diff -druNp --no-dereference linux-libre-3.2.96-gnu1/arch/arm/kernel/traps.c linux-libre-3.2.97-gnu1/arch/arm/kernel/traps.c
--- linux-libre-3.2.96-gnu1/arch/arm/kernel/traps.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/arch/arm/kernel/traps.c	2018-01-01 15:51:06.000000000 -0500
@@ -130,30 +130,26 @@ static void dump_mem(const char *lvl, co
 	set_fs(fs);
 }
 
-static void dump_instr(const char *lvl, struct pt_regs *regs)
+static void __dump_instr(const char *lvl, struct pt_regs *regs)
 {
 	unsigned long addr = instruction_pointer(regs);
 	const int thumb = thumb_mode(regs);
 	const int width = thumb ? 4 : 8;
-	mm_segment_t fs;
 	char str[sizeof("00000000 ") * 5 + 2 + 1], *p = str;
 	int i;
 
 	/*
-	 * We need to switch to kernel mode so that we can use __get_user
-	 * to safely read from kernel space.  Note that we now dump the
-	 * code first, just in case the backtrace kills us.
+	 * Note that we now dump the code first, just in case the backtrace
+	 * kills us.
 	 */
-	fs = get_fs();
-	set_fs(KERNEL_DS);
 
 	for (i = -4; i < 1 + !!thumb; i++) {
 		unsigned int val, bad;
 
 		if (thumb)
-			bad = __get_user(val, &((u16 *)addr)[i]);
+			bad = get_user(val, &((u16 *)addr)[i]);
 		else
-			bad = __get_user(val, &((u32 *)addr)[i]);
+			bad = get_user(val, &((u32 *)addr)[i]);
 
 		if (!bad)
 			p += sprintf(p, i == 0 ? "(%0*x) " : "%0*x ",
@@ -164,8 +160,20 @@ static void dump_instr(const char *lvl,
 		}
 	}
 	printk("%sCode: %s\n", lvl, str);
+}
 
-	set_fs(fs);
+static void dump_instr(const char *lvl, struct pt_regs *regs)
+{
+	mm_segment_t fs;
+
+	if (!user_mode(regs)) {
+		fs = get_fs();
+		set_fs(KERNEL_DS);
+		__dump_instr(lvl, regs);
+		set_fs(fs);
+	} else {
+		__dump_instr(lvl, regs);
+	}
 }
 
 #ifdef CONFIG_ARM_UNWIND
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/arch/mips/ar7/platform.c linux-libre-3.2.97-gnu1/arch/mips/ar7/platform.c
--- linux-libre-3.2.96-gnu1/arch/mips/ar7/platform.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/arch/mips/ar7/platform.c	2018-01-01 15:51:06.000000000 -0500
@@ -541,6 +541,7 @@ static int __init ar7_register_uarts(voi
 	uart_port.type		= PORT_AR7;
 	uart_port.uartclk	= clk_get_rate(bus_clk) / 2;
 	uart_port.iotype	= UPIO_MEM32;
+	uart_port.flags		= UPF_FIXED_TYPE;
 	uart_port.regshift	= 2;
 
 	uart_port.line		= 0;
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/arch/s390/mm/gup.c linux-libre-3.2.97-gnu1/arch/s390/mm/gup.c
--- linux-libre-3.2.96-gnu1/arch/s390/mm/gup.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/arch/s390/mm/gup.c	2018-01-01 15:51:06.000000000 -0500
@@ -51,13 +51,12 @@ static inline int gup_pte_range(pmd_t *p
 static inline int gup_huge_pmd(pmd_t *pmdp, pmd_t pmd, unsigned long addr,
 		unsigned long end, int write, struct page **pages, int *nr)
 {
-	unsigned long mask, result;
 	struct page *head, *page, *tail;
+	unsigned long mask;
 	int refs;
 
-	result = write ? 0 : _SEGMENT_ENTRY_RO;
-	mask = result | _SEGMENT_ENTRY_INV;
-	if ((pmd_val(pmd) & mask) != result)
+	mask = (write ? _SEGMENT_ENTRY_RO : 0) | _SEGMENT_ENTRY_INV;
+	if ((pmd_val(pmd) & mask) != 0)
 		return 0;
 	VM_BUG_ON(!pfn_valid(pmd_val(pmd) >> PAGE_SHIFT));
 
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/arch/sh/include/cpu-sh4/cpu/sh7722.h linux-libre-3.2.97-gnu1/arch/sh/include/cpu-sh4/cpu/sh7722.h
--- linux-libre-3.2.96-gnu1/arch/sh/include/cpu-sh4/cpu/sh7722.h	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/arch/sh/include/cpu-sh4/cpu/sh7722.h	2018-01-01 15:51:06.000000000 -0500
@@ -67,7 +67,7 @@ enum {
 	GPIO_PTN3, GPIO_PTN2, GPIO_PTN1, GPIO_PTN0,
 
 	/* PTQ */
-	GPIO_PTQ7, GPIO_PTQ6, GPIO_PTQ5, GPIO_PTQ4,
+	GPIO_PTQ6, GPIO_PTQ5, GPIO_PTQ4,
 	GPIO_PTQ3, GPIO_PTQ2, GPIO_PTQ1, GPIO_PTQ0,
 
 	/* PTR */
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/arch/sh/include/cpu-sh4/cpu/sh7757.h linux-libre-3.2.97-gnu1/arch/sh/include/cpu-sh4/cpu/sh7757.h
--- linux-libre-3.2.96-gnu1/arch/sh/include/cpu-sh4/cpu/sh7757.h	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/arch/sh/include/cpu-sh4/cpu/sh7757.h	2018-01-01 15:51:06.000000000 -0500
@@ -40,7 +40,7 @@ enum {
 
 	/* PTJ */
 	GPIO_PTJ0, GPIO_PTJ1, GPIO_PTJ2, GPIO_PTJ3,
-	GPIO_PTJ4, GPIO_PTJ5, GPIO_PTJ6, GPIO_PTJ7_RESV,
+	GPIO_PTJ4, GPIO_PTJ5, GPIO_PTJ6,
 
 	/* PTK */
 	GPIO_PTK0, GPIO_PTK1, GPIO_PTK2, GPIO_PTK3,
@@ -48,7 +48,7 @@ enum {
 
 	/* PTL */
 	GPIO_PTL0, GPIO_PTL1, GPIO_PTL2, GPIO_PTL3,
-	GPIO_PTL4, GPIO_PTL5, GPIO_PTL6, GPIO_PTL7_RESV,
+	GPIO_PTL4, GPIO_PTL5, GPIO_PTL6,
 
 	/* PTM */
 	GPIO_PTM0, GPIO_PTM1, GPIO_PTM2, GPIO_PTM3,
@@ -56,7 +56,7 @@ enum {
 
 	/* PTN */
 	GPIO_PTN0, GPIO_PTN1, GPIO_PTN2, GPIO_PTN3,
-	GPIO_PTN4, GPIO_PTN5, GPIO_PTN6, GPIO_PTN7_RESV,
+	GPIO_PTN4, GPIO_PTN5, GPIO_PTN6,
 
 	/* PTO */
 	GPIO_PTO0, GPIO_PTO1, GPIO_PTO2, GPIO_PTO3,
@@ -68,7 +68,7 @@ enum {
 
 	/* PTQ */
 	GPIO_PTQ0, GPIO_PTQ1, GPIO_PTQ2, GPIO_PTQ3,
-	GPIO_PTQ4, GPIO_PTQ5, GPIO_PTQ6, GPIO_PTQ7_RESV,
+	GPIO_PTQ4, GPIO_PTQ5, GPIO_PTQ6,
 
 	/* PTR */
 	GPIO_PTR0, GPIO_PTR1, GPIO_PTR2, GPIO_PTR3,
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/arch/tile/kernel/setup.c linux-libre-3.2.97-gnu1/arch/tile/kernel/setup.c
--- linux-libre-3.2.96-gnu1/arch/tile/kernel/setup.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/arch/tile/kernel/setup.c	2018-01-01 15:51:06.000000000 -0500
@@ -119,7 +119,8 @@ early_param("maxmem", setup_maxmem);
 static int __init setup_maxnodemem(char *str)
 {
 	char *endp;
-	long maxnodemem_mb, node;
+	long maxnodemem_mb;
+	unsigned long node;
 
 	node = str ? simple_strtoul(str, &endp, 0) : INT_MAX;
 	if (node >= MAX_NUMNODES || *endp != ':' ||
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/arch/x86/crypto/salsa20_glue.c linux-libre-3.2.97-gnu1/arch/x86/crypto/salsa20_glue.c
--- linux-libre-3.2.96-gnu1/arch/x86/crypto/salsa20_glue.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/arch/x86/crypto/salsa20_glue.c	2018-01-01 15:51:06.000000000 -0500
@@ -64,13 +64,6 @@ static int encrypt(struct blkcipher_desc
 
 	salsa20_ivsetup(ctx, walk.iv);
 
-	if (likely(walk.nbytes == nbytes))
-	{
-		salsa20_encrypt_bytes(ctx, walk.src.virt.addr,
-				      walk.dst.virt.addr, nbytes);
-		return blkcipher_walk_done(desc, &walk, 0);
-	}
-
 	while (walk.nbytes >= 64) {
 		salsa20_encrypt_bytes(ctx, walk.src.virt.addr,
 				      walk.dst.virt.addr,
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/arch/x86/include/asm/kvm_para.h linux-libre-3.2.97-gnu1/arch/x86/include/asm/kvm_para.h
--- linux-libre-3.2.96-gnu1/arch/x86/include/asm/kvm_para.h	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/arch/x86/include/asm/kvm_para.h	2018-01-01 15:51:06.000000000 -0500
@@ -195,13 +195,13 @@ static inline unsigned int kvm_arch_para
 
 #ifdef CONFIG_KVM_GUEST
 void __init kvm_guest_init(void);
-void kvm_async_pf_task_wait(u32 token);
+void kvm_async_pf_task_wait(u32 token, int interrupt_kernel);
 void kvm_async_pf_task_wake(u32 token);
 u32 kvm_read_and_reset_pf_reason(void);
 extern void kvm_disable_steal_time(void);
 #else
 #define kvm_guest_init() do { } while (0)
-#define kvm_async_pf_task_wait(T) do {} while(0)
+#define kvm_async_pf_task_wait(T, I) do {} while(0)
 #define kvm_async_pf_task_wake(T) do {} while(0)
 static inline u32 kvm_read_and_reset_pf_reason(void)
 {
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/arch/x86/kernel/kvm.c linux-libre-3.2.97-gnu1/arch/x86/kernel/kvm.c
--- linux-libre-3.2.96-gnu1/arch/x86/kernel/kvm.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/arch/x86/kernel/kvm.c	2018-01-01 15:51:06.000000000 -0500
@@ -91,7 +91,6 @@ struct kvm_task_sleep_node {
 	u32 token;
 	int cpu;
 	bool halted;
-	struct mm_struct *mm;
 };
 
 static struct kvm_task_sleep_head {
@@ -114,7 +113,11 @@ static struct kvm_task_sleep_node *_find
 	return NULL;
 }
 
-void kvm_async_pf_task_wait(u32 token)
+/*
+ * @interrupt_kernel: Is this called from a routine which interrupts the kernel
+ * 		      (other than user space)?
+ */
+void kvm_async_pf_task_wait(u32 token, int interrupt_kernel)
 {
 	u32 key = hash_32(token, KVM_TASK_SLEEP_HASHBITS);
 	struct kvm_task_sleep_head *b = &async_pf_sleepers[key];
@@ -138,9 +141,10 @@ void kvm_async_pf_task_wait(u32 token)
 
 	n.token = token;
 	n.cpu = smp_processor_id();
-	n.mm = current->active_mm;
-	n.halted = idle || preempt_count() > 1;
-	atomic_inc(&n.mm->mm_count);
+	n.halted = idle ||
+		   (IS_ENABLED(CONFIG_PREEMPT_COUNT)
+		    ? preempt_count() > 1 || rcu_preempt_depth()
+		    : interrupt_kernel);
 	init_waitqueue_head(&n.wq);
 	hlist_add_head(&n.link, &b->list);
 	spin_unlock(&b->lock);
@@ -173,9 +177,6 @@ EXPORT_SYMBOL_GPL(kvm_async_pf_task_wait
 static void apf_task_wake_one(struct kvm_task_sleep_node *n)
 {
 	hlist_del_init(&n->link);
-	if (!n->mm)
-		return;
-	mmdrop(n->mm);
 	if (n->halted)
 		smp_send_reschedule(n->cpu);
 	else if (waitqueue_active(&n->wq))
@@ -219,7 +220,7 @@ again:
 		 * async PF was not yet handled.
 		 * Add dummy entry for the token.
 		 */
-		n = kmalloc(sizeof(*n), GFP_ATOMIC);
+		n = kzalloc(sizeof(*n), GFP_ATOMIC);
 		if (!n) {
 			/*
 			 * Allocation failed! Busy wait while other cpu
@@ -231,7 +232,6 @@ again:
 		}
 		n->token = token;
 		n->cpu = smp_processor_id();
-		n->mm = NULL;
 		init_waitqueue_head(&n->wq);
 		hlist_add_head(&n->link, &b->list);
 	} else
@@ -263,7 +263,7 @@ do_async_page_fault(struct pt_regs *regs
 		break;
 	case KVM_PV_REASON_PAGE_NOT_PRESENT:
 		/* page is swapped out by the host. */
-		kvm_async_pf_task_wait((u32)read_cr2());
+		kvm_async_pf_task_wait((u32)read_cr2(), !user_mode_vm(regs));
 		break;
 	case KVM_PV_REASON_PAGE_READY:
 		kvm_async_pf_task_wake((u32)read_cr2());
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/arch/x86/kvm/svm.c linux-libre-3.2.97-gnu1/arch/x86/kvm/svm.c
--- linux-libre-3.2.96-gnu1/arch/x86/kvm/svm.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/arch/x86/kvm/svm.c	2018-01-01 15:51:06.000000000 -0500
@@ -1620,7 +1620,7 @@ static int pf_interception(struct vcpu_s
 	case KVM_PV_REASON_PAGE_NOT_PRESENT:
 		svm->apf_reason = 0;
 		local_irq_disable();
-		kvm_async_pf_task_wait(fault_address);
+		kvm_async_pf_task_wait(fault_address, 0);
 		local_irq_enable();
 		break;
 	case KVM_PV_REASON_PAGE_READY:
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/arch/x86/kvm/vmx.c linux-libre-3.2.97-gnu1/arch/x86/kvm/vmx.c
--- linux-libre-3.2.96-gnu1/arch/x86/kvm/vmx.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/arch/x86/kvm/vmx.c	2018-01-01 15:51:06.000000000 -0500
@@ -7055,7 +7055,7 @@ void load_vmcs12_host_state(struct kvm_v
 	 * (KVM doesn't change it)- no reason to call set_cr4_guest_host_mask();
 	 */
 	vcpu->arch.cr4_guest_owned_bits = ~vmcs_readl(CR4_GUEST_HOST_MASK);
-	kvm_set_cr4(vcpu, vmcs12->host_cr4);
+	vmx_set_cr4(vcpu, vmcs12->host_cr4);
 
 	/* shadow page tables on either EPT or shadow page tables */
 	kvm_set_cr3(vcpu, vmcs12->host_cr3);
@@ -7285,12 +7285,7 @@ static int __init vmx_init(void)
 		goto out2;
 	}
 
-	/*
-	 * Allow direct access to the PC debug port (it is often used for I/O
-	 * delays, but the vmexits simply slow things down).
-	 */
 	memset(vmx_io_bitmap_a, 0xff, PAGE_SIZE);
-	clear_bit(0x80, vmx_io_bitmap_a);
 
 	memset(vmx_io_bitmap_b, 0xff, PAGE_SIZE);
 
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/arch/x86/kvm/x86.c linux-libre-3.2.97-gnu1/arch/x86/kvm/x86.c
--- linux-libre-3.2.96-gnu1/arch/x86/kvm/x86.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/arch/x86/kvm/x86.c	2018-01-01 15:51:06.000000000 -0500
@@ -3920,7 +3920,7 @@ static int vcpu_mmio_read(struct kvm_vcp
 		      !kvm_iodevice_read(&vcpu->arch.apic->dev, addr, n, v))
 		    && kvm_io_bus_read(vcpu->kvm, KVM_MMIO_BUS, addr, n, v))
 			break;
-		trace_kvm_mmio(KVM_TRACE_MMIO_READ, n, addr, *(u64 *)v);
+		trace_kvm_mmio(KVM_TRACE_MMIO_READ, n, addr, v);
 		handled += n;
 		addr += n;
 		len -= n;
@@ -4152,7 +4152,7 @@ static int read_prepare(struct kvm_vcpu
 	if (vcpu->mmio_read_completed) {
 		memcpy(val, vcpu->mmio_data, bytes);
 		trace_kvm_mmio(KVM_TRACE_MMIO_READ, bytes,
-			       vcpu->mmio_phys_addr, *(u64 *)val);
+			       vcpu->mmio_phys_addr, val);
 		vcpu->mmio_read_completed = 0;
 		return 1;
 	}
@@ -4174,14 +4174,14 @@ static int write_emulate(struct kvm_vcpu
 
 static int write_mmio(struct kvm_vcpu *vcpu, gpa_t gpa, int bytes, void *val)
 {
-	trace_kvm_mmio(KVM_TRACE_MMIO_WRITE, bytes, gpa, *(u64 *)val);
+	trace_kvm_mmio(KVM_TRACE_MMIO_WRITE, bytes, gpa, val);
 	return vcpu_mmio_write(vcpu, gpa, bytes, val);
 }
 
 static int read_exit_mmio(struct kvm_vcpu *vcpu, gpa_t gpa,
 			  void *val, int bytes)
 {
-	trace_kvm_mmio(KVM_TRACE_MMIO_READ_UNSATISFIED, bytes, gpa, 0);
+	trace_kvm_mmio(KVM_TRACE_MMIO_READ_UNSATISFIED, bytes, gpa, NULL);
 	return X86EMUL_IO_NEEDED;
 }
 
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/arch/x86/oprofile/op_model_ppro.c linux-libre-3.2.97-gnu1/arch/x86/oprofile/op_model_ppro.c
--- linux-libre-3.2.96-gnu1/arch/x86/oprofile/op_model_ppro.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/arch/x86/oprofile/op_model_ppro.c	2018-01-01 15:51:06.000000000 -0500
@@ -212,8 +212,8 @@ static void arch_perfmon_setup_counters(
 	eax.full = cpuid_eax(0xa);
 
 	/* Workaround for BIOS bugs in 6/15. Taken from perfmon2 */
-	if (eax.split.version_id == 0 && __this_cpu_read(cpu_info.x86) == 6 &&
-		__this_cpu_read(cpu_info.x86_model) == 15) {
+	if (eax.split.version_id == 0 && boot_cpu_data.x86 == 6 &&
+	    boot_cpu_data.x86_model == 15) {
 		eax.split.version_id = 2;
 		eax.split.num_counters = 2;
 		eax.split.bit_width = 40;
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/crypto/hmac.c linux-libre-3.2.97-gnu1/crypto/hmac.c
--- linux-libre-3.2.96-gnu1/crypto/hmac.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/crypto/hmac.c	2018-01-01 15:51:06.000000000 -0500
@@ -197,11 +197,15 @@ static int hmac_create(struct crypto_tem
 	salg = shash_attr_alg(tb[1], 0, 0);
 	if (IS_ERR(salg))
 		return PTR_ERR(salg);
+	alg = &salg->base;
 
+	/* The underlying hash algorithm must be unkeyed */
 	err = -EINVAL;
+	if (crypto_shash_alg_has_setkey(salg))
+		goto out_put_alg;
+
 	ds = salg->digestsize;
 	ss = salg->statesize;
-	alg = &salg->base;
 	if (ds > alg->cra_blocksize ||
 	    ss < alg->cra_blocksize)
 		goto out_put_alg;
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/crypto/salsa20_generic.c linux-libre-3.2.97-gnu1/crypto/salsa20_generic.c
--- linux-libre-3.2.96-gnu1/crypto/salsa20_generic.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/crypto/salsa20_generic.c	2018-01-01 15:51:06.000000000 -0500
@@ -188,13 +188,6 @@ static int encrypt(struct blkcipher_desc
 
 	salsa20_ivsetup(ctx, walk.iv);
 
-	if (likely(walk.nbytes == nbytes))
-	{
-		salsa20_encrypt_bytes(ctx, walk.dst.virt.addr,
-				      walk.src.virt.addr, nbytes);
-		return blkcipher_walk_done(desc, &walk, 0);
-	}
-
 	while (walk.nbytes >= 64) {
 		salsa20_encrypt_bytes(ctx, walk.dst.virt.addr,
 				      walk.src.virt.addr,
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/crypto/shash.c linux-libre-3.2.97-gnu1/crypto/shash.c
--- linux-libre-3.2.96-gnu1/crypto/shash.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/crypto/shash.c	2018-01-01 15:51:06.000000000 -0500
@@ -24,11 +24,12 @@
 
 static const struct crypto_type crypto_shash_type;
 
-static int shash_no_setkey(struct crypto_shash *tfm, const u8 *key,
-			   unsigned int keylen)
+int shash_no_setkey(struct crypto_shash *tfm, const u8 *key,
+		    unsigned int keylen)
 {
 	return -ENOSYS;
 }
+EXPORT_SYMBOL_GPL(shash_no_setkey);
 
 static int shash_setkey_unaligned(struct crypto_shash *tfm, const u8 *key,
 				  unsigned int keylen)
@@ -273,12 +274,14 @@ static int shash_async_finup(struct ahas
 
 int shash_ahash_digest(struct ahash_request *req, struct shash_desc *desc)
 {
-	struct scatterlist *sg = req->src;
-	unsigned int offset = sg->offset;
 	unsigned int nbytes = req->nbytes;
+	struct scatterlist *sg;
+	unsigned int offset;
 	int err;
 
-	if (nbytes < min(sg->length, ((unsigned int)(PAGE_SIZE)) - offset)) {
+	if (nbytes &&
+	    (sg = req->src, offset = sg->offset,
+	     nbytes < min(sg->length, ((unsigned int)(PAGE_SIZE)) - offset))) {
 		void *data;
 
 		data = crypto_kmap(sg_page(sg), 0);
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/drivers/crypto/talitos.c linux-libre-3.2.97-gnu1/drivers/crypto/talitos.c
--- linux-libre-3.2.96-gnu1/drivers/crypto/talitos.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/drivers/crypto/talitos.c	2018-01-01 15:51:06.000000000 -0500
@@ -1632,9 +1632,9 @@ static int common_nonsnoop_hash(struct t
 		req_ctx->swinit = 0;
 	} else {
 		desc->ptr[1] = zero_entry;
-		/* Indicate next op is not the first. */
-		req_ctx->first = 0;
 	}
+	/* Indicate next op is not the first. */
+	req_ctx->first = 0;
 
 	/* HMAC key */
 	if (ctx->keylen)
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/drivers/input/ff-core.c linux-libre-3.2.97-gnu1/drivers/input/ff-core.c
--- linux-libre-3.2.96-gnu1/drivers/input/ff-core.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/drivers/input/ff-core.c	2018-01-01 15:51:06.000000000 -0500
@@ -239,9 +239,15 @@ int input_ff_erase(struct input_dev *dev
 EXPORT_SYMBOL_GPL(input_ff_erase);
 
 /*
- * flush_effects - erase all effects owned by a file handle
+ * input_ff_flush - erase all effects owned by a file handle
+ * @dev: input device to erase effect from
+ * @file: purported owner of the effects
+ *
+ * This function erases all force-feedback effects associated with
+ * the given owner from specified device. Note that @file may be %NULL,
+ * in which case all effects will be erased.
  */
-static int flush_effects(struct input_dev *dev, struct file *file)
+int input_ff_flush(struct input_dev *dev, struct file *file)
 {
 	struct ff_device *ff = dev->ff;
 	int i;
@@ -257,6 +263,7 @@ static int flush_effects(struct input_de
 
 	return 0;
 }
+EXPORT_SYMBOL_GPL(input_ff_flush);
 
 /**
  * input_ff_event() - generic handler for force-feedback events
@@ -340,7 +347,7 @@ int input_ff_create(struct input_dev *de
 	mutex_init(&ff->mutex);
 
 	dev->ff = ff;
-	dev->flush = flush_effects;
+	dev->flush = input_ff_flush;
 	dev->event = input_ff_event;
 	__set_bit(EV_FF, dev->evbit);
 
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/drivers/input/misc/uinput.c linux-libre-3.2.97-gnu1/drivers/input/misc/uinput.c
--- linux-libre-3.2.96-gnu1/drivers/input/misc/uinput.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/drivers/input/misc/uinput.c	2018-01-01 15:51:06.000000000 -0500
@@ -218,6 +218,18 @@ static int uinput_dev_erase_effect(struc
 	return retval;
 }
 
+static int uinput_dev_flush(struct input_dev *dev, struct file *file)
+{
+	/*
+	 * If we are called with file == NULL that means we are tearing
+	 * down the device, and therefore we can not handle FF erase
+	 * requests: either we are handling UI_DEV_DESTROY (and holding
+	 * the udev->mutex), or the file descriptor is closed and there is
+	 * nobody on the other side anymore.
+	 */
+	return file ? input_ff_flush(dev, file) : 0;
+}
+
 static void uinput_destroy_device(struct uinput_device *udev)
 {
 	const char *name, *phys;
@@ -261,6 +273,12 @@ static int uinput_create_device(struct u
 		dev->ff->playback = uinput_dev_playback;
 		dev->ff->set_gain = uinput_dev_set_gain;
 		dev->ff->set_autocenter = uinput_dev_set_autocenter;
+		/*
+		 * The standard input_ff_flush() implementation does
+		 * not quite work for uinput as we can't reasonably
+		 * handle FF requests during device teardown.
+		 */
+		dev->flush = uinput_dev_flush;
 	}
 
 	error = input_register_device(udev->dev);
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/drivers/iommu/amd_iommu.c linux-libre-3.2.97-gnu1/drivers/iommu/amd_iommu.c
--- linux-libre-3.2.96-gnu1/drivers/iommu/amd_iommu.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/drivers/iommu/amd_iommu.c	2018-01-01 15:51:06.000000000 -0500
@@ -2772,6 +2772,7 @@ static int amd_iommu_unmap(struct iommu_
 	mutex_unlock(&domain->api_lock);
 
 	domain_flush_tlb_pde(domain);
+	domain_flush_complete(domain);
 
 	return get_order(unmap_size);
 }
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/drivers/net/can/usb/esd_usb2.c linux-libre-3.2.97-gnu1/drivers/net/can/usb/esd_usb2.c
--- linux-libre-3.2.96-gnu1/drivers/net/can/usb/esd_usb2.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/drivers/net/can/usb/esd_usb2.c	2018-01-01 15:51:06.000000000 -0500
@@ -332,7 +332,7 @@ static void esd_usb2_rx_can_msg(struct e
 		}
 
 		cf->can_id = id & ESD_IDMASK;
-		cf->can_dlc = get_can_dlc(msg->msg.rx.dlc);
+		cf->can_dlc = get_can_dlc(msg->msg.rx.dlc & ~ESD_RTR);
 
 		if (id & ESD_EXTID)
 			cf->can_id |= CAN_EFF_FLAG;
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/drivers/net/macvtap.c linux-libre-3.2.97-gnu1/drivers/net/macvtap.c
--- linux-libre-3.2.96-gnu1/drivers/net/macvtap.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/drivers/net/macvtap.c	2018-01-01 15:51:06.000000000 -0500
@@ -951,10 +951,12 @@ static long macvtap_ioctl(struct file *f
 		return 0;
 
 	case TUNSETSNDBUF:
-		if (get_user(u, up))
+		if (get_user(s, sp))
 			return -EFAULT;
+		if (s <= 0)
+			return -EINVAL;
 
-		q->sk.sk_sndbuf = u;
+		q->sk.sk_sndbuf = s;
 		return 0;
 
 	case TUNGETVNETHDRSZ:
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/drivers/net/tun.c linux-libre-3.2.97-gnu1/drivers/net/tun.c
--- linux-libre-3.2.96-gnu1/drivers/net/tun.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/drivers/net/tun.c	2018-01-01 15:51:06.000000000 -0500
@@ -1397,6 +1397,10 @@ static long __tun_chr_ioctl(struct file
 			ret = -EFAULT;
 			break;
 		}
+		if (sndbuf <= 0) {
+			ret = -EINVAL;
+			break;
+		}
 
 		tun->socket.sk->sk_sndbuf = sndbuf;
 		break;
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/drivers/s390/scsi/zfcp_aux.c linux-libre-3.2.97-gnu1/drivers/s390/scsi/zfcp_aux.c
--- linux-libre-3.2.96-gnu1/drivers/s390/scsi/zfcp_aux.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/drivers/s390/scsi/zfcp_aux.c	2018-01-01 15:51:06.000000000 -0500
@@ -366,6 +366,8 @@ struct zfcp_adapter *zfcp_adapter_enqueu
 	INIT_WORK(&adapter->scan_work, zfcp_fc_scan_ports);
 	INIT_WORK(&adapter->ns_up_work, zfcp_fc_sym_name_update);
 
+	adapter->erp_action.adapter = adapter;
+
 	if (zfcp_qdio_setup(adapter))
 		goto failed;
 
@@ -535,6 +537,9 @@ struct zfcp_port *zfcp_port_enqueue(stru
 	port->dev.parent = &adapter->ccw_device->dev;
 	port->dev.release = zfcp_port_release;
 
+	port->erp_action.adapter = adapter;
+	port->erp_action.port = port;
+
 	if (dev_set_name(&port->dev, "0x%016llx", (unsigned long long)wwpn)) {
 		kfree(port);
 		goto err_out;
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/drivers/s390/scsi/zfcp_erp.c linux-libre-3.2.97-gnu1/drivers/s390/scsi/zfcp_erp.c
--- linux-libre-3.2.96-gnu1/drivers/s390/scsi/zfcp_erp.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/drivers/s390/scsi/zfcp_erp.c	2018-01-01 15:51:06.000000000 -0500
@@ -193,9 +193,8 @@ static struct zfcp_erp_action *zfcp_erp_
 		atomic_set_mask(ZFCP_STATUS_COMMON_ERP_INUSE,
 				&zfcp_sdev->status);
 		erp_action = &zfcp_sdev->erp_action;
-		memset(erp_action, 0, sizeof(struct zfcp_erp_action));
-		erp_action->port = port;
-		erp_action->sdev = sdev;
+		WARN_ON_ONCE(erp_action->port != port);
+		WARN_ON_ONCE(erp_action->sdev != sdev);
 		if (!(atomic_read(&zfcp_sdev->status) &
 		      ZFCP_STATUS_COMMON_RUNNING))
 			act_status |= ZFCP_STATUS_ERP_CLOSE_ONLY;
@@ -208,8 +207,8 @@ static struct zfcp_erp_action *zfcp_erp_
 		zfcp_erp_action_dismiss_port(port);
 		atomic_set_mask(ZFCP_STATUS_COMMON_ERP_INUSE, &port->status);
 		erp_action = &port->erp_action;
-		memset(erp_action, 0, sizeof(struct zfcp_erp_action));
-		erp_action->port = port;
+		WARN_ON_ONCE(erp_action->port != port);
+		WARN_ON_ONCE(erp_action->sdev != NULL);
 		if (!(atomic_read(&port->status) & ZFCP_STATUS_COMMON_RUNNING))
 			act_status |= ZFCP_STATUS_ERP_CLOSE_ONLY;
 		break;
@@ -219,7 +218,8 @@ static struct zfcp_erp_action *zfcp_erp_
 		zfcp_erp_action_dismiss_adapter(adapter);
 		atomic_set_mask(ZFCP_STATUS_COMMON_ERP_INUSE, &adapter->status);
 		erp_action = &adapter->erp_action;
-		memset(erp_action, 0, sizeof(struct zfcp_erp_action));
+		WARN_ON_ONCE(erp_action->port != NULL);
+		WARN_ON_ONCE(erp_action->sdev != NULL);
 		if (!(atomic_read(&adapter->status) &
 		      ZFCP_STATUS_COMMON_RUNNING))
 			act_status |= ZFCP_STATUS_ERP_CLOSE_ONLY;
@@ -229,7 +229,11 @@ static struct zfcp_erp_action *zfcp_erp_
 		return NULL;
 	}
 
-	erp_action->adapter = adapter;
+	WARN_ON_ONCE(erp_action->adapter != adapter);
+	memset(&erp_action->list, 0, sizeof(erp_action->list));
+	memset(&erp_action->timer, 0, sizeof(erp_action->timer));
+	erp_action->step = ZFCP_ERP_STEP_UNINITIALIZED;
+	erp_action->fsf_req_id = 0;
 	erp_action->action = need;
 	erp_action->status = act_status;
 
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/drivers/s390/scsi/zfcp_scsi.c linux-libre-3.2.97-gnu1/drivers/s390/scsi/zfcp_scsi.c
--- linux-libre-3.2.96-gnu1/drivers/s390/scsi/zfcp_scsi.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/drivers/s390/scsi/zfcp_scsi.c	2018-01-01 15:51:06.000000000 -0500
@@ -136,10 +136,15 @@ static int zfcp_scsi_slave_alloc(struct
 	struct zfcp_unit *unit;
 	int npiv = adapter->connection_features & FSF_FEATURE_NPIV_MODE;
 
+	zfcp_sdev->erp_action.adapter = adapter;
+	zfcp_sdev->erp_action.sdev = sdev;
+
 	port = zfcp_get_port_by_wwpn(adapter, rport->port_name);
 	if (!port)
 		return -ENXIO;
 
+	zfcp_sdev->erp_action.port = port;
+
 	unit = zfcp_unit_find(port, zfcp_scsi_dev_lun(sdev));
 	if (unit)
 		put_device(&unit->dev);
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/drivers/scsi/libiscsi.c linux-libre-3.2.97-gnu1/drivers/scsi/libiscsi.c
--- linux-libre-3.2.96-gnu1/drivers/scsi/libiscsi.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/drivers/scsi/libiscsi.c	2018-01-01 15:51:06.000000000 -0500
@@ -1660,7 +1660,7 @@ int iscsi_queuecommand(struct Scsi_Host
 
 	if (test_bit(ISCSI_SUSPEND_BIT, &conn->suspend_tx)) {
 		reason = FAILURE_SESSION_IN_RECOVERY;
-		sc->result = DID_REQUEUE;
+		sc->result = DID_REQUEUE << 16;
 		goto fault;
 	}
 
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/drivers/scsi/lpfc/lpfc_init.c linux-libre-3.2.97-gnu1/drivers/scsi/lpfc/lpfc_init.c
--- linux-libre-3.2.96-gnu1/drivers/scsi/lpfc/lpfc_init.c	2017-11-26 13:31:39.000000000 -0500
+++ linux-libre-3.2.97-gnu1/drivers/scsi/lpfc/lpfc_init.c	2018-01-02 11:22:34.000000000 -0500
@@ -4490,6 +4490,7 @@ lpfc_sli4_driver_resource_setup(struct l
 			lpfc_printf_log(phba, KERN_ERR, LOG_INIT,
 				"2999 Unsupported SLI4 Parameters "
 				"Extents and RPI headers enabled.\n");
+			rc = -EIO;
 			goto out_free_bsmbx;
 		}
 	}
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/drivers/scsi/scsi_scan.c linux-libre-3.2.97-gnu1/drivers/scsi/scsi_scan.c
--- linux-libre-3.2.96-gnu1/drivers/scsi/scsi_scan.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/drivers/scsi/scsi_scan.c	2018-01-01 15:51:06.000000000 -0500
@@ -957,6 +957,9 @@ static int scsi_add_lun(struct scsi_devi
 	if (*bflags & BLIST_RETRY_HWERROR)
 		sdev->retry_hwerror = 1;
 
+	if (*bflags & BLIST_UNMAP_LIMIT_WS)
+		sdev->unmap_limit_for_ws = 1;
+
 	transport_configure_device(&sdev->sdev_gendev);
 
 	if (sdev->host->hostt->slave_configure) {
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/drivers/scsi/sd.c linux-libre-3.2.97-gnu1/drivers/scsi/sd.c
--- linux-libre-3.2.96-gnu1/drivers/scsi/sd.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/drivers/scsi/sd.c	2018-01-01 15:51:06.000000000 -0500
@@ -523,11 +523,21 @@ static void sd_config_discard(struct scs
 		break;
 
 	case SD_LBP_WS16:
-		max_blocks = min_not_zero(sdkp->max_ws_blocks, 0xffffffff);
+		if (sdkp->device->unmap_limit_for_ws)
+			max_blocks = sdkp->max_unmap_blocks;
+		else
+			max_blocks = sdkp->max_ws_blocks;
+
+		max_blocks = min_not_zero(max_blocks, 0xffffffff);
 		break;
 
 	case SD_LBP_WS10:
-		max_blocks = min_not_zero(sdkp->max_ws_blocks, (u32)0xffff);
+		if (sdkp->device->unmap_limit_for_ws)
+			max_blocks = sdkp->max_unmap_blocks;
+		else
+			max_blocks = sdkp->max_ws_blocks;
+
+		max_blocks = min_not_zero(max_blocks, (u32)0xffff);
 		break;
 
 	case SD_LBP_ZERO:
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/drivers/staging/iio/meter/ade7759.c linux-libre-3.2.97-gnu1/drivers/staging/iio/meter/ade7759.c
--- linux-libre-3.2.96-gnu1/drivers/staging/iio/meter/ade7759.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/drivers/staging/iio/meter/ade7759.c	2018-01-01 15:51:06.000000000 -0500
@@ -128,7 +128,7 @@ static int ade7759_spi_read_reg_40(struc
 				reg_address);
 		goto error_ret;
 	}
-	*val = ((u64)st->rx[1] << 32) | (st->rx[2] << 24) |
+	*val = ((u64)st->rx[1] << 32) | ((u64)st->rx[2] << 24) |
 		(st->rx[3] << 16) | (st->rx[4] << 8) | st->rx[5];
 
 error_ret:
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/drivers/usb/class/cdc-acm.c linux-libre-3.2.97-gnu1/drivers/usb/class/cdc-acm.c
--- linux-libre-3.2.96-gnu1/drivers/usb/class/cdc-acm.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/drivers/usb/class/cdc-acm.c	2018-01-01 15:51:06.000000000 -0500
@@ -1595,6 +1595,9 @@ static const struct usb_device_id acm_id
 	{ USB_DEVICE(0xfff0, 0x0100), /* DATECS FP-2000 */
 	.driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */
 	},
+	{ USB_DEVICE(0x09d8, 0x0320), /* Elatec GmbH TWN3 */
+	.driver_info = NO_UNION_NORMAL, /* has misplaced union descriptor */
+	},
 
