Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel-magellan/patches-3.17/0106-3.17.7-all-fixes.patch

    Contents of /trunk/kernel-magellan/patches-3.17/0106-3.17.7-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2537 - (show annotations) (download)
    Fri Jan 30 10:05:41 2015 UTC (9 years, 3 months ago) by niro
    File size: 35154 byte(s) 
    -linux-3.17.7
    1 diff --git a/Makefile b/Makefile
    2 index bb43e9e6a79c..267f8936ff69 100644
    3 --- a/Makefile
    4 +++ b/Makefile
    5 @@ -1,6 +1,6 @@
    6 VERSION = 3
    7 PATCHLEVEL = 17
    8 -SUBLEVEL = 6
    9 +SUBLEVEL = 7
    10 EXTRAVERSION =
    11 NAME = Shuffling Zombie Juror
    12
    13 diff --git a/arch/mips/net/bpf_jit.c b/arch/mips/net/bpf_jit.c
    14 index 9f7ecbda250c..1588716e32be 100644
    15 --- a/arch/mips/net/bpf_jit.c
    16 +++ b/arch/mips/net/bpf_jit.c
    17 @@ -430,7 +430,7 @@ static inline void emit_mod(unsigned int dst, unsigned int src,
    18 u32 *p = &ctx->target[ctx->idx];
    19 uasm_i_divu(&p, dst, src);
    20 p = &ctx->target[ctx->idx + 1];
    21 - uasm_i_mflo(&p, dst);
    22 + uasm_i_mfhi(&p, dst);
    23 }
    24 ctx->idx += 2; /* 2 insts */
    25 }
    26 @@ -1006,7 +1006,7 @@ load_ind:
    27 break;
    28 case BPF_ALU | BPF_MOD | BPF_K:
    29 /* A %= k */
    30 - if (k == 1 || optimize_div(&k)) {
    31 + if (k == 1) {
    32 ctx->flags |= SEEN_A;
    33 emit_jit_reg_move(r_A, r_zero, ctx);
    34 } else {
    35 diff --git a/arch/x86/boot/compressed/Makefile b/arch/x86/boot/compressed/Makefile
    36 index 14fe7cba21d1..b5bb49866bcc 100644
    37 --- a/arch/x86/boot/compressed/Makefile
    38 +++ b/arch/x86/boot/compressed/Makefile
    39 @@ -75,7 +75,7 @@ suffix-$(CONFIG_KERNEL_XZ) := xz
    40 suffix-$(CONFIG_KERNEL_LZO) := lzo
    41 suffix-$(CONFIG_KERNEL_LZ4) := lz4
    42
    43 -RUN_SIZE = $(shell objdump -h vmlinux | \
    44 +RUN_SIZE = $(shell $(OBJDUMP) -h vmlinux | \
    45 perl $(srctree)/arch/x86/tools/calc_run_size.pl)
    46 quiet_cmd_mkpiggy = MKPIGGY $@
    47 cmd_mkpiggy = $(obj)/mkpiggy $< $(RUN_SIZE) > $@ || ( rm -f $@ ; false )
    48 diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
    49 index cf79c4cdf955..c874859b4565 100644
    50 --- a/drivers/acpi/ec.c
    51 +++ b/drivers/acpi/ec.c
    52 @@ -299,11 +299,11 @@ static int acpi_ec_transaction_unlocked(struct acpi_ec *ec,
    53 /* following two actions should be kept atomic */
    54 ec->curr = t;
    55 start_transaction(ec);
    56 - if (ec->curr->command == ACPI_EC_COMMAND_QUERY)
    57 - clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags);
    58 spin_unlock_irqrestore(&ec->lock, tmp);
    59 ret = ec_poll(ec);
    60 spin_lock_irqsave(&ec->lock, tmp);
    61 + if (ec->curr->command == ACPI_EC_COMMAND_QUERY)
    62 + clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags);
    63 ec->curr = NULL;
    64 spin_unlock_irqrestore(&ec->lock, tmp);
    65 return ret;
    66 diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
    67 index 597b15e7f6e5..363a2576553a 100644
    68 --- a/drivers/ata/ahci.c
    69 +++ b/drivers/ata/ahci.c
    70 @@ -321,6 +321,9 @@ static const struct pci_device_id ahci_pci_tbl[] = {
    71 { PCI_VDEVICE(INTEL, 0x8c87), board_ahci }, /* 9 Series RAID */
    72 { PCI_VDEVICE(INTEL, 0x8c8e), board_ahci }, /* 9 Series RAID */
    73 { PCI_VDEVICE(INTEL, 0x8c8f), board_ahci }, /* 9 Series RAID */
    74 + { PCI_VDEVICE(INTEL, 0x9d03), board_ahci }, /* Sunrise Point-LP AHCI */
    75 + { PCI_VDEVICE(INTEL, 0x9d05), board_ahci }, /* Sunrise Point-LP RAID */
    76 + { PCI_VDEVICE(INTEL, 0x9d07), board_ahci }, /* Sunrise Point-LP RAID */
    77 { PCI_VDEVICE(INTEL, 0xa103), board_ahci }, /* Sunrise Point-H AHCI */
    78 { PCI_VDEVICE(INTEL, 0xa103), board_ahci }, /* Sunrise Point-H RAID */
    79 { PCI_VDEVICE(INTEL, 0xa105), board_ahci }, /* Sunrise Point-H RAID */
    80 @@ -492,6 +495,7 @@ static const struct pci_device_id ahci_pci_tbl[] = {
    81 * enabled. https://bugzilla.kernel.org/show_bug.cgi?id=60731
    82 */
    83 { PCI_VDEVICE(SAMSUNG, 0x1600), board_ahci_nomsi },
    84 + { PCI_VDEVICE(SAMSUNG, 0xa800), board_ahci_nomsi },
    85
    86 /* Enmotus */
    87 { PCI_DEVICE(0x1c44, 0x8000), board_ahci },
    88 diff --git a/drivers/ata/sata_fsl.c b/drivers/ata/sata_fsl.c
    89 index 07bc7e4dbd04..65071591b143 100644
    90 --- a/drivers/ata/sata_fsl.c
    91 +++ b/drivers/ata/sata_fsl.c
    92 @@ -1488,7 +1488,7 @@ static int sata_fsl_probe(struct platform_device *ofdev)
    93 host_priv->csr_base = csr_base;
    94
    95 irq = irq_of_parse_and_map(ofdev->dev.of_node, 0);
    96 - if (irq < 0) {
    97 + if (!irq) {
    98 dev_err(&ofdev->dev, "invalid irq from platform\n");
    99 goto error_exit_with_cleanup;
    100 }
    101 diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
    102 index 7bd17b3ee95c..8663c21093d1 100644
    103 --- a/drivers/gpu/drm/i915/intel_display.c
    104 +++ b/drivers/gpu/drm/i915/intel_display.c
    105 @@ -4209,7 +4209,6 @@ static void ironlake_crtc_disable(struct drm_crtc *crtc)
    106 ironlake_fdi_disable(crtc);
    107
    108 ironlake_disable_pch_transcoder(dev_priv, pipe);
    109 - intel_set_pch_fifo_underrun_reporting(dev, pipe, true);
    110
    111 if (HAS_PCH_CPT(dev)) {
    112 /* disable TRANS_DP_CTL */
    113 @@ -4274,7 +4273,6 @@ static void haswell_crtc_disable(struct drm_crtc *crtc)
    114
    115 if (intel_crtc->config.has_pch_encoder) {
    116 lpt_disable_pch_transcoder(dev_priv);
    117 - intel_set_pch_fifo_underrun_reporting(dev, TRANSCODER_A, true);
    118 intel_ddi_fdi_disable(crtc);
    119 }
    120
    121 diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
    122 index fdf40267249c..4cc77e74e1f6 100644
    123 --- a/drivers/gpu/drm/i915/intel_lvds.c
    124 +++ b/drivers/gpu/drm/i915/intel_lvds.c
    125 @@ -900,6 +900,17 @@ void intel_lvds_init(struct drm_device *dev)
    126 int pipe;
    127 u8 pin;
    128
    129 + /*
    130 + * Unlock registers and just leave them unlocked. Do this before
    131 + * checking quirk lists to avoid bogus WARNINGs.
