Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-magellan/patches-4.15/0105-4.15.6-all-fixes.patch

    Annotation of /trunk/kernel-magellan/patches-4.15/0105-4.15.6-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3089 - (hide annotations) (download)
    Wed Mar 21 14:52:34 2018 UTC (6 years, 2 months ago) by niro
    File size: 48432 byte(s) 
    -linux-4.15.6
    1 niro 3089 diff --git a/Makefile b/Makefile
    2     index 28c537fbe328..51563c76bdf6 100644
    3     --- a/Makefile
    4     +++ b/Makefile
    5     @@ -1,7 +1,7 @@
    6     # SPDX-License-Identifier: GPL-2.0
    7     VERSION = 4
    8     PATCHLEVEL = 15
    9     -SUBLEVEL = 5
    10     +SUBLEVEL = 6
    11     EXTRAVERSION =
    12     NAME = Fearless Coyote
    13    
    14     diff --git a/arch/arm/common/bL_switcher_dummy_if.c b/arch/arm/common/bL_switcher_dummy_if.c
    15     index 4c10c6452678..f4dc1714a79e 100644
    16     --- a/arch/arm/common/bL_switcher_dummy_if.c
    17     +++ b/arch/arm/common/bL_switcher_dummy_if.c
    18     @@ -57,3 +57,7 @@ static struct miscdevice bL_switcher_device = {
    19     &bL_switcher_fops
    20     };
    21     module_misc_device(bL_switcher_device);
    22     +
    23     +MODULE_AUTHOR("Nicolas Pitre <nico@linaro.org>");
    24     +MODULE_LICENSE("GPL v2");
    25     +MODULE_DESCRIPTION("big.LITTLE switcher dummy user interface");
    26     diff --git a/arch/arm64/boot/dts/mediatek/mt8173.dtsi b/arch/arm64/boot/dts/mediatek/mt8173.dtsi
    27     index 26396ef53bde..ea407aff1251 100644
    28     --- a/arch/arm64/boot/dts/mediatek/mt8173.dtsi
    29     +++ b/arch/arm64/boot/dts/mediatek/mt8173.dtsi
    30     @@ -81,6 +81,7 @@
    31     reg = <0x000>;
    32     enable-method = "psci";
    33     cpu-idle-states = <&CPU_SLEEP_0>;
    34     + #cooling-cells = <2>;
    35     };
    36    
    37     cpu1: cpu@1 {
    38     @@ -97,6 +98,7 @@
    39     reg = <0x100>;
    40     enable-method = "psci";
    41     cpu-idle-states = <&CPU_SLEEP_0>;
    42     + #cooling-cells = <2>;
    43     };
    44    
    45     cpu3: cpu@101 {
    46     diff --git a/arch/x86/crypto/twofish-x86_64-asm_64-3way.S b/arch/x86/crypto/twofish-x86_64-asm_64-3way.S
    47     index 1c3b7ceb36d2..e7273a606a07 100644
    48     --- a/arch/x86/crypto/twofish-x86_64-asm_64-3way.S
    49     +++ b/arch/x86/crypto/twofish-x86_64-asm_64-3way.S
    50     @@ -55,29 +55,31 @@
    51     #define RAB1bl %bl
    52     #define RAB2bl %cl
    53    
    54     +#define CD0 0x0(%rsp)
    55     +#define CD1 0x8(%rsp)
    56     +#define CD2 0x10(%rsp)
    57     +
    58     +# used only before/after all rounds
    59     #define RCD0 %r8
    60     #define RCD1 %r9
    61     #define RCD2 %r10
    62    
    63     -#define RCD0d %r8d
    64     -#define RCD1d %r9d
    65     -#define RCD2d %r10d
    66     -
    67     -#define RX0 %rbp
    68     -#define RX1 %r11
    69     -#define RX2 %r12
    70     +# used only during rounds
    71     +#define RX0 %r8
    72     +#define RX1 %r9
    73     +#define RX2 %r10
    74    
    75     -#define RX0d %ebp
    76     -#define RX1d %r11d
    77     -#define RX2d %r12d
    78     +#define RX0d %r8d
    79     +#define RX1d %r9d
    80     +#define RX2d %r10d
    81    
    82     -#define RY0 %r13
    83     -#define RY1 %r14
    84     -#define RY2 %r15
    85     +#define RY0 %r11
    86     +#define RY1 %r12
    87     +#define RY2 %r13
    88    
    89     -#define RY0d %r13d
    90     -#define RY1d %r14d
    91     -#define RY2d %r15d
    92     +#define RY0d %r11d
    93     +#define RY1d %r12d
    94     +#define RY2d %r13d
    95    
    96     #define RT0 %rdx
    97     #define RT1 %rsi
    98     @@ -85,6 +87,8 @@
    99     #define RT0d %edx
    100     #define RT1d %esi
    101    
    102     +#define RT1bl %sil
    103     +
    104     #define do16bit_ror(rot, op1, op2, T0, T1, tmp1, tmp2, ab, dst) \
    105     movzbl ab ## bl, tmp2 ## d; \
    106     movzbl ab ## bh, tmp1 ## d; \
    107     @@ -92,6 +96,11 @@
    108     op1##l T0(CTX, tmp2, 4), dst ## d; \
    109     op2##l T1(CTX, tmp1, 4), dst ## d;
    110    
    111     +#define swap_ab_with_cd(ab, cd, tmp) \
    112     + movq cd, tmp; \
    113     + movq ab, cd; \
    114     + movq tmp, ab;
    115     +
    116     /*
    117     * Combined G1 & G2 function. Reordered with help of rotates to have moves
    118     * at begining.
    119     @@ -110,15 +119,15 @@
    120     /* G1,2 && G2,2 */ \
    121     do16bit_ror(32, xor, xor, Tx2, Tx3, RT0, RT1, ab ## 0, x ## 0); \
    122     do16bit_ror(16, xor, xor, Ty3, Ty0, RT0, RT1, ab ## 0, y ## 0); \
    123     - xchgq cd ## 0, ab ## 0; \
    124     + swap_ab_with_cd(ab ## 0, cd ## 0, RT0); \
    125     \
    126     do16bit_ror(32, xor, xor, Tx2, Tx3, RT0, RT1, ab ## 1, x ## 1); \
    127     do16bit_ror(16, xor, xor, Ty3, Ty0, RT0, RT1, ab ## 1, y ## 1); \
    128     - xchgq cd ## 1, ab ## 1; \
    129     + swap_ab_with_cd(ab ## 1, cd ## 1, RT0); \
    130     \
    131     do16bit_ror(32, xor, xor, Tx2, Tx3, RT0, RT1, ab ## 2, x ## 2); \
    132     do16bit_ror(16, xor, xor, Ty3, Ty0, RT0, RT1, ab ## 2, y ## 2); \
    133     - xchgq cd ## 2, ab ## 2;
    134     + swap_ab_with_cd(ab ## 2, cd ## 2, RT0);
    135    
    136     #define enc_round_end(ab, x, y, n) \
    137     addl y ## d, x ## d; \
    138     @@ -168,6 +177,16 @@
    139     decrypt_round3(ba, dc, (n*2)+1); \
    140     decrypt_round3(ba, dc, (n*2));
    141    
    142     +#define push_cd() \
    143     + pushq RCD2; \
    144     + pushq RCD1; \
    145     + pushq RCD0;
    146     +
    147     +#define pop_cd() \
    148     + popq RCD0; \
    149     + popq RCD1; \
    150     + popq RCD2;
    151     +
    152     #define inpack3(in, n, xy, m) \
    153     movq 4*(n)(in), xy ## 0; \
    154     xorq w+4*m(CTX), xy ## 0; \
    155     @@ -223,11 +242,8 @@ ENTRY(__twofish_enc_blk_3way)
    156     * %rdx: src, RIO
    157     * %rcx: bool, if true: xor output
    158     */
    159     - pushq %r15;
    160     - pushq %r14;
    161     pushq %r13;
    162     pushq %r12;
    163     - pushq %rbp;
    164     pushq %rbx;
    165    
    166     pushq %rcx; /* bool xor */
    167     @@ -235,40 +251,36 @@ ENTRY(__twofish_enc_blk_3way)
    168    
    169     inpack_enc3();
    170    
    171     - encrypt_cycle3(RAB, RCD, 0);
    172     - encrypt_cycle3(RAB, RCD, 1);
    173     - encrypt_cycle3(RAB, RCD, 2);
    174     - encrypt_cycle3(RAB, RCD, 3);
    175     - encrypt_cycle3(RAB, RCD, 4);
    176     - encrypt_cycle3(RAB, RCD, 5);
    177     - encrypt_cycle3(RAB, RCD, 6);
    178     - encrypt_cycle3(RAB, RCD, 7);
    179     + push_cd();
    180     + encrypt_cycle3(RAB, CD, 0);
    181     + encrypt_cycle3(RAB, CD, 1);
    182     + encrypt_cycle3(RAB, CD, 2);
    183     + encrypt_cycle3(RAB, CD, 3);
    184     + encrypt_cycle3(RAB, CD, 4);
    185     + encrypt_cycle3(RAB, CD, 5);
    186     + encrypt_cycle3(RAB, CD, 6);
    187     + encrypt_cycle3(RAB, CD, 7);
    188     + pop_cd();
    189    
    190     popq RIO; /* dst */
    191     - popq %rbp; /* bool xor */
    192     + popq RT1; /* bool xor */
    193    
    194     - testb %bpl, %bpl;
    195     + testb RT1bl, RT1bl;
    196     jnz .L__enc_xor3;
    197    
    198     outunpack_enc3(mov);
    199    
    200     popq %rbx;
    201     - popq %rbp;
    202     popq %r12;
    203     popq %r13;
    204     - popq %r14;
    205     - popq %r15;
    206     ret;
    207    
    208     .L__enc_xor3:
    209     outunpack_enc3(xor);
    210    
    211     popq %rbx;
    212     - popq %rbp;
    213     popq %r12;
    214     popq %r13;
    215     - popq %r14;
    216     - popq %r15;
    217     ret;
    218     ENDPROC(__twofish_enc_blk_3way)
    219    
    220     @@ -278,35 +290,31 @@ ENTRY(twofish_dec_blk_3way)
    221     * %rsi: dst
    222     * %rdx: src, RIO
    223     */
    224     - pushq %r15;
    225     - pushq %r14;
    226     pushq %r13;
    227     pushq %r12;
    228     - pushq %rbp;
    229     pushq %rbx;
    230    
    231     pushq %rsi; /* dst */
    232    
    233     inpack_dec3();
    234    
    235     - decrypt_cycle3(RAB, RCD, 7);
    236     - decrypt_cycle3(RAB, RCD, 6);
    237     - decrypt_cycle3(RAB, RCD, 5);
    238     - decrypt_cycle3(RAB, RCD, 4);
    239     - decrypt_cycle3(RAB, RCD, 3);
    240     - decrypt_cycle3(RAB, RCD, 2);
    241     - decrypt_cycle3(RAB, RCD, 1);
    242     - decrypt_cycle3(RAB, RCD, 0);
    243     + push_cd();
    244     + decrypt_cycle3(RAB, CD, 7);
    245     + decrypt_cycle3(RAB, CD, 6);
    246     + decrypt_cycle3(RAB, CD, 5);
    247     + decrypt_cycle3(RAB, CD, 4);
    248     + decrypt_cycle3(RAB, CD, 3);
    249     + decrypt_cycle3(RAB, CD, 2);
    250     + decrypt_cycle3(RAB, CD, 1);
    251     + decrypt_cycle3(RAB, CD, 0);
    252     + pop_cd();
    253    
    254     popq RIO; /* dst */
    255    
    256     outunpack_dec3();
    257    
    258     popq %rbx;
    259     - popq %rbp;
    260     popq %r12;
    261     popq %r13;
    262     - popq %r14;
    263     - popq %r15;
    264     ret;
    265     ENDPROC(twofish_dec_blk_3way)
    266     diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
    267     index ac381437c291..17f4eca37d22 100644
    268     --- a/arch/x86/kvm/x86.c
    269     +++ b/arch/x86/kvm/x86.c
    270     @@ -2939,6 +2939,12 @@ void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu)
    271     pagefault_enable();
    272     kvm_x86_ops->vcpu_put(vcpu);
    273     vcpu->arch.last_host_tsc = rdtsc();
    274     + /*
    275     + * If userspace has set any breakpoints or watchpoints, dr6 is restored
    276     + * on every vmexit, but if not, we might have a stale dr6 from the
    277     + * guest. do_debug expects dr6 to be cleared after it runs, do the same.
