Contents of /trunk/kernel-lts/patches-3.4/0162-3.4.63-all-fixes.patch
Parent Directory | Revision Log
Revision 2304 -
(show annotations)
(download)
Mon Oct 14 07:15:18 2013 UTC (10 years, 11 months ago) by niro
File size: 35329 byte(s)
Mon Oct 14 07:15:18 2013 UTC (10 years, 11 months ago) by niro
File size: 35329 byte(s)
-linux-3.4.63
1 | diff --git a/arch/arm/mach-versatile/pci.c b/arch/arm/mach-versatile/pci.c |
2 | index d2268be8..709beb1d 100644 |
3 | --- a/arch/arm/mach-versatile/pci.c |
4 | +++ b/arch/arm/mach-versatile/pci.c |
5 | @@ -42,9 +42,9 @@ |
6 | #define PCI_IMAP0 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x0) |
7 | #define PCI_IMAP1 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x4) |
8 | #define PCI_IMAP2 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x8) |
9 | -#define PCI_SMAP0 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x10) |
10 | -#define PCI_SMAP1 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x14) |
11 | -#define PCI_SMAP2 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x18) |
12 | +#define PCI_SMAP0 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x14) |
13 | +#define PCI_SMAP1 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x18) |
14 | +#define PCI_SMAP2 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x1c) |
15 | #define PCI_SELFID __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0xc) |
16 | |
17 | #define DEVICE_ID_OFFSET 0x00 |
18 | diff --git a/arch/mips/ath79/clock.c b/arch/mips/ath79/clock.c |
19 | index 54d0eb4db..89276a2f 100644 |
20 | --- a/arch/mips/ath79/clock.c |
21 | +++ b/arch/mips/ath79/clock.c |
22 | @@ -159,7 +159,7 @@ static void __init ar933x_clocks_init(void) |
23 | ath79_ahb_clk.rate = freq / t; |
24 | } |
25 | |
26 | - ath79_wdt_clk.rate = ath79_ref_clk.rate; |
27 | + ath79_wdt_clk.rate = ath79_ahb_clk.rate; |
28 | ath79_uart_clk.rate = ath79_ref_clk.rate; |
29 | } |
30 | |
31 | diff --git a/arch/powerpc/kernel/align.c b/arch/powerpc/kernel/align.c |
32 | index ee5b690a..52e5758e 100644 |
33 | --- a/arch/powerpc/kernel/align.c |
34 | +++ b/arch/powerpc/kernel/align.c |
35 | @@ -764,6 +764,16 @@ int fix_alignment(struct pt_regs *regs) |
36 | nb = aligninfo[instr].len; |
37 | flags = aligninfo[instr].flags; |
38 | |
39 | + /* ldbrx/stdbrx overlap lfs/stfs in the DSISR unfortunately */ |
40 | + if (IS_XFORM(instruction) && ((instruction >> 1) & 0x3ff) == 532) { |
41 | + nb = 8; |
42 | + flags = LD+SW; |
43 | + } else if (IS_XFORM(instruction) && |
44 | + ((instruction >> 1) & 0x3ff) == 660) { |
45 | + nb = 8; |
46 | + flags = ST+SW; |
47 | + } |
48 | + |
49 | /* Byteswap little endian loads and stores */ |
50 | swiz = 0; |
51 | if (regs->msr & MSR_LE) { |
52 | diff --git a/crypto/api.c b/crypto/api.c |
53 | index 033a7147..4f98dd5b 100644 |
54 | --- a/crypto/api.c |
55 | +++ b/crypto/api.c |
56 | @@ -40,6 +40,8 @@ static inline struct crypto_alg *crypto_alg_get(struct crypto_alg *alg) |
57 | return alg; |
58 | } |
59 | |
60 | +static struct crypto_alg *crypto_larval_wait(struct crypto_alg *alg); |
61 | + |
62 | struct crypto_alg *crypto_mod_get(struct crypto_alg *alg) |
63 | { |
64 | return try_module_get(alg->cra_module) ? crypto_alg_get(alg) : NULL; |
65 | @@ -150,8 +152,11 @@ static struct crypto_alg *crypto_larval_add(const char *name, u32 type, |
66 | } |
67 | up_write(&crypto_alg_sem); |
68 | |
69 | - if (alg != &larval->alg) |
70 | + if (alg != &larval->alg) { |
71 | kfree(larval); |
72 | + if (crypto_is_larval(alg)) |
73 | + alg = crypto_larval_wait(alg); |
74 | + } |
75 | |
76 | return alg; |
77 | } |
78 | diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c |
79 | index 8b77fd31..efe172f3 100644 |
80 | --- a/drivers/gpu/drm/drm_edid.c |
81 | +++ b/drivers/gpu/drm/drm_edid.c |
82 | @@ -125,6 +125,9 @@ static struct edid_quirk { |
83 | |
84 | /* ViewSonic VA2026w */ |
85 | { "VSC", 5020, EDID_QUIRK_FORCE_REDUCED_BLANKING }, |
86 | + |
87 | + /* Medion MD 30217 PG */ |
88 | + { "MED", 0x7b8, EDID_QUIRK_PREFER_LARGE_75 }, |
89 | }; |
90 | |
91 | /*** DDC fetch and block validation ***/ |
92 | diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c |
93 | index ff73d60c..ab59fdf0 100644 |
94 | --- a/drivers/hid/hid-core.c |
95 | +++ b/drivers/hid/hid-core.c |
96 | @@ -63,6 +63,8 @@ struct hid_report *hid_register_report(struct hid_device *device, unsigned type, |
97 | struct hid_report_enum *report_enum = device->report_enum + type; |
98 | struct hid_report *report; |
99 | |
100 | + if (id >= HID_MAX_IDS) |
101 | + return NULL; |
102 | if (report_enum->report_id_hash[id]) |
103 | return report_enum->report_id_hash[id]; |
104 | |
105 | @@ -385,8 +387,10 @@ static int hid_parser_global(struct hid_parser *parser, struct hid_item *item) |
106 | |
107 | case HID_GLOBAL_ITEM_TAG_REPORT_ID: |
108 | parser->global.report_id = item_udata(item); |
109 | - if (parser->global.report_id == 0) { |
110 | - hid_err(parser->device, "report_id 0 is invalid\n"); |
111 | + if (parser->global.report_id == 0 || |
112 | + parser->global.report_id >= HID_MAX_IDS) { |
113 | + hid_err(parser->device, "report_id %u is invalid\n", |
114 | + parser->global.report_id); |
115 | return -1; |
116 | } |
117 | return 0; |
118 | @@ -557,7 +561,7 @@ static void hid_device_release(struct device *dev) |
