Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-lts/patches-3.4/0145-3.4.46-all-fixes.patch

    Contents of /trunk/kernel-lts/patches-3.4/0145-3.4.46-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2205 - (show annotations) (download)
    Thu Jun 13 10:38:23 2013 UTC (10 years, 11 months ago) by niro
    File size: 61243 byte(s) 
    -linux-3.4.46
    1 diff --git a/arch/arm/mach-omap2/board-rx51-peripherals.c b/arch/arm/mach-omap2/board-rx51-peripherals.c
    2 index d87ee06..283a8d0 100644
    3 --- a/arch/arm/mach-omap2/board-rx51-peripherals.c
    4 +++ b/arch/arm/mach-omap2/board-rx51-peripherals.c
    5 @@ -63,11 +63,11 @@
    6 #define RX51_TSC2005_RESET_GPIO 104
    7 #define RX51_TSC2005_IRQ_GPIO 100
    8
    9 -/* list all spi devices here */
    10 +/* List all SPI devices here. Note that the list/probe order seems to matter! */
    11 enum {
    12 RX51_SPI_WL1251,
    13 - RX51_SPI_MIPID, /* LCD panel */
    14 RX51_SPI_TSC2005, /* Touch Controller */
    15 + RX51_SPI_MIPID, /* LCD panel */
    16 };
    17
    18 static struct wl12xx_platform_data wl1251_pdata;
    19 diff --git a/arch/powerpc/include/asm/rtas.h b/arch/powerpc/include/asm/rtas.h
    20 index 557cff8..5e7e008 100644
    21 --- a/arch/powerpc/include/asm/rtas.h
    22 +++ b/arch/powerpc/include/asm/rtas.h
    23 @@ -262,6 +262,8 @@ extern void rtas_progress(char *s, unsigned short hex);
    24 extern void rtas_initialize(void);
    25 extern int rtas_suspend_cpu(struct rtas_suspend_me_data *data);
    26 extern int rtas_suspend_last_cpu(struct rtas_suspend_me_data *data);
    27 +extern int rtas_online_cpus_mask(cpumask_var_t cpus);
    28 +extern int rtas_offline_cpus_mask(cpumask_var_t cpus);
    29 extern int rtas_ibm_suspend_me(struct rtas_args *);
    30
    31 struct rtc_time;
    32 diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
    33 index fcec382..225e9f2 100644
    34 --- a/arch/powerpc/kernel/rtas.c
    35 +++ b/arch/powerpc/kernel/rtas.c
    36 @@ -19,6 +19,7 @@
    37 #include <linux/init.h>
    38 #include <linux/capability.h>
    39 #include <linux/delay.h>
    40 +#include <linux/cpu.h>
    41 #include <linux/smp.h>
    42 #include <linux/completion.h>
    43 #include <linux/cpumask.h>
    44 @@ -808,6 +809,95 @@ static void rtas_percpu_suspend_me(void *info)
    45 __rtas_suspend_cpu((struct rtas_suspend_me_data *)info, 1);
    46 }
    47
    48 +enum rtas_cpu_state {
    49 + DOWN,
    50 + UP,
    51 +};
    52 +
    53 +#ifndef CONFIG_SMP
    54 +static int rtas_cpu_state_change_mask(enum rtas_cpu_state state,
    55 + cpumask_var_t cpus)
    56 +{
    57 + if (!cpumask_empty(cpus)) {
    58 + cpumask_clear(cpus);
    59 + return -EINVAL;
    60 + } else
    61 + return 0;
    62 +}
    63 +#else
    64 +/* On return cpumask will be altered to indicate CPUs changed.
    65 + * CPUs with states changed will be set in the mask,
    66 + * CPUs with status unchanged will be unset in the mask. */
    67 +static int rtas_cpu_state_change_mask(enum rtas_cpu_state state,
    68 + cpumask_var_t cpus)
    69 +{
    70 + int cpu;
    71 + int cpuret = 0;
    72 + int ret = 0;
    73 +
    74 + if (cpumask_empty(cpus))
    75 + return 0;
    76 +
    77 + for_each_cpu(cpu, cpus) {
    78 + switch (state) {
    79 + case DOWN:
    80 + cpuret = cpu_down(cpu);
    81 + break;
    82 + case UP:
    83 + cpuret = cpu_up(cpu);
    84 + break;
    85 + }
    86 + if (cpuret) {
    87 + pr_debug("%s: cpu_%s for cpu#%d returned %d.\n",
    88 + __func__,
    89 + ((state == UP) ? "up" : "down"),
    90 + cpu, cpuret);
    91 + if (!ret)
    92 + ret = cpuret;
    93 + if (state == UP) {
    94 + /* clear bits for unchanged cpus, return */
    95 + cpumask_shift_right(cpus, cpus, cpu);
    96 + cpumask_shift_left(cpus, cpus, cpu);
    97 + break;
    98 + } else {
    99 + /* clear bit for unchanged cpu, continue */
    100 + cpumask_clear_cpu(cpu, cpus);
    101 + }
    102 + }
    103 + }
    104 +
    105 + return ret;
    106 +}
    107 +#endif
    108 +
    109 +int rtas_online_cpus_mask(cpumask_var_t cpus)
    110 +{
    111 + int ret;
    112 +
    113 + ret = rtas_cpu_state_change_mask(UP, cpus);
    114 +
    115 + if (ret) {
    116 + cpumask_var_t tmp_mask;
    117 +
    118 + if (!alloc_cpumask_var(&tmp_mask, GFP_TEMPORARY))
    119 + return ret;
    120 +
    121 + /* Use tmp_mask to preserve cpus mask from first failure */
    122 + cpumask_copy(tmp_mask, cpus);
    123 + rtas_offline_cpus_mask(tmp_mask);
    124 + free_cpumask_var(tmp_mask);
    125 + }
    126 +
    127 + return ret;
    128 +}
    129 +EXPORT_SYMBOL(rtas_online_cpus_mask);
    130 +
    131 +int rtas_offline_cpus_mask(cpumask_var_t cpus)
    132 +{
    133 + return rtas_cpu_state_change_mask(DOWN, cpus);
    134 +}
    135 +EXPORT_SYMBOL(rtas_offline_cpus_mask);
    136 +
    137 int rtas_ibm_suspend_me(struct rtas_args *args)
    138 {
    139 long state;
    140 @@ -815,6 +905,8 @@ int rtas_ibm_suspend_me(struct rtas_args *args)
    141 unsigned long retbuf[PLPAR_HCALL_BUFSIZE];
    142 struct rtas_suspend_me_data data;
    143 DECLARE_COMPLETION_ONSTACK(done);
    144 + cpumask_var_t offline_mask;
    145 + int cpuret;
    146
    147 if (!rtas_service_present("ibm,suspend-me"))
    148 return -ENOSYS;
    149 @@ -838,11 +930,24 @@ int rtas_ibm_suspend_me(struct rtas_args *args)
    150 return 0;
    151 }
    152
    153 + if (!alloc_cpumask_var(&offline_mask, GFP_TEMPORARY))
    154 + return -ENOMEM;
    155 +
    156 atomic_set(&data.working, 0);
    157 atomic_set(&data.done, 0);
    158 atomic_set(&data.error, 0);
    159 data.token = rtas_token("ibm,suspend-me");
    160 data.complete = &done;
    161 +
    162 + /* All present CPUs must be online */
    163 + cpumask_andnot(offline_mask, cpu_present_mask, cpu_online_mask);
    164 + cpuret = rtas_online_cpus_mask(offline_mask);
    165 + if (cpuret) {
    166 + pr_err("%s: Could not bring present CPUs online.\n", __func__);
    167 + atomic_set(&data.error, cpuret);
    168 + goto out;
    169 + }
    170 +
    171 stop_topology_update();
    172
    173 /* Call function on all CPUs. One of us will make the
    174 @@ -858,6 +963,14 @@ int rtas_ibm_suspend_me(struct rtas_args *args)
    175
    176 start_topology_update();
    177
    178 + /* Take down CPUs not online prior to suspend */
    179 + cpuret = rtas_offline_cpus_mask(offline_mask);
    180 + if (cpuret)
    181 + pr_warn("%s: Could not restore CPUs to offline state.\n",
    182 + __func__);
    183 +
    184 +out:
    185 + free_cpumask_var(offline_mask);
    186 return atomic_read(&data.error);
    187 }
    188 #else /* CONFIG_PPC_PSERIES */
    189 diff --git a/arch/powerpc/platforms/pseries/suspend.c b/arch/powerpc/platforms/pseries/suspend.c
    190 index 47226e0..5f997e7 100644
    191 --- a/arch/powerpc/platforms/pseries/suspend.c
    192 +++ b/arch/powerpc/platforms/pseries/suspend.c
    193 @@ -16,6 +16,7 @@
    194 * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA 02111-1307 USA
    195 */
    196
    197 +#include <linux/cpu.h>
    198 #include <linux/delay.h>
    199 #include <linux/suspend.h>
    200 #include <linux/stat.h>
    201 @@ -126,11 +127,15 @@ static ssize_t store_hibernate(struct device *dev,
    202 struct device_attribute *attr,
    203 const char *buf, size_t count)
    204 {
    205 + cpumask_var_t offline_mask;
    206 int rc;
    207
    208 if (!capable(CAP_SYS_ADMIN))
    209 return -EPERM;
    210
    211 + if (!alloc_cpumask_var(&offline_mask, GFP_TEMPORARY))
    212 + return -ENOMEM;
    213 +
    214 stream_id = simple_strtoul(buf, NULL, 16);
    215
    216 do {
    217 @@ -140,15 +145,32 @@ static ssize_t store_hibernate(struct device *dev,
    218 } while (rc == -EAGAIN);
    219
    220 if (!rc) {
    221 + /* All present CPUs must be online */
    222 + cpumask_andnot(offline_mask, cpu_present_mask,
    223 + cpu_online_mask);
    224 + rc = rtas_online_cpus_mask(offline_mask);
    225 + if (rc) {
    226 + pr_err("%s: Could not bring present CPUs online.\n",
    227 + __func__);
    228 + goto out;
    229 + }
    230 +
    231 stop_topology_update();
    232 rc = pm_suspend(PM_SUSPEND_MEM);
    233 start_topology_update();
    234 +
    235 + /* Take down CPUs not online prior to suspend */
    236 + if (!rtas_offline_cpus_mask(offline_mask))
    237 + pr_warn("%s: Could not restore CPUs to offline "
    238 + "state.\n", __func__);
    239 }
    240
    241 stream_id = 0;
    242
    243 if (!rc)
    244 rc = count;
    245 +out:
    246 + free_cpumask_var(offline_mask);
    247 return rc;
    248 }
    249
    250 diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
    251 index 4ff0ab9..90f5c0e 100644
    252 --- a/arch/x86/kvm/vmx.c
    253 +++ b/arch/x86/kvm/vmx.c
    254 @@ -4889,6 +4889,12 @@ static int handle_invalid_guest_state(struct kvm_vcpu *vcpu)
    255 if (err != EMULATE_DONE)
    256 return 0;
    257
    258 + if (vcpu->arch.halt_request) {
    259 + vcpu->arch.halt_request = 0;
    260 + ret = kvm_emulate_halt(vcpu);
    261 + goto out;
    262 + }
    263 +
    264 if (signal_pending(current))
    265 goto out;
    266 if (need_resched())
    267 diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
    268 index 2992678..a7678fa 100644
    269 --- a/arch/x86/xen/enlighten.c
    270 +++ b/arch/x86/xen/enlighten.c
    271 @@ -139,6 +139,21 @@ static void xen_vcpu_setup(int cpu)
    272
    273 BUG_ON(HYPERVISOR_shared_info == &xen_dummy_shared_info);
    274
    275 + /*
    276 + * This path is called twice on PVHVM - first during bootup via
    277 + * smp_init -> xen_hvm_cpu_notify, and then if the VCPU is being
    278 + * hotplugged: cpu_up -> xen_hvm_cpu_notify.
