Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-lts/patches-3.4/0162-3.4.63-all-fixes.patch

    Contents of /trunk/kernel-lts/patches-3.4/0162-3.4.63-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2304 - (show annotations) (download)
    Mon Oct 14 07:15:18 2013 UTC (10 years, 6 months ago) by niro
    File size: 35329 byte(s) 
    -linux-3.4.63
    1 diff --git a/arch/arm/mach-versatile/pci.c b/arch/arm/mach-versatile/pci.c
    2 index d2268be8..709beb1d 100644
    3 --- a/arch/arm/mach-versatile/pci.c
    4 +++ b/arch/arm/mach-versatile/pci.c
    5 @@ -42,9 +42,9 @@
    6 #define PCI_IMAP0 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x0)
    7 #define PCI_IMAP1 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x4)
    8 #define PCI_IMAP2 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x8)
    9 -#define PCI_SMAP0 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x10)
    10 -#define PCI_SMAP1 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x14)
    11 -#define PCI_SMAP2 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x18)
    12 +#define PCI_SMAP0 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x14)
    13 +#define PCI_SMAP1 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x18)
    14 +#define PCI_SMAP2 __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0x1c)
    15 #define PCI_SELFID __IO_ADDRESS(VERSATILE_PCI_CORE_BASE+0xc)
    16
    17 #define DEVICE_ID_OFFSET 0x00
    18 diff --git a/arch/mips/ath79/clock.c b/arch/mips/ath79/clock.c
    19 index 54d0eb4db..89276a2f 100644
    20 --- a/arch/mips/ath79/clock.c
    21 +++ b/arch/mips/ath79/clock.c
    22 @@ -159,7 +159,7 @@ static void __init ar933x_clocks_init(void)
    23 ath79_ahb_clk.rate = freq / t;
    24 }
    25
    26 - ath79_wdt_clk.rate = ath79_ref_clk.rate;
    27 + ath79_wdt_clk.rate = ath79_ahb_clk.rate;
    28 ath79_uart_clk.rate = ath79_ref_clk.rate;
    29 }
    30
    31 diff --git a/arch/powerpc/kernel/align.c b/arch/powerpc/kernel/align.c
    32 index ee5b690a..52e5758e 100644
    33 --- a/arch/powerpc/kernel/align.c
    34 +++ b/arch/powerpc/kernel/align.c
    35 @@ -764,6 +764,16 @@ int fix_alignment(struct pt_regs *regs)
    36 nb = aligninfo[instr].len;
    37 flags = aligninfo[instr].flags;
    38
    39 + /* ldbrx/stdbrx overlap lfs/stfs in the DSISR unfortunately */
    40 + if (IS_XFORM(instruction) && ((instruction >> 1) & 0x3ff) == 532) {
    41 + nb = 8;
    42 + flags = LD+SW;
    43 + } else if (IS_XFORM(instruction) &&
    44 + ((instruction >> 1) & 0x3ff) == 660) {
    45 + nb = 8;
    46 + flags = ST+SW;
    47 + }
    48 +
    49 /* Byteswap little endian loads and stores */
    50 swiz = 0;
    51 if (regs->msr & MSR_LE) {
    52 diff --git a/crypto/api.c b/crypto/api.c
    53 index 033a7147..4f98dd5b 100644
    54 --- a/crypto/api.c
    55 +++ b/crypto/api.c
    56 @@ -40,6 +40,8 @@ static inline struct crypto_alg *crypto_alg_get(struct crypto_alg *alg)
    57 return alg;
    58 }
    59
    60 +static struct crypto_alg *crypto_larval_wait(struct crypto_alg *alg);
    61 +
    62 struct crypto_alg *crypto_mod_get(struct crypto_alg *alg)
    63 {
    64 return try_module_get(alg->cra_module) ? crypto_alg_get(alg) : NULL;
    65 @@ -150,8 +152,11 @@ static struct crypto_alg *crypto_larval_add(const char *name, u32 type,
    66 }
    67 up_write(&crypto_alg_sem);
    68
    69 - if (alg != &larval->alg)
    70 + if (alg != &larval->alg) {
    71 kfree(larval);
    72 + if (crypto_is_larval(alg))
    73 + alg = crypto_larval_wait(alg);
    74 + }
    75
    76 return alg;
    77 }
    78 diff --git a/drivers/gpu/drm/drm_edid.c b/drivers/gpu/drm/drm_edid.c
    79 index 8b77fd31..efe172f3 100644
    80 --- a/drivers/gpu/drm/drm_edid.c
    81 +++ b/drivers/gpu/drm/drm_edid.c
    82 @@ -125,6 +125,9 @@ static struct edid_quirk {
    83
    84 /* ViewSonic VA2026w */
    85 { "VSC", 5020, EDID_QUIRK_FORCE_REDUCED_BLANKING },
    86 +
    87 + /* Medion MD 30217 PG */
    88 + { "MED", 0x7b8, EDID_QUIRK_PREFER_LARGE_75 },
    89 };
    90
    91 /*** DDC fetch and block validation ***/
    92 diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c
    93 index ff73d60c..ab59fdf0 100644
    94 --- a/drivers/hid/hid-core.c
    95 +++ b/drivers/hid/hid-core.c
    96 @@ -63,6 +63,8 @@ struct hid_report *hid_register_report(struct hid_device *device, unsigned type,
    97 struct hid_report_enum *report_enum = device->report_enum + type;
    98 struct hid_report *report;
    99
    100 + if (id >= HID_MAX_IDS)
    101 + return NULL;
    102 if (report_enum->report_id_hash[id])
    103 return report_enum->report_id_hash[id];
    104
    105 @@ -385,8 +387,10 @@ static int hid_parser_global(struct hid_parser *parser, struct hid_item *item)
    106
    107 case HID_GLOBAL_ITEM_TAG_REPORT_ID:
    108 parser->global.report_id = item_udata(item);
    109 - if (parser->global.report_id == 0) {
    110 - hid_err(parser->device, "report_id 0 is invalid\n");
    111 + if (parser->global.report_id == 0 ||
    112 + parser->global.report_id >= HID_MAX_IDS) {
    113 + hid_err(parser->device, "report_id %u is invalid\n",
    114 + parser->global.report_id);
    115 return -1;
    116 }
    117 return 0;
    118 @@ -557,7 +561,7 @@ static void hid_device_release(struct device *dev)
    119 for (i = 0; i < HID_REPORT_TYPES; i++) {
    120 struct hid_report_enum *report_enum = device->report_enum + i;
    121
