Magellan Linux

  • Back to homepage
    • /[pkg-src]/trunk/kernel26-alx/patches-3.10/0174-3.10.75-all-fixes.patch

    Annotation of /trunk/kernel26-alx/patches-3.10/0174-3.10.75-all-fixes.patch

    Parent Directory Parent Directory | Revision Log Revision Log

    Revision 2672 - (hide annotations) (download)
    Tue Jul 21 16:46:35 2015 UTC (8 years, 9 months ago) by niro
    File size: 25722 byte(s) 
    -3.10.84-alx-r1
    1 niro 2672 diff --git a/Makefile b/Makefile
    2     index d2a3930159ea..87909d8302ad 100644
    3     --- a/Makefile
    4     +++ b/Makefile
    5     @@ -1,6 +1,6 @@
    6     VERSION = 3
    7     PATCHLEVEL = 10
    8     -SUBLEVEL = 74
    9     +SUBLEVEL = 75
    10     EXTRAVERSION =
    11     NAME = TOSSUG Baby Fish
    12    
    13     diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
    14     index a88894190e41..c991fe680e58 100644
    15     --- a/drivers/acpi/processor_idle.c
    16     +++ b/drivers/acpi/processor_idle.c
    17     @@ -978,7 +978,7 @@ static int acpi_processor_setup_cpuidle_states(struct acpi_processor *pr)
    18     return -EINVAL;
    19    
    20     drv->safe_state_index = -1;
    21     - for (i = 0; i < CPUIDLE_STATE_MAX; i++) {
    22     + for (i = CPUIDLE_DRIVER_STATE_START; i < CPUIDLE_STATE_MAX; i++) {
    23     drv->states[i].name[0] = '\0';
    24     drv->states[i].desc[0] = '\0';
    25     }
    26     diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
    27     index cf1576d54363..a5c987ae665d 100644
    28     --- a/drivers/block/nbd.c
    29     +++ b/drivers/block/nbd.c
    30     @@ -815,10 +815,6 @@ static int __init nbd_init(void)
    31     return -EINVAL;
    32     }
    33    
    34     - nbd_dev = kcalloc(nbds_max, sizeof(*nbd_dev), GFP_KERNEL);
    35     - if (!nbd_dev)
    36     - return -ENOMEM;
    37     -
    38     part_shift = 0;
    39     if (max_part > 0) {
    40     part_shift = fls(max_part);
    41     @@ -840,6 +836,10 @@ static int __init nbd_init(void)
    42     if (nbds_max > 1UL << (MINORBITS - part_shift))
    43     return -EINVAL;
    44    
    45     + nbd_dev = kcalloc(nbds_max, sizeof(*nbd_dev), GFP_KERNEL);
    46     + if (!nbd_dev)
    47     + return -ENOMEM;
    48     +
    49     for (i = 0; i < nbds_max; i++) {
    50     struct gendisk *disk = alloc_disk(1 << part_shift);
    51     if (!disk)
    52     diff --git a/drivers/dma/omap-dma.c b/drivers/dma/omap-dma.c
    53     index ec3fc4fd9160..b94a37630e36 100644
    54     --- a/drivers/dma/omap-dma.c
    55     +++ b/drivers/dma/omap-dma.c
    56     @@ -487,6 +487,7 @@ static int omap_dma_terminate_all(struct omap_chan *c)
    57     * c->desc is NULL and exit.)
    58     */
    59     if (c->desc) {
    60     + omap_dma_desc_free(&c->desc->vd);
    61     c->desc = NULL;
    62     /* Avoid stopping the dma twice */
    63     if (!c->paused)
    64     diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c
    65     index b131520521e4..72b02483ff03 100644
    66     --- a/drivers/gpu/drm/radeon/radeon_bios.c
    67     +++ b/drivers/gpu/drm/radeon/radeon_bios.c
    68     @@ -76,7 +76,7 @@ static bool igp_read_bios_from_vram(struct radeon_device *rdev)
    69    
    70     static bool radeon_read_bios(struct radeon_device *rdev)
    71     {
    72     - uint8_t __iomem *bios;
    73     + uint8_t __iomem *bios, val1, val2;
    74     size_t size;
    75    
    76     rdev->bios = NULL;
    77     @@ -86,15 +86,19 @@ static bool radeon_read_bios(struct radeon_device *rdev)
    78     return false;
    79     }
    80    
    81     - if (size == 0 || bios[0] != 0x55 || bios[1] != 0xaa) {
    82     + val1 = readb(&bios[0]);
    83     + val2 = readb(&bios[1]);
    84     +
    85     + if (size == 0 || val1 != 0x55 || val2 != 0xaa) {
    86     pci_unmap_rom(rdev->pdev, bios);
    87     return false;
    88     }
    89     - rdev->bios = kmemdup(bios, size, GFP_KERNEL);
    90     + rdev->bios = kzalloc(size, GFP_KERNEL);
    91     if (rdev->bios == NULL) {
    92     pci_unmap_rom(rdev->pdev, bios);
    93     return false;
    94     }
    95     + memcpy_fromio(rdev->bios, bios, size);
    96     pci_unmap_rom(rdev->pdev, bios);
    97     return true;
    98     }
    99     diff --git a/drivers/iio/imu/adis_trigger.c b/drivers/iio/imu/adis_trigger.c
    100     index e0017c22bb9c..f53e9a803a0e 100644
    101     --- a/drivers/iio/imu/adis_trigger.c
    102     +++ b/drivers/iio/imu/adis_trigger.c
    103     @@ -60,7 +60,7 @@ int adis_probe_trigger(struct adis *adis, struct iio_dev *indio_dev)
    104     iio_trigger_set_drvdata(adis->trig, adis);
    105     ret = iio_trigger_register(adis->trig);
    106    
    107     - indio_dev->trig = adis->trig;
    108     + indio_dev->trig = iio_trigger_get(adis->trig);
    109     if (ret)
    110     goto error_free_irq;
    111    
    112     diff --git a/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c b/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
    113     index 7da0832f187b..01d661e0fa6c 100644
    114     --- a/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
    115     +++ b/drivers/iio/imu/inv_mpu6050/inv_mpu_ring.c
    116     @@ -25,6 +25,16 @@
    117     #include <linux/poll.h>
    118     #include "inv_mpu_iio.h"
    119    
    120     +static void inv_clear_kfifo(struct inv_mpu6050_state *st)
    121     +{
    122     + unsigned long flags;
    123     +
    124     + /* take the spin lock sem to avoid interrupt kick in */
    125     + spin_lock_irqsave(&st->time_stamp_lock, flags);
    126     + kfifo_reset(&st->timestamps);
    127     + spin_unlock_irqrestore(&st->time_stamp_lock, flags);
    128     +}
    129     +
    130     int inv_reset_fifo(struct iio_dev *indio_dev)
    131     {
    132     int result;
    133     @@ -51,6 +61,10 @@ int inv_reset_fifo(struct iio_dev *indio_dev)
    134     INV_MPU6050_BIT_FIFO_RST);
    135     if (result)
    136     goto reset_fifo_fail;
    137     +
    138     + /* clear timestamps fifo */
    139     + inv_clear_kfifo(st);
    140     +
    141     /* enable interrupt */
    142     if (st->chip_config.accl_fifo_enable ||
    143     st->chip_config.gyro_fifo_enable) {
    144     @@ -84,16 +98,6 @@ reset_fifo_fail:
    145     return result;
    146     }
    147    
    148     -static void inv_clear_kfifo(struct inv_mpu6050_state *st)
    149     -{
    150     - unsigned long flags;
    151     -
    152     - /* take the spin lock sem to avoid interrupt kick in */
    153     - spin_lock_irqsave(&st->time_stamp_lock, flags);
    154     - kfifo_reset(&st->timestamps);
    155     - spin_unlock_irqrestore(&st->time_stamp_lock, flags);
    156     -}
    157     -
    158     /**
    159     * inv_mpu6050_irq_handler() - Cache a timestamp at each data ready interrupt.
    160     */
    161     @@ -187,7 +191,6 @@ end_session:
    162     flush_fifo:
    163     /* Flush HW and SW FIFOs. */
    164     inv_reset_fifo(indio_dev);
    165     - inv_clear_kfifo(st);
    166     mutex_unlock(&indio_dev->mlock);
    167     iio_trigger_notify_done(indio_dev->trig);
    168    
    169     diff --git a/drivers/infiniband/core/umem.c b/drivers/infiniband/core/umem.c
    170     index a84112322071..055ebebc07dd 100644
    171     --- a/drivers/infiniband/core/umem.c
    172     +++ b/drivers/infiniband/core/umem.c
    173     @@ -94,6 +94,14 @@ struct ib_umem *ib_umem_get(struct ib_ucontext *context, unsigned long addr,
    174     if (dmasync)
    175     dma_set_attr(DMA_ATTR_WRITE_BARRIER, &attrs);
    176    
    177     + /*
    178     + * If the combination of the addr and size requested for this memory
    179     + * region causes an integer overflow, return error.
