Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-3.10/0174-3.10.75-all-fixes.patch

    Contents of /trunk/kernel-alx/patches-3.10/0174-3.10.75-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2662 - (show annotations) (download)
    Tue Jul 21 16:20:23 2015 UTC (8 years, 9 months ago) by niro
    File size: 25722 byte(s) 
    -linux-3.10.75
    1 diff --git a/Makefile b/Makefile
    2 index d2a3930159ea..87909d8302ad 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,6 +1,6 @@
    6 VERSION = 3
    7 PATCHLEVEL = 10
    8 -SUBLEVEL = 74
    9 +SUBLEVEL = 75
    10 EXTRAVERSION =
    11 NAME = TOSSUG Baby Fish
    12
    13 diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
    14 index a88894190e41..c991fe680e58 100644
    15 --- a/drivers/acpi/processor_idle.c
    16 +++ b/drivers/acpi/processor_idle.c
    17 @@ -978,7 +978,7 @@ static int acpi_processor_setup_cpuidle_states(struct acpi_processor *pr)
    18 return -EINVAL;
    19
    20 drv->safe_state_index = -1;
    21 - for (i = 0; i < CPUIDLE_STATE_MAX; i++) {
    22 + for (i = CPUIDLE_DRIVER_STATE_START; i < CPUIDLE_STATE_MAX; i++) {
    23 drv->states[i].name[0] = '\0';
    24 drv->states[i].desc[0] = '\0';
    25 }
    26 diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
    27 index cf1576d54363..a5c987ae665d 100644
    28 --- a/drivers/block/nbd.c
    29 +++ b/drivers/block/nbd.c
    30 @@ -815,10 +815,6 @@ static int __init nbd_init(void)
    31 return -EINVAL;
    32 }
    33
    34 - nbd_dev = kcalloc(nbds_max, sizeof(*nbd_dev), GFP_KERNEL);
    35 - if (!nbd_dev)
    36 - return -ENOMEM;
    37 -
    38 part_shift = 0;
    39 if (max_part > 0) {
    40 part_shift = fls(max_part);
    41 @@ -840,6 +836,10 @@ static int __init nbd_init(void)
    42 if (nbds_max > 1UL << (MINORBITS - part_shift))
    43 return -EINVAL;
    44
    45 + nbd_dev = kcalloc(nbds_max, sizeof(*nbd_dev), GFP_KERNEL);
    46 + if (!nbd_dev)
    47 + return -ENOMEM;
    48 +
    49 for (i = 0; i < nbds_max; i++) {
    50 struct gendisk *disk = alloc_disk(1 << part_shift);
    51 if (!disk)
    52 diff --git a/drivers/dma/omap-dma.c b/drivers/dma/omap-dma.c
    53 index ec3fc4fd9160..b94a37630e36 100644
    54 --- a/drivers/dma/omap-dma.c
    55 +++ b/drivers/dma/omap-dma.c
    56 @@ -487,6 +487,7 @@ static int omap_dma_terminate_all(struct omap_chan *c)
    57 * c->desc is NULL and exit.)
    58 */
    59 if (c->desc) {
    60 + omap_dma_desc_free(&c->desc->vd);
    61 c->desc = NULL;
    62 /* Avoid stopping the dma twice */
    63 if (!c->paused)
    64 diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c
    65 index b131520521e4..72b02483ff03 100644
    66 --- a/drivers/gpu/drm/radeon/radeon_bios.c
    67 +++ b/drivers/gpu/drm/radeon/radeon_bios.c
    68 @@ -76,7 +76,7 @@ static bool igp_read_bios_from_vram(struct radeon_device *rdev)
    69
    70 static bool radeon_read_bios(struct radeon_device *rdev)
    71 {
    72 - uint8_t __iomem *bios;
    73 + uint8_t __iomem *bios, val1, val2;
    74 size_t size;
    75
    76 rdev->bios = NULL;
    77 @@ -86,15 +86,19 @@ static bool radeon_read_bios(struct radeon_device *rdev)
    78 return false;
    79 }
    80
    81 - if (size == 0 || bios[0] != 0x55 || bios[1] != 0xaa) {
    82 + val1 = readb(&bios[0]);
    83 + val2 = readb(&bios[1]);
    84 +
    85 + if (size == 0 || val1 != 0x55 || val2 != 0xaa) {
    86 pci_unmap_rom(rdev->pdev, bios);
    87 return false;
    88 }
    89 - rdev->bios = kmemdup(bios, size, GFP_KERNEL);
    90 + rdev->bios = kzalloc(size, GFP_KERNEL);
    91 if (rdev->bios == NULL) {
    92 pci_unmap_rom(rdev->pdev, bios);
    93 return false;
    94 }
    95 + memcpy_fromio(rdev->bios, bios, size);
    96 pci_unmap_rom(rdev->pdev, bios);
    97 return true;
    98 }
    99 diff --git a/drivers/iio/imu/adis_trigger.c b/drivers/iio/imu/adis_trigger.c
    100 index e0017c22bb9c..f53e9a803a0e 100644
    101 --- a/drivers/iio/imu/adis_trigger.c
    102 +++ b/drivers/iio/imu/adis_trigger.c
    103 @@ -60,7 +60,7 @@ int adis_probe_trigger(struct adis *adis, struct iio_dev *indio_dev)
    104 iio_trigger_set_drvdata(adis->trig, adis);
    105 ret = iio_trigger_register(adis->trig);
    106
    107 - indio_dev->trig = adis->trig;
    108 + indio_dev->trig = iio_trigger_get(adis->trig);
    109 if (ret)
    110 goto error_free_irq;
    111
    112 diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
    113 index 7da0832f187b..01d661e0fa6c 100644
    114 --- a/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
    115 +++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
    116 @@ -25,6 +25,16 @@
    117 #include <linux/poll.h>
    118 #include "inv_mpu_iio.h"
    119
    120 +static void inv_clear_kfifo(struct inv_mpu6050_state *st)
    121 +{
    122 + unsigned long flags;
    123 +
    124 + /* take the spin lock sem to avoid interrupt kick in */
    125 + spin_lock_irqsave(&st->time_stamp_lock, flags);
    126 + kfifo_reset(&st->timestamps);
    127 + spin_unlock_irqrestore(&st->time_stamp_lock, flags);
    128 +}
    129 +
    130 int inv_reset_fifo(struct iio_dev *indio_dev)
    131 {
    132 int result;
    133 @@ -51,6 +61,10 @@ int inv_reset_fifo(struct iio_dev *indio_dev)
    134 INV_MPU6050_BIT_FIFO_RST);
    135 if (result)
    136 goto reset_fifo_fail;
    137 +
    138 + /* clear timestamps fifo */
    139 + inv_clear_kfifo(st);
    140 +
    141 /* enable interrupt */
    142 if (st->chip_config.accl_fifo_enable ||
    143 st->chip_config.gyro_fifo_enable) {
    144 @@ -84,16 +98,6 @@ reset_fifo_fail:
    145 return result;
    146 }
    147
    148 -static void inv_clear_kfifo(struct inv_mpu6050_state *st)
    149 -{
    150 - unsigned long flags;
    151 -
    152 - /* take the spin lock sem to avoid interrupt kick in */
    153 - spin_lock_irqsave(&st->time_stamp_lock, flags);
    154 - kfifo_reset(&st->timestamps);
    155 - spin_unlock_irqrestore(&st->time_stamp_lock, flags);
    156 -}
    157 -
    158 /**
    159 * inv_mpu6050_irq_handler() - Cache a timestamp at each data ready interrupt.
    160 */
    161 @@ -187,7 +191,6 @@ end_session:
    162 flush_fifo:
    163 /* Flush HW and SW FIFOs. */
    164 inv_reset_fifo(indio_dev);
    165 - inv_clear_kfifo(st);
    166 mutex_unlock(&indio_dev->mlock);
    167 iio_trigger_notify_done(indio_dev->trig);
    168
    169 diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
    170 index a84112322071..055ebebc07dd 100644
    171 --- a/drivers/infiniband/core/umem.c
    172 +++ b/drivers/infiniband/core/umem.c
    173 @@ -94,6 +94,14 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
    174 if (dmasync)
    175 dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs);
    176
    177 + /*
    178 + * If the combination of the addr and size requested for this memory
    179 + * region causes an integer overflow, return error.
    180 + */
    181 + if ((PAGE_ALIGN(addr + size) <= size) ||
    182 + (PAGE_ALIGN(addr + size) <= addr))
    183 + return ERR_PTR(-EINVAL);
    184 +
    185 if (!can_do_mlock())
    186 return ERR_PTR(-EPERM);
    187
    188 diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
    189 index 2c6f0f2ecd9d..949b38633496 100644
    190 --- a/drivers/infiniband/core/uverbs_main.c
    191 +++ b/drivers/infiniband/core/uverbs_main.c
    192 @@ -460,6 +460,7 @@ static void ib_uverbs_async_handler(struct ib_uverbs_file *file,
    193
    194 entry->desc.async.element = element;
    195 entry->desc.async.event_type = event;
    196 + entry->desc.async.reserved = 0;
    197 entry->counter = counter;
    198
    199 list_add_tail(&entry->list, &file->async_file->event_list);
    200 diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
    201 index 4d599cedbb0b..6ee534874535 100644
    202 --- a/drivers/infiniband/hw/mlx4/mad.c
    203 +++ b/drivers/infiniband/hw/mlx4/mad.c
    204 @@ -64,6 +64,14 @@ enum {
    205 #define GUID_TBL_BLK_NUM_ENTRIES 8
    206 #define GUID_TBL_BLK_SIZE (GUID_TBL_ENTRY_SIZE * GUID_TBL_BLK_NUM_ENTRIES)
    207
    208 +/* Counters should be saturate once they reach their maximum value */
    209 +#define ASSIGN_32BIT_COUNTER(counter, value) do {\
    210 + if ((value) > U32_MAX) \
    211 + counter = cpu_to_be32(U32_MAX); \
    212 + else \
    213 + counter = cpu_to_be32(value); \
    214 +} while (0)
    215 +
    216 struct mlx4_mad_rcv_buf {
    217 struct ib_grh grh;
    218 u8 payload[256];
    219 @@ -730,10 +738,14 @@ static int ib_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
    220 static void edit_counter(struct mlx4_counter *cnt,
    221 struct ib_pma_portcounters *pma_cnt)
    222 {
    223 - pma_cnt->port_xmit_data = cpu_to_be32((be64_to_cpu(cnt->tx_bytes)>>2));
    224 - pma_cnt->port_rcv_data = cpu_to_be32((be64_to_cpu(cnt->rx_bytes)>>2));
    225 - pma_cnt->port_xmit_packets = cpu_to_be32(be64_to_cpu(cnt->tx_frames));
    226 - pma_cnt->port_rcv_packets = cpu_to_be32(be64_to_cpu(cnt->rx_frames));
    227 + ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_data,
    228 + (be64_to_cpu(cnt->tx_bytes) >> 2));
    229 + ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_data,
    230 + (be64_to_cpu(cnt->rx_bytes) >> 2));
    231 + ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_packets,
    232 + be64_to_cpu(cnt->tx_frames));
    233 + ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_packets,
    234 + be64_to_cpu(cnt->rx_frames));
    235 }
    236
    237 static int iboe_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
    238 diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_common.h b/drivers/media/platform/s5p-mfc/s5p_mfc_common.h
    239 index f804c1faa7ff..d3b54f7b849f 100644
    240 --- a/drivers/media/platform/s5p-mfc/s5p_mfc_common.h
    241 +++ b/drivers/media/platform/s5p-mfc/s5p_mfc_common.h
    242 @@ -29,7 +29,7 @@
    243
    244 /* Offset base used to differentiate between CAPTURE and OUTPUT
    245 * while mmaping */
    246 -#define DST_QUEUE_OFF_BASE (TASK_SIZE / 2)
    247 +#define DST_QUEUE_OFF_BASE (1 << 30)
    248
    249 #define MFC_BANK1_ALLOC_CTX 0
    250 #define MFC_BANK2_ALLOC_CTX 1
    251 diff --git a/drivers/net/wireless/iwlwifi/dvm/dev.h b/drivers/net/wireless/iwlwifi/dvm/dev.h
    252 index 71ea77576d22..e783ea0e3837 100644
    253 --- a/drivers/net/wireless/iwlwifi/dvm/dev.h
    254 +++ b/drivers/net/wireless/iwlwifi/dvm/dev.h
    255 @@ -670,7 +670,6 @@ struct iwl_priv {
    256 unsigned long reload_jiffies;
    257 int reload_count;
    258 bool ucode_loaded;
    259 - bool init_ucode_run; /* Don't run init uCode again */
    260
    261 u8 plcp_delta_threshold;
    262
    263 diff --git a/drivers/net/wireless/iwlwifi/dvm/ucode.c b/drivers/net/wireless/iwlwifi/dvm/ucode.c
    264 index 0a1cdc5e856b..5ad94a8080b8 100644
    265 --- a/drivers/net/wireless/iwlwifi/dvm/ucode.c
    266 +++ b/drivers/net/wireless/iwlwifi/dvm/ucode.c
    267 @@ -425,9 +425,6 @@ int iwl_run_init_ucode(struct iwl_priv *priv)
    268 if (!priv->fw->img[IWL_UCODE_INIT].sec[0].len)
    269 return 0;
    270
    271 - if (priv->init_ucode_run)
    272 - return 0;
    273 -
    274 iwl_init_notification_wait(&priv->notif_wait, &calib_wait,
    275 calib_complete, ARRAY_SIZE(calib_complete),
    276 iwlagn_wait_calib, priv);
    277 @@ -447,8 +444,6 @@ int iwl_run_init_ucode(struct iwl_priv *priv)
    278 */
    279 ret = iwl_wait_notification(&priv->notif_wait, &calib_wait,
    280 UCODE_CALIB_TIMEOUT);
    281 - if (!ret)
    282 - priv->init_ucode_run = true;
    283
    284 goto out;
    285
    286 diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
    287 index 1ad39c799c74..bfe812fcce34 100644
    288 --- a/drivers/scsi/be2iscsi/be_main.c
    289 +++ b/drivers/scsi/be2iscsi/be_main.c
    290 @@ -5080,9 +5080,9 @@ free_port:
    291 hba_free:
    292 if (phba->msix_enabled)
    293 pci_disable_msix(phba->pcidev);
    294 - iscsi_host_remove(phba->shost);
    295 pci_dev_put(phba->pcidev);
    296 iscsi_host_free(phba->shost);
    297 + pci_set_drvdata(pcidev, NULL);
    298 disable_pci:
    299 pci_disable_device(pcidev);
    300 return ret;
    301 diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
    302 index e5953c8018c5..9f3168e8e5a8 100644
    303 --- a/drivers/scsi/scsi_lib.c
    304 +++ b/drivers/scsi/scsi_lib.c
    305 @@ -1242,9 +1242,11 @@ int scsi_prep_state_check(struct scsi_device *sdev, struct request *req)
    306 "rejecting I/O to dead device\n");
    307 ret = BLKPREP_KILL;
    308 break;
    309 - case SDEV_QUIESCE:
    310 case SDEV_BLOCK:
    311 case SDEV_CREATED_BLOCK:
    312 + ret = BLKPREP_DEFER;
    313 + break;
    314 + case SDEV_QUIESCE:
    315 /*
    316 * If the devices is blocked we defer normal commands.
    317 */
    318 diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
    319 index 9559ea749d83..5a3ea20e9cb5 100644
    320 --- a/drivers/target/iscsi/iscsi_target.c
    321 +++ b/drivers/target/iscsi/iscsi_target.c
    322 @@ -1179,7 +1179,7 @@ iscsit_handle_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
    323 * traditional iSCSI block I/O.
    324 */
    325 if (iscsit_allocate_iovecs(cmd) < 0) {
    326 - return iscsit_add_reject_cmd(cmd,
    327 + return iscsit_reject_cmd(cmd,
    328 ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
    329 }
    330 immed_data = cmd->immediate_data;
    331 diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
    332 index 0e57bcb8e3f7..2320e20d5be7 100644
    333 --- a/drivers/usb/host/xhci-pci.c
    334 +++ b/drivers/usb/host/xhci-pci.c
    335 @@ -94,6 +94,7 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
    336 if (pdev->vendor == PCI_VENDOR_ID_INTEL) {
    337 xhci->quirks |= XHCI_LPM_SUPPORT;
    338 xhci->quirks |= XHCI_INTEL_HOST;
    339 + xhci->quirks |= XHCI_AVOID_BEI;
    340 }
    341 if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
    342 pdev->device == PCI_DEVICE_ID_INTEL_PANTHERPOINT_XHCI) {
    343 @@ -109,7 +110,6 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
    344 * PPT chipsets.
    345 */
    346 xhci->quirks |= XHCI_SPURIOUS_REBOOT;
    347 - xhci->quirks |= XHCI_AVOID_BEI;
    348 }
    349 if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
    350 pdev->device == PCI_DEVICE_ID_ASROCK_P67) {
    351 diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
    352 index cf127a080644..4d918d5f945a 100644
    353 --- a/drivers/usb/serial/ftdi_sio.c
    354 +++ b/drivers/usb/serial/ftdi_sio.c
    355 @@ -620,6 +620,7 @@ static struct usb_device_id id_table_combined [] = {
    356 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
    357 { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID),
    358 .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
    359 + { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) },
    360 /*
    361 * ELV devices:
    362 */
    363 @@ -1899,8 +1900,12 @@ static int ftdi_8u2232c_probe(struct usb_serial *serial)
    364 {
    365 struct usb_device *udev = serial->dev;
    366
    367 - if ((udev->manufacturer && !strcmp(udev->manufacturer, "CALAO Systems")) ||
    368 - (udev->product && !strcmp(udev->product, "BeagleBone/XDS100V2")))
    369 + if (udev->manufacturer && !strcmp(udev->manufacturer, "CALAO Systems"))
    370 + return ftdi_jtag_probe(serial);
    371 +
    372 + if (udev->product &&
    373 + (!strcmp(udev->product, "BeagleBone/XDS100V2") ||
    374 + !strcmp(udev->product, "SNAP Connect E10")))
    375 return ftdi_jtag_probe(serial);
    376
    377 return 0;
    378 diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
    379 index e8d352615297..e906b6aa2424 100644
    380 --- a/drivers/usb/serial/ftdi_sio_ids.h
    381 +++ b/drivers/usb/serial/ftdi_sio_ids.h
    382 @@ -561,6 +561,12 @@
    383 */
    384 #define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation Platform */
    385
    386 +/*
    387 + * Synapse Wireless product ids (FTDI_VID)
    388 + * http://www.synapse-wireless.com
    389 + */
    390 +#define FTDI_SYNAPSE_SS200_PID 0x9090 /* SS200 - SNAP Stick 200 */
    391 +
    392
    393 /********************************/
    394 /** third-party VID/PID combos **/
    395 diff --git a/fs/cifs/file.c b/fs/cifs/file.c
    396 index 5fcc10fa62bd..f4a8577c3e91 100644
    397 --- a/fs/cifs/file.c
    398 +++ b/fs/cifs/file.c
    399 @@ -1789,6 +1789,7 @@ refind_writable:
    400 cifsFileInfo_put(inv_file);
    401 spin_lock(&cifs_file_list_lock);
    402 ++refind;
    403 + inv_file = NULL;
    404 goto refind_writable;
    405 }
    406 }
    407 diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
    408 index 46387e49aa46..8cd6474e248f 100644
    409 --- a/fs/ocfs2/file.c
    410 +++ b/fs/ocfs2/file.c
    411 @@ -2372,10 +2372,14 @@ out_dio:
    412 /* buffered aio wouldn't have proper lock coverage today */
    413 BUG_ON(ret == -EIOCBQUEUED && !(file->f_flags & O_DIRECT));
    414
    415 + if (unlikely(written <= 0))
    416 + goto no_sync;
    417 +
    418 if (((file->f_flags & O_DSYNC) && !direct_io) || IS_SYNC(inode) ||
    419 ((file->f_flags & O_DIRECT) && !direct_io)) {
    420 - ret = filemap_fdatawrite_range(file->f_mapping, *ppos,
    421 - *ppos + count - 1);
    422 + ret = filemap_fdatawrite_range(file->f_mapping,
    423 + iocb->ki_pos - written,
    424 + iocb->ki_pos - 1);
    425 if (ret < 0)
    426 written = ret;
    427
    428 @@ -2388,10 +2392,12 @@ out_dio:
    429 }
    430
    431 if (!ret)
    432 - ret = filemap_fdatawait_range(file->f_mapping, *ppos,
    433 - *ppos + count - 1);
    434 + ret = filemap_fdatawait_range(file->f_mapping,
    435 + iocb->ki_pos - written,
    436 + iocb->ki_pos - 1);
    437 }
    438
    439 +no_sync:
    440 /*
    441 * deep in g_f_a_w_n()->ocfs2_direct_IO we pass in a ocfs2_dio_end_io
    442 * function pointer which is called when o_direct io completes so that
    443 diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
    444 index 65fc60a07c47..9f285fb9bab3 100644
    445 --- a/fs/proc/task_mmu.c
    446 +++ b/fs/proc/task_mmu.c
    447 @@ -1110,9 +1110,19 @@ out:
    448 return ret;
    449 }
    450
    451 +static int pagemap_open(struct inode *inode, struct file *file)
    452 +{
    453 + /* do not disclose physical addresses to unprivileged
    454 + userspace (closes a rowhammer attack vector) */
    455 + if (!capable(CAP_SYS_ADMIN))
    456 + return -EPERM;
    457 + return 0;
    458 +}
    459 +
    460 const struct file_operations proc_pagemap_operations = {
    461 .llseek = mem_lseek, /* borrow this */
    462 .read = pagemap_read,
    463 + .open = pagemap_open,
    464 };
    465 #endif /* CONFIG_PROC_PAGE_MONITOR */
    466
    467 diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h
    468 index fa1abeb45b76..49c48dda162d 100644
    469 --- a/include/linux/blk_types.h
    470 +++ b/include/linux/blk_types.h
    471 @@ -170,7 +170,9 @@ enum rq_flag_bits {
    472 __REQ_ELVPRIV, /* elevator private data attached */
    473 __REQ_FAILED, /* set if the request failed */
    474 __REQ_QUIET, /* don't worry about errors */
    475 - __REQ_PREEMPT, /* set for "ide_preempt" requests */
    476 + __REQ_PREEMPT, /* set for "ide_preempt" requests and also
    477 + for requests for which the SCSI "quiesce"
    478 + state must be ignored. */
    479 __REQ_ALLOCED, /* request came from our alloc pool */
    480 __REQ_COPY_USER, /* contains copies of user pages */
    481 __REQ_FLUSH_SEQ, /* request for flush sequence */
    482 diff --git a/include/linux/kernel.h b/include/linux/kernel.h
    483 index e9ef6d6b51d5..341551c7b4c8 100644
    484 --- a/include/linux/kernel.h
    485 +++ b/include/linux/kernel.h
    486 @@ -29,6 +29,19 @@
    487 #define ULLONG_MAX (~0ULL)
    488 #define SIZE_MAX (~(size_t)0)
    489
    490 +#define U8_MAX ((u8)~0U)
    491 +#define S8_MAX ((s8)(U8_MAX>>1))
    492 +#define S8_MIN ((s8)(-S8_MAX - 1))
    493 +#define U16_MAX ((u16)~0U)
    494 +#define S16_MAX ((s16)(U16_MAX>>1))
    495 +#define S16_MIN ((s16)(-S16_MAX - 1))
    496 +#define U32_MAX ((u32)~0U)
    497 +#define S32_MAX ((s32)(U32_MAX>>1))
    498 +#define S32_MIN ((s32)(-S32_MAX - 1))
    499 +#define U64_MAX ((u64)~0ULL)
    500 +#define S64_MAX ((s64)(U64_MAX>>1))
    501 +#define S64_MIN ((s64)(-S64_MAX - 1))
    502 +
    503 #define STACK_MAGIC 0xdeadbeef
    504
    505 #define REPEAT_BYTE(x) ((~0ul / 0xff) * (x))
    506 diff --git a/ipc/compat.c b/ipc/compat.c
    507 index 892f6585dd60..d3b376025e9b 100644
    508 --- a/ipc/compat.c
    509 +++ b/ipc/compat.c
    510 @@ -381,7 +381,7 @@ COMPAT_SYSCALL_DEFINE6(ipc, u32, call, int, first, int, second,
    511 uptr = compat_ptr(ipck.msgp);
    512 fifth = ipck.msgtyp;
    513 }
    514 - return do_msgrcv(first, uptr, second, fifth, third,
    515 + return do_msgrcv(first, uptr, second, (s32)fifth, third,
    516 compat_do_msg_fill);
    517 }
    518 case MSGGET:
    519 diff --git a/kernel/printk.c b/kernel/printk.c
    520 index f7aff4bd5454..fd0154a57d6e 100644
    521 --- a/kernel/printk.c
    522 +++ b/kernel/printk.c
    523 @@ -107,7 +107,7 @@ static struct console *exclusive_console;
    524 */
    525 struct console_cmdline
    526 {
    527 - char name[8]; /* Name of the driver */
    528 + char name[16]; /* Name of the driver */
    529 int index; /* Minor dev. to use */
    530 char *options; /* Options for the driver */
    531 #ifdef CONFIG_A11Y_BRAILLE_CONSOLE
    532 @@ -2290,6 +2290,8 @@ void register_console(struct console *newcon)
    533 */
    534 for (i = 0; i < MAX_CMDLINECONSOLES && console_cmdline[i].name[0];
    535 i++) {
    536 + BUILD_BUG_ON(sizeof(console_cmdline[i].name) !=
    537 + sizeof(newcon->name));
    538 if (strcmp(console_cmdline[i].name, newcon->name) != 0)
    539 continue;
    540 if (newcon->index >= 0 &&
    541 diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
    542 index 1ad92b46753e..2298237db142 100644
    543 --- a/mm/memory_hotplug.c
    544 +++ b/mm/memory_hotplug.c
    545 @@ -1039,6 +1039,10 @@ static pg_data_t __ref *hotadd_new_pgdat(int nid, u64 start)
    546 return NULL;
    547
    548 arch_refresh_nodedata(nid, pgdat);
    549 + } else {
    550 + /* Reset the nr_zones and classzone_idx to 0 before reuse */
    551 + pgdat->nr_zones = 0;
    552 + pgdat->classzone_idx = 0;
    553 }
    554
    555 /* we can use NODE_DATA(nid) from here */
    556 @@ -1802,15 +1806,6 @@ void try_offline_node(int nid)
    557 if (is_vmalloc_addr(zone->wait_table))
    558 vfree(zone->wait_table);
    559 }
    560 -
    561 - /*
    562 - * Since there is no way to guarentee the address of pgdat/zone is not
    563 - * on stack of any kernel threads or used by other kernel objects
    564 - * without reference counting or other symchronizing method, do not
    565 - * reset node_data and free pgdat here. Just reset it to 0 and reuse
    566 - * the memory when the node is online again.
    567 - */
    568 - memset(pgdat, 0, sizeof(*pgdat));
    569 }
    570 EXPORT_SYMBOL(try_offline_node);
    571
    572 diff --git a/mm/page-writeback.c b/mm/page-writeback.c
    573 index 73cbc5dc150b..b034f79deb0e 100644
    574 --- a/mm/page-writeback.c
    575 +++ b/mm/page-writeback.c
    576 @@ -793,8 +793,11 @@ static void bdi_update_write_bandwidth(struct backing_dev_info *bdi,
    577 * bw * elapsed + write_bandwidth * (period - elapsed)
    578 * write_bandwidth = ---------------------------------------------------
    579 * period
    580 + *
    581 + * @written may have decreased due to account_page_redirty().
    582 + * Avoid underflowing @bw calculation.
    583 */
    584 - bw = written - bdi->written_stamp;
    585 + bw = written - min(written, bdi->written_stamp);
    586 bw *= HZ;
    587 if (unlikely(elapsed > period)) {
    588 do_div(bw, elapsed);
    589 @@ -858,7 +861,7 @@ static void global_update_bandwidth(unsigned long thresh,
    590 unsigned long now)
    591 {
    592 static DEFINE_SPINLOCK(dirty_lock);
    593 - static unsigned long update_time;
    594 + static unsigned long update_time = INITIAL_JIFFIES;
    595
    596 /*
    597 * check locklessly first to optimize away locking for the most time
    598 diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
    599 index 913dc4f49b10..92b5e1f7d3b0 100644
    600 --- a/net/ipv4/tcp_output.c
    601 +++ b/net/ipv4/tcp_output.c
    602 @@ -2909,6 +2909,7 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
    603 goto fallback;
    604 syn_data->ip_summed = CHECKSUM_PARTIAL;
    605 memcpy(syn_data->cb, syn->cb, sizeof(syn->cb));
    606 + skb_shinfo(syn_data)->gso_segs = 1;
    607 if (unlikely(memcpy_fromiovecend(skb_put(syn_data, space),
    608 fo->data->msg_iov, 0, space))) {
    609 kfree_skb(syn_data);
    610 diff --git a/net/llc/sysctl_net_llc.c b/net/llc/sysctl_net_llc.c
    611 index 612a5ddaf93b..799bafc2af39 100644
    612 --- a/net/llc/sysctl_net_llc.c
    613 +++ b/net/llc/sysctl_net_llc.c
    614 @@ -18,28 +18,28 @@ static struct ctl_table llc2_timeout_table[] = {
    615 {
    616 .procname = "ack",
    617 .data = &sysctl_llc2_ack_timeout,
    618 - .maxlen = sizeof(long),
    619 + .maxlen = sizeof(sysctl_llc2_ack_timeout),
    620 .mode = 0644,
    621 .proc_handler = proc_dointvec_jiffies,
    622 },
    623 {
    624 .procname = "busy",
    625 .data = &sysctl_llc2_busy_timeout,
    626 - .maxlen = sizeof(long),
    627 + .maxlen = sizeof(sysctl_llc2_busy_timeout),
    628 .mode = 0644,
    629 .proc_handler = proc_dointvec_jiffies,
    630 },
    631 {
    632 .procname = "p",
    633 .data = &sysctl_llc2_p_timeout,
    634 - .maxlen = sizeof(long),
    635 + .maxlen = sizeof(sysctl_llc2_p_timeout),
    636 .mode = 0644,
    637 .proc_handler = proc_dointvec_jiffies,
    638 },
    639 {
    640 .procname = "rej",
    641 .data = &sysctl_llc2_rej_timeout,
    642 - .maxlen = sizeof(long),
    643 + .maxlen = sizeof(sysctl_llc2_rej_timeout),
    644 .mode = 0644,
    645 .proc_handler = proc_dointvec_jiffies,
    646 },
    647 diff --git a/net/netfilter/nfnetlink_queue_core.c b/net/netfilter/nfnetlink_queue_core.c
    648 index 2b8199f68785..5497f50af2f0 100644
    649 --- a/net/netfilter/nfnetlink_queue_core.c
    650 +++ b/net/netfilter/nfnetlink_queue_core.c
    651 @@ -228,7 +228,7 @@ nfqnl_flush(struct nfqnl_instance *queue, nfqnl_cmpfn cmpfn, unsigned long data)
    652 }
    653
    654 static int
    655 -nfqnl_zcopy(struct sk_buff *to, const struct sk_buff *from, int len, int hlen)
    656 +nfqnl_zcopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen)
    657 {
    658 int i, j = 0;
    659 int plen = 0; /* length of skb->head fragment */
    660 diff --git a/net/rds/sysctl.c b/net/rds/sysctl.c
    661 index 907214b4c4d0..fc6cbe827856 100644
    662 --- a/net/rds/sysctl.c
    663 +++ b/net/rds/sysctl.c
    664 @@ -71,14 +71,14 @@ static ctl_table rds_sysctl_rds_table[] = {
    665 {
    666 .procname = "max_unacked_packets",
    667 .data = &rds_sysctl_max_unacked_packets,
    668 - .maxlen = sizeof(unsigned long),
    669 + .maxlen = sizeof(int),
    670 .mode = 0644,
    671 .proc_handler = proc_dointvec,
    672 },
    673 {
    674 .procname = "max_unacked_bytes",
    675 .data = &rds_sysctl_max_unacked_bytes,
    676 - .maxlen = sizeof(unsigned long),
    677 + .maxlen = sizeof(int),
    678 .mode = 0644,
    679 .proc_handler = proc_dointvec,
    680 },
    681 diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
    682 index ff427733c290..464be51025f6 100644
    683 --- a/security/selinux/selinuxfs.c
    684 +++ b/security/selinux/selinuxfs.c
    685 @@ -150,7 +150,7 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
    686 goto out;
    687
    688 /* No partial writes. */
    689 - length = EINVAL;
    690 + length = -EINVAL;
    691 if (*ppos != 0)
    692 goto out;
    693
    694 diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
    695 index 4008034b6ebe..a8eb7fe2766e 100644
    696 --- a/sound/pci/hda/patch_realtek.c
    697 +++ b/sound/pci/hda/patch_realtek.c
    698 @@ -266,7 +266,7 @@ static void alc_auto_setup_eapd(struct hda_codec *codec, bool on)
    699 {
    700 /* We currently only handle front, HP */
    701 static hda_nid_t pins[] = {
    702 - 0x0f, 0x10, 0x14, 0x15, 0
    703 + 0x0f, 0x10, 0x14, 0x15, 0x17, 0
    704 };
    705 hda_nid_t *p;
    706 for (p = pins; *p; p++)
    707 @@ -3363,6 +3363,7 @@ enum {
    708 ALC269_FIXUP_QUANTA_MUTE,
    709 ALC269_FIXUP_LIFEBOOK,
    710 ALC269_FIXUP_LIFEBOOK_EXTMIC,
    711 + ALC269_FIXUP_LIFEBOOK_HP_PIN,
    712 ALC269_FIXUP_AMIC,
    713 ALC269_FIXUP_DMIC,
    714 ALC269VB_FIXUP_AMIC,
    715 @@ -3477,6 +3478,13 @@ static const struct hda_fixup alc269_fixups[] = {
    716 { }
    717 },
    718 },
    719 + [ALC269_FIXUP_LIFEBOOK_HP_PIN] = {
    720 + .type = HDA_FIXUP_PINS,
    721 + .v.pins = (const struct hda_pintbl[]) {
    722 + { 0x21, 0x0221102f }, /* HP out */
    723 + { }
    724 + },
    725 + },
    726 [ALC269_FIXUP_AMIC] = {
    727 .type = HDA_FIXUP_PINS,
    728 .v.pins = (const struct hda_pintbl[]) {
    729 @@ -3727,6 +3735,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
    730 SND_PCI_QUIRK(0x1025, 0x0742, "Acer AO756", ALC271_FIXUP_HP_GATE_MIC_JACK),
    731 SND_PCI_QUIRK_VENDOR(0x1025, "Acer Aspire", ALC271_FIXUP_DMIC),
    732 SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook", ALC269_FIXUP_LIFEBOOK),
    733 + SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN),
    734 SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
    735 SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE),
    736 SND_PCI_QUIRK(0x17aa, 0x215e, "Thinkpad L512", ALC269_FIXUP_SKU_IGNORE),
    737 diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
    738 index c89a5bf5c00e..c311681bd390 100644
    739 --- a/sound/usb/mixer_quirks.c
    740 +++ b/sound/usb/mixer_quirks.c
    741 @@ -175,6 +175,7 @@ static const struct rc_config {
    742 { USB_ID(0x041e, 0x3040), 2, 2, 6, 6, 2, 0x6e91 }, /* Live! 24-bit */
    743 { USB_ID(0x041e, 0x3042), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 */
    744 { USB_ID(0x041e, 0x30df), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */
    745 + { USB_ID(0x041e, 0x3237), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */
    746 { USB_ID(0x041e, 0x3048), 2, 2, 6, 6, 2, 0x6e91 }, /* Toshiba SB0500 */
    747 };
    748