Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-4.9/0297-4.9.198-all-fixes.patch

    Annotation of /trunk/kernel-alx/patches-4.9/0297-4.9.198-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3572 - (hide annotations) (download)
    Thu Aug 13 10:21:15 2020 UTC (3 years, 8 months ago) by niro
    File size: 39651 byte(s) 
    linux-198
    1 niro 3572 diff --git a/Makefile b/Makefile
    2     index e62456010d34..2f11058a0d06 100644
    3     --- a/Makefile
    4     +++ b/Makefile
    5     @@ -1,6 +1,6 @@
    6     VERSION = 4
    7     PATCHLEVEL = 9
    8     -SUBLEVEL = 197
    9     +SUBLEVEL = 198
    10     EXTRAVERSION =
    11     NAME = Roaring Lionus
    12    
    13     diff --git a/arch/arm/boot/dts/am4372.dtsi b/arch/arm/boot/dts/am4372.dtsi
    14     index c9c9a47446e8..56224aa5e83e 100644
    15     --- a/arch/arm/boot/dts/am4372.dtsi
    16     +++ b/arch/arm/boot/dts/am4372.dtsi
    17     @@ -1117,6 +1117,8 @@
    18     ti,hwmods = "dss_dispc";
    19     clocks = <&disp_clk>;
    20     clock-names = "fck";
    21     +
    22     + max-memory-bandwidth = <230000000>;
    23     };
    24    
    25     rfbi: rfbi@4832a800 {
    26     diff --git a/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c b/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c
    27     index e2d84aa7f595..fa1c6707877a 100644
    28     --- a/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c
    29     +++ b/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c
    30     @@ -939,7 +939,8 @@ static struct omap_hwmod_class_sysconfig am33xx_timer_sysc = {
    31     .rev_offs = 0x0000,
    32     .sysc_offs = 0x0010,
    33     .syss_offs = 0x0014,
    34     - .sysc_flags = (SYSC_HAS_SIDLEMODE | SYSC_HAS_SOFTRESET),
    35     + .sysc_flags = SYSC_HAS_SIDLEMODE | SYSC_HAS_SOFTRESET |
    36     + SYSC_HAS_RESET_STATUS,
    37     .idlemodes = (SIDLE_FORCE | SIDLE_NO | SIDLE_SMART |
    38     SIDLE_SMART_WKUP),
    39     .sysc_fields = &omap_hwmod_sysc_type2,
    40     diff --git a/arch/mips/boot/dts/qca/ar9331.dtsi b/arch/mips/boot/dts/qca/ar9331.dtsi
    41     index cf47ed4d8569..1fda24fc1860 100644
    42     --- a/arch/mips/boot/dts/qca/ar9331.dtsi
    43     +++ b/arch/mips/boot/dts/qca/ar9331.dtsi
    44     @@ -98,7 +98,7 @@
    45    
    46     miscintc: interrupt-controller@18060010 {
    47     compatible = "qca,ar7240-misc-intc";
    48     - reg = <0x18060010 0x4>;
    49     + reg = <0x18060010 0x8>;
    50    
    51     interrupt-parent = <&cpuintc>;
    52     interrupts = <6>;
    53     diff --git a/arch/mips/loongson64/common/serial.c b/arch/mips/loongson64/common/serial.c
    54     index ffefc1cb2612..98c3a7feb10f 100644
    55     --- a/arch/mips/loongson64/common/serial.c
    56     +++ b/arch/mips/loongson64/common/serial.c
    57     @@ -110,7 +110,7 @@ static int __init serial_init(void)
    58     }
    59     module_init(serial_init);
    60    
    61     -static void __init serial_exit(void)
    62     +static void __exit serial_exit(void)
    63     {
    64     platform_device_unregister(&uart8250_device);
    65     }
    66     diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
    67     index 47d50197789b..f625fd20b21e 100644
    68     --- a/arch/mips/mm/tlbex.c
    69     +++ b/arch/mips/mm/tlbex.c
    70     @@ -661,6 +661,13 @@ static void build_restore_pagemask(u32 **p, struct uasm_reloc **r,
    71     int restore_scratch)
    72     {
    73     if (restore_scratch) {
    74     + /*
    75     + * Ensure the MFC0 below observes the value written to the
    76     + * KScratch register by the prior MTC0.
    77     + */
    78     + if (scratch_reg >= 0)
    79     + uasm_i_ehb(p);
    80     +
    81     /* Reset default page size */
    82     if (PM_DEFAULT_MASK >> 16) {
    83     uasm_i_lui(p, tmp, PM_DEFAULT_MASK >> 16);
    84     @@ -675,12 +682,10 @@ static void build_restore_pagemask(u32 **p, struct uasm_reloc **r,
    85     uasm_i_mtc0(p, 0, C0_PAGEMASK);
    86     uasm_il_b(p, r, lid);
    87     }
    88     - if (scratch_reg >= 0) {
    89     - uasm_i_ehb(p);
    90     + if (scratch_reg >= 0)
    91     UASM_i_MFC0(p, 1, c0_kscratch(), scratch_reg);
    92     - } else {
    93     + else
    94     UASM_i_LW(p, 1, scratchpad_offset(0), 0);
    95     - }
    96     } else {
    97     /* Reset default page size */
    98     if (PM_DEFAULT_MASK >> 16) {
    99     @@ -922,6 +927,10 @@ build_get_pgd_vmalloc64(u32 **p, struct uasm_label **l, struct uasm_reloc **r,
    100     }
    101     if (mode != not_refill && check_for_high_segbits) {
    102     uasm_l_large_segbits_fault(l, *p);
    103     +
    104     + if (mode == refill_scratch && scratch_reg >= 0)
    105     + uasm_i_ehb(p);
    106     +
    107     /*
    108     * We get here if we are an xsseg address, or if we are
    109     * an xuseg address above (PGDIR_SHIFT+PGDIR_BITS) boundary.
