Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-lts/patches-3.4/0156-3.4.57-all-fixes.patch

    Contents of /trunk/kernel-lts/patches-3.4/0156-3.4.57-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2261 - (show annotations) (download)
    Mon Aug 19 09:25:41 2013 UTC (10 years, 8 months ago) by niro
    File size: 24669 byte(s) 
    -linux-3.4.57
    1 diff --git a/Makefile b/Makefile
    2 index 2fe1f6d..7f4df0c 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,6 +1,6 @@
    6 VERSION = 3
    7 PATCHLEVEL = 4
    8 -SUBLEVEL = 56
    9 +SUBLEVEL = 57
    10 EXTRAVERSION =
    11 NAME = Saber-toothed Squirrel
    12
    13 diff --git a/arch/x86/kernel/i387.c b/arch/x86/kernel/i387.c
    14 index 2d6e649..6610e81 100644
    15 --- a/arch/x86/kernel/i387.c
    16 +++ b/arch/x86/kernel/i387.c
    17 @@ -132,7 +132,7 @@ static void __cpuinit mxcsr_feature_mask_init(void)
    18 clts();
    19 if (cpu_has_fxsr) {
    20 memset(&fx_scratch, 0, sizeof(struct i387_fxsave_struct));
    21 - asm volatile("fxsave %0" : : "m" (fx_scratch));
    22 + asm volatile("fxsave %0" : "+m" (fx_scratch));
    23 mask = fx_scratch.mxcsr_mask;
    24 if (mask == 0)
    25 mask = 0x0000ffbf;
    26 diff --git a/drivers/acpi/battery.c b/drivers/acpi/battery.c
    27 index 6ea287e2..9bdfcf5 100644
    28 --- a/drivers/acpi/battery.c
    29 +++ b/drivers/acpi/battery.c
    30 @@ -117,6 +117,7 @@ struct acpi_battery {
    31 struct acpi_device *device;
    32 struct notifier_block pm_nb;
    33 unsigned long update_time;
    34 + int revision;
    35 int rate_now;
    36 int capacity_now;
    37 int voltage_now;
    38 @@ -350,6 +351,7 @@ static struct acpi_offsets info_offsets[] = {
    39 };
    40
    41 static struct acpi_offsets extended_info_offsets[] = {
    42 + {offsetof(struct acpi_battery, revision), 0},
    43 {offsetof(struct acpi_battery, power_unit), 0},
    44 {offsetof(struct acpi_battery, design_capacity), 0},
    45 {offsetof(struct acpi_battery, full_charge_capacity), 0},
    46 diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
    47 index 45c5cf8..232119a 100644
    48 --- a/drivers/gpu/drm/i915/i915_drv.h
    49 +++ b/drivers/gpu/drm/i915/i915_drv.h
    50 @@ -296,6 +296,7 @@ enum intel_pch {
    51
    52 #define QUIRK_PIPEA_FORCE (1<<0)
    53 #define QUIRK_LVDS_SSC_DISABLE (1<<1)
    54 +#define QUIRK_NO_PCH_PWM_ENABLE (1<<2)
    55
    56 struct intel_fbdev;
    57 struct intel_fbc_work;
    58 diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
    59 index 84867a8..0e35922 100644
    60 --- a/drivers/gpu/drm/i915/intel_display.c
    61 +++ b/drivers/gpu/drm/i915/intel_display.c
    62 @@ -9160,6 +9160,17 @@ static void quirk_ssc_force_disable(struct drm_device *dev)
    63 dev_priv->quirks |= QUIRK_LVDS_SSC_DISABLE;
    64 }
    65
    66 +/*
    67 + * Some machines (Dell XPS13) suffer broken backlight controls if
    68 + * BLM_PCH_PWM_ENABLE is set.
