12 files changed, 531 insertions, 41 deletions

diff --git a/lib/Kconfig.debug b/lib/Kconfig.debug
index 51c6bf0d93c6..c40c7b734cd1 100644
--- a/lib/Kconfig.debug
+++ b/lib/Kconfig.debug
@@ -800,6 +800,30 @@ config SOFTLOCKUP_DETECTOR
           chance to run.  The current stack trace is displayed upon
           detection and the system will stay locked up.
 
+config BOOTPARAM_SOFTLOCKUP_PANIC
+        bool "Panic (Reboot) On Soft Lockups"
+        depends on SOFTLOCKUP_DETECTOR
+        help
+          Say Y here to enable the kernel to panic on "soft lockups",
+          which are bugs that cause the kernel to loop in kernel
+          mode for more than 20 seconds (configurable using the watchdog_thresh
+          sysctl), without giving other tasks a chance to run.
+
+          The panic can be used in combination with panic_timeout,
+          to cause the system to reboot automatically after a
+          lockup has been detected. This feature is useful for
+          high-availability systems that have uptime guarantees and
+          where a lockup must be resolved ASAP.
+
+          Say N if unsure.
+
+config BOOTPARAM_SOFTLOCKUP_PANIC_VALUE
+        int
+        depends on SOFTLOCKUP_DETECTOR
+        range 0 1
+        default 0 if !BOOTPARAM_SOFTLOCKUP_PANIC
+        default 1 if BOOTPARAM_SOFTLOCKUP_PANIC
+
 config HARDLOCKUP_DETECTOR_PERF
         bool
         select SOFTLOCKUP_DETECTOR
@@ -849,30 +873,6 @@ config BOOTPARAM_HARDLOCKUP_PANIC_VALUE
         default 0 if !BOOTPARAM_HARDLOCKUP_PANIC
         default 1 if BOOTPARAM_HARDLOCKUP_PANIC
 
-config BOOTPARAM_SOFTLOCKUP_PANIC
-        bool "Panic (Reboot) On Soft Lockups"
-        depends on SOFTLOCKUP_DETECTOR
-        help
-          Say Y here to enable the kernel to panic on "soft lockups",
-          which are bugs that cause the kernel to loop in kernel
-          mode for more than 20 seconds (configurable using the watchdog_thresh
-          sysctl), without giving other tasks a chance to run.
-
-          The panic can be used in combination with panic_timeout,
-          to cause the system to reboot automatically after a
-          lockup has been detected. This feature is useful for
-          high-availability systems that have uptime guarantees and
-          where a lockup must be resolved ASAP.
-
-          Say N if unsure.
-
-config BOOTPARAM_SOFTLOCKUP_PANIC_VALUE
-        int
-        depends on SOFTLOCKUP_DETECTOR
-        range 0 1
-        default 0 if !BOOTPARAM_SOFTLOCKUP_PANIC
-        default 1 if BOOTPARAM_SOFTLOCKUP_PANIC
-
 config DETECT_HUNG_TASK
         bool "Detect Hung Tasks"
         depends on DEBUG_KERNEL
diff --git a/lib/Kconfig.ubsan b/lib/Kconfig.ubsan
index a669c193b878..19d42ea75ec2 100644
--- a/lib/Kconfig.ubsan
+++ b/lib/Kconfig.ubsan
@@ -46,3 +46,10 @@ config UBSAN_NULL
         help
           This option enables detection of memory accesses via a
           null pointer.
+
+config TEST_UBSAN
+        tristate "Module for testing for undefined behavior detection"
+        depends on m && UBSAN
+        help
+          This is a test module for UBSAN.
+          It triggers various undefined behavior, and detect it.
diff --git a/lib/Makefile b/lib/Makefile
index 8fc0d3a9b34f..ce20696d5a92 100644
--- a/lib/Makefile
+++ b/lib/Makefile
@@ -53,6 +53,9 @@ obj-$(CONFIG_TEST_FIRMWARE) += test_firmware.o
 obj-$(CONFIG_TEST_SYSCTL) += test_sysctl.o
 obj-$(CONFIG_TEST_HASH) += test_hash.o test_siphash.o
 obj-$(CONFIG_TEST_KASAN) += test_kasan.o
+CFLAGS_test_kasan.o += -fno-builtin
+obj-$(CONFIG_TEST_UBSAN) += test_ubsan.o
+UBSAN_SANITIZE_test_ubsan.o := y
 obj-$(CONFIG_TEST_KSTRTOX) += test-kstrtox.o
 obj-$(CONFIG_TEST_LIST_SORT) += test_list_sort.o
 obj-$(CONFIG_TEST_LKM) += test_module.o
diff --git a/lib/list_debug.c b/lib/list_debug.c
index a34db8d27667..5d5424b51b74 100644
--- a/lib/list_debug.c
+++ b/lib/list_debug.c
@@ -21,13 +21,13 @@ bool __list_add_valid(struct list_head *new, struct list_head *prev,
                       struct list_head *next)
 {
         if (CHECK_DATA_CORRUPTION(next->prev != prev,
-                        "list_add corruption. next->prev should be prev (%p), but was %p. (next=%p).\n",
+                        "list_add corruption. next->prev should be prev (%px), but was %px. (next=%px).\n",
                         prev, next->prev, next) ||
             CHECK_DATA_CORRUPTION(prev->next != next,
-                        "list_add corruption. prev->next should be next (%p), but was %p. (prev=%p).\n",
+                        "list_add corruption. prev->next should be next (%px), but was %px. (prev=%px).\n",
                         next, prev->next, prev) ||
             CHECK_DATA_CORRUPTION(new == prev || new == next,
-                        "list_add double add: new=%p, prev=%p, next=%p.\n",
+                        "list_add double add: new=%px, prev=%px, next=%px.\n",
                         new, prev, next))
                 return false;
 