 	{ USB_DEVICE(0x2912, 0x0001), /* ATOL FPrint */
 	.driver_info = CLEAR_HALT_CONDITIONS,
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/drivers/usb/core/config.c linux-libre-3.2.97-gnu1/drivers/usb/core/config.c
--- linux-libre-3.2.96-gnu1/drivers/usb/core/config.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/drivers/usb/core/config.c	2018-01-01 15:51:06.000000000 -0500
@@ -521,6 +521,9 @@ static int usb_parse_configuration(struc
 	unsigned iad_num = 0;
 
 	memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE);
+	nintf = nintf_orig = config->desc.bNumInterfaces;
+	config->desc.bNumInterfaces = 0;	// Adjusted later
+
 	if (config->desc.bDescriptorType != USB_DT_CONFIG ||
 	    config->desc.bLength < USB_DT_CONFIG_SIZE ||
 	    config->desc.bLength > size) {
@@ -534,7 +537,6 @@ static int usb_parse_configuration(struc
 	buffer += config->desc.bLength;
 	size -= config->desc.bLength;
 
-	nintf = nintf_orig = config->desc.bNumInterfaces;
 	if (nintf > USB_MAXINTERFACES) {
 		dev_warn(ddev, "config %d has too many interfaces: %d, "
 		    "using maximum allowed: %d\n",
@@ -830,7 +832,7 @@ int usb_get_configuration(struct usb_dev
 		}
 
 		if (dev->quirks & USB_QUIRK_DELAY_INIT)
-			msleep(100);
+			msleep(200);
 
 		result = usb_get_descriptor(dev, USB_DT_CONFIG, cfgno,
 		    bigbuffer, length);
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/drivers/usb/core/hub.c linux-libre-3.2.97-gnu1/drivers/usb/core/hub.c
--- linux-libre-3.2.96-gnu1/drivers/usb/core/hub.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/drivers/usb/core/hub.c	2018-01-01 15:51:06.000000000 -0500
@@ -3552,7 +3552,7 @@ static void hub_port_connect_change(stru
 
 		usb_detect_quirks(udev);
 		if (udev->quirks & USB_QUIRK_DELAY_INIT)
-			msleep(1000);
+			msleep(2000);
 
 		/* consecutive bus-powered hubs aren't reliable; they can
 		 * violate the voltage drop budget.  if the new child has
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/drivers/usb/core/quirks.c linux-libre-3.2.97-gnu1/drivers/usb/core/quirks.c
--- linux-libre-3.2.96-gnu1/drivers/usb/core/quirks.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/drivers/usb/core/quirks.c	2018-01-01 15:51:06.000000000 -0500
@@ -205,6 +205,10 @@ static const struct usb_device_id usb_qu
 	/* Corsair Strafe RGB */
 	{ USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT },
 
+	/* MIDI keyboard WORLDE MINI */
+	{ USB_DEVICE(0x1c75, 0x0204), .driver_info =
+			USB_QUIRK_CONFIG_INTF_STRINGS },
+
 	{ }  /* terminating entry must be last */
 };
 
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/drivers/usb/gadget/dummy_hcd.c linux-libre-3.2.97-gnu1/drivers/usb/gadget/dummy_hcd.c
--- linux-libre-3.2.96-gnu1/drivers/usb/gadget/dummy_hcd.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/drivers/usb/gadget/dummy_hcd.c	2018-01-01 15:51:06.000000000 -0500
@@ -167,6 +167,7 @@ struct dummy_hcd {
 
 	struct usb_device		*udev;
 	struct list_head		urbp_list;
+	struct urbp			*next_frame_urbp;
 
 	unsigned			active:1;
 	unsigned			old_active:1;
@@ -181,11 +182,13 @@ struct dummy {
 	 */
 	struct dummy_ep			ep [DUMMY_ENDPOINTS];
 	int				address;
+	int				callback_usage;
 	struct usb_gadget		gadget;
 	struct usb_gadget_driver	*driver;
 	struct dummy_request		fifo_req;
 	u8				fifo_buf [FIFO_SIZE];
 	u16				devstatus;
+	unsigned			ints_enabled:1;
 	unsigned			udc_suspended:1;
 	unsigned			pullup:1;
 
@@ -347,6 +350,7 @@ static void set_link_state_by_speed(stru
 static void set_link_state(struct dummy_hcd *dum_hcd)
 {
 	struct dummy *dum = dum_hcd->dum;
+	unsigned int power_bit;
 
 	dum_hcd->active = 0;
 	if (dum->pullup)
@@ -357,36 +361,40 @@ static void set_link_state(struct dummy_
 			return;
 
 	set_link_state_by_speed(dum_hcd);
+	power_bit = (dummy_hcd_to_hcd(dum_hcd)->speed == HCD_USB3 ?
+			USB_SS_PORT_STAT_POWER : USB_PORT_STAT_POWER);
 
 	if ((dum_hcd->port_status & USB_PORT_STAT_ENABLE) == 0 ||
 	     dum_hcd->active)
 		dum_hcd->resuming = 0;
 
 	/* if !connected or reset */
-	if ((dum_hcd->port_status & USB_PORT_STAT_CONNECTION) == 0 ||
+	if ((dum_hcd->port_status & power_bit) == 0 ||
 			(dum_hcd->port_status & USB_PORT_STAT_RESET) != 0) {
 		/*
 		 * We're connected and not reset (reset occurred now),
 		 * and driver attached - disconnect!
 		 */
-		if ((dum_hcd->old_status & USB_PORT_STAT_CONNECTION) != 0 &&
+		if ((dum_hcd->old_status & power_bit) != 0 &&
 		    (dum_hcd->old_status & USB_PORT_STAT_RESET) == 0 &&
-		    dum->driver) {
+		    dum->ints_enabled) {
 			stop_activity(dum);
+			++dum->callback_usage;
 			spin_unlock(&dum->lock);
 			dum->driver->disconnect(&dum->gadget);
 			spin_lock(&dum->lock);
+			--dum->callback_usage;
 		}
-	} else if (dum_hcd->active != dum_hcd->old_active) {
-		if (dum_hcd->old_active && dum->driver->suspend) {
-			spin_unlock(&dum->lock);
+	} else if (dum_hcd->active != dum_hcd->old_active &&
+			dum->ints_enabled) {
+		++dum->callback_usage;
+		spin_unlock(&dum->lock);
+		if (dum_hcd->old_active && dum->driver->suspend)
 			dum->driver->suspend(&dum->gadget);
-			spin_lock(&dum->lock);
-		} else if (!dum_hcd->old_active &&  dum->driver->resume) {
-			spin_unlock(&dum->lock);
+		else if (!dum_hcd->old_active &&  dum->driver->resume)
 			dum->driver->resume(&dum->gadget);
-			spin_lock(&dum->lock);
-		}
+		spin_lock(&dum->lock);
+		--dum->callback_usage;
 	}
 
 	dum_hcd->old_status = dum_hcd->port_status;
@@ -907,9 +915,12 @@ static int dummy_udc_start(struct usb_ga
 	 * can't enumerate without help from the driver we're binding.
 	 */
 
+	spin_lock_irq(&dum->lock);
 	dum->devstatus = 0;
 
 	dum->driver = driver;
+	dum->ints_enabled = 1;
+	spin_unlock_irq(&dum->lock);
 	dev_dbg (udc_dev(dum), "binding gadget driver '%s'\n",
 			driver->driver.name);
 	return 0;
@@ -924,7 +935,19 @@ static int dummy_udc_stop(struct usb_gad
 	dev_dbg (udc_dev(dum), "unregister gadget driver '%s'\n",
 			driver->driver.name);
 
+	spin_lock_irq(&dum->lock);
+	dum->ints_enabled = 0;
+	stop_activity(dum);
+
+	/* emulate synchronize_irq(): wait for callbacks to finish */
+	while (dum->callback_usage > 0) {
+		spin_unlock_irq(&dum->lock);
+		usleep_range(1000, 2000);
+		spin_lock_irq(&dum->lock);
+	}
+
 	dum->driver = NULL;
+	spin_unlock_irq(&dum->lock);
 
 	return 0;
 }
@@ -1108,6 +1131,8 @@ static int dummy_urb_enqueue (
 
 	list_add_tail(&urbp->urbp_list, &dum_hcd->urbp_list);
 	urb->hcpriv = urbp;
+	if (!dum_hcd->next_frame_urbp)
+		dum_hcd->next_frame_urbp = urbp;
 	if (usb_pipetype (urb->pipe) == PIPE_CONTROL)
 		urb->error_count = 1;		/* mark as a new urb */
 
@@ -1303,6 +1328,8 @@ static struct dummy_ep *find_endpoint (s
 	if (!is_active((dum->gadget.speed == USB_SPEED_SUPER ?
 			dum->ss_hcd : dum->hs_hcd)))
 		return NULL;
+	if (!dum->ints_enabled)
+		return NULL;
 	if ((address & ~USB_DIR_IN) == 0)
 		return &dum->ep [0];
 	for (i = 1; i < DUMMY_ENDPOINTS; i++) {
@@ -1544,6 +1571,7 @@ static void dummy_timer(unsigned long _d
 		spin_unlock_irqrestore (&dum->lock, flags);
 		return;
 	}
+	dum_hcd->next_frame_urbp = NULL;
 
 	for (i = 0; i < DUMMY_ENDPOINTS; i++) {
 		if (!ep_name [i])
@@ -1560,6 +1588,10 @@ restart:
 		int			type;
 		int			status = -EINPROGRESS;
 
+		/* stop when we reach URBs queued after the timer interrupt */
+		if (urbp == dum_hcd->next_frame_urbp)
+			break;
+
 		urb = urbp->urb;
 		if (urb->unlinked)
 			goto return_urb;
@@ -1639,10 +1671,12 @@ restart:
 			 * until setup() returns; no reentrancy issues etc.
 			 */
 			if (value > 0) {
+				++dum->callback_usage;
 				spin_unlock (&dum->lock);
 				value = dum->driver->setup (&dum->gadget,
 						&setup);
 				spin_lock (&dum->lock);
+				--dum->callback_usage;
 
 				if (value >= 0) {
 					/* no delays (max 64KB data stage) */
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/drivers/usb/gadget/inode.c linux-libre-3.2.97-gnu1/drivers/usb/gadget/inode.c
--- linux-libre-3.2.96-gnu1/drivers/usb/gadget/inode.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/drivers/usb/gadget/inode.c	2018-01-01 15:51:06.000000000 -0500
@@ -24,7 +24,7 @@
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/poll.h>
-
+#include <linux/delay.h>
 #include <linux/device.h>
 #include <linux/moduleparam.h>
 
@@ -112,6 +112,7 @@ enum ep0_state {
 struct dev_data {
 	spinlock_t			lock;
 	atomic_t			count;
+	int				udc_usage;
 	enum ep0_state			state;		/* P: lock */
 	struct usb_gadgetfs_event	event [N_EVENT];
 	unsigned			ev_next;
@@ -608,9 +609,9 @@ static void ep_aio_complete(struct usb_e
 		priv->actual = req->actual;
 		kick_iocb(iocb);
 	}
-	spin_unlock(&epdata->dev->lock);
 
 	usb_ep_free_request(ep, req);
+	spin_unlock(&epdata->dev->lock);
 	put_ep(epdata);
 }
 
@@ -1009,8 +1010,13 @@ ep0_read (struct file *fd, char __user *
 			struct usb_ep		*ep = dev->gadget->ep0;
 			struct usb_request	*req = dev->req;
 
-			if ((retval = setup_req (ep, req, 0)) == 0)
-				retval = usb_ep_queue (ep, req, GFP_ATOMIC);
+			if ((retval = setup_req (ep, req, 0)) == 0) {
+				++dev->udc_usage;
+				spin_unlock_irq (&dev->lock);
+				retval = usb_ep_queue (ep, req, GFP_KERNEL);
+				spin_lock_irq (&dev->lock);
+				--dev->udc_usage;
+			}
 			dev->state = STATE_DEV_CONNECTED;
 
 			/* assume that was SET_CONFIGURATION */
@@ -1051,11 +1057,14 @@ ep0_read (struct file *fd, char __user *
 				retval = -EIO;
 			else {
 				len = min (len, (size_t)dev->req->actual);
-// FIXME don't call this with the spinlock held ...
+				++dev->udc_usage;
+				spin_unlock_irq(&dev->lock);
 				if (copy_to_user (buf, dev->req->buf, len))
 					retval = -EFAULT;
 				else
 					retval = len;
+				spin_lock_irq(&dev->lock);
+				--dev->udc_usage;
 				clean_req (dev->gadget->ep0, dev->req);
 				/* NOTE userspace can't yet choose to stall */
 			}
@@ -1201,6 +1210,7 @@ ep0_write (struct file *fd, const char _
 			retval = setup_req (dev->gadget->ep0, dev->req, len);
 			if (retval == 0) {
 				dev->state = STATE_DEV_CONNECTED;
+				++dev->udc_usage;
 				spin_unlock_irq (&dev->lock);
 				if (copy_from_user (dev->req->buf, buf, len))
 					retval = -EFAULT;
@@ -1211,12 +1221,13 @@ ep0_write (struct file *fd, const char _
 						dev->gadget->ep0, dev->req,
 						GFP_KERNEL);
 				}
+				spin_lock_irq(&dev->lock);
+				--dev->udc_usage;
 				if (retval < 0) {
-					spin_lock_irq (&dev->lock);
 					clean_req (dev->gadget->ep0, dev->req);
-					spin_unlock_irq (&dev->lock);
 				} else
 					retval = len;
+				spin_unlock_irq(&dev->lock);
 
 				return retval;
 			}
@@ -1308,9 +1319,21 @@ static long dev_ioctl (struct file *fd,
 	struct usb_gadget	*gadget = dev->gadget;
 	long ret = -ENOTTY;
 
-	if (gadget->ops->ioctl)
+	spin_lock_irq(&dev->lock);
+	if (dev->state == STATE_DEV_OPENED ||
+			dev->state == STATE_DEV_UNBOUND) {
+		/* Not bound to a UDC */
+	} else if (gadget->ops->ioctl) {
+		++dev->udc_usage;
+		spin_unlock_irq(&dev->lock);
+
 		ret = gadget->ops->ioctl (gadget, code, value);
 
+		spin_lock_irq(&dev->lock);
+		--dev->udc_usage;
+	}
+	spin_unlock_irq(&dev->lock);
+
 	return ret;
 }
 
@@ -1544,8 +1567,13 @@ delegate:
 							w_length);
 				if (value < 0)
 					break;
+
+				++dev->udc_usage;
+				spin_unlock (&dev->lock);
 				value = usb_ep_queue (gadget->ep0, dev->req,
-							GFP_ATOMIC);
+							GFP_KERNEL);
+				spin_lock (&dev->lock);
+				--dev->udc_usage;
 				if (value < 0) {
 					clean_req (gadget->ep0, dev->req);
 					break;
@@ -1568,11 +1596,18 @@ delegate:
 	if (value >= 0 && dev->state != STATE_DEV_SETUP) {
 		req->length = value;
 		req->zero = value < w_length;
-		value = usb_ep_queue (gadget->ep0, req, GFP_ATOMIC);
+
+		++dev->udc_usage;
+		spin_unlock (&dev->lock);
+		value = usb_ep_queue (gadget->ep0, req, GFP_KERNEL);
+		spin_lock(&dev->lock);
+		--dev->udc_usage;
+		spin_unlock(&dev->lock);
 		if (value < 0) {
 			DBG (dev, "ep_queue --> %d\n", value);
 			req->status = 0;
 		}
+		return value;
 	}
 
 	/* device stalls when value < 0 */
@@ -1597,21 +1632,24 @@ restart:
 		/* break link to FS */
 		ep = list_entry (entry, struct ep_data, epfiles);
 		list_del_init (&ep->epfiles);
+		spin_unlock_irq (&dev->lock);
+
 		dentry = ep->dentry;
 		ep->dentry = NULL;
 		parent = dentry->d_parent->d_inode;
 
 		/* break link to controller */
+		mutex_lock(&ep->lock);
 		if (ep->state == STATE_EP_ENABLED)
 			(void) usb_ep_disable (ep->ep);
 		ep->state = STATE_EP_UNBOUND;
 		usb_ep_free_request (ep->ep, ep->req);
 		ep->ep = NULL;
+		mutex_unlock(&ep->lock);
+
 		wake_up (&ep->wait);
 		put_ep (ep);
 
-		spin_unlock_irq (&dev->lock);
-
 		/* break link to dcache */
 		mutex_lock (&parent->i_mutex);
 		d_delete (dentry);
@@ -1685,6 +1723,11 @@ gadgetfs_unbind (struct usb_gadget *gadg
 
 	spin_lock_irq (&dev->lock);
 	dev->state = STATE_DEV_UNBOUND;
+	while (dev->udc_usage > 0) {
+		spin_unlock_irq(&dev->lock);
+		usleep_range(1000, 2000);
+		spin_lock_irq(&dev->lock);
+	}
 	spin_unlock_irq (&dev->lock);
 
 	destroy_ep_files (dev);
@@ -1761,9 +1804,10 @@ static void
 gadgetfs_suspend (struct usb_gadget *gadget)
 {
 	struct dev_data		*dev = get_gadget_data (gadget);
+	unsigned long		flags;
 
 	INFO (dev, "suspended from state %d\n", dev->state);
-	spin_lock (&dev->lock);
+	spin_lock_irqsave(&dev->lock, flags);
 	switch (dev->state) {
 	case STATE_DEV_SETUP:		// VERY odd... host died??
 	case STATE_DEV_CONNECTED:
@@ -1774,7 +1818,7 @@ gadgetfs_suspend (struct usb_gadget *gad
 	default:
 		break;
 	}
-	spin_unlock (&dev->lock);
+	spin_unlock_irqrestore(&dev->lock, flags);
 }
 
 static struct usb_gadget_driver gadgetfs_driver = {
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/drivers/usb/host/pci-quirks.c linux-libre-3.2.97-gnu1/drivers/usb/host/pci-quirks.c
--- linux-libre-3.2.96-gnu1/drivers/usb/host/pci-quirks.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/drivers/usb/host/pci-quirks.c	2018-01-01 15:51:06.000000000 -0500
@@ -866,7 +866,7 @@ EXPORT_SYMBOL_GPL(usb_disable_xhci_ports
  *
  * Takes care of the handoff between the Pre-OS (i.e. BIOS) and the OS.
  * It signals to the BIOS that the OS wants control of the host controller,
- * and then waits 5 seconds for the BIOS to hand over control.
+ * and then waits 1 second for the BIOS to hand over control.
  * If we timeout, assume the BIOS is broken and take control anyway.
  */
 static void __devinit quirk_usb_handoff_xhci(struct pci_dev *pdev)
@@ -912,9 +912,9 @@ static void __devinit quirk_usb_handoff_
 	if (val & XHCI_HC_BIOS_OWNED) {
 		writel(val | XHCI_HC_OS_OWNED, base + ext_cap_offset);
 
-		/* Wait for 5 seconds with 10 microsecond polling interval */
+		/* Wait for 1 second with 10 microsecond polling interval */
 		timeout = handshake(base + ext_cap_offset, XHCI_HC_BIOS_OWNED,
-				0, 5000, 10);
+				0, 1000000, 10);
 
 		/* Assume a buggy BIOS and take HC ownership anyway */
 		if (timeout) {
@@ -942,7 +942,7 @@ hc_init:
 	 * operational or runtime registers.  Wait 5 seconds and no more.
 	 */
 	timeout = handshake(op_reg_base + XHCI_STS_OFFSET, XHCI_STS_CNR, 0,
-			5000, 10);
+			5000000, 10);
 	/* Assume a buggy HC and start HC initialization anyway */
 	if (timeout) {
 		val = readl(op_reg_base + XHCI_STS_OFFSET);
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/drivers/usb/host/xhci.h linux-libre-3.2.97-gnu1/drivers/usb/host/xhci.h
--- linux-libre-3.2.96-gnu1/drivers/usb/host/xhci.h	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/drivers/usb/host/xhci.h	2018-01-01 15:51:06.000000000 -0500
@@ -1375,7 +1375,7 @@ struct xhci_bus_state {
 
 static inline unsigned int hcd_index(struct usb_hcd *hcd)
 {
-	if (hcd->speed == HCD_USB3)
+	if (hcd->speed >= HCD_USB3)
 		return 0;
 	else
 		return 1;
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/drivers/usb/renesas_usbhs/fifo.c linux-libre-3.2.97-gnu1/drivers/usb/renesas_usbhs/fifo.c
--- linux-libre-3.2.96-gnu1/drivers/usb/renesas_usbhs/fifo.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/drivers/usb/renesas_usbhs/fifo.c	2018-01-01 15:51:06.000000000 -0500
@@ -261,11 +261,26 @@ static void usbhsf_fifo_clear(struct usb
 			      struct usbhs_fifo *fifo)
 {
 	struct usbhs_priv *priv = usbhs_pipe_to_priv(pipe);
+	int ret = 0;
 
-	if (!usbhs_pipe_is_dcp(pipe))
-		usbhsf_fifo_barrier(priv, fifo);
+	if (!usbhs_pipe_is_dcp(pipe)) {
+		/*
+		 * This driver checks the pipe condition first to avoid -EBUSY
+		 * from usbhsf_fifo_barrier() with about 10 msec delay in
+		 * the interrupt handler if the pipe is RX direction and empty.
+		 */
+		if (usbhs_pipe_is_dir_in(pipe))
+			ret = usbhs_pipe_is_accessible(pipe);
+		if (!ret)
+			ret = usbhsf_fifo_barrier(priv, fifo);
+	}
 
-	usbhs_write(priv, fifo->ctr, BCLR);
+	/*
+	 * if non-DCP pipe, this driver should set BCLR when
+	 * usbhsf_fifo_barrier() returns 0.
+	 */
+	if (!ret)
+		usbhs_write(priv, fifo->ctr, BCLR);
 }
 
 static int usbhsf_fifo_rcv_len(struct usbhs_priv *priv,
@@ -802,8 +817,8 @@ static void usbhsf_dma_prepare_tasklet(u
 	dev_dbg(dev, "  %s %d (%d/ %d)\n",
 		fifo->name, usbhs_pipe_number(pipe), pkt->length, pkt->zero);
 
-	usbhsf_dma_start(pipe, fifo);
 	dma_async_issue_pending(chan);
+	usbhsf_dma_start(pipe, fifo);
 
 xfer_work_end:
 	usbhs_unlock(priv, flags);
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/drivers/usb/serial/cp210x.c linux-libre-3.2.97-gnu1/drivers/usb/serial/cp210x.c
--- linux-libre-3.2.96-gnu1/drivers/usb/serial/cp210x.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/drivers/usb/serial/cp210x.c	2018-01-01 15:51:06.000000000 -0500
@@ -176,6 +176,7 @@ static const struct usb_device_id id_tab
 	{ USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
 	{ USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
 	{ USB_DEVICE(0x18EF, 0xE025) }, /* ELV Marble Sound Board 1 */
+	{ USB_DEVICE(0x18EF, 0xE032) }, /* ELV TFD500 Data Logger */
 	{ USB_DEVICE(0x1901, 0x0190) }, /* GE B850 CP2105 Recorder interface */
 	{ USB_DEVICE(0x1901, 0x0193) }, /* GE B650 CP2104 PMC interface */
 	{ USB_DEVICE(0x1901, 0x0194) },	/* GE Healthcare Remote Alarm Box */
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/drivers/usb/serial/ftdi_sio.c linux-libre-3.2.97-gnu1/drivers/usb/serial/ftdi_sio.c
--- linux-libre-3.2.96-gnu1/drivers/usb/serial/ftdi_sio.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/drivers/usb/serial/ftdi_sio.c	2018-01-01 15:51:06.000000000 -0500
@@ -1035,6 +1035,8 @@ static struct usb_device_id id_table_com
 	{ USB_DEVICE(WICED_VID, WICED_USB20706V2_PID) },
 	{ USB_DEVICE(TI_VID, TI_CC3200_LAUNCHPAD_PID),
 		.driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
+	{ USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_BT_USB_PID) },
+	{ USB_DEVICE(CYPRESS_VID, CYPRESS_WICED_WL_USB_PID) },
 	{ },					/* Optional parameter entry */
 	{ }					/* Terminating entry */
 };
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/drivers/usb/serial/ftdi_sio_ids.h linux-libre-3.2.97-gnu1/drivers/usb/serial/ftdi_sio_ids.h
--- linux-libre-3.2.96-gnu1/drivers/usb/serial/ftdi_sio_ids.h	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/drivers/usb/serial/ftdi_sio_ids.h	2018-01-01 15:51:06.000000000 -0500
@@ -610,6 +610,13 @@
 #define ADI_GNICEPLUS_PID	0xF001
 
 /*
+ * Cypress WICED USB UART
+ */
+#define CYPRESS_VID			0x04B4
+#define CYPRESS_WICED_BT_USB_PID	0x009B
+#define CYPRESS_WICED_WL_USB_PID	0xF900
+
+/*
  * Microchip Technology, Inc.
  *
  * MICROCHIP_VID (0x04D8) and MICROCHIP_USB_BOARD_PID (0x000A) are
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/drivers/usb/serial/option.c linux-libre-3.2.97-gnu1/drivers/usb/serial/option.c
--- linux-libre-3.2.96-gnu1/drivers/usb/serial/option.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/drivers/usb/serial/option.c	2018-01-01 15:51:06.000000000 -0500
@@ -508,6 +508,7 @@ static void option_instat_callback(struc
 
 /* TP-LINK Incorporated products */
 #define TPLINK_VENDOR_ID			0x2357
+#define TPLINK_PRODUCT_LTE			0x000D
 #define TPLINK_PRODUCT_MA180			0x0201
 
 /* Changhong products */
@@ -1959,6 +1960,7 @@ static const struct usb_device_id option
 	{ USB_DEVICE(CELLIENT_VENDOR_ID, CELLIENT_PRODUCT_MEN200) },
 	{ USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600A) },
 	{ USB_DEVICE(PETATEL_VENDOR_ID, PETATEL_PRODUCT_NP10T_600E) },
+	{ USB_DEVICE_AND_INTERFACE_INFO(TPLINK_VENDOR_ID, TPLINK_PRODUCT_LTE, 0xff, 0x00, 0x00) },	/* TP-Link LTE Module */
 	{ USB_DEVICE(TPLINK_VENDOR_ID, TPLINK_PRODUCT_MA180),
 	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
 	{ USB_DEVICE(TPLINK_VENDOR_ID, 0x9000),					/* TP-Link MA260 */
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/drivers/usb/storage/unusual_devs.h linux-libre-3.2.97-gnu1/drivers/usb/storage/unusual_devs.h
--- linux-libre-3.2.96-gnu1/drivers/usb/storage/unusual_devs.h	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/drivers/usb/storage/unusual_devs.h	2018-01-01 15:51:06.000000000 -0500
@@ -1346,6 +1346,13 @@ UNUSUAL_DEV( 0x0bc2, 0x3010, 0x0000, 0x0
 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
 		US_FL_SANE_SENSE ),
 
+/* Reported by Kris Lindgren <kris.lindgren@gmail.com> */
+UNUSUAL_DEV( 0x0bc2, 0x3332, 0x0000, 0x9999,
+		"Seagate",
+		"External",
+		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+		US_FL_NO_WP_DETECT ),
+
 UNUSUAL_DEV(  0x0d49, 0x7310, 0x0000, 0x9999,
 		"Maxtor",
 		"USB to SATA",
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/drivers/uwb/hwa-rc.c linux-libre-3.2.97-gnu1/drivers/uwb/hwa-rc.c
--- linux-libre-3.2.96-gnu1/drivers/uwb/hwa-rc.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/drivers/uwb/hwa-rc.c	2018-01-01 15:51:06.000000000 -0500
@@ -813,6 +813,8 @@ static int hwarc_probe(struct usb_interf
 
 	if (iface->cur_altsetting->desc.bNumEndpoints < 1)
 		return -ENODEV;
+	if (!usb_endpoint_xfer_int(&iface->cur_altsetting->endpoint[0].desc))
+		return -ENODEV;
 
 	result = -ENOMEM;
 	uwb_rc = uwb_rc_alloc();
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/drivers/uwb/uwbd.c linux-libre-3.2.97-gnu1/drivers/uwb/uwbd.c
--- linux-libre-3.2.96-gnu1/drivers/uwb/uwbd.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/drivers/uwb/uwbd.c	2018-01-01 15:51:06.000000000 -0500
@@ -303,18 +303,22 @@ static int uwbd(void *param)
 /** Start the UWB daemon */
 void uwbd_start(struct uwb_rc *rc)
 {
-	rc->uwbd.task = kthread_run(uwbd, rc, "uwbd");
-	if (rc->uwbd.task == NULL)
+	struct task_struct *task = kthread_run(uwbd, rc, "uwbd");
+	if (IS_ERR(task)) {
+		rc->uwbd.task = NULL;
 		printk(KERN_ERR "UWB: Cannot start management daemon; "
 		       "UWB won't work\n");
-	else
+	} else {
+		rc->uwbd.task = task;
 		rc->uwbd.pid = rc->uwbd.task->pid;
+	}
 }
 
 /* Stop the UWB daemon and free any unprocessed events */
 void uwbd_stop(struct uwb_rc *rc)
 {
-	kthread_stop(rc->uwbd.task);
+	if (rc->uwbd.task)
+		kthread_stop(rc->uwbd.task);
 	uwbd_flush(rc);
 }
 
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/fs/bio.c linux-libre-3.2.97-gnu1/fs/bio.c
--- linux-libre-3.2.96-gnu1/fs/bio.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/fs/bio.c	2018-01-01 15:51:06.000000000 -0500
@@ -976,6 +976,7 @@ static struct bio *__bio_map_user_iov(st
 	struct bio *bio;
 	int cur_page = 0;
 	int ret, offset;
+	struct bio_vec *bvec;
 
 	for (i = 0; i < iov_count; i++) {
 		unsigned long uaddr = (unsigned long)iov[i].iov_base;
@@ -1019,7 +1020,12 @@ static struct bio *__bio_map_user_iov(st
 
 		ret = get_user_pages_fast(uaddr, local_nr_pages,
 				write_to_vm, &pages[cur_page]);
-		if (ret < local_nr_pages) {
+		if (unlikely(ret < local_nr_pages)) {
+			for (j = cur_page; j < page_limit; j++) {
+				if (!pages[j])
+					break;
+				put_page(pages[j]);
+			}
 			ret = -EFAULT;
 			goto out_unmap;
 		}
@@ -1074,10 +1080,8 @@ static struct bio *__bio_map_user_iov(st
 	return bio;
 
  out_unmap:
-	for (i = 0; i < nr_pages; i++) {
-		if(!pages[i])
-			break;
-		page_cache_release(pages[i]);
+	bio_for_each_segment_all(bvec, bio, j) {
+		put_page(bvec->bv_page);
 	}
  out:
 	kfree(pages);
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/fs/ecryptfs/ecryptfs_kernel.h linux-libre-3.2.97-gnu1/fs/ecryptfs/ecryptfs_kernel.h
--- linux-libre-3.2.96-gnu1/fs/ecryptfs/ecryptfs_kernel.h	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/fs/ecryptfs/ecryptfs_kernel.h	2018-01-01 15:51:06.000000000 -0500
@@ -83,11 +83,16 @@ struct ecryptfs_page_crypt_context {
 static inline struct ecryptfs_auth_tok *
 ecryptfs_get_encrypted_key_payload_data(struct key *key)
 {
-	if (key->type == &key_type_encrypted)
-		return (struct ecryptfs_auth_tok *)
-			(&((struct encrypted_key_payload *)key->payload.data)->payload_data);
-	else
+	struct encrypted_key_payload *payload;
+
+	if (key->type != &key_type_encrypted)
 		return NULL;
+
+	payload = key->payload.data;
+	if (!payload)
+		return ERR_PTR(-EKEYREVOKED);
+
+	return (struct ecryptfs_auth_tok *)payload->payload_data;
 }
 
 static inline struct key *ecryptfs_get_encrypted_key(char *sig)
@@ -113,13 +118,17 @@ static inline struct ecryptfs_auth_tok *
 ecryptfs_get_key_payload_data(struct key *key)
 {
 	struct ecryptfs_auth_tok *auth_tok;
+	struct user_key_payload *ukp;
 
 	auth_tok = ecryptfs_get_encrypted_key_payload_data(key);
-	if (!auth_tok)
-		return (struct ecryptfs_auth_tok *)
-			(((struct user_key_payload *)key->payload.data)->data);
-	else
+	if (auth_tok)
 		return auth_tok;
+
+	ukp = key->payload.data;
+	if (!ukp)
+		return ERR_PTR(-EKEYREVOKED);
+
+	return (struct ecryptfs_auth_tok *)ukp->data;
 }
 
 #define ECRYPTFS_MAX_KEYSET_SIZE 1024
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/fs/ecryptfs/keystore.c linux-libre-3.2.97-gnu1/fs/ecryptfs/keystore.c
--- linux-libre-3.2.96-gnu1/fs/ecryptfs/keystore.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/fs/ecryptfs/keystore.c	2018-01-01 15:51:06.000000000 -0500
@@ -458,7 +458,8 @@ out:
  * @auth_tok_key: key containing the authentication token
  * @auth_tok: authentication token
  *
- * Returns zero on valid auth tok; -EINVAL otherwise
+ * Returns zero on valid auth tok; -EINVAL if the payload is invalid; or
+ * -EKEYREVOKED if the key was revoked before we acquired its semaphore.
  */
 static int
 ecryptfs_verify_auth_tok_from_key(struct key *auth_tok_key,
@@ -467,6 +468,12 @@ ecryptfs_verify_auth_tok_from_key(struct
 	int rc = 0;
 
 	(*auth_tok) = ecryptfs_get_key_payload_data(auth_tok_key);
+	if (IS_ERR(*auth_tok)) {
+		rc = PTR_ERR(*auth_tok);
+		*auth_tok = NULL;
+		goto out;
+	}
+
 	if (ecryptfs_verify_version((*auth_tok)->version)) {
 		printk(KERN_ERR "Data structure version mismatch. Userspace "
 		       "tools must match eCryptfs kernel module with major "
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/fs/fscache/object-list.c linux-libre-3.2.97-gnu1/fs/fscache/object-list.c
--- linux-libre-3.2.96-gnu1/fs/fscache/object-list.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/fs/fscache/object-list.c	2018-01-01 15:51:06.000000000 -0500
@@ -338,6 +338,13 @@ static void fscache_objlist_config(struc
 	rcu_read_lock();
 
 	confkey = key->payload.data;
+	if (!confkey) {
+		/* key was revoked */
+		rcu_read_unlock();
+		key_put(key);
+		goto no_config;
+	}
+
 	buf = confkey->data;
 
 	for (len = confkey->datalen - 1; len >= 0; len--) {
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/fs/ocfs2/alloc.c linux-libre-3.2.97-gnu1/fs/ocfs2/alloc.c
--- linux-libre-3.2.96-gnu1/fs/ocfs2/alloc.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/fs/ocfs2/alloc.c	2018-01-01 15:51:06.000000000 -0500
@@ -7188,13 +7188,24 @@ out:
 
 static int ocfs2_trim_extent(struct super_block *sb,
 			     struct ocfs2_group_desc *gd,
-			     u32 start, u32 count)
+			     u64 group, u32 start, u32 count)
 {
 	u64 discard, bcount;
+	struct ocfs2_super *osb = OCFS2_SB(sb);
 
 	bcount = ocfs2_clusters_to_blocks(sb, count);
-	discard = le64_to_cpu(gd->bg_blkno) +
-			ocfs2_clusters_to_blocks(sb, start);
+	discard = ocfs2_clusters_to_blocks(sb, start);
+
+	/*
+	 * For the first cluster group, the gd->bg_blkno is not at the start
+	 * of the group, but at an offset from the start. If we add it while
+	 * calculating discard for first group, we will wrongly start fstrim a
+	 * few blocks after the desried start block and the range can cross
+	 * over into the next cluster group. So, add it only if this is not
+	 * the first cluster group.
+	 */
+	if (group != osb->first_cluster_group_blkno)
+		discard += le64_to_cpu(gd->bg_blkno);
 
 	trace_ocfs2_trim_extent(sb, (unsigned long long)discard, bcount);
 
@@ -7202,7 +7213,7 @@ static int ocfs2_trim_extent(struct supe
 }
 
 static int ocfs2_trim_group(struct super_block *sb,
-			    struct ocfs2_group_desc *gd,
+			    struct ocfs2_group_desc *gd, u64 group,
 			    u32 start, u32 max, u32 minbits)
 {
 	int ret = 0, count = 0, next;
@@ -7221,7 +7232,7 @@ static int ocfs2_trim_group(struct super
 		next = ocfs2_find_next_bit(bitmap, max, start);
 
 		if ((next - start) >= minbits) {
-			ret = ocfs2_trim_extent(sb, gd,
+			ret = ocfs2_trim_extent(sb, gd, group,
 						start, next - start);
 			if (ret < 0) {
 				mlog_errno(ret);
@@ -7323,7 +7334,8 @@ int ocfs2_trim_fs(struct super_block *sb
 		}
 
 		gd = (struct ocfs2_group_desc *)gd_bh->b_data;
-		cnt = ocfs2_trim_group(sb, gd, first_bit, last_bit, minlen);
+		cnt = ocfs2_trim_group(sb, gd, group,
+				       first_bit, last_bit, minlen);
 		brelse(gd_bh);
 		gd_bh = NULL;
 		if (cnt < 0) {
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/fs/read_write.c linux-libre-3.2.97-gnu1/fs/read_write.c
--- linux-libre-3.2.96-gnu1/fs/read_write.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/fs/read_write.c	2018-01-01 15:51:06.000000000 -0500
@@ -99,7 +99,7 @@ generic_file_llseek_size(struct file *fi
 		 * In the generic case the entire file is data, so as long as
 		 * offset isn't at the end of the file then the offset is data.
 		 */
-		if (offset >= i_size_read(inode))
+		if ((unsigned long long)offset >= i_size_read(inode))
 			return -ENXIO;
 		break;
 	case SEEK_HOLE:
@@ -107,7 +107,7 @@ generic_file_llseek_size(struct file *fi
 		 * There is a virtual hole at the end of the file, so as long as
 		 * offset isn't i_size or larger, return i_size.
 		 */
-		if (offset >= i_size_read(inode))
+		if ((unsigned long long)offset >= i_size_read(inode))
 			return -ENXIO;
 		offset = i_size_read(inode);
 		break;
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/fs/xattr.c linux-libre-3.2.97-gnu1/fs/xattr.c
--- linux-libre-3.2.96-gnu1/fs/xattr.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/fs/xattr.c	2018-01-01 15:51:06.000000000 -0500
@@ -161,7 +161,7 @@ xattr_getsecurity(struct inode *inode, c
 	}
 	memcpy(value, buffer, len);
 out:
-	security_release_secctx(buffer, len);
+	kfree(buffer);
 out_noalloc:
 	return len;
 }
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/include/crypto/internal/hash.h linux-libre-3.2.97-gnu1/include/crypto/internal/hash.h
--- linux-libre-3.2.96-gnu1/include/crypto/internal/hash.h	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/include/crypto/internal/hash.h	2018-01-01 15:51:06.000000000 -0500
@@ -70,6 +70,14 @@ int ahash_register_instance(struct crypt
 			    struct ahash_instance *inst);
 void ahash_free_instance(struct crypto_instance *inst);
 
+int shash_no_setkey(struct crypto_shash *tfm, const u8 *key,
+		    unsigned int keylen);
+
+static inline bool crypto_shash_alg_has_setkey(struct shash_alg *alg)
+{
+	return alg->setkey != shash_no_setkey;
+}
+
 int crypto_init_ahash_spawn(struct crypto_ahash_spawn *spawn,
 			    struct hash_alg_common *alg,
 			    struct crypto_instance *inst);
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/include/linux/input.h linux-libre-3.2.97-gnu1/include/linux/input.h
--- linux-libre-3.2.96-gnu1/include/linux/input.h	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/include/linux/input.h	2018-01-01 15:51:06.000000000 -0500
@@ -1618,6 +1618,7 @@ int input_ff_event(struct input_dev *dev
 
 int input_ff_upload(struct input_dev *dev, struct ff_effect *effect, struct file *file);
 int input_ff_erase(struct input_dev *dev, int effect_id, struct file *file);
+int input_ff_flush(struct input_dev *dev, struct file *file);
 
 int input_ff_create_memless(struct input_dev *dev, void *data,
 		int (*play_effect)(struct input_dev *, void *, struct ff_effect *));
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/include/linux/key.h linux-libre-3.2.97-gnu1/include/linux/key.h
--- linux-libre-3.2.96-gnu1/include/linux/key.h	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/include/linux/key.h	2018-01-01 15:51:06.000000000 -0500
@@ -155,6 +155,7 @@ struct key {
 #define KEY_FLAG_IN_QUOTA	3	/* set if key consumes quota */
 #define KEY_FLAG_USER_CONSTRUCT	4	/* set if key is being constructed in userspace */
 #define KEY_FLAG_NEGATIVE	5	/* set if key is negative */
+#define KEY_FLAG_UID_KEYRING	11	/* set if key is a user or user session keyring */
 
 	/* the description string
 	 * - this is used to match a key against search criteria
@@ -196,6 +197,7 @@ extern struct key *key_alloc(struct key_
 #define KEY_ALLOC_IN_QUOTA	0x0000	/* add to quota, reject if would overrun */
 #define KEY_ALLOC_QUOTA_OVERRUN	0x0001	/* add to quota, permit even if overrun */
 #define KEY_ALLOC_NOT_IN_QUOTA	0x0002	/* not in quota */
+#define KEY_ALLOC_UID_KEYRING	0x0010	/* allocating a user or user session keyring */
 
 extern void key_revoke(struct key *key);
 extern void key_put(struct key *key);
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/include/linux/spi/spidev.h linux-libre-3.2.97-gnu1/include/linux/spi/spidev.h
--- linux-libre-3.2.96-gnu1/include/linux/spi/spidev.h	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/include/linux/spi/spidev.h	2018-01-01 15:51:06.000000000 -0500
@@ -23,6 +23,7 @@
 #define SPIDEV_H
 
 #include <linux/types.h>
+#include <linux/ioctl.h>
 
 /* User space versions of kernel symbols for SPI clocking modes,
  * matching <linux/spi/spi.h>
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/include/net/bluetooth/l2cap.h linux-libre-3.2.97-gnu1/include/net/bluetooth/l2cap.h
--- linux-libre-3.2.96-gnu1/include/net/bluetooth/l2cap.h	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/include/net/bluetooth/l2cap.h	2018-01-01 15:51:06.000000000 -0500
@@ -496,6 +496,7 @@ extern int disable_ertm;
 
 int l2cap_init_sockets(void);
 void l2cap_cleanup_sockets(void);
+bool l2cap_is_socket(struct socket *sock);
 
 void __l2cap_connect_rsp_defer(struct l2cap_chan *chan);
 int __l2cap_wait_ack(struct sock *sk);
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/include/net/tcp.h linux-libre-3.2.97-gnu1/include/net/tcp.h
--- linux-libre-3.2.96-gnu1/include/net/tcp.h	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/include/net/tcp.h	2018-01-01 15:51:06.000000000 -0500
@@ -1394,12 +1394,12 @@ static inline void tcp_highest_sack_rese
 	tcp_sk(sk)->highest_sack = tcp_write_queue_head(sk);
 }
 
-/* Called when old skb is about to be deleted (to be combined with new skb) */
-static inline void tcp_highest_sack_combine(struct sock *sk,
+/* Called when old skb is about to be deleted and replaced by new skb */
+static inline void tcp_highest_sack_replace(struct sock *sk,
 					    struct sk_buff *old,
 					    struct sk_buff *new)
 {
-	if (tcp_sk(sk)->sacked_out && (old == tcp_sk(sk)->highest_sack))
+	if (old == tcp_highest_sack(sk))
 		tcp_sk(sk)->highest_sack = new;
 }
 
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/include/scsi/scsi_device.h linux-libre-3.2.97-gnu1/include/scsi/scsi_device.h
--- linux-libre-3.2.96-gnu1/include/scsi/scsi_device.h	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/include/scsi/scsi_device.h	2018-01-01 15:51:06.000000000 -0500
@@ -152,6 +152,7 @@ struct scsi_device {
 	unsigned no_read_capacity_16:1; /* Avoid READ_CAPACITY_16 cmds */
 	unsigned is_visible:1;	/* is the device visible in sysfs */
 	unsigned broken_fua:1;		/* Don't set FUA bit */
+	unsigned unmap_limit_for_ws:1;	/* Use the UNMAP limit for WRITE SAME */
 
 	DECLARE_BITMAP(supported_events, SDEV_EVT_MAXBITS); /* supported events */
 	struct list_head event_list;	/* asserted events */
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/include/scsi/scsi_devinfo.h linux-libre-3.2.97-gnu1/include/scsi/scsi_devinfo.h
--- linux-libre-3.2.96-gnu1/include/scsi/scsi_devinfo.h	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/include/scsi/scsi_devinfo.h	2018-01-01 15:51:06.000000000 -0500
@@ -30,4 +30,5 @@
 #define BLIST_RETRY_HWERROR	0x400000 /* retry HARDWARE_ERROR */
 #define BLIST_MAX_512		0x800000 /* maximum 512 sector cdb length */
 #define BLIST_ATTACH_PQ3	0x1000000 /* Scan: Attach to PQ3 devices */
+#define BLIST_UNMAP_LIMIT_WS	0x80000000 /* Use UNMAP limit for WRITE SAME */
 #endif
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/include/sound/seq_kernel.h linux-libre-3.2.97-gnu1/include/sound/seq_kernel.h
--- linux-libre-3.2.96-gnu1/include/sound/seq_kernel.h	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/include/sound/seq_kernel.h	2018-01-01 15:51:06.000000000 -0500
@@ -55,7 +55,8 @@ typedef union snd_seq_timestamp snd_seq_
 #define SNDRV_SEQ_DEFAULT_CLIENT_EVENTS	200
 
 /* max delivery path length */
-#define SNDRV_SEQ_MAX_HOPS		10
+/* NOTE: this shouldn't be greater than MAX_LOCKDEP_SUBCLASSES */
+#define SNDRV_SEQ_MAX_HOPS		8
 
 /* max size of event size */
 #define SNDRV_SEQ_MAX_EVENT_LEN		0x3fffffff
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/include/sound/seq_virmidi.h linux-libre-3.2.97-gnu1/include/sound/seq_virmidi.h
--- linux-libre-3.2.96-gnu1/include/sound/seq_virmidi.h	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/include/sound/seq_virmidi.h	2018-01-01 15:51:06.000000000 -0500
@@ -60,6 +60,7 @@ struct snd_virmidi_dev {
 	int port;			/* created/attached port */
 	unsigned int flags;		/* SNDRV_VIRMIDI_* */
 	rwlock_t filelist_lock;
+	struct rw_semaphore filelist_sem;
 	struct list_head filelist;
 };
 
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/include/sound/timer.h linux-libre-3.2.97-gnu1/include/sound/timer.h
--- linux-libre-3.2.96-gnu1/include/sound/timer.h	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/include/sound/timer.h	2018-01-01 15:51:06.000000000 -0500
@@ -90,6 +90,8 @@ struct snd_timer {
 	struct list_head ack_list_head;
 	struct list_head sack_list_head; /* slow ack list head */
 	struct tasklet_struct task_queue;
+	int max_instances;	/* upper limit of timer instances */
+	int num_instances;	/* current number of timer instances */
 };
 
 struct snd_timer_instance {
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/include/trace/events/kvm.h linux-libre-3.2.97-gnu1/include/trace/events/kvm.h
--- linux-libre-3.2.96-gnu1/include/trace/events/kvm.h	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/include/trace/events/kvm.h	2018-01-01 15:51:06.000000000 -0500
@@ -152,7 +152,7 @@ TRACE_EVENT(kvm_ack_irq,
 	{ KVM_TRACE_MMIO_WRITE, "write" }
 
 TRACE_EVENT(kvm_mmio,
-	TP_PROTO(int type, int len, u64 gpa, u64 val),
+	TP_PROTO(int type, int len, u64 gpa, void *val),
 	TP_ARGS(type, len, gpa, val),
 
 	TP_STRUCT__entry(
@@ -166,7 +166,10 @@ TRACE_EVENT(kvm_mmio,
 		__entry->type		= type;
 		__entry->len		= len;
 		__entry->gpa		= gpa;
-		__entry->val		= val;
+		__entry->val		= 0;
+		if (val)
+			memcpy(&__entry->val, val,
+			       min_t(u32, sizeof(__entry->val), len));
 	),
 
 	TP_printk("mmio %s len %u gpa 0x%llx val 0x%llx",
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/kernel/params.c linux-libre-3.2.97-gnu1/kernel/params.c
--- linux-libre-3.2.96-gnu1/kernel/params.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/kernel/params.c	2018-01-01 15:51:06.000000000 -0500
@@ -578,7 +578,7 @@ EXPORT_SYMBOL(__kernel_param_unlock);
 /*
  * add_sysfs_param - add a parameter to sysfs
  * @mk: struct module_kobject
- * @kparam: the actual parameter definition to add to sysfs
+ * @kp: the actual parameter definition to add to sysfs
  * @name: name of parameter
  *
  * Create a kobject if for a (per-module) parameter if mp NULL, and
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/kernel/ptrace.c linux-libre-3.2.97-gnu1/kernel/ptrace.c
--- linux-libre-3.2.96-gnu1/kernel/ptrace.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/kernel/ptrace.c	2018-01-01 15:51:06.000000000 -0500
@@ -77,12 +77,11 @@ void __ptrace_unlink(struct task_struct
 {
 	BUG_ON(!child->ptrace);
 
-	child->ptrace = 0;
 	child->parent = child->real_parent;
 	list_del_init(&child->ptrace_entry);
 
 	spin_lock(&child->sighand->siglock);
-
+	child->ptrace = 0;
 	/*
 	 * Clear all pending traps and TRAPPING.  TRAPPING should be
 	 * cleared regardless of JOBCTL_STOP_PENDING.  Do it explicitly.
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/kernel/sysctl.c linux-libre-3.2.97-gnu1/kernel/sysctl.c
--- linux-libre-3.2.96-gnu1/kernel/sysctl.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/kernel/sysctl.c	2018-01-01 15:51:06.000000000 -0500
@@ -329,7 +329,8 @@ static struct ctl_table kern_table[] = {
 		.data		= &sysctl_sched_time_avg,
 		.maxlen		= sizeof(unsigned int),
 		.mode		= 0644,
-		.proc_handler	= proc_dointvec,
+		.proc_handler	= proc_dointvec_minmax,
+		.extra1		= &one,
 	},
 	{
 		.procname	= "sched_shares_window",
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/Makefile linux-libre-3.2.97-gnu1/Makefile
--- linux-libre-3.2.96-gnu1/Makefile	2017-11-26 13:21:10.000000000 -0500
+++ linux-libre-3.2.97-gnu1/Makefile	2018-01-02 11:07:16.000000000 -0500
@@ -1,6 +1,6 @@
 VERSION = 3
 PATCHLEVEL = 2
-SUBLEVEL = 96
+SUBLEVEL = 97
 EXTRAVERSION =-gnu1
 NAME = Saber-toothed Squirrel
 
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/net/bluetooth/bnep/core.c linux-libre-3.2.97-gnu1/net/bluetooth/bnep/core.c
--- linux-libre-3.2.96-gnu1/net/bluetooth/bnep/core.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/net/bluetooth/bnep/core.c	2018-01-01 15:51:06.000000000 -0500
@@ -560,6 +560,9 @@ int bnep_add_connection(struct bnep_conn
 
 	BT_DBG("");
 
+	if (!l2cap_is_socket(sock))
+		return -EBADFD;
+
 	baswap((void *) dst, &bt_sk(sock->sk)->dst);
 	baswap((void *) src, &bt_sk(sock->sk)->src);
 
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/net/bluetooth/cmtp/core.c linux-libre-3.2.97-gnu1/net/bluetooth/cmtp/core.c
--- linux-libre-3.2.96-gnu1/net/bluetooth/cmtp/core.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/net/bluetooth/cmtp/core.c	2018-01-01 15:51:06.000000000 -0500
@@ -336,6 +336,9 @@ int cmtp_add_connection(struct cmtp_conn
 
 	BT_DBG("");
 
+	if (!l2cap_is_socket(sock))
+		return -EBADFD;
+
 	session = kzalloc(sizeof(struct cmtp_session), GFP_KERNEL);
 	if (!session)
 		return -ENOMEM;
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/net/bluetooth/hidp/core.c linux-libre-3.2.97-gnu1/net/bluetooth/hidp/core.c
--- linux-libre-3.2.96-gnu1/net/bluetooth/hidp/core.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/net/bluetooth/hidp/core.c	2018-01-01 15:51:06.000000000 -0500
@@ -972,6 +972,8 @@ int hidp_add_connection(struct hidp_conn
 
 	BT_DBG("");
 
+	if (!l2cap_is_socket(ctrl_sock) || !l2cap_is_socket(intr_sock))
+		return -EINVAL;
 	if (bacmp(&bt_sk(ctrl_sock->sk)->src, &bt_sk(intr_sock->sk)->src) ||
 			bacmp(&bt_sk(ctrl_sock->sk)->dst, &bt_sk(intr_sock->sk)->dst))
 		return -ENOTUNIQ;
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/net/bluetooth/l2cap_sock.c linux-libre-3.2.97-gnu1/net/bluetooth/l2cap_sock.c
--- linux-libre-3.2.96-gnu1/net/bluetooth/l2cap_sock.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/net/bluetooth/l2cap_sock.c	2018-01-01 15:51:06.000000000 -0500
@@ -38,6 +38,12 @@ static const struct proto_ops l2cap_sock
 static void l2cap_sock_init(struct sock *sk, struct sock *parent);
 static struct sock *l2cap_sock_alloc(struct net *net, struct socket *sock, int proto, gfp_t prio);
 
+bool l2cap_is_socket(struct socket *sock)
+{
+	return sock && sock->ops == &l2cap_sock_ops;
+}
+EXPORT_SYMBOL(l2cap_is_socket);
+
 static int l2cap_sock_bind(struct socket *sock, struct sockaddr *addr, int alen)
 {
 	struct sock *sk = sock->sk;
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/net/core/rtnetlink.c linux-libre-3.2.97-gnu1/net/core/rtnetlink.c
--- linux-libre-3.2.96-gnu1/net/core/rtnetlink.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/net/core/rtnetlink.c	2018-01-01 15:51:06.000000000 -0500
@@ -1137,7 +1137,10 @@ const struct nla_policy ifla_policy[IFLA
 	[IFLA_LINKINFO]		= { .type = NLA_NESTED },
 	[IFLA_NET_NS_PID]	= { .type = NLA_U32 },
 	[IFLA_NET_NS_FD]	= { .type = NLA_U32 },
-	[IFLA_IFALIAS]	        = { .type = NLA_STRING, .len = IFALIASZ-1 },
+	/* IFLA_IFALIAS is a string, but policy is set to NLA_BINARY to
+	 * allow 0-length string (needed to remove an alias).
+	 */
+	[IFLA_IFALIAS]	        = { .type = NLA_BINARY, .len = IFALIASZ - 1 },
 	[IFLA_VFINFO_LIST]	= {. type = NLA_NESTED },
 	[IFLA_VF_PORTS]		= { .type = NLA_NESTED },
 	[IFLA_PORT_SELF]	= { .type = NLA_NESTED },
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/net/dccp/proto.c linux-libre-3.2.97-gnu1/net/dccp/proto.c
--- linux-libre-3.2.96-gnu1/net/dccp/proto.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/net/dccp/proto.c	2018-01-01 15:51:06.000000000 -0500
@@ -252,6 +252,7 @@ int dccp_disconnect(struct sock *sk, int
 {
 	struct inet_connection_sock *icsk = inet_csk(sk);
 	struct inet_sock *inet = inet_sk(sk);
+	struct dccp_sock *dp = dccp_sk(sk);
 	int err = 0;
 	const int old_state = sk->sk_state;
 
@@ -271,6 +272,10 @@ int dccp_disconnect(struct sock *sk, int
 		sk->sk_err = ECONNRESET;
 
 	dccp_clear_xmit_timers(sk);
+	ccid_hc_rx_delete(dp->dccps_hc_rx_ccid, sk);
+	ccid_hc_tx_delete(dp->dccps_hc_tx_ccid, sk);
+	dp->dccps_hc_rx_ccid = NULL;
+	dp->dccps_hc_tx_ccid = NULL;
 
 	__skb_queue_purge(&sk->sk_receive_queue);
 	__skb_queue_purge(&sk->sk_write_queue);
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/net/ipv4/tcp_output.c linux-libre-3.2.97-gnu1/net/ipv4/tcp_output.c
--- linux-libre-3.2.96-gnu1/net/ipv4/tcp_output.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/net/ipv4/tcp_output.c	2018-01-01 15:51:06.000000000 -0500
@@ -1676,6 +1676,7 @@ static int tcp_mtu_probe(struct sock *sk
 	nskb->ip_summed = skb->ip_summed;
 
 	tcp_insert_write_queue_before(nskb, skb, sk);
+	tcp_highest_sack_replace(sk, skb, nskb);
 
 	len = 0;
 	tcp_for_write_queue_from_safe(skb, next, sk) {
@@ -1987,7 +1988,7 @@ static void tcp_collapse_retrans(struct
 
 	BUG_ON(tcp_skb_pcount(skb) != 1 || tcp_skb_pcount(next_skb) != 1);
 
-	tcp_highest_sack_combine(sk, next_skb, skb);
+	tcp_highest_sack_replace(sk, next_skb, skb);
 
 	tcp_unlink_write_queue(next_skb, sk);
 