    69 + */
    70 +static void quirk_no_pcm_pwm_enable(struct drm_device *dev)
    71 +{
    72 + struct drm_i915_private *dev_priv = dev->dev_private;
    73 + dev_priv->quirks |= QUIRK_NO_PCH_PWM_ENABLE;
    74 + DRM_INFO("applying no-PCH_PWM_ENABLE quirk\n");
    75 +}
    76 +
    77 struct intel_quirk {
    78 int device;
    79 int subsystem_vendor;
    80 @@ -9192,6 +9203,11 @@ struct intel_quirk intel_quirks[] = {
    81
    82 /* Sony Vaio Y cannot use SSC on LVDS */
    83 { 0x0046, 0x104d, 0x9076, quirk_ssc_force_disable },
    84 +
    85 + /* Dell XPS13 HD Sandy Bridge */
    86 + { 0x0116, 0x1028, 0x052e, quirk_no_pcm_pwm_enable },
    87 + /* Dell XPS13 HD and XPS13 FHD Ivy Bridge */
    88 + { 0x0166, 0x1028, 0x058b, quirk_no_pcm_pwm_enable },
    89 };
    90
    91 static void intel_init_quirks(struct drm_device *dev)
    92 diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
    93 index 207180d..ab4d990 100644
    94 --- a/drivers/gpu/drm/i915/intel_lvds.c
    95 +++ b/drivers/gpu/drm/i915/intel_lvds.c
    96 @@ -1097,7 +1097,8 @@ bool intel_lvds_init(struct drm_device *dev)
    97 goto failed;
    98
    99 out:
    100 - if (HAS_PCH_SPLIT(dev)) {
    101 + if (HAS_PCH_SPLIT(dev) &&
    102 + !(dev_priv->quirks & QUIRK_NO_PCH_PWM_ENABLE)) {
    103 u32 pwm;
    104
    105 pipe = (I915_READ(PCH_LVDS) & LVDS_PIPEB_SELECT) ? 1 : 0;
    106 diff --git a/drivers/net/arcnet/arcnet.c b/drivers/net/arcnet/arcnet.c
    107 index a746ba2..a956053 100644
    108 --- a/drivers/net/arcnet/arcnet.c
    109 +++ b/drivers/net/arcnet/arcnet.c
    110 @@ -1007,7 +1007,7 @@ static void arcnet_rx(struct net_device *dev, int bufnum)
    111
    112 soft = &pkt.soft.rfc1201;
    113
    114 - lp->hw.copy_from_card(dev, bufnum, 0, &pkt, sizeof(ARC_HDR_SIZE));
    115 + lp->hw.copy_from_card(dev, bufnum, 0, &pkt, ARC_HDR_SIZE);
    116 if (pkt.hard.offset[0]) {
    117 ofs = pkt.hard.offset[0];
    118 length = 256 - ofs;
    119 diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c
    120 index d3695ed..a061e37 100644
    121 --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c
    122 +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_dcb_82598.c
    123 @@ -108,9 +108,8 @@ s32 ixgbe_dcb_config_tx_desc_arbiter_82598(struct ixgbe_hw *hw,
    124
    125 /* Enable arbiter */
    126 reg &= ~IXGBE_DPMCS_ARBDIS;
    127 - /* Enable DFP and Recycle mode */
    128 - reg |= (IXGBE_DPMCS_TDPAC | IXGBE_DPMCS_TRM);
    129 reg |= IXGBE_DPMCS_TSOEF;
    130 +
    131 /* Configure Max TSO packet size 34KB including payload and headers */
    132 reg |= (0x4 << IXGBE_DPMCS_MTSOS_SHIFT);
    133
    134 diff --git a/drivers/net/ethernet/realtek/8139cp.c b/drivers/net/ethernet/realtek/8139cp.c
    135 index 4ce981c..2205db7 100644
    136 --- a/drivers/net/ethernet/realtek/8139cp.c
    137 +++ b/drivers/net/ethernet/realtek/8139cp.c
    138 @@ -478,7 +478,7 @@ rx_status_loop:
    139
    140 while (1) {
    141 u32 status, len;
    142 - dma_addr_t mapping;
    143 + dma_addr_t mapping, new_mapping;
    144 struct sk_buff *skb, *new_skb;
    145 struct cp_desc *desc;
    146 const unsigned buflen = cp->rx_buf_sz;
    147 @@ -520,6 +520,13 @@ rx_status_loop:
    148 goto rx_next;
    149 }
    150
    151 + new_mapping = dma_map_single(&cp->pdev->dev, new_skb->data, buflen,
    152 + PCI_DMA_FROMDEVICE);
    153 + if (dma_mapping_error(&cp->pdev->dev, new_mapping)) {
    154 + dev->stats.rx_dropped++;
    155 + goto rx_next;
    156 + }
    157 +
    158 dma_unmap_single(&cp->pdev->dev, mapping,
    159 buflen, PCI_DMA_FROMDEVICE);
    160