@@ -43,16 +43,16 @@ bool __list_del_entry_valid(struct list_head *entry)
         next = entry->next;
 
         if (CHECK_DATA_CORRUPTION(next == LIST_POISON1,
-                        "list_del corruption, %p->next is LIST_POISON1 (%p)\n",
+                        "list_del corruption, %px->next is LIST_POISON1 (%px)\n",
                         entry, LIST_POISON1) ||
             CHECK_DATA_CORRUPTION(prev == LIST_POISON2,
-                        "list_del corruption, %p->prev is LIST_POISON2 (%p)\n",
+                        "list_del corruption, %px->prev is LIST_POISON2 (%px)\n",
                         entry, LIST_POISON2) ||
             CHECK_DATA_CORRUPTION(prev->next != entry,
-                        "list_del corruption. prev->next should be %p, but was %p\n",
+                        "list_del corruption. prev->next should be %px, but was %px\n",
                         entry, prev->next) ||
             CHECK_DATA_CORRUPTION(next->prev != entry,
-                        "list_del corruption. next->prev should be %p, but was %p\n",
+                        "list_del corruption. next->prev should be %px, but was %px\n",
                         entry, next->prev))
                 return false;
 
diff --git a/lib/lockref.c b/lib/lockref.c
index 47169ed7e964..3d468b53d4c9 100644
--- a/lib/lockref.c
+++ b/lib/lockref.c
@@ -81,6 +81,34 @@ int lockref_get_not_zero(struct lockref *lockref)
 EXPORT_SYMBOL(lockref_get_not_zero);
 
 /**
+ * lockref_put_not_zero - Decrements count unless count <= 1 before decrement
+ * @lockref: pointer to lockref structure
+ * Return: 1 if count updated successfully or 0 if count would become zero
+ */
+int lockref_put_not_zero(struct lockref *lockref)
+{
+        int retval;
+
+        CMPXCHG_LOOP(
+                new.count--;
+                if (old.count <= 1)
+                        return 0;
+        ,
+                return 1;
+        );
+
+        spin_lock(&lockref->lock);
+        retval = 0;
+        if (lockref->count > 1) {
+                lockref->count--;
+                retval = 1;
+        }
+        spin_unlock(&lockref->lock);
+        return retval;
+}
+EXPORT_SYMBOL(lockref_put_not_zero);
+
+/**
  * lockref_get_or_lock - Increments count unless the count is 0 or dead
  * @lockref: pointer to lockref structure
  * Return: 1 if count updated successfully or 0 if count was zero
diff --git a/lib/radix-tree.c b/lib/radix-tree.c
index 8e00138d593f..da9e10c827df 100644
--- a/lib/radix-tree.c
+++ b/lib/radix-tree.c
@@ -146,7 +146,7 @@ static unsigned int radix_tree_descend(const struct radix_tree_node *parent,
 
 static inline gfp_t root_gfp_mask(const struct radix_tree_root *root)
 {
-        return root->gfp_mask & __GFP_BITS_MASK;
+        return root->gfp_mask & (__GFP_BITS_MASK & ~GFP_ZONEMASK);
 }
 
 static inline void tag_set(struct radix_tree_node *node, unsigned int tag,
@@ -2285,6 +2285,7 @@ void __init radix_tree_init(void)
         int ret;
 
