Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-alx/patches-4.9/0297-4.9.198-all-fixes.patch

    Contents of /trunk/kernel-alx/patches-4.9/0297-4.9.198-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 3572 - (show annotations) (download)
    Thu Aug 13 10:21:15 2020 UTC (3 years, 8 months ago) by niro
    File size: 39651 byte(s) 
    linux-198
    1 diff --git a/Makefile b/Makefile
    2 index e62456010d34..2f11058a0d06 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,6 +1,6 @@
    6 VERSION = 4
    7 PATCHLEVEL = 9
    8 -SUBLEVEL = 197
    9 +SUBLEVEL = 198
    10 EXTRAVERSION =
    11 NAME = Roaring Lionus
    12
    13 diff --git a/arch/arm/boot/dts/am4372.dtsi b/arch/arm/boot/dts/am4372.dtsi
    14 index c9c9a47446e8..56224aa5e83e 100644
    15 --- a/arch/arm/boot/dts/am4372.dtsi
    16 +++ b/arch/arm/boot/dts/am4372.dtsi
    17 @@ -1117,6 +1117,8 @@
    18 ti,hwmods = "dss_dispc";
    19 clocks = <&disp_clk>;
    20 clock-names = "fck";
    21 +
    22 + max-memory-bandwidth = <230000000>;
    23 };
    24
    25 rfbi: rfbi@4832a800 {
    26 diff --git a/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c b/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c
    27 index e2d84aa7f595..fa1c6707877a 100644
    28 --- a/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c
    29 +++ b/arch/arm/mach-omap2/omap_hwmod_33xx_43xx_ipblock_data.c
    30 @@ -939,7 +939,8 @@ static struct omap_hwmod_class_sysconfig am33xx_timer_sysc = {
    31 .rev_offs = 0x0000,
    32 .sysc_offs = 0x0010,
    33 .syss_offs = 0x0014,
    34 - .sysc_flags = (SYSC_HAS_SIDLEMODE | SYSC_HAS_SOFTRESET),
    35 + .sysc_flags = SYSC_HAS_SIDLEMODE | SYSC_HAS_SOFTRESET |
    36 + SYSC_HAS_RESET_STATUS,
    37 .idlemodes = (SIDLE_FORCE | SIDLE_NO | SIDLE_SMART |
    38 SIDLE_SMART_WKUP),
    39 .sysc_fields = &omap_hwmod_sysc_type2,
    40 diff --git a/arch/mips/boot/dts/qca/ar9331.dtsi b/arch/mips/boot/dts/qca/ar9331.dtsi
    41 index cf47ed4d8569..1fda24fc1860 100644
    42 --- a/arch/mips/boot/dts/qca/ar9331.dtsi
    43 +++ b/arch/mips/boot/dts/qca/ar9331.dtsi
    44 @@ -98,7 +98,7 @@
    45
    46 miscintc: interrupt-controller@18060010 {
    47 compatible = "qca,ar7240-misc-intc";
    48 - reg = <0x18060010 0x4>;
    49 + reg = <0x18060010 0x8>;
    50
    51 interrupt-parent = <&cpuintc>;
    52 interrupts = <6>;
    53 diff --git a/arch/mips/loongson64/common/serial.c b/arch/mips/loongson64/common/serial.c
    54 index ffefc1cb2612..98c3a7feb10f 100644
    55 --- a/arch/mips/loongson64/common/serial.c
    56 +++ b/arch/mips/loongson64/common/serial.c
    57 @@ -110,7 +110,7 @@ static int __init serial_init(void)
    58 }
    59 module_init(serial_init);
    60
    61 -static void __init serial_exit(void)
    62 +static void __exit serial_exit(void)
    63 {
    64 platform_device_unregister(&uart8250_device);
    65 }
    66 diff --git a/arch/mips/mm/tlbex.c b/arch/mips/mm/tlbex.c
    67 index 47d50197789b..f625fd20b21e 100644
    68 --- a/arch/mips/mm/tlbex.c
    69 +++ b/arch/mips/mm/tlbex.c
    70 @@ -661,6 +661,13 @@ static void build_restore_pagemask(u32 **p, struct uasm_reloc **r,
    71 int restore_scratch)
    72 {
    73 if (restore_scratch) {
    74 + /*
    75 + * Ensure the MFC0 below observes the value written to the
    76 + * KScratch register by the prior MTC0.
    77 + */
    78 + if (scratch_reg >= 0)
    79 + uasm_i_ehb(p);
    80 +
    81 /* Reset default page size */
    82 if (PM_DEFAULT_MASK >> 16) {
    83 uasm_i_lui(p, tmp, PM_DEFAULT_MASK >> 16);
    84 @@ -675,12 +682,10 @@ static void build_restore_pagemask(u32 **p, struct uasm_reloc **r,
    85 uasm_i_mtc0(p, 0, C0_PAGEMASK);
    86 uasm_il_b(p, r, lid);
    87 }
    88 - if (scratch_reg >= 0) {
    89 - uasm_i_ehb(p);
    90 + if (scratch_reg >= 0)
    91 UASM_i_MFC0(p, 1, c0_kscratch(), scratch_reg);
    92 - } else {
    93 + else
    94 UASM_i_LW(p, 1, scratchpad_offset(0), 0);
    95 - }
    96 } else {
    97 /* Reset default page size */
    98 if (PM_DEFAULT_MASK >> 16) {
    99 @@ -922,6 +927,10 @@ build_get_pgd_vmalloc64(u32 **p, struct uasm_label **l, struct uasm_reloc **r,
    100 }
    101 if (mode != not_refill && check_for_high_segbits) {
    102 uasm_l_large_segbits_fault(l, *p);
    103 +
    104 + if (mode == refill_scratch && scratch_reg >= 0)
    105 + uasm_i_ehb(p);
    106 +
    107 /*
    108 * We get here if we are an xsseg address, or if we are
    109 * an xuseg address above (PGDIR_SHIFT+PGDIR_BITS) boundary.
