diff -druNp --no-dereference linux-libre-3.16.73-gnu/arch/arm/boot/dts/exynos5260.dtsi linux-libre-3.16.74-gnu/arch/arm/boot/dts/exynos5260.dtsi
--- linux-libre-3.16.73-gnu/arch/arm/boot/dts/exynos5260.dtsi	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/arch/arm/boot/dts/exynos5260.dtsi	2019-09-23 16:12:19.000000000 -0400
@@ -211,7 +211,7 @@
 			wakeup-interrupt-controller {
 				compatible = "samsung,exynos4210-wakeup-eint";
 				interrupt-parent = <&gic>;
-				interrupts = <0 32 0>;
+				interrupts = <0 48 0>;
 			};
 		};
 
diff -druNp --no-dereference linux-libre-3.16.73-gnu/arch/arm/crypto/aesbs-glue.c linux-libre-3.16.74-gnu/arch/arm/crypto/aesbs-glue.c
--- linux-libre-3.16.73-gnu/arch/arm/crypto/aesbs-glue.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/arch/arm/crypto/aesbs-glue.c	2019-09-23 16:12:19.000000000 -0400
@@ -259,6 +259,8 @@ static int aesbs_xts_encrypt(struct blkc
 
 	blkcipher_walk_init(&walk, dst, src, nbytes);
 	err = blkcipher_walk_virt_block(desc, &walk, 8 * AES_BLOCK_SIZE);
+	if (err)
+		return err;
 
 	/* generate the initial tweak */
 	AES_encrypt(walk.iv, walk.iv, &ctx->twkey);
@@ -283,6 +285,8 @@ static int aesbs_xts_decrypt(struct blkc
 
 	blkcipher_walk_init(&walk, dst, src, nbytes);
 	err = blkcipher_walk_virt_block(desc, &walk, 8 * AES_BLOCK_SIZE);
+	if (err)
+		return err;
 
 	/* generate the initial tweak */
 	AES_encrypt(walk.iv, walk.iv, &ctx->twkey);
diff -druNp --no-dereference linux-libre-3.16.73-gnu/arch/arm/mach-omap2/omap_hwmod.c linux-libre-3.16.74-gnu/arch/arm/mach-omap2/omap_hwmod.c
--- linux-libre-3.16.73-gnu/arch/arm/mach-omap2/omap_hwmod.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/arch/arm/mach-omap2/omap_hwmod.c	2019-09-23 16:12:19.000000000 -0400
@@ -2617,7 +2617,7 @@ static void __init _setup_iclk_autoidle(
  */
 static int __init _setup_reset(struct omap_hwmod *oh)
 {
-	int r;
+	int r = 0;
 
 	if (oh->_state != _HWMOD_STATE_INITIALIZED)
 		return -EINVAL;
diff -druNp --no-dereference linux-libre-3.16.73-gnu/arch/arm/plat-pxa/ssp.c linux-libre-3.16.74-gnu/arch/arm/plat-pxa/ssp.c
--- linux-libre-3.16.73-gnu/arch/arm/plat-pxa/ssp.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/arch/arm/plat-pxa/ssp.c	2019-09-23 16:12:19.000000000 -0400
@@ -232,18 +232,12 @@ static int pxa_ssp_probe(struct platform
 
 static int pxa_ssp_remove(struct platform_device *pdev)
 {
-	struct resource *res;
 	struct ssp_device *ssp;
 
 	ssp = platform_get_drvdata(pdev);
 	if (ssp == NULL)
 		return -ENODEV;
 
-	res = platform_get_resource(pdev, IORESOURCE_MEM, 0);
-	release_mem_region(res->start, resource_size(res));
-
-	clk_put(ssp->clk);
-
 	mutex_lock(&ssp_lock);
 	list_del(&ssp->node);
 	mutex_unlock(&ssp_lock);
diff -druNp --no-dereference linux-libre-3.16.73-gnu/arch/arm64/include/asm/memory.h linux-libre-3.16.74-gnu/arch/arm64/include/asm/memory.h
--- linux-libre-3.16.73-gnu/arch/arm64/include/asm/memory.h	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/arch/arm64/include/asm/memory.h	2019-09-23 16:12:19.000000000 -0400
@@ -53,7 +53,15 @@
 #define TASK_SIZE_64		(UL(1) << VA_BITS)
 
 #ifdef CONFIG_COMPAT
+#ifdef CONFIG_ARM64_64K_PAGES
+/*
+ * With CONFIG_ARM64_64K_PAGES enabled, the last page is occupied
+ * by the compat vectors page.
+ */
 #define TASK_SIZE_32		UL(0x100000000)
+#else
+#define TASK_SIZE_32		(UL(0x100000000) - PAGE_SIZE)
+#endif /* CONFIG_ARM64_64K_PAGES */
 #define TASK_SIZE		(test_thread_flag(TIF_32BIT) ? \
 				TASK_SIZE_32 : TASK_SIZE_64)
 #define TASK_SIZE_OF(tsk)	(test_tsk_thread_flag(tsk, TIF_32BIT) ? \
diff -druNp --no-dereference linux-libre-3.16.73-gnu/arch/powerpc/include/asm/reg_booke.h linux-libre-3.16.74-gnu/arch/powerpc/include/asm/reg_booke.h
--- linux-libre-3.16.73-gnu/arch/powerpc/include/asm/reg_booke.h	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/arch/powerpc/include/asm/reg_booke.h	2019-09-23 16:12:19.000000000 -0400
@@ -29,7 +29,7 @@
 #if defined(CONFIG_PPC_BOOK3E_64)
 #define MSR_64BIT	MSR_CM
 
-#define MSR_		(MSR_ME | MSR_CE)
+#define MSR_		(MSR_ME | MSR_RI | MSR_CE)
 #define MSR_KERNEL	(MSR_ | MSR_64BIT)
 #define MSR_USER32	(MSR_ | MSR_PR | MSR_EE)
 #define MSR_USER64	(MSR_USER32 | MSR_64BIT)
diff -druNp --no-dereference linux-libre-3.16.73-gnu/arch/powerpc/platforms/83xx/usb.c linux-libre-3.16.74-gnu/arch/powerpc/platforms/83xx/usb.c
--- linux-libre-3.16.73-gnu/arch/powerpc/platforms/83xx/usb.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/arch/powerpc/platforms/83xx/usb.c	2019-09-23 16:12:19.000000000 -0400
@@ -222,8 +222,10 @@ int mpc837x_usb_cfg(void)
 	int ret = 0;
 
 	np = of_find_compatible_node(NULL, NULL, "fsl-usb2-dr");
-	if (!np || !of_device_is_available(np))
+	if (!np || !of_device_is_available(np)) {
+		of_node_put(np);
 		return -ENODEV;
+	}
 	prop = of_get_property(np, "phy_type", NULL);
 
 	if (!prop || (strcmp(prop, "ulpi") && strcmp(prop, "serial"))) {
diff -druNp --no-dereference linux-libre-3.16.73-gnu/arch/x86/crypto/crct10dif-pclmul_glue.c linux-libre-3.16.74-gnu/arch/x86/crypto/crct10dif-pclmul_glue.c
--- linux-libre-3.16.73-gnu/arch/x86/crypto/crct10dif-pclmul_glue.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/arch/x86/crypto/crct10dif-pclmul_glue.c	2019-09-23 16:12:19.000000000 -0400
@@ -76,15 +76,14 @@ static int chksum_final(struct shash_des
 	return 0;
 }
 
-static int __chksum_finup(__u16 *crcp, const u8 *data, unsigned int len,
-			u8 *out)
+static int __chksum_finup(__u16 crc, const u8 *data, unsigned int len, u8 *out)
 {
 	if (irq_fpu_usable()) {
 		kernel_fpu_begin();
-		*(__u16 *)out = crc_t10dif_pcl(*crcp, data, len);
+		*(__u16 *)out = crc_t10dif_pcl(crc, data, len);
 		kernel_fpu_end();
 	} else
-		*(__u16 *)out = crc_t10dif_generic(*crcp, data, len);
+		*(__u16 *)out = crc_t10dif_generic(crc, data, len);
 	return 0;
 }
 
@@ -93,15 +92,13 @@ static int chksum_finup(struct shash_des
 {
 	struct chksum_desc_ctx *ctx = shash_desc_ctx(desc);
 
-	return __chksum_finup(&ctx->crc, data, len, out);
+	return __chksum_finup(ctx->crc, data, len, out);
 }
 
 static int chksum_digest(struct shash_desc *desc, const u8 *data,
 			 unsigned int length, u8 *out)
 {
-	struct chksum_desc_ctx *ctx = shash_desc_ctx(desc);
-
-	return __chksum_finup(&ctx->crc, data, length, out);
+	return __chksum_finup(0, data, length, out);
 }
 
 static struct shash_alg alg = {
diff -druNp --no-dereference linux-libre-3.16.73-gnu/arch/x86/include/asm/uaccess.h linux-libre-3.16.74-gnu/arch/x86/include/asm/uaccess.h
--- linux-libre-3.16.73-gnu/arch/x86/include/asm/uaccess.h	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/arch/x86/include/asm/uaccess.h	2019-09-23 16:12:19.000000000 -0400
@@ -422,10 +422,11 @@ do {									\
 #define __put_user_nocheck(x, ptr, size)			\
 ({								\
 	int __pu_err;						\
-	__typeof__(*(ptr)) __pu_val;				\
-	__pu_val = x;						\
+	__typeof__(*(ptr)) __pu_val = (x);			\
+	__typeof__(ptr) __pu_ptr = (ptr);			\
+	__typeof__(size) __pu_size = (size);			\
 	__uaccess_begin();					\
-	__put_user_size(__pu_val, (ptr), (size), __pu_err, -EFAULT); \
+	__put_user_size(__pu_val, __pu_ptr, __pu_size, __pu_err, -EFAULT); \
 	__uaccess_end();					\
 	__pu_err;						\
 })
diff -druNp --no-dereference linux-libre-3.16.73-gnu/arch/x86/kernel/traps.c linux-libre-3.16.74-gnu/arch/x86/kernel/traps.c
--- linux-libre-3.16.73-gnu/arch/x86/kernel/traps.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/arch/x86/kernel/traps.c	2019-09-23 16:12:19.000000000 -0400
@@ -55,7 +55,6 @@
 #include <asm/fixmap.h>
 #include <asm/mach_traps.h>
 #include <asm/alternative.h>
-#include <asm/nospec-branch.h>
 
 #ifdef CONFIG_X86_64
 #include <asm/x86_init.h>
@@ -260,13 +259,6 @@ dotraplinkage void do_double_fault(struc
 		regs->ip = (unsigned long)general_protection;
 		regs->sp = (unsigned long)&normal_regs->orig_ax;
 
-		/*
-		 * This situation can be triggered by userspace via
-		 * modify_ldt(2) and the return does not take the regular
-		 * user space exit, so a CPU buffer clear is required when
-		 * MDS mitigation is enabled.
-		 */
-		mds_user_clear_cpu_buffers();
 		return;
 	}
 #endif
diff -druNp --no-dereference linux-libre-3.16.73-gnu/crypto/crct10dif_generic.c linux-libre-3.16.74-gnu/crypto/crct10dif_generic.c
--- linux-libre-3.16.73-gnu/crypto/crct10dif_generic.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/crypto/crct10dif_generic.c	2019-09-23 16:12:19.000000000 -0400
@@ -65,10 +65,9 @@ static int chksum_final(struct shash_des
 	return 0;
 }
 
-static int __chksum_finup(__u16 *crcp, const u8 *data, unsigned int len,
-			u8 *out)
+static int __chksum_finup(__u16 crc, const u8 *data, unsigned int len, u8 *out)
 {
-	*(__u16 *)out = crc_t10dif_generic(*crcp, data, len);
+	*(__u16 *)out = crc_t10dif_generic(crc, data, len);
 	return 0;
 }
 
@@ -77,15 +76,13 @@ static int chksum_finup(struct shash_des
 {
 	struct chksum_desc_ctx *ctx = shash_desc_ctx(desc);
 
-	return __chksum_finup(&ctx->crc, data, len, out);
+	return __chksum_finup(ctx->crc, data, len, out);
 }
 
 static int chksum_digest(struct shash_desc *desc, const u8 *data,
 			 unsigned int length, u8 *out)
 {
-	struct chksum_desc_ctx *ctx = shash_desc_ctx(desc);
-
-	return __chksum_finup(&ctx->crc, data, length, out);
+	return __chksum_finup(0, data, length, out);
 }
 
 static struct shash_alg alg = {
diff -druNp --no-dereference linux-libre-3.16.73-gnu/crypto/salsa20_generic.c linux-libre-3.16.74-gnu/crypto/salsa20_generic.c
--- linux-libre-3.16.73-gnu/crypto/salsa20_generic.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/crypto/salsa20_generic.c	2019-09-23 16:12:19.000000000 -0400
@@ -186,7 +186,7 @@ static int encrypt(struct blkcipher_desc
 	blkcipher_walk_init(&walk, dst, src, nbytes);
 	err = blkcipher_walk_virt_block(desc, &walk, 64);
 
-	salsa20_ivsetup(ctx, walk.iv);
+	salsa20_ivsetup(ctx, desc->info);
 
 	while (walk.nbytes >= 64) {
 		salsa20_encrypt_bytes(ctx, walk.dst.virt.addr,
diff -druNp --no-dereference linux-libre-3.16.73-gnu/Documentation/x86/mds.rst linux-libre-3.16.74-gnu/Documentation/x86/mds.rst
--- linux-libre-3.16.73-gnu/Documentation/x86/mds.rst	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/Documentation/x86/mds.rst	2019-09-23 16:12:19.000000000 -0400
@@ -142,45 +142,13 @@ Mitigation points
    mds_user_clear.
 
    The mitigation is invoked in prepare_exit_to_usermode() which covers
-   most of the kernel to user space transitions. There are a few exceptions
-   which are not invoking prepare_exit_to_usermode() on return to user
-   space. These exceptions use the paranoid exit code.
-
-   - Non Maskable Interrupt (NMI):
-
-     Access to sensible data like keys, credentials in the NMI context is
-     mostly theoretical: The CPU can do prefetching or execute a
-     misspeculated code path and thereby fetching data which might end up
-     leaking through a buffer.
-
-     But for mounting other attacks the kernel stack address of the task is
-     already valuable information. So in full mitigation mode, the NMI is
-     mitigated on the return from do_nmi() to provide almost complete
-     coverage.
-
-   - Double fault (#DF):
-
-     A double fault is usually fatal, but the ESPFIX workaround, which can
-     be triggered from user space through modify_ldt(2) is a recoverable
-     double fault. #DF uses the paranoid exit path, so explicit mitigation
-     in the double fault handler is required.
-
-   - Machine Check Exception (#MC):
-
-     Another corner case is a #MC which hits between the CPU buffer clear
-     invocation and the actual return to user. As this still is in kernel
-     space it takes the paranoid exit path which does not clear the CPU
-     buffers. So the #MC handler repopulates the buffers to some
-     extent. Machine checks are not reliably controllable and the window is
-     extremly small so mitigation would just tick a checkbox that this
-     theoretical corner case is covered. To keep the amount of special
-     cases small, ignore #MC.
-
-   - Debug Exception (#DB):
+   all but one of the kernel to user space transitions.  The exception
+   is when we return from a Non Maskable Interrupt (NMI), which is
+   handled directly in do_nmi().
 
-     This takes the paranoid exit path only when the INT1 breakpoint is in
-     kernel space. #DB on a user space address takes the regular exit path,
-     so no extra mitigation required.
+   (The reason that NMI is special is that prepare_exit_to_usermode() can
+    enable IRQs.  In NMI context, NMIs are blocked, and we don't want to
+    enable IRQs with NMIs blocked.)
 
 
 2. C-State transition
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/bluetooth/hci_ldisc.c linux-libre-3.16.74-gnu/drivers/bluetooth/hci_ldisc.c
--- linux-libre-3.16.73-gnu/drivers/bluetooth/hci_ldisc.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/bluetooth/hci_ldisc.c	2019-09-23 16:12:19.000000000 -0400
@@ -225,7 +225,7 @@ static int hci_uart_flush(struct hci_dev
 	tty_ldisc_flush(tty);
 	tty_driver_flush_buffer(tty);
 
-	if (test_bit(HCI_UART_PROTO_SET, &hu->flags))
+	if (test_bit(HCI_UART_PROTO_READY, &hu->flags))
 		hu->proto->flush(hu);
 
 	return 0;
@@ -342,7 +342,7 @@ static void hci_uart_tty_close(struct tt
 
 	cancel_work_sync(&hu->write_work);
 
-	if (test_and_clear_bit(HCI_UART_PROTO_SET, &hu->flags)) {
+	if (test_and_clear_bit(HCI_UART_PROTO_READY, &hu->flags)) {
 		if (hdev) {
 			if (test_bit(HCI_UART_REGISTERED, &hu->flags))
 				hci_unregister_dev(hdev);
@@ -350,6 +350,7 @@ static void hci_uart_tty_close(struct tt
 		}
 		hu->proto->close(hu);
 	}
+	clear_bit(HCI_UART_PROTO_SET, &hu->flags);
 
 	kfree(hu);
 }
@@ -376,7 +377,7 @@ static void hci_uart_tty_wakeup(struct t
 	if (tty != hu->tty)
 		return;
 
-	if (test_bit(HCI_UART_PROTO_SET, &hu->flags))
+	if (test_bit(HCI_UART_PROTO_READY, &hu->flags))
 		hci_uart_tx_wakeup(hu);
 }
 
@@ -399,7 +400,7 @@ static void hci_uart_tty_receive(struct
 	if (!hu || tty != hu->tty)
 		return;
 
-	if (!test_bit(HCI_UART_PROTO_SET, &hu->flags))
+	if (!test_bit(HCI_UART_PROTO_READY, &hu->flags))
 		return;
 
 	spin_lock(&hu->rx_lock);
@@ -483,6 +484,7 @@ static int hci_uart_set_proto(struct hci
 		return err;
 	}
 
+	set_bit(HCI_UART_PROTO_READY, &hu->flags);
 	return 0;
 }
 
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/bluetooth/hci_uart.h linux-libre-3.16.74-gnu/drivers/bluetooth/hci_uart.h
--- linux-libre-3.16.73-gnu/drivers/bluetooth/hci_uart.h	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/bluetooth/hci_uart.h	2019-09-23 16:12:19.000000000 -0400
@@ -81,6 +81,7 @@ struct hci_uart {
 /* HCI_UART proto flag bits */
 #define HCI_UART_PROTO_SET	0
 #define HCI_UART_REGISTERED	1
+#define HCI_UART_PROTO_READY	2
 
 /* TX states  */
 #define HCI_UART_SENDING	1
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/clk/tegra/clk-pll.c linux-libre-3.16.74-gnu/drivers/clk/tegra/clk-pll.c
--- linux-libre-3.16.73-gnu/drivers/clk/tegra/clk-pll.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/clk/tegra/clk-pll.c	2019-09-23 16:12:19.000000000 -0400
@@ -486,8 +486,8 @@ static void _update_pll_mnp(struct tegra
 		pll_override_writel(val, params->pmc_divp_reg, pll);
 
 		val = pll_override_readl(params->pmc_divnm_reg, pll);
-		val &= ~(divm_mask(pll) << div_nmp->override_divm_shift) |
-			~(divn_mask(pll) << div_nmp->override_divn_shift);
+		val &= ~((divm_mask(pll) << div_nmp->override_divm_shift) |
+			(divn_mask(pll) << div_nmp->override_divn_shift));
 		val |= (cfg->m << div_nmp->override_divm_shift) |
 			(cfg->n << div_nmp->override_divn_shift);
 		pll_override_writel(val, params->pmc_divnm_reg, pll);
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/gpu/drm/drm_fb_helper.c linux-libre-3.16.74-gnu/drivers/gpu/drm/drm_fb_helper.c
--- linux-libre-3.16.73-gnu/drivers/gpu/drm/drm_fb_helper.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/gpu/drm/drm_fb_helper.c	2019-09-23 16:12:19.000000000 -0400
@@ -453,8 +453,8 @@ static void drm_fb_helper_dpms(struct fb
 {
 	struct drm_fb_helper *fb_helper = info->par;
 	struct drm_device *dev = fb_helper->dev;
-	struct drm_crtc *crtc;
 	struct drm_connector *connector;
+	struct drm_mode_set *modeset;
 	int i, j;
 
 	/*
@@ -475,14 +475,13 @@ static void drm_fb_helper_dpms(struct fb
 	}
 
 	for (i = 0; i < fb_helper->crtc_count; i++) {
-		crtc = fb_helper->crtc_info[i].mode_set.crtc;
+		modeset = &fb_helper->crtc_info[i].mode_set;
 
-		if (!crtc->enabled)
+		if (!modeset->crtc->enabled)
 			continue;
 
-		/* Walk the connectors & encoders on this fb turning them on/off */
-		for (j = 0; j < fb_helper->connector_count; j++) {
-			connector = fb_helper->connector_info[j]->connector;
+		for (j = 0; j < modeset->num_connectors; j++) {
+			connector = modeset->connectors[j];
 			connector->funcs->dpms(connector, dpms_mode);
 			drm_object_property_set_value(&connector->base,
 				dev->mode_config.dpms_property, dpms_mode);
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/gpu/drm/radeon/radeon_display.c linux-libre-3.16.74-gnu/drivers/gpu/drm/radeon/radeon_display.c
--- linux-libre-3.16.73-gnu/drivers/gpu/drm/radeon/radeon_display.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/gpu/drm/radeon/radeon_display.c	2019-09-23 16:12:19.000000000 -0400
@@ -942,12 +942,12 @@ static void avivo_get_fb_ref_div(unsigne
 	ref_div_max = max(min(100 / post_div, ref_div_max), 1u);
 
 	/* get matching reference and feedback divider */
-	*ref_div = min(max(DIV_ROUND_CLOSEST(den, post_div), 1u), ref_div_max);
+	*ref_div = min(max(den/post_div, 1u), ref_div_max);
 	*fb_div = DIV_ROUND_CLOSEST(nom * *ref_div * post_div, den);
 
 	/* limit fb divider to its maximum */
         if (*fb_div > fb_div_max) {
-		*ref_div = DIV_ROUND_CLOSEST(*ref_div * fb_div_max, *fb_div);
+		*ref_div = (*ref_div * fb_div_max)/(*fb_div);
 		*fb_div = fb_div_max;
 	}
 }
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/hwmon/f71805f.c linux-libre-3.16.74-gnu/drivers/hwmon/f71805f.c
--- linux-libre-3.16.73-gnu/drivers/hwmon/f71805f.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/hwmon/f71805f.c	2019-09-23 16:12:19.000000000 -0400
@@ -96,17 +96,23 @@ superio_select(int base, int ld)
 	outb(ld, base + 1);
 }
 
-static inline void
+static inline int
 superio_enter(int base)
 {
+	if (!request_muxed_region(base, 2, DRVNAME))
+		return -EBUSY;
+
 	outb(0x87, base);
 	outb(0x87, base);
+
+	return 0;
 }
 
 static inline void
 superio_exit(int base)
 {
 	outb(0xaa, base);
+	release_region(base, 2);
 }
 
 /*
@@ -1562,7 +1568,7 @@ exit:
 static int __init f71805f_find(int sioaddr, unsigned short *address,
 			       struct f71805f_sio_data *sio_data)
 {
-	int err = -ENODEV;
+	int err;
 	u16 devid;
 
 	static const char * const names[] = {
@@ -1570,8 +1576,11 @@ static int __init f71805f_find(int sioad
 		"F71872F/FG or F71806F/FG",
 	};
 
-	superio_enter(sioaddr);
+	err = superio_enter(sioaddr);
+	if (err)
+		return err;
 