119 | for (i = 0; i < HID_REPORT_TYPES; i++) { |
120 | struct hid_report_enum *report_enum = device->report_enum + i; |
121 | |
122 | - for (j = 0; j < 256; j++) { |
123 | + for (j = 0; j < HID_MAX_IDS; j++) { |
124 | struct hid_report *report = report_enum->report_id_hash[j]; |
125 | if (report) |
126 | hid_free_report(report); |
127 | @@ -995,7 +999,12 @@ EXPORT_SYMBOL_GPL(hid_output_report); |
128 | |
129 | int hid_set_field(struct hid_field *field, unsigned offset, __s32 value) |
130 | { |
131 | - unsigned size = field->report_size; |
132 | + unsigned size; |
133 | + |
134 | + if (!field) |
135 | + return -1; |
136 | + |
137 | + size = field->report_size; |
138 | |
139 | hid_dump_input(field->report->device, field->usage + offset, value); |
140 | |
141 | diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h |
142 | index 14d22399..8cc08e23 100644 |
143 | --- a/drivers/hid/hid-ids.h |
144 | +++ b/drivers/hid/hid-ids.h |
145 | @@ -595,6 +595,7 @@ |
146 | #define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_16 0x0012 |
147 | #define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_17 0x0013 |
148 | #define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_18 0x0014 |
149 | +#define USB_DEVICE_ID_NTRIG_DUOSENSE 0x1500 |
150 | |
151 | #define USB_VENDOR_ID_ONTRAK 0x0a07 |
152 | #define USB_DEVICE_ID_ONTRAK_ADU100 0x0064 |
153 | diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c |
154 | index 21e473e7..f03c684e 100644 |
155 | --- a/drivers/hid/hid-input.c |
156 | +++ b/drivers/hid/hid-input.c |
157 | @@ -314,7 +314,7 @@ static int hidinput_get_battery_property(struct power_supply *psy, |
158 | { |
159 | struct hid_device *dev = container_of(psy, struct hid_device, battery); |
160 | int ret = 0; |
161 | - __u8 buf[2] = {}; |
162 | + __u8 *buf; |
163 | |
164 | switch (prop) { |
165 | case POWER_SUPPLY_PROP_PRESENT: |
166 | @@ -323,13 +323,20 @@ static int hidinput_get_battery_property(struct power_supply *psy, |
167 | break; |
168 | |
169 | case POWER_SUPPLY_PROP_CAPACITY: |
170 | + |
171 | + buf = kmalloc(2 * sizeof(__u8), GFP_KERNEL); |
172 | + if (!buf) { |
173 | + ret = -ENOMEM; |
174 | + break; |
175 | + } |
176 | ret = dev->hid_get_raw_report(dev, dev->battery_report_id, |
177 | - buf, sizeof(buf), |
178 | + buf, 2, |
179 | dev->battery_report_type); |
180 | |
181 | if (ret != 2) { |
182 | if (ret >= 0) |
183 | ret = -EINVAL; |
184 | + kfree(buf); |
185 | break; |
186 | } |
187 | |
188 | @@ -338,6 +345,7 @@ static int hidinput_get_battery_property(struct power_supply *psy, |
189 | buf[1] <= dev->battery_max) |
190 | val->intval = (100 * (buf[1] - dev->battery_min)) / |
191 | (dev->battery_max - dev->battery_min); |
192 | + kfree(buf); |
193 | break; |
194 | |
195 | case POWER_SUPPLY_PROP_MODEL_NAME: |
196 | diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c |
197 | index 9fae2ebd..48cba857 100644 |
198 | --- a/drivers/hid/hid-ntrig.c |
199 | +++ b/drivers/hid/hid-ntrig.c |
200 | @@ -115,7 +115,8 @@ static inline int ntrig_get_mode(struct hid_device *hdev) |
201 | struct hid_report *report = hdev->report_enum[HID_FEATURE_REPORT]. |
202 | report_id_hash[0x0d]; |
203 | |
204 | - if (!report) |
205 | + if (!report || report->maxfield < 1 || |
206 | + report->field[0]->report_count < 1) |
207 | return -EINVAL; |
208 | |
209 | usbhid_submit_report(hdev, report, USB_DIR_IN); |
210 | diff --git a/drivers/hid/hid-pl.c b/drivers/hid/hid-pl.c |
211 | index 47ed74c4..00cd2f8b 100644 |
212 | --- a/drivers/hid/hid-pl.c |
213 | +++ b/drivers/hid/hid-pl.c |
214 | @@ -129,8 +129,14 @@ static int plff_init(struct hid_device *hid) |
215 | strong = &report->field[0]->value[2]; |
216 | weak = &report->field[0]->value[3]; |
217 | debug("detected single-field device"); |
218 | - } else if (report->maxfield >= 4 && report->field[0]->maxusage == 1 && |
219 | - report->field[0]->usage[0].hid == (HID_UP_LED | 0x43)) { |
220 | + } else if (report->field[0]->maxusage == 1 && |
221 | + report->field[0]->usage[0].hid == |
222 | + (HID_UP_LED | 0x43) && |
223 | + report->maxfield >= 4 && |
224 | + report->field[0]->report_count >= 1 && |
225 | + report->field[1]->report_count >= 1 && |
226 | + report->field[2]->report_count >= 1 && |
227 | + report->field[3]->report_count >= 1) { |
228 | report->field[0]->value[0] = 0x00; |
229 | report->field[1]->value[0] = 0x00; |
230 | strong = &report->field[2]->value[0]; |
231 | diff --git a/drivers/hid/hid-speedlink.c b/drivers/hid/hid-speedlink.c |
232 | index 60201374..2b03c9ba 100644 |
233 | --- a/drivers/hid/hid-speedlink.c |
234 | +++ b/drivers/hid/hid-speedlink.c |
235 | @@ -3,7 +3,7 @@ |
236 | * Fixes "jumpy" cursor and removes nonexistent keyboard LEDS from |
237 | * the HID descriptor. |
238 | * |
239 | - * Copyright (c) 2011 Stefan Kriwanek <mail@stefankriwanek.de> |
240 | + * Copyright (c) 2011, 2013 Stefan Kriwanek <dev@stefankriwanek.de> |
241 | */ |
242 | |
243 | /* |
244 | @@ -48,8 +48,13 @@ static int speedlink_event(struct hid_device *hdev, struct hid_field *field, |
245 | struct hid_usage *usage, __s32 value) |
246 | { |
247 | /* No other conditions due to usage_table. */ |
248 | - /* Fix "jumpy" cursor (invalid events sent by device). */ |
249 | - if (value == 256) |
250 | + |
251 | + /* This fixes the "jumpy" cursor occuring due to invalid events sent |