    161 @@ -531,12 +538,11 @@ rx_status_loop:
    162
    163 skb_put(skb, len);
    164
    165 - mapping = dma_map_single(&cp->pdev->dev, new_skb->data, buflen,
    166 - PCI_DMA_FROMDEVICE);
    167 cp->rx_skb[rx_tail] = new_skb;
    168
    169 cp_rx_skb(cp, skb, desc);
    170 rx++;
    171 + mapping = new_mapping;
    172
    173 rx_next:
    174 cp->rx_ring[rx_tail].opts2 = 0;
    175 @@ -704,6 +710,22 @@ static inline u32 cp_tx_vlan_tag(struct sk_buff *skb)
    176 TxVlanTag | swab16(vlan_tx_tag_get(skb)) : 0x00;
    177 }
    178
    179 +static void unwind_tx_frag_mapping(struct cp_private *cp, struct sk_buff *skb,
    180 + int first, int entry_last)
    181 +{
    182 + int frag, index;
    183 + struct cp_desc *txd;
    184 + skb_frag_t *this_frag;
    185 + for (frag = 0; frag+first < entry_last; frag++) {
    186 + index = first+frag;
    187 + cp->tx_skb[index] = NULL;
    188 + txd = &cp->tx_ring[index];
    189 + this_frag = &skb_shinfo(skb)->frags[frag];
    190 + dma_unmap_single(&cp->pdev->dev, le64_to_cpu(txd->addr),
    191 + skb_frag_size(this_frag), PCI_DMA_TODEVICE);
    192 + }
    193 +}
    194 +
    195 static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
    196 struct net_device *dev)
    197 {
    198 @@ -737,6 +759,9 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
    199
    200 len = skb->len;
    201 mapping = dma_map_single(&cp->pdev->dev, skb->data, len, PCI_DMA_TODEVICE);
    202 + if (dma_mapping_error(&cp->pdev->dev, mapping))
    203 + goto out_dma_error;
    204 +
    205 txd->opts2 = opts2;
    206 txd->addr = cpu_to_le64(mapping);
    207 wmb();
    208 @@ -774,6 +799,9 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
    209 first_len = skb_headlen(skb);
    210 first_mapping = dma_map_single(&cp->pdev->dev, skb->data,
    211 first_len, PCI_DMA_TODEVICE);
    212 + if (dma_mapping_error(&cp->pdev->dev, first_mapping))
    213 + goto out_dma_error;
    214 +
    215 cp->tx_skb[entry] = skb;
    216 entry = NEXT_TX(entry);
    217
    218 @@ -787,6 +815,11 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
    219 mapping = dma_map_single(&cp->pdev->dev,
    220 skb_frag_address(this_frag),
    221 len, PCI_DMA_TODEVICE);
    222 + if (dma_mapping_error(&cp->pdev->dev, mapping)) {
    223 + unwind_tx_frag_mapping(cp, skb, first_entry, entry);
    224 + goto out_dma_error;
    225 + }
    226 +
    227 eor = (entry == (CP_TX_RING_SIZE - 1)) ? RingEnd : 0;
    228
    229 ctrl = eor | len | DescOwn;
    230 @@ -845,11 +878,16 @@ static netdev_tx_t cp_start_xmit (struct sk_buff *skb,
    231 if (TX_BUFFS_AVAIL(cp) <= (MAX_SKB_FRAGS + 1))
    232 netif_stop_queue(dev);
    233
    234 +out_unlock:
    235 spin_unlock_irqrestore(&cp->lock, intr_flags);
    236
    237 cpw8(TxPoll, NormalTxPoll);
    238
    239 return NETDEV_TX_OK;
    240 +out_dma_error:
    241 + kfree_skb(skb);
    242 + cp->dev->stats.tx_dropped++;
    243 + goto out_unlock;
    244 }
    245
    246 /* Set or clear the multicast filter for this adaptor.
    247 @@ -1020,6 +1058,10 @@ static int cp_refill_rx(struct cp_private *cp)
    248
    249 mapping = dma_map_single(&cp->pdev->dev, skb->data,
    250 cp->rx_buf_sz, PCI_DMA_FROMDEVICE);
    251 + if (dma_mapping_error(&cp->pdev->dev, mapping)) {
    252 + kfree_skb(skb);
    253 + goto err_out;
    254 + }
    255 cp->rx_skb[i] = skb;
    256
    257 cp->rx_ring[i].opts2 = 0;
    258 diff --git a/drivers/net/usb/smsc75xx.c b/drivers/net/usb/smsc75xx.c
    259 index 5caba55..d89747a 100644
    260 --- a/drivers/net/usb/smsc75xx.c
    261 +++ b/drivers/net/usb/smsc75xx.c
