commit: 7ecc929baefbf40295eeec0c6de3dda1343a74df Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Sat Sep 29 13:35:19 2018 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Sat Sep 29 13:35:19 2018 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=7ecc929b
Linux patch 4.14.73 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1072_linux-4.14.73.patch | 1830 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 1834 insertions(+) diff --git a/0000_README b/0000_README index ce833af..08015af 100644 --- a/0000_README +++ b/0000_README @@ -331,6 +331,10 @@ Patch: 1071_linux-4.14.72.patch From: http://www.kernel.org Desc: Linux 4.14.72 +Patch: 1072_linux-4.14.73.patch +From: http://www.kernel.org +Desc: Linux 4.14.73 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1072_linux-4.14.73.patch b/1072_linux-4.14.73.patch new file mode 100644 index 0000000..9020dd3 --- /dev/null +++ b/1072_linux-4.14.73.patch @@ -0,0 +1,1830 @@ +diff --git a/Makefile b/Makefile +index 734722bda173..89f30ca964b6 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,7 +1,7 @@ + # SPDX-License-Identifier: GPL-2.0 + VERSION = 4 + PATCHLEVEL = 14 +-SUBLEVEL = 72 ++SUBLEVEL = 73 + EXTRAVERSION = + NAME = Petit Gorille + +diff --git a/arch/x86/xen/pmu.c b/arch/x86/xen/pmu.c +index 7d00d4ad44d4..95997e6c0696 100644 +--- a/arch/x86/xen/pmu.c ++++ b/arch/x86/xen/pmu.c +@@ -478,7 +478,7 @@ static void xen_convert_regs(const struct xen_pmu_regs *xen_regs, + irqreturn_t xen_pmu_irq_handler(int irq, void *dev_id) + { + int err, ret = IRQ_NONE; +- struct pt_regs regs; ++ struct pt_regs regs = {0}; + const struct xen_pmu_data *xenpmu_data = get_xenpmu_data(); + uint8_t xenpmu_flags = get_xenpmu_flags(); + +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c +index fd435a96481c..e8d9479615c9 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cgs.c +@@ -715,12 +715,14 @@ static int amdgpu_cgs_get_firmware_info(struct cgs_device *cgs_device, + break; + case CHIP_POLARIS10: + if (type == CGS_UCODE_ID_SMU) { +- if ((adev->pdev->device == 0x67df) && +- ((adev->pdev->revision == 0xe0) || +- (adev->pdev->revision == 0xe3) || +- (adev->pdev->revision == 0xe4) || +- (adev->pdev->revision == 0xe5) || +- (adev->pdev->revision == 0xe7) || ++ if (((adev->pdev->device == 0x67df) && ++ ((adev->pdev->revision == 0xe0) || ++ (adev->pdev->revision == 0xe3) || ++ (adev->pdev->revision == 0xe4) || ++ (adev->pdev->revision == 0xe5) || ++ (adev->pdev->revision == 0xe7) || ++ (adev->pdev->revision == 0xef))) || ++ ((adev->pdev->device == 0x6fdf) && + (adev->pdev->revision == 0xef))) { + info->is_kicker = true; + strcpy(fw_name, "amdgpu/polaris10_k_smc.bin"); +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +index 0f16986ec5bc..4dd68d821353 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_drv.c +@@ -500,6 +500,7 @@ static const struct pci_device_id pciidlist[] = { + {0x1002, 0x67CA, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10}, + {0x1002, 0x67CC, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10}, + {0x1002, 0x67CF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10}, ++ {0x1002, 0x6FDF, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS10}, + /* Polaris12 */ + {0x1002, 0x6980, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12}, + {0x1002, 0x6981, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_POLARIS12}, +diff --git a/drivers/gpu/drm/nouveau/nouveau_connector.c b/drivers/gpu/drm/nouveau/nouveau_connector.c +index 430830d63a33..2c6d19683688 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_connector.c ++++ b/drivers/gpu/drm/nouveau/nouveau_connector.c +@@ -570,12 +570,16 @@ nouveau_connector_detect(struct drm_connector *connector, bool force) + nv_connector->edid = NULL; + } + +- /* Outputs are only polled while runtime active, so acquiring a +- * runtime PM ref here is unnecessary (and would deadlock upon +- * runtime suspend because it waits for polling to finish). ++ /* Outputs are only polled while runtime active, so resuming the ++ * device here is unnecessary (and would deadlock upon runtime suspend ++ * because it waits for polling to finish). We do however, want to ++ * prevent the autosuspend timer from elapsing during this operation ++ * if possible. + */ +- if (!drm_kms_helper_is_poll_worker()) { +- ret = pm_runtime_get_sync(connector->dev->dev); ++ if (drm_kms_helper_is_poll_worker()) { ++ pm_runtime_get_noresume(dev->dev); ++ } else { ++ ret = pm_runtime_get_sync(dev->dev); + if (ret < 0 && ret != -EACCES) + return conn_status; + } +@@ -653,10 +657,8 @@ detect_analog: + + out: + +- if (!drm_kms_helper_is_poll_worker()) { +- pm_runtime_mark_last_busy(connector->dev->dev); +- pm_runtime_put_autosuspend(connector->dev->dev); +- } ++ pm_runtime_mark_last_busy(dev->dev); ++ pm_runtime_put_autosuspend(dev->dev); + + return conn_status; + } +@@ -1120,6 +1122,26 @@ nouveau_connector_hotplug(struct nvif_notify *notify) + const struct nvif_notify_conn_rep_v0 *rep = notify->data; + const char *name = connector->name; + struct nouveau_encoder *nv_encoder; ++ int ret; ++ ++ ret = pm_runtime_get(drm->dev->dev); ++ if (ret == 0) { ++ /* We can't block here if there's a pending PM request ++ * running, as we'll deadlock nouveau_display_fini() when it ++ * calls nvif_put() on our nvif_notify struct. So, simply ++ * defer the hotplug event until the device finishes resuming ++ */ ++ NV_DEBUG(drm, "Deferring HPD on %s until runtime resume\n", ++ name); ++ schedule_work(&drm->hpd_work); ++ ++ pm_runtime_put_noidle(drm->dev->dev); ++ return NVIF_NOTIFY_KEEP; ++ } else if (ret != 1 && ret != -EACCES) { ++ NV_WARN(drm, "HPD on %s dropped due to RPM failure: %d\n", ++ name, ret); ++ return NVIF_NOTIFY_DROP; ++ } + + if (rep->mask & NVIF_NOTIFY_CONN_V0_IRQ) { + NV_DEBUG(drm, "service %s\n", name); +@@ -1137,6 +1159,8 @@ nouveau_connector_hotplug(struct nvif_notify *notify) + drm_helper_hpd_irq_event(connector->dev); + } + ++ pm_runtime_mark_last_busy(drm->dev->dev); ++ pm_runtime_put_autosuspend(drm->dev->dev); + return NVIF_NOTIFY_KEEP; + } + +diff --git a/drivers/gpu/drm/nouveau/nouveau_display.c b/drivers/gpu/drm/nouveau/nouveau_display.c +index caf53503c0f7..2612702c3a3f 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_display.c ++++ b/drivers/gpu/drm/nouveau/nouveau_display.c +@@ -356,8 +356,6 @@ nouveau_display_hpd_work(struct work_struct *work) + pm_runtime_get_sync(drm->dev->dev); + + drm_helper_hpd_irq_event(drm->dev); +- /* enable polling for external displays */ +- drm_kms_helper_poll_enable(drm->dev); + + pm_runtime_mark_last_busy(drm->dev->dev); + pm_runtime_put_sync(drm->dev->dev); +@@ -380,15 +378,29 @@ nouveau_display_acpi_ntfy(struct notifier_block *nb, unsigned long val, + { + struct nouveau_drm *drm = container_of(nb, typeof(*drm), acpi_nb); + struct acpi_bus_event *info = data; ++ int ret; + + if (!strcmp(info->device_class, ACPI_VIDEO_CLASS)) { + if (info->type == ACPI_VIDEO_NOTIFY_PROBE) { +- /* +- * This may be the only indication we receive of a +- * connector hotplug on a runtime suspended GPU, +- * schedule hpd_work to check. +- */ +- schedule_work(&drm->hpd_work); ++ ret = pm_runtime_get(drm->dev->dev); ++ if (ret == 1 || ret == -EACCES) { ++ /* If the GPU is already awake, or in a state ++ * where we can't wake it up, it can handle ++ * it's own hotplug events. ++ */ ++ pm_runtime_put_autosuspend(drm->dev->dev); ++ } else if (ret == 0) { ++ /* This may be the only indication we receive ++ * of a connector hotplug on a runtime ++ * suspended GPU, schedule hpd_work to check. ++ */ ++ NV_DEBUG(drm, "ACPI requested connector reprobe\n"); ++ schedule_work(&drm->hpd_work); ++ pm_runtime_put_noidle(drm->dev->dev); ++ } else { ++ NV_WARN(drm, "Dropped ACPI reprobe event due to RPM error: %d\n", ++ ret); ++ } + + /* acpi-video should not generate keypresses for this */ + return