    279 + * As we can only do the VCPUOP_register_vcpu_info once lets
    280 + * not over-write its result.
    281 + *
    282 + * For PV it is called during restore (xen_vcpu_restore) and bootup
    283 + * (xen_setup_vcpu_info_placement). The hotplug mechanism does not
    284 + * use this function.
    285 + */
    286 + if (xen_hvm_domain()) {
    287 + if (per_cpu(xen_vcpu, cpu) == &per_cpu(xen_vcpu_info, cpu))
    288 + return;
    289 + }
    290 if (cpu < MAX_VIRT_CPUS)
    291 per_cpu(xen_vcpu,cpu) = &HYPERVISOR_shared_info->vcpu_info[cpu];
    292
    293 diff --git a/drivers/acpi/acpica/exfldio.c b/drivers/acpi/acpica/exfldio.c
    294 index 149de45..af9f1f6 100644
    295 --- a/drivers/acpi/acpica/exfldio.c
    296 +++ b/drivers/acpi/acpica/exfldio.c
    297 @@ -722,7 +722,19 @@ acpi_ex_extract_from_field(union acpi_operand_object *obj_desc,
    298
    299 if ((obj_desc->common_field.start_field_bit_offset == 0) &&
    300 (obj_desc->common_field.bit_length == access_bit_width)) {
    301 - status = acpi_ex_field_datum_io(obj_desc, 0, buffer, ACPI_READ);
    302 + if (buffer_length >= sizeof(u64)) {
    303 + status =
    304 + acpi_ex_field_datum_io(obj_desc, 0, buffer,
    305 + ACPI_READ);
    306 + } else {
    307 + /* Use raw_datum (u64) to handle buffers < 64 bits */
    308 +
    309 + status =
    310 + acpi_ex_field_datum_io(obj_desc, 0, &raw_datum,
    311 + ACPI_READ);
    312 + ACPI_MEMCPY(buffer, &raw_datum, buffer_length);
    313 + }
    314 +
    315 return_ACPI_STATUS(status);
    316 }
    317
    318 diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
    319 index a51df96..f9914e5 100644
    320 --- a/drivers/acpi/ec.c
    321 +++ b/drivers/acpi/ec.c
    322 @@ -217,7 +217,7 @@ static int ec_check_sci_sync(struct acpi_ec *ec, u8 state)
    323 static int ec_poll(struct acpi_ec *ec)
    324 {
    325 unsigned long flags;
    326 - int repeat = 2; /* number of command restarts */
    327 + int repeat = 5; /* number of command restarts */
    328 while (repeat--) {
    329 unsigned long delay = jiffies +
    330 msecs_to_jiffies(ec_delay);
    331 @@ -235,8 +235,6 @@ static int ec_poll(struct acpi_ec *ec)
    332 }
    333 advance_transaction(ec, acpi_ec_read_status(ec));
    334 } while (time_before(jiffies, delay));
    335 - if (acpi_ec_read_status(ec) & ACPI_EC_FLAG_IBF)
    336 - break;
    337 pr_debug(PREFIX "controller reset, restart transaction\n");
    338 spin_lock_irqsave(&ec->curr_lock, flags);
    339 start_transaction(ec);
    340 diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
    341 index 43beaca..13cbdd3 100644
    342 --- a/drivers/block/drbd/drbd_receiver.c
    343 +++ b/drivers/block/drbd/drbd_receiver.c
    344 @@ -2225,7 +2225,6 @@ static int drbd_asb_recover_1p(struct drbd_conf *mdev) __must_hold(local)
    345 if (hg == -1 && mdev->state.role == R_PRIMARY) {
    346 enum drbd_state_rv rv2;
    347
    348 - drbd_set_role(mdev, R_SECONDARY, 0);
    349 /* drbd_change_state() does not sleep while in SS_IN_TRANSIENT_STATE,
    350 * we might be here in C_WF_REPORT_PARAMS which is transient.
    351 * we do not need to wait for the after state change work either. */
    352 diff --git a/drivers/char/ipmi/ipmi_bt_sm.c b/drivers/char/ipmi/ipmi_bt_sm.c
    353 index cdd4c09f..a22a7a5 100644
    354 --- a/drivers/char/ipmi/ipmi_bt_sm.c
    355 +++ b/drivers/char/ipmi/ipmi_bt_sm.c
    356 @@ -95,9 +95,9 @@ struct si_sm_data {
    357 enum bt_states state;
    358 unsigned char seq; /* BT sequence number */
    359 struct si_sm_io *io;
    360 - unsigned char write_data[IPMI_MAX_MSG_LENGTH];
    361 + unsigned char write_data[IPMI_MAX_MSG_LENGTH + 2]; /* +2 for memcpy */
    362 int write_count;
    363 - unsigned char read_data[IPMI_MAX_MSG_LENGTH];
    364 + unsigned char read_data[IPMI_MAX_MSG_LENGTH + 2]; /* +2 for memcpy */
    365 int read_count;
    366 int truncated;
    367 long timeout; /* microseconds countdown */
    368 diff --git a/drivers/char/ipmi/ipmi_devintf.c b/drivers/char/ipmi/ipmi_devintf.c
    369 index 9eb360f..d5a5f02 100644
    370 --- a/drivers/char/ipmi/ipmi_devintf.c
    371 +++ b/drivers/char/ipmi/ipmi_devintf.c
    372 @@ -837,13 +837,25 @@ static long compat_ipmi_ioctl(struct file *filep, unsigned int cmd,
    373 return ipmi_ioctl(filep, cmd, arg);
    374 }
    375 }
    376 +
    377 +static long unlocked_compat_ipmi_ioctl(struct file *filep, unsigned int cmd,
    378 + unsigned long arg)
    379 +{
    380 + int ret;
    381 +
    382 + mutex_lock(&ipmi_mutex);
    383 + ret = compat_ipmi_ioctl(filep, cmd, arg);
    384 + mutex_unlock(&ipmi_mutex);
    385 +
    386 + return ret;
    387 +}
    388 #endif
    389
    390 static const struct file_operations ipmi_fops = {
    391 .owner = THIS_MODULE,
    392 .unlocked_ioctl = ipmi_unlocked_ioctl,
    393 #ifdef CONFIG_COMPAT
    394 - .compat_ioctl = compat_ipmi_ioctl,
    395 + .compat_ioctl = unlocked_compat_ipmi_ioctl,
    396 #endif
    397 .open = ipmi_open,
    398 .release = ipmi_release,
    399 diff --git a/drivers/dma/pch_dma.c b/drivers/dma/pch_dma.c
    400 index 65c0495..d05669b 100644
    401 --- a/drivers/dma/pch_dma.c
    402 +++ b/drivers/dma/pch_dma.c
    403 @@ -476,7 +476,7 @@ static struct pch_dma_desc *pdc_desc_get(struct pch_dma_chan *pd_chan)
    404 dev_dbg(chan2dev(&pd_chan->chan), "scanned %d descriptors\n", i);
    405
    406 if (!ret) {
    407 - ret = pdc_alloc_desc(&pd_chan->chan, GFP_NOIO);
    408 + ret = pdc_alloc_desc(&pd_chan->chan, GFP_ATOMIC);
    409 if (ret) {
    410 spin_lock(&pd_chan->lock);
    411 pd_chan->descs_allocated++;
    412 diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
    413 index 961fb54..7f88de6 100644
    414 --- a/drivers/gpu/drm/drm_mm.c
    415 +++ b/drivers/gpu/drm/drm_mm.c
    416 @@ -680,33 +680,35 @@ void drm_mm_debug_table(struct drm_mm *mm, const char *prefix)
    417 EXPORT_SYMBOL(drm_mm_debug_table);
    418
    419 #if defined(CONFIG_DEBUG_FS)
    420 -int drm_mm_dump_table(struct seq_file *m, struct drm_mm *mm)
    421 +static unsigned long drm_mm_dump_hole(struct seq_file *m, struct drm_mm_node *entry)
    422 {
    423 - struct drm_mm_node *entry;
    424 - unsigned long total_used = 0, total_free = 0, total = 0;
    425 unsigned long hole_start, hole_end, hole_size;
    426
    427 - hole_start = drm_mm_hole_node_start(&mm->head_node);
    428 - hole_end = drm_mm_hole_node_end(&mm->head_node);
    429 - hole_size = hole_end - hole_start;
    430 - if (hole_size)
    431 + if (entry->hole_follows) {
    432 + hole_start = drm_mm_hole_node_start(entry);
    433 + hole_end = drm_mm_hole_node_end(entry);
    434 + hole_size = hole_end - hole_start;
    435 seq_printf(m, "0x%08lx-0x%08lx: 0x%08lx: free\n",
    436 hole_start, hole_end, hole_size);
    437 - total_free += hole_size;
    438 + return hole_size;
    439 + }
    440 +
    441 + return 0;
    442 +}
    443 +
    444 +int drm_mm_dump_table(struct seq_file *m, struct drm_mm *mm)
    445 +{
    446 + struct drm_mm_node *entry;
    447 + unsigned long total_used = 0, total_free = 0, total = 0;
    448 +
    449 + total_free += drm_mm_dump_hole(m, &mm->head_node);
    450
    451 drm_mm_for_each_node(entry, mm) {
    452 seq_printf(m, "0x%08lx-0x%08lx: 0x%08lx: used\n",
    453 entry->start, entry->start + entry->size,
    454 entry->size);
    455 total_used += entry->size;
    456 - if (entry->hole_follows) {
    457 - hole_start = drm_mm_hole_node_start(entry);
    458 - hole_end = drm_mm_hole_node_end(entry);
    459 - hole_size = hole_end - hole_start;
    460 - seq_printf(m, "0x%08lx-0x%08lx: 0x%08lx: free\n",
    461 - hole_start, hole_end, hole_size);
    462 - total_free += hole_size;
    463 - }
    464 + total_free += drm_mm_dump_hole(m, entry);
    465 }
    466 total = total_free + total_used;
    467
    468 diff --git a/drivers/gpu/drm/radeon/r300_cmdbuf.c b/drivers/gpu/drm/radeon/r300_cmdbuf.c
    469 index 1fe98b4..9aa02be 100644
    470 --- a/drivers/gpu/drm/radeon/r300_cmdbuf.c
    471 +++ b/drivers/gpu/drm/radeon/r300_cmdbuf.c
    472 @@ -74,7 +74,7 @@ static int r300_emit_cliprects(drm_radeon_private_t *dev_priv,
    473 OUT_RING(CP_PACKET0(R300_RE_CLIPRECT_TL_0, nr * 2 - 1));
    474
    475 for (i = 0; i < nr; ++i) {
    476 - if (DRM_COPY_FROM_USER_UNCHECKED
    477 + if (DRM_COPY_FROM_USER
    478 (&box, &cmdbuf->boxes[n + i], sizeof(box))) {
    479 DRM_ERROR("copy cliprect faulted\n");
    480 return -EFAULT;
    481 diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
    482 index 6f75887..ff62ddc 100644
    483 --- a/drivers/md/dm-snap.c
    484 +++ b/drivers/md/dm-snap.c
    485 @@ -1117,6 +1117,7 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv)
    486 s->pending_pool = mempool_create_slab_pool(MIN_IOS, pending_cache);
    487 if (!s->pending_pool) {
    488 ti->error = "Could not allocate mempool for pending exceptions";
    489 + r = -ENOMEM;
    490 goto bad_pending_pool;
    491 }
    492
    493 diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
    494 index 1555f0b..7c3ab8f 100644
    495 --- a/drivers/md/dm-thin.c
    496 +++ b/drivers/md/dm-thin.c
    497 @@ -2027,6 +2027,7 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv)
    498 * thin devices' discard limits consistent).