    262 @@ -43,7 +43,6 @@
    263 #define EEPROM_MAC_OFFSET (0x01)
    264 #define DEFAULT_TX_CSUM_ENABLE (true)
    265 #define DEFAULT_RX_CSUM_ENABLE (true)
    266 -#define DEFAULT_TSO_ENABLE (true)
    267 #define SMSC75XX_INTERNAL_PHY_ID (1)
    268 #define SMSC75XX_TX_OVERHEAD (8)
    269 #define MAX_RX_FIFO_SIZE (20 * 1024)
    270 @@ -1049,17 +1048,14 @@ static int smsc75xx_bind(struct usbnet *dev, struct usb_interface *intf)
    271
    272 INIT_WORK(&pdata->set_multicast, smsc75xx_deferred_multicast_write);
    273
    274 - if (DEFAULT_TX_CSUM_ENABLE) {
    275 + if (DEFAULT_TX_CSUM_ENABLE)
    276 dev->net->features |= NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM;
    277 - if (DEFAULT_TSO_ENABLE)
    278 - dev->net->features |= NETIF_F_SG |
    279 - NETIF_F_TSO | NETIF_F_TSO6;
    280 - }
    281 +
    282 if (DEFAULT_RX_CSUM_ENABLE)
    283 dev->net->features |= NETIF_F_RXCSUM;
    284
    285 dev->net->hw_features = NETIF_F_IP_CSUM | NETIF_F_IPV6_CSUM |
    286 - NETIF_F_SG | NETIF_F_TSO | NETIF_F_TSO6 | NETIF_F_RXCSUM;
    287 + NETIF_F_RXCSUM;
    288
    289 /* Init all registers */
    290 ret = smsc75xx_reset(dev);
    291 @@ -1184,8 +1180,6 @@ static struct sk_buff *smsc75xx_tx_fixup(struct usbnet *dev,
    292 {
    293 u32 tx_cmd_a, tx_cmd_b;
    294
    295 - skb_linearize(skb);
    296 -
    297 if (skb_headroom(skb) < SMSC75XX_TX_OVERHEAD) {
    298 struct sk_buff *skb2 =
    299 skb_copy_expand(skb, SMSC75XX_TX_OVERHEAD, 0, flags);
    300 diff --git a/drivers/net/wireless/ath/ath9k/htc_drv_init.c b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
    301 index 41c5237..2b8406a 100644
    302 --- a/drivers/net/wireless/ath/ath9k/htc_drv_init.c
    303 +++ b/drivers/net/wireless/ath/ath9k/htc_drv_init.c
    304 @@ -821,6 +821,7 @@ static int ath9k_init_device(struct ath9k_htc_priv *priv,
    305 if (error != 0)
    306 goto err_rx;
    307
    308 + ath9k_hw_disable(priv->ah);
    309 #ifdef CONFIG_MAC80211_LEDS
    310 /* must be initialized before ieee80211_register_hw */
    311 priv->led_cdev.default_trigger = ieee80211_create_tpt_led_trigger(priv->hw,
    312 diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
    313 index 7d00a87..4be8ccc 100644
    314 --- a/drivers/net/wireless/mwifiex/sdio.c
    315 +++ b/drivers/net/wireless/mwifiex/sdio.c
    316 @@ -1449,8 +1449,8 @@ static int mwifiex_sdio_host_to_card(struct mwifiex_adapter *adapter,
    317 /* Allocate buffer and copy payload */
    318 blk_size = MWIFIEX_SDIO_BLOCK_SIZE;
    319 buf_block_len = (pkt_len + blk_size - 1) / blk_size;
    320 - *(u16 *) &payload[0] = (u16) pkt_len;
    321 - *(u16 *) &payload[2] = type;
    322 + *(__le16 *)&payload[0] = cpu_to_le16((u16)pkt_len);
    323 + *(__le16 *)&payload[2] = cpu_to_le16(type);
    324
    325 /*
    326 * This is SDIO specific header
    327 diff --git a/drivers/net/wireless/rt2x00/rt2x00queue.c b/drivers/net/wireless/rt2x00/rt2x00queue.c
    328 index 50f92d5..4d792a2 100644
    329 --- a/drivers/net/wireless/rt2x00/rt2x00queue.c
    330 +++ b/drivers/net/wireless/rt2x00/rt2x00queue.c
    331 @@ -856,13 +856,8 @@ void rt2x00queue_index_inc(struct queue_entry *entry, enum queue_index index)
    332 spin_unlock_irqrestore(&queue->index_lock, irqflags);
    333 }
    334
    335 -void rt2x00queue_pause_queue(struct data_queue *queue)
    336 +void rt2x00queue_pause_queue_nocheck(struct data_queue *queue)
    337 {
    338 - if (!test_bit(DEVICE_STATE_PRESENT, &queue->rt2x00dev->flags) ||
    339 - !test_bit(QUEUE_STARTED, &queue->flags) ||
    340 - test_and_set_bit(QUEUE_PAUSED, &queue->flags))
