Merge 4.4.118 into android-4.4

Changes in 4.4.118
	net: add dst_cache support
	net: replace dst_cache ip6_tunnel implementation with the generic one
	cfg80211: check dev_set_name() return value
	mm,vmscan: Make unregister_shrinker() no-op if register_shrinker() failed.
	xfrm: Fix stack-out-of-bounds read on socket policy lookup.
	xfrm: check id proto in validate_tmpl()
	blktrace: fix unlocked registration of tracepoints
	drm: Require __GFP_NOFAIL for the legacy drm_modeset_lock_all
	Provide a function to create a NUL-terminated string from unterminated data
	selinux: ensure the context is NUL terminated in security_context_to_sid_core()
	selinux: skip bounded transition processing if the policy isn't loaded
	crypto: x86/twofish-3way - Fix %rbp usage
	KVM: x86: fix escape of guest dr6 to the host
	netfilter: x_tables: fix int overflow in xt_alloc_table_info()
	netfilter: x_tables: avoid out-of-bounds reads in xt_request_find_{match|target}
	netfilter: ipt_CLUSTERIP: fix out-of-bounds accesses in clusterip_tg_check()
	netfilter: on sockopt() acquire sock lock only in the required scope
	netfilter: xt_RATEEST: acquire xt_rateest_mutex for hash insert
	net: avoid skb_warn_bad_offload on IS_ERR
	ASoC: ux500: add MODULE_LICENSE tag
	video: fbdev/mmp: add MODULE_LICENSE
	arm64: dts: add #cooling-cells to CPU nodes
	Make DST_CACHE a silent config option
	dn_getsockoptdecnet: move nf_{get/set}sockopt outside sock lock
	staging: android: ashmem: Fix a race condition in pin ioctls
	binder: check for binder_thread allocation failure in binder_poll()
	staging: iio: adc: ad7192: fix external frequency setting
	usbip: keep usbip_device sockfd state in sync with tcp_socket
	usb: build drivers/usb/common/ when USB_SUPPORT is set
	ARM: OMAP2+: Fix SRAM virt to phys translation for save_secure_ram_context
	ARM: AM33xx: PRM: Remove am33xx_pwrdm_read_prev_pwrst function
	ARM: dts: Fix omap4 hang with GPS connected to USB by using wakeupgen
	ARM: dts: am4372: Correct the interrupts_properties of McASP
	perf top: Fix window dimensions change handling
	perf bench numa: Fixup discontiguous/sparse numa nodes
	media: s5k6aa: describe some function parameters
	pinctrl: sunxi: Fix A80 interrupt pin bank
	RDMA/cma: Make sure that PSN is not over max allowed
	scripts/kernel-doc: Don't fail with status != 0 if error encountered with -none
	ipvlan: Add the skb->mark as flow4's member to lookup route
	powerpc/perf: Fix oops when grouping different pmu events
	s390/dasd: prevent prefix I/O error
	gianfar: fix a flooded alignment reports because of padding issue.
	net_sched: red: Avoid devision by zero
	net_sched: red: Avoid illegal values
	btrfs: Fix possible off-by-one in btrfs_search_path_in_tree
	509: fix printing uninitialized stack memory when OID is empty
	dmaengine: ioat: Fix error handling path
	dmaengine: at_hdmac: fix potential NULL pointer dereference in atc_prep_dma_interleaved
	clk: fix a panic error caused by accessing NULL pointer
	ASoC: rockchip: disable clock on error
	spi: sun4i: disable clocks in the remove function
	xfrm: Fix stack-out-of-bounds with misconfigured transport mode policies.
	drm/armada: fix leak of crtc structure
	dmaengine: jz4740: disable/unprepare clk if probe fails
	mm/early_ioremap: Fix boot hang with earlyprintk=efi,keep
	x86/mm/kmmio: Fix mmiotrace for page unaligned addresses
	xen: XEN_ACPI_PROCESSOR is Dom0-only
	hippi: Fix a Fix a possible sleep-in-atomic bug in rr_close
	virtio_balloon: prevent uninitialized variable use
	isdn: icn: remove a #warning
	vmxnet3: prevent building with 64K pages
	gpio: intel-mid: Fix build warning when !CONFIG_PM
	platform/x86: intel_mid_thermal: Fix suspend handlers unused warning
	video: fbdev: via: remove possibly unused variables
	scsi: advansys: fix build warning for PCI=n
	x86/ras/inject: Make it depend on X86_LOCAL_APIC=y
	arm64: define BUG() instruction without CONFIG_BUG
	x86/fpu/math-emu: Fix possible uninitialized variable use
	tools build: Add tools tree support for 'make -s'
	x86/build: Silence the build with "make -s"
	thermal: fix INTEL_SOC_DTS_IOSF_CORE dependencies
	x86: add MULTIUSER dependency for KVM
	x86/platform: Add PCI dependency for PUNIT_ATOM_DEBUG
	scsi: advansys: fix uninitialized data access
	arm64: Kconfig: select COMPAT_BINFMT_ELF only when BINFMT_ELF is set
	ALSA: hda/ca0132 - fix possible NULL pointer use
	reiserfs: avoid a -Wmaybe-uninitialized warning
	ssb: mark ssb_bus_register as __maybe_unused
	thermal: spear: use __maybe_unused for PM functions
	x86/boot: Avoid warning for zero-filling .bss
	scsi: sim710: fix build warning
	drivers/net: fix eisa_driver probe section mismatch
	dpt_i2o: fix build warning
	profile: hide unused functions when !CONFIG_PROC_FS
	md: avoid warning for 32-bit sector_t
	mtd: ichxrom: maybe-uninitialized with gcc-4.9
	mtd: maps: add __init attribute
	mptfusion: hide unused seq_mpt_print_ioc_summary function
	scsi: fdomain: drop fdomain_pci_tbl when built-in
	video: fbdev: sis: remove unused variable
	staging: ste_rmi4: avoid unused function warnings
	fbdev: sis: enforce selection of at least one backend