    499 */
    500 ti->discards_supported = 1;
    501 + ti->discard_zeroes_data_unsupported = 1;
    502 }
    503 ti->private = pt;
    504
    505 @@ -2443,7 +2444,6 @@ static void set_discard_limits(struct pool *pool, struct queue_limits *limits)
    506 * bios that overlap 2 blocks.
    507 */
    508 limits->discard_granularity = pool->sectors_per_block << SECTOR_SHIFT;
    509 - limits->discard_zeroes_data = pool->pf.zero_new_blocks;
    510 }
    511
    512 static void pool_io_hints(struct dm_target *ti, struct queue_limits *limits)
    513 diff --git a/drivers/net/ethernet/3com/3c509.c b/drivers/net/ethernet/3com/3c509.c
    514 index 41719da..9040a62 100644
    515 --- a/drivers/net/ethernet/3com/3c509.c
    516 +++ b/drivers/net/ethernet/3com/3c509.c
    517 @@ -309,6 +309,7 @@ static int __devinit el3_isa_match(struct device *pdev,
    518 if (!dev)
    519 return -ENOMEM;
    520
    521 + SET_NETDEV_DEV(dev, pdev);
    522 netdev_boot_setup_check(dev);
    523
    524 if (!request_region(ioaddr, EL3_IO_EXTENT, "3c509-isa")) {
    525 @@ -704,6 +705,7 @@ static int __init el3_eisa_probe (struct device *device)
    526 return -ENOMEM;
    527 }
    528
    529 + SET_NETDEV_DEV(dev, device);
    530 netdev_boot_setup_check(dev);
    531
    532 el3_dev_fill(dev, phys_addr, ioaddr, irq, if_port, EL3_EISA);
    533 diff --git a/drivers/net/ethernet/3com/3c59x.c b/drivers/net/ethernet/3com/3c59x.c
    534 index e463d10..5673d6e 100644
    535 --- a/drivers/net/ethernet/3com/3c59x.c
    536 +++ b/drivers/net/ethernet/3com/3c59x.c
    537 @@ -632,7 +632,6 @@ struct vortex_private {
    538 pm_state_valid:1, /* pci_dev->saved_config_space has sane contents */
    539 open:1,
    540 medialock:1,
    541 - must_free_region:1, /* Flag: if zero, Cardbus owns the I/O region */
    542 large_frames:1, /* accept large frames */
    543 handling_irq:1; /* private in_irq indicator */
    544 /* {get|set}_wol operations are already serialized by rtnl.
    545 @@ -951,7 +950,7 @@ static int __devexit vortex_eisa_remove(struct device *device)
    546
    547 unregister_netdev(dev);
    548 iowrite16(TotalReset|0x14, ioaddr + EL3_CMD);
    549 - release_region(dev->base_addr, VORTEX_TOTAL_SIZE);
    550 + release_region(edev->base_addr, VORTEX_TOTAL_SIZE);
    551
    552 free_netdev(dev);
    553 return 0;
    554 @@ -1012,6 +1011,12 @@ static int __devinit vortex_init_one(struct pci_dev *pdev,
    555 if (rc < 0)
    556 goto out;
    557
    558 + rc = pci_request_regions(pdev, DRV_NAME);
    559 + if (rc < 0) {
    560 + pci_disable_device(pdev);
    561 + goto out;
    562 + }
    563 +
    564 unit = vortex_cards_found;
    565
    566 if (global_use_mmio < 0 && (unit >= MAX_UNITS || use_mmio[unit] < 0)) {
    567 @@ -1027,6 +1032,7 @@ static int __devinit vortex_init_one(struct pci_dev *pdev,
    568 if (!ioaddr) /* If mapping fails, fall-back to BAR 0... */
    569 ioaddr = pci_iomap(pdev, 0, 0);
    570 if (!ioaddr) {
    571 + pci_release_regions(pdev);
    572 pci_disable_device(pdev);
    573 rc = -ENOMEM;
    574 goto out;
    575 @@ -1036,6 +1042,7 @@ static int __devinit vortex_init_one(struct pci_dev *pdev,
    576 ent->driver_data, unit);
    577 if (rc < 0) {
    578 pci_iounmap(pdev, ioaddr);
    579 + pci_release_regions(pdev);
    580 pci_disable_device(pdev);
    581 goto out;
    582 }
    583 @@ -1179,11 +1186,6 @@ static int __devinit vortex_probe1(struct device *gendev,
    584
    585 /* PCI-only startup logic */
    586 if (pdev) {
    587 - /* EISA resources already marked, so only PCI needs to do this here */
    588 - /* Ignore return value, because Cardbus drivers already allocate for us */
    589 - if (request_region(dev->base_addr, vci->io_size, print_name) != NULL)
    590 - vp->must_free_region = 1;
    591 -
    592 /* enable bus-mastering if necessary */
    593 if (vci->flags & PCI_USES_MASTER)
    594 pci_set_master(pdev);
    595 @@ -1221,7 +1223,7 @@ static int __devinit vortex_probe1(struct device *gendev,
    596 &vp->rx_ring_dma);
    597 retval = -ENOMEM;
    598 if (!vp->rx_ring)
    599 - goto free_region;
    600 + goto free_device;
    601
    602 vp->tx_ring = (struct boom_tx_desc *)(vp->rx_ring + RX_RING_SIZE);
    603 vp->tx_ring_dma = vp->rx_ring_dma + sizeof(struct boom_rx_desc) * RX_RING_SIZE;
    604 @@ -1486,9 +1488,7 @@ free_ring:
    605 + sizeof(struct boom_tx_desc) * TX_RING_SIZE,
    606 vp->rx_ring,
    607 vp->rx_ring_dma);
    608 -free_region:
    609 - if (vp->must_free_region)
    610 - release_region(dev->base_addr, vci->io_size);
    611 +free_device:
    612 free_netdev(dev);
    613 pr_err(PFX "vortex_probe1 fails. Returns %d\n", retval);
    614 out:
    615 @@ -3256,8 +3256,9 @@ static void __devexit vortex_remove_one(struct pci_dev *pdev)
    616 + sizeof(struct boom_tx_desc) * TX_RING_SIZE,
    617 vp->rx_ring,
    618 vp->rx_ring_dma);
    619 - if (vp->must_free_region)
    620 - release_region(dev->base_addr, vp->io_size);
    621 +
    622 + pci_release_regions(pdev);
    623 +
    624 free_netdev(dev);
    625 }
    626
    627 diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
    628 index dd037dd..cf20388 100644
    629 --- a/drivers/net/ethernet/realtek/r8169.c
    630 +++ b/drivers/net/ethernet/realtek/r8169.c
    631 @@ -1690,8 +1690,6 @@ static void rtl8169_rx_vlan_tag(struct RxDesc *desc, struct sk_buff *skb)
    632
    633 if (opts2 & RxVlanTag)
    634 __vlan_hwaccel_put_tag(skb, swab16(opts2 & 0xffff));
    635 -
    636 - desc->opts2 = 0;
    637 }
    638
    639 static int rtl8169_gset_tbi(struct net_device *dev, struct ethtool_cmd *cmd)
    640 @@ -5434,8 +5432,6 @@ static int rtl_rx(struct net_device *dev, struct rtl8169_private *tp, u32 budget
    641 !(status & (RxRWT | RxFOVF)) &&
    642 (dev->features & NETIF_F_RXALL))
    643 goto process_pkt;
    644 -
    645 - rtl8169_mark_to_asic(desc, rx_buf_sz);
    646 } else {
    647 struct sk_buff *skb;
    648 dma_addr_t addr;
    649 @@ -5456,16 +5452,14 @@ process_pkt:
    650 if (unlikely(rtl8169_fragmented_frame(status))) {
    651 dev->stats.rx_dropped++;
    652 dev->stats.rx_length_errors++;
    653 - rtl8169_mark_to_asic(desc, rx_buf_sz);
    654 - continue;
    655 + goto release_descriptor;
    656 }
    657
    658 skb = rtl8169_try_rx_copy(tp->Rx_databuff[entry],
    659 tp, pkt_size, addr);
    660 - rtl8169_mark_to_asic(desc, rx_buf_sz);
    661 if (!skb) {
    662 dev->stats.rx_dropped++;
    663 - continue;
    664 + goto release_descriptor;
    665 }
    666
    667 rtl8169_rx_csum(skb, status);
    668 @@ -5481,6 +5475,10 @@ process_pkt:
    669 tp->rx_stats.bytes += pkt_size;
    670 u64_stats_update_end(&tp->rx_stats.syncp);
    671 }
    672 +release_descriptor:
    673 + desc->opts2 = 0;
    674 + wmb();
    675 + rtl8169_mark_to_asic(desc, rx_buf_sz);
    676 }
    677
    678 count = cur_rx - tp->cur_rx;
    679 diff --git a/drivers/net/ethernet/sfc/mcdi.c b/drivers/net/ethernet/sfc/mcdi.c
    680 index eb85217..192026f 100644
    681 --- a/drivers/net/ethernet/sfc/mcdi.c
    682 +++ b/drivers/net/ethernet/sfc/mcdi.c
    683 @@ -640,7 +640,7 @@ fail:
    684 int efx_mcdi_get_board_cfg(struct efx_nic *efx, u8 *mac_address,
    685 u16 *fw_subtype_list, u32 *capabilities)
    686 {
    687 - uint8_t outbuf[MC_CMD_GET_BOARD_CFG_OUT_LENMIN];
    688 + uint8_t outbuf[MC_CMD_GET_BOARD_CFG_OUT_LENMAX];
    689 size_t outlen, offset, i;
    690 int port_num = efx_port_num(efx);
    691 int rc;
    692 diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
    693 index 956a5ed..7160523 100644
    694 --- a/drivers/net/macvlan.c
    695 +++ b/drivers/net/macvlan.c
    696 @@ -205,7 +205,8 @@ static rx_handler_result_t macvlan_handle_frame(struct sk_buff **pskb)
    697 }
    698
    699 if (port->passthru)
    700 - vlan = list_first_entry(&port->vlans, struct macvlan_dev, list);
    701 + vlan = list_first_or_null_rcu(&port->vlans,
    702 + struct macvlan_dev, list);
    703 else
    704 vlan = macvlan_hash_lookup(port, eth->h_dest);
    705 if (vlan == NULL)
    706 @@ -724,7 +725,7 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
    707 if (err < 0)
    708 goto destroy_port;
    709
    710 - list_add_tail(&vlan->list, &port->vlans);
    711 + list_add_tail_rcu(&vlan->list, &port->vlans);
    712 netif_stacked_transfer_operstate(lowerdev, dev);
    713
    714 return 0;
    715 @@ -750,7 +751,7 @@ void macvlan_dellink(struct net_device *dev, struct list_head *head)
    716 {
    717 struct macvlan_dev *vlan = netdev_priv(dev);
    718
    719 - list_del(&vlan->list);
    720 + list_del_rcu(&vlan->list);
    721 unregister_netdevice_queue(dev, head);
    722 }
    723 EXPORT_SYMBOL_GPL(macvlan_dellink);
    724 diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
    725 index 8669c77..3b6e932 100644
    726 --- a/drivers/net/usb/qmi_wwan.c
    727 +++ b/drivers/net/usb/qmi_wwan.c
    728 @@ -9,6 +9,7 @@
    729 #include <linux/module.h>
    730 #include <linux/netdevice.h>
    731 #include <linux/ethtool.h>
    732 +#include <linux/etherdevice.h>
    733 #include <linux/mii.h>
    734 #include <linux/usb.h>
    735 #include <linux/usb/cdc.h>
    736 @@ -174,6 +175,93 @@ err:
    737 return status;
    738 }
    739
    740 +/* default ethernet address used by the modem */
    741 +static const u8 default_modem_addr[ETH_ALEN] = {0x02, 0x50, 0xf3};
    742 +
    743 +/* Make up an ethernet header if the packet doesn't have one.