         BUILD_BUG_ON(RADIX_TREE_MAX_TAGS + __GFP_BITS_SHIFT > 32);
+        BUILD_BUG_ON(ROOT_IS_IDR & ~GFP_ZONEMASK);
         radix_tree_node_cachep = kmem_cache_create("radix_tree_node",
                         sizeof(struct radix_tree_node), 0,
                         SLAB_PANIC | SLAB_RECLAIM_ACCOUNT,
diff --git a/lib/sha256.c b/lib/sha256.c
new file mode 100644
index 000000000000..4400c832e2aa
--- /dev/null
+++ b/lib/sha256.c
@@ -0,0 +1,283 @@
+/*
+ * SHA-256, as specified in
+ * http://csrc.nist.gov/groups/STM/cavp/documents/shs/sha256-384-512.pdf
+ *
+ * SHA-256 code by Jean-Luc Cooke <jlcooke@certainkey.com>.
+ *
+ * Copyright (c) Jean-Luc Cooke <jlcooke@certainkey.com>
+ * Copyright (c) Andrew McDonald <andrew@mcdonald.org.uk>
+ * Copyright (c) 2002 James Morris <jmorris@intercode.com.au>
+ * Copyright (c) 2014 Red Hat Inc.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the Free
+ * Software Foundation; either version 2 of the License, or (at your option)
+ * any later version.
+ */
+
+#include <linux/bitops.h>
+#include <linux/sha256.h>
+#include <linux/string.h>
+#include <asm/byteorder.h>
+
+static inline u32 Ch(u32 x, u32 y, u32 z)
+{
+        return z ^ (x & (y ^ z));
+}
+
+static inline u32 Maj(u32 x, u32 y, u32 z)
+{
+        return (x & y) | (z & (x | y));
+}
+
+#define e0(x)       (ror32(x, 2) ^ ror32(x, 13) ^ ror32(x, 22))
+#define e1(x)       (ror32(x, 6) ^ ror32(x, 11) ^ ror32(x, 25))
+#define s0(x)       (ror32(x, 7) ^ ror32(x, 18) ^ (x >> 3))
+#define s1(x)       (ror32(x, 17) ^ ror32(x, 19) ^ (x >> 10))
+
+static inline void LOAD_OP(int I, u32 *W, const u8 *input)
+{
+        W[I] = __be32_to_cpu(((__be32 *)(input))[I]);
+}
+
+static inline void BLEND_OP(int I, u32 *W)
+{
+        W[I] = s1(W[I-2]) + W[I-7] + s0(W[I-15]) + W[I-16];
+}
+
+static void sha256_transform(u32 *state, const u8 *input)
+{
+        u32 a, b, c, d, e, f, g, h, t1, t2;
+        u32 W[64];
+        int i;
+
+        /* load the input */
+        for (i = 0; i < 16; i++)
+                LOAD_OP(i, W, input);
+
+        /* now blend */
+        for (i = 16; i < 64; i++)
+                BLEND_OP(i, W);
+
+        /* load the state into our registers */
+        a = state[0];  b = state[1];  c = state[2];  d = state[3];
+        e = state[4];  f = state[5];  g = state[6];  h = state[7];
+
+        /* now iterate */
+        t1 = h + e1(e) + Ch(e, f, g) + 0x428a2f98 + W[0];
+        t2 = e0(a) + Maj(a, b, c);    d += t1;    h = t1 + t2;
+        t1 = g + e1(d) + Ch(d, e, f) + 0x71374491 + W[1];
+        t2 = e0(h) + Maj(h, a, b);    c += t1;    g = t1 + t2;
+        t1 = f + e1(c) + Ch(c, d, e) + 0xb5c0fbcf + W[2];
+        t2 = e0(g) + Maj(g, h, a);    b += t1;    f = t1 + t2;
+        t1 = e + e1(b) + Ch(b, c, d) + 0xe9b5dba5 + W[3];
+        t2 = e0(f) + Maj(f, g, h);    a += t1;    e = t1 + t2;
+        t1 = d + e1(a) + Ch(a, b, c) + 0x3956c25b + W[4];
+        t2 = e0(e) + Maj(e, f, g);    h += t1;    d = t1 + t2;
+        t1 = c + e1(h) + Ch(h, a, b) + 0x59f111f1 + W[5];
+        t2 = e0(d) + Maj(d, e, f);    g += t1;    c = t1 + t2;
+        t1 = b + e1(g) + Ch(g, h, a) + 0x923f82a4 + W[6];
+        t2 = e0(c) + Maj(c, d, e);    f += t1;    b = t1 + t2;