    122 - for (j = 0; j < 256; j++) {
    123 + for (j = 0; j < HID_MAX_IDS; j++) {
    124 struct hid_report *report = report_enum->report_id_hash[j];
    125 if (report)
    126 hid_free_report(report);
    127 @@ -995,7 +999,12 @@ EXPORT_SYMBOL_GPL(hid_output_report);
    128
    129 int hid_set_field(struct hid_field *field, unsigned offset, __s32 value)
    130 {
    131 - unsigned size = field->report_size;
    132 + unsigned size;
    133 +
    134 + if (!field)
    135 + return -1;
    136 +
    137 + size = field->report_size;
    138
    139 hid_dump_input(field->report->device, field->usage + offset, value);
    140
    141 diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
    142 index 14d22399..8cc08e23 100644
    143 --- a/drivers/hid/hid-ids.h
    144 +++ b/drivers/hid/hid-ids.h
    145 @@ -595,6 +595,7 @@
    146 #define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_16 0x0012
    147 #define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_17 0x0013
    148 #define USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_18 0x0014
    149 +#define USB_DEVICE_ID_NTRIG_DUOSENSE 0x1500
    150
    151 #define USB_VENDOR_ID_ONTRAK 0x0a07
    152 #define USB_DEVICE_ID_ONTRAK_ADU100 0x0064
    153 diff --git a/drivers/hid/hid-input.c b/drivers/hid/hid-input.c
    154 index 21e473e7..f03c684e 100644
    155 --- a/drivers/hid/hid-input.c
    156 +++ b/drivers/hid/hid-input.c
    157 @@ -314,7 +314,7 @@ static int hidinput_get_battery_property(struct power_supply *psy,
    158 {
    159 struct hid_device *dev = container_of(psy, struct hid_device, battery);
    160 int ret = 0;
    161 - __u8 buf[2] = {};
    162 + __u8 *buf;
    163
    164 switch (prop) {
    165 case POWER_SUPPLY_PROP_PRESENT:
    166 @@ -323,13 +323,20 @@ static int hidinput_get_battery_property(struct power_supply *psy,
    167 break;
    168
    169 case POWER_SUPPLY_PROP_CAPACITY:
    170 +
    171 + buf = kmalloc(2 * sizeof(__u8), GFP_KERNEL);
    172 + if (!buf) {
    173 + ret = -ENOMEM;
    174 + break;
    175 + }
    176 ret = dev->hid_get_raw_report(dev, dev->battery_report_id,
    177 - buf, sizeof(buf),
    178 + buf, 2,
    179 dev->battery_report_type);
    180
    181 if (ret != 2) {
    182 if (ret >= 0)
    183 ret = -EINVAL;
    184 + kfree(buf);
    185 break;
    186 }
    187
    188 @@ -338,6 +345,7 @@ static int hidinput_get_battery_property(struct power_supply *psy,
    189 buf[1] <= dev->battery_max)
    190 val->intval = (100 * (buf[1] - dev->battery_min)) /
    191 (dev->battery_max - dev->battery_min);
    192 + kfree(buf);
    193 break;
    194
    195 case POWER_SUPPLY_PROP_MODEL_NAME:
    196 diff --git a/drivers/hid/hid-ntrig.c b/drivers/hid/hid-ntrig.c
    197 index 9fae2ebd..48cba857 100644
    198 --- a/drivers/hid/hid-ntrig.c
    199 +++ b/drivers/hid/hid-ntrig.c
    200 @@ -115,7 +115,8 @@ static inline int ntrig_get_mode(struct hid_device *hdev)
    201 struct hid_report *report = hdev->report_enum[HID_FEATURE_REPORT].
    202 report_id_hash[0x0d];
    203
    204 - if (!report)
    205 + if (!report || report->maxfield < 1 ||
    206 + report->field[0]->report_count < 1)
    207 return -EINVAL;
    208
    209 usbhid_submit_report(hdev, report, USB_DIR_IN);
    210 diff --git a/drivers/hid/hid-pl.c b/drivers/hid/hid-pl.c
    211 index 47ed74c4..00cd2f8b 100644
    212 --- a/drivers/hid/hid-pl.c
    213 +++ b/drivers/hid/hid-pl.c
    214 @@ -129,8 +129,14 @@ static int plff_init(struct hid_device *hid)
    215 strong = &report->field[0]->value[2];
    216 weak = &report->field[0]->value[3];
    217 debug("detected single-field device");
    218 - } else if (report->maxfield >= 4 && report->field[0]->maxusage == 1 &&
    219 - report->field[0]->usage[0].hid == (HID_UP_LED | 0x43)) {
    220 + } else if (report->field[0]->maxusage == 1 &&
    221 + report->field[0]->usage[0].hid ==
    222 + (HID_UP_LED | 0x43) &&
    223 + report->maxfield >= 4 &&
    224 + report->field[0]->report_count >= 1 &&
    225 + report->field[1]->report_count >= 1 &&
    226 + report->field[2]->report_count >= 1 &&
    227 + report->field[3]->report_count >= 1) {
    228 report->field[0]->value[0] = 0x00;
    229 report->field[1]->value[0] = 0x00;
    230 strong = &report->field[2]->value[0];
    231 diff --git a/drivers/hid/hid-speedlink.c b/drivers/hid/hid-speedlink.c
    232 index 60201374..2b03c9ba 100644
    233 --- a/drivers/hid/hid-speedlink.c
    234 +++ b/drivers/hid/hid-speedlink.c
    235 @@ -3,7 +3,7 @@
    236 * Fixes "jumpy" cursor and removes nonexistent keyboard LEDS from
    237 * the HID descriptor.
    238 *
    239 - * Copyright (c) 2011 Stefan Kriwanek <mail@stefankriwanek.de>
    240 + * Copyright (c) 2011, 2013 Stefan Kriwanek <dev@stefankriwanek.de>
    241 */
    242
    243 /*
    244 @@ -48,8 +48,13 @@ static int speedlink_event(struct hid_device *hdev, struct hid_field *field,
    245 struct hid_usage *usage, __s32 value)
    246 {
    247 /* No other conditions due to usage_table. */
    248 - /* Fix "jumpy" cursor (invalid events sent by device). */
    249 - if (value == 256)
    250 +
    251 + /* This fixes the "jumpy" cursor occuring due to invalid events sent
    252 + * by the device. Some devices only send them with value==+256, others
    253 + * don't. However, catching abs(value)>=256 is restrictive enough not
    254 + * to interfere with devices that were bug-free (has been tested).