    110 @@ -938,12 +947,10 @@ build_get_pgd_vmalloc64(u32 **p, struct uasm_label **l, struct uasm_reloc **r,
    111 uasm_i_jr(p, ptr);
    112
    113 if (mode == refill_scratch) {
    114 - if (scratch_reg >= 0) {
    115 - uasm_i_ehb(p);
    116 + if (scratch_reg >= 0)
    117 UASM_i_MFC0(p, 1, c0_kscratch(), scratch_reg);
    118 - } else {
    119 + else
    120 UASM_i_LW(p, 1, scratchpad_offset(0), 0);
    121 - }
    122 } else {
    123 uasm_i_nop(p);
    124 }
    125 diff --git a/arch/parisc/mm/ioremap.c b/arch/parisc/mm/ioremap.c
    126 index 838d0259cd27..3741f91fc186 100644
    127 --- a/arch/parisc/mm/ioremap.c
    128 +++ b/arch/parisc/mm/ioremap.c
    129 @@ -2,7 +2,7 @@
    130 * arch/parisc/mm/ioremap.c
    131 *
    132 * (C) Copyright 1995 1996 Linus Torvalds
    133 - * (C) Copyright 2001-2006 Helge Deller <deller@gmx.de>
    134 + * (C) Copyright 2001-2019 Helge Deller <deller@gmx.de>
    135 * (C) Copyright 2005 Kyle McMartin <kyle@parisc-linux.org>
    136 */
    137
    138 @@ -83,7 +83,7 @@ void __iomem * __ioremap(unsigned long phys_addr, unsigned long size, unsigned l
    139 addr = (void __iomem *) area->addr;
    140 if (ioremap_page_range((unsigned long)addr, (unsigned long)addr + size,
    141 phys_addr, pgprot)) {
    142 - vfree(addr);
    143 + vunmap(addr);
    144 return NULL;
    145 }
    146
    147 @@ -91,9 +91,11 @@ void __iomem * __ioremap(unsigned long phys_addr, unsigned long size, unsigned l
    148 }
    149 EXPORT_SYMBOL(__ioremap);
    150
    151 -void iounmap(const volatile void __iomem *addr)
    152 +void iounmap(const volatile void __iomem *io_addr)
    153 {
    154 - if (addr > high_memory)
    155 - return vfree((void *) (PAGE_MASK & (unsigned long __force) addr));
    156 + unsigned long addr = (unsigned long)io_addr & PAGE_MASK;
    157 +
    158 + if (is_vmalloc_addr((void *)addr))
    159 + vunmap((void *)addr);
    160 }
    161 EXPORT_SYMBOL(iounmap);
    162 diff --git a/arch/xtensa/kernel/xtensa_ksyms.c b/arch/xtensa/kernel/xtensa_ksyms.c
    163 index a71d2739fa82..9210b9cc4ec9 100644
    164 --- a/arch/xtensa/kernel/xtensa_ksyms.c
    165 +++ b/arch/xtensa/kernel/xtensa_ksyms.c
    166 @@ -114,13 +114,6 @@ EXPORT_SYMBOL(__invalidate_icache_range);
    167 // FIXME EXPORT_SYMBOL(screen_info);
    168 #endif
    169
    170 -EXPORT_SYMBOL(outsb);
    171 -EXPORT_SYMBOL(outsw);
    172 -EXPORT_SYMBOL(outsl);
    173 -EXPORT_SYMBOL(insb);
    174 -EXPORT_SYMBOL(insw);
    175 -EXPORT_SYMBOL(insl);
    176 -
    177 extern long common_exception_return;
    178 EXPORT_SYMBOL(common_exception_return);
    179
    180 diff --git a/drivers/base/core.c b/drivers/base/core.c
    181 index 3dc483f00060..69a71074dc65 100644
    182 --- a/drivers/base/core.c
    183 +++ b/drivers/base/core.c
    184 @@ -10,6 +10,7 @@
    185 *
    186 */
    187
    188 +#include <linux/cpufreq.h>
    189 #include <linux/device.h>
    190 #include <linux/err.h>
    191 #include <linux/fwnode.h>
    192 @@ -2128,6 +2129,8 @@ void device_shutdown(void)
    193 wait_for_device_probe();
    194 device_block_probing();
    195
    196 + cpufreq_suspend();
    197 +
    198 spin_lock(&devices_kset->list_lock);
    199 /*
    200 * Walk the devices list backward, shutting down each in turn.
    201 diff --git a/drivers/block/loop.c b/drivers/block/loop.c
    202 index 9f840d9fdfcb..f236b7984b94 100644
    203 --- a/drivers/block/loop.c
    204 +++ b/drivers/block/loop.c
    205 @@ -1546,6 +1546,7 @@ static int lo_compat_ioctl(struct block_device *bdev, fmode_t mode,
    206 arg = (unsigned long) compat_ptr(arg);
    207 case LOOP_SET_FD:
    208 case LOOP_CHANGE_FD:
    209 + case LOOP_SET_DIRECT_IO:
    210 err = lo_ioctl(bdev, mode, cmd, arg);
    211 break;
    212 default:
    213 diff --git a/drivers/cpufreq/cpufreq.c b/drivers/cpufreq/cpufreq.c
    214 index e917521a3ef9..d43cd983a7ec 100644
    215 --- a/drivers/cpufreq/cpufreq.c
    216 +++ b/drivers/cpufreq/cpufreq.c
    217 @@ -2543,14 +2543,6 @@ int cpufreq_unregister_driver(struct cpufreq_driver *driver)
    218 }
    219 EXPORT_SYMBOL_GPL(cpufreq_unregister_driver);
    220
    221 -/*
    222 - * Stop cpufreq at shutdown to make sure it isn't holding any locks
    223 - * or mutexes when secondary CPUs are halted.
    224 - */
    225 -static struct syscore_ops cpufreq_syscore_ops = {
    226 - .shutdown = cpufreq_suspend,
    227 -};
    228 -
    229 struct kobject *cpufreq_global_kobject;
    230 EXPORT_SYMBOL(cpufreq_global_kobject);
    231
    232 @@ -2562,8 +2554,6 @@ static int __init cpufreq_core_init(void)
    233 cpufreq_global_kobject = kobject_create_and_add("cpufreq", &cpu_subsys.dev_root->kobj);
    234 BUG_ON(!cpufreq_global_kobject);
    235
    236 - register_syscore_ops(&cpufreq_syscore_ops);
    237 -
    238 return 0;
    239 }
    240 core_initcall(cpufreq_core_init);
    241 diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
    242 index c93dcfedc219..a9bf02ea0a3b 100644
    243 --- a/drivers/gpu/drm/drm_edid.c
    244 +++ b/drivers/gpu/drm/drm_edid.c
    245 @@ -160,6 +160,9 @@ static const struct edid_quirk {
    246 /* Medion MD 30217 PG */
    247 { "MED", 0x7b8, EDID_QUIRK_PREFER_LARGE_75 },
    248
    249 + /* Lenovo G50 */
    250 + { "SDC", 18514, EDID_QUIRK_FORCE_6BPC },
    251 +
    252 /* Panel in Samsung NP700G7A-S01PL notebook reports 6bpc */
    253 { "SEC", 0xd033, EDID_QUIRK_FORCE_8BPC },
    254
    255 diff --git a/drivers/gpu/drm/radeon/radeon_drv.c b/drivers/gpu/drm/radeon/radeon_drv.c
    256 index 3ccf5b28b326..30bd4a6a9d46 100644
    257 --- a/drivers/gpu/drm/radeon/radeon_drv.c
    258 +++ b/drivers/gpu/drm/radeon/radeon_drv.c
    259 @@ -366,19 +366,11 @@ radeon_pci_remove(struct pci_dev *pdev)
    260 static void
    261 radeon_pci_shutdown(struct pci_dev *pdev)
    262 {
    263 - struct drm_device *ddev = pci_get_drvdata(pdev);
    264 -
    265 /* if we are running in a VM, make sure the device
    266 * torn down properly on reboot/shutdown
    267 */
    268 if (radeon_device_is_virtual())
    269 radeon_pci_remove(pdev);
    270 -
    271 - /* Some adapters need to be suspended before a
    272 - * shutdown occurs in order to prevent an error
    273 - * during kexec.