+        t1 = a + e1(f) + Ch(f, g, h) + 0xab1c5ed5 + W[7];
+        t2 = e0(b) + Maj(b, c, d);    e += t1;    a = t1 + t2;
+
+        t1 = h + e1(e) + Ch(e, f, g) + 0xd807aa98 + W[8];
+        t2 = e0(a) + Maj(a, b, c);    d += t1;    h = t1 + t2;
+        t1 = g + e1(d) + Ch(d, e, f) + 0x12835b01 + W[9];
+        t2 = e0(h) + Maj(h, a, b);    c += t1;    g = t1 + t2;
+        t1 = f + e1(c) + Ch(c, d, e) + 0x243185be + W[10];
+        t2 = e0(g) + Maj(g, h, a);    b += t1;    f = t1 + t2;
+        t1 = e + e1(b) + Ch(b, c, d) + 0x550c7dc3 + W[11];
+        t2 = e0(f) + Maj(f, g, h);    a += t1;    e = t1 + t2;
+        t1 = d + e1(a) + Ch(a, b, c) + 0x72be5d74 + W[12];
+        t2 = e0(e) + Maj(e, f, g);    h += t1;    d = t1 + t2;
+        t1 = c + e1(h) + Ch(h, a, b) + 0x80deb1fe + W[13];
+        t2 = e0(d) + Maj(d, e, f);    g += t1;    c = t1 + t2;
+        t1 = b + e1(g) + Ch(g, h, a) + 0x9bdc06a7 + W[14];
+        t2 = e0(c) + Maj(c, d, e);    f += t1;    b = t1 + t2;
+        t1 = a + e1(f) + Ch(f, g, h) + 0xc19bf174 + W[15];
+        t2 = e0(b) + Maj(b, c, d);    e += t1;    a = t1+t2;
+
+        t1 = h + e1(e) + Ch(e, f, g) + 0xe49b69c1 + W[16];
+        t2 = e0(a) + Maj(a, b, c);    d += t1;    h = t1+t2;
+        t1 = g + e1(d) + Ch(d, e, f) + 0xefbe4786 + W[17];
+        t2 = e0(h) + Maj(h, a, b);    c += t1;    g = t1+t2;
+        t1 = f + e1(c) + Ch(c, d, e) + 0x0fc19dc6 + W[18];
+        t2 = e0(g) + Maj(g, h, a);    b += t1;    f = t1+t2;
+        t1 = e + e1(b) + Ch(b, c, d) + 0x240ca1cc + W[19];
+        t2 = e0(f) + Maj(f, g, h);    a += t1;    e = t1+t2;
+        t1 = d + e1(a) + Ch(a, b, c) + 0x2de92c6f + W[20];
+        t2 = e0(e) + Maj(e, f, g);    h += t1;    d = t1+t2;
+        t1 = c + e1(h) + Ch(h, a, b) + 0x4a7484aa + W[21];
+        t2 = e0(d) + Maj(d, e, f);    g += t1;    c = t1+t2;
+        t1 = b + e1(g) + Ch(g, h, a) + 0x5cb0a9dc + W[22];
+        t2 = e0(c) + Maj(c, d, e);    f += t1;    b = t1+t2;
+        t1 = a + e1(f) + Ch(f, g, h) + 0x76f988da + W[23];
+        t2 = e0(b) + Maj(b, c, d);    e += t1;    a = t1+t2;
+
+        t1 = h + e1(e) + Ch(e, f, g) + 0x983e5152 + W[24];
+        t2 = e0(a) + Maj(a, b, c);    d += t1;    h = t1+t2;
+        t1 = g + e1(d) + Ch(d, e, f) + 0xa831c66d + W[25];
+        t2 = e0(h) + Maj(h, a, b);    c += t1;    g = t1+t2;
+        t1 = f + e1(c) + Ch(c, d, e) + 0xb00327c8 + W[26];
+        t2 = e0(g) + Maj(g, h, a);    b += t1;    f = t1+t2;
+        t1 = e + e1(b) + Ch(b, c, d) + 0xbf597fc7 + W[27];
+        t2 = e0(f) + Maj(f, g, h);    a += t1;    e = t1+t2;
+        t1 = d + e1(a) + Ch(a, b, c) + 0xc6e00bf3 + W[28];
+        t2 = e0(e) + Maj(e, f, g);    h += t1;    d = t1+t2;
+        t1 = c + e1(h) + Ch(h, a, b) + 0xd5a79147 + W[29];
+        t2 = e0(d) + Maj(d, e, f);    g += t1;    c = t1+t2;
+        t1 = b + e1(g) + Ch(g, h, a) + 0x06ca6351 + W[30];
+        t2 = e0(c) + Maj(c, d, e);    f += t1;    b = t1+t2;
+        t1 = a + e1(f) + Ch(f, g, h) + 0x14292967 + W[31];
+        t2 = e0(b) + Maj(b, c, d);    e += t1;    a = t1+t2;
+
+        t1 = h + e1(e) + Ch(e, f, g) + 0x27b70a85 + W[32];
+        t2 = e0(a) + Maj(a, b, c);    d += t1;    h = t1+t2;