    110     @@ -938,12 +947,10 @@ build_get_pgd_vmalloc64(u32 **p, struct uasm_label **l, struct uasm_reloc **r,
    111     uasm_i_jr(p, ptr);
    112    
    113     if (mode == refill_scratch) {
    114     - if (scratch_reg >= 0) {
    115     - uasm_i_ehb(p);
    116     + if (scratch_reg >= 0)
    117     UASM_i_MFC0(p, 1, c0_kscratch(), scratch_reg);
    118     - } else {
    119     + else
    120     UASM_i_LW(p, 1, scratchpad_offset(0), 0);
    121     - }
    122     } else {
    123     uasm_i_nop(p);
    124     }
    125     diff --git a/arch/parisc/mm/ioremap.c b/arch/parisc/mm/ioremap.c
    126     index 838d0259cd27..3741f91fc186 100644
    127     --- a/arch/parisc/mm/ioremap.c
    128     +++ b/arch/parisc/mm/ioremap.c
    129     @@ -2,7 +2,7 @@
    130     * arch/parisc/mm/ioremap.c
    131     *
    132     * (C) Copyright 1995 1996 Linus Torvalds
    133     - * (C) Copyright 2001-2006 Helge Deller <deller@gmx.de>
    134     + * (C) Copyright 2001-2019 Helge Deller <deller@gmx.de>
    135     * (C) Copyright 2005 Kyle McMartin <kyle@parisc-linux.org>
    136     */
    137    
    138     @@ -83,7 +83,7 @@ void __iomem * __ioremap(unsigned long phys_addr, unsigned long size, unsigned l
    139     addr = (void __iomem *) area->addr;
    140     if (ioremap_page_range((unsigned long)addr, (unsigned long)addr + size,
    141     phys_addr, pgprot)) {
    142     - vfree(addr);
    143     + vunmap(addr);
    144     return NULL;
    145     }
    146    
    147     @@ -91,9 +91,11 @@ void __iomem * __ioremap(unsigned long phys_addr, unsigned long size, unsigned l
    148     }
    149     EXPORT_SYMBOL(__ioremap);
    150    
    151     -void iounmap(const volatile void __iomem *addr)
    152     +void iounmap(const volatile void __iomem *io_addr)
    153     {
    154     - if (addr > high_memory)
    155     - return vfree((void *) (PAGE_MASK & (unsigned long __force) addr));
    156     + unsigned long addr = (unsigned long)io_addr & PAGE_MASK;
    157     +
    158     + if (is_vmalloc_addr((void *)addr))
    159     + vunmap((void *)addr);
    160     }
    161     EXPORT_SYMBOL(iounmap);
    162     diff --git a/arch/xtensa/kernel/xtensa_ksyms.c b/arch/xtensa/kernel/xtensa_ksyms.c
    163     index a71d2739fa82..9210b9cc4ec9 100644
    164     --- a/arch/xtensa/kernel/xtensa_ksyms.c
    165     +++ b/arch/xtensa/kernel/xtensa_ksyms.c
    166     @@ -114,13 +114,6 @@ EXPORT_SYMBOL(__invalidate_icache_range);
    167     // FIXME EXPORT_SYMBOL(screen_info);
    168     #endif
    169    
    170     -EXPORT_SYMBOL(outsb);
    171     -EXPORT_SYMBOL(outsw);
    172     -EXPORT_SYMBOL(outsl);
    173     -EXPORT_SYMBOL(insb);
    174     -EXPORT_SYMBOL(insw);
    175     -EXPORT_SYMBOL(insl);
    176     -
    177     extern long common_exception_return;
    178     EXPORT_SYMBOL(common_exception_return);
    179    
    180     diff --git a/drivers/base/core.c b/drivers/base/core.c
    181     index 3dc483f00060..69a71074dc65 100644
    182     --- a/drivers/base/core.c
    183     +++ b/drivers/base/core.c
    184     @@ -10,6 +10,7 @@
    185     *
    186     */
    187    
    188     +#include <linux/cpufreq.h>
    189     #include <linux/device.h>
    190     #include <linux/err.h>
    191     #include <linux/fwnode.h>
    192     @@ -2128,6 +2129,8 @@ void device_shutdown(void)
    193     wait_for_device_probe();
    194     device_block_probing();
    195    
    196     + cpufreq_suspend();
    197     +
    198     spin_lock(&devices_kset->list_lock);
    199     /*
    200     * Walk the devices list backward, shutting down each in turn.
    201     diff --git a/drivers/block/loop.c b/drivers/block/loop.c
    202     index 9f840d9fdfcb..f236b7984b94 100644
    203     --- a/drivers/block/loop.c
    204     +++ b/drivers/block/loop.c
    205     @@ -1546,6 +1546,7 @@ static int lo_compat_ioctl(struct block_device *bdev, fmode_t mode,
    206     arg = (unsigned long) compat_ptr(arg);
    207     case LOOP_SET_FD:
    208     case LOOP_CHANGE_FD:
    209     + case LOOP_SET_DIRECT_IO:
    210     err = lo_ioctl(bdev, mode, cmd, arg);
    211     break;
    212     default:
    213     diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
    214     index e917521a3ef9..d43cd983a7ec 100644
    215     --- a/drivers/cpufreq/cpufreq.c
    216     +++ b/drivers/cpufreq/cpufreq.c
    217     @@ -2543,14 +2543,6 @@ int cpufreq_unregister_driver(struct cpufreq_driver *driver)
    218     }
    219     EXPORT_SYMBOL_GPL(cpufreq_unregister_driver);
    220    
    221     -/*
    222     - * Stop cpufreq at shutdown to make sure it isn't holding any locks
    223     - * or mutexes when secondary CPUs are halted.
    224     - */
    225     -static struct syscore_ops cpufreq_syscore_ops = {
    226     - .shutdown = cpufreq_suspend,
    227     -};
    228     -
    229     struct kobject *cpufreq_global_kobject;
    230     EXPORT_SYMBOL(cpufreq_global_kobject);
    231    
    232     @@ -2562,8 +2554,6 @@ static int __init cpufreq_core_init(void)
    233     cpufreq_global_kobject = kobject_create_and_add("cpufreq", &cpu_subsys.dev_root->kobj);
    234     BUG_ON(!cpufreq_global_kobject);
    235    
    236     - register_syscore_ops(&cpufreq_syscore_ops);
    237     -
    238     return 0;
    239     }
    240     core_initcall(cpufreq_core_init);
    241     diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
    242     index c93dcfedc219..a9bf02ea0a3b 100644
    243     --- a/drivers/gpu/drm/drm_edid.c
    244     +++ b/drivers/gpu/drm/drm_edid.c
    245     @@ -160,6 +160,9 @@ static const struct edid_quirk {
    246     /* Medion MD 30217 PG */
    247     { "MED", 0x7b8, EDID_QUIRK_PREFER_LARGE_75 },
    248    
    249     + /* Lenovo G50 */
    250     + { "SDC", 18514, EDID_QUIRK_FORCE_6BPC },
    251     +
    252     /* Panel in Samsung NP700G7A-S01PL notebook reports 6bpc */
    253     { "SEC", 0xd033, EDID_QUIRK_FORCE_8BPC },
    254    
    255     diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
    256     index 3ccf5b28b326..30bd4a6a9d46 100644
    257     --- a/drivers/gpu/drm/radeon/radeon_drv.c
    258     +++ b/drivers/gpu/drm/radeon/radeon_drv.c
    259     @@ -366,19 +366,11 @@ radeon_pci_remove(struct pci_dev *pdev)
    260     static void
    261     radeon_pci_shutdown(struct pci_dev *pdev)
    262     {
    263     - struct drm_device *ddev = pci_get_drvdata(pdev);
    264     -
    265     /* if we are running in a VM, make sure the device
    266     * torn down properly on reboot/shutdown
    267     */
    268     if (radeon_device_is_virtual())
    269     radeon_pci_remove(pdev);
    270     -
    271     - /* Some adapters need to be suspended before a
    272     - * shutdown occurs in order to prevent an error
    273     - * during kexec.