    132 + */
    133 + if (HAS_PCH_SPLIT(dev)) {
    134 + I915_WRITE(PCH_PP_CONTROL,
    135 + I915_READ(PCH_PP_CONTROL) | PANEL_UNLOCK_REGS);
    136 + } else {
    137 + I915_WRITE(PP_CONTROL,
    138 + I915_READ(PP_CONTROL) | PANEL_UNLOCK_REGS);
    139 + }
    140 if (!intel_lvds_supported(dev))
    141 return;
    142
    143 @@ -1098,17 +1109,6 @@ out:
    144 lvds_encoder->a3_power = I915_READ(lvds_encoder->reg) &
    145 LVDS_A3_POWER_MASK;
    146
    147 - /*
    148 - * Unlock registers and just
    149 - * leave them unlocked
    150 - */
    151 - if (HAS_PCH_SPLIT(dev)) {
    152 - I915_WRITE(PCH_PP_CONTROL,
    153 - I915_READ(PCH_PP_CONTROL) | PANEL_UNLOCK_REGS);
    154 - } else {
    155 - I915_WRITE(PP_CONTROL,
    156 - I915_READ(PP_CONTROL) | PANEL_UNLOCK_REGS);
    157 - }
    158 lvds_connector->lid_notifier.notifier_call = intel_lid_notify;
    159 if (acpi_lid_notifier_register(&lvds_connector->lid_notifier)) {
    160 DRM_DEBUG_KMS("lid notifier registration failed\n");
    161 diff --git a/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c b/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c
    162 index da153a2cb6b5..f01d019edbfd 100644
    163 --- a/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c
    164 +++ b/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c
    165 @@ -212,7 +212,6 @@ nvc0_identify(struct nouveau_device *device)
    166 device->oclass[NVDEV_ENGINE_BSP ] = &nvc0_bsp_oclass;
    167 device->oclass[NVDEV_ENGINE_PPP ] = &nvc0_ppp_oclass;
    168 device->oclass[NVDEV_ENGINE_COPY0 ] = &nvc0_copy0_oclass;
    169 - device->oclass[NVDEV_ENGINE_COPY1 ] = &nvc0_copy1_oclass;
    170 device->oclass[NVDEV_ENGINE_DISP ] = nva3_disp_oclass;
    171 device->oclass[NVDEV_ENGINE_PERFMON] = &nvc0_perfmon_oclass;
    172 break;
    173 diff --git a/drivers/gpu/drm/nouveau/nouveau_drm.c b/drivers/gpu/drm/nouveau/nouveau_drm.c
    174 index 3ed32dd90303..ace7524e631c 100644
    175 --- a/drivers/gpu/drm/nouveau/nouveau_drm.c
    176 +++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
    177 @@ -626,7 +626,6 @@ int nouveau_pmops_suspend(struct device *dev)
    178
    179 pci_save_state(pdev);
    180 pci_disable_device(pdev);
    181 - pci_ignore_hotplug(pdev);
    182 pci_set_power_state(pdev, PCI_D3hot);
    183 return 0;
    184 }
    185 @@ -930,6 +929,7 @@ static int nouveau_pmops_runtime_suspend(struct device *dev)
    186 ret = nouveau_do_suspend(drm_dev, true);
    187 pci_save_state(pdev);
    188 pci_disable_device(pdev);
    189 + pci_ignore_hotplug(pdev);
    190 pci_set_power_state(pdev, PCI_D3cold);
    191 drm_dev->switch_power_state = DRM_SWITCH_POWER_DYNAMIC_OFF;
    192 return ret;
    193 diff --git a/drivers/gpu/drm/radeon/radeon_cs.c b/drivers/gpu/drm/radeon/radeon_cs.c
    194 index e244c2d72730..67f91571ae79 100644
    195 --- a/drivers/gpu/drm/radeon/radeon_cs.c
    196 +++ b/drivers/gpu/drm/radeon/radeon_cs.c
    197 @@ -226,14 +226,11 @@ static int radeon_cs_get_ring(struct radeon_cs_parser *p, u32 ring, s32 priority
    198
    199 static void radeon_cs_sync_rings(struct radeon_cs_parser *p)
    200 {
    201 - int i;
    202 -
    203 - for (i = 0; i < p->nrelocs; i++) {
    204 - if (!p->relocs[i].robj)
    205 - continue;
    206 + struct radeon_cs_reloc *reloc;
    207
    208 + list_for_each_entry(reloc, &p->validated, tv.head) {
    209 radeon_semaphore_sync_to(p->ib.semaphore,
    210 - p->relocs[i].robj->tbo.sync_obj);
    211 + reloc->robj->tbo.sync_obj);
    212 }
    213 }
    214
    215 diff --git a/drivers/gpu/drm/radeon/radeon_kms.c b/drivers/gpu/drm/radeon/radeon_kms.c
    216 index eb7164d07985..82941bd8ca46 100644
    217 --- a/drivers/gpu/drm/radeon/radeon_kms.c
    218 +++ b/drivers/gpu/drm/radeon/radeon_kms.c
    219 @@ -795,6 +795,8 @@ int radeon_get_vblank_timestamp_kms(struct drm_device *dev, int crtc,
    220
    221 /* Get associated drm_crtc: */
    222 drmcrtc = &rdev->mode_info.crtcs[crtc]->base;
    223 + if (!drmcrtc)
    224 + return -EINVAL;
    225
    226 /* Helper routine in DRM core does all the work: */
    227 return drm_calc_vbltimestamp_from_scanoutpos(dev, crtc, max_error,
    228 diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
    229 index 480c87d8edc5..835f402a9faf 100644
    230 --- a/drivers/gpu/drm/radeon/radeon_object.c
    231 +++ b/drivers/gpu/drm/radeon/radeon_object.c
    232 @@ -187,6 +187,13 @@ int radeon_bo_create(struct radeon_device *rdev,
