Linux patch 4.19.1514.19-150

Signed-off-by: Mike Pagano <mpagano@gentoo.org>

2 files changed, 1692 insertions, 0 deletions

diff --git a/0000_README b/0000_README
index 47aa0306..7427668e 100644
--- a/0000_README
+++ b/0000_README
@@ -639,6 +639,10 @@ Patch:  1149_linux-4.19.150.patch
 From:   https://www.kernel.org
 Desc:   Linux 4.19.150
 
+Patch:  1150_linux-4.19.151.patch
+From:   https://www.kernel.org
+Desc:   Linux 4.19.151
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.
diff --git a/1150_linux-4.19.151.patch b/1150_linux-4.19.151.patch
new file mode 100644
index 00000000..e5af897d
--- /dev/null
+++ b/1150_linux-4.19.151.patch
@@ -0,0 +1,1688 @@
+diff --git a/Makefile b/Makefile
+index 65485185bec29..f2c9db9b4015a 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,7 +1,7 @@
+ # SPDX-License-Identifier: GPL-2.0
+ VERSION = 4
+ PATCHLEVEL = 19
+-SUBLEVEL = 150
++SUBLEVEL = 151
+ EXTRAVERSION =
+ NAME = "People's Front"
+ 
+diff --git a/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts b/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts
+index faa017d4cd56b..636bab51de38d 100644
+--- a/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts
++++ b/arch/arm64/boot/dts/altera/socfpga_stratix10_socdk.dts
+@@ -151,6 +151,7 @@
+ };
+ 
+ &qspi {
++	status = "okay";
+ 	flash@0 {
+ 		#address-cells = <1>;
+ 		#size-cells = <1>;
+diff --git a/drivers/base/dd.c b/drivers/base/dd.c
+index 0047bbdd43c0f..b3c569412f4e2 100644
+--- a/drivers/base/dd.c
++++ b/drivers/base/dd.c
+@@ -472,7 +472,8 @@ static int really_probe(struct device *dev, struct device_driver *drv)
+ 		 drv->bus->name, __func__, drv->name, dev_name(dev));
+ 	if (!list_empty(&dev->devres_head)) {
+ 		dev_crit(dev, "Resources present before probing\n");
+-		return -EBUSY;
++		ret = -EBUSY;
++		goto done;
+ 	}
+ 
+ re_probe:
+@@ -579,7 +580,7 @@ pinctrl_bind_failed:
+ 	ret = 0;
+ done:
+ 	atomic_dec(&probe_count);
+-	wake_up(&probe_waitqueue);
++	wake_up_all(&probe_waitqueue);
+ 	return ret;
+ }
+ 
+diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+index fcf421263fd96..abad7460084f2 100644
+--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_ttm.c
+@@ -954,6 +954,7 @@ static int amdgpu_ttm_tt_pin_userptr(struct ttm_tt *ttm)
+ 
+ release_sg:
+ 	kfree(ttm->sg);
++	ttm->sg = NULL;
+ 	return r;
+ }
+ 
+diff --git a/drivers/gpu/drm/nouveau/nouveau_mem.c b/drivers/gpu/drm/nouveau/nouveau_mem.c
+index c002f89685073..9682f30ab6f68 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_mem.c
++++ b/drivers/gpu/drm/nouveau/nouveau_mem.c
+@@ -176,6 +176,8 @@ void
+ nouveau_mem_del(struct ttm_mem_reg *reg)
+ {
+ 	struct nouveau_mem *mem = nouveau_mem(reg);
++	if (!mem)
++		return;
+ 	nouveau_mem_fini(mem);
+ 	kfree(reg->mm_node);
+ 	reg->mm_node = NULL;
+diff --git a/drivers/i2c/busses/i2c-i801.c b/drivers/i2c/busses/i2c-i801.c
+index 58fc17e46694d..3ac3b26cc9317 100644
+--- a/drivers/i2c/busses/i2c-i801.c
++++ b/drivers/i2c/busses/i2c-i801.c
+@@ -1698,6 +1698,7 @@ static int i801_probe(struct pci_dev *dev, const struct pci_device_id *id)
+ 
+ 	pci_set_drvdata(dev, priv);
+ 
++	dev_pm_set_driver_flags(&dev->dev, DPM_FLAG_NEVER_SKIP);
+ 	pm_runtime_set_autosuspend_delay(&dev->dev, 1000);
+ 	pm_runtime_use_autosuspend(&dev->dev);
+ 	pm_runtime_put_autosuspend(&dev->dev);
+diff --git a/drivers/i2c/busses/i2c-meson.c b/drivers/i2c/busses/i2c-meson.c
+index 90f5d0407d732..f48e637f1a3e8 100644
+--- a/drivers/i2c/busses/i2c-meson.c
++++ b/drivers/i2c/busses/i2c-meson.c
+@@ -8,6 +8,7 @@
+  * published by the Free Software Foundation.
+  */
+ 
++#include <linux/bitfield.h>
+ #include <linux/clk.h>
+ #include <linux/completion.h>
+ #include <linux/i2c.h>
+@@ -35,12 +36,17 @@
+ #define REG_CTRL_ACK_IGNORE	BIT(1)
+ #define REG_CTRL_STATUS		BIT(2)
+ #define REG_CTRL_ERROR		BIT(3)
+-#define REG_CTRL_CLKDIV_SHIFT	12
+-#define REG_CTRL_CLKDIV_MASK	GENMASK(21, 12)
+-#define REG_CTRL_CLKDIVEXT_SHIFT 28
+-#define REG_CTRL_CLKDIVEXT_MASK	GENMASK(29, 28)
++#define REG_CTRL_CLKDIV		GENMASK(21, 12)
++#define REG_CTRL_CLKDIVEXT	GENMASK(29, 28)
++
++#define REG_SLV_ADDR		GENMASK(7, 0)
++#define REG_SLV_SDA_FILTER	GENMASK(10, 8)
++#define REG_SLV_SCL_FILTER	GENMASK(13, 11)
++#define REG_SLV_SCL_LOW		GENMASK(27, 16)
++#define REG_SLV_SCL_LOW_EN	BIT(28)
+ 
+ #define I2C_TIMEOUT_MS		500
++#define FILTER_DELAY		15
+ 
+ enum {
+ 	TOKEN_END = 0,
+@@ -135,19 +141,24 @@ static void meson_i2c_set_clk_div(struct meson_i2c *i2c, unsigned int freq)
+ 	unsigned long clk_rate = clk_get_rate(i2c->clk);
+ 	unsigned int div;
+ 
+-	div = DIV_ROUND_UP(clk_rate, freq * i2c->data->div_factor);
++	div = DIV_ROUND_UP(clk_rate, freq);
++	div -= FILTER_DELAY;
++	div = DIV_ROUND_UP(div, i2c->data->div_factor);
+ 
+ 	/* clock divider has 12 bits */
+-	if (div >= (1 << 12)) {
++	if (div > GENMASK(11, 0)) {
+ 		dev_err(i2c->dev, "requested bus frequency too low\n");
+-		div = (1 << 12) - 1;
++		div = GENMASK(11, 0);
+ 	}
+ 
+-	meson_i2c_set_mask(i2c, REG_CTRL, REG_CTRL_CLKDIV_MASK,
+-			   (div & GENMASK(9, 0)) << REG_CTRL_CLKDIV_SHIFT);
++	meson_i2c_set_mask(i2c, REG_CTRL, REG_CTRL_CLKDIV,
++			   FIELD_PREP(REG_CTRL_CLKDIV, div & GENMASK(9, 0)));
++
++	meson_i2c_set_mask(i2c, REG_CTRL, REG_CTRL_CLKDIVEXT,
++			   FIELD_PREP(REG_CTRL_CLKDIVEXT, div >> 10));
+ 
+-	meson_i2c_set_mask(i2c, REG_CTRL, REG_CTRL_CLKDIVEXT_MASK,
+-			   (div >> 10) << REG_CTRL_CLKDIVEXT_SHIFT);
++	/* Disable HIGH/LOW mode */
++	meson_i2c_set_mask(i2c, REG_SLAVE_ADDR, REG_SLV_SCL_LOW_EN, 0);
+ 
+ 	dev_dbg(i2c->dev, "%s: clk %lu, freq %u, div %u\n", __func__,
+ 		clk_rate, freq, div);
+@@ -276,7 +287,10 @@ static void meson_i2c_do_start(struct meson_i2c *i2c, struct i2c_msg *msg)
+ 	token = (msg->flags & I2C_M_RD) ? TOKEN_SLAVE_ADDR_READ :
+ 		TOKEN_SLAVE_ADDR_WRITE;
+ 
+-	writel(msg->addr << 1, i2c->regs + REG_SLAVE_ADDR);
++
++	meson_i2c_set_mask(i2c, REG_SLAVE_ADDR, REG_SLV_ADDR,
++			   FIELD_PREP(REG_SLV_ADDR, msg->addr << 1));
++
+ 	meson_i2c_add_token(i2c, TOKEN_START);
+ 	meson_i2c_add_token(i2c, token);
+ }
+@@ -435,6 +449,10 @@ static int meson_i2c_probe(struct platform_device *pdev)
+ 		return ret;
+ 	}
+ 
++	/* Disable filtering */
++	meson_i2c_set_mask(i2c, REG_SLAVE_ADDR,
++			   REG_SLV_SDA_FILTER | REG_SLV_SCL_FILTER, 0);
++
+ 	meson_i2c_set_clk_div(i2c, timings.bus_freq_hz);
+ 
+ 	return 0;
+diff --git a/drivers/i2c/busses/i2c-owl.c b/drivers/i2c/busses/i2c-owl.c
+index 96b4572e6d9cc..cf3fcf35fe3d8 100644
+--- a/drivers/i2c/busses/i2c-owl.c
++++ b/drivers/i2c/busses/i2c-owl.c
+@@ -179,6 +179,9 @@ static irqreturn_t owl_i2c_interrupt(int irq, void *_dev)
+ 	fifostat = readl(i2c_dev->base + OWL_I2C_REG_FIFOSTAT);
+ 	if (fifostat & OWL_I2C_FIFOSTAT_RNB) {
+ 		i2c_dev->err = -ENXIO;
++		/* Clear NACK error bit by writing "1" */
++		owl_i2c_update_reg(i2c_dev->base + OWL_I2C_REG_FIFOSTAT,
++				   OWL_I2C_FIFOSTAT_RNB, true);
+ 		goto stop;
+ 	}
+ 
+@@ -186,6 +189,9 @@ static irqreturn_t owl_i2c_interrupt(int irq, void *_dev)
+ 	stat = readl(i2c_dev->base + OWL_I2C_REG_STAT);
+ 	if (stat & OWL_I2C_STAT_BEB) {
+ 		i2c_dev->err = -EIO;
++		/* Clear BUS error bit by writing "1" */
++		owl_i2c_update_reg(i2c_dev->base + OWL_I2C_REG_STAT,
++				   OWL_I2C_STAT_BEB, true);
+ 		goto stop;
+ 	}
+ 
+diff --git a/drivers/mmc/core/queue.c b/drivers/mmc/core/queue.c
+index 2a788169cbb82..9b31cd6b6062b 100644
+--- a/drivers/mmc/core/queue.c
++++ b/drivers/mmc/core/queue.c
+@@ -185,7 +185,7 @@ static void mmc_queue_setup_discard(struct request_queue *q,
+ 	q->limits.discard_granularity = card->pref_erase << 9;
+ 	/* granularity must not be greater than max. discard */
+ 	if (card->pref_erase > max_discard)
+-		q->limits.discard_granularity = 0;
++		q->limits.discard_granularity = SECTOR_SIZE;
+ 	if (mmc_can_secure_erase_trim(card))