    180     + */
    181     + if ((PAGE_ALIGN(addr + size) <= size) ||
    182     + (PAGE_ALIGN(addr + size) <= addr))
    183     + return ERR_PTR(-EINVAL);
    184     +
    185     if (!can_do_mlock())
    186     return ERR_PTR(-EPERM);
    187    
    188     diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c
    189     index 2c6f0f2ecd9d..949b38633496 100644
    190     --- a/drivers/infiniband/core/uverbs_main.c
    191     +++ b/drivers/infiniband/core/uverbs_main.c
    192     @@ -460,6 +460,7 @@ static void ib_uverbs_async_handler(struct ib_uverbs_file *file,
    193    
    194     entry->desc.async.element = element;
    195     entry->desc.async.event_type = event;
    196     + entry->desc.async.reserved = 0;
    197     entry->counter = counter;
    198    
    199     list_add_tail(&entry->list, &file->async_file->event_list);
    200     diff --git a/drivers/infiniband/hw/mlx4/mad.c b/drivers/infiniband/hw/mlx4/mad.c
    201     index 4d599cedbb0b..6ee534874535 100644
    202     --- a/drivers/infiniband/hw/mlx4/mad.c
    203     +++ b/drivers/infiniband/hw/mlx4/mad.c
    204     @@ -64,6 +64,14 @@ enum {
    205     #define GUID_TBL_BLK_NUM_ENTRIES 8
    206     #define GUID_TBL_BLK_SIZE (GUID_TBL_ENTRY_SIZE * GUID_TBL_BLK_NUM_ENTRIES)
    207    
    208     +/* Counters should be saturate once they reach their maximum value */
    209     +#define ASSIGN_32BIT_COUNTER(counter, value) do {\
    210     + if ((value) > U32_MAX) \
    211     + counter = cpu_to_be32(U32_MAX); \
    212     + else \
    213     + counter = cpu_to_be32(value); \
    214     +} while (0)
    215     +
    216     struct mlx4_mad_rcv_buf {
    217     struct ib_grh grh;
    218     u8 payload[256];
    219     @@ -730,10 +738,14 @@ static int ib_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
    220     static void edit_counter(struct mlx4_counter *cnt,
    221     struct ib_pma_portcounters *pma_cnt)
    222     {
    223     - pma_cnt->port_xmit_data = cpu_to_be32((be64_to_cpu(cnt->tx_bytes)>>2));
    224     - pma_cnt->port_rcv_data = cpu_to_be32((be64_to_cpu(cnt->rx_bytes)>>2));
    225     - pma_cnt->port_xmit_packets = cpu_to_be32(be64_to_cpu(cnt->tx_frames));
    226     - pma_cnt->port_rcv_packets = cpu_to_be32(be64_to_cpu(cnt->rx_frames));
    227     + ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_data,
    228     + (be64_to_cpu(cnt->tx_bytes) >> 2));
    229     + ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_data,
    230     + (be64_to_cpu(cnt->rx_bytes) >> 2));
    231     + ASSIGN_32BIT_COUNTER(pma_cnt->port_xmit_packets,
    232     + be64_to_cpu(cnt->tx_frames));
    233     + ASSIGN_32BIT_COUNTER(pma_cnt->port_rcv_packets,
    234     + be64_to_cpu(cnt->rx_frames));
    235     }
    236    
    237     static int iboe_process_mad(struct ib_device *ibdev, int mad_flags, u8 port_num,
    238     diff --git a/drivers/media/platform/s5p-mfc/s5p_mfc_common.h b/drivers/media/platform/s5p-mfc/s5p_mfc_common.h
    239     index f804c1faa7ff..d3b54f7b849f 100644
    240     --- a/drivers/media/platform/s5p-mfc/s5p_mfc_common.h
    241     +++ b/drivers/media/platform/s5p-mfc/s5p_mfc_common.h
    242     @@ -29,7 +29,7 @@
    243    
    244     /* Offset base used to differentiate between CAPTURE and OUTPUT
    245     * while mmaping */
    246     -#define DST_QUEUE_OFF_BASE (TASK_SIZE / 2)
    247     +#define DST_QUEUE_OFF_BASE (1 << 30)
    248    
    249     #define MFC_BANK1_ALLOC_CTX 0
    250     #define MFC_BANK2_ALLOC_CTX 1
    251     diff --git a/drivers/net/wireless/iwlwifi/dvm/dev.h b/drivers/net/wireless/iwlwifi/dvm/dev.h
    252     index 71ea77576d22..e783ea0e3837 100644
    253     --- a/drivers/net/wireless/iwlwifi/dvm/dev.h
    254     +++ b/drivers/net/wireless/iwlwifi/dvm/dev.h
    255     @@ -670,7 +670,6 @@ struct iwl_priv {
    256     unsigned long reload_jiffies;
    257     int reload_count;
    258     bool ucode_loaded;
    259     - bool init_ucode_run; /* Don't run init uCode again */
    260    
    261     u8 plcp_delta_threshold;
    262    
    263     diff --git a/drivers/net/wireless/iwlwifi/dvm/ucode.c b/drivers/net/wireless/iwlwifi/dvm/ucode.c
    264     index 0a1cdc5e856b..5ad94a8080b8 100644
    265     --- a/drivers/net/wireless/iwlwifi/dvm/ucode.c
    266     +++ b/drivers/net/wireless/iwlwifi/dvm/ucode.c
    267     @@ -425,9 +425,6 @@ int iwl_run_init_ucode(struct iwl_priv *priv)
    268     if (!priv->fw->img[IWL_UCODE_INIT].sec[0].len)
    269     return 0;
    270    
    271     - if (priv->init_ucode_run)
    272     - return 0;
    273     -
    274     iwl_init_notification_wait(&priv->notif_wait, &calib_wait,
    275     calib_complete, ARRAY_SIZE(calib_complete),
    276     iwlagn_wait_calib, priv);
    277     @@ -447,8 +444,6 @@ int iwl_run_init_ucode(struct iwl_priv *priv)
    278     */
    279     ret = iwl_wait_notification(&priv->notif_wait, &calib_wait,
    280     UCODE_CALIB_TIMEOUT);
    281     - if (!ret)
    282     - priv->init_ucode_run = true;
    283    
    284     goto out;
    285    
    286     diff --git a/drivers/scsi/be2iscsi/be_main.c b/drivers/scsi/be2iscsi/be_main.c
    287     index 1ad39c799c74..bfe812fcce34 100644
    288     --- a/drivers/scsi/be2iscsi/be_main.c
    289     +++ b/drivers/scsi/be2iscsi/be_main.c
    290     @@ -5080,9 +5080,9 @@ free_port:
    291     hba_free:
    292     if (phba->msix_enabled)
    293     pci_disable_msix(phba->pcidev);
    294     - iscsi_host_remove(phba->shost);
    295     pci_dev_put(phba->pcidev);
    296     iscsi_host_free(phba->shost);
    297     + pci_set_drvdata(pcidev, NULL);
    298     disable_pci:
    299     pci_disable_device(pcidev);
    300     return ret;
    301     diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
    302     index e5953c8018c5..9f3168e8e5a8 100644
    303     --- a/drivers/scsi/scsi_lib.c
    304     +++ b/drivers/scsi/scsi_lib.c
    305     @@ -1242,9 +1242,11 @@ int scsi_prep_state_check(struct scsi_device *sdev, struct request *req)
    306     "rejecting I/O to dead device\n");
    307     ret = BLKPREP_KILL;
    308     break;
    309     - case SDEV_QUIESCE:
    310     case SDEV_BLOCK:
    311     case SDEV_CREATED_BLOCK:
    312     + ret = BLKPREP_DEFER;
    313     + break;
    314     + case SDEV_QUIESCE:
    315     /*
    316     * If the devices is blocked we defer normal commands.
    317     */
    318     diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c
    319     index 9559ea749d83..5a3ea20e9cb5 100644
    320     --- a/drivers/target/iscsi/iscsi_target.c
    321     +++ b/drivers/target/iscsi/iscsi_target.c
    322     @@ -1179,7 +1179,7 @@ iscsit_handle_scsi_cmd(struct iscsi_conn *conn, struct iscsi_cmd *cmd,
    323     * traditional iSCSI block I/O.
    324     */
    325     if (iscsit_allocate_iovecs(cmd) < 0) {
    326     - return iscsit_add_reject_cmd(cmd,
    327     + return iscsit_reject_cmd(cmd,
    328     ISCSI_REASON_BOOKMARK_NO_RESOURCES, buf);
    329     }
    330     immed_data = cmd->immediate_data;
    331     diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c
    332     index 0e57bcb8e3f7..2320e20d5be7 100644
    333     --- a/drivers/usb/host/xhci-pci.c
    334     +++ b/drivers/usb/host/xhci-pci.c
    335     @@ -94,6 +94,7 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
    336     if (pdev->vendor == PCI_VENDOR_ID_INTEL) {
    337     xhci->quirks |= XHCI_LPM_SUPPORT;
    338     xhci->quirks |= XHCI_INTEL_HOST;
    339     + xhci->quirks |= XHCI_AVOID_BEI;
    340     }
    341     if (pdev->vendor == PCI_VENDOR_ID_INTEL &&
    342     pdev->device == PCI_DEVICE_ID_INTEL_PANTHERPOINT_XHCI) {
    343     @@ -109,7 +110,6 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci)
    344     * PPT chipsets.
    345     */
    346     xhci->quirks |= XHCI_SPURIOUS_REBOOT;
    347     - xhci->quirks |= XHCI_AVOID_BEI;
    348     }
    349     if (pdev->vendor == PCI_VENDOR_ID_ETRON &&
    350     pdev->device == PCI_DEVICE_ID_ASROCK_P67) {
    351     diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
    352     index cf127a080644..4d918d5f945a 100644
    353     --- a/drivers/usb/serial/ftdi_sio.c
    354     +++ b/drivers/usb/serial/ftdi_sio.c
    355     @@ -620,6 +620,7 @@ static struct usb_device_id id_table_combined [] = {
    356     .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
    357     { USB_DEVICE(FTDI_VID, FTDI_NT_ORIONLXM_PID),
    358     .driver_info = (kernel_ulong_t)&ftdi_jtag_quirk },
    359     + { USB_DEVICE(FTDI_VID, FTDI_SYNAPSE_SS200_PID) },
    360     /*
    361     * ELV devices:
    362     */
    363     @@ -1899,8 +1900,12 @@ static int ftdi_8u2232c_probe(struct usb_serial *serial)
    364     {
    365     struct usb_device *udev = serial->dev;
    366    
    367     - if ((udev->manufacturer && !strcmp(udev->manufacturer, "CALAO Systems")) ||
    368     - (udev->product && !strcmp(udev->product, "BeagleBone/XDS100V2")))
    369     + if (udev->manufacturer && !strcmp(udev->manufacturer, "CALAO Systems"))
    370     + return ftdi_jtag_probe(serial);
    371     +
    372     + if (udev->product &&
    373     + (!strcmp(udev->product, "BeagleBone/XDS100V2") ||
    374     + !strcmp(udev->product, "SNAP Connect E10")))
    375     return ftdi_jtag_probe(serial);
    376    
    377     return 0;
    378     diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
    379     index e8d352615297..e906b6aa2424 100644
    380     --- a/drivers/usb/serial/ftdi_sio_ids.h
    381     +++ b/drivers/usb/serial/ftdi_sio_ids.h
    382     @@ -561,6 +561,12 @@
    383     */
    384     #define FTDI_NT_ORIONLXM_PID 0x7c90 /* OrionLXm Substation Automation Platform */
    385    
    386     +/*
    387     + * Synapse Wireless product ids (FTDI_VID)
    388     + * http://www.synapse-wireless.com
    389     + */
    390     +#define FTDI_SYNAPSE_SS200_PID 0x9090 /* SS200 - SNAP Stick 200 */
    391     +
    392    
    393     /********************************/
    394     /** third-party VID/PID combos **/
    395     diff --git a/fs/cifs/file.c b/fs/cifs/file.c
    396     index 5fcc10fa62bd..f4a8577c3e91 100644
    397     --- a/fs/cifs/file.c
    398     +++ b/fs/cifs/file.c
    399     @@ -1789,6 +1789,7 @@ refind_writable:
    400     cifsFileInfo_put(inv_file);
    401     spin_lock(&cifs_file_list_lock);
    402     ++refind;
    403     + inv_file = NULL;
    404     goto refind_writable;
    405     }
    406     }
    407     diff --git a/fs/ocfs2/file.c b/fs/ocfs2/file.c
    408     index 46387e49aa46..8cd6474e248f 100644
    409     --- a/fs/ocfs2/file.c
    410     +++ b/fs/ocfs2/file.c
    411     @@ -2372,10 +2372,14 @@ out_dio:
    412     /* buffered aio wouldn't have proper lock coverage today */
    413     BUG_ON(ret == -EIOCBQUEUED && !(file->f_flags & O_DIRECT));
    414    
    415     + if (unlikely(written <= 0))
    416     + goto no_sync;
    417     +
    418     if (((file->f_flags & O_DSYNC) && !direct_io) || IS_SYNC(inode) ||
    419     ((file->f_flags & O_DIRECT) && !direct_io)) {
    420     - ret = filemap_fdatawrite_range(file->f_mapping, *ppos,
    421     - *ppos + count - 1);
    422     + ret = filemap_fdatawrite_range(file->f_mapping,
    423     + iocb->ki_pos - written,
    424     + iocb->ki_pos - 1);
    425     if (ret < 0)
    426     written = ret;
    427    
    428     @@ -2388,10 +2392,12 @@ out_dio:
    429     }
    430    
    431     if (!ret)
    432     - ret = filemap_fdatawait_range(file->f_mapping, *ppos,
    433     - *ppos + count - 1);
    434     + ret = filemap_fdatawait_range(file->f_mapping,
    435     + iocb->ki_pos - written,
    436     + iocb->ki_pos - 1);
    437     }
    438    
    439     +no_sync:
    440     /*
    441     * deep in g_f_a_w_n()->ocfs2_direct_IO we pass in a ocfs2_dio_end_io
    442     * function pointer which is called when o_direct io completes so that
    443     diff --git a/fs/proc/task_mmu.c b/fs/proc/task_mmu.c
    444     index 65fc60a07c47..9f285fb9bab3 100644
    445     --- a/fs/proc/task_mmu.c
    446     +++ b/fs/proc/task_mmu.c
    447     @@ -1110,9 +1110,19 @@ out:
    448     return ret;
    449     }
    450    
    451     +static int pagemap_open(struct inode *inode, struct file *file)
    452     +{
    453     + /* do not disclose physical addresses to unprivileged
    454     + userspace (closes a rowhammer attack vector) */
    455     + if (!capable(CAP_SYS_ADMIN))
    456     + return -EPERM;
    457     + return 0;
    458     +}
    459     +
    460     const struct file_operations proc_pagemap_operations = {
    461     .llseek = mem_lseek, /* borrow this */
    462     .read = pagemap_read,
    463     + .open = pagemap_open,
    464     };
    465     #endif /* CONFIG_PROC_PAGE_MONITOR */
    466    
    467     diff --git a/include/linux/blk_types.h b/include/linux/blk_types.h
    468     index fa1abeb45b76..49c48dda162d 100644
    469     --- a/include/linux/blk_types.h
    470     +++ b/include/linux/blk_types.h
    471     @@ -170,7 +170,9 @@ enum rq_flag_bits {
    472     __REQ_ELVPRIV, /* elevator private data attached */
    473     __REQ_FAILED, /* set if the request failed */
    474     __REQ_QUIET, /* don't worry about errors */
    475     - __REQ_PREEMPT, /* set for "ide_preempt" requests */
    476     + __REQ_PREEMPT, /* set for "ide_preempt" requests and also
    477     + for requests for which the SCSI "quiesce"
    478     + state must be ignored. */
    479     __REQ_ALLOCED, /* request came from our alloc pool */
    480     __REQ_COPY_USER, /* contains copies of user pages */
    481     __REQ_FLUSH_SEQ, /* request for flush sequence */
    482     diff --git a/include/linux/kernel.h b/include/linux/kernel.h
    483     index e9ef6d6b51d5..341551c7b4c8 100644
    484     --- a/include/linux/kernel.h
    485     +++ b/include/linux/kernel.h
    486     @@ -29,6 +29,19 @@
    487     #define ULLONG_MAX (~0ULL)
    488     #define SIZE_MAX (~(size_t)0)
    489    
    490     +#define U8_MAX ((u8)~0U)
    491     +#define S8_MAX ((s8)(U8_MAX>>1))
    492     +#define S8_MIN ((s8)(-S8_MAX - 1))
    493     +#define U16_MAX ((u16)~0U)
    494     +#define S16_MAX ((s16)(U16_MAX>>1))
    495     +#define S16_MIN ((s16)(-S16_MAX - 1))
    496     +#define U32_MAX ((u32)~0U)
    497     +#define S32_MAX ((s32)(U32_MAX>>1))
    498     +#define S32_MIN ((s32)(-S32_MAX - 1))
    499     +#define U64_MAX ((u64)~0ULL)
    500     +#define S64_MAX ((s64)(U64_MAX>>1))
    501     +#define S64_MIN ((s64)(-S64_MAX - 1))
    502     +
    503     #define STACK_MAGIC 0xdeadbeef
    504    
    505     #define REPEAT_BYTE(x) ((~0ul / 0xff) * (x))
    506     diff --git a/ipc/compat.c b/ipc/compat.c
    507     index 892f6585dd60..d3b376025e9b 100644
    508     --- a/ipc/compat.c
    509     +++ b/ipc/compat.c
    510     @@ -381,7 +381,7 @@ COMPAT_SYSCALL_DEFINE6(ipc, u32, call, int, first, int, second,
    511     uptr = compat_ptr(ipck.msgp);
    512     fifth = ipck.msgtyp;
    513     }
    514     - return do_msgrcv(first, uptr, second, fifth, third,
    515     + return do_msgrcv(first, uptr, second, (s32)fifth, third,
    516     compat_do_msg_fill);
    517     }
    518     case MSGGET:
    519     diff --git a/kernel/printk.c b/kernel/printk.c
    520     index f7aff4bd5454..fd0154a57d6e 100644
    521     --- a/kernel/printk.c
    522     +++ b/kernel/printk.c
    523     @@ -107,7 +107,7 @@ static struct console *exclusive_console;
    524     */
    525     struct console_cmdline
    526     {
    527     - char name[8]; /* Name of the driver */
    528     + char name[16]; /* Name of the driver */
    529     int index; /* Minor dev. to use */
    530     char *options; /* Options for the driver */
    531     #ifdef CONFIG_A11Y_BRAILLE_CONSOLE
    532     @@ -2290,6 +2290,8 @@ void register_console(struct console *newcon)
    533     */
    534     for (i = 0; i < MAX_CMDLINECONSOLES && console_cmdline[i].name[0];
    535     i++) {
    536     + BUILD_BUG_ON(sizeof(console_cmdline[i].name) !=
    537     + sizeof(newcon->name));
    538     if (strcmp(console_cmdline[i].name, newcon->name) != 0)
    539     continue;
    540     if (newcon->index >= 0 &&
    541     diff --git a/mm/memory_hotplug.c b/mm/memory_hotplug.c
    542     index 1ad92b46753e..2298237db142 100644
    543     --- a/mm/memory_hotplug.c
    544     +++ b/mm/memory_hotplug.c
    545     @@ -1039,6 +1039,10 @@ static pg_data_t __ref *hotadd_new_pgdat(int nid, u64 start)
    546     return NULL;
    547    
    548     arch_refresh_nodedata(nid, pgdat);
    549     + } else {
    550     + /* Reset the nr_zones and classzone_idx to 0 before reuse */
    551     + pgdat->nr_zones = 0;
    552     + pgdat->classzone_idx = 0;
    553     }
    554    
    555     /* we can use NODE_DATA(nid) from here */
    556     @@ -1802,15 +1806,6 @@ void try_offline_node(int nid)
    557     if (is_vmalloc_addr(zone->wait_table))
    558     vfree(zone->wait_table);
    559     }
    560     -
    561     - /*
    562     - * Since there is no way to guarentee the address of pgdat/zone is not
    563     - * on stack of any kernel threads or used by other kernel objects
    564     - * without reference counting or other symchronizing method, do not
    565     - * reset node_data and free pgdat here. Just reset it to 0 and reuse
    566     - * the memory when the node is online again.
    567     - */
    568     - memset(pgdat, 0, sizeof(*pgdat));
    569     }
    570     EXPORT_SYMBOL(try_offline_node);
    571    
    572     diff --git a/mm/page-writeback.c b/mm/page-writeback.c
    573     index 73cbc5dc150b..b034f79deb0e 100644
    574     --- a/mm/page-writeback.c
    575     +++ b/mm/page-writeback.c
    576     @@ -793,8 +793,11 @@ static void bdi_update_write_bandwidth(struct backing_dev_info *bdi,
    577     * bw * elapsed + write_bandwidth * (period - elapsed)
    578     * write_bandwidth = ---------------------------------------------------
    579     * period
    580     + *
    581     + * @written may have decreased due to account_page_redirty().
    582     + * Avoid underflowing @bw calculation.
    583     */
    584     - bw = written - bdi->written_stamp;
    585     + bw = written - min(written, bdi->written_stamp);
    586     bw *= HZ;
    587     if (unlikely(elapsed > period)) {
    588     do_div(bw, elapsed);
    589     @@ -858,7 +861,7 @@ static void global_update_bandwidth(unsigned long thresh,
    590     unsigned long now)
    591     {
    592     static DEFINE_SPINLOCK(dirty_lock);
    593     - static unsigned long update_time;
    594     + static unsigned long update_time = INITIAL_JIFFIES;
    595    
    596     /*
    597     * check locklessly first to optimize away locking for the most time
    598     diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
    599     index 913dc4f49b10..92b5e1f7d3b0 100644
    600     --- a/net/ipv4/tcp_output.c
    601     +++ b/net/ipv4/tcp_output.c
    602     @@ -2909,6 +2909,7 @@ static int tcp_send_syn_data(struct sock *sk, struct sk_buff *syn)
    603     goto fallback;
    604     syn_data->ip_summed = CHECKSUM_PARTIAL;
    605     memcpy(syn_data->cb, syn->cb, sizeof(syn->cb));
    606     + skb_shinfo(syn_data)->gso_segs = 1;
    607     if (unlikely(memcpy_fromiovecend(skb_put(syn_data, space),
    608     fo->data->msg_iov, 0, space))) {
    609     kfree_skb(syn_data);
    610     diff --git a/net/llc/sysctl_net_llc.c b/net/llc/sysctl_net_llc.c
    611     index 612a5ddaf93b..799bafc2af39 100644
    612     --- a/net/llc/sysctl_net_llc.c
    613     +++ b/net/llc/sysctl_net_llc.c
    614     @@ -18,28 +18,28 @@ static struct ctl_table llc2_timeout_table[] = {
    615     {
    616     .procname = "ack",
    617     .data = &sysctl_llc2_ack_timeout,
    618     - .maxlen = sizeof(long),
    619     + .maxlen = sizeof(sysctl_llc2_ack_timeout),
    620     .mode = 0644,
    621     .proc_handler = proc_dointvec_jiffies,
    622     },
    623     {
    624     .procname = "busy",
    625     .data = &sysctl_llc2_busy_timeout,
    626     - .maxlen = sizeof(long),
    627     + .maxlen = sizeof(sysctl_llc2_busy_timeout),
    628     .mode = 0644,
    629     .proc_handler = proc_dointvec_jiffies,
    630     },
    631     {
    632     .procname = "p",
    633     .data = &sysctl_llc2_p_timeout,
    634     - .maxlen = sizeof(long),
    635     + .maxlen = sizeof(sysctl_llc2_p_timeout),
    636     .mode = 0644,
    637     .proc_handler = proc_dointvec_jiffies,
    638     },
    639     {
    640     .procname = "rej",
    641     .data = &sysctl_llc2_rej_timeout,
    642     - .maxlen = sizeof(long),
    643     + .maxlen = sizeof(sysctl_llc2_rej_timeout),
    644     .mode = 0644,
    645     .proc_handler = proc_dointvec_jiffies,
    646     },
    647     diff --git a/net/netfilter/nfnetlink_queue_core.c b/net/netfilter/nfnetlink_queue_core.c
    648     index 2b8199f68785..5497f50af2f0 100644
    649     --- a/net/netfilter/nfnetlink_queue_core.c
    650     +++ b/net/netfilter/nfnetlink_queue_core.c
    651     @@ -228,7 +228,7 @@ nfqnl_flush(struct nfqnl_instance *queue, nfqnl_cmpfn cmpfn, unsigned long data)
    652     }
    653    
    654     static int
    655     -nfqnl_zcopy(struct sk_buff *to, const struct sk_buff *from, int len, int hlen)
    656     +nfqnl_zcopy(struct sk_buff *to, struct sk_buff *from, int len, int hlen)
    657     {
    658     int i, j = 0;
    659     int plen = 0; /* length of skb->head fragment */
    660     diff --git a/net/rds/sysctl.c b/net/rds/sysctl.c
    661     index 907214b4c4d0..fc6cbe827856 100644
    662     --- a/net/rds/sysctl.c
    663     +++ b/net/rds/sysctl.c
    664     @@ -71,14 +71,14 @@ static ctl_table rds_sysctl_rds_table[] = {
    665     {
    666     .procname = "max_unacked_packets",
    667     .data = &rds_sysctl_max_unacked_packets,
    668     - .maxlen = sizeof(unsigned long),
    669     + .maxlen = sizeof(int),
    670     .mode = 0644,
    671     .proc_handler = proc_dointvec,
    672     },
    673     {
    674     .procname = "max_unacked_bytes",
    675     .data = &rds_sysctl_max_unacked_bytes,
    676     - .maxlen = sizeof(unsigned long),
    677     + .maxlen = sizeof(int),
    678     .mode = 0644,
    679     .proc_handler = proc_dointvec,
    680     },
    681     diff --git a/security/selinux/selinuxfs.c b/security/selinux/selinuxfs.c
    682     index ff427733c290..464be51025f6 100644
    683     --- a/security/selinux/selinuxfs.c
    684     +++ b/security/selinux/selinuxfs.c
    685     @@ -150,7 +150,7 @@ static ssize_t sel_write_enforce(struct file *file, const char __user *buf,
    686     goto out;
    687    
    688     /* No partial writes. */
    689     - length = EINVAL;
    690     + length = -EINVAL;
    691     if (*ppos != 0)
    692     goto out;
    693    
    694     diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
    695     index 4008034b6ebe..a8eb7fe2766e 100644
    696     --- a/sound/pci/hda/patch_realtek.c
    697     +++ b/sound/pci/hda/patch_realtek.c
    698     @@ -266,7 +266,7 @@ static void alc_auto_setup_eapd(struct hda_codec *codec, bool on)
    699     {
    700     /* We currently only handle front, HP */
    701     static hda_nid_t pins[] = {
    702     - 0x0f, 0x10, 0x14, 0x15, 0
    703     + 0x0f, 0x10, 0x14, 0x15, 0x17, 0
    704     };
    705     hda_nid_t *p;
    706     for (p = pins; *p; p++)
    707     @@ -3363,6 +3363,7 @@ enum {
    708     ALC269_FIXUP_QUANTA_MUTE,
    709     ALC269_FIXUP_LIFEBOOK,
    710     ALC269_FIXUP_LIFEBOOK_EXTMIC,
    711     + ALC269_FIXUP_LIFEBOOK_HP_PIN,
    712     ALC269_FIXUP_AMIC,
    713     ALC269_FIXUP_DMIC,
    714     ALC269VB_FIXUP_AMIC,
    715     @@ -3477,6 +3478,13 @@ static const struct hda_fixup alc269_fixups[] = {
    716     { }
    717     },
    718     },
    719     + [ALC269_FIXUP_LIFEBOOK_HP_PIN] = {
    720     + .type = HDA_FIXUP_PINS,
    721     + .v.pins = (const struct hda_pintbl[]) {
    722     + { 0x21, 0x0221102f }, /* HP out */
    723     + { }
    724     + },
    725     + },
    726     [ALC269_FIXUP_AMIC] = {
    727     .type = HDA_FIXUP_PINS,
    728     .v.pins = (const struct hda_pintbl[]) {
    729     @@ -3727,6 +3735,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = {
    730     SND_PCI_QUIRK(0x1025, 0x0742, "Acer AO756", ALC271_FIXUP_HP_GATE_MIC_JACK),
    731     SND_PCI_QUIRK_VENDOR(0x1025, "Acer Aspire", ALC271_FIXUP_DMIC),
    732     SND_PCI_QUIRK(0x10cf, 0x1475, "Lifebook", ALC269_FIXUP_LIFEBOOK),
    733     + SND_PCI_QUIRK(0x10cf, 0x15dc, "Lifebook T731", ALC269_FIXUP_LIFEBOOK_HP_PIN),
    734     SND_PCI_QUIRK(0x10cf, 0x1845, "Lifebook U904", ALC269_FIXUP_LIFEBOOK_EXTMIC),
    735     SND_PCI_QUIRK(0x17aa, 0x20f2, "Thinkpad SL410/510", ALC269_FIXUP_SKU_IGNORE),
    736     SND_PCI_QUIRK(0x17aa, 0x215e, "Thinkpad L512", ALC269_FIXUP_SKU_IGNORE),
    737     diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
    738     index c89a5bf5c00e..c311681bd390 100644
    739     --- a/sound/usb/mixer_quirks.c
    740     +++ b/sound/usb/mixer_quirks.c
    741     @@ -175,6 +175,7 @@ static const struct rc_config {
    742     { USB_ID(0x041e, 0x3040), 2, 2, 6, 6, 2, 0x6e91 }, /* Live! 24-bit */
    743     { USB_ID(0x041e, 0x3042), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 */
    744     { USB_ID(0x041e, 0x30df), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */
    745     + { USB_ID(0x041e, 0x3237), 0, 1, 1, 1, 1, 0x000d }, /* Usb X-Fi S51 Pro */
    746     { USB_ID(0x041e, 0x3048), 2, 2, 6, 6, 2, 0x6e91 }, /* Toshiba SB0500 */
    747     };
    748