Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-lts/patches-3.4/0171-3.4.72-all-fixes.patch

    Contents of /trunk/kernel-lts/patches-3.4/0171-3.4.72-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2336 - (show annotations) (download)
    Thu Dec 12 08:43:38 2013 UTC (10 years, 4 months ago) by niro
    File size: 53718 byte(s) 
    -linux-3.4.72
    1 diff --git a/Documentation/sysctl/kernel.txt b/Documentation/sysctl/kernel.txt
    2 index 6d78841f..99d8ab9d 100644
    3 --- a/Documentation/sysctl/kernel.txt
    4 +++ b/Documentation/sysctl/kernel.txt
    5 @@ -284,13 +284,24 @@ Default value is "/sbin/hotplug".
    6 kptr_restrict:
    7
    8 This toggle indicates whether restrictions are placed on
    9 -exposing kernel addresses via /proc and other interfaces. When
    10 -kptr_restrict is set to (0), there are no restrictions. When
    11 -kptr_restrict is set to (1), the default, kernel pointers
    12 -printed using the %pK format specifier will be replaced with 0's
    13 -unless the user has CAP_SYSLOG. When kptr_restrict is set to
    14 -(2), kernel pointers printed using %pK will be replaced with 0's
    15 -regardless of privileges.
    16 +exposing kernel addresses via /proc and other interfaces.
    17 +
    18 +When kptr_restrict is set to (0), the default, there are no restrictions.
    19 +
    20 +When kptr_restrict is set to (1), kernel pointers printed using the %pK
    21 +format specifier will be replaced with 0's unless the user has CAP_SYSLOG
    22 +and effective user and group ids are equal to the real ids. This is
    23 +because %pK checks are done at read() time rather than open() time, so
    24 +if permissions are elevated between the open() and the read() (e.g via
    25 +a setuid binary) then %pK will not leak kernel pointers to unprivileged
    26 +users. Note, this is a temporary solution only. The correct long-term
    27 +solution is to do the permission checks at open() time. Consider removing
    28 +world read permissions from files that use %pK, and using dmesg_restrict
    29 +to protect against uses of %pK in dmesg(8) if leaking kernel pointer
    30 +values to unprivileged users is a concern.
    31 +
    32 +When kptr_restrict is set to (2), kernel pointers printed using
    33 +%pK will be replaced with 0's regardless of privileges.
    34
    35 ==============================================================
    36
    37 diff --git a/arch/arm/mach-integrator/integrator_cp.c b/arch/arm/mach-integrator/integrator_cp.c
    38 index 48a115a9..ecc33bc4 100644
    39 --- a/arch/arm/mach-integrator/integrator_cp.c
    40 +++ b/arch/arm/mach-integrator/integrator_cp.c
    41 @@ -366,7 +366,8 @@ static AMBA_APB_DEVICE(aaci, "mb:1d", 0, INTEGRATOR_CP_AACI_BASE,
    42 static void cp_clcd_enable(struct clcd_fb *fb)
    43 {
    44 struct fb_var_screeninfo *var = &fb->fb.var;
    45 - u32 val = CM_CTRL_STATIC1 | CM_CTRL_STATIC2;
    46 + u32 val = CM_CTRL_STATIC1 | CM_CTRL_STATIC2
    47 + | CM_CTRL_LCDEN0 | CM_CTRL_LCDEN1;
    48
    49 if (var->bits_per_pixel <= 8 ||
    50 (var->bits_per_pixel == 16 && var->green.length == 5))
    51 diff --git a/arch/arm/mach-sa1100/assabet.c b/arch/arm/mach-sa1100/assabet.c
    52 index 375d3f77..82636701 100644
    53 --- a/arch/arm/mach-sa1100/assabet.c
    54 +++ b/arch/arm/mach-sa1100/assabet.c
    55 @@ -509,6 +509,9 @@ static void __init assabet_map_io(void)
    56 * Its called GPCLKR0 in my SA1110 manual.
    57 */
    58 Ser1SDCR0 |= SDCR0_SUS;
    59 + MSC1 = (MSC1 & ~0xffff) |
    60 + MSC_NonBrst | MSC_32BitStMem |
    61 + MSC_RdAcc(2) | MSC_WrAcc(2) | MSC_Rec(0);
    62
    63 if (!machine_has_neponset())
    64 sa1100_register_uart_fns(&assabet_port_fns);
    65 diff --git a/arch/avr32/boot/u-boot/head.S b/arch/avr32/boot/u-boot/head.S
    66 index 4488fa27..2ffc298f 100644
    67 --- a/arch/avr32/boot/u-boot/head.S
    68 +++ b/arch/avr32/boot/u-boot/head.S
    69 @@ -8,6 +8,8 @@
    70 * published by the Free Software Foundation.
    71 */
    72 #include <asm/setup.h>
    73 +#include <asm/thread_info.h>
    74 +#include <asm/sysreg.h>
    75
    76 /*
    77 * The kernel is loaded where we want it to be and all caches
    78 @@ -20,11 +22,6 @@
    79 .section .init.text,"ax"
    80 .global _start
    81 _start:
    82 - /* Check if the boot loader actually provided a tag table */
    83 - lddpc r0, magic_number
    84 - cp.w r12, r0
    85 - brne no_tag_table
    86 -
    87 /* Initialize .bss */
    88 lddpc r2, bss_start_addr
    89 lddpc r3, end_addr
    90 @@ -34,6 +31,25 @@ _start:
    91 cp r2, r3
    92 brlo 1b
    93
    94 + /* Initialize status register */
    95 + lddpc r0, init_sr
    96 + mtsr SYSREG_SR, r0
    97 +
    98 + /* Set initial stack pointer */
    99 + lddpc sp, stack_addr
    100 + sub sp, -THREAD_SIZE
    101 +
    102 +#ifdef CONFIG_FRAME_POINTER
    103 + /* Mark last stack frame */
    104 + mov lr, 0
    105 + mov r7, 0
    106 +#endif
    107 +
    108 + /* Check if the boot loader actually provided a tag table */
    109 + lddpc r0, magic_number
    110 + cp.w r12, r0
    111 + brne no_tag_table
    112 +
    113 /*
    114 * Save the tag table address for later use. This must be done
    115 * _after_ .bss has been initialized...
    116 @@ -53,8 +69,15 @@ bss_start_addr:
    117 .long __bss_start
    118 end_addr:
    119 .long _end
    120 +init_sr:
    121 + .long 0x007f0000 /* Supervisor mode, everything masked */
    122 +stack_addr:
    123 + .long init_thread_union
    124 +panic_addr:
    125 + .long panic
    126
    127 no_tag_table:
    128 sub r12, pc, (. - 2f)
    129 - bral panic
    130 + /* branch to panic() which can be far away with that construct */
    131 + lddpc pc, panic_addr
    132 2: .asciz "Boot loader didn't provide correct magic number\n"
    133 diff --git a/arch/avr32/kernel/entry-avr32b.S b/arch/avr32/kernel/entry-avr32b.S
    134 index 169268c4..a91e8980 100644
    135 --- a/arch/avr32/kernel/entry-avr32b.S
    136 +++ b/arch/avr32/kernel/entry-avr32b.S
    137 @@ -399,9 +399,10 @@ handle_critical:
    138 /* We should never get here... */
    139 bad_return:
    140 sub r12, pc, (. - 1f)
    141 - bral panic
    142 + lddpc pc, 2f
    143 .align 2
    144 1: .asciz "Return from critical exception!"
    145 +2: .long panic
    146
    147 .align 1
    148 do_bus_error_write:
    149 diff --git a/arch/avr32/kernel/head.S b/arch/avr32/kernel/head.S
    150 index 6163bd0a..59eae6df 100644
    151 --- a/arch/avr32/kernel/head.S
    152 +++ b/arch/avr32/kernel/head.S
    153 @@ -10,33 +10,13 @@
    154 #include <linux/linkage.h>
    155
    156 #include <asm/page.h>
    157 -#include <asm/thread_info.h>
    158 -#include <asm/sysreg.h>
    159
    160 .section .init.text,"ax"
    161 .global kernel_entry
    162 kernel_entry:
    163 - /* Initialize status register */
    164 - lddpc r0, init_sr
    165 - mtsr SYSREG_SR, r0
    166 -
    167 - /* Set initial stack pointer */
    168 - lddpc sp, stack_addr
    169 - sub sp, -THREAD_SIZE
    170 -
    171 -#ifdef CONFIG_FRAME_POINTER
    172 - /* Mark last stack frame */
    173 - mov lr, 0
    174 - mov r7, 0
    175 -#endif
    176 -
    177 /* Start the show */
    178 lddpc pc, kernel_start_addr
    179
    180 .align 2
    181 -init_sr:
    182 - .long 0x007f0000 /* Supervisor mode, everything masked */
    183 -stack_addr:
    184 - .long init_thread_union
    185 kernel_start_addr:
    186 .long start_kernel
    187 diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c
    188 index e6de7879..32e2c811 100644
    189 --- a/arch/powerpc/kernel/signal_32.c
    190 +++ b/arch/powerpc/kernel/signal_32.c
    191 @@ -447,6 +447,12 @@ static int save_user_regs(struct pt_regs *regs, struct mcontext __user *frame,
    192 #endif /* CONFIG_ALTIVEC */
    193 if (copy_fpr_to_user(&frame->mc_fregs, current))
    194 return 1;
    195 +
    196 + /*
    197 + * Clear the MSR VSX bit to indicate there is no valid state attached
    198 + * to this context, except in the specific case below where we set it.
    199 + */
    200 + msr &= ~MSR_VSX;
    201 #ifdef CONFIG_VSX
    202 /*
    203 * Copy VSR 0-31 upper half from thread_struct to local
    204 @@ -459,15 +465,7 @@ static int save_user_regs(struct pt_regs *regs, struct mcontext __user *frame,
    205 if (copy_vsx_to_user(&frame->mc_vsregs, current))
    206 return 1;
    207 msr |= MSR_VSX;
    208 - } else if (!ctx_has_vsx_region)
    209 - /*
    210 - * With a small context structure we can't hold the VSX
    211 - * registers, hence clear the MSR value to indicate the state
    212 - * was not saved.
