @@
 
 static int smsc95xx_enter_suspend1(struct usbnet *dev)
 {
-	struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]);
-	struct mii_if_info *mii = &dev->mii;
+	struct smsc95xx_priv *pdata = dev->driver_priv;
 	u32 val;
 	int ret;
 
@@ -1450,17 +1447,17 @@
 	 * compatibility with non-standard link partners
 	 */
 	if (pdata->features & FEATURE_PHY_NLP_CROSSOVER)
-		smsc95xx_mdio_write_nopm(dev->net, mii->phy_id,	PHY_EDPD_CONFIG,
-			PHY_EDPD_CONFIG_DEFAULT);
+		smsc95xx_mdio_write_nopm(dev, PHY_EDPD_CONFIG,
+					 PHY_EDPD_CONFIG_DEFAULT);
 
 	/* enable energy detect power-down mode */
-	ret = smsc95xx_mdio_read_nopm(dev->net, mii->phy_id, PHY_MODE_CTRL_STS);
+	ret = smsc95xx_mdio_read_nopm(dev, PHY_MODE_CTRL_STS);
 	if (ret < 0)
 		return ret;
 
 	ret |= MODE_CTRL_STS_EDPWRDOWN_;
 
-	smsc95xx_mdio_write_nopm(dev->net, mii->phy_id, PHY_MODE_CTRL_STS, ret);
+	smsc95xx_mdio_write_nopm(dev, PHY_MODE_CTRL_STS, ret);
 
 	/* enter SUSPEND1 mode */
 	ret = smsc95xx_read_reg_nopm(dev, PM_CTRL, &val);
@@ -1489,7 +1486,7 @@
 
 static int smsc95xx_enter_suspend2(struct usbnet *dev)
 {
-	struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]);
+	struct smsc95xx_priv *pdata = dev->driver_priv;
 	u32 val;
 	int ret;
 
@@ -1511,7 +1508,7 @@
 
 static int smsc95xx_enter_suspend3(struct usbnet *dev)
 {
-	struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]);
+	struct smsc95xx_priv *pdata = dev->driver_priv;
 	u32 val;
 	int ret;
 
@@ -1550,7 +1547,7 @@
 
 static int smsc95xx_autosuspend(struct usbnet *dev, u32 link_up)
 {
-	struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]);
+	struct smsc95xx_priv *pdata = dev->driver_priv;
 	int ret;
 
 	if (!netif_running(dev->net)) {
@@ -1598,7 +1595,7 @@
 static int smsc95xx_suspend(struct usb_interface *intf, pm_message_t message)
 {
 	struct usbnet *dev = usb_get_intfdata(intf);
-	struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]);
+	struct smsc95xx_priv *pdata = dev->driver_priv;
 	u32 val, link_up;
 	int ret;
 
@@ -1869,7 +1866,7 @@
 	u32 val;
 
 	BUG_ON(!dev);
-	pdata = (struct smsc95xx_priv *)(dev->data[0]);
+	pdata = dev->driver_priv;
 	suspend_flags = pdata->suspend_flags;
 
 	netdev_dbg(dev->net, "resume suspend_flags=0x%02x\n", suspend_flags);
@@ -1924,9 +1921,11 @@
 
 static void smsc95xx_rx_csum_offload(struct sk_buff *skb)
 {
-	skb->csum = *(u16 *)(skb_tail_pointer(skb) - 2);
+	u16 *csum_ptr = (u16 *)(skb_tail_pointer(skb) - 2);
+
+	skb->csum = (__force __wsum)get_unaligned(csum_ptr);
 	skb->ip_summed = CHECKSUM_COMPLETE;
-	skb_trim(skb, skb->len - 2);
+	skb_trim(skb, skb->len - 2); /* remove csum */
 }
 
 static int smsc95xx_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
@@ -1985,25 +1984,22 @@
 				if (dev->net->features & NETIF_F_RXCSUM)
 					smsc95xx_rx_csum_offload(skb);
 				skb_trim(skb, skb->len - 4); /* remove fcs */
-				skb->truesize = size + sizeof(struct sk_buff);
 
 				return 1;
 			}
 
-			ax_skb = skb_clone(skb, GFP_ATOMIC);
+			ax_skb = netdev_alloc_skb_ip_align(dev->net, size);
 			if (unlikely(!ax_skb)) {
 				netdev_warn(dev->net, "Error allocating skb\n");
 				return 0;
 			}
 
-			ax_skb->len = size;
-			ax_skb->data = packet;
-			skb_set_tail_pointer(ax_skb, size);
+			skb_put(ax_skb, size);
+			memcpy(ax_skb->data, packet, size);
 
 			if (dev->net->features & NETIF_F_RXCSUM)
 				smsc95xx_rx_csum_offload(ax_skb);
 			skb_trim(ax_skb, ax_skb->len - 4); /* remove fcs */
-			ax_skb->truesize = size + sizeof(struct sk_buff);
 
 			usbnet_skb_return(dev, ax_skb);
 		}
@@ -2081,7 +2077,7 @@
 
 static int smsc95xx_manage_power(struct usbnet *dev, int on)
 {
-	struct smsc95xx_priv *pdata = (struct smsc95xx_priv *)(dev->data[0]);
+	struct smsc95xx_priv *pdata = dev->driver_priv;
 
 	dev->intf->needs_remote_wakeup = on;
 

diff --git a/drivers/net/usb/sr9700.c b/drivers/net/usb/sr9700.c
index dbdb027..4a72369 100644
--- a/drivers/net/usb/sr9700.c
+++ b/drivers/net/usb/sr9700.c

@@ -418,19 +418,15 @@
 			skb_pull(skb, 3);
 			skb->len = len;
 			skb_set_tail_pointer(skb, len);
-			skb->truesize = len + sizeof(struct sk_buff);
 			return 2;
 		}
 
-		/* skb_clone is used for address align */
-		sr_skb = skb_clone(skb, GFP_ATOMIC);
+		sr_skb = netdev_alloc_skb_ip_align(dev->net, len);
 		if (!sr_skb)
 			return 0;
 
-		sr_skb->len = len;
-		sr_skb->data = skb->data + 3;
-		skb_set_tail_pointer(sr_skb, len);
-		sr_skb->truesize = len + sizeof(struct sk_buff);
+		skb_put(sr_skb, len);
+		memcpy(sr_skb->data, skb->data + 3, len);
 		usbnet_skb_return(dev, sr_skb);
 
 		skb_pull(skb, len + SR_RX_OVERHEAD);

diff --git a/drivers/net/wireless/ath/ar5523/ar5523.c b/drivers/net/wireless/ath/ar5523/ar5523.c
index 74f23e4..0c1a7f6 100644
--- a/drivers/net/wireless/ath/ar5523/ar5523.c
+++ b/drivers/net/wireless/ath/ar5523/ar5523.c

@@ -1590,6 +1590,20 @@
 	struct ar5523 *ar;
 	int error = -ENOMEM;
 
+	static const u8 bulk_ep_addr[] = {
+		AR5523_CMD_TX_PIPE | USB_DIR_OUT,
+		AR5523_DATA_TX_PIPE | USB_DIR_OUT,
+		AR5523_CMD_RX_PIPE | USB_DIR_IN,
+		AR5523_DATA_RX_PIPE | USB_DIR_IN,
+		0};
+
+	if (!usb_check_bulk_endpoints(intf, bulk_ep_addr)) {
+		dev_err(&dev->dev,
+			"Could not find all expected endpoints\n");
+		error = -ENODEV;
+		goto out;
+	}
+
 	/*
 	 * Load firmware if the device requires it.  This will return
 	 * -ENXIO on success and we'll get called back afer the usb

diff --git a/drivers/net/wireless/ath/ath10k/debugfs_sta.c b/drivers/net/wireless/ath/ath10k/debugfs_sta.c
index d59ac6b..948c526 100644
--- a/drivers/net/wireless/ath/ath10k/debugfs_sta.c
+++ b/drivers/net/wireless/ath/ath10k/debugfs_sta.c

@@ -358,7 +358,7 @@
 	}
 out:
 	mutex_unlock(&ar->conf_mutex);
-	return count;
+	return ret ?: count;
 }
 
 static const struct file_operations fops_peer_debug_trigger = {

diff --git a/drivers/net/wireless/ath/ath10k/wmi.c b/drivers/net/wireless/ath/ath10k/wmi.c
index 25f51ca..a805dcb 100644
--- a/drivers/net/wireless/ath/ath10k/wmi.c
+++ b/drivers/net/wireless/ath/ath10k/wmi.c

@@ -1680,12 +1680,32 @@
 
 int ath10k_wmi_wait_for_service_ready(struct ath10k *ar)
 {
-	unsigned long time_left;
+	unsigned long time_left, i;
 
 	time_left = wait_for_completion_timeout(&ar->wmi.service_ready,
 						WMI_SERVICE_READY_TIMEOUT_HZ);
-	if (!time_left)
-		return -ETIMEDOUT;
+	if (!time_left) {
+		/* Sometimes the PCI HIF doesn't receive interrupt
+		 * for the service ready message even if the buffer
+		 * was completed. PCIe sniffer shows that it's
+		 * because the corresponding CE ring doesn't fires
+		 * it. Workaround here by polling CE rings once.
+		 */
+		ath10k_warn(ar, "failed to receive service ready completion, polling..\n");
+
+		for (i = 0; i < CE_COUNT; i++)
+			ath10k_hif_send_complete_check(ar, i, 1);
+
+		time_left = wait_for_completion_timeout(&ar->wmi.service_ready,
+							WMI_SERVICE_READY_TIMEOUT_HZ);
+		if (!time_left) {
+			ath10k_warn(ar, "polling timed out\n");
+			return -ETIMEDOUT;
+		}
+
+		ath10k_warn(ar, "service ready completion received, continuing normally\n");
+	}
+
 	return 0;
 }
 

diff --git a/drivers/net/wireless/ath/carl9170/usb.c b/drivers/net/wireless/ath/carl9170/usb.c
index 99f1897..738f43b 100644
--- a/drivers/net/wireless/ath/carl9170/usb.c
+++ b/drivers/net/wireless/ath/carl9170/usb.c

@@ -1069,6 +1069,38 @@
 			ar->usb_ep_cmd_is_bulk = true;
 	}
 
+	/* Verify that all expected endpoints are present */
+	if (ar->usb_ep_cmd_is_bulk) {
+		u8 bulk_ep_addr[] = {
+			AR9170_USB_EP_RX | USB_DIR_IN,
+			AR9170_USB_EP_TX | USB_DIR_OUT,
+			AR9170_USB_EP_CMD | USB_DIR_OUT,
+			0};
+		u8 int_ep_addr[] = {
+			AR9170_USB_EP_IRQ | USB_DIR_IN,
+			0};
+		if (!usb_check_bulk_endpoints(intf, bulk_ep_addr) ||
+		    !usb_check_int_endpoints(intf, int_ep_addr))
+			err = -ENODEV;
+	} else {
+		u8 bulk_ep_addr[] = {
+			AR9170_USB_EP_RX | USB_DIR_IN,
+			AR9170_USB_EP_TX | USB_DIR_OUT,
+			0};
+		u8 int_ep_addr[] = {
+			AR9170_USB_EP_IRQ | USB_DIR_IN,
+			AR9170_USB_EP_CMD | USB_DIR_OUT,
+			0};
+		if (!usb_check_bulk_endpoints(intf, bulk_ep_addr) ||
+		    !usb_check_int_endpoints(intf, int_ep_addr))
+			err = -ENODEV;
+	}
+
+	if (err) {
+		carl9170_free(ar);
+		return err;
+	}
+
 	usb_set_intfdata(intf, ar);
 	SET_IEEE80211_DEV(ar->hw, &intf->dev);
 

diff --git a/drivers/net/wireless/marvell/mwl8k.c b/drivers/net/wireless/marvell/mwl8k.c
index d5f7660..95454ec 100644
--- a/drivers/net/wireless/marvell/mwl8k.c
+++ b/drivers/net/wireless/marvell/mwl8k.c

@@ -2706,7 +2706,7 @@
 		cmd->action |= cpu_to_le16(MWL8K_ENABLE_RX_MULTICAST);
 		cmd->numaddr = cpu_to_le16(mc_count);
 		netdev_hw_addr_list_for_each(ha, mc_list) {
-			memcpy(cmd->addr[i], ha->addr, ETH_ALEN);
+			memcpy(cmd->addr[i++], ha->addr, ETH_ALEN);
 		}
 	}
 

diff --git a/drivers/nfc/trf7970a.c b/drivers/nfc/trf7970a.c
index eee5cc1..5ad5baf 100644
--- a/drivers/nfc/trf7970a.c
+++ b/drivers/nfc/trf7970a.c

@@ -427,7 +427,8 @@
 	enum trf7970a_state		state;
 	struct device			*dev;
 	struct spi_device		*spi;
-	struct regulator		*regulator;
+	struct regulator		*vin_regulator;
+	struct regulator		*vddio_regulator;
 	struct nfc_digital_dev		*ddev;
 	u32				quirks;
 	bool				is_initiator;
@@ -1886,7 +1887,7 @@
 	if (trf->state != TRF7970A_ST_PWR_OFF)
 		return 0;
 
-	ret = regulator_enable(trf->regulator);
+	ret = regulator_enable(trf->vin_regulator);
 	if (ret) {
 		dev_err(trf->dev, "%s - Can't enable VIN: %d\n", __func__, ret);
 		return ret;
@@ -1929,7 +1930,7 @@
 	if (trf->en2_gpiod && !(trf->quirks & TRF7970A_QUIRK_EN2_MUST_STAY_LOW))
 		gpiod_set_value_cansleep(trf->en2_gpiod, 0);
 
-	ret = regulator_disable(trf->regulator);
+	ret = regulator_disable(trf->vin_regulator);
 	if (ret)
 		dev_err(trf->dev, "%s - Can't disable VIN: %d\n", __func__,
 			ret);
@@ -2068,37 +2069,37 @@
 	mutex_init(&trf->lock);
 	INIT_DELAYED_WORK(&trf->timeout_work, trf7970a_timeout_work_handler);
 
-	trf->regulator = devm_regulator_get(&spi->dev, "vin");
-	if (IS_ERR(trf->regulator)) {
-		ret = PTR_ERR(trf->regulator);
+	trf->vin_regulator = devm_regulator_get(&spi->dev, "vin");
+	if (IS_ERR(trf->vin_regulator)) {
+		ret = PTR_ERR(trf->vin_regulator);
 		dev_err(trf->dev, "Can't get VIN regulator: %d\n", ret);
 		goto err_destroy_lock;
 	}
 
-	ret = regulator_enable(trf->regulator);
+	ret = regulator_enable(trf->vin_regulator);
 	if (ret) {
 		dev_err(trf->dev, "Can't enable VIN: %d\n", ret);
 		goto err_destroy_lock;
 	}
 
-	uvolts = regulator_get_voltage(trf->regulator);
+	uvolts = regulator_get_voltage(trf->vin_regulator);
 	if (uvolts > 4000000)
 		trf->chip_status_ctrl = TRF7970A_CHIP_STATUS_VRS5_3;
 
-	trf->regulator = devm_regulator_get(&spi->dev, "vdd-io");
-	if (IS_ERR(trf->regulator)) {
-		ret = PTR_ERR(trf->regulator);
+	trf->vddio_regulator = devm_regulator_get(&spi->dev, "vdd-io");
+	if (IS_ERR(trf->vddio_regulator)) {
+		ret = PTR_ERR(trf->vddio_regulator);
 		dev_err(trf->dev, "Can't get VDD_IO regulator: %d\n", ret);
-		goto err_destroy_lock;
+		goto err_disable_vin_regulator;
 	}
 
-	ret = regulator_enable(trf->regulator);
+	ret = regulator_enable(trf->vddio_regulator);
 	if (ret) {
 		dev_err(trf->dev, "Can't enable VDD_IO: %d\n", ret);
-		goto err_destroy_lock;
+		goto err_disable_vin_regulator;
 	}
 
-	if (regulator_get_voltage(trf->regulator) == 1800000) {
+	if (regulator_get_voltage(trf->vddio_regulator) == 1800000) {
 		trf->io_ctrl = TRF7970A_REG_IO_CTRL_IO_LOW;
 		dev_dbg(trf->dev, "trf7970a config vdd_io to 1.8V\n");
 	}
@@ -2111,7 +2112,7 @@
 	if (!trf->ddev) {
 		dev_err(trf->dev, "Can't allocate NFC digital device\n");
 		ret = -ENOMEM;
-		goto err_disable_regulator;
+		goto err_disable_vddio_regulator;
 	}
 
 	nfc_digital_set_parent_dev(trf->ddev, trf->dev);
@@ -2140,8 +2141,10 @@
 	trf7970a_shutdown(trf);
 err_free_ddev:
 	nfc_digital_free_device(trf->ddev);
-err_disable_regulator:
-	regulator_disable(trf->regulator);
+err_disable_vddio_regulator:
+	regulator_disable(trf->vddio_regulator);
+err_disable_vin_regulator:
+	regulator_disable(trf->vin_regulator);
 err_destroy_lock:
 	mutex_destroy(&trf->lock);
 	return ret;
@@ -2160,7 +2163,8 @@
 	nfc_digital_unregister_device(trf->ddev);
 	nfc_digital_free_device(trf->ddev);
 
-	regulator_disable(trf->regulator);
+	regulator_disable(trf->vddio_regulator);
+	regulator_disable(trf->vin_regulator);
 
 	mutex_destroy(&trf->lock);
 

diff --git a/drivers/nvme/target/configfs.c b/drivers/nvme/target/configfs.c
index b6aeb1d..3635a38 100644
--- a/drivers/nvme/target/configfs.c
+++ b/drivers/nvme/target/configfs.c

@@ -396,10 +396,18 @@
 	if (strtobool(page, &enable))
 		return -EINVAL;
 
+	/*
+	 * take a global nvmet_config_sem because the disable routine has a
+	 * window where it releases the subsys-lock, giving a chance to
+	 * a parallel enable to concurrently execute causing the disable to
+	 * have a misaccounting of the ns percpu_ref.
+	 */
+	down_write(&nvmet_config_sem);
 	if (enable)
 		ret = nvmet_ns_enable(ns);
 	else
 		nvmet_ns_disable(ns);
+	up_write(&nvmet_config_sem);
 
 	return ret ? ret : count;
 }

diff --git a/drivers/pinctrl/core.c b/drivers/pinctrl/core.c
index 7069f5d..ee2666d 100644
--- a/drivers/pinctrl/core.c
+++ b/drivers/pinctrl/core.c

@@ -2059,13 +2059,7 @@
 
 	error = pinctrl_claim_hogs(pctldev);
 	if (error) {
-		dev_err(pctldev->dev, "could not claim hogs: %i\n",
-			error);
-		pinctrl_free_pindescs(pctldev, pctldev->desc->pins,
-				      pctldev->desc->npins);
-		mutex_destroy(&pctldev->mutex);
-		kfree(pctldev);
-
+		dev_err(pctldev->dev, "could not claim hogs: %i\n", error);
 		return error;
 	}
 

diff --git a/drivers/pinctrl/devicetree.c b/drivers/pinctrl/devicetree.c
index b9a1080..6cbc92e 100644
--- a/drivers/pinctrl/devicetree.c
+++ b/drivers/pinctrl/devicetree.c

@@ -228,14 +228,16 @@
 	for (state = 0; ; state++) {
 		/* Retrieve the pinctrl-* property */
 		propname = kasprintf(GFP_KERNEL, "pinctrl-%d", state);
-		if (!propname)
-			return -ENOMEM;
+		if (!propname) {
+			ret = -ENOMEM;
+			goto err;
+		}
 		prop = of_find_property(np, propname, &size);
 		kfree(propname);
 		if (!prop) {
 			if (state == 0) {
-				of_node_put(np);
-				return -ENODEV;
+				ret = -ENODEV;
+				goto err;
 			}
 			break;
 		}

diff --git a/drivers/power/supply/rt9455_charger.c b/drivers/power/supply/rt9455_charger.c
index cfdbde9..70722c0 100644
--- a/drivers/power/supply/rt9455_charger.c
+++ b/drivers/power/supply/rt9455_charger.c

@@ -202,6 +202,7 @@
 	4450000, 4450000, 4450000, 4450000, 4450000, 4450000, 4450000, 4450000
 };
 
+#if IS_ENABLED(CONFIG_USB_PHY)
 /*
  * When the charger is in boost mode, REG02[7:2] represent boost output
  * voltage.
@@ -217,6 +218,7 @@
 	5600000, 5600000, 5600000, 5600000, 5600000, 5600000, 5600000, 5600000,
 	5600000, 5600000, 5600000, 5600000, 5600000, 5600000, 5600000, 5600000,
 };
+#endif
 
 /* REG07[3:0] (VMREG) in uV */
 static const int rt9455_vmreg_values[] = {

diff --git a/drivers/scsi/bfa/bfad_debugfs.c b/drivers/scsi/bfa/bfad_debugfs.c
index 05f5239..89b8aa9 100644
--- a/drivers/scsi/bfa/bfad_debugfs.c
+++ b/drivers/scsi/bfa/bfad_debugfs.c

@@ -262,7 +262,7 @@
 	unsigned long flags;
 	void *kern_buf;
 
-	kern_buf = memdup_user(buf, nbytes);
+	kern_buf = memdup_user_nul(buf, nbytes);
 	if (IS_ERR(kern_buf))
 		return PTR_ERR(kern_buf);
 
@@ -329,7 +329,7 @@
 	unsigned long flags;
 	void *kern_buf;
 
-	kern_buf = memdup_user(buf, nbytes);
+	kern_buf = memdup_user_nul(buf, nbytes);
 	if (IS_ERR(kern_buf))
 		return PTR_ERR(kern_buf);
 

diff --git a/drivers/scsi/bnx2fc/bnx2fc_tgt.c b/drivers/scsi/bnx2fc/bnx2fc_tgt.c
index 59a2dfb..09cf9e7 100644
--- a/drivers/scsi/bnx2fc/bnx2fc_tgt.c
+++ b/drivers/scsi/bnx2fc/bnx2fc_tgt.c

@@ -841,7 +841,6 @@
 
 	BNX2FC_TGT_DBG(tgt, "Freeing up session resources\n");
 
-	spin_lock_bh(&tgt->cq_lock);
 	ctx_base_ptr = tgt->ctx_base;
 	tgt->ctx_base = NULL;
 
@@ -897,7 +896,6 @@
 				    tgt->sq, tgt->sq_dma);
 		tgt->sq = NULL;
 	}
-	spin_unlock_bh(&tgt->cq_lock);
 
 	if (ctx_base_ptr)
 		iounmap(ctx_base_ptr);

diff --git a/drivers/scsi/hpsa.c b/drivers/scsi/hpsa.c
index 34434b7..f903d21 100644
--- a/drivers/scsi/hpsa.c
+++ b/drivers/scsi/hpsa.c

@@ -5627,7 +5627,7 @@
 {
 	struct Scsi_Host *sh;
 
-	sh = scsi_host_alloc(&hpsa_driver_template, sizeof(struct ctlr_info));
+	sh = scsi_host_alloc(&hpsa_driver_template, sizeof(struct ctlr_info *));
 	if (sh == NULL) {
 		dev_err(&h->pdev->dev, "scsi_host_alloc failed\n");
 		return -ENOMEM;

diff --git a/drivers/scsi/libsas/sas_expander.c b/drivers/scsi/libsas/sas_expander.c
index f77d72f..f846790 100644
--- a/drivers/scsi/libsas/sas_expander.c
+++ b/drivers/scsi/libsas/sas_expander.c

@@ -269,8 +269,7 @@
 	/* help some expanders that fail to zero sas_address in the 'no
 	 * device' case
 	 */
-	if (phy->attached_dev_type == SAS_PHY_UNUSED ||
-	    phy->linkrate < SAS_LINK_RATE_1_5_GBPS)
+	if (phy->attached_dev_type == SAS_PHY_UNUSED)
 		memset(phy->attached_sas_addr, 0, SAS_ADDR_SIZE);
 	else
 		memcpy(phy->attached_sas_addr, dr->attached_sas_addr, SAS_ADDR_SIZE);

diff --git a/drivers/scsi/lpfc/lpfc.h b/drivers/scsi/lpfc/lpfc.h
index 97a2f6c..4c10064 100644
--- a/drivers/scsi/lpfc/lpfc.h
+++ b/drivers/scsi/lpfc/lpfc.h

@@ -992,7 +992,6 @@
 	unsigned long bit_flags;
 #define	FABRIC_COMANDS_BLOCKED	0
 	atomic_t num_rsrc_err;
-	atomic_t num_cmd_success;
 	unsigned long last_rsrc_error_time;
 	unsigned long last_ramp_down_time;
 #ifdef CONFIG_SCSI_LPFC_DEBUG_FS

diff --git a/drivers/scsi/lpfc/lpfc_scsi.c b/drivers/scsi/lpfc/lpfc_scsi.c
index 2eba0c3..a8885f9 100644
--- a/drivers/scsi/lpfc/lpfc_scsi.c
+++ b/drivers/scsi/lpfc/lpfc_scsi.c

@@ -303,11 +303,10 @@
 	struct Scsi_Host  *shost;
 	struct scsi_device *sdev;
 	unsigned long new_queue_depth;
-	unsigned long num_rsrc_err, num_cmd_success;
+	unsigned long num_rsrc_err;
 	int i;
 
 	num_rsrc_err = atomic_read(&phba->num_rsrc_err);
-	num_cmd_success = atomic_read(&phba->num_cmd_success);
 
 	/*
 	 * The error and success command counters are global per
@@ -322,20 +321,16 @@
 		for (i = 0; i <= phba->max_vports && vports[i] != NULL; i++) {
 			shost = lpfc_shost_from_vport(vports[i]);
 			shost_for_each_device(sdev, shost) {
-				new_queue_depth =
-					sdev->queue_depth * num_rsrc_err /
-					(num_rsrc_err + num_cmd_success);
-				if (!new_queue_depth)
-					new_queue_depth = sdev->queue_depth - 1;
+				if (num_rsrc_err >= sdev->queue_depth)
+					new_queue_depth = 1;
 				else
 					new_queue_depth = sdev->queue_depth -
-								new_queue_depth;
+						num_rsrc_err;
 				scsi_change_queue_depth(sdev, new_queue_depth);
 			}
 		}
 	lpfc_destroy_vport_work_array(phba, vports);
 	atomic_set(&phba->num_rsrc_err, 0);
-	atomic_set(&phba->num_cmd_success, 0);
 }
 
 /**

diff --git a/drivers/scsi/qedf/qedf_debugfs.c b/drivers/scsi/qedf/qedf_debugfs.c
index 41fa846..2a3a2d4 100644
--- a/drivers/scsi/qedf/qedf_debugfs.c
+++ b/drivers/scsi/qedf/qedf_debugfs.c

@@ -190,7 +190,7 @@
 	if (!count || *ppos)
 		return 0;
 
-	kern_buf = memdup_user(buffer, count);
+	kern_buf = memdup_user_nul(buffer, count);
 	if (IS_ERR(kern_buf))
 		return PTR_ERR(kern_buf);
 

diff --git a/drivers/scsi/ufs/ufs-qcom.h b/drivers/scsi/ufs/ufs-qcom.h
index 076f528..275aa7d 100644
--- a/drivers/scsi/ufs/ufs-qcom.h
+++ b/drivers/scsi/ufs/ufs-qcom.h

@@ -166,10 +166,10 @@
 			1 << OFFSET_UFS_PHY_SOFT_RESET, REG_UFS_CFG1);
 
 	/*
-	 * Make sure assertion of ufs phy reset is written to
-	 * register before returning
+	 * Dummy read to ensure the write takes effect before doing any sort
+	 * of delay
 	 */
-	mb();
+	ufshcd_readl(hba, REG_UFS_CFG1);
 }
 
 static inline void ufs_qcom_deassert_reset(struct ufs_hba *hba)
@@ -178,10 +178,10 @@
 			0 << OFFSET_UFS_PHY_SOFT_RESET, REG_UFS_CFG1);
 
 	/*
-	 * Make sure de-assertion of ufs phy reset is written to
-	 * register before returning
+	 * Dummy read to ensure the write takes effect before doing any sort
+	 * of delay
 	 */
-	mb();
+	ufshcd_readl(hba, REG_UFS_CFG1);
 }
 
 struct ufs_qcom_bus_vote {

diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
index ef98d6f..54009f7 100644
--- a/drivers/scsi/ufs/ufshcd.c
+++ b/drivers/scsi/ufs/ufshcd.c

@@ -4696,7 +4696,7 @@
 		 * Make sure UIC command completion interrupt is disabled before
 		 * issuing UIC command.
 		 */
-		wmb();
+		ufshcd_readl(hba, REG_INTERRUPT_ENABLE);
 		reenable_intr = true;
 	}
 	ret = __ufshcd_send_uic_cmd(hba, cmd, false);
@@ -10369,7 +10369,7 @@
 	 * Make sure that UFS interrupts are disabled and any pending interrupt
 	 * status is cleared before registering UFS interrupt handler.
 	 */
-	mb();
+	ufshcd_readl(hba, REG_INTERRUPT_ENABLE);
 
 	/* IRQ registration */
 	err = devm_request_irq(dev, irq, ufshcd_intr, IRQF_SHARED, UFSHCD, hba);

diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
index ed4d69e..6824e90 100644
--- a/drivers/spi/spi.c
+++ b/drivers/spi/spi.c

@@ -861,6 +861,7 @@
 	else
 		rx_dev = ctlr->dev.parent;
 
+	ret = -ENOMSG;
 	list_for_each_entry(xfer, &msg->transfers, transfer_list) {
 		if (!ctlr->can_dma(ctlr, msg->spi, xfer))
 			continue;
@@ -884,6 +885,9 @@
 			}
 		}
 	}
+	/* No transfer has been mapped, bail out with success */
+	if (ret)
+		return 0;
 
 	ctlr->cur_msg_mapped = true;
 

diff --git a/drivers/staging/comedi/drivers/vmk80xx.c b/drivers/staging/comedi/drivers/vmk80xx.c
index 6010c04..ed23fa1 100644
--- a/drivers/staging/comedi/drivers/vmk80xx.c
+++ b/drivers/staging/comedi/drivers/vmk80xx.c

@@ -651,32 +651,21 @@
 	struct vmk80xx_private *devpriv = dev->private;
 	struct usb_interface *intf = comedi_to_usb_interface(dev);
 	struct usb_host_interface *iface_desc = intf->cur_altsetting;
-	struct usb_endpoint_descriptor *ep_desc;
-	int i;
+	struct usb_endpoint_descriptor *ep_rx_desc, *ep_tx_desc;
+	int ret;
 
-	if (iface_desc->desc.bNumEndpoints != 2)
+	if (devpriv->model == VMK8061_MODEL)
+		ret = usb_find_common_endpoints(iface_desc, &ep_rx_desc,
+						&ep_tx_desc, NULL, NULL);
+	else
+		ret = usb_find_common_endpoints(iface_desc, NULL, NULL,
+						&ep_rx_desc, &ep_tx_desc);
+
+	if (ret)
 		return -ENODEV;
 
-	for (i = 0; i < iface_desc->desc.bNumEndpoints; i++) {
-		ep_desc = &iface_desc->endpoint[i].desc;
-
-		if (usb_endpoint_is_int_in(ep_desc) ||
-		    usb_endpoint_is_bulk_in(ep_desc)) {
-			if (!devpriv->ep_rx)
-				devpriv->ep_rx = ep_desc;
-			continue;
-		}
-
-		if (usb_endpoint_is_int_out(ep_desc) ||
-		    usb_endpoint_is_bulk_out(ep_desc)) {
-			if (!devpriv->ep_tx)
-				devpriv->ep_tx = ep_desc;
-			continue;
-		}
-	}
-
-	if (!devpriv->ep_rx || !devpriv->ep_tx)
-		return -ENODEV;
+	devpriv->ep_rx = ep_rx_desc;
+	devpriv->ep_tx = ep_tx_desc;
 
 	if (!usb_endpoint_maxp(devpriv->ep_rx) || !usb_endpoint_maxp(devpriv->ep_tx))
 		return -EINVAL;

diff --git a/drivers/staging/greybus/arche-apb-ctrl.c b/drivers/staging/greybus/arche-apb-ctrl.c
index 0412f3d..fc723eb 100644
--- a/drivers/staging/greybus/arche-apb-ctrl.c
+++ b/drivers/staging/greybus/arche-apb-ctrl.c

@@ -499,6 +499,7 @@
 	{ .compatible = "usbffff,2", },
 	{ },
 };
+MODULE_DEVICE_TABLE(of, arche_apb_ctrl_of_match);
 
 static struct platform_driver arche_apb_ctrl_device_driver = {
 	.probe		= arche_apb_ctrl_probe,

diff --git a/drivers/staging/greybus/arche-platform.c b/drivers/staging/greybus/arche-platform.c
index 21ac92d..e7351e1 100644
--- a/drivers/staging/greybus/arche-platform.c
+++ b/drivers/staging/greybus/arche-platform.c

@@ -663,14 +663,7 @@
 	{ .compatible = "google,arche-platform", },
 	{ },
 };
-
-static const struct of_device_id arche_combined_id[] = {
-	/* Use PID/VID of SVC device */
-	{ .compatible = "google,arche-platform", },
-	{ .compatible = "usbffff,2", },
-	{ },
-};
-MODULE_DEVICE_TABLE(of, arche_combined_id);
+MODULE_DEVICE_TABLE(of, arche_platform_of_match);
 
 static struct platform_driver arche_platform_device_driver = {
 	.probe		= arche_platform_probe,

diff --git a/drivers/staging/greybus/light.c b/drivers/staging/greybus/light.c
index 031a916..9744c13 100644
--- a/drivers/staging/greybus/light.c
+++ b/drivers/staging/greybus/light.c

@@ -150,6 +150,9 @@
 		channel = get_channel_from_mode(channel->light,
 						GB_CHANNEL_MODE_TORCH);
 
+	if (!channel)
+		return -EINVAL;
+
 	/* For not flash we need to convert brightness to intensity */
 	intensity = channel->intensity_uA.min +
 			(channel->intensity_uA.step * channel->led->brightness);
@@ -553,7 +556,10 @@
 	}
 
 	channel_flash = get_channel_from_mode(light, GB_CHANNEL_MODE_FLASH);
-	WARN_ON(!channel_flash);
+	if (!channel_flash) {
+		dev_err(dev, "failed to get flash channel from mode\n");
+		return -EINVAL;
+	}
 
 	fled = &channel_flash->fled;
 

diff --git a/drivers/staging/lustre/lnet/libcfs/debug.c b/drivers/staging/lustre/lnet/libcfs/debug.c
index 1ab394c..8a36845 100644
--- a/drivers/staging/lustre/lnet/libcfs/debug.c
+++ b/drivers/staging/lustre/lnet/libcfs/debug.c

@@ -167,22 +167,6 @@
 module_param(libcfs_console_min_delay, console_min_delay, 0644);
 MODULE_PARM_DESC(libcfs_console_min_delay, "Lustre kernel debug console min delay (jiffies)");
 
-static int param_set_uint_minmax(const char *val,
-				 const struct kernel_param *kp,
-				 unsigned int min, unsigned int max)
-{
-	unsigned int num;
-	int ret;
-
-	if (!val)
-		return -EINVAL;
-	ret = kstrtouint(val, 0, &num);
-	if (ret < 0 || num < min || num > max)
-		return -EINVAL;
-	*((unsigned int *)kp->arg) = num;
-	return 0;
-}
-
 static int param_set_uintpos(const char *val, const struct kernel_param *kp)
 {
 	return param_set_uint_minmax(val, kp, 1, -1);

diff --git a/drivers/staging/speakup/main.c b/drivers/staging/speakup/main.c
index a27f5e9..00e9b87 100644
--- a/drivers/staging/speakup/main.c
+++ b/drivers/staging/speakup/main.c

@@ -582,7 +582,7 @@
 		}
 	attr_ch = get_char(vc, (u_short *)tmp_pos, &spk_attr);
 	buf[cnt++] = attr_ch;
-	while (tmpx < vc->vc_cols - 1) {
+	while (tmpx < vc->vc_cols - 1 && cnt < ARRAY_SIZE(buf) - 1) {
 		tmp_pos += 2;
 		tmpx++;
 		ch = get_char(vc, (u_short *)tmp_pos, &temp);

diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c
index 7e87d95..e3f08c9 100644
--- a/drivers/target/target_core_configfs.c
+++ b/drivers/target/target_core_configfs.c

@@ -3211,6 +3211,8 @@
 {
 	struct configfs_subsystem *subsys = &target_core_fabrics;
 	struct t10_alua_lu_gp *lu_gp;
+	struct cred *kern_cred;
+	const struct cred *old_cred;
 	int ret;
 
 	pr_debug("TARGET_CORE[0]: Loading Generic Kernel Storage"
@@ -3287,9 +3289,20 @@
 	if (ret < 0)
 		goto out;
 
+	/* We use the kernel credentials to access the target directory */
+	kern_cred = prepare_kernel_cred(&init_task);
+	if (!kern_cred) {
+		ret = -ENOMEM;
+		goto out;
+	}
+	old_cred = override_creds(kern_cred);
+	revert_creds(old_cred);
+	put_cred(kern_cred);
+
 	return 0;
 
 out:
+	target_xcopy_release_pt();
 	configfs_unregister_subsystem(subsys);
 	core_dev_release_virtual_lun0();
 	rd_module_exit();

diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index a60d4b5..f7c8b0f 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c

@@ -1986,8 +1986,12 @@
 		break;
 	case GSM_DATA:		/* Data */
 		gsm->buf[gsm->count++] = c;
-		if (gsm->count == gsm->len)
+		if (gsm->count >= MAX_MRU) {
+			gsm->bad_size++;
+			gsm->state = GSM_SEARCH;
+		} else if (gsm->count >= gsm->len) {
 			gsm->state = GSM_FCS;
+		}
 		break;
 	case GSM_FCS:		/* FCS follows the packet */
 		gsm->received_fcs = c;
@@ -2067,7 +2071,7 @@
 		gsm->state = GSM_DATA;
 		break;
 	case GSM_DATA:		/* Data */
-		if (gsm->count > gsm->mru) {	/* Allow one for the FCS */
+		if (gsm->count > gsm->mru || gsm->count > MAX_MRU) {	/* Allow one for the FCS */
 			gsm->state = GSM_OVERRUN;
 			gsm->bad_size++;
 		} else

diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c
index 0ddeb88..3640929 100644
--- a/drivers/tty/serial/kgdboc.c
+++ b/drivers/tty/serial/kgdboc.c

@@ -19,6 +19,7 @@
 #include <linux/console.h>
 #include <linux/vt_kern.h>
 #include <linux/input.h>
+#include <linux/irq_work.h>
 #include <linux/module.h>
 
