diff --git a/Makefile b/Makefile
index ff9d6bbf2210..57e1ea2a189a 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 4
-SUBLEVEL = 94
+SUBLEVEL = 95
 EXTRAVERSION =
 NAME = Blurry Fish Butt
 
diff --git a/arch/parisc/kernel/syscall.S b/arch/parisc/kernel/syscall.S
index a86b19fccb63..c6b855f7892c 100644
--- a/arch/parisc/kernel/syscall.S
+++ b/arch/parisc/kernel/syscall.S
@@ -479,11 +479,6 @@ lws_start:
        comiclr,>>      __NR_lws_entries, %r20, %r0
        b,n     lws_exit_nosys
 
-       /* WARNING: Trashing sr2 and sr3 */
-       mfsp    %sr7,%r1                        /* get userspace into sr3 */
-       mtsp    %r1,%sr3
-       mtsp    %r0,%sr2                        /* get kernel space into sr2 */
-
        /* Load table start */
        ldil    L%lws_table, %r1
        ldo     R%lws_table(%r1), %r28  /* Scratch use of r28 */
@@ -632,9 +627,9 @@ cas_action:
        stw     %r1, 4(%sr2,%r20)
 #endif
        /* The load and store could fail */
-1:     ldw,ma  0(%sr3,%r26), %r28
+1:     ldw,ma  0(%r26), %r28
        sub,<>  %r28, %r25, %r0
-2:     stw,ma  %r24, 0(%sr3,%r26)
+2:     stw,ma  %r24, 0(%r26)
        /* Free lock */
        stw,ma  %r20, 0(%sr2,%r20)
 #if ENABLE_LWS_DEBUG
@@ -711,9 +706,9 @@ lws_compare_and_swap_2:
        nop
 
        /* 8bit load */
-4:     ldb     0(%sr3,%r25), %r25
+4:     ldb     0(%r25), %r25
        b       cas2_lock_start
-5:     ldb     0(%sr3,%r24), %r24
+5:     ldb     0(%r24), %r24
        nop
        nop
        nop
@@ -721,9 +716,9 @@ lws_compare_and_swap_2:
        nop
 
        /* 16bit load */
-6:     ldh     0(%sr3,%r25), %r25
+6:     ldh     0(%r25), %r25
        b       cas2_lock_start
-7:     ldh     0(%sr3,%r24), %r24
+7:     ldh     0(%r24), %r24
        nop
        nop
        nop
@@ -731,9 +726,9 @@ lws_compare_and_swap_2:
        nop
 
        /* 32bit load */
-8:     ldw     0(%sr3,%r25), %r25
+8:     ldw     0(%r25), %r25
        b       cas2_lock_start
-9:     ldw     0(%sr3,%r24), %r24
+9:     ldw     0(%r24), %r24
        nop
        nop
        nop
@@ -742,14 +737,14 @@ lws_compare_and_swap_2:
 
        /* 64bit load */
 #ifdef CONFIG_64BIT
-10:    ldd     0(%sr3,%r25), %r25
-11:    ldd     0(%sr3,%r24), %r24
+10:    ldd     0(%r25), %r25
+11:    ldd     0(%r24), %r24
 #else
-       /* Load new value into r22/r23 - high/low */
-10:    ldw     0(%sr3,%r25), %r22
-11:    ldw     4(%sr3,%r25), %r23
+       /* Load old value into r22/r23 - high/low */
+10:    ldw     0(%r25), %r22
+11:    ldw     4(%r25), %r23
        /* Load new value into fr4 for atomic store later */
-12:    flddx   0(%sr3,%r24), %fr4
+12:    flddx   0(%r24), %fr4
 #endif
 
 cas2_lock_start:
@@ -799,30 +794,30 @@ cas2_action:
        ldo     1(%r0),%r28
 
        /* 8bit CAS */
-13:    ldb,ma  0(%sr3,%r26), %r29
+13:    ldb,ma  0(%r26), %r29
        sub,=   %r29, %r25, %r0
        b,n     cas2_end
-14:    stb,ma  %r24, 0(%sr3,%r26)
+14:    stb,ma  %r24, 0(%r26)
        b       cas2_end
        copy    %r0, %r28
        nop
        nop
 
        /* 16bit CAS */
-15:    ldh,ma  0(%sr3,%r26), %r29
+15:    ldh,ma  0(%r26), %r29
        sub,=   %r29, %r25, %r0
        b,n     cas2_end
-16:    sth,ma  %r24, 0(%sr3,%r26)
+16:    sth,ma  %r24, 0(%r26)
        b       cas2_end
        copy    %r0, %r28
        nop
        nop
 
        /* 32bit CAS */
-17:    ldw,ma  0(%sr3,%r26), %r29
+17:    ldw,ma  0(%r26), %r29
        sub,=   %r29, %r25, %r0
        b,n     cas2_end
-18:    stw,ma  %r24, 0(%sr3,%r26)
+18:    stw,ma  %r24, 0(%r26)
        b       cas2_end
        copy    %r0, %r28
        nop
@@ -830,22 +825,22 @@ cas2_action:
 
        /* 64bit CAS */
 #ifdef CONFIG_64BIT
-19:    ldd,ma  0(%sr3,%r26), %r29
+19:    ldd,ma  0(%r26), %r29
        sub,*=  %r29, %r25, %r0
        b,n     cas2_end
-20:    std,ma  %r24, 0(%sr3,%r26)
+20:    std,ma  %r24, 0(%r26)
        copy    %r0, %r28
 #else
        /* Compare first word */
-19:    ldw,ma  0(%sr3,%r26), %r29
+19:    ldw     0(%r26), %r29
        sub,=   %r29, %r22, %r0
        b,n     cas2_end
        /* Compare second word */
-20:    ldw,ma  4(%sr3,%r26), %r29
+20:    ldw     4(%r26), %r29
        sub,=   %r29, %r23, %r0
        b,n     cas2_end
        /* Perform the store */
-21:    fstdx   %fr4, 0(%sr3,%r26)
+21:    fstdx   %fr4, 0(%r26)
        copy    %r0, %r28
 #endif
 
diff --git a/crypto/asymmetric_keys/pkcs7_parser.c 
b/crypto/asymmetric_keys/pkcs7_parser.c
index 8f3056cd0399..2516e97c58f1 100644
--- a/crypto/asymmetric_keys/pkcs7_parser.c
+++ b/crypto/asymmetric_keys/pkcs7_parser.c
@@ -90,6 +90,9 @@ static int pkcs7_check_authattrs(struct pkcs7_message *msg)
        bool want;
 
        sinfo = msg->signed_infos;
+       if (!sinfo)
+               goto inconsistent;
+
        if (sinfo->authattrs) {
                want = true;
                msg->have_authattrs = true;
diff --git a/drivers/bus/mvebu-mbus.c b/drivers/bus/mvebu-mbus.c
index c43c3d2baf73..0d628becf37f 100644
--- a/drivers/bus/mvebu-mbus.c
+++ b/drivers/bus/mvebu-mbus.c
@@ -720,7 +720,7 @@ mvebu_mbus_default_setup_cpu_target(struct mvebu_mbus_state 
*mbus)
                        if (mbus->hw_io_coherency)
                                w->mbus_attr |= ATTR_HW_COHERENCY;
                        w->base = base & DDR_BASE_CS_LOW_MASK;
-                       w->size = (size | ~DDR_SIZE_MASK) + 1;
+                       w->size = (u64)(size | ~DDR_SIZE_MASK) + 1;
                }
        }
        mvebu_mbus_dram_info.num_cs = cs;
diff --git a/drivers/clocksource/cs5535-clockevt.c 
b/drivers/clocksource/cs5535-clockevt.c
index 9a7e37cf56b0..e1d7373e63e0 100644
--- a/drivers/clocksource/cs5535-clockevt.c
+++ b/drivers/clocksource/cs5535-clockevt.c
@@ -117,7 +117,8 @@ static irqreturn_t mfgpt_tick(int irq, void *dev_id)
        /* Turn off the clock (and clear the event) */
        disable_timer(cs5535_event_clock);
 
-       if (clockevent_state_shutdown(&cs5535_clockevent))
+       if (clockevent_state_detached(&cs5535_clockevent) ||
+           clockevent_state_shutdown(&cs5535_clockevent))
                return IRQ_HANDLED;
 
        /* Clear the counter */
diff --git a/drivers/gpu/drm/nouveau/nvkm/engine/bsp/g84.c 
b/drivers/gpu/drm/nouveau/nvkm/engine/bsp/g84.c
index 3ef01071f073..103471ff4dc4 100644
--- a/drivers/gpu/drm/nouveau/nvkm/engine/bsp/g84.c
+++ b/drivers/gpu/drm/nouveau/nvkm/engine/bsp/g84.c
@@ -40,5 +40,5 @@ int
 g84_bsp_new(struct nvkm_device *device, int index, struct nvkm_engine 
**pengine)
 {
        return nvkm_xtensa_new_(&g84_bsp, device, index,
-                               true, 0x103000, pengine);
+                               device->chipset != 0x92, 0x103000, pengine);
 }
diff --git a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/base.c 
b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/base.c
index e04a2296ecd0..5bb7f7e0f11f 100644
--- a/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/base.c
+++ b/drivers/gpu/drm/nouveau/nvkm/subdev/mmu/base.c
@@ -240,6 +240,8 @@ nvkm_vm_unmap_pgt(struct nvkm_vm *vm, int big, u32 fpde, 
u32 lpde)
                        mmu->func->map_pgt(vpgd->obj, pde, vpgt->mem);
                }
 
+               mmu->func->flush(vm);
+
                nvkm_memory_del(&pgt);
        }
 }
diff --git a/drivers/i2c/busses/i2c-ismt.c b/drivers/i2c/busses/i2c-ismt.c
index 639d1a9c8793..1111cb966a44 100644
--- a/drivers/i2c/busses/i2c-ismt.c
+++ b/drivers/i2c/busses/i2c-ismt.c
@@ -338,12 +338,15 @@ static int ismt_process_desc(const struct ismt_desc *desc,
                        data->word = dma_buffer[0] | (dma_buffer[1] << 8);
                        break;
                case I2C_SMBUS_BLOCK_DATA:
-               case I2C_SMBUS_I2C_BLOCK_DATA:
                        if (desc->rxbytes != dma_buffer[0] + 1)
                                return -EMSGSIZE;
 