    744 + *
    745 + * A firmware bug common among several devices cause them to send raw
    746 + * IP packets under some circumstances. There is no way for the
    747 + * driver/host to know when this will happen. And even when the bug
    748 + * hits, some packets will still arrive with an intact header.
    749 + *
    750 + * The supported devices are only capably of sending IPv4, IPv6 and
    751 + * ARP packets on a point-to-point link. Any packet with an ethernet
    752 + * header will have either our address or a broadcast/multicast
    753 + * address as destination. ARP packets will always have a header.
    754 + *
    755 + * This means that this function will reliably add the appropriate
    756 + * header iff necessary, provided our hardware address does not start
    757 + * with 4 or 6.
    758 + *
    759 + * Another common firmware bug results in all packets being addressed
    760 + * to 00:a0:c6:00:00:00 despite the host address being different.
    761 + * This function will also fixup such packets.
    762 + */
    763 +static int qmi_wwan_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
    764 +{
    765 + __be16 proto;
    766 +
    767 + /* usbnet rx_complete guarantees that skb->len is at least
    768 + * hard_header_len, so we can inspect the dest address without
    769 + * checking skb->len
    770 + */
    771 + switch (skb->data[0] & 0xf0) {
    772 + case 0x40:
    773 + proto = htons(ETH_P_IP);
    774 + break;
    775 + case 0x60:
    776 + proto = htons(ETH_P_IPV6);
    777 + break;
    778 + case 0x00:
    779 + if (is_multicast_ether_addr(skb->data))
    780 + return 1;
    781 + /* possibly bogus destination - rewrite just in case */
    782 + skb_reset_mac_header(skb);
    783 + goto fix_dest;
    784 + default:
    785 + /* pass along other packets without modifications */
    786 + return 1;
    787 + }
    788 + if (skb_headroom(skb) < ETH_HLEN)
    789 + return 0;
    790 + skb_push(skb, ETH_HLEN);
    791 + skb_reset_mac_header(skb);
    792 + eth_hdr(skb)->h_proto = proto;
    793 + memset(eth_hdr(skb)->h_source, 0, ETH_ALEN);
    794 +fix_dest:
    795 + memcpy(eth_hdr(skb)->h_dest, dev->net->dev_addr, ETH_ALEN);
    796 + return 1;
    797 +}
    798 +
    799 +/* very simplistic detection of IPv4 or IPv6 headers */
    800 +static bool possibly_iphdr(const char *data)
    801 +{
    802 + return (data[0] & 0xd0) == 0x40;
    803 +}
    804 +
    805 +/* disallow addresses which may be confused with IP headers */
    806 +static int qmi_wwan_mac_addr(struct net_device *dev, void *p)
    807 +{
    808 + struct sockaddr *addr = p;
    809 +
    810 + if (!is_valid_ether_addr(addr->sa_data) ||
    811 + possibly_iphdr(addr->sa_data))
    812 + return -EADDRNOTAVAIL;
    813 + memcpy(dev->dev_addr, addr->sa_data, ETH_ALEN);
    814 + return 0;
    815 +}
    816 +
    817 +static const struct net_device_ops qmi_wwan_netdev_ops = {
    818 + .ndo_open = usbnet_open,
    819 + .ndo_stop = usbnet_stop,
    820 + .ndo_start_xmit = usbnet_start_xmit,
    821 + .ndo_tx_timeout = usbnet_tx_timeout,
    822 + .ndo_change_mtu = usbnet_change_mtu,
    823 + .ndo_set_mac_address = qmi_wwan_mac_addr,
    824 + .ndo_validate_addr = eth_validate_addr,
    825 +};
    826 +
    827 /* using a counter to merge subdriver requests with our own into a combined state */
    828 static int qmi_wwan_manage_power(struct usbnet *dev, int on)
    829 {
    830 @@ -257,6 +345,18 @@ static int qmi_wwan_bind_shared(struct usbnet *dev, struct usb_interface *intf)
    831 /* save subdriver struct for suspend/resume wrappers */
    832 dev->data[0] = (unsigned long)subdriver;
    833
    834 + /* Never use the same address on both ends of the link, even
    835 + * if the buggy firmware told us to.
    836 + */
    837 + if (!compare_ether_addr(dev->net->dev_addr, default_modem_addr))
    838 + eth_hw_addr_random(dev->net);
    839 +
    840 + /* make MAC addr easily distinguishable from an IP header */
    841 + if (possibly_iphdr(dev->net->dev_addr)) {
    842 + dev->net->dev_addr[0] |= 0x02; /* set local assignment bit */
    843 + dev->net->dev_addr[0] &= 0xbf; /* clear "IP" bit */
    844 + }
    845 + dev->net->netdev_ops = &qmi_wwan_netdev_ops;
    846 err:
    847 return rv;
    848 }
    849 @@ -326,6 +426,7 @@ static const struct driver_info qmi_wwan_shared = {
    850 .bind = qmi_wwan_bind_shared,
    851 .unbind = qmi_wwan_unbind_shared,
    852 .manage_power = qmi_wwan_manage_power,
    853 + .rx_fixup = qmi_wwan_rx_fixup,
    854 };
    855
    856 static const struct driver_info qmi_wwan_force_int0 = {
    857 diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
    858 index 91e2c4f..f6a095f 100644
    859 --- a/drivers/net/wireless/ath/ath9k/main.c
    860 +++ b/drivers/net/wireless/ath/ath9k/main.c
    861 @@ -1711,6 +1711,7 @@ static int ath9k_sta_add(struct ieee80211_hw *hw,
    862 struct ath_common *common = ath9k_hw_common(sc->sc_ah);
    863 struct ath_node *an = (struct ath_node *) sta->drv_priv;
    864 struct ieee80211_key_conf ps_key = { };
    865 + int key;
    866
    867 ath_node_attach(sc, sta, vif);
    868
    869 @@ -1718,7 +1719,9 @@ static int ath9k_sta_add(struct ieee80211_hw *hw,
    870 vif->type != NL80211_IFTYPE_AP_VLAN)
    871 return 0;
    872
    873 - an->ps_key = ath_key_config(common, vif, sta, &ps_key);
    874 + key = ath_key_config(common, vif, sta, &ps_key);
    875 + if (key > 0)
    876 + an->ps_key = key;
    877
    878 return 0;
    879 }
    880 @@ -1735,6 +1738,7 @@ static void ath9k_del_ps_key(struct ath_softc *sc,
    881 return;
    882
    883 ath_key_delete(common, &ps_key);
    884 + an->ps_key = 0;
    885 }
    886
    887 static int ath9k_sta_remove(struct ieee80211_hw *hw,
    888 diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
    889 index bb2848a..448f545 100644
    890 --- a/drivers/net/wireless/b43/dma.c
    891 +++ b/drivers/net/wireless/b43/dma.c
    892 @@ -1733,6 +1733,25 @@ drop_recycle_buffer:
    893 sync_descbuffer_for_device(ring, dmaaddr, ring->rx_buffersize);
    894 }
    895
    896 +void b43_dma_handle_rx_overflow(struct b43_dmaring *ring)
    897 +{
    898 + int current_slot, previous_slot;
    899 +
    900 + B43_WARN_ON(ring->tx);
    901 +
    902 + /* Device has filled all buffers, drop all packets and let TCP
    903 + * decrease speed.
    904 + * Decrement RX index by one will let the device to see all slots
    905 + * as free again
    906 + */
    907 + /*
    908 + *TODO: How to increase rx_drop in mac80211?
