Snap for 4951318 from aaf7fb8812de7736b9c55b52ad4f2936d072da3d to nyc-iot-releaseandroid-n-iot-release-ihome-igv1nougat-iot-release

Change-Id: I987c100dd0ceae9b850b78bf08943b2746543018

18 files changed, 127 insertions, 809 deletions

diff --git a/drivers/char/diag/diag_dci.c b/drivers/char/diag/diag_dci.c
index 75af8a6f8dc..89eaf0e0b73 100644
--- a/drivers/char/diag/diag_dci.c
+++ b/drivers/char/diag/diag_dci.c
@@ -645,7 +645,7 @@ int diag_dci_query_log_mask(struct diag_dci_client_tbl *entry,
 	byte_mask = 0x01 << (item_num % 8);
 	offset = equip_id * 514;
 
-	if (offset + byte_index > DCI_LOG_MASK_SIZE) {
+	if (offset + byte_index >= DCI_LOG_MASK_SIZE) {
 		pr_err("diag: In %s, invalid offset: %d, log_code: %d, byte_index: %d\n",
 				__func__, offset, log_code, byte_index);
 		return 0;
@@ -672,7 +672,7 @@ int diag_dci_query_event_mask(struct diag_dci_client_tbl *entry,
 	bit_index = event_id % 8;
 	byte_mask = 0x1 << bit_index;
 
-	if (byte_index > DCI_EVENT_MASK_SIZE) {
+	if (byte_index >= DCI_EVENT_MASK_SIZE) {
 		pr_err("diag: In %s, invalid, event_id: %d, byte_index: %d\n",
 				__func__, event_id, byte_index);
 		return 0;
diff --git a/drivers/char/diag/diag_masks.c b/drivers/char/diag/diag_masks.c
index ff75a950514..cb36076cba6 100644
--- a/drivers/char/diag/diag_masks.c
+++ b/drivers/char/diag/diag_masks.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2008-2016, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2008-2016, 2018, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -649,7 +649,8 @@ static int diag_cmd_set_all_msg_mask(unsigned char *src_buf, int src_len,
 	msg_mask.status = (req->rt_mask) ? DIAG_CTRL_MASK_ALL_ENABLED :
 					   DIAG_CTRL_MASK_ALL_DISABLED;
 	for (i = 0; i < driver->msg_mask_tbl_count; i++, mask++) {
-		memset(mask->ptr, req->rt_mask,
+		if (mask && mask->ptr)
+			memset(mask->ptr, req->rt_mask,
 		       mask->range * sizeof(uint32_t));
 	}
 	mutex_unlock(&msg_mask.lock);
@@ -938,6 +939,8 @@ static int diag_cmd_set_log_mask(unsigned char *src_buf, int src_len,
 	}
 	mutex_lock(&log_mask.lock);
 	for (i = 0; i < MAX_EQUIP_ID && !status; i++, mask++) {
+		if (!mask || !mask->ptr)
+			continue;
 		if (mask->equip_id != req->equip_id)
 			continue;
 		if (req->num_items < mask->num_items)
@@ -1006,15 +1009,15 @@ static int diag_cmd_disable_log_mask(unsigned char *src_buf, int src_len,
 		       __func__, src_buf, src_len, dest_buf, dest_len);
 		return -EINVAL;
 	}
-
 	mutex_lock(&log_mask.lock);
 	for (i = 0; i < MAX_EQUIP_ID; i++, mask++)
-		memset(mask->ptr, 0, mask->range);
+		if (mask && mask->ptr)
+			memset(mask->ptr, 0, mask->range);
 	log_mask.status = DIAG_CTRL_MASK_ALL_DISABLED;
 	mutex_unlock(&log_mask.lock);
 	diag_update_userspace_clients(LOG_MASKS_TYPE);
 
-	/*
+        /*
 	 * Apps processor must send the response to this command. Frame the
 	 * response.
 	 */
diff --git a/drivers/char/diag/diagfwd_cntl.c b/drivers/char/diag/diagfwd_cntl.c
index cf7284401b6..6578fcc51ae 100644
--- a/drivers/char/diag/diagfwd_cntl.c
+++ b/drivers/char/diag/diagfwd_cntl.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2011-2016, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2011-2016, 2018, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -269,8 +269,8 @@ static void process_last_event_report(uint8_t *buf, uint32_t len,
 	header = (struct diag_ctrl_last_event_report *)ptr;
 	event_size = ((header->event_last_id / 8) + 1);
 	if (event_size >= driver->event_mask_size) {
-		pr_debug("diag: In %s, receiving event mask size more that Apps can handle\n",
-			 __func__);
+		pr_debug("diag: %s: receiving event mask size more that Apps can handle\n",
+			__func__);
 		temp = krealloc(driver->event_mask->ptr, event_size,
 				GFP_KERNEL);
 		if (!temp) {
@@ -400,6 +400,10 @@ static void process_ssid_range_report(uint8_t *buf, uint32_t len,
 		mask_ptr = (struct diag_msg_mask_t *)msg_mask.ptr;
 		found = 0;
 		for (j = 0; j < driver->msg_mask_tbl_count; j++, mask_ptr++) {
+			if (!mask_ptr || !ssid_range) {
+				found = 1;
+				break;
+			}
 			if (mask_ptr->ssid_first != ssid_range->ssid_first)
 				continue;
 			err = update_msg_mask_tbl_entry(mask_ptr, ssid_range);
@@ -416,6 +420,8 @@ static void process_ssid_range_report(uint8_t *buf, uint32_t len,
 
 		new_size = (driver->msg_mask_tbl_count + 1) *
 			   sizeof(struct diag_msg_mask_t);
+		pr_debug("diag: %s: receiving msg mask size more that Apps can handle\n",
+			__func__);
 		temp = krealloc(msg_mask.ptr, new_size, GFP_KERNEL);
 		if (!temp) {
 			pr_err("diag: In %s, Unable to add new ssid table to msg mask, ssid first: %d, last: %d\n",
@@ -424,6 +430,7 @@ static void process_ssid_range_report(uint8_t *buf, uint32_t len,
 			continue;
 		}
 		msg_mask.ptr = temp;
+		mask_ptr = (struct diag_msg_mask_t *)msg_mask.ptr;
 		err = diag_create_msg_mask_table_entry(mask_ptr, ssid_range);
 		if (err) {
 			pr_err("diag: In %s, Unable to create a new msg mask table entry, first: %d last: %d err: %d\n",
@@ -464,6 +471,10 @@ static void diag_build_time_mask_update(uint8_t *buf,
 
 	mutex_lock(&driver->build_time_mask->lock);
 	for (i = 0; i < driver->msg_mask_tbl_count; i++, build_mask++) {
+		if (!build_mask) {
+			found = 1;
+			break;
+		}
 		if (build_mask->ssid_first != range->ssid_first)
 			continue;
 		found = 1;
@@ -473,7 +484,8 @@ static void diag_build_time_mask_update(uint8_t *buf,
 			       __func__);
 		}
 		dest_ptr = build_mask->ptr;
-		for (j = 0; j < build_mask->range; j++, mask_ptr++, dest_ptr++)
+		for (j = 0; (j < build_mask->range) && mask_ptr && dest_ptr;
+			j++, mask_ptr++, dest_ptr++)
 			*(uint32_t *)dest_ptr |= *mask_ptr;
 		break;
 	}
@@ -482,6 +494,9 @@ static void diag_build_time_mask_update(uint8_t *buf,
 		goto end;
 	new_size = (driver->msg_mask_tbl_count + 1) *
 		   sizeof(struct diag_msg_mask_t);
+	pr_debug("diag: %s: receiving build time mask size more that Apps can handle\n",
+		__func__);
+
 	temp = krealloc(driver->build_time_mask->ptr, new_size, GFP_KERNEL);
 	if (!temp) {
 		pr_err("diag: In %s, unable to create a new entry for build time mask\n",
@@ -489,6 +504,7 @@ static void diag_build_time_mask_update(uint8_t *buf,
 		goto end;
 	}
 	driver->build_time_mask->ptr = temp;
+	build_mask = (struct diag_msg_mask_t *)driver->build_time_mask->ptr;
 	err = diag_create_msg_mask_table_entry(build_mask, range);
 	if (err) {
 		pr_err("diag: In %s, Unable to create a new msg mask table entry, err: %d\n",
diff --git a/drivers/cpuidle/lpm-levels-of.c b/drivers/cpuidle/lpm-levels-of.c
index cb037922c9c..b7a6a0722e7 100644
--- a/drivers/cpuidle/lpm-levels-of.c
+++ b/drivers/cpuidle/lpm-levels-of.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2014, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2014, 2018, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -342,10 +342,6 @@ static int parse_cluster_params(struct device_node *node, struct lpm_cluster *c)
 	return 0;
 failed:
 	pr_err("%s(): Failed reading %s\n", __func__, key);
-	kfree(c->name);
-	kfree(c->lpm_dev);
-	c->name = NULL;
-	c->lpm_dev = NULL;
 	return ret;
 }
 
@@ -452,8 +448,6 @@ static int parse_cluster_level(struct device_node *node,
 	return 0;
 failed:
 	pr_err("Failed %s() ret = %d\n", __func__, ret);
-	kfree(level->mode);
-	level->mode = NULL;
 	return ret;
 }
 
@@ -526,7 +520,6 @@ static int parse_cpu_levels(struct device_node *node, struct lpm_cluster *c)
 {
 	struct device_node *n;
 	int ret = -ENOMEM;
-	int i;
 
 	c->cpu = devm_kzalloc(&lpm_pdev->dev, sizeof(*c->cpu), GFP_KERNEL);
 	if (!c->cpu)
@@ -562,19 +555,12 @@ static int parse_cpu_levels(struct device_node *node, struct lpm_cluster *c)
 	}
 	return 0;
 failed:
-	for (i = 0; i < c->cpu->nlevels; i++) {
-		kfree(c->cpu->levels[i].name);
-		c->cpu->levels[i].name = NULL;
-	}
-	kfree(c->cpu);
-	c->cpu = NULL;
 	pr_err("%s(): Failed with error code:%d\n", __func__, ret);
 	return ret;
 }
 
 void free_cluster_node(struct lpm_cluster *cluster)
 {
-	int i;
 	struct lpm_cluster *cl, *m;
 
 	list_for_each_entry_safe(cl, m, &cluster->child, list) {
@@ -582,22 +568,6 @@ void free_cluster_node(struct lpm_cluster *cluster)
 		free_cluster_node(cl);
 	};
 
-	if (cluster->cpu) {
-		for (i = 0; i < cluster->cpu->nlevels; i++) {
-			kfree(cluster->cpu->levels[i].name);
-			cluster->cpu->levels[i].name = NULL;
-		}
-	}
-	for (i = 0; i < cluster->nlevels; i++) {
-		kfree(cluster->levels[i].mode);
-		cluster->levels[i].mode = NULL;
-	}
-	kfree(cluster->cpu);
-	kfree(cluster->name);
-	kfree(cluster->lpm_dev);
-	cluster->cpu = NULL;
-	cluster->name = NULL;
-	cluster->lpm_dev = NULL;
 	cluster->ndevices = 0;
 }
 
@@ -681,9 +651,7 @@ failed_parse_cluster:
 		list_del(&c->list);
 	free_cluster_node(c);
 failed_parse_params:
-	c->parent = NULL;
 	pr_err("Failed parse params\n");
-	kfree(c);
 	return NULL;
 }
 
diff --git a/drivers/media/platform/msm/vpu/Makefile b/drivers/media/platform/msm/vpu/Makefile
index e1fb5f1a3bb..c7d5eefbc7b 100644
--- a/drivers/media/platform/msm/vpu/Makefile
+++ b/drivers/media/platform/msm/vpu/Makefile
@@ -11,7 +11,5 @@ obj-$(CONFIG_MSM_VPU) := 	\
 		vpu_hfi.o \
 		vpu_bus_clock.o \
 
-obj-$(CONFIG_DEBUG_FS) += vpu_debug.o
-
 obj-$(CONFIG_MSM_VPU_IN_VCAP) += vpu_in_vcap.o
 obj-$(CONFIG_MSM_VPU_OUT_MDSS) += vpu_out_mdss.o
diff --git a/drivers/media/platform/msm/vpu/vpu_debug.c b/drivers/media/platform/msm/vpu/vpu_debug.c
deleted file mode 100644
index 79e6a847e16..00000000000
--- a/drivers/media/platform/msm/vpu/vpu_debug.c
+++ /dev/null
@@ -1,665 +0,0 @@
-/* Copyright (c) 2013-2014, The Linux Foundation. All rights reserved.
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License version 2 and
- * only version 2 as published by the Free Software Foundation.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- */
-
-#define pr_fmt(fmt)	"VPU, %s: " fmt, __func__
-
-#include <linux/types.h>
-#include <linux/wait.h>
-#include <linux/sched.h>
-#include <linux/seq_file.h>
-#include <linux/sizes.h>
-#include <linux/atomic.h>
-
-#include "vpu_debug.h"
-#include "vpu_v4l2.h"
-#include "vpu_ioctl_internal.h"
-#include "vpu_channel.h"
-#include "vpu_bus_clock.h"
-
-#define BUF_SIZE		(SZ_4K)
-#define RW_MODE			(S_IRUSR | S_IWUSR)
-#define FW_LOG_TIMEOUT_MS	500
-
-static int vpu_debug_on;
-
-struct fw_log_info {
-	/* wq woken by hfi layer when fw log msg received */
-	wait_queue_head_t wq;
-	/* wq only woken by hfi layer if this flag set */
-	int log_available;
-	/* buf used for formatting log msgs */
-	char *fmt_buf;
-	/* only one thread may read fw logs at a time */
-	atomic_t num_readers;
-};
-
-/* SMEM controller data */
-struct smem_ctrl_data {
-	/* number of bytes to read */
-	u32 size;
-	/* offset from shared memory base address */
-	u32 offset;
-};
-
-static struct smem_ctrl_data smem_ctrl = {
-	.size = 1024,
-	.offset = 0x00000000
-};
-
-
-static struct fw_log_info fw_log;
-
-void vpu_wakeup_fw_logging_wq(void)
-{
-	fw_log.log_available = 1;
-	wake_up_interruptible(&fw_log.wq);
-}
-
-static int open_fw_log(struct inode *inode, struct file *file)
-{
-	char *fmt_buf;
-
-	/* Only one user thread may read firmware logs at a time.
-	 * We decrement number of readers upon release of the
-	 * firmware logs.
-	 */
-	if (atomic_inc_return(&fw_log.num_readers) > 1) {
-		atomic_dec(&fw_log.num_readers);
-		return -EBUSY;
-	}
-
-	fmt_buf = kzalloc(BUF_SIZE, GFP_KERNEL);
-	if (unlikely(!fmt_buf)) {
-		pr_err("Failed to allocate fmt_buf\n");
-		atomic_dec(&fw_log.num_readers);
-		return -ENOMEM;
-	}
-
-	fw_log.fmt_buf = fmt_buf;
-	return 0;
-}
-
-static ssize_t read_fw_log(struct file *file, char __user *user_buf,
-	size_t len, loff_t *ppos)
-{
-	int ret;
-	int bytes_read = 0;
-	int buf_size = len;
-
-	/* fmt buffer is only BUF_SIZE */
-	buf_size = min(buf_size, BUF_SIZE);
-
-	do {
-		/* read data into user buffer */
-		bytes_read = vpu_hw_sys_print_log(user_buf,
-				fw_log.fmt_buf, buf_size);
-
-		/*
-		 * The Logging queue might not be ready yet. If that is the case
-		 * try again after queue init.
-		 * Also, when we read 0 bytes we wait until firmware writes
-		 * something in the logging queue.
-		 */
-		if ((bytes_read == -EAGAIN) || (bytes_read == 0)) {
-			fw_log.log_available = 0;
-			ret = wait_event_interruptible_timeout(fw_log.wq,
-				fw_log.log_available == 1,
-				msecs_to_jiffies(FW_LOG_TIMEOUT_MS));
-			if (ret < 0)
-				return ret;
-		} else if (bytes_read < 0) {
-			pr_err("Error: bytes_read=%d\n", bytes_read);
-			return bytes_read;
-		}
-
-	} while ((bytes_read == -EAGAIN) || (bytes_read == 0));
-
-	return bytes_read;
-}
-
-static int release_fw_log(struct inode *inode, struct file *file)
-{
-	kfree(fw_log.fmt_buf);
-	fw_log.fmt_buf = NULL;
-
-	/* Allow another reader to access firmware logs */
-	atomic_dec(&fw_log.num_readers);
-
-	return 0;
-}
-
-static const struct file_operations fw_logging_ops = {
-	.open = open_fw_log,
-	.read = read_fw_log,
-	.release = release_fw_log,
-};
-
-static ssize_t write_fw_log_level(struct file *file,
-		const char __user *user_buf, size_t count, loff_t *ppos)
-{
-	int ret;
-	char buf[4];
-	int log_level;
-	int len;
-
-	len = min(count, sizeof(buf) - 1);
-	if (copy_from_user(buf, user_buf, len))
-		return -EFAULT;
-	buf[len] = '\0';
-
-	if (kstrtou32(buf, 0, &log_level))
-		return -EINVAL;
-
-	if (log_level < VPU_LOGGING_NONE || log_level > VPU_LOGGING_ALL) {
-		pr_err("Invalid logging level %d\n", log_level);
-		return -EINVAL;
-	}
-
-	ret = vpu_hw_sys_set_log_level(log_level);
-	if (ret)
-		return ret;
-
-	pr_debug("Firmware log level set to %s\n", buf);
-	return count;
-}
-
-static ssize_t read_fw_log_level(struct file *file, char __user *user_buf,
-	size_t len, loff_t *ppos)
-{
-	int ret;
-	char buf[4];
-	int log_level;
-
-	ret = vpu_hw_sys_get_log_level();
-	if (ret < 0)
-		return ret;
-	log_level = ret;
-
-	ret = snprintf(buf, sizeof(buf), "%d\n", log_level);
-	if (ret < 0) {
-		pr_err("Error converting log level from int to char\n");
-		return ret;
-	}
-
-	return simple_read_from_buffer(user_buf, len, ppos, buf, sizeof(buf));
-}
-
-static const struct file_operations fw_log_level_ops = {
-	.open = simple_open,
-	.write = write_fw_log_level,
-	.read = read_fw_log_level,
-};
-
-static ssize_t read_queue_state(struct file *file, char __user *user_buf,
-	size_t len, loff_t *ppos)
-{
-	char *dbg_buf;
-	size_t size, ret;
-
-	dbg_buf = kzalloc(BUF_SIZE, GFP_KERNEL);
-	if (!dbg_buf) {
-		pr_err("failed to alloc\n");
-		return -ENOMEM;
-	}
-
-	size = vpu_hw_print_queues(dbg_buf, BUF_SIZE);
-	ret = simple_read_from_buffer(user_buf, len, ppos, dbg_buf, size);
-
-	kfree(dbg_buf);
-	return ret;
-}
-
-static const struct file_operations queue_state_ops = {
-	.open = simple_open,
-	.read = read_queue_state,
-};
-
-static ssize_t read_csr_regs(struct file *file, char __user *user_buf,
-	size_t len, loff_t *ppos)
-{
-	char *dbg_buf;
-	size_t size, ret;
-
-	dbg_buf = kzalloc(BUF_SIZE, GFP_KERNEL);
-	if (!dbg_buf) {
-		pr_err("failed to alloc\n");
-		return -ENOMEM;
-	}
-
-	/* If debug mode is on, a lock may still be
-	 * held (while in process of booting up firmware).
-	 * We need to still be able to dump csr registers
-	 * in this case. Do not attempt to acquire the lock.
-	 */
-	if (vpu_debug_on)
-		size = vpu_hw_dump_csr_regs_no_lock(dbg_buf, BUF_SIZE);
-	else
-		size = vpu_hw_dump_csr_regs(dbg_buf, BUF_SIZE);
-	if (size > 0)
-		ret = simple_read_from_buffer(user_buf, len, ppos,
-				dbg_buf, size);
-	else
-		ret = -EIO; /* device not readable */
-	kfree(dbg_buf);
-	return ret;
-}
-
-int write_csr_reg(struct file *file, const char __user *user_buf,
-	size_t count, loff_t *ppos)
-{
-	int ret;
-	int len;
-	char buf[24];
-	char *sptr, *token;
-	u32 reg_off;
-	u32 reg_val;
-
-	len = min(count, sizeof(buf) - 1);
-	if (copy_from_user(buf, user_buf, len))
-		return -EFAULT;
-	buf[len] = '\0';
-
-	sptr = buf;
-	token = strsep(&sptr, ":");
-	if (!token)
-		return -EINVAL;
-
-	if (kstrtou32(token, 0, &reg_off))
-		return -EINVAL;
-
-	if (kstrtou32(sptr, 0, &reg_val))
-		return -EINVAL;
-
-	ret = vpu_hw_write_csr_reg(reg_off, reg_val);
-	if (ret)
-		return ret;
-
-	return count;
-}
-
-static const struct file_operations csr_regs_ops = {
-	.open = simple_open,
-	.read = read_csr_regs,
-	.write = write_csr_reg,
-};
-
-static void debug_on(void)
-{
-	vpu_debug_on = 1;
-	vpu_hw_debug_on();
-}
-
-static void debug_off(void)
-{
-	vpu_hw_debug_off();
-	vpu_debug_on = 0;
-}
-
-static ssize_t write_cmd(struct file *file, const char __user *user_buf,
-	size_t len, loff_t *ppos)
-{
-	char buf[10];
-	char *cmp;
-
-	len = min(len, sizeof(buf) - 1);
-	if (copy_from_user(&buf[0], user_buf, len))
-		return -EFAULT;
-
-	buf[len] = '\0';
-	cmp = strstrip(buf);
-
-	if (strcmp(cmp, "crash") == 0)
-		vpu_hw_sys_cmd_ext(VPU_SYS_CMD_DEBUG_CRASH, NULL, 0);
-	else if (strcmp(cmp, "svs") == 0)
-		vpu_hw_sys_set_power_mode(VPU_POWER_SVS);
-	else if (strcmp(cmp, "nominal") == 0)
-		vpu_hw_sys_set_power_mode(VPU_POWER_NOMINAL);
-	else if (strcmp(cmp, "turbo") == 0)
-		vpu_hw_sys_set_power_mode(VPU_POWER_TURBO);
-	else if (strcmp(cmp, "dynamic") == 0)
-		vpu_hw_sys_set_power_mode(VPU_POWER_DYNAMIC);
-	else if (strcmp(cmp, "debugon") == 0)
-		debug_on();
-	else if (strcmp(cmp, "debugoff") == 0)
-		debug_off();
-
-	return len;
-}
-
-static ssize_t read_cmd(struct file *file, char __user *user_buf,
-	size_t len, loff_t *ppos)
-{
-	char str[] =
-		"Usage: echo <cmd> > <this_file> to send a command to VPU\n";
-
-	return simple_read_from_buffer(user_buf, len, ppos, str, sizeof(str));
-}
-
-static const struct file_operations vpu_cmd_ops = {
-	.open = simple_open,
-	.write = write_cmd,
-	.read = read_cmd,
-};
-
-static int smem_data_show(struct seq_file *m, void *private)
-{
-	char cbuf[SZ_64];
-	struct smem_ctrl_data *smem = m->private;
-	u32 offset = smem->offset;
-
-	if (((offset >> 2) << 2) != offset) {
-		seq_printf(m, "Error: offset (0x%x) must be a multiple of 4!\n",
-				offset);
-		goto smem_exit;
-	}
-	/*
-	 * Print each memory line (4 32-bit words) containing the incremented
-	 * offset. Stop reading if lower layer does not print anymore (or error)
-	 */
-	for (; offset <= smem->offset + smem->size; offset += 4 * sizeof(u32)) {
-		int ret;
-		ret = vpu_hw_dump_smem_line(cbuf, sizeof(cbuf), offset);
-		if (ret > 0) {
-			seq_printf(m, "%s", cbuf);
-		} else {
-			if (ret == -EACCES)
-				pr_err("Cannot read outside of VPU mem!\n");
-			if (ret == -ENOMEM)
-				pr_err("cbuf too small!\n");
-
-			/* break 'for' loop if ret <= 0 */
-			break;
-		}
-	}
-
-smem_exit:
-	return 0;
-}
-
-static int smem_data_open(struct inode *inode, struct file *file)
-{
-	return single_open(file, smem_data_show, inode->i_private);
-}
-
-static const struct file_operations smem_data_ops = {
-	.open = smem_data_open,
-	.read = seq_read,
-	.llseek = seq_lseek,
-	.release = single_release
-};
-
-static struct dentry *init_smem_dir(struct dentry *root)
-{
-	struct dentry *smem, *attr;
-
-	smem = debugfs_create_dir("smem", root);
-	if (IS_ERR_OR_NULL(root)) {
-		pr_err("Failed to create smem directory\n");
-		goto smem_dir_err;
-	}
-
-	attr = debugfs_create_x32("offset", RW_MODE, smem, &smem_ctrl.offset);
-	if (IS_ERR_OR_NULL(attr)) {
-		pr_err("Failed to create smem/offset entry\n");
-		goto smem_dir_err;
-	}
-
-	attr = debugfs_create_u32("size", RW_MODE, smem, &smem_ctrl.size);
-	if (IS_ERR_OR_NULL(attr)) {
-		pr_err("Failed to create smem/size entry\n");
-		goto smem_dir_err;
-	}
-
-	attr = debugfs_create_file("data", RW_MODE, smem, &smem_ctrl,
-			&smem_data_ops);
-	if (IS_ERR_OR_NULL(attr)) {
-		pr_err("Failed to create smem/data entry\n");
-		goto smem_dir_err;
-	}
-
-	return smem;
-smem_dir_err:
-	return NULL;
-}
-
-static struct vpu_client *debug_client;
-
-static ssize_t write_client(struct file *file, const char __user *user_buf,
-	size_t len, loff_t *ppos)
-{
-	char buf[10];
-	char *cmp;
-	struct vpu_dev_core *core = file->private_data;
-
-	if (!core)
-		return -ENODEV;
-
-	len = min(len, sizeof(buf) - 1);
-	if (copy_from_user(&buf[0], user_buf, len))
-		return -EFAULT;
-
-	buf[len] = '\0';
-	cmp = strstrip(buf);
-
-	if (strcmp(cmp, "get") == 0) {
-		if (!debug_client)
-			debug_client = vpu_open_kernel_client(core);
-	} else if (strcmp(cmp, "put") == 0) {
-		if (debug_client) {
-			vpu_close_client(debug_client);
-			debug_client = NULL;
-		}
-	} else {
-		return -EINVAL;
-	}
-
-	return len;
-}
-
-static ssize_t read_client(struct file *file, char __user *user_buf,
-	size_t len, loff_t *ppos)
-{
-	char str[] =
-		"Usage: echo get/put > <this_file> to inc/dec VPU client\n";
-
-	return simple_read_from_buffer(user_buf, len, ppos, str, sizeof(str));
-}
-
-static const struct file_operations vpu_client_ops = {
-	.open = simple_open,
-	.write = write_client,
-	.read = read_client,
-};
-
-static ssize_t read_streaming_state(struct file *file, char __user *user_buf,
-		size_t len, loff_t *ppos)
-{
-	struct vpu_dev_session *session = file->private_data;
-	char temp_buf[8];
-	size_t size, ret;
-
-	size = snprintf(temp_buf, sizeof(temp_buf), "%d\n",
-			session->streaming_state == ALL_STREAMING);
-	ret = simple_read_from_buffer(user_buf, len, ppos, temp_buf, size);
-
-	return ret;
-}
-
-static const struct file_operations streaming_state_ops = {
-	.open = simple_open,
-	.read = read_streaming_state,
-};
-
-static int init_vpu_session_info_dir(struct dentry *root,
-		struct vpu_dev_session *session)
-{
-	struct dentry *attr_root, *attr;
-	char attr_name[SZ_16];
-	if (!session || !root)
-		goto failed_create_dir;
-
-	/* create session debugfs directory */
-	snprintf(attr_name, SZ_16, "session_%d", session->id);
-
-	attr_root = debugfs_create_dir(attr_name, root);
-	if (IS_ERR_OR_NULL(attr_root)) {
-		pr_err("Failed to create %s info directory\n", attr_name);
-		goto failed_create_dir;
-	}
-
-	/* create number of clients attribute */
-	attr = debugfs_create_u32("num_clients", S_IRUGO, attr_root,
-			&session->client_count);
-	if (IS_ERR_OR_NULL(attr)) {
-		pr_err("Failed to create number of clients attribute\n");
-		goto failed_create_attr;
-	}
-
-	/* create streaming state attribute file */
-	attr = debugfs_create_file("streaming", S_IRUGO,
-			attr_root, session, &streaming_state_ops);
-	if (IS_ERR_OR_NULL(attr)) {
-		pr_err("Failed to create streaming state attribute\n");
-		goto failed_create_attr;
-	}
-
-	/* create resolution attribute files */
-	attr = debugfs_create_u32("in_width", S_IRUGO, attr_root,
-			&session->port_info[INPUT_PORT].format.width);
-	if (IS_ERR_OR_NULL(attr)) {
-		pr_err("Failed to create input width attribute\n");
-		goto failed_create_attr;
-	}
-
-	attr = debugfs_create_u32("in_height", S_IRUGO, attr_root,
-			&session->port_info[INPUT_PORT].format.height);
-	if (IS_ERR_OR_NULL(attr)) {
-		pr_err("Failed to create input height attribute\n");
-		goto failed_create_attr;
-	}
-
-	attr = debugfs_create_u32("out_width", S_IRUGO, attr_root,
-			&session->port_info[OUTPUT_PORT].format.width);
-	if (IS_ERR_OR_NULL(attr)) {
-		pr_err("Failed to create output width attribute\n");
-		goto failed_create_attr;
-	}
-
-	attr = debugfs_create_u32("out_height", S_IRUGO, attr_root,
-			&session->port_info[OUTPUT_PORT].format.height);
-	if (IS_ERR_OR_NULL(attr)) {
-		pr_err("Failed to create output height attribute\n");
-		goto failed_create_attr;
-	}
-
-	return 0;
-
-failed_create_attr:
-	debugfs_remove_recursive(attr_root);
-failed_create_dir:
-	return -ENOENT;
-}
-
-struct dentry *init_vpu_debugfs(struct vpu_dev_core *core)
-{
-	struct dentry *root, *attr;
-	int i;
-
-	root = debugfs_create_dir(VPU_DRV_NAME, NULL);
-	if (IS_ERR_OR_NULL(root)) {
-		pr_err("Failed to create debugfs directory\n");
-		goto failed_create_dir;
-	}
-
-	/* create shutdown delay file */
-	attr = debugfs_create_u32("shutdown_delay_ms", S_IRUGO | S_IWUSR,
-			root, &vpu_shutdown_delay);
-	if (IS_ERR_OR_NULL(attr)) {
-		pr_err("Failed to create shutdown_delay attribute\n");
-		goto failed_create_attr;
-	}
-
-	/* create firmware log file */
-	init_waitqueue_head(&fw_log.wq);
-	atomic_set(&fw_log.num_readers, 0);
-	attr = debugfs_create_file("firmware_log", S_IRUGO, root, NULL,
-			&fw_logging_ops);
-	if (IS_ERR_OR_NULL(attr)) {
-		pr_err("Failed to create firmware logging attribute\n");
-		goto failed_create_attr;
-	}
-
-	/* create firmware log level file */
-	attr = debugfs_create_file("firmware_log_level", RW_MODE, root, NULL,
-			&fw_log_level_ops);
-	if (IS_ERR_OR_NULL(attr)) {
-		pr_err("Failed to create firmware logging level attribute\n");
-		goto failed_create_attr;
-	}
-
-	/* create queue state file */
-	attr = debugfs_create_file("queue_state", S_IRUGO, root, NULL,
-			&queue_state_ops);
-	if (IS_ERR_OR_NULL(attr)) {
-		pr_err("Failed to create queue state attribute\n");
-		goto failed_create_attr;
-	}
-
-	/* create csr regs file */
-	attr = debugfs_create_file("csr_regs", RW_MODE, root, NULL,
-			&csr_regs_ops);
-	if (IS_ERR_OR_NULL(attr)) {
-		pr_err("Failed to create csr regs attribute\n");
-		goto failed_create_attr;
-	}
-
-	/* create cmd entry */
-	vpu_debug_on = 0;
-	attr = debugfs_create_file("cmd", RW_MODE, root, NULL,
-			&vpu_cmd_ops);
-	if (IS_ERR_OR_NULL(attr)) {
-		pr_err("Failed to create cmd attribute\n");
-		goto failed_create_attr;
-	}
-
-	/* create shared mem entry (smem dir + files) */
-	attr = init_smem_dir(root);
-	if (IS_ERR_OR_NULL(attr)) {
-		pr_err("Failed to create smem dir\n");
-		goto failed_create_attr;
-	}
-
-	/* create client entry */
-	attr = debugfs_create_file("client", RW_MODE, root, core,
-			&vpu_client_ops);
-	if (IS_ERR_OR_NULL(attr)) {
-		pr_err("Failed to create client attribute\n");
-		goto failed_create_attr;
-	}
-
-	/* create sessions station information directories */
-	for (i = 0; i < VPU_NUM_SESSIONS; i++)
-		init_vpu_session_info_dir(root, core->sessions[i]);
-
-	return root;
-
-failed_create_attr:
-	cleanup_vpu_debugfs(root);
-failed_create_dir:
-	return NULL;
-}
-
-void cleanup_vpu_debugfs(struct dentry *root)
-{
-	debugfs_remove_recursive(root);
-}
diff --git a/drivers/media/platform/msm/vpu/vpu_debug.h b/drivers/media/platform/msm/vpu/vpu_debug.h
index 1dffbb70abe..52484b89518 100644
--- a/drivers/media/platform/msm/vpu/vpu_debug.h
+++ b/drivers/media/platform/msm/vpu/vpu_debug.h
@@ -18,18 +18,6 @@
 
 #include "vpu_v4l2.h"
 
-#ifdef CONFIG_DEBUG_FS
-
-/* functions to init and deinit VPU debugfs entries */
-struct dentry *init_vpu_debugfs(struct vpu_dev_core *core);
-
-void cleanup_vpu_debugfs(struct dentry *dir);
-
-/* hfi layer uses this to inform debug layer that firmware sent a log msg */
-void vpu_wakeup_fw_logging_wq(void);
-
-#else
-
 static inline struct dentry *init_vpu_debugfs(struct vpu_dev_core *core)
 {
 	return NULL;
@@ -41,6 +29,4 @@ static inline void cleanup_vpu_debugfs(struct dentry *dir)
 static inline void vpu_wakeup_fw_logging_wq(void)
 { }
 
-#endif /* CONFIG_DEBUG_FS */
-
 #endif /* __H_VPU_DEBUG_H__ */
diff --git a/drivers/platform/msm/msm_bus/msm_bus_fabric_adhoc.c b/drivers/platform/msm/msm_bus/msm_bus_fabric_adhoc.c
index 759452a2a70..28c4a61d1d6 100644
--- a/drivers/platform/msm/msm_bus/msm_bus_fabric_adhoc.c
+++ b/drivers/platform/msm/msm_bus/msm_bus_fabric_adhoc.c
@@ -948,7 +948,7 @@ static struct device *msm_bus_device_init(
 	if (!bus_dev) {
 		MSM_BUS_ERR("%s:Device alloc failed\n", __func__);
 		bus_dev = NULL;
-		goto exit_device_init;
+		goto err_device_init;
 	}
 	/**
 	* Init here so we can use devm calls
@@ -958,54 +958,42 @@ static struct device *msm_bus_device_init(
 	bus_node = devm_kzalloc(bus_dev,
 			sizeof(struct msm_bus_node_device_type), GFP_KERNEL);
 	if (!bus_node) {
-		MSM_BUS_ERR("%s:Bus node alloc failed\n", __func__);
-		kfree(bus_dev);
-		bus_dev = NULL;
-		goto exit_device_init;
+		ret = -ENOMEM;
+		goto err_device_init;
 	}
 
 	node_info = devm_kzalloc(bus_dev,
 			sizeof(struct msm_bus_node_info_type), GFP_KERNEL);
 	if (!node_info) {
-		MSM_BUS_ERR("%s:Bus node info alloc failed\n", __func__);
-		devm_kfree(bus_dev, bus_node);
-		kfree(bus_dev);
-		bus_dev = NULL;
-		goto exit_device_init;
+		ret = -ENOMEM;
+		goto err_put_device;
 	}
 
 	bus_node->node_info = node_info;
 	bus_node->ap_owned = pdata->ap_owned;
 	bus_dev->platform_data = bus_node;
 
-	if (msm_bus_copy_node_info(pdata, bus_dev) < 0) {
-		devm_kfree(bus_dev, bus_node);
-		devm_kfree(bus_dev, node_info);
-		kfree(bus_dev);
-		bus_dev = NULL;
-		goto exit_device_init;
-	}
+	ret = msm_bus_copy_node_info(pdata, bus_dev);
+	if (ret)
+		goto err_put_device;
 
 	bus_dev->bus = &msm_bus_type;
 	dev_set_name(bus_dev, bus_node->node_info->name);
 
 	ret = device_add(bus_dev);
-	if (ret < 0) {
+	if (ret) {
 		MSM_BUS_ERR("%s: Error registering device %d",
 				__func__, pdata->node_info->id);
-		devm_kfree(bus_dev, bus_node);
-		devm_kfree(bus_dev, node_info->dev_connections);
-		devm_kfree(bus_dev, node_info->connections);
-		devm_kfree(bus_dev, node_info->black_connections);
-		devm_kfree(bus_dev, node_info->black_listed_connections);
-		devm_kfree(bus_dev, node_info);
-		kfree(bus_dev);
-		bus_dev = NULL;
-		goto exit_device_init;
+		goto err_put_device;
 	}
-
-exit_device_init:
 	return bus_dev;
+
+err_put_device:
+	put_device(bus_dev);
+	bus_dev = NULL;
+	kfree(bus_node);
+err_device_init:
+	return ERR_PTR(ret);
 }
 
 static int msm_bus_setup_dev_conn(struct device *bus_dev, void *data)
@@ -1127,10 +1115,10 @@ static int msm_bus_device_probe(struct platform_device *pdev)
 
 		node_dev = msm_bus_device_init(&pdata->info[i]);
 
-		if (!node_dev) {
+		if (IS_ERR(node_dev)) {
 			MSM_BUS_ERR("%s: Error during dev init for %d",
 				__func__, pdata->info[i].node_info->id);
-			ret = -ENXIO;
+			ret = PTR_ERR(node_dev);
 			goto exit_device_probe;
 		}
 
diff --git a/drivers/power/qcom/msm-core.c b/drivers/power/qcom/msm-core.c
index 109a567e972..662b065838c 100644
--- a/drivers/power/qcom/msm-core.c
+++ b/drivers/power/qcom/msm-core.c
@@ -96,6 +96,7 @@ struct cpu_static_info {
 
 static DEFINE_MUTEX(policy_update_mutex);
 static DEFINE_MUTEX(kthread_update_mutex);
+static DEFINE_SPINLOCK(update_lock);
 static struct delayed_work sampling_work;
 static struct completion sampling_completion;
 static struct task_struct *sampling_task;
@@ -194,7 +195,6 @@ void trigger_cpu_pwr_stats_calc(void)
 {
 	int cpu;
 	static long prev_temp[NR_CPUS];
-	static DEFINE_SPINLOCK(update_lock);
 	struct cpu_activity_info *cpu_node;
 
 	if (disabled)
@@ -363,8 +363,8 @@ static int update_userspace_power(struct sched_params __user *argp)
 	/* Copy the same power values for all the cpus in the cpumask
 	 * argp->cpumask within the cluster (argp->cluster)
 	 */
-	spin_lock(&update_lock);
 	get_user(cpumask, &argp->cpumask);
+	spin_lock(&update_lock);
 	for (i = 0; i < MAX_CORES_PER_CLUSTER; i++, cpumask >>= 1) {
 		if (!(cpumask & 0x01))
 			continue;
@@ -386,8 +386,8 @@ static int update_userspace_power(struct sched_params __user *argp)
 			repopulate_stats(cpu);
 		}
 	}
+	spin_unlock(&update_lock);
 	mutex_unlock(&policy_update_mutex);
-
 	activate_power_table = true;
 	return 0;
 
diff --git a/drivers/regulator/core.c b/drivers/regulator/core.c
index e4753f0fcee..5bc74cc0488 100644
--- a/drivers/regulator/core.c
+++ b/drivers/regulator/core.c
@@ -3683,7 +3683,7 @@ static ssize_t reg_debug_volt_get(struct file *file, char __user *buf,
 	mutex_lock(&debug_buf_mutex);
 
 	output = snprintf(debug_buf, MAX_DEBUG_BUF_LEN-1, "%d\n", voltage);
-	rc = simple_read_from_buffer((void __user *) buf, output, ppos,
+	rc = simple_read_from_buffer((void __user *) buf, count, ppos,
 					(void *) debug_buf, output);
 
 	mutex_unlock(&debug_buf_mutex);
diff --git a/drivers/soc/qcom/qdsp6v2/voice_svc.c b/drivers/soc/qcom/qdsp6v2/voice_svc.c
index e05230255d6..ddd0802b7d0 100644
--- a/drivers/soc/qcom/qdsp6v2/voice_svc.c
+++ b/drivers/soc/qcom/qdsp6v2/voice_svc.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2014-2017, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2014-2018, The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -773,7 +773,7 @@ static int voice_svc_probe(struct platform_device *pdev)
 	if (ret) {
 		pr_err("%s: Failed to alloc chrdev\n", __func__);
 		ret = -ENODEV;
-		goto chrdev_err;
+		goto done;
 	}
 
 	voice_svc_dev->major = MAJOR(device_num);
@@ -820,8 +820,6 @@ dev_err:
 	class_destroy(voice_svc_class);
 class_err:
 	unregister_chrdev_region(0, MINOR_NUMBER);
-chrdev_err:
-	kfree(voice_svc_dev);
 done:
 	return ret;
 }
@@ -835,7 +833,6 @@ static int voice_svc_remove(struct platform_device *pdev)
 	device_destroy(voice_svc_class, device_num);
 	class_destroy(voice_svc_class);
 	unregister_chrdev_region(0, MINOR_NUMBER);
-	kfree(voice_svc_dev);
 
 	return 0;
 }
diff --git a/drivers/video/msm/mdss/mdss_mdp.c b/drivers/video/msm/mdss/mdss_mdp.c
index 70864983048..39c8de21301 100644
--- a/drivers/video/msm/mdss/mdss_mdp.c
+++ b/drivers/video/msm/mdss/mdss_mdp.c
@@ -1,7 +1,7 @@
 /*
  * MDSS MDP Interface (used by framebuffer core)
  *
- * Copyright (c) 2007-2014, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2007-2014, 2018, The Linux Foundation. All rights reserved.
  * Copyright (C) 2007 Google Incorporated
  *
  * This software is licensed under the terms of the GNU General Public
@@ -1947,7 +1947,7 @@ static int mdss_mdp_parse_dt_pipe(struct platform_device *pdev)
 	if (!mdata->vig_pipes) {
 		pr_err("no mem for vig_pipes: kzalloc fail\n");
 		rc = -ENOMEM;
-		goto vig_alloc_fail;
+		goto parse_fail;
 	}
 
 	mdata->rgb_pipes = devm_kzalloc(&mdata->pdev->dev,
@@ -1955,7 +1955,7 @@ static int mdss_mdp_parse_dt_pipe(struct platform_device *pdev)
 	if (!mdata->rgb_pipes) {
 		pr_err("no mem for rgb_pipes: kzalloc fail\n");
 		rc = -ENOMEM;
-		goto rgb_alloc_fail;
+		goto parse_fail;
 	}
 
 	if (mdata->ndma_pipes) {
@@ -1965,7 +1965,7 @@ static int mdss_mdp_parse_dt_pipe(struct platform_device *pdev)
 		if (!mdata->dma_pipes) {
 			pr_err("no mem for dma_pipes: kzalloc fail\n");
 			rc = -ENOMEM;
-			goto dma_alloc_fail;
+			goto parse_fail;
 		}
 	}
 
@@ -2142,7 +2142,7 @@ static int mdss_mdp_parse_dt_pipe(struct platform_device *pdev)
 		if (!mdata->cursor_pipes) {
 			pr_err("no mem for cursor_pipes: kzalloc fail\n");
 			rc = -ENOMEM;
-			goto cursor_alloc_fail;
+			goto parse_fail;
 		}
 		rc = mdss_mdp_parse_dt_handler(pdev,
 			"qcom,mdss-pipe-cursor-off", offsets,
@@ -2166,18 +2166,8 @@ static int mdss_mdp_parse_dt_pipe(struct platform_device *pdev)
 		pr_info("dedicated vp cursors detected, num=%d\n",
 			mdata->ncursor_pipes);
 	}
-	goto parse_done;
 
 parse_fail:
-	kfree(mdata->cursor_pipes);
-cursor_alloc_fail:
-	kfree(mdata->dma_pipes);
-dma_alloc_fail:
-	kfree(mdata->rgb_pipes);
-rgb_alloc_fail:
-	kfree(mdata->vig_pipes);
-parse_done:
-vig_alloc_fail:
 	kfree(xin_id);
 xin_alloc_fail:
 	kfree(ftch_id);
diff --git a/net/core/sockev_nlmcast.c b/net/core/sockev_nlmcast.c
index 749ffb81c87..3d7dabef641 100644
--- a/net/core/sockev_nlmcast.c
+++ b/net/core/sockev_nlmcast.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2014-2015, The Linux Foundation. All rights reserved.
+ * Copyright (c) 2014-2015, 2018 The Linux Foundation. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 and
@@ -36,6 +36,8 @@ static struct netlink_kernel_cfg nlcfg = {
 
 static void _sockev_event(unsigned long event, __u8 *evstr, int buflen)
 {
+	memset(evstr, 0, buflen);
+
 	switch (event) {
 	case SOCKEV_SOCKET:
 		strlcpy(evstr, "SOCKEV_SOCKET", buflen);
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index a867351bc19..65aff0f7b3e 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -2493,17 +2493,20 @@ static int packet_release(struct socket *sock)
 static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 protocol)
 {
 	struct packet_sock *po = pkt_sk(sk);
+	int ret = 0;
+
+	lock_sock(sk);
+
+	spin_lock(&po->bind_lock);
 
 	if (po->fanout) {
 		if (dev)
 			dev_put(dev);
 
-		return -EINVAL;
+		ret = -EINVAL;
+		goto out_unlock;
 	}
 
-	lock_sock(sk);
-
-	spin_lock(&po->bind_lock);
 	unregister_prot_hook(sk, true);
 
 	po->num = protocol;
@@ -2530,7 +2533,7 @@ static int packet_do_bind(struct sock *sk, struct net_device *dev, __be16 protoc
 out_unlock:
 	spin_unlock(&po->bind_lock);
 	release_sock(sk);
-	return 0;
+	return ret;
 }
 
 /*
diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c
index ea970b8002a..6a7259fa076 100644
--- a/net/xfrm/xfrm_policy.c
+++ b/net/xfrm/xfrm_policy.c
@@ -1093,16 +1093,21 @@ static inline int policy_to_flow_dir(int dir)
 }
 
 static struct xfrm_policy *xfrm_sk_policy_lookup(struct sock *sk, int dir,
-						 const struct flowi *fl)
+						 const struct flowi *fl, u16 family)
 {
 	struct xfrm_policy *pol;
 
 	read_lock_bh(&xfrm_policy_lock);
 	if ((pol = sk->sk_policy[dir]) != NULL) {
-		bool match = xfrm_selector_match(&pol->selector, fl,
-						 sk->sk_family);
+		bool match;
 		int err = 0;
 
+		if (pol->family != family) {
+			pol = NULL;
+			goto out;
+		}
+
+		match = xfrm_selector_match(&pol->selector, fl, family);
 		if (match) {
 			if ((sk->sk_mark & pol->mark.m) != pol->mark.v) {
 				pol = NULL;
@@ -2059,7 +2064,7 @@ restart:
 
 	if (sk && sk->sk_policy[XFRM_POLICY_OUT]) {
 		num_pols = 1;
-		pols[0] = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl);
+		pols[0] = xfrm_sk_policy_lookup(sk, XFRM_POLICY_OUT, fl, family);
 		err = xfrm_expand_policies(fl, family, pols,
 					   &num_pols, &num_xfrms);
 		if (err < 0)
@@ -2337,7 +2342,7 @@ int __xfrm_policy_check(struct sock *sk, int dir, struct sk_buff *skb,
 
 	pol = NULL;
 	if (sk && sk->sk_policy[dir]) {
-		pol = xfrm_sk_policy_lookup(sk, dir, &fl);
+		pol = xfrm_sk_policy_lookup(sk, dir, &fl, family);
 		if (IS_ERR(pol)) {
 			XFRM_INC_STATS(net, LINUX_MIB_XFRMINPOLERROR);
 			return 0;
diff --git a/security/keys/encrypted-keys/encrypted.c b/security/keys/encrypted-keys/encrypted.c
index 9e1e005c759..fabb763bba1 100644
--- a/security/keys/encrypted-keys/encrypted.c
+++ b/security/keys/encrypted-keys/encrypted.c
@@ -141,23 +141,22 @@ static int valid_ecryptfs_desc(const char *ecryptfs_desc)
  */
 static int valid_master_desc(const char *new_desc, const char *orig_desc)
 {
-	if (!memcmp(new_desc, KEY_TRUSTED_PREFIX, KEY_TRUSTED_PREFIX_LEN)) {
-		if (strlen(new_desc) == KEY_TRUSTED_PREFIX_LEN)
-			goto out;
-		if (orig_desc)
-			if (memcmp(new_desc, orig_desc, KEY_TRUSTED_PREFIX_LEN))
-				goto out;
-	} else if (!memcmp(new_desc, KEY_USER_PREFIX, KEY_USER_PREFIX_LEN)) {
-		if (strlen(new_desc) == KEY_USER_PREFIX_LEN)
-			goto out;
-		if (orig_desc)
-			if (memcmp(new_desc, orig_desc, KEY_USER_PREFIX_LEN))
-				goto out;
-	} else
-		goto out;
+	int prefix_len;
+
+	if (!strncmp(new_desc, KEY_TRUSTED_PREFIX, KEY_TRUSTED_PREFIX_LEN))
+		prefix_len = KEY_TRUSTED_PREFIX_LEN;
+	else if (!strncmp(new_desc, KEY_USER_PREFIX, KEY_USER_PREFIX_LEN))
+		prefix_len = KEY_USER_PREFIX_LEN;
+	else
+		return -EINVAL;
+
+	if (!new_desc[prefix_len])
+		return -EINVAL;
+
+	if (orig_desc && strncmp(new_desc, orig_desc, prefix_len))
+		return -EINVAL;
+
 	return 0;
-out:
-	return -EINVAL;
 }
 
 /*
diff --git a/sound/core/rawmidi.c b/sound/core/rawmidi.c
index a5c5fc3f019..e2fc8be874c 100644
--- a/sound/core/rawmidi.c
+++ b/sound/core/rawmidi.c
@@ -958,14 +958,13 @@ static long snd_rawmidi_kernel_read1(struct snd_rawmidi_substream *substream,
 	long result = 0, count1;
 	struct snd_rawmidi_runtime *runtime = substream->runtime;
 
-	spin_lock_irqsave(&runtime->lock, flags);
 	if (userbuf)
 		mutex_lock(&runtime->realloc_mutex);
+	spin_lock_irqsave(&runtime->lock, flags);
 	while (count > 0 && runtime->avail) {
 		count1 = runtime->buffer_size - runtime->appl_ptr;
 		if (count1 > count)
 			count1 = count;
-		spin_lock_irqsave(&runtime->lock, flags);
 		if (count1 > (int)runtime->avail)
 			count1 = runtime->avail;
 		if (kernelbuf)
diff --git a/sound/soc/msm/qdsp6v2/rtac.c b/sound/soc/msm/qdsp6v2/rtac.c
index 11edd2a6caf..f908879ab81 100644
--- a/sound/soc/msm/qdsp6v2/rtac.c
+++ b/sound/soc/msm/qdsp6v2/rtac.c
@@ -144,6 +144,11 @@ struct mutex			rtac_voice_mutex;
 struct mutex			rtac_voice_apr_mutex;
 struct mutex			rtac_afe_apr_mutex;
 
+static struct mutex			rtac_asm_cal_mutex;
+static struct mutex			rtac_adm_cal_mutex;
+static struct mutex			rtac_afe_cal_mutex;
+static struct mutex			rtac_voice_cal_mutex;
+
 int rtac_clear_mapping(uint32_t cal_type)
 {
 	int result = 0;
@@ -1590,42 +1595,62 @@ static long rtac_ioctl_shared(struct file *f,
 	}
 
 	case AUDIO_GET_RTAC_ADM_CAL:
+		mutex_lock(&rtac_adm_cal_mutex);
 		result = send_adm_apr((void *)arg, ADM_CMD_GET_PP_PARAMS_V5);
+		mutex_unlock(&rtac_adm_cal_mutex);
 		break;
 	case AUDIO_SET_RTAC_ADM_CAL:
+		mutex_lock(&rtac_adm_cal_mutex);
 		result = send_adm_apr((void *)arg, ADM_CMD_SET_PP_PARAMS_V5);
+		mutex_unlock(&rtac_adm_cal_mutex);
 		break;
 	case AUDIO_GET_RTAC_ASM_CAL:
+		mutex_lock(&rtac_asm_cal_mutex);
 		result = send_rtac_asm_apr((void *)arg,
 			ASM_STREAM_CMD_GET_PP_PARAMS_V2);
+		mutex_unlock(&rtac_asm_cal_mutex);
 		break;
 	case AUDIO_SET_RTAC_ASM_CAL:
+		mutex_lock(&rtac_asm_cal_mutex);
 		result = send_rtac_asm_apr((void *)arg,
 			ASM_STREAM_CMD_SET_PP_PARAMS_V2);
+		mutex_unlock(&rtac_asm_cal_mutex);
 		break;
 	case AUDIO_GET_RTAC_CVS_CAL:
+		mutex_lock(&rtac_voice_cal_mutex);
 		result = send_voice_apr(RTAC_CVS, (void *)arg,
 			VOICE_CMD_GET_PARAM);
+		mutex_unlock(&rtac_voice_cal_mutex);
 		break;
 	case AUDIO_SET_RTAC_CVS_CAL:
+		mutex_lock(&rtac_voice_cal_mutex);
 		result = send_voice_apr(RTAC_CVS, (void *)arg,
 			VOICE_CMD_SET_PARAM);
+		mutex_unlock(&rtac_voice_cal_mutex);
 		break;
 	case AUDIO_GET_RTAC_CVP_CAL:
+		mutex_lock(&rtac_voice_cal_mutex);
 		result = send_voice_apr(RTAC_CVP, (void *)arg,
 			VOICE_CMD_GET_PARAM);
+		mutex_unlock(&rtac_voice_cal_mutex);
 		break;
 	case AUDIO_SET_RTAC_CVP_CAL:
+		mutex_lock(&rtac_voice_cal_mutex);
 		result = send_voice_apr(RTAC_CVP, (void *)arg,
 			VOICE_CMD_SET_PARAM);
+		mutex_unlock(&rtac_voice_cal_mutex);
 		break;
 	case AUDIO_GET_RTAC_AFE_CAL:
+		mutex_lock(&rtac_afe_cal_mutex);
 		result = send_rtac_afe_apr((void *)arg,
 			AFE_PORT_CMD_GET_PARAM_V2);
+		mutex_unlock(&rtac_afe_cal_mutex);
 		break;
 	case AUDIO_SET_RTAC_AFE_CAL:
+		mutex_lock(&rtac_afe_cal_mutex);
 		result = send_rtac_afe_apr((void *)arg,
 			AFE_PORT_CMD_SET_PARAM_V2);
+		mutex_unlock(&rtac_afe_cal_mutex);
 		break;
 	default:
 		pr_err("%s: Invalid IOCTL, command = %d!\n",
@@ -1757,6 +1782,7 @@ static int __init rtac_init(void)
 	init_waitqueue_head(&rtac_adm_apr_data.cmd_wait);
 	mutex_init(&rtac_adm_mutex);
 	mutex_init(&rtac_adm_apr_mutex);
+	mutex_init(&rtac_adm_cal_mutex);
 
 	rtac_adm_buffer = kzalloc(
 		rtac_cal[ADM_RTAC_CAL].map_data.map_size, GFP_KERNEL);
@@ -1773,6 +1799,7 @@ static int __init rtac_init(void)
 		init_waitqueue_head(&rtac_asm_apr_data[i].cmd_wait);
 	}
 	mutex_init(&rtac_asm_apr_mutex);
+	mutex_init(&rtac_asm_cal_mutex);
 
 	rtac_asm_buffer = kzalloc(
 		rtac_cal[ASM_RTAC_CAL].map_data.map_size, GFP_KERNEL);
@@ -1788,6 +1815,7 @@ static int __init rtac_init(void)
 	atomic_set(&rtac_afe_apr_data.cmd_state, 0);
 	init_waitqueue_head(&rtac_afe_apr_data.cmd_wait);
 	mutex_init(&rtac_afe_apr_mutex);
+	mutex_init(&rtac_afe_cal_mutex);
 
 	rtac_afe_buffer = kzalloc(
 		rtac_cal[AFE_RTAC_CAL].map_data.map_size, GFP_KERNEL);
@@ -1808,6 +1836,7 @@ static int __init rtac_init(void)
 	}
 	mutex_init(&rtac_voice_mutex);
 	mutex_init(&rtac_voice_apr_mutex);
+	mutex_init(&rtac_voice_cal_mutex);
 
 	rtac_voice_buffer = kzalloc(
 		rtac_cal[VOICE_RTAC_CAL].map_data.map_size, GFP_KERNEL);