+	err = -ENODEV;
 	devid = superio_inw(sioaddr, SIO_REG_MANID);
 	if (devid != SIO_FINTEK_ID)
 		goto exit;
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/hwmon/pc87427.c linux-libre-3.16.74-gnu/drivers/hwmon/pc87427.c
--- linux-libre-3.16.73-gnu/drivers/hwmon/pc87427.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/hwmon/pc87427.c	2019-09-23 16:12:19.000000000 -0400
@@ -106,6 +106,13 @@ static const char *logdev_str[2] = { DRV
 #define LD_IN		1
 #define LD_TEMP		1
 
+static inline int superio_enter(int sioaddr)
+{
+	if (!request_muxed_region(sioaddr, 2, DRVNAME))
+		return -EBUSY;
+	return 0;
+}
+
 static inline void superio_outb(int sioaddr, int reg, int val)
 {
 	outb(reg, sioaddr);
@@ -122,6 +129,7 @@ static inline void superio_exit(int sioa
 {
 	outb(0x02, sioaddr);
 	outb(0x02, sioaddr + 1);
+	release_region(sioaddr, 2);
 }
 
 /*
@@ -1221,7 +1229,11 @@ static int __init pc87427_find(int sioad
 {
 	u16 val;
 	u8 cfg, cfg_b;
-	int i, err = 0;
+	int i, err;
+
+	err = superio_enter(sioaddr);
+	if (err)
+		return err;
 
 	/* Identify device */
 	val = force_id ? force_id : superio_inb(sioaddr, SIOREG_DEVID);
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/hwmon/smsc47b397.c linux-libre-3.16.74-gnu/drivers/hwmon/smsc47b397.c
--- linux-libre-3.16.73-gnu/drivers/hwmon/smsc47b397.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/hwmon/smsc47b397.c	2019-09-23 16:12:19.000000000 -0400
@@ -72,14 +72,19 @@ static inline void superio_select(int ld
 	superio_outb(0x07, ld);
 }
 
-static inline void superio_enter(void)
+static inline int superio_enter(void)
 {
+	if (!request_muxed_region(REG, 2, DRVNAME))
+		return -EBUSY;
+
 	outb(0x55, REG);
+	return 0;
 }
 
 static inline void superio_exit(void)
 {
 	outb(0xAA, REG);
+	release_region(REG, 2);
 }
 
 #define SUPERIO_REG_DEVID	0x20
@@ -338,8 +343,12 @@ static int __init smsc47b397_find(void)
 	u8 id, rev;
 	char *name;
 	unsigned short addr;
+	int err;
+
+	err = superio_enter();
+	if (err)
+		return err;
 
-	superio_enter();
 	id = force_id ? force_id : superio_inb(SUPERIO_REG_DEVID);
 
 	switch (id) {
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/hwmon/smsc47m1.c linux-libre-3.16.74-gnu/drivers/hwmon/smsc47m1.c
--- linux-libre-3.16.73-gnu/drivers/hwmon/smsc47m1.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/hwmon/smsc47m1.c	2019-09-23 16:12:19.000000000 -0400
@@ -73,16 +73,21 @@ superio_inb(int reg)
 /* logical device for fans is 0x0A */
 #define superio_select() superio_outb(0x07, 0x0A)
 
-static inline void
+static inline int
 superio_enter(void)
 {
+	if (!request_muxed_region(REG, 2, DRVNAME))
+		return -EBUSY;
+
 	outb(0x55, REG);
+	return 0;
 }
 
 static inline void
 superio_exit(void)
 {
 	outb(0xAA, REG);
+	release_region(REG, 2);
 }
 
 #define SUPERIO_REG_ACT		0x30
@@ -495,8 +500,12 @@ static int __init smsc47m1_find(struct s
 {
 	u8 val;
 	unsigned short addr;
+	int err;
+
+	err = superio_enter();
+	if (err)
+		return err;
 
-	superio_enter();
 	val = force_id ? force_id : superio_inb(SUPERIO_REG_DEVID);
 
 	/*
@@ -572,13 +581,14 @@ static int __init smsc47m1_find(struct s
 static void smsc47m1_restore(const struct smsc47m1_sio_data *sio_data)
 {
 	if ((sio_data->activate & 0x01) == 0) {
-		superio_enter();
-		superio_select();
-
-		pr_info("Disabling device\n");
-		superio_outb(SUPERIO_REG_ACT, sio_data->activate);
-
-		superio_exit();
+		if (!superio_enter()) {
+			superio_select();
+			pr_info("Disabling device\n");
+			superio_outb(SUPERIO_REG_ACT, sio_data->activate);
+			superio_exit();
+		} else {
+			pr_warn("Failed to disable device\n");
+		}
 	}
 }
 
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/hwmon/vt1211.c linux-libre-3.16.74-gnu/drivers/hwmon/vt1211.c
--- linux-libre-3.16.73-gnu/drivers/hwmon/vt1211.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/hwmon/vt1211.c	2019-09-23 16:12:19.000000000 -0400
@@ -226,15 +226,21 @@ static inline void superio_select(int si
 	outb(ldn, sio_cip + 1);
 }
 
-static inline void superio_enter(int sio_cip)
+static inline int superio_enter(int sio_cip)
 {
+	if (!request_muxed_region(sio_cip, 2, DRVNAME))
+		return -EBUSY;
+
 	outb(0x87, sio_cip);
 	outb(0x87, sio_cip);
+
+	return 0;
 }
 
 static inline void superio_exit(int sio_cip)
 {
 	outb(0xaa, sio_cip);
+	release_region(sio_cip, 2);
 }
 
 /* ---------------------------------------------------------------------
@@ -1280,11 +1286,14 @@ EXIT:
 
 static int __init vt1211_find(int sio_cip, unsigned short *address)
 {
-	int err = -ENODEV;
+	int err;
 	int devid;
 
-	superio_enter(sio_cip);
+	err = superio_enter(sio_cip);
+	if (err)
+		return err;
 
+	err = -ENODEV;
 	devid = force_id ? force_id : superio_inb(sio_cip, SIO_VT1211_DEVID);
 	if (devid != SIO_VT1211_ID)
 		goto EXIT;
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/hwmon/w83627hf.c linux-libre-3.16.74-gnu/drivers/hwmon/w83627hf.c
--- linux-libre-3.16.73-gnu/drivers/hwmon/w83627hf.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/hwmon/w83627hf.c	2019-09-23 16:12:19.000000000 -0400
@@ -130,17 +130,23 @@ superio_select(struct w83627hf_sio_data
 	outb(ld,  sio->sioaddr + 1);
 }
 
-static inline void
+static inline int
 superio_enter(struct w83627hf_sio_data *sio)
 {
+	if (!request_muxed_region(sio->sioaddr, 2, DRVNAME))
+		return -EBUSY;
+
 	outb(0x87, sio->sioaddr);
 	outb(0x87, sio->sioaddr);
+
+	return 0;
 }
 
 static inline void
 superio_exit(struct w83627hf_sio_data *sio)
 {
 	outb(0xAA, sio->sioaddr);
+	release_region(sio->sioaddr, 2);
 }
 
 #define W627_DEVID 0x52
@@ -1273,7 +1279,7 @@ static DEVICE_ATTR(name, S_IRUGO, show_n
 static int __init w83627hf_find(int sioaddr, unsigned short *addr,
 				struct w83627hf_sio_data *sio_data)
 {
-	int err = -ENODEV;
+	int err;
 	u16 val;
 
 	static __initconst char *const names[] = {
@@ -1285,7 +1291,11 @@ static int __init w83627hf_find(int sioa
 	};
 
 	sio_data->sioaddr = sioaddr;
-	superio_enter(sio_data);
+	err = superio_enter(sio_data);
+	if (err)
+		return err;
+
+	err = -ENODEV;
 	val = force_id ? force_id : superio_inb(sio_data, DEVID);
 	switch (val) {
 	case W627_DEVID:
@@ -1639,9 +1649,21 @@ static int w83627thf_read_gpio5(struct p
 	struct w83627hf_sio_data *sio_data = dev_get_platdata(&pdev->dev);
 	int res = 0xff, sel;
 
-	superio_enter(sio_data);
+	if (superio_enter(sio_data)) {
+		/*
+		 * Some other driver reserved the address space for itself.
+		 * We don't want to fail driver instantiation because of that,
+		 * so display a warning and keep going.
+		 */
+		dev_warn(&pdev->dev,
+			 "Can not read VID data: Failed to enable SuperIO access\n");
+		return res;
+	}
+
 	superio_select(sio_data, W83627HF_LD_GPIO5);
 
+	res = 0xff;
+
 	/* Make sure these GPIO pins are enabled */
 	if (!(superio_inb(sio_data, W83627THF_GPIO5_EN) & (1<<3))) {
 		dev_dbg(&pdev->dev, "GPIO5 disabled, no VID function\n");
@@ -1672,7 +1694,17 @@ static int w83687thf_read_vid(struct pla
 	struct w83627hf_sio_data *sio_data = dev_get_platdata(&pdev->dev);
 	int res = 0xff;
 
-	superio_enter(sio_data);
+	if (superio_enter(sio_data)) {
+		/*
+		 * Some other driver reserved the address space for itself.
+		 * We don't want to fail driver instantiation because of that,
+		 * so display a warning and keep going.
+		 */
+		dev_warn(&pdev->dev,
+			 "Can not read VID data: Failed to enable SuperIO access\n");
+		return res;
+	}
+
 	superio_select(sio_data, W83627HF_LD_HWM);
 
 	/* Make sure these GPIO pins are enabled */
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/infiniband/hw/cxgb4/cm.c linux-libre-3.16.74-gnu/drivers/infiniband/hw/cxgb4/cm.c
--- linux-libre-3.16.73-gnu/drivers/infiniband/hw/cxgb4/cm.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/infiniband/hw/cxgb4/cm.c	2019-09-23 16:12:19.000000000 -0400
@@ -346,6 +346,8 @@ static struct sk_buff *get_skb(struct sk
 		skb_reset_transport_header(skb);
 	} else {
 		skb = alloc_skb(len, gfp);
+		if (!skb)
+			return NULL;
 	}
 	t4_set_arp_err_handler(skb, NULL, NULL);
 	return skb;
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/iommu/intel-iommu.c linux-libre-3.16.74-gnu/drivers/iommu/intel-iommu.c
--- linux-libre-3.16.73-gnu/drivers/iommu/intel-iommu.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/iommu/intel-iommu.c	2019-09-23 16:12:19.000000000 -0400
@@ -3578,9 +3578,7 @@ static void __init init_no_remapping_dev
 
 		/* This IOMMU has *only* gfx devices. Either bypass it or
 		   set the gfx_mapped flag, as appropriate */
-		if (dmar_map_gfx) {
-			intel_iommu_gfx_mapped = 1;
-		} else {
+		if (!dmar_map_gfx) {
 			drhd->ignored = 1;
 			for_each_active_dev_scope(drhd->devices,
 						  drhd->devices_cnt, i, dev)
@@ -4074,6 +4072,9 @@ int __init intel_iommu_init(void)
 		goto out_free_reserved_range;
 	}
 
+	if (dmar_map_gfx)
+		intel_iommu_gfx_mapped = 1;
+
 	init_no_remapping_devices();
 
 	ret = init_dmars();
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/md/bcache/journal.c linux-libre-3.16.74-gnu/drivers/md/bcache/journal.c
--- linux-libre-3.16.73-gnu/drivers/md/bcache/journal.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/md/bcache/journal.c	2019-09-23 16:12:19.000000000 -0400
@@ -507,11 +507,11 @@ static void journal_reclaim(struct cache
 				  ca->sb.nr_this_dev);
 	}
 
-	bkey_init(k);
-	SET_KEY_PTRS(k, n);
-
-	if (n)
+	if (n) {
+		bkey_init(k);
+		SET_KEY_PTRS(k, n);
 		c->journal.blocks_free = c->sb.bucket_size >> c->block_bits;
+	}
 out:
 	if (!journal_full(&c->journal))
 		__closure_wake_up(&c->journal.wait);
@@ -635,6 +635,9 @@ static void journal_write_unlocked(struc
 		ca->journal.seq[ca->journal.cur_idx] = w->data->seq;
 	}
 
+	/* If KEY_PTRS(k) == 0, this jset gets lost in air */
+	BUG_ON(i == 0);
+
 	atomic_dec_bug(&fifo_back(&c->journal.pin));
 	bch_journal_next(&c->journal);
 	journal_reclaim(c);
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/md/bcache/super.c linux-libre-3.16.74-gnu/drivers/md/bcache/super.c
--- linux-libre-3.16.73-gnu/drivers/md/bcache/super.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/md/bcache/super.c	2019-09-23 16:12:19.000000000 -0400
@@ -1364,9 +1364,13 @@ static void cache_set_free(struct closur
 	bch_btree_cache_free(c);
 	bch_journal_free(c);
 
+	mutex_lock(&bch_register_lock);
 	for_each_cache(ca, c, i)
-		if (ca)
+		if (ca) {
+			ca->set = NULL;
+			c->cache[ca->sb.nr_this_dev] = NULL;
 			kobject_put(&ca->kobj);
+		}
 
 	bch_bset_sort_state_free(&c->sort);
 	free_pages((unsigned long) c->uuids, ilog2(bucket_pages(c)));
@@ -1383,7 +1387,6 @@ static void cache_set_free(struct closur
 		mempool_destroy(c->search);
 	kfree(c->devices);
 
-	mutex_lock(&bch_register_lock);
 	list_del(&c->list);
 	mutex_unlock(&bch_register_lock);
 
@@ -1804,8 +1807,10 @@ void bch_cache_release(struct kobject *k
 	struct cache *ca = container_of(kobj, struct cache, kobj);
 	unsigned i;
 
-	if (ca->set)
+	if (ca->set) {
+		BUG_ON(ca->set->cache[ca->sb.nr_this_dev] != ca);
 		ca->set->cache[ca->sb.nr_this_dev] = NULL;
+	}
 
 	bio_split_pool_free(&ca->bio_split_hook);
 
@@ -1868,7 +1873,7 @@ static int cache_alloc(struct cache_sb *
 }
 
 static int register_cache(struct cache_sb *sb, struct page *sb_page,
-				  struct block_device *bdev, struct cache *ca)
+				struct block_device *bdev, struct cache *ca)
 {
 	char name[BDEVNAME_SIZE];
 	const char *err = NULL; /* must be set for any error case */
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/media/i2c/soc_camera/ov6650.c linux-libre-3.16.74-gnu/drivers/media/i2c/soc_camera/ov6650.c
--- linux-libre-3.16.73-gnu/drivers/media/i2c/soc_camera/ov6650.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/media/i2c/soc_camera/ov6650.c	2019-09-23 16:12:19.000000000 -0400
@@ -829,6 +829,8 @@ static int ov6650_video_probe(struct i2c
 	if (ret < 0)
 		return ret;
 
+	msleep(20);
+
 	/*
 	 * check and show product ID and manufacturer ID
 	 */
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/media/pci/cx18/cx18-fileops.c linux-libre-3.16.74-gnu/drivers/media/pci/cx18/cx18-fileops.c
--- linux-libre-3.16.73-gnu/drivers/media/pci/cx18/cx18-fileops.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/media/pci/cx18/cx18-fileops.c	2019-09-23 16:12:19.000000000 -0400
@@ -489,7 +489,7 @@ static ssize_t cx18_read_pos(struct cx18
 
 	CX18_DEBUG_HI_FILE("read %zd from %s, got %zd\n", count, s->name, rc);
 	if (rc > 0)
-		pos += rc;
+		*pos += rc;
 	return rc;
 }
 
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/media/pci/ivtv/ivtv-fileops.c linux-libre-3.16.74-gnu/drivers/media/pci/ivtv/ivtv-fileops.c
--- linux-libre-3.16.73-gnu/drivers/media/pci/ivtv/ivtv-fileops.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/media/pci/ivtv/ivtv-fileops.c	2019-09-23 16:12:19.000000000 -0400
@@ -420,7 +420,7 @@ static ssize_t ivtv_read_pos(struct ivtv
 
 	IVTV_DEBUG_HI_FILE("read %zd from %s, got %zd\n", count, s->name, rc);
 	if (rc > 0)
-		pos += rc;
+		*pos += rc;
 	return rc;
 }
 
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/media/platform/davinci/isif.c linux-libre-3.16.74-gnu/drivers/media/platform/davinci/isif.c
--- linux-libre-3.16.73-gnu/drivers/media/platform/davinci/isif.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/media/platform/davinci/isif.c	2019-09-23 16:12:19.000000000 -0400
@@ -890,9 +890,7 @@ static int isif_set_hw_if_params(struct
 static int isif_config_ycbcr(void)
 {
 	struct isif_ycbcr_config *params = &isif_cfg.ycbcr;
-	struct vpss_pg_frame_size frame_size;
 	u32 modeset = 0, ccdcfg = 0;
-	struct vpss_sync_pol sync;
 
 	dev_dbg(isif_cfg.dev, "\nStarting isif_config_ycbcr...");
 
@@ -980,13 +978,6 @@ static int isif_config_ycbcr(void)
 		/* two fields are interleaved in memory */
 		regw(0x00000249, SDOFST);
 
-	/* Setup test pattern if enabled */
-	if (isif_cfg.bayer.config_params.test_pat_gen) {
-		sync.ccdpg_hdpol = params->hd_pol;
-		sync.ccdpg_vdpol = params->vd_pol;
-		dm365_vpss_set_sync_pol(sync);
-		dm365_vpss_set_pg_frame_size(frame_size);
-	}
 	return 0;
 }
 
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/media/platform/davinci/vpbe.c linux-libre-3.16.74-gnu/drivers/media/platform/davinci/vpbe.c
--- linux-libre-3.16.73-gnu/drivers/media/platform/davinci/vpbe.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/media/platform/davinci/vpbe.c	2019-09-23 16:12:19.000000000 -0400
@@ -130,7 +130,7 @@ static int vpbe_enum_outputs(struct vpbe
 			     struct v4l2_output *output)
 {
 	struct vpbe_config *cfg = vpbe_dev->cfg;
-	int temp_index = output->index;
+	unsigned int temp_index = output->index;
 
 	if (temp_index >= cfg->num_outputs)
 		return -EINVAL;
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/media/platform/omap/omap_vout.c linux-libre-3.16.74-gnu/drivers/media/platform/omap/omap_vout.c
--- linux-libre-3.16.73-gnu/drivers/media/platform/omap/omap_vout.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/media/platform/omap/omap_vout.c	2019-09-23 16:12:19.000000000 -0400
@@ -1596,23 +1596,20 @@ static int vidioc_dqbuf(struct file *fil
 	unsigned long size;
 	struct videobuf_buffer *vb;
 
-	vb = q->bufs[b->index];
-
 	if (!vout->streaming)
 		return -EINVAL;
 
-	if (file->f_flags & O_NONBLOCK)
-		/* Call videobuf_dqbuf for non blocking mode */
-		ret = videobuf_dqbuf(q, (struct v4l2_buffer *)b, 1);
-	else
-		/* Call videobuf_dqbuf for  blocking mode */
-		ret = videobuf_dqbuf(q, (struct v4l2_buffer *)b, 0);
+	ret = videobuf_dqbuf(q, b, !!(file->f_flags & O_NONBLOCK));
+	if (ret)
+		return ret;
+
+	vb = q->bufs[b->index];
 
 	addr = (unsigned long) vout->buf_phy_addr[vb->i];
 	size = (unsigned long) vb->size;
 	dma_unmap_single(vout->vid_dev->v4l2_dev.dev,  addr,
 				size, DMA_TO_DEVICE);
-	return ret;
+	return 0;
 }
 
 static int vidioc_streamon(struct file *file, void *fh, enum v4l2_buf_type i)
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/media/radio/radio-raremono.c linux-libre-3.16.74-gnu/drivers/media/radio/radio-raremono.c
--- linux-libre-3.16.73-gnu/drivers/media/radio/radio-raremono.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/media/radio/radio-raremono.c	2019-09-23 16:12:19.000000000 -0400
@@ -283,6 +283,14 @@ static int vidioc_g_frequency(struct fil
 	return 0;
 }
 
+static void raremono_device_release(struct v4l2_device *v4l2_dev)
+{
+	struct raremono_device *radio = to_raremono_dev(v4l2_dev);
+
+	kfree(radio->buffer);
+	kfree(radio);
+}
+
 /* File system interface */
 static const struct v4l2_file_operations usb_raremono_fops = {
 	.owner		= THIS_MODULE,
@@ -307,12 +315,14 @@ static int usb_raremono_probe(struct usb
 	struct raremono_device *radio;
 	int retval = 0;
 
-	radio = devm_kzalloc(&intf->dev, sizeof(struct raremono_device), GFP_KERNEL);
-	if (radio)
-		radio->buffer = devm_kmalloc(&intf->dev, BUFFER_LENGTH, GFP_KERNEL);
-
-	if (!radio || !radio->buffer)
+	radio = kzalloc(sizeof(*radio), GFP_KERNEL);
+	if (!radio)
 		return -ENOMEM;
+	radio->buffer = kmalloc(BUFFER_LENGTH, GFP_KERNEL);
+	if (!radio->buffer) {
+		kfree(radio);
+		return -ENOMEM;
+	}
 
 	radio->usbdev = interface_to_usbdev(intf);
 	radio->intf = intf;
@@ -336,7 +346,8 @@ static int usb_raremono_probe(struct usb
 	if (retval != 3 ||
 	    (get_unaligned_be16(&radio->buffer[1]) & 0xfff) == 0x0242) {
 		dev_info(&intf->dev, "this is not Thanko's Raremono.\n");
-		return -ENODEV;
+		retval = -ENODEV;
+		goto free_mem;
 	}
 
 	dev_info(&intf->dev, "Thanko's Raremono connected: (%04X:%04X)\n",
@@ -345,7 +356,7 @@ static int usb_raremono_probe(struct usb
 	retval = v4l2_device_register(&intf->dev, &radio->v4l2_dev);
 	if (retval < 0) {
 		dev_err(&intf->dev, "couldn't register v4l2_device\n");
-		return retval;
+		goto free_mem;
 	}
 
 	mutex_init(&radio->lock);
@@ -357,6 +368,7 @@ static int usb_raremono_probe(struct usb
 	radio->vdev.ioctl_ops = &usb_raremono_ioctl_ops;
 	radio->vdev.lock = &radio->lock;
 	radio->vdev.release = video_device_release_empty;
+	radio->v4l2_dev.release = raremono_device_release;
 
 	usb_set_intfdata(intf, &radio->v4l2_dev);
 
@@ -373,6 +385,10 @@ static int usb_raremono_probe(struct usb
 	}
 	dev_err(&intf->dev, "could not register video device\n");
 	v4l2_device_unregister(&radio->v4l2_dev);
+
+free_mem:
+	kfree(radio->buffer);
+	kfree(radio);
 	return retval;
 }
 
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/media/radio/wl128x/fmdrv_common.c linux-libre-3.16.74-gnu/drivers/media/radio/wl128x/fmdrv_common.c
--- linux-libre-3.16.73-gnu/drivers/media/radio/wl128x/fmdrv_common.c	2019-08-20 19:56:29.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/media/radio/wl128x/fmdrv_common.c	2019-09-24 13:47:36.000000000 -0400
@@ -494,7 +494,8 @@ int fmc_send_cmd(struct fmdev *fmdev, u8
 		return -EIO;
 	}
 	/* Send response data to caller */
-	if (response != NULL && response_len != NULL && evt_hdr->dlen) {
+	if (response != NULL && response_len != NULL && evt_hdr->dlen &&
+	    evt_hdr->dlen <= payload_len) {
 		/* Skip header info and copy only response data */
 		skb_pull(skb, sizeof(struct fm_event_msg_hdr));
 		memcpy(response, skb->data, evt_hdr->dlen);
@@ -590,6 +591,8 @@ static void fm_irq_handle_flag_getcmd_re
 		return;
 
 	fm_evt_hdr = (void *)skb->data;
+	if (fm_evt_hdr->dlen > sizeof(fmdev->irq_info.flag))
+		return;
 
 	/* Skip header info and copy only response data */
 	skb_pull(skb, sizeof(struct fm_event_msg_hdr));
@@ -1278,8 +1281,9 @@ static int fm_download_firmware(struct f
 
 		switch (action->type) {
 		case ACTION_SEND_COMMAND:	/* Send */
-			if (fmc_send_cmd(fmdev, 0, 0, action->data,
-						action->size, NULL, NULL))
+			ret = fmc_send_cmd(fmdev, 0, 0, action->data,
+					   action->size, NULL, NULL);
+			if (ret)
 				goto rel_fw;
 
 			cmd_cnt++;
@@ -1317,7 +1321,8 @@ static int load_default_rx_configuration
 /* Does FM power on sequence */
 static int fm_power_up(struct fmdev *fmdev, u8 mode)
 {
-	u16 payload, asic_id, asic_ver;
+	u16 payload;
+	__be16 asic_id = 0, asic_ver = 0;
 	int resp_len, ret;
 	u8 fw_name[50];
 
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/media/usb/cpia2/cpia2_usb.c linux-libre-3.16.74-gnu/drivers/media/usb/cpia2/cpia2_usb.c
--- linux-libre-3.16.73-gnu/drivers/media/usb/cpia2/cpia2_usb.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/media/usb/cpia2/cpia2_usb.c	2019-09-23 16:12:19.000000000 -0400
@@ -884,7 +884,6 @@ static void cpia2_usb_disconnect(struct
 	cpia2_unregister_camera(cam);
 	v4l2_device_disconnect(&cam->v4l2_dev);
 	mutex_unlock(&cam->v4l2_lock);
-	v4l2_device_put(&cam->v4l2_dev);
 
 	if(cam->buffers) {
 		DBG("Wakeup waiting processes\n");
@@ -897,6 +896,8 @@ static void cpia2_usb_disconnect(struct
 	DBG("Releasing interface\n");
 	usb_driver_release_interface(&cpia2_driver, intf);
 
+	v4l2_device_put(&cam->v4l2_dev);
+
 	LOG("CPiA2 camera disconnected.\n");
 }
 
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/media/usb/pvrusb2/pvrusb2-hdw.c linux-libre-3.16.74-gnu/drivers/media/usb/pvrusb2/pvrusb2-hdw.c
--- linux-libre-3.16.73-gnu/drivers/media/usb/pvrusb2/pvrusb2-hdw.c	2019-08-20 19:55:48.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/media/usb/pvrusb2/pvrusb2-hdw.c	2019-09-24 13:46:47.000000000 -0400
@@ -670,6 +670,8 @@ static int ctrl_get_input(struct pvr2_ct
 
 static int ctrl_check_input(struct pvr2_ctrl *cptr,int v)
 {
+	if (v < 0 || v > PVR2_CVAL_INPUT_MAX)
+		return 0;
 	return ((1 << v) & cptr->hdw->input_allowed_mask) != 0;
 }
 
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/media/usb/pvrusb2/pvrusb2-hdw.h linux-libre-3.16.74-gnu/drivers/media/usb/pvrusb2/pvrusb2-hdw.h
--- linux-libre-3.16.73-gnu/drivers/media/usb/pvrusb2/pvrusb2-hdw.h	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/media/usb/pvrusb2/pvrusb2-hdw.h	2019-09-23 16:12:19.000000000 -0400
@@ -54,6 +54,7 @@
 #define PVR2_CVAL_INPUT_COMPOSITE 2
 #define PVR2_CVAL_INPUT_SVIDEO 3
 #define PVR2_CVAL_INPUT_RADIO 4
+#define PVR2_CVAL_INPUT_MAX PVR2_CVAL_INPUT_RADIO
 
 enum pvr2_config {
 	pvr2_config_empty,    /* No configuration */
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/media/usb/siano/smsusb.c linux-libre-3.16.74-gnu/drivers/media/usb/siano/smsusb.c
--- linux-libre-3.16.73-gnu/drivers/media/usb/siano/smsusb.c	2019-08-20 19:54:59.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/media/usb/siano/smsusb.c	2019-09-24 13:45:45.000000000 -0400
@@ -359,6 +359,7 @@ static int smsusb_init_device(struct usb
 	struct smsdevice_params_t params;
 	struct smsusb_device_t *dev;
 	int i, rc;
+	int align = 0;
 
 	/* create device object */
 	dev = kzalloc(sizeof(struct smsusb_device_t), GFP_KERNEL);
@@ -372,6 +373,24 @@ static int smsusb_init_device(struct usb
 	dev->udev = interface_to_usbdev(intf);
 	dev->state = SMSUSB_DISCONNECTED;
 
+	for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
+		struct usb_endpoint_descriptor *desc =
+				&intf->cur_altsetting->endpoint[i].desc;
+
+		if (desc->bEndpointAddress & USB_DIR_IN) {
+			dev->in_ep = desc->bEndpointAddress;
+			align = usb_endpoint_maxp(desc) - sizeof(struct sms_msg_hdr);
+		} else {
+			dev->out_ep = desc->bEndpointAddress;
+		}
+	}
+
+	pr_debug("in_ep = %02x, out_ep = %02x\n", dev->in_ep, dev->out_ep);
+	if (!dev->in_ep || !dev->out_ep || align < 0) {  /* Missing endpoints? */
+		smsusb_term_device(intf);
+		return -ENODEV;
+	}
+
 	params.device_type = sms_get_board(board_id)->type;
 
 	switch (params.device_type) {
@@ -386,24 +405,12 @@ static int smsusb_init_device(struct usb
 		/* fall-thru */
 	default:
 		dev->buffer_size = USB2_BUFFER_SIZE;
-		dev->response_alignment =
-		    le16_to_cpu(dev->udev->ep_in[1]->desc.wMaxPacketSize) -
-		    sizeof(struct sms_msg_hdr);
+		dev->response_alignment = align;
 
 		params.flags |= SMS_DEVICE_FAMILY2;
 		break;
 	}
 
-	for (i = 0; i < intf->cur_altsetting->desc.bNumEndpoints; i++) {
-		if (intf->cur_altsetting->endpoint[i].desc. bEndpointAddress & USB_DIR_IN)
-			dev->in_ep = intf->cur_altsetting->endpoint[i].desc.bEndpointAddress;
-		else
-			dev->out_ep = intf->cur_altsetting->endpoint[i].desc.bEndpointAddress;
-	}
-
-	sms_info("in_ep = %02x, out_ep = %02x",
-		dev->in_ep, dev->out_ep);
-
 	params.device = &dev->udev->dev;
 	params.buffer_size = dev->buffer_size;
 	params.num_buffers = MAX_BUFFERS;
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/media/usb/tlg2300/Kconfig linux-libre-3.16.74-gnu/drivers/media/usb/tlg2300/Kconfig
--- linux-libre-3.16.73-gnu/drivers/media/usb/tlg2300/Kconfig	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/media/usb/tlg2300/Kconfig	2019-09-23 16:12:19.000000000 -0400
@@ -7,6 +7,7 @@ config VIDEO_TLG2300
 	select VIDEOBUF_VMALLOC
 	select SND_PCM
 	select VIDEOBUF_DVB
+	depends on PM_RUNTIME
 
 	---help---
 	  This is a video4linux driver for Telegent tlg2300 based TV cards.
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/net/bonding/bond_options.c linux-libre-3.16.74-gnu/drivers/net/bonding/bond_options.c
--- linux-libre-3.16.73-gnu/drivers/net/bonding/bond_options.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/net/bonding/bond_options.c	2019-09-23 16:12:19.000000000 -0400
@@ -1068,13 +1068,6 @@ static int bond_option_arp_validate_set(
 {
 	pr_info("%s: Setting arp_validate to %s (%llu)\n",
 		bond->dev->name, newval->string, newval->value);
-
-	if (bond->dev->flags & IFF_UP) {
-		if (!newval->value)
-			bond->recv_probe = NULL;
-		else if (bond->params.arp_interval)
-			bond->recv_probe = bond_arp_rcv;
-	}
 	bond->params.arp_validate = newval->value;
 
 	return 0;
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/net/ethernet/arc/emac_main.c linux-libre-3.16.74-gnu/drivers/net/ethernet/arc/emac_main.c
--- linux-libre-3.16.73-gnu/drivers/net/ethernet/arc/emac_main.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/net/ethernet/arc/emac_main.c	2019-09-23 16:12:19.000000000 -0400
@@ -150,7 +150,7 @@ static void arc_emac_tx_clean(struct net
 		struct sk_buff *skb = tx_buff->skb;
 		unsigned int info = le32_to_cpu(txbd->info);
 
-		if ((info & FOR_EMAC) || !txbd->data)
+		if ((info & FOR_EMAC) || !txbd->data || !skb)
 			break;
 
 		if (unlikely(info & (DROP | DEFR | LTCL | UFLO))) {
@@ -178,6 +178,7 @@ static void arc_emac_tx_clean(struct net
 
 		txbd->data = 0;
 		txbd->info = 0;
+		tx_buff->skb = NULL;
 
 		*txbd_dirty = (*txbd_dirty + 1) % TX_BD_NUM;
 
@@ -594,7 +595,6 @@ static int arc_emac_tx(struct sk_buff *s
 	dma_unmap_addr_set(&priv->tx_buff[*txbd_curr], addr, addr);
 	dma_unmap_len_set(&priv->tx_buff[*txbd_curr], len, len);
 
-	priv->tx_buff[*txbd_curr].skb = skb;
 	priv->txbd[*txbd_curr].data = cpu_to_le32(addr);
 
 	/* Make sure pointer to data buffer is set */
@@ -604,6 +604,11 @@ static int arc_emac_tx(struct sk_buff *s
 
 	*info = cpu_to_le32(FOR_EMAC | FIRST_OR_LAST_MASK | len);
 
+	/* Make sure info word is set */
+	wmb();
+
+	priv->tx_buff[*txbd_curr].skb = skb;
+
 	/* Increment index to point to the next BD */
 	*txbd_curr = (*txbd_curr + 1) % TX_BD_NUM;
 
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/net/ethernet/chelsio/cxgb3/l2t.h linux-libre-3.16.74-gnu/drivers/net/ethernet/chelsio/cxgb3/l2t.h
--- linux-libre-3.16.73-gnu/drivers/net/ethernet/chelsio/cxgb3/l2t.h	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/net/ethernet/chelsio/cxgb3/l2t.h	2019-09-23 16:12:19.000000000 -0400
@@ -75,8 +75,8 @@ struct l2t_data {
 	struct l2t_entry *rover;	/* starting point for next allocation */
 	atomic_t nfree;		/* number of free entries */
 	rwlock_t lock;
-	struct l2t_entry l2tab[0];
 	struct rcu_head rcu_head;	/* to handle rcu cleanup */
+	struct l2t_entry l2tab[];
 };
 
 typedef void (*arp_failure_handler_func)(struct t3cdev * dev,
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/net/ethernet/freescale/ucc_geth_ethtool.c linux-libre-3.16.74-gnu/drivers/net/ethernet/freescale/ucc_geth_ethtool.c
--- linux-libre-3.16.73-gnu/drivers/net/ethernet/freescale/ucc_geth_ethtool.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/net/ethernet/freescale/ucc_geth_ethtool.c	2019-09-23 16:12:19.000000000 -0400
@@ -253,14 +253,12 @@ uec_set_ringparam(struct net_device *net
 		return -EINVAL;
 	}
 
+	if (netif_running(netdev))
+		return -EBUSY;
+
 	ug_info->bdRingLenRx[queue] = ring->rx_pending;
 	ug_info->bdRingLenTx[queue] = ring->tx_pending;
 
-	if (netif_running(netdev)) {
-		/* FIXME: restart automatically */
-		netdev_info(netdev, "Please re-open the interface\n");
-	}
-
 	return ret;
 }
 
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/net/ethernet/ibm/ehea/ehea_main.c linux-libre-3.16.74-gnu/drivers/net/ethernet/ibm/ehea/ehea_main.c
--- linux-libre-3.16.73-gnu/drivers/net/ethernet/ibm/ehea/ehea_main.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/net/ethernet/ibm/ehea/ehea_main.c	2019-09-23 16:12:19.000000000 -0400
@@ -1476,7 +1476,7 @@ static int ehea_init_port_res(struct ehe
 
 	memset(pr, 0, sizeof(struct ehea_port_res));
 
-	pr->tx_bytes = rx_bytes;
+	pr->tx_bytes = tx_bytes;
 	pr->tx_packets = tx_packets;
 	pr->rx_bytes = rx_bytes;
 	pr->rx_packets = rx_packets;
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/net/wireless/at76c50x-usb.c linux-libre-3.16.74-gnu/drivers/net/wireless/at76c50x-usb.c
--- linux-libre-3.16.73-gnu/drivers/net/wireless/at76c50x-usb.c	2019-08-20 19:58:40.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/net/wireless/at76c50x-usb.c	2019-09-24 13:50:08.000000000 -0400
@@ -2575,8 +2575,8 @@ static int __init at76_mod_init(void)
 	if (result < 0)
 		printk(KERN_ERR DRIVER_NAME
 		       ": usb_register failed (status %d)\n", result);
-
-	led_trigger_register_simple("at76_usb-tx", &ledtrig_tx);
+	else
+		led_trigger_register_simple("at76_usb-tx", &ledtrig_tx);
 	return result;
 }
 
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/net/wireless/ath/ath6kl/wmi.c linux-libre-3.16.74-gnu/drivers/net/wireless/ath/ath6kl/wmi.c
--- linux-libre-3.16.73-gnu/drivers/net/wireless/ath/ath6kl/wmi.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/net/wireless/ath/ath6kl/wmi.c	2019-09-23 16:12:19.000000000 -0400
@@ -1155,6 +1155,10 @@ static int ath6kl_wmi_pstream_timeout_ev
 		return -EINVAL;
 
 	ev = (struct wmi_pstream_timeout_event *) datap;
+	if (ev->traffic_class >= WMM_NUM_AC) {
+		ath6kl_err("invalid traffic class: %d\n", ev->traffic_class);
+		return -EINVAL;
+	}
 
 	/*
 	 * When the pstream (fat pipe == AC) timesout, it means there were
@@ -1496,6 +1500,10 @@ static int ath6kl_wmi_cac_event_rx(struc
 		return -EINVAL;
 
 	reply = (struct wmi_cac_event *) datap;
+	if (reply->ac >= WMM_NUM_AC) {
+		ath6kl_err("invalid AC: %d\n", reply->ac);
+		return -EINVAL;
+	}
 
 	if ((reply->cac_indication == CAC_INDICATION_ADMISSION_RESP) &&
 	    (reply->status_code != IEEE80211_TSPEC_STATUS_ADMISS_ACCEPTED)) {
@@ -2608,7 +2616,7 @@ int ath6kl_wmi_delete_pstream_cmd(struct
 	u16 active_tsids = 0;
 	int ret;
 
-	if (traffic_class > 3) {
+	if (traffic_class >= WMM_NUM_AC) {
 		ath6kl_err("invalid traffic class: %d\n", traffic_class);
 		return -EINVAL;
 	}
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/net/wireless/mwifiex/ie.c linux-libre-3.16.74-gnu/drivers/net/wireless/mwifiex/ie.c
--- linux-libre-3.16.73-gnu/drivers/net/wireless/mwifiex/ie.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/net/wireless/mwifiex/ie.c	2019-09-23 16:12:19.000000000 -0400
@@ -240,6 +240,9 @@ static int mwifiex_update_vs_ie(const u8
 		}
 
 		vs_ie = (struct ieee_types_header *)vendor_ie;
+		if (le16_to_cpu(ie->ie_length) + vs_ie->len + 2 >
+			IEEE_MAX_IE_SIZE)
+			return -EINVAL;
 		memcpy(ie->ie_buffer + le16_to_cpu(ie->ie_length),
 		       vs_ie, vs_ie->len + 2);
 		le16_add_cpu(&ie->ie_length, vs_ie->len + 2);
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/net/wireless/mwifiex/uap_cmd.c linux-libre-3.16.74-gnu/drivers/net/wireless/mwifiex/uap_cmd.c
--- linux-libre-3.16.73-gnu/drivers/net/wireless/mwifiex/uap_cmd.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/net/wireless/mwifiex/uap_cmd.c	2019-09-23 16:12:19.000000000 -0400
@@ -247,6 +247,8 @@ mwifiex_set_uap_rates(struct mwifiex_uap
 
 	rate_ie = (void *)cfg80211_find_ie(WLAN_EID_SUPP_RATES, var_pos, len);
 	if (rate_ie) {
+		if (rate_ie->len > MWIFIEX_SUPPORTED_RATES)
+			return;
 		memcpy(bss_cfg->rates, rate_ie + 1, rate_ie->len);
 		rate_len = rate_ie->len;
 	}
@@ -254,8 +256,11 @@ mwifiex_set_uap_rates(struct mwifiex_uap
 	rate_ie = (void *)cfg80211_find_ie(WLAN_EID_EXT_SUPP_RATES,
 					   params->beacon.tail,
 					   params->beacon.tail_len);
-	if (rate_ie)
+	if (rate_ie) {
+		if (rate_ie->len > MWIFIEX_SUPPORTED_RATES - rate_len)
+			return;
 		memcpy(bss_cfg->rates + rate_len, rate_ie + 1, rate_ie->len);
+	}
 
 	return;
 }
@@ -364,7 +369,7 @@ mwifiex_set_wmm_params(struct mwifiex_pr
 		       struct cfg80211_ap_settings *params)
 {
 	const u8 *vendor_ie;
-	struct ieee_types_header *wmm_ie;
+	const u8 *wmm_ie;
 	u8 wmm_oui[] = {0x00, 0x50, 0xf2, 0x02};
 
 	vendor_ie = cfg80211_find_vendor_ie(WLAN_OUI_MICROSOFT,
@@ -372,9 +377,11 @@ mwifiex_set_wmm_params(struct mwifiex_pr
 					    params->beacon.tail,
 					    params->beacon.tail_len);
 	if (vendor_ie) {
-		wmm_ie = (struct ieee_types_header *)vendor_ie;
-		memcpy(&bss_cfg->wmm_info, wmm_ie + 1,
-		       sizeof(bss_cfg->wmm_info));
+		wmm_ie = vendor_ie;
+		if (*(wmm_ie + 1) > sizeof(struct mwifiex_types_wmm_info))
+			return;
+		memcpy(&bss_cfg->wmm_info, wmm_ie +
+		       sizeof(struct ieee_types_header), *(wmm_ie + 1));
 		priv->wmm_enabled = 1;
 	} else {
 		memset(&bss_cfg->wmm_info, 0, sizeof(bss_cfg->wmm_info));
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/net/wireless/mwl8k.c linux-libre-3.16.74-gnu/drivers/net/wireless/mwl8k.c
--- linux-libre-3.16.73-gnu/drivers/net/wireless/mwl8k.c	2019-08-20 20:00:25.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/net/wireless/mwl8k.c	2019-09-24 13:52:04.000000000 -0400
@@ -436,6 +436,9 @@ static const struct ieee80211_rate mwl8k
 #define MWL8K_CMD_UPDATE_STADB		0x1123
 #define MWL8K_CMD_BASTREAM		0x1125
 
+#define MWL8K_LEGACY_5G_RATE_OFFSET \
+	(ARRAY_SIZE(mwl8k_rates_24) - ARRAY_SIZE(mwl8k_rates_50))
+
 static const char *mwl8k_cmd_name(__le16 cmd, char *buf, int bufsize)
 {
 	u16 command = le16_to_cpu(cmd);
@@ -1011,8 +1014,9 @@ mwl8k_rxd_ap_process(void *_rxd, struct
 
 	if (rxd->channel > 14) {
 		status->band = IEEE80211_BAND_5GHZ;
-		if (!(status->flag & RX_FLAG_HT))
-			status->rate_idx -= 5;
+		if (!(status->flag & RX_FLAG_HT) &&
+		    status->rate_idx >= MWL8K_LEGACY_5G_RATE_OFFSET)
+			status->rate_idx -= MWL8K_LEGACY_5G_RATE_OFFSET;
 	} else {
 		status->band = IEEE80211_BAND_2GHZ;
 	}
@@ -1119,8 +1123,9 @@ mwl8k_rxd_sta_process(void *_rxd, struct
 
 	if (rxd->channel > 14) {
 		status->band = IEEE80211_BAND_5GHZ;
-		if (!(status->flag & RX_FLAG_HT))
-			status->rate_idx -= 5;
+		if (!(status->flag & RX_FLAG_HT) &&
+		    status->rate_idx >= MWL8K_LEGACY_5G_RATE_OFFSET)
+			status->rate_idx -= MWL8K_LEGACY_5G_RATE_OFFSET;
 	} else {
 		status->band = IEEE80211_BAND_2GHZ;
 	}
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/net/wireless/p54/p54pci.c linux-libre-3.16.74-gnu/drivers/net/wireless/p54/p54pci.c
--- linux-libre-3.16.73-gnu/drivers/net/wireless/p54/p54pci.c	2019-08-20 20:00:56.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/net/wireless/p54/p54pci.c	2019-09-24 13:52:35.000000000 -0400
@@ -551,7 +551,7 @@ static int p54p_probe(struct pci_dev *pd
 	err = pci_enable_device(pdev);
 	if (err) {
 		dev_err(&pdev->dev, "Cannot enable new PCI device\n");
-		return err;
+		goto err_put;
 	}
 
 	mem_addr = pci_resource_start(pdev, 0);
@@ -636,6 +636,7 @@ static int p54p_probe(struct pci_dev *pd
 	pci_release_regions(pdev);
  err_disable_dev:
 	pci_disable_device(pdev);
+err_put:
 	pci_dev_put(pdev);
 	return err;
 }
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/net/wireless/p54/p54usb.c linux-libre-3.16.74-gnu/drivers/net/wireless/p54/p54usb.c
--- linux-libre-3.16.73-gnu/drivers/net/wireless/p54/p54usb.c	2019-08-20 20:01:00.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/net/wireless/p54/p54usb.c	2019-09-24 13:52:40.000000000 -0400
@@ -32,6 +32,8 @@ MODULE_LICENSE("GPL");
 MODULE_ALIAS("prism54usb");
 /*(DEBLOBBED)*/
 
+static struct usb_driver p54u_driver;
+
 /*
  * Note:
  *
@@ -920,9 +922,9 @@ static void p54u_load_firmware_cb(const
 {
 	struct p54u_priv *priv = context;
 	struct usb_device *udev = priv->udev;
+	struct usb_interface *intf = priv->intf;
 	int err;
 
-	complete(&priv->fw_wait_load);
 	if (firmware) {
 		priv->fw = firmware;
 		err = p54u_start_ops(priv);
@@ -931,26 +933,22 @@ static void p54u_load_firmware_cb(const
 		dev_err(&udev->dev, "Firmware not found.\n");
 	}
 
-	if (err) {
-		struct device *parent = priv->udev->dev.parent;
-
-		dev_err(&udev->dev, "failed to initialize device (%d)\n", err);
-
-		if (parent)
-			device_lock(parent);
+	complete(&priv->fw_wait_load);
+	/*
+	 * At this point p54u_disconnect may have already freed
+	 * the "priv" context. Do not use it anymore!
+	 */
+	priv = NULL;
 
-		device_release_driver(&udev->dev);
-		/*
-		 * At this point p54u_disconnect has already freed
-		 * the "priv" context. Do not use it anymore!
-		 */
-		priv = NULL;
+	if (err) {
+		dev_err(&intf->dev, "failed to initialize device (%d)\n", err);
 
-		if (parent)
-			device_unlock(parent);
+		usb_lock_device(udev);
+		usb_driver_release_interface(&p54u_driver, intf);
+		usb_unlock_device(udev);
 	}
 
-	usb_put_dev(udev);
+	usb_put_intf(intf);
 }
 
 static int p54u_load_firmware(struct ieee80211_hw *dev,
@@ -971,14 +969,14 @@ static int p54u_load_firmware(struct iee
 	dev_info(&priv->udev->dev, "Loading firmware file %s\n",
 	       p54u_fwlist[i].fw);
 
-	usb_get_dev(udev);
+	usb_get_intf(intf);
 	err = reject_firmware_nowait(THIS_MODULE, 1, p54u_fwlist[i].fw,
 				      device, GFP_KERNEL, priv,
 				      p54u_load_firmware_cb);
 	if (err) {
 		dev_err(&priv->udev->dev, "(p54usb) cannot load firmware %s "
 					  "(%d)!\n", p54u_fwlist[i].fw, err);
-		usb_put_dev(udev);
+		usb_put_intf(intf);
 	}
 
 	return err;
@@ -1010,8 +1008,6 @@ static int p54u_probe(struct usb_interfa
 	skb_queue_head_init(&priv->rx_queue);
 	init_usb_anchor(&priv->submitted);
 
-	usb_get_dev(udev);
-
 	/* really lazy and simple way of figuring out if we're a 3887 */
 	/* TODO: should just stick the identification in the device table */
 	i = intf->altsetting->desc.bNumEndpoints;
@@ -1052,10 +1048,8 @@ static int p54u_probe(struct usb_interfa
 		priv->upload_fw = p54u_upload_firmware_net2280;
 	}
 	err = p54u_load_firmware(dev, intf);
-	if (err) {
-		usb_put_dev(udev);
+	if (err)
 		p54_free_common(dev);
-	}
 	return err;
 }
 
@@ -1071,7 +1065,6 @@ static void p54u_disconnect(struct usb_i
 	wait_for_completion(&priv->fw_wait_load);
 	p54_unregister_common(dev);
 
-	usb_put_dev(interface_to_usbdev(intf));
 	release_firmware(priv->fw);
 	p54_free_common(dev);
 }
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/net/wireless/rsi/rsi_91x_mac80211.c linux-libre-3.16.74-gnu/drivers/net/wireless/rsi/rsi_91x_mac80211.c
--- linux-libre-3.16.73-gnu/drivers/net/wireless/rsi/rsi_91x_mac80211.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/net/wireless/rsi/rsi_91x_mac80211.c	2019-09-23 16:12:19.000000000 -0400
@@ -199,6 +199,7 @@ void rsi_mac80211_detach(struct rsi_hw *
 		ieee80211_stop_queues(hw);
 		ieee80211_unregister_hw(hw);
 		ieee80211_free_hw(hw);
+		adapter->hw = NULL;
 	}
 
 	rsi_remove_dbgfs(adapter);
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/pci/pcie/aspm.c linux-libre-3.16.74-gnu/drivers/pci/pcie/aspm.c
--- linux-libre-3.16.73-gnu/drivers/pci/pcie/aspm.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/pci/pcie/aspm.c	2019-09-23 16:12:19.000000000 -0400
@@ -175,6 +175,38 @@ static void pcie_clkpm_cap_init(struct p
 	link->clkpm_capable = (blacklist) ? 0 : capable;
 }
 
+static bool pcie_retrain_link(struct pcie_link_state *link)
+{
+	struct pci_dev *parent = link->pdev;
+	unsigned long start_jiffies;
+	u16 reg16;
+
+	pcie_capability_read_word(parent, PCI_EXP_LNKCTL, &reg16);
+	reg16 |= PCI_EXP_LNKCTL_RL;
+	pcie_capability_write_word(parent, PCI_EXP_LNKCTL, reg16);
+	if (parent->clear_retrain_link) {
+		/*
+		 * Due to an erratum in some devices the Retrain Link bit
+		 * needs to be cleared again manually to allow the link
+		 * training to succeed.
+		 */
+		reg16 &= ~PCI_EXP_LNKCTL_RL;
+		pcie_capability_write_word(parent, PCI_EXP_LNKCTL, reg16);
+	}
+
+	/* Wait for link training end. Break out after waiting for timeout */
+	start_jiffies = jiffies;
+	for (;;) {
+		pcie_capability_read_word(parent, PCI_EXP_LNKSTA, &reg16);
+		if (!(reg16 & PCI_EXP_LNKSTA_LT))
+			break;
+		if (time_after(jiffies, start_jiffies + LINK_RETRAIN_TIMEOUT))
+			break;
+		msleep(1);
+	}
+	return !(reg16 & PCI_EXP_LNKSTA_LT);
+}
+
 /*
  * pcie_aspm_configure_common_clock: check if the 2 ends of a link
  *   could use common clock. If they are, configure them to use the
@@ -184,7 +216,6 @@ static void pcie_aspm_configure_common_c
 {
 	int same_clock = 1;
 	u16 reg16, parent_reg, child_reg[8];
-	unsigned long start_jiffies;
 	struct pci_dev *child, *parent = link->pdev;
 	struct pci_bus *linkbus = parent->subordinate;
 	/*
@@ -224,21 +255,7 @@ static void pcie_aspm_configure_common_c
 		reg16 &= ~PCI_EXP_LNKCTL_CCC;
 	pcie_capability_write_word(parent, PCI_EXP_LNKCTL, reg16);
 
-	/* Retrain link */
-	reg16 |= PCI_EXP_LNKCTL_RL;
-	pcie_capability_write_word(parent, PCI_EXP_LNKCTL, reg16);
-
-	/* Wait for link training end. Break out after waiting for timeout */
-	start_jiffies = jiffies;
-	for (;;) {
-		pcie_capability_read_word(parent, PCI_EXP_LNKSTA, &reg16);
-		if (!(reg16 & PCI_EXP_LNKSTA_LT))
-			break;
-		if (time_after(jiffies, start_jiffies + LINK_RETRAIN_TIMEOUT))
-			break;
-		msleep(1);
-	}
-	if (!(reg16 & PCI_EXP_LNKSTA_LT))
+	if (pcie_retrain_link(link))
 		return;
 
 	/* Training failed. Restore common clock configurations */
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/pci/quirks.c linux-libre-3.16.74-gnu/drivers/pci/quirks.c
--- linux-libre-3.16.73-gnu/drivers/pci/quirks.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/pci/quirks.c	2019-09-23 16:12:19.000000000 -0400
@@ -2047,6 +2047,23 @@ DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_IN
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x10f4, quirk_disable_aspm_l0s);
 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x1508, quirk_disable_aspm_l0s);
 
+/*
+ * Some Pericom PCIe-to-PCI bridges in reverse mode need the PCIe Retrain
+ * Link bit cleared after starting the link retrain process to allow this
+ * process to finish.
+ *
+ * Affected devices: PI7C9X110, PI7C9X111SL, PI7C9X130.  See also the
+ * Pericom Errata Sheet PI7C9X111SLB_errata_rev1.2_102711.pdf.
+ */
+static void quirk_enable_clear_retrain_link(struct pci_dev *dev)
+{
+	dev->clear_retrain_link = 1;
+	dev_info(&dev->dev, "Enable PCIe Retrain Link quirk\n");
+}
+DECLARE_PCI_FIXUP_HEADER(0x12d8, 0xe110, quirk_enable_clear_retrain_link);
+DECLARE_PCI_FIXUP_HEADER(0x12d8, 0xe111, quirk_enable_clear_retrain_link);
+DECLARE_PCI_FIXUP_HEADER(0x12d8, 0xe130, quirk_enable_clear_retrain_link);
+
 static void fixup_rev1_53c810(struct pci_dev *dev)
 {
 	/* rev 1 ncr53c810 chips don't set the class at all which means
@@ -3137,6 +3154,7 @@ DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_A
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0032, quirk_no_bus_reset);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x003c, quirk_no_bus_reset);
 DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0033, quirk_no_bus_reset);
+DECLARE_PCI_FIXUP_HEADER(PCI_VENDOR_ID_ATHEROS, 0x0034, quirk_no_bus_reset);
 
 static void pci_do_fixups(struct pci_dev *dev, struct pci_fixup *f,
 			  struct pci_fixup *end)
@@ -3882,3 +3900,61 @@ void pci_dev_specific_enable_acs(struct
 		}
 	}
 }
+
+/*
+ * On Lenovo Thinkpad P50 SKUs with a Nvidia Quadro M1000M, the BIOS does
+ * not always reset the secondary Nvidia GPU between reboots if the system
+ * is configured to use Hybrid Graphics mode.  This results in the GPU
+ * being left in whatever state it was in during the *previous* boot, which
+ * causes spurious interrupts from the GPU, which in turn causes us to
+ * disable the wrong IRQ and end up breaking the touchpad.  Unsurprisingly,
+ * this also completely breaks nouveau.
+ *
+ * Luckily, it seems a simple reset of the Nvidia GPU brings it back to a
+ * clean state and fixes all these issues.
+ *
+ * When the machine is configured in Dedicated display mode, the issue
+ * doesn't occur.  Fortunately the GPU advertises NoReset+ when in this
+ * mode, so we can detect that and avoid resetting it.
+ */
+static void quirk_reset_lenovo_thinkpad_p50_nvgpu(struct pci_dev *pdev)
+{
+	void __iomem *map;
+	int ret;
+
+	if (pdev->subsystem_vendor != PCI_VENDOR_ID_LENOVO ||
+	    pdev->subsystem_device != 0x222e ||
+	    !pdev->reset_fn)
+		return;
+
+	if (pci_enable_device_mem(pdev))
+		return;
+
+	/*
+	 * Based on nvkm_device_ctor() in
+	 * drivers/gpu/drm/nouveau/nvkm/engine/device/base.c
+	 */
+	map = pci_iomap(pdev, 0, 0x23000);
+	if (!map) {
+		dev_err(&pdev->dev, "Can't map MMIO space\n");
+		goto out_disable;
+	}
+
+	/*
+	 * Make sure the GPU looks like it's been POSTed before resetting
+	 * it.
+	 */
+	if (ioread32(map + 0x2240c) & 0x2) {
+		dev_info(&pdev->dev, FW_BUG "GPU left initialized by EFI, resetting\n");
+		ret = pci_reset_function(pdev);
+		if (ret < 0)
+			dev_err(&pdev->dev, "Failed to reset GPU: %d\n", ret);
+	}
+
+	iounmap(map);
+out_disable:
+	pci_disable_device(pdev);
+}
+DECLARE_PCI_FIXUP_CLASS_FINAL(PCI_VENDOR_ID_NVIDIA, 0x13b1,
+			      PCI_CLASS_DISPLAY_VGA, 8,
+			      quirk_reset_lenovo_thinkpad_p50_nvgpu);
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/platform/x86/alienware-wmi.c linux-libre-3.16.74-gnu/drivers/platform/x86/alienware-wmi.c
--- linux-libre-3.16.73-gnu/drivers/platform/x86/alienware-wmi.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/platform/x86/alienware-wmi.c	2019-09-23 16:12:19.000000000 -0400
@@ -433,23 +433,22 @@ static acpi_status alienware_hdmi_comman
 
 	input.length = (acpi_size) sizeof(*in_args);
 	input.pointer = in_args;
-	if (out_data != NULL) {
+	if (out_data) {
 		output.length = ACPI_ALLOCATE_BUFFER;
 		output.pointer = NULL;
 		status = wmi_evaluate_method(WMAX_CONTROL_GUID, 1,
 					     command, &input, &output);
-	} else
+		if (ACPI_SUCCESS(status)) {
+			obj = (union acpi_object *)output.pointer;
+			if (obj && obj->type == ACPI_TYPE_INTEGER)
+				*out_data = (u32)obj->integer.value;
+		}
+		kfree(output.pointer);
+	} else {
 		status = wmi_evaluate_method(WMAX_CONTROL_GUID, 1,
 					     command, &input, NULL);
-
-	if (ACPI_SUCCESS(status) && out_data != NULL) {
-		obj = (union acpi_object *)output.pointer;
-		if (obj && obj->type == ACPI_TYPE_INTEGER)
-			*out_data = (u32) obj->integer.value;
 	}
-	kfree(output.pointer);
 	return status;
-
 }
 
 static ssize_t show_hdmi_cable(struct device *dev,
@@ -495,7 +494,7 @@ static ssize_t show_hdmi_source(struct d
 			return scnprintf(buf, PAGE_SIZE,
 					 "input [gpu] unknown\n");
 	}
-	pr_err("alienware-wmi: unknown HDMI source status: %d\n", out_data);
+	pr_err("alienware-wmi: unknown HDMI source status: %u\n", status);
 	return scnprintf(buf, PAGE_SIZE, "input gpu [unknown]\n");
 }
 
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/platform/x86/sony-laptop.c linux-libre-3.16.74-gnu/drivers/platform/x86/sony-laptop.c
--- linux-libre-3.16.73-gnu/drivers/platform/x86/sony-laptop.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/platform/x86/sony-laptop.c	2019-09-23 16:12:19.000000000 -0400
@@ -4401,14 +4401,16 @@ sony_pic_read_possible_resource(struct a
 			}
 			return AE_OK;
 		}
+
+	case ACPI_RESOURCE_TYPE_END_TAG:
+		return AE_OK;
+
 	default:
 		dprintk("Resource %d isn't an IRQ nor an IO port\n",
 			resource->type);
+		return AE_CTRL_TERMINATE;
 
-	case ACPI_RESOURCE_TYPE_END_TAG:
-		return AE_OK;
 	}
-	return AE_CTRL_TERMINATE;
 }
 
 static int sony_pic_possible_resources(struct acpi_device *device)
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/pwm/core.c linux-libre-3.16.74-gnu/drivers/pwm/core.c
--- linux-libre-3.16.73-gnu/drivers/pwm/core.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/pwm/core.c	2019-09-23 16:12:19.000000000 -0400
@@ -273,10 +273,12 @@ int pwmchip_add(struct pwm_chip *chip)
 	if (IS_ENABLED(CONFIG_OF))
 		of_pwmchip_add(chip);
 
-	pwmchip_sysfs_export(chip);
-
 out:
 	mutex_unlock(&pwm_lock);
+
+	if (!ret)
+		pwmchip_sysfs_export(chip);
+
 	return ret;
 }
 EXPORT_SYMBOL_GPL(pwmchip_add);
@@ -293,7 +295,7 @@ int pwmchip_remove(struct pwm_chip *chip
 	unsigned int i;
 	int ret = 0;
 
-	pwmchip_sysfs_unexport_children(chip);
+	pwmchip_sysfs_unexport(chip);
 
 	mutex_lock(&pwm_lock);
 
@@ -313,8 +315,6 @@ int pwmchip_remove(struct pwm_chip *chip
 
 	free_pwms(chip);
 
-	pwmchip_sysfs_unexport(chip);
-
 out:
 	mutex_unlock(&pwm_lock);
 	return ret;
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/pwm/pwm-tiehrpwm.c linux-libre-3.16.74-gnu/drivers/pwm/pwm-tiehrpwm.c
--- linux-libre-3.16.73-gnu/drivers/pwm/pwm-tiehrpwm.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/pwm/pwm-tiehrpwm.c	2019-09-23 16:12:19.000000000 -0400
@@ -379,6 +379,8 @@ static void ehrpwm_pwm_disable(struct pw
 	}
 
 	/* Update shadow register first before modifying active register */
+	ehrpwm_modify(pc->mmio_base, AQSFRC, AQSFRC_RLDCSF_MASK,
+		      AQSFRC_RLDCSF_ZRO);
 	ehrpwm_modify(pc->mmio_base, AQCSFRC, aqcsfrc_mask, aqcsfrc_val);
 	/*
 	 * Changes to immediate action on Action Qualifier. This puts
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/pwm/sysfs.c linux-libre-3.16.74-gnu/drivers/pwm/sysfs.c
--- linux-libre-3.16.73-gnu/drivers/pwm/sysfs.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/pwm/sysfs.c	2019-09-23 16:12:19.000000000 -0400
@@ -330,19 +330,6 @@ void pwmchip_sysfs_export(struct pwm_chi
 void pwmchip_sysfs_unexport(struct pwm_chip *chip)
 {
 	struct device *parent;
-
-	parent = class_find_device(&pwm_class, NULL, chip,
-				   pwmchip_sysfs_match);
-	if (parent) {
-		/* for class_find_device() */
-		put_device(parent);
-		device_unregister(parent);
-	}
-}
-
-void pwmchip_sysfs_unexport_children(struct pwm_chip *chip)
-{
-	struct device *parent;
 	unsigned int i;
 
 	parent = class_find_device(&pwm_class, NULL, chip,
@@ -358,6 +345,7 @@ void pwmchip_sysfs_unexport_children(str
 	}
 
 	put_device(parent);
+	device_unregister(parent);
 }
 
 static int __init pwm_sysfs_init(void)
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/rtc/interface.c linux-libre-3.16.74-gnu/drivers/rtc/interface.c
--- linux-libre-3.16.73-gnu/drivers/rtc/interface.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/rtc/interface.c	2019-09-23 16:12:19.000000000 -0400
@@ -492,10 +492,9 @@ out:
 	mutex_unlock(&rtc->ops_lock);
 #ifdef CONFIG_RTC_INTF_DEV_UIE_EMUL
 	/*
-	 * Enable emulation if the driver did not provide
-	 * the update_irq_enable function pointer or if returned
-	 * -EINVAL to signal that it has been configured without
-	 * interrupts or that are not available at the moment.
+	 * Enable emulation if the driver returned -EINVAL to signal that it has
+	 * been configured without interrupts or they are not available at the
+	 * moment.
 	 */
 	if (err == -EINVAL)
 		err = rtc_dev_update_irq_enable_emul(rtc, enabled);
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/scsi/libsas/sas_expander.c linux-libre-3.16.74-gnu/drivers/scsi/libsas/sas_expander.c
--- linux-libre-3.16.73-gnu/drivers/scsi/libsas/sas_expander.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/scsi/libsas/sas_expander.c	2019-09-23 16:12:19.000000000 -0400
@@ -977,6 +977,8 @@ static struct domain_device *sas_ex_disc
 		list_del(&child->dev_list_node);
 		spin_unlock_irq(&parent->port->dev_list_lock);
 		sas_put_device(child);
+		sas_port_delete(phy->port);
+		phy->port = NULL;
 		return NULL;
 	}
 	list_add_tail(&child->siblings, &parent->ex_dev.children);
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/scsi/qla2xxx/qla_attr.c linux-libre-3.16.74-gnu/drivers/scsi/qla2xxx/qla_attr.c
--- linux-libre-3.16.73-gnu/drivers/scsi/qla2xxx/qla_attr.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/scsi/qla2xxx/qla_attr.c	2019-09-23 16:12:19.000000000 -0400
@@ -423,7 +423,7 @@ qla2x00_sysfs_write_optrom_ctl(struct fi
 		}
 
 		ha->optrom_region_start = start;
-		ha->optrom_region_size = start + size;
+		ha->optrom_region_size = size;
 
 		ha->optrom_state = QLA_SREADING;
 		ha->optrom_buffer = vmalloc(ha->optrom_region_size);
@@ -495,7 +495,7 @@ qla2x00_sysfs_write_optrom_ctl(struct fi
 		}
 
 		ha->optrom_region_start = start;
-		ha->optrom_region_size = start + size;
+		ha->optrom_region_size = size;
 
 		ha->optrom_state = QLA_SWRITING;
 		ha->optrom_buffer = vmalloc(ha->optrom_region_size);
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/scsi/qla2xxx/qla_os.c linux-libre-3.16.74-gnu/drivers/scsi/qla2xxx/qla_os.c
--- linux-libre-3.16.73-gnu/drivers/scsi/qla2xxx/qla_os.c	2019-08-20 20:04:48.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/scsi/qla2xxx/qla_os.c	2019-09-24 13:56:22.000000000 -0400
@@ -5775,8 +5775,7 @@ qla2x00_module_init(void)
 	/* Initialize target kmem_cache and mem_pools */
 	ret = qlt_init();
 	if (ret < 0) {
-		kmem_cache_destroy(srb_cachep);
-		return ret;
+		goto destroy_cache;
 	} else if (ret > 0) {
 		/*
 		 * If initiator mode is explictly disabled by qlt_init(),
@@ -5795,11 +5794,10 @@ qla2x00_module_init(void)
 	qla2xxx_transport_template =
 	    fc_attach_transport(&qla2xxx_transport_functions);
 	if (!qla2xxx_transport_template) {
-		kmem_cache_destroy(srb_cachep);
 		ql_log(ql_log_fatal, NULL, 0x0002,
 		    "fc_attach_transport failed...Failing load!.\n");
-		qlt_exit();
-		return -ENODEV;
+		ret = -ENODEV;
+		goto qlt_exit;
 	}
 
 	apidev_major = register_chrdev(0, QLA2XXX_APIDEV, &apidev_fops);
@@ -5811,27 +5809,37 @@ qla2x00_module_init(void)
 	qla2xxx_transport_vport_template =
 	    fc_attach_transport(&qla2xxx_transport_vport_functions);
 	if (!qla2xxx_transport_vport_template) {
-		kmem_cache_destroy(srb_cachep);
-		qlt_exit();
-		fc_release_transport(qla2xxx_transport_template);
 		ql_log(ql_log_fatal, NULL, 0x0004,
 		    "fc_attach_transport vport failed...Failing load!.\n");
-		return -ENODEV;
+		ret = -ENODEV;
+		goto unreg_chrdev;
 	}
 	ql_log(ql_log_info, NULL, 0x0005,
 	    "QLogic Fibre Channel HBA Driver: %s.\n",
 	    qla2x00_version_str);
 	ret = pci_register_driver(&qla2xxx_pci_driver);
 	if (ret) {
-		kmem_cache_destroy(srb_cachep);
-		qlt_exit();
-		fc_release_transport(qla2xxx_transport_template);
-		fc_release_transport(qla2xxx_transport_vport_template);
 		ql_log(ql_log_fatal, NULL, 0x0006,
 		    "pci_register_driver failed...ret=%d Failing load!.\n",
 		    ret);
+		goto release_vport_transport;
 	}
 	return ret;
+
+release_vport_transport:
+	fc_release_transport(qla2xxx_transport_vport_template);
+
+unreg_chrdev:
+	if (apidev_major >= 0)
+		unregister_chrdev(apidev_major, QLA2XXX_APIDEV);
+	fc_release_transport(qla2xxx_transport_template);
+
+qlt_exit:
+	qlt_exit();
+
+destroy_cache:
+	kmem_cache_destroy(srb_cachep);
+	return ret;
 }
 
 /**
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/scsi/qla4xxx/ql4_os.c linux-libre-3.16.74-gnu/drivers/scsi/qla4xxx/ql4_os.c
--- linux-libre-3.16.73-gnu/drivers/scsi/qla4xxx/ql4_os.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/scsi/qla4xxx/ql4_os.c	2019-09-23 16:12:19.000000000 -0400
@@ -5923,7 +5923,7 @@ static int get_fw_boot_info(struct scsi_
 		val = rd_nvram_byte(ha, sec_addr);
 		if (val & BIT_7)
 			ddb_index[1] = (val & 0x7f);
-
+		goto exit_boot_info;
 	} else if (is_qla80XX(ha)) {
 		buf = dma_alloc_coherent(&ha->pdev->dev, size,
 					 &buf_dma, GFP_KERNEL);
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/spi/spi-rspi.c linux-libre-3.16.74-gnu/drivers/spi/spi-rspi.c
--- linux-libre-3.16.73-gnu/drivers/spi/spi-rspi.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/spi/spi-rspi.c	2019-09-23 16:12:19.000000000 -0400
@@ -277,7 +277,8 @@ static int rspi_set_config_register(stru
 	/* Sets parity, interrupt mask */
 	rspi_write8(rspi, 0x00, RSPI_SPCR2);
 
-	/* Sets SPCMD */
+	/* Resets sequencer */
+	rspi_write8(rspi, 0, RSPI_SPSCR);
 	rspi->spcmd |= SPCMD_SPB_8_TO_16(access_size);
 	rspi_write16(rspi, rspi->spcmd, RSPI_SPCMD0);
 
@@ -311,7 +312,8 @@ static int rspi_rz_set_config_register(s
 	rspi_write8(rspi, 0x00, RSPI_SSLND);
 	rspi_write8(rspi, 0x00, RSPI_SPND);
 
-	/* Sets SPCMD */
+	/* Resets sequencer */
+	rspi_write8(rspi, 0, RSPI_SPSCR);
 	rspi->spcmd |= SPCMD_SPB_8_TO_16(access_size);
 	rspi_write16(rspi, rspi->spcmd, RSPI_SPCMD0);
 
@@ -362,7 +364,8 @@ static int qspi_set_config_register(stru
 	/* Sets buffer to allow normal operation */
 	rspi_write8(rspi, 0x00, QSPI_SPBFCR);
 
-	/* Sets SPCMD */
+	/* Resets sequencer */
+	rspi_write8(rspi, 0, RSPI_SPSCR);
 	rspi_write16(rspi, rspi->spcmd, RSPI_SPCMD0);
 
 	/* Enables SPI function in master mode */
@@ -726,28 +729,6 @@ static int qspi_transfer_one(struct spi_
 	}
 }
 
-static int rspi_setup(struct spi_device *spi)
-{
-	struct rspi_data *rspi = spi_master_get_devdata(spi->master);
-
-	rspi->max_speed_hz = spi->max_speed_hz;
-
-	rspi->spcmd = SPCMD_SSLKP;
-	if (spi->mode & SPI_CPOL)
-		rspi->spcmd |= SPCMD_CPOL;
-	if (spi->mode & SPI_CPHA)
-		rspi->spcmd |= SPCMD_CPHA;
-
-	/* CMOS output mode and MOSI signal from previous transfer */
-	rspi->sppcr = 0;
-	if (spi->mode & SPI_LOOP)
-		rspi->sppcr |= SPPCR_SPLP;
-
-	set_config_register(rspi, 8);
-
-	return 0;
-}
-
 static u16 qspi_transfer_mode(const struct spi_transfer *xfer)
 {
 	if (xfer->tx_buf)
@@ -817,8 +798,24 @@ static int rspi_prepare_message(struct s
 				struct spi_message *msg)
 {
 	struct rspi_data *rspi = spi_master_get_devdata(master);
+	struct spi_device *spi = msg->spi;
 	int ret;
 
+	rspi->max_speed_hz = spi->max_speed_hz;
+
+	rspi->spcmd = SPCMD_SSLKP;
+	if (spi->mode & SPI_CPOL)
+		rspi->spcmd |= SPCMD_CPOL;
+	if (spi->mode & SPI_CPHA)
+		rspi->spcmd |= SPCMD_CPHA;
+
+	/* CMOS output mode and MOSI signal from previous transfer */
+	rspi->sppcr = 0;
+	if (spi->mode & SPI_LOOP)
+		rspi->sppcr |= SPPCR_SPLP;
+
+	set_config_register(rspi, 8);
+
 	if (msg->spi->mode &
 	    (SPI_TX_DUAL | SPI_TX_QUAD | SPI_RX_DUAL | SPI_RX_QUAD)) {
 		/* Setup sequencer for messages with multiple transfer modes */
@@ -1119,7 +1116,6 @@ static int rspi_probe(struct platform_de
 	init_waitqueue_head(&rspi->wait);
 
 	master->bus_num = pdev->id;
-	master->setup = rspi_setup;
 	master->auto_runtime_pm = true;
 	master->transfer_one = ops->transfer_one;
 	master->prepare_message = rspi_prepare_message;
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/staging/comedi/drivers/dt282x.c linux-libre-3.16.74-gnu/drivers/staging/comedi/drivers/dt282x.c
--- linux-libre-3.16.73-gnu/drivers/staging/comedi/drivers/dt282x.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/staging/comedi/drivers/dt282x.c	2019-09-23 16:12:19.000000000 -0400
@@ -483,7 +483,8 @@ static irqreturn_t dt282x_interrupt(int
 	}
 #endif
 	cfc_handle_events(dev, s);
-	cfc_handle_events(dev, s_ao);
+	if (s_ao)
+		cfc_handle_events(dev, s_ao);
 
 	return IRQ_RETVAL(handled);
 }
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/staging/line6/pcm.c linux-libre-3.16.74-gnu/drivers/staging/line6/pcm.c
--- linux-libre-3.16.73-gnu/drivers/staging/line6/pcm.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/staging/line6/pcm.c	2019-09-23 16:12:19.000000000 -0400
@@ -492,6 +492,11 @@ int line6_init_pcm(struct usb_line6 *lin
 				usb_rcvisocpipe(line6->usbdev, ep_read), 0),
 			usb_maxpacket(line6->usbdev,
 				usb_sndisocpipe(line6->usbdev, ep_write), 1));
+	if (!line6pcm->max_packet_size) {
+		dev_err(line6pcm->line6->ifcdev,
+			"cannot get proper max packet size\n");
+		return -EINVAL;
+	}
 
 	line6pcm->properties = properties;
 	line6->line6pcm = line6pcm;
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/tty/serial/serial_core.c linux-libre-3.16.74-gnu/drivers/tty/serial/serial_core.c
--- linux-libre-3.16.73-gnu/drivers/tty/serial/serial_core.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/tty/serial/serial_core.c	2019-09-23 16:12:19.000000000 -0400
@@ -1541,6 +1541,16 @@ static void uart_dtr_rts(struct tty_port
 		uart_clear_mctrl(uport, TIOCM_DTR | TIOCM_RTS);
 }
 
+static int uart_install(struct tty_driver *driver, struct tty_struct *tty)
+{
+	struct uart_driver *drv = driver->driver_state;
+	struct uart_state *state = drv->state + tty->index;
+
+	tty->driver_data = state;
+
+	return tty_standard_install(driver, tty);
+}
+
 /*
  * Calls to uart_open are serialised by the tty_lock in
  *   drivers/tty/tty_io.c:tty_open()
@@ -1553,9 +1563,8 @@ static void uart_dtr_rts(struct tty_port
  */
 static int uart_open(struct tty_struct *tty, struct file *filp)
 {
-	struct uart_driver *drv = (struct uart_driver *)tty->driver->driver_state;
 	int retval, line = tty->index;
-	struct uart_state *state = drv->state + line;
+	struct uart_state *state = tty->driver_data;
 	struct tty_port *port = &state->port;
 
 	pr_debug("uart_open(%d) called\n", line);
@@ -1583,7 +1592,6 @@ static int uart_open(struct tty_struct *
 	 * uart_close() will decrement the driver module use count.
 	 * Any failures from here onwards should not touch the count.
 	 */
-	tty->driver_data = state;
 	state->uart_port->state = state;
 	state->port.low_latency =
 		(state->uart_port->flags & UPF_LOW_LATENCY) ? 1 : 0;
@@ -2265,6 +2273,7 @@ static void uart_poll_put_char(struct tt
 #endif
 
 static const struct tty_operations uart_ops = {
+	.install	= uart_install,
 	.open		= uart_open,
 	.close		= uart_close,
 	.write		= uart_write,
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/tty/vt/keyboard.c linux-libre-3.16.74-gnu/drivers/tty/vt/keyboard.c
--- linux-libre-3.16.73-gnu/drivers/tty/vt/keyboard.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/tty/vt/keyboard.c	2019-09-23 16:12:19.000000000 -0400
@@ -120,6 +120,7 @@ static const int NR_TYPES = ARRAY_SIZE(m
 static struct input_handler kbd_handler;
 static DEFINE_SPINLOCK(kbd_event_lock);
 static DEFINE_SPINLOCK(led_lock);
+static DEFINE_SPINLOCK(func_buf_lock); /* guard 'func_buf'  and friends */
 static unsigned long key_down[BITS_TO_LONGS(KEY_CNT)];	/* keyboard key bitmap */
 static unsigned char shift_down[NR_SHIFT];		/* shift state counters.. */
 static bool dead_key_next;
@@ -1865,11 +1866,12 @@ int vt_do_kdgkb_ioctl(int cmd, struct kb
 	char *p;
 	u_char *q;
 	u_char __user *up;
-	int sz;
+	int sz, fnw_sz;
 	int delta;
 	char *first_free, *fj, *fnw;
 	int i, j, k;
 	int ret;
+	unsigned long flags;
 
 	if (!capable(CAP_SYS_TTY_CONFIG))
 		perm = 0;
@@ -1912,7 +1914,14 @@ int vt_do_kdgkb_ioctl(int cmd, struct kb
 			goto reterr;
 		}
 
+		fnw = NULL;
+		fnw_sz = 0;
+		/* race aginst other writers */
+		again:
+		spin_lock_irqsave(&func_buf_lock, flags);
 		q = func_table[i];
+
+		/* fj pointer to next entry after 'q' */
 		first_free = funcbufptr + (funcbufsize - funcbufleft);
 		for (j = i+1; j < MAX_NR_FUNC && !func_table[j]; j++)
 			;
@@ -1920,10 +1929,12 @@ int vt_do_kdgkb_ioctl(int cmd, struct kb
 			fj = func_table[j];
 		else
 			fj = first_free;
-
+		/* buffer usage increase by new entry */
 		delta = (q ? -strlen(q) : 1) + strlen(kbs->kb_string);
+
 		if (delta <= funcbufleft) { 	/* it fits in current buf */
 		    if (j < MAX_NR_FUNC) {
+			/* make enough space for new entry at 'fj' */
 			memmove(fj + delta, fj, first_free - fj);
 			for (k = j; k < MAX_NR_FUNC; k++)
 			    if (func_table[k])
@@ -1936,20 +1947,28 @@ int vt_do_kdgkb_ioctl(int cmd, struct kb
 		    sz = 256;
 		    while (sz < funcbufsize - funcbufleft + delta)
 		      sz <<= 1;
-		    fnw = kmalloc(sz, GFP_KERNEL);
-		    if(!fnw) {
-		      ret = -ENOMEM;
-		      goto reterr;
+		    if (fnw_sz != sz) {
+		      spin_unlock_irqrestore(&func_buf_lock, flags);
+		      kfree(fnw);
+		      fnw = kmalloc(sz, GFP_KERNEL);
+		      fnw_sz = sz;
+		      if (!fnw) {
+			ret = -ENOMEM;
+			goto reterr;
+		      }
+		      goto again;
 		    }
 
 		    if (!q)
 		      func_table[i] = fj;
+		    /* copy data before insertion point to new location */
 		    if (fj > funcbufptr)
 			memmove(fnw, funcbufptr, fj - funcbufptr);
 		    for (k = 0; k < j; k++)
 		      if (func_table[k])
 			func_table[k] = fnw + (func_table[k] - funcbufptr);
 
+		    /* copy data after insertion point to new location */
 		    if (first_free > fj) {
 			memmove(fnw + (fj - funcbufptr) + delta, fj, first_free - fj);
 			for (k = j; k < MAX_NR_FUNC; k++)
@@ -1962,7 +1981,9 @@ int vt_do_kdgkb_ioctl(int cmd, struct kb
 		    funcbufleft = funcbufleft - delta + sz - funcbufsize;
 		    funcbufsize = sz;
 		}
+		/* finally insert item itself */
 		strcpy(func_table[i], kbs->kb_string);
+		spin_unlock_irqrestore(&func_buf_lock, flags);
 		break;
 	}
 	ret = 0;
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/usb/class/cdc-acm.c linux-libre-3.16.74-gnu/drivers/usb/class/cdc-acm.c
--- linux-libre-3.16.73-gnu/drivers/usb/class/cdc-acm.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/usb/class/cdc-acm.c	2019-09-23 16:12:19.000000000 -0400
@@ -419,26 +419,61 @@ static void acm_read_bulk_callback(struc
 	struct acm_rb *rb = urb->context;
 	struct acm *acm = rb->instance;
 	unsigned long flags;
+	int status = urb->status;
+	bool stopped = false;
+	bool stalled = false;
 
 	dev_vdbg(&acm->data->dev, "%s - urb %d, len %d\n", __func__,
 					rb->index, urb->actual_length);
-	set_bit(rb->index, &acm->read_urbs_free);
 
 	if (!acm->dev) {
 		dev_dbg(&acm->data->dev, "%s - disconnected\n", __func__);
 		return;
 	}
 
-	if (urb->status) {
-		dev_dbg(&acm->data->dev, "%s - non-zero urb status: %d\n",
-							__func__, urb->status);
-		if ((urb->status != -ENOENT) || (urb->actual_length == 0))
-			return;
+	switch (status) {
+	case 0:
+		usb_mark_last_busy(acm->dev);
+		acm_process_read_urb(acm, urb);
+		break;
+	case -EPIPE:
+		set_bit(EVENT_RX_STALL, &acm->flags);
+		stalled = true;
+		break;
+	case -ENOENT:
+	case -ECONNRESET:
+	case -ESHUTDOWN:
+		dev_dbg(&acm->data->dev,
+			"%s - urb shutting down with status: %d\n",
+			__func__, status);
+		stopped = true;
+		break;
+	default:
+		dev_dbg(&acm->data->dev,
+			"%s - nonzero urb status received: %d\n",
+			__func__, status);
+		break;
 	}
 
-	usb_mark_last_busy(acm->dev);
+	/*
+	 * Make sure URB processing is done before marking as free to avoid
+	 * racing with unthrottle() on another CPU. Matches the barriers
+	 * implied by the test_and_clear_bit() in acm_submit_read_urb().
+	 */
+	smp_mb__before_atomic();
+	set_bit(rb->index, &acm->read_urbs_free);
+	/*
+	 * Make sure URB is marked as free before checking the throttled flag
+	 * to avoid racing with unthrottle() on another CPU. Matches the
+	 * smp_mb() in unthrottle().
+	 */
+	smp_mb__after_atomic();
 
-	acm_process_read_urb(acm, urb);
+	if (stopped || stalled) {
+		if (stalled)
+			schedule_work(&acm->work);
+		return;
+	}
 
 	/* throttle device if requested by tty */
 	spin_lock_irqsave(&acm->read_lock, flags);
@@ -468,16 +503,30 @@ static void acm_write_bulk(struct urb *u
 	spin_lock_irqsave(&acm->write_lock, flags);
 	acm_write_done(acm, wb);
 	spin_unlock_irqrestore(&acm->write_lock, flags);
+	set_bit(EVENT_TTY_WAKEUP, &acm->flags);
 	schedule_work(&acm->work);
 }
 
 static void acm_softint(struct work_struct *work)
 {
+	int i;
 	struct acm *acm = container_of(work, struct acm, work);
 
 	dev_vdbg(&acm->data->dev, "%s\n", __func__);
 
-	tty_port_tty_wakeup(&acm->port);
+	if (test_bit(EVENT_RX_STALL, &acm->flags)) {
+		if (!(usb_autopm_get_interface(acm->data))) {
+			for (i = 0; i < acm->rx_buflimit; i++)
+				usb_kill_urb(acm->read_urbs[i]);
+			usb_clear_halt(acm->dev, acm->in);
+			acm_submit_read_urbs(acm, GFP_KERNEL);
+			usb_autopm_put_interface(acm->data);
+		}
+		clear_bit(EVENT_RX_STALL, &acm->flags);
+	}
+
+	if (test_and_clear_bit(EVENT_TTY_WAKEUP, &acm->flags))
+		tty_port_tty_wakeup(&acm->port);
 }
 
 /*
@@ -773,6 +822,9 @@ static void acm_tty_unthrottle(struct tt
 	acm->throttle_req = 0;
 	spin_unlock_irq(&acm->read_lock);
 
+	/* Matches the smp_mb__after_atomic() in acm_read_bulk_callback(). */
+	smp_mb();
+
 	if (was_throttled)
 		acm_submit_read_urbs(acm, GFP_KERNEL);
 }
@@ -1347,8 +1399,16 @@ made_compressed_probe:
 	spin_lock_init(&acm->read_lock);
 	mutex_init(&acm->mutex);
 	acm->is_int_ep = usb_endpoint_xfer_int(epread);
-	if (acm->is_int_ep)
+	if (acm->is_int_ep) {
 		acm->bInterval = epread->bInterval;
+		acm->in = usb_rcvintpipe(usb_dev, epread->bEndpointAddress);
+	} else {
+		acm->in = usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress);
+	}
+	if (usb_endpoint_xfer_int(epwrite))
+		acm->out = usb_sndintpipe(usb_dev, epwrite->bEndpointAddress);
+	else
+		acm->out = usb_sndbulkpipe(usb_dev, epwrite->bEndpointAddress);
 	tty_port_init(&acm->port);
 	acm->port.ops = &acm_port_ops;
 	init_usb_anchor(&acm->delayed);
@@ -1393,20 +1453,15 @@ made_compressed_probe:
 		}
 		urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
 		urb->transfer_dma = rb->dma;
-		if (acm->is_int_ep) {
-			usb_fill_int_urb(urb, acm->dev,
-					 usb_rcvintpipe(usb_dev, epread->bEndpointAddress),
-					 rb->base,
+		if (acm->is_int_ep)
+			usb_fill_int_urb(urb, acm->dev, acm->in, rb->base,
 					 acm->readsize,
 					 acm_read_bulk_callback, rb,
 					 acm->bInterval);
-		} else {
-			usb_fill_bulk_urb(urb, acm->dev,
-					  usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress),
-					  rb->base,
+		else
+			usb_fill_bulk_urb(urb, acm->dev, acm->in, rb->base,
 					  acm->readsize,
 					  acm_read_bulk_callback, rb);
-		}
 
 		acm->read_urbs[i] = urb;
 		__set_bit(i, &acm->read_urbs_free);
@@ -1422,12 +1477,10 @@ made_compressed_probe:
 		}
 
 		if (usb_endpoint_xfer_int(epwrite))
-			usb_fill_int_urb(snd->urb, usb_dev,
-				usb_sndintpipe(usb_dev, epwrite->bEndpointAddress),
+			usb_fill_int_urb(snd->urb, usb_dev, acm->out,
 				NULL, acm->writesize, acm_write_bulk, snd, epwrite->bInterval);
 		else
-			usb_fill_bulk_urb(snd->urb, usb_dev,
-				usb_sndbulkpipe(usb_dev, epwrite->bEndpointAddress),
+			usb_fill_bulk_urb(snd->urb, usb_dev, acm->out,
 				NULL, acm->writesize, acm_write_bulk, snd);
 		snd->urb->transfer_flags |= URB_NO_TRANSFER_DMA_MAP;
 		if (quirks & SEND_ZERO_PACKET)
@@ -1496,8 +1549,8 @@ skip_countries:
 	}
 
 	if (quirks & CLEAR_HALT_CONDITIONS) {
-		usb_clear_halt(usb_dev, usb_rcvbulkpipe(usb_dev, epread->bEndpointAddress));
-		usb_clear_halt(usb_dev, usb_sndbulkpipe(usb_dev, epwrite->bEndpointAddress));
+		usb_clear_halt(usb_dev, acm->in);
+		usb_clear_halt(usb_dev, acm->out);
 	}
 
 	return 0;
@@ -1671,6 +1724,15 @@ static int acm_reset_resume(struct usb_i
 
 #endif /* CONFIG_PM */
 
+static int acm_pre_reset(struct usb_interface *intf)
+{
+	struct acm *acm = usb_get_intfdata(intf);
+
+	clear_bit(EVENT_RX_STALL, &acm->flags);
+
+	return 0;
+}
+
 #define NOKIA_PCSUITE_ACM_INFO(x) \
 		USB_DEVICE_AND_INTERFACE_INFO(0x0421, x, \
 		USB_CLASS_COMM, USB_CDC_SUBCLASS_ACM, \
@@ -1946,6 +2008,7 @@ static struct usb_driver acm_driver = {
 	.resume =	acm_resume,
 	.reset_resume =	acm_reset_resume,
 #endif
+	.pre_reset =	acm_pre_reset,
 	.id_table =	acm_ids,
 #ifdef CONFIG_PM
 	.supports_autosuspend = 1,
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/usb/class/cdc-acm.h linux-libre-3.16.74-gnu/drivers/usb/class/cdc-acm.h
--- linux-libre-3.16.73-gnu/drivers/usb/class/cdc-acm.h	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/usb/class/cdc-acm.h	2019-09-23 16:12:19.000000000 -0400
@@ -83,6 +83,7 @@ struct acm {
 	struct usb_device *dev;				/* the corresponding usb device */
 	struct usb_interface *control;			/* control interface */
 	struct usb_interface *data;			/* data interface */
+	unsigned in, out;				/* i/o pipes */
 	struct tty_port port;			 	/* our tty port data */
 	struct urb *ctrlurb;				/* urbs */
 	u8 *ctrl_buffer;				/* buffers of urbs */
@@ -101,6 +102,9 @@ struct acm {
 	spinlock_t write_lock;
 	struct mutex mutex;
 	bool disconnected;
+	unsigned long flags;
+#		define EVENT_TTY_WAKEUP	0
+#		define EVENT_RX_STALL	1
 	struct usb_cdc_line_coding line;		/* bits, stop, parity */
 	struct work_struct work;			/* work queue entry for line discipline waking up */
 	unsigned int ctrlin;				/* input control lines (DCD, DSR, RI, break, overruns) */
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/usb/misc/rio500.c linux-libre-3.16.74-gnu/drivers/usb/misc/rio500.c
--- linux-libre-3.16.73-gnu/drivers/usb/misc/rio500.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/usb/misc/rio500.c	2019-09-23 16:12:19.000000000 -0400
@@ -464,15 +464,23 @@ static int probe_rio(struct usb_interfac
 {
 	struct usb_device *dev = interface_to_usbdev(intf);
 	struct rio_usb_data *rio = &rio_instance;
-	int retval;
+	int retval = 0;
 
-	dev_info(&intf->dev, "USB Rio found at address %d\n", dev->devnum);
+	mutex_lock(&rio500_mutex);
+	if (rio->present) {
+		dev_info(&intf->dev, "Second USB Rio at address %d refused\n", dev->devnum);
+		retval = -EBUSY;
+		goto bail_out;
+	} else {
+		dev_info(&intf->dev, "USB Rio found at address %d\n", dev->devnum);
+	}
 
 	retval = usb_register_dev(intf, &usb_rio_class);
 	if (retval) {
 		dev_err(&dev->dev,
 			"Not able to get a minor for this device.\n");
-		return -ENOMEM;
+		retval = -ENOMEM;
+		goto bail_out;
 	}
 
 	rio->rio_dev = dev;
@@ -481,7 +489,8 @@ static int probe_rio(struct usb_interfac
 		dev_err(&dev->dev,
 			"probe_rio: Not enough memory for the output buffer\n");
 		usb_deregister_dev(intf, &usb_rio_class);
-		return -ENOMEM;
+		retval = -ENOMEM;
+		goto bail_out;
 	}
 	dev_dbg(&intf->dev, "obuf address:%p\n", rio->obuf);
 
@@ -490,7 +499,8 @@ static int probe_rio(struct usb_interfac
 			"probe_rio: Not enough memory for the input buffer\n");
 		usb_deregister_dev(intf, &usb_rio_class);
 		kfree(rio->obuf);
-		return -ENOMEM;
+		retval = -ENOMEM;
+		goto bail_out;
 	}
 	dev_dbg(&intf->dev, "ibuf address:%p\n", rio->ibuf);
 
@@ -498,8 +508,10 @@ static int probe_rio(struct usb_interfac
 
 	usb_set_intfdata (intf, rio);
 	rio->present = 1;
+bail_out:
+	mutex_unlock(&rio500_mutex);
 
-	return 0;
+	return retval;
 }
 
 static void disconnect_rio(struct usb_interface *intf)
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/usb/misc/sisusbvga/sisusb.c linux-libre-3.16.74-gnu/drivers/usb/misc/sisusbvga/sisusb.c
--- linux-libre-3.16.73-gnu/drivers/usb/misc/sisusbvga/sisusb.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/usb/misc/sisusbvga/sisusb.c	2019-09-23 16:12:19.000000000 -0400
@@ -3093,6 +3093,13 @@ static int sisusb_probe(struct usb_inter
 
 	mutex_init(&(sisusb->lock));
 
+	sisusb->sisusb_dev = dev;
+	sisusb->vrambase   = SISUSB_PCI_MEMBASE;
+	sisusb->mmiobase   = SISUSB_PCI_MMIOBASE;
+	sisusb->mmiosize   = SISUSB_PCI_MMIOSIZE;
+	sisusb->ioportbase = SISUSB_PCI_IOPORTBASE;
+	/* Everything else is zero */
+
 	/* Register device */
 	if ((retval = usb_register_dev(intf, &usb_sisusb_class))) {
 		dev_err(&sisusb->sisusb_dev->dev, "Failed to get a minor for device %d\n",
@@ -3101,13 +3108,7 @@ static int sisusb_probe(struct usb_inter
 		goto error_1;
 	}
 
-	sisusb->sisusb_dev = dev;
-	sisusb->minor      = intf->minor;
-	sisusb->vrambase   = SISUSB_PCI_MEMBASE;
-	sisusb->mmiobase   = SISUSB_PCI_MMIOBASE;
-	sisusb->mmiosize   = SISUSB_PCI_MMIOSIZE;
-	sisusb->ioportbase = SISUSB_PCI_IOPORTBASE;
-	/* Everything else is zero */
+	sisusb->minor = intf->minor;
 
 	/* Allocate buffers */
 	sisusb->ibufsize = SISUSB_IBUF_SIZE;
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/usb/serial/generic.c linux-libre-3.16.74-gnu/drivers/usb/serial/generic.c
--- linux-libre-3.16.73-gnu/drivers/usb/serial/generic.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/usb/serial/generic.c	2019-09-23 16:12:19.000000000 -0400
@@ -350,39 +350,59 @@ void usb_serial_generic_read_bulk_callba
 	struct usb_serial_port *port = urb->context;
 	unsigned char *data = urb->transfer_buffer;
 	unsigned long flags;
+	bool stopped = false;
+	int status = urb->status;
 	int i;
 
 	for (i = 0; i < ARRAY_SIZE(port->read_urbs); ++i) {
 		if (urb == port->read_urbs[i])
 			break;
 	}
-	set_bit(i, &port->read_urbs_free);
 
 	dev_dbg(&port->dev, "%s - urb %d, len %d\n", __func__, i,
 							urb->actual_length);
-	switch (urb->status) {
+	switch (status) {
 	case 0:
+		usb_serial_debug_data(&port->dev, __func__, urb->actual_length,
+							data);
+		port->serial->type->process_read_urb(urb);
 		break;
 	case -ENOENT:
 	case -ECONNRESET:
 	case -ESHUTDOWN:
 		dev_dbg(&port->dev, "%s - urb stopped: %d\n",
-							__func__, urb->status);
-		return;
+							__func__, status);
+		stopped = true;
+		break;
 	case -EPIPE:
 		dev_err(&port->dev, "%s - urb stopped: %d\n",
-							__func__, urb->status);
-		return;
+							__func__, status);
+		stopped = true;
+		break;
 	default:
 		dev_dbg(&port->dev, "%s - nonzero urb status: %d\n",
-							__func__, urb->status);
-		goto resubmit;
+							__func__, status);
+		break;
 	}
 
-	usb_serial_debug_data(&port->dev, __func__, urb->actual_length, data);
-	port->serial->type->process_read_urb(urb);
+	/*
+	 * Make sure URB processing is done before marking as free to avoid
+	 * racing with unthrottle() on another CPU. Matches the barriers
+	 * implied by the test_and_clear_bit() in
+	 * usb_serial_generic_submit_read_urb().
+	 */
+	smp_mb__before_atomic();
+	set_bit(i, &port->read_urbs_free);
+	/*
+	 * Make sure URB is marked as free before checking the throttled flag
+	 * to avoid racing with unthrottle() on another CPU. Matches the
+	 * smp_mb() in unthrottle().
+	 */
+	smp_mb__after_atomic();
+
+	if (stopped)
+		return;
 
-resubmit:
 	/* Throttle the device if requested by tty */
 	spin_lock_irqsave(&port->lock, flags);
 	port->throttled = port->throttle_req;
@@ -399,6 +419,7 @@ void usb_serial_generic_write_bulk_callb
 {
 	unsigned long flags;
 	struct usb_serial_port *port = urb->context;
+	int status = urb->status;
 	int i;
 
 	for (i = 0; i < ARRAY_SIZE(port->write_urbs); ++i) {
@@ -410,22 +431,22 @@ void usb_serial_generic_write_bulk_callb
 	set_bit(i, &port->write_urbs_free);
 	spin_unlock_irqrestore(&port->lock, flags);
 
-	switch (urb->status) {
+	switch (status) {
 	case 0:
 		break;
 	case -ENOENT:
 	case -ECONNRESET:
 	case -ESHUTDOWN:
 		dev_dbg(&port->dev, "%s - urb stopped: %d\n",
-							__func__, urb->status);
+							__func__, status);
 		return;
 	case -EPIPE:
 		dev_err_console(port, "%s - urb stopped: %d\n",
-							__func__, urb->status);
+							__func__, status);
 		return;
 	default:
 		dev_err_console(port, "%s - nonzero urb status: %d\n",
-							__func__, urb->status);
+							__func__, status);
 		goto resubmit;
 	}
 
@@ -456,6 +477,12 @@ void usb_serial_generic_unthrottle(struc
 	port->throttled = port->throttle_req = 0;
 	spin_unlock_irq(&port->lock);
 
+	/*
+	 * Matches the smp_mb__after_atomic() in
+	 * usb_serial_generic_read_bulk_callback().
+	 */
+	smp_mb();
+
 	if (was_throttled)
 		usb_serial_generic_submit_read_urbs(port, GFP_KERNEL);
 }
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/usb/serial/usb-serial.c linux-libre-3.16.74-gnu/drivers/usb/serial/usb-serial.c
--- linux-libre-3.16.73-gnu/drivers/usb/serial/usb-serial.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/usb/serial/usb-serial.c	2019-09-23 16:12:19.000000000 -0400
@@ -167,9 +167,9 @@ void usb_serial_put(struct usb_serial *s
  * @driver: the driver (USB in our case)
  * @tty: the tty being created
  *
- * Create the termios objects for this tty.  We use the default
+ * Initialise the termios structure for this tty.  We use the default
  * USB serial settings but permit them to be overridden by
- * serial->type->init_termios.
+ * serial->type->init_termios on first open.
  *
  * This is the first place a new tty gets used.  Hence this is where we
  * acquire references to the usb_serial structure and the driver module,
@@ -181,6 +181,7 @@ static int serial_install(struct tty_dri
 	int idx = tty->index;
 	struct usb_serial *serial;
 	struct usb_serial_port *port;
+	bool init_termios;
 	int retval = -ENODEV;
 
 	port = usb_serial_port_get_by_minor(idx);
@@ -195,14 +196,16 @@ static int serial_install(struct tty_dri
 	if (retval)
 		goto error_get_interface;
 
+	init_termios = (driver->termios[idx] == NULL);
+
 	retval = tty_port_install(&port->port, driver, tty);
 	if (retval)
 		goto error_init_termios;
 
 	mutex_unlock(&serial->disc_mutex);
 
-	/* allow the driver to update the settings */
-	if (serial->type->init_termios)
+	/* allow the driver to update the initial settings */
+	if (init_termios && serial->type->init_termios)
 		serial->type->init_termios(tty);
 
 	tty->driver_data = port;
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/vhost/vhost.c linux-libre-3.16.74-gnu/drivers/vhost/vhost.c
--- linux-libre-3.16.73-gnu/drivers/vhost/vhost.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/vhost/vhost.c	2019-09-23 16:12:19.000000000 -0400
@@ -1194,7 +1194,7 @@ static int get_indirect(struct vhost_vir
 		/* If this is an input descriptor, increment that count. */
 		if (desc.flags & VRING_DESC_F_WRITE) {
 			*in_num += ret;
-			if (unlikely(log)) {
+			if (unlikely(log && ret)) {
 				log[*log_num].addr = desc.addr;
 				log[*log_num].len = desc.len;
 				++*log_num;
@@ -1317,7 +1317,7 @@ int vhost_get_vq_desc(struct vhost_virtq
 			/* If this is an input descriptor,
 			 * increment that count. */
 			*in_num += ret;
-			if (unlikely(log)) {
+			if (unlikely(log && ret)) {
 				log[*log_num].addr = desc.addr;
 				log[*log_num].len = desc.len;
 				++*log_num;
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/video/backlight/lm3630a_bl.c linux-libre-3.16.74-gnu/drivers/video/backlight/lm3630a_bl.c
--- linux-libre-3.16.73-gnu/drivers/video/backlight/lm3630a_bl.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/video/backlight/lm3630a_bl.c	2019-09-23 16:12:19.000000000 -0400
@@ -201,7 +201,7 @@ static int lm3630a_bank_a_update_status(
 				      LM3630A_LEDA_ENABLE, LM3630A_LEDA_ENABLE);
 	if (ret < 0)
 		goto out_i2c_err;
-	return bl->props.brightness;
+	return 0;
 
 out_i2c_err:
 	dev_err(pchip->dev, "i2c failed to access\n");
@@ -278,7 +278,7 @@ static int lm3630a_bank_b_update_status(
 				      LM3630A_LEDB_ENABLE, LM3630A_LEDB_ENABLE);
 	if (ret < 0)
 		goto out_i2c_err;
-	return bl->props.brightness;
+	return 0;
 
 out_i2c_err:
 	dev_err(pchip->dev, "i2c failed to access REG_CTRL\n");
diff -druNp --no-dereference linux-libre-3.16.73-gnu/drivers/virt/fsl_hypervisor.c linux-libre-3.16.74-gnu/drivers/virt/fsl_hypervisor.c
--- linux-libre-3.16.73-gnu/drivers/virt/fsl_hypervisor.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/drivers/virt/fsl_hypervisor.c	2019-09-23 16:12:19.000000000 -0400
@@ -338,8 +338,8 @@ static long ioctl_dtprop(struct fsl_hv_i
 	struct fsl_hv_ioctl_prop param;
 	char __user *upath, *upropname;
 	void __user *upropval;
-	char *path = NULL, *propname = NULL;
-	void *propval = NULL;
+	char *path, *propname;
+	void *propval;
 	int ret = 0;
 
 	/* Get the parameters from the user. */
@@ -351,32 +351,30 @@ static long ioctl_dtprop(struct fsl_hv_i
 	upropval = (void __user *)(uintptr_t)param.propval;
 
 	path = strndup_user(upath, FH_DTPROP_MAX_PATHLEN);
-	if (IS_ERR(path)) {
-		ret = PTR_ERR(path);
-		goto out;
-	}
+	if (IS_ERR(path))
+		return PTR_ERR(path);
 
 	propname = strndup_user(upropname, FH_DTPROP_MAX_PATHLEN);
 	if (IS_ERR(propname)) {
 		ret = PTR_ERR(propname);
-		goto out;
+		goto err_free_path;
 	}
 
 	if (param.proplen > FH_DTPROP_MAX_PROPLEN) {
 		ret = -EINVAL;
-		goto out;
+		goto err_free_propname;
 	}
 
 	propval = kmalloc(param.proplen, GFP_KERNEL);
 	if (!propval) {
 		ret = -ENOMEM;
-		goto out;
+		goto err_free_propname;
 	}
 
 	if (set) {
 		if (copy_from_user(propval, upropval, param.proplen)) {
 			ret = -EFAULT;
-			goto out;
+			goto err_free_propval;
 		}
 
 		param.ret = fh_partition_set_dtprop(param.handle,
@@ -395,7 +393,7 @@ static long ioctl_dtprop(struct fsl_hv_i
 			if (copy_to_user(upropval, propval, param.proplen) ||
 			    put_user(param.proplen, &p->proplen)) {
 				ret = -EFAULT;
-				goto out;
+				goto err_free_propval;
 			}
 		}
 	}
@@ -403,10 +401,12 @@ static long ioctl_dtprop(struct fsl_hv_i
 	if (put_user(param.ret, &p->ret))
 		ret = -EFAULT;
 
-out:
-	kfree(path);
+err_free_propval:
 	kfree(propval);
+err_free_propname:
 	kfree(propname);
+err_free_path:
+	kfree(path);
 
 	return ret;
 }
diff -druNp --no-dereference linux-libre-3.16.73-gnu/fs/ceph/super.c linux-libre-3.16.74-gnu/fs/ceph/super.c
--- linux-libre-3.16.73-gnu/fs/ceph/super.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/fs/ceph/super.c	2019-09-23 16:12:19.000000000 -0400
@@ -706,6 +706,12 @@ static void ceph_umount_begin(struct sup
 	return;
 }
 
+static int ceph_remount(struct super_block *sb, int *flags, char *data)
+{
+	sync_filesystem(sb);
+	return 0;
+}
+
 static const struct super_operations ceph_super_ops = {
 	.alloc_inode	= ceph_alloc_inode,
 	.destroy_inode	= ceph_destroy_inode,
@@ -713,6 +719,7 @@ static const struct super_operations cep
 	.drop_inode	= ceph_drop_inode,
 	.sync_fs        = ceph_sync_fs,
 	.put_super	= ceph_put_super,
+	.remount_fs	= ceph_remount,
 	.show_options   = ceph_show_options,
 	.statfs		= ceph_statfs,
 	.umount_begin   = ceph_umount_begin,
diff -druNp --no-dereference linux-libre-3.16.73-gnu/fs/cifs/smb2ops.c linux-libre-3.16.74-gnu/fs/cifs/smb2ops.c
--- linux-libre-3.16.73-gnu/fs/cifs/smb2ops.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/fs/cifs/smb2ops.c	2019-09-23 16:12:19.000000000 -0400
@@ -1000,26 +1000,28 @@ smb21_set_oplock_level(struct cifsInodeI
 		       unsigned int epoch, bool *purge_cache)
 {
 	char message[5] = {0};
+	unsigned int new_oplock = 0;
 
 	oplock &= 0xFF;
 	if (oplock == SMB2_OPLOCK_LEVEL_NOCHANGE)
 		return;
 
-	cinode->oplock = 0;
 	if (oplock & SMB2_LEASE_READ_CACHING_HE) {
-		cinode->oplock |= CIFS_CACHE_READ_FLG;
+		new_oplock |= CIFS_CACHE_READ_FLG;
 		strcat(message, "R");
 	}
 	if (oplock & SMB2_LEASE_HANDLE_CACHING_HE) {
-		cinode->oplock |= CIFS_CACHE_HANDLE_FLG;
+		new_oplock |= CIFS_CACHE_HANDLE_FLG;
 		strcat(message, "H");
 	}
 	if (oplock & SMB2_LEASE_WRITE_CACHING_HE) {
-		cinode->oplock |= CIFS_CACHE_WRITE_FLG;
+		new_oplock |= CIFS_CACHE_WRITE_FLG;
 		strcat(message, "W");
 	}
-	if (!cinode->oplock)
-		strcat(message, "None");
+	if (!new_oplock)
+		strncpy(message, "None", sizeof(message));
+
+	cinode->oplock = new_oplock;
 	cifs_dbg(FYI, "%s Lease granted on inode %p\n", message,
 		 &cinode->vfs_inode);
 }
diff -druNp --no-dereference linux-libre-3.16.73-gnu/fs/ext4/file.c linux-libre-3.16.74-gnu/fs/ext4/file.c
--- linux-libre-3.16.73-gnu/fs/ext4/file.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/fs/ext4/file.c	2019-09-23 16:12:19.000000000 -0400
@@ -173,6 +173,13 @@ ext4_file_write_iter(struct kiocb *iocb,
 	}
 
 	ret = __generic_file_write_iter(iocb, from);
+	/*
+	 * Unaligned direct AIO must be the only IO in flight. Otherwise
+	 * overlapping aligned IO after unaligned might result in data
+	 * corruption.
+	 */
+	if (ret == -EIOCBQUEUED && aio_mutex)
+		ext4_unwritten_wait(inode);
 	mutex_unlock(&inode->i_mutex);
 
 	if (ret > 0) {
diff -druNp --no-dereference linux-libre-3.16.73-gnu/fs/ext4/ioctl.c linux-libre-3.16.74-gnu/fs/ext4/ioctl.c
--- linux-libre-3.16.73-gnu/fs/ext4/ioctl.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/fs/ext4/ioctl.c	2019-09-23 16:12:19.000000000 -0400
@@ -634,7 +634,7 @@ group_add_out:
 		if (err == 0)
 			err = err2;
 		mnt_drop_write_file(filp);
-		if (!err && (o_group > EXT4_SB(sb)->s_groups_count) &&
+		if (!err && (o_group < EXT4_SB(sb)->s_groups_count) &&
 		    ext4_has_group_desc_csum(sb) &&
 		    test_opt(sb, INIT_INODE_TABLE))
 			err = ext4_register_li_request(sb, o_group);
diff -druNp --no-dereference linux-libre-3.16.73-gnu/fs/fuse/file.c linux-libre-3.16.74-gnu/fs/fuse/file.c
--- linux-libre-3.16.73-gnu/fs/fuse/file.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/fs/fuse/file.c	2019-09-23 16:12:19.000000000 -0400
@@ -1597,7 +1597,7 @@ __acquires(fc->lock)
 {
 	struct fuse_conn *fc = get_fuse_conn(inode);
 	struct fuse_inode *fi = get_fuse_inode(inode);
-	size_t crop = i_size_read(inode);
+	loff_t crop = i_size_read(inode);
 	struct fuse_req *req;
 
 	while (fi->writectr >= 0 && !list_empty(&fi->queued_writes)) {
@@ -3017,6 +3017,13 @@ static long fuse_file_fallocate(struct f
 		}
 	}
 
+	if (!(mode & FALLOC_FL_KEEP_SIZE) &&
+	    offset + length > i_size_read(inode)) {
+		err = inode_newsize_ok(inode, offset + length);
+		if (err)
+			goto out;
+	}
+
 	if (!(mode & FALLOC_FL_KEEP_SIZE))
 		set_bit(FUSE_I_SIZE_UNSTABLE, &fi->state);
 
diff -druNp --no-dereference linux-libre-3.16.73-gnu/fs/gfs2/rgrp.c linux-libre-3.16.74-gnu/fs/gfs2/rgrp.c
--- linux-libre-3.16.73-gnu/fs/gfs2/rgrp.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/fs/gfs2/rgrp.c	2019-09-23 16:12:19.000000000 -0400
@@ -731,6 +731,7 @@ void gfs2_clear_rgrpd(struct gfs2_sbd *s
 
 		gfs2_free_clones(rgd);
 		kfree(rgd->rd_bits);
+		rgd->rd_bits = NULL;
 		return_all_reservations(rgd);
 		kmem_cache_free(gfs2_rgrpd_cachep, rgd);
 	}
@@ -925,9 +926,6 @@ static int read_rindex_entry(struct gfs2
 	if (error)
 		goto fail;
 
-	rgd->rd_gl->gl_object = rgd;
-	rgd->rd_gl->gl_vm.start = rgd->rd_addr * bsize;
-	rgd->rd_gl->gl_vm.end = rgd->rd_gl->gl_vm.start + (rgd->rd_length * bsize) - 1;
 	rgd->rd_rgl = (struct gfs2_rgrp_lvb *)rgd->rd_gl->gl_lksb.sb_lvbptr;
 	rgd->rd_flags &= ~GFS2_RDF_UPTODATE;
 	if (rgd->rd_data > sdp->sd_max_rg_data)
@@ -935,14 +933,20 @@ static int read_rindex_entry(struct gfs2
 	spin_lock(&sdp->sd_rindex_spin);
 	error = rgd_insert(rgd);
 	spin_unlock(&sdp->sd_rindex_spin);
-	if (!error)
+	if (!error) {
+		rgd->rd_gl->gl_object = rgd;
+		rgd->rd_gl->gl_vm.start = (rgd->rd_addr * bsize) & PAGE_MASK;
+		rgd->rd_gl->gl_vm.end = PAGE_ALIGN((rgd->rd_addr +
+						    rgd->rd_length) * bsize) - 1;
 		return 0;
+	}
 
 	error = 0; /* someone else read in the rgrp; free it and ignore it */
 	gfs2_glock_put(rgd->rd_gl);
 
 fail:
 	kfree(rgd->rd_bits);
+	rgd->rd_bits = NULL;
 	kmem_cache_free(gfs2_rgrpd_cachep, rgd);
 	return error;
 }
diff -druNp --no-dereference linux-libre-3.16.73-gnu/fs/jbd2/journal.c linux-libre-3.16.74-gnu/fs/jbd2/journal.c
--- linux-libre-3.16.73-gnu/fs/jbd2/journal.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/fs/jbd2/journal.c	2019-09-23 16:12:19.000000000 -0400
@@ -1344,6 +1344,10 @@ static int jbd2_write_superblock(journal
 	journal_superblock_t *sb = journal->j_superblock;
 	int ret;
 
+	/* Buffer got discarded which means block device got invalidated */
+	if (!buffer_mapped(bh))
+		return -EIO;
+
 	trace_jbd2_write_superblock(journal, write_op);
 	if (!(journal->j_flags & JBD2_BARRIER))
 		write_op &= ~(REQ_FUA | REQ_FLUSH);
diff -druNp --no-dereference linux-libre-3.16.73-gnu/fs/nfs/nfs4state.c linux-libre-3.16.74-gnu/fs/nfs/nfs4state.c
--- linux-libre-3.16.73-gnu/fs/nfs/nfs4state.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/fs/nfs/nfs4state.c	2019-09-23 16:12:19.000000000 -0400
@@ -140,6 +140,10 @@ int nfs40_discover_server_trunking(struc
 		/* Sustain the lease, even if it's empty.  If the clientid4
 		 * goes stale it's of no use for trunking discovery. */
 		nfs4_schedule_state_renewal(*result);
+
+		/* If the client state need to recover, do it. */
+		if (clp->cl_state)
+			nfs4_schedule_state_manager(clp);
 	}
 out:
 	return status;
diff -druNp --no-dereference linux-libre-3.16.73-gnu/fs/ocfs2/export.c linux-libre-3.16.74-gnu/fs/ocfs2/export.c
--- linux-libre-3.16.73-gnu/fs/ocfs2/export.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/fs/ocfs2/export.c	2019-09-23 16:12:19.000000000 -0400
@@ -148,16 +148,24 @@ static struct dentry *ocfs2_get_parent(s
 	u64 blkno;
 	struct dentry *parent;
 	struct inode *dir = child->d_inode;
+	int set;
 
 	trace_ocfs2_get_parent(child, child->d_name.len, child->d_name.name,
 			       (unsigned long long)OCFS2_I(dir)->ip_blkno);
 
