diff options
author | Mike Pagano <mpagano@gentoo.org> | 2017-07-05 10:18:30 -0400 |
---|---|---|
committer | Mike Pagano <mpagano@gentoo.org> | 2017-07-05 10:18:30 -0400 |
commit | 779573573454d346e3695a2fcebf9f12a41a55dc (patch) | |
tree | 187ad396bf313ef0ab7f2a9b17c0c6ff824ba041 | |
parent | Fix linux patch 4.4.75 (diff) | |
download | linux-patches-779573573454d346e3695a2fcebf9f12a41a55dc.tar.gz linux-patches-779573573454d346e3695a2fcebf9f12a41a55dc.tar.bz2 linux-patches-779573573454d346e3695a2fcebf9f12a41a55dc.zip |
Linux patch 4.4.764.4-79
-rw-r--r-- | 0000_README | 4 | ||||
-rw-r--r-- | 1075_linux-4.4.76.patch | 2890 |
2 files changed, 2894 insertions, 0 deletions
diff --git a/0000_README b/0000_README index c318ce29..a7fc0fec 100644 --- a/0000_README +++ b/0000_README @@ -343,6 +343,10 @@ Patch: 1074_linux-4.4.75.patch From: http://www.kernel.org Desc: Linux 4.4.75 +Patch: 1075_linux-4.4.76.patch +From: http://www.kernel.org +Desc: Linux 4.4.76 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1075_linux-4.4.76.patch b/1075_linux-4.4.76.patch new file mode 100644 index 00000000..c744f77b --- /dev/null +++ b/1075_linux-4.4.76.patch @@ -0,0 +1,2890 @@ +diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt +index af70d1541d3a..be61d53e997f 100644 +--- a/Documentation/sysctl/kernel.txt ++++ b/Documentation/sysctl/kernel.txt +@@ -810,14 +810,13 @@ via the /proc/sys interface: + Each write syscall must fully contain the sysctl value to be + written, and multiple writes on the same sysctl file descriptor + will rewrite the sysctl value, regardless of file position. +- 0 - (default) Same behavior as above, but warn about processes that +- perform writes to a sysctl file descriptor when the file position +- is not 0. +- 1 - Respect file position when writing sysctl strings. Multiple writes +- will append to the sysctl value buffer. Anything past the max length +- of the sysctl value buffer will be ignored. Writes to numeric sysctl +- entries must always be at file position 0 and the value must be +- fully contained in the buffer sent in the write syscall. ++ 0 - Same behavior as above, but warn about processes that perform writes ++ to a sysctl file descriptor when the file position is not 0. ++ 1 - (default) Respect file position when writing sysctl strings. Multiple ++ writes will append to the sysctl value buffer. Anything past the max ++ length of the sysctl value buffer will be ignored. Writes to numeric ++ sysctl entries must always be at file position 0 and the value must ++ be fully contained in the buffer sent in the write syscall. + + ============================================================== + +diff --git a/Makefile b/Makefile +index 696d15d8ad5d..902ab134446e 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 75 ++SUBLEVEL = 76 + EXTRAVERSION = + NAME = Blurry Fish Butt + +@@ -633,6 +633,12 @@ endif + # Tell gcc to never replace conditional load with a non-conditional one + KBUILD_CFLAGS += $(call cc-option,--param=allow-store-data-races=0) + ++# check for 'asm goto' ++ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-goto.sh $(CC) $(KBUILD_CFLAGS)), y) ++ KBUILD_CFLAGS += -DCC_HAVE_ASM_GOTO ++ KBUILD_AFLAGS += -DCC_HAVE_ASM_GOTO ++endif ++ + ifdef CONFIG_READABLE_ASM + # Disable optimizations that make assembler listings hard to read. + # reorder blocks reorders the control in the function +@@ -788,12 +794,6 @@ KBUILD_CFLAGS += $(call cc-option,-Werror=date-time) + # use the deterministic mode of AR if available + KBUILD_ARFLAGS := $(call ar-option,D) + +-# check for 'asm goto' +-ifeq ($(shell $(CONFIG_SHELL) $(srctree)/scripts/gcc-goto.sh $(CC) $(KBUILD_CFLAGS)), y) +- KBUILD_CFLAGS += -DCC_HAVE_ASM_GOTO +- KBUILD_AFLAGS += -DCC_HAVE_ASM_GOTO +-endif +- + include scripts/Makefile.kasan + include scripts/Makefile.extrawarn + +diff --git a/arch/arm/boot/dts/bcm5301x.dtsi b/arch/arm/boot/dts/bcm5301x.dtsi +index 6f50f672efbd..de8ac998604d 100644 +--- a/arch/arm/boot/dts/bcm5301x.dtsi ++++ b/arch/arm/boot/dts/bcm5301x.dtsi +@@ -54,14 +54,14 @@ + timer@0200 { + compatible = "arm,cortex-a9-global-timer"; + reg = <0x0200 0x100>; +- interrupts = <GIC_PPI 11 IRQ_TYPE_LEVEL_HIGH>; ++ interrupts = <GIC_PPI 11 IRQ_TYPE_EDGE_RISING>; + clocks = <&clk_periph>; + }; + + local-timer@0600 { + compatible = "arm,cortex-a9-twd-timer"; + reg = <0x0600 0x100>; +- interrupts = <GIC_PPI 13 IRQ_TYPE_LEVEL_HIGH>; ++ interrupts = <GIC_PPI 13 IRQ_TYPE_EDGE_RISING>; + clocks = <&clk_periph>; + }; + +diff --git a/arch/arm/mm/mmu.c b/arch/arm/mm/mmu.c +index 4867f5daf82c..e47cffd25c6c 100644 +--- a/arch/arm/mm/mmu.c ++++ b/arch/arm/mm/mmu.c +@@ -1184,15 +1184,15 @@ void __init sanity_check_meminfo(void) + + high_memory = __va(arm_lowmem_limit - 1) + 1; + ++ if (!memblock_limit) ++ memblock_limit = arm_lowmem_limit; ++ + /* + * Round the memblock limit down to a pmd size. This + * helps to ensure that we will allocate memory from the + * last full pmd, which should be mapped. + */ +- if (memblock_limit) +- memblock_limit = round_down(memblock_limit, PMD_SIZE); +- if (!memblock_limit) +- memblock_limit = arm_lowmem_limit; ++ memblock_limit = round_down(memblock_limit, PMD_SIZE); + + memblock_set_current_limit(memblock_limit); + } +diff --git a/arch/arm64/include/asm/acpi.h b/arch/arm64/include/asm/acpi.h +index caafd63b8092..40d1351e7573 100644 +--- a/arch/arm64/include/asm/acpi.h ++++ b/arch/arm64/include/asm/acpi.h +@@ -22,9 +22,9 @@ + #define ACPI_MADT_GICC_LENGTH \ + (acpi_gbl_FADT.header.revision < 6 ? 76 : 80) + +-#define BAD_MADT_GICC_ENTRY(entry, end) \ +- (!(entry) || (unsigned long)(entry) + sizeof(*(entry)) > (end) || \ +- (entry)->header.length != ACPI_MADT_GICC_LENGTH) ++#define BAD_MADT_GICC_ENTRY(entry, end) \ ++ (!(entry) || (entry)->header.length != ACPI_MADT_GICC_LENGTH || \ ++ (unsigned long)(entry) + ACPI_MADT_GICC_LENGTH > (end)) + + /* Basic configuration for ACPI */ + #ifdef CONFIG_ACPI +diff --git a/arch/mips/ath79/common.c b/arch/mips/ath79/common.c +index 3cedd1f95e0f..8ae4067a5eda 100644 +--- a/arch/mips/ath79/common.c ++++ b/arch/mips/ath79/common.c +@@ -76,14 +76,14 @@ void ath79_ddr_set_pci_windows(void) + { + BUG_ON(!ath79_ddr_pci_win_base); + +- __raw_writel(AR71XX_PCI_WIN0_OFFS, ath79_ddr_pci_win_base + 0); +- __raw_writel(AR71XX_PCI_WIN1_OFFS, ath79_ddr_pci_win_base + 1); +- __raw_writel(AR71XX_PCI_WIN2_OFFS, ath79_ddr_pci_win_base + 2); +- __raw_writel(AR71XX_PCI_WIN3_OFFS, ath79_ddr_pci_win_base + 3); +- __raw_writel(AR71XX_PCI_WIN4_OFFS, ath79_ddr_pci_win_base + 4); +- __raw_writel(AR71XX_PCI_WIN5_OFFS, ath79_ddr_pci_win_base + 5); +- __raw_writel(AR71XX_PCI_WIN6_OFFS, ath79_ddr_pci_win_base + 6); +- __raw_writel(AR71XX_PCI_WIN7_OFFS, ath79_ddr_pci_win_base + 7); ++ __raw_writel(AR71XX_PCI_WIN0_OFFS, ath79_ddr_pci_win_base + 0x0); ++ __raw_writel(AR71XX_PCI_WIN1_OFFS, ath79_ddr_pci_win_base + 0x4); ++ __raw_writel(AR71XX_PCI_WIN2_OFFS, ath79_ddr_pci_win_base + 0x8); ++ __raw_writel(AR71XX_PCI_WIN3_OFFS, ath79_ddr_pci_win_base + 0xc); ++ __raw_writel(AR71XX_PCI_WIN4_OFFS, ath79_ddr_pci_win_base + 0x10); ++ __raw_writel(AR71XX_PCI_WIN5_OFFS, ath79_ddr_pci_win_base + 0x14); ++ __raw_writel(AR71XX_PCI_WIN6_OFFS, ath79_ddr_pci_win_base + 0x18); ++ __raw_writel(AR71XX_PCI_WIN7_OFFS, ath79_ddr_pci_win_base + 0x1c); + } + EXPORT_SYMBOL_GPL(ath79_ddr_set_pci_windows); + +diff --git a/arch/mips/kernel/entry.S b/arch/mips/kernel/entry.S +index 7791840cf22c..db07793f7b43 100644 +--- a/arch/mips/kernel/entry.S ++++ b/arch/mips/kernel/entry.S +@@ -11,6 +11,7 @@ + #include <asm/asm.h> + #include <asm/asmmacro.h> + #include <asm/compiler.h> ++#include <asm/irqflags.h> + #include <asm/regdef.h> + #include <asm/mipsregs.h> + #include <asm/stackframe.h> +@@ -137,6 +138,7 @@ work_pending: + andi t0, a2, _TIF_NEED_RESCHED # a2 is preloaded with TI_FLAGS + beqz t0, work_notifysig + work_resched: ++ TRACE_IRQS_OFF + jal schedule + + local_irq_disable # make sure need_resched and +@@ -173,6 +175,7 @@ syscall_exit_work: + beqz t0, work_pending # trace bit set? + local_irq_enable # could let syscall_trace_leave() + # call schedule() instead ++ TRACE_IRQS_ON + move a0, sp + jal syscall_trace_leave + b resume_userspace +diff --git a/arch/mips/kernel/pm-cps.c b/arch/mips/kernel/pm-cps.c +index f63a289977cc..0b3e58a3189f 100644 +--- a/arch/mips/kernel/pm-cps.c ++++ b/arch/mips/kernel/pm-cps.c +@@ -55,7 +55,6 @@ DECLARE_BITMAP(state_support, CPS_PM_STATE_COUNT); + * state. Actually per-core rather than per-CPU. + */ + static DEFINE_PER_CPU_ALIGNED(u32*, ready_count); +-static DEFINE_PER_CPU_ALIGNED(void*, ready_count_alloc); + + /* Indicates online CPUs coupled with the current CPU */ + static DEFINE_PER_CPU_ALIGNED(cpumask_t, online_coupled); +@@ -625,7 +624,6 @@ static int __init cps_gen_core_entries(unsigned cpu) + { + enum cps_pm_state state; + unsigned core = cpu_data[cpu].core; +- unsigned dlinesz = cpu_data[cpu].dcache.linesz; + void *entry_fn, *core_rc; + + for (state = CPS_PM_NC_WAIT; state < CPS_PM_STATE_COUNT; state++) { +@@ -645,16 +643,11 @@ static int __init cps_gen_core_entries(unsigned cpu) + } + + if (!per_cpu(ready_count, core)) { +- core_rc = kmalloc(dlinesz * 2, GFP_KERNEL); ++ core_rc = kmalloc(sizeof(u32), GFP_KERNEL); + if (!core_rc) { + pr_err("Failed allocate core %u ready_count\n", core); + return -ENOMEM; + } +- per_cpu(ready_count_alloc, core) = core_rc; +- +- /* Ensure ready_count is aligned to a cacheline boundary */ +- core_rc += dlinesz - 1; +- core_rc = (void *)((unsigned long)core_rc & ~(dlinesz - 1)); + per_cpu(ready_count, core) = core_rc; + } + +diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c +index 99a402231f4d..31ca2edd7218 100644 +--- a/arch/mips/kernel/traps.c ++++ b/arch/mips/kernel/traps.c +@@ -194,6 +194,8 @@ void show_stack(struct task_struct *task, unsigned long *sp) + { + struct pt_regs regs; + mm_segment_t old_fs = get_fs(); ++ ++ regs.cp0_status = KSU_KERNEL; + if (sp) { + regs.regs[29] = (unsigned long)sp; + regs.regs[31] = 0; +diff --git a/arch/mips/ralink/mt7620.c b/arch/mips/ralink/mt7620.c +index dfb04fcedb04..48d6349fd9d7 100644 +--- a/arch/mips/ralink/mt7620.c ++++ b/arch/mips/ralink/mt7620.c +@@ -107,31 +107,31 @@ static struct rt2880_pmx_group mt7620a_pinmux_data[] = { + }; + + static struct rt2880_pmx_func pwm1_grp_mt7628[] = { +- FUNC("sdcx", 3, 19, 1), ++ FUNC("sdxc d6", 3, 19, 1), + FUNC("utif", 2, 19, 1), + FUNC("gpio", 1, 19, 1), +- FUNC("pwm", 0, 19, 1), ++ FUNC("pwm1", 0, 19, 1), + }; + + static struct rt2880_pmx_func pwm0_grp_mt7628[] = { +- FUNC("sdcx", 3, 18, 1), ++ FUNC("sdxc d7", 3, 18, 1), + FUNC("utif", 2, 18, 1), + FUNC("gpio", 1, 18, 1), +- FUNC("pwm", 0, 18, 1), ++ FUNC("pwm0", 0, 18, 1), + }; + + static struct rt2880_pmx_func uart2_grp_mt7628[] = { +- FUNC("sdcx", 3, 20, 2), ++ FUNC("sdxc d5 d4", 3, 20, 2), + FUNC("pwm", 2, 20, 2), + FUNC("gpio", 1, 20, 2), +- FUNC("uart", 0, 20, 2), ++ FUNC("uart2", 0, 20, 2), + }; + + static struct rt2880_pmx_func uart1_grp_mt7628[] = { +- FUNC("sdcx", 3, 45, 2), ++ FUNC("sw_r", 3, 45, 2), + FUNC("pwm", 2, 45, 2), + FUNC("gpio", 1, 45, 2), +- FUNC("uart", 0, 45, 2), ++ FUNC("uart1", 0, 45, 2), + }; + + static struct rt2880_pmx_func i2c_grp_mt7628[] = { +@@ -143,21 +143,21 @@ static struct rt2880_pmx_func i2c_grp_mt7628[] = { + + static struct rt2880_pmx_func refclk_grp_mt7628[] = { FUNC("reclk", 0, 36, 1) }; + static struct rt2880_pmx_func perst_grp_mt7628[] = { FUNC("perst", 0, 37, 1) }; +-static struct rt2880_pmx_func wdt_grp_mt7628[] = { FUNC("wdt", 0, 15, 38) }; ++static struct rt2880_pmx_func wdt_grp_mt7628[] = { FUNC("wdt", 0, 38, 1) }; + static struct rt2880_pmx_func spi_grp_mt7628[] = { FUNC("spi", 0, 7, 4) }; + + static struct rt2880_pmx_func sd_mode_grp_mt7628[] = { + FUNC("jtag", 3, 22, 8), + FUNC("utif", 2, 22, 8), + FUNC("gpio", 1, 22, 8), +- FUNC("sdcx", 0, 22, 8), ++ FUNC("sdxc", 0, 22, 8), + }; + + static struct rt2880_pmx_func uart0_grp_mt7628[] = { + FUNC("-", 3, 12, 2), + FUNC("-", 2, 12, 2), + FUNC("gpio", 1, 12, 2), +- FUNC("uart", 0, 12, 2), ++ FUNC("uart0", 0, 12, 2), + }; + + static struct rt2880_pmx_func i2s_grp_mt7628[] = { +@@ -171,7 +171,7 @@ static struct rt2880_pmx_func spi_cs1_grp_mt7628[] = { + FUNC("-", 3, 6, 1), + FUNC("refclk", 2, 6, 1), + FUNC("gpio", 1, 6, 1), +- FUNC("spi", 0, 6, 1), ++ FUNC("spi cs1", 0, 6, 1), + }; + + static struct rt2880_pmx_func spis_grp_mt7628[] = { +@@ -188,28 +188,44 @@ static struct rt2880_pmx_func gpio_grp_mt7628[] = { + FUNC("gpio", 0, 11, 1), + }; + +-#define MT7628_GPIO_MODE_MASK 0x3 +- +-#define MT7628_GPIO_MODE_PWM1 30 +-#define MT7628_GPIO_MODE_PWM0 28 +-#define MT7628_GPIO_MODE_UART2 26 +-#define MT7628_GPIO_MODE_UART1 24 +-#define MT7628_GPIO_MODE_I2C 20 +-#define MT7628_GPIO_MODE_REFCLK 18 +-#define MT7628_GPIO_MODE_PERST 16 +-#define MT7628_GPIO_MODE_WDT 14 +-#define MT7628_GPIO_MODE_SPI 12 +-#define MT7628_GPIO_MODE_SDMODE 10 +-#define MT7628_GPIO_MODE_UART0 8 +-#define MT7628_GPIO_MODE_I2S 6 +-#define MT7628_GPIO_MODE_CS1 4 +-#define MT7628_GPIO_MODE_SPIS 2 +-#define MT7628_GPIO_MODE_GPIO 0 ++static struct rt2880_pmx_func wled_kn_grp_mt7628[] = { ++ FUNC("rsvd", 3, 35, 1), ++ FUNC("rsvd", 2, 35, 1), ++ FUNC("gpio", 1, 35, 1), ++ FUNC("wled_kn", 0, 35, 1), ++}; ++ ++static struct rt2880_pmx_func wled_an_grp_mt7628[] = { ++ FUNC("rsvd", 3, 44, 1), ++ FUNC("rsvd", 2, 44, 1), ++ FUNC("gpio", 1, 44, 1), ++ FUNC("wled_an", 0, 44, 1), ++}; ++ ++#define MT7628_GPIO_MODE_MASK 0x3 ++ ++#define MT7628_GPIO_MODE_WLED_KN 48 ++#define MT7628_GPIO_MODE_WLED_AN 32 ++#define MT7628_GPIO_MODE_PWM1 30 ++#define MT7628_GPIO_MODE_PWM0 28 ++#define MT7628_GPIO_MODE_UART2 26 ++#define MT7628_GPIO_MODE_UART1 24 ++#define MT7628_GPIO_MODE_I2C 20 ++#define MT7628_GPIO_MODE_REFCLK 18 ++#define MT7628_GPIO_MODE_PERST 16 ++#define MT7628_GPIO_MODE_WDT 14 ++#define MT7628_GPIO_MODE_SPI 12 ++#define MT7628_GPIO_MODE_SDMODE 10 ++#define MT7628_GPIO_MODE_UART0 8 ++#define MT7628_GPIO_MODE_I2S 6 ++#define MT7628_GPIO_MODE_CS1 4 ++#define MT7628_GPIO_MODE_SPIS 2 ++#define MT7628_GPIO_MODE_GPIO 0 + + static struct rt2880_pmx_group mt7628an_pinmux_data[] = { +- GRP_G("pmw1", pwm1_grp_mt7628, MT7628_GPIO_MODE_MASK, ++ GRP_G("pwm1", pwm1_grp_mt7628, MT7628_GPIO_MODE_MASK, + 1, MT7628_GPIO_MODE_PWM1), +- GRP_G("pmw1", pwm0_grp_mt7628, MT7628_GPIO_MODE_MASK, ++ GRP_G("pwm0", pwm0_grp_mt7628, MT7628_GPIO_MODE_MASK, + 1, MT7628_GPIO_MODE_PWM0), + GRP_G("uart2", uart2_grp_mt7628, MT7628_GPIO_MODE_MASK, + 1, MT7628_GPIO_MODE_UART2), +@@ -233,6 +249,10 @@ static struct rt2880_pmx_group mt7628an_pinmux_data[] = { + 1, MT7628_GPIO_MODE_SPIS), + GRP_G("gpio", gpio_grp_mt7628, MT7628_GPIO_MODE_MASK, + 1, MT7628_GPIO_MODE_GPIO), ++ GRP_G("wled_an", wled_an_grp_mt7628, MT7628_GPIO_MODE_MASK, ++ 1, MT7628_GPIO_MODE_WLED_AN), ++ GRP_G("wled_kn", wled_kn_grp_mt7628, MT7628_GPIO_MODE_MASK, ++ 1, MT7628_GPIO_MODE_WLED_KN), + { 0 } + }; + +@@ -439,7 +459,7 @@ void __init ralink_clk_init(void) + ralink_clk_add("10000c00.uartlite", periph_rate); + ralink_clk_add("10180000.wmac", xtal_rate); + +- if (IS_ENABLED(CONFIG_USB) && is_mt76x8()) { ++ if (IS_ENABLED(CONFIG_USB) && !is_mt76x8()) { + /* + * When the CPU goes into sleep mode, the BUS clock will be + * too low for USB to function properly. Adjust the busses +diff --git a/arch/mips/ralink/rt288x.c b/arch/mips/ralink/rt288x.c +index 15506a1ff22a..9dd67749c592 100644 +--- a/arch/mips/ralink/rt288x.c ++++ b/arch/mips/ralink/rt288x.c +@@ -109,5 +109,5 @@ void prom_soc_init(struct ralink_soc_info *soc_info) + soc_info->mem_size_max = RT2880_MEM_SIZE_MAX; + + rt2880_pinmux_data = rt2880_pinmux_data_act; +- ralink_soc == RT2880_SOC; ++ ralink_soc = RT2880_SOC; + } +diff --git a/arch/powerpc/kernel/eeh.c b/arch/powerpc/kernel/eeh.c +index 98949b0df00a..6696c1986844 100644 +--- a/arch/powerpc/kernel/eeh.c ++++ b/arch/powerpc/kernel/eeh.c +@@ -304,9 +304,17 @@ void eeh_slot_error_detail(struct eeh_pe *pe, int severity) + * + * For pHyp, we have to enable IO for log retrieval. Otherwise, + * 0xFF's is always returned from PCI config space. ++ * ++ * When the @severity is EEH_LOG_PERM, the PE is going to be ++ * removed. Prior to that, the drivers for devices included in ++ * the PE will be closed. The drivers rely on working IO path ++ * to bring the devices to quiet state. Otherwise, PCI traffic ++ * from those devices after they are removed is like to cause ++ * another unexpected EEH error. + */ + if (!(pe->type & EEH_PE_PHB)) { +- if (eeh_has_flag(EEH_ENABLE_IO_FOR_LOG)) ++ if (eeh_has_flag(EEH_ENABLE_IO_FOR_LOG) || ++ severity == EEH_LOG_PERM) + eeh_pci_enable(pe, EEH_OPT_THAW_MMIO); + + /* +diff --git a/arch/s390/include/asm/ctl_reg.h b/arch/s390/include/asm/ctl_reg.h +index d7697ab802f6..8e136b88cdf4 100644 +--- a/arch/s390/include/asm/ctl_reg.h ++++ b/arch/s390/include/asm/ctl_reg.h +@@ -15,7 +15,9 @@ + BUILD_BUG_ON(sizeof(addrtype) != (high - low + 1) * sizeof(long));\ + asm volatile( \ + " lctlg %1,%2,%0\n" \ +- : : "Q" (*(addrtype *)(&array)), "i" (low), "i" (high));\ ++ : \ ++ : "Q" (*(addrtype *)(&array)), "i" (low), "i" (high) \ ++ : "memory"); \ + } + + #define __ctl_store(array, low, high) { \ +diff --git a/arch/x86/include/asm/kvm_emulate.h b/arch/x86/include/asm/kvm_emulate.h +index e9cd7befcb76..19d14ac23ef9 100644 +--- a/arch/x86/include/asm/kvm_emulate.h ++++ b/arch/x86/include/asm/kvm_emulate.h +@@ -221,6 +221,9 @@ struct x86_emulate_ops { + void (*get_cpuid)(struct x86_emulate_ctxt *ctxt, + u32 *eax, u32 *ebx, u32 *ecx, u32 *edx); + void (*set_nmi_mask)(struct x86_emulate_ctxt *ctxt, bool masked); ++ ++ unsigned (*get_hflags)(struct x86_emulate_ctxt *ctxt); ++ void (*set_hflags)(struct x86_emulate_ctxt *ctxt, unsigned hflags); + }; + + typedef u32 __attribute__((vector_size(16))) sse128_t; +@@ -290,7 +293,6 @@ struct x86_emulate_ctxt { + + /* interruptibility state, as a result of execution of STI or MOV SS */ + int interruptibility; +- int emul_flags; + + bool perm_ok; /* do not check permissions if true */ + bool ud; /* inject an #UD if host doesn't support insn */ +diff --git a/arch/x86/kvm/emulate.c b/arch/x86/kvm/emulate.c +index 1dcea225977d..04b2f3cad7ba 100644 +--- a/arch/x86/kvm/emulate.c ++++ b/arch/x86/kvm/emulate.c +@@ -2531,7 +2531,7 @@ static int em_rsm(struct x86_emulate_ctxt *ctxt) + u64 smbase; + int ret; + +- if ((ctxt->emul_flags & X86EMUL_SMM_MASK) == 0) ++ if ((ctxt->ops->get_hflags(ctxt) & X86EMUL_SMM_MASK) == 0) + return emulate_ud(ctxt); + + /* +@@ -2580,11 +2580,11 @@ static int em_rsm(struct x86_emulate_ctxt *ctxt) + return X86EMUL_UNHANDLEABLE; + } + +- if ((ctxt->emul_flags & X86EMUL_SMM_INSIDE_NMI_MASK) == 0) ++ if ((ctxt->ops->get_hflags(ctxt) & X86EMUL_SMM_INSIDE_NMI_MASK) == 0) + ctxt->ops->set_nmi_mask(ctxt, false); + +- ctxt->emul_flags &= ~X86EMUL_SMM_INSIDE_NMI_MASK; +- ctxt->emul_flags &= ~X86EMUL_SMM_MASK; ++ ctxt->ops->set_hflags(ctxt, ctxt->ops->get_hflags(ctxt) & ++ ~(X86EMUL_SMM_INSIDE_NMI_MASK | X86EMUL_SMM_MASK)); + return X86EMUL_CONTINUE; + } + +@@ -5296,6 +5296,7 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt) + const struct x86_emulate_ops *ops = ctxt->ops; + int rc = X86EMUL_CONTINUE; + int saved_dst_type = ctxt->dst.type; ++ unsigned emul_flags; + + ctxt->mem_read.pos = 0; + +@@ -5310,6 +5311,7 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt) + goto done; + } + ++ emul_flags = ctxt->ops->get_hflags(ctxt); + if (unlikely(ctxt->d & + (No64|Undefined|Sse|Mmx|Intercept|CheckPerm|Priv|Prot|String))) { + if ((ctxt->mode == X86EMUL_MODE_PROT64 && (ctxt->d & No64)) || +@@ -5343,7 +5345,7 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt) + fetch_possible_mmx_operand(ctxt, &ctxt->dst); + } + +- if (unlikely(ctxt->emul_flags & X86EMUL_GUEST_MASK) && ctxt->intercept) { ++ if (unlikely(emul_flags & X86EMUL_GUEST_MASK) && ctxt->intercept) { + rc = emulator_check_intercept(ctxt, ctxt->intercept, + X86_ICPT_PRE_EXCEPT); + if (rc != X86EMUL_CONTINUE) +@@ -5372,7 +5374,7 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt) + goto done; + } + +- if (unlikely(ctxt->emul_flags & X86EMUL_GUEST_MASK) && (ctxt->d & Intercept)) { ++ if (unlikely(emul_flags & X86EMUL_GUEST_MASK) && (ctxt->d & Intercept)) { + rc = emulator_check_intercept(ctxt, ctxt->intercept, + X86_ICPT_POST_EXCEPT); + if (rc != X86EMUL_CONTINUE) +@@ -5426,7 +5428,7 @@ int x86_emulate_insn(struct x86_emulate_ctxt *ctxt) + + special_insn: + +- if (unlikely(ctxt->emul_flags & X86EMUL_GUEST_MASK) && (ctxt->d & Intercept)) { ++ if (unlikely(emul_flags & X86EMUL_GUEST_MASK) && (ctxt->d & Intercept)) { + rc = emulator_check_intercept(ctxt, ctxt->intercept, + X86_ICPT_POST_MEMACCESS); + if (rc != X86EMUL_CONTINUE) +diff --git a/arch/x86/kvm/pmu_intel.c b/arch/x86/kvm/pmu_intel.c +index ab38af4f4947..23a7c7ba377a 100644 +--- a/arch/x86/kvm/pmu_intel.c ++++ b/arch/x86/kvm/pmu_intel.c +@@ -294,7 +294,7 @@ static void intel_pmu_refresh(struct kvm_vcpu *vcpu) + ((u64)1 << edx.split.bit_width_fixed) - 1; + } + +- pmu->global_ctrl = ((1 << pmu->nr_arch_gp_counters) - 1) | ++ pmu->global_ctrl = ((1ull << pmu->nr_arch_gp_counters) - 1) | + (((1ull << pmu->nr_arch_fixed_counters) - 1) << INTEL_PMC_IDX_FIXED); + pmu->global_ctrl_mask = ~pmu->global_ctrl; + +diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c +index 50ca8f409a7c..bbaa11f4e74b 100644 +--- a/arch/x86/kvm/vmx.c ++++ b/arch/x86/kvm/vmx.c +@@ -2264,7 +2264,7 @@ static int nested_vmx_check_exception(struct kvm_vcpu *vcpu, unsigned nr) + if (!(vmcs12->exception_bitmap & (1u << nr))) + return 0; + +- nested_vmx_vmexit(vcpu, to_vmx(vcpu)->exit_reason, ++ nested_vmx_vmexit(vcpu, EXIT_REASON_EXCEPTION_NMI, + vmcs_read32(VM_EXIT_INTR_INFO), + vmcs_readl(EXIT_QUALIFICATION)); + return 1; +diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c +index 6c82792487e9..8e526c6fd784 100644 +--- a/arch/x86/kvm/x86.c ++++ b/arch/x86/kvm/x86.c +@@ -4844,6 +4844,8 @@ static bool emulator_get_segment(struct x86_emulate_ctxt *ctxt, u16 *selector, + + if (var.unusable) { + memset(desc, 0, sizeof(*desc)); ++ if (base3) ++ *base3 = 0; + return false; + } + +@@ -4999,6 +5001,16 @@ static void emulator_set_nmi_mask(struct x86_emulate_ctxt *ctxt, bool masked) + kvm_x86_ops->set_nmi_mask(emul_to_vcpu(ctxt), masked); + } + ++static unsigned emulator_get_hflags(struct x86_emulate_ctxt *ctxt) ++{ ++ return emul_to_vcpu(ctxt)->arch.hflags; ++} ++ ++static void emulator_set_hflags(struct x86_emulate_ctxt *ctxt, unsigned emul_flags) ++{ ++ kvm_set_hflags(emul_to_vcpu(ctxt), emul_flags); ++} ++ + static const struct x86_emulate_ops emulate_ops = { + .read_gpr = emulator_read_gpr, + .write_gpr = emulator_write_gpr, +@@ -5038,6 +5050,8 @@ static const struct x86_emulate_ops emulate_ops = { + .intercept = emulator_intercept, + .get_cpuid = emulator_get_cpuid, + .set_nmi_mask = emulator_set_nmi_mask, ++ .get_hflags = emulator_get_hflags, ++ .set_hflags = emulator_set_hflags, + }; + + static void toggle_interruptibility(struct kvm_vcpu *vcpu, u32 mask) +@@ -5090,7 +5104,6 @@ static void init_emulate_ctxt(struct kvm_vcpu *vcpu) + BUILD_BUG_ON(HF_GUEST_MASK != X86EMUL_GUEST_MASK); + BUILD_BUG_ON(HF_SMM_MASK != X86EMUL_SMM_MASK); + BUILD_BUG_ON(HF_SMM_INSIDE_NMI_MASK != X86EMUL_SMM_INSIDE_NMI_MASK); +- ctxt->emul_flags = vcpu->arch.hflags; + + init_decode_cache(ctxt); + vcpu->arch.emulate_regs_need_sync_from_vcpu = false; +@@ -5486,8 +5499,6 @@ restart: + unsigned long rflags = kvm_x86_ops->get_rflags(vcpu); + toggle_interruptibility(vcpu, ctxt->interruptibility); + vcpu->arch.emulate_regs_need_sync_to_vcpu = false; +- if (vcpu->arch.hflags != ctxt->emul_flags) +- kvm_set_hflags(vcpu, ctxt->emul_flags); + kvm_rip_write(vcpu, ctxt->eip); + if (r == EMULATE_DONE) + kvm_vcpu_check_singlestep(vcpu, rflags, &r); +@@ -5974,7 +5985,8 @@ static int emulator_fix_hypercall(struct x86_emulate_ctxt *ctxt) + + kvm_x86_ops->patch_hypercall(vcpu, instruction); + +- return emulator_write_emulated(ctxt, rip, instruction, 3, NULL); ++ return emulator_write_emulated(ctxt, rip, instruction, 3, ++ &ctxt->exception); + } + + static int dm_request_for_irq_injection(struct kvm_vcpu *vcpu) +diff --git a/arch/x86/mm/mpx.c b/arch/x86/mm/mpx.c +index ef05755a1900..7ed47b1e6f42 100644 +--- a/arch/x86/mm/mpx.c ++++ b/arch/x86/mm/mpx.c +@@ -293,7 +293,7 @@ siginfo_t *mpx_generate_siginfo(struct pt_regs *regs) + * We were not able to extract an address from the instruction, + * probably because there was something invalid in it. + */ +- if (info->si_addr == (void *)-1) { ++ if (info->si_addr == (void __user *)-1) { + err = -EINVAL; + goto err_out; + } +@@ -525,15 +525,7 @@ int mpx_handle_bd_fault(void) + if (!kernel_managing_mpx_tables(current->mm)) + return -EINVAL; + +- if (do_mpx_bt_fault()) { +- force_sig(SIGSEGV, current); +- /* +- * The force_sig() is essentially "handling" this +- * exception, so we do not pass up the error +- * from do_mpx_bt_fault(). +- */ +- } +- return 0; ++ return do_mpx_bt_fault(); + } + + /* +diff --git a/arch/x86/mm/tlb.c b/arch/x86/mm/tlb.c +index 5fb6adaaa796..5a760fd66bec 100644 +--- a/arch/x86/mm/tlb.c ++++ b/arch/x86/mm/tlb.c +@@ -134,8 +134,6 @@ void native_flush_tlb_others(const struct cpumask *cpumask, + { + struct flush_tlb_info info; + +- if (end == 0) +- end = start + PAGE_SIZE; + info.flush_mm = mm; + info.flush_start = start; + info.flush_end = end; +@@ -264,7 +262,7 @@ void flush_tlb_page(struct vm_area_struct *vma, unsigned long start) + } + + if (cpumask_any_but(mm_cpumask(mm), smp_processor_id()) < nr_cpu_ids) +- flush_tlb_others(mm_cpumask(mm), mm, start, 0UL); ++ flush_tlb_others(mm_cpumask(mm), mm, start, start + PAGE_SIZE); + + preempt_enable(); + } +diff --git a/block/blk-cgroup.c b/block/blk-cgroup.c +index 9d359e05fad7..8161090a1970 100644 +--- a/block/blk-cgroup.c ++++ b/block/blk-cgroup.c +@@ -788,6 +788,7 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol, + { + struct gendisk *disk; + struct blkcg_gq *blkg; ++ struct module *owner; + unsigned int major, minor; + int key_len, part, ret; + char *body; +@@ -804,7 +805,9 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol, + if (!disk) + return -ENODEV; + if (part) { ++ owner = disk->fops->owner; + put_disk(disk); ++ module_put(owner); + return -ENODEV; + } + +@@ -820,7 +823,9 @@ int blkg_conf_prep(struct blkcg *blkcg, const struct blkcg_policy *pol, + ret = PTR_ERR(blkg); + rcu_read_unlock(); + spin_unlock_irq(disk->queue->queue_lock); ++ owner = disk->fops->owner; + put_disk(disk); ++ module_put(owner); + /* + * If queue was bypassing, we should retry. Do so after a + * short msleep(). It isn't strictly necessary but queue +@@ -851,9 +856,13 @@ EXPORT_SYMBOL_GPL(blkg_conf_prep); + void blkg_conf_finish(struct blkg_conf_ctx *ctx) + __releases(ctx->disk->queue->queue_lock) __releases(rcu) + { ++ struct module *owner; ++ + spin_unlock_irq(ctx->disk->queue->queue_lock); + rcu_read_unlock(); ++ owner = ctx->disk->fops->owner; + put_disk(ctx->disk); ++ module_put(owner); + } + EXPORT_SYMBOL_GPL(blkg_conf_finish); + +diff --git a/drivers/char/virtio_console.c b/drivers/char/virtio_console.c +index 31e8ae916ba0..be0b09a0fb44 100644 +--- a/drivers/char/virtio_console.c ++++ b/drivers/char/virtio_console.c +@@ -1864,7 +1864,7 @@ static void config_work_handler(struct work_struct *work) + { + struct ports_device *portdev; + +- portdev = container_of(work, struct ports_device, control_work); ++ portdev = container_of(work, struct ports_device, config_work); + if (!use_multiport(portdev)) { + struct virtio_device *vdev; + struct port *port; +diff --git a/drivers/cpufreq/s3c2416-cpufreq.c b/drivers/cpufreq/s3c2416-cpufreq.c +index d6d425773fa4..5b2db3c6568f 100644 +--- a/drivers/cpufreq/s3c2416-cpufreq.c ++++ b/drivers/cpufreq/s3c2416-cpufreq.c +@@ -400,7 +400,6 @@ static int s3c2416_cpufreq_driver_init(struct cpufreq_policy *policy) + rate = clk_get_rate(s3c_freq->hclk); + if (rate < 133 * 1000 * 1000) { + pr_err("cpufreq: HCLK not at 133MHz\n"); +- clk_put(s3c_freq->hclk); + ret = -EINVAL; + goto err_armclk; + } +diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +index 25a3e2485cc2..2bc17a907ecf 100644 +--- a/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c ++++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_cs.c +@@ -124,6 +124,13 @@ int amdgpu_cs_get_ring(struct amdgpu_device *adev, u32 ip_type, + } + break; + } ++ ++ if (!(*out_ring && (*out_ring)->adev)) { ++ DRM_ERROR("Ring %d is not initialized on IP %d\n", ++ ring, ip_type); ++ return -EINVAL; ++ } ++ + return 0; + } + +diff --git a/drivers/gpu/drm/ast/ast_drv.h b/drivers/gpu/drm/ast/ast_drv.h +index b92139e9b9d8..b5c64edeb668 100644 +--- a/drivers/gpu/drm/ast/ast_drv.h ++++ b/drivers/gpu/drm/ast/ast_drv.h +@@ -113,7 +113,11 @@ struct ast_private { + struct ttm_bo_kmap_obj cache_kmap; + int next_cursor; + bool support_wide_screen; +- bool DisableP2A; ++ enum { ++ ast_use_p2a, ++ ast_use_dt, ++ ast_use_defaults ++ } config_mode; + + enum ast_tx_chip tx_chip_type; + u8 dp501_maxclk; +diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c +index 6c021165ca67..498a94069e6b 100644 +--- a/drivers/gpu/drm/ast/ast_main.c ++++ b/drivers/gpu/drm/ast/ast_main.c +@@ -62,13 +62,84 @@ uint8_t ast_get_index_reg_mask(struct ast_private *ast, + return ret; + } + ++static void ast_detect_config_mode(struct drm_device *dev, u32 *scu_rev) ++{ ++ struct device_node *np = dev->pdev->dev.of_node; ++ struct ast_private *ast = dev->dev_private; ++ uint32_t data, jregd0, jregd1; ++ ++ /* Defaults */ ++ ast->config_mode = ast_use_defaults; ++ *scu_rev = 0xffffffff; ++ ++ /* Check if we have device-tree properties */ ++ if (np && !of_property_read_u32(np, "aspeed,scu-revision-id", ++ scu_rev)) { ++ /* We do, disable P2A access */ ++ ast->config_mode = ast_use_dt; ++ DRM_INFO("Using device-tree for configuration\n"); ++ return; ++ } ++ ++ /* Not all families have a P2A bridge */ ++ if (dev->pdev->device != PCI_CHIP_AST2000) ++ return; ++ ++ /* ++ * The BMC will set SCU 0x40 D[12] to 1 if the P2 bridge ++ * is disabled. We force using P2A if VGA only mode bit ++ * is set D[7] ++ */ ++ jregd0 = ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xd0, 0xff); ++ jregd1 = ast_get_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xd1, 0xff); ++ if (!(jregd0 & 0x80) || !(jregd1 & 0x10)) { ++ /* Double check it's actually working */ ++ data = ast_read32(ast, 0xf004); ++ if (data != 0xFFFFFFFF) { ++ /* P2A works, grab silicon revision */ ++ ast->config_mode = ast_use_p2a; ++ ++ DRM_INFO("Using P2A bridge for configuration\n"); ++ ++ /* Read SCU7c (silicon revision register) */ ++ ast_write32(ast, 0xf004, 0x1e6e0000); ++ ast_write32(ast, 0xf000, 0x1); ++ *scu_rev = ast_read32(ast, 0x1207c); ++ return; ++ } ++ } ++ ++ /* We have a P2A bridge but it's disabled */ ++ DRM_INFO("P2A bridge disabled, using default configuration\n"); ++} + + static int ast_detect_chip(struct drm_device *dev, bool *need_post) + { + struct ast_private *ast = dev->dev_private; +- uint32_t data, jreg; ++ uint32_t jreg, scu_rev; ++ ++ /* ++ * If VGA isn't enabled, we need to enable now or subsequent ++ * access to the scratch registers will fail. We also inform ++ * our caller that it needs to POST the chip ++ * (Assumption: VGA not enabled -> need to POST) ++ */ ++ if (!ast_is_vga_enabled(dev)) { ++ ast_enable_vga(dev); ++ DRM_INFO("VGA not enabled on entry, requesting chip POST\n"); ++ *need_post = true; ++ } else ++ *need_post = false; ++ ++ ++ /* Enable extended register access */ ++ ast_enable_mmio(dev); + ast_open_key(ast); + ++ /* Find out whether P2A works or whether to use device-tree */ ++ ast_detect_config_mode(dev, &scu_rev); ++ ++ /* Identify chipset */ + if (dev->pdev->device == PCI_CHIP_AST1180) { + ast->chip = AST1100; + DRM_INFO("AST 1180 detected\n"); +@@ -80,12 +151,7 @@ static int ast_detect_chip(struct drm_device *dev, bool *need_post) + ast->chip = AST2300; + DRM_INFO("AST 2300 detected\n"); + } else if (dev->pdev->revision >= 0x10) { +- uint32_t data; +- ast_write32(ast, 0xf004, 0x1e6e0000); +- ast_write32(ast, 0xf000, 0x1); +- +- data = ast_read32(ast, 0x1207c); +- switch (data & 0x0300) { ++ switch (scu_rev & 0x0300) { + case 0x0200: + ast->chip = AST1100; + DRM_INFO("AST 1100 detected\n"); +@@ -110,26 +176,6 @@ static int ast_detect_chip(struct drm_device *dev, bool *need_post) + } + } + +- /* +- * If VGA isn't enabled, we need to enable now or subsequent +- * access to the scratch registers will fail. We also inform +- * our caller that it needs to POST the chip +- * (Assumption: VGA not enabled -> need to POST) +- */ +- if (!ast_is_vga_enabled(dev)) { +- ast_enable_vga(dev); +- ast_enable_mmio(dev); +- DRM_INFO("VGA not enabled on entry, requesting chip POST\n"); +- *need_post = true; +- } else +- *need_post = false; +- +- /* Check P2A Access */ +- ast->DisableP2A = true; +- data = ast_read32(ast, 0xf004); +- if (data != 0xFFFFFFFF) +- ast->DisableP2A = false; +- + /* Check if we support wide screen */ + switch (ast->chip) { + case AST1180: +@@ -146,17 +192,12 @@ static int ast_detect_chip(struct drm_device *dev, bool *need_post) + ast->support_wide_screen = true; + else { + ast->support_wide_screen = false; +- if (ast->DisableP2A == false) { +- /* Read SCU7c (silicon revision register) */ +- ast_write32(ast, 0xf004, 0x1e6e0000); +- ast_write32(ast, 0xf000, 0x1); +- data = ast_read32(ast, 0x1207c); +- data &= 0x300; +- if (ast->chip == AST2300 && data == 0x0) /* ast1300 */ +- ast->support_wide_screen = true; +- if (ast->chip == AST2400 && data == 0x100) /* ast1400 */ +- ast->support_wide_screen = true; +- } ++ if (ast->chip == AST2300 && ++ (scu_rev & 0x300) == 0x0) /* ast1300 */ ++ ast->support_wide_screen = true; ++ if (ast->chip == AST2400 && ++ (scu_rev & 0x300) == 0x100) /* ast1400 */ ++ ast->support_wide_screen = true; + } + break; + } +@@ -220,85 +261,102 @@ static int ast_detect_chip(struct drm_device *dev, bool *need_post) + + static int ast_get_dram_info(struct drm_device *dev) + { ++ struct device_node *np = dev->pdev->dev.of_node; + struct ast_private *ast = dev->dev_private; +- uint32_t data, data2; +- uint32_t denum, num, div, ref_pll; ++ uint32_t mcr_cfg, mcr_scu_mpll, mcr_scu_strap; ++ uint32_t denum, num, div, ref_pll, dsel; + +- if (ast->DisableP2A) +- { ++ switch (ast->config_mode) { ++ case ast_use_dt: ++ /* ++ * If some properties are missing, use reasonable ++ * defaults for AST2400 ++ */ ++ if (of_property_read_u32(np, "aspeed,mcr-configuration", ++ &mcr_cfg)) ++ mcr_cfg = 0x00000577; ++ if (of_property_read_u32(np, "aspeed,mcr-scu-mpll", ++ &mcr_scu_mpll)) ++ mcr_scu_mpll = 0x000050C0; ++ if (of_property_read_u32(np, "aspeed,mcr-scu-strap", ++ &mcr_scu_strap)) ++ mcr_scu_strap = 0; ++ break; ++ case ast_use_p2a: ++ ast_write32(ast, 0xf004, 0x1e6e0000); ++ ast_write32(ast, 0xf000, 0x1); ++ mcr_cfg = ast_read32(ast, 0x10004); ++ mcr_scu_mpll = ast_read32(ast, 0x10120); ++ mcr_scu_strap = ast_read32(ast, 0x10170); ++ break; ++ case ast_use_defaults: ++ default: + ast->dram_bus_width = 16; + ast->dram_type = AST_DRAM_1Gx16; + ast->mclk = 396; ++ return 0; + } +- else +- { +- ast_write32(ast, 0xf004, 0x1e6e0000); +- ast_write32(ast, 0xf000, 0x1); +- data = ast_read32(ast, 0x10004); +- +- if (data & 0x40) +- ast->dram_bus_width = 16; +- else +- ast->dram_bus_width = 32; + +- if (ast->chip == AST2300 || ast->chip == AST2400) { +- switch (data & 0x03) { +- case 0: +- ast->dram_type = AST_DRAM_512Mx16; +- break; +- default: +- case 1: +- ast->dram_type = AST_DRAM_1Gx16; +- break; +- case 2: +- ast->dram_type = AST_DRAM_2Gx16; +- break; +- case 3: +- ast->dram_type = AST_DRAM_4Gx16; +- break; +- } +- } else { +- switch (data & 0x0c) { +- case 0: +- case 4: +- ast->dram_type = AST_DRAM_512Mx16; +- break; +- case 8: +- if (data & 0x40) +- ast->dram_type = AST_DRAM_1Gx16; +- else +- ast->dram_type = AST_DRAM_512Mx32; +- break; +- case 0xc: +- ast->dram_type = AST_DRAM_1Gx32; +- break; +- } +- } ++ if (mcr_cfg & 0x40) ++ ast->dram_bus_width = 16; ++ else ++ ast->dram_bus_width = 32; + +- data = ast_read32(ast, 0x10120); +- data2 = ast_read32(ast, 0x10170); +- if (data2 & 0x2000) +- ref_pll = 14318; +- else +- ref_pll = 12000; +- +- denum = data & 0x1f; +- num = (data & 0x3fe0) >> 5; +- data = (data & 0xc000) >> 14; +- switch (data) { +- case 3: +- div = 0x4; ++ if (ast->chip == AST2300 || ast->chip == AST2400) { ++ switch (mcr_cfg & 0x03) { ++ case 0: ++ ast->dram_type = AST_DRAM_512Mx16; + break; +- case 2: ++ default: + case 1: +- div = 0x2; ++ ast->dram_type = AST_DRAM_1Gx16; + break; +- default: +- div = 0x1; ++ case 2: ++ ast->dram_type = AST_DRAM_2Gx16; ++ break; ++ case 3: ++ ast->dram_type = AST_DRAM_4Gx16; ++ break; ++ } ++ } else { ++ switch (mcr_cfg & 0x0c) { ++ case 0: ++ case 4: ++ ast->dram_type = AST_DRAM_512Mx16; ++ break; ++ case 8: ++ if (mcr_cfg & 0x40) ++ ast->dram_type = AST_DRAM_1Gx16; ++ else ++ ast->dram_type = AST_DRAM_512Mx32; ++ break; ++ case 0xc: ++ ast->dram_type = AST_DRAM_1Gx32; + break; + } +- ast->mclk = ref_pll * (num + 2) / (denum + 2) * (div * 1000); + } ++ ++ if (mcr_scu_strap & 0x2000) ++ ref_pll = 14318; ++ else ++ ref_pll = 12000; ++ ++ denum = mcr_scu_mpll & 0x1f; ++ num = (mcr_scu_mpll & 0x3fe0) >> 5; ++ dsel = (mcr_scu_mpll & 0xc000) >> 14; ++ switch (dsel) { ++ case 3: ++ div = 0x4; ++ break; ++ case 2: ++ case 1: ++ div = 0x2; ++ break; ++ default: ++ div = 0x1; ++ break; ++ } ++ ast->mclk = ref_pll * (num + 2) / (denum + 2) * (div * 1000); + return 0; + } + +diff --git a/drivers/gpu/drm/ast/ast_post.c b/drivers/gpu/drm/ast/ast_post.c +index 270e8fb2803f..c7c58becb25d 100644 +--- a/drivers/gpu/drm/ast/ast_post.c ++++ b/drivers/gpu/drm/ast/ast_post.c +@@ -375,17 +375,14 @@ void ast_post_gpu(struct drm_device *dev) + ast_enable_mmio(dev); + ast_set_def_ext_reg(dev); + +- if (ast->DisableP2A == false) +- { ++ if (ast->config_mode == ast_use_p2a) { + if (ast->chip == AST2300 || ast->chip == AST2400) + ast_init_dram_2300(dev); + else + ast_init_dram_reg(dev); + + ast_init_3rdtx(dev); +- } +- else +- { ++ } else { + if (ast->tx_chip_type != AST_TX_NONE) + ast_set_index_reg_mask(ast, AST_IO_CRTC_PORT, 0xa3, 0xcf, 0x80); /* Enable DVO */ + } +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c +index 13db8a2851ed..1f013d45c9e9 100644 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_cmdbuf_res.c +@@ -321,6 +321,7 @@ void vmw_cmdbuf_res_man_destroy(struct vmw_cmdbuf_res_manager *man) + list_for_each_entry_safe(entry, next, &man->list, head) + vmw_cmdbuf_res_free(man, entry); + ++ drm_ht_remove(&man->resources); + kfree(man); + } + +diff --git a/drivers/hid/i2c-hid/i2c-hid.c b/drivers/hid/i2c-hid/i2c-hid.c +index 0b80633bae91..d4d655a10df1 100644 +--- a/drivers/hid/i2c-hid/i2c-hid.c ++++ b/drivers/hid/i2c-hid/i2c-hid.c +@@ -364,6 +364,15 @@ static int i2c_hid_hwreset(struct i2c_client *client) + if (ret) + return ret; + ++ /* ++ * The HID over I2C specification states that if a DEVICE needs time ++ * after the PWR_ON request, it should utilise CLOCK stretching. ++ * However, it has been observered that the Windows driver provides a ++ * 1ms sleep between the PWR_ON and RESET requests and that some devices ++ * rely on this. ++ */ ++ usleep_range(1000, 5000); ++ + i2c_hid_dbg(ihid, "resetting...\n"); + + ret = i2c_hid_command(client, &hid_reset_cmd, NULL, 0); +diff --git a/drivers/iommu/amd_iommu_v2.c b/drivers/iommu/amd_iommu_v2.c +index 4831eb910fc7..22160e481794 100644 +--- a/drivers/iommu/amd_iommu_v2.c ++++ b/drivers/iommu/amd_iommu_v2.c +@@ -699,9 +699,9 @@ out_clear_state: + + out_unregister: + mmu_notifier_unregister(&pasid_state->mn, mm); ++ mmput(mm); + + out_free: +- mmput(mm); + free_pasid_state(pasid_state); + + out: +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index b92b8a724efb..f9711aceef54 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -1137,7 +1137,7 @@ static void dma_pte_free_level(struct dmar_domain *domain, int level, + if (!dma_pte_present(pte) || dma_pte_superpage(pte)) + goto next; + +- level_pfn = pfn & level_mask(level - 1); ++ level_pfn = pfn & level_mask(level); + level_pte = phys_to_virt(dma_pte_addr(pte)); + + if (level > 2) +diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c +index 515bb8b80952..a070fa39521a 100644 +--- a/drivers/iommu/iommu.c ++++ b/drivers/iommu/iommu.c +@@ -391,36 +391,30 @@ int iommu_group_add_device(struct iommu_group *group, struct device *dev) + device->dev = dev; + + ret = sysfs_create_link(&dev->kobj, &group->kobj, "iommu_group"); +- if (ret) { +- kfree(device); +- return ret; +- } ++ if (ret) ++ goto err_free_device; + + device->name = kasprintf(GFP_KERNEL, "%s", kobject_name(&dev->kobj)); + rename: + if (!device->name) { +- sysfs_remove_link(&dev->kobj, "iommu_group"); +- kfree(device); +- return -ENOMEM; ++ ret = -ENOMEM; ++ goto err_remove_link; + } + + ret = sysfs_create_link_nowarn(group->devices_kobj, + &dev->kobj, device->name); + if (ret) { +- kfree(device->name); + if (ret == -EEXIST && i >= 0) { + /* + * Account for the slim chance of collision + * and append an instance to the name. + */ ++ kfree(device->name); + device->name = kasprintf(GFP_KERNEL, "%s.%d", + kobject_name(&dev->kobj), i++); + goto rename; + } +- +- sysfs_remove_link(&dev->kobj, "iommu_group"); +- kfree(device); +- return ret; ++ goto err_free_name; + } + + kobject_get(group->devices_kobj); +@@ -432,8 +426,10 @@ rename: + mutex_lock(&group->mutex); + list_add_tail(&device->list, &group->devices); + if (group->domain) +- __iommu_attach_device(group->domain, dev); ++ ret = __iommu_attach_device(group->domain, dev); + mutex_unlock(&group->mutex); ++ if (ret) ++ goto err_put_group; + + /* Notify any listeners about change to group. */ + blocking_notifier_call_chain(&group->notifier, +@@ -444,6 +440,21 @@ rename: + pr_info("Adding device %s to group %d\n", dev_name(dev), group->id); + + return 0; ++ ++err_put_group: ++ mutex_lock(&group->mutex); ++ list_del(&device->list); ++ mutex_unlock(&group->mutex); ++ dev->iommu_group = NULL; ++ kobject_put(group->devices_kobj); ++err_free_name: ++ kfree(device->name); ++err_remove_link: ++ sysfs_remove_link(&dev->kobj, "iommu_group"); ++err_free_device: ++ kfree(device); ++ pr_err("Failed to add device %s to group %d: %d\n", dev_name(dev), group->id, ret); ++ return ret; + } + EXPORT_SYMBOL_GPL(iommu_group_add_device); + +diff --git a/drivers/mtd/bcm47xxpart.c b/drivers/mtd/bcm47xxpart.c +index 5abab8800891..9190057535e6 100644 +--- a/drivers/mtd/bcm47xxpart.c ++++ b/drivers/mtd/bcm47xxpart.c +@@ -66,11 +66,13 @@ static const char *bcm47xxpart_trx_data_part_name(struct mtd_info *master, + { + uint32_t buf; + size_t bytes_read; ++ int err; + +- if (mtd_read(master, offset, sizeof(buf), &bytes_read, +- (uint8_t *)&buf) < 0) { +- pr_err("mtd_read error while parsing (offset: 0x%X)!\n", +- offset); ++ err = mtd_read(master, offset, sizeof(buf), &bytes_read, ++ (uint8_t *)&buf); ++ if (err && !mtd_is_bitflip(err)) { ++ pr_err("mtd_read error while parsing (offset: 0x%X): %d\n", ++ offset, err); + goto out_default; + } + +@@ -95,6 +97,7 @@ static int bcm47xxpart_parse(struct mtd_info *master, + int trx_part = -1; + int last_trx_part = -1; + int possible_nvram_sizes[] = { 0x8000, 0xF000, 0x10000, }; ++ int err; + + /* + * Some really old flashes (like AT45DB*) had smaller erasesize-s, but +@@ -118,8 +121,8 @@ static int bcm47xxpart_parse(struct mtd_info *master, + /* Parse block by block looking for magics */ + for (offset = 0; offset <= master->size - blocksize; + offset += blocksize) { +- /* Nothing more in higher memory */ +- if (offset >= 0x2000000) ++ /* Nothing more in higher memory on BCM47XX (MIPS) */ ++ if (config_enabled(CONFIG_BCM47XX) && offset >= 0x2000000) + break; + + if (curr_part >= BCM47XXPART_MAX_PARTS) { +@@ -128,10 +131,11 @@ static int bcm47xxpart_parse(struct mtd_info *master, + } + + /* Read beginning of the block */ +- if (mtd_read(master, offset, BCM47XXPART_BYTES_TO_READ, +- &bytes_read, (uint8_t *)buf) < 0) { +- pr_err("mtd_read error while parsing (offset: 0x%X)!\n", +- offset); ++ err = mtd_read(master, offset, BCM47XXPART_BYTES_TO_READ, ++ &bytes_read, (uint8_t *)buf); ++ if (err && !mtd_is_bitflip(err)) { ++ pr_err("mtd_read error while parsing (offset: 0x%X): %d\n", ++ offset, err); + continue; + } + +@@ -252,10 +256,11 @@ static int bcm47xxpart_parse(struct mtd_info *master, + } + + /* Read middle of the block */ +- if (mtd_read(master, offset + 0x8000, 0x4, +- &bytes_read, (uint8_t *)buf) < 0) { +- pr_err("mtd_read error while parsing (offset: 0x%X)!\n", +- offset); ++ err = mtd_read(master, offset + 0x8000, 0x4, &bytes_read, ++ (uint8_t *)buf); ++ if (err && !mtd_is_bitflip(err)) { ++ pr_err("mtd_read error while parsing (offset: 0x%X): %d\n", ++ offset, err); + continue; + } + +@@ -275,10 +280,11 @@ static int bcm47xxpart_parse(struct mtd_info *master, + } + + offset = master->size - possible_nvram_sizes[i]; +- if (mtd_read(master, offset, 0x4, &bytes_read, +- (uint8_t *)buf) < 0) { +- pr_err("mtd_read error while reading at offset 0x%X!\n", +- offset); ++ err = mtd_read(master, offset, 0x4, &bytes_read, ++ (uint8_t *)buf); ++ if (err && !mtd_is_bitflip(err)) { ++ pr_err("mtd_read error while reading (offset 0x%X): %d\n", ++ offset, err); + continue; + } + +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c +index 5e6238e0b2bd..75e6e7e6baed 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-dev.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-dev.c +@@ -2732,8 +2732,10 @@ static int xgbe_init(struct xgbe_prv_data *pdata) + + /* Flush Tx queues */ + ret = xgbe_flush_tx_queues(pdata); +- if (ret) ++ if (ret) { ++ netdev_err(pdata->netdev, "error flushing TX queues\n"); + return ret; ++ } + + /* + * Initialize DMA related features +diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c +index 865b7e0b133b..64034ff081a0 100644 +--- a/drivers/net/ethernet/amd/xgbe/xgbe-drv.c ++++ b/drivers/net/ethernet/amd/xgbe/xgbe-drv.c +@@ -877,7 +877,9 @@ static int xgbe_start(struct xgbe_prv_data *pdata) + + DBGPR("-->xgbe_start\n"); + +- hw_if->init(pdata); ++ ret = hw_if->init(pdata); ++ if (ret) ++ return ret; + + ret = phy_if->phy_start(pdata); + if (ret) +diff --git a/drivers/net/ethernet/broadcom/bgmac.c b/drivers/net/ethernet/broadcom/bgmac.c +index b56c9c581359..70da30095b89 100644 +--- a/drivers/net/ethernet/broadcom/bgmac.c ++++ b/drivers/net/ethernet/broadcom/bgmac.c +@@ -255,15 +255,16 @@ static void bgmac_dma_tx_free(struct bgmac *bgmac, struct bgmac_dma_ring *ring) + while (ring->start != ring->end) { + int slot_idx = ring->start % BGMAC_TX_RING_SLOTS; + struct bgmac_slot_info *slot = &ring->slots[slot_idx]; +- u32 ctl1; ++ u32 ctl0, ctl1; + int len; + + if (slot_idx == empty_slot) + break; + ++ ctl0 = le32_to_cpu(ring->cpu_base[slot_idx].ctl0); + ctl1 = le32_to_cpu(ring->cpu_base[slot_idx].ctl1); + len = ctl1 & BGMAC_DESC_CTL1_LEN; +- if (ctl1 & BGMAC_DESC_CTL0_SOF) ++ if (ctl0 & BGMAC_DESC_CTL0_SOF) + /* Unmap no longer used buffer */ + dma_unmap_single(dma_dev, slot->dma_addr, len, + DMA_TO_DEVICE); +@@ -469,6 +470,11 @@ static int bgmac_dma_rx_read(struct bgmac *bgmac, struct bgmac_dma_ring *ring, + len -= ETH_FCS_LEN; + + skb = build_skb(buf, BGMAC_RX_ALLOC_SIZE); ++ if (unlikely(!skb)) { ++ bgmac_err(bgmac, "build_skb failed\n"); ++ put_page(virt_to_head_page(buf)); ++ break; ++ } + skb_put(skb, BGMAC_RX_FRAME_OFFSET + + BGMAC_RX_BUF_OFFSET + len); + skb_pull(skb, BGMAC_RX_FRAME_OFFSET + +@@ -1302,7 +1308,8 @@ static int bgmac_open(struct net_device *net_dev) + + phy_start(bgmac->phy_dev); + +- netif_carrier_on(net_dev); ++ netif_start_queue(net_dev); ++ + return 0; + } + +diff --git a/drivers/net/ethernet/emulex/benet/be_cmds.c b/drivers/net/ethernet/emulex/benet/be_cmds.c +index 1795c935ff02..7b8638ddb673 100644 +--- a/drivers/net/ethernet/emulex/benet/be_cmds.c ++++ b/drivers/net/ethernet/emulex/benet/be_cmds.c +@@ -1052,7 +1052,7 @@ int be_cmd_pmac_add(struct be_adapter *adapter, u8 *mac_addr, + err: + spin_unlock_bh(&adapter->mcc_lock); + +- if (status == MCC_STATUS_UNAUTHORIZED_REQUEST) ++ if (base_status(status) == MCC_STATUS_UNAUTHORIZED_REQUEST) + status = -EPERM; + + return status; +diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c +index 6a061f17a44f..4cd2a7d0124f 100644 +--- a/drivers/net/ethernet/freescale/gianfar.c ++++ b/drivers/net/ethernet/freescale/gianfar.c +@@ -2939,7 +2939,7 @@ static bool gfar_add_rx_frag(struct gfar_rx_buff *rxb, u32 lstatus, + size, GFAR_RXB_TRUESIZE); + + /* try reuse page */ +- if (unlikely(page_count(page) != 1)) ++ if (unlikely(page_count(page) != 1 || page_is_pfmemalloc(page))) + return false; + + /* change offset to the other half */ +diff --git a/drivers/net/ethernet/ibm/ibmveth.c b/drivers/net/ethernet/ibm/ibmveth.c +index f9e4988ea30e..2f9b12cf9ee5 100644 +--- a/drivers/net/ethernet/ibm/ibmveth.c ++++ b/drivers/net/ethernet/ibm/ibmveth.c +@@ -1602,8 +1602,11 @@ static int ibmveth_probe(struct vio_dev *dev, const struct vio_device_id *id) + netdev->netdev_ops = &ibmveth_netdev_ops; + netdev->ethtool_ops = &netdev_ethtool_ops; + SET_NETDEV_DEV(netdev, &dev->dev); +- netdev->hw_features = NETIF_F_SG | NETIF_F_RXCSUM | +- NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM; ++ netdev->hw_features = NETIF_F_SG; ++ if (vio_get_attribute(dev, "ibm,illan-options", NULL) != NULL) { ++ netdev->hw_features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM | ++ NETIF_F_RXCSUM; ++ } + + netdev->features |= netdev->hw_features; + +diff --git a/drivers/net/ethernet/korina.c b/drivers/net/ethernet/korina.c +index d74f5f4e5782..07eabf72c480 100644 +--- a/drivers/net/ethernet/korina.c ++++ b/drivers/net/ethernet/korina.c +@@ -900,10 +900,10 @@ static void korina_restart_task(struct work_struct *work) + DMA_STAT_DONE | DMA_STAT_HALT | DMA_STAT_ERR, + &lp->rx_dma_regs->dmasm); + +- korina_free_ring(dev); +- + napi_disable(&lp->napi); + ++ korina_free_ring(dev); ++ + if (korina_init(dev) < 0) { + printk(KERN_ERR "%s: cannot restart device\n", dev->name); + return; +@@ -1064,12 +1064,12 @@ static int korina_close(struct net_device *dev) + tmp = tmp | DMA_STAT_DONE | DMA_STAT_HALT | DMA_STAT_ERR; + writel(tmp, &lp->rx_dma_regs->dmasm); + +- korina_free_ring(dev); +- + napi_disable(&lp->napi); + + cancel_work_sync(&lp->restart_task); + ++ korina_free_ring(dev); ++ + free_irq(lp->rx_irq, dev); + free_irq(lp->tx_irq, dev); + free_irq(lp->ovr_irq, dev); +diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c +index 71ec9cb08e06..15056f06754a 100644 +--- a/drivers/net/ethernet/marvell/mvneta.c ++++ b/drivers/net/ethernet/marvell/mvneta.c +@@ -2446,7 +2446,7 @@ static void mvneta_start_dev(struct mvneta_port *pp) + mvneta_port_enable(pp); + + /* Enable polling on the port */ +- for_each_present_cpu(cpu) { ++ for_each_online_cpu(cpu) { + struct mvneta_pcpu_port *port = per_cpu_ptr(pp->ports, cpu); + + napi_enable(&port->napi); +@@ -2472,7 +2472,7 @@ static void mvneta_stop_dev(struct mvneta_port *pp) + + phy_stop(pp->phy_dev); + +- for_each_present_cpu(cpu) { ++ for_each_online_cpu(cpu) { + struct mvneta_pcpu_port *port = per_cpu_ptr(pp->ports, cpu); + + napi_disable(&port->napi); +@@ -2902,13 +2902,11 @@ err_cleanup_rxqs: + static int mvneta_stop(struct net_device *dev) + { + struct mvneta_port *pp = netdev_priv(dev); +- int cpu; + + mvneta_stop_dev(pp); + mvneta_mdio_remove(pp); + unregister_cpu_notifier(&pp->cpu_notifier); +- for_each_present_cpu(cpu) +- smp_call_function_single(cpu, mvneta_percpu_disable, pp, true); ++ on_each_cpu(mvneta_percpu_disable, pp, true); + free_percpu_irq(dev->irq, pp->ports); + mvneta_cleanup_rxqs(pp); + mvneta_cleanup_txqs(pp); +diff --git a/drivers/net/ethernet/mellanox/mlx4/eq.c b/drivers/net/ethernet/mellanox/mlx4/eq.c +index 603d1c3d3b2e..ff77b8b608bd 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/eq.c ++++ b/drivers/net/ethernet/mellanox/mlx4/eq.c +@@ -542,8 +542,9 @@ static int mlx4_eq_int(struct mlx4_dev *dev, struct mlx4_eq *eq) + break; + + case MLX4_EVENT_TYPE_SRQ_LIMIT: +- mlx4_dbg(dev, "%s: MLX4_EVENT_TYPE_SRQ_LIMIT\n", +- __func__); ++ mlx4_dbg(dev, "%s: MLX4_EVENT_TYPE_SRQ_LIMIT. srq_no=0x%x, eq 0x%x\n", ++ __func__, be32_to_cpu(eqe->event.srq.srqn), ++ eq->eqn); + case MLX4_EVENT_TYPE_SRQ_CATAS_ERROR: + if (mlx4_is_master(dev)) { + /* forward only to slave owning the SRQ */ +@@ -558,15 +559,19 @@ static int mlx4_eq_int(struct mlx4_dev *dev, struct mlx4_eq *eq) + eq->eqn, eq->cons_index, ret); + break; + } +- mlx4_warn(dev, "%s: slave:%d, srq_no:0x%x, event: %02x(%02x)\n", +- __func__, slave, +- be32_to_cpu(eqe->event.srq.srqn), +- eqe->type, eqe->subtype); ++ if (eqe->type == ++ MLX4_EVENT_TYPE_SRQ_CATAS_ERROR) ++ mlx4_warn(dev, "%s: slave:%d, srq_no:0x%x, event: %02x(%02x)\n", ++ __func__, slave, ++ be32_to_cpu(eqe->event.srq.srqn), ++ eqe->type, eqe->subtype); + + if (!ret && slave != dev->caps.function) { +- mlx4_warn(dev, "%s: sending event %02x(%02x) to slave:%d\n", +- __func__, eqe->type, +- eqe->subtype, slave); ++ if (eqe->type == ++ MLX4_EVENT_TYPE_SRQ_CATAS_ERROR) ++ mlx4_warn(dev, "%s: sending event %02x(%02x) to slave:%d\n", ++ __func__, eqe->type, ++ eqe->subtype, slave); + mlx4_slave_event(dev, slave, eqe); + break; + } +diff --git a/drivers/net/ethernet/mellanox/mlx5/core/main.c b/drivers/net/ethernet/mellanox/mlx5/core/main.c +index 1e611980cf99..f5c1f4acc57b 100644 +--- a/drivers/net/ethernet/mellanox/mlx5/core/main.c ++++ b/drivers/net/ethernet/mellanox/mlx5/core/main.c +@@ -153,8 +153,9 @@ static struct mlx5_profile profile[] = { + }, + }; + +-#define FW_INIT_TIMEOUT_MILI 2000 +-#define FW_INIT_WAIT_MS 2 ++#define FW_INIT_TIMEOUT_MILI 2000 ++#define FW_INIT_WAIT_MS 2 ++#define FW_PRE_INIT_TIMEOUT_MILI 10000 + + static int wait_fw_init(struct mlx5_core_dev *dev, u32 max_wait_mili) + { +@@ -934,6 +935,15 @@ static int mlx5_load_one(struct mlx5_core_dev *dev, struct mlx5_priv *priv) + */ + dev->state = MLX5_DEVICE_STATE_UP; + ++ /* wait for firmware to accept initialization segments configurations ++ */ ++ err = wait_fw_init(dev, FW_PRE_INIT_TIMEOUT_MILI); ++ if (err) { ++ dev_err(&dev->pdev->dev, "Firmware over %d MS in pre-initializing state, aborting\n", ++ FW_PRE_INIT_TIMEOUT_MILI); ++ goto out; ++ } ++ + err = mlx5_cmd_init(dev); + if (err) { + dev_err(&pdev->dev, "Failed initializing command interface, aborting\n"); +diff --git a/drivers/net/ethernet/renesas/ravb_main.c b/drivers/net/ethernet/renesas/ravb_main.c +index 1e61d4da72db..585e90f8341d 100644 +--- a/drivers/net/ethernet/renesas/ravb_main.c ++++ b/drivers/net/ethernet/renesas/ravb_main.c +@@ -221,18 +221,6 @@ static void ravb_ring_free(struct net_device *ndev, int q) + int ring_size; + int i; + +- /* Free RX skb ringbuffer */ +- if (priv->rx_skb[q]) { +- for (i = 0; i < priv->num_rx_ring[q]; i++) +- dev_kfree_skb(priv->rx_skb[q][i]); +- } +- kfree(priv->rx_skb[q]); +- priv->rx_skb[q] = NULL; +- +- /* Free aligned TX buffers */ +- kfree(priv->tx_align[q]); +- priv->tx_align[q] = NULL; +- + if (priv->rx_ring[q]) { + for (i = 0; i < priv->num_rx_ring[q]; i++) { + struct ravb_ex_rx_desc *desc = &priv->rx_ring[q][i]; +@@ -261,6 +249,18 @@ static void ravb_ring_free(struct net_device *ndev, int q) + priv->tx_ring[q] = NULL; + } + ++ /* Free RX skb ringbuffer */ ++ if (priv->rx_skb[q]) { ++ for (i = 0; i < priv->num_rx_ring[q]; i++) ++ dev_kfree_skb(priv->rx_skb[q][i]); ++ } ++ kfree(priv->rx_skb[q]); ++ priv->rx_skb[q] = NULL; ++ ++ /* Free aligned TX buffers */ ++ kfree(priv->tx_align[q]); ++ priv->tx_align[q] = NULL; ++ + /* Free TX skb ringbuffer. + * SKBs are freed by ravb_tx_free() call above. + */ +diff --git a/drivers/net/ethernet/sfc/falcon.c b/drivers/net/ethernet/sfc/falcon.c +index d790cb8d9db3..8e832ba8ab24 100644 +--- a/drivers/net/ethernet/sfc/falcon.c ++++ b/drivers/net/ethernet/sfc/falcon.c +@@ -2796,6 +2796,11 @@ const struct efx_nic_type falcon_a1_nic_type = { + .timer_period_max = 1 << FRF_AB_TC_TIMER_VAL_WIDTH, + .offload_features = NETIF_F_IP_CSUM, + .mcdi_max_ver = -1, ++#ifdef CONFIG_SFC_SRIOV ++ .vswitching_probe = efx_port_dummy_op_int, ++ .vswitching_restore = efx_port_dummy_op_int, ++ .vswitching_remove = efx_port_dummy_op_void, ++#endif + }; + + const struct efx_nic_type falcon_b0_nic_type = { +@@ -2897,4 +2902,9 @@ const struct efx_nic_type falcon_b0_nic_type = { + .offload_features = NETIF_F_IP_CSUM | NETIF_F_RXHASH | NETIF_F_NTUPLE, + .mcdi_max_ver = -1, + .max_rx_ip_filters = FR_BZ_RX_FILTER_TBL0_ROWS, ++#ifdef CONFIG_SFC_SRIOV ++ .vswitching_probe = efx_port_dummy_op_int, ++ .vswitching_restore = efx_port_dummy_op_int, ++ .vswitching_remove = efx_port_dummy_op_void, ++#endif + }; +diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c +index 7f7c87762bc6..8dfc75250583 100644 +--- a/drivers/net/virtio_net.c ++++ b/drivers/net/virtio_net.c +@@ -47,8 +47,16 @@ module_param(gso, bool, 0444); + */ + DECLARE_EWMA(pkt_len, 1, 64) + ++/* With mergeable buffers we align buffer address and use the low bits to ++ * encode its true size. Buffer size is up to 1 page so we need to align to ++ * square root of page size to ensure we reserve enough bits to encode the true ++ * size. ++ */ ++#define MERGEABLE_BUFFER_MIN_ALIGN_SHIFT ((PAGE_SHIFT + 1) / 2) ++ + /* Minimum alignment for mergeable packet buffers. */ +-#define MERGEABLE_BUFFER_ALIGN max(L1_CACHE_BYTES, 256) ++#define MERGEABLE_BUFFER_ALIGN max(L1_CACHE_BYTES, \ ++ 1 << MERGEABLE_BUFFER_MIN_ALIGN_SHIFT) + + #define VIRTNET_DRIVER_VERSION "1.0.0" + +diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c +index 9a986ccd42e5..dab3bf6649e6 100644 +--- a/drivers/net/vxlan.c ++++ b/drivers/net/vxlan.c +@@ -2240,7 +2240,7 @@ static void vxlan_cleanup(unsigned long arg) + = container_of(p, struct vxlan_fdb, hlist); + unsigned long timeout; + +- if (f->state & NUD_PERMANENT) ++ if (f->state & (NUD_PERMANENT | NUD_NOARP)) + continue; + + timeout = f->used + vxlan->cfg.age_interval * HZ; +diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c +index 888e9cfef51a..34a062ccb11d 100644 +--- a/drivers/net/xen-netfront.c ++++ b/drivers/net/xen-netfront.c +@@ -321,7 +321,7 @@ static void xennet_alloc_rx_buffers(struct netfront_queue *queue) + queue->rx.req_prod_pvt = req_prod; + + /* Not enough requests? Try again later. */ +- if (req_prod - queue->rx.rsp_cons < NET_RX_SLOTS_MIN) { ++ if (req_prod - queue->rx.sring->req_prod < NET_RX_SLOTS_MIN) { + mod_timer(&queue->rx_refill_timer, jiffies + (HZ/10)); + return; + } +diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c +index be3bc2f4edd4..09cc64b3b695 100644 +--- a/drivers/platform/x86/ideapad-laptop.c ++++ b/drivers/platform/x86/ideapad-laptop.c +@@ -807,6 +807,7 @@ static void ideapad_acpi_notify(acpi_handle handle, u32 event, void *data) + case 11: + case 7: + case 6: ++ case 1: + ideapad_input_report(priv, vpc_bit); + break; + case 5: +diff --git a/drivers/scsi/lpfc/lpfc_els.c b/drivers/scsi/lpfc/lpfc_els.c +index 59ced8864b2f..0e6aaef9a038 100644 +--- a/drivers/scsi/lpfc/lpfc_els.c ++++ b/drivers/scsi/lpfc/lpfc_els.c +@@ -3563,12 +3563,14 @@ lpfc_els_free_iocb(struct lpfc_hba *phba, struct lpfc_iocbq *elsiocb) + } else { + buf_ptr1 = (struct lpfc_dmabuf *) elsiocb->context2; + lpfc_els_free_data(phba, buf_ptr1); ++ elsiocb->context2 = NULL; + } + } + + if (elsiocb->context3) { + buf_ptr = (struct lpfc_dmabuf *) elsiocb->context3; + lpfc_els_free_bpl(phba, buf_ptr); ++ elsiocb->context3 = NULL; + } + lpfc_sli_release_iocbq(phba, elsiocb); + return 0; +diff --git a/drivers/scsi/lpfc/lpfc_sli.c b/drivers/scsi/lpfc/lpfc_sli.c +index f5aeda8f014f..38e90d9c2ced 100644 +--- a/drivers/scsi/lpfc/lpfc_sli.c ++++ b/drivers/scsi/lpfc/lpfc_sli.c +@@ -5887,18 +5887,25 @@ lpfc_sli4_alloc_resource_identifiers(struct lpfc_hba *phba) + + free_vfi_bmask: + kfree(phba->sli4_hba.vfi_bmask); ++ phba->sli4_hba.vfi_bmask = NULL; + free_xri_ids: + kfree(phba->sli4_hba.xri_ids); ++ phba->sli4_hba.xri_ids = NULL; + free_xri_bmask: + kfree(phba->sli4_hba.xri_bmask); ++ phba->sli4_hba.xri_bmask = NULL; + free_vpi_ids: + kfree(phba->vpi_ids); ++ phba->vpi_ids = NULL; + free_vpi_bmask: + kfree(phba->vpi_bmask); ++ phba->vpi_bmask = NULL; + free_rpi_ids: + kfree(phba->sli4_hba.rpi_ids); ++ phba->sli4_hba.rpi_ids = NULL; + free_rpi_bmask: + kfree(phba->sli4_hba.rpi_bmask); ++ phba->sli4_hba.rpi_bmask = NULL; + err_exit: + return rc; + } +diff --git a/drivers/scsi/qla2xxx/qla_isr.c b/drivers/scsi/qla2xxx/qla_isr.c +index 0e59731f95ad..1f6a3b86965f 100644 +--- a/drivers/scsi/qla2xxx/qla_isr.c ++++ b/drivers/scsi/qla2xxx/qla_isr.c +@@ -2466,6 +2466,10 @@ qla2x00_error_entry(scsi_qla_host_t *vha, struct rsp_que *rsp, sts_entry_t *pkt) + if (pkt->entry_status & RF_BUSY) + res = DID_BUS_BUSY << 16; + ++ if (pkt->entry_type == NOTIFY_ACK_TYPE && ++ pkt->handle == QLA_TGT_SKIP_HANDLE) ++ return; ++ + sp = qla2x00_get_sp_from_handle(vha, func, req, pkt); + if (sp) { + sp->done(ha, sp, res); +diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c +index f57d96984ae4..e6faa0b050d1 100644 +--- a/drivers/scsi/qla2xxx/qla_target.c ++++ b/drivers/scsi/qla2xxx/qla_target.c +@@ -2865,7 +2865,7 @@ static int __qlt_send_term_imm_notif(struct scsi_qla_host *vha, + + pkt->entry_type = NOTIFY_ACK_TYPE; + pkt->entry_count = 1; +- pkt->handle = QLA_TGT_SKIP_HANDLE | CTIO_COMPLETION_HANDLE_MARK; ++ pkt->handle = QLA_TGT_SKIP_HANDLE; + + nack = (struct nack_to_isp *)pkt; + nack->ox_id = ntfy->ox_id; +diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c +index 4d5207dff960..8750c86f95f9 100644 +--- a/drivers/scsi/sd.c ++++ b/drivers/scsi/sd.c +@@ -2566,7 +2566,8 @@ sd_read_cache_type(struct scsi_disk *sdkp, unsigned char *buffer) + if (sdp->broken_fua) { + sd_first_printk(KERN_NOTICE, sdkp, "Disabling FUA\n"); + sdkp->DPOFUA = 0; +- } else if (sdkp->DPOFUA && !sdkp->device->use_10_for_rw) { ++ } else if (sdkp->DPOFUA && !sdkp->device->use_10_for_rw && ++ !sdkp->device->use_16_for_rw) { + sd_first_printk(KERN_NOTICE, sdkp, + "Uses READ/WRITE(6), disabling FUA\n"); + sdkp->DPOFUA = 0; +diff --git a/drivers/scsi/virtio_scsi.c b/drivers/scsi/virtio_scsi.c +index 7dbbb29d24c6..03a2aadf0d3c 100644 +--- a/drivers/scsi/virtio_scsi.c ++++ b/drivers/scsi/virtio_scsi.c +@@ -533,7 +533,9 @@ static int virtscsi_queuecommand(struct virtio_scsi *vscsi, + { + struct Scsi_Host *shost = virtio_scsi_host(vscsi->vdev); + struct virtio_scsi_cmd *cmd = scsi_cmd_priv(sc); ++ unsigned long flags; + int req_size; ++ int ret; + + BUG_ON(scsi_sg_count(sc) > shost->sg_tablesize); + +@@ -561,8 +563,15 @@ static int virtscsi_queuecommand(struct virtio_scsi *vscsi, + req_size = sizeof(cmd->req.cmd); + } + +- if (virtscsi_kick_cmd(req_vq, cmd, req_size, sizeof(cmd->resp.cmd)) != 0) ++ ret = virtscsi_kick_cmd(req_vq, cmd, req_size, sizeof(cmd->resp.cmd)); ++ if (ret == -EIO) { ++ cmd->resp.cmd.response = VIRTIO_SCSI_S_BAD_TARGET; ++ spin_lock_irqsave(&req_vq->vq_lock, flags); ++ virtscsi_complete_cmd(vscsi, cmd); ++ spin_unlock_irqrestore(&req_vq->vq_lock, flags); ++ } else if (ret != 0) { + return SCSI_MLQUEUE_HOST_BUSY; ++ } + return 0; + } + +diff --git a/drivers/spi/spi-davinci.c b/drivers/spi/spi-davinci.c +index 7d3af3eacf57..1ddba9ae8c0f 100644 +--- a/drivers/spi/spi-davinci.c ++++ b/drivers/spi/spi-davinci.c +@@ -651,7 +651,7 @@ static int davinci_spi_bufs(struct spi_device *spi, struct spi_transfer *t) + buf = t->rx_buf; + t->rx_dma = dma_map_single(&spi->dev, buf, + t->len, DMA_FROM_DEVICE); +- if (!t->rx_dma) { ++ if (dma_mapping_error(&spi->dev, !t->rx_dma)) { + ret = -EFAULT; + goto err_rx_map; + } +@@ -665,7 +665,7 @@ static int davinci_spi_bufs(struct spi_device *spi, struct spi_transfer *t) + buf = (void *)t->tx_buf; + t->tx_dma = dma_map_single(&spi->dev, buf, + t->len, DMA_TO_DEVICE); +- if (!t->tx_dma) { ++ if (dma_mapping_error(&spi->dev, t->tx_dma)) { + ret = -EFAULT; + goto err_tx_map; + } +diff --git a/drivers/usb/gadget/function/f_fs.c b/drivers/usb/gadget/function/f_fs.c +index 6d8f865a2fb7..732e6ed5d7b4 100644 +--- a/drivers/usb/gadget/function/f_fs.c ++++ b/drivers/usb/gadget/function/f_fs.c +@@ -3463,6 +3463,7 @@ static void ffs_closed(struct ffs_data *ffs) + { + struct ffs_dev *ffs_obj; + struct f_fs_opts *opts; ++ struct config_item *ci; + + ENTER(); + ffs_dev_lock(); +@@ -3486,8 +3487,11 @@ static void ffs_closed(struct ffs_data *ffs) + || !atomic_read(&opts->func_inst.group.cg_item.ci_kref.refcount)) + goto done; + +- unregister_gadget_item(ffs_obj->opts-> +- func_inst.group.cg_item.ci_parent->ci_parent); ++ ci = opts->func_inst.group.cg_item.ci_parent->ci_parent; ++ ffs_dev_unlock(); ++ ++ unregister_gadget_item(ci); ++ return; + done: + ffs_dev_unlock(); + } +diff --git a/drivers/vfio/vfio_iommu_spapr_tce.c b/drivers/vfio/vfio_iommu_spapr_tce.c +index 1a9f18b40be6..34e4b3ad8b92 100644 +--- a/drivers/vfio/vfio_iommu_spapr_tce.c ++++ b/drivers/vfio/vfio_iommu_spapr_tce.c +@@ -1163,6 +1163,10 @@ static int tce_iommu_attach_group(void *iommu_data, + /* pr_debug("tce_vfio: Attaching group #%u to iommu %p\n", + iommu_group_id(iommu_group), iommu_group); */ + table_group = iommu_group_get_iommudata(iommu_group); ++ if (!table_group) { ++ ret = -ENODEV; ++ goto unlock_exit; ++ } + + if (tce_groups_attached(container) && (!table_group->ops || + !table_group->ops->take_ownership || +diff --git a/drivers/watchdog/bcm_kona_wdt.c b/drivers/watchdog/bcm_kona_wdt.c +index e0c98423f2c9..11a72bc2c71b 100644 +--- a/drivers/watchdog/bcm_kona_wdt.c ++++ b/drivers/watchdog/bcm_kona_wdt.c +@@ -304,6 +304,8 @@ static int bcm_kona_wdt_probe(struct platform_device *pdev) + if (!wdt) + return -ENOMEM; + ++ spin_lock_init(&wdt->lock); ++ + res = platform_get_resource(pdev, IORESOURCE_MEM, 0); + wdt->base = devm_ioremap_resource(dev, res); + if (IS_ERR(wdt->base)) +@@ -316,7 +318,6 @@ static int bcm_kona_wdt_probe(struct platform_device *pdev) + return ret; + } + +- spin_lock_init(&wdt->lock); + platform_set_drvdata(pdev, wdt); + watchdog_set_drvdata(&bcm_kona_wdt_wdd, wdt); + bcm_kona_wdt_wdd.parent = &pdev->dev; +diff --git a/drivers/xen/swiotlb-xen.c b/drivers/xen/swiotlb-xen.c +index 7399782c0998..8a58bbc14de2 100644 +--- a/drivers/xen/swiotlb-xen.c ++++ b/drivers/xen/swiotlb-xen.c +@@ -409,9 +409,9 @@ dma_addr_t xen_swiotlb_map_page(struct device *dev, struct page *page, + if (map == SWIOTLB_MAP_ERROR) + return DMA_ERROR_CODE; + ++ dev_addr = xen_phys_to_bus(map); + xen_dma_map_page(dev, pfn_to_page(map >> PAGE_SHIFT), + dev_addr, map & ~PAGE_MASK, size, dir, attrs); +- dev_addr = xen_phys_to_bus(map); + + /* + * Ensure that the address returned is DMA'ble +@@ -567,13 +567,14 @@ xen_swiotlb_map_sg_attrs(struct device *hwdev, struct scatterlist *sgl, + sg_dma_len(sgl) = 0; + return 0; + } ++ dev_addr = xen_phys_to_bus(map); + xen_dma_map_page(hwdev, pfn_to_page(map >> PAGE_SHIFT), + dev_addr, + map & ~PAGE_MASK, + sg->length, + dir, + attrs); +- sg->dma_address = xen_phys_to_bus(map); ++ sg->dma_address = dev_addr; + } else { + /* we are not interested in the dma_addr returned by + * xen_dma_map_page, only in the potential cache flushes executed +diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c +index 3a93755e880f..29ef427c0652 100644 +--- a/fs/binfmt_elf.c ++++ b/fs/binfmt_elf.c +@@ -2295,6 +2295,7 @@ static int elf_core_dump(struct coredump_params *cprm) + goto end_coredump; + } + } ++ dump_truncate(cprm); + + if (!elf_core_write_extra_data(cprm)) + goto end_coredump; +diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c +index 863fa0f1972b..a61926cb01c0 100644 +--- a/fs/btrfs/inode.c ++++ b/fs/btrfs/inode.c +@@ -4397,8 +4397,19 @@ search_again: + if (found_type > min_type) { + del_item = 1; + } else { +- if (item_end < new_size) ++ if (item_end < new_size) { ++ /* ++ * With NO_HOLES mode, for the following mapping ++ * ++ * [0-4k][hole][8k-12k] ++ * ++ * if truncating isize down to 6k, it ends up ++ * isize being 8k. ++ */ ++ if (btrfs_fs_incompat(root->fs_info, NO_HOLES)) ++ last_size = new_size; + break; ++ } + if (found_key.offset >= new_size) + del_item = 1; + else +diff --git a/fs/coredump.c b/fs/coredump.c +index 5d15c4975ba1..a8852293038a 100644 +--- a/fs/coredump.c ++++ b/fs/coredump.c +@@ -810,3 +810,21 @@ int dump_align(struct coredump_params *cprm, int align) + return mod ? dump_skip(cprm, align - mod) : 1; + } + EXPORT_SYMBOL(dump_align); ++ ++/* ++ * Ensures that file size is big enough to contain the current file ++ * postion. This prevents gdb from complaining about a truncated file ++ * if the last "write" to the file was dump_skip. ++ */ ++void dump_truncate(struct coredump_params *cprm) ++{ ++ struct file *file = cprm->file; ++ loff_t offset; ++ ++ if (file->f_op->llseek && file->f_op->llseek != no_llseek) { ++ offset = file->f_op->llseek(file, 0, SEEK_CUR); ++ if (i_size_read(file->f_mapping->host) < offset) ++ do_truncate(file->f_path.dentry, offset, 0, file); ++ } ++} ++EXPORT_SYMBOL(dump_truncate); +diff --git a/fs/nfs/nfs4proc.c b/fs/nfs/nfs4proc.c +index 4e3679b25b9b..8e425f2c5ddd 100644 +--- a/fs/nfs/nfs4proc.c ++++ b/fs/nfs/nfs4proc.c +@@ -2188,8 +2188,6 @@ static int nfs4_opendata_access(struct rpc_cred *cred, + if ((mask & ~cache.mask & (MAY_READ | MAY_EXEC)) == 0) + return 0; + +- /* even though OPEN succeeded, access is denied. Close the file */ +- nfs4_close_state(state, fmode); + return -EACCES; + } + +diff --git a/fs/ocfs2/cluster/heartbeat.c b/fs/ocfs2/cluster/heartbeat.c +index 709fbbd44c65..acebc350e98d 100644 +--- a/fs/ocfs2/cluster/heartbeat.c ++++ b/fs/ocfs2/cluster/heartbeat.c +@@ -2070,13 +2070,13 @@ unlock: + spin_unlock(&o2hb_live_lock); + } + +-static ssize_t o2hb_heartbeat_group_threshold_show(struct config_item *item, ++static ssize_t o2hb_heartbeat_group_dead_threshold_show(struct config_item *item, + char *page) + { + return sprintf(page, "%u\n", o2hb_dead_threshold); + } + +-static ssize_t o2hb_heartbeat_group_threshold_store(struct config_item *item, ++static ssize_t o2hb_heartbeat_group_dead_threshold_store(struct config_item *item, + const char *page, size_t count) + { + unsigned long tmp; +@@ -2125,11 +2125,11 @@ static ssize_t o2hb_heartbeat_group_mode_store(struct config_item *item, + + } + +-CONFIGFS_ATTR(o2hb_heartbeat_group_, threshold); ++CONFIGFS_ATTR(o2hb_heartbeat_group_, dead_threshold); + CONFIGFS_ATTR(o2hb_heartbeat_group_, mode); + + static struct configfs_attribute *o2hb_heartbeat_group_attrs[] = { +- &o2hb_heartbeat_group_attr_threshold, ++ &o2hb_heartbeat_group_attr_dead_threshold, + &o2hb_heartbeat_group_attr_mode, + NULL, + }; +diff --git a/include/linux/coredump.h b/include/linux/coredump.h +index d016a121a8c4..28ffa94aed6b 100644 +--- a/include/linux/coredump.h ++++ b/include/linux/coredump.h +@@ -14,6 +14,7 @@ struct coredump_params; + extern int dump_skip(struct coredump_params *cprm, size_t nr); + extern int dump_emit(struct coredump_params *cprm, const void *addr, int nr); + extern int dump_align(struct coredump_params *cprm, int align); ++extern void dump_truncate(struct coredump_params *cprm); + #ifdef CONFIG_COREDUMP + extern void do_coredump(const siginfo_t *siginfo); + #else +diff --git a/include/net/xfrm.h b/include/net/xfrm.h +index d6f6e5006ee9..185fb037b332 100644 +--- a/include/net/xfrm.h ++++ b/include/net/xfrm.h +@@ -948,10 +948,6 @@ struct xfrm_dst { + struct flow_cache_object flo; + struct xfrm_policy *pols[XFRM_POLICY_TYPE_MAX]; + int num_pols, num_xfrms; +-#ifdef CONFIG_XFRM_SUB_POLICY +- struct flowi *origin; +- struct xfrm_selector *partner; +-#endif + u32 xfrm_genid; + u32 policy_genid; + u32 route_mtu_cached; +@@ -967,12 +963,6 @@ static inline void xfrm_dst_destroy(struct xfrm_dst *xdst) + dst_release(xdst->route); + if (likely(xdst->u.dst.xfrm)) + xfrm_state_put(xdst->u.dst.xfrm); +-#ifdef CONFIG_XFRM_SUB_POLICY +- kfree(xdst->origin); +- xdst->origin = NULL; +- kfree(xdst->partner); +- xdst->partner = NULL; +-#endif + } + #endif + +diff --git a/kernel/panic.c b/kernel/panic.c +index 41e2b54f36b5..1d07cf9af849 100644 +--- a/kernel/panic.c ++++ b/kernel/panic.c +@@ -167,7 +167,7 @@ void panic(const char *fmt, ...) + * Delay timeout seconds before rebooting the machine. + * We can't use the "normal" timers since we just panicked. + */ +- pr_emerg("Rebooting in %d seconds..", panic_timeout); ++ pr_emerg("Rebooting in %d seconds..\n", panic_timeout); + + for (i = 0; i < panic_timeout * 1000; i += PANIC_TIMER_STEP) { + touch_nmi_watchdog(); +diff --git a/kernel/sched/loadavg.c b/kernel/sched/loadavg.c +index b0b93fd33af9..f8e8d68ed3fd 100644 +--- a/kernel/sched/loadavg.c ++++ b/kernel/sched/loadavg.c +@@ -201,8 +201,9 @@ void calc_load_exit_idle(void) + struct rq *this_rq = this_rq(); + + /* +- * If we're still before the sample window, we're done. ++ * If we're still before the pending sample window, we're done. + */ ++ this_rq->calc_load_update = calc_load_update; + if (time_before(jiffies, this_rq->calc_load_update)) + return; + +@@ -211,7 +212,6 @@ void calc_load_exit_idle(void) + * accounted through the nohz accounting, so skip the entire deal and + * sync up for the next window. + */ +- this_rq->calc_load_update = calc_load_update; + if (time_before(jiffies, this_rq->calc_load_update + 10)) + this_rq->calc_load_update += LOAD_FREQ; + } +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 300d64162aff..464a7864e4c5 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -174,7 +174,7 @@ extern int no_unaligned_warning; + #define SYSCTL_WRITES_WARN 0 + #define SYSCTL_WRITES_STRICT 1 + +-static int sysctl_writes_strict = SYSCTL_WRITES_WARN; ++static int sysctl_writes_strict = SYSCTL_WRITES_STRICT; + + static int proc_do_cad_pid(struct ctl_table *table, int write, + void __user *buffer, size_t *lenp, loff_t *ppos); +diff --git a/lib/swiotlb.c b/lib/swiotlb.c +index 76f29ecba8f4..771234d050c7 100644 +--- a/lib/swiotlb.c ++++ b/lib/swiotlb.c +@@ -452,11 +452,11 @@ phys_addr_t swiotlb_tbl_map_single(struct device *hwdev, + : 1UL << (BITS_PER_LONG - IO_TLB_SHIFT); + + /* +- * For mappings greater than a page, we limit the stride (and +- * hence alignment) to a page size. ++ * For mappings greater than or equal to a page, we limit the stride ++ * (and hence alignment) to a page size. + */ + nslots = ALIGN(size, 1 << IO_TLB_SHIFT) >> IO_TLB_SHIFT; +- if (size > PAGE_SIZE) ++ if (size >= PAGE_SIZE) + stride = (1 << (PAGE_SHIFT - IO_TLB_SHIFT)); + else + stride = 1; +diff --git a/mm/huge_memory.c b/mm/huge_memory.c +index 47b469663822..6c6f5ccfcda1 100644 +--- a/mm/huge_memory.c ++++ b/mm/huge_memory.c +@@ -1363,8 +1363,11 @@ int do_huge_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma, + */ + if (unlikely(pmd_trans_migrating(*pmdp))) { + page = pmd_page(*pmdp); ++ if (!get_page_unless_zero(page)) ++ goto out_unlock; + spin_unlock(ptl); + wait_on_page_locked(page); ++ put_page(page); + goto out; + } + +@@ -1396,8 +1399,11 @@ int do_huge_pmd_numa_page(struct mm_struct *mm, struct vm_area_struct *vma, + + /* Migration could have started since the pmd_trans_migrating check */ + if (!page_locked) { ++ if (!get_page_unless_zero(page)) ++ goto out_unlock; + spin_unlock(ptl); + wait_on_page_locked(page); ++ put_page(page); + page_nid = -1; + goto out; + } +diff --git a/mm/swap_cgroup.c b/mm/swap_cgroup.c +index 40dd0f9b00d6..09f733b0424a 100644 +--- a/mm/swap_cgroup.c ++++ b/mm/swap_cgroup.c +@@ -205,6 +205,8 @@ void swap_cgroup_swapoff(int type) + struct page *page = map[i]; + if (page) + __free_page(page); ++ if (!(i % SWAP_CLUSTER_MAX)) ++ cond_resched(); + } + vfree(map); + } +diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c +index ad8d6e6b87ca..e20ae2d3c498 100644 +--- a/net/8021q/vlan.c ++++ b/net/8021q/vlan.c +@@ -278,7 +278,8 @@ static int register_vlan_device(struct net_device *real_dev, u16 vlan_id) + return 0; + + out_free_newdev: +- free_netdev(new_dev); ++ if (new_dev->reg_state == NETREG_UNINITIALIZED) ++ free_netdev(new_dev); + return err; + } + +diff --git a/net/caif/cfpkt_skbuff.c b/net/caif/cfpkt_skbuff.c +index 59ce1fcc220c..71b6ab240dea 100644 +--- a/net/caif/cfpkt_skbuff.c ++++ b/net/caif/cfpkt_skbuff.c +@@ -81,11 +81,7 @@ static struct cfpkt *cfpkt_create_pfx(u16 len, u16 pfx) + { + struct sk_buff *skb; + +- if (likely(in_interrupt())) +- skb = alloc_skb(len + pfx, GFP_ATOMIC); +- else +- skb = alloc_skb(len + pfx, GFP_KERNEL); +- ++ skb = alloc_skb(len + pfx, GFP_ATOMIC); + if (unlikely(skb == NULL)) + return NULL; + +diff --git a/net/core/dev.c b/net/core/dev.c +index 87b8754f34ac..524d8b28e690 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -1246,8 +1246,9 @@ int dev_set_alias(struct net_device *dev, const char *alias, size_t len) + if (!new_ifalias) + return -ENOMEM; + dev->ifalias = new_ifalias; ++ memcpy(dev->ifalias, alias, len); ++ dev->ifalias[len] = 0; + +- strlcpy(dev->ifalias, alias, len+1); + return len; + } + +diff --git a/net/core/dst.c b/net/core/dst.c +index d7ad628bf64e..e72d706f8d0c 100644 +--- a/net/core/dst.c ++++ b/net/core/dst.c +@@ -462,6 +462,20 @@ static int dst_dev_event(struct notifier_block *this, unsigned long event, + spin_lock_bh(&dst_garbage.lock); + dst = dst_garbage.list; + dst_garbage.list = NULL; ++ /* The code in dst_ifdown places a hold on the loopback device. ++ * If the gc entry processing is set to expire after a lengthy ++ * interval, this hold can cause netdev_wait_allrefs() to hang ++ * out and wait for a long time -- until the the loopback ++ * interface is released. If we're really unlucky, it'll emit ++ * pr_emerg messages to console too. Reset the interval here, ++ * so dst cleanups occur in a more timely fashion. ++ */ ++ if (dst_garbage.timer_inc > DST_GC_INC) { ++ dst_garbage.timer_inc = DST_GC_INC; ++ dst_garbage.timer_expires = DST_GC_MIN; ++ mod_delayed_work(system_wq, &dst_gc_work, ++ dst_garbage.timer_expires); ++ } + spin_unlock_bh(&dst_garbage.lock); + + if (last) +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c +index d43544ce7550..2ec5324a7ff7 100644 +--- a/net/core/rtnetlink.c ++++ b/net/core/rtnetlink.c +@@ -897,6 +897,7 @@ static noinline size_t if_nlmsg_size(const struct net_device *dev, + + nla_total_size(1) /* IFLA_LINKMODE */ + + nla_total_size(4) /* IFLA_CARRIER_CHANGES */ + + nla_total_size(4) /* IFLA_LINK_NETNSID */ ++ + nla_total_size(4) /* IFLA_GROUP */ + + nla_total_size(ext_filter_mask + & RTEXT_FILTER_VF ? 4 : 0) /* IFLA_NUM_VF */ + + rtnl_vfinfo_size(dev, ext_filter_mask) /* IFLA_VFINFO_LIST */ +@@ -1089,6 +1090,8 @@ static noinline_for_stack int rtnl_fill_vfinfo(struct sk_buff *skb, + struct ifla_vf_mac vf_mac; + struct ifla_vf_info ivi; + ++ memset(&ivi, 0, sizeof(ivi)); ++ + /* Not all SR-IOV capable drivers support the + * spoofcheck and "RSS query enable" query. Preset to + * -1 so the user space tool can detect that the driver +@@ -1097,7 +1100,6 @@ static noinline_for_stack int rtnl_fill_vfinfo(struct sk_buff *skb, + ivi.spoofchk = -1; + ivi.rss_query_en = -1; + ivi.trusted = -1; +- memset(ivi.mac, 0, sizeof(ivi.mac)); + /* The default value for VF link state is "auto" + * IFLA_VF_LINK_STATE_AUTO which equals zero + */ +@@ -1370,6 +1372,7 @@ static const struct nla_policy ifla_policy[IFLA_MAX+1] = { + [IFLA_PHYS_SWITCH_ID] = { .type = NLA_BINARY, .len = MAX_PHYS_ITEM_ID_LEN }, + [IFLA_LINK_NETNSID] = { .type = NLA_S32 }, + [IFLA_PROTO_DOWN] = { .type = NLA_U8 }, ++ [IFLA_GROUP] = { .type = NLA_U32 }, + }; + + static const struct nla_policy ifla_info_policy[IFLA_INFO_MAX+1] = { +diff --git a/net/decnet/dn_route.c b/net/decnet/dn_route.c +index b1dc096d22f8..403593bd2b83 100644 +--- a/net/decnet/dn_route.c ++++ b/net/decnet/dn_route.c +@@ -188,12 +188,6 @@ static inline void dnrt_free(struct dn_route *rt) + call_rcu_bh(&rt->dst.rcu_head, dst_rcu_free); + } + +-static inline void dnrt_drop(struct dn_route *rt) +-{ +- dst_release(&rt->dst); +- call_rcu_bh(&rt->dst.rcu_head, dst_rcu_free); +-} +- + static void dn_dst_check_expire(unsigned long dummy) + { + int i; +@@ -248,7 +242,7 @@ static int dn_dst_gc(struct dst_ops *ops) + } + *rtp = rt->dst.dn_next; + rt->dst.dn_next = NULL; +- dnrt_drop(rt); ++ dnrt_free(rt); + break; + } + spin_unlock_bh(&dn_rt_hash_table[i].lock); +@@ -350,7 +344,7 @@ static int dn_insert_route(struct dn_route *rt, unsigned int hash, struct dn_rou + dst_use(&rth->dst, now); + spin_unlock_bh(&dn_rt_hash_table[hash].lock); + +- dnrt_drop(rt); ++ dst_free(&rt->dst); + *rp = rth; + return 0; + } +@@ -380,7 +374,7 @@ static void dn_run_flush(unsigned long dummy) + for(; rt; rt = next) { + next = rcu_dereference_raw(rt->dst.dn_next); + RCU_INIT_POINTER(rt->dst.dn_next, NULL); +- dst_free((struct dst_entry *)rt); ++ dnrt_free(rt); + } + + nothing_to_declare: +@@ -1187,7 +1181,7 @@ make_route: + if (dev_out->flags & IFF_LOOPBACK) + flags |= RTCF_LOCAL; + +- rt = dst_alloc(&dn_dst_ops, dev_out, 1, DST_OBSOLETE_NONE, DST_HOST); ++ rt = dst_alloc(&dn_dst_ops, dev_out, 0, DST_OBSOLETE_NONE, DST_HOST); + if (rt == NULL) + goto e_nobufs; + +diff --git a/net/decnet/netfilter/dn_rtmsg.c b/net/decnet/netfilter/dn_rtmsg.c +index 85f2fdc360c2..29246bc9a7b4 100644 +--- a/net/decnet/netfilter/dn_rtmsg.c ++++ b/net/decnet/netfilter/dn_rtmsg.c +@@ -102,7 +102,9 @@ static inline void dnrmg_receive_user_skb(struct sk_buff *skb) + { + struct nlmsghdr *nlh = nlmsg_hdr(skb); + +- if (nlh->nlmsg_len < sizeof(*nlh) || skb->len < nlh->nlmsg_len) ++ if (skb->len < sizeof(*nlh) || ++ nlh->nlmsg_len < sizeof(*nlh) || ++ skb->len < nlh->nlmsg_len) + return; + + if (!netlink_capable(skb, CAP_NET_ADMIN)) +diff --git a/net/dsa/slave.c b/net/dsa/slave.c +index 8dfe9fb7ad36..554c2a961ad5 100644 +--- a/net/dsa/slave.c ++++ b/net/dsa/slave.c +@@ -1006,10 +1006,8 @@ static int dsa_slave_phy_connect(struct dsa_slave_priv *p, + /* Use already configured phy mode */ + if (p->phy_interface == PHY_INTERFACE_MODE_NA) + p->phy_interface = p->phy->interface; +- phy_connect_direct(slave_dev, p->phy, dsa_slave_adjust_link, +- p->phy_interface); +- +- return 0; ++ return phy_connect_direct(slave_dev, p->phy, dsa_slave_adjust_link, ++ p->phy_interface); + } + + static int dsa_slave_phy_setup(struct dsa_slave_priv *p, +diff --git a/net/ipv4/igmp.c b/net/ipv4/igmp.c +index 17adfdaf5795..3809d523d012 100644 +--- a/net/ipv4/igmp.c ++++ b/net/ipv4/igmp.c +@@ -1102,6 +1102,7 @@ static void igmpv3_add_delrec(struct in_device *in_dev, struct ip_mc_list *im) + pmc = kzalloc(sizeof(*pmc), GFP_KERNEL); + if (!pmc) + return; ++ spin_lock_init(&pmc->lock); + spin_lock_bh(&im->lock); + pmc->interface = im->interface; + in_dev_hold(in_dev); +@@ -2026,21 +2027,26 @@ static int ip_mc_add_src(struct in_device *in_dev, __be32 *pmca, int sfmode, + + static void ip_mc_clear_src(struct ip_mc_list *pmc) + { +- struct ip_sf_list *psf, *nextpsf; ++ struct ip_sf_list *psf, *nextpsf, *tomb, *sources; + +- for (psf = pmc->tomb; psf; psf = nextpsf) { ++ spin_lock_bh(&pmc->lock); ++ tomb = pmc->tomb; ++ pmc->tomb = NULL; ++ sources = pmc->sources; ++ pmc->sources = NULL; ++ pmc->sfmode = MCAST_EXCLUDE; ++ pmc->sfcount[MCAST_INCLUDE] = 0; ++ pmc->sfcount[MCAST_EXCLUDE] = 1; ++ spin_unlock_bh(&pmc->lock); ++ ++ for (psf = tomb; psf; psf = nextpsf) { + nextpsf = psf->sf_next; + kfree(psf); + } +- pmc->tomb = NULL; +- for (psf = pmc->sources; psf; psf = nextpsf) { ++ for (psf = sources; psf; psf = nextpsf) { + nextpsf = psf->sf_next; + kfree(psf); + } +- pmc->sources = NULL; +- pmc->sfmode = MCAST_EXCLUDE; +- pmc->sfcount[MCAST_INCLUDE] = 0; +- pmc->sfcount[MCAST_EXCLUDE] = 1; + } + + /* Join a multicast group +diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c +index 8cf3fc7c2932..03dadbf6cc5e 100644 +--- a/net/ipv6/addrconf.c ++++ b/net/ipv6/addrconf.c +@@ -291,9 +291,9 @@ static void addrconf_mod_rs_timer(struct inet6_dev *idev, + static void addrconf_mod_dad_work(struct inet6_ifaddr *ifp, + unsigned long delay) + { +- if (!delayed_work_pending(&ifp->dad_work)) +- in6_ifa_hold(ifp); +- mod_delayed_work(addrconf_wq, &ifp->dad_work, delay); ++ in6_ifa_hold(ifp); ++ if (mod_delayed_work(addrconf_wq, &ifp->dad_work, delay)) ++ in6_ifa_put(ifp); + } + + static int snmp6_alloc_dev(struct inet6_dev *idev) +diff --git a/net/ipv6/fib6_rules.c b/net/ipv6/fib6_rules.c +index ed33abf57abd..9ac4f0cef27d 100644 +--- a/net/ipv6/fib6_rules.c ++++ b/net/ipv6/fib6_rules.c +@@ -32,7 +32,6 @@ struct fib6_rule { + struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi6 *fl6, + int flags, pol_lookup_t lookup) + { +- struct rt6_info *rt; + struct fib_lookup_arg arg = { + .lookup_ptr = lookup, + .flags = FIB_LOOKUP_NOREF, +@@ -41,21 +40,11 @@ struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi6 *fl6, + fib_rules_lookup(net->ipv6.fib6_rules_ops, + flowi6_to_flowi(fl6), flags, &arg); + +- rt = arg.result; ++ if (arg.result) ++ return arg.result; + +- if (!rt) { +- dst_hold(&net->ipv6.ip6_null_entry->dst); +- return &net->ipv6.ip6_null_entry->dst; +- } +- +- if (rt->rt6i_flags & RTF_REJECT && +- rt->dst.error == -EAGAIN) { +- ip6_rt_put(rt); +- rt = net->ipv6.ip6_null_entry; +- dst_hold(&rt->dst); +- } +- +- return &rt->dst; ++ dst_hold(&net->ipv6.ip6_null_entry->dst); ++ return &net->ipv6.ip6_null_entry->dst; + } + + static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp, +@@ -116,7 +105,8 @@ static int fib6_rule_action(struct fib_rule *rule, struct flowi *flp, + flp6->saddr = saddr; + } + err = rt->dst.error; +- goto out; ++ if (err != -EAGAIN) ++ goto out; + } + again: + ip6_rt_put(rt); +diff --git a/net/ipv6/ip6_fib.c b/net/ipv6/ip6_fib.c +index 85bf86458706..1ac06723f0d7 100644 +--- a/net/ipv6/ip6_fib.c ++++ b/net/ipv6/ip6_fib.c +@@ -290,8 +290,7 @@ struct dst_entry *fib6_rule_lookup(struct net *net, struct flowi6 *fl6, + struct rt6_info *rt; + + rt = lookup(net, net->ipv6.fib6_main_tbl, fl6, flags); +- if (rt->rt6i_flags & RTF_REJECT && +- rt->dst.error == -EAGAIN) { ++ if (rt->dst.error == -EAGAIN) { + ip6_rt_put(rt); + rt = net->ipv6.ip6_null_entry; + dst_hold(&rt->dst); +diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c +index 19c0d67ce8c4..7d339fc1057f 100644 +--- a/net/ipv6/ip6_output.c ++++ b/net/ipv6/ip6_output.c +@@ -1005,8 +1005,10 @@ static int ip6_dst_lookup_tail(struct net *net, const struct sock *sk, + } + #endif + if (ipv6_addr_v4mapped(&fl6->saddr) && +- !(ipv6_addr_v4mapped(&fl6->daddr) || ipv6_addr_any(&fl6->daddr))) +- return -EAFNOSUPPORT; ++ !(ipv6_addr_v4mapped(&fl6->daddr) || ipv6_addr_any(&fl6->daddr))) { ++ err = -EAFNOSUPPORT; ++ goto out_err_release; ++ } + + return 0; + +diff --git a/net/key/af_key.c b/net/key/af_key.c +index f9c9ecb0cdd3..e67c28e614b9 100644 +--- a/net/key/af_key.c ++++ b/net/key/af_key.c +@@ -1135,6 +1135,7 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net, + goto out; + } + ++ err = -ENOBUFS; + key = ext_hdrs[SADB_EXT_KEY_AUTH - 1]; + if (sa->sadb_sa_auth) { + int keysize = 0; +@@ -1146,8 +1147,10 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net, + if (key) + keysize = (key->sadb_key_bits + 7) / 8; + x->aalg = kmalloc(sizeof(*x->aalg) + keysize, GFP_KERNEL); +- if (!x->aalg) ++ if (!x->aalg) { ++ err = -ENOMEM; + goto out; ++ } + strcpy(x->aalg->alg_name, a->name); + x->aalg->alg_key_len = 0; + if (key) { +@@ -1166,8 +1169,10 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net, + goto out; + } + x->calg = kmalloc(sizeof(*x->calg), GFP_KERNEL); +- if (!x->calg) ++ if (!x->calg) { ++ err = -ENOMEM; + goto out; ++ } + strcpy(x->calg->alg_name, a->name); + x->props.calgo = sa->sadb_sa_encrypt; + } else { +@@ -1181,8 +1186,10 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net, + if (key) + keysize = (key->sadb_key_bits + 7) / 8; + x->ealg = kmalloc(sizeof(*x->ealg) + keysize, GFP_KERNEL); +- if (!x->ealg) ++ if (!x->ealg) { ++ err = -ENOMEM; + goto out; ++ } + strcpy(x->ealg->alg_name, a->name); + x->ealg->alg_key_len = 0; + if (key) { +@@ -1227,8 +1234,10 @@ static struct xfrm_state * pfkey_msg2xfrm_state(struct net *net, + struct xfrm_encap_tmpl *natt; + + x->encap = kmalloc(sizeof(*x->encap), GFP_KERNEL); +- if (!x->encap) ++ if (!x->encap) { ++ err = -ENOMEM; + goto out; ++ } + + natt = x->encap; + n_type = ext_hdrs[SADB_X_EXT_NAT_T_TYPE-1]; +diff --git a/net/mac80211/main.c b/net/mac80211/main.c +index 175ffcf7fb06..2ee53dc1ddf7 100644 +--- a/net/mac80211/main.c ++++ b/net/mac80211/main.c +@@ -891,12 +891,17 @@ int ieee80211_register_hw(struct ieee80211_hw *hw) + supp_ht = supp_ht || sband->ht_cap.ht_supported; + supp_vht = supp_vht || sband->vht_cap.vht_supported; + +- if (sband->ht_cap.ht_supported) +- local->rx_chains = +- max(ieee80211_mcs_to_chains(&sband->ht_cap.mcs), +- local->rx_chains); ++ if (!sband->ht_cap.ht_supported) ++ continue; + + /* TODO: consider VHT for RX chains, hopefully it's the same */ ++ local->rx_chains = ++ max(ieee80211_mcs_to_chains(&sband->ht_cap.mcs), ++ local->rx_chains); ++ ++ /* no need to mask, SM_PS_DISABLED has all bits set */ ++ sband->ht_cap.cap |= WLAN_HT_CAP_SM_PS_DISABLED << ++ IEEE80211_HT_CAP_SM_PS_SHIFT; + } + + /* if low-level driver supports AP, we also support VLAN */ +diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c +index 9f5272968abb..e565b2becb14 100644 +--- a/net/netfilter/nf_conntrack_netlink.c ++++ b/net/netfilter/nf_conntrack_netlink.c +@@ -45,6 +45,8 @@ + #include <net/netfilter/nf_conntrack_zones.h> + #include <net/netfilter/nf_conntrack_timestamp.h> + #include <net/netfilter/nf_conntrack_labels.h> ++#include <net/netfilter/nf_conntrack_seqadj.h> ++#include <net/netfilter/nf_conntrack_synproxy.h> + #ifdef CONFIG_NF_NAT_NEEDED + #include <net/netfilter/nf_nat_core.h> + #include <net/netfilter/nf_nat_l4proto.h> +@@ -1798,6 +1800,8 @@ ctnetlink_create_conntrack(struct net *net, + nf_ct_tstamp_ext_add(ct, GFP_ATOMIC); + nf_ct_ecache_ext_add(ct, 0, 0, GFP_ATOMIC); + nf_ct_labels_ext_add(ct); ++ nfct_seqadj_ext_add(ct); ++ nfct_synproxy_ext_add(ct); + + /* we must add conntrack extensions before confirmation. */ + ct->status |= IPS_CONFIRMED; +diff --git a/net/netfilter/xt_TCPMSS.c b/net/netfilter/xt_TCPMSS.c +index b7c43def0dc6..00f798b20b20 100644 +--- a/net/netfilter/xt_TCPMSS.c ++++ b/net/netfilter/xt_TCPMSS.c +@@ -104,7 +104,7 @@ tcpmss_mangle_packet(struct sk_buff *skb, + tcph = (struct tcphdr *)(skb_network_header(skb) + tcphoff); + tcp_hdrlen = tcph->doff * 4; + +- if (len < tcp_hdrlen) ++ if (len < tcp_hdrlen || tcp_hdrlen < sizeof(struct tcphdr)) + return -1; + + if (info->mss == XT_TCPMSS_CLAMP_PMTU) { +@@ -156,6 +156,10 @@ tcpmss_mangle_packet(struct sk_buff *skb, + if (len > tcp_hdrlen) + return 0; + ++ /* tcph->doff has 4 bits, do not wrap it to 0 */ ++ if (tcp_hdrlen >= 15 * 4) ++ return 0; ++ + /* + * MSS Option not found ?! add it.. + */ +diff --git a/net/sctp/socket.c b/net/sctp/socket.c +index 956141b71619..3ebf3b652d60 100644 +--- a/net/sctp/socket.c ++++ b/net/sctp/socket.c +@@ -239,7 +239,7 @@ static struct sctp_transport *sctp_addr_id2transport(struct sock *sk, + union sctp_addr *laddr = (union sctp_addr *)addr; + struct sctp_transport *transport; + +- if (sctp_verify_addr(sk, laddr, af->sockaddr_len)) ++ if (!af || sctp_verify_addr(sk, laddr, af->sockaddr_len)) + return NULL; + + addr_asoc = sctp_endpoint_lookup_assoc(sctp_sk(sk)->ep, +diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c +index b2e934ff2448..e05ec54ac53f 100644 +--- a/net/unix/af_unix.c ++++ b/net/unix/af_unix.c +@@ -997,7 +997,8 @@ static int unix_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len) + struct path path = { NULL, NULL }; + + err = -EINVAL; +- if (sunaddr->sun_family != AF_UNIX) ++ if (addr_len < offsetofend(struct sockaddr_un, sun_family) || ++ sunaddr->sun_family != AF_UNIX) + goto out; + + if (addr_len == sizeof(short)) { +@@ -1108,6 +1109,10 @@ static int unix_dgram_connect(struct socket *sock, struct sockaddr *addr, + unsigned int hash; + int err; + ++ err = -EINVAL; ++ if (alen < offsetofend(struct sockaddr, sa_family)) ++ goto out; ++ + if (addr->sa_family != AF_UNSPEC) { + err = unix_mkname(sunaddr, alen, &hash); + if (err < 0) +diff --git a/net/xfrm/xfrm_policy.c b/net/xfrm/xfrm_policy.c +index 36a50ef9295d..8a0fdd870395 100644 +--- a/net/xfrm/xfrm_policy.c ++++ b/net/xfrm/xfrm_policy.c +@@ -1776,43 +1776,6 @@ free_dst: + goto out; + } + +-#ifdef CONFIG_XFRM_SUB_POLICY +-static int xfrm_dst_alloc_copy(void **target, const void *src, int size) +-{ +- if (!*target) { +- *target = kmalloc(size, GFP_ATOMIC); +- if (!*target) +- return -ENOMEM; +- } +- +- memcpy(*target, src, size); +- return 0; +-} +-#endif +- +-static int xfrm_dst_update_parent(struct dst_entry *dst, +- const struct xfrm_selector *sel) +-{ +-#ifdef CONFIG_XFRM_SUB_POLICY +- struct xfrm_dst *xdst = (struct xfrm_dst *)dst; +- return xfrm_dst_alloc_copy((void **)&(xdst->partner), +- sel, sizeof(*sel)); +-#else +- return 0; +-#endif +-} +- +-static int xfrm_dst_update_origin(struct dst_entry *dst, +- const struct flowi *fl) +-{ +-#ifdef CONFIG_XFRM_SUB_POLICY +- struct xfrm_dst *xdst = (struct xfrm_dst *)dst; +- return xfrm_dst_alloc_copy((void **)&(xdst->origin), fl, sizeof(*fl)); +-#else +- return 0; +-#endif +-} +- + static int xfrm_expand_policies(const struct flowi *fl, u16 family, + struct xfrm_policy **pols, + int *num_pols, int *num_xfrms) +@@ -1884,16 +1847,6 @@ xfrm_resolve_and_create_bundle(struct xfrm_policy **pols, int num_pols, + + xdst = (struct xfrm_dst *)dst; + xdst->num_xfrms = err; +- if (num_pols > 1) +- err = xfrm_dst_update_parent(dst, &pols[1]->selector); +- else +- err = xfrm_dst_update_origin(dst, fl); +- if (unlikely(err)) { +- dst_free(dst); +- XFRM_INC_STATS(net, LINUX_MIB_XFRMOUTBUNDLECHECKERROR); +- return ERR_PTR(err); +- } +- + xdst->num_pols = num_pols; + memcpy(xdst->pols, pols, sizeof(struct xfrm_policy *) * num_pols); + xdst->policy_genid = atomic_read(&pols[0]->genid); +diff --git a/sound/pci/hda/hda_codec.h b/sound/pci/hda/hda_codec.h +index 373fcad840ea..776dffa88aee 100644 +--- a/sound/pci/hda/hda_codec.h ++++ b/sound/pci/hda/hda_codec.h +@@ -294,6 +294,8 @@ struct hda_codec { + + #define list_for_each_codec(c, bus) \ + list_for_each_entry(c, &(bus)->core.codec_list, core.list) ++#define list_for_each_codec_safe(c, n, bus) \ ++ list_for_each_entry_safe(c, n, &(bus)->core.codec_list, core.list) + + /* snd_hda_codec_read/write optional flags */ + #define HDA_RW_NO_RESPONSE_FALLBACK (1 << 0) +diff --git a/sound/pci/hda/hda_controller.c b/sound/pci/hda/hda_controller.c +index 5baf8b56b6e7..9c6e10fb479f 100644 +--- a/sound/pci/hda/hda_controller.c ++++ b/sound/pci/hda/hda_controller.c +@@ -1128,8 +1128,12 @@ EXPORT_SYMBOL_GPL(azx_probe_codecs); + /* configure each codec instance */ + int azx_codec_configure(struct azx *chip) + { +- struct hda_codec *codec; +- list_for_each_codec(codec, &chip->bus) { ++ struct hda_codec *codec, *next; ++ ++ /* use _safe version here since snd_hda_codec_configure() deregisters ++ * the device upon error and deletes itself from the bus list. ++ */ ++ list_for_each_codec_safe(codec, next, &chip->bus) { + snd_hda_codec_configure(codec); + } + return 0; +diff --git a/sound/pci/hda/hda_generic.c b/sound/pci/hda/hda_generic.c +index dc2fa576d60d..689df78f640a 100644 +--- a/sound/pci/hda/hda_generic.c ++++ b/sound/pci/hda/hda_generic.c +@@ -3190,6 +3190,7 @@ static int check_dyn_adc_switch(struct hda_codec *codec) + spec->input_paths[i][nums]); + spec->input_paths[i][nums] = + spec->input_paths[i][n]; ++ spec->input_paths[i][n] = 0; + } + } + nums++; +diff --git a/tools/perf/util/probe-finder.c b/tools/perf/util/probe-finder.c +index 05012bb178d7..fdd87c7e3e91 100644 +--- a/tools/perf/util/probe-finder.c ++++ b/tools/perf/util/probe-finder.c +@@ -1460,16 +1460,12 @@ int debuginfo__find_probe_point(struct debuginfo *dbg, unsigned long addr, + Dwarf_Addr _addr = 0, baseaddr = 0; + const char *fname = NULL, *func = NULL, *basefunc = NULL, *tmp; + int baseline = 0, lineno = 0, ret = 0; +- bool reloc = false; + +-retry: ++ /* We always need to relocate the address for aranges */ ++ if (debuginfo__get_text_offset(dbg, &baseaddr) == 0) ++ addr += baseaddr; + /* Find cu die */ + if (!dwarf_addrdie(dbg->dbg, (Dwarf_Addr)addr, &cudie)) { +- if (!reloc && debuginfo__get_text_offset(dbg, &baseaddr) == 0) { +- addr += baseaddr; +- reloc = true; +- goto retry; +- } + pr_warning("Failed to find debug information for address %lx\n", + addr); + ret = -EINVAL; |