Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-3.10/0165-3.10.66-all-fixes.patch

    Annotation of /trunk/kernel-alx/patches-3.10/0165-3.10.66-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2653 - (hide annotations) (download)
    Tue Jul 21 16:20:22 2015 UTC (8 years, 10 months ago) by niro
    File size: 50783 byte(s) 
    -linux-3.10.66
    1 niro 2653 diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
    2     index 1311a48a7367..98da831a14ba 100644
    3     --- a/Documentation/kernel-parameters.txt
    4     +++ b/Documentation/kernel-parameters.txt
    5     @@ -1061,6 +1061,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
    6     i8042.notimeout [HW] Ignore timeout condition signalled by controller
    7     i8042.reset [HW] Reset the controller during init and cleanup
    8     i8042.unlock [HW] Unlock (ignore) the keylock
    9     + i8042.kbdreset [HW] Reset device connected to KBD port
    10    
    11     i810= [HW,DRM]
    12    
    13     diff --git a/Makefile b/Makefile
    14     index 7889b38766db..12ae1ef5437a 100644
    15     --- a/Makefile
    16     +++ b/Makefile
    17     @@ -1,6 +1,6 @@
    18     VERSION = 3
    19     PATCHLEVEL = 10
    20     -SUBLEVEL = 65
    21     +SUBLEVEL = 66
    22     EXTRAVERSION =
    23     NAME = TOSSUG Baby Fish
    24    
    25     diff --git a/arch/arc/boot/dts/nsimosci.dts b/arch/arc/boot/dts/nsimosci.dts
    26     index 398064cef746..4c169d825415 100644
    27     --- a/arch/arc/boot/dts/nsimosci.dts
    28     +++ b/arch/arc/boot/dts/nsimosci.dts
    29     @@ -20,7 +20,7 @@
    30     /* this is for console on PGU */
    31     /* bootargs = "console=tty0 consoleblank=0"; */
    32     /* this is for console on serial */
    33     - bootargs = "earlycon=uart8250,mmio32,0xc0000000,115200n8 console=tty0 console=ttyS0,115200n8 consoleblank=0 debug";
    34     + bootargs = "earlycon=uart8250,mmio32,0xf0000000,115200n8 console=tty0 console=ttyS0,115200n8 consoleblank=0 debug";
    35     };
    36    
    37     aliases {
    38     @@ -46,9 +46,9 @@
    39     #interrupt-cells = <1>;
    40     };
    41    
    42     - uart0: serial@c0000000 {
    43     + uart0: serial@f0000000 {
    44     compatible = "ns8250";
    45     - reg = <0xc0000000 0x2000>;
    46     + reg = <0xf0000000 0x2000>;
    47     interrupts = <11>;
    48     clock-frequency = <3686400>;
    49     baud = <115200>;
    50     @@ -57,21 +57,21 @@
    51     no-loopback-test = <1>;
    52     };
    53    
    54     - pgu0: pgu@c9000000 {
    55     + pgu0: pgu@f9000000 {
    56     compatible = "snps,arcpgufb";
    57     - reg = <0xc9000000 0x400>;
    58     + reg = <0xf9000000 0x400>;
    59     };
    60    
    61     - ps2: ps2@c9001000 {
    62     + ps2: ps2@f9001000 {
    63     compatible = "snps,arc_ps2";
    64     - reg = <0xc9000400 0x14>;
    65     + reg = <0xf9000400 0x14>;
    66     interrupts = <13>;
    67     interrupt-names = "arc_ps2_irq";
    68     };
    69    
    70     - eth0: ethernet@c0003000 {
    71     + eth0: ethernet@f0003000 {
    72     compatible = "snps,oscilan";
    73     - reg = <0xc0003000 0x44>;
    74     + reg = <0xf0003000 0x44>;
    75     interrupts = <7>, <8>;
    76     interrupt-names = "rx", "tx";
    77     };
    78     diff --git a/arch/arm/boot/dts/imx25.dtsi b/arch/arm/boot/dts/imx25.dtsi
    79     index 701153992c69..82897e2d8d5a 100644
    80     --- a/arch/arm/boot/dts/imx25.dtsi
    81     +++ b/arch/arm/boot/dts/imx25.dtsi
    82     @@ -141,7 +141,7 @@
    83     #size-cells = <0>;
    84     compatible = "fsl,imx25-cspi", "fsl,imx35-cspi";
    85     reg = <0x43fa4000 0x4000>;
    86     - clocks = <&clks 62>, <&clks 62>;
    87     + clocks = <&clks 78>, <&clks 78>;
    88     clock-names = "ipg", "per";
    89     interrupts = <14>;
    90     status = "disabled";
    91     diff --git a/arch/arm/mach-imx/clk-imx6q.c b/arch/arm/mach-imx/clk-imx6q.c
    92     index 0b9e437719bd..2acaded8025d 100644
    93     --- a/arch/arm/mach-imx/clk-imx6q.c
    94     +++ b/arch/arm/mach-imx/clk-imx6q.c
    95     @@ -301,8 +301,8 @@ int __init mx6q_clocks_init(void)
    96     post_div_table[1].div = 1;
    97     post_div_table[2].div = 1;
    98     video_div_table[1].div = 1;
    99     - video_div_table[2].div = 1;
    100     - };
    101     + video_div_table[3].div = 1;
    102     + }
    103    
    104     /* type name parent_name base div_mask */
    105     clk[pll1_sys] = imx_clk_pllv3(IMX_PLLV3_SYS, "pll1_sys", "osc", base, 0x7f);
    106     diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c
    107     index f8b23b8040d9..3f3259e74fd3 100644
    108     --- a/arch/arm/mach-omap2/timer.c
    109     +++ b/arch/arm/mach-omap2/timer.c
    110     @@ -503,11 +503,11 @@ static void __init realtime_counter_init(void)
    111     rate = clk_get_rate(sys_clk);
    112     /* Numerator/denumerator values refer TRM Realtime Counter section */
    113     switch (rate) {
    114     - case 1200000:
    115     + case 12000000:
    116     num = 64;
    117     den = 125;
    118     break;
    119     - case 1300000:
    120     + case 13000000:
    121     num = 768;
    122     den = 1625;
    123     break;
    124     @@ -515,11 +515,11 @@ static void __init realtime_counter_init(void)
    125     num = 8;
    126     den = 25;
    127     break;
    128     - case 2600000:
    129     + case 26000000:
    130     num = 384;
    131     den = 1625;
    132     break;
    133     - case 2700000:
    134     + case 27000000:
    135     num = 256;
    136     den = 1125;
    137     break;
    138     diff --git a/arch/arm/mach-shmobile/setup-sh73a0.c b/arch/arm/mach-shmobile/setup-sh73a0.c
    139     index 9696f3646864..ea788c8e32e8 100644
    140     --- a/arch/arm/mach-shmobile/setup-sh73a0.c
    141     +++ b/arch/arm/mach-shmobile/setup-sh73a0.c
    142     @@ -814,6 +814,7 @@ static struct platform_device ipmmu_device = {
    143    
    144     static struct renesas_intc_irqpin_config irqpin0_platform_data = {
    145     .irq_base = irq_pin(0), /* IRQ0 -> IRQ7 */
    146     + .control_parent = true,
    147     };
    148    
    149     static struct resource irqpin0_resources[] = {
    150     @@ -875,6 +876,7 @@ static struct platform_device irqpin1_device = {
    151    
    152     static struct renesas_intc_irqpin_config irqpin2_platform_data = {
    153     .irq_base = irq_pin(16), /* IRQ16 -> IRQ23 */
    154     + .control_parent = true,
    155     };
    156    
    157     static struct resource irqpin2_resources[] = {
    158     @@ -905,6 +907,7 @@ static struct platform_device irqpin2_device = {
    159    
    160     static struct renesas_intc_irqpin_config irqpin3_platform_data = {
    161     .irq_base = irq_pin(24), /* IRQ24 -> IRQ31 */
    162     + .control_parent = true,
    163     };
    164    
    165     static struct resource irqpin3_resources[] = {
    166     diff --git a/arch/um/Kconfig.common b/arch/um/Kconfig.common
    167     index bceee6623b00..d1ff46c0559b 100644
    168     --- a/arch/um/Kconfig.common
    169     +++ b/arch/um/Kconfig.common
    170     @@ -8,6 +8,7 @@ config UML
    171     default y
    172     select HAVE_GENERIC_HARDIRQS
    173     select HAVE_UID16
    174     + select HAVE_FUTEX_CMPXCHG if FUTEX
    175     select GENERIC_IRQ_SHOW
    176     select GENERIC_CPU_DEVICES
    177     select GENERIC_IO
    178     diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
    179     index 211bce445522..0c6c07cea3f7 100644
    180     --- a/arch/x86/kernel/kprobes/core.c
    181     +++ b/arch/x86/kernel/kprobes/core.c
    182     @@ -1017,6 +1017,15 @@ int __kprobes setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs)
    183     regs->flags &= ~X86_EFLAGS_IF;
    184     trace_hardirqs_off();
    185     regs->ip = (unsigned long)(jp->entry);
    186     +
    187     + /*
    188     + * jprobes use jprobe_return() which skips the normal return
    189     + * path of the function, and this messes up the accounting of the
    190     + * function graph tracer to get messed up.
    191     + *
    192     + * Pause function graph tracing while performing the jprobe function.
    193     + */
    194     + pause_graph_tracing();
    195     return 1;
    196     }
    197    
    198     @@ -1042,24 +1051,25 @@ int __kprobes longjmp_break_handler(struct kprobe *p, struct pt_regs *regs)
    199     struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
    200     u8 *addr = (u8 *) (regs->ip - 1);
    201     struct jprobe *jp = container_of(p, struct jprobe, kp);
    202     + void *saved_sp = kcb->jprobe_saved_sp;
    203    
    204     if ((addr > (u8 *) jprobe_return) &&
    205     (addr < (u8 *) jprobe_return_end)) {
    206     - if (stack_addr(regs) != kcb->jprobe_saved_sp) {
    207     + if (stack_addr(regs) != saved_sp) {
    208     struct pt_regs *saved_regs = &kcb->jprobe_saved_regs;
    209     printk(KERN_ERR
    210     "current sp %p does not match saved sp %p\n",
    211     - stack_addr(regs), kcb->jprobe_saved_sp);
    212     + stack_addr(regs), saved_sp);
    213     printk(KERN_ERR "Saved registers for jprobe %p\n", jp);
    214     show_regs(saved_regs);
    215     printk(KERN_ERR "Current registers\n");
    216     show_regs(regs);
    217     BUG();
    218     }
    219     + /* It's OK to start function graph tracing again */
    220     + unpause_graph_tracing();
    221     *regs = kcb->jprobe_saved_regs;
    222     - memcpy((kprobe_opcode_t *)(kcb->jprobe_saved_sp),
    223     - kcb->jprobes_stack,
    224     - MIN_STACK_SIZE(kcb->jprobe_saved_sp));
    225     + memcpy(saved_sp, kcb->jprobes_stack, MIN_STACK_SIZE(saved_sp));
    226     preempt_enable_no_resched();
    227     return 1;
    228     }
    229     diff --git a/arch/x86/um/sys_call_table_32.c b/arch/x86/um/sys_call_table_32.c
    230     index 531d4269e2e3..bd16d6c370ec 100644
    231     --- a/arch/x86/um/sys_call_table_32.c
    232     +++ b/arch/x86/um/sys_call_table_32.c
    233     @@ -34,7 +34,7 @@ typedef asmlinkage void (*sys_call_ptr_t)(void);
    234    
    235     extern asmlinkage void sys_ni_syscall(void);
    236    
    237     -const sys_call_ptr_t sys_call_table[] __cacheline_aligned = {
    238     +const sys_call_ptr_t sys_call_table[] ____cacheline_aligned = {
    239     /*
    240     * Smells like a compiler bug -- it doesn't work
    241     * when the & below is removed.
    242     diff --git a/arch/x86/um/sys_call_table_64.c b/arch/x86/um/sys_call_table_64.c
    243     index f2f0723070ca..95783087f0d3 100644
    244     --- a/arch/x86/um/sys_call_table_64.c
    245     +++ b/arch/x86/um/sys_call_table_64.c
    246     @@ -46,7 +46,7 @@ typedef void (*sys_call_ptr_t)(void);
    247    
    248     extern void sys_ni_syscall(void);
    249    
    250     -const sys_call_ptr_t sys_call_table[] __cacheline_aligned = {
    251     +const sys_call_ptr_t sys_call_table[] ____cacheline_aligned = {
    252     /*
    253     * Smells like a compiler bug -- it doesn't work
    254     * when the & below is removed.
    255     diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
    256     index 665f9530c950..af909a20dd70 100644
    257     --- a/drivers/gpio/gpiolib-of.c
    258     +++ b/drivers/gpio/gpiolib-of.c
    259     @@ -12,6 +12,7 @@
    260     */
    261    
    262     #include <linux/device.h>
    263     +#include <linux/err.h>
    264     #include <linux/errno.h>
    265     #include <linux/module.h>
    266     #include <linux/io.h>
    267     @@ -42,8 +43,14 @@ static int of_gpiochip_find_and_xlate(struct gpio_chip *gc, void *data)
    268     return false;
    269    
    270     ret = gc->of_xlate(gc, &gg_data->gpiospec, gg_data->flags);
    271     - if (ret < 0)
    272     - return false;
    273     + if (ret < 0) {
    274     + /* We've found the gpio chip, but the translation failed.
    275     + * Return true to stop looking and return the translation
    276     + * error via out_gpio
    277     + */
    278     + gg_data->out_gpio = ERR_PTR(ret);
    279     + return true;
    280     + }
    281    
    282     gg_data->out_gpio = ret + gc->base;
    283     return true;
    284     diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
    285     index 2d90f96c19d0..7695b5dd9d2d 100644
    286     --- a/drivers/gpu/drm/i915/i915_reg.h
    287     +++ b/drivers/gpu/drm/i915/i915_reg.h
    288     @@ -317,6 +317,7 @@
    289     #define PIPE_CONTROL_GLOBAL_GTT_IVB (1<<24) /* gen7+ */
    290     #define PIPE_CONTROL_CS_STALL (1<<20)
    291     #define PIPE_CONTROL_TLB_INVALIDATE (1<<18)
    292     +#define PIPE_CONTROL_MEDIA_STATE_CLEAR (1<<16)
    293     #define PIPE_CONTROL_QW_WRITE (1<<14)
    294     #define PIPE_CONTROL_DEPTH_STALL (1<<13)
    295     #define PIPE_CONTROL_WRITE_FLUSH (1<<12)
    296     diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
    297     index 4605c3877c95..ef4cde15c15c 100644
    298     --- a/drivers/gpu/drm/i915/intel_ringbuffer.c
    299     +++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
    300     @@ -314,12 +314,15 @@ gen7_render_ring_flush(struct intel_ring_buffer *ring,
    301     flags |= PIPE_CONTROL_VF_CACHE_INVALIDATE;
    302     flags |= PIPE_CONTROL_CONST_CACHE_INVALIDATE;
    303     flags |= PIPE_CONTROL_STATE_CACHE_INVALIDATE;
    304     + flags |= PIPE_CONTROL_MEDIA_STATE_CLEAR;
    305     /*
    306     * TLB invalidate requires a post-sync write.
    307     */
    308     flags |= PIPE_CONTROL_QW_WRITE;
    309     flags |= PIPE_CONTROL_GLOBAL_GTT_IVB;
    310    
    311     + flags |= PIPE_CONTROL_STALL_AT_SCOREBOARD;
    312     +
    313     /* Workaround: we must issue a pipe_control with CS-stall bit
    314     * set before a pipe_control command that has the state cache
    315     * invalidate bit set. */
    316     diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
    317     index 4c05f2b015cf..d4a5118911fd 100644
    318     --- a/drivers/gpu/drm/radeon/atombios_dp.c
    319     +++ b/drivers/gpu/drm/radeon/atombios_dp.c
    320     @@ -574,6 +574,10 @@ int radeon_dp_mode_valid_helper(struct drm_connector *connector,
    321     struct radeon_connector_atom_dig *dig_connector;
    322     int dp_clock;
    323    
    324     + if ((mode->clock > 340000) &&
    325     + (!radeon_connector_is_dp12_capable(connector)))
    326     + return MODE_CLOCK_HIGH;
    327     +
    328     if (!radeon_connector->con_priv)
    329     return MODE_CLOCK_HIGH;
    330     dig_connector = radeon_connector->con_priv;
    331     diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
    332     index 6c0ce8915fac..4a14e113369d 100644
    333     --- a/drivers/gpu/drm/radeon/radeon_ttm.c
    334     +++ b/drivers/gpu/drm/radeon/radeon_ttm.c
    335     @@ -189,7 +189,7 @@ static void radeon_evict_flags(struct ttm_buffer_object *bo,
    336     rbo = container_of(bo, struct radeon_bo, tbo);
    337     switch (bo->mem.mem_type) {
    338     case TTM_PL_VRAM:
    339     - if (rbo->rdev->ring[RADEON_RING_TYPE_GFX_INDEX].ready == false)
    340     + if (rbo->rdev->ring[radeon_copy_ring_index(rbo->rdev)].ready == false)
    341     radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_CPU);
    342     else
    343     radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_GTT);
    344     diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
    345     index c62d20e8a6f1..ee742f14ddc2 100644
    346     --- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
    347     +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
    348     @@ -1049,6 +1049,8 @@ int vmw_event_fence_action_create(struct drm_file *file_priv,
    349     if (ret != 0)
    350     goto out_no_queue;
    351    
    352     + return 0;
    353     +
    354     out_no_queue:
    355     event->base.destroy(&event->base);
    356     out_no_event:
    357     @@ -1123,17 +1125,10 @@ int vmw_fence_event_ioctl(struct drm_device *dev, void *data,
    358    
    359     BUG_ON(fence == NULL);
    360    
    361     - if (arg->flags & DRM_VMW_FE_FLAG_REQ_TIME)
    362     - ret = vmw_event_fence_action_create(file_priv, fence,
    363     - arg->flags,
    364     - arg->user_data,
    365     - true);
    366     - else
    367     - ret = vmw_event_fence_action_create(file_priv, fence,
    368     - arg->flags,
    369     - arg->user_data,
    370     - true);
    371     -
    372     + ret = vmw_event_fence_action_create(file_priv, fence,
    373     + arg->flags,
    374     + arg->user_data,
    375     + true);
    376     if (unlikely(ret != 0)) {
    377     if (ret != -ERESTARTSYS)
    378     DRM_ERROR("Failed to attach event to fence.\n");
    379     diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
    380     index ce715b1bee46..78227f32d6fa 100644
    381     --- a/drivers/input/serio/i8042-x86ia64io.h
    382     +++ b/drivers/input/serio/i8042-x86ia64io.h
    383     @@ -408,6 +408,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
    384     },
    385     },
    386     {
    387     + /* Acer Aspire 7738 */
    388     + .matches = {
    389     + DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
    390     + DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 7738"),
    391     + },
    392     + },
    393     + {
    394     /* Gericom Bellagio */
    395     .matches = {
    396     DMI_MATCH(DMI_SYS_VENDOR, "Gericom"),
    397     @@ -721,6 +728,35 @@ static const struct dmi_system_id __initconst i8042_dmi_dritek_table[] = {
    398     { }
    399     };
    400    
    401     +/*
    402     + * Some laptops need keyboard reset before probing for the trackpad to get
    403     + * it detected, initialised & finally work.
    404     + */
    405     +static const struct dmi_system_id __initconst i8042_dmi_kbdreset_table[] = {
    406     + {
    407     + /* Gigabyte P35 v2 - Elantech touchpad */
    408     + .matches = {
    409     + DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
    410     + DMI_MATCH(DMI_PRODUCT_NAME, "P35V2"),
    411     + },
    412     + },
    413     + {
    414     + /* Aorus branded Gigabyte X3 Plus - Elantech touchpad */
    415     + .matches = {
    416     + DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
    417     + DMI_MATCH(DMI_PRODUCT_NAME, "X3"),
    418     + },
    419     + },
    420     + {
    421     + /* Gigabyte P34 - Elantech touchpad */
    422     + .matches = {
    423     + DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
    424     + DMI_MATCH(DMI_PRODUCT_NAME, "P34"),
    425     + },
    426     + },
    427     + { }
    428     +};
    429     +
    430     #endif /* CONFIG_X86 */
    431    
    432     #ifdef CONFIG_PNP
    433     @@ -1001,6 +1037,9 @@ static int __init i8042_platform_init(void)
    434     if (dmi_check_system(i8042_dmi_dritek_table))
    435     i8042_dritek = true;
    436    
    437     + if (dmi_check_system(i8042_dmi_kbdreset_table))
    438     + i8042_kbdreset = true;
    439     +
    440     /*
    441     * A20 was already enabled during early kernel init. But some buggy
    442     * BIOSes (in MSI Laptops) require A20 to be enabled using 8042 to
    443     diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
    444     index 78e4de42efaa..9870c540e6fb 100644
    445     --- a/drivers/input/serio/i8042.c
    446     +++ b/drivers/input/serio/i8042.c
    447     @@ -67,6 +67,10 @@ static bool i8042_notimeout;
    448     module_param_named(notimeout, i8042_notimeout, bool, 0);
    449     MODULE_PARM_DESC(notimeout, "Ignore timeouts signalled by i8042");
    450    
    451     +static bool i8042_kbdreset;
    452     +module_param_named(kbdreset, i8042_kbdreset, bool, 0);
    453     +MODULE_PARM_DESC(kbdreset, "Reset device connected to KBD port");
    454     +
    455     #ifdef CONFIG_X86
    456     static bool i8042_dritek;
    457     module_param_named(dritek, i8042_dritek, bool, 0);
    458     @@ -783,6 +787,16 @@ static int __init i8042_check_aux(void)
    459     return -1;
    460    
    461     /*
    462     + * Reset keyboard (needed on some laptops to successfully detect
    463     + * touchpad, e.g., some Gigabyte laptop models with Elantech
    464     + * touchpads).
    465     + */
    466     + if (i8042_kbdreset) {
    467     + pr_warn("Attempting to reset device connected to KBD port\n");
    468     + i8042_kbd_write(NULL, (unsigned char) 0xff);
    469     + }
    470     +
    471     +/*
    472     * Test AUX IRQ delivery to make sure BIOS did not grab the IRQ and
    473     * used it for a PCI card or somethig else.
    474     */
    475     diff --git a/drivers/media/i2c/smiapp-pll.c b/drivers/media/i2c/smiapp-pll.c
    476     index d8d5da7c52db..942305129e15 100644
    477     --- a/drivers/media/i2c/smiapp-pll.c
    478     +++ b/drivers/media/i2c/smiapp-pll.c
    479     @@ -67,7 +67,7 @@ static void print_pll(struct device *dev, struct smiapp_pll *pll)
    480     {
    481     dev_dbg(dev, "pre_pll_clk_div\t%d\n", pll->pre_pll_clk_div);
    482     dev_dbg(dev, "pll_multiplier \t%d\n", pll->pll_multiplier);
    483     - if (pll->flags != SMIAPP_PLL_FLAG_NO_OP_CLOCKS) {
    484     + if (!(pll->flags & SMIAPP_PLL_FLAG_NO_OP_CLOCKS)) {
    485     dev_dbg(dev, "op_sys_clk_div \t%d\n", pll->op_sys_clk_div);
    486     dev_dbg(dev, "op_pix_clk_div \t%d\n", pll->op_pix_clk_div);
    487     }
    488     @@ -77,7 +77,7 @@ static void print_pll(struct device *dev, struct smiapp_pll *pll)
    489     dev_dbg(dev, "ext_clk_freq_hz \t%d\n", pll->ext_clk_freq_hz);
    490     dev_dbg(dev, "pll_ip_clk_freq_hz \t%d\n", pll->pll_ip_clk_freq_hz);
    491     dev_dbg(dev, "pll_op_clk_freq_hz \t%d\n", pll->pll_op_clk_freq_hz);
    492     - if (pll->flags & SMIAPP_PLL_FLAG_NO_OP_CLOCKS) {
    493     + if (!(pll->flags & SMIAPP_PLL_FLAG_NO_OP_CLOCKS)) {
    494     dev_dbg(dev, "op_sys_clk_freq_hz \t%d\n",
    495     pll->op_sys_clk_freq_hz);
    496     dev_dbg(dev, "op_pix_clk_freq_hz \t%d\n",
    497     diff --git a/drivers/media/i2c/smiapp/smiapp-core.c b/drivers/media/i2c/smiapp/smiapp-core.c
    498     index b280216de31b..de8bc35d8b0b 100644
    499     --- a/drivers/media/i2c/smiapp/smiapp-core.c
    500     +++ b/drivers/media/i2c/smiapp/smiapp-core.c
    501     @@ -2629,7 +2629,9 @@ static int smiapp_registered(struct v4l2_subdev *subdev)
    502     pll->flags |= SMIAPP_PLL_FLAG_OP_PIX_CLOCK_PER_LANE;
    503     pll->scale_n = sensor->limits[SMIAPP_LIMIT_SCALER_N_MIN];
    504    
    505     + mutex_lock(&sensor->mutex);
    506     rval = smiapp_update_mode(sensor);
    507     + mutex_unlock(&sensor->mutex);
    508     if (rval) {
    509     dev_err(&client->dev, "update mode failed\n");
    510     goto out_nvm_release;
    511     diff --git a/drivers/media/usb/dvb-usb/af9005.c b/drivers/media/usb/dvb-usb/af9005.c
    512     index af176b6ce738..e6d3561eea47 100644
    513     --- a/drivers/media/usb/dvb-usb/af9005.c
    514     +++ b/drivers/media/usb/dvb-usb/af9005.c
    515     @@ -1081,9 +1081,12 @@ static int __init af9005_usb_module_init(void)
    516     err("usb_register failed. (%d)", result);
    517     return result;
    518     }
    519     +#if IS_MODULE(CONFIG_DVB_USB_AF9005) || defined(CONFIG_DVB_USB_AF9005_REMOTE)
    520     + /* FIXME: convert to todays kernel IR infrastructure */
    521     rc_decode = symbol_request(af9005_rc_decode);
    522     rc_keys = symbol_request(rc_map_af9005_table);
    523     rc_keys_size = symbol_request(rc_map_af9005_table_size);
    524     +#endif
    525     if (rc_decode == NULL || rc_keys == NULL || rc_keys_size == NULL) {
    526     err("af9005_rc_decode function not found, disabling remote");
    527     af9005_properties.rc.legacy.rc_query = NULL;
    528     diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
    529     index 5dbefa68b1d2..363cdbf4ac8d 100644
    530     --- a/drivers/media/usb/uvc/uvc_driver.c
    531     +++ b/drivers/media/usb/uvc/uvc_driver.c
    532     @@ -1603,12 +1603,12 @@ static void uvc_delete(struct uvc_device *dev)
    533     {
    534     struct list_head *p, *n;
    535    
    536     - usb_put_intf(dev->intf);
    537     - usb_put_dev(dev->udev);
    538     -
    539     uvc_status_cleanup(dev);
    540     uvc_ctrl_cleanup_device(dev);
    541    
    542     + usb_put_intf(dev->intf);
    543     + usb_put_dev(dev->udev);
    544     +
    545     if (dev->vdev.dev)
    546     v4l2_device_unregister(&dev->vdev);
    547     #ifdef CONFIG_MEDIA_CONTROLLER
    548     diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
    549     index 2ea429c27714..836e2ac36a0d 100644
    550     --- a/drivers/mmc/host/sdhci.c
    551     +++ b/drivers/mmc/host/sdhci.c
    552     @@ -1316,6 +1316,8 @@ static void sdhci_request(struct mmc_host *mmc, struct mmc_request *mrq)
    553    
    554     sdhci_runtime_pm_get(host);
    555    
    556     + present = mmc_gpio_get_cd(host->mmc);
    557     +
    558     spin_lock_irqsave(&host->lock, flags);
    559    
    560     WARN_ON(host->mrq != NULL);
    561     @@ -1344,7 +1346,6 @@ static void sdhci_request(struct mmc_host *mmc, struct mmc_request *mrq)
    562     * zero: cd-gpio is used, and card is removed
    563     * one: cd-gpio is used, and card is present
    564     */
    565     - present = mmc_gpio_get_cd(host->mmc);
    566     if (present < 0) {
    567     /* If polling, assume that the card is always present. */
    568     if (host->quirks & SDHCI_QUIRK_BROKEN_CARD_DETECTION)
    569     diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
    570     index cc3df8aebb87..63fb90b006ba 100644
    571     --- a/drivers/net/can/usb/kvaser_usb.c
    572     +++ b/drivers/net/can/usb/kvaser_usb.c
    573     @@ -1238,6 +1238,9 @@ static int kvaser_usb_close(struct net_device *netdev)
    574     if (err)
    575     netdev_warn(netdev, "Cannot stop device, error %d\n", err);
    576    
    577     + /* reset tx contexts */
    578     + kvaser_usb_unlink_tx_urbs(priv);
    579     +
    580     priv->can.state = CAN_STATE_STOPPED;
    581     close_candev(priv->netdev);
    582    
    583     @@ -1286,12 +1289,14 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
    584     if (!urb) {
    585     netdev_err(netdev, "No memory left for URBs\n");
    586     stats->tx_dropped++;
    587     - goto nourbmem;
    588     + dev_kfree_skb(skb);
    589     + return NETDEV_TX_OK;
    590     }
    591    
    592     buf = kmalloc(sizeof(struct kvaser_msg), GFP_ATOMIC);
    593     if (!buf) {
    594     stats->tx_dropped++;
    595     + dev_kfree_skb(skb);
    596     goto nobufmem;
    597     }
    598    
    599     @@ -1326,6 +1331,7 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
    600     }
    601     }
    602    
    603     + /* This should never happen; it implies a flow control bug */
    604     if (!context) {
    605     netdev_warn(netdev, "cannot find free context\n");
    606     ret = NETDEV_TX_BUSY;
    607     @@ -1356,9 +1362,6 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
    608     if (unlikely(err)) {
    609     can_free_echo_skb(netdev, context->echo_index);
    610    
    611     - skb = NULL; /* set to NULL to avoid double free in
    612     - * dev_kfree_skb(skb) */
    613     -
    614     atomic_dec(&priv->active_tx_urbs);
    615     usb_unanchor_urb(urb);
    616    
    617     @@ -1380,8 +1383,6 @@ releasebuf:
    618     kfree(buf);
    619     nobufmem:
    620     usb_free_urb(urb);
    621     -nourbmem:
    622     - dev_kfree_skb(skb);
    623     return ret;
    624     }
    625    
    626     @@ -1493,6 +1494,10 @@ static int kvaser_usb_init_one(struct usb_interface *intf,
    627     struct kvaser_usb_net_priv *priv;
    628     int i, err;
    629    
    630     + err = kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, channel);
    631     + if (err)
    632     + return err;
    633     +
    634     netdev = alloc_candev(sizeof(*priv), MAX_TX_URBS);
    635     if (!netdev) {
    636     dev_err(&intf->dev, "Cannot alloc candev\n");
    637     @@ -1596,9 +1601,6 @@ static int kvaser_usb_probe(struct usb_interface *intf,
    638    
    639     usb_set_intfdata(intf, dev);
    640    
    641     - for (i = 0; i < MAX_NET_DEVICES; i++)
    642     - kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, i);
    643     -
    644     err = kvaser_usb_get_software_info(dev);
    645     if (err) {
    646     dev_err(&intf->dev,
    647     diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
    648     index d30085c2b454..a85a9c2f1385 100644
    649     --- a/drivers/net/ethernet/atheros/alx/main.c
    650     +++ b/drivers/net/ethernet/atheros/alx/main.c
    651     @@ -184,15 +184,16 @@ static void alx_schedule_reset(struct alx_priv *alx)
    652     schedule_work(&alx->reset_wk);
    653     }
    654    
    655     -static bool alx_clean_rx_irq(struct alx_priv *alx, int budget)
    656     +static int alx_clean_rx_irq(struct alx_priv *alx, int budget)
    657     {
    658     struct alx_rx_queue *rxq = &alx->rxq;
    659     struct alx_rrd *rrd;
    660     struct alx_buffer *rxb;
    661     struct sk_buff *skb;
    662     u16 length, rfd_cleaned = 0;
    663     + int work = 0;
    664    
    665     - while (budget > 0) {
    666     + while (work < budget) {
    667     rrd = &rxq->rrd[rxq->rrd_read_idx];
    668     if (!(rrd->word3 & cpu_to_le32(1 << RRD_UPDATED_SHIFT)))
    669     break;
    670     @@ -203,7 +204,7 @@ static bool alx_clean_rx_irq(struct alx_priv *alx, int budget)
    671     ALX_GET_FIELD(le32_to_cpu(rrd->word0),
    672     RRD_NOR) != 1) {
    673     alx_schedule_reset(alx);
    674     - return 0;
    675     + return work;
    676     }
    677    
    678     rxb = &rxq->bufs[rxq->read_idx];
    679     @@ -243,7 +244,7 @@ static bool alx_clean_rx_irq(struct alx_priv *alx, int budget)
    680     }
    681    
    682     napi_gro_receive(&alx->napi, skb);
    683     - budget--;
    684     + work++;
    685    
    686     next_pkt:
    687     if (++rxq->read_idx == alx->rx_ringsz)
    688     @@ -258,21 +259,22 @@ next_pkt:
    689     if (rfd_cleaned)
    690     alx_refill_rx_ring(alx, GFP_ATOMIC);
    691    
    692     - return budget > 0;
    693     + return work;
    694     }
    695    
    696     static int alx_poll(struct napi_struct *napi, int budget)
    697     {
    698     struct alx_priv *alx = container_of(napi, struct alx_priv, napi);
    699     struct alx_hw *hw = &alx->hw;
    700     - bool complete = true;
    701     unsigned long flags;
    702     + bool tx_complete;
    703     + int work;
    704    
    705     - complete = alx_clean_tx_irq(alx) &&
    706     - alx_clean_rx_irq(alx, budget);
    707     + tx_complete = alx_clean_tx_irq(alx);
    708     + work = alx_clean_rx_irq(alx, budget);
    709    
    710     - if (!complete)
    711     - return 1;
    712     + if (!tx_complete || work == budget)
    713     + return budget;
    714    
    715     napi_complete(&alx->napi);
    716    
    717     @@ -284,7 +286,7 @@ static int alx_poll(struct napi_struct *napi, int budget)
    718    
    719     alx_post_write(hw);
    720    
    721     - return 0;
    722     + return work;
    723     }
    724    
    725     static irqreturn_t alx_intr_handle(struct alx_priv *alx, u32 intr)
    726     diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
    727     index 5501cad30cfa..8c1eab1151b8 100644
    728     --- a/drivers/net/ethernet/broadcom/tg3.c
    729     +++ b/drivers/net/ethernet/broadcom/tg3.c
    730     @@ -17389,23 +17389,6 @@ static int tg3_init_one(struct pci_dev *pdev,
    731     goto err_out_apeunmap;
    732     }
    733    
    734     - /*
    735     - * Reset chip in case UNDI or EFI driver did not shutdown
    736     - * DMA self test will enable WDMAC and we'll see (spurious)
    737     - * pending DMA on the PCI bus at that point.
    738     - */
    739     - if ((tr32(HOSTCC_MODE) & HOSTCC_MODE_ENABLE) ||
    740     - (tr32(WDMAC_MODE) & WDMAC_MODE_ENABLE)) {
    741     - tw32(MEMARB_MODE, MEMARB_MODE_ENABLE);
    742     - tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
    743     - }
    744     -
    745     - err = tg3_test_dma(tp);
    746     - if (err) {
    747     - dev_err(&pdev->dev, "DMA engine test failed, aborting\n");
    748     - goto err_out_apeunmap;
    749     - }
    750     -
    751     intmbx = MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW;
    752     rcvmbx = MAILBOX_RCVRET_CON_IDX_0 + TG3_64BIT_REG_LOW;
    753     sndmbx = MAILBOX_SNDHOST_PROD_IDX_0 + TG3_64BIT_REG_LOW;
    754     @@ -17450,6 +17433,23 @@ static int tg3_init_one(struct pci_dev *pdev,
    755     sndmbx += 0xc;
    756     }
    757    
    758     + /*
    759     + * Reset chip in case UNDI or EFI driver did not shutdown
    760     + * DMA self test will enable WDMAC and we'll see (spurious)
    761     + * pending DMA on the PCI bus at that point.
    762     + */
    763     + if ((tr32(HOSTCC_MODE) & HOSTCC_MODE_ENABLE) ||
    764     + (tr32(WDMAC_MODE) & WDMAC_MODE_ENABLE)) {
    765     + tw32(MEMARB_MODE, MEMARB_MODE_ENABLE);
    766     + tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
    767     + }
    768     +
    769     + err = tg3_test_dma(tp);
    770     + if (err) {
    771     + dev_err(&pdev->dev, "DMA engine test failed, aborting\n");
    772     + goto err_out_apeunmap;
    773     + }
    774     +
    775     tg3_init_coal(tp);
    776    
    777     pci_set_drvdata(pdev, dev);
    778     diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
    779     index 635f55992d7e..8cc0eaa9d6f1 100644
    780     --- a/drivers/net/ethernet/cisco/enic/enic_main.c
    781     +++ b/drivers/net/ethernet/cisco/enic/enic_main.c
    782     @@ -1294,10 +1294,14 @@ static void enic_rq_indicate_buf(struct vnic_rq *rq,
    783     skb_put(skb, bytes_written);
    784     skb->protocol = eth_type_trans(skb, netdev);
    785    
    786     - if ((netdev->features & NETIF_F_RXCSUM) && !csum_not_calc) {
    787     - skb->csum = htons(checksum);
    788     - skb->ip_summed = CHECKSUM_COMPLETE;
    789     - }
    790     + /* Hardware does not provide whole packet checksum. It only
    791     + * provides pseudo checksum. Since hw validates the packet
    792     + * checksum but not provide us the checksum value. use
    793     + * CHECSUM_UNNECESSARY.
    794     + */
    795     + if ((netdev->features & NETIF_F_RXCSUM) && tcp_udp_csum_ok &&
    796     + ipv4_csum_ok)
    797     + skb->ip_summed = CHECKSUM_UNNECESSARY;
    798    
    799     if (vlan_stripped)
    800     __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), vlan_tci);
    801     diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c
    802     index 0ed96df20162..3458eb6fd491 100644
    803     --- a/drivers/platform/x86/hp_accel.c
    804     +++ b/drivers/platform/x86/hp_accel.c
    805     @@ -237,6 +237,7 @@ static struct dmi_system_id lis3lv02d_dmi_ids[] = {
    806     AXIS_DMI_MATCH("HPB64xx", "HP ProBook 64", xy_swap),
    807     AXIS_DMI_MATCH("HPB64xx", "HP EliteBook 84", xy_swap),
    808     AXIS_DMI_MATCH("HPB65xx", "HP ProBook 65", x_inverted),
    809     + AXIS_DMI_MATCH("HPZBook15", "HP ZBook 15", x_inverted),
    810     { NULL, }
    811     /* Laptop models without axis info (yet):
    812     * "NC6910" "HP Compaq 6910"
    813     diff --git a/drivers/s390/char/con3215.c b/drivers/s390/char/con3215.c
    814     index bb86494e2b7b..19915c5b256f 100644
    815     --- a/drivers/s390/char/con3215.c
    816     +++ b/drivers/s390/char/con3215.c
    817     @@ -288,12 +288,16 @@ static void raw3215_timeout(unsigned long __data)
    818     unsigned long flags;
    819    
    820     spin_lock_irqsave(get_ccwdev_lock(raw->cdev), flags);
    821     - if (raw->flags & RAW3215_TIMER_RUNS) {
    822     - del_timer(&raw->timer);
    823     - raw->flags &= ~RAW3215_TIMER_RUNS;
    824     - if (!(raw->port.flags & ASYNC_SUSPENDED)) {
    825     - raw3215_mk_write_req(raw);
    826     - raw3215_start_io(raw);
    827     + raw->flags &= ~RAW3215_TIMER_RUNS;
    828     + if (!(raw->port.flags & ASYNC_SUSPENDED)) {
    829     + raw3215_mk_write_req(raw);
    830     + raw3215_start_io(raw);
    831     + if ((raw->queued_read || raw->queued_write) &&
    832     + !(raw->flags & RAW3215_WORKING) &&
    833     + !(raw->flags & RAW3215_TIMER_RUNS)) {
    834     + raw->timer.expires = RAW3215_TIMEOUT + jiffies;
    835     + add_timer(&raw->timer);
    836     + raw->flags |= RAW3215_TIMER_RUNS;
    837     }
    838     }
    839     spin_unlock_irqrestore(get_ccwdev_lock(raw->cdev), flags);
    840     @@ -317,17 +321,15 @@ static inline void raw3215_try_io(struct raw3215_info *raw)
    841     (raw->flags & RAW3215_FLUSHING)) {
    842     /* execute write requests bigger than minimum size */
    843     raw3215_start_io(raw);
    844     - if (raw->flags & RAW3215_TIMER_RUNS) {
    845     - del_timer(&raw->timer);
    846     - raw->flags &= ~RAW3215_TIMER_RUNS;
    847     - }
    848     - } else if (!(raw->flags & RAW3215_TIMER_RUNS)) {
    849     - /* delay small writes */
    850     - raw->timer.expires = RAW3215_TIMEOUT + jiffies;
    851     - add_timer(&raw->timer);
    852     - raw->flags |= RAW3215_TIMER_RUNS;
    853     }
    854     }
    855     + if ((raw->queued_read || raw->queued_write) &&
    856     + !(raw->flags & RAW3215_WORKING) &&
    857     + !(raw->flags & RAW3215_TIMER_RUNS)) {
    858     + raw->timer.expires = RAW3215_TIMEOUT + jiffies;
    859     + add_timer(&raw->timer);
    860     + raw->flags |= RAW3215_TIMER_RUNS;
    861     + }
    862     }
    863    
    864     /*
    865     @@ -1027,12 +1029,26 @@ static int tty3215_write(struct tty_struct * tty,
    866     const unsigned char *buf, int count)
    867     {
    868     struct raw3215_info *raw;
    869     + int i, written;
    870    
    871     if (!tty)
    872     return 0;
    873     raw = (struct raw3215_info *) tty->driver_data;
    874     - raw3215_write(raw, buf, count);
    875     - return count;
    876     + written = count;
    877     + while (count > 0) {
    878     + for (i = 0; i < count; i++)
    879     + if (buf[i] == '\t' || buf[i] == '\n')
    880     + break;
    881     + raw3215_write(raw, buf, i);
    882     + count -= i;
    883     + buf += i;
    884     + if (count > 0) {
    885     + raw3215_putchar(raw, *buf);
    886     + count--;
    887     + buf++;
    888     + }
    889     + }
    890     + return written;
    891     }
    892    
    893     /*
    894     @@ -1180,7 +1196,7 @@ static int __init tty3215_init(void)
    895     driver->subtype = SYSTEM_TYPE_TTY;
    896     driver->init_termios = tty_std_termios;
    897     driver->init_termios.c_iflag = IGNBRK | IGNPAR;
    898     - driver->init_termios.c_oflag = ONLCR | XTABS;
    899     + driver->init_termios.c_oflag = ONLCR;
    900     driver->init_termios.c_lflag = ISIG;
    901     driver->flags = TTY_DRIVER_REAL_RAW;
    902     tty_set_operations(driver, &tty3215_ops);
    903     diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
    904     index 87ca72d36d5b..a8990783ba66 100644
    905     --- a/drivers/scsi/storvsc_drv.c
    906     +++ b/drivers/scsi/storvsc_drv.c
    907     @@ -1439,13 +1439,12 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd)
    908     if (ret == -EAGAIN) {
    909     /* no more space */
    910    
    911     - if (cmd_request->bounce_sgl_count) {
    912     + if (cmd_request->bounce_sgl_count)
    913     destroy_bounce_buffer(cmd_request->bounce_sgl,
    914     cmd_request->bounce_sgl_count);
    915    
    916     - ret = SCSI_MLQUEUE_DEVICE_BUSY;
    917     - goto queue_error;
    918     - }
    919     + ret = SCSI_MLQUEUE_DEVICE_BUSY;
    920     + goto queue_error;
    921     }
    922    
    923     return 0;
    924     diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c
    925     index c9790f6fdd89..016e882356d6 100644
    926     --- a/drivers/target/iscsi/iscsi_target_util.c
    927     +++ b/drivers/target/iscsi/iscsi_target_util.c
    928     @@ -1349,15 +1349,15 @@ static int iscsit_do_tx_data(
    929     struct iscsi_conn *conn,
    930     struct iscsi_data_count *count)
    931     {
    932     - int data = count->data_length, total_tx = 0, tx_loop = 0, iov_len;
    933     + int ret, iov_len;
    934     struct kvec *iov_p;
    935     struct msghdr msg;
    936    
    937     if (!conn || !conn->sock || !conn->conn_ops)
    938     return -1;
    939    
    940     - if (data <= 0) {
    941     - pr_err("Data length is: %d\n", data);
    942     + if (count->data_length <= 0) {
    943     + pr_err("Data length is: %d\n", count->data_length);
    944     return -1;
    945     }
    946    
    947     @@ -1366,20 +1366,16 @@ static int iscsit_do_tx_data(
    948     iov_p = count->iov;
    949     iov_len = count->iov_count;
    950    
    951     - while (total_tx < data) {
    952     - tx_loop = kernel_sendmsg(conn->sock, &msg, iov_p, iov_len,
    953     - (data - total_tx));
    954     - if (tx_loop <= 0) {
    955     - pr_debug("tx_loop: %d total_tx %d\n",
    956     - tx_loop, total_tx);
    957     - return tx_loop;
    958     - }
    959     - total_tx += tx_loop;
    960     - pr_debug("tx_loop: %d, total_tx: %d, data: %d\n",
    961     - tx_loop, total_tx, data);
    962     + ret = kernel_sendmsg(conn->sock, &msg, iov_p, iov_len,
    963     + count->data_length);
    964     + if (ret != count->data_length) {
    965     + pr_err("Unexpected ret: %d send data %d\n",
    966     + ret, count->data_length);
    967     + return -EPIPE;
    968     }
    969     + pr_debug("ret: %d, sent data: %d\n", ret, count->data_length);
    970    
    971     - return total_tx;
    972     + return ret;
    973     }
    974    
    975     int rx_data(
    976     diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
    977     index 8f8e75e392de..87f8fc63b3e1 100644
    978     --- a/drivers/usb/dwc3/gadget.c
    979     +++ b/drivers/usb/dwc3/gadget.c
    980     @@ -907,8 +907,7 @@ static void dwc3_prepare_trbs(struct dwc3_ep *dep, bool starting)
    981    
    982     if (i == (request->num_mapped_sgs - 1) ||
    983     sg_is_last(s)) {
    984     - if (list_is_last(&req->list,
    985     - &dep->request_list))
    986     + if (list_empty(&dep->request_list))
    987     last_one = true;
    988     chain = false;
    989     }
    990     @@ -926,6 +925,9 @@ static void dwc3_prepare_trbs(struct dwc3_ep *dep, bool starting)
    991     if (last_one)
    992     break;
    993     }
    994     +
    995     + if (last_one)
    996     + break;
    997     } else {
    998     dma = req->request.dma;
    999     length = req->request.length;
    1000     diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
    1001     index 9cfe3af3101a..66c905884496 100644
    1002     --- a/drivers/usb/host/pci-quirks.c
    1003     +++ b/drivers/usb/host/pci-quirks.c
    1004     @@ -470,7 +470,8 @@ static void quirk_usb_handoff_ohci(struct pci_dev *pdev)
    1005     {
    1006     void __iomem *base;
    1007     u32 control;
    1008     - u32 fminterval;
    1009     + u32 fminterval = 0;
    1010     + bool no_fminterval = false;
    1011     int cnt;
    1012    
    1013     if (!mmio_resource_enabled(pdev, 0))
    1014     @@ -480,6 +481,13 @@ static void quirk_usb_handoff_ohci(struct pci_dev *pdev)
    1015     if (base == NULL)
    1016     return;
    1017    
    1018     + /*
    1019     + * ULi M5237 OHCI controller locks the whole system when accessing
    1020     + * the OHCI_FMINTERVAL offset.
    1021     + */
    1022     + if (pdev->vendor == PCI_VENDOR_ID_AL && pdev->device == 0x5237)
    1023     + no_fminterval = true;
    1024     +
    1025     control = readl(base + OHCI_CONTROL);
    1026    
    1027     /* On PA-RISC, PDC can leave IR set incorrectly; ignore it there. */
    1028     @@ -518,7 +526,9 @@ static void quirk_usb_handoff_ohci(struct pci_dev *pdev)
    1029     }
    1030    
    1031     /* software reset of the controller, preserving HcFmInterval */
    1032     - fminterval = readl(base + OHCI_FMINTERVAL);
    1033     + if (!no_fminterval)
    1034     + fminterval = readl(base + OHCI_FMINTERVAL);
    1035     +
    1036     writel(OHCI_HCR, base + OHCI_CMDSTATUS);
    1037    
    1038     /* reset requires max 10 us delay */
    1039     @@ -527,7 +537,9 @@ static void quirk_usb_handoff_ohci(struct pci_dev *pdev)
    1040     break;
    1041     udelay(1);
    1042     }
    1043     - writel(fminterval, base + OHCI_FMINTERVAL);
    1044     +
    1045     + if (!no_fminterval)
    1046     + writel(fminterval, base + OHCI_FMINTERVAL);
    1047    
    1048     /* Now the controller is safely in SUSPEND and nothing can wake it up */
    1049     iounmap(base);
    1050     diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
    1051     index a24714f6f88f..8e15acd204ef 100644
    1052     --- a/drivers/usb/serial/cp210x.c
    1053     +++ b/drivers/usb/serial/cp210x.c
    1054     @@ -120,10 +120,12 @@ static const struct usb_device_id id_table[] = {
    1055     { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */
    1056     { USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */
    1057     { USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */
    1058     - { USB_DEVICE(0x10C4, 0x8875) }, /* CEL MeshConnect USB Stick */
    1059     + { USB_DEVICE(0x10C4, 0x8856) }, /* CEL EM357 ZigBee USB Stick - LR */
    1060     + { USB_DEVICE(0x10C4, 0x8857) }, /* CEL EM357 ZigBee USB Stick */
    1061     { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */
    1062     { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */
    1063     { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */
    1064     + { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */
    1065     { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
    1066     { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
    1067     { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
    1068     diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
    1069     index f0e65c970d35..cec377b8bb8b 100644
    1070     --- a/drivers/usb/serial/keyspan.c
    1071     +++ b/drivers/usb/serial/keyspan.c
    1072     @@ -418,6 +418,8 @@ static void usa26_instat_callback(struct urb *urb)
    1073     }
    1074     port = serial->port[msg->port];
    1075     p_priv = usb_get_serial_port_data(port);
    1076     + if (!p_priv)
    1077     + goto resubmit;
    1078    
    1079     /* Update handshaking pin state information */
    1080     old_dcd_state = p_priv->dcd_state;
    1081     @@ -428,7 +430,7 @@ static void usa26_instat_callback(struct urb *urb)
    1082    
    1083     if (old_dcd_state != p_priv->dcd_state)
    1084     tty_port_tty_hangup(&port->port, true);
    1085     -
    1086     +resubmit:
    1087     /* Resubmit urb so we continue receiving */
    1088     err = usb_submit_urb(urb, GFP_ATOMIC);
    1089     if (err != 0)
    1090     @@ -543,6 +545,8 @@ static void usa28_instat_callback(struct urb *urb)
    1091     }
    1092     port = serial->port[msg->port];
    1093     p_priv = usb_get_serial_port_data(port);
    1094     + if (!p_priv)
    1095     + goto resubmit;
    1096    
    1097     /* Update handshaking pin state information */
    1098     old_dcd_state = p_priv->dcd_state;
    1099     @@ -553,7 +557,7 @@ static void usa28_instat_callback(struct urb *urb)
    1100    
    1101     if (old_dcd_state != p_priv->dcd_state && old_dcd_state)
    1102     tty_port_tty_hangup(&port->port, true);
    1103     -
    1104     +resubmit:
    1105     /* Resubmit urb so we continue receiving */
    1106     err = usb_submit_urb(urb, GFP_ATOMIC);
    1107     if (err != 0)
    1108     @@ -630,6 +634,8 @@ static void usa49_instat_callback(struct urb *urb)
    1109     }
    1110     port = serial->port[msg->portNumber];
    1111     p_priv = usb_get_serial_port_data(port);
    1112     + if (!p_priv)
    1113     + goto resubmit;
    1114    
    1115     /* Update handshaking pin state information */
    1116     old_dcd_state = p_priv->dcd_state;
    1117     @@ -640,7 +646,7 @@ static void usa49_instat_callback(struct urb *urb)
    1118    
    1119     if (old_dcd_state != p_priv->dcd_state && old_dcd_state)
    1120     tty_port_tty_hangup(&port->port, true);
    1121     -
    1122     +resubmit:
    1123     /* Resubmit urb so we continue receiving */
    1124     err = usb_submit_urb(urb, GFP_ATOMIC);
    1125     if (err != 0)
    1126     @@ -878,6 +884,8 @@ static void usa90_instat_callback(struct urb *urb)
    1127    
    1128     port = serial->port[0];
    1129     p_priv = usb_get_serial_port_data(port);
    1130     + if (!p_priv)
    1131     + goto resubmit;
    1132    
    1133     /* Update handshaking pin state information */
    1134     old_dcd_state = p_priv->dcd_state;
    1135     @@ -888,7 +896,7 @@ static void usa90_instat_callback(struct urb *urb)
    1136    
    1137     if (old_dcd_state != p_priv->dcd_state && old_dcd_state)
    1138     tty_port_tty_hangup(&port->port, true);
    1139     -
    1140     +resubmit:
    1141     /* Resubmit urb so we continue receiving */
    1142     err = usb_submit_urb(urb, GFP_ATOMIC);
    1143     if (err != 0)
    1144     @@ -949,6 +957,8 @@ static void usa67_instat_callback(struct urb *urb)
    1145    
    1146     port = serial->port[msg->port];
    1147     p_priv = usb_get_serial_port_data(port);
    1148     + if (!p_priv)
    1149     + goto resubmit;
    1150    
    1151     /* Update handshaking pin state information */
    1152     old_dcd_state = p_priv->dcd_state;
    1153     @@ -957,7 +967,7 @@ static void usa67_instat_callback(struct urb *urb)
    1154    
    1155     if (old_dcd_state != p_priv->dcd_state && old_dcd_state)
    1156     tty_port_tty_hangup(&port->port, true);
    1157     -
    1158     +resubmit:
    1159     /* Resubmit urb so we continue receiving */
    1160     err = usb_submit_urb(urb, GFP_ATOMIC);
    1161     if (err != 0)
    1162     diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
    1163     index ac3725440d64..dc55bc254c5c 100644
    1164     --- a/drivers/vfio/pci/vfio_pci.c
    1165     +++ b/drivers/vfio/pci/vfio_pci.c
    1166     @@ -519,13 +519,11 @@ static const struct vfio_device_ops vfio_pci_ops = {
    1167    
    1168     static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
    1169     {
    1170     - u8 type;
    1171     struct vfio_pci_device *vdev;
    1172     struct iommu_group *group;
    1173     int ret;
    1174    
    1175     - pci_read_config_byte(pdev, PCI_HEADER_TYPE, &type);
    1176     - if ((type & PCI_HEADER_TYPE) != PCI_HEADER_TYPE_NORMAL)
    1177     + if (pdev->hdr_type != PCI_HEADER_TYPE_NORMAL)
    1178     return -EINVAL;
    1179    
    1180     group = iommu_group_get(&pdev->dev);
    1181     diff --git a/drivers/video/logo/logo.c b/drivers/video/logo/logo.c
    1182     index 080c35b34bbb..cc5dbb5b2f71 100644
    1183     --- a/drivers/video/logo/logo.c
    1184     +++ b/drivers/video/logo/logo.c
    1185     @@ -25,6 +25,21 @@ static bool nologo;
    1186     module_param(nologo, bool, 0);
    1187     MODULE_PARM_DESC(nologo, "Disables startup logo");
    1188    
    1189     +/*
    1190     + * Logos are located in the initdata, and will be freed in kernel_init.
    1191     + * Use late_init to mark the logos as freed to prevent any further use.
    1192     + */
    1193     +
    1194     +static bool logos_freed;
    1195     +
    1196     +static int __init fb_logo_late_init(void)
    1197     +{
    1198     + logos_freed = true;
    1199     + return 0;
    1200     +}
    1201     +
    1202     +late_initcall(fb_logo_late_init);
    1203     +
    1204     /* logo's are marked __initdata. Use __init_refok to tell
    1205     * modpost that it is intended that this function uses data
    1206     * marked __initdata.
    1207     @@ -33,7 +48,7 @@ const struct linux_logo * __init_refok fb_find_logo(int depth)
    1208     {
    1209     const struct linux_logo *logo = NULL;
    1210    
    1211     - if (nologo)
    1212     + if (nologo || logos_freed)
    1213     return NULL;
    1214    
    1215     if (depth >= 1) {
    1216     diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c
    1217     index 9c8a5a6d33df..7a318480ab7a 100644
    1218     --- a/fs/lockd/svc.c
    1219     +++ b/fs/lockd/svc.c
    1220     @@ -137,10 +137,6 @@ lockd(void *vrqstp)
    1221    
    1222     dprintk("NFS locking service started (ver " LOCKD_VERSION ").\n");
    1223    
    1224     - if (!nlm_timeout)
    1225     - nlm_timeout = LOCKD_DFLT_TIMEO;
    1226     - nlmsvc_timeout = nlm_timeout * HZ;
    1227     -
    1228     /*
    1229     * The main request loop. We don't terminate until the last
    1230     * NFS mount or NFS daemon has gone away.
    1231     @@ -346,6 +342,10 @@ static struct svc_serv *lockd_create_svc(void)
    1232     printk(KERN_WARNING
    1233     "lockd_up: no pid, %d users??\n", nlmsvc_users);
    1234    
    1235     + if (!nlm_timeout)
    1236     + nlm_timeout = LOCKD_DFLT_TIMEO;
    1237     + nlmsvc_timeout = nlm_timeout * HZ;
    1238     +
    1239     serv = svc_create(&nlmsvc_program, LOCKD_BUFSIZE, NULL);
    1240     if (!serv) {
    1241     printk(KERN_WARNING "lockd_up: create service failed\n");
    1242     diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
    1243     index cc143ee7a56e..519833d0457e 100644
    1244     --- a/fs/nfs/nfs4client.c
    1245     +++ b/fs/nfs/nfs4client.c
    1246     @@ -394,20 +394,14 @@ static bool nfs4_match_clientids(struct nfs_client *a, struct nfs_client *b)
    1247     }
    1248    
    1249     /*
    1250     - * Returns true if the server owners match
    1251     + * Returns true if the server major ids match
    1252     */
    1253     static bool
    1254     -nfs4_match_serverowners(struct nfs_client *a, struct nfs_client *b)
    1255     +nfs4_check_clientid_trunking(struct nfs_client *a, struct nfs_client *b)
    1256     {
    1257     struct nfs41_server_owner *o1 = a->cl_serverowner;
    1258     struct nfs41_server_owner *o2 = b->cl_serverowner;
    1259    
    1260     - if (o1->minor_id != o2->minor_id) {
    1261     - dprintk("NFS: --> %s server owner minor IDs do not match\n",
    1262     - __func__);
    1263     - return false;
    1264     - }
    1265     -
    1266     if (o1->major_id_sz != o2->major_id_sz)
    1267     goto out_major_mismatch;
    1268     if (memcmp(o1->major_id, o2->major_id, o1->major_id_sz) != 0)
    1269     @@ -483,7 +477,12 @@ int nfs41_walk_client_list(struct nfs_client *new,
    1270     if (!nfs4_match_clientids(pos, new))
    1271     continue;
    1272    
    1273     - if (!nfs4_match_serverowners(pos, new))
    1274     + /*
    1275     + * Note that session trunking is just a special subcase of
    1276     + * client id trunking. In either case, we want to fall back
    1277     + * to using the existing nfs_client.
    1278     + */
    1279     + if (!nfs4_check_clientid_trunking(pos, new))
    1280     continue;
    1281    
    1282     atomic_inc(&pos->cl_count);
    1283     diff --git a/fs/notify/inode_mark.c b/fs/notify/inode_mark.c
    1284     index 74825be65b7b..fbb9dfb7b1d2 100644
    1285     --- a/fs/notify/inode_mark.c
    1286     +++ b/fs/notify/inode_mark.c
    1287     @@ -288,20 +288,25 @@ void fsnotify_unmount_inodes(struct list_head *list)
    1288     spin_unlock(&inode->i_lock);
    1289    
    1290     /* In case the dropping of a reference would nuke next_i. */
    1291     - if ((&next_i->i_sb_list != list) &&
    1292     - atomic_read(&next_i->i_count)) {
    1293     + while (&next_i->i_sb_list != list) {
    1294     spin_lock(&next_i->i_lock);
    1295     - if (!(next_i->i_state & (I_FREEING | I_WILL_FREE))) {
    1296     + if (!(next_i->i_state & (I_FREEING | I_WILL_FREE)) &&
    1297     + atomic_read(&next_i->i_count)) {
    1298     __iget(next_i);
    1299     need_iput = next_i;
    1300     + spin_unlock(&next_i->i_lock);
    1301     + break;
    1302     }
    1303     spin_unlock(&next_i->i_lock);
    1304     + next_i = list_entry(next_i->i_sb_list.next,
    1305     + struct inode, i_sb_list);
    1306     }
    1307    
    1308     /*
    1309     - * We can safely drop inode_sb_list_lock here because we hold
    1310     - * references on both inode and next_i. Also no new inodes
    1311     - * will be added since the umount has begun.
    1312     + * We can safely drop inode_sb_list_lock here because either
    1313     + * we actually hold references on both inode and next_i or
    1314     + * end of list. Also no new inodes will be added since the
    1315     + * umount has begun.
    1316     */
    1317     spin_unlock(&inode_sb_list_lock);
    1318    
    1319     diff --git a/lib/decompress_bunzip2.c b/lib/decompress_bunzip2.c
    1320     index 31c5f7675fbf..f504027d66a8 100644
    1321     --- a/lib/decompress_bunzip2.c
    1322     +++ b/lib/decompress_bunzip2.c
    1323     @@ -184,7 +184,7 @@ static int INIT get_next_block(struct bunzip_data *bd)
    1324     if (get_bits(bd, 1))
    1325     return RETVAL_OBSOLETE_INPUT;
    1326     origPtr = get_bits(bd, 24);
    1327     - if (origPtr > dbufSize)
    1328     + if (origPtr >= dbufSize)
    1329     return RETVAL_DATA_ERROR;
    1330     /* mapping table: if some byte values are never used (encoding things
    1331     like ascii text), the compression code removes the gaps to have fewer
    1332     diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
    1333     index 11ef25c9cf43..923146c4f007 100644
    1334     --- a/net/ipv4/tcp_output.c
    1335     +++ b/net/ipv4/tcp_output.c
    1336     @@ -1862,7 +1862,7 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
    1337     if (unlikely(!tcp_snd_wnd_test(tp, skb, mss_now)))
    1338     break;
    1339    
    1340     - if (tso_segs == 1) {
    1341     + if (tso_segs == 1 || !sk->sk_gso_max_segs) {
    1342     if (unlikely(!tcp_nagle_test(tp, skb, mss_now,
    1343     (tcp_skb_is_last(sk, skb) ?
    1344     nonagle : TCP_NAGLE_PUSH))))
    1345     @@ -1899,7 +1899,7 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
    1346     }
    1347    
    1348     limit = mss_now;
    1349     - if (tso_segs > 1 && !tcp_urg_mode(tp))
    1350     + if (tso_segs > 1 && sk->sk_gso_max_segs && !tcp_urg_mode(tp))
    1351     limit = tcp_mss_split_point(sk, skb, mss_now,
    1352     min_t(unsigned int,
    1353     cwnd_quota,
    1354     diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
    1355     index f77139007983..3b04dfd34554 100644
    1356     --- a/net/netfilter/ipset/ip_set_core.c
    1357     +++ b/net/netfilter/ipset/ip_set_core.c
    1358     @@ -1754,6 +1754,12 @@ ip_set_sockfn_get(struct sock *sk, int optval, void __user *user, int *len)
    1359     if (*op < IP_SET_OP_VERSION) {
    1360     /* Check the version at the beginning of operations */
    1361     struct ip_set_req_version *req_version = data;
    1362     +
    1363     + if (*len < sizeof(struct ip_set_req_version)) {
    1364     + ret = -EINVAL;
    1365     + goto done;
    1366     + }
    1367     +
    1368     if (req_version->version != IPSET_PROTOCOL) {
    1369     ret = -EPROTO;
    1370     goto done;
    1371     diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
    1372     index afe41178c9fb..f7ad5c630b65 100644
    1373     --- a/net/netlink/af_netlink.c
    1374     +++ b/net/netlink/af_netlink.c
    1375     @@ -374,14 +374,14 @@ out:
    1376     return err;
    1377     }
    1378    
    1379     -static void netlink_frame_flush_dcache(const struct nl_mmap_hdr *hdr)
    1380     +static void netlink_frame_flush_dcache(const struct nl_mmap_hdr *hdr, unsigned int nm_len)
    1381     {
    1382     #if ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE == 1
    1383     struct page *p_start, *p_end;
    1384    
    1385     /* First page is flushed through netlink_{get,set}_status */
    1386     p_start = pgvec_to_page(hdr + PAGE_SIZE);
    1387     - p_end = pgvec_to_page((void *)hdr + NL_MMAP_HDRLEN + hdr->nm_len - 1);
    1388     + p_end = pgvec_to_page((void *)hdr + NL_MMAP_HDRLEN + nm_len - 1);
    1389     while (p_start <= p_end) {
    1390     flush_dcache_page(p_start);
    1391     p_start++;
    1392     @@ -399,9 +399,9 @@ static enum nl_mmap_status netlink_get_status(const struct nl_mmap_hdr *hdr)
    1393     static void netlink_set_status(struct nl_mmap_hdr *hdr,
    1394     enum nl_mmap_status status)
    1395     {
    1396     + smp_mb();
    1397     hdr->nm_status = status;
    1398     flush_dcache_page(pgvec_to_page(hdr));
    1399     - smp_wmb();
    1400     }
    1401    
    1402     static struct nl_mmap_hdr *
    1403     @@ -563,24 +563,16 @@ static int netlink_mmap_sendmsg(struct sock *sk, struct msghdr *msg,
    1404     struct nl_mmap_hdr *hdr;
    1405     struct sk_buff *skb;
    1406     unsigned int maxlen;
    1407     - bool excl = true;
    1408     int err = 0, len = 0;
    1409    
    1410     - /* Netlink messages are validated by the receiver before processing.
    1411     - * In order to avoid userspace changing the contents of the message
    1412     - * after validation, the socket and the ring may only be used by a
    1413     - * single process, otherwise we fall back to copying.
    1414     - */
    1415     - if (atomic_long_read(&sk->sk_socket->file->f_count) > 1 ||
    1416     - atomic_read(&nlk->mapped) > 1)
    1417     - excl = false;
    1418     -
    1419     mutex_lock(&nlk->pg_vec_lock);
    1420    
    1421     ring = &nlk->tx_ring;
    1422     maxlen = ring->frame_size - NL_MMAP_HDRLEN;
    1423    
    1424     do {
    1425     + unsigned int nm_len;
    1426     +
    1427     hdr = netlink_current_frame(ring, NL_MMAP_STATUS_VALID);
    1428     if (hdr == NULL) {
    1429     if (!(msg->msg_flags & MSG_DONTWAIT) &&
    1430     @@ -588,35 +580,23 @@ static int netlink_mmap_sendmsg(struct sock *sk, struct msghdr *msg,
    1431     schedule();
    1432     continue;
    1433     }
    1434     - if (hdr->nm_len > maxlen) {
    1435     +
    1436     + nm_len = ACCESS_ONCE(hdr->nm_len);
    1437     + if (nm_len > maxlen) {
    1438     err = -EINVAL;
    1439     goto out;
    1440     }
    1441    
    1442     - netlink_frame_flush_dcache(hdr);
    1443     + netlink_frame_flush_dcache(hdr, nm_len);
    1444    
    1445     - if (likely(dst_portid == 0 && dst_group == 0 && excl)) {
    1446     - skb = alloc_skb_head(GFP_KERNEL);
    1447     - if (skb == NULL) {
    1448     - err = -ENOBUFS;
    1449     - goto out;
    1450     - }
    1451     - sock_hold(sk);
    1452     - netlink_ring_setup_skb(skb, sk, ring, hdr);
    1453     - NETLINK_CB(skb).flags |= NETLINK_SKB_TX;
    1454     - __skb_put(skb, hdr->nm_len);
    1455     - netlink_set_status(hdr, NL_MMAP_STATUS_RESERVED);
    1456     - atomic_inc(&ring->pending);
    1457     - } else {
    1458     - skb = alloc_skb(hdr->nm_len, GFP_KERNEL);
    1459     - if (skb == NULL) {
    1460     - err = -ENOBUFS;
    1461     - goto out;
    1462     - }
    1463     - __skb_put(skb, hdr->nm_len);
    1464     - memcpy(skb->data, (void *)hdr + NL_MMAP_HDRLEN, hdr->nm_len);
    1465     - netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED);
    1466     + skb = alloc_skb(nm_len, GFP_KERNEL);
    1467     + if (skb == NULL) {
    1468     + err = -ENOBUFS;
    1469     + goto out;
    1470     }
    1471     + __skb_put(skb, nm_len);
    1472     + memcpy(skb->data, (void *)hdr + NL_MMAP_HDRLEN, nm_len);
    1473     + netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED);
    1474    
    1475     netlink_increment_head(ring);
    1476    
    1477     @@ -662,7 +642,7 @@ static void netlink_queue_mmaped_skb(struct sock *sk, struct sk_buff *skb)
    1478     hdr->nm_pid = NETLINK_CB(skb).creds.pid;
    1479     hdr->nm_uid = from_kuid(sk_user_ns(sk), NETLINK_CB(skb).creds.uid);
    1480     hdr->nm_gid = from_kgid(sk_user_ns(sk), NETLINK_CB(skb).creds.gid);
    1481     - netlink_frame_flush_dcache(hdr);
    1482     + netlink_frame_flush_dcache(hdr, hdr->nm_len);
    1483     netlink_set_status(hdr, NL_MMAP_STATUS_VALID);
    1484    
    1485     NETLINK_CB(skb).flags |= NETLINK_SKB_DELIVERED;
    1486     diff --git a/net/wireless/chan.c b/net/wireless/chan.c
    1487     index fd556ac05fdb..e69a17da1e84 100644
    1488     --- a/net/wireless/chan.c
    1489     +++ b/net/wireless/chan.c
    1490     @@ -338,7 +338,7 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
    1491     {
    1492     struct ieee80211_sta_ht_cap *ht_cap;
    1493     struct ieee80211_sta_vht_cap *vht_cap;
    1494     - u32 width, control_freq;
    1495     + u32 width, control_freq, cap;
    1496    
    1497     if (WARN_ON(!cfg80211_chandef_valid(chandef)))
    1498     return false;
    1499     @@ -370,7 +370,8 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
    1500     return false;
    1501     break;
    1502     case NL80211_CHAN_WIDTH_80P80:
    1503     - if (!(vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ))
    1504     + cap = vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
    1505     + if (cap != IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
    1506     return false;
    1507     case NL80211_CHAN_WIDTH_80:
    1508     if (!vht_cap->vht_supported)
    1509     @@ -381,7 +382,9 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
    1510     case NL80211_CHAN_WIDTH_160:
    1511     if (!vht_cap->vht_supported)
    1512     return false;
    1513     - if (!(vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ))
    1514     + cap = vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
    1515     + if (cap != IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ &&
    1516     + cap != IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
    1517     return false;
    1518     prohibited_flags |= IEEE80211_CHAN_NO_160MHZ;
    1519     width = 160;