    278     + */
    279     + set_debugreg(0, 6);
    280     }
    281    
    282     static int kvm_vcpu_ioctl_get_lapic(struct kvm_vcpu *vcpu,
    283     diff --git a/block/blk-map.c b/block/blk-map.c
    284     index d3a94719f03f..db9373bd31ac 100644
    285     --- a/block/blk-map.c
    286     +++ b/block/blk-map.c
    287     @@ -119,7 +119,7 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,
    288     unsigned long align = q->dma_pad_mask | queue_dma_alignment(q);
    289     struct bio *bio = NULL;
    290     struct iov_iter i;
    291     - int ret;
    292     + int ret = -EINVAL;
    293    
    294     if (!iter_is_iovec(iter))
    295     goto fail;
    296     @@ -148,7 +148,7 @@ int blk_rq_map_user_iov(struct request_queue *q, struct request *rq,
    297     __blk_rq_unmap_user(bio);
    298     fail:
    299     rq->bio = NULL;
    300     - return -EINVAL;
    301     + return ret;
    302     }
    303     EXPORT_SYMBOL(blk_rq_map_user_iov);
    304    
    305     diff --git a/drivers/android/binder.c b/drivers/android/binder.c
    306     index ec0917fb7cca..255eabdca2a4 100644
    307     --- a/drivers/android/binder.c
    308     +++ b/drivers/android/binder.c
    309     @@ -1933,8 +1933,14 @@ static void binder_send_failed_reply(struct binder_transaction *t,
    310     &target_thread->todo);
    311     wake_up_interruptible(&target_thread->wait);
    312     } else {
    313     - WARN(1, "Unexpected reply error: %u\n",
    314     - target_thread->reply_error.cmd);
    315     + /*
    316     + * Cannot get here for normal operation, but
    317     + * we can if multiple synchronous transactions
    318     + * are sent without blocking for responses.
    319     + * Just ignore the 2nd error in this case.
    320     + */
    321     + pr_warn("Unexpected reply error: %u\n",
    322     + target_thread->reply_error.cmd);
    323     }
    324     binder_inner_proc_unlock(target_thread->proc);
    325     binder_thread_dec_tmpref(target_thread);
    326     @@ -2135,7 +2141,7 @@ static void binder_transaction_buffer_release(struct binder_proc *proc,
    327     int debug_id = buffer->debug_id;
    328    
    329     binder_debug(BINDER_DEBUG_TRANSACTION,
    330     - "%d buffer release %d, size %zd-%zd, failed at %p\n",
    331     + "%d buffer release %d, size %zd-%zd, failed at %pK\n",
    332     proc->pid, buffer->debug_id,
    333     buffer->data_size, buffer->offsets_size, failed_at);
    334    
    335     @@ -3647,7 +3653,7 @@ static int binder_thread_write(struct binder_proc *proc,
    336     }
    337     }
    338     binder_debug(BINDER_DEBUG_DEAD_BINDER,
    339     - "%d:%d BC_DEAD_BINDER_DONE %016llx found %p\n",
    340     + "%d:%d BC_DEAD_BINDER_DONE %016llx found %pK\n",
    341     proc->pid, thread->pid, (u64)cookie,
    342     death);
    343     if (death == NULL) {
    344     @@ -4316,6 +4322,15 @@ static int binder_thread_release(struct binder_proc *proc,
    345    
    346     binder_inner_proc_unlock(thread->proc);
    347    
    348     + /*
    349     + * This is needed to avoid races between wake_up_poll() above and
    350     + * and ep_remove_waitqueue() called for other reasons (eg the epoll file
    351     + * descriptor being closed); ep_remove_waitqueue() holds an RCU read
    352     + * lock, so we can be sure it's done after calling synchronize_rcu().
    353     + */
    354     + if (thread->looper & BINDER_LOOPER_STATE_POLL)
    355     + synchronize_rcu();
    356     +
    357     if (send_reply)
    358     binder_send_failed_reply(send_reply, BR_DEAD_REPLY);
    359     binder_release_work(proc, &thread->todo);
    360     @@ -4331,6 +4346,8 @@ static unsigned int binder_poll(struct file *filp,
    361     bool wait_for_proc_work;
    362    
    363     thread = binder_get_thread(proc);
    364     + if (!thread)
    365     + return POLLERR;
    366    
    367     binder_inner_proc_lock(thread->proc);
    368     thread->looper |= BINDER_LOOPER_STATE_POLL;
    369     @@ -4974,7 +4991,7 @@ static void print_binder_transaction_ilocked(struct seq_file *m,
    370     spin_lock(&t->lock);
    371     to_proc = t->to_proc;
    372     seq_printf(m,
    373     - "%s %d: %p from %d:%d to %d:%d code %x flags %x pri %ld r%d",
    374     + "%s %d: %pK from %d:%d to %d:%d code %x flags %x pri %ld r%d",
    375     prefix, t->debug_id, t,
    376     t->from ? t->from->proc->pid : 0,
    377     t->from ? t->from->pid : 0,
    378     @@ -4998,7 +5015,7 @@ static void print_binder_transaction_ilocked(struct seq_file *m,
    379     }
    380     if (buffer->target_node)
    381     seq_printf(m, " node %d", buffer->target_node->debug_id);
    382     - seq_printf(m, " size %zd:%zd data %p\n",
    383     + seq_printf(m, " size %zd:%zd data %pK\n",
    384     buffer->data_size, buffer->offsets_size,
    385     buffer->data);
    386     }
    387     diff --git a/drivers/crypto/s5p-sss.c b/drivers/crypto/s5p-sss.c
    388     index 142c6020cec7..5c0496d1ed41 100644
    389     --- a/drivers/crypto/s5p-sss.c
    390     +++ b/drivers/crypto/s5p-sss.c
    391     @@ -1926,15 +1926,21 @@ static void s5p_aes_crypt_start(struct s5p_aes_dev *dev, unsigned long mode)
    392     uint32_t aes_control;
    393     unsigned long flags;
    394     int err;
    395     + u8 *iv;
    396    
    397     aes_control = SSS_AES_KEY_CHANGE_MODE;
    398     if (mode & FLAGS_AES_DECRYPT)
    399     aes_control |= SSS_AES_MODE_DECRYPT;
    400    
    401     - if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CBC)
    402     + if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CBC) {
    403     aes_control |= SSS_AES_CHAIN_MODE_CBC;
    404     - else if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CTR)
    405     + iv = req->info;
    406     + } else if ((mode & FLAGS_AES_MODE_MASK) == FLAGS_AES_CTR) {
    407     aes_control |= SSS_AES_CHAIN_MODE_CTR;
    408     + iv = req->info;
    409     + } else {
    410     + iv = NULL; /* AES_ECB */
    411     + }
    412    
    413     if (dev->ctx->keylen == AES_KEYSIZE_192)
    414     aes_control |= SSS_AES_KEY_SIZE_192;
    415     @@ -1965,7 +1971,7 @@ static void s5p_aes_crypt_start(struct s5p_aes_dev *dev, unsigned long mode)
    416     goto outdata_error;
    417    
    418     SSS_AES_WRITE(dev, AES_CONTROL, aes_control);
    419     - s5p_set_aes(dev, dev->ctx->aes_key, req->info, dev->ctx->keylen);
    420     + s5p_set_aes(dev, dev->ctx->aes_key, iv, dev->ctx->keylen);
    421    
    422     s5p_set_dma_indata(dev, dev->sg_src);
    423     s5p_set_dma_outdata(dev, dev->sg_dst);
    424     diff --git a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
    425     index 8289ee482f49..09bd6c6c176c 100644
    426     --- a/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
    427     +++ b/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
    428     @@ -3648,6 +3648,12 @@ static int pvr2_send_request_ex(struct pvr2_hdw *hdw,
    429     hdw);
    430     hdw->ctl_write_urb->actual_length = 0;
    431     hdw->ctl_write_pend_flag = !0;
    432     + if (usb_urb_ep_type_check(hdw->ctl_write_urb)) {
    433     + pvr2_trace(
    434     + PVR2_TRACE_ERROR_LEGS,
