Merge android-4.4.135 (c9d74f2) into msm-4.4

* refs/heads/tmp-c9d74f2
  Linux 4.4.135
  Revert "vti4: Don't override MTU passed on link creation via IFLA_MTU"
  Revert "vti4: Don't override MTU passed on link creation via IFLA_MTU"
  Linux 4.4.134
  s390/ftrace: use expoline for indirect branches
  kdb: make "mdr" command repeat
  Bluetooth: btusb: Add device ID for RTL8822BE
  ASoC: samsung: i2s: Ensure the RCLK rate is properly determined
  regulator: of: Add a missing 'of_node_put()' in an error handling path of 'of_regulator_match()'
  scsi: lpfc: Fix frequency of Release WQE CQEs
  scsi: lpfc: Fix soft lockup in lpfc worker thread during LIP testing
  scsi: lpfc: Fix issue_lip if link is disabled
  netlabel: If PF_INET6, check sk_buff ip header version
  selftests/net: fixes psock_fanout eBPF test case
  perf report: Fix memory corruption in --branch-history mode --branch-history
  perf tests: Use arch__compare_symbol_names to compare symbols
  x86/apic: Set up through-local-APIC mode on the boot CPU if 'noapic' specified
  drm/rockchip: Respect page offset for PRIME mmap calls
  MIPS: Octeon: Fix logging messages with spurious periods after newlines
  audit: return on memory error to avoid null pointer dereference
  crypto: sunxi-ss - Add MODULE_ALIAS to sun4i-ss
  clk: samsung: exynos3250: Fix PLL rates
  clk: samsung: exynos5250: Fix PLL rates
  clk: samsung: exynos5433: Fix PLL rates
  clk: samsung: exynos5260: Fix PLL rates
  clk: samsung: s3c2410: Fix PLL rates
  media: cx25821: prevent out-of-bounds read on array card
  udf: Provide saner default for invalid uid / gid
  PCI: Add function 1 DMA alias quirk for Marvell 88SE9220
  serial: arc_uart: Fix out-of-bounds access through DT alias
  serial: fsl_lpuart: Fix out-of-bounds access through DT alias
  serial: imx: Fix out-of-bounds access through serial port index
  serial: mxs-auart: Fix out-of-bounds access through serial port index
  serial: samsung: Fix out-of-bounds access through serial port index
  serial: xuartps: Fix out-of-bounds access through DT alias
  rtc: tx4939: avoid unintended sign extension on a 24 bit shift
  staging: rtl8192u: return -ENOMEM on failed allocation of priv->oldaddr
  hwrng: stm32 - add reset during probe
  enic: enable rq before updating rq descriptors
  clk: rockchip: Prevent calculating mmc phase if clock rate is zero
  media: em28xx: USB bulk packet size fix
  dmaengine: pl330: fix a race condition in case of threaded irqs
  media: s3c-camif: fix out-of-bounds array access
  media: cx23885: Set subdev host data to clk_freq pointer
  media: cx23885: Override 888 ImpactVCBe crystal frequency
  ALSA: vmaster: Propagate slave error
  x86/devicetree: Fix device IRQ settings in DT
  x86/devicetree: Initialize device tree before using it
  usb: gadget: composite: fix incorrect handling of OS desc requests
  usb: gadget: udc: change comparison to bitshift when dealing with a mask
  gfs2: Fix fallocate chunk size
  cdrom: do not call check_disk_change() inside cdrom_open()
  hwmon: (pmbus/adm1275) Accept negative page register values
  hwmon: (pmbus/max8688) Accept negative page register values
  perf/core: Fix perf_output_read_group()
  ASoC: topology: create TLV data for dapm widgets
  powerpc: Add missing prototype for arch_irq_work_raise()
  usb: gadget: ffs: Execute copy_to_user() with USER_DS set
  usb: gadget: ffs: Let setup() return USB_GADGET_DELAYED_STATUS
  usb: dwc2: Fix interval type issue
  ipmi_ssif: Fix kernel panic at msg_done_handler
  PCI: Restore config space on runtime resume despite being unbound
  MIPS: ath79: Fix AR724X_PLL_REG_PCIE_CONFIG offset
  xhci: zero usb device slot_id member when disabling and freeing a xhci slot
  KVM: lapic: stop advertising DIRECTED_EOI when in-kernel IOAPIC is in use
  i2c: mv64xxx: Apply errata delay only in standard mode
  ACPICA: acpi: acpica: fix acpi operand cache leak in nseval.c
  ACPICA: Events: add a return on failure from acpi_hw_register_read