	video: Use bool instead int pointer for get_opt_bool() argument
	scsi: mvumi: use __maybe_unused to hide pm functions
	SCSI: initio: remove duplicate module device table
	pwc: hide unused label
	usb: musb/ux500: remove duplicate check for dma_is_compatible
	tty: hvc_xen: hide xen_console_remove when unused
	target/user: Fix cast from pointer to phys_addr_t
	driver-core: use 'dev' argument in dev_dbg_ratelimited stub
	fbdev: auo_k190x: avoid unused function warnings
	amd-xgbe: Fix unused suspend handlers build warning
	mtd: sh_flctl: pass FIFO as physical address
	mtd: cfi: enforce valid geometry configuration
	fbdev: s6e8ax0: avoid unused function warnings
	modsign: hide openssl output in silent builds
	Drivers: hv: vmbus: fix build warning
	fbdev: sm712fb: avoid unused function warnings
	hwrng: exynos - use __maybe_unused to hide pm functions
	USB: cdc_subset: only build when one driver is enabled
	rtlwifi: fix gcc-6 indentation warning
	staging: wilc1000: fix kbuild test robot error
	x86/platform/olpc: Fix resume handler build warning
	netfilter: ipvs: avoid unused variable warnings
	ipv4: ipconfig: avoid unused ic_proto_used symbol
	tc1100-wmi: fix build warning when CONFIG_PM not enabled
	tlan: avoid unused label with PCI=n
	drm/vmwgfx: use *_32_bits() macros
	tty: cyclades: cyz_interrupt is only used for PCI
	genirq/msi: Add stubs for get_cached_msi_msg/pci_write_msi_msg
	ASoC: mediatek: add i2c dependency
	iio: adc: axp288: remove redundant duplicate const on axp288_adc_channels
	infiniband: cxgb4: use %pR format string for printing resources
	b2c2: flexcop: avoid unused function warnings
	i2c: remove __init from i2c_register_board_info()
	staging: unisys: visorinput depends on INPUT
	tc358743: fix register i2c_rd/wr functions
	drm/nouveau: hide gcc-4.9 -Wmaybe-uninitialized
	Input: tca8418_keypad - hide gcc-4.9 -Wmaybe-uninitialized warning
	KVM: add X86_LOCAL_APIC dependency
	go7007: add MEDIA_CAMERA_SUPPORT dependency
	em28xx: only use mt9v011 if camera support is enabled
	ISDN: eicon: reduce stack size of sig_ind function
	ASoC: rockchip: use __maybe_unused to hide st_irq_syscfg_resume
	serial: 8250_mid: fix broken DMA dependency
	drm/gma500: Sanity-check pipe index
	hdpvr: hide unused variable
	v4l: remove MEDIA_TUNER dependency for VIDEO_TUNER
	cw1200: fix bogus maybe-uninitialized warning
	wireless: cw1200: use __maybe_unused to hide pm functions_
	perf/x86: Shut up false-positive -Wmaybe-uninitialized warning
	dmaengine: zx: fix build warning
	net: hp100: remove unnecessary #ifdefs
	gpio: xgene: mark PM functions as __maybe_unused
	ncpfs: fix unused variable warning
	Revert "power: bq27xxx_battery: Remove unneeded dependency in Kconfig"
	power: bq27xxx_battery: mark some symbols __maybe_unused
	isdn: sc: work around type mismatch warning
	binfmt_elf: compat: avoid unused function warning
	idle: i7300: add PCI dependency
	usb: phy: msm add regulator dependency
	ncr5380: shut up gcc indentation warning
	ARM: tegra: select USB_ULPI from EHCI rather than platform
	ASoC: Intel: Kconfig: fix build when ACPI is not enabled
	netlink: fix nla_put_{u8,u16,u32} for KASAN
	dell-wmi, dell-laptop: depends DMI
	genksyms: Fix segfault with invalid declarations
	x86/microcode/AMD: Change load_microcode_amd()'s param to bool to fix preemptibility bug
	drm/gma500: remove helper function
	kasan: rework Kconfig settings
	KVM: async_pf: Fix #DF due to inject "Page not Present" and "Page Ready" exceptions simultaneously
	x86/retpoline: Remove the esp/rsp thunk
	KVM: x86: Make indirect calls in emulator speculation safe
	KVM: VMX: Make indirect call speculation safe
	module/retpoline: Warn about missing retpoline in module
	x86/nospec: Fix header guards names
	x86/bugs: Drop one "mitigation" from dmesg
	x86/cpu/bugs: Make retpoline module warning conditional
	x86/spectre: Check CONFIG_RETPOLINE in command line parser
	Documentation: Document array_index_nospec
	array_index_nospec: Sanitize speculative array de-references
	x86: Implement array_index_mask_nospec
	x86: Introduce barrier_nospec
	x86/get_user: Use pointer masking to limit speculation
	x86/syscall: Sanitize syscall table de-references under speculation
	vfs, fdtable: Prevent bounds-check bypass via speculative execution
	nl80211: Sanitize array index in parse_txq_params
	x86/spectre: Report get_user mitigation for spectre_v1
	x86/spectre: Fix spelling mistake: "vunerable"-> "vulnerable"
	x86/paravirt: Remove 'noreplace-paravirt' cmdline option
	x86/kvm: Update spectre-v1 mitigation
	x86/retpoline: Avoid retpolines for built-in __init functions
	x86/spectre: Simplify spectre_v2 command line parsing
	x86/speculation: Fix typo IBRS_ATT, which should be IBRS_ALL
	KVM: nVMX: kmap() can't fail
	KVM: nVMX: vmx_complete_nested_posted_interrupt() can't fail
	kvm: nVMX: Fix kernel panics induced by illegal INVEPT/INVVPID types
	KVM: VMX: clean up declaration of VPID/EPT invalidation types
	KVM: nVMX: invvpid handling improvements
	crypto: s5p-sss - Fix kernel Oops in AES-ECB mode
	net: dst_cache_per_cpu_dst_set() can be static
	Linux 4.4.118