 #define MAX_CONFIG_LEN		40
@@ -38,6 +39,25 @@
 static struct tty_driver	*kgdb_tty_driver;
 static int			kgdb_tty_line;
 
+/*
+ * When we leave the debug trap handler we need to reset the keyboard status
+ * (since the original keyboard state gets partially clobbered by kdb use of
+ * the keyboard).
+ *
+ * The path to deliver the reset is somewhat circuitous.
+ *
+ * To deliver the reset we register an input handler, reset the keyboard and
+ * then deregister the input handler. However, to get this done right, we do
+ * have to carefully manage the calling context because we can only register
+ * input handlers from task context.
+ *
+ * In particular we need to trigger the action from the debug trap handler with
+ * all its NMI and/or NMI-like oddities. To solve this the kgdboc trap exit code
+ * (the "post_exception" callback) uses irq_work_queue(), which is NMI-safe, to
+ * schedule a callback from a hardirq context. From there we have to defer the
+ * work again, this time using schedule_work(), to get a callback using the
+ * system workqueue, which runs in task context.
+ */
 #ifdef CONFIG_KDB_KEYBOARD
 static int kgdboc_reset_connect(struct input_handler *handler,
 				struct input_dev *dev,
@@ -89,10 +109,17 @@
 
 static DECLARE_WORK(kgdboc_restore_input_work, kgdboc_restore_input_helper);
 
+static void kgdboc_queue_restore_input_helper(struct irq_work *unused)
+{
+	schedule_work(&kgdboc_restore_input_work);
+}
+
+static DEFINE_IRQ_WORK(kgdboc_restore_input_irq_work, kgdboc_queue_restore_input_helper);
+
 static void kgdboc_restore_input(void)
 {
 	if (likely(system_state == SYSTEM_RUNNING))
-		schedule_work(&kgdboc_restore_input_work);
+		irq_work_queue(&kgdboc_restore_input_irq_work);
 }
 
 static int kgdboc_register_kbd(char **cptr)
@@ -123,6 +150,7 @@
 			i--;
 		}
 	}
+	irq_work_sync(&kgdboc_restore_input_irq_work);
 	flush_work(&kgdboc_restore_input_work);
 }
 #else /* ! CONFIG_KDB_KEYBOARD */

diff --git a/drivers/tty/serial/max3100.c b/drivers/tty/serial/max3100.c
index ace8264..3584101 100644
--- a/drivers/tty/serial/max3100.c
+++ b/drivers/tty/serial/max3100.c

@@ -50,6 +50,9 @@
 #include <linux/freezer.h>
 #include <linux/tty.h>
 #include <linux/tty_flip.h>
+#include <linux/types.h>
+
+#include <asm/unaligned.h>
 
 #include <linux/serial_max3100.h>
 
@@ -196,7 +199,7 @@
 static int max3100_sr(struct max3100_port *s, u16 tx, u16 *rx)
 {
 	struct spi_message message;
-	u16 etx, erx;
+	__be16 etx, erx;
 	int status;
 	struct spi_transfer tran = {
 		.tx_buf = &etx,
@@ -218,7 +221,7 @@
 	return 0;
 }
 
-static int max3100_handlerx(struct max3100_port *s, u16 rx)
+static int max3100_handlerx_unlocked(struct max3100_port *s, u16 rx)
 {
 	unsigned int ch, flg, status = 0;
 	int ret = 0, cts;
@@ -258,6 +261,17 @@
 	return ret;
 }
 
+static int max3100_handlerx(struct max3100_port *s, u16 rx)
+{
+	unsigned long flags;
+	int ret;
+
+	uart_port_lock_irqsave(&s->port, &flags);
+	ret = max3100_handlerx_unlocked(s, rx);
+	uart_port_unlock_irqrestore(&s->port, flags);
+	return ret;
+}
+
 static void max3100_work(struct work_struct *w)
 {
 	struct max3100_port *s = container_of(w, struct max3100_port, work);
@@ -750,13 +764,14 @@
 	mutex_lock(&max3100s_lock);
 
 	if (!uart_driver_registered) {
-		uart_driver_registered = 1;
 		retval = uart_register_driver(&max3100_uart_driver);
 		if (retval) {
 			printk(KERN_ERR "Couldn't register max3100 uart driver\n");
 			mutex_unlock(&max3100s_lock);
 			return retval;
 		}
+
+		uart_driver_registered = 1;
 	}
 
 	for (i = 0; i < MAX_MAX3100; i++)
@@ -844,6 +859,7 @@
 		}
 	pr_debug("removing max3100 driver\n");
 	uart_unregister_driver(&max3100_uart_driver);
+	uart_driver_registered = 0;
 
 	mutex_unlock(&max3100s_lock);
 	return 0;

diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
index e837508..cb0b2a4 100644
--- a/drivers/tty/serial/mxs-auart.c
+++ b/drivers/tty/serial/mxs-auart.c

@@ -1132,11 +1132,13 @@
 
 static irqreturn_t mxs_auart_irq_handle(int irq, void *context)
 {
-	u32 istat;
+	u32 istat, stat;
 	struct mxs_auart_port *s = context;
 	u32 mctrl_temp = s->mctrl_prev;
-	u32 stat = mxs_read(s, REG_STAT);
 
+	uart_port_lock(&s->port);
+
+	stat = mxs_read(s, REG_STAT);
 	istat = mxs_read(s, REG_INTR);
 
 	/* ack irq */
@@ -1172,6 +1174,8 @@
 		istat &= ~AUART_INTR_TXIS;
 	}
 
+	uart_port_unlock(&s->port);
+
 	return IRQ_HANDLED;
 }
 

diff --git a/drivers/tty/serial/pmac_zilog.c b/drivers/tty/serial/pmac_zilog.c
index 6ccdd01..c4de565 100644
--- a/drivers/tty/serial/pmac_zilog.c
+++ b/drivers/tty/serial/pmac_zilog.c

@@ -233,7 +233,6 @@
 {
 	struct tty_port *port;
 	unsigned char ch, r1, drop, error, flag;
-	int loops = 0;
 
 	/* Sanity check, make sure the old bug is no longer happening */
 	if (uap->port.state == NULL) {
@@ -316,25 +315,12 @@
 		if (r1 & Rx_OVR)
 			tty_insert_flip_char(port, 0, TTY_OVERRUN);
 	next_char:
-		/* We can get stuck in an infinite loop getting char 0 when the
-		 * line is in a wrong HW state, we break that here.
-		 * When that happens, I disable the receive side of the driver.
-		 * Note that what I've been experiencing is a real irq loop where
-		 * I'm getting flooded regardless of the actual port speed.
-		 * Something strange is going on with the HW
-		 */
-		if ((++loops) > 1000)
-			goto flood;
 		ch = read_zsreg(uap, R0);
 		if (!(ch & Rx_CH_AV))
 			break;
 	}
 
 	return true;
- flood:
-	pmz_interrupt_control(uap, 0);
-	pmz_error("pmz: rx irq flood !\n");
-	return true;
 }
 
 static void pmz_status_handle(struct uart_pmac_port *uap)

diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index 6900f76..daa696e 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c

@@ -457,7 +457,6 @@
 static int service_outstanding_interrupt(struct wdm_device *desc)
 {
 	int rv = 0;
-	int used;
 
 	/* submit read urb only if the device is waiting for it */
 	if (!desc->resp_count || !--desc->resp_count)
@@ -472,10 +471,7 @@
 		goto out;
 	}
 
-	used = test_and_set_bit(WDM_RESPONDING, &desc->flags);
-	if (used)
-		goto out;
-
+	set_bit(WDM_RESPONDING, &desc->flags);
 	spin_unlock_irq(&desc->iuspin);
 	rv = usb_submit_urb(desc->response, GFP_KERNEL);
 	spin_lock_irq(&desc->iuspin);

diff --git a/drivers/usb/dwc2/hcd_ddma.c b/drivers/usb/dwc2/hcd_ddma.c
index 4a4b6a5..0114f71 100644
--- a/drivers/usb/dwc2/hcd_ddma.c
+++ b/drivers/usb/dwc2/hcd_ddma.c

@@ -895,13 +895,15 @@
 	struct dwc2_dma_desc *dma_desc;
 	struct dwc2_hcd_iso_packet_desc *frame_desc;
 	u16 frame_desc_idx;
-	struct urb *usb_urb = qtd->urb->priv;
+	struct urb *usb_urb;
 	u16 remain = 0;
 	int rc = 0;
 
 	if (!qtd->urb)
 		return -EINVAL;
 
+	usb_urb = qtd->urb->priv;
+
 	dma_sync_single_for_cpu(hsotg->dev, qh->desc_list_dma + (idx *
 				sizeof(struct dwc2_dma_desc)),
 				sizeof(struct dwc2_dma_desc),

diff --git a/drivers/usb/gadget/composite.c b/drivers/usb/gadget/composite.c
index f976d91..d6fd444 100644
--- a/drivers/usb/gadget/composite.c
+++ b/drivers/usb/gadget/composite.c

@@ -2018,7 +2018,7 @@
 			buf[5] = 0x01;
 			switch (ctrl->bRequestType & USB_RECIP_MASK) {
 			case USB_RECIP_DEVICE:
-				if (w_index != 0x4 || (w_value >> 8))
+				if (w_index != 0x4 || (w_value & 0xff))
 					break;
 				buf[6] = w_index;
 				if (w_length == 0x10) {
@@ -2042,9 +2042,9 @@
 				}
 				break;
 			case USB_RECIP_INTERFACE:
-				if (w_index != 0x5 || (w_value >> 8))
+				if (w_index != 0x5 || (w_value & 0xff))
 					break;
-				interface = w_value & 0xFF;
+				interface = w_value >> 8;
 				if (interface >= MAX_CONFIG_INTERFACES ||
 				    !os_desc_cfg->interface[interface])
 					break;

diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c
index 1c08fb0..9739207 100644
--- a/drivers/usb/gadget/function/f_fs.c
+++ b/drivers/usb/gadget/function/f_fs.c

@@ -3310,7 +3310,7 @@
 	__ffs_event_add(ffs, FUNCTIONFS_SETUP);
 	spin_unlock_irqrestore(&ffs->ev.waitq.lock, flags);
 
-	return creq->wLength == 0 ? USB_GADGET_DELAYED_STATUS : 0;
+	return ffs->ev.setup.wLength == 0 ? USB_GADGET_DELAYED_STATUS : 0;
 }
 
 static bool ffs_func_req_match(struct usb_function *f,

diff --git a/drivers/usb/gadget/function/u_audio.c b/drivers/usb/gadget/function/u_audio.c
index 48661e9..d768065 100644
--- a/drivers/usb/gadget/function/u_audio.c
+++ b/drivers/usb/gadget/function/u_audio.c

@@ -633,6 +633,8 @@
 		return;
 
 	uac = g_audio->uac;
+	g_audio->uac = NULL;
+
 	card = uac->card;
 	if (card)
 		snd_card_free_when_closed(card);

diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index b5c38ab..69d367f 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c

@@ -258,6 +258,10 @@
 #define QUECTEL_PRODUCT_EM061K_LMS		0x0124
 #define QUECTEL_PRODUCT_EC25			0x0125
 #define QUECTEL_PRODUCT_EM060K_128		0x0128
+#define QUECTEL_PRODUCT_EM060K_129		0x0129
+#define QUECTEL_PRODUCT_EM060K_12a		0x012a
+#define QUECTEL_PRODUCT_EM060K_12b		0x012b
+#define QUECTEL_PRODUCT_EM060K_12c		0x012c
 #define QUECTEL_PRODUCT_EG91			0x0191
 #define QUECTEL_PRODUCT_EG95			0x0195
 #define QUECTEL_PRODUCT_BG96			0x0296
@@ -1221,6 +1225,18 @@
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_128, 0xff, 0xff, 0x30) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_128, 0xff, 0x00, 0x40) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_128, 0xff, 0xff, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_129, 0xff, 0xff, 0x30) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_129, 0xff, 0x00, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_129, 0xff, 0xff, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12a, 0xff, 0xff, 0x30) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12a, 0xff, 0x00, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12a, 0xff, 0xff, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12b, 0xff, 0xff, 0x30) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12b, 0xff, 0x00, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12b, 0xff, 0xff, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12c, 0xff, 0xff, 0x30) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12c, 0xff, 0x00, 0x40) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM060K_12c, 0xff, 0xff, 0x40) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0xff, 0x30) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0x00, 0x40) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(QUECTEL_VENDOR_ID, QUECTEL_PRODUCT_EM061K_LCN, 0xff, 0xff, 0x40) },
@@ -1363,6 +1379,12 @@
 	  .driver_info = NCTRL(2) | RSVD(3) },
 	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x1083, 0xff),	/* Telit FE990 (ECM) */
 	  .driver_info = NCTRL(0) | RSVD(1) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a0, 0xff),	/* Telit FN20C04 (rmnet) */
+	  .driver_info = RSVD(0) | NCTRL(3) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a4, 0xff),	/* Telit FN20C04 (rmnet) */
+	  .driver_info = RSVD(0) | NCTRL(3) },
+	{ USB_DEVICE_INTERFACE_CLASS(TELIT_VENDOR_ID, 0x10a9, 0xff),	/* Telit FN20C04 (rmnet) */
+	  .driver_info = RSVD(0) | NCTRL(2) | RSVD(3) | RSVD(4) },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910),
 	  .driver_info = NCTRL(0) | RSVD(1) | RSVD(3) },
 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_ME910_DUAL_MODEM),
@@ -2055,6 +2077,10 @@
 	  .driver_info = RSVD(3) },
 	{ USB_DEVICE_INTERFACE_CLASS(LONGCHEER_VENDOR_ID, 0x9803, 0xff),
 	  .driver_info = RSVD(4) },
+	{ USB_DEVICE(LONGCHEER_VENDOR_ID, 0x9b05),	/* Longsung U8300 */
+	  .driver_info = RSVD(4) | RSVD(5) },
+	{ USB_DEVICE(LONGCHEER_VENDOR_ID, 0x9b3c),	/* Longsung U9300 */
+	  .driver_info = RSVD(0) | RSVD(4) },
 	{ USB_DEVICE(LONGCHEER_VENDOR_ID, ZOOM_PRODUCT_4597) },
 	{ USB_DEVICE(LONGCHEER_VENDOR_ID, IBALL_3_5G_CONNECT) },
 	{ USB_DEVICE(HAIER_VENDOR_ID, HAIER_PRODUCT_CE100) },
@@ -2274,15 +2300,29 @@
 	{ USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0xff, 0x30) },	/* Fibocom FG150 Diag */
 	{ USB_DEVICE_AND_INTERFACE_INFO(0x2cb7, 0x010b, 0xff, 0, 0) },		/* Fibocom FG150 AT */
 	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0111, 0xff) },			/* Fibocom FM160 (MBIM mode) */
+	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0115, 0xff),			/* Fibocom FM135 (laptop MBIM) */
+	  .driver_info = RSVD(5) },
 	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a0, 0xff) },			/* Fibocom NL668-AM/NL652-EU (laptop MBIM) */
 	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a2, 0xff) },			/* Fibocom FM101-GL (laptop MBIM) */
 	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a3, 0xff) },			/* Fibocom FM101-GL (laptop MBIM) */
 	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x01a4, 0xff),			/* Fibocom FM101-GL (laptop MBIM) */
 	  .driver_info = RSVD(4) },
+	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a04, 0xff) },			/* Fibocom FM650-CN (ECM mode) */
+	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a05, 0xff) },			/* Fibocom FM650-CN (NCM mode) */
+	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a06, 0xff) },			/* Fibocom FM650-CN (RNDIS mode) */
+	{ USB_DEVICE_INTERFACE_CLASS(0x2cb7, 0x0a07, 0xff) },			/* Fibocom FM650-CN (MBIM mode) */
 	{ USB_DEVICE_INTERFACE_CLASS(0x2df3, 0x9d03, 0xff) },			/* LongSung M5710 */
 	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1404, 0xff) },			/* GosunCn GM500 RNDIS */
 	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1405, 0xff) },			/* GosunCn GM500 MBIM */
 	{ USB_DEVICE_INTERFACE_CLASS(0x305a, 0x1406, 0xff) },			/* GosunCn GM500 ECM/NCM */
+	{ USB_DEVICE(0x33f8, 0x0104),						/* Rolling RW101-GL (laptop RMNET) */
+	  .driver_info = RSVD(4) | RSVD(5) },
+	{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a2, 0xff) },			/* Rolling RW101-GL (laptop MBIM) */
+	{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a3, 0xff) },			/* Rolling RW101-GL (laptop MBIM) */
+	{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x01a4, 0xff),			/* Rolling RW101-GL (laptop MBIM) */
+	  .driver_info = RSVD(4) },
+	{ USB_DEVICE_INTERFACE_CLASS(0x33f8, 0x0115, 0xff),			/* Rolling RW135-GL (laptop MBIM) */
+	  .driver_info = RSVD(5) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(OPPO_VENDOR_ID, OPPO_PRODUCT_R11, 0xff, 0xff, 0x30) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x30) },
 	{ USB_DEVICE_AND_INTERFACE_INFO(SIERRA_VENDOR_ID, SIERRA_PRODUCT_EM9191, 0xff, 0xff, 0x40) },

diff --git a/drivers/vhost/vhost.c b/drivers/vhost/vhost.c
index 3fe32d3..6cc8603 100644
--- a/drivers/vhost/vhost.c
+++ b/drivers/vhost/vhost.c

@@ -2425,9 +2425,19 @@
 	r = vhost_get_avail(vq, avail_idx, &vq->avail->idx);
 	if (unlikely(r))
 		return false;
-	vq->avail_idx = vhost16_to_cpu(vq, avail_idx);
 
-	return vq->avail_idx == vq->last_avail_idx;
+	vq->avail_idx = vhost16_to_cpu(vq, avail_idx);
+	if (vq->avail_idx != vq->last_avail_idx) {
+		/* Since we have updated avail_idx, the following
+		 * call to vhost_get_vq_desc() will read available
+		 * ring entries. Make sure that read happens after
+		 * the avail_idx read.
+		 */
+		smp_rmb();
+		return false;
+	}
+
+	return true;
 }
 EXPORT_SYMBOL_GPL(vhost_vq_avail_empty);
 

diff --git a/drivers/video/fbdev/Kconfig b/drivers/video/fbdev/Kconfig
index 5da3990..15c49b3 100644
--- a/drivers/video/fbdev/Kconfig
+++ b/drivers/video/fbdev/Kconfig

@@ -2196,8 +2196,8 @@
 	depends on FB && MIPS_COBALT
 
 config FB_SH7760
-	bool "SH7760/SH7763/SH7720/SH7721 LCDC support"
-	depends on FB=y && (CPU_SUBTYPE_SH7760 || CPU_SUBTYPE_SH7763 \
+	tristate "SH7760/SH7763/SH7720/SH7721 LCDC support"
+	depends on FB && (CPU_SUBTYPE_SH7760 || CPU_SUBTYPE_SH7763 \
 		|| CPU_SUBTYPE_SH7720 || CPU_SUBTYPE_SH7721)
 	select FB_CFB_FILLRECT
 	select FB_CFB_COPYAREA

diff --git a/drivers/video/fbdev/savage/savagefb_driver.c b/drivers/video/fbdev/savage/savagefb_driver.c
index a4f15b9..13e9d70 100644
--- a/drivers/video/fbdev/savage/savagefb_driver.c
+++ b/drivers/video/fbdev/savage/savagefb_driver.c

@@ -2271,7 +2271,10 @@
 	if (info->var.xres_virtual > 0x1000)
 		info->var.xres_virtual = 0x1000;
 #endif
-	savagefb_check_var(&info->var, info);
+	err = savagefb_check_var(&info->var, info);
+	if (err)
+		goto failed;
+
 	savagefb_set_fix(info);
 
 	/*

diff --git a/drivers/video/fbdev/sh_mobile_lcdcfb.c b/drivers/video/fbdev/sh_mobile_lcdcfb.c
index c3a4650..f4d1f94 100644
--- a/drivers/video/fbdev/sh_mobile_lcdcfb.c
+++ b/drivers/video/fbdev/sh_mobile_lcdcfb.c

@@ -1718,7 +1718,7 @@
 	 */
 	info->fix = sh_mobile_lcdc_overlay_fix;
 	snprintf(info->fix.id, sizeof(info->fix.id),
-		 "SH Mobile LCDC Overlay %u", ovl->index);
+		 "SHMobile ovl %u", ovl->index);
 	info->fix.smem_start = ovl->dma_handle;
 	info->fix.smem_len = ovl->fb_size;
 	info->fix.line_length = ovl->pitch;

diff --git a/drivers/virtio/virtio_pci_common.c b/drivers/virtio/virtio_pci_common.c
index 924554b..313b6f8 100644
--- a/drivers/virtio/virtio_pci_common.c
+++ b/drivers/virtio/virtio_pci_common.c

@@ -341,8 +341,10 @@
 				  vring_interrupt, 0,
 				  vp_dev->msix_names[msix_vec],
 				  vqs[i]);
-		if (err)
+		if (err) {
+			vp_del_vq(vqs[i]);
 			goto error_find;
+		}
 	}
 	return 0;
 

diff --git a/fs/9p/vfs_file.c b/fs/9p/vfs_file.c
index 13e126f..097c18e 100644
--- a/fs/9p/vfs_file.c
+++ b/fs/9p/vfs_file.c

@@ -691,6 +691,7 @@
 	.lock = v9fs_file_lock,
 	.mmap = generic_file_readonly_mmap,
 	.fsync = v9fs_file_fsync,
+	.setlease = simple_nosetlease,
 };
 
 const struct file_operations v9fs_file_operations_dotl = {
@@ -726,4 +727,5 @@
 	.flock = v9fs_file_flock_dotl,
 	.mmap = v9fs_mmap_file_mmap,
 	.fsync = v9fs_file_fsync_dotl,
+	.setlease = simple_nosetlease,
 };

diff --git a/fs/9p/vfs_inode.c b/fs/9p/vfs_inode.c
index e88cb25..ffbd9d1 100644
--- a/fs/9p/vfs_inode.c
+++ b/fs/9p/vfs_inode.c

@@ -101,7 +101,7 @@
 	int res;
 	int mode = stat->mode;
 
-	res = mode & S_IALLUGO;
+	res = mode & 0777; /* S_IRWXUGO */
 	if (v9fs_proto_dotu(v9ses)) {
 		if ((mode & P9_DMSETUID) == P9_DMSETUID)
 			res |= S_ISUID;
@@ -192,6 +192,9 @@
 		break;
 	}
 
+	if (uflags & O_TRUNC)
+		ret |= P9_OTRUNC;
+
 	if (extended) {
 		if (uflags & O_EXCL)
 			ret |= P9_OEXCL;

diff --git a/fs/9p/vfs_super.c b/fs/9p/vfs_super.c
index d440077..be50f3e 100644
--- a/fs/9p/vfs_super.c
+++ b/fs/9p/vfs_super.c

@@ -346,6 +346,7 @@
 	.alloc_inode = v9fs_alloc_inode,
 	.destroy_inode = v9fs_destroy_inode,
 	.statfs = simple_statfs,
+	.drop_inode = v9fs_drop_inode,
 	.evict_inode = v9fs_evict_inode,
 	.show_options = v9fs_show_options,
 	.umount_begin = v9fs_umount_begin,

diff --git a/fs/btrfs/backref.c b/fs/btrfs/backref.c
index 6d761d2..f03930f 100644
--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c

@@ -2232,20 +2232,14 @@
 	size_t alloc_bytes;
 
 	alloc_bytes = max_t(size_t, total_bytes, sizeof(*data));
-	data = kvmalloc(alloc_bytes, GFP_KERNEL);
+	data = kvzalloc(alloc_bytes, GFP_KERNEL);
 	if (!data)
 		return ERR_PTR(-ENOMEM);
 
-	if (total_bytes >= sizeof(*data)) {
+	if (total_bytes >= sizeof(*data))
 		data->bytes_left = total_bytes - sizeof(*data);
-		data->bytes_missing = 0;
-	} else {
+	else
 		data->bytes_missing = sizeof(*data) - total_bytes;
-		data->bytes_left = 0;
-	}
-
-	data->elem_cnt = 0;
-	data->elem_missed = 0;
 
 	return data;
 }

diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 320acfa..443d858 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c

@@ -3010,6 +3010,7 @@
 			 * alignment and size).
 			 */
 			ret = -EUCLEAN;
+			mutex_unlock(&fs_info->delete_unused_bgs_mutex);
 			goto error;
 		}
 

diff --git a/fs/ecryptfs/keystore.c b/fs/ecryptfs/keystore.c
index cd5ef81..d8874aa 100644
--- a/fs/ecryptfs/keystore.c
+++ b/fs/ecryptfs/keystore.c

@@ -370,9 +370,11 @@
 	 *         | Key Identifier Size      | 1 or 2 bytes |
 	 *         | Key Identifier           | arbitrary    |
 	 *         | File Encryption Key Size | 1 or 2 bytes |
+	 *         | Cipher Code              | 1 byte       |
 	 *         | File Encryption Key      | arbitrary    |
+	 *         | Checksum                 | 2 bytes      |
 	 */
-	data_len = (5 + ECRYPTFS_SIG_SIZE_HEX + crypt_stat->key_size);
+	data_len = (8 + ECRYPTFS_SIG_SIZE_HEX + crypt_stat->key_size);
 	*packet = kmalloc(data_len, GFP_KERNEL);
 	message = *packet;
 	if (!message) {

diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index aaee4f8..fda8cc7 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c

@@ -2818,7 +2818,7 @@
 	inode = ext4_new_inode_start_handle(dir, mode,
 					    NULL, 0, NULL,
 					    EXT4_HT_DIR,
-			EXT4_MAXQUOTAS_INIT_BLOCKS(dir->i_sb) +
+			EXT4_MAXQUOTAS_TRANS_BLOCKS(dir->i_sb) +
 			  4 + EXT4_XATTR_TRANS_BLOCKS);
 	handle = ext4_journal_current_handle();
 	err = PTR_ERR(inode);

diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
index 11b7b8b..f529ced 100644
--- a/fs/ext4/xattr.c
+++ b/fs/ext4/xattr.c

@@ -3090,8 +3090,10 @@
 
 		bh = ext4_sb_bread(inode->i_sb, ce->e_value, REQ_PRIO);
 		if (IS_ERR(bh)) {
-			if (PTR_ERR(bh) == -ENOMEM)
+			if (PTR_ERR(bh) == -ENOMEM) {
+				mb_cache_entry_put(ea_block_cache, ce);
 				return NULL;
+			}
 			bh = NULL;
 			EXT4_ERROR_INODE(inode, "block %lu read error",
 					 (unsigned long)ce->e_value);

diff --git a/fs/jffs2/xattr.c b/fs/jffs2/xattr.c
index acb4492..5a31220 100644
--- a/fs/jffs2/xattr.c
+++ b/fs/jffs2/xattr.c

@@ -1111,6 +1111,9 @@
 		return rc;
 
 	request = PAD(sizeof(struct jffs2_raw_xattr) + strlen(xname) + 1 + size);
+	if (request > c->sector_size - c->cleanmarker_size)
+		return -ERANGE;
+
 	rc = jffs2_reserve_space(c, request, &length,
 				 ALLOC_NORMAL, JFFS2_SUMMARY_XATTR_SIZE);
 	if (rc) {

diff --git a/fs/nfs/internal.h b/fs/nfs/internal.h
index 6f3dc6a..5a4fc86 100644
--- a/fs/nfs/internal.h
+++ b/fs/nfs/internal.h

@@ -615,9 +615,9 @@
 	if ((bsize & (bsize - 1)) || nrbitsp) {
 		unsigned char	nrbits;
 
-		for (nrbits = 31; nrbits && !(bsize & (1 << nrbits)); nrbits--)
+		for (nrbits = 31; nrbits && !(bsize & (1UL << nrbits)); nrbits--)
 			;
-		bsize = 1 << nrbits;
+		bsize = 1UL << nrbits;
 		if (nrbitsp)
 			*nrbitsp = nrbits;
 	}

diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
index e2de156..e612b71 100644
--- a/fs/nfsd/nfs4state.c
+++ b/fs/nfsd/nfs4state.c

@@ -5454,7 +5454,7 @@
 	return status;
 }
 
-static void nfsd4_close_open_stateid(struct nfs4_ol_stateid *s)
+static bool nfsd4_close_open_stateid(struct nfs4_ol_stateid *s)
 {
 	struct nfs4_client *clp = s->st_stid.sc_client;
 	bool unhashed;
@@ -5468,11 +5468,11 @@
 			put_ol_stateid_locked(s, &reaplist);
 		spin_unlock(&clp->cl_lock);
 		free_ol_stateid_reaplist(&reaplist);
+		return false;
 	} else {
 		spin_unlock(&clp->cl_lock);
 		free_ol_stateid_reaplist(&reaplist);
-		if (unhashed)
-			move_to_close_lru(s, clp->net);
+		return unhashed;
 	}
 }
 
@@ -5488,6 +5488,7 @@
 	struct nfs4_ol_stateid *stp;
 	struct net *net = SVC_NET(rqstp);
 	struct nfsd_net *nn = net_generic(net, nfsd_net_id);
+	bool need_move_to_close_list;
 
 	dprintk("NFSD: nfsd4_close on file %pd\n", 
 			cstate->current_fh.fh_dentry);
@@ -5503,8 +5504,10 @@
 	stp->st_stid.sc_type = NFS4_CLOSED_STID;
 	nfs4_inc_and_copy_stateid(&close->cl_stateid, &stp->st_stid);
 
-	nfsd4_close_open_stateid(stp);
+	need_move_to_close_list = nfsd4_close_open_stateid(stp);
 	mutex_unlock(&stp->st_mutex);
+	if (need_move_to_close_list)
+		move_to_close_lru(stp, net);
 
 	/* See RFC5661 sectionm 18.2.4 */
 	if (stp->st_stid.sc_client->cl_minorversion)

diff --git a/fs/nilfs2/dir.c b/fs/nilfs2/dir.c
index 582831a..7f3931f 100644
--- a/fs/nilfs2/dir.c
+++ b/fs/nilfs2/dir.c

@@ -252,7 +252,7 @@
 
 #define S_SHIFT 12
 static unsigned char
-nilfs_type_by_mode[S_IFMT >> S_SHIFT] = {
+nilfs_type_by_mode[(S_IFMT >> S_SHIFT) + 1] = {
 	[S_IFREG >> S_SHIFT]	= NILFS_FT_REG_FILE,
 	[S_IFDIR >> S_SHIFT]	= NILFS_FT_DIR,
 	[S_IFCHR >> S_SHIFT]	= NILFS_FT_CHRDEV,

diff --git a/fs/nilfs2/ioctl.c b/fs/nilfs2/ioctl.c
index 1d63a29..f6d887b 100644
--- a/fs/nilfs2/ioctl.c
+++ b/fs/nilfs2/ioctl.c

@@ -68,7 +68,7 @@
 	if (argv->v_nmembs == 0)
 		return 0;
 
-	if (argv->v_size > PAGE_SIZE)
+	if ((size_t)argv->v_size > PAGE_SIZE)
 		return -EINVAL;
 
 	/*

diff --git a/fs/nilfs2/segment.c b/fs/nilfs2/segment.c
index fc6175b..bfe1211 100644
--- a/fs/nilfs2/segment.c
+++ b/fs/nilfs2/segment.c

@@ -2168,8 +2168,10 @@
 {
 	spin_lock(&sci->sc_state_lock);
 	if (!(sci->sc_state & NILFS_SEGCTOR_COMMIT)) {
-		sci->sc_timer.expires = jiffies + sci->sc_interval;
-		add_timer(&sci->sc_timer);
+		if (sci->sc_task) {
+			sci->sc_timer.expires = jiffies + sci->sc_interval;
+			add_timer(&sci->sc_timer);
+		}
 		sci->sc_state |= NILFS_SEGCTOR_COMMIT;
 	}
 	spin_unlock(&sci->sc_state_lock);
@@ -2216,19 +2218,36 @@
 	struct nilfs_segctor_wait_request wait_req;
 	int err = 0;
 
-	spin_lock(&sci->sc_state_lock);
 	init_wait(&wait_req.wq);
 	wait_req.err = 0;
 	atomic_set(&wait_req.done, 0);
+	init_waitqueue_entry(&wait_req.wq, current);
+
+	/*
+	 * To prevent a race issue where completion notifications from the
+	 * log writer thread are missed, increment the request sequence count
+	 * "sc_seq_request" and insert a wait queue entry using the current
+	 * sequence number into the "sc_wait_request" queue at the same time
+	 * within the lock section of "sc_state_lock".
+	 */
+	spin_lock(&sci->sc_state_lock);
 	wait_req.seq = ++sci->sc_seq_request;
+	add_wait_queue(&sci->sc_wait_request, &wait_req.wq);
 	spin_unlock(&sci->sc_state_lock);
 
-	init_waitqueue_entry(&wait_req.wq, current);
-	add_wait_queue(&sci->sc_wait_request, &wait_req.wq);
-	set_current_state(TASK_INTERRUPTIBLE);
 	wake_up(&sci->sc_wait_daemon);
 
 	for (;;) {
+		set_current_state(TASK_INTERRUPTIBLE);
+
+		/*
+		 * Synchronize only while the log writer thread is alive.
+		 * Leave flushing out after the log writer thread exits to
+		 * the cleanup work in nilfs_segctor_destroy().
+		 */
+		if (!sci->sc_task)
+			break;
+
 		if (atomic_read(&wait_req.done)) {
 			err = wait_req.err;
 			break;
@@ -2244,7 +2263,7 @@
 	return err;
 }
 
-static void nilfs_segctor_wakeup(struct nilfs_sc_info *sci, int err)
+static void nilfs_segctor_wakeup(struct nilfs_sc_info *sci, int err, bool force)
 {
 	struct nilfs_segctor_wait_request *wrq, *n;
 	unsigned long flags;
@@ -2252,7 +2271,7 @@
 	spin_lock_irqsave(&sci->sc_wait_request.lock, flags);
 	list_for_each_entry_safe(wrq, n, &sci->sc_wait_request.head, wq.entry) {
 		if (!atomic_read(&wrq->done) &&
-		    nilfs_cnt32_ge(sci->sc_seq_done, wrq->seq)) {
+		    (force || nilfs_cnt32_ge(sci->sc_seq_done, wrq->seq))) {
 			wrq->err = err;
 			atomic_set(&wrq->done, 1);
 		}
@@ -2372,10 +2391,21 @@
  */
 static void nilfs_segctor_accept(struct nilfs_sc_info *sci)
 {
+	bool thread_is_alive;
+
 	spin_lock(&sci->sc_state_lock);
 	sci->sc_seq_accepted = sci->sc_seq_request;
+	thread_is_alive = (bool)sci->sc_task;
 	spin_unlock(&sci->sc_state_lock);
-	del_timer_sync(&sci->sc_timer);
+
+	/*
+	 * This function does not race with the log writer thread's
+	 * termination.  Therefore, deleting sc_timer, which should not be
+	 * done after the log writer thread exits, can be done safely outside
+	 * the area protected by sc_state_lock.
+	 */
+	if (thread_is_alive)
+		del_timer_sync(&sci->sc_timer);
 }
 
 /**
@@ -2392,7 +2422,7 @@
 	if (mode == SC_LSEG_SR) {
 		sci->sc_state &= ~NILFS_SEGCTOR_COMMIT;
 		sci->sc_seq_done = sci->sc_seq_accepted;
-		nilfs_segctor_wakeup(sci, err);
+		nilfs_segctor_wakeup(sci, err, false);
 		sci->sc_flush_request = 0;
 	} else {
 		if (mode == SC_FLUSH_FILE)
@@ -2401,7 +2431,7 @@
 			sci->sc_flush_request &= ~FLUSH_DAT_BIT;
 
 		/* re-enable timer if checkpoint creation was not done */
-		if ((sci->sc_state & NILFS_SEGCTOR_COMMIT) &&
+		if ((sci->sc_state & NILFS_SEGCTOR_COMMIT) && sci->sc_task &&
 		    time_before(jiffies, sci->sc_timer.expires))
 			add_timer(&sci->sc_timer);
 	}
@@ -2448,11 +2478,11 @@
 	return err;
 }
 
-static void nilfs_construction_timeout(unsigned long data)
+static void nilfs_construction_timeout(struct timer_list *t)
 {
-	struct task_struct *p = (struct task_struct *)data;
+	struct nilfs_sc_info *sci = from_timer(sci, t, sc_timer);
 
-	wake_up_process(p);
+	wake_up_process(sci->sc_timer_task);
 }
 
 static void
@@ -2590,8 +2620,8 @@
 	struct the_nilfs *nilfs = sci->sc_super->s_fs_info;
 	int timeout = 0;
 
-	sci->sc_timer.data = (unsigned long)current;
-	sci->sc_timer.function = nilfs_construction_timeout;
+	sci->sc_timer_task = current;
+	timer_setup(&sci->sc_timer, nilfs_construction_timeout, 0);
 
 	/* start sync. */
 	sci->sc_task = current;
@@ -2658,6 +2688,7 @@
  end_thread:
 	/* end sync. */
 	sci->sc_task = NULL;
+	del_timer_sync(&sci->sc_timer);
 	wake_up(&sci->sc_wait_task); /* for nilfs_segctor_kill_thread() */
 	spin_unlock(&sci->sc_state_lock);
 	return 0;
@@ -2721,7 +2752,6 @@
 	INIT_LIST_HEAD(&sci->sc_gc_inodes);
 	INIT_LIST_HEAD(&sci->sc_iput_queue);
 	INIT_WORK(&sci->sc_iput_work, nilfs_iput_work_func);
-	init_timer(&sci->sc_timer);
 
 	sci->sc_interval = HZ * NILFS_SC_DEFAULT_TIMEOUT;
 	sci->sc_mjcp_freq = HZ * NILFS_SC_DEFAULT_SR_FREQ;
@@ -2775,6 +2805,13 @@
 		|| sci->sc_seq_request != sci->sc_seq_done);
 	spin_unlock(&sci->sc_state_lock);
 
+	/*
+	 * Forcibly wake up tasks waiting in nilfs_segctor_sync(), which can
+	 * be called from delayed iput() via nilfs_evict_inode() and can race
+	 * with the above log writer thread termination.
+	 */
+	nilfs_segctor_wakeup(sci, 0, true);
+
 	if (flush_work(&sci->sc_iput_work))
 		flag = true;
 
@@ -2800,7 +2837,6 @@
 
 	down_write(&nilfs->ns_segctor_sem);
 
-	del_timer_sync(&sci->sc_timer);
 	kfree(sci);
 }
 

diff --git a/fs/nilfs2/segment.h b/fs/nilfs2/segment.h
index 1060949..84084a4 100644
--- a/fs/nilfs2/segment.h
+++ b/fs/nilfs2/segment.h