    233 if (!(rdev->flags & RADEON_IS_PCIE))
    234 bo->flags &= ~(RADEON_GEM_GTT_WC | RADEON_GEM_GTT_UC);
    235
    236 +#ifdef CONFIG_X86_32
    237 + /* XXX: Write-combined CPU mappings of GTT seem broken on 32-bit
    238 + * See https://bugs.freedesktop.org/show_bug.cgi?id=84627
    239 + */
    240 + bo->flags &= ~RADEON_GEM_GTT_WC;
    241 +#endif
    242 +
    243 radeon_ttm_placement_from_domain(bo, domain);
    244 /* Kernel allocation are uninterruptible */
    245 down_read(&rdev->pm.mclk_lock);
    246 diff --git a/drivers/i2c/busses/i2c-cadence.c b/drivers/i2c/busses/i2c-cadence.c
    247 index 63f3f03ecc9b..c604f4c3ac0d 100644
    248 --- a/drivers/i2c/busses/i2c-cadence.c
    249 +++ b/drivers/i2c/busses/i2c-cadence.c
    250 @@ -111,6 +111,8 @@
    251 #define CDNS_I2C_DIVA_MAX 4
    252 #define CDNS_I2C_DIVB_MAX 64
    253
    254 +#define CDNS_I2C_TIMEOUT_MAX 0xFF
    255 +
    256 #define cdns_i2c_readreg(offset) readl_relaxed(id->membase + offset)
    257 #define cdns_i2c_writereg(val, offset) writel_relaxed(val, id->membase + offset)
    258
    259 @@ -852,6 +854,15 @@ static int cdns_i2c_probe(struct platform_device *pdev)
    260 goto err_clk_dis;
    261 }
    262
    263 + /*
    264 + * Cadence I2C controller has a bug wherein it generates
    265 + * invalid read transaction after HW timeout in master receiver mode.
    266 + * HW timeout is not used by this driver and the interrupt is disabled.
    267 + * But the feature itself cannot be disabled. Hence maximum value
    268 + * is written to this register to reduce the chances of error.
    269 + */
    270 + cdns_i2c_writereg(CDNS_I2C_TIMEOUT_MAX, CDNS_I2C_TIME_OUT_OFFSET);
    271 +
    272 dev_info(&pdev->dev, "%u kHz mmio %08lx irq %d\n",
    273 id->i2c_clk / 1000, (unsigned long)r_mem->start, id->irq);
    274
    275 diff --git a/drivers/i2c/busses/i2c-davinci.c b/drivers/i2c/busses/i2c-davinci.c
    276 index 4d9614719128..82be5e2da7cf 100644
    277 --- a/drivers/i2c/busses/i2c-davinci.c
    278 +++ b/drivers/i2c/busses/i2c-davinci.c
    279 @@ -411,11 +411,9 @@ i2c_davinci_xfer_msg(struct i2c_adapter *adap, struct i2c_msg *msg, int stop)
    280 if (dev->cmd_err & DAVINCI_I2C_STR_NACK) {
    281 if (msg->flags & I2C_M_IGNORE_NAK)
    282 return msg->len;
    283 - if (stop) {
    284 - w = davinci_i2c_read_reg(dev, DAVINCI_I2C_MDR_REG);
    285 - w |= DAVINCI_I2C_MDR_STP;
    286 - davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, w);
    287 - }
    288 + w = davinci_i2c_read_reg(dev, DAVINCI_I2C_MDR_REG);
    289 + w |= DAVINCI_I2C_MDR_STP;
    290 + davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, w);
    291 return -EREMOTEIO;
    292 }
    293 return -EIO;
    294 diff --git a/drivers/i2c/busses/i2c-omap.c b/drivers/i2c/busses/i2c-omap.c
    295 index 0dffb0e62c3b..493574ee87f5 100644
    296 --- a/drivers/i2c/busses/i2c-omap.c
    297 +++ b/drivers/i2c/busses/i2c-omap.c
    298 @@ -926,14 +926,12 @@ omap_i2c_isr_thread(int this_irq, void *dev_id)
    299 if (stat & OMAP_I2C_STAT_NACK) {
    300 err |= OMAP_I2C_STAT_NACK;
    301 omap_i2c_ack_stat(dev, OMAP_I2C_STAT_NACK);
    302 - break;
    303 }
    304
    305 if (stat & OMAP_I2C_STAT_AL) {
    306 dev_err(dev->dev, "Arbitration lost\n");
    307 err |= OMAP_I2C_STAT_AL;
    308 omap_i2c_ack_stat(dev, OMAP_I2C_STAT_AL);
    309 - break;
    310 }
    311
    312 /*
    313 @@ -958,11 +956,13 @@ omap_i2c_isr_thread(int this_irq, void *dev_id)
    314 if (dev->fifo_size)
    315 num_bytes = dev->buf_len;
    316
    317 - omap_i2c_receive_data(dev, num_bytes, true);
    318 -
    319 - if (dev->errata & I2C_OMAP_ERRATA_I207)
    320 + if (dev->errata & I2C_OMAP_ERRATA_I207) {
    321 i2c_omap_errata_i207(dev, stat);
    322 + num_bytes = (omap_i2c_read_reg(dev,
    323 + OMAP_I2C_BUFSTAT_REG) >> 8) & 0x3F;
    324 + }
    325
    326 + omap_i2c_receive_data(dev, num_bytes, true);
    327 omap_i2c_ack_stat(dev, OMAP_I2C_STAT_RDR);
    328 continue;
    329 }
    330 diff --git a/drivers/input/evdev.c b/drivers/input/evdev.c
    331 index de055451d1af..b535322a36db 100644
    332 --- a/drivers/input/evdev.c
    333 +++ b/drivers/input/evdev.c
    334 @@ -421,7 +421,7 @@ static int evdev_open(struct inode *inode, struct file *file)
    335
    336 err_free_client:
    337 evdev_detach_client(evdev, client);
    338 - kfree(client);
    339 + kvfree(client);
    340 return error;
    341 }
    342
