commit: 5a3c2c16a6d0eb0c726b98af9ed28cca9c25a872 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Fri Mar 10 00:38:00 2017 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Fri Mar 10 00:38:00 2017 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=5a3c2c16
Linux patch 3.12.71 0000_README | 4 + 1070_linux-3.12.71.patch | 3728 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 3732 insertions(+) diff --git a/0000_README b/0000_README index 89b165d..8a27c91 100644 --- a/0000_README +++ b/0000_README @@ -326,6 +326,10 @@ Patch: 1069_linux-3.12.70.patch From: http://www.kernel.org Desc: Linux 3.12.70 +Patch: 1070_linux-3.12.71.patch +From: http://www.kernel.org +Desc: Linux 3.12.71 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1070_linux-3.12.71.patch b/1070_linux-3.12.71.patch new file mode 100644 index 0000000..e6e53a2 --- /dev/null +++ b/1070_linux-3.12.71.patch @@ -0,0 +1,3728 @@ +diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt +index 64c6734da6d8..1ebce8682832 100644 +--- a/Documentation/kernel-parameters.txt ++++ b/Documentation/kernel-parameters.txt +@@ -1013,6 +1013,10 @@ bytes respectively. Such letter suffixes can also be entirely omitted. + When zero, profiling data is discarded and associated + debugfs files are removed at module unload time. + ++ goldfish [X86] Enable the goldfish android emulator platform. ++ Don't use this when you are not running on the ++ android emulator ++ + gpt [EFI] Forces disk with valid GPT signature but + invalid Protective MBR to be treated as GPT. + +diff --git a/Makefile b/Makefile +index d0e6e38ee77b..f9da868f99a8 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 12 +-SUBLEVEL = 70 ++SUBLEVEL = 71 + EXTRAVERSION = + NAME = One Giant Leap for Frogkind + +diff --git a/arch/arc/kernel/unaligned.c b/arch/arc/kernel/unaligned.c +index 7ff5b5c183bb..2cc82b6ec23d 100644 +--- a/arch/arc/kernel/unaligned.c ++++ b/arch/arc/kernel/unaligned.c +@@ -240,8 +240,9 @@ int misaligned_fixup(unsigned long address, struct pt_regs *regs, + if (state.fault) + goto fault; + ++ /* clear any remanants of delay slot */ + if (delay_mode(regs)) { +- regs->ret = regs->bta; ++ regs->ret = regs->bta & ~1U; + regs->status32 &= ~STATUS_DE_MASK; + } else { + regs->ret += state.instr_len; +diff --git a/arch/arm/kernel/ptrace.c b/arch/arm/kernel/ptrace.c +index ec33df500f86..93e6b7ea81b9 100644 +--- a/arch/arm/kernel/ptrace.c ++++ b/arch/arm/kernel/ptrace.c +@@ -600,7 +600,7 @@ static int gpr_set(struct task_struct *target, + const void *kbuf, const void __user *ubuf) + { + int ret; +- struct pt_regs newregs; ++ struct pt_regs newregs = *task_pt_regs(target); + + ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, + &newregs, +diff --git a/arch/parisc/include/asm/bitops.h b/arch/parisc/include/asm/bitops.h +index 8c9b631d2a78..8c00e6c06266 100644 +--- a/arch/parisc/include/asm/bitops.h ++++ b/arch/parisc/include/asm/bitops.h +@@ -6,7 +6,7 @@ + #endif + + #include <linux/compiler.h> +-#include <asm/types.h> /* for BITS_PER_LONG/SHIFT_PER_LONG */ ++#include <asm/types.h> + #include <asm/byteorder.h> + #include <linux/atomic.h> + +@@ -16,6 +16,12 @@ + * to include/asm-i386/bitops.h or kerneldoc + */ + ++#if __BITS_PER_LONG == 64 ++#define SHIFT_PER_LONG 6 ++#else ++#define SHIFT_PER_LONG 5 ++#endif ++ + #define CHOP_SHIFTCOUNT(x) (((unsigned long) (x)) & (BITS_PER_LONG - 1)) + + +diff --git a/arch/parisc/include/uapi/asm/bitsperlong.h b/arch/parisc/include/uapi/asm/bitsperlong.h +index 75196b415d3f..540c94de4427 100644 +--- a/arch/parisc/include/uapi/asm/bitsperlong.h ++++ b/arch/parisc/include/uapi/asm/bitsperlong.h +@@ -9,10 +9,8 @@ + */ + #if (defined(__KERNEL__) && defined(CONFIG_64BIT)) || defined (__LP64__) + #define __BITS_PER_LONG 64 +-#define SHIFT_PER_LONG 6 + #else + #define __BITS_PER_LONG 32 +-#define SHIFT_PER_LONG 5 + #endif + + #include <asm-generic/bitsperlong.h> +diff --git a/arch/parisc/include/uapi/asm/swab.h b/arch/parisc/include/uapi/asm/swab.h +index e78403b129ef..928e1bbac98f 100644 +--- a/arch/parisc/include/uapi/asm/swab.h ++++ b/arch/parisc/include/uapi/asm/swab.h +@@ -1,6 +1,7 @@ + #ifndef _PARISC_SWAB_H + #define _PARISC_SWAB_H + ++#include <asm/bitsperlong.h> + #include <linux/types.h> + #include <linux/compiler.h> + +@@ -38,7 +39,7 @@ static inline __attribute_const__ __u32 __arch_swab32(__u32 x) + } + #define __arch_swab32 __arch_swab32 + +-#if BITS_PER_LONG > 32 ++#if __BITS_PER_LONG > 32 + /* + ** From "PA-RISC 2.0 Architecture", HP Professional Books. + ** See Appendix I page 8 , "Endian Byte Swapping". +@@ -61,6 +62,6 @@ static inline __attribute_const__ __u64 __arch_swab64(__u64 x) + return x; + } + #define __arch_swab64 __arch_swab64 +-#endif /* BITS_PER_LONG > 32 */ ++#endif /* __BITS_PER_LONG > 32 */ + + #endif /* _PARISC_SWAB_H */ +diff --git a/arch/s390/net/bpf_jit_comp.c b/arch/s390/net/bpf_jit_comp.c +index 906fba63b66d..45f3d31c8e5e 100644 +--- a/arch/s390/net/bpf_jit_comp.c ++++ b/arch/s390/net/bpf_jit_comp.c +@@ -811,7 +811,7 @@ static struct bpf_binary_header *bpf_alloc_binary(unsigned int bpfsize, + return NULL; + memset(header, 0, sz); + header->pages = sz / PAGE_SIZE; +- hole = sz - (bpfsize + sizeof(*header)); ++ hole = min(sz - (bpfsize + sizeof(*header)), PAGE_SIZE - sizeof(*header)); + /* Insert random number of illegal instructions before BPF code + * and make sure the first instruction starts at an even address. + */ +diff --git a/arch/tile/kernel/ptrace.c b/arch/tile/kernel/ptrace.c +index de98c6ddf136..2343126c4ad2 100644 +--- a/arch/tile/kernel/ptrace.c ++++ b/arch/tile/kernel/ptrace.c +@@ -110,7 +110,7 @@ static int tile_gpr_set(struct task_struct *target, + const void *kbuf, const void __user *ubuf) + { + int ret; +- struct pt_regs regs; ++ struct pt_regs regs = *task_pt_regs(target); + + ret = user_regset_copyin(&pos, &count, &kbuf, &ubuf, ®s, 0, + sizeof(regs)); +diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig +index 0cda30450825..7255e3dee799 100644 +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -894,7 +894,7 @@ config X86_LOCAL_APIC + + config X86_IO_APIC + def_bool y +- depends on X86_64 || SMP || X86_32_NON_STANDARD || X86_UP_IOAPIC || PCI_MSI ++ depends on X86_LOCAL_APIC || X86_UP_IOAPIC + + config X86_VISWS_APIC + def_bool y +diff --git a/arch/x86/net/bpf_jit_comp.c b/arch/x86/net/bpf_jit_comp.c +index 1b72000b6be2..1fed139f8eae 100644 +--- a/arch/x86/net/bpf_jit_comp.c ++++ b/arch/x86/net/bpf_jit_comp.c +@@ -171,7 +171,7 @@ static struct bpf_binary_header *bpf_alloc_binary(unsigned int proglen, + memset(header, 0xcc, sz); /* fill whole space with int3 instructions */ + + header->pages = sz / PAGE_SIZE; +- hole = sz - (proglen + sizeof(*header)); ++ hole = min(sz - (proglen + sizeof(*header)), PAGE_SIZE - sizeof(*header)); + + /* insert a random number of int3 instructions before BPF code */ + *image_ptr = &header->image[prandom_u32() % hole]; +diff --git a/arch/x86/platform/goldfish/goldfish.c b/arch/x86/platform/goldfish/goldfish.c +index 1693107a518e..0d17c0aafeb1 100644 +--- a/arch/x86/platform/goldfish/goldfish.c ++++ b/arch/x86/platform/goldfish/goldfish.c +@@ -42,10 +42,22 @@ static struct resource goldfish_pdev_bus_resources[] = { + } + }; + ++static bool goldfish_enable __initdata; ++ ++static int __init goldfish_setup(char *str) ++{ ++ goldfish_enable = true; ++ return 0; ++} ++__setup("goldfish", goldfish_setup); ++ + static int __init goldfish_init(void) + { ++ if (!goldfish_enable) ++ return -ENODEV; ++ + platform_device_register_simple("goldfish_pdev_bus", -1, +- goldfish_pdev_bus_resources, 2); ++ goldfish_pdev_bus_resources, 2); + return 0; + } + device_initcall(goldfish_init); +diff --git a/crypto/algapi.c b/crypto/algapi.c +index daf2f653b131..8ea7a5dc3839 100644 +--- a/crypto/algapi.c ++++ b/crypto/algapi.c +@@ -337,6 +337,7 @@ int crypto_register_alg(struct crypto_alg *alg) + struct crypto_larval *larval; + int err; + ++ alg->cra_flags &= ~CRYPTO_ALG_DEAD; + err = crypto_check_alg(alg); + if (err) + return err; +diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c +index dc9d4b1ea4ec..90a71cc5c910 100644 +--- a/drivers/ata/sata_mv.c ++++ b/drivers/ata/sata_mv.c +@@ -4098,6 +4098,9 @@ static int mv_platform_probe(struct platform_device *pdev) + host->iomap = NULL; + hpriv->base = devm_ioremap(&pdev->dev, res->start, + resource_size(res)); ++ if (!hpriv->base) ++ return -ENOMEM; ++ + hpriv->base -= SATAHC0_REG_BASE; + + hpriv->clk = clk_get(&pdev->dev, NULL); +diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c +index 8356b481e339..a7b2a5f53b2b 100644 +--- a/drivers/cpufreq/cpufreq.c ++++ b/drivers/cpufreq/cpufreq.c +@@ -860,9 +860,6 @@ static void cpufreq_init_policy(struct cpufreq_policy *policy) + + /* set default policy */ + ret = __cpufreq_set_policy(policy, &new_policy); +- policy->user_policy.policy = policy->policy; +- policy->user_policy.governor = policy->governor; +- + if (ret) { + pr_debug("setting policy failed\n"); + if (cpufreq_driver->exit) +@@ -872,8 +869,7 @@ static void cpufreq_init_policy(struct cpufreq_policy *policy) + + #ifdef CONFIG_HOTPLUG_CPU + static int cpufreq_add_policy_cpu(struct cpufreq_policy *policy, +- unsigned int cpu, struct device *dev, +- bool frozen) ++ unsigned int cpu, struct device *dev) + { + int ret = 0, has_target = !!cpufreq_driver->target; + unsigned long flags; +@@ -904,11 +900,7 @@ static int cpufreq_add_policy_cpu(struct cpufreq_policy *policy, + } + } + +- /* Don't touch sysfs links during light-weight init */ +- if (!frozen) +- ret = sysfs_create_link(&dev->kobj, &policy->kobj, "cpufreq"); +- +- return ret; ++ return sysfs_create_link(&dev->kobj, &policy->kobj, "cpufreq"); + } + #endif + +@@ -951,6 +943,27 @@ err_free_policy: + return NULL; + } + ++static void cpufreq_policy_put_kobj(struct cpufreq_policy *policy) ++{ ++ struct kobject *kobj; ++ struct completion *cmp; ++ ++ lock_policy_rwsem_read(policy->cpu); ++ kobj = &policy->kobj; ++ cmp = &policy->kobj_unregister; ++ unlock_policy_rwsem_read(policy->cpu); ++ kobject_put(kobj); ++ ++ /* ++ * We need to make sure that the underlying kobj is ++ * actually not referenced anymore by anybody before we ++ * proceed with unloading. ++ */ ++ pr_debug("waiting for dropping of refcount\n"); ++ wait_for_completion(cmp); ++ pr_debug("wait complete\n"); ++} ++ + static void cpufreq_policy_free(struct cpufreq_policy *policy) + { + free_cpumask_var(policy->related_cpus); +@@ -1020,7 +1033,7 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif, + list_for_each_entry(tpolicy, &cpufreq_policy_list, policy_list) { + if (cpumask_test_cpu(cpu, tpolicy->related_cpus)) { + read_unlock_irqrestore(&cpufreq_driver_lock, flags); +- ret = cpufreq_add_policy_cpu(tpolicy, cpu, dev, frozen); ++ ret = cpufreq_add_policy_cpu(tpolicy, cpu, dev); + up_read(&cpufreq_rwsem); + return ret; + } +@@ -1028,15 +1041,17 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif, + read_unlock_irqrestore(&cpufreq_driver_lock, flags); + #endif + +- if (frozen) +- /* Restore the saved policy when doing light-weight init */ +- policy = cpufreq_policy_restore(cpu); +- else ++ /* ++ * Restore the saved policy when doing light-weight init and fall back ++ * to the full init if that fails. ++ */ ++ policy = frozen ? cpufreq_policy_restore(cpu) : NULL; ++ if (!policy) { ++ frozen = false; + policy = cpufreq_policy_alloc(); +- +- if (!policy) +- goto nomem_out; +- ++ if (!policy) ++ goto nomem_out; ++ } + + /* + * In the resume path, since we restore a saved policy, the assignment +@@ -1073,8 +1088,10 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif, + */ + cpumask_and(policy->cpus, policy->cpus, cpu_online_mask); + +- policy->user_policy.min = policy->min; +- policy->user_policy.max = policy->max; ++ if (!frozen) { ++ policy->user_policy.min = policy->min; ++ policy->user_policy.max = policy->max; ++ } + + blocking_notifier_call_chain(&cpufreq_policy_notifier_list, + CPUFREQ_START, policy); +@@ -1105,6 +1122,11 @@ static int __cpufreq_add_dev(struct device *dev, struct subsys_interface *sif, + + cpufreq_init_policy(policy); + ++ if (!frozen) { ++ policy->user_policy.policy = policy->policy; ++ policy->user_policy.governor = policy->governor; ++ } ++ + kobject_uevent(&policy->kobj, KOBJ_ADD); + up_read(&cpufreq_rwsem); + +@@ -1119,7 +1141,13 @@ err_out_unregister: + write_unlock_irqrestore(&cpufreq_driver_lock, flags); + + err_set_policy_cpu: ++ if (frozen) { ++ /* Do not leave stale fallback data behind. */ ++ per_cpu(cpufreq_cpu_data_fallback, cpu) = NULL; ++ cpufreq_policy_put_kobj(policy); ++ } + cpufreq_policy_free(policy); ++ + nomem_out: + up_read(&cpufreq_rwsem); + +@@ -1141,7 +1169,7 @@ static int cpufreq_add_dev(struct device *dev, struct subsys_interface *sif) + } + + static int cpufreq_nominate_new_policy_cpu(struct cpufreq_policy *policy, +- unsigned int old_cpu, bool frozen) ++ unsigned int old_cpu) + { + struct device *cpu_dev; + int ret; +@@ -1149,10 +1177,6 @@ static int cpufreq_nominate_new_policy_cpu(struct cpufreq_policy *policy, + /* first sibling now owns the new sysfs dir */ + cpu_dev = get_cpu_device(cpumask_any_but(policy->cpus, old_cpu)); + +- /* Don't touch sysfs files during light-weight tear-down */ +- if (frozen) +- return cpu_dev->id; +- + sysfs_remove_link(&cpu_dev->kobj, "cpufreq"); + ret = kobject_move(&policy->kobj, &cpu_dev->kobj); + if (ret) { +@@ -1220,7 +1244,7 @@ static int __cpufreq_remove_dev_prepare(struct device *dev, + sysfs_remove_link(&dev->kobj, "cpufreq"); + } else if (cpus > 1) { + +- new_cpu = cpufreq_nominate_new_policy_cpu(policy, cpu, frozen); ++ new_cpu = cpufreq_nominate_new_policy_cpu(policy, cpu); + if (new_cpu >= 0) { + update_policy_cpu(policy, new_cpu); + +@@ -1242,8 +1266,6 @@ static int __cpufreq_remove_dev_finish(struct device *dev, + int ret; + unsigned long flags; + struct cpufreq_policy *policy; +- struct kobject *kobj; +- struct completion *cmp; + + read_lock_irqsave(&cpufreq_driver_lock, flags); + policy = per_cpu(cpufreq_cpu_data, cpu); +@@ -1273,22 +1295,8 @@ static int __cpufreq_remove_dev_finish(struct device *dev, + } + } + +- if (!frozen) { +- lock_policy_rwsem_read(cpu); +- kobj = &policy->kobj; +- cmp = &policy->kobj_unregister; +- unlock_policy_rwsem_read(cpu); +- kobject_put(kobj); +- +- /* +- * We need to make sure that the underlying kobj is +- * actually not referenced anymore by anybody before we +- * proceed with unloading. +- */ +- pr_debug("waiting for dropping of refcount\n"); +- wait_for_completion(cmp); +- pr_debug("wait complete\n"); +- } ++ if (!frozen) ++ cpufreq_policy_put_kobj(policy); + + /* + * Perform the ->exit() even during light-weight tear-down, +@@ -2062,9 +2070,6 @@ static int cpufreq_cpu_callback(struct notifier_block *nfb, + dev = get_cpu_device(cpu); + if (dev) { + +- if (action & CPU_TASKS_FROZEN) +- frozen = true; +- + switch (action & ~CPU_TASKS_FROZEN) { + case CPU_ONLINE: + __cpufreq_add_dev(dev, NULL, frozen); +diff --git a/drivers/crypto/caam/caamhash.c b/drivers/crypto/caam/caamhash.c +index 92d2116bf1ad..170df51257ea 100644 +--- a/drivers/crypto/caam/caamhash.c ++++ b/drivers/crypto/caam/caamhash.c +@@ -1799,6 +1799,7 @@ caam_hash_alloc(struct device *ctrldev, struct caam_hash_template *template, + template->name); + snprintf(alg->cra_driver_name, CRYPTO_MAX_ALG_NAME, "%s", + template->driver_name); ++ t_alg->ahash_alg.setkey = NULL; + } + alg->cra_module = THIS_MODULE; + alg->cra_init = caam_hash_cra_init; +diff --git a/drivers/gpu/drm/i915/intel_crt.c b/drivers/gpu/drm/i915/intel_crt.c +index 74ef54a4645f..62a0e501057b 100644 +--- a/drivers/gpu/drm/i915/intel_crt.c ++++ b/drivers/gpu/drm/i915/intel_crt.c +@@ -475,6 +475,7 @@ static bool intel_crt_detect_ddc(struct drm_connector *connector) + struct drm_i915_private *dev_priv = crt->base.base.dev->dev_private; + struct edid *edid; + struct i2c_adapter *i2c; ++ bool ret = false; + + BUG_ON(crt->base.type != INTEL_OUTPUT_ANALOG); + +@@ -491,17 +492,17 @@ static bool intel_crt_detect_ddc(struct drm_connector *connector) + */ + if (!is_digital) { + DRM_DEBUG_KMS("CRT detected via DDC:0x50 [EDID]\n"); +- return true; ++ ret = true; ++ } else { ++ DRM_DEBUG_KMS("CRT not detected via DDC:0x50 [EDID reports a digital panel]\n"); + } +- +- DRM_DEBUG_KMS("CRT not detected via DDC:0x50 [EDID reports a digital panel]\n"); + } else { + DRM_DEBUG_KMS("CRT not detected via DDC:0x50 [no valid EDID found]\n"); + } + + kfree(edid); + +- return false; ++ return ret; + } + + static enum drm_connector_status +diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c +index 57d5abc420d1..bfb054d1d5b0 100644 +--- a/drivers/gpu/drm/i915/intel_display.c ++++ b/drivers/gpu/drm/i915/intel_display.c +@@ -7696,9 +7696,9 @@ static void do_intel_finish_page_flip(struct drm_device *dev, + + wake_up_all(&dev_priv->pending_flip_queue); + +- queue_work(dev_priv->wq, &work->work); +- + trace_i915_flip_complete(intel_crtc->plane, work->pending_flip_obj); ++ ++ queue_work(dev_priv->wq, &work->work); + } + + void intel_finish_page_flip(struct drm_device *dev, int pipe) +diff --git a/drivers/gpu/drm/nouveau/dispnv04/hw.c b/drivers/gpu/drm/nouveau/dispnv04/hw.c +index 973056b86207..b16e051e48f0 100644 +--- a/drivers/gpu/drm/nouveau/dispnv04/hw.c ++++ b/drivers/gpu/drm/nouveau/dispnv04/hw.c +@@ -224,6 +224,7 @@ nouveau_hw_get_clock(struct drm_device *dev, enum nvbios_pll_type plltype) + uint32_t mpllP; + + pci_read_config_dword(pci_get_bus_and_slot(0, 3), 0x6c, &mpllP); ++ mpllP = (mpllP >> 8) & 0xf; + if (!mpllP) + mpllP = 4; + +@@ -234,7 +235,7 @@ nouveau_hw_get_clock(struct drm_device *dev, enum nvbios_pll_type plltype) + uint32_t clock; + + pci_read_config_dword(pci_get_bus_and_slot(0, 5), 0x4c, &clock); +- return clock; ++ return clock / 1000; + } + + ret = nouveau_hw_get_pllvals(dev, plltype, &pllvals); +diff --git a/drivers/gpu/drm/nouveau/nv50_display.c b/drivers/gpu/drm/nouveau/nv50_display.c +index f8e66c08b11a..4e384a2f99c3 100644 +--- a/drivers/gpu/drm/nouveau/nv50_display.c ++++ b/drivers/gpu/drm/nouveau/nv50_display.c +@@ -1265,7 +1265,7 @@ nv50_crtc_gamma_set(struct drm_crtc *crtc, u16 *r, u16 *g, u16 *b, + uint32_t start, uint32_t size) + { + struct nouveau_crtc *nv_crtc = nouveau_crtc(crtc); +- u32 end = max(start + size, (u32)256); ++ u32 end = min_t(u32, start + size, 256); + u32 i; + + for (i = start; i < end; i++) { +diff --git a/drivers/isdn/hardware/eicon/message.c b/drivers/isdn/hardware/eicon/message.c +index a82e542ffc21..fecbf1d2f60b 100644 +--- a/drivers/isdn/hardware/eicon/message.c ++++ b/drivers/isdn/hardware/eicon/message.c +@@ -11304,7 +11304,8 @@ static void mixer_notify_update(PLCI *plci, byte others) + ((CAPI_MSG *) msg)->header.ncci = 0; + ((CAPI_MSG *) msg)->info.facility_req.Selector = SELECTOR_LINE_INTERCONNECT; + ((CAPI_MSG *) msg)->info.facility_req.structs[0] = 3; +- PUT_WORD(&(((CAPI_MSG *) msg)->info.facility_req.structs[1]), LI_REQ_SILENT_UPDATE); ++ ((CAPI_MSG *) msg)->info.facility_req.structs[1] = LI_REQ_SILENT_UPDATE & 0xff; ++ ((CAPI_MSG *) msg)->info.facility_req.structs[2] = LI_REQ_SILENT_UPDATE >> 8; + ((CAPI_MSG *) msg)->info.facility_req.structs[3] = 0; + w = api_put(notify_plci->appl, (CAPI_MSG *) msg); + if (w != _QUEUE_FULL) +diff --git a/drivers/media/i2c/Kconfig b/drivers/media/i2c/Kconfig +index d18be19c96cd..db62d7ede7fe 100644 +--- a/drivers/media/i2c/Kconfig ++++ b/drivers/media/i2c/Kconfig +@@ -590,6 +590,7 @@ config VIDEO_S5K6AA + config VIDEO_S5K4ECGX + tristate "Samsung S5K4ECGX sensor support" + depends on I2C && VIDEO_V4L2 && VIDEO_V4L2_SUBDEV_API ++ select CRC32 + ---help--- + This is a V4L2 sensor-level driver for Samsung S5K4ECGX 5M + camera sensor with an embedded SoC image signal processor. +diff --git a/drivers/media/usb/siano/smsusb.c b/drivers/media/usb/siano/smsusb.c +index 03761c6f472f..8e7c78567138 100644 +--- a/drivers/media/usb/siano/smsusb.c ++++ b/drivers/media/usb/siano/smsusb.c +@@ -206,20 +206,28 @@ static int smsusb_start_streaming(struct smsusb_device_t *dev) + static int smsusb_sendrequest(void *context, void *buffer, size_t size) + { + struct smsusb_device_t *dev = (struct smsusb_device_t *) context; +- struct sms_msg_hdr *phdr = (struct sms_msg_hdr *) buffer; +- int dummy; ++ struct sms_msg_hdr *phdr; ++ int dummy, ret; + + if (dev->state != SMSUSB_ACTIVE) + return -ENOENT; + ++ phdr = kmalloc(size, GFP_KERNEL); ++ if (!phdr) ++ return -ENOMEM; ++ memcpy(phdr, buffer, size); ++ + sms_debug("sending %s(%d) size: %d", + smscore_translate_msg(phdr->msg_type), phdr->msg_type, + phdr->msg_length); + + smsendian_handle_tx_message((struct sms_msg_data *) phdr); +- smsendian_handle_message_header((struct sms_msg_hdr *)buffer); +- return usb_bulk_msg(dev->udev, usb_sndbulkpipe(dev->udev, 2), +- buffer, size, &dummy, 1000); ++ smsendian_handle_message_header((struct sms_msg_hdr *)phdr); ++ ret = usb_bulk_msg(dev->udev, usb_sndbulkpipe(dev->udev, 2), ++ phdr, size, &dummy, 1000); ++ ++ kfree(phdr); ++ return ret; + } + + static char *smsusb1_fw_lkup[] = { +diff --git a/drivers/mfd/pm8921-core.c b/drivers/mfd/pm8921-core.c +index a6841f77aa5e..484fe66e6c88 100644 +--- a/drivers/mfd/pm8921-core.c ++++ b/drivers/mfd/pm8921-core.c +@@ -171,11 +171,12 @@ static int pm8921_remove(struct platform_device *pdev) + drvdata = platform_get_drvdata(pdev); + if (drvdata) + pmic = drvdata->pm_chip_data; +- if (pmic) ++ if (pmic) { + mfd_remove_devices(pmic->dev); +- if (pmic->irq_chip) { +- pm8xxx_irq_exit(pmic->irq_chip); +- pmic->irq_chip = NULL; ++ if (pmic->irq_chip) { ++ pm8xxx_irq_exit(pmic->irq_chip); ++ pmic->irq_chip = NULL; ++ } + } + + return 0; +diff --git a/drivers/net/can/c_can/c_can_pci.c b/drivers/net/can/c_can/c_can_pci.c +index b374be7891a2..b905e5e840f7 100644 +--- a/drivers/net/can/c_can/c_can_pci.c ++++ b/drivers/net/can/c_can/c_can_pci.c +@@ -109,6 +109,7 @@ static int c_can_pci_probe(struct pci_dev *pdev, + + dev->irq = pdev->irq; + priv->base = addr; ++ priv->device = &pdev->dev; + + if (!c_can_pci_data->freq) { + dev_err(&pdev->dev, "no clock frequency defined\n"); +diff --git a/drivers/net/can/ti_hecc.c b/drivers/net/can/ti_hecc.c +index 3a349a22d5bc..0269e41b7659 100644 +--- a/drivers/net/can/ti_hecc.c ++++ b/drivers/net/can/ti_hecc.c +@@ -962,7 +962,12 @@ static int ti_hecc_probe(struct platform_device *pdev) + netif_napi_add(ndev, &priv->napi, ti_hecc_rx_poll, + HECC_DEF_NAPI_WEIGHT); + +- clk_enable(priv->clk); ++ err = clk_prepare_enable(priv->clk); ++ if (err) { ++ dev_err(&pdev->dev, "clk_prepare_enable() failed\n"); ++ goto probe_exit_clk; ++ } ++ + err = register_candev(ndev); + if (err) { + dev_err(&pdev->dev, "register_candev() failed\n"); +@@ -995,7 +1000,7 @@ static int ti_hecc_remove(struct platform_device *pdev) + struct ti_hecc_priv *priv = netdev_priv(ndev); + + unregister_candev(ndev); +- clk_disable(priv->clk); ++ clk_disable_unprepare(priv->clk); + clk_put(priv->clk); + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + iounmap(priv->base); +@@ -1020,7 +1025,7 @@ static int ti_hecc_suspend(struct platform_device *pdev, pm_message_t state) + hecc_set_bit(priv, HECC_CANMC, HECC_CANMC_PDR); + priv->can.state = CAN_STATE_SLEEPING; + +- clk_disable(priv->clk); ++ clk_disable_unprepare(priv->clk); + + return 0; + } +@@ -1029,8 +1034,11 @@ static int ti_hecc_resume(struct platform_device *pdev) + { + struct net_device *dev = platform_get_drvdata(pdev); + struct ti_hecc_priv *priv = netdev_priv(dev); ++ int err; + +- clk_enable(priv->clk); ++ err = clk_prepare_enable(priv->clk); ++ if (err) ++ return err; + + hecc_clear_bit(priv, HECC_CANMC, HECC_CANMC_PDR); + priv->can.state = CAN_STATE_ERROR_ACTIVE; +diff --git a/drivers/net/ethernet/freescale/gianfar_ethtool.c b/drivers/net/ethernet/freescale/gianfar_ethtool.c +index d3d7ede27ef1..c0f7328adb13 100644 +--- a/drivers/net/ethernet/freescale/gianfar_ethtool.c ++++ b/drivers/net/ethernet/freescale/gianfar_ethtool.c +@@ -553,6 +553,9 @@ static int gfar_spauseparam(struct net_device *dev, + struct gfar __iomem *regs = priv->gfargrp[0].regs; + u32 oldadv, newadv; + ++ if (!phydev) ++ return -ENODEV; ++ + if (!(phydev->supported & SUPPORTED_Pause) || + (!(phydev->supported & SUPPORTED_Asym_Pause) && + (epause->rx_pause != epause->tx_pause))) +diff --git a/drivers/net/macvtap.c b/drivers/net/macvtap.c +index 98ce4feb9a79..2f6da225fab4 100644 +--- a/drivers/net/macvtap.c ++++ b/drivers/net/macvtap.c +@@ -655,7 +655,7 @@ static ssize_t macvtap_get_user(struct macvtap_queue *q, struct msghdr *m, + size_t linear; + + if (q->flags & IFF_VNET_HDR) { +- vnet_hdr_len = q->vnet_hdr_sz; ++ vnet_hdr_len = READ_ONCE(q->vnet_hdr_sz); + + err = -EINVAL; + if (len < vnet_hdr_len) +@@ -792,7 +792,7 @@ static ssize_t macvtap_put_user(struct macvtap_queue *q, + + if (q->flags & IFF_VNET_HDR) { + struct virtio_net_hdr vnet_hdr; +- vnet_hdr_len = q->vnet_hdr_sz; ++ vnet_hdr_len = READ_ONCE(q->vnet_hdr_sz); + if ((len -= vnet_hdr_len) < 0) + return -EINVAL; + +diff --git a/drivers/net/tun.c b/drivers/net/tun.c +index 813750d09680..ade348b7b19e 100644 +--- a/drivers/net/tun.c ++++ b/drivers/net/tun.c +@@ -997,9 +997,11 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, + } + + if (tun->flags & TUN_VNET_HDR) { +- if (len < tun->vnet_hdr_sz) ++ int vnet_hdr_sz = READ_ONCE(tun->vnet_hdr_sz); ++ ++ if (len < vnet_hdr_sz) + return -EINVAL; +- len -= tun->vnet_hdr_sz; ++ len -= vnet_hdr_sz; + + if (memcpy_fromiovecend((void *)&gso, iv, offset, sizeof(gso))) + return -EFAULT; +@@ -1010,7 +1012,7 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile, + + if (gso.hdr_len > len) + return -EINVAL; +- offset += tun->vnet_hdr_sz; ++ offset += vnet_hdr_sz; + } + + if ((tun->flags & TUN_TYPE_MASK) == TUN_TAP_DEV) { +@@ -1187,15 +1189,19 @@ static ssize_t tun_put_user(struct tun_struct *tun, + ssize_t total = 0; + int vlan_offset = 0, copied; + int vlan_hlen = 0; ++ int vnet_hdr_sz = 0; + + if (vlan_tx_tag_present(skb)) + vlan_hlen = VLAN_HLEN; + ++ if (tun->flags & TUN_VNET_HDR) ++ vnet_hdr_sz = READ_ONCE(tun->vnet_hdr_sz); ++ + if (!(tun->flags & TUN_NO_PI)) { + if ((len -= sizeof(pi)) < 0) + return -EINVAL; + +- if (len < skb->len) { ++ if (len < skb->len + vlan_hlen + vnet_hdr_sz) { + /* Packet will be striped */ + pi.flags |= TUN_PKT_STRIP; + } +@@ -1205,9 +1211,9 @@ static ssize_t tun_put_user(struct tun_struct *tun, + total += sizeof(pi); + } + +- if (tun->flags & TUN_VNET_HDR) { ++ if (vnet_hdr_sz) { + struct virtio_net_hdr gso = { 0 }; /* no info leak */ +- if ((len -= tun->vnet_hdr_sz) < 0) ++ if ((len -= vnet_hdr_sz) < 0) + return -EINVAL; + + if (skb_is_gso(skb)) { +@@ -1251,7 +1257,7 @@ static ssize_t tun_put_user(struct tun_struct *tun, + if (unlikely(memcpy_toiovecend(iv, (void *)&gso, total, + sizeof(gso)))) + return -EFAULT; +- total += tun->vnet_hdr_sz; ++ total += vnet_hdr_sz; + } + + copied = total; +diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c +index 756bb3a8e02c..3651f3cd474e 100644 +--- a/drivers/net/usb/cdc_ether.c ++++ b/drivers/net/usb/cdc_ether.c +@@ -487,6 +487,7 @@ static const struct driver_info wwan_info = { + #define ZTE_VENDOR_ID 0x19D2 + #define DELL_VENDOR_ID 0x413C + #define REALTEK_VENDOR_ID 0x0bda ++#define HP_VENDOR_ID 0x03f0 + + static const struct usb_device_id products[] = { + /* BLACKLIST !! +@@ -633,6 +634,13 @@ static const struct usb_device_id products[] = { + .driver_info = 0, + }, + ++/* HP lt2523 (Novatel E371) - handled by qmi_wwan */ ++{ ++ USB_DEVICE_AND_INTERFACE_INFO(HP_VENDOR_ID, 0x421d, USB_CLASS_COMM, ++ USB_CDC_SUBCLASS_ETHERNET, USB_CDC_PROTO_NONE), ++ .driver_info = 0, ++}, ++ + /* AnyDATA ADU960S - handled by qmi_wwan */ + { + USB_DEVICE_AND_INTERFACE_INFO(0x16d5, 0x650a, USB_CLASS_COMM, +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 415bbe0365c6..40eabbb4bcd7 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -560,6 +560,13 @@ static const struct usb_device_id products[] = { + USB_CDC_PROTO_NONE), + .driver_info = (unsigned long)&qmi_wwan_info, + }, ++ { /* HP lt2523 (Novatel E371) */ ++ USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x421d, ++ USB_CLASS_COMM, ++ USB_CDC_SUBCLASS_ETHERNET, ++ USB_CDC_PROTO_NONE), ++ .driver_info = (unsigned long)&qmi_wwan_info, ++ }, + { /* HP lt4112 LTE/HSPA+ Gobi 4G Module (Huawei me906e) */ + USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x581d, USB_CLASS_VENDOR_SPEC, 1, 7), + .driver_info = (unsigned long)&qmi_wwan_info, +diff --git a/drivers/net/wireless/rtlwifi/usb.c b/drivers/net/wireless/rtlwifi/usb.c +index 832560aa2274..2719ca31b469 100644 +--- a/drivers/net/wireless/rtlwifi/usb.c ++++ b/drivers/net/wireless/rtlwifi/usb.c +@@ -830,6 +830,7 @@ static void rtl_usb_stop(struct ieee80211_hw *hw) + struct rtl_priv *rtlpriv = rtl_priv(hw); + struct rtl_hal *rtlhal = rtl_hal(rtl_priv(hw)); + struct rtl_usb *rtlusb = rtl_usbdev(rtl_usbpriv(hw)); ++ struct urb *urb; + + /* should after adapter start and interrupt enable. */ + set_hal_stop(rtlhal); +@@ -837,6 +838,23 @@ static void rtl_usb_stop(struct ieee80211_hw *hw) + /* Enable software */ + SET_USB_STOP(rtlusb); + rtl_usb_deinit(hw); ++ ++ /* free pre-allocated URBs from rtl_usb_start() */ ++ usb_kill_anchored_urbs(&rtlusb->rx_submitted); ++ ++ tasklet_kill(&rtlusb->rx_work_tasklet); ++ cancel_work_sync(&rtlpriv->works.lps_change_work); ++ ++ flush_workqueue(rtlpriv->works.rtl_wq); ++ ++ skb_queue_purge(&rtlusb->rx_queue); ++ ++ while ((urb = usb_get_from_anchor(&rtlusb->rx_cleanup_urbs))) { ++ usb_free_coherent(urb->dev, urb->transfer_buffer_length, ++ urb->transfer_buffer, urb->transfer_dma); ++ usb_free_urb(urb); ++ } ++ + rtlpriv->cfg->ops->hw_disable(hw); + } + +diff --git a/drivers/pci/host/pci-mvebu.c b/drivers/pci/host/pci-mvebu.c +index 1324c3b93ee5..d2698834d446 100644 +--- a/drivers/pci/host/pci-mvebu.c ++++ b/drivers/pci/host/pci-mvebu.c +@@ -266,6 +266,58 @@ static int mvebu_pcie_hw_wr_conf(struct mvebu_pcie_port *port, + return ret; + } + ++/* ++ * Remove windows, starting from the largest ones to the smallest ++ * ones. ++ */ ++static void mvebu_pcie_del_windows(struct mvebu_pcie_port *port, ++ phys_addr_t base, size_t size) ++{ ++ while (size) { ++ size_t sz = 1 << (fls(size) - 1); ++ ++ mvebu_mbus_del_window(base, sz); ++ base += sz; ++ size -= sz; ++ } ++} ++ ++/* ++ * MBus windows can only have a power of two size, but PCI BARs do not ++ * have this constraint. Therefore, we have to split the PCI BAR into ++ * areas each having a power of two size. We start from the largest ++ * one (i.e highest order bit set in the size). ++ */ ++static void mvebu_pcie_add_windows(struct mvebu_pcie_port *port, ++ unsigned int target, unsigned int attribute, ++ phys_addr_t base, size_t size, ++ phys_addr_t remap) ++{ ++ size_t size_mapped = 0; ++ ++ while (size) { ++ size_t sz = 1 << (fls(size) - 1); ++ int ret; ++ ++ ret = mvebu_mbus_add_window_remap_by_id(target, attribute, base, ++ sz, remap); ++ if (ret) { ++ dev_err(&port->pcie->pdev->dev, ++ "Could not create MBus window at 0x%x, size 0x%x: %d\n", ++ base, sz, ret); ++ mvebu_pcie_del_windows(port, base - size_mapped, ++ size_mapped); ++ return; ++ } ++ ++ size -= sz; ++ size_mapped += sz; ++ base += sz; ++ if (remap != MVEBU_MBUS_NO_REMAP) ++ remap += sz; ++ } ++} ++ + static void mvebu_pcie_handle_iobase_change(struct mvebu_pcie_port *port) + { + phys_addr_t iobase; +@@ -276,8 +328,8 @@ static void mvebu_pcie_handle_iobase_change(struct mvebu_pcie_port *port) + + /* If a window was configured, remove it */ + if (port->iowin_base) { +- mvebu_mbus_del_window(port->iowin_base, +- port->iowin_size); ++ mvebu_pcie_del_windows(port, port->iowin_base, ++ port->iowin_size); + port->iowin_base = 0; + port->iowin_size = 0; + } +@@ -299,9 +351,9 @@ static void mvebu_pcie_handle_iobase_change(struct mvebu_pcie_port *port) + (port->bridge.iolimitupper << 16)) - + iobase) + 1; + +- mvebu_mbus_add_window_remap_by_id(port->io_target, port->io_attr, +- port->iowin_base, port->iowin_size, +- iobase); ++ mvebu_pcie_add_windows(port, port->io_target, port->io_attr, ++ port->iowin_base, port->iowin_size, ++ iobase); + + pci_ioremap_io(iobase, port->iowin_base); + } +@@ -313,8 +365,8 @@ static void mvebu_pcie_handle_membase_change(struct mvebu_pcie_port *port) + + /* If a window was configured, remove it */ + if (port->memwin_base) { +- mvebu_mbus_del_window(port->memwin_base, +- port->memwin_size); ++ mvebu_pcie_del_windows(port, port->memwin_base, ++ port->memwin_size); + port->memwin_base = 0; + port->memwin_size = 0; + } +@@ -333,8 +385,9 @@ static void mvebu_pcie_handle_membase_change(struct mvebu_pcie_port *port) + (((port->bridge.memlimit & 0xFFF0) << 16) | 0xFFFFF) - + port->memwin_base + 1; + +- mvebu_mbus_add_window_by_id(port->mem_target, port->mem_attr, +- port->memwin_base, port->memwin_size); ++ mvebu_pcie_add_windows(port, port->mem_target, port->mem_attr, ++ port->memwin_base, port->memwin_size, ++ MVEBU_MBUS_NO_REMAP); + } + + /* +@@ -677,14 +730,21 @@ resource_size_t mvebu_pcie_align_resource(struct pci_dev *dev, + + /* + * On the PCI-to-PCI bridge side, the I/O windows must have at +- * least a 64 KB size and be aligned on their size, and the +- * memory windows must have at least a 1 MB size and be +- * aligned on their size ++ * least a 64 KB size and the memory windows must have at ++ * least a 1 MB size. Moreover, MBus windows need to have a ++ * base address aligned on their size, and their size must be ++ * a power of two. This means that if the BAR doesn't have a ++ * power of two size, several MBus windows will actually be ++ * created. We need to ensure that the biggest MBus window ++ * (which will be the first one) is aligned on its size, which ++ * explains the rounddown_pow_of_two() being done here. + */ + if (res->flags & IORESOURCE_IO) +- return round_up(start, max((resource_size_t)SZ_64K, size)); ++ return round_up(start, max_t(resource_size_t, SZ_64K, ++ rounddown_pow_of_two(size))); + else if (res->flags & IORESOURCE_MEM) +- return round_up(start, max((resource_size_t)SZ_1M, size)); ++ return round_up(start, max_t(resource_size_t, SZ_1M, ++ rounddown_pow_of_two(size))); + else + return start; + } +diff --git a/drivers/platform/goldfish/pdev_bus.c b/drivers/platform/goldfish/pdev_bus.c +index 92cc4cfafde5..6bcd57cb2f75 100644 +--- a/drivers/platform/goldfish/pdev_bus.c ++++ b/drivers/platform/goldfish/pdev_bus.c +@@ -153,23 +153,26 @@ static int goldfish_new_pdev(void) + static irqreturn_t goldfish_pdev_bus_interrupt(int irq, void *dev_id) + { + irqreturn_t ret = IRQ_NONE; ++ + while (1) { + u32 op = readl(pdev_bus_base + PDEV_BUS_OP); +- switch (op) { +- case PDEV_BUS_OP_DONE: +- return IRQ_NONE; + ++ switch (op) { + case PDEV_BUS_OP_REMOVE_DEV: + goldfish_pdev_remove(); ++ ret = IRQ_HANDLED; + break; + + case PDEV_BUS_OP_ADD_DEV: + goldfish_new_pdev(); ++ ret = IRQ_HANDLED; + break; ++ ++ case PDEV_BUS_OP_DONE: ++ default: ++ return ret; + } +- ret = IRQ_HANDLED; + } +- return ret; + } + + static int goldfish_pdev_bus_probe(struct platform_device *pdev) +diff --git a/drivers/platform/x86/intel_mid_powerbtn.c b/drivers/platform/x86/intel_mid_powerbtn.c +index 6b18aba82cfa..018abbe3ea07 100644 +--- a/drivers/platform/x86/intel_mid_powerbtn.c ++++ b/drivers/platform/x86/intel_mid_powerbtn.c +@@ -78,8 +78,8 @@ static int mfld_pb_probe(struct platform_device *pdev) + + input_set_capability(input, EV_KEY, KEY_POWER); + +- error = request_threaded_irq(irq, NULL, mfld_pb_isr, IRQF_NO_SUSPEND, +- DRIVER_NAME, input); ++ error = request_threaded_irq(irq, NULL, mfld_pb_isr, IRQF_NO_SUSPEND | ++ IRQF_ONESHOT, DRIVER_NAME, input); + if (error) { + dev_err(&pdev->dev, "Unable to request irq %d for mfld power" + "button\n", irq); +diff --git a/drivers/rtc/interface.c b/drivers/rtc/interface.c +index ff20d90ea8e7..2062937a3e0e 100644 +--- a/drivers/rtc/interface.c ++++ b/drivers/rtc/interface.c +@@ -773,9 +773,23 @@ EXPORT_SYMBOL_GPL(rtc_irq_set_freq); + */ + static int rtc_timer_enqueue(struct rtc_device *rtc, struct rtc_timer *timer) + { ++ struct timerqueue_node *next = timerqueue_getnext(&rtc->timerqueue); ++ struct rtc_time tm; ++ ktime_t now; ++ + timer->enabled = 1; ++ __rtc_read_time(rtc, &tm); ++ now = rtc_tm_to_ktime(tm); ++ ++ /* Skip over expired timers */ ++ while (next) { ++ if (next->expires.tv64 >= now.tv64) ++ break; ++ next = timerqueue_iterate_next(next); ++ } ++ + timerqueue_add(&rtc->timerqueue, &timer->node); +- if (&timer->node == timerqueue_getnext(&rtc->timerqueue)) { ++ if (!next) { + struct rtc_wkalrm alarm; + int err; + alarm.time = rtc_ktime_to_tm(timer->node.expires); +diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c +index 6065212fdeed..36cf11cafee7 100644 +--- a/drivers/s390/scsi/zfcp_fsf.c ++++ b/drivers/s390/scsi/zfcp_fsf.c +@@ -1584,7 +1584,7 @@ out: + int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *wka_port) + { + struct zfcp_qdio *qdio = wka_port->adapter->qdio; +- struct zfcp_fsf_req *req = NULL; ++ struct zfcp_fsf_req *req; + int retval = -EIO; + + spin_lock_irq(&qdio->req_q_lock); +@@ -1613,7 +1613,7 @@ int zfcp_fsf_open_wka_port(struct zfcp_fc_wka_port *wka_port) + zfcp_fsf_req_free(req); + out: + spin_unlock_irq(&qdio->req_q_lock); +- if (req && !IS_ERR(req)) ++ if (!retval) + zfcp_dbf_rec_run_wka("fsowp_1", wka_port, req->req_id); + return retval; + } +@@ -1639,7 +1639,7 @@ static void zfcp_fsf_close_wka_port_handler(struct zfcp_fsf_req *req) + int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *wka_port) + { + struct zfcp_qdio *qdio = wka_port->adapter->qdio; +- struct zfcp_fsf_req *req = NULL; ++ struct zfcp_fsf_req *req; + int retval = -EIO; + + spin_lock_irq(&qdio->req_q_lock); +@@ -1668,7 +1668,7 @@ int zfcp_fsf_close_wka_port(struct zfcp_fc_wka_port *wka_port) + zfcp_fsf_req_free(req); + out: + spin_unlock_irq(&qdio->req_q_lock); +- if (req && !IS_ERR(req)) ++ if (!retval) + zfcp_dbf_rec_run_wka("fscwp_1", wka_port, req->req_id); + return retval; + } +diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c +index aeff39767588..f3f2dc86fda7 100644 +--- a/drivers/scsi/scsi_lib.c ++++ b/drivers/scsi/scsi_lib.c +@@ -1025,8 +1025,12 @@ static int scsi_init_sgtable(struct request *req, struct scsi_data_buffer *sdb, + int scsi_init_io(struct scsi_cmnd *cmd, gfp_t gfp_mask) + { + struct request *rq = cmd->request; ++ int error; + +- int error = scsi_init_sgtable(rq, &cmd->sdb, gfp_mask); ++ if (WARN_ON_ONCE(!rq->nr_phys_segments)) ++ return -EINVAL; ++ ++ error = scsi_init_sgtable(rq, &cmd->sdb, gfp_mask); + if (error) + goto err_exit; + +@@ -1128,11 +1132,7 @@ int scsi_setup_blk_pc_cmnd(struct scsi_device *sdev, struct request *req) + * submit a request without an attached bio. + */ + if (req->bio) { +- int ret; +- +- BUG_ON(!req->nr_phys_segments); +- +- ret = scsi_init_io(cmd, GFP_ATOMIC); ++ int ret = scsi_init_io(cmd, GFP_ATOMIC); + if (unlikely(ret)) + return ret; + } else { +@@ -1176,11 +1176,6 @@ int scsi_setup_fs_cmnd(struct scsi_device *sdev, struct request *req) + return ret; + } + +- /* +- * Filesystem requests must transfer data. +- */ +- BUG_ON(!req->nr_phys_segments); +- + cmd = scsi_get_cmd_from_req(sdev, req); + if (unlikely(!cmd)) + return BLKPREP_DEFER; +diff --git a/drivers/staging/vt6655/hostap.c b/drivers/staging/vt6655/hostap.c +index 8acff44a9e75..3f6c96cf8ebe 100644 +--- a/drivers/staging/vt6655/hostap.c ++++ b/drivers/staging/vt6655/hostap.c +@@ -143,7 +143,8 @@ static int hostap_disable_hostapd(PSDevice pDevice, int rtnl_locked) + DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "%s: Netdevice %s unregistered\n", + pDevice->dev->name, pDevice->apdev->name); + } +- free_netdev(pDevice->apdev); ++ if (pDevice->apdev) ++ free_netdev(pDevice->apdev); + pDevice->apdev = NULL; + pDevice->bEnable8021x = false; + pDevice->bEnableHostWEP = false; +diff --git a/drivers/staging/vt6656/hostap.c b/drivers/staging/vt6656/hostap.c +index c699a3058b39..cfffdd20e435 100644 +--- a/drivers/staging/vt6656/hostap.c ++++ b/drivers/staging/vt6656/hostap.c +@@ -133,7 +133,8 @@ static int hostap_disable_hostapd(struct vnt_private *pDevice, int rtnl_locked) + DBG_PRT(MSG_LEVEL_DEBUG, KERN_INFO "%s: Netdevice %s unregistered\n", + pDevice->dev->name, pDevice->apdev->name); + } +- free_netdev(pDevice->apdev); ++ if (pDevice->apdev) ++ free_netdev(pDevice->apdev); + pDevice->apdev = NULL; + pDevice->bEnable8021x = false; + pDevice->bEnableHostWEP = false; +diff --git a/drivers/target/target_core_sbc.c b/drivers/target/target_core_sbc.c +index 401fc7097935..552ac2d6fdc4 100644 +--- a/drivers/target/target_core_sbc.c ++++ b/drivers/target/target_core_sbc.c +@@ -367,6 +367,7 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success, + int *post_ret) + { + struct se_device *dev = cmd->se_dev; ++ sense_reason_t ret = TCM_NO_SENSE; + + /* + * Only set SCF_COMPARE_AND_WRITE_POST to force a response fall-through +@@ -374,9 +375,12 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success, + * sent to the backend driver. + */ + spin_lock_irq(&cmd->t_state_lock); +- if ((cmd->transport_state & CMD_T_SENT) && !cmd->scsi_status) { ++ if (cmd->transport_state & CMD_T_SENT) { + cmd->se_cmd_flags |= SCF_COMPARE_AND_WRITE_POST; + *post_ret = 1; ++ ++ if (cmd->scsi_status == SAM_STAT_CHECK_CONDITION) ++ ret = TCM_LOGICAL_UNIT_COMMUNICATION_FAILURE; + } + spin_unlock_irq(&cmd->t_state_lock); + +@@ -386,7 +390,7 @@ static sense_reason_t compare_and_write_post(struct se_cmd *cmd, bool success, + */ + up(&dev->caw_sem); + +- return TCM_NO_SENSE; ++ return ret; + } + + static sense_reason_t compare_and_write_callback(struct se_cmd *cmd, bool success, +diff --git a/drivers/tty/serial/msm_serial.c b/drivers/tty/serial/msm_serial.c +index c0f2b3e5452f..90ed37e45006 100644 +--- a/drivers/tty/serial/msm_serial.c ++++ b/drivers/tty/serial/msm_serial.c +@@ -973,6 +973,7 @@ static struct of_device_id msm_match_table[] = { + { .compatible = "qcom,msm-uartdm" }, + {} + }; ++MODULE_DEVICE_TABLE(of, msm_match_table); + + static struct platform_driver msm_platform_driver = { + .remove = msm_serial_remove, +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index c78c4f7efb40..ea93b35b1c6d 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -514,19 +514,18 @@ static int acm_port_activate(struct tty_port *port, struct tty_struct *tty) + acm->control->needs_remote_wakeup = 1; + + acm->ctrlurb->dev = acm->dev; +- if (usb_submit_urb(acm->ctrlurb, GFP_KERNEL)) { ++ retval = usb_submit_urb(acm->ctrlurb, GFP_KERNEL); ++ if (retval) { + dev_err(&acm->control->dev, + "%s - usb_submit_urb(ctrl irq) failed\n", __func__); + goto error_submit_urb; + } + + acm->ctrlout = ACM_CTRL_DTR | ACM_CTRL_RTS; +- if (acm_set_control(acm, acm->ctrlout) < 0 && +- (acm->ctrl_caps & USB_CDC_CAP_LINE)) ++ retval = acm_set_control(acm, acm->ctrlout); ++ if (retval < 0 && (acm->ctrl_caps & USB_CDC_CAP_LINE)) + goto error_set_control; + +- usb_autopm_put_interface(acm->control); +- + /* + * Unthrottle device in case the TTY was closed while throttled. + */ +@@ -535,9 +534,12 @@ static int acm_port_activate(struct tty_port *port, struct tty_struct *tty) + acm->throttle_req = 0; + spin_unlock_irq(&acm->read_lock); + +- if (acm_submit_read_urbs(acm, GFP_KERNEL)) ++ retval = acm_submit_read_urbs(acm, GFP_KERNEL); ++ if (retval) + goto error_submit_read_urbs; + ++ usb_autopm_put_interface(acm->control); ++ + mutex_unlock(&acm->mutex); + + return 0; +@@ -554,7 +556,8 @@ error_submit_urb: + error_get_interface: + disconnected: + mutex_unlock(&acm->mutex); +- return retval; ++ ++ return usb_translate_errors(retval); + } + + static void acm_port_destruct(struct tty_port *port) +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index ba39d978583c..094fe92ac21f 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -37,6 +37,10 @@ static const struct usb_device_id usb_quirk_list[] = { + /* CBM - Flash disk */ + { USB_DEVICE(0x0204, 0x6025), .driver_info = USB_QUIRK_RESET_RESUME }, + ++ /* WORLDE easy key (easykey.25) MIDI controller */ ++ { USB_DEVICE(0x0218, 0x0401), .driver_info = ++ USB_QUIRK_CONFIG_INTF_STRINGS }, ++ + /* HP 5300/5370C scanner */ + { USB_DEVICE(0x03f0, 0x0701), .driver_info = + USB_QUIRK_STRING_FETCH_255 }, +diff --git a/drivers/usb/serial/ark3116.c b/drivers/usb/serial/ark3116.c +index bc77e955cbef..1f4c116843fc 100644 +--- a/drivers/usb/serial/ark3116.c ++++ b/drivers/usb/serial/ark3116.c +@@ -100,10 +100,17 @@ static int ark3116_read_reg(struct usb_serial *serial, + usb_rcvctrlpipe(serial->dev, 0), + 0xfe, 0xc0, 0, reg, + buf, 1, ARK_TIMEOUT); +- if (result < 0) ++ if (result < 1) { ++ dev_err(&serial->interface->dev, ++ "failed to read register %u: %d\n", ++ reg, result); ++ if (result >= 0) ++ result = -EIO; ++ + return result; +- else +- return buf[0]; ++ } ++ ++ return buf[0]; + } + + static inline int calc_divisor(int bps) +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c +index 8b3e77716c4a..95544c6323a7 100644 +--- a/drivers/usb/serial/cp210x.c ++++ b/drivers/usb/serial/cp210x.c +@@ -171,6 +171,8 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(0x1901, 0x0190) }, /* GE B850 CP2105 Recorder interface */ + { USB_DEVICE(0x1901, 0x0193) }, /* GE B650 CP2104 PMC interface */ + { USB_DEVICE(0x1901, 0x0194) }, /* GE Healthcare Remote Alarm Box */ ++ { USB_DEVICE(0x1901, 0x0195) }, /* GE B850/B650/B450 CP2104 DP UART interface */ ++ { USB_DEVICE(0x1901, 0x0196) }, /* GE B850 CP2105 DP UART interface */ + { USB_DEVICE(0x19CF, 0x3000) }, /* Parrot NMEA GPS Flight Recorder */ + { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */ + { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */ +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c +index d1b76b0a67df..a099f8eafd9a 100644 +--- a/drivers/usb/serial/ftdi_sio.c ++++ b/drivers/usb/serial/ftdi_sio.c +@@ -1829,8 +1829,6 @@ static int ftdi_sio_port_probe(struct usb_serial_port *port) + + mutex_init(&priv->cfg_lock); + +- priv->flags = ASYNC_LOW_LATENCY; +- + if (quirk && quirk->port_probe) + quirk->port_probe(priv); + +@@ -2104,6 +2102,20 @@ static int ftdi_process_packet(struct usb_serial_port *port, + priv->prev_status = status; + } + ++ /* save if the transmitter is empty or not */ ++ if (packet[1] & FTDI_RS_TEMT) ++ priv->transmit_empty = 1; ++ else ++ priv->transmit_empty = 0; ++ ++ len -= 2; ++ if (!len) ++ return 0; /* status only */ ++ ++ /* ++ * Break and error status must only be processed for packets with ++ * data payload to avoid over-reporting. ++ */ + flag = TTY_NORMAL; + if (packet[1] & FTDI_RS_ERR_MASK) { + /* Break takes precedence over parity, which takes precedence +@@ -2126,15 +2138,6 @@ static int ftdi_process_packet(struct usb_serial_port *port, + } + } + +- /* save if the transmitter is empty or not */ +- if (packet[1] & FTDI_RS_TEMT) +- priv->transmit_empty = 1; +- else +- priv->transmit_empty = 0; +- +- len -= 2; +- if (!len) +- return 0; /* status only */ + port->icount.rx += len; + ch = packet + 2; + +@@ -2465,8 +2468,12 @@ static int ftdi_get_modem_status(struct usb_serial_port *port, + FTDI_SIO_GET_MODEM_STATUS_REQUEST_TYPE, + 0, priv->interface, + buf, len, WDR_TIMEOUT); +- if (ret < 0) { ++ ++ /* NOTE: We allow short responses and handle that below. */ ++ if (ret < 1) { + dev_err(&port->dev, "failed to get modem status: %d\n", ret); ++ if (ret >= 0) ++ ret = -EIO; + ret = usb_translate_errors(ret); + goto out; + } +diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c +index 0b1659026d85..fc052e4cc5b2 100644 +--- a/drivers/usb/serial/mos7840.c ++++ b/drivers/usb/serial/mos7840.c +@@ -1031,6 +1031,7 @@ static int mos7840_open(struct tty_struct *tty, struct usb_serial_port *port) + * (can't set it up in mos7840_startup as the structures * + * were not set up at that time.) */ + if (port0->open_ports == 1) { ++ /* FIXME: Buffer never NULL, so URB is not submitted. */ + if (serial->port[0]->interrupt_in_buffer == NULL) { + /* set up interrupt urb */ + usb_fill_int_urb(serial->port[0]->interrupt_in_urb, +@@ -2195,7 +2196,8 @@ static int mos7840_calc_num_ports(struct usb_serial *serial) + static int mos7840_attach(struct usb_serial *serial) + { + if (serial->num_bulk_in < serial->num_ports || +- serial->num_bulk_out < serial->num_ports) { ++ serial->num_bulk_out < serial->num_ports || ++ serial->num_interrupt_in < 1) { + dev_err(&serial->interface->dev, "missing endpoints\n"); + return -ENODEV; + } +diff --git a/drivers/usb/serial/opticon.c b/drivers/usb/serial/opticon.c +index df495ea0d977..bb9c07a79b4f 100644 +--- a/drivers/usb/serial/opticon.c ++++ b/drivers/usb/serial/opticon.c +@@ -143,7 +143,7 @@ static int opticon_open(struct tty_struct *tty, struct usb_serial_port *port) + usb_clear_halt(port->serial->dev, port->read_urb->pipe); + + res = usb_serial_generic_open(tty, port); +- if (!res) ++ if (res) + return res; + + /* Request CTS line state, sometimes during opening the current +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 99dff08b560b..49b668da6cf0 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -527,6 +527,12 @@ static void option_instat_callback(struct urb *urb); + #define VIATELECOM_VENDOR_ID 0x15eb + #define VIATELECOM_PRODUCT_CDS7 0x0001 + ++/* WeTelecom products */ ++#define WETELECOM_VENDOR_ID 0x22de ++#define WETELECOM_PRODUCT_WMD200 0x6801 ++#define WETELECOM_PRODUCT_6802 0x6802 ++#define WETELECOM_PRODUCT_WMD300 0x6803 ++ + /* some devices interfaces need special handling due to a number of reasons */ + enum option_blacklist_reason { + OPTION_BLACKLIST_NONE = 0, +@@ -1648,7 +1654,79 @@ static const struct usb_device_id option_ids[] = { + .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0178, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffe9, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff42, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff43, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff44, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff45, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff46, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff47, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff48, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff49, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff4a, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff4b, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff4c, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff4d, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff4e, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff4f, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff50, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff51, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff52, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff53, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff54, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff55, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff56, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff57, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff58, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff59, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff5a, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff5b, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff5c, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff5d, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff5e, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff5f, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff60, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff61, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff62, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff63, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff64, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff65, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff66, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff67, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff68, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff69, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff6a, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff6b, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff6c, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff6d, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff6e, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff6f, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff70, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff71, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff72, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff73, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff74, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff75, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff76, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff77, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff78, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff79, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff7a, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff7b, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff7c, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff7d, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff7e, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff7f, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff80, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff81, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff82, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff83, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff84, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff85, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff86, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff87, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff88, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff89, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8a, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8b, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8c, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff8d, 0xff, 0xff, 0xff) }, +@@ -1659,7 +1737,61 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff92, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff93, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff94, 0xff, 0xff, 0xff) }, +- ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xff9f, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa0, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa1, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa2, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa3, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa4, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa5, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa6, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa7, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa8, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffa9, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffaa, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffab, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffac, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffae, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffaf, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb0, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb1, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb2, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb3, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb4, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb5, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb6, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb7, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb8, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffb9, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffba, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffbb, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffbc, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffbd, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffbe, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffbf, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc0, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc1, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc2, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc3, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc4, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc5, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc6, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc7, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc8, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffc9, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffca, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffcb, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffcc, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffcd, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffce, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffcf, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd0, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd1, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd2, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd3, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd4, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffd5, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0xffe9, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC2726, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710T, 0xff, 0xff, 0xff) }, +@@ -1871,6 +2003,10 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_INTERFACE_CLASS(0x2020, 0x4000, 0xff) }, /* OLICARD300 - MT6225 */ + { USB_DEVICE(INOVIA_VENDOR_ID, INOVIA_SEW858) }, + { USB_DEVICE(VIATELECOM_VENDOR_ID, VIATELECOM_PRODUCT_CDS7) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD200, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_6802, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(WETELECOM_VENDOR_ID, WETELECOM_PRODUCT_WMD300, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(0x03f0, 0x421d, 0xff, 0xff, 0xff) }, /* HP lt2523 (Novatel E371) */ + { } /* Terminating entry */ + }; + MODULE_DEVICE_TABLE(usb, option_ids); +diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c +index 23f11751e05a..3438146b3ddc 100644 +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -52,6 +52,7 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID) }, + { USB_DEVICE(IODATA_VENDOR_ID, IODATA_PRODUCT_ID_RSAQ5) }, + { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID) }, ++ { USB_DEVICE(ATEN_VENDOR_ID, ATEN_PRODUCT_ID2) }, + { USB_DEVICE(ATEN_VENDOR_ID2, ATEN_PRODUCT_ID) }, + { USB_DEVICE(ELCOM_VENDOR_ID, ELCOM_PRODUCT_ID) }, + { USB_DEVICE(ELCOM_VENDOR_ID, ELCOM_PRODUCT_ID_UCSGT) }, +diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h +index e3b7af8adfb7..09d9be88209e 100644 +--- a/drivers/usb/serial/pl2303.h ++++ b/drivers/usb/serial/pl2303.h +@@ -27,6 +27,7 @@ + #define ATEN_VENDOR_ID 0x0557 + #define ATEN_VENDOR_ID2 0x0547 + #define ATEN_PRODUCT_ID 0x2008 ++#define ATEN_PRODUCT_ID2 0x2118 + + #define IODATA_VENDOR_ID 0x04bb + #define IODATA_PRODUCT_ID 0x0a03 +diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c +index 3e96d1a9cbdb..d2e8eee46ef7 100644 +--- a/drivers/usb/serial/qcserial.c ++++ b/drivers/usb/serial/qcserial.c +@@ -119,6 +119,7 @@ static const struct usb_device_id id_table[] = { + {USB_DEVICE(0x1410, 0xa021)}, /* Novatel Gobi 3000 Composite */ + {USB_DEVICE(0x413c, 0x8193)}, /* Dell Gobi 3000 QDL */ + {USB_DEVICE(0x413c, 0x8194)}, /* Dell Gobi 3000 Composite */ ++ {USB_DEVICE(0x413c, 0x81a6)}, /* Dell DW5570 QDL (MC8805) */ + {USB_DEVICE(0x1199, 0x68a4)}, /* Sierra Wireless QDL */ + {USB_DEVICE(0x1199, 0x68a5)}, /* Sierra Wireless Modem */ + {USB_DEVICE(0x1199, 0x68a8)}, /* Sierra Wireless QDL */ +diff --git a/drivers/usb/serial/spcp8x5.c b/drivers/usb/serial/spcp8x5.c +index ab754d23244c..5fe33cc6a8e3 100644 +--- a/drivers/usb/serial/spcp8x5.c ++++ b/drivers/usb/serial/spcp8x5.c +@@ -233,11 +233,17 @@ static int spcp8x5_get_msr(struct usb_serial_port *port, u8 *status) + ret = usb_control_msg(dev, usb_rcvctrlpipe(dev, 0), + GET_UART_STATUS, GET_UART_STATUS_TYPE, + 0, GET_UART_STATUS_MSR, buf, 1, 100); +- if (ret < 0) ++ if (ret < 1) { + dev_err(&port->dev, "failed to get modem status: %d", ret); ++ if (ret >= 0) ++ ret = -EIO; ++ goto out; ++ } + + dev_dbg(&port->dev, "0xc0:0x22:0:6 %d - 0x02%x", ret, *buf); + *status = *buf; ++ ret = 0; ++out: + kfree(buf); + + return ret; +diff --git a/drivers/video/fbcmap.c b/drivers/video/fbcmap.c +index f89245b8ba8e..68a113594808 100644 +--- a/drivers/video/fbcmap.c ++++ b/drivers/video/fbcmap.c +@@ -163,17 +163,18 @@ void fb_dealloc_cmap(struct fb_cmap *cmap) + + int fb_copy_cmap(const struct fb_cmap *from, struct fb_cmap *to) + { +- int tooff = 0, fromoff = 0; +- int size; ++ unsigned int tooff = 0, fromoff = 0; ++ size_t size; + + if (to->start > from->start) + fromoff = to->start - from->start; + else + tooff = from->start - to->start; +- size = to->len - tooff; +- if (size > (int) (from->len - fromoff)) +- size = from->len - fromoff; +- if (size <= 0) ++ if (fromoff >= from->len || tooff >= to->len) ++ return -EINVAL; ++ ++ size = min_t(size_t, to->len - tooff, from->len - fromoff); ++ if (size == 0) + return -EINVAL; + size *= sizeof(u16); + +@@ -187,17 +188,18 @@ int fb_copy_cmap(const struct fb_cmap *from, struct fb_cmap *to) + + int fb_cmap_to_user(const struct fb_cmap *from, struct fb_cmap_user *to) + { +- int tooff = 0, fromoff = 0; +- int size; ++ unsigned int tooff = 0, fromoff = 0; ++ size_t size; + + if (to->start > from->start) + fromoff = to->start - from->start; + else + tooff = from->start - to->start; +- size = to->len - tooff; +- if (size > (int) (from->len - fromoff)) +- size = from->len - fromoff; +- if (size <= 0) ++ if (fromoff >= from->len || tooff >= to->len) ++ return -EINVAL; ++ ++ size = min_t(size_t, to->len - tooff, from->len - fromoff); ++ if (size == 0) + return -EINVAL; + size *= sizeof(u16); + +diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c +index a4e276e65b0a..467aca9c64e5 100644 +--- a/fs/cifs/readdir.c ++++ b/fs/cifs/readdir.c +@@ -280,6 +280,7 @@ initiate_cifs_search(const unsigned int xid, struct file *file) + rc = -ENOMEM; + goto error_exit; + } ++ spin_lock_init(&cifsFile->file_info_lock); + file->private_data = cifsFile; + cifsFile->tlink = cifs_get_tlink(tlink); + tcon = tlink_tcon(tlink); +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index 6362896f5875..7bc05f7bb2a7 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -3852,6 +3852,15 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent) + (EXT4_MAX_BLOCK_FILE_PHYS / EXT4_BLOCKS_PER_GROUP(sb))); + db_count = (sbi->s_groups_count + EXT4_DESC_PER_BLOCK(sb) - 1) / + EXT4_DESC_PER_BLOCK(sb); ++ if (EXT4_HAS_INCOMPAT_FEATURE(sb, EXT4_FEATURE_INCOMPAT_META_BG)) { ++ if (le32_to_cpu(es->s_first_meta_bg) > db_count) { ++ ext4_msg(sb, KERN_WARNING, ++ "first meta block group too large: %u " ++ "(group descriptor block count %u)", ++ le32_to_cpu(es->s_first_meta_bg), db_count); ++ goto failed_mount; ++ } ++ } + sbi->s_group_desc = ext4_kvmalloc(db_count * + sizeof(struct buffer_head *), + GFP_KERNEL); +diff --git a/fs/ocfs2/ioctl.c b/fs/ocfs2/ioctl.c +index fa32ce9b455d..71e249201bcd 100644 +--- a/fs/ocfs2/ioctl.c ++++ b/fs/ocfs2/ioctl.c +@@ -34,9 +34,8 @@ + copy_to_user((typeof(a) __user *)b, &(a), sizeof(a)) + + /* +- * This call is void because we are already reporting an error that may +- * be -EFAULT. The error will be returned from the ioctl(2) call. It's +- * just a best-effort to tell userspace that this request caused the error. ++ * This is just a best-effort to tell userspace that this request ++ * caused the error. + */ + static inline void o2info_set_request_error(struct ocfs2_info_request *kreq, + struct ocfs2_info_request __user *req) +@@ -145,136 +144,105 @@ bail: + int ocfs2_info_handle_blocksize(struct inode *inode, + struct ocfs2_info_request __user *req) + { +- int status = -EFAULT; + struct ocfs2_info_blocksize oib; + + if (o2info_from_user(oib, req)) +- goto bail; ++ return -EFAULT; + + oib.ib_blocksize = inode->i_sb->s_blocksize; + + o2info_set_request_filled(&oib.ib_req); + + if (o2info_to_user(oib, req)) +- goto bail; +- +- status = 0; +-bail: +- if (status) +- o2info_set_request_error(&oib.ib_req, req); ++ return -EFAULT; + +- return status; ++ return 0; + } + + int ocfs2_info_handle_clustersize(struct inode *inode, + struct ocfs2_info_request __user *req) + { +- int status = -EFAULT; + struct ocfs2_info_clustersize oic; + struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); + + if (o2info_from_user(oic, req)) +- goto bail; ++ return -EFAULT; + + oic.ic_clustersize = osb->s_clustersize; + + o2info_set_request_filled(&oic.ic_req); + + if (o2info_to_user(oic, req)) +- goto bail; +- +- status = 0; +-bail: +- if (status) +- o2info_set_request_error(&oic.ic_req, req); ++ return -EFAULT; + +- return status; ++ return 0; + } + + int ocfs2_info_handle_maxslots(struct inode *inode, + struct ocfs2_info_request __user *req) + { +- int status = -EFAULT; + struct ocfs2_info_maxslots oim; + struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); + + if (o2info_from_user(oim, req)) +- goto bail; ++ return -EFAULT; + + oim.im_max_slots = osb->max_slots; + + o2info_set_request_filled(&oim.im_req); + + if (o2info_to_user(oim, req)) +- goto bail; ++ return -EFAULT; + +- status = 0; +-bail: +- if (status) +- o2info_set_request_error(&oim.im_req, req); +- +- return status; ++ return 0; + } + + int ocfs2_info_handle_label(struct inode *inode, + struct ocfs2_info_request __user *req) + { +- int status = -EFAULT; + struct ocfs2_info_label oil; + struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); + + if (o2info_from_user(oil, req)) +- goto bail; ++ return -EFAULT; + + memcpy(oil.il_label, osb->vol_label, OCFS2_MAX_VOL_LABEL_LEN); + + o2info_set_request_filled(&oil.il_req); + + if (o2info_to_user(oil, req)) +- goto bail; ++ return -EFAULT; + +- status = 0; +-bail: +- if (status) +- o2info_set_request_error(&oil.il_req, req); +- +- return status; ++ return 0; + } + + int ocfs2_info_handle_uuid(struct inode *inode, + struct ocfs2_info_request __user *req) + { +- int status = -EFAULT; + struct ocfs2_info_uuid oiu; + struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); + + if (o2info_from_user(oiu, req)) +- goto bail; ++ return -EFAULT; + + memcpy(oiu.iu_uuid_str, osb->uuid_str, OCFS2_TEXT_UUID_LEN + 1); + + o2info_set_request_filled(&oiu.iu_req); + + if (o2info_to_user(oiu, req)) +- goto bail; +- +- status = 0; +-bail: +- if (status) +- o2info_set_request_error(&oiu.iu_req, req); ++ return -EFAULT; + +- return status; ++ return 0; + } + + int ocfs2_info_handle_fs_features(struct inode *inode, + struct ocfs2_info_request __user *req) + { +- int status = -EFAULT; + struct ocfs2_info_fs_features oif; + struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); + + if (o2info_from_user(oif, req)) +- goto bail; ++ return -EFAULT; + + oif.if_compat_features = osb->s_feature_compat; + oif.if_incompat_features = osb->s_feature_incompat; +@@ -283,39 +251,28 @@ int ocfs2_info_handle_fs_features(struct inode *inode, + o2info_set_request_filled(&oif.if_req); + + if (o2info_to_user(oif, req)) +- goto bail; ++ return -EFAULT; + +- status = 0; +-bail: +- if (status) +- o2info_set_request_error(&oif.if_req, req); +- +- return status; ++ return 0; + } + + int ocfs2_info_handle_journal_size(struct inode *inode, + struct ocfs2_info_request __user *req) + { +- int status = -EFAULT; + struct ocfs2_info_journal_size oij; + struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); + + if (o2info_from_user(oij, req)) +- goto bail; ++ return -EFAULT; + + oij.ij_journal_size = i_size_read(osb->journal->j_inode); + + o2info_set_request_filled(&oij.ij_req); + + if (o2info_to_user(oij, req)) +- goto bail; ++ return -EFAULT; + +- status = 0; +-bail: +- if (status) +- o2info_set_request_error(&oij.ij_req, req); +- +- return status; ++ return 0; + } + + int ocfs2_info_scan_inode_alloc(struct ocfs2_super *osb, +@@ -371,7 +328,7 @@ int ocfs2_info_handle_freeinode(struct inode *inode, + u32 i; + u64 blkno = -1; + char namebuf[40]; +- int status = -EFAULT, type = INODE_ALLOC_SYSTEM_INODE; ++ int status, type = INODE_ALLOC_SYSTEM_INODE; + struct ocfs2_info_freeinode *oifi = NULL; + struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); + struct inode *inode_alloc = NULL; +@@ -383,8 +340,10 @@ int ocfs2_info_handle_freeinode(struct inode *inode, + goto out_err; + } + +- if (o2info_from_user(*oifi, req)) +- goto bail; ++ if (o2info_from_user(*oifi, req)) { ++ status = -EFAULT; ++ goto out_free; ++ } + + oifi->ifi_slotnum = osb->max_slots; + +@@ -421,14 +380,16 @@ int ocfs2_info_handle_freeinode(struct inode *inode, + + o2info_set_request_filled(&oifi->ifi_req); + +- if (o2info_to_user(*oifi, req)) +- goto bail; ++ if (o2info_to_user(*oifi, req)) { ++ status = -EFAULT; ++ goto out_free; ++ } + + status = 0; + bail: + if (status) + o2info_set_request_error(&oifi->ifi_req, req); +- ++out_free: + kfree(oifi); + out_err: + return status; +@@ -655,7 +616,7 @@ int ocfs2_info_handle_freefrag(struct inode *inode, + { + u64 blkno = -1; + char namebuf[40]; +- int status = -EFAULT, type = GLOBAL_BITMAP_SYSTEM_INODE; ++ int status, type = GLOBAL_BITMAP_SYSTEM_INODE; + + struct ocfs2_info_freefrag *oiff; + struct ocfs2_super *osb = OCFS2_SB(inode->i_sb); +@@ -668,8 +629,10 @@ int ocfs2_info_handle_freefrag(struct inode *inode, + goto out_err; + } + +- if (o2info_from_user(*oiff, req)) +- goto bail; ++ if (o2info_from_user(*oiff, req)) { ++ status = -EFAULT; ++ goto out_free; ++ } + /* + * chunksize from userspace should be power of 2. + */ +@@ -708,14 +671,14 @@ int ocfs2_info_handle_freefrag(struct inode *inode, + + if (o2info_to_user(*oiff, req)) { + status = -EFAULT; +- goto bail; ++ goto out_free; + } + + status = 0; + bail: + if (status) + o2info_set_request_error(&oiff->iff_req, req); +- ++out_free: + kfree(oiff); + out_err: + return status; +@@ -724,23 +687,17 @@ out_err: + int ocfs2_info_handle_unknown(struct inode *inode, + struct ocfs2_info_request __user *req) + { +- int status = -EFAULT; + struct ocfs2_info_request oir; + + if (o2info_from_user(oir, req)) +- goto bail; ++ return -EFAULT; + + o2info_clear_request_filled(&oir); + + if (o2info_to_user(oir, req)) +- goto bail; ++ return -EFAULT; + +- status = 0; +-bail: +- if (status) +- o2info_set_request_error(&oir, req); +- +- return status; ++ return 0; + } + + /* +diff --git a/fs/splice.c b/fs/splice.c +index 51ce51b9af6a..2e012472f97b 100644 +--- a/fs/splice.c ++++ b/fs/splice.c +@@ -215,6 +215,7 @@ ssize_t splice_to_pipe(struct pipe_inode_info *pipe, + buf->len = spd->partial[page_nr].len; + buf->private = spd->partial[page_nr].private; + buf->ops = spd->ops; ++ buf->flags = 0; + if (spd->flags & SPLICE_F_GIFT) + buf->flags |= PIPE_BUF_FLAG_GIFT; + +diff --git a/include/linux/can/core.h b/include/linux/can/core.h +index 78c6c52073ad..6bdc00b6df01 100644 +--- a/include/linux/can/core.h ++++ b/include/linux/can/core.h +@@ -45,10 +45,9 @@ struct can_proto { + extern int can_proto_register(const struct can_proto *cp); + extern void can_proto_unregister(const struct can_proto *cp); + +-extern int can_rx_register(struct net_device *dev, canid_t can_id, +- canid_t mask, +- void (*func)(struct sk_buff *, void *), +- void *data, char *ident); ++int can_rx_register(struct net_device *dev, canid_t can_id, canid_t mask, ++ void (*func)(struct sk_buff *, void *), ++ void *data, char *ident, struct sock *sk); + + extern void can_rx_unregister(struct net_device *dev, canid_t can_id, + canid_t mask, +diff --git a/include/linux/nfs4.h b/include/linux/nfs4.h +index 3859ddbecb5f..985e180a5d9a 100644 +--- a/include/linux/nfs4.h ++++ b/include/linux/nfs4.h +@@ -240,7 +240,7 @@ enum nfsstat4 { + + static inline bool seqid_mutating_err(u32 err) + { +- /* rfc 3530 section 8.1.5: */ ++ /* See RFC 7530, section 9.1.7 */ + switch (err) { + case NFS4ERR_STALE_CLIENTID: + case NFS4ERR_STALE_STATEID: +@@ -249,6 +249,7 @@ static inline bool seqid_mutating_err(u32 err) + case NFS4ERR_BADXDR: + case NFS4ERR_RESOURCE: + case NFS4ERR_NOFILEHANDLE: ++ case NFS4ERR_MOVED: + return false; + }; + return true; +diff --git a/include/linux/sunrpc/clnt.h b/include/linux/sunrpc/clnt.h +index 6740801aa71a..5a51d3e5646c 100644 +--- a/include/linux/sunrpc/clnt.h ++++ b/include/linux/sunrpc/clnt.h +@@ -168,5 +168,6 @@ size_t rpc_peeraddr(struct rpc_clnt *, struct sockaddr *, size_t); + const char *rpc_peeraddr2str(struct rpc_clnt *, enum rpc_display_format_t); + int rpc_localaddr(struct rpc_clnt *, struct sockaddr *, size_t); + ++void rpc_cleanup_clids(void); + #endif /* __KERNEL__ */ + #endif /* _LINUX_SUNRPC_CLNT_H */ +diff --git a/include/net/cipso_ipv4.h b/include/net/cipso_ipv4.h +index a8c2ef6d3b93..9078b31d336f 100644 +--- a/include/net/cipso_ipv4.h ++++ b/include/net/cipso_ipv4.h +@@ -303,6 +303,10 @@ static inline int cipso_v4_validate(const struct sk_buff *skb, + } + + for (opt_iter = 6; opt_iter < opt_len;) { ++ if (opt_iter + 1 == opt_len) { ++ err_offset = opt_iter; ++ goto out; ++ } + tag_len = opt[opt_iter + 1]; + if ((tag_len == 0) || (opt[opt_iter + 1] > (opt_len - opt_iter))) { + err_offset = opt_iter + 1; +diff --git a/include/net/if_inet6.h b/include/net/if_inet6.h +index 02ef7727bb55..587e9dd3e3b4 100644 +--- a/include/net/if_inet6.h ++++ b/include/net/if_inet6.h +@@ -166,7 +166,6 @@ struct inet6_dev { + struct net_device *dev; + + struct list_head addr_list; +- int valid_ll_addr_cnt; + + struct ifmcaddr6 *mc_list; + struct ifmcaddr6 *mc_tomb; +diff --git a/include/net/sock.h b/include/net/sock.h +index 238e934dd3c3..467d2f810fb3 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -1554,6 +1554,7 @@ extern struct sk_buff *sock_rmalloc(struct sock *sk, + extern void sock_wfree(struct sk_buff *skb); + extern void skb_orphan_partial(struct sk_buff *skb); + extern void sock_rfree(struct sk_buff *skb); ++void sock_efree(struct sk_buff *skb); + extern void sock_edemux(struct sk_buff *skb); + + extern int sock_setsockopt(struct socket *sock, int level, +diff --git a/kernel/futex.c b/kernel/futex.c +index 509bdd404414..9c6394afd10f 100644 +--- a/kernel/futex.c ++++ b/kernel/futex.c +@@ -2905,4 +2905,4 @@ static int __init futex_init(void) + + return 0; + } +-__initcall(futex_init); ++core_initcall(futex_init); +diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c +index 44a8df70c0ec..1c0315709806 100644 +--- a/kernel/printk/printk.c ++++ b/kernel/printk/printk.c +@@ -1261,7 +1261,7 @@ static void call_console_drivers(int level, const char *text, size_t len) + { + struct console *con; + +- trace_console(text, len); ++ trace_console_rcuidle(text, len); + + if (level >= console_loglevel && !ignore_loglevel) + return; +diff --git a/kernel/sched/core.c b/kernel/sched/core.c +index fe080adbe5a8..426193802b1f 100644 +--- a/kernel/sched/core.c ++++ b/kernel/sched/core.c +@@ -4233,7 +4233,8 @@ void show_state_filter(unsigned long state_filter) + touch_all_softlockup_watchdogs(); + + #ifdef CONFIG_SCHED_DEBUG +- sysrq_sched_debug_show(); ++ if (!state_filter) ++ sysrq_sched_debug_show(); + #endif + rcu_read_unlock(); + /* +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 37b95a2982af..2488148a66d7 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -2229,6 +2229,7 @@ static int __do_proc_doulongvec_minmax(void *data, struct ctl_table *table, int + break; + if (neg) + continue; ++ val = convmul * val / convdiv; + if ((min && val < *min) || (max && val > *max)) + continue; + *i = val; +diff --git a/mm/filemap.c b/mm/filemap.c +index 9fa5c3f40cd6..5fce50a0c898 100644 +--- a/mm/filemap.c ++++ b/mm/filemap.c +@@ -1338,6 +1338,11 @@ static void do_generic_file_read(struct file *filp, loff_t *ppos, + + cond_resched(); + find_page: ++ if (fatal_signal_pending(current)) { ++ error = -EINTR; ++ goto out; ++ } ++ + page = find_get_page(mapping, index); + if (!page) { + page_cache_sync_readahead(mapping, +diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c +index 723978c6f8ab..8b2e127b6af4 100644 +--- a/mm/memory_hotplug.c ++++ b/mm/memory_hotplug.c +@@ -1205,7 +1205,7 @@ int is_mem_section_removable(unsigned long start_pfn, unsigned long nr_pages) + } + + /* +- * Confirm all pages in a range [start, end) is belongs to the same zone. ++ * Confirm all pages in a range [start, end) belong to the same zone. + */ + static int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn) + { +@@ -1213,9 +1213,9 @@ static int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn) + struct zone *zone = NULL; + struct page *page; + int i; +- for (pfn = start_pfn, sec_end_pfn = SECTION_ALIGN_UP(start_pfn); ++ for (pfn = start_pfn, sec_end_pfn = SECTION_ALIGN_UP(start_pfn + 1); + pfn < end_pfn; +- pfn = sec_end_pfn + 1, sec_end_pfn += PAGES_PER_SECTION) { ++ pfn = sec_end_pfn, sec_end_pfn += PAGES_PER_SECTION) { + /* Make sure the memory section is present first */ + if (!present_section_nr(pfn_to_section_nr(pfn))) + continue; +@@ -1234,7 +1234,11 @@ static int test_pages_in_a_zone(unsigned long start_pfn, unsigned long end_pfn) + zone = page_zone(page); + } + } +- return 1; ++ ++ if (zone) ++ return 1; ++ else ++ return 0; + } + + /* +diff --git a/net/can/af_can.c b/net/can/af_can.c +index 5a668268f7ff..86f88598a102 100644 +--- a/net/can/af_can.c ++++ b/net/can/af_can.c +@@ -425,6 +425,7 @@ static struct hlist_head *find_rcv_list(canid_t *can_id, canid_t *mask, + * @func: callback function on filter match + * @data: returned parameter for callback function + * @ident: string for calling module indentification ++ * @sk: socket pointer (might be NULL) + * + * Description: + * Invokes the callback function with the received sk_buff and the given +@@ -448,7 +449,7 @@ static struct hlist_head *find_rcv_list(canid_t *can_id, canid_t *mask, + */ + int can_rx_register(struct net_device *dev, canid_t can_id, canid_t mask, + void (*func)(struct sk_buff *, void *), void *data, +- char *ident) ++ char *ident, struct sock *sk) + { + struct receiver *r; + struct hlist_head *rl; +@@ -476,6 +477,7 @@ int can_rx_register(struct net_device *dev, canid_t can_id, canid_t mask, + r->func = func; + r->data = data; + r->ident = ident; ++ r->sk = sk; + + hlist_add_head_rcu(&r->list, rl); + d->entries++; +@@ -500,8 +502,11 @@ EXPORT_SYMBOL(can_rx_register); + static void can_rx_delete_receiver(struct rcu_head *rp) + { + struct receiver *r = container_of(rp, struct receiver, rcu); ++ struct sock *sk = r->sk; + + kmem_cache_free(rcv_cache, r); ++ if (sk) ++ sock_put(sk); + } + + /** +@@ -576,8 +581,11 @@ void can_rx_unregister(struct net_device *dev, canid_t can_id, canid_t mask, + spin_unlock(&can_rcvlists_lock); + + /* schedule the receiver item for deletion */ +- if (r) ++ if (r) { ++ if (r->sk) ++ sock_hold(r->sk); + call_rcu(&r->rcu, can_rx_delete_receiver); ++ } + } + EXPORT_SYMBOL(can_rx_unregister); + +diff --git a/net/can/af_can.h b/net/can/af_can.h +index 1dccb4c33894..0e95be423587 100644 +--- a/net/can/af_can.h ++++ b/net/can/af_can.h +@@ -50,13 +50,14 @@ + + struct receiver { + struct hlist_node list; +- struct rcu_head rcu; + canid_t can_id; + canid_t mask; + unsigned long matches; + void (*func)(struct sk_buff *, void *); + void *data; + char *ident; ++ struct sock *sk; ++ struct rcu_head rcu; + }; + + enum { RX_ERR, RX_ALL, RX_FIL, RX_INV, RX_EFF, RX_MAX }; +diff --git a/net/can/bcm.c b/net/can/bcm.c +index 392a687d3ca6..d64e8bab7c1a 100644 +--- a/net/can/bcm.c ++++ b/net/can/bcm.c +@@ -706,14 +706,23 @@ static struct bcm_op *bcm_find_op(struct list_head *ops, canid_t can_id, + + static void bcm_remove_op(struct bcm_op *op) + { +- hrtimer_cancel(&op->timer); +- hrtimer_cancel(&op->thrtimer); +- +- if (op->tsklet.func) +- tasklet_kill(&op->tsklet); ++ if (op->tsklet.func) { ++ while (test_bit(TASKLET_STATE_SCHED, &op->tsklet.state) || ++ test_bit(TASKLET_STATE_RUN, &op->tsklet.state) || ++ hrtimer_active(&op->timer)) { ++ hrtimer_cancel(&op->timer); ++ tasklet_kill(&op->tsklet); ++ } ++ } + +- if (op->thrtsklet.func) +- tasklet_kill(&op->thrtsklet); ++ if (op->thrtsklet.func) { ++ while (test_bit(TASKLET_STATE_SCHED, &op->thrtsklet.state) || ++ test_bit(TASKLET_STATE_RUN, &op->thrtsklet.state) || ++ hrtimer_active(&op->thrtimer)) { ++ hrtimer_cancel(&op->thrtimer); ++ tasklet_kill(&op->thrtsklet); ++ } ++ } + + if ((op->frames) && (op->frames != &op->sframe)) + kfree(op->frames); +@@ -1169,7 +1178,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, + err = can_rx_register(dev, op->can_id, + REGMASK(op->can_id), + bcm_rx_handler, op, +- "bcm"); ++ "bcm", sk); + + op->rx_reg_dev = dev; + dev_put(dev); +@@ -1178,7 +1187,7 @@ static int bcm_rx_setup(struct bcm_msg_head *msg_head, struct msghdr *msg, + } else + err = can_rx_register(NULL, op->can_id, + REGMASK(op->can_id), +- bcm_rx_handler, op, "bcm"); ++ bcm_rx_handler, op, "bcm", sk); + if (err) { + /* this bcm rx op is broken -> remove it */ + list_del(&op->list); +diff --git a/net/can/gw.c b/net/can/gw.c +index 233ce53c1852..3ce56716041d 100644 +--- a/net/can/gw.c ++++ b/net/can/gw.c +@@ -441,7 +441,7 @@ static inline int cgw_register_filter(struct cgw_job *gwj) + { + return can_rx_register(gwj->src.dev, gwj->ccgw.filter.can_id, + gwj->ccgw.filter.can_mask, can_can_gw_rcv, +- gwj, "gw"); ++ gwj, "gw", NULL); + } + + static inline void cgw_unregister_filter(struct cgw_job *gwj) +diff --git a/net/can/raw.c b/net/can/raw.c +index e10699cc72bd..65a0553bc14b 100644 +--- a/net/can/raw.c ++++ b/net/can/raw.c +@@ -168,7 +168,7 @@ static int raw_enable_filters(struct net_device *dev, struct sock *sk, + for (i = 0; i < count; i++) { + err = can_rx_register(dev, filter[i].can_id, + filter[i].can_mask, +- raw_rcv, sk, "raw"); ++ raw_rcv, sk, "raw", sk); + if (err) { + /* clean up successfully registered filters */ + while (--i >= 0) +@@ -189,7 +189,7 @@ static int raw_enable_errfilter(struct net_device *dev, struct sock *sk, + + if (err_mask) + err = can_rx_register(dev, 0, err_mask | CAN_ERR_FLAG, +- raw_rcv, sk, "raw"); ++ raw_rcv, sk, "raw", sk); + + return err; + } +diff --git a/net/core/dev.c b/net/core/dev.c +index 6b0ddf661f92..349ee899b3f0 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -1594,24 +1594,19 @@ EXPORT_SYMBOL(call_netdevice_notifiers); + + static struct static_key netstamp_needed __read_mostly; + #ifdef HAVE_JUMP_LABEL +-/* We are not allowed to call static_key_slow_dec() from irq context +- * If net_disable_timestamp() is called from irq context, defer the +- * static_key_slow_dec() calls. +- */ + static atomic_t netstamp_needed_deferred; +-#endif +- +-void net_enable_timestamp(void) ++static void netstamp_clear(struct work_struct *work) + { +-#ifdef HAVE_JUMP_LABEL + int deferred = atomic_xchg(&netstamp_needed_deferred, 0); + +- if (deferred) { +- while (--deferred) +- static_key_slow_dec(&netstamp_needed); +- return; +- } ++ while (deferred--) ++ static_key_slow_dec(&netstamp_needed); ++} ++static DECLARE_WORK(netstamp_work, netstamp_clear); + #endif ++ ++void net_enable_timestamp(void) ++{ + static_key_slow_inc(&netstamp_needed); + } + EXPORT_SYMBOL(net_enable_timestamp); +@@ -1619,12 +1614,12 @@ EXPORT_SYMBOL(net_enable_timestamp); + void net_disable_timestamp(void) + { + #ifdef HAVE_JUMP_LABEL +- if (in_interrupt()) { +- atomic_inc(&netstamp_needed_deferred); +- return; +- } +-#endif ++ /* net_disable_timestamp() can be called from non process context */ ++ atomic_inc(&netstamp_needed_deferred); ++ schedule_work(&netstamp_work); ++#else + static_key_slow_dec(&netstamp_needed); ++#endif + } + EXPORT_SYMBOL(net_disable_timestamp); + +@@ -2489,9 +2484,9 @@ static netdev_features_t harmonize_features(struct sk_buff *skb, + if (skb->ip_summed != CHECKSUM_NONE && + !can_checksum_protocol(features, skb_network_protocol(skb))) { + features &= ~NETIF_F_ALL_CSUM; +- } else if (illegal_highdma(dev, skb)) { +- features &= ~NETIF_F_SG; + } ++ if (illegal_highdma(dev, skb)) ++ features &= ~NETIF_F_SG; + + return features; + } +diff --git a/net/core/dst.c b/net/core/dst.c +index 31344009de25..08c9a8f7b885 100644 +--- a/net/core/dst.c ++++ b/net/core/dst.c +@@ -280,12 +280,13 @@ void dst_release(struct dst_entry *dst) + { + if (dst) { + int newrefcnt; ++ unsigned short nocache = dst->flags & DST_NOCACHE; + + newrefcnt = atomic_dec_return(&dst->__refcnt); + if (unlikely(newrefcnt < 0)) + net_warn_ratelimited("%s: dst:%p refcnt:%d\n", + __func__, dst, newrefcnt); +- if (!newrefcnt && unlikely(dst->flags & DST_NOCACHE)) ++ if (!newrefcnt && unlikely(nocache)) + call_rcu(&dst->rcu_head, dst_destroy_rcu); + } + } +diff --git a/net/core/sock.c b/net/core/sock.c +index 7fa427ed41bc..d765d6411a5b 100644 +--- a/net/core/sock.c ++++ b/net/core/sock.c +@@ -1656,6 +1656,12 @@ void sock_rfree(struct sk_buff *skb) + } + EXPORT_SYMBOL(sock_rfree); + ++void sock_efree(struct sk_buff *skb) ++{ ++ sock_put(skb->sk); ++} ++EXPORT_SYMBOL(sock_efree); ++ + void sock_edemux(struct sk_buff *skb) + { + struct sock *sk = skb->sk; +diff --git a/net/dccp/input.c b/net/dccp/input.c +index 14cdafad7a90..e511ccc74a07 100644 +--- a/net/dccp/input.c ++++ b/net/dccp/input.c +@@ -606,7 +606,8 @@ int dccp_rcv_state_process(struct sock *sk, struct sk_buff *skb, + if (inet_csk(sk)->icsk_af_ops->conn_request(sk, + skb) < 0) + return 1; +- goto discard; ++ consume_skb(skb); ++ return 0; + } + if (dh->dccph_type == DCCP_PKT_RESET) + goto discard; +diff --git a/net/ieee802154/6lowpan.c b/net/ieee802154/6lowpan.c +index ceabe6f13216..a377d435756e 100644 +--- a/net/ieee802154/6lowpan.c ++++ b/net/ieee802154/6lowpan.c +@@ -548,7 +548,7 @@ static int lowpan_header_create(struct sk_buff *skb, + hc06_ptr += 3; + } else { + /* compress nothing */ +- memcpy(hc06_ptr, &hdr, 4); ++ memcpy(hc06_ptr, hdr, 4); + /* replace the top byte with new ECN | DSCP format */ + *hc06_ptr = tmp; + hc06_ptr += 4; +@@ -1392,8 +1392,10 @@ static int lowpan_newlink(struct net *src_net, struct net_device *dev, + real_dev = dev_get_by_index(src_net, nla_get_u32(tb[IFLA_LINK])); + if (!real_dev) + return -ENODEV; +- if (real_dev->type != ARPHRD_IEEE802154) ++ if (real_dev->type != ARPHRD_IEEE802154) { ++ dev_put(real_dev); + return -EINVAL; ++ } + + lowpan_dev_info(dev)->real_dev = real_dev; + lowpan_dev_info(dev)->fragment_tag = 0; +diff --git a/net/ipv4/cipso_ipv4.c b/net/ipv4/cipso_ipv4.c +index 667c1d4ca984..4322372dddbe 100644 +--- a/net/ipv4/cipso_ipv4.c ++++ b/net/ipv4/cipso_ipv4.c +@@ -1649,6 +1649,10 @@ int cipso_v4_validate(const struct sk_buff *skb, unsigned char **option) + goto validate_return_locked; + } + ++ if (opt_iter + 1 == opt_len) { ++ err_offset = opt_iter; ++ goto validate_return_locked; ++ } + tag_len = tag[1]; + if (tag_len > (opt_len - opt_iter)) { + err_offset = opt_iter + 1; +diff --git a/net/ipv4/ip_sockglue.c b/net/ipv4/ip_sockglue.c +index 9e4f832aaf13..5a7bb6cb22bb 100644 +--- a/net/ipv4/ip_sockglue.c ++++ b/net/ipv4/ip_sockglue.c +@@ -1044,7 +1044,14 @@ void ipv4_pktinfo_prepare(struct sk_buff *skb) + pktinfo->ipi_ifindex = 0; + pktinfo->ipi_spec_dst.s_addr = 0; + } +- skb_dst_drop(skb); ++ /* We need to keep the dst for __ip_options_echo() ++ * We could restrict the test to opt.ts_needtime || opt.srr, ++ * but the following is good enough as IP options are not often used. ++ */ ++ if (unlikely(IPCB(skb)->opt.optlen)) ++ skb_dst_force(skb); ++ else ++ skb_dst_drop(skb); + } + + int ip_setsockopt(struct sock *sk, int level, +diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c +index 33e2bf806249..e8e662331720 100644 +--- a/net/ipv4/ip_vti.c ++++ b/net/ipv4/ip_vti.c +@@ -283,7 +283,6 @@ static int vti_tunnel_init(struct net_device *dev) + memcpy(dev->dev_addr, &iph->saddr, 4); + memcpy(dev->broadcast, &iph->daddr, 4); + +- dev->hard_header_len = LL_MAX_HEADER + sizeof(struct iphdr); + dev->mtu = ETH_DATA_LEN; + dev->flags = IFF_NOARP; + dev->iflink = 0; +diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c +index 6de66893a488..6be49858c86f 100644 +--- a/net/ipv4/ping.c ++++ b/net/ipv4/ping.c +@@ -640,6 +640,8 @@ static int ping_v4_push_pending_frames(struct sock *sk, struct pingfakehdr *pfh, + { + struct sk_buff *skb = skb_peek(&sk->sk_write_queue); + ++ if (!skb) ++ return 0; + pfh->wcheck = csum_partial((char *)&pfh->icmph, + sizeof(struct icmphdr), pfh->wcheck); + pfh->icmph.checksum = csum_fold(pfh->wcheck); +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 3e63b5fb2121..3d2e55c5458e 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -722,6 +722,12 @@ ssize_t tcp_splice_read(struct socket *sock, loff_t *ppos, + ret = -EAGAIN; + break; + } ++ /* if __tcp_splice_read() got nothing while we have ++ * an skb in receive queue, we do not want to loop. ++ * This might happen with URG data. ++ */ ++ if (!skb_queue_empty(&sk->sk_receive_queue)) ++ break; + sk_wait_data(sk, &timeo); + if (signal_pending(current)) { + ret = sock_intr_errno(timeo); +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index 57f5bad5650c..12504f57fd7b 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -1408,6 +1408,7 @@ static int tcp_v4_conn_req_fastopen(struct sock *sk, + * scaled. So correct it appropriately. + */ + tp->snd_wnd = ntohs(tcp_hdr(skb)->window); ++ tp->max_window = tp->snd_wnd; + + /* Activate the retrans timer so that SYNACK can be retransmitted. + * The request socket is not added to the SYN table of the parent +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index c807d5790ca1..d92c4b69f7ea 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -2163,9 +2163,11 @@ u32 __tcp_select_window(struct sock *sk) + int full_space = min_t(int, tp->window_clamp, tcp_full_space(sk)); + int window; + +- if (mss > full_space) ++ if (unlikely(mss > full_space)) { + mss = full_space; +- ++ if (mss <= 0) ++ return 0; ++ } + if (free_space < (full_space >> 1)) { + icsk->icsk_ack.quick = 0; + +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index 1e31fc5477e8..1452e113e8e4 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -3237,6 +3237,22 @@ out: + in6_ifa_put(ifp); + } + ++/* ifp->idev must be at least read locked */ ++static bool ipv6_lonely_lladdr(struct inet6_ifaddr *ifp) ++{ ++ struct inet6_ifaddr *ifpiter; ++ struct inet6_dev *idev = ifp->idev; ++ ++ list_for_each_entry(ifpiter, &idev->addr_list, if_list) { ++ if (ifp != ifpiter && ifpiter->scope == IFA_LINK && ++ (ifpiter->flags & (IFA_F_PERMANENT|IFA_F_TENTATIVE| ++ IFA_F_OPTIMISTIC|IFA_F_DADFAILED)) == ++ IFA_F_PERMANENT) ++ return false; ++ } ++ return true; ++} ++ + static void addrconf_dad_completed(struct inet6_ifaddr *ifp) + { + struct net_device *dev = ifp->idev->dev; +@@ -3256,14 +3272,11 @@ static void addrconf_dad_completed(struct inet6_ifaddr *ifp) + */ + + read_lock_bh(&ifp->idev->lock); +- spin_lock(&ifp->lock); +- send_mld = ipv6_addr_type(&ifp->addr) & IPV6_ADDR_LINKLOCAL && +- ifp->idev->valid_ll_addr_cnt == 1; ++ send_mld = ifp->scope == IFA_LINK && ipv6_lonely_lladdr(ifp); + send_rs = send_mld && + ipv6_accept_ra(ifp->idev) && + ifp->idev->cnf.rtr_solicits > 0 && + (dev->flags&IFF_LOOPBACK) == 0; +- spin_unlock(&ifp->lock); + read_unlock_bh(&ifp->idev->lock); + + /* While dad is in progress mld report's source address is in6_addrany. +@@ -4558,19 +4571,6 @@ errout: + rtnl_set_sk_err(net, RTNLGRP_IPV6_PREFIX, err); + } + +-static void update_valid_ll_addr_cnt(struct inet6_ifaddr *ifp, int count) +-{ +- write_lock_bh(&ifp->idev->lock); +- spin_lock(&ifp->lock); +- if (((ifp->flags & (IFA_F_PERMANENT|IFA_F_TENTATIVE|IFA_F_OPTIMISTIC| +- IFA_F_DADFAILED)) == IFA_F_PERMANENT) && +- (ipv6_addr_type(&ifp->addr) & IPV6_ADDR_LINKLOCAL)) +- ifp->idev->valid_ll_addr_cnt += count; +- WARN_ON(ifp->idev->valid_ll_addr_cnt < 0); +- spin_unlock(&ifp->lock); +- write_unlock_bh(&ifp->idev->lock); +-} +- + static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp) + { + struct net *net = dev_net(ifp->idev->dev); +@@ -4579,8 +4579,6 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp) + + switch (event) { + case RTM_NEWADDR: +- update_valid_ll_addr_cnt(ifp, 1); +- + /* + * If the address was optimistic + * we inserted the route at the start of +@@ -4596,8 +4594,6 @@ static void __ipv6_ifa_notify(int event, struct inet6_ifaddr *ifp) + ifp->idev->dev, 0, 0); + break; + case RTM_DELADDR: +- update_valid_ll_addr_cnt(ifp, -1); +- + if (ifp->idev->cnf.forwarding) + addrconf_leave_anycast(ifp); + addrconf_leave_solict(ifp->idev, &ifp->addr); +@@ -4693,8 +4689,7 @@ static void addrconf_disable_change(struct net *net, __s32 newf) + struct net_device *dev; + struct inet6_dev *idev; + +- rcu_read_lock(); +- for_each_netdev_rcu(net, dev) { ++ for_each_netdev(net, dev) { + idev = __in6_dev_get(dev); + if (idev) { + int changed = (!idev->cnf.disable_ipv6) ^ (!newf); +@@ -4703,7 +4698,6 @@ static void addrconf_disable_change(struct net *net, __s32 newf) + dev_disable_change(idev); + } + } +- rcu_read_unlock(); + } + + static int addrconf_disable_ipv6(struct ctl_table *table, int *p, int newf) +diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c +index 6b5acd50103f..bb3e8326cacb 100644 +--- a/net/ipv6/ip6_gre.c ++++ b/net/ipv6/ip6_gre.c +@@ -55,6 +55,7 @@ + #include <net/ip6_fib.h> + #include <net/ip6_route.h> + #include <net/ip6_tunnel.h> ++#include <net/gre.h> + + + static bool log_ecn_error = true; +@@ -366,35 +367,37 @@ static void ip6gre_tunnel_uninit(struct net_device *dev) + + + static void ip6gre_err(struct sk_buff *skb, struct inet6_skb_parm *opt, +- u8 type, u8 code, int offset, __be32 info) ++ u8 type, u8 code, int offset, __be32 info) + { +- const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)skb->data; +- __be16 *p = (__be16 *)(skb->data + offset); +- int grehlen = offset + 4; ++ const struct gre_base_hdr *greh; ++ const struct ipv6hdr *ipv6h; ++ int grehlen = sizeof(*greh); + struct ip6_tnl *t; ++ int key_off = 0; + __be16 flags; ++ __be32 key; + +- flags = p[0]; +- if (flags&(GRE_CSUM|GRE_KEY|GRE_SEQ|GRE_ROUTING|GRE_VERSION)) { +- if (flags&(GRE_VERSION|GRE_ROUTING)) +- return; +- if (flags&GRE_KEY) { +- grehlen += 4; +- if (flags&GRE_CSUM) +- grehlen += 4; +- } ++ if (!pskb_may_pull(skb, offset + grehlen)) ++ return; ++ greh = (const struct gre_base_hdr *)(skb->data + offset); ++ flags = greh->flags; ++ if (flags & (GRE_VERSION | GRE_ROUTING)) ++ return; ++ if (flags & GRE_CSUM) ++ grehlen += 4; ++ if (flags & GRE_KEY) { ++ key_off = grehlen + offset; ++ grehlen += 4; + } + +- /* If only 8 bytes returned, keyed message will be dropped here */ +- if (!pskb_may_pull(skb, grehlen)) ++ if (!pskb_may_pull(skb, offset + grehlen)) + return; + ipv6h = (const struct ipv6hdr *)skb->data; +- p = (__be16 *)(skb->data + offset); ++ greh = (const struct gre_base_hdr *)(skb->data + offset); ++ key = key_off ? *(__be32 *)(skb->data + key_off) : 0; + + t = ip6gre_tunnel_lookup(skb->dev, &ipv6h->daddr, &ipv6h->saddr, +- flags & GRE_KEY ? +- *(((__be32 *)p) + (grehlen / 4) - 1) : 0, +- p[1]); ++ key, greh->protocol); + if (t == NULL) + return; + +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index 9a625b1ae10f..509fbc805017 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -104,16 +104,25 @@ struct ip6_tnl_net { + + static struct net_device_stats *ip6_get_stats(struct net_device *dev) + { +- struct pcpu_tstats sum = { 0 }; ++ struct pcpu_tstats tmp, sum = { 0 }; + int i; + + for_each_possible_cpu(i) { ++ unsigned int start; + const struct pcpu_tstats *tstats = per_cpu_ptr(dev->tstats, i); + +- sum.rx_packets += tstats->rx_packets; +- sum.rx_bytes += tstats->rx_bytes; +- sum.tx_packets += tstats->tx_packets; +- sum.tx_bytes += tstats->tx_bytes; ++ do { ++ start = u64_stats_fetch_begin_bh(&tstats->syncp); ++ tmp.rx_packets = tstats->rx_packets; ++ tmp.rx_bytes = tstats->rx_bytes; ++ tmp.tx_packets = tstats->tx_packets; ++ tmp.tx_bytes = tstats->tx_bytes; ++ } while (u64_stats_fetch_retry_bh(&tstats->syncp, start)); ++ ++ sum.rx_packets += tmp.rx_packets; ++ sum.rx_bytes += tmp.rx_bytes; ++ sum.tx_packets += tmp.tx_packets; ++ sum.tx_bytes += tmp.tx_bytes; + } + dev->stats.rx_packets = sum.rx_packets; + dev->stats.rx_bytes = sum.rx_bytes; +@@ -396,18 +405,19 @@ ip6_tnl_dev_uninit(struct net_device *dev) + + __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw) + { +- const struct ipv6hdr *ipv6h = (const struct ipv6hdr *) raw; +- __u8 nexthdr = ipv6h->nexthdr; +- __u16 off = sizeof (*ipv6h); ++ const struct ipv6hdr *ipv6h = (const struct ipv6hdr *)raw; ++ unsigned int nhoff = raw - skb->data; ++ unsigned int off = nhoff + sizeof(*ipv6h); ++ u8 next, nexthdr = ipv6h->nexthdr; + + while (ipv6_ext_hdr(nexthdr) && nexthdr != NEXTHDR_NONE) { +- __u16 optlen = 0; + struct ipv6_opt_hdr *hdr; +- if (raw + off + sizeof (*hdr) > skb->data && +- !pskb_may_pull(skb, raw - skb->data + off + sizeof (*hdr))) ++ u16 optlen; ++ ++ if (!pskb_may_pull(skb, off + sizeof(*hdr))) + break; + +- hdr = (struct ipv6_opt_hdr *) (raw + off); ++ hdr = (struct ipv6_opt_hdr *)(skb->data + off); + if (nexthdr == NEXTHDR_FRAGMENT) { + struct frag_hdr *frag_hdr = (struct frag_hdr *) hdr; + if (frag_hdr->frag_off) +@@ -418,20 +428,29 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw) + } else { + optlen = ipv6_optlen(hdr); + } ++ /* cache hdr->nexthdr, since pskb_may_pull() might ++ * invalidate hdr ++ */ ++ next = hdr->nexthdr; + if (nexthdr == NEXTHDR_DEST) { +- __u16 i = off + 2; ++ u16 i = 2; ++ ++ /* Remember : hdr is no longer valid at this point. */ ++ if (!pskb_may_pull(skb, off + optlen)) ++ break; ++ + while (1) { + struct ipv6_tlv_tnl_enc_lim *tel; + + /* No more room for encapsulation limit */ +- if (i + sizeof (*tel) > off + optlen) ++ if (i + sizeof(*tel) > optlen) + break; + +- tel = (struct ipv6_tlv_tnl_enc_lim *) &raw[i]; ++ tel = (struct ipv6_tlv_tnl_enc_lim *)(skb->data + off + i); + /* return index of option if found and valid */ + if (tel->type == IPV6_TLV_TNL_ENCAP_LIMIT && + tel->length == 1) +- return i; ++ return i + off - nhoff; + /* else jump to next option */ + if (tel->type) + i += tel->length + 2; +@@ -439,7 +458,7 @@ __u16 ip6_tnl_parse_tlv_enc_lim(struct sk_buff *skb, __u8 *raw) + i++; + } + } +- nexthdr = hdr->nexthdr; ++ nexthdr = next; + off += optlen; + } + return 0; +@@ -822,8 +841,10 @@ static int ip6_tnl_rcv(struct sk_buff *skb, __u16 protocol, + } + + tstats = this_cpu_ptr(t->dev->tstats); ++ u64_stats_update_begin(&tstats->syncp); + tstats->rx_packets++; + tstats->rx_bytes += skb->len; ++ u64_stats_update_end(&tstats->syncp); + + netif_rx(skb); + +diff --git a/net/irda/irqueue.c b/net/irda/irqueue.c +index 7152624ed5f1..26ccd65cdcab 100644 +--- a/net/irda/irqueue.c ++++ b/net/irda/irqueue.c +@@ -385,9 +385,6 @@ EXPORT_SYMBOL(hashbin_new); + * for deallocating this structure if it's complex. If not the user can + * just supply kfree, which should take care of the job. + */ +-#ifdef CONFIG_LOCKDEP +-static int hashbin_lock_depth = 0; +-#endif + int hashbin_delete( hashbin_t* hashbin, FREE_FUNC free_func) + { + irda_queue_t* queue; +@@ -398,22 +395,27 @@ int hashbin_delete( hashbin_t* hashbin, FREE_FUNC free_func) + IRDA_ASSERT(hashbin->magic == HB_MAGIC, return -1;); + + /* Synchronize */ +- if ( hashbin->hb_type & HB_LOCK ) { +- spin_lock_irqsave_nested(&hashbin->hb_spinlock, flags, +- hashbin_lock_depth++); +- } ++ if (hashbin->hb_type & HB_LOCK) ++ spin_lock_irqsave(&hashbin->hb_spinlock, flags); + + /* + * Free the entries in the hashbin, TODO: use hashbin_clear when + * it has been shown to work + */ + for (i = 0; i < HASHBIN_SIZE; i ++ ) { +- queue = dequeue_first((irda_queue_t**) &hashbin->hb_queue[i]); +- while (queue ) { +- if (free_func) +- (*free_func)(queue); +- queue = dequeue_first( +- (irda_queue_t**) &hashbin->hb_queue[i]); ++ while (1) { ++ queue = dequeue_first((irda_queue_t**) &hashbin->hb_queue[i]); ++ ++ if (!queue) ++ break; ++ ++ if (free_func) { ++ if (hashbin->hb_type & HB_LOCK) ++ spin_unlock_irqrestore(&hashbin->hb_spinlock, flags); ++ free_func(queue); ++ if (hashbin->hb_type & HB_LOCK) ++ spin_lock_irqsave(&hashbin->hb_spinlock, flags); ++ } + } + } + +@@ -422,12 +424,8 @@ int hashbin_delete( hashbin_t* hashbin, FREE_FUNC free_func) + hashbin->magic = ~HB_MAGIC; + + /* Release lock */ +- if ( hashbin->hb_type & HB_LOCK) { ++ if (hashbin->hb_type & HB_LOCK) + spin_unlock_irqrestore(&hashbin->hb_spinlock, flags); +-#ifdef CONFIG_LOCKDEP +- hashbin_lock_depth--; +-#endif +- } + + /* + * Free the hashbin structure +diff --git a/net/l2tp/l2tp_core.h b/net/l2tp/l2tp_core.h +index 6f251cbc2ed7..f8f1089ee8f2 100644 +--- a/net/l2tp/l2tp_core.h ++++ b/net/l2tp/l2tp_core.h +@@ -261,6 +261,7 @@ extern int l2tp_xmit_skb(struct l2tp_session *session, struct sk_buff *skb, int + + extern int l2tp_nl_register_ops(enum l2tp_pwtype pw_type, const struct l2tp_nl_cmd_ops *ops); + extern void l2tp_nl_unregister_ops(enum l2tp_pwtype pw_type); ++int l2tp_ioctl(struct sock *sk, int cmd, unsigned long arg); + + /* Session reference counts. Incremented when code obtains a reference + * to a session. +diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c +index 81f317f841b4..b69b762159ad 100644 +--- a/net/l2tp/l2tp_ip.c ++++ b/net/l2tp/l2tp_ip.c +@@ -11,6 +11,7 @@ + + #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + ++#include <asm/ioctls.h> + #include <linux/icmp.h> + #include <linux/module.h> + #include <linux/skbuff.h> +@@ -555,6 +556,30 @@ out: + return err ? err : copied; + } + ++int l2tp_ioctl(struct sock *sk, int cmd, unsigned long arg) ++{ ++ struct sk_buff *skb; ++ int amount; ++ ++ switch (cmd) { ++ case SIOCOUTQ: ++ amount = sk_wmem_alloc_get(sk); ++ break; ++ case SIOCINQ: ++ spin_lock_bh(&sk->sk_receive_queue.lock); ++ skb = skb_peek(&sk->sk_receive_queue); ++ amount = skb ? skb->len : 0; ++ spin_unlock_bh(&sk->sk_receive_queue.lock); ++ break; ++ ++ default: ++ return -ENOIOCTLCMD; ++ } ++ ++ return put_user(amount, (int __user *)arg); ++} ++EXPORT_SYMBOL(l2tp_ioctl); ++ + static struct proto l2tp_ip_prot = { + .name = "L2TP/IP", + .owner = THIS_MODULE, +@@ -563,7 +588,7 @@ static struct proto l2tp_ip_prot = { + .bind = l2tp_ip_bind, + .connect = l2tp_ip_connect, + .disconnect = l2tp_ip_disconnect, +- .ioctl = udp_ioctl, ++ .ioctl = l2tp_ioctl, + .destroy = l2tp_ip_destroy_sock, + .setsockopt = ip_setsockopt, + .getsockopt = ip_getsockopt, +diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c +index 7c1a288f0b20..8783dfe5ac6c 100644 +--- a/net/l2tp/l2tp_ip6.c ++++ b/net/l2tp/l2tp_ip6.c +@@ -721,7 +721,7 @@ static struct proto l2tp_ip6_prot = { + .bind = l2tp_ip6_bind, + .connect = l2tp_ip6_connect, + .disconnect = l2tp_ip6_disconnect, +- .ioctl = udp_ioctl, ++ .ioctl = l2tp_ioctl, + .destroy = l2tp_ip6_destroy_sock, + .setsockopt = ipv6_setsockopt, + .getsockopt = ipv6_getsockopt, +diff --git a/net/llc/llc_conn.c b/net/llc/llc_conn.c +index cd8724177965..6d36b3241b98 100644 +--- a/net/llc/llc_conn.c ++++ b/net/llc/llc_conn.c +@@ -821,7 +821,10 @@ void llc_conn_handler(struct llc_sap *sap, struct sk_buff *skb) + * another trick required to cope with how the PROCOM state + * machine works. -acme + */ ++ skb_orphan(skb); ++ sock_hold(sk); + skb->sk = sk; ++ skb->destructor = sock_efree; + } + if (!sock_owned_by_user(sk)) + llc_conn_rcv(sk, skb); +diff --git a/net/llc/llc_sap.c b/net/llc/llc_sap.c +index e5850699098e..4ee1e1142e8e 100644 +--- a/net/llc/llc_sap.c ++++ b/net/llc/llc_sap.c +@@ -290,7 +290,10 @@ static void llc_sap_rcv(struct llc_sap *sap, struct sk_buff *skb, + + ev->type = LLC_SAP_EV_TYPE_PDU; + ev->reason = 0; ++ skb_orphan(skb); ++ sock_hold(sk); + skb->sk = sk; ++ skb->destructor = sock_efree; + llc_sap_state_process(sap, skb); + } + +diff --git a/net/mac80211/mesh.c b/net/mac80211/mesh.c +index 67559f7a7832..732cc22fbe26 100644 +--- a/net/mac80211/mesh.c ++++ b/net/mac80211/mesh.c +@@ -345,7 +345,7 @@ int mesh_add_vendor_ies(struct ieee80211_sub_if_data *sdata, + /* fast-forward to vendor IEs */ + offset = ieee80211_ie_split_vendor(ifmsh->ie, ifmsh->ie_len, 0); + +- if (offset) { ++ if (offset < ifmsh->ie_len) { + len = ifmsh->ie_len - offset; + data = ifmsh->ie + offset; + if (skb_tailroom(skb) < len) +diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c +index 40d82575adc1..dfea5968a582 100644 +--- a/net/packet/af_packet.c ++++ b/net/packet/af_packet.c +@@ -1268,6 +1268,8 @@ static void __fanout_link(struct sock *sk, struct packet_sock *po) + f->arr[f->num_members] = sk; + smp_wmb(); + f->num_members++; ++ if (f->num_members == 1) ++ dev_add_pack(&f->prot_hook); + spin_unlock(&f->lock); + } + +@@ -1284,6 +1286,8 @@ static void __fanout_unlink(struct sock *sk, struct packet_sock *po) + BUG_ON(i >= f->num_members); + f->arr[i] = f->arr[f->num_members - 1]; + f->num_members--; ++ if (f->num_members == 0) ++ __dev_remove_pack(&f->prot_hook); + spin_unlock(&f->lock); + } + +@@ -1316,13 +1320,16 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags) + return -EINVAL; + } + ++ mutex_lock(&fanout_mutex); ++ ++ err = -EINVAL; + if (!po->running) +- return -EINVAL; ++ goto out; + ++ err = -EALREADY; + if (po->fanout) +- return -EALREADY; ++ goto out; + +- mutex_lock(&fanout_mutex); + match = NULL; + list_for_each_entry(f, &fanout_list, list) { + if (f->id == id && +@@ -1352,7 +1359,6 @@ static int fanout_add(struct sock *sk, u16 id, u16 type_flags) + match->prot_hook.func = packet_rcv_fanout; + match->prot_hook.af_packet_priv = match; + match->prot_hook.id_match = match_fanout_group; +- dev_add_pack(&match->prot_hook); + list_add(&match->list, &fanout_list); + } + err = -EINVAL; +@@ -1373,24 +1379,29 @@ out: + return err; + } + +-static void fanout_release(struct sock *sk) ++/* If pkt_sk(sk)->fanout->sk_ref is zero, this function removes ++ * pkt_sk(sk)->fanout from fanout_list and returns pkt_sk(sk)->fanout. ++ * It is the responsibility of the caller to call fanout_release_data() and ++ * free the returned packet_fanout (after synchronize_net()) ++ */ ++static struct packet_fanout *fanout_release(struct sock *sk) + { + struct packet_sock *po = pkt_sk(sk); + struct packet_fanout *f; + +- f = po->fanout; +- if (!f) +- return; +- + mutex_lock(&fanout_mutex); +- po->fanout = NULL; ++ f = po->fanout; ++ if (f) { ++ po->fanout = NULL; + +- if (atomic_dec_and_test(&f->sk_ref)) { +- list_del(&f->list); +- dev_remove_pack(&f->prot_hook); +- kfree(f); ++ if (atomic_dec_and_test(&f->sk_ref)) ++ list_del(&f->list); ++ else ++ f = NULL; + } + mutex_unlock(&fanout_mutex); ++ ++ return f; + } + + static const struct proto_ops packet_ops; +@@ -2255,7 +2266,7 @@ static int packet_snd(struct socket *sock, + int vnet_hdr_len; + struct packet_sock *po = pkt_sk(sk); + unsigned short gso_type = 0; +- int hlen, tlen; ++ int hlen, tlen, linear; + int extra_len = 0; + + /* +@@ -2349,7 +2360,9 @@ static int packet_snd(struct socket *sock, + err = -ENOBUFS; + hlen = LL_RESERVED_SPACE(dev); + tlen = dev->needed_tailroom; +- skb = packet_alloc_skb(sk, hlen + tlen, hlen, len, vnet_hdr.hdr_len, ++ linear = vnet_hdr.hdr_len; ++ linear = max(linear, min_t(int, len, dev->hard_header_len)); ++ skb = packet_alloc_skb(sk, hlen + tlen, hlen, len, linear, + msg->msg_flags & MSG_DONTWAIT, &err); + if (skb == NULL) + goto out_unlock; +@@ -2452,6 +2465,7 @@ static int packet_release(struct socket *sock) + { + struct sock *sk = sock->sk; + struct packet_sock *po; ++ struct packet_fanout *f; + struct net *net; + union tpacket_req_u req_u; + +@@ -2491,9 +2505,13 @@ static int packet_release(struct socket *sock) + packet_set_ring(sk, &req_u, 1, 1); + } + +- fanout_release(sk); ++ f = fanout_release(sk); + + synchronize_net(); ++ ++ if (f) { ++ kfree(f); ++ } + /* + * Now the socket is dead. No more input will appear. + */ +@@ -3371,7 +3389,6 @@ static int packet_notifier(struct notifier_block *this, + } + if (msg == NETDEV_UNREGISTER) { + packet_cached_dev_reset(po); +- fanout_release(sk); + po->ifindex = -1; + if (po->prot_hook.dev) + dev_put(po->prot_hook.dev); +@@ -3660,7 +3677,7 @@ static int packet_set_ring(struct sock *sk, union tpacket_req_u *req_u, + */ + if (!tx_ring) + init_prb_bdqc(po, rb, pg_vec, req_u, tx_ring); +- break; ++ break; + default: + break; + } +diff --git a/net/sctp/associola.c b/net/sctp/associola.c +index 88ca530f1d1a..1c58a980f0c2 100644 +--- a/net/sctp/associola.c ++++ b/net/sctp/associola.c +@@ -1286,78 +1286,107 @@ void sctp_assoc_update(struct sctp_association *asoc, + } + + /* Update the retran path for sending a retransmitted packet. +- * Round-robin through the active transports, else round-robin +- * through the inactive transports as this is the next best thing +- * we can try. ++ * See also RFC4960, 6.4. Multi-Homed SCTP Endpoints: ++ * ++ * When there is outbound data to send and the primary path ++ * becomes inactive (e.g., due to failures), or where the ++ * SCTP user explicitly requests to send data to an ++ * inactive destination transport address, before reporting ++ * an error to its ULP, the SCTP endpoint should try to send ++ * the data to an alternate active destination transport ++ * address if one exists. ++ * ++ * When retransmitting data that timed out, if the endpoint ++ * is multihomed, it should consider each source-destination ++ * address pair in its retransmission selection policy. ++ * When retransmitting timed-out data, the endpoint should ++ * attempt to pick the most divergent source-destination ++ * pair from the original source-destination pair to which ++ * the packet was transmitted. ++ * ++ * Note: Rules for picking the most divergent source-destination ++ * pair are an implementation decision and are not specified ++ * within this document. ++ * ++ * Our basic strategy is to round-robin transports in priorities ++ * according to sctp_state_prio_map[] e.g., if no such ++ * transport with state SCTP_ACTIVE exists, round-robin through ++ * SCTP_UNKNOWN, etc. You get the picture. + */ +-void sctp_assoc_update_retran_path(struct sctp_association *asoc) ++static const u8 sctp_trans_state_to_prio_map[] = { ++ [SCTP_ACTIVE] = 3, /* best case */ ++ [SCTP_UNKNOWN] = 2, ++ [SCTP_PF] = 1, ++ [SCTP_INACTIVE] = 0, /* worst case */ ++}; ++ ++static u8 sctp_trans_score(const struct sctp_transport *trans) + { +- struct sctp_transport *t, *next; +- struct list_head *head = &asoc->peer.transport_addr_list; +- struct list_head *pos; ++ return sctp_trans_state_to_prio_map[trans->state]; ++} + +- if (asoc->peer.transport_count == 1) +- return; ++static struct sctp_transport *sctp_trans_elect_best(struct sctp_transport *curr, ++ struct sctp_transport *best) ++{ ++ if (best == NULL) ++ return curr; + +- /* Find the next transport in a round-robin fashion. */ +- t = asoc->peer.retran_path; +- pos = &t->transports; +- next = NULL; ++ return sctp_trans_score(curr) > sctp_trans_score(best) ? curr : best; ++} + +- while (1) { +- /* Skip the head. */ +- if (pos->next == head) +- pos = head->next; +- else +- pos = pos->next; ++void sctp_assoc_update_retran_path(struct sctp_association *asoc) ++{ ++ struct sctp_transport *trans = asoc->peer.retran_path; ++ struct sctp_transport *trans_next = NULL; + +- t = list_entry(pos, struct sctp_transport, transports); ++ /* We're done as we only have the one and only path. */ ++ if (asoc->peer.transport_count == 1) ++ return; ++ /* If active_path and retran_path are the same and active, ++ * then this is the only active path. Use it. ++ */ ++ if (asoc->peer.active_path == asoc->peer.retran_path && ++ asoc->peer.active_path->state == SCTP_ACTIVE) ++ return; + +- /* We have exhausted the list, but didn't find any +- * other active transports. If so, use the next +- * transport. +- */ +- if (t == asoc->peer.retran_path) { +- t = next; ++ /* Iterate from retran_path's successor back to retran_path. */ ++ for (trans = list_next_entry(trans, transports); 1; ++ trans = list_next_entry(trans, transports)) { ++ /* Manually skip the head element. */ ++ if (&trans->transports == &asoc->peer.transport_addr_list) ++ continue; ++ if (trans->state == SCTP_UNCONFIRMED) ++ continue; ++ trans_next = sctp_trans_elect_best(trans, trans_next); ++ /* Active is good enough for immediate return. */ ++ if (trans_next->state == SCTP_ACTIVE) + break; +- } +- +- /* Try to find an active transport. */ +- +- if ((t->state == SCTP_ACTIVE) || +- (t->state == SCTP_UNKNOWN)) { ++ /* We've reached the end, time to update path. */ ++ if (trans == asoc->peer.retran_path) + break; +- } else { +- /* Keep track of the next transport in case +- * we don't find any active transport. +- */ +- if (t->state != SCTP_UNCONFIRMED && !next) +- next = t; +- } + } + +- if (t) +- asoc->peer.retran_path = t; +- else +- t = asoc->peer.retran_path; ++ if (trans_next != NULL) ++ asoc->peer.retran_path = trans_next; + +- pr_debug("%s: association:%p addr:%pISpc\n", __func__, asoc, +- &t->ipaddr.sa); ++ pr_debug("%s: association:%p updated new path to addr:%pISpc\n", ++ __func__, asoc, &asoc->peer.retran_path->ipaddr.sa); + } + +-/* Choose the transport for sending retransmit packet. */ +-struct sctp_transport *sctp_assoc_choose_alter_transport( +- struct sctp_association *asoc, struct sctp_transport *last_sent_to) ++struct sctp_transport * ++sctp_assoc_choose_alter_transport(struct sctp_association *asoc, ++ struct sctp_transport *last_sent_to) + { + /* If this is the first time packet is sent, use the active path, + * else use the retran path. If the last packet was sent over the + * retran path, update the retran path and use it. + */ +- if (!last_sent_to) ++ if (last_sent_to == NULL) { + return asoc->peer.active_path; +- else { ++ } else { + if (last_sent_to == asoc->peer.retran_path) + sctp_assoc_update_retran_path(asoc); ++ + return asoc->peer.retran_path; + } + } +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index 2c5cb6d2787d..8e7cc3e2b08b 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -6712,7 +6712,8 @@ static int sctp_wait_for_sndbuf(struct sctp_association *asoc, long *timeo_p, + */ + sctp_release_sock(sk); + current_timeo = schedule_timeout(current_timeo); +- BUG_ON(sk != asoc->base.sk); ++ if (sk != asoc->base.sk) ++ goto do_error; + sctp_lock_sock(sk); + + *timeo_p = current_timeo; +diff --git a/net/socket.c b/net/socket.c +index 64c47cd62e14..bc3f3f726d47 100644 +--- a/net/socket.c ++++ b/net/socket.c +@@ -2334,8 +2334,10 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen, + return err; + + err = sock_error(sock->sk); +- if (err) ++ if (err) { ++ datagrams = err; + goto out_put; ++ } + + entry = mmsg; + compat_entry = (struct compat_mmsghdr __user *)mmsg; +diff --git a/net/sunrpc/auth_gss/gss_rpc_xdr.c b/net/sunrpc/auth_gss/gss_rpc_xdr.c +index e0062c544ac8..a9ca70579eb9 100644 +--- a/net/sunrpc/auth_gss/gss_rpc_xdr.c ++++ b/net/sunrpc/auth_gss/gss_rpc_xdr.c +@@ -260,7 +260,7 @@ static int gssx_dec_option_array(struct xdr_stream *xdr, + if (!oa->data) + return -ENOMEM; + +- creds = kmalloc(sizeof(struct svc_cred), GFP_KERNEL); ++ creds = kzalloc(sizeof(struct svc_cred), GFP_KERNEL); + if (!creds) { + kfree(oa->data); + return -ENOMEM; +diff --git a/net/sunrpc/clnt.c b/net/sunrpc/clnt.c +index 8724ef857360..8ac0f2ec323b 100644 +--- a/net/sunrpc/clnt.c ++++ b/net/sunrpc/clnt.c +@@ -315,6 +315,11 @@ out: + + static DEFINE_IDA(rpc_clids); + ++void rpc_cleanup_clids(void) ++{ ++ ida_destroy(&rpc_clids); ++} ++ + static int rpc_alloc_clid(struct rpc_clnt *clnt) + { + int clid; +diff --git a/net/sunrpc/sunrpc_syms.c b/net/sunrpc/sunrpc_syms.c +index 3d6498af9adc..c13279459407 100644 +--- a/net/sunrpc/sunrpc_syms.c ++++ b/net/sunrpc/sunrpc_syms.c +@@ -111,6 +111,7 @@ out: + static void __exit + cleanup_sunrpc(void) + { ++ rpc_cleanup_clids(); + rpcauth_remove_module(); + cleanup_socket_xprt(); + svc_cleanup_xprt_sock(); +diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c +index 3974413f78e7..339532b15223 100644 +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -978,6 +978,7 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) + unsigned int hash; + struct unix_address *addr; + struct hlist_head *list; ++ struct path path = { NULL, NULL }; + + err = -EINVAL; + if (sunaddr->sun_family != AF_UNIX) +@@ -993,9 +994,20 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) + goto out; + addr_len = err; + ++ if (sun_path[0]) { ++ umode_t mode = S_IFSOCK | ++ (SOCK_INODE(sock)->i_mode & ~current_umask()); ++ err = unix_mknod(sun_path, mode, &path); ++ if (err) { ++ if (err == -EEXIST) ++ err = -EADDRINUSE; ++ goto out; ++ } ++ } ++ + err = mutex_lock_interruptible(&u->readlock); + if (err) +- goto out; ++ goto out_put; + + err = -EINVAL; + if (u->addr) +@@ -1012,16 +1024,6 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) + atomic_set(&addr->refcnt, 1); + + if (sun_path[0]) { +- struct path path; +- umode_t mode = S_IFSOCK | +- (SOCK_INODE(sock)->i_mode & ~current_umask()); +- err = unix_mknod(sun_path, mode, &path); +- if (err) { +- if (err == -EEXIST) +- err = -EADDRINUSE; +- unix_release_addr(addr); +- goto out_up; +- } + addr->hash = UNIX_HASH_SIZE; + hash = path.dentry->d_inode->i_ino & (UNIX_HASH_SIZE-1); + spin_lock(&unix_table_lock); +@@ -1048,6 +1050,9 @@ out_unlock: + spin_unlock(&unix_table_lock); + out_up: + mutex_unlock(&u->readlock); ++out_put: ++ if (err) ++ path_put(&path); + out: + return err; + } +diff --git a/security/selinux/hooks.c b/security/selinux/hooks.c +index 3ba608a61bbf..bcae35aa0557 100644 +--- a/security/selinux/hooks.c ++++ b/security/selinux/hooks.c +@@ -5511,7 +5511,7 @@ static int selinux_setprocattr(struct task_struct *p, + return error; + + /* Obtain a SID for the context, if one was specified. */ +- if (size && str[1] && str[1] != '\n') { ++ if (size && str[0] && str[0] != '\n') { + if (str[size-1] == '\n') { + str[size-1] = 0; + size--; +diff --git a/sound/core/seq/seq_memory.c b/sound/core/seq/seq_memory.c +index 652350e2533f..7204c0f1700b 100644 +--- a/sound/core/seq/seq_memory.c ++++ b/sound/core/seq/seq_memory.c +@@ -419,7 +419,6 @@ int snd_seq_pool_done(struct snd_seq_pool *pool) + { + unsigned long flags; + struct snd_seq_event_cell *ptr; +- int max_count = 5 * HZ; + + if (snd_BUG_ON(!pool)) + return -EINVAL; +@@ -432,14 +431,8 @@ int snd_seq_pool_done(struct snd_seq_pool *pool) + if (waitqueue_active(&pool->output_sleep)) + wake_up(&pool->output_sleep); + +- while (atomic_read(&pool->counter) > 0) { +- if (max_count == 0) { +- snd_printk(KERN_WARNING "snd_seq_pool_done timeout: %d cells remain\n", atomic_read(&pool->counter)); +- break; +- } ++ while (atomic_read(&pool->counter) > 0) + schedule_timeout_uninterruptible(1); +- max_count--; +- } + + /* release all resources */ + spin_lock_irqsave(&pool->lock, flags); +diff --git a/sound/core/seq/seq_queue.c b/sound/core/seq/seq_queue.c +index 4c9aa462de9b..17fe04d892f9 100644 +--- a/sound/core/seq/seq_queue.c ++++ b/sound/core/seq/seq_queue.c +@@ -183,6 +183,8 @@ void __exit snd_seq_queues_delete(void) + } + } + ++static void queue_use(struct snd_seq_queue *queue, int client, int use); ++ + /* allocate a new queue - + * return queue index value or negative value for error + */ +@@ -194,11 +196,11 @@ int snd_seq_queue_alloc(int client, int locked, unsigned int info_flags) + if (q == NULL) + return -ENOMEM; + q->info_flags = info_flags; ++ queue_use(q, client, 1); + if (queue_list_add(q) < 0) { + queue_delete(q); + return -ENOMEM; + } +- snd_seq_queue_use(q->queue, client, 1); /* use this queue */ + return q->queue; + } + +@@ -504,19 +506,9 @@ int snd_seq_queue_timer_set_tempo(int queueid, int client, + return result; + } + +- +-/* use or unuse this queue - +- * if it is the first client, starts the timer. +- * if it is not longer used by any clients, stop the timer. +- */ +-int snd_seq_queue_use(int queueid, int client, int use) ++/* use or unuse this queue */ ++static void queue_use(struct snd_seq_queue *queue, int client, int use) + { +- struct snd_seq_queue *queue; +- +- queue = queueptr(queueid); +- if (queue == NULL) +- return -EINVAL; +- mutex_lock(&queue->timer_mutex); + if (use) { + if (!test_and_set_bit(client, queue->clients_bitmap)) + queue->clients++; +@@ -531,6 +523,21 @@ int snd_seq_queue_use(int queueid, int client, int use) + } else { + snd_seq_timer_close(queue); + } ++} ++ ++/* use or unuse this queue - ++ * if it is the first client, starts the timer. ++ * if it is not longer used by any clients, stop the timer. ++ */ ++int snd_seq_queue_use(int queueid, int client, int use) ++{ ++ struct snd_seq_queue *queue; ++ ++ queue = queueptr(queueid); ++ if (queue == NULL) ++ return -EINVAL; ++ mutex_lock(&queue->timer_mutex); ++ queue_use(queue, client, use); + mutex_unlock(&queue->timer_mutex); + queuefree(queue); + return 0;