@@ -180,6 +180,7 @@
 	unsigned long		sc_watermark;
 
 	struct timer_list	sc_timer;
+	struct task_struct     *sc_timer_task;
 	struct task_struct     *sc_task;
 };
 

diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
index 35a6153..90e462b 100644
--- a/fs/proc/task_mmu.c
+++ b/fs/proc/task_mmu.c

@@ -788,6 +788,9 @@
 		[ilog2(VM_PKEY_BIT2)]	= "",
 		[ilog2(VM_PKEY_BIT3)]	= "",
 #endif
+#ifdef CONFIG_HAVE_ARCH_USERFAULTFD_MINOR
+		[ilog2(VM_UFFD_MINOR)]	= "ui",
+#endif /* CONFIG_HAVE_ARCH_USERFAULTFD_MINOR */
 	};
 	size_t i;
 

diff --git a/fs/sysfs/file.c b/fs/sysfs/file.c
index cef9a46..2ebaf3d 100644
--- a/fs/sysfs/file.c
+++ b/fs/sysfs/file.c

@@ -427,6 +427,8 @@
 	kn = kernfs_find_and_get(kobj->sd, attr->name);
 	if (kn)
 		kernfs_break_active_protection(kn);
+	else
+		kobject_put(kobj);
 	return kn;
 }
 EXPORT_SYMBOL_GPL(sysfs_break_active_protection);

diff --git a/fs/userfaultfd.c b/fs/userfaultfd.c
index 839a914..c732444 100644
--- a/fs/userfaultfd.c
+++ b/fs/userfaultfd.c

@@ -17,6 +17,7 @@
 #include <linux/sched/signal.h>
 #include <linux/sched/mm.h>
 #include <linux/mm.h>
+#include <linux/mmu_notifier.h>
 #include <linux/poll.h>
 #include <linux/slab.h>
 #include <linux/seq_file.h>
@@ -30,6 +31,8 @@
 #include <linux/security.h>
 #include <linux/hugetlb.h>
 
+int sysctl_unprivileged_userfaultfd __read_mostly;
+
 static struct kmem_cache *userfaultfd_ctx_cachep __read_mostly;
 
 enum userfaultfd_state {
@@ -62,6 +65,8 @@
 	enum userfaultfd_state state;
 	/* released */
 	bool released;
+	/* memory mappings are changing because of non-cooperative event */
+	bool mmap_changing;
 	/* mm with one ore more vmas attached to this userfaultfd_ctx */
 	struct mm_struct *mm;
 };
@@ -185,24 +190,21 @@
 	msg_init(&msg);
 	msg.event = UFFD_EVENT_PAGEFAULT;
 	msg.arg.pagefault.address = address;
+	/*
+	 * These flags indicate why the userfault occurred:
+	 * - UFFD_PAGEFAULT_FLAG_WP indicates a write protect fault.
+	 * - UFFD_PAGEFAULT_FLAG_MINOR indicates a minor fault.
+	 * - Neither of these flags being set indicates a MISSING fault.
+	 *
+	 * Separately, UFFD_PAGEFAULT_FLAG_WRITE indicates it was a write
+	 * fault. Otherwise, it was a read fault.
+	 */
 	if (flags & FAULT_FLAG_WRITE)
-		/*
-		 * If UFFD_FEATURE_PAGEFAULT_FLAG_WP was set in the
-		 * uffdio_api.features and UFFD_PAGEFAULT_FLAG_WRITE
-		 * was not set in a UFFD_EVENT_PAGEFAULT, it means it
-		 * was a read fault, otherwise if set it means it's
-		 * a write fault.
-		 */
 		msg.arg.pagefault.flags |= UFFD_PAGEFAULT_FLAG_WRITE;
 	if (reason & VM_UFFD_WP)
-		/*
-		 * If UFFD_FEATURE_PAGEFAULT_FLAG_WP was set in the
-		 * uffdio_api.features and UFFD_PAGEFAULT_FLAG_WP was
-		 * not set in a UFFD_EVENT_PAGEFAULT, it means it was
-		 * a missing fault, otherwise if set it means it's a
-		 * write protect fault.
-		 */
 		msg.arg.pagefault.flags |= UFFD_PAGEFAULT_FLAG_WP;
+	if (reason & VM_UFFD_MINOR)
+		msg.arg.pagefault.flags |= UFFD_PAGEFAULT_FLAG_MINOR;
 	if (features & UFFD_FEATURE_THREAD_ID)
 		msg.arg.pagefault.feat.ptid = task_pid_vnr(current);
 	return msg;
@@ -372,11 +374,20 @@
 
 	BUG_ON(ctx->mm != mm);
 
-	VM_BUG_ON(reason & ~(VM_UFFD_MISSING|VM_UFFD_WP));
-	VM_BUG_ON(!(reason & VM_UFFD_MISSING) ^ !!(reason & VM_UFFD_WP));
+	/* Any unrecognized flag is a bug. */
+	VM_BUG_ON(reason & ~__VM_UFFD_FLAGS);
+	/* 0 or > 1 flags set is a bug; we expect exactly 1. */
+	VM_BUG_ON(!reason || (reason & (reason - 1)));
 
 	if (ctx->features & UFFD_FEATURE_SIGBUS)
 		goto out;
+	if ((vmf->flags & FAULT_FLAG_USER) == 0 &&
+	    ctx->flags & UFFD_USER_MODE_ONLY) {
+		printk_once(KERN_WARNING "uffd: Set unprivileged_userfaultfd "
+			"sysctl knob to 1 if kernel faults must be handled "
+			"without obtaining CAP_SYS_PTRACE capability\n");
+		goto out;
+	}
 
 	/*
 	 * If it's already released don't get it. This avoids to loop
@@ -632,7 +643,7 @@
 		for (vma = mm->mmap; vma; vma = vma->vm_next)
 			if (vma->vm_userfaultfd_ctx.ctx == release_new_ctx) {
 				vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX;
-				vma->vm_flags &= ~(VM_UFFD_WP | VM_UFFD_MISSING);
+				vma->vm_flags &= ~__VM_UFFD_FLAGS;
 			}
 		up_write(&mm->mmap_sem);
 
@@ -644,6 +655,7 @@
 	 * already released.
 	 */
 out:
+	WRITE_ONCE(ctx->mmap_changing, false);
 	userfaultfd_ctx_put(ctx);
 }
 
@@ -663,7 +675,7 @@
 	octx = vma->vm_userfaultfd_ctx.ctx;
 	if (!octx || !(octx->features & UFFD_FEATURE_EVENT_FORK)) {
 		vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX;
-		vma->vm_flags &= ~(VM_UFFD_WP | VM_UFFD_MISSING);
+		vma->vm_flags &= ~__VM_UFFD_FLAGS;
 		return 0;
 	}
 
@@ -689,10 +701,12 @@
 		ctx->state = UFFD_STATE_RUNNING;
 		ctx->features = octx->features;
 		ctx->released = false;
+		ctx->mmap_changing = false;
 		ctx->mm = vma->vm_mm;
 		atomic_inc(&ctx->mm->mm_count);
 
 		userfaultfd_ctx_get(octx);
+		WRITE_ONCE(octx->mmap_changing, true);
 		fctx->orig = octx;
 		fctx->new = ctx;
 		list_add_tail(&fctx->list, fcs);
@@ -735,6 +749,11 @@
 	if (ctx && (ctx->features & UFFD_FEATURE_EVENT_REMAP)) {
 		vm_ctx->ctx = ctx;
 		userfaultfd_ctx_get(ctx);
+		WRITE_ONCE(ctx->mmap_changing, true);
+	} else {
+		/* Drop uffd context if remap feature not enabled */
+		vma->vm_userfaultfd_ctx = NULL_VM_UFFD_CTX;
+		vma->vm_flags &= ~__VM_UFFD_FLAGS;
 	}
 }
 
@@ -775,6 +794,7 @@
 		return true;
 
 	userfaultfd_ctx_get(ctx);
+	WRITE_ONCE(ctx->mmap_changing, true);
 	up_read(&mm->mmap_sem);
 
 	msg_init(&ewq.msg);
@@ -818,6 +838,7 @@
 			return -ENOMEM;
 
 		userfaultfd_ctx_get(ctx);
+		WRITE_ONCE(ctx->mmap_changing, true);
 		unmap_ctx->ctx = ctx;
 		unmap_ctx->start = start;
 		unmap_ctx->end = end;
@@ -875,12 +896,12 @@
 	for (vma = mm->mmap; vma; vma = vma->vm_next) {
 		cond_resched();
 		BUG_ON(!!vma->vm_userfaultfd_ctx.ctx ^
-		       !!(vma->vm_flags & (VM_UFFD_MISSING | VM_UFFD_WP)));
+		       !!(vma->vm_flags & __VM_UFFD_FLAGS));
 		if (vma->vm_userfaultfd_ctx.ctx != ctx) {
 			prev = vma;
 			continue;
 		}
-		new_flags = vma->vm_flags & ~(VM_UFFD_MISSING | VM_UFFD_WP);
+		new_flags = vma->vm_flags & ~__VM_UFFD_FLAGS;
 		if (still_valid) {
 			prev = vma_merge(mm, prev, vma->vm_start, vma->vm_end,
 					 new_flags, vma->anon_vma,
@@ -1278,10 +1299,16 @@
 	return 0;
 }
 
-static inline bool vma_can_userfault(struct vm_area_struct *vma)
+static inline bool vma_can_userfault(struct vm_area_struct *vma,
+				     unsigned long vm_flags)
 {
+	if (vm_flags & VM_UFFD_MINOR) {
+		if (!(is_vm_hugetlb_page(vma) || vma_is_shmem(vma)))
+			return false;
+	}
+
 	return vma_is_anonymous(vma) || is_vm_hugetlb_page(vma) ||
-		vma_is_shmem(vma);
+	       vma_is_shmem(vma);
 }
 
 static int userfaultfd_register(struct userfaultfd_ctx *ctx,
@@ -1307,8 +1334,7 @@
 	ret = -EINVAL;
 	if (!uffdio_register.mode)
 		goto out;
-	if (uffdio_register.mode & ~(UFFDIO_REGISTER_MODE_MISSING|
-				     UFFDIO_REGISTER_MODE_WP))
+	if (uffdio_register.mode & ~UFFD_API_REGISTER_MODES)
 		goto out;
 	vm_flags = 0;
 	if (uffdio_register.mode & UFFDIO_REGISTER_MODE_MISSING)
@@ -1322,6 +1348,12 @@
 		ret = -EINVAL;
 		goto out;
 	}
+	if (uffdio_register.mode & UFFDIO_REGISTER_MODE_MINOR) {
+#ifndef CONFIG_HAVE_ARCH_USERFAULTFD_MINOR
+		goto out;
+#endif
+		vm_flags |= VM_UFFD_MINOR;
+	}
 
 	ret = validate_range(mm, &uffdio_register.range.start,
 			     uffdio_register.range.len);
@@ -1367,11 +1399,11 @@
 		cond_resched();
 
 		BUG_ON(!!cur->vm_userfaultfd_ctx.ctx ^
-		       !!(cur->vm_flags & (VM_UFFD_MISSING | VM_UFFD_WP)));
+		       !!(cur->vm_flags & __VM_UFFD_FLAGS));
 
 		/* check not compatible vmas */
 		ret = -EINVAL;
-		if (!vma_can_userfault(cur))
+		if (!vma_can_userfault(cur, vm_flags))
 			goto out_unlock;
 
 		/*
@@ -1428,7 +1460,7 @@
 	do {
 		cond_resched();
 
-		BUG_ON(!vma_can_userfault(vma));
+		BUG_ON(!vma_can_userfault(vma, vm_flags));
 		BUG_ON(vma->vm_userfaultfd_ctx.ctx &&
 		       vma->vm_userfaultfd_ctx.ctx != ctx);
 		WARN_ON(!(vma->vm_flags & VM_MAYWRITE));
@@ -1445,7 +1477,7 @@
 			start = vma->vm_start;
 		vma_end = min(end, vma->vm_end);
 
-		new_flags = (vma->vm_flags & ~vm_flags) | vm_flags;
+		new_flags = (vma->vm_flags & ~__VM_UFFD_FLAGS) | vm_flags;
 		prev = vma_merge(mm, prev, start, vma_end, new_flags,
 				 vma->anon_vma, vma->vm_file, vma->vm_pgoff,
 				 vma_policy(vma),
@@ -1474,6 +1506,9 @@
 		vma->vm_flags = new_flags;
 		vma->vm_userfaultfd_ctx.ctx = ctx;
 
+		if (is_vm_hugetlb_page(vma) && uffd_disable_huge_pmd_share(vma))
+			hugetlb_unshare_all_pmds(vma);
+
 	skip:
 		prev = vma;
 		start = vma->vm_end;
@@ -1483,6 +1518,15 @@
 	up_write(&mm->mmap_sem);
 	mmput(mm);
 	if (!ret) {
+		__u64 ioctls_out;
+
+		ioctls_out = basic_ioctls ? UFFD_API_RANGE_IOCTLS_BASIC :
+		    UFFD_API_RANGE_IOCTLS;
+
+		/* CONTINUE ioctl is only supported for MINOR ranges. */
+		if (!(uffdio_register.mode & UFFDIO_REGISTER_MODE_MINOR))
+			ioctls_out &= ~((__u64)1 << _UFFDIO_CONTINUE);
+
 		/*
 		 * Now that we scanned all vmas we can already tell
 		 * userland which ioctls methods are guaranteed to
@@ -1557,7 +1601,7 @@
 		cond_resched();
 
 		BUG_ON(!!cur->vm_userfaultfd_ctx.ctx ^
-		       !!(cur->vm_flags & (VM_UFFD_MISSING | VM_UFFD_WP)));
+		       !!(cur->vm_flags & __VM_UFFD_FLAGS));
 
 		/*
 		 * Check not compatible vmas, not strictly required
@@ -1566,7 +1610,7 @@
 		 * provides for more strict behavior to notice
 		 * unregistration errors.
 		 */
-		if (!vma_can_userfault(cur))
+		if (!vma_can_userfault(cur, cur->vm_flags))
 			goto out_unlock;
 
 		found = true;
@@ -1580,7 +1624,7 @@
 	do {
 		cond_resched();
 
-		BUG_ON(!vma_can_userfault(vma));
+		BUG_ON(!vma_can_userfault(vma, vma->vm_flags));
 
 		/*
 		 * Nothing to do: this vma is already registered into this
@@ -1608,7 +1652,7 @@
 			wake_userfault(vma->vm_userfaultfd_ctx.ctx, &range);
 		}
 
-		new_flags = vma->vm_flags & ~(VM_UFFD_MISSING | VM_UFFD_WP);
+		new_flags = vma->vm_flags & ~__VM_UFFD_FLAGS;
 		prev = vma_merge(mm, prev, start, vma_end, new_flags,
 				 vma->anon_vma, vma->vm_file, vma->vm_pgoff,
 				 vma_policy(vma),
@@ -1695,6 +1739,10 @@
 
 	user_uffdio_copy = (struct uffdio_copy __user *) arg;
 
+	ret = -EAGAIN;
+	if (READ_ONCE(ctx->mmap_changing))
+		goto out;
+
 	ret = -EFAULT;
 	if (copy_from_user(&uffdio_copy, user_uffdio_copy,
 			   /* don't copy "copy" last field */
@@ -1716,7 +1764,7 @@
 		goto out;
 	if (mmget_not_zero(ctx->mm)) {
 		ret = mcopy_atomic(ctx->mm, uffdio_copy.dst, uffdio_copy.src,
-				   uffdio_copy.len);
+				   uffdio_copy.len, &ctx->mmap_changing);
 		mmput(ctx->mm);
 	} else {
 		return -ESRCH;
@@ -1747,6 +1795,10 @@
 
 	user_uffdio_zeropage = (struct uffdio_zeropage __user *) arg;
 
+	ret = -EAGAIN;
+	if (READ_ONCE(ctx->mmap_changing))
+		goto out;
+
 	ret = -EFAULT;
 	if (copy_from_user(&uffdio_zeropage, user_uffdio_zeropage,
 			   /* don't copy "zeropage" last field */
@@ -1763,7 +1815,8 @@
 
 	if (mmget_not_zero(ctx->mm)) {
 		ret = mfill_zeropage(ctx->mm, uffdio_zeropage.range.start,
-				     uffdio_zeropage.range.len);
+				     uffdio_zeropage.range.len,
+				     &ctx->mmap_changing);
 		mmput(ctx->mm);
 	} else {
 		return -ESRCH;
@@ -1784,6 +1837,66 @@
 	return ret;
 }
 
+static int userfaultfd_continue(struct userfaultfd_ctx *ctx, unsigned long arg)
+{
+	__s64 ret;
+	struct uffdio_continue uffdio_continue;
+	struct uffdio_continue __user *user_uffdio_continue;
+	struct userfaultfd_wake_range range;
+
+	user_uffdio_continue = (struct uffdio_continue __user *)arg;
+
+	ret = -EAGAIN;
+	if (READ_ONCE(ctx->mmap_changing))
+		goto out;
+
+	ret = -EFAULT;
+	if (copy_from_user(&uffdio_continue, user_uffdio_continue,
+			   /* don't copy the output fields */
+			   sizeof(uffdio_continue) - (sizeof(__s64))))
+		goto out;
+
+	ret = validate_range(ctx->mm, &uffdio_continue.range.start,
+			     uffdio_continue.range.len);
+	if (ret)
+		goto out;
+
+	ret = -EINVAL;
+	/* double check for wraparound just in case. */
+	if (uffdio_continue.range.start + uffdio_continue.range.len <=
+	    uffdio_continue.range.start) {
+		goto out;
+	}
+	if (uffdio_continue.mode & ~UFFDIO_CONTINUE_MODE_DONTWAKE)
+		goto out;
+
+	if (mmget_not_zero(ctx->mm)) {
+		ret = mcopy_continue(ctx->mm, uffdio_continue.range.start,
+				     uffdio_continue.range.len,
+				     &ctx->mmap_changing);
+		mmput(ctx->mm);
+	} else {
+		return -ESRCH;
+	}
+
+	if (unlikely(put_user(ret, &user_uffdio_continue->mapped)))
+		return -EFAULT;
+	if (ret < 0)
+		goto out;
+
+	/* len == 0 would wake all */
+	BUG_ON(!ret);
+	range.len = ret;
+	if (!(uffdio_continue.mode & UFFDIO_CONTINUE_MODE_DONTWAKE)) {
+		range.start = uffdio_continue.range.start;
+		wake_userfault(ctx, &range);
+	}
+	ret = range.len == uffdio_continue.range.len ? 0 : -EAGAIN;
+
+out:
+	return ret;
+}
+
 static inline unsigned int uffd_ctx_features(__u64 user_features)
 {
 	/*
@@ -1820,6 +1933,10 @@
 		goto err_out;
 	/* report all available features and ioctls to userland */
 	uffdio_api.features = UFFD_API_FEATURES;
+#ifndef CONFIG_HAVE_ARCH_USERFAULTFD_MINOR
+	uffdio_api.features &=
+		~(UFFD_FEATURE_MINOR_HUGETLBFS | UFFD_FEATURE_MINOR_SHMEM);
+#endif
 	uffdio_api.ioctls = UFFD_API_IOCTLS;
 	ret = -EFAULT;
 	if (copy_to_user(buf, &uffdio_api, sizeof(uffdio_api)))
@@ -1865,6 +1982,9 @@
 	case UFFDIO_ZEROPAGE:
 		ret = userfaultfd_zeropage(ctx, arg);
 		break;
+	case UFFDIO_CONTINUE:
+		ret = userfaultfd_continue(ctx, arg);
+		break;
 	}
 	return ret;
 }
@@ -1942,14 +2062,25 @@
 	struct file *file;
 	struct userfaultfd_ctx *ctx;
 
+	file = ERR_PTR(-EPERM);
+	if (!sysctl_unprivileged_userfaultfd &&
+	    (flags & UFFD_USER_MODE_ONLY) == 0 &&
+	    !capable(CAP_SYS_PTRACE)) {
+		printk_once(KERN_WARNING "uffd: Set unprivileged_userfaultfd "
+			"sysctl knob to 1 if kernel faults must be handled "
+			"without obtaining CAP_SYS_PTRACE capability\n");
+		goto out;
+	}
+
 	BUG_ON(!current->mm);
 
 	/* Check the UFFD_* constants for consistency.  */
+	BUILD_BUG_ON(UFFD_USER_MODE_ONLY & UFFD_SHARED_FCNTL_FLAGS);
 	BUILD_BUG_ON(UFFD_CLOEXEC != O_CLOEXEC);
 	BUILD_BUG_ON(UFFD_NONBLOCK != O_NONBLOCK);
 
 	file = ERR_PTR(-EINVAL);
-	if (flags & ~UFFD_SHARED_FCNTL_FLAGS)
+	if (flags & ~(UFFD_SHARED_FCNTL_FLAGS | UFFD_USER_MODE_ONLY))
 		goto out;
 
 	file = ERR_PTR(-ENOMEM);
@@ -1962,6 +2093,7 @@
 	ctx->features = 0;
 	ctx->state = UFFD_STATE_WAIT_API;
 	ctx->released = false;
+	ctx->mmap_changing = false;
 	ctx->mm = current->mm;
 	/* prevent the mm struct to be freed */
 	mmgrab(ctx->mm);

diff --git a/include/linux/bpf-cgroup.h b/include/linux/bpf-cgroup.h
index c1fa663..2c68257 100644
--- a/include/linux/bpf-cgroup.h
+++ b/include/linux/bpf-cgroup.h

@@ -66,7 +66,8 @@
 
 int __cgroup_bpf_run_filter_sock_addr(struct sock *sk,
 				      struct sockaddr *uaddr,
-				      enum bpf_attach_type type);
+				      enum bpf_attach_type type,
+				      void *t_ctx);
 
 int __cgroup_bpf_run_filter_sock_ops(struct sock *sk,
 				     struct bpf_sock_ops_kern *sock_ops,
@@ -117,16 +118,18 @@
 ({									       \
 	int __ret = 0;							       \
 	if (cgroup_bpf_enabled)						       \
-		__ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, type);    \
+		__ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, type,     \
+							  NULL);	       \
 	__ret;								       \
 })
 
-#define BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, type)			       \
+#define BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, type, t_ctx)		       \
 ({									       \
 	int __ret = 0;							       \
 	if (cgroup_bpf_enabled)	{					       \
 		lock_sock(sk);						       \
-		__ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, type);    \
+		__ret = __cgroup_bpf_run_filter_sock_addr(sk, uaddr, type,     \
+							  t_ctx);	       \
 		release_sock(sk);					       \
 	}								       \
 	__ret;								       \
@@ -148,10 +151,22 @@
 	BPF_CGROUP_RUN_SA_PROG(sk, uaddr, BPF_CGROUP_INET6_CONNECT)
 
 #define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr)		       \
-	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_INET4_CONNECT)
+	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_INET4_CONNECT, NULL)
 
 #define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr)		       \
-	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_INET6_CONNECT)
+	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_INET6_CONNECT, NULL)
+
+#define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, t_ctx)		       \
+	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_UDP4_SENDMSG, t_ctx)
+
+#define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, t_ctx)		       \
+	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_UDP6_SENDMSG, t_ctx)
+
+#define BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, uaddr)			\
+	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_UDP4_RECVMSG, NULL)
+
+#define BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, uaddr)			\
+	BPF_CGROUP_RUN_SA_PROG_LOCK(sk, uaddr, BPF_CGROUP_UDP6_RECVMSG, NULL)
 
 #define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops)				       \
 ({									       \
@@ -183,6 +198,10 @@
 #define BPF_CGROUP_RUN_PROG_INET4_CONNECT_LOCK(sk, uaddr) ({ 0; })
 #define BPF_CGROUP_RUN_PROG_INET6_CONNECT(sk, uaddr) ({ 0; })
 #define BPF_CGROUP_RUN_PROG_INET6_CONNECT_LOCK(sk, uaddr) ({ 0; })
+#define BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk, uaddr, t_ctx) ({ 0; })
+#define BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk, uaddr, t_ctx) ({ 0; })
+#define BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk, uaddr) ({ 0; })
+#define BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk, uaddr) ({ 0; })
 #define BPF_CGROUP_RUN_PROG_SOCK_OPS(sock_ops) ({ 0; })
 
 #endif /* CONFIG_CGROUP_BPF */

diff --git a/include/linux/etherdevice.h b/include/linux/etherdevice.h
index 0913690..c7af3af 100644
--- a/include/linux/etherdevice.h
+++ b/include/linux/etherdevice.h

@@ -292,6 +292,18 @@
 }
 
 /**
+ * eth_hw_addr_set - Assign Ethernet address to a net_device
+ * @dev: pointer to net_device structure
+ * @addr: address to assign
+ *
+ * Assign given address to the net_device, addr_assign_type is not changed.
+ */
+static inline void eth_hw_addr_set(struct net_device *dev, const u8 *addr)
+{
+	ether_addr_copy(dev->dev_addr, addr);
+}
+
+/**
  * eth_hw_addr_inherit - Copy dev_addr from another net_device
  * @dst: pointer to net_device to copy dev_addr to
  * @src: pointer to net_device to copy dev_addr from
@@ -511,6 +523,52 @@
 }
 
 /**
+ * eth_hw_addr_gen - Generate and assign Ethernet address to a port
+ * @dev: pointer to port's net_device structure
+ * @base_addr: base Ethernet address
+ * @id: offset to add to the base address
+ *
+ * Generate a MAC address using a base address and an offset and assign it
+ * to a net_device. Commonly used by switch drivers which need to compute
+ * addresses for all their ports. addr_assign_type is not changed.
+ */
+static inline void eth_hw_addr_gen(struct net_device *dev, const u8 *base_addr,
+				   unsigned int id)
+{
+	u64 u = ether_addr_to_u64(base_addr);
+	u8 addr[ETH_ALEN];
+
+	u += id;
+	u64_to_ether_addr(u, addr);
+	eth_hw_addr_set(dev, addr);
+}
+
+/**
+ * eth_skb_pkt_type - Assign packet type if destination address does not match
+ * @skb: Assigned a packet type if address does not match @dev address
+ * @dev: Network device used to compare packet address against
+ *
+ * If the destination MAC address of the packet does not match the network
+ * device address, assign an appropriate packet type.
+ */
+static inline void eth_skb_pkt_type(struct sk_buff *skb,
+				    const struct net_device *dev)
+{
+	const struct ethhdr *eth = eth_hdr(skb);
+
+	if (unlikely(!ether_addr_equal_64bits(eth->h_dest, dev->dev_addr))) {
+		if (unlikely(is_multicast_ether_addr_64bits(eth->h_dest))) {
+			if (ether_addr_equal_64bits(eth->h_dest, dev->broadcast))
+				skb->pkt_type = PACKET_BROADCAST;
+			else
+				skb->pkt_type = PACKET_MULTICAST;
+		} else {
+			skb->pkt_type = PACKET_OTHERHOST;
+		}
+	}
+}
+
+/**
  * eth_skb_pad - Pad buffer to mininum number of octets for Ethernet frame
  * @skb: Buffer to pad
  *

diff --git a/include/linux/filter.h b/include/linux/filter.h
index e473895..d9072ff 100644
--- a/include/linux/filter.h
+++ b/include/linux/filter.h

@@ -1051,6 +1051,7 @@
 	 * only two (src and dst) are available at convert_ctx_access time
 	 */
 	u64 tmp_reg;
+	void *t_ctx;	/* Attach type specific context. */
 };
 
 struct bpf_sock_ops_kern {

diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
index e52e6be..a030497 100644
--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h

@@ -11,6 +11,7 @@
 #include <linux/list.h>
 #include <linux/kref.h>
 #include <asm/pgtable.h>
+#include <linux/userfaultfd_k.h>
 
 struct ctl_table;
 struct user_struct;
@@ -108,11 +109,14 @@
 unsigned long hugetlb_total_pages(void);
 int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
 			unsigned long address, unsigned int flags);
+#ifdef CONFIG_USERFAULTFD
 int hugetlb_mcopy_atomic_pte(struct mm_struct *dst_mm, pte_t *dst_pte,
 				struct vm_area_struct *dst_vma,
 				unsigned long dst_addr,
 				unsigned long src_addr,
+				enum mcopy_atomic_mode mode,
 				struct page **pagep);
+#endif /* CONFIG_USERFAULTFD */
 int hugetlb_reserve_pages(struct inode *inode, long from, long to,
 						struct vm_area_struct *vma,
 						vm_flags_t vm_flags);
@@ -126,7 +130,8 @@
 u32 hugetlb_fault_mutex_hash(struct hstate *h, struct address_space *mapping,
 				pgoff_t idx);
 
-pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud);
+pte_t *huge_pmd_share(struct mm_struct *mm, struct vm_area_struct *vma,
+		      unsigned long addr, pud_t *pud);
 
 extern int hugepages_treat_as_movable;
 extern int sysctl_hugetlb_shm_group;
@@ -134,7 +139,7 @@
 
 /* arch callbacks */
 
-pte_t *huge_pte_alloc(struct mm_struct *mm,
+pte_t *huge_pte_alloc(struct mm_struct *mm, struct vm_area_struct *vma,
 			unsigned long addr, unsigned long sz);
 pte_t *huge_pte_offset(struct mm_struct *mm,
 		       unsigned long addr, unsigned long sz);
@@ -159,6 +164,8 @@
 		unsigned long address, unsigned long end, pgprot_t newprot);
 
 bool is_hugetlb_entry_migration(pte_t pte);
+void hugetlb_unshare_all_pmds(struct vm_area_struct *vma);
+
 #else /* !CONFIG_HUGETLB_PAGE */
 
 static inline void reset_vma_resv_huge_pages(struct vm_area_struct *vma)
@@ -202,8 +209,10 @@
 #define is_hugepage_only_range(mm, addr, len)	0
 #define hugetlb_free_pgd_range(tlb, addr, end, floor, ceiling) ({BUG(); 0; })
 #define hugetlb_fault(mm, vma, addr, flags)	({ BUG(); 0; })
+#ifdef CONFIG_USERFAULTFD
 #define hugetlb_mcopy_atomic_pte(dst_mm, dst_pte, dst_vma, dst_addr, \
-				src_addr, pagep)	({ BUG(); 0; })
+				src_addr, mode, pagep)	({ BUG(); 0; })
+#endif /* CONFIG_USERFAULTFD */
 #define huge_pte_offset(mm, address, sz)	0
 
 static inline bool isolate_huge_page(struct page *page, struct list_head *list)
@@ -232,6 +241,8 @@
 	BUG();
 }
 
+static inline void hugetlb_unshare_all_pmds(struct vm_area_struct *vma) { }
+
 #endif /* !CONFIG_HUGETLB_PAGE */
 /*
  * hugepages at page global directory. If arch support
@@ -632,4 +643,14 @@
 }
 #endif
 
+bool want_pmd_share(struct vm_area_struct *vma, unsigned long addr);
+
+#ifndef __HAVE_ARCH_FLUSH_HUGETLB_TLB_RANGE
+/*
+ * ARCHes with special requirements for evicting HUGETLB backing TLB entries can
+ * implement this.
+ */
+#define flush_hugetlb_tlb_range(vma, addr, end)	flush_tlb_range(vma, addr, end)
+#endif
+
 #endif /* _LINUX_HUGETLB_H */

diff --git a/include/linux/mm.h b/include/linux/mm.h
index 7cec81a..448b1e7 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h

@@ -261,6 +261,13 @@
 # define VM_GROWSUP	VM_NONE
 #endif
 
+#ifdef CONFIG_HAVE_ARCH_USERFAULTFD_MINOR
+# define VM_UFFD_MINOR_BIT	37
+# define VM_UFFD_MINOR		BIT(VM_UFFD_MINOR_BIT)	/* UFFD minor faults */
+#else /* !CONFIG_HAVE_ARCH_USERFAULTFD_MINOR */
+# define VM_UFFD_MINOR		VM_NONE
+#endif /* CONFIG_HAVE_ARCH_USERFAULTFD_MINOR */
+
 /* Bits set in the VMA until the stack is in its final location */
 #define VM_STACK_INCOMPLETE_SETUP	(VM_RAND_READ | VM_SEQ_READ)
 

diff --git a/include/linux/moduleparam.h b/include/linux/moduleparam.h
index ba36506..dee4c40 100644
--- a/include/linux/moduleparam.h
+++ b/include/linux/moduleparam.h

@@ -361,6 +361,8 @@
 extern const struct kernel_param_ops param_ops_uint;
 extern int param_set_uint(const char *val, const struct kernel_param *kp);
 extern int param_get_uint(char *buffer, const struct kernel_param *kp);
+int param_set_uint_minmax(const char *val, const struct kernel_param *kp,
+		unsigned int min, unsigned int max);
 #define param_check_uint(name, p) __param_check(name, p, unsigned int)
 
 extern const struct kernel_param_ops param_ops_long;

diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index 1709a92..565c8d9 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h

@@ -3818,6 +3818,24 @@
 void __hw_addr_init(struct netdev_hw_addr_list *list);
 
 /* Functions used for device addresses handling */
+static inline void
+__dev_addr_set(struct net_device *dev, const u8 *addr, size_t len)
+{
+	memcpy(dev->dev_addr, addr, len);
+}
+
+static inline void dev_addr_set(struct net_device *dev, const u8 *addr)
+{
+	__dev_addr_set(dev, addr, dev->addr_len);
+}
+
+static inline void
+dev_addr_mod(struct net_device *dev, unsigned int offset,
+	     const u8 *addr, size_t len)
+{
+	memcpy(&dev->dev_addr[offset], addr, len);
+}
+
 int dev_addr_add(struct net_device *dev, const unsigned char *addr,
 		 unsigned char addr_type);
 int dev_addr_del(struct net_device *dev, const unsigned char *addr,
@@ -4549,6 +4567,7 @@
 #define DEV_STATS_INC(DEV, FIELD) atomic_long_inc(&(DEV)->stats.__##FIELD)
 #define DEV_STATS_ADD(DEV, FIELD, VAL) 	\
 		atomic_long_add((VAL), &(DEV)->stats.__##FIELD)
+#define DEV_STATS_READ(DEV, FIELD) atomic_long_read(&(DEV)->stats.__##FIELD)
 
 #include <uapi/linux/net_dropdump.h>
 

diff --git a/include/linux/serial_core.h b/include/linux/serial_core.h
index cfd20e1..c03d96e 100644
--- a/include/linux/serial_core.h
+++ b/include/linux/serial_core.h

@@ -257,6 +257,85 @@
 	void			*private_data;		/* generic platform data pointer */
 };
 
+/**
+ * uart_port_lock - Lock the UART port
+ * @up:		Pointer to UART port structure
+ */
+static inline void uart_port_lock(struct uart_port *up)
+{
+	spin_lock(&up->lock);
+}
+
+/**
+ * uart_port_lock_irq - Lock the UART port and disable interrupts
+ * @up:		Pointer to UART port structure
+ */
+static inline void uart_port_lock_irq(struct uart_port *up)
+{
+	spin_lock_irq(&up->lock);
+}
+
+/**
+ * uart_port_lock_irqsave - Lock the UART port, save and disable interrupts
+ * @up:		Pointer to UART port structure
+ * @flags:	Pointer to interrupt flags storage
+ */
+static inline void uart_port_lock_irqsave(struct uart_port *up, unsigned long *flags)
+{
+	spin_lock_irqsave(&up->lock, *flags);
+}
+
+/**
+ * uart_port_trylock - Try to lock the UART port
+ * @up:		Pointer to UART port structure
+ *
+ * Returns: True if lock was acquired, false otherwise
+ */
+static inline bool uart_port_trylock(struct uart_port *up)
+{
+	return spin_trylock(&up->lock);
+}
+
+/**
+ * uart_port_trylock_irqsave - Try to lock the UART port, save and disable interrupts
+ * @up:		Pointer to UART port structure
+ * @flags:	Pointer to interrupt flags storage
+ *
+ * Returns: True if lock was acquired, false otherwise
+ */
+static inline bool uart_port_trylock_irqsave(struct uart_port *up, unsigned long *flags)
+{
+	return spin_trylock_irqsave(&up->lock, *flags);
+}
+
+/**
+ * uart_port_unlock - Unlock the UART port
+ * @up:		Pointer to UART port structure
+ */
+static inline void uart_port_unlock(struct uart_port *up)
+{
+	spin_unlock(&up->lock);
+}
+
+/**
+ * uart_port_unlock_irq - Unlock the UART port and re-enable interrupts
+ * @up:		Pointer to UART port structure
+ */
+static inline void uart_port_unlock_irq(struct uart_port *up)
+{
+	spin_unlock_irq(&up->lock);
+}
+
+/**
+ * uart_port_unlock_irqrestore - Unlock the UART port, restore interrupts
+ * @up:		Pointer to UART port structure
+ * @flags:	The saved interrupt flags for restore
+ */
+static inline void uart_port_unlock_irqrestore(struct uart_port *up, unsigned long flags)
+{
+	spin_unlock_irqrestore(&up->lock, flags);
+}
+
 static inline int serial_port_in(struct uart_port *up, int offset)
 {
 	return up->serial_in(up, offset);

diff --git a/include/linux/shmem_fs.h b/include/linux/shmem_fs.h
index ed91ce5..301f0be 100644
--- a/include/linux/shmem_fs.h
+++ b/include/linux/shmem_fs.h

@@ -8,6 +8,7 @@
 #include <linux/pagemap.h>
 #include <linux/percpu_counter.h>
 #include <linux/xattr.h>
+#include <linux/userfaultfd_k.h>
 
 /* inode in-kernel data */
 
@@ -132,21 +133,16 @@
 }
 #endif
 
+#ifdef CONFIG_USERFAULTFD
 #ifdef CONFIG_SHMEM
-extern int shmem_mcopy_atomic_pte(struct mm_struct *dst_mm, pmd_t *dst_pmd,
-				  struct vm_area_struct *dst_vma,
-				  unsigned long dst_addr,
-				  unsigned long src_addr,
-				  struct page **pagep);
-extern int shmem_mfill_zeropage_pte(struct mm_struct *dst_mm,
-				    pmd_t *dst_pmd,
-				    struct vm_area_struct *dst_vma,
-				    unsigned long dst_addr);
-#else
-#define shmem_mcopy_atomic_pte(dst_mm, dst_pte, dst_vma, dst_addr, \
-			       src_addr, pagep)        ({ BUG(); 0; })
-#define shmem_mfill_zeropage_pte(dst_mm, dst_pmd, dst_vma, \
-				 dst_addr)      ({ BUG(); 0; })
-#endif
+int shmem_mcopy_atomic_pte(struct mm_struct *dst_mm, pmd_t *dst_pmd,
+			   struct vm_area_struct *dst_vma,
+			   unsigned long dst_addr, unsigned long src_addr,
+			   enum mcopy_atomic_mode mode, struct page **pagep);
+#else /* !CONFIG_SHMEM */
+#define shmem_mcopy_atomic_pte(dst_mm, dst_pmd, dst_vma, dst_addr, \
+			       src_addr, mode, pagep)        ({ BUG(); 0; })
+#endif /* CONFIG_SHMEM */
+#endif /* CONFIG_USERFAULTFD */
 
