Merge 4.4.223 into android-4.4-p

Changes in 4.4.223
	mwifiex: fix PCIe register information for 8997 chipset
	drm/qxl: qxl_release use after free
	drm/qxl: qxl_release leak in qxl_draw_dirty_fb()
	staging: rtl8192u: Fix crash due to pointers being "confusing"
	usb: gadget: f_acm: Fix configfs attr name
	usb: gadged: pch_udc: get rid of redundant assignments
	usb: gadget: pch_udc: reorder spin_[un]lock to avoid deadlock
	usb: gadget: udc: core: don't starve DMA resources
	MIPS: Fix macro typo
	MIPS: ptrace: Drop cp0_tcstatus from regoffset_table[]
	MIPS: BMIPS: Fix PRID_IMP_BMIPS5000 masking for BMIPS5200
	MIPS: smp-cps: Stop printing EJTAG exceptions to UART
	MIPS: scall: Handle seccomp filters which redirect syscalls
	MIPS: BMIPS: BMIPS5000 has I cache filing from D cache
	MIPS: BMIPS: Clear MIPS_CACHE_ALIASES earlier
	MIPS: BMIPS: local_r4k___flush_cache_all needs to blast S-cache
	MIPS: BMIPS: Pretty print BMIPS5200 processor name
	MIPS: Fix HTW config on XPA kernel without LPA enabled
	MIPS: BMIPS: Adjust mips-hpt-frequency for BCM7435
	MIPS: math-emu: Fix BC1{EQ,NE}Z emulation
	MIPS: Fix BC1{EQ,NE}Z return offset calculation
	MIPS: perf: Fix I6400 event numbers
	MIPS: KVM: Fix translation of MFC0 ErrCtl
	MIPS: SMP: Update cpu_foreign_map on CPU disable
	MIPS: c-r4k: Fix protected_writeback_scache_line for EVA
	MIPS: Octeon: Off by one in octeon_irq_gpio_map()
	bpf, mips: fix off-by-one in ctx offset allocation
	MIPS: RM7000: Double locking bug in rm7k_tc_disable()
	MIPS: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO
	mips/panic: replace smp_send_stop() with kdump friendly version in panic path
	ARM: dts: armadillo800eva Correct extal1 frequency to 24 MHz
	ARM: imx: select SRC for i.MX7
	ARM: dts: kirkwood: gpio pin fixes for linkstation ls-wxl/wsxl
	ARM: dts: kirkwood: gpio pin fixes for linkstation ls-wvl/vl
	ARM: dts: kirkwood: gpio-leds fixes for linkstation ls-wxl/wsxl
	ARM: dts: kirkwood: gpio-leds fixes for linkstation ls-wvl/vl
	ARM: dts: orion5x: gpio pin fixes for linkstation lswtgl
	ARM: dts: orion5x: fix the missing mtd flash on linkstation lswtgl
	ARM: dts: kirkwood: use unique machine name for ds112
	ARM: dts: kirkwood: add kirkwood-ds112.dtb to Makefile
	ARM: OMAP2+: hwmod: fix _idle() hwmod state sanity check sequence
	perf/x86: Fix filter_events() bug with event mappings
	x86/LDT: Print the real LDT base address
	x86/apic/uv: Silence a shift wrapping warning
	ALSA: fm801: explicitly free IRQ line
	ALSA: fm801: propagate TUNER_ONLY bit when autodetected
	ALSA: fm801: detect FM-only card earlier
	netfilter: nfnetlink: use original skbuff when acking batches
	xfrm: fix crash in XFRM_MSG_GETSA netlink handler
	mwifiex: fix IBSS data path issue.
	mwifiex: add missing check for PCIe8997 chipset
	iwlwifi: set max firmware version of 7265 to 17
	Bluetooth: btmrvl: fix hung task warning dump
	dccp: limit sk_filter trim to payload
	net/mlx4_core: Do not BUG_ON during reset when PCI is offline
	mlxsw: pci: Correctly determine if descriptor queue is full
	PCI: Supply CPU physical address (not bus address) to iomem_is_exclusive()
	net/mlx4_core: Implement pci_resume callback
	alpha/PCI: Call iomem_is_exclusive() for IORESOURCE_MEM, but not IORESOURCE_IO
	vfio/pci: Allow VPD short read
	brcmfmac: add eth_type_trans back for PCIe full dongle
	mlxsw: Treat local port 64 as valid