+	status = ocfs2_nfs_sync_lock(OCFS2_SB(dir->i_sb), 1);
+	if (status < 0) {
+		mlog(ML_ERROR, "getting nfs sync lock(EX) failed %d\n", status);
+		parent = ERR_PTR(status);
+		goto bail;
+	}
+
 	status = ocfs2_inode_lock(dir, NULL, 0);
 	if (status < 0) {
 		if (status != -ENOENT)
 			mlog_errno(status);
 		parent = ERR_PTR(status);
-		goto bail;
+		goto unlock_nfs_sync;
 	}
 
 	status = ocfs2_lookup_ino_from_name(dir, "..", 2, &blkno);
@@ -166,11 +174,31 @@ static struct dentry *ocfs2_get_parent(s
 		goto bail_unlock;
 	}
 
+	status = ocfs2_test_inode_bit(OCFS2_SB(dir->i_sb), blkno, &set);
+	if (status < 0) {
+		if (status == -EINVAL) {
+			status = -ESTALE;
+		} else
+			mlog(ML_ERROR, "test inode bit failed %d\n", status);
+		parent = ERR_PTR(status);
+		goto bail_unlock;
+	}
+
+	trace_ocfs2_get_dentry_test_bit(status, set);
+	if (!set) {
+		status = -ESTALE;
+		parent = ERR_PTR(status);
+		goto bail_unlock;
+	}
+
 	parent = d_obtain_alias(ocfs2_iget(OCFS2_SB(dir->i_sb), blkno, 0, 0));
 
 bail_unlock:
 	ocfs2_inode_unlock(dir, 0);
 
+unlock_nfs_sync:
+	ocfs2_nfs_sync_unlock(OCFS2_SB(dir->i_sb), 1);
+
 bail:
 	trace_ocfs2_get_parent_end(parent);
 
diff -druNp --no-dereference linux-libre-3.16.73-gnu/fs/xfs/xfs_super.c linux-libre-3.16.74-gnu/fs/xfs/xfs_super.c
--- linux-libre-3.16.73-gnu/fs/xfs/xfs_super.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/fs/xfs/xfs_super.c	2019-09-23 16:12:19.000000000 -0400
@@ -1038,6 +1038,10 @@ xfs_fs_put_super(
 {
 	struct xfs_mount	*mp = XFS_M(sb);
 
+	/* if ->fill_super failed, we have no mount to tear down */
+	if (!sb->s_fs_info)
+		return;
+
 	xfs_filestream_unmount(mp);
 	xfs_unmountfs(mp);
 
@@ -1045,6 +1049,8 @@ xfs_fs_put_super(
 	xfs_icsb_destroy_counters(mp);
 	xfs_destroy_mount_workqueues(mp);
 	xfs_close_devices(mp);
+
+	sb->s_fs_info = NULL;
 	xfs_free_fsname(mp);
 	kfree(mp);
 }
@@ -1514,6 +1520,7 @@ out_destroy_workqueues:
  out_close_devices:
 	xfs_close_devices(mp);
  out_free_fsname:
+	sb->s_fs_info = NULL;
 	xfs_free_fsname(mp);
 	kfree(mp);
  out:
@@ -1540,6 +1547,9 @@ xfs_fs_nr_cached_objects(
 	struct super_block	*sb,
 	int			nid)
 {
+	/* Paranoia: catch incorrect calls during mount setup or teardown */
+	if (WARN_ON_ONCE(!sb->s_fs_info))
+		return 0;
 	return xfs_reclaim_inodes_count(XFS_M(sb));
 }
 
diff -druNp --no-dereference linux-libre-3.16.73-gnu/include/linux/atalk.h linux-libre-3.16.74-gnu/include/linux/atalk.h
--- linux-libre-3.16.73-gnu/include/linux/atalk.h	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/include/linux/atalk.h	2019-09-23 16:12:19.000000000 -0400
@@ -150,19 +150,29 @@ extern int sysctl_aarp_retransmit_limit;
 extern int sysctl_aarp_resolve_time;
 
 #ifdef CONFIG_SYSCTL
-extern void atalk_register_sysctl(void);
+extern int atalk_register_sysctl(void);
 extern void atalk_unregister_sysctl(void);
 #else
-#define atalk_register_sysctl()		do { } while(0)
-#define atalk_unregister_sysctl()	do { } while(0)
+static inline int atalk_register_sysctl(void)
+{
+	return 0;
+}
+static inline void atalk_unregister_sysctl(void)
+{
+}
 #endif
 
 #ifdef CONFIG_PROC_FS
 extern int atalk_proc_init(void);
 extern void atalk_proc_exit(void);
 #else
-#define atalk_proc_init()	({ 0; })
-#define atalk_proc_exit()	do { } while(0)
+static inline int atalk_proc_init(void)
+{
+	return 0;
+}
+static inline void atalk_proc_exit(void)
+{
+}
 #endif /* CONFIG_PROC_FS */
 
 #endif /* __LINUX_ATALK_H__ */
diff -druNp --no-dereference linux-libre-3.16.73-gnu/include/linux/ieee80211.h linux-libre-3.16.74-gnu/include/linux/ieee80211.h
--- linux-libre-3.16.73-gnu/include/linux/ieee80211.h	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/include/linux/ieee80211.h	2019-09-23 16:12:19.000000000 -0400
@@ -1621,6 +1621,9 @@ enum ieee80211_reasoncode {
 	WLAN_REASON_INVALID_RSN_IE_CAP = 22,
 	WLAN_REASON_IEEE8021X_FAILED = 23,
 	WLAN_REASON_CIPHER_SUITE_REJECTED = 24,
+	/* TDLS (802.11z) */
+	WLAN_REASON_TDLS_TEARDOWN_UNREACHABLE = 25,
+	WLAN_REASON_TDLS_TEARDOWN_UNSPECIFIED = 26,
 	/* 802.11e */
 	WLAN_REASON_DISASSOC_UNSPECIFIED_QOS = 32,
 	WLAN_REASON_DISASSOC_QAP_NO_BANDWIDTH = 33,
diff -druNp --no-dereference linux-libre-3.16.73-gnu/include/linux/mfd/da9063/registers.h linux-libre-3.16.74-gnu/include/linux/mfd/da9063/registers.h
--- linux-libre-3.16.73-gnu/include/linux/mfd/da9063/registers.h	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/include/linux/mfd/da9063/registers.h	2019-09-23 16:12:19.000000000 -0400
@@ -204,9 +204,9 @@
 
 /* DA9063 Configuration registers */
 /* OTP */
-#define	DA9063_REG_OPT_COUNT		0x101
-#define	DA9063_REG_OPT_ADDR		0x102
-#define	DA9063_REG_OPT_DATA		0x103
+#define	DA9063_REG_OTP_CONT		0x101
+#define	DA9063_REG_OTP_ADDR		0x102
+#define	DA9063_REG_OTP_DATA		0x103
 
 /* Customer Trim and Configuration */
 #define	DA9063_REG_T_OFFSET		0x104
diff -druNp --no-dereference linux-libre-3.16.73-gnu/include/linux/of.h linux-libre-3.16.74-gnu/include/linux/of.h
--- linux-libre-3.16.73-gnu/include/linux/of.h	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/include/linux/of.h	2019-09-23 16:12:19.000000000 -0400
@@ -171,8 +171,8 @@ extern struct device_node *of_find_all_n
 static inline u64 of_read_number(const __be32 *cell, int size)
 {
 	u64 r = 0;
-	while (size--)
-		r = (r << 32) | be32_to_cpu(*(cell++));
+	for (; size--; cell++)
+		r = (r << 32) | be32_to_cpu(*cell);
 	return r;
 }
 
diff -druNp --no-dereference linux-libre-3.16.73-gnu/include/linux/pci.h linux-libre-3.16.74-gnu/include/linux/pci.h
--- linux-libre-3.16.73-gnu/include/linux/pci.h	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/include/linux/pci.h	2019-09-23 16:12:19.000000000 -0400
@@ -308,6 +308,8 @@ struct pci_dev {
 						   powered on/off by the
 						   corresponding bridge */
 	unsigned int	ignore_hotplug:1;	/* Ignore hotplug events */
+	unsigned int	clear_retrain_link:1;	/* Need to clear Retrain Link
+						   bit manually */
 	unsigned int	d3_delay;	/* D3->D0 transition time in ms */
 	unsigned int	d3cold_delay;	/* D3cold->D0 transition time in ms */
 
diff -druNp --no-dereference linux-libre-3.16.73-gnu/include/linux/pwm.h linux-libre-3.16.74-gnu/include/linux/pwm.h
--- linux-libre-3.16.73-gnu/include/linux/pwm.h	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/include/linux/pwm.h	2019-09-23 16:12:19.000000000 -0400
@@ -299,7 +299,6 @@ static inline void pwm_add_table(struct
 #ifdef CONFIG_PWM_SYSFS
 void pwmchip_sysfs_export(struct pwm_chip *chip);
 void pwmchip_sysfs_unexport(struct pwm_chip *chip);
-void pwmchip_sysfs_unexport_children(struct pwm_chip *chip);
 #else
 static inline void pwmchip_sysfs_export(struct pwm_chip *chip)
 {
@@ -308,10 +307,6 @@ static inline void pwmchip_sysfs_export(
 static inline void pwmchip_sysfs_unexport(struct pwm_chip *chip)
 {
 }
-
-static inline void pwmchip_sysfs_unexport_children(struct pwm_chip *chip)
-{
-}
 #endif /* CONFIG_PWM_SYSFS */
 
 #endif /* __LINUX_PWM_H */
diff -druNp --no-dereference linux-libre-3.16.73-gnu/include/linux/smpboot.h linux-libre-3.16.74-gnu/include/linux/smpboot.h
--- linux-libre-3.16.73-gnu/include/linux/smpboot.h	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/include/linux/smpboot.h	2019-09-23 16:12:19.000000000 -0400
@@ -31,7 +31,7 @@ struct smpboot_thread_data;
  * @thread_comm:	The base name of the thread
  */
 struct smp_hotplug_thread {
-	struct task_struct __percpu	**store;
+	struct task_struct		* __percpu *store;
 	struct list_head		list;
 	int				(*thread_should_run)(unsigned int cpu);
 	void				(*thread_fn)(unsigned int cpu);
diff -druNp --no-dereference linux-libre-3.16.73-gnu/include/media/davinci/vpbe.h linux-libre-3.16.74-gnu/include/media/davinci/vpbe.h
--- linux-libre-3.16.73-gnu/include/media/davinci/vpbe.h	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/include/media/davinci/vpbe.h	2019-09-23 16:12:19.000000000 -0400
@@ -96,7 +96,7 @@ struct vpbe_config {
 	struct encoder_config_info *ext_encoders;
 	/* amplifier information goes here */
 	struct amp_config_info *amp;
-	int num_outputs;
+	unsigned int num_outputs;
 	/* Order is venc outputs followed by LCD and then external encoders */
 	struct vpbe_output *outputs;
 };
diff -druNp --no-dereference linux-libre-3.16.73-gnu/include/net/bluetooth/hci_core.h linux-libre-3.16.74-gnu/include/net/bluetooth/hci_core.h
--- linux-libre-3.16.73-gnu/include/net/bluetooth/hci_core.h	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/include/net/bluetooth/hci_core.h	2019-09-23 16:12:19.000000000 -0400
@@ -142,6 +142,9 @@ struct oob_data {
 
 #define HCI_MAX_SHORT_NAME_LENGTH	10
 
+/* Min encryption key size to match with SMP */
+#define HCI_MIN_ENC_KEY_SIZE		7
+
 /* Default LE RPA expiry time, 15 minutes */
 #define HCI_DEFAULT_RPA_TIMEOUT		(15 * 60)
 
diff -druNp --no-dereference linux-libre-3.16.73-gnu/include/net/mac80211.h linux-libre-3.16.74-gnu/include/net/mac80211.h
--- linux-libre-3.16.73-gnu/include/net/mac80211.h	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/include/net/mac80211.h	2019-09-23 16:12:19.000000000 -0400
@@ -4815,4 +4815,17 @@ int ieee80211_parse_p2p_noa(const struct
  */
 void ieee80211_update_p2p_noa(struct ieee80211_noa_data *data, u32 tsf);
 
+/**
+ * ieee80211_tdls_oper - request userspace to perform a TDLS operation
+ * @vif: virtual interface
+ * @peer: the peer's destination address
+ * @oper: the requested TDLS operation
+ * @reason_code: reason code for the operation, valid for TDLS teardown
+ * @gfp: allocation flags
+ *
+ * See cfg80211_tdls_oper_request().
+ */
+void ieee80211_tdls_oper_request(struct ieee80211_vif *vif, const u8 *peer,
+				 enum nl80211_tdls_operation oper,
+				 u16 reason_code, gfp_t gfp);
 #endif /* MAC80211_H */
diff -druNp --no-dereference linux-libre-3.16.73-gnu/kernel/debug/kdb/kdb_main.c linux-libre-3.16.74-gnu/kernel/debug/kdb/kdb_main.c
--- linux-libre-3.16.73-gnu/kernel/debug/kdb/kdb_main.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/kernel/debug/kdb/kdb_main.c	2019-09-23 16:12:19.000000000 -0400
@@ -2569,7 +2569,7 @@ static int kdb_per_cpu(int argc, const c
 		diag = kdbgetularg(argv[3], &whichcpu);
 		if (diag)
 			return diag;
-		if (!cpu_online(whichcpu)) {
+		if (whichcpu >= nr_cpu_ids || !cpu_online(whichcpu)) {
 			kdb_printf("cpu %ld is not online\n", whichcpu);
 			return KDB_BADCPUNUM;
 		}
diff -druNp --no-dereference linux-libre-3.16.73-gnu/kernel/time/ntp.c linux-libre-3.16.74-gnu/kernel/time/ntp.c
--- linux-libre-3.16.73-gnu/kernel/time/ntp.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/kernel/time/ntp.c	2019-09-23 16:12:19.000000000 -0400
@@ -588,7 +588,7 @@ static inline void process_adjtimex_mode
 		time_constant = max(time_constant, 0l);
 	}
 
-	if (txc->modes & ADJ_TAI && txc->constant > 0)
+	if (txc->modes & ADJ_TAI && txc->constant >= 0)
 		*time_tai = txc->constant;
 
 	if (txc->modes & ADJ_OFFSET)
diff -druNp --no-dereference linux-libre-3.16.73-gnu/kernel/trace/trace_events.c linux-libre-3.16.74-gnu/kernel/trace/trace_events.c
--- linux-libre-3.16.73-gnu/kernel/trace/trace_events.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/kernel/trace/trace_events.c	2019-09-23 16:12:19.000000000 -0400
@@ -1007,9 +1007,6 @@ event_id_read(struct file *filp, char __
 	char buf[32];
 	int len;
 
-	if (*ppos)
-		return 0;
-
 	if (unlikely(!id))
 		return -ENODEV;
 
diff -druNp --no-dereference linux-libre-3.16.73-gnu/lib/kobject_uevent.c linux-libre-3.16.74-gnu/lib/kobject_uevent.c
--- linux-libre-3.16.73-gnu/lib/kobject_uevent.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/lib/kobject_uevent.c	2019-09-23 16:12:19.000000000 -0400
@@ -178,6 +178,13 @@ int kobject_uevent_env(struct kobject *k
 	struct uevent_sock *ue_sk;
 #endif
 
+	/*
+	 * Mark "remove" event done regardless of result, for some subsystems
+	 * do not want to re-trigger "remove" event via automatic cleanup.
+	 */
+	if (action == KOBJ_REMOVE)
+		kobj->state_remove_uevent_sent = 1;
+
 	pr_debug("kobject: '%s' (%p): %s\n",
 		 kobject_name(kobj), kobj, __func__);
 
@@ -275,8 +282,6 @@ int kobject_uevent_env(struct kobject *k
 	 */
 	if (action == KOBJ_ADD)
 		kobj->state_add_uevent_sent = 1;
-	else if (action == KOBJ_REMOVE)
-		kobj->state_remove_uevent_sent = 1;
 
 	mutex_lock(&uevent_sock_mutex);
 	/* we will send an event, so request a new sequence number */
diff -druNp --no-dereference linux-libre-3.16.73-gnu/Makefile linux-libre-3.16.74-gnu/Makefile
--- linux-libre-3.16.73-gnu/Makefile	2019-08-20 19:48:25.000000000 -0400
+++ linux-libre-3.16.74-gnu/Makefile	2019-09-24 13:40:32.000000000 -0400
@@ -1,6 +1,6 @@
 VERSION = 3
 PATCHLEVEL = 16
-SUBLEVEL = 73
+SUBLEVEL = 74
 EXTRAVERSION =-gnu
 NAME = Museum of Fishiegoodies
 
diff -druNp --no-dereference linux-libre-3.16.73-gnu/net/appletalk/atalk_proc.c linux-libre-3.16.74-gnu/net/appletalk/atalk_proc.c
--- linux-libre-3.16.73-gnu/net/appletalk/atalk_proc.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/net/appletalk/atalk_proc.c	2019-09-23 16:12:19.000000000 -0400
@@ -293,7 +293,7 @@ out_interface:
 	goto out;
 }
 
-void __exit atalk_proc_exit(void)
+void atalk_proc_exit(void)
 {
 	remove_proc_entry("interface", atalk_proc_dir);
 	remove_proc_entry("route", atalk_proc_dir);
diff -druNp --no-dereference linux-libre-3.16.73-gnu/net/appletalk/ddp.c linux-libre-3.16.74-gnu/net/appletalk/ddp.c
--- linux-libre-3.16.73-gnu/net/appletalk/ddp.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/net/appletalk/ddp.c	2019-09-23 16:12:19.000000000 -0400
@@ -1913,12 +1913,16 @@ static const char atalk_err_snap[] __ini
 /* Called by proto.c on kernel start up */
 static int __init atalk_init(void)
 {
-	int rc = proto_register(&ddp_proto, 0);
+	int rc;
 
-	if (rc != 0)
+	rc = proto_register(&ddp_proto, 0);
+	if (rc)
 		goto out;
 
-	(void)sock_register(&atalk_family_ops);
+	rc = sock_register(&atalk_family_ops);
+	if (rc)
+		goto out_proto;
+
 	ddp_dl = register_snap_client(ddp_snap_id, atalk_rcv);
 	if (!ddp_dl)
 		printk(atalk_err_snap);
@@ -1926,12 +1930,33 @@ static int __init atalk_init(void)
 	dev_add_pack(&ltalk_packet_type);
 	dev_add_pack(&ppptalk_packet_type);
 
-	register_netdevice_notifier(&ddp_notifier);
+	rc = register_netdevice_notifier(&ddp_notifier);
+	if (rc)
+		goto out_sock;
+
 	aarp_proto_init();
-	atalk_proc_init();
-	atalk_register_sysctl();
+	rc = atalk_proc_init();
+	if (rc)
+		goto out_aarp;
+
+	rc = atalk_register_sysctl();
+	if (rc)
+		goto out_proc;
 out:
 	return rc;
+out_proc:
+	atalk_proc_exit();
+out_aarp:
+	aarp_cleanup_module();
+	unregister_netdevice_notifier(&ddp_notifier);
+out_sock:
+	dev_remove_pack(&ppptalk_packet_type);
+	dev_remove_pack(&ltalk_packet_type);
+	unregister_snap_client(ddp_dl);
+	sock_unregister(PF_APPLETALK);
+out_proto:
+	proto_unregister(&ddp_proto);
+	goto out;
 }
 module_init(atalk_init);
 
diff -druNp --no-dereference linux-libre-3.16.73-gnu/net/appletalk/sysctl_net_atalk.c linux-libre-3.16.74-gnu/net/appletalk/sysctl_net_atalk.c
--- linux-libre-3.16.73-gnu/net/appletalk/sysctl_net_atalk.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/net/appletalk/sysctl_net_atalk.c	2019-09-23 16:12:19.000000000 -0400
@@ -44,9 +44,12 @@ static struct ctl_table atalk_table[] =
 
 static struct ctl_table_header *atalk_table_header;
 
-void atalk_register_sysctl(void)
+int __init atalk_register_sysctl(void)
 {
 	atalk_table_header = register_net_sysctl(&init_net, "net/appletalk", atalk_table);
+	if (!atalk_table_header)
+		return -ENOMEM;
+	return 0;
 }
 
 void atalk_unregister_sysctl(void)
diff -druNp --no-dereference linux-libre-3.16.73-gnu/net/bluetooth/hci_conn.c linux-libre-3.16.74-gnu/net/bluetooth/hci_conn.c
--- linux-libre-3.16.73-gnu/net/bluetooth/hci_conn.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/net/bluetooth/hci_conn.c	2019-09-23 16:12:19.000000000 -0400
@@ -980,8 +980,16 @@ auth:
 		return 0;
 
 encrypt:
-	if (conn->link_mode & HCI_LM_ENCRYPT)
+	if (conn->link_mode & HCI_LM_ENCRYPT) {
+		/* Ensure that the encryption key size has been read,
+		 * otherwise stall the upper layer responses.
+		 */
+		if (!conn->enc_key_size)
+			return 0;
+
+		/* Nothing else needed, all requirements are met */
 		return 1;
+	}
 
 	hci_conn_encrypt(conn);
 	return 0;
diff -druNp --no-dereference linux-libre-3.16.73-gnu/net/bluetooth/l2cap_core.c linux-libre-3.16.74-gnu/net/bluetooth/l2cap_core.c
--- linux-libre-3.16.73-gnu/net/bluetooth/l2cap_core.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/net/bluetooth/l2cap_core.c	2019-09-23 16:12:19.000000000 -0400
@@ -1260,6 +1260,21 @@ static void l2cap_start_connection(struc
 	}
 }
 
+static bool l2cap_check_enc_key_size(struct hci_conn *hcon)
+{
+	/* The minimum encryption key size needs to be enforced by the
+	 * host stack before establishing any L2CAP connections. The
+	 * specification in theory allows a minimum of 1, but to align
+	 * BR/EDR and LE transports, a minimum of 7 is chosen.
+	 *
+	 * This check might also be called for unencrypted connections
+	 * that have no key size requirements. Ensure that the link is
+	 * actually encrypted before enforcing a key size.
+	 */
+	return (!(hcon->link_mode & HCI_LM_ENCRYPT) ||
+		hcon->enc_key_size >= HCI_MIN_ENC_KEY_SIZE);
+}
+
 static void l2cap_do_start(struct l2cap_chan *chan)
 {
 	struct l2cap_conn *conn = chan->conn;
@@ -1273,10 +1288,14 @@ static void l2cap_do_start(struct l2cap_
 		if (!(conn->info_state & L2CAP_INFO_FEAT_MASK_REQ_DONE))
 			return;
 
-		if (l2cap_chan_check_security(chan) &&
-		    __l2cap_no_conn_pending(chan)) {
+		if (!l2cap_chan_check_security(chan) ||
+		    !__l2cap_no_conn_pending(chan))
+			return;
+
+		if (l2cap_check_enc_key_size(conn->hcon))
 			l2cap_start_connection(chan);
-		}
+		else
+			__set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
 	} else {
 		struct l2cap_info_req req;
 		req.type = cpu_to_le16(L2CAP_IT_FEAT_MASK);
@@ -1366,7 +1385,10 @@ static void l2cap_conn_start(struct l2ca
 				continue;
 			}
 
-			l2cap_start_connection(chan);
+			if (l2cap_check_enc_key_size(conn->hcon))
+				l2cap_start_connection(chan);
+			else
+				l2cap_chan_close(chan, ECONNREFUSED);
 
 		} else if (chan->state == BT_CONNECT2) {
 			struct l2cap_conn_rsp rsp;
@@ -7352,7 +7374,7 @@ int l2cap_security_cfm(struct hci_conn *
 		}
 
 		if (chan->state == BT_CONNECT) {
-			if (!status)
+			if (!status && l2cap_check_enc_key_size(hcon))
 				l2cap_start_connection(chan);
 			else
 				__set_chan_timer(chan, L2CAP_DISC_TIMEOUT);
@@ -7360,7 +7382,7 @@ int l2cap_security_cfm(struct hci_conn *
 			struct l2cap_conn_rsp rsp;
 			__u16 res, stat;
 
