lkml.org 
[lkml]   [2011]   [May]   [9]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    Date
    From
    SubjectRe: Linux 2.6.38.6
    diff --git a/Documentation/flexible-arrays.txt b/Documentation/flexible-arrays.txt
    index cb8a3a0..df904ae 100644
    --- a/Documentation/flexible-arrays.txt
    +++ b/Documentation/flexible-arrays.txt
    @@ -66,10 +66,10 @@ trick is to ensure that any needed memory allocations are done before
    entering atomic context, using:

    int flex_array_prealloc(struct flex_array *array, unsigned int start,
    - unsigned int end, gfp_t flags);
    + unsigned int nr_elements, gfp_t flags);

    This function will ensure that memory for the elements indexed in the range
    -defined by start and end has been allocated. Thereafter, a
    +defined by start and nr_elements has been allocated. Thereafter, a
    flex_array_put() call on an element in that range is guaranteed not to
    block.

    diff --git a/Makefile b/Makefile
    index 20ed7d1..c74c308 100644
    --- a/Makefile
    +++ b/Makefile
    @@ -1,7 +1,7 @@
    VERSION = 2
    PATCHLEVEL = 6
    SUBLEVEL = 38
    -EXTRAVERSION = .5
    +EXTRAVERSION = .6
    NAME = Flesh-Eating Bats with Fangs

    # *DOCUMENTATION*
    diff --git a/arch/arm/kernel/sys_oabi-compat.c b/arch/arm/kernel/sys_oabi-compat.c
    index 4ad8da1..af0aaeb 100644
    --- a/arch/arm/kernel/sys_oabi-compat.c
    +++ b/arch/arm/kernel/sys_oabi-compat.c
    @@ -311,7 +311,7 @@ asmlinkage long sys_oabi_semtimedop(int semid,
    long err;
    int i;

    - if (nsops < 1)
    + if (nsops < 1 || nsops > SEMOPM)
    return -EINVAL;
    sops = kmalloc(sizeof(*sops) * nsops, GFP_KERNEL);
    if (!sops)
    diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
    index a2b9c7d..b65c707 100644
    --- a/arch/x86/kernel/cpu/amd.c
    +++ b/arch/x86/kernel/cpu/amd.c
    @@ -681,7 +681,7 @@ cpu_dev_register(amd_cpu_dev);
    */

    const int amd_erratum_400[] =
    - AMD_OSVW_ERRATUM(1, AMD_MODEL_RANGE(0xf, 0x41, 0x2, 0xff, 0xf),
    + AMD_OSVW_ERRATUM(1, AMD_MODEL_RANGE(0x0f, 0x4, 0x2, 0xff, 0xf),
    AMD_MODEL_RANGE(0x10, 0x2, 0x1, 0xff, 0xf));
    EXPORT_SYMBOL_GPL(amd_erratum_400);

    diff --git a/arch/x86/kvm/svm.c b/arch/x86/kvm/svm.c
    index 63fec15..d8a15a1 100644
    --- a/arch/x86/kvm/svm.c
    +++ b/arch/x86/kvm/svm.c
    @@ -135,6 +135,8 @@ struct vcpu_svm {

    u32 *msrpm;

    + ulong nmi_iret_rip;
    +
    struct nested_state nested;

    bool nmi_singlestep;
    @@ -2653,6 +2655,7 @@ static int iret_interception(struct vcpu_svm *svm)
    ++svm->vcpu.stat.nmi_window_exits;
    clr_intercept(svm, INTERCEPT_IRET);
    svm->vcpu.arch.hflags |= HF_IRET_MASK;
    + svm->nmi_iret_rip = kvm_rip_read(&svm->vcpu);
    return 1;
    }

    @@ -3474,7 +3477,12 @@ static void svm_complete_interrupts(struct vcpu_svm *svm)

    svm->int3_injected = 0;

    - if (svm->vcpu.arch.hflags & HF_IRET_MASK) {
    + /*
    + * If we've made progress since setting HF_IRET_MASK, we've
    + * executed an IRET and can allow NMI injection.
    + */
    + if ((svm->vcpu.arch.hflags & HF_IRET_MASK)
    + && kvm_rip_read(&svm->vcpu) != svm->nmi_iret_rip) {
    svm->vcpu.arch.hflags &= ~(HF_NMI_MASK | HF_IRET_MASK);
    kvm_make_request(KVM_REQ_EVENT, &svm->vcpu);
    }
    diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
    index bd3c61b..6a788c3 100644
    --- a/drivers/firewire/ohci.c
    +++ b/drivers/firewire/ohci.c
    @@ -2163,7 +2163,6 @@ static int ohci_set_config_rom(struct fw_card *card,
    {
    struct fw_ohci *ohci;
    unsigned long flags;
    - int ret = -EBUSY;
    __be32 *next_config_rom;
    dma_addr_t uninitialized_var(next_config_rom_bus);

    @@ -2204,22 +2203,37 @@ static int ohci_set_config_rom(struct fw_card *card,

    spin_lock_irqsave(&ohci->lock, flags);

    + /*
    + * If there is not an already pending config_rom update,
    + * push our new allocation into the ohci->next_config_rom
    + * and then mark the local variable as null so that we
    + * won't deallocate the new buffer.
    + *
    + * OTOH, if there is a pending config_rom update, just
    + * use that buffer with the new config_rom data, and
    + * let this routine free the unused DMA allocation.
    + */
    +
    if (ohci->next_config_rom == NULL) {
    ohci->next_config_rom = next_config_rom;
    ohci->next_config_rom_bus = next_config_rom_bus;
    + next_config_rom = NULL;
    + }

    - copy_config_rom(ohci->next_config_rom, config_rom, length);
    + copy_config_rom(ohci->next_config_rom, config_rom, length);

    - ohci->next_header = config_rom[0];
    - ohci->next_config_rom[0] = 0;
    + ohci->next_header = config_rom[0];
    + ohci->next_config_rom[0] = 0;

    - reg_write(ohci, OHCI1394_ConfigROMmap,
    - ohci->next_config_rom_bus);
    - ret = 0;
    - }
    + reg_write(ohci, OHCI1394_ConfigROMmap, ohci->next_config_rom_bus);

    spin_unlock_irqrestore(&ohci->lock, flags);

    + /* If we didn't use the DMA allocation, delete it. */
    + if (next_config_rom != NULL)
    + dma_free_coherent(ohci->card.device, CONFIG_ROM_SIZE,
    + next_config_rom, next_config_rom_bus);
    +
    /*
    * Now initiate a bus reset to have the changes take
    * effect. We clean up the old config rom memory and DMA
    @@ -2227,13 +2241,10 @@ static int ohci_set_config_rom(struct fw_card *card,
    * controller could need to access it before the bus reset
    * takes effect.
    */
    - if (ret == 0)
    - fw_schedule_bus_reset(&ohci->card, true, true);
    - else
    - dma_free_coherent(ohci->card.device, CONFIG_ROM_SIZE,
    - next_config_rom, next_config_rom_bus);

    - return ret;
    + fw_schedule_bus_reset(&ohci->card, true, true);
    +
    + return 0;
    }

    static void ohci_send_request(struct fw_card *card, struct fw_packet *packet)
    diff --git a/drivers/gpu/drm/radeon/radeon_atombios.c b/drivers/gpu/drm/radeon/radeon_atombios.c
    index 99768d9..a73f0e6 100644
    --- a/drivers/gpu/drm/radeon/radeon_atombios.c
    +++ b/drivers/gpu/drm/radeon/radeon_atombios.c
    @@ -1599,9 +1599,10 @@ struct radeon_encoder_atom_dig *radeon_atombios_get_lvds_info(struct
    memcpy((u8 *)edid, (u8 *)&fake_edid_record->ucFakeEDIDString[0],
    fake_edid_record->ucFakeEDIDLength);

    - if (drm_edid_is_valid(edid))
    + if (drm_edid_is_valid(edid)) {
    rdev->mode_info.bios_hardcoded_edid = edid;
    - else
    + rdev->mode_info.bios_hardcoded_edid_size = edid_size;
    + } else
    kfree(edid);
    }
    }
    diff --git a/drivers/i2c/busses/i2c-parport.c b/drivers/i2c/busses/i2c-parport.c
    index 0eb1515..2dbba16 100644
    --- a/drivers/i2c/busses/i2c-parport.c
    +++ b/drivers/i2c/busses/i2c-parport.c
    @@ -1,7 +1,7 @@
    /* ------------------------------------------------------------------------ *
    * i2c-parport.c I2C bus over parallel port *
    * ------------------------------------------------------------------------ *
    - Copyright (C) 2003-2010 Jean Delvare <khali@linux-fr.org>
    + Copyright (C) 2003-2011 Jean Delvare <khali@linux-fr.org>