    909 + */
    910 + current_slot = ring->ops->get_current_rxslot(ring);
    911 + previous_slot = prev_slot(ring, current_slot);
    912 + ring->ops->set_current_rxslot(ring, previous_slot);
    913 +}
    914 +
    915 void b43_dma_rx(struct b43_dmaring *ring)
    916 {
    917 const struct b43_dma_ops *ops = ring->ops;
    918 diff --git a/drivers/net/wireless/b43/dma.h b/drivers/net/wireless/b43/dma.h
    919 index 9fdd198..df8c8cd 100644
    920 --- a/drivers/net/wireless/b43/dma.h
    921 +++ b/drivers/net/wireless/b43/dma.h
    922 @@ -9,7 +9,7 @@
    923 /* DMA-Interrupt reasons. */
    924 #define B43_DMAIRQ_FATALMASK ((1 << 10) | (1 << 11) | (1 << 12) \
    925 | (1 << 14) | (1 << 15))
    926 -#define B43_DMAIRQ_NONFATALMASK (1 << 13)
    927 +#define B43_DMAIRQ_RDESC_UFLOW (1 << 13)
    928 #define B43_DMAIRQ_RX_DONE (1 << 16)
    929
    930 /*** 32-bit DMA Engine. ***/
    931 @@ -295,6 +295,8 @@ int b43_dma_tx(struct b43_wldev *dev,
    932 void b43_dma_handle_txstatus(struct b43_wldev *dev,
    933 const struct b43_txstatus *status);
    934
    935 +void b43_dma_handle_rx_overflow(struct b43_dmaring *ring);
    936 +
    937 void b43_dma_rx(struct b43_dmaring *ring);
    938
    939 void b43_dma_direct_fifo_rx(struct b43_wldev *dev,
    940 diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
    941 index 14fd2ca..b54c750 100644
    942 --- a/drivers/net/wireless/b43/main.c
    943 +++ b/drivers/net/wireless/b43/main.c
    944 @@ -1895,30 +1895,18 @@ static void b43_do_interrupt_thread(struct b43_wldev *dev)
    945 }
    946 }
    947
    948 - if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
    949 - B43_DMAIRQ_NONFATALMASK))) {
    950 - if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
    951 - b43err(dev->wl, "Fatal DMA error: "
    952 - "0x%08X, 0x%08X, 0x%08X, "
    953 - "0x%08X, 0x%08X, 0x%08X\n",
    954 - dma_reason[0], dma_reason[1],
    955 - dma_reason[2], dma_reason[3],
    956 - dma_reason[4], dma_reason[5]);
    957 - b43err(dev->wl, "This device does not support DMA "
    958 + if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK))) {
    959 + b43err(dev->wl,
    960 + "Fatal DMA error: 0x%08X, 0x%08X, 0x%08X, 0x%08X, 0x%08X, 0x%08X\n",
    961 + dma_reason[0], dma_reason[1],
    962 + dma_reason[2], dma_reason[3],
    963 + dma_reason[4], dma_reason[5]);
    964 + b43err(dev->wl, "This device does not support DMA "
    965 "on your system. It will now be switched to PIO.\n");
    966 - /* Fall back to PIO transfers if we get fatal DMA errors! */
    967 - dev->use_pio = true;
    968 - b43_controller_restart(dev, "DMA error");
    969 - return;
    970 - }
    971 - if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
    972 - b43err(dev->wl, "DMA error: "
    973 - "0x%08X, 0x%08X, 0x%08X, "
    974 - "0x%08X, 0x%08X, 0x%08X\n",
    975 - dma_reason[0], dma_reason[1],
    976 - dma_reason[2], dma_reason[3],
    977 - dma_reason[4], dma_reason[5]);
    978 - }
    979 + /* Fall back to PIO transfers if we get fatal DMA errors! */
    980 + dev->use_pio = true;
    981 + b43_controller_restart(dev, "DMA error");
    982 + return;
    983 }
    984
    985 if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
    986 @@ -1937,6 +1925,11 @@ static void b43_do_interrupt_thread(struct b43_wldev *dev)
    987 handle_irq_noise(dev);
    988
    989 /* Check the DMA reason registers for received data. */
    990 + if (dma_reason[0] & B43_DMAIRQ_RDESC_UFLOW) {
    991 + if (B43_DEBUG)
    992 + b43warn(dev->wl, "RX descriptor underrun\n");
    993 + b43_dma_handle_rx_overflow(dev->dma.rx_ring);
    994 + }
    995 if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
    996 if (b43_using_pio_transfers(dev))
    997 b43_pio_rx(dev->pio.rx_queue);
    998 @@ -1994,7 +1987,7 @@ static irqreturn_t b43_do_interrupt(struct b43_wldev *dev)
    999 return IRQ_NONE;
    1000
    1001 dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
    1002 - & 0x0001DC00;
    1003 + & 0x0001FC00;
    1004 dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
    1005 & 0x0000DC00;
    1006 dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
    1007 @@ -3122,7 +3115,7 @@ static int b43_chip_init(struct b43_wldev *dev)
    1008 b43_write32(dev, 0x018C, 0x02000000);
    1009 }
    1010 b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
    1011 - b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
    1012 + b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001FC00);
    1013 b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
    1014 b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
    1015 b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
    1016 diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
    1017 index 2977a12..3050b6a 100644
    1018 --- a/drivers/net/wireless/mwifiex/cmdevt.c
    1019 +++ b/drivers/net/wireless/mwifiex/cmdevt.c
    1020 @@ -1084,6 +1084,7 @@ mwifiex_process_hs_config(struct mwifiex_adapter *adapter)
    1021 adapter->if_ops.wakeup(adapter);
    1022 adapter->hs_activated = false;
    1023 adapter->is_hs_configured = false;
    1024 + adapter->is_suspended = false;
    1025 mwifiex_hs_activated_event(mwifiex_get_priv(adapter,
    1026 MWIFIEX_BSS_ROLE_ANY),
    1027 false);
    1028 diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
    1029 index 4fb146a..dc70c0f 100644
    1030 --- a/drivers/net/wireless/mwifiex/sta_ioctl.c
    1031 +++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
    1032 @@ -105,7 +105,7 @@ int mwifiex_request_set_multicast_list(struct mwifiex_private *priv,
    1033 } else {
    1034 /* Multicast */
    1035 priv->curr_pkt_filter &= ~HostCmd_ACT_MAC_PROMISCUOUS_ENABLE;
    1036 - if (mcast_list->mode == MWIFIEX_MULTICAST_MODE) {
    1037 + if (mcast_list->mode == MWIFIEX_ALL_MULTI_MODE) {
    1038 dev_dbg(priv->adapter->dev,
    1039 "info: Enabling All Multicast!\n");
    1040 priv->curr_pkt_filter |=
    1041 @@ -117,20 +117,11 @@ int mwifiex_request_set_multicast_list(struct mwifiex_private *priv,
    1042 dev_dbg(priv->adapter->dev,
    1043 "info: Set multicast list=%d\n",
    1044 mcast_list->num_multicast_addr);
    1045 - /* Set multicast addresses to firmware */
    1046 - if (old_pkt_filter == priv->curr_pkt_filter) {
    1047 - /* Send request to firmware */
    1048 - ret = mwifiex_send_cmd_async(priv,
    1049 - HostCmd_CMD_MAC_MULTICAST_ADR,
    1050 - HostCmd_ACT_GEN_SET, 0,
    1051 - mcast_list);
    1052 - } else {
    1053 - /* Send request to firmware */
    1054 - ret = mwifiex_send_cmd_async(priv,
    1055 - HostCmd_CMD_MAC_MULTICAST_ADR,
    1056 - HostCmd_ACT_GEN_SET, 0,
    1057 - mcast_list);
    1058 - }
    1059 + /* Send multicast addresses to firmware */
    1060 + ret = mwifiex_send_cmd_async(priv,
    1061 + HostCmd_CMD_MAC_MULTICAST_ADR,
    1062 + HostCmd_ACT_GEN_SET, 0,
    1063 + mcast_list);
    1064 }
    1065 }
    1066 }
    1067 diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c
    1068 index 22b2dfa..fdacfce 100644
    1069 --- a/drivers/platform/x86/hp_accel.c
    1070 +++ b/drivers/platform/x86/hp_accel.c
    1071 @@ -362,7 +362,8 @@ static int lis3lv02d_suspend(struct acpi_device *device, pm_message_t state)
    1072
    1073 static int lis3lv02d_resume(struct acpi_device *device)
    1074 {
    1075 - return lis3lv02d_poweron(&lis3_dev);
    1076 + lis3lv02d_poweron(&lis3_dev);
    1077 + return 0;
    1078 }
    1079 #else
    1080 #define lis3lv02d_suspend NULL
    1081 diff --git a/drivers/rtc/rtc-pcf2123.c b/drivers/rtc/rtc-pcf2123.c
    1082 index 8361187..9ea2555 100644
    1083 --- a/drivers/rtc/rtc-pcf2123.c
    1084 +++ b/drivers/rtc/rtc-pcf2123.c
    1085 @@ -264,6 +264,7 @@ static int __devinit pcf2123_probe(struct spi_device *spi)
    1086
    1087 if (!(rxbuf[0] & 0x20)) {
    1088 dev_err(&spi->dev, "chip not found\n");
    1089 + ret = -ENODEV;
    1090 goto kfree_exit;
    1091 }
    1092
    1093 diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
    1094 index 5b3cadb..2bbb845 100644
    1095 --- a/drivers/scsi/sd.c
    1096 +++ b/drivers/scsi/sd.c
    1097 @@ -140,6 +140,7 @@ sd_store_cache_type(struct device *dev, struct device_attribute *attr,
    1098 char *buffer_data;
    1099 struct scsi_mode_data data;
    1100 struct scsi_sense_hdr sshdr;
    1101 + const char *temp = "temporary ";
    1102 int len;
    1103
    1104 if (sdp->type != TYPE_DISK)
    1105 @@ -148,6 +149,13 @@ sd_store_cache_type(struct device *dev, struct device_attribute *attr,
    1106 * it's not worth the risk */
    1107 return -EINVAL;
    1108
    1109 + if (strncmp(buf, temp, sizeof(temp) - 1) == 0) {
    1110 + buf += sizeof(temp) - 1;
    1111 + sdkp->cache_override = 1;
    1112 + } else {
    1113 + sdkp->cache_override = 0;
    1114 + }
    1115 +
    1116 for (i = 0; i < ARRAY_SIZE(sd_cache_types); i++) {
    1117 len = strlen(sd_cache_types[i]);
    1118 if (strncmp(sd_cache_types[i], buf, len) == 0 &&
    1119 @@ -160,6 +168,13 @@ sd_store_cache_type(struct device *dev, struct device_attribute *attr,
    1120 return -EINVAL;
    1121 rcd = ct & 0x01 ? 1 : 0;
    1122 wce = ct & 0x02 ? 1 : 0;
    1123 +
    1124 + if (sdkp->cache_override) {
    1125 + sdkp->WCE = wce;
    1126 + sdkp->RCD = rcd;
    1127 + return count;
    1128 + }
    1129 +
    1130 if (scsi_mode_sense(sdp, 0x08, 8, buffer, sizeof(buffer), SD_TIMEOUT,
    1131 SD_MAX_RETRIES, &data, NULL))
    1132 return -EINVAL;
    1133 @@ -2126,6 +2141,10 @@ sd_read_cache_type(struct scsi_disk *sdkp, unsigned char *buffer)
    1134 int old_rcd = sdkp->RCD;
    1135 int old_dpofua = sdkp->DPOFUA;
    1136
    1137 +
    1138 + if (sdkp->cache_override)
    1139 + return;
    1140 +
    1141 first_len = 4;
    1142 if (sdp->skip_ms_page_8) {
    1143 if (sdp->type == TYPE_RBC)
    1144 @@ -2607,6 +2626,7 @@ static void sd_probe_async(void *data, async_cookie_t cookie)
    1145 sdkp->capacity = 0;
    1146 sdkp->media_present = 1;
    1147 sdkp->write_prot = 0;
    1148 + sdkp->cache_override = 0;
    1149 sdkp->WCE = 0;
    1150 sdkp->RCD = 0;
    1151 sdkp->ATO = 0;
    1152 diff --git a/drivers/scsi/sd.h b/drivers/scsi/sd.h
    1153 index f703f48..e2b2956 100644
    1154 --- a/drivers/scsi/sd.h
    1155 +++ b/drivers/scsi/sd.h
    1156 @@ -67,6 +67,7 @@ struct scsi_disk {
    1157 u8 protection_type;/* Data Integrity Field */
    1158 u8 provisioning_mode;
    1159 unsigned ATO : 1; /* state of disk ATO bit */
    1160 + unsigned cache_override : 1; /* temp override of WCE,RCD */
    1161 unsigned WCE : 1; /* state of disk WCE bit */
    1162 unsigned RCD : 1; /* state of disk RCD bit, unused */
    1163 unsigned DPOFUA : 1; /* state of disk DPOFUA bit */
    1164 diff --git a/drivers/target/iscsi/iscsi_target_erl1.c b/drivers/target/iscsi/iscsi_target_erl1.c
    1165 index 006f605..fd669b5 100644
    1166 --- a/drivers/target/iscsi/iscsi_target_erl1.c
    1167 +++ b/drivers/target/iscsi/iscsi_target_erl1.c
    1168 @@ -824,7 +824,7 @@ static int iscsit_attach_ooo_cmdsn(
    1169 /*
    1170 * CmdSN is greater than the tail of the list.
    1171 */
    1172 - if (ooo_tail->cmdsn < ooo_cmdsn->cmdsn)
    1173 + if (iscsi_sna_lt(ooo_tail->cmdsn, ooo_cmdsn->cmdsn))
    1174 list_add_tail(&ooo_cmdsn->ooo_list,
    1175 &sess->sess_ooo_cmdsn_list);
    1176 else {
    1177 @@ -834,11 +834,12 @@ static int iscsit_attach_ooo_cmdsn(
    1178 */
    1179 list_for_each_entry(ooo_tmp, &sess->sess_ooo_cmdsn_list,
    1180 ooo_list) {
    1181 - if (ooo_tmp->cmdsn < ooo_cmdsn->cmdsn)
    1182 + if (iscsi_sna_lt(ooo_tmp->cmdsn, ooo_cmdsn->cmdsn))
    1183 continue;
    1184
    1185 + /* Insert before this entry */
    1186 list_add(&ooo_cmdsn->ooo_list,
    1187 - &ooo_tmp->ooo_list);
    1188 + ooo_tmp->ooo_list.prev);
    1189 break;
    1190 }
    1191 }
    1192 diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
    1193 index ec970cb..19e4518 100644
    1194 --- a/fs/ext4/mballoc.c
    1195 +++ b/fs/ext4/mballoc.c
    1196 @@ -1980,7 +1980,11 @@ repeat:
    1197 group = ac->ac_g_ex.fe_group;
    1198
    1199 for (i = 0; i < ngroups; group++, i++) {
    1200 - if (group == ngroups)
    1201 + /*
    1202 + * Artificially restricted ngroups for non-extent
    1203 + * files makes group > ngroups possible on first loop.
    1204 + */
    1205 + if (group >= ngroups)
    1206 group = 0;
    1207
    1208 /* This now checks without needing the buddy page */
    1209 diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
    1210 index 001ef01..36ad5b4 100644
    1211 --- a/fs/hugetlbfs/inode.c
    1212 +++ b/fs/hugetlbfs/inode.c
    1213 @@ -927,9 +927,13 @@ static int can_do_hugetlb_shm(void)
    1214 return capable(CAP_IPC_LOCK) || in_group_p(sysctl_hugetlb_shm_group);
    1215 }
    1216
    1217 -struct file *hugetlb_file_setup(const char *name, unsigned long addr,
    1218 - size_t size, vm_flags_t acctflag,
    1219 - struct user_struct **user, int creat_flags)
    1220 +/*
    1221 + * Note that size should be aligned to proper hugepage size in caller side,
    1222 + * otherwise hugetlb_reserve_pages reserves one less hugepages than intended.
    1223 + */
    1224 +struct file *hugetlb_file_setup(const char *name, size_t size,
    1225 + vm_flags_t acctflag, struct user_struct **user,
    1226 + int creat_flags)
    1227 {
    1228 int error = -ENOMEM;
    1229 struct file *file;
    1230 @@ -937,8 +941,6 @@ struct file *hugetlb_file_setup(const char *name, unsigned long addr,
    1231 struct path path;
    1232 struct dentry *root;
    1233 struct qstr quick_string;
    1234 - struct hstate *hstate;
    1235 - unsigned long num_pages;
    1236
    1237 *user = NULL;
    1238 if (!hugetlbfs_vfsmount)
    1239 @@ -972,12 +974,10 @@ struct file *hugetlb_file_setup(const char *name, unsigned long addr,
    1240 if (!inode)
    1241 goto out_dentry;
    1242
    1243 - hstate = hstate_inode(inode);
    1244 - size += addr & ~huge_page_mask(hstate);
    1245 - num_pages = ALIGN(size, huge_page_size(hstate)) >>
    1246 - huge_page_shift(hstate);
    1247 error = -ENOMEM;
    1248 - if (hugetlb_reserve_pages(inode, 0, num_pages, NULL, acctflag))
    1249 + if (hugetlb_reserve_pages(inode, 0,
    1250 + size >> huge_page_shift(hstate_inode(inode)), NULL,
    1251 + acctflag))
    1252 goto out_inode;
    1253
    1254 d_instantiate(path.dentry, inode);
    1255 diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
    1256 index dd0308d..64198ed 100644
    1257 --- a/fs/nfsd/nfs4proc.c
    1258 +++ b/fs/nfsd/nfs4proc.c
    1259 @@ -270,6 +270,7 @@ static __be32
    1260 do_open_fhandle(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open *open)
    1261 {
    1262 __be32 status;
    1263 + int accmode = 0;
    1264
    1265 /* We don't know the target directory, and therefore can not
    1266 * set the change info
    1267 @@ -283,9 +284,19 @@ do_open_fhandle(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_
    1268
    1269 open->op_truncate = (open->op_iattr.ia_valid & ATTR_SIZE) &&
    1270 (open->op_iattr.ia_size == 0);
    1271 + /*
    1272 + * In the delegation case, the client is telling us about an
    1273 + * open that it *already* performed locally, some time ago. We
    1274 + * should let it succeed now if possible.
    1275 + *
    1276 + * In the case of a CLAIM_FH open, on the other hand, the client
    1277 + * may be counting on us to enforce permissions (the Linux 4.1
    1278 + * client uses this for normal opens, for example).
    1279 + */
    1280 + if (open->op_claim_type == NFS4_OPEN_CLAIM_DELEG_CUR_FH)
    1281 + accmode = NFSD_MAY_OWNER_OVERRIDE;
    1282
    1283 - status = do_open_permission(rqstp, current_fh, open,
    1284 - NFSD_MAY_OWNER_OVERRIDE);
    1285 + status = do_open_permission(rqstp, current_fh, open, accmode);
    1286
    1287 return status;
    1288 }
    1289 diff --git a/include/linux/audit.h b/include/linux/audit.h
    1290 index ed3ef19..4f334d5 100644
    1291 --- a/include/linux/audit.h
    1292 +++ b/include/linux/audit.h
    1293 @@ -480,7 +480,7 @@ static inline void audit_syscall_entry(int arch, int major, unsigned long a0,
    1294 unsigned long a1, unsigned long a2,
    1295 unsigned long a3)
    1296 {
    1297 - if (unlikely(!audit_dummy_context()))
    1298 + if (unlikely(current->audit_context))
    1299 __audit_syscall_entry(arch, major, a0, a1, a2, a3);
    1300 }
    1301 static inline void audit_syscall_exit(void *pt_regs)
    1302 diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
    1303 index 000837e..2c36a71 100644
    1304 --- a/include/linux/hugetlb.h
    1305 +++ b/include/linux/hugetlb.h
    1306 @@ -152,8 +152,7 @@ static inline struct hugetlbfs_sb_info *HUGETLBFS_SB(struct super_block *sb)
    1307
    1308 extern const struct file_operations hugetlbfs_file_operations;
    1309 extern const struct vm_operations_struct hugetlb_vm_ops;
    1310 -struct file *hugetlb_file_setup(const char *name, unsigned long addr,
    1311 - size_t size, vm_flags_t acct,
    1312 +struct file *hugetlb_file_setup(const char *name, size_t size, vm_flags_t acct,
    1313 struct user_struct **user, int creat_flags);
    1314
    1315 static inline int is_file_hugepages(struct file *file)
    1316 @@ -170,8 +169,8 @@ static inline int is_file_hugepages(struct file *file)
    1317
    1318 #define is_file_hugepages(file) 0
    1319 static inline struct file *
    1320 -hugetlb_file_setup(const char *name, unsigned long addr, size_t size,
    1321 - vm_flags_t acctflag, struct user_struct **user, int creat_flags)
    1322 +hugetlb_file_setup(const char *name, size_t size, vm_flags_t acctflag,
    1323 + struct user_struct **user, int creat_flags)
    1324 {
    1325 return ERR_PTR(-ENOSYS);
    1326 }
    1327 @@ -294,7 +293,7 @@ static inline unsigned hstate_index_to_shift(unsigned index)
    1328 return hstates[index].order + PAGE_SHIFT;
    1329 }
    1330
    1331 -#else
    1332 +#else /* CONFIG_HUGETLB_PAGE */
    1333 struct hstate {};
    1334 #define alloc_huge_page_node(h, nid) NULL
    1335 #define alloc_bootmem_huge_page(h) NULL
    1336 diff --git a/include/linux/if_cablemodem.h b/include/linux/if_cablemodem.h
    1337 index 9ca1007..ee6b3c4 100644
    1338 --- a/include/linux/if_cablemodem.h
    1339 +++ b/include/linux/if_cablemodem.h
    1340 @@ -12,11 +12,11 @@
    1341 */
    1342
    1343 /* some useful defines for sb1000.c e cmconfig.c - fv */
    1344 -#define SIOCGCMSTATS SIOCDEVPRIVATE+0 /* get cable modem stats */
    1345 -#define SIOCGCMFIRMWARE SIOCDEVPRIVATE+1 /* get cm firmware version */
    1346 -#define SIOCGCMFREQUENCY SIOCDEVPRIVATE+2 /* get cable modem frequency */
    1347 -#define SIOCSCMFREQUENCY SIOCDEVPRIVATE+3 /* set cable modem frequency */
    1348 -#define SIOCGCMPIDS SIOCDEVPRIVATE+4 /* get cable modem PIDs */
    1349 -#define SIOCSCMPIDS SIOCDEVPRIVATE+5 /* set cable modem PIDs */
    1350 +#define SIOCGCMSTATS (SIOCDEVPRIVATE+0) /* get cable modem stats */
    1351 +#define SIOCGCMFIRMWARE (SIOCDEVPRIVATE+1) /* get cm firmware version */
    1352 +#define SIOCGCMFREQUENCY (SIOCDEVPRIVATE+2) /* get cable modem frequency */
    1353 +#define SIOCSCMFREQUENCY (SIOCDEVPRIVATE+3) /* set cable modem frequency */
    1354 +#define SIOCGCMPIDS (SIOCDEVPRIVATE+4) /* get cable modem PIDs */
    1355 +#define SIOCSCMPIDS (SIOCDEVPRIVATE+5) /* set cable modem PIDs */
    1356
    1357 #endif
    1358 diff --git a/include/linux/rculist.h b/include/linux/rculist.h
    1359 index d079290..6f95e24 100644
    1360 --- a/include/linux/rculist.h
    1361 +++ b/include/linux/rculist.h
    1362 @@ -242,6 +242,23 @@ static inline void list_splice_init_rcu(struct list_head *list,
    1363 list_entry_rcu((ptr)->next, type, member)
    1364
    1365 /**
    1366 + * list_first_or_null_rcu - get the first element from a list
    1367 + * @ptr: the list head to take the element from.
    1368 + * @type: the type of the struct this is embedded in.
    1369 + * @member: the name of the list_struct within the struct.
    1370 + *
    1371 + * Note that if the list is empty, it returns NULL.
    1372 + *
    1373 + * This primitive may safely run concurrently with the _rcu list-mutation
    1374 + * primitives such as list_add_rcu() as long as it's guarded by rcu_read_lock().
    1375 + */
    1376 +#define list_first_or_null_rcu(ptr, type, member) \
    1377 + ({struct list_head *__ptr = (ptr); \
    1378 + struct list_head __rcu *__next = list_next_rcu(__ptr); \
    1379 + likely(__ptr != __next) ? container_of(__next, type, member) : NULL; \
    1380 + })
    1381 +
    1382 +/**
    1383 * list_for_each_entry_rcu - iterate over rcu list of given type
    1384 * @pos: the type * to use as a loop cursor.
    1385 * @head: the head for your list.
    1386 diff --git a/include/net/sock.h b/include/net/sock.h
    1387 index 59a8947..f673ba5 100644
    1388 --- a/include/net/sock.h
    1389 +++ b/include/net/sock.h
    1390 @@ -793,6 +793,18 @@ struct inet_hashinfo;
    1391 struct raw_hashinfo;
    1392 struct module;
    1393
    1394 +/*
    1395 + * caches using SLAB_DESTROY_BY_RCU should let .next pointer from nulls nodes
    1396 + * un-modified. Special care is taken when initializing object to zero.