    274     - */
    275     - radeon_suspend_kms(ddev, true, true, false);
    276     }
    277    
    278     static int radeon_pmops_suspend(struct device *dev)
    279     diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
    280     index 0c215353adb9..2b1dd60a29fa 100644
    281     --- a/drivers/infiniband/hw/cxgb4/mem.c
    282     +++ b/drivers/infiniband/hw/cxgb4/mem.c
    283     @@ -264,13 +264,17 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
    284     struct sk_buff *skb)
    285     {
    286     int err;
    287     - struct fw_ri_tpte tpt;
    288     + struct fw_ri_tpte *tpt;
    289     u32 stag_idx;
    290     static atomic_t key;
    291    
    292     if (c4iw_fatal_error(rdev))
    293     return -EIO;
    294    
    295     + tpt = kmalloc(sizeof(*tpt), GFP_KERNEL);
    296     + if (!tpt)
    297     + return -ENOMEM;
    298     +
    299     stag_state = stag_state > 0;
    300     stag_idx = (*stag) >> 8;
    301    
    302     @@ -280,6 +284,7 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
    303     mutex_lock(&rdev->stats.lock);
    304     rdev->stats.stag.fail++;
    305     mutex_unlock(&rdev->stats.lock);
    306     + kfree(tpt);
    307     return -ENOMEM;
    308     }
    309     mutex_lock(&rdev->stats.lock);
    310     @@ -294,28 +299,28 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
    311    
    312     /* write TPT entry */
    313     if (reset_tpt_entry)
    314     - memset(&tpt, 0, sizeof(tpt));
    315     + memset(tpt, 0, sizeof(*tpt));
    316     else {
    317     - tpt.valid_to_pdid = cpu_to_be32(FW_RI_TPTE_VALID_F |
    318     + tpt->valid_to_pdid = cpu_to_be32(FW_RI_TPTE_VALID_F |
    319     FW_RI_TPTE_STAGKEY_V((*stag & FW_RI_TPTE_STAGKEY_M)) |
    320     FW_RI_TPTE_STAGSTATE_V(stag_state) |
    321     FW_RI_TPTE_STAGTYPE_V(type) | FW_RI_TPTE_PDID_V(pdid));
    322     - tpt.locread_to_qpid = cpu_to_be32(FW_RI_TPTE_PERM_V(perm) |
    323     + tpt->locread_to_qpid = cpu_to_be32(FW_RI_TPTE_PERM_V(perm) |
    324     (bind_enabled ? FW_RI_TPTE_MWBINDEN_F : 0) |
    325     FW_RI_TPTE_ADDRTYPE_V((zbva ? FW_RI_ZERO_BASED_TO :
    326     FW_RI_VA_BASED_TO))|
    327     FW_RI_TPTE_PS_V(page_size));
    328     - tpt.nosnoop_pbladdr = !pbl_size ? 0 : cpu_to_be32(
    329     + tpt->nosnoop_pbladdr = !pbl_size ? 0 : cpu_to_be32(
    330     FW_RI_TPTE_PBLADDR_V(PBL_OFF(rdev, pbl_addr)>>3));
    331     - tpt.len_lo = cpu_to_be32((u32)(len & 0xffffffffUL));
    332     - tpt.va_hi = cpu_to_be32((u32)(to >> 32));
    333     - tpt.va_lo_fbo = cpu_to_be32((u32)(to & 0xffffffffUL));
    334     - tpt.dca_mwbcnt_pstag = cpu_to_be32(0);
    335     - tpt.len_hi = cpu_to_be32((u32)(len >> 32));
    336     + tpt->len_lo = cpu_to_be32((u32)(len & 0xffffffffUL));
    337     + tpt->va_hi = cpu_to_be32((u32)(to >> 32));
    338     + tpt->va_lo_fbo = cpu_to_be32((u32)(to & 0xffffffffUL));
    339     + tpt->dca_mwbcnt_pstag = cpu_to_be32(0);
    340     + tpt->len_hi = cpu_to_be32((u32)(len >> 32));
    341     }
    342     err = write_adapter_mem(rdev, stag_idx +
    343     (rdev->lldi.vr->stag.start >> 5),
    344     - sizeof(tpt), &tpt, skb);
    345     + sizeof(*tpt), tpt, skb);
    346    
    347     if (reset_tpt_entry) {
    348     c4iw_put_resource(&rdev->resource.tpt_table, stag_idx);
    349     @@ -323,6 +328,7 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
    350     rdev->stats.stag.cur -= 32;
    351     mutex_unlock(&rdev->stats.lock);
    352     }
    353     + kfree(tpt);
    354     return err;
    355     }
    356    
    357     diff --git a/drivers/input/misc/da9063_onkey.c b/drivers/input/misc/da9063_onkey.c
    358     index bb863e062b03..eaf5ecc431c9 100644
    359     --- a/drivers/input/misc/da9063_onkey.c
    360     +++ b/drivers/input/misc/da9063_onkey.c
    361     @@ -247,10 +247,7 @@ static int da9063_onkey_probe(struct platform_device *pdev)
    362     onkey->input->phys = onkey->phys;
    363     onkey->input->dev.parent = &pdev->dev;
    364    
    365     - if (onkey->key_power)
    366     - input_set_capability(onkey->input, EV_KEY, KEY_POWER);
    367     -
    368     - input_set_capability(onkey->input, EV_KEY, KEY_SLEEP);
    369     + input_set_capability(onkey->input, EV_KEY, KEY_POWER);
    370    
    371     INIT_DELAYED_WORK(&onkey->work, da9063_poll_on);
    372    
    373     diff --git a/drivers/memstick/host/jmb38x_ms.c b/drivers/memstick/host/jmb38x_ms.c
    374     index 48db922075e2..08fa6400d255 100644
    375     --- a/drivers/memstick/host/jmb38x_ms.c
    376     +++ b/drivers/memstick/host/jmb38x_ms.c
    377     @@ -947,7 +947,7 @@ static int jmb38x_ms_probe(struct pci_dev *pdev,
    378     if (!cnt) {
    379     rc = -ENODEV;
    380     pci_dev_busy = 1;
    381     - goto err_out;
    382     + goto err_out_int;
    383     }
    384    
    385     jm = kzalloc(sizeof(struct jmb38x_ms)
    386     diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.h b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
    387     index 3f8858db12eb..dcf10ea60e7f 100644
    388     --- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h
    389     +++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
    390     @@ -362,6 +362,7 @@ struct bcmgenet_mib_counters {
    391     #define EXT_ENERGY_DET_MASK (1 << 12)
    392    
    393     #define EXT_RGMII_OOB_CTRL 0x0C
    394     +#define RGMII_MODE_EN_V123 (1 << 0)
    395     #define RGMII_LINK (1 << 4)
    396     #define OOB_DISABLE (1 << 5)
    397     #define RGMII_MODE_EN (1 << 6)
    398     diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
    399     index 9bd90a7c4d40..b0b9feeb173b 100644
    400     --- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
    401     +++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
    402     @@ -328,7 +328,11 @@ int bcmgenet_mii_config(struct net_device *dev)
    403     */
    404     if (priv->ext_phy) {
    405     reg = bcmgenet_ext_readl(priv, EXT_RGMII_OOB_CTRL);
    406     - reg |= RGMII_MODE_EN | id_mode_dis;
    407     + reg |= id_mode_dis;
    408     + if (GENET_IS_V1(priv) || GENET_IS_V2(priv) || GENET_IS_V3(priv))
    409     + reg |= RGMII_MODE_EN_V123;
    410     + else
    411     + reg |= RGMII_MODE_EN;
    412     bcmgenet_ext_writel(priv, reg, EXT_RGMII_OOB_CTRL);
    413     }
    414    
    415     @@ -342,11 +346,12 @@ int bcmgenet_mii_probe(struct net_device *dev)
    416     struct bcmgenet_priv *priv = netdev_priv(dev);
    417     struct device_node *dn = priv->pdev->dev.of_node;
    418     struct phy_device *phydev;
    419     - u32 phy_flags;
    420     + u32 phy_flags = 0;
    421     int ret;
    422    
    423     /* Communicate the integrated PHY revision */
    424     - phy_flags = priv->gphy_rev;
    425     + if (priv->internal_phy)
    426     + phy_flags = priv->gphy_rev;
    427    
    428     /* Initialize link state variables that bcmgenet_mii_setup() uses */
    429     priv->old_link = -1;