 #endif

diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index 8ce4196..1774747 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h

@@ -4083,6 +4083,12 @@
 	return skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6;
 }
 
+/* Note: Should be called only if skb_is_gso(skb) is true */
+static inline bool skb_is_gso_sctp(const struct sk_buff *skb)
+{
+	return skb_shinfo(skb)->gso_type & SKB_GSO_SCTP;
+}
+
 static inline void skb_gso_reset(struct sk_buff *skb)
 {
 	skb_shinfo(skb)->gso_size = 0;
@@ -4090,6 +4096,22 @@
 	skb_shinfo(skb)->gso_type = 0;
 }
 
+static inline void skb_increase_gso_size(struct skb_shared_info *shinfo,
+					 u16 increment)
+{
+	if (WARN_ON_ONCE(shinfo->gso_size == GSO_BY_FRAGS))
+		return;
+	shinfo->gso_size += increment;
+}
+
+static inline void skb_decrease_gso_size(struct skb_shared_info *shinfo,
+					 u16 decrement)
+{
+	if (WARN_ON_ONCE(shinfo->gso_size == GSO_BY_FRAGS))
+		return;
+	shinfo->gso_size -= decrement;
+}
+
 void __skb_warn_lro_forwarding(const struct sk_buff *skb);
 
 static inline bool skb_warn_if_lro(const struct sk_buff *skb)

diff --git a/include/linux/trace_events.h b/include/linux/trace_events.h
index 84014ec..47e6420 100644
--- a/include/linux/trace_events.h
+++ b/include/linux/trace_events.h

@@ -409,7 +409,7 @@
 	}								\
 	early_initcall(trace_init_perf_perm_##name);
 
-#define PERF_MAX_TRACE_SIZE	2048
+#define PERF_MAX_TRACE_SIZE	8192
 
 #define MAX_FILTER_STR_VAL	256	/* Should handle KSYM_SYMBOL_LEN */
 

diff --git a/include/linux/userfaultfd_k.h b/include/linux/userfaultfd_k.h
index f2f3b68..99c1b40 100644
--- a/include/linux/userfaultfd_k.h
+++ b/include/linux/userfaultfd_k.h

@@ -14,6 +14,10 @@
 #include <linux/userfaultfd.h> /* linux/include/uapi/linux/userfaultfd.h */
 
 #include <linux/fcntl.h>
+#include <linux/mm.h>
+
+/* The set of all possible UFFD-related VM flags. */
+#define __VM_UFFD_FLAGS (VM_UFFD_MISSING | VM_UFFD_WP | VM_UFFD_MINOR)
 
 /*
  * CAREFUL: Check include/uapi/asm-generic/fcntl.h when defining
@@ -28,13 +32,35 @@
 #define UFFD_SHARED_FCNTL_FLAGS (O_CLOEXEC | O_NONBLOCK)
 #define UFFD_FLAGS_SET (EFD_SHARED_FCNTL_FLAGS)
 
+extern int sysctl_unprivileged_userfaultfd;
+
 extern int handle_userfault(struct vm_fault *vmf, unsigned long reason);
 
+/*
+ * The mode of operation for __mcopy_atomic and its helpers.
+ *
+ * This is almost an implementation detail (mcopy_atomic below doesn't take this
+ * as a parameter), but it's exposed here because memory-kind-specific
+ * implementations (e.g. hugetlbfs) need to know the mode of operation.
+ */
+enum mcopy_atomic_mode {
+	/* A normal copy_from_user into the destination range. */
+	MCOPY_ATOMIC_NORMAL,
+	/* Don't copy; map the destination range to the zero page. */
+	MCOPY_ATOMIC_ZEROPAGE,
+	/* Just install pte(s) with the existing page(s) in the page cache. */
+	MCOPY_ATOMIC_CONTINUE,
+};
+
 extern ssize_t mcopy_atomic(struct mm_struct *dst_mm, unsigned long dst_start,
-			    unsigned long src_start, unsigned long len);
+			    unsigned long src_start, unsigned long len,
+			    bool *mmap_changing);
 extern ssize_t mfill_zeropage(struct mm_struct *dst_mm,
 			      unsigned long dst_start,
-			      unsigned long len);
+			      unsigned long len,
+			      bool *mmap_changing);
+extern ssize_t mcopy_continue(struct mm_struct *dst_mm, unsigned long dst_start,
+			      unsigned long len, bool *mmap_changing);
 
 /* mm helpers */
 static inline bool is_mergeable_vm_userfaultfd_ctx(struct vm_area_struct *vma,
@@ -43,14 +69,35 @@
 	return vma->vm_userfaultfd_ctx.ctx == vm_ctx.ctx;
 }
 
+/*
+ * Never enable huge pmd sharing on some uffd registered vmas:
+ *
+ * - VM_UFFD_WP VMAs, because write protect information is per pgtable entry.
+ *
+ * - VM_UFFD_MINOR VMAs, because otherwise we would never get minor faults for
+ *   VMAs which share huge pmds. (If you have two mappings to the same
+ *   underlying pages, and fault in the non-UFFD-registered one with a write,
+ *   with huge pmd sharing this would *also* setup the second UFFD-registered
+ *   mapping, and we'd not get minor faults.)
+ */
+static inline bool uffd_disable_huge_pmd_share(struct vm_area_struct *vma)
+{
+	return vma->vm_flags & (VM_UFFD_WP | VM_UFFD_MINOR);
+}
+
 static inline bool userfaultfd_missing(struct vm_area_struct *vma)
 {
 	return vma->vm_flags & VM_UFFD_MISSING;
 }
 
+static inline bool userfaultfd_minor(struct vm_area_struct *vma)
+{
+	return vma->vm_flags & VM_UFFD_MINOR;
+}
+
 static inline bool userfaultfd_armed(struct vm_area_struct *vma)
 {
-	return vma->vm_flags & (VM_UFFD_MISSING | VM_UFFD_WP);
+	return vma->vm_flags & __VM_UFFD_FLAGS;
 }
 
 extern int dup_userfaultfd(struct vm_area_struct *, struct list_head *);
@@ -91,6 +138,11 @@
 	return false;
 }
 
+static inline bool userfaultfd_minor(struct vm_area_struct *vma)
+{
+	return false;
+}
+
 static inline bool userfaultfd_armed(struct vm_area_struct *vma)
 {
 	return false;

diff --git a/include/net/addrconf.h b/include/net/addrconf.h
index 40c7cc5..d06ff01 100644
--- a/include/net/addrconf.h
+++ b/include/net/addrconf.h

@@ -387,6 +387,10 @@
 	refcount_inc(&ifp->refcnt);
 }
 
+static inline bool in6_ifa_hold_safe(struct inet6_ifaddr *ifp)
+{
+	return refcount_inc_not_zero(&ifp->refcnt);
+}
 
 /*
  *	compute link-local solicited-node multicast address

diff --git a/include/net/af_unix.h b/include/net/af_unix.h
index e514508..c1d17aa 100644
--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h

@@ -52,7 +52,7 @@
 	struct mutex		iolock, bindlock;
 	struct sock		*peer;
 	struct list_head	link;
-	atomic_long_t		inflight;
+	unsigned long		inflight;
 	spinlock_t		lock;
 	unsigned long		gc_flags;
 #define UNIX_GC_CANDIDATE	0
@@ -72,6 +72,9 @@
 	U_LOCK_NORMAL,
 	U_LOCK_SECOND,	/* for double locking, see unix_state_double_lock(). */
 	U_LOCK_DIAG, /* used while dumping icons, see sk_diag_dump_icons(). */
+	U_LOCK_GC_LISTENER, /* used for listening socket while determining gc
+			     * candidates to close a small race window.
+			     */
 };
 
 static inline void unix_state_lock_nested(struct sock *sk,

diff --git a/include/net/dst_ops.h b/include/net/dst_ops.h
index 632086b..3ae2fda 100644
--- a/include/net/dst_ops.h
+++ b/include/net/dst_ops.h

@@ -24,7 +24,7 @@
 	void			(*destroy)(struct dst_entry *);
 	void			(*ifdown)(struct dst_entry *,
 					  struct net_device *dev, int how);
-	struct dst_entry *	(*negative_advice)(struct dst_entry *);
+	void			(*negative_advice)(struct sock *sk, struct dst_entry *);
 	void			(*link_failure)(struct sk_buff *);
 	void			(*update_pmtu)(struct dst_entry *dst, struct sock *sk,
 					       struct sk_buff *skb, u32 mtu,

diff --git a/include/net/ip_tunnels.h b/include/net/ip_tunnels.h
index 8bf17bb..7844e39 100644
--- a/include/net/ip_tunnels.h
+++ b/include/net/ip_tunnels.h

@@ -324,6 +324,39 @@
 	return pskb_network_may_pull(skb, nhlen);
 }
 
+/* Variant of pskb_inet_may_pull().
+ */
+static inline bool skb_vlan_inet_prepare(struct sk_buff *skb)
+{
+	int nhlen = 0, maclen = ETH_HLEN;
+	__be16 type = skb->protocol;
+
+	/* Essentially this is skb_protocol(skb, true)
+	 * And we get MAC len.
+	 */
+	if (eth_type_vlan(type))
+		type = __vlan_get_protocol(skb, type, &maclen);
+
+	switch (type) {
+#if IS_ENABLED(CONFIG_IPV6)
+	case htons(ETH_P_IPV6):
+		nhlen = sizeof(struct ipv6hdr);
+		break;
+#endif
+	case htons(ETH_P_IP):
+		nhlen = sizeof(struct iphdr);
+		break;
+	}
+	/* For ETH_P_IPV6/ETH_P_IP we make sure to pull
+	 * a base network header in skb->head.
+	 */
+	if (!pskb_may_pull(skb, maclen + nhlen))
+		return false;
+
+	skb_set_network_header(skb, maclen);
+	return true;
+}
+
 static inline int ip_encap_hlen(struct ip_tunnel_encap *e)
 {
 	const struct ip_tunnel_encap_ops *ops;

diff --git a/include/net/neighbour.h b/include/net/neighbour.h
index cb4c313..240d08f 100644
--- a/include/net/neighbour.h
+++ b/include/net/neighbour.h

@@ -172,7 +172,7 @@
 	possible_net_t		net;
 	struct net_device	*dev;
 	u8			flags;
-	u8			key[0];
+	u32			key[0];
 };
 
 /*

diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
index e71e155..55c5717 100644
--- a/include/net/netfilter/nf_tables.h
+++ b/include/net/netfilter/nf_tables.h

@@ -366,7 +366,8 @@
 	int				(*init)(const struct nft_set *set,
 						const struct nft_set_desc *desc,
 						const struct nlattr * const nla[]);
-	void				(*destroy)(const struct nft_set *set);
+	void				(*destroy)(const struct nft_ctx *ctx,
+						   const struct nft_set *set);
 
 	unsigned int			elemsize;
 	u32				features;
@@ -382,6 +383,7 @@
  *	@list: table set list node
  *	@bindings: list of set bindings
  *	@table: table this set belongs to
+ *	@net: netnamespace this set belongs to
  * 	@name: name of the set
  * 	@ktype: key type (numeric type defined by userspace, not used in the kernel)
  * 	@dtype: data type (verdict or numeric type defined by userspace)
@@ -406,6 +408,7 @@
 	struct list_head		list;
 	struct list_head		bindings;
 	struct nft_table		*table;
+	possible_net_t			net;
 	char				*name;
 	u32				ktype;
 	u32				dtype;
@@ -421,7 +424,8 @@
 	unsigned char			*udata;
 	/* runtime data below here */
 	const struct nft_set_ops	*ops ____cacheline_aligned;
-	u16				flags:14,
+	u16				flags:13,
+					bound:1,
 					genmask:2;
 	u8				klen;
 	u8				dlen;
@@ -429,6 +433,11 @@
 		__attribute__((aligned(__alignof__(u64))));
 };
 
+static inline bool nft_set_is_anonymous(const struct nft_set *set)
+{
+	return set->flags & NFT_SET_ANONYMOUS;
+}
+
 static inline void *nft_set_priv(const struct nft_set *set)
 {
 	return (void *)set->data;
@@ -638,6 +647,8 @@
 			u64 timeout, gfp_t gfp);
 void nft_set_elem_destroy(const struct nft_set *set, void *elem,
 			  bool destroy_expr);
+void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,
+				const struct nft_set *set, void *elem);
 
 /**
  *	struct nft_set_gc_batch_head - nf_tables set garbage collection batch
@@ -1332,15 +1343,12 @@
 struct nft_trans_set {
 	struct nft_set			*set;
 	u32				set_id;
-	bool				bound;
 };
 
 #define nft_trans_set(trans)	\
 	(((struct nft_trans_set *)trans->data)->set)
 #define nft_trans_set_id(trans)	\
 	(((struct nft_trans_set *)trans->data)->set_id)
-#define nft_trans_set_bound(trans)	\
-	(((struct nft_trans_set *)trans->data)->bound)
 
 struct nft_trans_chain {
 	bool				update;

diff --git a/include/net/sock.h b/include/net/sock.h
index 4d65d47..829b8ce 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h

@@ -1826,19 +1826,12 @@
 
 static inline void dst_negative_advice(struct sock *sk)
 {
-	struct dst_entry *ndst, *dst = __sk_dst_get(sk);
+	struct dst_entry *dst = __sk_dst_get(sk);
 
 	sk_rethink_txhash(sk);
 
-	if (dst && dst->ops->negative_advice) {
-		ndst = dst->ops->negative_advice(dst);
-
-		if (ndst != dst) {
-			rcu_assign_pointer(sk->sk_dst_cache, ndst);
-			sk_tx_queue_clear(sk);
-			WRITE_ONCE(sk->sk_dst_pending_confirm, 0);
-		}
-	}
+	if (dst && dst->ops->negative_advice)
+		dst->ops->negative_advice(sk, dst);
 }
 
 static inline void

diff --git a/include/trace/events/asoc.h b/include/trace/events/asoc.h
index ccd1a3b..e7bfe62 100644
--- a/include/trace/events/asoc.h
+++ b/include/trace/events/asoc.h

@@ -11,6 +11,8 @@
 #define DAPM_DIRECT "(direct)"
 #define DAPM_ARROW(dir) (((dir) == SND_SOC_DAPM_DIR_OUT) ? "->" : "<-")
 
+TRACE_DEFINE_ENUM(SND_SOC_DAPM_DIR_OUT);
+
 struct snd_soc_jack;
 struct snd_soc_codec;
 struct snd_soc_card;

diff --git a/include/trace/events/mmflags.h b/include/trace/events/mmflags.h
index 40b9cc3..329b513 100644
--- a/include/trace/events/mmflags.h
+++ b/include/trace/events/mmflags.h

@@ -131,6 +131,12 @@
 #define IF_HAVE_VM_SOFTDIRTY(flag,name)
 #endif
 
+#ifdef CONFIG_HAVE_ARCH_USERFAULTFD_MINOR
+# define IF_HAVE_UFFD_MINOR(flag, name) {flag, name},
+#else
+# define IF_HAVE_UFFD_MINOR(flag, name)
+#endif
+
 #define __def_vmaflag_names						\
 	{VM_READ,			"read"		},		\
 	{VM_WRITE,			"write"		},		\
@@ -142,6 +148,7 @@
 	{VM_MAYSHARE,			"mayshare"	},		\
 	{VM_GROWSDOWN,			"growsdown"	},		\
 	{VM_UFFD_MISSING,		"uffd_missing"	},		\
+IF_HAVE_UFFD_MINOR(VM_UFFD_MINOR,	"uffd_minor"	)		\
 	{VM_PFNMAP,			"pfnmap"	},		\
 	{VM_DENYWRITE,			"denywrite"	},		\
 	{VM_UFFD_WP,			"uffd_wp"	},		\

diff --git a/include/uapi/linux/bpf.h b/include/uapi/linux/bpf.h
index e5d541b..bf3fa85 100644
--- a/include/uapi/linux/bpf.h
+++ b/include/uapi/linux/bpf.h

@@ -149,6 +149,10 @@
 	BPF_CGROUP_INET6_CONNECT,
 	BPF_CGROUP_INET4_POST_BIND,
 	BPF_CGROUP_INET6_POST_BIND,
+	BPF_CGROUP_UDP4_SENDMSG,
+	BPF_CGROUP_UDP6_SENDMSG,
+	BPF_CGROUP_UDP4_RECVMSG = 19,
+	BPF_CGROUP_UDP6_RECVMSG = 20,
 	__MAX_BPF_ATTACH_TYPE
 };
 
@@ -1039,6 +1043,12 @@
 	__u32 family;		/* Allows 4-byte read, but no write */
 	__u32 type;		/* Allows 4-byte read, but no write */
 	__u32 protocol;		/* Allows 4-byte read, but no write */
+	__u32 msg_src_ip4;	/* Allows 1,2,4-byte read an 4-byte write.
+				 * Stored in network byte order.
+				 */
+	__u32 msg_src_ip6[4];	/* Allows 1,2,4-byte read an 4-byte write.
+				 * Stored in network byte order.
+				 */
 };
 
 /* User bpf_sock_ops struct to access socket values and specify request ops

diff --git a/include/uapi/linux/mman.h b/include/uapi/linux/mman.h
index bfd5938..467dcfc 100644
--- a/include/uapi/linux/mman.h
+++ b/include/uapi/linux/mman.h

@@ -5,8 +5,9 @@
 #include <asm/mman.h>
 #include <asm-generic/hugetlb_encode.h>
 
-#define MREMAP_MAYMOVE	1
-#define MREMAP_FIXED	2
+#define MREMAP_MAYMOVE		1
+#define MREMAP_FIXED		2
+#define MREMAP_DONTUNMAP	4
 
 #define OVERCOMMIT_GUESS		0
 #define OVERCOMMIT_ALWAYS		1

diff --git a/include/uapi/linux/userfaultfd.h b/include/uapi/linux/userfaultfd.h
index 48f1a7c..9792195 100644
--- a/include/uapi/linux/userfaultfd.h
+++ b/include/uapi/linux/userfaultfd.h

@@ -19,14 +19,19 @@
  * means the userland is reading).
  */
 #define UFFD_API ((__u64)0xAA)
+#define UFFD_API_REGISTER_MODES (UFFDIO_REGISTER_MODE_MISSING |	\
+				 UFFDIO_REGISTER_MODE_WP |	\
+				 UFFDIO_REGISTER_MODE_MINOR)
 #define UFFD_API_FEATURES (UFFD_FEATURE_EVENT_FORK |		\
 			   UFFD_FEATURE_EVENT_REMAP |		\
-			   UFFD_FEATURE_EVENT_REMOVE |	\
+			   UFFD_FEATURE_EVENT_REMOVE |		\
 			   UFFD_FEATURE_EVENT_UNMAP |		\
 			   UFFD_FEATURE_MISSING_HUGETLBFS |	\
 			   UFFD_FEATURE_MISSING_SHMEM |		\
 			   UFFD_FEATURE_SIGBUS |		\
-			   UFFD_FEATURE_THREAD_ID)
+			   UFFD_FEATURE_THREAD_ID |		\
+			   UFFD_FEATURE_MINOR_HUGETLBFS |	\
+			   UFFD_FEATURE_MINOR_SHMEM)
 #define UFFD_API_IOCTLS				\
 	((__u64)1 << _UFFDIO_REGISTER |		\
 	 (__u64)1 << _UFFDIO_UNREGISTER |	\
@@ -34,10 +39,12 @@
 #define UFFD_API_RANGE_IOCTLS			\
 	((__u64)1 << _UFFDIO_WAKE |		\
 	 (__u64)1 << _UFFDIO_COPY |		\
-	 (__u64)1 << _UFFDIO_ZEROPAGE)
+	 (__u64)1 << _UFFDIO_ZEROPAGE |		\
+	 (__u64)1 << _UFFDIO_CONTINUE)
 #define UFFD_API_RANGE_IOCTLS_BASIC		\
 	((__u64)1 << _UFFDIO_WAKE |		\
-	 (__u64)1 << _UFFDIO_COPY)
+	 (__u64)1 << _UFFDIO_COPY |		\
+	 (__u64)1 << _UFFDIO_CONTINUE)
 
 /*
  * Valid ioctl command number range with this API is from 0x00 to
@@ -52,6 +59,7 @@
 #define _UFFDIO_WAKE			(0x02)
 #define _UFFDIO_COPY			(0x03)
 #define _UFFDIO_ZEROPAGE		(0x04)
+#define _UFFDIO_CONTINUE		(0x07)
 #define _UFFDIO_API			(0x3F)
 
 /* userfaultfd ioctl ids */
@@ -68,6 +76,8 @@
 				      struct uffdio_copy)
 #define UFFDIO_ZEROPAGE		_IOWR(UFFDIO, _UFFDIO_ZEROPAGE,	\
 				      struct uffdio_zeropage)
+#define UFFDIO_CONTINUE		_IOR(UFFDIO, _UFFDIO_CONTINUE,	\
+				     struct uffdio_continue)
 
 /* read() structure */
 struct uffd_msg {
@@ -122,6 +132,7 @@
 /* flags for UFFD_EVENT_PAGEFAULT */
 #define UFFD_PAGEFAULT_FLAG_WRITE	(1<<0)	/* If this was a write fault */
 #define UFFD_PAGEFAULT_FLAG_WP		(1<<1)	/* If reason is VM_UFFD_WP */
+#define UFFD_PAGEFAULT_FLAG_MINOR	(1<<2)	/* If reason is VM_UFFD_MINOR */
 
 struct uffdio_api {
 	/* userland asks for an API number and the features to enable */
@@ -166,6 +177,10 @@
 	 *
 	 * UFFD_FEATURE_THREAD_ID pid of the page faulted task_struct will
 	 * be returned, if feature is not requested 0 will be returned.
+	 *
+	 * UFFD_FEATURE_MINOR_HUGETLBFS indicates that minor faults
+	 * can be intercepted (via REGISTER_MODE_MINOR) for
+	 * hugetlbfs-backed pages.
 	 */
 #define UFFD_FEATURE_PAGEFAULT_FLAG_WP		(1<<0)
 #define UFFD_FEATURE_EVENT_FORK			(1<<1)
@@ -176,6 +191,8 @@
 #define UFFD_FEATURE_EVENT_UNMAP		(1<<6)
 #define UFFD_FEATURE_SIGBUS			(1<<7)
 #define UFFD_FEATURE_THREAD_ID			(1<<8)
+#define UFFD_FEATURE_MINOR_HUGETLBFS		(1<<9)
+#define UFFD_FEATURE_MINOR_SHMEM		(1<<10)
 	__u64 features;
 
 	__u64 ioctls;
@@ -190,6 +207,7 @@
 	struct uffdio_range range;
 #define UFFDIO_REGISTER_MODE_MISSING	((__u64)1<<0)
 #define UFFDIO_REGISTER_MODE_WP		((__u64)1<<1)
+#define UFFDIO_REGISTER_MODE_MINOR	((__u64)1<<2)
 	__u64 mode;
 
 	/*
@@ -231,4 +249,25 @@
 	__s64 zeropage;
 };
 
+struct uffdio_continue {
+	struct uffdio_range range;
+#define UFFDIO_CONTINUE_MODE_DONTWAKE		((__u64)1<<0)
+	__u64 mode;
+
+	/*
+	 * Fields below here are written by the ioctl and must be at the end:
+	 * the copy_from_user will not read past here.
+	 */
+	__s64 mapped;
+};
+
+/*
+ * Flags for the userfaultfd(2) system call itself.
+ */
+
+/*
+ * Create a userfaultfd that can handle page faults only in user mode.
+ */
+#define UFFD_USER_MODE_ONLY 1
+
 #endif /* _LINUX_USERFAULTFD_H */

diff --git a/init/Kconfig b/init/Kconfig
index add4e08..4d377f7 100644
--- a/init/Kconfig
+++ b/init/Kconfig

@@ -1569,6 +1569,11 @@
 	  bugs/quirks. Disable this only if your target machine is
 	  unaffected by PCI quirks.
 
+config HAVE_ARCH_USERFAULTFD_MINOR
+	bool
+	help
+	  Arch has userfaultfd minor fault support
+
 config MEMBARRIER
 	bool "Enable membarrier() system call" if EXPERT
 	default y

diff --git a/kernel/bpf/cgroup.c b/kernel/bpf/cgroup.c
index 36a4f3e..5f976ec 100644
--- a/kernel/bpf/cgroup.c
+++ b/kernel/bpf/cgroup.c

@@ -501,6 +501,7 @@
  * @sk: sock struct that will use sockaddr
  * @uaddr: sockaddr struct provided by user
  * @type: The type of program to be exectuted
+ * @t_ctx: Pointer to attach type specific context
  *
  * socket is expected to be of type INET or INET6.
  *
@@ -509,12 +510,15 @@
  */
 int __cgroup_bpf_run_filter_sock_addr(struct sock *sk,
 				      struct sockaddr *uaddr,
-				      enum bpf_attach_type type)
+				      enum bpf_attach_type type,
+				      void *t_ctx)
 {
 	struct bpf_sock_addr_kern ctx = {
 		.sk = sk,
 		.uaddr = uaddr,
+		.t_ctx = t_ctx,
 	};
+	struct sockaddr_storage unspec;
 	struct cgroup *cgrp;
 	int ret;
 
@@ -524,6 +528,11 @@
 	if (sk->sk_family != AF_INET && sk->sk_family != AF_INET6)
 		return 0;
 
+	if (!ctx.uaddr) {
+		memset(&unspec, 0, sizeof(unspec));
+		ctx.uaddr = (struct sockaddr *)&unspec;
+	}
+
 	cgrp = sock_cgroup_ptr(&sk->sk_cgrp_data);
 	ret = BPF_PROG_RUN_ARRAY(cgrp->bpf.effective[type], &ctx, BPF_PROG_RUN);
 

diff --git a/kernel/bpf/syscall.c b/kernel/bpf/syscall.c
index 8fb19c7..cc8af43 100644
--- a/kernel/bpf/syscall.c
+++ b/kernel/bpf/syscall.c

@@ -1149,6 +1149,10 @@
 		case BPF_CGROUP_INET6_BIND:
 		case BPF_CGROUP_INET4_CONNECT:
 		case BPF_CGROUP_INET6_CONNECT:
+		case BPF_CGROUP_UDP4_SENDMSG:
+		case BPF_CGROUP_UDP6_SENDMSG:
+		case BPF_CGROUP_UDP4_RECVMSG:
+		case BPF_CGROUP_UDP6_RECVMSG:
 			return 0;
 		default:
 			return -EINVAL;
@@ -1394,6 +1398,10 @@
 	case BPF_CGROUP_INET6_BIND:
 	case BPF_CGROUP_INET4_CONNECT:
 	case BPF_CGROUP_INET6_CONNECT:
+	case BPF_CGROUP_UDP4_SENDMSG:
+	case BPF_CGROUP_UDP6_SENDMSG:
+	case BPF_CGROUP_UDP4_RECVMSG:
+	case BPF_CGROUP_UDP6_RECVMSG:
 		ptype = BPF_PROG_TYPE_CGROUP_SOCK_ADDR;
 		break;
 	case BPF_CGROUP_SOCK_OPS:
@@ -1459,6 +1467,10 @@
 	case BPF_CGROUP_INET6_BIND:
 	case BPF_CGROUP_INET4_CONNECT:
 	case BPF_CGROUP_INET6_CONNECT:
+	case BPF_CGROUP_UDP4_SENDMSG:
+	case BPF_CGROUP_UDP6_SENDMSG:
+	case BPF_CGROUP_UDP4_RECVMSG:
+	case BPF_CGROUP_UDP6_RECVMSG:
 		ptype = BPF_PROG_TYPE_CGROUP_SOCK_ADDR;
 		break;
 	case BPF_CGROUP_SOCK_OPS:
@@ -1511,6 +1523,10 @@
 	case BPF_CGROUP_INET6_POST_BIND:
 	case BPF_CGROUP_INET4_CONNECT:
 	case BPF_CGROUP_INET6_CONNECT:
+	case BPF_CGROUP_UDP4_SENDMSG:
+	case BPF_CGROUP_UDP6_SENDMSG:
+	case BPF_CGROUP_UDP4_RECVMSG:
+	case BPF_CGROUP_UDP6_RECVMSG:
 	case BPF_CGROUP_SOCK_OPS:
 		break;
 	default:

diff --git a/kernel/bpf/verifier.c b/kernel/bpf/verifier.c
index 83868b9..bdb778a 100644
--- a/kernel/bpf/verifier.c
+++ b/kernel/bpf/verifier.c

@@ -3618,6 +3618,48 @@
 	return 0;
 }
 
+static int check_return_code(struct bpf_verifier_env *env)
+{
+	struct bpf_reg_state *reg;
+	struct tnum range = tnum_range(0, 1);
+
+	switch (env->prog->type) {
+	case BPF_PROG_TYPE_CGROUP_SOCK_ADDR:
+		if (env->prog->expected_attach_type == BPF_CGROUP_UDP4_RECVMSG ||
+		    env->prog->expected_attach_type == BPF_CGROUP_UDP6_RECVMSG)
+			range = tnum_range(1, 1);
+	case BPF_PROG_TYPE_CGROUP_SKB:
+	case BPF_PROG_TYPE_CGROUP_SOCK:
+	case BPF_PROG_TYPE_SOCK_OPS:
+		break;
+	default:
+		return 0;
+	}
+
+	reg = &env->cur_state->regs[BPF_REG_0];
+	if (reg->type != SCALAR_VALUE) {
+		verbose("At program exit the register R0 is not a known value (%s)\n",
+			reg_type_str[reg->type]);
+		return -EINVAL;
+	}
+
+	if (!tnum_in(range, reg->var_off)) {
+		char tn_buf[48];
+
+		verbose("At program exit the register R0 ");
+		if (!tnum_is_unknown(reg->var_off)) {
+			tnum_strn(tn_buf, sizeof(tn_buf), reg->var_off);
+			verbose("has value %s", tn_buf);
+		} else {
+			verbose("has unknown scalar value");
+		}
+		tnum_strn(tn_buf, sizeof(tn_buf), range);
+		verbose(" should have been in %s\n", tn_buf);
+		return -EINVAL;
+	}
+	return 0;
+}
+
 /* non-recursive DFS pseudo code
  * 1  procedure DFS-iterative(G,v):
  * 2      label v as discovered
@@ -4460,6 +4502,9 @@
 					return -EACCES;
 				}
 
+				err = check_return_code(env);
+				if (err)
+					return err;
 process_bpf_exit:
 				err = pop_stack(env, &env->prev_insn_idx, &env->insn_idx);
 				if (err < 0) {

diff --git a/kernel/cgroup/cpuset.c b/kernel/cgroup/cpuset.c
index c39c980..52a56a8 100644
--- a/kernel/cgroup/cpuset.c
+++ b/kernel/cgroup/cpuset.c

@@ -1284,7 +1284,7 @@
 static int update_relax_domain_level(struct cpuset *cs, s64 val)
 {
 #ifdef CONFIG_SMP
-	if (val < -1 || val >= sched_domain_level_max)
+	if (val < -1 || val > sched_domain_level_max + 1)
 		return -EINVAL;
 #endif
 

diff --git a/kernel/debug/kdb/kdb_io.c b/kernel/debug/kdb/kdb_io.c
index e3f27e4..40d01c7 100644
--- a/kernel/debug/kdb/kdb_io.c
+++ b/kernel/debug/kdb/kdb_io.c

@@ -170,6 +170,33 @@
 	return key;
 }
 
+/**
+ * kdb_position_cursor() - Place cursor in the correct horizontal position
+ * @prompt: Nil-terminated string containing the prompt string
+ * @buffer: Nil-terminated string containing the entire command line
+ * @cp: Cursor position, pointer the character in buffer where the cursor
+ *      should be positioned.
+ *
+ * The cursor is positioned by sending a carriage-return and then printing
+ * the content of the line until we reach the correct cursor position.
+ *
+ * There is some additional fine detail here.
+ *
+ * Firstly, even though kdb_printf() will correctly format zero-width fields
+ * we want the second call to kdb_printf() to be conditional. That keeps things
+ * a little cleaner when LOGGING=1.
+ *
+ * Secondly, we can't combine everything into one call to kdb_printf() since
+ * that renders into a fixed length buffer and the combined print could result
+ * in unwanted truncation.
+ */
+static void kdb_position_cursor(char *prompt, char *buffer, char *cp)
+{
+	kdb_printf("\r%s", kdb_prompt_str);
+	if (cp > buffer)
+		kdb_printf("%.*s", (int)(cp - buffer), buffer);
+}
+
 /*
  * kdb_read
  *
@@ -208,7 +235,6 @@
 						 * and null byte */
 	char *lastchar;
 	char *p_tmp;
-	char tmp;
 	static char tmpbuffer[CMD_BUFLEN];
 	int len = strlen(buffer);
 	int len_tmp;
@@ -250,12 +276,8 @@
 			}
 			*(--lastchar) = '\0';
 			--cp;
-			kdb_printf("\b%s \r", cp);
-			tmp = *cp;
-			*cp = '\0';
-			kdb_printf(kdb_prompt_str);
-			kdb_printf("%s", buffer);
-			*cp = tmp;
+			kdb_printf("\b%s ", cp);
+			kdb_position_cursor(kdb_prompt_str, buffer, cp);
 		}
 		break;
 	case 10: /* new line */
@@ -277,19 +299,14 @@
 			memcpy(tmpbuffer, cp+1, lastchar - cp - 1);
 			memcpy(cp, tmpbuffer, lastchar - cp - 1);
 			*(--lastchar) = '\0';
-			kdb_printf("%s \r", cp);
-			tmp = *cp;
-			*cp = '\0';
-			kdb_printf(kdb_prompt_str);
-			kdb_printf("%s", buffer);
-			*cp = tmp;
+			kdb_printf("%s ", cp);
+			kdb_position_cursor(kdb_prompt_str, buffer, cp);
 		}
 		break;
 	case 1: /* Home */
 		if (cp > buffer) {
-			kdb_printf("\r");
-			kdb_printf(kdb_prompt_str);
 			cp = buffer;
+			kdb_position_cursor(kdb_prompt_str, buffer, cp);
 		}
 		break;
 	case 5: /* End */
@@ -305,11 +322,10 @@
 		}
 		break;
 	case 14: /* Down */
-		memset(tmpbuffer, ' ',
-		       strlen(kdb_prompt_str) + (lastchar-buffer));
-		*(tmpbuffer+strlen(kdb_prompt_str) +
-		  (lastchar-buffer)) = '\0';
-		kdb_printf("\r%s\r", tmpbuffer);
+	case 16: /* Up */
+		kdb_printf("\r%*c\r",
+			   (int)(strlen(kdb_prompt_str) + (lastchar - buffer)),
+			   ' ');
 		*lastchar = (char)key;
 		*(lastchar+1) = '\0';
 		return lastchar;
@@ -319,15 +335,6 @@
 			++cp;
 		}
 		break;
-	case 16: /* Up */
-		memset(tmpbuffer, ' ',
-		       strlen(kdb_prompt_str) + (lastchar-buffer));
-		*(tmpbuffer+strlen(kdb_prompt_str) +
-		  (lastchar-buffer)) = '\0';
-		kdb_printf("\r%s\r", tmpbuffer);
-		*lastchar = (char)key;
-		*(lastchar+1) = '\0';
-		return lastchar;
 	case 9: /* Tab */
 		if (tab < 2)
 			++tab;
@@ -371,15 +378,25 @@
 			kdb_printf("\n");
 			kdb_printf(kdb_prompt_str);
 			kdb_printf("%s", buffer);
+			if (cp != lastchar)
+				kdb_position_cursor(kdb_prompt_str, buffer, cp);
 		} else if (tab != 2 && count > 0) {
-			len_tmp = strlen(p_tmp);
-			strncpy(p_tmp+len_tmp, cp, lastchar-cp+1);
-			len_tmp = strlen(p_tmp);
-			strncpy(cp, p_tmp+len, len_tmp-len + 1);
-			len = len_tmp - len;
-			kdb_printf("%s", cp);
-			cp += len;
-			lastchar += len;
+			/* How many new characters do we want from tmpbuffer? */
+			len_tmp = strlen(p_tmp) - len;
+			if (lastchar + len_tmp >= bufend)
+				len_tmp = bufend - lastchar;
+
+			if (len_tmp) {
+				/* + 1 ensures the '\0' is memmove'd */
+				memmove(cp+len_tmp, cp, (lastchar-cp) + 1);
+				memcpy(cp, p_tmp+len, len_tmp);
+				kdb_printf("%s", cp);
+				cp += len_tmp;
+				lastchar += len_tmp;
+				if (cp != lastchar)
+					kdb_position_cursor(kdb_prompt_str,
+							    buffer, cp);
+			}
 		}
 		kdb_nextline = 1; /* reset output line number */
 		break;
@@ -390,13 +407,9 @@
 				memcpy(cp+1, tmpbuffer, lastchar - cp);
 				*++lastchar = '\0';
 				*cp = key;
-				kdb_printf("%s\r", cp);
+				kdb_printf("%s", cp);
 				++cp;
-				tmp = *cp;
-				*cp = '\0';
-				kdb_printf(kdb_prompt_str);
-				kdb_printf("%s", buffer);
-				*cp = tmp;
+				kdb_position_cursor(kdb_prompt_str, buffer, cp);
 			} else {
 				*++lastchar = '\0';
 				*cp++ = key;

diff --git a/kernel/kprobes.c b/kernel/kprobes.c
index 3a6d281..e86bbcb 100644
--- a/kernel/kprobes.c
+++ b/kernel/kprobes.c

@@ -1550,10 +1550,17 @@
 	jump_label_lock();
 	preempt_disable();
 
-	/* Ensure it is not in reserved area nor out of text */
-	if (!(core_kernel_text((unsigned long) p->addr) ||
-	    is_module_text_address((unsigned long) p->addr)) ||
-	    in_gate_area_no_mm((unsigned long) p->addr) ||
+	/* Ensure the address is in a text area, and find a module if exists. */
+	*probed_mod = NULL;
+	if (!core_kernel_text((unsigned long) p->addr)) {
+		*probed_mod = __module_text_address((unsigned long) p->addr);
+		if (!(*probed_mod)) {
+			ret = -EINVAL;
+			goto out;
+		}
+	}
+	/* Ensure it is not in reserved area. */
+	if (in_gate_area_no_mm((unsigned long) p->addr) ||
 	    within_kprobe_blacklist((unsigned long) p->addr) ||
 	    jump_label_text_reserved(p->addr, p->addr) ||
 	    find_bug((unsigned long)p->addr)) {
@@ -1561,8 +1568,7 @@
 		goto out;
 	}
 