252 | + * by the device. Some devices only send them with value==+256, others |
253 | + * don't. However, catching abs(value)>=256 is restrictive enough not |
254 | + * to interfere with devices that were bug-free (has been tested). |
255 | + */ |
256 | + if (abs(value) >= 256) |
257 | return 1; |
258 | /* Drop useless distance 0 events (on button clicks etc.) as well */ |
259 | if (value == 0) |
260 | diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c |
261 | index 5c4112e6..d712294b 100644 |
262 | --- a/drivers/hid/usbhid/hid-quirks.c |
263 | +++ b/drivers/hid/usbhid/hid-quirks.c |
264 | @@ -103,6 +103,8 @@ static const struct hid_blacklist { |
265 | { USB_VENDOR_ID_SIGMA_MICRO, USB_DEVICE_ID_SIGMA_MICRO_KEYBOARD, HID_QUIRK_NO_INIT_REPORTS }, |
266 | { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X, HID_QUIRK_MULTI_INPUT }, |
267 | { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X, HID_QUIRK_MULTI_INPUT }, |
268 | + { USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_DUOSENSE, HID_QUIRK_NO_INIT_REPORTS }, |
269 | + |
270 | { 0, 0 } |
271 | }; |
272 | |
273 | diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c |
274 | index 17119247..a60a54d8 100644 |
275 | --- a/drivers/iommu/intel-iommu.c |
276 | +++ b/drivers/iommu/intel-iommu.c |
277 | @@ -886,56 +886,54 @@ static int dma_pte_clear_range(struct dmar_domain *domain, |
278 | return order; |
279 | } |
280 | |
281 | +static void dma_pte_free_level(struct dmar_domain *domain, int level, |
282 | + struct dma_pte *pte, unsigned long pfn, |
283 | + unsigned long start_pfn, unsigned long last_pfn) |
284 | +{ |
285 | + pfn = max(start_pfn, pfn); |
286 | + pte = &pte[pfn_level_offset(pfn, level)]; |
287 | + |
288 | + do { |
289 | + unsigned long level_pfn; |
290 | + struct dma_pte *level_pte; |
291 | + |
292 | + if (!dma_pte_present(pte) || dma_pte_superpage(pte)) |
293 | + goto next; |
294 | + |
295 | + level_pfn = pfn & level_mask(level - 1); |
296 | + level_pte = phys_to_virt(dma_pte_addr(pte)); |
297 | + |
298 | + if (level > 2) |
299 | + dma_pte_free_level(domain, level - 1, level_pte, |
300 | + level_pfn, start_pfn, last_pfn); |
301 | + |
302 | + /* If range covers entire pagetable, free it */ |
303 | + if (!(start_pfn > level_pfn || |
304 | + last_pfn < level_pfn + level_size(level))) { |
305 | + dma_clear_pte(pte); |
306 | + domain_flush_cache(domain, pte, sizeof(*pte)); |
307 | + free_pgtable_page(level_pte); |
308 | + } |
309 | +next: |
310 | + pfn += level_size(level); |
311 | + } while (!first_pte_in_page(++pte) && pfn <= last_pfn); |
312 | +} |
313 | + |
314 | /* free page table pages. last level pte should already be cleared */ |
315 | static void dma_pte_free_pagetable(struct dmar_domain *domain, |
316 | unsigned long start_pfn, |
317 | unsigned long last_pfn) |
318 | { |
319 | int addr_width = agaw_to_width(domain->agaw) - VTD_PAGE_SHIFT; |
320 | - struct dma_pte *first_pte, *pte; |
321 | - int total = agaw_to_level(domain->agaw); |
322 | - int level; |
323 | - unsigned long tmp; |
324 | - int large_page = 2; |
325 | |
326 | BUG_ON(addr_width < BITS_PER_LONG && start_pfn >> addr_width); |
327 | BUG_ON(addr_width < BITS_PER_LONG && last_pfn >> addr_width); |
328 | BUG_ON(start_pfn > last_pfn); |
329 | |
330 | /* We don't need lock here; nobody else touches the iova range */ |
331 | - level = 2; |
332 | - while (level <= total) { |
333 | - tmp = align_to_level(start_pfn, level); |
334 | - |
335 | - /* If we can't even clear one PTE at this level, we're done */ |
336 | - if (tmp + level_size(level) - 1 > last_pfn) |
337 | - return; |
338 | - |
339 | - do { |
340 | - large_page = level; |
341 | - first_pte = pte = dma_pfn_level_pte(domain, tmp, level, &large_page); |
342 | - if (large_page > level) |
343 | - level = large_page + 1; |
344 | - if (!pte) { |
345 | - tmp = align_to_level(tmp + 1, level + 1); |
346 | - continue; |
347 | - } |
348 | - do { |
349 | - if (dma_pte_present(pte)) { |
350 | - free_pgtable_page(phys_to_virt(dma_pte_addr(pte))); |
351 | - dma_clear_pte(pte); |
352 | - } |
353 | - pte++; |
354 | - tmp += level_size(level); |
355 | - } while (!first_pte_in_page(pte) && |
356 | - tmp + level_size(level) - 1 <= last_pfn); |
357 | + dma_pte_free_level(domain, agaw_to_level(domain->agaw), |
358 | + domain->pgd, 0, start_pfn, last_pfn); |
359 | |
360 | - domain_flush_cache(domain, first_pte, |
361 | - (void *)pte - (void *)first_pte); |
362 | - |
363 | - } while (tmp && tmp + level_size(level) - 1 <= last_pfn); |
364 | - level++; |
365 | - } |
366 | /* free pgd */ |
367 | if (start_pfn == 0 && last_pfn == DOMAIN_MAX_PFN(domain->gaw)) { |
368 | free_pgtable_page(domain->pgd); |
369 | diff --git a/drivers/mmc/host/tmio_mmc_dma.c b/drivers/mmc/host/tmio_mmc_dma.c |
370 | index fff92860..491e9ecc 100644 |
371 | --- a/drivers/mmc/host/tmio_mmc_dma.c |
372 | +++ b/drivers/mmc/host/tmio_mmc_dma.c |
373 | @@ -104,6 +104,7 @@ static void tmio_mmc_start_dma_rx(struct tmio_mmc_host *host) |
374 | pio: |
375 | if (!desc) { |
376 | /* DMA failed, fall back to PIO */ |
377 | + tmio_mmc_enable_dma(host, false); |
378 | if (ret >= 0) |
379 | ret = -EIO; |
380 | host->chan_rx = NULL; |
381 | @@ -116,7 +117,6 @@ pio: |
382 | } |
383 | dev_warn(&host->pdev->dev, |
384 | "DMA failed: %d, falling back to PIO\n", ret); |
385 | - tmio_mmc_enable_dma(host, false); |
386 | } |
387 | |
388 | dev_dbg(&host->pdev->dev, "%s(): desc %p, cookie %d, sg[%d]\n", __func__, |
389 | @@ -185,6 +185,7 @@ static void tmio_mmc_start_dma_tx(struct tmio_mmc_host *host) |
390 | pio: |
391 | if (!desc) { |
392 | /* DMA failed, fall back to PIO */ |
393 | + tmio_mmc_enable_dma(host, false); |
394 | if (ret >= 0) |
395 | ret = -EIO; |
396 | host->chan_tx = NULL; |
397 | @@ -197,7 +198,6 @@ pio: |
398 | } |
399 | dev_warn(&host->pdev->dev, |
400 | "DMA failed: %d, falling back to PIO\n", ret); |
401 | - tmio_mmc_enable_dma(host, false); |
402 | } |
403 | |
404 | dev_dbg(&host->pdev->dev, "%s(): desc %p, cookie %d\n", __func__, |
405 | diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c |
406 | index f86ee0c7..503ff9f6 100644 |
407 | --- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c |
408 | +++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c |
409 | @@ -1030,6 +1030,10 @@ static bool ar9003_hw_ani_control(struct ath_hw *ah, |
410 | * is_on == 0 means MRC CCK is OFF (more noise imm) |
411 | */ |
412 | bool is_on = param ? 1 : 0; |
413 | + |
414 | + if (ah->caps.rx_chainmask == 1) |
415 | + break; |
416 | + |
417 | REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL, |
418 | AR_PHY_MRC_CCK_ENABLE, is_on); |
419 | REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL, |
420 | diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h |
421 | index 4bfb44a0..e2ab182d 100644 |
422 | --- a/drivers/net/wireless/ath/ath9k/ath9k.h |
423 | +++ b/drivers/net/wireless/ath/ath9k/ath9k.h |
424 | @@ -78,10 +78,6 @@ struct ath_config { |
425 | sizeof(struct ath_buf_state)); \ |
426 | } while (0) |
427 | |
428 | -#define ATH_RXBUF_RESET(_bf) do { \ |
429 | - (_bf)->bf_stale = false; \ |
430 | - } while (0) |
431 | - |
432 | /** |
433 | * enum buffer_type - Buffer type flags |
434 | * |
435 | @@ -314,6 +310,7 @@ struct ath_rx { |
436 | struct ath_buf *rx_bufptr; |
437 | struct ath_rx_edma rx_edma[ATH9K_RX_QUEUE_MAX]; |
438 | |
439 | + struct ath_buf *buf_hold; |
440 | struct sk_buff *frag; |
441 | }; |
442 | |
443 | diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c |
444 | index 039bac7e..2e6583d3 100644 |
445 | --- a/drivers/net/wireless/ath/ath9k/recv.c |
446 | +++ b/drivers/net/wireless/ath/ath9k/recv.c |
447 | @@ -78,8 +78,6 @@ static void ath_rx_buf_link(struct ath_softc *sc, struct ath_buf *bf) |
448 | struct ath_desc *ds; |
449 | struct sk_buff *skb; |
450 | |
451 | - ATH_RXBUF_RESET(bf); |
452 | - |
453 | ds = bf->bf_desc; |
454 | ds->ds_link = 0; /* link to null */ |
455 | ds->ds_data = bf->bf_buf_addr; |
456 | @@ -106,6 +104,14 @@ static void ath_rx_buf_link(struct ath_softc *sc, struct ath_buf *bf) |
457 | sc->rx.rxlink = &ds->ds_link; |
458 | } |
459 | |
460 | +static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_buf *bf) |
461 | +{ |
462 | + if (sc->rx.buf_hold) |
463 | + ath_rx_buf_link(sc, sc->rx.buf_hold); |
464 | + |
465 | + sc->rx.buf_hold = bf; |
466 | +} |
467 | + |
468 | static void ath_setdefantenna(struct ath_softc *sc, u32 antenna) |
469 | { |
470 | /* XXX block beacon interrupts */ |
471 | @@ -153,7 +159,6 @@ static bool ath_rx_edma_buf_link(struct ath_softc *sc, |
472 | |
473 | skb = bf->bf_mpdu; |
474 | |
475 | - ATH_RXBUF_RESET(bf); |
476 | memset(skb->data, 0, ah->caps.rx_status_len); |
477 | dma_sync_single_for_device(sc->dev, bf->bf_buf_addr, |
478 | ah->caps.rx_status_len, DMA_TO_DEVICE); |
479 | @@ -485,6 +490,7 @@ int ath_startrecv(struct ath_softc *sc) |
480 | if (list_empty(&sc->rx.rxbuf)) |
481 | goto start_recv; |
482 | |
483 | + sc->rx.buf_hold = NULL; |
484 | sc->rx.rxlink = NULL; |
485 | list_for_each_entry_safe(bf, tbf, &sc->rx.rxbuf, list) { |
486 | ath_rx_buf_link(sc, bf); |
487 | @@ -734,6 +740,9 @@ static struct ath_buf *ath_get_next_rx_buf(struct ath_softc *sc, |
488 | } |
489 | |
490 | bf = list_first_entry(&sc->rx.rxbuf, struct ath_buf, list); |
491 | + if (bf == sc->rx.buf_hold) |
492 | + return NULL; |
493 | + |
494 | ds = bf->bf_desc; |
495 | |
496 | /* |
497 | @@ -1974,7 +1983,7 @@ requeue: |
498 | if (edma) { |
499 | ath_rx_edma_buf_link(sc, qtype); |
500 | } else { |
501 | - ath_rx_buf_link(sc, bf); |
502 | + ath_rx_buf_relink(sc, bf); |
503 | ath9k_hw_rxena(ah); |
504 | } |
505 | } while (1); |
506 | diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c |
507 | index 12a42f2c..3d0aa472 100644 |
508 | --- a/drivers/net/wireless/ath/ath9k/xmit.c |
509 | +++ b/drivers/net/wireless/ath/ath9k/xmit.c |
510 | @@ -2479,6 +2479,7 @@ void ath_tx_node_init(struct ath_softc *sc, struct ath_node *an) |
511 | for (acno = 0, ac = &an->ac[acno]; |
512 | acno < WME_NUM_AC; acno++, ac++) { |
513 | ac->sched = false; |
514 | + ac->clear_ps_filter = true; |
515 | ac->txq = sc->tx.txq_map[acno]; |
516 | INIT_LIST_HEAD(&ac->tid_q); |
517 | } |
518 | diff --git a/drivers/net/wireless/brcm80211/brcmsmac/dma.c b/drivers/net/wireless/brcm80211/brcmsmac/dma.c |
519 | index 11054ae9..9a184058 100644 |
520 | --- a/drivers/net/wireless/brcm80211/brcmsmac/dma.c |
521 | +++ b/drivers/net/wireless/brcm80211/brcmsmac/dma.c |
522 | @@ -1013,9 +1013,10 @@ static bool dma64_rxidle(struct dma_info *di) |
523 | |
524 | /* |
525 | * post receive buffers |
526 | - * return false is refill failed completely and ring is empty this will stall |
527 | - * the rx dma and user might want to call rxfill again asap. This unlikely |
528 | - * happens on memory-rich NIC, but often on memory-constrained dongle |
529 | + * Return false if refill failed completely or dma mapping failed. The ring |
530 | + * is empty, which will stall the rx dma and user might want to call rxfill |
531 | + * again asap. This is unlikely to happen on a memory-rich NIC, but often on |
532 | + * memory-constrained dongle. |
533 | */ |
534 | bool dma_rxfill(struct dma_pub *pub) |
535 | { |
536 | @@ -1074,6 +1075,8 @@ bool dma_rxfill(struct dma_pub *pub) |
537 | |
538 | pa = dma_map_single(di->dmadev, p->data, di->rxbufsize, |
539 | DMA_FROM_DEVICE); |
540 | + if (dma_mapping_error(di->dmadev, pa)) |
541 | + return false; |
542 | |
543 | /* save the free packet pointer */ |
544 | di->rxp[rxout] = p; |
545 | @@ -1294,7 +1297,11 @@ int dma_txfast(struct dma_pub *pub, struct sk_buff *p, bool commit) |
546 | |
547 | /* get physical address of buffer start */ |
548 | pa = dma_map_single(di->dmadev, data, len, DMA_TO_DEVICE); |
549 | - |
550 | + /* if mapping failed, free skb */ |
551 | + if (dma_mapping_error(di->dmadev, pa)) { |
552 | + brcmu_pkt_buf_free_skb(p); |
553 | + return; |
554 | + } |
555 | /* With a DMA segment list, Descriptor table is filled |
556 | * using the segment list instead of looping over |
557 | * buffers in multi-chain DMA. Therefore, EOF for SGLIST |
558 | diff --git a/drivers/of/base.c b/drivers/of/base.c |
559 | index 58064498..1c207f23 100644 |
560 | --- a/drivers/of/base.c |
561 | +++ b/drivers/of/base.c |
562 | @@ -1227,6 +1227,7 @@ void of_alias_scan(void * (*dt_alloc)(u64 size, u64 align)) |
563 | ap = dt_alloc(sizeof(*ap) + len + 1, 4); |
564 | if (!ap) |
565 | continue; |
566 | + memset(ap, 0, sizeof(*ap) + len + 1); |
567 | ap->alias = start; |
568 | of_alias_add(ap, np, id, start, len); |
569 | } |
570 | diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c |
571 | index 105fff2e..05973a49 100644 |
572 | --- a/drivers/scsi/sd.c |
573 | +++ b/drivers/scsi/sd.c |
574 | @@ -2225,14 +2225,9 @@ sd_read_cache_type(struct scsi_disk *sdkp, unsigned char *buffer) |
575 | } |
576 | } |
577 | |
578 | - if (modepage == 0x3F) { |
579 | - sd_printk(KERN_ERR, sdkp, "No Caching mode page " |
580 | - "present\n"); |
581 | - goto defaults; |
582 | - } else if ((buffer[offset] & 0x3f) != modepage) { |
583 | - sd_printk(KERN_ERR, sdkp, "Got wrong page\n"); |
584 | - goto defaults; |
585 | - } |
586 | + sd_printk(KERN_ERR, sdkp, "No Caching mode page found\n"); |
587 | + goto defaults; |
588 | + |
589 | Page_found: |
590 | if (modepage == 8) { |
591 | sdkp->WCE = ((buffer[offset + 2] & 0x04) != 0); |
592 | diff --git a/drivers/staging/comedi/drivers/dt282x.c b/drivers/staging/comedi/drivers/dt282x.c |
593 | index 95ebc267..e3adb382 100644 |
594 | --- a/drivers/staging/comedi/drivers/dt282x.c |
595 | +++ b/drivers/staging/comedi/drivers/dt282x.c |
596 | @@ -407,8 +407,9 @@ struct dt282x_private { |
597 | } \ |
598 | udelay(5); \ |
599 | } \ |
600 | - if (_i) \ |
601 | + if (_i) { \ |
602 | b \ |
603 | + } \ |
604 | } while (0) |
605 | |
606 | static int dt282x_attach(struct comedi_device *dev, |
607 | diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c |
608 | index 9dd51f7f..1434ee9e 100644 |
609 | --- a/drivers/usb/class/cdc-wdm.c |
610 | +++ b/drivers/usb/class/cdc-wdm.c |
611 | @@ -233,6 +233,7 @@ skip_error: |
612 | static void wdm_int_callback(struct urb *urb) |
613 | { |
614 | int rv = 0; |
615 | + int responding; |
616 | int status = urb->status; |
617 | struct wdm_device *desc; |
618 | struct usb_cdc_notification *dr; |
619 | @@ -286,8 +287,8 @@ static void wdm_int_callback(struct urb *urb) |
620 | |
621 | spin_lock(&desc->iuspin); |
622 | clear_bit(WDM_READ, &desc->flags); |
623 | - set_bit(WDM_RESPONDING, &desc->flags); |
624 | - if (!test_bit(WDM_DISCONNECTING, &desc->flags) |
625 | + responding = test_and_set_bit(WDM_RESPONDING, &desc->flags); |
626 | + if (!responding && !test_bit(WDM_DISCONNECTING, &desc->flags) |
627 | && !test_bit(WDM_SUSPENDING, &desc->flags)) { |
628 | rv = usb_submit_urb(desc->response, GFP_ATOMIC); |
629 | dev_dbg(&desc->intf->dev, "%s: usb_submit_urb %d", |
630 | @@ -687,16 +688,20 @@ static void wdm_rxwork(struct work_struct *work) |
631 | { |
632 | struct wdm_device *desc = container_of(work, struct wdm_device, rxwork); |
633 | unsigned long flags; |
634 | - int rv; |
635 | + int rv = 0; |
636 | + int responding; |
637 | |
638 | spin_lock_irqsave(&desc->iuspin, flags); |
639 | if (test_bit(WDM_DISCONNECTING, &desc->flags)) { |
640 | spin_unlock_irqrestore(&desc->iuspin, flags); |
641 | } else { |
642 | + responding = test_and_set_bit(WDM_RESPONDING, &desc->flags); |
643 | spin_unlock_irqrestore(&desc->iuspin, flags); |
644 | - rv = usb_submit_urb(desc->response, GFP_KERNEL); |
645 | + if (!responding) |
646 | + rv = usb_submit_urb(desc->response, GFP_KERNEL); |
647 | if (rv < 0 && rv != -EPERM) { |
648 | spin_lock_irqsave(&desc->iuspin, flags); |
649 | + clear_bit(WDM_RESPONDING, &desc->flags); |
650 | if (!test_bit(WDM_DISCONNECTING, &desc->flags)) |
651 | schedule_work(&desc->rxwork); |
652 | spin_unlock_irqrestore(&desc->iuspin, flags); |