    430     diff --git a/drivers/net/ethernet/hisilicon/hns_mdio.c b/drivers/net/ethernet/hisilicon/hns_mdio.c
    431     index de23a0ead5d7..d06efcd5f13b 100644
    432     --- a/drivers/net/ethernet/hisilicon/hns_mdio.c
    433     +++ b/drivers/net/ethernet/hisilicon/hns_mdio.c
    434     @@ -166,11 +166,15 @@ static int mdio_sc_cfg_reg_write(struct hns_mdio_device *mdio_dev,
    435     {
    436     u32 time_cnt;
    437     u32 reg_value;
    438     + int ret;
    439    
    440     regmap_write(mdio_dev->subctrl_vbase, cfg_reg, set_val);
    441    
    442     for (time_cnt = MDIO_TIMEOUT; time_cnt; time_cnt--) {
    443     - regmap_read(mdio_dev->subctrl_vbase, st_reg, &reg_value);
    444     + ret = regmap_read(mdio_dev->subctrl_vbase, st_reg, &reg_value);
    445     + if (ret)
    446     + return ret;
    447     +
    448     reg_value &= st_msk;
    449     if ((!!check_st) == (!!reg_value))
    450     break;
    451     diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
    452     index cae691486105..e1f47b6ea3b7 100644
    453     --- a/drivers/net/xen-netback/interface.c
    454     +++ b/drivers/net/xen-netback/interface.c
    455     @@ -706,7 +706,6 @@ err_unmap:
    456     xenvif_unmap_frontend_data_rings(queue);
    457     netif_napi_del(&queue->napi);
    458     err:
    459     - module_put(THIS_MODULE);
    460     return err;
    461     }
    462    
    463     diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
    464     index a07533702d26..e09653c73ab4 100644
    465     --- a/drivers/pci/pci.c
    466     +++ b/drivers/pci/pci.c
    467     @@ -753,19 +753,6 @@ void pci_update_current_state(struct pci_dev *dev, pci_power_t state)
    468     }
    469     }
    470    
    471     -/**
    472     - * pci_power_up - Put the given device into D0 forcibly
    473     - * @dev: PCI device to power up
    474     - */
    475     -void pci_power_up(struct pci_dev *dev)
    476     -{
    477     - if (platform_pci_power_manageable(dev))
    478     - platform_pci_set_power_state(dev, PCI_D0);
    479     -
    480     - pci_raw_set_power_state(dev, PCI_D0);
    481     - pci_update_current_state(dev, PCI_D0);
    482     -}
    483     -
    484     /**
    485     * pci_platform_power_transition - Use platform to change device power state
    486     * @dev: PCI device to handle.
    487     @@ -941,6 +928,17 @@ int pci_set_power_state(struct pci_dev *dev, pci_power_t state)
    488     }
    489     EXPORT_SYMBOL(pci_set_power_state);
    490    
    491     +/**
    492     + * pci_power_up - Put the given device into D0 forcibly
    493     + * @dev: PCI device to power up
    494     + */
    495     +void pci_power_up(struct pci_dev *dev)
    496     +{
    497     + __pci_start_power_transition(dev, PCI_D0);
    498     + pci_raw_set_power_state(dev, PCI_D0);
    499     + pci_update_current_state(dev, PCI_D0);
    500     +}
    501     +
    502     /**
    503     * pci_choose_state - Choose the power state of a PCI device
    504     * @dev: PCI device to be suspended
    505     diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
    506     index 1964391db904..a3aaef4c53a3 100644
    507     --- a/drivers/s390/scsi/zfcp_fsf.c
    508     +++ b/drivers/s390/scsi/zfcp_fsf.c
    509     @@ -20,6 +20,11 @@
    510    
    511     struct kmem_cache *zfcp_fsf_qtcb_cache;
    512    
    513     +static bool ber_stop = true;
    514     +module_param(ber_stop, bool, 0600);
    515     +MODULE_PARM_DESC(ber_stop,
    516     + "Shuts down FCP devices for FCP channels that report a bit-error count in excess of its threshold (default on)");
    517     +
    518     static void zfcp_fsf_request_timeout_handler(unsigned long data)
    519     {
    520     struct zfcp_adapter *adapter = (struct zfcp_adapter *) data;
    521     @@ -231,10 +236,15 @@ static void zfcp_fsf_status_read_handler(struct zfcp_fsf_req *req)
    522     case FSF_STATUS_READ_SENSE_DATA_AVAIL:
    523     break;
    524     case FSF_STATUS_READ_BIT_ERROR_THRESHOLD:
    525     - dev_warn(&adapter->ccw_device->dev,
    526     - "The error threshold for checksum statistics "
    527     - "has been exceeded\n");
    528     zfcp_dbf_hba_bit_err("fssrh_3", req);
    529     + if (ber_stop) {
    530     + dev_warn(&adapter->ccw_device->dev,
    531     + "All paths over this FCP device are disused because of excessive bit errors\n");
    532     + zfcp_erp_adapter_shutdown(adapter, 0, "fssrh_b");
    533     + } else {
    534     + dev_warn(&adapter->ccw_device->dev,
    535     + "The error threshold for checksum statistics has been exceeded\n");
    536     + }
    537     break;
    538     case FSF_STATUS_READ_LINK_DOWN:
    539     zfcp_fsf_status_read_link_down(req);
    540     diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c
    541     index 19bffe0b2cc0..2cbfec6a7466 100644
    542     --- a/drivers/scsi/megaraid.c
    543     +++ b/drivers/scsi/megaraid.c
    544     @@ -4219,11 +4219,11 @@ megaraid_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
    545     */
    546     if (pdev->subsystem_vendor == PCI_VENDOR_ID_COMPAQ &&
    547     pdev->subsystem_device == 0xC000)
    548     - return -ENODEV;
    549     + goto out_disable_device;
    550     /* Now check the magic signature byte */
    551     pci_read_config_word(pdev, PCI_CONF_AMISIG, &magic);
    552     if (magic != HBA_SIGNATURE_471 && magic != HBA_SIGNATURE)
    553     - return -ENODEV;
    554     + goto out_disable_device;
    555     /* Ok it is probably a megaraid */
    556     }
    557    
    558     diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
    559     index 11f45cb99892..d13e91e16425 100644
    560     --- a/drivers/scsi/qla2xxx/qla_target.c
    561     +++ b/drivers/scsi/qla2xxx/qla_target.c
    562     @@ -572,6 +572,7 @@ static void qlt_free_session_done(struct work_struct *work)
    563    
    564     if (logout_started) {
    565     bool traced = false;
    566     + u16 cnt = 0;
    567    
    568     while (!ACCESS_ONCE(sess->logout_completed)) {
    569     if (!traced) {
    570     @@ -581,6 +582,9 @@ static void qlt_free_session_done(struct work_struct *work)
    571     traced = true;
    572     }
    573     msleep(100);
    574     + cnt++;
    575     + if (cnt > 200)
    576     + break;
    577     }
    578    
    579     ql_dbg(ql_dbg_tgt_mgt, vha, 0xf087,
    580     diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
    581     index 56b65b85b121..38830818bfb6 100644
    582     --- a/drivers/scsi/scsi_sysfs.c
    583     +++ b/drivers/scsi/scsi_sysfs.c
    584     @@ -710,6 +710,14 @@ sdev_store_delete(struct device *dev, struct device_attribute *attr,
    585     const char *buf, size_t count)
    586     {
    587     struct kernfs_node *kn;
    588     + struct scsi_device *sdev = to_scsi_device(dev);
    589     +
    590     + /*
    591     + * We need to try to get module, avoiding the module been removed
    592     + * during delete.
    593     + */
    594     + if (scsi_device_get(sdev))
    595     + return -ENODEV;
    596    
    597     kn = sysfs_break_active_protection(&dev->kobj, &attr->attr);
    598     WARN_ON_ONCE(!kn);
    599     @@ -724,9 +732,10 @@ sdev_store_delete(struct device *dev, struct device_attribute *attr,
    600     * state into SDEV_DEL.
    601     */
    602     device_remove_file(dev, attr);
    603     - scsi_remove_device(to_scsi_device(dev));
    604     + scsi_remove_device(sdev);
    605     if (kn)
    606     sysfs_unbreak_active_protection(kn);
    607     + scsi_device_put(sdev);
    608     return count;
    609     };
    610     static DEVICE_ATTR(delete, S_IWUSR, NULL, sdev_store_delete);
    611     diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
    612     index a9c172692f21..26f259fb6e3c 100644
    613     --- a/drivers/scsi/ufs/ufshcd.c
    614     +++ b/drivers/scsi/ufs/ufshcd.c
    615     @@ -6492,6 +6492,9 @@ int ufshcd_shutdown(struct ufs_hba *hba)
    616     {
    617     int ret = 0;
    618    
    619     + if (!hba->is_powered)
    620     + goto out;
    621     +
    622     if (ufshcd_is_ufs_dev_poweroff(hba) && ufshcd_is_link_off(hba))
    623     goto out;
    624    
    625     diff --git a/drivers/staging/wlan-ng/cfg80211.c b/drivers/staging/wlan-ng/cfg80211.c
    626     index 182b2d564627..4c6384328615 100644
    627     --- a/drivers/staging/wlan-ng/cfg80211.c
    628     +++ b/drivers/staging/wlan-ng/cfg80211.c
    629     @@ -489,10 +489,8 @@ static int prism2_connect(struct wiphy *wiphy, struct net_device *dev,
    630     /* Set the encryption - we only support wep */
    631     if (is_wep) {
    632     if (sme->key) {
    633     - if (sme->key_idx >= NUM_WEPKEYS) {
    634     - err = -EINVAL;
    635     - goto exit;
    636     - }
    637     + if (sme->key_idx >= NUM_WEPKEYS)
    638     + return -EINVAL;
    639    
    640     result = prism2_domibset_uint32(wlandev,
    641     DIDmib_dot11smt_dot11PrivacyTable_dot11WEPDefaultKeyID,
    642     diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c
    643     index 0669fbb0ec25..07c3c3449147 100644
    644     --- a/drivers/usb/class/usblp.c
    645     +++ b/drivers/usb/class/usblp.c
    646     @@ -458,6 +458,7 @@ static void usblp_cleanup(struct usblp *usblp)
    647     kfree(usblp->readbuf);
    648     kfree(usblp->device_id_string);
    649     kfree(usblp->statusbuf);
    650     + usb_put_intf(usblp->intf);
    651     kfree(usblp);
    652     }
    653    
    654     @@ -1120,7 +1121,7 @@ static int usblp_probe(struct usb_interface *intf,
    655     init_waitqueue_head(&usblp->wwait);
    656     init_usb_anchor(&usblp->urbs);
    657     usblp->ifnum = intf->cur_altsetting->desc.bInterfaceNumber;
    658     - usblp->intf = intf;
    659     + usblp->intf = usb_get_intf(intf);
    660    
    661     /* Malloc device ID string buffer to the largest expected length,
    662     * since we can re-query it on an ioctl and a dynamic string
    663     @@ -1209,6 +1210,7 @@ abort:
    664     kfree(usblp->readbuf);
    665     kfree(usblp->statusbuf);
    666     kfree(usblp->device_id_string);
    667     + usb_put_intf(usblp->intf);
    668     kfree(usblp);
    669     abort_ret:
    670     return retval;
    671     diff --git a/drivers/usb/gadget/udc/lpc32xx_udc.c b/drivers/usb/gadget/udc/lpc32xx_udc.c
    672     index 6df1aded4503..ac2aa04ca657 100644
    673     --- a/drivers/usb/gadget/udc/lpc32xx_udc.c
    674     +++ b/drivers/usb/gadget/udc/lpc32xx_udc.c
    675     @@ -1178,11 +1178,11 @@ static void udc_pop_fifo(struct lpc32xx_udc *udc, u8 *data, u32 bytes)
    676     tmp = readl(USBD_RXDATA(udc->udp_baseaddr));
    677    
    678     bl = bytes - n;
    679     - if (bl > 3)
    680     - bl = 3;
    681     + if (bl > 4)
    682     + bl = 4;
    683    
    684     for (i = 0; i < bl; i++)
    685     - data[n + i] = (u8) ((tmp >> (n * 8)) & 0xFF);
    686     + data[n + i] = (u8) ((tmp >> (i * 8)) & 0xFF);
    687     }
    688     break;
    689    
    690     diff --git a/drivers/usb/misc/ldusb.c b/drivers/usb/misc/ldusb.c
    691     index eee69c9e9a12..52e28b4913ad 100644
    692     --- a/drivers/usb/misc/ldusb.c
    693     +++ b/drivers/usb/misc/ldusb.c
    694     @@ -384,10 +384,7 @@ static int ld_usb_release(struct inode *inode, struct file *file)
    695     goto exit;
    696     }
    697    
    698     - if (mutex_lock_interruptible(&dev->mutex)) {
    699     - retval = -ERESTARTSYS;
    700     - goto exit;
    701     - }
    702     + mutex_lock(&dev->mutex);
    703    
    704     if (dev->open_count != 1) {
    705     retval = -ENODEV;
    706     @@ -471,7 +468,7 @@ static ssize_t ld_usb_read(struct file *file, char __user *buffer, size_t count,
    707    
    708     /* wait for data */
    709     spin_lock_irq(&dev->rbsl);
    710     - if (dev->ring_head == dev->ring_tail) {
    711     + while (dev->ring_head == dev->ring_tail) {
    712     dev->interrupt_in_done = 0;
    713     spin_unlock_irq(&dev->rbsl);
    714     if (file->f_flags & O_NONBLOCK) {
    715     @@ -481,12 +478,17 @@ static ssize_t ld_usb_read(struct file *file, char __user *buffer, size_t count,
    716     retval = wait_event_interruptible(dev->read_wait, dev->interrupt_in_done);
    717     if (retval < 0)
    718     goto unlock_exit;
    719     - } else {
    720     - spin_unlock_irq(&dev->rbsl);
    721     +
    722     + spin_lock_irq(&dev->rbsl);
    723     }
    724     + spin_unlock_irq(&dev->rbsl);
    725    
    726     /* actual_buffer contains actual_length + interrupt_in_buffer */
    727     actual_buffer = (size_t*)(dev->ring_buffer + dev->ring_tail*(sizeof(size_t)+dev->interrupt_in_endpoint_size));
    728     + if (*actual_buffer > dev->interrupt_in_endpoint_size) {
    729     + retval = -EIO;
    730     + goto unlock_exit;
    731     + }
    732     bytes_to_read = min(count, *actual_buffer);
    733     if (bytes_to_read < *actual_buffer)
    734     dev_warn(&dev->intf->dev, "Read buffer overflow, %zd bytes dropped\n",
    735     @@ -702,7 +704,9 @@ static int ld_usb_probe(struct usb_interface *intf, const struct usb_device_id *
    736     dev_warn(&intf->dev, "Interrupt out endpoint not found (using control endpoint instead)\n");
    737    
    738     dev->interrupt_in_endpoint_size = usb_endpoint_maxp(dev->interrupt_in_endpoint);
    739     - dev->ring_buffer = kmalloc(ring_buffer_size*(sizeof(size_t)+dev->interrupt_in_endpoint_size), GFP_KERNEL);
    740     + dev->ring_buffer = kcalloc(ring_buffer_size,
    741     + sizeof(size_t) + dev->interrupt_in_endpoint_size,
    742     + GFP_KERNEL);
    743     if (!dev->ring_buffer)
    744     goto error;
    745     dev->interrupt_in_buffer = kmalloc(dev->interrupt_in_endpoint_size, GFP_KERNEL);
    746     diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c