    274 - */
    275 - radeon_suspend_kms(ddev, true, true, false);
    276 }
    277
    278 static int radeon_pmops_suspend(struct device *dev)
    279 diff --git a/drivers/infiniband/hw/cxgb4/mem.c b/drivers/infiniband/hw/cxgb4/mem.c
    280 index 0c215353adb9..2b1dd60a29fa 100644
    281 --- a/drivers/infiniband/hw/cxgb4/mem.c
    282 +++ b/drivers/infiniband/hw/cxgb4/mem.c
    283 @@ -264,13 +264,17 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
    284 struct sk_buff *skb)
    285 {
    286 int err;
    287 - struct fw_ri_tpte tpt;
    288 + struct fw_ri_tpte *tpt;
    289 u32 stag_idx;
    290 static atomic_t key;
    291
    292 if (c4iw_fatal_error(rdev))
    293 return -EIO;
    294
    295 + tpt = kmalloc(sizeof(*tpt), GFP_KERNEL);
    296 + if (!tpt)
    297 + return -ENOMEM;
    298 +
    299 stag_state = stag_state > 0;
    300 stag_idx = (*stag) >> 8;
    301
    302 @@ -280,6 +284,7 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
    303 mutex_lock(&rdev->stats.lock);
    304 rdev->stats.stag.fail++;
    305 mutex_unlock(&rdev->stats.lock);
    306 + kfree(tpt);
    307 return -ENOMEM;
    308 }
    309 mutex_lock(&rdev->stats.lock);
    310 @@ -294,28 +299,28 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
    311
    312 /* write TPT entry */
    313 if (reset_tpt_entry)
    314 - memset(&tpt, 0, sizeof(tpt));
    315 + memset(tpt, 0, sizeof(*tpt));
    316 else {
    317 - tpt.valid_to_pdid = cpu_to_be32(FW_RI_TPTE_VALID_F |
    318 + tpt->valid_to_pdid = cpu_to_be32(FW_RI_TPTE_VALID_F |
    319 FW_RI_TPTE_STAGKEY_V((*stag & FW_RI_TPTE_STAGKEY_M)) |
    320 FW_RI_TPTE_STAGSTATE_V(stag_state) |
    321 FW_RI_TPTE_STAGTYPE_V(type) | FW_RI_TPTE_PDID_V(pdid));
    322 - tpt.locread_to_qpid = cpu_to_be32(FW_RI_TPTE_PERM_V(perm) |
    323 + tpt->locread_to_qpid = cpu_to_be32(FW_RI_TPTE_PERM_V(perm) |
    324 (bind_enabled ? FW_RI_TPTE_MWBINDEN_F : 0) |
    325 FW_RI_TPTE_ADDRTYPE_V((zbva ? FW_RI_ZERO_BASED_TO :
    326 FW_RI_VA_BASED_TO))|
    327 FW_RI_TPTE_PS_V(page_size));
    328 - tpt.nosnoop_pbladdr = !pbl_size ? 0 : cpu_to_be32(
    329 + tpt->nosnoop_pbladdr = !pbl_size ? 0 : cpu_to_be32(
    330 FW_RI_TPTE_PBLADDR_V(PBL_OFF(rdev, pbl_addr)>>3));
    331 - tpt.len_lo = cpu_to_be32((u32)(len & 0xffffffffUL));
    332 - tpt.va_hi = cpu_to_be32((u32)(to >> 32));
    333 - tpt.va_lo_fbo = cpu_to_be32((u32)(to & 0xffffffffUL));
    334 - tpt.dca_mwbcnt_pstag = cpu_to_be32(0);
    335 - tpt.len_hi = cpu_to_be32((u32)(len >> 32));
    336 + tpt->len_lo = cpu_to_be32((u32)(len & 0xffffffffUL));
    337 + tpt->va_hi = cpu_to_be32((u32)(to >> 32));
    338 + tpt->va_lo_fbo = cpu_to_be32((u32)(to & 0xffffffffUL));
    339 + tpt->dca_mwbcnt_pstag = cpu_to_be32(0);
    340 + tpt->len_hi = cpu_to_be32((u32)(len >> 32));
    341 }
    342 err = write_adapter_mem(rdev, stag_idx +
    343 (rdev->lldi.vr->stag.start >> 5),
    344 - sizeof(tpt), &tpt, skb);
    345 + sizeof(*tpt), tpt, skb);
    346
    347 if (reset_tpt_entry) {
    348 c4iw_put_resource(&rdev->resource.tpt_table, stag_idx);
    349 @@ -323,6 +328,7 @@ static int write_tpt_entry(struct c4iw_rdev *rdev, u32 reset_tpt_entry,
    350 rdev->stats.stag.cur -= 32;
    351 mutex_unlock(&rdev->stats.lock);
    352 }
    353 + kfree(tpt);
    354 return err;
    355 }
    356
    357 diff --git a/drivers/input/misc/da9063_onkey.c b/drivers/input/misc/da9063_onkey.c
    358 index bb863e062b03..eaf5ecc431c9 100644
    359 --- a/drivers/input/misc/da9063_onkey.c
    360 +++ b/drivers/input/misc/da9063_onkey.c
    361 @@ -247,10 +247,7 @@ static int da9063_onkey_probe(struct platform_device *pdev)
    362 onkey->input->phys = onkey->phys;
    363 onkey->input->dev.parent = &pdev->dev;
    364
    365 - if (onkey->key_power)
    366 - input_set_capability(onkey->input, EV_KEY, KEY_POWER);
    367 -
    368 - input_set_capability(onkey->input, EV_KEY, KEY_SLEEP);
    369 + input_set_capability(onkey->input, EV_KEY, KEY_POWER);
    370
    371 INIT_DELAYED_WORK(&onkey->work, da9063_poll_on);
    372
    373 diff --git a/drivers/memstick/host/jmb38x_ms.c b/drivers/memstick/host/jmb38x_ms.c
    374 index 48db922075e2..08fa6400d255 100644
    375 --- a/drivers/memstick/host/jmb38x_ms.c
    376 +++ b/drivers/memstick/host/jmb38x_ms.c
    377 @@ -947,7 +947,7 @@ static int jmb38x_ms_probe(struct pci_dev *pdev,
    378 if (!cnt) {
    379 rc = -ENODEV;
    380 pci_dev_busy = 1;
    381 - goto err_out;
    382 + goto err_out_int;
    383 }
    384
    385 jm = kzalloc(sizeof(struct jmb38x_ms)
    386 diff --git a/drivers/net/ethernet/broadcom/genet/bcmgenet.h b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
    387 index 3f8858db12eb..dcf10ea60e7f 100644
    388 --- a/drivers/net/ethernet/broadcom/genet/bcmgenet.h
    389 +++ b/drivers/net/ethernet/broadcom/genet/bcmgenet.h
    390 @@ -362,6 +362,7 @@ struct bcmgenet_mib_counters {
    391 #define EXT_ENERGY_DET_MASK (1 << 12)
    392
    393 #define EXT_RGMII_OOB_CTRL 0x0C
    394 +#define RGMII_MODE_EN_V123 (1 << 0)
    395 #define RGMII_LINK (1 << 4)
    396 #define OOB_DISABLE (1 << 5)
    397 #define RGMII_MODE_EN (1 << 6)
    398 diff --git a/drivers/net/ethernet/broadcom/genet/bcmmii.c b/drivers/net/ethernet/broadcom/genet/bcmmii.c
    399 index 9bd90a7c4d40..b0b9feeb173b 100644
    400 --- a/drivers/net/ethernet/broadcom/genet/bcmmii.c
    401 +++ b/drivers/net/ethernet/broadcom/genet/bcmmii.c
    402 @@ -328,7 +328,11 @@ int bcmgenet_mii_config(struct net_device *dev)
    403 */
    404 if (priv->ext_phy) {
    405 reg = bcmgenet_ext_readl(priv, EXT_RGMII_OOB_CTRL);
    406 - reg |= RGMII_MODE_EN | id_mode_dis;
    407 + reg |= id_mode_dis;
    408 + if (GENET_IS_V1(priv) || GENET_IS_V2(priv) || GENET_IS_V3(priv))
    409 + reg |= RGMII_MODE_EN_V123;
    410 + else
    411 + reg |= RGMII_MODE_EN;
    412 bcmgenet_ext_writel(priv, reg, EXT_RGMII_OOB_CTRL);
    413 }
    414
    415 @@ -342,11 +346,12 @@ int bcmgenet_mii_probe(struct net_device *dev)
    416 struct bcmgenet_priv *priv = netdev_priv(dev);
    417 struct device_node *dn = priv->pdev->dev.of_node;
    418 struct phy_device *phydev;
    419 - u32 phy_flags;
    420 + u32 phy_flags = 0;
    421 int ret;
    422
    423 /* Communicate the integrated PHY revision */
    424 - phy_flags = priv->gphy_rev;
    425 + if (priv->internal_phy)
    426 + phy_flags = priv->gphy_rev;
    427
    428 /* Initialize link state variables that bcmgenet_mii_setup() uses */
    429 priv->old_link = -1;
    430 diff --git a/drivers/net/ethernet/hisilicon/hns_mdio.c b/drivers/net/ethernet/hisilicon/hns_mdio.c
    431 index de23a0ead5d7..d06efcd5f13b 100644
    432 --- a/drivers/net/ethernet/hisilicon/hns_mdio.c
    433 +++ b/drivers/net/ethernet/hisilicon/hns_mdio.c
    434 @@ -166,11 +166,15 @@ static int mdio_sc_cfg_reg_write(struct hns_mdio_device *mdio_dev,
    435 {
    436 u32 time_cnt;
    437 u32 reg_value;
    438 + int ret;
    439
    440 regmap_write(mdio_dev->subctrl_vbase, cfg_reg, set_val);
    441
    442 for (time_cnt = MDIO_TIMEOUT; time_cnt; time_cnt--) {
    443 - regmap_read(mdio_dev->subctrl_vbase, st_reg, &reg_value);
    444 + ret = regmap_read(mdio_dev->subctrl_vbase, st_reg, &reg_value);
    445 + if (ret)
    446 + return ret;
    447 +
    448 reg_value &= st_msk;
    449 if ((!!check_st) == (!!reg_value))
    450 break;
    451 diff --git a/drivers/net/xen-netback/interface.c b/drivers/net/xen-netback/interface.c
    452 index cae691486105..e1f47b6ea3b7 100644
    453 --- a/drivers/net/xen-netback/interface.c
    454 +++ b/drivers/net/xen-netback/interface.c
    455 @@ -706,7 +706,6 @@ err_unmap:
    456 xenvif_unmap_frontend_data_rings(queue);
    457 netif_napi_del(&queue->napi);
    458 err:
    459 - module_put(THIS_MODULE);
    460 return err;
    461 }
    462
    463 diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
    464 index a07533702d26..e09653c73ab4 100644
    465 --- a/drivers/pci/pci.c
    466 +++ b/drivers/pci/pci.c
    467 @@ -753,19 +753,6 @@ void pci_update_current_state(struct pci_dev *dev, pci_power_t state)
    468 }
    469 }
    470
    471 -/**
    472 - * pci_power_up - Put the given device into D0 forcibly
    473 - * @dev: PCI device to power up
    474 - */
    475 -void pci_power_up(struct pci_dev *dev)
    476 -{
    477 - if (platform_pci_power_manageable(dev))
    478 - platform_pci_set_power_state(dev, PCI_D0);
    479 -
    480 - pci_raw_set_power_state(dev, PCI_D0);
    481 - pci_update_current_state(dev, PCI_D0);
    482 -}
    483 -
    484 /**
    485 * pci_platform_power_transition - Use platform to change device power state
    486 * @dev: PCI device to handle.