	IB/mlx4: Initialize hop_limit when creating address handle
	ovs/gre,geneve: fix error path when creating an iface
	GRE: Disable segmentation offloads w/ CSUM and we are encapsulated via FOU
	powerpc/pci/of: Parse unassigned resources
	firmware: actually return NULL on failed request_firmware_nowait()
	c8sectpfe: Rework firmware loading mechanism
	net/mlx5: Avoid passing dma address 0 to firmware
	IB/mlx5: Fix RC transport send queue overhead computation
	net/mlx5: Make command timeout way shorter
	IB/mlx5: Fix FW version diaplay in sysfs
	net/mlx5e: Fix MLX5E_100BASE_T define
	net/mlx5: Fix the size of modify QP mailbox
	net/mlx5: Fix masking of reserved bits in XRCD number
	net/mlx5e: Fix blue flame quota logic
	net/mlx5: use mlx5_buf_alloc_node instead of mlx5_buf_alloc in mlx5_wq_ll_create
	net/mlx5: Avoid calling sleeping function by the health poll thread
	net/mlx5: Fix wait_vital for VFs and remove fixed sleep
	net/mlx5: Fix potential deadlock in command mode change
	net/mlx5: Add timeout handle to commands with callback
	net/mlx5: Fix pci error recovery flow
	net/mlx5e: Copy all L2 headers into inline segment
	net_sched: keep backlog updated with qlen
	sch_drr: update backlog as well
	sch_hfsc: always keep backlog updated
	sch_prio: update backlog as well
	sch_qfq: keep backlog updated with qlen
	sch_sfb: keep backlog updated with qlen
	sch_tbf: update backlog as well
	btrfs: cleaner_kthread() doesn't need explicit freeze
	irda: Free skb on irda_accept error path.
	phy: fix device reference leaks
	bonding: prevent out of bound accesses
	mtd: nand: fix ONFI parameter page layout
	ath10k: free cached fw bin contents when get board id fails
	xprtrdma: checking for NULL instead of IS_ERR()
	xprtrdma: Fix additional uses of spin_lock_irqsave(rb_lock)
	xprtrdma: xprt_rdma_free() must not release backchannel reqs
	xprtrdma: rpcrdma_bc_receive_call() should init rq_private_buf.len
	RDMA/cxgb3: device driver frees DMA memory with different size
	mlxsw: spectrum: Don't forward packets when STP state is DISABLED
	mlxsw: spectrum: Disable learning according to STP state
	mlxsw: spectrum: Don't count internal TX header bytes to stats
	mlxsw: spectrum: Indicate support for autonegotiation
	mlxsw: spectrum: Fix misuse of hard_header_len
	net: tcp_memcontrol: properly detect ancestor socket pressure
	tcp: do not set rtt_min to 1
	RDS:TCP: Synchronize rds_tcp_accept_one with rds_send_xmit when resetting t_sock
	net: ipv6: tcp reset, icmp need to consider L3 domain
	batman-adv: Fix lockdep annotation of batadv_tlv_container_remove
	batman-adv: replace WARN with rate limited output on non-existing VLAN
	tty: serial: msm: Support more bauds
	serial: samsung: Fix possible out of bounds access on non-DT platform
	Drivers: hv: utils: use memdup_user in hvt_op_write
	isa: Call isa_bus_init before dependent ISA bus drivers register
	Btrfs: clean up an error code in btrfs_init_space_info()
	Input: gpio-keys - fix check for disabling unsupported keys
	Input: edt-ft5x06 - fix setting gain, offset, and threshold via device tree
	net/xfrm_input: fix possible NULL deref of tunnel.ip6->parms.i_key
	xfrm_user: propagate sec ctx allocation errors
	xfrm: Fix memory leak of aead algorithm name
	mac80211: fix mgmt-tx abort cookie and leak
	mac80211: TDLS: always downgrade invalid chandefs
	mac80211: TDLS: change BW calculation for WIDER_BW peers