    255 + */
    256 + if (abs(value) >= 256)
    257 return 1;
    258 /* Drop useless distance 0 events (on button clicks etc.) as well */
    259 if (value == 0)
    260 diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
    261 index 5c4112e6..d712294b 100644
    262 --- a/drivers/hid/usbhid/hid-quirks.c
    263 +++ b/drivers/hid/usbhid/hid-quirks.c
    264 @@ -103,6 +103,8 @@ static const struct hid_blacklist {
    265 { USB_VENDOR_ID_SIGMA_MICRO, USB_DEVICE_ID_SIGMA_MICRO_KEYBOARD, HID_QUIRK_NO_INIT_REPORTS },
    266 { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_MOUSEPEN_I608X, HID_QUIRK_MULTI_INPUT },
    267 { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_EASYPEN_M610X, HID_QUIRK_MULTI_INPUT },
    268 + { USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_DUOSENSE, HID_QUIRK_NO_INIT_REPORTS },
    269 +
    270 { 0, 0 }
    271 };
    272
    273 diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
    274 index 17119247..a60a54d8 100644
    275 --- a/drivers/iommu/intel-iommu.c
    276 +++ b/drivers/iommu/intel-iommu.c
    277 @@ -886,56 +886,54 @@ static int dma_pte_clear_range(struct dmar_domain *domain,
    278 return order;
    279 }
    280
    281 +static void dma_pte_free_level(struct dmar_domain *domain, int level,
    282 + struct dma_pte *pte, unsigned long pfn,
    283 + unsigned long start_pfn, unsigned long last_pfn)
    284 +{
    285 + pfn = max(start_pfn, pfn);
    286 + pte = &pte[pfn_level_offset(pfn, level)];
    287 +
    288 + do {
    289 + unsigned long level_pfn;
    290 + struct dma_pte *level_pte;
    291 +
    292 + if (!dma_pte_present(pte) || dma_pte_superpage(pte))
    293 + goto next;
    294 +
    295 + level_pfn = pfn & level_mask(level - 1);
    296 + level_pte = phys_to_virt(dma_pte_addr(pte));
    297 +
    298 + if (level > 2)
    299 + dma_pte_free_level(domain, level - 1, level_pte,
    300 + level_pfn, start_pfn, last_pfn);
    301 +
    302 + /* If range covers entire pagetable, free it */
    303 + if (!(start_pfn > level_pfn ||
    304 + last_pfn < level_pfn + level_size(level))) {
    305 + dma_clear_pte(pte);
    306 + domain_flush_cache(domain, pte, sizeof(*pte));
    307 + free_pgtable_page(level_pte);
    308 + }
    309 +next:
    310 + pfn += level_size(level);
    311 + } while (!first_pte_in_page(++pte) && pfn <= last_pfn);
    312 +}
    313 +
    314 /* free page table pages. last level pte should already be cleared */
    315 static void dma_pte_free_pagetable(struct dmar_domain *domain,
    316 unsigned long start_pfn,
    317 unsigned long last_pfn)
    318 {
    319 int addr_width = agaw_to_width(domain->agaw) - VTD_PAGE_SHIFT;
    320 - struct dma_pte *first_pte, *pte;
    321 - int total = agaw_to_level(domain->agaw);
    322 - int level;
    323 - unsigned long tmp;
    324 - int large_page = 2;
    325
    326 BUG_ON(addr_width < BITS_PER_LONG && start_pfn >> addr_width);
    327 BUG_ON(addr_width < BITS_PER_LONG && last_pfn >> addr_width);
    328 BUG_ON(start_pfn > last_pfn);
    329
    330 /* We don't need lock here; nobody else touches the iova range */
    331 - level = 2;
    332 - while (level <= total) {
    333 - tmp = align_to_level(start_pfn, level);
    334 -
    335 - /* If we can't even clear one PTE at this level, we're done */
    336 - if (tmp + level_size(level) - 1 > last_pfn)
    337 - return;
    338 -
    339 - do {
    340 - large_page = level;
    341 - first_pte = pte = dma_pfn_level_pte(domain, tmp, level, &large_page);
    342 - if (large_page > level)
    343 - level = large_page + 1;
    344 - if (!pte) {
    345 - tmp = align_to_level(tmp + 1, level + 1);
    346 - continue;
    347 - }
    348 - do {
    349 - if (dma_pte_present(pte)) {
    350 - free_pgtable_page(phys_to_virt(dma_pte_addr(pte)));
    351 - dma_clear_pte(pte);
    352 - }
    353 - pte++;
    354 - tmp += level_size(level);
    355 - } while (!first_pte_in_page(pte) &&
    356 - tmp + level_size(level) - 1 <= last_pfn);
    357 + dma_pte_free_level(domain, agaw_to_level(domain->agaw),
    358 + domain->pgd, 0, start_pfn, last_pfn);
    359
    360 - domain_flush_cache(domain, first_pte,
    361 - (void *)pte - (void *)first_pte);
    362 -
    363 - } while (tmp && tmp + level_size(level) - 1 <= last_pfn);
    364 - level++;
    365 - }
    366 /* free pgd */
    367 if (start_pfn == 0 && last_pfn == DOMAIN_MAX_PFN(domain->gaw)) {
    368 free_pgtable_page(domain->pgd);
    369 diff --git a/drivers/mmc/host/tmio_mmc_dma.c b/drivers/mmc/host/tmio_mmc_dma.c
    370 index fff92860..491e9ecc 100644
    371 --- a/drivers/mmc/host/tmio_mmc_dma.c
    372 +++ b/drivers/mmc/host/tmio_mmc_dma.c
    373 @@ -104,6 +104,7 @@ static void tmio_mmc_start_dma_rx(struct tmio_mmc_host *host)
    374 pio:
    375 if (!desc) {
    376 /* DMA failed, fall back to PIO */
    377 + tmio_mmc_enable_dma(host, false);
    378 if (ret >= 0)
    379 ret = -EIO;
    380 host->chan_rx = NULL;
    381 @@ -116,7 +117,6 @@ pio:
    382 }
    383 dev_warn(&host->pdev->dev,
    384 "DMA failed: %d, falling back to PIO\n", ret);
    385 - tmio_mmc_enable_dma(host, false);
    386 }
    387
    388 dev_dbg(&host->pdev->dev, "%s(): desc %p, cookie %d, sg[%d]\n", __func__,
    389 @@ -185,6 +185,7 @@ static void tmio_mmc_start_dma_tx(struct tmio_mmc_host *host)
    390 pio:
    391 if (!desc) {
    392 /* DMA failed, fall back to PIO */
    393 + tmio_mmc_enable_dma(host, false);
    394 if (ret >= 0)
    395 ret = -EIO;