-	/* Check if are we probing a module */
-	*probed_mod = __module_text_address((unsigned long) p->addr);
+	/* Get module refcount and reject __init functions for loaded modules. */
 	if (*probed_mod) {
 		/*
 		 * We must hold a refcount of the probed module while updating

diff --git a/kernel/params.c b/kernel/params.c
index cc9108c..395cb97 100644
--- a/kernel/params.c
+++ b/kernel/params.c

@@ -245,6 +245,24 @@
 STANDARD_PARAM_DEF(ulong,	unsigned long,		"%lu",  kstrtoul);
 STANDARD_PARAM_DEF(ullong,	unsigned long long,	"%llu", kstrtoull);
 
+int param_set_uint_minmax(const char *val, const struct kernel_param *kp,
+		unsigned int min, unsigned int max)
+{
+	unsigned int num;
+	int ret;
+
+	if (!val)
+		return -EINVAL;
+	ret = kstrtouint(val, 0, &num);
+	if (ret)
+		return ret;
+	if (num < min || num > max)
+		return -EINVAL;
+	*((unsigned int *)kp->arg) = num;
+	return 0;
+}
+EXPORT_SYMBOL_GPL(param_set_uint_minmax);
+
 int param_set_charp(const char *val, const struct kernel_param *kp)
 {
 	if (strlen(val) > 1024) {

diff --git a/kernel/sched/topology.c b/kernel/sched/topology.c
index 5f7b89e..c3beaa1 100644
--- a/kernel/sched/topology.c
+++ b/kernel/sched/topology.c

@@ -1133,16 +1133,13 @@
 	if (!attr || attr->relax_domain_level < 0) {
 		if (default_relax_domain_level < 0)
 			return;
-		else
-			request = default_relax_domain_level;
+		request = default_relax_domain_level;
 	} else
 		request = attr->relax_domain_level;
-	if (request < sd->level) {
+
+	if (sd->level >= request) {
 		/* Turn off idle balance on this domain: */
 		sd->flags &= ~(SD_BALANCE_WAKE|SD_BALANCE_NEWIDLE);
-	} else {
-		/* Turn on idle balance on this domain: */
-		sd->flags |= (SD_BALANCE_WAKE|SD_BALANCE_NEWIDLE);
 	}
 }
 

diff --git a/kernel/sys.c b/kernel/sys.c
index 420232c..2f34221 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c

@@ -1384,16 +1384,18 @@
 	return ret;
 }
 
+
+static uint64_t netbpfload_pid = 0;
 SYSCALL_DEFINE1(newuname, struct new_utsname __user *, name)
 {
 	struct new_utsname tmp;
 
 	down_read(&uts_sem);
 	memcpy(&tmp, utsname(), sizeof(tmp));
-	if (!strncmp(current->comm, "bpfloader", 9) ||
-	    !strncmp(current->comm, "netbpfload", 10) ||
-	    !strncmp(current->comm, "netd", 4)) {
-		strcpy(tmp.release, "5.4.186");
+	if (!strncmp(current->comm, "netbpfload", 10) &&
+	    current->pid != netbpfload_pid) {
+		netbpfload_pid = current->pid;
+		strcpy(tmp.release, "6.6.40");
 		pr_debug("fake uname: %s/%d release=%s\n",
 			 current->comm, current->pid, tmp.release);
 	}

diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 9ee107e..d7573c6 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c

@@ -66,6 +66,7 @@
 #include <linux/kexec.h>
 #include <linux/bpf.h>
 #include <linux/mount.h>
+#include <linux/userfaultfd_k.h>
 
 #include <linux/uaccess.h>
 #include <asm/processor.h>
@@ -1754,6 +1755,17 @@
 		.extra2		= (void *)&mmap_rnd_compat_bits_max,
 	},
 #endif
+#ifdef CONFIG_USERFAULTFD
+	{
+		.procname	= "unprivileged_userfaultfd",
+		.data		= &sysctl_unprivileged_userfaultfd,
+		.maxlen		= sizeof(sysctl_unprivileged_userfaultfd),
+		.mode		= 0644,
+		.proc_handler	= proc_dointvec_minmax,
+		.extra1		= &zero,
+		.extra2		= &one,
+	},
+#endif
 	{ }
 };
 

diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 8c09e8c..1e9045f 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c

@@ -1101,6 +1101,11 @@
  *
  * As a safety measure we check to make sure the data pages have not
  * been corrupted.
+ *
+ * Callers of this function need to guarantee that the list of pages doesn't get
+ * modified during the check. In particular, if it's possible that the function
+ * is invoked with concurrent readers which can swap in a new reader page then
+ * the caller should take cpu_buffer->reader_lock.
  */
 static int rb_check_pages(struct ring_buffer_per_cpu *cpu_buffer)
 {
@@ -1779,8 +1784,12 @@
 		 */
 		synchronize_sched();
 		for_each_buffer_cpu(buffer, cpu) {
+			unsigned long flags;
+
 			cpu_buffer = buffer->buffers[cpu];
+			raw_spin_lock_irqsave(&cpu_buffer->reader_lock, flags);
 			rb_check_pages(cpu_buffer);
+			raw_spin_unlock_irqrestore(&cpu_buffer->reader_lock, flags);
 		}
 		atomic_dec(&buffer->record_disabled);
 	}

diff --git a/kernel/trace/trace_event_perf.c b/kernel/trace/trace_event_perf.c
index 80b7b19..bd1d6be 100644
--- a/kernel/trace/trace_event_perf.c
+++ b/kernel/trace/trace_event_perf.c

@@ -276,7 +276,8 @@
 	BUILD_BUG_ON(PERF_MAX_TRACE_SIZE % sizeof(unsigned long));
 
 	if (WARN_ONCE(size > PERF_MAX_TRACE_SIZE,
-		      "perf buffer not large enough"))
+		      "perf buffer not large enough, wanted %d, have %d",
+		      size, PERF_MAX_TRACE_SIZE))
 		return NULL;
 
 	*rctxp = rctx = perf_swevent_get_recursion_context();

diff --git a/kernel/trace/trace_events.c b/kernel/trace/trace_events.c
index f29552b..960db7c 100644
--- a/kernel/trace/trace_events.c
+++ b/kernel/trace/trace_events.c

@@ -1309,6 +1309,7 @@
 	return 0;
 }
 
+#ifdef CONFIG_PERF_EVENTS
 static ssize_t
 event_id_read(struct file *filp, char __user *ubuf, size_t cnt, loff_t *ppos)
 {
@@ -1323,6 +1324,7 @@
 
 	return simple_read_from_buffer(ubuf, cnt, ppos, buf, len);
 }
+#endif
 
 static ssize_t
 event_filter_read(struct file *filp, char __user *ubuf, size_t cnt,
@@ -1727,10 +1729,12 @@
 	.release = seq_release,
 };
 
+#ifdef CONFIG_PERF_EVENTS
 static const struct file_operations ftrace_event_id_fops = {
 	.read = event_id_read,
 	.llseek = default_llseek,
 };
+#endif
 
 static const struct file_operations ftrace_event_filter_fops = {
 	.open = tracing_open_generic,

diff --git a/kernel/trace/trace_events_trigger.c b/kernel/trace/trace_events_trigger.c
index 871ea0f..40c1a2d 100644
--- a/kernel/trace/trace_events_trigger.c
+++ b/kernel/trace/trace_events_trigger.c

@@ -1127,10 +1127,8 @@
 			  struct event_trigger_data *data,
 			  struct trace_event_file *file)
 {
-	int ret = tracing_alloc_snapshot_instance(file->tr);
-
-	if (ret < 0)
-		return ret;
+	if (tracing_alloc_snapshot_instance(file->tr) != 0)
+		return 0;
 
 	return register_trigger(glob, ops, data, file);
 }

diff --git a/lib/dynamic_debug.c b/lib/dynamic_debug.c
index 99434e3..a7d46b8 100644
--- a/lib/dynamic_debug.c
+++ b/lib/dynamic_debug.c

@@ -242,7 +242,11 @@
 		} else {
 			for (end = buf; *end && !isspace(*end); end++)
 				;
-			BUG_ON(end == buf);
+			if (end == buf) {
+				pr_err("parse err after word:%d=%s\n", nwords,
+				       nwords ? words[nwords - 1] : "<none>");
+				return -EINVAL;
+			}
 		}
 
 		/* `buf' is start of word, `end' is one past its end */

diff --git a/lib/lz4/lz4_decompress.c b/lib/lz4/lz4_decompress.c
index cda8b79..3c30bf1 100644
--- a/lib/lz4/lz4_decompress.c
+++ b/lib/lz4/lz4_decompress.c

@@ -268,8 +268,12 @@
 			ip += length;
 			op += length;
 
-			/* Necessarily EOF, due to parsing restrictions */
-			if (!partialDecoding || (cpy == oend))
+			/* Necessarily EOF when !partialDecoding.
+			 * When partialDecoding, it is EOF if we've either
+			 * filled the output buffer or
+			 * can't proceed with reading an offset for following match.
+			 */
+			if (!partialDecoding || (cpy == oend) || (ip >= (iend - 2)))
 				break;
 		} else {
 			/* may overwrite up to WILDCOPYLENGTH beyond cpy */

diff --git a/lib/stackdepot.c b/lib/stackdepot.c
index c519aa0..0a17883 100644
--- a/lib/stackdepot.c
+++ b/lib/stackdepot.c

@@ -243,10 +243,10 @@
 		/*
 		 * Zero out zone modifiers, as we don't have specific zone
 		 * requirements. Keep the flags related to allocation in atomic
-		 * contexts and I/O.
+		 * contexts, I/O, nolockdep.
 		 */
 		alloc_flags &= ~GFP_ZONEMASK;
-		alloc_flags &= (GFP_ATOMIC | GFP_KERNEL);
+		alloc_flags &= (GFP_ATOMIC | GFP_KERNEL | __GFP_NOLOCKDEP);
 		alloc_flags |= __GFP_NOWARN;
 		page = alloc_pages(alloc_flags, STACK_ALLOC_ORDER);
 		if (page)

diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index f09f5dd..18e048b 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c

@@ -34,7 +34,6 @@
 #include <linux/hugetlb.h>
 #include <linux/hugetlb_cgroup.h>
 #include <linux/node.h>
-#include <linux/userfaultfd_k.h>
 #include "internal.h"
 
 int hugepages_treat_as_movable;
@@ -3303,7 +3302,7 @@
 		src_pte = huge_pte_offset(src, addr, sz);
 		if (!src_pte)
 			continue;
-		dst_pte = huge_pte_alloc(dst, addr, sz);
+		dst_pte = huge_pte_alloc(dst, vma, addr, sz);
 		if (!dst_pte) {
 			ret = -ENOMEM;
 			break;
@@ -3776,6 +3775,43 @@
 	return 0;
 }
 
+static inline int hugetlb_handle_userfault(struct vm_area_struct *vma,
+						  struct address_space *mapping,
+						  struct hstate *h,
+						  pgoff_t idx,
+						  unsigned int flags,
+						  unsigned long haddr,
+						  unsigned long reason)
+{
+	int ret;
+	u32 hash;
+	struct vm_fault vmf = {
+		.vma = vma,
+		.address = haddr,
+		.flags = flags,
+
+		/*
+		 * Hard to debug if it ends up being
+		 * used by a callee that assumes
+		 * something about the other
+		 * uninitialized fields... same as in
+		 * memory.c
+		 */
+	};
+
+	/*
+	 * hugetlb_fault_mutex and i_mmap_rwsem must be
+	 * dropped before handling userfault.  Reacquire
+	 * after handling fault to make calling code simpler.
+	 */
+	hash = hugetlb_fault_mutex_hash(h, mapping, idx);
+	mutex_unlock(&hugetlb_fault_mutex_table[hash]);
+	ret = handle_userfault(&vmf, reason);
+	mutex_lock(&hugetlb_fault_mutex_table[hash]);
+
+	return ret;
+}
+
 static int hugetlb_no_page(struct mm_struct *mm, struct vm_area_struct *vma,
 			   struct address_space *mapping, pgoff_t idx,
 			   unsigned long address, pte_t *ptep, unsigned int flags)
@@ -3811,33 +3847,11 @@
 		if (idx >= size)
 			goto out;
 
-		/*
-		 * Check for page in userfault range
-		 */
+		/* Check for page in userfault range */
 		if (userfaultfd_missing(vma)) {
-			u32 hash;
-			struct vm_fault vmf = {
-				.vma = vma,
-				.address = address,
-				.flags = flags,
-				/*
-				 * Hard to debug if it ends up being
-				 * used by a callee that assumes
-				 * something about the other
-				 * uninitialized fields... same as in
-				 * memory.c
-				 */
-			};
-
-			/*
-			 * hugetlb_fault_mutex must be dropped before
-			 * handling userfault.  Reacquire after handling
-			 * fault to make calling code simpler.
-			 */
-			hash = hugetlb_fault_mutex_hash(h, mapping, idx);
-			mutex_unlock(&hugetlb_fault_mutex_table[hash]);
-			ret = handle_userfault(&vmf, VM_UFFD_MISSING);
-			mutex_lock(&hugetlb_fault_mutex_table[hash]);
+			ret = hugetlb_handle_userfault(vma, mapping, h,
+						       idx, flags, address,
+						       VM_UFFD_MISSING);
 			goto out;
 		}
 
@@ -3881,6 +3895,16 @@
 				VM_FAULT_SET_HINDEX(hstate_index(h));
 			goto backout_unlocked;
 		}
+
+		/* Check for page in userfault range. */
+		if (userfaultfd_minor(vma)) {
+			unlock_page(page);
+			put_page(page);
+			ret = hugetlb_handle_userfault(vma, mapping, h,
+						       idx, flags, address,
+						       VM_UFFD_MINOR);
+			goto out;
+		}
 	}
 
 	/*
@@ -3997,7 +4021,7 @@
 			return VM_FAULT_HWPOISON_LARGE |
 				VM_FAULT_SET_HINDEX(hstate_index(h));
 	} else {
-		ptep = huge_pte_alloc(mm, address, huge_page_size(h));
+		ptep = huge_pte_alloc(mm, vma, address, huge_page_size(h));
 		if (!ptep)
 			return VM_FAULT_OOM;
 	}
@@ -4109,6 +4133,7 @@
 	return ret;
 }
 
+#ifdef CONFIG_USERFAULTFD
 /*
  * Used by userfaultfd UFFDIO_COPY.  Based on mcopy_atomic_pte with
  * modifications for huge pages.
@@ -4118,8 +4143,10 @@
 			    struct vm_area_struct *dst_vma,
 			    unsigned long dst_addr,
 			    unsigned long src_addr,
+			    enum mcopy_atomic_mode mode,
 			    struct page **pagep)
 {
+	bool is_continue = (mode == MCOPY_ATOMIC_CONTINUE);
 	struct address_space *mapping;
 	pgoff_t idx;
 	unsigned long size;
@@ -4129,8 +4156,17 @@
 	spinlock_t *ptl;
 	int ret;
 	struct page *page;
+	int writable;
 
-	if (!*pagep) {
+	mapping = dst_vma->vm_file->f_mapping;
+	idx = vma_hugecache_offset(h, dst_vma, dst_addr);
+
+	if (is_continue) {
+		ret = -EFAULT;
+		page = find_lock_page(mapping, idx);
+		if (!page)
+			goto out;
+	} else if (!*pagep) {
 		/* If a page already exists, then it's UFFDIO_COPY for
 		 * a non-missing case. Return -EEXIST.
 		 */
@@ -4169,13 +4205,8 @@
 	 */
 	__SetPageUptodate(page);
 
-	mapping = dst_vma->vm_file->f_mapping;
-	idx = vma_hugecache_offset(h, dst_vma, dst_addr);
-
-	/*
-	 * If shared, add to page cache
-	 */
-	if (vm_shared) {
+	/* Add shared, newly allocated pages to the page cache. */
+	if (vm_shared && !is_continue) {
 		size = i_size_read(mapping->host) >> huge_page_shift(h);
 		ret = -EFAULT;
 		if (idx >= size)
@@ -4220,8 +4251,14 @@
 		hugepage_add_new_anon_rmap(page, dst_vma, dst_addr);
 	}
 
-	_dst_pte = make_huge_pte(dst_vma, page, dst_vma->vm_flags & VM_WRITE);
-	if (dst_vma->vm_flags & VM_WRITE)
+	/* For CONTINUE on a non-shared VMA, don't set VM_WRITE for CoW. */
+	if (is_continue && !vm_shared)
+		writable = 0;
+	else
+		writable = dst_vma->vm_flags & VM_WRITE;
+
+	_dst_pte = make_huge_pte(dst_vma, page, writable);
+	if (writable)
 		_dst_pte = huge_pte_mkdirty(_dst_pte);
 	_dst_pte = pte_mkyoung(_dst_pte);
 
@@ -4235,20 +4272,22 @@
 	update_mmu_cache(dst_vma, dst_addr, dst_pte);
 
 	spin_unlock(ptl);
-	set_page_huge_active(page);
-	if (vm_shared)
+	if (!is_continue)
+		set_page_huge_active(page);
+	if (vm_shared || is_continue)
 		unlock_page(page);
 	ret = 0;
 out:
 	return ret;
 out_release_unlock:
 	spin_unlock(ptl);
-	if (vm_shared)
+	if (vm_shared || is_continue)
 		unlock_page(page);
 out_release_nounlock:
 	put_page(page);
 	goto out;
 }
+#endif /* CONFIG_USERFAULTFD */
 
 long follow_hugetlb_page(struct mm_struct *mm, struct vm_area_struct *vma,
 			 struct page **pages, struct vm_area_struct **vmas,
@@ -4407,14 +4446,6 @@
 	return i ? i : err;
 }
 
-#ifndef __HAVE_ARCH_FLUSH_HUGETLB_TLB_RANGE
-/*
- * ARCHes with special requirements for evicting HUGETLB backing TLB entries can
- * implement this.
- */
-#define flush_hugetlb_tlb_range(vma, addr, end)	flush_tlb_range(vma, addr, end)
-#endif
-
 unsigned long hugetlb_change_protection(struct vm_area_struct *vma,
 		unsigned long address, unsigned long end, pgprot_t newprot)
 {
@@ -4688,6 +4719,15 @@
 	return false;
 }
 
+bool want_pmd_share(struct vm_area_struct *vma, unsigned long addr)
+{
+#ifdef CONFIG_USERFAULTFD
+	if (uffd_disable_huge_pmd_share(vma))
+		return false;
+#endif
+	return vma_shareable(vma, addr);
+}
+
 /*
  * Determine if start,end range within vma could be mapped by shared pmd.
  * If yes, adjust start and end to cover range associated with possible
@@ -4724,9 +4764,9 @@
  * racing tasks could either miss the sharing (see huge_pte_offset) or select a
  * bad pmd for sharing.
  */
-pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud)
+pte_t *huge_pmd_share(struct mm_struct *mm, struct vm_area_struct *vma,
+		      unsigned long addr, pud_t *pud)
 {
-	struct vm_area_struct *vma = find_vma(mm, addr);
 	struct address_space *mapping = vma->vm_file->f_mapping;
 	pgoff_t idx = ((addr - vma->vm_start) >> PAGE_SHIFT) +
 			vma->vm_pgoff;
@@ -4736,9 +4776,6 @@
 	pte_t *pte;
 	spinlock_t *ptl;
 
-	if (!vma_shareable(vma, addr))
-		return (pte_t *)pmd_alloc(mm, pud, addr);
-
 	i_mmap_lock_write(mapping);
 	vma_interval_tree_foreach(svma, &mapping->i_mmap, idx, idx) {
 		if (svma == vma)
@@ -4808,9 +4845,10 @@
 	*addr |= PUD_SIZE - PMD_SIZE;
 	return 1;
 }
-#define want_pmd_share()	(1)
+
 #else /* !CONFIG_ARCH_WANT_HUGE_PMD_SHARE */
-pte_t *huge_pmd_share(struct mm_struct *mm, unsigned long addr, pud_t *pud)
+pte_t *huge_pmd_share(struct mm_struct *mm, struct vm_area_struct vma,
+		      unsigned long addr, pud_t *pud)
 {
 	return NULL;
 }
@@ -4824,11 +4862,15 @@
 				unsigned long *start, unsigned long *end)
 {
 }
-#define want_pmd_share()	(0)
+
+bool want_pmd_share(struct vm_area_struct *vma, unsigned long addr)
+{
+	return false;
+}
 #endif /* CONFIG_ARCH_WANT_HUGE_PMD_SHARE */
 
 #ifdef CONFIG_ARCH_WANT_GENERAL_HUGETLB
-pte_t *huge_pte_alloc(struct mm_struct *mm,
+pte_t *huge_pte_alloc(struct mm_struct *mm, struct vm_area_struct *vma,
 			unsigned long addr, unsigned long sz)
 {
 	pgd_t *pgd;
@@ -4846,8 +4888,8 @@
 			pte = (pte_t *)pud;
 		} else {
 			BUG_ON(sz != PMD_SIZE);
-			if (want_pmd_share() && pud_none(*pud))
-				pte = huge_pmd_share(mm, addr, pud);
+			if (want_pmd_share(vma, addr) && pud_none(*pud))
+				pte = huge_pmd_share(mm, vma, addr, pud);
 			else
 				pte = (pte_t *)pmd_alloc(mm, pud, addr);
 		}
@@ -5003,3 +5045,52 @@
 	spin_unlock(&hugetlb_lock);
 	put_page(page);
 }
+
+/*
+ * This function will unconditionally remove all the shared pmd pgtable entries
+ * within the specific vma for a hugetlbfs memory range.
+ */
+void hugetlb_unshare_all_pmds(struct vm_area_struct *vma)
+{
+	struct hstate *h = hstate_vma(vma);
+	unsigned long sz = huge_page_size(h);
+	struct mm_struct *mm = vma->vm_mm;
+	unsigned long address, start, end;
+	spinlock_t *ptl;
+	pte_t *ptep;
+
+	if (!(vma->vm_flags & VM_MAYSHARE))
+		return;
+
+	start = ALIGN(vma->vm_start, PUD_SIZE);
+	end = ALIGN_DOWN(vma->vm_end, PUD_SIZE);
+
+	if (start >= end)
+		return;
+
+	/*
+	 * No need to call adjust_range_if_pmd_sharing_possible(), because
+	 * we have already done the PUD_SIZE alignment.
+	 */
+	mmu_notifier_invalidate_range_start(mm, start, end);
+	i_mmap_lock_write(vma->vm_file->f_mapping);
+	for (address = start; address < end; address += PUD_SIZE) {
+		unsigned long tmp = address;
+
+		ptep = huge_pte_offset(mm, address, sz);
+		if (!ptep)
+			continue;
+		ptl = huge_pte_lock(h, mm, ptep);
+		/* We don't want 'address' to be changed */
+		huge_pmd_unshare(mm, &tmp, ptep);
+		spin_unlock(ptl);
+	}
+	flush_hugetlb_tlb_range(vma, start, end);
+	i_mmap_unlock_write(vma->vm_file->f_mapping);
+	/*
+	 * No need to call mmu_notifier_invalidate_range(), see
+	 * Documentation/vm/mmu_notifier.rst.
+	 */
+	mmu_notifier_invalidate_range_end(mm, start, end);
+}
+

diff --git a/mm/memory.c b/mm/memory.c
index eac98dc..f268fb0 100644
--- a/mm/memory.c
+++ b/mm/memory.c

@@ -3766,9 +3766,11 @@
 	 * something).
 	 */
 	if (vma->vm_ops->map_pages && fault_around_bytes >> PAGE_SHIFT > 1) {
-		ret = do_fault_around(vmf);
-		if (ret)
-			return ret;
+		if (likely(!userfaultfd_minor(vmf->vma))) {
+			ret = do_fault_around(vmf);
+			if (ret)
+				return ret;
+		}
 	}
 
 	ret = __do_fault(vmf);

diff --git a/mm/mremap.c b/mm/mremap.c
index e1a04b9..9abb8f3 100644
--- a/mm/mremap.c
+++ b/mm/mremap.c

@@ -262,8 +262,8 @@
 static unsigned long move_vma(struct vm_area_struct *vma,
 		unsigned long old_addr, unsigned long old_len,
 		unsigned long new_len, unsigned long new_addr,
-		bool *locked, struct vm_userfaultfd_ctx *uf,
-		struct list_head *uf_unmap)
+		bool *locked, unsigned long flags,
+		struct vm_userfaultfd_ctx *uf, struct list_head *uf_unmap)
 {
 	struct mm_struct *mm = vma->vm_mm;
 	struct vm_area_struct *new_vma;
@@ -295,11 +295,19 @@
 	if (err)
 		return err;
 
+	if (unlikely(flags & MREMAP_DONTUNMAP && vm_flags & VM_ACCOUNT)) {
+		if (security_vm_enough_memory_mm(mm, new_len >> PAGE_SHIFT))
+			return -ENOMEM;
+	}
+
 	new_pgoff = vma->vm_pgoff + ((old_addr - vma->vm_start) >> PAGE_SHIFT);
 	new_vma = copy_vma(&vma, new_addr, new_len, new_pgoff,
 			   &need_rmap_locks);
-	if (!new_vma)
+	if (!new_vma) {
+		if (unlikely(flags & MREMAP_DONTUNMAP && vm_flags & VM_ACCOUNT))
+			vm_unacct_memory(new_len >> PAGE_SHIFT);
 		return -ENOMEM;
+	}
 
 	moved_len = move_page_tables(vma, old_addr, new_vma, new_addr, old_len,
 				     need_rmap_locks);
@@ -328,7 +336,7 @@
 	}
 
 	/* Conceal VM_ACCOUNT so old reservation is not undone */
-	if (vm_flags & VM_ACCOUNT) {
+	if (vm_flags & VM_ACCOUNT && !(flags & MREMAP_DONTUNMAP)) {
 		vma->vm_flags &= ~VM_ACCOUNT;
 		excess = vma->vm_end - vma->vm_start - old_len;
 		if (old_addr > vma->vm_start &&
@@ -352,11 +360,26 @@
 	if (unlikely(vma->vm_flags & VM_PFNMAP))
 		untrack_pfn_moved(vma);
 
+	if (unlikely(!err && (flags & MREMAP_DONTUNMAP))) {
+		/* We always clear VM_LOCKED[ONFAULT] on the old vma */
+		vma->vm_flags &= VM_LOCKED_CLEAR_MASK;
+
+		/* Because we won't unmap we don't need to touch locked_vm */
+		return new_addr;
+	}
+
 	if (do_munmap(mm, old_addr, old_len, uf_unmap) < 0) {
 		/* OOM: unable to split vma, just get accounts right */
-		vm_unacct_memory(excess >> PAGE_SHIFT);
+		if (vm_flags & VM_ACCOUNT && !(flags & MREMAP_DONTUNMAP))
+			vm_acct_memory(new_len >> PAGE_SHIFT);
 		excess = 0;
 	}
+
+	if (vm_flags & VM_LOCKED) {
+		mm->locked_vm += new_len >> PAGE_SHIFT;
+		*locked = true;
+	}
+
 	mm->hiwater_vm = hiwater_vm;
 
 	/* Restore VM_ACCOUNT if one or two pieces of vma left */
@@ -366,16 +389,12 @@
 			vma->vm_next->vm_flags |= VM_ACCOUNT;
 	}
 
-	if (vm_flags & VM_LOCKED) {
-		mm->locked_vm += new_len >> PAGE_SHIFT;
-		*locked = true;
-	}
-
 	return new_addr;
 }
 
 static struct vm_area_struct *vma_to_resize(unsigned long addr,
-	unsigned long old_len, unsigned long new_len, unsigned long *p)
+	unsigned long old_len, unsigned long new_len, unsigned long flags,
+	unsigned long *p)
 {
 	struct mm_struct *mm = current->mm;
 	struct vm_area_struct *vma = find_vma(mm, addr);
@@ -397,6 +416,10 @@
 		return ERR_PTR(-EINVAL);
 	}
 
+	if ((flags & MREMAP_DONTUNMAP) &&
+			(vma->vm_flags & (VM_DONTEXPAND | VM_PFNMAP)))
+		return ERR_PTR(-EINVAL);
+
 	if (is_vm_hugetlb_page(vma))
 		return ERR_PTR(-EINVAL);
 
@@ -441,7 +464,7 @@
 
 static unsigned long mremap_to(unsigned long addr, unsigned long old_len,
 		unsigned long new_addr, unsigned long new_len, bool *locked,
-		struct vm_userfaultfd_ctx *uf,
+		unsigned long flags, struct vm_userfaultfd_ctx *uf,
 		struct list_head *uf_unmap_early,
 		struct list_head *uf_unmap)
 {
@@ -449,7 +472,7 @@
 	struct vm_area_struct *vma;
 	unsigned long ret = -EINVAL;
 	unsigned long charged = 0;
-	unsigned long map_flags;
+	unsigned long map_flags = 0;
 
 	if (offset_in_page(new_addr))
 		goto out;
@@ -461,9 +484,11 @@
 	if (addr + old_len > new_addr && new_addr + new_len > addr)
 		goto out;
 
-	ret = do_munmap(mm, new_addr, new_len, uf_unmap_early);
-	if (ret)
-		goto out;
+	if (flags & MREMAP_FIXED) {
+		ret = do_munmap(mm, new_addr, new_len, uf_unmap_early);
+		if (ret)
+			goto out;
+	}
 
 	if (old_len >= new_len) {
 		ret = do_munmap(mm, addr+new_len, old_len - new_len, uf_unmap);
@@ -472,13 +497,22 @@
 		old_len = new_len;
 	}
 
-	vma = vma_to_resize(addr, old_len, new_len, &charged);
+	vma = vma_to_resize(addr, old_len, new_len, flags, &charged);
 	if (IS_ERR(vma)) {
 		ret = PTR_ERR(vma);
 		goto out;
 	}
 
-	map_flags = MAP_FIXED;
+	/* MREMAP_DONTUNMAP expands by old_len since old_len == new_len */
+	if (flags & MREMAP_DONTUNMAP &&
+		!may_expand_vm(mm, vma->vm_flags, old_len >> PAGE_SHIFT)) {
+		ret = -ENOMEM;
+		goto out;
+	}
+
+	if (flags & MREMAP_FIXED)
+		map_flags |= MAP_FIXED;
+
 	if (vma->vm_flags & VM_MAYSHARE)
 		map_flags |= MAP_SHARED;
 
@@ -488,10 +522,16 @@
 	if (offset_in_page(ret))
 		goto out1;
 
-	ret = move_vma(vma, addr, old_len, new_len, new_addr, locked, uf,
+	/* We got a new mapping */
+	if (!(flags & MREMAP_FIXED))
+		new_addr = ret;
+
+	ret = move_vma(vma, addr, old_len, new_len, new_addr, locked, flags, uf,
 		       uf_unmap);
+
 	if (!(offset_in_page(ret)))
 		goto out;
+
 out1:
 	vm_unacct_memory(charged);
 
@@ -534,12 +574,21 @@
 
 	addr = untagged_addr(addr);
 
-	if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
+	if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE | MREMAP_DONTUNMAP))
 		return ret;
 
 	if (flags & MREMAP_FIXED && !(flags & MREMAP_MAYMOVE))
 		return ret;
 
+	/*
+	 * MREMAP_DONTUNMAP is always a move and it does not allow resizing
+	 * in the process.
+	 */
+	if (flags & MREMAP_DONTUNMAP &&
+			(!(flags & MREMAP_MAYMOVE) || old_len != new_len))
+		return ret;
+
+
 	if (offset_in_page(addr))
 		return ret;
 
@@ -557,9 +606,10 @@
 	if (down_write_killable(&current->mm->mmap_sem))
 		return -EINTR;
 
-	if (flags & MREMAP_FIXED) {
+	if (flags & (MREMAP_FIXED | MREMAP_DONTUNMAP)) {
 		ret = mremap_to(addr, old_len, new_addr, new_len,
-				&locked, &uf, &uf_unmap_early, &uf_unmap);
+				&locked, flags, &uf, &uf_unmap_early,
+				&uf_unmap);
 		goto out;
 	}
 
@@ -579,7 +629,7 @@
 	/*
 	 * Ok, we need to grow..
 	 */
-	vma = vma_to_resize(addr, old_len, new_len, &charged);
+	vma = vma_to_resize(addr, old_len, new_len, flags, &charged);
 	if (IS_ERR(vma)) {
 		ret = PTR_ERR(vma);
 		goto out;
@@ -629,7 +679,7 @@
 		}
 
 		ret = move_vma(vma, addr, old_len, new_len, new_addr,
-			       &locked, &uf, &uf_unmap);
+			       &locked, flags, &uf, &uf_unmap);
 	}
 out:
 	if (offset_in_page(ret)) {
@@ -640,7 +690,7 @@
 	if (locked && new_len > old_len)
 		mm_populate(new_addr + old_len, new_len - old_len);
 	userfaultfd_unmap_complete(mm, &uf_unmap_early);
-	mremap_userfaultfd_complete(&uf, addr, new_addr, old_len);
+	mremap_userfaultfd_complete(&uf, addr, ret, old_len);
 	userfaultfd_unmap_complete(mm, &uf_unmap);
 	return ret;
 }

diff --git a/mm/shmem.c b/mm/shmem.c
index d368181..c6498c1 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c

@@ -74,7 +74,6 @@
 #include <linux/syscalls.h>
 #include <linux/fcntl.h>
 #include <uapi/linux/memfd.h>
-#include <linux/userfaultfd_k.h>
 #include <linux/rmap.h>
 #include <linux/uuid.h>
 
@@ -1607,8 +1606,8 @@
  * vm. If we swap it in we mark it dirty since we also free the swap
  * entry since a page cannot live in both the swap and page cache.
  *
- * fault_mm and fault_type are only supplied by shmem_fault:
- * otherwise they are NULL.
+ * vma, vmf, and fault_type are only supplied by shmem_fault: otherwise they
+ * are NULL.
  */
 static int shmem_getpage_gfp(struct inode *inode, pgoff_t index,
 	struct page **pagep, enum sgp_type sgp, gfp_t gfp,
@@ -1645,6 +1644,13 @@
 		goto unlock;
 	}
 
+	if (page && vma && userfaultfd_minor(vma)) {
+		unlock_page(page);
+		put_page(page);
+		*fault_type = handle_userfault(vmf, VM_UFFD_MINOR);
+		return 0;
+	}
+
 	if (page && sgp == SGP_WRITE)
 		mark_page_accessed(page);
 
@@ -2260,14 +2266,13 @@
 	return mapping->a_ops == &shmem_aops;
 }
 
-static int shmem_mfill_atomic_pte(struct mm_struct *dst_mm,
-				  pmd_t *dst_pmd,
-				  struct vm_area_struct *dst_vma,
-				  unsigned long dst_addr,
-				  unsigned long src_addr,
-				  bool zeropage,
-				  struct page **pagep)
+#ifdef CONFIG_USERFAULTFD
+int shmem_mcopy_atomic_pte(struct mm_struct *dst_mm, pmd_t *dst_pmd,
+			   struct vm_area_struct *dst_vma,
+			   unsigned long dst_addr, unsigned long src_addr,
+			   enum mcopy_atomic_mode mode, struct page **pagep)
 {
+	bool is_continue = (mode == MCOPY_ATOMIC_CONTINUE);
 	struct inode *inode = file_inode(dst_vma->vm_file);
 	struct shmem_inode_info *info = SHMEM_I(inode);
 	struct address_space *mapping = inode->i_mapping;
@@ -2295,12 +2300,17 @@
 		goto out;
 	}
 
-	if (!*pagep) {
+	if (is_continue) {
+		ret = -EFAULT;
+		page = find_lock_page(mapping, pgoff);
+		if (!page)
+			goto out_unacct_blocks;
+	} else if (!*pagep) {
 		page = shmem_alloc_page(gfp, info, pgoff);
 		if (!page)
 			goto out_unacct_blocks;
 
-		if (!zeropage) {	/* mcopy_atomic */
+		if (mode == MCOPY_ATOMIC_NORMAL) {	/* mcopy_atomic */
 			page_kaddr = kmap_atomic(page);
 			ret = copy_from_user(page_kaddr,
 					     (const void __user *)src_addr,
@@ -2314,7 +2324,7 @@
 				/* don't free the page */
 				return -ENOENT;
 			}
-		} else {		/* mfill_zeropage_atomic */
+		} else {		/* zeropage */
 			clear_highpage(page);
 		}
 	} else {
@@ -2322,10 +2332,13 @@
 		*pagep = NULL;
 	}
 
-	VM_BUG_ON(PageLocked(page) || PageSwapBacked(page));
-	__SetPageLocked(page);
-	__SetPageSwapBacked(page);
-	__SetPageUptodate(page);
+	if (!is_continue) {
+		VM_BUG_ON(PageSwapBacked(page));
+		VM_BUG_ON(PageLocked(page));
+		__SetPageLocked(page);
+		__SetPageSwapBacked(page);
+		__SetPageUptodate(page);
+	}
 
 	ret = -EFAULT;
 	offset = linear_page_index(dst_vma, dst_addr);
@@ -2333,19 +2346,22 @@
 	if (unlikely(offset >= max_off))
 		goto out_release;
 
-	ret = mem_cgroup_try_charge(page, dst_mm, gfp, &memcg, false);
-	if (ret)
-		goto out_release;
+	/* If page wasn't already in the page cache, add it. */
+	if (!is_continue) {
+		ret = mem_cgroup_try_charge(page, dst_mm, gfp, &memcg, false);
+		if (ret)
+			goto out_release;
 
-	ret = radix_tree_maybe_preload(gfp & GFP_RECLAIM_MASK);
-	if (!ret) {
-		ret = shmem_add_to_page_cache(page, mapping, pgoff, NULL);
-		radix_tree_preload_end();
+		ret = radix_tree_maybe_preload(gfp & GFP_RECLAIM_MASK);
+		if (!ret) {
+			ret = shmem_add_to_page_cache(page, mapping, pgoff, NULL);
+			radix_tree_preload_end();
+		}
+		if (ret)
+			goto out_release_uncharge;
+
+		mem_cgroup_commit_charge(page, memcg, false, false);
 	}
-	if (ret)
-		goto out_release_uncharge;
-
-	mem_cgroup_commit_charge(page, memcg, false, false);
 
 	_dst_pte = mk_pte(page, dst_vma->vm_page_prot);
 	if (dst_vma->vm_flags & VM_WRITE)
@@ -2372,13 +2388,15 @@
 	if (!pte_none(*dst_pte))
 		goto out_release_uncharge_unlock;
 
-	lru_cache_add_anon(page);
+	if (!is_continue) {
+		lru_cache_add_anon(page);
 
-	spin_lock_irq(&info->lock);
-	info->alloced++;
-	inode->i_blocks += BLOCKS_PER_PAGE;
-	shmem_recalc_inode(inode);
-	spin_unlock_irq(&info->lock);
+		spin_lock_irq(&info->lock);
+		info->alloced++;
+		inode->i_blocks += BLOCKS_PER_PAGE;
+		shmem_recalc_inode(inode);
+		spin_unlock_irq(&info->lock);
+	}
 
 	inc_mm_counter(dst_mm, mm_counter_file(page));
 	page_add_file_rmap(page, false);
@@ -2404,28 +2422,7 @@
 	shmem_inode_unacct_blocks(inode, 1);
 	goto out;
 }
-
-int shmem_mcopy_atomic_pte(struct mm_struct *dst_mm,
-			   pmd_t *dst_pmd,
-			   struct vm_area_struct *dst_vma,
-			   unsigned long dst_addr,
-			   unsigned long src_addr,
-			   struct page **pagep)
-{
-	return shmem_mfill_atomic_pte(dst_mm, dst_pmd, dst_vma,
-				      dst_addr, src_addr, false, pagep);
-}
-
-int shmem_mfill_zeropage_pte(struct mm_struct *dst_mm,
-			     pmd_t *dst_pmd,
-			     struct vm_area_struct *dst_vma,
-			     unsigned long dst_addr)
-{
-	struct page *page = NULL;
-
-	return shmem_mfill_atomic_pte(dst_mm, dst_pmd, dst_vma,
-				      dst_addr, 0, true, &page);
-}
+#endif /* CONFIG_USERFAULTFD */
 
 #ifdef CONFIG_TMPFS
 static const struct inode_operations shmem_symlink_inode_operations;

diff --git a/mm/userfaultfd.c b/mm/userfaultfd.c
index 3f08453..17bf210 100644
--- a/mm/userfaultfd.c
+++ b/mm/userfaultfd.c

@@ -180,7 +180,7 @@
 					      unsigned long dst_start,
 					      unsigned long src_start,
 					      unsigned long len,
-					      bool zeropage)
+					      enum mcopy_atomic_mode mode)
 {
 	int vm_alloc_shared = dst_vma->vm_flags & VM_SHARED;
 	int vm_shared = dst_vma->vm_flags & VM_SHARED;
@@ -201,7 +201,7 @@
 	 * by THP.  Since we can not reliably insert a zero page, this
 	 * feature is not supported.
 	 */
-	if (zeropage) {
+	if (mode == MCOPY_ATOMIC_ZEROPAGE) {
 		up_read(&dst_mm->mmap_sem);
 		return -EINVAL;
 	}
@@ -264,8 +264,6 @@
 	h = hstate_vma(dst_vma);
 
 	while (src_addr < src_start + len) {
-		pte_t dst_pteval;
-
 		BUG_ON(dst_addr >= dst_start + len);
 		VM_BUG_ON(dst_addr & ~huge_page_mask(h));
 
@@ -278,21 +276,21 @@
 		mutex_lock(&hugetlb_fault_mutex_table[hash]);
 
 		err = -ENOMEM;
-		dst_pte = huge_pte_alloc(dst_mm, dst_addr, huge_page_size(h));
+		dst_pte = huge_pte_alloc(dst_mm, dst_vma, dst_addr, huge_page_size(h));
 		if (!dst_pte) {
 			mutex_unlock(&hugetlb_fault_mutex_table[hash]);
 			goto out_unlock;
 		}
 
-		err = -EEXIST;
-		dst_pteval = huge_ptep_get(dst_pte);
-		if (!huge_pte_none(dst_pteval)) {
+		if (mode != MCOPY_ATOMIC_CONTINUE &&
+		    !huge_pte_none(huge_ptep_get(dst_pte))) {
+			err = -EEXIST;
 			mutex_unlock(&hugetlb_fault_mutex_table[hash]);
 			goto out_unlock;
 		}
 
 		err = hugetlb_mcopy_atomic_pte(dst_mm, dst_pte, dst_vma,
-						dst_addr, src_addr, &page);
+					       dst_addr, src_addr, mode, &page);
 
 		mutex_unlock(&hugetlb_fault_mutex_table[hash]);
 		vm_alloc_shared = vm_shared;
@@ -392,7 +390,7 @@
 				      unsigned long dst_start,
 				      unsigned long src_start,
 				      unsigned long len,
-				      bool zeropage);
+				      enum mcopy_atomic_mode mode);
 #endif /* CONFIG_HUGETLB_PAGE */
 
 static __always_inline ssize_t mfill_atomic_pte(struct mm_struct *dst_mm,
@@ -401,7 +399,7 @@
 						unsigned long dst_addr,
 						unsigned long src_addr,
 						struct page **page,
-						bool zeropage)
+						enum mcopy_atomic_mode mode)
 {
 	ssize_t err;
 
@@ -416,20 +414,22 @@
 	 * and not in the radix tree.
 	 */
 	if (!(dst_vma->vm_flags & VM_SHARED)) {
-		if (!zeropage)
+		switch (mode) {
+		case MCOPY_ATOMIC_NORMAL:
 			err = mcopy_atomic_pte(dst_mm, dst_pmd, dst_vma,
 					       dst_addr, src_addr, page);
-		else
+			break;
+		case MCOPY_ATOMIC_ZEROPAGE:
 			err = mfill_zeropage_pte(dst_mm, dst_pmd,
 						 dst_vma, dst_addr);
+			break;
+		case MCOPY_ATOMIC_CONTINUE:
+			err = -EINVAL;
+			break;
+		}
 	} else {
-		if (!zeropage)
-			err = shmem_mcopy_atomic_pte(dst_mm, dst_pmd,
-						     dst_vma, dst_addr,
-						     src_addr, page);
-		else
-			err = shmem_mfill_zeropage_pte(dst_mm, dst_pmd,
-						       dst_vma, dst_addr);
+		err = shmem_mcopy_atomic_pte(dst_mm, dst_pmd, dst_vma, dst_addr,
+					     src_addr, mode, page);
 	}
 
 	return err;
@@ -439,7 +439,8 @@
 					      unsigned long dst_start,
 					      unsigned long src_start,
 					      unsigned long len,
-					      bool zeropage)
+					      enum mcopy_atomic_mode mcopy_mode,
+					      bool *mmap_changing)
 {
 	struct vm_area_struct *dst_vma;
 	ssize_t err;
@@ -466,6 +467,15 @@
 	down_read(&dst_mm->mmap_sem);
 
 	/*
+	 * If memory mappings are changing because of non-cooperative
+	 * operation (e.g. mremap) running in parallel, bail out and
+	 * request the user to retry later
+	 */
+	err = -EAGAIN;
+	if (mmap_changing && READ_ONCE(*mmap_changing))
+		goto out_unlock;
+
+	/*
 	 * Make sure the vma is not shared, that the dst range is
 	 * both valid and fully within a single existing vma.
 	 */
@@ -499,10 +509,12 @@
 	 */
 	if (is_vm_hugetlb_page(dst_vma))
 		return  __mcopy_atomic_hugetlb(dst_mm, dst_vma, dst_start,
-						src_start, len, zeropage);
+						src_start, len, mcopy_mode);
 
 	if (!vma_is_anonymous(dst_vma) && !vma_is_shmem(dst_vma))
 		goto out_unlock;
+	if (!vma_is_shmem(dst_vma) && mcopy_mode == MCOPY_ATOMIC_CONTINUE)
+		goto out_unlock;
 
 	/*
 	 * Ensure the dst_vma has a anon_vma or this page
@@ -549,7 +561,7 @@
 		BUG_ON(pmd_trans_huge(*dst_pmd));
 
 		err = mfill_atomic_pte(dst_mm, dst_pmd, dst_vma, dst_addr,
-				       src_addr, &page, zeropage);
+				       src_addr, &page, mcopy_mode);
 		cond_resched();
 
 		if (unlikely(err == -ENOENT)) {
@@ -596,13 +608,24 @@
 }
 
 ssize_t mcopy_atomic(struct mm_struct *dst_mm, unsigned long dst_start,
-		     unsigned long src_start, unsigned long len)
+		     unsigned long src_start, unsigned long len,
+		     bool *mmap_changing)
 {
-	return __mcopy_atomic(dst_mm, dst_start, src_start, len, false);
+	return __mcopy_atomic(dst_mm, dst_start, src_start, len,
+			      MCOPY_ATOMIC_NORMAL, mmap_changing);
 }
 
 ssize_t mfill_zeropage(struct mm_struct *dst_mm, unsigned long start,
-		       unsigned long len)
+		       unsigned long len, bool *mmap_changing)
 {
-	return __mcopy_atomic(dst_mm, start, 0, len, true);
+	return __mcopy_atomic(dst_mm, start, 0, len, MCOPY_ATOMIC_ZEROPAGE,
+			      mmap_changing);
 }
+
+ssize_t mcopy_continue(struct mm_struct *dst_mm, unsigned long start,
+		       unsigned long len, bool *mmap_changing)
+{
+	return __mcopy_atomic(dst_mm, start, 0, len, MCOPY_ATOMIC_CONTINUE,
+			      mmap_changing);
+}
+

diff --git a/net/9p/client.c b/net/9p/client.c
index 8b1ec2f..09f7ddb 100644
--- a/net/9p/client.c
+++ b/net/9p/client.c

@@ -243,6 +243,8 @@
 	if (!fc)
 		return NULL;
 	fc->capacity = alloc_msize;
+	fc->id = 0;
+	fc->tag = P9_NOTAG;
 	fc->sdata = (char *) fc + sizeof(struct p9_fcall);
 	return fc;
 }

diff --git a/net/batman-adv/translation-table.c b/net/batman-adv/translation-table.c
index 850447c..70b7c65 100644
--- a/net/batman-adv/translation-table.c
+++ b/net/batman-adv/translation-table.c

@@ -4159,7 +4159,7 @@
 
 	spin_lock_bh(&bat_priv->tt.commit_lock);
 
-	while (true) {
+	while (timeout) {
 		table_size = batadv_tt_local_table_transmit_size(bat_priv);
 		if (packet_size_max >= table_size)
 			break;

diff --git a/net/bluetooth/hci_request.c b/net/bluetooth/hci_request.c
index cced1a8..98ee2e5 100644
--- a/net/bluetooth/hci_request.c
+++ b/net/bluetooth/hci_request.c

@@ -97,8 +97,10 @@
 	if (hdev->req_status == HCI_REQ_PEND) {
 		hdev->req_result = result;
 		hdev->req_status = HCI_REQ_DONE;
-		if (skb)
+		if (skb) {
+			kfree_skb(hdev->req_skb);
 			hdev->req_skb = skb_get(skb);
+		}
 		wake_up_interruptible(&hdev->req_wait_q);
 	}
 }

diff --git a/net/bluetooth/l2cap_core.c b/net/bluetooth/l2cap_core.c
index e52657f..b36d2e4 100644
--- a/net/bluetooth/l2cap_core.c
+++ b/net/bluetooth/l2cap_core.c

@@ -429,6 +429,9 @@
 
 	BT_DBG("chan %p state %s", chan, state_to_string(chan->state));
 
+	if (!conn)
+		return;
+
 	mutex_lock(&conn->chan_lock);
 	/* __set_chan_timer() calls l2cap_chan_hold(chan) while scheduling
 	 * this work. No need to call l2cap_chan_hold(chan) here again.

diff --git a/net/bluetooth/l2cap_sock.c b/net/bluetooth/l2cap_sock.c
index 70b86ef..89556de 100644
--- a/net/bluetooth/l2cap_sock.c
+++ b/net/bluetooth/l2cap_sock.c

@@ -406,7 +406,8 @@
 	struct l2cap_chan *chan = l2cap_pi(sk)->chan;
 	struct l2cap_options opts;
 	struct l2cap_conninfo cinfo;
-	int len, err = 0;
+	int err = 0;
+	size_t len;
 	u32 opt;
 
 	BT_DBG("sk %p", sk);
@@ -437,7 +438,7 @@
 		opts.max_tx   = chan->max_tx;
 		opts.txwin_size = chan->tx_win;
 
-		len = min_t(unsigned int, len, sizeof(opts));
+		len = min(len, sizeof(opts));
 		if (copy_to_user(optval, (char *) &opts, len))
 			err = -EFAULT;
 
@@ -487,7 +488,7 @@
 		cinfo.hci_handle = chan->conn->hcon->handle;
 		memcpy(cinfo.dev_class, chan->conn->hcon->dev_class, 3);
 
-		len = min_t(unsigned int, len, sizeof(cinfo));
+		len = min(len, sizeof(cinfo));
 		if (copy_to_user(optval, (char *) &cinfo, len))
 			err = -EFAULT;
 

diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index b3dd396..d289060 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c

@@ -82,6 +82,10 @@
 	struct sock *sk;
 
 	sco_conn_lock(conn);
+	if (!conn->hcon) {
+		sco_conn_unlock(conn);
+		return;
+	}
 	sk = conn->sk;
 	if (sk)
 		sock_hold(sk);
@@ -881,7 +885,8 @@
 	struct sock *sk = sock->sk;
 	struct sco_options opts;
 	struct sco_conninfo cinfo;
-	int len, err = 0;
+	int err = 0;
+	size_t len;
 
 	BT_DBG("sk %p", sk);
 
@@ -903,7 +908,7 @@
 
 		BT_DBG("mtu %d", opts.mtu);
 
-		len = min_t(unsigned int, len, sizeof(opts));
+		len = min(len, sizeof(opts));
 		if (copy_to_user(optval, (char *)&opts, len))
 			err = -EFAULT;
 
@@ -921,7 +926,7 @@
 		cinfo.hci_handle = sco_pi(sk)->conn->hcon->handle;
 		memcpy(cinfo.dev_class, sco_pi(sk)->conn->hcon->dev_class, 3);
 
-		len = min_t(unsigned int, len, sizeof(cinfo));
+		len = min(len, sizeof(cinfo));
 		if (copy_to_user(optval, (char *)&cinfo, len))
 			err = -EFAULT;
 

diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index 57f69f3..e7a5da3 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c

@@ -120,7 +120,7 @@
 
 	skb = skb_clone(skb, GFP_ATOMIC);
 	if (!skb) {
-		dev->stats.tx_dropped++;
+		DEV_STATS_INC(dev, tx_dropped);
 		return -ENOMEM;
 	}
 
@@ -235,6 +235,7 @@
 {
 	struct net_device *dev = BR_INPUT_SKB_CB(skb)->brdev;
 	const unsigned char *src = eth_hdr(skb)->h_source;
+	struct sk_buff *nskb;
 
 	if (!should_deliver(p, skb))
 		return;
@@ -243,12 +244,16 @@
 	if (skb->dev == p->dev && ether_addr_equal(src, addr))
 		return;
 
-	skb = skb_copy(skb, GFP_ATOMIC);
-	if (!skb) {
-		dev->stats.tx_dropped++;
+	__skb_push(skb, ETH_HLEN);
+	nskb = pskb_copy(skb, GFP_ATOMIC);
+	__skb_pull(skb, ETH_HLEN);
+	if (!nskb) {
+		DEV_STATS_INC(dev, tx_dropped);
 		return;
 	}
 
+	skb = nskb;
+	__skb_pull(skb, ETH_HLEN);
 	if (!is_broadcast_ether_addr(addr))
 		memcpy(eth_hdr(skb)->h_dest, addr, ETH_ALEN);
 

diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
index 07e7cf2..4146869 100644
--- a/net/bridge/br_input.c
+++ b/net/bridge/br_input.c

@@ -189,12 +189,12 @@
 			if ((mdst && mdst->mglist) ||
 			    br_multicast_is_router(br)) {
 				local_rcv = true;
-				br->dev->stats.multicast++;
+				DEV_STATS_INC(br->dev, multicast);
 			}
 			mcast_hit = true;
 		} else {
 			local_rcv = true;
-			br->dev->stats.multicast++;
+			DEV_STATS_INC(br->dev, multicast);
 		}
 		break;
 	case BR_PKT_UNICAST:

diff --git a/net/core/filter.c b/net/core/filter.c
index 333d287..71d144d 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c

@@ -2145,6 +2145,10 @@
 	u32 off = skb_mac_header_len(skb);
 	int ret;
 
+	/* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */
+	if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb)))
+		return -ENOTSUPP;
+
 	ret = skb_cow(skb, len_diff);
 	if (unlikely(ret < 0))
 		return ret;
@@ -2154,15 +2158,19 @@
 		return ret;
 
 	if (skb_is_gso(skb)) {
-		/* SKB_GSO_TCPV4 needs to be changed into SKB_GSO_TCPV6. */
-		if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV4) {
-			skb_shinfo(skb)->gso_type &= ~SKB_GSO_TCPV4;
-			skb_shinfo(skb)->gso_type |=  SKB_GSO_TCPV6;
+		struct skb_shared_info *shinfo = skb_shinfo(skb);
+
+		/* SKB_GSO_TCPV4 needs to be changed into
+		 * SKB_GSO_TCPV6.
+		 */
+		if (shinfo->gso_type & SKB_GSO_TCPV4) {
+			shinfo->gso_type &= ~SKB_GSO_TCPV4;
+			shinfo->gso_type |=  SKB_GSO_TCPV6;
 		}
 
 		/* Header must be checked, and gso_segs recomputed. */
-		skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY;
-		skb_shinfo(skb)->gso_segs = 0;
+		shinfo->gso_type |= SKB_GSO_DODGY;
+		shinfo->gso_segs = 0;
 	}
 
 	skb->protocol = htons(ETH_P_IPV6);
@@ -2177,6 +2185,10 @@
 	u32 off = skb_mac_header_len(skb);
 	int ret;
 
+	/* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */
+	if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb)))
+		return -ENOTSUPP;
+
 	ret = skb_unclone(skb, GFP_ATOMIC);
 	if (unlikely(ret < 0))
 		return ret;
@@ -2186,15 +2198,19 @@
 		return ret;
 
 	if (skb_is_gso(skb)) {
-		/* SKB_GSO_TCPV6 needs to be changed into SKB_GSO_TCPV4. */
-		if (skb_shinfo(skb)->gso_type & SKB_GSO_TCPV6) {
-			skb_shinfo(skb)->gso_type &= ~SKB_GSO_TCPV6;
-			skb_shinfo(skb)->gso_type |=  SKB_GSO_TCPV4;
+		struct skb_shared_info *shinfo = skb_shinfo(skb);
+
+		/* SKB_GSO_TCPV6 needs to be changed into
+		 * SKB_GSO_TCPV4.
+		 */
+		if (shinfo->gso_type & SKB_GSO_TCPV6) {
+			shinfo->gso_type &= ~SKB_GSO_TCPV6;
+			shinfo->gso_type |=  SKB_GSO_TCPV4;
 		}
 
 		/* Header must be checked, and gso_segs recomputed. */
-		skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY;
-		skb_shinfo(skb)->gso_segs = 0;
+		shinfo->gso_type |= SKB_GSO_DODGY;
+		shinfo->gso_segs = 0;
 	}
 
 	skb->protocol = htons(ETH_P_IP);
@@ -2293,6 +2309,10 @@
 	u32 off = skb_mac_header_len(skb) + bpf_skb_net_base_len(skb);
 	int ret;
 
+	/* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */
+	if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb)))
+		return -ENOTSUPP;
+
 	ret = skb_cow(skb, len_diff);
 	if (unlikely(ret < 0))
 		return ret;
@@ -2302,11 +2322,13 @@
 		return ret;
 
 	if (skb_is_gso(skb)) {
+		struct skb_shared_info *shinfo = skb_shinfo(skb);
+
 		/* Due to header grow, MSS needs to be downgraded. */
-		skb_shinfo(skb)->gso_size -= len_diff;
+		skb_decrease_gso_size(shinfo, len_diff);
 		/* Header must be checked, and gso_segs recomputed. */
-		skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY;
-		skb_shinfo(skb)->gso_segs = 0;
+		shinfo->gso_type |= SKB_GSO_DODGY;
+		shinfo->gso_segs = 0;
 	}
 
 	return 0;
@@ -2317,6 +2339,10 @@
 	u32 off = skb_mac_header_len(skb) + bpf_skb_net_base_len(skb);
 	int ret;
 
+	/* SCTP uses GSO_BY_FRAGS, thus cannot adjust it. */
+	if (skb_is_gso(skb) && unlikely(skb_is_gso_sctp(skb)))
+		return -ENOTSUPP;
+
 	ret = skb_unclone(skb, GFP_ATOMIC);
 	if (unlikely(ret < 0))
 		return ret;
@@ -2326,11 +2352,13 @@
 		return ret;
 
 	if (skb_is_gso(skb)) {
+		struct skb_shared_info *shinfo = skb_shinfo(skb);
+
 		/* Due to header shrink, MSS can be upgraded. */
-		skb_shinfo(skb)->gso_size += len_diff;
+		skb_increase_gso_size(shinfo, len_diff);
 		/* Header must be checked, and gso_segs recomputed. */
-		skb_shinfo(skb)->gso_type |= SKB_GSO_DODGY;
-		skb_shinfo(skb)->gso_segs = 0;
+		shinfo->gso_type |= SKB_GSO_DODGY;
+		shinfo->gso_segs = 0;
 	}
 
 	return 0;
@@ -3866,6 +3894,8 @@
 		switch (prog->expected_attach_type) {
 		case BPF_CGROUP_INET4_BIND:
 		case BPF_CGROUP_INET4_CONNECT:
+		case BPF_CGROUP_UDP4_SENDMSG:
+		case BPF_CGROUP_UDP4_RECVMSG:
 			break;
 		default:
 			return false;
@@ -3875,6 +3905,25 @@
 		switch (prog->expected_attach_type) {
 		case BPF_CGROUP_INET6_BIND:
 		case BPF_CGROUP_INET6_CONNECT:
+		case BPF_CGROUP_UDP6_SENDMSG:
+		case BPF_CGROUP_UDP6_RECVMSG:
+			break;
+		default:
+			return false;
+		}
+		break;
+	case bpf_ctx_range(struct bpf_sock_addr, msg_src_ip4):
+		switch (prog->expected_attach_type) {
+		case BPF_CGROUP_UDP4_SENDMSG:
+			break;
+		default:
+			return false;
+		}
+		break;
+	case bpf_ctx_range_till(struct bpf_sock_addr, msg_src_ip6[0],
+				msg_src_ip6[3]):
+		switch (prog->expected_attach_type) {
+		case BPF_CGROUP_UDP6_SENDMSG:
 			break;
 		default:
 			return false;
@@ -3885,6 +3934,9 @@
 	switch (off) {
 	case bpf_ctx_range(struct bpf_sock_addr, user_ip4):
 	case bpf_ctx_range_till(struct bpf_sock_addr, user_ip6[0], user_ip6[3]):
+	case bpf_ctx_range(struct bpf_sock_addr, msg_src_ip4):
+	case bpf_ctx_range_till(struct bpf_sock_addr, msg_src_ip6[0],
+				msg_src_ip6[3]):
 		/* Only narrow read access allowed for now. */
 		if (type == BPF_READ) {
 			bpf_ctx_record_field_size(info, size_default);
@@ -4560,6 +4612,23 @@
 		*insn++ = BPF_ALU32_IMM(BPF_RSH, si->dst_reg,
 					SK_FL_PROTO_SHIFT);
 		break;
+
+	case offsetof(struct bpf_sock_addr, msg_src_ip4):
+		/* Treat t_ctx as struct in_addr for msg_src_ip4. */
+		SOCK_ADDR_LOAD_OR_STORE_NESTED_FIELD_SIZE_OFF(
+			struct bpf_sock_addr_kern, struct in_addr, t_ctx,
+			s_addr, BPF_SIZE(si->code), 0, tmp_reg);
+		break;
+
+	case bpf_ctx_range_till(struct bpf_sock_addr, msg_src_ip6[0],
+				msg_src_ip6[3]):
+		off = si->off;
+		off -= offsetof(struct bpf_sock_addr, msg_src_ip6[0]);
+		/* Treat t_ctx as struct in6_addr for msg_src_ip6. */
+		SOCK_ADDR_LOAD_OR_STORE_NESTED_FIELD_SIZE_OFF(
+			struct bpf_sock_addr_kern, struct in6_addr, t_ctx,
+			s6_addr32[0], BPF_SIZE(si->code), off, tmp_reg);
+		break;
 	}
 
 	return insn - insn_buf;

diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 34fd852..394f6f2 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c

@@ -51,12 +51,15 @@
 
 static struct net_generic *net_alloc_generic(void)
 {
+	unsigned int gen_ptrs = READ_ONCE(max_gen_ptrs);
+	unsigned int generic_size;
 	struct net_generic *ng;
-	unsigned int generic_size = offsetof(struct net_generic, ptr[max_gen_ptrs]);
+
+	generic_size = offsetof(struct net_generic, ptr[gen_ptrs]);
 
 	ng = kzalloc(generic_size, GFP_KERNEL);
 	if (ng)
-		ng->s.len = max_gen_ptrs;
+		ng->s.len = gen_ptrs;
 
 	return ng;
 }
@@ -954,7 +957,11 @@
 			}
 			return error;
 		}
-		max_gen_ptrs = max(max_gen_ptrs, *ops->id + 1);
+		/* This does not require READ_ONCE as writers already hold
+		 * pernet_ops_rwsem. But WRITE_ONCE is needed to protect
+		 * net_alloc_generic.
+		 */
+		WRITE_ONCE(max_gen_ptrs, max(max_gen_ptrs, *ops->id + 1));
 	}
 	error = __register_pernet_operations(list, ops);
 	if (error) {

diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
index 8532539..ed3c304 100644
--- a/net/core/rtnetlink.c
+++ b/net/core/rtnetlink.c

@@ -1802,7 +1802,7 @@
 
 		nla_for_each_nested(attr, tb[IFLA_VF_VLAN_LIST], rem) {
 			if (nla_type(attr) != IFLA_VF_VLAN_INFO ||
-			    nla_len(attr) < NLA_HDRLEN) {
+			    nla_len(attr) < sizeof(struct ifla_vf_vlan_info)) {
 				return -EINVAL;
 			}
 			if (len >= MAX_VLAN_LIST_LEN)

diff --git a/net/core/sock.c b/net/core/sock.c
index 044e864..ff3006f 100644
--- a/net/core/sock.c
+++ b/net/core/sock.c

@@ -453,7 +453,7 @@
 	unsigned long flags;
 	struct sk_buff_head *list = &sk->sk_receive_queue;
 
-	if (atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf) {
+	if (atomic_read(&sk->sk_rmem_alloc) >= READ_ONCE(sk->sk_rcvbuf)) {
 		atomic_inc(&sk->sk_drops);
 		trace_sock_rcvqueue_full(sk, skb);
 		return -ENOMEM;
@@ -505,7 +505,7 @@
 
 	skb->dev = NULL;
 
-	if (sk_rcvqueues_full(sk, sk->sk_rcvbuf)) {
+	if (sk_rcvqueues_full(sk, READ_ONCE(sk->sk_rcvbuf))) {
 		atomic_inc(&sk->sk_drops);
 		goto discard_and_relse;
 	}

diff --git a/net/ethernet/eth.c b/net/ethernet/eth.c
index 7e0e5f2..9d9f6f5 100644
--- a/net/ethernet/eth.c
+++ b/net/ethernet/eth.c

@@ -165,15 +165,7 @@
 	eth = (struct ethhdr *)skb->data;
 	skb_pull_inline(skb, ETH_HLEN);
 
-	if (unlikely(is_multicast_ether_addr_64bits(eth->h_dest))) {
-		if (ether_addr_equal_64bits(eth->h_dest, dev->broadcast))
-			skb->pkt_type = PACKET_BROADCAST;
-		else
-			skb->pkt_type = PACKET_MULTICAST;
-	}
-	else if (unlikely(!ether_addr_equal_64bits(eth->h_dest,
-						   dev->dev_addr)))
-		skb->pkt_type = PACKET_OTHERHOST;
+	eth_skb_pkt_type(skb, dev);
 
 	/*
 	 * Some variants of DSA tagging don't have an ethertype field

diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 183b5f2..6fb2977 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c

@@ -141,7 +141,8 @@
 static struct dst_entry *ipv4_dst_check(struct dst_entry *dst, u32 cookie);
 static unsigned int	 ipv4_default_advmss(const struct dst_entry *dst);
 static unsigned int	 ipv4_mtu(const struct dst_entry *dst);
-static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst);
+static void		ipv4_negative_advice(struct sock *sk,
+					     struct dst_entry *dst);
 static void		 ipv4_link_failure(struct sk_buff *skb);
 static void		 ip_rt_update_pmtu(struct dst_entry *dst, struct sock *sk,
 					   struct sk_buff *skb, u32 mtu,
@@ -863,22 +864,15 @@
 	__ip_do_redirect(rt, skb, &fl4, true);
 }
 
-static struct dst_entry *ipv4_negative_advice(struct dst_entry *dst)
+static void ipv4_negative_advice(struct sock *sk,
+				 struct dst_entry *dst)
 {
 	struct rtable *rt = (struct rtable *)dst;
-	struct dst_entry *ret = dst;
 
-	if (rt) {
-		if (dst->obsolete > 0) {
-			ip_rt_put(rt);
-			ret = NULL;
-		} else if ((rt->rt_flags & RTCF_REDIRECTED) ||
-			   rt->dst.expires) {
-			ip_rt_put(rt);
-			ret = NULL;
-		}
-	}
-	return ret;
+	if ((dst->obsolete > 0) ||
+	    (rt->rt_flags & RTCF_REDIRECTED) ||
+	    rt->dst.expires)
+		sk_dst_reset(sk);
 }
 
 /*
@@ -952,13 +946,11 @@
 		icmp_send(skb, ICMP_REDIRECT, ICMP_REDIR_HOST, gw);
 		peer->rate_last = jiffies;
 		++peer->n_redirects;
-#ifdef CONFIG_IP_ROUTE_VERBOSE
-		if (log_martians &&
+		if (IS_ENABLED(CONFIG_IP_ROUTE_VERBOSE) && log_martians &&
 		    peer->n_redirects == ip_rt_redirect_number)
 			net_warn_ratelimited("host %pI4/if%d ignores redirects for %pI4 to %pI4\n",
 					     &ip_hdr(skb)->saddr, inet_iif(skb),
 					     &ip_hdr(skb)->daddr, &gw);
-#endif
 	}
 out_put_peer:
 	inet_putpeer(peer);

diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 21d5355..fd6ee2f 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c

@@ -2281,7 +2281,7 @@
 	/* If we've already sent a FIN, or it's a closed state, skip this. */
 	if ((1 << sk->sk_state) &
 	    (TCPF_ESTABLISHED | TCPF_SYN_SENT |
-	     TCPF_SYN_RECV | TCPF_CLOSE_WAIT)) {
+	     TCPF_CLOSE_WAIT)) {
 		/* Clear out any half completed packets.  FIN if needed. */
 		if (tcp_close_state(sk))
 #ifdef CONFIG_MPTCP
@@ -2381,7 +2381,7 @@
 		 * machine. State transitions:
 		 *
 		 * TCP_ESTABLISHED -> TCP_FIN_WAIT1
-		 * TCP_SYN_RECV	-> TCP_FIN_WAIT1 (forget it, it's impossible)
+		 * TCP_SYN_RECV	-> TCP_FIN_WAIT1 (it is difficult)
 		 * TCP_CLOSE_WAIT -> TCP_LAST_ACK
 		 *
 		 * are legal only when FIN has been sent (i.e. in window),

diff --git a/net/ipv4/tcp_dctcp.c b/net/ipv4/tcp_dctcp.c
index f0de9fb..ff720fc 100644
--- a/net/ipv4/tcp_dctcp.c
+++ b/net/ipv4/tcp_dctcp.c

@@ -59,7 +59,18 @@
 };
 
 static unsigned int dctcp_shift_g __read_mostly = 4; /* g = 1/2^4 */
-module_param(dctcp_shift_g, uint, 0644);
+
+static int dctcp_shift_g_set(const char *val, const struct kernel_param *kp)
+{
+	return param_set_uint_minmax(val, kp, 0, 10);
+}
+
+static const struct kernel_param_ops dctcp_shift_g_ops = {
+	.set = dctcp_shift_g_set,
+	.get = param_get_uint,
+};
+
+module_param_cb(dctcp_shift_g, &dctcp_shift_g_ops, &dctcp_shift_g, 0644);
 MODULE_PARM_DESC(dctcp_shift_g, "parameter g for updating dctcp_alpha");
 
 static unsigned int dctcp_alpha_on_init __read_mostly = DCTCP_MAX_ALPHA;

diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c
index 3950de8..f8bf8aa 100644
--- a/net/ipv4/tcp_input.c
+++ b/net/ipv4/tcp_input.c

@@ -6849,6 +6849,8 @@
 				tcp_send_ack(sk);
 		}
 #endif
+		if (sk->sk_shutdown & SEND_SHUTDOWN)
+			tcp_shutdown(sk, SEND_SHUTDOWN);
 		break;
 
 	case TCP_FIN_WAIT1: {

diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index d846a82..c46c200 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c

@@ -3351,7 +3351,6 @@
 	 * as TCP stack thinks it has already been transmitted.
 	 */
 	if (tskb && (tcp_send_head(sk) || tcp_under_memory_pressure(sk))) {
-coalesce:
 		TCP_SKB_CB(tskb)->tcp_flags |= TCPHDR_FIN;
 		TCP_SKB_CB(tskb)->end_seq++;
 		tp->write_seq++;
@@ -3366,12 +3365,12 @@
 			return;
 		}
 	} else {
-		skb = alloc_skb_fclone(MAX_TCP_HEADER, sk->sk_allocation);
-		if (unlikely(!skb)) {
-			if (tskb)
-				goto coalesce;
+		skb = alloc_skb_fclone(MAX_TCP_HEADER,
+				       sk_gfp_mask(sk, GFP_ATOMIC |
+						       __GFP_NOWARN));
+		if (unlikely(!skb))
 			return;
-		}
+
 		skb_reserve(skb, MAX_TCP_HEADER);
 		sk_forced_mem_schedule(sk, skb->truesize);
 		/* FIN eats a sequence byte, write_seq advanced by tcp_queue_skb(). */

diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index f868d86..e9e8254 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c

@@ -874,6 +874,7 @@
 {
 	struct inet_sock *inet = inet_sk(sk);
 	struct udp_sock *up = udp_sk(sk);
+	DECLARE_SOCKADDR(struct sockaddr_in *, usin, msg->msg_name);
 	struct flowi4 fl4_stack;
 	struct flowi4 *fl4;
 	int ulen = len;
@@ -928,8 +929,7 @@
 	/*
 	 *	Get and verify the address.
 	 */
-	if (msg->msg_name) {
-		DECLARE_SOCKADDR(struct sockaddr_in *, usin, msg->msg_name);
+	if (usin) {
 		if (msg->msg_namelen < sizeof(*usin))
 			return -EINVAL;
 		if (usin->sin_family != AF_INET) {
@@ -979,6 +979,22 @@
 		rcu_read_unlock();
 	}
 
+	if (cgroup_bpf_enabled && !connected) {
+		err = BPF_CGROUP_RUN_PROG_UDP4_SENDMSG_LOCK(sk,
+					    (struct sockaddr *)usin, &ipc.addr);
+		if (err)
+			goto out_free;
+		if (usin) {
+			if (usin->sin_port == 0) {
+				/* BPF program set invalid port. Reject it. */
+				err = -EINVAL;
+				goto out_free;
+			}
+			daddr = usin->sin_addr.s_addr;
+			dport = usin->sin_port;
+		}
+	}
+
 	saddr = ipc.addr;
 	ipc.addr = faddr = daddr;
 
@@ -1673,6 +1689,10 @@
 		sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
 		memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
 		*addr_len = sizeof(*sin);
+
+		if (cgroup_bpf_enabled)
+			BPF_CGROUP_RUN_PROG_UDP4_RECVMSG_LOCK(sk,
+							(struct sockaddr *)sin);
 	}
 	if (inet->cmsg_flags)
 		ip_cmsg_recv_offset(msg, sk, skb, sizeof(struct udphdr), off);

diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index aa88270..d9ea1b0 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c

@@ -1950,9 +1950,10 @@
 		if (ipv6_addr_equal(&ifp->addr, addr)) {
 			if (!dev || ifp->idev->dev == dev ||
 			    !(ifp->scope&(IFA_LINK|IFA_HOST) || strict)) {
-				result = ifp;
-				in6_ifa_hold(ifp);
-				break;
+				if (in6_ifa_hold_safe(ifp)) {
+					result = ifp;
+					break;
+				}
 			}
 		}
 	}

diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c
index 5ecec10..1e19fdb 100644
--- a/net/ipv6/fib6_rules.c
+++ b/net/ipv6/fib6_rules.c

@@ -94,6 +94,31 @@
 	return &net->ipv6.ip6_null_entry->dst;
 }
 
+static int fib6_rule_saddr(struct net *net, struct fib_rule *rule, int flags,
+			   struct flowi6 *flp6, const struct net_device *dev)
+{
+	struct fib6_rule *r = (struct fib6_rule *)rule;
+
+	/* If we need to find a source address for this traffic,
+	 * we check the result if it meets requirement of the rule.
+	 */
+	if ((rule->flags & FIB_RULE_FIND_SADDR) &&
+	    r->src.plen && !(flags & RT6_LOOKUP_F_HAS_SADDR)) {
+		struct in6_addr saddr;
+
+		if (ipv6_dev_get_saddr(net, dev, &flp6->daddr,
+				       rt6_flags2srcprefs(flags), &saddr))
+			return -EAGAIN;
+
+		if (!ipv6_prefix_equal(&saddr, &r->src.addr, r->src.plen))
+			return -EAGAIN;
+
+		flp6->saddr = saddr;
+	}
+
+	return 0;
+}
+
 static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp,
 			    int flags, struct fib_lookup_arg *arg)
 {
@@ -132,27 +157,16 @@
 
 	rt = lookup(net, table, flp6, flags);
 	if (rt != net->ipv6.ip6_null_entry) {
-		struct fib6_rule *r = (struct fib6_rule *)rule;
+		struct inet6_dev *idev = ip6_dst_idev(&rt->dst);
 
-		/*
-		 * If we need to find a source address for this traffic,
-		 * we check the result if it meets requirement of the rule.
-		 */
-		if ((rule->flags & FIB_RULE_FIND_SADDR) &&
-		    r->src.plen && !(flags & RT6_LOOKUP_F_HAS_SADDR)) {
-			struct in6_addr saddr;
+		if (!idev)
+			goto again;
+		err = fib6_rule_saddr(net, rule, flags, flp6,
+				      idev->dev);
 
-			if (ipv6_dev_get_saddr(net,
-					       ip6_dst_idev(&rt->dst)->dev,
-					       &flp6->daddr,
-					       rt6_flags2srcprefs(flags),
-					       &saddr))
-				goto again;
-			if (!ipv6_prefix_equal(&saddr, &r->src.addr,
-					       r->src.plen))
-				goto again;
-			flp6->saddr = saddr;
-		}
+		if (err == -EAGAIN)
+			goto again;
+
 		err = rt->dst.error;
 		if (err != -EAGAIN)
 			goto out;

diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index b2344d4..42d4ffd 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c

@@ -81,7 +81,8 @@
 static struct dst_entry	*ip6_dst_check(struct dst_entry *dst, u32 cookie);
 static unsigned int	 ip6_default_advmss(const struct dst_entry *dst);
 static unsigned int	 ip6_mtu(const struct dst_entry *dst);
-static struct dst_entry *ip6_negative_advice(struct dst_entry *);
+static void		ip6_negative_advice(struct sock *sk,
+					    struct dst_entry *dst);
 static void		ip6_dst_destroy(struct dst_entry *);
 static void		ip6_dst_ifdown(struct dst_entry *,
 				       struct net_device *dev, int how);
@@ -1415,22 +1416,24 @@
 		return rt6_check(rt, cookie);
 }
 
-static struct dst_entry *ip6_negative_advice(struct dst_entry *dst)
+static void ip6_negative_advice(struct sock *sk,
+				struct dst_entry *dst)
 {
 	struct rt6_info *rt = (struct rt6_info *) dst;
 
-	if (rt) {
-		if (rt->rt6i_flags & RTF_CACHE) {
-			if (rt6_check_expired(rt)) {
-				ip6_del_rt(rt);
-				dst = NULL;
-			}
-		} else {
-			dst_release(dst);
-			dst = NULL;
+	if (rt->rt6i_flags & RTF_CACHE) {
+		rcu_read_lock();
+		if (rt6_check_expired(rt)) {
+			/* counteract the dst_release() in sk_dst_reset() */
+			dst_hold(dst);
+			sk_dst_reset(sk);
+
+			ip6_del_rt(rt);
 		}
+		rcu_read_unlock();
+		return;
 	}
-	return dst;
+	sk_dst_reset(sk);
 }
 
 static void ip6_link_failure(struct sk_buff *skb)

diff --git a/net/ipv6/seg6.c b/net/ipv6/seg6.c
index b785bf5..00d8f76 100644
--- a/net/ipv6/seg6.c
+++ b/net/ipv6/seg6.c

@@ -486,6 +486,8 @@
 #endif
 #ifdef CONFIG_IPV6_SEG6_LWTUNNEL
 out_unregister_genl:
+#endif
+#if IS_ENABLED(CONFIG_IPV6_SEG6_LWTUNNEL) || IS_ENABLED(CONFIG_IPV6_SEG6_HMAC)
 	genl_unregister_family(&seg6_genl_family);
 #endif
 out_unregister_pernet:
@@ -499,8 +501,9 @@
 	seg6_hmac_exit();
 #endif
 #ifdef CONFIG_IPV6_SEG6_LWTUNNEL
+	seg6_local_exit();
 	seg6_iptunnel_exit();
 #endif
-	unregister_pernet_subsys(&ip6_segments_ops);
 	genl_unregister_family(&seg6_genl_family);
+	unregister_pernet_subsys(&ip6_segments_ops);
 }

diff --git a/net/ipv6/seg6_hmac.c b/net/ipv6/seg6_hmac.c
index 73ef23d..1e609e9 100644
--- a/net/ipv6/seg6_hmac.c
+++ b/net/ipv6/seg6_hmac.c

@@ -360,6 +360,7 @@
 	struct crypto_shash *tfm;
 	struct shash_desc *shash;
 	int i, alg_count, cpu;
+	int ret = -ENOMEM;
 
 	alg_count = ARRAY_SIZE(hmac_algos);
 
@@ -370,12 +371,14 @@
 		algo = &hmac_algos[i];
 		algo->tfms = alloc_percpu(struct crypto_shash *);
 		if (!algo->tfms)
-			return -ENOMEM;
+			goto error_out;
 
 		for_each_possible_cpu(cpu) {
 			tfm = crypto_alloc_shash(algo->name, 0, 0);
-			if (IS_ERR(tfm))
-				return PTR_ERR(tfm);
+			if (IS_ERR(tfm)) {
+				ret = PTR_ERR(tfm);
+				goto error_out;
+			}
 			p_tfm = per_cpu_ptr(algo->tfms, cpu);
 			*p_tfm = tfm;
 		}
@@ -387,18 +390,22 @@
 
 		algo->shashs = alloc_percpu(struct shash_desc *);
 		if (!algo->shashs)
-			return -ENOMEM;
+			goto error_out;
 
 		for_each_possible_cpu(cpu) {
 			shash = kzalloc_node(shsize, GFP_KERNEL,
 					     cpu_to_node(cpu));
 			if (!shash)
-				return -ENOMEM;
+				goto error_out;
 			*per_cpu_ptr(algo->shashs, cpu) = shash;
 		}
 	}
 
 	return 0;
+
+error_out:
+	seg6_hmac_exit();
+	return ret;
 }
 
 int __init seg6_hmac_init(void)
@@ -418,22 +425,29 @@
 void seg6_hmac_exit(void)
 {
 	struct seg6_hmac_algo *algo = NULL;
+	struct crypto_shash *tfm;
+	struct shash_desc *shash;
 	int i, alg_count, cpu;
 
 	alg_count = ARRAY_SIZE(hmac_algos);
 	for (i = 0; i < alg_count; i++) {
 		algo = &hmac_algos[i];
-		for_each_possible_cpu(cpu) {
-			struct crypto_shash *tfm;
-			struct shash_desc *shash;
 
-			shash = *per_cpu_ptr(algo->shashs, cpu);
-			kfree(shash);
-			tfm = *per_cpu_ptr(algo->tfms, cpu);
-			crypto_free_shash(tfm);
+		if (algo->shashs) {
+			for_each_possible_cpu(cpu) {
+				shash = *per_cpu_ptr(algo->shashs, cpu);
+				kfree(shash);
+			}
+			free_percpu(algo->shashs);
 		}
-		free_percpu(algo->tfms);
-		free_percpu(algo->shashs);
+
+		if (algo->tfms) {
+			for_each_possible_cpu(cpu) {
+				tfm = *per_cpu_ptr(algo->tfms, cpu);
+				crypto_free_shash(tfm);
+			}
+			free_percpu(algo->tfms);
+		}
 	}
 }
 EXPORT_SYMBOL(seg6_hmac_exit);

diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 4463361..7906642 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c

@@ -461,6 +461,10 @@
 						    inet6_iif(skb));
 		}
 		*addr_len = sizeof(*sin6);
+
+		if (cgroup_bpf_enabled)
+			BPF_CGROUP_RUN_PROG_UDP6_RECVMSG_LOCK(sk,
+						(struct sockaddr *)sin6);
 	}
 
 	if (np->rxopt.all)
@@ -1349,6 +1353,29 @@
 		fl6.saddr = np->saddr;
 	fl6.fl6_sport = inet->inet_sport;
 
+	if (cgroup_bpf_enabled && !connected) {
+		err = BPF_CGROUP_RUN_PROG_UDP6_SENDMSG_LOCK(sk,
+					   (struct sockaddr *)sin6, &fl6.saddr);
+		if (err)
+			goto out_no_dst;
+		if (sin6) {
+			if (ipv6_addr_v4mapped(&sin6->sin6_addr)) {
+				/* BPF program rewrote IPv6-only by IPv4-mapped
+				 * IPv6. It's currently unsupported.
+				 */
+				err = -ENOTSUPP;
+				goto out_no_dst;
+			}
+			if (sin6->sin6_port == 0) {
+				/* BPF program set invalid port. Reject it. */
+				err = -EINVAL;
+				goto out_no_dst;
+			}
+			fl6.fl6_dport = sin6->sin6_port;
+			fl6.daddr = sin6->sin6_addr;
+		}
+	}
+
 	final_p = fl6_update_dst(&fl6, opt, &final);
 	if (final_p)
 		connected = 0;
@@ -1444,6 +1471,7 @@
 
 out:
 	dst_release(dst);
+out_no_dst:
 	fl6_sock_release(flowlabel);
 	txopt_put(opt_to_free);
 	if (!err)

diff --git a/net/l2tp/l2tp_eth.c b/net/l2tp/l2tp_eth.c
index d29bfee..22f4db9 100644
--- a/net/l2tp/l2tp_eth.c
+++ b/net/l2tp/l2tp_eth.c

@@ -159,6 +159,9 @@
 	/* checksums verified by L2TP */
 	skb->ip_summed = CHECKSUM_NONE;
 
+	/* drop outer flow-hash */
+	skb_clear_hash(skb);
+
 	skb_dst_drop(skb);
 	nf_reset(skb);
 

diff --git a/net/mac80211/ieee80211_i.h b/net/mac80211/ieee80211_i.h
index 7c8d77d..7e994a4 100644
--- a/net/mac80211/ieee80211_i.h
+++ b/net/mac80211/ieee80211_i.h

@@ -112,7 +112,7 @@
 };
 
 /**
- * enum ieee80211_corrupt_data_flags - BSS data corruption flags
+ * enum ieee80211_bss_corrupt_data_flags - BSS data corruption flags
  * @IEEE80211_BSS_CORRUPT_BEACON: last beacon frame received was corrupted
  * @IEEE80211_BSS_CORRUPT_PROBE_RESP: last probe response received was corrupted
  *
@@ -125,7 +125,7 @@
 };
 
 /**
- * enum ieee80211_valid_data_flags - BSS valid data flags
+ * enum ieee80211_bss_valid_data_flags - BSS valid data flags
  * @IEEE80211_BSS_VALID_WMM: WMM/UAPSD data was gathered from non-corrupt IE
  * @IEEE80211_BSS_VALID_RATES: Supported rates were gathered from non-corrupt IE
  * @IEEE80211_BSS_VALID_ERP: ERP flag was gathered from non-corrupt IE

diff --git a/net/netfilter/ipvs/ip_vs_proto_sctp.c b/net/netfilter/ipvs/ip_vs_proto_sctp.c
index eff7569..aaf04e4 100644
--- a/net/netfilter/ipvs/ip_vs_proto_sctp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c

@@ -123,7 +123,8 @@
 	if (sctph->source != cp->vport || payload_csum ||
 	    skb->ip_summed == CHECKSUM_PARTIAL) {
 		sctph->source = cp->vport;
-		sctp_nat_csum(skb, sctph, sctphoff);
+		if (!skb_is_gso(skb) || !skb_is_gso_sctp(skb))
+			sctp_nat_csum(skb, sctph, sctphoff);
 	} else {
 		skb->ip_summed = CHECKSUM_UNNECESSARY;
 	}
@@ -171,7 +172,8 @@
 	    (skb->ip_summed == CHECKSUM_PARTIAL &&
 	     !(skb_dst(skb)->dev->features & NETIF_F_SCTP_CRC))) {
 		sctph->dest = cp->dport;
-		sctp_nat_csum(skb, sctph, sctphoff);
+		if (!skb_is_gso(skb) || !skb_is_gso_sctp(skb))
+			sctp_nat_csum(skb, sctph, sctphoff);
 	} else if (skb->ip_summed != CHECKSUM_PARTIAL) {
 		skb->ip_summed = CHECKSUM_UNNECESSARY;
 	}

diff --git a/net/netfilter/nf_tables_api.c b/net/netfilter/nf_tables_api.c
index d5a1b67..92d02a4 100644
--- a/net/netfilter/nf_tables_api.c
+++ b/net/netfilter/nf_tables_api.c

@@ -148,18 +148,18 @@
 	struct net *net = ctx->net;
 	struct nft_trans *trans;
 
-	if (!(set->flags & NFT_SET_ANONYMOUS))
+	if (!nft_set_is_anonymous(set))
 		return;
 
 	list_for_each_entry_reverse(trans, &net->nft.commit_list, list) {
 		switch (trans->msg_type) {
 		case NFT_MSG_NEWSET:
 			if (nft_trans_set(trans) == set)
-				nft_trans_set_bound(trans) = bind;
+				set->bound = true;
 			break;
 		case NFT_MSG_NEWSETELEM:
 			if (nft_trans_elem_set(trans) == set)
-				nft_trans_elem_set_bound(trans) = bind;
+				set->bound = true;
 			break;
 		}
 	}
@@ -371,6 +371,31 @@
 	return 0;
 }
 
+static void nft_setelem_data_deactivate(const struct net *net,
+					const struct nft_set *set,
+					struct nft_set_elem *elem);
+
+static int nft_mapelem_deactivate(const struct nft_ctx *ctx,
+				  struct nft_set *set,
+				  const struct nft_set_iter *iter,
+				  struct nft_set_elem *elem)
+{
+	nft_setelem_data_deactivate(ctx->net, set, elem);
+
+	return 0;
+}
+
+static void nft_map_deactivate(const struct nft_ctx *ctx, struct nft_set *set)
+{
+	struct nft_set_iter iter = {
+		.genmask	= nft_genmask_next(ctx->net),
+		.fn		= nft_mapelem_deactivate,
+	};
+
+	set->ops->walk(ctx, set, &iter);
+	WARN_ON_ONCE(iter.err);
+}
+
 static int nft_delset(const struct nft_ctx *ctx, struct nft_set *set)
 {
 	int err;
@@ -379,6 +404,9 @@
 	if (err < 0)
 		return err;
 
+	if (set->flags & (NFT_SET_MAP | NFT_SET_OBJECT))
+		nft_map_deactivate(ctx, set);
+
 	nft_deactivate_next(ctx->net, set);
 	nft_use_dec(&ctx->table->use);
 
@@ -870,7 +898,7 @@
 		if (!nft_is_active_next(ctx->net, set))
 			continue;
 
-		if (set->flags & NFT_SET_ANONYMOUS &&
+		if (nft_set_is_anonymous(set) &&
 		    !list_empty(&set->bindings))
 			continue;
 
@@ -1818,14 +1846,17 @@
 static const struct nft_expr_type *__nft_expr_type_get(u8 family,
 						       struct nlattr *nla)
 {
-	const struct nft_expr_type *type;
+	const struct nft_expr_type *type, *candidate = NULL;
 
-	list_for_each_entry(type, &nf_tables_expressions, list) {
-		if (!nla_strcmp(nla, type->name) &&
-		    (!type->family || type->family == family))
-			return type;
+	list_for_each_entry_rcu(type, &nf_tables_expressions, list) {
+		if (!nla_strcmp(nla, type->name)) {
+			if (!type->family && !candidate)
+				candidate = type;
+			else if (type->family == family)
+				candidate = type;
+		}
 	}
-	return NULL;
+	return candidate;
 }
 
 static const struct nft_expr_type *nft_expr_type_get(u8 family,
@@ -1836,9 +1867,13 @@
 	if (nla == NULL)
 		return ERR_PTR(-EINVAL);
 
+	rcu_read_lock();
 	type = __nft_expr_type_get(family, nla);
-	if (type != NULL && try_module_get(type->owner))
+	if (type != NULL && try_module_get(type->owner)) {
+		rcu_read_unlock();
 		return type;
+	}
+	rcu_read_unlock();
 
 #ifdef CONFIG_MODULES
 	if (type == NULL) {
@@ -3345,6 +3380,7 @@
 
 	INIT_LIST_HEAD(&set->bindings);
 	set->table = table;
+	write_pnet(&set->net, net);
 	set->ops   = ops;
 	set->ktype = ktype;
 	set->klen  = desc.klen;
@@ -3372,7 +3408,7 @@
 	return 0;
 
 err4:
-	ops->destroy(set);
+	ops->destroy(&ctx, set);
 err3:
 	kfree(set->name);
 err2:
@@ -3384,12 +3420,12 @@
 	return err;
 }
 
-static void nft_set_destroy(struct nft_set *set)
+static void nft_set_destroy(const struct nft_ctx *ctx, struct nft_set *set)
 {
 	if (WARN_ON(set->use > 0))
 		return;
 
-	set->ops->destroy(set);
+	set->ops->destroy(ctx, set);
 	module_put(set->ops->type->owner);
 	kfree(set->name);
 	kvfree(set);
@@ -3453,7 +3489,7 @@
 	struct nft_set_binding *i;
 	struct nft_set_iter iter;
 
-	if (!list_empty(&set->bindings) && set->flags & NFT_SET_ANONYMOUS)
+	if (!list_empty(&set->bindings) && nft_set_is_anonymous(set))
 		return -EBUSY;
 
 	if (binding->flags & NFT_SET_MAP) {
@@ -3493,7 +3529,7 @@
 {
 	list_del_rcu(&binding->list);
 
-	if (list_empty(&set->bindings) && set->flags & NFT_SET_ANONYMOUS) {
+	if (list_empty(&set->bindings) && nft_set_is_anonymous(set)) {
 		list_del_rcu(&set->list);
 		if (event)
 			nf_tables_set_notify(ctx, set, NFT_MSG_DELSET,
@@ -3502,10 +3538,39 @@
 }
 EXPORT_SYMBOL_GPL(nf_tables_unbind_set);
 
+static void nft_setelem_data_activate(const struct net *net,
+				      const struct nft_set *set,
+				      struct nft_set_elem *elem);
+
+static int nft_mapelem_activate(const struct nft_ctx *ctx,
+				struct nft_set *set,
+				const struct nft_set_iter *iter,
+				struct nft_set_elem *elem)
+{
+	nft_setelem_data_activate(ctx->net, set, elem);
+
+	return 0;
+}
+
+static void nft_map_activate(const struct nft_ctx *ctx, struct nft_set *set)
+{
+	struct nft_set_iter iter = {
+		.genmask	= nft_genmask_next(ctx->net),
+		.fn		= nft_mapelem_activate,
+	};
+
+	set->ops->walk(ctx, set, &iter);
+	WARN_ON_ONCE(iter.err);
+}
+
 void nf_tables_activate_set(const struct nft_ctx *ctx, struct nft_set *set)
 {
-	if (set->flags & NFT_SET_ANONYMOUS)
+	if (nft_set_is_anonymous(set)) {
+		if (set->flags & (NFT_SET_MAP | NFT_SET_OBJECT))
+			nft_map_activate(ctx, set);
+
 		nft_clear(ctx->net, set);
+	}
 
 	nft_use_inc_restore(&set->use);
 }
@@ -3518,7 +3583,7 @@
 	switch (phase) {
 	case NFT_TRANS_PREPARE_ERROR:
 		nft_set_trans_unbind(ctx, set);
-		if (set->flags & NFT_SET_ANONYMOUS)
+		if (nft_set_is_anonymous(set))
 			nft_deactivate_next(ctx->net, set);
 		else
 			list_del_rcu(&binding->list);
@@ -3526,13 +3591,20 @@
 		nft_use_dec(&set->use);
 		break;
 	case NFT_TRANS_PREPARE:
-		if (set->flags & NFT_SET_ANONYMOUS)
-			nft_deactivate_next(ctx->net, set);
+		if (nft_set_is_anonymous(set)) {
+			if (set->flags & (NFT_SET_MAP | NFT_SET_OBJECT))
+				nft_map_deactivate(ctx, set);
 
+			nft_deactivate_next(ctx->net, set);
+		}
 		nft_use_dec(&set->use);
 		return;
 	case NFT_TRANS_ABORT:
 	case NFT_TRANS_RELEASE:
+		if (nft_set_is_anonymous(set) &&
+		    set->flags & (NFT_SET_MAP | NFT_SET_OBJECT))
+			nft_map_deactivate(ctx, set);
+
 		nft_use_dec(&set->use);
 		/* fall through */
 	default:
@@ -3544,8 +3616,8 @@
 
 void nf_tables_destroy_set(const struct nft_ctx *ctx, struct nft_set *set)
 {
-	if (list_empty(&set->bindings) && set->flags & NFT_SET_ANONYMOUS)
-		nft_set_destroy(set);
+	if (list_empty(&set->bindings) && nft_set_is_anonymous(set))
+		nft_set_destroy(ctx, set);
 }
 EXPORT_SYMBOL_GPL(nf_tables_destroy_set);
 
@@ -3715,8 +3787,12 @@
 				  const struct nft_set_iter *iter,
 				  struct nft_set_elem *elem)
 {
+	const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
 	struct nft_set_dump_args *args;
 
+	if (nft_set_elem_expired(ext))
+		return 0;
+
 	args = container_of(iter, struct nft_set_dump_args, iter);
 	return nf_tables_fill_setelem(args->skb, set, elem);
 }
@@ -3995,33 +4071,39 @@
 	return elem;
 }
 
+/* Drop references and destroy. Called from gc, dynset and abort path. */
 void nft_set_elem_destroy(const struct nft_set *set, void *elem,
 			  bool destroy_expr)
 {
 	struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
+	struct nft_ctx ctx = {
+		.net	= read_pnet(&set->net),
+	};
 
 	nft_data_release(nft_set_ext_key(ext), NFT_DATA_VALUE);
 	if (nft_set_ext_exists(ext, NFT_SET_EXT_DATA))
 		nft_data_release(nft_set_ext_data(ext), set->dtype);
 	if (destroy_expr && nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
-		nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext));
+		nf_tables_expr_destroy(&ctx, nft_set_ext_expr(ext));
 	if (nft_set_ext_exists(ext, NFT_SET_EXT_OBJREF))
 		nft_use_dec(&(*nft_set_ext_obj(ext))->use);
 	kfree(elem);
 }
 EXPORT_SYMBOL_GPL(nft_set_elem_destroy);
 
-/* Only called from commit path, nft_set_elem_deactivate() already deals with
- * the refcounting from the preparation phase.
+/* Destroy element. References have been already dropped in the preparation
+ * path via nft_setelem_data_deactivate().
  */
-static void nf_tables_set_elem_destroy(const struct nft_set *set, void *elem)
+void nf_tables_set_elem_destroy(const struct nft_ctx *ctx,
+				const struct nft_set *set, void *elem)
 {
 	struct nft_set_ext *ext = nft_set_elem_ext(set, elem);
 
 	if (nft_set_ext_exists(ext, NFT_SET_EXT_EXPR))
-		nf_tables_expr_destroy(NULL, nft_set_ext_expr(ext));
+		nf_tables_expr_destroy(ctx, nft_set_ext_expr(ext));
 	kfree(elem);
 }
+EXPORT_SYMBOL_GPL(nf_tables_set_elem_destroy);
 
 static int nft_setelem_parse_flags(const struct nft_set *set,
 				   const struct nlattr *attr, u32 *flags)
@@ -4345,9 +4427,9 @@
 	}
 }
 
-static void nft_set_elem_activate(const struct net *net,
-				  const struct nft_set *set,
-				  struct nft_set_elem *elem)
+static void nft_setelem_data_activate(const struct net *net,
+				      const struct nft_set *set,
+				      struct nft_set_elem *elem)
 {
 	const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
 
@@ -4357,9 +4439,9 @@
 		nft_use_inc_restore(&(*nft_set_ext_obj(ext))->use);
 }
 
-static void nft_set_elem_deactivate(const struct net *net,
-				    const struct nft_set *set,
-				    struct nft_set_elem *elem)
+static void nft_setelem_data_deactivate(const struct net *net,
+					const struct nft_set *set,
+					struct nft_set_elem *elem)
 {
 	const struct nft_set_ext *ext = nft_set_elem_ext(set, elem->priv);
 
@@ -4426,7 +4508,7 @@
 	kfree(elem.priv);
 	elem.priv = priv;
 
-	nft_set_elem_deactivate(ctx->net, set, &elem);
+	nft_setelem_data_deactivate(ctx->net, set, &elem);
 
 	nft_trans_elem(trans) = elem;
 	list_add_tail(&trans->list, &ctx->net->nft.commit_list);
@@ -4460,7 +4542,7 @@
 	}
 	set->ndeact++;
 
-	nft_set_elem_deactivate(ctx->net, set, elem);
+	nft_setelem_data_deactivate(ctx->net, set, elem);
 	nft_trans_elem_set(trans) = set;
 	nft_trans_elem(trans) = *elem;
 	list_add_tail(&trans->list, &ctx->net->nft.commit_list);
@@ -5290,10 +5372,11 @@
 		nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
 		break;
 	case NFT_MSG_DELSET:
-		nft_set_destroy(nft_trans_set(trans));
+		nft_set_destroy(&trans->ctx, nft_trans_set(trans));
 		break;
 	case NFT_MSG_DELSETELEM:
-		nf_tables_set_elem_destroy(nft_trans_elem_set(trans),
+		nf_tables_set_elem_destroy(&trans->ctx,
+					   nft_trans_elem_set(trans),
 					   nft_trans_elem(trans).priv);
 		break;
 	case NFT_MSG_DELOBJ:
@@ -5379,7 +5462,7 @@
 			/* This avoids hitting -EBUSY when deleting the table
 			 * from the transaction.
 			 */
-			if (nft_trans_set(trans)->flags & NFT_SET_ANONYMOUS &&
+			if (nft_set_is_anonymous(nft_trans_set(trans)) &&
 			    !list_empty(&nft_trans_set(trans)->bindings))
 				nft_use_dec(&trans->ctx.table->use);
 
@@ -5450,8 +5533,7 @@
 		nf_tables_rule_destroy(&trans->ctx, nft_trans_rule(trans));
 		break;
 	case NFT_MSG_NEWSET:
-		if (!nft_trans_set_bound(trans))
-			nft_set_destroy(nft_trans_set(trans));
+		nft_set_destroy(&trans->ctx, nft_trans_set(trans));
 		break;
 	case NFT_MSG_NEWSETELEM:
 		nft_set_elem_destroy(nft_trans_elem_set(trans),
@@ -5523,7 +5605,7 @@
 			break;
 		case NFT_MSG_NEWSET:
 			nft_use_dec_restore(&trans->ctx.table->use);
-			if (nft_trans_set_bound(trans)) {
+			if (nft_trans_set(trans)->bound) {
 				nft_trans_destroy(trans);
 				break;
 			}
@@ -5532,22 +5614,23 @@
 		case NFT_MSG_DELSET:
 			nft_use_inc_restore(&trans->ctx.table->use);
 			nft_clear(trans->ctx.net, nft_trans_set(trans));
+			if (nft_trans_set(trans)->flags & (NFT_SET_MAP | NFT_SET_OBJECT))
+				nft_map_activate(&trans->ctx, nft_trans_set(trans));
 			nft_trans_destroy(trans);
 			break;
 		case NFT_MSG_NEWSETELEM:
-			if (nft_trans_elem_set_bound(trans)) {
+			if (nft_trans_elem_set(trans)->bound) {
 				nft_trans_destroy(trans);
 				break;
 			}
 			te = (struct nft_trans_elem *)trans->data;
-
 			te->set->ops->remove(net, te->set, &te->elem);
 			atomic_dec(&te->set->nelems);
 			break;
 		case NFT_MSG_DELSETELEM:
 			te = (struct nft_trans_elem *)trans->data;
 
-			nft_set_elem_activate(net, te->set, &te->elem);
+			nft_setelem_data_activate(net, te->set, &te->elem);
 			te->set->ops->activate(net, te->set, &te->elem);
 			te->set->ndeact--;
 
@@ -6177,7 +6260,10 @@
 		list_for_each_entry_safe(set, ns, &table->sets, list) {
 			list_del(&set->list);
 			nft_use_dec(&table->use);
-			nft_set_destroy(set);
+			if (set->flags & (NFT_SET_MAP | NFT_SET_OBJECT))
+				nft_map_deactivate(&ctx, set);
+
+			nft_set_destroy(&ctx, set);
 		}
 		list_for_each_entry_safe(obj, ne, &table->objects, list) {
 			list_del(&obj->list);

diff --git a/net/netfilter/nfnetlink_queue.c b/net/netfilter/nfnetlink_queue.c
index 0c40438..c236860 100644
--- a/net/netfilter/nfnetlink_queue.c
+++ b/net/netfilter/nfnetlink_queue.c

@@ -168,7 +168,9 @@
 	struct nfqnl_instance *inst = container_of(head, struct nfqnl_instance,
 						   rcu);
 
+	rcu_read_lock();
 	nfqnl_flush(inst, NULL, 0);
+	rcu_read_unlock();
 	kfree(inst);
 	module_put(THIS_MODULE);
 }

diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
index 461bdec..af02731 100644
--- a/net/netfilter/nft_dynset.c
+++ b/net/netfilter/nft_dynset.c

@@ -127,7 +127,7 @@
 		u32 flags = ntohl(nla_get_be32(tb[NFTA_DYNSET_FLAGS]));
 
 		if (flags & ~NFT_DYNSET_F_INV)
-			return -EINVAL;
+			return -EOPNOTSUPP;
 		if (flags & NFT_DYNSET_F_INV)
 			priv->invert = true;
 	}
@@ -147,21 +147,13 @@
 		return -EBUSY;
 
 	priv->op = ntohl(nla_get_be32(tb[NFTA_DYNSET_OP]));
-	switch (priv->op) {
-	case NFT_DYNSET_OP_ADD:
-		break;
-	case NFT_DYNSET_OP_UPDATE:
-		if (!(set->flags & NFT_SET_TIMEOUT))
-			return -EOPNOTSUPP;
-		break;
-	default:
+	if (priv->op > NFT_DYNSET_OP_UPDATE)
 		return -EOPNOTSUPP;
-	}
 
 	timeout = 0;
 	if (tb[NFTA_DYNSET_TIMEOUT] != NULL) {
 		if (!(set->flags & NFT_SET_TIMEOUT))
-			return -EINVAL;
+			return -EOPNOTSUPP;
 		timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64(
 						tb[NFTA_DYNSET_TIMEOUT])));
 	}
@@ -173,7 +165,7 @@
 
 	if (tb[NFTA_DYNSET_SREG_DATA] != NULL) {
 		if (!(set->flags & NFT_SET_MAP))
-			return -EINVAL;
+			return -EOPNOTSUPP;
 		if (set->dtype == NFT_DATA_VERDICT)
 			return -EOPNOTSUPP;
 
@@ -187,7 +179,7 @@
 	if (tb[NFTA_DYNSET_EXPR] != NULL) {
 		if (!(set->flags & NFT_SET_EVAL))
 			return -EINVAL;
-		if (!(set->flags & NFT_SET_ANONYMOUS))
+		if (!nft_set_is_anonymous(set))
 			return -EOPNOTSUPP;
 
 		priv->expr = nft_expr_init(ctx, tb[NFTA_DYNSET_EXPR]);

diff --git a/net/netfilter/nft_set_bitmap.c b/net/netfilter/nft_set_bitmap.c
index 734989c..d50daba 100644
--- a/net/netfilter/nft_set_bitmap.c
+++ b/net/netfilter/nft_set_bitmap.c

@@ -256,13 +256,14 @@
 	return 0;
 }
 
-static void nft_bitmap_destroy(const struct nft_set *set)
+static void nft_bitmap_destroy(const struct nft_ctx *ctx,
+			       const struct nft_set *set)
 {
 	struct nft_bitmap *priv = nft_set_priv(set);
 	struct nft_bitmap_elem *be, *n;
 
 	list_for_each_entry_safe(be, n, &priv->list, head)
-		nft_set_elem_destroy(set, be, true);
+		nf_tables_set_elem_destroy(ctx, set, be);
 }
 
 static bool nft_bitmap_estimate(const struct nft_set_desc *desc, u32 features,

diff --git a/net/netfilter/nft_set_hash.c b/net/netfilter/nft_set_hash.c
index eb7db31..37f0ecd 100644
--- a/net/netfilter/nft_set_hash.c
+++ b/net/netfilter/nft_set_hash.c

@@ -254,8 +254,6 @@
 
 		if (iter->count < iter->skip)
 			goto cont;
-		if (nft_set_elem_expired(&he->ext))
-			goto cont;
 		if (!nft_set_elem_active(&he->ext, iter->genmask))
 			goto cont;
 
@@ -351,19 +349,31 @@
 	return 0;
 }
 
+struct nft_rhash_ctx {
+	const struct nft_ctx	ctx;
+	const struct nft_set	*set;
+};
+
 static void nft_rhash_elem_destroy(void *ptr, void *arg)
 {
-	nft_set_elem_destroy(arg, ptr, true);
+	struct nft_rhash_ctx *rhash_ctx = arg;
+
+	nf_tables_set_elem_destroy(&rhash_ctx->ctx, rhash_ctx->set, ptr);
 }
 
-static void nft_rhash_destroy(const struct nft_set *set)
+static void nft_rhash_destroy(const struct nft_ctx *ctx,
+			      const struct nft_set *set)
 {
 	struct nft_rhash *priv = nft_set_priv(set);
+	struct nft_rhash_ctx rhash_ctx = {
+		.ctx	= *ctx,
+		.set	= set,
+	};
 
 	cancel_delayed_work_sync(&priv->gc_work);
 	rcu_barrier();
 	rhashtable_free_and_destroy(&priv->ht, nft_rhash_elem_destroy,
-				    (void *)set);
+				    (void *)&rhash_ctx);
 }
 
 /* Number of buckets is stored in u32, so cap our result to 1U<<31 */
@@ -583,7 +593,8 @@
 	return 0;
 }
 
-static void nft_hash_destroy(const struct nft_set *set)
+static void nft_hash_destroy(const struct nft_ctx *ctx,
+			     const struct nft_set *set)
 {
 	struct nft_hash *priv = nft_set_priv(set);
 	struct nft_hash_elem *he;
@@ -593,7 +604,7 @@
 	for (i = 0; i < priv->buckets; i++) {
 		hlist_for_each_entry_safe(he, next, &priv->table[i], node) {
 			hlist_del_rcu(&he->node);
-			nft_set_elem_destroy(set, he, true);
+			nf_tables_set_elem_destroy(ctx, set, he);
 		}
 	}
 }

diff --git a/net/netfilter/nft_set_rbtree.c b/net/netfilter/nft_set_rbtree.c
index 6f3205d..40fe165 100644
--- a/net/netfilter/nft_set_rbtree.c
+++ b/net/netfilter/nft_set_rbtree.c

@@ -292,7 +292,8 @@
 	return 0;
 }
 
-static void nft_rbtree_destroy(const struct nft_set *set)
+static void nft_rbtree_destroy(const struct nft_ctx *ctx,
+			       const struct nft_set *set)
 {
 	struct nft_rbtree *priv = nft_set_priv(set);
 	struct nft_rbtree_elem *rbe;
@@ -301,7 +302,7 @@
 	while ((node = priv->root.rb_node) != NULL) {
 		rb_erase(node, &priv->root);
 		rbe = rb_entry(node, struct nft_rbtree_elem, node);
-		nft_set_elem_destroy(set, rbe, true);
+		nf_tables_set_elem_destroy(ctx, set, rbe);
 	}
 }
 

diff --git a/net/netrom/nr_route.c b/net/netrom/nr_route.c
index 879c811..b13eb80 100644
--- a/net/netrom/nr_route.c
+++ b/net/netrom/nr_route.c

@@ -313,22 +313,14 @@
 	return 0;
 }
 
-static inline void __nr_remove_node(struct nr_node *nr_node)
+static void nr_remove_node_locked(struct nr_node *nr_node)
 {
+	lockdep_assert_held(&nr_node_list_lock);
+
 	hlist_del_init(&nr_node->node_node);
 	nr_node_put(nr_node);
 }
 
-#define nr_remove_node_locked(__node) \
-	__nr_remove_node(__node)
-
-static void nr_remove_node(struct nr_node *nr_node)
-{
-	spin_lock_bh(&nr_node_list_lock);
-	__nr_remove_node(nr_node);
-	spin_unlock_bh(&nr_node_list_lock);
-}
-
 static inline void __nr_remove_neigh(struct nr_neigh *nr_neigh)
 {
 	hlist_del_init(&nr_neigh->neigh_node);
@@ -367,6 +359,7 @@
 		return -EINVAL;
 	}
 
+	spin_lock_bh(&nr_node_list_lock);
 	nr_node_lock(nr_node);
 	for (i = 0; i < nr_node->count; i++) {
 		if (nr_node->routes[i].neighbour == nr_neigh) {
@@ -380,7 +373,7 @@
 			nr_node->count--;
 
 			if (nr_node->count == 0) {
-				nr_remove_node(nr_node);
+				nr_remove_node_locked(nr_node);
 			} else {
 				switch (i) {
 				case 0:
@@ -393,12 +386,14 @@
 				nr_node_put(nr_node);
 			}
 			nr_node_unlock(nr_node);
+			spin_unlock_bh(&nr_node_list_lock);
 
 			return 0;
 		}
 	}
 	nr_neigh_put(nr_neigh);
 	nr_node_unlock(nr_node);
+	spin_unlock_bh(&nr_node_list_lock);
 	nr_node_put(nr_node);
 
 	return -EINVAL;

diff --git a/net/nfc/nci/core.c b/net/nfc/nci/core.c
index bed8bbc..28b46b8 100644
--- a/net/nfc/nci/core.c
+++ b/net/nfc/nci/core.c

@@ -1463,6 +1463,19 @@
 				 ndev->ops->n_core_ops);
 }
 
+static bool nci_valid_size(struct sk_buff *skb)
+{
+	unsigned int hdr_size = NCI_CTRL_HDR_SIZE;
+	BUILD_BUG_ON(NCI_CTRL_HDR_SIZE != NCI_DATA_HDR_SIZE);
+
+	if (skb->len < hdr_size ||
+	    !nci_plen(skb->data) ||
+	    skb->len < hdr_size + nci_plen(skb->data)) {
+		return false;
+	}
+	return true;
+}
+
 /* ---- NCI TX Data worker thread ---- */
 
 static void nci_tx_work(struct work_struct *work)
@@ -1513,9 +1526,9 @@
 		nfc_send_to_raw_sock(ndev->nfc_dev, skb,
 				     RAW_PAYLOAD_NCI, NFC_DIRECTION_RX);
 
-		if (!nci_plen(skb->data)) {
+		if (!nci_valid_size(skb)) {
 			kfree_skb(skb);
-			break;
+			continue;
 		}
 
 		/* Process frame */

diff --git a/net/nsh/nsh.c b/net/nsh/nsh.c
index f8eeef8..d76c1d3 100644
--- a/net/nsh/nsh.c
+++ b/net/nsh/nsh.c

@@ -17,13 +17,15 @@
 static struct sk_buff *nsh_gso_segment(struct sk_buff *skb,
 				       netdev_features_t features)
 {
+	unsigned int outer_hlen, mac_len, nsh_len;
 	struct sk_buff *segs = ERR_PTR(-EINVAL);
 	u16 mac_offset = skb->mac_header;
-	unsigned int nsh_len, mac_len;
-	__be16 proto;
+	__be16 outer_proto, proto;
 
 	skb_reset_network_header(skb);
 
+	outer_proto = skb->protocol;
+	outer_hlen = skb_mac_header_len(skb);
 	mac_len = skb->mac_len;
 
 	if (unlikely(!pskb_may_pull(skb, NSH_BASE_HDR_LEN)))
@@ -53,10 +55,10 @@
 	}
 
 	for (skb = segs; skb; skb = skb->next) {
-		skb->protocol = htons(ETH_P_NSH);
-		__skb_push(skb, nsh_len);
-		skb->mac_header = mac_offset;
-		skb->network_header = skb->mac_header + mac_len;
+		skb->protocol = outer_proto;
+		__skb_push(skb, nsh_len + outer_hlen);
+		skb_reset_mac_header(skb);
+		skb_set_network_header(skb, outer_hlen);
 		skb->mac_len = mac_len;
 	}
 

diff --git a/net/openvswitch/actions.c b/net/openvswitch/actions.c
index 93eb963..adc37cd 100644
--- a/net/openvswitch/actions.c
+++ b/net/openvswitch/actions.c

@@ -890,6 +890,12 @@
 				pskb_trim(skb, ovs_mac_header_len(key));
 		}
 
+		/* Need to set the pkt_type to involve the routing layer.  The
+		 * packet movement through the OVS datapath doesn't generally
+		 * use routing, but this is needed for tunnel cases.
+		 */
+		skb->pkt_type = PACKET_OUTGOING;
+
 		if (likely(!mru ||
 		           (skb->len <= mru + vport->dev->hard_header_len))) {
 			ovs_vport_send(vport, skb, ovs_key_mac_proto(key));

diff --git a/net/openvswitch/flow.c b/net/openvswitch/flow.c
index dbe1079..0b26971 100644
--- a/net/openvswitch/flow.c
+++ b/net/openvswitch/flow.c

@@ -426,7 +426,6 @@
 	 */
 	key->tp.src = htons(icmp->icmp6_type);
 	key->tp.dst = htons(icmp->icmp6_code);
-	memset(&key->ipv6.nd, 0, sizeof(key->ipv6.nd));
 
 	if (icmp->icmp6_code == 0 &&
 	    (icmp->icmp6_type == NDISC_NEIGHBOUR_SOLICITATION ||
@@ -435,6 +434,8 @@
 		struct nd_msg *nd;
 		int offset;
 
+		memset(&key->ipv6.nd, 0, sizeof(key->ipv6.nd));
+
 		/* In order to process neighbor discovery options, we need the
 		 * entire packet.
 		 */

diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 6a02cf8..0cc0a00 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c

@@ -2480,8 +2480,7 @@
 		ts = __packet_set_timestamp(po, ph, skb);
 		__packet_set_status(po, ph, TP_STATUS_AVAILABLE | ts);
 
-		if (!packet_read_pending(&po->tx_ring))
-			complete(&po->skb_completion);
+		complete(&po->skb_completion);
 	}
 
 	sock_wfree(skb);

diff --git a/net/phonet/pn_netlink.c b/net/phonet/pn_netlink.c
index da754fc..6a04fe1 100644
--- a/net/phonet/pn_netlink.c
+++ b/net/phonet/pn_netlink.c

@@ -206,7 +206,7 @@
 	struct sk_buff *skb;
 	int err = -ENOBUFS;
 
-	skb = nlmsg_new(NLMSG_ALIGN(sizeof(struct ifaddrmsg)) +
+	skb = nlmsg_new(NLMSG_ALIGN(sizeof(struct rtmsg)) +
 			nla_total_size(1) + nla_total_size(4), GFP_KERNEL);
 	if (skb == NULL)
 		goto errout;

diff --git a/net/rds/ib.h b/net/rds/ib.h
index 7db93f7..e9589308 100644
--- a/net/rds/ib.h
+++ b/net/rds/ib.h

@@ -416,7 +416,7 @@
 int rds_ib_xmit_atomic(struct rds_connection *conn, struct rm_atomic_op *op);
 
 /* ib_stats.c */
-DECLARE_PER_CPU(struct rds_ib_statistics, rds_ib_stats);
+DECLARE_PER_CPU_SHARED_ALIGNED(struct rds_ib_statistics, rds_ib_stats);
 #define rds_ib_stats_inc(member) rds_stats_inc_which(rds_ib_stats, member)
 #define rds_ib_stats_add(member, count) \
 		rds_stats_add_which(rds_ib_stats, member, count)

diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c
index 1fd2939..aa1850f 100644
--- a/net/sunrpc/xprtsock.c
+++ b/net/sunrpc/xprtsock.c

@@ -3273,24 +3273,6 @@
 	xprt_unregister_transport(&xs_bc_tcp_transport);
 }
 
-static int param_set_uint_minmax(const char *val,
-		const struct kernel_param *kp,
-		unsigned int min, unsigned int max)
-{
-	unsigned int num;
-	int ret;
-
-	if (!val)
-		return -EINVAL;
-	ret = kstrtouint(val, 0, &num);
-	if (ret)
-		return ret;
-	if (num < min || num > max)
-		return -EINVAL;
-	*((unsigned int *)kp->arg) = num;
-	return 0;
-}
-
 static int param_set_portnr(const char *val, const struct kernel_param *kp)
 {
 	return param_set_uint_minmax(val, kp,

diff --git a/net/tipc/msg.c b/net/tipc/msg.c
index de0b2e5..75815e8 100644
--- a/net/tipc/msg.c
+++ b/net/tipc/msg.c

@@ -140,9 +140,9 @@
 	if (fragid == FIRST_FRAGMENT) {
 		if (unlikely(head))
 			goto err;
-		*buf = NULL;
 		if (skb_has_frag_list(frag) && __skb_linearize(frag))
 			goto err;
+		*buf = NULL;
 		frag = skb_unshare(frag, GFP_ATOMIC);
 		if (unlikely(!frag))
 			goto err;
@@ -154,6 +154,11 @@
 	if (!head)
 		goto err;
 
+	/* Either the input skb ownership is transferred to headskb
+	 * or the input skb is freed, clear the reference to avoid
+	 * bad access on error path.
+	 */
+	*buf = NULL;
 	if (skb_try_coalesce(head, frag, &headstolen, &delta)) {
 		kfree_skb_partial(frag, headstolen);
 	} else {
@@ -177,7 +182,6 @@
 		*headbuf = NULL;
 		return 1;
 	}
-	*buf = NULL;
 	return 0;
 err:
 	kfree_skb(*buf);

diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
index b185577..ca62df6 100644
--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c

@@ -819,11 +819,11 @@
 	sk->sk_write_space	= unix_write_space;
 	sk->sk_max_ack_backlog	= net->unx.sysctl_max_dgram_qlen;
 	sk->sk_destruct		= unix_sock_destructor;
-	u	  = unix_sk(sk);
+	u = unix_sk(sk);
+	u->inflight = 0;
 	u->path.dentry = NULL;
 	u->path.mnt = NULL;
 	spin_lock_init(&u->lock);
-	atomic_long_set(&u->inflight, 0);
 	INIT_LIST_HEAD(&u->link);
 	mutex_init(&u->iolock); /* single task reading lock */
 	mutex_init(&u->bindlock); /* single task binding lock */
@@ -1899,7 +1899,7 @@
 			goto out_err;
 	}
 
-	if (sk->sk_shutdown & SEND_SHUTDOWN)
+	if (READ_ONCE(sk->sk_shutdown) & SEND_SHUTDOWN)
 		goto pipe_err;
 
 	while (sent < len) {

diff --git a/net/unix/garbage.c b/net/unix/garbage.c
index 0a21242..fa2b740 100644
--- a/net/unix/garbage.c
+++ b/net/unix/garbage.c

@@ -171,17 +171,18 @@
 
 static void dec_inflight(struct unix_sock *usk)
 {
-	atomic_long_dec(&usk->inflight);
+	usk->inflight--;
 }
 
 static void inc_inflight(struct unix_sock *usk)
 {
-	atomic_long_inc(&usk->inflight);
+	usk->inflight++;
 }
 
 static void inc_inflight_move_tail(struct unix_sock *u)
 {
-	atomic_long_inc(&u->inflight);
+	u->inflight++;
+
 	/* If this still might be part of a cycle, move it to the end
 	 * of the list, so that it's checked even if it was already
 	 * passed over
@@ -238,20 +239,34 @@
 	 * receive queues.  Other, non candidate sockets _can_ be
 	 * added to queue, so we must make sure only to touch
 	 * candidates.
+	 *
+	 * Embryos, though never candidates themselves, affect which
+	 * candidates are reachable by the garbage collector.  Before
+	 * being added to a listener's queue, an embryo may already
+	 * receive data carrying SCM_RIGHTS, potentially making the
+	 * passed socket a candidate that is not yet reachable by the
+	 * collector.  It becomes reachable once the embryo is
+	 * enqueued.  Therefore, we must ensure that no SCM-laden
+	 * embryo appears in a (candidate) listener's queue between
+	 * consecutive scan_children() calls.
 	 */
 	list_for_each_entry_safe(u, next, &gc_inflight_list, link) {
+		struct sock *sk = &u->sk;
 		long total_refs;
-		long inflight_refs;
 
-		total_refs = file_count(u->sk.sk_socket->file);
-		inflight_refs = atomic_long_read(&u->inflight);
+		total_refs = file_count(sk->sk_socket->file);
 
-		BUG_ON(inflight_refs < 1);
-		BUG_ON(total_refs < inflight_refs);
-		if (total_refs == inflight_refs) {
+		BUG_ON(!u->inflight);
+		BUG_ON(total_refs < u->inflight);
+		if (total_refs == u->inflight) {
 			list_move_tail(&u->link, &gc_candidates);
 			__set_bit(UNIX_GC_CANDIDATE, &u->gc_flags);
 			__set_bit(UNIX_GC_MAYBE_CYCLE, &u->gc_flags);
+
+			if (sk->sk_state == TCP_LISTEN) {
+				unix_state_lock_nested(sk, U_LOCK_GC_LISTENER);
+				unix_state_unlock(sk);
+			}
 		}
 	}
 
@@ -275,7 +290,7 @@
 		/* Move cursor to after the current position. */
 		list_move(&cursor, &u->link);
 
-		if (atomic_long_read(&u->inflight) > 0) {
+		if (u->inflight) {
 			list_move_tail(&u->link, &not_cycle_list);
 			__clear_bit(UNIX_GC_MAYBE_CYCLE, &u->gc_flags);
 			scan_children(&u->sk, inc_inflight_move_tail, NULL);

diff --git a/net/unix/scm.c b/net/unix/scm.c
index c4dde27..4acb791 100644
--- a/net/unix/scm.c
+++ b/net/unix/scm.c

@@ -51,12 +51,13 @@
 	if (s) {
 		struct unix_sock *u = unix_sk(s);
 
-		if (atomic_long_inc_return(&u->inflight) == 1) {
+		if (!u->inflight) {
 			BUG_ON(!list_empty(&u->link));
 			list_add_tail(&u->link, &gc_inflight_list);
 		} else {
 			BUG_ON(list_empty(&u->link));
 		}
+		u->inflight++;
 		/* Paired with READ_ONCE() in wait_for_unix_gc() */
 		WRITE_ONCE(unix_tot_inflight, unix_tot_inflight + 1);
 	}
@@ -73,10 +74,11 @@
 	if (s) {
 		struct unix_sock *u = unix_sk(s);
 
-		BUG_ON(!atomic_long_read(&u->inflight));
+		BUG_ON(!u->inflight);
 		BUG_ON(list_empty(&u->link));
 
-		if (atomic_long_dec_and_test(&u->inflight))
+		u->inflight--;
+		if (!u->inflight)
 			list_del_init(&u->link);
 		/* Paired with READ_ONCE() in wait_for_unix_gc() */
 		WRITE_ONCE(unix_tot_inflight, unix_tot_inflight - 1);

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index f4dfce4..cef9798 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c

@@ -10957,6 +10957,8 @@
 error:
 	for (i = 0; i < new_coalesce.n_rules; i++) {
 		tmp_rule = &new_coalesce.rules[i];
+		if (!tmp_rule)
+			continue;
 		for (j = 0; j < tmp_rule->n_patterns; j++)
 			kfree(tmp_rule->patterns[j].mask);
 		kfree(tmp_rule->patterns);

diff --git a/net/wireless/trace.h b/net/wireless/trace.h
index cd0a1c7..bba3e61 100644
--- a/net/wireless/trace.h
+++ b/net/wireless/trace.h

@@ -1591,7 +1591,7 @@
 
 DECLARE_EVENT_CLASS(tx_rx_evt,
 	TP_PROTO(struct wiphy *wiphy, u32 tx, u32 rx),
-	TP_ARGS(wiphy, rx, tx),
+	TP_ARGS(wiphy, tx, rx),
 	TP_STRUCT__entry(
 		WIPHY_ENTRY
 		__field(u32, tx)
@@ -1608,7 +1608,7 @@
 
 DEFINE_EVENT(tx_rx_evt, rdev_set_antenna,
 	TP_PROTO(struct wiphy *wiphy, u32 tx, u32 rx),
-	TP_ARGS(wiphy, rx, tx)
+	TP_ARGS(wiphy, tx, rx)
 );
 
 DECLARE_EVENT_CLASS(wiphy_netdev_id_evt,

diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index d58473f..c5296c4 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c

@@ -2554,15 +2554,10 @@
 	/* Impossible. Such dst must be popped before reaches point of failure. */
 }
 
-static struct dst_entry *xfrm_negative_advice(struct dst_entry *dst)
+static void xfrm_negative_advice(struct sock *sk, struct dst_entry *dst)
 {
-	if (dst) {
-		if (dst->obsolete) {
-			dst_release(dst);
-			dst = NULL;
-		}
-	}
-	return dst;
+	if (dst->obsolete)
+		sk_dst_reset(sk);
 }
 
 static void xfrm_init_pmtu(struct dst_entry *dst)

diff --git a/scripts/kconfig/symbol.c b/scripts/kconfig/symbol.c
index 2956d15..d0c26d1 100644
--- a/scripts/kconfig/symbol.c
+++ b/scripts/kconfig/symbol.c

@@ -13,14 +13,17 @@
 
 struct symbol symbol_yes = {
 	.name = "y",
+	.type = S_TRISTATE,
 	.curr = { "y", yes },
 	.flags = SYMBOL_CONST|SYMBOL_VALID,
 }, symbol_mod = {
 	.name = "m",
+	.type = S_TRISTATE,
 	.curr = { "m", mod },
 	.flags = SYMBOL_CONST|SYMBOL_VALID,
 }, symbol_no = {
 	.name = "n",
+	.type = S_TRISTATE,
 	.curr = { "n", no },
 	.flags = SYMBOL_CONST|SYMBOL_VALID,
 }, symbol_empty = {
@@ -802,8 +805,7 @@
 		case no:
 			return "n";
 		case mod:
-			sym_calc_value(modules_sym);
-			return (modules_sym->curr.tri == no) ? "n" : "m";
+			return "m";
 		case yes:
 			return "y";
 		}

diff --git a/sound/core/timer.c b/sound/core/timer.c
index 720d635..15aa82d 100644
--- a/sound/core/timer.c
+++ b/sound/core/timer.c

@@ -448,6 +448,14 @@
 }
 EXPORT_SYMBOL(snd_timer_close);
 
+static unsigned long snd_timer_hw_resolution(struct snd_timer *timer)
+{
+	if (timer->hw.c_resolution)
+		return timer->hw.c_resolution(timer);
+	else
+		return timer->hw.resolution;
+}
+
 unsigned long snd_timer_resolution(struct snd_timer_instance *timeri)
 {
 	struct snd_timer * timer;
@@ -455,11 +463,8 @@
 	if (timeri == NULL)
 		return 0;
 	timer = timeri->timer;
-	if (timer) {
-		if (timer->hw.c_resolution)
-			return timer->hw.c_resolution(timer);
-		return timer->hw.resolution;
-	}
+	if (timer)
+		return snd_timer_hw_resolution(timer);
 	return 0;
 }
 EXPORT_SYMBOL(snd_timer_resolution);
@@ -519,6 +524,16 @@
 		goto unlock;
 	}
 
+	/* check the actual time for the start tick;
+	 * bail out as error if it's way too low (< 100us)
+	 */
+	if (start) {
+		if ((u64)snd_timer_hw_resolution(timer) * ticks < 100000) {
+			result = -EINVAL;
+			goto unlock;
+		}
+	}
+
 	if (start)
 		timeri->ticks = timeri->cticks = ticks;
 	else if (!timeri->cticks)
@@ -792,10 +807,7 @@
 	spin_lock_irqsave(&timer->lock, flags);
 
 	/* remember the current resolution */
-	if (timer->hw.c_resolution)
-		resolution = timer->hw.c_resolution(timer);
-	else
-		resolution = timer->hw.resolution;
+	resolution = snd_timer_hw_resolution(timer);
 
 	/* loop for all active instances
 	 * Here we cannot use list_for_each_entry because the active_list of a
@@ -1035,12 +1047,8 @@
 	spin_lock_irqsave(&timer->lock, flags);
 	if (event == SNDRV_TIMER_EVENT_MSTART ||
 	    event == SNDRV_TIMER_EVENT_MCONTINUE ||
-	    event == SNDRV_TIMER_EVENT_MRESUME) {
-		if (timer->hw.c_resolution)
-			resolution = timer->hw.c_resolution(timer);
-		else
-			resolution = timer->hw.resolution;
-	}
+	    event == SNDRV_TIMER_EVENT_MRESUME)
+		resolution = snd_timer_hw_resolution(timer);
 	list_for_each_entry(ti, &timer->active_list_head, active_list) {
 		if (ti->ccallback)
 			ti->ccallback(ti, event, tstamp, resolution);
@@ -1675,10 +1683,7 @@
 	mutex_lock(&register_mutex);
 	t = snd_timer_find(&tid);
 	if (t != NULL) {
-		if (t->hw.c_resolution)
-			gstatus.resolution = t->hw.c_resolution(t);
-		else
-			gstatus.resolution = t->hw.resolution;
+		gstatus.resolution = snd_timer_hw_resolution(t);
 		if (t->hw.precise_resolution) {
 			t->hw.precise_resolution(t, &gstatus.resolution_num,
 						 &gstatus.resolution_den);

diff --git a/sound/soc/codecs/da7219-aad.c b/sound/soc/codecs/da7219-aad.c
index 5a31a4d..47576e4 100644
--- a/sound/soc/codecs/da7219-aad.c
+++ b/sound/soc/codecs/da7219-aad.c

@@ -625,8 +625,10 @@
 		return NULL;
 
 	aad_pdata = devm_kzalloc(codec->dev, sizeof(*aad_pdata), GFP_KERNEL);
-	if (!aad_pdata)
+	if (!aad_pdata) {
+		fwnode_handle_put(aad_np);
 		return NULL;
+	}
 
 	aad_pdata->irq = i2c->irq;
 
@@ -701,6 +703,8 @@
 	else
 		aad_pdata->adc_1bit_rpt = DA7219_AAD_ADC_1BIT_RPT_1;
 
+	fwnode_handle_put(aad_np);
+
 	return aad_pdata;
 }
 

diff --git a/sound/soc/codecs/rt5645.c b/sound/soc/codecs/rt5645.c
index 536a338..6a08655 100644
--- a/sound/soc/codecs/rt5645.c
+++ b/sound/soc/codecs/rt5645.c

@@ -410,6 +410,7 @@
 	struct regmap *regmap;
 	struct i2c_client *i2c;
 	struct gpio_desc *gpiod_hp_det;
+	struct gpio_desc *gpiod_cbj_sleeve;
 	struct snd_soc_jack *hp_jack;
 	struct snd_soc_jack *mic_jack;
 	struct snd_soc_jack *btn_jack;
@@ -3148,6 +3149,9 @@
 		regmap_update_bits(rt5645->regmap, RT5645_IN1_CTRL2,
 			RT5645_CBJ_MN_JD, 0);
 
+		if (rt5645->gpiod_cbj_sleeve)
+			gpiod_set_value(rt5645->gpiod_cbj_sleeve, 1);
+
 		msleep(600);
 		regmap_read(rt5645->regmap, RT5645_IN1_CTRL3, &val);
 		val &= 0x7;
@@ -3164,6 +3168,8 @@
 			snd_soc_dapm_disable_pin(dapm, "Mic Det Power");
 			snd_soc_dapm_sync(dapm);
 			rt5645->jack_type = SND_JACK_HEADPHONE;
+			if (rt5645->gpiod_cbj_sleeve)
+				gpiod_set_value(rt5645->gpiod_cbj_sleeve, 0);
 		}
 		if (rt5645->pdata.level_trigger_irq)
 			regmap_update_bits(rt5645->regmap, RT5645_IRQ_CTRL2,
@@ -3189,6 +3195,9 @@
 		if (rt5645->pdata.level_trigger_irq)
 			regmap_update_bits(rt5645->regmap, RT5645_IRQ_CTRL2,
 				RT5645_JD_1_1_MASK, RT5645_JD_1_1_INV);
+
+		if (rt5645->gpiod_cbj_sleeve)
+			gpiod_set_value(rt5645->gpiod_cbj_sleeve, 0);
 	}
 
 	return rt5645->jack_type;
@@ -3760,6 +3769,16 @@
 			return ret;
 	}
 
+	rt5645->gpiod_cbj_sleeve = devm_gpiod_get_optional(&i2c->dev, "cbj-sleeve",
+							   GPIOD_OUT_LOW);
+
+	if (IS_ERR(rt5645->gpiod_cbj_sleeve)) {
+		ret = PTR_ERR(rt5645->gpiod_cbj_sleeve);
+		dev_info(&i2c->dev, "failed to initialize gpiod, ret=%d\n", ret);
+		if (ret != -ENOENT)
+			return ret;
+	}
+
 	for (i = 0; i < ARRAY_SIZE(rt5645->supplies); i++)
 		rt5645->supplies[i].supply = rt5645_supply_names[i];
 
@@ -3992,7 +4011,11 @@
 	cancel_delayed_work_sync(&rt5645->jack_detect_work);
 	cancel_delayed_work_sync(&rt5645->rcclock_work);
 
+	if (rt5645->gpiod_cbj_sleeve)
+		gpiod_set_value(rt5645->gpiod_cbj_sleeve, 0);
+
 	snd_soc_unregister_codec(&i2c->dev);
+
 	regulator_bulk_disable(ARRAY_SIZE(rt5645->supplies), rt5645->supplies);
 
 	return 0;
@@ -4010,6 +4033,9 @@
 		0);
 	msleep(20);
 	regmap_write(rt5645->regmap, RT5645_RESET, 0);
+
+	if (rt5645->gpiod_cbj_sleeve)
+		gpiod_set_value(rt5645->gpiod_cbj_sleeve, 0);
 }
 
 static struct i2c_driver rt5645_i2c_driver = {

diff --git a/sound/usb/line6/driver.c b/sound/usb/line6/driver.c
index b175da7..818fed7 100644
--- a/sound/usb/line6/driver.c
+++ b/sound/usb/line6/driver.c

@@ -209,7 +209,7 @@
 	struct urb *urb;
 
 	/* create message: */
-	msg = kmalloc(sizeof(struct message), GFP_ATOMIC);
+	msg = kzalloc(sizeof(struct message), GFP_ATOMIC);
 	if (msg == NULL)
 		return -ENOMEM;
 
@@ -687,7 +687,7 @@
 	int ret;
 
 	/* initialize USB buffers: */
-	line6->buffer_listen = kmalloc(LINE6_BUFSIZE_LISTEN, GFP_KERNEL);
+	line6->buffer_listen = kzalloc(LINE6_BUFSIZE_LISTEN, GFP_KERNEL);
 	if (!line6->buffer_listen)
 		return -ENOMEM;
 
@@ -696,7 +696,7 @@
 		return -ENOMEM;
 
 	if (line6->properties->capabilities & LINE6_CAP_CONTROL_MIDI) {
-		line6->buffer_message = kmalloc(LINE6_MIDI_MESSAGE_MAXLEN, GFP_KERNEL);
+		line6->buffer_message = kzalloc(LINE6_MIDI_MESSAGE_MAXLEN, GFP_KERNEL);
 		if (!line6->buffer_message)
 			return -ENOMEM;
 

diff --git a/tools/include/uapi/linux/mman.h b/tools/include/uapi/linux/mman.h
index bfd5938..467dcfc 100644
--- a/tools/include/uapi/linux/mman.h
+++ b/tools/include/uapi/linux/mman.h

@@ -5,8 +5,9 @@
 #include <asm/mman.h>
 #include <asm-generic/hugetlb_encode.h>
 
-#define MREMAP_MAYMOVE	1
-#define MREMAP_FIXED	2
+#define MREMAP_MAYMOVE		1
+#define MREMAP_FIXED		2
+#define MREMAP_DONTUNMAP	4
 
 #define OVERCOMMIT_GUESS		0
 #define OVERCOMMIT_ALWAYS		1

diff --git a/tools/lib/subcmd/parse-options.c b/tools/lib/subcmd/parse-options.c
index f6a1bab..264db22 100644
--- a/tools/lib/subcmd/parse-options.c
+++ b/tools/lib/subcmd/parse-options.c

@@ -612,11 +612,10 @@
 			const char *const subcommands[], const char *usagestr[], int flags)
 {
 	struct parse_opt_ctx_t ctx;
+	char *buf = NULL;
 
 	/* build usage string if it's not provided */
 	if (subcommands && !usagestr[0]) {
-		char *buf = NULL;
-
 		astrcatf(&buf, "%s %s [<options>] {", subcmd_config.exec_name, argv[0]);
 
 		for (int i = 0; subcommands[i]; i++) {
@@ -658,7 +657,10 @@
 			astrcatf(&error_buf, "unknown switch `%c'", *ctx.opt);
 		usage_with_options(usagestr, options);
 	}
-
+	if (buf) {
+		usagestr[0] = NULL;
+		free(buf);
+	}
 	return parse_options_end(&ctx);
 }
 

diff --git a/tools/objtool/arch/x86/lib/x86-opcode-map.txt b/tools/objtool/arch/x86/lib/x86-opcode-map.txt
index 5cb9f00..996a3a2 100644
--- a/tools/objtool/arch/x86/lib/x86-opcode-map.txt
+++ b/tools/objtool/arch/x86/lib/x86-opcode-map.txt

@@ -148,7 +148,7 @@
 65: SEG=GS (Prefix)
 66: Operand-Size (Prefix)
 67: Address-Size (Prefix)
-68: PUSH Iz (d64)
+68: PUSH Iz
 69: IMUL Gv,Ev,Iz
 6a: PUSH Ib (d64)
 6b: IMUL Gv,Ev,Ib

diff --git a/tools/perf/trace/beauty/mmap.c b/tools/perf/trace/beauty/mmap.c
index 51f1cea..91b88fd 100644
--- a/tools/perf/trace/beauty/mmap.c
+++ b/tools/perf/trace/beauty/mmap.c

@@ -85,6 +85,7 @@
 
 	P_MREMAP_FLAG(MAYMOVE);
 	P_MREMAP_FLAG(FIXED);
+	P_MREMAP_FLAG(DONTUNMAP);
 #undef P_MREMAP_FLAG
 
 	if (flags)

diff --git a/tools/power/x86/turbostat/turbostat.8 b/tools/power/x86/turbostat/turbostat.8
index ccf2a69..948c808 100644
--- a/tools/power/x86/turbostat/turbostat.8
+++ b/tools/power/x86/turbostat/turbostat.8

@@ -296,7 +296,7 @@
 
 Busy% = MPERF_delta/TSC_delta
 
-Bzy_MHz = TSC_delta/APERF_delta/MPERF_delta/measurement_interval
+Bzy_MHz = TSC_delta*APERF_delta/MPERF_delta/measurement_interval
 
 Note that these calculations depend on TSC_delta, so they
 are not reliable during intervals when TSC_MHz is not running at the base frequency.

diff --git a/tools/power/x86/turbostat/turbostat.c b/tools/power/x86/turbostat/turbostat.c
index 0692f2e..e850ac1 100644
--- a/tools/power/x86/turbostat/turbostat.c
+++ b/tools/power/x86/turbostat/turbostat.c

@@ -1353,9 +1353,10 @@
 	average.packages.rapl_dram_perf_status += p->rapl_dram_perf_status;
 
 	for (i = 0, mp = sys.pp; mp; i++, mp = mp->next) {
-		if (mp->format == FORMAT_RAW)
-			continue;
-		average.packages.counter[i] += p->counter[i];
+		if ((mp->format == FORMAT_RAW) && (topo.num_packages == 0))
+			average.packages.counter[i] = p->counter[i];
+		else
+			average.packages.counter[i] += p->counter[i];
 	}
 	return 0;
 }

diff --git a/tools/testing/selftests/bpf/test_verifier.c b/tools/testing/selftests/bpf/test_verifier.c
index f7757f7..f2e9b37 100644
--- a/tools/testing/selftests/bpf/test_verifier.c
+++ b/tools/testing/selftests/bpf/test_verifier.c

@@ -8046,6 +8046,78 @@
 		.result = REJECT,
 		.errstr = "variable ctx access var_off=(0x0; 0x4)",
 	},
+	{
+		"bpf_exit with invalid return code. test1",
+		.insns = {
+			BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
+			BPF_EXIT_INSN(),
+		},
+		.errstr = "R0 has value (0x0; 0xffffffff)",
+		.result = REJECT,
+		.prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
+	},
+	{
+		"bpf_exit with invalid return code. test2",
+		.insns = {
+			BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
+			BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 1),
+			BPF_EXIT_INSN(),
+		},
+		.result = ACCEPT,
+		.prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
+	},
+	{
+		"bpf_exit with invalid return code. test3",
+		.insns = {
+			BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
+			BPF_ALU64_IMM(BPF_AND, BPF_REG_0, 3),
+			BPF_EXIT_INSN(),
+		},
+		.errstr = "R0 has value (0x0; 0x3)",
+		.result = REJECT,
+		.prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
+	},
+	{
+		"bpf_exit with invalid return code. test4",
+		.insns = {
+			BPF_MOV64_IMM(BPF_REG_0, 1),
+			BPF_EXIT_INSN(),
+		},
+		.result = ACCEPT,
+		.prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
+	},
+	{
+		"bpf_exit with invalid return code. test5",
+		.insns = {
+			BPF_MOV64_IMM(BPF_REG_0, 2),
+			BPF_EXIT_INSN(),
+		},
+		.errstr = "R0 has value (0x2; 0x0)",
+		.result = REJECT,
+		.prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
+	},
+	{
+		"bpf_exit with invalid return code. test6",
+		.insns = {
+			BPF_MOV64_REG(BPF_REG_0, BPF_REG_1),
+			BPF_EXIT_INSN(),
+		},
+		.errstr = "R0 is not a known value (ctx)",
+		.result = REJECT,
+		.prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
+	},
+	{
+		"bpf_exit with invalid return code. test7",
+		.insns = {
+			BPF_LDX_MEM(BPF_W, BPF_REG_0, BPF_REG_1, 0),
+			BPF_LDX_MEM(BPF_W, BPF_REG_2, BPF_REG_1, 4),
+			BPF_ALU64_REG(BPF_MUL, BPF_REG_0, BPF_REG_2),
+			BPF_EXIT_INSN(),
+		},
+		.errstr = "R0 has unknown scalar value",
+		.result = REJECT,
+		.prog_type = BPF_PROG_TYPE_CGROUP_SOCK,
+	},
 };
 
 static int probe_filter_length(const struct bpf_insn *fp)

diff --git a/tools/testing/selftests/ftrace/test.d/event/subsystem-enable.tc b/tools/testing/selftests/ftrace/test.d/event/subsystem-enable.tc
index 8509490..9365a3c 100644
--- a/tools/testing/selftests/ftrace/test.d/event/subsystem-enable.tc
+++ b/tools/testing/selftests/ftrace/test.d/event/subsystem-enable.tc

@@ -30,7 +30,7 @@
 
 yield
 
-count=`cat trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l`
+count=`head -n 100 trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l`
 if [ $count -lt 3 ]; then
     fail "at least fork, exec and exit events should be recorded"
 fi
@@ -41,7 +41,7 @@
 
 yield
 
-count=`cat trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l`
+count=`head -n 100 trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l`
 if [ $count -lt 3 ]; then
     fail "at least fork, exec and exit events should be recorded"
 fi
@@ -52,7 +52,7 @@
 
 yield
 
-count=`cat trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l`
+count=`head -n 100 trace | grep -v ^# | awk '{ print $5 }' | sort -u | wc -l`
 if [ $count -ne 0 ]; then
     fail "any of scheduler events should not be recorded"
 fi

diff --git a/tools/testing/selftests/kcmp/kcmp_test.c b/tools/testing/selftests/kcmp/kcmp_test.c
index 6ea7b9f..d7a8e32 100644
--- a/tools/testing/selftests/kcmp/kcmp_test.c
+++ b/tools/testing/selftests/kcmp/kcmp_test.c

@@ -88,7 +88,10 @@
 		int pid2 = getpid();
 		int ret;
 
-		fd2 = open(kpath, O_RDWR, 0644);
+		ksft_print_header();
+		ksft_set_plan(3);
+
+		fd2 = open(kpath, O_RDWR);
 		if (fd2 < 0) {
 			perror("Can't open file");
 			ksft_exit_fail();
@@ -152,7 +155,6 @@
 			ksft_inc_pass_cnt();
 		}
 
-		ksft_print_cnts();
 
 		if (ret)
 			ksft_exit_fail();
@@ -162,5 +164,5 @@
 
 	waitpid(pid2, &status, P_ALL);
 
-	return ksft_exit_pass();
+	return 0;
 }

diff --git a/tools/testing/selftests/timers/posix_timers.c b/tools/testing/selftests/timers/posix_timers.c
index 15cf56d..0fab100 100644
--- a/tools/testing/selftests/timers/posix_timers.c
+++ b/tools/testing/selftests/timers/posix_timers.c

@@ -67,7 +67,7 @@
 	diff = end.tv_usec - start.tv_usec;
 	diff += (end.tv_sec - start.tv_sec) * USECS_PER_SEC;
 
-	if (abs(diff - DELAY * USECS_PER_SEC) > USECS_PER_SEC / 2) {
+	if (llabs(diff - DELAY * USECS_PER_SEC) > USECS_PER_SEC / 2) {
 		printf("Diff too high: %lld..", diff);
 		return -1;
 	}

diff --git a/tools/testing/selftests/timers/valid-adjtimex.c b/tools/testing/selftests/timers/valid-adjtimex.c
index 48b9a80..d13ebde 100644
--- a/tools/testing/selftests/timers/valid-adjtimex.c
+++ b/tools/testing/selftests/timers/valid-adjtimex.c

@@ -21,9 +21,6 @@
  *   MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  *   GNU General Public License for more details.
  */
-
-
-
 #include <stdio.h>
 #include <stdlib.h>
 #include <time.h>
@@ -62,45 +59,47 @@
 #define NUM_FREQ_OUTOFRANGE 4
 #define NUM_FREQ_INVALID 2
 
+#define SHIFTED_PPM (1 << 16)
+
 long valid_freq[NUM_FREQ_VALID] = {
-	-499<<16,
-	-450<<16,
-	-400<<16,
-	-350<<16,
-	-300<<16,
-	-250<<16,
-	-200<<16,
-	-150<<16,
-	-100<<16,
-	-75<<16,
-	-50<<16,
-	-25<<16,
-	-10<<16,
-	-5<<16,
-	-1<<16,
+	 -499 * SHIFTED_PPM,
+	 -450 * SHIFTED_PPM,
+	 -400 * SHIFTED_PPM,
+	 -350 * SHIFTED_PPM,
+	 -300 * SHIFTED_PPM,
+	 -250 * SHIFTED_PPM,
+	 -200 * SHIFTED_PPM,
+	 -150 * SHIFTED_PPM,
+	 -100 * SHIFTED_PPM,
+	  -75 * SHIFTED_PPM,
+	  -50 * SHIFTED_PPM,
+	  -25 * SHIFTED_PPM,
+	  -10 * SHIFTED_PPM,
+	   -5 * SHIFTED_PPM,
+	   -1 * SHIFTED_PPM,
 	-1000,
-	1<<16,
-	5<<16,
-	10<<16,
-	25<<16,
-	50<<16,
-	75<<16,
-	100<<16,
-	150<<16,
-	200<<16,
-	250<<16,
-	300<<16,
-	350<<16,
-	400<<16,
-	450<<16,
-	499<<16,
+	    1 * SHIFTED_PPM,
+	    5 * SHIFTED_PPM,
+	   10 * SHIFTED_PPM,
+	   25 * SHIFTED_PPM,
+	   50 * SHIFTED_PPM,
+	   75 * SHIFTED_PPM,
+	  100 * SHIFTED_PPM,
+	  150 * SHIFTED_PPM,
+	  200 * SHIFTED_PPM,
+	  250 * SHIFTED_PPM,
+	  300 * SHIFTED_PPM,
+	  350 * SHIFTED_PPM,
+	  400 * SHIFTED_PPM,
+	  450 * SHIFTED_PPM,
+	  499 * SHIFTED_PPM,
 };
 
 long outofrange_freq[NUM_FREQ_OUTOFRANGE] = {
-	-1000<<16,
-	-550<<16,
-	550<<16,
-	1000<<16,
+	-1000 * SHIFTED_PPM,
+	 -550 * SHIFTED_PPM,
+	  550 * SHIFTED_PPM,
+	 1000 * SHIFTED_PPM,
 };
 
 #define LONG_MAX (~0UL>>1)

diff --git a/tools/testing/selftests/vm/map_hugetlb.c b/tools/testing/selftests/vm/map_hugetlb.c
index c65c55b..312889e 100644
--- a/tools/testing/selftests/vm/map_hugetlb.c
+++ b/tools/testing/selftests/vm/map_hugetlb.c

@@ -15,7 +15,6 @@
 #include <unistd.h>
 #include <sys/mman.h>
 #include <fcntl.h>
-#include "vm_util.h"
 
 #define LENGTH (256UL*1024*1024)
 #define PROTECTION (PROT_READ | PROT_WRITE)
@@ -71,16 +70,10 @@
 {
 	void *addr;
 	int ret;
-	size_t hugepage_size;
 	size_t length = LENGTH;
 	int flags = FLAGS;
 	int shift = 0;
 
-	hugepage_size = default_huge_page_size();
-	/* munmap with fail if the length is not page aligned */
-	if (hugepage_size > length)
-		length = hugepage_size;
-
 	if (argc > 1)
 		length = atol(argv[1]) << 20;
 	if (argc > 2) {
commit	9850488201f0b0bcbded1eca53750d2fd6accfbb	[log] [tgz]
author	Tim Zimmermann <tim@linux4.de>	Fri Jul 26 06:10:45 2024 +0200
committer	Tim Zimmermann <tim@linux4.de>	Fri Jul 26 06:10:45 2024 +0200
tree	0502cbe21786d425060a3d7afdacd4010651e9c4
parent	47320233b0588873e131d00d1f7103a4b8311a92 [diff]
parent	96bb20c54464e5d19c856d6dac93850132d2f0b7 [diff]