    747     index 321756fc4d29..f56307059d48 100644
    748     --- a/drivers/usb/misc/legousbtower.c
    749     +++ b/drivers/usb/misc/legousbtower.c
    750     @@ -425,10 +425,7 @@ static int tower_release (struct inode *inode, struct file *file)
    751     goto exit;
    752     }
    753    
    754     - if (mutex_lock_interruptible(&dev->lock)) {
    755     - retval = -ERESTARTSYS;
    756     - goto exit;
    757     - }
    758     + mutex_lock(&dev->lock);
    759    
    760     if (dev->open_count != 1) {
    761     dev_dbg(&dev->udev->dev, "%s: device not opened exactly once\n",
    762     diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
    763     index 836cb93ba49e..a7e41723c34c 100644
    764     --- a/drivers/usb/serial/ti_usb_3410_5052.c
    765     +++ b/drivers/usb/serial/ti_usb_3410_5052.c
    766     @@ -778,7 +778,6 @@ static void ti_close(struct usb_serial_port *port)
    767     struct ti_port *tport;
    768     int port_number;
    769     int status;
    770     - int do_unlock;
    771     unsigned long flags;
    772    
    773     tdev = usb_get_serial_data(port->serial);
    774     @@ -802,16 +801,13 @@ static void ti_close(struct usb_serial_port *port)
    775     "%s - cannot send close port command, %d\n"
    776     , __func__, status);
    777    
    778     - /* if mutex_lock is interrupted, continue anyway */
    779     - do_unlock = !mutex_lock_interruptible(&tdev->td_open_close_lock);
    780     + mutex_lock(&tdev->td_open_close_lock);
    781     --tport->tp_tdev->td_open_port_count;
    782     - if (tport->tp_tdev->td_open_port_count <= 0) {
    783     + if (tport->tp_tdev->td_open_port_count == 0) {
    784     /* last port is closed, shut down interrupt urb */
    785     usb_kill_urb(port->serial->port[0]->interrupt_in_urb);
    786     - tport->tp_tdev->td_open_port_count = 0;
    787     }
    788     - if (do_unlock)
    789     - mutex_unlock(&tdev->td_open_close_lock);
    790     + mutex_unlock(&tdev->td_open_close_lock);
    791     }
    792    
    793    
    794     diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
    795     index f3a251234474..538f378eea52 100644
    796     --- a/fs/btrfs/extent-tree.c
    797     +++ b/fs/btrfs/extent-tree.c
    798     @@ -10325,6 +10325,7 @@ int btrfs_read_block_groups(struct btrfs_root *root)
    799     btrfs_err(info,
    800     "bg %llu is a mixed block group but filesystem hasn't enabled mixed block groups",
    801     cache->key.objectid);
    802     + btrfs_put_block_group(cache);
    803     ret = -EINVAL;
    804     goto error;
    805     }
    806     diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c
    807     index f7a9adab0b84..6f5d78b172ba 100644
    808     --- a/fs/cifs/smb1ops.c
    809     +++ b/fs/cifs/smb1ops.c
    810     @@ -180,6 +180,9 @@ cifs_get_next_mid(struct TCP_Server_Info *server)
    811     /* we do not want to loop forever */
    812     last_mid = cur_mid;
    813     cur_mid++;
    814     + /* avoid 0xFFFF MID */
    815     + if (cur_mid == 0xffff)
    816     + cur_mid++;
    817    
    818     /*
    819     * This nested loop looks more expensive than it is.
    820     diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
    821     index fa947d36ae1d..a30f63623db7 100644
    822     --- a/fs/ocfs2/journal.c
    823     +++ b/fs/ocfs2/journal.c
    824     @@ -231,7 +231,8 @@ void ocfs2_recovery_exit(struct ocfs2_super *osb)
    825     /* At this point, we know that no more recovery threads can be
    826     * launched, so wait for any recovery completion work to
    827     * complete. */
    828     - flush_workqueue(osb->ocfs2_wq);
    829     + if (osb->ocfs2_wq)
    830     + flush_workqueue(osb->ocfs2_wq);
    831    
    832     /*
    833     * Now that recovery is shut down, and the osb is about to be
    834     diff --git a/fs/ocfs2/localalloc.c b/fs/ocfs2/localalloc.c
    835     index 5d53d0d63d19..ea38677daa06 100644
    836     --- a/fs/ocfs2/localalloc.c
    837     +++ b/fs/ocfs2/localalloc.c
    838     @@ -391,7 +391,8 @@ void ocfs2_shutdown_local_alloc(struct ocfs2_super *osb)
    839     struct ocfs2_dinode *alloc = NULL;
    840    
    841     cancel_delayed_work(&osb->la_enable_wq);
    842     - flush_workqueue(osb->ocfs2_wq);
    843     + if (osb->ocfs2_wq)
    844     + flush_workqueue(osb->ocfs2_wq);
    845    
    846     if (osb->local_alloc_state == OCFS2_LA_UNUSED)
    847     goto out;
    848     diff --git a/mm/shmem.c b/mm/shmem.c
    849     index 944242491059..ac8a5fedc245 100644
    850     --- a/mm/shmem.c
    851     +++ b/mm/shmem.c
    852     @@ -2457,11 +2457,12 @@ static void shmem_tag_pins(struct address_space *mapping)
    853     void **slot;
    854     pgoff_t start;
    855     struct page *page;
    856     + unsigned int tagged = 0;
    857    
    858     lru_add_drain();
    859     start = 0;
    860     - rcu_read_lock();
    861    
    862     + spin_lock_irq(&mapping->tree_lock);
    863     radix_tree_for_each_slot(slot, &mapping->page_tree, &iter, start) {
    864     page = radix_tree_deref_slot(slot);
    865     if (!page || radix_tree_exception(page)) {
    866     @@ -2470,18 +2471,19 @@ static void shmem_tag_pins(struct address_space *mapping)
    867     continue;
    868     }
    869     } else if (page_count(page) - page_mapcount(page) > 1) {
    870     - spin_lock_irq(&mapping->tree_lock);
    871     radix_tree_tag_set(&mapping->page_tree, iter.index,
    872     SHMEM_TAG_PINNED);
    873     - spin_unlock_irq(&mapping->tree_lock);
    874     }
    875    
    876     - if (need_resched()) {
    877     - cond_resched_rcu();
    878     - slot = radix_tree_iter_next(&iter);
    879     - }
    880     + if (++tagged % 1024)
    881     + continue;
    882     +
    883     + slot = radix_tree_iter_next(&iter);
    884     + spin_unlock_irq(&mapping->tree_lock);
    885     + cond_resched();
    886     + spin_lock_irq(&mapping->tree_lock);
    887     }
    888     - rcu_read_unlock();
    889     + spin_unlock_irq(&mapping->tree_lock);
    890     }
    891    
    892     /*
    893     diff --git a/mm/slub.c b/mm/slub.c
    894     index 131dee87a67c..fa6d62d559eb 100644
    895     --- a/mm/slub.c
    896     +++ b/mm/slub.c
    897     @@ -4718,7 +4718,17 @@ static ssize_t show_slab_objects(struct kmem_cache *s,
    898     }
    899     }
    900    
    901     - get_online_mems();
    902     + /*
    903     + * It is impossible to take "mem_hotplug_lock" here with "kernfs_mutex"
    904     + * already held which will conflict with an existing lock order:
    905     + *
    906     + * mem_hotplug_lock->slab_mutex->kernfs_mutex
    907     + *
    908     + * We don't really need mem_hotplug_lock (to hold off
    909     + * slab_mem_going_offline_callback) here because slab's memory hot
    910     + * unplug code doesn't destroy the kmem_cache->node[] data.
