Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-lts/patches-3.4/0171-3.4.72-all-fixes.patch

    Annotation of /trunk/kernel-lts/patches-3.4/0171-3.4.72-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2336 - (hide annotations) (download)
    Thu Dec 12 08:43:38 2013 UTC (10 years, 6 months ago) by niro
    File size: 53718 byte(s) 
    -linux-3.4.72
    1 niro 2336 diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
    2     index 6d78841f..99d8ab9d 100644
    3     --- a/Documentation/sysctl/kernel.txt
    4     +++ b/Documentation/sysctl/kernel.txt
    5     @@ -284,13 +284,24 @@ Default value is "/sbin/hotplug".
    6     kptr_restrict:
    7    
    8     This toggle indicates whether restrictions are placed on
    9     -exposing kernel addresses via /proc and other interfaces. When
    10     -kptr_restrict is set to (0), there are no restrictions. When
    11     -kptr_restrict is set to (1), the default, kernel pointers
    12     -printed using the %pK format specifier will be replaced with 0's
    13     -unless the user has CAP_SYSLOG. When kptr_restrict is set to
    14     -(2), kernel pointers printed using %pK will be replaced with 0's
    15     -regardless of privileges.
    16     +exposing kernel addresses via /proc and other interfaces.
    17     +
    18     +When kptr_restrict is set to (0), the default, there are no restrictions.
    19     +
    20     +When kptr_restrict is set to (1), kernel pointers printed using the %pK
    21     +format specifier will be replaced with 0's unless the user has CAP_SYSLOG
    22     +and effective user and group ids are equal to the real ids. This is
    23     +because %pK checks are done at read() time rather than open() time, so
    24     +if permissions are elevated between the open() and the read() (e.g via
    25     +a setuid binary) then %pK will not leak kernel pointers to unprivileged
    26     +users. Note, this is a temporary solution only. The correct long-term
    27     +solution is to do the permission checks at open() time. Consider removing
    28     +world read permissions from files that use %pK, and using dmesg_restrict
    29     +to protect against uses of %pK in dmesg(8) if leaking kernel pointer
    30     +values to unprivileged users is a concern.
    31     +
    32     +When kptr_restrict is set to (2), kernel pointers printed using
    33     +%pK will be replaced with 0's regardless of privileges.
    34    
    35     ==============================================================
    36    
    37     diff --git a/arch/arm/mach-integrator/integrator_cp.c b/arch/arm/mach-integrator/integrator_cp.c
    38     index 48a115a9..ecc33bc4 100644
    39     --- a/arch/arm/mach-integrator/integrator_cp.c
    40     +++ b/arch/arm/mach-integrator/integrator_cp.c
    41     @@ -366,7 +366,8 @@ static AMBA_APB_DEVICE(aaci, "mb:1d", 0, INTEGRATOR_CP_AACI_BASE,
    42     static void cp_clcd_enable(struct clcd_fb *fb)
    43     {
    44     struct fb_var_screeninfo *var = &fb->fb.var;
    45     - u32 val = CM_CTRL_STATIC1 | CM_CTRL_STATIC2;
    46     + u32 val = CM_CTRL_STATIC1 | CM_CTRL_STATIC2
    47     + | CM_CTRL_LCDEN0 | CM_CTRL_LCDEN1;
    48    
    49     if (var->bits_per_pixel <= 8 ||
    50     (var->bits_per_pixel == 16 && var->green.length == 5))
    51     diff --git a/arch/arm/mach-sa1100/assabet.c b/arch/arm/mach-sa1100/assabet.c
    52     index 375d3f77..82636701 100644
    53     --- a/arch/arm/mach-sa1100/assabet.c
    54     +++ b/arch/arm/mach-sa1100/assabet.c
    55     @@ -509,6 +509,9 @@ static void __init assabet_map_io(void)
    56     * Its called GPCLKR0 in my SA1110 manual.
    57     */
    58     Ser1SDCR0 |= SDCR0_SUS;
    59     + MSC1 = (MSC1 & ~0xffff) |
    60     + MSC_NonBrst | MSC_32BitStMem |
    61     + MSC_RdAcc(2) | MSC_WrAcc(2) | MSC_Rec(0);
    62    
    63     if (!machine_has_neponset())
    64     sa1100_register_uart_fns(&assabet_port_fns);
    65     diff --git a/arch/avr32/boot/u-boot/head.S b/arch/avr32/boot/u-boot/head.S
    66     index 4488fa27..2ffc298f 100644
    67     --- a/arch/avr32/boot/u-boot/head.S
    68     +++ b/arch/avr32/boot/u-boot/head.S
    69     @@ -8,6 +8,8 @@
    70     * published by the Free Software Foundation.
    71     */
    72     #include <asm/setup.h>
    73     +#include <asm/thread_info.h>
    74     +#include <asm/sysreg.h>
    75    
    76     /*
    77     * The kernel is loaded where we want it to be and all caches
    78     @@ -20,11 +22,6 @@
    79     .section .init.text,"ax"
    80     .global _start
    81     _start:
    82     - /* Check if the boot loader actually provided a tag table */
    83     - lddpc r0, magic_number
    84     - cp.w r12, r0
    85     - brne no_tag_table
    86     -
    87     /* Initialize .bss */
    88     lddpc r2, bss_start_addr
    89     lddpc r3, end_addr
    90     @@ -34,6 +31,25 @@ _start:
    91     cp r2, r3
    92     brlo 1b
    93    
    94     + /* Initialize status register */
    95     + lddpc r0, init_sr
    96     + mtsr SYSREG_SR, r0
    97     +
    98     + /* Set initial stack pointer */
    99     + lddpc sp, stack_addr
    100     + sub sp, -THREAD_SIZE
    101     +
    102     +#ifdef CONFIG_FRAME_POINTER
    103     + /* Mark last stack frame */
    104     + mov lr, 0
    105     + mov r7, 0
    106     +#endif
    107     +
    108     + /* Check if the boot loader actually provided a tag table */
    109     + lddpc r0, magic_number
    110     + cp.w r12, r0
    111     + brne no_tag_table
    112     +
    113     /*
    114     * Save the tag table address for later use. This must be done
    115     * _after_ .bss has been initialized...
    116     @@ -53,8 +69,15 @@ bss_start_addr:
    117     .long __bss_start
    118     end_addr:
    119     .long _end
    120     +init_sr:
    121     + .long 0x007f0000 /* Supervisor mode, everything masked */
    122     +stack_addr:
    123     + .long init_thread_union
    124     +panic_addr:
    125     + .long panic
    126    
    127     no_tag_table:
    128     sub r12, pc, (. - 2f)
    129     - bral panic
    130     + /* branch to panic() which can be far away with that construct */
    131     + lddpc pc, panic_addr
    132     2: .asciz "Boot loader didn't provide correct magic number\n"
    133     diff --git a/arch/avr32/kernel/entry-avr32b.S b/arch/avr32/kernel/entry-avr32b.S
    134     index 169268c4..a91e8980 100644
    135     --- a/arch/avr32/kernel/entry-avr32b.S
    136     +++ b/arch/avr32/kernel/entry-avr32b.S
    137     @@ -399,9 +399,10 @@ handle_critical:
    138     /* We should never get here... */
    139     bad_return:
    140     sub r12, pc, (. - 1f)
    141     - bral panic
    142     + lddpc pc, 2f
    143     .align 2
    144     1: .asciz "Return from critical exception!"
    145     +2: .long panic
    146    
    147     .align 1
    148     do_bus_error_write:
    149     diff --git a/arch/avr32/kernel/head.S b/arch/avr32/kernel/head.S
    150     index 6163bd0a..59eae6df 100644
    151     --- a/arch/avr32/kernel/head.S
    152     +++ b/arch/avr32/kernel/head.S
    153     @@ -10,33 +10,13 @@
    154     #include <linux/linkage.h>
    155    
    156     #include <asm/page.h>
    157     -#include <asm/thread_info.h>
    158     -#include <asm/sysreg.h>
    159    
    160     .section .init.text,"ax"
    161     .global kernel_entry
    162     kernel_entry:
    163     - /* Initialize status register */
    164     - lddpc r0, init_sr
    165     - mtsr SYSREG_SR, r0
    166     -
    167     - /* Set initial stack pointer */
    168     - lddpc sp, stack_addr
    169     - sub sp, -THREAD_SIZE
    170     -
    171     -#ifdef CONFIG_FRAME_POINTER
    172     - /* Mark last stack frame */
    173     - mov lr, 0
    174     - mov r7, 0
    175     -#endif
    176     -
    177     /* Start the show */
    178     lddpc pc, kernel_start_addr
    179    
    180     .align 2
    181     -init_sr:
    182     - .long 0x007f0000 /* Supervisor mode, everything masked */
    183     -stack_addr:
    184     - .long init_thread_union
    185     kernel_start_addr:
    186     .long start_kernel
    187     diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
    188     index e6de7879..32e2c811 100644
    189     --- a/arch/powerpc/kernel/signal_32.c
    190     +++ b/arch/powerpc/kernel/signal_32.c
    191     @@ -447,6 +447,12 @@ static int save_user_regs(struct pt_regs *regs, struct mcontext __user *frame,
    192     #endif /* CONFIG_ALTIVEC */
    193     if (copy_fpr_to_user(&frame->mc_fregs, current))
    194     return 1;
    195     +
    196     + /*
    197     + * Clear the MSR VSX bit to indicate there is no valid state attached
    198     + * to this context, except in the specific case below where we set it.
    199     + */
    200     + msr &= ~MSR_VSX;
    201     #ifdef CONFIG_VSX
    202     /*
    203     * Copy VSR 0-31 upper half from thread_struct to local
    204     @@ -459,15 +465,7 @@ static int save_user_regs(struct pt_regs *regs, struct mcontext __user *frame,
    205     if (copy_vsx_to_user(&frame->mc_vsregs, current))
    206     return 1;
    207     msr |= MSR_VSX;
    208     - } else if (!ctx_has_vsx_region)
    209     - /*
    210     - * With a small context structure we can't hold the VSX
    211     - * registers, hence clear the MSR value to indicate the state
    212     - * was not saved.