    396 host->chan_tx = NULL;
    397 @@ -197,7 +198,6 @@ pio:
    398 }
    399 dev_warn(&host->pdev->dev,
    400 "DMA failed: %d, falling back to PIO\n", ret);
    401 - tmio_mmc_enable_dma(host, false);
    402 }
    403
    404 dev_dbg(&host->pdev->dev, "%s(): desc %p, cookie %d\n", __func__,
    405 diff --git a/drivers/net/wireless/ath/ath9k/ar9003_phy.c b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
    406 index f86ee0c7..503ff9f6 100644
    407 --- a/drivers/net/wireless/ath/ath9k/ar9003_phy.c
    408 +++ b/drivers/net/wireless/ath/ath9k/ar9003_phy.c
    409 @@ -1030,6 +1030,10 @@ static bool ar9003_hw_ani_control(struct ath_hw *ah,
    410 * is_on == 0 means MRC CCK is OFF (more noise imm)
    411 */
    412 bool is_on = param ? 1 : 0;
    413 +
    414 + if (ah->caps.rx_chainmask == 1)
    415 + break;
    416 +
    417 REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
    418 AR_PHY_MRC_CCK_ENABLE, is_on);
    419 REG_RMW_FIELD(ah, AR_PHY_MRC_CCK_CTRL,
    420 diff --git a/drivers/net/wireless/ath/ath9k/ath9k.h b/drivers/net/wireless/ath/ath9k/ath9k.h
    421 index 4bfb44a0..e2ab182d 100644
    422 --- a/drivers/net/wireless/ath/ath9k/ath9k.h
    423 +++ b/drivers/net/wireless/ath/ath9k/ath9k.h
    424 @@ -78,10 +78,6 @@ struct ath_config {
    425 sizeof(struct ath_buf_state)); \
    426 } while (0)
    427
    428 -#define ATH_RXBUF_RESET(_bf) do { \
    429 - (_bf)->bf_stale = false; \
    430 - } while (0)
    431 -
    432 /**
    433 * enum buffer_type - Buffer type flags
    434 *
    435 @@ -314,6 +310,7 @@ struct ath_rx {
    436 struct ath_buf *rx_bufptr;
    437 struct ath_rx_edma rx_edma[ATH9K_RX_QUEUE_MAX];
    438
    439 + struct ath_buf *buf_hold;
    440 struct sk_buff *frag;
    441 };
    442
    443 diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
    444 index 039bac7e..2e6583d3 100644
    445 --- a/drivers/net/wireless/ath/ath9k/recv.c
    446 +++ b/drivers/net/wireless/ath/ath9k/recv.c
    447 @@ -78,8 +78,6 @@ static void ath_rx_buf_link(struct ath_softc *sc, struct ath_buf *bf)
    448 struct ath_desc *ds;
    449 struct sk_buff *skb;
    450
    451 - ATH_RXBUF_RESET(bf);
    452 -
    453 ds = bf->bf_desc;
    454 ds->ds_link = 0; /* link to null */
    455 ds->ds_data = bf->bf_buf_addr;
    456 @@ -106,6 +104,14 @@ static void ath_rx_buf_link(struct ath_softc *sc, struct ath_buf *bf)
    457 sc->rx.rxlink = &ds->ds_link;
    458 }
    459
    460 +static void ath_rx_buf_relink(struct ath_softc *sc, struct ath_buf *bf)
    461 +{
    462 + if (sc->rx.buf_hold)
    463 + ath_rx_buf_link(sc, sc->rx.buf_hold);
    464 +
    465 + sc->rx.buf_hold = bf;
    466 +}
    467 +
    468 static void ath_setdefantenna(struct ath_softc *sc, u32 antenna)
    469 {
    470 /* XXX block beacon interrupts */
    471 @@ -153,7 +159,6 @@ static bool ath_rx_edma_buf_link(struct ath_softc *sc,
    472
    473 skb = bf->bf_mpdu;
    474
    475 - ATH_RXBUF_RESET(bf);
    476 memset(skb->data, 0, ah->caps.rx_status_len);
    477 dma_sync_single_for_device(sc->dev, bf->bf_buf_addr,
    478 ah->caps.rx_status_len, DMA_TO_DEVICE);
    479 @@ -485,6 +490,7 @@ int ath_startrecv(struct ath_softc *sc)
    480 if (list_empty(&sc->rx.rxbuf))
    481 goto start_recv;
    482
    483 + sc->rx.buf_hold = NULL;
    484 sc->rx.rxlink = NULL;
    485 list_for_each_entry_safe(bf, tbf, &sc->rx.rxbuf, list) {
    486 ath_rx_buf_link(sc, bf);
    487 @@ -734,6 +740,9 @@ static struct ath_buf *ath_get_next_rx_buf(struct ath_softc *sc,
    488 }
    489
    490 bf = list_first_entry(&sc->rx.rxbuf, struct ath_buf, list);
    491 + if (bf == sc->rx.buf_hold)
    492 + return NULL;
    493 +
    494 ds = bf->bf_desc;
    495
    496 /*
    497 @@ -1974,7 +1983,7 @@ requeue:
    498 if (edma) {
    499 ath_rx_edma_buf_link(sc, qtype);
    500 } else {
    501 - ath_rx_buf_link(sc, bf);
    502 + ath_rx_buf_relink(sc, bf);
    503 ath9k_hw_rxena(ah);
    504 }
    505 } while (1);
    506 diff --git a/drivers/net/wireless/ath/ath9k/xmit.c b/drivers/net/wireless/ath/ath9k/xmit.c
    507 index 12a42f2c..3d0aa472 100644
    508 --- a/drivers/net/wireless/ath/ath9k/xmit.c
    509 +++ b/drivers/net/wireless/ath/ath9k/xmit.c
    510 @@ -2479,6 +2479,7 @@ void ath_tx_node_init(struct ath_softc *sc, struct ath_node *an)
    511 for (acno = 0, ac = &an->ac[acno];
    512 acno < WME_NUM_AC; acno++, ac++) {
    513 ac->sched = false;
    514 + ac->clear_ps_filter = true;
    515 ac->txq = sc->tx.txq_map[acno];
    516 INIT_LIST_HEAD(&ac->tid_q);
    517 }
    518 diff --git a/drivers/net/wireless/brcm80211/brcmsmac/dma.c b/drivers/net/wireless/brcm80211/brcmsmac/dma.c
    519 index 11054ae9..9a184058 100644
    520 --- a/drivers/net/wireless/brcm80211/brcmsmac/dma.c
    521 +++ b/drivers/net/wireless/brcm80211/brcmsmac/dma.c
    522 @@ -1013,9 +1013,10 @@ static bool dma64_rxidle(struct dma_info *di)
    523
    524 /*
    525 * post receive buffers
    526 - * return false is refill failed completely and ring is empty this will stall
    527 - * the rx dma and user might want to call rxfill again asap. This unlikely
    528 - * happens on memory-rich NIC, but often on memory-constrained dongle
    529 + * Return false if refill failed completely or dma mapping failed. The ring
    530 + * is empty, which will stall the rx dma and user might want to call rxfill
    531 + * again asap. This is unlikely to happen on a memory-rich NIC, but often on
    532 + * memory-constrained dongle.
    533 */
    534 bool dma_rxfill(struct dma_pub *pub)
    535 {
    536 @@ -1074,6 +1075,8 @@ bool dma_rxfill(struct dma_pub *pub)
    537
    538 pa = dma_map_single(di->dmadev, p->data, di->rxbufsize,
    539 DMA_FROM_DEVICE);
    540 + if (dma_mapping_error(di->dmadev, pa))
    541 + return false;
    542
    543 /* save the free packet pointer */
    544 di->rxp[rxout] = p;
    545 @@ -1294,7 +1297,11 @@ int dma_txfast(struct dma_pub *pub, struct sk_buff *p, bool commit)
    546
    547 /* get physical address of buffer start */
    548 pa = dma_map_single(di->dmadev, data, len, DMA_TO_DEVICE);
    549 -
    550 + /* if mapping failed, free skb */
    551 + if (dma_mapping_error(di->dmadev, pa)) {
    552 + brcmu_pkt_buf_free_skb(p);
    553 + return;
    554 + }
    555 /* With a DMA segment list, Descriptor table is filled
    556 * using the segment list instead of looping over
    557 * buffers in multi-chain DMA. Therefore, EOF for SGLIST
    558 diff --git a/drivers/of/base.c b/drivers/of/base.c
    559 index 58064498..1c207f23 100644
    560 --- a/drivers/of/base.c
    561 +++ b/drivers/of/base.c
    562 @@ -1227,6 +1227,7 @@ void of_alias_scan(void * (*dt_alloc)(u64 size, u64 align))
    563 ap = dt_alloc(sizeof(*ap) + len + 1, 4);
    564 if (!ap)
    565 continue;
    566 + memset(ap, 0, sizeof(*ap) + len + 1);
    567 ap->alias = start;
    568 of_alias_add(ap, np, id, start, len);
    569 }
    570 diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
    571 index 105fff2e..05973a49 100644
    572 --- a/drivers/scsi/sd.c
    573 +++ b/drivers/scsi/sd.c
    574 @@ -2225,14 +2225,9 @@ sd_read_cache_type(struct scsi_disk *sdkp, unsigned char *buffer)
    575 }
    576 }
    577
    578 - if (modepage == 0x3F) {
    579 - sd_printk(KERN_ERR, sdkp, "No Caching mode page "
    580 - "present\n");
    581 - goto defaults;
    582 - } else if ((buffer[offset] & 0x3f) != modepage) {
    583 - sd_printk(KERN_ERR, sdkp, "Got wrong page\n");
    584 - goto defaults;
    585 - }
    586 + sd_printk(KERN_ERR, sdkp, "No Caching mode page found\n");
    587 + goto defaults;
    588 +
    589 Page_found:
    590 if (modepage == 8) {
    591 sdkp->WCE = ((buffer[offset + 2] & 0x04) != 0);
    592 diff --git a/drivers/staging/comedi/drivers/dt282x.c b/drivers/staging/comedi/drivers/dt282x.c
    593 index 95ebc267..e3adb382 100644
    594 --- a/drivers/staging/comedi/drivers/dt282x.c
    595 +++ b/drivers/staging/comedi/drivers/dt282x.c
    596 @@ -407,8 +407,9 @@ struct dt282x_private {
    597 } \
    598 udelay(5); \
    599 } \
    600 - if (_i) \
    601 + if (_i) { \
    602 b \
    603 + } \
    604 } while (0)
    605
    606 static int dt282x_attach(struct comedi_device *dev,
    607 diff --git a/drivers/usb/class/cdc-wdm.c b/drivers/usb/class/cdc-wdm.c
    608 index 9dd51f7f..1434ee9e 100644
    609 --- a/drivers/usb/class/cdc-wdm.c
    610 +++ b/drivers/usb/class/cdc-wdm.c
    611 @@ -233,6 +233,7 @@ skip_error:
    612 static void wdm_int_callback(struct urb *urb)
    613 {
    614 int rv = 0;
    615 + int responding;
    616 int status = urb->status;
    617 struct wdm_device *desc;
    618 struct usb_cdc_notification *dr;
    619 @@ -286,8 +287,8 @@ static void wdm_int_callback(struct urb *urb)
    620
    621 spin_lock(&desc->iuspin);
    622 clear_bit(WDM_READ, &desc->flags);
    623 - set_bit(WDM_RESPONDING, &desc->flags);
    624 - if (!test_bit(WDM_DISCONNECTING, &desc->flags)
    625 + responding = test_and_set_bit(WDM_RESPONDING, &desc->flags);
    626 + if (!responding && !test_bit(WDM_DISCONNECTING, &desc->flags)
    627 && !test_bit(WDM_SUSPENDING, &desc->flags)) {
    628 rv = usb_submit_urb(desc->response, GFP_ATOMIC);
    629 dev_dbg(&desc->intf->dev, "%s: usb_submit_urb %d",
    630 @@ -687,16 +688,20 @@ static void wdm_rxwork(struct work_struct *work)
    631 {
    632 struct wdm_device *desc = container_of(work, struct wdm_device, rxwork);
    633 unsigned long flags;
    634 - int rv;
    635 + int rv = 0;
    636 + int responding;
    637
    638 spin_lock_irqsave(&desc->iuspin, flags);
    639 if (test_bit(WDM_DISCONNECTING, &desc->flags)) {
    640 spin_unlock_irqrestore(&desc->iuspin, flags);
    641 } else {
    642 + responding = test_and_set_bit(WDM_RESPONDING, &desc->flags);
    643 spin_unlock_irqrestore(&desc->iuspin, flags);
    644 - rv = usb_submit_urb(desc->response, GFP_KERNEL);
    645 + if (!responding)
    646 + rv = usb_submit_urb(desc->response, GFP_KERNEL);
    647 if (rv < 0 && rv != -EPERM) {
    648 spin_lock_irqsave(&desc->iuspin, flags);
    649 + clear_bit(WDM_RESPONDING, &desc->flags);
    650 if (!test_bit(WDM_DISCONNECTING, &desc->flags))
    651 schedule_work(&desc->rxwork);
    652 spin_unlock_irqrestore(&desc->iuspin, flags);
    653 diff --git a/drivers/usb/core/config.c b/drivers/usb/core/config.c
    654 index f4bdd0ce..78609d30 100644
    655 --- a/drivers/usb/core/config.c
    656 +++ b/drivers/usb/core/config.c
    657 @@ -424,7 +424,8 @@ static int usb_parse_configuration(struct usb_device *dev, int cfgidx,
    658
    659 memcpy(&config->desc, buffer, USB_DT_CONFIG_SIZE);
    660 if (config->desc.bDescriptorType != USB_DT_CONFIG ||
    661 - config->desc.bLength < USB_DT_CONFIG_SIZE) {
    662 + config->desc.bLength < USB_DT_CONFIG_SIZE ||
    663 + config->desc.bLength > size) {
    664 dev_err(ddev, "invalid descriptor for config index %d: "
    665 "type = 0x%X, length = %d\n", cfgidx,
    666 config->desc.bDescriptorType, config->desc.bLength);
    667 diff --git a/drivers/usb/host/ehci-mxc.c b/drivers/usb/host/ehci-mxc.c
    668 index a797d51e..77477ca5 100644
    669 --- a/drivers/usb/host/ehci-mxc.c
    670 +++ b/drivers/usb/host/ehci-mxc.c
    671 @@ -298,7 +298,7 @@ static int __exit ehci_mxc_drv_remove(struct platform_device *pdev)
    672 if (pdata && pdata->exit)
    673 pdata->exit(pdev);
    674
    675 - if (pdata->otg)
    676 + if (pdata && pdata->otg)
    677 usb_phy_shutdown(pdata->otg);
    678
    679 usb_remove_hcd(hcd);
    680 diff --git a/drivers/usb/host/xhci-plat.c b/drivers/usb/host/xhci-plat.c
    681 index 93ad67ec..6e70ce97 100644
    682 --- a/drivers/usb/host/xhci-plat.c
    683 +++ b/drivers/usb/host/xhci-plat.c
    684 @@ -24,7 +24,7 @@ static void xhci_plat_quirks(struct device *dev, struct xhci_hcd *xhci)
    685 * here that the generic code does not try to make a pci_dev from our
    686 * dev struct in order to setup MSI
    687 */
    688 - xhci->quirks |= XHCI_BROKEN_MSI;
    689 + xhci->quirks |= XHCI_PLAT;
    690 }
    691
    692 /* called during probe() after chip reset completes */
    693 diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
    694 index 8072a932..1504946c 100644
    695 --- a/drivers/usb/host/xhci.c
    696 +++ b/drivers/usb/host/xhci.c
    697 @@ -342,9 +342,14 @@ static void xhci_msix_sync_irqs(struct xhci_hcd *xhci)
    698 static int xhci_try_enable_msi(struct usb_hcd *hcd)
    699 {
    700 struct xhci_hcd *xhci = hcd_to_xhci(hcd);
    701 - struct pci_dev *pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
    702 + struct pci_dev *pdev;
    703 int ret;
    704
    705 + /* The xhci platform device has set up IRQs through usb_add_hcd. */
    706 + if (xhci->quirks & XHCI_PLAT)
    707 + return 0;
    708 +
    709 + pdev = to_pci_dev(xhci_to_hcd(xhci)->self.controller);
    710 /*
    711 * Some Fresco Logic host controllers advertise MSI, but fail to
    712 * generate interrupts. Don't even try to enable MSI.
    713 @@ -3496,10 +3501,21 @@ void xhci_free_dev(struct usb_hcd *hcd, struct usb_device *udev)
    714 {
    715 struct xhci_hcd *xhci = hcd_to_xhci(hcd);
    716 struct xhci_virt_device *virt_dev;
    717 + struct device *dev = hcd->self.controller;
    718 unsigned long flags;
    719 u32 state;
    720 int i, ret;
    721
    722 +#ifndef CONFIG_USB_DEFAULT_PERSIST
    723 + /*
    724 + * We called pm_runtime_get_noresume when the device was attached.
    725 + * Decrement the counter here to allow controller to runtime suspend
    726 + * if no devices remain.
    727 + */
    728 + if (xhci->quirks & XHCI_RESET_ON_RESUME)
    729 + pm_runtime_put_noidle(dev);
    730 +#endif
    731 +
    732 ret = xhci_check_args(hcd, udev, NULL, 0, true, __func__);
    733 /* If the host is halted due to driver unload, we still need to free the
    734 * device.
    735 @@ -3571,6 +3587,7 @@ static int xhci_reserve_host_control_ep_resources(struct xhci_hcd *xhci)
    736 int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
    737 {
    738 struct xhci_hcd *xhci = hcd_to_xhci(hcd);
    739 + struct device *dev = hcd->self.controller;
    740 unsigned long flags;
    741 int timeleft;
    742 int ret;
    743 @@ -3623,6 +3640,16 @@ int xhci_alloc_dev(struct usb_hcd *hcd, struct usb_device *udev)
    744 goto disable_slot;
    745 }
    746 udev->slot_id = xhci->slot_id;
    747 +
    748 +#ifndef CONFIG_USB_DEFAULT_PERSIST
    749 + /*
    750 + * If resetting upon resume, we can't put the controller into runtime
    751 + * suspend if there is a device attached.
    752 + */
    753 + if (xhci->quirks & XHCI_RESET_ON_RESUME)
    754 + pm_runtime_get_noresume(dev);
    755 +#endif
    756 +
    757 /* Is this a LS or FS device under a HS hub? */
    758 /* Hub or peripherial? */
    759 return 1;
    760 diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
    761 index 15aaf58c..a54a408c 100644
    762 --- a/drivers/usb/host/xhci.h
    763 +++ b/drivers/usb/host/xhci.h
    764 @@ -1508,6 +1508,7 @@ struct xhci_hcd {
    765 #define XHCI_SPURIOUS_REBOOT (1 << 13)
    766 #define XHCI_COMP_MODE_QUIRK (1 << 14)
    767 #define XHCI_AVOID_BEI (1 << 15)
    768 +#define XHCI_PLAT (1 << 16)
    769 unsigned int num_active_eps;
    770 unsigned int limit_active_eps;
    771 /* There are two roothubs to keep track of bus suspend info for */
    772 diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c
    773 index cdde45de..4491830b 100644
    774 --- a/drivers/usb/serial/mos7720.c
    775 +++ b/drivers/usb/serial/mos7720.c
    776 @@ -383,7 +383,7 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
    777 kfree(urbtrack);
    778 return -ENOMEM;
    779 }
    780 - urbtrack->setup = kmalloc(sizeof(*urbtrack->setup), GFP_KERNEL);
    781 + urbtrack->setup = kmalloc(sizeof(*urbtrack->setup), GFP_ATOMIC);
    782 if (!urbtrack->setup) {
    783 usb_free_urb(urbtrack->urb);
    784 kfree(urbtrack);
    785 @@ -391,8 +391,8 @@ static int write_parport_reg_nonblock(struct mos7715_parport *mos_parport,
    786 }
    787 urbtrack->setup->bRequestType = (__u8)0x40;
    788 urbtrack->setup->bRequest = (__u8)0x0e;
    789 - urbtrack->setup->wValue = get_reg_value(reg, dummy);
    790 - urbtrack->setup->wIndex = get_reg_index(reg);
    791 + urbtrack->setup->wValue = cpu_to_le16(get_reg_value(reg, dummy));
    792 + urbtrack->setup->wIndex = cpu_to_le16(get_reg_index(reg));
    793 urbtrack->setup->wLength = 0;
    794 usb_fill_control_urb(urbtrack->urb, usbdev,
    795 usb_sndctrlpipe(usbdev, 0),
    796 diff --git a/drivers/xen/grant-table.c b/drivers/xen/grant-table.c
    797 index 7e34beed..3275bde6 100644
    798 --- a/drivers/xen/grant-table.c
    799 +++ b/drivers/xen/grant-table.c
    800 @@ -641,9 +641,18 @@ void gnttab_request_free_callback(struct gnttab_free_callback *callback,
    801 void (*fn)(void *), void *arg, u16 count)
    802 {
    803 unsigned long flags;
    804 + struct gnttab_free_callback *cb;
    805 +
    806 spin_lock_irqsave(&gnttab_list_lock, flags);
    807 - if (callback->next)
    808 - goto out;
    809 +
    810 + /* Check if the callback is already on the list */
    811 + cb = gnttab_free_callback_list;
    812 + while (cb) {
    813 + if (cb == callback)
    814 + goto out;
    815 + cb = cb->next;
    816 + }
    817 +
    818 callback->fn = fn;
    819 callback->arg = arg;
    820 callback->count = count;
    821 diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
    822 index e7fe81d3..4ac06b08 100644
    823 --- a/fs/cifs/connect.c
    824 +++ b/fs/cifs/connect.c
    825 @@ -362,6 +362,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
    826 try_to_freeze();
    827
    828 /* we should try only the port we connected to before */
    829 + mutex_lock(&server->srv_mutex);
    830 rc = generic_ip_connect(server);
    831 if (rc) {
    832 cFYI(1, "reconnect error %d", rc);
    833 @@ -373,6 +374,7 @@ cifs_reconnect(struct TCP_Server_Info *server)
    834 server->tcpStatus = CifsNeedNegotiate;
    835 spin_unlock(&GlobalMid_Lock);
    836 }
    837 + mutex_unlock(&server->srv_mutex);
    838 } while (server->tcpStatus == CifsNeedReconnect);
    839
    840 return rc;
    841 diff --git a/fs/fuse/dir.c b/fs/fuse/dir.c
    842 index d48478a8..373b2514 100644
    843 --- a/fs/fuse/dir.c
    844 +++ b/fs/fuse/dir.c
    845 @@ -1503,6 +1503,8 @@ static int fuse_setxattr(struct dentry *entry, const char *name,
    846 fc->no_setxattr = 1;
    847 err = -EOPNOTSUPP;
    848 }
    849 + if (!err)
    850 + fuse_invalidate_attr(inode);
    851 return err;
    852 }
    853
    854 @@ -1632,6 +1634,8 @@ static int fuse_removexattr(struct dentry *entry, const char *name)
    855 fc->no_removexattr = 1;
    856 err = -EOPNOTSUPP;
    857 }
    858 + if (!err)
    859 + fuse_invalidate_attr(inode);
    860 return err;
    861 }
    862
    863 diff --git a/fs/fuse/file.c b/fs/fuse/file.c
    864 index 8e6381a1..df25454e 100644
    865 --- a/fs/fuse/file.c
    866 +++ b/fs/fuse/file.c
    867 @@ -1294,7 +1294,6 @@ static int fuse_writepage_locked(struct page *page)
    868
    869 inc_bdi_stat(mapping->backing_dev_info, BDI_WRITEBACK);
    870 inc_zone_page_state(tmp_page, NR_WRITEBACK_TEMP);
    871 - end_page_writeback(page);
    872
    873 spin_lock(&fc->lock);
    874 list_add(&req->writepages_entry, &fi->writepages);
    875 @@ -1302,6 +1301,8 @@ static int fuse_writepage_locked(struct page *page)
    876 fuse_flush_writepages(inode);
    877 spin_unlock(&fc->lock);
    878
    879 + end_page_writeback(page);
    880 +
    881 return 0;
    882
    883 err_free:
    884 diff --git a/fs/isofs/inode.c b/fs/isofs/inode.c
    885 index 29037c36..e92a342f 100644
    886 --- a/fs/isofs/inode.c
    887 +++ b/fs/isofs/inode.c
    888 @@ -119,8 +119,8 @@ static void destroy_inodecache(void)
    889
    890 static int isofs_remount(struct super_block *sb, int *flags, char *data)
    891 {
    892 - /* we probably want a lot more here */
    893 - *flags |= MS_RDONLY;
    894 + if (!(*flags & MS_RDONLY))
    895 + return -EROFS;
    896 return 0;
    897 }
    898
    899 @@ -769,15 +769,6 @@ root_found:
    900 */
    901 s->s_maxbytes = 0x80000000000LL;
    902
    903 - /*
    904 - * The CDROM is read-only, has no nodes (devices) on it, and since
    905 - * all of the files appear to be owned by root, we really do not want
    906 - * to allow suid. (suid or devices will not show up unless we have
    907 - * Rock Ridge extensions)
    908 - */
    909 -
    910 - s->s_flags |= MS_RDONLY /* | MS_NODEV | MS_NOSUID */;
    911 -
    912 /* Set this for reference. Its not currently used except on write
    913 which we don't have .. */
    914
    915 @@ -1536,6 +1527,9 @@ struct inode *isofs_iget(struct super_block *sb,
    916 static struct dentry *isofs_mount(struct file_system_type *fs_type,
    917 int flags, const char *dev_name, void *data)
    918 {
    919 + /* We don't support read-write mounts */
    920 + if (!(flags & MS_RDONLY))
    921 + return ERR_PTR(-EACCES);
    922 return mount_bdev(fs_type, flags, dev_name, data, isofs_fill_super);
    923 }
    924
    925 diff --git a/fs/ocfs2/extent_map.c b/fs/ocfs2/extent_map.c
    926 index 7eb1c0c7..cf228479 100644
    927 --- a/fs/ocfs2/extent_map.c
    928 +++ b/fs/ocfs2/extent_map.c
    929 @@ -782,7 +782,6 @@ int ocfs2_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
    930 cpos = map_start >> osb->s_clustersize_bits;
    931 mapping_end = ocfs2_clusters_for_bytes(inode->i_sb,
    932 map_start + map_len);
    933 - mapping_end -= cpos;
    934 is_last = 0;
    935 while (cpos < mapping_end && !is_last) {
    936 u32 fe_flags;
    937 diff --git a/include/linux/hid.h b/include/linux/hid.h
    938 index 3a95da60..8c933a86 100644
    939 --- a/include/linux/hid.h
    940 +++ b/include/linux/hid.h
    941 @@ -420,10 +420,12 @@ struct hid_report {
    942 struct hid_device *device; /* associated device */
    943 };
    944
    945 +#define HID_MAX_IDS 256
    946 +
    947 struct hid_report_enum {
    948 unsigned numbered;
    949 struct list_head report_list;
    950 - struct hid_report *report_id_hash[256];
    951 + struct hid_report *report_id_hash[HID_MAX_IDS];
    952 };
    953
    954 #define HID_REPORT_TYPES 3
    955 diff --git a/include/linux/rculist.h b/include/linux/rculist.h
    956 index 6f95e241..38633526 100644
    957 --- a/include/linux/rculist.h
    958 +++ b/include/linux/rculist.h
    959 @@ -254,8 +254,9 @@ static inline void list_splice_init_rcu(struct list_head *list,
    960 */
    961 #define list_first_or_null_rcu(ptr, type, member) \
    962 ({struct list_head *__ptr = (ptr); \
    963 - struct list_head __rcu *__next = list_next_rcu(__ptr); \
    964 - likely(__ptr != __next) ? container_of(__next, type, member) : NULL; \
    965 + struct list_head *__next = ACCESS_ONCE(__ptr->next); \
    966 + likely(__ptr != __next) ? \
    967 + list_entry_rcu(__next, type, member) : NULL; \
    968 })
    969
    970 /**
    971 diff --git a/include/media/v4l2-ctrls.h b/include/media/v4l2-ctrls.h
    972 index 11e67562..ab45ea5b 100644
    973 --- a/include/media/v4l2-ctrls.h
    974 +++ b/include/media/v4l2-ctrls.h
    975 @@ -22,6 +22,7 @@
    976 #define _V4L2_CTRLS_H
    977
    978 #include <linux/list.h>
    979 +#include <linux/mutex.h>
    980 #include <linux/videodev2.h>
    981
    982 /* forward references */
    983 diff --git a/mm/huge_memory.c b/mm/huge_memory.c
    984 index ef99c15f..3da5c0bf 100644
    985 --- a/mm/huge_memory.c
    986 +++ b/mm/huge_memory.c
    987 @@ -1894,6 +1894,8 @@ static void collapse_huge_page(struct mm_struct *mm,
    988 goto out;
    989
    990 vma = find_vma(mm, address);
    991 + if (!vma)
    992 + goto out;
    993 hstart = (vma->vm_start + ~HPAGE_PMD_MASK) & HPAGE_PMD_MASK;
    994 hend = vma->vm_end & HPAGE_PMD_MASK;
    995 if (address < hstart || address + HPAGE_PMD_SIZE > hend)
    996 diff --git a/mm/memcontrol.c b/mm/memcontrol.c
    997 index 81c275b3..9c364428 100644
    998 --- a/mm/memcontrol.c
    999 +++ b/mm/memcontrol.c
    1000 @@ -4349,7 +4349,13 @@ static int compare_thresholds(const void *a, const void *b)
    1001 const struct mem_cgroup_threshold *_a = a;
    1002 const struct mem_cgroup_threshold *_b = b;
    1003
    1004 - return _a->threshold - _b->threshold;
    1005 + if (_a->threshold > _b->threshold)
    1006 + return 1;
    1007 +
    1008 + if (_a->threshold < _b->threshold)
    1009 + return -1;
    1010 +
    1011 + return 0;
    1012 }
    1013
    1014 static int mem_cgroup_oom_notify_cb(struct mem_cgroup *memcg)
    1015 diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c
    1016 index 1f350522..e6083c14 100644
    1017 --- a/sound/pci/hda/hda_intel.c
    1018 +++ b/sound/pci/hda/hda_intel.c
    1019 @@ -2602,6 +2602,7 @@ static struct snd_pci_quirk msi_black_list[] __devinitdata = {
    1020 SND_PCI_QUIRK(0x1043, 0x81f2, "ASUS", 0), /* Athlon64 X2 + nvidia */
    1021 SND_PCI_QUIRK(0x1043, 0x81f6, "ASUS", 0), /* nvidia */
    1022 SND_PCI_QUIRK(0x1043, 0x822d, "ASUS", 0), /* Athlon64 X2 + nvidia MCP55 */
    1023 + SND_PCI_QUIRK(0x1179, 0xfb44, "Toshiba Satellite C870", 0), /* AMD Hudson */
    1024 SND_PCI_QUIRK(0x1849, 0x0888, "ASRock", 0), /* Athlon64 X2 + nvidia */
    1025 SND_PCI_QUIRK(0xa0a0, 0x0575, "Aopen MZ915-M", 0), /* ICH6 */
    1026 {}
    1027 diff --git a/sound/soc/codecs/wm8960.c b/sound/soc/codecs/wm8960.c
    1028 index 840d7208..ddb0d904 100644
    1029 --- a/sound/soc/codecs/wm8960.c
    1030 +++ b/sound/soc/codecs/wm8960.c
    1031 @@ -790,9 +790,9 @@ static int wm8960_set_dai_pll(struct snd_soc_dai *codec_dai, int pll_id,
    1032 if (pll_div.k) {
    1033 reg |= 0x20;
    1034
    1035 - snd_soc_write(codec, WM8960_PLL2, (pll_div.k >> 18) & 0x3f);
    1036 - snd_soc_write(codec, WM8960_PLL3, (pll_div.k >> 9) & 0x1ff);
    1037 - snd_soc_write(codec, WM8960_PLL4, pll_div.k & 0x1ff);
    1038 + snd_soc_write(codec, WM8960_PLL2, (pll_div.k >> 16) & 0xff);
    1039 + snd_soc_write(codec, WM8960_PLL3, (pll_div.k >> 8) & 0xff);
    1040 + snd_soc_write(codec, WM8960_PLL4, pll_div.k & 0xff);
    1041 }
    1042 snd_soc_write(codec, WM8960_PLL1, reg);
    1043