    213 - */
    214 - msr &= ~MSR_VSX;
    215 -
    216 -
    217 + }
    218 #endif /* CONFIG_VSX */
    219 #ifdef CONFIG_SPE
    220 /* save spe registers */
    221 diff --git a/arch/powerpc/kernel/signal_64.c b/arch/powerpc/kernel/signal_64.c
    222 index 2692efdb..3ad1b508 100644
    223 --- a/arch/powerpc/kernel/signal_64.c
    224 +++ b/arch/powerpc/kernel/signal_64.c
    225 @@ -117,6 +117,12 @@ static long setup_sigcontext(struct sigcontext __user *sc, struct pt_regs *regs,
    226 flush_fp_to_thread(current);
    227 /* copy fpr regs and fpscr */
    228 err |= copy_fpr_to_user(&sc->fp_regs, current);
    229 +
    230 + /*
    231 + * Clear the MSR VSX bit to indicate there is no valid state attached
    232 + * to this context, except in the specific case below where we set it.
    233 + */
    234 + msr &= ~MSR_VSX;
    235 #ifdef CONFIG_VSX
    236 /*
    237 * Copy VSX low doubleword to local buffer for formatting,
    238 diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
    239 index aeb82200..60662545 100644
    240 --- a/drivers/ata/ahci.c
    241 +++ b/drivers/ata/ahci.c
    242 @@ -402,6 +402,8 @@ static const struct pci_device_id ahci_pci_tbl[] = {
    243 .driver_data = board_ahci_yes_fbs }, /* 88se9172 on some Gigabyte */
    244 { PCI_DEVICE(0x1b4b, 0x91a3),
    245 .driver_data = board_ahci_yes_fbs },
    246 + { PCI_DEVICE(0x1b4b, 0x9230),
    247 + .driver_data = board_ahci_yes_fbs },
    248
    249 /* Promise */
    250 { PCI_VDEVICE(PROMISE, 0x3f20), board_ahci }, /* PDC42819 */
    251 diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
    252 index 47a1fb85..60f41cd2 100644
    253 --- a/drivers/ata/libahci.c
    254 +++ b/drivers/ata/libahci.c
    255 @@ -1249,9 +1249,11 @@ int ahci_do_softreset(struct ata_link *link, unsigned int *class,
    256 {
    257 struct ata_port *ap = link->ap;
    258 struct ahci_host_priv *hpriv = ap->host->private_data;
    259 + struct ahci_port_priv *pp = ap->private_data;
    260 const char *reason = NULL;
    261 unsigned long now, msecs;
    262 struct ata_taskfile tf;
    263 + bool fbs_disabled = false;
    264 int rc;
    265
    266 DPRINTK("ENTER\n");
    267 @@ -1261,6 +1263,16 @@ int ahci_do_softreset(struct ata_link *link, unsigned int *class,
    268 if (rc && rc != -EOPNOTSUPP)
    269 ata_link_warn(link, "failed to reset engine (errno=%d)\n", rc);
    270
    271 + /*
    272 + * According to AHCI-1.2 9.3.9: if FBS is enable, software shall
    273 + * clear PxFBS.EN to '0' prior to issuing software reset to devices
    274 + * that is attached to port multiplier.
    275 + */
    276 + if (!ata_is_host_link(link) && pp->fbs_enabled) {
    277 + ahci_disable_fbs(ap);
    278 + fbs_disabled = true;
    279 + }
    280 +
    281 ata_tf_init(link->device, &tf);
    282
    283 /* issue the first D2H Register FIS */
    284 @@ -1301,6 +1313,10 @@ int ahci_do_softreset(struct ata_link *link, unsigned int *class,
    285 } else
    286 *class = ahci_dev_classify(ap);
    287
    288 + /* re-enable FBS if disabled before */
    289 + if (fbs_disabled)
    290 + ahci_enable_fbs(ap);
    291 +
    292 DPRINTK("EXIT, class=%u\n", *class);
    293 return 0;
    294
    295 diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
    296 index 9cf09ae8..cd20cf1e 100644
    297 --- a/drivers/ata/libata-core.c
    298 +++ b/drivers/ata/libata-core.c
    299 @@ -4074,6 +4074,7 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
    300 { "TORiSAN DVD-ROM DRD-N216", NULL, ATA_HORKAGE_MAX_SEC_128 },
    301 { "QUANTUM DAT DAT72-000", NULL, ATA_HORKAGE_ATAPI_MOD16_DMA },
    302 { "Slimtype DVD A DS8A8SH", NULL, ATA_HORKAGE_MAX_SEC_LBA48 },
    303 + { "Slimtype DVD A DS8A9SH", NULL, ATA_HORKAGE_MAX_SEC_LBA48 },
    304
    305 /* Devices we expect to fail diagnostics */
    306
    307 diff --git a/drivers/ata/libata-transport.c b/drivers/ata/libata-transport.c
    308 index c3419048..92156774 100644
    309 --- a/drivers/ata/libata-transport.c
    310 +++ b/drivers/ata/libata-transport.c
    311 @@ -319,25 +319,25 @@ int ata_tport_add(struct device *parent,
    312 /*
    313 * ATA link attributes
    314 */
    315 +static int noop(int x) { return x; }
    316
    317 -
    318 -#define ata_link_show_linkspeed(field) \
    319 +#define ata_link_show_linkspeed(field, format) \
    320 static ssize_t \
    321 show_ata_link_##field(struct device *dev, \
    322 struct device_attribute *attr, char *buf) \
    323 { \
    324 struct ata_link *link = transport_class_to_link(dev); \
    325 \
    326 - return sprintf(buf,"%s\n", sata_spd_string(fls(link->field))); \
    327 + return sprintf(buf, "%s\n", sata_spd_string(format(link->field))); \
    328 }
    329
    330 -#define ata_link_linkspeed_attr(field) \
    331 - ata_link_show_linkspeed(field) \
    332 +#define ata_link_linkspeed_attr(field, format) \
    333 + ata_link_show_linkspeed(field, format) \
    334 static DEVICE_ATTR(field, S_IRUGO, show_ata_link_##field, NULL)
    335
    336 -ata_link_linkspeed_attr(hw_sata_spd_limit);
    337 -ata_link_linkspeed_attr(sata_spd_limit);
    338 -ata_link_linkspeed_attr(sata_spd);
    339 +ata_link_linkspeed_attr(hw_sata_spd_limit, fls);
    340 +ata_link_linkspeed_attr(sata_spd_limit, fls);
    341 +ata_link_linkspeed_attr(sata_spd, noop);
    342
    343
    344 static DECLARE_TRANSPORT_CLASS(ata_link_class,
    345 diff --git a/drivers/block/loop.c b/drivers/block/loop.c
    346 index a4ddbae2..462fd182 100644
    347 --- a/drivers/block/loop.c
    348 +++ b/drivers/block/loop.c
    349 @@ -1636,7 +1636,7 @@ static int loop_add(struct loop_device **l, int i)
    350
    351 lo->lo_queue = blk_alloc_queue(GFP_KERNEL);
    352 if (!lo->lo_queue)
    353 - goto out_free_dev;
    354 + goto out_free_idr;
    355
    356 disk = lo->lo_disk = alloc_disk(1 << part_shift);
    357 if (!disk)
    358 @@ -1680,6 +1680,8 @@ static int loop_add(struct loop_device **l, int i)
    359
    360 out_free_queue:
    361 blk_cleanup_queue(lo->lo_queue);
    362 +out_free_idr:
    363 + idr_remove(&loop_index_idr, i);
    364 out_free_dev:
    365 kfree(lo);
    366 out:
    367 diff --git a/drivers/block/xen-blkback/blkback.c b/drivers/block/xen-blkback/blkback.c
    368 index 4ed7bf9b..0ed5df4d 100644
    369 --- a/drivers/block/xen-blkback/blkback.c
    370 +++ b/drivers/block/xen-blkback/blkback.c
    371 @@ -401,6 +401,8 @@ static int dispatch_discard_io(struct xen_blkif *blkif,
    372 unsigned long secure;
    373 struct phys_req preq;
    374
    375 + xen_blkif_get(blkif);
    376 +
    377 preq.sector_number = req->u.discard.sector_number;
    378 preq.nr_sects = req->u.discard.nr_sectors;
    379
    380 @@ -413,7 +415,6 @@ static int dispatch_discard_io(struct xen_blkif *blkif,
    381 }
    382 blkif->st_ds_req++;
    383
    384 - xen_blkif_get(blkif);
    385 secure = (blkif->vbd.discard_secure &&
    386 (req->u.discard.flag & BLKIF_DISCARD_SECURE)) ?