	mac80211: Fix BW upgrade for TDLS peers
	NFS: Fix an LOCK/OPEN race when unlinking an open file
	net: get rid of an signed integer overflow in ip_idents_reserve()
	mtd: nand: denali: add missing nand_release() call in denali_remove()
	ASoC: Intel: pass correct parameter in sst_alloc_stream_mrfld()
	ASoC: tegra_alc5632: check return value
	ASoC: fsl_ssi: mark SACNT register volatile
	Revert "ACPI / LPSS: allow to use specific PM domain during ->probe()"
	mmc: sdhci: restore behavior when setting VDD via external regulator
	mmc: sd: limit SD card power limit according to cards capabilities
	mmc: debugfs: correct wrong voltage value
	mmc: block: return error on failed mmc_blk_get()
	clk: rockchip: Revert "clk: rockchip: reset init state before mmc card initialization"
	mmc: dw_mmc: rockchip: Set the drive phase properly
	mmc: moxart: fix wait_for_completion_interruptible_timeout return variable type
	mmc: sdhci: Fix regression setting power on Trats2 board
	perf tools: Fix perf regs mask generation
	powerpc/tm: Fix stack pointer corruption in __tm_recheckpoint()
	powerpc/book3s: Fix MCE console messages for unrecoverable MCE.
	sctp: fix the transports round robin issue when init is retransmitted
	sunrpc: Update RPCBIND_MAXNETIDLEN
	NFC: nci: memory leak in nci_core_conn_create()
	net: phy: Avoid polling PHY with PHY_IGNORE_INTERRUPTS
	net: phy: Fix phy_mac_interrupt()
	net: phy: bcm7xxx: Fix shadow mode 2 disabling
	of_mdio: fix node leak in of_phy_register_fixed_link error path
	phy: micrel: Fix finding PHY properties in MAC node for KSZ9031.
	net: dsa: slave: fix of-node leak and phy priority
	drivers: net: cpsw: don't ignore phy-mode if phy-handle is used
	iommu/dma: Respect IOMMU aperture when allocating
	mdio-sun4i: oops in error handling in probe
	iio:ad7797: Use correct attribute_group
	selftests/ipc: Fix test failure seen after initial test run
	wimax/i2400m: Fix potential urb refcnt leak
	cifs: protect updating server->dstaddr with a spinlock
	scripts/config: allow colons in option strings for sed
	lib/mpi: Fix building for powerpc with clang
	net: bcmgenet: suppress warnings on failed Rx SKB allocations
	net: systemport: suppress warnings on failed Rx SKB allocations
	rc: allow rc modules to be loaded if rc-main is not a module
	lirc_imon: do not leave imon_probe() with mutex held
	am437x-vpfe: fix an uninitialized variable bug
	cx23885: uninitialized variable in cx23885_av_work_handler()
	ath9k_htc: check for underflow in ath9k_htc_rx_msg()
	VFIO: platform: reset: fix a warning message condition
	net: moxa: fix an error code
	mfd: lp8788-irq: Uninitialized variable in irq handler
	ethernet: micrel: fix some error codes
	power: ipaq-micro-battery: freeing the wrong variable
	i40e: fix an uninitialized variable bug
	qede: uninitialized variable in qede_start_xmit()
	qlcnic: potential NULL dereference in qlcnic_83xx_get_minidump_template()
	qlcnic: use the correct ring in qlcnic_83xx_process_rcv_ring_diag()
	target: Fix a memory leak in target_dev_lba_map_store()
	memory/tegra: Add number of TLB lines for Tegra124
	pinctrl: bcm2835: Fix memory leak in error path
	be2net: Don't leak iomapped memory on removal.
	ipv4: Fix memory leak in exception case for splitting tries
	flow_dissector: Check for IP fragmentation even if not using IPv4 address
	ipv4: fix checksum annotation in udp4_csum_init
	ipv4: do not abuse GFP_ATOMIC in inet_netconf_notify_devconf()
	ipv4: accept u8 in IP_TOS ancillary data
	net: vrf: Fix dev refcnt leak due to IPv6 prefix route
	ipv6: fix checksum annotation in udp6_csum_init
	ipv6: do not abuse GFP_ATOMIC in inet6_netconf_notify_devconf()
	ipv6: add missing netconf notif when 'all' is updated
	net: ipv6: Fix processing of RAs in presence of VRF
	netfilter: nf_tables: fix a wrong check to skip the inactive rules
	netfilter: nft_dynset: fix panic if NFT_SET_HASH is not enabled
	netfilter: nf_tables: destroy the set if fail to add transaction
	netfilter: nft_dup: do not use sreg_dev if the user doesn't specify it
	udp: restore UDPlite many-cast delivery
	clk: st: avoid uninitialized variable use
	clk: gpio: handle error codes for of_clk_get_parent_count()
	clk: ti: omap3+: dpll: use non-locking version of clk_get_rate
	clk: multiplier: Prevent the multiplier from under / over flowing
	clk: imx: clk-pllv3: fix incorrect handle of enet powerdown bit
	clk: xgene: Don't call __pa on ioremaped address
	cls_bpf: reset class and reuse major in da
	arm64: bpf: jit JMP_JSET_{X,K}
	bpf, trace: check event type in bpf_perf_event_read
	bpf: fix map not being uncharged during map creation failure
	net/mlx4_core: Fix potential corruption in counters database
	net/mlx4_core: Fix access to uninitialized index
	net/mlx4_en: Fix the return value of a failure in VLAN VID add/kill
	net/mlx4_core: Check device state before unregistering it
	net/mlx4_core: Fix the resource-type enum in res tracker to conform to FW spec
	net/mlx4_en: Process all completions in RX rings after port goes up
	net/mlx4_core: Do not access comm channel if it has not yet been initialized
	net/mlx4_en: Fix potential deadlock in port statistics flow
	net/mlx4: Fix uninitialized fields in rule when adding promiscuous mode to device managed flow steering
	net/mlx4_core: Fix QUERY FUNC CAP flags
	mlxsw: switchx2: Fix misuse of hard_header_len
	mlxsw: switchx2: Fix ethernet port initialization
	sched/fair: Fix calc_cfs_shares() fixed point arithmetics width confusion
	net_sched: flower: Avoid dissection of unmasked keys
	pkt_sched: fq: use proper locking in fq_dump_stats()
	sched/preempt: Fix preempt_count manipulations
	power: bq27xxx: fix reading for bq27000 and bq27010
	power: bq27xxx: fix register numbers of bq27500
	power: test_power: correctly handle empty writes
	power: bq27xxx_battery: Fix bq27541 AveragePower register address
	power_supply: tps65217-charger: Fix NULL deref during property export
	net: vrf: Fix dst reference counting
	net: Don't delete routes in different VRFs
	vti6: fix input path
	ipv4: Fix table id reference in fib_sync_down_addr
	mlx4: do not call napi_schedule() without care
	xprtrdma: Fix backchannel allocation of extra rpcrdma_reps
	ALSA: fm801: Initialize chip after IRQ handler is registered
	bonding: fix length of actor system
	MIPS: perf: Remove incorrect odd/even counter handling for I6400
	Revert "cpufreq: Drop rwsem lock around CPUFREQ_GOV_POLICY_EXIT"
	net: dsa: mv88e6xxx: unlock DSA and CPU ports
	gfs2: fix flock panic issue
	blk-mq: fix undefined behaviour in order_to_size()
	dm: fix second blk_delay_queue() parameter to be in msec units not jiffies
	dmaengine: edma: Add probe callback to edma_tptc_driver
	openvswitch: update checksum in {push,pop}_mpls
	cxgb4/cxgb4vf: Fixes regression in perf when tx vlan offload is disabled
	net: bcmgenet: fix skb_len in bcmgenet_xmit_single()
	net: bcmgenet: device stats are unsigned long
	ovs/gre: fix rtnl notifications on iface deletion
	gre: do not assign header_ops in collect metadata mode
	gre: build header correctly for collect metadata tunnels
	gre: reject GUE and FOU in collect metadata mode
	sfc: fix potential stack corruption from running past stat bitmask
	sfc: clear napi_hash state when copying channels
	net: bcmsysport: Device stats are unsigned long
	cxgbi: fix uninitialized flowi6
	net: macb: add missing free_netdev() on error in macb_probe()
	macvtap: segmented packet is consumed
	tipc: fix the error handling in tipc_udp_enable()
	net: icmp6_send should use dst dev to determine L3 domain
	et131x: Fix logical vs bitwise check in et131x_tx_timeout()
	net: ethernet: stmmac: dwmac-sti: fix probe error path
	rtnl: reset calcit fptr in rtnl_unregister()
	net: ethernet: stmmac: dwmac-rk: fix probe error path
	fq_codel: return non zero qlen in class dumps
	net: ethernet: stmmac: dwmac-generic: fix probe error path
	ovs/geneve: fix rtnl notifications on iface deletion
	bnxt: add a missing rcu synchronization
	qdisc: fix a module refcount leak in qdisc_create_dflt()
	net: axienet: Fix return value check in axienet_probe()
	bnxt_en: Remove locking around txr->dev_state
	net: ethernet: davinci_emac: Fix devioctl while in fixed link
	net: ethernet: mvneta: Remove IFF_UNICAST_FLT which is not implemented
	net: ethernet: ti: cpsw: fix device and of_node leaks
	net: ethernet: ti: cpsw: fix secondary-emac probe error path
	net: hns: fix device reference leaks
	net: bridge: don't increment tx_dropped in br_do_proxy_arp
	net: dsa: mv88e6xxx: enable SA learning on DSA ports
	net: ehea: avoid null pointer dereference
	l2tp: fix use-after-free during module unload
	hwrng: exynos - Disable runtime PM on driver unbind
	net: icmp_route_lookup should use rt dev to determine L3 domain
	net: mvneta: fix trivial cut-off issue in mvneta_ethtool_update_stats
	net: macb: replace macb_writel() call by queue_writel() to update queue ISR
	ravb: Add missing free_irq() call to ravb_close()
	mvpp2: use correct size for memset
	net: vxlan: lwt: Fix vxlan local traffic.
	net: ethoc: Fix early error paths
	ovs/vxlan: fix rtnl notifications on iface deletion
	net: mv643xx_eth: fix packet corruption with TSO and tiny unaligned packets.
	regulator: core: Rely on regulator_dev_release to free constraints
	net: dsa: mv88e6xxx: fix port VLAN maps
	at803x: fix reset handling
	cxl: Fix DAR check & use REGION_ID instead of opencoding
	net: ethernet: davinci_emac: Fix platform_data overwrite
	ata: sata_dwc_460ex: remove incorrect locking
	pinctrl: tegra: Correctly check the supported configuration
	brcmfmac: add fallback for devices that do not report per-chain values
	brcmfmac: restore stopping netdev queue when bus clogs up
	bridge: Fix problems around fdb entries pointing to the bridge device
	bna: add missing per queue ethtool stat
	net: skbuff: Remove errornous length validation in skb_vlan_pop()
	net: ep93xx_eth: Do not crash unloading module
	macvlan: Fix potential use-after free for broadcasts
	sctp: Fix SHUTDOWN CTSN Ack in the peer restart case
	ALSA: hda: Match both PCI ID and SSID for driver blacklist
	mac80211: add ieee80211_is_any_nullfunc()
	Linux 4.4.223

Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>
Change-Id: Ie7caca39501fe5e82b947964cc474ed1c786d756

15 files changed, 56 insertions, 21 deletions

diff --git a/include/asm-generic/preempt.h b/include/asm-generic/preempt.h
index 5d8ffa3e6f8c..c1cde3577551 100644
--- a/include/asm-generic/preempt.h
+++ b/include/asm-generic/preempt.h
@@ -7,10 +7,10 @@
 
 static __always_inline int preempt_count(void)
 {
-	return current_thread_info()->preempt_count;
+	return READ_ONCE(current_thread_info()->preempt_count);
 }
 
-static __always_inline int *preempt_count_ptr(void)
+static __always_inline volatile int *preempt_count_ptr(void)
 {
 	return &current_thread_info()->preempt_count;
 }
diff --git a/include/linux/cpufreq.h b/include/linux/cpufreq.h
index 23015c3a377b..fc8f969c95b6 100644
--- a/include/linux/cpufreq.h
+++ b/include/linux/cpufreq.h
@@ -100,10 +100,6 @@ struct cpufreq_policy {
 	 * - Any routine that will write to the policy structure and/or may take away
 	 *   the policy altogether (eg. CPU hotplug), will hold this lock in write
 	 *   mode before doing so.
-	 *
-	 * Additional rules:
-	 * - Lock should not be held across
-	 *     __cpufreq_governor(data, CPUFREQ_GOV_POLICY_EXIT);
 	 */
 	struct rw_semaphore	rwsem;
 
diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
index 149a7a6687e9..e7a278ca1fde 100644
--- a/include/linux/ieee80211.h
+++ b/include/linux/ieee80211.h
@@ -607,6 +607,15 @@ static inline bool ieee80211_is_qos_nullfunc(__le16 fc)
 }
 
 /**
+ * ieee80211_is_any_nullfunc - check if frame is regular or QoS nullfunc frame
+ * @fc: frame control bytes in little-endian byteorder
+ */
+static inline bool ieee80211_is_any_nullfunc(__le16 fc)
+{
+	return (ieee80211_is_nullfunc(fc) || ieee80211_is_qos_nullfunc(fc));
+}
+
+/**
  * ieee80211_is_bufferable_mmpdu - check if frame is bufferable MMPDU
  * @fc: frame control field in little-endian byteorder
  */
diff --git a/include/linux/mlx5/driver.h b/include/linux/mlx5/driver.h
index 412aa988c6ad..06cc39623d13 100644
--- a/include/linux/mlx5/driver.h
+++ b/include/linux/mlx5/driver.h
@@ -54,7 +54,7 @@ enum {
 	/* one minute for the sake of bringup. Generally, commands must always
 	 * complete and we may need to increase this timeout value
 	 */
-	MLX5_CMD_TIMEOUT_MSEC	= 7200 * 1000,
+	MLX5_CMD_TIMEOUT_MSEC	= 60 * 1000,
 	MLX5_CMD_WQ_MAX_NAME	= 32,
 };
 
@@ -566,6 +566,7 @@ struct mlx5_cmd_work_ent {
 	void		       *uout;
 	int			uout_size;
 	mlx5_cmd_cbk_t		callback;
+	struct delayed_work	cb_timeout_work;
 	void		       *context;
 	int			idx;
 	struct completion	done;
diff --git a/include/linux/mlx5/qp.h b/include/linux/mlx5/qp.h
index a8786d27ab81..489fc317746a 100644
--- a/include/linux/mlx5/qp.h
+++ b/include/linux/mlx5/qp.h
@@ -539,6 +539,7 @@ struct mlx5_modify_qp_mbox_in {
 	__be32			optparam;
 	u8			rsvd1[4];
 	struct mlx5_qp_context	ctx;
+	u8			rsvd2[16];
 };
 
 struct mlx5_modify_qp_mbox_out {
diff --git a/include/linux/mtd/nand.h b/include/linux/mtd/nand.h
index 5a9d1d4c2487..93fc37200793 100644
--- a/include/linux/mtd/nand.h
+++ b/include/linux/mtd/nand.h
@@ -276,7 +276,7 @@ struct nand_onfi_params {
 	__le16 t_r;
 	__le16 t_ccs;
 	__le16 src_sync_timing_mode;
-	__le16 src_ssync_features;
+	u8 src_ssync_features;
 	__le16 clk_pin_capacitance_typ;
 	__le16 io_pin_capacitance_typ;
 	__le16 input_pin_capacitance_typ;
@@ -284,7 +284,7 @@ struct nand_onfi_params {
 	u8 driver_strength_support;
 	__le16 t_int_r;
 	__le16 t_ald;
-	u8 reserved4[7];
+	u8 reserved4[8];
 
 	/* vendor */
 	__le16 vendor_revision;
diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
index d999e503ba8a..c1a42027ee0e 100644
--- a/include/linux/netdevice.h
+++ b/include/linux/netdevice.h
@@ -2013,7 +2013,10 @@ struct napi_gro_cb {
 	/* Number of gro_receive callbacks this packet already went through */
 	u8 recursion_counter:4;
 
-	/* 3 bit hole */
+	/* Used in GRE, set in fou/gue_gro_receive */
+	u8	is_fou:1;
+
+	/* 2 bit hole */
 
 	/* used to support CHECKSUM_COMPLETE for tunneling protocols */
 	__wsum	csum;
diff --git a/include/linux/sunrpc/msg_prot.h b/include/linux/sunrpc/msg_prot.h
index 807371357160..59cbf16eaeb5 100644
--- a/include/linux/sunrpc/msg_prot.h
+++ b/include/linux/sunrpc/msg_prot.h
@@ -158,9 +158,9 @@ typedef __be32	rpc_fraghdr;
 
 /*
  * Note that RFC 1833 does not put any size restrictions on the
- * netid string, but all currently defined netid's fit in 4 bytes.
+ * netid string, but all currently defined netid's fit in 5 bytes.
  */
-#define RPCBIND_MAXNETIDLEN	(4u)
+#define RPCBIND_MAXNETIDLEN	(5u)
 
 /*
  * Universal addresses are introduced in RFC 1833 and further spelled
diff --git a/include/net/bonding.h b/include/net/bonding.h
index d5abd3a80896..6fbfc21b27b1 100644
--- a/include/net/bonding.h
+++ b/include/net/bonding.h
@@ -34,6 +34,9 @@
 
 #define BOND_DEFAULT_MIIMON	100
 
+#ifndef __long_aligned
+#define __long_aligned __attribute__((aligned((sizeof(long)))))
+#endif
 /*
  * Less bad way to call ioctl from within the kernel; this needs to be
  * done some other way to get the call out of interrupt context.
@@ -138,7 +141,9 @@ struct bond_params {
 	struct reciprocal_value reciprocal_packets_per_slave;
 	u16 ad_actor_sys_prio;
 	u16 ad_user_port_key;
-	u8 ad_actor_system[ETH_ALEN];
+
+	/* 2 bytes of padding : see ether_addr_equal_64bits() */
+	u8 ad_actor_system[ETH_ALEN + 2];
 };
 
 struct bond_parm_tbl {
diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
index a39430e2fdcc..33f28e62b790 100644
--- a/include/net/ip6_route.h
+++ b/include/net/ip6_route.h
@@ -103,6 +103,9 @@ void fib6_force_start_gc(struct net *net);
 struct rt6_info *addrconf_dst_alloc(struct inet6_dev *idev,
 				    const struct in6_addr *addr, bool anycast);
 
+struct rt6_info *ip6_dst_alloc(struct net *net, struct net_device *dev,
+			       int flags);
+
 /*
  *	support functions for ND
  *
diff --git a/include/net/ip_fib.h b/include/net/ip_fib.h
index f6ff83b2ac87..b8dfab88c877 100644
--- a/include/net/ip_fib.h
+++ b/include/net/ip_fib.h
@@ -112,6 +112,7 @@ struct fib_info {
 	unsigned char		fib_scope;
 	unsigned char		fib_type;
 	__be32			fib_prefsrc;
+	u32			fib_tb_id;
 	u32			fib_priority;
 	struct dst_metrics	*fib_metrics;
 #define fib_mtu fib_metrics->metrics[RTAX_MTU-1]
@@ -320,7 +321,7 @@ void fib_flush_external(struct net *net);
 /* Exported by fib_semantics.c */
 int ip_fib_check_default(__be32 gw, struct net_device *dev);
 int fib_sync_down_dev(struct net_device *dev, unsigned long event, bool force);
-int fib_sync_down_addr(struct net *net, __be32 local);
+int fib_sync_down_addr(struct net_device *dev, __be32 local);
 int fib_sync_up(struct net_device *dev, unsigned int nh_flags);
 void fib_sync_mtu(struct net_device *dev, u32 orig_mtu);
 