    487 @@ -941,6 +928,17 @@ int pci_set_power_state(struct pci_dev *dev, pci_power_t state)
    488 }
    489 EXPORT_SYMBOL(pci_set_power_state);
    490
    491 +/**
    492 + * pci_power_up - Put the given device into D0 forcibly
    493 + * @dev: PCI device to power up
    494 + */
    495 +void pci_power_up(struct pci_dev *dev)
    496 +{
    497 + __pci_start_power_transition(dev, PCI_D0);
    498 + pci_raw_set_power_state(dev, PCI_D0);
    499 + pci_update_current_state(dev, PCI_D0);
    500 +}
    501 +
    502 /**
    503 * pci_choose_state - Choose the power state of a PCI device
    504 * @dev: PCI device to be suspended
    505 diff --git a/drivers/s390/scsi/zfcp_fsf.c b/drivers/s390/scsi/zfcp_fsf.c
    506 index 1964391db904..a3aaef4c53a3 100644
    507 --- a/drivers/s390/scsi/zfcp_fsf.c
    508 +++ b/drivers/s390/scsi/zfcp_fsf.c
    509 @@ -20,6 +20,11 @@
    510
    511 struct kmem_cache *zfcp_fsf_qtcb_cache;
    512
    513 +static bool ber_stop = true;
    514 +module_param(ber_stop, bool, 0600);
    515 +MODULE_PARM_DESC(ber_stop,
    516 + "Shuts down FCP devices for FCP channels that report a bit-error count in excess of its threshold (default on)");
    517 +
    518 static void zfcp_fsf_request_timeout_handler(unsigned long data)
    519 {
    520 struct zfcp_adapter *adapter = (struct zfcp_adapter *) data;
    521 @@ -231,10 +236,15 @@ static void zfcp_fsf_status_read_handler(struct zfcp_fsf_req *req)
    522 case FSF_STATUS_READ_SENSE_DATA_AVAIL:
    523 break;
    524 case FSF_STATUS_READ_BIT_ERROR_THRESHOLD:
    525 - dev_warn(&adapter->ccw_device->dev,
    526 - "The error threshold for checksum statistics "
    527 - "has been exceeded\n");
    528 zfcp_dbf_hba_bit_err("fssrh_3", req);
    529 + if (ber_stop) {
    530 + dev_warn(&adapter->ccw_device->dev,
    531 + "All paths over this FCP device are disused because of excessive bit errors\n");
    532 + zfcp_erp_adapter_shutdown(adapter, 0, "fssrh_b");
    533 + } else {
    534 + dev_warn(&adapter->ccw_device->dev,
    535 + "The error threshold for checksum statistics has been exceeded\n");
    536 + }
    537 break;
    538 case FSF_STATUS_READ_LINK_DOWN:
    539 zfcp_fsf_status_read_link_down(req);
    540 diff --git a/drivers/scsi/megaraid.c b/drivers/scsi/megaraid.c
    541 index 19bffe0b2cc0..2cbfec6a7466 100644
    542 --- a/drivers/scsi/megaraid.c
    543 +++ b/drivers/scsi/megaraid.c
    544 @@ -4219,11 +4219,11 @@ megaraid_probe_one(struct pci_dev *pdev, const struct pci_device_id *id)
    545 */
    546 if (pdev->subsystem_vendor == PCI_VENDOR_ID_COMPAQ &&
    547 pdev->subsystem_device == 0xC000)
    548 - return -ENODEV;
    549 + goto out_disable_device;
    550 /* Now check the magic signature byte */
    551 pci_read_config_word(pdev, PCI_CONF_AMISIG, &magic);
    552 if (magic != HBA_SIGNATURE_471 && magic != HBA_SIGNATURE)
    553 - return -ENODEV;
    554 + goto out_disable_device;
    555 /* Ok it is probably a megaraid */
    556 }
    557
    558 diff --git a/drivers/scsi/qla2xxx/qla_target.c b/drivers/scsi/qla2xxx/qla_target.c
    559 index 11f45cb99892..d13e91e16425 100644
    560 --- a/drivers/scsi/qla2xxx/qla_target.c
    561 +++ b/drivers/scsi/qla2xxx/qla_target.c
    562 @@ -572,6 +572,7 @@ static void qlt_free_session_done(struct work_struct *work)
    563
    564 if (logout_started) {
    565 bool traced = false;
    566 + u16 cnt = 0;
    567
    568 while (!ACCESS_ONCE(sess->logout_completed)) {
    569 if (!traced) {
    570 @@ -581,6 +582,9 @@ static void qlt_free_session_done(struct work_struct *work)
    571 traced = true;
    572 }
    573 msleep(100);
    574 + cnt++;
    575 + if (cnt > 200)
    576 + break;
    577 }
    578
    579 ql_dbg(ql_dbg_tgt_mgt, vha, 0xf087,
    580 diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
    581 index 56b65b85b121..38830818bfb6 100644
    582 --- a/drivers/scsi/scsi_sysfs.c
    583 +++ b/drivers/scsi/scsi_sysfs.c
    584 @@ -710,6 +710,14 @@ sdev_store_delete(struct device *dev, struct device_attribute *attr,
    585 const char *buf, size_t count)
    586 {
    587 struct kernfs_node *kn;
    588 + struct scsi_device *sdev = to_scsi_device(dev);
    589 +
    590 + /*
    591 + * We need to try to get module, avoiding the module been removed
    592 + * during delete.