    213     - */
    214     - msr &= ~MSR_VSX;
    215     -
    216     -
    217     + }
    218     #endif /* CONFIG_VSX */
    219     #ifdef CONFIG_SPE
    220     /* save spe registers */
    221     diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
    222     index 2692efdb..3ad1b508 100644
    223     --- a/arch/powerpc/kernel/signal_64.c
    224     +++ b/arch/powerpc/kernel/signal_64.c
    225     @@ -117,6 +117,12 @@ static long setup_sigcontext(struct sigcontext __user *sc, struct pt_regs *regs,
    226     flush_fp_to_thread(current);
    227     /* copy fpr regs and fpscr */
    228     err |= copy_fpr_to_user(&sc->fp_regs, current);
    229     +
    230     + /*
    231     + * Clear the MSR VSX bit to indicate there is no valid state attached
    232     + * to this context, except in the specific case below where we set it.
    233     + */
    234     + msr &= ~MSR_VSX;
    235     #ifdef CONFIG_VSX
    236     /*
    237     * Copy VSX low doubleword to local buffer for formatting,
    238     diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
    239     index aeb82200..60662545 100644
    240     --- a/drivers/ata/ahci.c
    241     +++ b/drivers/ata/ahci.c
    242     @@ -402,6 +402,8 @@ static const struct pci_device_id ahci_pci_tbl[] = {
    243     .driver_data = board_ahci_yes_fbs }, /* 88se9172 on some Gigabyte */
    244     { PCI_DEVICE(0x1b4b, 0x91a3),
    245     .driver_data = board_ahci_yes_fbs },
    246     + { PCI_DEVICE(0x1b4b, 0x9230),
    247     + .driver_data = board_ahci_yes_fbs },
    248    
    249     /* Promise */
    250     { PCI_VDEVICE(PROMISE, 0x3f20), board_ahci }, /* PDC42819 */
    251     diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
    252     index 47a1fb85..60f41cd2 100644
    253     --- a/drivers/ata/libahci.c
    254     +++ b/drivers/ata/libahci.c
    255     @@ -1249,9 +1249,11 @@ int ahci_do_softreset(struct ata_link *link, unsigned int *class,
    256     {
    257     struct ata_port *ap = link->ap;
    258     struct ahci_host_priv *hpriv = ap->host->private_data;
    259     + struct ahci_port_priv *pp = ap->private_data;
    260     const char *reason = NULL;
    261     unsigned long now, msecs;
    262     struct ata_taskfile tf;
    263     + bool fbs_disabled = false;
    264     int rc;
    265    
    266     DPRINTK("ENTER\n");
    267     @@ -1261,6 +1263,16 @@ int ahci_do_softreset(struct ata_link *link, unsigned int *class,
    268     if (rc && rc != -EOPNOTSUPP)
    269     ata_link_warn(link, "failed to reset engine (errno=%d)\n", rc);
    270    
    271     + /*
    272     + * According to AHCI-1.2 9.3.9: if FBS is enable, software shall
    273     + * clear PxFBS.EN to '0' prior to issuing software reset to devices
    274     + * that is attached to port multiplier.
    275     + */
    276     + if (!ata_is_host_link(link) && pp->fbs_enabled) {
    277     + ahci_disable_fbs(ap);
    278     + fbs_disabled = true;
    279     + }
    280     +
    281     ata_tf_init(link->device, &tf);
    282    
    283     /* issue the first D2H Register FIS */
    284     @@ -1301,6 +1313,10 @@ int ahci_do_softreset(struct ata_link *link, unsigned int *class,
    285     } else
    286     *class = ahci_dev_classify(ap);
    287    
    288     + /* re-enable FBS if disabled before */
    289     + if (fbs_disabled)
    290     + ahci_enable_fbs(ap);
    291     +
    292     DPRINTK("EXIT, class=%u\n", *class);
    293     return 0;
    294    
    295     diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
    296     index 9cf09ae8..cd20cf1e 100644
    297     --- a/drivers/ata/libata-core.c
    298     +++ b/drivers/ata/libata-core.c
    299     @@ -4074,6 +4074,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
    300     { "TORiSAN DVD-ROM DRD-N216", NULL, ATA_HORKAGE_MAX_SEC_128 },
    301     { "QUANTUM DAT DAT72-000", NULL, ATA_HORKAGE_ATAPI_MOD16_DMA },
    302     { "Slimtype DVD A DS8A8SH", NULL, ATA_HORKAGE_MAX_SEC_LBA48 },
    303     + { "Slimtype DVD A DS8A9SH", NULL, ATA_HORKAGE_MAX_SEC_LBA48 },
    304    
    305     /* Devices we expect to fail diagnostics */
    306    
    307     diff --git a/drivers/ata/libata-transport.c b/drivers/ata/libata-transport.c
    308     index c3419048..92156774 100644
    309     --- a/drivers/ata/libata-transport.c
    310     +++ b/drivers/ata/libata-transport.c
    311     @@ -319,25 +319,25 @@ int ata_tport_add(struct device *parent,
    312     /*
    313     * ATA link attributes
    314     */
    315     +static int noop(int x) { return x; }
    316    
    317     -
    318     -#define ata_link_show_linkspeed(field) \
    319     +#define ata_link_show_linkspeed(field, format) \
    320     static ssize_t \
    321     show_ata_link_##field(struct device *dev, \
    322     struct device_attribute *attr, char *buf) \
    323     { \
    324     struct ata_link *link = transport_class_to_link(dev); \
    325     \
    326     - return sprintf(buf,"%s\n", sata_spd_string(fls(link->field))); \
    327     + return sprintf(buf, "%s\n", sata_spd_string(format(link->field))); \
    328     }
    329    
    330     -#define ata_link_linkspeed_attr(field) \
    331     - ata_link_show_linkspeed(field) \
    332     +#define ata_link_linkspeed_attr(field, format) \
    333     + ata_link_show_linkspeed(field, format) \
    334     static DEVICE_ATTR(field, S_IRUGO, show_ata_link_##field, NULL)
    335    
    336     -ata_link_linkspeed_attr(hw_sata_spd_limit);
    337     -ata_link_linkspeed_attr(sata_spd_limit);
    338     -ata_link_linkspeed_attr(sata_spd);
    339     +ata_link_linkspeed_attr(hw_sata_spd_limit, fls);
    340     +ata_link_linkspeed_attr(sata_spd_limit, fls);
    341     +ata_link_linkspeed_attr(sata_spd, noop);
    342    
    343    
    344     static DECLARE_TRANSPORT_CLASS(ata_link_class,
    345     diff --git a/drivers/block/loop.c b/drivers/block/loop.c
    346     index a4ddbae2..462fd182 100644
    347     --- a/drivers/block/loop.c
    348     +++ b/drivers/block/loop.c
    349     @@ -1636,7 +1636,7 @@ static int loop_add(struct loop_device **l, int i)
    350    
    351     lo->lo_queue = blk_alloc_queue(GFP_KERNEL);
    352     if (!lo->lo_queue)
    353     - goto out_free_dev;
    354     + goto out_free_idr;
    355    
    356     disk = lo->lo_disk = alloc_disk(1 << part_shift);
    357     if (!disk)
    358     @@ -1680,6 +1680,8 @@ static int loop_add(struct loop_device **l, int i)
    359    
    360     out_free_queue:
    361     blk_cleanup_queue(lo->lo_queue);
    362     +out_free_idr:
    363     + idr_remove(&loop_index_idr, i);
    364     out_free_dev:
    365     kfree(lo);
    366     out:
    367     diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
    368     index 4ed7bf9b..0ed5df4d 100644
    369     --- a/drivers/block/xen-blkback/blkback.c
    370     +++ b/drivers/block/xen-blkback/blkback.c
    371     @@ -401,6 +401,8 @@ static int dispatch_discard_io(struct xen_blkif *blkif,
    372     unsigned long secure;
    373     struct phys_req preq;
    374    
    375     + xen_blkif_get(blkif);
    376     +
    377     preq.sector_number = req->u.discard.sector_number;
    378     preq.nr_sects = req->u.discard.nr_sectors;
    379    
    380     @@ -413,7 +415,6 @@ static int dispatch_discard_io(struct xen_blkif *blkif,
    381     }
    382     blkif->st_ds_req++;
    383    
    384     - xen_blkif_get(blkif);
    385     secure = (blkif->vbd.discard_secure &&
    386     (req->u.discard.flag & BLKIF_DISCARD_SECURE)) ?