    911     + */
    912     +
    913     #ifdef CONFIG_SLUB_DEBUG
    914     if (flags & SO_ALL) {
    915     struct kmem_cache_node *n;
    916     @@ -4759,7 +4769,6 @@ static ssize_t show_slab_objects(struct kmem_cache *s,
    917     x += sprintf(buf + x, " N%d=%lu",
    918     node, nodes[node]);
    919     #endif
    920     - put_online_mems();
    921     kfree(nodes);
    922     return x + sprintf(buf + x, "\n");
    923     }
    924     diff --git a/net/ipv4/route.c b/net/ipv4/route.c
    925     index d1a302d321fa..6058dbc4e2c1 100644
    926     --- a/net/ipv4/route.c
    927     +++ b/net/ipv4/route.c
    928     @@ -2221,7 +2221,7 @@ struct rtable *__ip_route_output_key_hash(struct net *net, struct flowi4 *fl4,
    929     struct fib_result res;
    930     struct rtable *rth;
    931     int orig_oif;
    932     - int err = -ENETUNREACH;
    933     + int err;
    934    
    935     res.tclassid = 0;
    936     res.fi = NULL;
    937     @@ -2236,11 +2236,14 @@ struct rtable *__ip_route_output_key_hash(struct net *net, struct flowi4 *fl4,
    938    
    939     rcu_read_lock();
    940     if (fl4->saddr) {
    941     - rth = ERR_PTR(-EINVAL);
    942     if (ipv4_is_multicast(fl4->saddr) ||
    943     ipv4_is_lbcast(fl4->saddr) ||
    944     - ipv4_is_zeronet(fl4->saddr))
    945     + ipv4_is_zeronet(fl4->saddr)) {
    946     + rth = ERR_PTR(-EINVAL);
    947     goto out;
    948     + }
    949     +
    950     + rth = ERR_PTR(-ENETUNREACH);
    951    
    952     /* I removed check for oif == dev_out->oif here.
    953     It was wrong for two reasons:
    954     diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
    955     index 47ca2a2f1cf8..16eba7b5f1a9 100644
    956     --- a/net/ipv6/sit.c
    957     +++ b/net/ipv6/sit.c
    958     @@ -1856,7 +1856,6 @@ static int __net_init sit_init_net(struct net *net)
    959    
    960     err_reg_dev:
    961     ipip6_dev_free(sitn->fb_tunnel_dev);
    962     - free_netdev(sitn->fb_tunnel_dev);
    963     err_alloc_dev:
    964     return err;
    965     }
    966     diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
    967     index bcec1240f41d..9769db9818d2 100644
    968     --- a/net/mac80211/debugfs_netdev.c
    969     +++ b/net/mac80211/debugfs_netdev.c
    970     @@ -490,9 +490,14 @@ static ssize_t ieee80211_if_fmt_aqm(
    971     const struct ieee80211_sub_if_data *sdata, char *buf, int buflen)
    972     {
    973     struct ieee80211_local *local = sdata->local;
    974     - struct txq_info *txqi = to_txq_info(sdata->vif.txq);
    975     + struct txq_info *txqi;
    976     int len;
    977    
    978     + if (!sdata->vif.txq)
    979     + return 0;
    980     +
    981     + txqi = to_txq_info(sdata->vif.txq);
    982     +
    983     spin_lock_bh(&local->fq.lock);
    984     rcu_read_lock();
    985    
    986     @@ -657,7 +662,9 @@ static void add_common_files(struct ieee80211_sub_if_data *sdata)
    987     DEBUGFS_ADD(rc_rateidx_vht_mcs_mask_5ghz);
    988     DEBUGFS_ADD(hw_queues);
    989    
    990     - if (sdata->local->ops->wake_tx_queue)
    991     + if (sdata->local->ops->wake_tx_queue &&
    992     + sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE &&
    993     + sdata->vif.type != NL80211_IFTYPE_NAN)
    994     DEBUGFS_ADD(aqm);
    995     }
    996    
    997     diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
    998     index c75594a12c38..048389b5aa0f 100644
    999     --- a/net/mac80211/mlme.c
    1000     +++ b/net/mac80211/mlme.c
    1001     @@ -2434,7 +2434,8 @@ struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
    1002    
    1003     rcu_read_lock();
    1004     ssid = ieee80211_bss_get_ie(cbss, WLAN_EID_SSID);
    1005     - if (WARN_ON_ONCE(ssid == NULL))
    1006     + if (WARN_ONCE(!ssid || ssid[1] > IEEE80211_MAX_SSID_LEN,
    1007     + "invalid SSID element (len=%d)", ssid ? ssid[1] : -1))
    1008     ssid_len = 0;
    1009     else
    1010     ssid_len = ssid[1];
    1011     @@ -4691,7 +4692,7 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
    1012    
    1013     rcu_read_lock();
    1014     ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
    1015     - if (!ssidie) {
    1016     + if (!ssidie || ssidie[1] > sizeof(assoc_data->ssid)) {
    1017     rcu_read_unlock();
    1018     kfree(assoc_data);
    1019     return -EINVAL;
    1020     diff --git a/net/sched/act_api.c b/net/sched/act_api.c
    1021     index 67adb4ecded2..5b8f8b382a2e 100644
    1022     --- a/net/sched/act_api.c
    1023     +++ b/net/sched/act_api.c
    1024     @@ -948,10 +948,15 @@ tcf_add_notify(struct net *net, struct nlmsghdr *n, struct list_head *actions,
    1025     static int tcf_action_add(struct net *net, struct nlattr *nla,
    1026     struct nlmsghdr *n, u32 portid, int ovr)
    1027     {
    1028     - int ret = 0;
    1029     + int loop, ret;
    1030     LIST_HEAD(actions);
    1031    
    1032     - ret = tcf_action_init(net, nla, NULL, NULL, ovr, 0, &actions);
    1033     + for (loop = 0; loop < 10; loop++) {
    1034     + ret = tcf_action_init(net, nla, NULL, NULL, ovr, 0, &actions);
    1035     + if (ret != -EAGAIN)
    1036     + break;
    1037     + }
    1038     +
    1039     if (ret)
    1040     return ret;
    1041    
    1042     @@ -989,10 +994,7 @@ static int tc_ctl_action(struct sk_buff *skb, struct nlmsghdr *n)
    1043     */
    1044     if (n->nlmsg_flags & NLM_F_REPLACE)
    1045     ovr = 1;
    1046     -replay:
    1047     ret = tcf_action_add(net, tca[TCA_ACT_TAB], n, portid, ovr);
    1048     - if (ret == -EAGAIN)
    1049     - goto replay;
    1050     break;
    1051     case RTM_DELACTION:
    1052     ret = tca_action_gd(net, tca[TCA_ACT_TAB], n,
    1053     diff --git a/net/sctp/socket.c b/net/sctp/socket.c
    1054     index 93e60068800b..574a6a2c48d7 100644
    1055     --- a/net/sctp/socket.c
    1056     +++ b/net/sctp/socket.c
    1057     @@ -7911,7 +7911,7 @@ struct proto sctp_prot = {
    1058     .backlog_rcv = sctp_backlog_rcv,
    1059     .hash = sctp_hash,
    1060     .unhash = sctp_unhash,
    1061     - .get_port = sctp_get_port,
    1062     + .no_autobind = true,
    1063     .obj_size = sizeof(struct sctp_sock),
    1064     .sysctl_mem = sysctl_sctp_mem,
    1065     .sysctl_rmem = sysctl_sctp_rmem,
    1066     @@ -7950,7 +7950,7 @@ struct proto sctpv6_prot = {
    1067     .backlog_rcv = sctp_backlog_rcv,
    1068     .hash = sctp_hash,
    1069     .unhash = sctp_unhash,
    1070     - .get_port = sctp_get_port,
    1071     + .no_autobind = true,
    1072     .obj_size = sizeof(struct sctp6_sock),
    1073     .sysctl_mem = sysctl_sctp_mem,
    1074     .sysctl_rmem = sysctl_sctp_rmem,
    1075     diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
    1076     index 7aa1ca7ec638..ac75e6d4eb82 100644
    1077     --- a/net/wireless/nl80211.c
    1078     +++ b/net/wireless/nl80211.c
    1079     @@ -5358,6 +5358,9 @@ static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
    1080     if (!rdev->ops->del_mpath)
    1081     return -EOPNOTSUPP;
    1082    
    1083     + if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
    1084     + return -EOPNOTSUPP;
    1085     +
    1086     return rdev_del_mpath(rdev, dev, dst);
    1087     }
    1088    
    1089     diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c
    1090     index 995163830a61..9e7846b7d953 100644
    1091     --- a/net/wireless/wext-sme.c
    1092     +++ b/net/wireless/wext-sme.c
    1093     @@ -224,6 +224,7 @@ int cfg80211_mgd_wext_giwessid(struct net_device *dev,
    1094     struct iw_point *data, char *ssid)
    1095     {
    1096     struct wireless_dev *wdev = dev->ieee80211_ptr;
    1097     + int ret = 0;
    1098    
    1099     /* call only for station! */
    1100     if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION))
    1101     @@ -241,7 +242,10 @@ int cfg80211_mgd_wext_giwessid(struct net_device *dev,
    1102     if (ie) {
    1103     data->flags = 1;
    1104     data->length = ie[1];
    1105     - memcpy(ssid, ie + 2, data->length);
    1106     + if (data->length > IW_ESSID_MAX_SIZE)
    1107     + ret = -EINVAL;
    1108     + else
    1109     + memcpy(ssid, ie + 2, data->length);
    1110     }
    1111     rcu_read_unlock();
    1112     } else if (wdev->wext.connect.ssid && wdev->wext.connect.ssid_len) {
    1113     @@ -251,7 +255,7 @@ int cfg80211_mgd_wext_giwessid(struct net_device *dev,
    1114     }
    1115     wdev_unlock(wdev);
    1116    
    1117     - return 0;
    1118     + return ret;
    1119     }
    1120    
    1121     int cfg80211_mgd_wext_siwap(struct net_device *dev,
    1122     diff --git a/scripts/namespace.pl b/scripts/namespace.pl
    1123     index 9f3c9d47a4a5..4dddd4c01b62 100755
    1124     --- a/scripts/namespace.pl
    1125     +++ b/scripts/namespace.pl
    1126     @@ -65,13 +65,14 @@
    1127     require 5; # at least perl 5
    1128     use strict;
    1129     use File::Find;
    1130     +use File::Spec;
    1131    
    1132     my $nm = ($ENV{'NM'} || "nm") . " -p";
    1133     my $objdump = ($ENV{'OBJDUMP'} || "objdump") . " -s -j .comment";
    1134     -my $srctree = "";
    1135     -my $objtree = "";
    1136     -$srctree = "$ENV{'srctree'}/" if (exists($ENV{'srctree'}));
    1137     -$objtree = "$ENV{'objtree'}/" if (exists($ENV{'objtree'}));
    1138     +my $srctree = File::Spec->curdir();
    1139     +my $objtree = File::Spec->curdir();
    1140     +$srctree = File::Spec->rel2abs($ENV{'srctree'}) if (exists($ENV{'srctree'}));
    1141     +$objtree = File::Spec->rel2abs($ENV{'objtree'}) if (exists($ENV{'objtree'}));
    1142    
    1143     if ($#ARGV != -1) {
    1144     print STDERR "usage: $0 takes no parameters\n";
    1145     @@ -231,9 +232,9 @@ sub do_nm
    1146     }
    1147     ($source = $basename) =~ s/\.o$//;
    1148     if (-e "$source.c" || -e "$source.S") {
    1149     - $source = "$objtree$File::Find::dir/$source";
    1150     + $source = File::Spec->catfile($objtree, $File::Find::dir, $source)
    1151     } else {
    1152     - $source = "$srctree$File::Find::dir/$source";
    1153     + $source = File::Spec->catfile($srctree, $File::Find::dir, $source)
    1154     }
    1155     if (! -e "$source.c" && ! -e "$source.S") {
    1156     # No obvious source, exclude the object if it is conglomerate
    1157     diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
    1158     index d45c85dcf9d9..a64612db1f15 100644
    1159     --- a/sound/pci/hda/patch_realtek.c
    1160     +++ b/sound/pci/hda/patch_realtek.c
    1161     @@ -353,6 +353,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
    1162     case 0x10ec0700:
    1163     case 0x10ec0701:
    1164     case 0x10ec0703:
    1165     + case 0x10ec0711:
    1166     alc_update_coef_idx(codec, 0x10, 1<<15, 0);
    1167     break;
    1168     case 0x10ec0662:
    1169     @@ -6424,6 +6425,7 @@ static int patch_alc269(struct hda_codec *codec)
    1170     case 0x10ec0700:
    1171     case 0x10ec0701:
    1172     case 0x10ec0703:
    1173     + case 0x10ec0711:
    1174     spec->codec_variant = ALC269_TYPE_ALC700;
    1175     spec->gen.mixer_nid = 0; /* ALC700 does not have any loopback mixer path */
    1176     alc_update_coef_idx(codec, 0x4a, 1 << 15, 0); /* Combo jack auto trigger control */
    1177     @@ -7464,6 +7466,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = {
    1178     HDA_CODEC_ENTRY(0x10ec0700, "ALC700", patch_alc269),
    1179     HDA_CODEC_ENTRY(0x10ec0701, "ALC701", patch_alc269),
    1180     HDA_CODEC_ENTRY(0x10ec0703, "ALC703", patch_alc269),
    1181     + HDA_CODEC_ENTRY(0x10ec0711, "ALC711", patch_alc269),
    1182     HDA_CODEC_ENTRY(0x10ec0867, "ALC891", patch_alc662),
    1183     HDA_CODEC_ENTRY(0x10ec0880, "ALC880", patch_alc880),
    1184     HDA_CODEC_ENTRY(0x10ec0882, "ALC882", patch_alc882),
    1185     diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
    1186     index 91b444db575e..5346b3cafc67 100644
    1187     --- a/sound/soc/sh/rcar/core.c
    1188     +++ b/sound/soc/sh/rcar/core.c
    1189     @@ -629,6 +629,7 @@ static int rsnd_soc_dai_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
    1190     }
    1191    
    1192     /* set format */
    1193     + rdai->bit_clk_inv = 0;
    1194     switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
    1195     case SND_SOC_DAIFMT_I2S:
    1196     rdai->sys_delay = 0;