Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-4.4/0134-4.4.35-all-fixes.patch

    Contents of /trunk/kernel-alx/patches-4.4/0134-4.4.35-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2870 - (show annotations) (download)
    Mon Mar 27 13:49:13 2017 UTC (7 years, 1 month ago) by niro
    File size: 38198 byte(s) 
    linux-4.4.35
    1 diff --git a/Makefile b/Makefile
    2 index 30924aabf1b4..f88830af1533 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,6 +1,6 @@
    6 VERSION = 4
    7 PATCHLEVEL = 4
    8 -SUBLEVEL = 34
    9 +SUBLEVEL = 35
    10 EXTRAVERSION =
    11 NAME = Blurry Fish Butt
    12
    13 @@ -395,11 +395,12 @@ KBUILD_CFLAGS := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
    14 -fno-strict-aliasing -fno-common \
    15 -Werror-implicit-function-declaration \
    16 -Wno-format-security \
    17 - -std=gnu89
    18 + -std=gnu89 $(call cc-option,-fno-PIE)
    19 +
    20
    21 KBUILD_AFLAGS_KERNEL :=
    22 KBUILD_CFLAGS_KERNEL :=
    23 -KBUILD_AFLAGS := -D__ASSEMBLY__
    24 +KBUILD_AFLAGS := -D__ASSEMBLY__ $(call cc-option,-fno-PIE)
    25 KBUILD_AFLAGS_MODULE := -DMODULE
    26 KBUILD_CFLAGS_MODULE := -DMODULE
    27 KBUILD_LDFLAGS_MODULE := -T $(srctree)/scripts/module-common.lds
    28 diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
    29 index 6cb5834062a3..e2defc7593a4 100644
    30 --- a/arch/x86/kernel/cpu/amd.c
    31 +++ b/arch/x86/kernel/cpu/amd.c
    32 @@ -352,7 +352,6 @@ static void amd_detect_cmp(struct cpuinfo_x86 *c)
    33 #ifdef CONFIG_SMP
    34 unsigned bits;
    35 int cpu = smp_processor_id();
    36 - unsigned int socket_id, core_complex_id;
    37
    38 bits = c->x86_coreid_bits;
    39 /* Low order bits define the core id (index of core in socket) */
    40 @@ -370,10 +369,7 @@ static void amd_detect_cmp(struct cpuinfo_x86 *c)
    41 if (c->x86 != 0x17 || !cpuid_edx(0x80000006))
    42 return;
    43
    44 - socket_id = (c->apicid >> bits) - 1;
    45 - core_complex_id = (c->apicid & ((1 << bits) - 1)) >> 3;
    46 -
    47 - per_cpu(cpu_llc_id, cpu) = (socket_id << 3) | core_complex_id;
    48 + per_cpu(cpu_llc_id, cpu) = c->apicid >> 3;
    49 #endif
    50 }
    51
    52 diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
    53 index 685ef431a41d..7429d481a311 100644
    54 --- a/arch/x86/kvm/x86.c
    55 +++ b/arch/x86/kvm/x86.c
    56 @@ -199,7 +199,18 @@ static void kvm_on_user_return(struct user_return_notifier *urn)
    57 struct kvm_shared_msrs *locals
    58 = container_of(urn, struct kvm_shared_msrs, urn);
    59 struct kvm_shared_msr_values *values;
    60 + unsigned long flags;
    61
    62 + /*
    63 + * Disabling irqs at this point since the following code could be
    64 + * interrupted and executed through kvm_arch_hardware_disable()
    65 + */
    66 + local_irq_save(flags);
    67 + if (locals->registered) {
    68 + locals->registered = false;
    69 + user_return_notifier_unregister(urn);
    70 + }
    71 + local_irq_restore(flags);
    72 for (slot = 0; slot < shared_msrs_global.nr; ++slot) {
    73 values = &locals->values[slot];
    74 if (values->host != values->curr) {
    75 @@ -207,8 +218,6 @@ static void kvm_on_user_return(struct user_return_notifier *urn)
    76 values->curr = values->host;
    77 }
    78 }
    79 - locals->registered = false;
    80 - user_return_notifier_unregister(urn);
    81 }
    82
    83 static void shared_msr_update(unsigned slot, u32 msr)
    84 @@ -3317,6 +3326,7 @@ long kvm_arch_vcpu_ioctl(struct file *filp,
    85 };
    86 case KVM_SET_VAPIC_ADDR: {
    87 struct kvm_vapic_addr va;
    88 + int idx;
    89
    90 r = -EINVAL;
    91 if (!lapic_in_kernel(vcpu))
    92 @@ -3324,7 +3334,9 @@ long kvm_arch_vcpu_ioctl(struct file *filp,
    93 r = -EFAULT;
    94 if (copy_from_user(&va, argp, sizeof va))
    95 goto out;
    96 + idx = srcu_read_lock(&vcpu->kvm->srcu);
    97 r = kvm_lapic_set_vapic_addr(vcpu, va.vapic_addr);
    98 + srcu_read_unlock(&vcpu->kvm->srcu, idx);
    99 break;
    100 }
    101 case KVM_X86_SETUP_MCE: {
    102 diff --git a/arch/x86/purgatory/Makefile b/arch/x86/purgatory/Makefile
    103 index 2c835e356349..d445c5f1aeb1 100644
    104 --- a/arch/x86/purgatory/Makefile
    105 +++ b/arch/x86/purgatory/Makefile
    106 @@ -12,6 +12,7 @@ targets += purgatory.ro
    107
    108 KBUILD_CFLAGS := -fno-strict-aliasing -Wall -Wstrict-prototypes -fno-zero-initialized-in-bss -fno-builtin -ffreestanding -c -MD -Os -mcmodel=large
    109 KBUILD_CFLAGS += -m$(BITS)
    110 +KBUILD_CFLAGS += $(call cc-option,-fno-PIE)
    111
    112 $(obj)/purgatory.ro: $(PURGATORY_OBJS) FORCE
    113 $(call if_changed,ld)
    114 diff --git a/drivers/base/power/main.c b/drivers/base/power/main.c
    115 index ae60e6357d7b..e9b713675c7c 100644
    116 --- a/drivers/base/power/main.c
    117 +++ b/drivers/base/power/main.c
    118 @@ -1022,6 +1022,8 @@ static int __device_suspend_noirq(struct device *dev, pm_message_t state, bool a
    119 TRACE_DEVICE(dev);
    120 TRACE_SUSPEND(0);
    121
    122 + dpm_wait_for_children(dev, async);
    123 +
    124 if (async_error)
    125 goto Complete;
    126
    127 @@ -1033,8 +1035,6 @@ static int __device_suspend_noirq(struct device *dev, pm_message_t state, bool a
    128 if (dev->power.syscore || dev->power.direct_complete)
    129 goto Complete;
    130
    131 - dpm_wait_for_children(dev, async);
    132 -
    133 if (dev->pm_domain) {
    134 info = "noirq power domain ";
    135 callback = pm_noirq_op(&dev->pm_domain->ops, state);
    136 @@ -1169,6 +1169,8 @@ static int __device_suspend_late(struct device *dev, pm_message_t state, bool as
    137
    138 __pm_runtime_disable(dev, false);
    139
    140 + dpm_wait_for_children(dev, async);
    141 +
    142 if (async_error)
    143 goto Complete;
    144
    145 @@ -1180,8 +1182,6 @@ static int __device_suspend_late(struct device *dev, pm_message_t state, bool as
    146 if (dev->power.syscore || dev->power.direct_complete)
    147 goto Complete;
    148
    149 - dpm_wait_for_children(dev, async);
    150 -
    151 if (dev->pm_domain) {
    152 info = "late power domain ";
    153 callback = pm_late_early_op(&dev->pm_domain->ops, state);
    154 diff --git a/drivers/clk/mmp/clk-of-mmp2.c b/drivers/clk/mmp/clk-of-mmp2.c
    155 index 251533d87c65..f261b1d292c7 100644
    156 --- a/drivers/clk/mmp/clk-of-mmp2.c
    157 +++ b/drivers/clk/mmp/clk-of-mmp2.c
    158 @@ -313,7 +313,7 @@ static void __init mmp2_clk_init(struct device_node *np)
    159 }
    160
    161 pxa_unit->apmu_base = of_iomap(np, 1);
    162 - if (!pxa_unit->mpmu_base) {
    163 + if (!pxa_unit->apmu_base) {
    164 pr_err("failed to map apmu registers\n");
    165 return;
    166 }
    167 diff --git a/drivers/clk/mmp/clk-of-pxa168.c b/drivers/clk/mmp/clk-of-pxa168.c
    168 index 64eaf4141c69..427f4bb08665 100644
    169 --- a/drivers/clk/mmp/clk-of-pxa168.c
    170 +++ b/drivers/clk/mmp/clk-of-pxa168.c
    171 @@ -262,7 +262,7 @@ static void __init pxa168_clk_init(struct device_node *np)
    172 }
    173
    174 pxa_unit->apmu_base = of_iomap(np, 1);
    175 - if (!pxa_unit->mpmu_base) {
    176 + if (!pxa_unit->apmu_base) {
    177 pr_err("failed to map apmu registers\n");
    178 return;
    179 }
    180 diff --git a/drivers/clk/mmp/clk-of-pxa910.c b/drivers/clk/mmp/clk-of-pxa910.c
    181 index 13d6173326a4..cdf5ba566d3b 100644
    182 --- a/drivers/clk/mmp/clk-of-pxa910.c
    183 +++ b/drivers/clk/mmp/clk-of-pxa910.c
    184 @@ -282,7 +282,7 @@ static void __init pxa910_clk_init(struct device_node *np)
    185 }
    186
    187 pxa_unit->apmu_base = of_iomap(np, 1);
    188 - if (!pxa_unit->mpmu_base) {
    189 + if (!pxa_unit->apmu_base) {
    190 pr_err("failed to map apmu registers\n");
    191 return;
    192 }
    193 @@ -294,7 +294,7 @@ static void __init pxa910_clk_init(struct device_node *np)
    194 }
    195
    196 pxa_unit->apbcp_base = of_iomap(np, 3);
    197 - if (!pxa_unit->mpmu_base) {
    198 + if (!pxa_unit->apbcp_base) {
    199 pr_err("failed to map apbcp registers\n");
    200 return;
    201 }
    202 diff --git a/drivers/crypto/caam/caamalg.c b/drivers/crypto/caam/caamalg.c
    203 index b3044219772c..2cde3796cb82 100644
    204 --- a/drivers/crypto/caam/caamalg.c
    205 +++ b/drivers/crypto/caam/caamalg.c
    206 @@ -4542,6 +4542,15 @@ static int __init caam_algapi_init(void)
    207 if (!aes_inst && (alg_sel == OP_ALG_ALGSEL_AES))
    208 continue;
    209
    210 + /*
    211 + * Check support for AES modes not available
    212 + * on LP devices.
    213 + */
    214 + if ((cha_vid & CHA_ID_LS_AES_MASK) == CHA_ID_LS_AES_LP)
    215 + if ((alg->class1_alg_type & OP_ALG_AAI_MASK) ==
    216 + OP_ALG_AAI_XTS)
    217 + continue;
    218 +
    219 t_alg = caam_alg_alloc(alg);
    220 if (IS_ERR(t_alg)) {
    221 err = PTR_ERR(t_alg);
    222 diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu.h b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
    223 index ff5566c69f7d..e8e962f7b5cb 100644
    224 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu.h
    225 +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu.h
    226 @@ -532,6 +532,7 @@ struct amdgpu_bo {
    227 u64 metadata_flags;
    228 void *metadata;
    229 u32 metadata_size;
    230 + unsigned prime_shared_count;
    231 /* list of all virtual address to which this bo
    232 * is associated to
    233 */
    234 diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
    235 index f82a2dd83874..3c7a7235988d 100644
    236 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
    237 +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_bo_list.c
    238 @@ -117,7 +117,7 @@ static int amdgpu_bo_list_set(struct amdgpu_device *adev,
    239 entry->allowed_domains = AMDGPU_GEM_DOMAIN_GTT;
    240 }
    241 entry->tv.bo = &entry->robj->tbo;
    242 - entry->tv.shared = true;
    243 + entry->tv.shared = !entry->robj->prime_shared_count;
    244
    245 if (entry->prefered_domains == AMDGPU_GEM_DOMAIN_GDS)
    246 gds_obj = entry->robj;
    247 diff --git a/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c b/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c
    248 index 59f735a933a9..e6a7d30c3747 100644
    249 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c
    250 +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_prime.c
    251 @@ -77,20 +77,36 @@ struct drm_gem_object *amdgpu_gem_prime_import_sg_table(struct drm_device *dev,
    252 list_add_tail(&bo->list, &adev->gem.objects);
    253 mutex_unlock(&adev->gem.mutex);
    254
    255 + bo->prime_shared_count = 1;
    256 return &bo->gem_base;
    257 }
    258
    259 int amdgpu_gem_prime_pin(struct drm_gem_object *obj)
    260 {
    261 struct amdgpu_bo *bo = gem_to_amdgpu_bo(obj);
    262 - int ret = 0;
    263 + long ret = 0;
    264
    265 ret = amdgpu_bo_reserve(bo, false);
    266 if (unlikely(ret != 0))
    267 return ret;
    268
    269 + /*
    270 + * Wait for all shared fences to complete before we switch to future
    271 + * use of exclusive fence on this prime shared bo.