+ 		blk_queue_flag_set(QUEUE_FLAG_SECERASE, q);
+ }
+diff --git a/drivers/mtd/nand/raw/sunxi_nand.c b/drivers/mtd/nand/raw/sunxi_nand.c
+index 5b8502fd50cbc..88075e420f907 100644
+--- a/drivers/mtd/nand/raw/sunxi_nand.c
++++ b/drivers/mtd/nand/raw/sunxi_nand.c
+@@ -1947,7 +1947,7 @@ static int sunxi_nand_chip_init(struct device *dev, struct sunxi_nfc *nfc,
+ 	ret = mtd_device_register(mtd, NULL, 0);
+ 	if (ret) {
+ 		dev_err(dev, "failed to register mtd device: %d\n", ret);
+-		nand_release(nand);
++		nand_cleanup(nand);
+ 		return ret;
+ 	}
+ 
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index d32e32e791741..a59333b87eafd 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -1123,6 +1123,7 @@ static void bond_setup_by_slave(struct net_device *bond_dev,
+ 
+ 	bond_dev->type		    = slave_dev->type;
+ 	bond_dev->hard_header_len   = slave_dev->hard_header_len;
++	bond_dev->needed_headroom   = slave_dev->needed_headroom;
+ 	bond_dev->addr_len	    = slave_dev->addr_len;
+ 
+ 	memcpy(bond_dev->broadcast, slave_dev->broadcast,
+diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
+index 76cc10e44080b..7ddacc9e4fe40 100644
+--- a/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
++++ b/drivers/net/ethernet/mellanox/mlx5/core/en_fs.c
+@@ -217,6 +217,9 @@ static int __mlx5e_add_vlan_rule(struct mlx5e_priv *priv,
+ 		break;
+ 	}
+ 
++	if (WARN_ONCE(*rule_p, "VLAN rule already exists type %d", rule_type))
++		return 0;
++
+ 	*rule_p = mlx5_add_flow_rules(ft, spec, &flow_act, &dest, 1);
+ 
+ 	if (IS_ERR(*rule_p)) {
+@@ -397,8 +400,7 @@ static void mlx5e_add_vlan_rules(struct mlx5e_priv *priv)
+ 	for_each_set_bit(i, priv->fs.vlan.active_svlans, VLAN_N_VID)
+ 		mlx5e_add_vlan_rule(priv, MLX5E_VLAN_RULE_TYPE_MATCH_STAG_VID, i);
+ 
+-	if (priv->fs.vlan.cvlan_filter_disabled &&
+-	    !(priv->netdev->flags & IFF_PROMISC))
++	if (priv->fs.vlan.cvlan_filter_disabled)
+ 		mlx5e_add_any_vid_rules(priv);
+ }
+ 
+@@ -415,8 +417,12 @@ static void mlx5e_del_vlan_rules(struct mlx5e_priv *priv)
+ 	for_each_set_bit(i, priv->fs.vlan.active_svlans, VLAN_N_VID)
+ 		mlx5e_del_vlan_rule(priv, MLX5E_VLAN_RULE_TYPE_MATCH_STAG_VID, i);
+ 
+-	if (priv->fs.vlan.cvlan_filter_disabled &&
+-	    !(priv->netdev->flags & IFF_PROMISC))
++	WARN_ON_ONCE(!(test_bit(MLX5E_STATE_DESTROYING, &priv->state)));
++
++	/* must be called after DESTROY bit is set and
++	 * set_rx_mode is called and flushed
++	 */
++	if (priv->fs.vlan.cvlan_filter_disabled)
+ 		mlx5e_del_any_vid_rules(priv);
+ }
+ 
+diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c
+index b5066cf86c856..569e698b5c807 100644
+--- a/drivers/net/ethernet/renesas/ravb_main.c
++++ b/drivers/net/ethernet/renesas/ravb_main.c
+@@ -1337,51 +1337,6 @@ static inline int ravb_hook_irq(unsigned int irq, irq_handler_t handler,
+ 	return error;
+ }
+ 
+-/* MDIO bus init function */
+-static int ravb_mdio_init(struct ravb_private *priv)
+-{
+-	struct platform_device *pdev = priv->pdev;
+-	struct device *dev = &pdev->dev;
+-	int error;
+-
+-	/* Bitbang init */
+-	priv->mdiobb.ops = &bb_ops;
+-
+-	/* MII controller setting */
+-	priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb);
+-	if (!priv->mii_bus)
+-		return -ENOMEM;
+-
+-	/* Hook up MII support for ethtool */
+-	priv->mii_bus->name = "ravb_mii";
+-	priv->mii_bus->parent = dev;
+-	snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x",
+-		 pdev->name, pdev->id);
+-
+-	/* Register MDIO bus */
+-	error = of_mdiobus_register(priv->mii_bus, dev->of_node);
+-	if (error)
+-		goto out_free_bus;
+-
+-	return 0;
+-
+-out_free_bus:
+-	free_mdio_bitbang(priv->mii_bus);
+-	return error;
+-}
+-
+-/* MDIO bus release function */
+-static int ravb_mdio_release(struct ravb_private *priv)
+-{
+-	/* Unregister mdio bus */
+-	mdiobus_unregister(priv->mii_bus);
+-
+-	/* Free bitbang info */
+-	free_mdio_bitbang(priv->mii_bus);
+-
+-	return 0;
+-}
+-
+ /* Network device open function for Ethernet AVB */
+ static int ravb_open(struct net_device *ndev)
+ {
+@@ -1390,13 +1345,6 @@ static int ravb_open(struct net_device *ndev)
+ 	struct device *dev = &pdev->dev;
+ 	int error;
+ 
+-	/* MDIO bus init */
+-	error = ravb_mdio_init(priv);
+-	if (error) {
+-		netdev_err(ndev, "failed to initialize MDIO\n");
+-		return error;
+-	}
+-
+ 	napi_enable(&priv->napi[RAVB_BE]);
+ 	napi_enable(&priv->napi[RAVB_NC]);
+ 
+@@ -1474,7 +1422,6 @@ out_free_irq:
+ out_napi_off:
+ 	napi_disable(&priv->napi[RAVB_NC]);
+ 	napi_disable(&priv->napi[RAVB_BE]);
+-	ravb_mdio_release(priv);
+ 	return error;
+ }
+ 
+@@ -1774,8 +1721,6 @@ static int ravb_close(struct net_device *ndev)
+ 	ravb_ring_free(ndev, RAVB_BE);
+ 	ravb_ring_free(ndev, RAVB_NC);
+ 
+-	ravb_mdio_release(priv);
+-
+ 	return 0;
+ }
+ 
+@@ -1922,6 +1867,51 @@ static const struct net_device_ops ravb_netdev_ops = {
+ 	.ndo_set_features	= ravb_set_features,
+ };
+ 
++/* MDIO bus init function */
++static int ravb_mdio_init(struct ravb_private *priv)
++{
++	struct platform_device *pdev = priv->pdev;
++	struct device *dev = &pdev->dev;
++	int error;
++
++	/* Bitbang init */
++	priv->mdiobb.ops = &bb_ops;
++
++	/* MII controller setting */
++	priv->mii_bus = alloc_mdio_bitbang(&priv->mdiobb);
++	if (!priv->mii_bus)
++		return -ENOMEM;
++
++	/* Hook up MII support for ethtool */
++	priv->mii_bus->name = "ravb_mii";
++	priv->mii_bus->parent = dev;
++	snprintf(priv->mii_bus->id, MII_BUS_ID_SIZE, "%s-%x",
++		 pdev->name, pdev->id);
++
++	/* Register MDIO bus */
++	error = of_mdiobus_register(priv->mii_bus, dev->of_node);
++	if (error)
++		goto out_free_bus;
++
++	return 0;
++
++out_free_bus:
++	free_mdio_bitbang(priv->mii_bus);
++	return error;
++}
++
++/* MDIO bus release function */
++static int ravb_mdio_release(struct ravb_private *priv)
++{
++	/* Unregister mdio bus */
++	mdiobus_unregister(priv->mii_bus);
++
++	/* Free bitbang info */
++	free_mdio_bitbang(priv->mii_bus);
++
++	return 0;
++}
++
+ static const struct of_device_id ravb_match_table[] = {
+ 	{ .compatible = "renesas,etheravb-r8a7790", .data = (void *)RCAR_GEN2 },
+ 	{ .compatible = "renesas,etheravb-r8a7794", .data = (void *)RCAR_GEN2 },
+@@ -2148,6 +2138,13 @@ static int ravb_probe(struct platform_device *pdev)
+ 		eth_hw_addr_random(ndev);
+ 	}
+ 
++	/* MDIO bus init */
++	error = ravb_mdio_init(priv);
++	if (error) {
++		dev_err(&pdev->dev, "failed to initialize MDIO\n");
++		goto out_dma_free;
++	}
++
+ 	netif_napi_add(ndev, &priv->napi[RAVB_BE], ravb_poll, 64);
+ 	netif_napi_add(ndev, &priv->napi[RAVB_NC], ravb_poll, 64);
+ 
+@@ -2169,6 +2166,8 @@ static int ravb_probe(struct platform_device *pdev)
+ out_napi_del:
+ 	netif_napi_del(&priv->napi[RAVB_NC]);
+ 	netif_napi_del(&priv->napi[RAVB_BE]);
++	ravb_mdio_release(priv);
++out_dma_free:
+ 	dma_free_coherent(ndev->dev.parent, priv->desc_bat_size, priv->desc_bat,
+ 			  priv->desc_bat_dma);
+ 
+@@ -2200,6 +2199,7 @@ static int ravb_remove(struct platform_device *pdev)
+ 	unregister_netdev(ndev);
+ 	netif_napi_del(&priv->napi[RAVB_NC]);
+ 	netif_napi_del(&priv->napi[RAVB_BE]);
++	ravb_mdio_release(priv);
+ 	pm_runtime_disable(&pdev->dev);
+ 	free_netdev(ndev);
+ 	platform_set_drvdata(pdev, NULL);
+diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
+index 4d5fb4b51cc4f..5986fe927ad0b 100644
+--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
++++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_ethtool.c
+@@ -694,23 +694,16 @@ static int stmmac_ethtool_op_set_eee(struct net_device *dev,
+ 	struct stmmac_priv *priv = netdev_priv(dev);
+ 	int ret;
+ 
+-	if (!edata->eee_enabled) {
++	if (!priv->dma_cap.eee)
++		return -EOPNOTSUPP;
++
++	if (!edata->eee_enabled)
+ 		stmmac_disable_eee_mode(priv);
+-	} else {
+-		/* We are asking for enabling the EEE but it is safe
+-		 * to verify all by invoking the eee_init function.
+-		 * In case of failure it will return an error.
+-		 */
+-		edata->eee_enabled = stmmac_eee_init(priv);
+-		if (!edata->eee_enabled)
+-			return -EOPNOTSUPP;
+-	}
+ 
+ 	ret = phy_ethtool_set_eee(dev->phydev, edata);
+ 	if (ret)
+ 		return ret;
+ 
+-	priv->eee_enabled = edata->eee_enabled;
+ 	priv->tx_lpi_timer = edata->tx_lpi_timer;
+ 	return 0;
+ }
+diff --git a/drivers/net/macsec.c b/drivers/net/macsec.c
+index 4ad3b877e5fd9..4c5b67a2d63a0 100644
+--- a/drivers/net/macsec.c
++++ b/drivers/net/macsec.c
+@@ -1085,6 +1085,7 @@ static rx_handler_result_t macsec_handle_frame(struct sk_buff **pskb)
+ 	struct macsec_rx_sa *rx_sa;
+ 	struct macsec_rxh_data *rxd;
+ 	struct macsec_dev *macsec;
++	unsigned int len;
+ 	sci_t sci;
+ 	u32 pn;
+ 	bool cbit;
+@@ -1240,9 +1241,10 @@ deliver:
+ 	macsec_rxsc_put(rx_sc);
+ 
+ 	skb_orphan(skb);
++	len = skb->len;
+ 	ret = gro_cells_receive(&macsec->gro_cells, skb);
+ 	if (ret == NET_RX_SUCCESS)
+-		count_rx(dev, skb->len);
++		count_rx(dev, len);
+ 	else
+ 		macsec->secy.netdev->stats.rx_dropped++;
+ 
+diff --git a/drivers/net/phy/Kconfig b/drivers/net/phy/Kconfig
+index 1f5fd24cd749e..2386871e12949 100644
+--- a/drivers/net/phy/Kconfig
++++ b/drivers/net/phy/Kconfig
+@@ -154,6 +154,7 @@ config MDIO_THUNDER
+ 	depends on 64BIT
+ 	depends on PCI
+ 	select MDIO_CAVIUM
++	select MDIO_DEVRES
+ 	help
+ 	  This driver supports the MDIO interfaces found on Cavium
+ 	  ThunderX SoCs when the MDIO bus device appears as a PCI
+diff --git a/drivers/net/team/team.c b/drivers/net/team/team.c
+index 53d9562a8818b..3eb034a5a659b 100644
+--- a/drivers/net/team/team.c
++++ b/drivers/net/team/team.c
+@@ -294,7 +294,7 @@ inst_rollback:
+ 	for (i--; i >= 0; i--)
+ 		__team_option_inst_del_option(team, dst_opts[i]);
+ 
+-	i = option_count - 1;
++	i = option_count;
+ alloc_rollback:
+ 	for (i--; i >= 0; i--)
+ 		kfree(dst_opts[i]);
+@@ -2086,6 +2086,7 @@ static void team_setup_by_port(struct net_device *dev,
+ 	dev->header_ops	= port_dev->header_ops;
+ 	dev->type = port_dev->type;
+ 	dev->hard_header_len = port_dev->hard_header_len;
++	dev->needed_headroom = port_dev->needed_headroom;
+ 	dev->addr_len = port_dev->addr_len;
+ 	dev->mtu = port_dev->mtu;
+ 	memcpy(dev->broadcast, port_dev->broadcast, port_dev->addr_len);
+diff --git a/drivers/net/usb/ax88179_178a.c b/drivers/net/usb/ax88179_178a.c
+index 8455f72007b9e..a9d0df435e266 100644
+--- a/drivers/net/usb/ax88179_178a.c
++++ b/drivers/net/usb/ax88179_178a.c
+@@ -1735,6 +1735,7 @@ static const struct driver_info belkin_info = {
+ 	.status = ax88179_status,
+ 	.link_reset = ax88179_link_reset,
+ 	.reset	= ax88179_reset,
++	.stop	= ax88179_stop,
+ 	.flags	= FLAG_ETHER | FLAG_FRAMING_AX,
+ 	.rx_fixup = ax88179_rx_fixup,
+ 	.tx_fixup = ax88179_tx_fixup,
+diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
+index 80373a9171dd2..933d1a74bcdb3 100644
+--- a/drivers/net/usb/rtl8150.c
++++ b/drivers/net/usb/rtl8150.c
+@@ -277,12 +277,20 @@ static int write_mii_word(rtl8150_t * dev, u8 phy, __u8 indx, u16 reg)
+ 		return 1;
+ }
+ 
+-static inline void set_ethernet_addr(rtl8150_t * dev)
++static void set_ethernet_addr(rtl8150_t *dev)
+ {
+-	u8 node_id[6];
++	u8 node_id[ETH_ALEN];
++	int ret;
++
++	ret = get_registers(dev, IDR, sizeof(node_id), node_id);
+ 
+-	get_registers(dev, IDR, sizeof(node_id), node_id);
+-	memcpy(dev->netdev->dev_addr, node_id, sizeof(node_id));
++	if (ret == sizeof(node_id)) {
++		ether_addr_copy(dev->netdev->dev_addr, node_id);
++	} else {
++		eth_hw_addr_random(dev->netdev);
++		netdev_notice(dev->netdev, "Assigned a random MAC address: %pM\n",
++			      dev->netdev->dev_addr);
++	}
+ }
+ 
+ static int rtl8150_set_mac_address(struct net_device *netdev, void *p)
+diff --git a/drivers/nvme/host/core.c b/drivers/nvme/host/core.c
+index 9ea3d8e611005..b633ea40430ee 100644
+--- a/drivers/nvme/host/core.c
++++ b/drivers/nvme/host/core.c
+@@ -2606,8 +2606,10 @@ static int nvme_dev_open(struct inode *inode, struct file *file)
+ 	}
+ 
+ 	nvme_get_ctrl(ctrl);
+-	if (!try_module_get(ctrl->ops->module))
++	if (!try_module_get(ctrl->ops->module)) {
++		nvme_put_ctrl(ctrl);
+ 		return -EINVAL;
++	}
+ 
+ 	file->private_data = ctrl;
+ 	return 0;
+diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
+index 1e2524de6a63c..a13bb4ddd0cf1 100644
+--- a/drivers/platform/x86/Kconfig
++++ b/drivers/platform/x86/Kconfig
+@@ -235,6 +235,7 @@ config FUJITSU_LAPTOP
+ 	depends on BACKLIGHT_CLASS_DEVICE
+ 	depends on ACPI_VIDEO || ACPI_VIDEO = n
+ 	select INPUT_SPARSEKMAP
++	select NEW_LEDS
+ 	select LEDS_CLASS
+ 	---help---
+ 	  This is a driver for laptops built by Fujitsu:
+diff --git a/drivers/platform/x86/intel-vbtn.c b/drivers/platform/x86/intel-vbtn.c
+index c7c8b432c163f..1e6b4661c7645 100644
+--- a/drivers/platform/x86/intel-vbtn.c
++++ b/drivers/platform/x86/intel-vbtn.c
+@@ -15,9 +15,13 @@
+ #include <linux/platform_device.h>
+ #include <linux/suspend.h>
+ 
++/* Returned when NOT in tablet mode on some HP Stream x360 11 models */
++#define VGBS_TABLET_MODE_FLAG_ALT	0x10
+ /* When NOT in tablet mode, VGBS returns with the flag 0x40 */
+-#define TABLET_MODE_FLAG 0x40
+-#define DOCK_MODE_FLAG   0x80
++#define VGBS_TABLET_MODE_FLAG		0x40
++#define VGBS_DOCK_MODE_FLAG		0x80
++
++#define VGBS_TABLET_MODE_FLAGS (VGBS_TABLET_MODE_FLAG | VGBS_TABLET_MODE_FLAG_ALT)
+ 
+ MODULE_LICENSE("GPL");
+ MODULE_AUTHOR("AceLan Kao");
+@@ -148,26 +152,60 @@ static void detect_tablet_mode(struct platform_device *device)
+ 	if (ACPI_FAILURE(status))
+ 		return;
+ 
+-	m = !(vgbs & TABLET_MODE_FLAG);
++	m = !(vgbs & VGBS_TABLET_MODE_FLAGS);
+ 	input_report_switch(priv->input_dev, SW_TABLET_MODE, m);
+-	m = (vgbs & DOCK_MODE_FLAG) ? 1 : 0;
++	m = (vgbs & VGBS_DOCK_MODE_FLAG) ? 1 : 0;
+ 	input_report_switch(priv->input_dev, SW_DOCK, m);
+ }
+ 
++/*
++ * There are several laptops (non 2-in-1) models out there which support VGBS,
++ * but simply always return 0, which we translate to SW_TABLET_MODE=1. This in
++ * turn causes userspace (libinput) to suppress events from the builtin
++ * keyboard and touchpad, making the laptop essentially unusable.
++ *
++ * Since the problem of wrongly reporting SW_TABLET_MODE=1 in combination
++ * with libinput, leads to a non-usable system. Where as OTOH many people will
++ * not even notice when SW_TABLET_MODE is not being reported, a DMI based allow
++ * list is used here. This list mainly matches on the chassis-type of 2-in-1s.
++ *
++ * There are also some 2-in-1s which use the intel-vbtn ACPI interface to report
++ * SW_TABLET_MODE with a chassis-type of 8 ("Portable") or 10 ("Notebook"),
++ * these are matched on a per model basis, since many normal laptops with a
++ * possible broken VGBS ACPI-method also use these chassis-types.
++ */
++static const struct dmi_system_id dmi_switches_allow_list[] = {
++	{
++		.matches = {
++			DMI_EXACT_MATCH(DMI_CHASSIS_TYPE, "31" /* Convertible */),
++		},
++	},
++	{
++		.matches = {
++			DMI_EXACT_MATCH(DMI_CHASSIS_TYPE, "32" /* Detachable */),
++		},
++	},
++	{
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
++			DMI_MATCH(DMI_PRODUCT_NAME, "Venue 11 Pro 7130"),
++		},
++	},
++	{
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "HP Stream x360 Convertible PC 11"),
++		},
++	},
++	{} /* Array terminator */
++};
++
+ static bool intel_vbtn_has_switches(acpi_handle handle)
+ {
+-	const char *chassis_type = dmi_get_system_info(DMI_CHASSIS_TYPE);
+ 	unsigned long long vgbs;
+ 	acpi_status status;
+ 
+-	/*
+-	 * Some normal laptops have a VGBS method despite being non-convertible
+-	 * and their VGBS method always returns 0, causing detect_tablet_mode()
+-	 * to report SW_TABLET_MODE=1 to userspace, which causes issues.
+-	 * These laptops have a DMI chassis_type of 9 ("Laptop"), do not report
+-	 * switches on any devices with a DMI chassis_type of 9.
+-	 */
+-	if (chassis_type && strcmp(chassis_type, "9") == 0)
++	if (!dmi_check_system(dmi_switches_allow_list))
+ 		return false;
+ 
+ 	status = acpi_evaluate_integer(handle, "VGBS", NULL, &vgbs);
+diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
+index 8f85bb4fe7844..98bd8213b0378 100644
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -2597,7 +2597,7 @@ static void hotkey_compare_and_issue_event(struct tp_nvram_state *oldn,
+  */
+ static int hotkey_kthread(void *data)
+ {
+-	struct tp_nvram_state s[2];
++	struct tp_nvram_state s[2] = { 0 };
+ 	u32 poll_mask, event_mask;
+ 	unsigned int si, so;
+ 	unsigned long t;
+@@ -6879,8 +6879,10 @@ static int __init tpacpi_query_bcl_levels(acpi_handle handle)
+ 	list_for_each_entry(child, &device->children, node) {
+ 		acpi_status status = acpi_evaluate_object(child->handle, "_BCL",
+ 							  NULL, &buffer);
+-		if (ACPI_FAILURE(status))
++		if (ACPI_FAILURE(status)) {
++			buffer.length = ACPI_ALLOCATE_BUFFER;
+ 			continue;
++		}
+ 
+ 		obj = (union acpi_object *)buffer.pointer;
+ 		if (!obj || (obj->type != ACPI_TYPE_PACKAGE)) {
+diff --git a/drivers/video/console/newport_con.c b/drivers/video/console/newport_con.c
+index cc2fb50431840..02b24ae8b9cb6 100644
+--- a/drivers/video/console/newport_con.c
++++ b/drivers/video/console/newport_con.c
+@@ -35,12 +35,6 @@
+ 
+ #define FONT_DATA ((unsigned char *)font_vga_8x16.data)
+ 
+-/* borrowed from fbcon.c */
+-#define REFCOUNT(fd)	(((int *)(fd))[-1])
+-#define FNTSIZE(fd)	(((int *)(fd))[-2])
+-#define FNTCHARCNT(fd)	(((int *)(fd))[-3])
+-#define FONT_EXTRA_WORDS 3
+-
+ static unsigned char *font_data[MAX_NR_CONSOLES];
+ 
+ static struct newport_regs *npregs;
+@@ -522,6 +516,7 @@ static int newport_set_font(int unit, struct console_font *op)
+ 	FNTSIZE(new_data) = size;
+ 	FNTCHARCNT(new_data) = op->charcount;
+ 	REFCOUNT(new_data) = 0;	/* usage counter */
++	FNTSUM(new_data) = 0;
+ 
+ 	p = new_data;
+ 	for (i = 0; i < op->charcount; i++) {
+diff --git a/drivers/video/fbdev/core/fbcon.c b/drivers/video/fbdev/core/fbcon.c
+index 0bf5ea518558c..5742a0dc774e9 100644
+--- a/drivers/video/fbdev/core/fbcon.c
++++ b/drivers/video/fbdev/core/fbcon.c
+@@ -2270,6 +2270,9 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font)
+ 
+ 	if (font->width <= 8) {
+ 		j = vc->vc_font.height;
++		if (font->charcount * j > FNTSIZE(fontdata))
++			return -EINVAL;
++
+ 		for (i = 0; i < font->charcount; i++) {
+ 			memcpy(data, fontdata, j);
+ 			memset(data + j, 0, 32 - j);
+@@ -2278,6 +2281,9 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font)
+ 		}
+ 	} else if (font->width <= 16) {
+ 		j = vc->vc_font.height * 2;
++		if (font->charcount * j > FNTSIZE(fontdata))
++			return -EINVAL;
++
+ 		for (i = 0; i < font->charcount; i++) {
+ 			memcpy(data, fontdata, j);
+ 			memset(data + j, 0, 64 - j);
+@@ -2285,6 +2291,9 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font)
+ 			fontdata += j;
+ 		}
+ 	} else if (font->width <= 24) {
++		if (font->charcount * (vc->vc_font.height * sizeof(u32)) > FNTSIZE(fontdata))
++			return -EINVAL;
++
+ 		for (i = 0; i < font->charcount; i++) {
+ 			for (j = 0; j < vc->vc_font.height; j++) {
+ 				*data++ = fontdata[0];
+@@ -2297,6 +2306,9 @@ static int fbcon_get_font(struct vc_data *vc, struct console_font *font)
+ 		}
+ 	} else {
+ 		j = vc->vc_font.height * 4;
++		if (font->charcount * j > FNTSIZE(fontdata))
++			return -EINVAL;
++
+ 		for (i = 0; i < font->charcount; i++) {
+ 			memcpy(data, fontdata, j);
+ 			memset(data + j, 0, 128 - j);
+diff --git a/drivers/video/fbdev/core/fbcon.h b/drivers/video/fbdev/core/fbcon.h
+index aeea63abbe987..c023009f29789 100644
+--- a/drivers/video/fbdev/core/fbcon.h
++++ b/drivers/video/fbdev/core/fbcon.h
+@@ -152,13 +152,6 @@ static inline int attr_col_ec(int shift, struct vc_data *vc,
+ #define attr_bgcol_ec(bgshift, vc, info) attr_col_ec(bgshift, vc, info, 0)
+ #define attr_fgcol_ec(fgshift, vc, info) attr_col_ec(fgshift, vc, info, 1)
+ 
+-/* Font */
+-#define REFCOUNT(fd)	(((int *)(fd))[-1])
+-#define FNTSIZE(fd)	(((int *)(fd))[-2])
+-#define FNTCHARCNT(fd)	(((int *)(fd))[-3])
+-#define FNTSUM(fd)	(((int *)(fd))[-4])
+-#define FONT_EXTRA_WORDS 4
+-
+     /*
+      *  Scroll Method
+      */
+diff --git a/drivers/video/fbdev/core/fbcon_rotate.c b/drivers/video/fbdev/core/fbcon_rotate.c
+index c0d445294aa7c..ac72d4f85f7d0 100644
+--- a/drivers/video/fbdev/core/fbcon_rotate.c
++++ b/drivers/video/fbdev/core/fbcon_rotate.c
+@@ -14,6 +14,7 @@
+ #include <linux/fb.h>
+ #include <linux/vt_kern.h>
+ #include <linux/console.h>
++#include <linux/font.h>
+ #include <asm/types.h>
+ #include "fbcon.h"
+ #include "fbcon_rotate.h"
+diff --git a/drivers/video/fbdev/core/tileblit.c b/drivers/video/fbdev/core/tileblit.c
+index eb664dbf96f66..adff8d6ffe6f9 100644
+--- a/drivers/video/fbdev/core/tileblit.c
++++ b/drivers/video/fbdev/core/tileblit.c
+@@ -13,6 +13,7 @@
+ #include <linux/fb.h>
+ #include <linux/vt_kern.h>
+ #include <linux/console.h>
++#include <linux/font.h>
+ #include <asm/types.h>
+ #include "fbcon.h"
+ 
+diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
+index 947a40069d246..3d63c76ed0989 100644
+--- a/fs/cifs/smb2ops.c
++++ b/fs/cifs/smb2ops.c
+@@ -950,7 +950,7 @@ smb2_set_ea(const unsigned int xid, struct cifs_tcon *tcon,
+ 		return rc;
+ 	}
+ 
+-	len = sizeof(ea) + ea_name_len + ea_value_len + 1;
++	len = sizeof(*ea) + ea_name_len + ea_value_len + 1;
+ 	ea = kzalloc(len, GFP_KERNEL);
+ 	if (ea == NULL) {
+ 		SMB2_close(xid, tcon, fid.persistent_fid, fid.volatile_fid);
+diff --git a/include/linux/font.h b/include/linux/font.h
+index d6821769dd1e1..f85e70bd4793e 100644
+--- a/include/linux/font.h
++++ b/include/linux/font.h
+@@ -57,4 +57,17 @@ extern const struct font_desc *get_default_font(int xres, int yres,
+ /* Max. length for the name of a predefined font */
+ #define MAX_FONT_NAME	32
+ 
++/* Extra word getters */
++#define REFCOUNT(fd)	(((int *)(fd))[-1])
++#define FNTSIZE(fd)	(((int *)(fd))[-2])
++#define FNTCHARCNT(fd)	(((int *)(fd))[-3])
++#define FNTSUM(fd)	(((int *)(fd))[-4])
++
++#define FONT_EXTRA_WORDS 4
++
++struct font_data {
++	unsigned int extra[FONT_EXTRA_WORDS];
++	const unsigned char data[];
++} __packed;
++
+ #endif /* _VIDEO_FONT_H */
+diff --git a/include/linux/khugepaged.h b/include/linux/khugepaged.h
+index 082d1d2a52169..dc9a2eecc8b80 100644
+--- a/include/linux/khugepaged.h
++++ b/include/linux/khugepaged.h
+@@ -15,6 +15,7 @@ extern int __khugepaged_enter(struct mm_struct *mm);
+ extern void __khugepaged_exit(struct mm_struct *mm);
+ extern int khugepaged_enter_vma_merge(struct vm_area_struct *vma,
+ 				      unsigned long vm_flags);
++extern void khugepaged_min_free_kbytes_update(void);
+ 
+ #define khugepaged_enabled()					       \
+ 	(transparent_hugepage_flags &				       \
+@@ -73,6 +74,10 @@ static inline int khugepaged_enter_vma_merge(struct vm_area_struct *vma,
+ {
+ 	return 0;
+ }
++
++static inline void khugepaged_min_free_kbytes_update(void)
++{
++}
+ #endif /* CONFIG_TRANSPARENT_HUGEPAGE */
+ 
+ #endif /* _LINUX_KHUGEPAGED_H */
+diff --git a/include/net/xfrm.h b/include/net/xfrm.h
+index 3a0b5de742e9b..fe8bed557691a 100644
+--- a/include/net/xfrm.h
++++ b/include/net/xfrm.h
+@@ -1873,21 +1873,17 @@ static inline unsigned int xfrm_replay_state_esn_len(struct xfrm_replay_state_es
+ static inline int xfrm_replay_clone(struct xfrm_state *x,
+ 				     struct xfrm_state *orig)
+ {
+-	x->replay_esn = kzalloc(xfrm_replay_state_esn_len(orig->replay_esn),
++
++	x->replay_esn = kmemdup(orig->replay_esn,
++				xfrm_replay_state_esn_len(orig->replay_esn),
+ 				GFP_KERNEL);
+ 	if (!x->replay_esn)
+ 		return -ENOMEM;
+-
+-	x->replay_esn->bmp_len = orig->replay_esn->bmp_len;
+-	x->replay_esn->replay_window = orig->replay_esn->replay_window;
+-
+-	x->preplay_esn = kmemdup(x->replay_esn,
+-				 xfrm_replay_state_esn_len(x->replay_esn),
++	x->preplay_esn = kmemdup(orig->preplay_esn,
++				 xfrm_replay_state_esn_len(orig->preplay_esn),
+ 				 GFP_KERNEL);
+-	if (!x->preplay_esn) {
+-		kfree(x->replay_esn);
++	if (!x->preplay_esn)
+ 		return -ENOMEM;
+-	}
+ 
+ 	return 0;
+ }
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index a17e6302ded53..a35d742b0ba82 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -98,7 +98,7 @@ static void remote_function(void *data)
+  * retry due to any failures in smp_call_function_single(), such as if the
+  * task_cpu() goes offline concurrently.
+  *
+- * returns @func return value or -ESRCH when the process isn't running
++ * returns @func return value or -ESRCH or -ENXIO when the process isn't running
+  */
+ static int
+ task_function_call(struct task_struct *p, remote_function_f func, void *info)
+@@ -114,7 +114,8 @@ task_function_call(struct task_struct *p, remote_function_f func, void *info)
+ 	for (;;) {
+ 		ret = smp_call_function_single(task_cpu(p), remote_function,
+ 					       &data, 1);
+-		ret = !ret ? data.ret : -EAGAIN;
++		if (!ret)
++			ret = data.ret;
+ 
+ 		if (ret != -EAGAIN)
+ 			break;
+diff --git a/kernel/umh.c b/kernel/umh.c
+index 52a9084f85419..16653319c8ce8 100644
+--- a/kernel/umh.c
++++ b/kernel/umh.c
+@@ -13,6 +13,7 @@
+ #include <linux/cred.h>
+ #include <linux/file.h>
+ #include <linux/fdtable.h>
++#include <linux/fs_struct.h>
+ #include <linux/workqueue.h>
+ #include <linux/security.h>
+ #include <linux/mount.h>
+@@ -72,6 +73,14 @@ static int call_usermodehelper_exec_async(void *data)
+ 	flush_signal_handlers(current, 1);
+ 	spin_unlock_irq(&current->sighand->siglock);
+ 
++	/*
++	 * Initial kernel threads share ther FS with init, in order to
++	 * get the init root directory. But we've now created a new
++	 * thread that is going to execve a user process and has its own
++	 * 'struct fs_struct'. Reset umask to the default.
++	 */
++	current->fs->umask = 0022;
++
+ 	/*
+ 	 * Our parent (unbound workqueue) runs with elevated scheduling
+ 	 * priority. Avoid propagating that into the userspace child.
+diff --git a/lib/fonts/font_10x18.c b/lib/fonts/font_10x18.c
+index 532f0ff89a962..0e2deac97da0d 100644
+--- a/lib/fonts/font_10x18.c
++++ b/lib/fonts/font_10x18.c
+@@ -8,8 +8,8 @@
+ 
+ #define FONTDATAMAX 9216
+ 
+-static const unsigned char fontdata_10x18[FONTDATAMAX] = {
+-
++static struct font_data fontdata_10x18 = {
++	{ 0, 0, FONTDATAMAX, 0 }, {
+ 	/* 0 0x00 '^@' */
+ 	0x00, 0x00, /* 0000000000 */
+ 	0x00, 0x00, /* 0000000000 */
+@@ -5129,8 +5129,7 @@ static const unsigned char fontdata_10x18[FONTDATAMAX] = {
+ 	0x00, 0x00, /* 0000000000 */
+ 	0x00, 0x00, /* 0000000000 */
+ 	0x00, 0x00, /* 0000000000 */
+-
+-};
++} };
+ 
+ 
+ const struct font_desc font_10x18 = {
+@@ -5138,7 +5137,7 @@ const struct font_desc font_10x18 = {
+ 	.name	= "10x18",
+ 	.width	= 10,
+ 	.height	= 18,
+-	.data	= fontdata_10x18,
++	.data	= fontdata_10x18.data,
+ #ifdef __sparc__
+ 	.pref	= 5,
+ #else
+diff --git a/lib/fonts/font_6x10.c b/lib/fonts/font_6x10.c
+index 09b2cc03435b9..87da8acd07db0 100644
+--- a/lib/fonts/font_6x10.c
++++ b/lib/fonts/font_6x10.c
+@@ -1,8 +1,10 @@
+ // SPDX-License-Identifier: GPL-2.0
+ #include <linux/font.h>
+ 
+-static const unsigned char fontdata_6x10[] = {
++#define FONTDATAMAX 2560
+ 
++static struct font_data fontdata_6x10 = {
++	{ 0, 0, FONTDATAMAX, 0 }, {
+ 	/* 0 0x00 '^@' */
+ 	0x00, /* 00000000 */
+ 	0x00, /* 00000000 */
+@@ -3074,14 +3076,13 @@ static const unsigned char fontdata_6x10[] = {
+ 	0x00, /* 00000000 */
+ 	0x00, /* 00000000 */
+ 	0x00, /* 00000000 */
+-
+-};
++} };
+ 
+ const struct font_desc font_6x10 = {
+ 	.idx	= FONT6x10_IDX,
+ 	.name	= "6x10",
+ 	.width	= 6,
+ 	.height	= 10,
+-	.data	= fontdata_6x10,
++	.data	= fontdata_6x10.data,
+ 	.pref	= 0,
+ };
+diff --git a/lib/fonts/font_6x11.c b/lib/fonts/font_6x11.c
+index d7136c33f1f01..5e975dfa10a53 100644
+--- a/lib/fonts/font_6x11.c
++++ b/lib/fonts/font_6x11.c
+@@ -9,8 +9,8 @@
+ 
+ #define FONTDATAMAX (11*256)
+ 
+-static const unsigned char fontdata_6x11[FONTDATAMAX] = {
+-
++static struct font_data fontdata_6x11 = {
++	{ 0, 0, FONTDATAMAX, 0 }, {
+ 	/* 0 0x00 '^@' */
+ 	0x00, /* 00000000 */
+ 	0x00, /* 00000000 */
+@@ -3338,8 +3338,7 @@ static const unsigned char fontdata_6x11[FONTDATAMAX] = {
+ 	0x00, /* 00000000 */
+ 	0x00, /* 00000000 */
+ 	0x00, /* 00000000 */
+-
+-};
++} };
+ 
+ 
+ const struct font_desc font_vga_6x11 = {
+@@ -3347,7 +3346,7 @@ const struct font_desc font_vga_6x11 = {
+ 	.name	= "ProFont6x11",
+ 	.width	= 6,
+ 	.height	= 11,
+-	.data	= fontdata_6x11,
++	.data	= fontdata_6x11.data,
+ 	/* Try avoiding this font if possible unless on MAC */
+ 	.pref	= -2000,
+ };
+diff --git a/lib/fonts/font_7x14.c b/lib/fonts/font_7x14.c
+index 89752d0b23e8b..86d298f385058 100644
+--- a/lib/fonts/font_7x14.c
++++ b/lib/fonts/font_7x14.c
+@@ -8,8 +8,8 @@
+ 
+ #define FONTDATAMAX 3584
+ 
+-static const unsigned char fontdata_7x14[FONTDATAMAX] = {
+-
++static struct font_data fontdata_7x14 = {
++	{ 0, 0, FONTDATAMAX, 0 }, {
+ 	/* 0 0x00 '^@' */
+ 	0x00, /* 0000000 */
+ 	0x00, /* 0000000 */
+@@ -4105,8 +4105,7 @@ static const unsigned char fontdata_7x14[FONTDATAMAX] = {
+ 	0x00, /* 0000000 */
+ 	0x00, /* 0000000 */
+ 	0x00, /* 0000000 */
+-
+-};
++} };
+ 
+ 
+ const struct font_desc font_7x14 = {
+@@ -4114,6 +4113,6 @@ const struct font_desc font_7x14 = {
+ 	.name	= "7x14",
+ 	.width	= 7,
+ 	.height	= 14,
+-	.data	= fontdata_7x14,
++	.data	= fontdata_7x14.data,
+ 	.pref	= 0,
+ };
+diff --git a/lib/fonts/font_8x16.c b/lib/fonts/font_8x16.c
+index b7ab1f5fbdb8a..37cedd36ca5ef 100644
+--- a/lib/fonts/font_8x16.c
++++ b/lib/fonts/font_8x16.c
+@@ -10,8 +10,8 @@
+ 
+ #define FONTDATAMAX 4096
+ 
+-static const unsigned char fontdata_8x16[FONTDATAMAX] = {
+-
++static struct font_data fontdata_8x16 = {
++	{ 0, 0, FONTDATAMAX, 0 }, {
+ 	/* 0 0x00 '^@' */
+ 	0x00, /* 00000000 */
+ 	0x00, /* 00000000 */
+@@ -4619,8 +4619,7 @@ static const unsigned char fontdata_8x16[FONTDATAMAX] = {
+ 	0x00, /* 00000000 */
+ 	0x00, /* 00000000 */
+ 	0x00, /* 00000000 */
+-
+-};
++} };
+ 
+ 
+ const struct font_desc font_vga_8x16 = {
+@@ -4628,7 +4627,7 @@ const struct font_desc font_vga_8x16 = {
+ 	.name	= "VGA8x16",
+ 	.width	= 8,
+ 	.height	= 16,
+-	.data	= fontdata_8x16,
++	.data	= fontdata_8x16.data,
+ 	.pref	= 0,
+ };
+ EXPORT_SYMBOL(font_vga_8x16);
+diff --git a/lib/fonts/font_8x8.c b/lib/fonts/font_8x8.c
+index 2328ebc8bab5d..8ab695538395d 100644
+--- a/lib/fonts/font_8x8.c
++++ b/lib/fonts/font_8x8.c
+@@ -9,8 +9,8 @@
+ 
+ #define FONTDATAMAX 2048
+ 
+-static const unsigned char fontdata_8x8[FONTDATAMAX] = {
+-
++static struct font_data fontdata_8x8 = {
++	{ 0, 0, FONTDATAMAX, 0 }, {
+ 	/* 0 0x00 '^@' */
+ 	0x00, /* 00000000 */
+ 	0x00, /* 00000000 */
+@@ -2570,8 +2570,7 @@ static const unsigned char fontdata_8x8[FONTDATAMAX] = {
+ 	0x00, /* 00000000 */
+ 	0x00, /* 00000000 */
+ 	0x00, /* 00000000 */
+-
+-};
++} };
+ 
+ 
+ const struct font_desc font_vga_8x8 = {
+@@ -2579,6 +2578,6 @@ const struct font_desc font_vga_8x8 = {
+ 	.name	= "VGA8x8",
+ 	.width	= 8,
+ 	.height	= 8,
+-	.data	= fontdata_8x8,
++	.data	= fontdata_8x8.data,
+ 	.pref	= 0,
+ };
+diff --git a/lib/fonts/font_acorn_8x8.c b/lib/fonts/font_acorn_8x8.c
+index 0ff0e85d4481b..069b3e80c4344 100644
+--- a/lib/fonts/font_acorn_8x8.c
++++ b/lib/fonts/font_acorn_8x8.c
+@@ -3,7 +3,10 @@
+ 
+ #include <linux/font.h>
+ 
+-static const unsigned char acorndata_8x8[] = {
++#define FONTDATAMAX 2048
++
++static struct font_data acorndata_8x8 = {
++{ 0, 0, FONTDATAMAX, 0 }, {
+ /* 00 */  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, /* ^@ */
+ /* 01 */  0x7e, 0x81, 0xa5, 0x81, 0xbd, 0x99, 0x81, 0x7e, /* ^A */
+ /* 02 */  0x7e, 0xff, 0xbd, 0xff, 0xc3, 0xe7, 0xff, 0x7e, /* ^B */
+@@ -260,14 +263,14 @@ static const unsigned char acorndata_8x8[] = {
+ /* FD */  0x38, 0x04, 0x18, 0x20, 0x3c, 0x00, 0x00, 0x00,
+ /* FE */  0x00, 0x00, 0x3c, 0x3c, 0x3c, 0x3c, 0x00, 0x00,
+ /* FF */  0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
+-};
++} };
+ 
+ const struct font_desc font_acorn_8x8 = {
+ 	.idx	= ACORN8x8_IDX,
+ 	.name	= "Acorn8x8",
+ 	.width	= 8,
+ 	.height	= 8,
+-	.data	= acorndata_8x8,
++	.data	= acorndata_8x8.data,
+ #ifdef CONFIG_ARCH_ACORN
+ 	.pref	= 20,
+ #else
+diff --git a/lib/fonts/font_mini_4x6.c b/lib/fonts/font_mini_4x6.c
+index 838caa1cfef70..1449876c6a270 100644
+--- a/lib/fonts/font_mini_4x6.c
++++ b/lib/fonts/font_mini_4x6.c
+@@ -43,8 +43,8 @@ __END__;
+ 
+ #define FONTDATAMAX 1536
+ 
+-static const unsigned char fontdata_mini_4x6[FONTDATAMAX] = {
+-
++static struct font_data fontdata_mini_4x6 = {
++	{ 0, 0, FONTDATAMAX, 0 }, {
+ 	/*{*/
+ 	  	/*   Char 0: ' '  */
+ 	0xee,	/*=  [*** ]       */
+@@ -2145,14 +2145,14 @@ static const unsigned char fontdata_mini_4x6[FONTDATAMAX] = {
+ 	0xee,	/*=   [*** ]        */
+ 	0x00,	/*=   [    ]        */
+ 	/*}*/
+-};
++} };
+ 
+ const struct font_desc font_mini_4x6 = {
+ 	.idx	= MINI4x6_IDX,
+ 	.name	= "MINI4x6",
+ 	.width	= 4,
+ 	.height	= 6,
+-	.data	= fontdata_mini_4x6,
++	.data	= fontdata_mini_4x6.data,
+ 	.pref	= 3,
+ };
+ 
+diff --git a/lib/fonts/font_pearl_8x8.c b/lib/fonts/font_pearl_8x8.c
+index b15d3c342c5bb..32d65551e7ed2 100644
+--- a/lib/fonts/font_pearl_8x8.c
++++ b/lib/fonts/font_pearl_8x8.c
+@@ -14,8 +14,8 @@
+ 
+ #define FONTDATAMAX 2048
+ 
+-static const unsigned char fontdata_pearl8x8[FONTDATAMAX] = {
+-
++static struct font_data fontdata_pearl8x8 = {
++   { 0, 0, FONTDATAMAX, 0 }, {
+    /* 0 0x00 '^@' */
+    0x00, /* 00000000 */
+    0x00, /* 00000000 */
+@@ -2575,14 +2575,13 @@ static const unsigned char fontdata_pearl8x8[FONTDATAMAX] = {
+    0x00, /* 00000000 */
+    0x00, /* 00000000 */
+    0x00, /* 00000000 */
+-
+-};
++} };
+ 
+ const struct font_desc font_pearl_8x8 = {
+ 	.idx	= PEARL8x8_IDX,
+ 	.name	= "PEARL8x8",
+ 	.width	= 8,
+ 	.height	= 8,
+-	.data	= fontdata_pearl8x8,
++	.data	= fontdata_pearl8x8.data,
+ 	.pref	= 2,
+ };
+diff --git a/lib/fonts/font_sun12x22.c b/lib/fonts/font_sun12x22.c
+index 955d6eee3959d..641a6b4dca424 100644
+--- a/lib/fonts/font_sun12x22.c
++++ b/lib/fonts/font_sun12x22.c
+@@ -3,8 +3,8 @@
+ 
+ #define FONTDATAMAX 11264
+ 
+-static const unsigned char fontdata_sun12x22[FONTDATAMAX] = {
+-
++static struct font_data fontdata_sun12x22 = {
++	{ 0, 0, FONTDATAMAX, 0 }, {
+ 	/* 0 0x00 '^@' */
+ 	0x00, 0x00, /* 000000000000 */
+ 	0x00, 0x00, /* 000000000000 */
+@@ -6148,8 +6148,7 @@ static const unsigned char fontdata_sun12x22[FONTDATAMAX] = {
+ 	0x00, 0x00, /* 000000000000 */
+ 	0x00, 0x00, /* 000000000000 */
+ 	0x00, 0x00, /* 000000000000 */
+-
+-};
++} };
+ 
+ 
+ const struct font_desc font_sun_12x22 = {
+@@ -6157,7 +6156,7 @@ const struct font_desc font_sun_12x22 = {
+ 	.name	= "SUN12x22",
+ 	.width	= 12,
+ 	.height	= 22,
+-	.data	= fontdata_sun12x22,
++	.data	= fontdata_sun12x22.data,
+ #ifdef __sparc__
+ 	.pref	= 5,
+ #else
+diff --git a/lib/fonts/font_sun8x16.c b/lib/fonts/font_sun8x16.c
+index 03d71e53954ab..193fe6d988e08 100644
+--- a/lib/fonts/font_sun8x16.c
++++ b/lib/fonts/font_sun8x16.c
+@@ -3,7 +3,8 @@
+ 
+ #define FONTDATAMAX 4096
+ 
+-static const unsigned char fontdata_sun8x16[FONTDATAMAX] = {
++static struct font_data fontdata_sun8x16 = {
++{ 0, 0, FONTDATAMAX, 0 }, {
+ /* */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+ /* */ 0x00,0x00,0x7e,0x81,0xa5,0x81,0x81,0xbd,0x99,0x81,0x81,0x7e,0x00,0x00,0x00,0x00,
+ /* */ 0x00,0x00,0x7e,0xff,0xdb,0xff,0xff,0xc3,0xe7,0xff,0xff,0x7e,0x00,0x00,0x00,0x00,
+@@ -260,14 +261,14 @@ static const unsigned char fontdata_sun8x16[FONTDATAMAX] = {
+ /* */ 0x00,0x70,0xd8,0x30,0x60,0xc8,0xf8,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+ /* */ 0x00,0x00,0x00,0x00,0x7c,0x7c,0x7c,0x7c,0x7c,0x7c,0x7c,0x00,0x00,0x00,0x00,0x00,
+ /* */ 0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,
+-};
++} };
+ 
+ const struct font_desc font_sun_8x16 = {
+ 	.idx	= SUN8x16_IDX,
+ 	.name	= "SUN8x16",
+ 	.width	= 8,
+ 	.height	= 16,
+-	.data	= fontdata_sun8x16,
++	.data	= fontdata_sun8x16.data,
+ #ifdef __sparc__
+ 	.pref	= 10,
+ #else
+diff --git a/mm/khugepaged.c b/mm/khugepaged.c
+index f37be43f8caeb..9c7dc2276156b 100644
+--- a/mm/khugepaged.c
++++ b/mm/khugepaged.c
+@@ -53,6 +53,9 @@ enum scan_result {
+ #define CREATE_TRACE_POINTS
+ #include <trace/events/huge_memory.h>
+ 
++static struct task_struct *khugepaged_thread __read_mostly;
++static DEFINE_MUTEX(khugepaged_mutex);
++
+ /* default scan 8*512 pte (or vmas) every 30 second */
+ static unsigned int khugepaged_pages_to_scan __read_mostly;
+ static unsigned int khugepaged_pages_collapsed;
+@@ -820,6 +823,18 @@ static struct page *khugepaged_alloc_hugepage(bool *wait)
+ 
+ static bool khugepaged_prealloc_page(struct page **hpage, bool *wait)
+ {
++	/*
++	 * If the hpage allocated earlier was briefly exposed in page cache
++	 * before collapse_file() failed, it is possible that racing lookups
++	 * have not yet completed, and would then be unpleasantly surprised by
++	 * finding the hpage reused for the same mapping at a different offset.
++	 * Just release the previous allocation if there is any danger of that.
++	 */
++	if (*hpage && page_count(*hpage) > 1) {
++		put_page(*hpage);
++		*hpage = NULL;
++	}
++
+ 	if (!*hpage)
+ 		*hpage = khugepaged_alloc_hugepage(wait);
+ 
+@@ -1940,8 +1955,6 @@ static void set_recommended_min_free_kbytes(void)
+ 
+ int start_stop_khugepaged(void)
+ {
+-	static struct task_struct *khugepaged_thread __read_mostly;
+-	static DEFINE_MUTEX(khugepaged_mutex);
+ 	int err = 0;
+ 
+ 	mutex_lock(&khugepaged_mutex);
+@@ -1968,3 +1981,11 @@ fail:
+ 	mutex_unlock(&khugepaged_mutex);
+ 	return err;
+ }
++
++void khugepaged_min_free_kbytes_update(void)
++{
++	mutex_lock(&khugepaged_mutex);
++	if (khugepaged_enabled() && khugepaged_thread)
++		set_recommended_min_free_kbytes();
++	mutex_unlock(&khugepaged_mutex);
++}
+diff --git a/mm/page_alloc.c b/mm/page_alloc.c
+index 545800433dfba..4325e7d581155 100644
+--- a/mm/page_alloc.c
++++ b/mm/page_alloc.c
+@@ -66,6 +66,7 @@
+ #include <linux/ftrace.h>
+ #include <linux/lockdep.h>
+ #include <linux/nmi.h>
++#include <linux/khugepaged.h>
+ 
+ #include <asm/sections.h>
+ #include <asm/tlbflush.h>
+@@ -7399,6 +7400,8 @@ int __meminit init_per_zone_wmark_min(void)
+ 	setup_min_slab_ratio();
+ #endif
+ 
++	khugepaged_min_free_kbytes_update();
++
+ 	return 0;
+ }
+ postcore_initcall(init_per_zone_wmark_min)
+diff --git a/net/openvswitch/conntrack.c b/net/openvswitch/conntrack.c
+index f8e073ef1a671..fb13fcfedaf4f 100644
+--- a/net/openvswitch/conntrack.c
++++ b/net/openvswitch/conntrack.c
+@@ -899,15 +899,19 @@ static int ovs_ct_nat(struct net *net, struct sw_flow_key *key,
+ 	}
+ 	err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range, maniptype);
+ 
+-	if (err == NF_ACCEPT &&
+-	    ct->status & IPS_SRC_NAT && ct->status & IPS_DST_NAT) {
+-		if (maniptype == NF_NAT_MANIP_SRC)
+-			maniptype = NF_NAT_MANIP_DST;
+-		else
+-			maniptype = NF_NAT_MANIP_SRC;
+-
+-		err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range,
+-					 maniptype);
++	if (err == NF_ACCEPT && ct->status & IPS_DST_NAT) {
++		if (ct->status & IPS_SRC_NAT) {
++			if (maniptype == NF_NAT_MANIP_SRC)
++				maniptype = NF_NAT_MANIP_DST;
++			else
++				maniptype = NF_NAT_MANIP_SRC;
++
++			err = ovs_ct_nat_execute(skb, ct, ctinfo, &info->range,
++						 maniptype);
++		} else if (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL) {
++			err = ovs_ct_nat_execute(skb, ct, ctinfo, NULL,
++						 NF_NAT_MANIP_SRC);
++		}
+ 	}
+ 
+ 	/* Mark NAT done if successful and update the flow key. */
+diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c
+index 126154a97a592..04213afd7710f 100644
+--- a/net/rxrpc/conn_event.c
++++ b/net/rxrpc/conn_event.c
+@@ -342,18 +342,18 @@ static int rxrpc_process_event(struct rxrpc_connection *conn,
+ 			return ret;
+ 
+ 		spin_lock(&conn->channel_lock);
+-		spin_lock(&conn->state_lock);
++		spin_lock_bh(&conn->state_lock);
+ 
+ 		if (conn->state == RXRPC_CONN_SERVICE_CHALLENGING) {
+ 			conn->state = RXRPC_CONN_SERVICE;
+-			spin_unlock(&conn->state_lock);
++			spin_unlock_bh(&conn->state_lock);
+ 			for (loop = 0; loop < RXRPC_MAXCALLS; loop++)
+ 				rxrpc_call_is_secure(
+ 					rcu_dereference_protected(
+ 						conn->channels[loop].call,
+ 						lockdep_is_held(&conn->channel_lock)));
+ 		} else {
+-			spin_unlock(&conn->state_lock);
++			spin_unlock_bh(&conn->state_lock);
+ 		}
+ 
+ 		spin_unlock(&conn->channel_lock);
+diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c
+index ad9d1b21cb0ba..2fe2add62a8ed 100644
+--- a/net/rxrpc/key.c
++++ b/net/rxrpc/key.c
+@@ -905,7 +905,7 @@ int rxrpc_request_key(struct rxrpc_sock *rx, char __user *optval, int optlen)
+ 
+ 	_enter("");
+ 
+-	if (optlen <= 0 || optlen > PAGE_SIZE - 1)
++	if (optlen <= 0 || optlen > PAGE_SIZE - 1 || rx->securities)
+ 		return -EINVAL;
+ 
+ 	description = memdup_user_nul(optval, optlen);
+@@ -1075,7 +1075,7 @@ static long rxrpc_read(const struct key *key,
+ 
+ 		switch (token->security_index) {
+ 		case RXRPC_SECURITY_RXKAD:
+-			toksize += 9 * 4;	/* viceid, kvno, key*2 + len, begin,
++			toksize += 8 * 4;	/* viceid, kvno, key*2, begin,
+ 						 * end, primary, tktlen */
+ 			toksize += RND(token->kad->ticket_len);
+ 			break;
+@@ -1110,7 +1110,8 @@ static long rxrpc_read(const struct key *key,
+ 			break;
+ 
+ 		default: /* we have a ticket we can't encode */
+-			BUG();
++			pr_err("Unsupported key token type (%u)\n",
++			       token->security_index);
+ 			continue;
+ 		}
+ 
+@@ -1141,6 +1142,14 @@ static long rxrpc_read(const struct key *key,
+ 			memcpy((u8 *)xdr + _l, &zero, 4 - (_l & 3));	\
+ 		xdr += (_l + 3) >> 2;					\
+ 	} while(0)
++#define ENCODE_BYTES(l, s)						\
++	do {								\
++		u32 _l = (l);						\
++		memcpy(xdr, (s), _l);					\
++		if (_l & 3)						\
++			memcpy((u8 *)xdr + _l, &zero, 4 - (_l & 3));	\
++		xdr += (_l + 3) >> 2;					\
++	} while(0)
+ #define ENCODE64(x)					\
+ 	do {						\
+ 		__be64 y = cpu_to_be64(x);		\
+@@ -1168,7 +1177,7 @@ static long rxrpc_read(const struct key *key,
+ 		case RXRPC_SECURITY_RXKAD:
+ 			ENCODE(token->kad->vice_id);
+ 			ENCODE(token->kad->kvno);
+-			ENCODE_DATA(8, token->kad->session_key);
++			ENCODE_BYTES(8, token->kad->session_key);
+ 			ENCODE(token->kad->start);
+ 			ENCODE(token->kad->expiry);
+ 			ENCODE(token->kad->primary_flag);
+@@ -1218,7 +1227,6 @@ static long rxrpc_read(const struct key *key,
+ 			break;
+ 
+ 		default:
+-			BUG();
+ 			break;
+ 		}
+ 
+diff --git a/net/sctp/auth.c b/net/sctp/auth.c
+index 5b537613946fc..2bd8c80bd85fb 100644
+--- a/net/sctp/auth.c
++++ b/net/sctp/auth.c
+@@ -515,6 +515,7 @@ int sctp_auth_init_hmacs(struct sctp_endpoint *ep, gfp_t gfp)
+ out_err:
+ 	/* Clean up any successful allocations */
+ 	sctp_auth_destroy_hmacs(ep->auth_hmacs);
++	ep->auth_hmacs = NULL;
+ 	return -ENOMEM;
+ }
+ 
+diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
+index 996b68b48a878..4e41792099822 100644
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -3621,6 +3621,9 @@ static int nl80211_del_key(struct sk_buff *skb, struct genl_info *info)
+ 	if (err)
+ 		return err;
+ 
++	if (key.idx < 0)
++		return -EINVAL;
++
+ 	if (info->attrs[NL80211_ATTR_MAC])
+ 		mac_addr = nla_data(info->attrs[NL80211_ATTR_MAC]);
+ 
+diff --git a/net/xfrm/xfrm_interface.c b/net/xfrm/xfrm_interface.c
+index 6f00f88adab90..6cc9f6e2dd2b7 100644
+--- a/net/xfrm/xfrm_interface.c
++++ b/net/xfrm/xfrm_interface.c
+@@ -293,7 +293,7 @@ xfrmi_xmit2(struct sk_buff *skb, struct net_device *dev, struct flowi *fl)
+ 	}
+ 
+ 	mtu = dst_mtu(dst);
+-	if (!skb->ignore_df && skb->len > mtu) {
++	if (skb->len > mtu) {
+ 		skb_dst_update_pmtu_no_confirm(skb, mtu);
+ 
+ 		if (skb->protocol == htons(ETH_P_IPV6)) {
+diff --git a/net/xfrm/xfrm_state.c b/net/xfrm/xfrm_state.c
+index 47a8ff972a2bf..a649d7c2f48ca 100644
+--- a/net/xfrm/xfrm_state.c
++++ b/net/xfrm/xfrm_state.c
+@@ -923,7 +923,8 @@ static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x,
+ 	 */
+ 	if (x->km.state == XFRM_STATE_VALID) {
+ 		if ((x->sel.family &&
+-		     !xfrm_selector_match(&x->sel, fl, x->sel.family)) ||
++		     (x->sel.family != family ||
++		      !xfrm_selector_match(&x->sel, fl, family))) ||
+ 		    !security_xfrm_state_pol_flow_match(x, pol, fl))
+ 			return;
+ 
+@@ -936,7 +937,9 @@ static void xfrm_state_look_at(struct xfrm_policy *pol, struct xfrm_state *x,
+ 		*acq_in_progress = 1;
+ 	} else if (x->km.state == XFRM_STATE_ERROR ||
+ 		   x->km.state == XFRM_STATE_EXPIRED) {
+-		if (xfrm_selector_match(&x->sel, fl, x->sel.family) &&
++		if ((!x->sel.family ||
++		     (x->sel.family == family &&
++		      xfrm_selector_match(&x->sel, fl, family))) &&
+ 		    security_xfrm_state_pol_flow_match(x, pol, fl))
+ 			*error = -ESRCH;
+ 	}
+@@ -976,7 +979,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
+ 		    tmpl->mode == x->props.mode &&
+ 		    tmpl->id.proto == x->id.proto &&
+ 		    (tmpl->id.spi == x->id.spi || !tmpl->id.spi))
+-			xfrm_state_look_at(pol, x, fl, encap_family,
++			xfrm_state_look_at(pol, x, fl, family,
+ 					   &best, &acquire_in_progress, &error);
+ 	}
+ 	if (best || acquire_in_progress)
+@@ -993,7 +996,7 @@ xfrm_state_find(const xfrm_address_t *daddr, const xfrm_address_t *saddr,
+ 		    tmpl->mode == x->props.mode &&
+ 		    tmpl->id.proto == x->id.proto &&
+ 		    (tmpl->id.spi == x->id.spi || !tmpl->id.spi))
+-			xfrm_state_look_at(pol, x, fl, encap_family,
++			xfrm_state_look_at(pol, x, fl, family,
+ 					   &best, &acquire_in_progress, &error);
+ 	}
+ 
+@@ -1341,6 +1344,30 @@ out:
+ EXPORT_SYMBOL(xfrm_state_add);
+ 
+ #ifdef CONFIG_XFRM_MIGRATE
++static inline int clone_security(struct xfrm_state *x, struct xfrm_sec_ctx *security)
++{
++	struct xfrm_user_sec_ctx *uctx;
++	int size = sizeof(*uctx) + security->ctx_len;
++	int err;
++
++	uctx = kmalloc(size, GFP_KERNEL);
++	if (!uctx)
++		return -ENOMEM;
++
++	uctx->exttype = XFRMA_SEC_CTX;
++	uctx->len = size;
++	uctx->ctx_doi = security->ctx_doi;
++	uctx->ctx_alg = security->ctx_alg;
++	uctx->ctx_len = security->ctx_len;
++	memcpy(uctx + 1, security->ctx_str, security->ctx_len);
++	err = security_xfrm_state_alloc(x, uctx);
++	kfree(uctx);
++	if (err)
++		return err;
++
++	return 0;
++}
++
+ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig,
+ 					   struct xfrm_encap_tmpl *encap)
+ {
+@@ -1397,6 +1424,10 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig,
+ 			goto error;
+ 	}
+ 
++	if (orig->security)
++		if (clone_security(x, orig->security))
++			goto error;
++
+ 	if (orig->coaddr) {
+ 		x->coaddr = kmemdup(orig->coaddr, sizeof(*x->coaddr),
+ 				    GFP_KERNEL);
+@@ -1410,6 +1441,7 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig,
+ 	}
+ 
+ 	memcpy(&x->mark, &orig->mark, sizeof(x->mark));
++	memcpy(&x->props.smark, &orig->props.smark, sizeof(x->props.smark));
+ 
+ 	if (xfrm_init_state(x) < 0)
+ 		goto error;
+@@ -1421,7 +1453,7 @@ static struct xfrm_state *xfrm_state_clone(struct xfrm_state *orig,
+ 	x->tfcpad = orig->tfcpad;
+ 	x->replay_maxdiff = orig->replay_maxdiff;
+ 	x->replay_maxage = orig->replay_maxage;
+-	x->curlft.add_time = orig->curlft.add_time;
++	memcpy(&x->curlft, &orig->curlft, sizeof(x->curlft));
+ 	x->km.state = orig->km.state;
+ 	x->km.seq = orig->km.seq;
+ 	x->replay = orig->replay;
+diff --git a/tools/perf/builtin-top.c b/tools/perf/builtin-top.c
+index d0733251a386e..9caab84c6294d 100644
+--- a/tools/perf/builtin-top.c
++++ b/tools/perf/builtin-top.c
+@@ -651,7 +651,9 @@ repeat:
+ 	delay_msecs = top->delay_secs * MSEC_PER_SEC;
+ 	set_term_quiet_input(&save);
+ 	/* trash return*/
+-	getc(stdin);
++	clearerr(stdin);
++	if (poll(&stdin_poll, 1, 0) > 0)
++		getc(stdin);
+ 
+ 	while (!done) {
+ 		perf_top__print_sym_table(top);