Change-Id: I01c76e1c15a611e13a1e98092bc5c01cdb5b6adb
Signed-off-by: Greg Kroah-Hartman <gregkh@google.com>

13 files changed, 279 insertions, 38 deletions

diff --git a/include/linux/device.h b/include/linux/device.h
index 7075a2485ed3..834000903525 100644
--- a/include/linux/device.h
+++ b/include/linux/device.h
@@ -1272,8 +1272,11 @@ do {									\
 		dev_printk(KERN_DEBUG, dev, fmt, ##__VA_ARGS__);	\
 } while (0)
 #else
-#define dev_dbg_ratelimited(dev, fmt, ...)			\
-	no_printk(KERN_DEBUG pr_fmt(fmt), ##__VA_ARGS__)
+#define dev_dbg_ratelimited(dev, fmt, ...)				\
+do {									\
+	if (0)								\
+		dev_printk(KERN_DEBUG, dev, fmt, ##__VA_ARGS__);	\
+} while (0)
 #endif
 
 #ifdef VERBOSE_DEBUG
diff --git a/include/linux/fdtable.h b/include/linux/fdtable.h
index 5295535b60c6..a7b7a050bfa8 100644
--- a/include/linux/fdtable.h
+++ b/include/linux/fdtable.h
@@ -9,6 +9,7 @@
 #include <linux/compiler.h>
 #include <linux/spinlock.h>
 #include <linux/rcupdate.h>
+#include <linux/nospec.h>
 #include <linux/types.h>
 #include <linux/init.h>
 #include <linux/fs.h>
@@ -81,8 +82,10 @@ static inline struct file *__fcheck_files(struct files_struct *files, unsigned i
 {
 	struct fdtable *fdt = rcu_dereference_raw(files->fdt);
 
-	if (fd < fdt->max_fds)
+	if (fd < fdt->max_fds) {
+		fd = array_index_nospec(fd, fdt->max_fds);
 		return rcu_dereference_raw(fdt->fd[fd]);
+	}
 	return NULL;
 }
 
diff --git a/include/linux/init.h b/include/linux/init.h
index aedb254abc37..3561ea30ed8c 100644
--- a/include/linux/init.h
+++ b/include/linux/init.h
@@ -4,6 +4,13 @@
 #include <linux/compiler.h>
 #include <linux/types.h>
 
+/* Built-in __init functions needn't be compiled with retpoline */
+#if defined(RETPOLINE) && !defined(MODULE)
+#define __noretpoline __attribute__((indirect_branch("keep")))
+#else
+#define __noretpoline
+#endif
+
 /* These macros are used to mark some functions or 
  * initialized data (doesn't apply to uninitialized data)
  * as `initialization' functions. The kernel can take this
@@ -39,7 +46,7 @@
 
 /* These are for everybody (although not all archs will actually
    discard it in modules) */
-#define __init		__section(.init.text) __cold notrace
+#define __init		__section(.init.text) __cold notrace __noretpoline
 #define __initdata	__section(.init.data)
 #define __initconst	__constsection(.init.rodata)
 #define __exitdata	__section(.exit.data)
diff --git a/include/linux/module.h b/include/linux/module.h
index e2324653c8ef..dfe5c2e25ba1 100644
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -789,6 +789,15 @@ static inline void module_bug_finalize(const Elf_Ehdr *hdr,
 static inline void module_bug_cleanup(struct module *mod) {}
 #endif	/* CONFIG_GENERIC_BUG */
 
+#ifdef RETPOLINE
+extern bool retpoline_module_ok(bool has_retpoline);
+#else
+static inline bool retpoline_module_ok(bool has_retpoline)
+{
+	return true;
+}
+#endif
+
 #ifdef CONFIG_MODULE_SIG
 static inline bool module_sig_ok(struct module *module)
 {
diff --git a/include/linux/msi.h b/include/linux/msi.h
index f0f43ec45ee7..d0d50cf00b4d 100644
--- a/include/linux/msi.h
+++ b/include/linux/msi.h
@@ -17,7 +17,13 @@ struct msi_desc;
 struct pci_dev;
 struct platform_msi_priv_data;
 void __get_cached_msi_msg(struct msi_desc *entry, struct msi_msg *msg);
+#ifdef CONFIG_GENERIC_MSI_IRQ
 void get_cached_msi_msg(unsigned int irq, struct msi_msg *msg);
+#else
+static inline void get_cached_msi_msg(unsigned int irq, struct msi_msg *msg)
+{
+}
+#endif
 
 typedef void (*irq_write_msi_msg_t)(struct msi_desc *desc,
 				    struct msi_msg *msg);
@@ -105,18 +111,21 @@ struct msi_desc {
 
 struct pci_dev *msi_desc_to_pci_dev(struct msi_desc *desc);
 void *msi_desc_to_pci_sysdata(struct msi_desc *desc);
+void pci_write_msi_msg(unsigned int irq, struct msi_msg *msg);
 #else /* CONFIG_PCI_MSI */
 static inline void *msi_desc_to_pci_sysdata(struct msi_desc *desc)
 {
 	return NULL;
 }
+static inline void pci_write_msi_msg(unsigned int irq, struct msi_msg *msg)
+{
+}
 #endif /* CONFIG_PCI_MSI */
 
 struct msi_desc *alloc_msi_entry(struct device *dev);
 void free_msi_entry(struct msi_desc *entry);
 void __pci_read_msi_msg(struct msi_desc *entry, struct msi_msg *msg);
 void __pci_write_msi_msg(struct msi_desc *entry, struct msi_msg *msg);
-void pci_write_msi_msg(unsigned int irq, struct msi_msg *msg);
 
 u32 __pci_msix_desc_mask_irq(struct msi_desc *desc, u32 flag);
 u32 __pci_msi_desc_mask_irq(struct msi_desc *desc, u32 mask, u32 flag);
diff --git a/include/linux/mtd/sh_flctl.h b/include/linux/mtd/sh_flctl.h
index 1c28f8879b1c..067b37aff4a1 100644
--- a/include/linux/mtd/sh_flctl.h
+++ b/include/linux/mtd/sh_flctl.h
@@ -148,6 +148,7 @@ struct sh_flctl {
 	struct platform_device	*pdev;
 	struct dev_pm_qos_request pm_qos;
 	void __iomem		*reg;
+	resource_size_t		fifo;
 
