Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-4.14/0172-4.14.73-all-fixes.patch

    Contents of /trunk/kernel-alx/patches-4.14/0172-4.14.73-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3238 - (show annotations) (download)
    Fri Nov 9 12:14:58 2018 UTC (5 years, 5 months ago) by niro
    File size: 62284 byte(s) 
    -added up to patches-4.14.79
    1 diff --git a/Makefile b/Makefile
    2 index 734722bda173..89f30ca964b6 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,7 +1,7 @@
    6 # SPDX-License-Identifier: GPL-2.0
    7 VERSION = 4
    8 PATCHLEVEL = 14
    9 -SUBLEVEL = 72
    10 +SUBLEVEL = 73
    11 EXTRAVERSION =
    12 NAME = Petit Gorille
    13
    14 diff --git a/arch/x86/xen/pmu.c b/arch/x86/xen/pmu.c
    15 index 7d00d4ad44d4..95997e6c0696 100644
    16 --- a/arch/x86/xen/pmu.c
    17 +++ b/arch/x86/xen/pmu.c
    18 @@ -478,7 +478,7 @@ static void xen_convert_regs(const struct xen_pmu_regs *xen_regs,
    19 irqreturn_t xen_pmu_irq_handler(int irq, void *dev_id)
    20 {
    21 int err, ret = IRQ_NONE;
    22 - struct pt_regs regs;
    23 + struct pt_regs regs = {0};
    24 const struct xen_pmu_data *xenpmu_data = get_xenpmu_data();
    25 uint8_t xenpmu_flags = get_xenpmu_flags();
    26
    27 diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
    28 index fd435a96481c..e8d9479615c9 100644
    29 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
    30 +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c
    31 @@ -715,12 +715,14 @@ static int amdgpu_cgs_get_firmware_info(struct cgs_device *cgs_device,
    32 break;
    33 case CHIP_POLARIS10:
    34 if (type == CGS_UCODE_ID_SMU) {
    35 - if ((adev->pdev->device == 0x67df) &&
    36 - ((adev->pdev->revision == 0xe0) ||
    37 - (adev->pdev->revision == 0xe3) ||
    38 - (adev->pdev->revision == 0xe4) ||
    39 - (adev->pdev->revision == 0xe5) ||
    40 - (adev->pdev->revision == 0xe7) ||
    41 + if (((adev->pdev->device == 0x67df) &&
    42 + ((adev->pdev->revision == 0xe0) ||
    43 + (adev->pdev->revision == 0xe3) ||
    44 + (adev->pdev->revision == 0xe4) ||
    45 + (adev->pdev->revision == 0xe5) ||
    46 + (adev->pdev->revision == 0xe7) ||
    47 + (adev->pdev->revision == 0xef))) ||
    48 + ((adev->pdev->device == 0x6fdf) &&
    49 (adev->pdev->revision == 0xef))) {
    50 info->is_kicker = true;
    51 strcpy(fw_name, "amdgpu/polaris10_k_smc.bin");
    52 diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
    53 index 0f16986ec5bc..4dd68d821353 100644
    54 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
    55 +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c
    56 @@ -500,6 +500,7 @@ static const struct pci_device_id pciidlist[] = {
    57 {0x1002, 0x67CA, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10},
    58 {0x1002, 0x67CC, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10},
    59 {0x1002, 0x67CF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10},
    60 + {0x1002, 0x6FDF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10},
    61 /* Polaris12 */
    62 {0x1002, 0x6980, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
    63 {0x1002, 0x6981, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12},
    64 diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
    65 index 430830d63a33..2c6d19683688 100644
    66 --- a/drivers/gpu/drm/nouveau/nouveau_connector.c
    67 +++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
    68 @@ -570,12 +570,16 @@ nouveau_connector_detect(struct drm_connector *connector, bool force)
    69 nv_connector->edid = NULL;
    70 }
    71
    72 - /* Outputs are only polled while runtime active, so acquiring a
    73 - * runtime PM ref here is unnecessary (and would deadlock upon
    74 - * runtime suspend because it waits for polling to finish).
    75 + /* Outputs are only polled while runtime active, so resuming the
    76 + * device here is unnecessary (and would deadlock upon runtime suspend
    77 + * because it waits for polling to finish). We do however, want to
    78 + * prevent the autosuspend timer from elapsing during this operation
    79 + * if possible.
    80 */
    81 - if (!drm_kms_helper_is_poll_worker()) {
    82 - ret = pm_runtime_get_sync(connector->dev->dev);
    83 + if (drm_kms_helper_is_poll_worker()) {
    84 + pm_runtime_get_noresume(dev->dev);
    85 + } else {
    86 + ret = pm_runtime_get_sync(dev->dev);
    87 if (ret < 0 && ret != -EACCES)
    88 return conn_status;
    89 }
    90 @@ -653,10 +657,8 @@ detect_analog:
    91
    92 out:
    93
    94 - if (!drm_kms_helper_is_poll_worker()) {
    95 - pm_runtime_mark_last_busy(connector->dev->dev);
    96 - pm_runtime_put_autosuspend(connector->dev->dev);
    97 - }
    98 + pm_runtime_mark_last_busy(dev->dev);
    99 + pm_runtime_put_autosuspend(dev->dev);
    100
    101 return conn_status;
    102 }
    103 @@ -1120,6 +1122,26 @@ nouveau_connector_hotplug(struct nvif_notify *notify)
    104 const struct nvif_notify_conn_rep_v0 *rep = notify->data;
    105 const char *name = connector->name;
    106 struct nouveau_encoder *nv_encoder;
    107 + int ret;
    108 +
    109 + ret = pm_runtime_get(drm->dev->dev);
    110 + if (ret == 0) {
    111 + /* We can't block here if there's a pending PM request
    112 + * running, as we'll deadlock nouveau_display_fini() when it
    113 + * calls nvif_put() on our nvif_notify struct. So, simply
    114 + * defer the hotplug event until the device finishes resuming
    115 + */
    116 + NV_DEBUG(drm, "Deferring HPD on %s until runtime resume\n",
    117 + name);
    118 + schedule_work(&drm->hpd_work);
    119 +
    120 + pm_runtime_put_noidle(drm->dev->dev);
    121 + return NVIF_NOTIFY_KEEP;
    122 + } else if (ret != 1 && ret != -EACCES) {
    123 + NV_WARN(drm, "HPD on %s dropped due to RPM failure: %d\n",
    124 + name, ret);
    125 + return NVIF_NOTIFY_DROP;
    126 + }
    127
    128 if (rep->mask & NVIF_NOTIFY_CONN_V0_IRQ) {
    129 NV_DEBUG(drm, "service %s\n", name);
    130 @@ -1137,6 +1159,8 @@ nouveau_connector_hotplug(struct nvif_notify *notify)
    131 drm_helper_hpd_irq_event(connector->dev);
    132 }
    133
    134 + pm_runtime_mark_last_busy(drm->dev->dev);
    135 + pm_runtime_put_autosuspend(drm->dev->dev);
    136 return NVIF_NOTIFY_KEEP;
    137 }
    138
    139 diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
    140 index caf53503c0f7..2612702c3a3f 100644
    141 --- a/drivers/gpu/drm/nouveau/nouveau_display.c
    142 +++ b/drivers/gpu/drm/nouveau/nouveau_display.c
    143 @@ -356,8 +356,6 @@ nouveau_display_hpd_work(struct work_struct *work)
    144 pm_runtime_get_sync(drm->dev->dev);
    145
    146 drm_helper_hpd_irq_event(drm->dev);
    147 - /* enable polling for external displays */
    148 - drm_kms_helper_poll_enable(drm->dev);
    149
    150 pm_runtime_mark_last_busy(drm->dev->dev);
    151 pm_runtime_put_sync(drm->dev->dev);
    152 @@ -380,15 +378,29 @@ nouveau_display_acpi_ntfy(struct notifier_block *nb, unsigned long val,
    153 {
    154 struct nouveau_drm *drm = container_of(nb, typeof(*drm), acpi_nb);
    155 struct acpi_bus_event *info = data;
    156 + int ret;
    157
    158 if (!strcmp(info->device_class, ACPI_VIDEO_CLASS)) {
    159 if (info->type == ACPI_VIDEO_NOTIFY_PROBE) {
    160 - /*
    161 - * This may be the only indication we receive of a
    162 - * connector hotplug on a runtime suspended GPU,
    163 - * schedule hpd_work to check.
    164 - */
    165 - schedule_work(&drm->hpd_work);
    166 + ret = pm_runtime_get(drm->dev->dev);
    167 + if (ret == 1 || ret == -EACCES) {
    168 + /* If the GPU is already awake, or in a state
    169 + * where we can't wake it up, it can handle
    170 + * it's own hotplug events.
    171 + */
    172 + pm_runtime_put_autosuspend(drm->dev->dev);
    173 + } else if (ret == 0) {
    174 + /* This may be the only indication we receive
    175 + * of a connector hotplug on a runtime
    176 + * suspended GPU, schedule hpd_work to check.
