diff -druNp --no-dereference linux-libre-4.1.50-gnu/arch/arm/include/asm/kvm_emulate.h linux-libre-4.1.51-gnu/arch/arm/include/asm/kvm_emulate.h
--- linux-libre-4.1.50-gnu/arch/arm/include/asm/kvm_emulate.h	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/arch/arm/include/asm/kvm_emulate.h	2018-03-27 16:15:21.000000000 -0400
@@ -28,6 +28,18 @@
 unsigned long *vcpu_reg(struct kvm_vcpu *vcpu, u8 reg_num);
 unsigned long *vcpu_spsr(struct kvm_vcpu *vcpu);
 
+static inline unsigned long vcpu_get_reg(struct kvm_vcpu *vcpu,
+					 u8 reg_num)
+{
+	return *vcpu_reg(vcpu, reg_num);
+}
+
+static inline void vcpu_set_reg(struct kvm_vcpu *vcpu, u8 reg_num,
+				unsigned long val)
+{
+	*vcpu_reg(vcpu, reg_num) = val;
+}
+
 bool kvm_condition_valid(struct kvm_vcpu *vcpu);
 void kvm_skip_instr(struct kvm_vcpu *vcpu, bool is_wide_instr);
 void kvm_inject_undefined(struct kvm_vcpu *vcpu);
diff -druNp --no-dereference linux-libre-4.1.50-gnu/arch/arm/kvm/mmio.c linux-libre-4.1.51-gnu/arch/arm/kvm/mmio.c
--- linux-libre-4.1.50-gnu/arch/arm/kvm/mmio.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/arch/arm/kvm/mmio.c	2018-03-27 16:15:21.000000000 -0400
@@ -115,7 +115,7 @@ int kvm_handle_mmio_return(struct kvm_vc
 		trace_kvm_mmio(KVM_TRACE_MMIO_READ, len, run->mmio.phys_addr,
 			       &data);
 		data = vcpu_data_host_to_guest(vcpu, data, len);
-		*vcpu_reg(vcpu, vcpu->arch.mmio_decode.rt) = data;
+		vcpu_set_reg(vcpu, vcpu->arch.mmio_decode.rt, data);
 	}
 
 	return 0;
@@ -186,7 +186,8 @@ int io_mem_abort(struct kvm_vcpu *vcpu,
 	rt = vcpu->arch.mmio_decode.rt;
 
 	if (is_write) {
-		data = vcpu_data_guest_to_host(vcpu, *vcpu_reg(vcpu, rt), len);
+		data = vcpu_data_guest_to_host(vcpu, vcpu_get_reg(vcpu, rt),
+					       len);
 
 		trace_kvm_mmio(KVM_TRACE_MMIO_WRITE, len, fault_ipa, &data);
 		mmio_write_buf(data_buf, len, data);
diff -druNp --no-dereference linux-libre-4.1.50-gnu/arch/arm/mach-mvebu/Kconfig linux-libre-4.1.51-gnu/arch/arm/mach-mvebu/Kconfig
--- linux-libre-4.1.50-gnu/arch/arm/mach-mvebu/Kconfig	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/arch/arm/mach-mvebu/Kconfig	2018-03-27 16:15:21.000000000 -0400
@@ -37,7 +37,7 @@ config MACH_ARMADA_370
 config MACH_ARMADA_375
 	bool "Marvell Armada 375 boards" if ARCH_MULTI_V7
 	select ARM_ERRATA_720789
-	select ARM_ERRATA_753970
+	select PL310_ERRATA_753970
 	select ARM_GIC
 	select ARMADA_375_CLK
 	select HAVE_ARM_SCU
@@ -52,7 +52,7 @@ config MACH_ARMADA_375
 config MACH_ARMADA_38X
 	bool "Marvell Armada 380/385 boards" if ARCH_MULTI_V7
 	select ARM_ERRATA_720789
-	select ARM_ERRATA_753970
+	select PL310_ERRATA_753970
 	select ARM_GIC
 	select ARMADA_38X_CLK
 	select HAVE_ARM_SCU
diff -druNp --no-dereference linux-libre-4.1.50-gnu/arch/arm/mach-omap2/omap-secure.c linux-libre-4.1.51-gnu/arch/arm/mach-omap2/omap-secure.c
--- linux-libre-4.1.50-gnu/arch/arm/mach-omap2/omap-secure.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/arch/arm/mach-omap2/omap-secure.c	2018-03-27 16:15:21.000000000 -0400
@@ -73,6 +73,7 @@ phys_addr_t omap_secure_ram_mempool_base
 	return omap_secure_memblock_base;
 }
 
+#if defined(CONFIG_ARCH_OMAP3) && defined(CONFIG_PM)
 u32 omap3_save_secure_ram(void __iomem *addr, int size)
 {
 	u32 ret;
@@ -91,6 +92,7 @@ u32 omap3_save_secure_ram(void __iomem *
 
 	return ret;
 }
+#endif
 
 /**
  * rx51_secure_dispatcher: Routine to dispatch secure PPA API calls
diff -druNp --no-dereference linux-libre-4.1.50-gnu/arch/arm64/include/asm/kvm_emulate.h linux-libre-4.1.51-gnu/arch/arm64/include/asm/kvm_emulate.h
--- linux-libre-4.1.50-gnu/arch/arm64/include/asm/kvm_emulate.h	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/arch/arm64/include/asm/kvm_emulate.h	2018-03-27 16:15:21.000000000 -0400
@@ -109,6 +109,19 @@ static inline unsigned long *vcpu_reg(co
 	return (unsigned long *)&vcpu_gp_regs(vcpu)->regs.regs[reg_num];
 }
 
+static inline unsigned long vcpu_get_reg(const struct kvm_vcpu *vcpu,
+					 u8 reg_num)
+{
+	return (reg_num == 31) ? 0 : vcpu_gp_regs(vcpu)->regs.regs[reg_num];
+}
+
+static inline void vcpu_set_reg(struct kvm_vcpu *vcpu, u8 reg_num,
+				unsigned long val)
+{
+	if (reg_num != 31)
+		vcpu_gp_regs(vcpu)->regs.regs[reg_num] = val;
+}
+
 /* Get vcpu SPSR for current mode */
 static inline unsigned long *vcpu_spsr(const struct kvm_vcpu *vcpu)
 {
diff -druNp --no-dereference linux-libre-4.1.50-gnu/arch/mips/ath25/board.c linux-libre-4.1.51-gnu/arch/mips/ath25/board.c
--- linux-libre-4.1.50-gnu/arch/mips/ath25/board.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/arch/mips/ath25/board.c	2018-03-27 16:15:21.000000000 -0400
@@ -135,6 +135,8 @@ int __init ath25_find_config(phys_addr_t
 	}
 
 	board_data = kzalloc(BOARD_CONFIG_BUFSZ, GFP_KERNEL);
+	if (!board_data)
+		goto error;
 	ath25_board.config = (struct ath25_boarddata *)board_data;
 	memcpy_fromio(board_data, bcfg, 0x100);
 	if (broken_boarddata) {
diff -druNp --no-dereference linux-libre-4.1.50-gnu/arch/mips/cavium-octeon/octeon-irq.c linux-libre-4.1.51-gnu/arch/mips/cavium-octeon/octeon-irq.c
--- linux-libre-4.1.50-gnu/arch/mips/cavium-octeon/octeon-irq.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/arch/mips/cavium-octeon/octeon-irq.c	2018-03-27 16:15:21.000000000 -0400
@@ -2242,6 +2242,8 @@ static int __init octeon_irq_init_cib(st
 	}
 
 	host_data = kzalloc(sizeof(*host_data), GFP_KERNEL);
+	if (!host_data)
+		return -ENOMEM;
 	raw_spin_lock_init(&host_data->lock);
 
 	addr = of_get_address(ciu_node, 0, NULL, NULL);
diff -druNp --no-dereference linux-libre-4.1.50-gnu/arch/mips/kernel/smp-bmips.c linux-libre-4.1.51-gnu/arch/mips/kernel/smp-bmips.c
--- linux-libre-4.1.50-gnu/arch/mips/kernel/smp-bmips.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/arch/mips/kernel/smp-bmips.c	2018-03-27 16:15:21.000000000 -0400
@@ -166,11 +166,11 @@ static void bmips_prepare_cpus(unsigned
 		return;
 	}
 
-	if (request_irq(IPI0_IRQ, bmips_ipi_interrupt, IRQF_PERCPU,
-			"smp_ipi0", NULL))
+	if (request_irq(IPI0_IRQ, bmips_ipi_interrupt,
+			IRQF_PERCPU | IRQF_NO_SUSPEND, "smp_ipi0", NULL))
 		panic("Can't request IPI0 interrupt");
-	if (request_irq(IPI1_IRQ, bmips_ipi_interrupt, IRQF_PERCPU,
-			"smp_ipi1", NULL))
+	if (request_irq(IPI1_IRQ, bmips_ipi_interrupt,
+			IRQF_PERCPU | IRQF_NO_SUSPEND, "smp_ipi1", NULL))
 		panic("Can't request IPI1 interrupt");
 }
 
diff -druNp --no-dereference linux-libre-4.1.50-gnu/arch/sh/boards/mach-se/770x/setup.c linux-libre-4.1.51-gnu/arch/sh/boards/mach-se/770x/setup.c
--- linux-libre-4.1.50-gnu/arch/sh/boards/mach-se/770x/setup.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/arch/sh/boards/mach-se/770x/setup.c	2018-03-27 16:15:21.000000000 -0400
@@ -8,6 +8,7 @@
  */
 #include <linux/init.h>
 #include <linux/platform_device.h>
+#include <linux/sh_eth.h>
 #include <mach-se/mach/se.h>
 #include <mach-se/mach/mrshpc.h>
 #include <asm/machvec.h>
@@ -114,6 +115,11 @@ static struct platform_device heartbeat_
 #if defined(CONFIG_CPU_SUBTYPE_SH7710) ||\
 	defined(CONFIG_CPU_SUBTYPE_SH7712)
 /* SH771X Ethernet driver */
+static struct sh_eth_plat_data sh_eth_plat = {
+	.phy = PHY_ID,
+	.phy_interface = PHY_INTERFACE_MODE_MII,
+};
+
 static struct resource sh_eth0_resources[] = {
 	[0] = {
 		.start = SH_ETH0_BASE,
@@ -131,7 +137,7 @@ static struct platform_device sh_eth0_de
 	.name = "sh771x-ether",
 	.id = 0,
 	.dev = {
-		.platform_data = PHY_ID,
+		.platform_data = &sh_eth_plat,
 	},
 	.num_resources = ARRAY_SIZE(sh_eth0_resources),
 	.resource = sh_eth0_resources,
@@ -154,7 +160,7 @@ static struct platform_device sh_eth1_de
 	.name = "sh771x-ether",
 	.id = 1,
 	.dev = {
-		.platform_data = PHY_ID,
+		.platform_data = &sh_eth_plat,
 	},
 	.num_resources = ARRAY_SIZE(sh_eth1_resources),
 	.resource = sh_eth1_resources,
diff -druNp --no-dereference linux-libre-4.1.50-gnu/arch/x86/kernel/cpu/mcheck/mce.c linux-libre-4.1.51-gnu/arch/x86/kernel/cpu/mcheck/mce.c
--- linux-libre-4.1.50-gnu/arch/x86/kernel/cpu/mcheck/mce.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/arch/x86/kernel/cpu/mcheck/mce.c	2018-03-27 16:15:21.000000000 -0400
@@ -57,6 +57,9 @@ static DEFINE_MUTEX(mce_chrdev_read_mute
 			      rcu_read_lock_sched_held() || \
 			      lockdep_is_held(&mce_chrdev_read_mutex))
 
+/* sysfs synchronization */
+static DEFINE_MUTEX(mce_sysfs_mutex);
+
 #define CREATE_TRACE_POINTS
 #include <trace/events/mce.h>
 
@@ -2183,6 +2186,7 @@ static ssize_t set_ignore_ce(struct devi
 	if (kstrtou64(buf, 0, &new) < 0)
 		return -EINVAL;
 
+	mutex_lock(&mce_sysfs_mutex);
 	if (mca_cfg.ignore_ce ^ !!new) {
 		if (new) {
 			/* disable ce features */
@@ -2195,6 +2199,8 @@ static ssize_t set_ignore_ce(struct devi
 			on_each_cpu(mce_enable_ce, (void *)1, 1);
 		}
 	}
+	mutex_unlock(&mce_sysfs_mutex);
+
 	return size;
 }
 
@@ -2207,6 +2213,7 @@ static ssize_t set_cmci_disabled(struct
 	if (kstrtou64(buf, 0, &new) < 0)
 		return -EINVAL;
 
+	mutex_lock(&mce_sysfs_mutex);
 	if (mca_cfg.cmci_disabled ^ !!new) {
 		if (new) {
 			/* disable cmci */
@@ -2218,6 +2225,8 @@ static ssize_t set_cmci_disabled(struct
 			on_each_cpu(mce_enable_ce, NULL, 1);
 		}
 	}
+	mutex_unlock(&mce_sysfs_mutex);
+
 	return size;
 }
 
@@ -2225,8 +2234,19 @@ static ssize_t store_int_with_restart(st
 				      struct device_attribute *attr,
 				      const char *buf, size_t size)
 {
-	ssize_t ret = device_store_int(s, attr, buf, size);
+	unsigned long old_check_interval = check_interval;
+	ssize_t ret = device_store_ulong(s, attr, buf, size);
+
+	if (check_interval == old_check_interval)
+		return ret;
+
+	if (check_interval < 1)
+		check_interval = 1;
+
+	mutex_lock(&mce_sysfs_mutex);
 	mce_restart();
+	mutex_unlock(&mce_sysfs_mutex);
+
 	return ret;
 }
 
diff -druNp --no-dereference linux-libre-4.1.50-gnu/arch/x86/kernel/machine_kexec_64.c linux-libre-4.1.51-gnu/arch/x86/kernel/machine_kexec_64.c
--- linux-libre-4.1.50-gnu/arch/x86/kernel/machine_kexec_64.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/arch/x86/kernel/machine_kexec_64.c	2018-03-27 16:15:21.000000000 -0400
@@ -517,6 +517,7 @@ int arch_kexec_apply_relocations_add(con
 				goto overflow;
 			break;
 		case R_X86_64_PC32:
+		case R_X86_64_PLT32:
 			value -= (u64)address;
 			*(u32 *)location = value;
 			break;
diff -druNp --no-dereference linux-libre-4.1.50-gnu/arch/x86/kernel/module.c linux-libre-4.1.51-gnu/arch/x86/kernel/module.c
--- linux-libre-4.1.50-gnu/arch/x86/kernel/module.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/arch/x86/kernel/module.c	2018-03-27 16:15:21.000000000 -0400
@@ -170,19 +170,28 @@ int apply_relocate_add(Elf64_Shdr *sechd
 		case R_X86_64_NONE:
 			break;
 		case R_X86_64_64:
+			if (*(u64 *)loc != 0)
+				goto invalid_relocation;
 			*(u64 *)loc = val;
 			break;
 		case R_X86_64_32:
+			if (*(u32 *)loc != 0)
+				goto invalid_relocation;
 			*(u32 *)loc = val;
 			if (val != *(u32 *)loc)
 				goto overflow;
 			break;
 		case R_X86_64_32S:
+			if (*(s32 *)loc != 0)
+				goto invalid_relocation;
 			*(s32 *)loc = val;
 			if ((s64)val != *(s32 *)loc)
 				goto overflow;
 			break;
 		case R_X86_64_PC32:
+		case R_X86_64_PLT32:
+			if (*(u32 *)loc != 0)
+				goto invalid_relocation;
 			val -= (u64)loc;
 			*(u32 *)loc = val;
 #if 0
@@ -198,6 +207,11 @@ int apply_relocate_add(Elf64_Shdr *sechd
 	}
 	return 0;
 