    387 BLKDEV_DISCARD_SECURE : 0;
    388 diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
    389 index 0e359225..5647ce4b 100644
    390 --- a/drivers/gpu/drm/i915/intel_display.c
    391 +++ b/drivers/gpu/drm/i915/intel_display.c
    392 @@ -6377,7 +6377,9 @@ static void i9xx_update_cursor(struct drm_crtc *crtc, u32 base)
    393 intel_crtc->cursor_visible = visible;
    394 }
    395 /* and commit changes on next vblank */
    396 + POSTING_READ(CURCNTR(pipe));
    397 I915_WRITE(CURBASE(pipe), base);
    398 + POSTING_READ(CURBASE(pipe));
    399 }
    400
    401 static void ivb_update_cursor(struct drm_crtc *crtc, u32 base)
    402 @@ -6402,7 +6404,9 @@ static void ivb_update_cursor(struct drm_crtc *crtc, u32 base)
    403 intel_crtc->cursor_visible = visible;
    404 }
    405 /* and commit changes on next vblank */
    406 + POSTING_READ(CURCNTR_IVB(pipe));
    407 I915_WRITE(CURBASE_IVB(pipe), base);
    408 + POSTING_READ(CURBASE_IVB(pipe));
    409 }
    410
    411 /* If no-part of the cursor is visible on the framebuffer, then the GPU may hang... */
    412 diff --git a/drivers/gpu/drm/nouveau/nouveau_gem.c b/drivers/gpu/drm/nouveau/nouveau_gem.c
    413 index ed52a6f4..2f46bbfb 100644
    414 --- a/drivers/gpu/drm/nouveau/nouveau_gem.c
    415 +++ b/drivers/gpu/drm/nouveau/nouveau_gem.c
    416 @@ -281,7 +281,8 @@ validate_fini_list(struct list_head *list, struct nouveau_fence *fence)
    417 list_for_each_safe(entry, tmp, list) {
    418 nvbo = list_entry(entry, struct nouveau_bo, entry);
    419
    420 - nouveau_bo_fence(nvbo, fence);
    421 + if (likely(fence))
    422 + nouveau_bo_fence(nvbo, fence);
    423
    424 if (unlikely(nvbo->validate_mapped)) {
    425 ttm_bo_kunmap(&nvbo->kmap);
    426 diff --git a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
    427 index 9760e5ad..b44bbf50 100644
    428 --- a/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
    429 +++ b/drivers/gpu/drm/radeon/radeon_legacy_crtc.c
    430 @@ -416,6 +416,7 @@ int radeon_crtc_do_set_base(struct drm_crtc *crtc,
    431 /* Pin framebuffer & get tilling informations */
    432 obj = radeon_fb->obj;
    433 rbo = gem_to_radeon_bo(obj);
    434 +retry:
    435 r = radeon_bo_reserve(rbo, false);
    436 if (unlikely(r != 0))
    437 return r;
    438 @@ -424,6 +425,33 @@ int radeon_crtc_do_set_base(struct drm_crtc *crtc,
    439 &base);
    440 if (unlikely(r != 0)) {
    441 radeon_bo_unreserve(rbo);
    442 +
    443 + /* On old GPU like RN50 with little vram pining can fails because
    444 + * current fb is taking all space needed. So instead of unpining
    445 + * the old buffer after pining the new one, first unpin old one
    446 + * and then retry pining new one.
    447 + *
    448 + * As only master can set mode only master can pin and it is
    449 + * unlikely the master client will race with itself especialy
    450 + * on those old gpu with single crtc.
    451 + *
    452 + * We don't shutdown the display controller because new buffer
    453 + * will end up in same spot.
    454 + */
    455 + if (!atomic && fb && fb != crtc->fb) {
    456 + struct radeon_bo *old_rbo;
    457 + unsigned long nsize, osize;
    458 +
    459 + old_rbo = gem_to_radeon_bo(to_radeon_framebuffer(fb)->obj);
    460 + osize = radeon_bo_size(old_rbo);
    461 + nsize = radeon_bo_size(rbo);
    462 + if (nsize <= osize && !radeon_bo_reserve(old_rbo, false)) {
    463 + radeon_bo_unpin(old_rbo);
    464 + radeon_bo_unreserve(old_rbo);
    465 + fb = NULL;
    466 + goto retry;
    467 + }
    468 + }
    469 return -EINVAL;
    470 }
    471 radeon_bo_get_tiling_flags(rbo, &tiling_flags, NULL);
    472 diff --git a/drivers/gpu/drm/radeon/sid.h b/drivers/gpu/drm/radeon/sid.h
    473 index 1767ae7f..a9fcbe44 100644
    474 --- a/drivers/gpu/drm/radeon/sid.h
    475 +++ b/drivers/gpu/drm/radeon/sid.h
    476 @@ -165,7 +165,7 @@
    477 #define NOOFGROUPS_SHIFT 12
    478 #define NOOFGROUPS_MASK 0x00001000
    479
    480 -#define MC_SEQ_TRAIN_WAKEUP_CNTL 0x2808
    481 +#define MC_SEQ_TRAIN_WAKEUP_CNTL 0x28e8
    482 #define TRAIN_DONE_D0 (1 << 30)
    483 #define TRAIN_DONE_D1 (1 << 31)
    484
    485 diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
    486 index f8187ead..2d692626 100644
    487 --- a/drivers/gpu/drm/ttm/ttm_bo_util.c
    488 +++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
    489 @@ -342,7 +342,9 @@ int ttm_bo_move_memcpy(struct ttm_buffer_object *bo,
    490 if (old_iomap == NULL && ttm == NULL)
    491 goto out2;
    492
    493 - if (ttm->state == tt_unpopulated) {
    494 + /* TTM might be null for moves within the same region.
    495 + */
    496 + if (ttm && ttm->state == tt_unpopulated) {
    497 ret = ttm->bdev->driver->ttm_tt_populate(ttm);
    498 if (ret)
    499 goto out1;
    500 diff --git a/drivers/hid/hid-apple.c b/drivers/hid/hid-apple.c
    501 index 899c7120..9421f643 100644
    502 --- a/drivers/hid/hid-apple.c
    503 +++ b/drivers/hid/hid-apple.c
    504 @@ -48,6 +48,12 @@ module_param(iso_layout, uint, 0644);
    505 MODULE_PARM_DESC(iso_layout, "Enable/Disable hardcoded ISO-layout of the keyboard. "
    506 "(0 = disabled, [1] = enabled)");
    507
    508 +static unsigned int swap_opt_cmd = 0;
    509 +module_param(swap_opt_cmd, uint, 0644);
    510 +MODULE_PARM_DESC(swap_opt_cmd, "Swap the Option (\"Alt\") and Command (\"Flag\") keys. "
    511 + "(For people who want to keep Windows PC keyboard muscle memory. "
    512 + "[0] = as-is, Mac layout. 1 = swapped, Windows layout.)");
    513 +
    514 struct apple_sc {
    515 unsigned long quirks;
    516 unsigned int fn_on;
    517 @@ -152,6 +158,14 @@ static const struct apple_key_translation apple_iso_keyboard[] = {
    518 { }
    519 };
    520
    521 +static const struct apple_key_translation swapped_option_cmd_keys[] = {
    522 + { KEY_LEFTALT, KEY_LEFTMETA },
    523 + { KEY_LEFTMETA, KEY_LEFTALT },
    524 + { KEY_RIGHTALT, KEY_RIGHTMETA },
    525 + { KEY_RIGHTMETA,KEY_RIGHTALT },
    526 + { }
    527 +};
    528 +
    529 static const struct apple_key_translation *apple_find_translation(
    530 const struct apple_key_translation *table, u16 from)
    531 {
    532 @@ -244,6 +258,14 @@ static int hidinput_apple_event(struct hid_device *hid, struct input_dev *input,
    533 }
    534 }
    535
    536 + if (swap_opt_cmd) {
    537 + trans = apple_find_translation(swapped_option_cmd_keys, usage->code);
    538 + if (trans) {
    539 + input_event(input, usage->type, trans->to, value);
    540 + return 1;
    541 + }
    542 + }
    543 +
    544 return 0;
    545 }
    546
    547 diff --git a/drivers/hid/hid-roccat-kovaplus.c b/drivers/hid/hid-roccat-kovaplus.c
    548 index 112d9341..1973cff8 100644
    549 --- a/drivers/hid/hid-roccat-kovaplus.c
    550 +++ b/drivers/hid/hid-roccat-kovaplus.c
    551 @@ -623,9 +623,13 @@ static void kovaplus_keep_values_up_to_date(struct kovaplus_device *kovaplus,
    552 break;
    553 case KOVAPLUS_MOUSE_REPORT_BUTTON_TYPE_CPI:
    554 kovaplus->actual_cpi = kovaplus_convert_event_cpi(button_report->data1);
    555 + break;
    556 case KOVAPLUS_MOUSE_REPORT_BUTTON_TYPE_SENSITIVITY:
    557 kovaplus->actual_x_sensitivity = button_report->data1;
    558 kovaplus->actual_y_sensitivity = button_report->data2;
    559 + break;
    560 + default:
    561 + break;
    562 }
    563 }
    564
    565 diff --git a/drivers/infiniband/hw/ipath/ipath_user_sdma.c b/drivers/infiniband/hw/ipath/ipath_user_sdma.c
    566 index f5cb13b2..cc04b7ba 100644
    567 --- a/drivers/infiniband/hw/ipath/ipath_user_sdma.c
    568 +++ b/drivers/infiniband/hw/ipath/ipath_user_sdma.c
    569 @@ -280,9 +280,7 @@ static int ipath_user_sdma_pin_pages(const struct ipath_devdata *dd,
    570 int j;
    571 int ret;
    572
    573 - ret = get_user_pages(current, current->mm, addr,
    574 - npages, 0, 1, pages, NULL);
    575 -
    576 + ret = get_user_pages_fast(addr, npages, 0, pages);
    577 if (ret != npages) {
    578 int i;
    579
    580 @@ -811,10 +809,7 @@ int ipath_user_sdma_writev(struct ipath_devdata *dd,
    581 while (dim) {
    582 const int mxp = 8;
    583
    584 - down_write(&current->mm->mmap_sem);
    585 ret = ipath_user_sdma_queue_pkts(dd, pq, &list, iov, dim, mxp);
    586 - up_write(&current->mm->mmap_sem);
    587 -
    588 if (ret <= 0)
    589 goto done_unlock;
    590 else {
    591 diff --git a/drivers/input/serio/i8042-x86ia64io.h b/drivers/input/serio/i8042-x86ia64io.h
    592 index 5f306f79..0ec9abbe 100644
    593 --- a/drivers/input/serio/i8042-x86ia64io.h
    594 +++ b/drivers/input/serio/i8042-x86ia64io.h
    595 @@ -765,6 +765,7 @@ static struct pnp_device_id pnp_kbd_devids[] = {
    596 { .id = "CPQA0D7", .driver_data = 0 },
    597 { .id = "", },
    598 };
    599 +MODULE_DEVICE_TABLE(pnp, pnp_kbd_devids);
    600
    601 static struct pnp_driver i8042_pnp_kbd_driver = {
    602 .name = "i8042 kbd",
    603 @@ -786,6 +787,7 @@ static struct pnp_device_id pnp_aux_devids[] = {
    604 { .id = "SYN0801", .driver_data = 0 },
    605 { .id = "", },
    606 };
    607 +MODULE_DEVICE_TABLE(pnp, pnp_aux_devids);
    608
    609 static struct pnp_driver i8042_pnp_aux_driver = {
    610 .name = "i8042 aux",
    611 diff --git a/drivers/md/dm-table.c b/drivers/md/dm-table.c
    612 index f220a695..d509f236 100644
    613 --- a/drivers/md/dm-table.c
    614 +++ b/drivers/md/dm-table.c
    615 @@ -581,14 +581,28 @@ static int adjoin(struct dm_table *table, struct dm_target *ti)
    616
    617 /*
    618 * Used to dynamically allocate the arg array.