    387     BLKDEV_DISCARD_SECURE : 0;
    388     diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
    389     index 0e359225..5647ce4b 100644
    390     --- a/drivers/gpu/drm/i915/intel_display.c
    391     +++ b/drivers/gpu/drm/i915/intel_display.c
    392     @@ -6377,7 +6377,9 @@ static void i9xx_update_cursor(struct drm_crtc *crtc, u32 base)
    393     intel_crtc->cursor_visible = visible;
    394     }
    395     /* and commit changes on next vblank */
    396     + POSTING_READ(CURCNTR(pipe));
    397     I915_WRITE(CURBASE(pipe), base);
    398     + POSTING_READ(CURBASE(pipe));
    399     }
    400    
    401     static void ivb_update_cursor(struct drm_crtc *crtc, u32 base)
    402     @@ -6402,7 +6404,9 @@ static void ivb_update_cursor(struct drm_crtc *crtc, u32 base)
    403     intel_crtc->cursor_visible = visible;
    404     }
    405     /* and commit changes on next vblank */
    406     + POSTING_READ(CURCNTR_IVB(pipe));
    407     I915_WRITE(CURBASE_IVB(pipe), base);
    408     + POSTING_READ(CURBASE_IVB(pipe));
    409     }
    410    
    411     /* If no-part of the cursor is visible on the framebuffer, then the GPU may hang... */
    412     diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
    413     index ed52a6f4..2f46bbfb 100644
    414     --- a/drivers/gpu/drm/nouveau/nouveau_gem.c
    415     +++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
    416     @@ -281,7 +281,8 @@ validate_fini_list(struct list_head *list, struct nouveau_fence *fence)
    417     list_for_each_safe(entry, tmp, list) {
    418     nvbo = list_entry(entry, struct nouveau_bo, entry);
    419    
    420     - nouveau_bo_fence(nvbo, fence);
    421     + if (likely(fence))
    422     + nouveau_bo_fence(nvbo, fence);
    423    
    424     if (unlikely(nvbo->validate_mapped)) {
    425     ttm_bo_kunmap(&nvbo->kmap);
    426     diff --git a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
    427     index 9760e5ad..b44bbf50 100644
    428     --- a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
    429     +++ b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
    430     @@ -416,6 +416,7 @@ int radeon_crtc_do_set_base(struct drm_crtc *crtc,
    431     /* Pin framebuffer & get tilling informations */
    432     obj = radeon_fb->obj;
    433     rbo = gem_to_radeon_bo(obj);
    434     +retry:
    435     r = radeon_bo_reserve(rbo, false);
    436     if (unlikely(r != 0))
    437     return r;
    438     @@ -424,6 +425,33 @@ int radeon_crtc_do_set_base(struct drm_crtc *crtc,
    439     &base);
    440     if (unlikely(r != 0)) {
    441     radeon_bo_unreserve(rbo);
    442     +
    443     + /* On old GPU like RN50 with little vram pining can fails because
    444     + * current fb is taking all space needed. So instead of unpining
    445     + * the old buffer after pining the new one, first unpin old one
    446     + * and then retry pining new one.
    447     + *
    448     + * As only master can set mode only master can pin and it is
    449     + * unlikely the master client will race with itself especialy
    450     + * on those old gpu with single crtc.
    451     + *
    452     + * We don't shutdown the display controller because new buffer
    453     + * will end up in same spot.
    454     + */
    455     + if (!atomic && fb && fb != crtc->fb) {
    456     + struct radeon_bo *old_rbo;
    457     + unsigned long nsize, osize;
    458     +
    459     + old_rbo = gem_to_radeon_bo(to_radeon_framebuffer(fb)->obj);
    460     + osize = radeon_bo_size(old_rbo);
    461     + nsize = radeon_bo_size(rbo);
    462     + if (nsize <= osize && !radeon_bo_reserve(old_rbo, false)) {
    463     + radeon_bo_unpin(old_rbo);
    464     + radeon_bo_unreserve(old_rbo);
    465     + fb = NULL;
    466     + goto retry;
    467     + }
    468     + }
    469     return -EINVAL;
    470     }
    471     radeon_bo_get_tiling_flags(rbo, &tiling_flags, NULL);
    472     diff --git a/drivers/gpu/drm/radeon/sid.h b/drivers/gpu/drm/radeon/sid.h
    473     index 1767ae7f..a9fcbe44 100644
    474     --- a/drivers/gpu/drm/radeon/sid.h
    475     +++ b/drivers/gpu/drm/radeon/sid.h
    476     @@ -165,7 +165,7 @@
    477     #define NOOFGROUPS_SHIFT 12
    478     #define NOOFGROUPS_MASK 0x00001000
    479    
    480     -#define MC_SEQ_TRAIN_WAKEUP_CNTL 0x2808
    481     +#define MC_SEQ_TRAIN_WAKEUP_CNTL 0x28e8
    482     #define TRAIN_DONE_D0 (1 << 30)
    483     #define TRAIN_DONE_D1 (1 << 31)
    484    
    485     diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
    486     index f8187ead..2d692626 100644
    487     --- a/drivers/gpu/drm/ttm/ttm_bo_util.c
    488     +++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
    489     @@ -342,7 +342,9 @@ int ttm_bo_move_memcpy(struct ttm_buffer_object *bo,
    490     if (old_iomap == NULL && ttm == NULL)
    491     goto out2;
    492    
    493     - if (ttm->state == tt_unpopulated) {
    494     + /* TTM might be null for moves within the same region.
    495     + */
    496     + if (ttm && ttm->state == tt_unpopulated) {
    497     ret = ttm->bdev->driver->ttm_tt_populate(ttm);
    498     if (ret)
    499     goto out1;
    500     diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
    501     index 899c7120..9421f643 100644
    502     --- a/drivers/hid/hid-apple.c
    503     +++ b/drivers/hid/hid-apple.c
    504     @@ -48,6 +48,12 @@ module_param(iso_layout, uint, 0644);
    505     MODULE_PARM_DESC(iso_layout, "Enable/Disable hardcoded ISO-layout of the keyboard. "
    506     "(0 = disabled, [1] = enabled)");
    507    
    508     +static unsigned int swap_opt_cmd = 0;
    509     +module_param(swap_opt_cmd, uint, 0644);
    510     +MODULE_PARM_DESC(swap_opt_cmd, "Swap the Option (\"Alt\") and Command (\"Flag\") keys. "
    511     + "(For people who want to keep Windows PC keyboard muscle memory. "
    512     + "[0] = as-is, Mac layout. 1 = swapped, Windows layout.)");
    513     +
    514     struct apple_sc {
    515     unsigned long quirks;
    516     unsigned int fn_on;
    517     @@ -152,6 +158,14 @@ static const struct apple_key_translation apple_iso_keyboard[] = {
    518     { }
    519     };
    520    
    521     +static const struct apple_key_translation swapped_option_cmd_keys[] = {
    522     + { KEY_LEFTALT, KEY_LEFTMETA },
    523     + { KEY_LEFTMETA, KEY_LEFTALT },
    524     + { KEY_RIGHTALT, KEY_RIGHTMETA },
    525     + { KEY_RIGHTMETA,KEY_RIGHTALT },
    526     + { }
    527     +};
    528     +
    529     static const struct apple_key_translation *apple_find_translation(
    530     const struct apple_key_translation *table, u16 from)
    531     {
    532     @@ -244,6 +258,14 @@ static int hidinput_apple_event(struct hid_device *hid, struct input_dev *input,
    533     }
    534     }
    535    
    536     + if (swap_opt_cmd) {
    537     + trans = apple_find_translation(swapped_option_cmd_keys, usage->code);
    538     + if (trans) {
    539     + input_event(input, usage->type, trans->to, value);
    540     + return 1;
    541     + }
    542     + }
    543     +
    544     return 0;
    545     }
    546    
    547     diff --git a/drivers/hid/hid-roccat-kovaplus.c b/drivers/hid/hid-roccat-kovaplus.c
    548     index 112d9341..1973cff8 100644
    549     --- a/drivers/hid/hid-roccat-kovaplus.c
    550     +++ b/drivers/hid/hid-roccat-kovaplus.c
    551     @@ -623,9 +623,13 @@ static void kovaplus_keep_values_up_to_date(struct kovaplus_device *kovaplus,
    552     break;
    553     case KOVAPLUS_MOUSE_REPORT_BUTTON_TYPE_CPI:
    554     kovaplus->actual_cpi = kovaplus_convert_event_cpi(button_report->data1);
    555     + break;
    556     case KOVAPLUS_MOUSE_REPORT_BUTTON_TYPE_SENSITIVITY:
    557     kovaplus->actual_x_sensitivity = button_report->data1;
    558     kovaplus->actual_y_sensitivity = button_report->data2;
    559     + break;
    560     + default:
    561     + break;
    562     }
    563     }
    564    
    565     diff --git a/drivers/infiniband/hw/ipath/ipath_user_sdma.c b/drivers/infiniband/hw/ipath/ipath_user_sdma.c
    566     index f5cb13b2..cc04b7ba 100644
    567     --- a/drivers/infiniband/hw/ipath/ipath_user_sdma.c
    568     +++ b/drivers/infiniband/hw/ipath/ipath_user_sdma.c
    569     @@ -280,9 +280,7 @@ static int ipath_user_sdma_pin_pages(const struct ipath_devdata *dd,
    570     int j;
    571     int ret;
    572    
    573     - ret = get_user_pages(current, current->mm, addr,
    574     - npages, 0, 1, pages, NULL);
    575     -
    576     + ret = get_user_pages_fast(addr, npages, 0, pages);
    577     if (ret != npages) {
    578     int i;
    579    
    580     @@ -811,10 +809,7 @@ int ipath_user_sdma_writev(struct ipath_devdata *dd,
    581     while (dim) {
    582     const int mxp = 8;
    583    
    584     - down_write(&current->mm->mmap_sem);
    585     ret = ipath_user_sdma_queue_pkts(dd, pq, &list, iov, dim, mxp);
    586     - up_write(&current->mm->mmap_sem);
    587     -
    588     if (ret <= 0)
    589     goto done_unlock;
    590     else {
    591     diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
    592     index 5f306f79..0ec9abbe 100644
    593     --- a/drivers/input/serio/i8042-x86ia64io.h
    594     +++ b/drivers/input/serio/i8042-x86ia64io.h
    595     @@ -765,6 +765,7 @@ static struct pnp_device_id pnp_kbd_devids[] = {
    596     { .id = "CPQA0D7", .driver_data = 0 },
    597     { .id = "", },
    598     };
    599     +MODULE_DEVICE_TABLE(pnp, pnp_kbd_devids);
    600    
    601     static struct pnp_driver i8042_pnp_kbd_driver = {
    602     .name = "i8042 kbd",
    603     @@ -786,6 +787,7 @@ static struct pnp_device_id pnp_aux_devids[] = {
    604     { .id = "SYN0801", .driver_data = 0 },
    605     { .id = "", },
    606     };
    607     +MODULE_DEVICE_TABLE(pnp, pnp_aux_devids);
    608    
    609     static struct pnp_driver i8042_pnp_aux_driver = {
    610     .name = "i8042 aux",
    611     diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
    612     index f220a695..d509f236 100644
    613     --- a/drivers/md/dm-table.c
    614     +++ b/drivers/md/dm-table.c
    615     @@ -581,14 +581,28 @@ static int adjoin(struct dm_table *table, struct dm_target *ti)
    616    
    617     /*
    618     * Used to dynamically allocate the arg array.