+invalid_relocation:
+	pr_err("x86/modules: Skipping invalid relocation target, existing value is nonzero for type %d, loc %p, val %Lx\n",
+	       (int)ELF64_R_TYPE(rel[i].r_info), loc, val);
+	return -ENOEXEC;
+
 overflow:
 	pr_err("overflow in relocation type %d val %Lx\n",
 	       (int)ELF64_R_TYPE(rel[i].r_info), val);
diff -druNp --no-dereference linux-libre-4.1.50-gnu/arch/x86/lib/checksum_32.S linux-libre-4.1.51-gnu/arch/x86/lib/checksum_32.S
--- linux-libre-4.1.50-gnu/arch/x86/lib/checksum_32.S	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/arch/x86/lib/checksum_32.S	2018-03-27 16:15:21.000000000 -0400
@@ -29,8 +29,7 @@
 #include <asm/dwarf2.h>
 #include <asm/errno.h>
 #include <asm/asm.h>
-#include <asm/nospec-branch.h>
-
+				
 /*
  * computes a partial checksum, e.g. for TCP/UDP fragments
  */
@@ -160,7 +159,7 @@ ENTRY(csum_partial)
 	negl %ebx
 	lea 45f(%ebx,%ebx,2), %ebx
 	testl %esi, %esi
-	JMP_NOSPEC %ebx
+	jmp *%ebx
 
 	# Handle 2-byte-aligned regions
 20:	addw (%esi), %ax
@@ -447,7 +446,7 @@ ENTRY(csum_partial_copy_generic)
 	andl $-32,%edx
 	lea 3f(%ebx,%ebx), %ebx
 	testl %esi, %esi 
-	JMP_NOSPEC %ebx
+	jmp *%ebx
 1:	addl $64,%esi
 	addl $64,%edi 
 	SRC(movb -32(%edx),%bl)	; SRC(movb (%edx),%bl)
diff -druNp --no-dereference linux-libre-4.1.50-gnu/arch/x86/tools/relocs.c linux-libre-4.1.51-gnu/arch/x86/tools/relocs.c
--- linux-libre-4.1.50-gnu/arch/x86/tools/relocs.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/arch/x86/tools/relocs.c	2018-03-27 16:15:21.000000000 -0400
@@ -769,9 +769,12 @@ static int do_reloc64(struct section *se
 		break;
 
 	case R_X86_64_PC32:
+	case R_X86_64_PLT32:
 		/*
 		 * PC relative relocations don't need to be adjusted unless
 		 * referencing a percpu symbol.
+		 *
+		 * NB: R_X86_64_PLT32 can be treated as R_X86_64_PC32.
 		 */
 		if (is_percpu_sym(sym, symname))
 			add_reloc(&relocs32neg, offset);
diff -druNp --no-dereference linux-libre-4.1.50-gnu/block/blk-cgroup.c linux-libre-4.1.51-gnu/block/blk-cgroup.c
--- linux-libre-4.1.50-gnu/block/blk-cgroup.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/block/blk-cgroup.c	2018-03-27 16:15:21.000000000 -0400
@@ -870,10 +870,8 @@ int blkcg_init_queue(struct request_queu
 	if (preloaded)
 		radix_tree_preload_end();
 
-	if (IS_ERR(blkg)) {
-		blkg_free(new_blkg);
+	if (IS_ERR(blkg))
 		return PTR_ERR(blkg);
-	}
 
 	q->root_blkg = blkg;
 	q->root_rl.blkg = blkg;
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/block/loop.c linux-libre-4.1.51-gnu/drivers/block/loop.c
--- linux-libre-4.1.50-gnu/drivers/block/loop.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/block/loop.c	2018-03-27 16:15:21.000000000 -0400
@@ -207,7 +207,7 @@ static int lo_write_bvec(struct file *fi
 	struct iov_iter i;
 	ssize_t bw;
 
-	iov_iter_bvec(&i, ITER_BVEC, bvec, 1, bvec->bv_len);
+	iov_iter_bvec(&i, ITER_BVEC | WRITE, bvec, 1, bvec->bv_len);
 
 	file_start_write(file);
 	bw = vfs_iter_write(file, &i, ppos);
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/char/tpm/st33zp24/st33zp24.c linux-libre-4.1.51-gnu/drivers/char/tpm/st33zp24/st33zp24.c
--- linux-libre-4.1.50-gnu/drivers/char/tpm/st33zp24/st33zp24.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/char/tpm/st33zp24/st33zp24.c	2018-03-27 16:15:21.000000000 -0400
@@ -485,7 +485,7 @@ static int st33zp24_recv(struct tpm_chip
 			    size_t count)
 {
 	int size = 0;
-	int expected;
+	u32 expected;
 
 	if (!chip)
 		return -EBUSY;
@@ -502,7 +502,7 @@ static int st33zp24_recv(struct tpm_chip
 	}
 
 	expected = be32_to_cpu(*(__be32 *)(buf + 2));
-	if (expected > count) {
+	if (expected > count || expected < TPM_HEADER_SIZE) {
 		size = -EIO;
 		goto out;
 	}
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/char/tpm/tpm_i2c_infineon.c linux-libre-4.1.51-gnu/drivers/char/tpm/tpm_i2c_infineon.c
--- linux-libre-4.1.50-gnu/drivers/char/tpm/tpm_i2c_infineon.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/char/tpm/tpm_i2c_infineon.c	2018-03-27 16:15:21.000000000 -0400
@@ -436,7 +436,8 @@ static int recv_data(struct tpm_chip *ch
 static int tpm_tis_i2c_recv(struct tpm_chip *chip, u8 *buf, size_t count)
 {
 	int size = 0;
-	int expected, status;
+	int status;
+	u32 expected;
 
 	if (count < TPM_HEADER_SIZE) {
 		size = -EIO;
@@ -451,7 +452,7 @@ static int tpm_tis_i2c_recv(struct tpm_c
 	}
 
 	expected = be32_to_cpu(*(__be32 *)(buf + 2));
-	if ((size_t) expected > count) {
+	if (((size_t) expected > count) || (expected < TPM_HEADER_SIZE)) {
 		size = -EIO;
 		goto out;
 	}
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/char/tpm/tpm_i2c_nuvoton.c linux-libre-4.1.51-gnu/drivers/char/tpm/tpm_i2c_nuvoton.c
--- linux-libre-4.1.50-gnu/drivers/char/tpm/tpm_i2c_nuvoton.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/char/tpm/tpm_i2c_nuvoton.c	2018-03-27 16:15:21.000000000 -0400
@@ -275,7 +275,11 @@ static int i2c_nuvoton_recv(struct tpm_c
 	struct device *dev = chip->pdev;
 	struct i2c_client *client = to_i2c_client(dev);
 	s32 rc;
-	int expected, status, burst_count, retries, size = 0;
+	int status;
+	int burst_count;
+	int retries;
+	int size = 0;
+	u32 expected;
 
 	if (count < TPM_HEADER_SIZE) {
 		i2c_nuvoton_ready(chip);    /* return to idle */
@@ -317,7 +321,7 @@ static int i2c_nuvoton_recv(struct tpm_c
 		 * to machine native
 		 */
 		expected = be32_to_cpu(*(__be32 *) (buf + 2));
-		if (expected > count) {
+		if (expected > count || expected < size) {
 			dev_err(dev, "%s() expected > count\n", __func__);
 			size = -EIO;
 			continue;
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/cpufreq/s3c24xx-cpufreq.c linux-libre-4.1.51-gnu/drivers/cpufreq/s3c24xx-cpufreq.c
--- linux-libre-4.1.50-gnu/drivers/cpufreq/s3c24xx-cpufreq.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/cpufreq/s3c24xx-cpufreq.c	2018-03-27 16:15:21.000000000 -0400
@@ -364,7 +364,13 @@ struct clk *s3c_cpufreq_clk_get(struct d
 static int s3c_cpufreq_init(struct cpufreq_policy *policy)
 {
 	policy->clk = clk_arm;
-	return cpufreq_generic_init(policy, ftab, cpu_cur.info->latency);
+
+	policy->cpuinfo.transition_latency = cpu_cur.info->latency;
+
+	if (ftab)
+		return cpufreq_table_validate_and_show(policy, ftab);
+
+	return 0;
 }
 
 static int __init s3c_cpufreq_initclks(void)
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/gpu/drm/radeon/cik.c linux-libre-4.1.51-gnu/drivers/gpu/drm/radeon/cik.c
--- linux-libre-4.1.50-gnu/drivers/gpu/drm/radeon/cik.c	2018-03-08 03:40:56.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/gpu/drm/radeon/cik.c	2018-03-28 09:45:18.000000000 -0400
@@ -3495,35 +3495,8 @@ static void cik_gpu_init(struct radeon_d
 	case CHIP_KAVERI:
 		rdev->config.cik.max_shader_engines = 1;
 		rdev->config.cik.max_tile_pipes = 4;
-		if ((rdev->pdev->device == 0x1304) ||
-		    (rdev->pdev->device == 0x1305) ||
-		    (rdev->pdev->device == 0x130C) ||
-		    (rdev->pdev->device == 0x130F) ||
-		    (rdev->pdev->device == 0x1310) ||
-		    (rdev->pdev->device == 0x1311) ||
-		    (rdev->pdev->device == 0x131C)) {
-			rdev->config.cik.max_cu_per_sh = 8;
-			rdev->config.cik.max_backends_per_se = 2;
-		} else if ((rdev->pdev->device == 0x1309) ||
-			   (rdev->pdev->device == 0x130A) ||
-			   (rdev->pdev->device == 0x130D) ||
-			   (rdev->pdev->device == 0x1313) ||
-			   (rdev->pdev->device == 0x131D)) {
-			rdev->config.cik.max_cu_per_sh = 6;
-			rdev->config.cik.max_backends_per_se = 2;
-		} else if ((rdev->pdev->device == 0x1306) ||
-			   (rdev->pdev->device == 0x1307) ||
-			   (rdev->pdev->device == 0x130B) ||
-			   (rdev->pdev->device == 0x130E) ||
-			   (rdev->pdev->device == 0x1315) ||
-			   (rdev->pdev->device == 0x1318) ||
-			   (rdev->pdev->device == 0x131B)) {
-			rdev->config.cik.max_cu_per_sh = 4;
-			rdev->config.cik.max_backends_per_se = 1;
-		} else {
-			rdev->config.cik.max_cu_per_sh = 3;
-			rdev->config.cik.max_backends_per_se = 1;
-		}
+		rdev->config.cik.max_cu_per_sh = 8;
+		rdev->config.cik.max_backends_per_se = 2;
 		rdev->config.cik.max_sh_per_se = 1;
 		rdev->config.cik.max_texture_channel_caches = 4;
 		rdev->config.cik.max_gprs = 256;
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/gpu/drm/ttm/ttm_page_alloc.c linux-libre-4.1.51-gnu/drivers/gpu/drm/ttm/ttm_page_alloc.c
--- linux-libre-4.1.50-gnu/drivers/gpu/drm/ttm/ttm_page_alloc.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/gpu/drm/ttm/ttm_page_alloc.c	2018-03-27 16:15:21.000000000 -0400
@@ -818,6 +818,8 @@ int ttm_page_alloc_init(struct ttm_mem_g
 	pr_info("Initializing pool allocator\n");
 
 	_manager = kzalloc(sizeof(*_manager), GFP_KERNEL);
+	if (!_manager)
+		return -ENOMEM;
 
 	ttm_page_pool_init_locked(&_manager->wc_pool, GFP_HIGHUSER, "wc");
 
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/infiniband/core/ucma.c linux-libre-4.1.51-gnu/drivers/infiniband/core/ucma.c
--- linux-libre-4.1.50-gnu/drivers/infiniband/core/ucma.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/infiniband/core/ucma.c	2018-03-27 16:15:21.000000000 -0400
@@ -1050,6 +1050,9 @@ static ssize_t ucma_init_qp_attr(struct
 	if (copy_from_user(&cmd, inbuf, sizeof(cmd)))
 		return -EFAULT;
 
+	if (cmd.qp_state > IB_QPS_ERR)
+		return -EINVAL;
+
 	ctx = ucma_get_ctx(file, cmd.id);
 	if (IS_ERR(ctx))
 		return PTR_ERR(ctx);
@@ -1187,6 +1190,9 @@ static ssize_t ucma_set_option(struct uc
 	if (IS_ERR(ctx))
 		return PTR_ERR(ctx);
 
+	if (unlikely(cmd.optval > KMALLOC_MAX_SIZE))
+		return -EINVAL;
+
 	optval = memdup_user((void __user *) (unsigned long) cmd.optval,
 			     cmd.optlen);
 	if (IS_ERR(optval)) {
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/infiniband/hw/mlx5/cq.c linux-libre-4.1.51-gnu/drivers/infiniband/hw/mlx5/cq.c
--- linux-libre-4.1.50-gnu/drivers/infiniband/hw/mlx5/cq.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/infiniband/hw/mlx5/cq.c	2018-03-27 16:15:21.000000000 -0400
@@ -959,7 +959,12 @@ static int resize_user(struct mlx5_ib_de
 	if (ucmd.reserved0 || ucmd.reserved1)
 		return -EINVAL;
 
-	umem = ib_umem_get(context, ucmd.buf_addr, entries * ucmd.cqe_size,
+	/* check multiplication overflow */
+	if (ucmd.cqe_size && SIZE_MAX / ucmd.cqe_size <= entries - 1)
+		return -EINVAL;
+
+	umem = ib_umem_get(context, ucmd.buf_addr,
+			   (size_t)ucmd.cqe_size * entries,
 			   IB_ACCESS_LOCAL_WRITE, 1);
 	if (IS_ERR(umem)) {
 		err = PTR_ERR(umem);
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/input/keyboard/matrix_keypad.c linux-libre-4.1.51-gnu/drivers/input/keyboard/matrix_keypad.c
--- linux-libre-4.1.50-gnu/drivers/input/keyboard/matrix_keypad.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/input/keyboard/matrix_keypad.c	2018-03-27 16:15:21.000000000 -0400
@@ -216,8 +216,10 @@ static void matrix_keypad_stop(struct in
 {
 	struct matrix_keypad *keypad = input_get_drvdata(dev);
 
+	spin_lock_irq(&keypad->lock);
 	keypad->stopped = true;
-	mb();
+	spin_unlock_irq(&keypad->lock);
+
 	flush_work(&keypad->work.work);
 	/*
 	 * matrix_keypad_scan() will leave IRQs enabled;
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/input/keyboard/tca8418_keypad.c linux-libre-4.1.51-gnu/drivers/input/keyboard/tca8418_keypad.c
--- linux-libre-4.1.50-gnu/drivers/input/keyboard/tca8418_keypad.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/input/keyboard/tca8418_keypad.c	2018-03-27 16:15:21.000000000 -0400
@@ -189,8 +189,6 @@ static void tca8418_read_keypad(struct t
 		input_event(input, EV_MSC, MSC_SCAN, code);
 		input_report_key(input, keymap[code], state);
 
-		/* Read for next loop */
-		error = tca8418_read_byte(keypad_data, REG_KEY_EVENT_A, &reg);
 	} while (1);
 
 	input_sync(input);
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/leds/led-core.c linux-libre-4.1.51-gnu/drivers/leds/led-core.c
--- linux-libre-4.1.50-gnu/drivers/leds/led-core.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/leds/led-core.c	2018-03-27 16:15:21.000000000 -0400
@@ -76,7 +76,7 @@ void led_blink_set(struct led_classdev *
 		   unsigned long *delay_on,
 		   unsigned long *delay_off)
 {
-	del_timer_sync(&led_cdev->blink_timer);
+	led_stop_software_blink(led_cdev);
 
 	led_cdev->flags &= ~LED_BLINK_ONESHOT;
 	led_cdev->flags &= ~LED_BLINK_ONESHOT_STOP;
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/leds/led-triggers.c linux-libre-4.1.51-gnu/drivers/leds/led-triggers.c
--- linux-libre-4.1.50-gnu/drivers/leds/led-triggers.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/leds/led-triggers.c	2018-03-27 16:15:21.000000000 -0400
@@ -88,21 +88,23 @@ ssize_t led_trigger_show(struct device *
 	down_read(&led_cdev->trigger_lock);
 
 	if (!led_cdev->trigger)
-		len += sprintf(buf+len, "[none] ");
+		len += scnprintf(buf+len, PAGE_SIZE - len, "[none] ");
 	else
-		len += sprintf(buf+len, "none ");
+		len += scnprintf(buf+len, PAGE_SIZE - len, "none ");
 
 	list_for_each_entry(trig, &trigger_list, next_trig) {
 		if (led_cdev->trigger && !strcmp(led_cdev->trigger->name,
 							trig->name))
-			len += sprintf(buf+len, "[%s] ", trig->name);
+			len += scnprintf(buf+len, PAGE_SIZE - len, "[%s] ",
+					 trig->name);
 		else
-			len += sprintf(buf+len, "%s ", trig->name);
+			len += scnprintf(buf+len, PAGE_SIZE - len, "%s ",
+					 trig->name);
 	}
 	up_read(&led_cdev->trigger_lock);
 	up_read(&triggers_list_lock);
 
-	len += sprintf(len+buf, "\n");
+	len += scnprintf(len+buf, PAGE_SIZE - len, "\n");
 	return len;
 }
 EXPORT_SYMBOL_GPL(led_trigger_show);
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/md/bcache/super.c linux-libre-4.1.51-gnu/drivers/md/bcache/super.c
--- linux-libre-4.1.50-gnu/drivers/md/bcache/super.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/md/bcache/super.c	2018-03-27 16:15:21.000000000 -0400
@@ -966,6 +966,7 @@ int bch_cached_dev_attach(struct cached_
 	uint32_t rtime = cpu_to_le32(get_seconds());
 	struct uuid_entry *u;
 	char buf[BDEVNAME_SIZE];
+	struct cached_dev *exist_dc, *t;
 
 	bdevname(dc->bdev, buf);
 
@@ -989,6 +990,16 @@ int bch_cached_dev_attach(struct cached_
 		return -EINVAL;
 	}
 
+	/* Check whether already attached */
+	list_for_each_entry_safe(exist_dc, t, &c->cached_devs, list) {
+		if (!memcmp(dc->sb.uuid, exist_dc->sb.uuid, 16)) {
+			pr_err("Tried to attach %s but duplicate UUID already attached",
+				buf);
+
+			return -EINVAL;
+		}
+	}
+
 	u = uuid_find(c, dc->sb.uuid);
 
 	if (u &&
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/md/dm-io.c linux-libre-4.1.51-gnu/drivers/md/dm-io.c
--- linux-libre-4.1.50-gnu/drivers/md/dm-io.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/md/dm-io.c	2018-03-27 16:15:21.000000000 -0400
@@ -299,6 +299,7 @@ static void do_region(int rw, unsigned r
 	else if (rw & REQ_WRITE_SAME)
 		special_cmd_max_sectors = q->limits.max_write_same_sectors;
 	if ((rw & (REQ_DISCARD | REQ_WRITE_SAME)) && special_cmd_max_sectors == 0) {
+		atomic_inc(&io->count);
 		dec_count(io, region, -EOPNOTSUPP);
 		return;
 	}
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/mtd/nand/gpmi-nand/gpmi-nand.c linux-libre-4.1.51-gnu/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
--- linux-libre-4.1.50-gnu/drivers/mtd/nand/gpmi-nand/gpmi-nand.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/mtd/nand/gpmi-nand/gpmi-nand.c	2018-03-27 16:15:21.000000000 -0400
@@ -1029,9 +1029,6 @@ static int gpmi_ecc_read_page(struct mtd
 		return ret;
 	}
 
-	/* handle the block mark swapping */
-	block_mark_swapping(this, payload_virt, auxiliary_virt);
-
 	/* Loop over status bytes, accumulating ECC status. */
 	status = auxiliary_virt + nfc_geo->auxiliary_status_offset;
 
@@ -1047,6 +1044,9 @@ static int gpmi_ecc_read_page(struct mtd
 		max_bitflips = max_t(unsigned int, max_bitflips, *status);
 	}
 
+	/* handle the block mark swapping */
+	block_mark_swapping(this, buf, auxiliary_virt);
+
 	if (oob_required) {
 		/*
 		 * It's time to deliver the OOB bytes. See gpmi_ecc_read_oob()
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/mtd/ubi/vmt.c linux-libre-4.1.51-gnu/drivers/mtd/ubi/vmt.c
--- linux-libre-4.1.50-gnu/drivers/mtd/ubi/vmt.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/mtd/ubi/vmt.c	2018-03-27 16:15:21.000000000 -0400
@@ -310,6 +310,12 @@ int ubi_create_volume(struct ubi_device
 			vol->last_eb_bytes = vol->usable_leb_size;
 	}
 
+	/* Make volume "available" before it becomes accessible via sysfs */
+	spin_lock(&ubi->volumes_lock);
+	ubi->volumes[vol_id] = vol;
+	ubi->vol_count += 1;
+	spin_unlock(&ubi->volumes_lock);
+
 	/* Register character device for the volume */
 	cdev_init(&vol->cdev, &ubi_vol_cdev_operations);
 	vol->cdev.owner = THIS_MODULE;
@@ -352,11 +358,6 @@ int ubi_create_volume(struct ubi_device
 	if (err)
 		goto out_sysfs;
 
-	spin_lock(&ubi->volumes_lock);
-	ubi->volumes[vol_id] = vol;
-	ubi->vol_count += 1;
-	spin_unlock(&ubi->volumes_lock);
-
 	ubi_volume_notify(ubi, vol, UBI_VOLUME_ADDED);
 	self_check_volumes(ubi);
 	return err;
@@ -376,6 +377,10 @@ out_sysfs:
 out_cdev:
 	cdev_del(&vol->cdev);
 out_mapping:
+	spin_lock(&ubi->volumes_lock);
+	ubi->volumes[vol_id] = NULL;
+	ubi->vol_count -= 1;
+	spin_unlock(&ubi->volumes_lock);
 	if (do_free)
 		kfree(vol->eba_tbl);
 out_acc:
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/net/ethernet/arc/emac_main.c linux-libre-4.1.51-gnu/drivers/net/ethernet/arc/emac_main.c
--- linux-libre-4.1.50-gnu/drivers/net/ethernet/arc/emac_main.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/net/ethernet/arc/emac_main.c	2018-03-27 16:15:21.000000000 -0400
@@ -250,39 +250,48 @@ static int arc_emac_rx(struct net_device
 			continue;
 		}
 
-		pktlen = info & LEN_MASK;
-		stats->rx_packets++;
-		stats->rx_bytes += pktlen;
-		skb = rx_buff->skb;
-		skb_put(skb, pktlen);
-		skb->dev = ndev;
-		skb->protocol = eth_type_trans(skb, ndev);
-
-		dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr),
-				 dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE);
-
-		/* Prepare the BD for next cycle */
-		rx_buff->skb = netdev_alloc_skb_ip_align(ndev,
-							 EMAC_BUFFER_SIZE);
-		if (unlikely(!rx_buff->skb)) {
+		/* Prepare the BD for next cycle. netif_receive_skb()
+		 * only if new skb was allocated and mapped to avoid holes
+		 * in the RX fifo.
+		 */
+		skb = netdev_alloc_skb_ip_align(ndev, EMAC_BUFFER_SIZE);
+		if (unlikely(!skb)) {
+			if (net_ratelimit())
+				netdev_err(ndev, "cannot allocate skb\n");
+			/* Return ownership to EMAC */
+			rxbd->info = cpu_to_le32(FOR_EMAC | EMAC_BUFFER_SIZE);
 			stats->rx_errors++;
-			/* Because receive_skb is below, increment rx_dropped */
 			stats->rx_dropped++;
 			continue;
 		}
 
-		/* receive_skb only if new skb was allocated to avoid holes */
-		netif_receive_skb(skb);
-
-		addr = dma_map_single(&ndev->dev, (void *)rx_buff->skb->data,
+		addr = dma_map_single(&ndev->dev, (void *)skb->data,
 				      EMAC_BUFFER_SIZE, DMA_FROM_DEVICE);
 		if (dma_mapping_error(&ndev->dev, addr)) {
 			if (net_ratelimit())
-				netdev_err(ndev, "cannot dma map\n");
-			dev_kfree_skb(rx_buff->skb);
+				netdev_err(ndev, "cannot map dma buffer\n");
+			dev_kfree_skb(skb);
+			/* Return ownership to EMAC */
+			rxbd->info = cpu_to_le32(FOR_EMAC | EMAC_BUFFER_SIZE);
 			stats->rx_errors++;
+			stats->rx_dropped++;
 			continue;
 		}
+
+		/* unmap previosly mapped skb */
+		dma_unmap_single(&ndev->dev, dma_unmap_addr(rx_buff, addr),
+				 dma_unmap_len(rx_buff, len), DMA_FROM_DEVICE);
+
+		pktlen = info & LEN_MASK;
+		stats->rx_packets++;
+		stats->rx_bytes += pktlen;
+		skb_put(rx_buff->skb, pktlen);
+		rx_buff->skb->dev = ndev;
+		rx_buff->skb->protocol = eth_type_trans(rx_buff->skb, ndev);
+
+		netif_receive_skb(rx_buff->skb);
+
+		rx_buff->skb = skb;
 		dma_unmap_addr_set(rx_buff, addr, addr);
 		dma_unmap_len_set(rx_buff, len, EMAC_BUFFER_SIZE);
 
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c linux-libre-4.1.51-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c
--- linux-libre-4.1.50-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c	2018-03-08 03:46:19.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c	2018-03-28 09:51:26.000000000 -0400
@@ -2995,7 +2995,7 @@ int bnx2x_nic_unload(struct bnx2x *bp, i
 
 	del_timer_sync(&bp->timer);
 
-	if (IS_PF(bp)) {
+	if (IS_PF(bp) && !BP_NOMCP(bp)) {
 		/* Set ALWAYS_ALIVE bit in shmem */
 		bp->fw_drv_pulse_wr_seq |= DRV_PULSE_ALWAYS_ALIVE;
 		bnx2x_drv_pulse(bp);
@@ -3077,7 +3077,7 @@ int bnx2x_nic_unload(struct bnx2x *bp, i
 	bp->cnic_loaded = false;
 
 	/* Clear driver version indication in shmem */
-	if (IS_PF(bp))
+	if (IS_PF(bp) && !BP_NOMCP(bp))
 		bnx2x_update_mng_version(bp);
 
 	/* Check if there are pending parity attentions. If there are - set
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c linux-libre-4.1.51-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
--- linux-libre-4.1.50-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c	2018-03-08 03:46:19.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c	2018-03-28 09:51:26.000000000 -0400
@@ -9482,6 +9482,15 @@ static int bnx2x_init_shmem(struct bnx2x
 
 	do {
 		bp->common.shmem_base = REG_RD(bp, MISC_REG_SHARED_MEM_ADDR);
+
+		/* If we read all 0xFFs, means we are in PCI error state and
+		 * should bail out to avoid crashes on adapter's FW reads.
+		 */
+		if (bp->common.shmem_base == 0xFFFFFFFF) {
+			bp->flags |= NO_MCP_FLAG;
+			return -ENODEV;
+		}
+
 		if (bp->common.shmem_base) {
 			val = SHMEM_RD(bp, validity_map[BP_PORT(bp)]);
 			if (val & SHR_MEM_VALIDITY_MB)
@@ -13727,7 +13736,10 @@ static pci_ers_result_t bnx2x_io_slot_re
 		BNX2X_ERR("IO slot reset --> driver unload\n");
 
 		/* MCP should have been reset; Need to wait for validity */
-		bnx2x_init_shmem(bp);
+		if (bnx2x_init_shmem(bp)) {
+			rtnl_unlock();
+			return PCI_ERS_RESULT_DISCONNECT;
+		}
 
 		if (IS_PF(bp) && SHMEM2_HAS(bp, drv_capabilities_flag)) {
 			u32 v;
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/net/ethernet/broadcom/tg3.c linux-libre-4.1.51-gnu/drivers/net/ethernet/broadcom/tg3.c
--- linux-libre-4.1.50-gnu/drivers/net/ethernet/broadcom/tg3.c	2018-03-08 03:47:35.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/net/ethernet/broadcom/tg3.c	2018-03-28 09:52:44.000000000 -0400
@@ -10042,6 +10042,16 @@ static int tg3_reset_hw(struct tg3 *tp,
 
 	tw32(GRC_MODE, tp->grc_mode | val);
 
+	/* On one of the AMD platform, MRRS is restricted to 4000 because of
+	 * south bridge limitation. As a workaround, Driver is setting MRRS
+	 * to 2048 instead of default 4096.
+	 */
+	if (tp->pdev->subsystem_vendor == PCI_VENDOR_ID_DELL &&
+	    tp->pdev->subsystem_device == TG3PCI_SUBDEVICE_ID_DELL_5762) {
+		val = tr32(TG3PCI_DEV_STATUS_CTRL) & ~MAX_READ_REQ_MASK;
+		tw32(TG3PCI_DEV_STATUS_CTRL, val | MAX_READ_REQ_SIZE_2048);
+	}
+
 	/* Setup the timer prescalar register.  Clock is always 66Mhz. */
 	val = tr32(GRC_MISC_CFG);
 	val &= ~0xff;
@@ -14221,7 +14231,8 @@ static int tg3_change_mtu(struct net_dev
 	 */
 	if (tg3_asic_rev(tp) == ASIC_REV_57766 ||
 	    tg3_asic_rev(tp) == ASIC_REV_5717 ||
-	    tg3_asic_rev(tp) == ASIC_REV_5719)
+	    tg3_asic_rev(tp) == ASIC_REV_5719 ||
+	    tg3_asic_rev(tp) == ASIC_REV_5720)
 		reset_phy = true;
 
 	err = tg3_restart_hw(tp, reset_phy);
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/net/ethernet/broadcom/tg3.h linux-libre-4.1.51-gnu/drivers/net/ethernet/broadcom/tg3.h
--- linux-libre-4.1.50-gnu/drivers/net/ethernet/broadcom/tg3.h	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/net/ethernet/broadcom/tg3.h	2018-03-27 16:15:21.000000000 -0400
@@ -95,6 +95,7 @@
 #define TG3PCI_SUBDEVICE_ID_DELL_JAGUAR		0x0106
 #define TG3PCI_SUBDEVICE_ID_DELL_MERLOT		0x0109
 #define TG3PCI_SUBDEVICE_ID_DELL_SLIM_MERLOT	0x010a
+#define TG3PCI_SUBDEVICE_ID_DELL_5762		0x07f0
 #define TG3PCI_SUBVENDOR_ID_COMPAQ		PCI_VENDOR_ID_COMPAQ
 #define TG3PCI_SUBDEVICE_ID_COMPAQ_BANSHEE	0x007c
 #define TG3PCI_SUBDEVICE_ID_COMPAQ_BANSHEE_2	0x009a
@@ -280,6 +281,9 @@
 #define TG3PCI_STD_RING_PROD_IDX	0x00000098 /* 64-bit */
 #define TG3PCI_RCV_RET_RING_CON_IDX	0x000000a0 /* 64-bit */
 /* 0xa8 --> 0xb8 unused */
+#define TG3PCI_DEV_STATUS_CTRL		0x000000b4
+#define  MAX_READ_REQ_SIZE_2048		 0x00004000
+#define  MAX_READ_REQ_MASK		 0x00007000
 #define TG3PCI_DUAL_MAC_CTRL		0x000000b8
 #define  DUAL_MAC_CTRL_CH_MASK		 0x00000003
 #define  DUAL_MAC_CTRL_ID		 0x00000004
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/net/ethernet/freescale/gianfar_ptp.c linux-libre-4.1.51-gnu/drivers/net/ethernet/freescale/gianfar_ptp.c
--- linux-libre-4.1.50-gnu/drivers/net/ethernet/freescale/gianfar_ptp.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/net/ethernet/freescale/gianfar_ptp.c	2018-03-27 16:15:21.000000000 -0400
@@ -314,11 +314,10 @@ static int ptp_gianfar_adjtime(struct pt
 	now = tmr_cnt_read(etsects);
 	now += delta;
 	tmr_cnt_write(etsects, now);
+	set_fipers(etsects);
 
 	spin_unlock_irqrestore(&etsects->lock, flags);
 
-	set_fipers(etsects);
-
 	return 0;
 }
 
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/net/ethernet/intel/e1000/e1000.h linux-libre-4.1.51-gnu/drivers/net/ethernet/intel/e1000/e1000.h
--- linux-libre-4.1.50-gnu/drivers/net/ethernet/intel/e1000/e1000.h	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/net/ethernet/intel/e1000/e1000.h	2018-03-27 16:15:21.000000000 -0400
@@ -328,7 +328,8 @@ struct e1000_adapter {
 enum e1000_state_t {
 	__E1000_TESTING,
 	__E1000_RESETTING,
-	__E1000_DOWN
+	__E1000_DOWN,
+	__E1000_DISABLED
 };
 
 #undef pr_fmt
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/net/ethernet/intel/e1000/e1000_main.c linux-libre-4.1.51-gnu/drivers/net/ethernet/intel/e1000/e1000_main.c
--- linux-libre-4.1.50-gnu/drivers/net/ethernet/intel/e1000/e1000_main.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/net/ethernet/intel/e1000/e1000_main.c	2018-03-27 16:15:21.000000000 -0400
@@ -940,7 +940,7 @@ static int e1000_init_hw_struct(struct e
 static int e1000_probe(struct pci_dev *pdev, const struct pci_device_id *ent)
 {
 	struct net_device *netdev;
-	struct e1000_adapter *adapter;
+	struct e1000_adapter *adapter = NULL;
 	struct e1000_hw *hw;
 
 	static int cards_found = 0;
@@ -950,6 +950,7 @@ static int e1000_probe(struct pci_dev *p
 	u16 tmp = 0;
 	u16 eeprom_apme_mask = E1000_EEPROM_APME;
 	int bars, need_ioport;
+	bool disable_dev = false;
 
 	/* do not allocate ioport bars when not needed */
 	need_ioport = e1000_is_need_ioport(pdev);
@@ -1250,11 +1251,13 @@ err_mdio_ioremap:
 	iounmap(hw->ce4100_gbe_mdio_base_virt);
 	iounmap(hw->hw_addr);
 err_ioremap:
+	disable_dev = !test_and_set_bit(__E1000_DISABLED, &adapter->flags);
 	free_netdev(netdev);
 err_alloc_etherdev:
 	pci_release_selected_regions(pdev, bars);
 err_pci_reg:
-	pci_disable_device(pdev);
+	if (!adapter || disable_dev)
+		pci_disable_device(pdev);
 	return err;
 }
 
@@ -1272,6 +1275,7 @@ static void e1000_remove(struct pci_dev
 	struct net_device *netdev = pci_get_drvdata(pdev);
 	struct e1000_adapter *adapter = netdev_priv(netdev);
 	struct e1000_hw *hw = &adapter->hw;
+	bool disable_dev;
 
 	e1000_down_and_stop(adapter);
 	e1000_release_manageability(adapter);
@@ -1290,9 +1294,11 @@ static void e1000_remove(struct pci_dev
 		iounmap(hw->flash_address);
 	pci_release_selected_regions(pdev, adapter->bars);
 
+	disable_dev = !test_and_set_bit(__E1000_DISABLED, &adapter->flags);
 	free_netdev(netdev);
 
-	pci_disable_device(pdev);
+	if (disable_dev)
+		pci_disable_device(pdev);
 }
 
 /**
@@ -5137,7 +5143,8 @@ static int __e1000_shutdown(struct pci_d
 	if (netif_running(netdev))
 		e1000_free_irq(adapter);
 
-	pci_disable_device(pdev);
+	if (!test_and_set_bit(__E1000_DISABLED, &adapter->flags))
+		pci_disable_device(pdev);
 
 	return 0;
 }
@@ -5181,6 +5188,10 @@ static int e1000_resume(struct pci_dev *
 		pr_err("Cannot enable PCI device from suspend\n");
 		return err;
 	}
+
+	/* flush memory to make sure state is correct */
+	smp_mb__before_atomic();
+	clear_bit(__E1000_DISABLED, &adapter->flags);
 	pci_set_master(pdev);
 
 	pci_enable_wake(pdev, PCI_D3hot, 0);
@@ -5255,7 +5266,9 @@ static pci_ers_result_t e1000_io_error_d
 
 	if (netif_running(netdev))
 		e1000_down(adapter);
-	pci_disable_device(pdev);
+
+	if (!test_and_set_bit(__E1000_DISABLED, &adapter->flags))
+		pci_disable_device(pdev);
 
 	/* Request a slot slot reset. */
 	return PCI_ERS_RESULT_NEED_RESET;
@@ -5283,6 +5296,10 @@ static pci_ers_result_t e1000_io_slot_re
 		pr_err("Cannot re-enable PCI device after reset.\n");
 		return PCI_ERS_RESULT_DISCONNECT;
 	}
+
+	/* flush memory to make sure state is correct */
+	smp_mb__before_atomic();
+	clear_bit(__E1000_DISABLED, &adapter->flags);
 	pci_set_master(pdev);
 
 	pci_enable_wake(pdev, PCI_D3hot, 0);
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/net/phy/mdio-sun4i.c linux-libre-4.1.51-gnu/drivers/net/phy/mdio-sun4i.c
--- linux-libre-4.1.50-gnu/drivers/net/phy/mdio-sun4i.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/net/phy/mdio-sun4i.c	2018-03-27 16:15:21.000000000 -0400
@@ -128,8 +128,10 @@ static int sun4i_mdio_probe(struct platf
 
 	data->regulator = devm_regulator_get(&pdev->dev, "phy");
 	if (IS_ERR(data->regulator)) {
-		if (PTR_ERR(data->regulator) == -EPROBE_DEFER)
-			return -EPROBE_DEFER;
+		if (PTR_ERR(data->regulator) == -EPROBE_DEFER) {
+			ret = -EPROBE_DEFER;
+			goto err_out_free_mdiobus;
+		}
 
 		dev_info(&pdev->dev, "no regulator found\n");
 	} else {
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/net/ppp/ppp_generic.c linux-libre-4.1.51-gnu/drivers/net/ppp/ppp_generic.c
--- linux-libre-4.1.50-gnu/drivers/net/ppp/ppp_generic.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/net/ppp/ppp_generic.c	2018-03-27 16:15:21.000000000 -0400
@@ -2912,6 +2912,15 @@ ppp_connect_channel(struct channel *pch,
 		goto outl;
 
 	ppp_lock(ppp);
+	spin_lock_bh(&pch->downl);
+	if (!pch->chan) {
+		/* Don't connect unregistered channels */
+		spin_unlock_bh(&pch->downl);
+		ppp_unlock(ppp);
+		ret = -ENOTCONN;
+		goto outl;
+	}
+	spin_unlock_bh(&pch->downl);
 	if (pch->file.hdrlen > ppp->file.hdrlen)
 		ppp->file.hdrlen = pch->file.hdrlen;
 	hdrlen = pch->file.hdrlen + 2;	/* for protocol bytes */
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/net/wan/hdlc_ppp.c linux-libre-4.1.51-gnu/drivers/net/wan/hdlc_ppp.c
--- linux-libre-4.1.50-gnu/drivers/net/wan/hdlc_ppp.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/net/wan/hdlc_ppp.c	2018-03-27 16:15:21.000000000 -0400
@@ -574,7 +574,10 @@ static void ppp_timer(unsigned long arg)
 			ppp_cp_event(proto->dev, proto->pid, TO_GOOD, 0, 0,
 				     0, NULL);
 			proto->restart_counter--;
-		} else
+		} else if (netif_carrier_ok(proto->dev))
+			ppp_cp_event(proto->dev, proto->pid, TO_GOOD, 0, 0,
+				     0, NULL);
+		else
 			ppp_cp_event(proto->dev, proto->pid, TO_BAD, 0, 0,
 				     0, NULL);
 		break;
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/net/xen-netfront.c linux-libre-4.1.51-gnu/drivers/net/xen-netfront.c
--- linux-libre-4.1.50-gnu/drivers/net/xen-netfront.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/net/xen-netfront.c	2018-03-27 16:15:21.000000000 -0400
@@ -1284,6 +1284,7 @@ static struct net_device *xennet_create_
 
 	netif_carrier_off(netdev);
 
+	xenbus_switch_state(dev, XenbusStateInitialising);
 	return netdev;
 
  exit:
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/s390/block/dasd_3990_erp.c linux-libre-4.1.51-gnu/drivers/s390/block/dasd_3990_erp.c
--- linux-libre-4.1.50-gnu/drivers/s390/block/dasd_3990_erp.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/s390/block/dasd_3990_erp.c	2018-03-27 16:15:21.000000000 -0400
@@ -2743,6 +2743,16 @@ dasd_3990_erp_action(struct dasd_ccw_req
 		erp = dasd_3990_erp_handle_match_erp(cqr, erp);
 	}
 
+
+	/*
+	 * For path verification work we need to stick with the path that was
+	 * originally chosen so that the per path configuration data is
+	 * assigned correctly.
+	 */
+	if (test_bit(DASD_CQR_VERIFY_PATH, &erp->flags) && cqr->lpm) {
+		erp->lpm = cqr->lpm;
+	}
+
 	if (device->features & DASD_FEATURE_ERPLOG) {
 		/* print current erp_chain */
 		dev_err(&device->cdev->dev,
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/s390/net/qeth_core.h linux-libre-4.1.51-gnu/drivers/s390/net/qeth_core.h
--- linux-libre-4.1.50-gnu/drivers/s390/net/qeth_core.h	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/s390/net/qeth_core.h	2018-03-27 16:15:21.000000000 -0400
@@ -588,6 +588,11 @@ struct qeth_cmd_buffer {
 	void (*callback) (struct qeth_channel *, struct qeth_cmd_buffer *);
 };
 
+static inline struct qeth_ipa_cmd *__ipa_cmd(struct qeth_cmd_buffer *iob)
+{
+	return (struct qeth_ipa_cmd *)(iob->data + IPA_PDU_HEADER_SIZE);
+}
+
 /**
  * definition of a qeth channel, used for read and write
  */
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/s390/net/qeth_core_main.c linux-libre-4.1.51-gnu/drivers/s390/net/qeth_core_main.c
--- linux-libre-4.1.50-gnu/drivers/s390/net/qeth_core_main.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/s390/net/qeth_core_main.c	2018-03-27 16:15:21.000000000 -0400
@@ -2061,7 +2061,7 @@ int qeth_send_control_data(struct qeth_c
 	unsigned long flags;
 	struct qeth_reply *reply = NULL;
 	unsigned long timeout, event_timeout;
-	struct qeth_ipa_cmd *cmd;
+	struct qeth_ipa_cmd *cmd = NULL;
 
 	QETH_CARD_TEXT(card, 2, "sendctl");
 
@@ -2075,23 +2075,27 @@ int qeth_send_control_data(struct qeth_c
 	}
 	reply->callback = reply_cb;
 	reply->param = reply_param;
-	if (card->state == CARD_STATE_DOWN)
-		reply->seqno = QETH_IDX_COMMAND_SEQNO;
-	else
-		reply->seqno = card->seqno.ipa++;
+
 	init_waitqueue_head(&reply->wait_q);
-	spin_lock_irqsave(&card->lock, flags);
-	list_add_tail(&reply->list, &card->cmd_waiter_list);
-	spin_unlock_irqrestore(&card->lock, flags);
 	QETH_DBF_HEX(CTRL, 2, iob->data, QETH_DBF_CTRL_LEN);
 
 	while (atomic_cmpxchg(&card->write.irq_pending, 0, 1)) ;
-	qeth_prepare_control_data(card, len, iob);
 
-	if (IS_IPA(iob->data))
+	if (IS_IPA(iob->data)) {
+		cmd = __ipa_cmd(iob);
+		cmd->hdr.seqno = card->seqno.ipa++;
+		reply->seqno = cmd->hdr.seqno;
 		event_timeout = QETH_IPA_TIMEOUT;
-	else
+	} else {
+		reply->seqno = QETH_IDX_COMMAND_SEQNO;
 		event_timeout = QETH_TIMEOUT;
+	}
+	qeth_prepare_control_data(card, len, iob);
+
+	spin_lock_irqsave(&card->lock, flags);
+	list_add_tail(&reply->list, &card->cmd_waiter_list);
+	spin_unlock_irqrestore(&card->lock, flags);
+
 	timeout = jiffies + event_timeout;
 
 	QETH_CARD_TEXT(card, 6, "noirqpnd");
@@ -2116,9 +2120,8 @@ int qeth_send_control_data(struct qeth_c
 
 	/* we have only one long running ipassist, since we can ensure
 	   process context of this command we can sleep */
-	cmd = (struct qeth_ipa_cmd *)(iob->data+IPA_PDU_HEADER_SIZE);
-	if ((cmd->hdr.command == IPA_CMD_SETIP) &&
-	    (cmd->hdr.prot_version == QETH_PROT_IPV4)) {
+	if (cmd && cmd->hdr.command == IPA_CMD_SETIP &&
+	    cmd->hdr.prot_version == QETH_PROT_IPV4) {
 		if (!wait_event_timeout(reply->wait_q,
 		    atomic_read(&reply->received), event_timeout))
 			goto time_err;
@@ -2925,7 +2928,7 @@ static void qeth_fill_ipacmd_header(stru
 	memset(cmd, 0, sizeof(struct qeth_ipa_cmd));
 	cmd->hdr.command = command;
 	cmd->hdr.initiator = IPA_CMD_INITIATOR_HOST;
-	cmd->hdr.seqno = card->seqno.ipa;
+	/* cmd->hdr.seqno is set by qeth_send_control_data() */
 	cmd->hdr.adapter_type = qeth_get_ipa_adp_type(card->info.link_type);
 	cmd->hdr.rel_adapter_no = (__u8) card->info.portno;
 	if (card->options.layer2)
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/scsi/qla2xxx/qla_init.c linux-libre-4.1.51-gnu/drivers/scsi/qla2xxx/qla_init.c
--- linux-libre-4.1.50-gnu/drivers/scsi/qla2xxx/qla_init.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/scsi/qla2xxx/qla_init.c	2018-03-27 16:15:21.000000000 -0400
@@ -365,6 +365,7 @@ qla24xx_abort_sp_done(void *data, void *
 	srb_t *sp = (srb_t *)ptr;
 	struct srb_iocb *abt = &sp->u.iocb_cmd;
 
+	del_timer(&sp->u.iocb_cmd.timer);
 	complete(&abt->u.abt.comp);
 }
 
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/scsi/qla2xxx/qla_target.c linux-libre-4.1.51-gnu/drivers/scsi/qla2xxx/qla_target.c
--- linux-libre-4.1.50-gnu/drivers/scsi/qla2xxx/qla_target.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/scsi/qla2xxx/qla_target.c	2018-03-27 16:15:21.000000000 -0400
@@ -5513,7 +5513,7 @@ static fc_port_t *qlt_get_port_database(
 	fc_port_t *fcport;
 	int rc;
 
-	fcport = kzalloc(sizeof(*fcport), GFP_KERNEL);
+	fcport = qla2x00_alloc_fcport(vha, GFP_KERNEL);
 	if (!fcport) {
 		ql_dbg(ql_dbg_tgt_mgt, vha, 0xf06f,
 		    "qla_target(%d): Allocation of tmp FC port failed",
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/scsi/storvsc_drv.c linux-libre-4.1.51-gnu/drivers/scsi/storvsc_drv.c
--- linux-libre-4.1.50-gnu/drivers/scsi/storvsc_drv.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/scsi/storvsc_drv.c	2018-03-27 16:15:21.000000000 -0400
@@ -1067,10 +1067,11 @@ static void storvsc_handle_error(struct
 		case TEST_UNIT_READY:
 			break;
 		default:
-			set_host_byte(scmnd, DID_TARGET_FAILURE);
+			set_host_byte(scmnd, DID_ERROR);
 		}
 		break;
 	case SRB_STATUS_INVALID_LUN:
+		set_host_byte(scmnd, DID_NO_CONNECT);
 		do_work = true;
 		process_err_fn = storvsc_remove_lun;
 		break;
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/spi/spi-atmel.c linux-libre-4.1.51-gnu/drivers/spi/spi-atmel.c
--- linux-libre-4.1.50-gnu/drivers/spi/spi-atmel.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/spi/spi-atmel.c	2018-03-27 16:15:21.000000000 -0400
@@ -1423,12 +1423,12 @@ static int atmel_spi_remove(struct platf
 	pm_runtime_get_sync(&pdev->dev);
 
 	/* reset the hardware and block queue progress */
-	spin_lock_irq(&as->lock);
 	if (as->use_dma) {
 		atmel_spi_stop_dma(as);
 		atmel_spi_release_dma(as);
 	}
 
+	spin_lock_irq(&as->lock);
 	spi_writel(as, CR, SPI_BIT(SWRST));
 	spi_writel(as, CR, SPI_BIT(SWRST)); /* AT91SAM9263 Rev B workaround */
 	spi_readl(as, SR);
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/staging/android/ashmem.c linux-libre-4.1.51-gnu/drivers/staging/android/ashmem.c
--- linux-libre-4.1.50-gnu/drivers/staging/android/ashmem.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/staging/android/ashmem.c	2018-03-27 16:15:21.000000000 -0400
@@ -330,24 +330,23 @@ static loff_t ashmem_llseek(struct file
 	mutex_lock(&ashmem_mutex);
 
 	if (asma->size == 0) {
-		ret = -EINVAL;
-		goto out;
+		mutex_unlock(&ashmem_mutex);
+		return -EINVAL;
 	}
 
 	if (!asma->file) {
-		ret = -EBADF;
-		goto out;
+		mutex_unlock(&ashmem_mutex);
+		return -EBADF;
 	}
 
+	mutex_unlock(&ashmem_mutex);
+
 	ret = vfs_llseek(asma->file, offset, origin);
 	if (ret < 0)
-		goto out;
+		return ret;
 
 	/** Copy f_pos from backing file, since f_ops->llseek() sets it */
 	file->f_pos = asma->file->f_pos;
-
-out:
-	mutex_unlock(&ashmem_mutex);
 	return ret;
 }
 
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/tty/serial/8250/8250_pci.c linux-libre-4.1.51-gnu/drivers/tty/serial/8250/8250_pci.c
--- linux-libre-4.1.50-gnu/drivers/tty/serial/8250/8250_pci.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/tty/serial/8250/8250_pci.c	2018-03-27 16:15:21.000000000 -0400
@@ -5397,6 +5397,17 @@ static struct pci_device_id serial_pci_t
 		PCI_ANY_ID, PCI_ANY_ID, 0, 0,    /* 135a.0dc0 */
 		pbn_b2_4_115200 },
 	/*
+	 * BrainBoxes UC-260
+	 */
+	{	PCI_VENDOR_ID_INTASHIELD, 0x0D21,
+		PCI_ANY_ID, PCI_ANY_ID,
+		PCI_CLASS_COMMUNICATION_MULTISERIAL << 8, 0xffff00,
+		pbn_b2_4_115200 },
+	{	PCI_VENDOR_ID_INTASHIELD, 0x0E34,
+		PCI_ANY_ID, PCI_ANY_ID,
+		 PCI_CLASS_COMMUNICATION_MULTISERIAL << 8, 0xffff00,
+		pbn_b2_4_115200 },
+	/*
 	 * Perle PCI-RAS cards
 	 */
 	{       PCI_VENDOR_ID_PLX, PCI_DEVICE_ID_PLX_9030,
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/tty/serial/atmel_serial.c linux-libre-4.1.51-gnu/drivers/tty/serial/atmel_serial.c
--- linux-libre-4.1.50-gnu/drivers/tty/serial/atmel_serial.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/tty/serial/atmel_serial.c	2018-03-27 16:15:21.000000000 -0400
@@ -1687,6 +1687,7 @@ static void atmel_get_ip_name(struct uar
 		switch (version) {
 		case 0x302:
 		case 0x10213:
+		case 0x10302:
 			dev_dbg(port->dev, "This version is usart\n");
 			atmel_port->is_usart = true;
 			break;
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/tty/serial/sh-sci.c linux-libre-4.1.51-gnu/drivers/tty/serial/sh-sci.c
--- linux-libre-4.1.50-gnu/drivers/tty/serial/sh-sci.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/tty/serial/sh-sci.c	2018-03-27 16:15:21.000000000 -0400
@@ -736,6 +736,8 @@ static void sci_receive_chars(struct uar
 		/* Tell the rest of the system the news. New characters! */
 		tty_flip_buffer_push(tport);
 	} else {
+		/* TTY buffers full; read from RX reg to prevent lockup */
+		serial_port_in(port, SCxRDR);
 		serial_port_in(port, SCxSR); /* dummy read */
 		serial_port_out(port, SCxSR, SCxSR_RDxF_CLEAR(port));
 	}
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/usb/core/message.c linux-libre-4.1.51-gnu/drivers/usb/core/message.c
--- linux-libre-4.1.50-gnu/drivers/usb/core/message.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/usb/core/message.c	2018-03-27 16:15:21.000000000 -0400
@@ -147,6 +147,10 @@ int usb_control_msg(struct usb_device *d
 
 	ret = usb_internal_control_msg(dev, pipe, dr, data, size, timeout);
 
+	/* Linger a bit, prior to the next control message. */
+	if (dev->quirks & USB_QUIRK_DELAY_CTRL_MSG)
+		msleep(200);
+
 	kfree(dr);
 
 	return ret;
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/usb/core/quirks.c linux-libre-4.1.51-gnu/drivers/usb/core/quirks.c
--- linux-libre-4.1.50-gnu/drivers/usb/core/quirks.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/usb/core/quirks.c	2018-03-27 16:15:21.000000000 -0400
@@ -229,7 +229,8 @@ static const struct usb_device_id usb_qu
 	{ USB_DEVICE(0x1b1c, 0x1b13), .driver_info = USB_QUIRK_DELAY_INIT },
 
 	/* Corsair Strafe RGB */
-	{ USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT },
+	{ USB_DEVICE(0x1b1c, 0x1b20), .driver_info = USB_QUIRK_DELAY_INIT |
+	  USB_QUIRK_DELAY_CTRL_MSG },
 
 	/* Corsair K70 LUX */
 	{ USB_DEVICE(0x1b1c, 0x1b36), .driver_info = USB_QUIRK_DELAY_INIT },
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/usb/gadget/function/f_fs.c linux-libre-4.1.51-gnu/drivers/usb/gadget/function/f_fs.c
--- linux-libre-4.1.50-gnu/drivers/usb/gadget/function/f_fs.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/usb/gadget/function/f_fs.c	2018-03-27 16:15:21.000000000 -0400
@@ -1333,7 +1333,6 @@ ffs_fs_kill_sb(struct super_block *sb)
 	if (sb->s_fs_info) {
 		ffs_release_dev(sb->s_fs_info);
 		ffs_data_closed(sb->s_fs_info);
-		ffs_data_put(sb->s_fs_info);
 	}
 }
 
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/usb/mon/mon_text.c linux-libre-4.1.51-gnu/drivers/usb/mon/mon_text.c
--- linux-libre-4.1.50-gnu/drivers/usb/mon/mon_text.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/usb/mon/mon_text.c	2018-03-27 16:15:21.000000000 -0400
@@ -82,6 +82,8 @@ struct mon_reader_text {
 
 	wait_queue_head_t wait;
 	int printf_size;
+	size_t printf_offset;
+	size_t printf_togo;
 	char *printf_buf;
 	struct mutex printf_lock;
 
@@ -373,73 +375,103 @@ err_alloc:
 	return rc;
 }
 
-/*
- * For simplicity, we read one record in one system call and throw out
- * what does not fit. This means that the following does not work:
- *   dd if=/dbg/usbmon/0t bs=10
- * Also, we do not allow seeks and do not bother advancing the offset.
- */
+static ssize_t mon_text_copy_to_user(struct mon_reader_text *rp,
+    char __user * const buf, const size_t nbytes)
+{
+	const size_t togo = min(nbytes, rp->printf_togo);
+
+	if (copy_to_user(buf, &rp->printf_buf[rp->printf_offset], togo))
+		return -EFAULT;
+	rp->printf_togo -= togo;
+	rp->printf_offset += togo;
+	return togo;
+}
+
+/* ppos is not advanced since the llseek operation is not permitted. */
 static ssize_t mon_text_read_t(struct file *file, char __user *buf,
-				size_t nbytes, loff_t *ppos)
+    size_t nbytes, loff_t *ppos)
 {
 	struct mon_reader_text *rp = file->private_data;
 	struct mon_event_text *ep;
 	struct mon_text_ptr ptr;
+	ssize_t ret;
 
-	if (IS_ERR(ep = mon_text_read_wait(rp, file)))
-		return PTR_ERR(ep);
 	mutex_lock(&rp->printf_lock);
-	ptr.cnt = 0;
-	ptr.pbuf = rp->printf_buf;
-	ptr.limit = rp->printf_size;
 
-	mon_text_read_head_t(rp, &ptr, ep);
-	mon_text_read_statset(rp, &ptr, ep);
-	ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt,
-	    " %d", ep->length);
-	mon_text_read_data(rp, &ptr, ep);
+	if (rp->printf_togo == 0) {
 
-	if (copy_to_user(buf, rp->printf_buf, ptr.cnt))
-		ptr.cnt = -EFAULT;
+		ep = mon_text_read_wait(rp, file);
+		if (IS_ERR(ep)) {
+			mutex_unlock(&rp->printf_lock);
+			return PTR_ERR(ep);
+		}
+		ptr.cnt = 0;
+		ptr.pbuf = rp->printf_buf;
+		ptr.limit = rp->printf_size;
+
+		mon_text_read_head_t(rp, &ptr, ep);
+		mon_text_read_statset(rp, &ptr, ep);
+		ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt,
+		    " %d", ep->length);
+		mon_text_read_data(rp, &ptr, ep);
+
+		rp->printf_togo = ptr.cnt;
+		rp->printf_offset = 0;
+
+		kmem_cache_free(rp->e_slab, ep);
+	}
+
+	ret = mon_text_copy_to_user(rp, buf, nbytes);
 	mutex_unlock(&rp->printf_lock);
-	kmem_cache_free(rp->e_slab, ep);
-	return ptr.cnt;
+	return ret;
 }
 
+/* ppos is not advanced since the llseek operation is not permitted. */
 static ssize_t mon_text_read_u(struct file *file, char __user *buf,
-				size_t nbytes, loff_t *ppos)
+    size_t nbytes, loff_t *ppos)
 {
 	struct mon_reader_text *rp = file->private_data;
 	struct mon_event_text *ep;
 	struct mon_text_ptr ptr;
+	ssize_t ret;
 
-	if (IS_ERR(ep = mon_text_read_wait(rp, file)))
-		return PTR_ERR(ep);
 	mutex_lock(&rp->printf_lock);
-	ptr.cnt = 0;
-	ptr.pbuf = rp->printf_buf;
-	ptr.limit = rp->printf_size;
 
-	mon_text_read_head_u(rp, &ptr, ep);
-	if (ep->type == 'E') {
-		mon_text_read_statset(rp, &ptr, ep);
-	} else if (ep->xfertype == USB_ENDPOINT_XFER_ISOC) {
-		mon_text_read_isostat(rp, &ptr, ep);
-		mon_text_read_isodesc(rp, &ptr, ep);
-	} else if (ep->xfertype == USB_ENDPOINT_XFER_INT) {
-		mon_text_read_intstat(rp, &ptr, ep);
-	} else {
-		mon_text_read_statset(rp, &ptr, ep);
+	if (rp->printf_togo == 0) {
+
+		ep = mon_text_read_wait(rp, file);
+		if (IS_ERR(ep)) {
+			mutex_unlock(&rp->printf_lock);
+			return PTR_ERR(ep);
+		}
+		ptr.cnt = 0;
+		ptr.pbuf = rp->printf_buf;
+		ptr.limit = rp->printf_size;
+
+		mon_text_read_head_u(rp, &ptr, ep);
+		if (ep->type == 'E') {
+			mon_text_read_statset(rp, &ptr, ep);
+		} else if (ep->xfertype == USB_ENDPOINT_XFER_ISOC) {
+			mon_text_read_isostat(rp, &ptr, ep);
+			mon_text_read_isodesc(rp, &ptr, ep);
+		} else if (ep->xfertype == USB_ENDPOINT_XFER_INT) {
+			mon_text_read_intstat(rp, &ptr, ep);
+		} else {
+			mon_text_read_statset(rp, &ptr, ep);
+		}
+		ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt,
+		    " %d", ep->length);
+		mon_text_read_data(rp, &ptr, ep);
+
+		rp->printf_togo = ptr.cnt;
+		rp->printf_offset = 0;
+
+		kmem_cache_free(rp->e_slab, ep);
 	}
-	ptr.cnt += snprintf(ptr.pbuf + ptr.cnt, ptr.limit - ptr.cnt,
-	    " %d", ep->length);
-	mon_text_read_data(rp, &ptr, ep);
 
-	if (copy_to_user(buf, rp->printf_buf, ptr.cnt))
-		ptr.cnt = -EFAULT;
+	ret = mon_text_copy_to_user(rp, buf, nbytes);
 	mutex_unlock(&rp->printf_lock);
-	kmem_cache_free(rp->e_slab, ep);
-	return ptr.cnt;
+	return ret;
 }
 
 static struct mon_event_text *mon_text_read_wait(struct mon_reader_text *rp,
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/usb/storage/uas.c linux-libre-4.1.51-gnu/drivers/usb/storage/uas.c
--- linux-libre-4.1.50-gnu/drivers/usb/storage/uas.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/usb/storage/uas.c	2018-03-27 16:15:21.000000000 -0400
@@ -1052,7 +1052,7 @@ static int uas_post_reset(struct usb_int
 		return 0;
 
 	err = uas_configure_endpoints(devinfo);
-	if (err && err != ENODEV)
+	if (err && err != -ENODEV)
 		shost_printk(KERN_ERR, shost,
 			     "%s: alloc streams error %d after reset",
 			     __func__, err);
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/usb/storage/unusual_devs.h linux-libre-4.1.51-gnu/drivers/usb/storage/unusual_devs.h
--- linux-libre-4.1.50-gnu/drivers/usb/storage/unusual_devs.h	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/usb/storage/unusual_devs.h	2018-03-27 16:15:21.000000000 -0400
@@ -2131,6 +2131,13 @@ UNUSUAL_DEV(  0x22b8, 0x3010, 0x0001, 0x
 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
 		US_FL_FIX_CAPACITY | US_FL_IGNORE_RESIDUE ),
 
+/* Reported by Teijo Kinnunen <teijo.kinnunen@code-q.fi> */
+UNUSUAL_DEV(  0x152d, 0x2567, 0x0117, 0x0117,
+		"JMicron",
+		"USB to ATA/ATAPI Bridge",
+		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+		US_FL_BROKEN_FUA ),
+
 /* Reported-by George Cherian <george.cherian@cavium.com> */
 UNUSUAL_DEV(0x152d, 0x9561, 0x0000, 0x9999,
 		"JMicron",
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/watchdog/hpwdt.c linux-libre-4.1.51-gnu/drivers/watchdog/hpwdt.c
--- linux-libre-4.1.50-gnu/drivers/watchdog/hpwdt.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/watchdog/hpwdt.c	2018-03-27 16:15:21.000000000 -0400
@@ -51,6 +51,7 @@ static char expect_release;
 static unsigned long hpwdt_is_open;
 
 static void __iomem *pci_mem_addr;		/* the PCI-memory address */
+static unsigned long __iomem *hpwdt_nmistat;
 static unsigned long __iomem *hpwdt_timer_reg;
 static unsigned long __iomem *hpwdt_timer_con;
 
@@ -474,6 +475,11 @@ static int hpwdt_time_left(void)
 }
 
 #ifdef CONFIG_HPWDT_NMI_DECODING
+static int hpwdt_my_nmi(void)
+{
+	return ioread8(hpwdt_nmistat) & 0x6;
+}
+
 /*
  *	NMI Handler
  */
@@ -485,6 +491,9 @@ static int hpwdt_pretimeout(unsigned int
 	if (!hpwdt_nmi_decoding)
 		goto out;
 
+	if ((ulReason == NMI_UNKNOWN) && !hpwdt_my_nmi())
+		return NMI_DONE;
+
 	spin_lock_irqsave(&rom_lock, rom_pl);
 	if (!die_nmi_called && !is_icru && !is_uefi)
 		asminline_call(&cmn_regs, cru_rom_addr);
@@ -686,7 +695,7 @@ static void dmi_find_icru(const struct d
 		smbios_proliant_ptr = (struct smbios_proliant_info *) dm;
 		if (smbios_proliant_ptr->misc_features & 0x01)
 			is_icru = 1;
-		if (smbios_proliant_ptr->misc_features & 0x408)
+		if (smbios_proliant_ptr->misc_features & 0x1400)
 			is_uefi = 1;
 	}
 }
@@ -826,6 +835,7 @@ static int hpwdt_init_one(struct pci_dev
 		retval = -ENOMEM;
 		goto error_pci_iomap;
 	}
+	hpwdt_nmistat	= pci_mem_addr + 0x6e;
 	hpwdt_timer_reg = pci_mem_addr + 0x70;
 	hpwdt_timer_con = pci_mem_addr + 0x72;
 
diff -druNp --no-dereference linux-libre-4.1.50-gnu/drivers/xen/gntdev.c linux-libre-4.1.51-gnu/drivers/xen/gntdev.c
--- linux-libre-4.1.50-gnu/drivers/xen/gntdev.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/drivers/xen/gntdev.c	2018-03-27 16:15:21.000000000 -0400
@@ -378,10 +378,8 @@ static int unmap_grant_pages(struct gran
 		}
 		range = 0;
 		while (range < pages) {
-			if (map->unmap_ops[offset+range].handle == -1) {
-				range--;
+			if (map->unmap_ops[offset+range].handle == -1)
 				break;
-			}
 			range++;
 		}
 		err = __unmap_grant_pages(map, offset, range);
@@ -876,8 +874,10 @@ unlock_out:
 out_unlock_put:
 	mutex_unlock(&priv->lock);
 out_put_map:
-	if (use_ptemod)
+	if (use_ptemod) {
 		map->vma = NULL;
+		unmap_grant_pages(map, 0, map->count);
+	}
 	gntdev_put_map(priv, map);
 	return err;
 }
diff -druNp --no-dereference linux-libre-4.1.50-gnu/fs/btrfs/acl.c linux-libre-4.1.51-gnu/fs/btrfs/acl.c
--- linux-libre-4.1.50-gnu/fs/btrfs/acl.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/fs/btrfs/acl.c	2018-03-27 16:15:21.000000000 -0400
@@ -82,12 +82,6 @@ static int __btrfs_set_acl(struct btrfs_
 	switch (type) {
 	case ACL_TYPE_ACCESS:
 		name = POSIX_ACL_XATTR_ACCESS;
-		if (acl) {
-			ret = posix_acl_update_mode(inode, &inode->i_mode, &acl);
-			if (ret)
-				return ret;
-		}
-		ret = 0;
 		break;
 	case ACL_TYPE_DEFAULT:
 		if (!S_ISDIR(inode->i_mode))
@@ -123,7 +117,18 @@ out:
 
 int btrfs_set_acl(struct inode *inode, struct posix_acl *acl, int type)
 {
-	return __btrfs_set_acl(NULL, inode, acl, type);
+	int ret;
+	umode_t old_mode = inode->i_mode;
+
+	if (type == ACL_TYPE_ACCESS && acl) {
+		ret = posix_acl_update_mode(inode, &inode->i_mode, &acl);
+		if (ret)
+			return ret;
+	}
+	ret = __btrfs_set_acl(NULL, inode, acl, type);
+	if (ret)
+		inode->i_mode = old_mode;
+	return ret;
 }
 
 /*
diff -druNp --no-dereference linux-libre-4.1.50-gnu/fs/super.c linux-libre-4.1.51-gnu/fs/super.c
--- linux-libre-4.1.50-gnu/fs/super.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/fs/super.c	2018-03-27 16:15:21.000000000 -0400
@@ -481,7 +481,11 @@ retry:
 	hlist_add_head(&s->s_instances, &type->fs_supers);
 	spin_unlock(&sb_lock);
 	get_filesystem(type);
-	register_shrinker(&s->s_shrink);
+	err = register_shrinker(&s->s_shrink);
+	if (err) {
+		deactivate_locked_super(s);
+		s = ERR_PTR(err);
+	}
 	return s;
 }
 
diff -druNp --no-dereference linux-libre-4.1.50-gnu/fs/xfs/xfs_qm.c linux-libre-4.1.51-gnu/fs/xfs/xfs_qm.c
--- linux-libre-4.1.50-gnu/fs/xfs/xfs_qm.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/fs/xfs/xfs_qm.c	2018-03-27 16:15:21.000000000 -0400
@@ -47,7 +47,7 @@
 STATIC int	xfs_qm_init_quotainos(xfs_mount_t *);
 STATIC int	xfs_qm_init_quotainfo(xfs_mount_t *);
 
-
+STATIC void	xfs_qm_destroy_quotainos(xfs_quotainfo_t *qi);
 STATIC void	xfs_qm_dqfree_one(struct xfs_dquot *dqp);
 /*
  * We use the batch lookup interface to iterate over the dquots as it
@@ -660,9 +660,17 @@ xfs_qm_init_quotainfo(
 	qinf->qi_shrinker.scan_objects = xfs_qm_shrink_scan;
 	qinf->qi_shrinker.seeks = DEFAULT_SEEKS;
 	qinf->qi_shrinker.flags = SHRINKER_NUMA_AWARE;
-	register_shrinker(&qinf->qi_shrinker);
+
+	error = register_shrinker(&qinf->qi_shrinker);
+	if (error)
+		goto out_free_inos;
+
 	return 0;
 
+out_free_inos:
+	mutex_destroy(&qinf->qi_quotaofflock);
+	mutex_destroy(&qinf->qi_tree_lock);
+	xfs_qm_destroy_quotainos(qinf);
 out_free_lru:
 	list_lru_destroy(&qinf->qi_lru);
 out_free_qinf:
@@ -671,7 +679,6 @@ out_free_qinf:
 	return error;
 }
 
-
 /*
  * Gets called when unmounting a filesystem or when all quotas get
  * turned off.
@@ -688,19 +695,8 @@ xfs_qm_destroy_quotainfo(
 
 	unregister_shrinker(&qi->qi_shrinker);
 	list_lru_destroy(&qi->qi_lru);
-
-	if (qi->qi_uquotaip) {
-		IRELE(qi->qi_uquotaip);
-		qi->qi_uquotaip = NULL; /* paranoia */
-	}
-	if (qi->qi_gquotaip) {
-		IRELE(qi->qi_gquotaip);
-		qi->qi_gquotaip = NULL;
-	}
-	if (qi->qi_pquotaip) {
-		IRELE(qi->qi_pquotaip);
-		qi->qi_pquotaip = NULL;
-	}
+	xfs_qm_destroy_quotainos(qi);
+	mutex_destroy(&qi->qi_tree_lock);
 	mutex_destroy(&qi->qi_quotaofflock);
 	kmem_free(qi);
 	mp->m_quotainfo = NULL;
@@ -1563,6 +1559,24 @@ error_rele:
 }
 
 STATIC void
+xfs_qm_destroy_quotainos(
+	xfs_quotainfo_t	*qi)
+{
+	if (qi->qi_uquotaip) {
+		IRELE(qi->qi_uquotaip);
+		qi->qi_uquotaip = NULL; /* paranoia */
+	}
+	if (qi->qi_gquotaip) {
+		IRELE(qi->qi_gquotaip);
+		qi->qi_gquotaip = NULL;
+	}
+	if (qi->qi_pquotaip) {
+		IRELE(qi->qi_pquotaip);
+		qi->qi_pquotaip = NULL;
+	}
+}
+
+STATIC void
 xfs_qm_dqfree_one(
 	struct xfs_dquot	*dqp)
 {
diff -druNp --no-dereference linux-libre-4.1.50-gnu/include/linux/nospec.h linux-libre-4.1.51-gnu/include/linux/nospec.h
--- linux-libre-4.1.50-gnu/include/linux/nospec.h	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/include/linux/nospec.h	2018-03-27 16:15:21.000000000 -0400
@@ -5,6 +5,7 @@
 
 #ifndef _LINUX_NOSPEC_H
 #define _LINUX_NOSPEC_H
+#include <asm/barrier.h>
 
 /**
  * array_index_mask_nospec() - generate a ~0 mask when index < size, 0 otherwise
@@ -66,7 +67,6 @@ static inline unsigned long array_index_
 	BUILD_BUG_ON(sizeof(_i) > sizeof(long));			\
 	BUILD_BUG_ON(sizeof(_s) > sizeof(long));			\
 									\
-	_i &= _mask;							\
-	_i;								\
+	(typeof(_i)) (_i & _mask);					\
 })
 #endif /* _LINUX_NOSPEC_H */
diff -druNp --no-dereference linux-libre-4.1.50-gnu/include/linux/usb/quirks.h linux-libre-4.1.51-gnu/include/linux/usb/quirks.h
--- linux-libre-4.1.50-gnu/include/linux/usb/quirks.h	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/include/linux/usb/quirks.h	2018-03-27 16:15:21.000000000 -0400
@@ -56,4 +56,7 @@
  */
 #define USB_QUIRK_LINEAR_FRAME_INTR_BINTERVAL	BIT(11)
 
+/* Device needs a pause after every control message. */
+#define USB_QUIRK_DELAY_CTRL_MSG		BIT(13)
+
 #endif /* __LINUX_USB_QUIRKS_H */
diff -druNp --no-dereference linux-libre-4.1.50-gnu/include/linux/workqueue.h linux-libre-4.1.51-gnu/include/linux/workqueue.h
--- linux-libre-4.1.50-gnu/include/linux/workqueue.h	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/include/linux/workqueue.h	2018-03-27 16:15:21.000000000 -0400
@@ -449,6 +449,7 @@ extern bool cancel_delayed_work_sync(str
 
 extern void workqueue_set_max_active(struct workqueue_struct *wq,
 				     int max_active);
+extern struct work_struct *current_work(void);
 extern bool current_is_workqueue_rescuer(void);
 extern bool workqueue_congested(int cpu, struct workqueue_struct *wq);
 extern unsigned int work_busy(struct work_struct *work);
diff -druNp --no-dereference linux-libre-4.1.50-gnu/include/net/udplite.h linux-libre-4.1.51-gnu/include/net/udplite.h
--- linux-libre-4.1.50-gnu/include/net/udplite.h	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/include/net/udplite.h	2018-03-27 16:15:21.000000000 -0400
@@ -62,6 +62,7 @@ static inline int udplite_checksum_init(
 		UDP_SKB_CB(skb)->cscov = cscov;
 		if (skb->ip_summed == CHECKSUM_COMPLETE)
 			skb->ip_summed = CHECKSUM_NONE;
+		skb->csum_valid = 0;
         }
 
 	return 0;
diff -druNp --no-dereference linux-libre-4.1.50-gnu/kernel/time/hrtimer.c linux-libre-4.1.51-gnu/kernel/time/hrtimer.c
--- linux-libre-4.1.50-gnu/kernel/time/hrtimer.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/kernel/time/hrtimer.c	2018-03-27 16:15:21.000000000 -0400
@@ -1148,7 +1148,12 @@ static void __hrtimer_init(struct hrtime
 
 	cpu_base = raw_cpu_ptr(&hrtimer_bases);
 
-	if (clock_id == CLOCK_REALTIME && mode != HRTIMER_MODE_ABS)
+	/*
+	 * POSIX magic: Relative CLOCK_REALTIME timers are not affected by
+	 * clock modifications, so they needs to become CLOCK_MONOTONIC to
+	 * ensure POSIX compliance.
+	 */
+	if (clock_id == CLOCK_REALTIME && mode & HRTIMER_MODE_REL)
 		clock_id = CLOCK_MONOTONIC;
 
 	base = hrtimer_clockid_to_base(clock_id);
diff -druNp --no-dereference linux-libre-4.1.50-gnu/kernel/workqueue.c linux-libre-4.1.51-gnu/kernel/workqueue.c
--- linux-libre-4.1.50-gnu/kernel/workqueue.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/kernel/workqueue.c	2018-03-27 16:15:21.000000000 -0400
@@ -4063,6 +4063,22 @@ void workqueue_set_max_active(struct wor
 EXPORT_SYMBOL_GPL(workqueue_set_max_active);
 
 /**
+ * current_work - retrieve %current task's work struct
+ *
+ * Determine if %current task is a workqueue worker and what it's working on.
+ * Useful to find out the context that the %current task is running in.
+ *
+ * Return: work struct if %current task is a workqueue worker, %NULL otherwise.
+ */
+struct work_struct *current_work(void)
+{
+	struct worker *worker = current_wq_worker();
+
+	return worker ? worker->current_work : NULL;
+}
+EXPORT_SYMBOL(current_work);
+
+/**
  * current_is_workqueue_rescuer - is %current workqueue rescuer?
  *
  * Determine whether %current is a workqueue rescuer.  Can be used from
diff -druNp --no-dereference linux-libre-4.1.50-gnu/lib/mpi/longlong.h linux-libre-4.1.51-gnu/lib/mpi/longlong.h
--- linux-libre-4.1.50-gnu/lib/mpi/longlong.h	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/lib/mpi/longlong.h	2018-03-27 16:15:21.000000000 -0400
@@ -671,7 +671,23 @@ do {						\
 	**************  MIPS/64  **************
 	***************************************/
 #if (defined(__mips) && __mips >= 3) && W_TYPE_SIZE == 64
-#if (__GNUC__ >= 5) || (__GNUC__ >= 4 && __GNUC_MINOR__ >= 4)
+#if defined(__mips_isa_rev) && __mips_isa_rev >= 6
+/*
+ * GCC ends up emitting a __multi3 intrinsic call for MIPS64r6 with the plain C
+ * code below, so we special case MIPS64r6 until the compiler can do better.
+ */
+#define umul_ppmm(w1, w0, u, v)						\
+do {									\
+	__asm__ ("dmulu %0,%1,%2"					\
+		 : "=d" ((UDItype)(w0))					\
+		 : "d" ((UDItype)(u)),					\
+		   "d" ((UDItype)(v)));					\
+	__asm__ ("dmuhu %0,%1,%2"					\
+		 : "=d" ((UDItype)(w1))					\
+		 : "d" ((UDItype)(u)),					\
+		   "d" ((UDItype)(v)));					\
+} while (0)
+#elif (__GNUC__ >= 5) || (__GNUC__ >= 4 && __GNUC_MINOR__ >= 4)
 #define umul_ppmm(w1, w0, u, v) \
 do {									\
 	typedef unsigned int __ll_UTItype __attribute__((mode(TI)));	\
diff -druNp --no-dereference linux-libre-4.1.50-gnu/Makefile linux-libre-4.1.51-gnu/Makefile
--- linux-libre-4.1.50-gnu/Makefile	2018-03-08 03:39:05.000000000 -0500
+++ linux-libre-4.1.51-gnu/Makefile	2018-03-28 09:43:19.000000000 -0400
@@ -1,6 +1,6 @@
 VERSION = 4
 PATCHLEVEL = 1
-SUBLEVEL = 50
+SUBLEVEL = 51
 EXTRAVERSION = -gnu
 NAME = Series 4800
 
diff -druNp --no-dereference linux-libre-4.1.50-gnu/net/bridge/br_sysfs_if.c linux-libre-4.1.51-gnu/net/bridge/br_sysfs_if.c
--- linux-libre-4.1.50-gnu/net/bridge/br_sysfs_if.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/net/bridge/br_sysfs_if.c	2018-03-27 16:15:21.000000000 -0400
@@ -229,6 +229,9 @@ static ssize_t brport_show(struct kobjec
 	struct brport_attribute *brport_attr = to_brport_attr(attr);
 	struct net_bridge_port *p = to_brport(kobj);
 
+	if (!brport_attr->show)
+		return -EINVAL;
+
 	return brport_attr->show(p, buf);
 }
 
diff -druNp --no-dereference linux-libre-4.1.50-gnu/net/bridge/netfilter/ebtables.c linux-libre-4.1.51-gnu/net/bridge/netfilter/ebtables.c
--- linux-libre-4.1.50-gnu/net/bridge/netfilter/ebtables.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/net/bridge/netfilter/ebtables.c	2018-03-27 16:15:21.000000000 -0400
@@ -2019,7 +2019,9 @@ static int ebt_size_mwt(struct compat_eb
 		if (match_kern)
 			match_kern->match_size = ret;
 
-		WARN_ON(type == EBT_COMPAT_TARGET && size_left);
+		if (WARN_ON(type == EBT_COMPAT_TARGET && size_left))
+			return -EINVAL;
+
 		match32 = (struct compat_ebt_entry_mwt *) buf;
 	}
 
@@ -2076,6 +2078,15 @@ static int size_entry_mwt(struct ebt_ent
 	 *
 	 * offsets are relative to beginning of struct ebt_entry (i.e., 0).
 	 */
+	for (i = 0; i < 4 ; ++i) {
+		if (offsets[i] >= *total)
+			return -EINVAL;
+		if (i == 0)
+			continue;
+		if (offsets[i-1] > offsets[i])
+			return -EINVAL;
+	}
+
 	for (i = 0, j = 1 ; j < 4 ; j++, i++) {
 		struct compat_ebt_entry_mwt *match32;
 		unsigned int size;
diff -druNp --no-dereference linux-libre-4.1.50-gnu/net/bridge/netfilter/ebt_among.c linux-libre-4.1.51-gnu/net/bridge/netfilter/ebt_among.c
--- linux-libre-4.1.50-gnu/net/bridge/netfilter/ebt_among.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/net/bridge/netfilter/ebt_among.c	2018-03-27 16:15:21.000000000 -0400
@@ -172,18 +172,35 @@ ebt_among_mt(const struct sk_buff *skb,
 	return true;
 }
 
+static bool poolsize_invalid(const struct ebt_mac_wormhash *w)
+{
+	return w && w->poolsize >= (INT_MAX / sizeof(struct ebt_mac_wormhash_tuple));
+}
+
 static int ebt_among_mt_check(const struct xt_mtchk_param *par)
 {
 	const struct ebt_among_info *info = par->matchinfo;
 	const struct ebt_entry_match *em =
 		container_of(par->matchinfo, const struct ebt_entry_match, data);
-	int expected_length = sizeof(struct ebt_among_info);
+	unsigned int expected_length = sizeof(struct ebt_among_info);
 	const struct ebt_mac_wormhash *wh_dst, *wh_src;
 	int err;
 
+	if (expected_length > em->match_size)
+		return -EINVAL;
+
 	wh_dst = ebt_among_wh_dst(info);
-	wh_src = ebt_among_wh_src(info);
+	if (poolsize_invalid(wh_dst))
+		return -EINVAL;
+
 	expected_length += ebt_mac_wormhash_size(wh_dst);
+	if (expected_length > em->match_size)
+		return -EINVAL;
+
+	wh_src = ebt_among_wh_src(info);
+	if (poolsize_invalid(wh_src))
+		return -EINVAL;
+
 	expected_length += ebt_mac_wormhash_size(wh_src);
 
 	if (em->match_size != EBT_ALIGN(expected_length)) {
diff -druNp --no-dereference linux-libre-4.1.50-gnu/net/core/dev.c linux-libre-4.1.51-gnu/net/core/dev.c
--- linux-libre-4.1.50-gnu/net/core/dev.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/net/core/dev.c	2018-03-27 16:15:21.000000000 -0400
@@ -2129,8 +2129,11 @@ EXPORT_SYMBOL(netif_set_xps_queue);
  */
 int netif_set_real_num_tx_queues(struct net_device *dev, unsigned int txq)
 {
+	bool disabling;
 	int rc;
 
+	disabling = txq < dev->real_num_tx_queues;
+
 	if (txq < 1 || txq > dev->num_tx_queues)
 		return -EINVAL;
 
@@ -2146,15 +2149,19 @@ int netif_set_real_num_tx_queues(struct
 		if (dev->num_tc)
 			netif_setup_tc(dev, txq);
 
-		if (txq < dev->real_num_tx_queues) {
+		dev->real_num_tx_queues = txq;
+
+		if (disabling) {
+			synchronize_net();
 			qdisc_reset_all_tx_gt(dev, txq);
 #ifdef CONFIG_XPS
 			netif_reset_xps_queues_gt(dev, txq);
 #endif
 		}
+	} else {
+		dev->real_num_tx_queues = txq;
 	}
 
-	dev->real_num_tx_queues = txq;
 	return 0;
 }
 EXPORT_SYMBOL(netif_set_real_num_tx_queues);
diff -druNp --no-dereference linux-libre-4.1.50-gnu/net/ipv4/route.c linux-libre-4.1.51-gnu/net/ipv4/route.c
--- linux-libre-4.1.50-gnu/net/ipv4/route.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/net/ipv4/route.c	2018-03-27 16:15:21.000000000 -0400
@@ -122,10 +122,13 @@ static int ip_rt_redirect_silence __read
 static int ip_rt_error_cost __read_mostly	= HZ;
 static int ip_rt_error_burst __read_mostly	= 5 * HZ;
 static int ip_rt_mtu_expires __read_mostly	= 10 * 60 * HZ;
-static int ip_rt_min_pmtu __read_mostly		= 512 + 20 + 20;
+static u32 ip_rt_min_pmtu __read_mostly		= 512 + 20 + 20;
 static int ip_rt_min_advmss __read_mostly	= 256;
 
 static int ip_rt_gc_timeout __read_mostly	= RT_GC_TIMEOUT;
+
+static int ip_min_valid_pmtu __read_mostly	= IPV4_MIN_MTU;
+
 /*
  *	Interface to generic destination cache.
  */
@@ -2689,7 +2692,8 @@ static struct ctl_table ipv4_route_table
 		.data		= &ip_rt_min_pmtu,
 		.maxlen		= sizeof(int),
 		.mode		= 0644,
-		.proc_handler	= proc_dointvec,
+		.proc_handler	= proc_dointvec_minmax,
+		.extra1		= &ip_min_valid_pmtu,
 	},
 	{
 		.procname	= "min_adv_mss",
diff -druNp --no-dereference linux-libre-4.1.50-gnu/net/ipv4/udp.c linux-libre-4.1.51-gnu/net/ipv4/udp.c
--- linux-libre-4.1.50-gnu/net/ipv4/udp.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/net/ipv4/udp.c	2018-03-27 16:15:21.000000000 -0400
@@ -1733,6 +1733,11 @@ static inline int udp4_csum_init(struct
 		err = udplite_checksum_init(skb, uh);
 		if (err)
 			return err;
+
+		if (UDP_SKB_CB(skb)->partial_cov) {
+			skb->csum = inet_compute_pseudo(skb, proto);
+			return 0;
+		}
 	}
 
 	return skb_checksum_init_zero_check(skb, proto, uh->check,
diff -druNp --no-dereference linux-libre-4.1.50-gnu/net/ipv6/ip6_checksum.c linux-libre-4.1.51-gnu/net/ipv6/ip6_checksum.c
--- linux-libre-4.1.50-gnu/net/ipv6/ip6_checksum.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/net/ipv6/ip6_checksum.c	2018-03-27 16:15:21.000000000 -0400
@@ -73,6 +73,11 @@ int udp6_csum_init(struct sk_buff *skb,
 		err = udplite_checksum_init(skb, uh);
 		if (err)
 			return err;
+
+		if (UDP_SKB_CB(skb)->partial_cov) {
+			skb->csum = ip6_compute_pseudo(skb, proto);
+			return 0;
+		}
 	}
 
 	/* To support RFC 6936 (allow zero checksum in UDP/IPV6 for tunnels)
diff -druNp --no-dereference linux-libre-4.1.50-gnu/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c linux-libre-4.1.51-gnu/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c
--- linux-libre-4.1.50-gnu/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/net/ipv6/netfilter/nf_nat_l3proto_ipv6.c	2018-03-27 16:15:21.000000000 -0400
@@ -99,6 +99,10 @@ static bool nf_nat_ipv6_manip_pkt(struct
 	    !l4proto->manip_pkt(skb, &nf_nat_l3proto_ipv6, iphdroff, hdroff,
 				target, maniptype))
 		return false;
+
+	/* must reload, offset might have changed */
+	ipv6h = (void *)skb->data + iphdroff;
+
 manip_addr:
 	if (maniptype == NF_NAT_MANIP_SRC)
 		ipv6h->saddr = target->src.u3.in6;
diff -druNp --no-dereference linux-libre-4.1.50-gnu/net/ipv6/route.c linux-libre-4.1.51-gnu/net/ipv6/route.c
--- linux-libre-4.1.50-gnu/net/ipv6/route.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/net/ipv6/route.c	2018-03-27 16:15:21.000000000 -0400
@@ -1379,6 +1379,7 @@ struct dst_entry *icmp6_dst_alloc(struct
 	}
 
 	rt->dst.flags |= DST_HOST;
+	rt->dst.input = ip6_input;
 	rt->dst.output  = ip6_output;
 	atomic_set(&rt->dst.__refcnt, 1);
 	rt->rt6i_gateway  = fl6->daddr;
diff -druNp --no-dereference linux-libre-4.1.50-gnu/net/ipv6/sit.c linux-libre-4.1.51-gnu/net/ipv6/sit.c
--- linux-libre-4.1.50-gnu/net/ipv6/sit.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/net/ipv6/sit.c	2018-03-27 16:15:21.000000000 -0400
@@ -176,7 +176,7 @@ static void ipip6_tunnel_clone_6rd(struc
 #ifdef CONFIG_IPV6_SIT_6RD
 	struct ip_tunnel *t = netdev_priv(dev);
 
-	if (t->dev == sitn->fb_tunnel_dev) {
+	if (dev == sitn->fb_tunnel_dev) {
 		ipv6_addr_set(&t->ip6rd.prefix, htonl(0x20020000), 0, 0, 0);
 		t->ip6rd.relay_prefix = 0;
 		t->ip6rd.prefixlen = 16;
diff -druNp --no-dereference linux-libre-4.1.50-gnu/net/netfilter/nf_nat_proto_common.c linux-libre-4.1.51-gnu/net/netfilter/nf_nat_proto_common.c
--- linux-libre-4.1.50-gnu/net/netfilter/nf_nat_proto_common.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/net/netfilter/nf_nat_proto_common.c	2018-03-27 16:15:21.000000000 -0400
@@ -41,7 +41,7 @@ void nf_nat_l4proto_unique_tuple(const s
 				 const struct nf_conn *ct,
 				 u16 *rover)
 {
-	unsigned int range_size, min, i;
+	unsigned int range_size, min, max, i;
 	__be16 *portptr;
 	u_int16_t off;
 
@@ -71,7 +71,10 @@ void nf_nat_l4proto_unique_tuple(const s
 		}
 	} else {
 		min = ntohs(range->min_proto.all);
-		range_size = ntohs(range->max_proto.all) - min + 1;
+		max = ntohs(range->max_proto.all);
+		if (unlikely(max < min))
+			swap(max, min);
+		range_size = max - min + 1;
 	}
 
 	if (range->flags & NF_NAT_RANGE_PROTO_RANDOM) {
diff -druNp --no-dereference linux-libre-4.1.50-gnu/net/netfilter/xt_IDLETIMER.c linux-libre-4.1.51-gnu/net/netfilter/xt_IDLETIMER.c
--- linux-libre-4.1.50-gnu/net/netfilter/xt_IDLETIMER.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/net/netfilter/xt_IDLETIMER.c	2018-03-27 16:15:21.000000000 -0400
@@ -146,11 +146,11 @@ static int idletimer_tg_create(struct id
 		    (unsigned long) info->timer);
 	info->timer->refcnt = 1;
 
+	INIT_WORK(&info->timer->work, idletimer_tg_work);
+
 	mod_timer(&info->timer->timer,
 		  msecs_to_jiffies(info->timeout * 1000) + jiffies);
 
-	INIT_WORK(&info->timer->work, idletimer_tg_work);
-
 	return 0;
 
 out_free_attr:
@@ -191,7 +191,10 @@ static int idletimer_tg_checkentry(const
 		pr_debug("timeout value is zero\n");
 		return -EINVAL;
 	}
-
+	if (info->timeout >= INT_MAX / 1000) {
+		pr_debug("timeout value is too big\n");
+		return -EINVAL;
+	}
 	if (info->label[0] == '\0' ||
 	    strnlen(info->label,
 		    MAX_IDLETIMER_LABEL_SIZE) == MAX_IDLETIMER_LABEL_SIZE) {
diff -druNp --no-dereference linux-libre-4.1.50-gnu/net/netfilter/xt_LED.c linux-libre-4.1.51-gnu/net/netfilter/xt_LED.c
--- linux-libre-4.1.50-gnu/net/netfilter/xt_LED.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/net/netfilter/xt_LED.c	2018-03-27 16:15:21.000000000 -0400
@@ -141,10 +141,11 @@ static int led_tg_check(const struct xt_
 		goto exit_alloc;
 	}
 
-	/* See if we need to set up a timer */
-	if (ledinfo->delay > 0)
-		setup_timer(&ledinternal->timer, led_timeout_callback,
-			    (unsigned long)ledinternal);
+	/* Since the letinternal timer can be shared between multiple targets,
+	 * always set it up, even if the current target does not need it
+	 */
+	setup_timer(&ledinternal->timer, led_timeout_callback,
+		    (unsigned long)ledinternal);
 
 	list_add_tail(&ledinternal->list, &xt_led_triggers);
 
@@ -181,8 +182,7 @@ static void led_tg_destroy(const struct
 
 	list_del(&ledinternal->list);
 
-	if (ledinfo->delay > 0)
-		del_timer_sync(&ledinternal->timer);
+	del_timer_sync(&ledinternal->timer);
 
 	led_trigger_unregister(&ledinternal->netfilter_led_trigger);
 
diff -druNp --no-dereference linux-libre-4.1.50-gnu/net/netlink/genetlink.c linux-libre-4.1.51-gnu/net/netlink/genetlink.c
--- linux-libre-4.1.50-gnu/net/netlink/genetlink.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/net/netlink/genetlink.c	2018-03-27 16:15:21.000000000 -0400
@@ -1118,6 +1118,7 @@ static int genlmsg_mcast(struct sk_buff
 {
 	struct sk_buff *tmp;
 	struct net *net, *prev = NULL;
+	bool delivered = false;
 	int err;
 
 	for_each_net_rcu(net) {
@@ -1129,14 +1130,21 @@ static int genlmsg_mcast(struct sk_buff
 			}
 			err = nlmsg_multicast(prev->genl_sock, tmp,
 					      portid, group, flags);
-			if (err)
+			if (!err)
+				delivered = true;
+			else if (err != -ESRCH)
 				goto error;
 		}
 
 		prev = net;
 	}
 
-	return nlmsg_multicast(prev->genl_sock, skb, portid, group, flags);
+	err = nlmsg_multicast(prev->genl_sock, skb, portid, group, flags);
+	if (!err)
+		delivered = true;
+	else if (err != -ESRCH)
+		goto error;
+	return delivered ? 0 : -ESRCH;
  error:
 	kfree_skb(skb);
 	return err;
diff -druNp --no-dereference linux-libre-4.1.50-gnu/net/sctp/sm_make_chunk.c linux-libre-4.1.51-gnu/net/sctp/sm_make_chunk.c
--- linux-libre-4.1.50-gnu/net/sctp/sm_make_chunk.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/net/sctp/sm_make_chunk.c	2018-03-27 16:15:21.000000000 -0400
@@ -1367,10 +1367,14 @@ static struct sctp_chunk *_sctp_make_chu
 	sctp_chunkhdr_t *chunk_hdr;
 	struct sk_buff *skb;
 	struct sock *sk;
+	int chunklen;
+
+	chunklen = sizeof(*chunk_hdr) + paylen;
+	if (chunklen > SCTP_MAX_CHUNK_LEN)
+		goto nodata;
 
 	/* No need to allocate LL here, as this is only a chunk. */
-	skb = alloc_skb(WORD_ROUND(sizeof(sctp_chunkhdr_t) + paylen),
-			GFP_ATOMIC);
+	skb = alloc_skb(chunklen, GFP_ATOMIC);
 	if (!skb)
 		goto nodata;
 
diff -druNp --no-dereference linux-libre-4.1.50-gnu/net/sctp/socket.c linux-libre-4.1.51-gnu/net/sctp/socket.c
--- linux-libre-4.1.50-gnu/net/sctp/socket.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/net/sctp/socket.c	2018-03-27 16:15:21.000000000 -0400
@@ -4455,7 +4455,7 @@ static int sctp_getsockopt_autoclose(str
 	len = sizeof(int);
 	if (put_user(len, optlen))
 		return -EFAULT;
-	if (copy_to_user(optval, &sctp_sk(sk)->autoclose, sizeof(int)))
+	if (copy_to_user(optval, &sctp_sk(sk)->autoclose, len))
 		return -EFAULT;
 	return 0;
 }
@@ -5032,6 +5032,9 @@ copy_getaddrs:
 		err = -EFAULT;
 		goto out;
 	}
+	/* XXX: We should have accounted for sizeof(struct sctp_getaddrs) too,
+	 * but we can't change it anymore.
+	 */
 	if (put_user(bytes_copied, optlen))
 		err = -EFAULT;
 out:
@@ -5468,7 +5471,7 @@ static int sctp_getsockopt_maxseg(struct
 		params.assoc_id = 0;
 	} else if (len >= sizeof(struct sctp_assoc_value)) {
 		len = sizeof(struct sctp_assoc_value);
-		if (copy_from_user(&params, optval, sizeof(params)))
+		if (copy_from_user(&params, optval, len))
 			return -EFAULT;
 	} else
 		return -EINVAL;
@@ -5637,7 +5640,9 @@ static int sctp_getsockopt_active_key(st
 
 	if (len < sizeof(struct sctp_authkeyid))
 		return -EINVAL;
-	if (copy_from_user(&val, optval, sizeof(struct sctp_authkeyid)))
+
+	len = sizeof(struct sctp_authkeyid);
+	if (copy_from_user(&val, optval, len))
 		return -EFAULT;
 
 	asoc = sctp_id2assoc(sk, val.scact_assoc_id);
@@ -5649,7 +5654,6 @@ static int sctp_getsockopt_active_key(st
 	else
 		val.scact_keynumber = ep->active_key_id;
 
-	len = sizeof(struct sctp_authkeyid);
 	if (put_user(len, optlen))
 		return -EFAULT;
 	if (copy_to_user(optval, &val, len))
@@ -5675,7 +5679,7 @@ static int sctp_getsockopt_peer_auth_chu
 	if (len < sizeof(struct sctp_authchunks))
 		return -EINVAL;
 
-	if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks)))
+	if (copy_from_user(&val, optval, sizeof(val)))
 		return -EFAULT;
 
 	to = p->gauth_chunks;
@@ -5720,7 +5724,7 @@ static int sctp_getsockopt_local_auth_ch
 	if (len < sizeof(struct sctp_authchunks))
 		return -EINVAL;
 
-	if (copy_from_user(&val, optval, sizeof(struct sctp_authchunks)))
+	if (copy_from_user(&val, optval, sizeof(val)))
 		return -EFAULT;
 
 	to = p->gauth_chunks;
diff -druNp --no-dereference linux-libre-4.1.50-gnu/sound/core/seq/seq_clientmgr.c linux-libre-4.1.51-gnu/sound/core/seq/seq_clientmgr.c
--- linux-libre-4.1.50-gnu/sound/core/seq/seq_clientmgr.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/sound/core/seq/seq_clientmgr.c	2018-03-27 16:15:21.000000000 -0400
@@ -919,7 +919,8 @@ int snd_seq_dispatch_event(struct snd_se
 static int snd_seq_client_enqueue_event(struct snd_seq_client *client,
 					struct snd_seq_event *event,
 					struct file *file, int blocking,
-					int atomic, int hop)
+					int atomic, int hop,
+					struct mutex *mutexp)
 {
 	struct snd_seq_event_cell *cell;
 	int err;
@@ -957,7 +958,8 @@ static int snd_seq_client_enqueue_event(
 		return -ENXIO; /* queue is not allocated */
 
 	/* allocate an event cell */
-	err = snd_seq_event_dup(client->pool, event, &cell, !blocking || atomic, file);
+	err = snd_seq_event_dup(client->pool, event, &cell, !blocking || atomic,
+				file, mutexp);
 	if (err < 0)
 		return err;
 
@@ -1026,12 +1028,11 @@ static ssize_t snd_seq_write(struct file
 		return -ENXIO;
 
 	/* allocate the pool now if the pool is not allocated yet */ 
+	mutex_lock(&client->ioctl_mutex);
 	if (client->pool->size > 0 && !snd_seq_write_pool_allocated(client)) {
-		mutex_lock(&client->ioctl_mutex);
 		err = snd_seq_pool_init(client->pool);
-		mutex_unlock(&client->ioctl_mutex);
 		if (err < 0)
-			return -ENOMEM;
+			goto out;
 	}
 
 	/* only process whole events */
@@ -1082,7 +1083,7 @@ static ssize_t snd_seq_write(struct file
 		/* ok, enqueue it */
 		err = snd_seq_client_enqueue_event(client, &event, file,
 						   !(file->f_flags & O_NONBLOCK),
-						   0, 0);
+						   0, 0, &client->ioctl_mutex);
 		if (err < 0)
 			break;
 
@@ -1093,6 +1094,8 @@ static ssize_t snd_seq_write(struct file
 		written += len;
 	}
 
+ out:
+	mutex_unlock(&client->ioctl_mutex);
 	return written ? written : err;
 }
 
@@ -1924,6 +1927,9 @@ static int snd_seq_ioctl_set_client_pool
 	    (! snd_seq_write_pool_allocated(client) ||
 	     info.output_pool != client->pool->size)) {
 		if (snd_seq_write_pool_allocated(client)) {
+			/* is the pool in use? */
+			if (atomic_read(&client->pool->counter))
+				return -EBUSY;
 			/* remove all existing cells */
 			snd_seq_pool_mark_closing(client->pool);
 			snd_seq_queue_client_leave_cells(client->number);
@@ -2348,7 +2354,8 @@ static int kernel_client_enqueue(int cli
 	if (! cptr->accept_output)
 		result = -EPERM;
 	else /* send it */
-		result = snd_seq_client_enqueue_event(cptr, ev, file, blocking, atomic, hop);
+		result = snd_seq_client_enqueue_event(cptr, ev, file, blocking,
+						      atomic, hop, NULL);
 
 	snd_seq_client_unlock(cptr);
 	return result;
diff -druNp --no-dereference linux-libre-4.1.50-gnu/sound/core/seq/seq_fifo.c linux-libre-4.1.51-gnu/sound/core/seq/seq_fifo.c
--- linux-libre-4.1.50-gnu/sound/core/seq/seq_fifo.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/sound/core/seq/seq_fifo.c	2018-03-27 16:15:21.000000000 -0400
@@ -123,7 +123,7 @@ int snd_seq_fifo_event_in(struct snd_seq
 		return -EINVAL;
 
 	snd_use_lock_use(&f->use_lock);
-	err = snd_seq_event_dup(f->pool, event, &cell, 1, NULL); /* always non-blocking */
+	err = snd_seq_event_dup(f->pool, event, &cell, 1, NULL, NULL); /* always non-blocking */
 	if (err < 0) {
 		if ((err == -ENOMEM) || (err == -EAGAIN))
 			atomic_inc(&f->overflow);
diff -druNp --no-dereference linux-libre-4.1.50-gnu/sound/core/seq/seq_memory.c linux-libre-4.1.51-gnu/sound/core/seq/seq_memory.c
--- linux-libre-4.1.50-gnu/sound/core/seq/seq_memory.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/sound/core/seq/seq_memory.c	2018-03-27 16:15:21.000000000 -0400
@@ -221,7 +221,8 @@ void snd_seq_cell_free(struct snd_seq_ev
  */
 static int snd_seq_cell_alloc(struct snd_seq_pool *pool,
 			      struct snd_seq_event_cell **cellp,
-			      int nonblock, struct file *file)
+			      int nonblock, struct file *file,
+			      struct mutex *mutexp)
 {
 	struct snd_seq_event_cell *cell;
 	unsigned long flags;
@@ -245,7 +246,11 @@ static int snd_seq_cell_alloc(struct snd
 		set_current_state(TASK_INTERRUPTIBLE);
 		add_wait_queue(&pool->output_sleep, &wait);
 		spin_unlock_irq(&pool->lock);
+		if (mutexp)
+			mutex_unlock(mutexp);
 		schedule();
+		if (mutexp)
+			mutex_lock(mutexp);
 		spin_lock_irq(&pool->lock);
 		remove_wait_queue(&pool->output_sleep, &wait);
 		/* interrupted? */
@@ -288,7 +293,7 @@ __error:
  */
 int snd_seq_event_dup(struct snd_seq_pool *pool, struct snd_seq_event *event,
 		      struct snd_seq_event_cell **cellp, int nonblock,
-		      struct file *file)
+		      struct file *file, struct mutex *mutexp)
 {
 	int ncells, err;
 	unsigned int extlen;
@@ -305,7 +310,7 @@ int snd_seq_event_dup(struct snd_seq_poo
 	if (ncells >= pool->total_elements)
 		return -ENOMEM;
 
-	err = snd_seq_cell_alloc(pool, &cell, nonblock, file);
+	err = snd_seq_cell_alloc(pool, &cell, nonblock, file, mutexp);
 	if (err < 0)
 		return err;
 
@@ -331,7 +336,8 @@ int snd_seq_event_dup(struct snd_seq_poo
 			int size = sizeof(struct snd_seq_event);
 			if (len < size)
 				size = len;
-			err = snd_seq_cell_alloc(pool, &tmp, nonblock, file);
+			err = snd_seq_cell_alloc(pool, &tmp, nonblock, file,
+						 mutexp);
 			if (err < 0)
 				goto __error;
 			if (cell->event.data.ext.ptr == NULL)
diff -druNp --no-dereference linux-libre-4.1.50-gnu/sound/core/seq/seq_memory.h linux-libre-4.1.51-gnu/sound/core/seq/seq_memory.h
--- linux-libre-4.1.50-gnu/sound/core/seq/seq_memory.h	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/sound/core/seq/seq_memory.h	2018-03-27 16:15:21.000000000 -0400
@@ -66,7 +66,8 @@ struct snd_seq_pool {
 void snd_seq_cell_free(struct snd_seq_event_cell *cell);
 
 int snd_seq_event_dup(struct snd_seq_pool *pool, struct snd_seq_event *event,
-		      struct snd_seq_event_cell **cellp, int nonblock, struct file *file);
+		      struct snd_seq_event_cell **cellp, int nonblock,
+		      struct file *file, struct mutex *mutexp);
 
 /* return number of unused (free) cells */
 static inline int snd_seq_unused_cells(struct snd_seq_pool *pool)
diff -druNp --no-dereference linux-libre-4.1.50-gnu/sound/pci/hda/patch_realtek.c linux-libre-4.1.51-gnu/sound/pci/hda/patch_realtek.c
--- linux-libre-4.1.50-gnu/sound/pci/hda/patch_realtek.c	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/sound/pci/hda/patch_realtek.c	2018-03-27 16:15:21.000000000 -0400
@@ -4615,6 +4615,16 @@ static void alc298_fixup_speaker_volume(
 	}
 }
 
+/* disable DAC3 (0x06) selection on NID 0x17 as it has no volume amp control */
+static void alc295_fixup_disable_dac3(struct hda_codec *codec,
+				      const struct hda_fixup *fix, int action)
+{
+	if (action == HDA_FIXUP_ACT_PRE_PROBE) {
+		hda_nid_t conn[2] = { 0x02, 0x03 };
+		snd_hda_override_conn_list(codec, 0x17, 2, conn);
+	}
+}
+
 /* Hook to update amp GPIO4 for automute */
 static void alc280_hp_gpio4_automute_hook(struct hda_codec *codec,
 					  struct hda_jack_callback *jack)
@@ -4764,6 +4774,7 @@ enum {
 	ALC233_FIXUP_LENOVO_LINE2_MIC_HOTKEY,
 	ALC255_FIXUP_DELL_SPK_NOISE,
 	ALC225_FIXUP_DELL1_MIC_NO_PRESENCE,
+	ALC295_FIXUP_DISABLE_DAC3,
 	ALC280_FIXUP_HP_HEADSET_MIC,
 	ALC221_FIXUP_HP_FRONT_MIC,
 	ALC292_FIXUP_TPT460,
@@ -5453,6 +5464,10 @@ static const struct hda_fixup alc269_fix
 		.chained = true,
 		.chain_id = ALC298_FIXUP_DELL_AIO_MIC_NO_PRESENCE,
 	},
+	[ALC295_FIXUP_DISABLE_DAC3] = {
+		.type = HDA_FIXUP_FUNC,
+		.v.func = alc295_fixup_disable_dac3,
+	},
 	[ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER] = {
 		.type = HDA_FIXUP_PINS,
 		.v.pins = (const struct hda_pintbl[]) {
@@ -5510,6 +5525,7 @@ static const struct snd_pci_quirk alc269
 	SND_PCI_QUIRK(0x1028, 0x0725, "Dell Inspiron 3162", ALC255_FIXUP_DELL_SPK_NOISE),
 	SND_PCI_QUIRK(0x1028, 0x075b, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
 	SND_PCI_QUIRK(0x1028, 0x075d, "Dell AIO", ALC298_FIXUP_SPK_VOLUME),
+	SND_PCI_QUIRK(0x1028, 0x07b0, "Dell Precision 7520", ALC295_FIXUP_DISABLE_DAC3),
 	SND_PCI_QUIRK(0x1028, 0x0798, "Dell Inspiron 17 7000 Gaming", ALC256_FIXUP_DELL_INSPIRON_7559_SUBWOOFER),
 	SND_PCI_QUIRK(0x1028, 0x082a, "Dell XPS 13 9360", ALC256_FIXUP_DELL_XPS_13_HEADPHONE_NOISE),
 	SND_PCI_QUIRK(0x1028, 0x164a, "Dell", ALC293_FIXUP_DELL1_MIC_NO_PRESENCE),
diff -druNp --no-dereference linux-libre-4.1.50-gnu/sound/usb/quirks-table.h linux-libre-4.1.51-gnu/sound/usb/quirks-table.h
--- linux-libre-4.1.50-gnu/sound/usb/quirks-table.h	2018-03-05 16:35:54.000000000 -0500
+++ linux-libre-4.1.51-gnu/sound/usb/quirks-table.h	2018-03-27 16:15:21.000000000 -0400
@@ -3274,4 +3274,51 @@ AU0828_DEVICE(0x2040, 0x7270, "Hauppauge
 	}
 },
 
+{
+	/*
+	 * Bower's & Wilkins PX headphones only support the 48 kHz sample rate
+	 * even though it advertises more. The capture interface doesn't work
+	 * even on windows.
+	 */
+	USB_DEVICE(0x19b5, 0x0021),
+	.driver_info = (unsigned long) &(const struct snd_usb_audio_quirk) {
+		.ifnum = QUIRK_ANY_INTERFACE,
+		.type = QUIRK_COMPOSITE,
+		.data = (const struct snd_usb_audio_quirk[]) {
+			{
+				.ifnum = 0,
+				.type = QUIRK_AUDIO_STANDARD_MIXER,
+			},
+			/* Capture */
+			{
+				.ifnum = 1,
+				.type = QUIRK_IGNORE_INTERFACE,
+			},
+			/* Playback */
+			{
+				.ifnum = 2,
+				.type = QUIRK_AUDIO_FIXED_ENDPOINT,
+				.data = &(const struct audioformat) {
+					.formats = SNDRV_PCM_FMTBIT_S16_LE,
+					.channels = 2,
+					.iface = 2,
+					.altsetting = 1,
+					.altset_idx = 1,
+					.attributes = UAC_EP_CS_ATTR_FILL_MAX |
+						UAC_EP_CS_ATTR_SAMPLE_RATE,
+					.endpoint = 0x03,
+					.ep_attr = USB_ENDPOINT_XFER_ISOC,
+					.rates = SNDRV_PCM_RATE_48000,
+					.rate_min = 48000,
+					.rate_max = 48000,
+					.nr_rates = 1,
+					.rate_table = (unsigned int[]) {
+						48000
+					}
+				}
+			},
+		}
+	}
+},
+
 #undef USB_DEVICE_VENDOR_SPEC