    343 diff --git a/drivers/media/i2c/smiapp/smiapp-core.c b/drivers/media/i2c/smiapp/smiapp-core.c
    344 index 62acb10630f9..818b48d3ac28 100644
    345 --- a/drivers/media/i2c/smiapp/smiapp-core.c
    346 +++ b/drivers/media/i2c/smiapp/smiapp-core.c
    347 @@ -2133,7 +2133,7 @@ static int smiapp_set_selection(struct v4l2_subdev *subdev,
    348 ret = smiapp_set_compose(subdev, fh, sel);
    349 break;
    350 default:
    351 - BUG();
    352 + ret = -EINVAL;
    353 }
    354
    355 mutex_unlock(&sensor->mutex);
    356 diff --git a/drivers/media/rc/ir-rc6-decoder.c b/drivers/media/rc/ir-rc6-decoder.c
    357 index f1f098e22f7e..d16bc67af732 100644
    358 --- a/drivers/media/rc/ir-rc6-decoder.c
    359 +++ b/drivers/media/rc/ir-rc6-decoder.c
    360 @@ -259,8 +259,8 @@ again:
    361 case 32:
    362 if ((scancode & RC6_6A_LCC_MASK) == RC6_6A_MCE_CC) {
    363 protocol = RC_TYPE_RC6_MCE;
    364 - scancode &= ~RC6_6A_MCE_TOGGLE_MASK;
    365 toggle = !!(scancode & RC6_6A_MCE_TOGGLE_MASK);
    366 + scancode &= ~RC6_6A_MCE_TOGGLE_MASK;
    367 } else {
    368 protocol = RC_BIT_RC6_6A_32;
    369 toggle = 0;
    370 diff --git a/drivers/media/usb/s2255/s2255drv.c b/drivers/media/usb/s2255/s2255drv.c
    371 index 2c901861034a..efcaa90529ba 100644
    372 --- a/drivers/media/usb/s2255/s2255drv.c
    373 +++ b/drivers/media/usb/s2255/s2255drv.c
    374 @@ -632,7 +632,7 @@ static void s2255_fillbuff(struct s2255_vc *vc,
    375 break;
    376 case V4L2_PIX_FMT_JPEG:
    377 case V4L2_PIX_FMT_MJPEG:
    378 - buf->vb.v4l2_buf.length = jpgsize;
    379 + vb2_set_plane_payload(&buf->vb, 0, jpgsize);
    380 memcpy(vbuf, tmpbuf, jpgsize);
    381 break;
    382 case V4L2_PIX_FMT_YUV422P:
    383 diff --git a/drivers/net/bonding/bond_netlink.c b/drivers/net/bonding/bond_netlink.c
    384 index d163e112f04c..fc061c3a6485 100644
    385 --- a/drivers/net/bonding/bond_netlink.c
    386 +++ b/drivers/net/bonding/bond_netlink.c
    387 @@ -194,7 +194,12 @@ static int bond_changelink(struct net_device *bond_dev,
    388
    389 bond_option_arp_ip_targets_clear(bond);
    390 nla_for_each_nested(attr, data[IFLA_BOND_ARP_IP_TARGET], rem) {
    391 - __be32 target = nla_get_be32(attr);
    392 + __be32 target;
    393 +
    394 + if (nla_len(attr) < sizeof(target))
    395 + return -EINVAL;
    396 +
    397 + target = nla_get_be32(attr);
    398
    399 bond_opt_initval(&newval, (__force u64)target);
    400 err = __bond_opt_set(bond, BOND_OPT_ARP_TARGETS,
    401 diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
    402 index ba499489969a..cbfa4ff9f3bd 100644
    403 --- a/drivers/net/ethernet/broadcom/tg3.c
    404 +++ b/drivers/net/ethernet/broadcom/tg3.c
    405 @@ -8561,7 +8561,8 @@ static int tg3_init_rings(struct tg3 *tp)
    406 if (tnapi->rx_rcb)
    407 memset(tnapi->rx_rcb, 0, TG3_RX_RCB_RING_BYTES(tp));
    408
    409 - if (tg3_rx_prodring_alloc(tp, &tnapi->prodring)) {
    410 + if (tnapi->prodring.rx_std &&
    411 + tg3_rx_prodring_alloc(tp, &tnapi->prodring)) {
    412 tg3_free_rings(tp);
    413 return -ENOMEM;
    414 }
    415 diff --git a/drivers/net/ethernet/marvell/mvneta.c b/drivers/net/ethernet/marvell/mvneta.c
    416 index ade067de1689..67a84cfaefa1 100644
    417 --- a/drivers/net/ethernet/marvell/mvneta.c
    418 +++ b/drivers/net/ethernet/marvell/mvneta.c
    419 @@ -216,7 +216,7 @@
    420 /* Various constants */
    421
    422 /* Coalescing */
    423 -#define MVNETA_TXDONE_COAL_PKTS 16
    424 +#define MVNETA_TXDONE_COAL_PKTS 1
    425 #define MVNETA_RX_COAL_PKTS 32
    426 #define MVNETA_RX_COAL_USEC 100
    427
    428 @@ -1721,6 +1721,7 @@ static int mvneta_tx(struct sk_buff *skb, struct net_device *dev)
    429 u16 txq_id = skb_get_queue_mapping(skb);
    430 struct mvneta_tx_queue *txq = &pp->txqs[txq_id];
    431 struct mvneta_tx_desc *tx_desc;
    432 + int len = skb->len;
    433 int frags = 0;
    434 u32 tx_cmd;
    435
    436 @@ -1788,7 +1789,7 @@ out:
    437
    438 u64_stats_update_begin(&stats->syncp);
    439 stats->tx_packets++;
    440 - stats->tx_bytes += skb->len;
    441 + stats->tx_bytes += len;
    442 u64_stats_update_end(&stats->syncp);
    443 } else {
    444 dev->stats.tx_dropped++;
    445 diff --git a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
    446 index 5d2498dcf536..cd5cf6d957c7 100644
    447 --- a/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
    448 +++ b/drivers/net/ethernet/mellanox/mlx4/resource_tracker.c