653 | diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c |
654 | index f4bdd0ce..78609d30 100644 |
655 | --- a/drivers/usb/core/config.c |
656 | +++ b/drivers/usb/core/config.c |
657 | @@ -424,7 +424,8 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx, |
658 | |
659 | memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE); |
660 | if (config->desc.bDescriptorType != USB_DT_CONFIG || |
661 | - config->desc.bLength < USB_DT_CONFIG_SIZE) { |
662 | + config->desc.bLength < USB_DT_CONFIG_SIZE || |
663 | + config->desc.bLength > size) { |
664 | dev_err(ddev, "invalid descriptor for config index %d: " |
665 | "type = 0x%X, length = %d\n", cfgidx, |
666 | config->desc.bDescriptorType, config->desc.bLength); |
667 | diff --git a/drivers/usb/host/ehci-mxc.c b/drivers/usb/host/ehci-mxc.c |
668 | index a797d51e..77477ca5 100644 |
669 | --- a/drivers/usb/host/ehci-mxc.c |
670 | +++ b/drivers/usb/host/ehci-mxc.c |
671 | @@ -298,7 +298,7 @@ static int __exit ehci_mxc_drv_remove(struct platform_device *pdev) |
672 | if (pdata && pdata->exit) |
673 | pdata->exit(pdev); |
674 | |
675 | - if (pdata->otg) |
676 | + if (pdata && pdata->otg) |
677 | usb_phy_shutdown(pdata->otg); |
678 | |
679 | usb_remove_hcd(hcd); |
680 | diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c |
681 | index 93ad67ec..6e70ce97 100644 |
682 | --- a/drivers/usb/host/xhci-plat.c |
683 | +++ b/drivers/usb/host/xhci-plat.c |
684 | @@ -24,7 +24,7 @@ static void xhci_plat_quirks(struct device *dev, struct xhci_hcd *xhci) |
685 | * here that the generic code does not try to make a pci_dev from our |
686 | * dev struct in order to setup MSI |
687 | */ |
688 | - xhci->quirks |= XHCI_BROKEN_MSI; |
689 | + xhci->quirks |= XHCI_PLAT; |
690 | } |
691 | |
692 | /* called during probe() after chip reset completes */ |
693 | diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c |
694 | index 8072a932..1504946c 100644 |
695 | --- a/drivers/usb/host/xhci.c |
696 | +++ b/drivers/usb/host/xhci.c |
697 | @@ -342,9 +342,14 @@ static void xhci_msix_sync_irqs(struct xhci_hcd *xhci) |
698 | static int xhci_try_enable_msi(struct usb_hcd *hcd) |
699 | { |
700 | struct xhci_hcd *xhci = hcd_to_xhci(hcd); |
701 | - struct pci_dev *pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller); |
702 | + struct pci_dev *pdev; |
703 | int ret; |
704 | |
705 | + /* The xhci platform device has set up IRQs through usb_add_hcd. */ |
706 | + if (xhci->quirks & XHCI_PLAT) |
707 | + return 0; |
708 | + |
709 | + pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller); |
710 | /* |
711 | * Some Fresco Logic host controllers advertise MSI, but fail to |
712 | * generate interrupts. Don't even try to enable MSI. |
713 | @@ -3496,10 +3501,21 @@ void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev) |
714 | { |
715 | struct xhci_hcd *xhci = hcd_to_xhci(hcd); |
716 | struct xhci_virt_device *virt_dev; |
717 | + struct device *dev = hcd->self.controller; |
718 | unsigned long flags; |
719 | u32 state; |
720 | int i, ret; |
721 | |
722 | +#ifndef CONFIG_USB_DEFAULT_PERSIST |
723 | + /* |
724 | + * We called pm_runtime_get_noresume when the device was attached. |
725 | + * Decrement the counter here to allow controller to runtime suspend |
726 | + * if no devices remain. |
727 | + */ |
728 | + if (xhci->quirks & XHCI_RESET_ON_RESUME) |
729 | + pm_runtime_put_noidle(dev); |
730 | +#endif |
731 | + |
732 | ret = xhci_check_args(hcd, udev, NULL, 0, true, __func__); |
733 | /* If the host is halted due to driver unload, we still need to free the |
734 | * device. |
735 | @@ -3571,6 +3587,7 @@ static int xhci_reserve_host_control_ep_resources(struct xhci_hcd *xhci) |
736 | int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev) |
737 | { |
738 | struct xhci_hcd *xhci = hcd_to_xhci(hcd); |
739 | + struct device *dev = hcd->self.controller; |
740 | unsigned long flags; |
741 | int timeleft; |
742 | int ret; |
743 | @@ -3623,6 +3640,16 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev) |
744 | goto disable_slot; |
745 | } |
746 | udev->slot_id = xhci->slot_id; |
747 | + |
748 | +#ifndef CONFIG_USB_DEFAULT_PERSIST |
749 | + /* |
750 | + * If resetting upon resume, we can't put the controller into runtime |
751 | + * suspend if there is a device attached. |
752 | + */ |
753 | + if (xhci->quirks & XHCI_RESET_ON_RESUME) |
754 | + pm_runtime_get_noresume(dev); |
755 | +#endif |
756 | + |
757 | /* Is this a LS or FS device under a HS hub? */ |
758 | /* Hub or peripherial? */ |
759 | return 1; |
760 | diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h |
761 | index 15aaf58c..a54a408c 100644 |
762 | --- a/drivers/usb/host/xhci.h |
763 | +++ b/drivers/usb/host/xhci.h |
764 | @@ -1508,6 +1508,7 @@ struct xhci_hcd { |
765 | #define XHCI_SPURIOUS_REBOOT (1 << 13) |
766 | #define XHCI_COMP_MODE_QUIRK (1 << 14) |
767 | #define XHCI_AVOID_BEI (1 << 15) |
768 | +#define XHCI_PLAT (1 << 16) |
769 | unsigned int num_active_eps; |
770 | unsigned int limit_active_eps; |
771 | /* There are two roothubs to keep track of bus suspend info for */ |
772 | diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c |
773 | index cdde45de..4491830b 100644 |
774 | --- a/drivers/usb/serial/mos7720.c |
775 | +++ b/drivers/usb/serial/mos7720.c |
776 | @@ -383,7 +383,7 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport, |
777 | kfree(urbtrack); |
778 | return -ENOMEM; |
779 | } |
780 | - urbtrack->setup = kmalloc(sizeof(*urbtrack->setup), GFP_KERNEL); |
781 | + urbtrack->setup = kmalloc(sizeof(*urbtrack->setup), GFP_ATOMIC); |
782 | if (!urbtrack->setup) { |
783 | usb_free_urb(urbtrack->urb); |
784 | kfree(urbtrack); |
785 | @@ -391,8 +391,8 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport, |
786 | } |
787 | urbtrack->setup->bRequestType = (__u8)0x40; |
788 | urbtrack->setup->bRequest = (__u8)0x0e; |
789 | - urbtrack->setup->wValue = get_reg_value(reg, dummy); |
790 | - urbtrack->setup->wIndex = get_reg_index(reg); |
791 | + urbtrack->setup->wValue = cpu_to_le16(get_reg_value(reg, dummy)); |
792 | + urbtrack->setup->wIndex = cpu_to_le16(get_reg_index(reg)); |
793 | urbtrack->setup->wLength = 0; |
794 | usb_fill_control_urb(urbtrack->urb, usbdev, |
795 | usb_sndctrlpipe(usbdev, 0), |
796 | diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c |
797 | index 7e34beed..3275bde6 100644 |
798 | --- a/drivers/xen/grant-table.c |
799 | +++ b/drivers/xen/grant-table.c |
800 | @@ -641,9 +641,18 @@ void gnttab_request_free_callback(struct gnttab_free_callback *callback, |
801 | void (*fn)(void *), void *arg, u16 count) |
802 | { |
803 | unsigned long flags; |
804 | + struct gnttab_free_callback *cb; |
805 | + |
806 | spin_lock_irqsave(&gnttab_list_lock, flags); |
807 | - if (callback->next) |
808 | - goto out; |
809 | + |
810 | + /* Check if the callback is already on the list */ |
811 | + cb = gnttab_free_callback_list; |
812 | + while (cb) { |
813 | + if (cb == callback) |
814 | + goto out; |
815 | + cb = cb->next; |
816 | + } |
817 | + |
818 | callback->fn = fn; |
819 | callback->arg = arg; |
820 | callback->count = count; |
821 | diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c |
822 | index e7fe81d3..4ac06b08 100644 |
823 | --- a/fs/cifs/connect.c |
824 | +++ b/fs/cifs/connect.c |
825 | @@ -362,6 +362,7 @@ cifs_reconnect(struct TCP_Server_Info *server) |
826 | try_to_freeze(); |
827 | |
828 | /* we should try only the port we connected to before */ |
829 | + mutex_lock(&server->srv_mutex); |
830 | rc = generic_ip_connect(server); |
831 | if (rc) { |
832 | cFYI(1, "reconnect error %d", rc); |
833 | @@ -373,6 +374,7 @@ cifs_reconnect(struct TCP_Server_Info *server) |
834 | server->tcpStatus = CifsNeedNegotiate; |
835 | spin_unlock(&GlobalMid_Lock); |
836 | } |
837 | + mutex_unlock(&server->srv_mutex); |
838 | } while (server->tcpStatus == CifsNeedReconnect); |
839 | |
840 | return rc; |
841 | diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c |
842 | index d48478a8..373b2514 100644 |
843 | --- a/fs/fuse/dir.c |
844 | +++ b/fs/fuse/dir.c |
845 | @@ -1503,6 +1503,8 @@ static int fuse_setxattr(struct dentry *entry, const char *name, |
846 | fc->no_setxattr = 1; |
847 | err = -EOPNOTSUPP; |
848 | } |
849 | + if (!err) |
850 | + fuse_invalidate_attr(inode); |
851 | return err; |
852 | } |
853 | |
854 | @@ -1632,6 +1634,8 @@ static int fuse_removexattr(struct dentry *entry, const char *name) |
855 | fc->no_removexattr = 1; |
856 | err = -EOPNOTSUPP; |
857 | } |
858 | + if (!err) |
859 | + fuse_invalidate_attr(inode); |
860 | return err; |
861 | } |
862 | |
863 | diff --git a/fs/fuse/file.c b/fs/fuse/file.c |
864 | index 8e6381a1..df25454e 100644 |
865 | --- a/fs/fuse/file.c |
866 | +++ b/fs/fuse/file.c |
867 | @@ -1294,7 +1294,6 @@ static int fuse_writepage_locked(struct page *page) |
868 | |
869 | inc_bdi_stat(mapping->backing_dev_info, BDI_WRITEBACK); |
870 | inc_zone_page_state(tmp_page, NR_WRITEBACK_TEMP); |
871 | - end_page_writeback(page); |
872 | |
873 | spin_lock(&fc->lock); |
874 | list_add(&req->writepages_entry, &fi->writepages); |
875 | @@ -1302,6 +1301,8 @@ static int fuse_writepage_locked(struct page *page) |
876 | fuse_flush_writepages(inode); |
877 | spin_unlock(&fc->lock); |
878 | |
879 | + end_page_writeback(page); |
880 | + |
881 | return 0; |
882 | |
883 | err_free: |
884 | diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c |
885 | index 29037c36..e92a342f 100644 |
886 | --- a/fs/isofs/inode.c |
887 | +++ b/fs/isofs/inode.c |
888 | @@ -119,8 +119,8 @@ static void destroy_inodecache(void) |
889 | |
890 | static int isofs_remount(struct super_block *sb, int *flags, char *data) |
891 | { |
892 | - /* we probably want a lot more here */ |
893 | - *flags |= MS_RDONLY; |
894 | + if (!(*flags & MS_RDONLY)) |
895 | + return -EROFS; |
896 | return 0; |
897 | } |
898 | |
899 | @@ -769,15 +769,6 @@ root_found: |
900 | */ |
901 | s->s_maxbytes = 0x80000000000LL; |
902 | |
903 | - /* |
904 | - * The CDROM is read-only, has no nodes (devices) on it, and since |
905 | - * all of the files appear to be owned by root, we really do not want |
906 | - * to allow suid. (suid or devices will not show up unless we have |
907 | - * Rock Ridge extensions) |
908 | - */ |
909 | - |
910 | - s->s_flags |= MS_RDONLY /* | MS_NODEV | MS_NOSUID */; |
911 | - |
912 | /* Set this for reference. Its not currently used except on write |
913 | which we don't have .. */ |
914 | |
915 | @@ -1536,6 +1527,9 @@ struct inode *isofs_iget(struct super_block *sb, |
916 | static struct dentry *isofs_mount(struct file_system_type *fs_type, |
917 | int flags, const char *dev_name, void *data) |
918 | { |
919 | + /* We don't support read-write mounts */ |
920 | + if (!(flags & MS_RDONLY)) |
921 | + return ERR_PTR(-EACCES); |
922 | return mount_bdev(fs_type, flags, dev_name, data, isofs_fill_super); |
923 | } |
924 | |
925 | diff --git a/fs/ocfs2/extent_map.c b/fs/ocfs2/extent_map.c |
926 | index 7eb1c0c7..cf228479 100644 |
927 | --- a/fs/ocfs2/extent_map.c |
928 | +++ b/fs/ocfs2/extent_map.c |
929 | @@ -782,7 +782,6 @@ int ocfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo, |
930 | cpos = map_start >> osb->s_clustersize_bits; |
931 | mapping_end = ocfs2_clusters_for_bytes(inode->i_sb, |
932 | map_start + map_len); |
933 | - mapping_end -= cpos; |
934 | is_last = 0; |
935 | while (cpos < mapping_end && !is_last) { |
936 | u32 fe_flags; |
937 | diff --git a/include/linux/hid.h b/include/linux/hid.h |
938 | index 3a95da60..8c933a86 100644 |
939 | --- a/include/linux/hid.h |
940 | +++ b/include/linux/hid.h |
941 | @@ -420,10 +420,12 @@ struct hid_report { |
942 | struct hid_device *device; /* associated device */ |
943 | }; |
944 | |
945 | +#define HID_MAX_IDS 256 |
946 | + |
947 | struct hid_report_enum { |
948 | unsigned numbered; |
949 | struct list_head report_list; |
950 | - struct hid_report *report_id_hash[256]; |
951 | + struct hid_report *report_id_hash[HID_MAX_IDS]; |
952 | }; |
953 | |
954 | #define HID_REPORT_TYPES 3 |
955 | diff --git a/include/linux/rculist.h b/include/linux/rculist.h |
956 | index 6f95e241..38633526 100644 |
957 | --- a/include/linux/rculist.h |
958 | +++ b/include/linux/rculist.h |
959 | @@ -254,8 +254,9 @@ static inline void list_splice_init_rcu(struct list_head *list, |
960 | */ |
961 | #define list_first_or_null_rcu(ptr, type, member) \ |
962 | ({struct list_head *__ptr = (ptr); \ |
963 | - struct list_head __rcu *__next = list_next_rcu(__ptr); \ |
964 | - likely(__ptr != __next) ? container_of(__next, type, member) : NULL; \ |
965 | + struct list_head *__next = ACCESS_ONCE(__ptr->next); \ |
966 | + likely(__ptr != __next) ? \ |
967 | + list_entry_rcu(__next, type, member) : NULL; \ |
968 | }) |
969 | |
970 | /** |
971 | diff --git a/include/media/v4l2-ctrls.h b/include/media/v4l2-ctrls.h |
972 | index 11e67562..ab45ea5b 100644 |
973 | --- a/include/media/v4l2-ctrls.h |
974 | +++ b/include/media/v4l2-ctrls.h |
975 | @@ -22,6 +22,7 @@ |
976 | #define _V4L2_CTRLS_H |
977 | |
978 | #include <linux/list.h> |
979 | +#include <linux/mutex.h> |
980 | #include <linux/videodev2.h> |
981 | |
982 | /* forward references */ |
983 | diff --git a/mm/huge_memory.c b/mm/huge_memory.c |
984 | index ef99c15f..3da5c0bf 100644 |
985 | --- a/mm/huge_memory.c |
986 | +++ b/mm/huge_memory.c |
987 | @@ -1894,6 +1894,8 @@ static void collapse_huge_page(struct mm_struct *mm, |
988 | goto out; |
989 | |
990 | vma = find_vma(mm, address); |
991 | + if (!vma) |
992 | + goto out; |
993 | hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK; |
994 | hend = vma->vm_end & HPAGE_PMD_MASK; |
995 | if (address < hstart || address + HPAGE_PMD_SIZE > hend) |
996 | diff --git a/mm/memcontrol.c b/mm/memcontrol.c |
997 | index 81c275b3..9c364428 100644 |
998 | --- a/mm/memcontrol.c |
999 | +++ b/mm/memcontrol.c |
1000 | @@ -4349,7 +4349,13 @@ static int compare_thresholds(const void *a, const void *b) |
1001 | const struct mem_cgroup_threshold *_a = a; |
1002 | const struct mem_cgroup_threshold *_b = b; |
1003 | |
1004 | - return _a->threshold - _b->threshold; |
1005 | + if (_a->threshold > _b->threshold) |
1006 | + return 1; |
1007 | + |
1008 | + if (_a->threshold < _b->threshold) |
1009 | + return -1; |
1010 | + |
1011 | + return 0; |
1012 | } |
1013 | |
1014 | static int mem_cgroup_oom_notify_cb(struct mem_cgroup *memcg) |
1015 | diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c |
1016 | index 1f350522..e6083c14 100644 |
1017 | --- a/sound/pci/hda/hda_intel.c |
1018 | +++ b/sound/pci/hda/hda_intel.c |
1019 | @@ -2602,6 +2602,7 @@ static struct snd_pci_quirk msi_black_list[] __devinitdata = { |
1020 | SND_PCI_QUIRK(0x1043, 0x81f2, "ASUS", 0), /* Athlon64 X2 + nvidia */ |
1021 | SND_PCI_QUIRK(0x1043, 0x81f6, "ASUS", 0), /* nvidia */ |
1022 | SND_PCI_QUIRK(0x1043, 0x822d, "ASUS", 0), /* Athlon64 X2 + nvidia MCP55 */ |
1023 | + SND_PCI_QUIRK(0x1179, 0xfb44, "Toshiba Satellite C870", 0), /* AMD Hudson */ |
1024 | SND_PCI_QUIRK(0x1849, 0x0888, "ASRock", 0), /* Athlon64 X2 + nvidia */ |
1025 | SND_PCI_QUIRK(0xa0a0, 0x0575, "Aopen MZ915-M", 0), /* ICH6 */ |
1026 | {} |
1027 | diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c |
1028 | index 840d7208..ddb0d904 100644 |
1029 | --- a/sound/soc/codecs/wm8960.c |
1030 | +++ b/sound/soc/codecs/wm8960.c |
1031 | @@ -790,9 +790,9 @@ static int wm8960_set_dai_pll(struct snd_soc_dai *codec_dai, int pll_id, |
1032 | if (pll_div.k) { |
1033 | reg |= 0x20; |
1034 | |
1035 | - snd_soc_write(codec, WM8960_PLL2, (pll_div.k >> 18) & 0x3f); |
1036 | - snd_soc_write(codec, WM8960_PLL3, (pll_div.k >> 9) & 0x1ff); |
1037 | - snd_soc_write(codec, WM8960_PLL4, pll_div.k & 0x1ff); |
1038 | + snd_soc_write(codec, WM8960_PLL2, (pll_div.k >> 16) & 0xff); |
1039 | + snd_soc_write(codec, WM8960_PLL3, (pll_div.k >> 8) & 0xff); |
1040 | + snd_soc_write(codec, WM8960_PLL4, pll_div.k & 0xff); |
1041 | } |
1042 | snd_soc_write(codec, WM8960_PLL1, reg); |
1043 |