    Based on older i2c-philips-par.c driver
    Copyright (C) 1995-2000 Simon G. Vogl
    @@ -33,6 +33,8 @@
    #include <linux/i2c-algo-bit.h>
    #include <linux/i2c-smbus.h>
    #include <linux/slab.h>
    +#include <linux/list.h>
    +#include <linux/mutex.h>
    #include "i2c-parport.h"

    /* ----- Device list ------------------------------------------------------ */
    @@ -43,10 +45,11 @@ struct i2c_par {
    struct i2c_algo_bit_data algo_data;
    struct i2c_smbus_alert_setup alert_data;
    struct i2c_client *ara;
    - struct i2c_par *next;
    + struct list_head node;
    };

    -static struct i2c_par *adapter_list;
    +static LIST_HEAD(adapter_list);
    +static DEFINE_MUTEX(adapter_list_lock);

    /* ----- Low-level parallel port access ----------------------------------- */

    @@ -228,8 +231,9 @@ static void i2c_parport_attach (struct parport *port)
    }

    /* Add the new adapter to the list */
    - adapter->next = adapter_list;
    - adapter_list = adapter;
    + mutex_lock(&adapter_list_lock);
    + list_add_tail(&adapter->node, &adapter_list);
    + mutex_unlock(&adapter_list_lock);
    return;

    ERROR1:
    @@ -241,11 +245,11 @@ ERROR0:

    static void i2c_parport_detach (struct parport *port)
    {
    - struct i2c_par *adapter, *prev;
    + struct i2c_par *adapter, *_n;

    /* Walk the list */
    - for (prev = NULL, adapter = adapter_list; adapter;
    - prev = adapter, adapter = adapter->next) {
    + mutex_lock(&adapter_list_lock);
    + list_for_each_entry_safe(adapter, _n, &adapter_list, node) {
    if (adapter->pdev->port == port) {
    if (adapter->ara) {
    parport_disable_irq(port);
    @@ -259,14 +263,11 @@ static void i2c_parport_detach (struct parport *port)

    parport_release(adapter->pdev);
    parport_unregister_device(adapter->pdev);
    - if (prev)
    - prev->next = adapter->next;
    - else
    - adapter_list = adapter->next;
    + list_del(&adapter->node);
    kfree(adapter);
    - return;
    }
    }
    + mutex_unlock(&adapter_list_lock);
    }

    static struct parport_driver i2c_parport_driver = {
    diff --git a/drivers/media/radio/saa7706h.c b/drivers/media/radio/saa7706h.c
    index 585680f..b1193df 100644
    --- a/drivers/media/radio/saa7706h.c
    +++ b/drivers/media/radio/saa7706h.c
    @@ -376,7 +376,7 @@ static int __devinit saa7706h_probe(struct i2c_client *client,
    v4l_info(client, "chip found @ 0x%02x (%s)\n",
    client->addr << 1, client->adapter->name);

    - state = kmalloc(sizeof(struct saa7706h_state), GFP_KERNEL);
    + state = kzalloc(sizeof(struct saa7706h_state), GFP_KERNEL);
    if (state == NULL)
    return -ENOMEM;
    sd = &state->sd;
    diff --git a/drivers/media/radio/tef6862.c b/drivers/media/radio/tef6862.c
    index 7c0d777..0991e19 100644
    --- a/drivers/media/radio/tef6862.c
    +++ b/drivers/media/radio/tef6862.c
    @@ -176,7 +176,7 @@ static int __devinit tef6862_probe(struct i2c_client *client,
    v4l_info(client, "chip found @ 0x%02x (%s)\n",
    client->addr << 1, client->adapter->name);

    - state = kmalloc(sizeof(struct tef6862_state), GFP_KERNEL);
    + state = kzalloc(sizeof(struct tef6862_state), GFP_KERNEL);
    if (state == NULL)
    return -ENOMEM;
    state->freq = TEF6862_LO_FREQ;
    diff --git a/drivers/media/rc/imon.c b/drivers/media/rc/imon.c
    index e7dc6b4..eee3957 100644
    --- a/drivers/media/rc/imon.c
    +++ b/drivers/media/rc/imon.c
    @@ -46,7 +46,7 @@
    #define MOD_AUTHOR "Jarod Wilson <jarod@wilsonet.com>"
    #define MOD_DESC "Driver for SoundGraph iMON MultiMedia IR/Display"
    #define MOD_NAME "imon"
    -#define MOD_VERSION "0.9.2"
    +#define MOD_VERSION "0.9.3"

    #define DISPLAY_MINOR_BASE 144
    #define DEVICE_NAME "lcd%d"
    @@ -451,8 +451,9 @@ static int display_close(struct inode *inode, struct file *file)
    }

    /**
    - * Sends a packet to the device -- this function must be called
    - * with ictx->lock held.
    + * Sends a packet to the device -- this function must be called with
    + * ictx->lock held, or its unlock/lock sequence while waiting for tx
    + * to complete can/will lead to a deadlock.
    */
    static int send_packet(struct imon_context *ictx)
    {
    @@ -982,12 +983,21 @@ static void imon_touch_display_timeout(unsigned long data)
    * the iMON remotes, and those used by the Windows MCE remotes (which is
    * really just RC-6), but only one or the other at a time, as the signals
    * are decoded onboard the receiver.
    + *
    + * This function gets called two different ways, one way is from
    + * rc_register_device, for initial protocol selection/setup, and the other is
    + * via a userspace-initiated protocol change request, either by direct sysfs
    + * prodding or by something like ir-keytable. In the rc_register_device case,
    + * the imon context lock is already held, but when initiated from userspace,
    + * it is not, so we must acquire it prior to calling send_packet, which
    + * requires that the lock is held.
    */
    static int imon_ir_change_protocol(struct rc_dev *rc, u64 rc_type)
    {
    int retval;
    struct imon_context *ictx = rc->priv;
    struct device *dev = ictx->dev;
    + bool unlock = false;
    unsigned char ir_proto_packet[] = {
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x86 };

    @@ -1020,6 +1030,11 @@ static int imon_ir_change_protocol(struct rc_dev *rc, u64 rc_type)

    memcpy(ictx->usb_tx_buf, &ir_proto_packet, sizeof(ir_proto_packet));

    + if (!mutex_is_locked(&ictx->lock)) {
    + unlock = true;
    + mutex_lock(&ictx->lock);
    + }
    +
    retval = send_packet(ictx);
    if (retval)
    goto out;
    @@ -1028,6 +1043,9 @@ static int imon_ir_change_protocol(struct rc_dev *rc, u64 rc_type)
    ictx->pad_mouse = false;

    out:
    + if (unlock)
    + mutex_unlock(&ictx->lock);
    +
    return retval;
    }

    @@ -2125,6 +2143,7 @@ static struct imon_context *imon_init_intf0(struct usb_interface *intf)
    goto rdev_setup_failed;
    }

    + mutex_unlock(&ictx->lock);
    return ictx;

    rdev_setup_failed:
    @@ -2196,6 +2215,7 @@ static struct imon_context *imon_init_intf1(struct usb_interface *intf,
    goto urb_submit_failed;
    }

    + mutex_unlock(&ictx->lock);
    return ictx;

    urb_submit_failed:
    @@ -2290,6 +2310,8 @@ static int __devinit imon_probe(struct usb_interface *interface,
    usb_set_intfdata(interface, ictx);

    if (ifnum == 0) {
    + mutex_lock(&ictx->lock);
    +
    if (product == 0xffdc && ictx->rf_device) {
    sysfs_err = sysfs_create_group(&interface->dev.kobj,
    &imon_rf_attr_group);
    @@ -2300,13 +2322,14 @@ static int __devinit imon_probe(struct usb_interface *interface,

    if (ictx->display_supported)
    imon_init_display(ictx, interface);
    +
    + mutex_unlock(&ictx->lock);
    }

    dev_info(dev, "iMON device (%04x:%04x, intf%d) on "
    "usb<%d:%d> initialized\n", vendor, product, ifnum,
    usbdev->bus->busnum, usbdev->devnum);

    - mutex_unlock(&ictx->lock);
    mutex_unlock(&driver_lock);

    return 0;
    diff --git a/drivers/media/video/cx88/cx88-input.c b/drivers/media/video/cx88/cx88-input.c
    index 06f7d1d..ac4f8e0 100644
    --- a/drivers/media/video/cx88/cx88-input.c
    +++ b/drivers/media/video/cx88/cx88-input.c
    @@ -283,7 +283,7 @@ int cx88_ir_init(struct cx88_core *core, struct pci_dev *pci)
    case CX88_BOARD_PCHDTV_HD3000:
    case CX88_BOARD_PCHDTV_HD5500:
    case CX88_BOARD_HAUPPAUGE_IRONLY:
    - ir_codes = RC_MAP_HAUPPAUGE_NEW;
    + ir_codes = RC_MAP_RC5_HAUPPAUGE_NEW;
    ir->sampling = 1;
    break;
    case CX88_BOARD_WINFAST_DTV2000H:
    diff --git a/drivers/media/video/m52790.c b/drivers/media/video/m52790.c
    index 5e1c9a8..303ffa7 100644
    --- a/drivers/media/video/m52790.c
    +++ b/drivers/media/video/m52790.c
    @@ -174,7 +174,7 @@ static int m52790_probe(struct i2c_client *client,
    v4l_info(client, "chip found @ 0x%x (%s)\n",
    client->addr << 1, client->adapter->name);