    449 @@ -1546,7 +1546,7 @@ static int qp_alloc_res(struct mlx4_dev *dev, int slave, int op, int cmd,
    450
    451 switch (op) {
    452 case RES_OP_RESERVE:
    453 - count = get_param_l(&in_param);
    454 + count = get_param_l(&in_param) & 0xffffff;
    455 align = get_param_h(&in_param);
    456 err = mlx4_grant_resource(dev, slave, RES_QP, count, 0);
    457 if (err)
    458 diff --git a/drivers/net/vxlan.c b/drivers/net/vxlan.c
    459 index 81a8a296a582..2aa3a8db5334 100644
    460 --- a/drivers/net/vxlan.c
    461 +++ b/drivers/net/vxlan.c
    462 @@ -2050,9 +2050,8 @@ static int vxlan_init(struct net_device *dev)
    463 spin_lock(&vn->sock_lock);
    464 vs = vxlan_find_sock(vxlan->net, ipv6 ? AF_INET6 : AF_INET,
    465 vxlan->dst_port);
    466 - if (vs) {
    467 + if (vs && atomic_add_unless(&vs->refcnt, 1, 0)) {
    468 /* If we have a socket with same port already, reuse it */
    469 - atomic_inc(&vs->refcnt);
    470 vxlan_vs_add_dev(vs, vxlan);
    471 } else {
    472 /* otherwise make new socket outside of RTNL */
    473 @@ -2362,9 +2361,9 @@ static struct socket *vxlan_create_sock(struct net *net, bool ipv6,
    474 if (ipv6) {
    475 udp_conf.family = AF_INET6;
    476 udp_conf.use_udp6_tx_checksums =
    477 - !!(flags & VXLAN_F_UDP_ZERO_CSUM6_TX);
    478 + !(flags & VXLAN_F_UDP_ZERO_CSUM6_TX);
    479 udp_conf.use_udp6_rx_checksums =
    480 - !!(flags & VXLAN_F_UDP_ZERO_CSUM6_RX);
    481 + !(flags & VXLAN_F_UDP_ZERO_CSUM6_RX);
    482 } else {
    483 udp_conf.family = AF_INET;
    484 udp_conf.local_ip.s_addr = INADDR_ANY;
    485 @@ -2459,12 +2458,9 @@ struct vxlan_sock *vxlan_sock_add(struct net *net, __be16 port,
    486
    487 spin_lock(&vn->sock_lock);
    488 vs = vxlan_find_sock(net, ipv6 ? AF_INET6 : AF_INET, port);
    489 - if (vs) {
    490 - if (vs->rcv == rcv)
    491 - atomic_inc(&vs->refcnt);
    492 - else
    493 + if (vs && ((vs->rcv != rcv) ||
    494 + !atomic_add_unless(&vs->refcnt, 1, 0)))
    495 vs = ERR_PTR(-EBUSY);
    496 - }
    497 spin_unlock(&vn->sock_lock);
    498
    499 if (!vs)
    500 diff --git a/drivers/net/xen-netfront.c b/drivers/net/xen-netfront.c
    501 index ca82f545ec2c..646e2dec699c 100644
    502 --- a/drivers/net/xen-netfront.c
    503 +++ b/drivers/net/xen-netfront.c
    504 @@ -496,9 +496,6 @@ static void xennet_make_frags(struct sk_buff *skb, struct netfront_queue *queue,
    505 len = skb_frag_size(frag);
    506 offset = frag->page_offset;
    507
    508 - /* Data must not cross a page boundary. */
    509 - BUG_ON(len + offset > PAGE_SIZE<<compound_order(page));
    510 -
    511 /* Skip unused frames from start of page */
    512 page += offset >> PAGE_SHIFT;
    513 offset &= ~PAGE_MASK;
    514 @@ -506,8 +503,6 @@ static void xennet_make_frags(struct sk_buff *skb, struct netfront_queue *queue,
    515 while (len > 0) {
    516 unsigned long bytes;
    517
    518 - BUG_ON(offset >= PAGE_SIZE);
    519 -
    520 bytes = PAGE_SIZE - offset;
    521 if (bytes > len)
    522 bytes = len;
    523 @@ -632,6 +627,9 @@ static int xennet_start_xmit(struct sk_buff *skb, struct net_device *dev)
    524 slots, skb->len);
    525 if (skb_linearize(skb))
    526 goto drop;
    527 + data = skb->data;
    528 + offset = offset_in_page(data);
    529 + len = skb_headlen(skb);
    530 }
    531
    532 spin_lock_irqsave(&queue->tx_lock, flags);
    533 diff --git a/drivers/of/fdt.c b/drivers/of/fdt.c
    534 index 30e97bcc4f88..d134710de96d 100644
    535 --- a/drivers/of/fdt.c
    536 +++ b/drivers/of/fdt.c
    537 @@ -964,8 +964,6 @@ void __init __weak early_init_dt_add_memory_arch(u64 base, u64 size)
    538 int __init __weak early_init_dt_reserve_memory_arch(phys_addr_t base,
    539 phys_addr_t size, bool nomap)
    540 {
    541 - if (memblock_is_region_reserved(base, size))
    542 - return -EBUSY;
    543 if (nomap)
    544 return memblock_remove(base, size);
    545 return memblock_reserve(base, size);
    546 diff --git a/fs/fat/namei_vfat.c b/fs/fat/namei_vfat.c
    547 index 6df8d3d885e5..b8b92c2f9683 100644
    548 --- a/fs/fat/namei_vfat.c
    549 +++ b/fs/fat/namei_vfat.c
    550 @@ -736,7 +736,12 @@ static struct dentry *vfat_lookup(struct inode *dir, struct dentry *dentry,
    551 }
    552
    553 alias = d_find_alias(inode);
    554 - if (alias && !vfat_d_anon_disconn(alias)) {
    555 + /*
    556 + * Checking "alias->d_parent == dentry->d_parent" to make sure
    557 + * FS is not corrupted (especially double linked dir).