    619     + *
    620     + * We do first allocation with GFP_NOIO because dm-mpath and dm-thin must
    621     + * process messages even if some device is suspended. These messages have a
    622     + * small fixed number of arguments.
    623     + *
    624     + * On the other hand, dm-switch needs to process bulk data using messages and
    625     + * excessive use of GFP_NOIO could cause trouble.
    626     */
    627     static char **realloc_argv(unsigned *array_size, char **old_argv)
    628     {
    629     char **argv;
    630     unsigned new_size;
    631     + gfp_t gfp;
    632    
    633     - new_size = *array_size ? *array_size * 2 : 64;
    634     - argv = kmalloc(new_size * sizeof(*argv), GFP_KERNEL);
    635     + if (*array_size) {
    636     + new_size = *array_size * 2;
    637     + gfp = GFP_KERNEL;
    638     + } else {
    639     + new_size = 8;
    640     + gfp = GFP_NOIO;
    641     + }
    642     + argv = kmalloc(new_size * sizeof(*argv), gfp);
    643     if (argv) {
    644     memcpy(argv, old_argv, *array_size * sizeof(*argv));
    645     *array_size = new_size;
    646     diff --git a/drivers/md/md.c b/drivers/md/md.c
    647     index 7b45b5e1..e63ca864 100644
    648     --- a/drivers/md/md.c
    649     +++ b/drivers/md/md.c
    650     @@ -3507,6 +3507,7 @@ level_store(struct mddev *mddev, const char *buf, size_t len)
    651     mddev->in_sync = 1;
    652     del_timer_sync(&mddev->safemode_timer);
    653     }
    654     + blk_set_stacking_limits(&mddev->queue->limits);
    655     pers->run(mddev);
    656     mddev_resume(mddev);
    657     set_bit(MD_CHANGE_DEVS, &mddev->flags);
    658     diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
    659     index 9ec51cec..0f000e60 100644
    660     --- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
    661     +++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
    662     @@ -227,8 +227,6 @@ static void dma_irq_callback(void *param)
    663     struct gpmi_nand_data *this = param;
    664     struct completion *dma_c = &this->dma_done;
    665    
    666     - complete(dma_c);
    667     -
    668     switch (this->dma_type) {
    669     case DMA_FOR_COMMAND:
    670     dma_unmap_sg(this->dev, &this->cmd_sgl, 1, DMA_TO_DEVICE);
    671     @@ -253,6 +251,8 @@ static void dma_irq_callback(void *param)
    672     default:
    673     pr_err("in wrong DMA operation.\n");
    674     }
    675     +
    676     + complete(dma_c);
    677     }
    678    
    679     int start_dma_without_bch_irq(struct gpmi_nand_data *this,
    680     diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
    681     index eb9f5fb0..e50a0b48 100644
    682     --- a/drivers/mtd/nand/nand_base.c
    683     +++ b/drivers/mtd/nand/nand_base.c
    684     @@ -2888,10 +2888,21 @@ static int nand_flash_detect_onfi(struct mtd_info *mtd, struct nand_chip *chip,
    685     sanitize_string(p->model, sizeof(p->model));
    686     if (!mtd->name)
    687     mtd->name = p->model;
    688     +
    689     mtd->writesize = le32_to_cpu(p->byte_per_page);
    690     - mtd->erasesize = le32_to_cpu(p->pages_per_block) * mtd->writesize;
    691     +
    692     + /*
    693     + * pages_per_block and blocks_per_lun may not be a power-of-2 size
    694     + * (don't ask me who thought of this...). MTD assumes that these
    695     + * dimensions will be power-of-2, so just truncate the remaining area.
    696     + */
    697     + mtd->erasesize = 1 << (fls(le32_to_cpu(p->pages_per_block)) - 1);
    698     + mtd->erasesize *= mtd->writesize;
    699     +
    700     mtd->oobsize = le16_to_cpu(p->spare_bytes_per_page);
    701     - chip->chipsize = le32_to_cpu(p->blocks_per_lun);
    702     +
    703     + /* See erasesize comment */
    704     + chip->chipsize = 1 << (fls(le32_to_cpu(p->blocks_per_lun)) - 1);
    705     chip->chipsize *= (uint64_t)mtd->erasesize * p->lun_count;
    706     *busw = 0;
    707     if (le16_to_cpu(p->features) & 1)
    708     diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
    709     index e2131ca6..eb4014a2 100644
    710     --- a/drivers/net/can/flexcan.c
    711     +++ b/drivers/net/can/flexcan.c
    712     @@ -667,7 +667,6 @@ static int flexcan_chip_start(struct net_device *dev)
    713     {
    714     struct flexcan_priv *priv = netdev_priv(dev);
    715     struct flexcan_regs __iomem *regs = priv->base;
    716     - unsigned int i;
    717     int err;
    718     u32 reg_mcr, reg_ctrl;
    719    
    720     @@ -735,17 +734,6 @@ static int flexcan_chip_start(struct net_device *dev)
    721     netdev_dbg(dev, "%s: writing ctrl=0x%08x", __func__, reg_ctrl);
    722     flexcan_write(reg_ctrl, &regs->ctrl);
    723    
    724     - for (i = 0; i < ARRAY_SIZE(regs->cantxfg); i++) {
    725     - flexcan_write(0, &regs->cantxfg[i].can_ctrl);
    726     - flexcan_write(0, &regs->cantxfg[i].can_id);
    727     - flexcan_write(0, &regs->cantxfg[i].data[0]);
    728     - flexcan_write(0, &regs->cantxfg[i].data[1]);
    729     -
    730     - /* put MB into rx queue */
    731     - flexcan_write(FLEXCAN_MB_CNT_CODE(0x4),
    732     - &regs->cantxfg[i].can_ctrl);
    733     - }
    734     -
    735     /* Abort any pending TX, mark Mailbox as INACTIVE */
    736     flexcan_write(FLEXCAN_MB_CNT_CODE(0x4),
    737     &regs->cantxfg[FLEXCAN_TX_BUF_ID].can_ctrl);
    738     diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
    739     index 4be8ccc8..daf55ba8 100644
    740     --- a/drivers/net/wireless/mwifiex/sdio.c
    741     +++ b/drivers/net/wireless/mwifiex/sdio.c
    742     @@ -938,7 +938,10 @@ static int mwifiex_decode_rx_packet(struct mwifiex_adapter *adapter,
    743     struct sk_buff *skb, u32 upld_typ)
    744     {
    745     u8 *cmd_buf;
    746     + __le16 *curr_ptr = (__le16 *)skb->data;
    747     + u16 pkt_len = le16_to_cpu(*curr_ptr);
    748    
    749     + skb_trim(skb, pkt_len);
    750     skb_pull(skb, INTF_HEADER_LEN);
    751    
    752     switch (upld_typ) {
    753     diff --git a/drivers/net/wireless/prism54/islpci_dev.c b/drivers/net/wireless/prism54/islpci_dev.c
    754     index 5970ff6f..d498b02f 100644
    755     --- a/drivers/net/wireless/prism54/islpci_dev.c
    756     +++ b/drivers/net/wireless/prism54/islpci_dev.c
    757     @@ -811,6 +811,10 @@ static const struct net_device_ops islpci_netdev_ops = {
    758     .ndo_validate_addr = eth_validate_addr,
    759     };
    760    
    761     +static struct device_type wlan_type = {
    762     + .name = "wlan",
    763     +};
    764     +
    765     struct net_device *
    766     islpci_setup(struct pci_dev *pdev)
    767     {
    768     @@ -821,9 +825,8 @@ islpci_setup(struct pci_dev *pdev)
    769     return ndev;
    770    
    771     pci_set_drvdata(pdev, ndev);
    772     -#if defined(SET_NETDEV_DEV)
    773     SET_NETDEV_DEV(ndev, &pdev->dev);
    774     -#endif
    775     + SET_NETDEV_DEVTYPE(ndev, &wlan_type);
    776    
    777     /* setup the structure members */
    778     ndev->base_addr = pci_resource_start(pdev, 0);
    779     diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
    780     index 0ea85f46..131b22b8 100644
    781     --- a/drivers/net/wireless/rt2x00/rt2400pci.c
    782     +++ b/drivers/net/wireless/rt2x00/rt2400pci.c
    783     @@ -1253,7 +1253,7 @@ static void rt2400pci_fill_rxdone(struct queue_entry *entry,
    784     */
    785     rxdesc->timestamp = ((u64)rx_high << 32) | rx_low;
    786     rxdesc->signal = rt2x00_get_field32(word2, RXD_W2_SIGNAL) & ~0x08;
    787     - rxdesc->rssi = rt2x00_get_field32(word2, RXD_W3_RSSI) -
    788     + rxdesc->rssi = rt2x00_get_field32(word3, RXD_W3_RSSI) -
    789     entry->queue->rt2x00dev->rssi_offset;
    790     rxdesc->size = rt2x00_get_field32(word0, RXD_W0_DATABYTE_COUNT);
    791    
    792     diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c b/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
    793     index 025bdc2e..4f7f822b 100644
    794     --- a/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
    795     +++ b/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
    796     @@ -762,7 +762,7 @@ static long _rtl92c_signal_scale_mapping(struct ieee80211_hw *hw,
    797    
    798     static void _rtl92c_query_rxphystatus(struct ieee80211_hw *hw,
    799     struct rtl_stats *pstats,
    800     - struct rx_desc_92c *pdesc,
    801     + struct rx_desc_92c *p_desc,
    802     struct rx_fwinfo_92c *p_drvinfo,
    803     bool packet_match_bssid,
    804     bool packet_toself,
    805     @@ -777,11 +777,11 @@ static void _rtl92c_query_rxphystatus(struct ieee80211_hw *hw,
    806     u32 rssi, total_rssi = 0;
    807     bool in_powersavemode = false;
    808     bool is_cck_rate;
    809     + u8 *pdesc = (u8 *)p_desc;
    810    