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/net/l2tp/l2tp_eth.c linux-libre-3.2.97-gnu1/net/l2tp/l2tp_eth.c
--- linux-libre-3.2.96-gnu1/net/l2tp/l2tp_eth.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/net/l2tp/l2tp_eth.c	2018-01-01 15:51:06.000000000 -0500
@@ -39,7 +39,6 @@ struct l2tp_eth {
 	struct net_device	*dev;
 	struct sock		*tunnel_sock;
 	struct l2tp_session	*session;
-	struct list_head	list;
 };
 
 /* via l2tp_session_priv() */
@@ -47,17 +46,6 @@ struct l2tp_eth_sess {
 	struct net_device	*dev;
 };
 
-/* per-net private data for this module */
-static unsigned int l2tp_eth_net_id;
-struct l2tp_eth_net {
-	struct list_head l2tp_eth_dev_list;
-	spinlock_t l2tp_eth_lock;
-};
-
-static inline struct l2tp_eth_net *l2tp_eth_pernet(struct net *net)
-{
-	return net_generic(net, l2tp_eth_net_id);
-}
 
 static int l2tp_eth_dev_init(struct net_device *dev)
 {
@@ -72,12 +60,6 @@ static int l2tp_eth_dev_init(struct net_
 
 static void l2tp_eth_dev_uninit(struct net_device *dev)
 {
-	struct l2tp_eth *priv = netdev_priv(dev);
-	struct l2tp_eth_net *pn = l2tp_eth_pernet(dev_net(dev));
-
-	spin_lock(&pn->l2tp_eth_lock);
-	list_del_init(&priv->list);
-	spin_unlock(&pn->l2tp_eth_lock);
 	dev_put(dev);
 }
 
@@ -193,7 +175,6 @@ static int l2tp_eth_create(struct net *n
 	struct l2tp_eth *priv;
 	struct l2tp_eth_sess *spriv;
 	int rc;
-	struct l2tp_eth_net *pn;
 
 	if (cfg->ifname) {
 		dev = dev_get_by_name(net, cfg->ifname);
@@ -228,7 +209,6 @@ static int l2tp_eth_create(struct net *n
 	priv = netdev_priv(dev);
 	priv->dev = dev;
 	priv->session = session;
-	INIT_LIST_HEAD(&priv->list);
 
 	priv->tunnel_sock = tunnel->sock;
 	session->recv_skb = l2tp_eth_dev_recv;
@@ -249,10 +229,6 @@ static int l2tp_eth_create(struct net *n
 	strlcpy(session->ifname, dev->name, IFNAMSIZ);
 
 	dev_hold(dev);
-	pn = l2tp_eth_pernet(dev_net(dev));
-	spin_lock(&pn->l2tp_eth_lock);
-	list_add(&priv->list, &pn->l2tp_eth_dev_list);
-	spin_unlock(&pn->l2tp_eth_lock);
 
 	return 0;
 
@@ -265,22 +241,6 @@ out:
 	return rc;
 }
 
-static __net_init int l2tp_eth_init_net(struct net *net)
-{
-	struct l2tp_eth_net *pn = net_generic(net, l2tp_eth_net_id);
-
-	INIT_LIST_HEAD(&pn->l2tp_eth_dev_list);
-	spin_lock_init(&pn->l2tp_eth_lock);
-
-	return 0;
-}
-
-static struct pernet_operations l2tp_eth_net_ops = {
-	.init = l2tp_eth_init_net,
-	.id   = &l2tp_eth_net_id,
-	.size = sizeof(struct l2tp_eth_net),
-};
-
 
 static const struct l2tp_nl_cmd_ops l2tp_eth_nl_cmd_ops = {
 	.session_create	= l2tp_eth_create,
@@ -294,25 +254,18 @@ static int __init l2tp_eth_init(void)
 
 	err = l2tp_nl_register_ops(L2TP_PWTYPE_ETH, &l2tp_eth_nl_cmd_ops);
 	if (err)
-		goto out;
-
-	err = register_pernet_device(&l2tp_eth_net_ops);
-	if (err)
-		goto out_unreg;
+		goto err;
 
 	printk(KERN_INFO "L2TP ethernet pseudowire support (L2TPv3)\n");
 
 	return 0;
 
-out_unreg:
-	l2tp_nl_unregister_ops(L2TP_PWTYPE_ETH);
-out:
+err:
 	return err;
 }
 
 static void __exit l2tp_eth_exit(void)
 {
-	unregister_pernet_device(&l2tp_eth_net_ops);
 	l2tp_nl_unregister_ops(L2TP_PWTYPE_ETH);
 }
 
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/net/l2tp/l2tp_ip.c linux-libre-3.2.97-gnu1/net/l2tp/l2tp_ip.c
--- linux-libre-3.2.96-gnu1/net/l2tp/l2tp_ip.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/net/l2tp/l2tp_ip.c	2018-01-01 15:51:06.000000000 -0500
@@ -127,6 +127,7 @@ static int l2tp_ip_recv(struct sk_buff *
 	unsigned char *ptr, *optr;
 	struct l2tp_session *session;
 	struct l2tp_tunnel *tunnel = NULL;
+	struct iphdr *iph;
 	int length;
 	int offset;
 
@@ -189,21 +190,16 @@ pass_up:
 		goto discard;
 
 	tunnel_id = ntohl(*(__be32 *) &skb->data[4]);
-	tunnel = l2tp_tunnel_find(&init_net, tunnel_id);
-	if (tunnel != NULL)
-		sk = tunnel->sock;
-	else {
-		struct iphdr *iph = (struct iphdr *) skb_network_header(skb);
+	iph = (struct iphdr *)skb_network_header(skb);
 
-		read_lock_bh(&l2tp_ip_lock);
-		sk = __l2tp_ip_bind_lookup(&init_net, iph->daddr, 0, tunnel_id);
+	read_lock_bh(&l2tp_ip_lock);
+	sk = __l2tp_ip_bind_lookup(&init_net, iph->daddr, 0, tunnel_id);
+	if (!sk) {
 		read_unlock_bh(&l2tp_ip_lock);
-	}
-
-	if (sk == NULL)
 		goto discard;
-
+	}
 	sock_hold(sk);
+	read_unlock_bh(&l2tp_ip_lock);
 
 	if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
 		goto discard_put;
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/net/l2tp/l2tp_ppp.c linux-libre-3.2.97-gnu1/net/l2tp/l2tp_ppp.c
--- linux-libre-3.2.96-gnu1/net/l2tp/l2tp_ppp.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/net/l2tp/l2tp_ppp.c	2018-01-01 15:51:06.000000000 -0500
@@ -642,6 +642,7 @@ static int pppol2tp_connect(struct socke
 	u32 tunnel_id, peer_tunnel_id;
 	u32 session_id, peer_session_id;
 	bool drop_refcnt = false;
+	bool drop_tunnel = false;
 	int ver = 2;
 	int fd;
 
@@ -685,7 +686,9 @@ static int pppol2tp_connect(struct socke
 	if (tunnel_id == 0)
 		goto end;
 
-	tunnel = l2tp_tunnel_find(sock_net(sk), tunnel_id);
+	tunnel = l2tp_tunnel_get(sock_net(sk), tunnel_id);
+	if (tunnel)
+		drop_tunnel = true;
 
 	/* Special case: create tunnel context if session_id and
 	 * peer_session_id is 0. Otherwise look up tunnel using supplied
@@ -818,6 +821,8 @@ out_no_ppp:
 end:
 	if (drop_refcnt)
 		l2tp_session_dec_refcount(session);
+	if (drop_tunnel)
+		l2tp_tunnel_dec_refcount(tunnel);
 	release_sock(sk);
 
 	return error;
@@ -997,6 +1002,9 @@ static int pppol2tp_session_ioctl(struct
 	       session->name, cmd, arg);
 
 	sk = ps->sock;
+	if (!sk)
+		return -EBADR;
+
 	sock_hold(sk);
 
 	switch (cmd) {
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/net/packet/af_packet.c linux-libre-3.2.97-gnu1/net/packet/af_packet.c
--- linux-libre-3.2.96-gnu1/net/packet/af_packet.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/net/packet/af_packet.c	2018-01-01 15:51:06.000000000 -0500
@@ -2231,6 +2231,7 @@ static int packet_snd(struct socket *soc
 	int offset = 0;
 	int vnet_hdr_len;
 	struct packet_sock *po = pkt_sk(sk);
+	bool has_vnet_hdr = false;
 	unsigned short gso_type = 0;
 
 	/*
@@ -2263,6 +2264,7 @@ static int packet_snd(struct socket *soc
 		reserve = dev->hard_header_len;
 	if (po->has_vnet_hdr) {
 		vnet_hdr_len = sizeof(vnet_hdr);
+		has_vnet_hdr = true;
 
 		err = -EINVAL;
 		if (len < vnet_hdr_len)
@@ -2354,7 +2356,7 @@ static int packet_snd(struct socket *soc
 	skb->priority = sk->sk_priority;
 	skb->mark = sk->sk_mark;
 
-	if (po->has_vnet_hdr) {
+	if (has_vnet_hdr) {
 		if (vnet_hdr.flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) {
 			if (!skb_partial_csum_set(skb, vnet_hdr.csum_start,
 						  vnet_hdr.csum_offset)) {
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/net/sctp/sm_sideeffect.c linux-libre-3.2.97-gnu1/net/sctp/sm_sideeffect.c
--- linux-libre-3.2.96-gnu1/net/sctp/sm_sideeffect.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/net/sctp/sm_sideeffect.c	2018-01-01 15:51:06.000000000 -0500
@@ -1598,8 +1598,8 @@ static int sctp_cmd_interpreter(sctp_eve
 		case SCTP_CMD_PROCESS_CTSN:
 			/* Dummy up a SACK for processing. */
 			sackh.cum_tsn_ack = cmd->obj.be32;
-			sackh.a_rwnd = asoc->peer.rwnd +
-					asoc->outqueue.outstanding_bytes;
+			sackh.a_rwnd = htonl(asoc->peer.rwnd +
+					     asoc->outqueue.outstanding_bytes);
 			sackh.num_gap_ack_blocks = 0;
 			sackh.num_dup_tsns = 0;
 			sctp_add_cmd_sf(commands, SCTP_CMD_PROCESS_SACK,
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/net/xfrm/xfrm_user.c linux-libre-3.2.97-gnu1/net/xfrm/xfrm_user.c
--- linux-libre-3.2.96-gnu1/net/xfrm/xfrm_user.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/net/xfrm/xfrm_user.c	2018-01-01 15:51:06.000000000 -0500
@@ -1530,7 +1530,8 @@ static int xfrm_dump_policy_done(struct
 {
 	struct xfrm_policy_walk *walk = (struct xfrm_policy_walk *) &cb->args[1];
 
-	xfrm_policy_walk_done(walk);
+	if (cb->args[0])
+		xfrm_policy_walk_done(walk);
 	return 0;
 }
 
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/security/keys/encrypted-keys/encrypted.c linux-libre-3.2.97-gnu1/security/keys/encrypted-keys/encrypted.c
--- linux-libre-3.2.96-gnu1/security/keys/encrypted-keys/encrypted.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/security/keys/encrypted-keys/encrypted.c	2018-01-01 15:51:06.000000000 -0500
@@ -315,6 +315,13 @@ static struct key *request_user_key(cons
 
 	down_read(&ukey->sem);
 	upayload = rcu_dereference(ukey->payload.data);
+	if (!upayload) {
+		/* key was revoked before we acquired its semaphore */
+		up_read(&ukey->sem);
+		key_put(ukey);
+		ukey = ERR_PTR(-EKEYREVOKED);
+		goto error;
+	}
 	*master_key = upayload->data;
 	*master_keylen = upayload->datalen;
 error:
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/security/keys/internal.h linux-libre-3.2.97-gnu1/security/keys/internal.h
--- linux-libre-3.2.96-gnu1/security/keys/internal.h	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/security/keys/internal.h	2018-01-01 15:51:06.000000000 -0500
@@ -124,7 +124,7 @@ extern key_ref_t search_process_keyrings
 					 key_match_func_t match,
 					 const struct cred *cred);
 
-extern struct key *find_keyring_by_name(const char *name, bool skip_perm_check);
+extern struct key *find_keyring_by_name(const char *name, bool uid_keyring);
 
 extern int install_user_keyrings(void);
 extern int install_thread_keyring_to_cred(struct cred *);
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/security/keys/key.c linux-libre-3.2.97-gnu1/security/keys/key.c
--- linux-libre-3.2.96-gnu1/security/keys/key.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/security/keys/key.c	2018-01-01 15:51:06.000000000 -0500
@@ -305,6 +305,8 @@ struct key *key_alloc(struct key_type *t
 
 	if (!(flags & KEY_ALLOC_NOT_IN_QUOTA))
 		key->flags |= 1 << KEY_FLAG_IN_QUOTA;
+	if (flags & KEY_ALLOC_UID_KEYRING)
+		key->flags |= 1 << KEY_FLAG_UID_KEYRING;
 
 	memset(&key->type_data, 0, sizeof(key->type_data));
 
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/security/keys/keyctl.c linux-libre-3.2.97-gnu1/security/keys/keyctl.c
--- linux-libre-3.2.96-gnu1/security/keys/keyctl.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/security/keys/keyctl.c	2018-01-01 15:51:06.000000000 -0500
@@ -684,7 +684,7 @@ long keyctl_read_key(key_serial_t keyid,
 	if (ret == 0)
 		goto can_read_key;
 	if (ret != -EACCES)
-		goto error;
+		goto error2;
 
 	/* we can't; see if it's searchable from this process's keyrings
 	 * - we automatically take account of the fact that it may be
@@ -1345,11 +1345,9 @@ long keyctl_assume_authority(key_serial_
 	}
 
 	ret = keyctl_change_reqkey_auth(authkey);
-	if (ret < 0)
-		goto error;
+	if (ret == 0)
+		ret = authkey->serial;
 	key_put(authkey);
-
-	ret = authkey->serial;
 error:
 	return ret;
 }
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/security/keys/keyring.c linux-libre-3.2.97-gnu1/security/keys/keyring.c
--- linux-libre-3.2.96-gnu1/security/keys/keyring.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/security/keys/keyring.c	2018-01-01 15:51:06.000000000 -0500
@@ -550,15 +550,15 @@ found:
 /*
  * Find a keyring with the specified name.
  *
- * All named keyrings in the current user namespace are searched, provided they
- * grant Search permission directly to the caller (unless this check is
- * skipped).  Keyrings whose usage points have reached zero or who have been
- * revoked are skipped.
+ * Only keyrings that have nonzero refcount, are not revoked, and are owned by a
+ * user in the current user namespace are considered.  If @uid_keyring is %true,
+ * the keyring additionally must have been allocated as a user or user session
+ * keyring; otherwise, it must grant Search permission directly to the caller.
  *
  * Returns a pointer to the keyring with the keyring's refcount having being
  * incremented on success.  -ENOKEY is returned if a key could not be found.
  */
-struct key *find_keyring_by_name(const char *name, bool skip_perm_check)
+struct key *find_keyring_by_name(const char *name, bool uid_keyring)
 {
 	struct key *keyring;
 	int bucket;
@@ -586,10 +586,15 @@ struct key *find_keyring_by_name(const c
 			if (strcmp(keyring->description, name) != 0)
 				continue;
 
-			if (!skip_perm_check &&
-			    key_permission(make_key_ref(keyring, 0),
-					   KEY_SEARCH) < 0)
-				continue;
+			if (uid_keyring) {
+				if (!test_bit(KEY_FLAG_UID_KEYRING,
+					      &keyring->flags))
+					continue;
+			} else {
+				if (key_permission(make_key_ref(keyring, 0),
+						   KEY_SEARCH) < 0)
+					continue;
+			}
 
 			/* we've got a match but we might end up racing with
 			 * key_cleanup() if the keyring is currently 'dead'
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/security/keys/process_keys.c linux-libre-3.2.97-gnu1/security/keys/process_keys.c
--- linux-libre-3.2.96-gnu1/security/keys/process_keys.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/security/keys/process_keys.c	2018-01-01 15:51:06.000000000 -0500
@@ -72,7 +72,9 @@ int install_user_keyrings(void)
 		uid_keyring = find_keyring_by_name(buf, true);
 		if (IS_ERR(uid_keyring)) {
 			uid_keyring = keyring_alloc(buf, user->uid, (gid_t) -1,
-						    cred, KEY_ALLOC_IN_QUOTA,
+						    cred,
+						    KEY_ALLOC_UID_KEYRING |
+							KEY_ALLOC_IN_QUOTA,
 						    NULL);
 			if (IS_ERR(uid_keyring)) {
 				ret = PTR_ERR(uid_keyring);
@@ -88,7 +90,10 @@ int install_user_keyrings(void)
 		if (IS_ERR(session_keyring)) {
 			session_keyring =
 				keyring_alloc(buf, user->uid, (gid_t) -1,
-					      cred, KEY_ALLOC_IN_QUOTA, NULL);
+					      cred,
+					      KEY_ALLOC_UID_KEYRING |
+						  KEY_ALLOC_IN_QUOTA,
+					      NULL);
 			if (IS_ERR(session_keyring)) {
 				ret = PTR_ERR(session_keyring);
 				goto error_release;
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/security/keys/request_key_auth.c linux-libre-3.2.97-gnu1/security/keys/request_key_auth.c
--- linux-libre-3.2.96-gnu1/security/keys/request_key_auth.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/security/keys/request_key_auth.c	2018-01-01 15:51:06.000000000 -0500
@@ -106,6 +106,18 @@ static void request_key_auth_revoke(stru
 	}
 }
 
+static void free_request_key_auth(struct request_key_auth *rka)
+{
+	if (!rka)
+		return;
+	key_put(rka->target_key);
+	key_put(rka->dest_keyring);
+	if (rka->cred)
+		put_cred(rka->cred);
+	kfree(rka->callout_info);
+	kfree(rka);
+}
+
 /*
  * Destroy an instantiation authorisation token key.
  */
@@ -115,15 +127,7 @@ static void request_key_auth_destroy(str
 
 	kenter("{%d}", key->serial);
 
-	if (rka->cred) {
-		put_cred(rka->cred);
-		rka->cred = NULL;
-	}
-
-	key_put(rka->target_key);
-	key_put(rka->dest_keyring);
-	kfree(rka->callout_info);
-	kfree(rka);
+	free_request_key_auth(rka);
 }
 
 /*
@@ -137,22 +141,17 @@ struct key *request_key_auth_new(struct
 	const struct cred *cred = current->cred;
 	struct key *authkey = NULL;
 	char desc[20];
-	int ret;
+	int ret = -ENOMEM;
 
 	kenter("%d,", target->serial);
 
 	/* allocate a auth record */
-	rka = kmalloc(sizeof(*rka), GFP_KERNEL);
-	if (!rka) {
-		kleave(" = -ENOMEM");
-		return ERR_PTR(-ENOMEM);
-	}
+	rka = kzalloc(sizeof(*rka), GFP_KERNEL);
+	if (!rka)
+		goto error;
 	rka->callout_info = kmalloc(callout_len, GFP_KERNEL);
-	if (!rka->callout_info) {
-		kleave(" = -ENOMEM");
-		kfree(rka);
-		return ERR_PTR(-ENOMEM);
-	}
+	if (!rka->callout_info)
+		goto error_free_rka;
 
 	/* see if the calling process is already servicing the key request of
 	 * another process */
@@ -162,8 +161,12 @@ struct key *request_key_auth_new(struct
 
 		/* if the auth key has been revoked, then the key we're
 		 * servicing is already instantiated */
-		if (test_bit(KEY_FLAG_REVOKED, &cred->request_key_auth->flags))
-			goto auth_key_revoked;
+		if (test_bit(KEY_FLAG_REVOKED,
+			     &cred->request_key_auth->flags)) {
+			up_read(&cred->request_key_auth->sem);
+			ret = -EKEYREVOKED;
+			goto error_free_rka;
+		}
 
 		irka = cred->request_key_auth->payload.data;
 		rka->cred = get_cred(irka->cred);
@@ -191,32 +194,22 @@ struct key *request_key_auth_new(struct
 			    KEY_USR_VIEW, KEY_ALLOC_NOT_IN_QUOTA);
 	if (IS_ERR(authkey)) {
 		ret = PTR_ERR(authkey);
-		goto error_alloc;
+		goto error_free_rka;
 	}
 
 	/* construct the auth key */
 	ret = key_instantiate_and_link(authkey, rka, 0, NULL, NULL);
 	if (ret < 0)
-		goto error_inst;
+		goto error_put_authkey;
 
 	kleave(" = {%d,%d}", authkey->serial, atomic_read(&authkey->usage));
 	return authkey;
 
-auth_key_revoked:
-	up_read(&cred->request_key_auth->sem);
-	kfree(rka->callout_info);
-	kfree(rka);
-	kleave("= -EKEYREVOKED");
-	return ERR_PTR(-EKEYREVOKED);
-
-error_inst:
-	key_revoke(authkey);
+error_put_authkey:
 	key_put(authkey);
-error_alloc:
-	key_put(rka->target_key);
-	key_put(rka->dest_keyring);
-	kfree(rka->callout_info);
-	kfree(rka);
+error_free_rka:
+	free_request_key_auth(rka);
+error:
 	kleave("= %d", ret);
 	return ERR_PTR(ret);
 }
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/security/keys/request_key.c linux-libre-3.2.97-gnu1/security/keys/request_key.c
--- linux-libre-3.2.96-gnu1/security/keys/request_key.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/security/keys/request_key.c	2018-01-01 15:51:06.000000000 -0500
@@ -267,11 +267,12 @@ static int construct_key(struct key *key
  * The keyring selected is returned with an extra reference upon it which the
  * caller must release.
  */
-static void construct_get_dest_keyring(struct key **_dest_keyring)
+static int construct_get_dest_keyring(struct key **_dest_keyring)
 {
 	struct request_key_auth *rka;
 	const struct cred *cred = current_cred();
 	struct key *dest_keyring = *_dest_keyring, *authkey;
+	int ret;
 
 	kenter("%p", dest_keyring);
 
@@ -280,6 +281,8 @@ static void construct_get_dest_keyring(s
 		/* the caller supplied one */
 		key_get(dest_keyring);
 	} else {
+		bool do_perm_check = true;
+
 		/* use a default keyring; falling through the cases until we
 		 * find one that we actually have */
 		switch (cred->jit_keyring) {
@@ -294,8 +297,10 @@ static void construct_get_dest_keyring(s
 					dest_keyring =
 						key_get(rka->dest_keyring);
 				up_read(&authkey->sem);
-				if (dest_keyring)
+				if (dest_keyring) {
+					do_perm_check = false;
 					break;
+				}
 			}
 
 		case KEY_REQKEY_DEFL_THREAD_KEYRING:
@@ -330,11 +335,29 @@ static void construct_get_dest_keyring(s
 		default:
 			BUG();
 		}
+
+		/*
+		 * Require Write permission on the keyring.  This is essential
+		 * because the default keyring may be the session keyring, and
+		 * joining a keyring only requires Search permission.
+		 *
+		 * However, this check is skipped for the "requestor keyring" so
+		 * that /sbin/request-key can itself use request_key() to add
+		 * keys to the original requestor's destination keyring.
+		 */
+		if (dest_keyring && do_perm_check) {
+			ret = key_permission(make_key_ref(dest_keyring, 1),
+					     KEY_WRITE);
+			if (ret) {
+				key_put(dest_keyring);
+				return ret;
+			}
+		}
 	}
 
 	*_dest_keyring = dest_keyring;
 	kleave(" [dk %d]", key_serial(dest_keyring));
-	return;
+	return 0;
 }
 
 /*
@@ -449,11 +472,15 @@ static struct key *construct_key_and_lin
 
 	kenter("");
 
-	user = key_user_lookup(current_fsuid(), current_user_ns());
-	if (!user)
-		return ERR_PTR(-ENOMEM);
+	ret = construct_get_dest_keyring(&dest_keyring);
+	if (ret)
+		goto error;
 
-	construct_get_dest_keyring(&dest_keyring);
+	user = key_user_lookup(current_fsuid(), current_user_ns());
+	if (!user) {
+		ret = -ENOMEM;
+		goto error_put_dest_keyring;
+	}
 
 	ret = construct_alloc_key(type, description, dest_keyring, flags, user,
 				  &key);
@@ -469,7 +496,7 @@ static struct key *construct_key_and_lin
 	} else if (ret == -EINPROGRESS) {
 		ret = 0;
 	} else {
-		goto couldnt_alloc_key;
+		goto error_put_dest_keyring;
 	}
 
 	key_put(dest_keyring);
@@ -479,8 +506,9 @@ static struct key *construct_key_and_lin
 construction_failed:
 	key_negate_and_link(key, key_negative_timeout, NULL, NULL);
 	key_put(key);
-couldnt_alloc_key:
+error_put_dest_keyring:
 	key_put(dest_keyring);
+error:
 	kleave(" = %d", ret);
 	return ERR_PTR(ret);
 }
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/security/keys/trusted.c linux-libre-3.2.97-gnu1/security/keys/trusted.c
--- linux-libre-3.2.96-gnu1/security/keys/trusted.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/security/keys/trusted.c	2018-01-01 15:51:06.000000000 -0500
@@ -69,7 +69,7 @@ static int TSS_sha1(const unsigned char
 	}
 
 	ret = crypto_shash_digest(&sdesc->shash, data, datalen, digest);
-	kfree(sdesc);
+	kzfree(sdesc);
 	return ret;
 }
 
@@ -113,7 +113,7 @@ static int TSS_rawhmac(unsigned char *di
 	if (!ret)
 		ret = crypto_shash_final(&sdesc->shash, digest);
 out:
-	kfree(sdesc);
+	kzfree(sdesc);
 	return ret;
 }
 
@@ -164,7 +164,7 @@ static int TSS_authhmac(unsigned char *d
 				  paramdigest, TPM_NONCE_SIZE, h1,
 				  TPM_NONCE_SIZE, h2, 1, &c, 0, 0);
 out:
-	kfree(sdesc);
+	kzfree(sdesc);
 	return ret;
 }
 
@@ -245,7 +245,7 @@ static int TSS_checkhmac1(unsigned char
 	if (memcmp(testhmac, authdata, SHA1_DIGEST_SIZE))
 		ret = -EINVAL;
 out:
-	kfree(sdesc);
+	kzfree(sdesc);
 	return ret;
 }
 
@@ -346,7 +346,7 @@ static int TSS_checkhmac2(unsigned char
 	if (memcmp(testhmac2, authdata2, SHA1_DIGEST_SIZE))
 		ret = -EINVAL;
 out:
-	kfree(sdesc);
+	kzfree(sdesc);
 	return ret;
 }
 
@@ -396,7 +396,7 @@ static int my_get_random(unsigned char *
 		return -ENOMEM;
 	ret = tpm_get_random(tb, buf, len);
 
-	kfree(tb);
+	kzfree(tb);
 	return ret;
 }
 
@@ -595,7 +595,7 @@ static int tpm_seal(struct tpm_buf *tb,
 		*bloblen = storedsize;
 	}
 out:
-	kfree(td);
+	kzfree(td);
 	return ret;
 }
 
@@ -709,7 +709,7 @@ static int key_seal(struct trusted_key_p
 	if (ret < 0)
 		pr_info("trusted_key: srkseal failed (%d)\n", ret);
 
-	kfree(tb);
+	kzfree(tb);
 	return ret;
 }
 
@@ -734,7 +734,7 @@ static int key_unseal(struct trusted_key
 		/* pull migratable flag out of sealed key */
 		p->migratable = p->key[--p->key_len];
 
-	kfree(tb);
+	kzfree(tb);
 	return ret;
 }
 
@@ -990,12 +990,12 @@ static int trusted_instantiate(struct ke
 	if (!ret && options->pcrlock)
 		ret = pcrlock(options->pcrlock);
 out:
-	kfree(datablob);
-	kfree(options);
+	kzfree(datablob);
+	kzfree(options);
 	if (!ret)
 		rcu_assign_pointer(key->payload.data, payload);
 	else
-		kfree(payload);
+		kzfree(payload);
 	return ret;
 }
 
@@ -1004,8 +1004,7 @@ static void trusted_rcu_free(struct rcu_
 	struct trusted_key_payload *p;
 
 	p = container_of(rcu, struct trusted_key_payload, rcu);
-	memset(p->key, 0, p->key_len);
-	kfree(p);
+	kzfree(p);
 }
 
 /*
@@ -1043,7 +1042,7 @@ static int trusted_update(struct key *ke
 	ret = datablob_parse(datablob, new_p, new_o);
 	if (ret != Opt_update) {
 		ret = -EINVAL;
-		kfree(new_p);
+		kzfree(new_p);
 		goto out;
 	}
 	/* copy old key values, and reseal with new pcrs */
@@ -1056,22 +1055,22 @@ static int trusted_update(struct key *ke
 	ret = key_seal(new_p, new_o);
 	if (ret < 0) {
 		pr_info("trusted_key: key_seal failed (%d)\n", ret);
-		kfree(new_p);
+		kzfree(new_p);
 		goto out;
 	}
 	if (new_o->pcrlock) {
 		ret = pcrlock(new_o->pcrlock);
 		if (ret < 0) {
 			pr_info("trusted_key: pcrlock failed (%d)\n", ret);
-			kfree(new_p);
+			kzfree(new_p);
 			goto out;
 		}
 	}
 	rcu_assign_pointer(key->payload.data, new_p);
 	call_rcu(&p->rcu, trusted_rcu_free);
 out:
-	kfree(datablob);
-	kfree(new_o);
+	kzfree(datablob);
+	kzfree(new_o);
 	return ret;
 }
 
@@ -1090,34 +1089,30 @@ static long trusted_read(const struct ke
 	p = rcu_dereference_key(key);
 	if (!p)
 		return -EINVAL;
-	if (!buffer || buflen <= 0)
-		return 2 * p->blob_len;
-	ascii_buf = kmalloc(2 * p->blob_len, GFP_KERNEL);
-	if (!ascii_buf)
-		return -ENOMEM;
 
-	bufp = ascii_buf;
-	for (i = 0; i < p->blob_len; i++)
-		bufp = hex_byte_pack(bufp, p->blob[i]);
-	if ((copy_to_user(buffer, ascii_buf, 2 * p->blob_len)) != 0) {
-		kfree(ascii_buf);
-		return -EFAULT;
+	if (buffer && buflen >= 2 * p->blob_len) {
+		ascii_buf = kmalloc(2 * p->blob_len, GFP_KERNEL);
+		if (!ascii_buf)
+			return -ENOMEM;
+
+		bufp = ascii_buf;
+		for (i = 0; i < p->blob_len; i++)
+			bufp = hex_byte_pack(bufp, p->blob[i]);
+		if (copy_to_user(buffer, ascii_buf, 2 * p->blob_len) != 0) {
+			kzfree(ascii_buf);
+			return -EFAULT;
+		}
+		kzfree(ascii_buf);
 	}
-	kfree(ascii_buf);
 	return 2 * p->blob_len;
 }
 
 /*
- * trusted_destroy - before freeing the key, clear the decrypted data
+ * trusted_destroy - clear and free the key's payload
  */
 static void trusted_destroy(struct key *key)
 {
-	struct trusted_key_payload *p = key->payload.data;
-
-	if (!p)
-		return;
-	memset(p->key, 0, p->key_len);
-	kfree(key->payload.data);
+	kzfree(key->payload.data);
 }
 
 struct key_type key_type_trusted = {
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/security/selinux/hooks.c linux-libre-3.2.97-gnu1/security/selinux/hooks.c
--- linux-libre-3.2.96-gnu1/security/selinux/hooks.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/security/selinux/hooks.c	2018-01-01 15:51:06.000000000 -0500
@@ -1845,7 +1845,7 @@ static int selinux_ptrace_access_check(s
 	if (rc)
 		return rc;
 
-	if (mode == PTRACE_MODE_READ) {
+	if (mode & PTRACE_MODE_READ) {
 		u32 sid = current_sid();
 		u32 csid = task_sid(child);
 		return avc_has_perm(sid, csid, SECCLASS_FILE, FILE__READ, NULL);
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/security/smack/smack_lsm.c linux-libre-3.2.97-gnu1/security/smack/smack_lsm.c
--- linux-libre-3.2.96-gnu1/security/smack/smack_lsm.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/security/smack/smack_lsm.c	2018-01-01 15:51:06.000000000 -0500
@@ -583,7 +583,7 @@ static int smack_inode_init_security(str
 	}
 
 	if (len)
-		*len = strlen(isp) + 1;
+		*len = strlen(isp);
 
 	return 0;
 }
@@ -940,7 +940,7 @@ static int smack_inode_removexattr(struc
  * @inode: the object
  * @name: attribute name
  * @buffer: where to put the result
- * @alloc: unused
+ * @alloc: duplicate memory
  *
  * Returns the size of the attribute or an error code
  */
@@ -953,43 +953,38 @@ static int smack_inode_getsecurity(const
 	struct super_block *sbp;
 	struct inode *ip = (struct inode *)inode;
 	char *isp;
-	int ilen;
-	int rc = 0;
 
-	if (strcmp(name, XATTR_SMACK_SUFFIX) == 0) {
+	if (strcmp(name, XATTR_SMACK_SUFFIX) == 0)
 		isp = smk_of_inode(inode);
-		ilen = strlen(isp) + 1;
-		*buffer = isp;
-		return ilen;
-	}
-
-	/*
-	 * The rest of the Smack xattrs are only on sockets.
-	 */
-	sbp = ip->i_sb;
-	if (sbp->s_magic != SOCKFS_MAGIC)
-		return -EOPNOTSUPP;
+	else {
+		/*
+		 * The rest of the Smack xattrs are only on sockets.
+		 */
+		sbp = ip->i_sb;
+		if (sbp->s_magic != SOCKFS_MAGIC)
+			return -EOPNOTSUPP;
 
-	sock = SOCKET_I(ip);
-	if (sock == NULL || sock->sk == NULL)
-		return -EOPNOTSUPP;
+		sock = SOCKET_I(ip);
+		if (sock == NULL || sock->sk == NULL)
+			return -EOPNOTSUPP;
 
-	ssp = sock->sk->sk_security;
+		ssp = sock->sk->sk_security;
 
-	if (strcmp(name, XATTR_SMACK_IPIN) == 0)
-		isp = ssp->smk_in;
-	else if (strcmp(name, XATTR_SMACK_IPOUT) == 0)
-		isp = ssp->smk_out;
-	else
-		return -EOPNOTSUPP;
+		if (strcmp(name, XATTR_SMACK_IPIN) == 0)
+			isp = ssp->smk_in;
+		else if (strcmp(name, XATTR_SMACK_IPOUT) == 0)
+			isp = ssp->smk_out;
+		else
+			return -EOPNOTSUPP;
+	}
 
-	ilen = strlen(isp) + 1;
-	if (rc == 0) {
-		*buffer = isp;
-		rc = ilen;
+	if (alloc) {
+		*buffer = kstrdup(isp, GFP_KERNEL);
+		if (*buffer == NULL)
+			return -ENOMEM;
 	}
 
-	return rc;
+	return strlen(isp);
 }
 
 
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/sound/core/hrtimer.c linux-libre-3.2.97-gnu1/sound/core/hrtimer.c
--- linux-libre-3.2.96-gnu1/sound/core/hrtimer.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/sound/core/hrtimer.c	2018-01-01 15:51:06.000000000 -0500
@@ -145,6 +145,7 @@ static int __init snd_hrtimer_init(void)
 	timer->hw = hrtimer_hw;
 	timer->hw.resolution = resolution;
 	timer->hw.ticks = NANO_SEC / resolution;
+	timer->max_instances = 100; /* lower the limit */
 
 	err = snd_timer_global_register(timer);
 	if (err < 0) {
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/sound/core/seq/oss/seq_oss_midi.c linux-libre-3.2.97-gnu1/sound/core/seq/oss/seq_oss_midi.c
--- linux-libre-3.2.96-gnu1/sound/core/seq/oss/seq_oss_midi.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/sound/core/seq/oss/seq_oss_midi.c	2018-01-01 15:51:06.000000000 -0500
@@ -618,9 +618,7 @@ send_midi_event(struct seq_oss_devinfo *
 	if (!dp->timer->running)
 		len = snd_seq_oss_timer_start(dp->timer);
 	if (ev->type == SNDRV_SEQ_EVENT_SYSEX) {
-		if ((ev->flags & SNDRV_SEQ_EVENT_LENGTH_MASK) == SNDRV_SEQ_EVENT_LENGTH_VARIABLE)
-			snd_seq_oss_readq_puts(dp->readq, mdev->seq_device,
-					       ev->data.ext.ptr, ev->data.ext.len);
+		snd_seq_oss_readq_sysex(dp->readq, mdev->seq_device, ev);
 	} else {
 		len = snd_midi_event_decode(mdev->coder, msg, sizeof(msg), ev);
 		if (len > 0)
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/sound/core/seq/oss/seq_oss_readq.c linux-libre-3.2.97-gnu1/sound/core/seq/oss/seq_oss_readq.c
--- linux-libre-3.2.96-gnu1/sound/core/seq/oss/seq_oss_readq.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/sound/core/seq/oss/seq_oss_readq.c	2018-01-01 15:51:06.000000000 -0500
@@ -120,6 +120,35 @@ snd_seq_oss_readq_puts(struct seq_oss_re
 }
 
 /*
+ * put MIDI sysex bytes; the event buffer may be chained, thus it has
+ * to be expanded via snd_seq_dump_var_event().
+ */
+struct readq_sysex_ctx {
+	struct seq_oss_readq *readq;
+	int dev;
+};
+
+static int readq_dump_sysex(void *ptr, void *buf, int count)
+{
+	struct readq_sysex_ctx *ctx = ptr;
+
+	return snd_seq_oss_readq_puts(ctx->readq, ctx->dev, buf, count);
+}
+
+int snd_seq_oss_readq_sysex(struct seq_oss_readq *q, int dev,
+			    struct snd_seq_event *ev)
+{
+	struct readq_sysex_ctx ctx = {
+		.readq = q,
+		.dev = dev
+	};
+
+	if ((ev->flags & SNDRV_SEQ_EVENT_LENGTH_MASK) != SNDRV_SEQ_EVENT_LENGTH_VARIABLE)
+		return 0;
+	return snd_seq_dump_var_event(ev, readq_dump_sysex, &ctx);
+}
+
+/*
  * copy an event to input queue:
  * return zero if enqueued
  */
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/sound/core/seq/oss/seq_oss_readq.h linux-libre-3.2.97-gnu1/sound/core/seq/oss/seq_oss_readq.h
--- linux-libre-3.2.96-gnu1/sound/core/seq/oss/seq_oss_readq.h	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/sound/core/seq/oss/seq_oss_readq.h	2018-01-01 15:51:06.000000000 -0500
@@ -44,6 +44,8 @@ void snd_seq_oss_readq_delete(struct seq
 void snd_seq_oss_readq_clear(struct seq_oss_readq *readq);
 unsigned int snd_seq_oss_readq_poll(struct seq_oss_readq *readq, struct file *file, poll_table *wait);
 int snd_seq_oss_readq_puts(struct seq_oss_readq *readq, int dev, unsigned char *data, int len);
+int snd_seq_oss_readq_sysex(struct seq_oss_readq *q, int dev,
+			    struct snd_seq_event *ev);
 int snd_seq_oss_readq_put_event(struct seq_oss_readq *readq, union evrec *ev);
 int snd_seq_oss_readq_put_timestamp(struct seq_oss_readq *readq, unsigned long curt, int seq_mode);
 int snd_seq_oss_readq_pick(struct seq_oss_readq *q, union evrec *rec);
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/sound/core/seq/seq_clientmgr.c linux-libre-3.2.97-gnu1/sound/core/seq/seq_clientmgr.c
--- linux-libre-3.2.96-gnu1/sound/core/seq/seq_clientmgr.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/sound/core/seq/seq_clientmgr.c	2018-01-01 15:51:06.000000000 -0500
@@ -676,7 +676,7 @@ static int deliver_to_subscribers(struct
 	if (atomic)
 		read_lock(&grp->list_lock);
 	else
-		down_read(&grp->list_mutex);
+		down_read_nested(&grp->list_mutex, hop);
 	list_for_each_entry(subs, &grp->list_head, src_list) {
 		/* both ports ready? */
 		if (atomic_read(&subs->ref_count) != 2)
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/sound/core/seq/seq_virmidi.c linux-libre-3.2.97-gnu1/sound/core/seq/seq_virmidi.c
--- linux-libre-3.2.96-gnu1/sound/core/seq/seq_virmidi.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/sound/core/seq/seq_virmidi.c	2018-01-01 15:51:06.000000000 -0500
@@ -77,13 +77,17 @@ static void snd_virmidi_init_event(struc
  * decode input event and put to read buffer of each opened file
  */
 static int snd_virmidi_dev_receive_event(struct snd_virmidi_dev *rdev,
-					 struct snd_seq_event *ev)
+					 struct snd_seq_event *ev,
+					 bool atomic)
 {
 	struct snd_virmidi *vmidi;
 	unsigned char msg[4];
 	int len;
 
-	read_lock(&rdev->filelist_lock);
+	if (atomic)
+		read_lock(&rdev->filelist_lock);
+	else
+		down_read(&rdev->filelist_sem);
 	list_for_each_entry(vmidi, &rdev->filelist, list) {
 		if (!vmidi->trigger)
 			continue;
@@ -97,7 +101,10 @@ static int snd_virmidi_dev_receive_event
 				snd_rawmidi_receive(vmidi->substream, msg, len);
 		}
 	}
-	read_unlock(&rdev->filelist_lock);
+	if (atomic)
+		read_unlock(&rdev->filelist_lock);
+	else
+		up_read(&rdev->filelist_sem);
 
 	return 0;
 }
@@ -115,7 +122,7 @@ int snd_virmidi_receive(struct snd_rawmi
 	struct snd_virmidi_dev *rdev;
 
 	rdev = rmidi->private_data;
-	return snd_virmidi_dev_receive_event(rdev, ev);
+	return snd_virmidi_dev_receive_event(rdev, ev, true);
 }
 #endif  /*  0  */
 
@@ -130,7 +137,7 @@ static int snd_virmidi_event_input(struc
 	rdev = private_data;
 	if (!(rdev->flags & SNDRV_VIRMIDI_USE))
 		return 0; /* ignored */
-	return snd_virmidi_dev_receive_event(rdev, ev);
+	return snd_virmidi_dev_receive_event(rdev, ev, atomic);
 }
 
 /*
@@ -209,7 +216,6 @@ static int snd_virmidi_input_open(struct
 	struct snd_virmidi_dev *rdev = substream->rmidi->private_data;
 	struct snd_rawmidi_runtime *runtime = substream->runtime;
 	struct snd_virmidi *vmidi;
-	unsigned long flags;
 
 	vmidi = kzalloc(sizeof(*vmidi), GFP_KERNEL);
 	if (vmidi == NULL)
@@ -223,9 +229,11 @@ static int snd_virmidi_input_open(struct
 	vmidi->client = rdev->client;
 	vmidi->port = rdev->port;	
 	runtime->private_data = vmidi;
-	write_lock_irqsave(&rdev->filelist_lock, flags);
+	down_write(&rdev->filelist_sem);
+	write_lock_irq(&rdev->filelist_lock);
 	list_add_tail(&vmidi->list, &rdev->filelist);
-	write_unlock_irqrestore(&rdev->filelist_lock, flags);
+	write_unlock_irq(&rdev->filelist_lock);
+	up_write(&rdev->filelist_sem);
 	vmidi->rdev = rdev;
 	return 0;
 }
@@ -264,9 +272,11 @@ static int snd_virmidi_input_close(struc
 	struct snd_virmidi_dev *rdev = substream->rmidi->private_data;
 	struct snd_virmidi *vmidi = substream->runtime->private_data;
 
+	down_write(&rdev->filelist_sem);
 	write_lock_irq(&rdev->filelist_lock);
 	list_del(&vmidi->list);
 	write_unlock_irq(&rdev->filelist_lock);
+	up_write(&rdev->filelist_sem);
 	snd_midi_event_free(vmidi->parser);
 	substream->runtime->private_data = NULL;
 	kfree(vmidi);
@@ -520,6 +530,7 @@ int snd_virmidi_new(struct snd_card *car
 	rdev->rmidi = rmidi;
 	rdev->device = device;
 	rdev->client = -1;
+	init_rwsem(&rdev->filelist_sem);
 	rwlock_init(&rdev->filelist_lock);
 	INIT_LIST_HEAD(&rdev->filelist);
 	rdev->seq_mode = SNDRV_VIRMIDI_SEQ_DISPATCH;
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/sound/core/timer.c linux-libre-3.2.97-gnu1/sound/core/timer.c
--- linux-libre-3.2.96-gnu1/sound/core/timer.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/sound/core/timer.c	2018-01-01 15:51:06.000000000 -0500
@@ -179,7 +179,7 @@ static void snd_timer_request(struct snd
  *
  * call this with register_mutex down.
  */
-static void snd_timer_check_slave(struct snd_timer_instance *slave)
+static int snd_timer_check_slave(struct snd_timer_instance *slave)
 {
 	struct snd_timer *timer;
 	struct snd_timer_instance *master;
@@ -189,16 +189,21 @@ static void snd_timer_check_slave(struct
 		list_for_each_entry(master, &timer->open_list_head, open_list) {
 			if (slave->slave_class == master->slave_class &&
 			    slave->slave_id == master->slave_id) {
+				if (master->timer->num_instances >=
+				    master->timer->max_instances)
+					return -EBUSY;
 				list_move_tail(&slave->open_list,
 					       &master->slave_list_head);
+				master->timer->num_instances++;
 				spin_lock_irq(&slave_active_lock);
 				slave->master = master;
 				slave->timer = master->timer;
 				spin_unlock_irq(&slave_active_lock);
-				return;
+				return 0;
 			}
 		}
 	}
+	return 0;
 }
 
 /*
@@ -207,7 +212,7 @@ static void snd_timer_check_slave(struct
  *
  * call this with register_mutex down.
  */
-static void snd_timer_check_master(struct snd_timer_instance *master)
+static int snd_timer_check_master(struct snd_timer_instance *master)
 {
 	struct snd_timer_instance *slave, *tmp;
 
@@ -215,7 +220,11 @@ static void snd_timer_check_master(struc
 	list_for_each_entry_safe(slave, tmp, &snd_timer_slave_list, open_list) {
 		if (slave->slave_class == master->slave_class &&
 		    slave->slave_id == master->slave_id) {
+			if (master->timer->num_instances >=
+			    master->timer->max_instances)
+				return -EBUSY;
 			list_move_tail(&slave->open_list, &master->slave_list_head);
+			master->timer->num_instances++;
 			spin_lock_irq(&slave_active_lock);
 			spin_lock(&master->timer->lock);
 			slave->master = master;
@@ -227,8 +236,11 @@ static void snd_timer_check_master(struc
 			spin_unlock_irq(&slave_active_lock);
 		}
 	}
+	return 0;
 }
 
+static int snd_timer_close_locked(struct snd_timer_instance *timeri);
+
 /*
  * open a timer instance
  * when opening a master, the slave id must be here given.
@@ -239,6 +251,7 @@ int snd_timer_open(struct snd_timer_inst
 {
 	struct snd_timer *timer;
 	struct snd_timer_instance *timeri = NULL;
+	int err;
 
 	if (tid->dev_class == SNDRV_TIMER_CLASS_SLAVE) {
 		/* open a slave instance */
@@ -257,10 +270,14 @@ int snd_timer_open(struct snd_timer_inst
 		timeri->slave_id = tid->device;
 		timeri->flags |= SNDRV_TIMER_IFLG_SLAVE;
 		list_add_tail(&timeri->open_list, &snd_timer_slave_list);
-		snd_timer_check_slave(timeri);
+		err = snd_timer_check_slave(timeri);
+		if (err < 0) {
+			snd_timer_close_locked(timeri);
+			timeri = NULL;
+		}
 		mutex_unlock(&register_mutex);
 		*ti = timeri;
-		return 0;
+		return err;
 	}
 
 	/* open a master instance */
@@ -286,6 +303,10 @@ int snd_timer_open(struct snd_timer_inst
 			return -EBUSY;
 		}
 	}
+	if (timer->num_instances >= timer->max_instances) {
+		mutex_unlock(&register_mutex);
+		return -EBUSY;
+	}
 	timeri = snd_timer_instance_new(owner, timer);
 	if (!timeri) {
 		mutex_unlock(&register_mutex);
@@ -307,44 +328,36 @@ int snd_timer_open(struct snd_timer_inst
 	}
 
 	list_add_tail(&timeri->open_list, &timer->open_list_head);
-	snd_timer_check_master(timeri);
+	timer->num_instances++;
+	err = snd_timer_check_master(timeri);
+	if (err < 0) {
+		snd_timer_close_locked(timeri);
+		timeri = NULL;
+	}
 	mutex_unlock(&register_mutex);
 	*ti = timeri;
-	return 0;
+	return err;
 }
 
 static int _snd_timer_stop(struct snd_timer_instance *timeri, int event);
 
 /*
  * close a timer instance
+ * call this with register_mutex down.
  */
-int snd_timer_close(struct snd_timer_instance *timeri)
+static int snd_timer_close_locked(struct snd_timer_instance *timeri)
 {
 	struct snd_timer *timer = NULL;
 	struct snd_timer_instance *slave, *tmp;
 
-	if (snd_BUG_ON(!timeri))
-		return -ENXIO;
+	list_del(&timeri->open_list);
 
 	/* force to stop the timer */
 	snd_timer_stop(timeri);
 
-	if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE) {
-		/* wait, until the active callback is finished */
-		spin_lock_irq(&slave_active_lock);
-		while (timeri->flags & SNDRV_TIMER_IFLG_CALLBACK) {
-			spin_unlock_irq(&slave_active_lock);
-			udelay(10);
-			spin_lock_irq(&slave_active_lock);
-		}
-		spin_unlock_irq(&slave_active_lock);
-		mutex_lock(&register_mutex);
-		list_del(&timeri->open_list);
-		mutex_unlock(&register_mutex);
-	} else {
-		timer = timeri->timer;
-		if (snd_BUG_ON(!timer))
-			goto out;
+	timer = timeri->timer;
+	if (timer) {
+		timer->num_instances--;
 		/* wait, until the active callback is finished */
 		spin_lock_irq(&timer->lock);
 		while (timeri->flags & SNDRV_TIMER_IFLG_CALLBACK) {
@@ -353,17 +366,14 @@ int snd_timer_close(struct snd_timer_ins
 			spin_lock_irq(&timer->lock);
 		}
 		spin_unlock_irq(&timer->lock);
-		mutex_lock(&register_mutex);
-		list_del(&timeri->open_list);
-		if (list_empty(&timer->open_list_head) &&
-		    timer->hw.close)
-			timer->hw.close(timer);
+
 		/* remove slave links */
 		spin_lock_irq(&slave_active_lock);
 		spin_lock(&timer->lock);
 		list_for_each_entry_safe(slave, tmp, &timeri->slave_list_head,
 					 open_list) {
 			list_move_tail(&slave->open_list, &snd_timer_slave_list);
+			timer->num_instances--;
 			slave->master = NULL;
 			slave->timer = NULL;
 			list_del_init(&slave->ack_list);
@@ -371,18 +381,42 @@ int snd_timer_close(struct snd_timer_ins
 		}
 		spin_unlock(&timer->lock);
 		spin_unlock_irq(&slave_active_lock);
-		mutex_unlock(&register_mutex);
+
+		/* slave doesn't need to release timer resources below */
+		if (timeri->flags & SNDRV_TIMER_IFLG_SLAVE)
+			timer = NULL;
 	}
- out:
+
 	if (timeri->private_free)
 		timeri->private_free(timeri);
 	kfree(timeri->owner);
 	kfree(timeri);
-	if (timer)
+
+	if (timer) {
+		if (list_empty(&timer->open_list_head) && timer->hw.close)
+			timer->hw.close(timer);
 		module_put(timer->module);
+	}
+
 	return 0;
 }
 
+/*
+ * close a timer instance
+ */
+int snd_timer_close(struct snd_timer_instance *timeri)
+{
+	int err;
+
+	if (snd_BUG_ON(!timeri))
+		return -ENXIO;
+
+	mutex_lock(&register_mutex);
+	err = snd_timer_close_locked(timeri);
+	mutex_unlock(&register_mutex);
+	return err;
+}
+
 unsigned long snd_timer_resolution(struct snd_timer_instance *timeri)
 {
 	struct snd_timer * timer;
@@ -847,6 +881,7 @@ int snd_timer_new(struct snd_card *card,
 	spin_lock_init(&timer->lock);
 	tasklet_init(&timer->task_queue, snd_timer_tasklet,
 		     (unsigned long)timer);
+	timer->max_instances = 1000; /* default limit per timer */
 	if (card != NULL) {
 		timer->module = card->module;
 		err = snd_device_new(card, SNDRV_DEV_TIMER, timer, &ops);
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/sound/core/timer_compat.c linux-libre-3.2.97-gnu1/sound/core/timer_compat.c
--- linux-libre-3.2.96-gnu1/sound/core/timer_compat.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/sound/core/timer_compat.c	2018-01-01 15:51:06.000000000 -0500
@@ -97,7 +97,8 @@ enum {
 	SNDRV_TIMER_IOCTL_STATUS32 = _IOW('T', 0x14, struct snd_timer_status32),
 };
 
-static long snd_timer_user_ioctl_compat(struct file *file, unsigned int cmd, unsigned long arg)
+static long __snd_timer_user_ioctl_compat(struct file *file, unsigned int cmd,
+					  unsigned long arg)
 {
 	void __user *argp = compat_ptr(arg);
 
@@ -118,7 +119,7 @@ static long snd_timer_user_ioctl_compat(
 	case SNDRV_TIMER_IOCTL_PAUSE:
 	case SNDRV_TIMER_IOCTL_PAUSE_OLD:
 	case SNDRV_TIMER_IOCTL_NEXT_DEVICE:
-		return snd_timer_user_ioctl(file, cmd, (unsigned long)argp);
+		return __snd_timer_user_ioctl(file, cmd, (unsigned long)argp);
 	case SNDRV_TIMER_IOCTL_INFO32:
 		return snd_timer_user_info_compat(file, argp);
 	case SNDRV_TIMER_IOCTL_STATUS32:
@@ -126,3 +127,15 @@ static long snd_timer_user_ioctl_compat(
 	}
 	return -ENOIOCTLCMD;
 }
+
+static long snd_timer_user_ioctl_compat(struct file *file, unsigned int cmd,
+					unsigned long arg)
+{
+	struct snd_timer_user *tu = file->private_data;
+	long ret;
+
+	mutex_lock(&tu->ioctl_lock);
+	ret = __snd_timer_user_ioctl_compat(file, cmd, arg);
+	mutex_unlock(&tu->ioctl_lock);
+	return ret;
+}
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/sound/usb/caiaq/device.c linux-libre-3.2.97-gnu1/sound/usb/caiaq/device.c
--- linux-libre-3.2.96-gnu1/sound/usb/caiaq/device.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/sound/usb/caiaq/device.c	2018-01-01 15:51:06.000000000 -0500
@@ -440,10 +440,12 @@ static int __devinit init_card(struct sn
 
 	err = snd_usb_caiaq_send_command(dev, EP1_CMD_GET_DEVICE_INFO, NULL, 0);
 	if (err)
-		return err;
+		goto err_kill_urb;
 
-	if (!wait_event_timeout(dev->ep1_wait_queue, dev->spec_received, HZ))
-		return -ENODEV;
+	if (!wait_event_timeout(dev->ep1_wait_queue, dev->spec_received, HZ)) {
+		err = -ENODEV;
+		goto err_kill_urb;
+	}
 
 	usb_string(usb_dev, usb_dev->descriptor.iManufacturer,
 		   dev->vendor_name, CAIAQ_USB_STR_LEN);
@@ -479,6 +481,10 @@ static int __devinit init_card(struct sn
 
 	setup_card(dev);
 	return 0;
+
+ err_kill_urb:
+	usb_kill_urb(&dev->ep1_in_urb);
+	return err;
 }
 
 static int __devinit snd_probe(struct usb_interface *intf,
diff -druNp --no-dereference linux-libre-3.2.96-gnu1/sound/usb/usx2y/usb_stream.c linux-libre-3.2.97-gnu1/sound/usb/usx2y/usb_stream.c
--- linux-libre-3.2.96-gnu1/sound/usb/usx2y/usb_stream.c	2017-11-26 08:51:12.000000000 -0500
+++ linux-libre-3.2.97-gnu1/sound/usb/usx2y/usb_stream.c	2018-01-01 15:51:06.000000000 -0500
@@ -192,7 +192,8 @@ struct usb_stream *usb_stream_new(struct
 	}
 
 	pg = get_order(read_size);
-	sk->s = (void *) __get_free_pages(GFP_KERNEL|__GFP_COMP|__GFP_ZERO, pg);
+	sk->s = (void *) __get_free_pages(GFP_KERNEL|__GFP_COMP|__GFP_ZERO|
+					  __GFP_NOWARN, pg);
 	if (!sk->s) {
 		snd_printk(KERN_WARNING "couldn't __get_free_pages()\n");
 		goto out;
@@ -212,7 +213,8 @@ struct usb_stream *usb_stream_new(struct
 	pg = get_order(write_size);
 
 	sk->write_page =
-		(void *)__get_free_pages(GFP_KERNEL|__GFP_COMP|__GFP_ZERO, pg);
+		(void *)__get_free_pages(GFP_KERNEL|__GFP_COMP|__GFP_ZERO|
+					 __GFP_NOWARN, pg);
 	if (!sk->write_page) {
 		snd_printk(KERN_WARNING "couldn't __get_free_pages()\n");
 		usb_stream_free(sk);
