Merge branch 'android-4.9' of https://android.googlesource.com/kernel/common into ti-android-linux-4.9.y

TI-Feature: google_android
TI-Tree: https://android.googlesource.com/kernel/common
TI-Branch: android-4.9

* 'android-4.9' of https://android.googlesource.com/kernel/common: (84 commits)
  Linux 4.9.29
  pstore: Shut down worker when unregistering
  pstore: Fix flags to enable dumps on powerpc
  libnvdimm, pfn: fix 'npfns' vs section alignment
  libnvdimm, pmem: fix a NULL pointer BUG in nd_pmem_notify
  libnvdimm, region: fix flush hint detection crash
  ipmi: Fix kernel panic at ipmi_ssif_thread()
  Bluetooth: hci_intel: add missing tty-device sanity check
  Bluetooth: hci_bcm: add missing tty-device sanity check
  Bluetooth: Fix user channel for 32bit userspace on 64bit kernel
  tty: pty: Fix ldisc flush after userspace become aware of the data already
  serial: omap: suspend device on probe errors
  serial: omap: fix runtime-pm handling on unbind
  serial: samsung: Use right device for DMA-mapping calls
  fscrypt: fix context consistency check when key(s) unavailable
  device-dax: fix cdev leak
  padata: free correct variable
  CIFS: add misssing SFM mapping for doublequote
  cifs: fix CIFS_IOC_GET_MNT_INFO oops
  CIFS: fix oplock break deadlocks
  ...

Signed-off-by: LCPD Auto Merger <lcpd_integration@list.ti.com>

97 files changed, 1113 insertions, 583 deletions

diff --git a/Makefile b/Makefile
index 9460a63087b8..c12e501a18b8 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 9
-SUBLEVEL = 28
+SUBLEVEL = 29
 EXTRAVERSION =
 NAME = Roaring Lionus
 
diff --git a/arch/arm/kvm/psci.c b/arch/arm/kvm/psci.c
index c2b131527a64..a08d7a93aebb 100644
--- a/arch/arm/kvm/psci.c
+++ b/arch/arm/kvm/psci.c
@@ -208,9 +208,10 @@ int kvm_psci_version(struct kvm_vcpu *vcpu)
 
 static int kvm_psci_0_2_call(struct kvm_vcpu *vcpu)
 {
-        int ret = 1;
+        struct kvm *kvm = vcpu->kvm;
         unsigned long psci_fn = vcpu_get_reg(vcpu, 0) & ~((u32) 0);
         unsigned long val;
+        int ret = 1;
 
         switch (psci_fn) {
         case PSCI_0_2_FN_PSCI_VERSION:
@@ -230,7 +231,9 @@ static int kvm_psci_0_2_call(struct kvm_vcpu *vcpu)
                 break;
         case PSCI_0_2_FN_CPU_ON:
         case PSCI_0_2_FN64_CPU_ON:
+                mutex_lock(&kvm->lock);
                 val = kvm_psci_vcpu_on(vcpu);
+                mutex_unlock(&kvm->lock);
                 break;
         case PSCI_0_2_FN_AFFINITY_INFO:
         case PSCI_0_2_FN64_AFFINITY_INFO:
@@ -279,6 +282,7 @@ static int kvm_psci_0_2_call(struct kvm_vcpu *vcpu)
 
 static int kvm_psci_0_1_call(struct kvm_vcpu *vcpu)
 {
+        struct kvm *kvm = vcpu->kvm;
         unsigned long psci_fn = vcpu_get_reg(vcpu, 0) & ~((u32) 0);
         unsigned long val;
 
@@ -288,7 +292,9 @@ static int kvm_psci_0_1_call(struct kvm_vcpu *vcpu)
                 val = PSCI_RET_SUCCESS;
                 break;
         case KVM_PSCI_FN_CPU_ON:
+                mutex_lock(&kvm->lock);
                 val = kvm_psci_vcpu_on(vcpu);
+                mutex_unlock(&kvm->lock);
                 break;
         default:
                 val = PSCI_RET_NOT_SUPPORTED;
diff --git a/arch/arm64/include/asm/kvm_emulate.h b/arch/arm64/include/asm/kvm_emulate.h
index f5ea0ba70f07..fe39e6841326 100644
--- a/arch/arm64/include/asm/kvm_emulate.h
+++ b/arch/arm64/include/asm/kvm_emulate.h
@@ -240,6 +240,12 @@ static inline u8 kvm_vcpu_trap_get_fault_type(const struct kvm_vcpu *vcpu)
         return kvm_vcpu_get_hsr(vcpu) & ESR_ELx_FSC_TYPE;
 }
 
+static inline int kvm_vcpu_sys_get_rt(struct kvm_vcpu *vcpu)
+{
+        u32 esr = kvm_vcpu_get_hsr(vcpu);
+        return (esr & ESR_ELx_SYS64_ISS_RT_MASK) >> ESR_ELx_SYS64_ISS_RT_SHIFT;
+}
+
 static inline unsigned long kvm_vcpu_get_mpidr_aff(struct kvm_vcpu *vcpu)
 {
         return vcpu_sys_reg(vcpu, MPIDR_EL1) & MPIDR_HWID_BITMASK;
diff --git a/arch/arm64/kvm/sys_regs.c b/arch/arm64/kvm/sys_regs.c
index 87e7e6608cd8..7cee552ce0bf 100644
--- a/arch/arm64/kvm/sys_regs.c
+++ b/arch/arm64/kvm/sys_regs.c
@@ -1573,8 +1573,8 @@ static int kvm_handle_cp_64(struct kvm_vcpu *vcpu,
 {
         struct sys_reg_params params;
         u32 hsr = kvm_vcpu_get_hsr(vcpu);
-        int Rt = (hsr >> 5) & 0xf;
-        int Rt2 = (hsr >> 10) & 0xf;
+        int Rt = kvm_vcpu_sys_get_rt(vcpu);
+        int Rt2 = (hsr >> 10) & 0x1f;
 
         params.is_aarch32 = true;
         params.is_32bit = false;
@@ -1625,7 +1625,7 @@ static int kvm_handle_cp_32(struct kvm_vcpu *vcpu,
 {
         struct sys_reg_params params;
         u32 hsr = kvm_vcpu_get_hsr(vcpu);
-        int Rt  = (hsr >> 5) & 0xf;
+        int Rt  = kvm_vcpu_sys_get_rt(vcpu);
 
         params.is_aarch32 = true;
         params.is_32bit = true;
@@ -1740,7 +1740,7 @@ int kvm_handle_sys_reg(struct kvm_vcpu *vcpu, struct kvm_run *run)
 {
         struct sys_reg_params params;
         unsigned long esr = kvm_vcpu_get_hsr(vcpu);
-        int Rt = (esr >> 5) & 0x1f;
+        int Rt = kvm_vcpu_sys_get_rt(vcpu);
         int ret;
 
         trace_kvm_handle_sys_reg(esr);
diff --git a/arch/powerpc/kernel/nvram_64.c b/arch/powerpc/kernel/nvram_64.c
index 34d2c595de23..73622673eee3 100644
--- a/arch/powerpc/kernel/nvram_64.c
+++ b/arch/powerpc/kernel/nvram_64.c
@@ -561,6 +561,7 @@ static ssize_t nvram_pstore_read(u64 *id, enum pstore_type_id *type,
 static struct pstore_info nvram_pstore_info = {
         .owner = THIS_MODULE,
         .name = "nvram",
+        .flags = PSTORE_FLAGS_DMESG,
         .open = nvram_pstore_open,
         .read = nvram_pstore_read,
         .write = nvram_pstore_write,
diff --git a/arch/x86/boot/boot.h b/arch/x86/boot/boot.h
index e5612f3e3b57..d7ac721a8a96 100644
--- a/arch/x86/boot/boot.h
+++ b/arch/x86/boot/boot.h
@@ -16,7 +16,7 @@
 #ifndef BOOT_BOOT_H
 #define BOOT_BOOT_H
 
-#define STACK_SIZE      512     /* Minimum number of bytes for stack */
+#define STACK_SIZE      1024    /* Minimum number of bytes for stack */
 
 #ifndef __ASSEMBLY__
 
diff --git a/arch/x86/events/intel/rapl.c b/arch/x86/events/intel/rapl.c
index 0a535cea8ff3..8b902b67342a 100644
--- a/arch/x86/events/intel/rapl.c
+++ b/arch/x86/events/intel/rapl.c
@@ -759,7 +759,7 @@ static const struct x86_cpu_id rapl_cpu_match[] __initconst = {
 
         X86_RAPL_MODEL_MATCH(INTEL_FAM6_BROADWELL_CORE,   hsw_rapl_init),
         X86_RAPL_MODEL_MATCH(INTEL_FAM6_BROADWELL_GT3E,   hsw_rapl_init),
-        X86_RAPL_MODEL_MATCH(INTEL_FAM6_BROADWELL_X,      hsw_rapl_init),
+        X86_RAPL_MODEL_MATCH(INTEL_FAM6_BROADWELL_X,      hsx_rapl_init),
         X86_RAPL_MODEL_MATCH(INTEL_FAM6_BROADWELL_XEON_D, hsw_rapl_init),
 
         X86_RAPL_MODEL_MATCH(INTEL_FAM6_XEON_PHI_KNL, knl_rapl_init),
diff --git a/arch/x86/include/asm/pmem.h b/arch/x86/include/asm/pmem.h
index 529bb4a6487a..e2904373010d 100644
--- a/arch/x86/include/asm/pmem.h
+++ b/arch/x86/include/asm/pmem.h
@@ -103,7 +103,7 @@ static inline size_t arch_copy_from_iter_pmem(void *addr, size_t bytes,
 
                 if (bytes < 8) {
                         if (!IS_ALIGNED(dest, 4) || (bytes != 4))
-                                arch_wb_cache_pmem(addr, 1);
+                                arch_wb_cache_pmem(addr, bytes);
                 } else {
                         if (!IS_ALIGNED(dest, 8)) {
                                 dest = ALIGN(dest, boot_cpu_data.x86_clflush_size);
diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index e5bc139d1ba7..43c152853969 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -3051,6 +3051,12 @@ static int kvm_vcpu_ioctl_x86_set_vcpu_events(struct kvm_vcpu *vcpu,
             (events->exception.nr > 31 || events->exception.nr == NMI_VECTOR))
                 return -EINVAL;
 
+        /* INITs are latched while in SMM */
+        if (events->flags & KVM_VCPUEVENT_VALID_SMM &&
+            (events->smi.smm || events->smi.pending) &&
+            vcpu->arch.mp_state == KVM_MP_STATE_INIT_RECEIVED)
+                return -EINVAL;
+
         process_nmi(vcpu);
         vcpu->arch.exception.pending = events->exception.injected;
         vcpu->arch.exception.nr = events->exception.nr;
@@ -7162,6 +7168,12 @@ int kvm_arch_vcpu_ioctl_set_mpstate(struct kvm_vcpu *vcpu,
             mp_state->mp_state != KVM_MP_STATE_RUNNABLE)
                 return -EINVAL;
 
+        /* INITs are latched while in SMM */
+        if ((is_smm(vcpu) || vcpu->arch.smi_pending) &&
+            (mp_state->mp_state == KVM_MP_STATE_SIPI_RECEIVED ||
+             mp_state->mp_state == KVM_MP_STATE_INIT_RECEIVED))
+                return -EINVAL;
+
         if (mp_state->mp_state == KVM_MP_STATE_SIPI_RECEIVED) {
                 vcpu->arch.mp_state = KVM_MP_STATE_INIT_RECEIVED;
                 set_bit(KVM_APIC_SIPI, &vcpu->arch.apic->pending_events);
diff --git a/arch/x86/um/ptrace_64.c b/arch/x86/um/ptrace_64.c
index e30202b1716e..7c1601798169 100644
--- a/arch/x86/um/ptrace_64.c
+++ b/arch/x86/um/ptrace_64.c
@@ -125,7 +125,7 @@ int poke_user(struct task_struct *child, long addr, long data)
         else if ((addr >= offsetof(struct user, u_debugreg[0])) &&
                 (addr <= offsetof(struct user, u_debugreg[7]))) {
                 addr -= offsetof(struct user, u_debugreg[0]);
-                addr = addr >> 2;
+                addr = addr >> 3;
                 if ((addr == 4) || (addr == 5))
                         return -EIO;
                 child->thread.arch.debugregs[addr] = data;
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index 7d5afdb417cc..418f1b8576cf 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -2028,7 +2028,8 @@ static unsigned long __init xen_read_phys_ulong(phys_addr_t addr)
 
 /*
  * Translate a virtual address to a physical one without relying on mapped
- * page tables.
+ * page tables. Don't rely on big pages being aligned in (guest) physical
+ * space!
  */
 static phys_addr_t __init xen_early_virt_to_phys(unsigned long vaddr)
 {
@@ -2049,7 +2050,7 @@ static phys_addr_t __init xen_early_virt_to_phys(unsigned long vaddr)
                                                        sizeof(pud)));
         if (!pud_present(pud))
                 return 0;
-        pa = pud_pfn(pud) << PAGE_SHIFT;
+        pa = pud_val(pud) & PTE_PFN_MASK;
         if (pud_large(pud))
                 return pa + (vaddr & ~PUD_MASK);
 
@@ -2057,7 +2058,7 @@ static phys_addr_t __init xen_early_virt_to_phys(unsigned long vaddr)
                                                        sizeof(pmd)));
         if (!pmd_present(pmd))
                 return 0;
-        pa = pmd_pfn(pmd) << PAGE_SHIFT;
+        pa = pmd_val(pmd) & PTE_PFN_MASK;
         if (pmd_large(pmd))
                 return pa + (vaddr & ~PMD_MASK);
 
diff --git a/block/blk-integrity.c b/block/blk-integrity.c
index 319f2e4f4a8b..478f572cb1e7 100644
--- a/block/blk-integrity.c
+++ b/block/blk-integrity.c
@@ -412,7 +412,8 @@ void blk_integrity_register(struct gendisk *disk, struct blk_integrity *template
 
         bi->flags = BLK_INTEGRITY_VERIFY | BLK_INTEGRITY_GENERATE |
                 template->flags;
-        bi->interval_exp = ilog2(queue_logical_block_size(disk->queue));
+        bi->interval_exp = template->interval_exp ? :
+                ilog2(queue_logical_block_size(disk->queue));
         bi->profile = template->profile ? template->profile : &nop_profile;
         bi->tuple_size = template->tuple_size;
         bi->tag_size = template->tag_size;
diff --git a/crypto/algif_aead.c b/crypto/algif_aead.c
index fde8d885f7b6..6c11537ca404 100644
--- a/crypto/algif_aead.c
+++ b/crypto/algif_aead.c
@@ -44,6 +44,11 @@ struct aead_async_req {
         char iv[];
 };
 
+struct aead_tfm {
+        struct crypto_aead *aead;
+        bool has_key;
+};
+
 struct aead_ctx {
         struct aead_sg_list tsgl;
         struct aead_async_rsgl first_rsgl;
@@ -732,24 +737,146 @@ static struct proto_ops algif_aead_ops = {
         .poll           =       aead_poll,
 };
 
+static int aead_check_key(struct socket *sock)
+{
+        int err = 0;
+        struct sock *psk;
+        struct alg_sock *pask;
+        struct aead_tfm *tfm;
+        struct sock *sk = sock->sk;
+        struct alg_sock *ask = alg_sk(sk);
+
+        lock_sock(sk);
+        if (ask->refcnt)
+                goto unlock_child;
+
+        psk = ask->parent;
+        pask = alg_sk(ask->parent);
+        tfm = pask->private;
+
+        err = -ENOKEY;
+        lock_sock_nested(psk, SINGLE_DEPTH_NESTING);
+        if (!tfm->has_key)
+                goto unlock;
+
+        if (!pask->refcnt++)
+                sock_hold(psk);
+
+        ask->refcnt = 1;
+        sock_put(psk);
+
+        err = 0;
+
+unlock:
+        release_sock(psk);
+unlock_child:
+        release_sock(sk);
+
+        return err;
+}
+
+static int aead_sendmsg_nokey(struct socket *sock, struct msghdr *msg,
+                                  size_t size)
+{
+        int err;
+
+        err = aead_check_key(sock);
+        if (err)
+                return err;
+
+        return aead_sendmsg(sock, msg, size);
+}
+
+static ssize_t aead_sendpage_nokey(struct socket *sock, struct page *page,
+                                       int offset, size_t size, int flags)
+{
+        int err;
+
+        err = aead_check_key(sock);
+        if (err)
+                return err;
+
+        return aead_sendpage(sock, page, offset, size, flags);
+}
+
+static int aead_recvmsg_nokey(struct socket *sock, struct msghdr *msg,
+                                  size_t ignored, int flags)
+{
+        int err;
+
+        err = aead_check_key(sock);
+        if (err)
+                return err;
+
+        return aead_recvmsg(sock, msg, ignored, flags);
+}
+
+static struct proto_ops algif_aead_ops_nokey = {
+        .family         =       PF_ALG,
+
+        .connect        =       sock_no_connect,
+        .socketpair     =       sock_no_socketpair,
+        .getname        =       sock_no_getname,
+        .ioctl          =       sock_no_ioctl,
+        .listen         =       sock_no_listen,
+        .shutdown       =       sock_no_shutdown,
+        .getsockopt     =       sock_no_getsockopt,
+        .mmap           =       sock_no_mmap,
+        .bind           =       sock_no_bind,
+        .accept         =       sock_no_accept,
+        .setsockopt     =       sock_no_setsockopt,
+
+        .release        =       af_alg_release,
+        .sendmsg        =       aead_sendmsg_nokey,
+        .sendpage       =       aead_sendpage_nokey,
+        .recvmsg        =       aead_recvmsg_nokey,
+        .poll           =       aead_poll,
+};
+
 static void *aead_bind(const char *name, u32 type, u32 mask)
 {
-        return crypto_alloc_aead(name, type, mask);
+        struct aead_tfm *tfm;
+        struct crypto_aead *aead;
+
+        tfm = kzalloc(sizeof(*tfm), GFP_KERNEL);
+        if (!tfm)
+                return ERR_PTR(-ENOMEM);
+
+        aead = crypto_alloc_aead(name, type, mask);
+        if (IS_ERR(aead)) {
+                kfree(tfm);
+                return ERR_CAST(aead);
+        }
+
+        tfm->aead = aead;
+
+        return tfm;
 }
 
 static void aead_release(void *private)
 {
-        crypto_free_aead(private);
+        struct aead_tfm *tfm = private;
+
+        crypto_free_aead(tfm->aead);
+        kfree(tfm);
 }
 
 static int aead_setauthsize(void *private, unsigned int authsize)
 {
-        return crypto_aead_setauthsize(private, authsize);
+        struct aead_tfm *tfm = private;
+
+        return crypto_aead_setauthsize(tfm->aead, authsize);
 }
 
 static int aead_setkey(void *private, const u8 *key, unsigned int keylen)
 {
-        return crypto_aead_setkey(private, key, keylen);
+        struct aead_tfm *tfm = private;
+        int err;
+
+        err = crypto_aead_setkey(tfm->aead, key, keylen);
+        tfm->has_key = !err;
+
+        return err;
 }
 
 static void aead_sock_destruct(struct sock *sk)
@@ -766,12 +893,14 @@ static void aead_sock_destruct(struct sock *sk)
         af_alg_release_parent(sk);
 }
 
-static int aead_accept_parent(void *private, struct sock *sk)
+static int aead_accept_parent_nokey(void *private, struct sock *sk)
 {
         struct aead_ctx *ctx;
         struct alg_sock *ask = alg_sk(sk);
-        unsigned int len = sizeof(*ctx) + crypto_aead_reqsize(private);
-        unsigned int ivlen = crypto_aead_ivsize(private);
+        struct aead_tfm *tfm = private;
+        struct crypto_aead *aead = tfm->aead;
+        unsigned int len = sizeof(*ctx) + crypto_aead_reqsize(aead);
+        unsigned int ivlen = crypto_aead_ivsize(aead);
 
         ctx = sock_kmalloc(sk, len, GFP_KERNEL);
         if (!ctx)
@@ -798,7 +927,7 @@ static int aead_accept_parent(void *private, struct sock *sk)
 
         ask->private = ctx;
 
-        aead_request_set_tfm(&ctx->aead_req, private);
+        aead_request_set_tfm(&ctx->aead_req, aead);
         aead_request_set_callback(&ctx->aead_req, CRYPTO_TFM_REQ_MAY_BACKLOG,
                                   af_alg_complete, &ctx->completion);
 
@@ -807,13 +936,25 @@ static int aead_accept_parent(void *private, struct sock *sk)
         return 0;
 }
 
+static int aead_accept_parent(void *private, struct sock *sk)
+{
+        struct aead_tfm *tfm = private;
+
+        if (!tfm->has_key)
+                return -ENOKEY;
+
+        return aead_accept_parent_nokey(private, sk);
+}
+
 static const struct af_alg_type algif_type_aead = {
         .bind           =       aead_bind,
         .release        =       aead_release,
         .setkey         =       aead_setkey,
         .setauthsize    =       aead_setauthsize,
         .accept         =       aead_accept_parent,
+        .accept_nokey   =       aead_accept_parent_nokey,
         .ops            =       &algif_aead_ops,
+        .ops_nokey      =       &algif_aead_ops_nokey,
         .name           =       "aead",
         .owner          =       THIS_MODULE
 };
diff --git a/drivers/Makefile b/drivers/Makefile
index d1edd6c28926..bd4e4e2d391b 100644
--- a/drivers/Makefile
+++ b/drivers/Makefile
@@ -106,6 +106,7 @@ obj-$(CONFIG_USB_PHY)		+= usb/
 obj-$(CONFIG_USB)               += usb/
 obj-$(CONFIG_PCI)               += usb/
 obj-$(CONFIG_USB_GADGET)        += usb/
+obj-$(CONFIG_OF)                += usb/
 obj-$(CONFIG_SERIO)             += input/serio/
 obj-$(CONFIG_GAMEPORT)          += input/gameport/
 obj-$(CONFIG_INPUT)             += input/
diff --git a/drivers/bluetooth/hci_bcm.c b/drivers/bluetooth/hci_bcm.c
index 8f6c23c20c52..deed58013555 100644
--- a/drivers/bluetooth/hci_bcm.c
+++ b/drivers/bluetooth/hci_bcm.c
@@ -287,6 +287,9 @@ static int bcm_open(struct hci_uart *hu)
 
         hu->priv = bcm;
 
+        if (!hu->tty->dev)
+                goto out;
+
         mutex_lock(&bcm_device_lock);
         list_for_each(p, &bcm_device_list) {
                 struct bcm_device *dev = list_entry(p, struct bcm_device, list);
@@ -307,7 +310,7 @@ static int bcm_open(struct hci_uart *hu)
         }
 
         mutex_unlock(&bcm_device_lock);
-
+out:
         return 0;
 }
 
diff --git a/drivers/bluetooth/hci_intel.c b/drivers/bluetooth/hci_intel.c
index 9e271286c5e5..73306384af6c 100644
--- a/drivers/bluetooth/hci_intel.c
+++ b/drivers/bluetooth/hci_intel.c
@@ -307,6 +307,9 @@ static int intel_set_power(struct hci_uart *hu, bool powered)
         struct list_head *p;
         int err = -ENODEV;
 
+        if (!hu->tty->dev)
+                return err;
+
         mutex_lock(&intel_device_list_lock);
 
         list_for_each(p, &intel_device_list) {
@@ -379,6 +382,9 @@ static void intel_busy_work(struct work_struct *work)
         struct intel_data *intel = container_of(work, struct intel_data,
                                                 busy_work);
 
+        if (!intel->hu->tty->dev)
+                return;
+
         /* Link is busy, delay the suspend */
         mutex_lock(&intel_device_list_lock);
         list_for_each(p, &intel_device_list) {
@@ -889,6 +895,8 @@ done:
         list_for_each(p, &intel_device_list) {
                 struct intel_device *dev = list_entry(p, struct intel_device,
                                                       list);
+                if (!hu->tty->dev)
+                        break;
                 if (hu->tty->dev->parent == dev->pdev->dev.parent) {
                         if (device_may_wakeup(&dev->pdev->dev)) {
                                 set_bit(STATE_LPM_ENABLED, &intel->flags);
@@ -1056,6 +1064,9 @@ static int intel_enqueue(struct hci_uart *hu, struct sk_buff *skb)
 
         BT_DBG("hu %p skb %p", hu, skb);
 
+        if (!hu->tty->dev)
+                goto out_enqueue;
+
         /* Be sure our controller is resumed and potential LPM transaction
          * completed before enqueuing any packet.
          */
@@ -1072,7 +1083,7 @@ static int intel_enqueue(struct hci_uart *hu, struct sk_buff *skb)
                 }
         }
         mutex_unlock(&intel_device_list_lock);
-
+out_enqueue:
         skb_queue_tail(&intel->txq, skb);
 
         return 0;
diff --git a/drivers/char/ipmi/ipmi_ssif.c b/drivers/char/ipmi/ipmi_ssif.c
index 5673ffff00be..6958b5ce9145 100644
--- a/drivers/char/ipmi/ipmi_ssif.c
+++ b/drivers/char/ipmi/ipmi_ssif.c
@@ -892,6 +892,7 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result,
                  * for details on the intricacies of this.
                  */
                 int left;
+                unsigned char *data_to_send;
 
                 ssif_inc_stat(ssif_info, sent_messages_parts);
 
@@ -900,6 +901,7 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result,
                         left = 32;
                 /* Length byte. */
                 ssif_info->multi_data[ssif_info->multi_pos] = left;
+                data_to_send = ssif_info->multi_data + ssif_info->multi_pos;
                 ssif_info->multi_pos += left;
                 if (left < 32)
                         /*
@@ -913,7 +915,7 @@ static void msg_written_handler(struct ssif_info *ssif_info, int result,
                 rv = ssif_i2c_send(ssif_info, msg_written_handler,
                                   I2C_SMBUS_WRITE,
                                   SSIF_IPMI_MULTI_PART_REQUEST_MIDDLE,
-                                  ssif_info->multi_data + ssif_info->multi_pos,
+                                  data_to_send,
                                   I2C_SMBUS_BLOCK_DATA);
                 if (rv < 0) {
                         /* request failed, just return the error. */
diff --git a/drivers/crypto/ccp/ccp-dev-v3.c b/drivers/crypto/ccp/ccp-dev-v3.c
index 8d2dbacc6161..e68966bbfa58 100644
--- a/drivers/crypto/ccp/ccp-dev-v3.c
+++ b/drivers/crypto/ccp/ccp-dev-v3.c
@@ -315,17 +315,73 @@ static int ccp_perform_ecc(struct ccp_op *op)
         return ccp_do_cmd(op, cr, ARRAY_SIZE(cr));
 }
 
+static void ccp_disable_queue_interrupts(struct ccp_device *ccp)
+{
+        iowrite32(0x00, ccp->io_regs + IRQ_MASK_REG);
+}
+
+static void ccp_enable_queue_interrupts(struct ccp_device *ccp)
+{
+        iowrite32(ccp->qim, ccp->io_regs + IRQ_MASK_REG);
+}
+
+static void ccp_irq_bh(unsigned long data)
+{
+        struct ccp_device *ccp = (struct ccp_device *)data;
+        struct ccp_cmd_queue *cmd_q;
+        u32 q_int, status;
+        unsigned int i;
+
+        status = ioread32(ccp->io_regs + IRQ_STATUS_REG);
+
+        for (i = 0; i < ccp->cmd_q_count; i++) {
+                cmd_q = &ccp->cmd_q[i];
+
+                q_int = status & (cmd_q->int_ok | cmd_q->int_err);
+                if (q_int) {
+                        cmd_q->int_status = status;
+                        cmd_q->q_status = ioread32(cmd_q->reg_status);
+                        cmd_q->q_int_status = ioread32(cmd_q->reg_int_status);
+
+                        /* On error, only save the first error value */
+                        if ((q_int & cmd_q->int_err) && !cmd_q->cmd_error)
+                                cmd_q->cmd_error = CMD_Q_ERROR(cmd_q->q_status);
+
+                        cmd_q->int_rcvd = 1;
+
+                        /* Acknowledge the interrupt and wake the kthread */
+                        iowrite32(q_int, ccp->io_regs + IRQ_STATUS_REG);
+                        wake_up_interruptible(&cmd_q->int_queue);
+                }
+        }
+        ccp_enable_queue_interrupts(ccp);
+}
+
+static irqreturn_t ccp_irq_handler(int irq, void *data)
+{
+        struct device *dev = data;
+        struct ccp_device *ccp = dev_get_drvdata(dev);
+
+        ccp_disable_queue_interrupts(ccp);
+        if (ccp->use_tasklet)
+                tasklet_schedule(&ccp->irq_tasklet);
+        else
+                ccp_irq_bh((unsigned long)ccp);
+
+        return IRQ_HANDLED;
+}
+
 static int ccp_init(struct ccp_device *ccp)
 {
         struct device *dev = ccp->dev;
         struct ccp_cmd_queue *cmd_q;
         struct dma_pool *dma_pool;
         char dma_pool_name[MAX_DMAPOOL_NAME_LEN];
-        unsigned int qmr, qim, i;
+        unsigned int qmr, i;
         int ret;
 
         /* Find available queues */
-        qim = 0;
+        ccp->qim = 0;
         qmr = ioread32(ccp->io_regs + Q_MASK_REG);
         for (i = 0; i < MAX_HW_QUEUES; i++) {
                 if (!(qmr & (1 << i)))
@@ -370,7 +426,7 @@ static int ccp_init(struct ccp_device *ccp)
                 init_waitqueue_head(&cmd_q->int_queue);
 
                 /* Build queue interrupt mask (two interrupts per queue) */
-                qim |= cmd_q->int_ok | cmd_q->int_err;
+                ccp->qim |= cmd_q->int_ok | cmd_q->int_err;
 
 #ifdef CONFIG_ARM64
                 /* For arm64 set the recommended queue cache settings */
@@ -388,14 +444,14 @@ static int ccp_init(struct ccp_device *ccp)
         dev_notice(dev, "%u command queues available\n", ccp->cmd_q_count);
 
         /* Disable and clear interrupts until ready */
-        iowrite32(0x00, ccp->io_regs + IRQ_MASK_REG);
+        ccp_disable_queue_interrupts(ccp);
         for (i = 0; i < ccp->cmd_q_count; i++) {
                 cmd_q = &ccp->cmd_q[i];
 
                 ioread32(cmd_q->reg_int_status);
                 ioread32(cmd_q->reg_status);
         }
-        iowrite32(qim, ccp->io_regs + IRQ_STATUS_REG);
+        iowrite32(ccp->qim, ccp->io_regs + IRQ_STATUS_REG);
 
         /* Request an irq */
         ret = ccp->get_irq(ccp);
@@ -408,6 +464,11 @@ static int ccp_init(struct ccp_device *ccp)
         init_waitqueue_head(&ccp->sb_queue);
         init_waitqueue_head(&ccp->suspend_queue);
 
+        /* Initialize the ISR tasklet? */
+        if (ccp->use_tasklet)
+                tasklet_init(&ccp->irq_tasklet, ccp_irq_bh,
+                             (unsigned long)ccp);
+
         dev_dbg(dev, "Starting threads...\n");
         /* Create a kthread for each queue */
         for (i = 0; i < ccp->cmd_q_count; i++) {
@@ -430,7 +491,7 @@ static int ccp_init(struct ccp_device *ccp)
 
         dev_dbg(dev, "Enabling interrupts...\n");
         /* Enable interrupts */
-        iowrite32(qim, ccp->io_regs + IRQ_MASK_REG);
+        ccp_enable_queue_interrupts(ccp);
 
         dev_dbg(dev, "Registering device...\n");
         ccp_add_device(ccp);
@@ -467,7 +528,7 @@ static void ccp_destroy(struct ccp_device *ccp)
 {
         struct ccp_cmd_queue *cmd_q;
         struct ccp_cmd *cmd;
-        unsigned int qim, i;
+        unsigned int i;
 
         /* Unregister the DMA engine */
         ccp_dmaengine_unregister(ccp);
@@ -478,22 +539,15 @@ static void ccp_destroy(struct ccp_device *ccp)
         /* Remove this device from the list of available units */
         ccp_del_device(ccp);
 
-        /* Build queue interrupt mask (two interrupt masks per queue) */
-        qim = 0;
-        for (i = 0; i < ccp->cmd_q_count; i++) {
-                cmd_q = &ccp->cmd_q[i];
-                qim |= cmd_q->int_ok | cmd_q->int_err;
-        }
-
         /* Disable and clear interrupts */
-        iowrite32(0x00, ccp->io_regs + IRQ_MASK_REG);
+        ccp_disable_queue_interrupts(ccp);
         for (i = 0; i < ccp->cmd_q_count; i++) {
                 cmd_q = &ccp->cmd_q[i];
 
                 ioread32(cmd_q->reg_int_status);
                 ioread32(cmd_q->reg_status);
         }
-        iowrite32(qim, ccp->io_regs + IRQ_STATUS_REG);
+        iowrite32(ccp->qim, ccp->io_regs + IRQ_STATUS_REG);
 
         /* Stop the queue kthreads */
         for (i = 0; i < ccp->cmd_q_count; i++)
@@ -520,40 +574,6 @@ static void ccp_destroy(struct ccp_device *ccp)
         }
 }
 
-static irqreturn_t ccp_irq_handler(int irq, void *data)
-{
-        struct device *dev = data;
-        struct ccp_device *ccp = dev_get_drvdata(dev);
-        struct ccp_cmd_queue *cmd_q;
-        u32 q_int, status;
-        unsigned int i;
-
-        status = ioread32(ccp->io_regs + IRQ_STATUS_REG);
-
-        for (i = 0; i < ccp->cmd_q_count; i++) {
-                cmd_q = &ccp->cmd_q[i];
-
-                q_int = status & (cmd_q->int_ok | cmd_q->int_err);
-                if (q_int) {
-                        cmd_q->int_status = status;
-                        cmd_q->q_status = ioread32(cmd_q->reg_status);
-                        cmd_q->q_int_status = ioread32(cmd_q->reg_int_status);
-
-                        /* On error, only save the first error value */
-                        if ((q_int & cmd_q->int_err) && !cmd_q->cmd_error)
-                                cmd_q->cmd_error = CMD_Q_ERROR(cmd_q->q_status);
-
-                        cmd_q->int_rcvd = 1;
-
-                        /* Acknowledge the interrupt and wake the kthread */
-                        iowrite32(q_int, ccp->io_regs + IRQ_STATUS_REG);
-                        wake_up_interruptible(&cmd_q->int_queue);
-                }
-        }
-
-        return IRQ_HANDLED;
-}
-
 static const struct ccp_actions ccp3_actions = {
         .aes = ccp_perform_aes,
         .xts_aes = ccp_perform_xts_aes,
diff --git a/drivers/crypto/ccp/ccp-dev-v5.c b/drivers/crypto/ccp/ccp-dev-v5.c
index a388bf2d67f4..2c0ce5f605b3 100644
--- a/drivers/crypto/ccp/ccp-dev-v5.c
+++ b/drivers/crypto/ccp/ccp-dev-v5.c
@@ -644,6 +644,65 @@ static int ccp_assign_lsbs(struct ccp_device *ccp)
         return rc;
 }
 
+static void ccp5_disable_queue_interrupts(struct ccp_device *ccp)
+{
+        unsigned int i;
+
+        for (i = 0; i < ccp->cmd_q_count; i++)
+                iowrite32(0x0, ccp->cmd_q[i].reg_int_enable);
+}
+
+static void ccp5_enable_queue_interrupts(struct ccp_device *ccp)
+{
+        unsigned int i;
+
+        for (i = 0; i < ccp->cmd_q_count; i++)
+                iowrite32(SUPPORTED_INTERRUPTS, ccp->cmd_q[i].reg_int_enable);
+}
+
+static void ccp5_irq_bh(unsigned long data)
+{
+        struct ccp_device *ccp = (struct ccp_device *)data;
+        u32 status;
+        unsigned int i;
+
+        for (i = 0; i < ccp->cmd_q_count; i++) {
+                struct ccp_cmd_queue *cmd_q = &ccp->cmd_q[i];
+
+                status = ioread32(cmd_q->reg_interrupt_status);
+
+                if (status) {
+                        cmd_q->int_status = status;
+                        cmd_q->q_status = ioread32(cmd_q->reg_status);
+                        cmd_q->q_int_status = ioread32(cmd_q->reg_int_status);
+
+                        /* On error, only save the first error value */
+                        if ((status & INT_ERROR) && !cmd_q->cmd_error)
+                                cmd_q->cmd_error = CMD_Q_ERROR(cmd_q->q_status);
+
+                        cmd_q->int_rcvd = 1;
+
+                        /* Acknowledge the interrupt and wake the kthread */
+                        iowrite32(status, cmd_q->reg_interrupt_status);
+                        wake_up_interruptible(&cmd_q->int_queue);
+                }
+        }
+        ccp5_enable_queue_interrupts(ccp);
+}
+
+static irqreturn_t ccp5_irq_handler(int irq, void *data)
+{
+        struct device *dev = data;
+        struct ccp_device *ccp = dev_get_drvdata(dev);
+
+        ccp5_disable_queue_interrupts(ccp);
+        if (ccp->use_tasklet)
+                tasklet_schedule(&ccp->irq_tasklet);
+        else
+                ccp5_irq_bh((unsigned long)ccp);
+        return IRQ_HANDLED;
+}
+
 static int ccp5_init(struct ccp_device *ccp)
 {
         struct device *dev = ccp->dev;
@@ -728,19 +787,18 @@ static int ccp5_init(struct ccp_device *ccp)
         dev_notice(dev, "%u command queues available\n", ccp->cmd_q_count);
 
         /* Turn off the queues and disable interrupts until ready */
+        ccp5_disable_queue_interrupts(ccp);
         for (i = 0; i < ccp->cmd_q_count; i++) {
                 cmd_q = &ccp->cmd_q[i];
 
                 cmd_q->qcontrol = 0; /* Start with nothing */
                 iowrite32(cmd_q->qcontrol, cmd_q->reg_control);
 
-                /* Disable the interrupts */
-                iowrite32(0x00, cmd_q->reg_int_enable);
                 ioread32(cmd_q->reg_int_status);
                 ioread32(cmd_q->reg_status);
 
-                /* Clear the interrupts */
-                iowrite32(ALL_INTERRUPTS, cmd_q->reg_interrupt_status);
+                /* Clear the interrupt status */
+                iowrite32(SUPPORTED_INTERRUPTS, cmd_q->reg_interrupt_status);
         }
 
         dev_dbg(dev, "Requesting an IRQ...\n");
@@ -750,6 +808,10 @@ static int ccp5_init(struct ccp_device *ccp)
                 dev_err(dev, "unable to allocate an IRQ\n");
                 goto e_pool;
         }
+        /* Initialize the ISR tasklet */
+        if (ccp->use_tasklet)
+                tasklet_init(&ccp->irq_tasklet, ccp5_irq_bh,
+                             (unsigned long)ccp);
 
         /* Initialize the queue used to suspend */
         init_waitqueue_head(&ccp->suspend_queue);
@@ -821,11 +883,7 @@ static int ccp5_init(struct ccp_device *ccp)
         }
 
         dev_dbg(dev, "Enabling interrupts...\n");
-        /* Enable interrupts */
-        for (i = 0; i < ccp->cmd_q_count; i++) {
-                cmd_q = &ccp->cmd_q[i];
-                iowrite32(ALL_INTERRUPTS, cmd_q->reg_int_enable);
-        }
+        ccp5_enable_queue_interrupts(ccp);
 
         dev_dbg(dev, "Registering device...\n");
         /* Put this on the unit list to make it available */
@@ -877,17 +935,15 @@ static void ccp5_destroy(struct ccp_device *ccp)
         ccp_del_device(ccp);
 
         /* Disable and clear interrupts */
+        ccp5_disable_queue_interrupts(ccp);
         for (i = 0; i < ccp->cmd_q_count; i++) {
                 cmd_q = &ccp->cmd_q[i];
 
                 /* Turn off the run bit */
                 iowrite32(cmd_q->qcontrol & ~CMD5_Q_RUN, cmd_q->reg_control);
 
-                /* Disable the interrupts */
-                iowrite32(ALL_INTERRUPTS, cmd_q->reg_interrupt_status);
-
                 /* Clear the interrupt status */
-                iowrite32(0x00, cmd_q->reg_int_enable);
+                iowrite32(SUPPORTED_INTERRUPTS, cmd_q->reg_interrupt_status);
                 ioread32(cmd_q->reg_int_status);
                 ioread32(cmd_q->reg_status);
         }
@@ -920,38 +976,6 @@ static void ccp5_destroy(struct ccp_device *ccp)
         }
 }
 
-static irqreturn_t ccp5_irq_handler(int irq, void *data)
-{
-        struct device *dev = data;
-        struct ccp_device *ccp = dev_get_drvdata(dev);
-        u32 status;
-        unsigned int i;
-
-        for (i = 0; i < ccp->cmd_q_count; i++) {
-                struct ccp_cmd_queue *cmd_q = &ccp->cmd_q[i];
-
-                status = ioread32(cmd_q->reg_interrupt_status);
-
-                if (status) {
-                        cmd_q->int_status = status;
-                        cmd_q->q_status = ioread32(cmd_q->reg_status);
-                        cmd_q->q_int_status = ioread32(cmd_q->reg_int_status);
-
-                        /* On error, only save the first error value */
-                        if ((status & INT_ERROR) && !cmd_q->cmd_error)
-                                cmd_q->cmd_error = CMD_Q_ERROR(cmd_q->q_status);
-
-                        cmd_q->int_rcvd = 1;
-
-                        /* Acknowledge the interrupt and wake the kthread */
-                        iowrite32(ALL_INTERRUPTS, cmd_q->reg_interrupt_status);
-                        wake_up_interruptible(&cmd_q->int_queue);
-                }
-        }
-
-        return IRQ_HANDLED;
-}
-
 static void ccp5_config(struct ccp_device *ccp)
 {
         /* Public side */
diff --git a/drivers/crypto/ccp/ccp-dev.h b/drivers/crypto/ccp/ccp-dev.h
index 340aef14d616..8ac7ae17e1f4 100644
--- a/drivers/crypto/ccp/ccp-dev.h
+++ b/drivers/crypto/ccp/ccp-dev.h
@@ -109,9 +109,8 @@
 #define INT_COMPLETION                  0x1
 #define INT_ERROR                       0x2
 #define INT_QUEUE_STOPPED               0x4
-#define ALL_INTERRUPTS                  (INT_COMPLETION| \
-                                         INT_ERROR| \
-                                         INT_QUEUE_STOPPED)
+#define INT_EMPTY_QUEUE                 0x8
+#define SUPPORTED_INTERRUPTS            (INT_COMPLETION | INT_ERROR)
 
 #define LSB_REGION_WIDTH                5
 #define MAX_LSB_CNT                     8
@@ -333,7 +332,10 @@ struct ccp_device {
         void *dev_specific;
         int (*get_irq)(struct ccp_device *ccp);
         void (*free_irq)(struct ccp_device *ccp);
+        unsigned int qim;
         unsigned int irq;
+        bool use_tasklet;
+        struct tasklet_struct irq_tasklet;
 
         /* I/O area used for device communication. The register mapping
          * starts at an offset into the mapped bar.
diff --git a/drivers/crypto/ccp/ccp-pci.c b/drivers/crypto/ccp/ccp-pci.c
index 28a9996c1085..e880d4cf4ada 100644
--- a/drivers/crypto/ccp/ccp-pci.c
+++ b/drivers/crypto/ccp/ccp-pci.c
@@ -69,6 +69,7 @@ static int ccp_get_msix_irqs(struct ccp_device *ccp)
                         goto e_irq;
                 }
         }
+        ccp->use_tasklet = true;
 
         return 0;
 
@@ -100,6 +101,7 @@ static int ccp_get_msi_irq(struct ccp_device *ccp)
                 dev_notice(dev, "unable to allocate MSI IRQ (%d)\n", ret);
                 goto e_msi;
         }
+        ccp->use_tasklet = true;
 
         return 0;
 
diff --git a/drivers/dax/dax.c b/drivers/dax/dax.c
index 193224889e41..586f9543de73 100644
--- a/drivers/dax/dax.c
+++ b/drivers/dax/dax.c
@@ -553,13 +553,10 @@ static void dax_dev_release(struct device *dev)
         kfree(dax_dev);
 }
 
-static void unregister_dax_dev(void *dev)
+static void kill_dax_dev(struct dax_dev *dax_dev)
 {
-        struct dax_dev *dax_dev = to_dax_dev(dev);
         struct cdev *cdev = &dax_dev->cdev;
 
-        dev_dbg(dev, "%s\n", __func__);
-
         /*
          * Note, rcu is not protecting the liveness of dax_dev, rcu is
          * ensuring that any fault handlers that might have seen
@@ -571,6 +568,15 @@ static void unregister_dax_dev(void *dev)
         synchronize_srcu(&dax_srcu);
         unmap_mapping_range(dax_dev->inode->i_mapping, 0, 0, 1);
         cdev_del(cdev);
+}
+
+static void unregister_dax_dev(void *dev)
+{
+        struct dax_dev *dax_dev = to_dax_dev(dev);
+
+        dev_dbg(dev, "%s\n", __func__);
+
+        kill_dax_dev(dax_dev);
         device_unregister(dev);
 }
 
@@ -647,6 +653,7 @@ struct dax_dev *devm_create_dax_dev(struct dax_region *dax_region,
         dev_set_name(dev, "dax%d.%d", dax_region->id, dax_dev->id);
         rc = device_add(dev);
         if (rc) {
+                kill_dax_dev(dax_dev);
                 put_device(dev);
                 return ERR_PTR(rc);
         }
diff --git a/drivers/infiniband/core/sysfs.c b/drivers/infiniband/core/sysfs.c
index c1fb545e8d78..42de5f22da93 100644
--- a/drivers/infiniband/core/sysfs.c
+++ b/drivers/infiniband/core/sysfs.c
@@ -1301,7 +1301,7 @@ err_put:
         free_port_list_attributes(device);
 
 err_unregister:
-        device_unregister(class_dev);
+        device_del(class_dev);
 
 err:
         return ret;
diff --git a/drivers/infiniband/core/verbs.c b/drivers/infiniband/core/verbs.c
index 83687646da68..0e64b52af5b2 100644
--- a/drivers/infiniband/core/verbs.c
+++ b/drivers/infiniband/core/verbs.c
@@ -1516,7 +1516,9 @@ int ib_attach_mcast(struct ib_qp *qp, union ib_gid *gid, u16 lid)
 
         if (!qp->device->attach_mcast)
                 return -ENOSYS;
-        if (gid->raw[0] != 0xff || qp->qp_type != IB_QPT_UD)
+        if (gid->raw[0] != 0xff || qp->qp_type != IB_QPT_UD ||
+            lid < be16_to_cpu(IB_MULTICAST_LID_BASE) ||
+            lid == be16_to_cpu(IB_LID_PERMISSIVE))
                 return -EINVAL;
 
         ret = qp->device->attach_mcast(qp, gid, lid);
@@ -1532,7 +1534,9 @@ int ib_detach_mcast(struct ib_qp *qp, union ib_gid *gid, u16 lid)
 
         if (!qp->device->detach_mcast)
                 return -ENOSYS;
-        if (gid->raw[0] != 0xff || qp->qp_type != IB_QPT_UD)
+        if (gid->raw[0] != 0xff || qp->qp_type != IB_QPT_UD ||
+            lid < be16_to_cpu(IB_MULTICAST_LID_BASE) ||
+            lid == be16_to_cpu(IB_LID_PERMISSIVE))
                 return -EINVAL;
 
         ret = qp->device->detach_mcast(qp, gid, lid);
diff --git a/drivers/infiniband/hw/hfi1/ruc.c b/drivers/infiniband/hw/hfi1/ruc.c
index a1576aea4756..9f768b48321f 100644
--- a/drivers/infiniband/hw/hfi1/ruc.c
+++ b/drivers/infiniband/hw/hfi1/ruc.c
@@ -1,5 +1,5 @@
 /*
- * Copyright(c) 2015, 2016 Intel Corporation.
+ * Copyright(c) 2015 - 2017 Intel Corporation.
  *
  * This file is provided under a dual BSD/GPLv2 license.  When using or
  * redistributing this file, you may do so under either license.
@@ -833,23 +833,29 @@ void hfi1_make_ruc_header(struct rvt_qp *qp, struct ib_other_headers *ohdr,
 /* when sending, force a reschedule every one of these periods */
 #define SEND_RESCHED_TIMEOUT (5 * HZ)  /* 5s in jiffies */
 
+void hfi1_do_send_from_rvt(struct rvt_qp *qp)
+{
+        hfi1_do_send(qp, false);
+}
+
 void _hfi1_do_send(struct work_struct *work)
 {
         struct iowait *wait = container_of(work, struct iowait, iowork);
         struct rvt_qp *qp = iowait_to_qp(wait);
 
-        hfi1_do_send(qp);
+        hfi1_do_send(qp, true);
 }
 
 /**
  * hfi1_do_send - perform a send on a QP
  * @work: contains a pointer to the QP
+ * @in_thread: true if in a workqueue thread
  *
  * Process entries in the send work queue until credit or queue is
  * exhausted.  Only allow one CPU to send a packet per QP.
  * Otherwise, two threads could send packets out of order.
  */
-void hfi1_do_send(struct rvt_qp *qp)
+void hfi1_do_send(struct rvt_qp *qp, bool in_thread)
 {
         struct hfi1_pkt_state ps;
         struct hfi1_qp_priv *priv = qp->priv;
@@ -917,8 +923,10 @@ void hfi1_do_send(struct rvt_qp *qp)
                         qp->s_hdrwords = 0;
                         /* allow other tasks to run */
                         if (unlikely(time_after(jiffies, timeout))) {
-                                if (workqueue_congested(cpu,
-                                                        ps.ppd->hfi1_wq)) {
+                                if (!in_thread ||
+                                    workqueue_congested(
+                                                cpu,
+                                                ps.ppd->hfi1_wq)) {
                                         spin_lock_irqsave(
                                                 &qp->s_lock,
                                                 ps.flags);
@@ -931,11 +939,9 @@ void hfi1_do_send(struct rvt_qp *qp)
                                                 *ps.ppd->dd->send_schedule);
                                         return;
                                 }
-                                if (!irqs_disabled()) {
-                                        cond_resched();
-                                        this_cpu_inc(
-                                           *ps.ppd->dd->send_schedule);
-                                }
+                                cond_resched();
+                                this_cpu_inc(
+                                        *ps.ppd->dd->send_schedule);
                                 timeout = jiffies + (timeout_int) / 8;
                         }
                         spin_lock_irqsave(&qp->s_lock, ps.flags);
diff --git a/drivers/infiniband/hw/hfi1/verbs.c b/drivers/infiniband/hw/hfi1/verbs.c
index 4b7a16ceb362..01a380efea6b 100644
--- a/drivers/infiniband/hw/hfi1/verbs.c
+++ b/drivers/infiniband/hw/hfi1/verbs.c
@@ -1,5 +1,5 @@
 /*
- * Copyright(c) 2015, 2016 Intel Corporation.
+ * Copyright(c) 2015 - 2017 Intel Corporation.
  *
  * This file is provided under a dual BSD/GPLv2 license.  When using or
  * redistributing this file, you may do so under either license.
@@ -1697,7 +1697,7 @@ int hfi1_register_ib_device(struct hfi1_devdata *dd)
         dd->verbs_dev.rdi.driver_f.qp_priv_free = qp_priv_free;
         dd->verbs_dev.rdi.driver_f.free_all_qps = free_all_qps;
         dd->verbs_dev.rdi.driver_f.notify_qp_reset = notify_qp_reset;
-        dd->verbs_dev.rdi.driver_f.do_send = hfi1_do_send;
+        dd->verbs_dev.rdi.driver_f.do_send = hfi1_do_send_from_rvt;
         dd->verbs_dev.rdi.driver_f.schedule_send = hfi1_schedule_send;
         dd->verbs_dev.rdi.driver_f.schedule_send_no_lock = _hfi1_schedule_send;
         dd->verbs_dev.rdi.driver_f.get_pmtu_from_attr = get_pmtu_from_attr;
diff --git a/drivers/infiniband/hw/hfi1/verbs.h b/drivers/infiniband/hw/hfi1/verbs.h
index 1c3815d89eb7..bac84f820a54 100644
--- a/drivers/infiniband/hw/hfi1/verbs.h
+++ b/drivers/infiniband/hw/hfi1/verbs.h
@@ -1,5 +1,5 @@
 /*
- * Copyright(c) 2015, 2016 Intel Corporation.
+ * Copyright(c) 2015 - 2017 Intel Corporation.
  *
  * This file is provided under a dual BSD/GPLv2 license.  When using or
  * redistributing this file, you may do so under either license.
@@ -372,7 +372,9 @@ void hfi1_make_ruc_header(struct rvt_qp *qp, struct ib_other_headers *ohdr,
 
 void _hfi1_do_send(struct work_struct *work);
 
-void hfi1_do_send(struct rvt_qp *qp);
+void hfi1_do_send_from_rvt(struct rvt_qp *qp);
+
+void hfi1_do_send(struct rvt_qp *qp, bool in_thread);
 
 void hfi1_send_complete(struct rvt_qp *qp, struct rvt_swqe *wqe,
                         enum ib_wc_status status);
diff --git a/drivers/infiniband/hw/mlx4/main.c b/drivers/infiniband/hw/mlx4/main.c
index 46ad99595fd2..f2a885eee4bb 100644
--- a/drivers/infiniband/hw/mlx4/main.c
+++ b/drivers/infiniband/hw/mlx4/main.c
@@ -2926,6 +2926,7 @@ err_counter:
                 mlx4_ib_delete_counters_table(ibdev, &ibdev->counters_table[i]);
 
 err_map:
+        mlx4_ib_free_eqs(dev, ibdev);
         iounmap(ibdev->uar_map);
 
 err_uar:
diff --git a/drivers/infiniband/hw/mlx4/mcg.c b/drivers/infiniband/hw/mlx4/mcg.c
index a21d37f02f35..e6ea81c9644a 100644
--- a/drivers/infiniband/hw/mlx4/mcg.c
+++ b/drivers/infiniband/hw/mlx4/mcg.c
@@ -1102,7 +1102,8 @@ static void _mlx4_ib_mcg_port_cleanup(struct mlx4_ib_demux_ctx *ctx, int destroy
         while ((p = rb_first(&ctx->mcg_table)) != NULL) {
                 group = rb_entry(p, struct mcast_group, node);
                 if (atomic_read(&group->refcount))
-                        mcg_warn_group(group, "group refcount %d!!! (pointer %p)\n", atomic_read(&group->refcount), group);
+                        mcg_debug_group(group, "group refcount %d!!! (pointer %p)\n",
+                                        atomic_read(&group->refcount), group);
 
                 force_clean_group(group);
         }
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_fs.c b/drivers/infiniband/ulp/ipoib/ipoib_fs.c
index 6bd5740e2691..09396bd7b02d 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_fs.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_fs.c
@@ -281,8 +281,11 @@ void ipoib_delete_debug_files(struct net_device *dev)
 {
         struct ipoib_dev_priv *priv = netdev_priv(dev);
 
+        WARN_ONCE(!priv->mcg_dentry, "null mcg debug file\n");
+        WARN_ONCE(!priv->path_dentry, "null path debug file\n");
         debugfs_remove(priv->mcg_dentry);
         debugfs_remove(priv->path_dentry);
+        priv->mcg_dentry = priv->path_dentry = NULL;
 }
 
 int ipoib_register_debugfs(void)
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 3ef7b8f049c4..08c4b0287304 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -108,6 +108,33 @@ static struct ib_client ipoib_client = {
         .get_net_dev_by_params = ipoib_get_net_dev_by_params,
 };
 
+#ifdef CONFIG_INFINIBAND_IPOIB_DEBUG
+static int ipoib_netdev_event(struct notifier_block *this,
+                              unsigned long event, void *ptr)
+{
+        struct netdev_notifier_info *ni = ptr;
+        struct net_device *dev = ni->dev;
+
+        if (dev->netdev_ops->ndo_open != ipoib_open)
+                return NOTIFY_DONE;
+
+        switch (event) {
+        case NETDEV_REGISTER:
+                ipoib_create_debug_files(dev);
+                break;
+        case NETDEV_CHANGENAME:
+                ipoib_delete_debug_files(dev);
+                ipoib_create_debug_files(dev);
+                break;
+        case NETDEV_UNREGISTER:
+                ipoib_delete_debug_files(dev);
+                break;
+        }
+
+        return NOTIFY_DONE;
+}
+#endif
+
 int ipoib_open(struct net_device *dev)
 {
         struct ipoib_dev_priv *priv = netdev_priv(dev);
@@ -1655,8 +1682,6 @@ void ipoib_dev_cleanup(struct net_device *dev)
 
         ASSERT_RTNL();
 
-        ipoib_delete_debug_files(dev);
-
         /* Delete any child interfaces first */
         list_for_each_entry_safe(cpriv, tcpriv, &priv->child_intfs, list) {
                 /* Stop GC on child */
@@ -2074,8 +2099,6 @@ static struct net_device *ipoib_add_port(const char *format,
                 goto register_failed;
         }
 
-        ipoib_create_debug_files(priv->dev);
-
         if (ipoib_cm_add_mode_attr(priv->dev))
                 goto sysfs_failed;
         if (ipoib_add_pkey_attr(priv->dev))
@@ -2090,7 +2113,6 @@ static struct net_device *ipoib_add_port(const char *format,
         return priv->dev;
 
 sysfs_failed:
-        ipoib_delete_debug_files(priv->dev);
         unregister_netdev(priv->dev);
 
 register_failed:
@@ -2175,6 +2197,12 @@ static void ipoib_remove_one(struct ib_device *device, void *client_data)
         kfree(dev_list);
 }
 
+#ifdef CONFIG_INFINIBAND_IPOIB_DEBUG
+static struct notifier_block ipoib_netdev_notifier = {
+        .notifier_call = ipoib_netdev_event,
+};
+#endif
+
 static int __init ipoib_init_module(void)
 {
         int ret;
@@ -2227,6 +2255,9 @@ static int __init ipoib_init_module(void)
         if (ret)
                 goto err_client;
 
+#ifdef CONFIG_INFINIBAND_IPOIB_DEBUG
+        register_netdevice_notifier(&ipoib_netdev_notifier);
+#endif
         return 0;
 
 err_client:
@@ -2244,6 +2275,9 @@ err_fs:
 
 static void __exit ipoib_cleanup_module(void)
 {
+#ifdef CONFIG_INFINIBAND_IPOIB_DEBUG
+        unregister_netdevice_notifier(&ipoib_netdev_notifier);
+#endif
         ipoib_netlink_fini();
         ib_unregister_client(&ipoib_client);
         ib_sa_unregister_client(&ipoib_sa_client);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
index a2f9f29c6ab5..57eadd2b7a71 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_vlan.c
@@ -87,8 +87,6 @@ int __ipoib_vlan_add(struct ipoib_dev_priv *ppriv, struct ipoib_dev_priv *priv,
                 goto register_failed;
         }
 
-        ipoib_create_debug_files(priv->dev);
-
         /* RTNL childs don't need proprietary sysfs entries */
         if (type == IPOIB_LEGACY_CHILD) {
                 if (ipoib_cm_add_mode_attr(priv->dev))
@@ -109,7 +107,6 @@ int __ipoib_vlan_add(struct ipoib_dev_priv *ppriv, struct ipoib_dev_priv *priv,
 
 sysfs_failed:
         result = -ENOMEM;
-        ipoib_delete_debug_files(priv->dev);
         unregister_netdevice(priv->dev);
 
 register_failed:
diff --git a/drivers/md/dm-era-target.c b/drivers/md/dm-era-target.c
index bf2b2676cb8a..80e3df1f1f7d 100644
--- a/drivers/md/dm-era-target.c
+++ b/drivers/md/dm-era-target.c
@@ -961,15 +961,15 @@ static int metadata_commit(struct era_metadata *md)
                 }
         }
 
-        r = save_sm_root(md);
+        r = dm_tm_pre_commit(md->tm);
         if (r) {
-                DMERR("%s: save_sm_root failed", __func__);
+                DMERR("%s: pre commit failed", __func__);
                 return r;
         }
 
-        r = dm_tm_pre_commit(md->tm);
+        r = save_sm_root(md);
         if (r) {
-                DMERR("%s: pre commit failed", __func__);
+                DMERR("%s: save_sm_root failed", __func__);
                 return r;
         }
 
diff --git a/drivers/md/dm-rq.c b/drivers/md/dm-rq.c
index 2c965424d383..ba7c4c685db3 100644
--- a/drivers/md/dm-rq.c
+++ b/drivers/md/dm-rq.c
@@ -997,10 +997,14 @@ int dm_mq_init_request_queue(struct mapped_device *md, struct dm_table *t)
         dm_init_md_queue(md);
 
         /* backfill 'mq' sysfs registration normally done in blk_register_queue */
-        blk_mq_register_dev(disk_to_dev(md->disk), q);
+        err = blk_mq_register_dev(disk_to_dev(md->disk), q);
+        if (err)
+                goto out_cleanup_queue;
 
         return 0;
 
+out_cleanup_queue:
+        blk_cleanup_queue(q);
 out_tag_set:
         blk_mq_free_tag_set(md->tag_set);
 out_kfree_tag_set:
diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
index d1c05c12a9db..be869a990e38 100644
--- a/drivers/md/dm-thin.c
+++ b/drivers/md/dm-thin.c
@@ -1070,6 +1070,7 @@ static void passdown_endio(struct bio *bio)
          * to unmap (we ignore err).
          */
         queue_passdown_pt2(bio->bi_private);
+        bio_put(bio);
 }
 
 static void process_prepared_discard_passdown_pt1(struct dm_thin_new_mapping *m)
diff --git a/drivers/nvdimm/pfn_devs.c b/drivers/nvdimm/pfn_devs.c
index 6c033c9a2f06..78cb3e2359bd 100644
--- a/drivers/nvdimm/pfn_devs.c
+++ b/drivers/nvdimm/pfn_devs.c
@@ -538,7 +538,8 @@ static struct vmem_altmap *__nvdimm_setup_pfn(struct nd_pfn *nd_pfn,
                 nd_pfn->npfns = le64_to_cpu(pfn_sb->npfns);
                 altmap = NULL;
         } else if (nd_pfn->mode == PFN_MODE_PMEM) {
-                nd_pfn->npfns = (resource_size(res) - offset) / PAGE_SIZE;
+                nd_pfn->npfns = PFN_SECTION_ALIGN_UP((resource_size(res)
+                                        - offset) / PAGE_SIZE);
                 if (le64_to_cpu(nd_pfn->pfn_sb->npfns) > nd_pfn->npfns)
                         dev_info(&nd_pfn->dev,
                                         "number of pfns truncated from %lld to %ld\n",
@@ -625,7 +626,8 @@ static int nd_pfn_init(struct nd_pfn *nd_pfn)
          */
         start += start_pad;
         size = resource_size(&nsio->res);
-        npfns = (size - start_pad - end_trunc - SZ_8K) / SZ_4K;
+        npfns = PFN_SECTION_ALIGN_UP((size - start_pad - end_trunc - SZ_8K)
+                        / PAGE_SIZE);
         if (nd_pfn->mode == PFN_MODE_PMEM) {
                 /*
                  * vmemmap_populate_hugepages() allocates the memmap array in
diff --git a/drivers/nvdimm/pmem.c b/drivers/nvdimm/pmem.c
index 24618431a14b..b4808590870c 100644
--- a/drivers/nvdimm/pmem.c
+++ b/drivers/nvdimm/pmem.c
@@ -383,12 +383,12 @@ static void nd_pmem_shutdown(struct device *dev)
 
 static void nd_pmem_notify(struct device *dev, enum nvdimm_event event)
 {
-        struct pmem_device *pmem = dev_get_drvdata(dev);
-        struct nd_region *nd_region = to_region(pmem);
+        struct nd_region *nd_region;
         resource_size_t offset = 0, end_trunc = 0;
         struct nd_namespace_common *ndns;
         struct nd_namespace_io *nsio;
         struct resource res;
+        struct badblocks *bb;
 
         if (event != NVDIMM_REVALIDATE_POISON)
                 return;
@@ -397,20 +397,33 @@ static void nd_pmem_notify(struct device *dev, enum nvdimm_event event)
                 struct nd_btt *nd_btt = to_nd_btt(dev);
 
                 ndns = nd_btt->ndns;
-        } else if (is_nd_pfn(dev)) {
-                struct nd_pfn *nd_pfn = to_nd_pfn(dev);
-                struct nd_pfn_sb *pfn_sb = nd_pfn->pfn_sb;
+                nd_region = to_nd_region(ndns->dev.parent);
+                nsio = to_nd_namespace_io(&ndns->dev);
+                bb = &nsio->bb;
+        } else {
+                struct pmem_device *pmem = dev_get_drvdata(dev);
 
-                ndns = nd_pfn->ndns;
-                offset = pmem->data_offset + __le32_to_cpu(pfn_sb->start_pad);
-                end_trunc = __le32_to_cpu(pfn_sb->end_trunc);
-        } else
-                ndns = to_ndns(dev);
+                nd_region = to_region(pmem);
+                bb = &pmem->bb;
+
+                if (is_nd_pfn(dev)) {
+                        struct nd_pfn *nd_pfn = to_nd_pfn(dev);
+                        struct nd_pfn_sb *pfn_sb = nd_pfn->pfn_sb;
+
+                        ndns = nd_pfn->ndns;
+                        offset = pmem->data_offset +
+                                        __le32_to_cpu(pfn_sb->start_pad);
+                        end_trunc = __le32_to_cpu(pfn_sb->end_trunc);
+                } else {
+                        ndns = to_ndns(dev);
+                }
+
+                nsio = to_nd_namespace_io(&ndns->dev);
+        }
 
-        nsio = to_nd_namespace_io(&ndns->dev);
         res.start = nsio->res.start + offset;
         res.end = nsio->res.end - end_trunc;
-        nvdimm_badblocks_populate(nd_region, &pmem->bb, &res);
+        nvdimm_badblocks_populate(nd_region, bb, &res);
 }
 
 MODULE_ALIAS("pmem");
diff --git a/drivers/nvdimm/region_devs.c b/drivers/nvdimm/region_devs.c
index 9cf6f1a88fce..f62306246ca4 100644
--- a/drivers/nvdimm/region_devs.c
+++ b/drivers/nvdimm/region_devs.c
@@ -968,17 +968,20 @@ EXPORT_SYMBOL_GPL(nvdimm_flush);
  */
 int nvdimm_has_flush(struct nd_region *nd_region)
 {
-        struct nd_region_data *ndrd = dev_get_drvdata(&nd_region->dev);
         int i;
 
         /* no nvdimm == flushing capability unknown */
         if (nd_region->ndr_mappings == 0)
                 return -ENXIO;
 
-        for (i = 0; i < nd_region->ndr_mappings; i++)
-                /* flush hints present, flushing required */
-                if (ndrd_get_flush_wpq(ndrd, i, 0))
+        for (i = 0; i < nd_region->ndr_mappings; i++) {
+                struct nd_mapping *nd_mapping = &nd_region->mapping[i];
+                struct nvdimm *nvdimm = nd_mapping->nvdimm;
+
+                /* flush hints present / available */
+                if (nvdimm->num_flush)
                         return 1;
+        }
 
         /*
          * The platform defines dimm devices without hints, assume
diff --git a/drivers/staging/android/lowmemorykiller.c b/drivers/staging/android/lowmemorykiller.c
index 6dcde85f05dc..2b14acc6bc8a 100644
--- a/drivers/staging/android/lowmemorykiller.c
+++ b/drivers/staging/android/lowmemorykiller.c
@@ -96,6 +96,7 @@ static unsigned long lowmem_scan(struct shrinker *s, struct shrink_control *sc)
         int other_free = global_page_state(NR_FREE_PAGES) - totalreserve_pages;
         int other_file = global_node_page_state(NR_FILE_PAGES) -
                                 global_node_page_state(NR_SHMEM) -
+                                global_node_page_state(NR_UNEVICTABLE) -
                                 total_swapcache_pages();
 
         if (lowmem_adj_size < array_size)
diff --git a/drivers/staging/comedi/drivers/jr3_pci.c b/drivers/staging/comedi/drivers/jr3_pci.c
index 70390de66e0e..eb0a095efe9c 100644
--- a/drivers/staging/comedi/drivers/jr3_pci.c
+++ b/drivers/staging/comedi/drivers/jr3_pci.c
@@ -611,7 +611,7 @@ static void jr3_pci_poll_dev(unsigned long data)
                 s = &dev->subdevices[i];
                 spriv = s->private;
 
-                if (now > spriv->next_time_min) {
+                if (time_after_eq(now, spriv->next_time_min)) {
                         struct jr3_pci_poll_delay sub_delay;
 
                         sub_delay = jr3_pci_poll_subdevice(s);
@@ -727,11 +727,12 @@ static int jr3_pci_auto_attach(struct comedi_device *dev,
                 s->insn_read    = jr3_pci_ai_insn_read;
 
                 spriv = jr3_pci_alloc_spriv(dev, s);
-                if (spriv) {
-                        /* Channel specific range and maxdata */
-                        s->range_table_list     = spriv->range_table_list;
-                        s->maxdata_list         = spriv->maxdata_list;
-                }
+                if (!spriv)
+                        return -ENOMEM;
+
+                /* Channel specific range and maxdata */
+                s->range_table_list     = spriv->range_table_list;
+                s->maxdata_list         = spriv->maxdata_list;
         }
 
         /* Reset DSP card */
diff --git a/drivers/staging/gdm724x/gdm_mux.c b/drivers/staging/gdm724x/gdm_mux.c
index 400969170d1c..f03e43b1b5f6 100644
--- a/drivers/staging/gdm724x/gdm_mux.c
+++ b/drivers/staging/gdm724x/gdm_mux.c
@@ -664,9 +664,8 @@ static int __init gdm_usb_mux_init(void)
 
 static void __exit gdm_usb_mux_exit(void)
 {
-        unregister_lte_tty_driver();
-
         usb_deregister(&gdm_mux_driver);
+        unregister_lte_tty_driver();
 }
 
 module_init(gdm_usb_mux_init);
diff --git a/drivers/staging/vt6656/usbpipe.c b/drivers/staging/vt6656/usbpipe.c
index e9b6b21f7422..f759aa8a342d 100644
--- a/drivers/staging/vt6656/usbpipe.c
+++ b/drivers/staging/vt6656/usbpipe.c
@@ -47,15 +47,25 @@ int vnt_control_out(struct vnt_private *priv, u8 request, u16 value,
                 u16 index, u16 length, u8 *buffer)
 {
         int status = 0;
+        u8 *usb_buffer;
 
         if (test_bit(DEVICE_FLAGS_DISCONNECTED, &priv->flags))
                 return STATUS_FAILURE;
 
         mutex_lock(&priv->usb_lock);
 
+        usb_buffer = kmemdup(buffer, length, GFP_KERNEL);
+        if (!usb_buffer) {
+                mutex_unlock(&priv->usb_lock);
+                return -ENOMEM;
+        }
+
         status = usb_control_msg(priv->usb,
-                usb_sndctrlpipe(priv->usb, 0), request, 0x40, value,
-                        index, buffer, length, USB_CTL_WAIT);
+                                 usb_sndctrlpipe(priv->usb, 0),
+                                 request, 0x40, value,
+                                 index, usb_buffer, length, USB_CTL_WAIT);
+
+        kfree(usb_buffer);
 
         mutex_unlock(&priv->usb_lock);
 
@@ -75,15 +85,28 @@ int vnt_control_in(struct vnt_private *priv, u8 request, u16 value,
                 u16 index, u16 length, u8 *buffer)
 {
         int status;
+        u8 *usb_buffer;
 
         if (test_bit(DEVICE_FLAGS_DISCONNECTED, &priv->flags))
                 return STATUS_FAILURE;
 
         mutex_lock(&priv->usb_lock);
 
+        usb_buffer = kmalloc(length, GFP_KERNEL);
+        if (!usb_buffer) {
+                mutex_unlock(&priv->usb_lock);
+                return -ENOMEM;
+        }
+
         status = usb_control_msg(priv->usb,
-                usb_rcvctrlpipe(priv->usb, 0), request, 0xc0, value,
-                        index, buffer, length, USB_CTL_WAIT);
+                                 usb_rcvctrlpipe(priv->usb, 0),
+                                 request, 0xc0, value,
+                                 index, usb_buffer, length, USB_CTL_WAIT);
+
+        if (status == length)
+                memcpy(buffer, usb_buffer, length);
+
+        kfree(usb_buffer);
 
         mutex_unlock(&priv->usb_lock);
 
diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
index b7d747e92c7a..40e50f2d209d 100644
--- a/drivers/target/iscsi/iscsi_target.c
+++ b/drivers/target/iscsi/iscsi_target.c
@@ -4671,6 +4671,7 @@ int iscsit_release_sessions_for_tpg(struct iscsi_portal_group *tpg, int force)
                         continue;
                 }
                 atomic_set(&sess->session_reinstatement, 1);
+                atomic_set(&sess->session_fall_back_to_erl0, 1);
                 spin_unlock(&sess->conn_lock);
 
                 list_move_tail(&se_sess->sess_list, &free_list);
diff --git a/drivers/target/iscsi/iscsi_target_configfs.c b/drivers/target/iscsi/iscsi_target_configfs.c
index e980e2d0c2db..7e70fe849f0d 100644
--- a/drivers/target/iscsi/iscsi_target_configfs.c
+++ b/drivers/target/iscsi/iscsi_target_configfs.c
@@ -1530,6 +1530,7 @@ static void lio_tpg_close_session(struct se_session *se_sess)
                 return;
         }
         atomic_set(&sess->session_reinstatement, 1);
+        atomic_set(&sess->session_fall_back_to_erl0, 1);
         spin_unlock(&sess->conn_lock);
 
         iscsit_stop_time2retain_timer(sess);
diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c
index 15f79a2ca34a..96c55bc10ac9 100644
--- a/drivers/target/iscsi/iscsi_target_login.c
+++ b/drivers/target/iscsi/iscsi_target_login.c
@@ -204,6 +204,7 @@ int iscsi_check_for_session_reinstatement(struct iscsi_conn *conn)
                             initiatorname_param->value) &&
                    (sess_p->sess_ops->SessionType == sessiontype))) {
                         atomic_set(&sess_p->session_reinstatement, 1);
+                        atomic_set(&sess_p->session_fall_back_to_erl0, 1);
                         spin_unlock(&sess_p->conn_lock);
                         iscsit_inc_session_usage_count(sess_p);
                         iscsit_stop_time2retain_timer(sess_p);
diff --git a/drivers/target/target_core_file.c b/drivers/target/target_core_file.c
index d545993df18b..29f807b29e74 100644
--- a/drivers/target/target_core_file.c
+++ b/drivers/target/target_core_file.c
@@ -594,8 +594,7 @@ fd_execute_rw(struct se_cmd *cmd, struct scatterlist *sgl, u32 sgl_nents,
         if (ret < 0)
                 return TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
 
-        if (ret)
-                target_complete_cmd(cmd, SAM_STAT_GOOD);
+        target_complete_cmd(cmd, SAM_STAT_GOOD);
         return 0;
 }
 
diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c
index a53fb23a0411..b3b1461ec60d 100644
--- a/drivers/target/target_core_sbc.c
+++ b/drivers/target/target_core_sbc.c
@@ -506,8 +506,11 @@ static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool succes
          * been failed with a non-zero SCSI status.
          */
         if (cmd->scsi_status) {
-                pr_err("compare_and_write_callback: non zero scsi_status:"
+                pr_debug("compare_and_write_callback: non zero scsi_status:"
                         " 0x%02x\n", cmd->scsi_status);
+                *post_ret = 1;
+                if (cmd->scsi_status == SAM_STAT_CHECK_CONDITION)
+                        ret = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE;
                 goto out;
         }
 
diff --git a/drivers/tty/pty.c b/drivers/tty/pty.c
index a23fa5ed1d67..2b907385b4a8 100644
--- a/drivers/tty/pty.c
+++ b/drivers/tty/pty.c
@@ -216,16 +216,11 @@ static int pty_signal(struct tty_struct *tty, int sig)
 static void pty_flush_buffer(struct tty_struct *tty)
 {
         struct tty_struct *to = tty->link;
-        struct tty_ldisc *ld;
 
         if (!to)
                 return;
 
-        ld = tty_ldisc_ref(to);
-        tty_buffer_flush(to, ld);
-        if (ld)
-                tty_ldisc_deref(ld);
-
+        tty_buffer_flush(to, NULL);
         if (to->packet) {
                 spin_lock_irq(&tty->ctrl_lock);
                 tty->ctrl_status |= TIOCPKT_FLUSHWRITE;
diff --git a/drivers/tty/serial/omap-serial.c b/drivers/tty/serial/omap-serial.c
index a2a529994ba5..44e5b5bf713b 100644
--- a/drivers/tty/serial/omap-serial.c
+++ b/drivers/tty/serial/omap-serial.c
@@ -1712,7 +1712,8 @@ static int serial_omap_probe(struct platform_device *pdev)
         return 0;
 
 err_add_port:
-        pm_runtime_put(&pdev->dev);
+        pm_runtime_dont_use_autosuspend(&pdev->dev);
+        pm_runtime_put_sync(&pdev->dev);
         pm_runtime_disable(&pdev->dev);
         pm_qos_remove_request(&up->pm_qos_request);
         device_init_wakeup(up->dev, false);
@@ -1725,9 +1726,13 @@ static int serial_omap_remove(struct platform_device *dev)
 {
         struct uart_omap_port *up = platform_get_drvdata(dev);
 
+        pm_runtime_get_sync(up->dev);
+
+        uart_remove_one_port(&serial_omap_reg, &up->port);
+
+        pm_runtime_dont_use_autosuspend(up->dev);
         pm_runtime_put_sync(up->dev);
         pm_runtime_disable(up->dev);
-        uart_remove_one_port(&serial_omap_reg, &up->port);
         pm_qos_remove_request(&up->pm_qos_request);
         device_init_wakeup(&dev->dev, false);
 
diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c
index 3e2ef4fd7382..d65f92bcd0f1 100644
--- a/drivers/tty/serial/samsung.c
+++ b/drivers/tty/serial/samsung.c
@@ -906,14 +906,13 @@ static int s3c24xx_serial_request_dma(struct s3c24xx_uart_port *p)
                 return -ENOMEM;
         }
 
-        dma->rx_addr = dma_map_single(dma->rx_chan->device->dev, dma->rx_buf,
+        dma->rx_addr = dma_map_single(p->port.dev, dma->rx_buf,
                                 dma->rx_size, DMA_FROM_DEVICE);
 
         spin_lock_irqsave(&p->port.lock, flags);
 
         /* TX buffer */
-        dma->tx_addr = dma_map_single(dma->tx_chan->device->dev,
-                                p->port.state->xmit.buf,
+        dma->tx_addr = dma_map_single(p->port.dev, p->port.state->xmit.buf,
                                 UART_XMIT_SIZE, DMA_TO_DEVICE);
 
         spin_unlock_irqrestore(&p->port.lock, flags);
@@ -927,7 +926,7 @@ static void s3c24xx_serial_release_dma(struct s3c24xx_uart_port *p)
 
         if (dma->rx_chan) {
                 dmaengine_terminate_all(dma->rx_chan);
-                dma_unmap_single(dma->rx_chan->device->dev, dma->rx_addr,
+                dma_unmap_single(p->port.dev, dma->rx_addr,
                                 dma->rx_size, DMA_FROM_DEVICE);
                 kfree(dma->rx_buf);
                 dma_release_channel(dma->rx_chan);
@@ -936,7 +935,7 @@ static void s3c24xx_serial_release_dma(struct s3c24xx_uart_port *p)
 
         if (dma->tx_chan) {
                 dmaengine_terminate_all(dma->tx_chan);
-                dma_unmap_single(dma->tx_chan->device->dev, dma->tx_addr,
+                dma_unmap_single(p->port.dev, dma->tx_addr,
                                 UART_XMIT_SIZE, DMA_TO_DEVICE);
                 dma_release_channel(dma->tx_chan);
                 dma->tx_chan = NULL;
diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
index 0a6369510f2d..0b845e550fbd 100644
--- a/drivers/usb/class/cdc-wdm.c
+++ b/drivers/usb/class/cdc-wdm.c
@@ -58,7 +58,6 @@ MODULE_DEVICE_TABLE (usb, wdm_ids);
 #define WDM_SUSPENDING          8
 #define WDM_RESETTING           9
 #define WDM_OVERFLOW            10
-#define WDM_DRAIN_ON_OPEN       11
 
 #define WDM_MAX                 16
 
@@ -182,7 +181,7 @@ static void wdm_in_callback(struct urb *urb)
                                 "nonzero urb status received: -ESHUTDOWN\n");
                         goto skip_error;
                 case -EPIPE:
-                        dev_dbg(&desc->intf->dev,
+                        dev_err(&desc->intf->dev,
                                 "nonzero urb status received: -EPIPE\n");
                         break;
                 default:
@@ -210,25 +209,6 @@ static void wdm_in_callback(struct urb *urb)
                         desc->reslength = length;
                 }
         }
-
-        /*
-         * Handling devices with the WDM_DRAIN_ON_OPEN flag set:
-         * If desc->resp_count is unset, then the urb was submitted
-         * without a prior notification.  If the device returned any
-         * data, then this implies that it had messages queued without
-         * notifying us.  Continue reading until that queue is flushed.
-         */
-        if (!desc->resp_count) {
-                if (!length) {
-                        /* do not propagate the expected -EPIPE */
-                        desc->rerr = 0;
-                        goto unlock;
-                }
-                dev_dbg(&desc->intf->dev, "got %d bytes without notification\n", length);
-                set_bit(WDM_RESPONDING, &desc->flags);
-                usb_submit_urb(desc->response, GFP_ATOMIC);
-        }
-
 skip_error:
         set_bit(WDM_READ, &desc->flags);
         wake_up(&desc->wait);
@@ -243,7 +223,6 @@ skip_error:
                 service_outstanding_interrupt(desc);
         }
 
-unlock:
         spin_unlock(&desc->iuspin);
 }
 
@@ -686,17 +665,6 @@ static int wdm_open(struct inode *inode, struct file *file)
                         dev_err(&desc->intf->dev,
                                 "Error submitting int urb - %d\n", rv);
                         rv = usb_translate_errors(rv);
-                } else if (test_bit(WDM_DRAIN_ON_OPEN, &desc->flags)) {
-                        /*
-                         * Some devices keep pending messages queued
-                         * without resending notifications.  We must
-                         * flush the message queue before we can
-                         * assume a one-to-one relationship between
-                         * notifications and messages in the queue
-                         */
-                        dev_dbg(&desc->intf->dev, "draining queued data\n");
-                        set_bit(WDM_RESPONDING, &desc->flags);
-                        rv = usb_submit_urb(desc->response, GFP_KERNEL);
                 }
         } else {
                 rv = 0;
@@ -803,8 +771,7 @@ static void wdm_rxwork(struct work_struct *work)
 /* --- hotplug --- */
 
 static int wdm_create(struct usb_interface *intf, struct usb_endpoint_descriptor *ep,
-                u16 bufsize, int (*manage_power)(struct usb_interface *, int),
-                bool drain_on_open)
+                u16 bufsize, int (*manage_power)(struct usb_interface *, int))
 {
         int rv = -ENOMEM;
         struct wdm_device *desc;
@@ -891,68 +858,6 @@ static int wdm_create(struct usb_interface *intf, struct usb_endpoint_descriptor
 
         desc->manage_power = manage_power;
 
-        /*
-         * "drain_on_open" enables a hack to work around a firmware
-         * issue observed on network functions, in particular MBIM
-         * functions.
-         *
-         * Quoting section 7 of the CDC-WMC r1.1 specification:
-         *
-         *  "The firmware shall interpret GetEncapsulatedResponse as a
-         *   request to read response bytes. The firmware shall send
-         *   the next wLength bytes from the response. The firmware
-         *   shall allow the host to retrieve data using any number of
-         *   GetEncapsulatedResponse requests. The firmware shall
-         *   return a zero- length reply if there are no data bytes
-         *   available.
-         *
-         *   The firmware shall send ResponseAvailable notifications
-         *   periodically, using any appropriate algorithm, to inform
-         *   the host that there is data available in the reply
-         *   buffer. The firmware is allowed to send ResponseAvailable
-         *   notifications even if there is no data available, but
-         *   this will obviously reduce overall performance."
-         *
-         * These requirements, although they make equally sense, are
-         * often not implemented by network functions. Some firmwares
-         * will queue data indefinitely, without ever resending a
-         * notification. The result is that the driver and firmware
-         * loses "syncronization" if the driver ever fails to respond
-         * to a single notification, something which easily can happen
-         * on release(). When this happens, the driver will appear to
-         * never receive notifications for the most current data. Each
-         * notification will only cause a single read, which returns
-         * the oldest data in the firmware's queue.
-         *
-         * The "drain_on_open" hack resolves the situation by draining
-         * data from the firmware until none is returned, without a
-         * prior notification.
-         *
-         * This will inevitably race with the firmware, risking that
-         * we read data from the device before handling the associated
-         * notification. To make things worse, some of the devices
-         * needing the hack do not implement the "return zero if no
-         * data is available" requirement either. Instead they return
-         * an error on the subsequent read in this case.  This means
-         * that "winning" the race can cause an unexpected EIO to
-         * userspace.
-         *
-         * "winning" the race is more likely on resume() than on
-         * open(), and the unexpected error is more harmful in the
-         * middle of an open session. The hack is therefore only
-         * applied on open(), and not on resume() where it logically
-         * would be equally necessary. So we define open() as the only
-         * driver <-> device "syncronization point".  Should we happen
-         * to lose a notification after open(), then syncronization
-         * will be lost until release()
-         *
-         * The hack should not be enabled for CDC WDM devices
-         * conforming to the CDC-WMC r1.1 specification.  This is
-         * ensured by setting drain_on_open to false in wdm_probe().
-         */
-        if (drain_on_open)
-                set_bit(WDM_DRAIN_ON_OPEN, &desc->flags);
-
         spin_lock(&wdm_device_list_lock);
         list_add(&desc->device_list, &wdm_device_list);
         spin_unlock(&wdm_device_list_lock);
@@ -1006,7 +911,7 @@ static int wdm_probe(struct usb_interface *intf, const struct usb_device_id *id)
                 goto err;
         ep = &iface->endpoint[0].desc;
 
-        rv = wdm_create(intf, ep, maxcom, &wdm_manage_power, false);
+        rv = wdm_create(intf, ep, maxcom, &wdm_manage_power);
 
 err:
         return rv;
@@ -1038,7 +943,7 @@ struct usb_driver *usb_cdc_wdm_register(struct usb_interface *intf,
 {
         int rv = -EINVAL;
 
-        rv = wdm_create(intf, ep, bufsize, manage_power, true);
+        rv = wdm_create(intf, ep, bufsize, manage_power);
         if (rv < 0)
                 goto err;
 
diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c
index dadd1e8dfe09..0bb380a9fcf7 100644
--- a/drivers/usb/core/driver.c
+++ b/drivers/usb/core/driver.c
@@ -1328,6 +1328,24 @@ static int usb_suspend_both(struct usb_device *udev, pm_message_t msg)
                  */
                 if (udev->parent && !PMSG_IS_AUTO(msg))
                         status = 0;
+
+                /*
+                 * If the device is inaccessible, don't try to resume
+                 * suspended interfaces and just return the error.
+                 */
+                if (status && status != -EBUSY) {
+                        int err;
+                        u16 devstat;
+
+                        err = usb_get_status(udev, USB_RECIP_DEVICE, 0,
+                                             &devstat);
+                        if (err) {
+                                dev_err(&udev->dev,
+                                        "Failed to suspend device, error %d\n",
+                                        status);
+                                goto done;
+                        }
+                }
         }
 
         /* If the suspend failed, resume interfaces that did get suspended */
@@ -1760,6 +1778,9 @@ static int autosuspend_check(struct usb_device *udev)
         int                     w, i;
         struct usb_interface    *intf;
 
+        if (udev->state == USB_STATE_NOTATTACHED)
+                return -ENODEV;
+
         /* Fail if autosuspend is disabled, or any interfaces are in use, or
          * any interface drivers require remote wakeup but it isn't available.
          */
diff --git a/drivers/usb/core/file.c b/drivers/usb/core/file.c
index 822ced9639aa..422ce7b20d73 100644
--- a/drivers/usb/core/file.c
+++ b/drivers/usb/core/file.c
@@ -27,6 +27,7 @@
 #define MAX_USB_MINORS  256
 static const struct file_operations *usb_minors[MAX_USB_MINORS];
 static DECLARE_RWSEM(minor_rwsem);
+static DEFINE_MUTEX(init_usb_class_mutex);
 
 static int usb_open(struct inode *inode, struct file *file)
 {
@@ -109,8 +110,9 @@ static void release_usb_class(struct kref *kref)
 
 static void destroy_usb_class(void)
 {
-        if (usb_class)
-                kref_put(&usb_class->kref, release_usb_class);
+        mutex_lock(&init_usb_class_mutex);
+        kref_put(&usb_class->kref, release_usb_class);
+        mutex_unlock(&init_usb_class_mutex);
 }
 
 int usb_major_init(void)
@@ -171,7 +173,10 @@ int usb_register_dev(struct usb_interface *intf,
         if (intf->minor >= 0)
                 return -EADDRINUSE;
 
+        mutex_lock(&init_usb_class_mutex);
         retval = init_usb_class();
+        mutex_unlock(&init_usb_class_mutex);
+
         if (retval)
                 return retval;
 
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 35fb2bef0e45..579900640faa 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -1064,6 +1064,9 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
 
                 portstatus = portchange = 0;
                 status = hub_port_status(hub, port1, &portstatus, &portchange);
+                if (status)
+                        goto abort;
+
                 if (udev || (portstatus & USB_PORT_STAT_CONNECTION))
                         dev_dbg(&port_dev->dev, "status %04x change %04x\n",
                                         portstatus, portchange);
@@ -1196,7 +1199,7 @@ static void hub_activate(struct usb_hub *hub, enum hub_activation_type type)
 
         /* Scan all ports that need attention */
         kick_hub_wq(hub);
-
+ abort:
         if (type == HUB_INIT2 || type == HUB_INIT3) {
                 /* Allow autosuspend if it was suppressed */
  disconnected:
@@ -2082,6 +2085,12 @@ void usb_disconnect(struct usb_device **pdev)
         dev_info(&udev->dev, "USB disconnect, device number %d\n",
                         udev->devnum);
 
+        /*
+         * Ensure that the pm runtime code knows that the USB device
+         * is in the process of being disconnected.
+         */
+        pm_runtime_barrier(&udev->dev);
+
         usb_lock_device(udev);
 
         hub_disconnect_children(udev);
diff --git a/drivers/usb/gadget/Kconfig b/drivers/usb/gadget/Kconfig
index 3684775677eb..f6cce5ac69c5 100644
--- a/drivers/usb/gadget/Kconfig
+++ b/drivers/usb/gadget/Kconfig
@@ -510,6 +510,7 @@ config USB_CONFIGFS_F_TCM
 choice
         tristate "USB Gadget Drivers"
         default USB_ETH
+        optional
         help
           A Linux "Gadget Driver" talks to the USB Peripheral Controller
           driver through the abstract "gadget" API.  Some other operating
diff --git a/drivers/usb/gadget/function/f_mtp.c b/drivers/usb/gadget/function/f_mtp.c
index d6aa2ea0efc8..9515b2a7d0e0 100644
--- a/drivers/usb/gadget/function/f_mtp.c
+++ b/drivers/usb/gadget/function/f_mtp.c
@@ -541,14 +541,10 @@ static ssize_t mtp_read(struct file *fp, char __user *buf,
         ssize_t r = count;
         unsigned xfer;
         int ret = 0;
-        size_t len;
+        size_t len = 0;
 
         DBG(cdev, "mtp_read(%zu)\n", count);
 
-        len = usb_ep_align_maybe(cdev->gadget, dev->ep_out, count);
-        if (len > MTP_BULK_BUFFER_SIZE)
-                return -EINVAL;
-
         /* we will block until we're online */
         DBG(cdev, "mtp_read: waiting for online state\n");
         ret = wait_event_interruptible(dev->read_wq,
@@ -558,6 +554,14 @@ static ssize_t mtp_read(struct file *fp, char __user *buf,
                 goto done;
         }
         spin_lock_irq(&dev->lock);
+        if (dev->ep_out->desc) {
+                len = usb_ep_align_maybe(cdev->gadget, dev->ep_out, count);
+                if (len > MTP_BULK_BUFFER_SIZE) {
+                        spin_unlock_irq(&dev->lock);
+                        return -EINVAL;
+                }
+        }
+
         if (dev->state == STATE_CANCELED) {
                 /* report cancelation to userspace */
                 dev->state = STATE_READY;
@@ -873,6 +877,10 @@ static void receive_file_work(struct work_struct *data)
                                         usb_ep_dequeue(dev->ep_out, read_req);
                                 break;
                         }
+                        if (read_req->status) {
+                                r = read_req->status;
+                                break;
+                        }
                         /* if xfer_file_length is 0xFFFFFFFF, then we read until
                          * we get a zero length packet
                          */
diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
index d461560212c1..7767fce64adf 100644
--- a/drivers/usb/host/xhci-mem.c
+++ b/drivers/usb/host/xhci-mem.c
@@ -1494,6 +1494,17 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
          */
         max_esit_payload = xhci_get_max_esit_payload(udev, ep);
         interval = xhci_get_endpoint_interval(udev, ep);
+
+        /* Periodic endpoint bInterval limit quirk */
+        if (usb_endpoint_xfer_int(&ep->desc) ||
+            usb_endpoint_xfer_isoc(&ep->desc)) {
+                if ((xhci->quirks & XHCI_LIMIT_ENDPOINT_INTERVAL_7) &&
+                    udev->speed >= USB_SPEED_HIGH &&
+                    interval >= 7) {
+                        interval = 6;
+                }
+        }
+
         mult = xhci_get_endpoint_mult(udev, ep);
         max_packet = GET_MAX_PACKET(usb_endpoint_maxp(&ep->desc));
         max_burst = xhci_get_endpoint_max_burst(udev, ep);
@@ -2475,7 +2486,7 @@ int xhci_mem_init(struct xhci_hcd *xhci, gfp_t flags)
                 (xhci->cmd_ring->first_seg->dma & (u64) ~CMD_RING_RSVD_BITS) |
                 xhci->cmd_ring->cycle_state;
         xhci_dbg_trace(xhci, trace_xhci_dbg_init,
-                        "// Setting command ring address to 0x%x", val);
+                        "// Setting command ring address to 0x%016llx", val_64);
         xhci_write_64(xhci, val_64, &xhci->op_regs->cmd_ring);
         xhci_dbg_cmd_ptrs(xhci);
 
diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
index 954abfd5014d..93f566cb968b 100644
--- a/drivers/usb/host/xhci-pci.c
+++ b/drivers/usb/host/xhci-pci.c
@@ -199,6 +199,9 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
                         pdev->device == 0x1042)
                 xhci->quirks |= XHCI_BROKEN_STREAMS;
 
+        if (pdev->vendor == PCI_VENDOR_ID_TI && pdev->device == 0x8241)
+                xhci->quirks |= XHCI_LIMIT_ENDPOINT_INTERVAL_7;
+
         if (xhci->quirks & XHCI_RESET_ON_RESUME)
                 xhci_dbg_trace(xhci, trace_xhci_dbg_quirks,
                                 "QUIRK: Resetting on resume");
diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
index f97b009ffc40..328fe06752ec 100644
--- a/drivers/usb/host/xhci.h
+++ b/drivers/usb/host/xhci.h
@@ -1659,6 +1659,7 @@ struct xhci_hcd {
 #define XHCI_MISSING_CAS        (1 << 24)
 /* For controller with a broken Port Disable implementation */
 #define XHCI_BROKEN_PORT_PED    (1 << 25)
+#define XHCI_LIMIT_ENDPOINT_INTERVAL_7  (1 << 26)
 
         unsigned int            num_active_eps;
         unsigned int            limit_active_eps;
diff --git a/drivers/usb/misc/usbtest.c b/drivers/usb/misc/usbtest.c
index 5c8210dc6fd9..d94927e5623b 100644
--- a/drivers/usb/misc/usbtest.c
+++ b/drivers/usb/misc/usbtest.c
@@ -159,6 +159,7 @@ get_endpoints(struct usbtest_dev *dev, struct usb_interface *intf)
                         case USB_ENDPOINT_XFER_INT:
                                 if (dev->info->intr)
                                         goto try_intr;
+                                continue;
                         case USB_ENDPOINT_XFER_ISOC:
                                 if (dev->info->iso)
                                         goto try_iso;
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index d8d13eede6d9..1dc75db16cbd 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -873,6 +873,7 @@ static const struct usb_device_id id_table_combined[] = {
         { USB_DEVICE_AND_INTERFACE_INFO(MICROCHIP_VID, MICROCHIP_USB_BOARD_PID,
                                         USB_CLASS_VENDOR_SPEC,
                                         USB_SUBCLASS_VENDOR_SPEC, 0x00) },
+        { USB_DEVICE_INTERFACE_NUMBER(ACTEL_VID, MICROSEMI_ARROW_SF2PLUS_BOARD_PID, 2) },
         { USB_DEVICE(JETI_VID, JETI_SPC1201_PID) },
         { USB_DEVICE(MARVELL_VID, MARVELL_SHEEVAPLUG_PID),
                 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
index 48ee04c94a75..71fb9e59db71 100644
--- a/drivers/usb/serial/ftdi_sio_ids.h
+++ b/drivers/usb/serial/ftdi_sio_ids.h
@@ -873,6 +873,12 @@
 #define FIC_VID                 0x1457
 #define FIC_NEO1973_DEBUG_PID   0x5118
 
+/*
+ * Actel / Microsemi
+ */
+#define ACTEL_VID                               0x1514
+#define MICROSEMI_ARROW_SF2PLUS_BOARD_PID       0x2008
+
 /* Olimex */
 #define OLIMEX_VID                      0x15BA
 #define OLIMEX_ARM_USB_OCD_PID          0x0003
diff --git a/drivers/vfio/vfio_iommu_type1.c b/drivers/vfio/vfio_iommu_type1.c
index 2ba19424e4a1..1d48e62f4f52 100644
--- a/drivers/vfio/vfio_iommu_type1.c
+++ b/drivers/vfio/vfio_iommu_type1.c
@@ -130,57 +130,36 @@ static void vfio_unlink_dma(struct vfio_iommu *iommu, struct vfio_dma *old)
         rb_erase(&old->node, &iommu->dma_list);
 }
 
-struct vwork {
-        struct mm_struct        *mm;
-        long                    npage;
-        struct work_struct      work;
-};
-
-/* delayed decrement/increment for locked_vm */
-static void vfio_lock_acct_bg(struct work_struct *work)
+static int vfio_lock_acct(long npage, bool *lock_cap)
 {
-        struct vwork *vwork = container_of(work, struct vwork, work);
-        struct mm_struct *mm;
-
-        mm = vwork->mm;
-        down_write(&mm->mmap_sem);
-        mm->locked_vm += vwork->npage;
-        up_write(&mm->mmap_sem);
-        mmput(mm);
-        kfree(vwork);
-}
+        int ret;
 
-static void vfio_lock_acct(long npage)
-{
-        struct vwork *vwork;
-        struct mm_struct *mm;
+        if (!npage)
+                return 0;
 
-        if (!current->mm || !npage)
-                return; /* process exited or nothing to do */
+        if (!current->mm)
+                return -ESRCH; /* process exited */
+
+        ret = down_write_killable(&current->mm->mmap_sem);
+        if (!ret) {
+                if (npage > 0) {
+                        if (lock_cap ? !*lock_cap : !capable(CAP_IPC_LOCK)) {
+                                unsigned long limit;
+
+                                limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
+
+                                if (current->mm->locked_vm + npage > limit)
+                                        ret = -ENOMEM;
+                        }
+                }
+
+                if (!ret)
+                        current->mm->locked_vm += npage;
 
-        if (down_write_trylock(&current->mm->mmap_sem)) {
-                current->mm->locked_vm += npage;
                 up_write(&current->mm->mmap_sem);
-                return;
         }
 
-        /*
-         * Couldn't get mmap_sem lock, so must setup to update
-         * mm->locked_vm later. If locked_vm were atomic, we
-         * wouldn't need this silliness
-         */
-        vwork = kmalloc(sizeof(struct vwork), GFP_KERNEL);
-        if (!vwork)
-                return;
-        mm = get_task_mm(current);
-        if (!mm) {
-                kfree(vwork);
-                return;
-        }
-        INIT_WORK(&vwork->work, vfio_lock_acct_bg);
-        vwork->mm = mm;
-        vwork->npage = npage;
-        schedule_work(&vwork->work);
+        return ret;
 }
 
 /*
@@ -262,9 +241,9 @@ static int vaddr_get_pfn(unsigned long vaddr, int prot, unsigned long *pfn)
 static long vfio_pin_pages(unsigned long vaddr, long npage,
                            int prot, unsigned long *pfn_base)
 {
-        unsigned long limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
+        unsigned long pfn = 0, limit = rlimit(RLIMIT_MEMLOCK) >> PAGE_SHIFT;
         bool lock_cap = capable(CAP_IPC_LOCK);
-        long ret, i;
+        long ret, i = 1;
         bool rsvd;
 
         if (!current->mm)
@@ -283,16 +262,11 @@ static long vfio_pin_pages(unsigned long vaddr, long npage,
                 return -ENOMEM;
         }
 
-        if (unlikely(disable_hugepages)) {
-                if (!rsvd)
-                        vfio_lock_acct(1);
-                return 1;
-        }
+        if (unlikely(disable_hugepages))
+                goto out;
 
         /* Lock all the consecutive pages from pfn_base */
-        for (i = 1, vaddr += PAGE_SIZE; i < npage; i++, vaddr += PAGE_SIZE) {
-                unsigned long pfn = 0;
-
+        for (vaddr += PAGE_SIZE; i < npage; i++, vaddr += PAGE_SIZE) {
                 ret = vaddr_get_pfn(vaddr, prot, &pfn);
                 if (ret)
                         break;
@@ -308,12 +282,24 @@ static long vfio_pin_pages(unsigned long vaddr, long npage,
                         put_pfn(pfn, prot);
                         pr_warn("%s: RLIMIT_MEMLOCK (%ld) exceeded\n",
                                 __func__, limit << PAGE_SHIFT);
-                        break;
+                        ret = -ENOMEM;
+                        goto unpin_out;
                 }
         }
 
+out:
         if (!rsvd)
-                vfio_lock_acct(i);
+                ret = vfio_lock_acct(i, &lock_cap);
+
+unpin_out:
+        if (ret) {
+                if (!rsvd) {
+                        for (pfn = *pfn_base ; i ; pfn++, i--)
+                                put_pfn(pfn, prot);
+                }
+
+                return ret;
+        }
 
         return i;
 }
@@ -328,7 +314,7 @@ static long vfio_unpin_pages(unsigned long pfn, long npage,
                 unlocked += put_pfn(pfn++, prot);
 
         if (do_accounting)
-                vfio_lock_acct(-unlocked);
+                vfio_lock_acct(-unlocked, NULL);
 
         return unlocked;
 }
@@ -390,7 +376,7 @@ static void vfio_unmap_unpin(struct vfio_iommu *iommu, struct vfio_dma *dma)
                 cond_resched();
         }
 
-        vfio_lock_acct(-unlocked);
+        vfio_lock_acct(-unlocked, NULL);
 }
 
 static void vfio_remove_dma(struct vfio_iommu *iommu, struct vfio_dma *dma)
diff --git a/fs/block_dev.c b/fs/block_dev.c
index 9ad527ff9974..2924bddb4a94 100644
--- a/fs/block_dev.c
+++ b/fs/block_dev.c
@@ -102,12 +102,11 @@ void invalidate_bdev(struct block_device *bdev)
 {
         struct address_space *mapping = bdev->bd_inode->i_mapping;
 
-        if (mapping->nrpages == 0)
-                return;
-
-        invalidate_bh_lrus();
-        lru_add_drain_all();    /* make sure all lru add caches are flushed */
-        invalidate_mapping_pages(mapping, 0, -1);
+        if (mapping->nrpages) {
+                invalidate_bh_lrus();
+                lru_add_drain_all();    /* make sure all lru add caches are flushed */
+                invalidate_mapping_pages(mapping, 0, -1);
+        }
         /* 99% of the time, we don't need to flush the cleancache on the bdev.
          * But, for the strange corners, lets be cautious
          */
diff --git a/fs/ceph/xattr.c b/fs/ceph/xattr.c
index febc28f9e2c2..75267cdd5dfd 100644
--- a/fs/ceph/xattr.c
+++ b/fs/ceph/xattr.c
@@ -392,6 +392,7 @@ static int __set_xattr(struct ceph_inode_info *ci,
 
         if (update_xattr) {
                 int err = 0;
+
                 if (xattr && (flags & XATTR_CREATE))
                         err = -EEXIST;
                 else if (!xattr && (flags & XATTR_REPLACE))
@@ -399,12 +400,14 @@ static int __set_xattr(struct ceph_inode_info *ci,
                 if (err) {
                         kfree(name);
                         kfree(val);
+                        kfree(*newxattr);
                         return err;
                 }
                 if (update_xattr < 0) {
                         if (xattr)
                                 __remove_xattr(ci, xattr);
                         kfree(name);
+                        kfree(*newxattr);
                         return 0;
                 }
         }
diff --git a/fs/cifs/cifs_unicode.c b/fs/cifs/cifs_unicode.c
index 02b071bf3732..a0b3e7d1be48 100644
--- a/fs/cifs/cifs_unicode.c
+++ b/fs/cifs/cifs_unicode.c
@@ -83,6 +83,9 @@ convert_sfm_char(const __u16 src_char, char *target)
         case SFM_COLON:
                 *target = ':';
                 break;
+        case SFM_DOUBLEQUOTE:
+                *target = '"';
+                break;
         case SFM_ASTERISK:
                 *target = '*';
                 break;
@@ -418,6 +421,9 @@ static __le16 convert_to_sfm_char(char src_char, bool end_of_string)
         case ':':
                 dest_char = cpu_to_le16(SFM_COLON);
                 break;
+        case '"':
+                dest_char = cpu_to_le16(SFM_DOUBLEQUOTE);
+                break;
         case '*':
                 dest_char = cpu_to_le16(SFM_ASTERISK);
                 break;
diff --git a/fs/cifs/cifs_unicode.h b/fs/cifs/cifs_unicode.h
index 479bc0a941f3..07ade707fa60 100644
--- a/fs/cifs/cifs_unicode.h
+++ b/fs/cifs/cifs_unicode.h
@@ -57,6 +57,7 @@
  * not conflict (although almost does) with the mapping above.
  */
 
+#define SFM_DOUBLEQUOTE ((__u16) 0xF020)
 #define SFM_ASTERISK    ((__u16) 0xF021)
 #define SFM_QUESTION    ((__u16) 0xF025)
 #define SFM_COLON       ((__u16) 0xF022)
@@ -64,8 +65,8 @@
 #define SFM_LESSTHAN    ((__u16) 0xF023)
 #define SFM_PIPE        ((__u16) 0xF027)
 #define SFM_SLASH       ((__u16) 0xF026)
-#define SFM_PERIOD      ((__u16) 0xF028)
-#define SFM_SPACE       ((__u16) 0xF029)
+#define SFM_SPACE       ((__u16) 0xF028)
+#define SFM_PERIOD      ((__u16) 0xF029)
 
 /*
  * Mapping mechanism to use when one of the seven reserved characters is
diff --git a/fs/cifs/cifsfs.c b/fs/cifs/cifsfs.c
index 15261ba464c5..c0c253005b76 100644
--- a/fs/cifs/cifsfs.c
+++ b/fs/cifs/cifsfs.c
@@ -87,6 +87,7 @@ extern mempool_t *cifs_req_poolp;
 extern mempool_t *cifs_mid_poolp;
 
 struct workqueue_struct *cifsiod_wq;
+struct workqueue_struct *cifsoplockd_wq;
 __u32 cifs_lock_secret;
 
 /*
@@ -1283,9 +1284,16 @@ init_cifs(void)
                 goto out_clean_proc;
         }
 
+        cifsoplockd_wq = alloc_workqueue("cifsoplockd",
+                                         WQ_FREEZABLE|WQ_MEM_RECLAIM, 0);
+        if (!cifsoplockd_wq) {
+                rc = -ENOMEM;
+                goto out_destroy_cifsiod_wq;
+        }
+
         rc = cifs_fscache_register();
         if (rc)
-                goto out_destroy_wq;
+                goto out_destroy_cifsoplockd_wq;
 
         rc = cifs_init_inodecache();
         if (rc)
@@ -1333,7 +1341,9 @@ out_destroy_inodecache:
         cifs_destroy_inodecache();
 out_unreg_fscache:
         cifs_fscache_unregister();
-out_destroy_wq:
+out_destroy_cifsoplockd_wq:
+        destroy_workqueue(cifsoplockd_wq);
+out_destroy_cifsiod_wq:
         destroy_workqueue(cifsiod_wq);
 out_clean_proc:
         cifs_proc_clean();
@@ -1356,6 +1366,7 @@ exit_cifs(void)
         cifs_destroy_mids();
         cifs_destroy_inodecache();
         cifs_fscache_unregister();
+        destroy_workqueue(cifsoplockd_wq);
         destroy_workqueue(cifsiod_wq);
         cifs_proc_clean();
 }
diff --git a/fs/cifs/cifsglob.h b/fs/cifs/cifsglob.h
index b3830f7ab260..48ef401c3c61 100644
--- a/fs/cifs/cifsglob.h
+++ b/fs/cifs/cifsglob.h
@@ -1651,6 +1651,7 @@ void cifs_oplock_break(struct work_struct *work);
 
 extern const struct slow_work_ops cifs_oplock_break_ops;
 extern struct workqueue_struct *cifsiod_wq;
+extern struct workqueue_struct *cifsoplockd_wq;
 extern __u32 cifs_lock_secret;
 
 extern mempool_t *cifs_mid_poolp;
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 586fdac05ec2..1f91c9dadd5b 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -717,6 +717,9 @@ CIFSSMBEcho(struct TCP_Server_Info *server)
         if (rc)
                 return rc;
 
+        if (server->capabilities & CAP_UNICODE)
+                smb->hdr.Flags2 |= SMBFLG2_UNICODE;
+
         /* set up echo request */
         smb->hdr.Tid = 0xffff;
         smb->hdr.WordCount = 1;
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index b8015de88e8c..1a545695f547 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2839,16 +2839,14 @@ match_prepath(struct super_block *sb, struct cifs_mnt_data *mnt_data)
 {
         struct cifs_sb_info *old = CIFS_SB(sb);
         struct cifs_sb_info *new = mnt_data->cifs_sb;
+        bool old_set = old->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH;
+        bool new_set = new->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH;
 
-        if (old->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH) {
-                if (!(new->mnt_cifs_flags & CIFS_MOUNT_USE_PREFIX_PATH))
-                        return 0;
-                /* The prepath should be null terminated strings */
-                if (strcmp(new->prepath, old->prepath))
-                        return 0;
-
+        if (old_set && new_set && !strcmp(new->prepath, old->prepath))
                 return 1;
-        }
+        else if (!old_set && !new_set)
+                return 1;
+
         return 0;
 }
 
diff --git a/fs/cifs/ioctl.c b/fs/cifs/ioctl.c
index 001528781b6b..bdba9e7a9438 100644
--- a/fs/cifs/ioctl.c
+++ b/fs/cifs/ioctl.c
@@ -264,10 +264,14 @@ long cifs_ioctl(struct file *filep, unsigned int command, unsigned long arg)
                                 rc = -EOPNOTSUPP;
                         break;
                 case CIFS_IOC_GET_MNT_INFO:
+                        if (pSMBFile == NULL)
+                                break;
                         tcon = tlink_tcon(pSMBFile->tlink);
                         rc = smb_mnt_get_fsinfo(xid, tcon, (void __user *)arg);
                         break;
                 case CIFS_ENUMERATE_SNAPSHOTS:
+                        if (pSMBFile == NULL)
+                                break;
                         if (arg == 0) {
                                 rc = -EINVAL;
                                 goto cifs_ioc_exit;
diff --git a/fs/cifs/misc.c b/fs/cifs/misc.c
index c6729156f9a0..5419afea0a36 100644
--- a/fs/cifs/misc.c
+++ b/fs/cifs/misc.c
@@ -492,7 +492,7 @@ is_valid_oplock_break(char *buffer, struct TCP_Server_Info *srv)
                                            CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
                                            &pCifsInode->flags);
 
-                                queue_work(cifsiod_wq,
+                                queue_work(cifsoplockd_wq,
                                            &netfile->oplock_break);
                                 netfile->oplock_break_cancelled = false;
 
diff --git a/fs/cifs/smb2misc.c b/fs/cifs/smb2misc.c
index 97307808ae42..967dfe656ced 100644
--- a/fs/cifs/smb2misc.c
+++ b/fs/cifs/smb2misc.c
@@ -494,7 +494,7 @@ smb2_tcon_has_lease(struct cifs_tcon *tcon, struct smb2_lease_break *rsp,
                 else
                         cfile->oplock_break_cancelled = true;
 
-                queue_work(cifsiod_wq, &cfile->oplock_break);
+                queue_work(cifsoplockd_wq, &cfile->oplock_break);
                 kfree(lw);
                 return true;
         }
@@ -638,7 +638,8 @@ smb2_is_valid_oplock_break(char *buffer, struct TCP_Server_Info *server)
                                            CIFS_INODE_DOWNGRADE_OPLOCK_TO_L2,
                                            &cinode->flags);
                                 spin_unlock(&cfile->file_info_lock);
-                                queue_work(cifsiod_wq, &cfile->oplock_break);
+                                queue_work(cifsoplockd_wq,
+                                           &cfile->oplock_break);
 
                                 spin_unlock(&tcon->open_file_lock);
                                 spin_unlock(&cifs_tcp_ses_lock);
diff --git a/fs/cifs/smb2ops.c b/fs/cifs/smb2ops.c
index 007abf7195af..36334fe3266c 100644
--- a/fs/cifs/smb2ops.c
+++ b/fs/cifs/smb2ops.c
@@ -924,6 +924,7 @@ smb3_enum_snapshots(const unsigned int xid, struct cifs_tcon *tcon,
                 }
                 if (snapshot_in.snapshot_array_size < sizeof(struct smb_snapshot_array)) {
                         rc = -ERANGE;
+                        kfree(retbuf);
                         return rc;
                 }
 
diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c
index 802185386851..7c1c6c39d582 100644
--- a/fs/cifs/smb2pdu.c
+++ b/fs/cifs/smb2pdu.c
@@ -569,8 +569,12 @@ int smb3_validate_negotiate(const unsigned int xid, struct cifs_tcon *tcon)
         }
 
         if (rsplen != sizeof(struct validate_negotiate_info_rsp)) {
-                cifs_dbg(VFS, "invalid size of protocol negotiate response\n");
-                return -EIO;
+                cifs_dbg(VFS, "invalid protocol negotiate response size: %d\n",
+                         rsplen);
+
+                /* relax check since Mac returns max bufsize allowed on ioctl */
+                if (rsplen > CIFSMaxBufSize)
+                        return -EIO;
         }
 
         /* check validate negotiate info response matches what we got earlier */
@@ -1670,8 +1674,12 @@ SMB2_ioctl(const unsigned int xid, struct cifs_tcon *tcon, u64 persistent_fid,
          * than one credit. Windows typically sets this smaller, but for some
          * ioctls it may be useful to allow server to send more. No point
          * limiting what the server can send as long as fits in one credit
+         * Unfortunately - we can not handle more than CIFS_MAX_MSG_SIZE
+         * (by default, note that it can be overridden to make max larger)
+         * in responses (except for read responses which can be bigger.
+         * We may want to bump this limit up
          */
-        req->MaxOutputResponse = cpu_to_le32(0xFF00); /* < 64K uses 1 credit */
+        req->MaxOutputResponse = cpu_to_le32(CIFSMaxBufSize);
 
         if (is_fsctl)
                 req->Flags = cpu_to_le32(SMB2_0_IOCTL_IS_FSCTL);
diff --git a/fs/crypto/policy.c b/fs/crypto/policy.c
index abc18847b98d..bb4e209bd809 100644
--- a/fs/crypto/policy.c
+++ b/fs/crypto/policy.c
@@ -161,27 +161,61 @@ int fscrypt_get_policy(struct inode *inode, struct fscrypt_policy *policy)
 }
 EXPORT_SYMBOL(fscrypt_get_policy);
 
+/**
+ * fscrypt_has_permitted_context() - is a file's encryption policy permitted
+ *                                   within its directory?
+ *
+ * @parent: inode for parent directory
+ * @child: inode for file being looked up, opened, or linked into @parent
+ *
+ * Filesystems must call this before permitting access to an inode in a
+ * situation where the parent directory is encrypted (either before allowing
+ * ->lookup() to succeed, or for a regular file before allowing it to be opened)
+ * and before any operation that involves linking an inode into an encrypted
+ * directory, including link, rename, and cross rename.  It enforces the
+ * constraint that within a given encrypted directory tree, all files use the
+ * same encryption policy.  The pre-access check is needed to detect potentially
+ * malicious offline violations of this constraint, while the link and rename
+ * checks are needed to prevent online violations of this constraint.
+ *
+ * Return: 1 if permitted, 0 if forbidden.  If forbidden, the caller must fail
+ * the filesystem operation with EPERM.
+ */
 int fscrypt_has_permitted_context(struct inode *parent, struct inode *child)
 {
-        struct fscrypt_info *parent_ci, *child_ci;
+        const struct fscrypt_operations *cops = parent->i_sb->s_cop;
+        const struct fscrypt_info *parent_ci, *child_ci;
+        struct fscrypt_context parent_ctx, child_ctx;
         int res;
 
-        if ((parent == NULL) || (child == NULL)) {
-                printk(KERN_ERR "parent %p child %p\n", parent, child);
-                BUG_ON(1);
-        }
-
         /* No restrictions on file types which are never encrypted */
         if (!S_ISREG(child->i_mode) && !S_ISDIR(child->i_mode) &&
             !S_ISLNK(child->i_mode))
                 return 1;
 
-        /* no restrictions if the parent directory is not encrypted */
-        if (!parent->i_sb->s_cop->is_encrypted(parent))
+        /* No restrictions if the parent directory is unencrypted */
+        if (!cops->is_encrypted(parent))
                 return 1;
-        /* if the child directory is not encrypted, this is always a problem */
-        if (!parent->i_sb->s_cop->is_encrypted(child))
+
+        /* Encrypted directories must not contain unencrypted files */
+        if (!cops->is_encrypted(child))
                 return 0;
+
+        /*
+         * Both parent and child are encrypted, so verify they use the same
+         * encryption policy.  Compare the fscrypt_info structs if the keys are
+         * available, otherwise retrieve and compare the fscrypt_contexts.
+         *
+         * Note that the fscrypt_context retrieval will be required frequently
+         * when accessing an encrypted directory tree without the key.
+         * Performance-wise this is not a big deal because we already don't
+         * really optimize for file access without the key (to the extent that
+         * such access is even possible), given that any attempted access
+         * already causes a fscrypt_context retrieval and keyring search.
+         *
+         * In any case, if an unexpected error occurs, fall back to "forbidden".
+         */
+
         res = fscrypt_get_encryption_info(parent);
         if (res)
                 return 0;
@@ -190,17 +224,32 @@ int fscrypt_has_permitted_context(struct inode *parent, struct inode *child)
                 return 0;
         parent_ci = parent->i_crypt_info;
         child_ci = child->i_crypt_info;
-        if (!parent_ci && !child_ci)
-                return 1;
-        if (!parent_ci || !child_ci)
+
+        if (parent_ci && child_ci) {
+                return memcmp(parent_ci->ci_master_key, child_ci->ci_master_key,
+                              FS_KEY_DESCRIPTOR_SIZE) == 0 &&
+                        (parent_ci->ci_data_mode == child_ci->ci_data_mode) &&
+                        (parent_ci->ci_filename_mode ==
+                         child_ci->ci_filename_mode) &&
+                        (parent_ci->ci_flags == child_ci->ci_flags);
+        }
+
+        res = cops->get_context(parent, &parent_ctx, sizeof(parent_ctx));
+        if (res != sizeof(parent_ctx))
                 return 0;
 
-        return (memcmp(parent_ci->ci_master_key,
-                        child_ci->ci_master_key,
-                        FS_KEY_DESCRIPTOR_SIZE) == 0 &&
-                (parent_ci->ci_data_mode == child_ci->ci_data_mode) &&
-                (parent_ci->ci_filename_mode == child_ci->ci_filename_mode) &&
-                (parent_ci->ci_flags == child_ci->ci_flags));
+        res = cops->get_context(child, &child_ctx, sizeof(child_ctx));
+        if (res != sizeof(child_ctx))
+                return 0;
+
+        return memcmp(parent_ctx.master_key_descriptor,
+                      child_ctx.master_key_descriptor,
+                      FS_KEY_DESCRIPTOR_SIZE) == 0 &&
+                (parent_ctx.contents_encryption_mode ==
+                 child_ctx.contents_encryption_mode) &&
+                (parent_ctx.filenames_encryption_mode ==
+                 child_ctx.filenames_encryption_mode) &&
+                (parent_ctx.flags == child_ctx.flags);
 }
 EXPORT_SYMBOL(fscrypt_has_permitted_context);
 
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index 3cb7fa290c18..42723b27d6f2 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -5741,6 +5741,11 @@ int ext4_page_mkwrite(struct vm_area_struct *vma, struct vm_fault *vmf)
         file_update_time(vma->vm_file);
 
         down_read(&EXT4_I(inode)->i_mmap_sem);
+
+        ret = ext4_convert_inline_data(inode);
+        if (ret)
+                goto out_ret;
+
         /* Delalloc case is easy... */
         if (test_opt(inode->i_sb, DELALLOC) &&
             !ext4_should_journal_data(inode) &&
diff --git a/fs/orangefs/inode.c b/fs/orangefs/inode.c
index ef3b4eb54cf2..08ecdeebd6f7 100644
--- a/fs/orangefs/inode.c
+++ b/fs/orangefs/inode.c
@@ -223,8 +223,7 @@ int orangefs_setattr(struct dentry *dentry, struct iattr *iattr)
         if (ret)
                 goto out;
 
-        if ((iattr->ia_valid & ATTR_SIZE) &&
-            iattr->ia_size != i_size_read(inode)) {
+        if (iattr->ia_valid & ATTR_SIZE) {
                 ret = orangefs_setattr_size(inode, iattr);
                 if (ret)
                         goto out;
diff --git a/fs/orangefs/namei.c b/fs/orangefs/namei.c
index a290ff6ec756..7c315938e9c2 100644
--- a/fs/orangefs/namei.c
+++ b/fs/orangefs/namei.c
@@ -193,8 +193,6 @@ static struct dentry *orangefs_lookup(struct inode *dir, struct dentry *dentry,
                 goto out;
         }
 
-        ORANGEFS_I(inode)->getattr_time = jiffies - 1;
-
         gossip_debug(GOSSIP_NAME_DEBUG,
                      "%s:%s:%d "
                      "Found good inode [%lu] with count [%d]\n",
diff --git a/fs/orangefs/xattr.c b/fs/orangefs/xattr.c
index 74a81b1daaac..237c9c04dc3b 100644
--- a/fs/orangefs/xattr.c
+++ b/fs/orangefs/xattr.c
@@ -76,11 +76,8 @@ ssize_t orangefs_inode_getxattr(struct inode *inode, const char *name,
         if (S_ISLNK(inode->i_mode))
                 return -EOPNOTSUPP;
 
-        if (strlen(name) >= ORANGEFS_MAX_XATTR_NAMELEN) {
-                gossip_err("Invalid key length (%d)\n",
-                           (int)strlen(name));
+        if (strlen(name) > ORANGEFS_MAX_XATTR_NAMELEN)
                 return -EINVAL;
-        }
 
         fsuid = from_kuid(&init_user_ns, current_fsuid());
         fsgid = from_kgid(&init_user_ns, current_fsgid());
@@ -172,6 +169,9 @@ static int orangefs_inode_removexattr(struct inode *inode, const char *name,
         struct orangefs_kernel_op_s *new_op = NULL;
         int ret = -ENOMEM;
 
+        if (strlen(name) > ORANGEFS_MAX_XATTR_NAMELEN)
+                return -EINVAL;
+
         down_write(&orangefs_inode->xattr_sem);
         new_op = op_alloc(ORANGEFS_VFS_OP_REMOVEXATTR);
         if (!new_op)
@@ -231,23 +231,13 @@ int orangefs_inode_setxattr(struct inode *inode, const char *name,
                      "%s: name %s, buffer_size %zd\n",
                      __func__, name, size);
 
-        if (size >= ORANGEFS_MAX_XATTR_VALUELEN ||
-            flags < 0) {
-                gossip_err("orangefs_inode_setxattr: bogus values of size(%d), flags(%d)\n",
-                           (int)size,
-                           flags);
+        if (size > ORANGEFS_MAX_XATTR_VALUELEN)
+                return -EINVAL;
+        if (strlen(name) > ORANGEFS_MAX_XATTR_NAMELEN)
                 return -EINVAL;
-        }
 
         internal_flag = convert_to_internal_xattr_flags(flags);
 
-        if (strlen(name) >= ORANGEFS_MAX_XATTR_NAMELEN) {
-                gossip_err
-                    ("orangefs_inode_setxattr: bogus key size (%d)\n",
-                     (int)(strlen(name)));
-                return -EINVAL;
-        }
-
         /* This is equivalent to a removexattr */
         if (size == 0 && value == NULL) {
                 gossip_debug(GOSSIP_XATTR_DEBUG,
@@ -358,7 +348,7 @@ try_again:
 
         returned_count = new_op->downcall.resp.listxattr.returned_count;
         if (returned_count < 0 ||
-            returned_count >= ORANGEFS_MAX_XATTR_LISTLEN) {
+            returned_count > ORANGEFS_MAX_XATTR_LISTLEN) {
                 gossip_err("%s: impossible value for returned_count:%d:\n",
                 __func__,
                 returned_count);
diff --git a/fs/pstore/platform.c b/fs/pstore/platform.c
index 14984d902a99..43033a3d66d5 100644
--- a/fs/pstore/platform.c
+++ b/fs/pstore/platform.c
@@ -704,6 +704,7 @@ int pstore_register(struct pstore_info *psi)
         if (psi->flags & PSTORE_FLAGS_PMSG)
                 pstore_register_pmsg();
 
+        /* Start watching for new records, if desired. */
         if (pstore_update_ms >= 0) {
                 pstore_timer.expires = jiffies +
                         msecs_to_jiffies(pstore_update_ms);
@@ -726,6 +727,11 @@ EXPORT_SYMBOL_GPL(pstore_register);
 
 void pstore_unregister(struct pstore_info *psi)
 {
+        /* Stop timer and make sure all work has finished. */
+        pstore_update_ms = -1;
+        del_timer_sync(&pstore_timer);
+        flush_work(&pstore_work);
+
         if (psi->flags & PSTORE_FLAGS_PMSG)
                 pstore_unregister_pmsg();
         if (psi->flags & PSTORE_FLAGS_FTRACE)
@@ -825,7 +831,9 @@ static void pstore_timefunc(unsigned long dummy)
                 schedule_work(&pstore_work);
         }
 
-        mod_timer(&pstore_timer, jiffies + msecs_to_jiffies(pstore_update_ms));
+        if (pstore_update_ms >= 0)
+                mod_timer(&pstore_timer,
+                          jiffies + msecs_to_jiffies(pstore_update_ms));
 }
 
 module_param(backend, charp, 0444);
diff --git a/fs/sdcardfs/dentry.c b/fs/sdcardfs/dentry.c
index ae2b4babe2e5..a23168179716 100644
--- a/fs/sdcardfs/dentry.c
+++ b/fs/sdcardfs/dentry.c
@@ -34,6 +34,8 @@ static int sdcardfs_d_revalidate(struct dentry *dentry, unsigned int flags)
         struct dentry *parent_lower_dentry = NULL;
         struct dentry *lower_cur_parent_dentry = NULL;
         struct dentry *lower_dentry = NULL;
+        struct inode *inode;
+        struct sdcardfs_inode_data *data;
 
         if (flags & LOOKUP_RCU)
                 return -ECHILD;
@@ -103,6 +105,19 @@ static int sdcardfs_d_revalidate(struct dentry *dentry, unsigned int flags)
                 spin_unlock(&dentry->d_lock);
                 spin_unlock(&lower_dentry->d_lock);
         }
+        if (!err)
+                goto out;
+
+        /* If our top's inode is gone, we may be out of date */
+        inode = d_inode(dentry);
+        if (inode) {
+                data = top_data_get(SDCARDFS_I(inode));
+                if (data->abandoned) {
+                        d_drop(dentry);
+                        err = 0;
+                }
+                data_put(data);
+        }
 
 out:
         dput(parent_dentry);
diff --git a/fs/sdcardfs/derived_perm.c b/fs/sdcardfs/derived_perm.c
index 5a0ef3889846..1239d1cd208b 100644
--- a/fs/sdcardfs/derived_perm.c
+++ b/fs/sdcardfs/derived_perm.c
@@ -26,28 +26,28 @@ static void inherit_derived_state(struct inode *parent, struct inode *child)
         struct sdcardfs_inode_info *pi = SDCARDFS_I(parent);
         struct sdcardfs_inode_info *ci = SDCARDFS_I(child);
 
-        ci->perm = PERM_INHERIT;
-        ci->userid = pi->userid;
-        ci->d_uid = pi->d_uid;
-        ci->under_android = pi->under_android;
-        ci->under_cache = pi->under_cache;
-        ci->under_obb = pi->under_obb;
-        set_top(ci, pi->top);
+        ci->data->perm = PERM_INHERIT;
+        ci->data->userid = pi->data->userid;
+        ci->data->d_uid = pi->data->d_uid;
+        ci->data->under_android = pi->data->under_android;
+        ci->data->under_cache = pi->data->under_cache;
+        ci->data->under_obb = pi->data->under_obb;
+        set_top(ci, pi->top_data);
 }
 
 /* helper function for derived state */
 void setup_derived_state(struct inode *inode, perm_t perm, userid_t userid,
-                                                uid_t uid, bool under_android,
-                                                struct inode *top)
+                                        uid_t uid, bool under_android,
+                                        struct sdcardfs_inode_data *top)
 {
         struct sdcardfs_inode_info *info = SDCARDFS_I(inode);
 
-        info->perm = perm;
-        info->userid = userid;
-        info->d_uid = uid;
-        info->under_android = under_android;
-        info->under_cache = false;
-        info->under_obb = false;
+        info->data->perm = perm;
+        info->data->userid = userid;
+        info->data->d_uid = uid;
+        info->data->under_android = under_android;
+        info->data->under_cache = false;
+        info->data->under_obb = false;
         set_top(info, top);
 }
 
@@ -58,7 +58,8 @@ void get_derived_permission_new(struct dentry *parent, struct dentry *dentry,
                                 const struct qstr *name)
 {
         struct sdcardfs_inode_info *info = SDCARDFS_I(d_inode(dentry));
-        struct sdcardfs_inode_info *parent_info = SDCARDFS_I(d_inode(parent));
+        struct sdcardfs_inode_data *parent_data =
+                        SDCARDFS_I(d_inode(parent))->data;
         appid_t appid;
         unsigned long user_num;
         int err;
@@ -82,60 +83,61 @@ void get_derived_permission_new(struct dentry *parent, struct dentry *dentry,
         if (!S_ISDIR(d_inode(dentry)->i_mode))
                 return;
         /* Derive custom permissions based on parent and current node */
-        switch (parent_info->perm) {
+        switch (parent_data->perm) {
         case PERM_INHERIT:
         case PERM_ANDROID_PACKAGE_CACHE:
                 /* Already inherited above */
                 break;
         case PERM_PRE_ROOT:
                 /* Legacy internal layout places users at top level */
-                info->perm = PERM_ROOT;
+                info->data->perm = PERM_ROOT;
                 err = kstrtoul(name->name, 10, &user_num);
                 if (err)
-                        info->userid = 0;
+                        info->data->userid = 0;
                 else
-                        info->userid = user_num;
-                set_top(info, &info->vfs_inode);
+                        info->data->userid = user_num;
+                set_top(info, info->data);
                 break;
         case PERM_ROOT:
                 /* Assume masked off by default. */
                 if (qstr_case_eq(name, &q_Android)) {
                         /* App-specific directories inside; let anyone traverse */
-                        info->perm = PERM_ANDROID;
-                        info->under_android = true;
-                        set_top(info, &info->vfs_inode);
+                        info->data->perm = PERM_ANDROID;
+                        info->data->under_android = true;
+                        set_top(info, info->data);
                 }
                 break;
         case PERM_ANDROID:
                 if (qstr_case_eq(name, &q_data)) {
                         /* App-specific directories inside; let anyone traverse */
-                        info->perm = PERM_ANDROID_DATA;
-                        set_top(info, &info->vfs_inode);
+                        info->data->perm = PERM_ANDROID_DATA;
+                        set_top(info, info->data);
                 } else if (qstr_case_eq(name, &q_obb)) {
                         /* App-specific directories inside; let anyone traverse */
-                        info->perm = PERM_ANDROID_OBB;
-                        info->under_obb = true;
-                        set_top(info, &info->vfs_inode);
+                        info->data->perm = PERM_ANDROID_OBB;
+                        info->data->under_obb = true;
+                        set_top(info, info->data);
                         /* Single OBB directory is always shared */
                 } else if (qstr_case_eq(name, &q_media)) {
                         /* App-specific directories inside; let anyone traverse */
-                        info->perm = PERM_ANDROID_MEDIA;
-                        set_top(info, &info->vfs_inode);
+                        info->data->perm = PERM_ANDROID_MEDIA;
+                        set_top(info, info->data);
                 }
                 break;
         case PERM_ANDROID_OBB:
         case PERM_ANDROID_DATA:
         case PERM_ANDROID_MEDIA:
-                info->perm = PERM_ANDROID_PACKAGE;
+                info->data->perm = PERM_ANDROID_PACKAGE;
                 appid = get_appid(name->name);
-                if (appid != 0 && !is_excluded(name->name, parent_info->userid))
-                        info->d_uid = multiuser_get_uid(parent_info->userid, appid);
-                set_top(info, &info->vfs_inode);
+                if (appid != 0 && !is_excluded(name->name, parent_data->userid))
+                        info->data->d_uid =
+                                multiuser_get_uid(parent_data->userid, appid);
+                set_top(info, info->data);
                 break;
         case PERM_ANDROID_PACKAGE:
                 if (qstr_case_eq(name, &q_cache)) {
-                        info->perm = PERM_ANDROID_PACKAGE_CACHE;
-                        info->under_cache = true;
+                        info->data->perm = PERM_ANDROID_PACKAGE_CACHE;
+                        info->data->under_cache = true;
                 }
                 break;
         }
@@ -166,7 +168,8 @@ void fixup_lower_ownership(struct dentry *dentry, const char *name)
         struct inode *delegated_inode = NULL;
         int error;
         struct sdcardfs_inode_info *info;
-        struct sdcardfs_inode_info *info_top;
+        struct sdcardfs_inode_data *info_d;
+        struct sdcardfs_inode_data *info_top;
         perm_t perm;
         struct sdcardfs_sb_info *sbi = SDCARDFS_SB(dentry->d_sb);
         uid_t uid = sbi->options.fs_low_uid;
@@ -174,15 +177,16 @@ void fixup_lower_ownership(struct dentry *dentry, const char *name)
         struct iattr newattrs;
 
         info = SDCARDFS_I(d_inode(dentry));
-        perm = info->perm;
-        if (info->under_obb) {
+        info_d = info->data;
+        perm = info_d->perm;
+        if (info_d->under_obb) {
                 perm = PERM_ANDROID_OBB;
-        } else if (info->under_cache) {
+        } else if (info_d->under_cache) {
                 perm = PERM_ANDROID_PACKAGE_CACHE;
         } else if (perm == PERM_INHERIT) {
-                info_top = SDCARDFS_I(grab_top(info));
+                info_top = top_data_get(info);
                 perm = info_top->perm;
-                release_top(info);
+                data_put(info_top);
         }
 
         switch (perm) {
@@ -192,7 +196,7 @@ void fixup_lower_ownership(struct dentry *dentry, const char *name)
         case PERM_ANDROID_MEDIA:
         case PERM_ANDROID_PACKAGE:
         case PERM_ANDROID_PACKAGE_CACHE:
-                uid = multiuser_get_uid(info->userid, uid);
+                uid = multiuser_get_uid(info_d->userid, uid);
                 break;
         case PERM_ANDROID_OBB:
                 uid = AID_MEDIA_OBB;
@@ -207,24 +211,24 @@ void fixup_lower_ownership(struct dentry *dentry, const char *name)
         case PERM_ANDROID_DATA:
         case PERM_ANDROID_MEDIA:
                 if (S_ISDIR(d_inode(dentry)->i_mode))
-                        gid = multiuser_get_uid(info->userid, AID_MEDIA_RW);
+                        gid = multiuser_get_uid(info_d->userid, AID_MEDIA_RW);
                 else
-                        gid = multiuser_get_uid(info->userid, get_type(name));
+                        gid = multiuser_get_uid(info_d->userid, get_type(name));
                 break;
         case PERM_ANDROID_OBB:
                 gid = AID_MEDIA_OBB;
                 break;
         case PERM_ANDROID_PACKAGE:
-                if (uid_is_app(info->d_uid))
-                        gid = multiuser_get_ext_gid(info->d_uid);
+                if (uid_is_app(info_d->d_uid))
+                        gid = multiuser_get_ext_gid(info_d->d_uid);
                 else
-                        gid = multiuser_get_uid(info->userid, AID_MEDIA_RW);
+                        gid = multiuser_get_uid(info_d->userid, AID_MEDIA_RW);
                 break;
         case PERM_ANDROID_PACKAGE_CACHE:
-                if (uid_is_app(info->d_uid))
-                        gid = multiuser_get_ext_cache_gid(info->d_uid);
+                if (uid_is_app(info_d->d_uid))
+                        gid = multiuser_get_ext_cache_gid(info_d->d_uid);
                 else
-                        gid = multiuser_get_uid(info->userid, AID_MEDIA_RW);
+                        gid = multiuser_get_uid(info_d->userid, AID_MEDIA_RW);
                 break;
         case PERM_PRE_ROOT:
         default:
@@ -257,11 +261,13 @@ retry_deleg:
         sdcardfs_put_lower_path(dentry, &path);
 }
 
-static int descendant_may_need_fixup(struct sdcardfs_inode_info *info, struct limit_search *limit)
+static int descendant_may_need_fixup(struct sdcardfs_inode_data *data,
+                struct limit_search *limit)
 {
-        if (info->perm == PERM_ROOT)
-                return (limit->flags & BY_USERID)?info->userid == limit->userid:1;
-        if (info->perm == PERM_PRE_ROOT || info->perm == PERM_ANDROID)
+        if (data->perm == PERM_ROOT)
+                return (limit->flags & BY_USERID) ?
+                                data->userid == limit->userid : 1;
+        if (data->perm == PERM_PRE_ROOT || data->perm == PERM_ANDROID)
                 return 1;
         return 0;
 }
@@ -292,7 +298,7 @@ static void __fixup_perms_recursive(struct dentry *dentry, struct limit_search *
         }
         info = SDCARDFS_I(d_inode(dentry));
 
-        if (needs_fixup(info->perm)) {
+        if (needs_fixup(info->data->perm)) {
                 list_for_each_entry(child, &dentry->d_subdirs, d_child) {
                         spin_lock_nested(&child->d_lock, depth + 1);
                         if (!(limit->flags & BY_NAME) || qstr_case_eq(&child->d_name, &limit->name)) {
@@ -305,7 +311,7 @@ static void __fixup_perms_recursive(struct dentry *dentry, struct limit_search *
                         }
                         spin_unlock(&child->d_lock);
                 }
-        } else if (descendant_may_need_fixup(info, limit)) {
+        } else if (descendant_may_need_fixup(info->data, limit)) {
                 list_for_each_entry(child, &dentry->d_subdirs, d_child) {
                         __fixup_perms_recursive(child, limit, depth + 1);
                 }
@@ -349,12 +355,12 @@ int need_graft_path(struct dentry *dentry)
         struct sdcardfs_sb_info *sbi = SDCARDFS_SB(dentry->d_sb);
         struct qstr obb = QSTR_LITERAL("obb");
 
-        if (parent_info->perm == PERM_ANDROID &&
+        if (parent_info->data->perm == PERM_ANDROID &&
                         qstr_case_eq(&dentry->d_name, &obb)) {
 
                 /* /Android/obb is the base obbpath of DERIVED_UNIFIED */
                 if (!(sbi->options.multiuser == false
-                                && parent_info->userid == 0)) {
+                                && parent_info->data->userid == 0)) {
                         ret = 1;
                 }
         }
@@ -415,11 +421,11 @@ int is_base_obbpath(struct dentry *dentry)
 
         spin_lock(&SDCARDFS_D(dentry)->lock);
         if (sbi->options.multiuser) {
-                if (parent_info->perm == PERM_PRE_ROOT &&
+                if (parent_info->data->perm == PERM_PRE_ROOT &&
                                 qstr_case_eq(&dentry->d_name, &q_obb)) {
                         ret = 1;
                 }
-        } else  if (parent_info->perm == PERM_ANDROID &&
+        } else  if (parent_info->data->perm == PERM_ANDROID &&
                         qstr_case_eq(&dentry->d_name, &q_obb)) {
                 ret = 1;
         }
diff --git a/fs/sdcardfs/inode.c b/fs/sdcardfs/inode.c
index 4d558b87fe42..d48da4126dac 100644
--- a/fs/sdcardfs/inode.c
+++ b/fs/sdcardfs/inode.c
@@ -23,7 +23,8 @@
 #include <linux/ratelimit.h>
 
 /* Do not directly use this function. Use OVERRIDE_CRED() instead. */
-const struct cred *override_fsids(struct sdcardfs_sb_info *sbi, struct sdcardfs_inode_info *info)
+const struct cred *override_fsids(struct sdcardfs_sb_info *sbi,
+                struct sdcardfs_inode_data *data)
 {
         struct cred *cred;
         const struct cred *old_cred;
@@ -33,10 +34,10 @@ const struct cred *override_fsids(struct sdcardfs_sb_info *sbi, struct sdcardfs_
         if (!cred)
                 return NULL;
 
-        if (info->under_obb)
+        if (data->under_obb)
                 uid = AID_MEDIA_OBB;
         else
-                uid = multiuser_get_uid(info->userid, sbi->options.fs_low_uid);
+                uid = multiuser_get_uid(data->userid, sbi->options.fs_low_uid);
         cred->fsuid = make_kuid(&init_user_ns, uid);
         cred->fsgid = make_kgid(&init_user_ns, sbi->options.fs_low_gid);
 
@@ -96,7 +97,8 @@ static int sdcardfs_create(struct inode *dir, struct dentry *dentry,
         if (err)
                 goto out;
 
-        err = sdcardfs_interpose(dentry, dir->i_sb, &lower_path, SDCARDFS_I(dir)->userid);
+        err = sdcardfs_interpose(dentry, dir->i_sb, &lower_path,
+                        SDCARDFS_I(dir)->data->userid);
         if (err)
                 goto out;
         fsstack_copy_attr_times(dir, sdcardfs_lower_inode(dir));
@@ -267,7 +269,7 @@ static int sdcardfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode
         struct path lower_path;
         struct sdcardfs_sb_info *sbi = SDCARDFS_SB(dentry->d_sb);
         const struct cred *saved_cred = NULL;
-        struct sdcardfs_inode_info *pi = SDCARDFS_I(dir);
+        struct sdcardfs_inode_data *pd = SDCARDFS_I(dir)->data;
         int touch_err = 0;
         struct fs_struct *saved_fs;
         struct fs_struct *copied_fs;
@@ -336,7 +338,7 @@ static int sdcardfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode
                         make_nomedia_in_obb = 1;
         }
 
-        err = sdcardfs_interpose(dentry, dir->i_sb, &lower_path, pi->userid);
+        err = sdcardfs_interpose(dentry, dir->i_sb, &lower_path, pd->userid);
         if (err) {
                 unlock_dir(lower_parent_dentry);
                 goto out;
@@ -349,12 +351,13 @@ static int sdcardfs_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode
         fixup_lower_ownership(dentry, dentry->d_name.name);
         unlock_dir(lower_parent_dentry);
         if ((!sbi->options.multiuser) && (qstr_case_eq(&dentry->d_name, &q_obb))
-                && (pi->perm == PERM_ANDROID) && (pi->userid == 0))
+                && (pd->perm == PERM_ANDROID) && (pd->userid == 0))
                 make_nomedia_in_obb = 1;
 
         /* When creating /Android/data and /Android/obb, mark them as .nomedia */
         if (make_nomedia_in_obb ||
-                ((pi->perm == PERM_ANDROID) && (qstr_case_eq(&dentry->d_name, &q_data)))) {
+                ((pd->perm == PERM_ANDROID)
+                                && (qstr_case_eq(&dentry->d_name, &q_data)))) {
                 REVERT_CRED(saved_cred);
                 OVERRIDE_CRED(SDCARDFS_SB(dir->i_sb), saved_cred, SDCARDFS_I(d_inode(dentry)));
                 set_fs_pwd(current->fs, &lower_path);
@@ -620,7 +623,7 @@ static int sdcardfs_permission(struct vfsmount *mnt, struct inode *inode, int ma
 {
         int err;
         struct inode tmp;
-        struct inode *top = grab_top(SDCARDFS_I(inode));
+        struct sdcardfs_inode_data *top = top_data_get(SDCARDFS_I(inode));
 
         if (!top)
                 return -EINVAL;
@@ -637,10 +640,11 @@ static int sdcardfs_permission(struct vfsmount *mnt, struct inode *inode, int ma
          * locks must be dealt with to avoid undefined behavior.
          */
         copy_attrs(&tmp, inode);
-        tmp.i_uid = make_kuid(&init_user_ns, SDCARDFS_I(top)->d_uid);
-        tmp.i_gid = make_kgid(&init_user_ns, get_gid(mnt, SDCARDFS_I(top)));
-        tmp.i_mode = (inode->i_mode & S_IFMT) | get_mode(mnt, SDCARDFS_I(top));
-        release_top(SDCARDFS_I(inode));
+        tmp.i_uid = make_kuid(&init_user_ns, top->d_uid);
+        tmp.i_gid = make_kgid(&init_user_ns, get_gid(mnt, top));
+        tmp.i_mode = (inode->i_mode & S_IFMT)
+                        | get_mode(mnt, SDCARDFS_I(inode), top);
+        data_put(top);
         tmp.i_sb = inode->i_sb;
         if (IS_POSIXACL(inode))
                 pr_warn("%s: This may be undefined behavior...\n", __func__);
@@ -692,11 +696,12 @@ static int sdcardfs_setattr(struct vfsmount *mnt, struct dentry *dentry, struct
         struct dentry *parent;
         struct inode tmp;
         struct dentry tmp_d;
-        struct inode *top;
+        struct sdcardfs_inode_data *top;
+
         const struct cred *saved_cred = NULL;
 
         inode = d_inode(dentry);
-        top = grab_top(SDCARDFS_I(inode));
+        top = top_data_get(SDCARDFS_I(inode));
 
         if (!top)
                 return -EINVAL;
@@ -714,11 +719,12 @@ static int sdcardfs_setattr(struct vfsmount *mnt, struct dentry *dentry, struct
          *
          */
         copy_attrs(&tmp, inode);
-        tmp.i_uid = make_kuid(&init_user_ns, SDCARDFS_I(top)->d_uid);
-        tmp.i_gid = make_kgid(&init_user_ns, get_gid(mnt, SDCARDFS_I(top)));
-        tmp.i_mode = (inode->i_mode & S_IFMT) | get_mode(mnt, SDCARDFS_I(top));
+        tmp.i_uid = make_kuid(&init_user_ns, top->d_uid);
+        tmp.i_gid = make_kgid(&init_user_ns, get_gid(mnt, top));
+        tmp.i_mode = (inode->i_mode & S_IFMT)
+                        | get_mode(mnt, SDCARDFS_I(inode), top);
         tmp.i_size = i_size_read(inode);
-        release_top(SDCARDFS_I(inode));
+        data_put(top);
         tmp.i_sb = inode->i_sb;
         tmp_d.d_inode = &tmp;
 
@@ -821,17 +827,17 @@ static int sdcardfs_fillattr(struct vfsmount *mnt,
                                 struct inode *inode, struct kstat *stat)
 {
         struct sdcardfs_inode_info *info = SDCARDFS_I(inode);
-        struct inode *top = grab_top(info);
+        struct sdcardfs_inode_data *top = top_data_get(info);
 
         if (!top)
                 return -EINVAL;
 
         stat->dev = inode->i_sb->s_dev;
         stat->ino = inode->i_ino;
-        stat->mode = (inode->i_mode  & S_IFMT) | get_mode(mnt, SDCARDFS_I(top));
+        stat->mode = (inode->i_mode  & S_IFMT) | get_mode(mnt, info, top);
         stat->nlink = inode->i_nlink;
-        stat->uid = make_kuid(&init_user_ns, SDCARDFS_I(top)->d_uid);
-        stat->gid = make_kgid(&init_user_ns, get_gid(mnt, SDCARDFS_I(top)));
+        stat->uid = make_kuid(&init_user_ns, top->d_uid);
+        stat->gid = make_kgid(&init_user_ns, get_gid(mnt, top));
         stat->rdev = inode->i_rdev;
         stat->size = i_size_read(inode);
         stat->atime = inode->i_atime;
@@ -839,7 +845,7 @@ static int sdcardfs_fillattr(struct vfsmount *mnt,
         stat->ctime = inode->i_ctime;
         stat->blksize = (1 << inode->i_blkbits);
         stat->blocks = inode->i_blocks;
-        release_top(info);
+        data_put(top);
         return 0;
 }
 
diff --git a/fs/sdcardfs/lookup.c b/fs/sdcardfs/lookup.c
index 706329dd1ca3..17761c546617 100644
--- a/fs/sdcardfs/lookup.c
+++ b/fs/sdcardfs/lookup.c
@@ -71,7 +71,7 @@ struct inode_data {
 static int sdcardfs_inode_test(struct inode *inode, void *candidate_data/*void *candidate_lower_inode*/)
 {
         struct inode *current_lower_inode = sdcardfs_lower_inode(inode);
-        userid_t current_userid = SDCARDFS_I(inode)->userid;
+        userid_t current_userid = SDCARDFS_I(inode)->data->userid;
 
         if (current_lower_inode == ((struct inode_data *)candidate_data)->lower_inode &&
                         current_userid == ((struct inode_data *)candidate_data)->id)
@@ -438,7 +438,8 @@ struct dentry *sdcardfs_lookup(struct inode *dir, struct dentry *dentry,
                 goto out;
         }
 
-        ret = __sdcardfs_lookup(dentry, flags, &lower_parent_path, SDCARDFS_I(dir)->userid);
+        ret = __sdcardfs_lookup(dentry, flags, &lower_parent_path,
+                                SDCARDFS_I(dir)->data->userid);
         if (IS_ERR(ret))
                 goto out;
         if (ret)
diff --git a/fs/sdcardfs/main.c b/fs/sdcardfs/main.c
index 953d2156d2e9..3c5b51d49d21 100644
--- a/fs/sdcardfs/main.c
+++ b/fs/sdcardfs/main.c
@@ -327,13 +327,13 @@ static int sdcardfs_read_super(struct vfsmount *mnt, struct super_block *sb,
         mutex_lock(&sdcardfs_super_list_lock);
         if (sb_info->options.multiuser) {
                 setup_derived_state(d_inode(sb->s_root), PERM_PRE_ROOT,
-                                        sb_info->options.fs_user_id, AID_ROOT,
-                                        false, d_inode(sb->s_root));
+                                sb_info->options.fs_user_id, AID_ROOT,
+                                false, SDCARDFS_I(d_inode(sb->s_root))->data);
                 snprintf(sb_info->obbpath_s, PATH_MAX, "%s/obb", dev_name);
         } else {
                 setup_derived_state(d_inode(sb->s_root), PERM_ROOT,
-                                        sb_info->options.fs_user_id, AID_ROOT,
-                                        false, d_inode(sb->s_root));
+                                sb_info->options.fs_user_id, AID_ROOT,
+                                false, SDCARDFS_I(d_inode(sb->s_root))->data);
                 snprintf(sb_info->obbpath_s, PATH_MAX, "%s/Android/obb", dev_name);
         }
         fixup_tmp_permissions(d_inode(sb->s_root));
diff --git a/fs/sdcardfs/packagelist.c b/fs/sdcardfs/packagelist.c
index 5ea6469638d8..00a0f656acc7 100644
--- a/fs/sdcardfs/packagelist.c
+++ b/fs/sdcardfs/packagelist.c
@@ -156,7 +156,7 @@ int check_caller_access_to_name(struct inode *parent_node, const struct qstr *na
         struct qstr q_android_secure = QSTR_LITERAL("android_secure");
 
         /* Always block security-sensitive files at root */
-        if (parent_node && SDCARDFS_I(parent_node)->perm == PERM_ROOT) {
+        if (parent_node && SDCARDFS_I(parent_node)->data->perm == PERM_ROOT) {
                 if (qstr_case_eq(name, &q_autorun)
                         || qstr_case_eq(name, &q__android_secure)
                         || qstr_case_eq(name, &q_android_secure)) {
diff --git a/fs/sdcardfs/sdcardfs.h b/fs/sdcardfs/sdcardfs.h
index 380982b4a567..3687b22a2e6b 100644
--- a/fs/sdcardfs/sdcardfs.h
+++ b/fs/sdcardfs/sdcardfs.h
@@ -30,6 +30,7 @@
 #include <linux/file.h>
 #include <linux/fs.h>
 #include <linux/aio.h>
+#include <linux/kref.h>
 #include <linux/mm.h>
 #include <linux/mount.h>
 #include <linux/namei.h>
@@ -81,7 +82,8 @@
  */
 #define fixup_tmp_permissions(x)        \
         do {                                            \
-                (x)->i_uid = make_kuid(&init_user_ns, SDCARDFS_I(x)->d_uid);    \
+                (x)->i_uid = make_kuid(&init_user_ns,   \
+                                SDCARDFS_I(x)->data->d_uid);    \
                 (x)->i_gid = make_kgid(&init_user_ns, AID_SDCARD_RW);   \
                 (x)->i_mode = ((x)->i_mode & S_IFMT) | 0775;\
         } while (0)
@@ -97,14 +99,14 @@
  */
 #define OVERRIDE_CRED(sdcardfs_sbi, saved_cred, info)           \
         do {    \
-                saved_cred = override_fsids(sdcardfs_sbi, info);        \
+                saved_cred = override_fsids(sdcardfs_sbi, info->data);  \
                 if (!saved_cred)        \
                         return -ENOMEM; \
         } while (0)
 
 #define OVERRIDE_CRED_PTR(sdcardfs_sbi, saved_cred, info)       \
         do {    \
-                saved_cred = override_fsids(sdcardfs_sbi, info);        \
+                saved_cred = override_fsids(sdcardfs_sbi, info->data);  \
                 if (!saved_cred)        \
                         return ERR_PTR(-ENOMEM);        \
         } while (0)
@@ -142,9 +144,11 @@ typedef enum {
 struct sdcardfs_sb_info;
 struct sdcardfs_mount_options;
 struct sdcardfs_inode_info;
+struct sdcardfs_inode_data;
 
 /* Do not directly use this function. Use OVERRIDE_CRED() instead. */
-const struct cred *override_fsids(struct sdcardfs_sb_info *sbi, struct sdcardfs_inode_info *info);
+const struct cred *override_fsids(struct sdcardfs_sb_info *sbi,
+                        struct sdcardfs_inode_data *data);
 /* Do not directly use this function, use REVERT_CRED() instead. */
 void revert_fsids(const struct cred *old_cred);
 
@@ -178,18 +182,26 @@ struct sdcardfs_file_info {
         const struct vm_operations_struct *lower_vm_ops;
 };
 
-/* sdcardfs inode data in memory */
-struct sdcardfs_inode_info {
-        struct inode *lower_inode;
-        /* state derived based on current position in hierachy */
+struct sdcardfs_inode_data {
+        struct kref refcount;
+        bool abandoned;
+
         perm_t perm;
         userid_t userid;
         uid_t d_uid;
         bool under_android;
         bool under_cache;
         bool under_obb;
+};
+
+/* sdcardfs inode data in memory */
+struct sdcardfs_inode_info {
+        struct inode *lower_inode;
+        /* state derived based on current position in hierarchy */
+        struct sdcardfs_inode_data *data;
+
         /* top folder for ownership */
-        struct inode *top;
+        struct sdcardfs_inode_data *top_data;
 
         struct inode vfs_inode;
 };
@@ -351,39 +363,56 @@ SDCARDFS_DENT_FUNC(orig_path)
 
 static inline bool sbinfo_has_sdcard_magic(struct sdcardfs_sb_info *sbinfo)
 {
-        return sbinfo && sbinfo->sb && sbinfo->sb->s_magic == SDCARDFS_SUPER_MAGIC;
+        return sbinfo && sbinfo->sb
+                        && sbinfo->sb->s_magic == SDCARDFS_SUPER_MAGIC;
 }
 
-/* grab a refererence if we aren't linking to ourself */
-static inline void set_top(struct sdcardfs_inode_info *info, struct inode *top)
+static inline struct sdcardfs_inode_data *data_get(
+                struct sdcardfs_inode_data *data)
 {
-        struct inode *old_top = NULL;
-
-        BUG_ON(IS_ERR_OR_NULL(top));
-        if (info->top && info->top != &info->vfs_inode)
-                old_top = info->top;
-        if (top != &info->vfs_inode)
-                igrab(top);
-        info->top = top;
-        iput(old_top);
+        if (data)
+                kref_get(&data->refcount);
+        return data;
 }
 
-static inline struct inode *grab_top(struct sdcardfs_inode_info *info)
+static inline struct sdcardfs_inode_data *top_data_get(
+                struct sdcardfs_inode_info *info)
 {
-        struct inode *top = info->top;
+        return data_get(info->top_data);
+}
 
-        if (top)
-                return igrab(top);
-        else
-                return NULL;
+extern void data_release(struct kref *ref);
+
+static inline void data_put(struct sdcardfs_inode_data *data)
+{
+        kref_put(&data->refcount, data_release);
+}
+
+static inline void release_own_data(struct sdcardfs_inode_info *info)
+{
+        /*
+         * This happens exactly once per inode. At this point, the inode that
+         * originally held this data is about to be freed, and all references
+         * to it are held as a top value, and will likely be released soon.
+         */
+        info->data->abandoned = true;
+        data_put(info->data);
 }
 
-static inline void release_top(struct sdcardfs_inode_info *info)
+static inline void set_top(struct sdcardfs_inode_info *info,
+                        struct sdcardfs_inode_data *top)
 {
-        iput(info->top);
+        struct sdcardfs_inode_data *old_top = info->top_data;
+
+        if (top)
+                data_get(top);
+        info->top_data = top;
+        if (old_top)
+                data_put(old_top);
 }
 
-static inline int get_gid(struct vfsmount *mnt, struct sdcardfs_inode_info *info)
+static inline int get_gid(struct vfsmount *mnt,
+                struct sdcardfs_inode_data *data)
 {
         struct sdcardfs_vfsmount_options *opts = mnt->data;
 
@@ -396,10 +425,12 @@ static inline int get_gid(struct vfsmount *mnt, struct sdcardfs_inode_info *info
                  */
                 return AID_SDCARD_RW;
         else
-                return multiuser_get_uid(info->userid, opts->gid);
+                return multiuser_get_uid(data->userid, opts->gid);
 }
 
-static inline int get_mode(struct vfsmount *mnt, struct sdcardfs_inode_info *info)
+static inline int get_mode(struct vfsmount *mnt,
+                struct sdcardfs_inode_info *info,
+                struct sdcardfs_inode_data *data)
 {
         int owner_mode;
         int filtered_mode;
@@ -407,12 +438,12 @@ static inline int get_mode(struct vfsmount *mnt, struct sdcardfs_inode_info *inf
         int visible_mode = 0775 & ~opts->mask;
 
 
-        if (info->perm == PERM_PRE_ROOT) {
+        if (data->perm == PERM_PRE_ROOT) {
                 /* Top of multi-user view should always be visible to ensure
                 * secondary users can traverse inside.
                 */
                 visible_mode = 0711;
-        } else if (info->under_android) {
+        } else if (data->under_android) {
                 /* Block "other" access to Android directories, since only apps
                 * belonging to a specific user should be in there; we still
                 * leave +x open for the default view.
@@ -481,8 +512,9 @@ struct limit_search {
         userid_t userid;
 };
 
-extern void setup_derived_state(struct inode *inode, perm_t perm, userid_t userid,
-                        uid_t uid, bool under_android, struct inode *top);
+extern void setup_derived_state(struct inode *inode, perm_t perm,
+                userid_t userid, uid_t uid, bool under_android,
+                struct sdcardfs_inode_data *top);
 extern void get_derived_permission(struct dentry *parent, struct dentry *dentry);
 extern void get_derived_permission_new(struct dentry *parent, struct dentry *dentry, const struct qstr *name);
 extern void fixup_perms_recursive(struct dentry *dentry, struct limit_search *limit);
@@ -601,7 +633,7 @@ static inline void sdcardfs_copy_and_fix_attrs(struct inode *dest, const struct
 {
         dest->i_mode = (src->i_mode  & S_IFMT) | S_IRWXU | S_IRWXG |
                         S_IROTH | S_IXOTH; /* 0775 */
-        dest->i_uid = make_kuid(&init_user_ns, SDCARDFS_I(dest)->d_uid);
+        dest->i_uid = make_kuid(&init_user_ns, SDCARDFS_I(dest)->data->d_uid);
         dest->i_gid = make_kgid(&init_user_ns, AID_SDCARD_RW);
         dest->i_rdev = src->i_rdev;
         dest->i_atime = src->i_atime;
diff --git a/fs/sdcardfs/super.c b/fs/sdcardfs/super.c
index 8a9c9c7adca2..7f4539b4b249 100644
--- a/fs/sdcardfs/super.c
+++ b/fs/sdcardfs/super.c
@@ -26,6 +26,23 @@
  */
 static struct kmem_cache *sdcardfs_inode_cachep;
 
+/*
+ * To support the top references, we must track some data separately.
+ * An sdcardfs_inode_info always has a reference to its data, and once set up,
+ * also has a reference to its top. The top may be itself, in which case it
+ * holds two references to its data. When top is changed, it takes a ref to the
+ * new data and then drops the ref to the old data.
+ */
+static struct kmem_cache *sdcardfs_inode_data_cachep;
+
+void data_release(struct kref *ref)
+{
+        struct sdcardfs_inode_data *data =
+                container_of(ref, struct sdcardfs_inode_data, refcount);
+
+        kmem_cache_free(sdcardfs_inode_data_cachep, data);
+}
+
 /* final actions when unmounting a file system */
 static void sdcardfs_put_super(struct super_block *sb)
 {
@@ -166,6 +183,7 @@ static void sdcardfs_evict_inode(struct inode *inode)
         struct inode *lower_inode;
 
         truncate_inode_pages(&inode->i_data, 0);
+        set_top(SDCARDFS_I(inode), NULL);
         clear_inode(inode);
         /*
          * Decrement a reference to a lower_inode, which was incremented
@@ -173,13 +191,13 @@ static void sdcardfs_evict_inode(struct inode *inode)
          */
         lower_inode = sdcardfs_lower_inode(inode);
         sdcardfs_set_lower_inode(inode, NULL);
-        set_top(SDCARDFS_I(inode), inode);
         iput(lower_inode);
 }
 
 static struct inode *sdcardfs_alloc_inode(struct super_block *sb)
 {
         struct sdcardfs_inode_info *i;
+        struct sdcardfs_inode_data *d;
 
         i = kmem_cache_alloc(sdcardfs_inode_cachep, GFP_KERNEL);
         if (!i)
@@ -188,6 +206,16 @@ static struct inode *sdcardfs_alloc_inode(struct super_block *sb)
         /* memset everything up to the inode to 0 */
         memset(i, 0, offsetof(struct sdcardfs_inode_info, vfs_inode));
 
+        d = kmem_cache_alloc(sdcardfs_inode_data_cachep,
+                                        GFP_KERNEL | __GFP_ZERO);
+        if (!d) {
+                kmem_cache_free(sdcardfs_inode_cachep, i);
+                return NULL;
+        }
+
+        i->data = d;
+        kref_init(&d->refcount);
+
         i->vfs_inode.i_version = 1;
         return &i->vfs_inode;
 }
@@ -196,6 +224,7 @@ static void i_callback(struct rcu_head *head)
 {
         struct inode *inode = container_of(head, struct inode, i_rcu);
 
+        release_own_data(SDCARDFS_I(inode));
         kmem_cache_free(sdcardfs_inode_cachep, SDCARDFS_I(inode));
 }
 
@@ -214,20 +243,30 @@ static void init_once(void *obj)
 
 int sdcardfs_init_inode_cache(void)
 {
-        int err = 0;
-
         sdcardfs_inode_cachep =
                 kmem_cache_create("sdcardfs_inode_cache",
                                   sizeof(struct sdcardfs_inode_info), 0,
                                   SLAB_RECLAIM_ACCOUNT, init_once);
+
         if (!sdcardfs_inode_cachep)
-                err = -ENOMEM;
-        return err;
+                return -ENOMEM;
+
+        sdcardfs_inode_data_cachep =
+                kmem_cache_create("sdcardfs_inode_data_cache",
+                                  sizeof(struct sdcardfs_inode_data), 0,
+                                  SLAB_RECLAIM_ACCOUNT, NULL);
+        if (!sdcardfs_inode_data_cachep) {
+                kmem_cache_destroy(sdcardfs_inode_cachep);
+                return -ENOMEM;
+        }
+
+        return 0;
 }
 
 /* sdcardfs inode cache destructor */
 void sdcardfs_destroy_inode_cache(void)
 {
+        kmem_cache_destroy(sdcardfs_inode_data_cachep);
         kmem_cache_destroy(sdcardfs_inode_cachep);
 }
 
diff --git a/fs/xattr.c b/fs/xattr.c
index 2d13b4e62fae..ed8c374570ed 100644
--- a/fs/xattr.c
+++ b/fs/xattr.c
@@ -530,7 +530,7 @@ getxattr(struct dentry *d, const char __user *name, void __user *value,
                         size = XATTR_SIZE_MAX;
                 kvalue = kzalloc(size, GFP_KERNEL | __GFP_NOWARN);
                 if (!kvalue) {
-                        kvalue = vmalloc(size);
+                        kvalue = vzalloc(size);
                         if (!kvalue)
                                 return -ENOMEM;
                 }
diff --git a/kernel/padata.c b/kernel/padata.c
index b4a3c0ae649b..e4a8f8d9b31a 100644
--- a/kernel/padata.c
+++ b/kernel/padata.c
@@ -358,7 +358,7 @@ static int padata_setup_cpumasks(struct parallel_data *pd,
 
         cpumask_and(pd->cpumask.pcpu, pcpumask, cpu_online_mask);
         if (!alloc_cpumask_var(&pd->cpumask.cbcpu, GFP_KERNEL)) {
-                free_cpumask_var(pd->cpumask.cbcpu);
+                free_cpumask_var(pd->cpumask.pcpu);
                 return -ENOMEM;
         }
 
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index e5b159b88e39..5b06fb385dd7 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -3125,6 +3125,7 @@ __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order,
                 enum compact_priority prio, enum compact_result *compact_result)
 {
         struct page *page;
+        unsigned int noreclaim_flag = current->flags & PF_MEMALLOC;
 
         if (!order)
                 return NULL;
@@ -3132,7 +3133,7 @@ __alloc_pages_direct_compact(gfp_t gfp_mask, unsigned int order,
         current->flags |= PF_MEMALLOC;
         *compact_result = try_to_compact_pages(gfp_mask, order, alloc_flags, ac,
                                                                         prio);
-        current->flags &= ~PF_MEMALLOC;
+        current->flags = (current->flags & ~PF_MEMALLOC) | noreclaim_flag;
 
         if (*compact_result <= COMPACT_INACTIVE)
                 return NULL;
diff --git a/net/bluetooth/hci_sock.c b/net/bluetooth/hci_sock.c
index 48f9471e7c85..c88a6007e643 100644
--- a/net/bluetooth/hci_sock.c
+++ b/net/bluetooth/hci_sock.c
@@ -1680,7 +1680,8 @@ static int hci_sock_sendmsg(struct socket *sock, struct msghdr *msg,
         if (msg->msg_flags & MSG_OOB)
                 return -EOPNOTSUPP;
 
-        if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_NOSIGNAL|MSG_ERRQUEUE))
+        if (msg->msg_flags & ~(MSG_DONTWAIT|MSG_NOSIGNAL|MSG_ERRQUEUE|
+                               MSG_CMSG_COMPAT))
                 return -EINVAL;
 
         if (len < 4 || len > HCI_MAX_FRAME_SIZE)
diff --git a/net/core/datagram.c b/net/core/datagram.c
index 963732e775df..58dfa23d12ca 100644
--- a/net/core/datagram.c
+++ b/net/core/datagram.c
@@ -740,7 +740,7 @@ int skb_copy_and_csum_datagram_msg(struct sk_buff *skb,
 
         if (msg_data_left(msg) < chunk) {
                 if (__skb_checksum_complete(skb))
-                        goto csum_error;
+                        return -EINVAL;
                 if (skb_copy_datagram_msg(skb, hlen, msg, chunk))
                         goto fault;
         } else {
@@ -748,15 +748,16 @@ int skb_copy_and_csum_datagram_msg(struct sk_buff *skb,
                 if (skb_copy_and_csum_datagram(skb, hlen, &msg->msg_iter,
                                                chunk, &csum))
                         goto fault;
-                if (csum_fold(csum))
-                        goto csum_error;
+
+                if (csum_fold(csum)) {
+                        iov_iter_revert(&msg->msg_iter, chunk);
+                        return -EINVAL;
+                }
+
                 if (unlikely(skb->ip_summed == CHECKSUM_COMPLETE))
                         netdev_rx_csum_fault(skb->dev);
         }
         return 0;
-csum_error:
-        iov_iter_revert(&msg->msg_iter, chunk);
-        return -EINVAL;
 fault:
         return -EFAULT;
 }
diff --git a/tools/perf/util/auxtrace.c b/tools/perf/util/auxtrace.c
index c5a6e0b12452..78bd632f144d 100644
--- a/tools/perf/util/auxtrace.c
+++ b/tools/perf/util/auxtrace.c
@@ -1826,7 +1826,7 @@ static int addr_filter__resolve_kernel_syms(struct addr_filter *filt)
                 filt->addr = start;
                 if (filt->range && !filt->size && !filt->sym_to) {
                         filt->size = size;
-                        no_size = !!size;
+                        no_size = !size;
                 }
         }
 
@@ -1840,7 +1840,7 @@ static int addr_filter__resolve_kernel_syms(struct addr_filter *filt)
                 if (err)
                         return err;
                 filt->size = start + size - filt->addr;
-                no_size = !!size;
+                no_size = !size;
         }
 
         /* The very last symbol in kallsyms does not imply a particular size */
diff --git a/tools/testing/selftests/x86/ldt_gdt.c b/tools/testing/selftests/x86/ldt_gdt.c
index 4af47079cf04..e717fed80219 100644
--- a/tools/testing/selftests/x86/ldt_gdt.c
+++ b/tools/testing/selftests/x86/ldt_gdt.c
@@ -403,6 +403,51 @@ static void *threadproc(void *ctx)
         }
 }
 
+#ifdef __i386__
+
+#ifndef SA_RESTORE
+#define SA_RESTORER 0x04000000
+#endif
+
+/*
+ * The UAPI header calls this 'struct sigaction', which conflicts with
+ * glibc.  Sigh.
+ */
+struct fake_ksigaction {
+        void *handler;  /* the real type is nasty */
+        unsigned long sa_flags;
+        void (*sa_restorer)(void);
+        unsigned char sigset[8];
+};
+
+static void fix_sa_restorer(int sig)
+{
+        struct fake_ksigaction ksa;
+
+        if (syscall(SYS_rt_sigaction, sig, NULL, &ksa, 8) == 0) {
+                /*
+                 * glibc has a nasty bug: it sometimes writes garbage to
+                 * sa_restorer.  This interacts quite badly with anything
+                 * that fiddles with SS because it can trigger legacy
+                 * stack switching.  Patch it up.  See:
+                 *
+                 * https://sourceware.org/bugzilla/show_bug.cgi?id=21269
+                 */
+                if (!(ksa.sa_flags & SA_RESTORER) && ksa.sa_restorer) {
+                        ksa.sa_restorer = NULL;
+                        if (syscall(SYS_rt_sigaction, sig, &ksa, NULL,
+                                    sizeof(ksa.sigset)) != 0)
+                                err(1, "rt_sigaction");
+                }
+        }
+}
+#else
+static void fix_sa_restorer(int sig)
+{
+        /* 64-bit glibc works fine. */
+}
+#endif
+
 static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
                        int flags)
 {
@@ -414,6 +459,7 @@ static void sethandler(int sig, void (*handler)(int, siginfo_t *, void *),
         if (sigaction(sig, &sa, 0))
                 err(1, "sigaction");
 
+        fix_sa_restorer(sig);
 }
 
 static jmp_buf jmpbuf;