+        t1 = g + e1(d) + Ch(d, e, f) + 0x2e1b2138 + W[33];
+        t2 = e0(h) + Maj(h, a, b);    c += t1;    g = t1+t2;
+        t1 = f + e1(c) + Ch(c, d, e) + 0x4d2c6dfc + W[34];
+        t2 = e0(g) + Maj(g, h, a);    b += t1;    f = t1+t2;
+        t1 = e + e1(b) + Ch(b, c, d) + 0x53380d13 + W[35];
+        t2 = e0(f) + Maj(f, g, h);    a += t1;    e = t1+t2;
+        t1 = d + e1(a) + Ch(a, b, c) + 0x650a7354 + W[36];
+        t2 = e0(e) + Maj(e, f, g);    h += t1;    d = t1+t2;
+        t1 = c + e1(h) + Ch(h, a, b) + 0x766a0abb + W[37];
+        t2 = e0(d) + Maj(d, e, f);    g += t1;    c = t1+t2;
+        t1 = b + e1(g) + Ch(g, h, a) + 0x81c2c92e + W[38];
+        t2 = e0(c) + Maj(c, d, e);    f += t1;    b = t1+t2;
+        t1 = a + e1(f) + Ch(f, g, h) + 0x92722c85 + W[39];
+        t2 = e0(b) + Maj(b, c, d);    e += t1;    a = t1+t2;
+
+        t1 = h + e1(e) + Ch(e, f, g) + 0xa2bfe8a1 + W[40];
+        t2 = e0(a) + Maj(a, b, c);    d += t1;    h = t1+t2;
+        t1 = g + e1(d) + Ch(d, e, f) + 0xa81a664b + W[41];
+        t2 = e0(h) + Maj(h, a, b);    c += t1;    g = t1+t2;
+        t1 = f + e1(c) + Ch(c, d, e) + 0xc24b8b70 + W[42];
+        t2 = e0(g) + Maj(g, h, a);    b += t1;    f = t1+t2;
+        t1 = e + e1(b) + Ch(b, c, d) + 0xc76c51a3 + W[43];
+        t2 = e0(f) + Maj(f, g, h);    a += t1;    e = t1+t2;
+        t1 = d + e1(a) + Ch(a, b, c) + 0xd192e819 + W[44];
+        t2 = e0(e) + Maj(e, f, g);    h += t1;    d = t1+t2;
+        t1 = c + e1(h) + Ch(h, a, b) + 0xd6990624 + W[45];
+        t2 = e0(d) + Maj(d, e, f);    g += t1;    c = t1+t2;
+        t1 = b + e1(g) + Ch(g, h, a) + 0xf40e3585 + W[46];
+        t2 = e0(c) + Maj(c, d, e);    f += t1;    b = t1+t2;
+        t1 = a + e1(f) + Ch(f, g, h) + 0x106aa070 + W[47];
+        t2 = e0(b) + Maj(b, c, d);    e += t1;    a = t1+t2;
+
+        t1 = h + e1(e) + Ch(e, f, g) + 0x19a4c116 + W[48];
+        t2 = e0(a) + Maj(a, b, c);    d += t1;    h = t1+t2;
+        t1 = g + e1(d) + Ch(d, e, f) + 0x1e376c08 + W[49];
+        t2 = e0(h) + Maj(h, a, b);    c += t1;    g = t1+t2;
+        t1 = f + e1(c) + Ch(c, d, e) + 0x2748774c + W[50];
+        t2 = e0(g) + Maj(g, h, a);    b += t1;    f = t1+t2;
+        t1 = e + e1(b) + Ch(b, c, d) + 0x34b0bcb5 + W[51];
+        t2 = e0(f) + Maj(f, g, h);    a += t1;    e = t1+t2;
+        t1 = d + e1(a) + Ch(a, b, c) + 0x391c0cb3 + W[52];
+        t2 = e0(e) + Maj(e, f, g);    h += t1;    d = t1+t2;
+        t1 = c + e1(h) + Ch(h, a, b) + 0x4ed8aa4a + W[53];
+        t2 = e0(d) + Maj(d, e, f);    g += t1;    c = t1+t2;
+        t1 = b + e1(g) + Ch(g, h, a) + 0x5b9cca4f + W[54];
+        t2 = e0(c) + Maj(c, d, e);    f += t1;    b = t1+t2;
+        t1 = a + e1(f) + Ch(f, g, h) + 0x682e6ff3 + W[55];
+        t2 = e0(b) + Maj(b, c, d);    e += t1;    a = t1+t2;
+
+        t1 = h + e1(e) + Ch(e, f, g) + 0x748f82ee + W[56];
+        t2 = e0(a) + Maj(a, b, c);    d += t1;    h = t1+t2;
+        t1 = g + e1(d) + Ch(d, e, f) + 0x78a5636f + W[57];
+        t2 = e0(h) + Maj(h, a, b);    c += t1;    g = t1+t2;
+        t1 = f + e1(c) + Ch(c, d, e) + 0x84c87814 + W[58];
+        t2 = e0(g) + Maj(g, h, a);    b += t1;    f = t1+t2;
+        t1 = e + e1(b) + Ch(b, c, d) + 0x8cc70208 + W[59];
+        t2 = e0(f) + Maj(f, g, h);    a += t1;    e = t1+t2;
+        t1 = d + e1(a) + Ch(a, b, c) + 0x90befffa + W[60];
+        t2 = e0(e) + Maj(e, f, g);    h += t1;    d = t1+t2;
+        t1 = c + e1(h) + Ch(h, a, b) + 0xa4506ceb + W[61];
+        t2 = e0(d) + Maj(d, e, f);    g += t1;    c = t1+t2;
+        t1 = b + e1(g) + Ch(g, h, a) + 0xbef9a3f7 + W[62];
+        t2 = e0(c) + Maj(c, d, e);    f += t1;    b = t1+t2;
+        t1 = a + e1(f) + Ch(f, g, h) + 0xc67178f2 + W[63];
+        t2 = e0(b) + Maj(b, c, d);    e += t1;    a = t1+t2;
+
+        state[0] += a; state[1] += b; state[2] += c; state[3] += d;
+        state[4] += e; state[5] += f; state[6] += g; state[7] += h;
+
+        /* clear any sensitive info... */
+        a = b = c = d = e = f = g = h = t1 = t2 = 0;
+        memset(W, 0, 64 * sizeof(u32));
+}
+
+int sha256_init(struct sha256_state *sctx)
+{
+        sctx->state[0] = SHA256_H0;
+        sctx->state[1] = SHA256_H1;
+        sctx->state[2] = SHA256_H2;
+        sctx->state[3] = SHA256_H3;
+        sctx->state[4] = SHA256_H4;
+        sctx->state[5] = SHA256_H5;
+        sctx->state[6] = SHA256_H6;
+        sctx->state[7] = SHA256_H7;
+        sctx->count = 0;
+
+        return 0;
+}
+
+int sha256_update(struct sha256_state *sctx, const u8 *data, unsigned int len)
+{
+        unsigned int partial, done;
+        const u8 *src;
+
+        partial = sctx->count & 0x3f;
+        sctx->count += len;
+        done = 0;
+        src = data;
+
+        if ((partial + len) > 63) {
+                if (partial) {
+                        done = -partial;
+                        memcpy(sctx->buf + partial, data, done + 64);
+                        src = sctx->buf;
+                }
+
+                do {
+                        sha256_transform(sctx->state, src);
+                        done += 64;
+                        src = data + done;
+                } while (done + 63 < len);
+
+                partial = 0;
+        }
+        memcpy(sctx->buf + partial, src, len - done);
+
+        return 0;
+}
+
+int sha256_final(struct sha256_state *sctx, u8 *out)
+{
+        __be32 *dst = (__be32 *)out;
+        __be64 bits;
+        unsigned int index, pad_len;
+        int i;
+        static const u8 padding[64] = { 0x80, };
+
+        /* Save number of bits */
+        bits = cpu_to_be64(sctx->count << 3);
+
+        /* Pad out to 56 mod 64. */
+        index = sctx->count & 0x3f;
+        pad_len = (index < 56) ? (56 - index) : ((64+56) - index);
+        sha256_update(sctx, padding, pad_len);
+
+        /* Append length (before padding) */
+        sha256_update(sctx, (const u8 *)&bits, sizeof(bits));
+
+        /* Store state in digest */
+        for (i = 0; i < 8; i++)
+                dst[i] = cpu_to_be32(sctx->state[i]);
+
+        /* Zeroize sensitive information. */
+        memset(sctx, 0, sizeof(*sctx));
+
+        return 0;
+}
diff --git a/lib/swiotlb.c b/lib/swiotlb.c
index 47aeb04c1997..de7cc540450f 100644
--- a/lib/swiotlb.c
+++ b/lib/swiotlb.c
@@ -719,7 +719,7 @@ swiotlb_alloc_buffer(struct device *dev, size_t size, dma_addr_t *dma_handle,
                 goto out_warn;
 
         *dma_handle = __phys_to_dma(dev, phys_addr);
-        if (dma_coherent_ok(dev, *dma_handle, size))
+        if (!dma_coherent_ok(dev, *dma_handle, size))
                 goto out_unmap;
 
         memset(phys_to_virt(phys_addr), 0, size);
diff --git a/lib/test_bitmap.c b/lib/test_bitmap.c
index 413367cf569e..de16f7869fb1 100644
--- a/lib/test_bitmap.c
+++ b/lib/test_bitmap.c
@@ -296,15 +296,17 @@ static void __init test_bitmap_parselist(void)
         }
 }
 
+#define EXP_BYTES       (sizeof(exp) * 8)
+
 static void __init test_bitmap_arr32(void)
 {
-        unsigned int nbits, next_bit, len = sizeof(exp) * 8;
+        unsigned int nbits, next_bit;
         u32 arr[sizeof(exp) / 4];
-        DECLARE_BITMAP(bmap2, len);
+        DECLARE_BITMAP(bmap2, EXP_BYTES);
 
         memset(arr, 0xa5, sizeof(arr));
 
-        for (nbits = 0; nbits < len; ++nbits) {
+        for (nbits = 0; nbits < EXP_BYTES; ++nbits) {
                 bitmap_to_arr32(arr, exp, nbits);
                 bitmap_from_arr32(bmap2, arr, nbits);
                 expect_eq_bitmap(bmap2, exp, nbits);
@@ -316,7 +318,7 @@ static void __init test_bitmap_arr32(void)
                                 " tail is not safely cleared: %d\n",
                                 nbits, next_bit);
 
-                if (nbits < len - 32)
+                if (nbits < EXP_BYTES - 32)
                         expect_eq_uint(arr[DIV_ROUND_UP(nbits, 32)],
                                                                 0xa5a5a5a5);
         }
diff --git a/lib/test_kasan.c b/lib/test_kasan.c
index 98854a64b014..ec657105edbf 100644
--- a/lib/test_kasan.c
+++ b/lib/test_kasan.c
@@ -567,7 +567,15 @@ static noinline void __init kmem_cache_invalid_free(void)
                 return;
         }
 
+        /* Trigger invalid free, the object doesn't get freed */
         kmem_cache_free(cache, p + 1);
+
+        /*
+         * Properly free the object to prevent the "Objects remaining in
+         * test_cache on __kmem_cache_shutdown" BUG failure.
+         */
+        kmem_cache_free(cache, p);
+
         kmem_cache_destroy(cache);
 }
 
diff --git a/lib/test_ubsan.c b/lib/test_ubsan.c
new file mode 100644
index 000000000000..280f4979d00e
--- /dev/null
+++ b/lib/test_ubsan.c
@@ -0,0 +1,144 @@
+// SPDX-License-Identifier: GPL-2.0
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/module.h>
+
+typedef void(*test_ubsan_fp)(void);
+
+static void test_ubsan_add_overflow(void)
+{
+        volatile int val = INT_MAX;
+
+        val += 2;
+}
+
+static void test_ubsan_sub_overflow(void)
+{
+        volatile int val = INT_MIN;
+        volatile int val2 = 2;
+
+        val -= val2;
+}
+
+static void test_ubsan_mul_overflow(void)
+{
+        volatile int val = INT_MAX / 2;
+
+        val *= 3;
+}
+
+static void test_ubsan_negate_overflow(void)
+{
+        volatile int val = INT_MIN;
+
+        val = -val;
+}
+
+static void test_ubsan_divrem_overflow(void)
+{
+        volatile int val = 16;
+        volatile int val2 = 0;
+
+        val /= val2;
+}
+
+static void test_ubsan_vla_bound_not_positive(void)
+{
+        volatile int size = -1;
+        char buf[size];
+
+        (void)buf;
+}
+
+static void test_ubsan_shift_out_of_bounds(void)
+{
+        volatile int val = -1;
+        int val2 = 10;
+
+        val2 <<= val;
+}
+
+static void test_ubsan_out_of_bounds(void)
+{
+        volatile int i = 4, j = 5;
+        volatile int arr[i];
+
+        arr[j] = i;
+}
+
+static void test_ubsan_load_invalid_value(void)
+{
+        volatile char *dst, *src;
+        bool val, val2, *ptr;
+        char c = 4;
+
+        dst = (char *)&val;
+        src = &c;
+        *dst = *src;
+
+        ptr = &val2;
+        val2 = val;
+}
+
+static void test_ubsan_null_ptr_deref(void)
+{
+        volatile int *ptr = NULL;
+        int val;
+
+        val = *ptr;
+}
+
+static void test_ubsan_misaligned_access(void)
+{
+        volatile char arr[5] __aligned(4) = {1, 2, 3, 4, 5};
+        volatile int *ptr, val = 6;
+
+        ptr = (int *)(arr + 1);
+        *ptr = val;
+}
+
+static void test_ubsan_object_size_mismatch(void)
+{
+        /* "((aligned(8)))" helps this not into be misaligned for ptr-access. */
+        volatile int val __aligned(8) = 4;
+        volatile long long *ptr, val2;
+
+        ptr = (long long *)&val;
+        val2 = *ptr;
+}
+
+static const test_ubsan_fp test_ubsan_array[] = {
+        test_ubsan_add_overflow,
+        test_ubsan_sub_overflow,
+        test_ubsan_mul_overflow,
+        test_ubsan_negate_overflow,
+        test_ubsan_divrem_overflow,
+        test_ubsan_vla_bound_not_positive,
+        test_ubsan_shift_out_of_bounds,
+        test_ubsan_out_of_bounds,
+        test_ubsan_load_invalid_value,
+        //test_ubsan_null_ptr_deref, /* exclude it because there is a crash */
+        test_ubsan_misaligned_access,
+        test_ubsan_object_size_mismatch,
+};
+
+static int __init test_ubsan_init(void)
+{
+        unsigned int i;
+
+        for (i = 0; i < ARRAY_SIZE(test_ubsan_array); i++)
+                test_ubsan_array[i]();
+
+        (void)test_ubsan_null_ptr_deref; /* to avoid unsed-function warning */
+        return 0;
+}
+module_init(test_ubsan_init);
+
+static void __exit test_ubsan_exit(void)
+{
+        /* do nothing */
+}
+module_exit(test_ubsan_exit);
+
+MODULE_AUTHOR("Jinbum Park <jinb.park7@gmail.com>");
+MODULE_LICENSE("GPL v2");
diff --git a/lib/vsprintf.c b/lib/vsprintf.c
index d7a708f82559..30c0cb8cc9bc 100644
--- a/lib/vsprintf.c
+++ b/lib/vsprintf.c
@@ -336,7 +336,7 @@ char *put_dec(char *buf, unsigned long long n)
  *
  * If speed is not important, use snprintf(). It's easy to read the code.
  */
-int num_to_str(char *buf, int size, unsigned long long num)
+int num_to_str(char *buf, int size, unsigned long long num, unsigned int width)
 {
         /* put_dec requires 2-byte alignment of the buffer. */
         char tmp[sizeof(num) * 3] __aligned(2);
@@ -350,11 +350,21 @@ int num_to_str(char *buf, int size, unsigned long long num)
                 len = put_dec(tmp, num) - tmp;
         }
 
-        if (len > size)
+        if (len > size || width > size)
                 return 0;
+
+        if (width > len) {
+                width = width - len;
+                for (idx = 0; idx < width; idx++)
+                        buf[idx] = ' ';
+        } else {
+                width = 0;
+        }
+
         for (idx = 0; idx < len; ++idx)
-                buf[idx] = tmp[len - idx - 1];
-        return len;
+                buf[idx + width] = tmp[len - idx - 1];
+
+        return len + width;
 }
 
 #define SIGN    1               /* unsigned/signed, must be 1 */
@@ -2591,6 +2601,8 @@ int vbin_printf(u32 *bin_buf, size_t size, const char *fmt, va_list args)
                         case 's':
                         case 'F':
                         case 'f':
+                        case 'x':
+                        case 'K':
                                 save_arg(void *);
                                 break;
                         default:
@@ -2765,6 +2777,8 @@ int bstr_printf(char *buf, size_t size, const char *fmt, const u32 *bin_buf)
                         case 's':
                         case 'F':
                         case 'f':
+                        case 'x':
+                        case 'K':
                                 process = true;
                                 break;
                         default: