Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-3.10/0165-3.10.66-all-fixes.patch

    Contents of /trunk/kernel-alx/patches-3.10/0165-3.10.66-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2653 - (show annotations) (download)
    Tue Jul 21 16:20:22 2015 UTC (8 years, 9 months ago) by niro
    File size: 50783 byte(s) 
    -linux-3.10.66
    1 diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
    2 index 1311a48a7367..98da831a14ba 100644
    3 --- a/Documentation/kernel-parameters.txt
    4 +++ b/Documentation/kernel-parameters.txt
    5 @@ -1061,6 +1061,7 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
    6 i8042.notimeout [HW] Ignore timeout condition signalled by controller
    7 i8042.reset [HW] Reset the controller during init and cleanup
    8 i8042.unlock [HW] Unlock (ignore) the keylock
    9 + i8042.kbdreset [HW] Reset device connected to KBD port
    10
    11 i810= [HW,DRM]
    12
    13 diff --git a/Makefile b/Makefile
    14 index 7889b38766db..12ae1ef5437a 100644
    15 --- a/Makefile
    16 +++ b/Makefile
    17 @@ -1,6 +1,6 @@
    18 VERSION = 3
    19 PATCHLEVEL = 10
    20 -SUBLEVEL = 65
    21 +SUBLEVEL = 66
    22 EXTRAVERSION =
    23 NAME = TOSSUG Baby Fish
    24
    25 diff --git a/arch/arc/boot/dts/nsimosci.dts b/arch/arc/boot/dts/nsimosci.dts
    26 index 398064cef746..4c169d825415 100644
    27 --- a/arch/arc/boot/dts/nsimosci.dts
    28 +++ b/arch/arc/boot/dts/nsimosci.dts
    29 @@ -20,7 +20,7 @@
    30 /* this is for console on PGU */
    31 /* bootargs = "console=tty0 consoleblank=0"; */
    32 /* this is for console on serial */
    33 - bootargs = "earlycon=uart8250,mmio32,0xc0000000,115200n8 console=tty0 console=ttyS0,115200n8 consoleblank=0 debug";
    34 + bootargs = "earlycon=uart8250,mmio32,0xf0000000,115200n8 console=tty0 console=ttyS0,115200n8 consoleblank=0 debug";
    35 };
    36
    37 aliases {
    38 @@ -46,9 +46,9 @@
    39 #interrupt-cells = <1>;
    40 };
    41
    42 - uart0: serial@c0000000 {
    43 + uart0: serial@f0000000 {
    44 compatible = "ns8250";
    45 - reg = <0xc0000000 0x2000>;
    46 + reg = <0xf0000000 0x2000>;
    47 interrupts = <11>;
    48 clock-frequency = <3686400>;
    49 baud = <115200>;
    50 @@ -57,21 +57,21 @@
    51 no-loopback-test = <1>;
    52 };
    53
    54 - pgu0: pgu@c9000000 {
    55 + pgu0: pgu@f9000000 {
    56 compatible = "snps,arcpgufb";
    57 - reg = <0xc9000000 0x400>;
    58 + reg = <0xf9000000 0x400>;
    59 };
    60
    61 - ps2: ps2@c9001000 {
    62 + ps2: ps2@f9001000 {
    63 compatible = "snps,arc_ps2";
    64 - reg = <0xc9000400 0x14>;
    65 + reg = <0xf9000400 0x14>;
    66 interrupts = <13>;
    67 interrupt-names = "arc_ps2_irq";
    68 };
    69
    70 - eth0: ethernet@c0003000 {
    71 + eth0: ethernet@f0003000 {
    72 compatible = "snps,oscilan";
    73 - reg = <0xc0003000 0x44>;
    74 + reg = <0xf0003000 0x44>;
    75 interrupts = <7>, <8>;
    76 interrupt-names = "rx", "tx";
    77 };
    78 diff --git a/arch/arm/boot/dts/imx25.dtsi b/arch/arm/boot/dts/imx25.dtsi
    79 index 701153992c69..82897e2d8d5a 100644
    80 --- a/arch/arm/boot/dts/imx25.dtsi
    81 +++ b/arch/arm/boot/dts/imx25.dtsi
    82 @@ -141,7 +141,7 @@
    83 #size-cells = <0>;
    84 compatible = "fsl,imx25-cspi", "fsl,imx35-cspi";
    85 reg = <0x43fa4000 0x4000>;
    86 - clocks = <&clks 62>, <&clks 62>;
    87 + clocks = <&clks 78>, <&clks 78>;
    88 clock-names = "ipg", "per";
    89 interrupts = <14>;
    90 status = "disabled";
    91 diff --git a/arch/arm/mach-imx/clk-imx6q.c b/arch/arm/mach-imx/clk-imx6q.c
    92 index 0b9e437719bd..2acaded8025d 100644
    93 --- a/arch/arm/mach-imx/clk-imx6q.c
    94 +++ b/arch/arm/mach-imx/clk-imx6q.c
    95 @@ -301,8 +301,8 @@ int __init mx6q_clocks_init(void)
    96 post_div_table[1].div = 1;
    97 post_div_table[2].div = 1;
    98 video_div_table[1].div = 1;
    99 - video_div_table[2].div = 1;
    100 - };
    101 + video_div_table[3].div = 1;
    102 + }
    103
    104 /* type name parent_name base div_mask */
    105 clk[pll1_sys] = imx_clk_pllv3(IMX_PLLV3_SYS, "pll1_sys", "osc", base, 0x7f);
    106 diff --git a/arch/arm/mach-omap2/timer.c b/arch/arm/mach-omap2/timer.c
    107 index f8b23b8040d9..3f3259e74fd3 100644
    108 --- a/arch/arm/mach-omap2/timer.c
    109 +++ b/arch/arm/mach-omap2/timer.c
    110 @@ -503,11 +503,11 @@ static void __init realtime_counter_init(void)
    111 rate = clk_get_rate(sys_clk);
    112 /* Numerator/denumerator values refer TRM Realtime Counter section */
    113 switch (rate) {
    114 - case 1200000:
    115 + case 12000000:
    116 num = 64;
    117 den = 125;
    118 break;
    119 - case 1300000:
    120 + case 13000000:
    121 num = 768;
    122 den = 1625;
    123 break;
    124 @@ -515,11 +515,11 @@ static void __init realtime_counter_init(void)
    125 num = 8;
    126 den = 25;
    127 break;
    128 - case 2600000:
    129 + case 26000000:
    130 num = 384;
    131 den = 1625;
    132 break;
    133 - case 2700000:
    134 + case 27000000:
    135 num = 256;
    136 den = 1125;
    137 break;
    138 diff --git a/arch/arm/mach-shmobile/setup-sh73a0.c b/arch/arm/mach-shmobile/setup-sh73a0.c
    139 index 9696f3646864..ea788c8e32e8 100644
    140 --- a/arch/arm/mach-shmobile/setup-sh73a0.c
    141 +++ b/arch/arm/mach-shmobile/setup-sh73a0.c
    142 @@ -814,6 +814,7 @@ static struct platform_device ipmmu_device = {
    143
    144 static struct renesas_intc_irqpin_config irqpin0_platform_data = {
    145 .irq_base = irq_pin(0), /* IRQ0 -> IRQ7 */
    146 + .control_parent = true,
    147 };
    148
    149 static struct resource irqpin0_resources[] = {
    150 @@ -875,6 +876,7 @@ static struct platform_device irqpin1_device = {
    151
    152 static struct renesas_intc_irqpin_config irqpin2_platform_data = {
    153 .irq_base = irq_pin(16), /* IRQ16 -> IRQ23 */
    154 + .control_parent = true,
    155 };
    156
    157 static struct resource irqpin2_resources[] = {
    158 @@ -905,6 +907,7 @@ static struct platform_device irqpin2_device = {
    159
    160 static struct renesas_intc_irqpin_config irqpin3_platform_data = {
    161 .irq_base = irq_pin(24), /* IRQ24 -> IRQ31 */
    162 + .control_parent = true,
    163 };
    164
    165 static struct resource irqpin3_resources[] = {
    166 diff --git a/arch/um/Kconfig.common b/arch/um/Kconfig.common
    167 index bceee6623b00..d1ff46c0559b 100644
    168 --- a/arch/um/Kconfig.common
    169 +++ b/arch/um/Kconfig.common
    170 @@ -8,6 +8,7 @@ config UML
    171 default y
    172 select HAVE_GENERIC_HARDIRQS
    173 select HAVE_UID16
    174 + select HAVE_FUTEX_CMPXCHG if FUTEX
    175 select GENERIC_IRQ_SHOW
    176 select GENERIC_CPU_DEVICES
    177 select GENERIC_IO
    178 diff --git a/arch/x86/kernel/kprobes/core.c b/arch/x86/kernel/kprobes/core.c
    179 index 211bce445522..0c6c07cea3f7 100644
    180 --- a/arch/x86/kernel/kprobes/core.c
    181 +++ b/arch/x86/kernel/kprobes/core.c
    182 @@ -1017,6 +1017,15 @@ int __kprobes setjmp_pre_handler(struct kprobe *p, struct pt_regs *regs)
    183 regs->flags &= ~X86_EFLAGS_IF;
    184 trace_hardirqs_off();
    185 regs->ip = (unsigned long)(jp->entry);
    186 +
    187 + /*
    188 + * jprobes use jprobe_return() which skips the normal return
    189 + * path of the function, and this messes up the accounting of the
    190 + * function graph tracer to get messed up.
    191 + *
    192 + * Pause function graph tracing while performing the jprobe function.
    193 + */
    194 + pause_graph_tracing();
    195 return 1;
    196 }
    197
    198 @@ -1042,24 +1051,25 @@ int __kprobes longjmp_break_handler(struct kprobe *p, struct pt_regs *regs)
    199 struct kprobe_ctlblk *kcb = get_kprobe_ctlblk();
    200 u8 *addr = (u8 *) (regs->ip - 1);
    201 struct jprobe *jp = container_of(p, struct jprobe, kp);
    202 + void *saved_sp = kcb->jprobe_saved_sp;
    203
    204 if ((addr > (u8 *) jprobe_return) &&
    205 (addr < (u8 *) jprobe_return_end)) {
    206 - if (stack_addr(regs) != kcb->jprobe_saved_sp) {
    207 + if (stack_addr(regs) != saved_sp) {
    208 struct pt_regs *saved_regs = &kcb->jprobe_saved_regs;
    209 printk(KERN_ERR
    210 "current sp %p does not match saved sp %p\n",
    211 - stack_addr(regs), kcb->jprobe_saved_sp);
    212 + stack_addr(regs), saved_sp);
    213 printk(KERN_ERR "Saved registers for jprobe %p\n", jp);
    214 show_regs(saved_regs);
    215 printk(KERN_ERR "Current registers\n");
    216 show_regs(regs);
    217 BUG();
    218 }
    219 + /* It's OK to start function graph tracing again */
    220 + unpause_graph_tracing();
    221 *regs = kcb->jprobe_saved_regs;
    222 - memcpy((kprobe_opcode_t *)(kcb->jprobe_saved_sp),
    223 - kcb->jprobes_stack,
    224 - MIN_STACK_SIZE(kcb->jprobe_saved_sp));
    225 + memcpy(saved_sp, kcb->jprobes_stack, MIN_STACK_SIZE(saved_sp));
    226 preempt_enable_no_resched();
    227 return 1;
    228 }
    229 diff --git a/arch/x86/um/sys_call_table_32.c b/arch/x86/um/sys_call_table_32.c
    230 index 531d4269e2e3..bd16d6c370ec 100644
    231 --- a/arch/x86/um/sys_call_table_32.c
    232 +++ b/arch/x86/um/sys_call_table_32.c
    233 @@ -34,7 +34,7 @@ typedef asmlinkage void (*sys_call_ptr_t)(void);
    234
    235 extern asmlinkage void sys_ni_syscall(void);
    236
    237 -const sys_call_ptr_t sys_call_table[] __cacheline_aligned = {
    238 +const sys_call_ptr_t sys_call_table[] ____cacheline_aligned = {
    239 /*
    240 * Smells like a compiler bug -- it doesn't work
    241 * when the & below is removed.
    242 diff --git a/arch/x86/um/sys_call_table_64.c b/arch/x86/um/sys_call_table_64.c
    243 index f2f0723070ca..95783087f0d3 100644
    244 --- a/arch/x86/um/sys_call_table_64.c
    245 +++ b/arch/x86/um/sys_call_table_64.c
    246 @@ -46,7 +46,7 @@ typedef void (*sys_call_ptr_t)(void);
    247
    248 extern void sys_ni_syscall(void);
    249
    250 -const sys_call_ptr_t sys_call_table[] __cacheline_aligned = {
    251 +const sys_call_ptr_t sys_call_table[] ____cacheline_aligned = {
    252 /*
    253 * Smells like a compiler bug -- it doesn't work
    254 * when the & below is removed.
    255 diff --git a/drivers/gpio/gpiolib-of.c b/drivers/gpio/gpiolib-of.c
    256 index 665f9530c950..af909a20dd70 100644
    257 --- a/drivers/gpio/gpiolib-of.c
    258 +++ b/drivers/gpio/gpiolib-of.c
    259 @@ -12,6 +12,7 @@
    260 */
    261
    262 #include <linux/device.h>
    263 +#include <linux/err.h>
    264 #include <linux/errno.h>
    265 #include <linux/module.h>
    266 #include <linux/io.h>
    267 @@ -42,8 +43,14 @@ static int of_gpiochip_find_and_xlate(struct gpio_chip *gc, void *data)
    268 return false;
    269
    270 ret = gc->of_xlate(gc, &gg_data->gpiospec, gg_data->flags);
    271 - if (ret < 0)
    272 - return false;
    273 + if (ret < 0) {
    274 + /* We've found the gpio chip, but the translation failed.
    275 + * Return true to stop looking and return the translation
    276 + * error via out_gpio
    277 + */
    278 + gg_data->out_gpio = ERR_PTR(ret);
    279 + return true;
    280 + }
    281
    282 gg_data->out_gpio = ret + gc->base;
    283 return true;
    284 diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
    285 index 2d90f96c19d0..7695b5dd9d2d 100644
    286 --- a/drivers/gpu/drm/i915/i915_reg.h
    287 +++ b/drivers/gpu/drm/i915/i915_reg.h
    288 @@ -317,6 +317,7 @@
    289 #define PIPE_CONTROL_GLOBAL_GTT_IVB (1<<24) /* gen7+ */
    290 #define PIPE_CONTROL_CS_STALL (1<<20)
    291 #define PIPE_CONTROL_TLB_INVALIDATE (1<<18)
    292 +#define PIPE_CONTROL_MEDIA_STATE_CLEAR (1<<16)
    293 #define PIPE_CONTROL_QW_WRITE (1<<14)
    294 #define PIPE_CONTROL_DEPTH_STALL (1<<13)
    295 #define PIPE_CONTROL_WRITE_FLUSH (1<<12)
    296 diff --git a/drivers/gpu/drm/i915/intel_ringbuffer.c b/drivers/gpu/drm/i915/intel_ringbuffer.c
    297 index 4605c3877c95..ef4cde15c15c 100644
    298 --- a/drivers/gpu/drm/i915/intel_ringbuffer.c
    299 +++ b/drivers/gpu/drm/i915/intel_ringbuffer.c
    300 @@ -314,12 +314,15 @@ gen7_render_ring_flush(struct intel_ring_buffer *ring,
    301 flags |= PIPE_CONTROL_VF_CACHE_INVALIDATE;
    302 flags |= PIPE_CONTROL_CONST_CACHE_INVALIDATE;
    303 flags |= PIPE_CONTROL_STATE_CACHE_INVALIDATE;
    304 + flags |= PIPE_CONTROL_MEDIA_STATE_CLEAR;
    305 /*
    306 * TLB invalidate requires a post-sync write.
    307 */
    308 flags |= PIPE_CONTROL_QW_WRITE;
    309 flags |= PIPE_CONTROL_GLOBAL_GTT_IVB;
    310
    311 + flags |= PIPE_CONTROL_STALL_AT_SCOREBOARD;
    312 +
    313 /* Workaround: we must issue a pipe_control with CS-stall bit
    314 * set before a pipe_control command that has the state cache
    315 * invalidate bit set. */
    316 diff --git a/drivers/gpu/drm/radeon/atombios_dp.c b/drivers/gpu/drm/radeon/atombios_dp.c
    317 index 4c05f2b015cf..d4a5118911fd 100644
    318 --- a/drivers/gpu/drm/radeon/atombios_dp.c
    319 +++ b/drivers/gpu/drm/radeon/atombios_dp.c
    320 @@ -574,6 +574,10 @@ int radeon_dp_mode_valid_helper(struct drm_connector *connector,
    321 struct radeon_connector_atom_dig *dig_connector;
    322 int dp_clock;
    323
    324 + if ((mode->clock > 340000) &&
    325 + (!radeon_connector_is_dp12_capable(connector)))
    326 + return MODE_CLOCK_HIGH;
    327 +
    328 if (!radeon_connector->con_priv)
    329 return MODE_CLOCK_HIGH;
    330 dig_connector = radeon_connector->con_priv;
    331 diff --git a/drivers/gpu/drm/radeon/radeon_ttm.c b/drivers/gpu/drm/radeon/radeon_ttm.c
    332 index 6c0ce8915fac..4a14e113369d 100644
    333 --- a/drivers/gpu/drm/radeon/radeon_ttm.c
    334 +++ b/drivers/gpu/drm/radeon/radeon_ttm.c
    335 @@ -189,7 +189,7 @@ static void radeon_evict_flags(struct ttm_buffer_object *bo,
    336 rbo = container_of(bo, struct radeon_bo, tbo);
    337 switch (bo->mem.mem_type) {
    338 case TTM_PL_VRAM:
    339 - if (rbo->rdev->ring[RADEON_RING_TYPE_GFX_INDEX].ready == false)
    340 + if (rbo->rdev->ring[radeon_copy_ring_index(rbo->rdev)].ready == false)
    341 radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_CPU);
    342 else
    343 radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_GTT);
    344 diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
    345 index c62d20e8a6f1..ee742f14ddc2 100644
    346 --- a/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
    347 +++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fence.c
    348 @@ -1049,6 +1049,8 @@ int vmw_event_fence_action_create(struct drm_file *file_priv,
    349 if (ret != 0)
    350 goto out_no_queue;
    351
    352 + return 0;
    353 +
    354 out_no_queue:
    355 event->base.destroy(&event->base);
    356 out_no_event:
    357 @@ -1123,17 +1125,10 @@ int vmw_fence_event_ioctl(struct drm_device *dev, void *data,
    358
    359 BUG_ON(fence == NULL);
    360
    361 - if (arg->flags & DRM_VMW_FE_FLAG_REQ_TIME)
    362 - ret = vmw_event_fence_action_create(file_priv, fence,
    363 - arg->flags,
    364 - arg->user_data,
    365 - true);
    366 - else
    367 - ret = vmw_event_fence_action_create(file_priv, fence,
    368 - arg->flags,
    369 - arg->user_data,
    370 - true);
    371 -
    372 + ret = vmw_event_fence_action_create(file_priv, fence,
    373 + arg->flags,
    374 + arg->user_data,
    375 + true);
    376 if (unlikely(ret != 0)) {
    377 if (ret != -ERESTARTSYS)
    378 DRM_ERROR("Failed to attach event to fence.\n");
    379 diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
    380 index ce715b1bee46..78227f32d6fa 100644
    381 --- a/drivers/input/serio/i8042-x86ia64io.h
    382 +++ b/drivers/input/serio/i8042-x86ia64io.h
    383 @@ -408,6 +408,13 @@ static const struct dmi_system_id __initconst i8042_dmi_nomux_table[] = {
    384 },
    385 },
    386 {
    387 + /* Acer Aspire 7738 */
    388 + .matches = {
    389 + DMI_MATCH(DMI_SYS_VENDOR, "Acer"),
    390 + DMI_MATCH(DMI_PRODUCT_NAME, "Aspire 7738"),
    391 + },
    392 + },
    393 + {
    394 /* Gericom Bellagio */
    395 .matches = {
    396 DMI_MATCH(DMI_SYS_VENDOR, "Gericom"),
    397 @@ -721,6 +728,35 @@ static const struct dmi_system_id __initconst i8042_dmi_dritek_table[] = {
    398 { }
    399 };
    400
    401 +/*
    402 + * Some laptops need keyboard reset before probing for the trackpad to get
    403 + * it detected, initialised & finally work.
    404 + */
    405 +static const struct dmi_system_id __initconst i8042_dmi_kbdreset_table[] = {
    406 + {
    407 + /* Gigabyte P35 v2 - Elantech touchpad */
    408 + .matches = {
    409 + DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
    410 + DMI_MATCH(DMI_PRODUCT_NAME, "P35V2"),
    411 + },
    412 + },
    413 + {
    414 + /* Aorus branded Gigabyte X3 Plus - Elantech touchpad */
    415 + .matches = {
    416 + DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
    417 + DMI_MATCH(DMI_PRODUCT_NAME, "X3"),
    418 + },
    419 + },
    420 + {
    421 + /* Gigabyte P34 - Elantech touchpad */
    422 + .matches = {
    423 + DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
    424 + DMI_MATCH(DMI_PRODUCT_NAME, "P34"),
    425 + },
    426 + },
    427 + { }
    428 +};
    429 +
    430 #endif /* CONFIG_X86 */
    431
    432 #ifdef CONFIG_PNP
    433 @@ -1001,6 +1037,9 @@ static int __init i8042_platform_init(void)
    434 if (dmi_check_system(i8042_dmi_dritek_table))
    435 i8042_dritek = true;
    436
    437 + if (dmi_check_system(i8042_dmi_kbdreset_table))
    438 + i8042_kbdreset = true;
    439 +
    440 /*
    441 * A20 was already enabled during early kernel init. But some buggy
    442 * BIOSes (in MSI Laptops) require A20 to be enabled using 8042 to
    443 diff --git a/drivers/input/serio/i8042.c b/drivers/input/serio/i8042.c
    444 index 78e4de42efaa..9870c540e6fb 100644
    445 --- a/drivers/input/serio/i8042.c
    446 +++ b/drivers/input/serio/i8042.c
    447 @@ -67,6 +67,10 @@ static bool i8042_notimeout;
    448 module_param_named(notimeout, i8042_notimeout, bool, 0);
    449 MODULE_PARM_DESC(notimeout, "Ignore timeouts signalled by i8042");
    450
    451 +static bool i8042_kbdreset;
    452 +module_param_named(kbdreset, i8042_kbdreset, bool, 0);
    453 +MODULE_PARM_DESC(kbdreset, "Reset device connected to KBD port");
    454 +
    455 #ifdef CONFIG_X86
    456 static bool i8042_dritek;
    457 module_param_named(dritek, i8042_dritek, bool, 0);
    458 @@ -783,6 +787,16 @@ static int __init i8042_check_aux(void)
    459 return -1;
    460
    461 /*
    462 + * Reset keyboard (needed on some laptops to successfully detect
    463 + * touchpad, e.g., some Gigabyte laptop models with Elantech
    464 + * touchpads).
    465 + */
    466 + if (i8042_kbdreset) {
    467 + pr_warn("Attempting to reset device connected to KBD port\n");
    468 + i8042_kbd_write(NULL, (unsigned char) 0xff);
    469 + }
    470 +
    471 +/*
    472 * Test AUX IRQ delivery to make sure BIOS did not grab the IRQ and
    473 * used it for a PCI card or somethig else.
    474 */
    475 diff --git a/drivers/media/i2c/smiapp-pll.c b/drivers/media/i2c/smiapp-pll.c
    476 index d8d5da7c52db..942305129e15 100644
    477 --- a/drivers/media/i2c/smiapp-pll.c
    478 +++ b/drivers/media/i2c/smiapp-pll.c
    479 @@ -67,7 +67,7 @@ static void print_pll(struct device *dev, struct smiapp_pll *pll)
    480 {
    481 dev_dbg(dev, "pre_pll_clk_div\t%d\n", pll->pre_pll_clk_div);
    482 dev_dbg(dev, "pll_multiplier \t%d\n", pll->pll_multiplier);
    483 - if (pll->flags != SMIAPP_PLL_FLAG_NO_OP_CLOCKS) {
    484 + if (!(pll->flags & SMIAPP_PLL_FLAG_NO_OP_CLOCKS)) {
    485 dev_dbg(dev, "op_sys_clk_div \t%d\n", pll->op_sys_clk_div);
    486 dev_dbg(dev, "op_pix_clk_div \t%d\n", pll->op_pix_clk_div);
    487 }
    488 @@ -77,7 +77,7 @@ static void print_pll(struct device *dev, struct smiapp_pll *pll)
    489 dev_dbg(dev, "ext_clk_freq_hz \t%d\n", pll->ext_clk_freq_hz);
    490 dev_dbg(dev, "pll_ip_clk_freq_hz \t%d\n", pll->pll_ip_clk_freq_hz);
    491 dev_dbg(dev, "pll_op_clk_freq_hz \t%d\n", pll->pll_op_clk_freq_hz);
    492 - if (pll->flags & SMIAPP_PLL_FLAG_NO_OP_CLOCKS) {
    493 + if (!(pll->flags & SMIAPP_PLL_FLAG_NO_OP_CLOCKS)) {
    494 dev_dbg(dev, "op_sys_clk_freq_hz \t%d\n",
    495 pll->op_sys_clk_freq_hz);
    496 dev_dbg(dev, "op_pix_clk_freq_hz \t%d\n",
    497 diff --git a/drivers/media/i2c/smiapp/smiapp-core.c b/drivers/media/i2c/smiapp/smiapp-core.c
    498 index b280216de31b..de8bc35d8b0b 100644
    499 --- a/drivers/media/i2c/smiapp/smiapp-core.c
    500 +++ b/drivers/media/i2c/smiapp/smiapp-core.c
    501 @@ -2629,7 +2629,9 @@ static int smiapp_registered(struct v4l2_subdev *subdev)
    502 pll->flags |= SMIAPP_PLL_FLAG_OP_PIX_CLOCK_PER_LANE;
    503 pll->scale_n = sensor->limits[SMIAPP_LIMIT_SCALER_N_MIN];
    504
    505 + mutex_lock(&sensor->mutex);
    506 rval = smiapp_update_mode(sensor);
    507 + mutex_unlock(&sensor->mutex);
    508 if (rval) {
    509 dev_err(&client->dev, "update mode failed\n");
    510 goto out_nvm_release;
    511 diff --git a/drivers/media/usb/dvb-usb/af9005.c b/drivers/media/usb/dvb-usb/af9005.c
    512 index af176b6ce738..e6d3561eea47 100644
    513 --- a/drivers/media/usb/dvb-usb/af9005.c
    514 +++ b/drivers/media/usb/dvb-usb/af9005.c
    515 @@ -1081,9 +1081,12 @@ static int __init af9005_usb_module_init(void)
    516 err("usb_register failed. (%d)", result);
    517 return result;
    518 }
    519 +#if IS_MODULE(CONFIG_DVB_USB_AF9005) || defined(CONFIG_DVB_USB_AF9005_REMOTE)
    520 + /* FIXME: convert to todays kernel IR infrastructure */
    521 rc_decode = symbol_request(af9005_rc_decode);
    522 rc_keys = symbol_request(rc_map_af9005_table);
    523 rc_keys_size = symbol_request(rc_map_af9005_table_size);
    524 +#endif
    525 if (rc_decode == NULL || rc_keys == NULL || rc_keys_size == NULL) {
    526 err("af9005_rc_decode function not found, disabling remote");
    527 af9005_properties.rc.legacy.rc_query = NULL;
    528 diff --git a/drivers/media/usb/uvc/uvc_driver.c b/drivers/media/usb/uvc/uvc_driver.c
    529 index 5dbefa68b1d2..363cdbf4ac8d 100644
    530 --- a/drivers/media/usb/uvc/uvc_driver.c
    531 +++ b/drivers/media/usb/uvc/uvc_driver.c
    532 @@ -1603,12 +1603,12 @@ static void uvc_delete(struct uvc_device *dev)
    533 {
    534 struct list_head *p, *n;
    535
    536 - usb_put_intf(dev->intf);
    537 - usb_put_dev(dev->udev);
    538 -
    539 uvc_status_cleanup(dev);
    540 uvc_ctrl_cleanup_device(dev);
    541
    542 + usb_put_intf(dev->intf);
    543 + usb_put_dev(dev->udev);
    544 +
    545 if (dev->vdev.dev)
    546 v4l2_device_unregister(&dev->vdev);
    547 #ifdef CONFIG_MEDIA_CONTROLLER
    548 diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
    549 index 2ea429c27714..836e2ac36a0d 100644
    550 --- a/drivers/mmc/host/sdhci.c
    551 +++ b/drivers/mmc/host/sdhci.c
    552 @@ -1316,6 +1316,8 @@ static void sdhci_request(struct mmc_host *mmc, struct mmc_request *mrq)
    553
    554 sdhci_runtime_pm_get(host);
    555
    556 + present = mmc_gpio_get_cd(host->mmc);
    557 +
    558 spin_lock_irqsave(&host->lock, flags);
    559
    560 WARN_ON(host->mrq != NULL);
    561 @@ -1344,7 +1346,6 @@ static void sdhci_request(struct mmc_host *mmc, struct mmc_request *mrq)
    562 * zero: cd-gpio is used, and card is removed
    563 * one: cd-gpio is used, and card is present
    564 */
    565 - present = mmc_gpio_get_cd(host->mmc);
    566 if (present < 0) {
    567 /* If polling, assume that the card is always present. */
    568 if (host->quirks & SDHCI_QUIRK_BROKEN_CARD_DETECTION)
    569 diff --git a/drivers/net/can/usb/kvaser_usb.c b/drivers/net/can/usb/kvaser_usb.c
    570 index cc3df8aebb87..63fb90b006ba 100644
    571 --- a/drivers/net/can/usb/kvaser_usb.c
    572 +++ b/drivers/net/can/usb/kvaser_usb.c
    573 @@ -1238,6 +1238,9 @@ static int kvaser_usb_close(struct net_device *netdev)
    574 if (err)
    575 netdev_warn(netdev, "Cannot stop device, error %d\n", err);
    576
    577 + /* reset tx contexts */
    578 + kvaser_usb_unlink_tx_urbs(priv);
    579 +
    580 priv->can.state = CAN_STATE_STOPPED;
    581 close_candev(priv->netdev);
    582
    583 @@ -1286,12 +1289,14 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
    584 if (!urb) {
    585 netdev_err(netdev, "No memory left for URBs\n");
    586 stats->tx_dropped++;
    587 - goto nourbmem;
    588 + dev_kfree_skb(skb);
    589 + return NETDEV_TX_OK;
    590 }
    591
    592 buf = kmalloc(sizeof(struct kvaser_msg), GFP_ATOMIC);
    593 if (!buf) {
    594 stats->tx_dropped++;
    595 + dev_kfree_skb(skb);
    596 goto nobufmem;
    597 }
    598
    599 @@ -1326,6 +1331,7 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
    600 }
    601 }
    602
    603 + /* This should never happen; it implies a flow control bug */
    604 if (!context) {
    605 netdev_warn(netdev, "cannot find free context\n");
    606 ret = NETDEV_TX_BUSY;
    607 @@ -1356,9 +1362,6 @@ static netdev_tx_t kvaser_usb_start_xmit(struct sk_buff *skb,
    608 if (unlikely(err)) {
    609 can_free_echo_skb(netdev, context->echo_index);
    610
    611 - skb = NULL; /* set to NULL to avoid double free in
    612 - * dev_kfree_skb(skb) */
    613 -
    614 atomic_dec(&priv->active_tx_urbs);
    615 usb_unanchor_urb(urb);
    616
    617 @@ -1380,8 +1383,6 @@ releasebuf:
    618 kfree(buf);
    619 nobufmem:
    620 usb_free_urb(urb);
    621 -nourbmem:
    622 - dev_kfree_skb(skb);
    623 return ret;
    624 }
    625
    626 @@ -1493,6 +1494,10 @@ static int kvaser_usb_init_one(struct usb_interface *intf,
    627 struct kvaser_usb_net_priv *priv;
    628 int i, err;
    629
    630 + err = kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, channel);
    631 + if (err)
    632 + return err;
    633 +
    634 netdev = alloc_candev(sizeof(*priv), MAX_TX_URBS);
    635 if (!netdev) {
    636 dev_err(&intf->dev, "Cannot alloc candev\n");
    637 @@ -1596,9 +1601,6 @@ static int kvaser_usb_probe(struct usb_interface *intf,
    638
    639 usb_set_intfdata(intf, dev);
    640
    641 - for (i = 0; i < MAX_NET_DEVICES; i++)
    642 - kvaser_usb_send_simple_msg(dev, CMD_RESET_CHIP, i);
    643 -
    644 err = kvaser_usb_get_software_info(dev);
    645 if (err) {
    646 dev_err(&intf->dev,
    647 diff --git a/drivers/net/ethernet/atheros/alx/main.c b/drivers/net/ethernet/atheros/alx/main.c
    648 index d30085c2b454..a85a9c2f1385 100644
    649 --- a/drivers/net/ethernet/atheros/alx/main.c
    650 +++ b/drivers/net/ethernet/atheros/alx/main.c
    651 @@ -184,15 +184,16 @@ static void alx_schedule_reset(struct alx_priv *alx)
    652 schedule_work(&alx->reset_wk);
    653 }
    654
    655 -static bool alx_clean_rx_irq(struct alx_priv *alx, int budget)
    656 +static int alx_clean_rx_irq(struct alx_priv *alx, int budget)
    657 {
    658 struct alx_rx_queue *rxq = &alx->rxq;
    659 struct alx_rrd *rrd;
    660 struct alx_buffer *rxb;
    661 struct sk_buff *skb;
    662 u16 length, rfd_cleaned = 0;
    663 + int work = 0;
    664
    665 - while (budget > 0) {
    666 + while (work < budget) {
    667 rrd = &rxq->rrd[rxq->rrd_read_idx];
    668 if (!(rrd->word3 & cpu_to_le32(1 << RRD_UPDATED_SHIFT)))
    669 break;
    670 @@ -203,7 +204,7 @@ static bool alx_clean_rx_irq(struct alx_priv *alx, int budget)
    671 ALX_GET_FIELD(le32_to_cpu(rrd->word0),
    672 RRD_NOR) != 1) {
    673 alx_schedule_reset(alx);
    674 - return 0;
    675 + return work;
    676 }
    677
    678 rxb = &rxq->bufs[rxq->read_idx];
    679 @@ -243,7 +244,7 @@ static bool alx_clean_rx_irq(struct alx_priv *alx, int budget)
    680 }
    681
    682 napi_gro_receive(&alx->napi, skb);
    683 - budget--;
    684 + work++;
    685
    686 next_pkt:
    687 if (++rxq->read_idx == alx->rx_ringsz)
    688 @@ -258,21 +259,22 @@ next_pkt:
    689 if (rfd_cleaned)
    690 alx_refill_rx_ring(alx, GFP_ATOMIC);
    691
    692 - return budget > 0;
    693 + return work;
    694 }
    695
    696 static int alx_poll(struct napi_struct *napi, int budget)
    697 {
    698 struct alx_priv *alx = container_of(napi, struct alx_priv, napi);
    699 struct alx_hw *hw = &alx->hw;
    700 - bool complete = true;
    701 unsigned long flags;
    702 + bool tx_complete;
    703 + int work;
    704
    705 - complete = alx_clean_tx_irq(alx) &&
    706 - alx_clean_rx_irq(alx, budget);
    707 + tx_complete = alx_clean_tx_irq(alx);
    708 + work = alx_clean_rx_irq(alx, budget);
    709
    710 - if (!complete)
    711 - return 1;
    712 + if (!tx_complete || work == budget)
    713 + return budget;
    714
    715 napi_complete(&alx->napi);
    716
    717 @@ -284,7 +286,7 @@ static int alx_poll(struct napi_struct *napi, int budget)
    718
    719 alx_post_write(hw);
    720
    721 - return 0;
    722 + return work;
    723 }
    724
    725 static irqreturn_t alx_intr_handle(struct alx_priv *alx, u32 intr)
    726 diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
    727 index 5501cad30cfa..8c1eab1151b8 100644
    728 --- a/drivers/net/ethernet/broadcom/tg3.c
    729 +++ b/drivers/net/ethernet/broadcom/tg3.c
    730 @@ -17389,23 +17389,6 @@ static int tg3_init_one(struct pci_dev *pdev,
    731 goto err_out_apeunmap;
    732 }
    733
    734 - /*
    735 - * Reset chip in case UNDI or EFI driver did not shutdown
    736 - * DMA self test will enable WDMAC and we'll see (spurious)
    737 - * pending DMA on the PCI bus at that point.
    738 - */
    739 - if ((tr32(HOSTCC_MODE) & HOSTCC_MODE_ENABLE) ||
    740 - (tr32(WDMAC_MODE) & WDMAC_MODE_ENABLE)) {
    741 - tw32(MEMARB_MODE, MEMARB_MODE_ENABLE);
    742 - tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
    743 - }
    744 -
    745 - err = tg3_test_dma(tp);
    746 - if (err) {
    747 - dev_err(&pdev->dev, "DMA engine test failed, aborting\n");
    748 - goto err_out_apeunmap;
    749 - }
    750 -
    751 intmbx = MAILBOX_INTERRUPT_0 + TG3_64BIT_REG_LOW;
    752 rcvmbx = MAILBOX_RCVRET_CON_IDX_0 + TG3_64BIT_REG_LOW;
    753 sndmbx = MAILBOX_SNDHOST_PROD_IDX_0 + TG3_64BIT_REG_LOW;
    754 @@ -17450,6 +17433,23 @@ static int tg3_init_one(struct pci_dev *pdev,
    755 sndmbx += 0xc;
    756 }
    757
    758 + /*
    759 + * Reset chip in case UNDI or EFI driver did not shutdown
    760 + * DMA self test will enable WDMAC and we'll see (spurious)
    761 + * pending DMA on the PCI bus at that point.
    762 + */
    763 + if ((tr32(HOSTCC_MODE) & HOSTCC_MODE_ENABLE) ||
    764 + (tr32(WDMAC_MODE) & WDMAC_MODE_ENABLE)) {
    765 + tw32(MEMARB_MODE, MEMARB_MODE_ENABLE);
    766 + tg3_halt(tp, RESET_KIND_SHUTDOWN, 1);
    767 + }
    768 +
    769 + err = tg3_test_dma(tp);
    770 + if (err) {
    771 + dev_err(&pdev->dev, "DMA engine test failed, aborting\n");
    772 + goto err_out_apeunmap;
    773 + }
    774 +
    775 tg3_init_coal(tp);
    776
    777 pci_set_drvdata(pdev, dev);
    778 diff --git a/drivers/net/ethernet/cisco/enic/enic_main.c b/drivers/net/ethernet/cisco/enic/enic_main.c
    779 index 635f55992d7e..8cc0eaa9d6f1 100644
    780 --- a/drivers/net/ethernet/cisco/enic/enic_main.c
    781 +++ b/drivers/net/ethernet/cisco/enic/enic_main.c
    782 @@ -1294,10 +1294,14 @@ static void enic_rq_indicate_buf(struct vnic_rq *rq,
    783 skb_put(skb, bytes_written);
    784 skb->protocol = eth_type_trans(skb, netdev);
    785
    786 - if ((netdev->features & NETIF_F_RXCSUM) && !csum_not_calc) {
    787 - skb->csum = htons(checksum);
    788 - skb->ip_summed = CHECKSUM_COMPLETE;
    789 - }
    790 + /* Hardware does not provide whole packet checksum. It only
    791 + * provides pseudo checksum. Since hw validates the packet
    792 + * checksum but not provide us the checksum value. use
    793 + * CHECSUM_UNNECESSARY.
    794 + */
    795 + if ((netdev->features & NETIF_F_RXCSUM) && tcp_udp_csum_ok &&
    796 + ipv4_csum_ok)
    797 + skb->ip_summed = CHECKSUM_UNNECESSARY;
    798
    799 if (vlan_stripped)
    800 __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), vlan_tci);
    801 diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c
    802 index 0ed96df20162..3458eb6fd491 100644
    803 --- a/drivers/platform/x86/hp_accel.c
    804 +++ b/drivers/platform/x86/hp_accel.c
    805 @@ -237,6 +237,7 @@ static struct dmi_system_id lis3lv02d_dmi_ids[] = {
    806 AXIS_DMI_MATCH("HPB64xx", "HP ProBook 64", xy_swap),
    807 AXIS_DMI_MATCH("HPB64xx", "HP EliteBook 84", xy_swap),
    808 AXIS_DMI_MATCH("HPB65xx", "HP ProBook 65", x_inverted),
    809 + AXIS_DMI_MATCH("HPZBook15", "HP ZBook 15", x_inverted),
    810 { NULL, }
    811 /* Laptop models without axis info (yet):
    812 * "NC6910" "HP Compaq 6910"
    813 diff --git a/drivers/s390/char/con3215.c b/drivers/s390/char/con3215.c
    814 index bb86494e2b7b..19915c5b256f 100644
    815 --- a/drivers/s390/char/con3215.c
    816 +++ b/drivers/s390/char/con3215.c
    817 @@ -288,12 +288,16 @@ static void raw3215_timeout(unsigned long __data)
    818 unsigned long flags;
    819
    820 spin_lock_irqsave(get_ccwdev_lock(raw->cdev), flags);
    821 - if (raw->flags & RAW3215_TIMER_RUNS) {
    822 - del_timer(&raw->timer);
    823 - raw->flags &= ~RAW3215_TIMER_RUNS;
    824 - if (!(raw->port.flags & ASYNC_SUSPENDED)) {
    825 - raw3215_mk_write_req(raw);
    826 - raw3215_start_io(raw);
    827 + raw->flags &= ~RAW3215_TIMER_RUNS;
    828 + if (!(raw->port.flags & ASYNC_SUSPENDED)) {
    829 + raw3215_mk_write_req(raw);
    830 + raw3215_start_io(raw);
    831 + if ((raw->queued_read || raw->queued_write) &&
    832 + !(raw->flags & RAW3215_WORKING) &&
    833 + !(raw->flags & RAW3215_TIMER_RUNS)) {
    834 + raw->timer.expires = RAW3215_TIMEOUT + jiffies;
    835 + add_timer(&raw->timer);
    836 + raw->flags |= RAW3215_TIMER_RUNS;
    837 }
    838 }
    839 spin_unlock_irqrestore(get_ccwdev_lock(raw->cdev), flags);
    840 @@ -317,17 +321,15 @@ static inline void raw3215_try_io(struct raw3215_info *raw)
    841 (raw->flags & RAW3215_FLUSHING)) {
    842 /* execute write requests bigger than minimum size */
    843 raw3215_start_io(raw);
    844 - if (raw->flags & RAW3215_TIMER_RUNS) {
    845 - del_timer(&raw->timer);
    846 - raw->flags &= ~RAW3215_TIMER_RUNS;
    847 - }
    848 - } else if (!(raw->flags & RAW3215_TIMER_RUNS)) {
    849 - /* delay small writes */
    850 - raw->timer.expires = RAW3215_TIMEOUT + jiffies;
    851 - add_timer(&raw->timer);
    852 - raw->flags |= RAW3215_TIMER_RUNS;
    853 }
    854 }
    855 + if ((raw->queued_read || raw->queued_write) &&
    856 + !(raw->flags & RAW3215_WORKING) &&
    857 + !(raw->flags & RAW3215_TIMER_RUNS)) {
    858 + raw->timer.expires = RAW3215_TIMEOUT + jiffies;
    859 + add_timer(&raw->timer);
    860 + raw->flags |= RAW3215_TIMER_RUNS;
    861 + }
    862 }
    863
    864 /*
    865 @@ -1027,12 +1029,26 @@ static int tty3215_write(struct tty_struct * tty,
    866 const unsigned char *buf, int count)
    867 {
    868 struct raw3215_info *raw;
    869 + int i, written;
    870
    871 if (!tty)
    872 return 0;
    873 raw = (struct raw3215_info *) tty->driver_data;
    874 - raw3215_write(raw, buf, count);
    875 - return count;
    876 + written = count;
    877 + while (count > 0) {
    878 + for (i = 0; i < count; i++)
    879 + if (buf[i] == '\t' || buf[i] == '\n')
    880 + break;
    881 + raw3215_write(raw, buf, i);
    882 + count -= i;
    883 + buf += i;
    884 + if (count > 0) {
    885 + raw3215_putchar(raw, *buf);
    886 + count--;
    887 + buf++;
    888 + }
    889 + }
    890 + return written;
    891 }
    892
    893 /*
    894 @@ -1180,7 +1196,7 @@ static int __init tty3215_init(void)
    895 driver->subtype = SYSTEM_TYPE_TTY;
    896 driver->init_termios = tty_std_termios;
    897 driver->init_termios.c_iflag = IGNBRK | IGNPAR;
    898 - driver->init_termios.c_oflag = ONLCR | XTABS;
    899 + driver->init_termios.c_oflag = ONLCR;
    900 driver->init_termios.c_lflag = ISIG;
    901 driver->flags = TTY_DRIVER_REAL_RAW;
    902 tty_set_operations(driver, &tty3215_ops);
    903 diff --git a/drivers/scsi/storvsc_drv.c b/drivers/scsi/storvsc_drv.c
    904 index 87ca72d36d5b..a8990783ba66 100644
    905 --- a/drivers/scsi/storvsc_drv.c
    906 +++ b/drivers/scsi/storvsc_drv.c
    907 @@ -1439,13 +1439,12 @@ static int storvsc_queuecommand(struct Scsi_Host *host, struct scsi_cmnd *scmnd)
    908 if (ret == -EAGAIN) {
    909 /* no more space */
    910
    911 - if (cmd_request->bounce_sgl_count) {
    912 + if (cmd_request->bounce_sgl_count)
    913 destroy_bounce_buffer(cmd_request->bounce_sgl,
    914 cmd_request->bounce_sgl_count);
    915
    916 - ret = SCSI_MLQUEUE_DEVICE_BUSY;
    917 - goto queue_error;
    918 - }
    919 + ret = SCSI_MLQUEUE_DEVICE_BUSY;
    920 + goto queue_error;
    921 }
    922
    923 return 0;
    924 diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c
    925 index c9790f6fdd89..016e882356d6 100644
    926 --- a/drivers/target/iscsi/iscsi_target_util.c
    927 +++ b/drivers/target/iscsi/iscsi_target_util.c
    928 @@ -1349,15 +1349,15 @@ static int iscsit_do_tx_data(
    929 struct iscsi_conn *conn,
    930 struct iscsi_data_count *count)
    931 {
    932 - int data = count->data_length, total_tx = 0, tx_loop = 0, iov_len;
    933 + int ret, iov_len;
    934 struct kvec *iov_p;
    935 struct msghdr msg;
    936
    937 if (!conn || !conn->sock || !conn->conn_ops)
    938 return -1;
    939
    940 - if (data <= 0) {
    941 - pr_err("Data length is: %d\n", data);
    942 + if (count->data_length <= 0) {
    943 + pr_err("Data length is: %d\n", count->data_length);
    944 return -1;
    945 }
    946
    947 @@ -1366,20 +1366,16 @@ static int iscsit_do_tx_data(
    948 iov_p = count->iov;
    949 iov_len = count->iov_count;
    950
    951 - while (total_tx < data) {
    952 - tx_loop = kernel_sendmsg(conn->sock, &msg, iov_p, iov_len,
    953 - (data - total_tx));
    954 - if (tx_loop <= 0) {
    955 - pr_debug("tx_loop: %d total_tx %d\n",
    956 - tx_loop, total_tx);
    957 - return tx_loop;
    958 - }
    959 - total_tx += tx_loop;
    960 - pr_debug("tx_loop: %d, total_tx: %d, data: %d\n",
    961 - tx_loop, total_tx, data);
    962 + ret = kernel_sendmsg(conn->sock, &msg, iov_p, iov_len,
    963 + count->data_length);
    964 + if (ret != count->data_length) {
    965 + pr_err("Unexpected ret: %d send data %d\n",
    966 + ret, count->data_length);
    967 + return -EPIPE;
    968 }
    969 + pr_debug("ret: %d, sent data: %d\n", ret, count->data_length);
    970
    971 - return total_tx;
    972 + return ret;
    973 }
    974
    975 int rx_data(
    976 diff --git a/drivers/usb/dwc3/gadget.c b/drivers/usb/dwc3/gadget.c
    977 index 8f8e75e392de..87f8fc63b3e1 100644
    978 --- a/drivers/usb/dwc3/gadget.c
    979 +++ b/drivers/usb/dwc3/gadget.c
    980 @@ -907,8 +907,7 @@ static void dwc3_prepare_trbs(struct dwc3_ep *dep, bool starting)
    981
    982 if (i == (request->num_mapped_sgs - 1) ||
    983 sg_is_last(s)) {
    984 - if (list_is_last(&req->list,
    985 - &dep->request_list))
    986 + if (list_empty(&dep->request_list))
    987 last_one = true;
    988 chain = false;
    989 }
    990 @@ -926,6 +925,9 @@ static void dwc3_prepare_trbs(struct dwc3_ep *dep, bool starting)
    991 if (last_one)
    992 break;
    993 }
    994 +
    995 + if (last_one)
    996 + break;
    997 } else {
    998 dma = req->request.dma;
    999 length = req->request.length;
    1000 diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c
    1001 index 9cfe3af3101a..66c905884496 100644
    1002 --- a/drivers/usb/host/pci-quirks.c
    1003 +++ b/drivers/usb/host/pci-quirks.c
    1004 @@ -470,7 +470,8 @@ static void quirk_usb_handoff_ohci(struct pci_dev *pdev)
    1005 {
    1006 void __iomem *base;
    1007 u32 control;
    1008 - u32 fminterval;
    1009 + u32 fminterval = 0;
    1010 + bool no_fminterval = false;
    1011 int cnt;
    1012
    1013 if (!mmio_resource_enabled(pdev, 0))
    1014 @@ -480,6 +481,13 @@ static void quirk_usb_handoff_ohci(struct pci_dev *pdev)
    1015 if (base == NULL)
    1016 return;
    1017
    1018 + /*
    1019 + * ULi M5237 OHCI controller locks the whole system when accessing
    1020 + * the OHCI_FMINTERVAL offset.
    1021 + */
    1022 + if (pdev->vendor == PCI_VENDOR_ID_AL && pdev->device == 0x5237)
    1023 + no_fminterval = true;
    1024 +
    1025 control = readl(base + OHCI_CONTROL);
    1026
    1027 /* On PA-RISC, PDC can leave IR set incorrectly; ignore it there. */
    1028 @@ -518,7 +526,9 @@ static void quirk_usb_handoff_ohci(struct pci_dev *pdev)
    1029 }
    1030
    1031 /* software reset of the controller, preserving HcFmInterval */
    1032 - fminterval = readl(base + OHCI_FMINTERVAL);
    1033 + if (!no_fminterval)
    1034 + fminterval = readl(base + OHCI_FMINTERVAL);
    1035 +
    1036 writel(OHCI_HCR, base + OHCI_CMDSTATUS);
    1037
    1038 /* reset requires max 10 us delay */
    1039 @@ -527,7 +537,9 @@ static void quirk_usb_handoff_ohci(struct pci_dev *pdev)
    1040 break;
    1041 udelay(1);
    1042 }
    1043 - writel(fminterval, base + OHCI_FMINTERVAL);
    1044 +
    1045 + if (!no_fminterval)
    1046 + writel(fminterval, base + OHCI_FMINTERVAL);
    1047
    1048 /* Now the controller is safely in SUSPEND and nothing can wake it up */
    1049 iounmap(base);
    1050 diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
    1051 index a24714f6f88f..8e15acd204ef 100644
    1052 --- a/drivers/usb/serial/cp210x.c
    1053 +++ b/drivers/usb/serial/cp210x.c
    1054 @@ -120,10 +120,12 @@ static const struct usb_device_id id_table[] = {
    1055 { USB_DEVICE(0x10C4, 0x85F8) }, /* Virtenio Preon32 */
    1056 { USB_DEVICE(0x10C4, 0x8664) }, /* AC-Services CAN-IF */
    1057 { USB_DEVICE(0x10C4, 0x8665) }, /* AC-Services OBD-IF */
    1058 - { USB_DEVICE(0x10C4, 0x8875) }, /* CEL MeshConnect USB Stick */
    1059 + { USB_DEVICE(0x10C4, 0x8856) }, /* CEL EM357 ZigBee USB Stick - LR */
    1060 + { USB_DEVICE(0x10C4, 0x8857) }, /* CEL EM357 ZigBee USB Stick */
    1061 { USB_DEVICE(0x10C4, 0x88A4) }, /* MMB Networks ZigBee USB Device */
    1062 { USB_DEVICE(0x10C4, 0x88A5) }, /* Planet Innovation Ingeni ZigBee USB Device */
    1063 { USB_DEVICE(0x10C4, 0x8946) }, /* Ketra N1 Wireless Interface */
    1064 + { USB_DEVICE(0x10C4, 0x8977) }, /* CEL MeshWorks DevKit Device */
    1065 { USB_DEVICE(0x10C4, 0xEA60) }, /* Silicon Labs factory default */
    1066 { USB_DEVICE(0x10C4, 0xEA61) }, /* Silicon Labs factory default */
    1067 { USB_DEVICE(0x10C4, 0xEA70) }, /* Silicon Labs factory default */
    1068 diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
    1069 index f0e65c970d35..cec377b8bb8b 100644
    1070 --- a/drivers/usb/serial/keyspan.c
    1071 +++ b/drivers/usb/serial/keyspan.c
    1072 @@ -418,6 +418,8 @@ static void usa26_instat_callback(struct urb *urb)
    1073 }
    1074 port = serial->port[msg->port];
    1075 p_priv = usb_get_serial_port_data(port);
    1076 + if (!p_priv)
    1077 + goto resubmit;
    1078
    1079 /* Update handshaking pin state information */
    1080 old_dcd_state = p_priv->dcd_state;
    1081 @@ -428,7 +430,7 @@ static void usa26_instat_callback(struct urb *urb)
    1082
    1083 if (old_dcd_state != p_priv->dcd_state)
    1084 tty_port_tty_hangup(&port->port, true);
    1085 -
    1086 +resubmit:
    1087 /* Resubmit urb so we continue receiving */
    1088 err = usb_submit_urb(urb, GFP_ATOMIC);
    1089 if (err != 0)
    1090 @@ -543,6 +545,8 @@ static void usa28_instat_callback(struct urb *urb)
    1091 }
    1092 port = serial->port[msg->port];
    1093 p_priv = usb_get_serial_port_data(port);
    1094 + if (!p_priv)
    1095 + goto resubmit;
    1096
    1097 /* Update handshaking pin state information */
    1098 old_dcd_state = p_priv->dcd_state;
    1099 @@ -553,7 +557,7 @@ static void usa28_instat_callback(struct urb *urb)
    1100
    1101 if (old_dcd_state != p_priv->dcd_state && old_dcd_state)
    1102 tty_port_tty_hangup(&port->port, true);
    1103 -
    1104 +resubmit:
    1105 /* Resubmit urb so we continue receiving */
    1106 err = usb_submit_urb(urb, GFP_ATOMIC);
    1107 if (err != 0)
    1108 @@ -630,6 +634,8 @@ static void usa49_instat_callback(struct urb *urb)
    1109 }
    1110 port = serial->port[msg->portNumber];
    1111 p_priv = usb_get_serial_port_data(port);
    1112 + if (!p_priv)
    1113 + goto resubmit;
    1114
    1115 /* Update handshaking pin state information */
    1116 old_dcd_state = p_priv->dcd_state;
    1117 @@ -640,7 +646,7 @@ static void usa49_instat_callback(struct urb *urb)
    1118
    1119 if (old_dcd_state != p_priv->dcd_state && old_dcd_state)
    1120 tty_port_tty_hangup(&port->port, true);
    1121 -
    1122 +resubmit:
    1123 /* Resubmit urb so we continue receiving */
    1124 err = usb_submit_urb(urb, GFP_ATOMIC);
    1125 if (err != 0)
    1126 @@ -878,6 +884,8 @@ static void usa90_instat_callback(struct urb *urb)
    1127
    1128 port = serial->port[0];
    1129 p_priv = usb_get_serial_port_data(port);
    1130 + if (!p_priv)
    1131 + goto resubmit;
    1132
    1133 /* Update handshaking pin state information */
    1134 old_dcd_state = p_priv->dcd_state;
    1135 @@ -888,7 +896,7 @@ static void usa90_instat_callback(struct urb *urb)
    1136
    1137 if (old_dcd_state != p_priv->dcd_state && old_dcd_state)
    1138 tty_port_tty_hangup(&port->port, true);
    1139 -
    1140 +resubmit:
    1141 /* Resubmit urb so we continue receiving */
    1142 err = usb_submit_urb(urb, GFP_ATOMIC);
    1143 if (err != 0)
    1144 @@ -949,6 +957,8 @@ static void usa67_instat_callback(struct urb *urb)
    1145
    1146 port = serial->port[msg->port];
    1147 p_priv = usb_get_serial_port_data(port);
    1148 + if (!p_priv)
    1149 + goto resubmit;
    1150
    1151 /* Update handshaking pin state information */
    1152 old_dcd_state = p_priv->dcd_state;
    1153 @@ -957,7 +967,7 @@ static void usa67_instat_callback(struct urb *urb)
    1154
    1155 if (old_dcd_state != p_priv->dcd_state && old_dcd_state)
    1156 tty_port_tty_hangup(&port->port, true);
    1157 -
    1158 +resubmit:
    1159 /* Resubmit urb so we continue receiving */
    1160 err = usb_submit_urb(urb, GFP_ATOMIC);
    1161 if (err != 0)
    1162 diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
    1163 index ac3725440d64..dc55bc254c5c 100644
    1164 --- a/drivers/vfio/pci/vfio_pci.c
    1165 +++ b/drivers/vfio/pci/vfio_pci.c
    1166 @@ -519,13 +519,11 @@ static const struct vfio_device_ops vfio_pci_ops = {
    1167
    1168 static int vfio_pci_probe(struct pci_dev *pdev, const struct pci_device_id *id)
    1169 {
    1170 - u8 type;
    1171 struct vfio_pci_device *vdev;
    1172 struct iommu_group *group;
    1173 int ret;
    1174
    1175 - pci_read_config_byte(pdev, PCI_HEADER_TYPE, &type);
    1176 - if ((type & PCI_HEADER_TYPE) != PCI_HEADER_TYPE_NORMAL)
    1177 + if (pdev->hdr_type != PCI_HEADER_TYPE_NORMAL)
    1178 return -EINVAL;
    1179
    1180 group = iommu_group_get(&pdev->dev);
    1181 diff --git a/drivers/video/logo/logo.c b/drivers/video/logo/logo.c
    1182 index 080c35b34bbb..cc5dbb5b2f71 100644
    1183 --- a/drivers/video/logo/logo.c
    1184 +++ b/drivers/video/logo/logo.c
    1185 @@ -25,6 +25,21 @@ static bool nologo;
    1186 module_param(nologo, bool, 0);
    1187 MODULE_PARM_DESC(nologo, "Disables startup logo");
    1188
    1189 +/*
    1190 + * Logos are located in the initdata, and will be freed in kernel_init.
    1191 + * Use late_init to mark the logos as freed to prevent any further use.
    1192 + */
    1193 +
    1194 +static bool logos_freed;
    1195 +
    1196 +static int __init fb_logo_late_init(void)
    1197 +{
    1198 + logos_freed = true;
    1199 + return 0;
    1200 +}
    1201 +
    1202 +late_initcall(fb_logo_late_init);
    1203 +
    1204 /* logo's are marked __initdata. Use __init_refok to tell
    1205 * modpost that it is intended that this function uses data
    1206 * marked __initdata.
    1207 @@ -33,7 +48,7 @@ const struct linux_logo * __init_refok fb_find_logo(int depth)
    1208 {
    1209 const struct linux_logo *logo = NULL;
    1210
    1211 - if (nologo)
    1212 + if (nologo || logos_freed)
    1213 return NULL;
    1214
    1215 if (depth >= 1) {
    1216 diff --git a/fs/lockd/svc.c b/fs/lockd/svc.c
    1217 index 9c8a5a6d33df..7a318480ab7a 100644
    1218 --- a/fs/lockd/svc.c
    1219 +++ b/fs/lockd/svc.c
    1220 @@ -137,10 +137,6 @@ lockd(void *vrqstp)
    1221
    1222 dprintk("NFS locking service started (ver " LOCKD_VERSION ").\n");
    1223
    1224 - if (!nlm_timeout)
    1225 - nlm_timeout = LOCKD_DFLT_TIMEO;
    1226 - nlmsvc_timeout = nlm_timeout * HZ;
    1227 -
    1228 /*
    1229 * The main request loop. We don't terminate until the last
    1230 * NFS mount or NFS daemon has gone away.
    1231 @@ -346,6 +342,10 @@ static struct svc_serv *lockd_create_svc(void)
    1232 printk(KERN_WARNING
    1233 "lockd_up: no pid, %d users??\n", nlmsvc_users);
    1234
    1235 + if (!nlm_timeout)
    1236 + nlm_timeout = LOCKD_DFLT_TIMEO;
    1237 + nlmsvc_timeout = nlm_timeout * HZ;
    1238 +
    1239 serv = svc_create(&nlmsvc_program, LOCKD_BUFSIZE, NULL);
    1240 if (!serv) {
    1241 printk(KERN_WARNING "lockd_up: create service failed\n");
    1242 diff --git a/fs/nfs/nfs4client.c b/fs/nfs/nfs4client.c
    1243 index cc143ee7a56e..519833d0457e 100644
    1244 --- a/fs/nfs/nfs4client.c
    1245 +++ b/fs/nfs/nfs4client.c
    1246 @@ -394,20 +394,14 @@ static bool nfs4_match_clientids(struct nfs_client *a, struct nfs_client *b)
    1247 }
    1248
    1249 /*
    1250 - * Returns true if the server owners match
    1251 + * Returns true if the server major ids match
    1252 */
    1253 static bool
    1254 -nfs4_match_serverowners(struct nfs_client *a, struct nfs_client *b)
    1255 +nfs4_check_clientid_trunking(struct nfs_client *a, struct nfs_client *b)
    1256 {
    1257 struct nfs41_server_owner *o1 = a->cl_serverowner;
    1258 struct nfs41_server_owner *o2 = b->cl_serverowner;
    1259
    1260 - if (o1->minor_id != o2->minor_id) {
    1261 - dprintk("NFS: --> %s server owner minor IDs do not match\n",
    1262 - __func__);
    1263 - return false;
    1264 - }
    1265 -
    1266 if (o1->major_id_sz != o2->major_id_sz)
    1267 goto out_major_mismatch;
    1268 if (memcmp(o1->major_id, o2->major_id, o1->major_id_sz) != 0)
    1269 @@ -483,7 +477,12 @@ int nfs41_walk_client_list(struct nfs_client *new,
    1270 if (!nfs4_match_clientids(pos, new))
    1271 continue;
    1272
    1273 - if (!nfs4_match_serverowners(pos, new))
    1274 + /*
    1275 + * Note that session trunking is just a special subcase of
    1276 + * client id trunking. In either case, we want to fall back
    1277 + * to using the existing nfs_client.
    1278 + */
    1279 + if (!nfs4_check_clientid_trunking(pos, new))
    1280 continue;
    1281
    1282 atomic_inc(&pos->cl_count);
    1283 diff --git a/fs/notify/inode_mark.c b/fs/notify/inode_mark.c
    1284 index 74825be65b7b..fbb9dfb7b1d2 100644
    1285 --- a/fs/notify/inode_mark.c
    1286 +++ b/fs/notify/inode_mark.c
    1287 @@ -288,20 +288,25 @@ void fsnotify_unmount_inodes(struct list_head *list)
    1288 spin_unlock(&inode->i_lock);
    1289
    1290 /* In case the dropping of a reference would nuke next_i. */
    1291 - if ((&next_i->i_sb_list != list) &&
    1292 - atomic_read(&next_i->i_count)) {
    1293 + while (&next_i->i_sb_list != list) {
    1294 spin_lock(&next_i->i_lock);
    1295 - if (!(next_i->i_state & (I_FREEING | I_WILL_FREE))) {
    1296 + if (!(next_i->i_state & (I_FREEING | I_WILL_FREE)) &&
    1297 + atomic_read(&next_i->i_count)) {
    1298 __iget(next_i);
    1299 need_iput = next_i;
    1300 + spin_unlock(&next_i->i_lock);
    1301 + break;
    1302 }
    1303 spin_unlock(&next_i->i_lock);
    1304 + next_i = list_entry(next_i->i_sb_list.next,
    1305 + struct inode, i_sb_list);
    1306 }
    1307
    1308 /*
    1309 - * We can safely drop inode_sb_list_lock here because we hold
    1310 - * references on both inode and next_i. Also no new inodes
    1311 - * will be added since the umount has begun.
    1312 + * We can safely drop inode_sb_list_lock here because either
    1313 + * we actually hold references on both inode and next_i or
    1314 + * end of list. Also no new inodes will be added since the
    1315 + * umount has begun.
    1316 */
    1317 spin_unlock(&inode_sb_list_lock);
    1318
    1319 diff --git a/lib/decompress_bunzip2.c b/lib/decompress_bunzip2.c
    1320 index 31c5f7675fbf..f504027d66a8 100644
    1321 --- a/lib/decompress_bunzip2.c
    1322 +++ b/lib/decompress_bunzip2.c
    1323 @@ -184,7 +184,7 @@ static int INIT get_next_block(struct bunzip_data *bd)
    1324 if (get_bits(bd, 1))
    1325 return RETVAL_OBSOLETE_INPUT;
    1326 origPtr = get_bits(bd, 24);
    1327 - if (origPtr > dbufSize)
    1328 + if (origPtr >= dbufSize)
    1329 return RETVAL_DATA_ERROR;
    1330 /* mapping table: if some byte values are never used (encoding things
    1331 like ascii text), the compression code removes the gaps to have fewer
    1332 diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
    1333 index 11ef25c9cf43..923146c4f007 100644
    1334 --- a/net/ipv4/tcp_output.c
    1335 +++ b/net/ipv4/tcp_output.c
    1336 @@ -1862,7 +1862,7 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
    1337 if (unlikely(!tcp_snd_wnd_test(tp, skb, mss_now)))
    1338 break;
    1339
    1340 - if (tso_segs == 1) {
    1341 + if (tso_segs == 1 || !sk->sk_gso_max_segs) {
    1342 if (unlikely(!tcp_nagle_test(tp, skb, mss_now,
    1343 (tcp_skb_is_last(sk, skb) ?
    1344 nonagle : TCP_NAGLE_PUSH))))
    1345 @@ -1899,7 +1899,7 @@ static bool tcp_write_xmit(struct sock *sk, unsigned int mss_now, int nonagle,
    1346 }
    1347
    1348 limit = mss_now;
    1349 - if (tso_segs > 1 && !tcp_urg_mode(tp))
    1350 + if (tso_segs > 1 && sk->sk_gso_max_segs && !tcp_urg_mode(tp))
    1351 limit = tcp_mss_split_point(sk, skb, mss_now,
    1352 min_t(unsigned int,
    1353 cwnd_quota,
    1354 diff --git a/net/netfilter/ipset/ip_set_core.c b/net/netfilter/ipset/ip_set_core.c
    1355 index f77139007983..3b04dfd34554 100644
    1356 --- a/net/netfilter/ipset/ip_set_core.c
    1357 +++ b/net/netfilter/ipset/ip_set_core.c
    1358 @@ -1754,6 +1754,12 @@ ip_set_sockfn_get(struct sock *sk, int optval, void __user *user, int *len)
    1359 if (*op < IP_SET_OP_VERSION) {
    1360 /* Check the version at the beginning of operations */
    1361 struct ip_set_req_version *req_version = data;
    1362 +
    1363 + if (*len < sizeof(struct ip_set_req_version)) {
    1364 + ret = -EINVAL;
    1365 + goto done;
    1366 + }
    1367 +
    1368 if (req_version->version != IPSET_PROTOCOL) {
    1369 ret = -EPROTO;
    1370 goto done;
    1371 diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
    1372 index afe41178c9fb..f7ad5c630b65 100644
    1373 --- a/net/netlink/af_netlink.c
    1374 +++ b/net/netlink/af_netlink.c
    1375 @@ -374,14 +374,14 @@ out:
    1376 return err;
    1377 }
    1378
    1379 -static void netlink_frame_flush_dcache(const struct nl_mmap_hdr *hdr)
    1380 +static void netlink_frame_flush_dcache(const struct nl_mmap_hdr *hdr, unsigned int nm_len)
    1381 {
    1382 #if ARCH_IMPLEMENTS_FLUSH_DCACHE_PAGE == 1
    1383 struct page *p_start, *p_end;
    1384
    1385 /* First page is flushed through netlink_{get,set}_status */
    1386 p_start = pgvec_to_page(hdr + PAGE_SIZE);
    1387 - p_end = pgvec_to_page((void *)hdr + NL_MMAP_HDRLEN + hdr->nm_len - 1);
    1388 + p_end = pgvec_to_page((void *)hdr + NL_MMAP_HDRLEN + nm_len - 1);
    1389 while (p_start <= p_end) {
    1390 flush_dcache_page(p_start);
    1391 p_start++;
    1392 @@ -399,9 +399,9 @@ static enum nl_mmap_status netlink_get_status(const struct nl_mmap_hdr *hdr)
    1393 static void netlink_set_status(struct nl_mmap_hdr *hdr,
    1394 enum nl_mmap_status status)
    1395 {
    1396 + smp_mb();
    1397 hdr->nm_status = status;
    1398 flush_dcache_page(pgvec_to_page(hdr));
    1399 - smp_wmb();
    1400 }
    1401
    1402 static struct nl_mmap_hdr *
    1403 @@ -563,24 +563,16 @@ static int netlink_mmap_sendmsg(struct sock *sk, struct msghdr *msg,
    1404 struct nl_mmap_hdr *hdr;
    1405 struct sk_buff *skb;
    1406 unsigned int maxlen;
    1407 - bool excl = true;
    1408 int err = 0, len = 0;
    1409
    1410 - /* Netlink messages are validated by the receiver before processing.
    1411 - * In order to avoid userspace changing the contents of the message
    1412 - * after validation, the socket and the ring may only be used by a
    1413 - * single process, otherwise we fall back to copying.
    1414 - */
    1415 - if (atomic_long_read(&sk->sk_socket->file->f_count) > 1 ||
    1416 - atomic_read(&nlk->mapped) > 1)
    1417 - excl = false;
    1418 -
    1419 mutex_lock(&nlk->pg_vec_lock);
    1420
    1421 ring = &nlk->tx_ring;
    1422 maxlen = ring->frame_size - NL_MMAP_HDRLEN;
    1423
    1424 do {
    1425 + unsigned int nm_len;
    1426 +
    1427 hdr = netlink_current_frame(ring, NL_MMAP_STATUS_VALID);
    1428 if (hdr == NULL) {
    1429 if (!(msg->msg_flags & MSG_DONTWAIT) &&
    1430 @@ -588,35 +580,23 @@ static int netlink_mmap_sendmsg(struct sock *sk, struct msghdr *msg,
    1431 schedule();
    1432 continue;
    1433 }
    1434 - if (hdr->nm_len > maxlen) {
    1435 +
    1436 + nm_len = ACCESS_ONCE(hdr->nm_len);
    1437 + if (nm_len > maxlen) {
    1438 err = -EINVAL;
    1439 goto out;
    1440 }
    1441
    1442 - netlink_frame_flush_dcache(hdr);
    1443 + netlink_frame_flush_dcache(hdr, nm_len);
    1444
    1445 - if (likely(dst_portid == 0 && dst_group == 0 && excl)) {
    1446 - skb = alloc_skb_head(GFP_KERNEL);
    1447 - if (skb == NULL) {
    1448 - err = -ENOBUFS;
    1449 - goto out;
    1450 - }
    1451 - sock_hold(sk);
    1452 - netlink_ring_setup_skb(skb, sk, ring, hdr);
    1453 - NETLINK_CB(skb).flags |= NETLINK_SKB_TX;
    1454 - __skb_put(skb, hdr->nm_len);
    1455 - netlink_set_status(hdr, NL_MMAP_STATUS_RESERVED);
    1456 - atomic_inc(&ring->pending);
    1457 - } else {
    1458 - skb = alloc_skb(hdr->nm_len, GFP_KERNEL);
    1459 - if (skb == NULL) {
    1460 - err = -ENOBUFS;
    1461 - goto out;
    1462 - }
    1463 - __skb_put(skb, hdr->nm_len);
    1464 - memcpy(skb->data, (void *)hdr + NL_MMAP_HDRLEN, hdr->nm_len);
    1465 - netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED);
    1466 + skb = alloc_skb(nm_len, GFP_KERNEL);
    1467 + if (skb == NULL) {
    1468 + err = -ENOBUFS;
    1469 + goto out;
    1470 }
    1471 + __skb_put(skb, nm_len);
    1472 + memcpy(skb->data, (void *)hdr + NL_MMAP_HDRLEN, nm_len);
    1473 + netlink_set_status(hdr, NL_MMAP_STATUS_UNUSED);
    1474
    1475 netlink_increment_head(ring);
    1476
    1477 @@ -662,7 +642,7 @@ static void netlink_queue_mmaped_skb(struct sock *sk, struct sk_buff *skb)
    1478 hdr->nm_pid = NETLINK_CB(skb).creds.pid;
    1479 hdr->nm_uid = from_kuid(sk_user_ns(sk), NETLINK_CB(skb).creds.uid);
    1480 hdr->nm_gid = from_kgid(sk_user_ns(sk), NETLINK_CB(skb).creds.gid);
    1481 - netlink_frame_flush_dcache(hdr);
    1482 + netlink_frame_flush_dcache(hdr, hdr->nm_len);
    1483 netlink_set_status(hdr, NL_MMAP_STATUS_VALID);
    1484
    1485 NETLINK_CB(skb).flags |= NETLINK_SKB_DELIVERED;
    1486 diff --git a/net/wireless/chan.c b/net/wireless/chan.c
    1487 index fd556ac05fdb..e69a17da1e84 100644
    1488 --- a/net/wireless/chan.c
    1489 +++ b/net/wireless/chan.c
    1490 @@ -338,7 +338,7 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
    1491 {
    1492 struct ieee80211_sta_ht_cap *ht_cap;
    1493 struct ieee80211_sta_vht_cap *vht_cap;
    1494 - u32 width, control_freq;
    1495 + u32 width, control_freq, cap;
    1496
    1497 if (WARN_ON(!cfg80211_chandef_valid(chandef)))
    1498 return false;
    1499 @@ -370,7 +370,8 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
    1500 return false;
    1501 break;
    1502 case NL80211_CHAN_WIDTH_80P80:
    1503 - if (!(vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ))
    1504 + cap = vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
    1505 + if (cap != IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
    1506 return false;
    1507 case NL80211_CHAN_WIDTH_80:
    1508 if (!vht_cap->vht_supported)
    1509 @@ -381,7 +382,9 @@ bool cfg80211_chandef_usable(struct wiphy *wiphy,
    1510 case NL80211_CHAN_WIDTH_160:
    1511 if (!vht_cap->vht_supported)
    1512 return false;
    1513 - if (!(vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ))
    1514 + cap = vht_cap->cap & IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_MASK;
    1515 + if (cap != IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160MHZ &&
    1516 + cap != IEEE80211_VHT_CAP_SUPP_CHAN_WIDTH_160_80PLUS80MHZ)
    1517 return false;
    1518 prohibited_flags |= IEEE80211_CHAN_NO_160MHZ;
    1519 width = 160;