    593 + */
    594 + if (scsi_device_get(sdev))
    595 + return -ENODEV;
    596
    597 kn = sysfs_break_active_protection(&dev->kobj, &attr->attr);
    598 WARN_ON_ONCE(!kn);
    599 @@ -724,9 +732,10 @@ sdev_store_delete(struct device *dev, struct device_attribute *attr,
    600 * state into SDEV_DEL.
    601 */
    602 device_remove_file(dev, attr);
    603 - scsi_remove_device(to_scsi_device(dev));
    604 + scsi_remove_device(sdev);
    605 if (kn)
    606 sysfs_unbreak_active_protection(kn);
    607 + scsi_device_put(sdev);
    608 return count;
    609 };
    610 static DEVICE_ATTR(delete, S_IWUSR, NULL, sdev_store_delete);
    611 diff --git a/drivers/scsi/ufs/ufshcd.c b/drivers/scsi/ufs/ufshcd.c
    612 index a9c172692f21..26f259fb6e3c 100644
    613 --- a/drivers/scsi/ufs/ufshcd.c
    614 +++ b/drivers/scsi/ufs/ufshcd.c
    615 @@ -6492,6 +6492,9 @@ int ufshcd_shutdown(struct ufs_hba *hba)
    616 {
    617 int ret = 0;
    618
    619 + if (!hba->is_powered)
    620 + goto out;
    621 +
    622 if (ufshcd_is_ufs_dev_poweroff(hba) && ufshcd_is_link_off(hba))
    623 goto out;
    624
    625 diff --git a/drivers/staging/wlan-ng/cfg80211.c b/drivers/staging/wlan-ng/cfg80211.c
    626 index 182b2d564627..4c6384328615 100644
    627 --- a/drivers/staging/wlan-ng/cfg80211.c
    628 +++ b/drivers/staging/wlan-ng/cfg80211.c
    629 @@ -489,10 +489,8 @@ static int prism2_connect(struct wiphy *wiphy, struct net_device *dev,
    630 /* Set the encryption - we only support wep */
    631 if (is_wep) {
    632 if (sme->key) {
    633 - if (sme->key_idx >= NUM_WEPKEYS) {
    634 - err = -EINVAL;
    635 - goto exit;
    636 - }
    637 + if (sme->key_idx >= NUM_WEPKEYS)
    638 + return -EINVAL;
    639
    640 result = prism2_domibset_uint32(wlandev,
    641 DIDmib_dot11smt_dot11PrivacyTable_dot11WEPDefaultKeyID,
    642 diff --git a/drivers/usb/class/usblp.c b/drivers/usb/class/usblp.c
    643 index 0669fbb0ec25..07c3c3449147 100644
    644 --- a/drivers/usb/class/usblp.c
    645 +++ b/drivers/usb/class/usblp.c
    646 @@ -458,6 +458,7 @@ static void usblp_cleanup(struct usblp *usblp)
    647 kfree(usblp->readbuf);
    648 kfree(usblp->device_id_string);
    649 kfree(usblp->statusbuf);
    650 + usb_put_intf(usblp->intf);
    651 kfree(usblp);
    652 }
    653
    654 @@ -1120,7 +1121,7 @@ static int usblp_probe(struct usb_interface *intf,
    655 init_waitqueue_head(&usblp->wwait);
    656 init_usb_anchor(&usblp->urbs);
    657 usblp->ifnum = intf->cur_altsetting->desc.bInterfaceNumber;
    658 - usblp->intf = intf;
    659 + usblp->intf = usb_get_intf(intf);
    660
    661 /* Malloc device ID string buffer to the largest expected length,
    662 * since we can re-query it on an ioctl and a dynamic string
    663 @@ -1209,6 +1210,7 @@ abort:
    664 kfree(usblp->readbuf);
    665 kfree(usblp->statusbuf);
    666 kfree(usblp->device_id_string);
    667 + usb_put_intf(usblp->intf);
    668 kfree(usblp);
    669 abort_ret:
    670 return retval;
    671 diff --git a/drivers/usb/gadget/udc/lpc32xx_udc.c b/drivers/usb/gadget/udc/lpc32xx_udc.c
    672 index 6df1aded4503..ac2aa04ca657 100644
    673 --- a/drivers/usb/gadget/udc/lpc32xx_udc.c
    674 +++ b/drivers/usb/gadget/udc/lpc32xx_udc.c
    675 @@ -1178,11 +1178,11 @@ static void udc_pop_fifo(struct lpc32xx_udc *udc, u8 *data, u32 bytes)
    676 tmp = readl(USBD_RXDATA(udc->udp_baseaddr));
    677
    678 bl = bytes - n;
    679 - if (bl > 3)
    680 - bl = 3;
    681 + if (bl > 4)
    682 + bl = 4;
    683
    684 for (i = 0; i < bl; i++)
    685 - data[n + i] = (u8) ((tmp >> (n * 8)) & 0xFF);
    686 + data[n + i] = (u8) ((tmp >> (i * 8)) & 0xFF);
    687 }
    688 break;
    689
    690 diff --git a/drivers/usb/misc/ldusb.c b/drivers/usb/misc/ldusb.c
    691 index eee69c9e9a12..52e28b4913ad 100644
    692 --- a/drivers/usb/misc/ldusb.c
    693 +++ b/drivers/usb/misc/ldusb.c
    694 @@ -384,10 +384,7 @@ static int ld_usb_release(struct inode *inode, struct file *file)
    695 goto exit;
    696 }
    697
    698 - if (mutex_lock_interruptible(&dev->mutex)) {
    699 - retval = -ERESTARTSYS;
    700 - goto exit;
    701 - }
    702 + mutex_lock(&dev->mutex);
    703
    704 if (dev->open_count != 1) {
    705 retval = -ENODEV;
    706 @@ -471,7 +468,7 @@ static ssize_t ld_usb_read(struct file *file, char __user *buffer, size_t count,
    707
    708 /* wait for data */
    709 spin_lock_irq(&dev->rbsl);
    710 - if (dev->ring_head == dev->ring_tail) {
    711 + while (dev->ring_head == dev->ring_tail) {
    712 dev->interrupt_in_done = 0;
    713 spin_unlock_irq(&dev->rbsl);
    714 if (file->f_flags & O_NONBLOCK) {
    715 @@ -481,12 +478,17 @@ static ssize_t ld_usb_read(struct file *file, char __user *buffer, size_t count,
    716 retval = wait_event_interruptible(dev->read_wait, dev->interrupt_in_done);
    717 if (retval < 0)
    718 goto unlock_exit;
    719 - } else {
    720 - spin_unlock_irq(&dev->rbsl);
    721 +
    722 + spin_lock_irq(&dev->rbsl);
    723 }
    724 + spin_unlock_irq(&dev->rbsl);
    725
    726 /* actual_buffer contains actual_length + interrupt_in_buffer */
    727 actual_buffer = (size_t*)(dev->ring_buffer + dev->ring_tail*(sizeof(size_t)+dev->interrupt_in_endpoint_size));
    728 + if (*actual_buffer > dev->interrupt_in_endpoint_size) {
    729 + retval = -EIO;
    730 + goto unlock_exit;
    731 + }
    732 bytes_to_read = min(count, *actual_buffer);
    733 if (bytes_to_read < *actual_buffer)
    734 dev_warn(&dev->intf->dev, "Read buffer overflow, %zd bytes dropped\n",
    735 @@ -702,7 +704,9 @@ static int ld_usb_probe(struct usb_interface *intf, const struct usb_device_id *
    736 dev_warn(&intf->dev, "Interrupt out endpoint not found (using control endpoint instead)\n");
    737
    738 dev->interrupt_in_endpoint_size = usb_endpoint_maxp(dev->interrupt_in_endpoint);
    739 - dev->ring_buffer = kmalloc(ring_buffer_size*(sizeof(size_t)+dev->interrupt_in_endpoint_size), GFP_KERNEL);
    740 + dev->ring_buffer = kcalloc(ring_buffer_size,
    741 + sizeof(size_t) + dev->interrupt_in_endpoint_size,
    742 + GFP_KERNEL);
    743 if (!dev->ring_buffer)
    744 goto error;
    745 dev->interrupt_in_buffer = kmalloc(dev->interrupt_in_endpoint_size, GFP_KERNEL);
    746 diff --git a/drivers/usb/misc/legousbtower.c b/drivers/usb/misc/legousbtower.c