    341 - return;
    342 -
    343 switch (queue->qid) {
    344 case QID_AC_VO:
    345 case QID_AC_VI:
    346 @@ -878,6 +873,15 @@ void rt2x00queue_pause_queue(struct data_queue *queue)
    347 break;
    348 }
    349 }
    350 +void rt2x00queue_pause_queue(struct data_queue *queue)
    351 +{
    352 + if (!test_bit(DEVICE_STATE_PRESENT, &queue->rt2x00dev->flags) ||
    353 + !test_bit(QUEUE_STARTED, &queue->flags) ||
    354 + test_and_set_bit(QUEUE_PAUSED, &queue->flags))
    355 + return;
    356 +
    357 + rt2x00queue_pause_queue_nocheck(queue);
    358 +}
    359 EXPORT_SYMBOL_GPL(rt2x00queue_pause_queue);
    360
    361 void rt2x00queue_unpause_queue(struct data_queue *queue)
    362 @@ -939,7 +943,7 @@ void rt2x00queue_stop_queue(struct data_queue *queue)
    363 return;
    364 }
    365
    366 - rt2x00queue_pause_queue(queue);
    367 + rt2x00queue_pause_queue_nocheck(queue);
    368
    369 queue->rt2x00dev->ops->lib->stop_queue(queue);
    370
    371 diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c
    372 index 039c054..c75b27b 100644
    373 --- a/drivers/tty/serial/mxs-auart.c
    374 +++ b/drivers/tty/serial/mxs-auart.c
    375 @@ -375,11 +375,18 @@ static void mxs_auart_settermios(struct uart_port *u,
    376
    377 static irqreturn_t mxs_auart_irq_handle(int irq, void *context)
    378 {
    379 - u32 istatus, istat;
    380 + u32 istat;
    381 struct mxs_auart_port *s = context;
    382 u32 stat = readl(s->port.membase + AUART_STAT);
    383
    384 - istatus = istat = readl(s->port.membase + AUART_INTR);
    385 + istat = readl(s->port.membase + AUART_INTR);
    386 +
    387 + /* ack irq */
    388 + writel(istat & (AUART_INTR_RTIS
    389 + | AUART_INTR_TXIS
    390 + | AUART_INTR_RXIS
    391 + | AUART_INTR_CTSMIS),
    392 + s->port.membase + AUART_INTR_CLR);
    393
    394 if (istat & AUART_INTR_CTSMIS) {
    395 uart_handle_cts_change(&s->port, stat & AUART_STAT_CTS);
    396 @@ -398,12 +405,6 @@ static irqreturn_t mxs_auart_irq_handle(int irq, void *context)
    397 istat &= ~AUART_INTR_TXIS;
    398 }
    399
    400 - writel(istatus & (AUART_INTR_RTIS
    401 - | AUART_INTR_TXIS
    402 - | AUART_INTR_RXIS
    403 - | AUART_INTR_CTSMIS),
    404 - s->port.membase + AUART_INTR_CLR);
    405 -
    406 return IRQ_HANDLED;
    407 }
    408
    409 @@ -543,7 +544,7 @@ auart_console_write(struct console *co, const char *str, unsigned int count)
    410 struct mxs_auart_port *s;
    411 struct uart_port *port;
    412 unsigned int old_ctrl0, old_ctrl2;
    413 - unsigned int to = 1000;
    414 + unsigned int to = 20000;
    415
    416 if (co->index > MXS_AUART_PORTS || co->index < 0)
    417 return;
    418 @@ -564,18 +565,23 @@ auart_console_write(struct console *co, const char *str, unsigned int count)
    419
    420 uart_console_write(port, str, count, mxs_auart_console_putchar);
    421
    422 - /*
    423 - * Finally, wait for transmitter to become empty
    424 - * and restore the TCR
    425 - */
    426 + /* Finally, wait for transmitter to become empty ... */
    427 while (readl(port->membase + AUART_STAT) & AUART_STAT_BUSY) {
    428 + udelay(1);
    429 if (!to--)
    430 break;
    431 - udelay(1);
    432 }
    433
    434 - writel(old_ctrl0, port->membase + AUART_CTRL0);
    435 - writel(old_ctrl2, port->membase + AUART_CTRL2);
    436 + /*
    437 + * ... and restore the TCR if we waited long enough for the transmitter
    438 + * to be idle. This might keep the transmitter enabled although it is
    439 + * unused, but that is better than to disable it while it is still
    440 + * transmitting.
    441 + */
    442 + if (!(readl(port->membase + AUART_STAT) & AUART_STAT_BUSY)) {
    443 + writel(old_ctrl0, port->membase + AUART_CTRL0);
    444 + writel(old_ctrl2, port->membase + AUART_CTRL2);
    445 + }
    446
    447 clk_disable(s->clk);
    448 }
    449 diff --git a/fs/notify/fanotify/fanotify_user.c b/fs/notify/fanotify/fanotify_user.c
    450 index 3568c8a..48bc91d 100644
    451 --- a/fs/notify/fanotify/fanotify_user.c
    452 +++ b/fs/notify/fanotify/fanotify_user.c
    453 @@ -120,6 +120,7 @@ static int fill_event_metadata(struct fsnotify_group *group,
    454 metadata->event_len = FAN_EVENT_METADATA_LEN;
    455 metadata->metadata_len = FAN_EVENT_METADATA_LEN;
    456 metadata->vers = FANOTIFY_METADATA_VERSION;
    457 + metadata->reserved = 0;
    458 metadata->mask = event->mask & FAN_ALL_OUTGOING_EVENTS;
    459 metadata->pid = pid_vnr(event->tgid);
    460 if (unlikely(event->mask & FAN_Q_OVERFLOW))
    461 diff --git a/kernel/events/core.c b/kernel/events/core.c
    462 index d074cf0..8e810ba 100644
    463 --- a/kernel/events/core.c
    464 +++ b/kernel/events/core.c
    465 @@ -250,9 +250,9 @@ perf_cgroup_match(struct perf_event *event)
    466 return !event->cgrp || event->cgrp == cpuctx->cgrp;
    467 }
    468
    469 -static inline void perf_get_cgroup(struct perf_event *event)
    470 +static inline bool perf_tryget_cgroup(struct perf_event *event)
    471 {
    472 - css_get(&event->cgrp->css);
    473 + return css_tryget(&event->cgrp->css);
    474 }
    475
    476 static inline void perf_put_cgroup(struct perf_event *event)
    477 @@ -481,7 +481,11 @@ static inline int perf_cgroup_connect(int fd, struct perf_event *event,
    478 event->cgrp = cgrp;
    479
    480 /* must be done before we fput() the file */
    481 - perf_get_cgroup(event);
    482 + if (!perf_tryget_cgroup(event)) {
    483 + event->cgrp = NULL;
    484 + ret = -ENOENT;
    485 + goto out;
    486 + }
    487
    488 /*
    489 * all events in a group must monitor
    490 @@ -911,6 +915,15 @@ list_add_event(struct perf_event *event, struct perf_event_context *ctx)
    491 }
    492
    493 /*
    494 + * Initialize event state based on the perf_event_attr::disabled.
    495 + */
    496 +static inline void perf_event__state_init(struct perf_event *event)
    497 +{
    498 + event->state = event->attr.disabled ? PERF_EVENT_STATE_OFF :
    499 + PERF_EVENT_STATE_INACTIVE;
    500 +}
    501 +
    502 +/*
    503 * Called at perf_event creation and when events are attached/detached from a
    504 * group.
    505 */
    506 @@ -6058,8 +6071,7 @@ perf_event_alloc(struct perf_event_attr *attr, int cpu,
    507 event->overflow_handler = overflow_handler;
    508 event->overflow_handler_context = context;
    509
    510 - if (attr->disabled)
    511 - event->state = PERF_EVENT_STATE_OFF;
    512 + perf_event__state_init(event);
    513
    514 pmu = NULL;
    515
    516 @@ -6481,9 +6493,17 @@ SYSCALL_DEFINE5(perf_event_open,
    517
    518 mutex_lock(&gctx->mutex);
    519 perf_remove_from_context(group_leader);
    520 +
    521 + /*
    522 + * Removing from the context ends up with disabled
    523 + * event. What we want here is event in the initial
    524 + * startup state, ready to be add into new context.
    525 + */
    526 + perf_event__state_init(group_leader);
    527 list_for_each_entry(sibling, &group_leader->sibling_list,
    528 group_entry) {
    529 perf_remove_from_context(sibling);
    530 + perf_event__state_init(sibling);
    531 put_ctx(gctx);
    532 }
    533 mutex_unlock(&gctx->mutex);
    534 diff --git a/kernel/sched/fair.c b/kernel/sched/fair.c
    535 index e955364..da4512f 100644
    536 --- a/kernel/sched/fair.c
    537 +++ b/kernel/sched/fair.c
    538 @@ -5511,7 +5511,7 @@ static unsigned int get_rr_interval_fair(struct rq *rq, struct task_struct *task
    539 * idle runqueue:
    540 */
    541 if (rq->cfs.load.weight)
    542 - rr_interval = NS_TO_JIFFIES(sched_slice(&rq->cfs, se));
    543 + rr_interval = NS_TO_JIFFIES(sched_slice(cfs_rq_of(se), se));
    544
    545 return rr_interval;
    546 }
    547 diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
    548 index bf7a604..086c973 100644
    549 --- a/net/ipv4/sysctl_net_ipv4.c
    550 +++ b/net/ipv4/sysctl_net_ipv4.c
    551 @@ -34,6 +34,8 @@ static int tcp_adv_win_scale_min = -31;
    552 static int tcp_adv_win_scale_max = 31;
    553 static int ip_ttl_min = 1;
    554 static int ip_ttl_max = 255;
    555 +static int tcp_syn_retries_min = 1;
    556 +static int tcp_syn_retries_max = MAX_TCP_SYNCNT;
    557 static int ip_ping_group_range_min[] = { 0, 0 };
    558 static int ip_ping_group_range_max[] = { GID_T_MAX, GID_T_MAX };
    559
    560 @@ -276,7 +278,9 @@ static struct ctl_table ipv4_table[] = {
    561 .data = &sysctl_tcp_syn_retries,
    562 .maxlen = sizeof(int),
    563 .mode = 0644,
    564 - .proc_handler = proc_dointvec
    565 + .proc_handler = proc_dointvec_minmax,
    566 + .extra1 = &tcp_syn_retries_min,
    567 + .extra2 = &tcp_syn_retries_max
    568 },
    569 {
    570 .procname = "tcp_synack_retries",
    571 diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
    572 index 8110362..d5e4615 100644
    573 --- a/net/ipv6/ip6mr.c
    574 +++ b/net/ipv6/ip6mr.c
    575 @@ -256,10 +256,12 @@ static void __net_exit ip6mr_rules_exit(struct net *net)
    576 {
    577 struct mr6_table *mrt, *next;
    578
    579 + rtnl_lock();
    580 list_for_each_entry_safe(mrt, next, &net->ipv6.mr6_tables, list) {
    581 list_del(&mrt->list);
    582 ip6mr_free_table(mrt);
    583 }
    584 + rtnl_unlock();
    585 fib_rules_unregister(net->ipv6.mr6_rules_ops);
    586 }
    587 #else
    588 @@ -286,7 +288,10 @@ static int __net_init ip6mr_rules_init(struct net *net)
    589
    590 static void __net_exit ip6mr_rules_exit(struct net *net)
    591 {
    592 + rtnl_lock();
    593 ip6mr_free_table(net->ipv6.mrt6);
    594 + net->ipv6.mrt6 = NULL;
    595 + rtnl_unlock();
    596 }
    597 #endif
    598
    599 diff --git a/net/key/af_key.c b/net/key/af_key.c
    600 index 5bbab6a..60109f4 100644
    601 --- a/net/key/af_key.c
    602 +++ b/net/key/af_key.c
    603 @@ -2073,6 +2073,7 @@ static int pfkey_xfrm_policy2msg(struct sk_buff *skb, const struct xfrm_policy *
    604 pol->sadb_x_policy_type = IPSEC_POLICY_NONE;
    605 }
    606 pol->sadb_x_policy_dir = dir+1;
    607 + pol->sadb_x_policy_reserved = 0;
    608 pol->sadb_x_policy_id = xp->index;
    609 pol->sadb_x_policy_priority = xp->priority;
    610
    611 @@ -3108,7 +3109,9 @@ static int pfkey_send_acquire(struct xfrm_state *x, struct xfrm_tmpl *t, struct
    612 pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
    613 pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
    614 pol->sadb_x_policy_dir = dir+1;
    615 + pol->sadb_x_policy_reserved = 0;
    616 pol->sadb_x_policy_id = xp->index;
    617 + pol->sadb_x_policy_priority = xp->priority;
    618
    619 /* Set sadb_comb's. */
    620 if (x->id.proto == IPPROTO_AH)
    621 @@ -3496,6 +3499,7 @@ static int pfkey_send_migrate(const struct xfrm_selector *sel, u8 dir, u8 type,
    622 pol->sadb_x_policy_exttype = SADB_X_EXT_POLICY;
    623 pol->sadb_x_policy_type = IPSEC_POLICY_IPSEC;
    624 pol->sadb_x_policy_dir = dir + 1;
    625 + pol->sadb_x_policy_reserved = 0;
    626 pol->sadb_x_policy_id = 0;
    627 pol->sadb_x_policy_priority = 0;
    628
    629 diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c
    630 index 8ce9feb..067aa2a 100644
    631 --- a/net/mac80211/rx.c
    632 +++ b/net/mac80211/rx.c
    633 @@ -831,8 +831,14 @@ ieee80211_rx_h_check(struct ieee80211_rx_data *rx)
    634 struct ieee80211_hdr *hdr = (struct ieee80211_hdr *)rx->skb->data;
    635 struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(rx->skb);
    636
    637 - /* Drop duplicate 802.11 retransmissions (IEEE 802.11 Chap. 9.2.9) */
    638 - if (rx->sta && !is_multicast_ether_addr(hdr->addr1)) {
    639 + /*
    640 + * Drop duplicate 802.11 retransmissions
    641 + * (IEEE 802.11-2012: 9.3.2.10 "Duplicate detection and recovery")
    642 + */
    643 + if (rx->skb->len >= 24 && rx->sta &&
    644 + !ieee80211_is_ctl(hdr->frame_control) &&
    645 + !ieee80211_is_qos_nullfunc(hdr->frame_control) &&
    646 + !is_multicast_ether_addr(hdr->addr1)) {
    647 if (unlikely(ieee80211_has_retry(hdr->frame_control) &&
    648 rx->sta->last_seq_ctrl[rx->seqno_idx] ==
    649 hdr->seq_ctrl)) {
    650 diff --git a/net/sched/sch_atm.c b/net/sched/sch_atm.c
    651 index e25e490..6e38ef0 100644
    652 --- a/net/sched/sch_atm.c
    653 +++ b/net/sched/sch_atm.c
    654 @@ -606,6 +606,7 @@ static int atm_tc_dump_class(struct Qdisc *sch, unsigned long cl,
    655 struct sockaddr_atmpvc pvc;
    656 int state;
    657
    658 + memset(&pvc, 0, sizeof(pvc));
    659 pvc.sap_family = AF_ATMPVC;
    660 pvc.sap_addr.itf = flow->vcc->dev ? flow->vcc->dev->number : -1;
    661 pvc.sap_addr.vpi = flow->vcc->vpi;
    662 diff --git a/net/sched/sch_cbq.c b/net/sched/sch_cbq.c
    663 index b7cddb9..7f59944 100644
    664 --- a/net/sched/sch_cbq.c
    665 +++ b/net/sched/sch_cbq.c
    666 @@ -1467,6 +1467,7 @@ static int cbq_dump_wrr(struct sk_buff *skb, struct cbq_class *cl)
    667 unsigned char *b = skb_tail_pointer(skb);
    668 struct tc_cbq_wrropt opt;
    669
    670 + memset(&opt, 0, sizeof(opt));
    671 opt.flags = 0;
    672 opt.allot = cl->allot;
    673 opt.priority = cl->priority + 1;
    674 diff --git a/net/sctp/outqueue.c b/net/sctp/outqueue.c
    675 index 96eb168..3dd7207 100644
    676 --- a/net/sctp/outqueue.c
    677 +++ b/net/sctp/outqueue.c
    678 @@ -205,6 +205,8 @@ static inline int sctp_cacc_skip(struct sctp_transport *primary,
    679 */
    680 void sctp_outq_init(struct sctp_association *asoc, struct sctp_outq *q)
    681 {
    682 + memset(q, 0, sizeof(struct sctp_outq));
    683 +
    684 q->asoc = asoc;
    685 INIT_LIST_HEAD(&q->out_chunk_list);
    686 INIT_LIST_HEAD(&q->control_chunk_list);
    687 @@ -212,13 +214,7 @@ void sctp_outq_init(struct sctp_association *asoc, struct sctp_outq *q)
    688 INIT_LIST_HEAD(&q->sacked);
    689 INIT_LIST_HEAD(&q->abandoned);
    690
    691 - q->fast_rtx = 0;
    692 - q->outstanding_bytes = 0;
    693 q->empty = 1;
    694 - q->cork = 0;
    695 -
    696 - q->malloced = 0;
    697 - q->out_qlen = 0;
    698 }
    699
    700 /* Free the outqueue structure and any related pending chunks.
    701 diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
    702 index f432c57..add9f94 100644
    703 --- a/net/wireless/nl80211.c
    704 +++ b/net/wireless/nl80211.c
    705 @@ -5081,12 +5081,14 @@ EXPORT_SYMBOL(cfg80211_testmode_alloc_event_skb);
    706
    707 void cfg80211_testmode_event(struct sk_buff *skb, gfp_t gfp)
    708 {
    709 + struct cfg80211_registered_device *rdev = ((void **)skb->cb)[0];
    710 void *hdr = ((void **)skb->cb)[1];
    711 struct nlattr *data = ((void **)skb->cb)[2];
    712
    713 nla_nest_end(skb, data);
    714 genlmsg_end(skb, hdr);
    715 - genlmsg_multicast(skb, 0, nl80211_testmode_mcgrp.id, gfp);
    716 + genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), skb, 0,
    717 + nl80211_testmode_mcgrp.id, gfp);
    718 }
    719 EXPORT_SYMBOL(cfg80211_testmode_event);
    720 #endif
    721 @@ -7768,7 +7770,8 @@ void nl80211_send_mgmt_tx_status(struct cfg80211_registered_device *rdev,
    722
    723 genlmsg_end(msg, hdr);
    724
    725 - genlmsg_multicast(msg, 0, nl80211_mlme_mcgrp.id, gfp);
    726 + genlmsg_multicast_netns(wiphy_net(&rdev->wiphy), msg, 0,
    727 + nl80211_mlme_mcgrp.id, gfp);
    728 return;
    729
    730 nla_put_failure:
    731 diff --git a/sound/core/compress_offload.c b/sound/core/compress_offload.c
    732 index a58cf35..84717ce 100644
    733 --- a/sound/core/compress_offload.c
    734 +++ b/sound/core/compress_offload.c
    735 @@ -582,7 +582,7 @@ static long snd_compr_ioctl(struct file *f, unsigned int cmd, unsigned long arg)
    736 mutex_lock(&stream->device->lock);
    737 switch (_IOC_NR(cmd)) {
    738 case _IOC_NR(SNDRV_COMPRESS_IOCTL_VERSION):
    739 - put_user(SNDRV_COMPRESS_VERSION,
    740 + retval = put_user(SNDRV_COMPRESS_VERSION,
    741 (int __user *)arg) ? -EFAULT : 0;
    742 break;
    743 case _IOC_NR(SNDRV_COMPRESS_GET_CAPS):