Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-4.9/0229-4.9.130-all-fixes.patch

    Contents of /trunk/kernel-alx/patches-4.9/0229-4.9.130-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3230 - (show annotations) (download)
    Mon Oct 1 09:59:50 2018 UTC (5 years, 7 months ago) by niro
    File size: 36931 byte(s) 
    -linux-4.9.130
    1 diff --git a/Makefile b/Makefile
    2 index 3f3c340374c5..b98e04a5e1e5 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,6 +1,6 @@
    6 VERSION = 4
    7 PATCHLEVEL = 9
    8 -SUBLEVEL = 129
    9 +SUBLEVEL = 130
    10 EXTRAVERSION =
    11 NAME = Roaring Lionus
    12
    13 diff --git a/arch/x86/xen/pmu.c b/arch/x86/xen/pmu.c
    14 index b9fc52556bcc..0b29a43e09c8 100644
    15 --- a/arch/x86/xen/pmu.c
    16 +++ b/arch/x86/xen/pmu.c
    17 @@ -477,7 +477,7 @@ static void xen_convert_regs(const struct xen_pmu_regs *xen_regs,
    18 irqreturn_t xen_pmu_irq_handler(int irq, void *dev_id)
    19 {
    20 int err, ret = IRQ_NONE;
    21 - struct pt_regs regs;
    22 + struct pt_regs regs = {0};
    23 const struct xen_pmu_data *xenpmu_data = get_xenpmu_data();
    24 uint8_t xenpmu_flags = get_xenpmu_flags();
    25
    26 diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c
    27 index 56c288f78d8a..5bfae1f972c7 100644
    28 --- a/drivers/gpu/drm/nouveau/nouveau_connector.c
    29 +++ b/drivers/gpu/drm/nouveau/nouveau_connector.c
    30 @@ -271,12 +271,16 @@ nouveau_connector_detect(struct drm_connector *connector, bool force)
    31 nv_connector->edid = NULL;
    32 }
    33
    34 - /* Outputs are only polled while runtime active, so acquiring a
    35 - * runtime PM ref here is unnecessary (and would deadlock upon
    36 - * runtime suspend because it waits for polling to finish).
    37 + /* Outputs are only polled while runtime active, so resuming the
    38 + * device here is unnecessary (and would deadlock upon runtime suspend
    39 + * because it waits for polling to finish). We do however, want to
    40 + * prevent the autosuspend timer from elapsing during this operation
    41 + * if possible.
    42 */
    43 - if (!drm_kms_helper_is_poll_worker()) {
    44 - ret = pm_runtime_get_sync(connector->dev->dev);
    45 + if (drm_kms_helper_is_poll_worker()) {
    46 + pm_runtime_get_noresume(dev->dev);
    47 + } else {
    48 + ret = pm_runtime_get_sync(dev->dev);
    49 if (ret < 0 && ret != -EACCES)
    50 return conn_status;
    51 }
    52 @@ -354,10 +358,8 @@ detect_analog:
    53
    54 out:
    55
    56 - if (!drm_kms_helper_is_poll_worker()) {
    57 - pm_runtime_mark_last_busy(connector->dev->dev);
    58 - pm_runtime_put_autosuspend(connector->dev->dev);
    59 - }
    60 + pm_runtime_mark_last_busy(dev->dev);
    61 + pm_runtime_put_autosuspend(dev->dev);
    62
    63 return conn_status;
    64 }
    65 diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c
    66 index 6526a3366087..3ddd4096da2a 100644
    67 --- a/drivers/gpu/drm/nouveau/nouveau_display.c
    68 +++ b/drivers/gpu/drm/nouveau/nouveau_display.c
    69 @@ -367,8 +367,6 @@ nouveau_display_hpd_work(struct work_struct *work)
    70 pm_runtime_get_sync(drm->dev->dev);
    71
    72 drm_helper_hpd_irq_event(drm->dev);
    73 - /* enable polling for external displays */
    74 - drm_kms_helper_poll_enable(drm->dev);
    75
    76 pm_runtime_mark_last_busy(drm->dev->dev);
    77 pm_runtime_put_sync(drm->dev->dev);
    78 @@ -391,15 +389,29 @@ nouveau_display_acpi_ntfy(struct notifier_block *nb, unsigned long val,
    79 {
    80 struct nouveau_drm *drm = container_of(nb, typeof(*drm), acpi_nb);
    81 struct acpi_bus_event *info = data;
    82 + int ret;
    83
    84 if (!strcmp(info->device_class, ACPI_VIDEO_CLASS)) {
    85 if (info->type == ACPI_VIDEO_NOTIFY_PROBE) {
    86 - /*
    87 - * This may be the only indication we receive of a
    88 - * connector hotplug on a runtime suspended GPU,
    89 - * schedule hpd_work to check.
    90 - */
    91 - schedule_work(&drm->hpd_work);
    92 + ret = pm_runtime_get(drm->dev->dev);
    93 + if (ret == 1 || ret == -EACCES) {
    94 + /* If the GPU is already awake, or in a state
    95 + * where we can't wake it up, it can handle
    96 + * it's own hotplug events.
    97 + */
    98 + pm_runtime_put_autosuspend(drm->dev->dev);
    99 + } else if (ret == 0) {
    100 + /* This may be the only indication we receive
    101 + * of a connector hotplug on a runtime
    102 + * suspended GPU, schedule hpd_work to check.
    103 + */
    104 + NV_DEBUG(drm, "ACPI requested connector reprobe\n");
    105 + schedule_work(&drm->hpd_work);
    106 + pm_runtime_put_noidle(drm->dev->dev);
    107 + } else {
    108 + NV_WARN(drm, "Dropped ACPI reprobe event due to RPM error: %d\n",
    109 + ret);
    110 + }
    111
    112 /* acpi-video should not generate keypresses for this */
    113 return NOTIFY_BAD;
    114 @@ -422,6 +434,11 @@ nouveau_display_init(struct drm_device *dev)
    115 if (ret)
    116 return ret;
    117
    118 + /* enable connector detection and polling for connectors without HPD
    119 + * support
    120 + */
    121 + drm_kms_helper_poll_enable(dev);
    122 +
    123 /* enable hotplug interrupts */
    124 list_for_each_entry(connector, &dev->mode_config.connector_list, head) {
    125 struct nouveau_connector *conn = nouveau_connector(connector);
    126 diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c
    127 index f8c9f6f4f822..a2d8630058ed 100644
    128 --- a/drivers/gpu/drm/vc4/vc4_plane.c
    129 +++ b/drivers/gpu/drm/vc4/vc4_plane.c
    130 @@ -327,6 +327,9 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state)
    131 vc4_state->y_scaling[0] = vc4_get_scaling_mode(vc4_state->src_h[0],
    132 vc4_state->crtc_h);
    133
    134 + vc4_state->is_unity = (vc4_state->x_scaling[0] == VC4_SCALING_NONE &&
    135 + vc4_state->y_scaling[0] == VC4_SCALING_NONE);
    136 +
    137 if (num_planes > 1) {
    138 vc4_state->is_yuv = true;
    139
    140 @@ -342,24 +345,17 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state)
    141 vc4_get_scaling_mode(vc4_state->src_h[1],
    142 vc4_state->crtc_h);
    143
    144 - /* YUV conversion requires that scaling be enabled,
    145 - * even on a plane that's otherwise 1:1. Choose TPZ
    146 - * for simplicity.
    147 + /* YUV conversion requires that horizontal scaling be enabled,
    148 + * even on a plane that's otherwise 1:1. Looks like only PPF
    149 + * works in that case, so let's pick that one.
    150 */
    151 - if (vc4_state->x_scaling[0] == VC4_SCALING_NONE)
    152 - vc4_state->x_scaling[0] = VC4_SCALING_TPZ;
    153 - if (vc4_state->y_scaling[0] == VC4_SCALING_NONE)
    154 - vc4_state->y_scaling[0] = VC4_SCALING_TPZ;
    155 + if (vc4_state->is_unity)
    156 + vc4_state->x_scaling[0] = VC4_SCALING_PPF;
    157 } else {
    158 vc4_state->x_scaling[1] = VC4_SCALING_NONE;
    159 vc4_state->y_scaling[1] = VC4_SCALING_NONE;
    160 }
    161
    162 - vc4_state->is_unity = (vc4_state->x_scaling[0] == VC4_SCALING_NONE &&
    163 - vc4_state->y_scaling[0] == VC4_SCALING_NONE &&
    164 - vc4_state->x_scaling[1] == VC4_SCALING_NONE &&
    165 - vc4_state->y_scaling[1] == VC4_SCALING_NONE);
    166 -
    167 /* No configuring scaling on the cursor plane, since it gets
    168 non-vblank-synced updates, and scaling requires requires
    169 LBM changes which have to be vblank-synced.
    170 @@ -614,7 +610,10 @@ static int vc4_plane_mode_set(struct drm_plane *plane,
    171 vc4_dlist_write(vc4_state, SCALER_CSC2_ITR_R_601_5);
    172 }
    173
    174 - if (!vc4_state->is_unity) {
    175 + if (vc4_state->x_scaling[0] != VC4_SCALING_NONE ||
    176 + vc4_state->x_scaling[1] != VC4_SCALING_NONE ||
    177 + vc4_state->y_scaling[0] != VC4_SCALING_NONE ||
    178 + vc4_state->y_scaling[1] != VC4_SCALING_NONE) {
    179 /* LBM Base Address. */
    180 if (vc4_state->y_scaling[0] != VC4_SCALING_NONE ||
    181 vc4_state->y_scaling[1] != VC4_SCALING_NONE) {
    182 diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
    183 index 7944a1f589eb..2248b330c047 100644
    184 --- a/drivers/hid/hid-core.c
    185 +++ b/drivers/hid/hid-core.c
    186 @@ -2059,6 +2059,9 @@ static const struct hid_device_id hid_have_special_driver[] = {
    187 { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS3_CONTROLLER) },
    188 { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER) },
    189 { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER) },
    190 + { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_2) },
    191 + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_2) },
    192 + { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_DONGLE) },
    193 { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_VAIO_VGX_MOUSE) },
    194 { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_VAIO_VGP_MOUSE) },
    195 { HID_USB_DEVICE(USB_VENDOR_ID_SINO_LITE, USB_DEVICE_ID_SINO_LITE_CONTROLLER) },
    196 diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
    197 index 019ee9181f2b..de64cd33590a 100644
    198 --- a/drivers/hid/hid-ids.h
    199 +++ b/drivers/hid/hid-ids.h
    200 @@ -927,6 +927,8 @@
    201 #define USB_DEVICE_ID_SONY_PS3_BDREMOTE 0x0306
    202 #define USB_DEVICE_ID_SONY_PS3_CONTROLLER 0x0268
    203 #define USB_DEVICE_ID_SONY_PS4_CONTROLLER 0x05c4
    204 +#define USB_DEVICE_ID_SONY_PS4_CONTROLLER_2 0x09cc
    205 +#define USB_DEVICE_ID_SONY_PS4_CONTROLLER_DONGLE 0x0ba0
    206 #define USB_DEVICE_ID_SONY_MOTION_CONTROLLER 0x03d5
    207 #define USB_DEVICE_ID_SONY_NAVIGATION_CONTROLLER 0x042f
    208 #define USB_DEVICE_ID_SONY_BUZZ_CONTROLLER 0x0002
    209 diff --git a/drivers/hid/hid-sony.c b/drivers/hid/hid-sony.c
    210 index 1b1dccd37fbd..eee58d15e745 100644
    211 --- a/drivers/hid/hid-sony.c
    212 +++ b/drivers/hid/hid-sony.c
    213 @@ -2581,6 +2581,12 @@ static const struct hid_device_id sony_devices[] = {
    214 .driver_data = DUALSHOCK4_CONTROLLER_USB },
    215 { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER),
    216 .driver_data = DUALSHOCK4_CONTROLLER_BT },
    217 + { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_2),
    218 + .driver_data = DUALSHOCK4_CONTROLLER_USB },
    219 + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_2),
    220 + .driver_data = DUALSHOCK4_CONTROLLER_BT },
    221 + { HID_USB_DEVICE(USB_VENDOR_ID_SONY, USB_DEVICE_ID_SONY_PS4_CONTROLLER_DONGLE),
    222 + .driver_data = DUALSHOCK4_CONTROLLER_USB },
    223 /* Nyko Core Controller for PS3 */
    224 { HID_USB_DEVICE(USB_VENDOR_ID_SINO_LITE, USB_DEVICE_ID_SINO_LITE_CONTROLLER),
    225 .driver_data = SIXAXIS_CONTROLLER_USB | SINO_LITE_CONTROLLER },
    226 diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c
    227 index cc2243f6cc7f..bb45eb22ba1f 100644
    228 --- a/drivers/infiniband/hw/cxgb4/qp.c
    229 +++ b/drivers/infiniband/hw/cxgb4/qp.c
    230 @@ -1258,6 +1258,12 @@ static void flush_qp(struct c4iw_qp *qhp)
    231
    232 t4_set_wq_in_error(&qhp->wq);
    233 if (qhp->ibqp.uobject) {
    234 +
    235 + /* for user qps, qhp->wq.flushed is protected by qhp->mutex */
    236 + if (qhp->wq.flushed)
    237 + return;
    238 +
    239 + qhp->wq.flushed = 1;
    240 t4_set_cq_in_error(&rchp->cq);
    241 spin_lock_irqsave(&rchp->comp_handler_lock, flag);
    242 (*rchp->ibcq.comp_handler)(&rchp->ibcq, rchp->ibcq.cq_context);
    243 diff --git a/drivers/misc/vmw_balloon.c b/drivers/misc/vmw_balloon.c
    244 index 518e2dec2aa2..5e9122cd3898 100644
    245 --- a/drivers/misc/vmw_balloon.c
    246 +++ b/drivers/misc/vmw_balloon.c
    247 @@ -45,6 +45,7 @@
    248 #include <linux/seq_file.h>
    249 #include <linux/vmw_vmci_defs.h>
    250 #include <linux/vmw_vmci_api.h>
    251 +#include <linux/io.h>
    252 #include <asm/hypervisor.h>
    253
    254 MODULE_AUTHOR("VMware, Inc.");
    255 diff --git a/drivers/net/appletalk/ipddp.c b/drivers/net/appletalk/ipddp.c
    256 index 2e4649655181..4e98e5aff7c5 100644
    257 --- a/drivers/net/appletalk/ipddp.c
    258 +++ b/drivers/net/appletalk/ipddp.c
    259 @@ -284,8 +284,12 @@ static int ipddp_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd)
    260 case SIOCFINDIPDDPRT:
    261 spin_lock_bh(&ipddp_route_lock);
    262 rp = __ipddp_find_route(&rcp);
    263 - if (rp)
    264 - memcpy(&rcp2, rp, sizeof(rcp2));
    265 + if (rp) {
    266 + memset(&rcp2, 0, sizeof(rcp2));
    267 + rcp2.ip = rp->ip;
    268 + rcp2.at = rp->at;
    269 + rcp2.flags = rp->flags;
    270 + }
    271 spin_unlock_bh(&ipddp_route_lock);
    272
    273 if (rp) {
    274 diff --git a/drivers/net/ethernet/hp/hp100.c b/drivers/net/ethernet/hp/hp100.c
    275 index 631dbc7b4dbb..0988bf1a43c0 100644
    276 --- a/drivers/net/ethernet/hp/hp100.c
    277 +++ b/drivers/net/ethernet/hp/hp100.c
    278 @@ -2636,7 +2636,7 @@ static int hp100_login_to_vg_hub(struct net_device *dev, u_short force_relogin)
    279 /* Wait for link to drop */
    280 time = jiffies + (HZ / 10);
    281 do {
    282 - if (~(hp100_inb(VG_LAN_CFG_1) & HP100_LINK_UP_ST))
    283 + if (!(hp100_inb(VG_LAN_CFG_1) & HP100_LINK_UP_ST))
    284 break;
    285 if (!in_interrupt())
    286 schedule_timeout_interruptible(1);
    287 diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
    288 index 7f6af10f09ee..3c1adb38412b 100644
    289 --- a/drivers/net/xen-netfront.c
    290 +++ b/drivers/net/xen-netfront.c
    291 @@ -906,7 +906,11 @@ static RING_IDX xennet_fill_frags(struct netfront_queue *queue,
    292 BUG_ON(pull_to <= skb_headlen(skb));
    293 __pskb_pull_tail(skb, pull_to - skb_headlen(skb));
    294 }
    295 - BUG_ON(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS);
    296 + if (unlikely(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS)) {
    297 + queue->rx.rsp_cons = ++cons;
    298 + kfree_skb(nskb);
    299 + return ~0U;
    300 + }
    301
    302 skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags,
    303 skb_frag_page(nfrag),
    304 @@ -1043,6 +1047,8 @@ err:
    305 skb->len += rx->status;
    306
    307 i = xennet_fill_frags(queue, skb, &tmpq);
    308 + if (unlikely(i == ~0U))
    309 + goto err;
    310
    311 if (rx->flags & XEN_NETRXF_csum_blank)
    312 skb->ip_summed = CHECKSUM_PARTIAL;
    313 diff --git a/drivers/pci/host/pci-aardvark.c b/drivers/pci/host/pci-aardvark.c
    314 index 11bad826683e..1dbd09c91a7c 100644
    315 --- a/drivers/pci/host/pci-aardvark.c
    316 +++ b/drivers/pci/host/pci-aardvark.c
    317 @@ -976,6 +976,7 @@ static int advk_pcie_probe(struct platform_device *pdev)
    318 return -ENOMEM;
    319 }
    320
    321 + pci_bus_size_bridges(bus);
    322 pci_bus_assign_resources(bus);
    323
    324 list_for_each_entry(child, &bus->children, node)
    325 diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
    326 index a05d143ac43b..c7a695c2303a 100644
    327 --- a/drivers/pci/quirks.c
    328 +++ b/drivers/pci/quirks.c
    329 @@ -4236,11 +4236,6 @@ static int pci_quirk_qcom_rp_acs(struct pci_dev *dev, u16 acs_flags)
    330 *
    331 * 0x9d10-0x9d1b PCI Express Root port #{1-12}
    332 *
    333 - * The 300 series chipset suffers from the same bug so include those root
    334 - * ports here as well.
    335 - *
    336 - * 0xa32c-0xa343 PCI Express Root port #{0-24}
    337 - *
    338 * [1] http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-datasheet-vol-2.html
    339 * [2] http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-datasheet-vol-1.html
    340 * [3] http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-spec-update.html
    341 @@ -4258,7 +4253,6 @@ static bool pci_quirk_intel_spt_pch_acs_match(struct pci_dev *dev)
    342 case 0xa110 ... 0xa11f: case 0xa167 ... 0xa16a: /* Sunrise Point */
    343 case 0xa290 ... 0xa29f: case 0xa2e7 ... 0xa2ee: /* Union Point */
    344 case 0x9d10 ... 0x9d1b: /* 7th & 8th Gen Mobile */
    345 - case 0xa32c ... 0xa343: /* 300 series */
    346 return true;
    347 }
    348
    349 diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c
    350 index 005629447b0c..fe419935041c 100644
    351 --- a/drivers/platform/x86/alienware-wmi.c
    352 +++ b/drivers/platform/x86/alienware-wmi.c
    353 @@ -518,6 +518,7 @@ static acpi_status alienware_wmax_command(struct wmax_basic_args *in_args,
    354 if (obj && obj->type == ACPI_TYPE_INTEGER)
    355 *out_data = (u32) obj->integer.value;
    356 }
    357 + kfree(output.pointer);
    358 return status;
    359
    360 }
    361 diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
    362 index 98f75e5811c8..f06e74ea10d3 100644
    363 --- a/drivers/target/iscsi/iscsi_target_auth.c
    364 +++ b/drivers/target/iscsi/iscsi_target_auth.c
    365 @@ -26,18 +26,6 @@
    366 #include "iscsi_target_nego.h"
    367 #include "iscsi_target_auth.h"
    368
    369 -static int chap_string_to_hex(unsigned char *dst, unsigned char *src, int len)
    370 -{
    371 - int j = DIV_ROUND_UP(len, 2), rc;
    372 -
    373 - rc = hex2bin(dst, src, j);
    374 - if (rc < 0)
    375 - pr_debug("CHAP string contains non hex digit symbols\n");
    376 -
    377 - dst[j] = '\0';
    378 - return j;
    379 -}
    380 -
    381 static void chap_binaryhex_to_asciihex(char *dst, char *src, int src_len)
    382 {
    383 int i;
    384 @@ -240,9 +228,16 @@ static int chap_server_compute_md5(
    385 pr_err("Could not find CHAP_R.\n");
    386 goto out;
    387 }
    388 + if (strlen(chap_r) != MD5_SIGNATURE_SIZE * 2) {
    389 + pr_err("Malformed CHAP_R\n");
    390 + goto out;
    391 + }
    392 + if (hex2bin(client_digest, chap_r, MD5_SIGNATURE_SIZE) < 0) {
    393 + pr_err("Malformed CHAP_R\n");
    394 + goto out;
    395 + }
    396
    397 pr_debug("[server] Got CHAP_R=%s\n", chap_r);
    398 - chap_string_to_hex(client_digest, chap_r, strlen(chap_r));
    399
    400 tfm = crypto_alloc_shash("md5", 0, 0);
    401 if (IS_ERR(tfm)) {
    402 @@ -341,9 +336,7 @@ static int chap_server_compute_md5(
    403 pr_err("Could not find CHAP_C.\n");
    404 goto out;
    405 }
    406 - pr_debug("[server] Got CHAP_C=%s\n", challenge);
    407 - challenge_len = chap_string_to_hex(challenge_binhex, challenge,
    408 - strlen(challenge));
    409 + challenge_len = DIV_ROUND_UP(strlen(challenge), 2);
    410 if (!challenge_len) {
    411 pr_err("Unable to convert incoming challenge\n");
    412 goto out;
    413 @@ -352,6 +345,11 @@ static int chap_server_compute_md5(
    414 pr_err("CHAP_C exceeds maximum binary size of 1024 bytes\n");
    415 goto out;
    416 }
    417 + if (hex2bin(challenge_binhex, challenge, challenge_len) < 0) {
    418 + pr_err("Malformed CHAP_C\n");
    419 + goto out;
    420 + }
    421 + pr_debug("[server] Got CHAP_C=%s\n", challenge);
    422 /*
    423 * During mutual authentication, the CHAP_C generated by the
    424 * initiator must not match the original CHAP_C generated by
    425 diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c
    426 index f62c598810ff..638eb9bbd59f 100644
    427 --- a/drivers/tty/vt/vt_ioctl.c
    428 +++ b/drivers/tty/vt/vt_ioctl.c
    429 @@ -31,6 +31,8 @@
    430 #include <asm/io.h>
    431 #include <asm/uaccess.h>
    432
    433 +#include <linux/nospec.h>
    434 +
    435 #include <linux/kbd_kern.h>
    436 #include <linux/vt_kern.h>
    437 #include <linux/kbd_diacr.h>
    438 @@ -703,6 +705,8 @@ int vt_ioctl(struct tty_struct *tty,
    439 if (vsa.console == 0 || vsa.console > MAX_NR_CONSOLES)
    440 ret = -ENXIO;
    441 else {
    442 + vsa.console = array_index_nospec(vsa.console,
    443 + MAX_NR_CONSOLES + 1);
    444 vsa.console--;
    445 console_lock();
    446 ret = vc_allocate(vsa.console);
    447 diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c
    448 index e8b365000d73..e16bc4cec62e 100644
    449 --- a/fs/ext4/dir.c
    450 +++ b/fs/ext4/dir.c
    451 @@ -74,7 +74,7 @@ int __ext4_check_dir_entry(const char *function, unsigned int line,
    452 else if (unlikely(rlen < EXT4_DIR_REC_LEN(de->name_len)))
    453 error_msg = "rec_len is too small for name_len";
    454 else if (unlikely(((char *) de - buf) + rlen > size))
    455 - error_msg = "directory entry across range";
    456 + error_msg = "directory entry overrun";
    457 else if (unlikely(le32_to_cpu(de->inode) >
    458 le32_to_cpu(EXT4_SB(dir->i_sb)->s_es->s_inodes_count)))
    459 error_msg = "inode out of bounds";
    460 @@ -83,18 +83,16 @@ int __ext4_check_dir_entry(const char *function, unsigned int line,
    461
    462 if (filp)
    463 ext4_error_file(filp, function, line, bh->b_blocknr,
    464 - "bad entry in directory: %s - offset=%u(%u), "
    465 - "inode=%u, rec_len=%d, name_len=%d",
    466 - error_msg, (unsigned) (offset % size),
    467 - offset, le32_to_cpu(de->inode),
    468 - rlen, de->name_len);
    469 + "bad entry in directory: %s - offset=%u, "
    470 + "inode=%u, rec_len=%d, name_len=%d, size=%d",
    471 + error_msg, offset, le32_to_cpu(de->inode),
    472 + rlen, de->name_len, size);
    473 else
    474 ext4_error_inode(dir, function, line, bh->b_blocknr,
    475 - "bad entry in directory: %s - offset=%u(%u), "
    476 - "inode=%u, rec_len=%d, name_len=%d",
    477 - error_msg, (unsigned) (offset % size),
    478 - offset, le32_to_cpu(de->inode),
    479 - rlen, de->name_len);
    480 + "bad entry in directory: %s - offset=%u, "
    481 + "inode=%u, rec_len=%d, name_len=%d, size=%d",
    482 + error_msg, offset, le32_to_cpu(de->inode),
    483 + rlen, de->name_len, size);
    484
    485 return 1;
    486 }
    487 diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c
    488 index 436baf7cdca3..211539a7adfc 100644
    489 --- a/fs/ext4/inline.c
    490 +++ b/fs/ext4/inline.c
    491 @@ -1754,6 +1754,7 @@ bool empty_inline_dir(struct inode *dir, int *has_inline_data)
    492 {
    493 int err, inline_size;
    494 struct ext4_iloc iloc;
    495 + size_t inline_len;
    496 void *inline_pos;
    497 unsigned int offset;
    498 struct ext4_dir_entry_2 *de;
    499 @@ -1781,8 +1782,9 @@ bool empty_inline_dir(struct inode *dir, int *has_inline_data)
    500 goto out;
    501 }
    502
    503 + inline_len = ext4_get_inline_size(dir);
    504 offset = EXT4_INLINE_DOTDOT_SIZE;
    505 - while (offset < dir->i_size) {
    506 + while (offset < inline_len) {
    507 de = ext4_get_inline_entry(dir, &iloc, offset,
    508 &inline_pos, &inline_size);
    509 if (ext4_check_dir_entry(dir, NULL, de,
    510 diff --git a/fs/ext4/mmp.c b/fs/ext4/mmp.c
    511 index d89754ef1aab..c2e830a6206d 100644
    512 --- a/fs/ext4/mmp.c
    513 +++ b/fs/ext4/mmp.c
    514 @@ -48,7 +48,6 @@ static int write_mmp_block(struct super_block *sb, struct buffer_head *bh)
    515 */
    516 sb_start_write(sb);
    517 ext4_mmp_csum_set(sb, mmp);
    518 - mark_buffer_dirty(bh);
    519 lock_buffer(bh);
    520 bh->b_end_io = end_buffer_write_sync;
    521 get_bh(bh);
    522 diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
    523 index a225a21d04ad..bc727c393a89 100644
    524 --- a/fs/ext4/namei.c
    525 +++ b/fs/ext4/namei.c
    526 @@ -3527,6 +3527,12 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry,
    527 int credits;
    528 u8 old_file_type;
    529
    530 + if (new.inode && new.inode->i_nlink == 0) {
    531 + EXT4_ERROR_INODE(new.inode,
    532 + "target of rename is already freed");
    533 + return -EFSCORRUPTED;
    534 + }
    535 +
    536 if ((ext4_test_inode_flag(new_dir, EXT4_INODE_PROJINHERIT)) &&
    537 (!projid_eq(EXT4_I(new_dir)->i_projid,
    538 EXT4_I(old_dentry->d_inode)->i_projid)))
    539 diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
    540 index eb720d9e2953..1da301ee78ce 100644
    541 --- a/fs/ext4/resize.c
    542 +++ b/fs/ext4/resize.c
    543 @@ -18,6 +18,7 @@
    544
    545 int ext4_resize_begin(struct super_block *sb)
    546 {
    547 + struct ext4_sb_info *sbi = EXT4_SB(sb);
    548 int ret = 0;
    549
    550 if (!capable(CAP_SYS_RESOURCE))
    551 @@ -28,7 +29,7 @@ int ext4_resize_begin(struct super_block *sb)
    552 * because the user tools have no way of handling this. Probably a
    553 * bad time to do it anyways.
    554 */
    555 - if (EXT4_SB(sb)->s_sbh->b_blocknr !=
    556 + if (EXT4_B2C(sbi, sbi->s_sbh->b_blocknr) !=
    557 le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block)) {
    558 ext4_warning(sb, "won't resize using backup superblock at %llu",
    559 (unsigned long long)EXT4_SB(sb)->s_sbh->b_blocknr);
    560 @@ -1954,6 +1955,26 @@ retry:
    561 }
    562 }
    563
    564 + /*
    565 + * Make sure the last group has enough space so that it's
    566 + * guaranteed to have enough space for all metadata blocks
    567 + * that it might need to hold. (We might not need to store
    568 + * the inode table blocks in the last block group, but there
    569 + * will be cases where this might be needed.)
    570 + */
    571 + if ((ext4_group_first_block_no(sb, n_group) +
    572 + ext4_group_overhead_blocks(sb, n_group) + 2 +
    573 + sbi->s_itb_per_group + sbi->s_cluster_ratio) >= n_blocks_count) {
    574 + n_blocks_count = ext4_group_first_block_no(sb, n_group);
    575 + n_group--;
    576 + n_blocks_count_retry = 0;
    577 + if (resize_inode) {
    578 + iput(resize_inode);
    579 + resize_inode = NULL;
    580 + }
    581 + goto retry;
    582 + }
    583 +
    584 /* extend the last group */
    585 if (n_group == o_group)
    586 add = n_blocks_count - o_blocks_count;
    587 diff --git a/fs/ext4/super.c b/fs/ext4/super.c
    588 index 9d44b3683b46..f88d4804c3a8 100644
    589 --- a/fs/ext4/super.c
    590 +++ b/fs/ext4/super.c
    591 @@ -2015,6 +2015,8 @@ static int _ext4_show_options(struct seq_file *seq, struct super_block *sb,
    592 SEQ_OPTS_PRINT("max_dir_size_kb=%u", sbi->s_max_dir_size_kb);
    593 if (test_opt(sb, DATA_ERR_ABORT))
    594 SEQ_OPTS_PUTS("data_err=abort");
    595 + if (DUMMY_ENCRYPTION_ENABLED(sbi))
    596 + SEQ_OPTS_PUTS("test_dummy_encryption");
    597
    598 ext4_show_quota_options(seq, sb);
    599 return 0;
    600 @@ -4187,11 +4189,13 @@ no_journal:
    601 block = ext4_count_free_clusters(sb);
    602 ext4_free_blocks_count_set(sbi->s_es,
    603 EXT4_C2B(sbi, block));
    604 + ext4_superblock_csum_set(sb);
    605 err = percpu_counter_init(&sbi->s_freeclusters_counter, block,
    606 GFP_KERNEL);
    607 if (!err) {
    608 unsigned long freei = ext4_count_free_inodes(sb);
    609 sbi->s_es->s_free_inodes_count = cpu_to_le32(freei);
    610 + ext4_superblock_csum_set(sb);
    611 err = percpu_counter_init(&sbi->s_freeinodes_counter, freei,
    612 GFP_KERNEL);
    613 }
    614 diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c
    615 index 8f040f88ade4..25c8b328c43d 100644
    616 --- a/fs/ocfs2/buffer_head_io.c
    617 +++ b/fs/ocfs2/buffer_head_io.c
    618 @@ -341,6 +341,7 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr,
    619 * for this bh as it's not marked locally
    620 * uptodate. */
    621 status = -EIO;
    622 + clear_buffer_needs_validate(bh);
    623 put_bh(bh);
    624 bhs[i] = NULL;
    625 continue;
    626 diff --git a/include/net/nfc/hci.h b/include/net/nfc/hci.h
    627 index 316694dafa5b..008f466d1da7 100644
    628 --- a/include/net/nfc/hci.h
    629 +++ b/include/net/nfc/hci.h
    630 @@ -87,7 +87,7 @@ struct nfc_hci_pipe {
    631 * According to specification 102 622 chapter 4.4 Pipes,
    632 * the pipe identifier is 7 bits long.
    633 */
    634 -#define NFC_HCI_MAX_PIPES 127
    635 +#define NFC_HCI_MAX_PIPES 128
    636 struct nfc_hci_init_data {
    637 u8 gate_count;
    638 struct nfc_hci_gate gates[NFC_HCI_MAX_CUSTOM_GATES];
    639 diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
    640 index f6e8727f7fa3..f81adb476c03 100644
    641 --- a/kernel/sched/fair.c
    642 +++ b/kernel/sched/fair.c
    643 @@ -8639,7 +8639,8 @@ static inline bool vruntime_normalized(struct task_struct *p)
    644 * - A task which has been woken up by try_to_wake_up() and
    645 * waiting for actually being woken up by sched_ttwu_pending().
    646 */
    647 - if (!se->sum_exec_runtime || p->state == TASK_WAKING)
    648 + if (!se->sum_exec_runtime ||
    649 + (p->state == TASK_WAKING && p->sched_remote_wakeup))
    650 return true;
    651
    652 return false;
    653 diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
    654 index dc29b600d2cb..f316e90ad538 100644
    655 --- a/kernel/trace/ring_buffer.c
    656 +++ b/kernel/trace/ring_buffer.c
    657 @@ -1504,6 +1504,8 @@ rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned long nr_pages)
    658 tmp_iter_page = first_page;
    659
    660 do {
    661 + cond_resched();
    662 +
    663 to_remove_page = tmp_iter_page;
    664 rb_inc_page(cpu_buffer, &tmp_iter_page);
    665
    666 diff --git a/mm/shmem.c b/mm/shmem.c
    667 index 42ca5df2c0e3..4b5cca167baf 100644
    668 --- a/mm/shmem.c
    669 +++ b/mm/shmem.c
    670 @@ -2160,6 +2160,8 @@ static struct inode *shmem_get_inode(struct super_block *sb, const struct inode
    671 mpol_shared_policy_init(&info->policy, NULL);
    672 break;
    673 }
    674 +
    675 + lockdep_annotate_inode_mutex_key(inode);
    676 } else
    677 shmem_free_inode(sb);
    678 return inode;
    679 diff --git a/net/core/neighbour.c b/net/core/neighbour.c
    680 index 128c811dcb1a..8eb1916b742c 100644
    681 --- a/net/core/neighbour.c
    682 +++ b/net/core/neighbour.c
    683 @@ -1138,6 +1138,12 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
    684 lladdr = neigh->ha;
    685 }
    686
    687 + /* Update confirmed timestamp for neighbour entry after we
    688 + * received ARP packet even if it doesn't change IP to MAC binding.
    689 + */
    690 + if (new & NUD_CONNECTED)
    691 + neigh->confirmed = jiffies;
    692 +
    693 /* If entry was valid and address is not changed,
    694 do not change entry state, if new one is STALE.
    695 */
    696 @@ -1159,15 +1165,12 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new,
    697 }
    698 }
    699
    700 - /* Update timestamps only once we know we will make a change to the
    701 + /* Update timestamp only once we know we will make a change to the
    702 * neighbour entry. Otherwise we risk to move the locktime window with
    703 * noop updates and ignore relevant ARP updates.
    704 */
    705 - if (new != old || lladdr != neigh->ha) {
    706 - if (new & NUD_CONNECTED)
    707 - neigh->confirmed = jiffies;
    708 + if (new != old || lladdr != neigh->ha)
    709 neigh->updated = jiffies;
    710 - }
    711
    712 if (new != old) {
    713 neigh_del_timer(neigh);
    714 diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
    715 index b5116ec31757..689246d079ad 100644
    716 --- a/net/ipv4/af_inet.c
    717 +++ b/net/ipv4/af_inet.c
    718 @@ -1277,6 +1277,7 @@ struct sk_buff *inet_gso_segment(struct sk_buff *skb,
    719 if (encap)
    720 skb_reset_inner_headers(skb);
    721 skb->network_header = (u8 *)iph - skb->head;
    722 + skb_reset_mac_len(skb);
    723 } while ((skb = skb->next));
    724
    725 out:
    726 diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
    727 index aa2a20e918fd..b9b2a9828d98 100644
    728 --- a/net/ipv4/udp.c
    729 +++ b/net/ipv4/udp.c
    730 @@ -1730,6 +1730,28 @@ static inline int udp4_csum_init(struct sk_buff *skb, struct udphdr *uh,
    731 inet_compute_pseudo);
    732 }
    733
    734 +/* wrapper for udp_queue_rcv_skb tacking care of csum conversion and
    735 + * return code conversion for ip layer consumption
    736 + */
    737 +static int udp_unicast_rcv_skb(struct sock *sk, struct sk_buff *skb,
    738 + struct udphdr *uh)
    739 +{
    740 + int ret;
    741 +
    742 + if (inet_get_convert_csum(sk) && uh->check && !IS_UDPLITE(sk))
    743 + skb_checksum_try_convert(skb, IPPROTO_UDP, uh->check,
    744 + inet_compute_pseudo);
    745 +
    746 + ret = udp_queue_rcv_skb(sk, skb);
    747 +
    748 + /* a return value > 0 means to resubmit the input, but
    749 + * it wants the return to be -protocol, or 0
    750 + */
    751 + if (ret > 0)
    752 + return -ret;
    753 + return 0;
    754 +}
    755 +
    756 /*
    757 * All we need to do is get the socket, and then do a checksum.
    758 */
    759 @@ -1776,14 +1798,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
    760 if (unlikely(sk->sk_rx_dst != dst))
    761 udp_sk_rx_dst_set(sk, dst);
    762
    763 - ret = udp_queue_rcv_skb(sk, skb);
    764 + ret = udp_unicast_rcv_skb(sk, skb, uh);
    765 sock_put(sk);
    766 - /* a return value > 0 means to resubmit the input, but
    767 - * it wants the return to be -protocol, or 0
    768 - */
    769 - if (ret > 0)
    770 - return -ret;
    771 - return 0;
    772 + return ret;
    773 }
    774
    775 if (rt->rt_flags & (RTCF_BROADCAST|RTCF_MULTICAST))
    776 @@ -1791,22 +1808,8 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
    777 saddr, daddr, udptable, proto);
    778
    779 sk = __udp4_lib_lookup_skb(skb, uh->source, uh->dest, udptable);
    780 - if (sk) {
    781 - int ret;
    782 -
    783 - if (inet_get_convert_csum(sk) && uh->check && !IS_UDPLITE(sk))
    784 - skb_checksum_try_convert(skb, IPPROTO_UDP, uh->check,
    785 - inet_compute_pseudo);
    786 -
    787 - ret = udp_queue_rcv_skb(sk, skb);
    788 -
    789 - /* a return value > 0 means to resubmit the input, but
    790 - * it wants the return to be -protocol, or 0
    791 - */
    792 - if (ret > 0)
    793 - return -ret;
    794 - return 0;
    795 - }
    796 + if (sk)
    797 + return udp_unicast_rcv_skb(sk, skb, uh);
    798
    799 if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb))
    800 goto drop;
    801 diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c
    802 index 649f4d87b318..a36ae90bf613 100644
    803 --- a/net/ipv6/ip6_offload.c
    804 +++ b/net/ipv6/ip6_offload.c
    805 @@ -113,6 +113,7 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb,
    806 payload_len = skb->len - nhoff - sizeof(*ipv6h);
    807 ipv6h->payload_len = htons(payload_len);
    808 skb->network_header = (u8 *)ipv6h - skb->head;
    809 + skb_reset_mac_len(skb);
    810
    811 if (udpfrag) {
    812 int err = ip6_find_1stfragopt(skb, &prevhdr);
    813 diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
    814 index ea14466cdca8..8e77cecd2165 100644
    815 --- a/net/ipv6/ip6_output.c
    816 +++ b/net/ipv6/ip6_output.c
    817 @@ -201,12 +201,10 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6,
    818 kfree_skb(skb);
    819 return -ENOBUFS;
    820 }
    821 + if (skb->sk)
    822 + skb_set_owner_w(skb2, skb->sk);
    823 consume_skb(skb);
    824 skb = skb2;
    825 - /* skb_set_owner_w() changes sk->sk_wmem_alloc atomically,
    826 - * it is safe to call in our context (socket lock not held)
    827 - */
    828 - skb_set_owner_w(skb, (struct sock *)sk);
    829 }
    830 if (opt->opt_flen)
    831 ipv6_push_frag_opts(skb, opt, &proto);
    832 diff --git a/net/nfc/hci/core.c b/net/nfc/hci/core.c
    833 index 2b0f0ac498d2..5a58f9f38095 100644
    834 --- a/net/nfc/hci/core.c
    835 +++ b/net/nfc/hci/core.c
    836 @@ -209,6 +209,11 @@ void nfc_hci_cmd_received(struct nfc_hci_dev *hdev, u8 pipe, u8 cmd,
    837 }
    838 create_info = (struct hci_create_pipe_resp *)skb->data;
    839
    840 + if (create_info->pipe >= NFC_HCI_MAX_PIPES) {
    841 + status = NFC_HCI_ANY_E_NOK;
    842 + goto exit;
    843 + }
    844 +
    845 /* Save the new created pipe and bind with local gate,
    846 * the description for skb->data[3] is destination gate id
    847 * but since we received this cmd from host controller, we
    848 @@ -232,6 +237,11 @@ void nfc_hci_cmd_received(struct nfc_hci_dev *hdev, u8 pipe, u8 cmd,
    849 }
    850 delete_info = (struct hci_delete_pipe_noti *)skb->data;
    851
    852 + if (delete_info->pipe >= NFC_HCI_MAX_PIPES) {
    853 + status = NFC_HCI_ANY_E_NOK;
    854 + goto exit;
    855 + }
    856 +
    857 hdev->pipes[delete_info->pipe].gate = NFC_HCI_INVALID_GATE;
    858 hdev->pipes[delete_info->pipe].dest_host = NFC_HCI_INVALID_HOST;
    859 break;
    860 diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c
    861 index 3469ac14c89c..d0dfa822266b 100644
    862 --- a/sound/firewire/bebob/bebob.c
    863 +++ b/sound/firewire/bebob/bebob.c
    864 @@ -263,6 +263,8 @@ do_registration(struct work_struct *work)
    865 error:
    866 mutex_unlock(&devices_mutex);
    867 snd_bebob_stream_destroy_duplex(bebob);
    868 + kfree(bebob->maudio_special_quirk);
    869 + bebob->maudio_special_quirk = NULL;
    870 snd_card_free(bebob->card);
    871 dev_info(&bebob->unit->device,
    872 "Sound card registration failed: %d\n", err);
    873 diff --git a/sound/firewire/bebob/bebob_maudio.c b/sound/firewire/bebob/bebob_maudio.c
    874 index 07e5abdbceb5..6dbf047d4f75 100644
    875 --- a/sound/firewire/bebob/bebob_maudio.c
    876 +++ b/sound/firewire/bebob/bebob_maudio.c
    877 @@ -96,17 +96,13 @@ int snd_bebob_maudio_load_firmware(struct fw_unit *unit)
    878 struct fw_device *device = fw_parent_device(unit);
    879 int err, rcode;
    880 u64 date;
    881 - __le32 cues[3] = {
    882 - cpu_to_le32(MAUDIO_BOOTLOADER_CUE1),
    883 - cpu_to_le32(MAUDIO_BOOTLOADER_CUE2),
    884 - cpu_to_le32(MAUDIO_BOOTLOADER_CUE3)
    885 - };
    886 + __le32 *cues;
    887
    888 /* check date of software used to build */
    889 err = snd_bebob_read_block(unit, INFO_OFFSET_SW_DATE,
    890 &date, sizeof(u64));
    891 if (err < 0)
    892 - goto end;
    893 + return err;
    894 /*
    895 * firmware version 5058 or later has date later than "20070401", but
    896 * 'date' is not null-terminated.
    897 @@ -114,20 +110,28 @@ int snd_bebob_maudio_load_firmware(struct fw_unit *unit)
    898 if (date < 0x3230303730343031LL) {
    899 dev_err(&unit->device,
    900 "Use firmware version 5058 or later\n");
    901 - err = -ENOSYS;
    902 - goto end;
    903 + return -ENXIO;
    904 }
    905
    906 + cues = kmalloc_array(3, sizeof(*cues), GFP_KERNEL);
    907 + if (!cues)
    908 + return -ENOMEM;
    909 +
    910 + cues[0] = cpu_to_le32(MAUDIO_BOOTLOADER_CUE1);
    911 + cues[1] = cpu_to_le32(MAUDIO_BOOTLOADER_CUE2);
    912 + cues[2] = cpu_to_le32(MAUDIO_BOOTLOADER_CUE3);
    913 +
    914 rcode = fw_run_transaction(device->card, TCODE_WRITE_BLOCK_REQUEST,
    915 device->node_id, device->generation,
    916 device->max_speed, BEBOB_ADDR_REG_REQ,
    917 - cues, sizeof(cues));
    918 + cues, 3 * sizeof(*cues));
    919 + kfree(cues);
    920 if (rcode != RCODE_COMPLETE) {
    921 dev_err(&unit->device,
    922 "Failed to send a cue to load firmware\n");
    923 err = -EIO;
    924 }
    925 -end:
    926 +
    927 return err;
    928 }
    929
    930 @@ -290,10 +294,6 @@ snd_bebob_maudio_special_discover(struct snd_bebob *bebob, bool is1814)
    931 bebob->midi_output_ports = 2;
    932 }
    933 end:
    934 - if (err < 0) {
    935 - kfree(params);
    936 - bebob->maudio_special_quirk = NULL;
    937 - }
    938 mutex_unlock(&bebob->mutex);
    939 return err;
    940 }
    941 diff --git a/sound/firewire/digi00x/digi00x.c b/sound/firewire/digi00x/digi00x.c
    942 index 1f5e1d23f31a..ef689997d6a5 100644
    943 --- a/sound/firewire/digi00x/digi00x.c
    944 +++ b/sound/firewire/digi00x/digi00x.c
    945 @@ -49,6 +49,7 @@ static void dg00x_free(struct snd_dg00x *dg00x)
    946 fw_unit_put(dg00x->unit);
    947
    948 mutex_destroy(&dg00x->mutex);
    949 + kfree(dg00x);
    950 }
    951
    952 static void dg00x_card_free(struct snd_card *card)
    953 diff --git a/sound/firewire/fireworks/fireworks.c b/sound/firewire/fireworks/fireworks.c
    954 index 71a0613d3da0..f2d073365cf6 100644
    955 --- a/sound/firewire/fireworks/fireworks.c
    956 +++ b/sound/firewire/fireworks/fireworks.c
    957 @@ -301,6 +301,8 @@ error:
    958 snd_efw_transaction_remove_instance(efw);
    959 snd_efw_stream_destroy_duplex(efw);
    960 snd_card_free(efw->card);
    961 + kfree(efw->resp_buf);
    962 + efw->resp_buf = NULL;
    963 dev_info(&efw->unit->device,
    964 "Sound card registration failed: %d\n", err);
    965 }
    966 diff --git a/sound/firewire/oxfw/oxfw.c b/sound/firewire/oxfw/oxfw.c
    967 index 474b06d8acd1..696b6cf35003 100644
    968 --- a/sound/firewire/oxfw/oxfw.c
    969 +++ b/sound/firewire/oxfw/oxfw.c
    970 @@ -135,6 +135,7 @@ static void oxfw_free(struct snd_oxfw *oxfw)
    971
    972 kfree(oxfw->spec);
    973 mutex_destroy(&oxfw->mutex);
    974 + kfree(oxfw);
    975 }
    976
    977 /*
    978 @@ -212,6 +213,7 @@ static int detect_quirks(struct snd_oxfw *oxfw)
    979 static void do_registration(struct work_struct *work)
    980 {
    981 struct snd_oxfw *oxfw = container_of(work, struct snd_oxfw, dwork.work);
    982 + int i;
    983 int err;
    984
    985 if (oxfw->registered)
    986 @@ -274,7 +276,15 @@ error:
    987 snd_oxfw_stream_destroy_simplex(oxfw, &oxfw->rx_stream);
    988 if (oxfw->has_output)
    989 snd_oxfw_stream_destroy_simplex(oxfw, &oxfw->tx_stream);
    990 + for (i = 0; i < SND_OXFW_STREAM_FORMAT_ENTRIES; ++i) {
    991 + kfree(oxfw->tx_stream_formats[i]);
    992 + oxfw->tx_stream_formats[i] = NULL;
    993 + kfree(oxfw->rx_stream_formats[i]);
    994 + oxfw->rx_stream_formats[i] = NULL;
    995 + }
    996 snd_card_free(oxfw->card);
    997 + kfree(oxfw->spec);
    998 + oxfw->spec = NULL;
    999 dev_info(&oxfw->unit->device,
    1000 "Sound card registration failed: %d\n", err);
    1001 }
    1002 diff --git a/sound/firewire/tascam/tascam.c b/sound/firewire/tascam/tascam.c
    1003 index 9dc93a7eb9da..4c967ac1c0e8 100644
    1004 --- a/sound/firewire/tascam/tascam.c
    1005 +++ b/sound/firewire/tascam/tascam.c
    1006 @@ -93,6 +93,7 @@ static void tscm_free(struct snd_tscm *tscm)
    1007 fw_unit_put(tscm->unit);
    1008
    1009 mutex_destroy(&tscm->mutex);
    1010 + kfree(tscm);
    1011 }
    1012
    1013 static void tscm_card_free(struct snd_card *card)
    1014 diff --git a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c
    1015 index 56fc47bd6dba..50b216fc369f 100644
    1016 --- a/sound/pci/emu10k1/emufx.c
    1017 +++ b/sound/pci/emu10k1/emufx.c
    1018 @@ -2520,7 +2520,7 @@ static int snd_emu10k1_fx8010_ioctl(struct snd_hwdep * hw, struct file *file, un
    1019 emu->support_tlv = 1;
    1020 return put_user(SNDRV_EMU10K1_VERSION, (int __user *)argp);
    1021 case SNDRV_EMU10K1_IOCTL_INFO:
    1022 - info = kmalloc(sizeof(*info), GFP_KERNEL);
    1023 + info = kzalloc(sizeof(*info), GFP_KERNEL);
    1024 if (!info)
    1025 return -ENOMEM;
    1026 snd_emu10k1_fx8010_info(emu, info);
    1027 diff --git a/sound/soc/codecs/cs4265.c b/sound/soc/codecs/cs4265.c
    1028 index fd966bb851cb..6e8eb1f5a041 100644
    1029 --- a/sound/soc/codecs/cs4265.c
    1030 +++ b/sound/soc/codecs/cs4265.c
    1031 @@ -157,8 +157,8 @@ static const struct snd_kcontrol_new cs4265_snd_controls[] = {
    1032 SOC_SINGLE("Validity Bit Control Switch", CS4265_SPDIF_CTL2,
    1033 3, 1, 0),
    1034 SOC_ENUM("SPDIF Mono/Stereo", spdif_mono_stereo_enum),
    1035 - SOC_SINGLE("MMTLR Data Switch", 0,
    1036 - 1, 1, 0),
    1037 + SOC_SINGLE("MMTLR Data Switch", CS4265_SPDIF_CTL2,
    1038 + 0, 1, 0),
    1039 SOC_ENUM("Mono Channel Select", spdif_mono_select_enum),
    1040 SND_SOC_BYTES("C Data Buffer", CS4265_C_DATA_BUFF, 24),
    1041 };