    747 index 321756fc4d29..f56307059d48 100644
    748 --- a/drivers/usb/misc/legousbtower.c
    749 +++ b/drivers/usb/misc/legousbtower.c
    750 @@ -425,10 +425,7 @@ static int tower_release (struct inode *inode, struct file *file)
    751 goto exit;
    752 }
    753
    754 - if (mutex_lock_interruptible(&dev->lock)) {
    755 - retval = -ERESTARTSYS;
    756 - goto exit;
    757 - }
    758 + mutex_lock(&dev->lock);
    759
    760 if (dev->open_count != 1) {
    761 dev_dbg(&dev->udev->dev, "%s: device not opened exactly once\n",
    762 diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
    763 index 836cb93ba49e..a7e41723c34c 100644
    764 --- a/drivers/usb/serial/ti_usb_3410_5052.c
    765 +++ b/drivers/usb/serial/ti_usb_3410_5052.c
    766 @@ -778,7 +778,6 @@ static void ti_close(struct usb_serial_port *port)
    767 struct ti_port *tport;
    768 int port_number;
    769 int status;
    770 - int do_unlock;
    771 unsigned long flags;
    772
    773 tdev = usb_get_serial_data(port->serial);
    774 @@ -802,16 +801,13 @@ static void ti_close(struct usb_serial_port *port)
    775 "%s - cannot send close port command, %d\n"
    776 , __func__, status);
    777
    778 - /* if mutex_lock is interrupted, continue anyway */
    779 - do_unlock = !mutex_lock_interruptible(&tdev->td_open_close_lock);
    780 + mutex_lock(&tdev->td_open_close_lock);
    781 --tport->tp_tdev->td_open_port_count;
    782 - if (tport->tp_tdev->td_open_port_count <= 0) {
    783 + if (tport->tp_tdev->td_open_port_count == 0) {
    784 /* last port is closed, shut down interrupt urb */
    785 usb_kill_urb(port->serial->port[0]->interrupt_in_urb);
    786 - tport->tp_tdev->td_open_port_count = 0;
    787 }
    788 - if (do_unlock)
    789 - mutex_unlock(&tdev->td_open_close_lock);
    790 + mutex_unlock(&tdev->td_open_close_lock);
    791 }
    792
    793
    794 diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
    795 index f3a251234474..538f378eea52 100644
    796 --- a/fs/btrfs/extent-tree.c
    797 +++ b/fs/btrfs/extent-tree.c
    798 @@ -10325,6 +10325,7 @@ int btrfs_read_block_groups(struct btrfs_root *root)
    799 btrfs_err(info,
    800 "bg %llu is a mixed block group but filesystem hasn't enabled mixed block groups",
    801 cache->key.objectid);
    802 + btrfs_put_block_group(cache);
    803 ret = -EINVAL;
    804 goto error;
    805 }
    806 diff --git a/fs/cifs/smb1ops.c b/fs/cifs/smb1ops.c
    807 index f7a9adab0b84..6f5d78b172ba 100644
    808 --- a/fs/cifs/smb1ops.c
    809 +++ b/fs/cifs/smb1ops.c
    810 @@ -180,6 +180,9 @@ cifs_get_next_mid(struct TCP_Server_Info *server)
    811 /* we do not want to loop forever */
    812 last_mid = cur_mid;
    813 cur_mid++;
    814 + /* avoid 0xFFFF MID */
    815 + if (cur_mid == 0xffff)
    816 + cur_mid++;
    817
    818 /*
    819 * This nested loop looks more expensive than it is.
    820 diff --git a/fs/ocfs2/journal.c b/fs/ocfs2/journal.c
    821 index fa947d36ae1d..a30f63623db7 100644
    822 --- a/fs/ocfs2/journal.c
    823 +++ b/fs/ocfs2/journal.c
    824 @@ -231,7 +231,8 @@ void ocfs2_recovery_exit(struct ocfs2_super *osb)
    825 /* At this point, we know that no more recovery threads can be
    826 * launched, so wait for any recovery completion work to
    827 * complete. */
    828 - flush_workqueue(osb->ocfs2_wq);
    829 + if (osb->ocfs2_wq)
    830 + flush_workqueue(osb->ocfs2_wq);
    831
    832 /*
    833 * Now that recovery is shut down, and the osb is about to be
    834 diff --git a/fs/ocfs2/localalloc.c b/fs/ocfs2/localalloc.c
    835 index 5d53d0d63d19..ea38677daa06 100644
    836 --- a/fs/ocfs2/localalloc.c
    837 +++ b/fs/ocfs2/localalloc.c
    838 @@ -391,7 +391,8 @@ void ocfs2_shutdown_local_alloc(struct ocfs2_super *osb)
    839 struct ocfs2_dinode *alloc = NULL;
    840
    841 cancel_delayed_work(&osb->la_enable_wq);
    842 - flush_workqueue(osb->ocfs2_wq);
    843 + if (osb->ocfs2_wq)
    844 + flush_workqueue(osb->ocfs2_wq);
    845
    846 if (osb->local_alloc_state == OCFS2_LA_UNUSED)
    847 goto out;
    848 diff --git a/mm/shmem.c b/mm/shmem.c
    849 index 944242491059..ac8a5fedc245 100644
    850 --- a/mm/shmem.c
    851 +++ b/mm/shmem.c
    852 @@ -2457,11 +2457,12 @@ static void shmem_tag_pins(struct address_space *mapping)
    853 void **slot;
    854 pgoff_t start;
    855 struct page *page;
    856 + unsigned int tagged = 0;
    857
    858 lru_add_drain();
    859 start = 0;
    860 - rcu_read_lock();
    861
    862 + spin_lock_irq(&mapping->tree_lock);
    863 radix_tree_for_each_slot(slot, &mapping->page_tree, &iter, start) {
    864 page = radix_tree_deref_slot(slot);
    865 if (!page || radix_tree_exception(page)) {
    866 @@ -2470,18 +2471,19 @@ static void shmem_tag_pins(struct address_space *mapping)
    867 continue;
    868 }
    869 } else if (page_count(page) - page_mapcount(page) > 1) {
    870 - spin_lock_irq(&mapping->tree_lock);
    871 radix_tree_tag_set(&mapping->page_tree, iter.index,
    872 SHMEM_TAG_PINNED);
    873 - spin_unlock_irq(&mapping->tree_lock);
    874 }
    875
    876 - if (need_resched()) {
    877 - cond_resched_rcu();
    878 - slot = radix_tree_iter_next(&iter);
    879 - }
    880 + if (++tagged % 1024)
    881 + continue;
    882 +
    883 + slot = radix_tree_iter_next(&iter);
    884 + spin_unlock_irq(&mapping->tree_lock);
    885 + cond_resched();
    886 + spin_lock_irq(&mapping->tree_lock);
    887 }
    888 - rcu_read_unlock();
    889 + spin_unlock_irq(&mapping->tree_lock);
    890 }
    891
    892 /*
    893 diff --git a/mm/slub.c b/mm/slub.c
    894 index 131dee87a67c..fa6d62d559eb 100644
    895 --- a/mm/slub.c
    896 +++ b/mm/slub.c
    897 @@ -4718,7 +4718,17 @@ static ssize_t show_slab_objects(struct kmem_cache *s,
    898 }
    899 }
    900
    901 - get_online_mems();
    902 + /*
    903 + * It is impossible to take "mem_hotplug_lock" here with "kernfs_mutex"
    904 + * already held which will conflict with an existing lock order:
    905 + *
    906 + * mem_hotplug_lock->slab_mutex->kernfs_mutex
    907 + *
    908 + * We don't really need mem_hotplug_lock (to hold off
    909 + * slab_mem_going_offline_callback) here because slab's memory hot
    910 + * unplug code doesn't destroy the kmem_cache->node[] data.
    911 + */
    912 +
    913 #ifdef CONFIG_SLUB_DEBUG
    914 if (flags & SO_ALL) {
    915 struct kmem_cache_node *n;
    916 @@ -4759,7 +4769,6 @@ static ssize_t show_slab_objects(struct kmem_cache *s,
    917 x += sprintf(buf + x, " N%d=%lu",
    918 node, nodes[node]);
    919 #endif
    920 - put_online_mems();
    921 kfree(nodes);
    922 return x + sprintf(buf + x, "\n");
    923 }
    924 diff --git a/net/ipv4/route.c b/net/ipv4/route.c
    925 index d1a302d321fa..6058dbc4e2c1 100644
    926 --- a/net/ipv4/route.c
    927 +++ b/net/ipv4/route.c
    928 @@ -2221,7 +2221,7 @@ struct rtable *__ip_route_output_key_hash(struct net *net, struct flowi4 *fl4,
    929 struct fib_result res;
    930 struct rtable *rth;
    931 int orig_oif;
    932 - int err = -ENETUNREACH;
    933 + int err;
    934
    935 res.tclassid = 0;
    936 res.fi = NULL;
    937 @@ -2236,11 +2236,14 @@ struct rtable *__ip_route_output_key_hash(struct net *net, struct flowi4 *fl4,
    938
    939 rcu_read_lock();
    940 if (fl4->saddr) {
    941 - rth = ERR_PTR(-EINVAL);
    942 if (ipv4_is_multicast(fl4->saddr) ||
    943 ipv4_is_lbcast(fl4->saddr) ||
    944 - ipv4_is_zeronet(fl4->saddr))
    945 + ipv4_is_zeronet(fl4->saddr)) {
    946 + rth = ERR_PTR(-EINVAL);
    947 goto out;
    948 + }
    949 +
    950 + rth = ERR_PTR(-ENETUNREACH);
    951
    952 /* I removed check for oif == dev_out->oif here.
    953 It was wrong for two reasons:
    954 diff --git a/net/ipv6/sit.c b/net/ipv6/sit.c
    955 index 47ca2a2f1cf8..16eba7b5f1a9 100644
    956 --- a/net/ipv6/sit.c
    957 +++ b/net/ipv6/sit.c
    958 @@ -1856,7 +1856,6 @@ static int __net_init sit_init_net(struct net *net)
    959
    960 err_reg_dev:
    961 ipip6_dev_free(sitn->fb_tunnel_dev);
    962 - free_netdev(sitn->fb_tunnel_dev);
    963 err_alloc_dev:
    964 return err;
    965 }
    966 diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
    967 index bcec1240f41d..9769db9818d2 100644
    968 --- a/net/mac80211/debugfs_netdev.c
    969 +++ b/net/mac80211/debugfs_netdev.c
    970 @@ -490,9 +490,14 @@ static ssize_t ieee80211_if_fmt_aqm(
    971 const struct ieee80211_sub_if_data *sdata, char *buf, int buflen)
    972 {
    973 struct ieee80211_local *local = sdata->local;
    974 - struct txq_info *txqi = to_txq_info(sdata->vif.txq);
    975 + struct txq_info *txqi;
    976 int len;
    977
    978 + if (!sdata->vif.txq)
    979 + return 0;
    980 +
    981 + txqi = to_txq_info(sdata->vif.txq);
    982 +
    983 spin_lock_bh(&local->fq.lock);
    984 rcu_read_lock();
    985
    986 @@ -657,7 +662,9 @@ static void add_common_files(struct ieee80211_sub_if_data *sdata)
    987 DEBUGFS_ADD(rc_rateidx_vht_mcs_mask_5ghz);
    988 DEBUGFS_ADD(hw_queues);
    989
    990 - if (sdata->local->ops->wake_tx_queue)
    991 + if (sdata->local->ops->wake_tx_queue &&
    992 + sdata->vif.type != NL80211_IFTYPE_P2P_DEVICE &&
    993 + sdata->vif.type != NL80211_IFTYPE_NAN)
    994 DEBUGFS_ADD(aqm);
    995 }
    996
    997 diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
    998 index c75594a12c38..048389b5aa0f 100644
    999 --- a/net/mac80211/mlme.c
    1000 +++ b/net/mac80211/mlme.c
    1001 @@ -2434,7 +2434,8 @@ struct sk_buff *ieee80211_ap_probereq_get(struct ieee80211_hw *hw,
    1002
    1003 rcu_read_lock();
    1004 ssid = ieee80211_bss_get_ie(cbss, WLAN_EID_SSID);
    1005 - if (WARN_ON_ONCE(ssid == NULL))
    1006 + if (WARN_ONCE(!ssid || ssid[1] > IEEE80211_MAX_SSID_LEN,
    1007 + "invalid SSID element (len=%d)", ssid ? ssid[1] : -1))
    1008 ssid_len = 0;
    1009 else
    1010 ssid_len = ssid[1];
    1011 @@ -4691,7 +4692,7 @@ int ieee80211_mgd_assoc(struct ieee80211_sub_if_data *sdata,
    1012
    1013 rcu_read_lock();
    1014 ssidie = ieee80211_bss_get_ie(req->bss, WLAN_EID_SSID);
    1015 - if (!ssidie) {
    1016 + if (!ssidie || ssidie[1] > sizeof(assoc_data->ssid)) {
    1017 rcu_read_unlock();
    1018 kfree(assoc_data);
    1019 return -EINVAL;
    1020 diff --git a/net/sched/act_api.c b/net/sched/act_api.c
    1021 index 67adb4ecded2..5b8f8b382a2e 100644
    1022 --- a/net/sched/act_api.c
    1023 +++ b/net/sched/act_api.c
    1024 @@ -948,10 +948,15 @@ tcf_add_notify(struct net *net, struct nlmsghdr *n, struct list_head *actions,
    1025 static int tcf_action_add(struct net *net, struct nlattr *nla,
    1026 struct nlmsghdr *n, u32 portid, int ovr)
    1027 {
    1028 - int ret = 0;
    1029 + int loop, ret;
    1030 LIST_HEAD(actions);
    1031
    1032 - ret = tcf_action_init(net, nla, NULL, NULL, ovr, 0, &actions);
    1033 + for (loop = 0; loop < 10; loop++) {
    1034 + ret = tcf_action_init(net, nla, NULL, NULL, ovr, 0, &actions);
    1035 + if (ret != -EAGAIN)
    1036 + break;
    1037 + }
    1038 +
    1039 if (ret)
    1040 return ret;
    1041
    1042 @@ -989,10 +994,7 @@ static int tc_ctl_action(struct sk_buff *skb, struct nlmsghdr *n)
    1043 */
    1044 if (n->nlmsg_flags & NLM_F_REPLACE)
    1045 ovr = 1;
    1046 -replay:
    1047 ret = tcf_action_add(net, tca[TCA_ACT_TAB], n, portid, ovr);
    1048 - if (ret == -EAGAIN)
    1049 - goto replay;
    1050 break;
    1051 case RTM_DELACTION:
    1052 ret = tca_action_gd(net, tca[TCA_ACT_TAB], n,
    1053 diff --git a/net/sctp/socket.c b/net/sctp/socket.c
    1054 index 93e60068800b..574a6a2c48d7 100644
    1055 --- a/net/sctp/socket.c
    1056 +++ b/net/sctp/socket.c
    1057 @@ -7911,7 +7911,7 @@ struct proto sctp_prot = {
    1058 .backlog_rcv = sctp_backlog_rcv,
    1059 .hash = sctp_hash,
    1060 .unhash = sctp_unhash,
    1061 - .get_port = sctp_get_port,
    1062 + .no_autobind = true,
    1063 .obj_size = sizeof(struct sctp_sock),
    1064 .sysctl_mem = sysctl_sctp_mem,
    1065 .sysctl_rmem = sysctl_sctp_rmem,
    1066 @@ -7950,7 +7950,7 @@ struct proto sctpv6_prot = {
    1067 .backlog_rcv = sctp_backlog_rcv,
    1068 .hash = sctp_hash,
    1069 .unhash = sctp_unhash,
    1070 - .get_port = sctp_get_port,
    1071 + .no_autobind = true,
    1072 .obj_size = sizeof(struct sctp6_sock),
    1073 .sysctl_mem = sysctl_sctp_mem,
    1074 .sysctl_rmem = sysctl_sctp_rmem,
    1075 diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
    1076 index 7aa1ca7ec638..ac75e6d4eb82 100644
    1077 --- a/net/wireless/nl80211.c
    1078 +++ b/net/wireless/nl80211.c
    1079 @@ -5358,6 +5358,9 @@ static int nl80211_del_mpath(struct sk_buff *skb, struct genl_info *info)
    1080 if (!rdev->ops->del_mpath)
    1081 return -EOPNOTSUPP;
    1082
    1083 + if (dev->ieee80211_ptr->iftype != NL80211_IFTYPE_MESH_POINT)
    1084 + return -EOPNOTSUPP;
    1085 +
    1086 return rdev_del_mpath(rdev, dev, dst);
    1087 }
    1088
    1089 diff --git a/net/wireless/wext-sme.c b/net/wireless/wext-sme.c
    1090 index 995163830a61..9e7846b7d953 100644
    1091 --- a/net/wireless/wext-sme.c
    1092 +++ b/net/wireless/wext-sme.c
    1093 @@ -224,6 +224,7 @@ int cfg80211_mgd_wext_giwessid(struct net_device *dev,
    1094 struct iw_point *data, char *ssid)
    1095 {
    1096 struct wireless_dev *wdev = dev->ieee80211_ptr;
    1097 + int ret = 0;
    1098
    1099 /* call only for station! */
    1100 if (WARN_ON(wdev->iftype != NL80211_IFTYPE_STATION))
    1101 @@ -241,7 +242,10 @@ int cfg80211_mgd_wext_giwessid(struct net_device *dev,
    1102 if (ie) {
    1103 data->flags = 1;
    1104 data->length = ie[1];
    1105 - memcpy(ssid, ie + 2, data->length);
    1106 + if (data->length > IW_ESSID_MAX_SIZE)
    1107 + ret = -EINVAL;
    1108 + else
    1109 + memcpy(ssid, ie + 2, data->length);
    1110 }
    1111 rcu_read_unlock();
    1112 } else if (wdev->wext.connect.ssid && wdev->wext.connect.ssid_len) {
    1113 @@ -251,7 +255,7 @@ int cfg80211_mgd_wext_giwessid(struct net_device *dev,
    1114 }
    1115 wdev_unlock(wdev);
    1116
    1117 - return 0;
    1118 + return ret;
    1119 }
    1120
    1121 int cfg80211_mgd_wext_siwap(struct net_device *dev,
    1122 diff --git a/scripts/namespace.pl b/scripts/namespace.pl
    1123 index 9f3c9d47a4a5..4dddd4c01b62 100755
    1124 --- a/scripts/namespace.pl
    1125 +++ b/scripts/namespace.pl
    1126 @@ -65,13 +65,14 @@
    1127 require 5; # at least perl 5
    1128 use strict;
    1129 use File::Find;
    1130 +use File::Spec;
    1131
    1132 my $nm = ($ENV{'NM'} || "nm") . " -p";
    1133 my $objdump = ($ENV{'OBJDUMP'} || "objdump") . " -s -j .comment";
    1134 -my $srctree = "";
    1135 -my $objtree = "";
    1136 -$srctree = "$ENV{'srctree'}/" if (exists($ENV{'srctree'}));
    1137 -$objtree = "$ENV{'objtree'}/" if (exists($ENV{'objtree'}));
    1138 +my $srctree = File::Spec->curdir();
    1139 +my $objtree = File::Spec->curdir();
    1140 +$srctree = File::Spec->rel2abs($ENV{'srctree'}) if (exists($ENV{'srctree'}));
    1141 +$objtree = File::Spec->rel2abs($ENV{'objtree'}) if (exists($ENV{'objtree'}));
    1142
    1143 if ($#ARGV != -1) {
    1144 print STDERR "usage: $0 takes no parameters\n";
    1145 @@ -231,9 +232,9 @@ sub do_nm
    1146 }
    1147 ($source = $basename) =~ s/\.o$//;
    1148 if (-e "$source.c" || -e "$source.S") {
    1149 - $source = "$objtree$File::Find::dir/$source";
    1150 + $source = File::Spec->catfile($objtree, $File::Find::dir, $source)
    1151 } else {
    1152 - $source = "$srctree$File::Find::dir/$source";
    1153 + $source = File::Spec->catfile($srctree, $File::Find::dir, $source)
    1154 }
    1155 if (! -e "$source.c" && ! -e "$source.S") {
    1156 # No obvious source, exclude the object if it is conglomerate
    1157 diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
    1158 index d45c85dcf9d9..a64612db1f15 100644
    1159 --- a/sound/pci/hda/patch_realtek.c
    1160 +++ b/sound/pci/hda/patch_realtek.c
    1161 @@ -353,6 +353,7 @@ static void alc_fill_eapd_coef(struct hda_codec *codec)
    1162 case 0x10ec0700:
    1163 case 0x10ec0701:
    1164 case 0x10ec0703:
    1165 + case 0x10ec0711:
    1166 alc_update_coef_idx(codec, 0x10, 1<<15, 0);
    1167 break;
    1168 case 0x10ec0662:
    1169 @@ -6424,6 +6425,7 @@ static int patch_alc269(struct hda_codec *codec)
    1170 case 0x10ec0700:
    1171 case 0x10ec0701:
    1172 case 0x10ec0703:
    1173 + case 0x10ec0711:
    1174 spec->codec_variant = ALC269_TYPE_ALC700;
    1175 spec->gen.mixer_nid = 0; /* ALC700 does not have any loopback mixer path */
    1176 alc_update_coef_idx(codec, 0x4a, 1 << 15, 0); /* Combo jack auto trigger control */
    1177 @@ -7464,6 +7466,7 @@ static const struct hda_device_id snd_hda_id_realtek[] = {
    1178 HDA_CODEC_ENTRY(0x10ec0700, "ALC700", patch_alc269),
    1179 HDA_CODEC_ENTRY(0x10ec0701, "ALC701", patch_alc269),
    1180 HDA_CODEC_ENTRY(0x10ec0703, "ALC703", patch_alc269),
    1181 + HDA_CODEC_ENTRY(0x10ec0711, "ALC711", patch_alc269),
    1182 HDA_CODEC_ENTRY(0x10ec0867, "ALC891", patch_alc662),
    1183 HDA_CODEC_ENTRY(0x10ec0880, "ALC880", patch_alc880),
    1184 HDA_CODEC_ENTRY(0x10ec0882, "ALC882", patch_alc882),
    1185 diff --git a/sound/soc/sh/rcar/core.c b/sound/soc/sh/rcar/core.c
    1186 index 91b444db575e..5346b3cafc67 100644
    1187 --- a/sound/soc/sh/rcar/core.c
    1188 +++ b/sound/soc/sh/rcar/core.c
    1189 @@ -629,6 +629,7 @@ static int rsnd_soc_dai_set_fmt(struct snd_soc_dai *dai, unsigned int fmt)
    1190 }
    1191
    1192 /* set format */
    1193 + rdai->bit_clk_inv = 0;
    1194 switch (fmt & SND_SOC_DAIFMT_FORMAT_MASK) {
    1195 case SND_SOC_DAIFMT_I2S:
    1196 rdai->sys_delay = 0;