    1397 + */
    1398 +static inline void sk_prot_clear_nulls(struct sock *sk, int size)
    1399 +{
    1400 + if (offsetof(struct sock, sk_node.next) != 0)
    1401 + memset(sk, 0, offsetof(struct sock, sk_node.next));
    1402 + memset(&sk->sk_node.pprev, 0,
    1403 + size - offsetof(struct sock, sk_node.pprev));
    1404 +}
    1405 +
    1406 /* Networking protocol blocks we attach to sockets.
    1407 * socket layer -> transport layer interface
    1408 * transport -> network interface is defined by struct inet_proto
    1409 diff --git a/include/net/tcp.h b/include/net/tcp.h
    1410 index 2757a11..8376a6a 100644
    1411 --- a/include/net/tcp.h
    1412 +++ b/include/net/tcp.h
    1413 @@ -948,6 +948,7 @@ static inline int tcp_prequeue(struct sock *sk, struct sk_buff *skb)
    1414 if (sysctl_tcp_low_latency || !tp->ucopy.task)
    1415 return 0;
    1416
    1417 + skb_dst_force(skb);
    1418 __skb_queue_tail(&tp->ucopy.prequeue, skb);
    1419 tp->ucopy.memory += skb->truesize;
    1420 if (tp->ucopy.memory > sk->sk_rcvbuf) {
    1421 diff --git a/ipc/shm.c b/ipc/shm.c
    1422 index 85d81b4..a02ef57 100644
    1423 --- a/ipc/shm.c
    1424 +++ b/ipc/shm.c
    1425 @@ -479,10 +479,12 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
    1426
    1427 sprintf (name, "SYSV%08x", key);
    1428 if (shmflg & SHM_HUGETLB) {
    1429 + size_t hugesize = ALIGN(size, huge_page_size(&default_hstate));
    1430 +
    1431 /* hugetlb_file_setup applies strict accounting */
    1432 if (shmflg & SHM_NORESERVE)
    1433 acctflag = VM_NORESERVE;
    1434 - file = hugetlb_file_setup(name, 0, size, acctflag,
    1435 + file = hugetlb_file_setup(name, hugesize, acctflag,
    1436 &shp->mlock_user, HUGETLB_SHMFS_INODE);
    1437 } else {
    1438 /*
    1439 diff --git a/kernel/kmod.c b/kernel/kmod.c
    1440 index 05698a7..f2490e1 100644
    1441 --- a/kernel/kmod.c
    1442 +++ b/kernel/kmod.c
    1443 @@ -541,6 +541,11 @@ int call_usermodehelper_exec(struct subprocess_info *sub_info, int wait)
    1444 int retval = 0;
    1445
    1446 helper_lock();
    1447 + if (!sub_info->path) {
    1448 + retval = -EINVAL;
    1449 + goto out;
    1450 + }
    1451 +
    1452 if (sub_info->path[0] == '\0')
    1453 goto out;
    1454
    1455 diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
    1456 index 01d8e62..6570548 100644
    1457 --- a/kernel/time/tick-sched.c
    1458 +++ b/kernel/time/tick-sched.c
    1459 @@ -866,7 +866,7 @@ void tick_cancel_sched_timer(int cpu)
    1460 hrtimer_cancel(&ts->sched_timer);
    1461 # endif
    1462
    1463 - ts->nohz_mode = NOHZ_MODE_INACTIVE;
    1464 + memset(ts, 0, sizeof(*ts));
    1465 }
    1466 #endif
    1467
    1468 diff --git a/kernel/timer.c b/kernel/timer.c
    1469 index 6dfdb72..dd93d90 100644
    1470 --- a/kernel/timer.c
    1471 +++ b/kernel/timer.c
    1472 @@ -1680,12 +1680,12 @@ static int __cpuinit init_timers_cpu(int cpu)
    1473 boot_done = 1;
    1474 base = &boot_tvec_bases;
    1475 }
    1476 + spin_lock_init(&base->lock);
    1477 tvec_base_done[cpu] = 1;
    1478 } else {
    1479 base = per_cpu(tvec_bases, cpu);
    1480 }
    1481
    1482 - spin_lock_init(&base->lock);
    1483
    1484 for (j = 0; j < TVN_SIZE; j++) {
    1485 INIT_LIST_HEAD(base->tv5.vec + j);
    1486 diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
    1487 index 431dba8..289197a 100644
    1488 --- a/kernel/trace/trace_events_filter.c
    1489 +++ b/kernel/trace/trace_events_filter.c
    1490 @@ -777,7 +777,11 @@ static int filter_set_pred(struct event_filter *filter,
    1491
    1492 static void __free_preds(struct event_filter *filter)
    1493 {
    1494 + int i;
    1495 +
    1496 if (filter->preds) {
    1497 + for (i = 0; i < filter->n_preds; i++)
    1498 + kfree(filter->preds[i].ops);
    1499 kfree(filter->preds);
    1500 filter->preds = NULL;
    1501 }
    1502 diff --git a/mm/mmap.c b/mm/mmap.c
    1503 index 3635d47..ed884dd 100644
    1504 --- a/mm/mmap.c
    1505 +++ b/mm/mmap.c
    1506 @@ -1130,15 +1130,19 @@ SYSCALL_DEFINE6(mmap_pgoff, unsigned long, addr, unsigned long, len,
    1507 file = fget(fd);
    1508 if (!file)
    1509 goto out;
    1510 + if (is_file_hugepages(file))
    1511 + len = ALIGN(len, huge_page_size(hstate_file(file)));
    1512 } else if (flags & MAP_HUGETLB) {
    1513 struct user_struct *user = NULL;
    1514 +
    1515 + len = ALIGN(len, huge_page_size(&default_hstate));
    1516 /*
    1517 * VM_NORESERVE is used because the reservations will be
    1518 * taken when vm_ops->mmap() is called
    1519 * A dummy user value is used because we are not locking
    1520 * memory so no accounting is necessary
    1521 */
    1522 - file = hugetlb_file_setup(HUGETLB_ANON_FILE, addr, len,
    1523 + file = hugetlb_file_setup(HUGETLB_ANON_FILE, len,
    1524 VM_NORESERVE, &user,
    1525 HUGETLB_ANONHUGE_INODE);
    1526 if (IS_ERR(file))
    1527 diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
    1528 index 9757c19..daeb19d 100644
    1529 --- a/net/8021q/vlan_dev.c
    1530 +++ b/net/8021q/vlan_dev.c
    1531 @@ -598,7 +598,7 @@ static netdev_features_t vlan_dev_fix_features(struct net_device *dev,
    1532 netdev_features_t features)
    1533 {
    1534 struct net_device *real_dev = vlan_dev_priv(dev)->real_dev;
    1535 - u32 old_features = features;
    1536 + netdev_features_t old_features = features;
    1537
    1538 features &= real_dev->vlan_features;
    1539 features |= NETIF_F_RXCSUM;
    1540 diff --git a/net/bridge/br_stp_timer.c b/net/bridge/br_stp_timer.c
    1541 index 58de2a0..c83ee79 100644
    1542 --- a/net/bridge/br_stp_timer.c
    1543 +++ b/net/bridge/br_stp_timer.c
    1544 @@ -107,7 +107,7 @@ static void br_tcn_timer_expired(unsigned long arg)
    1545
    1546 br_debug(br, "tcn timer expired\n");
    1547 spin_lock(&br->lock);
    1548 - if (br->dev->flags & IFF_UP) {
    1549 + if (!br_is_root_bridge(br) && (br->dev->flags & IFF_UP)) {
    1550 br_transmit_tcn(br);
    1551
    1552 mod_timer(&br->tcn_timer,jiffies + br->bridge_hello_time);
    1553 diff --git a/net/core/dev.c b/net/core/dev.c
    1554 index dd12421..7db83d6 100644
    1555 --- a/net/core/dev.c
    1556 +++ b/net/core/dev.c
    1557 @@ -2170,7 +2170,7 @@ EXPORT_SYMBOL(netif_skb_features);
    1558 * support DMA from it.
    1559 */
    1560 static inline int skb_needs_linearize(struct sk_buff *skb,
    1561 - int features)
    1562 + netdev_features_t features)
    1563 {
    1564 return skb_is_nonlinear(skb) &&
    1565 ((skb_has_frag_list(skb) &&
    1566 diff --git a/net/core/ethtool.c b/net/core/ethtool.c
    1567 index 6d6d7d2..7becb3f 100644
    1568 --- a/net/core/ethtool.c
    1569 +++ b/net/core/ethtool.c
    1570 @@ -1286,7 +1286,7 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
    1571 void __user *useraddr = ifr->ifr_data;
    1572 u32 ethcmd;
    1573 int rc;
    1574 - u32 old_features;
    1575 + netdev_features_t old_features;
    1576
    1577 if (!dev || !netif_device_present(dev))
    1578 return -ENODEV;
    1579 diff --git a/net/core/sock.c b/net/core/sock.c
    1580 index f8b5030..561eb57 100644
    1581 --- a/net/core/sock.c
    1582 +++ b/net/core/sock.c
    1583 @@ -1093,18 +1093,6 @@ static void sock_copy(struct sock *nsk, const struct sock *osk)
    1584 #endif
    1585 }
    1586
    1587 -/*
    1588 - * caches using SLAB_DESTROY_BY_RCU should let .next pointer from nulls nodes
    1589 - * un-modified. Special care is taken when initializing object to zero.
