Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-3.10/0146-3.10.47-all-fixes.patch

    Contents of /trunk/kernel-alx/patches-3.10/0146-3.10.47-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2634 - (show annotations) (download)
    Tue Jul 21 16:20:18 2015 UTC (8 years, 9 months ago) by niro
    File size: 46364 byte(s) 
    -linux-3.10.47
    1 diff --git a/Documentation/SubmittingPatches b/Documentation/SubmittingPatches
    2 index 6e97e73d87b5..4dbba7e100a1 100644
    3 --- a/Documentation/SubmittingPatches
    4 +++ b/Documentation/SubmittingPatches
    5 @@ -131,6 +131,20 @@ If you cannot condense your patch set into a smaller set of patches,
    6 then only post say 15 or so at a time and wait for review and integration.
    7
    8
    9 +If your patch fixes a bug in a specific commit, e.g. you found an issue using
    10 +git-bisect, please use the 'Fixes:' tag with the first 12 characters of the
    11 +SHA-1 ID, and the one line summary.
    12 +Example:
    13 +
    14 + Fixes: e21d2170f366 ("video: remove unnecessary platform_set_drvdata()")
    15 +
    16 +The following git-config settings can be used to add a pretty format for
    17 +outputting the above style in the git log or git show commands
    18 +
    19 + [core]
    20 + abbrev = 12
    21 + [pretty]
    22 + fixes = Fixes: %h (\"%s\")
    23
    24 4) Style check your changes.
    25
    26 @@ -420,7 +434,7 @@ person it names. This tag documents that potentially interested parties
    27 have been included in the discussion
    28
    29
    30 -14) Using Reported-by:, Tested-by:, Reviewed-by: and Suggested-by:
    31 +14) Using Reported-by:, Tested-by:, Reviewed-by:, Suggested-by: and Fixes:
    32
    33 If this patch fixes a problem reported by somebody else, consider adding a
    34 Reported-by: tag to credit the reporter for their contribution. Please
    35 @@ -475,6 +489,12 @@ idea was not posted in a public forum. That said, if we diligently credit our
    36 idea reporters, they will, hopefully, be inspired to help us again in the
    37 future.
    38
    39 +A Fixes: tag indicates that the patch fixes an issue in a previous commit. It
    40 +is used to make it easy to determine where a bug originated, which can help
    41 +review a bug fix. This tag also assists the stable kernel team in determining
    42 +which stable kernel versions should receive your fix. This is the preferred
    43 +method for indicating a bug fixed by the patch. See #2 above for more details.
    44 +
    45
    46 15) The canonical patch format
    47
    48 diff --git a/Makefile b/Makefile
    49 index c226f110181d..6a3b46d1863c 100644
    50 --- a/Makefile
    51 +++ b/Makefile
    52 @@ -1,6 +1,6 @@
    53 VERSION = 3
    54 PATCHLEVEL = 10
    55 -SUBLEVEL = 46
    56 +SUBLEVEL = 47
    57 EXTRAVERSION =
    58 NAME = TOSSUG Baby Fish
    59
    60 diff --git a/arch/mips/kernel/irq-msc01.c b/arch/mips/kernel/irq-msc01.c
    61 index fab40f7d2e03..ac9facc08694 100644
    62 --- a/arch/mips/kernel/irq-msc01.c
    63 +++ b/arch/mips/kernel/irq-msc01.c
    64 @@ -131,7 +131,7 @@ void __init init_msc_irqs(unsigned long icubase, unsigned int irqbase, msc_irqma
    65
    66 board_bind_eic_interrupt = &msc_bind_eic_interrupt;
    67
    68 - for (; nirq >= 0; nirq--, imp++) {
    69 + for (; nirq > 0; nirq--, imp++) {
    70 int n = imp->im_irq;
    71
    72 switch (imp->im_type) {
    73 diff --git a/arch/mips/kvm/kvm_mips.c b/arch/mips/kvm/kvm_mips.c
    74 index 426345ac6f6e..2c7b3ade8ec0 100644
    75 --- a/arch/mips/kvm/kvm_mips.c
    76 +++ b/arch/mips/kvm/kvm_mips.c
    77 @@ -149,9 +149,7 @@ void kvm_mips_free_vcpus(struct kvm *kvm)
    78 if (kvm->arch.guest_pmap[i] != KVM_INVALID_PAGE)
    79 kvm_mips_release_pfn_clean(kvm->arch.guest_pmap[i]);
    80 }
    81 -
    82 - if (kvm->arch.guest_pmap)
    83 - kfree(kvm->arch.guest_pmap);
    84 + kfree(kvm->arch.guest_pmap);
    85
    86 kvm_for_each_vcpu(i, vcpu, kvm) {
    87 kvm_arch_vcpu_free(vcpu);
    88 @@ -384,12 +382,9 @@ void kvm_arch_vcpu_free(struct kvm_vcpu *vcpu)
    89
    90 kvm_mips_dump_stats(vcpu);
    91
    92 - if (vcpu->arch.guest_ebase)
    93 - kfree(vcpu->arch.guest_ebase);
    94 -
    95 - if (vcpu->arch.kseg0_commpage)
    96 - kfree(vcpu->arch.kseg0_commpage);
    97 -
    98 + kfree(vcpu->arch.guest_ebase);
    99 + kfree(vcpu->arch.kseg0_commpage);
    100 + kfree(vcpu);
    101 }
    102
    103 void kvm_arch_vcpu_destroy(struct kvm_vcpu *vcpu)
    104 diff --git a/arch/powerpc/include/asm/systbl.h b/arch/powerpc/include/asm/systbl.h
    105 index 43523fe0d8b4..05fcdd826829 100644
    106 --- a/arch/powerpc/include/asm/systbl.h
    107 +++ b/arch/powerpc/include/asm/systbl.h
    108 @@ -190,7 +190,7 @@ SYSCALL_SPU(getcwd)
    109 SYSCALL_SPU(capget)
    110 SYSCALL_SPU(capset)
    111 COMPAT_SYS(sigaltstack)
    112 -COMPAT_SYS_SPU(sendfile)
    113 +SYSX_SPU(sys_sendfile64,compat_sys_sendfile,sys_sendfile)
    114 SYSCALL(ni_syscall)
    115 SYSCALL(ni_syscall)
    116 PPC_SYS(vfork)
    117 diff --git a/arch/powerpc/include/uapi/asm/cputable.h b/arch/powerpc/include/uapi/asm/cputable.h
    118 index 5b7657959faa..de2c0e4ee1aa 100644
    119 --- a/arch/powerpc/include/uapi/asm/cputable.h
    120 +++ b/arch/powerpc/include/uapi/asm/cputable.h
    121 @@ -41,5 +41,6 @@
    122 #define PPC_FEATURE2_EBB 0x10000000
    123 #define PPC_FEATURE2_ISEL 0x08000000
    124 #define PPC_FEATURE2_TAR 0x04000000
    125 +#define PPC_FEATURE2_VEC_CRYPTO 0x02000000
    126
    127 #endif /* _UAPI__ASM_POWERPC_CPUTABLE_H */
    128 diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c
    129 index 2a45d0f04385..b2dc45522850 100644
    130 --- a/arch/powerpc/kernel/cputable.c
    131 +++ b/arch/powerpc/kernel/cputable.c
    132 @@ -105,7 +105,8 @@ extern void __restore_cpu_e6500(void);
    133 PPC_FEATURE_PSERIES_PERFMON_COMPAT)
    134 #define COMMON_USER2_POWER8 (PPC_FEATURE2_ARCH_2_07 | \
    135 PPC_FEATURE2_HTM_COMP | PPC_FEATURE2_DSCR | \
    136 - PPC_FEATURE2_ISEL | PPC_FEATURE2_TAR)
    137 + PPC_FEATURE2_ISEL | PPC_FEATURE2_TAR | \
    138 + PPC_FEATURE2_VEC_CRYPTO)
    139 #define COMMON_USER_PA6T (COMMON_USER_PPC64 | PPC_FEATURE_PA6T |\
    140 PPC_FEATURE_TRUE_LE | \
    141 PPC_FEATURE_HAS_ALTIVEC_COMP)
    142 diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c
    143 index 5fc29ad7e26f..57fd5c1e8e89 100644
    144 --- a/arch/powerpc/kernel/time.c
    145 +++ b/arch/powerpc/kernel/time.c
    146 @@ -512,7 +512,7 @@ void timer_interrupt(struct pt_regs * regs)
    147
    148 __get_cpu_var(irq_stat).timer_irqs++;
    149
    150 -#if defined(CONFIG_PPC32) && defined(CONFIG_PMAC)
    151 +#if defined(CONFIG_PPC32) && defined(CONFIG_PPC_PMAC)
    152 if (atomic_read(&ppc_n_lost_interrupts) != 0)
    153 do_IRQ(regs);
    154 #endif
    155 diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c
    156 index e15c521846ca..08490ecc465e 100644
    157 --- a/arch/powerpc/lib/sstep.c
    158 +++ b/arch/powerpc/lib/sstep.c
    159 @@ -1395,7 +1395,7 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
    160 regs->gpr[rd] = byterev_4(val);
    161 goto ldst_done;
    162
    163 -#ifdef CONFIG_PPC_CPU
    164 +#ifdef CONFIG_PPC_FPU
    165 case 535: /* lfsx */
    166 case 567: /* lfsux */
    167 if (!(regs->msr & MSR_FP))
    168 diff --git a/arch/powerpc/platforms/pseries/eeh_pseries.c b/arch/powerpc/platforms/pseries/eeh_pseries.c
    169 index b456b157d33d..68f97d5a4679 100644
    170 --- a/arch/powerpc/platforms/pseries/eeh_pseries.c
    171 +++ b/arch/powerpc/platforms/pseries/eeh_pseries.c
    172 @@ -400,6 +400,7 @@ static int pseries_eeh_get_state(struct eeh_pe *pe, int *state)
    173 } else {
    174 result = EEH_STATE_NOT_SUPPORT;
    175 }
    176 + break;
    177 default:
    178 result = EEH_STATE_NOT_SUPPORT;
    179 }
    180 diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h
    181 index 942a08623a1a..68e9f007cd4a 100644
    182 --- a/arch/x86/include/asm/ptrace.h
    183 +++ b/arch/x86/include/asm/ptrace.h
    184 @@ -232,6 +232,22 @@ static inline unsigned long regs_get_kernel_stack_nth(struct pt_regs *regs,
    185
    186 #define ARCH_HAS_USER_SINGLE_STEP_INFO
    187
    188 +/*
    189 + * When hitting ptrace_stop(), we cannot return using SYSRET because
    190 + * that does not restore the full CPU state, only a minimal set. The
    191 + * ptracer can change arbitrary register values, which is usually okay
    192 + * because the usual ptrace stops run off the signal delivery path which
    193 + * forces IRET; however, ptrace_event() stops happen in arbitrary places
    194 + * in the kernel and don't force IRET path.
    195 + *
    196 + * So force IRET path after a ptrace stop.
    197 + */
    198 +#define arch_ptrace_stop_needed(code, info) \
    199 +({ \
    200 + set_thread_flag(TIF_NOTIFY_RESUME); \
    201 + false; \
    202 +})
    203 +
    204 struct user_desc;
    205 extern int do_get_thread_area(struct task_struct *p, int idx,
    206 struct user_desc __user *info);
    207 diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c
    208 index 6e514583aa76..0d94e09221d9 100644
    209 --- a/drivers/block/mtip32xx/mtip32xx.c
    210 +++ b/drivers/block/mtip32xx/mtip32xx.c
    211 @@ -1493,6 +1493,37 @@ static inline void ata_swap_string(u16 *buf, unsigned int len)
    212 be16_to_cpus(&buf[i]);
    213 }
    214
    215 +static void mtip_set_timeout(struct driver_data *dd,
    216 + struct host_to_dev_fis *fis,
    217 + unsigned int *timeout, u8 erasemode)
    218 +{
    219 + switch (fis->command) {
    220 + case ATA_CMD_DOWNLOAD_MICRO:
    221 + *timeout = 120000; /* 2 minutes */
    222 + break;
    223 + case ATA_CMD_SEC_ERASE_UNIT:
    224 + case 0xFC:
    225 + if (erasemode)
    226 + *timeout = ((*(dd->port->identify + 90) * 2) * 60000);
    227 + else
    228 + *timeout = ((*(dd->port->identify + 89) * 2) * 60000);
    229 + break;
    230 + case ATA_CMD_STANDBYNOW1:
    231 + *timeout = 120000; /* 2 minutes */
    232 + break;
    233 + case 0xF7:
    234 + case 0xFA:
    235 + *timeout = 60000; /* 60 seconds */
    236 + break;
    237 + case ATA_CMD_SMART:
    238 + *timeout = 15000; /* 15 seconds */
    239 + break;
    240 + default:
    241 + *timeout = MTIP_IOCTL_COMMAND_TIMEOUT_MS;
    242 + break;
    243 + }
    244 +}
    245 +
    246 /*
    247 * Request the device identity information.
    248 *
    249 @@ -1602,6 +1633,7 @@ static int mtip_standby_immediate(struct mtip_port *port)
    250 int rv;
    251 struct host_to_dev_fis fis;
    252 unsigned long start;
    253 + unsigned int timeout;
    254
    255 /* Build the FIS. */
    256 memset(&fis, 0, sizeof(struct host_to_dev_fis));
    257 @@ -1609,6 +1641,8 @@ static int mtip_standby_immediate(struct mtip_port *port)
    258 fis.opts = 1 << 7;
    259 fis.command = ATA_CMD_STANDBYNOW1;
    260
    261 + mtip_set_timeout(port->dd, &fis, &timeout, 0);
    262 +
    263 start = jiffies;
    264 rv = mtip_exec_internal_command(port,
    265 &fis,
    266 @@ -1617,7 +1651,7 @@ static int mtip_standby_immediate(struct mtip_port *port)
    267 0,
    268 0,
    269 GFP_ATOMIC,
    270 - 15000);
    271 + timeout);
    272 dbg_printk(MTIP_DRV_NAME "Time taken to complete standby cmd: %d ms\n",
    273 jiffies_to_msecs(jiffies - start));
    274 if (rv)
    275 @@ -2156,36 +2190,6 @@ static unsigned int implicit_sector(unsigned char command,
    276 }
    277 return rv;
    278 }
    279 -static void mtip_set_timeout(struct driver_data *dd,
    280 - struct host_to_dev_fis *fis,
    281 - unsigned int *timeout, u8 erasemode)
    282 -{
    283 - switch (fis->command) {
    284 - case ATA_CMD_DOWNLOAD_MICRO:
    285 - *timeout = 120000; /* 2 minutes */
    286 - break;
    287 - case ATA_CMD_SEC_ERASE_UNIT:
    288 - case 0xFC:
    289 - if (erasemode)
    290 - *timeout = ((*(dd->port->identify + 90) * 2) * 60000);
    291 - else
    292 - *timeout = ((*(dd->port->identify + 89) * 2) * 60000);
    293 - break;
    294 - case ATA_CMD_STANDBYNOW1:
    295 - *timeout = 120000; /* 2 minutes */
    296 - break;
    297 - case 0xF7:
    298 - case 0xFA:
    299 - *timeout = 60000; /* 60 seconds */
    300 - break;
    301 - case ATA_CMD_SMART:
    302 - *timeout = 15000; /* 15 seconds */
    303 - break;
    304 - default:
    305 - *timeout = MTIP_IOCTL_COMMAND_TIMEOUT_MS;
    306 - break;
    307 - }
    308 -}
    309
    310 /*
    311 * Executes a taskfile
    312 @@ -4284,6 +4288,57 @@ static DEFINE_HANDLER(5);
    313 static DEFINE_HANDLER(6);
    314 static DEFINE_HANDLER(7);
    315
    316 +static void mtip_disable_link_opts(struct driver_data *dd, struct pci_dev *pdev)
    317 +{
    318 + int pos;
    319 + unsigned short pcie_dev_ctrl;
    320 +
    321 + pos = pci_find_capability(pdev, PCI_CAP_ID_EXP);
    322 + if (pos) {
    323 + pci_read_config_word(pdev,
    324 + pos + PCI_EXP_DEVCTL,
    325 + &pcie_dev_ctrl);
    326 + if (pcie_dev_ctrl & (1 << 11) ||
    327 + pcie_dev_ctrl & (1 << 4)) {
    328 + dev_info(&dd->pdev->dev,
    329 + "Disabling ERO/No-Snoop on bridge device %04x:%04x\n",
    330 + pdev->vendor, pdev->device);
    331 + pcie_dev_ctrl &= ~(PCI_EXP_DEVCTL_NOSNOOP_EN |
    332 + PCI_EXP_DEVCTL_RELAX_EN);
    333 + pci_write_config_word(pdev,
    334 + pos + PCI_EXP_DEVCTL,
    335 + pcie_dev_ctrl);
    336 + }
    337 + }
    338 +}
    339 +
    340 +static void mtip_fix_ero_nosnoop(struct driver_data *dd, struct pci_dev *pdev)
    341 +{
    342 + /*
    343 + * This workaround is specific to AMD/ATI chipset with a PCI upstream
    344 + * device with device id 0x5aXX
    345 + */
    346 + if (pdev->bus && pdev->bus->self) {
    347 + if (pdev->bus->self->vendor == PCI_VENDOR_ID_ATI &&
    348 + ((pdev->bus->self->device & 0xff00) == 0x5a00)) {
    349 + mtip_disable_link_opts(dd, pdev->bus->self);
    350 + } else {
    351 + /* Check further up the topology */
    352 + struct pci_dev *parent_dev = pdev->bus->self;
    353 + if (parent_dev->bus &&
    354 + parent_dev->bus->parent &&
    355 + parent_dev->bus->parent->self &&
    356 + parent_dev->bus->parent->self->vendor ==
    357 + PCI_VENDOR_ID_ATI &&
    358 + (parent_dev->bus->parent->self->device &
    359 + 0xff00) == 0x5a00) {
    360 + mtip_disable_link_opts(dd,
    361 + parent_dev->bus->parent->self);
    362 + }
    363 + }
    364 + }
    365 +}
    366 +
    367 /*
    368 * Called for each supported PCI device detected.
    369 *
    370 @@ -4435,6 +4490,8 @@ static int mtip_pci_probe(struct pci_dev *pdev,
    371 goto block_initialize_err;
    372 }
    373
    374 + mtip_fix_ero_nosnoop(dd, pdev);
    375 +
    376 /* Initialize the block layer. */
    377 rv = mtip_block_initialize(dd);
    378 if (rv < 0) {
    379 @@ -4727,13 +4784,13 @@ static int __init mtip_init(void)
    380 */
    381 static void __exit mtip_exit(void)
    382 {
    383 - debugfs_remove_recursive(dfs_parent);
    384 -
    385 /* Release the allocated major block device number. */
    386 unregister_blkdev(mtip_major, MTIP_DRV_NAME);
    387
    388 /* Unregister the PCI driver. */
    389 pci_unregister_driver(&mtip_pci_driver);
    390 +
    391 + debugfs_remove_recursive(dfs_parent);
    392 }
    393
    394 MODULE_AUTHOR("Micron Technology, Inc");
    395 diff --git a/drivers/extcon/extcon-max77693.c b/drivers/extcon/extcon-max77693.c
    396 index b56bdaa27d4b..9966fc0a527f 100644
    397 --- a/drivers/extcon/extcon-max77693.c
    398 +++ b/drivers/extcon/extcon-max77693.c
    399 @@ -1180,7 +1180,7 @@ static int max77693_muic_probe(struct platform_device *pdev)
    400
    401
    402 /* Initialize MUIC register by using platform data or default data */
    403 - if (pdata->muic_data) {
    404 + if (pdata && pdata->muic_data) {
    405 init_data = pdata->muic_data->init_data;
    406 num_init_data = pdata->muic_data->num_init_data;
    407 } else {
    408 @@ -1213,7 +1213,7 @@ static int max77693_muic_probe(struct platform_device *pdev)
    409 = init_data[i].data;
    410 }
    411
    412 - if (pdata->muic_data) {
    413 + if (pdata && pdata->muic_data) {
    414 struct max77693_muic_platform_data *muic_pdata = pdata->muic_data;
    415
    416 /*
    417 diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c
    418 index f0d588f8859e..1acb99100556 100644
    419 --- a/drivers/infiniband/core/user_mad.c
    420 +++ b/drivers/infiniband/core/user_mad.c
    421 @@ -98,7 +98,7 @@ struct ib_umad_port {
    422
    423 struct ib_umad_device {
    424 int start_port, end_port;
    425 - struct kref ref;
    426 + struct kobject kobj;
    427 struct ib_umad_port port[0];
    428 };
    429
    430 @@ -134,14 +134,18 @@ static DECLARE_BITMAP(dev_map, IB_UMAD_MAX_PORTS);
    431 static void ib_umad_add_one(struct ib_device *device);
    432 static void ib_umad_remove_one(struct ib_device *device);
    433
    434 -static void ib_umad_release_dev(struct kref *ref)
    435 +static void ib_umad_release_dev(struct kobject *kobj)
    436 {
    437 struct ib_umad_device *dev =
    438 - container_of(ref, struct ib_umad_device, ref);
    439 + container_of(kobj, struct ib_umad_device, kobj);
    440
    441 kfree(dev);
    442 }
    443
    444 +static struct kobj_type ib_umad_dev_ktype = {
    445 + .release = ib_umad_release_dev,
    446 +};
    447 +
    448 static int hdr_size(struct ib_umad_file *file)
    449 {
    450 return file->use_pkey_index ? sizeof (struct ib_user_mad_hdr) :
    451 @@ -780,27 +784,19 @@ static int ib_umad_open(struct inode *inode, struct file *filp)
    452 {
    453 struct ib_umad_port *port;
    454 struct ib_umad_file *file;
    455 - int ret;
    456 + int ret = -ENXIO;
    457
    458 port = container_of(inode->i_cdev, struct ib_umad_port, cdev);
    459 - if (port)
    460 - kref_get(&port->umad_dev->ref);
    461 - else
    462 - return -ENXIO;
    463
    464 mutex_lock(&port->file_mutex);
    465
    466 - if (!port->ib_dev) {
    467 - ret = -ENXIO;
    468 + if (!port->ib_dev)
    469 goto out;
    470 - }
    471
    472 + ret = -ENOMEM;
    473 file = kzalloc(sizeof *file, GFP_KERNEL);
    474 - if (!file) {
    475 - kref_put(&port->umad_dev->ref, ib_umad_release_dev);
    476 - ret = -ENOMEM;
    477 + if (!file)
    478 goto out;
    479 - }
    480
    481 mutex_init(&file->mutex);
    482 spin_lock_init(&file->send_lock);
    483 @@ -814,6 +810,13 @@ static int ib_umad_open(struct inode *inode, struct file *filp)
    484 list_add_tail(&file->port_list, &port->file_list);
    485
    486 ret = nonseekable_open(inode, filp);
    487 + if (ret) {
    488 + list_del(&file->port_list);
    489 + kfree(file);
    490 + goto out;
    491 + }
    492 +
    493 + kobject_get(&port->umad_dev->kobj);
    494
    495 out:
    496 mutex_unlock(&port->file_mutex);
    497 @@ -852,7 +855,7 @@ static int ib_umad_close(struct inode *inode, struct file *filp)
    498 mutex_unlock(&file->port->file_mutex);
    499
    500 kfree(file);
    501 - kref_put(&dev->ref, ib_umad_release_dev);
    502 + kobject_put(&dev->kobj);
    503
    504 return 0;
    505 }
    506 @@ -880,10 +883,6 @@ static int ib_umad_sm_open(struct inode *inode, struct file *filp)
    507 int ret;
    508
    509 port = container_of(inode->i_cdev, struct ib_umad_port, sm_cdev);
    510 - if (port)
    511 - kref_get(&port->umad_dev->ref);
    512 - else
    513 - return -ENXIO;
    514
    515 if (filp->f_flags & O_NONBLOCK) {
    516 if (down_trylock(&port->sm_sem)) {
    517 @@ -898,17 +897,27 @@ static int ib_umad_sm_open(struct inode *inode, struct file *filp)
    518 }
    519
    520 ret = ib_modify_port(port->ib_dev, port->port_num, 0, &props);
    521 - if (ret) {
    522 - up(&port->sm_sem);
    523 - goto fail;
    524 - }
    525 + if (ret)
    526 + goto err_up_sem;
    527
    528 filp->private_data = port;
    529
    530 - return nonseekable_open(inode, filp);
    531 + ret = nonseekable_open(inode, filp);
    532 + if (ret)
    533 + goto err_clr_sm_cap;
    534 +
    535 + kobject_get(&port->umad_dev->kobj);
    536 +
    537 + return 0;
    538 +
    539 +err_clr_sm_cap:
    540 + swap(props.set_port_cap_mask, props.clr_port_cap_mask);
    541 + ib_modify_port(port->ib_dev, port->port_num, 0, &props);
    542 +
    543 +err_up_sem:
    544 + up(&port->sm_sem);
    545
    546 fail:
    547 - kref_put(&port->umad_dev->ref, ib_umad_release_dev);
    548 return ret;
    549 }
    550
    551 @@ -927,7 +936,7 @@ static int ib_umad_sm_close(struct inode *inode, struct file *filp)
    552
    553 up(&port->sm_sem);
    554
    555 - kref_put(&port->umad_dev->ref, ib_umad_release_dev);
    556 + kobject_put(&port->umad_dev->kobj);
    557
    558 return ret;
    559 }
    560 @@ -995,6 +1004,7 @@ static int find_overflow_devnum(void)
    561 }
    562
    563 static int ib_umad_init_port(struct ib_device *device, int port_num,
    564 + struct ib_umad_device *umad_dev,
    565 struct ib_umad_port *port)
    566 {
    567 int devnum;
    568 @@ -1027,6 +1037,7 @@ static int ib_umad_init_port(struct ib_device *device, int port_num,
    569
    570 cdev_init(&port->cdev, &umad_fops);
    571 port->cdev.owner = THIS_MODULE;
    572 + port->cdev.kobj.parent = &umad_dev->kobj;
    573 kobject_set_name(&port->cdev.kobj, "umad%d", port->dev_num);
    574 if (cdev_add(&port->cdev, base, 1))
    575 goto err_cdev;
    576 @@ -1045,6 +1056,7 @@ static int ib_umad_init_port(struct ib_device *device, int port_num,
    577 base += IB_UMAD_MAX_PORTS;
    578 cdev_init(&port->sm_cdev, &umad_sm_fops);
    579 port->sm_cdev.owner = THIS_MODULE;
    580 + port->sm_cdev.kobj.parent = &umad_dev->kobj;
    581 kobject_set_name(&port->sm_cdev.kobj, "issm%d", port->dev_num);
    582 if (cdev_add(&port->sm_cdev, base, 1))
    583 goto err_sm_cdev;
    584 @@ -1138,7 +1150,7 @@ static void ib_umad_add_one(struct ib_device *device)
    585 if (!umad_dev)
    586 return;
    587
    588 - kref_init(&umad_dev->ref);
    589 + kobject_init(&umad_dev->kobj, &ib_umad_dev_ktype);
    590
    591 umad_dev->start_port = s;
    592 umad_dev->end_port = e;
    593 @@ -1146,7 +1158,8 @@ static void ib_umad_add_one(struct ib_device *device)
    594 for (i = s; i <= e; ++i) {
    595 umad_dev->port[i - s].umad_dev = umad_dev;
    596
    597 - if (ib_umad_init_port(device, i, &umad_dev->port[i - s]))
    598 + if (ib_umad_init_port(device, i, umad_dev,
    599 + &umad_dev->port[i - s]))
    600 goto err;
    601 }
    602
    603 @@ -1158,7 +1171,7 @@ err:
    604 while (--i >= s)
    605 ib_umad_kill_port(&umad_dev->port[i - s]);
    606
    607 - kref_put(&umad_dev->ref, ib_umad_release_dev);
    608 + kobject_put(&umad_dev->kobj);
    609 }
    610
    611 static void ib_umad_remove_one(struct ib_device *device)
    612 @@ -1172,7 +1185,7 @@ static void ib_umad_remove_one(struct ib_device *device)
    613 for (i = 0; i <= umad_dev->end_port - umad_dev->start_port; ++i)
    614 ib_umad_kill_port(&umad_dev->port[i]);
    615
    616 - kref_put(&umad_dev->ref, ib_umad_release_dev);
    617 + kobject_put(&umad_dev->kobj);
    618 }
    619
    620 static char *umad_devnode(struct device *dev, umode_t *mode)
    621 diff --git a/drivers/infiniband/hw/ipath/ipath_diag.c b/drivers/infiniband/hw/ipath/ipath_diag.c
    622 index e2f9a51f4a38..45802e97332e 100644
    623 --- a/drivers/infiniband/hw/ipath/ipath_diag.c
    624 +++ b/drivers/infiniband/hw/ipath/ipath_diag.c
    625 @@ -346,6 +346,10 @@ static ssize_t ipath_diagpkt_write(struct file *fp,
    626 ret = -EFAULT;
    627 goto bail;
    628 }
    629 + dp.len = odp.len;
    630 + dp.unit = odp.unit;
    631 + dp.data = odp.data;
    632 + dp.pbc_wd = 0;
    633 } else {
    634 ret = -EINVAL;
    635 goto bail;
    636 diff --git a/drivers/infiniband/hw/qib/qib_mad.c b/drivers/infiniband/hw/qib/qib_mad.c
    637 index ccb119143d20..1dd9fcbb7c9a 100644
    638 --- a/drivers/infiniband/hw/qib/qib_mad.c
    639 +++ b/drivers/infiniband/hw/qib/qib_mad.c
    640 @@ -1028,7 +1028,7 @@ static int set_pkeys(struct qib_devdata *dd, u8 port, u16 *pkeys)
    641
    642 event.event = IB_EVENT_PKEY_CHANGE;
    643 event.device = &dd->verbs_dev.ibdev;
    644 - event.element.port_num = 1;
    645 + event.element.port_num = port;
    646 ib_dispatch_event(&event);
    647 }
    648 return 0;
    649 diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c
    650 index 793ac5dcee71..1954daac0b59 100644
    651 --- a/drivers/infiniband/ulp/srp/ib_srp.c
    652 +++ b/drivers/infiniband/ulp/srp/ib_srp.c
    653 @@ -1409,6 +1409,12 @@ err_unmap:
    654 err_iu:
    655 srp_put_tx_iu(target, iu, SRP_IU_CMD);
    656
    657 + /*
    658 + * Avoid that the loops that iterate over the request ring can
    659 + * encounter a dangling SCSI command pointer.
    660 + */
    661 + req->scmnd = NULL;
    662 +
    663 spin_lock_irqsave(&target->lock, flags);
    664 list_add(&req->list, &target->free_reqs);
    665
    666 diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
    667 index 76f1d37ac0ff..1913301df08f 100644
    668 --- a/drivers/input/mouse/elantech.c
    669 +++ b/drivers/input/mouse/elantech.c
    670 @@ -473,8 +473,15 @@ static void elantech_report_absolute_v3(struct psmouse *psmouse,
    671 input_report_key(dev, BTN_TOOL_FINGER, fingers == 1);
    672 input_report_key(dev, BTN_TOOL_DOUBLETAP, fingers == 2);
    673 input_report_key(dev, BTN_TOOL_TRIPLETAP, fingers == 3);
    674 - input_report_key(dev, BTN_LEFT, packet[0] & 0x01);
    675 - input_report_key(dev, BTN_RIGHT, packet[0] & 0x02);
    676 +
    677 + /* For clickpads map both buttons to BTN_LEFT */
    678 + if (etd->fw_version & 0x001000) {
    679 + input_report_key(dev, BTN_LEFT, packet[0] & 0x03);
    680 + } else {
    681 + input_report_key(dev, BTN_LEFT, packet[0] & 0x01);
    682 + input_report_key(dev, BTN_RIGHT, packet[0] & 0x02);
    683 + }
    684 +
    685 input_report_abs(dev, ABS_PRESSURE, pres);
    686 input_report_abs(dev, ABS_TOOL_WIDTH, width);
    687
    688 @@ -484,10 +491,17 @@ static void elantech_report_absolute_v3(struct psmouse *psmouse,
    689 static void elantech_input_sync_v4(struct psmouse *psmouse)
    690 {
    691 struct input_dev *dev = psmouse->dev;
    692 + struct elantech_data *etd = psmouse->private;
    693 unsigned char *packet = psmouse->packet;
    694
    695 - input_report_key(dev, BTN_LEFT, packet[0] & 0x01);
    696 - input_report_key(dev, BTN_RIGHT, packet[0] & 0x02);
    697 + /* For clickpads map both buttons to BTN_LEFT */
    698 + if (etd->fw_version & 0x001000) {
    699 + input_report_key(dev, BTN_LEFT, packet[0] & 0x03);
    700 + } else {
    701 + input_report_key(dev, BTN_LEFT, packet[0] & 0x01);
    702 + input_report_key(dev, BTN_RIGHT, packet[0] & 0x02);
    703 + }
    704 +
    705 input_mt_report_pointer_emulation(dev, true);
    706 input_sync(dev);
    707 }
    708 @@ -805,7 +819,7 @@ static int elantech_set_absolute_mode(struct psmouse *psmouse)
    709 if (etd->set_hw_resolution)
    710 etd->reg_10 = 0x0b;
    711 else
    712 - etd->reg_10 = 0x03;
    713 + etd->reg_10 = 0x01;
    714
    715 if (elantech_write_reg(psmouse, 0x10, etd->reg_10))
    716 rc = -1;
    717 @@ -1306,7 +1320,8 @@ static int elantech_reconnect(struct psmouse *psmouse)
    718 }
    719
    720 /*
    721 - * Some hw_version 3 models go into error state when we try to set bit 3 of r10
    722 + * Some hw_version 3 models go into error state when we try to set
    723 + * bit 3 and/or bit 1 of r10.
    724 */
    725 static const struct dmi_system_id no_hw_res_dmi_table[] = {
    726 #if defined(CONFIG_DMI) && defined(CONFIG_X86)
    727 diff --git a/drivers/misc/mei/hw-me.c b/drivers/misc/mei/hw-me.c
    728 index 06311c5ada36..297cc10a26da 100644
    729 --- a/drivers/misc/mei/hw-me.c
    730 +++ b/drivers/misc/mei/hw-me.c
    731 @@ -164,6 +164,9 @@ static void mei_me_hw_reset_release(struct mei_device *dev)
    732 hcsr |= H_IG;
    733 hcsr &= ~H_RST;
    734 mei_hcsr_set(hw, hcsr);
    735 +
    736 + /* complete this write before we set host ready on another CPU */
    737 + mmiowb();
    738 }
    739 /**
    740 * mei_me_hw_reset - resets fw via mei csr register.
    741 @@ -186,7 +189,19 @@ static void mei_me_hw_reset(struct mei_device *dev, bool intr_enable)
    742 dev->recvd_hw_ready = false;
    743 mei_me_reg_write(hw, H_CSR, hcsr);
    744
    745 - if (dev->dev_state == MEI_DEV_POWER_DOWN)
    746 + /*
    747 + * Host reads the H_CSR once to ensure that the
    748 + * posted write to H_CSR completes.
    749 + */
    750 + hcsr = mei_hcsr_read(hw);
    751 +
    752 + if ((hcsr & H_RST) == 0)
    753 + dev_warn(&dev->pdev->dev, "H_RST is not set = 0x%08X", hcsr);
    754 +
    755 + if ((hcsr & H_RDY) == H_RDY)
    756 + dev_warn(&dev->pdev->dev, "H_RDY is not cleared 0x%08X", hcsr);
    757 +
    758 + if (intr_enable == false)
    759 mei_me_hw_reset_release(dev);
    760
    761 dev_dbg(&dev->pdev->dev, "current HCSR = 0x%08x.\n", mei_hcsr_read(hw));
    762 @@ -202,6 +217,7 @@ static void mei_me_hw_reset(struct mei_device *dev, bool intr_enable)
    763 static void mei_me_host_set_ready(struct mei_device *dev)
    764 {
    765 struct mei_me_hw *hw = to_me_hw(dev);
    766 + hw->host_hw_state = mei_hcsr_read(hw);
    767 hw->host_hw_state |= H_IE | H_IG | H_RDY;
    768 mei_hcsr_set(hw, hw->host_hw_state);
    769 }
    770 @@ -494,19 +510,15 @@ irqreturn_t mei_me_irq_thread_handler(int irq, void *dev_id)
    771 /* check if we need to start the dev */
    772 if (!mei_host_is_ready(dev)) {
    773 if (mei_hw_is_ready(dev)) {
    774 + mei_me_hw_reset_release(dev);
    775 dev_dbg(&dev->pdev->dev, "we need to start the dev.\n");
    776
    777 dev->recvd_hw_ready = true;
    778 wake_up_interruptible(&dev->wait_hw_ready);
    779 -
    780 - mutex_unlock(&dev->device_lock);
    781 - return IRQ_HANDLED;
    782 } else {
    783 - dev_dbg(&dev->pdev->dev, "Reset Completed.\n");
    784 - mei_me_hw_reset_release(dev);
    785 - mutex_unlock(&dev->device_lock);
    786 - return IRQ_HANDLED;
    787 + dev_dbg(&dev->pdev->dev, "Spurious Interrupt\n");
    788 }
    789 + goto end;
    790 }
    791 /* check slots available for reading */
    792 slots = mei_count_full_read_slots(dev);
    793 diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
    794 index f30acaa84037..d6ceb2e45c59 100644
    795 --- a/drivers/pci/pci.c
    796 +++ b/drivers/pci/pci.c
    797 @@ -3659,7 +3659,7 @@ int pci_set_vga_state(struct pci_dev *dev, bool decode,
    798 u16 cmd;
    799 int rc;
    800
    801 - WARN_ON((flags & PCI_VGA_STATE_CHANGE_DECODES) & (command_bits & ~(PCI_COMMAND_IO|PCI_COMMAND_MEMORY)));
    802 + WARN_ON((flags & PCI_VGA_STATE_CHANGE_DECODES) && (command_bits & ~(PCI_COMMAND_IO|PCI_COMMAND_MEMORY)));
    803
    804 /* ARCH specific VGA enables */
    805 rc = pci_set_vga_state_arch(dev, decode, command_bits, flags);
    806 diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c
    807 index df4655c5c138..4510279e28dc 100644
    808 --- a/drivers/pci/quirks.c
    809 +++ b/drivers/pci/quirks.c
    810 @@ -2930,6 +2930,7 @@ static void disable_igfx_irq(struct pci_dev *dev)
    811 }
    812 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0102, disable_igfx_irq);
    813 DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x010a, disable_igfx_irq);
    814 +DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0152, disable_igfx_irq);
    815
    816 /*
    817 * Some devices may pass our check in pci_intx_mask_supported if
    818 diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
    819 index 72663ba228dc..799f84e686b5 100644
    820 --- a/drivers/target/iscsi/iscsi_target.c
    821 +++ b/drivers/target/iscsi/iscsi_target.c
    822 @@ -1313,7 +1313,7 @@ iscsit_check_dataout_hdr(struct iscsi_conn *conn, unsigned char *buf,
    823 if (cmd->data_direction != DMA_TO_DEVICE) {
    824 pr_err("Command ITT: 0x%08x received DataOUT for a"
    825 " NON-WRITE command.\n", cmd->init_task_tag);
    826 - return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR, buf);
    827 + return iscsit_dump_data_payload(conn, payload_length, 1);
    828 }
    829 se_cmd = &cmd->se_cmd;
    830 iscsit_mod_dataout_timer(cmd);
    831 diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c
    832 index 77dad2474c8c..c9790f6fdd89 100644
    833 --- a/drivers/target/iscsi/iscsi_target_util.c
    834 +++ b/drivers/target/iscsi/iscsi_target_util.c
    835 @@ -1288,6 +1288,8 @@ int iscsit_tx_login_rsp(struct iscsi_conn *conn, u8 status_class, u8 status_deta
    836 login->login_failed = 1;
    837 iscsit_collect_login_stats(conn, status_class, status_detail);
    838
    839 + memset(&login->rsp[0], 0, ISCSI_HDR_LEN);
    840 +
    841 hdr = (struct iscsi_login_rsp *)&login->rsp[0];
    842 hdr->opcode = ISCSI_OP_LOGIN_RSP;
    843 hdr->status_class = status_class;
    844 diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
    845 index 8032917b6636..68398753eb82 100644
    846 --- a/drivers/target/target_core_device.c
    847 +++ b/drivers/target/target_core_device.c
    848 @@ -614,6 +614,7 @@ void core_dev_unexport(
    849 dev->export_count--;
    850 spin_unlock(&hba->device_lock);
    851
    852 + lun->lun_sep = NULL;
    853 lun->lun_se_dev = NULL;
    854 }
    855
    856 diff --git a/drivers/watchdog/ath79_wdt.c b/drivers/watchdog/ath79_wdt.c
    857 index 37cb09b27b63..c97a47ca8971 100644
    858 --- a/drivers/watchdog/ath79_wdt.c
    859 +++ b/drivers/watchdog/ath79_wdt.c
    860 @@ -20,6 +20,7 @@
    861 #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
    862
    863 #include <linux/bitops.h>
    864 +#include <linux/delay.h>
    865 #include <linux/errno.h>
    866 #include <linux/fs.h>
    867 #include <linux/init.h>
    868 @@ -91,6 +92,15 @@ static inline void ath79_wdt_keepalive(void)
    869 static inline void ath79_wdt_enable(void)
    870 {
    871 ath79_wdt_keepalive();
    872 +
    873 + /*
    874 + * Updating the TIMER register requires a few microseconds
    875 + * on the AR934x SoCs at least. Use a small delay to ensure
    876 + * that the TIMER register is updated within the hardware
    877 + * before enabling the watchdog.
    878 + */
    879 + udelay(2);
    880 +
    881 ath79_wdt_wr(WDOG_REG_CTRL, WDOG_CTRL_ACTION_FCR);
    882 /* flush write */
    883 ath79_wdt_rr(WDOG_REG_CTRL);
    884 diff --git a/drivers/watchdog/sp805_wdt.c b/drivers/watchdog/sp805_wdt.c
    885 index 8872642505c0..e42118213ba5 100644
    886 --- a/drivers/watchdog/sp805_wdt.c
    887 +++ b/drivers/watchdog/sp805_wdt.c
    888 @@ -60,7 +60,6 @@
    889 * @adev: amba device structure of wdt
    890 * @status: current status of wdt
    891 * @load_val: load value to be set for current timeout
    892 - * @timeout: current programmed timeout
    893 */
    894 struct sp805_wdt {
    895 struct watchdog_device wdd;
    896 @@ -69,7 +68,6 @@ struct sp805_wdt {
    897 struct clk *clk;
    898 struct amba_device *adev;
    899 unsigned int load_val;
    900 - unsigned int timeout;
    901 };
    902
    903 static bool nowayout = WATCHDOG_NOWAYOUT;
    904 @@ -99,7 +97,7 @@ static int wdt_setload(struct watchdog_device *wdd, unsigned int timeout)
    905 spin_lock(&wdt->lock);
    906 wdt->load_val = load;
    907 /* roundup timeout to closest positive integer value */
    908 - wdt->timeout = div_u64((load + 1) * 2 + (rate / 2), rate);
    909 + wdd->timeout = div_u64((load + 1) * 2 + (rate / 2), rate);
    910 spin_unlock(&wdt->lock);
    911
    912 return 0;
    913 diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c
    914 index c1c7a9d78722..cd4b9073dd20 100644
    915 --- a/fs/nfs/inode.c
    916 +++ b/fs/nfs/inode.c
    917 @@ -1382,18 +1382,20 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
    918 inode->i_version = fattr->change_attr;
    919 }
    920 } else if (server->caps & NFS_CAP_CHANGE_ATTR)
    921 - invalid |= save_cache_validity;
    922 + nfsi->cache_validity |= save_cache_validity;
    923
    924 if (fattr->valid & NFS_ATTR_FATTR_MTIME) {
    925 memcpy(&inode->i_mtime, &fattr->mtime, sizeof(inode->i_mtime));
    926 } else if (server->caps & NFS_CAP_MTIME)
    927 - invalid |= save_cache_validity & (NFS_INO_INVALID_ATTR
    928 + nfsi->cache_validity |= save_cache_validity &
    929 + (NFS_INO_INVALID_ATTR
    930 | NFS_INO_REVAL_FORCED);
    931
    932 if (fattr->valid & NFS_ATTR_FATTR_CTIME) {
    933 memcpy(&inode->i_ctime, &fattr->ctime, sizeof(inode->i_ctime));
    934 } else if (server->caps & NFS_CAP_CTIME)
    935 - invalid |= save_cache_validity & (NFS_INO_INVALID_ATTR
    936 + nfsi->cache_validity |= save_cache_validity &
    937 + (NFS_INO_INVALID_ATTR
    938 | NFS_INO_REVAL_FORCED);
    939
    940 /* Check if our cached file size is stale */
    941 @@ -1416,7 +1418,8 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
    942 (long long)new_isize);
    943 }
    944 } else
    945 - invalid |= save_cache_validity & (NFS_INO_INVALID_ATTR
    946 + nfsi->cache_validity |= save_cache_validity &
    947 + (NFS_INO_INVALID_ATTR
    948 | NFS_INO_REVAL_PAGECACHE
    949 | NFS_INO_REVAL_FORCED);
    950
    951 @@ -1424,7 +1427,8 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
    952 if (fattr->valid & NFS_ATTR_FATTR_ATIME)
    953 memcpy(&inode->i_atime, &fattr->atime, sizeof(inode->i_atime));
    954 else if (server->caps & NFS_CAP_ATIME)
    955 - invalid |= save_cache_validity & (NFS_INO_INVALID_ATIME
    956 + nfsi->cache_validity |= save_cache_validity &
    957 + (NFS_INO_INVALID_ATIME
    958 | NFS_INO_REVAL_FORCED);
    959
    960 if (fattr->valid & NFS_ATTR_FATTR_MODE) {
    961 @@ -1435,7 +1439,8 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
    962 invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL;
    963 }
    964 } else if (server->caps & NFS_CAP_MODE)
    965 - invalid |= save_cache_validity & (NFS_INO_INVALID_ATTR
    966 + nfsi->cache_validity |= save_cache_validity &
    967 + (NFS_INO_INVALID_ATTR
    968 | NFS_INO_INVALID_ACCESS
    969 | NFS_INO_INVALID_ACL
    970 | NFS_INO_REVAL_FORCED);
    971 @@ -1446,7 +1451,8 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
    972 inode->i_uid = fattr->uid;
    973 }
    974 } else if (server->caps & NFS_CAP_OWNER)
    975 - invalid |= save_cache_validity & (NFS_INO_INVALID_ATTR
    976 + nfsi->cache_validity |= save_cache_validity &
    977 + (NFS_INO_INVALID_ATTR
    978 | NFS_INO_INVALID_ACCESS
    979 | NFS_INO_INVALID_ACL
    980 | NFS_INO_REVAL_FORCED);
    981 @@ -1457,7 +1463,8 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
    982 inode->i_gid = fattr->gid;
    983 }
    984 } else if (server->caps & NFS_CAP_OWNER_GROUP)
    985 - invalid |= save_cache_validity & (NFS_INO_INVALID_ATTR
    986 + nfsi->cache_validity |= save_cache_validity &
    987 + (NFS_INO_INVALID_ATTR
    988 | NFS_INO_INVALID_ACCESS
    989 | NFS_INO_INVALID_ACL
    990 | NFS_INO_REVAL_FORCED);
    991 @@ -1470,7 +1477,8 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr)
    992 set_nlink(inode, fattr->nlink);
    993 }
    994 } else if (server->caps & NFS_CAP_NLINK)
    995 - invalid |= save_cache_validity & (NFS_INO_INVALID_ATTR
    996 + nfsi->cache_validity |= save_cache_validity &
    997 + (NFS_INO_INVALID_ATTR
    998 | NFS_INO_REVAL_FORCED);
    999
    1000 if (fattr->valid & NFS_ATTR_FATTR_SPACE_USED) {
    1001 diff --git a/fs/nfs/nfs4filelayout.c b/fs/nfs/nfs4filelayout.c
    1002 index 22d10623f5ee..b039f7f26d95 100644
    1003 --- a/fs/nfs/nfs4filelayout.c
    1004 +++ b/fs/nfs/nfs4filelayout.c
    1005 @@ -1300,7 +1300,7 @@ filelayout_alloc_layout_hdr(struct inode *inode, gfp_t gfp_flags)
    1006 struct nfs4_filelayout *flo;
    1007
    1008 flo = kzalloc(sizeof(*flo), gfp_flags);
    1009 - return &flo->generic_hdr;
    1010 + return flo != NULL ? &flo->generic_hdr : NULL;
    1011 }
    1012
    1013 static void
    1014 diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
    1015 index ae6a50b7a617..bdff771057d3 100644
    1016 --- a/fs/nfsd/nfs4state.c
    1017 +++ b/fs/nfsd/nfs4state.c
    1018 @@ -3608,7 +3608,7 @@ nfsd4_free_lock_stateid(struct nfs4_ol_stateid *stp)
    1019 * correspondance, and we have to delete the lockowner when we
    1020 * delete the lock stateid:
    1021 */
    1022 - unhash_lockowner(lo);
    1023 + release_lockowner(lo);
    1024 return nfs_ok;
    1025 }
    1026
    1027 diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c
    1028 index 5188a38fef06..d4890a96421e 100644
    1029 --- a/fs/nfsd/nfs4xdr.c
    1030 +++ b/fs/nfsd/nfs4xdr.c
    1031 @@ -2035,8 +2035,8 @@ nfsd4_encode_fattr(struct svc_fh *fhp, struct svc_export *exp,
    1032 err = vfs_getattr(&path, &stat);
    1033 if (err)
    1034 goto out_nfserr;
    1035 - if ((bmval0 & (FATTR4_WORD0_FILES_FREE | FATTR4_WORD0_FILES_TOTAL |
    1036 - FATTR4_WORD0_MAXNAME)) ||
    1037 + if ((bmval0 & (FATTR4_WORD0_FILES_AVAIL | FATTR4_WORD0_FILES_FREE |
    1038 + FATTR4_WORD0_FILES_TOTAL | FATTR4_WORD0_MAXNAME)) ||
    1039 (bmval1 & (FATTR4_WORD1_SPACE_AVAIL | FATTR4_WORD1_SPACE_FREE |
    1040 FATTR4_WORD1_SPACE_TOTAL))) {
    1041 err = vfs_statfs(&path, &statfs);
    1042 diff --git a/fs/nfsd/nfscache.c b/fs/nfsd/nfscache.c
    1043 index ec8d97ddc635..e5e4675b7e75 100644
    1044 --- a/fs/nfsd/nfscache.c
    1045 +++ b/fs/nfsd/nfscache.c
    1046 @@ -129,13 +129,6 @@ nfsd_reply_cache_alloc(void)
    1047 }
    1048
    1049 static void
    1050 -nfsd_reply_cache_unhash(struct svc_cacherep *rp)
    1051 -{
    1052 - hlist_del_init(&rp->c_hash);
    1053 - list_del_init(&rp->c_lru);
    1054 -}
    1055 -
    1056 -static void
    1057 nfsd_reply_cache_free_locked(struct svc_cacherep *rp)
    1058 {
    1059 if (rp->c_type == RC_REPLBUFF && rp->c_replvec.iov_base) {
    1060 @@ -228,13 +221,6 @@ hash_refile(struct svc_cacherep *rp)
    1061 hlist_add_head(&rp->c_hash, cache_hash + hash_32(rp->c_xid, maskbits));
    1062 }
    1063
    1064 -static inline bool
    1065 -nfsd_cache_entry_expired(struct svc_cacherep *rp)
    1066 -{
    1067 - return rp->c_state != RC_INPROG &&
    1068 - time_after(jiffies, rp->c_timestamp + RC_EXPIRE);
    1069 -}
    1070 -
    1071 /*
    1072 * Walk the LRU list and prune off entries that are older than RC_EXPIRE.
    1073 * Also prune the oldest ones when the total exceeds the max number of entries.
    1074 @@ -245,8 +231,14 @@ prune_cache_entries(void)
    1075 struct svc_cacherep *rp, *tmp;
    1076
    1077 list_for_each_entry_safe(rp, tmp, &lru_head, c_lru) {
    1078 - if (!nfsd_cache_entry_expired(rp) &&
    1079 - num_drc_entries <= max_drc_entries)
    1080 + /*
    1081 + * Don't free entries attached to calls that are still
    1082 + * in-progress, but do keep scanning the list.
    1083 + */
    1084 + if (rp->c_state == RC_INPROG)
    1085 + continue;
    1086 + if (num_drc_entries <= max_drc_entries &&
    1087 + time_before(jiffies, rp->c_timestamp + RC_EXPIRE))
    1088 break;
    1089 nfsd_reply_cache_free_locked(rp);
    1090 }
    1091 @@ -402,22 +394,8 @@ nfsd_cache_lookup(struct svc_rqst *rqstp)
    1092
    1093 /*
    1094 * Since the common case is a cache miss followed by an insert,
    1095 - * preallocate an entry. First, try to reuse the first entry on the LRU
    1096 - * if it works, then go ahead and prune the LRU list.
    1097 + * preallocate an entry.
    1098 */
    1099 - spin_lock(&cache_lock);
    1100 - if (!list_empty(&lru_head)) {
    1101 - rp = list_first_entry(&lru_head, struct svc_cacherep, c_lru);
    1102 - if (nfsd_cache_entry_expired(rp) ||
    1103 - num_drc_entries >= max_drc_entries) {
    1104 - nfsd_reply_cache_unhash(rp);
    1105 - prune_cache_entries();
    1106 - goto search_cache;
    1107 - }
    1108 - }
    1109 -
    1110 - /* No expired ones available, allocate a new one. */
    1111 - spin_unlock(&cache_lock);
    1112 rp = nfsd_reply_cache_alloc();
    1113 spin_lock(&cache_lock);
    1114 if (likely(rp)) {
    1115 @@ -425,7 +403,9 @@ nfsd_cache_lookup(struct svc_rqst *rqstp)
    1116 drc_mem_usage += sizeof(*rp);
    1117 }
    1118
    1119 -search_cache:
    1120 + /* go ahead and prune the cache */
    1121 + prune_cache_entries();
    1122 +
    1123 found = nfsd_cache_search(rqstp, csum);
    1124 if (found) {
    1125 if (likely(rp))
    1126 @@ -439,15 +419,6 @@ search_cache:
    1127 goto out;
    1128 }
    1129
    1130 - /*
    1131 - * We're keeping the one we just allocated. Are we now over the
    1132 - * limit? Prune one off the tip of the LRU in trade for the one we
    1133 - * just allocated if so.
    1134 - */
    1135 - if (num_drc_entries >= max_drc_entries)
    1136 - nfsd_reply_cache_free_locked(list_first_entry(&lru_head,
    1137 - struct svc_cacherep, c_lru));
    1138 -
    1139 nfsdstats.rcmisses++;
    1140 rqstp->rq_cacherep = rp;
    1141 rp->c_state = RC_INPROG;
    1142 diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c
    1143 index f844533792ee..36166443bc45 100644
    1144 --- a/fs/reiserfs/inode.c
    1145 +++ b/fs/reiserfs/inode.c
    1146 @@ -3211,8 +3211,14 @@ int reiserfs_setattr(struct dentry *dentry, struct iattr *attr)
    1147 attr->ia_size != i_size_read(inode)) {
    1148 error = inode_newsize_ok(inode, attr->ia_size);
    1149 if (!error) {
    1150 + /*
    1151 + * Could race against reiserfs_file_release
    1152 + * if called from NFS, so take tailpack mutex.
    1153 + */
    1154 + mutex_lock(&REISERFS_I(inode)->tailpack);
    1155 truncate_setsize(inode, attr->ia_size);
    1156 - reiserfs_vfs_truncate_file(inode);
    1157 + reiserfs_truncate_file(inode, 1);
    1158 + mutex_unlock(&REISERFS_I(inode)->tailpack);
    1159 }
    1160 }
    1161
    1162 diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c
    1163 index 14374530784c..881324c08430 100644
    1164 --- a/fs/ubifs/file.c
    1165 +++ b/fs/ubifs/file.c
    1166 @@ -1524,8 +1524,7 @@ static int ubifs_vm_page_mkwrite(struct vm_area_struct *vma,
    1167 }
    1168
    1169 wait_for_stable_page(page);
    1170 - unlock_page(page);
    1171 - return 0;
    1172 + return VM_FAULT_LOCKED;
    1173
    1174 out_unlock:
    1175 unlock_page(page);
    1176 diff --git a/fs/ubifs/shrinker.c b/fs/ubifs/shrinker.c
    1177 index 9e1d05666fed..e0a7a764a903 100644
    1178 --- a/fs/ubifs/shrinker.c
    1179 +++ b/fs/ubifs/shrinker.c
    1180 @@ -128,7 +128,6 @@ static int shrink_tnc(struct ubifs_info *c, int nr, int age, int *contention)
    1181 freed = ubifs_destroy_tnc_subtree(znode);
    1182 atomic_long_sub(freed, &ubifs_clean_zn_cnt);
    1183 atomic_long_sub(freed, &c->clean_zn_cnt);
    1184 - ubifs_assert(atomic_long_read(&c->clean_zn_cnt) >= 0);
    1185 total_freed += freed;
    1186 znode = zprev;
    1187 }
    1188 diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h
    1189 index 2e99b8e08770..bb980ae6d9d3 100644
    1190 --- a/include/linux/ptrace.h
    1191 +++ b/include/linux/ptrace.h
    1192 @@ -337,6 +337,9 @@ static inline void user_single_step_siginfo(struct task_struct *tsk,
    1193 * calling arch_ptrace_stop() when it would be superfluous. For example,
    1194 * if the thread has not been back to user mode since the last stop, the
    1195 * thread state might indicate that nothing needs to be done.
    1196 + *
    1197 + * This is guaranteed to be invoked once before a task stops for ptrace and
    1198 + * may include arch-specific operations necessary prior to a ptrace stop.
    1199 */
    1200 #define arch_ptrace_stop_needed(code, info) (0)
    1201 #endif
    1202 diff --git a/include/trace/syscall.h b/include/trace/syscall.h
    1203 index 84bc4197e736..0a5b4952aa30 100644
    1204 --- a/include/trace/syscall.h
    1205 +++ b/include/trace/syscall.h
    1206 @@ -4,6 +4,7 @@
    1207 #include <linux/tracepoint.h>
    1208 #include <linux/unistd.h>
    1209 #include <linux/ftrace_event.h>
    1210 +#include <linux/thread_info.h>
    1211
    1212 #include <asm/ptrace.h>
    1213
    1214 @@ -31,4 +32,18 @@ struct syscall_metadata {
    1215 struct ftrace_event_call *exit_event;
    1216 };
    1217
    1218 +#if defined(CONFIG_TRACEPOINTS) && defined(CONFIG_HAVE_SYSCALL_TRACEPOINTS)
    1219 +static inline void syscall_tracepoint_update(struct task_struct *p)
    1220 +{
    1221 + if (test_thread_flag(TIF_SYSCALL_TRACEPOINT))
    1222 + set_tsk_thread_flag(p, TIF_SYSCALL_TRACEPOINT);
    1223 + else
    1224 + clear_tsk_thread_flag(p, TIF_SYSCALL_TRACEPOINT);
    1225 +}
    1226 +#else
    1227 +static inline void syscall_tracepoint_update(struct task_struct *p)
    1228 +{
    1229 +}
    1230 +#endif
    1231 +
    1232 #endif /* _TRACE_SYSCALL_H */
    1233 diff --git a/kernel/fork.c b/kernel/fork.c
    1234 index 270c1dab674a..814363a69b80 100644
    1235 --- a/kernel/fork.c
    1236 +++ b/kernel/fork.c
    1237 @@ -1479,7 +1479,9 @@ static struct task_struct *copy_process(unsigned long clone_flags,
    1238
    1239 total_forks++;
    1240 spin_unlock(&current->sighand->siglock);
    1241 + syscall_tracepoint_update(p);
    1242 write_unlock_irq(&tasklist_lock);
    1243 +
    1244 proc_fork_connector(p);
    1245 cgroup_post_fork(p);
    1246 if (clone_flags & CLONE_THREAD)
    1247 diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
    1248 index 6dbdf277c8fe..60f49637b4d5 100644
    1249 --- a/kernel/trace/trace.c
    1250 +++ b/kernel/trace/trace.c
    1251 @@ -1400,12 +1400,12 @@ static void tracing_stop_tr(struct trace_array *tr)
    1252
    1253 void trace_stop_cmdline_recording(void);
    1254
    1255 -static void trace_save_cmdline(struct task_struct *tsk)
    1256 +static int trace_save_cmdline(struct task_struct *tsk)
    1257 {
    1258 unsigned pid, idx;
    1259
    1260 if (!tsk->pid || unlikely(tsk->pid > PID_MAX_DEFAULT))
    1261 - return;
    1262 + return 0;
    1263
    1264 /*
    1265 * It's not the end of the world if we don't get
    1266 @@ -1414,7 +1414,7 @@ static void trace_save_cmdline(struct task_struct *tsk)
    1267 * so if we miss here, then better luck next time.
    1268 */
    1269 if (!arch_spin_trylock(&trace_cmdline_lock))
    1270 - return;
    1271 + return 0;
    1272
    1273 idx = map_pid_to_cmdline[tsk->pid];
    1274 if (idx == NO_CMDLINE_MAP) {
    1275 @@ -1439,6 +1439,8 @@ static void trace_save_cmdline(struct task_struct *tsk)
    1276 memcpy(&saved_cmdlines[idx], tsk->comm, TASK_COMM_LEN);
    1277
    1278 arch_spin_unlock(&trace_cmdline_lock);
    1279 +
    1280 + return 1;
    1281 }
    1282
    1283 void trace_find_cmdline(int pid, char comm[])
    1284 @@ -1480,9 +1482,8 @@ void tracing_record_cmdline(struct task_struct *tsk)
    1285 if (!__this_cpu_read(trace_cmdline_save))
    1286 return;
    1287
    1288 - __this_cpu_write(trace_cmdline_save, false);
    1289 -
    1290 - trace_save_cmdline(tsk);
    1291 + if (trace_save_cmdline(tsk))
    1292 + __this_cpu_write(trace_cmdline_save, false);
    1293 }
    1294
    1295 void
    1296 diff --git a/net/ipv4/netfilter/ipt_ULOG.c b/net/ipv4/netfilter/ipt_ULOG.c
    1297 index 32b0e978c8e0..f8629c04f35b 100644
    1298 --- a/net/ipv4/netfilter/ipt_ULOG.c
    1299 +++ b/net/ipv4/netfilter/ipt_ULOG.c
    1300 @@ -220,6 +220,7 @@ static void ipt_ulog_packet(struct net *net,
    1301 ub->qlen++;
    1302
    1303 pm = nlmsg_data(nlh);
    1304 + memset(pm, 0, sizeof(*pm));
    1305
    1306 /* We might not have a timestamp, get one */
    1307 if (skb->tstamp.tv64 == 0)
    1308 @@ -238,8 +239,6 @@ static void ipt_ulog_packet(struct net *net,
    1309 }
    1310 else if (loginfo->prefix[0] != '\0')
    1311 strncpy(pm->prefix, loginfo->prefix, sizeof(pm->prefix));
    1312 - else
    1313 - *(pm->prefix) = '\0';
    1314
    1315 if (in && in->hard_header_len > 0 &&
    1316 skb->mac_header != skb->network_header &&
    1317 @@ -251,13 +250,9 @@ static void ipt_ulog_packet(struct net *net,
    1318
    1319 if (in)
    1320 strncpy(pm->indev_name, in->name, sizeof(pm->indev_name));
    1321 - else
    1322 - pm->indev_name[0] = '\0';
    1323
    1324 if (out)
    1325 strncpy(pm->outdev_name, out->name, sizeof(pm->outdev_name));
    1326 - else
    1327 - pm->outdev_name[0] = '\0';
    1328
    1329 /* copy_len <= skb->len, so can't fail. */
    1330 if (skb_copy_bits(skb, 0, pm->payload, copy_len) < 0)
    1331 diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
    1332 index 21a3a475d7cd..663042e84e81 100644
    1333 --- a/net/netfilter/ipvs/ip_vs_core.c
    1334 +++ b/net/netfilter/ipvs/ip_vs_core.c
    1335 @@ -1384,15 +1384,19 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum)
    1336
    1337 if (ipip) {
    1338 __be32 info = ic->un.gateway;
    1339 + __u8 type = ic->type;
    1340 + __u8 code = ic->code;
    1341
    1342 /* Update the MTU */
    1343 if (ic->type == ICMP_DEST_UNREACH &&
    1344 ic->code == ICMP_FRAG_NEEDED) {
    1345 struct ip_vs_dest *dest = cp->dest;
    1346 u32 mtu = ntohs(ic->un.frag.mtu);
    1347 + __be16 frag_off = cih->frag_off;
    1348
    1349 /* Strip outer IP and ICMP, go to IPIP header */
    1350 - __skb_pull(skb, ihl + sizeof(_icmph));
    1351 + if (pskb_pull(skb, ihl + sizeof(_icmph)) == NULL)
    1352 + goto ignore_ipip;
    1353 offset2 -= ihl + sizeof(_icmph);
    1354 skb_reset_network_header(skb);
    1355 IP_VS_DBG(12, "ICMP for IPIP %pI4->%pI4: mtu=%u\n",
    1356 @@ -1400,7 +1404,7 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum)
    1357 ipv4_update_pmtu(skb, dev_net(skb->dev),
    1358 mtu, 0, 0, 0, 0);
    1359 /* Client uses PMTUD? */
    1360 - if (!(cih->frag_off & htons(IP_DF)))
    1361 + if (!(frag_off & htons(IP_DF)))
    1362 goto ignore_ipip;
    1363 /* Prefer the resulting PMTU */
    1364 if (dest) {
    1365 @@ -1419,12 +1423,13 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum)
    1366 /* Strip outer IP, ICMP and IPIP, go to IP header of
    1367 * original request.
    1368 */
    1369 - __skb_pull(skb, offset2);
    1370 + if (pskb_pull(skb, offset2) == NULL)
    1371 + goto ignore_ipip;
    1372 skb_reset_network_header(skb);
    1373 IP_VS_DBG(12, "Sending ICMP for %pI4->%pI4: t=%u, c=%u, i=%u\n",
    1374 &ip_hdr(skb)->saddr, &ip_hdr(skb)->daddr,
    1375 - ic->type, ic->code, ntohl(info));
    1376 - icmp_send(skb, ic->type, ic->code, info);
    1377 + type, code, ntohl(info));
    1378 + icmp_send(skb, type, code, info);
    1379 /* ICMP can be shorter but anyways, account it */
    1380 ip_vs_out_stats(cp, skb);
    1381
    1382 diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c
    1383 index 80a6640f329b..b9aad4723a9d 100644
    1384 --- a/net/sunrpc/svc_xprt.c
    1385 +++ b/net/sunrpc/svc_xprt.c
    1386 @@ -730,6 +730,8 @@ static int svc_handle_xprt(struct svc_rqst *rqstp, struct svc_xprt *xprt)
    1387 newxpt = xprt->xpt_ops->xpo_accept(xprt);
    1388 if (newxpt)
    1389 svc_add_new_temp_xprt(serv, newxpt);
    1390 + else
    1391 + module_put(xprt->xpt_class->xcl_owner);
    1392 } else if (xprt->xpt_ops->xpo_has_wspace(xprt)) {
    1393 /* XPT_DATA|XPT_DEFERRED case: */
    1394 dprintk("svc: server %p, pool %u, transport %p, inuse=%d\n",
    1395 diff --git a/scripts/recordmcount.h b/scripts/recordmcount.h
    1396 index 9d1421e63ff8..49b582a225b0 100644
    1397 --- a/scripts/recordmcount.h
    1398 +++ b/scripts/recordmcount.h
    1399 @@ -163,11 +163,11 @@ static int mcount_adjust = 0;
    1400
    1401 static int MIPS_is_fake_mcount(Elf_Rel const *rp)
    1402 {
    1403 - static Elf_Addr old_r_offset;
    1404 + static Elf_Addr old_r_offset = ~(Elf_Addr)0;
    1405 Elf_Addr current_r_offset = _w(rp->r_offset);
    1406 int is_fake;
    1407
    1408 - is_fake = old_r_offset &&
    1409 + is_fake = (old_r_offset != ~(Elf_Addr)0) &&
    1410 (current_r_offset - old_r_offset == MIPS_FAKEMCOUNT_OFFSET);
    1411 old_r_offset = current_r_offset;
    1412