NOTIFY_BAD; +@@ -412,6 +424,11 @@ nouveau_display_init(struct drm_device *dev) + if (ret) + return ret; + ++ /* enable connector detection and polling for connectors without HPD ++ * support ++ */ ++ drm_kms_helper_poll_enable(dev); ++ + /* enable hotplug interrupts */ + drm_connector_list_iter_begin(dev, &conn_iter); + nouveau_for_each_non_mst_connector_iter(connector, &conn_iter) { +@@ -426,7 +443,7 @@ nouveau_display_init(struct drm_device *dev) + } + + void +-nouveau_display_fini(struct drm_device *dev, bool suspend) ++nouveau_display_fini(struct drm_device *dev, bool suspend, bool runtime) + { + struct nouveau_display *disp = nouveau_display(dev); + struct nouveau_drm *drm = nouveau_drm(dev); +@@ -451,6 +468,9 @@ nouveau_display_fini(struct drm_device *dev, bool suspend) + } + drm_connector_list_iter_end(&conn_iter); + ++ if (!runtime) ++ cancel_work_sync(&drm->hpd_work); ++ + drm_kms_helper_poll_disable(dev); + disp->fini(dev); + } +@@ -640,11 +660,11 @@ nouveau_display_suspend(struct drm_device *dev, bool runtime) + } + } + +- nouveau_display_fini(dev, true); ++ nouveau_display_fini(dev, true, runtime); + return 0; + } + +- nouveau_display_fini(dev, true); ++ nouveau_display_fini(dev, true, runtime); + + list_for_each_entry(crtc, &dev->mode_config.crtc_list, head) { + struct nouveau_framebuffer *nouveau_fb; +diff --git a/drivers/gpu/drm/nouveau/nouveau_display.h b/drivers/gpu/drm/nouveau/nouveau_display.h +index 34cd144681b9..5e7dae79c2ee 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_display.h ++++ b/drivers/gpu/drm/nouveau/nouveau_display.h +@@ -64,7 +64,7 @@ nouveau_display(struct drm_device *dev) + int nouveau_display_create(struct drm_device *dev); + void nouveau_display_destroy(struct drm_device *dev); + int nouveau_display_init(struct drm_device *dev); +-void nouveau_display_fini(struct drm_device *dev, bool suspend); ++void nouveau_display_fini(struct drm_device *dev, bool suspend, bool runtime); + int nouveau_display_suspend(struct drm_device *dev, bool runtime); + void nouveau_display_resume(struct drm_device *dev, bool runtime); + int nouveau_display_vblank_enable(struct drm_device *, unsigned int); +diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c +index d6f13d7254de..7d3c7bb0ebfa 100644 +--- a/drivers/gpu/drm/nouveau/nouveau_drm.c ++++ b/drivers/gpu/drm/nouveau/nouveau_drm.c +@@ -546,7 +546,7 @@ nouveau_drm_unload(struct drm_device *dev) + nouveau_debugfs_fini(drm); + + if (dev->mode_config.num_crtc) +- nouveau_display_fini(dev, false); ++ nouveau_display_fini(dev, false, false); + nouveau_display_destroy(dev); + + nouveau_bios_takedown(dev); +diff --git a/drivers/gpu/drm/udl/udl_fb.c b/drivers/gpu/drm/udl/udl_fb.c +index 8746eeeec44d..491f1892b50e 100644 +--- a/drivers/gpu/drm/udl/udl_fb.c ++++ b/drivers/gpu/drm/udl/udl_fb.c +@@ -432,9 +432,11 @@ static void udl_fbdev_destroy(struct drm_device *dev, + { + drm_fb_helper_unregister_fbi(&ufbdev->helper); + drm_fb_helper_fini(&ufbdev->helper); +- drm_framebuffer_unregister_private(&ufbdev->ufb.base); +- drm_framebuffer_cleanup(&ufbdev->ufb.base); +- drm_gem_object_put_unlocked(&ufbdev->ufb.obj->base); ++ if (ufbdev->ufb.obj) { ++ drm_framebuffer_unregister_private(&ufbdev->ufb.base); ++ drm_framebuffer_cleanup(&ufbdev->ufb.base); ++ drm_gem_object_put_unlocked(&ufbdev->ufb.obj->base); ++ } + } + + int udl_fbdev_init(struct drm_device *dev) +diff --git a/drivers/gpu/drm/vc4/vc4_plane.c b/drivers/gpu/drm/vc4/vc4_plane.c +index 17590cb2b80d..502c7eb708c2 100644 +--- a/drivers/gpu/drm/vc4/vc4_plane.c ++++ b/drivers/gpu/drm/vc4/vc4_plane.c +@@ -329,6 +329,9 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state) + vc4_state->y_scaling[0] = vc4_get_scaling_mode(vc4_state->src_h[0], + vc4_state->crtc_h); + ++ vc4_state->is_unity = (vc4_state->x_scaling[0] == VC4_SCALING_NONE && ++ vc4_state->y_scaling[0] == VC4_SCALING_NONE); ++ + if (num_planes > 1) { + vc4_state->is_yuv = true; + +@@ -344,24 +347,17 @@ static int vc4_plane_setup_clipping_and_scaling(struct drm_plane_state *state) + vc4_get_scaling_mode(vc4_state->src_h[1], + vc4_state->crtc_h); + +- /* YUV conversion requires that scaling be enabled, +- * even on a plane that's otherwise 1:1. Choose TPZ +- * for simplicity. ++ /* YUV conversion requires that horizontal scaling be enabled, ++ * even on a plane that's otherwise 1:1. Looks like only PPF ++ * works in that case, so let's pick that one. + */ +- if (vc4_state->x_scaling[0] == VC4_SCALING_NONE) +- vc4_state->x_scaling[0] = VC4_SCALING_TPZ; +- if (vc4_state->y_scaling[0] == VC4_SCALING_NONE) +- vc4_state->y_scaling[0] = VC4_SCALING_TPZ; ++ if (vc4_state->is_unity) ++ vc4_state->x_scaling[0] = VC4_SCALING_PPF; + } else { + vc4_state->x_scaling[1] = VC4_SCALING_NONE; + vc4_state->y_scaling[1] = VC4_SCALING_NONE; + } + +- vc4_state->is_unity = (vc4_state->x_scaling[0] == VC4_SCALING_NONE && +- vc4_state->y_scaling[0] == VC4_SCALING_NONE && +- vc4_state->x_scaling[1] == VC4_SCALING_NONE && +- vc4_state->y_scaling[1] == VC4_SCALING_NONE); +- + /* No configuring scaling on the cursor plane, since it gets + non-vblank-synced updates, and scaling requires requires + LBM changes which have to be vblank-synced. +@@ -639,7 +635,10 @@ static int vc4_plane_mode_set(struct drm_plane *plane, + vc4_dlist_write(vc4_state, SCALER_CSC2_ITR_R_601_5); + } + +- if (!vc4_state->is_unity) { ++ if (vc4_state->x_scaling[0] != VC4_SCALING_NONE || ++ vc4_state->x_scaling[1] != VC4_SCALING_NONE || ++ vc4_state->y_scaling[0] != VC4_SCALING_NONE || ++ vc4_state->y_scaling[1] != VC4_SCALING_NONE) { + /* LBM Base Address. */ + if (vc4_state->y_scaling[0] != VC4_SCALING_NONE || + vc4_state->y_scaling[1] != VC4_SCALING_NONE) { +diff --git a/drivers/infiniband/hw/cxgb4/qp.c b/drivers/infiniband/hw/cxgb4/qp.c +index a8a8f65a1e51..24952af51a54 100644 +--- a/drivers/infiniband/hw/cxgb4/qp.c ++++ b/drivers/infiniband/hw/cxgb4/qp.c +@@ -1395,6 +1395,12 @@ static void flush_qp(struct c4iw_qp *qhp) + schp = to_c4iw_cq(qhp->ibqp.send_cq); + + if (qhp->ibqp.uobject) { ++ ++ /* for user qps, qhp->wq.flushed is protected by qhp->mutex */ ++ if (qhp->wq.flushed) ++ return; ++ ++ qhp->wq.flushed = 1; + t4_set_wq_in_error(&qhp->wq); + t4_set_cq_in_error(&rchp->cq); + spin_lock_irqsave(&rchp->comp_handler_lock, flag); +diff --git a/drivers/misc/vmw_balloon.c b/drivers/misc/vmw_balloon.c +index 5f8b583c6e41..f74166aa9a0d 100644 +--- a/drivers/misc/vmw_balloon.c ++++ b/drivers/misc/vmw_balloon.c +@@ -45,6 +45,7 @@ + #include <linux/seq_file.h> + #include <linux/vmw_vmci_defs.h> + #include <linux/vmw_vmci_api.h> ++#include <linux/io.h> + #include <asm/hypervisor.h> + + MODULE_AUTHOR("VMware, Inc."); +diff --git a/drivers/net/appletalk/ipddp.c b/drivers/net/appletalk/ipddp.c +index 9375cef22420..3d27616d9c85 100644 +--- a/drivers/net/appletalk/ipddp.c ++++ b/drivers/net/appletalk/ipddp.c +@@ -283,8 +283,12 @@ static int ipddp_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) + case SIOCFINDIPDDPRT: + spin_lock_bh(&ipddp_route_lock); + rp = __ipddp_find_route(&rcp); +- if (rp) +- memcpy(&rcp2, rp, sizeof(rcp2)); ++ if (rp) { ++ memset(&rcp2, 0, sizeof(rcp2)); ++ rcp2.ip = rp->ip; ++ rcp2.at = rp->at; ++ rcp2.flags = rp->flags; ++ } + spin_unlock_bh(&ipddp_route_lock); + + if (rp) { +diff --git a/drivers/net/ethernet/hp/hp100.c b/drivers/net/ethernet/hp/hp100.c +index c8c7ad2eff77..9b5a68b65432 100644 +--- a/drivers/net/ethernet/hp/hp100.c ++++ b/drivers/net/ethernet/hp/hp100.c +@@ -2634,7 +2634,7 @@ static int hp100_login_to_vg_hub(struct net_device *dev, u_short force_relogin) + /* Wait for link to drop */ + time = jiffies + (HZ / 10); + do { +- if (~(hp100_inb(VG_LAN_CFG_1) & HP100_LINK_UP_ST)) ++ if (!