    1590 - */
    1591 -static inline void sk_prot_clear_nulls(struct sock *sk, int size)
    1592 -{
    1593 - if (offsetof(struct sock, sk_node.next) != 0)
    1594 - memset(sk, 0, offsetof(struct sock, sk_node.next));
    1595 - memset(&sk->sk_node.pprev, 0,
    1596 - size - offsetof(struct sock, sk_node.pprev));
    1597 -}
    1598 -
    1599 void sk_prot_clear_portaddr_nulls(struct sock *sk, int size)
    1600 {
    1601 unsigned long nulls1, nulls2;
    1602 diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
    1603 index 3889e02..7ee7121 100644
    1604 --- a/net/ipv6/tcp_ipv6.c
    1605 +++ b/net/ipv6/tcp_ipv6.c
    1606 @@ -2079,6 +2079,17 @@ void tcp6_proc_exit(struct net *net)
    1607 }
    1608 #endif
    1609
    1610 +static void tcp_v6_clear_sk(struct sock *sk, int size)
    1611 +{
    1612 + struct inet_sock *inet = inet_sk(sk);
    1613 +
    1614 + /* we do not want to clear pinet6 field, because of RCU lookups */
    1615 + sk_prot_clear_nulls(sk, offsetof(struct inet_sock, pinet6));
    1616 +
    1617 + size -= offsetof(struct inet_sock, pinet6) + sizeof(inet->pinet6);
    1618 + memset(&inet->pinet6 + 1, 0, size);
    1619 +}
    1620 +
    1621 struct proto tcpv6_prot = {
    1622 .name = "TCPv6",
    1623 .owner = THIS_MODULE,
    1624 @@ -2120,6 +2131,7 @@ struct proto tcpv6_prot = {
    1625 #ifdef CONFIG_CGROUP_MEM_RES_CTLR_KMEM
    1626 .proto_cgroup = tcp_proto_cgroup,
    1627 #endif
    1628 + .clear_sk = tcp_v6_clear_sk,
    1629 };
    1630
    1631 static const struct inet6_protocol tcpv6_protocol = {
    1632 diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
    1633 index 37b0699..aa2f18b 100644
    1634 --- a/net/ipv6/udp.c
    1635 +++ b/net/ipv6/udp.c
    1636 @@ -1457,6 +1457,17 @@ void udp6_proc_exit(struct net *net) {
    1637 }
    1638 #endif /* CONFIG_PROC_FS */
    1639
    1640 +void udp_v6_clear_sk(struct sock *sk, int size)
    1641 +{
    1642 + struct inet_sock *inet = inet_sk(sk);
    1643 +
    1644 + /* we do not want to clear pinet6 field, because of RCU lookups */
    1645 + sk_prot_clear_portaddr_nulls(sk, offsetof(struct inet_sock, pinet6));
    1646 +
    1647 + size -= offsetof(struct inet_sock, pinet6) + sizeof(inet->pinet6);
    1648 + memset(&inet->pinet6 + 1, 0, size);
    1649 +}
    1650 +
    1651 /* ------------------------------------------------------------------------ */
    1652
    1653 struct proto udpv6_prot = {
    1654 @@ -1487,7 +1498,7 @@ struct proto udpv6_prot = {
    1655 .compat_setsockopt = compat_udpv6_setsockopt,
    1656 .compat_getsockopt = compat_udpv6_getsockopt,
    1657 #endif
    1658 - .clear_sk = sk_prot_clear_portaddr_nulls,
    1659 + .clear_sk = udp_v6_clear_sk,
    1660 };
    1661
    1662 static struct inet_protosw udpv6_protosw = {
    1663 diff --git a/net/ipv6/udp_impl.h b/net/ipv6/udp_impl.h
    1664 index d757104..4691ed5 100644
    1665 --- a/net/ipv6/udp_impl.h
    1666 +++ b/net/ipv6/udp_impl.h
    1667 @@ -31,6 +31,8 @@ extern int udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
    1668 extern int udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb);
    1669 extern void udpv6_destroy_sock(struct sock *sk);
    1670
    1671 +extern void udp_v6_clear_sk(struct sock *sk, int size);
    1672 +
    1673 #ifdef CONFIG_PROC_FS
    1674 extern int udp6_seq_show(struct seq_file *seq, void *v);
    1675 #endif
    1676 diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite.c
    1677 index 1d08e21..dfcc4be 100644
    1678 --- a/net/ipv6/udplite.c
    1679 +++ b/net/ipv6/udplite.c
    1680 @@ -56,7 +56,7 @@ struct proto udplitev6_prot = {
    1681 .compat_setsockopt = compat_udpv6_setsockopt,
    1682 .compat_getsockopt = compat_udpv6_getsockopt,
    1683 #endif
    1684 - .clear_sk = sk_prot_clear_portaddr_nulls,
    1685 + .clear_sk = udp_v6_clear_sk,
    1686 };
    1687
    1688 static struct inet_protosw udplite6_protosw = {
    1689 diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
    1690 index 8ea65e0..808fd08 100644
    1691 --- a/net/ipv6/xfrm6_policy.c
    1692 +++ b/net/ipv6/xfrm6_policy.c
    1693 @@ -96,8 +96,10 @@ static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
    1694 dev_hold(dev);
    1695
    1696 xdst->u.rt6.rt6i_idev = in6_dev_get(dev);
    1697 - if (!xdst->u.rt6.rt6i_idev)
    1698 + if (!xdst->u.rt6.rt6i_idev) {
    1699 + dev_put(dev);
    1700 return -ENODEV;
    1701 + }
    1702
    1703 xdst->u.rt6.rt6i_peer = rt->rt6i_peer;
    1704 if (rt->rt6i_peer)
    1705 diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
    1706 index 38ca5e0..cfcd783 100644
    1707 --- a/net/packet/af_packet.c
    1708 +++ b/net/packet/af_packet.c
    1709 @@ -812,37 +812,27 @@ static void prb_open_block(struct tpacket_kbdq_core *pkc1,
    1710
    1711 smp_rmb();
    1712
    1713 - if (likely(TP_STATUS_KERNEL == BLOCK_STATUS(pbd1))) {
    1714 -
    1715 - /* We could have just memset this but we will lose the
    1716 - * flexibility of making the priv area sticky
    1717 - */
    1718 - BLOCK_SNUM(pbd1) = pkc1->knxt_seq_num++;
    1719 - BLOCK_NUM_PKTS(pbd1) = 0;
    1720 - BLOCK_LEN(pbd1) = BLK_PLUS_PRIV(pkc1->blk_sizeof_priv);
    1721 - getnstimeofday(&ts);
    1722 - h1->ts_first_pkt.ts_sec = ts.tv_sec;
    1723 - h1->ts_first_pkt.ts_nsec = ts.tv_nsec;
    1724 - pkc1->pkblk_start = (char *)pbd1;
    1725 - pkc1->nxt_offset = (char *)(pkc1->pkblk_start +
    1726 - BLK_PLUS_PRIV(pkc1->blk_sizeof_priv));
    1727 - BLOCK_O2FP(pbd1) = (__u32)BLK_PLUS_PRIV(pkc1->blk_sizeof_priv);
    1728 - BLOCK_O2PRIV(pbd1) = BLK_HDR_LEN;
    1729 - pbd1->version = pkc1->version;
    1730 - pkc1->prev = pkc1->nxt_offset;
    1731 - pkc1->pkblk_end = pkc1->pkblk_start + pkc1->kblk_size;
    1732 - prb_thaw_queue(pkc1);
    1733 - _prb_refresh_rx_retire_blk_timer(pkc1);
    1734 -
    1735 - smp_wmb();
    1736 -
    1737 - return;
    1738 - }
    1739 + /* We could have just memset this but we will lose the
    1740 + * flexibility of making the priv area sticky
    1741 + */
    1742 + BLOCK_SNUM(pbd1) = pkc1->knxt_seq_num++;
    1743 + BLOCK_NUM_PKTS(pbd1) = 0;
    1744 + BLOCK_LEN(pbd1) = BLK_PLUS_PRIV(pkc1->blk_sizeof_priv);
    1745 + getnstimeofday(&ts);
    1746 + h1->ts_first_pkt.ts_sec = ts.tv_sec;
    1747 + h1->ts_first_pkt.ts_nsec = ts.tv_nsec;
    1748 + pkc1->pkblk_start = (char *)pbd1;
    1749 + pkc1->nxt_offset = (char *)(pkc1->pkblk_start +
    1750 + BLK_PLUS_PRIV(pkc1->blk_sizeof_priv));
    1751 + BLOCK_O2FP(pbd1) = (__u32)BLK_PLUS_PRIV(pkc1->blk_sizeof_priv);
    1752 + BLOCK_O2PRIV(pbd1) = BLK_HDR_LEN;
    1753 + pbd1->version = pkc1->version;
    1754 + pkc1->prev = pkc1->nxt_offset;
    1755 + pkc1->pkblk_end = pkc1->pkblk_start + pkc1->kblk_size;
    1756 + prb_thaw_queue(pkc1);
    1757 + _prb_refresh_rx_retire_blk_timer(pkc1);
    1758
    1759 - WARN(1, "ERROR block:%p is NOT FREE status:%d kactive_blk_num:%d\n",
    1760 - pbd1, BLOCK_STATUS(pbd1), pkc1->kactive_blk_num);
    1761 - dump_stack();
    1762 - BUG();
    1763 + smp_wmb();
    1764 }
    1765
    1766 /*
    1767 @@ -933,10 +923,6 @@ static void prb_retire_current_block(struct tpacket_kbdq_core *pkc,
    1768 prb_close_block(pkc, pbd, po, status);
    1769 return;
    1770 }
    1771 -
    1772 - WARN(1, "ERROR-pbd[%d]:%p\n", pkc->kactive_blk_num, pbd);
    1773 - dump_stack();
    1774 - BUG();
    1775 }
    1776
    1777 static int prb_curr_blk_in_use(struct tpacket_kbdq_core *pkc,
    1778 diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
    1779 index 60f8f61..57827bf 100644
    1780 --- a/net/sched/act_ipt.c
    1781 +++ b/net/sched/act_ipt.c
    1782 @@ -8,7 +8,7 @@
    1783 * as published by the Free Software Foundation; either version
    1784 * 2 of the License, or (at your option) any later version.
    1785 *
    1786 - * Copyright: Jamal Hadi Salim (2002-4)
    1787 + * Copyright: Jamal Hadi Salim (2002-13)
    1788 */
    1789
    1790 #include <linux/types.h>
    1791 @@ -299,17 +299,44 @@ static struct tc_action_ops act_ipt_ops = {
    1792 .walk = tcf_generic_walker
    1793 };
    1794
    1795 -MODULE_AUTHOR("Jamal Hadi Salim(2002-4)");
    1796 +static struct tc_action_ops act_xt_ops = {
    1797 + .kind = "xt",
    1798 + .hinfo = &ipt_hash_info,
    1799 + .type = TCA_ACT_IPT,
    1800 + .capab = TCA_CAP_NONE,
    1801 + .owner = THIS_MODULE,
    1802 + .act = tcf_ipt,
    1803 + .dump = tcf_ipt_dump,
    1804 + .cleanup = tcf_ipt_cleanup,
    1805 + .lookup = tcf_hash_search,
    1806 + .init = tcf_ipt_init,
    1807 + .walk = tcf_generic_walker
    1808 +};
    1809 +
    1810 +MODULE_AUTHOR("Jamal Hadi Salim(2002-13)");
    1811 MODULE_DESCRIPTION("Iptables target actions");
    1812 MODULE_LICENSE("GPL");
    1813 +MODULE_ALIAS("act_xt");
    1814
    1815 static int __init ipt_init_module(void)
    1816 {
    1817 - return tcf_register_action(&act_ipt_ops);
    1818 + int ret1, ret2;
    1819 + ret1 = tcf_register_action(&act_xt_ops);
    1820 + if (ret1 < 0)
    1821 + printk("Failed to load xt action\n");
    1822 + ret2 = tcf_register_action(&act_ipt_ops);
    1823 + if (ret2 < 0)
    1824 + printk("Failed to load ipt action\n");
    1825 +
    1826 + if (ret1 < 0 && ret2 < 0)
    1827 + return ret1;
    1828 + else
    1829 + return 0;
    1830 }
    1831
    1832 static void __exit ipt_cleanup_module(void)
    1833 {
    1834 + tcf_unregister_action(&act_xt_ops);
    1835 tcf_unregister_action(&act_ipt_ops);
    1836 }
    1837
    1838 diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
    1839 index c72dce0..c74a044 100644
    1840 --- a/sound/pci/hda/hda_codec.c
    1841 +++ b/sound/pci/hda/hda_codec.c
    1842 @@ -617,6 +617,9 @@ int snd_hda_queue_unsol_event(struct hda_bus *bus, u32 res, u32 res_ex)
    1843 struct hda_bus_unsolicited *unsol;
    1844 unsigned int wp;
    1845
    1846 + if (!bus || !bus->workq)
    1847 + return 0;
    1848 +
    1849 trace_hda_unsol_event(bus, res, res_ex);
    1850 unsol = bus->unsol;
    1851 if (!unsol)
    1852 diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
    1853 index 4c471a5..d9924d7 100644
    1854 --- a/sound/soc/codecs/wm8994.c
    1855 +++ b/sound/soc/codecs/wm8994.c
    1856 @@ -2824,6 +2824,7 @@ static int wm8994_aif3_hw_params(struct snd_pcm_substream *substream,
    1857 default:
    1858 return 0;
    1859 }
    1860 + break;
    1861 default:
    1862 return 0;
    1863 }