    811     - is_cck_rate = RX_HAL_IS_CCK_RATE(pdesc);
    812     + is_cck_rate = RX_HAL_IS_CCK_RATE(p_desc);
    813     pstats->packet_matchbssid = packet_match_bssid;
    814     pstats->packet_toself = packet_toself;
    815     - pstats->is_cck = is_cck_rate;
    816     pstats->packet_beacon = packet_beacon;
    817     pstats->is_cck = is_cck_rate;
    818     pstats->RX_SIGQ[0] = -1;
    819     diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
    820     index 9adb21a1..2fd82970 100644
    821     --- a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
    822     +++ b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
    823     @@ -303,10 +303,10 @@ out:
    824     bool rtl92cu_rx_query_desc(struct ieee80211_hw *hw,
    825     struct rtl_stats *stats,
    826     struct ieee80211_rx_status *rx_status,
    827     - u8 *p_desc, struct sk_buff *skb)
    828     + u8 *pdesc, struct sk_buff *skb)
    829     {
    830     struct rx_fwinfo_92c *p_drvinfo;
    831     - struct rx_desc_92c *pdesc = (struct rx_desc_92c *)p_desc;
    832     + struct rx_desc_92c *p_desc = (struct rx_desc_92c *)pdesc;
    833     u32 phystatus = GET_RX_DESC_PHY_STATUS(pdesc);
    834    
    835     stats->length = (u16) GET_RX_DESC_PKT_LEN(pdesc);
    836     @@ -345,11 +345,11 @@ bool rtl92cu_rx_query_desc(struct ieee80211_hw *hw,
    837     if (phystatus) {
    838     p_drvinfo = (struct rx_fwinfo_92c *)(skb->data +
    839     stats->rx_bufshift);
    840     - rtl92c_translate_rx_signal_stuff(hw, skb, stats, pdesc,
    841     + rtl92c_translate_rx_signal_stuff(hw, skb, stats, p_desc,
    842     p_drvinfo);
    843     }
    844     /*rx_status->qual = stats->signal; */
    845     - rx_status->signal = stats->rssi + 10;
    846     + rx_status->signal = stats->recvsignalpower + 10;
    847     /*rx_status->noise = -stats->noise; */
    848     return true;
    849     }
    850     diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/trx.c b/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
    851     index a7f6126e..1a2bbc2b 100644
    852     --- a/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
    853     +++ b/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
    854     @@ -529,7 +529,7 @@ bool rtl92de_rx_query_desc(struct ieee80211_hw *hw, struct rtl_stats *stats,
    855     p_drvinfo);
    856     }
    857     /*rx_status->qual = stats->signal; */
    858     - rx_status->signal = stats->rssi + 10;
    859     + rx_status->signal = stats->recvsignalpower + 10;
    860     /*rx_status->noise = -stats->noise; */
    861     return true;
    862     }
    863     diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/rf.c b/drivers/net/wireless/rtlwifi/rtl8192se/rf.c
    864     index 08c2f562..c405f967 100644
    865     --- a/drivers/net/wireless/rtlwifi/rtl8192se/rf.c
    866     +++ b/drivers/net/wireless/rtlwifi/rtl8192se/rf.c
    867     @@ -268,7 +268,7 @@ static void _rtl92s_get_txpower_writeval_byregulatory(struct ieee80211_hw *hw,
    868     rtlefuse->pwrgroup_ht40
    869     [RF90_PATH_A][chnl - 1]) {
    870     pwrdiff_limit[i] =
    871     - rtlefuse->pwrgroup_ht20
    872     + rtlefuse->pwrgroup_ht40
    873     [RF90_PATH_A][chnl - 1];
    874     }
    875     } else {
    876     diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
    877     index 2fd3d13b..94bbce82 100644
    878     --- a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
    879     +++ b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
    880     @@ -582,7 +582,7 @@ bool rtl92se_rx_query_desc(struct ieee80211_hw *hw, struct rtl_stats *stats,
    881     }
    882    
    883     /*rx_status->qual = stats->signal; */
    884     - rx_status->signal = stats->rssi + 10;
    885     + rx_status->signal = stats->recvsignalpower + 10;
    886     /*rx_status->noise = -stats->noise; */
    887    
    888     return true;
    889     diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
    890     index e0610bda..7e41b70a 100644
    891     --- a/drivers/pci/pcie/portdrv_pci.c
    892     +++ b/drivers/pci/pcie/portdrv_pci.c
    893     @@ -151,7 +151,6 @@ static int __devinit pcie_portdrv_probe(struct pci_dev *dev,
    894     static void pcie_portdrv_remove(struct pci_dev *dev)
    895     {
    896     pcie_port_device_remove(dev);
    897     - pci_disable_device(dev);
    898     }
    899    
    900     static int error_detected_iter(struct device *device, void *data)
    901     diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
    902     index 8334dadc..be56590b 100644
    903     --- a/drivers/s390/net/qeth_core_main.c
    904     +++ b/drivers/s390/net/qeth_core_main.c
    905     @@ -4357,7 +4357,7 @@ int qeth_snmp_command(struct qeth_card *card, char __user *udata)
    906     struct qeth_cmd_buffer *iob;
    907     struct qeth_ipa_cmd *cmd;
    908     struct qeth_snmp_ureq *ureq;
    909     - int req_len;
    910     + unsigned int req_len;
    911     struct qeth_arp_query_info qinfo = {0, };
    912     int rc = 0;
    913    
    914     @@ -4373,6 +4373,10 @@ int qeth_snmp_command(struct qeth_card *card, char __user *udata)
    915     /* skip 4 bytes (data_len struct member) to get req_len */
    916     if (copy_from_user(&req_len, udata + sizeof(int), sizeof(int)))
    917     return -EFAULT;
    918     + if (req_len > (QETH_BUFSIZE - IPA_PDU_HEADER_SIZE -
    919     + sizeof(struct qeth_ipacmd_hdr) -
    920     + sizeof(struct qeth_ipacmd_setadpparms_hdr)))
    921     + return -EINVAL;
    922     ureq = memdup_user(udata, req_len + sizeof(struct qeth_snmp_ureq_hdr));
    923     if (IS_ERR(ureq)) {
    924     QETH_CARD_TEXT(card, 2, "snmpnome");
    925     diff --git a/drivers/staging/media/lirc/lirc_zilog.c b/drivers/staging/media/lirc/lirc_zilog.c
    926     index 76ea4a8f..56a96d32 100644
    927     --- a/drivers/staging/media/lirc/lirc_zilog.c
    928     +++ b/drivers/staging/media/lirc/lirc_zilog.c
    929     @@ -61,6 +61,9 @@
    930     #include <media/lirc_dev.h>
    931     #include <media/lirc.h>
    932    
    933     +/* Max transfer size done by I2C transfer functions */
    934     +#define MAX_XFER_SIZE 64
    935     +
    936     struct IR;
    937    
    938     struct IR_rx {
    939     @@ -942,7 +945,14 @@ static ssize_t read(struct file *filep, char *outbuf, size_t n, loff_t *ppos)
    940     schedule();
    941     set_current_state(TASK_INTERRUPTIBLE);
    942     } else {
    943     - unsigned char buf[rbuf->chunk_size];
    944     + unsigned char buf[MAX_XFER_SIZE];
    945     +
    946     + if (rbuf->chunk_size > sizeof(buf)) {
    947     + zilog_error("chunk_size is too big (%d)!\n",
    948     + rbuf->chunk_size);
    949     + ret = -EINVAL;
    950     + break;
    951     + }
    952     m = lirc_buffer_read(rbuf, buf);
    953     if (m == rbuf->chunk_size) {
    954     ret = copy_to_user((void *)outbuf+written, buf,
    955     diff --git a/drivers/staging/tidspbridge/Kconfig b/drivers/staging/tidspbridge/Kconfig
    956     index 0dd479f5..f67c78e5 100644
    957     --- a/drivers/staging/tidspbridge/Kconfig
    958     +++ b/drivers/staging/tidspbridge/Kconfig
    959     @@ -4,7 +4,7 @@
    960    
    961     menuconfig TIDSPBRIDGE
    962     tristate "DSP Bridge driver"
    963     - depends on ARCH_OMAP3
    964     + depends on ARCH_OMAP3 && BROKEN
    965     select OMAP_MBOX_FWK
    966     help
    967     DSP/BIOS Bridge is designed for platforms that contain a GPP and
    968     diff --git a/drivers/staging/vt6656/baseband.c b/drivers/staging/vt6656/baseband.c
    969     index 06f27f62..858e2a8e 100644
    970     --- a/drivers/staging/vt6656/baseband.c
    971     +++ b/drivers/staging/vt6656/baseband.c
    972     @@ -976,6 +976,7 @@ BOOL BBbVT3184Init(PSDevice pDevice)
    973     PBYTE pbyAgc;
    974     WORD wLengthAgc;
    975     BYTE abyArray[256];
    976     + u8 data;
    977    
    978     ntStatus = CONTROLnsRequestIn(pDevice,
    979     MESSAGE_TYPE_READ,
    980     @@ -1144,6 +1145,16 @@ else {
    981     ControlvWriteByte(pDevice,MESSAGE_REQUEST_BBREG,0x0D,0x01);
    982    
    983     RFbRFTableDownload(pDevice);
    984     +
    985     + /* Fix for TX USB resets from vendors driver */
    986     + CONTROLnsRequestIn(pDevice, MESSAGE_TYPE_READ, USB_REG4,
    987     + MESSAGE_REQUEST_MEM, sizeof(data), &data);
    988     +
    989     + data |= 0x2;
    990     +
    991     + CONTROLnsRequestOut(pDevice, MESSAGE_TYPE_WRITE, USB_REG4,
    992     + MESSAGE_REQUEST_MEM, sizeof(data), &data);
    993     +
    994     return TRUE;//ntStatus;
    995     }
    996    
    997     diff --git a/drivers/staging/vt6656/rndis.h b/drivers/staging/vt6656/rndis.h
    998     index fccf7e98..dcf7bf54 100644
    999     --- a/drivers/staging/vt6656/rndis.h
    1000     +++ b/drivers/staging/vt6656/rndis.h
    1001     @@ -69,6 +69,7 @@
    1002    
    1003     #define VIAUSB20_PACKET_HEADER 0x04
    1004    
    1005     +#define USB_REG4 0x604
    1006    
    1007     /*--------------------- Export Classes ----------------------------*/
    1008    
    1009     diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
    1010     index a0fc7b9e..b54f6ecf 100644
    1011     --- a/drivers/target/iscsi/iscsi_target_auth.c
    1012     +++ b/drivers/target/iscsi/iscsi_target_auth.c
    1013     @@ -174,6 +174,7 @@ static int chap_server_compute_md5(
    1014     unsigned char client_digest[MD5_SIGNATURE_SIZE];
    1015     unsigned char server_digest[MD5_SIGNATURE_SIZE];
    1016     unsigned char chap_n[MAX_CHAP_N_SIZE], chap_r[MAX_RESPONSE_LENGTH];
    1017     + size_t compare_len;
    1018     struct iscsi_chap *chap = conn->auth_protocol;
    1019     struct crypto_hash *tfm;
    1020     struct hash_desc desc;
    1021     @@ -212,7 +213,9 @@ static int chap_server_compute_md5(
    1022     goto out;
    1023     }
    1024    
    1025     - if (memcmp(chap_n, auth->userid, strlen(auth->userid)) != 0) {
    1026     + /* Include the terminating NULL in the compare */
    1027     + compare_len = strlen(auth->userid) + 1;
    1028     + if (strncmp(chap_n, auth->userid, compare_len) != 0) {
    1029     pr_err("CHAP_N values do not match!\n");
    1030     goto out;
    1031     }
    1032     diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
    1033     index 2dba448c..60470ee9 100644
    1034     --- a/drivers/target/iscsi/iscsi_target_nego.c
    1035     +++ b/drivers/target/iscsi/iscsi_target_nego.c
    1036     @@ -89,7 +89,7 @@ int extract_param(
    1037     if (len < 0)
    1038     return -1;
    1039    
    1040     - if (len > max_length) {
    1041     + if (len >= max_length) {
    1042     pr_err("Length of input: %d exceeds max_length:"
    1043     " %d\n", len, max_length);
    1044     return -1;
    1045     diff --git a/drivers/video/backlight/atmel-pwm-bl.c b/drivers/video/backlight/atmel-pwm-bl.c
    1046     index 0443a4f7..4d2bbd89 100644
    1047     --- a/drivers/video/backlight/atmel-pwm-bl.c
    1048     +++ b/drivers/video/backlight/atmel-pwm-bl.c
    1049     @@ -70,7 +70,7 @@ static int atmel_pwm_bl_set_intensity(struct backlight_device *bd)
    1050     static int atmel_pwm_bl_get_intensity(struct backlight_device *bd)
    1051     {
    1052     struct atmel_pwm_bl *pwmbl = bl_get_data(bd);
    1053     - u8 intensity;
    1054     + u32 intensity;
    1055    
    1056     if (pwmbl->pdata->pwm_active_low) {
    1057     intensity = pwm_channel_readl(&pwmbl->pwmc, PWM_CDTY) -
    1058     @@ -80,7 +80,7 @@ static int atmel_pwm_bl_get_intensity(struct backlight_device *bd)
    1059     pwm_channel_readl(&pwmbl->pwmc, PWM_CDTY);
    1060     }
    1061    
    1062     - return intensity;
    1063     + return intensity & 0xffff;
    1064     }
    1065    
    1066     static int atmel_pwm_bl_init_pwm(struct atmel_pwm_bl *pwmbl)
    1067     diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c
    1068     index 10f5e0b4..901c3d74 100644
    1069     --- a/fs/devpts/inode.c
    1070     +++ b/fs/devpts/inode.c
    1071     @@ -475,6 +475,7 @@ static void devpts_kill_sb(struct super_block *sb)
    1072     {
    1073     struct pts_fs_info *fsi = DEVPTS_SB(sb);
    1074    
    1075     + ida_destroy(&fsi->allocated_ptys);
    1076     kfree(fsi);
    1077     kill_litter_super(sb);
    1078     }
    1079     diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
    1080     index b1aa7fd4..01f2cf34 100644
    1081     --- a/fs/ext4/xattr.c
    1082     +++ b/fs/ext4/xattr.c
    1083     @@ -1270,6 +1270,7 @@ retry:
    1084     new_extra_isize = s_min_extra_isize;
    1085     kfree(is); is = NULL;
    1086     kfree(bs); bs = NULL;
    1087     + brelse(bh);
    1088     goto retry;
    1089     }
    1090     error = -1;
    1091     diff --git a/include/linux/mtd/map.h b/include/linux/mtd/map.h
    1092     index 3595a023..292645fc 100644
    1093     --- a/include/linux/mtd/map.h
    1094     +++ b/include/linux/mtd/map.h
    1095     @@ -362,7 +362,7 @@ static inline map_word map_word_load_partial(struct map_info *map, map_word orig
    1096     bitpos = (map_bankwidth(map)-1-i)*8;
    1097     #endif
    1098     orig.x[0] &= ~(0xff << bitpos);
    1099     - orig.x[0] |= buf[i-start] << bitpos;
    1100     + orig.x[0] |= (unsigned long)buf[i-start] << bitpos;
    1101     }
    1102     }
    1103     return orig;
    1104     @@ -381,7 +381,7 @@ static inline map_word map_word_ff(struct map_info *map)
    1105    
    1106     if (map_bankwidth(map) < MAP_FF_LIMIT) {
    1107     int bw = 8 * map_bankwidth(map);
    1108     - r.x[0] = (1 << bw) - 1;
    1109     + r.x[0] = (1UL << bw) - 1;
    1110     } else {
    1111     for (i=0; i<map_words(map); i++)
    1112     r.x[i] = ~0UL;
    1113     diff --git a/include/trace/ftrace.h b/include/trace/ftrace.h
    1114     index 76972494..763bf05c 100644
    1115     --- a/include/trace/ftrace.h
    1116     +++ b/include/trace/ftrace.h
    1117     @@ -379,7 +379,8 @@ ftrace_define_fields_##call(struct ftrace_event_call *event_call) \
    1118     __data_size += (len) * sizeof(type);
    1119    
    1120     #undef __string
    1121     -#define __string(item, src) __dynamic_array(char, item, strlen(src) + 1)
    1122     +#define __string(item, src) __dynamic_array(char, item, \
    1123     + strlen((src) ? (const char *)(src) : "(null)") + 1)
    1124    
    1125     #undef DECLARE_EVENT_CLASS
    1126     #define DECLARE_EVENT_CLASS(call, proto, args, tstruct, assign, print) \
    1127     @@ -504,7 +505,7 @@ static inline notrace int ftrace_get_offsets_##call( \
    1128    
    1129     #undef __assign_str
    1130     #define __assign_str(dst, src) \
    1131     - strcpy(__get_str(dst), src);
    1132     + strcpy(__get_str(dst), (src) ? (const char *)(src) : "(null)");
    1133    
    1134     #undef TP_fast_assign
    1135     #define TP_fast_assign(args...) args
    1136     diff --git a/kernel/audit.c b/kernel/audit.c
    1137     index 1c7f2c61..4478f7b2 100644
    1138     --- a/kernel/audit.c
    1139     +++ b/kernel/audit.c
    1140     @@ -625,7 +625,7 @@ static int audit_log_common_recv_msg(struct audit_buffer **ab, u16 msg_type,
    1141     char *ctx = NULL;
    1142     u32 len;
    1143    
    1144     - if (!audit_enabled) {
    1145     + if (!audit_enabled && msg_type != AUDIT_USER_AVC) {
    1146     *ab = NULL;
    1147     return rc;
    1148     }
    1149     @@ -684,6 +684,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
    1150    
    1151     switch (msg_type) {
    1152     case AUDIT_GET:
    1153     + status_set.mask = 0;
    1154     status_set.enabled = audit_enabled;
    1155     status_set.failure = audit_failure;
    1156     status_set.pid = audit_pid;
    1157     @@ -695,7 +696,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
    1158     &status_set, sizeof(status_set));
    1159     break;
    1160     case AUDIT_SET:
    1161     - if (nlh->nlmsg_len < sizeof(struct audit_status))
    1162     + if (nlmsg_len(nlh) < sizeof(struct audit_status))
    1163     return -EINVAL;
    1164     status_get = (struct audit_status *)data;
    1165     if (status_get->mask & AUDIT_STATUS_ENABLED) {
    1166     diff --git a/kernel/cpuset.c b/kernel/cpuset.c
    1167     index 8fe6f6b6..e372d949 100644
    1168     --- a/kernel/cpuset.c
    1169     +++ b/kernel/cpuset.c
    1170     @@ -983,8 +983,10 @@ static void cpuset_change_task_nodemask(struct task_struct *tsk,
    1171     need_loop = task_has_mempolicy(tsk) ||
    1172     !nodes_intersects(*newmems, tsk->mems_allowed);
    1173    
    1174     - if (need_loop)
    1175     + if (need_loop) {
    1176     + local_irq_disable();
    1177     write_seqcount_begin(&tsk->mems_allowed_seq);
    1178     + }
    1179    
    1180     nodes_or(tsk->mems_allowed, tsk->mems_allowed, *newmems);
    1181     mpol_rebind_task(tsk, newmems, MPOL_REBIND_STEP1);
    1182     @@ -992,8 +994,10 @@ static void cpuset_change_task_nodemask(struct task_struct *tsk,
    1183     mpol_rebind_task(tsk, newmems, MPOL_REBIND_STEP2);
    1184     tsk->mems_allowed = *newmems;
    1185    
    1186     - if (need_loop)
    1187     + if (need_loop) {
    1188     write_seqcount_end(&tsk->mems_allowed_seq);
    1189     + local_irq_enable();
    1190     + }
    1191    
    1192     task_unlock(tsk);
    1193     }
    1194     diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
    1195     index 0de28576..91c04f16 100644
    1196     --- a/kernel/power/snapshot.c
    1197     +++ b/kernel/power/snapshot.c
    1198     @@ -1398,7 +1398,11 @@ int hibernate_preallocate_memory(void)
    1199     * highmem and non-highmem zones separately.