    619 + *
    620 + * We do first allocation with GFP_NOIO because dm-mpath and dm-thin must
    621 + * process messages even if some device is suspended. These messages have a
    622 + * small fixed number of arguments.
    623 + *
    624 + * On the other hand, dm-switch needs to process bulk data using messages and
    625 + * excessive use of GFP_NOIO could cause trouble.
    626 */
    627 static char **realloc_argv(unsigned *array_size, char **old_argv)
    628 {
    629 char **argv;
    630 unsigned new_size;
    631 + gfp_t gfp;
    632
    633 - new_size = *array_size ? *array_size * 2 : 64;
    634 - argv = kmalloc(new_size * sizeof(*argv), GFP_KERNEL);
    635 + if (*array_size) {
    636 + new_size = *array_size * 2;
    637 + gfp = GFP_KERNEL;
    638 + } else {
    639 + new_size = 8;
    640 + gfp = GFP_NOIO;
    641 + }
    642 + argv = kmalloc(new_size * sizeof(*argv), gfp);
    643 if (argv) {
    644 memcpy(argv, old_argv, *array_size * sizeof(*argv));
    645 *array_size = new_size;
    646 diff --git a/drivers/md/md.c b/drivers/md/md.c
    647 index 7b45b5e1..e63ca864 100644
    648 --- a/drivers/md/md.c
    649 +++ b/drivers/md/md.c
    650 @@ -3507,6 +3507,7 @@ level_store(struct mddev *mddev, const char *buf, size_t len)
    651 mddev->in_sync = 1;
    652 del_timer_sync(&mddev->safemode_timer);
    653 }
    654 + blk_set_stacking_limits(&mddev->queue->limits);
    655 pers->run(mddev);
    656 mddev_resume(mddev);
    657 set_bit(MD_CHANGE_DEVS, &mddev->flags);
    658 diff --git a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
    659 index 9ec51cec..0f000e60 100644
    660 --- a/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
    661 +++ b/drivers/mtd/nand/gpmi-nand/gpmi-nand.c
    662 @@ -227,8 +227,6 @@ static void dma_irq_callback(void *param)
    663 struct gpmi_nand_data *this = param;
    664 struct completion *dma_c = &this->dma_done;
    665
    666 - complete(dma_c);
    667 -
    668 switch (this->dma_type) {
    669 case DMA_FOR_COMMAND:
    670 dma_unmap_sg(this->dev, &this->cmd_sgl, 1, DMA_TO_DEVICE);
    671 @@ -253,6 +251,8 @@ static void dma_irq_callback(void *param)
    672 default:
    673 pr_err("in wrong DMA operation.\n");
    674 }
    675 +
    676 + complete(dma_c);
    677 }
    678
    679 int start_dma_without_bch_irq(struct gpmi_nand_data *this,
    680 diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c
    681 index eb9f5fb0..e50a0b48 100644
    682 --- a/drivers/mtd/nand/nand_base.c
    683 +++ b/drivers/mtd/nand/nand_base.c
    684 @@ -2888,10 +2888,21 @@ static int nand_flash_detect_onfi(struct mtd_info *mtd, struct nand_chip *chip,
    685 sanitize_string(p->model, sizeof(p->model));
    686 if (!mtd->name)
    687 mtd->name = p->model;
    688 +
    689 mtd->writesize = le32_to_cpu(p->byte_per_page);
    690 - mtd->erasesize = le32_to_cpu(p->pages_per_block) * mtd->writesize;
    691 +
    692 + /*
    693 + * pages_per_block and blocks_per_lun may not be a power-of-2 size
    694 + * (don't ask me who thought of this...). MTD assumes that these
    695 + * dimensions will be power-of-2, so just truncate the remaining area.
    696 + */
    697 + mtd->erasesize = 1 << (fls(le32_to_cpu(p->pages_per_block)) - 1);
    698 + mtd->erasesize *= mtd->writesize;
    699 +
    700 mtd->oobsize = le16_to_cpu(p->spare_bytes_per_page);
    701 - chip->chipsize = le32_to_cpu(p->blocks_per_lun);
    702 +
    703 + /* See erasesize comment */
    704 + chip->chipsize = 1 << (fls(le32_to_cpu(p->blocks_per_lun)) - 1);
    705 chip->chipsize *= (uint64_t)mtd->erasesize * p->lun_count;
    706 *busw = 0;
    707 if (le16_to_cpu(p->features) & 1)
    708 diff --git a/drivers/net/can/flexcan.c b/drivers/net/can/flexcan.c
    709 index e2131ca6..eb4014a2 100644
    710 --- a/drivers/net/can/flexcan.c
    711 +++ b/drivers/net/can/flexcan.c
    712 @@ -667,7 +667,6 @@ static int flexcan_chip_start(struct net_device *dev)
    713 {
    714 struct flexcan_priv *priv = netdev_priv(dev);
    715 struct flexcan_regs __iomem *regs = priv->base;
    716 - unsigned int i;
    717 int err;
    718 u32 reg_mcr, reg_ctrl;
    719
    720 @@ -735,17 +734,6 @@ static int flexcan_chip_start(struct net_device *dev)
    721 netdev_dbg(dev, "%s: writing ctrl=0x%08x", __func__, reg_ctrl);
    722 flexcan_write(reg_ctrl, &regs->ctrl);
    723
    724 - for (i = 0; i < ARRAY_SIZE(regs->cantxfg); i++) {
    725 - flexcan_write(0, &regs->cantxfg[i].can_ctrl);
    726 - flexcan_write(0, &regs->cantxfg[i].can_id);
    727 - flexcan_write(0, &regs->cantxfg[i].data[0]);
    728 - flexcan_write(0, &regs->cantxfg[i].data[1]);
    729 -
    730 - /* put MB into rx queue */
    731 - flexcan_write(FLEXCAN_MB_CNT_CODE(0x4),
    732 - &regs->cantxfg[i].can_ctrl);
    733 - }
    734 -
    735 /* Abort any pending TX, mark Mailbox as INACTIVE */
    736 flexcan_write(FLEXCAN_MB_CNT_CODE(0x4),
    737 &regs->cantxfg[FLEXCAN_TX_BUF_ID].can_ctrl);
    738 diff --git a/drivers/net/wireless/mwifiex/sdio.c b/drivers/net/wireless/mwifiex/sdio.c
    739 index 4be8ccc8..daf55ba8 100644
    740 --- a/drivers/net/wireless/mwifiex/sdio.c
    741 +++ b/drivers/net/wireless/mwifiex/sdio.c
    742 @@ -938,7 +938,10 @@ static int mwifiex_decode_rx_packet(struct mwifiex_adapter *adapter,
    743 struct sk_buff *skb, u32 upld_typ)
    744 {
    745 u8 *cmd_buf;
    746 + __le16 *curr_ptr = (__le16 *)skb->data;
    747 + u16 pkt_len = le16_to_cpu(*curr_ptr);
    748
    749 + skb_trim(skb, pkt_len);
    750 skb_pull(skb, INTF_HEADER_LEN);
    751
    752 switch (upld_typ) {
    753 diff --git a/drivers/net/wireless/prism54/islpci_dev.c b/drivers/net/wireless/prism54/islpci_dev.c
    754 index 5970ff6f..d498b02f 100644
    755 --- a/drivers/net/wireless/prism54/islpci_dev.c
    756 +++ b/drivers/net/wireless/prism54/islpci_dev.c
    757 @@ -811,6 +811,10 @@ static const struct net_device_ops islpci_netdev_ops = {
    758 .ndo_validate_addr = eth_validate_addr,
    759 };
    760
    761 +static struct device_type wlan_type = {
    762 + .name = "wlan",
    763 +};
    764 +
    765 struct net_device *
    766 islpci_setup(struct pci_dev *pdev)
    767 {
    768 @@ -821,9 +825,8 @@ islpci_setup(struct pci_dev *pdev)
    769 return ndev;
    770
    771 pci_set_drvdata(pdev, ndev);
    772 -#if defined(SET_NETDEV_DEV)
    773 SET_NETDEV_DEV(ndev, &pdev->dev);
    774 -#endif
    775 + SET_NETDEV_DEVTYPE(ndev, &wlan_type);
    776
    777 /* setup the structure members */
    778 ndev->base_addr = pci_resource_start(pdev, 0);
    779 diff --git a/drivers/net/wireless/rt2x00/rt2400pci.c b/drivers/net/wireless/rt2x00/rt2400pci.c
    780 index 0ea85f46..131b22b8 100644
    781 --- a/drivers/net/wireless/rt2x00/rt2400pci.c
    782 +++ b/drivers/net/wireless/rt2x00/rt2400pci.c
    783 @@ -1253,7 +1253,7 @@ static void rt2400pci_fill_rxdone(struct queue_entry *entry,
    784 */
    785 rxdesc->timestamp = ((u64)rx_high << 32) | rx_low;
    786 rxdesc->signal = rt2x00_get_field32(word2, RXD_W2_SIGNAL) & ~0x08;
    787 - rxdesc->rssi = rt2x00_get_field32(word2, RXD_W3_RSSI) -
    788 + rxdesc->rssi = rt2x00_get_field32(word3, RXD_W3_RSSI) -
    789 entry->queue->rt2x00dev->rssi_offset;
    790 rxdesc->size = rt2x00_get_field32(word0, RXD_W0_DATABYTE_COUNT);
    791
    792 diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c b/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
    793 index 025bdc2e..4f7f822b 100644
    794 --- a/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
    795 +++ b/drivers/net/wireless/rtlwifi/rtl8192cu/mac.c
    796 @@ -762,7 +762,7 @@ static long _rtl92c_signal_scale_mapping(struct ieee80211_hw *hw,
    797
    798 static void _rtl92c_query_rxphystatus(struct ieee80211_hw *hw,
    799 struct rtl_stats *pstats,
    800 - struct rx_desc_92c *pdesc,
    801 + struct rx_desc_92c *p_desc,
    802 struct rx_fwinfo_92c *p_drvinfo,
    803 bool packet_match_bssid,
    804 bool packet_toself,
    805 @@ -777,11 +777,11 @@ static void _rtl92c_query_rxphystatus(struct ieee80211_hw *hw,
    806 u32 rssi, total_rssi = 0;
    807 bool in_powersavemode = false;
    808 bool is_cck_rate;