    - state = kmalloc(sizeof(struct m52790_state), GFP_KERNEL);
    + state = kzalloc(sizeof(struct m52790_state), GFP_KERNEL);
    if (state == NULL)
    return -ENOMEM;

    diff --git a/drivers/media/video/tda9840.c b/drivers/media/video/tda9840.c
    index 5d4cf3b..22fa820 100644
    --- a/drivers/media/video/tda9840.c
    +++ b/drivers/media/video/tda9840.c
    @@ -171,7 +171,7 @@ static int tda9840_probe(struct i2c_client *client,
    v4l_info(client, "chip found @ 0x%x (%s)\n",
    client->addr << 1, client->adapter->name);

    - sd = kmalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
    + sd = kzalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
    if (sd == NULL)
    return -ENOMEM;
    v4l2_i2c_subdev_init(sd, client, &tda9840_ops);
    diff --git a/drivers/media/video/tea6415c.c b/drivers/media/video/tea6415c.c
    index 19621ed..827425c 100644
    --- a/drivers/media/video/tea6415c.c
    +++ b/drivers/media/video/tea6415c.c
    @@ -152,7 +152,7 @@ static int tea6415c_probe(struct i2c_client *client,

    v4l_info(client, "chip found @ 0x%x (%s)\n",
    client->addr << 1, client->adapter->name);
    - sd = kmalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
    + sd = kzalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
    if (sd == NULL)
    return -ENOMEM;
    v4l2_i2c_subdev_init(sd, client, &tea6415c_ops);
    diff --git a/drivers/media/video/tea6420.c b/drivers/media/video/tea6420.c
    index 5ea8404..f350b6c 100644
    --- a/drivers/media/video/tea6420.c
    +++ b/drivers/media/video/tea6420.c
    @@ -125,7 +125,7 @@ static int tea6420_probe(struct i2c_client *client,
    v4l_info(client, "chip found @ 0x%x (%s)\n",
    client->addr << 1, client->adapter->name);

    - sd = kmalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
    + sd = kzalloc(sizeof(struct v4l2_subdev), GFP_KERNEL);
    if (sd == NULL)
    return -ENOMEM;
    v4l2_i2c_subdev_init(sd, client, &tea6420_ops);
    diff --git a/drivers/media/video/upd64031a.c b/drivers/media/video/upd64031a.c
    index f8138c7..1aab96a 100644
    --- a/drivers/media/video/upd64031a.c
    +++ b/drivers/media/video/upd64031a.c
    @@ -230,7 +230,7 @@ static int upd64031a_probe(struct i2c_client *client,
    v4l_info(client, "chip found @ 0x%x (%s)\n",
    client->addr << 1, client->adapter->name);

    - state = kmalloc(sizeof(struct upd64031a_state), GFP_KERNEL);
    + state = kzalloc(sizeof(struct upd64031a_state), GFP_KERNEL);
    if (state == NULL)
    return -ENOMEM;
    sd = &state->sd;
    diff --git a/drivers/media/video/upd64083.c b/drivers/media/video/upd64083.c
    index 28e0e6b..9bbe617 100644
    --- a/drivers/media/video/upd64083.c
    +++ b/drivers/media/video/upd64083.c
    @@ -202,7 +202,7 @@ static int upd64083_probe(struct i2c_client *client,
    v4l_info(client, "chip found @ 0x%x (%s)\n",
    client->addr << 1, client->adapter->name);

    - state = kmalloc(sizeof(struct upd64083_state), GFP_KERNEL);
    + state = kzalloc(sizeof(struct upd64083_state), GFP_KERNEL);
    if (state == NULL)
    return -ENOMEM;
    sd = &state->sd;
    diff --git a/drivers/mmc/core/host.c b/drivers/mmc/core/host.c
    index b3ac6c5..9ae3dbf 100644
    --- a/drivers/mmc/core/host.c
    +++ b/drivers/mmc/core/host.c
    @@ -94,7 +94,7 @@ static void mmc_host_clk_gate_delayed(struct mmc_host *host)
    spin_unlock_irqrestore(&host->clk_lock, flags);
    return;
    }
    - mutex_lock(&host->clk_gate_mutex);
    + mmc_claim_host(host);
    spin_lock_irqsave(&host->clk_lock, flags);
    if (!host->clk_requests) {
    spin_unlock_irqrestore(&host->clk_lock, flags);
    @@ -104,7 +104,7 @@ static void mmc_host_clk_gate_delayed(struct mmc_host *host)
    pr_debug("%s: gated MCI clock\n", mmc_hostname(host));
    }
    spin_unlock_irqrestore(&host->clk_lock, flags);
    - mutex_unlock(&host->clk_gate_mutex);
    + mmc_release_host(host);
    }

    /*
    @@ -130,7 +130,7 @@ void mmc_host_clk_ungate(struct mmc_host *host)
    {
    unsigned long flags;

    - mutex_lock(&host->clk_gate_mutex);
    + mmc_claim_host(host);
    spin_lock_irqsave(&host->clk_lock, flags);
    if (host->clk_gated) {
    spin_unlock_irqrestore(&host->clk_lock, flags);
    @@ -140,7 +140,7 @@ void mmc_host_clk_ungate(struct mmc_host *host)
    }
    host->clk_requests++;
    spin_unlock_irqrestore(&host->clk_lock, flags);
    - mutex_unlock(&host->clk_gate_mutex);
    + mmc_release_host(host);
    }

    /**
    @@ -218,7 +218,6 @@ static inline void mmc_host_clk_init(struct mmc_host *host)
    host->clk_gated = false;
    INIT_WORK(&host->clk_gate_work, mmc_host_clk_gate_work);
    spin_lock_init(&host->clk_lock);
    - mutex_init(&host->clk_gate_mutex);
    }

    /**
    diff --git a/drivers/mmc/host/sdhci-pci.c b/drivers/mmc/host/sdhci-pci.c
    index f7e622c..b1b2fc0 100644
    --- a/drivers/mmc/host/sdhci-pci.c
    +++ b/drivers/mmc/host/sdhci-pci.c
    @@ -961,6 +961,7 @@ static struct sdhci_pci_slot * __devinit sdhci_pci_probe_slot(
    host->ioaddr = pci_ioremap_bar(pdev, bar);
    if (!host->ioaddr) {
    dev_err(&pdev->dev, "failed to remap registers\n");
    + ret = -ENOMEM;
    goto release;
    }

    diff --git a/drivers/mmc/host/sdhci.c b/drivers/mmc/host/sdhci.c
    index 9e15f41..5d20661 100644
    --- a/drivers/mmc/host/sdhci.c
    +++ b/drivers/mmc/host/sdhci.c
    @@ -1334,6 +1334,13 @@ static void sdhci_tasklet_finish(unsigned long param)

    host = (struct sdhci_host*)param;

    + /*
    + * If this tasklet gets rescheduled while running, it will
    + * be run again afterwards but without any active request.
    + */
    + if (!host->mrq)
    + return;
    +
    spin_lock_irqsave(&host->lock, flags);

    del_timer(&host->timer);
    @@ -1345,7 +1352,7 @@ static void sdhci_tasklet_finish(unsigned long param)
    * upon error conditions.
    */
    if (!(host->flags & SDHCI_DEVICE_DEAD) &&
    - (mrq->cmd->error ||
    + ((mrq->cmd && mrq->cmd->error) ||
    (mrq->data && (mrq->data->error ||
    (mrq->data->stop && mrq->data->stop->error))) ||
    (host->quirks & SDHCI_QUIRK_RESET_AFTER_REQUEST))) {
    diff --git a/drivers/net/atl1c/atl1c.h b/drivers/net/atl1c/atl1c.h
    index 9ab5809..dec8110 100644
    --- a/drivers/net/atl1c/atl1c.h
    +++ b/drivers/net/atl1c/atl1c.h
    @@ -566,9 +566,9 @@ struct atl1c_adapter {
    #define __AT_TESTING 0x0001
    #define __AT_RESETTING 0x0002
    #define __AT_DOWN 0x0003
    - u8 work_event;
    -#define ATL1C_WORK_EVENT_RESET 0x01
    -#define ATL1C_WORK_EVENT_LINK_CHANGE 0x02
    + unsigned long work_event;
    +#define ATL1C_WORK_EVENT_RESET 0
    +#define ATL1C_WORK_EVENT_LINK_CHANGE 1
    u32 msg_enable;

    bool have_msi;
    diff --git a/drivers/net/atl1c/atl1c_main.c b/drivers/net/atl1c/atl1c_main.c
    index 3824382..dffc7f7 100644
    --- a/drivers/net/atl1c/atl1c_main.c
    +++ b/drivers/net/atl1c/atl1c_main.c
    @@ -325,7 +325,7 @@ static void atl1c_link_chg_event(struct atl1c_adapter *adapter)
    }
    }

    - adapter->work_event |= ATL1C_WORK_EVENT_LINK_CHANGE;
    + set_bit(ATL1C_WORK_EVENT_LINK_CHANGE, &adapter->work_event);
    schedule_work(&adapter->common_task);
    }

    @@ -337,20 +337,16 @@ static void atl1c_common_task(struct work_struct *work)
    adapter = container_of(work, struct atl1c_adapter, common_task);
    netdev = adapter->netdev;

    - if (adapter->work_event & ATL1C_WORK_EVENT_RESET) {
    - adapter->work_event &= ~ATL1C_WORK_EVENT_RESET;
    + if (test_and_clear_bit(ATL1C_WORK_EVENT_RESET, &adapter->work_event)) {
    netif_device_detach(netdev);
    atl1c_down(adapter);
    atl1c_up(adapter);
    netif_device_attach(netdev);
    - return;
    }

    - if (adapter->work_event & ATL1C_WORK_EVENT_LINK_CHANGE) {
    - adapter->work_event &= ~ATL1C_WORK_EVENT_LINK_CHANGE;
    + if (test_and_clear_bit(ATL1C_WORK_EVENT_LINK_CHANGE,
    + &adapter->work_event))
    atl1c_check_link_status(adapter);
    - }
    - return;
    }


    @@ -369,7 +365,7 @@ static void atl1c_tx_timeout(struct net_device *netdev)
    struct atl1c_adapter *adapter = netdev_priv(netdev);

    /* Do the reset outside of interrupt context */
    - adapter->work_event |= ATL1C_WORK_EVENT_RESET;
    + set_bit(ATL1C_WORK_EVENT_RESET, &adapter->work_event);
    schedule_work(&adapter->common_task);
    }

    diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
    index 9a60e41..1189d72 100644
    --- a/drivers/net/usb/cdc_ether.c
    +++ b/drivers/net/usb/cdc_ether.c
    @@ -458,7 +458,7 @@ static const struct driver_info cdc_info = {
    .manage_power = cdc_manage_power,
    };

    -static const struct driver_info mbm_info = {
    +static const struct driver_info wwan_info = {
    .description = "Mobile Broadband Network Device",
    .flags = FLAG_WWAN,
    .bind = cdc_bind,
    @@ -469,6 +469,7 @@ static const struct driver_info mbm_info = {

    /*-------------------------------------------------------------------------*/

    +#define HUAWEI_VENDOR_ID 0x12D1

    static const struct usb_device_id products [] = {
    /*
    @@ -578,8 +579,17 @@ static const struct usb_device_id products [] = {
    }, {
    USB_INTERFACE_INFO(USB_CLASS_COMM, USB_CDC_SUBCLASS_MDLM,
    USB_CDC_PROTO_NONE),
    - .driver_info = (unsigned long)&mbm_info,
    + .driver_info = (unsigned long)&wwan_info,

    +}, {
    + /* Various Huawei modems with a network port like the UMG1831 */
    + .match_flags = USB_DEVICE_ID_MATCH_VENDOR
    + | USB_DEVICE_ID_MATCH_INT_INFO,
    + .idVendor = HUAWEI_VENDOR_ID,
    + .bInterfaceClass = USB_CLASS_COMM,
    + .bInterfaceSubClass = USB_CDC_SUBCLASS_ETHERNET,
    + .bInterfaceProtocol = 255,
    + .driver_info = (unsigned long)&wwan_info,
    },
    { }, // END
    };
    diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
    index 89546bc..1e0c1e3 100644
    --- a/drivers/net/wireless/ath/ath9k/recv.c
    +++ b/drivers/net/wireless/ath/ath9k/recv.c
    @@ -533,7 +533,7 @@ bool ath_stoprecv(struct ath_softc *sc)
    "confusing the DMA engine when we start RX up\n");
    ATH_DBG_WARN_ON_ONCE(!stopped);
    }
    - return stopped || reset;
    + return stopped && !reset;
    }

    void ath_flushrecv(struct ath_softc *sc)
    diff --git a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
    index 24a11b8..c13542b 100644
    --- a/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
    +++ b/drivers/net/wireless/iwlwifi/iwl-agn-tx.c
    @@ -561,12 +561,17 @@ int iwlagn_tx_skb(struct iwl_priv *priv, struct sk_buff *skb)

    hdr_len = ieee80211_hdrlen(fc);

    - /* Find index into station table for destination station */
    - sta_id = iwl_sta_id_or_broadcast(priv, ctx, info->control.sta);
    - if (sta_id == IWL_INVALID_STATION) {
    - IWL_DEBUG_DROP(priv, "Dropping - INVALID STATION: %pM\n",
    - hdr->addr1);
    - goto drop_unlock;
    + /* For management frames use broadcast id to do not break aggregation */
    + if (!ieee80211_is_data(fc))
    + sta_id = ctx->bcast_sta_id;
    + else {
    + /* Find index into station table for destination station */
    + sta_id = iwl_sta_id_or_broadcast(priv, ctx, info->control.sta);
    + if (sta_id == IWL_INVALID_STATION) {
    + IWL_DEBUG_DROP(priv, "Dropping - INVALID STATION: %pM\n",
    + hdr->addr1);
    + goto drop_unlock;
    + }
    }

    IWL_DEBUG_TX(priv, "station Id %d\n", sta_id);
    @@ -1207,12 +1212,16 @@ int iwlagn_tx_queue_reclaim(struct iwl_priv *priv, int txq_id, int index)
    q->read_ptr = iwl_queue_inc_wrap(q->read_ptr, q->n_bd)) {

    tx_info = &txq->txb[txq->q.read_ptr];
    - iwlagn_tx_status(priv, tx_info,
    - txq_id >= IWLAGN_FIRST_AMPDU_QUEUE);
    +
    + if (WARN_ON_ONCE(tx_info->skb == NULL))
    + continue;

    hdr = (struct ieee80211_hdr *)tx_info->skb->data;
    - if (hdr && ieee80211_is_data_qos(hdr->frame_control))
    + if (ieee80211_is_data_qos(hdr->frame_control))
    nfreed++;
    +
    + iwlagn_tx_status(priv, tx_info,
    + txq_id >= IWLAGN_FIRST_AMPDU_QUEUE);
    tx_info->skb = NULL;

    if (priv->cfg->ops->lib->txq_inval_byte_cnt_tbl)
    diff --git a/drivers/scsi/device_handler/scsi_dh.c b/drivers/scsi/device_handler/scsi_dh.c
    index b837c5b..1367b91 100644
    --- a/drivers/scsi/device_handler/scsi_dh.c
    +++ b/drivers/scsi/device_handler/scsi_dh.c
    @@ -437,12 +437,14 @@ int scsi_dh_activate(struct request_queue *q, activate_complete fn, void *data)
    unsigned long flags;
    struct scsi_device *sdev;
    struct scsi_device_handler *scsi_dh = NULL;
    + struct device *dev = NULL;

    spin_lock_irqsave(q->queue_lock, flags);
    sdev = q->queuedata;
    if (sdev && sdev->scsi_dh_data)
    scsi_dh = sdev->scsi_dh_data->scsi_dh;
    - if (!scsi_dh || !get_device(&sdev->sdev_gendev) ||
    + dev = get_device(&sdev->sdev_gendev);
    + if (!scsi_dh || !dev ||
    sdev->sdev_state == SDEV_CANCEL ||
    sdev->sdev_state == SDEV_DEL)
    err = SCSI_DH_NOSYS;
    @@ -453,12 +455,13 @@ int scsi_dh_activate(struct request_queue *q, activate_complete fn, void *data)
    if (err) {
    if (fn)
    fn(data, err);
    - return err;
    + goto out;
    }

    if (scsi_dh->activate)
    err = scsi_dh->activate(sdev, fn, data);
    - put_device(&sdev->sdev_gendev);
    +out:
    + put_device(dev);
    return err;
    }
    EXPORT_SYMBOL_GPL(scsi_dh_activate);
    diff --git a/drivers/scsi/mpt2sas/mpt2sas_ctl.c b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
    index e92b77a..3834c95 100644
    --- a/drivers/scsi/mpt2sas/mpt2sas_ctl.c
    +++ b/drivers/scsi/mpt2sas/mpt2sas_ctl.c
    @@ -688,6 +688,13 @@ _ctl_do_mpt_command(struct MPT2SAS_ADAPTER *ioc,
    goto out;
    }

    + /* Check for overflow and wraparound */
    + if (karg.data_sge_offset * 4 > ioc->request_sz ||
    + karg.data_sge_offset > (UINT_MAX / 4)) {
    + ret = -EINVAL;
    + goto out;
    + }
    +
    /* copy in request message frame from user */
    if (copy_from_user(mpi_request, mf, karg.data_sge_offset*4)) {
    printk(KERN_ERR "failure at %s:%d/%s()!\n", __FILE__, __LINE__,
    @@ -1963,7 +1970,7 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state)
    Mpi2DiagBufferPostReply_t *mpi_reply;
    int rc, i;
    u8 buffer_type;
    - unsigned long timeleft;
    + unsigned long timeleft, request_size, copy_size;
    u16 smid;
    u16 ioc_status;
    u8 issue_reset = 0;
    @@ -1999,6 +2006,8 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state)
    return -ENOMEM;
    }

    + request_size = ioc->diag_buffer_sz[buffer_type];
    +
    if ((karg.starting_offset % 4) || (karg.bytes_to_read % 4)) {
    printk(MPT2SAS_ERR_FMT "%s: either the starting_offset "
    "or bytes_to_read are not 4 byte aligned\n", ioc->name,
    @@ -2006,13 +2015,23 @@ _ctl_diag_read_buffer(void __user *arg, enum block_state state)
    return -EINVAL;
    }

    + if (karg.starting_offset > request_size)
    + return -EINVAL;
    +
    diag_data = (void *)(request_data + karg.starting_offset);
    dctlprintk(ioc, printk(MPT2SAS_INFO_FMT "%s: diag_buffer(%p), "
    "offset(%d), sz(%d)\n", ioc->name, __func__,
    diag_data, karg.starting_offset, karg.bytes_to_read));

    + /* Truncate data on requests that are too large */
    + if ((diag_data + karg.bytes_to_read < diag_data) ||
    + (diag_data + karg.bytes_to_read > request_data + request_size))
    + copy_size = request_size - karg.starting_offset;
    + else
    + copy_size = karg.bytes_to_read;
    +
    if (copy_to_user((void __user *)uarg->diagnostic_data,
    - diag_data, karg.bytes_to_read)) {
    + diag_data, copy_size)) {
    printk(MPT2SAS_ERR_FMT "%s: Unable to write "
    "mpt_diag_read_buffer_t data @ %p\n", ioc->name,
    __func__, diag_data);
    diff --git a/drivers/scsi/pmcraid.c b/drivers/scsi/pmcraid.c
    index 321cf3a..ce0701d 100644
    --- a/drivers/scsi/pmcraid.c
    +++ b/drivers/scsi/pmcraid.c
    @@ -3814,6 +3814,9 @@ static long pmcraid_ioctl_passthrough(
    rc = -EFAULT;
    goto out_free_buffer;
    }
    + } else if (request_size < 0) {
    + rc = -EINVAL;
    + goto out_free_buffer;
    }

    /* check if we have any additional command parameters */
    diff --git a/drivers/scsi/scsi_lib.c b/drivers/scsi/scsi_lib.c
    index fb2bb35..415fdf2 100644
    --- a/drivers/scsi/scsi_lib.c
    +++ b/drivers/scsi/scsi_lib.c
    @@ -400,10 +400,15 @@ static inline int scsi_host_is_busy(struct Scsi_Host *shost)
    static void scsi_run_queue(struct request_queue *q)
    {
    struct scsi_device *sdev = q->queuedata;
    - struct Scsi_Host *shost = sdev->host;
    + struct Scsi_Host *shost;
    LIST_HEAD(starved_list);
    unsigned long flags;

    + /* if the device is dead, sdev will be NULL, so no queue to run */
    + if (!sdev)
    + return;
    +
    + shost = sdev->host;
    if (scsi_target(sdev)->single_lun)
    scsi_single_lun_run(sdev);

    diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
    index 490ce21..360b7cb 100644
    --- a/drivers/scsi/scsi_sysfs.c
    +++ b/drivers/scsi/scsi_sysfs.c
    @@ -322,14 +322,8 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
    kfree(evt);
    }

    - if (sdev->request_queue) {
    - sdev->request_queue->queuedata = NULL;
    - /* user context needed to free queue */
    - scsi_free_queue(sdev->request_queue);
    - /* temporary expedient, try to catch use of queue lock
    - * after free of sdev */
    - sdev->request_queue = NULL;
    - }
    + /* NULL queue means the device can't be used */
    + sdev->request_queue = NULL;

    scsi_target_reap(scsi_target(sdev));

    @@ -937,6 +931,12 @@ void __scsi_remove_device(struct scsi_device *sdev)
    if (sdev->host->hostt->slave_destroy)
    sdev->host->hostt->slave_destroy(sdev);
    transport_destroy_device(dev);
    +
    + /* cause the request function to reject all I/O requests */
    + sdev->request_queue->queuedata = NULL;
    +
    + /* Freeing the queue signals to block that we're done */
    + scsi_free_queue(sdev->request_queue);
    put_device(dev);
    }

    diff --git a/drivers/staging/usbip/vhci_hcd.c b/drivers/staging/usbip/vhci_hcd.c
    index a35fe61..7284d0c 100644
    --- a/drivers/staging/usbip/vhci_hcd.c
    +++ b/drivers/staging/usbip/vhci_hcd.c
    @@ -1135,7 +1135,7 @@ static int vhci_hcd_probe(struct platform_device *pdev)
    usbip_uerr("create hcd failed\n");
    return -ENOMEM;
    }
    -
    + hcd->has_tt = 1;

    /* this is private data for vhci_hcd */
    the_controller = hcd_to_vhci(hcd);
    diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c
    index da1d970..435f407 100644
    --- a/fs/nfsd/vfs.c
    +++ b/fs/nfsd/vfs.c
    @@ -1363,7 +1363,7 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
    goto out;
    if (!(iap->ia_valid & ATTR_MODE))
    iap->ia_mode = 0;
    - err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE);
    + err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_EXEC);
    if (err)
    goto out;

    @@ -1385,6 +1385,13 @@ nfsd_create_v3(struct svc_rqst *rqstp, struct svc_fh *fhp,
    if (IS_ERR(dchild))
    goto out_nfserr;

    + /* If file doesn't exist, check for permissions to create one */
    + if (!dchild->d_inode) {
    + err = fh_verify(rqstp, fhp, S_IFDIR, NFSD_MAY_CREATE);
    + if (err)
    + goto out;
    + }
    +
    err = fh_compose(resfhp, fhp->fh_export, dchild, fhp);
    if (err)
    goto out;
    diff --git a/fs/partitions/ldm.c b/fs/partitions/ldm.c
    index b10e354..ce4f624 100644
    --- a/fs/partitions/ldm.c
    +++ b/fs/partitions/ldm.c
    @@ -1299,6 +1299,11 @@ static bool ldm_frag_add (const u8 *data, int size, struct list_head *frags)

    BUG_ON (!data || !frags);

    + if (size < 2 * VBLK_SIZE_HEAD) {
    + ldm_error("Value of size is to small.");
    + return false;
    + }
    +
    group = get_unaligned_be32(data + 0x08);
    rec = get_unaligned_be16(data + 0x0C);
    num = get_unaligned_be16(data + 0x0E);
    @@ -1306,6 +1311,10 @@ static bool ldm_frag_add (const u8 *data, int size, struct list_head *frags)
    ldm_error ("A VBLK claims to have %d parts.", num);
    return false;
    }
    + if (rec >= num) {
    + ldm_error("REC value (%d) exceeds NUM value (%d)", rec, num);
    + return false;
    + }

    list_for_each (item, frags) {
    f = list_entry (item, struct frag, list);
    @@ -1334,10 +1343,9 @@ found:

    f->map |= (1 << rec);

    - if (num > 0) {
    - data += VBLK_SIZE_HEAD;
    - size -= VBLK_SIZE_HEAD;
    - }
    + data += VBLK_SIZE_HEAD;
    + size -= VBLK_SIZE_HEAD;
    +
    memcpy (f->data+rec*(size-VBLK_SIZE_HEAD)+VBLK_SIZE_HEAD, data, size);

    return true;
    diff --git a/fs/ubifs/log.c b/fs/ubifs/log.c
    index 4d0cb12..40fa780 100644
    --- a/fs/ubifs/log.c
    +++ b/fs/ubifs/log.c
    @@ -175,26 +175,6 @@ void ubifs_add_bud(struct ubifs_info *c, struct ubifs_bud *bud)
    }

    /**
    - * ubifs_create_buds_lists - create journal head buds lists for remount rw.
    - * @c: UBIFS file-system description object
    - */
    -void ubifs_create_buds_lists(struct ubifs_info *c)
    -{
    - struct rb_node *p;
    -
    - spin_lock(&c->buds_lock);
    - p = rb_first(&c->buds);
    - while (p) {
    - struct ubifs_bud *bud = rb_entry(p, struct ubifs_bud, rb);
    - struct ubifs_jhead *jhead = &c->jheads[bud->jhead];
    -
    - list_add_tail(&bud->list, &jhead->buds_list);
    - p = rb_next(p);
    - }
    - spin_unlock(&c->buds_lock);
    -}
    -
    -/**
    * ubifs_add_bud_to_log - add a new bud to the log.
    * @c: UBIFS file-system description object
    * @jhead: journal head the bud belongs to
    diff --git a/fs/ubifs/replay.c b/fs/ubifs/replay.c
    index eed0fcf..d3d6d36 100644
    --- a/fs/ubifs/replay.c
    +++ b/fs/ubifs/replay.c
    @@ -59,6 +59,7 @@ enum {
    * @new_size: truncation new size
    * @free: amount of free space in a bud
    * @dirty: amount of dirty space in a bud from padding and deletion nodes
    + * @jhead: journal head number of the bud
    *
    * UBIFS journal replay must compare node sequence numbers, which means it must
    * build a tree of node information to insert into the TNC.
    @@ -80,6 +81,7 @@ struct replay_entry {
    struct {
    int free;
    int dirty;
    + int jhead;
    };
    };
    };
    @@ -159,6 +161,11 @@ static int set_bud_lprops(struct ubifs_info *c, struct replay_entry *r)
    err = PTR_ERR(lp);
    goto out;
    }
    +
    + /* Make sure the journal head points to the latest bud */
    + err = ubifs_wbuf_seek_nolock(&c->jheads[r->jhead].wbuf, r->lnum,
    + c->leb_size - r->free, UBI_SHORTTERM);
    +
    out:
    ubifs_release_lprops(c);
    return err;
    @@ -627,10 +634,6 @@ static int replay_bud(struct ubifs_info *c, int lnum, int offs, int jhead,
    ubifs_assert(sleb->endpt - offs >= used);
    ubifs_assert(sleb->endpt % c->min_io_size == 0);

    - if (sleb->endpt + c->min_io_size <= c->leb_size && !c->ro_mount)
    - err = ubifs_wbuf_seek_nolock(&c->jheads[jhead].wbuf, lnum,
    - sleb->endpt, UBI_SHORTTERM);
    -
    *dirty = sleb->endpt - offs - used;
    *free = c->leb_size - sleb->endpt;

    @@ -653,12 +656,14 @@ out_dump:
    * @sqnum: sequence number
    * @free: amount of free space in bud
    * @dirty: amount of dirty space from padding and deletion nodes
    + * @jhead: journal head number for the bud
    *
    * This function inserts a reference node to the replay tree and returns zero
    * in case of success or a negative error code in case of failure.
    */
    static int insert_ref_node(struct ubifs_info *c, int lnum, int offs,
    - unsigned long long sqnum, int free, int dirty)
    + unsigned long long sqnum, int free, int dirty,
    + int jhead)
    {
    struct rb_node **p = &c->replay_tree.rb_node, *parent = NULL;
    struct replay_entry *r;
    @@ -688,6 +693,7 @@ static int insert_ref_node(struct ubifs_info *c, int lnum, int offs,
    r->flags = REPLAY_REF;
    r->free = free;
    r->dirty = dirty;
    + r->jhead = jhead;

    rb_link_node(&r->rb, parent, p);
    rb_insert_color(&r->rb, &c->replay_tree);
    @@ -712,7 +718,7 @@ static int replay_buds(struct ubifs_info *c)
    if (err)
    return err;
    err = insert_ref_node(c, b->bud->lnum, b->bud->start, b->sqnum,
    - free, dirty);
    + free, dirty, b->bud->jhead);
    if (err)
    return err;
    }
    diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
    index e94d962..e20cb5a 100644
    --- a/fs/ubifs/super.c
    +++ b/fs/ubifs/super.c
    @@ -1235,12 +1235,12 @@ static int mount_ubifs(struct ubifs_info *c)
    goto out_free;
    }

    + err = alloc_wbufs(c);
    + if (err)
    + goto out_cbuf;
    +
    sprintf(c->bgt_name, BGT_NAME_PATTERN, c->vi.ubi_num, c->vi.vol_id);
    if (!c->ro_mount) {
    - err = alloc_wbufs(c);
    - if (err)
    - goto out_cbuf;
    -
    /* Create background thread */
    c->bgt = kthread_create(ubifs_bg_thread, c, "%s", c->bgt_name);
    if (IS_ERR(c->bgt)) {
    @@ -1603,12 +1603,6 @@ static int ubifs_remount_rw(struct ubifs_info *c)
    if (err)
    goto out;

    - err = alloc_wbufs(c);
    - if (err)
    - goto out;
    -
    - ubifs_create_buds_lists(c);
    -
    /* Create background thread */
    c->bgt = kthread_create(ubifs_bg_thread, c, "%s", c->bgt_name);
    if (IS_ERR(c->bgt)) {
    @@ -1717,7 +1711,6 @@ static void ubifs_remount_ro(struct ubifs_info *c)
    if (err)
    ubifs_ro_mode(c, err);

    - free_wbufs(c);
    vfree(c->orph_buf);
    c->orph_buf = NULL;
    vfree(c->ileb_buf);
    diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h
    index 6724bf3..e893a90 100644
    --- a/include/drm/drm_pciids.h
    +++ b/include/drm/drm_pciids.h
    @@ -153,6 +153,7 @@
    {0x1002, 0x6729, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BARTS|RADEON_NEW_MEMMAP}, \
    {0x1002, 0x6738, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BARTS|RADEON_NEW_MEMMAP}, \
    {0x1002, 0x6739, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BARTS|RADEON_NEW_MEMMAP}, \
    + {0x1002, 0x673e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_BARTS|RADEON_NEW_MEMMAP}, \
    {0x1002, 0x6740, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
    {0x1002, 0x6741, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
    {0x1002, 0x6742, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TURKS|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
    @@ -185,6 +186,7 @@
    {0x1002, 0x688D, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_NEW_MEMMAP}, \
    {0x1002, 0x6898, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_NEW_MEMMAP}, \
    {0x1002, 0x6899, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_NEW_MEMMAP}, \
    + {0x1002, 0x689b, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_NEW_MEMMAP}, \
    {0x1002, 0x689c, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HEMLOCK|RADEON_NEW_MEMMAP}, \
    {0x1002, 0x689d, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_HEMLOCK|RADEON_NEW_MEMMAP}, \
    {0x1002, 0x689e, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_CYPRESS|RADEON_NEW_MEMMAP}, \
    @@ -195,7 +197,9 @@
    {0x1002, 0x68b0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_JUNIPER|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
    {0x1002, 0x68b8, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_JUNIPER|RADEON_NEW_MEMMAP}, \
    {0x1002, 0x68b9, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_JUNIPER|RADEON_NEW_MEMMAP}, \
    + {0x1002, 0x68ba, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_JUNIPER|RADEON_NEW_MEMMAP}, \
    {0x1002, 0x68be, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_JUNIPER|RADEON_NEW_MEMMAP}, \
    + {0x1002, 0x68bf, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_JUNIPER|RADEON_NEW_MEMMAP}, \
    {0x1002, 0x68c0, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_REDWOOD|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
    {0x1002, 0x68c1, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_REDWOOD|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
    {0x1002, 0x68c7, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_REDWOOD|RADEON_IS_MOBILITY|RADEON_NEW_MEMMAP}, \
    diff --git a/include/linux/flex_array.h b/include/linux/flex_array.h
    index 70e4efa..ebeb2f3 100644
    --- a/include/linux/flex_array.h
    +++ b/include/linux/flex_array.h
    @@ -61,7 +61,7 @@ struct flex_array {
    struct flex_array *flex_array_alloc(int element_size, unsigned int total,
    gfp_t flags);
    int flex_array_prealloc(struct flex_array *fa, unsigned int start,
    - unsigned int end, gfp_t flags);
    + unsigned int nr_elements, gfp_t flags);
    void flex_array_free(struct flex_array *fa);
    void flex_array_free_parts(struct flex_array *fa);
    int flex_array_put(struct flex_array *fa, unsigned int element_nr, void *src,
    diff --git a/include/linux/mmc/host.h b/include/linux/mmc/host.h
    index bcb793e..eb792cb 100644
    --- a/include/linux/mmc/host.h
    +++ b/include/linux/mmc/host.h
    @@ -183,7 +183,6 @@ struct mmc_host {
    struct work_struct clk_gate_work; /* delayed clock gate */
    unsigned int clk_old; /* old clock value cache */
    spinlock_t clk_lock; /* lock for clk fields */
    - struct mutex clk_gate_mutex; /* mutex for clock gating */
    #endif

    /* host specific block data */
    diff --git a/kernel/workqueue.c b/kernel/workqueue.c
    index ee6578b..7b65ae7 100644
    --- a/kernel/workqueue.c
    +++ b/kernel/workqueue.c
    @@ -1283,8 +1283,14 @@ __acquires(&gcwq->lock)
    return true;
    spin_unlock_irq(&gcwq->lock);

    - /* CPU has come up inbetween, retry migration */
    + /*
    + * We've raced with CPU hot[un]plug. Give it a breather
    + * and retry migration. cond_resched() is required here;
    + * otherwise, we might deadlock against cpu_stop trying to
    + * bring down the CPU on non-preemptive kernel.
    + */
    cpu_relax();
    + cond_resched();
    }
    }

    diff --git a/lib/flex_array.c b/lib/flex_array.c
    index c0ea40b..854b57b 100644
    --- a/lib/flex_array.c
    +++ b/lib/flex_array.c
    @@ -232,10 +232,10 @@ EXPORT_SYMBOL(flex_array_clear);

    /**
    * flex_array_prealloc - guarantee that array space exists
    - * @fa: the flex array for which to preallocate parts
    - * @start: index of first array element for which space is allocated
    - * @end: index of last (inclusive) element for which space is allocated
    - * @flags: page allocation flags
    + * @fa: the flex array for which to preallocate parts
    + * @start: index of first array element for which space is allocated
    + * @nr_elements: number of elements for which space is allocated
    + * @flags: page allocation flags
    *
    * This will guarantee that no future calls to flex_array_put()
    * will allocate memory. It can be used if you are expecting to
    @@ -245,14 +245,24 @@ EXPORT_SYMBOL(flex_array_clear);
    * Locking must be provided by the caller.
    */
    int flex_array_prealloc(struct flex_array *fa, unsigned int start,
    - unsigned int end, gfp_t flags)
    + unsigned int nr_elements, gfp_t flags)
    {
    int start_part;
    int end_part;
    int part_nr;
    + unsigned int end;
    struct flex_array_part *part;

    - if (start >= fa->total_nr_elements || end >= fa->total_nr_elements)
    + if (!start && !nr_elements)
    + return 0;
    + if (start >= fa->total_nr_elements)
    + return -ENOSPC;
    + if (!nr_elements)
    + return 0;
    +
    + end = start + nr_elements - 1;
    +
    + if (end >= fa->total_nr_elements)
    return -ENOSPC;
    if (elements_fit_in_base(fa))
    return 0;
    @@ -343,6 +353,8 @@ int flex_array_shrink(struct flex_array *fa)
    int part_nr;
    int ret = 0;

    + if (!fa->total_nr_elements)
    + return 0;
    if (elements_fit_in_base(fa))
    return ret;
    for (part_nr = 0; part_nr < FLEX_ARRAY_NR_BASE_PTRS; part_nr++) {
    diff --git a/lib/xz/xz_dec_lzma2.c b/lib/xz/xz_dec_lzma2.c
    index ea5fa4f..a6cdc96 100644
    --- a/lib/xz/xz_dec_lzma2.c
    +++ b/lib/xz/xz_dec_lzma2.c
    @@ -969,6 +969,9 @@ XZ_EXTERN enum xz_ret xz_dec_lzma2_run(struct xz_dec_lzma2 *s,
    */
    tmp = b->in[b->in_pos++];

    + if (tmp == 0x00)
    + return XZ_STREAM_END;
    +
    if (tmp >= 0xE0 || tmp == 0x01) {
    s->lzma2.need_props = true;
    s->lzma2.need_dict_reset = false;
    @@ -1001,9 +1004,6 @@ XZ_EXTERN enum xz_ret xz_dec_lzma2_run(struct xz_dec_lzma2 *s,
    lzma_reset(s);
    }
    } else {
    - if (tmp == 0x00)
    - return XZ_STREAM_END;
    -
    if (tmp > 0x02)
    return XZ_DATA_ERROR;

    diff --git a/mm/memory.c b/mm/memory.c
    index ab88d09..8b2bb7d 100644
    --- a/mm/memory.c
    +++ b/mm/memory.c
    @@ -1359,7 +1359,7 @@ split_fallthrough:
    */
    mark_page_accessed(page);
    }
    - if (flags & FOLL_MLOCK) {
    + if ((flags & FOLL_MLOCK) && (vma->vm_flags & VM_LOCKED)) {
    /*
    * The preliminary mapping check is mainly to avoid the
    * pointless overhead of lock_page on the ZERO_PAGE
    @@ -1503,10 +1503,9 @@ int __get_user_pages(struct task_struct *tsk, struct mm_struct *mm,
    }

    /*
    - * If we don't actually want the page itself,
    - * and it's the stack guard page, just skip it.
    + * For mlock, just skip the stack guard page.
    */
    - if (!pages && stack_guard_page(vma, start))
    + if ((gup_flags & FOLL_MLOCK) && stack_guard_page(vma, start))
    goto next_page;

    do {
    diff --git a/mm/mlock.c b/mm/mlock.c
    index da23be4..c8e7790 100644
    --- a/mm/mlock.c
    +++ b/mm/mlock.c
    @@ -162,7 +162,7 @@ static long __mlock_vma_pages_range(struct vm_area_struct *vma,
    VM_BUG_ON(end > vma->vm_end);
    VM_BUG_ON(!rwsem_is_locked(&mm->mmap_sem));

    - gup_flags = FOLL_TOUCH;
    + gup_flags = FOLL_TOUCH | FOLL_MLOCK;
    /*
    * We want to touch writable mappings with a write fault in order
    * to break COW, except for shared mappings because these don't COW
    @@ -178,9 +178,6 @@ static long __mlock_vma_pages_range(struct vm_area_struct *vma,
    if (vma->vm_flags & (VM_READ | VM_WRITE | VM_EXEC))
    gup_flags |= FOLL_FORCE;

    - if (vma->vm_flags & VM_LOCKED)
    - gup_flags |= FOLL_MLOCK;
    -
    return __get_user_pages(current, mm, addr, nr_pages, gup_flags,
    NULL, NULL, nonblocking);
    }
    diff --git a/net/can/bcm.c b/net/can/bcm.c
    index 092dc88..63779ab 100644
    --- a/net/can/bcm.c
    +++ b/net/can/bcm.c
    @@ -1427,9 +1427,14 @@ static int bcm_init(struct sock *sk)
    static int bcm_release(struct socket *sock)
    {
    struct sock *sk = sock->sk;
    - struct bcm_sock *bo = bcm_sk(sk);
    + struct bcm_sock *bo;
    struct bcm_op *op, *next;

    + if (sk == NULL)
    + return 0;
    +
    + bo = bcm_sk(sk);
    +
    /* remove bcm_ops, timer, rx_unregister(), etc. */

    unregister_netdevice_notifier(&bo->notifier);
    diff --git a/net/can/raw.c b/net/can/raw.c
    index 883e9d7..241b2b6 100644
    --- a/net/can/raw.c
    +++ b/net/can/raw.c
    @@ -305,7 +305,12 @@ static int raw_init(struct sock *sk)
    static int raw_release(struct socket *sock)
    {
    struct sock *sk = sock->sk;
    - struct raw_sock *ro = raw_sk(sk);
    + struct raw_sock *ro;
    +
    + if (!sk)
    + return 0;
    +
    + ro = raw_sk(sk);

    unregister_netdevice_notifier(&ro->notifier);

    diff --git a/net/mac80211/cfg.c b/net/mac80211/cfg.c
    index 9cd73b1..40f7357 100644
    --- a/net/mac80211/cfg.c
    +++ b/net/mac80211/cfg.c
    @@ -1471,6 +1471,8 @@ int __ieee80211_request_smps(struct ieee80211_sub_if_data *sdata,
    enum ieee80211_smps_mode old_req;
    int err;

    + lockdep_assert_held(&sdata->u.mgd.mtx);
    +
    old_req = sdata->u.mgd.req_smps;
    sdata->u.mgd.req_smps = smps_mode;

    diff --git a/net/mac80211/debugfs_netdev.c b/net/mac80211/debugfs_netdev.c
    index 2dabdf7..bae23ad 100644
    --- a/net/mac80211/debugfs_netdev.c
    +++ b/net/mac80211/debugfs_netdev.c
    @@ -172,9 +172,9 @@ static int ieee80211_set_smps(struct ieee80211_sub_if_data *sdata,
    if (sdata->vif.type != NL80211_IFTYPE_STATION)
    return -EOPNOTSUPP;

    - mutex_lock(&local->iflist_mtx);
    + mutex_lock(&sdata->u.mgd.mtx);
    err = __ieee80211_request_smps(sdata, smps_mode);
    - mutex_unlock(&local->iflist_mtx);
    + mutex_unlock(&sdata->u.mgd.mtx);

    return err;
    }
    diff --git a/net/unix/af_unix.c b/net/unix/af_unix.c
    index 437a99e..7a79ad0 100644
    --- a/net/unix/af_unix.c
    +++ b/net/unix/af_unix.c
    @@ -524,6 +524,8 @@ static int unix_dgram_connect(struct socket *, struct sockaddr *,
    int, int);
    static int unix_seqpacket_sendmsg(struct kiocb *, struct socket *,
    struct msghdr *, size_t);
    +static int unix_seqpacket_recvmsg(struct kiocb *, struct socket *,
    + struct msghdr *, size_t, int);

    static const struct proto_ops unix_stream_ops = {
    .family = PF_UNIX,
    @@ -583,7 +585,7 @@ static const struct proto_ops unix_seqpacket_ops = {
    .setsockopt = sock_no_setsockopt,
    .getsockopt = sock_no_getsockopt,
    .sendmsg = unix_seqpacket_sendmsg,
    - .recvmsg = unix_dgram_recvmsg,
    + .recvmsg = unix_seqpacket_recvmsg,
    .mmap = sock_no_mmap,
    .sendpage = sock_no_sendpage,
    };
    @@ -1695,6 +1697,18 @@ static int unix_seqpacket_sendmsg(struct kiocb *kiocb, struct socket *sock,
    return unix_dgram_sendmsg(kiocb, sock, msg, len);
    }

    +static int unix_seqpacket_recvmsg(struct kiocb *iocb, struct socket *sock,
    + struct msghdr *msg, size_t size,
    + int flags)
    +{
    + struct sock *sk = sock->sk;
    +
    + if (sk->sk_state != TCP_ESTABLISHED)
    + return -ENOTCONN;
    +
    + return unix_dgram_recvmsg(iocb, sock, msg, size, flags);
    +}
    +
    static void unix_copy_addr(struct msghdr *msg, struct sock *sk)
    {
    struct unix_sock *u = unix_sk(sk);
    diff --git a/security/selinux/ss/policydb.c b/security/selinux/ss/policydb.c
    index 5736356..f96f09c 100644
    --- a/security/selinux/ss/policydb.c
    +++ b/security/selinux/ss/policydb.c
    @@ -497,7 +497,7 @@ static int policydb_index(struct policydb *p)
    goto out;

    rc = flex_array_prealloc(p->type_val_to_struct_array, 0,
    - p->p_types.nprim - 1, GFP_KERNEL | __GFP_ZERO);
    + p->p_types.nprim, GFP_KERNEL | __GFP_ZERO);
    if (rc)
    goto out;

    @@ -514,7 +514,7 @@ static int policydb_index(struct policydb *p)
    goto out;

    rc = flex_array_prealloc(p->sym_val_to_name[i],
    - 0, p->symtab[i].nprim - 1,
    + 0, p->symtab[i].nprim,
    GFP_KERNEL | __GFP_ZERO);
    if (rc)
    goto out;
    @@ -2286,7 +2286,7 @@ int policydb_read(struct policydb *p, void *fp)
    goto bad;

    /* preallocate so we don't have to worry about the put ever failing */
    - rc = flex_array_prealloc(p->type_attr_map_array, 0, p->p_types.nprim - 1,
    + rc = flex_array_prealloc(p->type_attr_map_array, 0, p->p_types.nprim,
    GFP_KERNEL | __GFP_ZERO);
    if (rc)
    goto bad;
    diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
    index 8ff0223..24a3acb 100644
    --- a/sound/pci/hda/patch_realtek.c
    +++ b/sound/pci/hda/patch_realtek.c
    @@ -1774,11 +1774,11 @@ static void alc_apply_fixup(struct hda_codec *codec, int action)
    codec->chip_name, fix->type);
    break;
    }
    - if (!fix[id].chained)
    + if (!fix->chained)
    break;
    if (++depth > 10)
    break;
    - id = fix[id].chain_id;
    + id = fix->chain_id;
    }
    }

    @@ -9932,6 +9932,7 @@ static struct snd_pci_quirk alc882_cfg_tbl[] = {
    SND_PCI_QUIRK(0x1071, 0x8258, "Evesham Voyaeger", ALC883_LAPTOP_EAPD),
    SND_PCI_QUIRK(0x10f1, 0x2350, "TYAN-S2350", ALC888_6ST_DELL),
    SND_PCI_QUIRK(0x108e, 0x534d, NULL, ALC883_3ST_6ch),
    + SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte P35 DS3R", ALC882_6ST_DIG),

    SND_PCI_QUIRK(0x1462, 0x0349, "MSI", ALC883_TARGA_2ch_DIG),
    SND_PCI_QUIRK(0x1462, 0x040d, "MSI", ALC883_TARGA_2ch_DIG),
    @@ -10768,7 +10769,6 @@ enum {
    PINFIX_LENOVO_Y530,
    PINFIX_PB_M5210,
    PINFIX_ACER_ASPIRE_7736,
    - PINFIX_GIGABYTE_880GM,
    };

    static const struct alc_fixup alc882_fixups[] = {
    @@ -10800,13 +10800,6 @@ static const struct alc_fixup alc882_fixups[] = {
    .type = ALC_FIXUP_SKU,
    .v.sku = ALC_FIXUP_SKU_IGNORE,
    },
    - [PINFIX_GIGABYTE_880GM] = {
    - .type = ALC_FIXUP_PINS,
    - .v.pins = (const struct alc_pincfg[]) {
    - { 0x14, 0x1114410 }, /* set as speaker */
    - { }
    - }
    - },
    };

    static struct snd_pci_quirk alc882_fixup_tbl[] = {
    @@ -10814,7 +10807,6 @@ static struct snd_pci_quirk alc882_fixup_tbl[] = {
    SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Y530", PINFIX_LENOVO_Y530),
    SND_PCI_QUIRK(0x147b, 0x107a, "Abit AW9D-MAX", PINFIX_ABIT_AW9D_MAX),
    SND_PCI_QUIRK(0x1025, 0x0296, "Acer Aspire 7736z", PINFIX_ACER_ASPIRE_7736),
    - SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte", PINFIX_GIGABYTE_880GM),
    {}
    };

    @@ -18882,6 +18874,8 @@ static struct snd_pci_quirk alc662_cfg_tbl[] = {
    ALC662_3ST_6ch_DIG),
    SND_PCI_QUIRK(0x1179, 0xff6e, "Toshiba NB20x", ALC662_AUTO),
    SND_PCI_QUIRK(0x144d, 0xca00, "Samsung NC10", ALC272_SAMSUNG_NC10),
    + SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte 945GCM-S2L",
    + ALC662_3ST_6ch_DIG),
    SND_PCI_QUIRK(0x152d, 0x2304, "Quanta WH1", ALC663_ASUS_H13),
    SND_PCI_QUIRK(0x1565, 0x820f, "Biostar TA780G M2+", ALC662_3ST_6ch_DIG),
    SND_PCI_QUIRK(0x1631, 0xc10c, "PB RS65", ALC663_ASUS_M51VA),
    @@ -19555,7 +19549,7 @@ enum {
    ALC662_FIXUP_IDEAPAD,
    ALC272_FIXUP_MARIO,
    ALC662_FIXUP_CZC_P10T,
    - ALC662_FIXUP_GIGABYTE,
    + ALC662_FIXUP_SKU_IGNORE,
    };

    static const struct alc_fixup alc662_fixups[] = {
    @@ -19584,20 +19578,17 @@ static const struct alc_fixup alc662_fixups[] = {
    {}
    }
    },
    - [ALC662_FIXUP_GIGABYTE] = {
    - .type = ALC_FIXUP_PINS,
    - .v.pins = (const struct alc_pincfg[]) {
    - { 0x14, 0x1114410 }, /* set as speaker */
    - { }
    - }
    + [ALC662_FIXUP_SKU_IGNORE] = {
    + .type = ALC_FIXUP_SKU,
    + .v.sku = ALC_FIXUP_SKU_IGNORE,
    },
    };

    static struct snd_pci_quirk alc662_fixup_tbl[] = {
    SND_PCI_QUIRK(0x1025, 0x0308, "Acer Aspire 8942G", ALC662_FIXUP_ASPIRE),
    + SND_PCI_QUIRK(0x1025, 0x031c, "Gateway NV79", ALC662_FIXUP_SKU_IGNORE),
    SND_PCI_QUIRK(0x1025, 0x038b, "Acer Aspire 8943G", ALC662_FIXUP_ASPIRE),
    SND_PCI_QUIRK(0x144d, 0xc051, "Samsung R720", ALC662_FIXUP_IDEAPAD),
    - SND_PCI_QUIRK(0x1458, 0xa002, "Gigabyte", ALC662_FIXUP_GIGABYTE),
    SND_PCI_QUIRK(0x17aa, 0x38af, "Lenovo Ideapad Y550P", ALC662_FIXUP_IDEAPAD),
    SND_PCI_QUIRK(0x17aa, 0x3a0d, "Lenovo Ideapad Y550", ALC662_FIXUP_IDEAPAD),
    SND_PCI_QUIRK(0x1b35, 0x2206, "CZC P10T", ALC662_FIXUP_CZC_P10T),

    \
     
     \ /
      Last update: 2011-05-10 00:29    [W:0.121 / U:0.180 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site