    435     + "Invalid write control endpoint");
    436     + return -EINVAL;
    437     + }
    438     status = usb_submit_urb(hdw->ctl_write_urb,GFP_KERNEL);
    439     if (status < 0) {
    440     pvr2_trace(PVR2_TRACE_ERROR_LEGS,
    441     @@ -3672,6 +3678,12 @@ status);
    442     hdw);
    443     hdw->ctl_read_urb->actual_length = 0;
    444     hdw->ctl_read_pend_flag = !0;
    445     + if (usb_urb_ep_type_check(hdw->ctl_read_urb)) {
    446     + pvr2_trace(
    447     + PVR2_TRACE_ERROR_LEGS,
    448     + "Invalid read control endpoint");
    449     + return -EINVAL;
    450     + }
    451     status = usb_submit_urb(hdw->ctl_read_urb,GFP_KERNEL);
    452     if (status < 0) {
    453     pvr2_trace(PVR2_TRACE_ERROR_LEGS,
    454     diff --git a/drivers/misc/mei/hw-me-regs.h b/drivers/misc/mei/hw-me-regs.h
    455     index 0ccccbaf530d..e4b10b2d1a08 100644
    456     --- a/drivers/misc/mei/hw-me-regs.h
    457     +++ b/drivers/misc/mei/hw-me-regs.h
    458     @@ -132,6 +132,11 @@
    459     #define MEI_DEV_ID_KBP 0xA2BA /* Kaby Point */
    460     #define MEI_DEV_ID_KBP_2 0xA2BB /* Kaby Point 2 */
    461    
    462     +#define MEI_DEV_ID_CNP_LP 0x9DE0 /* Cannon Point LP */
    463     +#define MEI_DEV_ID_CNP_LP_4 0x9DE4 /* Cannon Point LP 4 (iTouch) */
    464     +#define MEI_DEV_ID_CNP_H 0xA360 /* Cannon Point H */
    465     +#define MEI_DEV_ID_CNP_H_4 0xA364 /* Cannon Point H 4 (iTouch) */
    466     +
    467     /*
    468     * MEI HW Section
    469     */
    470     diff --git a/drivers/misc/mei/pci-me.c b/drivers/misc/mei/pci-me.c
    471     index 4a0ccda4d04b..ea4e152270a3 100644
    472     --- a/drivers/misc/mei/pci-me.c
    473     +++ b/drivers/misc/mei/pci-me.c
    474     @@ -98,6 +98,11 @@ static const struct pci_device_id mei_me_pci_tbl[] = {
    475     {MEI_PCI_DEVICE(MEI_DEV_ID_KBP, MEI_ME_PCH8_CFG)},
    476     {MEI_PCI_DEVICE(MEI_DEV_ID_KBP_2, MEI_ME_PCH8_CFG)},
    477    
    478     + {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_LP, MEI_ME_PCH8_CFG)},
    479     + {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_LP_4, MEI_ME_PCH8_CFG)},
    480     + {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H, MEI_ME_PCH8_CFG)},
    481     + {MEI_PCI_DEVICE(MEI_DEV_ID_CNP_H_4, MEI_ME_PCH8_CFG)},
    482     +
    483     /* required last entry */
    484     {0, }
    485     };
    486     diff --git a/drivers/net/tun.c b/drivers/net/tun.c
    487     index a8ec589d1359..e29cd5c7d39f 100644
    488     --- a/drivers/net/tun.c
    489     +++ b/drivers/net/tun.c
    490     @@ -1317,27 +1317,23 @@ static struct sk_buff *tun_napi_alloc_frags(struct tun_file *tfile,
    491     skb->truesize += skb->data_len;
    492    
    493     for (i = 1; i < it->nr_segs; i++) {
    494     + struct page_frag *pfrag = &current->task_frag;
    495     size_t fragsz = it->iov[i].iov_len;
    496     - unsigned long offset;
    497     - struct page *page;
    498     - void *data;
    499    
    500     if (fragsz == 0 || fragsz > PAGE_SIZE) {
    501     err = -EINVAL;
    502     goto free;
    503     }
    504    
    505     - local_bh_disable();
    506     - data = napi_alloc_frag(fragsz);
    507     - local_bh_enable();
    508     - if (!data) {
    509     + if (!skb_page_frag_refill(fragsz, pfrag, GFP_KERNEL)) {
    510     err = -ENOMEM;
    511     goto free;
    512     }
    513    
    514     - page = virt_to_head_page(data);
    515     - offset = data - page_address(page);
    516     - skb_fill_page_desc(skb, i - 1, page, offset, fragsz);
    517     + skb_fill_page_desc(skb, i - 1, pfrag->page,
    518     + pfrag->offset, fragsz);
    519     + page_ref_inc(pfrag->page);
    520     + pfrag->offset += fragsz;
    521     }
    522    
    523     return skb;
    524     diff --git a/drivers/soc/qcom/rmtfs_mem.c b/drivers/soc/qcom/rmtfs_mem.c
    525     index ce35ff748adf..0a43b2e8906f 100644
    526     --- a/drivers/soc/qcom/rmtfs_mem.c
    527     +++ b/drivers/soc/qcom/rmtfs_mem.c
    528     @@ -267,3 +267,7 @@ static void qcom_rmtfs_mem_exit(void)
    529     unregister_chrdev_region(qcom_rmtfs_mem_major, QCOM_RMTFS_MEM_DEV_MAX);
    530     }
    531     module_exit(qcom_rmtfs_mem_exit);
    532     +
    533     +MODULE_AUTHOR("Linaro Ltd");
    534     +MODULE_DESCRIPTION("Qualcomm Remote Filesystem memory driver");
    535     +MODULE_LICENSE("GPL v2");
    536     diff --git a/drivers/staging/android/ashmem.c b/drivers/staging/android/ashmem.c
    537     index 372ce9913e6d..e7541dc90473 100644
    538     --- a/drivers/staging/android/ashmem.c
    539     +++ b/drivers/staging/android/ashmem.c
    540     @@ -710,30 +710,32 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd,
    541     size_t pgstart, pgend;
    542     int ret = -EINVAL;
    543    
    544     + mutex_lock(&ashmem_mutex);
    545     +
    546     if (unlikely(!asma->file))
    547     - return -EINVAL;
    548     + goto out_unlock;
    549    
    550     - if (unlikely(copy_from_user(&pin, p, sizeof(pin))))
    551     - return -EFAULT;
    552     + if (unlikely(copy_from_user(&pin, p, sizeof(pin)))) {
    553     + ret = -EFAULT;
    554     + goto out_unlock;
    555     + }
    556    
    557     /* per custom, you can pass zero for len to mean "everything onward" */
    558     if (!pin.len)
    559     pin.len = PAGE_ALIGN(asma->size) - pin.offset;
    560    
    561     if (unlikely((pin.offset | pin.len) & ~PAGE_MASK))
    562     - return -EINVAL;
    563     + goto out_unlock;
    564    
    565     if (unlikely(((__u32)-1) - pin.offset < pin.len))
    566     - return -EINVAL;
    567     + goto out_unlock;
    568    
    569     if (unlikely(PAGE_ALIGN(asma->size) < pin.offset + pin.len))
    570     - return -EINVAL;
    571     + goto out_unlock;
    572    
    573     pgstart = pin.offset / PAGE_SIZE;
    574     pgend = pgstart + (pin.len / PAGE_SIZE) - 1;
    575    
    576     - mutex_lock(&ashmem_mutex);
    577     -
    578     switch (cmd) {
    579     case ASHMEM_PIN:
    580     ret = ashmem_pin(asma, pgstart, pgend);
    581     @@ -746,6 +748,7 @@ static int ashmem_pin_unpin(struct ashmem_area *asma, unsigned long cmd,
    582     break;
    583     }
    584    
    585     +out_unlock:
    586     mutex_unlock(&ashmem_mutex);
    587    
    588     return ret;
    589     diff --git a/drivers/staging/android/ion/ion-ioctl.c b/drivers/staging/android/ion/ion-ioctl.c
    590     index c78989351f9c..6cfed48f376e 100644
    591     --- a/drivers/staging/android/ion/ion-ioctl.c
    592     +++ b/drivers/staging/android/ion/ion-ioctl.c
    593     @@ -70,8 +70,10 @@ long ion_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
    594     return -EFAULT;
    595    
    596     ret = validate_ioctl_arg(cmd, &data);
    597     - if (WARN_ON_ONCE(ret))
    598     + if (ret) {
    599     + pr_warn_once("%s: ioctl validate failed\n", __func__);
    600     return ret;
    601     + }
    602    
    603     if (!(dir & _IOC_WRITE))
    604     memset(&data, 0, sizeof(data));
    605     diff --git a/drivers/staging/android/ion/ion_system_heap.c b/drivers/staging/android/ion/ion_system_heap.c
    606     index 4dc5d7a589c2..b6ece18e6a88 100644