(hp100_inb(VG_LAN_CFG_1) & HP100_LINK_UP_ST)) + break; + if (!in_interrupt()) + schedule_timeout_interruptible(1); +diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c +index 71e2aef6b7a1..951892da3352 100644 +--- a/drivers/net/ppp/pppoe.c ++++ b/drivers/net/ppp/pppoe.c +@@ -429,6 +429,9 @@ static int pppoe_rcv(struct sk_buff *skb, struct net_device *dev, + if (!skb) + goto out; + ++ if (skb_mac_header_len(skb) < ETH_HLEN) ++ goto drop; ++ + if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr))) + goto drop; + +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 31684f3382f6..c5d4b35bb72a 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -1205,13 +1205,13 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x1199, 0x9061, 8)}, /* Sierra Wireless Modem */ + {QMI_FIXED_INTF(0x1199, 0x9063, 8)}, /* Sierra Wireless EM7305 */ + {QMI_FIXED_INTF(0x1199, 0x9063, 10)}, /* Sierra Wireless EM7305 */ +- {QMI_FIXED_INTF(0x1199, 0x9071, 8)}, /* Sierra Wireless MC74xx */ +- {QMI_FIXED_INTF(0x1199, 0x9071, 10)}, /* Sierra Wireless MC74xx */ +- {QMI_FIXED_INTF(0x1199, 0x9079, 8)}, /* Sierra Wireless EM74xx */ +- {QMI_FIXED_INTF(0x1199, 0x9079, 10)}, /* Sierra Wireless EM74xx */ +- {QMI_FIXED_INTF(0x1199, 0x907b, 8)}, /* Sierra Wireless EM74xx */ +- {QMI_FIXED_INTF(0x1199, 0x907b, 10)}, /* Sierra Wireless EM74xx */ +- {QMI_FIXED_INTF(0x1199, 0x9091, 8)}, /* Sierra Wireless EM7565 */ ++ {QMI_QUIRK_SET_DTR(0x1199, 0x9071, 8)}, /* Sierra Wireless MC74xx */ ++ {QMI_QUIRK_SET_DTR(0x1199, 0x9071, 10)},/* Sierra Wireless MC74xx */ ++ {QMI_QUIRK_SET_DTR(0x1199, 0x9079, 8)}, /* Sierra Wireless EM74xx */ ++ {QMI_QUIRK_SET_DTR(0x1199, 0x9079, 10)},/* Sierra Wireless EM74xx */ ++ {QMI_QUIRK_SET_DTR(0x1199, 0x907b, 8)}, /* Sierra Wireless EM74xx */ ++ {QMI_QUIRK_SET_DTR(0x1199, 0x907b, 10)},/* Sierra Wireless EM74xx */ ++ {QMI_QUIRK_SET_DTR(0x1199, 0x9091, 8)}, /* Sierra Wireless EM7565 */ + {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)}, /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */ + {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)}, /* Alcatel L800MA */ + {QMI_FIXED_INTF(0x2357, 0x0201, 4)}, /* TP-LINK HSUPA Modem MA180 */ +diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c +index d80343429de5..1a40fc3517a8 100644 +--- a/drivers/net/xen-netfront.c ++++ b/drivers/net/xen-netfront.c +@@ -907,7 +907,11 @@ static RING_IDX xennet_fill_frags(struct netfront_queue *queue, + BUG_ON(pull_to <= skb_headlen(skb)); + __pskb_pull_tail(skb, pull_to - skb_headlen(skb)); + } +- BUG_ON(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS); ++ if (unlikely(skb_shinfo(skb)->nr_frags >= MAX_SKB_FRAGS)) { ++ queue->rx.rsp_cons = ++cons; ++ kfree_skb(nskb); ++ return ~0U; ++ } + + skb_add_rx_frag(skb, skb_shinfo(skb)->nr_frags, + skb_frag_page(nfrag), +@@ -1044,6 +1048,8 @@ err: + skb->len += rx->status; + + i = xennet_fill_frags(queue, skb, &tmpq); ++ if (unlikely(i == ~0U)) ++ goto err; + + if (rx->flags & XEN_NETRXF_csum_blank) + skb->ip_summed = CHECKSUM_PARTIAL; +diff --git a/drivers/pci/host/pci-aardvark.c b/drivers/pci/host/pci-aardvark.c +index 9bfc22b5da4b..5f3048e75bec 100644 +--- a/drivers/pci/host/pci-aardvark.c ++++ b/drivers/pci/host/pci-aardvark.c +@@ -954,6 +954,7 @@ static int advk_pcie_probe(struct platform_device *pdev) + + bus = bridge->bus; + ++ pci_bus_size_bridges(bus); + pci_bus_assign_resources(bus); + + list_for_each_entry(child, &bus->children, node) +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index ec2911c4ee42..35c9b2f4b293 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -4388,11 +4388,6 @@ static int pci_quirk_qcom_rp_acs(struct pci_dev *dev, u16 acs_flags) + * + * 0x9d10-0x9d1b PCI Express Root port #{1-12} + * +- * The 300 series chipset suffers from the same bug so include those root +- * ports here as well. +- * +- * 0xa32c-0xa343 PCI Express Root port #{0-24} +- * + * [1] http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-datasheet-vol-2.html + * [2] http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-datasheet-vol-1.html + * [3] http://www.intel.com/content/www/us/en/chipsets/100-series-chipset-spec-update.html +@@ -4410,7 +4405,6 @@ static bool pci_quirk_intel_spt_pch_acs_match(struct pci_dev *dev) + case 0xa110 ... 0xa11f: case 0xa167 ... 0xa16a: /* Sunrise Point */ + case 0xa290 ... 0xa29f: case 0xa2e7 ... 0xa2ee: /* Union Point */ + case 0x9d10 ... 0x9d1b: /* 7th & 8th Gen Mobile */ +- case 0xa32c ... 0xa343: /* 300 series */ + return true; + } + +diff --git a/drivers/platform/x86/alienware-wmi.c b/drivers/platform/x86/alienware-wmi.c +index 4eb8e1a472b2..e335b18da20f 100644 +--- a/drivers/platform/x86/alienware-wmi.c ++++ b/drivers/platform/x86/alienware-wmi.c +@@ -519,6 +519,7 @@ static acpi_status alienware_wmax_command(struct wmax_basic_args *in_args, + if (obj && obj->type == ACPI_TYPE_INTEGER) + *out_data = (u32) obj->integer.value; + } ++ kfree(output.pointer); + return status; + + } +diff --git a/drivers/rpmsg/rpmsg_core.c b/drivers/rpmsg/rpmsg_core.c +index cec4c3223044..dffa3aab7178 100644 +--- a/drivers/rpmsg/rpmsg_core.c ++++ b/drivers/rpmsg/rpmsg_core.c +@@ -23,7 +23,6 @@ + #include <linux/module.h> + #include <linux/rpmsg.h> + #include <linux/of_device.h> +-#include <linux/pm_domain.h> + #include <linux/slab.h> + + #include "rpmsg_internal.h" +@@ -419,10 +418,6 @@ static int rpmsg_dev_probe(struct device *dev) + struct rpmsg_endpoint *ept = NULL; + int err; + +- err = dev_pm_domain_attach(dev, true); +- if (err) +- goto out; +- + if (rpdrv->callback) { + strncpy(chinfo.name, rpdev->id.name, RPMSG_NAME_SIZE); + chinfo.src = rpdev->src; +@@ -464,8 +459,6 @@ static int rpmsg_dev_remove(struct device *dev) + + rpdrv->remove(rpdev); + +- dev_pm_domain_detach(dev, true); +- + if (rpdev->ept) + rpmsg_destroy_ept(rpdev->ept); + +diff --git a/drivers/spi/spi.c b/drivers/spi/spi.c +index f85d30dc9187..670dbb7a8500 100644 +--- a/drivers/spi/spi.c ++++ b/drivers/spi/spi.c +@@ -2108,8 +2108,17 @@ int spi_register_controller(struct spi_controller *ctlr) + */ + if (ctlr->num_chipselect == 0) + return -EINVAL; +- /* allocate dynamic bus number using Linux idr */ +- if ((ctlr->bus_num < 0) && ctlr->dev.of_node) { ++ if (ctlr->bus_num >= 0) { ++ /* devices with a fixed bus num must check-in with the num */ ++ mutex_lock(&board_lock); ++ id = idr_alloc(&spi_master_idr, ctlr, ctlr->bus_num, ++ ctlr->bus_num + 1, GFP_KERNEL); ++ mutex_unlock(&board_lock); ++ if (WARN(id < 0, "couldn't get idr")) ++ return id == -ENOSPC ? -EBUSY : id; ++ ctlr->bus_num = id; ++ } else if (ctlr->dev.of_node) { ++ /* allocate dynamic bus number using Linux idr */ + id = of_alias_get_id(ctlr->dev.of_node, "spi"); + if (id >= 0) { + ctlr->bus_num = id; +diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c +index 9518ffd8b8ba..4e680d753941 100644 +--- a/drivers/target/iscsi/iscsi_target_auth.c ++++ b/drivers/target/iscsi/iscsi_target_auth.c +@@ -26,27 +26,6 @@ + #include "iscsi_target_nego.h" + #include "iscsi_target_auth.h" + +-static int chap_string_to_hex(unsigned char *dst, unsigned char *src, int len) +-{ +- int j = DIV_ROUND_UP(len, 2), rc; +- +- rc = hex2bin(dst, src, j); +- if (rc < 0) +- pr_debug("CHAP string contains non hex digit symbols\n"); +- +- dst[j] = '\0'; +- return j; +-} +- +-static void chap_binaryhex_to_asciihex(char *dst, char *src, int src_len) +-{ +- int i; +- +- for (i = 0; i < src_len; i++) { +- sprintf(&dst[i*2], "%02x", (int) src[i] & 0xff); +- } +-} +- + static int chap_gen_challenge( + struct iscsi_conn *conn, + int caller, +@@ -62,7 +41,7 @@ static int chap_gen_challenge( + ret = get_random_bytes_wait(chap->challenge, CHAP_CHALLENGE_LENGTH); + if (unlikely(ret)) + return ret; +- chap_binaryhex_to_asciihex(challenge_asciihex, chap->challenge, ++ bin2hex(challenge_asciihex, chap->challenge, + CHAP_CHALLENGE_LENGTH); + /* + * Set CHAP_C, and copy the generated challenge into c_str. +@@ -248,9 +227,16 @@ static int chap_server_compute_md5( + pr_err("Could not find CHAP_R.