diff --git a/include/net/route.h b/include/net/route.h
index 11dfd0df0e67..f828a9d83012 100644
--- a/include/net/route.h
+++ b/include/net/route.h
@@ -210,6 +210,9 @@ unsigned int inet_addr_type_dev_table(struct net *net,
 void ip_rt_multicast_event(struct in_device *);
 int ip_rt_ioctl(struct net *, unsigned int cmd, void __user *arg);
 void ip_rt_get_source(u8 *src, struct sk_buff *skb, struct rtable *rt);
+struct rtable *rt_dst_alloc(struct net_device *dev,
+			     unsigned int flags, u16 type,
+			     bool nopolicy, bool noxfrm, bool will_cache);
 
 struct in_ifaddr;
 void fib_add_ifaddr(struct in_ifaddr *);
diff --git a/include/net/sch_generic.h b/include/net/sch_generic.h
index ccd2a964dad7..d236ce450da3 100644
--- a/include/net/sch_generic.h
+++ b/include/net/sch_generic.h
@@ -674,9 +674,11 @@ static inline struct sk_buff *qdisc_peek_dequeued(struct Qdisc *sch)
 	/* we can reuse ->gso_skb because peek isn't called for root qdiscs */
 	if (!sch->gso_skb) {
 		sch->gso_skb = sch->dequeue(sch);
-		if (sch->gso_skb)
+		if (sch->gso_skb) {
 			/* it's still part of the queue */
+			qdisc_qstats_backlog_inc(sch, sch->gso_skb);
 			sch->q.qlen++;
+		}
 	}
 
 	return sch->gso_skb;
@@ -689,6 +691,7 @@ static inline struct sk_buff *qdisc_dequeue_peeked(struct Qdisc *sch)
 
 	if (skb) {
 		sch->gso_skb = NULL;
+		qdisc_qstats_backlog_dec(sch, skb);
 		sch->q.qlen--;
 	} else {
 		skb = sch->dequeue(sch);
diff --git a/include/net/sock.h b/include/net/sock.h
index fb1462b427d3..e34872ca5a28 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1206,11 +1206,13 @@ static inline void memcg_memory_allocated_add(struct cg_proto *prot,
 					      unsigned long amt,
 					      int *parent_status)
 {
-	page_counter_charge(&prot->memory_allocated, amt);
+	struct page_counter *counter;
+
+	if (page_counter_try_charge(&prot->memory_allocated, amt, &counter))
+		return;
 
-	if (page_counter_read(&prot->memory_allocated) >
-	    prot->memory_allocated.limit)
-		*parent_status = OVER_LIMIT;
+	page_counter_charge(&prot->memory_allocated, amt);
+	*parent_status = OVER_LIMIT;
 }
 
 static inline void memcg_memory_allocated_sub(struct cg_proto *prot,
@@ -1653,7 +1655,13 @@ static inline void sock_put(struct sock *sk)
  */
 void sock_gen_put(struct sock *sk);
 
-int sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested);
+int __sk_receive_skb(struct sock *sk, struct sk_buff *skb, const int nested,
+		     unsigned int trim_cap);
+static inline int sk_receive_skb(struct sock *sk, struct sk_buff *skb,
+				 const int nested)
+{
+	return __sk_receive_skb(sk, skb, nested, 1);
+}
 
 static inline void sk_tx_queue_set(struct sock *sk, int tx_queue)
 {
diff --git a/include/net/xfrm.h b/include/net/xfrm.h
index c5c03fa47f8c..4b8d8af7942a 100644
--- a/include/net/xfrm.h
+++ b/include/net/xfrm.h
@@ -1554,8 +1554,10 @@ int xfrm4_tunnel_deregister(struct xfrm_tunnel *handler, unsigned short family);
 void xfrm4_local_error(struct sk_buff *skb, u32 mtu);
 int xfrm6_extract_header(struct sk_buff *skb);
 int xfrm6_extract_input(struct xfrm_state *x, struct sk_buff *skb);
-int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi);
+int xfrm6_rcv_spi(struct sk_buff *skb, int nexthdr, __be32 spi,
+		  struct ip6_tnl *t);
 int xfrm6_transport_finish(struct sk_buff *skb, int async);
+int xfrm6_rcv_tnl(struct sk_buff *skb, struct ip6_tnl *t);
 int xfrm6_rcv(struct sk_buff *skb);
 int xfrm6_input_addr(struct sk_buff *skb, xfrm_address_t *daddr,
 		     xfrm_address_t *saddr, u8 proto);