commit: e1f77829bd6587aaa9afefb2c81e68fd51ff66c2 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Fri Aug 1 23:59:16 2014 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Fri Aug 1 23:59:16 2014 +0000 URL: http://git.overlays.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=e1f77829
Linux patch 3.12.26 --- 0000_README | 4 + 1025_linux-3.12.26.patch | 3381 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 3385 insertions(+) diff --git a/0000_README b/0000_README index 76b0ed4..4b58868 100644 --- a/0000_README +++ b/0000_README @@ -142,6 +142,10 @@ Patch: 1024_linux-3.12.25.patch From: http://www.kernel.org Desc: Linux 3.12.25 +Patch: 1025_linux-3.12.26.patch +From: http://www.kernel.org +Desc: Linux 3.12.26 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1025_linux-3.12.26.patch b/1025_linux-3.12.26.patch new file mode 100644 index 0000000..4385766 --- /dev/null +++ b/1025_linux-3.12.26.patch @@ -0,0 +1,3381 @@ +diff --git a/Makefile b/Makefile +index 4d25b56bf81c..647d87ac4a15 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 12 +-SUBLEVEL = 25 ++SUBLEVEL = 26 + EXTRAVERSION = + NAME = One Giant Leap for Frogkind + +@@ -614,6 +614,8 @@ KBUILD_CFLAGS += -fomit-frame-pointer + endif + endif + ++KBUILD_CFLAGS += $(call cc-option, -fno-var-tracking-assignments) ++ + ifdef CONFIG_DEBUG_INFO + KBUILD_CFLAGS += -g + KBUILD_AFLAGS += -gdwarf-2 +diff --git a/arch/arc/include/uapi/asm/ptrace.h b/arch/arc/include/uapi/asm/ptrace.h +index 2618cc13ba75..76a7739aab1c 100644 +--- a/arch/arc/include/uapi/asm/ptrace.h ++++ b/arch/arc/include/uapi/asm/ptrace.h +@@ -11,6 +11,7 @@ + #ifndef _UAPI__ASM_ARC_PTRACE_H + #define _UAPI__ASM_ARC_PTRACE_H + ++#define PTRACE_GET_THREAD_AREA 25 + + #ifndef __ASSEMBLY__ + /* +diff --git a/arch/arc/kernel/ptrace.c b/arch/arc/kernel/ptrace.c +index 5d76706139dd..13b3ffb27a38 100644 +--- a/arch/arc/kernel/ptrace.c ++++ b/arch/arc/kernel/ptrace.c +@@ -146,6 +146,10 @@ long arch_ptrace(struct task_struct *child, long request, + pr_debug("REQ=%ld: ADDR =0x%lx, DATA=0x%lx)\n", request, addr, data); + + switch (request) { ++ case PTRACE_GET_THREAD_AREA: ++ ret = put_user(task_thread_info(child)->thr_ptr, ++ (unsigned long __user *)data); ++ break; + default: + ret = ptrace_request(child, request, addr, data); + break; +diff --git a/arch/arm/Kconfig b/arch/arm/Kconfig +index e47fcd1e9645..99e1ce978cf9 100644 +--- a/arch/arm/Kconfig ++++ b/arch/arm/Kconfig +@@ -5,6 +5,7 @@ config ARM + select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE + select ARCH_HAS_TICK_BROADCAST if GENERIC_CLOCKEVENTS_BROADCAST + select ARCH_HAVE_CUSTOM_GPIO_H ++ select ARCH_SUPPORTS_ATOMIC_RMW + select ARCH_WANT_IPC_PARSE_VERSION + select BUILDTIME_EXTABLE_SORT if MMU + select CLONE_BACKWARDS +diff --git a/arch/arm/boot/dts/imx25.dtsi b/arch/arm/boot/dts/imx25.dtsi +index 737ed5da8f71..de1611966d8b 100644 +--- a/arch/arm/boot/dts/imx25.dtsi ++++ b/arch/arm/boot/dts/imx25.dtsi +@@ -30,6 +30,7 @@ + spi2 = &spi3; + usb0 = &usbotg; + usb1 = &usbhost1; ++ ethernet0 = &fec; + }; + + cpus { +diff --git a/arch/arm/boot/dts/imx27.dtsi b/arch/arm/boot/dts/imx27.dtsi +index b7a1c6d950b9..c07aea4f66cb 100644 +--- a/arch/arm/boot/dts/imx27.dtsi ++++ b/arch/arm/boot/dts/imx27.dtsi +@@ -30,6 +30,7 @@ + spi0 = &cspi1; + spi1 = &cspi2; + spi2 = &cspi3; ++ ethernet0 = &fec; + }; + + aitc: aitc-interrupt-controller@e0000000 { +diff --git a/arch/arm/boot/dts/imx51.dtsi b/arch/arm/boot/dts/imx51.dtsi +index 54cee6517902..6d2a5343691f 100644 +--- a/arch/arm/boot/dts/imx51.dtsi ++++ b/arch/arm/boot/dts/imx51.dtsi +@@ -27,6 +27,7 @@ + spi0 = &ecspi1; + spi1 = &ecspi2; + spi2 = &cspi; ++ ethernet0 = &fec; + }; + + tzic: tz-interrupt-controller@e0000000 { +diff --git a/arch/arm/boot/dts/imx53.dtsi b/arch/arm/boot/dts/imx53.dtsi +index dc72353de0b3..50eda500f39a 100644 +--- a/arch/arm/boot/dts/imx53.dtsi ++++ b/arch/arm/boot/dts/imx53.dtsi +@@ -33,6 +33,7 @@ + spi0 = &ecspi1; + spi1 = &ecspi2; + spi2 = &cspi; ++ ethernet0 = &fec; + }; + + cpus { +diff --git a/arch/arm64/Kconfig b/arch/arm64/Kconfig +index c04454876bcb..fe70eaea0e28 100644 +--- a/arch/arm64/Kconfig ++++ b/arch/arm64/Kconfig +@@ -1,6 +1,7 @@ + config ARM64 + def_bool y + select ARCH_HAS_ATOMIC64_DEC_IF_POSITIVE ++ select ARCH_SUPPORTS_ATOMIC_RMW + select ARCH_WANT_OPTIONAL_GPIOLIB + select ARCH_WANT_COMPAT_IPC_PARSE_VERSION + select ARCH_WANT_FRAME_POINTERS +diff --git a/arch/parisc/include/uapi/asm/signal.h b/arch/parisc/include/uapi/asm/signal.h +index a2fa297196bc..f5645d6a89f2 100644 +--- a/arch/parisc/include/uapi/asm/signal.h ++++ b/arch/parisc/include/uapi/asm/signal.h +@@ -69,8 +69,6 @@ + #define SA_NOMASK SA_NODEFER + #define SA_ONESHOT SA_RESETHAND + +-#define SA_RESTORER 0x04000000 /* obsolete -- ignored */ +- + #define MINSIGSTKSZ 2048 + #define SIGSTKSZ 8192 + +diff --git a/arch/powerpc/Kconfig b/arch/powerpc/Kconfig +index d5d026b6d237..2e0ddfadc0b9 100644 +--- a/arch/powerpc/Kconfig ++++ b/arch/powerpc/Kconfig +@@ -138,6 +138,7 @@ config PPC + select OLD_SIGSUSPEND + select OLD_SIGACTION if PPC32 + select HAVE_DEBUG_STACKOVERFLOW ++ select ARCH_SUPPORTS_ATOMIC_RMW + + config EARLY_PRINTK + bool +diff --git a/arch/sparc/Kconfig b/arch/sparc/Kconfig +index 4e5683877b93..d60f34dbae89 100644 +--- a/arch/sparc/Kconfig ++++ b/arch/sparc/Kconfig +@@ -75,6 +75,7 @@ config SPARC64 + select ARCH_HAVE_NMI_SAFE_CMPXCHG + select HAVE_C_RECORDMCOUNT + select NO_BOOTMEM ++ select ARCH_SUPPORTS_ATOMIC_RMW + + config ARCH_DEFCONFIG + string +diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig +index eb2dfa61eabe..9dc1a24d41b8 100644 +--- a/arch/x86/Kconfig ++++ b/arch/x86/Kconfig +@@ -123,6 +123,7 @@ config X86 + select COMPAT_OLD_SIGACTION if IA32_EMULATION + select RTC_LIB + select HAVE_DEBUG_STACKOVERFLOW ++ select ARCH_SUPPORTS_ATOMIC_RMW + + config INSTRUCTION_DECODER + def_bool y +diff --git a/arch/x86/boot/header.S b/arch/x86/boot/header.S +index 9ec06a1f6d61..425712462178 100644 +--- a/arch/x86/boot/header.S ++++ b/arch/x86/boot/header.S +@@ -91,10 +91,9 @@ bs_die: + + .section ".bsdata", "a" + bugger_off_msg: +- .ascii "Direct floppy boot is not supported. " +- .ascii "Use a boot loader program instead.\r\n" ++ .ascii "Use a boot loader.\r\n" + .ascii "\n" +- .ascii "Remove disk and press any key to reboot ...\r\n" ++ .ascii "Remove disk and press any key to reboot...\r\n" + .byte 0 + + #ifdef CONFIG_EFI_STUB +@@ -108,7 +107,7 @@ coff_header: + #else + .word 0x8664 # x86-64 + #endif +- .word 3 # nr_sections ++ .word 4 # nr_sections + .long 0 # TimeDateStamp + .long 0 # PointerToSymbolTable + .long 1 # NumberOfSymbols +@@ -250,6 +249,25 @@ section_table: + .word 0 # NumberOfLineNumbers + .long 0x60500020 # Characteristics (section flags) + ++ # ++ # The offset & size fields are filled in by build.c. ++ # ++ .ascii ".bss" ++ .byte 0 ++ .byte 0 ++ .byte 0 ++ .byte 0 ++ .long 0 ++ .long 0x0 ++ .long 0 # Size of initialized data ++ # on disk ++ .long 0x0 ++ .long 0 # PointerToRelocations ++ .long 0 # PointerToLineNumbers ++ .word 0 # NumberOfRelocations ++ .word 0 # NumberOfLineNumbers ++ .long 0xc8000080 # Characteristics (section flags) ++ + #endif /* CONFIG_EFI_STUB */ + + # Kernel attributes; used by setup. This is part 1 of the +diff --git a/arch/x86/boot/tools/build.c b/arch/x86/boot/tools/build.c +index c941d6a8887f..687dd281c23e 100644 +--- a/arch/x86/boot/tools/build.c ++++ b/arch/x86/boot/tools/build.c +@@ -141,7 +141,7 @@ static void usage(void) + + #ifdef CONFIG_EFI_STUB + +-static void update_pecoff_section_header(char *section_name, u32 offset, u32 size) ++static void update_pecoff_section_header_fields(char *section_name, u32 vma, u32 size, u32 datasz, u32 offset) + { + unsigned int pe_header; + unsigned short num_sections; +@@ -162,10 +162,10 @@ static void update_pecoff_section_header(char *section_name, u32 offset, u32 siz + put_unaligned_le32(size, section + 0x8); + + /* section header vma field */ +- put_unaligned_le32(offset, section + 0xc); ++ put_unaligned_le32(vma, section + 0xc); + + /* section header 'size of initialised data' field */ +- put_unaligned_le32(size, section + 0x10); ++ put_unaligned_le32(datasz, section + 0x10); + + /* section header 'file offset' field */ + put_unaligned_le32(offset, section + 0x14); +@@ -177,6 +177,11 @@ static void update_pecoff_section_header(char *section_name, u32 offset, u32 siz + } + } + ++static void update_pecoff_section_header(char *section_name, u32 offset, u32 size) ++{ ++ update_pecoff_section_header_fields(section_name, offset, size, size, offset); ++} ++ + static void update_pecoff_setup_and_reloc(unsigned int size) + { + u32 setup_offset = 0x200; +@@ -201,9 +206,6 @@ static void update_pecoff_text(unsigned int text_start, unsigned int file_sz) + + pe_header = get_unaligned_le32(&buf[0x3c]); + +- /* Size of image */ +- put_unaligned_le32(file_sz, &buf[pe_header + 0x50]); +- + /* + * Size of code: Subtract the size of the first sector (512 bytes) + * which includes the header. +@@ -218,6 +220,22 @@ static void update_pecoff_text(unsigned int text_start, unsigned int file_sz) + update_pecoff_section_header(".text", text_start, text_sz); + } + ++static void update_pecoff_bss(unsigned int file_sz, unsigned int init_sz) ++{ ++ unsigned int pe_header; ++ unsigned int bss_sz = init_sz - file_sz; ++ ++ pe_header = get_unaligned_le32(&buf[0x3c]); ++ ++ /* Size of uninitialized data */ ++ put_unaligned_le32(bss_sz, &buf[pe_header + 0x24]); ++ ++ /* Size of image */ ++ put_unaligned_le32(init_sz, &buf[pe_header + 0x50]); ++ ++ update_pecoff_section_header_fields(".bss", file_sz, bss_sz, 0, 0); ++} ++ + #endif /* CONFIG_EFI_STUB */ + + +@@ -269,6 +287,9 @@ int main(int argc, char ** argv) + int fd; + void *kernel; + u32 crc = 0xffffffffUL; ++#ifdef CONFIG_EFI_STUB ++ unsigned int init_sz; ++#endif + + /* Defaults for old kernel */ + #ifdef CONFIG_X86_32 +@@ -339,7 +360,9 @@ int main(int argc, char ** argv) + put_unaligned_le32(sys_size, &buf[0x1f4]); + + #ifdef CONFIG_EFI_STUB +- update_pecoff_text(setup_sectors * 512, sz + i + ((sys_size * 16) - sz)); ++ update_pecoff_text(setup_sectors * 512, i + (sys_size * 16)); ++ init_sz = get_unaligned_le32(&buf[0x260]); ++ update_pecoff_bss(i + (sys_size * 16), init_sz); + + #ifdef CONFIG_X86_64 /* Yes, this is really how we defined it :( */ + efi_stub_entry -= 0x200; +diff --git a/arch/x86/kernel/cpu/perf_event_intel.c b/arch/x86/kernel/cpu/perf_event_intel.c +index f31a1655d1ff..aa4b5c132c66 100644 +--- a/arch/x86/kernel/cpu/perf_event_intel.c ++++ b/arch/x86/kernel/cpu/perf_event_intel.c +@@ -1365,6 +1365,15 @@ again: + intel_pmu_lbr_read(); + + /* ++ * CondChgd bit 63 doesn't mean any overflow status. Ignore ++ * and clear the bit. ++ */ ++ if (__test_and_clear_bit(63, (unsigned long *)&status)) { ++ if (!status) ++ goto done; ++ } ++ ++ /* + * PEBS overflow sets bit 62 in the global status register + */ + if (__test_and_clear_bit(62, (unsigned long *)&status)) { +diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S +index 3308125c90aa..1fc2a347c47c 100644 +--- a/arch/x86/kernel/entry_32.S ++++ b/arch/x86/kernel/entry_32.S +@@ -436,8 +436,8 @@ sysenter_do_call: + cmpl $(NR_syscalls), %eax + jae sysenter_badsys + call *sys_call_table(,%eax,4) +- movl %eax,PT_EAX(%esp) + sysenter_after_call: ++ movl %eax,PT_EAX(%esp) + LOCKDEP_SYS_EXIT + DISABLE_INTERRUPTS(CLBR_ANY) + TRACE_IRQS_OFF +@@ -517,6 +517,7 @@ ENTRY(system_call) + jae syscall_badsys + syscall_call: + call *sys_call_table(,%eax,4) ++syscall_after_call: + movl %eax,PT_EAX(%esp) # store the return value + syscall_exit: + LOCKDEP_SYS_EXIT +@@ -686,12 +687,12 @@ syscall_fault: + END(syscall_fault) + + syscall_badsys: +- movl $-ENOSYS,PT_EAX(%esp) +- jmp syscall_exit ++ movl $-ENOSYS,%eax ++ jmp syscall_after_call + END(syscall_badsys) + + sysenter_badsys: +- movl $-ENOSYS,PT_EAX(%esp) ++ movl $-ENOSYS,%eax + jmp sysenter_after_call + END(syscall_badsys) + CFI_ENDPROC +diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c +index dd0dd2d4ceca..d8f80e733cf8 100644 +--- a/block/blk-cgroup.c ++++ b/block/blk-cgroup.c +@@ -859,6 +859,13 @@ void blkcg_drain_queue(struct request_queue *q) + { + lockdep_assert_held(q->queue_lock); + ++ /* ++ * @q could be exiting and already have destroyed all blkgs as ++ * indicated by NULL root_blkg. If so, don't confuse policies. ++ */ ++ if (!q->root_blkg) ++ return; ++ + blk_throtl_drain(q); + } + +diff --git a/block/blk-tag.c b/block/blk-tag.c +index 3f33d8672268..a185b86741e5 100644 +--- a/block/blk-tag.c ++++ b/block/blk-tag.c +@@ -27,18 +27,15 @@ struct request *blk_queue_find_tag(struct request_queue *q, int tag) + EXPORT_SYMBOL(blk_queue_find_tag); + + /** +- * __blk_free_tags - release a given set of tag maintenance info ++ * blk_free_tags - release a given set of tag maintenance info + * @bqt: the tag map to free + * +- * Tries to free the specified @bqt. Returns true if it was +- * actually freed and false if there are still references using it ++ * Drop the reference count on @bqt and frees it when the last reference ++ * is dropped. + */ +-static int __blk_free_tags(struct blk_queue_tag *bqt) ++void blk_free_tags(struct blk_queue_tag *bqt) + { +- int retval; +- +- retval = atomic_dec_and_test(&bqt->refcnt); +- if (retval) { ++ if (atomic_dec_and_test(&bqt->refcnt)) { + BUG_ON(find_first_bit(bqt->tag_map, bqt->max_depth) < + bqt->max_depth); + +@@ -50,9 +47,8 @@ static int __blk_free_tags(struct blk_queue_tag *bqt) + + kfree(bqt); + } +- +- return retval; + } ++EXPORT_SYMBOL(blk_free_tags); + + /** + * __blk_queue_free_tags - release tag maintenance info +@@ -69,28 +65,13 @@ void __blk_queue_free_tags(struct request_queue *q) + if (!bqt) + return; + +- __blk_free_tags(bqt); ++ blk_free_tags(bqt); + + q->queue_tags = NULL; + queue_flag_clear_unlocked(QUEUE_FLAG_QUEUED, q); + } + + /** +- * blk_free_tags - release a given set of tag maintenance info +- * @bqt: the tag map to free +- * +- * For externally managed @bqt frees the map. Callers of this +- * function must guarantee to have released all the queues that +- * might have been using this tag map. +- */ +-void blk_free_tags(struct blk_queue_tag *bqt) +-{ +- if (unlikely(!__blk_free_tags(bqt))) +- BUG(); +-} +-EXPORT_SYMBOL(blk_free_tags); +- +-/** + * blk_queue_free_tags - release tag maintenance info + * @q: the request queue for the device + * +diff --git a/block/compat_ioctl.c b/block/compat_ioctl.c +index fbd5a67cb773..a0926a6094b2 100644 +--- a/block/compat_ioctl.c ++++ b/block/compat_ioctl.c +@@ -690,6 +690,7 @@ long compat_blkdev_ioctl(struct file *file, unsigned cmd, unsigned long arg) + case BLKROSET: + case BLKDISCARD: + case BLKSECDISCARD: ++ case BLKZEROOUT: + /* + * the ones below are implemented in blkdev_locked_ioctl, + * but we call blkdev_ioctl, which gets the lock for us +diff --git a/drivers/acpi/resource.c b/drivers/acpi/resource.c +index 0bdacc5e26a3..2ba8f02ced36 100644 +--- a/drivers/acpi/resource.c ++++ b/drivers/acpi/resource.c +@@ -77,7 +77,7 @@ bool acpi_dev_resource_memory(struct acpi_resource *ares, struct resource *res) + switch (ares->type) { + case ACPI_RESOURCE_TYPE_MEMORY24: + memory24 = &ares->data.memory24; +- if (!memory24->address_length) ++ if (!memory24->minimum && !memory24->address_length) + return false; + acpi_dev_get_memresource(res, memory24->minimum, + memory24->address_length, +@@ -85,7 +85,7 @@ bool acpi_dev_resource_memory(struct acpi_resource *ares, struct resource *res) + break; + case ACPI_RESOURCE_TYPE_MEMORY32: + memory32 = &ares->data.memory32; +- if (!memory32->address_length) ++ if (!memory32->minimum && !memory32->address_length) + return false; + acpi_dev_get_memresource(res, memory32->minimum, + memory32->address_length, +@@ -93,7 +93,7 @@ bool acpi_dev_resource_memory(struct acpi_resource *ares, struct resource *res) + break; + case ACPI_RESOURCE_TYPE_FIXED_MEMORY32: + fixed_memory32 = &ares->data.fixed_memory32; +- if (!fixed_memory32->address_length) ++ if (!fixed_memory32->address && !fixed_memory32->address_length) + return false; + acpi_dev_get_memresource(res, fixed_memory32->address, + fixed_memory32->address_length, +@@ -150,7 +150,7 @@ bool acpi_dev_resource_io(struct acpi_resource *ares, struct resource *res) + switch (ares->type) { + case ACPI_RESOURCE_TYPE_IO: + io = &ares->data.io; +- if (!io->address_length) ++ if (!io->minimum && !io->address_length) + return false; + acpi_dev_get_ioresource(res, io->minimum, + io->address_length, +@@ -158,7 +158,7 @@ bool acpi_dev_resource_io(struct acpi_resource *ares, struct resource *res) + break; + case ACPI_RESOURCE_TYPE_FIXED_IO: + fixed_io = &ares->data.fixed_io; +- if (!fixed_io->address_length) ++ if (!fixed_io->address && !fixed_io->address_length) + return false; + acpi_dev_get_ioresource(res, fixed_io->address, + fixed_io->address_length, +diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c +index 5421a820ec7d..efa328bf6724 100644 +--- a/drivers/ata/ahci.c ++++ b/drivers/ata/ahci.c +@@ -455,6 +455,7 @@ static const struct pci_device_id ahci_pci_tbl[] = { + + /* Promise */ + { PCI_VDEVICE(PROMISE, 0x3f20), board_ahci }, /* PDC42819 */ ++ { PCI_VDEVICE(PROMISE, 0x3781), board_ahci }, /* FastTrak TX8660 ahci-mode */ + + /* Asmedia */ + { PCI_VDEVICE(ASMEDIA, 0x0601), board_ahci }, /* ASM1060 */ +diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c +index d2eb9df3da3d..0d9a2f674819 100644 +--- a/drivers/ata/libata-core.c ++++ b/drivers/ata/libata-core.c +@@ -4787,6 +4787,10 @@ void swap_buf_le16(u16 *buf, unsigned int buf_words) + * ata_qc_new - Request an available ATA command, for queueing + * @ap: target port + * ++ * Some ATA host controllers may implement a queue depth which is less ++ * than ATA_MAX_QUEUE. So we shouldn't allocate a tag which is beyond ++ * the hardware limitation. ++ * + * LOCKING: + * None. + */ +@@ -4794,14 +4798,15 @@ void swap_buf_le16(u16 *buf, unsigned int buf_words) + static struct ata_queued_cmd *ata_qc_new(struct ata_port *ap) + { + struct ata_queued_cmd *qc = NULL; ++ unsigned int max_queue = ap->host->n_tags; + unsigned int i, tag; + + /* no command while frozen */ + if (unlikely(ap->pflags & ATA_PFLAG_FROZEN)) + return NULL; + +- for (i = 0; i < ATA_MAX_QUEUE; i++) { +- tag = (i + ap->last_tag + 1) % ATA_MAX_QUEUE; ++ for (i = 0, tag = ap->last_tag + 1; i < max_queue; i++, tag++) { ++ tag = tag < max_queue ? tag : 0; + + /* the last tag is reserved for internal command. */ + if (tag == ATA_TAG_INTERNAL) +@@ -6103,6 +6108,7 @@ void ata_host_init(struct ata_host *host, struct device *dev, + { + spin_lock_init(&host->lock); + mutex_init(&host->eh_mutex); ++ host->n_tags = ATA_MAX_QUEUE - 1; + host->dev = dev; + host->ops = ops; + } +@@ -6184,6 +6190,8 @@ int ata_host_register(struct ata_host *host, struct scsi_host_template *sht) + { + int i, rc; + ++ host->n_tags = clamp(sht->can_queue, 1, ATA_MAX_QUEUE - 1); ++ + /* host must have been started */ + if (!(host->flags & ATA_HOST_STARTED)) { + dev_err(host->dev, "BUG: trying to register unstarted host\n"); +diff --git a/drivers/bluetooth/hci_h5.c b/drivers/bluetooth/hci_h5.c +index b6154d5a07a5..db0be2fb05fe 100644 +--- a/drivers/bluetooth/hci_h5.c ++++ b/drivers/bluetooth/hci_h5.c +@@ -406,6 +406,7 @@ static int h5_rx_3wire_hdr(struct hci_uart *hu, unsigned char c) + H5_HDR_PKT_TYPE(hdr) != HCI_3WIRE_LINK_PKT) { + BT_ERR("Non-link packet received in non-active state"); + h5_reset_rx(h5); ++ return 0; + } + + h5->rx_func = h5_rx_payload; +diff --git a/drivers/gpu/drm/qxl/qxl_irq.c b/drivers/gpu/drm/qxl/qxl_irq.c +index 21393dc4700a..f4b6b89b98f3 100644 +--- a/drivers/gpu/drm/qxl/qxl_irq.c ++++ b/drivers/gpu/drm/qxl/qxl_irq.c +@@ -33,6 +33,9 @@ irqreturn_t qxl_irq_handler(DRM_IRQ_ARGS) + + pending = xchg(&qdev->ram_header->int_pending, 0); + ++ if (!pending) ++ return IRQ_NONE; ++ + atomic_inc(&qdev->irq_received); + + if (pending & QXL_INTERRUPT_DISPLAY) { +diff --git a/drivers/gpu/drm/radeon/atombios_encoders.c b/drivers/gpu/drm/radeon/atombios_encoders.c +index 583345636d4b..6a965172d8dd 100644 +--- a/drivers/gpu/drm/radeon/atombios_encoders.c ++++ b/drivers/gpu/drm/radeon/atombios_encoders.c +@@ -183,7 +183,6 @@ void radeon_atom_backlight_init(struct radeon_encoder *radeon_encoder, + struct backlight_properties props; + struct radeon_backlight_privdata *pdata; + struct radeon_encoder_atom_dig *dig; +- u8 backlight_level; + char bl_name[16]; + + /* Mac laptops with multiple GPUs use the gmux driver for backlight +@@ -222,12 +221,17 @@ void radeon_atom_backlight_init(struct radeon_encoder *radeon_encoder, + + pdata->encoder = radeon_encoder; + +- backlight_level = radeon_atom_get_backlight_level_from_reg(rdev); +- + dig = radeon_encoder->enc_priv; + dig->bl_dev = bd; + + bd->props.brightness = radeon_atom_backlight_get_brightness(bd); ++ /* Set a reasonable default here if the level is 0 otherwise ++ * fbdev will attempt to turn the backlight on after console ++ * unblanking and it will try and restore 0 which turns the backlight ++ * off again. ++ */ ++ if (bd->props.brightness == 0) ++ bd->props.brightness = RADEON_MAX_BL_LEVEL; + bd->props.power = FB_BLANK_UNBLANK; + backlight_update_status(bd); + +diff --git a/drivers/gpu/drm/radeon/cik.c b/drivers/gpu/drm/radeon/cik.c +index bb7f2ae7683d..14836dfd04e7 100644 +--- a/drivers/gpu/drm/radeon/cik.c ++++ b/drivers/gpu/drm/radeon/cik.c +@@ -6554,6 +6554,7 @@ static inline u32 cik_get_ih_wptr(struct radeon_device *rdev) + tmp = RREG32(IH_RB_CNTL); + tmp |= IH_WPTR_OVERFLOW_CLEAR; + WREG32(IH_RB_CNTL, tmp); ++ wptr &= ~RB_OVERFLOW; + } + return (wptr & rdev->ih.ptr_mask); + } +diff --git a/drivers/gpu/drm/radeon/evergreen.c b/drivers/gpu/drm/radeon/evergreen.c +index 4564bb1ab837..7ca58fc7a1c6 100644 +--- a/drivers/gpu/drm/radeon/evergreen.c ++++ b/drivers/gpu/drm/radeon/evergreen.c +@@ -4664,6 +4664,7 @@ static u32 evergreen_get_ih_wptr(struct radeon_device *rdev) + tmp = RREG32(IH_RB_CNTL); + tmp |= IH_WPTR_OVERFLOW_CLEAR; + WREG32(IH_RB_CNTL, tmp); ++ wptr &= ~RB_OVERFLOW; + } + return (wptr & rdev->ih.ptr_mask); + } +diff --git a/drivers/gpu/drm/radeon/r600.c b/drivers/gpu/drm/radeon/r600.c +index 2c2b91f16ecf..88eb936fbc2f 100644 +--- a/drivers/gpu/drm/radeon/r600.c ++++ b/drivers/gpu/drm/radeon/r600.c +@@ -3657,6 +3657,7 @@ static u32 r600_get_ih_wptr(struct radeon_device *rdev) + tmp = RREG32(IH_RB_CNTL); + tmp |= IH_WPTR_OVERFLOW_CLEAR; + WREG32(IH_RB_CNTL, tmp); ++ wptr &= ~RB_OVERFLOW; + } + return (wptr & rdev->ih.ptr_mask); + } +diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c +index 0254a7596a55..9a19a0432f0f 100644 +--- a/drivers/gpu/drm/radeon/radeon_display.c ++++ b/drivers/gpu/drm/radeon/radeon_display.c +@@ -708,6 +708,10 @@ int radeon_ddc_get_modes(struct radeon_connector *radeon_connector) + struct radeon_device *rdev = dev->dev_private; + int ret = 0; + ++ /* don't leak the edid if we already fetched it in detect() */ ++ if (radeon_connector->edid) ++ goto got_edid; ++ + /* on hw with routers, select right port */ + if (radeon_connector->router.ddc_valid) + radeon_router_select_ddc_port(radeon_connector); +@@ -747,6 +751,7 @@ int radeon_ddc_get_modes(struct radeon_connector *radeon_connector) + radeon_connector->edid = radeon_bios_get_hardcoded_edid(rdev); + } + if (radeon_connector->edid) { ++got_edid: + drm_mode_connector_update_edid_property(&radeon_connector->base, radeon_connector->edid); + ret = drm_add_edid_modes(&radeon_connector->base, radeon_connector->edid); + drm_edid_to_eld(&radeon_connector->base, radeon_connector->edid); +diff --git a/drivers/gpu/drm/radeon/si.c b/drivers/gpu/drm/radeon/si.c +index c9f9c07f888d..4d41a0dc1796 100644 +--- a/drivers/gpu/drm/radeon/si.c ++++ b/drivers/gpu/drm/radeon/si.c +@@ -6041,6 +6041,7 @@ static inline u32 si_get_ih_wptr(struct radeon_device *rdev) + tmp = RREG32(IH_RB_CNTL); + tmp |= IH_WPTR_OVERFLOW_CLEAR; + WREG32(IH_RB_CNTL, tmp); ++ wptr &= ~RB_OVERFLOW; + } + return (wptr & rdev->ih.ptr_mask); + } +diff --git a/drivers/hv/hv_kvp.c b/drivers/hv/hv_kvp.c +index 09988b289622..816782a65488 100644 +--- a/drivers/hv/hv_kvp.c ++++ b/drivers/hv/hv_kvp.c +@@ -127,6 +127,15 @@ kvp_work_func(struct work_struct *dummy) + kvp_respond_to_host(NULL, HV_E_FAIL); + } + ++static void poll_channel(struct vmbus_channel *channel) ++{ ++ unsigned long flags; ++ ++ spin_lock_irqsave(&channel->inbound_lock, flags); ++ hv_kvp_onchannelcallback(channel); ++ spin_unlock_irqrestore(&channel->inbound_lock, flags); ++} ++ + static int kvp_handle_handshake(struct hv_kvp_msg *msg) + { + int ret = 1; +@@ -155,7 +164,7 @@ static int kvp_handle_handshake(struct hv_kvp_msg *msg) + kvp_register(dm_reg_value); + kvp_transaction.active = false; + if (kvp_transaction.kvp_context) +- hv_kvp_onchannelcallback(kvp_transaction.kvp_context); ++ poll_channel(kvp_transaction.kvp_context); + } + return ret; + } +@@ -568,6 +577,7 @@ response_done: + + vmbus_sendpacket(channel, recv_buffer, buf_len, req_id, + VM_PKT_DATA_INBAND, 0); ++ poll_channel(channel); + + } + +@@ -603,7 +613,7 @@ void hv_kvp_onchannelcallback(void *context) + return; + } + +- vmbus_recvpacket(channel, recv_buffer, PAGE_SIZE * 2, &recvlen, ++ vmbus_recvpacket(channel, recv_buffer, PAGE_SIZE * 4, &recvlen, + &requestid); + + if (recvlen > 0) { +diff --git a/drivers/hv/hv_util.c b/drivers/hv/hv_util.c +index 273e3ddb3a20..665b7dac6b7d 100644 +--- a/drivers/hv/hv_util.c ++++ b/drivers/hv/hv_util.c +@@ -312,7 +312,7 @@ static int util_probe(struct hv_device *dev, + (struct hv_util_service *)dev_id->driver_data; + int ret; + +- srv->recv_buffer = kmalloc(PAGE_SIZE * 2, GFP_KERNEL); ++ srv->recv_buffer = kmalloc(PAGE_SIZE * 4, GFP_KERNEL); + if (!srv->recv_buffer) + return -ENOMEM; + if (srv->util_init) { +diff --git a/drivers/hwmon/adt7470.c b/drivers/hwmon/adt7470.c +index 0f4dea5ccf17..9ee3913850d6 100644 +--- a/drivers/hwmon/adt7470.c ++++ b/drivers/hwmon/adt7470.c +@@ -515,7 +515,7 @@ static ssize_t set_temp_min(struct device *dev, + return -EINVAL; + + temp = DIV_ROUND_CLOSEST(temp, 1000); +- temp = clamp_val(temp, 0, 255); ++ temp = clamp_val(temp, -128, 127); + + mutex_lock(&data->lock); + data->temp_min[attr->index] = temp; +@@ -549,7 +549,7 @@ static ssize_t set_temp_max(struct device *dev, + return -EINVAL; + + temp = DIV_ROUND_CLOSEST(temp, 1000); +- temp = clamp_val(temp, 0, 255); ++ temp = clamp_val(temp, -128, 127); + + mutex_lock(&data->lock); + data->temp_max[attr->index] = temp; +@@ -826,7 +826,7 @@ static ssize_t set_pwm_tmin(struct device *dev, + return -EINVAL; + + temp = DIV_ROUND_CLOSEST(temp, 1000); +- temp = clamp_val(temp, 0, 255); ++ temp = clamp_val(temp, -128, 127); + + mutex_lock(&data->lock); + data->pwm_tmin[attr->index] = temp; +diff --git a/drivers/hwmon/da9052-hwmon.c b/drivers/hwmon/da9052-hwmon.c +index 960fac3fb166..48044b044b7a 100644 +--- a/drivers/hwmon/da9052-hwmon.c ++++ b/drivers/hwmon/da9052-hwmon.c +@@ -194,7 +194,7 @@ static ssize_t da9052_hwmon_show_name(struct device *dev, + struct device_attribute *devattr, + char *buf) + { +- return sprintf(buf, "da9052-hwmon\n"); ++ return sprintf(buf, "da9052\n"); + } + + static ssize_t show_label(struct device *dev, +diff --git a/drivers/hwmon/da9055-hwmon.c b/drivers/hwmon/da9055-hwmon.c +index 029ecabc4380..1b275a2881d6 100644 +--- a/drivers/hwmon/da9055-hwmon.c ++++ b/drivers/hwmon/da9055-hwmon.c +@@ -204,7 +204,7 @@ static ssize_t da9055_hwmon_show_name(struct device *dev, + struct device_attribute *devattr, + char *buf) + { +- return sprintf(buf, "da9055-hwmon\n"); ++ return sprintf(buf, "da9055\n"); + } + + static ssize_t show_label(struct device *dev, +diff --git a/drivers/hwmon/smsc47m192.c b/drivers/hwmon/smsc47m192.c +index efee4c59239f..34b9a601ad07 100644 +--- a/drivers/hwmon/smsc47m192.c ++++ b/drivers/hwmon/smsc47m192.c +@@ -86,7 +86,7 @@ static inline u8 IN_TO_REG(unsigned long val, int n) + */ + static inline s8 TEMP_TO_REG(int val) + { +- return clamp_val(SCALE(val, 1, 1000), -128000, 127000); ++ return SCALE(clamp_val(val, -128000, 127000), 1, 1000); + } + + static inline int TEMP_FROM_REG(s8 val) +@@ -384,6 +384,8 @@ static ssize_t set_vrm(struct device *dev, struct device_attribute *attr, + err = kstrtoul(buf, 10, &val); + if (err) + return err; ++ if (val > 255) ++ return -EINVAL; + + data->vrm = val; + return count; +diff --git a/drivers/input/input.c b/drivers/input/input.c +index 74f47980117b..fcf77af28866 100644 +--- a/drivers/input/input.c ++++ b/drivers/input/input.c +@@ -257,9 +257,10 @@ static int input_handle_abs_event(struct input_dev *dev, + } + + static int input_get_disposition(struct input_dev *dev, +- unsigned int type, unsigned int code, int value) ++ unsigned int type, unsigned int code, int *pval) + { + int disposition = INPUT_IGNORE_EVENT; ++ int value = *pval; + + switch (type) { + +@@ -357,6 +358,7 @@ static int input_get_disposition(struct input_dev *dev, + break; + } + ++ *pval = value; + return disposition; + } + +@@ -365,7 +367,7 @@ static void input_handle_event(struct input_dev *dev, + { + int disposition; + +- disposition = input_get_disposition(dev, type, code, value); ++ disposition = input_get_disposition(dev, type, code, &value); + + if ((disposition & INPUT_PASS_TO_DEVICE) && dev->event) + dev->event(dev, type, code, value); +diff --git a/drivers/irqchip/irq-gic.c b/drivers/irqchip/irq-gic.c +index 86df97f6fd27..0fcbf921fff3 100644 +--- a/drivers/irqchip/irq-gic.c ++++ b/drivers/irqchip/irq-gic.c +@@ -42,6 +42,7 @@ + #include <linux/irqchip/chained_irq.h> + #include <linux/irqchip/arm-gic.h> + ++#include <asm/cputype.h> + #include <asm/irq.h> + #include <asm/exception.h> + #include <asm/smp_plat.h> +@@ -760,7 +761,9 @@ void __init gic_init_bases(unsigned int gic_nr, int irq_start, + } + + for_each_possible_cpu(cpu) { +- unsigned long offset = percpu_offset * cpu_logical_map(cpu); ++ u32 mpidr = cpu_logical_map(cpu); ++ u32 core_id = MPIDR_AFFINITY_LEVEL(mpidr, 0); ++ unsigned long offset = percpu_offset * core_id; + *per_cpu_ptr(gic->dist_base.percpu_base, cpu) = dist_base + offset; + *per_cpu_ptr(gic->cpu_base.percpu_base, cpu) = cpu_base + offset; + } +@@ -864,6 +867,7 @@ int __init gic_of_init(struct device_node *node, struct device_node *parent) + } + IRQCHIP_DECLARE(cortex_a15_gic, "arm,cortex-a15-gic", gic_of_init); + IRQCHIP_DECLARE(cortex_a9_gic, "arm,cortex-a9-gic", gic_of_init); ++IRQCHIP_DECLARE(cortex_a7_gic, "arm,cortex-a7-gic", gic_of_init); + IRQCHIP_DECLARE(msm_8660_qgic, "qcom,msm-8660-qgic", gic_of_init); + IRQCHIP_DECLARE(msm_qgic2, "qcom,msm-qgic2", gic_of_init); + +diff --git a/drivers/md/dm-cache-metadata.c b/drivers/md/dm-cache-metadata.c +index 1d38019bb022..b564c0610259 100644 +--- a/drivers/md/dm-cache-metadata.c ++++ b/drivers/md/dm-cache-metadata.c +@@ -407,6 +407,15 @@ static int __open_metadata(struct dm_cache_metadata *cmd) + + disk_super = dm_block_data(sblock); + ++ /* Verify the data block size hasn't changed */ ++ if (le32_to_cpu(disk_super->data_block_size) != cmd->data_block_size) { ++ DMERR("changing the data block size (from %u to %llu) is not supported", ++ le32_to_cpu(disk_super->data_block_size), ++ (unsigned long long)cmd->data_block_size); ++ r = -EINVAL; ++ goto bad; ++ } ++ + r = __check_incompat_features(disk_super, cmd); + if (r < 0) + goto bad; +diff --git a/drivers/md/dm-thin-metadata.c b/drivers/md/dm-thin-metadata.c +index 07a6ea3a9820..b63095c73b5f 100644 +--- a/drivers/md/dm-thin-metadata.c ++++ b/drivers/md/dm-thin-metadata.c +@@ -613,6 +613,15 @@ static int __open_metadata(struct dm_pool_metadata *pmd) + + disk_super = dm_block_data(sblock); + ++ /* Verify the data block size hasn't changed */ ++ if (le32_to_cpu(disk_super->data_block_size) != pmd->data_block_size) { ++ DMERR("changing the data block size (from %u to %llu) is not supported", ++ le32_to_cpu(disk_super->data_block_size), ++ (unsigned long long)pmd->data_block_size); ++ r = -EINVAL; ++ goto bad_unlock_sblock; ++ } ++ + r = __check_incompat_features(disk_super, pmd); + if (r < 0) + goto bad_unlock_sblock; +diff --git a/drivers/media/dvb-frontends/tda10071.c b/drivers/media/dvb-frontends/tda10071.c +index 8ad3a57cf640..287b977862e2 100644 +--- a/drivers/media/dvb-frontends/tda10071.c ++++ b/drivers/media/dvb-frontends/tda10071.c +@@ -667,6 +667,7 @@ static int tda10071_set_frontend(struct dvb_frontend *fe) + struct dtv_frontend_properties *c = &fe->dtv_property_cache; + int ret, i; + u8 mode, rolloff, pilot, inversion, div; ++ fe_modulation_t modulation; + + dev_dbg(&priv->i2c->dev, "%s: delivery_system=%d modulation=%d " \ + "frequency=%d symbol_rate=%d inversion=%d pilot=%d " \ +@@ -701,10 +702,13 @@ static int tda10071_set_frontend(struct dvb_frontend *fe) + + switch (c->delivery_system) { + case SYS_DVBS: ++ modulation = QPSK; + rolloff = 0; + pilot = 2; + break; + case SYS_DVBS2: ++ modulation = c->modulation; ++ + switch (c->rolloff) { + case ROLLOFF_20: + rolloff = 2; +@@ -749,7 +753,7 @@ static int tda10071_set_frontend(struct dvb_frontend *fe) + + for (i = 0, mode = 0xff; i < ARRAY_SIZE(TDA10071_MODCOD); i++) { + if (c->delivery_system == TDA10071_MODCOD[i].delivery_system && +- c->modulation == TDA10071_MODCOD[i].modulation && ++ modulation == TDA10071_MODCOD[i].modulation && + c->fec_inner == TDA10071_MODCOD[i].fec) { + mode = TDA10071_MODCOD[i].val; + dev_dbg(&priv->i2c->dev, "%s: mode found=%02x\n", +diff --git a/drivers/media/usb/gspca/pac7302.c b/drivers/media/usb/gspca/pac7302.c +index a91509643563..0d4be1d840ab 100644 +--- a/drivers/media/usb/gspca/pac7302.c ++++ b/drivers/media/usb/gspca/pac7302.c +@@ -928,6 +928,7 @@ static const struct usb_device_id device_table[] = { + {USB_DEVICE(0x093a, 0x2620)}, + {USB_DEVICE(0x093a, 0x2621)}, + {USB_DEVICE(0x093a, 0x2622), .driver_info = FL_VFLIP}, ++ {USB_DEVICE(0x093a, 0x2623), .driver_info = FL_VFLIP}, + {USB_DEVICE(0x093a, 0x2624), .driver_info = FL_VFLIP}, + {USB_DEVICE(0x093a, 0x2625)}, + {USB_DEVICE(0x093a, 0x2626)}, +diff --git a/drivers/media/usb/hdpvr/hdpvr-video.c b/drivers/media/usb/hdpvr/hdpvr-video.c +index 0500c4175d5f..6bce01a674f9 100644 +--- a/drivers/media/usb/hdpvr/hdpvr-video.c ++++ b/drivers/media/usb/hdpvr/hdpvr-video.c +@@ -82,7 +82,7 @@ static void hdpvr_read_bulk_callback(struct urb *urb) + } + + /*=========================================================================*/ +-/* bufffer bits */ ++/* buffer bits */ + + /* function expects dev->io_mutex to be hold by caller */ + int hdpvr_cancel_queue(struct hdpvr_device *dev) +@@ -926,7 +926,7 @@ static int hdpvr_s_ctrl(struct v4l2_ctrl *ctrl) + case V4L2_CID_MPEG_AUDIO_ENCODING: + if (dev->flags & HDPVR_FLAG_AC3_CAP) { + opt->audio_codec = ctrl->val; +- return hdpvr_set_audio(dev, opt->audio_input, ++ return hdpvr_set_audio(dev, opt->audio_input + 1, + opt->audio_codec); + } + return 0; +@@ -1198,7 +1198,7 @@ int hdpvr_register_videodev(struct hdpvr_device *dev, struct device *parent, + v4l2_ctrl_new_std_menu(hdl, &hdpvr_ctrl_ops, + V4L2_CID_MPEG_AUDIO_ENCODING, + ac3 ? V4L2_MPEG_AUDIO_ENCODING_AC3 : V4L2_MPEG_AUDIO_ENCODING_AAC, +- 0x7, V4L2_MPEG_AUDIO_ENCODING_AAC); ++ 0x7, ac3 ? dev->options.audio_codec : V4L2_MPEG_AUDIO_ENCODING_AAC); + v4l2_ctrl_new_std_menu(hdl, &hdpvr_ctrl_ops, + V4L2_CID_MPEG_VIDEO_ENCODING, + V4L2_MPEG_VIDEO_ENCODING_MPEG_4_AVC, 0x3, +diff --git a/drivers/media/v4l2-core/v4l2-dv-timings.c b/drivers/media/v4l2-core/v4l2-dv-timings.c +index c0895f88ce9c..9f2ac588661b 100644 +--- a/drivers/media/v4l2-core/v4l2-dv-timings.c ++++ b/drivers/media/v4l2-core/v4l2-dv-timings.c +@@ -594,10 +594,10 @@ struct v4l2_fract v4l2_calc_aspect_ratio(u8 hor_landscape, u8 vert_portrait) + aspect.denominator = 9; + } else if (ratio == 34) { + aspect.numerator = 4; +- aspect.numerator = 3; ++ aspect.denominator = 3; + } else if (ratio == 68) { + aspect.numerator = 15; +- aspect.numerator = 9; ++ aspect.denominator = 9; + } else { + aspect.numerator = hor_landscape + 99; + aspect.denominator = 100; +diff --git a/drivers/mtd/devices/elm.c b/drivers/mtd/devices/elm.c +index d1dd6a33a050..3059a7a53bff 100644 +--- a/drivers/mtd/devices/elm.c ++++ b/drivers/mtd/devices/elm.c +@@ -428,6 +428,7 @@ static int elm_context_save(struct elm_info *info) + ELM_SYNDROME_FRAGMENT_1 + offset); + regs->elm_syndrome_fragment_0[i] = elm_read_reg(info, + ELM_SYNDROME_FRAGMENT_0 + offset); ++ break; + default: + return -EINVAL; + } +@@ -466,6 +467,7 @@ static int elm_context_restore(struct elm_info *info) + regs->elm_syndrome_fragment_1[i]); + elm_write_reg(info, ELM_SYNDROME_FRAGMENT_0 + offset, + regs->elm_syndrome_fragment_0[i]); ++ break; + default: + return -EINVAL; + } +diff --git a/drivers/net/can/c_can/c_can.c b/drivers/net/can/c_can/c_can.c +index e59c42b446a9..ae148055baa2 100644 +--- a/drivers/net/can/c_can/c_can.c ++++ b/drivers/net/can/c_can/c_can.c +@@ -830,9 +830,6 @@ static int c_can_do_rx_poll(struct net_device *dev, int quota) + continue; + } + +- if (msg_ctrl_save & IF_MCONT_EOB) +- return num_rx_pkts; +- + if (!(msg_ctrl_save & IF_MCONT_NEWDAT)) + continue; + +diff --git a/drivers/net/can/slcan.c b/drivers/net/can/slcan.c +index 25377e547f9b..3c28d1f187c0 100644 +--- a/drivers/net/can/slcan.c ++++ b/drivers/net/can/slcan.c +@@ -54,6 +54,7 @@ + #include <linux/delay.h> + #include <linux/init.h> + #include <linux/kernel.h> ++#include <linux/workqueue.h> + #include <linux/can.h> + #include <linux/can/skb.h> + +@@ -87,6 +88,7 @@ struct slcan { + struct tty_struct *tty; /* ptr to TTY structure */ + struct net_device *dev; /* easy for intr handling */ + spinlock_t lock; ++ struct work_struct tx_work; /* Flushes transmit buffer */ + + /* These are pointers to the malloc()ed frame buffers. */ + unsigned char rbuff[SLC_MTU]; /* receiver buffer */ +@@ -311,34 +313,44 @@ static void slc_encaps(struct slcan *sl, struct can_frame *cf) + sl->dev->stats.tx_bytes += cf->can_dlc; + } + +-/* +- * Called by the driver when there's room for more data. If we have +- * more packets to send, we send them here. +- */ +-static void slcan_write_wakeup(struct tty_struct *tty) ++/* Write out any remaining transmit buffer. Scheduled when tty is writable */ ++static void slcan_transmit(struct work_struct *work) + { ++ struct slcan *sl = container_of(work, struct slcan, tx_work); + int actual; +- struct slcan *sl = (struct slcan *) tty->disc_data; + ++ spin_lock_bh(&sl->lock); + /* First make sure we're connected. */ +- if (!sl || sl->magic != SLCAN_MAGIC || !netif_running(sl->dev)) ++ if (!sl->tty || sl->magic != SLCAN_MAGIC || !netif_running(sl->dev)) { ++ spin_unlock_bh(&sl->lock); + return; ++ } + +- spin_lock(&sl->lock); + if (sl->xleft <= 0) { + /* Now serial buffer is almost free & we can start + * transmission of another packet */ + sl->dev->stats.tx_packets++; +- clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags); +- spin_unlock(&sl->lock); ++ clear_bit(TTY_DO_WRITE_WAKEUP, &sl->tty->flags); ++ spin_unlock_bh(&sl->lock); + netif_wake_queue(sl->dev); + return; + } + +- actual = tty->ops->write(tty, sl->xhead, sl->xleft); ++ actual = sl->tty->ops->write(sl->tty, sl->xhead, sl->xleft); + sl->xleft -= actual; + sl->xhead += actual; +- spin_unlock(&sl->lock); ++ spin_unlock_bh(&sl->lock); ++} ++ ++/* ++ * Called by the driver when there's room for more data. ++ * Schedule the transmit. ++ */ ++static void slcan_write_wakeup(struct tty_struct *tty) ++{ ++ struct slcan *sl = tty->disc_data; ++ ++ schedule_work(&sl->tx_work); + } + + /* Send a can_frame to a TTY queue. */ +@@ -524,6 +536,7 @@ static struct slcan *slc_alloc(dev_t line) + sl->magic = SLCAN_MAGIC; + sl->dev = dev; + spin_lock_init(&sl->lock); ++ INIT_WORK(&sl->tx_work, slcan_transmit); + slcan_devs[i] = dev; + + return sl; +@@ -622,8 +635,12 @@ static void slcan_close(struct tty_struct *tty) + if (!sl || sl->magic != SLCAN_MAGIC || sl->tty != tty) + return; + ++ spin_lock_bh(&sl->lock); + tty->disc_data = NULL; + sl->tty = NULL; ++ spin_unlock_bh(&sl->lock); ++ ++ flush_work(&sl->tx_work); + + /* Flush network side */ + unregister_netdev(sl->dev); +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +index 0399458e6d44..9846d3e712a1 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_cmn.c +@@ -755,7 +755,8 @@ static void bnx2x_tpa_stop(struct bnx2x *bp, struct bnx2x_fastpath *fp, + + return; + } +- bnx2x_frag_free(fp, new_data); ++ if (new_data) ++ bnx2x_frag_free(fp, new_data); + drop: + /* drop the packet and keep the buffer in the bin */ + DP(NETIF_MSG_RX_STATUS, +diff --git a/drivers/net/ethernet/emulex/benet/be_main.c b/drivers/net/ethernet/emulex/benet/be_main.c +index 2c38cc402119..5226c99813c7 100644 +--- a/drivers/net/ethernet/emulex/benet/be_main.c ++++ b/drivers/net/ethernet/emulex/benet/be_main.c +@@ -2632,7 +2632,7 @@ static int be_open(struct net_device *netdev) + + for_all_evt_queues(adapter, eqo, i) { + napi_enable(&eqo->napi); +- be_eq_notify(adapter, eqo->q.id, true, false, 0); ++ be_eq_notify(adapter, eqo->q.id, true, true, 0); + } + adapter->flags |= BE_FLAGS_NAPI_ENABLED; + +diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c +index 42f0f6717511..70e16f71f574 100644 +--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c ++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c +@@ -1374,7 +1374,7 @@ static void e1000_rar_set_pch2lan(struct e1000_hw *hw, u8 *addr, u32 index) + /* RAR[1-6] are owned by manageability. Skip those and program the + * next address into the SHRA register array. + */ +- if (index < (u32)(hw->mac.rar_entry_count - 6)) { ++ if (index < (u32)(hw->mac.rar_entry_count)) { + s32 ret_val; + + ret_val = e1000_acquire_swflag_ich8lan(hw); +diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.h b/drivers/net/ethernet/intel/e1000e/ich8lan.h +index 217090df33e7..59865695b282 100644 +--- a/drivers/net/ethernet/intel/e1000e/ich8lan.h ++++ b/drivers/net/ethernet/intel/e1000e/ich8lan.h +@@ -98,7 +98,7 @@ + #define PCIE_ICH8_SNOOP_ALL PCIE_NO_SNOOP_ALL + + #define E1000_ICH_RAR_ENTRIES 7 +-#define E1000_PCH2_RAR_ENTRIES 11 /* RAR[0-6], SHRA[0-3] */ ++#define E1000_PCH2_RAR_ENTRIES 5 /* RAR[0], SHRA[0-3] */ + #define E1000_PCH_LPT_RAR_ENTRIES 12 /* RAR[0], SHRA[0-10] */ + + #define PHY_PAGE_SHIFT 5 +diff --git a/drivers/net/ethernet/intel/igb/e1000_82575.c b/drivers/net/ethernet/intel/igb/e1000_82575.c +index 47c2d10df826..974558e36588 100644 +--- a/drivers/net/ethernet/intel/igb/e1000_82575.c ++++ b/drivers/net/ethernet/intel/igb/e1000_82575.c +@@ -1403,6 +1403,13 @@ static s32 igb_init_hw_82575(struct e1000_hw *hw) + s32 ret_val; + u16 i, rar_count = mac->rar_entry_count; + ++ if ((hw->mac.type >= e1000_i210) && ++ !(igb_get_flash_presence_i210(hw))) { ++ ret_val = igb_pll_workaround_i210(hw); ++ if (ret_val) ++ return ret_val; ++ } ++ + /* Initialize identification LED */ + ret_val = igb_id_led_init(hw); + if (ret_val) { +diff --git a/drivers/net/ethernet/intel/igb/e1000_defines.h b/drivers/net/ethernet/intel/igb/e1000_defines.h +index 978eca31ceda..956c4c3ae70b 100644 +--- a/drivers/net/ethernet/intel/igb/e1000_defines.h ++++ b/drivers/net/ethernet/intel/igb/e1000_defines.h +@@ -46,14 +46,15 @@ + /* Extended Device Control */ + #define E1000_CTRL_EXT_SDP3_DATA 0x00000080 /* Value of SW Defineable Pin 3 */ + /* Physical Func Reset Done Indication */ +-#define E1000_CTRL_EXT_PFRSTD 0x00004000 +-#define E1000_CTRL_EXT_LINK_MODE_MASK 0x00C00000 +-#define E1000_CTRL_EXT_LINK_MODE_PCIE_SERDES 0x00C00000 +-#define E1000_CTRL_EXT_LINK_MODE_1000BASE_KX 0x00400000 +-#define E1000_CTRL_EXT_LINK_MODE_SGMII 0x00800000 +-#define E1000_CTRL_EXT_LINK_MODE_GMII 0x00000000 +-#define E1000_CTRL_EXT_EIAME 0x01000000 +-#define E1000_CTRL_EXT_IRCA 0x00000001 ++#define E1000_CTRL_EXT_PFRSTD 0x00004000 ++#define E1000_CTRL_EXT_SDLPE 0X00040000 /* SerDes Low Power Enable */ ++#define E1000_CTRL_EXT_LINK_MODE_MASK 0x00C00000 ++#define E1000_CTRL_EXT_LINK_MODE_PCIE_SERDES 0x00C00000 ++#define E1000_CTRL_EXT_LINK_MODE_1000BASE_KX 0x00400000 ++#define E1000_CTRL_EXT_LINK_MODE_SGMII 0x00800000 ++#define E1000_CTRL_EXT_LINK_MODE_GMII 0x00000000 ++#define E1000_CTRL_EXT_EIAME 0x01000000 ++#define E1000_CTRL_EXT_IRCA 0x00000001 + /* Interrupt delay cancellation */ + /* Driver loaded bit for FW */ + #define E1000_CTRL_EXT_DRV_LOAD 0x10000000 +@@ -62,6 +63,7 @@ + /* packet buffer parity error detection enabled */ + /* descriptor FIFO parity error detection enable */ + #define E1000_CTRL_EXT_PBA_CLR 0x80000000 /* PBA Clear */ ++#define E1000_CTRL_EXT_PHYPDEN 0x00100000 + #define E1000_I2CCMD_REG_ADDR_SHIFT 16 + #define E1000_I2CCMD_PHY_ADDR_SHIFT 24 + #define E1000_I2CCMD_OPCODE_READ 0x08000000 +diff --git a/drivers/net/ethernet/intel/igb/e1000_hw.h b/drivers/net/ethernet/intel/igb/e1000_hw.h +index 37a9c06a6c68..80f20d1f1cfe 100644 +--- a/drivers/net/ethernet/intel/igb/e1000_hw.h ++++ b/drivers/net/ethernet/intel/igb/e1000_hw.h +@@ -569,4 +569,7 @@ extern struct net_device *igb_get_hw_dev(struct e1000_hw *hw); + /* These functions must be implemented by drivers */ + s32 igb_read_pcie_cap_reg(struct e1000_hw *hw, u32 reg, u16 *value); + s32 igb_write_pcie_cap_reg(struct e1000_hw *hw, u32 reg, u16 *value); ++ ++void igb_read_pci_cfg(struct e1000_hw *hw, u32 reg, u16 *value); ++void igb_write_pci_cfg(struct e1000_hw *hw, u32 reg, u16 *value); + #endif /* _E1000_HW_H_ */ +diff --git a/drivers/net/ethernet/intel/igb/e1000_i210.c b/drivers/net/ethernet/intel/igb/e1000_i210.c +index 0c0393316a3a..0217d4e229a0 100644 +--- a/drivers/net/ethernet/intel/igb/e1000_i210.c ++++ b/drivers/net/ethernet/intel/igb/e1000_i210.c +@@ -835,3 +835,69 @@ s32 igb_init_nvm_params_i210(struct e1000_hw *hw) + } + return ret_val; + } ++ ++/** ++ * igb_pll_workaround_i210 ++ * @hw: pointer to the HW structure ++ * ++ * Works around an errata in the PLL circuit where it occasionally ++ * provides the wrong clock frequency after power up. ++ **/ ++s32 igb_pll_workaround_i210(struct e1000_hw *hw) ++{ ++ s32 ret_val; ++ u32 wuc, mdicnfg, ctrl, ctrl_ext, reg_val; ++ u16 nvm_word, phy_word, pci_word, tmp_nvm; ++ int i; ++ ++ /* Get and set needed register values */ ++ wuc = rd32(E1000_WUC); ++ mdicnfg = rd32(E1000_MDICNFG); ++ reg_val = mdicnfg & ~E1000_MDICNFG_EXT_MDIO; ++ wr32(E1000_MDICNFG, reg_val); ++ ++ /* Get data from NVM, or set default */ ++ ret_val = igb_read_invm_word_i210(hw, E1000_INVM_AUTOLOAD, ++ &nvm_word); ++ if (ret_val) ++ nvm_word = E1000_INVM_DEFAULT_AL; ++ tmp_nvm = nvm_word | E1000_INVM_PLL_WO_VAL; ++ for (i = 0; i < E1000_MAX_PLL_TRIES; i++) { ++ /* check current state directly from internal PHY */ ++ igb_read_phy_reg_gs40g(hw, (E1000_PHY_PLL_FREQ_PAGE | ++ E1000_PHY_PLL_FREQ_REG), &phy_word); ++ if ((phy_word & E1000_PHY_PLL_UNCONF) ++ != E1000_PHY_PLL_UNCONF) { ++ ret_val = 0; ++ break; ++ } else { ++ ret_val = -E1000_ERR_PHY; ++ } ++ /* directly reset the internal PHY */ ++ ctrl = rd32(E1000_CTRL); ++ wr32(E1000_CTRL, ctrl|E1000_CTRL_PHY_RST); ++ ++ ctrl_ext = rd32(E1000_CTRL_EXT); ++ ctrl_ext |= (E1000_CTRL_EXT_PHYPDEN | E1000_CTRL_EXT_SDLPE); ++ wr32(E1000_CTRL_EXT, ctrl_ext); ++ ++ wr32(E1000_WUC, 0); ++ reg_val = (E1000_INVM_AUTOLOAD << 4) | (tmp_nvm << 16); ++ wr32(E1000_EEARBC_I210, reg_val); ++ ++ igb_read_pci_cfg(hw, E1000_PCI_PMCSR, &pci_word); ++ pci_word |= E1000_PCI_PMCSR_D3; ++ igb_write_pci_cfg(hw, E1000_PCI_PMCSR, &pci_word); ++ usleep_range(1000, 2000); ++ pci_word &= ~E1000_PCI_PMCSR_D3; ++ igb_write_pci_cfg(hw, E1000_PCI_PMCSR, &pci_word); ++ reg_val = (E1000_INVM_AUTOLOAD << 4) | (nvm_word << 16); ++ wr32(E1000_EEARBC_I210, reg_val); ++ ++ /* restore WUC register */ ++ wr32(E1000_WUC, wuc); ++ } ++ /* restore MDICNFG setting */ ++ wr32(E1000_MDICNFG, mdicnfg); ++ return ret_val; ++} +diff --git a/drivers/net/ethernet/intel/igb/e1000_i210.h b/drivers/net/ethernet/intel/igb/e1000_i210.h +index dde3c4b7ea99..99f4611d6f48 100644 +--- a/drivers/net/ethernet/intel/igb/e1000_i210.h ++++ b/drivers/net/ethernet/intel/igb/e1000_i210.h +@@ -48,6 +48,7 @@ extern s32 igb_write_xmdio_reg(struct e1000_hw *hw, u16 addr, u8 dev_addr, + u16 data); + extern s32 igb_init_nvm_params_i210(struct e1000_hw *hw); + extern bool igb_get_flash_presence_i210(struct e1000_hw *hw); ++s32 igb_pll_workaround_i210(struct e1000_hw *hw); + + #define E1000_STM_OPCODE 0xDB00 + #define E1000_EEPROM_FLASH_SIZE_WORD 0x11 +@@ -93,4 +94,15 @@ enum E1000_INVM_STRUCTURE_TYPE { + #define NVM_LED_1_CFG_DEFAULT_I211 0x0184 + #define NVM_LED_0_2_CFG_DEFAULT_I211 0x200C + ++/* PLL Defines */ ++#define E1000_PCI_PMCSR 0x44 ++#define E1000_PCI_PMCSR_D3 0x03 ++#define E1000_MAX_PLL_TRIES 5 ++#define E1000_PHY_PLL_UNCONF 0xFF ++#define E1000_PHY_PLL_FREQ_PAGE 0xFC0000 ++#define E1000_PHY_PLL_FREQ_REG 0x000E ++#define E1000_INVM_DEFAULT_AL 0x202F ++#define E1000_INVM_AUTOLOAD 0x0A ++#define E1000_INVM_PLL_WO_VAL 0x0010 ++ + #endif +diff --git a/drivers/net/ethernet/intel/igb/e1000_regs.h b/drivers/net/ethernet/intel/igb/e1000_regs.h +index 82632c6c53af..7156981ec813 100644 +--- a/drivers/net/ethernet/intel/igb/e1000_regs.h ++++ b/drivers/net/ethernet/intel/igb/e1000_regs.h +@@ -69,6 +69,7 @@ + #define E1000_PBA 0x01000 /* Packet Buffer Allocation - RW */ + #define E1000_PBS 0x01008 /* Packet Buffer Size */ + #define E1000_EEMNGCTL 0x01010 /* MNG EEprom Control */ ++#define E1000_EEARBC_I210 0x12024 /* EEPROM Auto Read Bus Control */ + #define E1000_EEWR 0x0102C /* EEPROM Write Register - RW */ + #define E1000_I2CCMD 0x01028 /* SFPI2C Command Register - RW */ + #define E1000_FRTIMER 0x01048 /* Free Running Timer - RW */ +diff --git a/drivers/net/ethernet/intel/igb/igb_main.c b/drivers/net/ethernet/intel/igb/igb_main.c +index 8cf44f2a8ccd..76e43c417a31 100644 +--- a/drivers/net/ethernet/intel/igb/igb_main.c ++++ b/drivers/net/ethernet/intel/igb/igb_main.c +@@ -6918,6 +6918,20 @@ static int igb_ioctl(struct net_device *netdev, struct ifreq *ifr, int cmd) + } + } + ++void igb_read_pci_cfg(struct e1000_hw *hw, u32 reg, u16 *value) ++{ ++ struct igb_adapter *adapter = hw->back; ++ ++ pci_read_config_word(adapter->pdev, reg, value); ++} ++ ++void igb_write_pci_cfg(struct e1000_hw *hw, u32 reg, u16 *value) ++{ ++ struct igb_adapter *adapter = hw->back; ++ ++ pci_write_config_word(adapter->pdev, reg, *value); ++} ++ + s32 igb_read_pcie_cap_reg(struct e1000_hw *hw, u32 reg, u16 *value) + { + struct igb_adapter *adapter = hw->back; +@@ -7281,6 +7295,8 @@ static int igb_sriov_reinit(struct pci_dev *dev) + + if (netif_running(netdev)) + igb_close(netdev); ++ else ++ igb_reset(adapter); + + igb_clear_interrupt_scheme(adapter); + +diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c +index 5cdd2b2f18c5..fabdda91fd0e 100644 +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -2358,7 +2358,7 @@ static void mvneta_adjust_link(struct net_device *ndev) + + if (phydev->speed == SPEED_1000) + val |= MVNETA_GMAC_CONFIG_GMII_SPEED; +- else ++ else if (phydev->speed == SPEED_100) + val |= MVNETA_GMAC_CONFIG_MII_SPEED; + + mvreg_write(pp, MVNETA_GMAC_AUTONEG_CONFIG, val); +diff --git a/drivers/net/ethernet/sun/sunvnet.c b/drivers/net/ethernet/sun/sunvnet.c +index 3df56840a3b9..398faff8be7a 100644 +--- a/drivers/net/ethernet/sun/sunvnet.c ++++ b/drivers/net/ethernet/sun/sunvnet.c +@@ -1083,6 +1083,24 @@ static struct vnet *vnet_find_or_create(const u64 *local_mac) + return vp; + } + ++static void vnet_cleanup(void) ++{ ++ struct vnet *vp; ++ struct net_device *dev; ++ ++ mutex_lock(&vnet_list_mutex); ++ while (!list_empty(&vnet_list)) { ++ vp = list_first_entry(&vnet_list, struct vnet, list); ++ list_del(&vp->list); ++ dev = vp->dev; ++ /* vio_unregister_driver() should have cleaned up port_list */ ++ BUG_ON(!list_empty(&vp->port_list)); ++ unregister_netdev(dev); ++ free_netdev(dev); ++ } ++ mutex_unlock(&vnet_list_mutex); ++} ++ + static const char *local_mac_prop = "local-mac-address"; + + static struct vnet *vnet_find_parent(struct mdesc_handle *hp, +@@ -1240,7 +1258,6 @@ static int vnet_port_remove(struct vio_dev *vdev) + + kfree(port); + +- unregister_netdev(vp->dev); + } + return 0; + } +@@ -1268,6 +1285,7 @@ static int __init vnet_init(void) + static void __exit vnet_exit(void) + { + vio_unregister_driver(&vnet_port_driver); ++ vnet_cleanup(); + } + + module_init(vnet_init); +diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c +index 82ee6ed954cb..addd23246eb6 100644 +--- a/drivers/net/ppp/pppoe.c ++++ b/drivers/net/ppp/pppoe.c +@@ -675,7 +675,7 @@ static int pppoe_connect(struct socket *sock, struct sockaddr *uservaddr, + po->chan.hdrlen = (sizeof(struct pppoe_hdr) + + dev->hard_header_len); + +- po->chan.mtu = dev->mtu - sizeof(struct pppoe_hdr); ++ po->chan.mtu = dev->mtu - sizeof(struct pppoe_hdr) - 2; + po->chan.private = sk; + po->chan.ops = &pppoe_chan_ops; + +diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c +index ad4a94e9ff57..87526443841f 100644 +--- a/drivers/net/slip/slip.c ++++ b/drivers/net/slip/slip.c +@@ -83,6 +83,7 @@ + #include <linux/delay.h> + #include <linux/init.h> + #include <linux/slab.h> ++#include <linux/workqueue.h> + #include "slip.h" + #ifdef CONFIG_INET + #include <linux/ip.h> +@@ -416,36 +417,46 @@ static void sl_encaps(struct slip *sl, unsigned char *icp, int len) + #endif + } + +-/* +- * Called by the driver when there's room for more data. If we have +- * more packets to send, we send them here. +- */ +-static void slip_write_wakeup(struct tty_struct *tty) ++/* Write out any remaining transmit buffer. Scheduled when tty is writable */ ++static void slip_transmit(struct work_struct *work) + { ++ struct slip *sl = container_of(work, struct slip, tx_work); + int actual; +- struct slip *sl = tty->disc_data; + ++ spin_lock_bh(&sl->lock); + /* First make sure we're connected. */ +- if (!sl || sl->magic != SLIP_MAGIC || !netif_running(sl->dev)) ++ if (!sl->tty || sl->magic != SLIP_MAGIC || !netif_running(sl->dev)) { ++ spin_unlock_bh(&sl->lock); + return; ++ } + +- spin_lock_bh(&sl->lock); + if (sl->xleft <= 0) { + /* Now serial buffer is almost free & we can start + * transmission of another packet */ + sl->dev->stats.tx_packets++; +- clear_bit(TTY_DO_WRITE_WAKEUP, &tty->flags); ++ clear_bit(TTY_DO_WRITE_WAKEUP, &sl->tty->flags); + spin_unlock_bh(&sl->lock); + sl_unlock(sl); + return; + } + +- actual = tty->ops->write(tty, sl->xhead, sl->xleft); ++ actual = sl->tty->ops->write(sl->tty, sl->xhead, sl->xleft); + sl->xleft -= actual; + sl->xhead += actual; + spin_unlock_bh(&sl->lock); + } + ++/* ++ * Called by the driver when there's room for more data. ++ * Schedule the transmit. ++ */ ++static void slip_write_wakeup(struct tty_struct *tty) ++{ ++ struct slip *sl = tty->disc_data; ++ ++ schedule_work(&sl->tx_work); ++} ++ + static void sl_tx_timeout(struct net_device *dev) + { + struct slip *sl = netdev_priv(dev); +@@ -749,6 +760,7 @@ static struct slip *sl_alloc(dev_t line) + sl->magic = SLIP_MAGIC; + sl->dev = dev; + spin_lock_init(&sl->lock); ++ INIT_WORK(&sl->tx_work, slip_transmit); + sl->mode = SL_MODE_DEFAULT; + #ifdef CONFIG_SLIP_SMART + /* initialize timer_list struct */ +@@ -872,8 +884,12 @@ static void slip_close(struct tty_struct *tty) + if (!sl || sl->magic != SLIP_MAGIC || sl->tty != tty) + return; + ++ spin_lock_bh(&sl->lock); + tty->disc_data = NULL; + sl->tty = NULL; ++ spin_unlock_bh(&sl->lock); ++ ++ flush_work(&sl->tx_work); + + /* VSV = very important to remove timers */ + #ifdef CONFIG_SLIP_SMART +diff --git a/drivers/net/slip/slip.h b/drivers/net/slip/slip.h +index 67673cf1266b..cf32aadf508f 100644 +--- a/drivers/net/slip/slip.h ++++ b/drivers/net/slip/slip.h +@@ -53,6 +53,7 @@ struct slip { + struct tty_struct *tty; /* ptr to TTY structure */ + struct net_device *dev; /* easy for intr handling */ + spinlock_t lock; ++ struct work_struct tx_work; /* Flushes transmit buffer */ + + #ifdef SL_INCLUDE_CSLIP + struct slcompress *slcomp; /* for header compression */ +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 135fb3ac330f..2d8bf4232502 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -647,6 +647,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x05c6, 0x9084, 4)}, + {QMI_FIXED_INTF(0x05c6, 0x920d, 0)}, + {QMI_FIXED_INTF(0x05c6, 0x920d, 5)}, ++ {QMI_FIXED_INTF(0x0846, 0x68a2, 8)}, + {QMI_FIXED_INTF(0x12d1, 0x140c, 1)}, /* Huawei E173 */ + {QMI_FIXED_INTF(0x12d1, 0x14ac, 1)}, /* Huawei E1820 */ + {QMI_FIXED_INTF(0x16d8, 0x6003, 0)}, /* CMOTech 6003 */ +@@ -721,6 +722,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x19d2, 0x1424, 2)}, + {QMI_FIXED_INTF(0x19d2, 0x1425, 2)}, + {QMI_FIXED_INTF(0x19d2, 0x1426, 2)}, /* ZTE MF91 */ ++ {QMI_FIXED_INTF(0x19d2, 0x1428, 2)}, /* Telewell TW-LTE 4G v2 */ + {QMI_FIXED_INTF(0x19d2, 0x2002, 4)}, /* ZTE (Vodafone) K3765-Z */ + {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)}, /* Sierra Wireless MC7700 */ + {QMI_FIXED_INTF(0x114f, 0x68a2, 8)}, /* Sierra Wireless MC7750 */ +@@ -733,6 +735,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x1199, 0x901f, 8)}, /* Sierra Wireless EM7355 */ + {QMI_FIXED_INTF(0x1199, 0x9041, 8)}, /* Sierra Wireless MC7305/MC7355 */ + {QMI_FIXED_INTF(0x1199, 0x9051, 8)}, /* Netgear AirCard 340U */ ++ {QMI_FIXED_INTF(0x1199, 0x9057, 8)}, + {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)}, /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */ + {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)}, /* Alcatel L800MA */ + {QMI_FIXED_INTF(0x2357, 0x0201, 4)}, /* TP-LINK HSUPA Modem MA180 */ +diff --git a/drivers/net/wireless/iwlwifi/dvm/rxon.c b/drivers/net/wireless/iwlwifi/dvm/rxon.c +index d7ce2f12a907..6a5b7593ea42 100644 +--- a/drivers/net/wireless/iwlwifi/dvm/rxon.c ++++ b/drivers/net/wireless/iwlwifi/dvm/rxon.c +@@ -1068,13 +1068,6 @@ int iwlagn_commit_rxon(struct iwl_priv *priv, struct iwl_rxon_context *ctx) + /* recalculate basic rates */ + iwl_calc_basic_rates(priv, ctx); + +- /* +- * force CTS-to-self frames protection if RTS-CTS is not preferred +- * one aggregation protection method +- */ +- if (!priv->hw_params.use_rts_for_aggregation) +- ctx->staging.flags |= RXON_FLG_SELF_CTS_EN; +- + if ((ctx->vif && ctx->vif->bss_conf.use_short_slot) || + !(ctx->staging.flags & RXON_FLG_BAND_24G_MSK)) + ctx->staging.flags |= RXON_FLG_SHORT_SLOT_MSK; +@@ -1480,11 +1473,6 @@ void iwlagn_bss_info_changed(struct ieee80211_hw *hw, + else + ctx->staging.flags &= ~RXON_FLG_TGG_PROTECT_MSK; + +- if (bss_conf->use_cts_prot) +- ctx->staging.flags |= RXON_FLG_SELF_CTS_EN; +- else +- ctx->staging.flags &= ~RXON_FLG_SELF_CTS_EN; +- + memcpy(ctx->staging.bssid_addr, bss_conf->bssid, ETH_ALEN); + + if (vif->type == NL80211_IFTYPE_AP || +diff --git a/drivers/net/wireless/mwifiex/main.c b/drivers/net/wireless/mwifiex/main.c +index c2b91f566e05..edf5239d93df 100644 +--- a/drivers/net/wireless/mwifiex/main.c ++++ b/drivers/net/wireless/mwifiex/main.c +@@ -654,6 +654,7 @@ mwifiex_hard_start_xmit(struct sk_buff *skb, struct net_device *dev) + } + + tx_info = MWIFIEX_SKB_TXCB(skb); ++ memset(tx_info, 0, sizeof(*tx_info)); + tx_info->bss_num = priv->bss_num; + tx_info->bss_type = priv->bss_type; + +diff --git a/drivers/tty/serial/sirfsoc_uart.c b/drivers/tty/serial/sirfsoc_uart.c +index 6904818d3424..25aecf0fa339 100644 +--- a/drivers/tty/serial/sirfsoc_uart.c ++++ b/drivers/tty/serial/sirfsoc_uart.c +@@ -359,9 +359,11 @@ static irqreturn_t sirfsoc_uart_usp_cts_handler(int irq, void *dev_id) + { + struct sirfsoc_uart_port *sirfport = (struct sirfsoc_uart_port *)dev_id; + struct uart_port *port = &sirfport->port; ++ spin_lock(&port->lock); + if (gpio_is_valid(sirfport->cts_gpio) && sirfport->ms_enabled) + uart_handle_cts_change(port, + !gpio_get_value(sirfport->cts_gpio)); ++ spin_unlock(&port->lock); + return IRQ_HANDLED; + } + +@@ -429,10 +431,6 @@ sirfsoc_uart_pio_rx_chars(struct uart_port *port, unsigned int max_rx_count) + sirfport->rx_io_count += rx_count; + port->icount.rx += rx_count; + +- spin_unlock(&port->lock); +- tty_flip_buffer_push(&port->state->port); +- spin_lock(&port->lock); +- + return rx_count; + } + +@@ -466,6 +464,7 @@ static void sirfsoc_uart_tx_dma_complete_callback(void *param) + struct circ_buf *xmit = &port->state->xmit; + unsigned long flags; + ++ spin_lock_irqsave(&port->lock, flags); + xmit->tail = (xmit->tail + sirfport->transfer_size) & + (UART_XMIT_SIZE - 1); + port->icount.tx += sirfport->transfer_size; +@@ -474,10 +473,9 @@ static void sirfsoc_uart_tx_dma_complete_callback(void *param) + if (sirfport->tx_dma_addr) + dma_unmap_single(port->dev, sirfport->tx_dma_addr, + sirfport->transfer_size, DMA_TO_DEVICE); +- spin_lock_irqsave(&sirfport->tx_lock, flags); + sirfport->tx_dma_state = TX_DMA_IDLE; + sirfsoc_uart_tx_with_dma(sirfport); +- spin_unlock_irqrestore(&sirfport->tx_lock, flags); ++ spin_unlock_irqrestore(&port->lock, flags); + } + + static void sirfsoc_uart_insert_rx_buf_to_tty( +@@ -490,7 +488,6 @@ static void sirfsoc_uart_insert_rx_buf_to_tty( + inserted = tty_insert_flip_string(tport, + sirfport->rx_dma_items[sirfport->rx_completed].xmit.buf, count); + port->icount.rx += inserted; +- tty_flip_buffer_push(tport); + } + + static void sirfsoc_rx_submit_one_dma_desc(struct uart_port *port, int index) +@@ -525,7 +522,7 @@ static void sirfsoc_rx_tmo_process_tl(unsigned long param) + unsigned int count; + unsigned long flags; + +- spin_lock_irqsave(&sirfport->rx_lock, flags); ++ spin_lock_irqsave(&port->lock, flags); + while (sirfport->rx_completed != sirfport->rx_issued) { + sirfsoc_uart_insert_rx_buf_to_tty(sirfport, + SIRFSOC_RX_DMA_BUF_SIZE); +@@ -540,12 +537,8 @@ static void sirfsoc_rx_tmo_process_tl(unsigned long param) + wr_regl(port, ureg->sirfsoc_rx_dma_io_ctrl, + rd_regl(port, ureg->sirfsoc_rx_dma_io_ctrl) | + SIRFUART_IO_MODE); +- spin_unlock_irqrestore(&sirfport->rx_lock, flags); +- spin_lock(&port->lock); + sirfsoc_uart_pio_rx_chars(port, 4 - sirfport->rx_io_count); +- spin_unlock(&port->lock); + if (sirfport->rx_io_count == 4) { +- spin_lock_irqsave(&sirfport->rx_lock, flags); + sirfport->rx_io_count = 0; + wr_regl(port, ureg->sirfsoc_int_st_reg, + uint_st->sirfsoc_rx_done); +@@ -556,11 +549,8 @@ static void sirfsoc_rx_tmo_process_tl(unsigned long param) + else + wr_regl(port, SIRFUART_INT_EN_CLR, + uint_en->sirfsoc_rx_done_en); +- spin_unlock_irqrestore(&sirfport->rx_lock, flags); +- + sirfsoc_uart_start_next_rx_dma(port); + } else { +- spin_lock_irqsave(&sirfport->rx_lock, flags); + wr_regl(port, ureg->sirfsoc_int_st_reg, + uint_st->sirfsoc_rx_done); + if (!sirfport->is_marco) +@@ -570,8 +560,9 @@ static void sirfsoc_rx_tmo_process_tl(unsigned long param) + else + wr_regl(port, ureg->sirfsoc_int_en_reg, + uint_en->sirfsoc_rx_done_en); +- spin_unlock_irqrestore(&sirfport->rx_lock, flags); + } ++ spin_unlock_irqrestore(&port->lock, flags); ++ tty_flip_buffer_push(&port->state->port); + } + + static void sirfsoc_uart_handle_rx_tmo(struct sirfsoc_uart_port *sirfport) +@@ -580,8 +571,6 @@ static void sirfsoc_uart_handle_rx_tmo(struct sirfsoc_uart_port *sirfport) + struct sirfsoc_register *ureg = &sirfport->uart_reg->uart_reg; + struct sirfsoc_int_en *uint_en = &sirfport->uart_reg->uart_int_en; + struct dma_tx_state tx_state; +- spin_lock(&sirfport->rx_lock); +- + dmaengine_tx_status(sirfport->rx_dma_chan, + sirfport->rx_dma_items[sirfport->rx_issued].cookie, &tx_state); + dmaengine_terminate_all(sirfport->rx_dma_chan); +@@ -594,7 +583,6 @@ static void sirfsoc_uart_handle_rx_tmo(struct sirfsoc_uart_port *sirfport) + else + wr_regl(port, SIRFUART_INT_EN_CLR, + uint_en->sirfsoc_rx_timeout_en); +- spin_unlock(&sirfport->rx_lock); + tasklet_schedule(&sirfport->rx_tmo_process_tasklet); + } + +@@ -658,7 +646,6 @@ static irqreturn_t sirfsoc_uart_isr(int irq, void *dev_id) + intr_status &= port->read_status_mask; + uart_insert_char(port, intr_status, + uint_en->sirfsoc_rx_oflow_en, 0, flag); +- tty_flip_buffer_push(&state->port); + } + recv_char: + if ((sirfport->uart_reg->uart_type == SIRF_REAL_UART) && +@@ -683,6 +670,9 @@ recv_char: + sirfsoc_uart_pio_rx_chars(port, + SIRFSOC_UART_IO_RX_MAX_CNT); + } ++ spin_unlock(&port->lock); ++ tty_flip_buffer_push(&state->port); ++ spin_lock(&port->lock); + if (intr_status & uint_st->sirfsoc_txfifo_empty) { + if (IS_DMA_CHAN_VALID(sirfport->tx_dma_no)) + sirfsoc_uart_tx_with_dma(sirfport); +@@ -701,6 +691,7 @@ recv_char: + } + } + spin_unlock(&port->lock); ++ + return IRQ_HANDLED; + } + +@@ -709,24 +700,27 @@ static void sirfsoc_uart_rx_dma_complete_tl(unsigned long param) + struct sirfsoc_uart_port *sirfport = (struct sirfsoc_uart_port *)param; + struct uart_port *port = &sirfport->port; + unsigned long flags; +- spin_lock_irqsave(&sirfport->rx_lock, flags); ++ spin_lock_irqsave(&port->lock, flags); + while (sirfport->rx_completed != sirfport->rx_issued) { + sirfsoc_uart_insert_rx_buf_to_tty(sirfport, + SIRFSOC_RX_DMA_BUF_SIZE); + sirfsoc_rx_submit_one_dma_desc(port, sirfport->rx_completed++); + sirfport->rx_completed %= SIRFSOC_RX_LOOP_BUF_CNT; + } +- spin_unlock_irqrestore(&sirfport->rx_lock, flags); ++ spin_unlock_irqrestore(&port->lock, flags); ++ tty_flip_buffer_push(&port->state->port); + } + + static void sirfsoc_uart_rx_dma_complete_callback(void *param) + { + struct sirfsoc_uart_port *sirfport = (struct sirfsoc_uart_port *)param; +- spin_lock(&sirfport->rx_lock); ++ unsigned long flags; ++ ++ spin_lock_irqsave(&sirfport->port.lock, flags); + sirfport->rx_issued++; + sirfport->rx_issued %= SIRFSOC_RX_LOOP_BUF_CNT; +- spin_unlock(&sirfport->rx_lock); + tasklet_schedule(&sirfport->rx_dma_complete_tasklet); ++ spin_unlock_irqrestore(&sirfport->port.lock, flags); + } + + /* submit rx dma task into dmaengine */ +@@ -735,18 +729,14 @@ static void sirfsoc_uart_start_next_rx_dma(struct uart_port *port) + struct sirfsoc_uart_port *sirfport = to_sirfport(port); + struct sirfsoc_register *ureg = &sirfport->uart_reg->uart_reg; + struct sirfsoc_int_en *uint_en = &sirfport->uart_reg->uart_int_en; +- unsigned long flags; + int i; +- spin_lock_irqsave(&sirfport->rx_lock, flags); + sirfport->rx_io_count = 0; + wr_regl(port, ureg->sirfsoc_rx_dma_io_ctrl, + rd_regl(port, ureg->sirfsoc_rx_dma_io_ctrl) & + ~SIRFUART_IO_MODE); +- spin_unlock_irqrestore(&sirfport->rx_lock, flags); + for (i = 0; i < SIRFSOC_RX_LOOP_BUF_CNT; i++) + sirfsoc_rx_submit_one_dma_desc(port, i); + sirfport->rx_completed = sirfport->rx_issued = 0; +- spin_lock_irqsave(&sirfport->rx_lock, flags); + if (!sirfport->is_marco) + wr_regl(port, ureg->sirfsoc_int_en_reg, + rd_regl(port, ureg->sirfsoc_int_en_reg) | +@@ -754,7 +744,6 @@ static void sirfsoc_uart_start_next_rx_dma(struct uart_port *port) + else + wr_regl(port, ureg->sirfsoc_int_en_reg, + SIRFUART_RX_DMA_INT_EN(port, uint_en)); +- spin_unlock_irqrestore(&sirfport->rx_lock, flags); + } + + static void sirfsoc_uart_start_rx(struct uart_port *port) +@@ -1455,8 +1444,6 @@ usp_no_flow_control: + ret = -EFAULT; + goto err; + } +- spin_lock_init(&sirfport->rx_lock); +- spin_lock_init(&sirfport->tx_lock); + tasklet_init(&sirfport->rx_dma_complete_tasklet, + sirfsoc_uart_rx_dma_complete_tl, (unsigned long)sirfport); + tasklet_init(&sirfport->rx_tmo_process_tasklet, +diff --git a/drivers/tty/serial/sirfsoc_uart.h b/drivers/tty/serial/sirfsoc_uart.h +index fb8d0a002607..38cb159138f1 100644 +--- a/drivers/tty/serial/sirfsoc_uart.h ++++ b/drivers/tty/serial/sirfsoc_uart.h +@@ -438,8 +438,6 @@ struct sirfsoc_uart_port { + struct dma_chan *tx_dma_chan; + dma_addr_t tx_dma_addr; + struct dma_async_tx_descriptor *tx_dma_desc; +- spinlock_t rx_lock; +- spinlock_t tx_lock; + struct tasklet_struct rx_dma_complete_tasklet; + struct tasklet_struct rx_tmo_process_tasklet; + unsigned int rx_io_count; +diff --git a/drivers/usb/chipidea/udc.c b/drivers/usb/chipidea/udc.c +index a18c2cfafe6d..455e4e6b9926 100644 +--- a/drivers/usb/chipidea/udc.c ++++ b/drivers/usb/chipidea/udc.c +@@ -1178,8 +1178,8 @@ static int ep_enable(struct usb_ep *ep, + + if (hwep->type == USB_ENDPOINT_XFER_CONTROL) + cap |= QH_IOS; +- if (hwep->num) +- cap |= QH_ZLT; ++ ++ cap |= QH_ZLT; + cap |= (hwep->ep.maxpacket << __ffs(QH_MAX_PKT)) & QH_MAX_PKT; + /* + * For ISO-TX, we set mult at QH as the largest value, and use +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 60a1f13db296..9c63a76cfedd 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -891,6 +891,25 @@ static int hub_usb3_port_disable(struct usb_hub *hub, int port1) + if (!hub_is_superspeed(hub->hdev)) + return -EINVAL; + ++ ret = hub_port_status(hub, port1, &portstatus, &portchange); ++ if (ret < 0) ++ return ret; ++ ++ /* ++ * USB controller Advanced Micro Devices, Inc. [AMD] FCH USB XHCI ++ * Controller [1022:7814] will have spurious result making the following ++ * usb 3.0 device hotplugging route to the 2.0 root hub and recognized ++ * as high-speed device if we set the usb 3.0 port link state to ++ * Disabled. Since it's already in USB_SS_PORT_LS_RX_DETECT state, we ++ * check the state here to avoid the bug. ++ */ ++ if ((portstatus & USB_PORT_STAT_LINK_STATE) == ++ USB_SS_PORT_LS_RX_DETECT) { ++ dev_dbg(&hub->ports[port1 - 1]->dev, ++ "Not disabling port; link state is RxDetect\n"); ++ return ret; ++ } ++ + ret = hub_set_port_link_state(hub, port1, USB_SS_PORT_LS_SS_DISABLED); + if (ret) + return ret; +diff --git a/fs/aio.c b/fs/aio.c +index e609e15f36b9..6d68e01dc7ca 100644 +--- a/fs/aio.c ++++ b/fs/aio.c +@@ -830,16 +830,20 @@ void exit_aio(struct mm_struct *mm) + static void put_reqs_available(struct kioctx *ctx, unsigned nr) + { + struct kioctx_cpu *kcpu; ++ unsigned long flags; + + preempt_disable(); + kcpu = this_cpu_ptr(ctx->cpu); + ++ local_irq_save(flags); + kcpu->reqs_available += nr; ++ + while (kcpu->reqs_available >= ctx->req_batch * 2) { + kcpu->reqs_available -= ctx->req_batch; + atomic_add(ctx->req_batch, &ctx->reqs_available); + } + ++ local_irq_restore(flags); + preempt_enable(); + } + +@@ -847,10 +851,12 @@ static bool get_reqs_available(struct kioctx *ctx) + { + struct kioctx_cpu *kcpu; + bool ret = false; ++ unsigned long flags; + + preempt_disable(); + kcpu = this_cpu_ptr(ctx->cpu); + ++ local_irq_save(flags); + if (!kcpu->reqs_available) { + int old, avail = atomic_read(&ctx->reqs_available); + +@@ -869,6 +875,7 @@ static bool get_reqs_available(struct kioctx *ctx) + ret = true; + kcpu->reqs_available--; + out: ++ local_irq_restore(flags); + preempt_enable(); + return ret; + } +diff --git a/fs/coredump.c b/fs/coredump.c +index 02db009d1531..88adbdd15193 100644 +--- a/fs/coredump.c ++++ b/fs/coredump.c +@@ -307,7 +307,7 @@ static int zap_threads(struct task_struct *tsk, struct mm_struct *mm, + if (unlikely(nr < 0)) + return nr; + +- tsk->flags = PF_DUMPCORE; ++ tsk->flags |= PF_DUMPCORE; + if (atomic_read(&mm->mm_users) == nr + 1) + goto done; + /* +diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c +index b7989f2ab4c4..936d40400c56 100644 +--- a/fs/fuse/dir.c ++++ b/fs/fuse/dir.c +@@ -188,7 +188,8 @@ static int fuse_dentry_revalidate(struct dentry *entry, unsigned int flags) + inode = ACCESS_ONCE(entry->d_inode); + if (inode && is_bad_inode(inode)) + goto invalid; +- else if (fuse_dentry_time(entry) < get_jiffies_64()) { ++ else if (time_before64(fuse_dentry_time(entry), get_jiffies_64()) || ++ (flags & LOOKUP_REVAL)) { + int err; + struct fuse_entry_out outarg; + struct fuse_req *req; +@@ -945,7 +946,7 @@ int fuse_update_attributes(struct inode *inode, struct kstat *stat, + int err; + bool r; + +- if (fi->i_time < get_jiffies_64()) { ++ if (time_before64(fi->i_time, get_jiffies_64())) { + r = true; + err = fuse_do_getattr(inode, stat, file); + } else { +@@ -1131,7 +1132,7 @@ static int fuse_permission(struct inode *inode, int mask) + ((mask & MAY_EXEC) && S_ISREG(inode->i_mode))) { + struct fuse_inode *fi = get_fuse_inode(inode); + +- if (fi->i_time < get_jiffies_64()) { ++ if (time_before64(fi->i_time, get_jiffies_64())) { + refreshed = true; + + err = fuse_perm_getattr(inode, mask); +diff --git a/fs/fuse/inode.c b/fs/fuse/inode.c +index a8ce6dab60a0..4937d4b51253 100644 +--- a/fs/fuse/inode.c ++++ b/fs/fuse/inode.c +@@ -461,6 +461,17 @@ static const match_table_t tokens = { + {OPT_ERR, NULL} + }; + ++static int fuse_match_uint(substring_t *s, unsigned int *res) ++{ ++ int err = -ENOMEM; ++ char *buf = match_strdup(s); ++ if (buf) { ++ err = kstrtouint(buf, 10, res); ++ kfree(buf); ++ } ++ return err; ++} ++ + static int parse_fuse_opt(char *opt, struct fuse_mount_data *d, int is_bdev) + { + char *p; +@@ -471,6 +482,7 @@ static int parse_fuse_opt(char *opt, struct fuse_mount_data *d, int is_bdev) + while ((p = strsep(&opt, ",")) != NULL) { + int token; + int value; ++ unsigned uv; + substring_t args[MAX_OPT_ARGS]; + if (!*p) + continue; +@@ -494,18 +506,18 @@ static int parse_fuse_opt(char *opt, struct fuse_mount_data *d, int is_bdev) + break; + + case OPT_USER_ID: +- if (match_int(&args[0], &value)) ++ if (fuse_match_uint(&args[0], &uv)) + return 0; +- d->user_id = make_kuid(current_user_ns(), value); ++ d->user_id = make_kuid(current_user_ns(), uv); + if (!uid_valid(d->user_id)) + return 0; + d->user_id_present = 1; + break; + + case OPT_GROUP_ID: +- if (match_int(&args[0], &value)) ++ if (fuse_match_uint(&args[0], &uv)) + return 0; +- d->group_id = make_kgid(current_user_ns(), value); ++ d->group_id = make_kgid(current_user_ns(), uv); + if (!gid_valid(d->group_id)) + return 0; + d->group_id_present = 1; +diff --git a/fs/namei.c b/fs/namei.c +index 338d08b7eae2..e3249d565c95 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -2281,9 +2281,10 @@ done: + goto out; + } + path->dentry = dentry; +- path->mnt = mntget(nd->path.mnt); ++ path->mnt = nd->path.mnt; + if (should_follow_link(dentry->d_inode, nd->flags & LOOKUP_FOLLOW)) + return 1; ++ mntget(path->mnt); + follow_mount(path); + error = 0; + out: +diff --git a/fs/quota/dquot.c b/fs/quota/dquot.c +index 9cd5f63715c0..7f30bdc57d13 100644 +--- a/fs/quota/dquot.c ++++ b/fs/quota/dquot.c +@@ -702,6 +702,7 @@ dqcache_shrink_scan(struct shrinker *shrink, struct shrink_control *sc) + struct dquot *dquot; + unsigned long freed = 0; + ++ spin_lock(&dq_list_lock); + head = free_dquots.prev; + while (head != &free_dquots && sc->nr_to_scan) { + dquot = list_entry(head, struct dquot, dq_free); +@@ -713,6 +714,7 @@ dqcache_shrink_scan(struct shrinker *shrink, struct shrink_control *sc) + freed++; + head = free_dquots.prev; + } ++ spin_unlock(&dq_list_lock); + return freed; + } + +diff --git a/include/linux/libata.h b/include/linux/libata.h +index 3fee55e73e5e..e13b3aef0b0c 100644 +--- a/include/linux/libata.h ++++ b/include/linux/libata.h +@@ -593,6 +593,7 @@ struct ata_host { + struct device *dev; + void __iomem * const *iomap; + unsigned int n_ports; ++ unsigned int n_tags; /* nr of NCQ tags */ + void *private_data; + struct ata_port_operations *ops; + unsigned long flags; +diff --git a/include/net/sock.h b/include/net/sock.h +index 4aa873a6267f..def541a583de 100644 +--- a/include/net/sock.h ++++ b/include/net/sock.h +@@ -1749,8 +1749,8 @@ sk_dst_get(struct sock *sk) + + rcu_read_lock(); + dst = rcu_dereference(sk->sk_dst_cache); +- if (dst) +- dst_hold(dst); ++ if (dst && !atomic_inc_not_zero(&dst->__refcnt)) ++ dst = NULL; + rcu_read_unlock(); + return dst; + } +@@ -1789,9 +1789,11 @@ __sk_dst_set(struct sock *sk, struct dst_entry *dst) + static inline void + sk_dst_set(struct sock *sk, struct dst_entry *dst) + { +- spin_lock(&sk->sk_dst_lock); +- __sk_dst_set(sk, dst); +- spin_unlock(&sk->sk_dst_lock); ++ struct dst_entry *old_dst; ++ ++ sk_tx_queue_clear(sk); ++ old_dst = xchg(&sk->sk_dst_cache, dst); ++ dst_release(old_dst); + } + + static inline void +@@ -1803,9 +1805,7 @@ __sk_dst_reset(struct sock *sk) + static inline void + sk_dst_reset(struct sock *sk) + { +- spin_lock(&sk->sk_dst_lock); +- __sk_dst_reset(sk); +- spin_unlock(&sk->sk_dst_lock); ++ sk_dst_set(sk, NULL); + } + + extern struct dst_entry *__sk_dst_check(struct sock *sk, u32 cookie); +diff --git a/kernel/Kconfig.locks b/kernel/Kconfig.locks +index d2b32ac27a39..ecee67a00f5f 100644 +--- a/kernel/Kconfig.locks ++++ b/kernel/Kconfig.locks +@@ -220,6 +220,9 @@ config INLINE_WRITE_UNLOCK_IRQRESTORE + + endif + ++config ARCH_SUPPORTS_ATOMIC_RMW ++ bool ++ + config MUTEX_SPIN_ON_OWNER + def_bool y +- depends on SMP && !DEBUG_MUTEXES ++ depends on SMP && !DEBUG_MUTEXES && ARCH_SUPPORTS_ATOMIC_RMW +diff --git a/kernel/power/process.c b/kernel/power/process.c +index 06ec8869dbf1..14f9a8d4725d 100644 +--- a/kernel/power/process.c ++++ b/kernel/power/process.c +@@ -184,6 +184,7 @@ void thaw_processes(void) + + printk("Restarting tasks ... "); + ++ __usermodehelper_set_disable_depth(UMH_FREEZING); + thaw_workqueues(); + + read_lock(&tasklist_lock); +diff --git a/kernel/sched/debug.c b/kernel/sched/debug.c +index fd9ca1de7559..0efe4a27540b 100644 +--- a/kernel/sched/debug.c ++++ b/kernel/sched/debug.c +@@ -554,7 +554,7 @@ void proc_sched_show_task(struct task_struct *p, struct seq_file *m) + + avg_atom = p->se.sum_exec_runtime; + if (nr_switches) +- do_div(avg_atom, nr_switches); ++ avg_atom = div64_ul(avg_atom, nr_switches); + else + avg_atom = -1LL; + +diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c +index 88c9c65a430d..fe75444ae7ec 100644 +--- a/kernel/time/alarmtimer.c ++++ b/kernel/time/alarmtimer.c +@@ -585,9 +585,14 @@ static int alarm_timer_set(struct k_itimer *timr, int flags, + struct itimerspec *new_setting, + struct itimerspec *old_setting) + { ++ ktime_t exp; ++ + if (!rtcdev) + return -ENOTSUPP; + ++ if (flags & ~TIMER_ABSTIME) ++ return -EINVAL; ++ + if (old_setting) + alarm_timer_get(timr, old_setting); + +@@ -597,8 +602,16 @@ static int alarm_timer_set(struct k_itimer *timr, int flags, + + /* start the timer */ + timr->it.alarm.interval = timespec_to_ktime(new_setting->it_interval); +- alarm_start(&timr->it.alarm.alarmtimer, +- timespec_to_ktime(new_setting->it_value)); ++ exp = timespec_to_ktime(new_setting->it_value); ++ /* Convert (if necessary) to absolute time */ ++ if (flags != TIMER_ABSTIME) { ++ ktime_t now; ++ ++ now = alarm_bases[timr->it.alarm.alarmtimer.type].gettime(); ++ exp = ktime_add(now, exp); ++ } ++ ++ alarm_start(&timr->it.alarm.alarmtimer, exp); + return 0; + } + +@@ -730,6 +743,9 @@ static int alarm_timer_nsleep(const clockid_t which_clock, int flags, + if (!alarmtimer_get_rtcdev()) + return -ENOTSUPP; + ++ if (flags & ~TIMER_ABSTIME) ++ return -EINVAL; ++ + if (!capable(CAP_WAKE_ALARM)) + return -EPERM; + +diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c +index a8642bac843e..d2ab10b3a30e 100644 +--- a/kernel/trace/ftrace.c ++++ b/kernel/trace/ftrace.c +@@ -331,12 +331,12 @@ static void update_ftrace_function(void) + func = ftrace_ops_list_func; + } + ++ update_function_graph_func(); ++ + /* If there's no change, then do nothing more here */ + if (ftrace_trace_function == func) + return; + +- update_function_graph_func(); +- + /* + * If we are using the list function, it doesn't care + * about the function_trace_ops. +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index 15c4ae203885..a758ec217bc0 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -616,10 +616,6 @@ int ring_buffer_poll_wait(struct ring_buffer *buffer, int cpu, + struct ring_buffer_per_cpu *cpu_buffer; + struct rb_irq_work *work; + +- if ((cpu == RING_BUFFER_ALL_CPUS && !ring_buffer_empty(buffer)) || +- (cpu != RING_BUFFER_ALL_CPUS && !ring_buffer_empty_cpu(buffer, cpu))) +- return POLLIN | POLLRDNORM; +- + if (cpu == RING_BUFFER_ALL_CPUS) + work = &buffer->irq_work; + else { +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 5e9cb157d31e..dcdf4e682dd4 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -434,6 +434,12 @@ int __trace_puts(unsigned long ip, const char *str, int size) + struct print_entry *entry; + unsigned long irq_flags; + int alloc; ++ int pc; ++ ++ if (!(trace_flags & TRACE_ITER_PRINTK)) ++ return 0; ++ ++ pc = preempt_count(); + + if (unlikely(tracing_selftest_running || tracing_disabled)) + return 0; +@@ -443,7 +449,7 @@ int __trace_puts(unsigned long ip, const char *str, int size) + local_save_flags(irq_flags); + buffer = global_trace.trace_buffer.buffer; + event = trace_buffer_lock_reserve(buffer, TRACE_PRINT, alloc, +- irq_flags, preempt_count()); ++ irq_flags, pc); + if (!event) + return 0; + +@@ -460,6 +466,7 @@ int __trace_puts(unsigned long ip, const char *str, int size) + entry->buf[size] = '\0'; + + __buffer_unlock_commit(buffer, event); ++ ftrace_trace_stack(buffer, irq_flags, 4, pc); + + return size; + } +@@ -477,6 +484,12 @@ int __trace_bputs(unsigned long ip, const char *str) + struct bputs_entry *entry; + unsigned long irq_flags; + int size = sizeof(struct bputs_entry); ++ int pc; ++ ++ if (!(trace_flags & TRACE_ITER_PRINTK)) ++ return 0; ++ ++ pc = preempt_count(); + + if (unlikely(tracing_selftest_running || tracing_disabled)) + return 0; +@@ -484,7 +497,7 @@ int __trace_bputs(unsigned long ip, const char *str) + local_save_flags(irq_flags); + buffer = global_trace.trace_buffer.buffer; + event = trace_buffer_lock_reserve(buffer, TRACE_BPUTS, size, +- irq_flags, preempt_count()); ++ irq_flags, pc); + if (!event) + return 0; + +@@ -493,6 +506,7 @@ int __trace_bputs(unsigned long ip, const char *str) + entry->str = str; + + __buffer_unlock_commit(buffer, event); ++ ftrace_trace_stack(buffer, irq_flags, 4, pc); + + return 1; + } +@@ -750,7 +764,7 @@ static struct { + { trace_clock_local, "local", 1 }, + { trace_clock_global, "global", 1 }, + { trace_clock_counter, "counter", 0 }, +- { trace_clock_jiffies, "uptime", 1 }, ++ { trace_clock_jiffies, "uptime", 0 }, + { trace_clock, "perf", 1 }, + ARCH_TRACE_CLOCKS + }; +diff --git a/kernel/trace/trace_clock.c b/kernel/trace/trace_clock.c +index 26dc348332b7..57b67b1f24d1 100644 +--- a/kernel/trace/trace_clock.c ++++ b/kernel/trace/trace_clock.c +@@ -59,13 +59,14 @@ u64 notrace trace_clock(void) + + /* + * trace_jiffy_clock(): Simply use jiffies as a clock counter. ++ * Note that this use of jiffies_64 is not completely safe on ++ * 32-bit systems. But the window is tiny, and the effect if ++ * we are affected is that we will have an obviously bogus ++ * timestamp on a trace event - i.e. not life threatening. + */ + u64 notrace trace_clock_jiffies(void) + { +- u64 jiffy = jiffies - INITIAL_JIFFIES; +- +- /* Return nsecs */ +- return (u64)jiffies_to_usecs(jiffy) * 1000ULL; ++ return jiffies_64_to_clock_t(jiffies_64 - INITIAL_JIFFIES); + } + + /* +diff --git a/mm/kmemleak.c b/mm/kmemleak.c +index e126b0ef9ad2..31f01c5011e5 100644 +--- a/mm/kmemleak.c ++++ b/mm/kmemleak.c +@@ -753,7 +753,9 @@ static void add_scan_area(unsigned long ptr, size_t size, gfp_t gfp) + } + + spin_lock_irqsave(&object->lock, flags); +- if (ptr + size > object->pointer + object->size) { ++ if (size == SIZE_MAX) { ++ size = object->pointer + object->size - ptr; ++ } else if (ptr + size > object->pointer + object->size) { + kmemleak_warn("Scan area larger than object 0x%08lx\n", ptr); + dump_object_info(object); + kmem_cache_free(scan_area_cache, area); +diff --git a/mm/shmem.c b/mm/shmem.c +index 8297623fcaed..0da81aaeb4cc 100644 +--- a/mm/shmem.c ++++ b/mm/shmem.c +@@ -80,11 +80,12 @@ static struct vfsmount *shm_mnt; + #define SHORT_SYMLINK_LEN 128 + + /* +- * shmem_fallocate and shmem_writepage communicate via inode->i_private +- * (with i_mutex making sure that it has only one user at a time): +- * we would prefer not to enlarge the shmem inode just for that. ++ * shmem_fallocate communicates with shmem_fault or shmem_writepage via ++ * inode->i_private (with i_mutex making sure that it has only one user at ++ * a time): we would prefer not to enlarge the shmem inode just for that. + */ + struct shmem_falloc { ++ wait_queue_head_t *waitq; /* faults into hole wait for punch to end */ + pgoff_t start; /* start of range currently being fallocated */ + pgoff_t next; /* the next page offset to be fallocated */ + pgoff_t nr_falloced; /* how many new pages have been fallocated */ +@@ -533,22 +534,19 @@ static void shmem_undo_range(struct inode *inode, loff_t lstart, loff_t lend, + return; + + index = start; +- for ( ; ; ) { ++ while (index < end) { + cond_resched(); + pvec.nr = shmem_find_get_pages_and_swap(mapping, index, + min(end - index, (pgoff_t)PAGEVEC_SIZE), + pvec.pages, indices); + if (!pvec.nr) { +- if (index == start || unfalloc) ++ /* If all gone or hole-punch or unfalloc, we're done */ ++ if (index == start || end != -1) + break; ++ /* But if truncating, restart to make sure all gone */ + index = start; + continue; + } +- if ((index == start || unfalloc) && indices[0] >= end) { +- shmem_deswap_pagevec(&pvec); +- pagevec_release(&pvec); +- break; +- } + mem_cgroup_uncharge_start(); + for (i = 0; i < pagevec_count(&pvec); i++) { + struct page *page = pvec.pages[i]; +@@ -560,8 +558,12 @@ static void shmem_undo_range(struct inode *inode, loff_t lstart, loff_t lend, + if (radix_tree_exceptional_entry(page)) { + if (unfalloc) + continue; +- nr_swaps_freed += !shmem_free_swap(mapping, +- index, page); ++ if (shmem_free_swap(mapping, index, page)) { ++ /* Swap was replaced by page: retry */ ++ index--; ++ break; ++ } ++ nr_swaps_freed++; + continue; + } + +@@ -570,6 +572,11 @@ static void shmem_undo_range(struct inode *inode, loff_t lstart, loff_t lend, + if (page->mapping == mapping) { + VM_BUG_ON(PageWriteback(page)); + truncate_inode_page(mapping, page); ++ } else { ++ /* Page was replaced by swap: retry */ ++ unlock_page(page); ++ index--; ++ break; + } + } + unlock_page(page); +@@ -826,6 +833,7 @@ static int shmem_writepage(struct page *page, struct writeback_control *wbc) + spin_lock(&inode->i_lock); + shmem_falloc = inode->i_private; + if (shmem_falloc && ++ !shmem_falloc->waitq && + index >= shmem_falloc->start && + index < shmem_falloc->next) + shmem_falloc->nr_unswapped++; +@@ -1300,6 +1308,64 @@ static int shmem_fault(struct vm_area_struct *vma, struct vm_fault *vmf) + int error; + int ret = VM_FAULT_LOCKED; + ++ /* ++ * Trinity finds that probing a hole which tmpfs is punching can ++ * prevent the hole-punch from ever completing: which in turn ++ * locks writers out with its hold on i_mutex. So refrain from ++ * faulting pages into the hole while it's being punched. Although ++ * shmem_undo_range() does remove the additions, it may be unable to ++ * keep up, as each new page needs its own unmap_mapping_range() call, ++ * and the i_mmap tree grows ever slower to scan if new vmas are added. ++ * ++ * It does not matter if we sometimes reach this check just before the ++ * hole-punch begins, so that one fault then races with the punch: ++ * we just need to make racing faults a rare case. ++ * ++ * The implementation below would be much simpler if we just used a ++ * standard mutex or completion: but we cannot take i_mutex in fault, ++ * and bloating every shmem inode for this unlikely case would be sad. ++ */ ++ if (unlikely(inode->i_private)) { ++ struct shmem_falloc *shmem_falloc; ++ ++ spin_lock(&inode->i_lock); ++ shmem_falloc = inode->i_private; ++ if (shmem_falloc && ++ shmem_falloc->waitq && ++ vmf->pgoff >= shmem_falloc->start && ++ vmf->pgoff < shmem_falloc->next) { ++ wait_queue_head_t *shmem_falloc_waitq; ++ DEFINE_WAIT(shmem_fault_wait); ++ ++ ret = VM_FAULT_NOPAGE; ++ if ((vmf->flags & FAULT_FLAG_ALLOW_RETRY) && ++ !(vmf->flags & FAULT_FLAG_RETRY_NOWAIT)) { ++ /* It's polite to up mmap_sem if we can */ ++ up_read(&vma->vm_mm->mmap_sem); ++ ret = VM_FAULT_RETRY; ++ } ++ ++ shmem_falloc_waitq = shmem_falloc->waitq; ++ prepare_to_wait(shmem_falloc_waitq, &shmem_fault_wait, ++ TASK_UNINTERRUPTIBLE); ++ spin_unlock(&inode->i_lock); ++ schedule(); ++ ++ /* ++ * shmem_falloc_waitq points into the shmem_fallocate() ++ * stack of the hole-punching task: shmem_falloc_waitq ++ * is usually invalid by the time we reach here, but ++ * finish_wait() does not dereference it in that case; ++ * though i_lock needed lest racing with wake_up_all(). ++ */ ++ spin_lock(&inode->i_lock); ++ finish_wait(shmem_falloc_waitq, &shmem_fault_wait); ++ spin_unlock(&inode->i_lock); ++ return ret; ++ } ++ spin_unlock(&inode->i_lock); ++ } ++ + error = shmem_getpage(inode, vmf->pgoff, &vmf->page, SGP_CACHE, &ret); + if (error) + return ((error == -ENOMEM) ? VM_FAULT_OOM : VM_FAULT_SIGBUS); +@@ -1819,12 +1885,25 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset, + struct address_space *mapping = file->f_mapping; + loff_t unmap_start = round_up(offset, PAGE_SIZE); + loff_t unmap_end = round_down(offset + len, PAGE_SIZE) - 1; ++ DECLARE_WAIT_QUEUE_HEAD_ONSTACK(shmem_falloc_waitq); ++ ++ shmem_falloc.waitq = &shmem_falloc_waitq; ++ shmem_falloc.start = unmap_start >> PAGE_SHIFT; ++ shmem_falloc.next = (unmap_end + 1) >> PAGE_SHIFT; ++ spin_lock(&inode->i_lock); ++ inode->i_private = &shmem_falloc; ++ spin_unlock(&inode->i_lock); + + if ((u64)unmap_end > (u64)unmap_start) + unmap_mapping_range(mapping, unmap_start, + 1 + unmap_end - unmap_start, 0); + shmem_truncate_range(inode, offset, offset + len - 1); + /* No need to unmap again: hole-punching leaves COWed pages */ ++ ++ spin_lock(&inode->i_lock); ++ inode->i_private = NULL; ++ wake_up_all(&shmem_falloc_waitq); ++ spin_unlock(&inode->i_lock); + error = 0; + goto out; + } +@@ -1842,6 +1921,7 @@ static long shmem_fallocate(struct file *file, int mode, loff_t offset, + goto out; + } + ++ shmem_falloc.waitq = NULL; + shmem_falloc.start = start; + shmem_falloc.next = start; + shmem_falloc.nr_falloced = 0; +diff --git a/mm/slab_common.c b/mm/slab_common.c +index e2e98af703ea..97e5f5eeca12 100644 +--- a/mm/slab_common.c ++++ b/mm/slab_common.c +@@ -56,7 +56,7 @@ static int kmem_cache_sanity_check(struct mem_cgroup *memcg, const char *name, + continue; + } + +-#if !defined(CONFIG_SLUB) || !defined(CONFIG_SLUB_DEBUG_ON) ++#if !defined(CONFIG_SLUB) + /* + * For simplicity, we won't check this in the list of memcg + * caches. We have control over memcg naming, and if there +diff --git a/mm/vmalloc.c b/mm/vmalloc.c +index 107454312d5e..e2be0f802ccf 100644 +--- a/mm/vmalloc.c ++++ b/mm/vmalloc.c +@@ -359,6 +359,12 @@ static struct vmap_area *alloc_vmap_area(unsigned long size, + if (unlikely(!va)) + return ERR_PTR(-ENOMEM); + ++ /* ++ * Only scan the relevant parts containing pointers to other objects ++ * to avoid false negatives. ++ */ ++ kmemleak_scan_area(&va->rb_node, SIZE_MAX, gfp_mask & GFP_RECLAIM_MASK); ++ + retry: + spin_lock(&vmap_area_lock); + /* +@@ -1646,11 +1652,11 @@ void *__vmalloc_node_range(unsigned long size, unsigned long align, + clear_vm_uninitialized_flag(area); + + /* +- * A ref_count = 3 is needed because the vm_struct and vmap_area +- * structures allocated in the __get_vm_area_node() function contain +- * references to the virtual address of the vmalloc'ed block. ++ * A ref_count = 2 is needed because vm_struct allocated in ++ * __get_vm_area_node() contains a reference to the virtual address of ++ * the vmalloc'ed block. + */ +- kmemleak_alloc(addr, real_size, 3, gfp_mask); ++ kmemleak_alloc(addr, real_size, 2, gfp_mask); + + return addr; + +diff --git a/mm/vmscan.c b/mm/vmscan.c +index 1d891f49587b..5ad29b2925a0 100644 +--- a/mm/vmscan.c ++++ b/mm/vmscan.c +@@ -1522,19 +1522,18 @@ shrink_inactive_list(unsigned long nr_to_scan, struct lruvec *lruvec, + * If dirty pages are scanned that are not queued for IO, it + * implies that flushers are not keeping up. In this case, flag + * the zone ZONE_TAIL_LRU_DIRTY and kswapd will start writing +- * pages from reclaim context. It will forcibly stall in the +- * next check. ++ * pages from reclaim context. + */ + if (nr_unqueued_dirty == nr_taken) + zone_set_flag(zone, ZONE_TAIL_LRU_DIRTY); + + /* +- * In addition, if kswapd scans pages marked marked for +- * immediate reclaim and under writeback (nr_immediate), it +- * implies that pages are cycling through the LRU faster than ++ * If kswapd scans pages marked marked for immediate ++ * reclaim and under writeback (nr_immediate), it implies ++ * that pages are cycling through the LRU faster than + * they are written so also forcibly stall. + */ +- if (nr_unqueued_dirty == nr_taken || nr_immediate) ++ if (nr_immediate) + congestion_wait(BLK_RW_ASYNC, HZ/10); + } + +diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c +index 6ee48aac776f..7e57135c7cc4 100644 +--- a/net/8021q/vlan_core.c ++++ b/net/8021q/vlan_core.c +@@ -108,8 +108,11 @@ EXPORT_SYMBOL(vlan_dev_vlan_id); + + static struct sk_buff *vlan_reorder_header(struct sk_buff *skb) + { +- if (skb_cow(skb, skb_headroom(skb)) < 0) ++ if (skb_cow(skb, skb_headroom(skb)) < 0) { ++ kfree_skb(skb); + return NULL; ++ } ++ + memmove(skb->data - ETH_HLEN, skb->data - VLAN_ETH_HLEN, 2 * ETH_ALEN); + skb->mac_header += VLAN_HLEN; + return skb; +diff --git a/net/appletalk/ddp.c b/net/appletalk/ddp.c +index 7d424ac6e760..43e875c84429 100644 +--- a/net/appletalk/ddp.c ++++ b/net/appletalk/ddp.c +@@ -1489,8 +1489,6 @@ static int atalk_rcv(struct sk_buff *skb, struct net_device *dev, + goto drop; + + /* Queue packet (standard) */ +- skb->sk = sock; +- + if (sock_queue_rcv_skb(sock, skb) < 0) + goto drop; + +@@ -1644,7 +1642,6 @@ static int atalk_sendmsg(struct kiocb *iocb, struct socket *sock, struct msghdr + if (!skb) + goto out; + +- skb->sk = sk; + skb_reserve(skb, ddp_dl->header_length); + skb_reserve(skb, dev->hard_header_len); + skb->dev = dev; +diff --git a/net/core/dev.c b/net/core/dev.c +index 704c0c5bed1f..ef2f239cc322 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -1202,7 +1202,11 @@ EXPORT_SYMBOL(netdev_features_change); + void netdev_state_change(struct net_device *dev) + { + if (dev->flags & IFF_UP) { +- call_netdevice_notifiers(NETDEV_CHANGE, dev); ++ struct netdev_notifier_change_info change_info; ++ ++ change_info.flags_changed = 0; ++ call_netdevice_notifiers_info(NETDEV_CHANGE, dev, ++ &change_info.info); + rtmsg_ifinfo(RTM_NEWLINK, dev, 0); + } + } +diff --git a/net/core/dst.c b/net/core/dst.c +index ca4231ec7347..15b6792e6ebb 100644 +--- a/net/core/dst.c ++++ b/net/core/dst.c +@@ -267,6 +267,15 @@ again: + } + EXPORT_SYMBOL(dst_destroy); + ++static void dst_destroy_rcu(struct rcu_head *head) ++{ ++ struct dst_entry *dst = container_of(head, struct dst_entry, rcu_head); ++ ++ dst = dst_destroy(dst); ++ if (dst) ++ __dst_free(dst); ++} ++ + void dst_release(struct dst_entry *dst) + { + if (dst) { +@@ -274,11 +283,8 @@ void dst_release(struct dst_entry *dst) + + newrefcnt = atomic_dec_return(&dst->__refcnt); + WARN_ON(newrefcnt < 0); +- if (unlikely(dst->flags & DST_NOCACHE) && !newrefcnt) { +- dst = dst_destroy(dst); +- if (dst) +- __dst_free(dst); +- } ++ if (unlikely(dst->flags & DST_NOCACHE) && !newrefcnt) ++ call_rcu(&dst->rcu_head, dst_destroy_rcu); + } + } + EXPORT_SYMBOL(dst_release); +diff --git a/net/core/skbuff.c b/net/core/skbuff.c +index 5a60953e6f39..aeb870c5c134 100644 +--- a/net/core/skbuff.c ++++ b/net/core/skbuff.c +@@ -2744,12 +2744,13 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb, + int i = 0; + int pos; + ++ __skb_push(head_skb, doffset); + proto = skb_network_protocol(head_skb); + if (unlikely(!proto)) + return ERR_PTR(-EINVAL); + + csum = !!can_checksum_protocol(features, proto); +- __skb_push(head_skb, doffset); ++ + headroom = skb_headroom(head_skb); + pos = skb_headlen(head_skb); + +diff --git a/net/dns_resolver/dns_query.c b/net/dns_resolver/dns_query.c +index c32be292c7e3..ede0e2d7412e 100644 +--- a/net/dns_resolver/dns_query.c ++++ b/net/dns_resolver/dns_query.c +@@ -150,7 +150,9 @@ int dns_query(const char *type, const char *name, size_t namelen, + if (!*_result) + goto put; + +- memcpy(*_result, upayload->data, len + 1); ++ memcpy(*_result, upayload->data, len); ++ *_result[len] = '\0'; ++ + if (_expiry) + *_expiry = rkey->expiry; + +diff --git a/net/ipv4/icmp.c b/net/ipv4/icmp.c +index 5f7d11a45871..ff670cab5af5 100644 +--- a/net/ipv4/icmp.c ++++ b/net/ipv4/icmp.c +@@ -705,8 +705,6 @@ static void icmp_unreach(struct sk_buff *skb) + &iph->daddr); + } else { + info = ntohs(icmph->un.frag.mtu); +- if (!info) +- goto out; + } + break; + case ICMP_SR_FAILED: +diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c +index 7defdc9ba167..9fa5c0908ce3 100644 +--- a/net/ipv4/igmp.c ++++ b/net/ipv4/igmp.c +@@ -1952,6 +1952,10 @@ int ip_mc_leave_group(struct sock *sk, struct ip_mreqn *imr) + + rtnl_lock(); + in_dev = ip_mc_find_dev(net, imr); ++ if (!in_dev) { ++ ret = -ENODEV; ++ goto out; ++ } + ifindex = imr->imr_ifindex; + for (imlp = &inet->mc_list; + (iml = rtnl_dereference(*imlp)) != NULL; +@@ -1969,16 +1973,14 @@ int ip_mc_leave_group(struct sock *sk, struct ip_mreqn *imr) + + *imlp = iml->next_rcu; + +- if (in_dev) +- ip_mc_dec_group(in_dev, group); ++ ip_mc_dec_group(in_dev, group); + rtnl_unlock(); + /* decrease mem now to avoid the memleak warning */ + atomic_sub(sizeof(*iml), &sk->sk_omem_alloc); + kfree_rcu(iml, rcu); + return 0; + } +- if (!in_dev) +- ret = -ENODEV; ++out: + rtnl_unlock(); + return ret; + } +diff --git a/net/ipv4/ip_options.c b/net/ipv4/ip_options.c +index ec7264514a82..089ed81d1878 100644 +--- a/net/ipv4/ip_options.c ++++ b/net/ipv4/ip_options.c +@@ -288,6 +288,10 @@ int ip_options_compile(struct net *net, + optptr++; + continue; + } ++ if (unlikely(l < 2)) { ++ pp_ptr = optptr; ++ goto error; ++ } + optlen = optptr[1]; + if (optlen<2 || optlen>l) { + pp_ptr = optptr; +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index d9dbe0f78612..edd5a8171357 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -166,6 +166,7 @@ struct ip_tunnel *ip_tunnel_lookup(struct ip_tunnel_net *itn, + + hlist_for_each_entry_rcu(t, head, hash_node) { + if (remote != t->parms.iph.daddr || ++ t->parms.iph.saddr != 0 || + !(t->dev->flags & IFF_UP)) + continue; + +@@ -182,10 +183,11 @@ struct ip_tunnel *ip_tunnel_lookup(struct ip_tunnel_net *itn, + head = &itn->tunnels[hash]; + + hlist_for_each_entry_rcu(t, head, hash_node) { +- if ((local != t->parms.iph.saddr && +- (local != t->parms.iph.daddr || +- !ipv4_is_multicast(local))) || +- !(t->dev->flags & IFF_UP)) ++ if ((local != t->parms.iph.saddr || t->parms.iph.daddr != 0) && ++ (local != t->parms.iph.daddr || !ipv4_is_multicast(local))) ++ continue; ++ ++ if (!(t->dev->flags & IFF_UP)) + continue; + + if (!ip_tunnel_key_match(&t->parms, flags, key)) +@@ -202,6 +204,8 @@ struct ip_tunnel *ip_tunnel_lookup(struct ip_tunnel_net *itn, + + hlist_for_each_entry_rcu(t, head, hash_node) { + if (t->parms.i_key != key || ++ t->parms.iph.saddr != 0 || ++ t->parms.iph.daddr != 0 || + !(t->dev->flags & IFF_UP)) + continue; + +diff --git a/net/ipv4/route.c b/net/ipv4/route.c +index 2b681867164d..310963d7c028 100644 +--- a/net/ipv4/route.c ++++ b/net/ipv4/route.c +@@ -1032,20 +1032,21 @@ void ipv4_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, u32 mtu) + const struct iphdr *iph = (const struct iphdr *) skb->data; + struct flowi4 fl4; + struct rtable *rt; +- struct dst_entry *dst; ++ struct dst_entry *odst = NULL; + bool new = false; + + bh_lock_sock(sk); +- rt = (struct rtable *) __sk_dst_get(sk); ++ odst = sk_dst_get(sk); + +- if (sock_owned_by_user(sk) || !rt) { ++ if (sock_owned_by_user(sk) || !odst) { + __ipv4_sk_update_pmtu(skb, sk, mtu); + goto out; + } + + __build_flow_key(&fl4, sk, iph, 0, 0, 0, 0, 0); + +- if (!__sk_dst_check(sk, 0)) { ++ rt = (struct rtable *)odst; ++ if (odst->obsolete && odst->ops->check(odst, 0) == NULL) { + rt = ip_route_output_flow(sock_net(sk), &fl4, sk); + if (IS_ERR(rt)) + goto out; +@@ -1055,8 +1056,7 @@ void ipv4_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, u32 mtu) + + __ip_rt_update_pmtu((struct rtable *) rt->dst.path, &fl4, mtu); + +- dst = dst_check(&rt->dst, 0); +- if (!dst) { ++ if (!dst_check(&rt->dst, 0)) { + if (new) + dst_release(&rt->dst); + +@@ -1068,10 +1068,11 @@ void ipv4_sk_update_pmtu(struct sk_buff *skb, struct sock *sk, u32 mtu) + } + + if (new) +- __sk_dst_set(sk, &rt->dst); ++ sk_dst_set(sk, &rt->dst); + + out: + bh_unlock_sock(sk); ++ dst_release(odst); + } + EXPORT_SYMBOL_GPL(ipv4_sk_update_pmtu); + +diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c +index 531ab5721d79..cbe5adaad338 100644 +--- a/net/ipv4/tcp.c ++++ b/net/ipv4/tcp.c +@@ -1064,7 +1064,7 @@ int tcp_sendmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg, + if (unlikely(tp->repair)) { + if (tp->repair_queue == TCP_RECV_QUEUE) { + copied = tcp_send_rcvq(sk, msg, size); +- goto out; ++ goto out_nopush; + } + + err = -EINVAL; +@@ -1237,6 +1237,7 @@ wait_for_memory: + out: + if (copied) + tcp_push(sk, flags, mss_now, tp->nonagle); ++out_nopush: + release_sock(sk); + return copied + copied_syn; + +diff --git a/net/ipv4/tcp_input.c b/net/ipv4/tcp_input.c +index 0e8af08a98fc..95f67671f56e 100644 +--- a/net/ipv4/tcp_input.c ++++ b/net/ipv4/tcp_input.c +@@ -1064,7 +1064,7 @@ static bool tcp_check_dsack(struct sock *sk, const struct sk_buff *ack_skb, + } + + /* D-SACK for already forgotten data... Do dumb counting. */ +- if (dup_sack && tp->undo_marker && tp->undo_retrans && ++ if (dup_sack && tp->undo_marker && tp->undo_retrans > 0 && + !after(end_seq_0, prior_snd_una) && + after(end_seq_0, tp->undo_marker)) + tp->undo_retrans--; +@@ -1120,7 +1120,7 @@ static int tcp_match_skb_to_sack(struct sock *sk, struct sk_buff *skb, + unsigned int new_len = (pkt_len / mss) * mss; + if (!in_sack && new_len < pkt_len) { + new_len += mss; +- if (new_len > skb->len) ++ if (new_len >= skb->len) + return 0; + } + pkt_len = new_len; +@@ -1144,7 +1144,7 @@ static u8 tcp_sacktag_one(struct sock *sk, + + /* Account D-SACK for retransmitted packet. */ + if (dup_sack && (sacked & TCPCB_RETRANS)) { +- if (tp->undo_marker && tp->undo_retrans && ++ if (tp->undo_marker && tp->undo_retrans > 0 && + after(end_seq, tp->undo_marker)) + tp->undo_retrans--; + if (sacked & TCPCB_SACKED_ACKED) +@@ -1845,7 +1845,7 @@ static void tcp_clear_retrans_partial(struct tcp_sock *tp) + tp->lost_out = 0; + + tp->undo_marker = 0; +- tp->undo_retrans = 0; ++ tp->undo_retrans = -1; + } + + void tcp_clear_retrans(struct tcp_sock *tp) +@@ -2613,7 +2613,7 @@ static void tcp_enter_recovery(struct sock *sk, bool ece_ack) + + tp->prior_ssthresh = 0; + tp->undo_marker = tp->snd_una; +- tp->undo_retrans = tp->retrans_out; ++ tp->undo_retrans = tp->retrans_out ? : -1; + + if (inet_csk(sk)->icsk_ca_state < TCP_CA_CWR) { + if (!ece_ack) +diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c +index 826fc6fab576..0cce660cf7dd 100644 +--- a/net/ipv4/tcp_output.c ++++ b/net/ipv4/tcp_output.c +@@ -2437,8 +2437,6 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb) + if (!tp->retrans_stamp) + tp->retrans_stamp = TCP_SKB_CB(skb)->when; + +- tp->undo_retrans += tcp_skb_pcount(skb); +- + /* snd_nxt is stored to detect loss of retransmitted segment, + * see tcp_input.c tcp_sacktag_write_queue(). + */ +@@ -2446,6 +2444,10 @@ int tcp_retransmit_skb(struct sock *sk, struct sk_buff *skb) + } else { + NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_TCPRETRANSFAIL); + } ++ ++ if (tp->undo_retrans < 0) ++ tp->undo_retrans = 0; ++ tp->undo_retrans += tcp_skb_pcount(skb); + return err; + } + +diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c +index e6d457c4a4e4..d9a2598a5190 100644 +--- a/net/netlink/af_netlink.c ++++ b/net/netlink/af_netlink.c +@@ -628,7 +628,7 @@ static unsigned int netlink_poll(struct file *file, struct socket *sock, + while (nlk->cb_running && netlink_dump_space(nlk)) { + err = netlink_dump(sk); + if (err < 0) { +- sk->sk_err = err; ++ sk->sk_err = -err; + sk->sk_error_report(sk); + break; + } +@@ -2440,7 +2440,7 @@ static int netlink_recvmsg(struct kiocb *kiocb, struct socket *sock, + atomic_read(&sk->sk_rmem_alloc) <= sk->sk_rcvbuf / 2) { + ret = netlink_dump(sk); + if (ret) { +- sk->sk_err = ret; ++ sk->sk_err = -ret; + sk->sk_error_report(sk); + } + } +diff --git a/net/sctp/sysctl.c b/net/sctp/sysctl.c +index 3e5ac1948607..968355f0de60 100644 +--- a/net/sctp/sysctl.c ++++ b/net/sctp/sysctl.c +@@ -303,41 +303,40 @@ static int proc_sctp_do_hmac_alg(struct ctl_table *ctl, + loff_t *ppos) + { + struct net *net = current->nsproxy->net_ns; +- char tmp[8]; + struct ctl_table tbl; +- int ret; +- int changed = 0; ++ bool changed = false; + char *none = "none"; ++ char tmp[8]; ++ int ret; + + memset(&tbl, 0, sizeof(struct ctl_table)); + + if (write) { + tbl.data = tmp; +- tbl.maxlen = 8; ++ tbl.maxlen = sizeof(tmp); + } else { + tbl.data = net->sctp.sctp_hmac_alg ? : none; + tbl.maxlen = strlen(tbl.data); + } +- ret = proc_dostring(&tbl, write, buffer, lenp, ppos); + +- if (write) { ++ ret = proc_dostring(&tbl, write, buffer, lenp, ppos); ++ if (write && ret == 0) { + #ifdef CONFIG_CRYPTO_MD5 + if (!strncmp(tmp, "md5", 3)) { + net->sctp.sctp_hmac_alg = "md5"; +- changed = 1; ++ changed = true; + } + #endif + #ifdef CONFIG_CRYPTO_SHA1 + if (!strncmp(tmp, "sha1", 4)) { + net->sctp.sctp_hmac_alg = "sha1"; +- changed = 1; ++ changed = true; + } + #endif + if (!strncmp(tmp, "none", 4)) { + net->sctp.sctp_hmac_alg = NULL; +- changed = 1; ++ changed = true; + } +- + if (!changed) + ret = -EINVAL; + } +@@ -362,8 +361,7 @@ static int proc_sctp_do_auth(struct ctl_table *ctl, int write, + tbl.data = &net->sctp.auth_enable; + + ret = proc_dointvec(&tbl, write, buffer, lenp, ppos); +- +- if (write) { ++ if (write && ret == 0) { + struct sock *sk = net->sctp.ctl_sock; + + net->sctp.auth_enable = new_value; +diff --git a/net/sctp/ulpevent.c b/net/sctp/ulpevent.c +index 81089ed65456..12c37cee80e5 100644 +--- a/net/sctp/ulpevent.c ++++ b/net/sctp/ulpevent.c +@@ -367,9 +367,10 @@ fail: + * specification [SCTP] and any extensions for a list of possible + * error formats. + */ +-struct sctp_ulpevent *sctp_ulpevent_make_remote_error( +- const struct sctp_association *asoc, struct sctp_chunk *chunk, +- __u16 flags, gfp_t gfp) ++struct sctp_ulpevent * ++sctp_ulpevent_make_remote_error(const struct sctp_association *asoc, ++ struct sctp_chunk *chunk, __u16 flags, ++ gfp_t gfp) + { + struct sctp_ulpevent *event; + struct sctp_remote_error *sre; +@@ -388,8 +389,7 @@ struct sctp_ulpevent *sctp_ulpevent_make_remote_error( + /* Copy the skb to a new skb with room for us to prepend + * notification with. + */ +- skb = skb_copy_expand(chunk->skb, sizeof(struct sctp_remote_error), +- 0, gfp); ++ skb = skb_copy_expand(chunk->skb, sizeof(*sre), 0, gfp); + + /* Pull off the rest of the cause TLV from the chunk. */ + skb_pull(chunk->skb, elen); +@@ -400,62 +400,21 @@ struct sctp_ulpevent *sctp_ulpevent_make_remote_error( + event = sctp_skb2event(skb); + sctp_ulpevent_init(event, MSG_NOTIFICATION, skb->truesize); + +- sre = (struct sctp_remote_error *) +- skb_push(skb, sizeof(struct sctp_remote_error)); ++ sre = (struct sctp_remote_error *) skb_push(skb, sizeof(*sre)); + + /* Trim the buffer to the right length. */ +- skb_trim(skb, sizeof(struct sctp_remote_error) + elen); ++ skb_trim(skb, sizeof(*sre) + elen); + +- /* Socket Extensions for SCTP +- * 5.3.1.3 SCTP_REMOTE_ERROR +- * +- * sre_type: +- * It should be SCTP_REMOTE_ERROR. +- */ ++ /* RFC6458, Section 6.1.3. SCTP_REMOTE_ERROR */ ++ memset(sre, 0, sizeof(*sre)); + sre->sre_type = SCTP_REMOTE_ERROR; +- +- /* +- * Socket Extensions for SCTP +- * 5.3.1.3 SCTP_REMOTE_ERROR +- * +- * sre_flags: 16 bits (unsigned integer) +- * Currently unused. +- */ + sre->sre_flags = 0; +- +- /* Socket Extensions for SCTP +- * 5.3.1.3 SCTP_REMOTE_ERROR +- * +- * sre_length: sizeof (__u32) +- * +- * This field is the total length of the notification data, +- * including the notification header. +- */ + sre->sre_length = skb->len; +- +- /* Socket Extensions for SCTP +- * 5.3.1.3 SCTP_REMOTE_ERROR +- * +- * sre_error: 16 bits (unsigned integer) +- * This value represents one of the Operational Error causes defined in +- * the SCTP specification, in network byte order. +- */ + sre->sre_error = cause; +- +- /* Socket Extensions for SCTP +- * 5.3.1.3 SCTP_REMOTE_ERROR +- * +- * sre_assoc_id: sizeof (sctp_assoc_t) +- * +- * The association id field, holds the identifier for the association. +- * All notifications for a given association have the same association +- * identifier. For TCP style socket, this field is ignored. +- */ + sctp_ulpevent_set_owner(event, asoc); + sre->sre_assoc_id = sctp_assoc2id(asoc); + + return event; +- + fail: + return NULL; + } +@@ -900,7 +859,9 @@ __u16 sctp_ulpevent_get_notification_type(const struct sctp_ulpevent *event) + return notification->sn_header.sn_type; + } + +-/* Copy out the sndrcvinfo into a msghdr. */ ++/* RFC6458, Section 5.3.2. SCTP Header Information Structure ++ * (SCTP_SNDRCV, DEPRECATED) ++ */ + void sctp_ulpevent_read_sndrcvinfo(const struct sctp_ulpevent *event, + struct msghdr *msghdr) + { +@@ -909,74 +870,21 @@ void sctp_ulpevent_read_sndrcvinfo(const struct sctp_ulpevent *event, + if (sctp_ulpevent_is_notification(event)) + return; + +- /* Sockets API Extensions for SCTP +- * Section 5.2.2 SCTP Header Information Structure (SCTP_SNDRCV) +- * +- * sinfo_stream: 16 bits (unsigned integer) +- * +- * For recvmsg() the SCTP stack places the message's stream number in +- * this value. +- */ ++ memset(&sinfo, 0, sizeof(sinfo)); + sinfo.sinfo_stream = event->stream; +- /* sinfo_ssn: 16 bits (unsigned integer) +- * +- * For recvmsg() this value contains the stream sequence number that +- * the remote endpoint placed in the DATA chunk. For fragmented +- * messages this is the same number for all deliveries of the message +- * (if more than one recvmsg() is needed to read the message). +- */ + sinfo.sinfo_ssn = event->ssn; +- /* sinfo_ppid: 32 bits (unsigned integer) +- * +- * In recvmsg() this value is +- * the same information that was passed by the upper layer in the peer +- * application. Please note that byte order issues are NOT accounted +- * for and this information is passed opaquely by the SCTP stack from +- * one end to the other. +- */ + sinfo.sinfo_ppid = event->ppid; +- /* sinfo_flags: 16 bits (unsigned integer) +- * +- * This field may contain any of the following flags and is composed of +- * a bitwise OR of these values. +- * +- * recvmsg() flags: +- * +- * SCTP_UNORDERED - This flag is present when the message was sent +- * non-ordered. +- */ + sinfo.sinfo_flags = event->flags; +- /* sinfo_tsn: 32 bit (unsigned integer) +- * +- * For the receiving side, this field holds a TSN that was +- * assigned to one of the SCTP Data Chunks. +- */ + sinfo.sinfo_tsn = event->tsn; +- /* sinfo_cumtsn: 32 bit (unsigned integer) +- * +- * This field will hold the current cumulative TSN as +- * known by the underlying SCTP layer. Note this field is +- * ignored when sending and only valid for a receive +- * operation when sinfo_flags are set to SCTP_UNORDERED. +- */ + sinfo.sinfo_cumtsn = event->cumtsn; +- /* sinfo_assoc_id: sizeof (sctp_assoc_t) +- * +- * The association handle field, sinfo_assoc_id, holds the identifier +- * for the association announced in the COMMUNICATION_UP notification. +- * All notifications for a given association have the same identifier. +- * Ignored for one-to-one style sockets. +- */ + sinfo.sinfo_assoc_id = sctp_assoc2id(event->asoc); +- +- /* context value that is set via SCTP_CONTEXT socket option. */ ++ /* Context value that is set via SCTP_CONTEXT socket option. */ + sinfo.sinfo_context = event->asoc->default_rcv_context; +- + /* These fields are not used while receiving. */ + sinfo.sinfo_timetolive = 0; + + put_cmsg(msghdr, IPPROTO_SCTP, SCTP_SNDRCV, +- sizeof(struct sctp_sndrcvinfo), (void *)&sinfo); ++ sizeof(sinfo), &sinfo); + } + + /* Do accounting for bytes received and hold a reference to the association +diff --git a/net/tipc/bcast.c b/net/tipc/bcast.c +index 716de1ac6cb5..6ef89256b2fb 100644 +--- a/net/tipc/bcast.c ++++ b/net/tipc/bcast.c +@@ -531,6 +531,7 @@ receive: + + buf = node->bclink.deferred_head; + node->bclink.deferred_head = buf->next; ++ buf->next = NULL; + node->bclink.deferred_size--; + goto receive; + } +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index ee1a6ff120a2..37806a97c878 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2917,7 +2917,7 @@ static int azx_suspend(struct device *dev) + struct azx *chip = card->private_data; + struct azx_pcm *p; + +- if (chip->disabled) ++ if (chip->disabled || chip->init_failed) + return 0; + + snd_power_change_state(card, SNDRV_CTL_POWER_D3hot); +@@ -2948,7 +2948,7 @@ static int azx_resume(struct device *dev) + struct snd_card *card = dev_get_drvdata(dev); + struct azx *chip = card->private_data; + +- if (chip->disabled) ++ if (chip->disabled || chip->init_failed) + return 0; + + if (chip->driver_caps & AZX_DCAPS_I915_POWERWELL) +@@ -2983,7 +2983,7 @@ static int azx_runtime_suspend(struct device *dev) + struct snd_card *card = dev_get_drvdata(dev); + struct azx *chip = card->private_data; + +- if (chip->disabled) ++ if (chip->disabled || chip->init_failed) + return 0; + + if (!(chip->driver_caps & AZX_DCAPS_PM_RUNTIME)) +@@ -3009,7 +3009,7 @@ static int azx_runtime_resume(struct device *dev) + struct hda_codec *codec; + int status; + +- if (chip->disabled) ++ if (chip->disabled || chip->init_failed) + return 0; + + if (!(chip->driver_caps & AZX_DCAPS_PM_RUNTIME)) +@@ -3044,7 +3044,7 @@ static int azx_runtime_idle(struct device *dev) + struct snd_card *card = dev_get_drvdata(dev); + struct azx *chip = card->private_data; + +- if (chip->disabled) ++ if (chip->disabled || chip->init_failed) + return 0; + + if (!power_save_controller ||