\n"); + goto out; + } ++ if (strlen(chap_r) != MD5_SIGNATURE_SIZE * 2) { ++ pr_err("Malformed CHAP_R\n"); ++ goto out; ++ } ++ if (hex2bin(client_digest, chap_r, MD5_SIGNATURE_SIZE) < 0) { ++ pr_err("Malformed CHAP_R\n"); ++ goto out; ++ } + + pr_debug("[server] Got CHAP_R=%s\n", chap_r); +- chap_string_to_hex(client_digest, chap_r, strlen(chap_r)); + + tfm = crypto_alloc_shash("md5", 0, 0); + if (IS_ERR(tfm)) { +@@ -294,7 +280,7 @@ static int chap_server_compute_md5( + goto out; + } + +- chap_binaryhex_to_asciihex(response, server_digest, MD5_SIGNATURE_SIZE); ++ bin2hex(response, server_digest, MD5_SIGNATURE_SIZE); + pr_debug("[server] MD5 Server Digest: %s\n", response); + + if (memcmp(server_digest, client_digest, MD5_SIGNATURE_SIZE) != 0) { +@@ -349,9 +335,7 @@ static int chap_server_compute_md5( + pr_err("Could not find CHAP_C.\n"); + goto out; + } +- pr_debug("[server] Got CHAP_C=%s\n", challenge); +- challenge_len = chap_string_to_hex(challenge_binhex, challenge, +- strlen(challenge)); ++ challenge_len = DIV_ROUND_UP(strlen(challenge), 2); + if (!challenge_len) { + pr_err("Unable to convert incoming challenge\n"); + goto out; +@@ -360,6 +344,11 @@ static int chap_server_compute_md5( + pr_err("CHAP_C exceeds maximum binary size of 1024 bytes\n"); + goto out; + } ++ if (hex2bin(challenge_binhex, challenge, challenge_len) < 0) { ++ pr_err("Malformed CHAP_C\n"); ++ goto out; ++ } ++ pr_debug("[server] Got CHAP_C=%s\n", challenge); + /* + * During mutual authentication, the CHAP_C generated by the + * initiator must not match the original CHAP_C generated by +@@ -413,7 +402,7 @@ static int chap_server_compute_md5( + /* + * Convert response from binary hex to ascii hext. + */ +- chap_binaryhex_to_asciihex(response, digest, MD5_SIGNATURE_SIZE); ++ bin2hex(response, digest, MD5_SIGNATURE_SIZE); + *nr_out_len += sprintf(nr_out_ptr + *nr_out_len, "CHAP_R=0x%s", + response); + *nr_out_len += 1; +diff --git a/drivers/tty/vt/vt_ioctl.c b/drivers/tty/vt/vt_ioctl.c +index 2d2b420598b2..7b34b0ddbf0e 100644 +--- a/drivers/tty/vt/vt_ioctl.c ++++ b/drivers/tty/vt/vt_ioctl.c +@@ -32,6 +32,8 @@ + #include <asm/io.h> + #include <linux/uaccess.h> + ++#include <linux/nospec.h> ++ + #include <linux/kbd_kern.h> + #include <linux/vt_kern.h> + #include <linux/kbd_diacr.h> +@@ -700,6 +702,8 @@ int vt_ioctl(struct tty_struct *tty, + if (vsa.console == 0 || vsa.console > MAX_NR_CONSOLES) + ret = -ENXIO; + else { ++ vsa.console = array_index_nospec(vsa.console, ++ MAX_NR_CONSOLES + 1); + vsa.console--; + console_lock(); + ret = vc_allocate(vsa.console); +diff --git a/fs/ext4/dir.c b/fs/ext4/dir.c +index d5babc9f222b..dc676714454a 100644 +--- a/fs/ext4/dir.c ++++ b/fs/ext4/dir.c +@@ -75,7 +75,7 @@ int __ext4_check_dir_entry(const char *function, unsigned int line, + else if (unlikely(rlen < EXT4_DIR_REC_LEN(de->name_len))) + error_msg = "rec_len is too small for name_len"; + else if (unlikely(((char *) de - buf) + rlen > size)) +- error_msg = "directory entry across range"; ++ error_msg = "directory entry overrun"; + else if (unlikely(le32_to_cpu(de->inode) > + le32_to_cpu(EXT4_SB(dir->i_sb)->s_es->s_inodes_count))) + error_msg = "inode out of bounds"; +@@ -84,18 +84,16 @@ int __ext4_check_dir_entry(const char *function, unsigned int line, + + if (filp) + ext4_error_file(filp, function, line, bh->b_blocknr, +- "bad entry in directory: %s - offset=%u(%u), " +- "inode=%u, rec_len=%d, name_len=%d", +- error_msg, (unsigned) (offset % size), +- offset, le32_to_cpu(de->inode), +- rlen, de->name_len); ++ "bad entry in directory: %s - offset=%u, " ++ "inode=%u, rec_len=%d, name_len=%d, size=%d", ++ error_msg, offset, le32_to_cpu(de->inode), ++ rlen, de->name_len, size); + else + ext4_error_inode(dir, function, line, bh->b_blocknr, +- "bad entry in directory: %s - offset=%u(%u), " +- "inode=%u, rec_len=%d, name_len=%d", +- error_msg, (unsigned) (offset % size), +- offset, le32_to_cpu(de->inode), +- rlen, de->name_len); ++ "bad entry in directory: %s - offset=%u, " ++ "inode=%u, rec_len=%d, name_len=%d, size=%d", ++ error_msg, offset, le32_to_cpu(de->inode), ++ rlen, de->name_len, size); + + return 1; + } +diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h +index 0abb30d19fa1..c96778c39885 100644 +--- a/fs/ext4/ext4.h ++++ b/fs/ext4/ext4.h +@@ -714,6 +714,9 @@ struct fsxattr { + /* Max physical block we can address w/o extents */ + #define EXT4_MAX_BLOCK_FILE_PHYS 0xFFFFFFFF + ++/* Max logical block we can support */ ++#define EXT4_MAX_LOGICAL_BLOCK 0xFFFFFFFF ++ + /* + * Structure of an inode on the disk + */ +diff --git a/fs/ext4/inline.c b/fs/ext4/inline.c +index b549cfd2d7d3..4e1d62ba0703 100644 +--- a/fs/ext4/inline.c ++++ b/fs/ext4/inline.c +@@ -1759,6 +1759,7 @@ bool empty_inline_dir(struct inode *dir, int *has_inline_data) + { + int err, inline_size; + struct ext4_iloc iloc; ++ size_t inline_len; + void *inline_pos; + unsigned int offset; + struct ext4_dir_entry_2 *de; +@@ -1786,8 +1787,9 @@ bool empty_inline_dir(struct inode *dir, int *has_inline_data) + goto out; + } + ++ inline_len = ext4_get_inline_size(dir); + offset = EXT4_INLINE_DOTDOT_SIZE; +- while (offset < dir->i_size) { ++ while (offset < inline_len) { + de = ext4_get_inline_entry(dir, &iloc, offset, + &inline_pos, &inline_size); + if (ext4_check_dir_entry(dir, NULL, de, +diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c +index f9baa59de0e2..9808df52ceca 100644 +--- a/fs/ext4/inode.c ++++ b/fs/ext4/inode.c +@@ -3407,11 +3407,16 @@ static int ext4_iomap_begin(struct inode *inode, loff_t offset, loff_t length, + { + struct ext4_sb_info *sbi = EXT4_SB(inode->i_sb); + unsigned int blkbits = inode->i_blkbits; +- unsigned long first_block = offset >> blkbits; +- unsigned long last_block = (offset + length - 1) >> blkbits; ++ unsigned long first_block, last_block; + struct ext4_map_blocks map; + int ret; + ++ if ((offset >> blkbits) > EXT4_MAX_LOGICAL_BLOCK) ++ return -EINVAL; ++ first_block = offset >> blkbits; ++ last_block = min_t(loff_t, (offset + length - 1) >> blkbits, ++ EXT4_MAX_LOGICAL_BLOCK); ++ + if (WARN_ON_ONCE(ext4_has_inline_data(inode))) + return -ERANGE; + +diff --git a/fs/ext4/mmp.c b/fs/ext4/mmp.c +index 638ad4743477..38e6a846aac1 100644 +--- a/fs/ext4/mmp.c ++++ b/fs/ext4/mmp.c +@@ -49,7 +49,6 @@ static int write_mmp_block(struct super_block *sb, struct buffer_head *bh) + */ + sb_start_write(sb); + ext4_mmp_csum_set(sb, mmp); +- mark_buffer_dirty(bh); + lock_buffer(bh); + bh->b_end_io = end_buffer_write_sync; + get_bh(bh); +diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c +index 1db39e12e02b..eb0d8ee39827 100644 +--- a/fs/ext4/namei.c ++++ b/fs/ext4/namei.c +@@ -3514,6 +3514,12 @@ static int ext4_rename(struct inode *old_dir, struct dentry *old_dentry, + int credits; + u8 old_file_type; + ++ if (new.inode && new.inode->i_nlink == 0) { ++ EXT4_ERROR_INODE(new.inode, ++ "target of rename is already freed"); ++ return -EFSCORRUPTED; ++ } ++ + if ((ext4_test_inode_flag(new_dir, EXT4_INODE_PROJINHERIT)) && + (!projid_eq(EXT4_I(new_dir)->i_projid, + EXT4_I(old_dentry->d_inode)->i_projid))) +diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c +index 823c0b82dfeb..e344e606c054 100644 +--- a/fs/ext4/resize.c ++++ b/fs/ext4/resize.c +@@ -19,6 +19,7 @@ + + int ext4_resize_begin(struct super_block *sb) + { ++ struct ext4_sb_info *sbi = EXT4_SB(sb); + int ret = 0; + + if (!capable(CAP_SYS_RESOURCE)) +@@ -29,7 +30,7 @@ int ext4_resize_begin(struct super_block *sb) + * because the user tools have no way of handling this. Probably a + * bad time to do it anyways. + */ +- if (EXT4_SB(sb)->s_sbh->b_blocknr != ++ if (EXT4_B2C(sbi, sbi->s_sbh->b_blocknr) != + le32_to_cpu(EXT4_SB(sb)->s_es->s_first_data_block)) { + ext4_warning(sb, "won't resize using backup superblock at %llu", + (unsigned long long)EXT4_SB(sb)->s_sbh->b_blocknr); +@@ -1956,6 +1957,26 @@ retry: + } + } + ++ /* ++ * Make sure the last group has enough space so that it's ++ * guaranteed to have enough space for all metadata blocks ++ * that it might need to hold. (We might not need to store ++ * the inode table blocks in the last block group, but there ++ * will be cases where this might be needed.) ++ */ ++ if ((ext4_group_first_block_no(sb, n_group) + ++ ext4_group_overhead_blocks(sb, n_group) + 2 + ++ sbi->s_itb_per_group + sbi->s_cluster_ratio) >= n_blocks_count) { ++ n_blocks_count = ext4_group_first_block_no(sb, n_group); ++ n_group--; ++ n_blocks_count_retry = 0; ++ if (resize_inode) { ++ iput(resize_inode); ++ resize_inode = NULL; ++ } ++ goto retry; ++ } ++ + /* extend the last group */ + if (n_group == o_group) + add = n_blocks_count - o_blocks_count; +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index b4fb085261fd..9dbd27f7b778 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -2085,6 +2085,8 @@ static int _ext4_show_options(struct seq_file *seq, struct super_block *sb, + SEQ_OPTS_PRINT("max_dir_size_kb=%u", sbi->s_max_dir_size_kb); + if (test_opt(sb, DATA_ERR_ABORT)) + SEQ_OPTS_PUTS("data_err=abort"); ++ if (DUMMY_ENCRYPTION_ENABLED(sbi)) ++ SEQ_OPTS_PUTS("test_dummy_encryption"); + + ext4_show_quota_options(seq, sb); + return 0; +@@ -4311,11 +4313,13 @@ no_journal: + block = ext4_count_free_clusters(sb); + ext4_free_blocks_count_set(sbi->s_es, + EXT4_C2B(sbi, block)); ++ ext4_superblock_csum_set(sb); + err = percpu_counter_init(&sbi->s_freeclusters_counter, block, + GFP_KERNEL); + if (!err) { + unsigned long freei = ext4_count_free_inodes(sb); + sbi->s_es->s_free_inodes_count = cpu_to_le32(freei); ++ ext4_superblock_csum_set(sb); + err = percpu_counter_init(&sbi->s_freeinodes_counter, freei, + GFP_KERNEL); + } +diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c +index d9ebe11c8990..1d098c3c00e0 100644 +--- a/fs/ocfs2/buffer_head_io.c ++++ b/fs/ocfs2/buffer_head_io.c +@@ -342,6 +342,7 @@ int ocfs2_read_blocks(struct ocfs2_caching_info *ci, u64 block, int nr, + * for this bh as it's not marked locally + * uptodate. */ + status = -EIO; ++ clear_buffer_needs_validate(bh); + put_bh(bh); + bhs[i] = NULL; + continue; +diff --git a/fs/ubifs/xattr.c b/fs/ubifs/xattr.c +index d47f16c0d582..c13eae819cbc 100644 +--- a/fs/ubifs/xattr.c ++++ b/fs/ubifs/xattr.c +@@ -152,12 +152,6 @@ static int create_xattr(struct ubifs_info *c, struct inode *host, + ui->data_len = size; + + mutex_lock(&host_ui->ui_mutex); +- +- if (!host->i_nlink) { +- err = -ENOENT; +- goto out_noent; +- } +- + host->i_ctime = current_time(host); + host_ui->xattr_cnt += 1; + host_ui->xattr_size += CALC_DENT_SIZE(fname_len(nm)); +@@ -189,7 +183,6 @@ out_cancel: + host_ui->xattr_size -= CALC_XATTR_BYTES(size); + host_ui->xattr_names -= fname_len(nm); + host_ui->flags &= ~UBIFS_CRYPT_FL; +-out_noent: + mutex_unlock(&host_ui->ui_mutex); + out_free: + make_bad_inode(inode); +@@ -241,12 +234,6 @@ static int change_xattr(struct ubifs_info *c, struct inode *host, + mutex_unlock(&ui->ui_mutex); + + mutex_lock(&host_ui->ui_mutex); +- +- if (!host->i_nlink) { +- err = -ENOENT; +- goto out_noent; +- } +- + host->i_ctime = current_time(host); + host_ui->xattr_size -= CALC_XATTR_BYTES(old_size); + host_ui->xattr_size += CALC_XATTR_BYTES(size); +@@ -268,7 +255,6 @@ static int change_xattr(struct ubifs_info *c, struct inode *host, + out_cancel: + host_ui->xattr_size -= CALC_XATTR_BYTES(size); + host_ui->xattr_size += CALC_XATTR_BYTES(old_size); +-out_noent: + mutex_unlock(&host_ui->ui_mutex); + make_bad_inode(inode); + out_free: +@@ -497,12 +483,6 @@ static int remove_xattr(struct ubifs_info *c, struct inode *host, + return err; + + mutex_lock(&host_ui->ui_mutex); +- +- if (!host->i_nlink) { +- err = -ENOENT; +- goto out_noent; +- } +- + host->i_ctime = current_time(host); + host_ui->xattr_cnt -= 1; + host_ui->xattr_size -= CALC_DENT_SIZE(fname_len(nm)); +@@ -522,7 +502,6 @@ out_cancel: + host_ui->xattr_size += CALC_DENT_SIZE(fname_len(nm)); + host_ui->xattr_size += CALC_XATTR_BYTES(ui->data_len); + host_ui->xattr_names += fname_len(nm); +-out_noent: + mutex_unlock(&host_ui->ui_mutex); + ubifs_release_budget(c, &req); + make_bad_inode(inode); +@@ -562,9 +541,6 @@ static int ubifs_xattr_remove(struct inode *host, const char *name) + + ubifs_assert(inode_is_locked(host)); + +- if (!host->i_nlink) +- return -ENOENT; +- + if (fname_len(&nm) > UBIFS_MAX_NLEN) + return -ENAMETOOLONG; + +diff --git a/include/net/nfc/hci.h b/include/net/nfc/hci.h +index 316694dafa5b..008f466d1da7 100644 +--- a/include/net/nfc/hci.h ++++ b/include/net/nfc/hci.h +@@ -87,7 +87,7 @@ struct nfc_hci_pipe { + * According to specification 102 622 chapter 4.4 Pipes, + * the pipe identifier is 7 bits long. + */ +-#define NFC_HCI_MAX_PIPES 127 ++#define NFC_HCI_MAX_PIPES 128 + struct nfc_hci_init_data { + u8 gate_count; + struct nfc_hci_gate gates[NFC_HCI_MAX_CUSTOM_GATES]; +diff --git a/include/net/tls.h b/include/net/tls.h +index 48940a883d9a..86ed3dd80fe7 100644 +--- a/include/net/tls.h ++++ b/include/net/tls.h +@@ -79,11 +79,13 @@ enum { + TLS_PENDING_CLOSED_RECORD + }; + ++union tls_crypto_context { ++ struct tls_crypto_info info; ++ struct tls12_crypto_info_aes_gcm_128 aes_gcm_128; ++}; ++ + struct tls_context { +- union { +- struct tls_crypto_info crypto_send; +- struct tls12_crypto_info_aes_gcm_128 crypto_send_aes_gcm_128; +- }; ++ union tls_crypto_context crypto_send; + + void *priv_ctx; + +@@ -208,8 +210,8 @@ static inline void tls_fill_prepend(struct tls_context *ctx, + * size KTLS_DTLS_HEADER_SIZE + KTLS_DTLS_NONCE_EXPLICIT_SIZE + */ + buf[0] = record_type; +- buf[1] = TLS_VERSION_MINOR(ctx->crypto_send.version); +- buf[2] = TLS_VERSION_MAJOR(ctx->crypto_send.version); ++ buf[1] = TLS_VERSION_MINOR(ctx->crypto_send.info.version); ++ buf[2] = TLS_VERSION_MAJOR(ctx->crypto_send.info.version); + /* we can use IV for nonce explicit according to spec */ + buf[3] = pkt_len >> 8; + buf[4] = pkt_len & 0xFF; +diff --git a/include/uapi/linux/keyctl.h b/include/uapi/linux/keyctl.h +index 910cc4334b21..7b8c9e19bad1 100644 +--- a/include/uapi/linux/keyctl.h ++++ b/include/uapi/linux/keyctl.h +@@ -65,7 +65,7 @@ + + /* keyctl structures */ + struct keyctl_dh_params { +- __s32 dh_private; ++ __s32 private; + __s32 prime; + __s32 base; + }; +diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c +index a5e20ceb0b5a..b2d699f28304 100644 +--- a/kernel/sched/fair.c ++++ b/kernel/sched/fair.c +@@ -9137,7 +9137,8 @@ static inline bool vruntime_normalized(struct task_struct *p) + * - A task which has been woken up by try_to_wake_up() and + * waiting for actually being woken up by sched_ttwu_pending(). + */ +- if (!se->sum_exec_runtime || p->state == TASK_WAKING) ++ if (!se->sum_exec_runtime || ++ (p->state == TASK_WAKING && p->sched_remote_wakeup)) + return true; + + return false; +diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c +index ea3c062e7e1c..a8fa0a896b78 100644 +--- a/kernel/time/tick-sched.c ++++ b/kernel/time/tick-sched.c +@@ -908,7 +908,7 @@ static bool can_stop_idle_tick(int cpu, struct tick_sched *ts) + if (unlikely(local_softirq_pending() && cpu_online(cpu))) { + static int ratelimit; + +- if (ratelimit < 10 && ++ if (ratelimit < 10 && !in_softirq() && + (local_softirq_pending() & SOFTIRQ_STOP_IDLE_MASK)) { + pr_warn("NOHZ: local_softirq_pending %02x\n", + (unsigned int) local_softirq_pending()); +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index fd7809004297..a1d5e0949dcf 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -1479,6 +1479,8 @@ rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned long nr_pages) + tmp_iter_page = first_page; + + do { ++ cond_resched(); ++ + to_remove_page = tmp_iter_page; + rb_inc_page(cpu_buffer, &tmp_iter_page); + +diff --git a/mm/shmem.c b/mm/shmem.c +index f383298b7280..ea786a504e1b 100644 +--- a/mm/shmem.c ++++ b/mm/shmem.c +@@ -2207,6 +2207,8 @@ static struct inode *shmem_get_inode(struct super_block *sb, const struct inode + mpol_shared_policy_init(&info->policy, NULL); + break; + } ++ ++ lockdep_annotate_inode_mutex_key(inode); + } else + shmem_free_inode(sb); + return inode; +diff --git a/net/core/neighbour.c b/net/core/neighbour.c +index 514d697d4691..dcb89cbc2730 100644 +--- a/net/core/neighbour.c ++++ b/net/core/neighbour.c +@@ -1174,6 +1174,12 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new, + lladdr = neigh->ha; + } + ++ /* Update confirmed timestamp for neighbour entry after we ++ * received ARP packet even if it doesn't change IP to MAC binding. ++ */ ++ if (new & NUD_CONNECTED) ++ neigh->confirmed = jiffies; ++ + /* If entry was valid and address is not changed, + do not change entry state, if new one is STALE. + */ +@@ -1195,15 +1201,12 @@ int neigh_update(struct neighbour *neigh, const u8 *lladdr, u8 new, + } + } + +- /* Update timestamps only once we know we will make a change to the ++ /* Update timestamp only once we know we will make a change to the + * neighbour entry. Otherwise we risk to move the locktime window with + * noop updates and ignore relevant ARP updates. + */ +- if (new != old || lladdr != neigh->ha) { +- if (new & NUD_CONNECTED) +- neigh->confirmed = jiffies; ++ if (new != old || lladdr != neigh->ha) + neigh->updated = jiffies; +- } + + if (new != old) { + neigh_del_timer(neigh); +diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c +index b9d9a2b8792c..f31c09873d0f 100644 +--- a/net/ipv4/af_inet.c ++++ b/net/ipv4/af_inet.c +@@ -1307,6 +1307,7 @@ struct sk_buff *inet_gso_segment(struct sk_buff *skb, + if (encap) + skb_reset_inner_headers(skb); + skb->network_header = (u8 *)iph - skb->head; ++ skb_reset_mac_len(skb); + } while ((skb = skb->next)); + + out: +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index 5752bf7593dc..3de413867991 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -2049,6 +2049,28 @@ static inline int udp4_csum_init(struct sk_buff *skb, struct udphdr *uh, + inet_compute_pseudo); + } + ++/* wrapper for udp_queue_rcv_skb tacking care of csum conversion and ++ * return code conversion for ip layer consumption ++ */ ++static int udp_unicast_rcv_skb(struct sock *sk, struct sk_buff *skb, ++ struct udphdr *uh) ++{ ++ int ret; ++ ++ if (inet_get_convert_csum(sk) && uh->check && !IS_UDPLITE(sk)) ++ skb_checksum_try_convert(skb, IPPROTO_UDP, uh->check, ++ inet_compute_pseudo); ++ ++ ret = udp_queue_rcv_skb(sk, skb); ++ ++ /* a return value > 0 means to resubmit the input, but ++ * it wants the return to be -protocol, or 0 ++ */ ++ if (ret > 0) ++ return -ret; ++ return 0; ++} ++ + /* + * All we need to do is get the socket, and then do a checksum. + */ +@@ -2095,14 +2117,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, + if (unlikely(sk->sk_rx_dst != dst)) + udp_sk_rx_dst_set(sk, dst); + +- ret = udp_queue_rcv_skb(sk, skb); ++ ret = udp_unicast_rcv_skb(sk, skb, uh); + sock_put(sk); +- /* a return value > 0 means to resubmit the input, but +- * it wants the return to be -protocol, or 0 +- */ +- if (ret > 0) +- return -ret; +- return 0; ++ return ret; + } + + if (rt->rt_flags & (RTCF_BROADCAST|RTCF_MULTICAST)) +@@ -2110,22 +2127,8 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, + saddr, daddr, udptable, proto); + + sk = __udp4_lib_lookup_skb(skb, uh->source, uh->dest, udptable); +- if (sk) { +- int ret; +- +- if (inet_get_convert_csum(sk) && uh->check && !IS_UDPLITE(sk)) +- skb_checksum_try_convert(skb, IPPROTO_UDP, uh->check, +- inet_compute_pseudo); +- +- ret = udp_queue_rcv_skb(sk, skb); +- +- /* a return value > 0 means to resubmit the input, but +- * it wants the return to be -protocol, or 0 +- */ +- if (ret > 0) +- return -ret; +- return 0; +- } ++ if (sk) ++ return udp_unicast_rcv_skb(sk, skb, uh); + + if (!xfrm4_policy_check(NULL, XFRM_POLICY_IN, skb)) + goto drop; +diff --git a/net/ipv6/ip6_offload.c b/net/ipv6/ip6_offload.c +index 4a87f9428ca5..e3698b6d8231 100644 +--- a/net/ipv6/ip6_offload.c ++++ b/net/ipv6/ip6_offload.c +@@ -113,6 +113,7 @@ static struct sk_buff *ipv6_gso_segment(struct sk_buff *skb, + payload_len = skb->len - nhoff - sizeof(*ipv6h); + ipv6h->payload_len = htons(payload_len); + skb->network_header = (u8 *)ipv6h - skb->head; ++ skb_reset_mac_len(skb); + + if (udpfrag) { + int err = ip6_find_1stfragopt(skb, &prevhdr); +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index 1da021527fcd..9ab1e0fcbc13 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -219,12 +219,10 @@ int ip6_xmit(const struct sock *sk, struct sk_buff *skb, struct flowi6 *fl6, + kfree_skb(skb); + return -ENOBUFS; + } ++ if (skb->sk) ++ skb_set_owner_w(skb2, skb->sk); + consume_skb(skb); + skb = skb2; +- /* skb_set_owner_w() changes sk->sk_wmem_alloc atomically, +- * it is safe to call in our context (socket lock not held) +- */ +- skb_set_owner_w(skb, (struct sock *)sk); + } + if (opt->opt_flen) + ipv6_push_frag_opts(skb, opt, &proto); +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index 330d5ea8451b..5cee941ab0a9 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -780,6 +780,28 @@ static void udp6_sk_rx_dst_set(struct sock *sk, struct dst_entry *dst) + } + } + ++/* wrapper for udp_queue_rcv_skb tacking care of csum conversion and ++ * return code conversion for ip layer consumption ++ */ ++static int udp6_unicast_rcv_skb(struct sock *sk, struct sk_buff *skb, ++ struct udphdr *uh) ++{ ++ int ret; ++ ++ if (inet_get_convert_csum(sk) && uh->check && !IS_UDPLITE(sk)) ++ skb_checksum_try_convert(skb, IPPROTO_UDP, uh->check, ++ ip6_compute_pseudo); ++ ++ ret = udpv6_queue_rcv_skb(sk, skb); ++ ++ /* a return value > 0 means to resubmit the input, but ++ * it wants the return to be -protocol, or 0 ++ */ ++ if (ret > 0) ++ return -ret; ++ return 0; ++} ++ + int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, + int proto) + { +@@ -831,13 +853,14 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, + if (unlikely(sk->sk_rx_dst != dst)) + udp6_sk_rx_dst_set(sk, dst); + +- ret = udpv6_queue_rcv_skb(sk, skb); +- sock_put(sk); ++ if (!uh->check && !udp_sk(sk)->no_check6_rx) { ++ sock_put(sk); ++ goto report_csum_error; ++ } + +- /* a return value > 0 means to resubmit the input */ +- if (ret > 0) +- return ret; +- return 0; ++ ret = udp6_unicast_rcv_skb(sk, skb, uh); ++ sock_put(sk); ++ return ret; + } + + /* +@@ -850,30 +873,13 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, + /* Unicast */ + sk = __udp6_lib_lookup_skb(skb, uh->source, uh->dest, udptable); + if (sk) { +- int ret; +- +- if (!uh->check && !udp_sk(sk)->no_check6_rx) { +- udp6_csum_zero_error(skb); +- goto csum_error; +- } +- +- if (inet_get_convert_csum(sk) && uh->check && !IS_UDPLITE(sk)) +- skb_checksum_try_convert(skb, IPPROTO_UDP, uh->check, +- ip6_compute_pseudo); +- +- ret = udpv6_queue_rcv_skb(sk, skb); +- +- /* a return value > 0 means to resubmit the input */ +- if (ret > 0) +- return ret; +- +- return 0; ++ if (!uh->check && !udp_sk(sk)->no_check6_rx) ++ goto report_csum_error; ++ return udp6_unicast_rcv_skb(sk, skb, uh); + } + +- if (!uh->check) { +- udp6_csum_zero_error(skb); +- goto csum_error; +- } ++ if (!uh->check) ++ goto report_csum_error; + + if (!xfrm6_policy_check(NULL, XFRM_POLICY_IN, skb)) + goto discard; +@@ -894,6 +900,9 @@ short_packet: + ulen, skb->len, + daddr, ntohs(uh->dest)); + goto discard; ++ ++report_csum_error: ++ udp6_csum_zero_error(skb); + csum_error: + __UDP6_INC_STATS(net, UDP_MIB_CSUMERRORS, proto == IPPROTO_UDPLITE); + discard: +diff --git a/net/nfc/hci/core.c b/net/nfc/hci/core.c +index b740fef0acc5..6bf14f4f4b42 100644 +--- a/net/nfc/hci/core.c ++++ b/net/nfc/hci/core.c +@@ -209,6 +209,11 @@ void nfc_hci_cmd_received(struct nfc_hci_dev *hdev, u8 pipe, u8 cmd, + } + create_info = (struct hci_create_pipe_resp *)skb->data; + ++ if (create_info->pipe >= NFC_HCI_MAX_PIPES) { ++ status = NFC_HCI_ANY_E_NOK; ++ goto exit; ++ } ++ + /* Save the new created pipe and bind with local gate, + * the description for skb->data[3] is destination gate id + * but since we received this cmd from host controller, we +@@ -232,6 +237,11 @@ void nfc_hci_cmd_received(struct nfc_hci_dev *hdev, u8 pipe, u8 cmd, + } + delete_info = (struct hci_delete_pipe_noti *)skb->data; + ++ if (delete_info->pipe >= NFC_HCI_MAX_PIPES) { ++ status = NFC_HCI_ANY_E_NOK; ++ goto exit; ++ } ++ + hdev->pipes[delete_info->pipe].gate = NFC_HCI_INVALID_GATE; + hdev->pipes[delete_info->pipe].dest_host = NFC_HCI_INVALID_HOST; + break; +diff --git a/net/sched/act_sample.c b/net/sched/act_sample.c +index 53752b9327d0..a859b55d7899 100644 +--- a/net/sched/act_sample.c ++++ b/net/sched/act_sample.c +@@ -64,7 +64,7 @@ static int tcf_sample_init(struct net *net, struct nlattr *nla, + + if (!exists) { + ret = tcf_idr_create(tn, parm->index, est, a, +- &act_sample_ops, bind, false); ++ &act_sample_ops, bind, true); + if (ret) + return ret; + ret = ACT_P_CREATED; +diff --git a/net/tls/tls_main.c b/net/tls/tls_main.c +index 055b9992d8c7..efa2cdba99d3 100644 +--- a/net/tls/tls_main.c ++++ b/net/tls/tls_main.c +@@ -218,6 +218,15 @@ static void tls_write_space(struct sock *sk) + ctx->sk_write_space(sk); + } + ++static void tls_ctx_free(struct tls_context *ctx) ++{ ++ if (!ctx) ++ return; ++ ++ memzero_explicit(&ctx->crypto_send, sizeof(ctx->crypto_send)); ++ kfree(ctx); ++} ++ + static void tls_sk_proto_close(struct sock *sk, long timeout) + { + struct tls_context *ctx = tls_get_ctx(sk); +@@ -246,7 +255,7 @@ static void tls_sk_proto_close(struct sock *sk, long timeout) + kfree(ctx->iv); + + sk_proto_close = ctx->sk_proto_close; +- kfree(ctx); ++ tls_ctx_free(ctx); + + release_sock(sk); + sk_proto_close(sk, timeout); +@@ -274,7 +283,7 @@ static int do_tls_getsockopt_tx(struct sock *sk, char __user *optval, + } + + /* get user crypto info */ +- crypto_info = &ctx->crypto_send; ++ crypto_info = &ctx->crypto_send.info; + + if (!TLS_CRYPTO_INFO_READY(crypto_info)) { + rc = -EBUSY; +@@ -371,7 +380,7 @@ static int do_tls_setsockopt_tx(struct sock *sk, char __user *optval, + } + + /* get user crypto info */ +- crypto_info = &ctx->crypto_send; ++ crypto_info = &ctx->crypto_send.info; + + /* Currently we don't support set crypto info more than one time */ + if (TLS_CRYPTO_INFO_READY(crypto_info)) { +@@ -416,7 +425,7 @@ static int do_tls_setsockopt_tx(struct sock *sk, char __user *optval, + goto out; + + err_crypto_info: +- memset(crypto_info, 0, sizeof(*crypto_info)); ++ memzero_explicit(crypto_info, sizeof(union tls_crypto_context)); + out: + return rc; + } +diff --git a/net/tls/tls_sw.c b/net/tls/tls_sw.c +index b81aa6d7dc45..6ae9ca567d6c 100644 +--- a/net/tls/tls_sw.c ++++ b/net/tls/tls_sw.c +@@ -661,7 +661,6 @@ static void tls_sw_free_resources(struct sock *sk) + + int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx) + { +- char keyval[TLS_CIPHER_AES_GCM_128_KEY_SIZE]; + struct tls_crypto_info *crypto_info; + struct tls12_crypto_info_aes_gcm_128 *gcm_128_info; + struct tls_sw_context *sw_ctx; +@@ -688,7 +687,7 @@ int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx) + ctx->priv_ctx = (struct tls_offload_context *)sw_ctx; + ctx->free_resources = tls_sw_free_resources; + +- crypto_info = &ctx->crypto_send; ++ crypto_info = &ctx->crypto_send.info; + switch (crypto_info->cipher_type) { + case TLS_CIPHER_AES_GCM_128: { + nonce_size = TLS_CIPHER_AES_GCM_128_IV_SIZE; +@@ -753,9 +752,7 @@ int tls_set_sw_offload(struct sock *sk, struct tls_context *ctx) + + ctx->push_pending_record = tls_sw_push_pending_record; + +- memcpy(keyval, gcm_128_info->key, TLS_CIPHER_AES_GCM_128_KEY_SIZE); +- +- rc = crypto_aead_setkey(sw_ctx->aead_send, keyval, ++ rc = crypto_aead_setkey(sw_ctx->aead_send, gcm_128_info->key, + TLS_CIPHER_AES_GCM_128_KEY_SIZE); + if (rc) + goto free_aead; +diff --git a/security/keys/dh.c b/security/keys/dh.c +index 35543f04e759..d1ea9f325f94 100644 +--- a/security/keys/dh.c ++++ b/security/keys/dh.c +@@ -307,7 +307,7 @@ long __keyctl_dh_compute(struct keyctl_dh_params __user *params, + } + dh_inputs.g_size = dlen; + +- dlen = dh_data_from_key(pcopy.dh_private, &dh_inputs.key); ++ dlen = dh_data_from_key(pcopy.private, &dh_inputs.key); + if (dlen < 0) { + ret = dlen; + goto out2; +diff --git a/sound/firewire/bebob/bebob.c b/sound/firewire/bebob/bebob.c +index 730ea91d9be8..93676354f87f 100644 +--- a/sound/firewire/bebob/bebob.c ++++ b/sound/firewire/bebob/bebob.c +@@ -263,6 +263,8 @@ do_registration(struct work_struct *work) + error: + mutex_unlock(&devices_mutex); + snd_bebob_stream_destroy_duplex(bebob); ++ kfree(bebob->maudio_special_quirk); ++ bebob->maudio_special_quirk = NULL; + snd_card_free(bebob->card); + dev_info(&bebob->unit->device, + "Sound card registration failed: %d\n", err); +diff --git a/sound/firewire/bebob/bebob_maudio.c b/sound/firewire/bebob/bebob_maudio.c +index bd55620c6a47..c266997ad299 100644 +--- a/sound/firewire/bebob/bebob_maudio.c ++++ b/sound/firewire/bebob/bebob_maudio.c +@@ -96,17 +96,13 @@ int snd_bebob_maudio_load_firmware(struct fw_unit *unit) + struct fw_device *device = fw_parent_device(unit); + int err, rcode; + u64 date; +- __le32 cues[3] = { +- cpu_to_le32(MAUDIO_BOOTLOADER_CUE1), +- cpu_to_le32(MAUDIO_BOOTLOADER_CUE2), +- cpu_to_le32(MAUDIO_BOOTLOADER_CUE3) +- }; ++ __le32 *cues; + + /* check date of software used to build */ + err = snd_bebob_read_block(unit, INFO_OFFSET_SW_DATE, + &date, sizeof(u64)); + if (err < 0) +- goto end; ++ return err; + /* + * firmware version 5058 or later has date later than "20070401", but + * 'date' is not null-terminated. +@@ -114,20 +110,28 @@ int snd_bebob_maudio_load_firmware(struct fw_unit *unit) + if (date < 0x3230303730343031LL) { + dev_err(&unit->device, + "Use firmware version 5058 or later\n"); +- err = -ENOSYS; +- goto end; ++ return -ENXIO; + } + ++ cues = kmalloc_array(3, sizeof(*cues), GFP_KERNEL); ++ if (!cues) ++ return -ENOMEM; ++ ++ cues[0] = cpu_to_le32(MAUDIO_BOOTLOADER_CUE1); ++ cues[1] = cpu_to_le32(MAUDIO_BOOTLOADER_CUE2); ++ cues[2] = cpu_to_le32(MAUDIO_BOOTLOADER_CUE3); ++ + rcode = fw_run_transaction(device->card, TCODE_WRITE_BLOCK_REQUEST, + device->node_id, device->generation, + device->max_speed, BEBOB_ADDR_REG_REQ, +- cues, sizeof(cues)); ++ cues, 3 * sizeof(*cues)); ++ kfree(cues); + if (rcode != RCODE_COMPLETE) { + dev_err(&unit->device, + "Failed to send a cue to load firmware\n"); + err = -EIO; + } +-end: ++ + return err; + } + +@@ -290,10 +294,6 @@ snd_bebob_maudio_special_discover(struct snd_bebob *bebob, bool is1814) + bebob->midi_output_ports = 2; + } + end: +- if (err < 0) { +- kfree(params); +- bebob->maudio_special_quirk = NULL; +- } + mutex_unlock(&bebob->mutex); + return err; + } +diff --git a/sound/firewire/digi00x/digi00x.c b/sound/firewire/digi00x/digi00x.c +index 1f5e1d23f31a..ef689997d6a5 100644 +--- a/sound/firewire/digi00x/digi00x.c ++++ b/sound/firewire/digi00x/digi00x.c +@@ -49,6 +49,7 @@ static void dg00x_free(struct snd_dg00x *dg00x) + fw_unit_put(dg00x->unit); + + mutex_destroy(&dg00x->mutex); ++ kfree(dg00x); + } + + static void dg00x_card_free(struct snd_card *card) +diff --git a/sound/firewire/fireface/ff-protocol-ff400.c b/sound/firewire/fireface/ff-protocol-ff400.c +index 12aa15df435d..9f5036442ab9 100644 +--- a/sound/firewire/fireface/ff-protocol-ff400.c ++++ b/sound/firewire/fireface/ff-protocol-ff400.c +@@ -146,6 +146,7 @@ static int ff400_switch_fetching_mode(struct snd_ff *ff, bool enable) + { + __le32 *reg; + int i; ++ int err; + + reg = kzalloc(sizeof(__le32) * 18, GFP_KERNEL); + if (reg == NULL) +@@ -163,9 +164,11 @@ static int ff400_switch_fetching_mode(struct snd_ff *ff, bool