    177 + */
    178 + NV_DEBUG(drm, "ACPI requested connector reprobe\n");
    179 + schedule_work(&drm->hpd_work);
    180 + pm_runtime_put_noidle(drm->dev->dev);
    181 + } else {
    182 + NV_WARN(drm, "Dropped ACPI reprobe event due to RPM error: %d\n",
    183 + ret);
    184 + }
    185
    186 /* acpi-video should not generate keypresses for this */
    187 return NOTIFY_BAD;
    188 @@ -412,6 +424,11 @@ nouveau_display_init(struct drm_device *dev)
    189 if (ret)
    190 return ret;
    191
    192 + /* enable connector detection and polling for connectors without HPD
    193 + * support
    194 + */
    195 + drm_kms_helper_poll_enable(dev);
    196 +
    197 /* enable hotplug interrupts */
    198 drm_connector_list_iter_begin(dev, &conn_iter);
    199 nouveau_for_each_non_mst_connector_iter(connector, &conn_iter) {
    200 @@ -426,7 +443,7 @@ nouveau_display_init(struct drm_device *dev)
    201 }
    202
    203 void
    204 -nouveau_display_fini(struct drm_device *dev, bool suspend)
    205 +nouveau_display_fini(struct drm_device *dev, bool suspend, bool runtime)
    206 {
    207 struct nouveau_display *disp = nouveau_display(dev);
    208 struct nouveau_drm *drm = nouveau_drm(dev);
    209 @@ -451,6 +468,9 @@ nouveau_display_fini(struct drm_device *dev, bool suspend)
    210 }
    211 drm_connector_list_iter_end(&conn_iter);
    212
    213 + if (!runtime)
    214 + cancel_work_sync(&drm->hpd_work);
    215 +
    216 drm_kms_helper_poll_disable(dev);
    217 disp->fini(dev);
    218 }
    219 @@ -640,11 +660,11 @@ nouveau_display_suspend(struct drm_device *dev, bool runtime)
    220 }
    221 }
    222
    223 - nouveau_display_fini(dev, true);
    224 + nouveau_display_fini(dev, true, runtime);
    225 return 0;
    226 }
    227
    228 - nouveau_display_fini(dev, true);
    229 + nouveau_display_fini(dev, true, runtime);
    230
    231 list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) {
    232 struct nouveau_framebuffer *nouveau_fb;
    233 diff --git a/drivers/gpu/drm/nouveau/nouveau_display.h b/drivers/gpu/drm/nouveau/nouveau_display.h
    234 index 34cd144681b9..5e7dae79c2ee 100644
    235 --- a/drivers/gpu/drm/nouveau/nouveau_display.h
    236 +++ b/drivers/gpu/drm/nouveau/nouveau_display.h
    237 @@ -64,7 +64,7 @@ nouveau_display(struct drm_device *dev)
    238 int nouveau_display_create(struct drm_device *dev);
    239 void nouveau_display_destroy(struct drm_device *dev);
    240 int nouveau_display_init(struct drm_device *dev);
    241 -void nouveau_display_fini(struct drm_device *dev, bool suspend);
    242 +void nouveau_display_fini(struct drm_device *dev, bool suspend, bool runtime);
    243 int nouveau_display_suspend(struct drm_device *dev, bool runtime);
    244 void nouveau_display_resume(struct drm_device *dev, bool runtime);
    245 int nouveau_display_vblank_enable(struct drm_device *, unsigned int);
    246 diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
    247 index d6f13d7254de..7d3c7bb0ebfa 100644
    248 --- a/drivers/gpu/drm/nouveau/nouveau_drm.c
    249 +++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
    250 @@ -546,7 +546,7 @@ nouveau_drm_unload(struct drm_device *dev)
    251 nouveau_debugfs_fini(drm);
    252
    253 if (dev->mode_config.num_crtc)
    254 - nouveau_display_fini(dev, false);
    255 + nouveau_display_fini(dev, false, false);
    256 nouveau_display_destroy(dev);
    257
    258 nouveau_bios_takedown(dev);
    259 diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c
    260 index 8746eeeec44d..491f1892b50e 100644
    261 --- a/drivers/gpu/drm/udl/udl_fb.c
    262 +++ b/drivers/gpu/drm/udl/udl_fb.c
    263 @@ -432,9 +432,11 @@ static void udl_fbdev_destroy(struct drm_device *dev,
    264 {
    265 drm_fb_helper_unregister_fbi(&ufbdev->helper);
    266 drm_fb_helper_fini(&ufbdev->helper);
    267 - drm_framebuffer_unregister_private(&ufbdev->ufb.base);
    268 - drm_framebuffer_cleanup(&ufbdev->ufb.base);
    269 - drm_gem_object_put_unlocked(&ufbdev->ufb.obj->base);
    270 + if (ufbdev->ufb.obj) {
    271 + drm_framebuffer_unregister_private(&ufbdev->ufb.base);
    272 + drm_framebuffer_cleanup(&ufbdev->ufb.base);
    273 + drm_gem_object_put_unlocked(&ufbdev->ufb.obj->base);
    274 + }
    275 }
    276
    277 int udl_fbdev_init(struct drm_device *dev)
    278 diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
    279 index 17590cb2b80d..502c7eb708c2 100644
    280 --- a/drivers/gpu/drm/vc4/vc4_plane.c
    281 +++ b/drivers/gpu/drm/vc4/vc4_plane.c
    282 @@ -329,6 +329,9 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state)
    283 vc4_state->y_scaling[0] = vc4_get_scaling_mode(vc4_state->src_h[0],
    284 vc4_state->crtc_h);
    285
    286 + vc4_state->is_unity = (vc4_state->x_scaling[0] == VC4_SCALING_NONE &&
    287 + vc4_state->y_scaling[0] == VC4_SCALING_NONE);
    288 +
    289 if (num_planes > 1) {
    290 vc4_state->is_yuv = true;
    291
    292 @@ -344,24 +347,17 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state)
    293 vc4_get_scaling_mode(vc4_state->src_h[1],
    294 vc4_state->crtc_h);
    295
    296 - /* YUV conversion requires that scaling be enabled,
    297 - * even on a plane that's otherwise 1:1. Choose TPZ
    298 - * for simplicity.
    299 + /* YUV conversion requires that horizontal scaling be enabled,
    300 + * even on a plane that's otherwise 1:1. Looks like only PPF
    301 + * works in that case, so let's pick that one.
    302 */
    303 - if (vc4_state->x_scaling[0] == VC4_SCALING_NONE)
    304 - vc4_state->x_scaling[0] = VC4_SCALING_TPZ;
    305 - if (vc4_state->y_scaling[0] == VC4_SCALING_NONE)
    306 - vc4_state->y_scaling[0] = VC4_SCALING_TPZ;
    307 + if (vc4_state->is_unity)
    308 + vc4_state->x_scaling[0] = VC4_SCALING_PPF;
    309 } else {
    310 vc4_state->x_scaling[1] = VC4_SCALING_NONE;
    311 vc4_state->y_scaling[1] = VC4_SCALING_NONE;
    312 }
    313
    314 - vc4_state->is_unity = (vc4_state->x_scaling[0] == VC4_SCALING_NONE &&
    315 - vc4_state->y_scaling[0] == VC4_SCALING_NONE &&
    316 - vc4_state->x_scaling[1] == VC4_SCALING_NONE &&
    317 - vc4_state->y_scaling[1] == VC4_SCALING_NONE);
    318 -
    319 /* No configuring scaling on the cursor plane, since it gets
    320 non-vblank-synced updates, and scaling requires requires
    321 LBM changes which have to be vblank-synced.
    322 @@ -639,7 +635,10 @@ static int vc4_plane_mode_set(struct drm_plane *plane,
    323 vc4_dlist_write(vc4_state, SCALER_CSC2_ITR_R_601_5);
    324 }
    325
    326 - if (!vc4_state->is_unity) {
    327 + if (vc4_state->x_scaling[0] != VC4_SCALING_NONE ||
    328 + vc4_state->x_scaling[1] != VC4_SCALING_NONE ||
    329 + vc4_state->y_scaling[0] != VC4_SCALING_NONE ||
    330 + vc4_state->y_scaling[1] != VC4_SCALING_NONE) {
    331 /* LBM Base Address. */
    332 if (vc4_state->y_scaling[0] != VC4_SCALING_NONE ||
    333 vc4_state->y_scaling[1] != VC4_SCALING_NONE) {
    334 diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
    335 index a8a8f65a1e51..24952af51a54 100644
    336 --- a/drivers/infiniband/hw/cxgb4/qp.c
    337 +++ b/drivers/infiniband/hw/cxgb4/qp.c
    338 @@ -1395,6 +1395,12 @@ static void flush_qp(struct c4iw_qp *qhp)
    339 schp = to_c4iw_cq(qhp->ibqp.send_cq);
    340
    341 if (qhp->ibqp.uobject) {
    342 +
    343 + /* for user qps, qhp->wq.flushed is protected by qhp->mutex */
    344 + if (qhp->wq.flushed)
    345 + return;
    346 +
    347 + qhp->wq.flushed = 1;
    348 t4_set_wq_in_error(&qhp->wq);
    349 t4_set_cq_in_error(&rchp->cq);
    350 spin_lock_irqsave(&rchp->comp_handler_lock, flag);
    351 diff --git a/drivers/misc/vmw_balloon.c b/drivers/misc/vmw_balloon.c
    352 index 5f8b583c6e41..f74166aa9a0d 100644
    353 --- a/drivers/misc/vmw_balloon.c
    354 +++ b/drivers/misc/vmw_balloon.c
    355 @@ -45,6 +45,7 @@
    356 #include <linux/seq_file.h>
    357 #include <linux/vmw_vmci_defs.h>
    358 #include <linux/vmw_vmci_api.h>
    359 +#include <linux/io.h>
    360 #include <asm/hypervisor.h>
    361
    362 MODULE_AUTHOR("VMware, Inc.");
    363 diff --git a/drivers/net/appletalk/ipddp.c b/drivers/net/appletalk/ipddp.c
    364 index 9375cef22420..3d27616d9c85 100644
    365 --- a/drivers/net/appletalk/ipddp.c
    366 +++ b/drivers/net/appletalk/ipddp.c
    367 @@ -283,8 +283,12 @@ static int ipddp_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
    368 case SIOCFINDIPDDPRT:
    369 spin_lock_bh(&ipddp_route_lock);
    370 rp = __ipddp_find_route(&rcp);
    371 - if (rp)
    372 - memcpy(&rcp2, rp, sizeof(rcp2));
    373 + if (rp) {
    374 + memset(&rcp2, 0, sizeof(rcp2));
    375 + rcp2.ip = rp->ip;
    376 + rcp2.at = rp->at;
    377 + rcp2.flags = rp->flags;
    378 + }
    379 spin_unlock_bh(&ipddp_route_lock);
    380
    381 if (rp) {
    382 diff --git a/drivers/net/ethernet/hp/hp100.c b/drivers/net/ethernet/hp/hp100.c
    383 index c8c7ad2eff77..9b5a68b65432 100644
    384 --- a/drivers/net/ethernet/hp/hp100.c
    385 +++ b/drivers/net/ethernet/hp/hp100.c
    386 @@ -2634,7 +2634,7 @@ static int hp100_login_to_vg_hub(struct net_device *dev, u_short force_relogin)
    387 /* Wait for link to drop */
    388 time = jiffies + (HZ / 10);
    389 do {
    390 - if (~(hp100_inb(VG_LAN_CFG_1) & HP100_LINK_UP_ST))
    391 + if (!(hp100_inb(VG_LAN_CFG_1) & HP100_LINK_UP_ST))
    392 break;
    393 if (!in_interrupt())
    394 schedule_timeout_interruptible(1);
    395 diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
    396 index 71e2aef6b7a1..951892da3352 100644
    397 --- a/drivers/net/ppp/pppoe.c
    398 +++ b/drivers/net/ppp/pppoe.c
    399 @@ -429,6 +429,9 @@ static int pppoe_rcv(struct sk_buff *skb, struct net_device *dev,
    400 if (!skb)
    401 goto out;
    402
    403 + if (skb_mac_header_len(skb) < ETH_HLEN)
    404 + goto drop;
    405 +
    406 if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr)))
    407 goto drop;
    408
    409 diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
    410 index 31684f3382f6..c5d4b35bb72a 100644
    411 --- a/drivers/net/usb/qmi_wwan.c
    412 +++ b/drivers/net/usb/qmi_wwan.c
    413 @@ -1205,13 +1205,13 @@ static const struct usb_device_id products[] = {
    414 {QMI_FIXED_INTF(0x1199, 0x9061, 8)}, /* Sierra Wireless Modem */
    415 {QMI_FIXED_INTF(0x1199, 0x9063, 8)}, /* Sierra Wireless EM7305 */
    416 {QMI_FIXED_INTF(0x1199, 0x9063, 10)}, /* Sierra Wireless EM7305 */
    417 - {QMI_FIXED_INTF(0x1199, 0x9071, 8)}, /* Sierra Wireless MC74xx */
    418 - {QMI_FIXED_INTF(0x1199, 0x9071, 10)}, /* Sierra Wireless MC74xx */
    419 - {QMI_FIXED_INTF(0x1199, 0x9079, 8)}, /* Sierra Wireless EM74xx */
    420 - {QMI_FIXED_INTF(0x1199, 0x9079, 10)}, /* Sierra Wireless EM74xx */
    421 - {QMI_FIXED_INTF(0x1199, 0x907b, 8)}, /* Sierra Wireless EM74xx */
    422 - {QMI_FIXED_INTF(0x1199, 0x907b, 10)}, /* Sierra Wireless EM74xx */
    423 - {QMI_FIXED_INTF(0x1199, 0x9091, 8)}, /* Sierra Wireless EM7565 */
    424 + {QMI_QUIRK_SET_DTR(0x1199, 0x9071, 8)}, /* Sierra Wireless MC74xx */
    425 + {QMI_QUIRK_SET_DTR(0x1199, 0x9071, 10)},/* Sierra Wireless MC74xx */
    426 + {QMI_QUIRK_SET_DTR(0x1199, 0x9079, 8)}, /* Sierra Wireless EM74xx */
    427 + {QMI_QUIRK_SET_DTR(0x1199, 0x9079, 10)},/* Sierra Wireless EM74xx */
    428 + {QMI_QUIRK_SET_DTR(0x1199, 0x907b, 8)}, /* Sierra Wireless EM74xx */
    429 + {QMI_QUIRK_SET_DTR(0x1199, 0x907b, 10)},/* Sierra Wireless EM74xx */
    430 + {QMI_QUIRK_SET_DTR(0x1199, 0x9091, 8)}, /* Sierra Wireless EM7565 */
    431 {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)}, /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
    432 {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)}, /* Alcatel L800MA */
    433 {QMI_FIXED_INTF(0x2357, 0x0201, 4)}, /* TP-LINK HSUPA Modem MA180 */
    434 diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
    435 index d80343429de5..1a40fc3517a8 100644
    436 --- a/drivers/net/xen-netfront.c
    437 +++ b/drivers/net/xen-netfront.c
    438 @@ -907,7 +907,11 @@ static RING_IDX xennet_fill_frags(struct netfront_queue *queue,
    439 BUG_ON(pull_to <= skb_headlen(skb));
    440 __pskb_pull_tail(skb, pull_to - skb_headlen(skb));
    441 }
    442 - BUG_ON(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS);
    443 + if (unlikely(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS)) {
    444 + queue->rx.rsp_cons = ++cons;
    445 + kfree_skb(nskb);
    446 + return ~0U;
    447 + }
    448
    449 skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
    450 skb_frag_page(nfrag),
    451 @@ -1044,6 +1048,8 @@ err:
    452 skb->len += rx->status;
    453
    454 i = xennet_fill_frags(queue, skb, &tmpq);
    455 + if (unlikely(i == ~0U))
    456 + goto err;
    457
    458 if (rx->flags & XEN_NETRXF_csum_blank)
    459 skb->ip_summed = CHECKSUM_PARTIAL;
    460 diff --git a/drivers/pci/host/pci-aardvark.c b/drivers/pci/host/pci-aardvark.c
    461 index 9bfc22b5da4b..5f3048e75bec 100644
    462 --- a/drivers/pci/host/pci-aardvark.c
    463 +++ b/drivers/pci/host/pci-aardvark.c
    464 @@ -954,6 +954,7 @@ static int advk_pcie_probe(struct platform_device *pdev)
    465
    466 bus = bridge->bus;
    467
    468 + pci_bus_size_bridges(bus);
    469 pci_bus_assign_resources(bus);
    470
    471 list_for_each_entry(child, &bus->children, node)
    472 diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
    473 index ec2911c4ee42..35c9b2f4b293 100644
    474 --- a/drivers/pci/quirks.c
    475 +++ b/drivers/pci/quirks.c
    476 @@ -4388,11 +4388,6 @@ static int pci_quirk_qcom_rp_acs(struct pci_dev *dev, u16 acs_flags)
    477 *
    478 * 0x9d10-0x9d1b PCI Express Root port #{1-12}
    479 *
    480 - * The 300 series chipset suffers from the same bug so include those root
    481 - * ports here as well.
    482 - *
    483 - * 0xa32c-0xa343 PCI Express Root port #{0-24}
    484 - *
    485 * [1] http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-datasheet-vol-2.html
    486 * [2] http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-datasheet-vol-1.html
    487 * [3] http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-spec-update.html
    488 @@ -4410,7 +4405,6 @@ static bool pci_quirk_intel_spt_pch_acs_match(struct pci_dev *dev)
    489 case 0xa110 ... 0xa11f: case 0xa167 ... 0xa16a: /* Sunrise Point */
    490 case 0xa290 ... 0xa29f: case 0xa2e7 ... 0xa2ee: /* Union Point */
    491 case 0x9d10 ... 0x9d1b: /* 7th & 8th Gen Mobile */
    492 - case 0xa32c ... 0xa343: /* 300 series */
    493 return true;
    494 }
    495
    496 diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c
    497 index 4eb8e1a472b2..e335b18da20f 100644
    498 --- a/drivers/platform/x86/alienware-wmi.c
    499 +++ b/drivers/platform/x86/alienware-wmi.c
    500 @@ -519,6 +519,7 @@ static acpi_status alienware_wmax_command(struct wmax_basic_args *in_args,
    501 if (obj && obj->type == ACPI_TYPE_INTEGER)
    502 *out_data = (u32) obj->integer.value;
    503 }
    504 + kfree(output.pointer);
    505 return status;
    506
    507 }
    508 diff --git a/drivers/rpmsg/rpmsg_core.c b/drivers/rpmsg/rpmsg_core.c
    509 index cec4c3223044..dffa3aab7178 100644
    510 --- a/drivers/rpmsg/rpmsg_core.c
    511 +++ b/drivers/rpmsg/rpmsg_core.c
    512 @@ -23,7 +23,6 @@
    513 #include <linux/module.h>
    514 #include <linux/rpmsg.h>
    515 #include <linux/of_device.h>
    516 -#include <linux/pm_domain.h>
    517 #include <linux/slab.h>
    518
    519 #include "rpmsg_internal.h"
    520 @@ -419,10 +418,6 @@ static int rpmsg_dev_probe(struct device *dev)
    521 struct rpmsg_endpoint *ept = NULL;
    522 int err;
    523
    524 - err = dev_pm_domain_attach(dev, true);
    525 - if (err)
    526 - goto out;
    527 -
    528 if (rpdrv->callback) {
    529 strncpy(chinfo.name, rpdev->id.name, RPMSG_NAME_SIZE);
    530 chinfo.src = rpdev->src;
    531 @@ -464,8 +459,6 @@ static int rpmsg_dev_remove(struct device *dev)
    532
    533 rpdrv->remove(rpdev);
    534
    535 - dev_pm_domain_detach(dev, true);
    536 -
    537 if (rpdev->ept)
    538 rpmsg_destroy_ept(rpdev->ept);
    539
    540 diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c
    541 index f85d30dc9187..670dbb7a8500 100644
    542 --- a/drivers/spi/spi.c
    543 +++ b/drivers/spi/spi.c
    544 @@ -2108,8 +2108,17 @@ int spi_register_controller(struct spi_controller *ctlr)
    545 */
    546 if (ctlr->num_chipselect == 0)
    547 return -EINVAL;
    548 - /* allocate dynamic bus number using Linux idr */
    549 - if ((ctlr->bus_num < 0) && ctlr->dev.of_node) {
    550 + if (ctlr->bus_num >= 0) {
    551 + /* devices with a fixed bus num must check-in with the num */
    552 + mutex_lock(&board_lock);
    553 + id = idr_alloc(&spi_master_idr, ctlr, ctlr->bus_num,
    554 + ctlr->bus_num + 1, GFP_KERNEL);
    555 + mutex_unlock(&board_lock);
    556 + if (WARN(id < 0, "couldn't get idr"))
    557 + return id == -ENOSPC ? -EBUSY : id;
    558 + ctlr->bus_num = id;
    559 + } else if (ctlr->dev.of_node) {
    560 + /* allocate dynamic bus number using Linux idr */
    561 id = of_alias_get_id(ctlr->dev.of_node, "spi");
    562 if (id >= 0) {
    563 ctlr->bus_num = id;
    564 diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
    565 index 9518ffd8b8ba..4e680d753941 100644
    566 --- a/drivers/target/iscsi/iscsi_target_auth.c
    567 +++ b/drivers/target/iscsi/iscsi_target_auth.c
    568 @@ -26,27 +26,6 @@
    569 #include "iscsi_target_nego.h"
    570 #include "iscsi_target_auth.h"
    571
    572 -static int chap_string_to_hex(unsigned char *dst, unsigned char *src, int len)
    573 -{
    574 - int j = DIV_ROUND_UP(len, 2), rc;
    575 -
    576 - rc = hex2bin(dst, src, j);
    577 - if (rc < 0)
    578 - pr_debug("CHAP string contains non hex digit symbols\n");
    579 -
    580 - dst[j] = '\0';
    581 - return j;
    582 -}
    583 -
    584 -static void chap_binaryhex_to_asciihex(char *dst, char *src, int src_len)
    585 -{
    586 - int i;
    587 -
    588 - for (i = 0; i < src_len; i++) {
    589 - sprintf(&dst[i*2], "%02x", (int) src[i] & 0xff);
    590 - }
    591 -}
    592 -
    593 static int chap_gen_challenge(
    594 struct iscsi_conn *conn,
    595 int caller,
    596 @@ -62,7 +41,7 @@ static int chap_gen_challenge(
    597 ret = get_random_bytes_wait(chap->challenge, CHAP_CHALLENGE_LENGTH);
    598 if (unlikely(ret))
    599 return ret;
    600 - chap_binaryhex_to_asciihex(challenge_asciihex, chap->challenge,
    601 + bin2hex(challenge_asciihex, chap->challenge,
    602 CHAP_CHALLENGE_LENGTH);
    603 /*
    604 * Set CHAP_C, and copy the generated challenge into c_str.
    605 @@ -248,9 +227,16 @@ static int chap_server_compute_md5(
    606 pr_err("Could not find CHAP_R.\n");
    607 goto out;
    608 }
    609 + if (strlen(chap_r) != MD5_SIGNATURE_SIZE * 2) {
    610 + pr_err("Malformed CHAP_R\n");
    611 + goto out;
    612 + }
    613 + if (hex2bin(client_digest, chap_r, MD5_SIGNATURE_SIZE) < 0) {
    614 + pr_err("Malformed CHAP_R\n");
    615 + goto out;
    616 + }
    617
    618 pr_debug("[server] Got CHAP_R=%s\n", chap_r);
    619 - chap_string_to_hex(client_digest, chap_r, strlen(chap_r));
    620
    621 tfm = crypto_alloc_shash("md5", 0, 0);
    622 if (IS_ERR(tfm)) {
    623 @@ -294,7 +280,7 @@ static int chap_server_compute_md5(
    624 goto out;
    625 }
    626
    627 - chap_binaryhex_to_asciihex(response, server_digest, MD5_SIGNATURE_SIZE);
    628 + bin2hex(response, server_digest, MD5_SIGNATURE_SIZE);
    629 pr_debug("[server] MD5 Server Digest: %s\n", response);
    630
    631 if (memcmp(server_digest, client_digest, MD5_SIGNATURE_SIZE) != 0) {
    632 @@ -349,9 +335,7 @@ static int chap_server_compute_md5(
    633 pr_err("Could not find CHAP_C.\n");
    634 goto out;
    635 }
    636 - pr_debug("[server] Got CHAP_C=%s\n", challenge);
    637 - challenge_len = chap_string_to_hex(challenge_binhex, challenge,
    638 - strlen(challenge));
    639 + challenge_len = DIV_ROUND_UP(strlen(challenge), 2);
    640 if (!challenge_len) {
    641 pr_err("Unable to convert incoming challenge\n");
    642 goto out;
    643 @@ -360,6 +344,11 @@ static int chap_server_compute_md5(
    644 pr_err("CHAP_C exceeds maximum binary size of 1024 bytes\n");
    645 goto out;
    646 }
    647 + if (hex2bin(challenge_binhex, challenge, challenge_len) < 0) {
    648 + pr_err("Malformed CHAP_C\n");
    649 + goto out;
    650 + }
    651 + pr_debug("[server] Got CHAP_C=%s\n", challenge);
    652 /*
    653 * During mutual authentication, the CHAP_C generated by the
    654 * initiator must not match the original CHAP_C generated by
    655 @@ -413,7 +402,7 @@ static int chap_server_compute_md5(
    656 /*
    657 * Convert response from binary hex to ascii hext.
    658 */
    659 - chap_binaryhex_to_asciihex(response, digest, MD5_SIGNATURE_SIZE);
    660 + bin2hex(response, digest, MD5_SIGNATURE_SIZE);
    661 *nr_out_len += sprintf(nr_out_ptr + *nr_out_len, "CHAP_R=0x%s",
    662 response);
    663 *nr_out_len += 1;
    664 diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c
    665 index 2d2b420598b2..7b34b0ddbf0e 100644
    666 --- a/drivers/tty/vt/vt_ioctl.c
    667 +++ b/drivers/tty/vt/vt_ioctl.c
    668 @@ -32,6 +32,8 @@
    669 #include <asm/io.h>
    670 #include <linux/uaccess.h>
    671
    672 +#include <linux/nospec.h>
    673 +
    674 #include <linux/kbd_kern.h>
    675 #include <linux/vt_kern.h>
    676 #include <linux/kbd_diacr.h>
    677 @@ -700,6 +702,8 @@ int vt_ioctl(struct tty_struct *tty,
    678 if (vsa.console == 0 || vsa.console > MAX_NR_CONSOLES)
    679 ret = -ENXIO;
    680 else {
    681 + vsa.console = array_index_nospec(vsa.console,
    682 + MAX_NR_CONSOLES + 1);
    683 vsa.console--;
    684 console_lock();
    685 ret = vc_allocate(vsa.console);
    686 diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c
    687 index d5babc9f222b..dc676714454a 100644
    688 --- a/fs/ext4/dir.c
    689 +++ b/fs/ext4/dir.c
    690 @@ -75,7 +75,7 @@ int __ext4_check_dir_entry(const char *function, unsigned int line,
    691 else if (unlikely(rlen < EXT4_DIR_REC_LEN(de->name_len)))
    692 error_msg = "rec_len is too small for name_len";
    693 else if (unlikely(((char *) de - buf) + rlen > size))
    694 - error_msg = "directory entry across range";
    695 + error_msg = "directory entry overrun";
    696 else if (unlikely(le32_to_cpu(de->inode) >
    697 le32_to_cpu(EXT4_SB(dir->i_sb)->s_es->s_inodes_count)))
    698 error_msg = "inode out of bounds";
    699 @@ -84,18 +84,16 @@ int __ext4_check_dir_entry(const char *function, unsigned int line,
    700
    701 if (filp)
    702 ext4_error_file(filp, function, line, bh->b_blocknr,
    703 - "bad entry in directory: %s - offset=%u(%u), "
    704 - "inode=%u, rec_len=%d, name_len=%d",
    705 - error_msg, (unsigned) (offset % size),
    706 - offset, le32_to_cpu(de->inode),
    707 - rlen, de->name_len);
    708 + "bad entry in directory: %s - offset=%u, "
    709 + "inode=%u, rec_len=%d, name_len=%d, size=%d",
    710 + error_msg, offset, le32_to_cpu(de->inode),
    711 + rlen, de->name_len, size);
    712 else
    713 ext4_error_inode(dir, function, line, bh->b_blocknr,
    714 - "bad entry in directory: %s - offset=%u(%u), "
    715 - "inode=%u, rec_len=%d, name_len=%d",
    716 - error_msg, (unsigned) (offset % size),
    717 - offset, le32_to_cpu(de->inode),
    718 - rlen, de->name_len);
    719 + "bad entry in directory: %s - offset=%u, "
    720 + "inode=%u, rec_len=%d, name_len=%d, size=%d",
    721 + error_msg, offset, le32_to_cpu(de->inode),
    722 + rlen, de->name_len, size);
    723
    724 return 1;
    725 }
    726 diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
    727 index 0abb30d19fa1..c96778c39885 100644
    728 --- a/fs/ext4/ext4.h
    729 +++ b/fs/ext4/ext4.h
    730 @@ -714,6 +714,9 @@ struct fsxattr {
    731 /* Max physical block we can address w/o extents */
    732 #define EXT4_MAX_BLOCK_FILE_PHYS 0xFFFFFFFF
    733
    734 +/* Max logical block we can support */
    735 +#define EXT4_MAX_LOGICAL_BLOCK 0xFFFFFFFF
    736 +
    737 /*
    738 * Structure of an inode on the disk
    739 */
    740 diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
    741 index b549cfd2d7d3..4e1d62ba0703 100644
    742 --- a/fs/ext4/inline.c
    743 +++ b/fs/ext4/inline.c
    744 @@ -1759,6 +1759,7 @@ bool empty_inline_dir(struct inode *dir, int *has_inline_data)
    745 {
    746 int err, inline_size;
    747 struct ext4_iloc iloc;
    748 + size_t inline_len;
    749 void *inline_pos;
    750 unsigned int offset;
    751 struct ext4_dir_entry_2 *de;
    752 @@ -1786,8 +1787,9 @@ bool empty_inline_dir(struct inode *dir, int *has_inline_data)
    753 goto out;
    754 }
    755
    756 + inline_len = ext4_get_inline_size(dir);
    757 offset = EXT4_INLINE_DOTDOT_SIZE;
    758 - while (offset < dir->i_size) {
    759 + while (offset < inline_len) {
    760 de = ext4_get_inline_entry(dir, &iloc, offset,
    761 &inline_pos, &inline_size);
    762 if (ext4_check_dir_entry(dir, NULL, de,
    763 diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
    764 index f9baa59de0e2..9808df52ceca 100644
    765 --- a/fs/ext4/inode.c
    766 +++ b/fs/ext4/inode.c
    767 @@ -3407,11 +3407,16 @@ static int ext4_iomap_begin(struct inode *inode, loff_t offset, loff_t length,
    768 {
    769 struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb);
    770 unsigned int blkbits = inode->i_blkbits;
    771 - unsigned long first_block = offset >> blkbits;
    772 - unsigned long last_block = (offset + length - 1) >> blkbits;
    773 + unsigned long first_block, last_block;
    774 struct ext4_map_blocks map;
    775 int ret;
    776
    777 + if ((offset >> blkbits) > EXT4_MAX_LOGICAL_BLOCK)
    778 + return -EINVAL;
    779 + first_block = offset >> blkbits;
    780 + last_block = min_t(loff_t, (offset + length - 1) >> blkbits,
    781 + EXT4_MAX_LOGICAL_BLOCK);
    782 +
    783 if (WARN_ON_ONCE(ext4_has_inline_data(inode)))
    784 return -ERANGE;
    785
    786 diff --git a/fs/ext4/mmp.c b/fs/ext4/mmp.c
    787 index 638ad4743477..38e6a846aac1 100644
    788 --- a/fs/ext4/mmp.c
    789 +++ b/fs/ext4/mmp.c
    790 @@ -49,7 +49,6 @@ static int write_mmp_block(struct super_block *sb, struct buffer_head *bh)
    791 */
    792 sb_start_write(sb);
    793 ext4_mmp_csum_set(sb, mmp);
    794 - mark_buffer_dirty(bh);
    795 lock_buffer(bh);
    796 bh->b_end_io = end_buffer_write_sync;
    797 get_bh(bh);
    798 diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
    799 index 1db39e12e02b..eb0d8ee39827 100644
    800 --- a/fs/ext4/namei.c
    801 +++ b/fs/ext4/namei.c
    802 @@ -3514,6 +3514,12 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
    803 int credits;
    804 u8 old_file_type;
    805
    806 + if (new.inode && new.inode->i_nlink == 0) {
    807 + EXT4_ERROR_INODE(new.inode,
    808 + "target of rename is already freed");
    809 + return -EFSCORRUPTED;
    810 + }
    811 +
    812 if ((ext4_test_inode_flag(new_dir, EXT4_INODE_PROJINHERIT)) &&
    813 (!projid_eq(EXT4_I(new_dir)->i_projid,
    814 EXT4_I(old_dentry->d_inode)->i_projid)))
    815 diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
    816 index 823c0b82dfeb..e344e606c054 100644
    817 --- a/fs/ext4/resize.c
    818 +++ b/fs/ext4/resize.c
    819 @@ -19,6 +19,7 @@
    820
    821 int ext4_resize_begin(struct super_block *sb)
    822 {
    823 + struct ext4_sb_info *sbi = EXT4_SB(sb);
    824 int ret = 0;
    825
    826 if (!capable(CAP_SYS_RESOURCE))
    827 @@ -29,7 +30,7 @@ int ext4_resize_begin(struct super_block *sb)
    828 * because the user tools have no way of handling this. Probably a
    829 * bad time to do it anyways.
    830 */
    831 - if (EXT4_SB(sb)->s_sbh->b_blocknr !=
    832 + if (EXT4_B2C(sbi, sbi->s_sbh->b_blocknr) !=
    833 le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block)) {
    834 ext4_warning(sb, "won't resize using backup superblock at %llu",
    835 (unsigned long long)EXT4_SB(sb)->s_sbh->b_blocknr);
    836 @@ -1956,6 +1957,26 @@ retry:
    837 }
    838 }
    839
    840 + /*
    841 + * Make sure the last group has enough space so that it's
    842 + * guaranteed to have enough space for all metadata blocks
    843 + * that it might need to hold. (We might not need to store
    844 + * the inode table blocks in the last block group, but there
    845 + * will be cases where this might be needed.)
    846 + */
    847 + if ((ext4_group_first_block_no(sb, n_group) +
    848 + ext4_group_overhead_blocks(sb, n_group) + 2 +
    849 + sbi->s_itb_per_group + sbi->s_cluster_ratio) >= n_blocks_count) {
    850 + n_blocks_count = ext4_group_first_block_no(sb, n_group);
    851 + n_group--;
    852 + n_blocks_count_retry = 0;
    853 + if (resize_inode) {
    854 + iput(resize_inode);
    855 + resize_inode = NULL;
    856 + }
    857 + goto retry;
    858 + }
    859 +
    860 /* extend the last group */
    861 if (n_group == o_group)
    862 add = n_blocks_count - o_blocks_count;
    863 diff --git a/fs/ext4/super.c b/fs/ext4/super.c
    864 index b4fb085261fd..9dbd27f7b778 100644
    865 --- a/fs/ext4/super.c
    866 +++ b/fs/ext4/super.c
    867 @@ -2085,6 +2085,8 @@ static int _ext4_show_options(struct seq_file *seq, struct super_block *sb,
    868 SEQ_OPTS_PRINT("max_dir_size_kb=%u", sbi->s_max_dir_size_kb);
    869 if (test_opt(sb, DATA_ERR_ABORT))
    870 SEQ_OPTS_PUTS("data_err=abort");
    871 + if (DUMMY_ENCRYPTION_ENABLED(sbi))
    872 + SEQ_OPTS_PUTS("test_dummy_encryption");
    873
    874 ext4_show_quota_options(seq, sb);
    875 return 0;
    876 @@ -4311,11 +4313,13 @@ no_journal:
    877 block = ext4_count_free_clusters(sb);
    878 ext4_free_blocks_count_set(sbi->s_es,
    879 EXT4_C2B(sbi, block));
    880 + ext4_superblock_csum_set(sb);
    881 err = percpu_counter_init(&sbi->s_freeclusters_counter, block,
    882 GFP_KERNEL);
    883 if (!err) {
    884 unsigned long freei = ext4_count_free_inodes(sb);
    885 sbi->s_es->s_free_inodes_count = cpu_to_le32(freei);
    886 + ext4_superblock_csum_set(sb);
    887 err = percpu_counter_init(&sbi->s_freeinodes_counter, freei,
    888 GFP_KERNEL);
    889 }
    890 diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c
    891 index d9ebe11c8990..1d098c3c00e0 100644
    892 --- a/fs/ocfs2/buffer_head_io.c
    893 +++ b/fs/ocfs2/buffer_head_io.c
    894 @@ -342,6 +342,7 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr,
    895 * for this bh as it's not marked locally
    896 * uptodate. */
    897 status = -EIO;
    898 + clear_buffer_needs_validate(bh);
    899 put_bh(bh);
    900 bhs[i] = NULL;
    901 continue;
    902 diff --git a/fs/ubifs/xattr.c b/fs/ubifs/xattr.c
    903 index d47f16c0d582..c13eae819cbc 100644
    904 --- a/fs/ubifs/xattr.c
    905 +++ b/fs/ubifs/xattr.c
    906 @@ -152,12 +152,6 @@ static int create_xattr(struct ubifs_info *c, struct inode *host,
    907 ui->data_len = size;
    908
    909 mutex_lock(&host_ui->ui_mutex);
    910 -
    911 - if (!host->i_nlink) {
    912 - err = -ENOENT;
    913 - goto out_noent;
    914 - }
    915 -
    916 host->i_ctime = current_time(host);
    917 host_ui->xattr_cnt += 1;
    918 host_ui->xattr_size += CALC_DENT_SIZE(fname_len(nm));
    919 @@ -189,7 +183,6 @@ out_cancel:
    920 host_ui->xattr_size -= CALC_XATTR_BYTES(size);
    921 host_ui->xattr_names -= fname_len(nm);
    922 host_ui->flags &= ~UBIFS_CRYPT_FL;
    923 -out_noent:
    924 mutex_unlock(&host_ui->ui_mutex);
    925 out_free:
    926 make_bad_inode(inode);
    927 @@ -241,12 +234,6 @@ static int change_xattr(struct ubifs_info *c, struct inode *host,
    928 mutex_unlock(&ui->ui_mutex);
    929
    930 mutex_lock(&host_ui->ui_mutex);
    931 -
    932 - if (!host->i_nlink) {
    933 - err = -ENOENT;
    934 - goto out_noent;
    935 - }
    936 -
    937 host->i_ctime = current_time(host);
    938 host_ui->xattr_size -= CALC_XATTR_BYTES(old_size);
    939 host_ui->xattr_size += CALC_XATTR_BYTES(size);
    940 @@ -268,7 +255,6 @@ static int change_xattr(struct ubifs_info *c, struct inode *host,
    941 out_cancel:
    942 host_ui->xattr_size -= CALC_XATTR_BYTES(size);
    943 host_ui->xattr_size += CALC_XATTR_BYTES(old_size);
    944 -out_noent:
    945 mutex_unlock(&host_ui->ui_mutex);
    946 make_bad_inode(inode);
    947 out_free:
    948 @@ -497,12 +483,6 @@ static int remove_xattr(struct ubifs_info *c, struct inode *host,
    949 return err;
    950
    951 mutex_lock(&host_ui->ui_mutex);
    952 -
    953 - if (!host->i_nlink) {
    954 - err = -ENOENT;
    955 - goto out_noent;
    956 - }
    957 -
    958 host->i_ctime = current_time(host);
    959 host_ui->xattr_cnt -= 1;
    960 host_ui->xattr_size -= CALC_DENT_SIZE(fname_len(nm));
    961 @@ -522,7 +502,6 @@ out_cancel:
    962 host_ui->xattr_size += CALC_DENT_SIZE(fname_len(nm));
    963 host_ui->xattr_size += CALC_XATTR_BYTES(ui->data_len);
    964 host_ui->xattr_names += fname_len(nm);
    965 -out_noent:
    966 mutex_unlock(&host_ui->ui_mutex);
    967 ubifs_release_budget(c, &req);
    968 make_bad_inode(inode);
    969 @@ -562,9 +541,6 @@ static int ubifs_xattr_remove(struct inode *host, const char *name)
    970
    971 ubifs_assert(inode_is_locked(host));
    972
    973 - if (!host->i_nlink)
    974 - return -ENOENT;
    975 -
    976 if (fname_len(&nm) > UBIFS_MAX_NLEN)
    977 return -ENAMETOOLONG;
    978
    979 diff --git a/include/net/nfc/hci.h b/include/net/nfc/hci.h
    980 index 316694dafa5b..008f466d1da7 100644
    981 --- a/include/net/nfc/hci.h
    982 +++ b/include/net/nfc/hci.h
    983 @@ -87,7 +87,7 @@ struct nfc_hci_pipe {
    984 * According to specification 102 622 chapter 4.4 Pipes,
    985 * the pipe identifier is 7 bits long.
    986 */
    987 -#define NFC_HCI_MAX_PIPES 127
    988 +#define NFC_HCI_MAX_PIPES 128
    989 struct nfc_hci_init_data {
    990 u8 gate_count;
    991 struct nfc_hci_gate gates[NFC_HCI_MAX_CUSTOM_GATES];
    992 diff --git a/include/net/tls.h b/include/net/tls.h
    993 index 48940a883d9a..86ed3dd80fe7 100644
    994 --- a/include/net/tls.h
    995 +++ b/include/net/tls.h
    996 @@ -79,11 +79,13 @@ enum {
    997 TLS_PENDING_CLOSED_RECORD
    998 };
    999
    1000 +union tls_crypto_context {
    1001 + struct tls_crypto_info info;
    1002 + struct tls12_crypto_info_aes_gcm_128 aes_gcm_128;
    1003 +};
    1004 +
    1005 struct tls_context {
    1006 - union {
    1007 - struct tls_crypto_info crypto_send;
    1008 - struct tls12_crypto_info_aes_gcm_128 crypto_send_aes_gcm_128;
    1009 - };
    1010 + union tls_crypto_context crypto_send;
    1011
    1012 void *priv_ctx;
    1013
    1014 @@ -208,8 +210,8 @@ static inline void tls_fill_prepend(struct tls_context *ctx,
    1015 * size KTLS_DTLS_HEADER_SIZE + KTLS_DTLS_NONCE_EXPLICIT_SIZE
    1016 */
    1017 buf[0] = record_type;
    1018 - buf[1] = TLS_VERSION_MINOR(ctx->crypto_send.version);
    1019 - buf[2] = TLS_VERSION_MAJOR(ctx->crypto_send.version);
    1020 + buf[1] = TLS_VERSION_MINOR(ctx->crypto_send.info.version);
    1021 + buf[2] = TLS_VERSION_MAJOR(ctx->crypto_send.info.version);
    1022 /* we can use IV for nonce explicit according to spec */
    1023 buf[3] = pkt_len >> 8;
    1024 buf[4] = pkt_len & 0xFF;
    1025 diff --git a/include/uapi/linux/keyctl.h b/include/uapi/linux/keyctl.h
    1026 index 910cc4334b21..7b8c9e19bad1 100644
    1027 --- a/include/uapi/linux/keyctl.h
    1028 +++ b/include/uapi/linux/keyctl.h
    1029 @@ -65,7 +65,7 @@
    1030
    1031 /* keyctl structures */
    1032 struct keyctl_dh_params {
    1033 - __s32 dh_private;
    1034 + __s32 private;
    1035 __s32 prime;
    1036 __s32 base;
    1037 };
    1038 diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
    1039 index a5e20ceb0b5a..b2d699f28304 100644
    1040 --- a/kernel/sched/fair.c
    1041 +++ b/kernel/sched/fair.c
    1042 @@ -9137,7 +9137,8 @@ static inline bool vruntime_normalized(struct task_struct *p)
    1043 * - A task which has been woken up by try_to_wake_up() and
    1044 * waiting for actually being woken up by sched_ttwu_pending().
    1045 */
    1046 - if (!se->sum_exec_runtime || p->state == TASK_WAKING)
    1047 + if (!se->sum_exec_runtime ||
    1048 + (p->state == TASK_WAKING && p->sched_remote_wakeup))
    1049 return true;
    1050
    1051 return false;
    1052 diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
    1053 index ea3c062e7e1c..a8fa0a896b78 100644
    1054 --- a/kernel/time/tick-sched.c
    1055 +++ b/kernel/time/tick-sched.c
    1056 @@ -908,7 +908,7 @@ static bool can_stop_idle_tick(int cpu, struct tick_sched *ts)
    1057 if (unlikely(local_softirq_pending() && cpu_online(cpu))) {
    1058 static int ratelimit;
    1059
    1060 - if (ratelimit < 10 &&
    1061 + if (ratelimit < 10 && !in_softirq() &&
    1062 (local_softirq_pending() & SOFTIRQ_STOP_IDLE_MASK)) {
    1063 pr_warn("NOHZ: local_softirq_pending %02x\n",
    1064 (unsigned int) local_softirq_pending());
    1065 diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
    1066 index fd7809004297..a1d5e0949dcf 100644
    1067 --- a/kernel/trace/ring_buffer.c
    1068 +++ b/kernel/trace/ring_buffer.c
    1069 @@ -1479,6 +1479,8 @@ rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned long nr_pages)
    1070 tmp_iter_page = first_page;
    1071
    1072 do {
    1073 + cond_resched();
    1074 +
    1075 to_remove_page = tmp_iter_page;
    1076 rb_inc_page(cpu_buffer, &tmp_iter_page);
    1077
    1078 diff --git a/mm/shmem.c b/mm/shmem.c
    1079 index f383298b7280..ea786a504e1b 100644
    1080 --- a/mm/shmem.c
    1081 +++ b/mm/shmem.c
    1082 @@ -2207,6 +2207,8 @@ static struct inode *shmem_get_inode(struct super_block *sb, const struct inode
    1083 mpol_shared_policy_init(&info->policy, NULL);
    1084 break;
    1085 }
    1086 +
    1087 + lockdep_annotate_inode_mutex_key(inode);
    1088 } else
    1089 shmem_free_inode(sb);
    1090 return inode;
    1091 diff --git a/net/core/neighbour.c b/net/core/neighbour.c
    1092 index 514d697d4691..dcb89cbc2730 100644
    1093 --- a/net/core/neighbour.c
    1094 +++ b/net/core/neighbour.c
    1095 @@ -1174,6 +1174,12 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
    1096 lladdr = neigh->ha;
    1097 }
    1098
    1099 + /* Update confirmed timestamp for neighbour entry after we
    1100 + * received ARP packet even if it doesn't change IP to MAC binding.
    1101 + */
    1102 + if (new & NUD_CONNECTED)
    1103 + neigh->confirmed = jiffies;
    1104 +
    1105 /* If entry was valid and address is not changed,
    1106 do not change entry state, if new one is STALE.
    1107 */
    1108 @@ -1195,15 +1201,12 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
    1109 }
    1110 }
    1111
    1112 - /* Update timestamps only once we know we will make a change to the
    1113 + /* Update timestamp only once we know we will make a change to the
    1114 * neighbour entry. Otherwise we risk to move the locktime window with
    1115 * noop updates and ignore relevant ARP updates.
    1116 */
    1117 - if (new != old || lladdr != neigh->ha) {
    1118 - if (new & NUD_CONNECTED)
    1119 - neigh->confirmed = jiffies;
    1120 + if (new != old || lladdr != neigh->ha)
    1121 neigh->updated = jiffies;
    1122 - }
    1123
    1124 if (new != old) {
    1125 neigh_del_timer(neigh);
    1126 diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
    1127 index b9d9a2b8792c..f31c09873d0f 100644
    1128 --- a/net/ipv4/af_inet.c
    1129 +++ b/net/ipv4/af_inet.c
    1130 @@ -1307,6 +1307,7 @@ struct sk_buff *inet_gso_segment(struct sk_buff *skb,
    1131 if (encap)
    1132 skb_reset_inner_headers(skb);
    1133 skb->network_header = (u8 *)iph - skb->head;
    1134 + skb_reset_mac_len(skb);
    1135 } while ((skb = skb->next));
    1136
    1137 out:
    1138 diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
    1139 index 5752bf7593dc..3de413867991 100644
    1140 --- a/net/ipv4/udp.c
    1141 +++ b/net/ipv4/udp.c
    1142 @@ -2049,6 +2049,28 @@ static inline int udp4_csum_init(struct sk_buff *skb, struct udphdr *uh,
    1143 inet_compute_pseudo);
    1144 }
    1145
    1146 +/* wrapper for udp_queue_rcv_skb tacking care of csum conversion and
    1147 + * return code conversion for ip layer consumption
    1148 + */
    1149 +static int udp_unicast_rcv_skb(struct sock *sk, struct sk_buff *skb,
    1150 + struct udphdr *uh)
    1151 +{
    1152 + int ret;
    1153 +
    1154 + if (inet_get_convert_csum(sk) && uh->check && !IS_UDPLITE(sk))
    1155 + skb_checksum_try_convert(skb, IPPROTO_UDP, uh->check,
    1156 + inet_compute_pseudo);
    1157 +
    1158 + ret = udp_queue_rcv_skb(sk, skb);
    1159 +
    1160 + /* a return value > 0 means to resubmit the input, but
    1161 + * it wants the return to be -protocol, or 0
    1162 + */
    1163 + if (ret > 0)
    1164 + return -ret;
    1165 + return 0;
    1166 +}
    1167 +
    1168 /*
    1169 * All we need to do is get the socket, and then do a checksum.
    1170 */
    1171 @@ -2095,14 +2117,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
    1172 if (unlikely(sk->sk_rx_dst != dst))
    1173 udp_sk_rx_dst_set(sk, dst);
    1174
    1175 - ret = udp_queue_rcv_skb(sk, skb);
    1176 + ret = udp_unicast_rcv_skb(sk, skb, uh);
    1177 sock_put(sk);
    1178 - /* a return value > 0 means to resubmit the input, but
    1179 - * it wants the return to be -protocol, or 0
    1180 - */
    1181 - if (ret > 0)
    1182 - return -ret;
    1183 - return 0;
    1184 + return ret;
    1185 }
    1186
    1187 if (rt->rt_flags & (RTCF_BROADCAST|RTCF_MULTICAST))
    1188 @@ -2110,22 +2127,8 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
    1189 saddr, daddr, udptable, proto);
    1190
    1191 sk = __udp4_lib_lookup_skb(skb, uh->source, uh->dest, udptable);
    1192 - if (sk) {
    1193 - int ret;
    1194 -
    1195 - if (inet_get_convert_csum(sk) && uh->check && !IS_UDPLITE(sk))
    1196 - skb_checksum_try_convert(skb, IPPROTO_UDP, uh->check,
    1197 - inet_compute_pseudo);
    1198 -
    1199 - ret = udp_queue_rcv_skb(sk, skb);
    1200 -
    1201 - /* a return value > 0 means to resubmit the input, but
    1202 - * it wants the return to be -protocol, or 0
    1203 - */
    1204 - if (ret > 0)
    1205 - return -ret;
    1206 - return 0;
    1207 - }
    1208 + if (sk)
    1209 + return udp_unicast_rcv_skb(sk, skb, uh);
    1210
    1211 if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
    1212 goto drop;
    1213 diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
    1214 index 4a87f9428ca5..e3698b6d8231 100644
    1215 --- a/net/ipv6/ip6_offload.c
    1216 +++ b/net/ipv6/ip6_offload.c
    1217 @@ -113,6 +113,7 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
    1218 payload_len = skb->len - nhoff - sizeof(*ipv6h);
    1219 ipv6h->payload_len = htons(payload_len);
    1220 skb->network_header = (u8 *)ipv6h - skb->head;
    1221 + skb_reset_mac_len(skb);
    1222
    1223 if (udpfrag) {
    1224 int err = ip6_find_1stfragopt(skb, &prevhdr);
    1225 diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
    1226 index 1da021527fcd..9ab1e0fcbc13 100644
    1227 --- a/net/ipv6/ip6_output.c
    1228 +++ b/net/ipv6/ip6_output.c
    1229 @@ -219,12 +219,10 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
    1230 kfree_skb(skb);
    1231 return -ENOBUFS;
    1232 }
    1233 + if (skb->sk)
    1234 + skb_set_owner_w(skb2, skb->sk);
    1235 consume_skb(skb);
    1236 skb = skb2;
    1237 - /* skb_set_owner_w() changes sk->sk_wmem_alloc atomically,
    1238 - * it is safe to call in our context (socket lock not held)
    1239 - */
    1240 - skb_set_owner_w(skb, (struct sock *)sk);
    1241 }
    1242 if (opt->opt_flen)
    1243 ipv6_push_frag_opts(skb, opt, &proto);
    1244 diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
    1245 index 330d5ea8451b..5cee941ab0a9 100644
    1246 --- a/net/ipv6/udp.c
    1247 +++ b/net/ipv6/udp.c
    1248 @@ -780,6 +780,28 @@ static void udp6_sk_rx_dst_set(struct sock *sk, struct dst_entry *dst)
    1249 }
    1250 }
    1251
    1252 +/* wrapper for udp_queue_rcv_skb tacking care of csum conversion and
    1253 + * return code conversion for ip layer consumption
    1254 + */
    1255 +static int udp6_unicast_rcv_skb(struct sock *sk, struct sk_buff *skb,
    1256 + struct udphdr *uh)
    1257 +{
    1258 + int ret;
    1259 +
    1260 + if (inet_get_convert_csum(sk) && uh->check && !IS_UDPLITE(sk))
    1261 + skb_checksum_try_convert(skb, IPPROTO_UDP, uh->check,
    1262 + ip6_compute_pseudo);
    1263 +
    1264 + ret = udpv6_queue_rcv_skb(sk, skb);
    1265 +
    1266 + /* a return value > 0 means to resubmit the input, but
    1267 + * it wants the return to be -protocol, or 0
    1268 + */
    1269 + if (ret > 0)
    1270 + return -ret;
    1271 + return 0;
    1272 +}
    1273 +
    1274 int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
    1275 int proto)
    1276 {
    1277 @@ -831,13 +853,14 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
    1278 if (unlikely(sk->sk_rx_dst != dst))
    1279 udp6_sk_rx_dst_set(sk, dst);
    1280
    1281 - ret = udpv6_queue_rcv_skb(sk, skb);
    1282 - sock_put(sk);
    1283 + if (!uh->check && !udp_sk(sk)->no_check6_rx) {
    1284 + sock_put(sk);
    1285 + goto report_csum_error;
    1286 + }
    1287
    1288 - /* a return value > 0 means to resubmit the input */
    1289 - if (ret > 0)
    1290 - return ret;
    1291 - return 0;
    1292 + ret = udp6_unicast_rcv_skb(sk, skb, uh);
    1293 + sock_put(sk);
    1294 + return ret;
    1295 }
    1296
    1297 /*
    1298 @@ -850,30 +873,13 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
    1299 /* Unicast */
    1300 sk = __udp6_lib_lookup_skb(skb, uh->source, uh->dest, udptable);
    1301 if (sk) {
    1302 - int ret;
    1303 -
    1304 - if (!uh->check && !udp_sk(sk)->no_check6_rx) {
    1305 - udp6_csum_zero_error(skb);
    1306 - goto csum_error;
    1307 - }
    1308 -
    1309 - if (inet_get_convert_csum(sk) && uh->check && !IS_UDPLITE(sk))
    1310 - skb_checksum_try_convert(skb, IPPROTO_UDP, uh->check,
    1311 - ip6_compute_pseudo);
    1312 -
    1313 - ret = udpv6_queue_rcv_skb(sk, skb);
    1314 -
    1315 - /* a return value > 0 means to resubmit the input */
    1316 - if (ret > 0)
    1317 - return ret;
    1318 -
    1319 - return 0;
    1320 + if (!uh->check && !udp_sk(sk)->no_check6_rx)
    1321 + goto report_csum_error;
    1322 + return udp6_unicast_rcv_skb(sk, skb, uh);
    1323 }
    1324
    1325 - if (!uh->check) {
    1326 - udp6_csum_zero_error(skb);
    1327 - goto csum_error;
    1328 - }
    1329 + if (!uh->check)
    1330 + goto report_csum_error;
    1331
    1332 if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb))
    1333 goto discard;
    1334 @@ -894,6 +900,9 @@ short_packet:
    1335 ulen, skb->len,
    1336 daddr, ntohs(uh->dest));
    1337 goto discard;
    1338 +
    1339 +report_csum_error:
    1340 + udp6_csum_zero_error(skb);
    1341 csum_error:
    1342 __UDP6_INC_STATS(net, UDP_MIB_CSUMERRORS, proto == IPPROTO_UDPLITE);
    1343 discard:
    1344 diff --git a/net/nfc/hci/core.c b/net/nfc/hci/core.c
    1345 index b740fef0acc5..6bf14f4f4b42 100644
    1346 --- a/net/nfc/hci/core.c
    1347 +++ b/net/nfc/hci/core.c
    1348 @@ -209,6 +209,11 @@ void nfc_hci_cmd_received(struct nfc_hci_dev *hdev, u8 pipe, u8 cmd,
    1349 }
    1350 create_info = (struct hci_create_pipe_resp *)skb->data;
    1351
    1352 + if (create_info->pipe >= NFC_HCI_MAX_PIPES) {
    1353 + status = NFC_HCI_ANY_E_NOK;
    1354 + goto exit;
    1355 + }
    1356 +
    1357 /* Save the new created pipe and bind with local gate,
    1358 * the description for skb->data[3] is destination gate id
    1359 * but since we received this cmd from host controller, we
    1360 @@ -232,6 +237,11 @@ void nfc_hci_cmd_received(struct nfc_hci_dev *hdev, u8 pipe, u8 cmd,
    1361 }
    1362 delete_info = (struct hci_delete_pipe_noti *)skb->data;
    1363
    1364 + if (delete_info->pipe >= NFC_HCI_MAX_PIPES) {
    1365 + status = NFC_HCI_ANY_E_NOK;
    1366 + goto exit;
    1367 + }
    1368 +
    1369 hdev->pipes[delete_info->pipe].gate = NFC_HCI_INVALID_GATE;
    1370 hdev->pipes[delete_info->pipe].dest_host = NFC_HCI_INVALID_HOST;
    1371 break;
    1372 diff --git a/net/sched/act_sample.c b/net/sched/act_sample.c
    1373 index 53752b9327d0..a859b55d7899 100644
    1374 --- a/net/sched/act_sample.c
    1375 +++ b/net/sched/act_sample.c
    1376 @@ -64,7 +64,7 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla,
    1377
    1378 if (!exists) {
    1379 ret = tcf_idr_create(tn, parm->index, est, a,
    1380 - &act_sample_ops, bind, false);
    1381 + &act_sample_ops, bind, true);
    1382 if (ret)
    1383 return ret;
    1384 ret = ACT_P_CREATED;
    1385 diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c
    1386 index 055b9992d8c7..efa2cdba99d3 100644
    1387 --- a/net/tls/tls_main.c
    1388 +++ b/net/tls/tls_main.c
    1389 @@ -218,6 +218,15 @@ static void tls_write_space(struct sock *sk)
    1390 ctx->sk_write_space(sk);
    1391 }
    1392
    1393 +static void tls_ctx_free(struct tls_context *ctx)
    1394 +{
    1395 + if (!ctx)
    1396 + return;
    1397 +
    1398 + memzero_explicit(&ctx->crypto_send, sizeof(ctx->crypto_send));
    1399 + kfree(ctx);
    1400 +}
    1401 +
    1402 static void tls_sk_proto_close(struct sock *sk, long timeout)
    1403 {
    1404 struct tls_context *ctx = tls_get_ctx(sk);
    1405 @@ -246,7 +255,7 @@ static void tls_sk_proto_close(struct sock *sk, long timeout)
    1406 kfree(ctx->iv);
    1407
    1408 sk_proto_close = ctx->sk_proto_close;
    1409 - kfree(ctx);
    1410 + tls_ctx_free(ctx);
    1411
    1412 release_sock(sk);
    1413 sk_proto_close(sk, timeout);
    1414 @@ -274,7 +283,7 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval,
    1415 }
    1416
    1417 /* get user crypto info */
    1418 - crypto_info = &ctx->crypto_send;
    1419 + crypto_info = &ctx->crypto_send.info;
    1420
    1421 if (!TLS_CRYPTO_INFO_READY(crypto_info)) {
    1422 rc = -EBUSY;
    1423 @@ -371,7 +380,7 @@ static int do_tls_setsockopt_tx(struct sock *sk, char __user *optval,
    1424 }
    1425
    1426 /* get user crypto info */
    1427 - crypto_info = &ctx->crypto_send;
    1428 + crypto_info = &ctx->crypto_send.info;
    1429
    1430 /* Currently we don't support set crypto info more than one time */
    1431 if (TLS_CRYPTO_INFO_READY(crypto_info)) {
    1432 @@ -416,7 +425,7 @@ static int do_tls_setsockopt_tx(struct sock *sk, char __user *optval,
    1433 goto out;
    1434
    1435 err_crypto_info:
    1436 - memset(crypto_info, 0, sizeof(*crypto_info));
    1437 + memzero_explicit(crypto_info, sizeof(union tls_crypto_context));
    1438 out:
    1439 return rc;
    1440 }
    1441 diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c
    1442 index b81aa6d7dc45..6ae9ca567d6c 100644
    1443 --- a/net/tls/tls_sw.c
    1444 +++ b/net/tls/tls_sw.c
    1445 @@ -661,7 +661,6 @@ static void tls_sw_free_resources(struct sock *sk)
    1446
    1447 int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx)
    1448 {
    1449 - char keyval[TLS_CIPHER_AES_GCM_128_KEY_SIZE];
    1450 struct tls_crypto_info *crypto_info;
    1451 struct tls12_crypto_info_aes_gcm_128 *gcm_128_info;
    1452 struct tls_sw_context *sw_ctx;
    1453 @@ -688,7 +687,7 @@ int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx)
    1454 ctx->priv_ctx = (struct tls_offload_context *)sw_ctx;
    1455 ctx->free_resources = tls_sw_free_resources;
    1456
    1457 - crypto_info = &ctx->crypto_send;
    1458 + crypto_info = &ctx->crypto_send.info;
    1459 switch (crypto_info->cipher_type) {
    1460 case TLS_CIPHER_AES_GCM_128: {
    1461 nonce_size = TLS_CIPHER_AES_GCM_128_IV_SIZE;
    1462 @@ -753,9 +752,7 @@ int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx)
    1463
    1464 ctx->push_pending_record = tls_sw_push_pending_record;
    1465
    1466 - memcpy(keyval, gcm_128_info->key, TLS_CIPHER_AES_GCM_128_KEY_SIZE);
    1467 -
    1468 - rc = crypto_aead_setkey(sw_ctx->aead_send, keyval,
    1469 + rc = crypto_aead_setkey(sw_ctx->aead_send, gcm_128_info->key,
    1470 TLS_CIPHER_AES_GCM_128_KEY_SIZE);
    1471 if (rc)
    1472 goto free_aead;
    1473 diff --git a/security/keys/dh.c b/security/keys/dh.c
    1474 index 35543f04e759..d1ea9f325f94 100644
    1475 --- a/security/keys/dh.c
    1476 +++ b/security/keys/dh.c
    1477 @@ -307,7 +307,7 @@ long __keyctl_dh_compute(struct keyctl_dh_params __user *params,
    1478 }
    1479 dh_inputs.g_size = dlen;
    1480
    1481 - dlen = dh_data_from_key(pcopy.dh_private, &dh_inputs.key);
    1482 + dlen = dh_data_from_key(pcopy.private, &dh_inputs.key);
    1483 if (dlen < 0) {
    1484 ret = dlen;
    1485 goto out2;
    1486 diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c
    1487 index 730ea91d9be8..93676354f87f 100644
    1488 --- a/sound/firewire/bebob/bebob.c
    1489 +++ b/sound/firewire/bebob/bebob.c
    1490 @@ -263,6 +263,8 @@ do_registration(struct work_struct *work)
    1491 error:
    1492 mutex_unlock(&devices_mutex);
    1493 snd_bebob_stream_destroy_duplex(bebob);
    1494 + kfree(bebob->maudio_special_quirk);
    1495 + bebob->maudio_special_quirk = NULL;
    1496 snd_card_free(bebob->card);
    1497 dev_info(&bebob->unit->device,
    1498 "Sound card registration failed: %d\n", err);
    1499 diff --git a/sound/firewire/bebob/bebob_maudio.c b/sound/firewire/bebob/bebob_maudio.c
    1500 index bd55620c6a47..c266997ad299 100644
    1501 --- a/sound/firewire/bebob/bebob_maudio.c
    1502 +++ b/sound/firewire/bebob/bebob_maudio.c
    1503 @@ -96,17 +96,13 @@ int snd_bebob_maudio_load_firmware(struct fw_unit *unit)
    1504 struct fw_device *device = fw_parent_device(unit);
    1505 int err, rcode;
    1506 u64 date;
    1507 - __le32 cues[3] = {
    1508 - cpu_to_le32(MAUDIO_BOOTLOADER_CUE1),
    1509 - cpu_to_le32(MAUDIO_BOOTLOADER_CUE2),
    1510 - cpu_to_le32(MAUDIO_BOOTLOADER_CUE3)
    1511 - };
    1512 + __le32 *cues;
    1513
    1514 /* check date of software used to build */
    1515 err = snd_bebob_read_block(unit, INFO_OFFSET_SW_DATE,
    1516 &date, sizeof(u64));
    1517 if (err < 0)
    1518 - goto end;
    1519 + return err;
    1520 /*
    1521 * firmware version 5058 or later has date later than "20070401", but
    1522 * 'date' is not null-terminated.
    1523 @@ -114,20 +110,28 @@ int snd_bebob_maudio_load_firmware(struct fw_unit *unit)
    1524 if (date < 0x3230303730343031LL) {
    1525 dev_err(&unit->device,
    1526 "Use firmware version 5058 or later\n");
    1527 - err = -ENOSYS;
    1528 - goto end;
    1529 + return -ENXIO;
    1530 }
    1531
    1532 + cues = kmalloc_array(3, sizeof(*cues), GFP_KERNEL);
    1533 + if (!cues)
    1534 + return -ENOMEM;
    1535 +
    1536 + cues[0] = cpu_to_le32(MAUDIO_BOOTLOADER_CUE1);
    1537 + cues[1] = cpu_to_le32(MAUDIO_BOOTLOADER_CUE2);
    1538 + cues[2] = cpu_to_le32(MAUDIO_BOOTLOADER_CUE3);
    1539 +
    1540 rcode = fw_run_transaction(device->card, TCODE_WRITE_BLOCK_REQUEST,
    1541 device->node_id, device->generation,
    1542 device->max_speed, BEBOB_ADDR_REG_REQ,
    1543 - cues, sizeof(cues));
    1544 + cues, 3 * sizeof(*cues));
    1545 + kfree(cues);
    1546 if (rcode != RCODE_COMPLETE) {
    1547 dev_err(&unit->device,
    1548 "Failed to send a cue to load firmware\n");
    1549 err = -EIO;
    1550 }
    1551 -end:
    1552 +
    1553 return err;
    1554 }
    1555
    1556 @@ -290,10 +294,6 @@ snd_bebob_maudio_special_discover(struct snd_bebob *bebob, bool is1814)
    1557 bebob->midi_output_ports = 2;
    1558 }
    1559 end:
    1560 - if (err < 0) {
    1561 - kfree(params);
    1562 - bebob->maudio_special_quirk = NULL;
    1563 - }
    1564 mutex_unlock(&bebob->mutex);
    1565 return err;
    1566 }
    1567 diff --git a/sound/firewire/digi00x/digi00x.c b/sound/firewire/digi00x/digi00x.c
    1568 index 1f5e1d23f31a..ef689997d6a5 100644
    1569 --- a/sound/firewire/digi00x/digi00x.c
    1570 +++ b/sound/firewire/digi00x/digi00x.c
    1571 @@ -49,6 +49,7 @@ static void dg00x_free(struct snd_dg00x *dg00x)
    1572 fw_unit_put(dg00x->unit);
    1573
    1574 mutex_destroy(&dg00x->mutex);
    1575 + kfree(dg00x);
    1576 }
    1577
    1578 static void dg00x_card_free(struct snd_card *card)
    1579 diff --git a/sound/firewire/fireface/ff-protocol-ff400.c b/sound/firewire/fireface/ff-protocol-ff400.c
    1580 index 12aa15df435d..9f5036442ab9 100644
    1581 --- a/sound/firewire/fireface/ff-protocol-ff400.c
    1582 +++ b/sound/firewire/fireface/ff-protocol-ff400.c
    1583 @@ -146,6 +146,7 @@ static int ff400_switch_fetching_mode(struct snd_ff *ff, bool enable)
    1584 {
    1585 __le32 *reg;
    1586 int i;
    1587 + int err;
    1588
    1589 reg = kzalloc(sizeof(__le32) * 18, GFP_KERNEL);
    1590 if (reg == NULL)
    1591 @@ -163,9 +164,11 @@ static int ff400_switch_fetching_mode(struct snd_ff *ff, bool enable)
    1592 reg[i] = cpu_to_le32(0x00000001);
    1593 }
    1594
    1595 - return snd_fw_transaction(ff->unit, TCODE_WRITE_BLOCK_REQUEST,
    1596 - FF400_FETCH_PCM_FRAMES, reg,
    1597 - sizeof(__le32) * 18, 0);
    1598 + err = snd_fw_transaction(ff->unit, TCODE_WRITE_BLOCK_REQUEST,
    1599 + FF400_FETCH_PCM_FRAMES, reg,
    1600 + sizeof(__le32) * 18, 0);
    1601 + kfree(reg);
    1602 + return err;
    1603 }
    1604
    1605 static void ff400_dump_sync_status(struct snd_ff *ff,
    1606 diff --git a/sound/firewire/fireworks/fireworks.c b/sound/firewire/fireworks/fireworks.c
    1607 index 71a0613d3da0..f2d073365cf6 100644
    1608 --- a/sound/firewire/fireworks/fireworks.c
    1609 +++ b/sound/firewire/fireworks/fireworks.c
    1610 @@ -301,6 +301,8 @@ error:
    1611 snd_efw_transaction_remove_instance(efw);
    1612 snd_efw_stream_destroy_duplex(efw);
    1613 snd_card_free(efw->card);
    1614 + kfree(efw->resp_buf);
    1615 + efw->resp_buf = NULL;
    1616 dev_info(&efw->unit->device,
    1617 "Sound card registration failed: %d\n", err);
    1618 }
    1619 diff --git a/sound/firewire/oxfw/oxfw.c b/sound/firewire/oxfw/oxfw.c
    1620 index 413ab6313bb6..a315d5b6b86b 100644
    1621 --- a/sound/firewire/oxfw/oxfw.c
    1622 +++ b/sound/firewire/oxfw/oxfw.c
    1623 @@ -136,6 +136,7 @@ static void oxfw_free(struct snd_oxfw *oxfw)
    1624
    1625 kfree(oxfw->spec);
    1626 mutex_destroy(&oxfw->mutex);
    1627 + kfree(oxfw);
    1628 }
    1629
    1630 /*
    1631 @@ -213,6 +214,7 @@ static int detect_quirks(struct snd_oxfw *oxfw)
    1632 static void do_registration(struct work_struct *work)
    1633 {
    1634 struct snd_oxfw *oxfw = container_of(work, struct snd_oxfw, dwork.work);
    1635 + int i;
    1636 int err;
    1637
    1638 if (oxfw->registered)
    1639 @@ -275,7 +277,15 @@ error:
    1640 snd_oxfw_stream_destroy_simplex(oxfw, &oxfw->rx_stream);
    1641 if (oxfw->has_output)
    1642 snd_oxfw_stream_destroy_simplex(oxfw, &oxfw->tx_stream);
    1643 + for (i = 0; i < SND_OXFW_STREAM_FORMAT_ENTRIES; ++i) {
    1644 + kfree(oxfw->tx_stream_formats[i]);
    1645 + oxfw->tx_stream_formats[i] = NULL;
    1646 + kfree(oxfw->rx_stream_formats[i]);
    1647 + oxfw->rx_stream_formats[i] = NULL;
    1648 + }
    1649 snd_card_free(oxfw->card);
    1650 + kfree(oxfw->spec);
    1651 + oxfw->spec = NULL;
    1652 dev_info(&oxfw->unit->device,
    1653 "Sound card registration failed: %d\n", err);
    1654 }
    1655 diff --git a/sound/firewire/tascam/tascam.c b/sound/firewire/tascam/tascam.c
    1656 index 44ad41fb7374..d3fdc463a884 100644
    1657 --- a/sound/firewire/tascam/tascam.c
    1658 +++ b/sound/firewire/tascam/tascam.c
    1659 @@ -93,6 +93,7 @@ static void tscm_free(struct snd_tscm *tscm)
    1660 fw_unit_put(tscm->unit);
    1661
    1662 mutex_destroy(&tscm->mutex);
    1663 + kfree(tscm);
    1664 }
    1665
    1666 static void tscm_card_free(struct snd_card *card)
    1667 diff --git a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c
    1668 index a2b56b188be4..d68bb40d3676 100644
    1669 --- a/sound/pci/emu10k1/emufx.c
    1670 +++ b/sound/pci/emu10k1/emufx.c
    1671 @@ -2547,7 +2547,7 @@ static int snd_emu10k1_fx8010_ioctl(struct snd_hwdep * hw, struct file *file, un
    1672 emu->support_tlv = 1;
    1673 return put_user(SNDRV_EMU10K1_VERSION, (int __user *)argp);
    1674 case SNDRV_EMU10K1_IOCTL_INFO:
    1675 - info = kmalloc(sizeof(*info), GFP_KERNEL);
    1676 + info = kzalloc(sizeof(*info), GFP_KERNEL);
    1677 if (!info)
    1678 return -ENOMEM;
    1679 snd_emu10k1_fx8010_info(emu, info);
    1680 diff --git a/sound/soc/codecs/cs4265.c b/sound/soc/codecs/cs4265.c
    1681 index fd966bb851cb..6e8eb1f5a041 100644
    1682 --- a/sound/soc/codecs/cs4265.c
    1683 +++ b/sound/soc/codecs/cs4265.c
    1684 @@ -157,8 +157,8 @@ static const struct snd_kcontrol_new cs4265_snd_controls[] = {
    1685 SOC_SINGLE("Validity Bit Control Switch", CS4265_SPDIF_CTL2,
    1686 3, 1, 0),
    1687 SOC_ENUM("SPDIF Mono/Stereo", spdif_mono_stereo_enum),
    1688 - SOC_SINGLE("MMTLR Data Switch", 0,
    1689 - 1, 1, 0),
    1690 + SOC_SINGLE("MMTLR Data Switch", CS4265_SPDIF_CTL2,
    1691 + 0, 1, 0),
    1692 SOC_ENUM("Mono Channel Select", spdif_mono_select_enum),
    1693 SND_SOC_BYTES("C Data Buffer", CS4265_C_DATA_BUFF, 24),
    1694 };
    1695 diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
    1696 index 107133297e8d..9896e736fa5c 100644
    1697 --- a/sound/soc/sh/rcar/core.c
    1698 +++ b/sound/soc/sh/rcar/core.c
    1699 @@ -925,12 +925,23 @@ static void rsnd_soc_dai_shutdown(struct snd_pcm_substream *substream,
    1700 rsnd_dai_call(nolock_stop, io, priv);
    1701 }
    1702
    1703 +static int rsnd_soc_dai_prepare(struct snd_pcm_substream *substream,
    1704 + struct snd_soc_dai *dai)
    1705 +{
    1706 + struct rsnd_priv *priv = rsnd_dai_to_priv(dai);
    1707 + struct rsnd_dai *rdai = rsnd_dai_to_rdai(dai);
    1708 + struct rsnd_dai_stream *io = rsnd_rdai_to_io(rdai, substream);
    1709 +
    1710 + return rsnd_dai_call(prepare, io, priv);
    1711 +}
    1712 +
    1713 static const struct snd_soc_dai_ops rsnd_soc_dai_ops = {
    1714 .startup = rsnd_soc_dai_startup,
    1715 .shutdown = rsnd_soc_dai_shutdown,
    1716 .trigger = rsnd_soc_dai_trigger,
    1717 .set_fmt = rsnd_soc_dai_set_fmt,
    1718 .set_tdm_slot = rsnd_soc_set_dai_tdm_slot,
    1719 + .prepare = rsnd_soc_dai_prepare,
    1720 };
    1721
    1722 void rsnd_parse_connect_common(struct rsnd_dai *rdai,
    1723 diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h
    1724 index c5de71f2dc8c..1768a0ae469d 100644
    1725 --- a/sound/soc/sh/rcar/rsnd.h
    1726 +++ b/sound/soc/sh/rcar/rsnd.h
    1727 @@ -283,6 +283,9 @@ struct rsnd_mod_ops {
    1728 int (*nolock_stop)(struct rsnd_mod *mod,
    1729 struct rsnd_dai_stream *io,
    1730 struct rsnd_priv *priv);
    1731 + int (*prepare)(struct rsnd_mod *mod,
    1732 + struct rsnd_dai_stream *io,
    1733 + struct rsnd_priv *priv);
    1734 };
    1735
    1736 struct rsnd_dai_stream;
    1737 @@ -312,6 +315,7 @@ struct rsnd_mod {
    1738 * H 0: fallback
    1739 * H 0: hw_params
    1740 * H 0: pointer
    1741 + * H 0: prepare
    1742 */
    1743 #define __rsnd_mod_shift_nolock_start 0
    1744 #define __rsnd_mod_shift_nolock_stop 0
    1745 @@ -326,6 +330,7 @@ struct rsnd_mod {
    1746 #define __rsnd_mod_shift_fallback 28 /* always called */
    1747 #define __rsnd_mod_shift_hw_params 28 /* always called */
    1748 #define __rsnd_mod_shift_pointer 28 /* always called */
    1749 +#define __rsnd_mod_shift_prepare 28 /* always called */
    1750
    1751 #define __rsnd_mod_add_probe 0
    1752 #define __rsnd_mod_add_remove 0
    1753 @@ -340,6 +345,7 @@ struct rsnd_mod {
    1754 #define __rsnd_mod_add_fallback 0
    1755 #define __rsnd_mod_add_hw_params 0
    1756 #define __rsnd_mod_add_pointer 0
    1757 +#define __rsnd_mod_add_prepare 0
    1758
    1759 #define __rsnd_mod_call_probe 0
    1760 #define __rsnd_mod_call_remove 0
    1761 @@ -354,6 +360,7 @@ struct rsnd_mod {
    1762 #define __rsnd_mod_call_pointer 0
    1763 #define __rsnd_mod_call_nolock_start 0
    1764 #define __rsnd_mod_call_nolock_stop 1
    1765 +#define __rsnd_mod_call_prepare 0
    1766
    1767 #define rsnd_mod_to_priv(mod) ((mod)->priv)
    1768 #define rsnd_mod_id(mod) ((mod) ? (mod)->id : -1)
    1769 diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c
    1770 index f0fb85fda42d..34223c8c28a8 100644
    1771 --- a/sound/soc/sh/rcar/ssi.c
    1772 +++ b/sound/soc/sh/rcar/ssi.c
    1773 @@ -280,7 +280,7 @@ static int rsnd_ssi_master_clk_start(struct rsnd_mod *mod,
    1774 if (rsnd_ssi_is_multi_slave(mod, io))
    1775 return 0;
    1776
    1777 - if (ssi->usrcnt > 1) {
    1778 + if (ssi->rate) {
    1779 if (ssi->rate != rate) {
    1780 dev_err(dev, "SSI parent/child should use same rate\n");
    1781 return -EINVAL;
    1782 @@ -482,7 +482,6 @@ static int rsnd_ssi_init(struct rsnd_mod *mod,
    1783 struct rsnd_priv *priv)
    1784 {
    1785 struct rsnd_ssi *ssi = rsnd_mod_to_ssi(mod);
    1786 - int ret;
    1787
    1788 if (!rsnd_ssi_is_run_mods(mod, io))
    1789 return 0;
    1790 @@ -493,10 +492,6 @@ static int rsnd_ssi_init(struct rsnd_mod *mod,
    1791
    1792 rsnd_mod_power_on(mod);
    1793
    1794 - ret = rsnd_ssi_master_clk_start(mod, io);
    1795 - if (ret < 0)
    1796 - return ret;
    1797 -
    1798 rsnd_ssi_config_init(mod, io);
    1799
    1800 rsnd_ssi_register_setup(mod);
    1801 @@ -847,6 +842,13 @@ static int rsnd_ssi_pointer(struct rsnd_mod *mod,
    1802 return 0;
    1803 }
    1804
    1805 +static int rsnd_ssi_prepare(struct rsnd_mod *mod,
    1806 + struct rsnd_dai_stream *io,
    1807 + struct rsnd_priv *priv)
    1808 +{
    1809 + return rsnd_ssi_master_clk_start(mod, io);
    1810 +}
    1811 +
    1812 static struct rsnd_mod_ops rsnd_ssi_pio_ops = {
    1813 .name = SSI_NAME,
    1814 .probe = rsnd_ssi_common_probe,
    1815 @@ -859,6 +861,7 @@ static struct rsnd_mod_ops rsnd_ssi_pio_ops = {
    1816 .pointer= rsnd_ssi_pointer,
    1817 .pcm_new = rsnd_ssi_pcm_new,
    1818 .hw_params = rsnd_ssi_hw_params,
    1819 + .prepare = rsnd_ssi_prepare,
    1820 };
    1821
    1822 static int rsnd_ssi_dma_probe(struct rsnd_mod *mod,
    1823 @@ -935,6 +938,7 @@ static struct rsnd_mod_ops rsnd_ssi_dma_ops = {
    1824 .pcm_new = rsnd_ssi_pcm_new,
    1825 .fallback = rsnd_ssi_fallback,
    1826 .hw_params = rsnd_ssi_hw_params,
    1827 + .prepare = rsnd_ssi_prepare,
    1828 };
    1829
    1830 int rsnd_ssi_is_dma_mode(struct rsnd_mod *mod)