Update to 4.4.2

Drop patches included in it.

Refresh rt patches with textual conflicts.

10 files changed, 55 insertions, 220 deletions

diff --git a/debian/changelog b/debian/changelog
index a9491a436824..02bfb398274c 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -1,4 +1,8 @@
-linux (4.4.1-1) UNRELEASED; urgency=medium
+linux (4.4.2-1) UNRELEASED; urgency=medium
+
+  * New upstream stable update:
+    https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.4.2
+    - ALSA: usb-audio: avoid freeing umidi object twice (CVE-2016-2384)
 
   [ Ben Hutchings ]
   * Set ABI to 1
@@ -13,7 +17,6 @@ linux (4.4.1-1) UNRELEASED; urgency=medium
     (regression in 4.4, 4.3.4)
   * bpf: fix branch offset adjustment on backjumps after patching ctx expansion
     (CVE-2016-2383)
-  * ALSA: usb-audio: avoid freeing umidi object twice (CVE-2016-2384)
   * udeb: Combine scsi-{common,extra}-modules with scsi-modules
   * udeb: Use wildcards to include entire classes of drivers:
     - input-modules: Include HID drivers by default
diff --git a/debian/patches/bugfix/all/alsa-usb-audio-avoid-freeing-umidi-object-twice.patch b/debian/patches/bugfix/all/alsa-usb-audio-avoid-freeing-umidi-object-twice.patch
deleted file mode 100644
index 72c57bf01f28..000000000000
--- a/debian/patches/bugfix/all/alsa-usb-audio-avoid-freeing-umidi-object-twice.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From: Andrey Konovalov <andreyknvl@gmail.com>
-Date: Sat, 13 Feb 2016 11:08:06 +0300
-Subject: ALSA: usb-audio: avoid freeing umidi object twice
-Origin: https://git.kernel.org/linus/07d86ca93db7e5cdf4743564d98292042ec21af7
-
-The 'umidi' object will be free'd on the error path by snd_usbmidi_free()
-when tearing down the rawmidi interface. So we shouldn't try to free it
-in snd_usbmidi_create() after having registered the rawmidi interface.
-
-Found by KASAN.
-
-Signed-off-by: Andrey Konovalov <andreyknvl@gmail.com>
-Acked-by: Clemens Ladisch <clemens@ladisch.de>
-Cc: <stable@vger.kernel.org>
-Signed-off-by: Takashi Iwai <tiwai@suse.de>
----
- sound/usb/midi.c | 1 -
- 1 file changed, 1 deletion(-)
-
-diff --git a/sound/usb/midi.c b/sound/usb/midi.c
-index cc39f63299ef..007cf5831121 100644
---- a/sound/usb/midi.c
-+++ b/sound/usb/midi.c
-@@ -2455,7 +2455,6 @@ int snd_usbmidi_create(struct snd_card *card,
- 	else
- 		err = snd_usbmidi_create_endpoints(umidi, endpoints);
- 	if (err < 0) {
--		snd_usbmidi_free(umidi);
- 		return err;
- 	}
- 
diff --git a/debian/patches/bugfix/all/tty-fix-unsafe-ldisc-reference-via-ioctl-tiocgetd.patch b/debian/patches/bugfix/all/tty-fix-unsafe-ldisc-reference-via-ioctl-tiocgetd.patch
deleted file mode 100644
index 02fe5e74bcd6..000000000000
--- a/debian/patches/bugfix/all/tty-fix-unsafe-ldisc-reference-via-ioctl-tiocgetd.patch
+++ /dev/null
@@ -1,63 +0,0 @@
-From: Peter Hurley <peter@hurleysoftware.com>
-Subject: tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)
-Date: Sun, 10 Jan 2016 22:40:55 -0800
-Origin: http://article.gmane.org/gmane.linux.kernel/2123249
-
-ioctl(TIOCGETD) retrieves the line discipline id directly from the
-ldisc because the line discipline id (c_line) in termios is untrustworthy;
-userspace may have set termios via ioctl(TCSETS*) without actually
-changing the line discipline via ioctl(TIOCSETD).
-
-However, directly accessing the current ldisc via tty->ldisc is
-unsafe; the ldisc ptr dereferenced may be stale if the line discipline
-is changing via ioctl(TIOCSETD) or hangup.
-
-Wait for the line discipline reference (just like read() or write())
-to retrieve the "current" line discipline id.
-
-Cc: <stable@vger.kernel.org>
-Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
----
- drivers/tty/tty_io.c | 24 +++++++++++++++++++++++-
- 1 file changed, 23 insertions(+), 1 deletion(-)
-
---- a/drivers/tty/tty_io.c
-+++ b/drivers/tty/tty_io.c
-@@ -2654,6 +2654,28 @@ static int tiocsetd(struct tty_struct *t
- }
- 
- /**
-+ *	tiocgetd	-	get line discipline
-+ *	@tty: tty device
-+ *	@p: pointer to user data
-+ *
-+ *	Retrieves the line discipline id directly from the ldisc.
-+ *
-+ *	Locking: waits for ldisc reference (in case the line discipline
-+ *		is changing or the tty is being hungup)
-+ */
-+
-+static int tiocgetd(struct tty_struct *tty, int __user *p)
-+{
-+	struct tty_ldisc *ld;
-+	int ret;
-+
-+	ld = tty_ldisc_ref_wait(tty);
-+	ret = put_user(ld->ops->num, p);
-+	tty_ldisc_deref(ld);
-+	return ret;
-+}
-+
-+/**