    607     --- a/drivers/staging/android/ion/ion_system_heap.c
    608     +++ b/drivers/staging/android/ion/ion_system_heap.c
    609     @@ -371,7 +371,7 @@ static int ion_system_contig_heap_allocate(struct ion_heap *heap,
    610     unsigned long i;
    611     int ret;
    612    
    613     - page = alloc_pages(low_order_gfp_flags, order);
    614     + page = alloc_pages(low_order_gfp_flags | __GFP_NOWARN, order);
    615     if (!page)
    616     return -ENOMEM;
    617    
    618     diff --git a/drivers/staging/fsl-mc/bus/Kconfig b/drivers/staging/fsl-mc/bus/Kconfig
    619     index 504c987447f2..eee1c1b277fa 100644
    620     --- a/drivers/staging/fsl-mc/bus/Kconfig
    621     +++ b/drivers/staging/fsl-mc/bus/Kconfig
    622     @@ -8,7 +8,7 @@
    623    
    624     config FSL_MC_BUS
    625     bool "QorIQ DPAA2 fsl-mc bus driver"
    626     - depends on OF && (ARCH_LAYERSCAPE || (COMPILE_TEST && (ARM || ARM64 || X86 || PPC)))
    627     + depends on OF && (ARCH_LAYERSCAPE || (COMPILE_TEST && (ARM || ARM64 || X86_LOCAL_APIC || PPC)))
    628     select GENERIC_MSI_IRQ_DOMAIN
    629     help
    630     Driver to enable the bus infrastructure for the QorIQ DPAA2
    631     diff --git a/drivers/staging/iio/adc/ad7192.c b/drivers/staging/iio/adc/ad7192.c
    632     index cadfb96734ed..d4da2807eb55 100644
    633     --- a/drivers/staging/iio/adc/ad7192.c
    634     +++ b/drivers/staging/iio/adc/ad7192.c
    635     @@ -141,6 +141,8 @@
    636     #define AD7192_GPOCON_P1DAT BIT(1) /* P1 state */
    637     #define AD7192_GPOCON_P0DAT BIT(0) /* P0 state */
    638    
    639     +#define AD7192_EXT_FREQ_MHZ_MIN 2457600
    640     +#define AD7192_EXT_FREQ_MHZ_MAX 5120000
    641     #define AD7192_INT_FREQ_MHZ 4915200
    642    
    643     /* NOTE:
    644     @@ -218,6 +220,12 @@ static int ad7192_calibrate_all(struct ad7192_state *st)
    645     ARRAY_SIZE(ad7192_calib_arr));
    646     }
    647    
    648     +static inline bool ad7192_valid_external_frequency(u32 freq)
    649     +{
    650     + return (freq >= AD7192_EXT_FREQ_MHZ_MIN &&
    651     + freq <= AD7192_EXT_FREQ_MHZ_MAX);
    652     +}
    653     +
    654     static int ad7192_setup(struct ad7192_state *st,
    655     const struct ad7192_platform_data *pdata)
    656     {
    657     @@ -243,17 +251,20 @@ static int ad7192_setup(struct ad7192_state *st,
    658     id);
    659    
    660     switch (pdata->clock_source_sel) {
    661     - case AD7192_CLK_EXT_MCLK1_2:
    662     - case AD7192_CLK_EXT_MCLK2:
    663     - st->mclk = AD7192_INT_FREQ_MHZ;
    664     - break;
    665     case AD7192_CLK_INT:
    666     case AD7192_CLK_INT_CO:
    667     - if (pdata->ext_clk_hz)
    668     - st->mclk = pdata->ext_clk_hz;
    669     - else
    670     - st->mclk = AD7192_INT_FREQ_MHZ;
    671     + st->mclk = AD7192_INT_FREQ_MHZ;
    672     break;
    673     + case AD7192_CLK_EXT_MCLK1_2:
    674     + case AD7192_CLK_EXT_MCLK2:
    675     + if (ad7192_valid_external_frequency(pdata->ext_clk_hz)) {
    676     + st->mclk = pdata->ext_clk_hz;
    677     + break;
    678     + }
    679     + dev_err(&st->sd.spi->dev, "Invalid frequency setting %u\n",
    680     + pdata->ext_clk_hz);
    681     + ret = -EINVAL;
    682     + goto out;
    683     default:
    684     ret = -EINVAL;
    685     goto out;
    686     diff --git a/drivers/staging/iio/impedance-analyzer/ad5933.c b/drivers/staging/iio/impedance-analyzer/ad5933.c
    687     index 2b28fb9c0048..3bcf49466361 100644
    688     --- a/drivers/staging/iio/impedance-analyzer/ad5933.c
    689     +++ b/drivers/staging/iio/impedance-analyzer/ad5933.c
    690     @@ -648,8 +648,6 @@ static int ad5933_register_ring_funcs_and_init(struct iio_dev *indio_dev)
    691     /* Ring buffer functions - here trigger setup related */
    692     indio_dev->setup_ops = &ad5933_ring_setup_ops;
    693    
    694     - indio_dev->modes |= INDIO_BUFFER_HARDWARE;
    695     -
    696     return 0;
    697     }
    698    
    699     @@ -762,7 +760,7 @@ static int ad5933_probe(struct i2c_client *client,
    700     indio_dev->dev.parent = &client->dev;
    701     indio_dev->info = &ad5933_info;
    702     indio_dev->name = id->name;
    703     - indio_dev->modes = INDIO_DIRECT_MODE;
    704     + indio_dev->modes = (INDIO_BUFFER_SOFTWARE | INDIO_DIRECT_MODE);
    705     indio_dev->channels = ad5933_channels;
    706     indio_dev->num_channels = ARRAY_SIZE(ad5933_channels);
    707    
    708     diff --git a/drivers/usb/host/xhci-debugfs.c b/drivers/usb/host/xhci-debugfs.c
    709     index e26e685d8a57..5851052d4668 100644
    710     --- a/drivers/usb/host/xhci-debugfs.c
    711     +++ b/drivers/usb/host/xhci-debugfs.c
    712     @@ -211,7 +211,7 @@ static void xhci_ring_dump_segment(struct seq_file *s,
    713     static int xhci_ring_trb_show(struct seq_file *s, void *unused)
    714     {
    715     int i;
    716     - struct xhci_ring *ring = s->private;
    717     + struct xhci_ring *ring = *(struct xhci_ring **)s->private;
    718     struct xhci_segment *seg = ring->first_seg;
    719    
    720     for (i = 0; i < ring->num_segs; i++) {
    721     @@ -387,7 +387,7 @@ void xhci_debugfs_create_endpoint(struct xhci_hcd *xhci,
    722    
    723     snprintf(epriv->name, sizeof(epriv->name), "ep%02d", ep_index);
    724     epriv->root = xhci_debugfs_create_ring_dir(xhci,
    725     - &dev->eps[ep_index].new_ring,
    726     + &dev->eps[ep_index].ring,
    727     epriv->name,
    728     spriv->root);
    729     spriv->eps[ep_index] = epriv;
    730     diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
    731     index da6dbe3ebd8b..5c1326154e66 100644
    732     --- a/drivers/usb/host/xhci.c
    733     +++ b/drivers/usb/host/xhci.c
    734     @@ -652,8 +652,6 @@ static void xhci_stop(struct usb_hcd *hcd)
    735     return;
    736     }
    737    
    738     - xhci_debugfs_exit(xhci);
    739     -
    740     spin_lock_irq(&xhci->lock);
    741     xhci->xhc_state |= XHCI_STATE_HALTED;
    742     xhci->cmd_ring_state = CMD_RING_STATE_STOPPED;
    743     @@ -685,6 +683,7 @@ static void xhci_stop(struct usb_hcd *hcd)
    744    
    745     xhci_dbg_trace(xhci, trace_xhci_dbg_init, "cleaning up memory");
    746     xhci_mem_cleanup(xhci);
    747     + xhci_debugfs_exit(xhci);
    748     xhci_dbg_trace(xhci, trace_xhci_dbg_init,
    749     "xhci_stop completed - status = %x",
    750     readl(&xhci->op_regs->status));
    751     @@ -1018,6 +1017,7 @@ int xhci_resume(struct xhci_hcd *xhci, bool hibernated)
    752    
    753     xhci_dbg(xhci, "cleaning up memory\n");
    754     xhci_mem_cleanup(xhci);
    755     + xhci_debugfs_exit(xhci);
    756     xhci_dbg(xhci, "xhci_stop completed - status = %x\n",
    757     readl(&xhci->op_regs->status));
    758    
    759     @@ -3551,12 +3551,10 @@ static void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
    760     virt_dev->eps[i].ep_state &= ~EP_STOP_CMD_PENDING;
    761     del_timer_sync(&virt_dev->eps[i].stop_cmd_timer);
    762     }
    763     -
    764     + xhci_debugfs_remove_slot(xhci, udev->slot_id);
    765     ret = xhci_disable_slot(xhci, udev->slot_id);