    272 + */
    273 + ret = reservation_object_wait_timeout_rcu(bo->tbo.resv, true, false,
    274 + MAX_SCHEDULE_TIMEOUT);
    275 + if (unlikely(ret < 0)) {
    276 + DRM_DEBUG_PRIME("Fence wait failed: %li\n", ret);
    277 + amdgpu_bo_unreserve(bo);
    278 + return ret;
    279 + }
    280 +
    281 /* pin buffer into GTT */
    282 ret = amdgpu_bo_pin(bo, AMDGPU_GEM_DOMAIN_GTT, NULL);
    283 + if (likely(ret == 0))
    284 + bo->prime_shared_count++;
    285 +
    286 amdgpu_bo_unreserve(bo);
    287 return ret;
    288 }
    289 @@ -105,6 +121,8 @@ void amdgpu_gem_prime_unpin(struct drm_gem_object *obj)
    290 return;
    291
    292 amdgpu_bo_unpin(bo);
    293 + if (bo->prime_shared_count)
    294 + bo->prime_shared_count--;
    295 amdgpu_bo_unreserve(bo);
    296 }
    297
    298 diff --git a/drivers/i2c/Kconfig b/drivers/i2c/Kconfig
    299 index 78fbee463628..65dbde778181 100644
    300 --- a/drivers/i2c/Kconfig
    301 +++ b/drivers/i2c/Kconfig
    302 @@ -59,7 +59,6 @@ config I2C_CHARDEV
    303
    304 config I2C_MUX
    305 tristate "I2C bus multiplexing support"
    306 - depends on HAS_IOMEM
    307 help
    308 Say Y here if you want the I2C core to support the ability to
    309 handle multiplexed I2C bus topologies, by presenting each
    310 diff --git a/drivers/i2c/muxes/Kconfig b/drivers/i2c/muxes/Kconfig
    311 index f06b0e24673b..af2a63cb4056 100644
    312 --- a/drivers/i2c/muxes/Kconfig
    313 +++ b/drivers/i2c/muxes/Kconfig
    314 @@ -63,6 +63,7 @@ config I2C_MUX_PINCTRL
    315
    316 config I2C_MUX_REG
    317 tristate "Register-based I2C multiplexer"
    318 + depends on HAS_IOMEM
    319 help
    320 If you say yes to this option, support will be included for a
    321 register based I2C multiplexer. This driver provides access to
    322 diff --git a/drivers/infiniband/core/cm.c b/drivers/infiniband/core/cm.c
    323 index 4d8e7f18a9af..941cd9b83941 100644
    324 --- a/drivers/infiniband/core/cm.c
    325 +++ b/drivers/infiniband/core/cm.c
    326 @@ -80,6 +80,8 @@ static struct ib_cm {
    327 __be32 random_id_operand;
    328 struct list_head timewait_list;
    329 struct workqueue_struct *wq;
    330 + /* Sync on cm change port state */
    331 + spinlock_t state_lock;
    332 } cm;
    333
    334 /* Counter indexes ordered by attribute ID */
    335 @@ -161,6 +163,8 @@ struct cm_port {
    336 struct ib_mad_agent *mad_agent;
    337 struct kobject port_obj;
    338 u8 port_num;
    339 + struct list_head cm_priv_prim_list;
    340 + struct list_head cm_priv_altr_list;
    341 struct cm_counter_group counter_group[CM_COUNTER_GROUPS];
    342 };
    343
    344 @@ -241,6 +245,12 @@ struct cm_id_private {
    345 u8 service_timeout;
    346 u8 target_ack_delay;
    347
    348 + struct list_head prim_list;
    349 + struct list_head altr_list;
    350 + /* Indicates that the send port mad is registered and av is set */
    351 + int prim_send_port_not_ready;
    352 + int altr_send_port_not_ready;
    353 +
    354 struct list_head work_list;
    355 atomic_t work_count;
    356 };
    357 @@ -259,20 +269,47 @@ static int cm_alloc_msg(struct cm_id_private *cm_id_priv,
    358 struct ib_mad_agent *mad_agent;
    359 struct ib_mad_send_buf *m;
    360 struct ib_ah *ah;
    361 + struct cm_av *av;
    362 + unsigned long flags, flags2;
    363 + int ret = 0;
    364
    365 + /* don't let the port to be released till the agent is down */
    366 + spin_lock_irqsave(&cm.state_lock, flags2);
    367 + spin_lock_irqsave(&cm.lock, flags);
    368 + if (!cm_id_priv->prim_send_port_not_ready)
    369 + av = &cm_id_priv->av;
    370 + else if (!cm_id_priv->altr_send_port_not_ready &&
    371 + (cm_id_priv->alt_av.port))
    372 + av = &cm_id_priv->alt_av;
    373 + else {
    374 + pr_info("%s: not valid CM id\n", __func__);
    375 + ret = -ENODEV;
    376 + spin_unlock_irqrestore(&cm.lock, flags);
    377 + goto out;
    378 + }
    379 + spin_unlock_irqrestore(&cm.lock, flags);
    380 + /* Make sure the port haven't released the mad yet */
    381 mad_agent = cm_id_priv->av.port->mad_agent;
    382 - ah = ib_create_ah(mad_agent->qp->pd, &cm_id_priv->av.ah_attr);
    383 - if (IS_ERR(ah))
    384 - return PTR_ERR(ah);
    385 + if (!mad_agent) {
    386 + pr_info("%s: not a valid MAD agent\n", __func__);
    387 + ret = -ENODEV;
    388 + goto out;
    389 + }
    390 + ah = ib_create_ah(mad_agent->qp->pd, &av->ah_attr);
    391 + if (IS_ERR(ah)) {
    392 + ret = PTR_ERR(ah);
    393 + goto out;
    394 + }
    395
    396 m = ib_create_send_mad(mad_agent, cm_id_priv->id.remote_cm_qpn,
    397 - cm_id_priv->av.pkey_index,
    398 + av->pkey_index,
    399 0, IB_MGMT_MAD_HDR, IB_MGMT_MAD_DATA,
    400 GFP_ATOMIC,
    401 IB_MGMT_BASE_VERSION);
    402 if (IS_ERR(m)) {
    403 ib_destroy_ah(ah);
    404 - return PTR_ERR(m);
    405 + ret = PTR_ERR(m);
    406 + goto out;
    407 }
    408
    409 /* Timeout set by caller if response is expected. */
    410 @@ -282,7 +319,10 @@ static int cm_alloc_msg(struct cm_id_private *cm_id_priv,
    411 atomic_inc(&cm_id_priv->refcount);
    412 m->context[0] = cm_id_priv;
    413 *msg = m;
    414 - return 0;
    415 +
    416 +out:
    417 + spin_unlock_irqrestore(&cm.state_lock, flags2);
    418 + return ret;
    419 }
    420
    421 static int cm_alloc_response_msg(struct cm_port *port,
    422 @@ -352,7 +392,8 @@ static void cm_init_av_for_response(struct cm_port *port, struct ib_wc *wc,
    423 grh, &av->ah_attr);
    424 }
    425
    426 -static int cm_init_av_by_path(struct ib_sa_path_rec *path, struct cm_av *av)
    427 +static int cm_init_av_by_path(struct ib_sa_path_rec *path, struct cm_av *av,
    428 + struct cm_id_private *cm_id_priv)
    429 {
    430 struct cm_device *cm_dev;
    431 struct cm_port *port = NULL;
    432 @@ -387,7 +428,17 @@ static int cm_init_av_by_path(struct ib_sa_path_rec *path, struct cm_av *av)
    433 &av->ah_attr);
    434 av->timeout = path->packet_life_time + 1;
    435
    436 - return 0;
    437 + spin_lock_irqsave(&cm.lock, flags);
    438 + if (&cm_id_priv->av == av)
    439 + list_add_tail(&cm_id_priv->prim_list, &port->cm_priv_prim_list);
    440 + else if (&cm_id_priv->alt_av == av)
    441 + list_add_tail(&cm_id_priv->altr_list, &port->cm_priv_altr_list);
    442 + else
    443 + ret = -EINVAL;
    444 +
    445 + spin_unlock_irqrestore(&cm.lock, flags);
    446 +
    447 + return ret;
    448 }
    449
    450 static int cm_alloc_id(struct cm_id_private *cm_id_priv)
    451 @@ -677,6 +728,8 @@ struct ib_cm_id *ib_create_cm_id(struct ib_device *device,
    452 spin_lock_init(&cm_id_priv->lock);
    453 init_completion(&cm_id_priv->comp);
    454 INIT_LIST_HEAD(&cm_id_priv->work_list);
    455 + INIT_LIST_HEAD(&cm_id_priv->prim_list);
    456 + INIT_LIST_HEAD(&cm_id_priv->altr_list);
    457 atomic_set(&cm_id_priv->work_count, -1);
    458 atomic_set(&cm_id_priv->refcount, 1);
    459 return &cm_id_priv->id;
    460 @@ -892,6 +945,15 @@ retest:
    461 break;
    462 }
    463
    464 + spin_lock_irq(&cm.lock);
    465 + if (!list_empty(&cm_id_priv->altr_list) &&
    466 + (!cm_id_priv->altr_send_port_not_ready))
    467 + list_del(&cm_id_priv->altr_list);
    468 + if (!list_empty(&cm_id_priv->prim_list) &&
    469 + (!cm_id_priv->prim_send_port_not_ready))
    470 + list_del(&cm_id_priv->prim_list);
    471 + spin_unlock_irq(&cm.lock);
    472 +
    473 cm_free_id(cm_id->local_id);
    474 cm_deref_id(cm_id_priv);
    475 wait_for_completion(&cm_id_priv->comp);
    476 @@ -1192,12 +1254,13 @@ int ib_send_cm_req(struct ib_cm_id *cm_id,
    477 goto out;
    478 }
    479
    480 - ret = cm_init_av_by_path(param->primary_path, &cm_id_priv->av);
    481 + ret = cm_init_av_by_path(param->primary_path, &cm_id_priv->av,
    482 + cm_id_priv);
    483 if (ret)
    484 goto error1;
    485 if (param->alternate_path) {
    486 ret = cm_init_av_by_path(param->alternate_path,
    487 - &cm_id_priv->alt_av);
    488 + &cm_id_priv->alt_av, cm_id_priv);
    489 if (ret)
    490 goto error1;
    491 }
    492 @@ -1639,7 +1702,8 @@ static int cm_req_handler(struct cm_work *work)
    493 cm_format_paths_from_req(req_msg, &work->path[0], &work->path[1]);
    494
    495 memcpy(work->path[0].dmac, cm_id_priv->av.ah_attr.dmac, ETH_ALEN);
    496 - ret = cm_init_av_by_path(&work->path[0], &cm_id_priv->av);
    497 + ret = cm_init_av_by_path(&work->path[0], &cm_id_priv->av,
    498 + cm_id_priv);
    499 if (ret) {
    500 ib_get_cached_gid(work->port->cm_dev->ib_device,
    501 work->port->port_num, 0, &work->path[0].sgid,
    502 @@ -1650,7 +1714,8 @@ static int cm_req_handler(struct cm_work *work)
    503 goto rejected;
    504 }
    505 if (req_msg->alt_local_lid) {
    506 - ret = cm_init_av_by_path(&work->path[1], &cm_id_priv->alt_av);
    507 + ret = cm_init_av_by_path(&work->path[1], &cm_id_priv->alt_av,
    508 + cm_id_priv);
    509 if (ret) {
    510 ib_send_cm_rej(cm_id, IB_CM_REJ_INVALID_ALT_GID,
    511 &work->path[0].sgid,
    512 @@ -2705,7 +2770,8 @@ int ib_send_cm_lap(struct ib_cm_id *cm_id,
    513 goto out;
    514 }
    515
    516 - ret = cm_init_av_by_path(alternate_path, &cm_id_priv->alt_av);
    517 + ret = cm_init_av_by_path(alternate_path, &cm_id_priv->alt_av,
    518 + cm_id_priv);
    519 if (ret)
    520 goto out;
    521 cm_id_priv->alt_av.timeout =
    522 @@ -2817,7 +2883,8 @@ static int cm_lap_handler(struct cm_work *work)
    523 cm_init_av_for_response(work->port, work->mad_recv_wc->wc,
    524 work->mad_recv_wc->recv_buf.grh,
    525 &cm_id_priv->av);
    526 - cm_init_av_by_path(param->alternate_path, &cm_id_priv->alt_av);
    527 + cm_init_av_by_path(param->alternate_path, &cm_id_priv->alt_av,
    528 + cm_id_priv);
    529 ret = atomic_inc_and_test(&cm_id_priv->work_count);
    530 if (!ret)
    531 list_add_tail(&work->list, &cm_id_priv->work_list);
    532 @@ -3009,7 +3076,7 @@ int ib_send_cm_sidr_req(struct ib_cm_id *cm_id,
    533 return -EINVAL;
    534
    535 cm_id_priv = container_of(cm_id, struct cm_id_private, id);
    536 - ret = cm_init_av_by_path(param->path, &cm_id_priv->av);
    537 + ret = cm_init_av_by_path(param->path, &cm_id_priv->av, cm_id_priv);
    538 if (ret)
    539 goto out;
    540
    541 @@ -3446,7 +3513,9 @@ out:
    542 static int cm_migrate(struct ib_cm_id *cm_id)
    543 {
    544 struct cm_id_private *cm_id_priv;
    545 + struct cm_av tmp_av;
    546 unsigned long flags;
    547 + int tmp_send_port_not_ready;
    548 int ret = 0;
    549
    550 cm_id_priv = container_of(cm_id, struct cm_id_private, id);
    551 @@ -3455,7 +3524,14 @@ static int cm_migrate(struct ib_cm_id *cm_id)
    552 (cm_id->lap_state == IB_CM_LAP_UNINIT ||
    553 cm_id->lap_state == IB_CM_LAP_IDLE)) {
    554 cm_id->lap_state = IB_CM_LAP_IDLE;
    555 + /* Swap address vector */
    556 + tmp_av = cm_id_priv->av;
    557 cm_id_priv->av = cm_id_priv->alt_av;
    558 + cm_id_priv->alt_av = tmp_av;
    559 + /* Swap port send ready state */
    560 + tmp_send_port_not_ready = cm_id_priv->prim_send_port_not_ready;
    561 + cm_id_priv->prim_send_port_not_ready = cm_id_priv->altr_send_port_not_ready;
    562 + cm_id_priv->altr_send_port_not_ready = tmp_send_port_not_ready;
    563 } else
    564 ret = -EINVAL;
    565 spin_unlock_irqrestore(&cm_id_priv->lock, flags);
    566 @@ -3875,6 +3951,9 @@ static void cm_add_one(struct ib_device *ib_device)
    567 port->cm_dev = cm_dev;
    568 port->port_num = i;
    569
    570 + INIT_LIST_HEAD(&port->cm_priv_prim_list);
    571 + INIT_LIST_HEAD(&port->cm_priv_altr_list);
    572 +
    573 ret = cm_create_port_fs(port);
    574 if (ret)
    575 goto error1;
    576 @@ -3932,6 +4011,8 @@ static void cm_remove_one(struct ib_device *ib_device, void *client_data)
    577 {
    578 struct cm_device *cm_dev = client_data;
    579 struct cm_port *port;
    580 + struct cm_id_private *cm_id_priv;
    581 + struct ib_mad_agent *cur_mad_agent;
    582 struct ib_port_modify port_modify = {
    583 .clr_port_cap_mask = IB_PORT_CM_SUP
    584 };
    585 @@ -3955,15 +4036,27 @@ static void cm_remove_one(struct ib_device *ib_device, void *client_data)
    586
    587 port = cm_dev->port[i-1];
    588 ib_modify_port(ib_device, port->port_num, 0, &port_modify);
    589 + /* Mark all the cm_id's as not valid */
    590 + spin_lock_irq(&cm.lock);
    591 + list_for_each_entry(cm_id_priv, &port->cm_priv_altr_list, altr_list)
    592 + cm_id_priv->altr_send_port_not_ready = 1;
    593 + list_for_each_entry(cm_id_priv, &port->cm_priv_prim_list, prim_list)
    594 + cm_id_priv->prim_send_port_not_ready = 1;
    595 + spin_unlock_irq(&cm.lock);
    596 /*
    597 * We flush the queue here after the going_down set, this
    598 * verify that no new works will be queued in the recv handler,
    599 * after that we can call the unregister_mad_agent
    600 */
    601 flush_workqueue(cm.wq);
    602 - ib_unregister_mad_agent(port->mad_agent);
    603 + spin_lock_irq(&cm.state_lock);
    604 + cur_mad_agent = port->mad_agent;
    605 + port->mad_agent = NULL;
    606 + spin_unlock_irq(&cm.state_lock);
    607 + ib_unregister_mad_agent(cur_mad_agent);
    608 cm_remove_port_fs(port);
    609 }
    610 +
    611 device_unregister(cm_dev->device);
    612 kfree(cm_dev);
    613 }
    614 @@ -3976,6 +4069,7 @@ static int __init ib_cm_init(void)
    615 INIT_LIST_HEAD(&cm.device_list);
    616 rwlock_init(&cm.device_lock);
    617 spin_lock_init(&cm.lock);
    618 + spin_lock_init(&cm.state_lock);
    619 cm.listen_service_table = RB_ROOT;
    620 cm.listen_service_id = be64_to_cpu(IB_CM_ASSIGN_SERVICE_ID);
    621 cm.remote_id_table = RB_ROOT;
    622 diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
    623 index 38acb3cfc545..04f3c0db9126 100644
    624 --- a/drivers/infiniband/core/umem.c
    625 +++ b/drivers/infiniband/core/umem.c
    626 @@ -175,7 +175,7 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
    627
    628 cur_base = addr & PAGE_MASK;
    629
    630 - if (npages == 0) {
    631 + if (npages == 0 || npages > UINT_MAX) {
    632 ret = -EINVAL;
    633 goto out;
    634 }
    635 diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
    636 index d625c82d6c82..7becef27cbbe 100644
    637 --- a/drivers/infiniband/core/uverbs_main.c
    638 +++ b/drivers/infiniband/core/uverbs_main.c
    639 @@ -244,12 +244,9 @@ static int ib_uverbs_cleanup_ucontext(struct ib_uverbs_file *file,
    640 container_of(uobj, struct ib_uqp_object, uevent.uobject);
    641
    642 idr_remove_uobj(&ib_uverbs_qp_idr, uobj);
    643 - if (qp != qp->real_qp) {
    644 - ib_close_qp(qp);
    645 - } else {
    646 + if (qp == qp->real_qp)
    647 ib_uverbs_detach_umcast(qp, uqp);
    648 - ib_destroy_qp(qp);
    649 - }
    650 + ib_destroy_qp(qp);
    651 ib_uverbs_release_uevent(file, &uqp->uevent);
    652 kfree(uqp);
    653 }
    654 diff --git a/drivers/infiniband/hw/mlx4/ah.c b/drivers/infiniband/hw/mlx4/ah.c
    655 index 06da56bda201..c007c766c61e 100644
    656 --- a/drivers/infiniband/hw/mlx4/ah.c
    657 +++ b/drivers/infiniband/hw/mlx4/ah.c
    658 @@ -102,7 +102,10 @@ static struct ib_ah *create_iboe_ah(struct ib_pd *pd, struct ib_ah_attr *ah_attr
    659 if (vlan_tag < 0x1000)
    660 vlan_tag |= (ah_attr->sl & 7) << 13;
    661 ah->av.eth.port_pd = cpu_to_be32(to_mpd(pd)->pdn | (ah_attr->port_num << 24));
    662 - ah->av.eth.gid_index = mlx4_ib_gid_index_to_real_index(ibdev, ah_attr->port_num, ah_attr->grh.sgid_index);
    663 + ret = mlx4_ib_gid_index_to_real_index(ibdev, ah_attr->port_num, ah_attr->grh.sgid_index);
    664 + if (ret < 0)
    665 + return ERR_PTR(ret);
    666 + ah->av.eth.gid_index = ret;
    667 ah->av.eth.vlan = cpu_to_be16(vlan_tag);
    668 if (ah_attr->static_rate) {
    669 ah->av.eth.stat_rate = ah_attr->static_rate + MLX4_STAT_RATE_OFFSET;
    670 diff --git a/drivers/infiniband/hw/mlx4/cq.c b/drivers/infiniband/hw/mlx4/cq.c
    671 index b88fc8f5ab18..57e1a08925d9 100644
    672 --- a/drivers/infiniband/hw/mlx4/cq.c
    673 +++ b/drivers/infiniband/hw/mlx4/cq.c
    674 @@ -253,11 +253,14 @@ struct ib_cq *mlx4_ib_create_cq(struct ib_device *ibdev,
    675 if (context)
    676 if (ib_copy_to_udata(udata, &cq->mcq.cqn, sizeof (__u32))) {
    677 err = -EFAULT;
    678 - goto err_dbmap;
    679 + goto err_cq_free;
    680 }
    681
    682 return &cq->ibcq;
    683
    684 +err_cq_free:
    685 + mlx4_cq_free(dev->dev, &cq->mcq);
    686 +
    687 err_dbmap:
    688 if (context)
    689 mlx4_ib_db_unmap_user(to_mucontext(context), &cq->db);
    690 diff --git a/drivers/infiniband/hw/mlx5/cq.c b/drivers/infiniband/hw/mlx5/cq.c
    691 index 8184267c7901..02c8deab1fff 100644
    692 --- a/drivers/infiniband/hw/mlx5/cq.c
    693 +++ b/drivers/infiniband/hw/mlx5/cq.c
    694 @@ -787,8 +787,7 @@ struct ib_cq *mlx5_ib_create_cq(struct ib_device *ibdev,
    695 if (err)
    696 goto err_create;
    697 } else {
    698 - /* for now choose 64 bytes till we have a proper interface */
    699 - cqe_size = 64;
    700 + cqe_size = cache_line_size() == 128 ? 128 : 64;
    701 err = create_cq_kernel(dev, cq, entries, cqe_size, &cqb,
    702 &index, &inlen);
    703 if (err)
    704 diff --git a/drivers/infiniband/hw/mlx5/main.c b/drivers/infiniband/hw/mlx5/main.c
    705 index bfc940ff9c8a..2a1fdcaa3044 100644
    706 --- a/drivers/infiniband/hw/mlx5/main.c
    707 +++ b/drivers/infiniband/hw/mlx5/main.c
    708 @@ -947,13 +947,13 @@ static void mlx5_ib_event(struct mlx5_core_dev *dev, void *context,
    709 {
    710 struct mlx5_ib_dev *ibdev = (struct mlx5_ib_dev *)context;
    711 struct ib_event ibev;
    712 -
    713 + bool fatal = false;
    714 u8 port = 0;
    715
    716 switch (event) {
    717 case MLX5_DEV_EVENT_SYS_ERROR:
    718 - ibdev->ib_active = false;
    719 ibev.event = IB_EVENT_DEVICE_FATAL;
    720 + fatal = true;
    721 break;
    722
    723 case MLX5_DEV_EVENT_PORT_UP:
    724 @@ -998,6 +998,9 @@ static void mlx5_ib_event(struct mlx5_core_dev *dev, void *context,
    725
    726 if (ibdev->ib_active)
    727 ib_dispatch_event(&ibev);
    728 +
    729 + if (fatal)
    730 + ibdev->ib_active = false;
    731 }
    732
    733 static void get_ext_port_caps(struct mlx5_ib_dev *dev)
    734 diff --git a/drivers/mfd/intel-lpss.c b/drivers/mfd/intel-lpss.c
    735 index 88e80ec772f6..fe89e5e337d5 100644
    736 --- a/drivers/mfd/intel-lpss.c
    737 +++ b/drivers/mfd/intel-lpss.c
    738 @@ -494,9 +494,6 @@ int intel_lpss_suspend(struct device *dev)
    739 for (i = 0; i < LPSS_PRIV_REG_COUNT; i++)
    740 lpss->priv_ctx[i] = readl(lpss->priv + i * 4);
    741
    742 - /* Put the device into reset state */
    743 - writel(0, lpss->priv + LPSS_PRIV_RESETS);
    744 -
    745 return 0;
    746 }
    747 EXPORT_SYMBOL_GPL(intel_lpss_suspend);
    748 diff --git a/drivers/mfd/mfd-core.c b/drivers/mfd/mfd-core.c
    749 index 60b60dc63ddd..022c9374ce8b 100644
    750 --- a/drivers/mfd/mfd-core.c
    751 +++ b/drivers/mfd/mfd-core.c
    752 @@ -354,6 +354,8 @@ int mfd_clone_cell(const char *cell, const char **clones, size_t n_clones)
    753 clones[i]);
    754 }
    755
    756 + put_device(dev);
    757 +
    758 return 0;
    759 }
    760 EXPORT_SYMBOL(mfd_clone_cell);
    761 diff --git a/drivers/net/wireless/iwlwifi/pcie/drv.c b/drivers/net/wireless/iwlwifi/pcie/drv.c
    762 index d58c094f2f04..f7e6a09926dd 100644
    763 --- a/drivers/net/wireless/iwlwifi/pcie/drv.c
    764 +++ b/drivers/net/wireless/iwlwifi/pcie/drv.c
    765 @@ -475,48 +475,64 @@ static const struct pci_device_id iwl_hw_card_ids[] = {
    766 MODULE_DEVICE_TABLE(pci, iwl_hw_card_ids);
    767
    768 #ifdef CONFIG_ACPI
    769 -#define SPL_METHOD "SPLC"
    770 -#define SPL_DOMAINTYPE_MODULE BIT(0)
    771 -#define SPL_DOMAINTYPE_WIFI BIT(1)
    772 -#define SPL_DOMAINTYPE_WIGIG BIT(2)
    773 -#define SPL_DOMAINTYPE_RFEM BIT(3)
    774 +#define ACPI_SPLC_METHOD "SPLC"
    775 +#define ACPI_SPLC_DOMAIN_WIFI (0x07)
    776
    777 -static u64 splx_get_pwr_limit(struct iwl_trans *trans, union acpi_object *splx)
    778 +static u64 splc_get_pwr_limit(struct iwl_trans *trans, union acpi_object *splc)
    779 {
    780 - union acpi_object *limits, *domain_type, *power_limit;
    781 -
    782 - if (splx->type != ACPI_TYPE_PACKAGE ||
    783 - splx->package.count != 2 ||
    784 - splx->package.elements[0].type != ACPI_TYPE_INTEGER ||
    785 - splx->package.elements[0].integer.value != 0) {
    786 - IWL_ERR(trans, "Unsupported splx structure\n");
    787 + union acpi_object *data_pkg, *dflt_pwr_limit;
    788 + int i;
    789 +
    790 + /* We need at least two elements, one for the revision and one
    791 + * for the data itself. Also check that the revision is
    792 + * supported (currently only revision 0).
    793 + */
    794 + if (splc->type != ACPI_TYPE_PACKAGE ||
    795 + splc->package.count < 2 ||
    796 + splc->package.elements[0].type != ACPI_TYPE_INTEGER ||
    797 + splc->package.elements[0].integer.value != 0) {
    798 + IWL_DEBUG_INFO(trans,
    799 + "Unsupported structure returned by the SPLC method. Ignoring.\n");
    800 return 0;
    801 }
    802
    803 - limits = &splx->package.elements[1];
    804 - if (limits->type != ACPI_TYPE_PACKAGE ||
    805 - limits->package.count < 2 ||
    806 - limits->package.elements[0].type != ACPI_TYPE_INTEGER ||
    807 - limits->package.elements[1].type != ACPI_TYPE_INTEGER) {
    808 - IWL_ERR(trans, "Invalid limits element\n");
    809 - return 0;
    810 + /* loop through all the packages to find the one for WiFi */
    811 + for (i = 1; i < splc->package.count; i++) {
    812 + union acpi_object *domain;
    813 +
    814 + data_pkg = &splc->package.elements[i];
    815 +
    816 + /* Skip anything that is not a package with the right
    817 + * amount of elements (i.e. at least 2 integers).
    818 + */
    819 + if (data_pkg->type != ACPI_TYPE_PACKAGE ||
    820 + data_pkg->package.count < 2 ||
    821 + data_pkg->package.elements[0].type != ACPI_TYPE_INTEGER ||
    822 + data_pkg->package.elements[1].type != ACPI_TYPE_INTEGER)
    823 + continue;
    824 +
    825 + domain = &data_pkg->package.elements[0];
    826 + if (domain->integer.value == ACPI_SPLC_DOMAIN_WIFI)
    827 + break;
    828 +
    829 + data_pkg = NULL;
    830 }
    831
    832 - domain_type = &limits->package.elements[0];
    833 - power_limit = &limits->package.elements[1];
    834 - if (!(domain_type->integer.value & SPL_DOMAINTYPE_WIFI)) {
    835 - IWL_DEBUG_INFO(trans, "WiFi power is not limited\n");
    836 + if (!data_pkg) {
    837 + IWL_DEBUG_INFO(trans,
    838 + "No element for the WiFi domain returned by the SPLC method.\n");
    839 return 0;
    840 }
    841
    842 - return power_limit->integer.value;
    843 + dflt_pwr_limit = &data_pkg->package.elements[1];
    844 + return dflt_pwr_limit->integer.value;
    845 }
    846
    847 static void set_dflt_pwr_limit(struct iwl_trans *trans, struct pci_dev *pdev)
    848 {
    849 acpi_handle pxsx_handle;
    850 acpi_handle handle;
    851 - struct acpi_buffer splx = {ACPI_ALLOCATE_BUFFER, NULL};
    852 + struct acpi_buffer splc = {ACPI_ALLOCATE_BUFFER, NULL};
    853 acpi_status status;
    854
    855 pxsx_handle = ACPI_HANDLE(&pdev->dev);
    856 @@ -527,23 +543,24 @@ static void set_dflt_pwr_limit(struct iwl_trans *trans, struct pci_dev *pdev)
    857 }
    858
    859 /* Get the method's handle */
    860 - status = acpi_get_handle(pxsx_handle, (acpi_string)SPL_METHOD, &handle);
    861 + status = acpi_get_handle(pxsx_handle, (acpi_string)ACPI_SPLC_METHOD,
    862 + &handle);
    863 if (ACPI_FAILURE(status)) {
    864 - IWL_DEBUG_INFO(trans, "SPL method not found\n");
    865 + IWL_DEBUG_INFO(trans, "SPLC method not found\n");
    866 return;
    867 }
    868
    869 /* Call SPLC with no arguments */
    870 - status = acpi_evaluate_object(handle, NULL, NULL, &splx);
    871 + status = acpi_evaluate_object(handle, NULL, NULL, &splc);
    872 if (ACPI_FAILURE(status)) {
    873 IWL_ERR(trans, "SPLC invocation failed (0x%x)\n", status);
    874 return;
    875 }
    876
    877 - trans->dflt_pwr_limit = splx_get_pwr_limit(trans, splx.pointer);
    878 + trans->dflt_pwr_limit = splc_get_pwr_limit(trans, splc.pointer);
    879 IWL_DEBUG_INFO(trans, "Default power limit set to %lld\n",
    880 trans->dflt_pwr_limit);
    881 - kfree(splx.pointer);
    882 + kfree(splc.pointer);
    883 }
    884
    885 #else /* CONFIG_ACPI */
    886 diff --git a/drivers/rtc/rtc-omap.c b/drivers/rtc/rtc-omap.c
    887 index ec2e9c5fb993..22394fe30579 100644
    888 --- a/drivers/rtc/rtc-omap.c
    889 +++ b/drivers/rtc/rtc-omap.c
    890 @@ -109,6 +109,7 @@
    891 /* OMAP_RTC_OSC_REG bit fields: */
    892 #define OMAP_RTC_OSC_32KCLK_EN BIT(6)
    893 #define OMAP_RTC_OSC_SEL_32KCLK_SRC BIT(3)
    894 +#define OMAP_RTC_OSC_OSC32K_GZ_DISABLE BIT(4)
    895
    896 /* OMAP_RTC_IRQWAKEEN bit fields: */
    897 #define OMAP_RTC_IRQWAKEEN_ALARM_WAKEEN BIT(1)
    898 @@ -646,8 +647,9 @@ static int omap_rtc_probe(struct platform_device *pdev)
    899 */
    900 if (rtc->has_ext_clk) {
    901 reg = rtc_read(rtc, OMAP_RTC_OSC_REG);
    902 - rtc_write(rtc, OMAP_RTC_OSC_REG,
    903 - reg | OMAP_RTC_OSC_SEL_32KCLK_SRC);
    904 + reg &= ~OMAP_RTC_OSC_OSC32K_GZ_DISABLE;
    905 + reg |= OMAP_RTC_OSC_32KCLK_EN | OMAP_RTC_OSC_SEL_32KCLK_SRC;
    906 + rtc_writel(rtc, OMAP_RTC_OSC_REG, reg);
    907 }
    908
    909 rtc->type->lock(rtc);
    910 diff --git a/drivers/uwb/lc-rc.c b/drivers/uwb/lc-rc.c
    911 index d059ad4d0dbd..97ee1b46db69 100644
    912 --- a/drivers/uwb/lc-rc.c
    913 +++ b/drivers/uwb/lc-rc.c
    914 @@ -56,8 +56,11 @@ static struct uwb_rc *uwb_rc_find_by_index(int index)
    915 struct uwb_rc *rc = NULL;
    916
    917 dev = class_find_device(&uwb_rc_class, NULL, &index, uwb_rc_index_match);
    918 - if (dev)
    919 + if (dev) {
    920 rc = dev_get_drvdata(dev);
    921 + put_device(dev);
    922 + }
    923 +
    924 return rc;
    925 }
    926
    927 @@ -467,7 +470,9 @@ struct uwb_rc *__uwb_rc_try_get(struct uwb_rc *target_rc)
    928 if (dev) {
    929 rc = dev_get_drvdata(dev);
    930 __uwb_rc_get(rc);
    931 + put_device(dev);
    932 }
    933 +
    934 return rc;
    935 }
    936 EXPORT_SYMBOL_GPL(__uwb_rc_try_get);
    937 @@ -520,8 +525,11 @@ struct uwb_rc *uwb_rc_get_by_grandpa(const struct device *grandpa_dev)
    938
    939 dev = class_find_device(&uwb_rc_class, NULL, grandpa_dev,
    940 find_rc_grandpa);
    941 - if (dev)
    942 + if (dev) {
    943 rc = dev_get_drvdata(dev);
    944 + put_device(dev);
    945 + }
    946 +
    947 return rc;
    948 }
    949 EXPORT_SYMBOL_GPL(uwb_rc_get_by_grandpa);
    950 @@ -553,8 +561,10 @@ struct uwb_rc *uwb_rc_get_by_dev(const struct uwb_dev_addr *addr)
    951 struct uwb_rc *rc = NULL;
    952
    953 dev = class_find_device(&uwb_rc_class, NULL, addr, find_rc_dev);
    954 - if (dev)
    955 + if (dev) {
    956 rc = dev_get_drvdata(dev);
    957 + put_device(dev);
    958 + }
    959
    960 return rc;
    961 }
    962 diff --git a/drivers/uwb/pal.c b/drivers/uwb/pal.c
    963 index c1304b8d4985..678e93741ae1 100644
    964 --- a/drivers/uwb/pal.c
    965 +++ b/drivers/uwb/pal.c
    966 @@ -97,6 +97,8 @@ static bool uwb_rc_class_device_exists(struct uwb_rc *target_rc)
    967
    968 dev = class_find_device(&uwb_rc_class, NULL, target_rc, find_rc);
    969
    970 + put_device(dev);
    971 +
    972 return (dev != NULL);
    973 }
    974
    975 diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
    976 index b7e921d207fb..cd5914495ad7 100644
    977 --- a/fs/ext4/ext4.h
    978 +++ b/fs/ext4/ext4.h
    979 @@ -221,6 +221,7 @@ struct ext4_io_submit {
    980 #define EXT4_MAX_BLOCK_SIZE 65536
    981 #define EXT4_MIN_BLOCK_LOG_SIZE 10
    982 #define EXT4_MAX_BLOCK_LOG_SIZE 16
    983 +#define EXT4_MAX_CLUSTER_LOG_SIZE 30
    984 #ifdef __KERNEL__
    985 # define EXT4_BLOCK_SIZE(s) ((s)->s_blocksize)
    986 #else
    987 diff --git a/fs/ext4/super.c b/fs/ext4/super.c
    988 index 5bab28caa9d4..127155b82e6e 100644
    989 --- a/fs/ext4/super.c
    990 +++ b/fs/ext4/super.c
    991 @@ -3394,7 +3394,15 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
    992 if (blocksize < EXT4_MIN_BLOCK_SIZE ||
    993 blocksize > EXT4_MAX_BLOCK_SIZE) {
    994 ext4_msg(sb, KERN_ERR,
    995 - "Unsupported filesystem blocksize %d", blocksize);
    996 + "Unsupported filesystem blocksize %d (%d log_block_size)",
    997 + blocksize, le32_to_cpu(es->s_log_block_size));
    998 + goto failed_mount;
    999 + }
    1000 + if (le32_to_cpu(es->s_log_block_size) >
    1001 + (EXT4_MAX_BLOCK_LOG_SIZE - EXT4_MIN_BLOCK_LOG_SIZE)) {
    1002 + ext4_msg(sb, KERN_ERR,
    1003 + "Invalid log block size: %u",
    1004 + le32_to_cpu(es->s_log_block_size));
    1005 goto failed_mount;
    1006 }
    1007
    1008 @@ -3533,6 +3541,13 @@ static int ext4_fill_super(struct super_block *sb, void *data, int silent)
    1009 "block size (%d)", clustersize, blocksize);
    1010 goto failed_mount;
    1011 }
    1012 + if (le32_to_cpu(es->s_log_cluster_size) >
    1013 + (EXT4_MAX_CLUSTER_LOG_SIZE - EXT4_MIN_BLOCK_LOG_SIZE)) {
    1014 + ext4_msg(sb, KERN_ERR,
    1015 + "Invalid log cluster size: %u",
    1016 + le32_to_cpu(es->s_log_cluster_size));
    1017 + goto failed_mount;
    1018 + }
    1019 sbi->s_cluster_bits = le32_to_cpu(es->s_log_cluster_size) -
    1020 le32_to_cpu(es->s_log_block_size);
    1021 sbi->s_clusters_per_group =
    1022 diff --git a/fs/fuse/file.c b/fs/fuse/file.c
    1023 index 682e79965c16..8821c380a71a 100644
    1024 --- a/fs/fuse/file.c
    1025 +++ b/fs/fuse/file.c
    1026 @@ -1997,6 +1997,10 @@ static int fuse_write_end(struct file *file, struct address_space *mapping,
    1027 {
    1028 struct inode *inode = page->mapping->host;
    1029
    1030 + /* Haven't copied anything? Skip zeroing, size extending, dirtying. */
    1031 + if (!copied)
    1032 + goto unlock;
    1033 +
    1034 if (!PageUptodate(page)) {
    1035 /* Zero any unwritten bytes at the end of the page */
    1036 size_t endoff = (pos + copied) & ~PAGE_CACHE_MASK;
    1037 @@ -2007,6 +2011,8 @@ static int fuse_write_end(struct file *file, struct address_space *mapping,
    1038
    1039 fuse_write_update_size(inode, pos + copied);
    1040 set_page_dirty(page);
    1041 +
    1042 +unlock:
    1043 unlock_page(page);
    1044 page_cache_release(page);
    1045
    1046 diff --git a/kernel/power/suspend_test.c b/kernel/power/suspend_test.c
    1047 index 084452e34a12..bdff5ed57f10 100644
    1048 --- a/kernel/power/suspend_test.c
    1049 +++ b/kernel/power/suspend_test.c
    1050 @@ -203,8 +203,10 @@ static int __init test_suspend(void)
    1051
    1052 /* RTCs have initialized by now too ... can we use one? */
    1053 dev = class_find_device(rtc_class, NULL, NULL, has_wakealarm);
    1054 - if (dev)
    1055 + if (dev) {
    1056 rtc = rtc_class_open(dev_name(dev));
    1057 + put_device(dev);
    1058 + }
    1059 if (!rtc) {
    1060 printk(warn_no_rtc);
    1061 return 0;
    1062 diff --git a/net/can/bcm.c b/net/can/bcm.c
    1063 index 6863310d6973..8ef1afacad82 100644
    1064 --- a/net/can/bcm.c
    1065 +++ b/net/can/bcm.c
    1066 @@ -1500,24 +1500,31 @@ static int bcm_connect(struct socket *sock, struct sockaddr *uaddr, int len,
    1067 struct sockaddr_can *addr = (struct sockaddr_can *)uaddr;
    1068 struct sock *sk = sock->sk;
    1069 struct bcm_sock *bo = bcm_sk(sk);
    1070 + int ret = 0;
    1071
    1072 if (len < sizeof(*addr))
    1073 return -EINVAL;
    1074
    1075 - if (bo->bound)
    1076 - return -EISCONN;
    1077 + lock_sock(sk);
    1078 +
    1079 + if (bo->bound) {
    1080 + ret = -EISCONN;
    1081 + goto fail;
    1082 + }
    1083
    1084 /* bind a device to this socket */
    1085 if (addr->can_ifindex) {
    1086 struct net_device *dev;
    1087
    1088 dev = dev_get_by_index(&init_net, addr->can_ifindex);
    1089 - if (!dev)
    1090 - return -ENODEV;
    1091 -
    1092 + if (!dev) {
    1093 + ret = -ENODEV;
    1094 + goto fail;
    1095 + }
    1096 if (dev->type != ARPHRD_CAN) {
    1097 dev_put(dev);
    1098 - return -ENODEV;
    1099 + ret = -ENODEV;
    1100 + goto fail;
    1101 }
    1102
    1103 bo->ifindex = dev->ifindex;
    1104 @@ -1528,17 +1535,24 @@ static int bcm_connect(struct socket *sock, struct sockaddr *uaddr, int len,
    1105 bo->ifindex = 0;
    1106 }
    1107
    1108 - bo->bound = 1;
    1109 -
    1110 if (proc_dir) {
    1111 /* unique socket address as filename */
    1112 sprintf(bo->procname, "%lu", sock_i_ino(sk));
    1113 bo->bcm_proc_read = proc_create_data(bo->procname, 0644,
    1114 proc_dir,
    1115 &bcm_proc_fops, sk);
    1116 + if (!bo->bcm_proc_read) {
    1117 + ret = -ENOMEM;
    1118 + goto fail;
    1119 + }
    1120 }
    1121
    1122 - return 0;
    1123 + bo->bound = 1;
    1124 +
    1125 +fail:
    1126 + release_sock(sk);
    1127 +
    1128 + return ret;
    1129 }
    1130
    1131 static int bcm_recvmsg(struct socket *sock, struct msghdr *msg, size_t size,
    1132 diff --git a/net/netfilter/nft_dynset.c b/net/netfilter/nft_dynset.c
    1133 index 9dec3bd1b63c..0a5df0cbaa28 100644
    1134 --- a/net/netfilter/nft_dynset.c
    1135 +++ b/net/netfilter/nft_dynset.c
    1136 @@ -140,7 +140,8 @@ static int nft_dynset_init(const struct nft_ctx *ctx,
    1137 if (tb[NFTA_DYNSET_TIMEOUT] != NULL) {
    1138 if (!(set->flags & NFT_SET_TIMEOUT))
    1139 return -EINVAL;
    1140 - timeout = be64_to_cpu(nla_get_be64(tb[NFTA_DYNSET_TIMEOUT]));
    1141 + timeout = msecs_to_jiffies(be64_to_cpu(nla_get_be64(
    1142 + tb[NFTA_DYNSET_TIMEOUT])));
    1143 }
    1144
    1145 priv->sreg_key = nft_parse_register(tb[NFTA_DYNSET_SREG_KEY]);
    1146 @@ -227,7 +228,8 @@ static int nft_dynset_dump(struct sk_buff *skb, const struct nft_expr *expr)
    1147 goto nla_put_failure;
    1148 if (nla_put_string(skb, NFTA_DYNSET_SET_NAME, priv->set->name))
    1149 goto nla_put_failure;
    1150 - if (nla_put_be64(skb, NFTA_DYNSET_TIMEOUT, cpu_to_be64(priv->timeout)))
    1151 + if (nla_put_be64(skb, NFTA_DYNSET_TIMEOUT,
    1152 + cpu_to_be64(jiffies_to_msecs(priv->timeout))))
    1153 goto nla_put_failure;
    1154 if (priv->expr && nft_expr_dump(skb, NFTA_DYNSET_EXPR, priv->expr))
    1155 goto nla_put_failure;
    1156 diff --git a/scripts/gcc-x86_64-has-stack-protector.sh b/scripts/gcc-x86_64-has-stack-protector.sh
    1157 index 973e8c141567..17867e723a51 100755
    1158 --- a/scripts/gcc-x86_64-has-stack-protector.sh
    1159 +++ b/scripts/gcc-x86_64-has-stack-protector.sh
    1160 @@ -1,6 +1,6 @@
    1161 #!/bin/sh
    1162
    1163 -echo "int foo(void) { char X[200]; return 3; }" | $* -S -x c -c -O0 -mcmodel=kernel -fstack-protector - -o - 2> /dev/null | grep -q "%gs"
    1164 +echo "int foo(void) { char X[200]; return 3; }" | $* -S -x c -c -O0 -mcmodel=kernel -fno-PIE -fstack-protector - -o - 2> /dev/null | grep -q "%gs"
    1165 if [ "$?" -eq "0" ] ; then
    1166 echo y
    1167 else