    1200     */
    1201     pages_highmem = preallocate_image_highmem(highmem / 2);
    1202     - alloc = (count - max_size) - pages_highmem;
    1203     + alloc = count - max_size;
    1204     + if (alloc > pages_highmem)
    1205     + alloc -= pages_highmem;
    1206     + else
    1207     + alloc = 0;
    1208     pages = preallocate_image_memory(alloc, avail_normal);
    1209     if (pages < alloc) {
    1210     /* We have exhausted non-highmem pages, try highmem. */
    1211     diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
    1212     index 8a538c55..877aa733 100644
    1213     --- a/kernel/time/alarmtimer.c
    1214     +++ b/kernel/time/alarmtimer.c
    1215     @@ -474,7 +474,7 @@ static int alarm_clock_getres(const clockid_t which_clock, struct timespec *tp)
    1216     clockid_t baseid = alarm_bases[clock2alarm(which_clock)].base_clockid;
    1217    
    1218     if (!alarmtimer_get_rtcdev())
    1219     - return -ENOTSUPP;
    1220     + return -EINVAL;
    1221    
    1222     return hrtimer_get_res(baseid, tp);
    1223     }
    1224     @@ -491,7 +491,7 @@ static int alarm_clock_get(clockid_t which_clock, struct timespec *tp)
    1225     struct alarm_base *base = &alarm_bases[clock2alarm(which_clock)];
    1226    
    1227     if (!alarmtimer_get_rtcdev())
    1228     - return -ENOTSUPP;
    1229     + return -EINVAL;
    1230    
    1231     *tp = ktime_to_timespec(base->gettime());
    1232     return 0;
    1233     diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
    1234     index e101cf9a..8c8169bf 100644
    1235     --- a/kernel/trace/ftrace.c
    1236     +++ b/kernel/trace/ftrace.c
    1237     @@ -312,9 +312,6 @@ static int remove_ftrace_list_ops(struct ftrace_ops **list,
    1238    
    1239     static int __register_ftrace_function(struct ftrace_ops *ops)
    1240     {
    1241     - if (ftrace_disabled)
    1242     - return -ENODEV;
    1243     -
    1244     if (FTRACE_WARN_ON(ops == &global_ops))
    1245     return -EINVAL;
    1246    
    1247     @@ -348,9 +345,6 @@ static int __unregister_ftrace_function(struct ftrace_ops *ops)
    1248     {
    1249     int ret;
    1250    
    1251     - if (ftrace_disabled)
    1252     - return -ENODEV;
    1253     -
    1254     if (WARN_ON(!(ops->flags & FTRACE_OPS_FL_ENABLED)))
    1255     return -EBUSY;
    1256    
    1257     @@ -1940,10 +1934,15 @@ static void ftrace_startup_enable(int command)
    1258     static int ftrace_startup(struct ftrace_ops *ops, int command)
    1259     {
    1260     bool hash_enable = true;
    1261     + int ret;
    1262    
    1263     if (unlikely(ftrace_disabled))
    1264     return -ENODEV;
    1265    
    1266     + ret = __register_ftrace_function(ops);
    1267     + if (ret)
    1268     + return ret;
    1269     +
    1270     ftrace_start_up++;
    1271     command |= FTRACE_UPDATE_CALLS;
    1272    
    1273     @@ -1965,12 +1964,17 @@ static int ftrace_startup(struct ftrace_ops *ops, int command)
    1274     return 0;
    1275     }
    1276    
    1277     -static void ftrace_shutdown(struct ftrace_ops *ops, int command)
    1278     +static int ftrace_shutdown(struct ftrace_ops *ops, int command)
    1279     {
    1280     bool hash_disable = true;
    1281     + int ret;
    1282    
    1283     if (unlikely(ftrace_disabled))
    1284     - return;
    1285     + return -ENODEV;
    1286     +
    1287     + ret = __unregister_ftrace_function(ops);
    1288     + if (ret)
    1289     + return ret;
    1290    
    1291     ftrace_start_up--;
    1292     /*
    1293     @@ -2005,9 +2009,10 @@ static void ftrace_shutdown(struct ftrace_ops *ops, int command)
    1294     }
    1295    
    1296     if (!command || !ftrace_enabled)
    1297     - return;
    1298     + return 0;
    1299    
    1300     ftrace_run_update_code(command);
    1301     + return 0;
    1302     }
    1303    
    1304     static void ftrace_startup_sysctl(void)
    1305     @@ -2873,16 +2878,13 @@ static void __enable_ftrace_function_probe(void)
    1306     if (i == FTRACE_FUNC_HASHSIZE)
    1307     return;
    1308    
    1309     - ret = __register_ftrace_function(&trace_probe_ops);
    1310     - if (!ret)
    1311     - ret = ftrace_startup(&trace_probe_ops, 0);
    1312     + ret = ftrace_startup(&trace_probe_ops, 0);
    1313    
    1314     ftrace_probe_registered = 1;
    1315     }
    1316    
    1317     static void __disable_ftrace_function_probe(void)
    1318     {
    1319     - int ret;
    1320     int i;
    1321    
    1322     if (!ftrace_probe_registered)
    1323     @@ -2895,9 +2897,7 @@ static void __disable_ftrace_function_probe(void)
    1324     }
    1325    
    1326     /* no more funcs left */
    1327     - ret = __unregister_ftrace_function(&trace_probe_ops);
    1328     - if (!ret)
    1329     - ftrace_shutdown(&trace_probe_ops, 0);
    1330     + ftrace_shutdown(&trace_probe_ops, 0);
    1331    
    1332     ftrace_probe_registered = 0;
    1333     }
    1334     @@ -3948,12 +3948,15 @@ device_initcall(ftrace_nodyn_init);
    1335     static inline int ftrace_init_dyn_debugfs(struct dentry *d_tracer) { return 0; }
    1336     static inline void ftrace_startup_enable(int command) { }
    1337     /* Keep as macros so we do not need to define the commands */
    1338     -# define ftrace_startup(ops, command) \
    1339     - ({ \
    1340     - (ops)->flags |= FTRACE_OPS_FL_ENABLED; \
    1341     - 0; \
    1342     +# define ftrace_startup(ops, command) \
    1343     + ({ \
    1344     + int ___ret = __register_ftrace_function(ops); \
    1345     + if (!___ret) \
    1346     + (ops)->flags |= FTRACE_OPS_FL_ENABLED; \
    1347     + ___ret; \
    1348     })
    1349     -# define ftrace_shutdown(ops, command) do { } while (0)
    1350     +# define ftrace_shutdown(ops, command) __unregister_ftrace_function(ops)
    1351     +
    1352     # define ftrace_startup_sysctl() do { } while (0)
    1353     # define ftrace_shutdown_sysctl() do { } while (0)
    1354    
    1355     @@ -4323,15 +4326,8 @@ int register_ftrace_function(struct ftrace_ops *ops)
    1356    
    1357     mutex_lock(&ftrace_lock);
    1358    
    1359     - if (unlikely(ftrace_disabled))
    1360     - goto out_unlock;
    1361     -
    1362     - ret = __register_ftrace_function(ops);
    1363     - if (!ret)
    1364     - ret = ftrace_startup(ops, 0);
    1365     -
    1366     + ret = ftrace_startup(ops, 0);
    1367    
    1368     - out_unlock:
    1369     mutex_unlock(&ftrace_lock);
    1370     return ret;
    1371     }
    1372     @@ -4348,9 +4344,7 @@ int unregister_ftrace_function(struct ftrace_ops *ops)
    1373     int ret;
    1374    
    1375     mutex_lock(&ftrace_lock);
    1376     - ret = __unregister_ftrace_function(ops);
    1377     - if (!ret)
    1378     - ftrace_shutdown(ops, 0);
    1379     + ret = ftrace_shutdown(ops, 0);
    1380     mutex_unlock(&ftrace_lock);
    1381    
    1382     return ret;
    1383     @@ -4544,6 +4538,12 @@ ftrace_suspend_notifier_call(struct notifier_block *bl, unsigned long state,
    1384     return NOTIFY_DONE;
    1385     }
    1386    
    1387     +/* Just a place holder for function graph */
    1388     +static struct ftrace_ops fgraph_ops __read_mostly = {
    1389     + .func = ftrace_stub,
    1390     + .flags = FTRACE_OPS_FL_GLOBAL,
    1391     +};
    1392     +
    1393     int register_ftrace_graph(trace_func_graph_ret_t retfunc,
    1394     trace_func_graph_ent_t entryfunc)
    1395     {
    1396     @@ -4570,7 +4570,7 @@ int register_ftrace_graph(trace_func_graph_ret_t retfunc,
    1397     ftrace_graph_return = retfunc;
    1398     ftrace_graph_entry = entryfunc;
    1399    
    1400     - ret = ftrace_startup(&global_ops, FTRACE_START_FUNC_RET);
    1401     + ret = ftrace_startup(&fgraph_ops, FTRACE_START_FUNC_RET);
    1402    
    1403     out:
    1404     mutex_unlock(&ftrace_lock);
    1405     @@ -4587,7 +4587,7 @@ void unregister_ftrace_graph(void)
    1406     ftrace_graph_active--;
    1407     ftrace_graph_return = (trace_func_graph_ret_t)ftrace_stub;
    1408     ftrace_graph_entry = ftrace_graph_entry_stub;
    1409     - ftrace_shutdown(&global_ops, FTRACE_STOP_FUNC_RET);
    1410     + ftrace_shutdown(&fgraph_ops, FTRACE_STOP_FUNC_RET);
    1411     unregister_pm_notifier(&ftrace_suspend_notifier);
    1412     unregister_trace_sched_switch(ftrace_graph_probe_sched_switch, NULL);
    1413    
    1414     diff --git a/lib/vsprintf.c b/lib/vsprintf.c
    1415     index abbabec9..73e2c45a 100644
    1416     --- a/lib/vsprintf.c
    1417     +++ b/lib/vsprintf.c
    1418     @@ -25,6 +25,7 @@
    1419     #include <linux/kallsyms.h>
    1420     #include <linux/uaccess.h>
    1421     #include <linux/ioport.h>
    1422     +#include <linux/cred.h>
    1423     #include <net/addrconf.h>
    1424    
    1425     #include <asm/page.h> /* for PAGE_SIZE */
    1426     @@ -930,11 +931,37 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
    1427     spec.field_width = 2 * sizeof(void *);
    1428     return string(buf, end, "pK-error", spec);
    1429     }
    1430     - if (!((kptr_restrict == 0) ||
    1431     - (kptr_restrict == 1 &&
    1432     - has_capability_noaudit(current, CAP_SYSLOG))))
    1433     +
    1434     + switch (kptr_restrict) {
    1435     + case 0:
    1436     + /* Always print %pK values */
    1437     + break;
    1438     + case 1: {
    1439     + /*
    1440     + * Only print the real pointer value if the current
    1441     + * process has CAP_SYSLOG and is running with the
    1442     + * same credentials it started with. This is because
    1443     + * access to files is checked at open() time, but %pK
    1444     + * checks permission at read() time. We don't want to
    1445     + * leak pointer values if a binary opens a file using
    1446     + * %pK and then elevates privileges before reading it.