    766     - if (ret) {
    767     - xhci_debugfs_remove_slot(xhci, udev->slot_id);
    768     + if (ret)
    769     xhci_free_virt_device(xhci, udev->slot_id);
    770     - }
    771     }
    772    
    773     int xhci_disable_slot(struct xhci_hcd *xhci, u32 slot_id)
    774     diff --git a/drivers/usb/usbip/stub_dev.c b/drivers/usb/usbip/stub_dev.c
    775     index e31a6f204397..86037e5b1101 100644
    776     --- a/drivers/usb/usbip/stub_dev.c
    777     +++ b/drivers/usb/usbip/stub_dev.c
    778     @@ -73,6 +73,7 @@ static ssize_t store_sockfd(struct device *dev, struct device_attribute *attr,
    779     goto err;
    780    
    781     sdev->ud.tcp_socket = socket;
    782     + sdev->ud.sockfd = sockfd;
    783    
    784     spin_unlock_irq(&sdev->ud.lock);
    785    
    786     @@ -172,6 +173,7 @@ static void stub_shutdown_connection(struct usbip_device *ud)
    787     if (ud->tcp_socket) {
    788     sockfd_put(ud->tcp_socket);
    789     ud->tcp_socket = NULL;
    790     + ud->sockfd = -1;
    791     }
    792    
    793     /* 3. free used data */
    794     @@ -266,6 +268,7 @@ static struct stub_device *stub_device_alloc(struct usb_device *udev)
    795     sdev->ud.status = SDEV_ST_AVAILABLE;
    796     spin_lock_init(&sdev->ud.lock);
    797     sdev->ud.tcp_socket = NULL;
    798     + sdev->ud.sockfd = -1;
    799    
    800     INIT_LIST_HEAD(&sdev->priv_init);
    801     INIT_LIST_HEAD(&sdev->priv_tx);
    802     diff --git a/drivers/usb/usbip/vhci_hcd.c b/drivers/usb/usbip/vhci_hcd.c
    803     index c3e1008aa491..20e3d4609583 100644
    804     --- a/drivers/usb/usbip/vhci_hcd.c
    805     +++ b/drivers/usb/usbip/vhci_hcd.c
    806     @@ -984,6 +984,7 @@ static void vhci_shutdown_connection(struct usbip_device *ud)
    807     if (vdev->ud.tcp_socket) {
    808     sockfd_put(vdev->ud.tcp_socket);
    809     vdev->ud.tcp_socket = NULL;
    810     + vdev->ud.sockfd = -1;
    811     }
    812     pr_info("release socket\n");
    813    
    814     @@ -1030,6 +1031,7 @@ static void vhci_device_reset(struct usbip_device *ud)
    815     if (ud->tcp_socket) {
    816     sockfd_put(ud->tcp_socket);
    817     ud->tcp_socket = NULL;
    818     + ud->sockfd = -1;
    819     }
    820     ud->status = VDEV_ST_NULL;
    821    
    822     diff --git a/drivers/video/fbdev/mmp/core.c b/drivers/video/fbdev/mmp/core.c
    823     index a0f496049db7..3a6bb6561ba0 100644
    824     --- a/drivers/video/fbdev/mmp/core.c
    825     +++ b/drivers/video/fbdev/mmp/core.c
    826     @@ -23,6 +23,7 @@
    827     #include <linux/slab.h>
    828     #include <linux/dma-mapping.h>
    829     #include <linux/export.h>
    830     +#include <linux/module.h>
    831     #include <video/mmp_disp.h>
    832    
    833     static struct mmp_overlay *path_get_overlay(struct mmp_path *path,
    834     @@ -249,3 +250,7 @@ void mmp_unregister_path(struct mmp_path *path)
    835     mutex_unlock(&disp_lock);
    836     }
    837     EXPORT_SYMBOL_GPL(mmp_unregister_path);
    838     +
    839     +MODULE_AUTHOR("Zhou Zhu <zzhu3@marvell.com>");
    840     +MODULE_DESCRIPTION("Marvell MMP display framework");
    841     +MODULE_LICENSE("GPL");
    842     diff --git a/include/linux/ptr_ring.h b/include/linux/ptr_ring.h
    843     index d72b2e7dd500..59c77c1388ae 100644
    844     --- a/include/linux/ptr_ring.h
    845     +++ b/include/linux/ptr_ring.h
    846     @@ -451,9 +451,14 @@ static inline int ptr_ring_consume_batched_bh(struct ptr_ring *r,
    847     __PTR_RING_PEEK_CALL_v; \
    848     })
    849    
    850     +/* Not all gfp_t flags (besides GFP_KERNEL) are allowed. See
    851     + * documentation for vmalloc for which of them are legal.
    852     + */
    853     static inline void **__ptr_ring_init_queue_alloc(unsigned int size, gfp_t gfp)
    854     {
    855     - return kcalloc(size, sizeof(void *), gfp);
    856     + if (size * sizeof(void *) > KMALLOC_MAX_SIZE)
    857     + return NULL;
    858     + return kvmalloc_array(size, sizeof(void *), gfp | __GFP_ZERO);
    859     }
    860    
    861     static inline void __ptr_ring_set_size(struct ptr_ring *r, int size)
    862     @@ -586,7 +591,7 @@ static inline int ptr_ring_resize(struct ptr_ring *r, int size, gfp_t gfp,
    863     spin_unlock(&(r)->producer_lock);
    864     spin_unlock_irqrestore(&(r)->consumer_lock, flags);
    865    
    866     - kfree(old);
    867     + kvfree(old);
    868    
    869     return 0;
    870     }
    871     @@ -626,7 +631,7 @@ static inline int ptr_ring_resize_multiple(struct ptr_ring **rings,
    872     }
    873    
    874     for (i = 0; i < nrings; ++i)
    875     - kfree(queues[i]);
    876     + kvfree(queues[i]);
    877    
    878     kfree(queues);
    879    
    880     @@ -634,7 +639,7 @@ static inline int ptr_ring_resize_multiple(struct ptr_ring **rings,
    881    
    882     nomem:
    883     while (--i >= 0)
    884     - kfree(queues[i]);
    885     + kvfree(queues[i]);
    886    
    887     kfree(queues);
    888    
    889     @@ -649,7 +654,7 @@ static inline void ptr_ring_cleanup(struct ptr_ring *r, void (*destroy)(void *))
    890     if (destroy)
    891     while ((ptr = ptr_ring_consume(r)))
    892     destroy(ptr);
    893     - kfree(r->queue);
    894     + kvfree(r->queue);
    895     }
    896    
    897     #endif /* _LINUX_PTR_RING_H */
    898     diff --git a/kernel/kcov.c b/kernel/kcov.c
    899     index 7594c033d98a..2c16f1ab5e10 100644
    900     --- a/kernel/kcov.c
    901     +++ b/kernel/kcov.c
    902     @@ -358,7 +358,8 @@ static int kcov_ioctl_locked(struct kcov *kcov, unsigned int cmd,
    903     */
    904     if (kcov->mode != KCOV_MODE_INIT || !kcov->area)
    905     return -EINVAL;
    906     - if (kcov->t != NULL)
    907     + t = current;
    908     + if (kcov->t != NULL || t->kcov != NULL)
    909     return -EBUSY;
    910     if (arg == KCOV_TRACE_PC)
    911     kcov->mode = KCOV_MODE_TRACE_PC;
    912     @@ -370,7 +371,6 @@ static int kcov_ioctl_locked(struct kcov *kcov, unsigned int cmd,
    913     #endif
    914     else
    915     return -EINVAL;
    916     - t = current;
    917     /* Cache in task struct for performance. */
    918     t->kcov_size = kcov->size;
    919     t->kcov_area = kcov->area;
    920     diff --git a/mm/vmalloc.c b/mm/vmalloc.c
    921     index 673942094328..ebff729cc956 100644
    922     --- a/mm/vmalloc.c
    923     +++ b/mm/vmalloc.c
    924     @@ -1943,11 +1943,15 @@ void *vmalloc_exec(unsigned long size)
    925     }
    926    
    927     #if defined(CONFIG_64BIT) && defined(CONFIG_ZONE_DMA32)
    928     -#define GFP_VMALLOC32 GFP_DMA32 | GFP_KERNEL
    929     +#define GFP_VMALLOC32 (GFP_DMA32 | GFP_KERNEL)
    930     #elif defined(CONFIG_64BIT) && defined(CONFIG_ZONE_DMA)
    931     -#define GFP_VMALLOC32 GFP_DMA | GFP_KERNEL
    932     +#define GFP_VMALLOC32 (GFP_DMA | GFP_KERNEL)
    933     #else
    934     -#define GFP_VMALLOC32 GFP_KERNEL
    935     +/*
    936     + * 64b systems should always have either DMA or DMA32 zones. For others
    937     + * GFP_DMA32 should do the right thing and use the normal zone.