enable) + reg[i] = cpu_to_le32(0x00000001); + } + +- return snd_fw_transaction(ff->unit, TCODE_WRITE_BLOCK_REQUEST, +- FF400_FETCH_PCM_FRAMES, reg, +- sizeof(__le32) * 18, 0); ++ err = snd_fw_transaction(ff->unit, TCODE_WRITE_BLOCK_REQUEST, ++ FF400_FETCH_PCM_FRAMES, reg, ++ sizeof(__le32) * 18, 0); ++ kfree(reg); ++ return err; + } + + static void ff400_dump_sync_status(struct snd_ff *ff, +diff --git a/sound/firewire/fireworks/fireworks.c b/sound/firewire/fireworks/fireworks.c +index 71a0613d3da0..f2d073365cf6 100644 +--- a/sound/firewire/fireworks/fireworks.c ++++ b/sound/firewire/fireworks/fireworks.c +@@ -301,6 +301,8 @@ error: + snd_efw_transaction_remove_instance(efw); + snd_efw_stream_destroy_duplex(efw); + snd_card_free(efw->card); ++ kfree(efw->resp_buf); ++ efw->resp_buf = NULL; + dev_info(&efw->unit->device, + "Sound card registration failed: %d\n", err); + } +diff --git a/sound/firewire/oxfw/oxfw.c b/sound/firewire/oxfw/oxfw.c +index 413ab6313bb6..a315d5b6b86b 100644 +--- a/sound/firewire/oxfw/oxfw.c ++++ b/sound/firewire/oxfw/oxfw.c +@@ -136,6 +136,7 @@ static void oxfw_free(struct snd_oxfw *oxfw) + + kfree(oxfw->spec); + mutex_destroy(&oxfw->mutex); ++ kfree(oxfw); + } + + /* +@@ -213,6 +214,7 @@ static int detect_quirks(struct snd_oxfw *oxfw) + static void do_registration(struct work_struct *work) + { + struct snd_oxfw *oxfw = container_of(work, struct snd_oxfw, dwork.work); ++ int i; + int err; + + if (oxfw->registered) +@@ -275,7 +277,15 @@ error: + snd_oxfw_stream_destroy_simplex(oxfw, &oxfw->rx_stream); + if (oxfw->has_output) + snd_oxfw_stream_destroy_simplex(oxfw, &oxfw->tx_stream); ++ for (i = 0; i < SND_OXFW_STREAM_FORMAT_ENTRIES; ++i) { ++ kfree(oxfw->tx_stream_formats[i]); ++ oxfw->tx_stream_formats[i] = NULL; ++ kfree(oxfw->rx_stream_formats[i]); ++ oxfw->rx_stream_formats[i] = NULL; ++ } + snd_card_free(oxfw->card); ++ kfree(oxfw->spec); ++ oxfw->spec = NULL; + dev_info(&oxfw->unit->device, + "Sound card registration failed: %d\n", err); + } +diff --git a/sound/firewire/tascam/tascam.c b/sound/firewire/tascam/tascam.c +index 44ad41fb7374..d3fdc463a884 100644 +--- a/sound/firewire/tascam/tascam.c ++++ b/sound/firewire/tascam/tascam.c +@@ -93,6 +93,7 @@ static void tscm_free(struct snd_tscm *tscm) + fw_unit_put(tscm->unit); + + mutex_destroy(&tscm->mutex); ++ kfree(tscm); + } + + static void tscm_card_free(struct snd_card *card) +diff --git a/sound/pci/emu10k1/emufx.c b/sound/pci/emu10k1/emufx.c +index a2b56b188be4..d68bb40d3676 100644 +--- a/sound/pci/emu10k1/emufx.c ++++ b/sound/pci/emu10k1/emufx.c +@@ -2547,7 +2547,7 @@ static int snd_emu10k1_fx8010_ioctl(struct snd_hwdep * hw, struct file *file, un + emu->support_tlv = 1; + return put_user(SNDRV_EMU10K1_VERSION, (int __user *)argp); + case SNDRV_EMU10K1_IOCTL_INFO: +- info = kmalloc(sizeof(*info), GFP_KERNEL); ++ info = kzalloc(sizeof(*info), GFP_KERNEL); + if (!info) + return -ENOMEM; + snd_emu10k1_fx8010_info(emu, info); +diff --git a/sound/soc/codecs/cs4265.c b/sound/soc/codecs/cs4265.c +index fd966bb851cb..6e8eb1f5a041 100644 +--- a/sound/soc/codecs/cs4265.c ++++ b/sound/soc/codecs/cs4265.c +@@ -157,8 +157,8 @@ static const struct snd_kcontrol_new cs4265_snd_controls[] = { + SOC_SINGLE("Validity Bit Control Switch", CS4265_SPDIF_CTL2, + 3, 1, 0), + SOC_ENUM("SPDIF Mono/Stereo", spdif_mono_stereo_enum), +- SOC_SINGLE("MMTLR Data Switch", 0, +- 1, 1, 0), ++ SOC_SINGLE("MMTLR Data Switch", CS4265_SPDIF_CTL2, ++ 0, 1, 0), + SOC_ENUM("Mono Channel Select", spdif_mono_select_enum), + SND_SOC_BYTES("C Data Buffer", CS4265_C_DATA_BUFF, 24), + }; +diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c +index 107133297e8d..9896e736fa5c 100644 +--- a/sound/soc/sh/rcar/core.c ++++ b/sound/soc/sh/rcar/core.c +@@ -925,12 +925,23 @@ static void rsnd_soc_dai_shutdown(struct snd_pcm_substream *substream, + rsnd_dai_call(nolock_stop, io, priv); + } + ++static int rsnd_soc_dai_prepare(struct snd_pcm_substream *substream, ++ struct snd_soc_dai *dai) ++{ ++ struct rsnd_priv *priv = rsnd_dai_to_priv(dai); ++ struct rsnd_dai *rdai = rsnd_dai_to_rdai(dai); ++ struct rsnd_dai_stream *io = rsnd_rdai_to_io(rdai, substream); ++ ++ return rsnd_dai_call(prepare, io, priv); ++} ++ + static const struct snd_soc_dai_ops rsnd_soc_dai_ops = { + .startup = rsnd_soc_dai_startup, + .shutdown = rsnd_soc_dai_shutdown, + .trigger = rsnd_soc_dai_trigger, + .set_fmt = rsnd_soc_dai_set_fmt, + .set_tdm_slot = rsnd_soc_set_dai_tdm_slot, ++ .prepare = rsnd_soc_dai_prepare, + }; + + void rsnd_parse_connect_common(struct rsnd_dai *rdai, +diff --git a/sound/soc/sh/rcar/rsnd.h b/sound/soc/sh/rcar/rsnd.h +index c5de71f2dc8c..1768a0ae469d 100644 +--- a/sound/soc/sh/rcar/rsnd.h ++++ b/sound/soc/sh/rcar/rsnd.h +@@ -283,6 +283,9 @@ struct rsnd_mod_ops { + int (*nolock_stop)(struct rsnd_mod *mod, + struct rsnd_dai_stream *io, + struct rsnd_priv *priv); ++ int (*prepare)(struct rsnd_mod *mod, ++ struct rsnd_dai_stream *io, ++ struct rsnd_priv *priv); + }; + + struct rsnd_dai_stream; +@@ -312,6 +315,7 @@ struct rsnd_mod { + * H 0: fallback + * H 0: hw_params + * H 0: pointer ++ * H 0: prepare + */ + #define __rsnd_mod_shift_nolock_start 0 + #define __rsnd_mod_shift_nolock_stop 0 +@@ -326,6 +330,7 @@ struct rsnd_mod { + #define __rsnd_mod_shift_fallback 28 /* always called */ + #define __rsnd_mod_shift_hw_params 28 /* always called */ + #define __rsnd_mod_shift_pointer 28 /* always called */ ++#define __rsnd_mod_shift_prepare 28 /* always called */ + + #define __rsnd_mod_add_probe 0 + #define __rsnd_mod_add_remove 0 +@@ -340,6 +345,7 @@ struct rsnd_mod { + #define __rsnd_mod_add_fallback 0 + #define __rsnd_mod_add_hw_params 0 + #define __rsnd_mod_add_pointer 0 ++#define __rsnd_mod_add_prepare 0 + + #define __rsnd_mod_call_probe 0 + #define __rsnd_mod_call_remove 0 +@@ -354,6 +360,7 @@ struct rsnd_mod { + #define __rsnd_mod_call_pointer 0 + #define __rsnd_mod_call_nolock_start 0 + #define __rsnd_mod_call_nolock_stop 1 ++#define __rsnd_mod_call_prepare 0 + + #define rsnd_mod_to_priv(mod) ((mod)->priv) + #define rsnd_mod_id(mod) ((mod) ? (mod)->id : -1) +diff --git a/sound/soc/sh/rcar/ssi.c b/sound/soc/sh/rcar/ssi.c +index f0fb85fda42d..34223c8c28a8 100644 +--- a/sound/soc/sh/rcar/ssi.c ++++ b/sound/soc/sh/rcar/ssi.c +@@ -280,7 +280,7 @@ static int rsnd_ssi_master_clk_start(struct rsnd_mod *mod, + if (rsnd_ssi_is_multi_slave(mod, io)) + return 0; + +- if (ssi->usrcnt > 1) { ++ if (ssi->rate) { + if (ssi->rate != rate) { + dev_err(dev, "SSI parent/child should use same rate\n"); + return -EINVAL; +@@ -482,7 +482,6 @@ static int rsnd_ssi_init(struct rsnd_mod *mod, + struct rsnd_priv *priv) + { + struct rsnd_ssi *ssi = rsnd_mod_to_ssi(mod); +- int ret; + + if (!rsnd_ssi_is_run_mods(mod, io)) + return 0; +@@ -493,10 +492,6 @@ static int rsnd_ssi_init(struct rsnd_mod *mod, + + rsnd_mod_power_on(mod); + +- ret = rsnd_ssi_master_clk_start(mod, io); +- if (ret < 0) +- return ret; +- + rsnd_ssi_config_init(mod, io); + + rsnd_ssi_register_setup(mod); +@@ -847,6 +842,13 @@ static int rsnd_ssi_pointer(struct rsnd_mod *mod, + return 0; + } + ++static int rsnd_ssi_prepare(struct rsnd_mod *mod, ++ struct rsnd_dai_stream *io, ++ struct rsnd_priv *priv) ++{ ++ return rsnd_ssi_master_clk_start(mod, io); ++} ++ + static struct rsnd_mod_ops rsnd_ssi_pio_ops = { + .name = SSI_NAME, + .probe = rsnd_ssi_common_probe, +@@ -859,6 +861,7 @@ static struct rsnd_mod_ops rsnd_ssi_pio_ops = { + .pointer= rsnd_ssi_pointer, + .pcm_new = rsnd_ssi_pcm_new, + .hw_params = rsnd_ssi_hw_params, ++ .prepare = rsnd_ssi_prepare, + }; + + static int rsnd_ssi_dma_probe(struct rsnd_mod *mod, +@@ -935,6 +938,7 @@ static struct rsnd_mod_ops rsnd_ssi_dma_ops = { + .pcm_new = rsnd_ssi_pcm_new, + .fallback = rsnd_ssi_fallback, + .hw_params = rsnd_ssi_hw_params, ++ .prepare = rsnd_ssi_prepare, + }; + + int rsnd_ssi_is_dma_mode(struct rsnd_mod *mod)