    558 + */
    559 + if (alias && alias->d_parent == dentry->d_parent &&
    560 + !vfat_d_anon_disconn(alias)) {
    561 /*
    562 * This inode has non anonymous-DCACHE_DISCONNECTED
    563 * dentry. This means, the user did ->lookup() by an
    564 @@ -755,12 +760,9 @@ static struct dentry *vfat_lookup(struct inode *dir, struct dentry *dentry,
    565
    566 out:
    567 mutex_unlock(&MSDOS_SB(sb)->s_lock);
    568 - dentry->d_time = dentry->d_parent->d_inode->i_version;
    569 - dentry = d_splice_alias(inode, dentry);
    570 - if (dentry)
    571 - dentry->d_time = dentry->d_parent->d_inode->i_version;
    572 - return dentry;
    573 -
    574 + if (!inode)
    575 + dentry->d_time = dir->i_version;
    576 + return d_splice_alias(inode, dentry);
    577 error:
    578 mutex_unlock(&MSDOS_SB(sb)->s_lock);
    579 return ERR_PTR(err);
    580 @@ -793,7 +795,6 @@ static int vfat_create(struct inode *dir, struct dentry *dentry, umode_t mode,
    581 inode->i_mtime = inode->i_atime = inode->i_ctime = ts;
    582 /* timestamp is already written, so mark_inode_dirty() is unneeded. */
    583
    584 - dentry->d_time = dentry->d_parent->d_inode->i_version;
    585 d_instantiate(dentry, inode);
    586 out:
    587 mutex_unlock(&MSDOS_SB(sb)->s_lock);
    588 @@ -824,6 +825,7 @@ static int vfat_rmdir(struct inode *dir, struct dentry *dentry)
    589 clear_nlink(inode);
    590 inode->i_mtime = inode->i_atime = CURRENT_TIME_SEC;
    591 fat_detach(inode);
    592 + dentry->d_time = dir->i_version;
    593 out:
    594 mutex_unlock(&MSDOS_SB(sb)->s_lock);
    595
    596 @@ -849,6 +851,7 @@ static int vfat_unlink(struct inode *dir, struct dentry *dentry)
    597 clear_nlink(inode);
    598 inode->i_mtime = inode->i_atime = CURRENT_TIME_SEC;
    599 fat_detach(inode);
    600 + dentry->d_time = dir->i_version;
    601 out:
    602 mutex_unlock(&MSDOS_SB(sb)->s_lock);
    603
    604 @@ -889,7 +892,6 @@ static int vfat_mkdir(struct inode *dir, struct dentry *dentry, umode_t mode)
    605 inode->i_mtime = inode->i_atime = inode->i_ctime = ts;
    606 /* timestamp is already written, so mark_inode_dirty() is unneeded. */
    607
    608 - dentry->d_time = dentry->d_parent->d_inode->i_version;
    609 d_instantiate(dentry, inode);
    610
    611 mutex_unlock(&MSDOS_SB(sb)->s_lock);
    612 diff --git a/include/net/inet_common.h b/include/net/inet_common.h
    613 index fe7994c48b75..b2828a06a5a6 100644
    614 --- a/include/net/inet_common.h
    615 +++ b/include/net/inet_common.h
    616 @@ -37,6 +37,8 @@ int inet_ioctl(struct socket *sock, unsigned int cmd, unsigned long arg);
    617 int inet_ctl_sock_create(struct sock **sk, unsigned short family,
    618 unsigned short type, unsigned char protocol,
    619 struct net *net);
    620 +int inet_recv_error(struct sock *sk, struct msghdr *msg, int len,
    621 + int *addr_len);
    622
    623 static inline void inet_ctl_sock_destroy(struct sock *sk)
    624 {
    625 diff --git a/mm/frontswap.c b/mm/frontswap.c
    626 index c30eec536f03..f2a3571c6e22 100644
    627 --- a/mm/frontswap.c
    628 +++ b/mm/frontswap.c
    629 @@ -244,8 +244,10 @@ int __frontswap_store(struct page *page)
    630 the (older) page from frontswap
    631 */
    632 inc_frontswap_failed_stores();
    633 - if (dup)
    634 + if (dup) {
    635 __frontswap_clear(sis, offset);
    636 + frontswap_ops->invalidate_page(type, offset);
    637 + }
    638 }
    639 if (frontswap_writethrough_enabled)
    640 /* report failure so swap also writes to swap device */
    641 diff --git a/mm/memory.c b/mm/memory.c
    642 index 37b80fc3a9b6..e497defd663e 100644
    643 --- a/mm/memory.c
    644 +++ b/mm/memory.c
    645 @@ -815,20 +815,20 @@ copy_one_pte(struct mm_struct *dst_mm, struct mm_struct *src_mm,
    646 if (!pte_file(pte)) {
    647 swp_entry_t entry = pte_to_swp_entry(pte);
    648
    649 - if (swap_duplicate(entry) < 0)
    650 - return entry.val;
    651 -
    652 - /* make sure dst_mm is on swapoff's mmlist. */
    653 - if (unlikely(list_empty(&dst_mm->mmlist))) {
    654 - spin_lock(&mmlist_lock);
    655 - if (list_empty(&dst_mm->mmlist))
    656 - list_add(&dst_mm->mmlist,
    657 - &src_mm->mmlist);
    658 - spin_unlock(&mmlist_lock);
    659 - }
    660 - if (likely(!non_swap_entry(entry)))
    661 + if (likely(!non_swap_entry(entry))) {
    662 + if (swap_duplicate(entry) < 0)
    663 + return entry.val;
    664 +
    665 + /* make sure dst_mm is on swapoff's mmlist. */
    666 + if (unlikely(list_empty(&dst_mm->mmlist))) {
    667 + spin_lock(&mmlist_lock);
    668 + if (list_empty(&dst_mm->mmlist))
    669 + list_add(&dst_mm->mmlist,
    670 + &src_mm->mmlist);
    671 + spin_unlock(&mmlist_lock);
    672 + }
    673 rss[MM_SWAPENTS]++;
    674 - else if (is_migration_entry(entry)) {
    675 + } else if (is_migration_entry(entry)) {
    676 page = migration_entry_to_page(entry);
    677
    678 if (PageAnon(page))
    679 diff --git a/mm/mmap.c b/mm/mmap.c
    680 index ebc25fab1545..a226d31a2395 100644
    681 --- a/mm/mmap.c
    682 +++ b/mm/mmap.c
    683 @@ -752,8 +752,11 @@ again: remove_next = 1 + (end > next->vm_end);
    684 * shrinking vma had, to cover any anon pages imported.
    685 */
    686 if (exporter && exporter->anon_vma && !importer->anon_vma) {
    687 - if (anon_vma_clone(importer, exporter))
    688 - return -ENOMEM;
    689 + int error;
    690 +
    691 + error = anon_vma_clone(importer, exporter);
    692 + if (error)
    693 + return error;
    694 importer->anon_vma = exporter->anon_vma;
    695 }
    696 }
    697 @@ -2453,7 +2456,8 @@ static int __split_vma(struct mm_struct * mm, struct vm_area_struct * vma,
    698 if (err)
    699 goto out_free_vma;
    700
    701 - if (anon_vma_clone(new, vma))
    702 + err = anon_vma_clone(new, vma);
    703 + if (err)
    704 goto out_free_mpol;
    705
    706 if (new->vm_file)
    707 diff --git a/mm/rmap.c b/mm/rmap.c
    708 index e01318d4b07e..1807ca3f8731 100644
    709 --- a/mm/rmap.c
    710 +++ b/mm/rmap.c
    711 @@ -274,6 +274,7 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
    712 {
    713 struct anon_vma_chain *avc;
    714 struct anon_vma *anon_vma;
    715 + int error;
    716
    717 /* Don't bother if the parent process has no anon_vma here. */
    718 if (!pvma->anon_vma)
    719 @@ -283,8 +284,9 @@ int anon_vma_fork(struct vm_area_struct *vma, struct vm_area_struct *pvma)
    720 * First, attach the new VMA to the parent VMA's anon_vmas,
    721 * so rmap can find non-COWed pages in child processes.