    938     + */
    939     +#define GFP_VMALLOC32 GFP_DMA32 | GFP_KERNEL
    940     #endif
    941    
    942     /**
    943     diff --git a/net/core/dev.c b/net/core/dev.c
    944     index 613fb4066be7..c8c102a3467f 100644
    945     --- a/net/core/dev.c
    946     +++ b/net/core/dev.c
    947     @@ -2815,7 +2815,7 @@ struct sk_buff *__skb_gso_segment(struct sk_buff *skb,
    948    
    949     segs = skb_mac_gso_segment(skb, features);
    950    
    951     - if (unlikely(skb_needs_check(skb, tx_path)))
    952     + if (unlikely(skb_needs_check(skb, tx_path) && !IS_ERR(segs)))
    953     skb_warn_bad_offload(skb);
    954    
    955     return segs;
    956     diff --git a/net/core/gen_estimator.c b/net/core/gen_estimator.c
    957     index 9834cfa21b21..0a3f88f08727 100644
    958     --- a/net/core/gen_estimator.c
    959     +++ b/net/core/gen_estimator.c
    960     @@ -159,7 +159,11 @@ int gen_new_estimator(struct gnet_stats_basic_packed *bstats,
    961     est->intvl_log = intvl_log;
    962     est->cpu_bstats = cpu_bstats;
    963    
    964     + if (stats_lock)
    965     + local_bh_disable();
    966     est_fetch_counters(est, &b);
    967     + if (stats_lock)
    968     + local_bh_enable();
    969     est->last_bytes = b.bytes;
    970     est->last_packets = b.packets;
    971     old = rcu_dereference_protected(*rate_est, 1);
    972     diff --git a/net/decnet/af_decnet.c b/net/decnet/af_decnet.c
    973     index 518cea17b811..ea9b55309483 100644
    974     --- a/net/decnet/af_decnet.c
    975     +++ b/net/decnet/af_decnet.c
    976     @@ -1338,6 +1338,12 @@ static int dn_setsockopt(struct socket *sock, int level, int optname, char __use
    977     lock_sock(sk);
    978     err = __dn_setsockopt(sock, level, optname, optval, optlen, 0);
    979     release_sock(sk);
    980     +#ifdef CONFIG_NETFILTER
    981     + /* we need to exclude all possible ENOPROTOOPTs except default case */
    982     + if (err == -ENOPROTOOPT && optname != DSO_LINKINFO &&
    983     + optname != DSO_STREAM && optname != DSO_SEQPACKET)
    984     + err = nf_setsockopt(sk, PF_DECnet, optname, optval, optlen);
    985     +#endif
    986    
    987     return err;
    988     }
    989     @@ -1445,15 +1451,6 @@ static int __dn_setsockopt(struct socket *sock, int level,int optname, char __us
    990     dn_nsp_send_disc(sk, 0x38, 0, sk->sk_allocation);
    991     break;
    992    
    993     - default:
    994     -#ifdef CONFIG_NETFILTER
    995     - return nf_setsockopt(sk, PF_DECnet, optname, optval, optlen);
    996     -#endif
    997     - case DSO_LINKINFO:
    998     - case DSO_STREAM:
    999     - case DSO_SEQPACKET:
    1000     - return -ENOPROTOOPT;
    1001     -
    1002     case DSO_MAXWINDOW:
    1003     if (optlen != sizeof(unsigned long))
    1004     return -EINVAL;
    1005     @@ -1501,6 +1498,12 @@ static int __dn_setsockopt(struct socket *sock, int level,int optname, char __us
    1006     return -EINVAL;
    1007     scp->info_loc = u.info;
    1008     break;
    1009     +
    1010     + case DSO_LINKINFO:
    1011     + case DSO_STREAM:
    1012     + case DSO_SEQPACKET:
    1013     + default:
    1014     + return -ENOPROTOOPT;
    1015     }
    1016    
    1017     return 0;
    1018     @@ -1514,6 +1517,20 @@ static int dn_getsockopt(struct socket *sock, int level, int optname, char __use
    1019     lock_sock(sk);
    1020     err = __dn_getsockopt(sock, level, optname, optval, optlen, 0);
    1021     release_sock(sk);
    1022     +#ifdef CONFIG_NETFILTER
    1023     + if (err == -ENOPROTOOPT && optname != DSO_STREAM &&
    1024     + optname != DSO_SEQPACKET && optname != DSO_CONACCEPT &&
    1025     + optname != DSO_CONREJECT) {
    1026     + int len;
    1027     +
    1028     + if (get_user(len, optlen))
    1029     + return -EFAULT;
    1030     +
    1031     + err = nf_getsockopt(sk, PF_DECnet, optname, optval, &len);
    1032     + if (err >= 0)
    1033     + err = put_user(len, optlen);
    1034     + }
    1035     +#endif
    1036    
    1037     return err;
    1038     }
    1039     @@ -1579,26 +1596,6 @@ static int __dn_getsockopt(struct socket *sock, int level,int optname, char __us
    1040     r_data = &link;
    1041     break;
    1042    
    1043     - default:
    1044     -#ifdef CONFIG_NETFILTER
    1045     - {
    1046     - int ret, len;
    1047     -
    1048     - if (get_user(len, optlen))
    1049     - return -EFAULT;
    1050     -
    1051     - ret = nf_getsockopt(sk, PF_DECnet, optname, optval, &len);
    1052     - if (ret >= 0)
    1053     - ret = put_user(len, optlen);
    1054     - return ret;
    1055     - }
    1056     -#endif
    1057     - case DSO_STREAM:
    1058     - case DSO_SEQPACKET:
    1059     - case DSO_CONACCEPT:
    1060     - case DSO_CONREJECT:
    1061     - return -ENOPROTOOPT;
    1062     -
    1063     case DSO_MAXWINDOW:
    1064     if (r_len > sizeof(unsigned long))
    1065     r_len = sizeof(unsigned long);
    1066     @@ -1630,6 +1627,13 @@ static int __dn_getsockopt(struct socket *sock, int level,int optname, char __us
    1067     r_len = sizeof(unsigned char);
    1068     r_data = &scp->info_rem;
    1069     break;
    1070     +
    1071     + case DSO_STREAM:
    1072     + case DSO_SEQPACKET:
    1073     + case DSO_CONACCEPT:
    1074     + case DSO_CONREJECT:
    1075     + default:
    1076     + return -ENOPROTOOPT;
    1077     }
    1078    
    1079     if (r_data) {
    1080     diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c
    1081     index 60fb1eb7d7d8..c7df4969f80a 100644
    1082     --- a/net/ipv4/ip_sockglue.c
    1083     +++ b/net/ipv4/ip_sockglue.c
    1084     @@ -1251,11 +1251,8 @@ int ip_setsockopt(struct sock *sk, int level,
    1085     if (err == -ENOPROTOOPT && optname != IP_HDRINCL &&
    1086     optname != IP_IPSEC_POLICY &&
    1087     optname != IP_XFRM_POLICY &&
    1088     - !ip_mroute_opt(optname)) {
    1089     - lock_sock(sk);
    1090     + !ip_mroute_opt(optname))
    1091     err = nf_setsockopt(sk, PF_INET, optname, optval, optlen);
    1092     - release_sock(sk);
    1093     - }
    1094     #endif
    1095     return err;
    1096     }
    1097     @@ -1280,12 +1277,9 @@ int compat_ip_setsockopt(struct sock *sk, int level, int optname,
    1098     if (err == -ENOPROTOOPT && optname != IP_HDRINCL &&
    1099     optname != IP_IPSEC_POLICY &&
    1100     optname != IP_XFRM_POLICY &&
    1101     - !ip_mroute_opt(optname)) {
    1102     - lock_sock(sk);
    1103     - err = compat_nf_setsockopt(sk, PF_INET, optname,
    1104     - optval, optlen);
    1105     - release_sock(sk);
    1106     - }
    1107     + !ip_mroute_opt(optname))
    1108     + err = compat_nf_setsockopt(sk, PF_INET, optname, optval,
    1109     + optlen);
    1110     #endif
    1111     return err;
    1112     }
    1113     diff --git a/net/ipv4/netfilter/ipt_CLUSTERIP.c b/net/ipv4/netfilter/ipt_CLUSTERIP.c
    1114     index 69060e3abe85..1e4a7209a3d2 100644
    1115     --- a/net/ipv4/netfilter/ipt_CLUSTERIP.c
    1116     +++ b/net/ipv4/netfilter/ipt_CLUSTERIP.c
    1117     @@ -431,7 +431,7 @@ static int clusterip_tg_check(const struct xt_tgchk_param *par)
    1118     struct ipt_clusterip_tgt_info *cipinfo = par->targinfo;
    1119     const struct ipt_entry *e = par->entryinfo;
    1120     struct clusterip_config *config;
    1121     - int ret;
    1122     + int ret, i;
    1123    
    1124     if (par->nft_compat) {
    1125     pr_err("cannot use CLUSTERIP target from nftables compat\n");
    1126     @@ -450,8 +450,18 @@ static int clusterip_tg_check(const struct xt_tgchk_param *par)
    1127     pr_info("Please specify destination IP\n");
    1128     return -EINVAL;
    1129     }
    1130     -
    1131     - /* FIXME: further sanity checks */
    1132     + if (cipinfo->num_local_nodes > ARRAY_SIZE(cipinfo->local_nodes)) {
    1133     + pr_info("bad num_local_nodes %u\n", cipinfo->num_local_nodes);
    1134     + return -EINVAL;
    1135     + }
    1136     + for (i = 0; i < cipinfo->num_local_nodes; i++) {
    1137     + if (cipinfo->local_nodes[i] - 1 >=
    1138     + sizeof(config->local_nodes) * 8) {
    1139     + pr_info("bad local_nodes[%d] %u\n",
    1140     + i, cipinfo->local_nodes[i]);
    1141     + return -EINVAL;
    1142     + }
    1143     + }
    1144    
    1145     config = clusterip_config_find_get(par->net, e->ip.dst.s_addr, 1);
    1146     if (!config) {
    1147     diff --git a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
    1148     index 89af9d88ca21..a5727036a8a8 100644
    1149     --- a/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
    1150     +++ b/net/ipv4/netfilter/nf_conntrack_l3proto_ipv4.c
    1151     @@ -218,15 +218,19 @@ getorigdst(struct sock *sk, int optval, void __user *user, int *len)
    1152     struct nf_conntrack_tuple tuple;
    1153    
    1154     memset(&tuple, 0, sizeof(tuple));
    1155     +
    1156     + lock_sock(sk);
    1157     tuple.src.u3.ip = inet->inet_rcv_saddr;
    1158     tuple.src.u.tcp.port = inet->inet_sport;
    1159     tuple.dst.u3.ip = inet->inet_daddr;
    1160     tuple.dst.u.tcp.port = inet->inet_dport;
    1161     tuple.src.l3num = PF_INET;
    1162     tuple.dst.protonum = sk->sk_protocol;
    1163     + release_sock(sk);
    1164    
    1165     /* We only do TCP and SCTP at the moment: is there a better way? */
    1166     - if (sk->sk_protocol != IPPROTO_TCP && sk->sk_protocol != IPPROTO_SCTP) {
    1167     + if (tuple.dst.protonum != IPPROTO_TCP &&
    1168     + tuple.dst.protonum != IPPROTO_SCTP) {
    1169     pr_debug("SO_ORIGINAL_DST: Not a TCP/SCTP socket\n");
    1170     return -ENOPROTOOPT;
    1171     }
    1172     diff --git a/net/ipv6/ipv6_sockglue.c b/net/ipv6/ipv6_sockglue.c
    1173     index e8ffb5b5d84e..d78d41fc4b1a 100644
    1174     --- a/net/ipv6/ipv6_sockglue.c
    1175     +++ b/net/ipv6/ipv6_sockglue.c
    1176     @@ -923,12 +923,8 @@ int ipv6_setsockopt(struct sock *sk, int level, int optname,
    1177     #ifdef CONFIG_NETFILTER
    1178     /* we need to exclude all possible ENOPROTOOPTs except default case */
    1179     if (err == -ENOPROTOOPT && optname != IPV6_IPSEC_POLICY &&
    1180     - optname != IPV6_XFRM_POLICY) {
    1181     - lock_sock(sk);
    1182     - err = nf_setsockopt(sk, PF_INET6, optname, optval,
    1183     - optlen);
    1184     - release_sock(sk);
    1185     - }
    1186     + optname != IPV6_XFRM_POLICY)
    1187     + err = nf_setsockopt(sk, PF_INET6, optname, optval, optlen);
    1188     #endif
    1189     return err;
    1190     }
    1191     @@ -958,12 +954,9 @@ int compat_ipv6_setsockopt(struct sock *sk, int level, int optname,
    1192     #ifdef CONFIG_NETFILTER
    1193     /* we need to exclude all possible ENOPROTOOPTs except default case */
    1194     if (err == -ENOPROTOOPT && optname != IPV6_IPSEC_POLICY &&
    1195     - optname != IPV6_XFRM_POLICY) {
    1196     - lock_sock(sk);
    1197     - err = compat_nf_setsockopt(sk, PF_INET6, optname,
    1198     - optval, optlen);
    1199     - release_sock(sk);
    1200     - }
    1201     + optname != IPV6_XFRM_POLICY)
    1202     + err = compat_nf_setsockopt(sk, PF_INET6, optname, optval,
    1203     + optlen);
    1204     #endif
    1205     return err;
    1206     }
    1207     diff --git a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
    1208     index 3b80a38f62b8..5863579800c1 100644
    1209     --- a/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
    1210     +++ b/net/ipv6/netfilter/nf_conntrack_l3proto_ipv6.c
    1211     @@ -226,20 +226,27 @@ static const struct nf_hook_ops ipv6_conntrack_ops[] = {
    1212     static int
    1213     ipv6_getorigdst(struct sock *sk, int optval, void __user *user, int *len)
    1214     {
    1215     - const struct inet_sock *inet = inet_sk(sk);
    1216     + struct nf_conntrack_tuple tuple = { .src.l3num = NFPROTO_IPV6 };
    1217     const struct ipv6_pinfo *inet6 = inet6_sk(sk);
    1218     + const struct inet_sock *inet = inet_sk(sk);
    1219     const struct nf_conntrack_tuple_hash *h;
    1220     struct sockaddr_in6 sin6;
    1221     - struct nf_conntrack_tuple tuple = { .src.l3num = NFPROTO_IPV6 };
    1222     struct nf_conn *ct;
    1223     + __be32 flow_label;
    1224     + int bound_dev_if;
    1225    
    1226     + lock_sock(sk);
    1227     tuple.src.u3.in6 = sk->sk_v6_rcv_saddr;
    1228     tuple.src.u.tcp.port = inet->inet_sport;
    1229     tuple.dst.u3.in6 = sk->sk_v6_daddr;
    1230     tuple.dst.u.tcp.port = inet->inet_dport;
    1231     tuple.dst.protonum = sk->sk_protocol;
    1232     + bound_dev_if = sk->sk_bound_dev_if;
    1233     + flow_label = inet6->flow_label;
    1234     + release_sock(sk);
    1235    
    1236     - if (sk->sk_protocol != IPPROTO_TCP && sk->sk_protocol != IPPROTO_SCTP)
    1237     + if (tuple.dst.protonum != IPPROTO_TCP &&
    1238     + tuple.dst.protonum != IPPROTO_SCTP)
    1239     return -ENOPROTOOPT;
    1240    
    1241     if (*len < 0 || (unsigned int) *len < sizeof(sin6))
    1242     @@ -257,14 +264,13 @@ ipv6_getorigdst(struct sock *sk, int optval, void __user *user, int *len)
    1243    
    1244     sin6.sin6_family = AF_INET6;
    1245     sin6.sin6_port = ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u.tcp.port;
    1246     - sin6.sin6_flowinfo = inet6->flow_label & IPV6_FLOWINFO_MASK;
    1247     + sin6.sin6_flowinfo = flow_label & IPV6_FLOWINFO_MASK;
    1248     memcpy(&sin6.sin6_addr,
    1249     &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple.dst.u3.in6,
    1250     sizeof(sin6.sin6_addr));
    1251    
    1252     nf_ct_put(ct);
    1253     - sin6.sin6_scope_id = ipv6_iface_scope_id(&sin6.sin6_addr,
    1254     - sk->sk_bound_dev_if);
    1255     + sin6.sin6_scope_id = ipv6_iface_scope_id(&sin6.sin6_addr, bound_dev_if);
    1256     return copy_to_user(user, &sin6, sizeof(sin6)) ? -EFAULT : 0;
    1257     }
    1258    
    1259     diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
    1260     index 55802e97f906..d7070d18db20 100644
    1261     --- a/net/netfilter/x_tables.c
    1262     +++ b/net/netfilter/x_tables.c
    1263     @@ -39,7 +39,6 @@ MODULE_LICENSE("GPL");
    1264     MODULE_AUTHOR("Harald Welte <laforge@netfilter.org>");
    1265     MODULE_DESCRIPTION("{ip,ip6,arp,eb}_tables backend module");
    1266    
    1267     -#define SMP_ALIGN(x) (((x) + SMP_CACHE_BYTES-1) & ~(SMP_CACHE_BYTES-1))
    1268     #define XT_PCPU_BLOCK_SIZE 4096
    1269    
    1270     struct compat_delta {
    1271     @@ -210,6 +209,9 @@ xt_request_find_match(uint8_t nfproto, const char *name, uint8_t revision)
    1272     {
    1273     struct xt_match *match;
    1274    
    1275     + if (strnlen(name, XT_EXTENSION_MAXNAMELEN) == XT_EXTENSION_MAXNAMELEN)
    1276     + return ERR_PTR(-EINVAL);
    1277     +
    1278     match = xt_find_match(nfproto, name, revision);
    1279     if (IS_ERR(match)) {
    1280     request_module("%st_%s", xt_prefix[nfproto], name);
    1281     @@ -252,6 +254,9 @@ struct xt_target *xt_request_find_target(u8 af, const char *name, u8 revision)
    1282     {
    1283     struct xt_target *target;
    1284    
    1285     + if (strnlen(name, XT_EXTENSION_MAXNAMELEN) == XT_EXTENSION_MAXNAMELEN)
    1286     + return ERR_PTR(-EINVAL);
    1287     +
    1288     target = xt_find_target(af, name, revision);
    1289     if (IS_ERR(target)) {
    1290     request_module("%st_%s", xt_prefix[af], name);
    1291     @@ -1000,7 +1005,7 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size)
    1292     return NULL;
    1293    
    1294     /* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */
    1295     - if ((SMP_ALIGN(size) >> PAGE_SHIFT) + 2 > totalram_pages)
    1296     + if ((size >> PAGE_SHIFT) + 2 > totalram_pages)
    1297     return NULL;
    1298    
    1299     info = kvmalloc(sz, GFP_KERNEL);
    1300     diff --git a/net/netfilter/xt_RATEEST.c b/net/netfilter/xt_RATEEST.c
    1301     index 498b54fd04d7..141c295191f6 100644
    1302     --- a/net/netfilter/xt_RATEEST.c
    1303     +++ b/net/netfilter/xt_RATEEST.c
    1304     @@ -39,23 +39,31 @@ static void xt_rateest_hash_insert(struct xt_rateest *est)
    1305     hlist_add_head(&est->list, &rateest_hash[h]);
    1306     }
    1307    
    1308     -struct xt_rateest *xt_rateest_lookup(const char *name)
    1309     +static struct xt_rateest *__xt_rateest_lookup(const char *name)
    1310     {
    1311     struct xt_rateest *est;
    1312     unsigned int h;
    1313    
    1314     h = xt_rateest_hash(name);
    1315     - mutex_lock(&xt_rateest_mutex);
    1316     hlist_for_each_entry(est, &rateest_hash[h], list) {
    1317     if (strcmp(est->name, name) == 0) {
    1318     est->refcnt++;
    1319     - mutex_unlock(&xt_rateest_mutex);
    1320     return est;
    1321     }
    1322     }
    1323     - mutex_unlock(&xt_rateest_mutex);
    1324     +
    1325     return NULL;
    1326     }
    1327     +
    1328     +struct xt_rateest *xt_rateest_lookup(const char *name)
    1329     +{
    1330     + struct xt_rateest *est;
    1331     +
    1332     + mutex_lock(&xt_rateest_mutex);
    1333     + est = __xt_rateest_lookup(name);
    1334     + mutex_unlock(&xt_rateest_mutex);
    1335     + return est;
    1336     +}
    1337     EXPORT_SYMBOL_GPL(xt_rateest_lookup);
    1338    
    1339     void xt_rateest_put(struct xt_rateest *est)
    1340     @@ -100,8 +108,10 @@ static int xt_rateest_tg_checkentry(const struct xt_tgchk_param *par)
    1341    
    1342     net_get_random_once(&jhash_rnd, sizeof(jhash_rnd));
    1343    
    1344     - est = xt_rateest_lookup(info->name);
    1345     + mutex_lock(&xt_rateest_mutex);
    1346     + est = __xt_rateest_lookup(info->name);
    1347     if (est) {
    1348     + mutex_unlock(&xt_rateest_mutex);
    1349     /*
    1350     * If estimator parameters are specified, they must match the
    1351     * existing estimator.
    1352     @@ -139,11 +149,13 @@ static int xt_rateest_tg_checkentry(const struct xt_tgchk_param *par)
    1353    
    1354     info->est = est;
    1355     xt_rateest_hash_insert(est);
    1356     + mutex_unlock(&xt_rateest_mutex);
    1357     return 0;
    1358    
    1359     err2:
    1360     kfree(est);
    1361     err1:
    1362     + mutex_unlock(&xt_rateest_mutex);
    1363     return ret;
    1364     }
    1365    
    1366     diff --git a/net/netfilter/xt_cgroup.c b/net/netfilter/xt_cgroup.c
    1367     index 1db1ce59079f..891f4e7e8ea7 100644
    1368     --- a/net/netfilter/xt_cgroup.c
    1369     +++ b/net/netfilter/xt_cgroup.c
    1370     @@ -52,6 +52,7 @@ static int cgroup_mt_check_v1(const struct xt_mtchk_param *par)
    1371     return -EINVAL;
    1372     }
    1373    
    1374     + info->priv = NULL;
    1375     if (info->has_path) {
    1376     cgrp = cgroup_get_from_path(info->path);
    1377     if (IS_ERR(cgrp)) {
    1378     diff --git a/net/rds/connection.c b/net/rds/connection.c
    1379     index 7ee2d5d68b78..9efc82c665b5 100644
    1380     --- a/net/rds/connection.c
    1381     +++ b/net/rds/connection.c
    1382     @@ -366,6 +366,8 @@ void rds_conn_shutdown(struct rds_conn_path *cp)
    1383     * to the conn hash, so we never trigger a reconnect on this
    1384     * conn - the reconnect is always triggered by the active peer. */
    1385     cancel_delayed_work_sync(&cp->cp_conn_w);
    1386     + if (conn->c_destroy_in_prog)
    1387     + return;
    1388     rcu_read_lock();
    1389     if (!hlist_unhashed(&conn->c_hash_node)) {
    1390     rcu_read_unlock();
    1391     @@ -445,7 +447,6 @@ void rds_conn_destroy(struct rds_connection *conn)
    1392     */
    1393     rds_cong_remove_conn(conn);
    1394    
    1395     - put_net(conn->c_net);
    1396     kfree(conn->c_path);
    1397     kmem_cache_free(rds_conn_slab, conn);
    1398    
    1399     diff --git a/net/rds/rds.h b/net/rds/rds.h
    1400     index c349c71babff..d09f6c1facb4 100644
    1401     --- a/net/rds/rds.h
    1402     +++ b/net/rds/rds.h
    1403     @@ -150,7 +150,7 @@ struct rds_connection {
    1404    
    1405     /* Protocol version */
    1406     unsigned int c_version;
    1407     - struct net *c_net;
    1408     + possible_net_t c_net;
    1409    
    1410     struct list_head c_map_item;
    1411     unsigned long c_map_queued;
    1412     @@ -165,13 +165,13 @@ struct rds_connection {
    1413     static inline
    1414     struct net *rds_conn_net(struct rds_connection *conn)
    1415     {
    1416     - return conn->c_net;
    1417     + return read_pnet(&conn->c_net);
    1418     }
    1419    
    1420     static inline
    1421     void rds_conn_net_set(struct rds_connection *conn, struct net *net)
    1422     {
    1423     - conn->c_net = get_net(net);
    1424     + write_pnet(&conn->c_net, net);
    1425     }
    1426    
    1427     #define RDS_FLAG_CONG_BITMAP 0x01
    1428     diff --git a/net/rds/tcp.c b/net/rds/tcp.c
    1429     index ab7356e0ba83..4df21e47d2ab 100644
    1430     --- a/net/rds/tcp.c
    1431     +++ b/net/rds/tcp.c
    1432     @@ -307,7 +307,8 @@ static void rds_tcp_conn_free(void *arg)
    1433     rdsdebug("freeing tc %p\n", tc);
    1434    
    1435     spin_lock_irqsave(&rds_tcp_conn_lock, flags);
    1436     - list_del(&tc->t_tcp_node);
    1437     + if (!tc->t_tcp_node_detached)
    1438     + list_del(&tc->t_tcp_node);
    1439     spin_unlock_irqrestore(&rds_tcp_conn_lock, flags);
    1440    
    1441     kmem_cache_free(rds_tcp_conn_slab, tc);
    1442     @@ -528,12 +529,16 @@ static void rds_tcp_kill_sock(struct net *net)
    1443     rds_tcp_listen_stop(lsock, &rtn->rds_tcp_accept_w);
    1444     spin_lock_irq(&rds_tcp_conn_lock);
    1445     list_for_each_entry_safe(tc, _tc, &rds_tcp_conn_list, t_tcp_node) {
    1446     - struct net *c_net = tc->t_cpath->cp_conn->c_net;
    1447     + struct net *c_net = read_pnet(&tc->t_cpath->cp_conn->c_net);
    1448    
    1449     if (net != c_net || !tc->t_sock)
    1450     continue;
    1451     - if (!list_has_conn(&tmp_list, tc->t_cpath->cp_conn))
    1452     + if (!list_has_conn(&tmp_list, tc->t_cpath->cp_conn)) {
    1453     list_move_tail(&tc->t_tcp_node, &tmp_list);
    1454     + } else {
    1455     + list_del(&tc->t_tcp_node);
    1456     + tc->t_tcp_node_detached = true;
    1457     + }
    1458     }
    1459     spin_unlock_irq(&rds_tcp_conn_lock);
    1460     list_for_each_entry_safe(tc, _tc, &tmp_list, t_tcp_node) {
    1461     @@ -587,7 +592,7 @@ static void rds_tcp_sysctl_reset(struct net *net)
    1462    
    1463     spin_lock_irq(&rds_tcp_conn_lock);
    1464     list_for_each_entry_safe(tc, _tc, &rds_tcp_conn_list, t_tcp_node) {
    1465     - struct net *c_net = tc->t_cpath->cp_conn->c_net;
    1466     + struct net *c_net = read_pnet(&tc->t_cpath->cp_conn->c_net);
    1467    
    1468     if (net != c_net || !tc->t_sock)
    1469     continue;
    1470     diff --git a/net/rds/tcp.h b/net/rds/tcp.h
    1471     index 864ca7d8f019..c6fa080e9b6d 100644
    1472     --- a/net/rds/tcp.h
    1473     +++ b/net/rds/tcp.h
    1474     @@ -12,6 +12,7 @@ struct rds_tcp_incoming {
    1475     struct rds_tcp_connection {
    1476    
    1477     struct list_head t_tcp_node;
    1478     + bool t_tcp_node_detached;
    1479     struct rds_conn_path *t_cpath;
    1480     /* t_conn_path_lock synchronizes the connection establishment between
    1481     * rds_tcp_accept_one and rds_tcp_conn_path_connect
    1482     diff --git a/security/selinux/ss/services.c b/security/selinux/ss/services.c
    1483     index 33cfe5d3d6cb..8900ea5cbabf 100644
    1484     --- a/security/selinux/ss/services.c
    1485     +++ b/security/selinux/ss/services.c
    1486     @@ -867,6 +867,9 @@ int security_bounded_transition(u32 old_sid, u32 new_sid)
    1487     int index;
    1488     int rc;
    1489    
    1490     + if (!ss_initialized)
    1491     + return 0;
    1492     +
    1493     read_lock(&policy_rwlock);
    1494    
    1495     rc = -EINVAL;
    1496     @@ -1413,27 +1416,25 @@ static int security_context_to_sid_core(const char *scontext, u32 scontext_len,
    1497     if (!scontext_len)
    1498     return -EINVAL;
    1499    
    1500     + /* Copy the string to allow changes and ensure a NUL terminator */
    1501     + scontext2 = kmemdup_nul(scontext, scontext_len, gfp_flags);
    1502     + if (!scontext2)
    1503     + return -ENOMEM;
    1504     +
    1505     if (!ss_initialized) {
    1506     int i;
    1507    
    1508     for (i = 1; i < SECINITSID_NUM; i++) {
    1509     - if (!strcmp(initial_sid_to_string[i], scontext)) {
    1510     + if (!strcmp(initial_sid_to_string[i], scontext2)) {
    1511     *sid = i;
    1512     - return 0;
    1513     + goto out;
    1514     }
    1515     }
    1516     *sid = SECINITSID_KERNEL;
    1517     - return 0;
    1518     + goto out;
    1519     }
    1520     *sid = SECSID_NULL;
    1521    
    1522     - /* Copy the string so that we can modify the copy as we parse it. */
    1523     - scontext2 = kmalloc(scontext_len + 1, gfp_flags);
    1524     - if (!scontext2)
    1525     - return -ENOMEM;
    1526     - memcpy(scontext2, scontext, scontext_len);
    1527     - scontext2[scontext_len] = 0;
    1528     -
    1529     if (force) {
    1530     /* Save another copy for storing in uninterpreted form */
    1531     rc = -ENOMEM;
    1532     diff --git a/sound/soc/ux500/mop500.c b/sound/soc/ux500/mop500.c
    1533     index 070a6880980e..c60a57797640 100644
    1534     --- a/sound/soc/ux500/mop500.c
    1535     +++ b/sound/soc/ux500/mop500.c
    1536     @@ -163,3 +163,7 @@ static struct platform_driver snd_soc_mop500_driver = {
    1537     };
    1538    
    1539     module_platform_driver(snd_soc_mop500_driver);
    1540     +
    1541     +MODULE_LICENSE("GPL v2");
    1542     +MODULE_DESCRIPTION("ASoC MOP500 board driver");
    1543     +MODULE_AUTHOR("Ola Lilja");
    1544     diff --git a/sound/soc/ux500/ux500_pcm.c b/sound/soc/ux500/ux500_pcm.c
    1545     index f12c01dddc8d..d35ba7700f46 100644
    1546     --- a/sound/soc/ux500/ux500_pcm.c
    1547     +++ b/sound/soc/ux500/ux500_pcm.c
    1548     @@ -165,3 +165,8 @@ int ux500_pcm_unregister_platform(struct platform_device *pdev)
    1549     return 0;
    1550     }
    1551     EXPORT_SYMBOL_GPL(ux500_pcm_unregister_platform);
    1552     +
    1553     +MODULE_AUTHOR("Ola Lilja");
    1554     +MODULE_AUTHOR("Roger Nilsson");
    1555     +MODULE_DESCRIPTION("ASoC UX500 driver");
    1556     +MODULE_LICENSE("GPL v2");