 	uint8_t	done_buff[2048 + 64];	/* max size 2048 + 64 */
 	int	read_bytes;
diff --git a/include/linux/nospec.h b/include/linux/nospec.h
new file mode 100644
index 000000000000..b99bced39ac2
--- /dev/null
+++ b/include/linux/nospec.h
@@ -0,0 +1,72 @@
+// SPDX-License-Identifier: GPL-2.0
+// Copyright(c) 2018 Linus Torvalds. All rights reserved.
+// Copyright(c) 2018 Alexei Starovoitov. All rights reserved.
+// Copyright(c) 2018 Intel Corporation. All rights reserved.
+
+#ifndef _LINUX_NOSPEC_H
+#define _LINUX_NOSPEC_H
+
+/**
+ * array_index_mask_nospec() - generate a ~0 mask when index < size, 0 otherwise
+ * @index: array element index
+ * @size: number of elements in array
+ *
+ * When @index is out of bounds (@index >= @size), the sign bit will be
+ * set.  Extend the sign bit to all bits and invert, giving a result of
+ * zero for an out of bounds index, or ~0 if within bounds [0, @size).
+ */
+#ifndef array_index_mask_nospec
+static inline unsigned long array_index_mask_nospec(unsigned long index,
+						    unsigned long size)
+{
+	/*
+	 * Warn developers about inappropriate array_index_nospec() usage.
+	 *
+	 * Even if the CPU speculates past the WARN_ONCE branch, the
+	 * sign bit of @index is taken into account when generating the
+	 * mask.
+	 *
+	 * This warning is compiled out when the compiler can infer that
+	 * @index and @size are less than LONG_MAX.
+	 */
+	if (WARN_ONCE(index > LONG_MAX || size > LONG_MAX,
+			"array_index_nospec() limited to range of [0, LONG_MAX]\n"))
+		return 0;
+
+	/*
+	 * Always calculate and emit the mask even if the compiler
+	 * thinks the mask is not needed. The compiler does not take
+	 * into account the value of @index under speculation.
+	 */
+	OPTIMIZER_HIDE_VAR(index);
+	return ~(long)(index | (size - 1UL - index)) >> (BITS_PER_LONG - 1);
+}
+#endif
+
+/*
+ * array_index_nospec - sanitize an array index after a bounds check
+ *
+ * For a code sequence like:
+ *
+ *     if (index < size) {
+ *         index = array_index_nospec(index, size);
+ *         val = array[index];
+ *     }
+ *
+ * ...if the CPU speculates past the bounds check then
+ * array_index_nospec() will clamp the index within the range of [0,
+ * size).
+ */
+#define array_index_nospec(index, size)					\
+({									\
+	typeof(index) _i = (index);					\
+	typeof(size) _s = (size);					\
+	unsigned long _mask = array_index_mask_nospec(_i, _s);		\
+									\
+	BUILD_BUG_ON(sizeof(_i) > sizeof(long));			\
+	BUILD_BUG_ON(sizeof(_s) > sizeof(long));			\
+									\
+	_i &= _mask;							\
+	_i;								\
+})
+#endif /* _LINUX_NOSPEC_H */
diff --git a/include/linux/string.h b/include/linux/string.h
index aa30789b0f65..98bb781a2eff 100644
--- a/include/linux/string.h
+++ b/include/linux/string.h
@@ -122,6 +122,7 @@ extern char *kstrdup(const char *s, gfp_t gfp);
 extern const char *kstrdup_const(const char *s, gfp_t gfp);
 extern char *kstrndup(const char *s, size_t len, gfp_t gfp);
 extern void *kmemdup(const void *src, size_t len, gfp_t gfp);
+extern char *kmemdup_nul(const char *s, size_t len, gfp_t gfp);
 
 extern char **argv_split(gfp_t gfp, const char *str, int *argcp);
 extern void argv_free(char **argv);
diff --git a/include/net/dst_cache.h b/include/net/dst_cache.h
new file mode 100644
index 000000000000..151accae708b
--- /dev/null
+++ b/include/net/dst_cache.h
@@ -0,0 +1,97 @@
+#ifndef _NET_DST_CACHE_H
+#define _NET_DST_CACHE_H
+
+#include <linux/jiffies.h>
+#include <net/dst.h>
+#if IS_ENABLED(CONFIG_IPV6)
+#include <net/ip6_fib.h>
+#endif
+
+struct dst_cache {
+	struct dst_cache_pcpu __percpu *cache;
+	unsigned long reset_ts;
+};
+
+/**
+ *	dst_cache_get - perform cache lookup
+ *	@dst_cache: the cache
+ *
+ *	The caller should use dst_cache_get_ip4() if it need to retrieve the
+ *	source address to be used when xmitting to the cached dst.
+ *	local BH must be disabled.
+ */
+struct dst_entry *dst_cache_get(struct dst_cache *dst_cache);
+
+/**
+ *	dst_cache_get_ip4 - perform cache lookup and fetch ipv4 source address
+ *	@dst_cache: the cache
+ *	@saddr: return value for the retrieved source address
+ *
+ *	local BH must be disabled.
+ */
+struct rtable *dst_cache_get_ip4(struct dst_cache *dst_cache, __be32 *saddr);
+
+/**
+ *	dst_cache_set_ip4 - store the ipv4 dst into the cache
+ *	@dst_cache: the cache
+ *	@dst: the entry to be cached
+ *	@saddr: the source address to be stored inside the cache
+ *
+ *	local BH must be disabled.
+ */
+void dst_cache_set_ip4(struct dst_cache *dst_cache, struct dst_entry *dst,
+		       __be32 saddr);
+
+#if IS_ENABLED(CONFIG_IPV6)
+
+/**
+ *	dst_cache_set_ip6 - store the ipv6 dst into the cache
+ *	@dst_cache: the cache
+ *	@dst: the entry to be cached
+ *	@saddr: the source address to be stored inside the cache
+ *
+ *	local BH must be disabled.
+ */
+void dst_cache_set_ip6(struct dst_cache *dst_cache, struct dst_entry *dst,
+		       const struct in6_addr *addr);
+
+/**
+ *	dst_cache_get_ip6 - perform cache lookup and fetch ipv6 source address
+ *	@dst_cache: the cache
+ *	@saddr: return value for the retrieved source address
+ *
+ *	local BH must be disabled.
+ */
+struct dst_entry *dst_cache_get_ip6(struct dst_cache *dst_cache,
+				    struct in6_addr *saddr);
+#endif
+
+/**
+ *	dst_cache_reset - invalidate the cache contents
+ *	@dst_cache: the cache
+ *
+ *	This do not free the cached dst to avoid races and contentions.
+ *	the dst will be freed on later cache lookup.
+ */
+static inline void dst_cache_reset(struct dst_cache *dst_cache)
+{
+	dst_cache->reset_ts = jiffies;
+}
+
+/**
+ *	dst_cache_init - initialize the cache, allocating the required storage
+ *	@dst_cache: the cache
+ *	@gfp: allocation flags
+ */
+int dst_cache_init(struct dst_cache *dst_cache, gfp_t gfp);
+
+/**
+ *	dst_cache_destroy - empty the cache and free the allocated storage
+ *	@dst_cache: the cache
+ *
+ *	No synchronization is enforced: it must be called only when the cache
+ *	is unsed.
+ */
+void dst_cache_destroy(struct dst_cache *dst_cache);
+
+#endif
diff --git a/include/net/ip6_tunnel.h b/include/net/ip6_tunnel.h
index 9c2c044153f6..d143c8480681 100644
--- a/include/net/ip6_tunnel.h
+++ b/include/net/ip6_tunnel.h
@@ -5,6 +5,8 @@
 #include <linux/netdevice.h>
 #include <linux/if_tunnel.h>
 #include <linux/ip6_tunnel.h>
+#include <net/ip_tunnels.h>
+#include <net/dst_cache.h>
 
 #define IP6TUNNEL_ERR_TIMEO (30*HZ)
 
@@ -32,12 +34,6 @@ struct __ip6_tnl_parm {
 	__be32			o_key;
 };
 
-struct ip6_tnl_dst {
-	seqlock_t lock;
-	struct dst_entry __rcu *dst;
-	u32 cookie;
-};
-
 /* IPv6 tunnel */
 struct ip6_tnl {
 	struct ip6_tnl __rcu *next;	/* next tunnel in list */
@@ -45,7 +41,7 @@ struct ip6_tnl {
 	struct net *net;	/* netns for packet i/o */
 	struct __ip6_tnl_parm parms;	/* tunnel configuration parameters */
 	struct flowi fl;	/* flowi template for xmit */
-	struct ip6_tnl_dst __percpu *dst_cache;	/* cached dst */
+	struct dst_cache dst_cache;	/* cached dst */
 
 	int err_count;
 	unsigned long err_time;
@@ -65,11 +61,6 @@ struct ipv6_tlv_tnl_enc_lim {
 	__u8 encap_limit;	/* tunnel encapsulation limit   */
 } __packed;
 
-struct dst_entry *ip6_tnl_dst_get(struct ip6_tnl *t);
-int ip6_tnl_dst_init(struct ip6_tnl *t);
-void ip6_tnl_dst_destroy(struct ip6_tnl *t);
-void ip6_tnl_dst_reset(struct ip6_tnl *t);
-void ip6_tnl_dst_set(struct ip6_tnl *t, struct dst_entry *dst);
 int ip6_tnl_rcv_ctl(struct ip6_tnl *t, const struct in6_addr *laddr,
 		const struct in6_addr *raddr);
 int ip6_tnl_xmit_ctl(struct ip6_tnl *t, const struct in6_addr *laddr,
diff --git a/include/net/netlink.h b/include/net/netlink.h
index 0e3172751755..5ffaea4665f8 100644
--- a/include/net/netlink.h
+++ b/include/net/netlink.h
@@ -745,7 +745,10 @@ static inline int nla_parse_nested(struct nlattr *tb[], int maxtype,
  */
 static inline int nla_put_u8(struct sk_buff *skb, int attrtype, u8 value)
 {
-	return nla_put(skb, attrtype, sizeof(u8), &value);
+	/* temporary variables to work around GCC PR81715 with asan-stack=1 */
+	u8 tmp = value;
+
+	return nla_put(skb, attrtype, sizeof(u8), &tmp);
 }
 
 /**
@@ -756,7 +759,9 @@ static inline int nla_put_u8(struct sk_buff *skb, int attrtype, u8 value)
  */
 static inline int nla_put_u16(struct sk_buff *skb, int attrtype, u16 value)
 {
-	return nla_put(skb, attrtype, sizeof(u16), &value);
+	u16 tmp = value;
+
+	return nla_put(skb, attrtype, sizeof(u16), &tmp);
 }
 
 /**
@@ -767,7 +772,9 @@ static inline int nla_put_u16(struct sk_buff *skb, int attrtype, u16 value)
  */
 static inline int nla_put_be16(struct sk_buff *skb, int attrtype, __be16 value)
 {
-	return nla_put(skb, attrtype, sizeof(__be16), &value);
+	__be16 tmp = value;
+
+	return nla_put(skb, attrtype, sizeof(__be16), &tmp);
 }
 
 /**
@@ -778,7 +785,9 @@ static inline int nla_put_be16(struct sk_buff *skb, int attrtype, __be16 value)
  */
 static inline int nla_put_net16(struct sk_buff *skb, int attrtype, __be16 value)
 {
-	return nla_put_be16(skb, attrtype | NLA_F_NET_BYTEORDER, value);
+	__be16 tmp = value;
+
+	return nla_put_be16(skb, attrtype | NLA_F_NET_BYTEORDER, tmp);
 }
 
 /**
@@ -789,7 +798,9 @@ static inline int nla_put_net16(struct sk_buff *skb, int attrtype, __be16 value)
  */
 static inline int nla_put_le16(struct sk_buff *skb, int attrtype, __le16 value)
 {
-	return nla_put(skb, attrtype, sizeof(__le16), &value);
+	__le16 tmp = value;
+
+	return nla_put(skb, attrtype, sizeof(__le16), &tmp);
 }
 
 /**
@@ -800,7 +811,9 @@ static inline int nla_put_le16(struct sk_buff *skb, int attrtype, __le16 value)
  */
 static inline int nla_put_u32(struct sk_buff *skb, int attrtype, u32 value)
 {
-	return nla_put(skb, attrtype, sizeof(u32), &value);
+	u32 tmp = value;
+
+	return nla_put(skb, attrtype, sizeof(u32), &tmp);
 }
 
 /**
@@ -811,7 +824,9 @@ static inline int nla_put_u32(struct sk_buff *skb, int attrtype, u32 value)
  */
 static inline int nla_put_be32(struct sk_buff *skb, int attrtype, __be32 value)
 {
-	return nla_put(skb, attrtype, sizeof(__be32), &value);
+	__be32 tmp = value;
+
+	return nla_put(skb, attrtype, sizeof(__be32), &tmp);
 }
 
 /**
@@ -822,7 +837,9 @@ static inline int nla_put_be32(struct sk_buff *skb, int attrtype, __be32 value)
  */
 static inline int nla_put_net32(struct sk_buff *skb, int attrtype, __be32 value)
 {
-	return nla_put_be32(skb, attrtype | NLA_F_NET_BYTEORDER, value);
+	__be32 tmp = value;
+
+	return nla_put_be32(skb, attrtype | NLA_F_NET_BYTEORDER, tmp);
 }
 
 /**
@@ -833,7 +850,9 @@ static inline int nla_put_net32(struct sk_buff *skb, int attrtype, __be32 value)
  */
 static inline int nla_put_le32(struct sk_buff *skb, int attrtype, __le32 value)
 {
-	return nla_put(skb, attrtype, sizeof(__le32), &value);
+	__le32 tmp = value;
+
+	return nla_put(skb, attrtype, sizeof(__le32), &tmp);
 }
 
 /**
@@ -844,7 +863,9 @@ static inline int nla_put_le32(struct sk_buff *skb, int attrtype, __le32 value)
  */
 static inline int nla_put_u64(struct sk_buff *skb, int attrtype, u64 value)
 {
-	return nla_put(skb, attrtype, sizeof(u64), &value);
+	u64 tmp = value;
+
+	return nla_put(skb, attrtype, sizeof(u64), &tmp);
 }
 
 /**
@@ -855,7 +876,9 @@ static inline int nla_put_u64(struct sk_buff *skb, int attrtype, u64 value)
  */
 static inline int nla_put_be64(struct sk_buff *skb, int attrtype, __be64 value)
 {
-	return nla_put(skb, attrtype, sizeof(__be64), &value);
+	__be64 tmp = value;
+
+	return nla_put(skb, attrtype, sizeof(__be64), &tmp);
 }
 
 /**
@@ -866,7 +889,9 @@ static inline int nla_put_be64(struct sk_buff *skb, int attrtype, __be64 value)
  */
 static inline int nla_put_net64(struct sk_buff *skb, int attrtype, __be64 value)
 {
-	return nla_put_be64(skb, attrtype | NLA_F_NET_BYTEORDER, value);
+	__be64 tmp = value;
+
+	return nla_put_be64(skb, attrtype | NLA_F_NET_BYTEORDER, tmp);
 }
 
 /**
@@ -877,7 +902,9 @@ static inline int nla_put_net64(struct sk_buff *skb, int attrtype, __be64 value)
  */
 static inline int nla_put_le64(struct sk_buff *skb, int attrtype, __le64 value)
 {
-	return nla_put(skb, attrtype, sizeof(__le64), &value);
+	__le64 tmp = value;
+
+	return nla_put(skb, attrtype, sizeof(__le64), &tmp);
 }
 
 /**
@@ -888,7 +915,9 @@ static inline int nla_put_le64(struct sk_buff *skb, int attrtype, __le64 value)
  */
 static inline int nla_put_s8(struct sk_buff *skb, int attrtype, s8 value)
 {
-	return nla_put(skb, attrtype, sizeof(s8), &value);
+	s8 tmp = value;
+
+	return nla_put(skb, attrtype, sizeof(s8), &tmp);
 }
 
 /**
@@ -899,7 +928,9 @@ static inline int nla_put_s8(struct sk_buff *skb, int attrtype, s8 value)
  */
 static inline int nla_put_s16(struct sk_buff *skb, int attrtype, s16 value)
 {
-	return nla_put(skb, attrtype, sizeof(s16), &value);
+	s16 tmp = value;
+
+	return nla_put(skb, attrtype, sizeof(s16), &tmp);
 }
 
 /**
@@ -910,7 +941,9 @@ static inline int nla_put_s16(struct sk_buff *skb, int attrtype, s16 value)
  */
 static inline int nla_put_s32(struct sk_buff *skb, int attrtype, s32 value)
 {
-	return nla_put(skb, attrtype, sizeof(s32), &value);
+	s32 tmp = value;
+
+	return nla_put(skb, attrtype, sizeof(s32), &tmp);
 }
 
 /**
@@ -921,7 +954,9 @@ static inline int nla_put_s32(struct sk_buff *skb, int attrtype, s32 value)
  */
 static inline int nla_put_s64(struct sk_buff *skb, int attrtype, s64 value)
 {
-	return nla_put(skb, attrtype, sizeof(s64), &value);
+	s64 tmp = value;
+
+	return nla_put(skb, attrtype, sizeof(s64), &tmp);
 }
 
 /**
@@ -969,7 +1004,9 @@ static inline int nla_put_msecs(struct sk_buff *skb, int attrtype,
 static inline int nla_put_in_addr(struct sk_buff *skb, int attrtype,
 				  __be32 addr)
 {
-	return nla_put_be32(skb, attrtype, addr);
+	__be32 tmp = addr;
+
+	return nla_put_be32(skb, attrtype, tmp);
 }
 
 /**
diff --git a/include/net/red.h b/include/net/red.h
index 76e0b5f922c6..3618cdfec884 100644
--- a/include/net/red.h
+++ b/include/net/red.h
@@ -167,6 +167,17 @@ static inline void red_set_vars(struct red_vars *v)
 	v->qcount	= -1;
 }
 
+static inline bool red_check_params(u32 qth_min, u32 qth_max, u8 Wlog)
+{
+	if (fls(qth_min) + Wlog > 32)
+		return false;
+	if (fls(qth_max) + Wlog > 32)
+		return false;
+	if (qth_max < qth_min)
+		return false;
+	return true;
+}
+
 static inline void red_set_parms(struct red_parms *p,
 				 u32 qth_min, u32 qth_max, u8 Wlog, u8 Plog,
 				 u8 Scell_log, u8 *stab, u32 max_P)
@@ -178,7 +189,7 @@ static inline void red_set_parms(struct red_parms *p,
 	p->qth_max	= qth_max << Wlog;
 	p->Wlog		= Wlog;
 	p->Plog		= Plog;
-	if (delta < 0)
+	if (delta <= 0)
 		delta = 1;
 	p->qth_delta	= delta;
 	if (!max_P) {
diff --git a/include/trace/events/clk.h b/include/trace/events/clk.h
index 758607226bfd..2cd449328aee 100644
--- a/include/trace/events/clk.h
+++ b/include/trace/events/clk.h
@@ -134,12 +134,12 @@ DECLARE_EVENT_CLASS(clk_parent,
 
 	TP_STRUCT__entry(
 		__string(        name,           core->name                )
-		__string(        pname,          parent->name              )
+		__string(        pname, parent ? parent->name : "none"     )
 	),
 
 	TP_fast_assign(
 		__assign_str(name, core->name);
-		__assign_str(pname, parent->name);
+		__assign_str(pname, parent ? parent->name : "none");
 	),
 
 	TP_printk("%s %s", __get_str(name), __get_str(pname))