                        memcpy(data->block, dma_buffer, desc->rxbytes);
                        break;
+               case I2C_SMBUS_I2C_BLOCK_DATA:
+                       memcpy(&data->block[1], dma_buffer, desc->rxbytes);
+                       data->block[0] = desc->rxbytes;
+                       break;
                }
                return 0;
        }
diff --git a/drivers/net/can/usb/esd_usb2.c b/drivers/net/can/usb/esd_usb2.c
index 113e64fcd73b..4c6707ecc619 100644
--- a/drivers/net/can/usb/esd_usb2.c
+++ b/drivers/net/can/usb/esd_usb2.c
@@ -333,7 +333,7 @@ static void esd_usb2_rx_can_msg(struct esd_usb2_net_priv 
*priv,
                }
 
                cf->can_id = id & ESD_IDMASK;
-               cf->can_dlc = get_can_dlc(msg->msg.rx.dlc);
+               cf->can_dlc = get_can_dlc(msg->msg.rx.dlc & ~ESD_RTR);
 
                if (id & ESD_EXTID)
                        cf->can_id |= CAN_EFF_FLAG;
diff --git a/drivers/net/can/usb/gs_usb.c b/drivers/net/can/usb/gs_usb.c
index ae5709354546..27e2352fcc42 100644
--- a/drivers/net/can/usb/gs_usb.c
+++ b/drivers/net/can/usb/gs_usb.c
@@ -356,6 +356,8 @@ static void gs_usb_receive_bulk_callback(struct urb *urb)
 
                gs_free_tx_context(txc);
 
+               atomic_dec(&dev->active_tx_urbs);
+
                netif_wake_queue(netdev);
        }
 
@@ -444,14 +446,6 @@ static void gs_usb_xmit_callback(struct urb *urb)
                          urb->transfer_buffer_length,
                          urb->transfer_buffer,
                          urb->transfer_dma);
-
-       atomic_dec(&dev->active_tx_urbs);
-
-       if (!netif_device_present(netdev))
-               return;
-
-       if (netif_queue_stopped(netdev))
-               netif_wake_queue(netdev);
 }
 
 static netdev_tx_t gs_can_start_xmit(struct sk_buff *skb, struct net_device 
*netdev)
diff --git a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_n.c 
b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_n.c
index 99dac9b8a082..c75bfd3f8cb3 100644
--- a/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_n.c
+++ b/drivers/net/wireless/brcm80211/brcmsmac/phy/phy_n.c
@@ -14764,8 +14764,8 @@ static void 
wlc_phy_ipa_restore_tx_digi_filts_nphy(struct brcms_phy *pi)
 }
 
 static void
-wlc_phy_set_rfseq_nphy(struct brcms_phy *pi, u8 cmd, u8 *events, u8 *dlys,
-                      u8 len)
+wlc_phy_set_rfseq_nphy(struct brcms_phy *pi, u8 cmd, const u8 *events,
+                      const u8 *dlys, u8 len)
 {
        u32 t1_offset, t2_offset;
        u8 ctr;
@@ -15240,16 +15240,16 @@ static void 
wlc_phy_workarounds_nphy_gainctrl_2057_rev5(struct brcms_phy *pi)
 static void wlc_phy_workarounds_nphy_gainctrl_2057_rev6(struct brcms_phy *pi)
 {
        u16 currband;
-       s8 lna1G_gain_db_rev7[] = { 9, 14, 19, 24 };
-       s8 *lna1_gain_db = NULL;
-       s8 *lna1_gain_db_2 = NULL;
-       s8 *lna2_gain_db = NULL;
-       s8 tiaA_gain_db_rev7[] = { -9, -6, -3, 0, 3, 3, 3, 3, 3, 3 };
-       s8 *tia_gain_db;
-       s8 tiaA_gainbits_rev7[] = { 0, 1, 2, 3, 4, 4, 4, 4, 4, 4 };
-       s8 *tia_gainbits;
-       u16 rfseqA_init_gain_rev7[] = { 0x624f, 0x624f };
-       u16 *rfseq_init_gain;
+       static const s8 lna1G_gain_db_rev7[] = { 9, 14, 19, 24 };
+       const s8 *lna1_gain_db = NULL;
+       const s8 *lna1_gain_db_2 = NULL;
+       const s8 *lna2_gain_db = NULL;
+       static const s8 tiaA_gain_db_rev7[] = { -9, -6, -3, 0, 3, 3, 3, 3, 3, 3 
};
+       const s8 *tia_gain_db;
+       static const s8 tiaA_gainbits_rev7[] = { 0, 1, 2, 3, 4, 4, 4, 4, 4, 4 };
+       const s8 *tia_gainbits;
+       static const u16 rfseqA_init_gain_rev7[] = { 0x624f, 0x624f };
+       const u16 *rfseq_init_gain;
        u16 init_gaincode;
        u16 clip1hi_gaincode;
        u16 clip1md_gaincode = 0;
@@ -15310,10 +15310,9 @@ static void 
wlc_phy_workarounds_nphy_gainctrl_2057_rev6(struct brcms_phy *pi)
 
                        if ((freq <= 5080) || (freq == 5825)) {
 
-                               s8 lna1A_gain_db_rev7[] = { 11, 16, 20, 24 };
-                               s8 lna1A_gain_db_2_rev7[] = {
-                                       11, 17, 22, 25};
-                               s8 lna2A_gain_db_rev7[] = { -1, 6, 10, 14 };
+                               static const s8 lna1A_gain_db_rev7[] = { 11, 
16, 20, 24 };
+                               static const s8 lna1A_gain_db_2_rev7[] = { 11, 
17, 22, 25};
+                               static const s8 lna2A_gain_db_rev7[] = { -1, 6, 
10, 14 };
 
                                crsminu_th = 0x3e;
                                lna1_gain_db = lna1A_gain_db_rev7;
@@ -15321,10 +15320,9 @@ static void 
wlc_phy_workarounds_nphy_gainctrl_2057_rev6(struct brcms_phy *pi)
                                lna2_gain_db = lna2A_gain_db_rev7;
                        } else if ((freq >= 5500) && (freq <= 5700)) {
 
-                               s8 lna1A_gain_db_rev7[] = { 11, 17, 21, 25 };
-                               s8 lna1A_gain_db_2_rev7[] = {
-                                       12, 18, 22, 26};
-                               s8 lna2A_gain_db_rev7[] = { 1, 8, 12, 16 };
+                               static const s8 lna1A_gain_db_rev7[] = { 11, 
17, 21, 25 };
+                               static const s8 lna1A_gain_db_2_rev7[] = { 12, 
18, 22, 26};
+                               static const s8 lna2A_gain_db_rev7[] = { 1, 8, 
12, 16 };
 
                                crsminu_th = 0x45;
                                clip1md_gaincode_B = 0x14;
@@ -15335,10 +15333,9 @@ static void 
wlc_phy_workarounds_nphy_gainctrl_2057_rev6(struct brcms_phy *pi)
                                lna2_gain_db = lna2A_gain_db_rev7;
                        } else {
 
-                               s8 lna1A_gain_db_rev7[] = { 12, 18, 22, 26 };
-                               s8 lna1A_gain_db_2_rev7[] = {
-                                       12, 18, 22, 26};
-                               s8 lna2A_gain_db_rev7[] = { -1, 6, 10, 14 };
+                               static const s8 lna1A_gain_db_rev7[] = { 12, 
18, 22, 26 };
+                               static const s8 lna1A_gain_db_2_rev7[] = { 12, 
18, 22, 26};
+                               static const s8 lna2A_gain_db_rev7[] = { -1, 6, 
10, 14 };
 
                                crsminu_th = 0x41;
                                lna1_gain_db = lna1A_gain_db_rev7;
@@ -15450,65 +15447,65 @@ static void wlc_phy_workarounds_nphy_gainctrl(struct 
brcms_phy *pi)
                NPHY_RFSEQ_CMD_CLR_HIQ_DIS,
                NPHY_RFSEQ_CMD_SET_HPF_BW
        };
-       u8 rfseq_updategainu_dlys[] = { 10, 30, 1 };
-       s8 lna1G_gain_db[] = { 7, 11, 16, 23 };
-       s8 lna1G_gain_db_rev4[] = { 8, 12, 17, 25 };
-       s8 lna1G_gain_db_rev5[] = { 9, 13, 18, 26 };
-       s8 lna1G_gain_db_rev6[] = { 8, 13, 18, 25 };
-       s8 lna1G_gain_db_rev6_224B0[] = { 10, 14, 19, 27 };
-       s8 lna1A_gain_db[] = { 7, 11, 17, 23 };
-       s8 lna1A_gain_db_rev4[] = { 8, 12, 18, 23 };
-       s8 lna1A_gain_db_rev5[] = { 6, 10, 16, 21 };
-       s8 lna1A_gain_db_rev6[] = { 6, 10, 16, 21 };
-       s8 *lna1_gain_db = NULL;
-       s8 lna2G_gain_db[] = { -5, 6, 10, 14 };
-       s8 lna2G_gain_db_rev5[] = { -3, 7, 11, 16 };
-       s8 lna2G_gain_db_rev6[] = { -5, 6, 10, 14 };
-       s8 lna2G_gain_db_rev6_224B0[] = { -5, 6, 10, 15 };
-       s8 lna2A_gain_db[] = { -6, 2, 6, 10 };
-       s8 lna2A_gain_db_rev4[] = { -5, 2, 6, 10 };
-       s8 lna2A_gain_db_rev5[] = { -7, 0, 4, 8 };
-       s8 lna2A_gain_db_rev6[] = { -7, 0, 4, 8 };
-       s8 *lna2_gain_db = NULL;
-       s8 tiaG_gain_db[] = {
+       static const u8 rfseq_updategainu_dlys[] = { 10, 30, 1 };
+       static const s8 lna1G_gain_db[] = { 7, 11, 16, 23 };
+       static const s8 lna1G_gain_db_rev4[] = { 8, 12, 17, 25 };
+       static const s8 lna1G_gain_db_rev5[] = { 9, 13, 18, 26 };
+       static const s8 lna1G_gain_db_rev6[] = { 8, 13, 18, 25 };
+       static const s8 lna1G_gain_db_rev6_224B0[] = { 10, 14, 19, 27 };
+       static const s8 lna1A_gain_db[] = { 7, 11, 17, 23 };
+       static const s8 lna1A_gain_db_rev4[] = { 8, 12, 18, 23 };
+       static const s8 lna1A_gain_db_rev5[] = { 6, 10, 16, 21 };
+       static const s8 lna1A_gain_db_rev6[] = { 6, 10, 16, 21 };
+       const s8 *lna1_gain_db = NULL;
+       static const s8 lna2G_gain_db[] = { -5, 6, 10, 14 };
+       static const s8 lna2G_gain_db_rev5[] = { -3, 7, 11, 16 };
+       static const s8 lna2G_gain_db_rev6[] = { -5, 6, 10, 14 };
+       static const s8 lna2G_gain_db_rev6_224B0[] = { -5, 6, 10, 15 };
+       static const s8 lna2A_gain_db[] = { -6, 2, 6, 10 };
+       static const s8 lna2A_gain_db_rev4[] = { -5, 2, 6, 10 };
+       static const s8 lna2A_gain_db_rev5[] = { -7, 0, 4, 8 };
+       static const s8 lna2A_gain_db_rev6[] = { -7, 0, 4, 8 };
+       const s8 *lna2_gain_db = NULL;
+       static const s8 tiaG_gain_db[] = {
                0x0A, 0x0A, 0x0A, 0x0A, 0x0A, 0x0A, 0x0A, 0x0A, 0x0A, 0x0A };
-       s8 tiaA_gain_db[] = {
+       static const s8 tiaA_gain_db[] = {
                0x13, 0x13, 0x13, 0x13, 0x13, 0x13, 0x13, 0x13, 0x13, 0x13 };
-       s8 tiaA_gain_db_rev4[] = {
+       static const s8 tiaA_gain_db_rev4[] = {
                0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d };
-       s8 tiaA_gain_db_rev5[] = {
+       static const s8 tiaA_gain_db_rev5[] = {
                0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d };
-       s8 tiaA_gain_db_rev6[] = {
+       static const s8 tiaA_gain_db_rev6[] = {
                0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d, 0x0d };
-       s8 *tia_gain_db;
-       s8 tiaG_gainbits[] = {
+       const s8 *tia_gain_db;
+       static const s8 tiaG_gainbits[] = {
                0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03, 0x03 };
-       s8 tiaA_gainbits[] = {
+       static const s8 tiaA_gainbits[] = {
                0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06, 0x06 };
-       s8 tiaA_gainbits_rev4[] = {
+       static const s8 tiaA_gainbits_rev4[] = {
                0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04 };
-       s8 tiaA_gainbits_rev5[] = {
+       static const s8 tiaA_gainbits_rev5[] = {
                0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04 };
-       s8 tiaA_gainbits_rev6[] = {
+       static const s8 tiaA_gainbits_rev6[] = {
                0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04, 0x04 };
-       s8 *tia_gainbits;
-       s8 lpf_gain_db[] = { 0x00, 0x06, 0x0c, 0x12, 0x12, 0x12 };
-       s8 lpf_gainbits[] = { 0x00, 0x01, 0x02, 0x03, 0x03, 0x03 };
-       u16 rfseqG_init_gain[] = { 0x613f, 0x613f, 0x613f, 0x613f };
-       u16 rfseqG_init_gain_rev4[] = { 0x513f, 0x513f, 0x513f, 0x513f };
-       u16 rfseqG_init_gain_rev5[] = { 0x413f, 0x413f, 0x413f, 0x413f };
-       u16 rfseqG_init_gain_rev5_elna[] = {
+       const s8 *tia_gainbits;
+       static const s8 lpf_gain_db[] = { 0x00, 0x06, 0x0c, 0x12, 0x12, 0x12 };
+       static const s8 lpf_gainbits[] = { 0x00, 0x01, 0x02, 0x03, 0x03, 0x03 };
+       static const u16 rfseqG_init_gain[] = { 0x613f, 0x613f, 0x613f, 0x613f 
};
+       static const u16 rfseqG_init_gain_rev4[] = { 0x513f, 0x513f, 0x513f, 
0x513f };
+       static const u16 rfseqG_init_gain_rev5[] = { 0x413f, 0x413f, 0x413f, 
0x413f };
+       static const u16 rfseqG_init_gain_rev5_elna[] = {
                0x013f, 0x013f, 0x013f, 0x013f };
-       u16 rfseqG_init_gain_rev6[] = { 0x513f, 0x513f };
-       u16 rfseqG_init_gain_rev6_224B0[] = { 0x413f, 0x413f };
-       u16 rfseqG_init_gain_rev6_elna[] = { 0x113f, 0x113f };
-       u16 rfseqA_init_gain[] = { 0x516f, 0x516f, 0x516f, 0x516f };
-       u16 rfseqA_init_gain_rev4[] = { 0x614f, 0x614f, 0x614f, 0x614f };
-       u16 rfseqA_init_gain_rev4_elna[] = {
+       static const u16 rfseqG_init_gain_rev6[] = { 0x513f, 0x513f };
+       static const u16 rfseqG_init_gain_rev6_224B0[] = { 0x413f, 0x413f };
+       static const u16 rfseqG_init_gain_rev6_elna[] = { 0x113f, 0x113f };
+       static const u16 rfseqA_init_gain[] = { 0x516f, 0x516f, 0x516f, 0x516f 
};
+       static const u16 rfseqA_init_gain_rev4[] = { 0x614f, 0x614f, 0x614f, 
0x614f };
+       static const u16 rfseqA_init_gain_rev4_elna[] = {
                0x314f, 0x314f, 0x314f, 0x314f };
-       u16 rfseqA_init_gain_rev5[] = { 0x714f, 0x714f, 0x714f, 0x714f };
-       u16 rfseqA_init_gain_rev6[] = { 0x714f, 0x714f };
-       u16 *rfseq_init_gain;
+       static const u16 rfseqA_init_gain_rev5[] = { 0x714f, 0x714f, 0x714f, 
0x714f };
+       static const u16 rfseqA_init_gain_rev6[] = { 0x714f, 0x714f };
+       const u16 *rfseq_init_gain;
        u16 initG_gaincode = 0x627e;
        u16 initG_gaincode_rev4 = 0x527e;
        u16 initG_gaincode_rev5 = 0x427e;
@@ -15538,10 +15535,10 @@ static void wlc_phy_workarounds_nphy_gainctrl(struct 
brcms_phy *pi)
        u16 clip1mdA_gaincode_rev6 = 0x2084;
        u16 clip1md_gaincode = 0;
        u16 clip1loG_gaincode = 0x0074;
-       u16 clip1loG_gaincode_rev5[] = {
+       static const u16 clip1loG_gaincode_rev5[] = {
                0x0062, 0x0064, 0x006a, 0x106a, 0x106c, 0x1074, 0x107c, 0x207c
        };
-       u16 clip1loG_gaincode_rev6[] = {
+       static const u16 clip1loG_gaincode_rev6[] = {
                0x106a, 0x106c, 0x1074, 0x107c, 0x007e, 0x107e, 0x207e, 0x307e
        };
        u16 clip1loG_gaincode_rev6_224B0 = 0x1074;
@@ -16066,7 +16063,7 @@ static void wlc_phy_workarounds_nphy_gainctrl(struct 
brcms_phy *pi)
 
 static void wlc_phy_workarounds_nphy(struct brcms_phy *pi)
 {
-       u8 rfseq_rx2tx_events[] = {
+       static const u8 rfseq_rx2tx_events[] = {
                NPHY_RFSEQ_CMD_NOP,
                NPHY_RFSEQ_CMD_RXG_FBW,
                NPHY_RFSEQ_CMD_TR_SWITCH,
@@ -16076,7 +16073,7 @@ static void wlc_phy_workarounds_nphy(struct brcms_phy 
*pi)
                NPHY_RFSEQ_CMD_EXT_PA
        };
        u8 rfseq_rx2tx_dlys[] = { 8, 6, 6, 2, 4, 60, 1 };
-       u8 rfseq_tx2rx_events[] = {
+       static const u8 rfseq_tx2rx_events[] = {
                NPHY_RFSEQ_CMD_NOP,
                NPHY_RFSEQ_CMD_EXT_PA,
                NPHY_RFSEQ_CMD_TX_GAIN,
@@ -16085,8 +16082,8 @@ static void wlc_phy_workarounds_nphy(struct brcms_phy 
*pi)
                NPHY_RFSEQ_CMD_RXG_FBW,
                NPHY_RFSEQ_CMD_CLR_HIQ_DIS
        };
-       u8 rfseq_tx2rx_dlys[] = { 8, 6, 2, 4, 4, 6, 1 };
-       u8 rfseq_tx2rx_events_rev3[] = {
+       static const u8 rfseq_tx2rx_dlys[] = { 8, 6, 2, 4, 4, 6, 1 };
+       static const u8 rfseq_tx2rx_events_rev3[] = {
                NPHY_REV3_RFSEQ_CMD_EXT_PA,
                NPHY_REV3_RFSEQ_CMD_INT_PA_PU,
                NPHY_REV3_RFSEQ_CMD_TX_GAIN,
@@ -16096,7 +16093,7 @@ static void wlc_phy_workarounds_nphy(struct brcms_phy 
*pi)
                NPHY_REV3_RFSEQ_CMD_CLR_HIQ_DIS,
                NPHY_REV3_RFSEQ_CMD_END
        };
-       u8 rfseq_tx2rx_dlys_rev3[] = { 8, 4, 2, 2, 4, 4, 6, 1 };
+       static const u8 rfseq_tx2rx_dlys_rev3[] = { 8, 4, 2, 2, 4, 4, 6, 1 };
        u8 rfseq_rx2tx_events_rev3[] = {
                NPHY_REV3_RFSEQ_CMD_NOP,
                NPHY_REV3_RFSEQ_CMD_RXG_FBW,
@@ -16110,7 +16107,7 @@ static void wlc_phy_workarounds_nphy(struct brcms_phy 
*pi)
        };
        u8 rfseq_rx2tx_dlys_rev3[] = { 8, 6, 6, 4, 4, 18, 42, 1, 1 };
 
-       u8 rfseq_rx2tx_events_rev3_ipa[] = {
+       static const u8 rfseq_rx2tx_events_rev3_ipa[] = {
                NPHY_REV3_RFSEQ_CMD_NOP,
                NPHY_REV3_RFSEQ_CMD_RXG_FBW,
                NPHY_REV3_RFSEQ_CMD_TR_SWITCH,
@@ -16121,15 +16118,15 @@ static void wlc_phy_workarounds_nphy(struct brcms_phy 
*pi)
                NPHY_REV3_RFSEQ_CMD_INT_PA_PU,
                NPHY_REV3_RFSEQ_CMD_END
        };
-       u8 rfseq_rx2tx_dlys_rev3_ipa[] = { 8, 6, 6, 4, 4, 16, 43, 1, 1 };
-       u16 rfseq_rx2tx_dacbufpu_rev7[] = { 0x10f, 0x10f };
+       static const u8 rfseq_rx2tx_dlys_rev3_ipa[] = { 8, 6, 6, 4, 4, 16, 43, 
1, 1 };
+       static const u16 rfseq_rx2tx_dacbufpu_rev7[] = { 0x10f, 0x10f };
 
        s16 alpha0, alpha1, alpha2;
        s16 beta0, beta1, beta2;
        u32 leg_data_weights, ht_data_weights, nss1_data_weights,
            stbc_data_weights;
        u8 chan_freq_range = 0;
-       u16 dac_control = 0x0002;
+       static const u16 dac_control = 0x0002;
        u16 aux_adc_vmid_rev7_core0[] = { 0x8e, 0x96, 0x96, 0x96 };
        u16 aux_adc_vmid_rev7_core1[] = { 0x8f, 0x9f, 0x9f, 0x96 };
        u16 aux_adc_vmid_rev4[] = { 0xa2, 0xb4, 0xb4, 0x89 };
@@ -16139,8 +16136,8 @@ static void wlc_phy_workarounds_nphy(struct brcms_phy 
*pi)
        u16 aux_adc_gain_rev4[] = { 0x02, 0x02, 0x02, 0x00 };
        u16 aux_adc_gain_rev3[] = { 0x02, 0x02, 0x02, 0x00 };
        u16 *aux_adc_gain;
-       u16 sk_adc_vmid[] = { 0xb4, 0xb4, 0xb4, 0x24 };
-       u16 sk_adc_gain[] = { 0x02, 0x02, 0x02, 0x02 };
+       static const u16 sk_adc_vmid[] = { 0xb4, 0xb4, 0xb4, 0x24 };
+       static const u16 sk_adc_gain[] = { 0x02, 0x02, 0x02, 0x02 };
        s32 min_nvar_val = 0x18d;
        s32 min_nvar_offset_6mbps = 20;
        u8 pdetrange;
@@ -16151,9 +16148,9 @@ static void wlc_phy_workarounds_nphy(struct brcms_phy 
*pi)
        u16 rfseq_rx2tx_lpf_h_hpc_rev7 = 0x77;
        u16 rfseq_tx2rx_lpf_h_hpc_rev7 = 0x77;
        u16 rfseq_pktgn_lpf_h_hpc_rev7 = 0x77;
-       u16 rfseq_htpktgn_lpf_hpc_rev7[] = { 0x77, 0x11, 0x11 };
-       u16 rfseq_pktgn_lpf_hpc_rev7[] = { 0x11, 0x11 };
-       u16 rfseq_cckpktgn_lpf_hpc_rev7[] = { 0x11, 0x11 };
+       static const u16 rfseq_htpktgn_lpf_hpc_rev7[] = { 0x77, 0x11, 0x11 };
+       static const u16 rfseq_pktgn_lpf_hpc_rev7[] = { 0x11, 0x11 };
+       static const u16 rfseq_cckpktgn_lpf_hpc_rev7[] = { 0x11, 0x11 };
        u16 ipalvlshift_3p3_war_en = 0;
        u16 rccal_bcap_val, rccal_scap_val;
        u16 rccal_tx20_11b_bcap = 0;
@@ -24291,13 +24288,13 @@ static void wlc_phy_update_txcal_ladder_nphy(struct 
brcms_phy *pi, u16 core)
        u16 bbmult;
        u16 tblentry;
 
-       struct nphy_txiqcal_ladder ladder_lo[] = {
+       static const struct nphy_txiqcal_ladder ladder_lo[] = {
                {3, 0}, {4, 0}, {6, 0}, {9, 0}, {13, 0}, {18, 0},
                {25, 0}, {25, 1}, {25, 2}, {25, 3}, {25, 4}, {25, 5},
                {25, 6}, {25, 7}, {35, 7}, {50, 7}, {71, 7}, {100, 7}
        };
 
-       struct nphy_txiqcal_ladder ladder_iq[] = {
+       static const struct nphy_txiqcal_ladder ladder_iq[] = {
                {3, 0}, {4, 0}, {6, 0}, {9, 0}, {13, 0}, {18, 0},
                {25, 0}, {35, 0}, {50, 0}, {71, 0}, {100, 0}, {100, 1},
                {100, 2}, {100, 3}, {100, 4}, {100, 5}, {100, 6}, {100, 7}
@@ -25773,67 +25770,67 @@ wlc_phy_cal_txiqlo_nphy(struct brcms_phy *pi, struct 
nphy_txgains target_gain,
        u16 cal_gain[2];
        struct nphy_iqcal_params cal_params[2];
        u32 tbl_len;
-       void *tbl_ptr;
+       const void *tbl_ptr;
        bool ladder_updated[2];
        u8 mphase_cal_lastphase = 0;
        int bcmerror = 0;
        bool phyhang_avoid_state = false;
 
-       u16 tbl_tx_iqlo_cal_loft_ladder_20[] = {
+       static const u16 tbl_tx_iqlo_cal_loft_ladder_20[] = {
                0x0300, 0x0500, 0x0700, 0x0900, 0x0d00, 0x1100, 0x1900, 0x1901,
                0x1902,
                0x1903, 0x1904, 0x1905, 0x1906, 0x1907, 0x2407, 0x3207, 0x4607,
                0x6407
        };
 
-       u16 tbl_tx_iqlo_cal_iqimb_ladder_20[] = {
+       static const u16 tbl_tx_iqlo_cal_iqimb_ladder_20[] = {
                0x0200, 0x0300, 0x0600, 0x0900, 0x0d00, 0x1100, 0x1900, 0x2400,
                0x3200,
                0x4600, 0x6400, 0x6401, 0x6402, 0x6403, 0x6404, 0x6405, 0x6406,
                0x6407
        };
 
-       u16 tbl_tx_iqlo_cal_loft_ladder_40[] = {
+       static const u16 tbl_tx_iqlo_cal_loft_ladder_40[] = {
                0x0200, 0x0300, 0x0400, 0x0700, 0x0900, 0x0c00, 0x1200, 0x1201,
                0x1202,
                0x1203, 0x1204, 0x1205, 0x1206, 0x1207, 0x1907, 0x2307, 0x3207,
                0x4707
        };
 
-       u16 tbl_tx_iqlo_cal_iqimb_ladder_40[] = {
+       static const u16 tbl_tx_iqlo_cal_iqimb_ladder_40[] = {
                0x0100, 0x0200, 0x0400, 0x0700, 0x0900, 0x0c00, 0x1200, 0x1900,
                0x2300,
                0x3200, 0x4700, 0x4701, 0x4702, 0x4703, 0x4704, 0x4705, 0x4706,
                0x4707
        };
 
-       u16 tbl_tx_iqlo_cal_startcoefs[] = {
+       static const u16 tbl_tx_iqlo_cal_startcoefs[] = {
                0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
                0x0000
        };
 
-       u16 tbl_tx_iqlo_cal_cmds_fullcal[] = {
+       static const u16 tbl_tx_iqlo_cal_cmds_fullcal[] = {
                0x8123, 0x8264, 0x8086, 0x8245, 0x8056,
                0x9123, 0x9264, 0x9086, 0x9245, 0x9056
        };
 
-       u16 tbl_tx_iqlo_cal_cmds_recal[] = {
+       static const u16 tbl_tx_iqlo_cal_cmds_recal[] = {
                0x8101, 0x8253, 0x8053, 0x8234, 0x8034,
                0x9101, 0x9253, 0x9053, 0x9234, 0x9034
        };
 
-       u16 tbl_tx_iqlo_cal_startcoefs_nphyrev3[] = {
+       static const u16 tbl_tx_iqlo_cal_startcoefs_nphyrev3[] = {
                0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
                0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
                0x0000
        };
 
-       u16 tbl_tx_iqlo_cal_cmds_fullcal_nphyrev3[] = {
+       static const u16 tbl_tx_iqlo_cal_cmds_fullcal_nphyrev3[] = {
                0x8434, 0x8334, 0x8084, 0x8267, 0x8056, 0x8234,
                0x9434, 0x9334, 0x9084, 0x9267, 0x9056, 0x9234
        };
 
-       u16 tbl_tx_iqlo_cal_cmds_recal_nphyrev3[] = {
+       static const u16 tbl_tx_iqlo_cal_cmds_recal_nphyrev3[] = {
                0x8423, 0x8323, 0x8073, 0x8256, 0x8045, 0x8223,
                0x9423, 0x9323, 0x9073, 0x9256, 0x9045, 0x9223
        };
diff --git a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c 
b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
index c2103e7a8132..bbb789f8990b 100644
--- a/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
+++ b/drivers/net/wireless/realtek/rtlwifi/rtl8821ae/hw.c
@@ -1127,7 +1127,7 @@ static u8 _rtl8821ae_dbi_read(struct rtl_priv *rtlpriv, 
u16 addr)
        }
        if (0 == tmp) {
                read_addr = REG_DBI_RDATA + addr % 4;
-               ret = rtl_read_byte(rtlpriv, read_addr);
+               ret = rtl_read_word(rtlpriv, read_addr);
        }
        return ret;
 }
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index df96f5f88c15..3f6bb3fff890 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1762,6 +1762,9 @@ static const struct usb_device_id acm_ids[] = {
        { USB_DEVICE(0xfff0, 0x0100), /* DATECS FP-2000 */
        .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
        },
+       { USB_DEVICE(0x09d8, 0x0320), /* Elatec GmbH TWN3 */
+       .driver_info = NO_UNION_NORMAL, /* has misplaced union descriptor */
+       },
 
        { USB_DEVICE(0x2912, 0x0001), /* ATOL FPrint */
        .driver_info = CLEAR_HALT_CONDITIONS,
diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
index d9d048fc9082..5172bec612eb 100644
--- a/drivers/usb/core/config.c
+++ b/drivers/usb/core/config.c
@@ -926,10 +926,12 @@ int usb_get_bos_descriptor(struct usb_device *dev)
        for (i = 0; i < num; i++) {
                buffer += length;
                cap = (struct usb_dev_cap_header *)buffer;
-               length = cap->bLength;
 
-               if (total_len < length)
+               if (total_len < sizeof(*cap) || total_len < cap->bLength) {
+                       dev->bos->desc->bNumDeviceCaps = i;
                        break;
+               }
+               length = cap->bLength;
                total_len -= length;
 
                if (cap->bDescriptorType != USB_DT_DEVICE_CAPABILITY) {
diff --git a/drivers/usb/core/devio.c b/drivers/usb/core/devio.c
index bd9419213d06..873ba02d59e6 100644
--- a/drivers/usb/core/devio.c
+++ b/drivers/usb/core/devio.c
@@ -1417,11 +1417,7 @@ static int proc_do_submiturb(struct usb_dev_state *ps, 
struct usbdevfs_urb *uurb
                        totlen += isopkt[u].length;
                }
                u *= sizeof(struct usb_iso_packet_descriptor);
-               if (totlen <= uurb->buffer_length)
-                       uurb->buffer_length = totlen;
-               else
-                       WARN_ONCE(1, "uurb->buffer_length is too short %d vs 
%d",
-                                 totlen, uurb->buffer_length);
+               uurb->buffer_length = totlen;
                break;
 
        default:
diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c
index 51bba58c0c3b..22e61786354a 100644
--- a/drivers/usb/core/hub.c
+++ b/drivers/usb/core/hub.c
@@ -2656,13 +2656,16 @@ static int hub_port_wait_reset(struct usb_hub *hub, int 
port1,
        if (!(portstatus & USB_PORT_STAT_CONNECTION))
                return -ENOTCONN;
 
-       /* bomb out completely if the connection bounced.  A USB 3.0
-        * connection may bounce if multiple warm resets were issued,
+       /* Retry if connect change is set but status is still connected.
+        * A USB 3.0 connection may bounce if multiple warm resets were issued,
         * but the device may have successfully re-connected. Ignore it.
         */
        if (!hub_is_superspeed(hub->hdev) &&
-                       (portchange & USB_PORT_STAT_C_CONNECTION))
-               return -ENOTCONN;
+           (portchange & USB_PORT_STAT_C_CONNECTION)) {
+               usb_clear_port_feature(hub->hdev, port1,
+                                      USB_PORT_FEAT_C_CONNECTION);
+               return -EAGAIN;
+       }
 
        if (!(portstatus & USB_PORT_STAT_ENABLE))
                return -EBUSY;
diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c
index 82806e311202..a6aaf2f193a4 100644
--- a/drivers/usb/core/quirks.c
+++ b/drivers/usb/core/quirks.c
@@ -221,6 +221,10 @@ static const struct usb_device_id usb_quirk_list[] = {
        /* Corsair Strafe RGB */
        { USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT },
 
+       /* MIDI keyboard WORLDE MINI */
+       { USB_DEVICE(0x1c75, 0x0204), .driver_info =
+                       USB_QUIRK_CONFIG_INTF_STRINGS },
+
        /* Acer C120 LED Projector */
        { USB_DEVICE(0x1de1, 0xc102), .driver_info = USB_QUIRK_NO_LPM },
 
diff --git a/drivers/usb/musb/musb_core.c b/drivers/usb/musb/musb_core.c
index 00eed5d66fda..06d83825923a 100644
--- a/drivers/usb/musb/musb_core.c
+++ b/drivers/usb/musb/musb_core.c
@@ -877,7 +877,7 @@ b_host:
         */
        if (int_usb & MUSB_INTR_RESET) {
                handled = IRQ_HANDLED;
-               if (devctl & MUSB_DEVCTL_HM) {
+               if (is_host_active(musb)) {
                        /*
                         * When BABBLE happens what we can depends on which
                         * platform MUSB is running, because some platforms
@@ -887,9 +887,7 @@ b_host:
                         * drop the session.
                         */
                        dev_err(musb->controller, "Babble\n");
-
-                       if (is_host_active(musb))
-                               musb_recover_from_babble(musb);
+                       musb_recover_from_babble(musb);
                } else {
                        dev_dbg(musb->controller, "BUS RESET as %s\n",
                                usb_otg_state_string(musb->xceiv->otg->state));
diff --git a/drivers/usb/musb/sunxi.c b/drivers/usb/musb/sunxi.c
index d9b0dc461439..2d3be66fb563 100644
--- a/drivers/usb/musb/sunxi.c
+++ b/drivers/usb/musb/sunxi.c
@@ -320,6 +320,8 @@ static int sunxi_musb_exit(struct musb *musb)
        if (test_bit(SUNXI_MUSB_FL_HAS_SRAM, &glue->flags))
                sunxi_sram_release(musb->controller->parent);
 
+       devm_usb_put_phy(glue->dev, glue->xceiv);
+
        return 0;
 }
 
diff --git a/drivers/usb/serial/metro-usb.c b/drivers/usb/serial/metro-usb.c
index 39e683096e94..45182c65fa1f 100644
--- a/drivers/usb/serial/metro-usb.c
+++ b/drivers/usb/serial/metro-usb.c
@@ -45,6 +45,7 @@ struct metrousb_private {
 static const struct usb_device_id id_table[] = {
        { USB_DEVICE(FOCUS_VENDOR_ID, FOCUS_PRODUCT_ID_BI) },
        { USB_DEVICE(FOCUS_VENDOR_ID, FOCUS_PRODUCT_ID_UNI) },
+       { USB_DEVICE_INTERFACE_CLASS(0x0c2e, 0x0730, 0xff) },   /* MS7820 */
        { }, /* Terminating entry. */
 };
 MODULE_DEVICE_TABLE(usb, id_table);
diff --git a/fs/ext4/crypto_key.c b/fs/ext4/crypto_key.c
index 505f8afde57c..9a1bc638abce 100644
--- a/fs/ext4/crypto_key.c
+++ b/fs/ext4/crypto_key.c
@@ -204,6 +204,12 @@ int ext4_get_encryption_info(struct inode *inode)
        }
        down_read(&keyring_key->sem);
        ukp = user_key_payload(keyring_key);
+       if (!ukp) {
+               /* key was revoked before we acquired its semaphore */
+               res = -EKEYREVOKED;
+               up_read(&keyring_key->sem);
+               goto out;
+       }
        if (ukp->datalen != sizeof(struct ext4_encryption_key)) {
                res = -EINVAL;
                up_read(&keyring_key->sem);
diff --git a/fs/f2fs/crypto.c b/fs/f2fs/crypto.c
index 4a62ef14e932..d879c6c846b7 100644
--- a/fs/f2fs/crypto.c
+++ b/fs/f2fs/crypto.c
@@ -362,7 +362,6 @@ static int f2fs_page_crypto(struct f2fs_crypto_ctx *ctx,
        else
                res = crypto_ablkcipher_encrypt(req);
        if (res == -EINPROGRESS || res == -EBUSY) {
-               BUG_ON(req->base.data != &ecr);
                wait_for_completion(&ecr.completion);
                res = ecr.res;
        }
diff --git a/fs/f2fs/crypto_fname.c b/fs/f2fs/crypto_fname.c
index 38349ed5ea51..0fce444dd5ae 100644
--- a/fs/f2fs/crypto_fname.c
+++ b/fs/f2fs/crypto_fname.c
@@ -124,7 +124,6 @@ static int f2fs_fname_encrypt(struct inode *inode,
        ablkcipher_request_set_crypt(req, &src_sg, &dst_sg, ciphertext_len, iv);
        res = crypto_ablkcipher_encrypt(req);
        if (res == -EINPROGRESS || res == -EBUSY) {
-               BUG_ON(req->base.data != &ecr);
                wait_for_completion(&ecr.completion);
                res = ecr.res;
        }
@@ -180,7 +179,6 @@ static int f2fs_fname_decrypt(struct inode *inode,
        ablkcipher_request_set_crypt(req, &src_sg, &dst_sg, iname->len, iv);
        res = crypto_ablkcipher_decrypt(req);
        if (res == -EINPROGRESS || res == -EBUSY) {
-               BUG_ON(req->base.data != &ecr);
                wait_for_completion(&ecr.completion);
                res = ecr.res;
        }
diff --git a/fs/f2fs/crypto_key.c b/fs/f2fs/crypto_key.c
index 18595d7a0efc..7e62889a1d3d 100644
--- a/fs/f2fs/crypto_key.c
+++ b/fs/f2fs/crypto_key.c
@@ -75,7 +75,6 @@ static int f2fs_derive_key_aes(char 
deriving_key[F2FS_AES_128_ECB_KEY_SIZE],
                                        F2FS_AES_256_XTS_KEY_SIZE, NULL);
        res = crypto_ablkcipher_encrypt(req);
        if (res == -EINPROGRESS || res == -EBUSY) {
-               BUG_ON(req->base.data != &ecr);
                wait_for_completion(&ecr.completion);
                res = ecr.res;
        }
@@ -189,18 +188,38 @@ int f2fs_get_encryption_info(struct inode *inode)
                keyring_key = NULL;
                goto out;
        }
-       BUG_ON(keyring_key->type != &key_type_logon);
+       if (keyring_key->type != &key_type_logon) {
+               printk_once(KERN_WARNING "f2fs: key type must be logon\n");
+               res = -ENOKEY;
+               goto out;
+       }
+       down_read(&keyring_key->sem);
        ukp = user_key_payload(keyring_key);
+       if (!ukp) {
+               /* key was revoked before we acquired its semaphore */
+               res = -EKEYREVOKED;
+               up_read(&keyring_key->sem);
+               goto out;
+       }
        if (ukp->datalen != sizeof(struct f2fs_encryption_key)) {
                res = -EINVAL;
+               up_read(&keyring_key->sem);
                goto out;
        }
        master_key = (struct f2fs_encryption_key *)ukp->data;
        BUILD_BUG_ON(F2FS_AES_128_ECB_KEY_SIZE !=
                                F2FS_KEY_DERIVATION_NONCE_SIZE);
-       BUG_ON(master_key->size != F2FS_AES_256_XTS_KEY_SIZE);
+       if (master_key->size != F2FS_AES_256_XTS_KEY_SIZE) {
+               printk_once(KERN_WARNING
+                               "f2fs: key size incorrect: %d\n",
+                               master_key->size);
+               res = -ENOKEY;
+               up_read(&keyring_key->sem);
+               goto out;
+       }
        res = f2fs_derive_key_aes(ctx.nonce, master_key->raw,
                                  raw_key);
+       up_read(&keyring_key->sem);
        if (res)
                goto out;
 
diff --git a/fs/f2fs/file.c b/fs/f2fs/file.c
index 4b449d263333..01eed94b01ea 100644
--- a/fs/f2fs/file.c
+++ b/fs/f2fs/file.c
@@ -1541,12 +1541,18 @@ static int f2fs_ioc_set_encryption_policy(struct file 
*filp, unsigned long arg)
                                sizeof(policy)))
                return -EFAULT;
 
+       err = mnt_want_write_file(filp);
+       if (err)
+               return err;
+
        mutex_lock(&inode->i_mutex);
 
        err = f2fs_process_policy(&policy, inode);
 
        mutex_unlock(&inode->i_mutex);
 
+       mnt_drop_write_file(filp);
+
        return err;
 #else
        return -EOPNOTSUPP;
diff --git a/fs/fscache/object-list.c b/fs/fscache/object-list.c
index 6b028b7c4250..926580a85153 100644
--- a/fs/fscache/object-list.c
+++ b/fs/fscache/object-list.c
@@ -330,6 +330,13 @@ static void fscache_objlist_config(struct 
fscache_objlist_data *data)
        rcu_read_lock();
 
        confkey = user_key_payload(key);
+       if (!confkey) {
+               /* key was revoked */
+               rcu_read_unlock();
+               key_put(key);
+               goto no_config;
+       }
+
        buf = confkey->data;
 
        for (len = confkey->datalen - 1; len >= 0; len--) {
diff --git a/include/linux/key.h b/include/linux/key.h
index dcc115e8dd03..af071ca73079 100644
--- a/include/linux/key.h
+++ b/include/linux/key.h
@@ -126,6 +126,11 @@ static inline bool is_key_possessed(const key_ref_t 
key_ref)
        return (unsigned long) key_ref & 1UL;
 }
 
+enum key_state {
+       KEY_IS_UNINSTANTIATED,
+       KEY_IS_POSITIVE,                /* Positively instantiated */
+};
+
 /*****************************************************************************/
 /*
  * authentication token / access credential / keyring
@@ -157,6 +162,7 @@ struct key {
                                                 * - may not match RCU 
dereferenced payload
                                                 * - payload should contain own 
length
                                                 */
+       short                   state;          /* Key state (+) or rejection 
error (-) */
 
 #ifdef KEY_DEBUGGING
        unsigned                magic;
@@ -165,19 +171,17 @@ struct key {
 #endif
 
        unsigned long           flags;          /* status flags (change with 
bitops) */
-#define KEY_FLAG_INSTANTIATED  0       /* set if key has been instantiated */
-#define KEY_FLAG_DEAD          1       /* set if key type has been deleted */
-#define KEY_FLAG_REVOKED       2       /* set if key had been revoked */
-#define KEY_FLAG_IN_QUOTA      3       /* set if key consumes quota */
-#define KEY_FLAG_USER_CONSTRUCT        4       /* set if key is being 
constructed in userspace */
-#define KEY_FLAG_NEGATIVE      5       /* set if key is negative */
-#define KEY_FLAG_ROOT_CAN_CLEAR        6       /* set if key can be cleared by 
root without permission */
-#define KEY_FLAG_INVALIDATED   7       /* set if key has been invalidated */
-#define KEY_FLAG_TRUSTED       8       /* set if key is trusted */
-#define KEY_FLAG_TRUSTED_ONLY  9       /* set if keyring only accepts links to 
trusted keys */
-#define KEY_FLAG_BUILTIN       10      /* set if key is builtin */
-#define KEY_FLAG_ROOT_CAN_INVAL        11      /* set if key can be 
invalidated by root without permission */
-#define KEY_FLAG_UID_KEYRING   12      /* set if key is a user or user session 
keyring */
+#define KEY_FLAG_DEAD          0       /* set if key type has been deleted */
+#define KEY_FLAG_REVOKED       1       /* set if key had been revoked */
+#define KEY_FLAG_IN_QUOTA      2       /* set if key consumes quota */
+#define KEY_FLAG_USER_CONSTRUCT        3       /* set if key is being 
constructed in userspace */
+#define KEY_FLAG_ROOT_CAN_CLEAR        4       /* set if key can be cleared by 
root without permission */
+#define KEY_FLAG_INVALIDATED   5       /* set if key has been invalidated */
+#define KEY_FLAG_TRUSTED       6       /* set if key is trusted */
+#define KEY_FLAG_TRUSTED_ONLY  7       /* set if keyring only accepts links to 
trusted keys */
+#define KEY_FLAG_BUILTIN       8       /* set if key is builtin */
+#define KEY_FLAG_ROOT_CAN_INVAL        9       /* set if key can be 
invalidated by root without permission */
+#define KEY_FLAG_UID_KEYRING   10      /* set if key is a user or user session 
keyring */
 
        /* the key type and key description string
         * - the desc is used to match a key against search criteria
@@ -203,7 +207,6 @@ struct key {
                        struct list_head name_link;
                        struct assoc_array keys;
                };
-               int reject_error;
        };
 };
 
@@ -319,17 +322,27 @@ extern void key_set_timeout(struct key *, unsigned);
 #define        KEY_NEED_SETATTR 0x20   /* Require permission to change 
attributes */
 #define        KEY_NEED_ALL    0x3f    /* All the above permissions */
 
+static inline short key_read_state(const struct key *key)
+{
+       /* Barrier versus mark_key_instantiated(). */
+       return smp_load_acquire(&key->state);
+}
+
 /**
- * key_is_instantiated - Determine if a key has been positively instantiated
+ * key_is_positive - Determine if a key has been positively instantiated
  * @key: The key to check.
  *
  * Return true if the specified key has been positively instantiated, false
  * otherwise.
  */
-static inline bool key_is_instantiated(const struct key *key)
+static inline bool key_is_positive(const struct key *key)
+{
+       return key_read_state(key) == KEY_IS_POSITIVE;
+}
+
+static inline bool key_is_negative(const struct key *key)
 {
-       return test_bit(KEY_FLAG_INSTANTIATED, &key->flags) &&
-               !test_bit(KEY_FLAG_NEGATIVE, &key->flags);
+       return key_read_state(key) < 0;
 }
 
 #define rcu_dereference_key(KEY)                                       \
diff --git a/include/linux/mbus.h b/include/linux/mbus.h
index 1f7bc630d225..71a5a56b0bba 100644
--- a/include/linux/mbus.h
+++ b/include/linux/mbus.h
@@ -29,8 +29,8 @@ struct mbus_dram_target_info
        struct mbus_dram_window {
                u8      cs_index;
                u8      mbus_attr;
-               u32     base;
-               u32     size;
+               u64     base;
+               u64     size;
        } cs[4];
 };
 
diff --git a/kernel/sched/auto_group.c b/kernel/sched/auto_group.c
index 750ed601ddf7..8620fd01b3d0 100644
--- a/kernel/sched/auto_group.c
+++ b/kernel/sched/auto_group.c
@@ -111,14 +111,11 @@ bool task_wants_autogroup(struct task_struct *p, struct 
task_group *tg)
 {
        if (tg != &root_task_group)
                return false;
-
        /*
-        * We can only assume the task group can't go away on us if
-        * autogroup_move_group() can see us on ->thread_group list.
+        * If we race with autogroup_move_group() the caller can use the old
+        * value of signal->autogroup but in this case sched_move_task() will
+        * be called again before autogroup_kref_put().
         */
-       if (p->flags & PF_EXITING)
-               return false;
-
        return true;
 }
 
@@ -138,13 +135,17 @@ autogroup_move_group(struct task_struct *p, struct 
autogroup *ag)
        }
 
        p->signal->autogroup = autogroup_kref_get(ag);
-
-       if (!READ_ONCE(sysctl_sched_autogroup_enabled))
-               goto out;
-
+       /*
+        * We can't avoid sched_move_task() after we changed signal->autogroup,
+        * this process can already run with task_group() == prev->tg or we can
+        * race with cgroup code which can read autogroup = prev under rq->lock.
+        * In the latter case for_each_thread() can not miss a migrating thread,
+        * cpu_cgroup_attach() must not be possible after cgroup_exit() and it
+        * can't be removed from thread list, we hold ->siglock.
+        */
        for_each_thread(p, t)
                sched_move_task(t);
-out:
+
        unlock_task_sighand(p, &flags);
        autogroup_kref_put(prev);
 }
diff --git a/lib/digsig.c b/lib/digsig.c
index 07be6c1ef4e2..00c5c8179393 100644
--- a/lib/digsig.c
+++ b/lib/digsig.c
@@ -87,6 +87,12 @@ static int digsig_verify_rsa(struct key *key,
        down_read(&key->sem);
        ukp = user_key_payload(key);
 
+       if (!ukp) {
+               /* key was revoked before we acquired its semaphore */
+               err = -EKEYREVOKED;
+               goto err1;
+       }
+
        if (ukp->datalen < sizeof(*pkh))
                goto err1;
 
diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c
index c79b85eb4d4c..6abc5012200b 100644
--- a/net/dns_resolver/dns_key.c
+++ b/net/dns_resolver/dns_key.c
@@ -224,7 +224,7 @@ static int dns_resolver_match_preparse(struct 
key_match_data *match_data)
 static void dns_resolver_describe(const struct key *key, struct seq_file *m)
 {
        seq_puts(m, key->description);
-       if (key_is_instantiated(key)) {
+       if (key_is_positive(key)) {
                int err = PTR_ERR(key->payload.data[dns_key_error]);
 
                if (err)
diff --git a/security/keys/big_key.c b/security/keys/big_key.c
index 907c1522ee46..08c4cc5c2973 100644
--- a/security/keys/big_key.c
+++ b/security/keys/big_key.c
@@ -138,7 +138,7 @@ void big_key_revoke(struct key *key)
 
        /* clear the quota */
        key_payload_reserve(key, 0);
-       if (key_is_instantiated(key) &&
+       if (key_is_positive(key) &&
            (size_t)key->payload.data[big_key_len] > BIG_KEY_FILE_THRESHOLD)
                vfs_truncate(path, 0);
 }
@@ -170,7 +170,7 @@ void big_key_describe(const struct key *key, struct 
seq_file *m)
 
        seq_puts(m, key->description);
 
-       if (key_is_instantiated(key))
+       if (key_is_positive(key))
                seq_printf(m, ": %zu [%s]",
                           datalen,
                           datalen > BIG_KEY_FILE_THRESHOLD ? "file" : "buff");
diff --git a/security/keys/encrypted-keys/encrypted.c 
b/security/keys/encrypted-keys/encrypted.c
index 31898856682e..ce295c0c1da0 100644
--- a/security/keys/encrypted-keys/encrypted.c
+++ b/security/keys/encrypted-keys/encrypted.c
@@ -315,6 +315,13 @@ static struct key *request_user_key(const char 
*master_desc, const u8 **master_k
 
        down_read(&ukey->sem);
        upayload = user_key_payload(ukey);
+       if (!upayload) {
+               /* key was revoked before we acquired its semaphore */
+               up_read(&ukey->sem);
+               key_put(ukey);
+               ukey = ERR_PTR(-EKEYREVOKED);
+               goto error;
+       }
        *master_key = upayload->data;
        *master_keylen = upayload->datalen;
 error:
@@ -845,7 +852,7 @@ static int encrypted_update(struct key *key, struct 
key_preparsed_payload *prep)
        size_t datalen = prep->datalen;
        int ret = 0;
 
-       if (test_bit(KEY_FLAG_NEGATIVE, &key->flags))
+       if (key_is_negative(key))
                return -ENOKEY;
        if (datalen <= 0 || datalen > 32767 || !prep->data)
                return -EINVAL;
diff --git a/security/keys/gc.c b/security/keys/gc.c
index 9cb4fe4478a1..1659094d684d 100644
--- a/security/keys/gc.c
+++ b/security/keys/gc.c
@@ -129,15 +129,15 @@ static noinline void key_gc_unused_keys(struct list_head 
*keys)
        while (!list_empty(keys)) {
                struct key *key =
                        list_entry(keys->next, struct key, graveyard_link);
+               short state = key->state;
+
                list_del(&key->graveyard_link);
 
                kdebug("- %u", key->serial);
                key_check(key);
 
                /* Throw away the key data if the key is instantiated */
-               if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags) &&
-                   !test_bit(KEY_FLAG_NEGATIVE, &key->flags) &&
-                   key->type->destroy)
+               if (state == KEY_IS_POSITIVE && key->type->destroy)
                        key->type->destroy(key);
 
                security_key_free(key);
@@ -151,7 +151,7 @@ static noinline void key_gc_unused_keys(struct list_head 
*keys)
                }
 
                atomic_dec(&key->user->nkeys);
-               if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
+               if (state != KEY_IS_UNINSTANTIATED)
                        atomic_dec(&key->user->nikeys);
 
                key_user_put(key->user);
diff --git a/security/keys/key.c b/security/keys/key.c
index 51d23c623424..4d971bf88ac3 100644
--- a/security/keys/key.c
+++ b/security/keys/key.c
@@ -395,6 +395,18 @@ int key_payload_reserve(struct key *key, size_t datalen)
 }
 EXPORT_SYMBOL(key_payload_reserve);
 
+/*
+ * Change the key state to being instantiated.
+ */
+static void mark_key_instantiated(struct key *key, int reject_error)
+{
+       /* Commit the payload before setting the state; barrier versus
+        * key_read_state().
+        */
+       smp_store_release(&key->state,
+                         (reject_error < 0) ? reject_error : KEY_IS_POSITIVE);
+}
+
 /*
  * Instantiate a key and link it into the target keyring atomically.  Must be
  * called with the target keyring's semaphore writelocked.  The target key's
@@ -418,14 +430,14 @@ static int __key_instantiate_and_link(struct key *key,
        mutex_lock(&key_construction_mutex);
 
        /* can't instantiate twice */
-       if (!test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) {
+       if (key->state == KEY_IS_UNINSTANTIATED) {
                /* instantiate the key */
                ret = key->type->instantiate(key, prep);
 
                if (ret == 0) {
                        /* mark the key as being instantiated */
                        atomic_inc(&key->user->nikeys);
-                       set_bit(KEY_FLAG_INSTANTIATED, &key->flags);
+                       mark_key_instantiated(key, 0);
 
                        if (test_and_clear_bit(KEY_FLAG_USER_CONSTRUCT, 
&key->flags))
                                awaken = 1;
@@ -553,13 +565,10 @@ int key_reject_and_link(struct key *key,
        mutex_lock(&key_construction_mutex);
 
        /* can't instantiate twice */
-       if (!test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) {
+       if (key->state == KEY_IS_UNINSTANTIATED) {
                /* mark the key as being negatively instantiated */
                atomic_inc(&key->user->nikeys);
-               key->reject_error = -error;
-               smp_wmb();
-               set_bit(KEY_FLAG_NEGATIVE, &key->flags);
-               set_bit(KEY_FLAG_INSTANTIATED, &key->flags);
+               mark_key_instantiated(key, -error);
                now = current_kernel_time();
                key->expiry = now.tv_sec + timeout;
                key_schedule_gc(key->expiry + key_gc_delay);
@@ -731,8 +740,8 @@ static inline key_ref_t __key_update(key_ref_t key_ref,
 
        ret = key->type->update(key, prep);
        if (ret == 0)
-               /* updating a negative key instantiates it */
-               clear_bit(KEY_FLAG_NEGATIVE, &key->flags);
+               /* Updating a negative key positively instantiates it */
+               mark_key_instantiated(key, 0);
 
        up_write(&key->sem);
 
@@ -907,6 +916,16 @@ error:
         */
        __key_link_end(keyring, &index_key, edit);
 
+       key = key_ref_to_ptr(key_ref);
+       if (test_bit(KEY_FLAG_USER_CONSTRUCT, &key->flags)) {
+               ret = wait_for_key_construction(key, true);
+               if (ret < 0) {
+                       key_ref_put(key_ref);
+                       key_ref = ERR_PTR(ret);
+                       goto error_free_prep;
+               }
+       }
+
        key_ref = __key_update(key_ref, &prep);
        goto error_free_prep;
 }
@@ -957,8 +976,8 @@ int key_update(key_ref_t key_ref, const void *payload, 
size_t plen)
 
        ret = key->type->update(key, &prep);
        if (ret == 0)
-               /* updating a negative key instantiates it */
-               clear_bit(KEY_FLAG_NEGATIVE, &key->flags);
+               /* Updating a negative key positively instantiates it */
+               mark_key_instantiated(key, 0);
 
        up_write(&key->sem);
 
diff --git a/security/keys/keyctl.c b/security/keys/keyctl.c
index a009dc66eb8f..2e741e1a8712 100644
--- a/security/keys/keyctl.c
+++ b/security/keys/keyctl.c
@@ -738,10 +738,9 @@ long keyctl_read_key(key_serial_t keyid, char __user 
*buffer, size_t buflen)
 
        key = key_ref_to_ptr(key_ref);
 
-       if (test_bit(KEY_FLAG_NEGATIVE, &key->flags)) {
-               ret = -ENOKEY;
-               goto error2;
-       }
+       ret = key_read_state(key);
+       if (ret < 0)
+               goto error2; /* Negatively instantiated */
 
        /* see if we can read it directly */
        ret = key_permission(key_ref, KEY_NEED_READ);
@@ -873,7 +872,7 @@ long keyctl_chown_key(key_serial_t id, uid_t user, gid_t 
group)
                atomic_dec(&key->user->nkeys);
                atomic_inc(&newowner->nkeys);
 
-               if (test_bit(KEY_FLAG_INSTANTIATED, &key->flags)) {
+               if (key->state != KEY_IS_UNINSTANTIATED) {
                        atomic_dec(&key->user->nikeys);
                        atomic_inc(&newowner->nikeys);
                }
diff --git a/security/keys/keyring.c b/security/keys/keyring.c
index 0c8dd4fbe130..ef828238cdc0 100644
--- a/security/keys/keyring.c
+++ b/security/keys/keyring.c
@@ -407,7 +407,7 @@ static void keyring_describe(const struct key *keyring, 
struct seq_file *m)
        else
                seq_puts(m, "[anon]");
 
-       if (key_is_instantiated(keyring)) {
+       if (key_is_positive(keyring)) {
                if (keyring->keys.nr_leaves_on_tree != 0)
                        seq_printf(m, ": %lu", keyring->keys.nr_leaves_on_tree);
                else
@@ -522,7 +522,8 @@ static int keyring_search_iterator(const void *object, void 
*iterator_data)
 {
        struct keyring_search_context *ctx = iterator_data;
        const struct key *key = keyring_ptr_to_key(object);
-       unsigned long kflags = key->flags;
+       unsigned long kflags = READ_ONCE(key->flags);
+       short state = READ_ONCE(key->state);
 
        kenter("{%d}", key->serial);
 
@@ -566,9 +567,8 @@ static int keyring_search_iterator(const void *object, void 
*iterator_data)
 
        if (ctx->flags & KEYRING_SEARCH_DO_STATE_CHECK) {
                /* we set a different error code if we pass a negative key */
-               if (kflags & (1 << KEY_FLAG_NEGATIVE)) {
-                       smp_rmb();
-                       ctx->result = ERR_PTR(key->reject_error);
+               if (state < 0) {
+                       ctx->result = ERR_PTR(state);
                        kleave(" = %d [neg]", ctx->skipped_ret);
                        goto skipped;
                }
diff --git a/security/keys/proc.c b/security/keys/proc.c
index b9f531c9e4fa..036128682463 100644
--- a/security/keys/proc.c
+++ b/security/keys/proc.c
@@ -182,6 +182,7 @@ static int proc_keys_show(struct seq_file *m, void *v)
        unsigned long timo;
        key_ref_t key_ref, skey_ref;
        char xbuf[16];
+       short state;
        int rc;
 
        struct keyring_search_context ctx = {
@@ -240,17 +241,19 @@ static int proc_keys_show(struct seq_file *m, void *v)
                        sprintf(xbuf, "%luw", timo / (60*60*24*7));
        }
 
+       state = key_read_state(key);
+
 #define showflag(KEY, LETTER, FLAG) \
        (test_bit(FLAG, &(KEY)->flags) ? LETTER : '-')
 
        seq_printf(m, "%08x %c%c%c%c%c%c%c %5d %4s %08x %5d %5d %-9.9s ",
                   key->serial,
-                  showflag(key, 'I', KEY_FLAG_INSTANTIATED),
+                  state != KEY_IS_UNINSTANTIATED ? 'I' : '-',
                   showflag(key, 'R', KEY_FLAG_REVOKED),
                   showflag(key, 'D', KEY_FLAG_DEAD),
                   showflag(key, 'Q', KEY_FLAG_IN_QUOTA),
                   showflag(key, 'U', KEY_FLAG_USER_CONSTRUCT),
-                  showflag(key, 'N', KEY_FLAG_NEGATIVE),
+                  state < 0 ? 'N' : '-',
                   showflag(key, 'i', KEY_FLAG_INVALIDATED),
                   atomic_read(&key->usage),
                   xbuf,
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 7dd050f24261..ac1d5b2b1626 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -727,7 +727,7 @@ try_again:
 
        ret = -EIO;
        if (!(lflags & KEY_LOOKUP_PARTIAL) &&
-           !test_bit(KEY_FLAG_INSTANTIATED, &key->flags))
+           key_read_state(key) == KEY_IS_UNINSTANTIATED)
                goto invalid_key;
 
        /* check the permissions */
diff --git a/security/keys/request_key.c b/security/keys/request_key.c
index c7a117c9a8f3..2ce733342b5a 100644
--- a/security/keys/request_key.c
+++ b/security/keys/request_key.c
@@ -594,10 +594,9 @@ int wait_for_key_construction(struct key *key, bool intr)
                          intr ? TASK_INTERRUPTIBLE : TASK_UNINTERRUPTIBLE);
        if (ret)
                return -ERESTARTSYS;
-       if (test_bit(KEY_FLAG_NEGATIVE, &key->flags)) {
-               smp_rmb();
-               return key->reject_error;
-       }
+       ret = key_read_state(key);
+       if (ret < 0)
+               return ret;
        return key_validate(key);
 }
 EXPORT_SYMBOL(wait_for_key_construction);
diff --git a/security/keys/request_key_auth.c b/security/keys/request_key_auth.c
index 4f0f112fe276..217775fcd0f3 100644
--- a/security/keys/request_key_auth.c
+++ b/security/keys/request_key_auth.c
@@ -73,7 +73,7 @@ static void request_key_auth_describe(const struct key *key,
 
        seq_puts(m, "key:");
        seq_puts(m, key->description);
-       if (key_is_instantiated(key))
+       if (key_is_positive(key))
                seq_printf(m, " pid:%d ci:%zu", rka->pid, rka->callout_len);
 }
 
diff --git a/security/keys/trusted.c b/security/keys/trusted.c
index 16dec53184b6..509aedcf8310 100644
--- a/security/keys/trusted.c
+++ b/security/keys/trusted.c
@@ -1014,7 +1014,7 @@ static int trusted_update(struct key *key, struct 
key_preparsed_payload *prep)
        char *datablob;
        int ret = 0;
 
-       if (test_bit(KEY_FLAG_NEGATIVE, &key->flags))
+       if (key_is_negative(key))
                return -ENOKEY;
        p = key->payload.data[0];
        if (!p->migratable)
diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c
index 8705d79b2c6f..eba8a516ee9e 100644
--- a/security/keys/user_defined.c
+++ b/security/keys/user_defined.c
@@ -120,7 +120,7 @@ int user_update(struct key *key, struct 
key_preparsed_payload *prep)
 
        if (ret == 0) {
                /* attach the new data, displacing the old */
-               if (!test_bit(KEY_FLAG_NEGATIVE, &key->flags))
+               if (key_is_positive(key))
                        zap = key->payload.data[0];
                else
                        zap = NULL;
@@ -174,7 +174,7 @@ EXPORT_SYMBOL_GPL(user_destroy);
 void user_describe(const struct key *key, struct seq_file *m)
 {
        seq_puts(m, key->description);
-       if (key_is_instantiated(key))
+       if (key_is_positive(key))
                seq_printf(m, ": %u", key->datalen);
 }
 
diff --git a/sound/core/seq/seq_lock.c b/sound/core/seq/seq_lock.c
index 12ba83367b1b..ba5752ee9af3 100644
--- a/sound/core/seq/seq_lock.c
+++ b/sound/core/seq/seq_lock.c
@@ -23,8 +23,6 @@
 #include <sound/core.h>
 #include "seq_lock.h"
 
-#if defined(CONFIG_SMP) || defined(CONFIG_SND_DEBUG)
-
 /* wait until all locks are released */
 void snd_use_lock_sync_helper(snd_use_lock_t *lockp, const char *file, int 
line)
 {
@@ -42,5 +40,3 @@ void snd_use_lock_sync_helper(snd_use_lock_t *lockp, const 
char *file, int line)
 }
 
 EXPORT_SYMBOL(snd_use_lock_sync_helper);
-
-#endif
diff --git a/sound/core/seq/seq_lock.h b/sound/core/seq/seq_lock.h
index 54044bc2c9ef..ac38031c370e 100644
--- a/sound/core/seq/seq_lock.h
+++ b/sound/core/seq/seq_lock.h
@@ -3,8 +3,6 @@
 
 #include <linux/sched.h>
 
-#if defined(CONFIG_SMP) || defined(CONFIG_SND_DEBUG)
-
 typedef atomic_t snd_use_lock_t;
 
 /* initialize lock */
@@ -20,14 +18,4 @@ typedef atomic_t snd_use_lock_t;
 void snd_use_lock_sync_helper(snd_use_lock_t *lock, const char *file, int 
line);
 #define snd_use_lock_sync(lockp) snd_use_lock_sync_helper(lockp, 
__BASE_FILE__, __LINE__)
 
-#else /* SMP || CONFIG_SND_DEBUG */
-
-typedef spinlock_t snd_use_lock_t;     /* dummy */
-#define snd_use_lock_init(lockp) /**/
-#define snd_use_lock_use(lockp) /**/
-#define snd_use_lock_free(lockp) /**/
-#define snd_use_lock_sync(lockp) /**/
-
-#endif /* SMP || CONFIG_SND_DEBUG */
-
 #endif /* __SND_SEQ_LOCK_H */
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index 83741887faa1..3324f98c35f6 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -1755,7 +1755,7 @@ static int get_kctl_0dB_offset(struct hda_codec *codec,
                        return -1;
                if (*step_to_check && *step_to_check != step) {
                        codec_err(codec, "Mismatching dB step for vmaster slave 
(%d!=%d)\n",
--                                 *step_to_check, step);
+                                  *step_to_check, step);
                        return -1;
                }
                *step_to_check = step;
diff --git a/sound/usb/quirks.c b/sound/usb/quirks.c
index 1cc20d138dae..9c5368e7ee23 100644
--- a/sound/usb/quirks.c
+++ b/sound/usb/quirks.c
@@ -1305,6 +1305,7 @@ u64 snd_usb_interface_dsd_format_quirks(struct 
snd_usb_audio *chip,
        case USB_ID(0x20b1, 0x2008): /* Matrix Audio X-Sabre */
        case USB_ID(0x20b1, 0x300a): /* Matrix Audio Mini-i Pro */
        case USB_ID(0x22d9, 0x0416): /* OPPO HA-1 */
+       case USB_ID(0x2772, 0x0230): /* Pro-Ject Pre Box S2 Digital */
                if (fp->altsetting == 2)
                        return SNDRV_PCM_FMTBIT_DSD_U32_BE;
                break;

Reply via email to