-  *	send_break	-	performed time break
-  *	@tty: device to break on
-  *	@duration: timeout in mS
-@@ -2879,7 +2901,7 @@ long tty_ioctl(struct file *file, unsign
- 	case TIOCGSID:
- 		return tiocgsid(tty, real_tty, p);
- 	case TIOCGETD:
--		return put_user(tty->ldisc->ops->num, (int __user *)p);
-+		return tiocgetd(tty, p);
- 	case TIOCSETD:
- 		return tiocsetd(tty, p);
- 	case TIOCVHANGUP:
diff --git a/debian/patches/bugfix/all/usb-serial-visor-fix-crash-on-detecting-device-without-write_urbs.patch b/debian/patches/bugfix/all/usb-serial-visor-fix-crash-on-detecting-device-without-write_urbs.patch
deleted file mode 100644
index 4b6a5d63cb1e..000000000000
--- a/debian/patches/bugfix/all/usb-serial-visor-fix-crash-on-detecting-device-without-write_urbs.patch
+++ /dev/null
@@ -1,31 +0,0 @@
-From: Vladis Dronov <vdronov@redhat.com>
-Subject: usb: serial: visor: fix crash on detecting device without write_urbs
-Date: Tue, 12 Jan 2016 15:10:50 +0100
-Origin: http://article.gmane.org/gmane.linux.usb.general/136045
-Bug: https://bugzilla.redhat.com/show_bug.cgi?id=1296466
-
-The visor driver crashes in clie_5_attach() when a specially crafted USB
-device without bulk-out endpoint is detected. This fix adds a check that
-the device has proper configuration expected by the driver.
-
-Reported-by: Ralf Spenneberg <ralf@spenneberg.net>
-Signed-off-by: Vladis Dronov <vdronov@redhat.com>
----
- drivers/usb/serial/visor.c | 6 ++++--
- 1 file changed, 4 insertions(+), 2 deletions(-)
-
---- a/drivers/usb/serial/visor.c
-+++ b/drivers/usb/serial/visor.c
-@@ -597,8 +597,10 @@ static int clie_5_attach(struct usb_seri
- 	 */
- 
- 	/* some sanity check */
--	if (serial->num_ports < 2)
--		return -1;
-+	if (serial->num_bulk_out < 2) {
-+		dev_err(&serial->interface->dev, "missing bulk out endpoints\n");
-+		return -ENODEV;
-+	}
- 
- 	/* port 0 now uses the modified endpoint Address */
- 	port = serial->port[0];
diff --git a/debian/patches/bugfix/arm/crypto-sun4i-ss-add-missing-statesize.patch b/debian/patches/bugfix/arm/crypto-sun4i-ss-add-missing-statesize.patch
deleted file mode 100644
index 7aace658ee86..000000000000
--- a/debian/patches/bugfix/arm/crypto-sun4i-ss-add-missing-statesize.patch
+++ /dev/null
@@ -1,40 +0,0 @@
-From: LABBE Corentin <clabbe.montjoie@gmail.com>
-Date: Mon, 16 Nov 2015 09:35:54 +0100
-Subject: crypto: sun4i-ss - add missing statesize
-Origin: https://git.kernel.org/cgit/linux/kernel/git/herbert/cryptodev-2.6.git/commit?id=4f9ea86604e3ba64edd2817795798168fbb3c1a6
-Bug-Debian: https://bugs.debian.org/808625
-
-sun4i-ss implementaton of md5/sha1 is via ahash algorithms.
-Commit 8996eafdcbad ("crypto: ahash - ensure statesize is non-zero")
-made impossible to load them without giving statesize. This patch
-specifiy statesize for sha1 and md5.
-
-Fixes: 6298e948215f ("crypto: sunxi-ss - Add Allwinner Security System crypto accelerator")
-Cc: <stable@vger.kernel.org> # v4.3+
-Tested-by: Chen-Yu Tsai <wens@csie.org>
-Signed-off-by: LABBE Corentin <clabbe.montjoie@gmail.com>
-Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
----
- drivers/crypto/sunxi-ss/sun4i-ss-core.c | 2 ++
- 1 file changed, 2 insertions(+)
-
-diff --git a/drivers/crypto/sunxi-ss/sun4i-ss-core.c b/drivers/crypto/sunxi-ss/sun4i-ss-core.c
-index eab6fe2..107cd2a 100644
---- a/drivers/crypto/sunxi-ss/sun4i-ss-core.c
-+++ b/drivers/crypto/sunxi-ss/sun4i-ss-core.c
-@@ -39,6 +39,7 @@ static struct sun4i_ss_alg_template ss_algs[] = {
- 		.import = sun4i_hash_import_md5,
- 		.halg = {
- 			.digestsize = MD5_DIGEST_SIZE,
-+			.statesize = sizeof(struct md5_state),
- 			.base = {
- 				.cra_name = "md5",
- 				.cra_driver_name = "md5-sun4i-ss",
-@@ -66,6 +67,7 @@ static struct sun4i_ss_alg_template ss_algs[] = {
- 		.import = sun4i_hash_import_sha1,
- 		.halg = {
- 			.digestsize = SHA1_DIGEST_SIZE,
-+			.statesize = sizeof(struct sha1_state),
- 			.base = {
- 				.cra_name = "sha1",
- 				.cra_driver_name = "sha1-sun4i-ss",
diff --git a/debian/patches/features/all/rt/hrtimer-fixup-hrtimer-callback-changes-for-preempt-r.patch b/debian/patches/features/all/rt/hrtimer-fixup-hrtimer-callback-changes-for-preempt-r.patch
index c72f4d745295..f96144243c87 100644
--- a/debian/patches/features/all/rt/hrtimer-fixup-hrtimer-callback-changes-for-preempt-r.patch
+++ b/debian/patches/features/all/rt/hrtimer-fixup-hrtimer-callback-changes-for-preempt-r.patch
@@ -23,25 +23,25 @@ Signed-off-by: Ingo Molnar <mingo@elte.hu>
 
 --- a/include/linux/hrtimer.h
 +++ b/include/linux/hrtimer.h
-@@ -87,6 +87,8 @@ enum hrtimer_restart {
-  * @function:	timer expiry callback function
+@@ -88,6 +88,8 @@ enum hrtimer_restart {
   * @base:	pointer to the timer base (per cpu and per clock)
   * @state:	state information (See bit values above)
+  * @is_rel:	Set if the timer was armed relative
 + * @cb_entry:	list entry to defer timers from hardirq context
 + * @irqsafe:	timer can run in hardirq context
   * @praecox:	timer expiry time if expired at the time of programming
-  * @start_pid: timer statistics field to store the pid of the task which
+  * @start_pid:  timer statistics field to store the pid of the task which
   *		started the timer
-@@ -103,6 +105,8 @@ struct hrtimer {
- 	enum hrtimer_restart		(*function)(struct hrtimer *);
+@@ -105,6 +107,8 @@ struct hrtimer {
  	struct hrtimer_clock_base	*base;
- 	unsigned long			state;
+ 	u8				state;
+ 	u8				is_rel;
 +	struct list_head		cb_entry;
 +	int				irqsafe;
  #ifdef CONFIG_MISSED_TIMER_OFFSETS_HIST
  	ktime_t				praecox;
  #endif
-@@ -134,6 +138,7 @@ struct hrtimer_sleeper {
+@@ -136,6 +140,7 @@ struct hrtimer_sleeper {
   *			timer to a base on another cpu.
   * @clockid:		clock id for per_cpu support
   * @active:		red black tree root node for the active timers
@@ -49,7 +49,7 @@ Signed-off-by: Ingo Molnar <mingo@elte.hu>
   * @get_time:		function to retrieve the current time of the clock
   * @offset:		offset of this clock to the monotonic base
   */
-@@ -142,6 +147,7 @@ struct hrtimer_clock_base {
+@@ -144,6 +149,7 @@ struct hrtimer_clock_base {
  	int			index;
  	clockid_t		clockid;
  	struct timerqueue_head	active;
@@ -57,7 +57,7 @@ Signed-off-by: Ingo Molnar <mingo@elte.hu>
  	ktime_t			(*get_time)(void);
  	ktime_t			offset;
  } __attribute__((__aligned__(HRTIMER_CLOCK_BASE_ALIGN)));
-@@ -185,6 +191,7 @@ struct hrtimer_cpu_base {
+@@ -187,6 +193,7 @@ struct hrtimer_cpu_base {
  	raw_spinlock_t			lock;
  	seqcount_t			seq;
  	struct hrtimer			*running;
@@ -122,7 +122,7 @@ Signed-off-by: Ingo Molnar <mingo@elte.hu>
  	if (!timerqueue_del(&base->active, &timer->node))
  		cpu_base->active_bases &= ~(1 << base->index);
  
-@@ -1162,6 +1164,7 @@ static void __hrtimer_init(struct hrtime
+@@ -1173,6 +1175,7 @@ static void __hrtimer_init(struct hrtime
  
  	base = hrtimer_clockid_to_base(clock_id);
  	timer->base = &cpu_base->clock_base[base];
@@ -130,7 +130,7 @@ Signed-off-by: Ingo Molnar <mingo@elte.hu>
  	timerqueue_init(&timer->node);
  
  #ifdef CONFIG_TIMER_STATS
-@@ -1202,6 +1205,7 @@ bool hrtimer_active(const struct hrtimer
+@@ -1213,6 +1216,7 @@ bool hrtimer_active(const struct hrtimer
  		seq = raw_read_seqcount_begin(&cpu_base->seq);
  
  		if (timer->state != HRTIMER_STATE_INACTIVE ||
@@ -138,7 +138,7 @@ Signed-off-by: Ingo Molnar <mingo@elte.hu>
  		    cpu_base->running == timer)
  			return true;
  
-@@ -1292,12 +1296,112 @@ static void __run_hrtimer(struct hrtimer
+@@ -1311,12 +1315,112 @@ static void __run_hrtimer(struct hrtimer
  	cpu_base->running = NULL;
  }
  
@@ -251,7 +251,7 @@ Signed-off-by: Ingo Molnar <mingo@elte.hu>
  
  	for (; active; base++, active >>= 1) {
  		struct timerqueue_node *node;
-@@ -1337,9 +1441,14 @@ static void __hrtimer_run_queues(struct
+@@ -1356,9 +1460,14 @@ static void __hrtimer_run_queues(struct
  			if (basenow.tv64 < hrtimer_get_softexpires_tv64(timer))
  				break;
  
@@ -267,7 +267,7 @@ Signed-off-by: Ingo Molnar <mingo@elte.hu>
  }
  
  #ifdef CONFIG_HIGH_RES_TIMERS
-@@ -1481,8 +1590,6 @@ void hrtimer_run_queues(void)
+@@ -1500,8 +1609,6 @@ void hrtimer_run_queues(void)
  	now = hrtimer_update_base(cpu_base);
  	__hrtimer_run_queues(cpu_base, now);
  	raw_spin_unlock(&cpu_base->lock);
@@ -276,7 +276,7 @@ Signed-off-by: Ingo Molnar <mingo@elte.hu>
  }
  
  /*
-@@ -1504,6 +1611,7 @@ static enum hrtimer_restart hrtimer_wake
+@@ -1523,6 +1630,7 @@ static enum hrtimer_restart hrtimer_wake
  void hrtimer_init_sleeper(struct hrtimer_sleeper *sl, struct task_struct *task)
  {
  	sl->timer.function = hrtimer_wakeup;
@@ -284,7 +284,7 @@ Signed-off-by: Ingo Molnar <mingo@elte.hu>
  	sl->task = task;
  }
  EXPORT_SYMBOL_GPL(hrtimer_init_sleeper);
-@@ -1638,6 +1746,7 @@ static void init_hrtimers_cpu(int cpu)
+@@ -1657,6 +1765,7 @@ static void init_hrtimers_cpu(int cpu)
  	for (i = 0; i < HRTIMER_MAX_CLOCK_BASES; i++) {
  		cpu_base->clock_base[i].cpu_base = cpu_base;
  		timerqueue_init_head(&cpu_base->clock_base[i].active);
@@ -292,7 +292,7 @@ Signed-off-by: Ingo Molnar <mingo@elte.hu>
  	}
  
  	cpu_base->cpu = cpu;
-@@ -1742,11 +1851,21 @@ static struct notifier_block hrtimers_nb
+@@ -1761,11 +1870,21 @@ static struct notifier_block hrtimers_nb
  	.notifier_call = hrtimer_cpu_notify,
  };
  
diff --git a/debian/patches/features/all/rt/hrtimers-prepare-full-preemption.patch b/debian/patches/features/all/rt/hrtimers-prepare-full-preemption.patch
index 860fcbcbdd43..77b457da7c3f 100644
--- a/debian/patches/features/all/rt/hrtimers-prepare-full-preemption.patch
+++ b/debian/patches/features/all/rt/hrtimers-prepare-full-preemption.patch
@@ -18,7 +18,7 @@ Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
 
 --- a/include/linux/hrtimer.h
 +++ b/include/linux/hrtimer.h
-@@ -205,6 +205,9 @@ struct hrtimer_cpu_base {
+@@ -207,6 +207,9 @@ struct hrtimer_cpu_base {
  	unsigned int			nr_hangs;
  	unsigned int			max_hang_time;
  #endif
@@ -28,7 +28,7 @@ Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  	struct hrtimer_clock_base	clock_base[HRTIMER_MAX_CLOCK_BASES];
  } ____cacheline_aligned;
  
-@@ -393,6 +396,13 @@ static inline void hrtimer_restart(struc
+@@ -416,6 +419,13 @@ static inline void hrtimer_restart(struc
  	hrtimer_start_expires(timer, HRTIMER_MODE_ABS);
  }
  
@@ -40,9 +40,9 @@ Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
 +#endif
 +
  /* Query timers: */
- extern ktime_t hrtimer_get_remaining(const struct hrtimer *timer);
+ extern ktime_t __hrtimer_get_remaining(const struct hrtimer *timer, bool adjust);
  
-@@ -412,7 +422,7 @@ static inline int hrtimer_is_queued(stru
+@@ -440,7 +450,7 @@ static inline int hrtimer_is_queued(stru
   * Helper function to check, whether the timer is running the callback
   * function
   */
@@ -86,7 +86,7 @@ Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  /*
   * enqueue_hrtimer - internal function to (re)start a timer
   *
-@@ -1076,7 +1102,7 @@ int hrtimer_cancel(struct hrtimer *timer
+@@ -1083,7 +1109,7 @@ int hrtimer_cancel(struct hrtimer *timer
  
  		if (ret >= 0)
  			return ret;
@@ -95,7 +95,7 @@ Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  	}
  }
  EXPORT_SYMBOL_GPL(hrtimer_cancel);
-@@ -1455,6 +1481,8 @@ void hrtimer_run_queues(void)
+@@ -1474,6 +1500,8 @@ void hrtimer_run_queues(void)
  	now = hrtimer_update_base(cpu_base);
  	__hrtimer_run_queues(cpu_base, now);
  	raw_spin_unlock(&cpu_base->lock);
@@ -104,7 +104,7 @@ Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  }
  
  /*
-@@ -1614,6 +1642,9 @@ static void init_hrtimers_cpu(int cpu)
+@@ -1633,6 +1661,9 @@ static void init_hrtimers_cpu(int cpu)
  
  	cpu_base->cpu = cpu;
  	hrtimer_init_hres(cpu_base);
@@ -116,7 +116,7 @@ Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  #ifdef CONFIG_HOTPLUG_CPU
 --- a/kernel/time/itimer.c
 +++ b/kernel/time/itimer.c
-@@ -213,6 +213,7 @@ int do_setitimer(int which, struct itime
+@@ -213,6 +213,7 @@ again:
  		/* We are sharing ->siglock with it_real_fn() */
  		if (hrtimer_try_to_cancel(timer) < 0) {
  			spin_unlock_irq(&tsk->sighand->siglock);
@@ -147,7 +147,7 @@ Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  /* Set a POSIX.1b interval timer. */
  /* timr->it_lock is taken. */
  static int
-@@ -905,6 +919,7 @@ SYSCALL_DEFINE4(timer_settime, timer_t,
+@@ -905,6 +919,7 @@ retry:
  	if (!timr)
  		return -EINVAL;
  
@@ -155,7 +155,7 @@ Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  	kc = clockid_to_kclock(timr->it_clock);
  	if (WARN_ON_ONCE(!kc || !kc->timer_set))
  		error = -EINVAL;
-@@ -913,9 +928,12 @@ SYSCALL_DEFINE4(timer_settime, timer_t,
+@@ -913,9 +928,12 @@ retry:
  
  	unlock_timer(timr, flag);
  	if (error == TIMER_RETRY) {
@@ -168,7 +168,7 @@ Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  
  	if (old_setting && !error &&
  	    copy_to_user(old_setting, &old_spec, sizeof (old_spec)))
-@@ -953,10 +971,15 @@ SYSCALL_DEFINE1(timer_delete, timer_t, t
+@@ -953,10 +971,15 @@ retry_delete:
  	if (!timer)
  		return -EINVAL;
  
diff --git a/debian/patches/features/all/rt/latency-hist.patch b/debian/patches/features/all/rt/latency-hist.patch
index 63fc4cbeff9a..ff53bb026c19 100644
--- a/debian/patches/features/all/rt/latency-hist.patch
+++ b/debian/patches/features/all/rt/latency-hist.patch
@@ -217,18 +217,18 @@ Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
 +These data are also reset when the wakeup histogram is reset.
 --- a/include/linux/hrtimer.h
 +++ b/include/linux/hrtimer.h
-@@ -87,6 +87,7 @@ enum hrtimer_restart {
-  * @function:	timer expiry callback function
+@@ -88,6 +88,7 @@ enum hrtimer_restart {
   * @base:	pointer to the timer base (per cpu and per clock)
   * @state:	state information (See bit values above)
+  * @is_rel:	Set if the timer was armed relative
 + * @praecox:	timer expiry time if expired at the time of programming
-  * @start_pid: timer statistics field to store the pid of the task which
+  * @start_pid:  timer statistics field to store the pid of the task which
   *		started the timer
   * @start_site:	timer statistics field to store the site where the timer
-@@ -102,6 +103,9 @@ struct hrtimer {
- 	enum hrtimer_restart		(*function)(struct hrtimer *);
+@@ -104,6 +105,9 @@ struct hrtimer {
  	struct hrtimer_clock_base	*base;
- 	unsigned long			state;
+ 	u8				state;
+ 	u8				is_rel;
 +#ifdef CONFIG_MISSED_TIMER_OFFSETS_HIST
 +	ktime_t				praecox;
 +#endif
@@ -237,7 +237,7 @@ Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  	void				*start_site;
 --- a/include/linux/sched.h
 +++ b/include/linux/sched.h
-@@ -1796,6 +1796,12 @@ struct task_struct {
+@@ -1797,6 +1797,12 @@ struct task_struct {
  	unsigned long trace;
  	/* bitmask and counter of trace recursion */
  	unsigned long trace_recursion;
@@ -367,7 +367,7 @@ Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  
  #include "tick-internal.h"
  
-@@ -994,7 +995,16 @@ void hrtimer_start_range_ns(struct hrtim
+@@ -1001,7 +1002,16 @@ void hrtimer_start_range_ns(struct hrtim
  	new_base = switch_hrtimer_base(timer, base, mode & HRTIMER_MODE_PINNED);
  
  	timer_stats_hrtimer_set_start_info(timer);
@@ -384,7 +384,7 @@ Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  	leftmost = enqueue_hrtimer(timer, new_base);
  	if (!leftmost)
  		goto unlock;
-@@ -1256,6 +1266,8 @@ static void __run_hrtimer(struct hrtimer
+@@ -1275,6 +1285,8 @@ static void __run_hrtimer(struct hrtimer
  	cpu_base->running = NULL;
  }
  
@@ -393,7 +393,7 @@ Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  static void __hrtimer_run_queues(struct hrtimer_cpu_base *cpu_base, ktime_t now)
  {
  	struct hrtimer_clock_base *base = cpu_base->clock_base;
-@@ -1275,6 +1287,15 @@ static void __hrtimer_run_queues(struct
+@@ -1294,6 +1306,15 @@ static void __hrtimer_run_queues(struct
  
  			timer = container_of(node, struct hrtimer, node);
  
@@ -1792,7 +1792,7 @@ Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  	if (!preempt_trace() && irq_trace())
  		stop_critical_timing(CALLER_ADDR0, caller_addr);
  }
-@@ -490,6 +498,7 @@ EXPORT_SYMBOL(trace_hardirqs_on_caller);
+@@ -490,6 +498,7 @@ __visible void trace_hardirqs_off_caller
  {
  	if (!preempt_trace() && irq_trace())
  		start_critical_timing(CALLER_ADDR0, caller_addr);
diff --git a/debian/patches/features/all/rt/printk-rt-aware.patch b/debian/patches/features/all/rt/printk-rt-aware.patch
index ff8008e64590..994d0cd78642 100644
--- a/debian/patches/features/all/rt/printk-rt-aware.patch
+++ b/debian/patches/features/all/rt/printk-rt-aware.patch
@@ -13,7 +13,7 @@ Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
 
 --- a/kernel/printk/printk.c
 +++ b/kernel/printk/printk.c
-@@ -1502,6 +1502,7 @@ static void call_console_drivers(int lev
+@@ -1503,6 +1503,7 @@ static void call_console_drivers(int lev
  	if (!console_drivers)
  		return;
  
@@ -21,7 +21,7 @@ Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  	for_each_console(con) {
  		if (exclusive_console && con != exclusive_console)
  			continue;
-@@ -1517,6 +1518,7 @@ static void call_console_drivers(int lev
+@@ -1518,6 +1519,7 @@ static void call_console_drivers(int lev
  		else
  			con->write(con, text, len);
  	}
@@ -29,7 +29,7 @@ Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  }
  
  /*
-@@ -1577,6 +1579,15 @@ static inline int can_use_console(unsign
+@@ -1578,6 +1580,15 @@ static inline int can_use_console(unsign
  static int console_trylock_for_printk(void)
  {
  	unsigned int cpu = smp_processor_id();
@@ -45,7 +45,7 @@ Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  
  	if (!console_trylock())
  		return 0;
-@@ -1879,8 +1890,7 @@ asmlinkage int vprintk_emit(int facility
+@@ -1880,8 +1891,7 @@ asmlinkage int vprintk_emit(int facility
  		 * console_sem which would prevent anyone from printing to
  		 * console
  		 */
@@ -55,7 +55,7 @@ Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  		/*
  		 * Try to acquire and then immediately release the console
  		 * semaphore.  The release will print out buffers and wake up
-@@ -1888,7 +1898,7 @@ asmlinkage int vprintk_emit(int facility
+@@ -1889,7 +1899,7 @@ asmlinkage int vprintk_emit(int facility
  		 */
  		if (console_trylock_for_printk())
  			console_unlock();
@@ -64,7 +64,7 @@ Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  		lockdep_on();
  	}
  
-@@ -2248,11 +2258,16 @@ static void console_cont_flush(char *tex
+@@ -2249,11 +2259,16 @@ static void console_cont_flush(char *tex
  		goto out;
  
  	len = cont_print_text(text, size);
@@ -81,7 +81,7 @@ Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  	return;
  out:
  	raw_spin_unlock_irqrestore(&logbuf_lock, flags);
-@@ -2351,12 +2366,17 @@ void console_unlock(void)
+@@ -2363,6 +2378,10 @@ skip:
  		console_idx = log_next(console_idx);
  		console_seq++;
  		console_prev = msg->flags;
@@ -92,9 +92,10 @@ Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
  		raw_spin_unlock(&logbuf_lock);
  
  		stop_critical_timings();	/* don't trace print latency */
- 		call_console_drivers(level, ext_text, ext_len, text, len);
- 		start_critical_timings();
- 		local_irq_restore(flags);
+@@ -2372,6 +2391,7 @@ skip:
+ 
+ 		if (do_cond_resched)
+ 			cond_resched();
 +#endif
  	}
  	console_locked = 0;
diff --git a/debian/patches/series b/debian/patches/series
index 379f50e2336c..6d47798f4cf7 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -43,7 +43,6 @@ bugfix/x86/viafb-autoload-on-olpc-xo1.5-only.patch
 
 # Arch bug fixes
 bugfix/x86/drm-i915-shut-up-gen8-sde-irq-dmesg-noise.patch
-bugfix/arm/crypto-sun4i-ss-add-missing-statesize.patch
 bugfix/x86/drm-vmwgfx-fix-a-width-pitch-mismatch-on-framebuffer.patch
 bugfix/mips/mips-math-emu-correctly-handle-nop-emulation.patch
 
@@ -114,8 +113,6 @@ features/all/grsecurity/grkernsec_perf_harden.patch
 bugfix/all/usbvision-fix-overflow-of-interfaces-array.patch
 bugfix/all/media-usbvision-fix-crash-on-detecting-device-with-i.patch
 bugfix/all/ptrace-being-capable-wrt-a-process-requires-mapped-uids-gids.patch
-bugfix/all/usb-serial-visor-fix-crash-on-detecting-device-without-write_urbs.patch
-bugfix/all/tty-fix-unsafe-ldisc-reference-via-ioctl-tiocgetd.patch
 bugfix/all/pipe-limit-the-per-user-amount-of-pages-allocated-in.patch
 bugfix/all/iw_cxgb3-Fix-incorrectly-returning-error-on-success.patch
 bugfix/all/fs-hugetlbfs-inode.c-fix-bugs-in-hugetlb_vmtruncate_.patch
@@ -123,7 +120,6 @@ bugfix/all/af_unix-guard-against-other-sk-in-unix_dgram_sendmsg.patch
 bugfix/all/revert-workqueue-make-sure-delayed-work-run-in-local-cpu.patch
 bugfix/all/af_unix-don-t-set-err-in-unix_stream_read_generic-unless-there-was-an-error.patch
 bugfix/all/bpf-fix-branch-offset-adjustment-on-backjumps-after-.patch
-bugfix/all/alsa-usb-audio-avoid-freeing-umidi-object-twice.patch
 bugfix/x86/x86-mm-page-align-the-_end-symbol-to-avoid-pfn-conve.patch
 bugfix/x86/x86-mm-pat-ensure-cpa-pfn-only-contains-page-frame-n.patch
 bugfix/x86/x86-efi-map-ram-into-the-identity-page-table-for-mix.patch