    809 + u8 *pdesc = (u8 *)p_desc;
    810
    811 - is_cck_rate = RX_HAL_IS_CCK_RATE(pdesc);
    812 + is_cck_rate = RX_HAL_IS_CCK_RATE(p_desc);
    813 pstats->packet_matchbssid = packet_match_bssid;
    814 pstats->packet_toself = packet_toself;
    815 - pstats->is_cck = is_cck_rate;
    816 pstats->packet_beacon = packet_beacon;
    817 pstats->is_cck = is_cck_rate;
    818 pstats->RX_SIGQ[0] = -1;
    819 diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
    820 index 9adb21a1..2fd82970 100644
    821 --- a/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
    822 +++ b/drivers/net/wireless/rtlwifi/rtl8192cu/trx.c
    823 @@ -303,10 +303,10 @@ out:
    824 bool rtl92cu_rx_query_desc(struct ieee80211_hw *hw,
    825 struct rtl_stats *stats,
    826 struct ieee80211_rx_status *rx_status,
    827 - u8 *p_desc, struct sk_buff *skb)
    828 + u8 *pdesc, struct sk_buff *skb)
    829 {
    830 struct rx_fwinfo_92c *p_drvinfo;
    831 - struct rx_desc_92c *pdesc = (struct rx_desc_92c *)p_desc;
    832 + struct rx_desc_92c *p_desc = (struct rx_desc_92c *)pdesc;
    833 u32 phystatus = GET_RX_DESC_PHY_STATUS(pdesc);
    834
    835 stats->length = (u16) GET_RX_DESC_PKT_LEN(pdesc);
    836 @@ -345,11 +345,11 @@ bool rtl92cu_rx_query_desc(struct ieee80211_hw *hw,
    837 if (phystatus) {
    838 p_drvinfo = (struct rx_fwinfo_92c *)(skb->data +
    839 stats->rx_bufshift);
    840 - rtl92c_translate_rx_signal_stuff(hw, skb, stats, pdesc,
    841 + rtl92c_translate_rx_signal_stuff(hw, skb, stats, p_desc,
    842 p_drvinfo);
    843 }
    844 /*rx_status->qual = stats->signal; */
    845 - rx_status->signal = stats->rssi + 10;
    846 + rx_status->signal = stats->recvsignalpower + 10;
    847 /*rx_status->noise = -stats->noise; */
    848 return true;
    849 }
    850 diff --git a/drivers/net/wireless/rtlwifi/rtl8192de/trx.c b/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
    851 index a7f6126e..1a2bbc2b 100644
    852 --- a/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
    853 +++ b/drivers/net/wireless/rtlwifi/rtl8192de/trx.c
    854 @@ -529,7 +529,7 @@ bool rtl92de_rx_query_desc(struct ieee80211_hw *hw, struct rtl_stats *stats,
    855 p_drvinfo);
    856 }
    857 /*rx_status->qual = stats->signal; */
    858 - rx_status->signal = stats->rssi + 10;
    859 + rx_status->signal = stats->recvsignalpower + 10;
    860 /*rx_status->noise = -stats->noise; */
    861 return true;
    862 }
    863 diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/rf.c b/drivers/net/wireless/rtlwifi/rtl8192se/rf.c
    864 index 08c2f562..c405f967 100644
    865 --- a/drivers/net/wireless/rtlwifi/rtl8192se/rf.c
    866 +++ b/drivers/net/wireless/rtlwifi/rtl8192se/rf.c
    867 @@ -268,7 +268,7 @@ static void _rtl92s_get_txpower_writeval_byregulatory(struct ieee80211_hw *hw,
    868 rtlefuse->pwrgroup_ht40
    869 [RF90_PATH_A][chnl - 1]) {
    870 pwrdiff_limit[i] =
    871 - rtlefuse->pwrgroup_ht20
    872 + rtlefuse->pwrgroup_ht40
    873 [RF90_PATH_A][chnl - 1];
    874 }
    875 } else {
    876 diff --git a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
    877 index 2fd3d13b..94bbce82 100644
    878 --- a/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
    879 +++ b/drivers/net/wireless/rtlwifi/rtl8192se/trx.c
    880 @@ -582,7 +582,7 @@ bool rtl92se_rx_query_desc(struct ieee80211_hw *hw, struct rtl_stats *stats,
    881 }
    882
    883 /*rx_status->qual = stats->signal; */
    884 - rx_status->signal = stats->rssi + 10;
    885 + rx_status->signal = stats->recvsignalpower + 10;
    886 /*rx_status->noise = -stats->noise; */
    887
    888 return true;
    889 diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
    890 index e0610bda..7e41b70a 100644
    891 --- a/drivers/pci/pcie/portdrv_pci.c
    892 +++ b/drivers/pci/pcie/portdrv_pci.c
    893 @@ -151,7 +151,6 @@ static int __devinit pcie_portdrv_probe(struct pci_dev *dev,
    894 static void pcie_portdrv_remove(struct pci_dev *dev)
    895 {
    896 pcie_port_device_remove(dev);
    897 - pci_disable_device(dev);
    898 }
    899
    900 static int error_detected_iter(struct device *device, void *data)
    901 diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c
    902 index 8334dadc..be56590b 100644
    903 --- a/drivers/s390/net/qeth_core_main.c
    904 +++ b/drivers/s390/net/qeth_core_main.c
    905 @@ -4357,7 +4357,7 @@ int qeth_snmp_command(struct qeth_card *card, char __user *udata)
    906 struct qeth_cmd_buffer *iob;
    907 struct qeth_ipa_cmd *cmd;
    908 struct qeth_snmp_ureq *ureq;
    909 - int req_len;
    910 + unsigned int req_len;
    911 struct qeth_arp_query_info qinfo = {0, };
    912 int rc = 0;
    913
    914 @@ -4373,6 +4373,10 @@ int qeth_snmp_command(struct qeth_card *card, char __user *udata)
    915 /* skip 4 bytes (data_len struct member) to get req_len */
    916 if (copy_from_user(&req_len, udata + sizeof(int), sizeof(int)))
    917 return -EFAULT;
    918 + if (req_len > (QETH_BUFSIZE - IPA_PDU_HEADER_SIZE -
    919 + sizeof(struct qeth_ipacmd_hdr) -
    920 + sizeof(struct qeth_ipacmd_setadpparms_hdr)))
    921 + return -EINVAL;
    922 ureq = memdup_user(udata, req_len + sizeof(struct qeth_snmp_ureq_hdr));
    923 if (IS_ERR(ureq)) {
    924 QETH_CARD_TEXT(card, 2, "snmpnome");
    925 diff --git a/drivers/staging/media/lirc/lirc_zilog.c b/drivers/staging/media/lirc/lirc_zilog.c
    926 index 76ea4a8f..56a96d32 100644
    927 --- a/drivers/staging/media/lirc/lirc_zilog.c
    928 +++ b/drivers/staging/media/lirc/lirc_zilog.c
    929 @@ -61,6 +61,9 @@
    930 #include <media/lirc_dev.h>
    931 #include <media/lirc.h>
    932
    933 +/* Max transfer size done by I2C transfer functions */
    934 +#define MAX_XFER_SIZE 64
    935 +
    936 struct IR;
    937
    938 struct IR_rx {
    939 @@ -942,7 +945,14 @@ static ssize_t read(struct file *filep, char *outbuf, size_t n, loff_t *ppos)
    940 schedule();
    941 set_current_state(TASK_INTERRUPTIBLE);
    942 } else {
    943 - unsigned char buf[rbuf->chunk_size];
    944 + unsigned char buf[MAX_XFER_SIZE];
    945 +
    946 + if (rbuf->chunk_size > sizeof(buf)) {
    947 + zilog_error("chunk_size is too big (%d)!\n",
    948 + rbuf->chunk_size);
    949 + ret = -EINVAL;
    950 + break;
    951 + }
    952 m = lirc_buffer_read(rbuf, buf);
    953 if (m == rbuf->chunk_size) {
    954 ret = copy_to_user((void *)outbuf+written, buf,
    955 diff --git a/drivers/staging/tidspbridge/Kconfig b/drivers/staging/tidspbridge/Kconfig
    956 index 0dd479f5..f67c78e5 100644
    957 --- a/drivers/staging/tidspbridge/Kconfig
    958 +++ b/drivers/staging/tidspbridge/Kconfig
    959 @@ -4,7 +4,7 @@
    960
    961 menuconfig TIDSPBRIDGE
    962 tristate "DSP Bridge driver"
    963 - depends on ARCH_OMAP3
    964 + depends on ARCH_OMAP3 && BROKEN
    965 select OMAP_MBOX_FWK
    966 help
    967 DSP/BIOS Bridge is designed for platforms that contain a GPP and
    968 diff --git a/drivers/staging/vt6656/baseband.c b/drivers/staging/vt6656/baseband.c
    969 index 06f27f62..858e2a8e 100644
    970 --- a/drivers/staging/vt6656/baseband.c
    971 +++ b/drivers/staging/vt6656/baseband.c
    972 @@ -976,6 +976,7 @@ BOOL BBbVT3184Init(PSDevice pDevice)
    973 PBYTE pbyAgc;
    974 WORD wLengthAgc;
    975 BYTE abyArray[256];
    976 + u8 data;
    977
    978 ntStatus = CONTROLnsRequestIn(pDevice,
    979 MESSAGE_TYPE_READ,
    980 @@ -1144,6 +1145,16 @@ else {
    981 ControlvWriteByte(pDevice,MESSAGE_REQUEST_BBREG,0x0D,0x01);
    982
    983 RFbRFTableDownload(pDevice);
    984 +
    985 + /* Fix for TX USB resets from vendors driver */
    986 + CONTROLnsRequestIn(pDevice, MESSAGE_TYPE_READ, USB_REG4,
    987 + MESSAGE_REQUEST_MEM, sizeof(data), &data);
    988 +
    989 + data |= 0x2;
    990 +
    991 + CONTROLnsRequestOut(pDevice, MESSAGE_TYPE_WRITE, USB_REG4,
    992 + MESSAGE_REQUEST_MEM, sizeof(data), &data);
    993 +
    994 return TRUE;//ntStatus;
    995 }
    996
    997 diff --git a/drivers/staging/vt6656/rndis.h b/drivers/staging/vt6656/rndis.h
    998 index fccf7e98..dcf7bf54 100644
    999 --- a/drivers/staging/vt6656/rndis.h
    1000 +++ b/drivers/staging/vt6656/rndis.h
    1001 @@ -69,6 +69,7 @@
    1002
    1003 #define VIAUSB20_PACKET_HEADER 0x04
    1004
    1005 +#define USB_REG4 0x604
    1006
    1007 /*--------------------- Export Classes ----------------------------*/
    1008
    1009 diff --git a/drivers/target/iscsi/iscsi_target_auth.c b/drivers/target/iscsi/iscsi_target_auth.c
    1010 index a0fc7b9e..b54f6ecf 100644
    1011 --- a/drivers/target/iscsi/iscsi_target_auth.c
    1012 +++ b/drivers/target/iscsi/iscsi_target_auth.c
    1013 @@ -174,6 +174,7 @@ static int chap_server_compute_md5(
    1014 unsigned char client_digest[MD5_SIGNATURE_SIZE];
    1015 unsigned char server_digest[MD5_SIGNATURE_SIZE];
    1016 unsigned char chap_n[MAX_CHAP_N_SIZE], chap_r[MAX_RESPONSE_LENGTH];
    1017 + size_t compare_len;
    1018 struct iscsi_chap *chap = conn->auth_protocol;
    1019 struct crypto_hash *tfm;
    1020 struct hash_desc desc;
    1021 @@ -212,7 +213,9 @@ static int chap_server_compute_md5(
    1022 goto out;
    1023 }
    1024
    1025 - if (memcmp(chap_n, auth->userid, strlen(auth->userid)) != 0) {
    1026 + /* Include the terminating NULL in the compare */
    1027 + compare_len = strlen(auth->userid) + 1;
    1028 + if (strncmp(chap_n, auth->userid, compare_len) != 0) {
    1029 pr_err("CHAP_N values do not match!\n");
    1030 goto out;
    1031 }
    1032 diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c
    1033 index 2dba448c..60470ee9 100644
    1034 --- a/drivers/target/iscsi/iscsi_target_nego.c
    1035 +++ b/drivers/target/iscsi/iscsi_target_nego.c
    1036 @@ -89,7 +89,7 @@ int extract_param(
    1037 if (len < 0)
    1038 return -1;
    1039
    1040 - if (len > max_length) {
    1041 + if (len >= max_length) {
    1042 pr_err("Length of input: %d exceeds max_length:"
    1043 " %d\n", len, max_length);
    1044 return -1;
    1045 diff --git a/drivers/video/backlight/atmel-pwm-bl.c b/drivers/video/backlight/atmel-pwm-bl.c
    1046 index 0443a4f7..4d2bbd89 100644
    1047 --- a/drivers/video/backlight/atmel-pwm-bl.c
    1048 +++ b/drivers/video/backlight/atmel-pwm-bl.c
    1049 @@ -70,7 +70,7 @@ static int atmel_pwm_bl_set_intensity(struct backlight_device *bd)
    1050 static int atmel_pwm_bl_get_intensity(struct backlight_device *bd)
    1051 {
    1052 struct atmel_pwm_bl *pwmbl = bl_get_data(bd);
    1053 - u8 intensity;
    1054 + u32 intensity;
    1055
    1056 if (pwmbl->pdata->pwm_active_low) {
    1057 intensity = pwm_channel_readl(&pwmbl->pwmc, PWM_CDTY) -
    1058 @@ -80,7 +80,7 @@ static int atmel_pwm_bl_get_intensity(struct backlight_device *bd)
    1059 pwm_channel_readl(&pwmbl->pwmc, PWM_CDTY);
    1060 }
    1061
    1062 - return intensity;
    1063 + return intensity & 0xffff;
    1064 }
    1065
    1066 static int atmel_pwm_bl_init_pwm(struct atmel_pwm_bl *pwmbl)
    1067 diff --git a/fs/devpts/inode.c b/fs/devpts/inode.c
    1068 index 10f5e0b4..901c3d74 100644
    1069 --- a/fs/devpts/inode.c
    1070 +++ b/fs/devpts/inode.c
    1071 @@ -475,6 +475,7 @@ static void devpts_kill_sb(struct super_block *sb)
    1072 {
    1073 struct pts_fs_info *fsi = DEVPTS_SB(sb);
    1074
    1075 + ida_destroy(&fsi->allocated_ptys);
    1076 kfree(fsi);
    1077 kill_litter_super(sb);
    1078 }
    1079 diff --git a/fs/ext4/xattr.c b/fs/ext4/xattr.c
    1080 index b1aa7fd4..01f2cf34 100644
    1081 --- a/fs/ext4/xattr.c
    1082 +++ b/fs/ext4/xattr.c
    1083 @@ -1270,6 +1270,7 @@ retry:
    1084 new_extra_isize = s_min_extra_isize;
    1085 kfree(is); is = NULL;
    1086 kfree(bs); bs = NULL;
    1087 + brelse(bh);
    1088 goto retry;
    1089 }
    1090 error = -1;
    1091 diff --git a/include/linux/mtd/map.h b/include/linux/mtd/map.h
    1092 index 3595a023..292645fc 100644
    1093 --- a/include/linux/mtd/map.h
    1094 +++ b/include/linux/mtd/map.h
    1095 @@ -362,7 +362,7 @@ static inline map_word map_word_load_partial(struct map_info *map, map_word orig
    1096 bitpos = (map_bankwidth(map)-1-i)*8;
    1097 #endif
    1098 orig.x[0] &= ~(0xff << bitpos);
    1099 - orig.x[0] |= buf[i-start] << bitpos;
    1100 + orig.x[0] |= (unsigned long)buf[i-start] << bitpos;
    1101 }
    1102 }
    1103 return orig;
    1104 @@ -381,7 +381,7 @@ static inline map_word map_word_ff(struct map_info *map)
    1105
    1106 if (map_bankwidth(map) < MAP_FF_LIMIT) {
    1107 int bw = 8 * map_bankwidth(map);
    1108 - r.x[0] = (1 << bw) - 1;
    1109 + r.x[0] = (1UL << bw) - 1;
    1110 } else {
    1111 for (i=0; i<map_words(map); i++)
    1112 r.x[i] = ~0UL;
    1113 diff --git a/include/trace/ftrace.h b/include/trace/ftrace.h
    1114 index 76972494..763bf05c 100644
    1115 --- a/include/trace/ftrace.h
    1116 +++ b/include/trace/ftrace.h
    1117 @@ -379,7 +379,8 @@ ftrace_define_fields_##call(struct ftrace_event_call *event_call) \
    1118 __data_size += (len) * sizeof(type);
    1119
    1120 #undef __string
    1121 -#define __string(item, src) __dynamic_array(char, item, strlen(src) + 1)
    1122 +#define __string(item, src) __dynamic_array(char, item, \
    1123 + strlen((src) ? (const char *)(src) : "(null)") + 1)
    1124
    1125 #undef DECLARE_EVENT_CLASS
    1126 #define DECLARE_EVENT_CLASS(call, proto, args, tstruct, assign, print) \
    1127 @@ -504,7 +505,7 @@ static inline notrace int ftrace_get_offsets_##call( \
    1128
    1129 #undef __assign_str
    1130 #define __assign_str(dst, src) \
    1131 - strcpy(__get_str(dst), src);
    1132 + strcpy(__get_str(dst), (src) ? (const char *)(src) : "(null)");
    1133
    1134 #undef TP_fast_assign
    1135 #define TP_fast_assign(args...) args
    1136 diff --git a/kernel/audit.c b/kernel/audit.c
    1137 index 1c7f2c61..4478f7b2 100644
    1138 --- a/kernel/audit.c
    1139 +++ b/kernel/audit.c
    1140 @@ -625,7 +625,7 @@ static int audit_log_common_recv_msg(struct audit_buffer **ab, u16 msg_type,
    1141 char *ctx = NULL;
    1142 u32 len;
    1143
    1144 - if (!audit_enabled) {
    1145 + if (!audit_enabled && msg_type != AUDIT_USER_AVC) {
    1146 *ab = NULL;
    1147 return rc;
    1148 }
    1149 @@ -684,6 +684,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
    1150
    1151 switch (msg_type) {
    1152 case AUDIT_GET:
    1153 + status_set.mask = 0;
    1154 status_set.enabled = audit_enabled;
    1155 status_set.failure = audit_failure;
    1156 status_set.pid = audit_pid;
    1157 @@ -695,7 +696,7 @@ static int audit_receive_msg(struct sk_buff *skb, struct nlmsghdr *nlh)
    1158 &status_set, sizeof(status_set));
    1159 break;
    1160 case AUDIT_SET:
    1161 - if (nlh->nlmsg_len < sizeof(struct audit_status))
    1162 + if (nlmsg_len(nlh) < sizeof(struct audit_status))
    1163 return -EINVAL;
    1164 status_get = (struct audit_status *)data;
    1165 if (status_get->mask & AUDIT_STATUS_ENABLED) {
    1166 diff --git a/kernel/cpuset.c b/kernel/cpuset.c
    1167 index 8fe6f6b6..e372d949 100644
    1168 --- a/kernel/cpuset.c
    1169 +++ b/kernel/cpuset.c
    1170 @@ -983,8 +983,10 @@ static void cpuset_change_task_nodemask(struct task_struct *tsk,
    1171 need_loop = task_has_mempolicy(tsk) ||
    1172 !nodes_intersects(*newmems, tsk->mems_allowed);
    1173
    1174 - if (need_loop)
    1175 + if (need_loop) {
    1176 + local_irq_disable();
    1177 write_seqcount_begin(&tsk->mems_allowed_seq);
    1178 + }
    1179
    1180 nodes_or(tsk->mems_allowed, tsk->mems_allowed, *newmems);
    1181 mpol_rebind_task(tsk, newmems, MPOL_REBIND_STEP1);
    1182 @@ -992,8 +994,10 @@ static void cpuset_change_task_nodemask(struct task_struct *tsk,
    1183 mpol_rebind_task(tsk, newmems, MPOL_REBIND_STEP2);
    1184 tsk->mems_allowed = *newmems;
    1185
    1186 - if (need_loop)
    1187 + if (need_loop) {
    1188 write_seqcount_end(&tsk->mems_allowed_seq);
    1189 + local_irq_enable();
    1190 + }
    1191
    1192 task_unlock(tsk);
    1193 }
    1194 diff --git a/kernel/power/snapshot.c b/kernel/power/snapshot.c
    1195 index 0de28576..91c04f16 100644
    1196 --- a/kernel/power/snapshot.c
    1197 +++ b/kernel/power/snapshot.c
    1198 @@ -1398,7 +1398,11 @@ int hibernate_preallocate_memory(void)
    1199 * highmem and non-highmem zones separately.