  bcache: quit dc->writeback_thread when BCACHE_DEV_DETACHING is set
  zorro: Set up z->dev.dma_mask for the DMA API
  clk: Don't show the incorrect clock phase
  cpufreq: cppc_cpufreq: Fix cppc_cpufreq_init() failure path
  usb: dwc3: Update DWC_usb31 GTXFIFOSIZ reg fields
  arm: dts: socfpga: fix GIC PPI warning
  virtio-net: Fix operstate for virtio when no VIRTIO_NET_F_STATUS
  ima: Fallback to the builtin hash algorithm
  ima: Fix Kconfig to select TPM 2.0 CRB interface
  ath10k: Fix kernel panic while using worker (ath10k_sta_rc_update_wk)
  net/mlx5: Protect from command bit overflow
  selftests: Print the test we're running to /dev/kmsg
  tools/thermal: tmon: fix for segfault
  powerpc/perf: Fix kernel address leak via sampling registers
  powerpc/perf: Prevent kernel address leak to userspace via BHRB buffer
  rtc: hctosys: Ensure system time doesn't overflow time_t
  hwmon: (nct6775) Fix writing pwmX_mode
  parisc/pci: Switch LBA PCI bus from Hard Fail to Soft Fail mode
  m68k: set dma and coherent masks for platform FEC ethernets
  powerpc/mpic: Check if cpu_possible() in mpic_physmask()
  ACPI: acpi_pad: Fix memory leak in power saving threads
  xen/acpi: off by one in read_acpi_id()
  btrfs: fix lockdep splat in btrfs_alloc_subvolume_writers
  Btrfs: fix copy_items() return value when logging an inode
  btrfs: tests/qgroup: Fix wrong tree backref level
  Bluetooth: btusb: Add USB ID 7392:a611 for Edimax EW-7611ULB
  net: bgmac: Fix endian access in bgmac_dma_tx_ring_free()
  rtc: snvs: Fix usage of snvs_rtc_enable
  sparc64: Make atomic_xchg() an inline function rather than a macro.
  fscache: Fix hanging wait on page discarded by writeback
  KVM: VMX: raise internal error for exception during invalid protected mode state
  sched/rt: Fix rq->clock_update_flags < RQCF_ACT_SKIP warning
  ocfs2/dlm: don't handle migrate lockres if already in shutdown
  btrfs: Fix possible softlock on single core machines
  Btrfs: fix NULL pointer dereference in log_dir_items
  Btrfs: bail out on error during replay_dir_deletes
  mm: fix races between address_space dereference and free in page_evicatable
  mm/ksm: fix interaction with THP
  dp83640: Ensure against premature access to PHY registers after reset
  scsi: aacraid: Insure command thread is not recursively stopped
  cpufreq: CPPC: Initialize shared perf capabilities of CPUs
  Force log to disk before reading the AGF during a fstrim
  sr: get/drop reference to device in revalidate and check_events
  swap: divide-by-zero when zero length swap file on ssd
  fs/proc/proc_sysctl.c: fix potential page fault while unregistering sysctl table
  x86/pgtable: Don't set huge PUD/PMD on non-leaf entries
  sh: fix debug trap failure to process signals before return to user
  net: mvneta: fix enable of all initialized RXQs
  net: Fix untag for vlan packets without ethernet header
  mm/kmemleak.c: wait for scan completion before disabling free
  llc: properly handle dev_queue_xmit() return value
  net-usb: add qmi_wwan if on lte modem wistron neweb d18q1
  net/usb/qmi_wwan.c: Add USB id for lt4120 modem
  net: qmi_wwan: add BroadMobi BM806U 2020:2033
  ARM: 8748/1: mm: Define vdso_start, vdso_end as array
  batman-adv: fix packet loss for broadcasted DHCP packets to a server
  batman-adv: fix multicast-via-unicast transmission with AP isolation
  selftests: ftrace: Add a testcase for probepoint
  selftests: ftrace: Add a testcase for string type with kprobe_event
  selftests: ftrace: Add probe event argument syntax testcase
  mm/mempolicy.c: avoid use uninitialized preferred_node
  RDMA/ucma: Correct option size check using optlen
  perf/cgroup: Fix child event counting bug
  vti4: Don't override MTU passed on link creation via IFLA_MTU
  vti4: Don't count header length twice on tunnel setup
  batman-adv: fix header size check in batadv_dbg_arp()
  net: Fix vlan untag for bridge and vlan_dev with reorder_hdr off