    722 */
    723 - if (anon_vma_clone(vma, pvma))
    724 - return -ENOMEM;
    725 + error = anon_vma_clone(vma, pvma);
    726 + if (error)
    727 + return error;
    728
    729 /* Then add our own anon_vma. */
    730 anon_vma = anon_vma_alloc();
    731 diff --git a/mm/slab.c b/mm/slab.c
    732 index 7c52b3890d25..cc91c1ef4e8a 100644
    733 --- a/mm/slab.c
    734 +++ b/mm/slab.c
    735 @@ -3108,7 +3108,7 @@ static void *____cache_alloc_node(struct kmem_cache *cachep, gfp_t flags,
    736 void *obj;
    737 int x;
    738
    739 - VM_BUG_ON(nodeid > num_online_nodes());
    740 + VM_BUG_ON(nodeid < 0 || nodeid >= MAX_NUMNODES);
    741 n = get_node(cachep, nodeid);
    742 BUG_ON(!n);
    743
    744 diff --git a/mm/vmpressure.c b/mm/vmpressure.c
    745 index d4042e75f7c7..c5afd573d7da 100644
    746 --- a/mm/vmpressure.c
    747 +++ b/mm/vmpressure.c
    748 @@ -165,6 +165,7 @@ static void vmpressure_work_fn(struct work_struct *work)
    749 unsigned long scanned;
    750 unsigned long reclaimed;
    751
    752 + spin_lock(&vmpr->sr_lock);
    753 /*
    754 * Several contexts might be calling vmpressure(), so it is
    755 * possible that the work was rescheduled again before the old
    756 @@ -173,11 +174,12 @@ static void vmpressure_work_fn(struct work_struct *work)
    757 * here. No need for any locks here since we don't care if
    758 * vmpr->reclaimed is in sync.
    759 */
    760 - if (!vmpr->scanned)
    761 + scanned = vmpr->scanned;
    762 + if (!scanned) {
    763 + spin_unlock(&vmpr->sr_lock);
    764 return;
    765 + }
    766
    767 - spin_lock(&vmpr->sr_lock);
    768 - scanned = vmpr->scanned;
    769 reclaimed = vmpr->reclaimed;
    770 vmpr->scanned = 0;
    771 vmpr->reclaimed = 0;
    772 diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
    773 index f0493e3b7471..4921b6536ea5 100644
    774 --- a/net/core/rtnetlink.c
    775 +++ b/net/core/rtnetlink.c
    776 @@ -1495,6 +1495,7 @@ static int do_setlink(const struct sk_buff *skb,
    777 goto errout;
    778 }
    779 if (!netlink_ns_capable(skb, net->user_ns, CAP_NET_ADMIN)) {
    780 + put_net(net);
    781 err = -EPERM;
    782 goto errout;
    783 }
    784 diff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c
    785 index d156b3c5f363..bf78bc365481 100644
    786 --- a/net/ipv4/af_inet.c
    787 +++ b/net/ipv4/af_inet.c
    788 @@ -1421,6 +1421,17 @@ out:
    789 return pp;
    790 }
    791
    792 +int inet_recv_error(struct sock *sk, struct msghdr *msg, int len, int *addr_len)
    793 +{
    794 + if (sk->sk_family == AF_INET)
    795 + return ip_recv_error(sk, msg, len, addr_len);
    796 +#if IS_ENABLED(CONFIG_IPV6)
    797 + if (sk->sk_family == AF_INET6)
    798 + return pingv6_ops.ipv6_recv_error(sk, msg, len, addr_len);
    799 +#endif
    800 + return -EINVAL;
    801 +}
    802 +
    803 static int inet_gro_complete(struct sk_buff *skb, int nhoff)
    804 {
    805 __be16 newlen = htons(skb->len - nhoff);
    806 diff --git a/net/ipv4/gre_offload.c b/net/ipv4/gre_offload.c
    807 index dd73bea2a65f..657d80c0931a 100644
    808 --- a/net/ipv4/gre_offload.c
    809 +++ b/net/ipv4/gre_offload.c
    810 @@ -279,6 +279,9 @@ static int gre_gro_complete(struct sk_buff *skb, int nhoff)
    811 err = ptype->callbacks.gro_complete(skb, nhoff + grehlen);
    812
    813 rcu_read_unlock();
    814 +
    815 + skb_set_inner_mac_header(skb, nhoff + grehlen);
    816 +
    817 return err;
    818 }
    819
    820 diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
    821 index e453cb724a95..607395236c95 100644
    822 --- a/net/ipv4/ip_vti.c
    823 +++ b/net/ipv4/ip_vti.c
    824 @@ -528,6 +528,7 @@ static struct rtnl_link_ops vti_link_ops __read_mostly = {
    825 .validate = vti_tunnel_validate,
    826 .newlink = vti_newlink,
    827 .changelink = vti_changelink,
    828 + .dellink = ip_tunnel_dellink,
    829 .get_size = vti_get_size,
    830 .fill_info = vti_fill_info,
    831 };
    832 diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
    833 index 352476233608..b503a3021a71 100644
    834 --- a/net/ipv4/ping.c
    835 +++ b/net/ipv4/ping.c
    836 @@ -855,16 +855,8 @@ int ping_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
    837 if (flags & MSG_OOB)
    838 goto out;
    839
    840 - if (flags & MSG_ERRQUEUE) {
    841 - if (family == AF_INET) {
    842 - return ip_recv_error(sk, msg, len, addr_len);
    843 -#if IS_ENABLED(CONFIG_IPV6)
    844 - } else if (family == AF_INET6) {
    845 - return pingv6_ops.ipv6_recv_error(sk, msg, len,
    846 - addr_len);
    847 -#endif
    848 - }
    849 - }
    850 + if (flags & MSG_ERRQUEUE)
    851 + return inet_recv_error(sk, msg, len, addr_len);
    852
    853 skb = skb_recv_datagram(sk, flags, noblock, &err);
    854 if (!skb)
    855 diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
    856 index 6b0b38fdf4fc..9cbf8b1df165 100644
    857 --- a/net/ipv4/tcp.c
    858 +++ b/net/ipv4/tcp.c
    859 @@ -1633,7 +1633,7 @@ int tcp_recvmsg(struct kiocb *iocb, struct sock *sk, struct msghdr *msg,
    860 u32 urg_hole = 0;
    861
    862 if (unlikely(flags & MSG_ERRQUEUE))
    863 - return ip_recv_error(sk, msg, len, addr_len);
    864 + return inet_recv_error(sk, msg, len, addr_len);
    865
    866 if (sk_can_busy_loop(sk) && skb_queue_empty(&sk->sk_receive_queue) &&
    867 (sk->sk_state == TCP_ESTABLISHED))
    868 diff --git a/net/ipv6/ip6_gre.c b/net/ipv6/ip6_gre.c
    869 index cacb493a133d..33d08abe43db 100644
    870 --- a/net/ipv6/ip6_gre.c
    871 +++ b/net/ipv6/ip6_gre.c
    872 @@ -502,11 +502,11 @@ static int ip6gre_rcv(struct sk_buff *skb)
    873
    874 skb->protocol = gre_proto;
    875 /* WCCP version 1 and 2 protocol decoding.
    876 - * - Change protocol to IP
    877 + * - Change protocol to IPv6
    878 * - When dealing with WCCPv2, Skip extra 4 bytes in GRE header
    879 */
    880 if (flags == 0 && gre_proto == htons(ETH_P_WCCP)) {
    881 - skb->protocol = htons(ETH_P_IP);
    882 + skb->protocol = htons(ETH_P_IPV6);
    883 if ((*(h + offset) & 0xF0) != 0x40)
    884 offset += 4;
    885 }
    886 diff --git a/net/ipv6/ip6_vti.c b/net/ipv6/ip6_vti.c
    887 index 99c9487f236a..3abcd4afeaaf 100644
    888 --- a/net/ipv6/ip6_vti.c
    889 +++ b/net/ipv6/ip6_vti.c
    890 @@ -905,6 +905,15 @@ static int vti6_newlink(struct net *src_net, struct net_device *dev,
    891 return vti6_tnl_create2(dev);
    892 }
    893
    894 +static void vti6_dellink(struct net_device *dev, struct list_head *head)
    895 +{
    896 + struct net *net = dev_net(dev);
    897 + struct vti6_net *ip6n = net_generic(net, vti6_net_id);
    898 +
    899 + if (dev != ip6n->fb_tnl_dev)
    900 + unregister_netdevice_queue(dev, head);
    901 +}
    902 +
    903 static int vti6_changelink(struct net_device *dev, struct nlattr *tb[],
    904 struct nlattr *data[])
    905 {
    906 @@ -980,6 +989,7 @@ static struct rtnl_link_ops vti6_link_ops __read_mostly = {
    907 .setup = vti6_dev_setup,
    908 .validate = vti6_validate,
    909 .newlink = vti6_newlink,
    910 + .dellink = vti6_dellink,
    911 .changelink = vti6_changelink,
    912 .get_size = vti6_get_size,
    913 .fill_info = vti6_fill_info,
    914 @@ -1020,6 +1030,7 @@ static int __net_init vti6_init_net(struct net *net)
    915 if (!ip6n->fb_tnl_dev)
    916 goto err_alloc_dev;
    917 dev_net_set(ip6n->fb_tnl_dev, net);
    918 + ip6n->fb_tnl_dev->rtnl_link_ops = &vti6_link_ops;
    919
    920 err = vti6_fb_tnl_dev_init(ip6n->fb_tnl_dev);
    921 if (err < 0)
    922 diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
    923 index 0007b8180397..b6bf8e8caec7 100644
    924 --- a/net/netlink/af_netlink.c
    925 +++ b/net/netlink/af_netlink.c
    926 @@ -3130,7 +3130,7 @@ static int __init netlink_proto_init(void)
    927 .head_offset = offsetof(struct netlink_sock, node),
    928 .key_offset = offsetof(struct netlink_sock, portid),
    929 .key_len = sizeof(u32), /* portid */
    930 - .hashfn = arch_fast_hash,
    931 + .hashfn = jhash,
    932 .max_shift = 16, /* 64K */
    933 .grow_decision = rht_grow_above_75,
    934 .shrink_decision = rht_shrink_below_30,
    935 diff --git a/net/sctp/output.c b/net/sctp/output.c
    936 index 42dffd428389..fc5e45b8a832 100644
    937 --- a/net/sctp/output.c
    938 +++ b/net/sctp/output.c
    939 @@ -401,12 +401,12 @@ int sctp_packet_transmit(struct sctp_packet *packet)
    940 sk = chunk->skb->sk;
    941
    942 /* Allocate the new skb. */
    943 - nskb = alloc_skb(packet->size + LL_MAX_HEADER, GFP_ATOMIC);
    944 + nskb = alloc_skb(packet->size + MAX_HEADER, GFP_ATOMIC);
    945 if (!nskb)
    946 goto nomem;
    947
    948 /* Make sure the outbound skb has enough header room reserved. */
    949 - skb_reserve(nskb, packet->overhead + LL_MAX_HEADER);
    950 + skb_reserve(nskb, packet->overhead + MAX_HEADER);
    951
    952 /* Set the owning socket so that we know where to get the
    953 * destination IP address.
    954 diff --git a/sound/pci/hda/patch_analog.c b/sound/pci/hda/patch_analog.c
    955 index 06275f8807a8..4714ff92f15e 100644
    956 --- a/sound/pci/hda/patch_analog.c
    957 +++ b/sound/pci/hda/patch_analog.c
    958 @@ -332,6 +332,7 @@ static const struct hda_fixup ad1986a_fixups[] = {
    959
    960 static const struct snd_pci_quirk ad1986a_fixup_tbl[] = {
    961 SND_PCI_QUIRK(0x103c, 0x30af, "HP B2800", AD1986A_FIXUP_LAPTOP_IMIC),
    962 + SND_PCI_QUIRK(0x1043, 0x1443, "ASUS Z99He", AD1986A_FIXUP_EAPD),
    963 SND_PCI_QUIRK(0x1043, 0x1447, "ASUS A8JN", AD1986A_FIXUP_EAPD),
    964 SND_PCI_QUIRK_MASK(0x1043, 0xff00, 0x8100, "ASUS P5", AD1986A_FIXUP_3STACK),
    965 SND_PCI_QUIRK_MASK(0x1043, 0xff00, 0x8200, "ASUS M2", AD1986A_FIXUP_3STACK),
    966 diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
    967 index 623a9d0c8d52..71a2350a974d 100644
    968 --- a/sound/pci/hda/patch_realtek.c
    969 +++ b/sound/pci/hda/patch_realtek.c
    970 @@ -5087,6 +5087,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
    971 SND_PCI_QUIRK(0x17aa, 0x2212, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
    972 SND_PCI_QUIRK(0x17aa, 0x2214, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
    973 SND_PCI_QUIRK(0x17aa, 0x2215, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
    974 + SND_PCI_QUIRK(0x17aa, 0x3977, "IdeaPad S210", ALC283_FIXUP_INT_MIC),
    975 SND_PCI_QUIRK(0x17aa, 0x3978, "IdeaPad Y410P", ALC269_FIXUP_NO_SHUTUP),
    976 SND_PCI_QUIRK(0x17aa, 0x5013, "Thinkpad", ALC269_FIXUP_LIMIT_INT_MIC_BOOST),
    977 SND_PCI_QUIRK(0x17aa, 0x501a, "Thinkpad", ALC283_FIXUP_INT_MIC),
    978 diff --git a/sound/usb/midi.c b/sound/usb/midi.c
    979 index 7b166c2be0f7..3ee6f8815fc6 100644
    980 --- a/sound/usb/midi.c
    981 +++ b/sound/usb/midi.c
    982 @@ -365,6 +365,8 @@ static void snd_usbmidi_error_timer(unsigned long data)
    983 if (in && in->error_resubmit) {
    984 in->error_resubmit = 0;
    985 for (j = 0; j < INPUT_URBS; ++j) {
    986 + if (atomic_read(&in->urbs[j]->use_count))
    987 + continue;
    988 in->urbs[j]->dev = umidi->dev;
    989 snd_usbmidi_submit_urb(in->urbs[j], GFP_ATOMIC);
    990 }