    1200 */
    1201 pages_highmem = preallocate_image_highmem(highmem / 2);
    1202 - alloc = (count - max_size) - pages_highmem;
    1203 + alloc = count - max_size;
    1204 + if (alloc > pages_highmem)
    1205 + alloc -= pages_highmem;
    1206 + else
    1207 + alloc = 0;
    1208 pages = preallocate_image_memory(alloc, avail_normal);
    1209 if (pages < alloc) {
    1210 /* We have exhausted non-highmem pages, try highmem. */
    1211 diff --git a/kernel/time/alarmtimer.c b/kernel/time/alarmtimer.c
    1212 index 8a538c55..877aa733 100644
    1213 --- a/kernel/time/alarmtimer.c
    1214 +++ b/kernel/time/alarmtimer.c
    1215 @@ -474,7 +474,7 @@ static int alarm_clock_getres(const clockid_t which_clock, struct timespec *tp)
    1216 clockid_t baseid = alarm_bases[clock2alarm(which_clock)].base_clockid;
    1217
    1218 if (!alarmtimer_get_rtcdev())
    1219 - return -ENOTSUPP;
    1220 + return -EINVAL;
    1221
    1222 return hrtimer_get_res(baseid, tp);
    1223 }
    1224 @@ -491,7 +491,7 @@ static int alarm_clock_get(clockid_t which_clock, struct timespec *tp)
    1225 struct alarm_base *base = &alarm_bases[clock2alarm(which_clock)];
    1226
    1227 if (!alarmtimer_get_rtcdev())
    1228 - return -ENOTSUPP;
    1229 + return -EINVAL;
    1230
    1231 *tp = ktime_to_timespec(base->gettime());
    1232 return 0;
    1233 diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
    1234 index e101cf9a..8c8169bf 100644
    1235 --- a/kernel/trace/ftrace.c
    1236 +++ b/kernel/trace/ftrace.c
    1237 @@ -312,9 +312,6 @@ static int remove_ftrace_list_ops(struct ftrace_ops **list,
    1238
    1239 static int __register_ftrace_function(struct ftrace_ops *ops)
    1240 {
    1241 - if (ftrace_disabled)
    1242 - return -ENODEV;
    1243 -
    1244 if (FTRACE_WARN_ON(ops == &global_ops))
    1245 return -EINVAL;
    1246
    1247 @@ -348,9 +345,6 @@ static int __unregister_ftrace_function(struct ftrace_ops *ops)
    1248 {
    1249 int ret;
    1250
    1251 - if (ftrace_disabled)
    1252 - return -ENODEV;
    1253 -
    1254 if (WARN_ON(!(ops->flags & FTRACE_OPS_FL_ENABLED)))
    1255 return -EBUSY;
    1256
    1257 @@ -1940,10 +1934,15 @@ static void ftrace_startup_enable(int command)
    1258 static int ftrace_startup(struct ftrace_ops *ops, int command)
    1259 {
    1260 bool hash_enable = true;
    1261 + int ret;
    1262
    1263 if (unlikely(ftrace_disabled))
    1264 return -ENODEV;
    1265
    1266 + ret = __register_ftrace_function(ops);
    1267 + if (ret)
    1268 + return ret;
    1269 +
    1270 ftrace_start_up++;
    1271 command |= FTRACE_UPDATE_CALLS;
    1272
    1273 @@ -1965,12 +1964,17 @@ static int ftrace_startup(struct ftrace_ops *ops, int command)
    1274 return 0;
    1275 }
    1276
    1277 -static void ftrace_shutdown(struct ftrace_ops *ops, int command)
    1278 +static int ftrace_shutdown(struct ftrace_ops *ops, int command)
    1279 {
    1280 bool hash_disable = true;
    1281 + int ret;
    1282
    1283 if (unlikely(ftrace_disabled))
    1284 - return;
    1285 + return -ENODEV;
    1286 +
    1287 + ret = __unregister_ftrace_function(ops);
    1288 + if (ret)
    1289 + return ret;
    1290
    1291 ftrace_start_up--;
    1292 /*
    1293 @@ -2005,9 +2009,10 @@ static void ftrace_shutdown(struct ftrace_ops *ops, int command)
    1294 }
    1295
    1296 if (!command || !ftrace_enabled)
    1297 - return;
    1298 + return 0;
    1299
    1300 ftrace_run_update_code(command);
    1301 + return 0;
    1302 }
    1303
    1304 static void ftrace_startup_sysctl(void)
    1305 @@ -2873,16 +2878,13 @@ static void __enable_ftrace_function_probe(void)
    1306 if (i == FTRACE_FUNC_HASHSIZE)
    1307 return;
    1308
    1309 - ret = __register_ftrace_function(&trace_probe_ops);
    1310 - if (!ret)
    1311 - ret = ftrace_startup(&trace_probe_ops, 0);
    1312 + ret = ftrace_startup(&trace_probe_ops, 0);
    1313
    1314 ftrace_probe_registered = 1;
    1315 }
    1316
    1317 static void __disable_ftrace_function_probe(void)
    1318 {
    1319 - int ret;
    1320 int i;
    1321
    1322 if (!ftrace_probe_registered)
    1323 @@ -2895,9 +2897,7 @@ static void __disable_ftrace_function_probe(void)
    1324 }
    1325
    1326 /* no more funcs left */
    1327 - ret = __unregister_ftrace_function(&trace_probe_ops);
    1328 - if (!ret)
    1329 - ftrace_shutdown(&trace_probe_ops, 0);
    1330 + ftrace_shutdown(&trace_probe_ops, 0);
    1331
    1332 ftrace_probe_registered = 0;
    1333 }
    1334 @@ -3948,12 +3948,15 @@ device_initcall(ftrace_nodyn_init);
    1335 static inline int ftrace_init_dyn_debugfs(struct dentry *d_tracer) { return 0; }
    1336 static inline void ftrace_startup_enable(int command) { }
    1337 /* Keep as macros so we do not need to define the commands */
    1338 -# define ftrace_startup(ops, command) \
    1339 - ({ \
    1340 - (ops)->flags |= FTRACE_OPS_FL_ENABLED; \
    1341 - 0; \
    1342 +# define ftrace_startup(ops, command) \
    1343 + ({ \
    1344 + int ___ret = __register_ftrace_function(ops); \
    1345 + if (!___ret) \
    1346 + (ops)->flags |= FTRACE_OPS_FL_ENABLED; \
    1347 + ___ret; \
    1348 })
    1349 -# define ftrace_shutdown(ops, command) do { } while (0)
    1350 +# define ftrace_shutdown(ops, command) __unregister_ftrace_function(ops)
    1351 +
    1352 # define ftrace_startup_sysctl() do { } while (0)
    1353 # define ftrace_shutdown_sysctl() do { } while (0)
    1354
    1355 @@ -4323,15 +4326,8 @@ int register_ftrace_function(struct ftrace_ops *ops)
    1356
    1357 mutex_lock(&ftrace_lock);
    1358
    1359 - if (unlikely(ftrace_disabled))
    1360 - goto out_unlock;
    1361 -
    1362 - ret = __register_ftrace_function(ops);
    1363 - if (!ret)
    1364 - ret = ftrace_startup(ops, 0);
    1365 -
    1366 + ret = ftrace_startup(ops, 0);
    1367
    1368 - out_unlock:
    1369 mutex_unlock(&ftrace_lock);
    1370 return ret;
    1371 }
    1372 @@ -4348,9 +4344,7 @@ int unregister_ftrace_function(struct ftrace_ops *ops)
    1373 int ret;
    1374
    1375 mutex_lock(&ftrace_lock);
    1376 - ret = __unregister_ftrace_function(ops);
    1377 - if (!ret)
    1378 - ftrace_shutdown(ops, 0);
    1379 + ret = ftrace_shutdown(ops, 0);
    1380 mutex_unlock(&ftrace_lock);
    1381
    1382 return ret;
    1383 @@ -4544,6 +4538,12 @@ ftrace_suspend_notifier_call(struct notifier_block *bl, unsigned long state,
    1384 return NOTIFY_DONE;
    1385 }
    1386
    1387 +/* Just a place holder for function graph */
    1388 +static struct ftrace_ops fgraph_ops __read_mostly = {
    1389 + .func = ftrace_stub,
    1390 + .flags = FTRACE_OPS_FL_GLOBAL,
    1391 +};
    1392 +
    1393 int register_ftrace_graph(trace_func_graph_ret_t retfunc,
    1394 trace_func_graph_ent_t entryfunc)
    1395 {
    1396 @@ -4570,7 +4570,7 @@ int register_ftrace_graph(trace_func_graph_ret_t retfunc,
    1397 ftrace_graph_return = retfunc;
    1398 ftrace_graph_entry = entryfunc;
    1399
    1400 - ret = ftrace_startup(&global_ops, FTRACE_START_FUNC_RET);
    1401 + ret = ftrace_startup(&fgraph_ops, FTRACE_START_FUNC_RET);
    1402
    1403 out:
    1404 mutex_unlock(&ftrace_lock);
    1405 @@ -4587,7 +4587,7 @@ void unregister_ftrace_graph(void)
    1406 ftrace_graph_active--;
    1407 ftrace_graph_return = (trace_func_graph_ret_t)ftrace_stub;
    1408 ftrace_graph_entry = ftrace_graph_entry_stub;
    1409 - ftrace_shutdown(&global_ops, FTRACE_STOP_FUNC_RET);
    1410 + ftrace_shutdown(&fgraph_ops, FTRACE_STOP_FUNC_RET);
    1411 unregister_pm_notifier(&ftrace_suspend_notifier);
    1412 unregister_trace_sched_switch(ftrace_graph_probe_sched_switch, NULL);
    1413
    1414 diff --git a/lib/vsprintf.c b/lib/vsprintf.c
    1415 index abbabec9..73e2c45a 100644
    1416 --- a/lib/vsprintf.c
    1417 +++ b/lib/vsprintf.c
    1418 @@ -25,6 +25,7 @@
    1419 #include <linux/kallsyms.h>
    1420 #include <linux/uaccess.h>
    1421 #include <linux/ioport.h>
    1422 +#include <linux/cred.h>
    1423 #include <net/addrconf.h>
    1424
    1425 #include <asm/page.h> /* for PAGE_SIZE */
    1426 @@ -930,11 +931,37 @@ char *pointer(const char *fmt, char *buf, char *end, void *ptr,
    1427 spec.field_width = 2 * sizeof(void *);
    1428 return string(buf, end, "pK-error", spec);
    1429 }
    1430 - if (!((kptr_restrict == 0) ||
    1431 - (kptr_restrict == 1 &&
    1432 - has_capability_noaudit(current, CAP_SYSLOG))))
    1433 +
    1434 + switch (kptr_restrict) {
    1435 + case 0:
    1436 + /* Always print %pK values */
    1437 + break;
    1438 + case 1: {
    1439 + /*
    1440 + * Only print the real pointer value if the current
    1441 + * process has CAP_SYSLOG and is running with the
    1442 + * same credentials it started with. This is because
    1443 + * access to files is checked at open() time, but %pK
    1444 + * checks permission at read() time. We don't want to
    1445 + * leak pointer values if a binary opens a file using
    1446 + * %pK and then elevates privileges before reading it.
    1447 + */
    1448 + const struct cred *cred = current_cred();
    1449 +
    1450 + if (!has_capability_noaudit(current, CAP_SYSLOG) ||
    1451 + (cred->euid != cred->uid) ||
    1452 + (cred->egid != cred->gid))
    1453 + ptr = NULL;
    1454 + break;
    1455 + }
    1456 + case 2:
    1457 + default:
    1458 + /* Always print 0's for %pK */
    1459 ptr = NULL;
    1460 + break;
    1461 + }
    1462 break;
    1463 +
    1464 case 'N':
    1465 switch (fmt[1]) {
    1466 case 'F':
    1467 diff --git a/security/selinux/netlabel.c b/security/selinux/netlabel.c
    1468 index da4b8b23..6235d052 100644
    1469 --- a/security/selinux/netlabel.c
    1470 +++ b/security/selinux/netlabel.c
    1471 @@ -442,8 +442,7 @@ int selinux_netlbl_socket_connect(struct sock *sk, struct sockaddr *addr)
    1472 sksec->nlbl_state != NLBL_CONNLABELED)
    1473 return 0;
    1474
    1475 - local_bh_disable();
    1476 - bh_lock_sock_nested(sk);
    1477 + lock_sock(sk);
    1478
    1479 /* connected sockets are allowed to disconnect when the address family
    1480 * is set to AF_UNSPEC, if that is what is happening we want to reset
    1481 @@ -464,7 +463,6 @@ int selinux_netlbl_socket_connect(struct sock *sk, struct sockaddr *addr)
    1482 sksec->nlbl_state = NLBL_CONNLABELED;
    1483
    1484 socket_connect_return:
    1485 - bh_unlock_sock(sk);
    1486 - local_bh_enable();
    1487 + release_sock(sk);
    1488 return rc;
    1489 }
    1490 diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
    1491 index 810f1fc2..c32ae4d5 100644
    1492 --- a/sound/pci/hda/patch_realtek.c
    1493 +++ b/sound/pci/hda/patch_realtek.c
    1494 @@ -6969,6 +6969,7 @@ static int patch_alc662(struct hda_codec *codec)
    1495 case 0x10ec0272:
    1496 case 0x10ec0663:
    1497 case 0x10ec0665:
    1498 + case 0x10ec0668:
    1499 set_beep_amp(spec, 0x0b, 0x04, HDA_INPUT);
    1500 break;
    1501 case 0x10ec0273:
    1502 diff --git a/sound/soc/blackfin/bf5xx-i2s.c b/sound/soc/blackfin/bf5xx-i2s.c
    1503 index 4dccf037..f59a961b 100644
    1504 --- a/sound/soc/blackfin/bf5xx-i2s.c
    1505 +++ b/sound/soc/blackfin/bf5xx-i2s.c
    1506 @@ -111,6 +111,7 @@ static int bf5xx_i2s_hw_params(struct snd_pcm_substream *substream,
    1507 bf5xx_i2s->tcr2 |= 7;
    1508 bf5xx_i2s->rcr2 |= 7;
    1509 sport_handle->wdsize = 1;
    1510 + break;
    1511 case SNDRV_PCM_FORMAT_S16_LE:
    1512 bf5xx_i2s->tcr2 |= 15;
    1513 bf5xx_i2s->rcr2 |= 15;
    1514 diff --git a/sound/soc/codecs/ak4642.c b/sound/soc/codecs/ak4642.c
    1515 index b3e24f28..7e4245f1 100644
    1516 --- a/sound/soc/codecs/ak4642.c
    1517 +++ b/sound/soc/codecs/ak4642.c
    1518 @@ -262,7 +262,7 @@ static int ak4642_dai_startup(struct snd_pcm_substream *substream,
    1519 * This operation came from example code of
    1520 * "ASAHI KASEI AK4642" (japanese) manual p94.
    1521 */
    1522 - snd_soc_write(codec, SG_SL1, PMMP | MGAIN0);
    1523 + snd_soc_update_bits(codec, SG_SL1, PMMP | MGAIN0, PMMP | MGAIN0);
    1524 snd_soc_write(codec, TIMER, ZTM(0x3) | WTM(0x3));
    1525 snd_soc_write(codec, ALC_CTL1, ALC | LMTH0);
    1526 snd_soc_update_bits(codec, PW_MGMT1, PMADL, PMADL);
    1527 diff --git a/sound/soc/codecs/wm8962.c b/sound/soc/codecs/wm8962.c
    1528 index e96c6ede..0b5132f7 100644
    1529 --- a/sound/soc/codecs/wm8962.c
    1530 +++ b/sound/soc/codecs/wm8962.c
    1531 @@ -3675,6 +3675,8 @@ static __devinit int wm8962_i2c_probe(struct i2c_client *i2c,
    1532 if (ret < 0)
    1533 goto err_regmap;
    1534
    1535 + regcache_cache_only(wm8962->regmap, true);
    1536 +
    1537 /* The drivers should power up as needed */
    1538 regulator_bulk_disable(ARRAY_SIZE(wm8962->supplies), wm8962->supplies);
    1539
    1540 diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c
    1541 index bdfbc1be..91a0a2f8 100644
    1542 --- a/virt/kvm/kvm_main.c
    1543 +++ b/virt/kvm/kvm_main.c
    1544 @@ -774,7 +774,7 @@ int __kvm_set_memory_region(struct kvm *kvm,
    1545 /* destroy any largepage mappings for dirty tracking */
    1546 }
    1547
    1548 - if (!npages) {
    1549 + if (!npages || base_gfn != old.base_gfn) {
    1550 struct kvm_memory_slot *slot;
    1551
    1552 r = -ENOMEM;
    1553 @@ -790,8 +790,10 @@ int __kvm_set_memory_region(struct kvm *kvm,
    1554 old_memslots = kvm->memslots;
    1555 rcu_assign_pointer(kvm->memslots, slots);
    1556 synchronize_srcu_expedited(&kvm->srcu);
    1557 - /* From this point no new shadow pages pointing to a deleted
    1558 - * memslot will be created.
    1559 + /* slot was deleted or moved, clear iommu mapping */
    1560 + kvm_iommu_unmap_pages(kvm, &old);
    1561 + /* From this point no new shadow pages pointing to a deleted,
    1562 + * or moved, memslot will be created.
    1563 *
    1564 * validation of sp->gfn happens in:
    1565 * - gfn_to_hva (kvm_read_guest, gfn_to_pfn)
    1566 @@ -805,20 +807,19 @@ int __kvm_set_memory_region(struct kvm *kvm,
    1567 if (r)
    1568 goto out_free;
    1569
    1570 - /* map/unmap the pages in iommu page table */
    1571 - if (npages) {
    1572 - r = kvm_iommu_map_pages(kvm, &new);
    1573 - if (r)
    1574 - goto out_free;
    1575 - } else
    1576 - kvm_iommu_unmap_pages(kvm, &old);
    1577 -
    1578 r = -ENOMEM;
    1579 slots = kmemdup(kvm->memslots, sizeof(struct kvm_memslots),
    1580 GFP_KERNEL);
    1581 if (!slots)
    1582 goto out_free;
    1583
    1584 + /* map new memory slot into the iommu */
    1585 + if (npages) {
    1586 + r = kvm_iommu_map_pages(kvm, &new);
    1587 + if (r)
    1588 + goto out_slots;
    1589 + }
    1590 +
    1591 /* actual memory is freed via old in kvm_free_physmem_slot below */
    1592 if (!npages) {
    1593 new.rmap = NULL;
    1594 @@ -845,6 +846,8 @@ int __kvm_set_memory_region(struct kvm *kvm,
    1595
    1596 return 0;
    1597
    1598 +out_slots:
    1599 + kfree(slots);
    1600 out_free:
    1601 kvm_free_physmem_slot(&new, &old);
    1602 out: