Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx-legacy/patches-4.9/0389-4.9.290-all-fixes.patch

    Annotation of /trunk/kernel-alx-legacy/patches-4.9/0389-4.9.290-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3691 - (hide annotations) (download)
    Mon Oct 24 14:08:05 2022 UTC (18 months, 3 weeks ago) by niro
    File size: 30936 byte(s) 
    -linux-4.9.290
    1 niro 3691 diff --git a/Makefile b/Makefile
    2     index 76e6507e4145f..9f1647076926d 100644
    3     --- a/Makefile
    4     +++ b/Makefile
    5     @@ -1,6 +1,6 @@
    6     VERSION = 4
    7     PATCHLEVEL = 9
    8     -SUBLEVEL = 289
    9     +SUBLEVEL = 290
    10     EXTRAVERSION =
    11     NAME = Roaring Lionus
    12    
    13     diff --git a/arch/arc/include/asm/pgtable.h b/arch/arc/include/asm/pgtable.h
    14     index c10f5cb203e61..81198a6773c60 100644
    15     --- a/arch/arc/include/asm/pgtable.h
    16     +++ b/arch/arc/include/asm/pgtable.h
    17     @@ -137,8 +137,10 @@
    18    
    19     #ifdef CONFIG_ARC_HAS_PAE40
    20     #define PTE_BITS_NON_RWX_IN_PD1 (0xff00000000 | PAGE_MASK | _PAGE_CACHEABLE)
    21     +#define MAX_POSSIBLE_PHYSMEM_BITS 40
    22     #else
    23     #define PTE_BITS_NON_RWX_IN_PD1 (PAGE_MASK | _PAGE_CACHEABLE)
    24     +#define MAX_POSSIBLE_PHYSMEM_BITS 32
    25     #endif
    26    
    27     /**************************************************************************
    28     diff --git a/arch/arm/include/asm/pgtable-2level.h b/arch/arm/include/asm/pgtable-2level.h
    29     index 92fd2c8a9af06..6154902bed83d 100644
    30     --- a/arch/arm/include/asm/pgtable-2level.h
    31     +++ b/arch/arm/include/asm/pgtable-2level.h
    32     @@ -78,6 +78,8 @@
    33     #define PTE_HWTABLE_OFF (PTE_HWTABLE_PTRS * sizeof(pte_t))
    34     #define PTE_HWTABLE_SIZE (PTRS_PER_PTE * sizeof(u32))
    35    
    36     +#define MAX_POSSIBLE_PHYSMEM_BITS 32
    37     +
    38     /*
    39     * PMD_SHIFT determines the size of the area a second-level page table can map
    40     * PGDIR_SHIFT determines what a third-level page table entry can map
    41     diff --git a/arch/arm/include/asm/pgtable-3level.h b/arch/arm/include/asm/pgtable-3level.h
    42     index 2a029bceaf2f8..35807e611b6e0 100644
    43     --- a/arch/arm/include/asm/pgtable-3level.h
    44     +++ b/arch/arm/include/asm/pgtable-3level.h
    45     @@ -37,6 +37,8 @@
    46     #define PTE_HWTABLE_OFF (0)
    47     #define PTE_HWTABLE_SIZE (PTRS_PER_PTE * sizeof(u64))
    48    
    49     +#define MAX_POSSIBLE_PHYSMEM_BITS 40
    50     +
    51     /*
    52     * PGDIR_SHIFT determines the size a top-level page table entry can map.
    53     */
    54     diff --git a/arch/mips/include/asm/pgtable-32.h b/arch/mips/include/asm/pgtable-32.h
    55     index c0be540e83cb3..2c6df5a92e1e4 100644
    56     --- a/arch/mips/include/asm/pgtable-32.h
    57     +++ b/arch/mips/include/asm/pgtable-32.h
    58     @@ -110,6 +110,7 @@ static inline void pmd_clear(pmd_t *pmdp)
    59    
    60     #if defined(CONFIG_XPA)
    61    
    62     +#define MAX_POSSIBLE_PHYSMEM_BITS 40
    63     #define pte_pfn(x) (((unsigned long)((x).pte_high >> _PFN_SHIFT)) | (unsigned long)((x).pte_low << _PAGE_PRESENT_SHIFT))
    64     static inline pte_t
    65     pfn_pte(unsigned long pfn, pgprot_t prot)
    66     @@ -125,6 +126,7 @@ pfn_pte(unsigned long pfn, pgprot_t prot)
    67    
    68     #elif defined(CONFIG_PHYS_ADDR_T_64BIT) && defined(CONFIG_CPU_MIPS32)
    69    
    70     +#define MAX_POSSIBLE_PHYSMEM_BITS 36
    71     #define pte_pfn(x) ((unsigned long)((x).pte_high >> 6))
    72    
    73     static inline pte_t pfn_pte(unsigned long pfn, pgprot_t prot)
    74     @@ -139,6 +141,7 @@ static inline pte_t pfn_pte(unsigned long pfn, pgprot_t prot)
    75    
    76     #else
    77    
    78     +#define MAX_POSSIBLE_PHYSMEM_BITS 32
    79     #ifdef CONFIG_CPU_VR41XX
    80     #define pte_pfn(x) ((unsigned long)((x).pte >> (PAGE_SHIFT + 2)))
    81     #define pfn_pte(pfn, prot) __pte(((pfn) << (PAGE_SHIFT + 2)) | pgprot_val(prot))
    82     diff --git a/arch/powerpc/include/asm/pte-common.h b/arch/powerpc/include/asm/pte-common.h
    83     index 4ba26dd259fd8..0d81cd9dd60e9 100644
    84     --- a/arch/powerpc/include/asm/pte-common.h
    85     +++ b/arch/powerpc/include/asm/pte-common.h
    86     @@ -101,8 +101,10 @@ static inline bool pte_user(pte_t pte)
    87     */
    88     #if defined(CONFIG_PPC32) && defined(CONFIG_PTE_64BIT)
    89     #define PTE_RPN_MASK (~((1ULL<<PTE_RPN_SHIFT)-1))
    90     +#define MAX_POSSIBLE_PHYSMEM_BITS 36
    91     #else
    92     #define PTE_RPN_MASK (~((1UL<<PTE_RPN_SHIFT)-1))
    93     +#define MAX_POSSIBLE_PHYSMEM_BITS 32
    94     #endif
    95    
    96     /* _PAGE_CHG_MASK masks of bits that are to be preserved across
    97     diff --git a/arch/x86/include/asm/pgtable-3level_types.h b/arch/x86/include/asm/pgtable-3level_types.h
    98     index bcc89625ebe53..f3f719d59e61b 100644
    99     --- a/arch/x86/include/asm/pgtable-3level_types.h
    100     +++ b/arch/x86/include/asm/pgtable-3level_types.h
    101     @@ -42,5 +42,6 @@ typedef union {
    102     */
    103     #define PTRS_PER_PTE 512
    104    
    105     +#define MAX_POSSIBLE_PHYSMEM_BITS 36
    106    
    107     #endif /* _ASM_X86_PGTABLE_3LEVEL_DEFS_H */
    108     diff --git a/arch/x86/kvm/ioapic.c b/arch/x86/kvm/ioapic.c
    109     index a069d0dd3ded4..aa34b16e62c24 100644
    110     --- a/arch/x86/kvm/ioapic.c
    111     +++ b/arch/x86/kvm/ioapic.c
    112     @@ -96,7 +96,7 @@ static unsigned long ioapic_read_indirect(struct kvm_ioapic *ioapic,
    113     static void rtc_irq_eoi_tracking_reset(struct kvm_ioapic *ioapic)
    114     {
    115     ioapic->rtc_status.pending_eoi = 0;
    116     - bitmap_zero(ioapic->rtc_status.dest_map.map, KVM_MAX_VCPU_ID + 1);
    117     + bitmap_zero(ioapic->rtc_status.dest_map.map, KVM_MAX_VCPU_ID);
    118     }
    119    
    120     static void kvm_rtc_eoi_tracking_restore_all(struct kvm_ioapic *ioapic);
    121     diff --git a/arch/x86/kvm/ioapic.h b/arch/x86/kvm/ioapic.h
    122     index 2f3df43489f22..1cc6e54436dba 100644
    123     --- a/arch/x86/kvm/ioapic.h
    124     +++ b/arch/x86/kvm/ioapic.h
    125     @@ -42,13 +42,13 @@ struct kvm_vcpu;
    126    
    127     struct dest_map {
    128     /* vcpu bitmap where IRQ has been sent */
    129     - DECLARE_BITMAP(map, KVM_MAX_VCPU_ID + 1);
    130     + DECLARE_BITMAP(map, KVM_MAX_VCPU_ID);
    131    
    132     /*
    133     * Vector sent to a given vcpu, only valid when
    134     * the vcpu's bit in map is set
    135     */
    136     - u8 vectors[KVM_MAX_VCPU_ID + 1];
    137     + u8 vectors[KVM_MAX_VCPU_ID];
    138     };
    139    
    140    
    141     diff --git a/drivers/amba/bus.c b/drivers/amba/bus.c
    142     index 5bc8d588d1460..22bf8133fd2af 100644
    143     --- a/drivers/amba/bus.c
    144     +++ b/drivers/amba/bus.c
    145     @@ -356,9 +356,6 @@ static int amba_device_try_add(struct amba_device *dev, struct resource *parent)
    146     void __iomem *tmp;
    147     int i, ret;
    148    
    149     - WARN_ON(dev->irq[0] == (unsigned int)-1);
    150     - WARN_ON(dev->irq[1] == (unsigned int)-1);
    151     -
    152     ret = request_resource(parent, &dev->res);
    153     if (ret)
    154     goto err_out;
    155     diff --git a/drivers/infiniband/hw/qib/qib_user_sdma.c b/drivers/infiniband/hw/qib/qib_user_sdma.c
    156     index 3e0677c512768..0dc15f95e7626 100644
    157     --- a/drivers/infiniband/hw/qib/qib_user_sdma.c
    158     +++ b/drivers/infiniband/hw/qib/qib_user_sdma.c
    159     @@ -41,6 +41,7 @@
    160     #include <linux/rbtree.h>
    161     #include <linux/spinlock.h>
    162     #include <linux/delay.h>
    163     +#include <linux/overflow.h>
    164    
    165     #include "qib.h"
    166     #include "qib_user_sdma.h"
    167     @@ -606,7 +607,7 @@ done:
    168     /*
    169     * How many pages in this iovec element?
    170     */
    171     -static int qib_user_sdma_num_pages(const struct iovec *iov)
    172     +static size_t qib_user_sdma_num_pages(const struct iovec *iov)
    173     {
    174     const unsigned long addr = (unsigned long) iov->iov_base;
    175     const unsigned long len = iov->iov_len;
    176     @@ -662,7 +663,7 @@ static void qib_user_sdma_free_pkt_frag(struct device *dev,
    177     static int qib_user_sdma_pin_pages(const struct qib_devdata *dd,
    178     struct qib_user_sdma_queue *pq,
    179     struct qib_user_sdma_pkt *pkt,
    180     - unsigned long addr, int tlen, int npages)
    181     + unsigned long addr, int tlen, size_t npages)
    182     {
    183     struct page *pages[8];
    184     int i, j;
    185     @@ -726,7 +727,7 @@ static int qib_user_sdma_pin_pkt(const struct qib_devdata *dd,
    186     unsigned long idx;
    187    
    188     for (idx = 0; idx < niov; idx++) {
    189     - const int npages = qib_user_sdma_num_pages(iov + idx);
    190     + const size_t npages = qib_user_sdma_num_pages(iov + idx);
    191     const unsigned long addr = (unsigned long) iov[idx].iov_base;
    192    
    193     ret = qib_user_sdma_pin_pages(dd, pq, pkt, addr,
    194     @@ -828,8 +829,8 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd,
    195     unsigned pktnw;
    196     unsigned pktnwc;
    197     int nfrags = 0;
    198     - int npages = 0;
    199     - int bytes_togo = 0;
    200     + size_t npages = 0;
    201     + size_t bytes_togo = 0;
    202     int tiddma = 0;
    203     int cfur;
    204    
    205     @@ -889,7 +890,11 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd,
    206    
    207     npages += qib_user_sdma_num_pages(&iov[idx]);
    208    
    209     - bytes_togo += slen;
    210     + if (check_add_overflow(bytes_togo, slen, &bytes_togo) ||
    211     + bytes_togo > type_max(typeof(pkt->bytes_togo))) {
    212     + ret = -EINVAL;
    213     + goto free_pbc;
    214     + }
    215     pktnwc += slen >> 2;
    216     idx++;
    217     nfrags++;
    218     @@ -908,10 +913,10 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd,
    219     }
    220    
    221     if (frag_size) {
    222     - int pktsize, tidsmsize, n;
    223     + size_t tidsmsize, n, pktsize, sz, addrlimit;
    224    
    225     n = npages*((2*PAGE_SIZE/frag_size)+1);
    226     - pktsize = sizeof(*pkt) + sizeof(pkt->addr[0])*n;
    227     + pktsize = struct_size(pkt, addr, n);
    228    
    229     /*
    230     * Determine if this is tid-sdma or just sdma.
    231     @@ -926,14 +931,24 @@ static int qib_user_sdma_queue_pkts(const struct qib_devdata *dd,
    232     else
    233     tidsmsize = 0;
    234    
    235     - pkt = kmalloc(pktsize+tidsmsize, GFP_KERNEL);
    236     + if (check_add_overflow(pktsize, tidsmsize, &sz)) {
    237     + ret = -EINVAL;
    238     + goto free_pbc;
    239     + }
    240     + pkt = kmalloc(sz, GFP_KERNEL);
    241     if (!pkt) {
    242     ret = -ENOMEM;
    243     goto free_pbc;
    244     }
    245     pkt->largepkt = 1;
    246     pkt->frag_size = frag_size;
    247     - pkt->addrlimit = n + ARRAY_SIZE(pkt->addr);
    248     + if (check_add_overflow(n, ARRAY_SIZE(pkt->addr),
    249     + &addrlimit) ||
    250     + addrlimit > type_max(typeof(pkt->addrlimit))) {
    251     + ret = -EINVAL;
    252     + goto free_pbc;
    253     + }
    254     + pkt->addrlimit = addrlimit;
    255    
    256     if (tiddma) {
    257     char *tidsm = (char *)pkt + pktsize;
    258     diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
    259     index bde19425e9c10..a3a3d4b40a7cc 100644
    260     --- a/drivers/net/usb/hso.c
    261     +++ b/drivers/net/usb/hso.c
    262     @@ -2512,7 +2512,7 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface,
    263     hso_net_init);
    264     if (!net) {
    265     dev_err(&interface->dev, "Unable to create ethernet device\n");
    266     - goto exit;
    267     + goto err_hso_dev;
    268     }
    269    
    270     hso_net = netdev_priv(net);
    271     @@ -2525,50 +2525,63 @@ static struct hso_device *hso_create_net_device(struct usb_interface *interface,
    272     USB_DIR_IN);
    273     if (!hso_net->in_endp) {
    274     dev_err(&interface->dev, "Can't find BULK IN endpoint\n");
    275     - goto exit;
    276     + goto err_net;
    277     }
    278     hso_net->out_endp = hso_get_ep(interface, USB_ENDPOINT_XFER_BULK,
    279     USB_DIR_OUT);
    280     if (!hso_net->out_endp) {
    281     dev_err(&interface->dev, "Can't find BULK OUT endpoint\n");
    282     - goto exit;
    283     + goto err_net;
    284     }
    285     SET_NETDEV_DEV(net, &interface->dev);
    286     SET_NETDEV_DEVTYPE(net, &hso_type);
    287    
    288     - /* registering our net device */
    289     - result = register_netdev(net);
    290     - if (result) {
    291     - dev_err(&interface->dev, "Failed to register device\n");
    292     - goto exit;
    293     - }
    294     -
    295     /* start allocating */
    296     for (i = 0; i < MUX_BULK_RX_BUF_COUNT; i++) {
    297     hso_net->mux_bulk_rx_urb_pool[i] = usb_alloc_urb(0, GFP_KERNEL);
    298     if (!hso_net->mux_bulk_rx_urb_pool[i])
    299     - goto exit;
    300     + goto err_mux_bulk_rx;
    301     hso_net->mux_bulk_rx_buf_pool[i] = kzalloc(MUX_BULK_RX_BUF_SIZE,
    302     GFP_KERNEL);
    303     if (!hso_net->mux_bulk_rx_buf_pool[i])
    304     - goto exit;
    305     + goto err_mux_bulk_rx;
    306     }
    307     hso_net->mux_bulk_tx_urb = usb_alloc_urb(0, GFP_KERNEL);
    308     if (!hso_net->mux_bulk_tx_urb)
    309     - goto exit;
    310     + goto err_mux_bulk_rx;
    311     hso_net->mux_bulk_tx_buf = kzalloc(MUX_BULK_TX_BUF_SIZE, GFP_KERNEL);
    312     if (!hso_net->mux_bulk_tx_buf)
    313     - goto exit;
    314     + goto err_free_tx_urb;
    315    
    316     add_net_device(hso_dev);
    317    
    318     + /* registering our net device */
    319     + result = register_netdev(net);
    320     + if (result) {
    321     + dev_err(&interface->dev, "Failed to register device\n");
    322     + goto err_free_tx_buf;
    323     + }
    324     +
    325     hso_log_port(hso_dev);
    326    
    327     hso_create_rfkill(hso_dev, interface);
    328    
    329     return hso_dev;
    330     -exit:
    331     - hso_free_net_device(hso_dev);
    332     +
    333     +err_free_tx_buf:
    334     + remove_net_device(hso_dev);
    335     + kfree(hso_net->mux_bulk_tx_buf);
    336     +err_free_tx_urb:
    337     + usb_free_urb(hso_net->mux_bulk_tx_urb);
    338     +err_mux_bulk_rx:
    339     + for (i = 0; i < MUX_BULK_RX_BUF_COUNT; i++) {
    340     + usb_free_urb(hso_net->mux_bulk_rx_urb_pool[i]);
    341     + kfree(hso_net->mux_bulk_rx_buf_pool[i]);
    342     + }
    343     +err_net:
    344     + free_netdev(net);
    345     +err_hso_dev:
    346     + kfree(hso_dev);
    347     return NULL;
    348     }
    349    
    350     diff --git a/drivers/net/wireless/rsi/rsi_91x_usb.c b/drivers/net/wireless/rsi/rsi_91x_usb.c
    351     index 974387ad1e8c5..83cbaac877ea3 100644
    352     --- a/drivers/net/wireless/rsi/rsi_91x_usb.c
    353     +++ b/drivers/net/wireless/rsi/rsi_91x_usb.c
    354     @@ -42,7 +42,7 @@ static int rsi_usb_card_write(struct rsi_hw *adapter,
    355     buf,
    356     len,
    357     &transfer,
    358     - HZ * 5);
    359     + USB_CTRL_SET_TIMEOUT);
    360    
    361     if (status < 0) {
    362     rsi_dbg(ERR_ZONE,
    363     diff --git a/drivers/scsi/scsi.c b/drivers/scsi/scsi.c
    364     index 1deb6adc411f7..4c9c1a8db8c30 100644
    365     --- a/drivers/scsi/scsi.c
    366     +++ b/drivers/scsi/scsi.c
    367     @@ -951,8 +951,10 @@ EXPORT_SYMBOL(scsi_device_get);
    368     */
    369     void scsi_device_put(struct scsi_device *sdev)
    370     {
    371     - module_put(sdev->host->hostt->module);
    372     + struct module *mod = sdev->host->hostt->module;
    373     +
    374     put_device(&sdev->sdev_gendev);
    375     + module_put(mod);
    376     }
    377     EXPORT_SYMBOL(scsi_device_put);
    378    
    379     diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
    380     index 38830818bfb6f..eae43a85e9b0e 100644
    381     --- a/drivers/scsi/scsi_sysfs.c
    382     +++ b/drivers/scsi/scsi_sysfs.c
    383     @@ -427,9 +427,12 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
    384     struct device *parent;
    385     struct list_head *this, *tmp;
    386     unsigned long flags;
    387     + struct module *mod;
    388    
    389     sdev = container_of(work, struct scsi_device, ew.work);
    390    
    391     + mod = sdev->host->hostt->module;
    392     +
    393     scsi_dh_release_device(sdev);
    394    
    395     parent = sdev->sdev_gendev.parent;
    396     @@ -461,11 +464,17 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
    397    
    398     if (parent)
    399     put_device(parent);
    400     + module_put(mod);
    401     }
    402    
    403     static void scsi_device_dev_release(struct device *dev)
    404     {
    405     struct scsi_device *sdp = to_scsi_device(dev);
    406     +
    407     + /* Set module pointer as NULL in case of module unloading */
    408     + if (!try_module_get(sdp->host->hostt->module))
    409     + sdp->host->hostt->module = NULL;
    410     +
    411     execute_in_process_context(scsi_device_dev_release_usercontext,
    412     &sdp->ew);
    413     }
    414     diff --git a/drivers/staging/comedi/drivers/dt9812.c b/drivers/staging/comedi/drivers/dt9812.c
    415     index 7ebca862ecaa3..e758eb3d2d19f 100644
    416     --- a/drivers/staging/comedi/drivers/dt9812.c
    417     +++ b/drivers/staging/comedi/drivers/dt9812.c
    418     @@ -41,6 +41,7 @@
    419     #include <linux/kernel.h>
    420     #include <linux/module.h>
    421     #include <linux/errno.h>
    422     +#include <linux/slab.h>
    423     #include <linux/uaccess.h>
    424    
    425     #include "../comedi_usb.h"
    426     @@ -246,22 +247,42 @@ static int dt9812_read_info(struct comedi_device *dev,
    427     {
    428     struct usb_device *usb = comedi_to_usb_dev(dev);
    429     struct dt9812_private *devpriv = dev->private;
    430     - struct dt9812_usb_cmd cmd;
    431     + struct dt9812_usb_cmd *cmd;
    432     + size_t tbuf_size;
    433     int count, ret;
    434     + void *tbuf;
    435    
    436     - cmd.cmd = cpu_to_le32(DT9812_R_FLASH_DATA);
    437     - cmd.u.flash_data_info.address =
    438     + tbuf_size = max(sizeof(*cmd), buf_size);
    439     +
    440     + tbuf = kzalloc(tbuf_size, GFP_KERNEL);
    441     + if (!tbuf)
    442     + return -ENOMEM;
    443     +
    444     + cmd = tbuf;
    445     +
    446     + cmd->cmd = cpu_to_le32(DT9812_R_FLASH_DATA);
    447     + cmd->u.flash_data_info.address =
    448     cpu_to_le16(DT9812_DIAGS_BOARD_INFO_ADDR + offset);
    449     - cmd.u.flash_data_info.numbytes = cpu_to_le16(buf_size);
    450     + cmd->u.flash_data_info.numbytes = cpu_to_le16(buf_size);
    451    
    452     /* DT9812 only responds to 32 byte writes!! */
    453     ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
    454     - &cmd, 32, &count, DT9812_USB_TIMEOUT);
    455     + cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT);
    456     if (ret)
    457     - return ret;
    458     + goto out;
    459     +
    460     + ret = usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr),
    461     + tbuf, buf_size, &count, DT9812_USB_TIMEOUT);
    462     + if (!ret) {
    463     + if (count == buf_size)
    464     + memcpy(buf, tbuf, buf_size);
    465     + else
    466     + ret = -EREMOTEIO;
    467     + }
    468     +out:
    469     + kfree(tbuf);
    470    
    471     - return usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr),
    472     - buf, buf_size, &count, DT9812_USB_TIMEOUT);
    473     + return ret;
    474     }
    475    
    476     static int dt9812_read_multiple_registers(struct comedi_device *dev,
    477     @@ -270,22 +291,42 @@ static int dt9812_read_multiple_registers(struct comedi_device *dev,
    478     {
    479     struct usb_device *usb = comedi_to_usb_dev(dev);
    480     struct dt9812_private *devpriv = dev->private;
    481     - struct dt9812_usb_cmd cmd;
    482     + struct dt9812_usb_cmd *cmd;
    483     int i, count, ret;
    484     + size_t buf_size;
    485     + void *buf;
    486    
    487     - cmd.cmd = cpu_to_le32(DT9812_R_MULTI_BYTE_REG);
    488     - cmd.u.read_multi_info.count = reg_count;
    489     + buf_size = max_t(size_t, sizeof(*cmd), reg_count);
    490     +
    491     + buf = kzalloc(buf_size, GFP_KERNEL);
    492     + if (!buf)
    493     + return -ENOMEM;
    494     +
    495     + cmd = buf;
    496     +
    497     + cmd->cmd = cpu_to_le32(DT9812_R_MULTI_BYTE_REG);
    498     + cmd->u.read_multi_info.count = reg_count;
    499     for (i = 0; i < reg_count; i++)
    500     - cmd.u.read_multi_info.address[i] = address[i];
    501     + cmd->u.read_multi_info.address[i] = address[i];
    502    
    503     /* DT9812 only responds to 32 byte writes!! */
    504     ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
    505     - &cmd, 32, &count, DT9812_USB_TIMEOUT);
    506     + cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT);
    507     if (ret)
    508     - return ret;
    509     + goto out;
    510     +
    511     + ret = usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr),
    512     + buf, reg_count, &count, DT9812_USB_TIMEOUT);
    513     + if (!ret) {
    514     + if (count == reg_count)
    515     + memcpy(value, buf, reg_count);
    516     + else
    517     + ret = -EREMOTEIO;
    518     + }
    519     +out:
    520     + kfree(buf);
    521    
    522     - return usb_bulk_msg(usb, usb_rcvbulkpipe(usb, devpriv->cmd_rd.addr),
    523     - value, reg_count, &count, DT9812_USB_TIMEOUT);
    524     + return ret;
    525     }
    526    
    527     static int dt9812_write_multiple_registers(struct comedi_device *dev,
    528     @@ -294,19 +335,27 @@ static int dt9812_write_multiple_registers(struct comedi_device *dev,
    529     {
    530     struct usb_device *usb = comedi_to_usb_dev(dev);
    531     struct dt9812_private *devpriv = dev->private;
    532     - struct dt9812_usb_cmd cmd;
    533     + struct dt9812_usb_cmd *cmd;
    534     int i, count;
    535     + int ret;
    536     +
    537     + cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
    538     + if (!cmd)
    539     + return -ENOMEM;
    540    
    541     - cmd.cmd = cpu_to_le32(DT9812_W_MULTI_BYTE_REG);
    542     - cmd.u.read_multi_info.count = reg_count;
    543     + cmd->cmd = cpu_to_le32(DT9812_W_MULTI_BYTE_REG);
    544     + cmd->u.read_multi_info.count = reg_count;
    545     for (i = 0; i < reg_count; i++) {
    546     - cmd.u.write_multi_info.write[i].address = address[i];
    547     - cmd.u.write_multi_info.write[i].value = value[i];
    548     + cmd->u.write_multi_info.write[i].address = address[i];
    549     + cmd->u.write_multi_info.write[i].value = value[i];
    550     }
    551    
    552     /* DT9812 only responds to 32 byte writes!! */
    553     - return usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
    554     - &cmd, 32, &count, DT9812_USB_TIMEOUT);
    555     + ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
    556     + cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT);
    557     + kfree(cmd);
    558     +
    559     + return ret;
    560     }
    561    
    562     static int dt9812_rmw_multiple_registers(struct comedi_device *dev,
    563     @@ -315,17 +364,25 @@ static int dt9812_rmw_multiple_registers(struct comedi_device *dev,
    564     {
    565     struct usb_device *usb = comedi_to_usb_dev(dev);
    566     struct dt9812_private *devpriv = dev->private;
    567     - struct dt9812_usb_cmd cmd;
    568     + struct dt9812_usb_cmd *cmd;
    569     int i, count;
    570     + int ret;
    571     +
    572     + cmd = kzalloc(sizeof(*cmd), GFP_KERNEL);
    573     + if (!cmd)
    574     + return -ENOMEM;
    575    
    576     - cmd.cmd = cpu_to_le32(DT9812_RMW_MULTI_BYTE_REG);
    577     - cmd.u.rmw_multi_info.count = reg_count;
    578     + cmd->cmd = cpu_to_le32(DT9812_RMW_MULTI_BYTE_REG);
    579     + cmd->u.rmw_multi_info.count = reg_count;
    580     for (i = 0; i < reg_count; i++)
    581     - cmd.u.rmw_multi_info.rmw[i] = rmw[i];
    582     + cmd->u.rmw_multi_info.rmw[i] = rmw[i];
    583    
    584     /* DT9812 only responds to 32 byte writes!! */
    585     - return usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
    586     - &cmd, 32, &count, DT9812_USB_TIMEOUT);
    587     + ret = usb_bulk_msg(usb, usb_sndbulkpipe(usb, devpriv->cmd_wr.addr),
    588     + cmd, sizeof(*cmd), &count, DT9812_USB_TIMEOUT);
    589     + kfree(cmd);
    590     +
    591     + return ret;
    592     }
    593    
    594     static int dt9812_digital_in(struct comedi_device *dev, u8 *bits)
    595     diff --git a/drivers/staging/comedi/drivers/ni_usb6501.c b/drivers/staging/comedi/drivers/ni_usb6501.c
    596     index 2f174a34d9e9b..7f647d80ec050 100644
    597     --- a/drivers/staging/comedi/drivers/ni_usb6501.c
    598     +++ b/drivers/staging/comedi/drivers/ni_usb6501.c
    599     @@ -153,6 +153,10 @@ static const u8 READ_COUNTER_RESPONSE[] = {0x00, 0x01, 0x00, 0x10,
    600     0x00, 0x00, 0x00, 0x02,
    601     0x00, 0x00, 0x00, 0x00};
    602    
    603     +/* Largest supported packets */
    604     +static const size_t TX_MAX_SIZE = sizeof(SET_PORT_DIR_REQUEST);
    605     +static const size_t RX_MAX_SIZE = sizeof(READ_PORT_RESPONSE);
    606     +
    607     enum commands {
    608     READ_PORT,
    609     WRITE_PORT,
    610     @@ -510,6 +514,12 @@ static int ni6501_find_endpoints(struct comedi_device *dev)
    611     if (!devpriv->ep_rx || !devpriv->ep_tx)
    612     return -ENODEV;
    613    
    614     + if (usb_endpoint_maxp(devpriv->ep_rx) < RX_MAX_SIZE)
    615     + return -ENODEV;
    616     +
    617     + if (usb_endpoint_maxp(devpriv->ep_tx) < TX_MAX_SIZE)
    618     + return -ENODEV;
    619     +
    620     return 0;
    621     }
    622    
    623     diff --git a/drivers/staging/comedi/drivers/vmk80xx.c b/drivers/staging/comedi/drivers/vmk80xx.c
    624     index cdf86284dd047..36470ee065967 100644
    625     --- a/drivers/staging/comedi/drivers/vmk80xx.c
    626     +++ b/drivers/staging/comedi/drivers/vmk80xx.c
    627     @@ -99,6 +99,9 @@ enum {
    628     #define IC3_VERSION BIT(0)
    629     #define IC6_VERSION BIT(1)
    630    
    631     +#define MIN_BUF_SIZE 64
    632     +#define PACKET_TIMEOUT 10000 /* ms */
    633     +
    634     enum vmk80xx_model {
    635     VMK8055_MODEL,
    636     VMK8061_MODEL
    637     @@ -166,22 +169,21 @@ static void vmk80xx_do_bulk_msg(struct comedi_device *dev)
    638     __u8 rx_addr;
    639     unsigned int tx_pipe;
    640     unsigned int rx_pipe;
    641     - size_t size;
    642     + size_t tx_size;
    643     + size_t rx_size;
    644    
    645     tx_addr = devpriv->ep_tx->bEndpointAddress;
    646     rx_addr = devpriv->ep_rx->bEndpointAddress;
    647     tx_pipe = usb_sndbulkpipe(usb, tx_addr);
    648     rx_pipe = usb_rcvbulkpipe(usb, rx_addr);
    649     + tx_size = usb_endpoint_maxp(devpriv->ep_tx);
    650     + rx_size = usb_endpoint_maxp(devpriv->ep_rx);
    651    
    652     - /*
    653     - * The max packet size attributes of the K8061
    654     - * input/output endpoints are identical
    655     - */
    656     - size = usb_endpoint_maxp(devpriv->ep_tx);
    657     + usb_bulk_msg(usb, tx_pipe, devpriv->usb_tx_buf, tx_size, NULL,
    658     + PACKET_TIMEOUT);
    659    
    660     - usb_bulk_msg(usb, tx_pipe, devpriv->usb_tx_buf,
    661     - size, NULL, devpriv->ep_tx->bInterval);
    662     - usb_bulk_msg(usb, rx_pipe, devpriv->usb_rx_buf, size, NULL, HZ * 10);
    663     + usb_bulk_msg(usb, rx_pipe, devpriv->usb_rx_buf, rx_size, NULL,
    664     + PACKET_TIMEOUT);
    665     }
    666    
    667     static int vmk80xx_read_packet(struct comedi_device *dev)
    668     @@ -200,7 +202,7 @@ static int vmk80xx_read_packet(struct comedi_device *dev)
    669     pipe = usb_rcvintpipe(usb, ep->bEndpointAddress);
    670     return usb_interrupt_msg(usb, pipe, devpriv->usb_rx_buf,
    671     usb_endpoint_maxp(ep), NULL,
    672     - HZ * 10);
    673     + PACKET_TIMEOUT);
    674     }
    675    
    676     static int vmk80xx_write_packet(struct comedi_device *dev, int cmd)
    677     @@ -221,7 +223,7 @@ static int vmk80xx_write_packet(struct comedi_device *dev, int cmd)
    678     pipe = usb_sndintpipe(usb, ep->bEndpointAddress);
    679     return usb_interrupt_msg(usb, pipe, devpriv->usb_tx_buf,
    680     usb_endpoint_maxp(ep), NULL,
    681     - HZ * 10);
    682     + PACKET_TIMEOUT);
    683     }
    684    
    685     static int vmk80xx_reset_device(struct comedi_device *dev)
    686     @@ -687,12 +689,12 @@ static int vmk80xx_alloc_usb_buffers(struct comedi_device *dev)
    687     struct vmk80xx_private *devpriv = dev->private;
    688     size_t size;
    689    
    690     - size = usb_endpoint_maxp(devpriv->ep_rx);
    691     + size = max(usb_endpoint_maxp(devpriv->ep_rx), MIN_BUF_SIZE);
    692     devpriv->usb_rx_buf = kzalloc(size, GFP_KERNEL);
    693     if (!devpriv->usb_rx_buf)
    694     return -ENOMEM;
    695    
    696     - size = usb_endpoint_maxp(devpriv->ep_tx);
    697     + size = max(usb_endpoint_maxp(devpriv->ep_rx), MIN_BUF_SIZE);
    698     devpriv->usb_tx_buf = kzalloc(size, GFP_KERNEL);
    699     if (!devpriv->usb_tx_buf)
    700     return -ENOMEM;
    701     diff --git a/drivers/staging/rtl8192u/r8192U_core.c b/drivers/staging/rtl8192u/r8192U_core.c
    702     index 53b77c8ae328a..95cbf7cf55e61 100644
    703     --- a/drivers/staging/rtl8192u/r8192U_core.c
    704     +++ b/drivers/staging/rtl8192u/r8192U_core.c
    705     @@ -266,7 +266,7 @@ int write_nic_byte_E(struct net_device *dev, int indx, u8 data)
    706    
    707     status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
    708     RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE,
    709     - indx | 0xfe00, 0, usbdata, 1, HZ / 2);
    710     + indx | 0xfe00, 0, usbdata, 1, 500);
    711     kfree(usbdata);
    712    
    713     if (status < 0){
    714     @@ -289,7 +289,7 @@ int read_nic_byte_E(struct net_device *dev, int indx, u8 *data)
    715    
    716     status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
    717     RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
    718     - indx | 0xfe00, 0, usbdata, 1, HZ / 2);
    719     + indx | 0xfe00, 0, usbdata, 1, 500);
    720     *data = *usbdata;
    721     kfree(usbdata);
    722    
    723     @@ -317,7 +317,7 @@ int write_nic_byte(struct net_device *dev, int indx, u8 data)
    724     status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
    725     RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE,
    726     (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
    727     - usbdata, 1, HZ / 2);
    728     + usbdata, 1, 500);
    729     kfree(usbdata);
    730    
    731     if (status < 0) {
    732     @@ -344,7 +344,7 @@ int write_nic_word(struct net_device *dev, int indx, u16 data)
    733     status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
    734     RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE,
    735     (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
    736     - usbdata, 2, HZ / 2);
    737     + usbdata, 2, 500);
    738     kfree(usbdata);
    739    
    740     if (status < 0) {
    741     @@ -371,7 +371,7 @@ int write_nic_dword(struct net_device *dev, int indx, u32 data)
    742     status = usb_control_msg(udev, usb_sndctrlpipe(udev, 0),
    743     RTL8187_REQ_SET_REGS, RTL8187_REQT_WRITE,
    744     (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
    745     - usbdata, 4, HZ / 2);
    746     + usbdata, 4, 500);
    747     kfree(usbdata);
    748    
    749    
    750     @@ -399,7 +399,7 @@ int read_nic_byte(struct net_device *dev, int indx, u8 *data)
    751     status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
    752     RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
    753     (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
    754     - usbdata, 1, HZ / 2);
    755     + usbdata, 1, 500);
    756     *data = *usbdata;
    757     kfree(usbdata);
    758    
    759     @@ -426,7 +426,7 @@ int read_nic_word(struct net_device *dev, int indx, u16 *data)
    760     status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
    761     RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
    762     (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
    763     - usbdata, 2, HZ / 2);
    764     + usbdata, 2, 500);
    765     *data = *usbdata;
    766     kfree(usbdata);
    767    
    768     @@ -450,7 +450,7 @@ static int read_nic_word_E(struct net_device *dev, int indx, u16 *data)
    769    
    770     status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
    771     RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
    772     - indx | 0xfe00, 0, usbdata, 2, HZ / 2);
    773     + indx | 0xfe00, 0, usbdata, 2, 500);
    774     *data = *usbdata;
    775     kfree(usbdata);
    776    
    777     @@ -476,7 +476,7 @@ int read_nic_dword(struct net_device *dev, int indx, u32 *data)
    778     status = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0),
    779     RTL8187_REQ_GET_REGS, RTL8187_REQT_READ,
    780     (indx & 0xff) | 0xff00, (indx >> 8) & 0x0f,
    781     - usbdata, 4, HZ / 2);
    782     + usbdata, 4, 500);
    783     *data = *usbdata;
    784     kfree(usbdata);
    785    
    786     diff --git a/drivers/staging/rtl8712/usb_ops_linux.c b/drivers/staging/rtl8712/usb_ops_linux.c
    787     index fc6bb0be2a28c..2919498fd8089 100644
    788     --- a/drivers/staging/rtl8712/usb_ops_linux.c
    789     +++ b/drivers/staging/rtl8712/usb_ops_linux.c
    790     @@ -504,7 +504,7 @@ int r8712_usbctrl_vendorreq(struct intf_priv *pintfpriv, u8 request, u16 value,
    791     memcpy(pIo_buf, pdata, len);
    792     }
    793     status = usb_control_msg(udev, pipe, request, reqtype, value, index,
    794     - pIo_buf, len, HZ / 2);
    795     + pIo_buf, len, 500);
    796     if (status > 0) { /* Success this control transfer. */
    797     if (requesttype == 0x01) {
    798     /* For Control read transfer, we have to copy the read
    799     diff --git a/drivers/usb/gadget/udc/Kconfig b/drivers/usb/gadget/udc/Kconfig
    800     index 658b8da609152..cff7dae51aabb 100644
    801     --- a/drivers/usb/gadget/udc/Kconfig
    802     +++ b/drivers/usb/gadget/udc/Kconfig
    803     @@ -278,6 +278,7 @@ config USB_AMD5536UDC
    804     config USB_FSL_QE
    805     tristate "Freescale QE/CPM USB Device Controller"
    806     depends on FSL_SOC && (QUICC_ENGINE || CPM)
    807     + depends on !64BIT || BROKEN
    808     help
    809     Some of Freescale PowerPC processors have a Full Speed
    810     QE/CPM2 USB controller, which support device mode with 4
    811     diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c
    812     index 60540a8ac431d..8eb3a291ca9d8 100644
    813     --- a/drivers/usb/musb/musb_gadget.c
    814     +++ b/drivers/usb/musb/musb_gadget.c
    815     @@ -1284,9 +1284,11 @@ static int musb_gadget_queue(struct usb_ep *ep, struct usb_request *req,
    816     status = musb_queue_resume_work(musb,
    817     musb_ep_restart_resume_work,
    818     request);
    819     - if (status < 0)
    820     + if (status < 0) {
    821     dev_err(musb->controller, "%s resume work: %i\n",
    822     __func__, status);
    823     + list_del(&request->list);
    824     + }
    825     }
    826    
    827     unlock:
    828     diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
    829     index ed94496cdc5b3..ec2b7f5c900c2 100644
    830     --- a/drivers/usb/storage/unusual_devs.h
    831     +++ b/drivers/usb/storage/unusual_devs.h
    832     @@ -425,6 +425,16 @@ UNUSUAL_DEV( 0x04b8, 0x0602, 0x0110, 0x0110,
    833     "785EPX Storage",
    834     USB_SC_SCSI, USB_PR_BULK, NULL, US_FL_SINGLE_LUN),
    835    
    836     +/*
    837     + * Reported by James Buren <braewoods+lkml@braewoods.net>
    838     + * Virtual ISOs cannot be remounted if ejected while the device is locked
    839     + * Disable locking to mimic Windows behavior that bypasses the issue
    840     + */
    841     +UNUSUAL_DEV( 0x04c5, 0x2028, 0x0001, 0x0001,
    842     + "iODD",
    843     + "2531/2541",
    844     + USB_SC_DEVICE, USB_PR_DEVICE, NULL, US_FL_NOT_LOCKABLE),
    845     +
    846     /*
    847     * Not sure who reported this originally but
    848     * Pavel Machek <pavel@ucw.cz> reported that the extra US_FL_SINGLE_LUN
    849     diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
    850     index 871c8b3920991..2d1d41c94e376 100644
    851     --- a/fs/isofs/inode.c
    852     +++ b/fs/isofs/inode.c
    853     @@ -1265,6 +1265,8 @@ static int isofs_read_inode(struct inode *inode, int relocated)
    854    
    855     de = (struct iso_directory_record *) (bh->b_data + offset);
    856     de_len = *(unsigned char *) de;
    857     + if (de_len < sizeof(struct iso_directory_record))
    858     + goto fail;
    859    
    860     if (offset + de_len > bufsize) {
    861     int frag1 = bufsize - offset;
    862     diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
    863     index 0a4c2d4d9f8d5..b43fa9d95a7a6 100644
    864     --- a/include/asm-generic/pgtable.h
    865     +++ b/include/asm-generic/pgtable.h
    866     @@ -847,6 +847,19 @@ static inline bool arch_has_pfn_modify_check(void)
    867     #define io_remap_pfn_range remap_pfn_range
    868     #endif
    869    
    870     +#if !defined(MAX_POSSIBLE_PHYSMEM_BITS) && !defined(CONFIG_64BIT)
    871     +#ifdef CONFIG_PHYS_ADDR_T_64BIT
    872     +/*
    873     + * ZSMALLOC needs to know the highest PFN on 32-bit architectures
    874     + * with physical address space extension, but falls back to
    875     + * BITS_PER_LONG otherwise.
    876     + */
    877     +#error Missing MAX_POSSIBLE_PHYSMEM_BITS definition
    878     +#else
    879     +#define MAX_POSSIBLE_PHYSMEM_BITS 32
    880     +#endif
    881     +#endif
    882     +
    883     #ifndef has_transparent_hugepage
    884     #ifdef CONFIG_TRANSPARENT_HUGEPAGE
    885     #define has_transparent_hugepage() 1
    886     diff --git a/kernel/printk/printk.c b/kernel/printk/printk.c
    887     index 7acae2f2478d9..9c17a26555512 100644
    888     --- a/kernel/printk/printk.c
    889     +++ b/kernel/printk/printk.c
    890     @@ -2035,8 +2035,15 @@ static int __init console_setup(char *str)
    891     char *s, *options, *brl_options = NULL;
    892     int idx;
    893    
    894     - if (str[0] == 0)
    895     + /*
    896     + * console="" or console=null have been suggested as a way to
    897     + * disable console output. Use ttynull that has been created
    898     + * for exacly this purpose.
    899     + */
    900     + if (str[0] == 0 || strcmp(str, "null") == 0) {
    901     + __add_preferred_console("ttynull", 0, NULL, NULL);
    902     return 1;
    903     + }
    904    
    905     if (_braille_console_setup(&str, &brl_options))
    906     return 1;
    907     diff --git a/mm/zsmalloc.c b/mm/zsmalloc.c
    908     index 8db3c2b27a175..2b7bfd97587a0 100644
    909     --- a/mm/zsmalloc.c
    910     +++ b/mm/zsmalloc.c
    911     @@ -83,18 +83,19 @@
    912     * This is made more complicated by various memory models and PAE.
    913     */
    914    
    915     -#ifndef MAX_PHYSMEM_BITS
    916     -#ifdef CONFIG_HIGHMEM64G
    917     -#define MAX_PHYSMEM_BITS 36
    918     -#else /* !CONFIG_HIGHMEM64G */
    919     +#ifndef MAX_POSSIBLE_PHYSMEM_BITS
    920     +#ifdef MAX_PHYSMEM_BITS
    921     +#define MAX_POSSIBLE_PHYSMEM_BITS MAX_PHYSMEM_BITS
    922     +#else
    923     /*
    924     * If this definition of MAX_PHYSMEM_BITS is used, OBJ_INDEX_BITS will just
    925     * be PAGE_SHIFT
    926     */
    927     -#define MAX_PHYSMEM_BITS BITS_PER_LONG
    928     +#define MAX_POSSIBLE_PHYSMEM_BITS BITS_PER_LONG
    929     #endif
    930     #endif
    931     -#define _PFN_BITS (MAX_PHYSMEM_BITS - PAGE_SHIFT)
    932     +
    933     +#define _PFN_BITS (MAX_POSSIBLE_PHYSMEM_BITS - PAGE_SHIFT)
    934    
    935     /*
    936     * Memory for allocating for handle keeps object position by