-			if (!status) {
+			if (!status && l2cap_check_enc_key_size(hcon)) {
 				if (test_bit(FLAG_DEFER_SETUP, &chan->flags)) {
 					res = L2CAP_CR_PEND;
 					stat = L2CAP_CS_AUTHOR_PEND;
diff -druNp --no-dereference linux-libre-3.16.73-gnu/net/bridge/netfilter/ebtables.c linux-libre-3.16.74-gnu/net/bridge/netfilter/ebtables.c
--- linux-libre-3.16.73-gnu/net/bridge/netfilter/ebtables.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/net/bridge/netfilter/ebtables.c	2019-09-23 16:12:19.000000000 -0400
@@ -2139,7 +2139,9 @@ static int compat_copy_entries(unsigned
 	if (ret < 0)
 		return ret;
 
-	WARN_ON(size_remaining);
+	if (size_remaining)
+		return -EINVAL;
+
 	return state->buf_kern_offset;
 }
 
diff -druNp --no-dereference linux-libre-3.16.73-gnu/net/ipv4/raw.c linux-libre-3.16.74-gnu/net/ipv4/raw.c
--- linux-libre-3.16.73-gnu/net/ipv4/raw.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/net/ipv4/raw.c	2019-09-23 16:12:19.000000000 -0400
@@ -167,6 +167,7 @@ static int icmp_filter(const struct sock
  */
 static int raw_v4_input(struct sk_buff *skb, const struct iphdr *iph, int hash)
 {
+	int dif = inet_iif(skb);
 	struct sock *sk;
 	struct hlist_head *head;
 	int delivered = 0;
@@ -179,8 +180,7 @@ static int raw_v4_input(struct sk_buff *
 
 	net = dev_net(skb->dev);
 	sk = __raw_v4_lookup(net, __sk_head(head), iph->protocol,
-			     iph->saddr, iph->daddr,
-			     skb->dev->ifindex);
+			     iph->saddr, iph->daddr, dif);
 
 	while (sk) {
 		delivered = 1;
@@ -193,7 +193,7 @@ static int raw_v4_input(struct sk_buff *
 		}
 		sk = __raw_v4_lookup(net, sk_next(sk), iph->protocol,
 				     iph->saddr, iph->daddr,
-				     skb->dev->ifindex);
+				     dif);
 	}
 out:
 	read_unlock(&raw_v4_hashinfo.lock);
diff -druNp --no-dereference linux-libre-3.16.73-gnu/net/mac80211/ieee80211_i.h linux-libre-3.16.74-gnu/net/mac80211/ieee80211_i.h
--- linux-libre-3.16.73-gnu/net/mac80211/ieee80211_i.h	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/net/mac80211/ieee80211_i.h	2019-09-23 16:12:19.000000000 -0400
@@ -1858,6 +1858,9 @@ int ieee80211_tdls_mgmt(struct wiphy *wi
 			const u8 *extra_ies, size_t extra_ies_len);
 int ieee80211_tdls_oper(struct wiphy *wiphy, struct net_device *dev,
 			const u8 *peer, enum nl80211_tdls_operation oper);
+void ieee80211_tdls_handle_disconnect(struct ieee80211_sub_if_data *sdata,
+				      const u8 *peer, u16 reason);
+const char *ieee80211_get_reason_code_string(u16 reason_code);
 
 
 #ifdef CONFIG_MAC80211_NOINLINE
diff -druNp --no-dereference linux-libre-3.16.73-gnu/net/mac80211/mlme.c linux-libre-3.16.74-gnu/net/mac80211/mlme.c
--- linux-libre-3.16.73-gnu/net/mac80211/mlme.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/net/mac80211/mlme.c	2019-09-23 16:12:19.000000000 -0400
@@ -2298,7 +2298,7 @@ static void ieee80211_rx_mgmt_auth(struc
 #define case_WLAN(type) \
 	case WLAN_REASON_##type: return #type
 
-static const char *ieee80211_get_reason_code_string(u16 reason_code)
+const char *ieee80211_get_reason_code_string(u16 reason_code)
 {
 	switch (reason_code) {
 	case_WLAN(UNSPECIFIED);
@@ -2357,21 +2357,24 @@ static void ieee80211_rx_mgmt_deauth(str
 {
 	struct ieee80211_if_managed *ifmgd = &sdata->u.mgd;
 	const u8 *bssid = NULL;
-	u16 reason_code;
+	u16 reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
 
 	sdata_assert_lock(sdata);
 
 	if (len < 24 + 2)
 		return;
 
+	if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) {
+		ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code);
+		return;
+	}
+
 	if (!ifmgd->associated ||
 	    !ether_addr_equal(mgmt->bssid, ifmgd->associated->bssid))
 		return;
 
 	bssid = ifmgd->associated->bssid;
 
-	reason_code = le16_to_cpu(mgmt->u.deauth.reason_code);
-
 	sdata_info(sdata, "deauthenticated from %pM (Reason: %u=%s)\n",
 		   bssid, reason_code, ieee80211_get_reason_code_string(reason_code));
 
@@ -2398,6 +2401,11 @@ static void ieee80211_rx_mgmt_disassoc(s
 
 	reason_code = le16_to_cpu(mgmt->u.disassoc.reason_code);
 
+	if (!ether_addr_equal(mgmt->bssid, mgmt->sa)) {
+		ieee80211_tdls_handle_disconnect(sdata, mgmt->sa, reason_code);
+		return;
+	}
+
 	sdata_info(sdata, "disassociated from %pM (Reason: %u)\n",
 		   mgmt->sa, reason_code);
 
diff -druNp --no-dereference linux-libre-3.16.73-gnu/net/mac80211/rx.c linux-libre-3.16.74-gnu/net/mac80211/rx.c
--- linux-libre-3.16.73-gnu/net/mac80211/rx.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/net/mac80211/rx.c	2019-09-23 16:12:19.000000000 -0400
@@ -3084,6 +3084,8 @@ static bool prepare_for_handlers(struct
 	case NL80211_IFTYPE_STATION:
 		if (!bssid && !sdata->u.mgd.use_4addr)
 			return false;
+		if (ieee80211_is_robust_mgmt_frame(skb) && !rx->sta)
+			return false;
 		if (!multicast &&
 		    !ether_addr_equal(sdata->vif.addr, hdr->addr1)) {
 			if (!(sdata->dev->flags & IFF_PROMISC) ||
diff -druNp --no-dereference linux-libre-3.16.73-gnu/net/mac80211/tdls.c linux-libre-3.16.74-gnu/net/mac80211/tdls.c
--- linux-libre-3.16.73-gnu/net/mac80211/tdls.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/net/mac80211/tdls.c	2019-09-23 16:12:19.000000000 -0400
@@ -8,6 +8,7 @@
  */
 
 #include <linux/ieee80211.h>
+#include <net/cfg80211.h>
 #include "ieee80211_i.h"
 
 static void ieee80211_tdls_add_ext_capab(struct sk_buff *skb)
@@ -323,3 +324,42 @@ int ieee80211_tdls_oper(struct wiphy *wi
 
 	return 0;
 }
+
+void ieee80211_tdls_oper_request(struct ieee80211_vif *vif, const u8 *peer,
+				 enum nl80211_tdls_operation oper,
+				 u16 reason_code, gfp_t gfp)
+{
+	struct ieee80211_sub_if_data *sdata = vif_to_sdata(vif);
+
+	if (vif->type != NL80211_IFTYPE_STATION || !vif->bss_conf.assoc) {
+		sdata_err(sdata, "Discarding TDLS oper %d - not STA or disconnected\n",
+			  oper);
+		return;
+	}
+
+	cfg80211_tdls_oper_request(sdata->dev, peer, oper, reason_code, gfp);
+}
+EXPORT_SYMBOL(ieee80211_tdls_oper_request);
+
+void ieee80211_tdls_handle_disconnect(struct ieee80211_sub_if_data *sdata,
+				      const u8 *peer, u16 reason)
+{
+	struct ieee80211_sta *sta;
+
+	rcu_read_lock();
+	sta = ieee80211_find_sta(&sdata->vif, peer);
+	if (!sta || !sta->tdls) {
+		rcu_read_unlock();
+		return;
+	}
+	rcu_read_unlock();
+
+	tdls_dbg(sdata, "disconnected from TDLS peer %pM (Reason: %u=%s)\n",
+		 peer, reason,
+		 ieee80211_get_reason_code_string(reason));
+
+	ieee80211_tdls_oper_request(&sdata->vif, peer,
+				    NL80211_TDLS_TEARDOWN,
+				    WLAN_REASON_TDLS_TEARDOWN_UNREACHABLE,
+				    GFP_ATOMIC);
+}
diff -druNp --no-dereference linux-libre-3.16.73-gnu/sound/pci/hda/hda_generic.c linux-libre-3.16.74-gnu/sound/pci/hda/hda_generic.c
--- linux-libre-3.16.73-gnu/sound/pci/hda/hda_generic.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/sound/pci/hda/hda_generic.c	2019-09-23 16:12:19.000000000 -0400
@@ -5348,7 +5348,8 @@ int snd_hda_gen_init(struct hda_codec *c
 	if (spec->init_hook)
 		spec->init_hook(codec);
 
-	snd_hda_apply_verbs(codec);
+	if (!spec->skip_verbs)
+		snd_hda_apply_verbs(codec);
 
 	codec->cached_write = 1;
 
diff -druNp --no-dereference linux-libre-3.16.73-gnu/sound/pci/hda/hda_generic.h linux-libre-3.16.74-gnu/sound/pci/hda/hda_generic.h
--- linux-libre-3.16.73-gnu/sound/pci/hda/hda_generic.h	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/sound/pci/hda/hda_generic.h	2019-09-23 16:12:19.000000000 -0400
@@ -238,6 +238,7 @@ struct hda_gen_spec {
 	unsigned int indep_hp_enabled:1; /* independent HP enabled */
 	unsigned int have_aamix_ctl:1;
 	unsigned int hp_mic_jack_modes:1;
+	unsigned int skip_verbs:1; /* don't apply verbs at snd_hda_gen_init() */
 
 	/* additional mute flags (only effective with auto_mute_via_amp=1) */
 	u64 mute_bits;
diff -druNp --no-dereference linux-libre-3.16.73-gnu/sound/pci/hda/patch_hdmi.c linux-libre-3.16.74-gnu/sound/pci/hda/patch_hdmi.c
--- linux-libre-3.16.73-gnu/sound/pci/hda/patch_hdmi.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/sound/pci/hda/patch_hdmi.c	2019-09-23 16:12:19.000000000 -0400
@@ -1632,6 +1632,12 @@ static void hdmi_repoll_eld(struct work_
 {
 	struct hdmi_spec_per_pin *per_pin =
 	container_of(to_delayed_work(work), struct hdmi_spec_per_pin, work);
+	struct hda_codec *codec = per_pin->codec;
+	struct hda_jack_tbl *jack;
+
+	jack = snd_hda_jack_tbl_get(codec, per_pin->pin_nid);
+	if (jack)
+		jack->jack_dirty = 1;
 
 	if (per_pin->repoll_count++ > 6)
 		per_pin->repoll_count = 0;
diff -druNp --no-dereference linux-libre-3.16.73-gnu/sound/pci/hda/patch_realtek.c linux-libre-3.16.74-gnu/sound/pci/hda/patch_realtek.c
--- linux-libre-3.16.73-gnu/sound/pci/hda/patch_realtek.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/sound/pci/hda/patch_realtek.c	2019-09-23 16:12:19.000000000 -0400
@@ -831,10 +831,11 @@ static int alc_init(struct hda_codec *co
 	if (spec->init_hook)
 		spec->init_hook(codec);
 
+	spec->gen.skip_verbs = 1; /* applied in below */
+	snd_hda_gen_init(codec);
 	alc_fix_pll(codec);
 	alc_auto_init_amp(codec, spec->init_amp);
-
-	snd_hda_gen_init(codec);
+	snd_hda_apply_verbs(codec); /* apply verbs here after own init */
 
 	snd_hda_apply_fixup(codec, HDA_FIXUP_ACT_INIT);
 
diff -druNp --no-dereference linux-libre-3.16.73-gnu/sound/soc/codecs/max98090.c linux-libre-3.16.74-gnu/sound/soc/codecs/max98090.c
--- linux-libre-3.16.73-gnu/sound/soc/codecs/max98090.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/sound/soc/codecs/max98090.c	2019-09-23 16:12:19.000000000 -0400
@@ -1271,14 +1271,14 @@ static const struct snd_soc_dapm_widget
 		&max98090_right_rcv_mixer_controls[0],
 		ARRAY_SIZE(max98090_right_rcv_mixer_controls)),
 
-	SND_SOC_DAPM_MUX("LINMOD Mux", M98090_REG_LOUTR_MIXER,
-		M98090_LINMOD_SHIFT, 0, &max98090_linmod_mux),
+	SND_SOC_DAPM_MUX("LINMOD Mux", SND_SOC_NOPM, 0, 0,
+		&max98090_linmod_mux),
 
-	SND_SOC_DAPM_MUX("MIXHPLSEL Mux", M98090_REG_HP_CONTROL,
-		M98090_MIXHPLSEL_SHIFT, 0, &max98090_mixhplsel_mux),
+	SND_SOC_DAPM_MUX("MIXHPLSEL Mux", SND_SOC_NOPM, 0, 0,
+		&max98090_mixhplsel_mux),
 
-	SND_SOC_DAPM_MUX("MIXHPRSEL Mux", M98090_REG_HP_CONTROL,
-		M98090_MIXHPRSEL_SHIFT, 0, &max98090_mixhprsel_mux),
+	SND_SOC_DAPM_MUX("MIXHPRSEL Mux", SND_SOC_NOPM, 0, 0,
+		&max98090_mixhprsel_mux),
 
 	SND_SOC_DAPM_PGA("HP Left Out", M98090_REG_OUTPUT_ENABLE,
 		M98090_HPLEN_SHIFT, 0, NULL, 0),
diff -druNp --no-dereference linux-libre-3.16.73-gnu/sound/soc/fsl/fsl_esai.c linux-libre-3.16.74-gnu/sound/soc/fsl/fsl_esai.c
--- linux-libre-3.16.73-gnu/sound/soc/fsl/fsl_esai.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/sound/soc/fsl/fsl_esai.c	2019-09-23 16:12:19.000000000 -0400
@@ -245,6 +245,7 @@ static int fsl_esai_set_dai_sysclk(struc
 		break;
 	case ESAI_HCKT_EXTAL:
 		ecr |= ESAI_ECR_ETI;
+		break;
 	case ESAI_HCKR_EXTAL:
 		ecr |= ESAI_ECR_ERI;
 		break;
diff -druNp --no-dereference linux-libre-3.16.73-gnu/sound/usb/mixer.c linux-libre-3.16.74-gnu/sound/usb/mixer.c
--- linux-libre-3.16.73-gnu/sound/usb/mixer.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/sound/usb/mixer.c	2019-09-23 16:12:19.000000000 -0400
@@ -81,6 +81,7 @@ struct mixer_build {
 	unsigned char *buffer;
 	unsigned int buflen;
 	DECLARE_BITMAP(unitbitmap, MAX_ID_ELEMS);
+	DECLARE_BITMAP(termbitmap, MAX_ID_ELEMS);
 	struct usb_audio_term oterm;
 	const struct usbmix_name_map *map;
 	const struct usbmix_selector_map *selector_map;
@@ -685,15 +686,24 @@ static int get_term_name(struct mixer_bu
  * parse the source unit recursively until it reaches to a terminal
  * or a branched unit.
  */
-static int check_input_term(struct mixer_build *state, int id,
+static int __check_input_term(struct mixer_build *state, int id,
 			    struct usb_audio_term *term)
 {
 	int err;
 	void *p1;
+	unsigned char *hdr;
 
 	memset(term, 0, sizeof(*term));
-	while ((p1 = find_audio_control_unit(state, id)) != NULL) {
-		unsigned char *hdr = p1;
+	for (;;) {
+		/* a loop in the terminal chain? */
+		if (test_and_set_bit(id, state->termbitmap))
+			return -EINVAL;
+
+		p1 = find_audio_control_unit(state, id);
+		if (!p1)
+			break;
+
+		hdr = p1;
 		term->id = id;
 		switch (hdr[2]) {
 		case UAC_INPUT_TERMINAL:
@@ -711,7 +721,7 @@ static int check_input_term(struct mixer
 				term->name = d->iTerminal;
 
 				/* call recursively to get the clock selectors */
-				err = check_input_term(state, d->bCSourceID, term);
+				err = __check_input_term(state, d->bCSourceID, term);
 				if (err < 0)
 					return err;
 			}
@@ -734,7 +744,7 @@ static int check_input_term(struct mixer
 		case UAC2_CLOCK_SELECTOR: {
 			struct uac_selector_unit_descriptor *d = p1;
 			/* call recursively to retrieve the channel info */
-			err = check_input_term(state, d->baSourceID[0], term);
+			err = __check_input_term(state, d->baSourceID[0], term);
 			if (err < 0)
 				return err;
 			term->type = d->bDescriptorSubtype << 16; /* virtual type */
@@ -781,6 +791,15 @@ static int check_input_term(struct mixer
 	return -ENODEV;
 }
 
+
+static int check_input_term(struct mixer_build *state, int id,
+			    struct usb_audio_term *term)
+{
+	memset(term, 0, sizeof(*term));
+	memset(state->termbitmap, 0, sizeof(state->termbitmap));
+	return __check_input_term(state, id, term);
+}
+
 /*
  * Feature Unit
  */
@@ -1594,6 +1613,7 @@ static int parse_audio_mixer_unit(struct
 	int pin, ich, err;
 
 	if (desc->bLength < 11 || !(input_pins = desc->bNrInPins) ||
+	    desc->bLength < sizeof(*desc) + desc->bNrInPins ||
 	    !(num_outs = uac_mixer_unit_bNrChannels(desc))) {
 		usb_audio_err(state->chip,
 			      "invalid MIXER UNIT descriptor %d\n",
@@ -2090,6 +2110,8 @@ static int parse_audio_selector_unit(str
 	kctl = snd_ctl_new1(&mixer_selectunit_ctl, cval);
 	if (! kctl) {
 		usb_audio_err(state->chip, "cannot malloc kcontrol\n");
+		for (i = 0; i < desc->bNrInPins; i++)
+			kfree(namelist[i]);
 		kfree(namelist);
 		kfree(cval);
 		return -ENOMEM;
@@ -2499,7 +2521,9 @@ int snd_usb_create_mixer(struct snd_usb_
 	    (err = snd_usb_mixer_status_create(mixer)) < 0)
 		goto _error;
 
-	snd_usb_mixer_apply_create_quirk(mixer);
+	err = snd_usb_mixer_apply_create_quirk(mixer);
+	if (err < 0)
+		goto _error;
 
 	err = snd_device_new(chip->card, SNDRV_DEV_CODEC, mixer, &dev_ops);
 	if (err < 0)
diff -druNp --no-dereference linux-libre-3.16.73-gnu/tools/testing/selftests/ipc/msgque.c linux-libre-3.16.74-gnu/tools/testing/selftests/ipc/msgque.c
--- linux-libre-3.16.73-gnu/tools/testing/selftests/ipc/msgque.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/tools/testing/selftests/ipc/msgque.c	2019-09-23 16:12:19.000000000 -0400
@@ -1,8 +1,9 @@
+#define _GNU_SOURCE
 #include <stdlib.h>
 #include <stdio.h>
 #include <string.h>
 #include <errno.h>
-#include <linux/msg.h>
+#include <sys/msg.h>
 #include <fcntl.h>
 
 #define MAX_MSG_SIZE		32
@@ -70,7 +71,7 @@ int restore_queue(struct msgque_data *ms
 	return 0;
 
 destroy:
-	if (msgctl(id, IPC_RMID, 0))
+	if (msgctl(id, IPC_RMID, NULL))
 		printf("Failed to destroy queue: %d\n", -errno);
 	return ret;
 }
@@ -117,7 +118,7 @@ int check_and_destroy_queue(struct msgqu
 
 	ret = 0;
 err:
-	if (msgctl(msgque->msq_id, IPC_RMID, 0)) {
+	if (msgctl(msgque->msq_id, IPC_RMID, NULL)) {
 		printf("Failed to destroy queue: %d\n", -errno);
 		return -errno;
 	}
@@ -126,7 +127,7 @@ err:
 
 int dump_queue(struct msgque_data *msgque)
 {
-	struct msqid64_ds ds;
+	struct msqid_ds ds;
 	int kern_id;
 	int i, ret;
 
@@ -243,7 +244,7 @@ int main(int argc, char **argv)
 	return 0;
 
 err_destroy:
-	if (msgctl(msgque.msq_id, IPC_RMID, 0)) {
+	if (msgctl(msgque.msq_id, IPC_RMID, NULL)) {
 		printf("Failed to destroy queue: %d\n", -errno);
 		return -errno;
 	}
diff -druNp --no-dereference linux-libre-3.16.73-gnu/virt/kvm/coalesced_mmio.c linux-libre-3.16.74-gnu/virt/kvm/coalesced_mmio.c
--- linux-libre-3.16.73-gnu/virt/kvm/coalesced_mmio.c	2019-08-20 14:01:58.000000000 -0400
+++ linux-libre-3.16.74-gnu/virt/kvm/coalesced_mmio.c	2019-09-23 16:12:19.000000000 -0400
@@ -39,7 +39,7 @@ static int coalesced_mmio_in_range(struc
 	return 1;
 }
 
-static int coalesced_mmio_has_room(struct kvm_coalesced_mmio_dev *dev)
+static int coalesced_mmio_has_room(struct kvm_coalesced_mmio_dev *dev, u32 last)
 {
 	struct kvm_coalesced_mmio_ring *ring;
 	unsigned avail;
@@ -51,7 +51,7 @@ static int coalesced_mmio_has_room(struc
 	 * there is always one unused entry in the buffer
 	 */
 	ring = dev->kvm->coalesced_mmio_ring;
-	avail = (ring->first - ring->last - 1) % KVM_COALESCED_MMIO_MAX;
+	avail = (ring->first - last - 1) % KVM_COALESCED_MMIO_MAX;
 	if (avail == 0) {
 		/* full */
 		return 0;
@@ -65,24 +65,27 @@ static int coalesced_mmio_write(struct k
 {
 	struct kvm_coalesced_mmio_dev *dev = to_mmio(this);
 	struct kvm_coalesced_mmio_ring *ring = dev->kvm->coalesced_mmio_ring;
+	__u32 insert;
 
 	if (!coalesced_mmio_in_range(dev, addr, len))
 		return -EOPNOTSUPP;
 
 	spin_lock(&dev->kvm->ring_lock);
 
-	if (!coalesced_mmio_has_room(dev)) {
+	insert = ACCESS_ONCE(ring->last);
+	if (!coalesced_mmio_has_room(dev, insert) ||
+	    insert >= KVM_COALESCED_MMIO_MAX) {
 		spin_unlock(&dev->kvm->ring_lock);
 		return -EOPNOTSUPP;
 	}
 
 	/* copy data in first free entry of the ring */
 
-	ring->coalesced_mmio[ring->last].phys_addr = addr;
-	ring->coalesced_mmio[ring->last].len = len;
-	memcpy(ring->coalesced_mmio[ring->last].data, val, len);
+	ring->coalesced_mmio[insert].phys_addr = addr;
+	ring->coalesced_mmio[insert].len = len;
+	memcpy(ring->coalesced_mmio[insert].data, val, len);
 	smp_wmb();
-	ring->last = (ring->last + 1) % KVM_COALESCED_MMIO_MAX;
+	ring->last = (insert + 1) % KVM_COALESCED_MMIO_MAX;
 	spin_unlock(&dev->kvm->ring_lock);
 	return 0;
 }