  sunvnet: does not support GSO for sctp
  ipv4: lock mtu in fnhe when received PMTU < net.ipv4.route.min_pmtu
  workqueue: use put_device() instead of kfree()
  bnxt_en: Check valid VNIC ID in bnxt_hwrm_vnic_set_tpa().
  netfilter: ebtables: fix erroneous reject of last rule
  USB: OHCI: Fix NULL dereference in HCDs using HCD_LOCAL_MEM
  xen: xenbus: use put_device() instead of kfree()
  fbdev: Fixing arbitrary kernel leak in case FBIOGETCMAP_SPARC in sbusfb_ioctl_helper().
  scsi: sd: Keep disk read-only when re-reading partition
  scsi: mpt3sas: Do not mark fw_event workqueue as WQ_MEM_RECLAIM
  usb: musb: call pm_runtime_{get,put}_sync before reading vbus registers
  e1000e: allocate ring descriptors with dma_zalloc_coherent
  e1000e: Fix check_for_link return value with autoneg off
  watchdog: f71808e_wdt: Fix magic close handling
  KVM: PPC: Book3S HV: Fix VRMA initialization with 2MB or 1GB memory backing
  selftests/powerpc: Skip the subpage_prot tests if the syscall is unavailable
  Btrfs: send, fix issuing write op when processing hole in no data mode
  xen/pirq: fix error path cleanup when binding MSIs
  net/tcp/illinois: replace broken algorithm reference link
  gianfar: Fix Rx byte accounting for ndev stats
  sit: fix IFLA_MTU ignored on NEWLINK
  bcache: fix kcrashes with fio in RAID5 backend dev
  dmaengine: rcar-dmac: fix max_chunk_size for R-Car Gen3
  virtio-gpu: fix ioctl and expose the fixed status to userspace.
  r8152: fix tx packets accounting
  clocksource/drivers/fsl_ftm_timer: Fix error return checking
  nvme-pci: Fix nvme queue cleanup if IRQ setup fails
  netfilter: ebtables: convert BUG_ONs to WARN_ONs
  batman-adv: invalidate checksum on fragment reassembly
  batman-adv: fix packet checksum in receive path
  md/raid1: fix NULL pointer dereference
  media: dmxdev: fix error code for invalid ioctls
  x86/topology: Update the 'cpu cores' field in /proc/cpuinfo correctly across CPU hotplug operations
  locking/xchg/alpha: Fix xchg() and cmpxchg() memory ordering bugs
  regulatory: add NUL to request alpha2
  smsc75xx: fix smsc75xx_set_features()
  ARM: OMAP: Fix dmtimer init for omap1
  s390/cio: clear timer when terminating driver I/O
  s390/cio: fix return code after missing interrupt
  powerpc/bpf/jit: Fix 32-bit JIT for seccomp_data access
  kernel/relay.c: limit kmalloc size to KMALLOC_MAX_SIZE
  md: raid5: avoid string overflow warning
  locking/xchg/alpha: Add unconditional memory barrier to cmpxchg()
  usb: musb: fix enumeration after resume
  drm/exynos: fix comparison to bitshift when dealing with a mask
  md raid10: fix NULL deference in handle_write_completed()
  mac80211: round IEEE80211_TX_STATUS_HEADROOM up to multiple of 4
  NFC: llcp: Limit size of SDP URI
  ARM: OMAP1: clock: Fix debugfs_create_*() usage
  ARM: OMAP3: Fix prm wake interrupt for resume
  ARM: OMAP2+: timer: fix a kmemleak caused in omap_get_timer_dt
  scsi: qla4xxx: skip error recovery in case of register disconnect.
  scsi: aacraid: fix shutdown crash when init fails
  scsi: storvsc: Increase cmd_per_lun for higher speed devices
  selftests: memfd: add config fragment for fuse
  usb: dwc2: Fix dwc2_hsotg_core_init_disconnected()
  usb: gadget: fsl_udc_core: fix ep valid checks
  usb: gadget: f_uac2: fix bFirstInterface in composite gadget
  ARC: Fix malformed ARC_EMUL_UNALIGNED default
  scsi: qla2xxx: Avoid triggering undefined behavior in qla2x00_mbx_completion()
  scsi: mptfusion: Add bounds check in mptctl_hp_targetinfo()
  scsi: sym53c8xx_2: iterator underflow in sym_getsync()
  scsi: bnx2fc: Fix check in SCSI completion handler for timed out request
  scsi: ufs: Enable quirk to ignore sending WRITE_SAME command
  irqchip/gic-v3: Change pr_debug message to pr_devel
  locking/qspinlock: Ensure node->count is updated before initialising node
  tools/libbpf: handle issues with bpf ELF objects containing .eh_frames
  bcache: return attach error when no cache set exist
  bcache: fix for data collapse after re-attaching an attached device
  bcache: fix for allocator and register thread race
  bcache: properly set task state in bch_writeback_thread()
  cifs: silence compiler warnings showing up with gcc-8.0.0
  proc: fix /proc/*/map_files lookup
  arm64: spinlock: Fix theoretical trylock() A-B-A with LSE atomics
  RDS: IB: Fix null pointer issue
  xen/grant-table: Use put_page instead of free_page
  xen-netfront: Fix race between device setup and open
  MIPS: TXx9: use IS_BUILTIN() for CONFIG_LEDS_CLASS
  bpf: fix selftests/bpf test_kmod.sh failure when CONFIG_BPF_JIT_ALWAYS_ON=y
  ACPI: processor_perflib: Do not send _PPC change notification if not ready
  firmware: dmi_scan: Fix handling of empty DMI strings
  x86/power: Fix swsusp_arch_resume prototype
  IB/ipoib: Fix for potential no-carrier state
  mm: pin address_space before dereferencing it while isolating an LRU page
  asm-generic: provide generic_pmdp_establish()
  mm/mempolicy: add nodes_empty check in SYSC_migrate_pages
  mm/mempolicy: fix the check of nodemask from user
  ocfs2: return error when we attempt to access a dirty bh in jbd2
  ocfs2/acl: use 'ip_xattr_sem' to protect getting extended attribute
  ocfs2: return -EROFS to mount.ocfs2 if inode block is invalid
  ntb_transport: Fix bug with max_mw_size parameter
  RDMA/mlx5: Avoid memory leak in case of XRCD dealloc failure
  powerpc/numa: Ensure nodes initialized for hotplug
  powerpc/numa: Use ibm,max-associativity-domains to discover possible nodes
  jffs2: Fix use-after-free bug in jffs2_iget()'s error handling path
  HID: roccat: prevent an out of bounds read in kovaplus_profile_activated()
  scsi: fas216: fix sense buffer initialization
  Btrfs: fix scrub to repair raid6 corruption
  btrfs: Fix out of bounds access in btrfs_search_slot
  Btrfs: set plug for fsync
  ipmi/powernv: Fix error return code in ipmi_powernv_probe()
  mac80211_hwsim: fix possible memory leak in hwsim_new_radio_nl()
  kconfig: Fix expr_free() E_NOT leak
  kconfig: Fix automatic menu creation mem leak
  kconfig: Don't leak main menus during parsing
  watchdog: sp5100_tco: Fix watchdog disable bit
  nfs: Do not convert nfs_idmap_cache_timeout to jiffies
  dm thin: fix documentation relative to low water mark threshold
  tools lib traceevent: Fix get_field_str() for dynamic strings
  perf callchain: Fix attr.sample_max_stack setting
  tools lib traceevent: Simplify pointer print logic and fix %pF
  PCI: Add function 1 DMA alias quirk for Marvell 9128
  tracing/hrtimer: Fix tracing bugs by taking all clock bases and modes into account
  kvm: x86: fix KVM_XEN_HVM_CONFIG ioctl
  ASoC: au1x: Fix timeout tests in au1xac97c_ac97_read()
  ALSA: hda - Use IS_REACHABLE() for dependency on input
  NFSv4: always set NFS_LOCK_LOST when a lock is lost.
  firewire-ohci: work around oversized DMA reads on JMicron controllers
  do d_instantiate/unlock_new_inode combinations safely
  xfs: remove racy hasattr check from attr ops
  kernel/signal.c: avoid undefined behaviour in kill_something_info
  kernel/sys.c: fix potential Spectre v1 issue
  kasan: fix memory hotplug during boot
  ipc/shm: fix shmat() nil address after round-down when remapping
  Revert "ipc/shm: Fix shmat mmap nil-page protection"
  xen-swiotlb: fix the check condition for xen_swiotlb_free_coherent
  libata: blacklist Micron 500IT SSD with MU01 firmware
  libata: Blacklist some Sandisk SSDs for NCQ
  mmc: sdhci-iproc: fix 32bit writes for TRANSFER_MODE register
  ALSA: timer: Fix pause event notification
  aio: fix io_destroy(2) vs. lookup_ioctx() race
  affs_lookup(): close a race with affs_remove_link()
  KVM: Fix spelling mistake: "cop_unsuable" -> "cop_unusable"
  MIPS: Fix ptrace(2) PTRACE_PEEKUSR and PTRACE_POKEUSR accesses to o32 FGRs
  MIPS: ptrace: Expose FIR register through FP regset
  UPSTREAM: sched/fair: Consider RT/IRQ pressure in capacity_spare_wake

Conflicts:
	drivers/media/dvb-core/dmxdev.c
	drivers/scsi/sd.c
	drivers/scsi/ufs/ufshcd.c
	drivers/usb/gadget/function/f_fs.c
	fs/ecryptfs/inode.c

Change-Id: I15751ed8c82ec65ba7eedcb0d385b9f803c333f7
Signed-off-by: Srinivasarao P <spathi@codeaurora.org>

11 files changed, 61 insertions, 18 deletions

diff --git a/kernel/audit.c b/kernel/audit.c
index d8e9fba58cbc..d440c25cb3be 100644
--- a/kernel/audit.c
+++ b/kernel/audit.c
@@ -744,6 +744,8 @@ static void audit_log_feature_change(int which, u32 old_feature, u32 new_feature
 		return;
 
 	ab = audit_log_start(NULL, GFP_KERNEL, AUDIT_FEATURE_CHANGE);
+	if (!ab)
+		return;
 	audit_log_task_info(ab, current);
 	audit_log_format(ab, " feature=%s old=%u new=%u old_lock=%u new_lock=%u res=%d",
 			 audit_feature_names[which], !!old_feature, !!new_feature,
diff --git a/kernel/debug/kdb/kdb_main.c b/kernel/debug/kdb/kdb_main.c
index 4121345498e0..ebc52c7bd8a6 100644
--- a/kernel/debug/kdb/kdb_main.c
+++ b/kernel/debug/kdb/kdb_main.c
@@ -1564,6 +1564,7 @@ static int kdb_md(int argc, const char **argv)
 	int symbolic = 0;
 	int valid = 0;
 	int phys = 0;
+	int raw = 0;
 
 	kdbgetintenv("MDCOUNT", &mdcount);
 	kdbgetintenv("RADIX", &radix);
@@ -1573,9 +1574,10 @@ static int kdb_md(int argc, const char **argv)
 	repeat = mdcount * 16 / bytesperword;
 
 	if (strcmp(argv[0], "mdr") == 0) {
-		if (argc != 2)
+		if (argc == 2 || (argc == 0 && last_addr != 0))
+			valid = raw = 1;
+		else
 			return KDB_ARGCOUNT;
-		valid = 1;
 	} else if (isdigit(argv[0][2])) {
 		bytesperword = (int)(argv[0][2] - '0');
 		if (bytesperword == 0) {
@@ -1611,7 +1613,10 @@ static int kdb_md(int argc, const char **argv)
 		radix = last_radix;
 		bytesperword = last_bytesperword;
 		repeat = last_repeat;
-		mdcount = ((repeat * bytesperword) + 15) / 16;
+		if (raw)
+			mdcount = repeat;
+		else
+			mdcount = ((repeat * bytesperword) + 15) / 16;
 	}
 
 	if (argc) {
@@ -1628,7 +1633,10 @@ static int kdb_md(int argc, const char **argv)
 			diag = kdbgetularg(argv[nextarg], &val);
 			if (!diag) {
 				mdcount = (int) val;
-				repeat = mdcount * 16 / bytesperword;
+				if (raw)
+					repeat = mdcount;
+				else
+					repeat = mdcount * 16 / bytesperword;
 			}
 		}
 		if (argc >= nextarg+1) {
@@ -1638,8 +1646,15 @@ static int kdb_md(int argc, const char **argv)
 		}
 	}
 
-	if (strcmp(argv[0], "mdr") == 0)
-		return kdb_mdr(addr, mdcount);
+	if (strcmp(argv[0], "mdr") == 0) {
+		int ret;
+		last_addr = addr;
+		ret = kdb_mdr(addr, mdcount);
+		last_addr += mdcount;
+		last_repeat = mdcount;
+		last_bytesperword = bytesperword; // to make REPEAT happy
+		return ret;
+	}
 
 	switch (radix) {
 	case 10:
diff --git a/kernel/events/core.c b/kernel/events/core.c
index 1a73b31b5fe7..a8f984b4fcff 100644
--- a/kernel/events/core.c
+++ b/kernel/events/core.c
@@ -427,9 +427,15 @@ static inline void __update_cgrp_time(struct perf_cgroup *cgrp)
 
 static inline void update_cgrp_time_from_cpuctx(struct perf_cpu_context *cpuctx)
 {
-	struct perf_cgroup *cgrp_out = cpuctx->cgrp;
-	if (cgrp_out)
-		__update_cgrp_time(cgrp_out);
+	struct perf_cgroup *cgrp = cpuctx->cgrp;
+	struct cgroup_subsys_state *css;
+
+	if (cgrp) {
+		for (css = &cgrp->css; css; css = css->parent) {
+			cgrp = container_of(css, struct perf_cgroup, css);
+			__update_cgrp_time(cgrp);
+		}
+	}
 }
 
 static inline void update_cgrp_time_from_event(struct perf_event *event)
@@ -457,6 +463,7 @@ perf_cgroup_set_timestamp(struct task_struct *task,
 {
 	struct perf_cgroup *cgrp;
 	struct perf_cgroup_info *info;
+	struct cgroup_subsys_state *css;
 
 	/*
 	 * ctx->lock held by caller
@@ -467,8 +474,12 @@ perf_cgroup_set_timestamp(struct task_struct *task,
 		return;
 
 	cgrp = perf_cgroup_from_task(task, ctx);
-	info = this_cpu_ptr(cgrp->info);
-	info->timestamp = ctx->timestamp;
+
+	for (css = &cgrp->css; css; css = css->parent) {
+		cgrp = container_of(css, struct perf_cgroup, css);
+		info = this_cpu_ptr(cgrp->info);
+		info->timestamp = ctx->timestamp;
+	}
 }
 
 #define PERF_CGROUP_SWOUT	0x1 /* cgroup switch out every event */
@@ -5404,7 +5415,8 @@ static void perf_output_read_group(struct perf_output_handle *handle,
 	if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING)
 		values[n++] = running;
 
-	if (leader != event)
+	if ((leader != event) &&
+	    (leader->state == PERF_EVENT_STATE_ACTIVE))
 		leader->pmu->read(leader);
 
 	values[n++] = perf_event_count(leader);
diff --git a/kernel/locking/qspinlock.c b/kernel/locking/qspinlock.c
index 8173bc7fec92..3b40c8809e52 100644
--- a/kernel/locking/qspinlock.c
+++ b/kernel/locking/qspinlock.c
@@ -423,6 +423,14 @@ queue:
 	tail = encode_tail(smp_processor_id(), idx);
 
 	node += idx;
+
+	/*
+	 * Ensure that we increment the head node->count before initialising
+	 * the actual node. If the compiler is kind enough to reorder these
+	 * stores, then an IRQ could overwrite our assignments.
+	 */
+	barrier();
+
 	node->locked = 0;
 	node->next = NULL;
 	pv_init_node(node);
diff --git a/kernel/power/power.h b/kernel/power/power.h
index 51f02ecaf125..2610516601ee 100644
--- a/kernel/power/power.h
+++ b/kernel/power/power.h
@@ -94,9 +94,6 @@ extern int in_suspend;
 extern dev_t swsusp_resume_device;
 extern sector_t swsusp_resume_block;
 
-extern asmlinkage int swsusp_arch_suspend(void);
-extern asmlinkage int swsusp_arch_resume(void);
-
 extern int create_basic_memory_bitmaps(void);
 extern void free_basic_memory_bitmaps(void);
 extern int hibernate_preallocate_memory(void);
diff --git a/kernel/relay.c b/kernel/relay.c
index 0b4570cfacae..f6d5f08bdfaa 100644
--- a/kernel/relay.c
+++ b/kernel/relay.c
@@ -163,7 +163,7 @@ static struct rchan_buf *relay_create_buf(struct rchan *chan)
 {
 	struct rchan_buf *buf;
 
-	if (chan->n_subbufs > UINT_MAX / sizeof(size_t *))
+	if (chan->n_subbufs > KMALLOC_MAX_SIZE / sizeof(size_t *))
 		return NULL;
 
 	buf = kzalloc(sizeof(struct rchan_buf), GFP_KERNEL);
diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
index f962ab1eb046..621793d3ec6d 100644
--- a/kernel/sched/fair.c
+++ b/kernel/sched/fair.c
@@ -7130,7 +7130,7 @@ boosted_task_util(struct task_struct *task)
 
 static unsigned long capacity_spare_wake(int cpu, struct task_struct *p)
 {
-	return capacity_orig_of(cpu) - cpu_util_wake(cpu, p);
+	return max_t(long, capacity_of(cpu) - cpu_util_wake(cpu, p), 0);
 }
 
 /*
diff --git a/kernel/sched/rt.c b/kernel/sched/rt.c
index fb7f36fd6e5b..af21389466b8 100644
--- a/kernel/sched/rt.c
+++ b/kernel/sched/rt.c
@@ -831,6 +831,8 @@ static int do_sched_rt_period_timer(struct rt_bandwidth *rt_b, int overrun)
 		struct rq *rq = rq_of_rt_rq(rt_rq);
 
 		raw_spin_lock(&rq->lock);
+		update_rq_clock(rq);
+
 		if (rt_rq->rt_time) {
 			u64 runtime;
 
diff --git a/kernel/signal.c b/kernel/signal.c
index 7d75bc2d042f..8bfbc47f0a23 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -1392,6 +1392,10 @@ static int kill_something_info(int sig, struct siginfo *info, pid_t pid)
 		return ret;
 	}
 
+	/* -INT_MIN is undefined.  Exclude this case to avoid a UBSAN warning */
+	if (pid == INT_MIN)
+		return -ESRCH;
+
 	read_lock(&tasklist_lock);
 	if (pid != -1) {
 		ret = __kill_pgrp_info(sig, info,
diff --git a/kernel/sys.c b/kernel/sys.c
index ba3ddb43dd9f..cf40663a54c2 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -55,6 +55,8 @@
 #include <linux/uidgid.h>
 #include <linux/cred.h>
 
+#include <linux/nospec.h>
+
 #include <linux/kmsg_dump.h>
 /* Move somewhere else to avoid recompiling? */
 #include <generated/utsrelease.h>
@@ -1313,6 +1315,7 @@ SYSCALL_DEFINE2(old_getrlimit, unsigned int, resource,
 	if (resource >= RLIM_NLIMITS)
 		return -EINVAL;
 
+	resource = array_index_nospec(resource, RLIM_NLIMITS);
 	task_lock(current->group_leader);
 	x = current->signal->rlim[resource];
 	task_unlock(current->group_leader);
diff --git a/kernel/workqueue.c b/kernel/workqueue.c
index acccc6c7437f..89a0f1171f90 100644
--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
@@ -5223,7 +5223,7 @@ int workqueue_sysfs_register(struct workqueue_struct *wq)
 
 	ret = device_register(&wq_dev->dev);
 	if (ret) {
-		kfree(wq_dev);
+		put_device(&wq_dev->dev);
 		wq->wq_dev = NULL;
 		return ret;
 	}