    1447     + */
    1448     + const struct cred *cred = current_cred();
    1449     +
    1450     + if (!has_capability_noaudit(current, CAP_SYSLOG) ||
    1451     + (cred->euid != cred->uid) ||
    1452     + (cred->egid != cred->gid))
    1453     + ptr = NULL;
    1454     + break;
    1455     + }
    1456     + case 2:
    1457     + default:
    1458     + /* Always print 0's for %pK */
    1459     ptr = NULL;
    1460     + break;
    1461     + }
    1462     break;
    1463     +
    1464     case 'N':
    1465     switch (fmt[1]) {
    1466     case 'F':
    1467     diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c
    1468     index da4b8b23..6235d052 100644
    1469     --- a/security/selinux/netlabel.c
    1470     +++ b/security/selinux/netlabel.c
    1471     @@ -442,8 +442,7 @@ int selinux_netlbl_socket_connect(struct sock *sk, struct sockaddr *addr)
    1472     sksec->nlbl_state != NLBL_CONNLABELED)
    1473     return 0;
    1474    
    1475     - local_bh_disable();
    1476     - bh_lock_sock_nested(sk);
    1477     + lock_sock(sk);
    1478    
    1479     /* connected sockets are allowed to disconnect when the address family
    1480     * is set to AF_UNSPEC, if that is what is happening we want to reset
    1481     @@ -464,7 +463,6 @@ int selinux_netlbl_socket_connect(struct sock *sk, struct sockaddr *addr)
    1482     sksec->nlbl_state = NLBL_CONNLABELED;
    1483    
    1484     socket_connect_return:
    1485     - bh_unlock_sock(sk);
    1486     - local_bh_enable();
    1487     + release_sock(sk);
    1488     return rc;
    1489     }
    1490     diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
    1491     index 810f1fc2..c32ae4d5 100644
    1492     --- a/sound/pci/hda/patch_realtek.c
    1493     +++ b/sound/pci/hda/patch_realtek.c
    1494     @@ -6969,6 +6969,7 @@ static int patch_alc662(struct hda_codec *codec)
    1495     case 0x10ec0272:
    1496     case 0x10ec0663:
    1497     case 0x10ec0665:
    1498     + case 0x10ec0668:
    1499     set_beep_amp(spec, 0x0b, 0x04, HDA_INPUT);
    1500     break;
    1501     case 0x10ec0273:
    1502     diff --git a/sound/soc/blackfin/bf5xx-i2s.c b/sound/soc/blackfin/bf5xx-i2s.c
    1503     index 4dccf037..f59a961b 100644
    1504     --- a/sound/soc/blackfin/bf5xx-i2s.c
    1505     +++ b/sound/soc/blackfin/bf5xx-i2s.c
    1506     @@ -111,6 +111,7 @@ static int bf5xx_i2s_hw_params(struct snd_pcm_substream *substream,
    1507     bf5xx_i2s->tcr2 |= 7;
    1508     bf5xx_i2s->rcr2 |= 7;
    1509     sport_handle->wdsize = 1;
    1510     + break;
    1511     case SNDRV_PCM_FORMAT_S16_LE:
    1512     bf5xx_i2s->tcr2 |= 15;
    1513     bf5xx_i2s->rcr2 |= 15;
    1514     diff --git a/sound/soc/codecs/ak4642.c b/sound/soc/codecs/ak4642.c
    1515     index b3e24f28..7e4245f1 100644
    1516     --- a/sound/soc/codecs/ak4642.c
    1517     +++ b/sound/soc/codecs/ak4642.c
    1518     @@ -262,7 +262,7 @@ static int ak4642_dai_startup(struct snd_pcm_substream *substream,
    1519     * This operation came from example code of
    1520     * "ASAHI KASEI AK4642" (japanese) manual p94.
    1521     */
    1522     - snd_soc_write(codec, SG_SL1, PMMP | MGAIN0);
    1523     + snd_soc_update_bits(codec, SG_SL1, PMMP | MGAIN0, PMMP | MGAIN0);
    1524     snd_soc_write(codec, TIMER, ZTM(0x3) | WTM(0x3));
    1525     snd_soc_write(codec, ALC_CTL1, ALC | LMTH0);
    1526     snd_soc_update_bits(codec, PW_MGMT1, PMADL, PMADL);
    1527     diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
    1528     index e96c6ede..0b5132f7 100644
    1529     --- a/sound/soc/codecs/wm8962.c
    1530     +++ b/sound/soc/codecs/wm8962.c
    1531     @@ -3675,6 +3675,8 @@ static __devinit int wm8962_i2c_probe(struct i2c_client *i2c,
    1532     if (ret < 0)
    1533     goto err_regmap;
    1534    
    1535     + regcache_cache_only(wm8962->regmap, true);
    1536     +
    1537     /* The drivers should power up as needed */
    1538     regulator_bulk_disable(ARRAY_SIZE(wm8962->supplies), wm8962->supplies);
    1539    
    1540     diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
    1541     index bdfbc1be..91a0a2f8 100644
    1542     --- a/virt/kvm/kvm_main.c
    1543     +++ b/virt/kvm/kvm_main.c
    1544     @@ -774,7 +774,7 @@ int __kvm_set_memory_region(struct kvm *kvm,
    1545     /* destroy any largepage mappings for dirty tracking */
    1546     }
    1547    
    1548     - if (!npages) {
    1549     + if (!npages || base_gfn != old.base_gfn) {
    1550     struct kvm_memory_slot *slot;
    1551    
    1552     r = -ENOMEM;
    1553     @@ -790,8 +790,10 @@ int __kvm_set_memory_region(struct kvm *kvm,
    1554     old_memslots = kvm->memslots;
    1555     rcu_assign_pointer(kvm->memslots, slots);
    1556     synchronize_srcu_expedited(&kvm->srcu);
    1557     - /* From this point no new shadow pages pointing to a deleted
    1558     - * memslot will be created.
    1559     + /* slot was deleted or moved, clear iommu mapping */
    1560     + kvm_iommu_unmap_pages(kvm, &old);
    1561     + /* From this point no new shadow pages pointing to a deleted,
    1562     + * or moved, memslot will be created.
    1563     *
    1564     * validation of sp->gfn happens in:
    1565     * - gfn_to_hva (kvm_read_guest, gfn_to_pfn)
    1566     @@ -805,20 +807,19 @@ int __kvm_set_memory_region(struct kvm *kvm,
    1567     if (r)
    1568     goto out_free;
    1569    
    1570     - /* map/unmap the pages in iommu page table */
    1571     - if (npages) {
    1572     - r = kvm_iommu_map_pages(kvm, &new);
    1573     - if (r)
    1574     - goto out_free;
    1575     - } else
    1576     - kvm_iommu_unmap_pages(kvm, &old);
    1577     -
    1578     r = -ENOMEM;
    1579     slots = kmemdup(kvm->memslots, sizeof(struct kvm_memslots),
    1580     GFP_KERNEL);
    1581     if (!slots)
    1582     goto out_free;
    1583    
    1584     + /* map new memory slot into the iommu */
    1585     + if (npages) {
    1586     + r = kvm_iommu_map_pages(kvm, &new);
    1587     + if (r)
    1588     + goto out_slots;
    1589     + }
    1590     +
    1591     /* actual memory is freed via old in kvm_free_physmem_slot below */
    1592     if (!npages) {
    1593     new.rmap = NULL;
    1594     @@ -845,6 +846,8 @@ int __kvm_set_memory_region(struct kvm *kvm,
    1595    
    1596     return 0;
    1597    
    1598     +out_slots:
    1599     + kfree(slots);
    1600     out_free:
    1601     kvm_free_physmem_slot(&new, &old);
    1602     out: