diff options
| -rw-r--r-- | 2.6.32/0000_README | 2 | ||||
| -rw-r--r-- | 2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201210310820.patch (renamed from 2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201210291444.patch) | 6 | ||||
| -rw-r--r-- | 3.2.33/0000_README (renamed from 3.2.32/0000_README) | 6 | ||||
| -rw-r--r-- | 3.2.33/1021_linux-3.2.22.patch (renamed from 3.2.32/1021_linux-3.2.22.patch) | 0 | ||||
| -rw-r--r-- | 3.2.33/1022_linux-3.2.23.patch (renamed from 3.2.32/1022_linux-3.2.23.patch) | 0 | ||||
| -rw-r--r-- | 3.2.33/1023_linux-3.2.24.patch (renamed from 3.2.32/1023_linux-3.2.24.patch) | 0 | ||||
| -rw-r--r-- | 3.2.33/1024_linux-3.2.25.patch (renamed from 3.2.32/1024_linux-3.2.25.patch) | 0 | ||||
| -rw-r--r-- | 3.2.33/1025_linux-3.2.26.patch (renamed from 3.2.32/1025_linux-3.2.26.patch) | 0 | ||||
| -rw-r--r-- | 3.2.33/1026_linux-3.2.27.patch (renamed from 3.2.32/1026_linux-3.2.27.patch) | 0 | ||||
| -rw-r--r-- | 3.2.33/1027_linux-3.2.28.patch (renamed from 3.2.32/1027_linux-3.2.28.patch) | 0 | ||||
| -rw-r--r-- | 3.2.33/1028_linux-3.2.29.patch (renamed from 3.2.32/1028_linux-3.2.29.patch) | 0 | ||||
| -rw-r--r-- | 3.2.33/1029_linux-3.2.30.patch (renamed from 3.2.32/1029_linux-3.2.30.patch) | 0 | ||||
| -rw-r--r-- | 3.2.33/1030_linux-3.2.31.patch (renamed from 3.2.32/1030_linux-3.2.31.patch) | 0 | ||||
| -rw-r--r-- | 3.2.33/1031_linux-3.2.32.patch (renamed from 3.2.32/1031_linux-3.2.32.patch) | 0 | ||||
| -rw-r--r-- | 3.2.33/1032_linux-3.2.33.patch | 3450 | ||||
| -rw-r--r-- | 3.2.33/4420_grsecurity-2.9.1-3.2.33-201210310843.patch (renamed from 3.2.32/4420_grsecurity-2.9.1-3.2.32-201210291445.patch) | 260 | ||||
| -rw-r--r-- | 3.2.33/4430_grsec-remove-localversion-grsec.patch (renamed from 3.2.32/4430_grsec-remove-localversion-grsec.patch) | 0 | ||||
| -rw-r--r-- | 3.2.33/4435_grsec-mute-warnings.patch (renamed from 3.2.32/4435_grsec-mute-warnings.patch) | 0 | ||||
| -rw-r--r-- | 3.2.33/4440_grsec-remove-protected-paths.patch (renamed from 3.2.32/4440_grsec-remove-protected-paths.patch) | 0 | ||||
| -rw-r--r-- | 3.2.33/4450_grsec-kconfig-default-gids.patch (renamed from 3.2.32/4450_grsec-kconfig-default-gids.patch) | 0 | ||||
| -rw-r--r-- | 3.2.33/4465_selinux-avc_audit-log-curr_ip.patch (renamed from 3.2.32/4465_selinux-avc_audit-log-curr_ip.patch) | 0 | ||||
| -rw-r--r-- | 3.2.33/4470_disable-compat_vdso.patch (renamed from 3.2.32/4470_disable-compat_vdso.patch) | 0 | ||||
| -rw-r--r-- | 3.6.5/0000_README (renamed from 3.6.4/0000_README) | 6 | ||||
| -rw-r--r-- | 3.6.5/1004_linux-3.6.5.patch | 4649 | ||||
| -rw-r--r-- | 3.6.5/4420_grsecurity-2.9.1-3.6.5-201210312121.patch (renamed from 3.6.4/4420_grsecurity-2.9.1-3.6.4-201210291446.patch) | 188 | ||||
| -rw-r--r-- | 3.6.5/4430_grsec-remove-localversion-grsec.patch (renamed from 3.6.4/4430_grsec-remove-localversion-grsec.patch) | 0 | ||||
| -rw-r--r-- | 3.6.5/4435_grsec-mute-warnings.patch (renamed from 3.6.4/4435_grsec-mute-warnings.patch) | 0 | ||||
| -rw-r--r-- | 3.6.5/4440_grsec-remove-protected-paths.patch (renamed from 3.6.4/4440_grsec-remove-protected-paths.patch) | 0 | ||||
| -rw-r--r-- | 3.6.5/4450_grsec-kconfig-default-gids.patch (renamed from 3.6.4/4450_grsec-kconfig-default-gids.patch) | 0 | ||||
| -rw-r--r-- | 3.6.5/4465_selinux-avc_audit-log-curr_ip.patch (renamed from 3.6.4/4465_selinux-avc_audit-log-curr_ip.patch) | 0 | ||||
| -rw-r--r-- | 3.6.5/4470_disable-compat_vdso.patch (renamed from 3.6.4/4470_disable-compat_vdso.patch) | 0 |
31 files changed, 8285 insertions, 282 deletions
diff --git a/2.6.32/0000_README b/2.6.32/0000_README index 288d745..77cac16 100644 --- a/2.6.32/0000_README +++ b/2.6.32/0000_README @@ -34,7 +34,7 @@ Patch: 1059_linux-2.6.32.60.patch From: http://www.kernel.org Desc: Linux 2.6.32.59 -Patch: 4420_grsecurity-2.9.1-2.6.32.60-201210291444.patch +Patch: 4420_grsecurity-2.9.1-2.6.32.60-201210310820.patch From: http://www.grsecurity.net Desc: hardened-sources base patch from upstream grsecurity diff --git a/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201210291444.patch b/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201210310820.patch index 489cffc..04f2458 100644 --- a/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201210291444.patch +++ b/2.6.32/4420_grsecurity-2.9.1-2.6.32.60-201210310820.patch @@ -103771,7 +103771,7 @@ index 5c9dc22..d271117 100644 .clock_get = thread_cpu_clock_get, .clock_set = do_posix_clock_nosettime, diff --git a/kernel/posix-timers.c b/kernel/posix-timers.c -index 5e76d22..cf1baeb 100644 +index 5e76d22..f2d062c 100644 --- a/kernel/posix-timers.c +++ b/kernel/posix-timers.c @@ -42,6 +42,7 @@ @@ -103817,10 +103817,10 @@ index 5e76d22..cf1baeb 100644 return 1; - if (posix_clocks[which_clock].clock_getres != NULL) + if (posix_clocks[which_clock] == NULL) ++ return 1; ++ if (posix_clocks[which_clock]->clock_getres != NULL) return 0; - if (posix_clocks[which_clock].res != 0) -+ if (posix_clocks[which_clock]->clock_getres != NULL) -+ return 0; + if (posix_clocks[which_clock]->res != 0) return 0; return 1; diff --git a/3.2.32/0000_README b/3.2.33/0000_README index 037da24..245166a 100644 --- a/3.2.32/0000_README +++ b/3.2.33/0000_README @@ -46,7 +46,11 @@ Patch: 1031_linux-3.2.32.patch From: http://www.kernel.org Desc: Linux 3.2.32 -Patch: 4420_grsecurity-2.9.1-3.2.32-201210291445.patch +Patch: 1032_linux-3.2.33.patch +From: http://www.kernel.org +Desc: Linux 3.2.33 + +Patch: 4420_grsecurity-2.9.1-3.2.33-201210310843.patch From: http://www.grsecurity.net Desc: hardened-sources base patch from upstream grsecurity diff --git a/3.2.32/1021_linux-3.2.22.patch b/3.2.33/1021_linux-3.2.22.patch index e6ad93a..e6ad93a 100644 --- a/3.2.32/1021_linux-3.2.22.patch +++ b/3.2.33/1021_linux-3.2.22.patch diff --git a/3.2.32/1022_linux-3.2.23.patch b/3.2.33/1022_linux-3.2.23.patch index 3d796d0..3d796d0 100644 --- a/3.2.32/1022_linux-3.2.23.patch +++ b/3.2.33/1022_linux-3.2.23.patch diff --git a/3.2.32/1023_linux-3.2.24.patch b/3.2.33/1023_linux-3.2.24.patch index 4692eb4..4692eb4 100644 --- a/3.2.32/1023_linux-3.2.24.patch +++ b/3.2.33/1023_linux-3.2.24.patch diff --git a/3.2.32/1024_linux-3.2.25.patch b/3.2.33/1024_linux-3.2.25.patch index e95c213..e95c213 100644 --- a/3.2.32/1024_linux-3.2.25.patch +++ b/3.2.33/1024_linux-3.2.25.patch diff --git a/3.2.32/1025_linux-3.2.26.patch b/3.2.33/1025_linux-3.2.26.patch index 44065b9..44065b9 100644 --- a/3.2.32/1025_linux-3.2.26.patch +++ b/3.2.33/1025_linux-3.2.26.patch diff --git a/3.2.32/1026_linux-3.2.27.patch b/3.2.33/1026_linux-3.2.27.patch index 5878eb4..5878eb4 100644 --- a/3.2.32/1026_linux-3.2.27.patch +++ b/3.2.33/1026_linux-3.2.27.patch diff --git a/3.2.32/1027_linux-3.2.28.patch b/3.2.33/1027_linux-3.2.28.patch index 4dbba4b..4dbba4b 100644 --- a/3.2.32/1027_linux-3.2.28.patch +++ b/3.2.33/1027_linux-3.2.28.patch diff --git a/3.2.32/1028_linux-3.2.29.patch b/3.2.33/1028_linux-3.2.29.patch index 3c65179..3c65179 100644 --- a/3.2.32/1028_linux-3.2.29.patch +++ b/3.2.33/1028_linux-3.2.29.patch diff --git a/3.2.32/1029_linux-3.2.30.patch b/3.2.33/1029_linux-3.2.30.patch index 86aea4b..86aea4b 100644 --- a/3.2.32/1029_linux-3.2.30.patch +++ b/3.2.33/1029_linux-3.2.30.patch diff --git a/3.2.32/1030_linux-3.2.31.patch b/3.2.33/1030_linux-3.2.31.patch index c6accf5..c6accf5 100644 --- a/3.2.32/1030_linux-3.2.31.patch +++ b/3.2.33/1030_linux-3.2.31.patch diff --git a/3.2.32/1031_linux-3.2.32.patch b/3.2.33/1031_linux-3.2.32.patch index 247fc0b..247fc0b 100644 --- a/3.2.32/1031_linux-3.2.32.patch +++ b/3.2.33/1031_linux-3.2.32.patch diff --git a/3.2.33/1032_linux-3.2.33.patch b/3.2.33/1032_linux-3.2.33.patch new file mode 100644 index 0000000..c32fb75 --- /dev/null +++ b/3.2.33/1032_linux-3.2.33.patch @@ -0,0 +1,3450 @@ +diff --git a/Makefile b/Makefile +index b6d8282..63ca1ea2 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 2 +-SUBLEVEL = 32 ++SUBLEVEL = 33 + EXTRAVERSION = + NAME = Saber-toothed Squirrel + +diff --git a/arch/arm/include/asm/vfpmacros.h b/arch/arm/include/asm/vfpmacros.h +index 3d5fc41..bf53047 100644 +--- a/arch/arm/include/asm/vfpmacros.h ++++ b/arch/arm/include/asm/vfpmacros.h +@@ -28,7 +28,7 @@ + ldr \tmp, =elf_hwcap @ may not have MVFR regs + ldr \tmp, [\tmp, #0] + tst \tmp, #HWCAP_VFPv3D16 +- ldceq p11, cr0, [\base],#32*4 @ FLDMIAD \base!, {d16-d31} ++ ldceql p11, cr0, [\base],#32*4 @ FLDMIAD \base!, {d16-d31} + addne \base, \base, #32*4 @ step over unused register space + #else + VFPFMRX \tmp, MVFR0 @ Media and VFP Feature Register 0 +@@ -52,7 +52,7 @@ + ldr \tmp, =elf_hwcap @ may not have MVFR regs + ldr \tmp, [\tmp, #0] + tst \tmp, #HWCAP_VFPv3D16 +- stceq p11, cr0, [\base],#32*4 @ FSTMIAD \base!, {d16-d31} ++ stceql p11, cr0, [\base],#32*4 @ FSTMIAD \base!, {d16-d31} + addne \base, \base, #32*4 @ step over unused register space + #else + VFPFMRX \tmp, MVFR0 @ Media and VFP Feature Register 0 +diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c +index 1d1710e..bfa0eeb 100644 +--- a/arch/arm/kernel/smp.c ++++ b/arch/arm/kernel/smp.c +@@ -295,18 +295,24 @@ static void __cpuinit smp_store_cpu_info(unsigned int cpuid) + asmlinkage void __cpuinit secondary_start_kernel(void) + { + struct mm_struct *mm = &init_mm; +- unsigned int cpu = smp_processor_id(); ++ unsigned int cpu; ++ ++ /* ++ * The identity mapping is uncached (strongly ordered), so ++ * switch away from it before attempting any exclusive accesses. ++ */ ++ cpu_switch_mm(mm->pgd, mm); ++ enter_lazy_tlb(mm, current); ++ local_flush_tlb_all(); + + /* + * All kernel threads share the same mm context; grab a + * reference and switch to it. + */ ++ cpu = smp_processor_id(); + atomic_inc(&mm->mm_count); + current->active_mm = mm; + cpumask_set_cpu(cpu, mm_cpumask(mm)); +- cpu_switch_mm(mm->pgd, mm); +- enter_lazy_tlb(mm, current); +- local_flush_tlb_all(); + + printk("CPU%u: Booted secondary processor\n", cpu); + +diff --git a/arch/mips/kernel/kgdb.c b/arch/mips/kernel/kgdb.c +index f4546e9..23817a6 100644 +--- a/arch/mips/kernel/kgdb.c ++++ b/arch/mips/kernel/kgdb.c +@@ -283,6 +283,15 @@ static int kgdb_mips_notify(struct notifier_block *self, unsigned long cmd, + struct pt_regs *regs = args->regs; + int trap = (regs->cp0_cause & 0x7c) >> 2; + ++#ifdef CONFIG_KPROBES ++ /* ++ * Return immediately if the kprobes fault notifier has set ++ * DIE_PAGE_FAULT. ++ */ ++ if (cmd == DIE_PAGE_FAULT) ++ return NOTIFY_DONE; ++#endif /* CONFIG_KPROBES */ ++ + /* Userspace events, ignore. */ + if (user_mode(regs)) + return NOTIFY_DONE; +diff --git a/arch/s390/boot/compressed/vmlinux.lds.S b/arch/s390/boot/compressed/vmlinux.lds.S +index d80f79d..8e1fb82 100644 +--- a/arch/s390/boot/compressed/vmlinux.lds.S ++++ b/arch/s390/boot/compressed/vmlinux.lds.S +@@ -5,7 +5,7 @@ OUTPUT_FORMAT("elf64-s390", "elf64-s390", "elf64-s390") + OUTPUT_ARCH(s390:64-bit) + #else + OUTPUT_FORMAT("elf32-s390", "elf32-s390", "elf32-s390") +-OUTPUT_ARCH(s390) ++OUTPUT_ARCH(s390:31-bit) + #endif + + ENTRY(startup) +diff --git a/arch/s390/kernel/vmlinux.lds.S b/arch/s390/kernel/vmlinux.lds.S +index e4c79eb..e43d21e 100644 +--- a/arch/s390/kernel/vmlinux.lds.S ++++ b/arch/s390/kernel/vmlinux.lds.S +@@ -8,7 +8,7 @@ + + #ifndef CONFIG_64BIT + OUTPUT_FORMAT("elf32-s390", "elf32-s390", "elf32-s390") +-OUTPUT_ARCH(s390) ++OUTPUT_ARCH(s390:31-bit) + ENTRY(_start) + jiffies = jiffies_64 + 4; + #else +diff --git a/arch/sparc/kernel/perf_event.c b/arch/sparc/kernel/perf_event.c +index 614da62..3c8f220 100644 +--- a/arch/sparc/kernel/perf_event.c ++++ b/arch/sparc/kernel/perf_event.c +@@ -555,11 +555,13 @@ static u64 nop_for_index(int idx) + + static inline void sparc_pmu_enable_event(struct cpu_hw_events *cpuc, struct hw_perf_event *hwc, int idx) + { +- u64 val, mask = mask_for_index(idx); ++ u64 enc, val, mask = mask_for_index(idx); ++ ++ enc = perf_event_get_enc(cpuc->events[idx]); + + val = cpuc->pcr; + val &= ~mask; +- val |= hwc->config; ++ val |= event_encoding(enc, idx); + cpuc->pcr = val; + + pcr_ops->write(cpuc->pcr); +@@ -1422,8 +1424,6 @@ static void perf_callchain_user_64(struct perf_callchain_entry *entry, + { + unsigned long ufp; + +- perf_callchain_store(entry, regs->tpc); +- + ufp = regs->u_regs[UREG_I6] + STACK_BIAS; + do { + struct sparc_stackf *usf, sf; +@@ -1444,8 +1444,6 @@ static void perf_callchain_user_32(struct perf_callchain_entry *entry, + { + unsigned long ufp; + +- perf_callchain_store(entry, regs->tpc); +- + ufp = regs->u_regs[UREG_I6] & 0xffffffffUL; + do { + struct sparc_stackf32 *usf, sf; +@@ -1464,6 +1462,11 @@ static void perf_callchain_user_32(struct perf_callchain_entry *entry, + void + perf_callchain_user(struct perf_callchain_entry *entry, struct pt_regs *regs) + { ++ perf_callchain_store(entry, regs->tpc); ++ ++ if (!current->mm) ++ return; ++ + flushw_user(); + if (test_thread_flag(TIF_32BIT)) + perf_callchain_user_32(entry, regs); +diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c +index 441521a..5e4252b 100644 +--- a/arch/sparc/kernel/sys_sparc_64.c ++++ b/arch/sparc/kernel/sys_sparc_64.c +@@ -519,12 +519,12 @@ SYSCALL_DEFINE1(sparc64_personality, unsigned long, personality) + { + int ret; + +- if (current->personality == PER_LINUX32 && +- personality == PER_LINUX) +- personality = PER_LINUX32; ++ if (personality(current->personality) == PER_LINUX32 && ++ personality(personality) == PER_LINUX) ++ personality |= PER_LINUX32; + ret = sys_personality(personality); +- if (ret == PER_LINUX32) +- ret = PER_LINUX; ++ if (personality(ret) == PER_LINUX32) ++ ret &= ~PER_LINUX32; + + return ret; + } +diff --git a/arch/sparc/kernel/syscalls.S b/arch/sparc/kernel/syscalls.S +index 1d7e274..7f5f65d 100644 +--- a/arch/sparc/kernel/syscalls.S ++++ b/arch/sparc/kernel/syscalls.S +@@ -212,24 +212,20 @@ linux_sparc_syscall: + 3: stx %o0, [%sp + PTREGS_OFF + PT_V9_I0] + ret_sys_call: + ldx [%sp + PTREGS_OFF + PT_V9_TSTATE], %g3 +- ldx [%sp + PTREGS_OFF + PT_V9_TNPC], %l1 ! pc = npc + sra %o0, 0, %o0 + mov %ulo(TSTATE_XCARRY | TSTATE_ICARRY), %g2 + sllx %g2, 32, %g2 + +- /* Check if force_successful_syscall_return() +- * was invoked. +- */ +- ldub [%g6 + TI_SYS_NOERROR], %l2 +- brnz,a,pn %l2, 80f +- stb %g0, [%g6 + TI_SYS_NOERROR] +- + cmp %o0, -ERESTART_RESTARTBLOCK + bgeu,pn %xcc, 1f +- andcc %l0, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT|_TIF_SYSCALL_TRACEPOINT), %l6 +-80: ++ andcc %l0, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT|_TIF_SYSCALL_TRACEPOINT), %g0 ++ ldx [%sp + PTREGS_OFF + PT_V9_TNPC], %l1 ! pc = npc ++ ++2: ++ stb %g0, [%g6 + TI_SYS_NOERROR] + /* System call success, clear Carry condition code. */ + andn %g3, %g2, %g3 ++3: + stx %g3, [%sp + PTREGS_OFF + PT_V9_TSTATE] + bne,pn %icc, linux_syscall_trace2 + add %l1, 0x4, %l2 ! npc = npc+4 +@@ -238,20 +234,20 @@ ret_sys_call: + stx %l2, [%sp + PTREGS_OFF + PT_V9_TNPC] + + 1: ++ /* Check if force_successful_syscall_return() ++ * was invoked. ++ */ ++ ldub [%g6 + TI_SYS_NOERROR], %l2 ++ brnz,pn %l2, 2b ++ ldx [%sp + PTREGS_OFF + PT_V9_TNPC], %l1 ! pc = npc + /* System call failure, set Carry condition code. + * Also, get abs(errno) to return to the process. + */ +- andcc %l0, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT|_TIF_SYSCALL_TRACEPOINT), %l6 + sub %g0, %o0, %o0 +- or %g3, %g2, %g3 + stx %o0, [%sp + PTREGS_OFF + PT_V9_I0] +- stx %g3, [%sp + PTREGS_OFF + PT_V9_TSTATE] +- bne,pn %icc, linux_syscall_trace2 +- add %l1, 0x4, %l2 ! npc = npc+4 +- stx %l1, [%sp + PTREGS_OFF + PT_V9_TPC] ++ ba,pt %xcc, 3b ++ or %g3, %g2, %g3 + +- b,pt %xcc, rtrap +- stx %l2, [%sp + PTREGS_OFF + PT_V9_TNPC] + linux_syscall_trace2: + call syscall_trace_leave + add %sp, PTREGS_OFF, %o0 +diff --git a/arch/sparc/mm/init_64.c b/arch/sparc/mm/init_64.c +index 8e073d8..6ff4d78 100644 +--- a/arch/sparc/mm/init_64.c ++++ b/arch/sparc/mm/init_64.c +@@ -2118,6 +2118,9 @@ EXPORT_SYMBOL(_PAGE_CACHE); + #ifdef CONFIG_SPARSEMEM_VMEMMAP + unsigned long vmemmap_table[VMEMMAP_SIZE]; + ++static long __meminitdata addr_start, addr_end; ++static int __meminitdata node_start; ++ + int __meminit vmemmap_populate(struct page *start, unsigned long nr, int node) + { + unsigned long vstart = (unsigned long) start; +@@ -2148,15 +2151,30 @@ int __meminit vmemmap_populate(struct page *start, unsigned long nr, int node) + + *vmem_pp = pte_base | __pa(block); + +- printk(KERN_INFO "[%p-%p] page_structs=%lu " +- "node=%d entry=%lu/%lu\n", start, block, nr, +- node, +- addr >> VMEMMAP_CHUNK_SHIFT, +- VMEMMAP_SIZE); ++ /* check to see if we have contiguous blocks */ ++ if (addr_end != addr || node_start != node) { ++ if (addr_start) ++ printk(KERN_DEBUG " [%lx-%lx] on node %d\n", ++ addr_start, addr_end-1, node_start); ++ addr_start = addr; ++ node_start = node; ++ } ++ addr_end = addr + VMEMMAP_CHUNK; + } + } + return 0; + } ++ ++void __meminit vmemmap_populate_print_last(void) ++{ ++ if (addr_start) { ++ printk(KERN_DEBUG " [%lx-%lx] on node %d\n", ++ addr_start, addr_end-1, node_start); ++ addr_start = 0; ++ addr_end = 0; ++ node_start = 0; ++ } ++} + #endif /* CONFIG_SPARSEMEM_VMEMMAP */ + + static void prot_init_common(unsigned long page_none, +diff --git a/arch/tile/Makefile b/arch/tile/Makefile +index 17acce7..04c637c 100644 +--- a/arch/tile/Makefile ++++ b/arch/tile/Makefile +@@ -26,6 +26,10 @@ $(error Set TILERA_ROOT or CROSS_COMPILE when building $(ARCH) on $(HOST_ARCH)) + endif + endif + ++# The tile compiler may emit .eh_frame information for backtracing. ++# In kernel modules, this causes load failures due to unsupported relocations. ++KBUILD_CFLAGS += -fno-asynchronous-unwind-tables ++ + ifneq ($(CONFIG_DEBUG_EXTRA_FLAGS),"") + KBUILD_CFLAGS += $(CONFIG_DEBUG_EXTRA_FLAGS) + endif +diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S +index bcda816..4893d58 100644 +--- a/arch/x86/kernel/entry_32.S ++++ b/arch/x86/kernel/entry_32.S +@@ -1025,7 +1025,7 @@ ENTRY(xen_sysenter_target) + + ENTRY(xen_hypervisor_callback) + CFI_STARTPROC +- pushl_cfi $0 ++ pushl_cfi $-1 /* orig_ax = -1 => not a system call */ + SAVE_ALL + TRACE_IRQS_OFF + +@@ -1067,14 +1067,16 @@ ENTRY(xen_failsafe_callback) + 2: mov 8(%esp),%es + 3: mov 12(%esp),%fs + 4: mov 16(%esp),%gs ++ /* EAX == 0 => Category 1 (Bad segment) ++ EAX != 0 => Category 2 (Bad IRET) */ + testl %eax,%eax + popl_cfi %eax + lea 16(%esp),%esp + CFI_ADJUST_CFA_OFFSET -16 + jz 5f + addl $16,%esp +- jmp iret_exc # EAX != 0 => Category 2 (Bad IRET) +-5: pushl_cfi $0 # EAX == 0 => Category 1 (Bad segment) ++ jmp iret_exc ++5: pushl_cfi $-1 /* orig_ax = -1 => not a system call */ + SAVE_ALL + jmp ret_from_exception + CFI_ENDPROC +diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S +index faf8d5e..6274f5f 100644 +--- a/arch/x86/kernel/entry_64.S ++++ b/arch/x86/kernel/entry_64.S +@@ -1303,7 +1303,7 @@ ENTRY(xen_failsafe_callback) + CFI_RESTORE r11 + addq $0x30,%rsp + CFI_ADJUST_CFA_OFFSET -0x30 +- pushq_cfi $0 ++ pushq_cfi $-1 /* orig_ax = -1 => not a system call */ + SAVE_ALL + jmp error_exit + CFI_ENDPROC +diff --git a/arch/x86/oprofile/nmi_int.c b/arch/x86/oprofile/nmi_int.c +index 75f9528..6bc0899 100644 +--- a/arch/x86/oprofile/nmi_int.c ++++ b/arch/x86/oprofile/nmi_int.c +@@ -55,7 +55,7 @@ u64 op_x86_get_ctrl(struct op_x86_model_spec const *model, + val |= counter_config->extra; + event &= model->event_mask ? model->event_mask : 0xFF; + val |= event & 0xFF; +- val |= (event & 0x0F00) << 24; ++ val |= (u64)(event & 0x0F00) << 24; + + return val; + } +diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c +index a1e21ae..69b9ef6 100644 +--- a/arch/x86/xen/enlighten.c ++++ b/arch/x86/xen/enlighten.c +@@ -818,7 +818,16 @@ static void xen_write_cr4(unsigned long cr4) + + native_write_cr4(cr4); + } +- ++#ifdef CONFIG_X86_64 ++static inline unsigned long xen_read_cr8(void) ++{ ++ return 0; ++} ++static inline void xen_write_cr8(unsigned long val) ++{ ++ BUG_ON(val); ++} ++#endif + static int xen_write_msr_safe(unsigned int msr, unsigned low, unsigned high) + { + int ret; +@@ -987,6 +996,11 @@ static const struct pv_cpu_ops xen_cpu_ops __initconst = { + .read_cr4_safe = native_read_cr4_safe, + .write_cr4 = xen_write_cr4, + ++#ifdef CONFIG_X86_64 ++ .read_cr8 = xen_read_cr8, ++ .write_cr8 = xen_write_cr8, ++#endif ++ + .wbinvd = native_wbinvd, + + .read_msr = native_read_msr_safe, +@@ -997,6 +1011,8 @@ static const struct pv_cpu_ops xen_cpu_ops __initconst = { + .read_tsc = native_read_tsc, + .read_pmc = native_read_pmc, + ++ .read_tscp = native_read_tscp, ++ + .iret = xen_iret, + .irq_enable_sysexit = xen_sysexit, + #ifdef CONFIG_X86_64 +diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c +index b19a18d..d2519b2 100644 +--- a/drivers/acpi/ec.c ++++ b/drivers/acpi/ec.c +@@ -71,9 +71,6 @@ enum ec_command { + #define ACPI_EC_UDELAY_GLK 1000 /* Wait 1ms max. to get global lock */ + #define ACPI_EC_MSI_UDELAY 550 /* Wait 550us for MSI EC */ + +-#define ACPI_EC_STORM_THRESHOLD 8 /* number of false interrupts +- per one transaction */ +- + enum { + EC_FLAGS_QUERY_PENDING, /* Query is pending */ + EC_FLAGS_GPE_STORM, /* GPE storm detected */ +@@ -87,6 +84,15 @@ static unsigned int ec_delay __read_mostly = ACPI_EC_DELAY; + module_param(ec_delay, uint, 0644); + MODULE_PARM_DESC(ec_delay, "Timeout(ms) waited until an EC command completes"); + ++/* ++ * If the number of false interrupts per one transaction exceeds ++ * this threshold, will think there is a GPE storm happened and ++ * will disable the GPE for normal transaction. ++ */ ++static unsigned int ec_storm_threshold __read_mostly = 8; ++module_param(ec_storm_threshold, uint, 0644); ++MODULE_PARM_DESC(ec_storm_threshold, "Maxim false GPE numbers not considered as GPE storm"); ++ + /* If we find an EC via the ECDT, we need to keep a ptr to its context */ + /* External interfaces use first EC only, so remember */ + typedef int (*acpi_ec_query_func) (void *data); +@@ -319,7 +325,7 @@ static int acpi_ec_transaction(struct acpi_ec *ec, struct transaction *t) + msleep(1); + /* It is safe to enable the GPE outside of the transaction. */ + acpi_enable_gpe(NULL, ec->gpe); +- } else if (t->irq_count > ACPI_EC_STORM_THRESHOLD) { ++ } else if (t->irq_count > ec_storm_threshold) { + pr_info(PREFIX "GPE storm detected, " + "transactions will use polling mode\n"); + set_bit(EC_FLAGS_GPE_STORM, &ec->flags); +@@ -914,6 +920,17 @@ static int ec_flag_msi(const struct dmi_system_id *id) + return 0; + } + ++/* ++ * Clevo M720 notebook actually works ok with IRQ mode, if we lifted ++ * the GPE storm threshold back to 20 ++ */ ++static int ec_enlarge_storm_threshold(const struct dmi_system_id *id) ++{ ++ pr_debug("Setting the EC GPE storm threshold to 20\n"); ++ ec_storm_threshold = 20; ++ return 0; ++} ++ + static struct dmi_system_id __initdata ec_dmi_table[] = { + { + ec_skip_dsdt_scan, "Compal JFL92", { +@@ -945,10 +962,13 @@ static struct dmi_system_id __initdata ec_dmi_table[] = { + { + ec_validate_ecdt, "ASUS hardware", { + DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer Inc.") }, NULL}, ++ { ++ ec_enlarge_storm_threshold, "CLEVO hardware", { ++ DMI_MATCH(DMI_SYS_VENDOR, "CLEVO Co."), ++ DMI_MATCH(DMI_PRODUCT_NAME, "M720T/M730T"),}, NULL}, + {}, + }; + +- + int __init acpi_ec_ecdt_probe(void) + { + acpi_status status; +diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c +index 10f92b3..7a987a7 100644 +--- a/drivers/bcma/main.c ++++ b/drivers/bcma/main.c +@@ -124,9 +124,10 @@ static int bcma_register_cores(struct bcma_bus *bus) + + static void bcma_unregister_cores(struct bcma_bus *bus) + { +- struct bcma_device *core; ++ struct bcma_device *core, *tmp; + +- list_for_each_entry(core, &bus->cores, list) { ++ list_for_each_entry_safe(core, tmp, &bus->cores, list) { ++ list_del(&core->list); + if (core->dev_registered) + device_unregister(&core->dev); + } +diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c +index b366b34..0d91655 100644 +--- a/drivers/char/tpm/tpm.c ++++ b/drivers/char/tpm/tpm.c +@@ -1072,17 +1072,20 @@ ssize_t tpm_write(struct file *file, const char __user *buf, + size_t size, loff_t *off) + { + struct tpm_chip *chip = file->private_data; +- size_t in_size = size, out_size; ++ size_t in_size = size; ++ ssize_t out_size; + + /* cannot perform a write until the read has cleared +- either via tpm_read or a user_read_timer timeout */ +- while (atomic_read(&chip->data_pending) != 0) +- msleep(TPM_TIMEOUT); +- +- mutex_lock(&chip->buffer_mutex); ++ either via tpm_read or a user_read_timer timeout. ++ This also prevents splitted buffered writes from blocking here. ++ */ ++ if (atomic_read(&chip->data_pending) != 0) ++ return -EBUSY; + + if (in_size > TPM_BUFSIZE) +- in_size = TPM_BUFSIZE; ++ return -E2BIG; ++ ++ mutex_lock(&chip->buffer_mutex); + + if (copy_from_user + (chip->data_buffer, (void __user *) buf, in_size)) { +@@ -1092,6 +1095,10 @@ ssize_t tpm_write(struct file *file, const char __user *buf, + + /* atomic tpm command send and result receive */ + out_size = tpm_transmit(chip, chip->data_buffer, TPM_BUFSIZE); ++ if (out_size < 0) { ++ mutex_unlock(&chip->buffer_mutex); ++ return out_size; ++ } + + atomic_set(&chip->data_pending, out_size); + mutex_unlock(&chip->buffer_mutex); +diff --git a/drivers/cpufreq/powernow-k8.c b/drivers/cpufreq/powernow-k8.c +index b7fe343..f6cd315 100644 +--- a/drivers/cpufreq/powernow-k8.c ++++ b/drivers/cpufreq/powernow-k8.c +@@ -1216,14 +1216,7 @@ static int powernowk8_target(struct cpufreq_policy *pol, + struct powernowk8_target_arg pta = { .pol = pol, .targfreq = targfreq, + .relation = relation }; + +- /* +- * Must run on @pol->cpu. cpufreq core is responsible for ensuring +- * that we're bound to the current CPU and pol->cpu stays online. +- */ +- if (smp_processor_id() == pol->cpu) +- return powernowk8_target_fn(&pta); +- else +- return work_on_cpu(pol->cpu, powernowk8_target_fn, &pta); ++ return work_on_cpu(pol->cpu, powernowk8_target_fn, &pta); + } + + /* Driver entry point to verify the policy and range of frequencies */ +diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c +index c9eee6d..a9d5482 100644 +--- a/drivers/edac/amd64_edac.c ++++ b/drivers/edac/amd64_edac.c +@@ -170,8 +170,11 @@ static int __amd64_set_scrub_rate(struct pci_dev *ctl, u32 new_bw, u32 min_rate) + * memory controller and apply to register. Search for the first + * bandwidth entry that is greater or equal than the setting requested + * and program that. If at last entry, turn off DRAM scrubbing. ++ * ++ * If no suitable bandwidth is found, turn off DRAM scrubbing entirely ++ * by falling back to the last element in scrubrates[]. + */ +- for (i = 0; i < ARRAY_SIZE(scrubrates); i++) { ++ for (i = 0; i < ARRAY_SIZE(scrubrates) - 1; i++) { + /* + * skip scrub rates which aren't recommended + * (see F10 BKDG, F3x58) +@@ -181,12 +184,6 @@ static int __amd64_set_scrub_rate(struct pci_dev *ctl, u32 new_bw, u32 min_rate) + + if (scrubrates[i].bandwidth <= new_bw) + break; +- +- /* +- * if no suitable bandwidth found, turn off DRAM scrubbing +- * entirely by falling back to the last element in the +- * scrubrates array. +- */ + } + + scrubval = scrubrates[i].scrubval; +diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c +index 33e1555..dbe4dbe 100644 +--- a/drivers/gpu/drm/i915/i915_gem.c ++++ b/drivers/gpu/drm/i915/i915_gem.c +@@ -999,6 +999,7 @@ i915_gem_pwrite_ioctl(struct drm_device *dev, void *data, + if (obj->phys_obj) + ret = i915_gem_phys_pwrite(dev, obj, args, file); + else if (obj->gtt_space && ++ obj->tiling_mode == I915_TILING_NONE && + obj->base.write_domain != I915_GEM_DOMAIN_CPU) { + ret = i915_gem_object_pin(obj, 0, true); + if (ret) +diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c +index f07bde2..57152a7 100644 +--- a/drivers/gpu/drm/i915/intel_lvds.c ++++ b/drivers/gpu/drm/i915/intel_lvds.c +@@ -771,6 +771,14 @@ static const struct dmi_system_id intel_no_lvds[] = { + DMI_MATCH(DMI_BOARD_NAME, "MS-7469"), + }, + }, ++ { ++ .callback = intel_no_lvds_dmi_callback, ++ .ident = "ZOTAC ZBOXSD-ID12/ID13", ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "ZOTAC"), ++ DMI_MATCH(DMI_BOARD_NAME, "ZBOXSD-ID12/ID13"), ++ }, ++ }, + + { } /* terminating entry */ + }; +diff --git a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c +index 2f46e0c..3ad3cc6 100644 +--- a/drivers/gpu/drm/radeon/radeon_legacy_encoders.c ++++ b/drivers/gpu/drm/radeon/radeon_legacy_encoders.c +@@ -973,11 +973,7 @@ static void radeon_legacy_tmds_ext_mode_set(struct drm_encoder *encoder, + static void radeon_ext_tmds_enc_destroy(struct drm_encoder *encoder) + { + struct radeon_encoder *radeon_encoder = to_radeon_encoder(encoder); +- struct radeon_encoder_ext_tmds *tmds = radeon_encoder->enc_priv; +- if (tmds) { +- if (tmds->i2c_bus) +- radeon_i2c_destroy(tmds->i2c_bus); +- } ++ /* don't destroy the i2c bus record here, this will be done in radeon_i2c_fini */ + kfree(radeon_encoder->enc_priv); + drm_encoder_cleanup(encoder); + kfree(radeon_encoder); +diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c +index 4065374..f4c3d28 100644 +--- a/drivers/hv/channel.c ++++ b/drivers/hv/channel.c +@@ -146,14 +146,14 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size, + + if (ret != 0) { + err = ret; +- goto errorout; ++ goto error0; + } + + ret = hv_ringbuffer_init( + &newchannel->inbound, in, recv_ringbuffer_size); + if (ret != 0) { + err = ret; +- goto errorout; ++ goto error0; + } + + +@@ -168,7 +168,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size, + + if (ret != 0) { + err = ret; +- goto errorout; ++ goto error0; + } + + /* Create and init the channel open message */ +@@ -177,7 +177,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size, + GFP_KERNEL); + if (!open_info) { + err = -ENOMEM; +- goto errorout; ++ goto error0; + } + + init_completion(&open_info->waitevent); +@@ -193,7 +193,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size, + + if (userdatalen > MAX_USER_DEFINED_BYTES) { + err = -EINVAL; +- goto errorout; ++ goto error0; + } + + if (userdatalen) +@@ -208,19 +208,18 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size, + sizeof(struct vmbus_channel_open_channel)); + + if (ret != 0) +- goto cleanup; ++ goto error1; + + t = wait_for_completion_timeout(&open_info->waitevent, 5*HZ); + if (t == 0) { + err = -ETIMEDOUT; +- goto errorout; ++ goto error1; + } + + + if (open_info->response.open_result.status) + err = open_info->response.open_result.status; + +-cleanup: + spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags); + list_del(&open_info->msglistentry); + spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags); +@@ -228,9 +227,12 @@ cleanup: + kfree(open_info); + return err; + +-errorout: +- hv_ringbuffer_cleanup(&newchannel->outbound); +- hv_ringbuffer_cleanup(&newchannel->inbound); ++error1: ++ spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags); ++ list_del(&open_info->msglistentry); ++ spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags); ++ ++error0: + free_pages((unsigned long)out, + get_order(send_ringbuffer_size + recv_ringbuffer_size)); + kfree(open_info); +diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c +index 0634ee5..8f67c4d 100644 +--- a/drivers/md/raid10.c ++++ b/drivers/md/raid10.c +@@ -2641,7 +2641,7 @@ static sector_t sync_request(struct mddev *mddev, sector_t sector_nr, + else { + bad_sectors -= (sector - first_bad); + if (max_sync > bad_sectors) +- max_sync = max_sync; ++ max_sync = bad_sectors; + continue; + } + } +diff --git a/drivers/media/video/au0828/au0828-video.c b/drivers/media/video/au0828/au0828-video.c +index 0b3e481..eab0641 100644 +--- a/drivers/media/video/au0828/au0828-video.c ++++ b/drivers/media/video/au0828/au0828-video.c +@@ -1692,14 +1692,18 @@ static int vidioc_streamoff(struct file *file, void *priv, + (AUVI_INPUT(i).audio_setup)(dev, 0); + } + +- videobuf_streamoff(&fh->vb_vidq); +- res_free(fh, AU0828_RESOURCE_VIDEO); ++ if (res_check(fh, AU0828_RESOURCE_VIDEO)) { ++ videobuf_streamoff(&fh->vb_vidq); ++ res_free(fh, AU0828_RESOURCE_VIDEO); ++ } + } else if (fh->type == V4L2_BUF_TYPE_VBI_CAPTURE) { + dev->vbi_timeout_running = 0; + del_timer_sync(&dev->vbi_timeout); + +- videobuf_streamoff(&fh->vb_vbiq); +- res_free(fh, AU0828_RESOURCE_VBI); ++ if (res_check(fh, AU0828_RESOURCE_VBI)) { ++ videobuf_streamoff(&fh->vb_vbiq); ++ res_free(fh, AU0828_RESOURCE_VBI); ++ } + } + + return 0; +diff --git a/drivers/mtd/nand/nand_base.c b/drivers/mtd/nand/nand_base.c +index 3ed9c5e..daed698 100644 +--- a/drivers/mtd/nand/nand_base.c ++++ b/drivers/mtd/nand/nand_base.c +@@ -2903,9 +2903,7 @@ static int nand_flash_detect_onfi(struct mtd_info *mtd, struct nand_chip *chip, + if (le16_to_cpu(p->features) & 1) + *busw = NAND_BUSWIDTH_16; + +- chip->options &= ~NAND_CHIPOPTIONS_MSK; +- chip->options |= (NAND_NO_READRDY | +- NAND_NO_AUTOINCR) & NAND_CHIPOPTIONS_MSK; ++ chip->options |= NAND_NO_READRDY | NAND_NO_AUTOINCR; + + return 1; + } +@@ -3069,9 +3067,8 @@ static struct nand_flash_dev *nand_get_flash_type(struct mtd_info *mtd, + mtd->erasesize <<= ((id_data[3] & 0x03) << 1); + } + } +- /* Get chip options, preserve non chip based options */ +- chip->options &= ~NAND_CHIPOPTIONS_MSK; +- chip->options |= type->options & NAND_CHIPOPTIONS_MSK; ++ /* Get chip options */ ++ chip->options |= type->options; + + /* + * Check if chip is not a Samsung device. Do not clear the +diff --git a/drivers/net/ethernet/intel/e1000/e1000_main.c b/drivers/net/ethernet/intel/e1000/e1000_main.c +index c5f6b0e..6546191 100644 +--- a/drivers/net/ethernet/intel/e1000/e1000_main.c ++++ b/drivers/net/ethernet/intel/e1000/e1000_main.c +@@ -168,6 +168,8 @@ static int e1000_82547_fifo_workaround(struct e1000_adapter *adapter, + + static bool e1000_vlan_used(struct e1000_adapter *adapter); + static void e1000_vlan_mode(struct net_device *netdev, u32 features); ++static void e1000_vlan_filter_on_off(struct e1000_adapter *adapter, ++ bool filter_on); + static void e1000_vlan_rx_add_vid(struct net_device *netdev, u16 vid); + static void e1000_vlan_rx_kill_vid(struct net_device *netdev, u16 vid); + static void e1000_restore_vlan(struct e1000_adapter *adapter); +@@ -1219,7 +1221,7 @@ static int __devinit e1000_probe(struct pci_dev *pdev, + if (err) + goto err_register; + +- e1000_vlan_mode(netdev, netdev->features); ++ e1000_vlan_filter_on_off(adapter, false); + + /* print bus type/speed/width info */ + e_info(probe, "(PCI%s:%dMHz:%d-bit) %pM\n", +@@ -4553,6 +4555,21 @@ static bool e1000_vlan_used(struct e1000_adapter *adapter) + return false; + } + ++static void __e1000_vlan_mode(struct e1000_adapter *adapter, u32 features) ++{ ++ struct e1000_hw *hw = &adapter->hw; ++ u32 ctrl; ++ ++ ctrl = er32(CTRL); ++ if (features & NETIF_F_HW_VLAN_RX) { ++ /* enable VLAN tag insert/strip */ ++ ctrl |= E1000_CTRL_VME; ++ } else { ++ /* disable VLAN tag insert/strip */ ++ ctrl &= ~E1000_CTRL_VME; ++ } ++ ew32(CTRL, ctrl); ++} + static void e1000_vlan_filter_on_off(struct e1000_adapter *adapter, + bool filter_on) + { +@@ -4562,6 +4579,7 @@ static void e1000_vlan_filter_on_off(struct e1000_adapter *adapter, + if (!test_bit(__E1000_DOWN, &adapter->flags)) + e1000_irq_disable(adapter); + ++ __e1000_vlan_mode(adapter, adapter->netdev->features); + if (filter_on) { + /* enable VLAN receive filtering */ + rctl = er32(RCTL); +@@ -4584,21 +4602,11 @@ static void e1000_vlan_filter_on_off(struct e1000_adapter *adapter, + static void e1000_vlan_mode(struct net_device *netdev, u32 features) + { + struct e1000_adapter *adapter = netdev_priv(netdev); +- struct e1000_hw *hw = &adapter->hw; +- u32 ctrl; + + if (!test_bit(__E1000_DOWN, &adapter->flags)) + e1000_irq_disable(adapter); + +- ctrl = er32(CTRL); +- if (features & NETIF_F_HW_VLAN_RX) { +- /* enable VLAN tag insert/strip */ +- ctrl |= E1000_CTRL_VME; +- } else { +- /* disable VLAN tag insert/strip */ +- ctrl &= ~E1000_CTRL_VME; +- } +- ew32(CTRL, ctrl); ++ __e1000_vlan_mode(adapter, features); + + if (!test_bit(__E1000_DOWN, &adapter->flags)) + e1000_irq_enable(adapter); +diff --git a/drivers/net/ethernet/marvell/skge.c b/drivers/net/ethernet/marvell/skge.c +index dea0cb4..57be855 100644 +--- a/drivers/net/ethernet/marvell/skge.c ++++ b/drivers/net/ethernet/marvell/skge.c +@@ -4143,6 +4143,13 @@ static struct dmi_system_id skge_32bit_dma_boards[] = { + DMI_MATCH(DMI_BOARD_NAME, "nForce"), + }, + }, ++ { ++ .ident = "ASUS P5NSLI", ++ .matches = { ++ DMI_MATCH(DMI_BOARD_VENDOR, "ASUSTeK Computer INC."), ++ DMI_MATCH(DMI_BOARD_NAME, "P5NSLI") ++ }, ++ }, + {} + }; + +diff --git a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h +index 026f9de..cc54153 100644 +--- a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h ++++ b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h +@@ -835,107 +835,107 @@ static const u32 ar9300_2p2_baseband_core[][2] = { + + static const u32 ar9300Modes_high_power_tx_gain_table_2p2[][5] = { + /* Addr 5G_HT20 5G_HT40 2G_HT40 2G_HT20 */ +- {0x0000a2dc, 0x000cfff0, 0x000cfff0, 0x03aaa352, 0x03aaa352}, +- {0x0000a2e0, 0x000f0000, 0x000f0000, 0x03ccc584, 0x03ccc584}, +- {0x0000a2e4, 0x03f00000, 0x03f00000, 0x03f0f800, 0x03f0f800}, ++ {0x0000a2dc, 0x00033800, 0x00033800, 0x03aaa352, 0x03aaa352}, ++ {0x0000a2e0, 0x0003c000, 0x0003c000, 0x03ccc584, 0x03ccc584}, ++ {0x0000a2e4, 0x03fc0000, 0x03fc0000, 0x03f0f800, 0x03f0f800}, + {0x0000a2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000}, + {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9}, + {0x0000a500, 0x00000000, 0x00000000, 0x00000000, 0x00000000}, + {0x0000a504, 0x06000003, 0x06000003, 0x04000002, 0x04000002}, + {0x0000a508, 0x0a000020, 0x0a000020, 0x08000004, 0x08000004}, + {0x0000a50c, 0x10000023, 0x10000023, 0x0b000200, 0x0b000200}, +- {0x0000a510, 0x15000028, 0x15000028, 0x0f000202, 0x0f000202}, +- {0x0000a514, 0x1b00002b, 0x1b00002b, 0x12000400, 0x12000400}, +- {0x0000a518, 0x1f020028, 0x1f020028, 0x16000402, 0x16000402}, +- {0x0000a51c, 0x2502002b, 0x2502002b, 0x19000404, 0x19000404}, +- {0x0000a520, 0x2a04002a, 0x2a04002a, 0x1c000603, 0x1c000603}, +- {0x0000a524, 0x2e06002a, 0x2e06002a, 0x21000a02, 0x21000a02}, +- {0x0000a528, 0x3302202d, 0x3302202d, 0x25000a04, 0x25000a04}, +- {0x0000a52c, 0x3804202c, 0x3804202c, 0x28000a20, 0x28000a20}, +- {0x0000a530, 0x3c06202c, 0x3c06202c, 0x2c000e20, 0x2c000e20}, +- {0x0000a534, 0x4108202d, 0x4108202d, 0x30000e22, 0x30000e22}, +- {0x0000a538, 0x4506402d, 0x4506402d, 0x34000e24, 0x34000e24}, +- {0x0000a53c, 0x4906222d, 0x4906222d, 0x38001640, 0x38001640}, +- {0x0000a540, 0x4d062231, 0x4d062231, 0x3c001660, 0x3c001660}, +- {0x0000a544, 0x50082231, 0x50082231, 0x3f001861, 0x3f001861}, +- {0x0000a548, 0x5608422e, 0x5608422e, 0x43001a81, 0x43001a81}, +- {0x0000a54c, 0x5a08442e, 0x5a08442e, 0x47001a83, 0x47001a83}, +- {0x0000a550, 0x5e0a4431, 0x5e0a4431, 0x4a001c84, 0x4a001c84}, +- {0x0000a554, 0x640a4432, 0x640a4432, 0x4e001ce3, 0x4e001ce3}, +- {0x0000a558, 0x680a4434, 0x680a4434, 0x52001ce5, 0x52001ce5}, +- {0x0000a55c, 0x6c0a6434, 0x6c0a6434, 0x56001ce9, 0x56001ce9}, +- {0x0000a560, 0x6f0a6633, 0x6f0a6633, 0x5a001ceb, 0x5a001ceb}, +- {0x0000a564, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec}, +- {0x0000a568, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec}, +- {0x0000a56c, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec}, +- {0x0000a570, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec}, +- {0x0000a574, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec}, +- {0x0000a578, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec}, +- {0x0000a57c, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec}, ++ {0x0000a510, 0x16000220, 0x16000220, 0x0f000202, 0x0f000202}, ++ {0x0000a514, 0x1c000223, 0x1c000223, 0x12000400, 0x12000400}, ++ {0x0000a518, 0x21002220, 0x21002220, 0x16000402, 0x16000402}, ++ {0x0000a51c, 0x27002223, 0x27002223, 0x19000404, 0x19000404}, ++ {0x0000a520, 0x2b022220, 0x2b022220, 0x1c000603, 0x1c000603}, ++ {0x0000a524, 0x2f022222, 0x2f022222, 0x21000a02, 0x21000a02}, ++ {0x0000a528, 0x34022225, 0x34022225, 0x25000a04, 0x25000a04}, ++ {0x0000a52c, 0x3a02222a, 0x3a02222a, 0x28000a20, 0x28000a20}, ++ {0x0000a530, 0x3e02222c, 0x3e02222c, 0x2c000e20, 0x2c000e20}, ++ {0x0000a534, 0x4202242a, 0x4202242a, 0x30000e22, 0x30000e22}, ++ {0x0000a538, 0x4702244a, 0x4702244a, 0x34000e24, 0x34000e24}, ++ {0x0000a53c, 0x4b02244c, 0x4b02244c, 0x38001640, 0x38001640}, ++ {0x0000a540, 0x4e02246c, 0x4e02246c, 0x3c001660, 0x3c001660}, ++ {0x0000a544, 0x52022470, 0x52022470, 0x3f001861, 0x3f001861}, ++ {0x0000a548, 0x55022490, 0x55022490, 0x43001a81, 0x43001a81}, ++ {0x0000a54c, 0x59022492, 0x59022492, 0x47001a83, 0x47001a83}, ++ {0x0000a550, 0x5d022692, 0x5d022692, 0x4a001c84, 0x4a001c84}, ++ {0x0000a554, 0x61022892, 0x61022892, 0x4e001ce3, 0x4e001ce3}, ++ {0x0000a558, 0x65024890, 0x65024890, 0x52001ce5, 0x52001ce5}, ++ {0x0000a55c, 0x69024892, 0x69024892, 0x56001ce9, 0x56001ce9}, ++ {0x0000a560, 0x6e024c92, 0x6e024c92, 0x5a001ceb, 0x5a001ceb}, ++ {0x0000a564, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec}, ++ {0x0000a568, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec}, ++ {0x0000a56c, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec}, ++ {0x0000a570, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec}, ++ {0x0000a574, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec}, ++ {0x0000a578, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec}, ++ {0x0000a57c, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec}, + {0x0000a580, 0x00800000, 0x00800000, 0x00800000, 0x00800000}, + {0x0000a584, 0x06800003, 0x06800003, 0x04800002, 0x04800002}, + {0x0000a588, 0x0a800020, 0x0a800020, 0x08800004, 0x08800004}, + {0x0000a58c, 0x10800023, 0x10800023, 0x0b800200, 0x0b800200}, +- {0x0000a590, 0x15800028, 0x15800028, 0x0f800202, 0x0f800202}, +- {0x0000a594, 0x1b80002b, 0x1b80002b, 0x12800400, 0x12800400}, +- {0x0000a598, 0x1f820028, 0x1f820028, 0x16800402, 0x16800402}, +- {0x0000a59c, 0x2582002b, 0x2582002b, 0x19800404, 0x19800404}, +- {0x0000a5a0, 0x2a84002a, 0x2a84002a, 0x1c800603, 0x1c800603}, +- {0x0000a5a4, 0x2e86002a, 0x2e86002a, 0x21800a02, 0x21800a02}, +- {0x0000a5a8, 0x3382202d, 0x3382202d, 0x25800a04, 0x25800a04}, +- {0x0000a5ac, 0x3884202c, 0x3884202c, 0x28800a20, 0x28800a20}, +- {0x0000a5b0, 0x3c86202c, 0x3c86202c, 0x2c800e20, 0x2c800e20}, +- {0x0000a5b4, 0x4188202d, 0x4188202d, 0x30800e22, 0x30800e22}, +- {0x0000a5b8, 0x4586402d, 0x4586402d, 0x34800e24, 0x34800e24}, +- {0x0000a5bc, 0x4986222d, 0x4986222d, 0x38801640, 0x38801640}, +- {0x0000a5c0, 0x4d862231, 0x4d862231, 0x3c801660, 0x3c801660}, +- {0x0000a5c4, 0x50882231, 0x50882231, 0x3f801861, 0x3f801861}, +- {0x0000a5c8, 0x5688422e, 0x5688422e, 0x43801a81, 0x43801a81}, +- {0x0000a5cc, 0x5a88442e, 0x5a88442e, 0x47801a83, 0x47801a83}, +- {0x0000a5d0, 0x5e8a4431, 0x5e8a4431, 0x4a801c84, 0x4a801c84}, +- {0x0000a5d4, 0x648a4432, 0x648a4432, 0x4e801ce3, 0x4e801ce3}, +- {0x0000a5d8, 0x688a4434, 0x688a4434, 0x52801ce5, 0x52801ce5}, +- {0x0000a5dc, 0x6c8a6434, 0x6c8a6434, 0x56801ce9, 0x56801ce9}, +- {0x0000a5e0, 0x6f8a6633, 0x6f8a6633, 0x5a801ceb, 0x5a801ceb}, +- {0x0000a5e4, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec}, +- {0x0000a5e8, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec}, +- {0x0000a5ec, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec}, +- {0x0000a5f0, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec}, +- {0x0000a5f4, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec}, +- {0x0000a5f8, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec}, +- {0x0000a5fc, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec}, ++ {0x0000a590, 0x16800220, 0x16800220, 0x0f800202, 0x0f800202}, ++ {0x0000a594, 0x1c800223, 0x1c800223, 0x12800400, 0x12800400}, ++ {0x0000a598, 0x21802220, 0x21802220, 0x16800402, 0x16800402}, ++ {0x0000a59c, 0x27802223, 0x27802223, 0x19800404, 0x19800404}, ++ {0x0000a5a0, 0x2b822220, 0x2b822220, 0x1c800603, 0x1c800603}, ++ {0x0000a5a4, 0x2f822222, 0x2f822222, 0x21800a02, 0x21800a02}, ++ {0x0000a5a8, 0x34822225, 0x34822225, 0x25800a04, 0x25800a04}, ++ {0x0000a5ac, 0x3a82222a, 0x3a82222a, 0x28800a20, 0x28800a20}, ++ {0x0000a5b0, 0x3e82222c, 0x3e82222c, 0x2c800e20, 0x2c800e20}, ++ {0x0000a5b4, 0x4282242a, 0x4282242a, 0x30800e22, 0x30800e22}, ++ {0x0000a5b8, 0x4782244a, 0x4782244a, 0x34800e24, 0x34800e24}, ++ {0x0000a5bc, 0x4b82244c, 0x4b82244c, 0x38801640, 0x38801640}, ++ {0x0000a5c0, 0x4e82246c, 0x4e82246c, 0x3c801660, 0x3c801660}, ++ {0x0000a5c4, 0x52822470, 0x52822470, 0x3f801861, 0x3f801861}, ++ {0x0000a5c8, 0x55822490, 0x55822490, 0x43801a81, 0x43801a81}, ++ {0x0000a5cc, 0x59822492, 0x59822492, 0x47801a83, 0x47801a83}, ++ {0x0000a5d0, 0x5d822692, 0x5d822692, 0x4a801c84, 0x4a801c84}, ++ {0x0000a5d4, 0x61822892, 0x61822892, 0x4e801ce3, 0x4e801ce3}, ++ {0x0000a5d8, 0x65824890, 0x65824890, 0x52801ce5, 0x52801ce5}, ++ {0x0000a5dc, 0x69824892, 0x69824892, 0x56801ce9, 0x56801ce9}, ++ {0x0000a5e0, 0x6e824c92, 0x6e824c92, 0x5a801ceb, 0x5a801ceb}, ++ {0x0000a5e4, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec}, ++ {0x0000a5e8, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec}, ++ {0x0000a5ec, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec}, ++ {0x0000a5f0, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec}, ++ {0x0000a5f4, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec}, ++ {0x0000a5f8, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec}, ++ {0x0000a5fc, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec}, + {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000}, + {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000}, +- {0x0000a608, 0x01804601, 0x01804601, 0x00000000, 0x00000000}, +- {0x0000a60c, 0x01804601, 0x01804601, 0x00000000, 0x00000000}, +- {0x0000a610, 0x01804601, 0x01804601, 0x00000000, 0x00000000}, +- {0x0000a614, 0x01804601, 0x01804601, 0x01404000, 0x01404000}, +- {0x0000a618, 0x01804601, 0x01804601, 0x01404501, 0x01404501}, +- {0x0000a61c, 0x01804601, 0x01804601, 0x02008501, 0x02008501}, +- {0x0000a620, 0x03408d02, 0x03408d02, 0x0280ca03, 0x0280ca03}, +- {0x0000a624, 0x0300cc03, 0x0300cc03, 0x03010c04, 0x03010c04}, +- {0x0000a628, 0x03410d04, 0x03410d04, 0x04014c04, 0x04014c04}, +- {0x0000a62c, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005}, +- {0x0000a630, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005}, +- {0x0000a634, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005}, +- {0x0000a638, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005}, +- {0x0000a63c, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005}, +- {0x0000b2dc, 0x000cfff0, 0x000cfff0, 0x03aaa352, 0x03aaa352}, +- {0x0000b2e0, 0x000f0000, 0x000f0000, 0x03ccc584, 0x03ccc584}, +- {0x0000b2e4, 0x03f00000, 0x03f00000, 0x03f0f800, 0x03f0f800}, ++ {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000}, ++ {0x0000a60c, 0x00000000, 0x00000000, 0x00000000, 0x00000000}, ++ {0x0000a610, 0x00000000, 0x00000000, 0x00000000, 0x00000000}, ++ {0x0000a614, 0x02004000, 0x02004000, 0x01404000, 0x01404000}, ++ {0x0000a618, 0x02004801, 0x02004801, 0x01404501, 0x01404501}, ++ {0x0000a61c, 0x02808a02, 0x02808a02, 0x02008501, 0x02008501}, ++ {0x0000a620, 0x0380ce03, 0x0380ce03, 0x0280ca03, 0x0280ca03}, ++ {0x0000a624, 0x04411104, 0x04411104, 0x03010c04, 0x03010c04}, ++ {0x0000a628, 0x04411104, 0x04411104, 0x04014c04, 0x04014c04}, ++ {0x0000a62c, 0x04411104, 0x04411104, 0x04015005, 0x04015005}, ++ {0x0000a630, 0x04411104, 0x04411104, 0x04015005, 0x04015005}, ++ {0x0000a634, 0x04411104, 0x04411104, 0x04015005, 0x04015005}, ++ {0x0000a638, 0x04411104, 0x04411104, 0x04015005, 0x04015005}, ++ {0x0000a63c, 0x04411104, 0x04411104, 0x04015005, 0x04015005}, ++ {0x0000b2dc, 0x00033800, 0x00033800, 0x03aaa352, 0x03aaa352}, ++ {0x0000b2e0, 0x0003c000, 0x0003c000, 0x03ccc584, 0x03ccc584}, ++ {0x0000b2e4, 0x03fc0000, 0x03fc0000, 0x03f0f800, 0x03f0f800}, + {0x0000b2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000}, +- {0x0000c2dc, 0x000cfff0, 0x000cfff0, 0x03aaa352, 0x03aaa352}, +- {0x0000c2e0, 0x000f0000, 0x000f0000, 0x03ccc584, 0x03ccc584}, +- {0x0000c2e4, 0x03f00000, 0x03f00000, 0x03f0f800, 0x03f0f800}, ++ {0x0000c2dc, 0x00033800, 0x00033800, 0x03aaa352, 0x03aaa352}, ++ {0x0000c2e0, 0x0003c000, 0x0003c000, 0x03ccc584, 0x03ccc584}, ++ {0x0000c2e4, 0x03fc0000, 0x03fc0000, 0x03f0f800, 0x03f0f800}, + {0x0000c2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000}, + {0x00016044, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4}, +- {0x00016048, 0x61200001, 0x61200001, 0x66480001, 0x66480001}, ++ {0x00016048, 0x66480001, 0x66480001, 0x66480001, 0x66480001}, + {0x00016068, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c}, + {0x00016444, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4}, +- {0x00016448, 0x61200001, 0x61200001, 0x66480001, 0x66480001}, ++ {0x00016448, 0x66480001, 0x66480001, 0x66480001, 0x66480001}, + {0x00016468, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c}, + {0x00016844, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4}, +- {0x00016848, 0x61200001, 0x61200001, 0x66480001, 0x66480001}, ++ {0x00016848, 0x66480001, 0x66480001, 0x66480001, 0x66480001}, + {0x00016868, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c}, + }; + +diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c +index 56bd370..da567f0 100644 +--- a/drivers/net/wireless/ipw2x00/ipw2200.c ++++ b/drivers/net/wireless/ipw2x00/ipw2200.c +@@ -10463,7 +10463,7 @@ static void ipw_handle_promiscuous_tx(struct ipw_priv *priv, + } else + len = src->len; + +- dst = alloc_skb(len + sizeof(*rt_hdr), GFP_ATOMIC); ++ dst = alloc_skb(len + sizeof(*rt_hdr) + sizeof(u16)*2, GFP_ATOMIC); + if (!dst) + continue; + +diff --git a/drivers/net/wireless/iwlwifi/iwl-6000.c b/drivers/net/wireless/iwlwifi/iwl-6000.c +index 9b6b010..4ac4ef0 100644 +--- a/drivers/net/wireless/iwlwifi/iwl-6000.c ++++ b/drivers/net/wireless/iwlwifi/iwl-6000.c +@@ -193,7 +193,7 @@ static int iwl6000_hw_channel_switch(struct iwl_priv *priv, + * See iwlagn_mac_channel_switch. + */ + struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS]; +- struct iwl6000_channel_switch_cmd cmd; ++ struct iwl6000_channel_switch_cmd *cmd; + const struct iwl_channel_info *ch_info; + u32 switch_time_in_usec, ucode_switch_time; + u16 ch; +@@ -203,18 +203,25 @@ static int iwl6000_hw_channel_switch(struct iwl_priv *priv, + struct ieee80211_vif *vif = ctx->vif; + struct iwl_host_cmd hcmd = { + .id = REPLY_CHANNEL_SWITCH, +- .len = { sizeof(cmd), }, ++ .len = { sizeof(*cmd), }, + .flags = CMD_SYNC, +- .data = { &cmd, }, ++ .dataflags[0] = IWL_HCMD_DFL_NOCOPY, + }; ++ int err; + +- cmd.band = priv->band == IEEE80211_BAND_2GHZ; ++ cmd = kzalloc(sizeof(*cmd), GFP_KERNEL); ++ if (!cmd) ++ return -ENOMEM; ++ ++ hcmd.data[0] = cmd; ++ ++ cmd->band = priv->band == IEEE80211_BAND_2GHZ; + ch = ch_switch->channel->hw_value; + IWL_DEBUG_11H(priv, "channel switch from %u to %u\n", + ctx->active.channel, ch); +- cmd.channel = cpu_to_le16(ch); +- cmd.rxon_flags = ctx->staging.flags; +- cmd.rxon_filter_flags = ctx->staging.filter_flags; ++ cmd->channel = cpu_to_le16(ch); ++ cmd->rxon_flags = ctx->staging.flags; ++ cmd->rxon_filter_flags = ctx->staging.filter_flags; + switch_count = ch_switch->count; + tsf_low = ch_switch->timestamp & 0x0ffffffff; + /* +@@ -230,30 +237,32 @@ static int iwl6000_hw_channel_switch(struct iwl_priv *priv, + switch_count = 0; + } + if (switch_count <= 1) +- cmd.switch_time = cpu_to_le32(priv->ucode_beacon_time); ++ cmd->switch_time = cpu_to_le32(priv->ucode_beacon_time); + else { + switch_time_in_usec = + vif->bss_conf.beacon_int * switch_count * TIME_UNIT; + ucode_switch_time = iwl_usecs_to_beacons(priv, + switch_time_in_usec, + beacon_interval); +- cmd.switch_time = iwl_add_beacon_time(priv, +- priv->ucode_beacon_time, +- ucode_switch_time, +- beacon_interval); ++ cmd->switch_time = iwl_add_beacon_time(priv, ++ priv->ucode_beacon_time, ++ ucode_switch_time, ++ beacon_interval); + } + IWL_DEBUG_11H(priv, "uCode time for the switch is 0x%x\n", +- cmd.switch_time); ++ cmd->switch_time); + ch_info = iwl_get_channel_info(priv, priv->band, ch); + if (ch_info) +- cmd.expect_beacon = is_channel_radar(ch_info); ++ cmd->expect_beacon = is_channel_radar(ch_info); + else { + IWL_ERR(priv, "invalid channel switch from %u to %u\n", + ctx->active.channel, ch); + return -EFAULT; + } + +- return iwl_trans_send_cmd(trans(priv), &hcmd); ++ err = iwl_trans_send_cmd(trans(priv), &hcmd); ++ kfree(cmd); ++ return err; + } + + static struct iwl_lib_ops iwl6000_lib = { +diff --git a/drivers/pcmcia/pxa2xx_sharpsl.c b/drivers/pcmcia/pxa2xx_sharpsl.c +index 69ae2fd..b938163 100644 +--- a/drivers/pcmcia/pxa2xx_sharpsl.c ++++ b/drivers/pcmcia/pxa2xx_sharpsl.c +@@ -219,7 +219,7 @@ static void sharpsl_pcmcia_socket_suspend(struct soc_pcmcia_socket *skt) + sharpsl_pcmcia_init_reset(skt); + } + +-static struct pcmcia_low_level sharpsl_pcmcia_ops __initdata = { ++static struct pcmcia_low_level sharpsl_pcmcia_ops = { + .owner = THIS_MODULE, + .hw_init = sharpsl_pcmcia_hw_init, + .hw_shutdown = sharpsl_pcmcia_hw_shutdown, +diff --git a/drivers/platform/x86/samsung-laptop.c b/drivers/platform/x86/samsung-laptop.c +index af1e296..21bc1a7 100644 +--- a/drivers/platform/x86/samsung-laptop.c ++++ b/drivers/platform/x86/samsung-laptop.c +@@ -21,6 +21,7 @@ + #include <linux/dmi.h> + #include <linux/platform_device.h> + #include <linux/rfkill.h> ++#include <linux/acpi.h> + + /* + * This driver is needed because a number of Samsung laptops do not hook +@@ -226,6 +227,7 @@ static struct backlight_device *backlight_device; + static struct mutex sabi_mutex; + static struct platform_device *sdev; + static struct rfkill *rfk; ++static bool handle_backlight; + static bool has_stepping_quirk; + + static int force; +@@ -602,6 +604,13 @@ static int __init samsung_init(void) + int retval; + + mutex_init(&sabi_mutex); ++ handle_backlight = true; ++ ++#ifdef CONFIG_ACPI ++ /* Don't handle backlight here if the acpi video already handle it */ ++ if (acpi_video_backlight_support()) ++ handle_backlight = false; ++#endif + + if (!force && !dmi_check_system(samsung_dmi_table)) + return -ENODEV; +@@ -661,7 +670,8 @@ static int __init samsung_init(void) + printk(KERN_DEBUG "ifaceP = 0x%08x\n", ifaceP); + printk(KERN_DEBUG "sabi_iface = %p\n", sabi_iface); + +- test_backlight(); ++ if (handle_backlight) ++ test_backlight(); + test_wireless(); + + retval = sabi_get_command(sabi_config->commands.get_brightness, +@@ -680,13 +690,23 @@ static int __init samsung_init(void) + } + + /* Check for stepping quirk */ +- check_for_stepping_quirk(); ++ if (handle_backlight) ++ check_for_stepping_quirk(); ++ ++#ifdef CONFIG_ACPI ++ /* Only log that if we are really on a sabi platform */ ++ if (acpi_video_backlight_support()) ++ pr_info("Backlight controlled by ACPI video driver\n"); ++#endif + + /* knock up a platform device to hang stuff off of */ + sdev = platform_device_register_simple("samsung", -1, NULL, 0); + if (IS_ERR(sdev)) + goto error_no_platform; + ++ if (!handle_backlight) ++ goto skip_backlight; ++ + /* create a backlight device to talk to this one */ + memset(&props, 0, sizeof(struct backlight_properties)); + props.type = BACKLIGHT_PLATFORM; +@@ -702,6 +722,7 @@ static int __init samsung_init(void) + backlight_device->props.power = FB_BLANK_UNBLANK; + backlight_update_status(backlight_device); + ++skip_backlight: + retval = init_wireless(sdev); + if (retval) + goto error_no_rfk; +diff --git a/drivers/rtc/rtc-imxdi.c b/drivers/rtc/rtc-imxdi.c +index d93a960..bc744b4 100644 +--- a/drivers/rtc/rtc-imxdi.c ++++ b/drivers/rtc/rtc-imxdi.c +@@ -392,6 +392,8 @@ static int dryice_rtc_probe(struct platform_device *pdev) + if (imxdi->ioaddr == NULL) + return -ENOMEM; + ++ spin_lock_init(&imxdi->irq_lock); ++ + imxdi->irq = platform_get_irq(pdev, 0); + if (imxdi->irq < 0) + return imxdi->irq; +diff --git a/drivers/scsi/scsi_debug.c b/drivers/scsi/scsi_debug.c +index 6888b2c..b3a729c 100644 +--- a/drivers/scsi/scsi_debug.c ++++ b/drivers/scsi/scsi_debug.c +@@ -2045,8 +2045,7 @@ static void unmap_region(sector_t lba, unsigned int len) + block = lba + alignment; + rem = do_div(block, granularity); + +- if (rem == 0 && lba + granularity <= end && +- block < map_size) ++ if (rem == 0 && lba + granularity < end && block < map_size) + clear_bit(block, map_storep); + + lba += granularity - rem; +diff --git a/drivers/staging/comedi/drivers/amplc_pc236.c b/drivers/staging/comedi/drivers/amplc_pc236.c +index 48246cd..b4311bf 100644 +--- a/drivers/staging/comedi/drivers/amplc_pc236.c ++++ b/drivers/staging/comedi/drivers/amplc_pc236.c +@@ -470,7 +470,7 @@ static int pc236_detach(struct comedi_device *dev) + { + printk(KERN_DEBUG "comedi%d: %s: detach\n", dev->minor, + PC236_DRIVER_NAME); +- if (devpriv) ++ if (dev->iobase) + pc236_intr_disable(dev); + + if (dev->irq) +diff --git a/drivers/staging/hv/storvsc_drv.c b/drivers/staging/hv/storvsc_drv.c +index ae8c33e..abc5ac5 100644 +--- a/drivers/staging/hv/storvsc_drv.c ++++ b/drivers/staging/hv/storvsc_drv.c +@@ -1043,7 +1043,12 @@ static int storvsc_host_reset(struct hv_device *device) + /* + * At this point, all outstanding requests in the adapter + * should have been flushed out and return to us ++ * There is a potential race here where the host may be in ++ * the process of responding when we return from here. ++ * Just wait for all in-transit packets to be accounted for ++ * before we return from here. + */ ++ storvsc_wait_to_drain(stor_device); + + cleanup: + return ret; +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c +index dbf7d20..df7f15d 100644 +--- a/drivers/usb/class/cdc-acm.c ++++ b/drivers/usb/class/cdc-acm.c +@@ -760,10 +760,6 @@ static const __u32 acm_tty_speed[] = { + 2500000, 3000000, 3500000, 4000000 + }; + +-static const __u8 acm_tty_size[] = { +- 5, 6, 7, 8 +-}; +- + static void acm_tty_set_termios(struct tty_struct *tty, + struct ktermios *termios_old) + { +@@ -780,7 +776,21 @@ static void acm_tty_set_termios(struct tty_struct *tty, + newline.bParityType = termios->c_cflag & PARENB ? + (termios->c_cflag & PARODD ? 1 : 2) + + (termios->c_cflag & CMSPAR ? 2 : 0) : 0; +- newline.bDataBits = acm_tty_size[(termios->c_cflag & CSIZE) >> 4]; ++ switch (termios->c_cflag & CSIZE) { ++ case CS5: ++ newline.bDataBits = 5; ++ break; ++ case CS6: ++ newline.bDataBits = 6; ++ break; ++ case CS7: ++ newline.bDataBits = 7; ++ break; ++ case CS8: ++ default: ++ newline.bDataBits = 8; ++ break; ++ } + /* FIXME: Needs to clear unsupported bits in the termios */ + acm->clocal = ((termios->c_cflag & CLOCAL) != 0); + +@@ -1172,7 +1182,7 @@ made_compressed_probe: + + if (usb_endpoint_xfer_int(epwrite)) + usb_fill_int_urb(snd->urb, usb_dev, +- usb_sndbulkpipe(usb_dev, epwrite->bEndpointAddress), ++ usb_sndintpipe(usb_dev, epwrite->bEndpointAddress), + NULL, acm->writesize, acm_write_bulk, snd, epwrite->bInterval); + else + usb_fill_bulk_urb(snd->urb, usb_dev, +@@ -1496,6 +1506,9 @@ static const struct usb_device_id acm_ids[] = { + Maybe we should define a new + quirk for this. */ + }, ++ { USB_DEVICE(0x0572, 0x1340), /* Conexant CX93010-2x UCMxx */ ++ .driver_info = NO_UNION_NORMAL, ++ }, + { USB_DEVICE(0x1bbb, 0x0003), /* Alcatel OT-I650 */ + .driver_info = NO_UNION_NORMAL, /* reports zero length descriptor */ + }, +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index 52340cc..a9a74d2 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -482,13 +482,16 @@ static void hub_tt_work(struct work_struct *work) + int limit = 100; + + spin_lock_irqsave (&hub->tt.lock, flags); +- while (--limit && !list_empty (&hub->tt.clear_list)) { ++ while (!list_empty(&hub->tt.clear_list)) { + struct list_head *next; + struct usb_tt_clear *clear; + struct usb_device *hdev = hub->hdev; + const struct hc_driver *drv; + int status; + ++ if (!hub->quiescing && --limit < 0) ++ break; ++ + next = hub->tt.clear_list.next; + clear = list_entry (next, struct usb_tt_clear, clear_list); + list_del (&clear->clear_list); +@@ -952,7 +955,7 @@ static void hub_quiesce(struct usb_hub *hub, enum hub_quiescing_type type) + if (hub->has_indicators) + cancel_delayed_work_sync(&hub->leds); + if (hub->tt.hub) +- cancel_work_sync(&hub->tt.clear_work); ++ flush_work_sync(&hub->tt.clear_work); + } + + /* caller has locked the hub device */ +diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c +index d0ec2f0..c2815a5 100644 +--- a/drivers/usb/host/pci-quirks.c ++++ b/drivers/usb/host/pci-quirks.c +@@ -545,7 +545,14 @@ static const struct dmi_system_id __devinitconst ehci_dmi_nohandoff_table[] = { + /* Pegatron Lucid (Ordissimo AIRIS) */ + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "M11JB"), +- DMI_MATCH(DMI_BIOS_VERSION, "Lucid-GE-133"), ++ DMI_MATCH(DMI_BIOS_VERSION, "Lucid-"), ++ }, ++ }, ++ { ++ /* Pegatron Lucid (Ordissimo) */ ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "Ordissimo"), ++ DMI_MATCH(DMI_BIOS_VERSION, "Lucid-"), + }, + }, + { } +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index 950aef8..0c6fb19 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1212,6 +1212,17 @@ static void xhci_cmd_to_noop(struct xhci_hcd *xhci, struct xhci_cd *cur_cd) + cur_seg = find_trb_seg(xhci->cmd_ring->first_seg, + xhci->cmd_ring->dequeue, &cycle_state); + ++ if (!cur_seg) { ++ xhci_warn(xhci, "Command ring mismatch, dequeue = %p %llx (dma)\n", ++ xhci->cmd_ring->dequeue, ++ (unsigned long long) ++ xhci_trb_virt_to_dma(xhci->cmd_ring->deq_seg, ++ xhci->cmd_ring->dequeue)); ++ xhci_debug_ring(xhci, xhci->cmd_ring); ++ xhci_dbg_ring_ptrs(xhci, xhci->cmd_ring); ++ return; ++ } ++ + /* find the command trb matched by cd from command ring */ + for (cmd_trb = xhci->cmd_ring->dequeue; + cmd_trb != xhci->cmd_ring->enqueue; +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index f5c0f38..5a23f4d 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -471,7 +471,8 @@ static bool compliance_mode_recovery_timer_quirk_check(void) + + if (strstr(dmi_product_name, "Z420") || + strstr(dmi_product_name, "Z620") || +- strstr(dmi_product_name, "Z820")) ++ strstr(dmi_product_name, "Z820") || ++ strstr(dmi_product_name, "Z1")) + return true; + + return false; +diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c +index 42de17b..d3addb2 100644 +--- a/drivers/usb/serial/mct_u232.c ++++ b/drivers/usb/serial/mct_u232.c +@@ -577,12 +577,14 @@ static void mct_u232_close(struct usb_serial_port *port) + { + dbg("%s port %d", __func__, port->number); + +- if (port->serial->dev) { +- /* shutdown our urbs */ +- usb_kill_urb(port->write_urb); +- usb_kill_urb(port->read_urb); +- usb_kill_urb(port->interrupt_in_urb); +- } ++ /* ++ * Must kill the read urb as it is actually an interrupt urb, which ++ * generic close thus fails to kill. ++ */ ++ usb_kill_urb(port->read_urb); ++ usb_kill_urb(port->interrupt_in_urb); ++ ++ usb_serial_generic_close(port); + } /* mct_u232_close */ + + +diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c +index b150ed9..d481f80 100644 +--- a/drivers/usb/serial/mos7840.c ++++ b/drivers/usb/serial/mos7840.c +@@ -235,12 +235,10 @@ struct moschip_port { + int port_num; /*Actual port number in the device(1,2,etc) */ + struct urb *write_urb; /* write URB for this port */ + struct urb *read_urb; /* read URB for this port */ +- struct urb *int_urb; + __u8 shadowLCR; /* last LCR value received */ + __u8 shadowMCR; /* last MCR value received */ + char open; + char open_ports; +- char zombie; + wait_queue_head_t wait_chase; /* for handling sleeping while waiting for chase to finish */ + wait_queue_head_t delta_msr_wait; /* for handling sleeping while waiting for msr change to happen */ + int delta_msr_cond; +@@ -505,7 +503,6 @@ static void mos7840_control_callback(struct urb *urb) + unsigned char *data; + struct moschip_port *mos7840_port; + __u8 regval = 0x0; +- int result = 0; + int status = urb->status; + + mos7840_port = urb->context; +@@ -524,7 +521,7 @@ static void mos7840_control_callback(struct urb *urb) + default: + dbg("%s - nonzero urb status received: %d", __func__, + status); +- goto exit; ++ return; + } + + dbg("%s urb buffer size is %d", __func__, urb->actual_length); +@@ -537,17 +534,6 @@ static void mos7840_control_callback(struct urb *urb) + mos7840_handle_new_msr(mos7840_port, regval); + else if (mos7840_port->MsrLsr == 1) + mos7840_handle_new_lsr(mos7840_port, regval); +- +-exit: +- spin_lock(&mos7840_port->pool_lock); +- if (!mos7840_port->zombie) +- result = usb_submit_urb(mos7840_port->int_urb, GFP_ATOMIC); +- spin_unlock(&mos7840_port->pool_lock); +- if (result) { +- dev_err(&urb->dev->dev, +- "%s - Error %d submitting interrupt urb\n", +- __func__, result); +- } + } + + static int mos7840_get_reg(struct moschip_port *mcs, __u16 Wval, __u16 reg, +@@ -655,14 +641,7 @@ static void mos7840_interrupt_callback(struct urb *urb) + wreg = MODEM_STATUS_REGISTER; + break; + } +- spin_lock(&mos7840_port->pool_lock); +- if (!mos7840_port->zombie) { +- rv = mos7840_get_reg(mos7840_port, wval, wreg, &Data); +- } else { +- spin_unlock(&mos7840_port->pool_lock); +- return; +- } +- spin_unlock(&mos7840_port->pool_lock); ++ rv = mos7840_get_reg(mos7840_port, wval, wreg, &Data); + } + } + } +@@ -2594,7 +2573,6 @@ error: + kfree(mos7840_port->ctrl_buf); + usb_free_urb(mos7840_port->control_urb); + kfree(mos7840_port); +- serial->port[i] = NULL; + } + return status; + } +@@ -2625,9 +2603,6 @@ static void mos7840_disconnect(struct usb_serial *serial) + mos7840_port = mos7840_get_port_private(serial->port[i]); + dbg ("mos7840_port %d = %p", i, mos7840_port); + if (mos7840_port) { +- spin_lock_irqsave(&mos7840_port->pool_lock, flags); +- mos7840_port->zombie = 1; +- spin_unlock_irqrestore(&mos7840_port->pool_lock, flags); + usb_kill_urb(mos7840_port->control_urb); + } + } +@@ -2661,6 +2636,7 @@ static void mos7840_release(struct usb_serial *serial) + mos7840_port = mos7840_get_port_private(serial->port[i]); + dbg("mos7840_port %d = %p", i, mos7840_port); + if (mos7840_port) { ++ usb_free_urb(mos7840_port->control_urb); + kfree(mos7840_port->ctrl_buf); + kfree(mos7840_port->dr); + kfree(mos7840_port); +diff --git a/drivers/usb/serial/opticon.c b/drivers/usb/serial/opticon.c +index c248a91..d6c5ed6 100644 +--- a/drivers/usb/serial/opticon.c ++++ b/drivers/usb/serial/opticon.c +@@ -160,7 +160,11 @@ static int send_control_msg(struct usb_serial_port *port, u8 requesttype, + { + struct usb_serial *serial = port->serial; + int retval; +- u8 buffer[2]; ++ u8 *buffer; ++ ++ buffer = kzalloc(1, GFP_KERNEL); ++ if (!buffer) ++ return -ENOMEM; + + buffer[0] = val; + /* Send the message to the vendor control endpoint +@@ -169,6 +173,7 @@ static int send_control_msg(struct usb_serial_port *port, u8 requesttype, + requesttype, + USB_DIR_OUT|USB_TYPE_VENDOR|USB_RECIP_INTERFACE, + 0, 0, buffer, 1, 0); ++ kfree(buffer); + + return retval; + } +@@ -292,7 +297,7 @@ static int opticon_write(struct tty_struct *tty, struct usb_serial_port *port, + if (!dr) { + dev_err(&port->dev, "out of memory\n"); + count = -ENOMEM; +- goto error; ++ goto error_no_dr; + } + + dr->bRequestType = USB_TYPE_VENDOR | USB_RECIP_INTERFACE | USB_DIR_OUT; +@@ -322,6 +327,8 @@ static int opticon_write(struct tty_struct *tty, struct usb_serial_port *port, + + return count; + error: ++ kfree(dr); ++error_no_dr: + usb_free_urb(urb); + error_no_urb: + kfree(buffer); +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 3fd4e6f..c334670 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -503,11 +503,19 @@ static const struct option_blacklist_info net_intf5_blacklist = { + .reserved = BIT(5), + }; + ++static const struct option_blacklist_info net_intf6_blacklist = { ++ .reserved = BIT(6), ++}; ++ + static const struct option_blacklist_info zte_mf626_blacklist = { + .sendsetup = BIT(0) | BIT(1), + .reserved = BIT(4), + }; + ++static const struct option_blacklist_info zte_1255_blacklist = { ++ .reserved = BIT(3) | BIT(4), ++}; ++ + static const struct usb_device_id option_ids[] = { + { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) }, + { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) }, +@@ -853,13 +861,19 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0113, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0117, 0xff, 0xff, 0xff) }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0118, 0xff, 0xff, 0xff) }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0121, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0118, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0121, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0122, 0xff, 0xff, 0xff) }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0123, 0xff, 0xff, 0xff) }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0124, 0xff, 0xff, 0xff) }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0125, 0xff, 0xff, 0xff) }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0126, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0123, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0124, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0125, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&net_intf6_blacklist }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0126, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0128, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0142, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0143, 0xff, 0xff, 0xff) }, +@@ -872,7 +886,8 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0156, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0157, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0158, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0158, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0159, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0161, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0162, 0xff, 0xff, 0xff) }, +@@ -880,13 +895,22 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0165, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0167, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0191, 0xff, 0xff, 0xff), /* ZTE EuFi890 */ ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0199, 0xff, 0xff, 0xff), /* ZTE MF820S */ ++ .driver_info = (kernel_ulong_t)&net_intf1_blacklist }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0257, 0xff, 0xff, 0xff), /* ZTE MF821 */ ++ .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0326, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1008, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1010, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1012, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1012, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1021, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&net_intf2_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1057, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1058, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1059, 0xff, 0xff, 0xff) }, +@@ -1002,18 +1026,24 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1169, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1170, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1244, 0xff, 0xff, 0xff) }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1245, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1245, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1246, 0xff, 0xff, 0xff) }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1247, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1247, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1248, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1249, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1250, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1251, 0xff, 0xff, 0xff) }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1252, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1252, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1253, 0xff, 0xff, 0xff) }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1254, 0xff, 0xff, 0xff) }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1255, 0xff, 0xff, 0xff) }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1256, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1254, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1255, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&zte_1255_blacklist }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1256, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1257, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1258, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1259, 0xff, 0xff, 0xff) }, +@@ -1058,8 +1088,16 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1298, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1299, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1300, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1401, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&net_intf2_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1402, 0xff, 0xff, 0xff), + .driver_info = (kernel_ulong_t)&net_intf2_blacklist }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1424, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&net_intf2_blacklist }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1425, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&net_intf2_blacklist }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x1426, 0xff, 0xff, 0xff), /* ZTE MF91 */ ++ .driver_info = (kernel_ulong_t)&net_intf2_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2002, 0xff, + 0xff, 0xff), .driver_info = (kernel_ulong_t)&zte_k3765_z_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x2003, 0xff, 0xff, 0xff) }, +@@ -1071,15 +1109,21 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0070, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0073, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0094, 0xff, 0xff, 0xff) }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0130, 0xff, 0xff, 0xff) }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0133, 0xff, 0xff, 0xff) }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0141, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0130, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&net_intf1_blacklist }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0133, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0141, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&net_intf5_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0147, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0152, 0xff, 0xff, 0xff) }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0168, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0168, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0170, 0xff, 0xff, 0xff) }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0176, 0xff, 0xff, 0xff) }, +- { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0178, 0xff, 0xff, 0xff) }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0176, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, ++ { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, 0x0178, 0xff, 0xff, 0xff), ++ .driver_info = (kernel_ulong_t)&net_intf3_blacklist }, + + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH, 0xff, 0xff, 0xff) }, + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_AC8710, 0xff, 0xff, 0xff) }, +diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c +index 535d087..e1f1ebd 100644 +--- a/drivers/usb/serial/sierra.c ++++ b/drivers/usb/serial/sierra.c +@@ -171,7 +171,6 @@ static int sierra_probe(struct usb_serial *serial, + { + int result = 0; + struct usb_device *udev; +- struct sierra_intf_private *data; + u8 ifnum; + + udev = serial->dev; +@@ -199,11 +198,6 @@ static int sierra_probe(struct usb_serial *serial, + return -ENODEV; + } + +- data = serial->private = kzalloc(sizeof(struct sierra_intf_private), GFP_KERNEL); +- if (!data) +- return -ENOMEM; +- spin_lock_init(&data->susp_lock); +- + return result; + } + +@@ -915,6 +909,7 @@ static void sierra_dtr_rts(struct usb_serial_port *port, int on) + static int sierra_startup(struct usb_serial *serial) + { + struct usb_serial_port *port; ++ struct sierra_intf_private *intfdata; + struct sierra_port_private *portdata; + struct sierra_iface_info *himemoryp = NULL; + int i; +@@ -922,6 +917,14 @@ static int sierra_startup(struct usb_serial *serial) + + dev_dbg(&serial->dev->dev, "%s\n", __func__); + ++ intfdata = kzalloc(sizeof(*intfdata), GFP_KERNEL); ++ if (!intfdata) ++ return -ENOMEM; ++ ++ spin_lock_init(&intfdata->susp_lock); ++ ++ usb_set_serial_data(serial, intfdata); ++ + /* Set Device mode to D0 */ + sierra_set_power_state(serial->dev, 0x0000); + +@@ -937,7 +940,7 @@ static int sierra_startup(struct usb_serial *serial) + dev_dbg(&port->dev, "%s: kmalloc for " + "sierra_port_private (%d) failed!\n", + __func__, i); +- return -ENOMEM; ++ goto err; + } + spin_lock_init(&portdata->lock); + init_usb_anchor(&portdata->active); +@@ -974,6 +977,14 @@ static int sierra_startup(struct usb_serial *serial) + } + + return 0; ++err: ++ for (--i; i >= 0; --i) { ++ portdata = usb_get_serial_port_data(serial->port[i]); ++ kfree(portdata); ++ } ++ kfree(intfdata); ++ ++ return -ENOMEM; + } + + static void sierra_release(struct usb_serial *serial) +@@ -993,6 +1004,7 @@ static void sierra_release(struct usb_serial *serial) + continue; + kfree(portdata); + } ++ kfree(serial->private); + } + + #ifdef CONFIG_PM +diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c +index 5b073bc..59d646d 100644 +--- a/drivers/usb/serial/whiteheat.c ++++ b/drivers/usb/serial/whiteheat.c +@@ -576,6 +576,7 @@ no_firmware: + "%s: please contact support@connecttech.com\n", + serial->type->description); + kfree(result); ++ kfree(command); + return -ENODEV; + + no_command_private: +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index 591f57f..fa8a1b2 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -1004,6 +1004,12 @@ UNUSUAL_DEV( 0x07cf, 0x1001, 0x1000, 0x9999, + USB_SC_8070, USB_PR_CB, NULL, + US_FL_NEED_OVERRIDE | US_FL_FIX_INQUIRY ), + ++/* Submitted by Oleksandr Chumachenko <ledest@gmail.com> */ ++UNUSUAL_DEV( 0x07cf, 0x1167, 0x0100, 0x0100, ++ "Casio", ++ "EX-N1 DigitalCamera", ++ USB_SC_8070, USB_PR_DEVICE, NULL, 0), ++ + /* Submitted by Hartmut Wahl <hwahl@hwahl.de>*/ + UNUSUAL_DEV( 0x0839, 0x000a, 0x0001, 0x0001, + "Samsung", +diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c +index 882a51f..b76071e 100644 +--- a/drivers/vhost/net.c ++++ b/drivers/vhost/net.c +@@ -371,7 +371,8 @@ static void handle_rx(struct vhost_net *net) + .hdr.gso_type = VIRTIO_NET_HDR_GSO_NONE + }; + size_t total_len = 0; +- int err, headcount, mergeable; ++ int err, mergeable; ++ s16 headcount; + size_t vhost_hlen, sock_hlen; + size_t vhost_len, sock_len; + /* TODO: check that we are running from vhost_worker? */ +diff --git a/drivers/video/udlfb.c b/drivers/video/udlfb.c +index 41746bb..cb5988f 100644 +--- a/drivers/video/udlfb.c ++++ b/drivers/video/udlfb.c +@@ -646,7 +646,7 @@ static ssize_t dlfb_ops_write(struct fb_info *info, const char __user *buf, + result = fb_sys_write(info, buf, count, ppos); + + if (result > 0) { +- int start = max((int)(offset / info->fix.line_length) - 1, 0); ++ int start = max((int)(offset / info->fix.line_length), 0); + int lines = min((u32)((result / info->fix.line_length) + 1), + (u32)info->var.yres); + +diff --git a/drivers/video/via/via_clock.c b/drivers/video/via/via_clock.c +index af8f26b..db1e392 100644 +--- a/drivers/video/via/via_clock.c ++++ b/drivers/video/via/via_clock.c +@@ -25,6 +25,7 @@ + + #include <linux/kernel.h> + #include <linux/via-core.h> ++#include <asm/olpc.h> + #include "via_clock.h" + #include "global.h" + #include "debug.h" +@@ -289,6 +290,10 @@ static void dummy_set_pll(struct via_pll_config config) + printk(KERN_INFO "Using undocumented set PLL.\n%s", via_slap); + } + ++static void noop_set_clock_state(u8 state) ++{ ++} ++ + void via_clock_init(struct via_clock *clock, int gfx_chip) + { + switch (gfx_chip) { +@@ -346,4 +351,18 @@ void via_clock_init(struct via_clock *clock, int gfx_chip) + break; + + } ++ ++ if (machine_is_olpc()) { ++ /* The OLPC XO-1.5 cannot suspend/resume reliably if the ++ * IGA1/IGA2 clocks are set as on or off (memory rot ++ * occasionally happens during suspend under such ++ * configurations). ++ * ++ * The only known stable scenario is to leave this bits as-is, ++ * which in their default states are documented to enable the ++ * clock only when it is needed. ++ */ ++ clock->set_primary_clock_state = noop_set_clock_state; ++ clock->set_secondary_clock_state = noop_set_clock_state; ++ } + } +diff --git a/fs/ceph/export.c b/fs/ceph/export.c +index 9fbcdec..b001030 100644 +--- a/fs/ceph/export.c ++++ b/fs/ceph/export.c +@@ -91,7 +91,7 @@ static int ceph_encode_fh(struct dentry *dentry, u32 *rawfh, int *max_len, + * FIXME: we should try harder by querying the mds for the ino. + */ + static struct dentry *__fh_to_dentry(struct super_block *sb, +- struct ceph_nfs_fh *fh) ++ struct ceph_nfs_fh *fh, int fh_len) + { + struct ceph_mds_client *mdsc = ceph_sb_to_client(sb)->mdsc; + struct inode *inode; +@@ -99,6 +99,9 @@ static struct dentry *__fh_to_dentry(struct super_block *sb, + struct ceph_vino vino; + int err; + ++ if (fh_len < sizeof(*fh) / 4) ++ return ERR_PTR(-ESTALE); ++ + dout("__fh_to_dentry %llx\n", fh->ino); + vino.ino = fh->ino; + vino.snap = CEPH_NOSNAP; +@@ -142,7 +145,7 @@ static struct dentry *__fh_to_dentry(struct super_block *sb, + * convert connectable fh to dentry + */ + static struct dentry *__cfh_to_dentry(struct super_block *sb, +- struct ceph_nfs_confh *cfh) ++ struct ceph_nfs_confh *cfh, int fh_len) + { + struct ceph_mds_client *mdsc = ceph_sb_to_client(sb)->mdsc; + struct inode *inode; +@@ -150,6 +153,9 @@ static struct dentry *__cfh_to_dentry(struct super_block *sb, + struct ceph_vino vino; + int err; + ++ if (fh_len < sizeof(*cfh) / 4) ++ return ERR_PTR(-ESTALE); ++ + dout("__cfh_to_dentry %llx (%llx/%x)\n", + cfh->ino, cfh->parent_ino, cfh->parent_name_hash); + +@@ -199,9 +205,11 @@ static struct dentry *ceph_fh_to_dentry(struct super_block *sb, struct fid *fid, + int fh_len, int fh_type) + { + if (fh_type == 1) +- return __fh_to_dentry(sb, (struct ceph_nfs_fh *)fid->raw); ++ return __fh_to_dentry(sb, (struct ceph_nfs_fh *)fid->raw, ++ fh_len); + else +- return __cfh_to_dentry(sb, (struct ceph_nfs_confh *)fid->raw); ++ return __cfh_to_dentry(sb, (struct ceph_nfs_confh *)fid->raw, ++ fh_len); + } + + /* +@@ -222,6 +230,8 @@ static struct dentry *ceph_fh_to_parent(struct super_block *sb, + + if (fh_type == 1) + return ERR_PTR(-ESTALE); ++ if (fh_len < sizeof(*cfh) / 4) ++ return ERR_PTR(-ESTALE); + + pr_debug("fh_to_parent %llx/%d\n", cfh->parent_ino, + cfh->parent_name_hash); +diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c +index 51352de..f854cf9 100644 +--- a/fs/compat_ioctl.c ++++ b/fs/compat_ioctl.c +@@ -210,6 +210,8 @@ static int do_video_set_spu_palette(unsigned int fd, unsigned int cmd, + + err = get_user(palp, &up->palette); + err |= get_user(length, &up->length); ++ if (err) ++ return -EFAULT; + + up_native = compat_alloc_user_space(sizeof(struct video_spu_palette)); + err = put_user(compat_ptr(palp), &up_native->palette); +diff --git a/fs/exec.c b/fs/exec.c +index 160cd2f..121ccae 100644 +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -1095,7 +1095,7 @@ int flush_old_exec(struct linux_binprm * bprm) + bprm->mm = NULL; /* We're using it now */ + + set_fs(USER_DS); +- current->flags &= ~(PF_RANDOMIZE | PF_KTHREAD); ++ current->flags &= ~(PF_RANDOMIZE | PF_KTHREAD | PF_NOFREEZE); + flush_thread(); + current->personality &= ~bprm->per_clear; + +diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c +index 54f2bdc..191580a 100644 +--- a/fs/ext4/extents.c ++++ b/fs/ext4/extents.c +@@ -2715,6 +2715,9 @@ static int ext4_ext_zeroout(struct inode *inode, struct ext4_extent *ex) + #define EXT4_EXT_MARK_UNINIT1 0x2 /* mark first half uninitialized */ + #define EXT4_EXT_MARK_UNINIT2 0x4 /* mark second half uninitialized */ + ++#define EXT4_EXT_DATA_VALID1 0x8 /* first half contains valid data */ ++#define EXT4_EXT_DATA_VALID2 0x10 /* second half contains valid data */ ++ + /* + * ext4_split_extent_at() splits an extent at given block. + * +@@ -2750,6 +2753,9 @@ static int ext4_split_extent_at(handle_t *handle, + unsigned int ee_len, depth; + int err = 0; + ++ BUG_ON((split_flag & (EXT4_EXT_DATA_VALID1 | EXT4_EXT_DATA_VALID2)) == ++ (EXT4_EXT_DATA_VALID1 | EXT4_EXT_DATA_VALID2)); ++ + ext_debug("ext4_split_extents_at: inode %lu, logical" + "block %llu\n", inode->i_ino, (unsigned long long)split); + +@@ -2808,7 +2814,14 @@ static int ext4_split_extent_at(handle_t *handle, + + err = ext4_ext_insert_extent(handle, inode, path, &newex, flags); + if (err == -ENOSPC && (EXT4_EXT_MAY_ZEROOUT & split_flag)) { +- err = ext4_ext_zeroout(inode, &orig_ex); ++ if (split_flag & (EXT4_EXT_DATA_VALID1|EXT4_EXT_DATA_VALID2)) { ++ if (split_flag & EXT4_EXT_DATA_VALID1) ++ err = ext4_ext_zeroout(inode, ex2); ++ else ++ err = ext4_ext_zeroout(inode, ex); ++ } else ++ err = ext4_ext_zeroout(inode, &orig_ex); ++ + if (err) + goto fix_extent_len; + /* update the extent length and mark as initialized */ +@@ -2861,12 +2874,13 @@ static int ext4_split_extent(handle_t *handle, + uninitialized = ext4_ext_is_uninitialized(ex); + + if (map->m_lblk + map->m_len < ee_block + ee_len) { +- split_flag1 = split_flag & EXT4_EXT_MAY_ZEROOUT ? +- EXT4_EXT_MAY_ZEROOUT : 0; ++ split_flag1 = split_flag & EXT4_EXT_MAY_ZEROOUT; + flags1 = flags | EXT4_GET_BLOCKS_PRE_IO; + if (uninitialized) + split_flag1 |= EXT4_EXT_MARK_UNINIT1 | + EXT4_EXT_MARK_UNINIT2; ++ if (split_flag & EXT4_EXT_DATA_VALID2) ++ split_flag1 |= EXT4_EXT_DATA_VALID1; + err = ext4_split_extent_at(handle, inode, path, + map->m_lblk + map->m_len, split_flag1, flags1); + if (err) +@@ -2879,8 +2893,8 @@ static int ext4_split_extent(handle_t *handle, + return PTR_ERR(path); + + if (map->m_lblk >= ee_block) { +- split_flag1 = split_flag & EXT4_EXT_MAY_ZEROOUT ? +- EXT4_EXT_MAY_ZEROOUT : 0; ++ split_flag1 = split_flag & (EXT4_EXT_MAY_ZEROOUT | ++ EXT4_EXT_DATA_VALID2); + if (uninitialized) + split_flag1 |= EXT4_EXT_MARK_UNINIT1; + if (split_flag & EXT4_EXT_MARK_UNINIT2) +@@ -3158,26 +3172,47 @@ static int ext4_split_unwritten_extents(handle_t *handle, + + split_flag |= ee_block + ee_len <= eof_block ? EXT4_EXT_MAY_ZEROOUT : 0; + split_flag |= EXT4_EXT_MARK_UNINIT2; +- ++ if (flags & EXT4_GET_BLOCKS_CONVERT) ++ split_flag |= EXT4_EXT_DATA_VALID2; + flags |= EXT4_GET_BLOCKS_PRE_IO; + return ext4_split_extent(handle, inode, path, map, split_flag, flags); + } + + static int ext4_convert_unwritten_extents_endio(handle_t *handle, +- struct inode *inode, +- struct ext4_ext_path *path) ++ struct inode *inode, ++ struct ext4_map_blocks *map, ++ struct ext4_ext_path *path) + { + struct ext4_extent *ex; ++ ext4_lblk_t ee_block; ++ unsigned int ee_len; + int depth; + int err = 0; + + depth = ext_depth(inode); + ex = path[depth].p_ext; ++ ee_block = le32_to_cpu(ex->ee_block); ++ ee_len = ext4_ext_get_actual_len(ex); + + ext_debug("ext4_convert_unwritten_extents_endio: inode %lu, logical" + "block %llu, max_blocks %u\n", inode->i_ino, +- (unsigned long long)le32_to_cpu(ex->ee_block), +- ext4_ext_get_actual_len(ex)); ++ (unsigned long long)ee_block, ee_len); ++ ++ /* If extent is larger than requested then split is required */ ++ if (ee_block != map->m_lblk || ee_len > map->m_len) { ++ err = ext4_split_unwritten_extents(handle, inode, map, path, ++ EXT4_GET_BLOCKS_CONVERT); ++ if (err < 0) ++ goto out; ++ ext4_ext_drop_refs(path); ++ path = ext4_ext_find_extent(inode, map->m_lblk, path); ++ if (IS_ERR(path)) { ++ err = PTR_ERR(path); ++ goto out; ++ } ++ depth = ext_depth(inode); ++ ex = path[depth].p_ext; ++ } + + err = ext4_ext_get_access(handle, inode, path + depth); + if (err) +@@ -3479,7 +3514,7 @@ ext4_ext_handle_uninitialized_extents(handle_t *handle, struct inode *inode, + } + /* IO end_io complete, convert the filled extent to written */ + if ((flags & EXT4_GET_BLOCKS_CONVERT)) { +- ret = ext4_convert_unwritten_extents_endio(handle, inode, ++ ret = ext4_convert_unwritten_extents_endio(handle, inode, map, + path); + if (ret >= 0) { + ext4_update_inode_fsync_trans(handle, inode, 1); +diff --git a/fs/gfs2/export.c b/fs/gfs2/export.c +index fe9945f..5235d6e 100644 +--- a/fs/gfs2/export.c ++++ b/fs/gfs2/export.c +@@ -167,6 +167,8 @@ static struct dentry *gfs2_fh_to_dentry(struct super_block *sb, struct fid *fid, + case GFS2_SMALL_FH_SIZE: + case GFS2_LARGE_FH_SIZE: + case GFS2_OLD_FH_SIZE: ++ if (fh_len < GFS2_SMALL_FH_SIZE) ++ return NULL; + this.no_formal_ino = ((u64)be32_to_cpu(fh[0])) << 32; + this.no_formal_ino |= be32_to_cpu(fh[1]); + this.no_addr = ((u64)be32_to_cpu(fh[2])) << 32; +@@ -186,6 +188,8 @@ static struct dentry *gfs2_fh_to_parent(struct super_block *sb, struct fid *fid, + switch (fh_type) { + case GFS2_LARGE_FH_SIZE: + case GFS2_OLD_FH_SIZE: ++ if (fh_len < GFS2_LARGE_FH_SIZE) ++ return NULL; + parent.no_formal_ino = ((u64)be32_to_cpu(fh[4])) << 32; + parent.no_formal_ino |= be32_to_cpu(fh[5]); + parent.no_addr = ((u64)be32_to_cpu(fh[6])) << 32; +diff --git a/fs/isofs/export.c b/fs/isofs/export.c +index dd4687f..516eb21 100644 +--- a/fs/isofs/export.c ++++ b/fs/isofs/export.c +@@ -179,7 +179,7 @@ static struct dentry *isofs_fh_to_parent(struct super_block *sb, + { + struct isofs_fid *ifid = (struct isofs_fid *)fid; + +- if (fh_type != 2) ++ if (fh_len < 2 || fh_type != 2) + return NULL; + + return isofs_export_iget(sb, +diff --git a/fs/jbd/commit.c b/fs/jbd/commit.c +index 8799207..931bf95 100644 +--- a/fs/jbd/commit.c ++++ b/fs/jbd/commit.c +@@ -86,7 +86,12 @@ nope: + static void release_data_buffer(struct buffer_head *bh) + { + if (buffer_freed(bh)) { ++ WARN_ON_ONCE(buffer_dirty(bh)); + clear_buffer_freed(bh); ++ clear_buffer_mapped(bh); ++ clear_buffer_new(bh); ++ clear_buffer_req(bh); ++ bh->b_bdev = NULL; + release_buffer_page(bh); + } else + put_bh(bh); +@@ -847,17 +852,35 @@ restart_loop: + * there's no point in keeping a checkpoint record for + * it. */ + +- /* A buffer which has been freed while still being +- * journaled by a previous transaction may end up still +- * being dirty here, but we want to avoid writing back +- * that buffer in the future after the "add to orphan" +- * operation been committed, That's not only a performance +- * gain, it also stops aliasing problems if the buffer is +- * left behind for writeback and gets reallocated for another +- * use in a different page. */ +- if (buffer_freed(bh) && !jh->b_next_transaction) { +- clear_buffer_freed(bh); +- clear_buffer_jbddirty(bh); ++ /* ++ * A buffer which has been freed while still being journaled by ++ * a previous transaction. ++ */ ++ if (buffer_freed(bh)) { ++ /* ++ * If the running transaction is the one containing ++ * "add to orphan" operation (b_next_transaction != ++ * NULL), we have to wait for that transaction to ++ * commit before we can really get rid of the buffer. ++ * So just clear b_modified to not confuse transaction ++ * credit accounting and refile the buffer to ++ * BJ_Forget of the running transaction. If the just ++ * committed transaction contains "add to orphan" ++ * operation, we can completely invalidate the buffer ++ * now. We are rather throughout in that since the ++ * buffer may be still accessible when blocksize < ++ * pagesize and it is attached to the last partial ++ * page. ++ */ ++ jh->b_modified = 0; ++ if (!jh->b_next_transaction) { ++ clear_buffer_freed(bh); ++ clear_buffer_jbddirty(bh); ++ clear_buffer_mapped(bh); ++ clear_buffer_new(bh); ++ clear_buffer_req(bh); ++ bh->b_bdev = NULL; ++ } + } + + if (buffer_jbddirty(bh)) { +diff --git a/fs/jbd/transaction.c b/fs/jbd/transaction.c +index 7e59c6e..edac004 100644 +--- a/fs/jbd/transaction.c ++++ b/fs/jbd/transaction.c +@@ -1839,15 +1839,16 @@ static int __dispose_buffer(struct journal_head *jh, transaction_t *transaction) + * We're outside-transaction here. Either or both of j_running_transaction + * and j_committing_transaction may be NULL. + */ +-static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh) ++static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh, ++ int partial_page) + { + transaction_t *transaction; + struct journal_head *jh; + int may_free = 1; +- int ret; + + BUFFER_TRACE(bh, "entry"); + ++retry: + /* + * It is safe to proceed here without the j_list_lock because the + * buffers cannot be stolen by try_to_free_buffers as long as we are +@@ -1875,10 +1876,18 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh) + * clear the buffer dirty bit at latest at the moment when the + * transaction marking the buffer as freed in the filesystem + * structures is committed because from that moment on the +- * buffer can be reallocated and used by a different page. ++ * block can be reallocated and used by a different page. + * Since the block hasn't been freed yet but the inode has + * already been added to orphan list, it is safe for us to add + * the buffer to BJ_Forget list of the newest transaction. ++ * ++ * Also we have to clear buffer_mapped flag of a truncated buffer ++ * because the buffer_head may be attached to the page straddling ++ * i_size (can happen only when blocksize < pagesize) and thus the ++ * buffer_head can be reused when the file is extended again. So we end ++ * up keeping around invalidated buffers attached to transactions' ++ * BJ_Forget list just to stop checkpointing code from cleaning up ++ * the transaction this buffer was modified in. + */ + transaction = jh->b_transaction; + if (transaction == NULL) { +@@ -1905,13 +1914,9 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh) + * committed, the buffer won't be needed any + * longer. */ + JBUFFER_TRACE(jh, "checkpointed: add to BJ_Forget"); +- ret = __dispose_buffer(jh, ++ may_free = __dispose_buffer(jh, + journal->j_running_transaction); +- journal_put_journal_head(jh); +- spin_unlock(&journal->j_list_lock); +- jbd_unlock_bh_state(bh); +- spin_unlock(&journal->j_state_lock); +- return ret; ++ goto zap_buffer; + } else { + /* There is no currently-running transaction. So the + * orphan record which we wrote for this file must have +@@ -1919,13 +1924,9 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh) + * the committing transaction, if it exists. */ + if (journal->j_committing_transaction) { + JBUFFER_TRACE(jh, "give to committing trans"); +- ret = __dispose_buffer(jh, ++ may_free = __dispose_buffer(jh, + journal->j_committing_transaction); +- journal_put_journal_head(jh); +- spin_unlock(&journal->j_list_lock); +- jbd_unlock_bh_state(bh); +- spin_unlock(&journal->j_state_lock); +- return ret; ++ goto zap_buffer; + } else { + /* The orphan record's transaction has + * committed. We can cleanse this buffer */ +@@ -1946,10 +1947,24 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh) + } + /* + * The buffer is committing, we simply cannot touch +- * it. So we just set j_next_transaction to the +- * running transaction (if there is one) and mark +- * buffer as freed so that commit code knows it should +- * clear dirty bits when it is done with the buffer. ++ * it. If the page is straddling i_size we have to wait ++ * for commit and try again. ++ */ ++ if (partial_page) { ++ tid_t tid = journal->j_committing_transaction->t_tid; ++ ++ journal_put_journal_head(jh); ++ spin_unlock(&journal->j_list_lock); ++ jbd_unlock_bh_state(bh); ++ spin_unlock(&journal->j_state_lock); ++ log_wait_commit(journal, tid); ++ goto retry; ++ } ++ /* ++ * OK, buffer won't be reachable after truncate. We just set ++ * j_next_transaction to the running transaction (if there is ++ * one) and mark buffer as freed so that commit code knows it ++ * should clear dirty bits when it is done with the buffer. + */ + set_buffer_freed(bh); + if (journal->j_running_transaction && buffer_jbddirty(bh)) +@@ -1972,6 +1987,14 @@ static int journal_unmap_buffer(journal_t *journal, struct buffer_head *bh) + } + + zap_buffer: ++ /* ++ * This is tricky. Although the buffer is truncated, it may be reused ++ * if blocksize < pagesize and it is attached to the page straddling ++ * EOF. Since the buffer might have been added to BJ_Forget list of the ++ * running transaction, journal_get_write_access() won't clear ++ * b_modified and credit accounting gets confused. So clear b_modified ++ * here. */ ++ jh->b_modified = 0; + journal_put_journal_head(jh); + zap_buffer_no_jh: + spin_unlock(&journal->j_list_lock); +@@ -2020,7 +2043,8 @@ void journal_invalidatepage(journal_t *journal, + if (offset <= curr_off) { + /* This block is wholly outside the truncation point */ + lock_buffer(bh); +- may_free &= journal_unmap_buffer(journal, bh); ++ may_free &= journal_unmap_buffer(journal, bh, ++ offset > 0); + unlock_buffer(bh); + } + curr_off = next_off; +diff --git a/fs/lockd/clntxdr.c b/fs/lockd/clntxdr.c +index 36057ce..6e2a2d5 100644 +--- a/fs/lockd/clntxdr.c ++++ b/fs/lockd/clntxdr.c +@@ -223,7 +223,7 @@ static void encode_nlm_stat(struct xdr_stream *xdr, + { + __be32 *p; + +- BUG_ON(be32_to_cpu(stat) > NLM_LCK_DENIED_GRACE_PERIOD); ++ WARN_ON_ONCE(be32_to_cpu(stat) > NLM_LCK_DENIED_GRACE_PERIOD); + p = xdr_reserve_space(xdr, 4); + *p = stat; + } +diff --git a/fs/lockd/mon.c b/fs/lockd/mon.c +index df753a1..23d7451 100644 +--- a/fs/lockd/mon.c ++++ b/fs/lockd/mon.c +@@ -40,7 +40,6 @@ struct nsm_args { + u32 proc; + + char *mon_name; +- char *nodename; + }; + + struct nsm_res { +@@ -94,7 +93,6 @@ static int nsm_mon_unmon(struct nsm_handle *nsm, u32 proc, struct nsm_res *res) + .vers = 3, + .proc = NLMPROC_NSM_NOTIFY, + .mon_name = nsm->sm_mon_name, +- .nodename = utsname()->nodename, + }; + struct rpc_message msg = { + .rpc_argp = &args, +@@ -431,7 +429,7 @@ static void encode_my_id(struct xdr_stream *xdr, const struct nsm_args *argp) + { + __be32 *p; + +- encode_nsm_string(xdr, argp->nodename); ++ encode_nsm_string(xdr, utsname()->nodename); + p = xdr_reserve_space(xdr, 4 + 4 + 4); + *p++ = cpu_to_be32(argp->prog); + *p++ = cpu_to_be32(argp->vers); +diff --git a/fs/lockd/svcproc.c b/fs/lockd/svcproc.c +index d27aab1..d413af3 100644 +--- a/fs/lockd/svcproc.c ++++ b/fs/lockd/svcproc.c +@@ -67,7 +67,8 @@ nlmsvc_retrieve_args(struct svc_rqst *rqstp, struct nlm_args *argp, + + /* Obtain file pointer. Not used by FREE_ALL call. */ + if (filp != NULL) { +- if ((error = nlm_lookup_file(rqstp, &file, &lock->fh)) != 0) ++ error = cast_status(nlm_lookup_file(rqstp, &file, &lock->fh)); ++ if (error != 0) + goto no_locks; + *filp = file; + +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index 4cfe260..d225b51 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -3673,6 +3673,7 @@ nfsd4_close(struct svc_rqst *rqstp, struct nfsd4_compound_state *cstate, + memcpy(&close->cl_stateid, &stp->st_stid.sc_stateid, sizeof(stateid_t)); + + nfsd4_close_open_stateid(stp); ++ release_last_closed_stateid(oo); + oo->oo_last_closed_stid = stp; + + /* place unused nfs4_stateowners on so_close_lru list to be +diff --git a/fs/proc/stat.c b/fs/proc/stat.c +index 0855e6f..4c9a859 100644 +--- a/fs/proc/stat.c ++++ b/fs/proc/stat.c +@@ -24,11 +24,14 @@ + + static cputime64_t get_idle_time(int cpu) + { +- u64 idle_time = get_cpu_idle_time_us(cpu, NULL); ++ u64 idle_time = -1ULL; + cputime64_t idle; + ++ if (cpu_online(cpu)) ++ idle_time = get_cpu_idle_time_us(cpu, NULL); ++ + if (idle_time == -1ULL) { +- /* !NO_HZ so we can rely on cpustat.idle */ ++ /* !NO_HZ or cpu offline so we can rely on cpustat.idle */ + idle = kstat_cpu(cpu).cpustat.idle; + idle = cputime64_add(idle, arch_idle_time(cpu)); + } else +@@ -39,11 +42,14 @@ static cputime64_t get_idle_time(int cpu) + + static cputime64_t get_iowait_time(int cpu) + { +- u64 iowait_time = get_cpu_iowait_time_us(cpu, NULL); ++ u64 iowait_time = -1ULL; + cputime64_t iowait; + ++ if (cpu_online(cpu)) ++ iowait_time = get_cpu_iowait_time_us(cpu, NULL); ++ + if (iowait_time == -1ULL) +- /* !NO_HZ so we can rely on cpustat.iowait */ ++ /* !NO_HZ or cpu offline so we can rely on cpustat.iowait */ + iowait = kstat_cpu(cpu).cpustat.iowait; + else + iowait = usecs_to_cputime64(iowait_time); +diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c +index 950f13a..5809abb 100644 +--- a/fs/reiserfs/inode.c ++++ b/fs/reiserfs/inode.c +@@ -1573,8 +1573,10 @@ struct dentry *reiserfs_fh_to_dentry(struct super_block *sb, struct fid *fid, + reiserfs_warning(sb, "reiserfs-13077", + "nfsd/reiserfs, fhtype=%d, len=%d - odd", + fh_type, fh_len); +- fh_type = 5; ++ fh_type = fh_len; + } ++ if (fh_len < 2) ++ return NULL; + + return reiserfs_get_dentry(sb, fid->raw[0], fid->raw[1], + (fh_type == 3 || fh_type >= 5) ? fid->raw[2] : 0); +@@ -1583,6 +1585,8 @@ struct dentry *reiserfs_fh_to_dentry(struct super_block *sb, struct fid *fid, + struct dentry *reiserfs_fh_to_parent(struct super_block *sb, struct fid *fid, + int fh_len, int fh_type) + { ++ if (fh_type > fh_len) ++ fh_type = fh_len; + if (fh_type < 4) + return NULL; + +diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c +index 7fdf6a7..fabbb81 100644 +--- a/fs/sysfs/dir.c ++++ b/fs/sysfs/dir.c +@@ -430,20 +430,18 @@ int __sysfs_add_one(struct sysfs_addrm_cxt *acxt, struct sysfs_dirent *sd) + /** + * sysfs_pathname - return full path to sysfs dirent + * @sd: sysfs_dirent whose path we want +- * @path: caller allocated buffer ++ * @path: caller allocated buffer of size PATH_MAX + * + * Gives the name "/" to the sysfs_root entry; any path returned + * is relative to wherever sysfs is mounted. +- * +- * XXX: does no error checking on @path size + */ + static char *sysfs_pathname(struct sysfs_dirent *sd, char *path) + { + if (sd->s_parent) { + sysfs_pathname(sd->s_parent, path); +- strcat(path, "/"); ++ strlcat(path, "/", PATH_MAX); + } +- strcat(path, sd->s_name); ++ strlcat(path, sd->s_name, PATH_MAX); + return path; + } + +@@ -476,9 +474,11 @@ int sysfs_add_one(struct sysfs_addrm_cxt *acxt, struct sysfs_dirent *sd) + char *path = kzalloc(PATH_MAX, GFP_KERNEL); + WARN(1, KERN_WARNING + "sysfs: cannot create duplicate filename '%s'\n", +- (path == NULL) ? sd->s_name : +- strcat(strcat(sysfs_pathname(acxt->parent_sd, path), "/"), +- sd->s_name)); ++ (path == NULL) ? sd->s_name ++ : (sysfs_pathname(acxt->parent_sd, path), ++ strlcat(path, "/", PATH_MAX), ++ strlcat(path, sd->s_name, PATH_MAX), ++ path)); + kfree(path); + } + +diff --git a/fs/xfs/xfs_export.c b/fs/xfs/xfs_export.c +index 558910f..5703fb8 100644 +--- a/fs/xfs/xfs_export.c ++++ b/fs/xfs/xfs_export.c +@@ -195,6 +195,9 @@ xfs_fs_fh_to_parent(struct super_block *sb, struct fid *fid, + struct xfs_fid64 *fid64 = (struct xfs_fid64 *)fid; + struct inode *inode = NULL; + ++ if (fh_len < xfs_fileid_length(fileid_type)) ++ return NULL; ++ + switch (fileid_type) { + case FILEID_INO32_GEN_PARENT: + inode = xfs_nfs_get_inode(sb, fid->i32.parent_ino, +diff --git a/include/linux/if_vlan.h b/include/linux/if_vlan.h +index 12d5543..c944c4f 100644 +--- a/include/linux/if_vlan.h ++++ b/include/linux/if_vlan.h +@@ -97,6 +97,8 @@ static inline int is_vlan_dev(struct net_device *dev) + } + + #define vlan_tx_tag_present(__skb) ((__skb)->vlan_tci & VLAN_TAG_PRESENT) ++#define vlan_tx_nonzero_tag_present(__skb) \ ++ (vlan_tx_tag_present(__skb) && ((__skb)->vlan_tci & VLAN_VID_MASK)) + #define vlan_tx_tag_get(__skb) ((__skb)->vlan_tci & ~VLAN_TAG_PRESENT) + + #if defined(CONFIG_VLAN_8021Q) || defined(CONFIG_VLAN_8021Q_MODULE) +@@ -106,7 +108,7 @@ extern struct net_device *__vlan_find_dev_deep(struct net_device *real_dev, + extern struct net_device *vlan_dev_real_dev(const struct net_device *dev); + extern u16 vlan_dev_vlan_id(const struct net_device *dev); + +-extern bool vlan_do_receive(struct sk_buff **skb, bool last_handler); ++extern bool vlan_do_receive(struct sk_buff **skb); + extern struct sk_buff *vlan_untag(struct sk_buff *skb); + + #else +@@ -128,10 +130,8 @@ static inline u16 vlan_dev_vlan_id(const struct net_device *dev) + return 0; + } + +-static inline bool vlan_do_receive(struct sk_buff **skb, bool last_handler) ++static inline bool vlan_do_receive(struct sk_buff **skb) + { +- if (((*skb)->vlan_tci & VLAN_VID_MASK) && last_handler) +- (*skb)->pkt_type = PACKET_OTHERHOST; + return false; + } + +diff --git a/include/linux/mtd/nand.h b/include/linux/mtd/nand.h +index 904131b..b25b09b 100644 +--- a/include/linux/mtd/nand.h ++++ b/include/linux/mtd/nand.h +@@ -215,9 +215,6 @@ typedef enum { + #define NAND_SUBPAGE_READ(chip) ((chip->ecc.mode == NAND_ECC_SOFT) \ + && (chip->page_shift > 9)) + +-/* Mask to zero out the chip options, which come from the id table */ +-#define NAND_CHIPOPTIONS_MSK (0x0000ffff & ~NAND_NO_AUTOINCR) +- + /* Non chip related options */ + /* This option skips the bbt scan during initialization. */ + #define NAND_SKIP_BBTSCAN 0x00010000 +diff --git a/include/linux/netfilter/xt_set.h b/include/linux/netfilter/xt_set.h +index c0405ac..e3a9978 100644 +--- a/include/linux/netfilter/xt_set.h ++++ b/include/linux/netfilter/xt_set.h +@@ -58,8 +58,8 @@ struct xt_set_info_target_v1 { + struct xt_set_info_target_v2 { + struct xt_set_info add_set; + struct xt_set_info del_set; +- u32 flags; +- u32 timeout; ++ __u32 flags; ++ __u32 timeout; + }; + + #endif /*_XT_SET_H*/ +diff --git a/include/net/netfilter/nf_conntrack_ecache.h b/include/net/netfilter/nf_conntrack_ecache.h +index a88fb69..ea6f8a4 100644 +--- a/include/net/netfilter/nf_conntrack_ecache.h ++++ b/include/net/netfilter/nf_conntrack_ecache.h +@@ -18,6 +18,7 @@ struct nf_conntrack_ecache { + u16 ctmask; /* bitmask of ct events to be delivered */ + u16 expmask; /* bitmask of expect events to be delivered */ + u32 pid; /* netlink pid of destroyer */ ++ struct timer_list timeout; + }; + + static inline struct nf_conntrack_ecache * +diff --git a/kernel/cgroup.c b/kernel/cgroup.c +index cdc0354..6337535 100644 +--- a/kernel/cgroup.c ++++ b/kernel/cgroup.c +@@ -1803,9 +1803,8 @@ static int cgroup_task_migrate(struct cgroup *cgrp, struct cgroup *oldcgrp, + * trading it for newcg is protected by cgroup_mutex, we're safe to drop + * it here; it will be freed under RCU. + */ +- put_css_set(oldcg); +- + set_bit(CGRP_RELEASABLE, &oldcgrp->flags); ++ put_css_set(oldcg); + return 0; + } + +diff --git a/kernel/module.c b/kernel/module.c +index 6969ef0..6c8fa34 100644 +--- a/kernel/module.c ++++ b/kernel/module.c +@@ -2659,6 +2659,10 @@ static int check_module_license_and_versions(struct module *mod) + if (strcmp(mod->name, "driverloader") == 0) + add_taint_module(mod, TAINT_PROPRIETARY_MODULE); + ++ /* lve claims to be GPL but upstream won't provide source */ ++ if (strcmp(mod->name, "lve") == 0) ++ add_taint_module(mod, TAINT_PROPRIETARY_MODULE); ++ + #ifdef CONFIG_MODVERSIONS + if ((mod->num_syms && !mod->crcs) + || (mod->num_gpl_syms && !mod->gpl_crcs) +diff --git a/kernel/sys.c b/kernel/sys.c +index c504302..d7c4ab0 100644 +--- a/kernel/sys.c ++++ b/kernel/sys.c +@@ -1171,15 +1171,16 @@ DECLARE_RWSEM(uts_sem); + * Work around broken programs that cannot handle "Linux 3.0". + * Instead we map 3.x to 2.6.40+x, so e.g. 3.0 would be 2.6.40 + */ +-static int override_release(char __user *release, int len) ++static int override_release(char __user *release, size_t len) + { + int ret = 0; +- char buf[65]; + + if (current->personality & UNAME26) { +- char *rest = UTS_RELEASE; ++ const char *rest = UTS_RELEASE; ++ char buf[65] = { 0 }; + int ndots = 0; + unsigned v; ++ size_t copy; + + while (*rest) { + if (*rest == '.' && ++ndots >= 3) +@@ -1189,8 +1190,9 @@ static int override_release(char __user *release, int len) + rest++; + } + v = ((LINUX_VERSION_CODE >> 8) & 0xff) + 40; +- snprintf(buf, len, "2.6.%u%s", v, rest); +- ret = copy_to_user(release, buf, len); ++ copy = min(sizeof(buf), max_t(size_t, 1, len)); ++ copy = scnprintf(buf, copy, "2.6.%u%s", v, rest); ++ ret = copy_to_user(release, buf, copy + 1); + } + return ret; + } +diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c +index 5ee1ac0..cb7f33e 100644 +--- a/kernel/time/timekeeping.c ++++ b/kernel/time/timekeeping.c +@@ -992,7 +992,7 @@ static cycle_t logarithmic_accumulation(cycle_t offset, int shift) + } + + /* Accumulate raw time */ +- raw_nsecs = timekeeper.raw_interval << shift; ++ raw_nsecs = (u64)timekeeper.raw_interval << shift; + raw_nsecs += raw_time.tv_nsec; + if (raw_nsecs >= NSEC_PER_SEC) { + u64 raw_secs = raw_nsecs; +diff --git a/kernel/timer.c b/kernel/timer.c +index 9c3c62b..c219db6 100644 +--- a/kernel/timer.c ++++ b/kernel/timer.c +@@ -63,6 +63,7 @@ EXPORT_SYMBOL(jiffies_64); + #define TVR_SIZE (1 << TVR_BITS) + #define TVN_MASK (TVN_SIZE - 1) + #define TVR_MASK (TVR_SIZE - 1) ++#define MAX_TVAL ((unsigned long)((1ULL << (TVR_BITS + 4*TVN_BITS)) - 1)) + + struct tvec { + struct list_head vec[TVN_SIZE]; +@@ -356,11 +357,12 @@ static void internal_add_timer(struct tvec_base *base, struct timer_list *timer) + vec = base->tv1.vec + (base->timer_jiffies & TVR_MASK); + } else { + int i; +- /* If the timeout is larger than 0xffffffff on 64-bit +- * architectures then we use the maximum timeout: ++ /* If the timeout is larger than MAX_TVAL (on 64-bit ++ * architectures or with CONFIG_BASE_SMALL=1) then we ++ * use the maximum timeout. + */ +- if (idx > 0xffffffffUL) { +- idx = 0xffffffffUL; ++ if (idx > MAX_TVAL) { ++ idx = MAX_TVAL; + expires = idx + base->timer_jiffies; + } + i = (expires >> (TVR_BITS + 3 * TVN_BITS)) & TVN_MASK; +diff --git a/lib/genalloc.c b/lib/genalloc.c +index f352cc4..716f947 100644 +--- a/lib/genalloc.c ++++ b/lib/genalloc.c +@@ -176,7 +176,7 @@ int gen_pool_add_virt(struct gen_pool *pool, unsigned long virt, phys_addr_t phy + struct gen_pool_chunk *chunk; + int nbits = size >> pool->min_alloc_order; + int nbytes = sizeof(struct gen_pool_chunk) + +- (nbits + BITS_PER_BYTE - 1) / BITS_PER_BYTE; ++ BITS_TO_LONGS(nbits) * sizeof(long); + + chunk = kmalloc_node(nbytes, GFP_KERNEL | __GFP_ZERO, nid); + if (unlikely(chunk == NULL)) +diff --git a/mm/rmap.c b/mm/rmap.c +index a4fd368..8685697 100644 +--- a/mm/rmap.c ++++ b/mm/rmap.c +@@ -56,6 +56,7 @@ + #include <linux/mmu_notifier.h> + #include <linux/migrate.h> + #include <linux/hugetlb.h> ++#include <linux/backing-dev.h> + + #include <asm/tlbflush.h> + +@@ -935,11 +936,8 @@ int page_mkclean(struct page *page) + + if (page_mapped(page)) { + struct address_space *mapping = page_mapping(page); +- if (mapping) { ++ if (mapping) + ret = page_mkclean_file(mapping, page); +- if (page_test_and_clear_dirty(page_to_pfn(page), 1)) +- ret = 1; +- } + } + + return ret; +@@ -1120,6 +1118,8 @@ void page_add_file_rmap(struct page *page) + */ + void page_remove_rmap(struct page *page) + { ++ struct address_space *mapping = page_mapping(page); ++ + /* page still mapped by someone else? */ + if (!atomic_add_negative(-1, &page->_mapcount)) + return; +@@ -1130,8 +1130,19 @@ void page_remove_rmap(struct page *page) + * this if the page is anon, so about to be freed; but perhaps + * not if it's in swapcache - there might be another pte slot + * containing the swap entry, but page not yet written to swap. ++ * ++ * And we can skip it on file pages, so long as the filesystem ++ * participates in dirty tracking; but need to catch shm and tmpfs ++ * and ramfs pages which have been modified since creation by read ++ * fault. ++ * ++ * Note that mapping must be decided above, before decrementing ++ * mapcount (which luckily provides a barrier): once page is unmapped, ++ * it could be truncated and page->mapping reset to NULL at any moment. ++ * Note also that we are relying on page_mapping(page) to set mapping ++ * to &swapper_space when PageSwapCache(page). + */ +- if ((!PageAnon(page) || PageSwapCache(page)) && ++ if (mapping && !mapping_cap_account_dirty(mapping) && + page_test_and_clear_dirty(page_to_pfn(page), 1)) + set_page_dirty(page); + /* +diff --git a/mm/shmem.c b/mm/shmem.c +index 7a82174..126ca35 100644 +--- a/mm/shmem.c ++++ b/mm/shmem.c +@@ -1962,12 +1962,14 @@ static struct dentry *shmem_fh_to_dentry(struct super_block *sb, + { + struct inode *inode; + struct dentry *dentry = NULL; +- u64 inum = fid->raw[2]; +- inum = (inum << 32) | fid->raw[1]; ++ u64 inum; + + if (fh_len < 3) + return NULL; + ++ inum = fid->raw[2]; ++ inum = (inum << 32) | fid->raw[1]; ++ + inode = ilookup5(sb, (unsigned long)(inum + fid->raw[0]), + shmem_match, fid->raw); + if (inode) { +diff --git a/net/8021q/vlan_core.c b/net/8021q/vlan_core.c +index 9ddbd4e..e860a4f 100644 +--- a/net/8021q/vlan_core.c ++++ b/net/8021q/vlan_core.c +@@ -5,7 +5,7 @@ + #include <linux/export.h> + #include "vlan.h" + +-bool vlan_do_receive(struct sk_buff **skbp, bool last_handler) ++bool vlan_do_receive(struct sk_buff **skbp) + { + struct sk_buff *skb = *skbp; + u16 vlan_id = skb->vlan_tci & VLAN_VID_MASK; +@@ -13,14 +13,8 @@ bool vlan_do_receive(struct sk_buff **skbp, bool last_handler) + struct vlan_pcpu_stats *rx_stats; + + vlan_dev = vlan_find_dev(skb->dev, vlan_id); +- if (!vlan_dev) { +- /* Only the last call to vlan_do_receive() should change +- * pkt_type to PACKET_OTHERHOST +- */ +- if (vlan_id && last_handler) +- skb->pkt_type = PACKET_OTHERHOST; ++ if (!vlan_dev) + return false; +- } + + skb = *skbp = skb_share_check(skb, GFP_ATOMIC); + if (unlikely(!skb)) +diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c +index c27b4e3..1849ee0 100644 +--- a/net/bluetooth/smp.c ++++ b/net/bluetooth/smp.c +@@ -30,6 +30,8 @@ + + #define SMP_TIMEOUT 30000 /* 30 seconds */ + ++#define AUTH_REQ_MASK 0x07 ++ + static inline void swap128(u8 src[16], u8 dst[16]) + { + int i; +@@ -206,7 +208,7 @@ static void build_pairing_cmd(struct l2cap_conn *conn, + req->max_key_size = SMP_MAX_ENC_KEY_SIZE; + req->init_key_dist = dist_keys; + req->resp_key_dist = dist_keys; +- req->auth_req = authreq; ++ req->auth_req = (authreq & AUTH_REQ_MASK); + return; + } + +@@ -215,7 +217,7 @@ static void build_pairing_cmd(struct l2cap_conn *conn, + rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE; + rsp->init_key_dist = req->init_key_dist & dist_keys; + rsp->resp_key_dist = req->resp_key_dist & dist_keys; +- rsp->auth_req = authreq; ++ rsp->auth_req = (authreq & AUTH_REQ_MASK); + } + + static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size) +diff --git a/net/core/dev.c b/net/core/dev.c +index abe1147..f500a69 100644 +--- a/net/core/dev.c ++++ b/net/core/dev.c +@@ -3278,18 +3278,18 @@ another_round: + ncls: + #endif + +- rx_handler = rcu_dereference(skb->dev->rx_handler); + if (vlan_tx_tag_present(skb)) { + if (pt_prev) { + ret = deliver_skb(skb, pt_prev, orig_dev); + pt_prev = NULL; + } +- if (vlan_do_receive(&skb, !rx_handler)) ++ if (vlan_do_receive(&skb)) + goto another_round; + else if (unlikely(!skb)) + goto out; + } + ++ rx_handler = rcu_dereference(skb->dev->rx_handler); + if (rx_handler) { + if (pt_prev) { + ret = deliver_skb(skb, pt_prev, orig_dev); +@@ -3309,6 +3309,9 @@ ncls: + } + } + ++ if (vlan_tx_nonzero_tag_present(skb)) ++ skb->pkt_type = PACKET_OTHERHOST; ++ + /* deliver only exact match when indicated */ + null_or_dev = deliver_exact ? skb->dev : NULL; + +diff --git a/net/core/neighbour.c b/net/core/neighbour.c +index 7aafaed..5b9709f 100644 +--- a/net/core/neighbour.c ++++ b/net/core/neighbour.c +@@ -1254,8 +1254,6 @@ int neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb) + if (!dst) + goto discard; + +- __skb_pull(skb, skb_network_offset(skb)); +- + if (!neigh_event_send(neigh, skb)) { + int err; + struct net_device *dev = neigh->dev; +@@ -1265,6 +1263,7 @@ int neigh_resolve_output(struct neighbour *neigh, struct sk_buff *skb) + neigh_hh_init(neigh, dst); + + do { ++ __skb_pull(skb, skb_network_offset(skb)); + seq = read_seqbegin(&neigh->ha_lock); + err = dev_hard_header(skb, dev, ntohs(skb->protocol), + neigh->ha, NULL, skb->len); +@@ -1295,9 +1294,8 @@ int neigh_connected_output(struct neighbour *neigh, struct sk_buff *skb) + unsigned int seq; + int err; + +- __skb_pull(skb, skb_network_offset(skb)); +- + do { ++ __skb_pull(skb, skb_network_offset(skb)); + seq = read_seqbegin(&neigh->ha_lock); + err = dev_hard_header(skb, dev, ntohs(skb->protocol), + neigh->ha, NULL, skb->len); +diff --git a/net/core/pktgen.c b/net/core/pktgen.c +index df878de..7bc9991 100644 +--- a/net/core/pktgen.c ++++ b/net/core/pktgen.c +@@ -2935,7 +2935,7 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev, + sizeof(struct ipv6hdr) - sizeof(struct udphdr) - + pkt_dev->pkt_overhead; + +- if (datalen < sizeof(struct pktgen_hdr)) { ++ if (datalen < 0 || datalen < sizeof(struct pktgen_hdr)) { + datalen = sizeof(struct pktgen_hdr); + if (net_ratelimit()) + pr_info("increased datalen to %d\n", datalen); +diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c +index de69cec..58c09a0 100644 +--- a/net/ipv4/tcp_ipv4.c ++++ b/net/ipv4/tcp_ipv4.c +@@ -651,10 +651,11 @@ static void tcp_v4_send_reset(struct sock *sk, struct sk_buff *skb) + arg.csumoffset = offsetof(struct tcphdr, check) / 2; + arg.flags = (sk && inet_sk(sk)->transparent) ? IP_REPLY_ARG_NOSRCCHECK : 0; + /* When socket is gone, all binding information is lost. +- * routing might fail in this case. using iif for oif to +- * make sure we can deliver it ++ * routing might fail in this case. No choice here, if we choose to force ++ * input interface, we will misroute in case of asymmetric route. + */ +- arg.bound_dev_if = sk ? sk->sk_bound_dev_if : inet_iif(skb); ++ if (sk) ++ arg.bound_dev_if = sk->sk_bound_dev_if; + + net = dev_net(skb_dst(skb)->dev); + arg.tos = ip_hdr(skb)->tos; +diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c +index 4a56574..ccab3c8 100644 +--- a/net/ipv6/tcp_ipv6.c ++++ b/net/ipv6/tcp_ipv6.c +@@ -1048,7 +1048,8 @@ static void tcp_v6_send_response(struct sk_buff *skb, u32 seq, u32 ack, u32 win, + __tcp_v6_send_check(buff, &fl6.saddr, &fl6.daddr); + + fl6.flowi6_proto = IPPROTO_TCP; +- fl6.flowi6_oif = inet6_iif(skb); ++ if (ipv6_addr_type(&fl6.daddr) & IPV6_ADDR_LINKLOCAL) ++ fl6.flowi6_oif = inet6_iif(skb); + fl6.fl6_dport = t1->dest; + fl6.fl6_sport = t1->source; + security_skb_classify_flow(skb, flowi6_to_flowi(&fl6)); +diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c +index 28a39bb..a582504 100644 +--- a/net/mac80211/wpa.c ++++ b/net/mac80211/wpa.c +@@ -106,7 +106,8 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx) + if (status->flag & RX_FLAG_MMIC_ERROR) + goto mic_fail; + +- if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key) ++ if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key && ++ rx->key->conf.cipher == WLAN_CIPHER_SUITE_TKIP) + goto update_iv; + + return RX_CONTINUE; +diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c +index 1d15193..7489bd3 100644 +--- a/net/netfilter/nf_conntrack_core.c ++++ b/net/netfilter/nf_conntrack_core.c +@@ -247,12 +247,15 @@ static void death_by_event(unsigned long ul_conntrack) + { + struct nf_conn *ct = (void *)ul_conntrack; + struct net *net = nf_ct_net(ct); ++ struct nf_conntrack_ecache *ecache = nf_ct_ecache_find(ct); ++ ++ BUG_ON(ecache == NULL); + + if (nf_conntrack_event(IPCT_DESTROY, ct) < 0) { + /* bad luck, let's retry again */ +- ct->timeout.expires = jiffies + ++ ecache->timeout.expires = jiffies + + (random32() % net->ct.sysctl_events_retry_timeout); +- add_timer(&ct->timeout); ++ add_timer(&ecache->timeout); + return; + } + /* we've got the event delivered, now it's dying */ +@@ -266,6 +269,9 @@ static void death_by_event(unsigned long ul_conntrack) + void nf_ct_insert_dying_list(struct nf_conn *ct) + { + struct net *net = nf_ct_net(ct); ++ struct nf_conntrack_ecache *ecache = nf_ct_ecache_find(ct); ++ ++ BUG_ON(ecache == NULL); + + /* add this conntrack to the dying list */ + spin_lock_bh(&nf_conntrack_lock); +@@ -273,10 +279,10 @@ void nf_ct_insert_dying_list(struct nf_conn *ct) + &net->ct.dying); + spin_unlock_bh(&nf_conntrack_lock); + /* set a new timer to retry event delivery */ +- setup_timer(&ct->timeout, death_by_event, (unsigned long)ct); +- ct->timeout.expires = jiffies + ++ setup_timer(&ecache->timeout, death_by_event, (unsigned long)ct); ++ ecache->timeout.expires = jiffies + + (random32() % net->ct.sysctl_events_retry_timeout); +- add_timer(&ct->timeout); ++ add_timer(&ecache->timeout); + } + EXPORT_SYMBOL_GPL(nf_ct_insert_dying_list); + +diff --git a/net/rds/send.c b/net/rds/send.c +index 96531d4..88eace5 100644 +--- a/net/rds/send.c ++++ b/net/rds/send.c +@@ -1122,7 +1122,7 @@ rds_send_pong(struct rds_connection *conn, __be16 dport) + rds_stats_inc(s_send_pong); + + if (!test_bit(RDS_LL_SEND_FULL, &conn->c_flags)) +- rds_send_xmit(conn); ++ queue_delayed_work(rds_wq, &conn->c_send_w, 0); + + rds_message_put(rm); + return 0; +diff --git a/net/sunrpc/cache.c b/net/sunrpc/cache.c +index 4530a91..237a2ee 100644 +--- a/net/sunrpc/cache.c ++++ b/net/sunrpc/cache.c +@@ -1404,11 +1404,11 @@ static ssize_t read_flush(struct file *file, char __user *buf, + size_t count, loff_t *ppos, + struct cache_detail *cd) + { +- char tbuf[20]; ++ char tbuf[22]; + unsigned long p = *ppos; + size_t len; + +- sprintf(tbuf, "%lu\n", convert_to_wallclock(cd->flush_time)); ++ snprintf(tbuf, sizeof(tbuf), "%lu\n", convert_to_wallclock(cd->flush_time)); + len = strlen(tbuf); + if (p >= len) + return 0; +diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c +index 10a385b..65fe23b 100644 +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -254,7 +254,6 @@ struct sock_xprt { + void (*old_data_ready)(struct sock *, int); + void (*old_state_change)(struct sock *); + void (*old_write_space)(struct sock *); +- void (*old_error_report)(struct sock *); + }; + + /* +@@ -737,10 +736,10 @@ static int xs_tcp_send_request(struct rpc_task *task) + dprintk("RPC: sendmsg returned unrecognized error %d\n", + -status); + case -ECONNRESET: +- case -EPIPE: + xs_tcp_shutdown(xprt); + case -ECONNREFUSED: + case -ENOTCONN: ++ case -EPIPE: + clear_bit(SOCK_ASYNC_NOSPACE, &transport->sock->flags); + } + +@@ -781,7 +780,6 @@ static void xs_save_old_callbacks(struct sock_xprt *transport, struct sock *sk) + transport->old_data_ready = sk->sk_data_ready; + transport->old_state_change = sk->sk_state_change; + transport->old_write_space = sk->sk_write_space; +- transport->old_error_report = sk->sk_error_report; + } + + static void xs_restore_old_callbacks(struct sock_xprt *transport, struct sock *sk) +@@ -789,7 +787,6 @@ static void xs_restore_old_callbacks(struct sock_xprt *transport, struct sock *s + sk->sk_data_ready = transport->old_data_ready; + sk->sk_state_change = transport->old_state_change; + sk->sk_write_space = transport->old_write_space; +- sk->sk_error_report = transport->old_error_report; + } + + static void xs_reset_transport(struct sock_xprt *transport) +@@ -1465,7 +1462,7 @@ static void xs_tcp_cancel_linger_timeout(struct rpc_xprt *xprt) + xprt_clear_connecting(xprt); + } + +-static void xs_sock_mark_closed(struct rpc_xprt *xprt) ++static void xs_sock_reset_connection_flags(struct rpc_xprt *xprt) + { + smp_mb__before_clear_bit(); + clear_bit(XPRT_CONNECTION_ABORT, &xprt->state); +@@ -1473,6 +1470,11 @@ static void xs_sock_mark_closed(struct rpc_xprt *xprt) + clear_bit(XPRT_CLOSE_WAIT, &xprt->state); + clear_bit(XPRT_CLOSING, &xprt->state); + smp_mb__after_clear_bit(); ++} ++ ++static void xs_sock_mark_closed(struct rpc_xprt *xprt) ++{ ++ xs_sock_reset_connection_flags(xprt); + /* Mark transport as closed and wake up all pending tasks */ + xprt_disconnect_done(xprt); + } +@@ -1528,6 +1530,7 @@ static void xs_tcp_state_change(struct sock *sk) + case TCP_CLOSE_WAIT: + /* The server initiated a shutdown of the socket */ + xprt->connect_cookie++; ++ clear_bit(XPRT_CONNECTED, &xprt->state); + xs_tcp_force_close(xprt); + case TCP_CLOSING: + /* +@@ -1552,25 +1555,6 @@ static void xs_tcp_state_change(struct sock *sk) + read_unlock_bh(&sk->sk_callback_lock); + } + +-/** +- * xs_error_report - callback mainly for catching socket errors +- * @sk: socket +- */ +-static void xs_error_report(struct sock *sk) +-{ +- struct rpc_xprt *xprt; +- +- read_lock_bh(&sk->sk_callback_lock); +- if (!(xprt = xprt_from_sock(sk))) +- goto out; +- dprintk("RPC: %s client %p...\n" +- "RPC: error %d\n", +- __func__, xprt, sk->sk_err); +- xprt_wake_pending_tasks(xprt, -EAGAIN); +-out: +- read_unlock_bh(&sk->sk_callback_lock); +-} +- + static void xs_write_space(struct sock *sk) + { + struct socket *sock; +@@ -1870,7 +1854,6 @@ static int xs_local_finish_connecting(struct rpc_xprt *xprt, + sk->sk_user_data = xprt; + sk->sk_data_ready = xs_local_data_ready; + sk->sk_write_space = xs_udp_write_space; +- sk->sk_error_report = xs_error_report; + sk->sk_allocation = GFP_ATOMIC; + + xprt_clear_connected(xprt); +@@ -1959,7 +1942,6 @@ static void xs_udp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock) + sk->sk_user_data = xprt; + sk->sk_data_ready = xs_udp_data_ready; + sk->sk_write_space = xs_udp_write_space; +- sk->sk_error_report = xs_error_report; + sk->sk_no_check = UDP_CSUM_NORCV; + sk->sk_allocation = GFP_ATOMIC; + +@@ -2027,10 +2009,8 @@ static void xs_abort_connection(struct sock_xprt *transport) + any.sa_family = AF_UNSPEC; + result = kernel_connect(transport->sock, &any, sizeof(any), 0); + if (!result) +- xs_sock_mark_closed(&transport->xprt); +- else +- dprintk("RPC: AF_UNSPEC connect return code %d\n", +- result); ++ xs_sock_reset_connection_flags(&transport->xprt); ++ dprintk("RPC: AF_UNSPEC connect return code %d\n", result); + } + + static void xs_tcp_reuse_connection(struct sock_xprt *transport) +@@ -2075,7 +2055,6 @@ static int xs_tcp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock) + sk->sk_data_ready = xs_tcp_data_ready; + sk->sk_state_change = xs_tcp_state_change; + sk->sk_write_space = xs_tcp_write_space; +- sk->sk_error_report = xs_error_report; + sk->sk_allocation = GFP_ATOMIC; + + /* socket options */ +@@ -2488,6 +2467,7 @@ static struct rpc_xprt_ops xs_tcp_ops = { + static struct rpc_xprt_ops bc_tcp_ops = { + .reserve_xprt = xprt_reserve_xprt, + .release_xprt = xprt_release_xprt, ++ .alloc_slot = xprt_alloc_slot, + .buf_alloc = bc_malloc, + .buf_free = bc_free, + .send_request = bc_send_request, +diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c +index fac51ee..1e7cfba 100644 +--- a/sound/pci/ac97/ac97_codec.c ++++ b/sound/pci/ac97/ac97_codec.c +@@ -1271,6 +1271,8 @@ static int snd_ac97_cvol_new(struct snd_card *card, char *name, int reg, unsigne + tmp.index = ac97->num; + kctl = snd_ctl_new1(&tmp, ac97); + } ++ if (!kctl) ++ return -ENOMEM; + if (reg >= AC97_PHONE && reg <= AC97_PCM) + set_tlv_db_scale(kctl, db_scale_5bit_12db_max); + else +diff --git a/sound/pci/emu10k1/emu10k1_main.c b/sound/pci/emu10k1/emu10k1_main.c +index 6a3e567..d37b946 100644 +--- a/sound/pci/emu10k1/emu10k1_main.c ++++ b/sound/pci/emu10k1/emu10k1_main.c +@@ -1416,6 +1416,15 @@ static struct snd_emu_chip_details emu_chip_details[] = { + .ca0108_chip = 1, + .spk71 = 1, + .emu_model = EMU_MODEL_EMU1010B}, /* EMU 1010 new revision */ ++ /* Tested by Maxim Kachur <mcdebugger@duganet.ru> 17th Oct 2012. */ ++ /* This is MAEM8986, 0202 is MAEM8980 */ ++ {.vendor = 0x1102, .device = 0x0008, .subsystem = 0x40071102, ++ .driver = "Audigy2", .name = "E-mu 1010 PCIe [MAEM8986]", ++ .id = "EMU1010", ++ .emu10k2_chip = 1, ++ .ca0108_chip = 1, ++ .spk71 = 1, ++ .emu_model = EMU_MODEL_EMU1010B}, /* EMU 1010 PCIe */ + /* Tested by James@superbug.co.uk 8th July 2005. */ + /* This is MAEM8810, 0202 is MAEM8820 */ + {.vendor = 0x1102, .device = 0x0004, .subsystem = 0x40011102, +diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c +index ec0518e..e449278 100644 +--- a/sound/pci/hda/patch_cirrus.c ++++ b/sound/pci/hda/patch_cirrus.c +@@ -1404,7 +1404,7 @@ static int patch_cs420x(struct hda_codec *codec) + return 0; + + error: +- kfree(codec->spec); ++ cs_free(codec); + codec->spec = NULL; + return err; + } +@@ -1949,7 +1949,7 @@ static int patch_cs421x(struct hda_codec *codec) + return 0; + + error: +- kfree(codec->spec); ++ cs_free(codec); + codec->spec = NULL; + return err; + } +diff --git a/sound/pci/hda/patch_conexant.c b/sound/pci/hda/patch_conexant.c +index 94f0c4a..58c287b 100644 +--- a/sound/pci/hda/patch_conexant.c ++++ b/sound/pci/hda/patch_conexant.c +@@ -4463,7 +4463,9 @@ static void apply_fixup(struct hda_codec *codec, + struct conexant_spec *spec = codec->spec; + + quirk = snd_pci_quirk_lookup(codec->bus->pci, quirk); +- if (quirk && table[quirk->value]) { ++ if (!quirk) ++ return; ++ if (table[quirk->value]) { + snd_printdd(KERN_INFO "hda_codec: applying pincfg for %s\n", + quirk->name); + apply_pincfg(codec, table[quirk->value]); +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 32c8169..c2c7f90 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -620,6 +620,8 @@ static void alc_line_automute(struct hda_codec *codec) + { + struct alc_spec *spec = codec->spec; + ++ if (spec->autocfg.line_out_type == AUTO_PIN_SPEAKER_OUT) ++ return; + /* check LO jack only when it's different from HP */ + if (spec->autocfg.line_out_pins[0] == spec->autocfg.hp_pins[0]) + return; +@@ -2663,8 +2665,10 @@ static const char *alc_get_line_out_pfx(struct alc_spec *spec, int ch, + return "PCM"; + break; + } +- if (snd_BUG_ON(ch >= ARRAY_SIZE(channel_name))) ++ if (ch >= ARRAY_SIZE(channel_name)) { ++ snd_BUG(); + return "PCM"; ++ } + + return channel_name[ch]; + } +@@ -5080,6 +5084,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x21e9, "Thinkpad Edge 15", ALC269_FIXUP_SKU_IGNORE), + SND_PCI_QUIRK(0x17aa, 0x21f6, "Thinkpad T530", ALC269_FIXUP_LENOVO_DOCK), + SND_PCI_QUIRK(0x17aa, 0x21fa, "Thinkpad X230", ALC269_FIXUP_LENOVO_DOCK), ++ SND_PCI_QUIRK(0x17aa, 0x21f3, "Thinkpad T430", ALC269_FIXUP_LENOVO_DOCK), + SND_PCI_QUIRK(0x17aa, 0x21fb, "Thinkpad T430s", ALC269_FIXUP_LENOVO_DOCK), + SND_PCI_QUIRK(0x17aa, 0x2203, "Thinkpad X230 Tablet", ALC269_FIXUP_LENOVO_DOCK), + SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K), +diff --git a/usr/gen_init_cpio.c b/usr/gen_init_cpio.c +index af0f22f..aca6edc 100644 +--- a/usr/gen_init_cpio.c ++++ b/usr/gen_init_cpio.c +@@ -303,7 +303,7 @@ static int cpio_mkfile(const char *name, const char *location, + int retval; + int rc = -1; + int namesize; +- int i; ++ unsigned int i; + + mode |= S_IFREG; + +@@ -381,25 +381,28 @@ error: + + static char *cpio_replace_env(char *new_location) + { +- char expanded[PATH_MAX + 1]; +- char env_var[PATH_MAX + 1]; +- char *start; +- char *end; +- +- for (start = NULL; (start = strstr(new_location, "${")); ) { +- end = strchr(start, '}'); +- if (start < end) { +- *env_var = *expanded = '\0'; +- strncat(env_var, start + 2, end - start - 2); +- strncat(expanded, new_location, start - new_location); +- strncat(expanded, getenv(env_var), PATH_MAX); +- strncat(expanded, end + 1, PATH_MAX); +- strncpy(new_location, expanded, PATH_MAX); +- } else +- break; +- } +- +- return new_location; ++ char expanded[PATH_MAX + 1]; ++ char env_var[PATH_MAX + 1]; ++ char *start; ++ char *end; ++ ++ for (start = NULL; (start = strstr(new_location, "${")); ) { ++ end = strchr(start, '}'); ++ if (start < end) { ++ *env_var = *expanded = '\0'; ++ strncat(env_var, start + 2, end - start - 2); ++ strncat(expanded, new_location, start - new_location); ++ strncat(expanded, getenv(env_var), ++ PATH_MAX - strlen(expanded)); ++ strncat(expanded, end + 1, ++ PATH_MAX - strlen(expanded)); ++ strncpy(new_location, expanded, PATH_MAX); ++ new_location[PATH_MAX] = 0; ++ } else ++ break; ++ } ++ ++ return new_location; + } + + diff --git a/3.2.32/4420_grsecurity-2.9.1-3.2.32-201210291445.patch b/3.2.33/4420_grsecurity-2.9.1-3.2.33-201210310843.patch index 7d16a10..81903cd 100644 --- a/3.2.32/4420_grsecurity-2.9.1-3.2.32-201210291445.patch +++ b/3.2.33/4420_grsecurity-2.9.1-3.2.33-201210310843.patch @@ -255,7 +255,7 @@ index 88fd7f5..b318a78 100644 ============================================================== diff --git a/Makefile b/Makefile -index b6d8282..f804e48 100644 +index 63ca1ea2..811946a 100644 --- a/Makefile +++ b/Makefile @@ -245,8 +245,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \ @@ -5996,7 +5996,7 @@ index 42b282f..28ce9f2 100644 addr = vmm->vm_end; if (flags & MAP_SHARED) diff --git a/arch/sparc/kernel/sys_sparc_64.c b/arch/sparc/kernel/sys_sparc_64.c -index 441521a..b767073 100644 +index 5e4252b..cbc22e8 100644 --- a/arch/sparc/kernel/sys_sparc_64.c +++ b/arch/sparc/kernel/sys_sparc_64.c @@ -124,7 +124,7 @@ unsigned long arch_get_unmapped_area(struct file *filp, unsigned long addr, unsi @@ -6147,7 +6147,7 @@ index 441521a..b767073 100644 mm->unmap_area = arch_unmap_area_topdown; } diff --git a/arch/sparc/kernel/syscalls.S b/arch/sparc/kernel/syscalls.S -index 1d7e274..b39c527 100644 +index 7f5f65d..3308382 100644 --- a/arch/sparc/kernel/syscalls.S +++ b/arch/sparc/kernel/syscalls.S @@ -62,7 +62,7 @@ sys32_rt_sigreturn: @@ -6177,24 +6177,15 @@ index 1d7e274..b39c527 100644 bne,pn %icc, linux_syscall_trace ! CTI Group mov %i0, %l5 ! IEU0 2: call %l7 ! CTI Group brk forced -@@ -226,7 +226,7 @@ ret_sys_call: +@@ -218,7 +218,7 @@ ret_sys_call: cmp %o0, -ERESTART_RESTARTBLOCK bgeu,pn %xcc, 1f -- andcc %l0, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT|_TIF_SYSCALL_TRACEPOINT), %l6 -+ andcc %l0, _TIF_WORK_SYSCALL, %l6 - 80: - /* System call success, clear Carry condition code. */ - andn %g3, %g2, %g3 -@@ -241,7 +241,7 @@ ret_sys_call: - /* System call failure, set Carry condition code. - * Also, get abs(errno) to return to the process. - */ -- andcc %l0, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT|_TIF_SYSCALL_TRACEPOINT), %l6 -+ andcc %l0, _TIF_WORK_SYSCALL, %l6 - sub %g0, %o0, %o0 - or %g3, %g2, %g3 - stx %o0, [%sp + PTREGS_OFF + PT_V9_I0] +- andcc %l0, (_TIF_SYSCALL_TRACE|_TIF_SECCOMP|_TIF_SYSCALL_AUDIT|_TIF_SYSCALL_TRACEPOINT), %g0 ++ andcc %l0, _TIF_WORK_SYSCALL, %g0 + ldx [%sp + PTREGS_OFF + PT_V9_TNPC], %l1 ! pc = npc + + 2: diff --git a/arch/sparc/kernel/traps_32.c b/arch/sparc/kernel/traps_32.c index 591f20c..0f1b925 100644 --- a/arch/sparc/kernel/traps_32.c @@ -15002,7 +14993,7 @@ index cd28a35..c72ed9a 100644 #include <asm/processor.h> #include <asm/fcntl.h> diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S -index bcda816..cbab6db 100644 +index 4893d58..0152a42 100644 --- a/arch/x86/kernel/entry_32.S +++ b/arch/x86/kernel/entry_32.S @@ -180,13 +180,153 @@ @@ -15685,7 +15676,7 @@ index bcda816..cbab6db 100644 /* * End of kprobes section */ -@@ -1112,7 +1377,7 @@ BUILD_INTERRUPT3(xen_hvm_callback_vector, XEN_HVM_EVTCHN_CALLBACK, +@@ -1114,7 +1379,7 @@ BUILD_INTERRUPT3(xen_hvm_callback_vector, XEN_HVM_EVTCHN_CALLBACK, ENTRY(mcount) ret @@ -15694,7 +15685,7 @@ index bcda816..cbab6db 100644 ENTRY(ftrace_caller) cmpl $0, function_trace_stop -@@ -1141,7 +1406,7 @@ ftrace_graph_call: +@@ -1143,7 +1408,7 @@ ftrace_graph_call: .globl ftrace_stub ftrace_stub: ret @@ -15703,7 +15694,7 @@ index bcda816..cbab6db 100644 #else /* ! CONFIG_DYNAMIC_FTRACE */ -@@ -1177,7 +1442,7 @@ trace: +@@ -1179,7 +1444,7 @@ trace: popl %ecx popl %eax jmp ftrace_stub @@ -15712,7 +15703,7 @@ index bcda816..cbab6db 100644 #endif /* CONFIG_DYNAMIC_FTRACE */ #endif /* CONFIG_FUNCTION_TRACER */ -@@ -1198,7 +1463,7 @@ ENTRY(ftrace_graph_caller) +@@ -1200,7 +1465,7 @@ ENTRY(ftrace_graph_caller) popl %ecx popl %eax ret @@ -15721,7 +15712,7 @@ index bcda816..cbab6db 100644 .globl return_to_handler return_to_handler: -@@ -1212,7 +1477,6 @@ return_to_handler: +@@ -1214,7 +1479,6 @@ return_to_handler: jmp *%ecx #endif @@ -15729,7 +15720,7 @@ index bcda816..cbab6db 100644 #include "syscall_table_32.S" syscall_table_size=(.-sys_call_table) -@@ -1258,15 +1522,18 @@ error_code: +@@ -1260,15 +1524,18 @@ error_code: movl $-1, PT_ORIG_EAX(%esp) # no syscall to restart REG_TO_PTGS %ecx SET_KERNEL_GS %ecx @@ -15750,7 +15741,7 @@ index bcda816..cbab6db 100644 /* * Debug traps and NMI can happen at the one SYSENTER instruction -@@ -1308,7 +1575,7 @@ debug_stack_correct: +@@ -1310,7 +1577,7 @@ debug_stack_correct: call do_debug jmp ret_from_exception CFI_ENDPROC @@ -15759,7 +15750,7 @@ index bcda816..cbab6db 100644 /* * NMI is doubly nasty. It can happen _while_ we're handling -@@ -1345,6 +1612,9 @@ nmi_stack_correct: +@@ -1347,6 +1614,9 @@ nmi_stack_correct: xorl %edx,%edx # zero error code movl %esp,%eax # pt_regs pointer call do_nmi @@ -15769,7 +15760,7 @@ index bcda816..cbab6db 100644 jmp restore_all_notrace CFI_ENDPROC -@@ -1381,12 +1651,15 @@ nmi_espfix_stack: +@@ -1383,12 +1653,15 @@ nmi_espfix_stack: FIXUP_ESPFIX_STACK # %eax == %esp xorl %edx,%edx # zero error code call do_nmi @@ -15786,7 +15777,7 @@ index bcda816..cbab6db 100644 ENTRY(int3) RING0_INT_FRAME -@@ -1398,14 +1671,14 @@ ENTRY(int3) +@@ -1400,14 +1673,14 @@ ENTRY(int3) call do_int3 jmp ret_from_exception CFI_ENDPROC @@ -15803,7 +15794,7 @@ index bcda816..cbab6db 100644 #ifdef CONFIG_KVM_GUEST ENTRY(async_page_fault) -@@ -1413,7 +1686,7 @@ ENTRY(async_page_fault) +@@ -1415,7 +1688,7 @@ ENTRY(async_page_fault) pushl_cfi $do_async_page_fault jmp error_code CFI_ENDPROC @@ -15813,7 +15804,7 @@ index bcda816..cbab6db 100644 /* diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S -index faf8d5e..ed7340c 100644 +index 6274f5f..b451ef1 100644 --- a/arch/x86/kernel/entry_64.S +++ b/arch/x86/kernel/entry_64.S @@ -55,6 +55,8 @@ @@ -27436,7 +27427,7 @@ index 153407c..611cba9 100644 -} -__setup("vdso=", vdso_setup); diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c -index a1e21ae..0b6bc7b 100644 +index 69b9ef6..cbe5f3a 100644 --- a/arch/x86/xen/enlighten.c +++ b/arch/x86/xen/enlighten.c @@ -86,8 +86,6 @@ EXPORT_SYMBOL_GPL(xen_start_info); @@ -27467,7 +27458,7 @@ index a1e21ae..0b6bc7b 100644 } #endif -@@ -1041,7 +1039,7 @@ static const struct pv_apic_ops xen_apic_ops __initconst = { +@@ -1057,7 +1055,7 @@ static const struct pv_apic_ops xen_apic_ops __initconst = { #endif }; @@ -27476,7 +27467,7 @@ index a1e21ae..0b6bc7b 100644 { struct sched_shutdown r = { .reason = reason }; -@@ -1049,17 +1047,17 @@ static void xen_reboot(int reason) +@@ -1065,17 +1063,17 @@ static void xen_reboot(int reason) BUG(); } @@ -27497,7 +27488,7 @@ index a1e21ae..0b6bc7b 100644 { xen_reboot(SHUTDOWN_poweroff); } -@@ -1165,7 +1163,17 @@ asmlinkage void __init xen_start_kernel(void) +@@ -1181,7 +1179,17 @@ asmlinkage void __init xen_start_kernel(void) __userpte_alloc_gfp &= ~__GFP_HIGHMEM; /* Work out if we support NX */ @@ -27516,7 +27507,7 @@ index a1e21ae..0b6bc7b 100644 xen_setup_features(); -@@ -1196,13 +1204,6 @@ asmlinkage void __init xen_start_kernel(void) +@@ -1212,13 +1220,6 @@ asmlinkage void __init xen_start_kernel(void) machine_ops = xen_machine_ops; @@ -30155,7 +30146,7 @@ index 1ee8ce7..b778bef 100644 return 0; diff --git a/drivers/char/tpm/tpm.c b/drivers/char/tpm/tpm.c -index b366b34..7e61653 100644 +index 0d91655..96118e0 100644 --- a/drivers/char/tpm/tpm.c +++ b/drivers/char/tpm/tpm.c @@ -414,7 +414,7 @@ static ssize_t tpm_transmit(struct tpm_chip *chip, const char *buf, @@ -30250,10 +30241,10 @@ index eb1d864..39ee5a7 100644 pr_info("dmatest: Started %u threads using %s\n", diff --git a/drivers/edac/amd64_edac.c b/drivers/edac/amd64_edac.c -index c9eee6d..f9d5280 100644 +index a9d5482..376077f 100644 --- a/drivers/edac/amd64_edac.c +++ b/drivers/edac/amd64_edac.c -@@ -2685,7 +2685,7 @@ static void __devexit amd64_remove_one_instance(struct pci_dev *pdev) +@@ -2682,7 +2682,7 @@ static void __devexit amd64_remove_one_instance(struct pci_dev *pdev) * PCI core identifies what devices are on a system during boot, and then * inquiry this table to see if this driver is for a given device found. */ @@ -31972,10 +31963,10 @@ index 4ef02b2..8a96831 100644 for (i = 0; i < hid->maxcollection; i++) diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c -index 4065374..10ed7dc 100644 +index f4c3d28..82f45a9 100644 --- a/drivers/hv/channel.c +++ b/drivers/hv/channel.c -@@ -400,8 +400,8 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer, +@@ -402,8 +402,8 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer, int ret = 0; int t; @@ -34363,7 +34354,7 @@ index 62306e5..c32000a 100644 "md/raid1:%s: read error corrected " "(%d sectors at %llu on %s)\n", diff --git a/drivers/md/raid10.c b/drivers/md/raid10.c -index 0634ee5..1686c46 100644 +index 8f67c4d..cea5925 100644 --- a/drivers/md/raid10.c +++ b/drivers/md/raid10.c @@ -1455,7 +1455,7 @@ static void end_sync_read(struct bio *bio, int error) @@ -42615,7 +42606,7 @@ index 3c14e43..eafa544 100644 +4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 4 +4 4 4 4 4 4 diff --git a/drivers/video/udlfb.c b/drivers/video/udlfb.c -index 41746bb..febcb44 100644 +index cb5988f..a44fee7 100644 --- a/drivers/video/udlfb.c +++ b/drivers/video/udlfb.c @@ -619,11 +619,11 @@ int dlfb_handle_damage(struct dlfb_data *dev, int x, int y, @@ -44871,19 +44862,10 @@ index 112e45a..b59845b 100644 /* diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c -index 51352de..93292ff 100644 +index f854cf9..93292ff 100644 --- a/fs/compat_ioctl.c +++ b/fs/compat_ioctl.c -@@ -210,6 +210,8 @@ static int do_video_set_spu_palette(unsigned int fd, unsigned int cmd, - - err = get_user(palp, &up->palette); - err |= get_user(length, &up->length); -+ if (err) -+ return -EFAULT; - - up_native = compat_alloc_user_space(sizeof(struct video_spu_palette)); - err = put_user(compat_ptr(palp), &up_native->palette); -@@ -621,7 +623,7 @@ static int serial_struct_ioctl(unsigned fd, unsigned cmd, +@@ -623,7 +623,7 @@ static int serial_struct_ioctl(unsigned fd, unsigned cmd, return -EFAULT; if (__get_user(udata, &ss32->iomem_base)) return -EFAULT; @@ -44892,7 +44874,7 @@ index 51352de..93292ff 100644 if (__get_user(ss.iomem_reg_shift, &ss32->iomem_reg_shift) || __get_user(ss.port_high, &ss32->port_high)) return -EFAULT; -@@ -796,7 +798,7 @@ static int compat_ioctl_preallocate(struct file *file, +@@ -798,7 +798,7 @@ static int compat_ioctl_preallocate(struct file *file, copy_in_user(&p->l_len, &p32->l_len, sizeof(s64)) || copy_in_user(&p->l_sysid, &p32->l_sysid, sizeof(s32)) || copy_in_user(&p->l_pid, &p32->l_pid, sizeof(u32)) || @@ -44901,7 +44883,7 @@ index 51352de..93292ff 100644 return -EFAULT; return ioctl_preallocate(file, p); -@@ -1644,8 +1646,8 @@ asmlinkage long compat_sys_ioctl(unsigned int fd, unsigned int cmd, +@@ -1646,8 +1646,8 @@ asmlinkage long compat_sys_ioctl(unsigned int fd, unsigned int cmd, static int __init init_sys32_ioctl_cmp(const void *p, const void *q) { unsigned int a, b; @@ -45066,7 +45048,7 @@ index a6f3763..f38ed00 100644 out_free_fd: diff --git a/fs/exec.c b/fs/exec.c -index 160cd2f..7f5ba47 100644 +index 121ccae..c12bdc7 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -55,12 +55,33 @@ @@ -47845,7 +47827,7 @@ index ee4e66b..9a39f9c 100644 spin_unlock(&inode->i_lock); } diff --git a/fs/isofs/export.c b/fs/isofs/export.c -index dd4687f..e9b81e0 100644 +index 516eb21..fd88add 100644 --- a/fs/isofs/export.c +++ b/fs/isofs/export.c @@ -135,6 +135,7 @@ isofs_export_encode_fh(struct dentry *dentry, @@ -50947,7 +50929,7 @@ index 014fcb4..980206f 100644 pipe_unlock(ipipe); diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c -index 7fdf6a7..e6cd8ad 100644 +index fabbb81..91a12e3 100644 --- a/fs/sysfs/dir.c +++ b/fs/sysfs/dir.c @@ -642,6 +642,18 @@ static int create_dir(struct kobject *kobj, struct sysfs_dirent *parent_sd, @@ -67493,10 +67475,10 @@ index b463871..fa3ea1f 100644 * nsown_capable - Check superior capability to one's own user_ns * @cap: The capability in question diff --git a/kernel/cgroup.c b/kernel/cgroup.c -index cdc0354..aab57fc 100644 +index 6337535..861ca46 100644 --- a/kernel/cgroup.c +++ b/kernel/cgroup.c -@@ -5156,7 +5156,7 @@ static int cgroup_css_links_read(struct cgroup *cont, +@@ -5155,7 +5155,7 @@ static int cgroup_css_links_read(struct cgroup *cont, struct css_set *cg = link->cg; struct task_struct *task; int count = 0; @@ -68968,7 +68950,7 @@ index 91c32a0..7b88d63 100644 seq_printf(m, "%40s %14lu %29s %pS\n", name, stats->contending_point[i], diff --git a/kernel/module.c b/kernel/module.c -index 6969ef0..39c391d 100644 +index 6c8fa34..0ab39b6 100644 --- a/kernel/module.c +++ b/kernel/module.c @@ -58,6 +58,7 @@ @@ -69486,7 +69468,7 @@ index 6969ef0..39c391d 100644 DEBUGP("\t0x%lx %s\n", shdr->sh_addr, info->secstrings + shdr->sh_name); } -@@ -2688,12 +2787,12 @@ static void flush_module_icache(const struct module *mod) +@@ -2692,12 +2791,12 @@ static void flush_module_icache(const struct module *mod) * Do it before processing of module parameters, so the module * can provide parameter accessor functions of its own. */ @@ -69505,7 +69487,7 @@ index 6969ef0..39c391d 100644 set_fs(old_fs); } -@@ -2773,8 +2872,10 @@ static void module_deallocate(struct module *mod, struct load_info *info) +@@ -2777,8 +2876,10 @@ static void module_deallocate(struct module *mod, struct load_info *info) { kfree(info->strmap); percpu_modfree(mod); @@ -69518,7 +69500,7 @@ index 6969ef0..39c391d 100644 } int __weak module_finalize(const Elf_Ehdr *hdr, -@@ -2838,9 +2939,38 @@ static struct module *load_module(void __user *umod, +@@ -2842,9 +2943,38 @@ static struct module *load_module(void __user *umod, if (err) goto free_unload; @@ -69557,7 +69539,7 @@ index 6969ef0..39c391d 100644 /* Fix up syms, so that st_value is a pointer to location. */ err = simplify_symbols(mod, &info); if (err < 0) -@@ -2856,13 +2986,6 @@ static struct module *load_module(void __user *umod, +@@ -2860,13 +2990,6 @@ static struct module *load_module(void __user *umod, flush_module_icache(mod); @@ -69571,7 +69553,7 @@ index 6969ef0..39c391d 100644 /* Mark state as coming so strong_try_module_get() ignores us. */ mod->state = MODULE_STATE_COMING; -@@ -2920,11 +3043,10 @@ static struct module *load_module(void __user *umod, +@@ -2924,11 +3047,10 @@ static struct module *load_module(void __user *umod, unlock: mutex_unlock(&module_mutex); synchronize_sched(); @@ -69584,7 +69566,7 @@ index 6969ef0..39c391d 100644 free_unload: module_unload_free(mod); free_module: -@@ -2965,16 +3087,16 @@ SYSCALL_DEFINE3(init_module, void __user *, umod, +@@ -2969,16 +3091,16 @@ SYSCALL_DEFINE3(init_module, void __user *, umod, MODULE_STATE_COMING, mod); /* Set RO and NX regions for core */ @@ -69609,7 +69591,7 @@ index 6969ef0..39c391d 100644 do_mod_ctors(mod); /* Start the module */ -@@ -3020,11 +3142,12 @@ SYSCALL_DEFINE3(init_module, void __user *, umod, +@@ -3024,11 +3146,12 @@ SYSCALL_DEFINE3(init_module, void __user *, umod, mod->strtab = mod->core_strtab; #endif unset_module_init_ro_nx(mod); @@ -69627,7 +69609,7 @@ index 6969ef0..39c391d 100644 mutex_unlock(&module_mutex); return 0; -@@ -3055,10 +3178,16 @@ static const char *get_ksymbol(struct module *mod, +@@ -3059,10 +3182,16 @@ static const char *get_ksymbol(struct module *mod, unsigned long nextval; /* At worse, next value is at end of module */ @@ -69647,7 +69629,7 @@ index 6969ef0..39c391d 100644 /* Scan for closest preceding symbol, and next symbol. (ELF starts real symbols at 1). */ -@@ -3306,7 +3435,7 @@ static int m_show(struct seq_file *m, void *p) +@@ -3310,7 +3439,7 @@ static int m_show(struct seq_file *m, void *p) char buf[8]; seq_printf(m, "%s %u", @@ -69656,7 +69638,7 @@ index 6969ef0..39c391d 100644 print_unload_info(m, mod); /* Informative for users. */ -@@ -3315,7 +3444,7 @@ static int m_show(struct seq_file *m, void *p) +@@ -3319,7 +3448,7 @@ static int m_show(struct seq_file *m, void *p) mod->state == MODULE_STATE_COMING ? "Loading": "Live"); /* Used by oprofile and other similar tools. */ @@ -69665,7 +69647,7 @@ index 6969ef0..39c391d 100644 /* Taints info */ if (mod->taints) -@@ -3351,7 +3480,17 @@ static const struct file_operations proc_modules_operations = { +@@ -3355,7 +3484,17 @@ static const struct file_operations proc_modules_operations = { static int __init proc_modules_init(void) { @@ -69683,7 +69665,7 @@ index 6969ef0..39c391d 100644 return 0; } module_init(proc_modules_init); -@@ -3410,12 +3549,12 @@ struct module *__module_address(unsigned long addr) +@@ -3414,12 +3553,12 @@ struct module *__module_address(unsigned long addr) { struct module *mod; @@ -69699,7 +69681,7 @@ index 6969ef0..39c391d 100644 return mod; return NULL; } -@@ -3449,11 +3588,20 @@ bool is_module_text_address(unsigned long addr) +@@ -3453,11 +3592,20 @@ bool is_module_text_address(unsigned long addr) */ struct module *__module_text_address(unsigned long addr) { @@ -71140,7 +71122,7 @@ index 2c71d91..1021f81 100644 struct tasklet_struct *list; diff --git a/kernel/sys.c b/kernel/sys.c -index c504302..b76c328 100644 +index d7c4ab0..fc14d2f 100644 --- a/kernel/sys.c +++ b/kernel/sys.c @@ -158,6 +158,12 @@ static int set_one_prio(struct task_struct *p, int niceval, int error) @@ -71264,35 +71246,7 @@ index c504302..b76c328 100644 abort_creds(new); return old_fsgid; -@@ -1171,13 +1207,13 @@ DECLARE_RWSEM(uts_sem); - * Work around broken programs that cannot handle "Linux 3.0". - * Instead we map 3.x to 2.6.40+x, so e.g. 3.0 would be 2.6.40 - */ --static int override_release(char __user *release, int len) -+static int override_release(char __user *release, size_t len) - { - int ret = 0; -- char buf[65]; - - if (current->personality & UNAME26) { -- char *rest = UTS_RELEASE; -+ char buf[65] = { 0 }; -+ const char *rest = UTS_RELEASE; - int ndots = 0; - unsigned v; - -@@ -1189,7 +1225,10 @@ static int override_release(char __user *release, int len) - rest++; - } - v = ((LINUX_VERSION_CODE >> 8) & 0xff) + 40; -+ if (sizeof buf < len) -+ len = sizeof buf; - snprintf(buf, len, "2.6.%u%s", v, rest); -+ buf[len - 1] = 0; - ret = copy_to_user(release, buf, len); - } - return ret; -@@ -1244,19 +1283,19 @@ SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name) +@@ -1246,19 +1282,19 @@ SYSCALL_DEFINE1(olduname, struct oldold_utsname __user *, name) return -EFAULT; down_read(&uts_sem); @@ -71317,7 +71271,7 @@ index c504302..b76c328 100644 __OLD_UTS_LEN); error |= __put_user(0, name->machine + __OLD_UTS_LEN); up_read(&uts_sem); -@@ -1721,7 +1760,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3, +@@ -1723,7 +1759,7 @@ SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3, error = get_dumpable(me->mm); break; case PR_SET_DUMPABLE: @@ -71753,7 +71707,7 @@ index fd4a7b1..fae5c2a 100644 cpumask_clear_cpu(cpu, tick_get_broadcast_mask()); tick_broadcast_clear_oneshot(cpu); diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c -index 5ee1ac0..335188f 100644 +index cb7f33e..7504d61 100644 --- a/kernel/time/timekeeping.c +++ b/kernel/time/timekeeping.c @@ -14,6 +14,7 @@ @@ -71892,10 +71846,10 @@ index 0b537f2..40d6c20 100644 return -ENOMEM; return 0; diff --git a/kernel/timer.c b/kernel/timer.c -index 9c3c62b..441690e 100644 +index c219db6..bb98998 100644 --- a/kernel/timer.c +++ b/kernel/timer.c -@@ -1304,7 +1304,7 @@ void update_process_times(int user_tick) +@@ -1306,7 +1306,7 @@ void update_process_times(int user_tick) /* * This function runs timers and the timer-tq in bottom half context. */ @@ -75710,10 +75664,10 @@ index e920aa3..137702a 100644 rc = process_vm_rw_single_vec( (unsigned long)rvec[i].iov_base, rvec[i].iov_len, diff --git a/mm/rmap.c b/mm/rmap.c -index a4fd368..e0ffec7 100644 +index 8685697..b490361 100644 --- a/mm/rmap.c +++ b/mm/rmap.c -@@ -152,6 +152,10 @@ int anon_vma_prepare(struct vm_area_struct *vma) +@@ -153,6 +153,10 @@ int anon_vma_prepare(struct vm_area_struct *vma) struct anon_vma *anon_vma = vma->anon_vma; struct anon_vma_chain *avc; @@ -75724,7 +75678,7 @@ index a4fd368..e0ffec7 100644 might_sleep(); if (unlikely(!anon_vma)) { struct mm_struct *mm = vma->vm_mm; -@@ -161,6 +165,12 @@ int anon_vma_prepare(struct vm_area_struct *vma) +@@ -162,6 +166,12 @@ int anon_vma_prepare(struct vm_area_struct *vma) if (!avc) goto out_enomem; @@ -75737,7 +75691,7 @@ index a4fd368..e0ffec7 100644 anon_vma = find_mergeable_anon_vma(vma); allocated = NULL; if (!anon_vma) { -@@ -174,6 +184,21 @@ int anon_vma_prepare(struct vm_area_struct *vma) +@@ -175,6 +185,21 @@ int anon_vma_prepare(struct vm_area_struct *vma) /* page_table_lock to protect against threads */ spin_lock(&mm->page_table_lock); if (likely(!vma->anon_vma)) { @@ -75759,7 +75713,7 @@ index a4fd368..e0ffec7 100644 vma->anon_vma = anon_vma; avc->anon_vma = anon_vma; avc->vma = vma; -@@ -187,12 +212,24 @@ int anon_vma_prepare(struct vm_area_struct *vma) +@@ -188,12 +213,24 @@ int anon_vma_prepare(struct vm_area_struct *vma) if (unlikely(allocated)) put_anon_vma(allocated); @@ -75784,7 +75738,7 @@ index a4fd368..e0ffec7 100644 anon_vma_chain_free(avc); out_enomem: return -ENOMEM; -@@ -243,7 +280,7 @@ static void anon_vma_chain_link(struct vm_area_struct *vma, +@@ -244,7 +281,7 @@ static void anon_vma_chain_link(struct vm_area_struct *vma, * Attach the anon_vmas from src to dst. * Returns 0 on success, -ENOMEM on failure. */ @@ -75793,7 +75747,7 @@ index a4fd368..e0ffec7 100644 { struct anon_vma_chain *avc, *pavc; struct anon_vma *root = NULL; -@@ -276,7 +313,7 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src) +@@ -277,7 +314,7 @@ int anon_vma_clone(struct vm_area_struct *dst, struct vm_area_struct *src) * the corresponding VMA in the parent process is attached to. * Returns 0 on success, non-zero on failure. */ @@ -75803,7 +75757,7 @@ index a4fd368..e0ffec7 100644 struct anon_vma_chain *avc; struct anon_vma *anon_vma; diff --git a/mm/shmem.c b/mm/shmem.c -index 7a82174..75d1c8b 100644 +index 126ca35..77e6609 100644 --- a/mm/shmem.c +++ b/mm/shmem.c @@ -31,7 +31,7 @@ @@ -75824,7 +75778,7 @@ index 7a82174..75d1c8b 100644 struct shmem_xattr { struct list_head list; /* anchored by shmem_inode_info->xattr_list */ -@@ -2181,8 +2181,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent) +@@ -2183,8 +2183,7 @@ int shmem_fill_super(struct super_block *sb, void *data, int silent) int err = -ENOMEM; /* Round up to L1_CACHE_BYTES to resist false sharing */ @@ -77891,7 +77845,7 @@ index 68bbf9f..5ef0d12 100644 return err; diff --git a/net/core/dev.c b/net/core/dev.c -index abe1147..d7e4046 100644 +index f500a69..94fbae3 100644 --- a/net/core/dev.c +++ b/net/core/dev.c @@ -1142,10 +1142,14 @@ void dev_load(struct net *net, const char *name) @@ -77954,7 +77908,7 @@ index abe1147..d7e4046 100644 { struct softnet_data *sd = &__get_cpu_var(softnet_data); -@@ -3327,7 +3331,7 @@ ncls: +@@ -3330,7 +3334,7 @@ ncls: if (pt_prev) { ret = pt_prev->func(skb, skb->dev, pt_prev, orig_dev); } else { @@ -77963,7 +77917,7 @@ index abe1147..d7e4046 100644 kfree_skb(skb); /* Jamal, now you will not able to escape explaining * me how you were going to use this. :-) -@@ -3892,7 +3896,7 @@ void netif_napi_del(struct napi_struct *napi) +@@ -3895,7 +3899,7 @@ void netif_napi_del(struct napi_struct *napi) } EXPORT_SYMBOL(netif_napi_del); @@ -77972,7 +77926,7 @@ index abe1147..d7e4046 100644 { struct softnet_data *sd = &__get_cpu_var(softnet_data); unsigned long time_limit = jiffies + 2; -@@ -4362,8 +4366,13 @@ static int ptype_seq_show(struct seq_file *seq, void *v) +@@ -4365,8 +4369,13 @@ static int ptype_seq_show(struct seq_file *seq, void *v) else seq_printf(seq, "%04x", ntohs(pt->type)); @@ -77986,7 +77940,7 @@ index abe1147..d7e4046 100644 } return 0; -@@ -5920,7 +5929,7 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev, +@@ -5923,7 +5932,7 @@ struct rtnl_link_stats64 *dev_get_stats(struct net_device *dev, } else { netdev_stats_to_stats64(storage, &dev->stats); } @@ -78693,7 +78647,7 @@ index a08a621..a1ca37e 100644 if (icsk->icsk_af_ops->conn_request(sk, skb) < 0) return 1; diff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c -index de69cec..74908e1 100644 +index 58c09a0..b62df0b 100644 --- a/net/ipv4/tcp_ipv4.c +++ b/net/ipv4/tcp_ipv4.c @@ -87,6 +87,9 @@ int sysctl_tcp_tw_reuse __read_mostly; @@ -78706,7 +78660,7 @@ index de69cec..74908e1 100644 #ifdef CONFIG_TCP_MD5SIG static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk, -@@ -1636,6 +1639,9 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb) +@@ -1637,6 +1640,9 @@ int tcp_v4_do_rcv(struct sock *sk, struct sk_buff *skb) return 0; reset: @@ -78716,7 +78670,7 @@ index de69cec..74908e1 100644 tcp_v4_send_reset(rsk, skb); discard: kfree_skb(skb); -@@ -1698,12 +1704,19 @@ int tcp_v4_rcv(struct sk_buff *skb) +@@ -1699,12 +1705,19 @@ int tcp_v4_rcv(struct sk_buff *skb) TCP_SKB_CB(skb)->sacked = 0; sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest); @@ -78739,7 +78693,7 @@ index de69cec..74908e1 100644 if (unlikely(iph->ttl < inet_sk(sk)->min_ttl)) { NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP); -@@ -1753,6 +1766,10 @@ no_tcp_socket: +@@ -1754,6 +1767,10 @@ no_tcp_socket: bad_packet: TCP_INC_STATS_BH(net, TCP_MIB_INERRS); } else { @@ -78750,7 +78704,7 @@ index de69cec..74908e1 100644 tcp_v4_send_reset(NULL, skb); } -@@ -2413,7 +2430,11 @@ static void get_openreq4(const struct sock *sk, const struct request_sock *req, +@@ -2414,7 +2431,11 @@ static void get_openreq4(const struct sock *sk, const struct request_sock *req, 0, /* non standard timer */ 0, /* open_requests have no inode */ atomic_read(&sk->sk_refcnt), @@ -78762,7 +78716,7 @@ index de69cec..74908e1 100644 len); } -@@ -2463,7 +2484,12 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len) +@@ -2464,7 +2485,12 @@ static void get_tcp4_sock(struct sock *sk, struct seq_file *f, int i, int *len) sock_i_uid(sk), icsk->icsk_probes_out, sock_i_ino(sk), @@ -78776,7 +78730,7 @@ index de69cec..74908e1 100644 jiffies_to_clock_t(icsk->icsk_rto), jiffies_to_clock_t(icsk->icsk_ack.ato), (icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong, -@@ -2491,7 +2517,13 @@ static void get_timewait4_sock(const struct inet_timewait_sock *tw, +@@ -2492,7 +2518,13 @@ static void get_timewait4_sock(const struct inet_timewait_sock *tw, " %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %pK%n", i, src, srcp, dest, destp, tw->tw_substate, 0, 0, 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0, @@ -79188,7 +79142,7 @@ index 6e6c2c4..942cebf 100644 static int raw6_seq_show(struct seq_file *seq, void *v) diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c -index 4a56574..9745b8a 100644 +index ccab3c8..99f760b 100644 --- a/net/ipv6/tcp_ipv6.c +++ b/net/ipv6/tcp_ipv6.c @@ -93,6 +93,10 @@ static struct tcp_md5sig_key *tcp_v6_md5_do_lookup(struct sock *sk, @@ -79202,7 +79156,7 @@ index 4a56574..9745b8a 100644 static void tcp_v6_hash(struct sock *sk) { if (sk->sk_state != TCP_CLOSE) { -@@ -1655,6 +1659,9 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb) +@@ -1656,6 +1660,9 @@ static int tcp_v6_do_rcv(struct sock *sk, struct sk_buff *skb) return 0; reset: @@ -79212,7 +79166,7 @@ index 4a56574..9745b8a 100644 tcp_v6_send_reset(sk, skb); discard: if (opt_skb) -@@ -1734,12 +1741,20 @@ static int tcp_v6_rcv(struct sk_buff *skb) +@@ -1735,12 +1742,20 @@ static int tcp_v6_rcv(struct sk_buff *skb) TCP_SKB_CB(skb)->sacked = 0; sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest); @@ -79235,7 +79189,7 @@ index 4a56574..9745b8a 100644 if (hdr->hop_limit < inet6_sk(sk)->min_hopcount) { NET_INC_STATS_BH(net, LINUX_MIB_TCPMINTTLDROP); -@@ -1787,6 +1802,10 @@ no_tcp_socket: +@@ -1788,6 +1803,10 @@ no_tcp_socket: bad_packet: TCP_INC_STATS_BH(net, TCP_MIB_INERRS); } else { @@ -79246,7 +79200,7 @@ index 4a56574..9745b8a 100644 tcp_v6_send_reset(NULL, skb); } -@@ -2047,7 +2066,13 @@ static void get_openreq6(struct seq_file *seq, +@@ -2048,7 +2067,13 @@ static void get_openreq6(struct seq_file *seq, uid, 0, /* non standard timer */ 0, /* open_requests have no inode */ @@ -79261,7 +79215,7 @@ index 4a56574..9745b8a 100644 } static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i) -@@ -2097,7 +2122,12 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i) +@@ -2098,7 +2123,12 @@ static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i) sock_i_uid(sp), icsk->icsk_probes_out, sock_i_ino(sp), @@ -79275,7 +79229,7 @@ index 4a56574..9745b8a 100644 jiffies_to_clock_t(icsk->icsk_rto), jiffies_to_clock_t(icsk->icsk_ack.ato), (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong, -@@ -2132,7 +2162,13 @@ static void get_timewait6_sock(struct seq_file *seq, +@@ -2133,7 +2163,13 @@ static void get_timewait6_sock(struct seq_file *seq, dest->s6_addr32[2], dest->s6_addr32[3], destp, tw->tw_substate, 0, 0, 3, jiffies_to_clock_t(ttd), 0, 0, 0, 0, @@ -79897,10 +79851,10 @@ index aa2d720..d8aa111 100644 } diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c -index 1d15193..257c9255 100644 +index 7489bd3..5f4df88 100644 --- a/net/netfilter/nf_conntrack_core.c +++ b/net/netfilter/nf_conntrack_core.c -@@ -1485,6 +1485,10 @@ err_proto: +@@ -1491,6 +1491,10 @@ err_proto: #define UNCONFIRMED_NULLS_VAL ((1<<30)+0) #define DYING_NULLS_VAL ((1<<30)+1) @@ -79911,7 +79865,7 @@ index 1d15193..257c9255 100644 static int nf_conntrack_init_net(struct net *net) { int ret; -@@ -1498,7 +1502,11 @@ static int nf_conntrack_init_net(struct net *net) +@@ -1504,7 +1508,11 @@ static int nf_conntrack_init_net(struct net *net) goto err_stat; } @@ -91055,32 +91009,6 @@ index 6789d78..4afd019e 100644 + .endm + #endif -diff --git a/usr/gen_init_cpio.c b/usr/gen_init_cpio.c -index af0f22f..9a7d479 100644 ---- a/usr/gen_init_cpio.c -+++ b/usr/gen_init_cpio.c -@@ -303,7 +303,7 @@ static int cpio_mkfile(const char *name, const char *location, - int retval; - int rc = -1; - int namesize; -- int i; -+ unsigned int i; - - mode |= S_IFREG; - -@@ -392,9 +392,10 @@ static char *cpio_replace_env(char *new_location) - *env_var = *expanded = '\0'; - strncat(env_var, start + 2, end - start - 2); - strncat(expanded, new_location, start - new_location); -- strncat(expanded, getenv(env_var), PATH_MAX); -- strncat(expanded, end + 1, PATH_MAX); -+ strncat(expanded, getenv(env_var), PATH_MAX - strlen(expanded)); -+ strncat(expanded, end + 1, PATH_MAX - strlen(expanded)); - strncpy(new_location, expanded, PATH_MAX); -+ new_location[PATH_MAX] = 0; - } else - break; - } diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index ec747dc..d3e1f29 100644 --- a/virt/kvm/kvm_main.c diff --git a/3.2.32/4430_grsec-remove-localversion-grsec.patch b/3.2.33/4430_grsec-remove-localversion-grsec.patch index 31cf878..31cf878 100644 --- a/3.2.32/4430_grsec-remove-localversion-grsec.patch +++ b/3.2.33/4430_grsec-remove-localversion-grsec.patch diff --git a/3.2.32/4435_grsec-mute-warnings.patch b/3.2.33/4435_grsec-mute-warnings.patch index e85abd6..e85abd6 100644 --- a/3.2.32/4435_grsec-mute-warnings.patch +++ b/3.2.33/4435_grsec-mute-warnings.patch diff --git a/3.2.32/4440_grsec-remove-protected-paths.patch b/3.2.33/4440_grsec-remove-protected-paths.patch index 637934a..637934a 100644 --- a/3.2.32/4440_grsec-remove-protected-paths.patch +++ b/3.2.33/4440_grsec-remove-protected-paths.patch diff --git a/3.2.32/4450_grsec-kconfig-default-gids.patch b/3.2.33/4450_grsec-kconfig-default-gids.patch index d4b0b7e..d4b0b7e 100644 --- a/3.2.32/4450_grsec-kconfig-default-gids.patch +++ b/3.2.33/4450_grsec-kconfig-default-gids.patch diff --git a/3.2.32/4465_selinux-avc_audit-log-curr_ip.patch b/3.2.33/4465_selinux-avc_audit-log-curr_ip.patch index 3ea7bcc..3ea7bcc 100644 --- a/3.2.32/4465_selinux-avc_audit-log-curr_ip.patch +++ b/3.2.33/4465_selinux-avc_audit-log-curr_ip.patch diff --git a/3.2.32/4470_disable-compat_vdso.patch b/3.2.33/4470_disable-compat_vdso.patch index 4742d01..4742d01 100644 --- a/3.2.32/4470_disable-compat_vdso.patch +++ b/3.2.33/4470_disable-compat_vdso.patch diff --git a/3.6.4/0000_README b/3.6.5/0000_README index 4789a33..dfd814a 100644 --- a/3.6.4/0000_README +++ b/3.6.5/0000_README @@ -2,7 +2,11 @@ README ----------------------------------------------------------------------------- Individual Patch Descriptions: ----------------------------------------------------------------------------- -Patch: 4420_grsecurity-2.9.1-3.6.4-201210291446.patch +Patch: 1004_linux-3.6.5.patch +From: http://www.kernel.org +Desc: Linux 3.6.5 + +Patch: 4420_grsecurity-2.9.1-3.6.5-201210312121.patch From: http://www.grsecurity.net Desc: hardened-sources base patch from upstream grsecurity diff --git a/3.6.5/1004_linux-3.6.5.patch b/3.6.5/1004_linux-3.6.5.patch new file mode 100644 index 0000000..738b926 --- /dev/null +++ b/3.6.5/1004_linux-3.6.5.patch @@ -0,0 +1,4649 @@ +diff --git a/Documentation/devicetree/bindings/arm/atmel-at91.txt b/Documentation/devicetree/bindings/arm/atmel-at91.txt +index ecc81e3..d187e9f 100644 +--- a/Documentation/devicetree/bindings/arm/atmel-at91.txt ++++ b/Documentation/devicetree/bindings/arm/atmel-at91.txt +@@ -8,7 +8,7 @@ PIT Timer required properties: + shared across all System Controller members. + + TC/TCLIB Timer required properties: +-- compatible: Should be "atmel,<chip>-pit". ++- compatible: Should be "atmel,<chip>-tcb". + <chip> can be "at91rm9200" or "at91sam9x5" + - reg: Should contain registers location and length + - interrupts: Should contain all interrupts for the TC block +diff --git a/Makefile b/Makefile +index dcf132a..6e4a00d 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 6 +-SUBLEVEL = 4 ++SUBLEVEL = 5 + EXTRAVERSION = + NAME = Terrified Chipmunk + +diff --git a/arch/arm/kernel/smp.c b/arch/arm/kernel/smp.c +index ebd8ad2..0181f7e 100644 +--- a/arch/arm/kernel/smp.c ++++ b/arch/arm/kernel/smp.c +@@ -222,18 +222,24 @@ static void percpu_timer_setup(void); + asmlinkage void __cpuinit secondary_start_kernel(void) + { + struct mm_struct *mm = &init_mm; +- unsigned int cpu = smp_processor_id(); ++ unsigned int cpu; ++ ++ /* ++ * The identity mapping is uncached (strongly ordered), so ++ * switch away from it before attempting any exclusive accesses. ++ */ ++ cpu_switch_mm(mm->pgd, mm); ++ enter_lazy_tlb(mm, current); ++ local_flush_tlb_all(); + + /* + * All kernel threads share the same mm context; grab a + * reference and switch to it. + */ ++ cpu = smp_processor_id(); + atomic_inc(&mm->mm_count); + current->active_mm = mm; + cpumask_set_cpu(cpu, mm_cpumask(mm)); +- cpu_switch_mm(mm->pgd, mm); +- enter_lazy_tlb(mm, current); +- local_flush_tlb_all(); + + printk("CPU%u: Booted secondary processor\n", cpu); + +diff --git a/arch/arm/mach-at91/at91rm9200_devices.c b/arch/arm/mach-at91/at91rm9200_devices.c +index 01fb732..d5a4913 100644 +--- a/arch/arm/mach-at91/at91rm9200_devices.c ++++ b/arch/arm/mach-at91/at91rm9200_devices.c +@@ -463,7 +463,7 @@ static struct i2c_gpio_platform_data pdata = { + + static struct platform_device at91rm9200_twi_device = { + .name = "i2c-gpio", +- .id = -1, ++ .id = 0, + .dev.platform_data = &pdata, + }; + +diff --git a/arch/arm/mach-at91/at91sam9260_devices.c b/arch/arm/mach-at91/at91sam9260_devices.c +index bce572a..18ca240 100644 +--- a/arch/arm/mach-at91/at91sam9260_devices.c ++++ b/arch/arm/mach-at91/at91sam9260_devices.c +@@ -471,7 +471,7 @@ static struct i2c_gpio_platform_data pdata = { + + static struct platform_device at91sam9260_twi_device = { + .name = "i2c-gpio", +- .id = -1, ++ .id = 0, + .dev.platform_data = &pdata, + }; + +diff --git a/arch/arm/mach-at91/at91sam9261_devices.c b/arch/arm/mach-at91/at91sam9261_devices.c +index bc2590d..2495de8 100644 +--- a/arch/arm/mach-at91/at91sam9261_devices.c ++++ b/arch/arm/mach-at91/at91sam9261_devices.c +@@ -285,7 +285,7 @@ static struct i2c_gpio_platform_data pdata = { + + static struct platform_device at91sam9261_twi_device = { + .name = "i2c-gpio", +- .id = -1, ++ .id = 0, + .dev.platform_data = &pdata, + }; + +diff --git a/arch/arm/mach-at91/at91sam9263_devices.c b/arch/arm/mach-at91/at91sam9263_devices.c +index 9b6ca73..9877963 100644 +--- a/arch/arm/mach-at91/at91sam9263_devices.c ++++ b/arch/arm/mach-at91/at91sam9263_devices.c +@@ -542,7 +542,7 @@ static struct i2c_gpio_platform_data pdata = { + + static struct platform_device at91sam9263_twi_device = { + .name = "i2c-gpio", +- .id = -1, ++ .id = 0, + .dev.platform_data = &pdata, + }; + +diff --git a/arch/arm/mach-at91/at91sam9rl_devices.c b/arch/arm/mach-at91/at91sam9rl_devices.c +index b3d365d..c82a427 100644 +--- a/arch/arm/mach-at91/at91sam9rl_devices.c ++++ b/arch/arm/mach-at91/at91sam9rl_devices.c +@@ -314,7 +314,7 @@ static struct i2c_gpio_platform_data pdata = { + + static struct platform_device at91sam9rl_twi_device = { + .name = "i2c-gpio", +- .id = -1, ++ .id = 0, + .dev.platform_data = &pdata, + }; + +diff --git a/arch/arm/mach-at91/board-neocore926.c b/arch/arm/mach-at91/board-neocore926.c +index 18103c5d..997d359 100644 +--- a/arch/arm/mach-at91/board-neocore926.c ++++ b/arch/arm/mach-at91/board-neocore926.c +@@ -129,7 +129,7 @@ static struct spi_board_info neocore926_spi_devices[] = { + .max_speed_hz = 125000 * 16, + .bus_num = 0, + .platform_data = &ads_info, +- .irq = AT91SAM9263_ID_IRQ1, ++ .irq = NR_IRQS_LEGACY + AT91SAM9263_ID_IRQ1, + }, + #endif + }; +diff --git a/arch/arm/mach-at91/board-sam9261ek.c b/arch/arm/mach-at91/board-sam9261ek.c +index 2269be5..17659be 100644 +--- a/arch/arm/mach-at91/board-sam9261ek.c ++++ b/arch/arm/mach-at91/board-sam9261ek.c +@@ -309,7 +309,7 @@ static struct spi_board_info ek_spi_devices[] = { + .max_speed_hz = 125000 * 26, /* (max sample rate @ 3V) * (cmd + data + overhead) */ + .bus_num = 0, + .platform_data = &ads_info, +- .irq = AT91SAM9261_ID_IRQ0, ++ .irq = NR_IRQS_LEGACY + AT91SAM9261_ID_IRQ0, + .controller_data = (void *) AT91_PIN_PA28, /* CS pin */ + }, + #endif +diff --git a/arch/arm/mach-at91/board-sam9263ek.c b/arch/arm/mach-at91/board-sam9263ek.c +index 82adf58..9e7153b 100644 +--- a/arch/arm/mach-at91/board-sam9263ek.c ++++ b/arch/arm/mach-at91/board-sam9263ek.c +@@ -132,7 +132,7 @@ static struct spi_board_info ek_spi_devices[] = { + .max_speed_hz = 125000 * 26, /* (max sample rate @ 3V) * (cmd + data + overhead) */ + .bus_num = 0, + .platform_data = &ads_info, +- .irq = AT91SAM9263_ID_IRQ1, ++ .irq = NR_IRQS_LEGACY + AT91SAM9263_ID_IRQ1, + }, + #endif + }; +diff --git a/arch/arm/mach-at91/generic.h b/arch/arm/mach-at91/generic.h +index f496506..b62f560e 100644 +--- a/arch/arm/mach-at91/generic.h ++++ b/arch/arm/mach-at91/generic.h +@@ -26,7 +26,8 @@ extern void __init at91_dt_initialize(void); + extern void __init at91_init_irq_default(void); + extern void __init at91_init_interrupts(unsigned int priority[]); + extern void __init at91x40_init_interrupts(unsigned int priority[]); +-extern void __init at91_aic_init(unsigned int priority[]); ++extern void __init at91_aic_init(unsigned int priority[], ++ unsigned int ext_irq_mask); + extern int __init at91_aic_of_init(struct device_node *node, + struct device_node *parent); + extern int __init at91_aic5_of_init(struct device_node *node, +diff --git a/arch/arm/mach-at91/irq.c b/arch/arm/mach-at91/irq.c +index 1e02c0e..febc2ee 100644 +--- a/arch/arm/mach-at91/irq.c ++++ b/arch/arm/mach-at91/irq.c +@@ -502,14 +502,19 @@ int __init at91_aic5_of_init(struct device_node *node, + /* + * Initialize the AIC interrupt controller. + */ +-void __init at91_aic_init(unsigned int *priority) ++void __init at91_aic_init(unsigned int *priority, unsigned int ext_irq_mask) + { + unsigned int i; + int irq_base; + +- if (at91_aic_pm_init()) ++ at91_extern_irq = kzalloc(BITS_TO_LONGS(n_irqs) ++ * sizeof(*at91_extern_irq), GFP_KERNEL); ++ ++ if (at91_aic_pm_init() || at91_extern_irq == NULL) + panic("Unable to allocate bit maps\n"); + ++ *at91_extern_irq = ext_irq_mask; ++ + at91_aic_base = ioremap(AT91_AIC, 512); + if (!at91_aic_base) + panic("Unable to ioremap AIC registers\n"); +diff --git a/arch/arm/mach-at91/setup.c b/arch/arm/mach-at91/setup.c +index 944bffb..bd0e88c 100644 +--- a/arch/arm/mach-at91/setup.c ++++ b/arch/arm/mach-at91/setup.c +@@ -47,7 +47,7 @@ void __init at91_init_irq_default(void) + void __init at91_init_interrupts(unsigned int *priority) + { + /* Initialize the AIC interrupt controller */ +- at91_aic_init(priority); ++ at91_aic_init(priority, at91_extern_irq); + + /* Enable GPIO interrupts */ + at91_gpio_irq_setup(); +@@ -151,7 +151,7 @@ static void __init soc_detect(u32 dbgu_base) + } + + /* at91sam9g10 */ +- if ((cidr & ~AT91_CIDR_EXT) == ARCH_ID_AT91SAM9G10) { ++ if ((socid & ~AT91_CIDR_EXT) == ARCH_ID_AT91SAM9G10) { + at91_soc_initdata.type = AT91_SOC_SAM9G10; + at91_boot_soc = at91sam9261_soc; + } +diff --git a/arch/arm/mach-exynos/common.c b/arch/arm/mach-exynos/common.c +index 4eb39cd..3e02ae6 100644 +--- a/arch/arm/mach-exynos/common.c ++++ b/arch/arm/mach-exynos/common.c +@@ -47,6 +47,7 @@ + #include <plat/fimc-core.h> + #include <plat/iic-core.h> + #include <plat/tv-core.h> ++#include <plat/spi-core.h> + #include <plat/regs-serial.h> + + #include "common.h" +@@ -346,6 +347,8 @@ static void __init exynos4_map_io(void) + + s5p_fb_setname(0, "exynos4-fb"); + s5p_hdmi_setname("exynos4-hdmi"); ++ ++ s3c64xx_spi_setname("exynos4210-spi"); + } + + static void __init exynos5_map_io(void) +@@ -366,6 +369,8 @@ static void __init exynos5_map_io(void) + s3c_i2c0_setname("s3c2440-i2c"); + s3c_i2c1_setname("s3c2440-i2c"); + s3c_i2c2_setname("s3c2440-i2c"); ++ ++ s3c64xx_spi_setname("exynos4210-spi"); + } + + static void __init exynos4_init_clocks(int xtal) +diff --git a/arch/arm/mach-s3c24xx/s3c2416.c b/arch/arm/mach-s3c24xx/s3c2416.c +index ed5a95ec..77ee0b7 100644 +--- a/arch/arm/mach-s3c24xx/s3c2416.c ++++ b/arch/arm/mach-s3c24xx/s3c2416.c +@@ -61,6 +61,7 @@ + #include <plat/nand-core.h> + #include <plat/adc-core.h> + #include <plat/rtc-core.h> ++#include <plat/spi-core.h> + + static struct map_desc s3c2416_iodesc[] __initdata = { + IODESC_ENT(WATCHDOG), +@@ -132,6 +133,7 @@ void __init s3c2416_map_io(void) + /* initialize device information early */ + s3c2416_default_sdhci0(); + s3c2416_default_sdhci1(); ++ s3c64xx_spi_setname("s3c2443-spi"); + + iotable_init(s3c2416_iodesc, ARRAY_SIZE(s3c2416_iodesc)); + } +diff --git a/arch/arm/mach-s3c24xx/s3c2443.c b/arch/arm/mach-s3c24xx/s3c2443.c +index ab648ad..165b6a6 100644 +--- a/arch/arm/mach-s3c24xx/s3c2443.c ++++ b/arch/arm/mach-s3c24xx/s3c2443.c +@@ -43,6 +43,7 @@ + #include <plat/nand-core.h> + #include <plat/adc-core.h> + #include <plat/rtc-core.h> ++#include <plat/spi-core.h> + + static struct map_desc s3c2443_iodesc[] __initdata = { + IODESC_ENT(WATCHDOG), +@@ -100,6 +101,9 @@ void __init s3c2443_map_io(void) + s3c24xx_gpiocfg_default.set_pull = s3c2443_gpio_setpull; + s3c24xx_gpiocfg_default.get_pull = s3c2443_gpio_getpull; + ++ /* initialize device information early */ ++ s3c64xx_spi_setname("s3c2443-spi"); ++ + iotable_init(s3c2443_iodesc, ARRAY_SIZE(s3c2443_iodesc)); + } + +diff --git a/arch/arm/mach-s5p64x0/common.c b/arch/arm/mach-s5p64x0/common.c +index 6e6a0a9..111e404 100644 +--- a/arch/arm/mach-s5p64x0/common.c ++++ b/arch/arm/mach-s5p64x0/common.c +@@ -44,6 +44,7 @@ + #include <plat/sdhci.h> + #include <plat/adc-core.h> + #include <plat/fb-core.h> ++#include <plat/spi-core.h> + #include <plat/gpio-cfg.h> + #include <plat/regs-irqtype.h> + #include <plat/regs-serial.h> +@@ -179,6 +180,7 @@ void __init s5p6440_map_io(void) + /* initialize any device information early */ + s3c_adc_setname("s3c64xx-adc"); + s3c_fb_setname("s5p64x0-fb"); ++ s3c64xx_spi_setname("s5p64x0-spi"); + + s5p64x0_default_sdhci0(); + s5p64x0_default_sdhci1(); +@@ -193,6 +195,7 @@ void __init s5p6450_map_io(void) + /* initialize any device information early */ + s3c_adc_setname("s3c64xx-adc"); + s3c_fb_setname("s5p64x0-fb"); ++ s3c64xx_spi_setname("s5p64x0-spi"); + + s5p64x0_default_sdhci0(); + s5p64x0_default_sdhci1(); +diff --git a/arch/arm/mach-s5pc100/common.c b/arch/arm/mach-s5pc100/common.c +index 6219086..cc6e561 100644 +--- a/arch/arm/mach-s5pc100/common.c ++++ b/arch/arm/mach-s5pc100/common.c +@@ -45,6 +45,7 @@ + #include <plat/fb-core.h> + #include <plat/iic-core.h> + #include <plat/onenand-core.h> ++#include <plat/spi-core.h> + #include <plat/regs-serial.h> + #include <plat/watchdog-reset.h> + +@@ -165,6 +166,8 @@ void __init s5pc100_map_io(void) + s3c_onenand_setname("s5pc100-onenand"); + s3c_fb_setname("s5pc100-fb"); + s3c_cfcon_setname("s5pc100-pata"); ++ ++ s3c64xx_spi_setname("s5pc100-spi"); + } + + void __init s5pc100_init_clocks(int xtal) +diff --git a/arch/arm/mach-s5pv210/common.c b/arch/arm/mach-s5pv210/common.c +index 4c9e902..a0c50ef 100644 +--- a/arch/arm/mach-s5pv210/common.c ++++ b/arch/arm/mach-s5pv210/common.c +@@ -43,6 +43,7 @@ + #include <plat/iic-core.h> + #include <plat/keypad-core.h> + #include <plat/tv-core.h> ++#include <plat/spi-core.h> + #include <plat/regs-serial.h> + + #include "common.h" +@@ -196,6 +197,8 @@ void __init s5pv210_map_io(void) + + /* setup TV devices */ + s5p_hdmi_setname("s5pv210-hdmi"); ++ ++ s3c64xx_spi_setname("s5pv210-spi"); + } + + void __init s5pv210_init_clocks(int xtal) +diff --git a/arch/arm/plat-samsung/include/plat/spi-core.h b/arch/arm/plat-samsung/include/plat/spi-core.h +new file mode 100644 +index 0000000..0b9428a +--- /dev/null ++++ b/arch/arm/plat-samsung/include/plat/spi-core.h +@@ -0,0 +1,30 @@ ++/* ++ * Copyright (C) 2012 Heiko Stuebner <heiko@sntech.de> ++ * ++ * This program is free software; you can redistribute it and/or modify ++ * it under the terms of the GNU General Public License version 2 as ++ * published by the Free Software Foundation. ++ */ ++ ++#ifndef __PLAT_S3C_SPI_CORE_H ++#define __PLAT_S3C_SPI_CORE_H ++ ++/* These functions are only for use with the core support code, such as ++ * the cpu specific initialisation code ++ */ ++ ++/* re-define device name depending on support. */ ++static inline void s3c64xx_spi_setname(char *name) ++{ ++#ifdef CONFIG_S3C64XX_DEV_SPI0 ++ s3c64xx_device_spi0.name = name; ++#endif ++#ifdef CONFIG_S3C64XX_DEV_SPI1 ++ s3c64xx_device_spi1.name = name; ++#endif ++#ifdef CONFIG_S3C64XX_DEV_SPI2 ++ s3c64xx_device_spi2.name = name; ++#endif ++} ++ ++#endif /* __PLAT_S3C_SPI_CORE_H */ +diff --git a/arch/x86/include/asm/efi.h b/arch/x86/include/asm/efi.h +index c9dcc18..029189d 100644 +--- a/arch/x86/include/asm/efi.h ++++ b/arch/x86/include/asm/efi.h +@@ -98,6 +98,7 @@ extern void efi_set_executable(efi_memory_desc_t *md, bool executable); + extern int efi_memblock_x86_reserve_range(void); + extern void efi_call_phys_prelog(void); + extern void efi_call_phys_epilog(void); ++extern void efi_unmap_memmap(void); + + #ifndef CONFIG_EFI + /* +diff --git a/arch/x86/kernel/e820.c b/arch/x86/kernel/e820.c +index ed858e9..df06ade 100644 +--- a/arch/x86/kernel/e820.c ++++ b/arch/x86/kernel/e820.c +@@ -1077,6 +1077,9 @@ void __init memblock_x86_fill(void) + memblock_add(ei->addr, ei->size); + } + ++ /* throw away partial pages */ ++ memblock_trim_memory(PAGE_SIZE); ++ + memblock_dump_all(); + } + +diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c +index 198e774..5cee802 100644 +--- a/arch/x86/kernel/setup.c ++++ b/arch/x86/kernel/setup.c +@@ -920,18 +920,19 @@ void __init setup_arch(char **cmdline_p) + #ifdef CONFIG_X86_64 + if (max_pfn > max_low_pfn) { + int i; +- for (i = 0; i < e820.nr_map; i++) { +- struct e820entry *ei = &e820.map[i]; ++ unsigned long start, end; ++ unsigned long start_pfn, end_pfn; + +- if (ei->addr + ei->size <= 1UL << 32) +- continue; ++ for_each_mem_pfn_range(i, MAX_NUMNODES, &start_pfn, &end_pfn, ++ NULL) { + +- if (ei->type == E820_RESERVED) ++ end = PFN_PHYS(end_pfn); ++ if (end <= (1UL<<32)) + continue; + ++ start = PFN_PHYS(start_pfn); + max_pfn_mapped = init_memory_mapping( +- ei->addr < 1UL << 32 ? 1UL << 32 : ei->addr, +- ei->addr + ei->size); ++ max((1UL<<32), start), end); + } + + /* can we preseve max_low_pfn ?*/ +@@ -1047,6 +1048,18 @@ void __init setup_arch(char **cmdline_p) + mcheck_init(); + + arch_init_ideal_nops(); ++ ++#ifdef CONFIG_EFI ++ /* Once setup is done above, disable efi_enabled on mismatched ++ * firmware/kernel archtectures since there is no support for ++ * runtime services. ++ */ ++ if (efi_enabled && IS_ENABLED(CONFIG_X86_64) != efi_64bit) { ++ pr_info("efi: Setup done, disabling due to 32/64-bit mismatch\n"); ++ efi_unmap_memmap(); ++ efi_enabled = 0; ++ } ++#endif + } + + #ifdef CONFIG_X86_32 +diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c +index ab1f6a9..d7aea41 100644 +--- a/arch/x86/mm/init.c ++++ b/arch/x86/mm/init.c +@@ -35,40 +35,44 @@ struct map_range { + unsigned page_size_mask; + }; + +-static void __init find_early_table_space(struct map_range *mr, unsigned long end, +- int use_pse, int use_gbpages) ++/* ++ * First calculate space needed for kernel direct mapping page tables to cover ++ * mr[0].start to mr[nr_range - 1].end, while accounting for possible 2M and 1GB ++ * pages. Then find enough contiguous space for those page tables. ++ */ ++static void __init find_early_table_space(struct map_range *mr, int nr_range) + { +- unsigned long puds, pmds, ptes, tables, start = 0, good_end = end; ++ int i; ++ unsigned long puds = 0, pmds = 0, ptes = 0, tables; ++ unsigned long start = 0, good_end; + phys_addr_t base; + +- puds = (end + PUD_SIZE - 1) >> PUD_SHIFT; +- tables = roundup(puds * sizeof(pud_t), PAGE_SIZE); +- +- if (use_gbpages) { +- unsigned long extra; +- +- extra = end - ((end>>PUD_SHIFT) << PUD_SHIFT); +- pmds = (extra + PMD_SIZE - 1) >> PMD_SHIFT; +- } else +- pmds = (end + PMD_SIZE - 1) >> PMD_SHIFT; ++ for (i = 0; i < nr_range; i++) { ++ unsigned long range, extra; + +- tables += roundup(pmds * sizeof(pmd_t), PAGE_SIZE); ++ range = mr[i].end - mr[i].start; ++ puds += (range + PUD_SIZE - 1) >> PUD_SHIFT; + +- if (use_pse) { +- unsigned long extra; ++ if (mr[i].page_size_mask & (1 << PG_LEVEL_1G)) { ++ extra = range - ((range >> PUD_SHIFT) << PUD_SHIFT); ++ pmds += (extra + PMD_SIZE - 1) >> PMD_SHIFT; ++ } else { ++ pmds += (range + PMD_SIZE - 1) >> PMD_SHIFT; ++ } + +- extra = end - ((end>>PMD_SHIFT) << PMD_SHIFT); ++ if (mr[i].page_size_mask & (1 << PG_LEVEL_2M)) { ++ extra = range - ((range >> PMD_SHIFT) << PMD_SHIFT); + #ifdef CONFIG_X86_32 +- extra += PMD_SIZE; ++ extra += PMD_SIZE; + #endif +- /* The first 2/4M doesn't use large pages. */ +- if (mr->start < PMD_SIZE) +- extra += mr->end - mr->start; +- +- ptes = (extra + PAGE_SIZE - 1) >> PAGE_SHIFT; +- } else +- ptes = (end + PAGE_SIZE - 1) >> PAGE_SHIFT; ++ ptes += (extra + PAGE_SIZE - 1) >> PAGE_SHIFT; ++ } else { ++ ptes += (range + PAGE_SIZE - 1) >> PAGE_SHIFT; ++ } ++ } + ++ tables = roundup(puds * sizeof(pud_t), PAGE_SIZE); ++ tables += roundup(pmds * sizeof(pmd_t), PAGE_SIZE); + tables += roundup(ptes * sizeof(pte_t), PAGE_SIZE); + + #ifdef CONFIG_X86_32 +@@ -86,7 +90,7 @@ static void __init find_early_table_space(struct map_range *mr, unsigned long en + pgt_buf_top = pgt_buf_start + (tables >> PAGE_SHIFT); + + printk(KERN_DEBUG "kernel direct mapping tables up to %#lx @ [mem %#010lx-%#010lx]\n", +- end - 1, pgt_buf_start << PAGE_SHIFT, ++ mr[nr_range - 1].end - 1, pgt_buf_start << PAGE_SHIFT, + (pgt_buf_top << PAGE_SHIFT) - 1); + } + +@@ -267,7 +271,7 @@ unsigned long __init_refok init_memory_mapping(unsigned long start, + * nodes are discovered. + */ + if (!after_bootmem) +- find_early_table_space(&mr[0], end, use_pse, use_gbpages); ++ find_early_table_space(mr, nr_range); + + for (i = 0; i < nr_range; i++) + ret = kernel_physical_mapping_init(mr[i].start, mr[i].end, +diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c +index 2b6b4a3..3baff25 100644 +--- a/arch/x86/mm/init_64.c ++++ b/arch/x86/mm/init_64.c +@@ -386,7 +386,8 @@ phys_pte_init(pte_t *pte_page, unsigned long addr, unsigned long end, + * these mappings are more intelligent. + */ + if (pte_val(*pte)) { +- pages++; ++ if (!after_bootmem) ++ pages++; + continue; + } + +@@ -451,6 +452,8 @@ phys_pmd_init(pmd_t *pmd_page, unsigned long address, unsigned long end, + * attributes. + */ + if (page_size_mask & (1 << PG_LEVEL_2M)) { ++ if (!after_bootmem) ++ pages++; + last_map_addr = next; + continue; + } +@@ -526,6 +529,8 @@ phys_pud_init(pud_t *pud_page, unsigned long addr, unsigned long end, + * attributes. + */ + if (page_size_mask & (1 << PG_LEVEL_1G)) { ++ if (!after_bootmem) ++ pages++; + last_map_addr = next; + continue; + } +diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c +index f55a4ce..72d8899 100644 +--- a/arch/x86/platform/efi/efi.c ++++ b/arch/x86/platform/efi/efi.c +@@ -69,11 +69,15 @@ EXPORT_SYMBOL(efi); + struct efi_memory_map memmap; + + bool efi_64bit; +-static bool efi_native; + + static struct efi efi_phys __initdata; + static efi_system_table_t efi_systab __initdata; + ++static inline bool efi_is_native(void) ++{ ++ return IS_ENABLED(CONFIG_X86_64) == efi_64bit; ++} ++ + static int __init setup_noefi(char *arg) + { + efi_enabled = 0; +@@ -419,10 +423,21 @@ void __init efi_reserve_boot_services(void) + } + } + +-static void __init efi_free_boot_services(void) ++void __init efi_unmap_memmap(void) ++{ ++ if (memmap.map) { ++ early_iounmap(memmap.map, memmap.nr_map * memmap.desc_size); ++ memmap.map = NULL; ++ } ++} ++ ++void __init efi_free_boot_services(void) + { + void *p; + ++ if (!efi_is_native()) ++ return; ++ + for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) { + efi_memory_desc_t *md = p; + unsigned long long start = md->phys_addr; +@@ -438,6 +453,8 @@ static void __init efi_free_boot_services(void) + + free_bootmem_late(start, size); + } ++ ++ efi_unmap_memmap(); + } + + static int __init efi_systab_init(void *phys) +@@ -670,12 +687,10 @@ void __init efi_init(void) + return; + } + efi_phys.systab = (efi_system_table_t *)boot_params.efi_info.efi_systab; +- efi_native = !efi_64bit; + #else + efi_phys.systab = (efi_system_table_t *) + (boot_params.efi_info.efi_systab | + ((__u64)boot_params.efi_info.efi_systab_hi<<32)); +- efi_native = efi_64bit; + #endif + + if (efi_systab_init(efi_phys.systab)) { +@@ -709,7 +724,7 @@ void __init efi_init(void) + * that doesn't match the kernel 32/64-bit mode. + */ + +- if (!efi_native) ++ if (!efi_is_native()) + pr_info("No EFI runtime due to 32/64-bit mismatch with kernel\n"); + else if (efi_runtime_init()) { + efi_enabled = 0; +@@ -721,7 +736,7 @@ void __init efi_init(void) + return; + } + #ifdef CONFIG_X86_32 +- if (efi_native) { ++ if (efi_is_native()) { + x86_platform.get_wallclock = efi_get_time; + x86_platform.set_wallclock = efi_set_rtc_mmss; + } +@@ -787,8 +802,10 @@ void __init efi_enter_virtual_mode(void) + * non-native EFI + */ + +- if (!efi_native) +- goto out; ++ if (!efi_is_native()) { ++ efi_unmap_memmap(); ++ return; ++ } + + /* Merge contiguous regions of the same type and attribute */ + for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) { +@@ -878,13 +895,6 @@ void __init efi_enter_virtual_mode(void) + } + + /* +- * Thankfully, it does seem that no runtime services other than +- * SetVirtualAddressMap() will touch boot services code, so we can +- * get rid of it all at this point +- */ +- efi_free_boot_services(); +- +- /* + * Now that EFI is in virtual mode, update the function + * pointers in the runtime service table to the new virtual addresses. + * +@@ -907,9 +917,6 @@ void __init efi_enter_virtual_mode(void) + if (__supported_pte_mask & _PAGE_NX) + runtime_code_page_mkexec(); + +-out: +- early_iounmap(memmap.map, memmap.nr_map * memmap.desc_size); +- memmap.map = NULL; + kfree(new_memmap); + } + +diff --git a/drivers/bcma/main.c b/drivers/bcma/main.c +index 758af9c..0059e26 100644 +--- a/drivers/bcma/main.c ++++ b/drivers/bcma/main.c +@@ -141,9 +141,10 @@ static int bcma_register_cores(struct bcma_bus *bus) + + static void bcma_unregister_cores(struct bcma_bus *bus) + { +- struct bcma_device *core; ++ struct bcma_device *core, *tmp; + +- list_for_each_entry(core, &bus->cores, list) { ++ list_for_each_entry_safe(core, tmp, &bus->cores, list) { ++ list_del(&core->list); + if (core->dev_registered) + device_unregister(&core->dev); + } +diff --git a/drivers/cpufreq/powernow-k8.c b/drivers/cpufreq/powernow-k8.c +index 1a40935..c671369 100644 +--- a/drivers/cpufreq/powernow-k8.c ++++ b/drivers/cpufreq/powernow-k8.c +@@ -1223,14 +1223,7 @@ static int powernowk8_target(struct cpufreq_policy *pol, + struct powernowk8_target_arg pta = { .pol = pol, .targfreq = targfreq, + .relation = relation }; + +- /* +- * Must run on @pol->cpu. cpufreq core is responsible for ensuring +- * that we're bound to the current CPU and pol->cpu stays online. +- */ +- if (smp_processor_id() == pol->cpu) +- return powernowk8_target_fn(&pta); +- else +- return work_on_cpu(pol->cpu, powernowk8_target_fn, &pta); ++ return work_on_cpu(pol->cpu, powernowk8_target_fn, &pta); + } + + /* Driver entry point to verify the policy and range of frequencies */ +diff --git a/drivers/dma/imx-dma.c b/drivers/dma/imx-dma.c +index 5084975..8aa9113 100644 +--- a/drivers/dma/imx-dma.c ++++ b/drivers/dma/imx-dma.c +@@ -474,8 +474,10 @@ static int imxdma_xfer_desc(struct imxdma_desc *d) + slot = i; + break; + } +- if (slot < 0) ++ if (slot < 0) { ++ spin_unlock_irqrestore(&imxdma->lock, flags); + return -EBUSY; ++ } + + imxdma->slots_2d[slot].xsr = d->x; + imxdma->slots_2d[slot].ysr = d->y; +diff --git a/drivers/dma/sirf-dma.c b/drivers/dma/sirf-dma.c +index 434ad31..c439489 100644 +--- a/drivers/dma/sirf-dma.c ++++ b/drivers/dma/sirf-dma.c +@@ -109,7 +109,7 @@ static void sirfsoc_dma_execute(struct sirfsoc_dma_chan *schan) + sdesc = list_first_entry(&schan->queued, struct sirfsoc_dma_desc, + node); + /* Move the first queued descriptor to active list */ +- list_move_tail(&schan->queued, &schan->active); ++ list_move_tail(&sdesc->node, &schan->active); + + /* Start the DMA transfer */ + writel_relaxed(sdesc->width, sdma->base + SIRFSOC_DMA_WIDTH_0 + +@@ -428,7 +428,7 @@ static struct dma_async_tx_descriptor *sirfsoc_dma_prep_interleaved( + unsigned long iflags; + int ret; + +- if ((xt->dir != DMA_MEM_TO_DEV) || (xt->dir != DMA_DEV_TO_MEM)) { ++ if ((xt->dir != DMA_MEM_TO_DEV) && (xt->dir != DMA_DEV_TO_MEM)) { + ret = -EINVAL; + goto err_dir; + } +diff --git a/drivers/extcon/extcon_class.c b/drivers/extcon/extcon_class.c +index f6419f9..7dcfb7c 100644 +--- a/drivers/extcon/extcon_class.c ++++ b/drivers/extcon/extcon_class.c +@@ -575,6 +575,10 @@ static void extcon_cleanup(struct extcon_dev *edev, bool skip) + kfree(edev->cables); + } + ++#if defined(CONFIG_ANDROID) ++ if (switch_class) ++ class_compat_remove_link(switch_class, edev->dev, NULL); ++#endif + device_unregister(edev->dev); + put_device(edev->dev); + } +@@ -821,6 +825,9 @@ module_init(extcon_class_init); + + static void __exit extcon_class_exit(void) + { ++#if defined(CONFIG_ANDROID) ++ class_compat_unregister(switch_class); ++#endif + class_destroy(extcon_class); + } + module_exit(extcon_class_exit); +diff --git a/drivers/gpu/drm/radeon/evergreen_cs.c b/drivers/gpu/drm/radeon/evergreen_cs.c +index d883b20..e932810 100644 +--- a/drivers/gpu/drm/radeon/evergreen_cs.c ++++ b/drivers/gpu/drm/radeon/evergreen_cs.c +@@ -2829,6 +2829,7 @@ static bool evergreen_vm_reg_valid(u32 reg) + case CAYMAN_SQ_EX_ALLOC_TABLE_SLOTS: + return true; + default: ++ DRM_ERROR("Invalid register 0x%x in CS\n", reg); + return false; + } + } +diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c +index 4065374..f4c3d28 100644 +--- a/drivers/hv/channel.c ++++ b/drivers/hv/channel.c +@@ -146,14 +146,14 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size, + + if (ret != 0) { + err = ret; +- goto errorout; ++ goto error0; + } + + ret = hv_ringbuffer_init( + &newchannel->inbound, in, recv_ringbuffer_size); + if (ret != 0) { + err = ret; +- goto errorout; ++ goto error0; + } + + +@@ -168,7 +168,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size, + + if (ret != 0) { + err = ret; +- goto errorout; ++ goto error0; + } + + /* Create and init the channel open message */ +@@ -177,7 +177,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size, + GFP_KERNEL); + if (!open_info) { + err = -ENOMEM; +- goto errorout; ++ goto error0; + } + + init_completion(&open_info->waitevent); +@@ -193,7 +193,7 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size, + + if (userdatalen > MAX_USER_DEFINED_BYTES) { + err = -EINVAL; +- goto errorout; ++ goto error0; + } + + if (userdatalen) +@@ -208,19 +208,18 @@ int vmbus_open(struct vmbus_channel *newchannel, u32 send_ringbuffer_size, + sizeof(struct vmbus_channel_open_channel)); + + if (ret != 0) +- goto cleanup; ++ goto error1; + + t = wait_for_completion_timeout(&open_info->waitevent, 5*HZ); + if (t == 0) { + err = -ETIMEDOUT; +- goto errorout; ++ goto error1; + } + + + if (open_info->response.open_result.status) + err = open_info->response.open_result.status; + +-cleanup: + spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags); + list_del(&open_info->msglistentry); + spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags); +@@ -228,9 +227,12 @@ cleanup: + kfree(open_info); + return err; + +-errorout: +- hv_ringbuffer_cleanup(&newchannel->outbound); +- hv_ringbuffer_cleanup(&newchannel->inbound); ++error1: ++ spin_lock_irqsave(&vmbus_connection.channelmsg_lock, flags); ++ list_del(&open_info->msglistentry); ++ spin_unlock_irqrestore(&vmbus_connection.channelmsg_lock, flags); ++ ++error0: + free_pages((unsigned long)out, + get_order(send_ringbuffer_size + recv_ringbuffer_size)); + kfree(open_info); +diff --git a/drivers/net/ethernet/tile/tilegx.c b/drivers/net/ethernet/tile/tilegx.c +index 4e2a162..4e98100 100644 +--- a/drivers/net/ethernet/tile/tilegx.c ++++ b/drivers/net/ethernet/tile/tilegx.c +@@ -1334,11 +1334,11 @@ static int tso_count_edescs(struct sk_buff *skb) + { + struct skb_shared_info *sh = skb_shinfo(skb); + unsigned int sh_len = skb_transport_offset(skb) + tcp_hdrlen(skb); +- unsigned int data_len = skb->data_len + skb->hdr_len - sh_len; ++ unsigned int data_len = skb->len - sh_len; + unsigned int p_len = sh->gso_size; + long f_id = -1; /* id of the current fragment */ +- long f_size = skb->hdr_len; /* size of the current fragment */ +- long f_used = sh_len; /* bytes used from the current fragment */ ++ long f_size = skb_headlen(skb) - sh_len; /* current fragment size */ ++ long f_used = 0; /* bytes used from the current fragment */ + long n; /* size of the current piece of payload */ + int num_edescs = 0; + int segment; +@@ -1353,7 +1353,7 @@ static int tso_count_edescs(struct sk_buff *skb) + /* Advance as needed. */ + while (f_used >= f_size) { + f_id++; +- f_size = sh->frags[f_id].size; ++ f_size = skb_frag_size(&sh->frags[f_id]); + f_used = 0; + } + +@@ -1384,13 +1384,13 @@ static void tso_headers_prepare(struct sk_buff *skb, unsigned char *headers, + struct iphdr *ih; + struct tcphdr *th; + unsigned int sh_len = skb_transport_offset(skb) + tcp_hdrlen(skb); +- unsigned int data_len = skb->data_len + skb->hdr_len - sh_len; ++ unsigned int data_len = skb->len - sh_len; + unsigned char *data = skb->data; + unsigned int ih_off, th_off, p_len; + unsigned int isum_seed, tsum_seed, id, seq; + long f_id = -1; /* id of the current fragment */ +- long f_size = skb->hdr_len; /* size of the current fragment */ +- long f_used = sh_len; /* bytes used from the current fragment */ ++ long f_size = skb_headlen(skb) - sh_len; /* current fragment size */ ++ long f_used = 0; /* bytes used from the current fragment */ + long n; /* size of the current piece of payload */ + int segment; + +@@ -1405,7 +1405,7 @@ static void tso_headers_prepare(struct sk_buff *skb, unsigned char *headers, + isum_seed = ((0xFFFF - ih->check) + + (0xFFFF - ih->tot_len) + + (0xFFFF - ih->id)); +- tsum_seed = th->check + (0xFFFF ^ htons(sh_len + data_len)); ++ tsum_seed = th->check + (0xFFFF ^ htons(skb->len)); + id = ntohs(ih->id); + seq = ntohl(th->seq); + +@@ -1444,7 +1444,7 @@ static void tso_headers_prepare(struct sk_buff *skb, unsigned char *headers, + /* Advance as needed. */ + while (f_used >= f_size) { + f_id++; +- f_size = sh->frags[f_id].size; ++ f_size = skb_frag_size(&sh->frags[f_id]); + f_used = 0; + } + +@@ -1478,14 +1478,14 @@ static void tso_egress(struct net_device *dev, gxio_mpipe_equeue_t *equeue, + struct tile_net_priv *priv = netdev_priv(dev); + struct skb_shared_info *sh = skb_shinfo(skb); + unsigned int sh_len = skb_transport_offset(skb) + tcp_hdrlen(skb); +- unsigned int data_len = skb->data_len + skb->hdr_len - sh_len; ++ unsigned int data_len = skb->len - sh_len; + unsigned int p_len = sh->gso_size; + gxio_mpipe_edesc_t edesc_head = { { 0 } }; + gxio_mpipe_edesc_t edesc_body = { { 0 } }; + long f_id = -1; /* id of the current fragment */ +- long f_size = skb->hdr_len; /* size of the current fragment */ +- long f_used = sh_len; /* bytes used from the current fragment */ +- void *f_data = skb->data; ++ long f_size = skb_headlen(skb) - sh_len; /* current fragment size */ ++ long f_used = 0; /* bytes used from the current fragment */ ++ void *f_data = skb->data + sh_len; + long n; /* size of the current piece of payload */ + unsigned long tx_packets = 0, tx_bytes = 0; + unsigned int csum_start; +@@ -1516,15 +1516,18 @@ static void tso_egress(struct net_device *dev, gxio_mpipe_equeue_t *equeue, + + /* Egress the payload. */ + while (p_used < p_len) { ++ void *va; + + /* Advance as needed. */ + while (f_used >= f_size) { + f_id++; +- f_size = sh->frags[f_id].size; +- f_used = 0; ++ f_size = skb_frag_size(&sh->frags[f_id]); + f_data = tile_net_frag_buf(&sh->frags[f_id]); ++ f_used = 0; + } + ++ va = f_data + f_used; ++ + /* Use bytes from the current fragment. */ + n = p_len - p_used; + if (n > f_size - f_used) +@@ -1533,7 +1536,7 @@ static void tso_egress(struct net_device *dev, gxio_mpipe_equeue_t *equeue, + p_used += n; + + /* Egress a piece of the payload. */ +- edesc_body.va = va_to_tile_io_addr(f_data) + f_used; ++ edesc_body.va = va_to_tile_io_addr(va); + edesc_body.xfer_size = n; + edesc_body.bound = !(p_used < p_len); + gxio_mpipe_equeue_put_at(equeue, edesc_body, slot); +diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c +index a03de71..d012982 100644 +--- a/drivers/net/usb/cdc_ether.c ++++ b/drivers/net/usb/cdc_ether.c +@@ -592,6 +592,32 @@ static const struct usb_device_id products [] = { + .driver_info = 0, + }, + ++/* Novatel USB551L and MC551 - handled by qmi_wwan */ ++{ ++ .match_flags = USB_DEVICE_ID_MATCH_VENDOR ++ | USB_DEVICE_ID_MATCH_PRODUCT ++ | USB_DEVICE_ID_MATCH_INT_INFO, ++ .idVendor = NOVATEL_VENDOR_ID, ++ .idProduct = 0xB001, ++ .bInterfaceClass = USB_CLASS_COMM, ++ .bInterfaceSubClass = USB_CDC_SUBCLASS_ETHERNET, ++ .bInterfaceProtocol = USB_CDC_PROTO_NONE, ++ .driver_info = 0, ++}, ++ ++/* Novatel E362 - handled by qmi_wwan */ ++{ ++ .match_flags = USB_DEVICE_ID_MATCH_VENDOR ++ | USB_DEVICE_ID_MATCH_PRODUCT ++ | USB_DEVICE_ID_MATCH_INT_INFO, ++ .idVendor = NOVATEL_VENDOR_ID, ++ .idProduct = 0x9010, ++ .bInterfaceClass = USB_CLASS_COMM, ++ .bInterfaceSubClass = USB_CDC_SUBCLASS_ETHERNET, ++ .bInterfaceProtocol = USB_CDC_PROTO_NONE, ++ .driver_info = 0, ++}, ++ + /* + * WHITELIST!!! + * +@@ -604,21 +630,6 @@ static const struct usb_device_id products [] = { + * because of bugs/quirks in a given product (like Zaurus, above). + */ + { +- /* Novatel USB551L */ +- /* This match must come *before* the generic CDC-ETHER match so that +- * we get FLAG_WWAN set on the device, since it's descriptors are +- * generic CDC-ETHER. +- */ +- .match_flags = USB_DEVICE_ID_MATCH_VENDOR +- | USB_DEVICE_ID_MATCH_PRODUCT +- | USB_DEVICE_ID_MATCH_INT_INFO, +- .idVendor = NOVATEL_VENDOR_ID, +- .idProduct = 0xB001, +- .bInterfaceClass = USB_CLASS_COMM, +- .bInterfaceSubClass = USB_CDC_SUBCLASS_ETHERNET, +- .bInterfaceProtocol = USB_CDC_PROTO_NONE, +- .driver_info = (unsigned long)&wwan_info, +-}, { + /* ZTE (Vodafone) K3805-Z */ + .match_flags = USB_DEVICE_ID_MATCH_VENDOR + | USB_DEVICE_ID_MATCH_PRODUCT +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 3543c9e..3585f93 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -364,6 +364,20 @@ static const struct usb_device_id products[] = { + USB_VENDOR_AND_INTERFACE_INFO(HUAWEI_VENDOR_ID, USB_CLASS_VENDOR_SPEC, 1, 57), + .driver_info = (unsigned long)&qmi_wwan_info, + }, ++ { /* Novatel USB551L and MC551 */ ++ USB_DEVICE_AND_INTERFACE_INFO(0x1410, 0xb001, ++ USB_CLASS_COMM, ++ USB_CDC_SUBCLASS_ETHERNET, ++ USB_CDC_PROTO_NONE), ++ .driver_info = (unsigned long)&qmi_wwan_info, ++ }, ++ { /* Novatel E362 */ ++ USB_DEVICE_AND_INTERFACE_INFO(0x1410, 0x9010, ++ USB_CLASS_COMM, ++ USB_CDC_SUBCLASS_ETHERNET, ++ USB_CDC_PROTO_NONE), ++ .driver_info = (unsigned long)&qmi_wwan_info, ++ }, + + /* 2. Combined interface devices matching on class+protocol */ + { /* Huawei E367 and possibly others in "Windows mode" */ +diff --git a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h +index 89bf94d..6f7cf49 100644 +--- a/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h ++++ b/drivers/net/wireless/ath/ath9k/ar9003_2p2_initvals.h +@@ -534,107 +534,107 @@ static const u32 ar9300_2p2_baseband_core[][2] = { + + static const u32 ar9300Modes_high_power_tx_gain_table_2p2[][5] = { + /* Addr 5G_HT20 5G_HT40 2G_HT40 2G_HT20 */ +- {0x0000a2dc, 0x000cfff0, 0x000cfff0, 0x03aaa352, 0x03aaa352}, +- {0x0000a2e0, 0x000f0000, 0x000f0000, 0x03ccc584, 0x03ccc584}, +- {0x0000a2e4, 0x03f00000, 0x03f00000, 0x03f0f800, 0x03f0f800}, ++ {0x0000a2dc, 0x00033800, 0x00033800, 0x03aaa352, 0x03aaa352}, ++ {0x0000a2e0, 0x0003c000, 0x0003c000, 0x03ccc584, 0x03ccc584}, ++ {0x0000a2e4, 0x03fc0000, 0x03fc0000, 0x03f0f800, 0x03f0f800}, + {0x0000a2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000}, + {0x0000a410, 0x000050d9, 0x000050d9, 0x000050d9, 0x000050d9}, + {0x0000a500, 0x00000000, 0x00000000, 0x00000000, 0x00000000}, + {0x0000a504, 0x06000003, 0x06000003, 0x04000002, 0x04000002}, + {0x0000a508, 0x0a000020, 0x0a000020, 0x08000004, 0x08000004}, + {0x0000a50c, 0x10000023, 0x10000023, 0x0b000200, 0x0b000200}, +- {0x0000a510, 0x15000028, 0x15000028, 0x0f000202, 0x0f000202}, +- {0x0000a514, 0x1b00002b, 0x1b00002b, 0x12000400, 0x12000400}, +- {0x0000a518, 0x1f020028, 0x1f020028, 0x16000402, 0x16000402}, +- {0x0000a51c, 0x2502002b, 0x2502002b, 0x19000404, 0x19000404}, +- {0x0000a520, 0x2a04002a, 0x2a04002a, 0x1c000603, 0x1c000603}, +- {0x0000a524, 0x2e06002a, 0x2e06002a, 0x21000a02, 0x21000a02}, +- {0x0000a528, 0x3302202d, 0x3302202d, 0x25000a04, 0x25000a04}, +- {0x0000a52c, 0x3804202c, 0x3804202c, 0x28000a20, 0x28000a20}, +- {0x0000a530, 0x3c06202c, 0x3c06202c, 0x2c000e20, 0x2c000e20}, +- {0x0000a534, 0x4108202d, 0x4108202d, 0x30000e22, 0x30000e22}, +- {0x0000a538, 0x4506402d, 0x4506402d, 0x34000e24, 0x34000e24}, +- {0x0000a53c, 0x4906222d, 0x4906222d, 0x38001640, 0x38001640}, +- {0x0000a540, 0x4d062231, 0x4d062231, 0x3c001660, 0x3c001660}, +- {0x0000a544, 0x50082231, 0x50082231, 0x3f001861, 0x3f001861}, +- {0x0000a548, 0x5608422e, 0x5608422e, 0x43001a81, 0x43001a81}, +- {0x0000a54c, 0x5a08442e, 0x5a08442e, 0x47001a83, 0x47001a83}, +- {0x0000a550, 0x5e0a4431, 0x5e0a4431, 0x4a001c84, 0x4a001c84}, +- {0x0000a554, 0x640a4432, 0x640a4432, 0x4e001ce3, 0x4e001ce3}, +- {0x0000a558, 0x680a4434, 0x680a4434, 0x52001ce5, 0x52001ce5}, +- {0x0000a55c, 0x6c0a6434, 0x6c0a6434, 0x56001ce9, 0x56001ce9}, +- {0x0000a560, 0x6f0a6633, 0x6f0a6633, 0x5a001ceb, 0x5a001ceb}, +- {0x0000a564, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec}, +- {0x0000a568, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec}, +- {0x0000a56c, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec}, +- {0x0000a570, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec}, +- {0x0000a574, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec}, +- {0x0000a578, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec}, +- {0x0000a57c, 0x730c6634, 0x730c6634, 0x5d001eec, 0x5d001eec}, ++ {0x0000a510, 0x16000220, 0x16000220, 0x0f000202, 0x0f000202}, ++ {0x0000a514, 0x1c000223, 0x1c000223, 0x12000400, 0x12000400}, ++ {0x0000a518, 0x21002220, 0x21002220, 0x16000402, 0x16000402}, ++ {0x0000a51c, 0x27002223, 0x27002223, 0x19000404, 0x19000404}, ++ {0x0000a520, 0x2b022220, 0x2b022220, 0x1c000603, 0x1c000603}, ++ {0x0000a524, 0x2f022222, 0x2f022222, 0x21000a02, 0x21000a02}, ++ {0x0000a528, 0x34022225, 0x34022225, 0x25000a04, 0x25000a04}, ++ {0x0000a52c, 0x3a02222a, 0x3a02222a, 0x28000a20, 0x28000a20}, ++ {0x0000a530, 0x3e02222c, 0x3e02222c, 0x2c000e20, 0x2c000e20}, ++ {0x0000a534, 0x4202242a, 0x4202242a, 0x30000e22, 0x30000e22}, ++ {0x0000a538, 0x4702244a, 0x4702244a, 0x34000e24, 0x34000e24}, ++ {0x0000a53c, 0x4b02244c, 0x4b02244c, 0x38001640, 0x38001640}, ++ {0x0000a540, 0x4e02246c, 0x4e02246c, 0x3c001660, 0x3c001660}, ++ {0x0000a544, 0x52022470, 0x52022470, 0x3f001861, 0x3f001861}, ++ {0x0000a548, 0x55022490, 0x55022490, 0x43001a81, 0x43001a81}, ++ {0x0000a54c, 0x59022492, 0x59022492, 0x47001a83, 0x47001a83}, ++ {0x0000a550, 0x5d022692, 0x5d022692, 0x4a001c84, 0x4a001c84}, ++ {0x0000a554, 0x61022892, 0x61022892, 0x4e001ce3, 0x4e001ce3}, ++ {0x0000a558, 0x65024890, 0x65024890, 0x52001ce5, 0x52001ce5}, ++ {0x0000a55c, 0x69024892, 0x69024892, 0x56001ce9, 0x56001ce9}, ++ {0x0000a560, 0x6e024c92, 0x6e024c92, 0x5a001ceb, 0x5a001ceb}, ++ {0x0000a564, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec}, ++ {0x0000a568, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec}, ++ {0x0000a56c, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec}, ++ {0x0000a570, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec}, ++ {0x0000a574, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec}, ++ {0x0000a578, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec}, ++ {0x0000a57c, 0x74026e92, 0x74026e92, 0x5d001eec, 0x5d001eec}, + {0x0000a580, 0x00800000, 0x00800000, 0x00800000, 0x00800000}, + {0x0000a584, 0x06800003, 0x06800003, 0x04800002, 0x04800002}, + {0x0000a588, 0x0a800020, 0x0a800020, 0x08800004, 0x08800004}, + {0x0000a58c, 0x10800023, 0x10800023, 0x0b800200, 0x0b800200}, +- {0x0000a590, 0x15800028, 0x15800028, 0x0f800202, 0x0f800202}, +- {0x0000a594, 0x1b80002b, 0x1b80002b, 0x12800400, 0x12800400}, +- {0x0000a598, 0x1f820028, 0x1f820028, 0x16800402, 0x16800402}, +- {0x0000a59c, 0x2582002b, 0x2582002b, 0x19800404, 0x19800404}, +- {0x0000a5a0, 0x2a84002a, 0x2a84002a, 0x1c800603, 0x1c800603}, +- {0x0000a5a4, 0x2e86002a, 0x2e86002a, 0x21800a02, 0x21800a02}, +- {0x0000a5a8, 0x3382202d, 0x3382202d, 0x25800a04, 0x25800a04}, +- {0x0000a5ac, 0x3884202c, 0x3884202c, 0x28800a20, 0x28800a20}, +- {0x0000a5b0, 0x3c86202c, 0x3c86202c, 0x2c800e20, 0x2c800e20}, +- {0x0000a5b4, 0x4188202d, 0x4188202d, 0x30800e22, 0x30800e22}, +- {0x0000a5b8, 0x4586402d, 0x4586402d, 0x34800e24, 0x34800e24}, +- {0x0000a5bc, 0x4986222d, 0x4986222d, 0x38801640, 0x38801640}, +- {0x0000a5c0, 0x4d862231, 0x4d862231, 0x3c801660, 0x3c801660}, +- {0x0000a5c4, 0x50882231, 0x50882231, 0x3f801861, 0x3f801861}, +- {0x0000a5c8, 0x5688422e, 0x5688422e, 0x43801a81, 0x43801a81}, +- {0x0000a5cc, 0x5a88442e, 0x5a88442e, 0x47801a83, 0x47801a83}, +- {0x0000a5d0, 0x5e8a4431, 0x5e8a4431, 0x4a801c84, 0x4a801c84}, +- {0x0000a5d4, 0x648a4432, 0x648a4432, 0x4e801ce3, 0x4e801ce3}, +- {0x0000a5d8, 0x688a4434, 0x688a4434, 0x52801ce5, 0x52801ce5}, +- {0x0000a5dc, 0x6c8a6434, 0x6c8a6434, 0x56801ce9, 0x56801ce9}, +- {0x0000a5e0, 0x6f8a6633, 0x6f8a6633, 0x5a801ceb, 0x5a801ceb}, +- {0x0000a5e4, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec}, +- {0x0000a5e8, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec}, +- {0x0000a5ec, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec}, +- {0x0000a5f0, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec}, +- {0x0000a5f4, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec}, +- {0x0000a5f8, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec}, +- {0x0000a5fc, 0x738c6634, 0x738c6634, 0x5d801eec, 0x5d801eec}, ++ {0x0000a590, 0x16800220, 0x16800220, 0x0f800202, 0x0f800202}, ++ {0x0000a594, 0x1c800223, 0x1c800223, 0x12800400, 0x12800400}, ++ {0x0000a598, 0x21802220, 0x21802220, 0x16800402, 0x16800402}, ++ {0x0000a59c, 0x27802223, 0x27802223, 0x19800404, 0x19800404}, ++ {0x0000a5a0, 0x2b822220, 0x2b822220, 0x1c800603, 0x1c800603}, ++ {0x0000a5a4, 0x2f822222, 0x2f822222, 0x21800a02, 0x21800a02}, ++ {0x0000a5a8, 0x34822225, 0x34822225, 0x25800a04, 0x25800a04}, ++ {0x0000a5ac, 0x3a82222a, 0x3a82222a, 0x28800a20, 0x28800a20}, ++ {0x0000a5b0, 0x3e82222c, 0x3e82222c, 0x2c800e20, 0x2c800e20}, ++ {0x0000a5b4, 0x4282242a, 0x4282242a, 0x30800e22, 0x30800e22}, ++ {0x0000a5b8, 0x4782244a, 0x4782244a, 0x34800e24, 0x34800e24}, ++ {0x0000a5bc, 0x4b82244c, 0x4b82244c, 0x38801640, 0x38801640}, ++ {0x0000a5c0, 0x4e82246c, 0x4e82246c, 0x3c801660, 0x3c801660}, ++ {0x0000a5c4, 0x52822470, 0x52822470, 0x3f801861, 0x3f801861}, ++ {0x0000a5c8, 0x55822490, 0x55822490, 0x43801a81, 0x43801a81}, ++ {0x0000a5cc, 0x59822492, 0x59822492, 0x47801a83, 0x47801a83}, ++ {0x0000a5d0, 0x5d822692, 0x5d822692, 0x4a801c84, 0x4a801c84}, ++ {0x0000a5d4, 0x61822892, 0x61822892, 0x4e801ce3, 0x4e801ce3}, ++ {0x0000a5d8, 0x65824890, 0x65824890, 0x52801ce5, 0x52801ce5}, ++ {0x0000a5dc, 0x69824892, 0x69824892, 0x56801ce9, 0x56801ce9}, ++ {0x0000a5e0, 0x6e824c92, 0x6e824c92, 0x5a801ceb, 0x5a801ceb}, ++ {0x0000a5e4, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec}, ++ {0x0000a5e8, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec}, ++ {0x0000a5ec, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec}, ++ {0x0000a5f0, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec}, ++ {0x0000a5f4, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec}, ++ {0x0000a5f8, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec}, ++ {0x0000a5fc, 0x74826e92, 0x74826e92, 0x5d801eec, 0x5d801eec}, + {0x0000a600, 0x00000000, 0x00000000, 0x00000000, 0x00000000}, + {0x0000a604, 0x00000000, 0x00000000, 0x00000000, 0x00000000}, +- {0x0000a608, 0x01804601, 0x01804601, 0x00000000, 0x00000000}, +- {0x0000a60c, 0x01804601, 0x01804601, 0x00000000, 0x00000000}, +- {0x0000a610, 0x01804601, 0x01804601, 0x00000000, 0x00000000}, +- {0x0000a614, 0x01804601, 0x01804601, 0x01404000, 0x01404000}, +- {0x0000a618, 0x01804601, 0x01804601, 0x01404501, 0x01404501}, +- {0x0000a61c, 0x01804601, 0x01804601, 0x02008501, 0x02008501}, +- {0x0000a620, 0x03408d02, 0x03408d02, 0x0280ca03, 0x0280ca03}, +- {0x0000a624, 0x0300cc03, 0x0300cc03, 0x03010c04, 0x03010c04}, +- {0x0000a628, 0x03410d04, 0x03410d04, 0x04014c04, 0x04014c04}, +- {0x0000a62c, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005}, +- {0x0000a630, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005}, +- {0x0000a634, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005}, +- {0x0000a638, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005}, +- {0x0000a63c, 0x03410d04, 0x03410d04, 0x04015005, 0x04015005}, +- {0x0000b2dc, 0x000cfff0, 0x000cfff0, 0x03aaa352, 0x03aaa352}, +- {0x0000b2e0, 0x000f0000, 0x000f0000, 0x03ccc584, 0x03ccc584}, +- {0x0000b2e4, 0x03f00000, 0x03f00000, 0x03f0f800, 0x03f0f800}, ++ {0x0000a608, 0x00000000, 0x00000000, 0x00000000, 0x00000000}, ++ {0x0000a60c, 0x00000000, 0x00000000, 0x00000000, 0x00000000}, ++ {0x0000a610, 0x00000000, 0x00000000, 0x00000000, 0x00000000}, ++ {0x0000a614, 0x02004000, 0x02004000, 0x01404000, 0x01404000}, ++ {0x0000a618, 0x02004801, 0x02004801, 0x01404501, 0x01404501}, ++ {0x0000a61c, 0x02808a02, 0x02808a02, 0x02008501, 0x02008501}, ++ {0x0000a620, 0x0380ce03, 0x0380ce03, 0x0280ca03, 0x0280ca03}, ++ {0x0000a624, 0x04411104, 0x04411104, 0x03010c04, 0x03010c04}, ++ {0x0000a628, 0x04411104, 0x04411104, 0x04014c04, 0x04014c04}, ++ {0x0000a62c, 0x04411104, 0x04411104, 0x04015005, 0x04015005}, ++ {0x0000a630, 0x04411104, 0x04411104, 0x04015005, 0x04015005}, ++ {0x0000a634, 0x04411104, 0x04411104, 0x04015005, 0x04015005}, ++ {0x0000a638, 0x04411104, 0x04411104, 0x04015005, 0x04015005}, ++ {0x0000a63c, 0x04411104, 0x04411104, 0x04015005, 0x04015005}, ++ {0x0000b2dc, 0x00033800, 0x00033800, 0x03aaa352, 0x03aaa352}, ++ {0x0000b2e0, 0x0003c000, 0x0003c000, 0x03ccc584, 0x03ccc584}, ++ {0x0000b2e4, 0x03fc0000, 0x03fc0000, 0x03f0f800, 0x03f0f800}, + {0x0000b2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000}, +- {0x0000c2dc, 0x000cfff0, 0x000cfff0, 0x03aaa352, 0x03aaa352}, +- {0x0000c2e0, 0x000f0000, 0x000f0000, 0x03ccc584, 0x03ccc584}, +- {0x0000c2e4, 0x03f00000, 0x03f00000, 0x03f0f800, 0x03f0f800}, ++ {0x0000c2dc, 0x00033800, 0x00033800, 0x03aaa352, 0x03aaa352}, ++ {0x0000c2e0, 0x0003c000, 0x0003c000, 0x03ccc584, 0x03ccc584}, ++ {0x0000c2e4, 0x03fc0000, 0x03fc0000, 0x03f0f800, 0x03f0f800}, + {0x0000c2e8, 0x00000000, 0x00000000, 0x03ff0000, 0x03ff0000}, + {0x00016044, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4}, +- {0x00016048, 0x61200001, 0x61200001, 0x66480001, 0x66480001}, ++ {0x00016048, 0x66480001, 0x66480001, 0x66480001, 0x66480001}, + {0x00016068, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c}, + {0x00016444, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4}, +- {0x00016448, 0x61200001, 0x61200001, 0x66480001, 0x66480001}, ++ {0x00016448, 0x66480001, 0x66480001, 0x66480001, 0x66480001}, + {0x00016468, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c}, + {0x00016844, 0x012492d4, 0x012492d4, 0x012492d4, 0x012492d4}, +- {0x00016848, 0x61200001, 0x61200001, 0x66480001, 0x66480001}, ++ {0x00016848, 0x66480001, 0x66480001, 0x66480001, 0x66480001}, + {0x00016868, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c, 0x6db6db6c}, + }; + +diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c +index a140165..46d9d4e 100644 +--- a/drivers/net/wireless/b43/main.c ++++ b/drivers/net/wireless/b43/main.c +@@ -5374,6 +5374,8 @@ static void b43_bcma_remove(struct bcma_device *core) + cancel_work_sync(&wldev->restart_work); + + B43_WARN_ON(!wl); ++ if (!wldev->fw.ucode.data) ++ return; /* NULL if firmware never loaded */ + if (wl->current_dev == wldev && wl->hw_registred) { + b43_leds_stop(wldev); + ieee80211_unregister_hw(wl->hw); +@@ -5448,6 +5450,8 @@ static void b43_ssb_remove(struct ssb_device *sdev) + cancel_work_sync(&wldev->restart_work); + + B43_WARN_ON(!wl); ++ if (!wldev->fw.ucode.data) ++ return; /* NULL if firmware never loaded */ + if (wl->current_dev == wldev && wl->hw_registred) { + b43_leds_stop(wldev); + ieee80211_unregister_hw(wl->hw); +diff --git a/drivers/net/wireless/ipw2x00/ipw2200.c b/drivers/net/wireless/ipw2x00/ipw2200.c +index 0df4591..6d1754a 100644 +--- a/drivers/net/wireless/ipw2x00/ipw2200.c ++++ b/drivers/net/wireless/ipw2x00/ipw2200.c +@@ -10479,7 +10479,7 @@ static void ipw_handle_promiscuous_tx(struct ipw_priv *priv, + } else + len = src->len; + +- dst = alloc_skb(len + sizeof(*rt_hdr), GFP_ATOMIC); ++ dst = alloc_skb(len + sizeof(*rt_hdr) + sizeof(u16)*2, GFP_ATOMIC); + if (!dst) + continue; + +diff --git a/drivers/net/wireless/iwlwifi/dvm/devices.c b/drivers/net/wireless/iwlwifi/dvm/devices.c +index 349c205..da58620 100644 +--- a/drivers/net/wireless/iwlwifi/dvm/devices.c ++++ b/drivers/net/wireless/iwlwifi/dvm/devices.c +@@ -518,7 +518,7 @@ static int iwl6000_hw_channel_switch(struct iwl_priv *priv, + * See iwlagn_mac_channel_switch. + */ + struct iwl_rxon_context *ctx = &priv->contexts[IWL_RXON_CTX_BSS]; +- struct iwl6000_channel_switch_cmd cmd; ++ struct iwl6000_channel_switch_cmd *cmd; + u32 switch_time_in_usec, ucode_switch_time; + u16 ch; + u32 tsf_low; +@@ -527,18 +527,25 @@ static int iwl6000_hw_channel_switch(struct iwl_priv *priv, + struct ieee80211_vif *vif = ctx->vif; + struct iwl_host_cmd hcmd = { + .id = REPLY_CHANNEL_SWITCH, +- .len = { sizeof(cmd), }, ++ .len = { sizeof(*cmd), }, + .flags = CMD_SYNC, +- .data = { &cmd, }, ++ .dataflags[0] = IWL_HCMD_DFL_NOCOPY, + }; ++ int err; + +- cmd.band = priv->band == IEEE80211_BAND_2GHZ; ++ cmd = kzalloc(sizeof(*cmd), GFP_KERNEL); ++ if (!cmd) ++ return -ENOMEM; ++ ++ hcmd.data[0] = cmd; ++ ++ cmd->band = priv->band == IEEE80211_BAND_2GHZ; + ch = ch_switch->channel->hw_value; + IWL_DEBUG_11H(priv, "channel switch from %u to %u\n", + ctx->active.channel, ch); +- cmd.channel = cpu_to_le16(ch); +- cmd.rxon_flags = ctx->staging.flags; +- cmd.rxon_filter_flags = ctx->staging.filter_flags; ++ cmd->channel = cpu_to_le16(ch); ++ cmd->rxon_flags = ctx->staging.flags; ++ cmd->rxon_filter_flags = ctx->staging.filter_flags; + switch_count = ch_switch->count; + tsf_low = ch_switch->timestamp & 0x0ffffffff; + /* +@@ -554,23 +561,25 @@ static int iwl6000_hw_channel_switch(struct iwl_priv *priv, + switch_count = 0; + } + if (switch_count <= 1) +- cmd.switch_time = cpu_to_le32(priv->ucode_beacon_time); ++ cmd->switch_time = cpu_to_le32(priv->ucode_beacon_time); + else { + switch_time_in_usec = + vif->bss_conf.beacon_int * switch_count * TIME_UNIT; + ucode_switch_time = iwl_usecs_to_beacons(priv, + switch_time_in_usec, + beacon_interval); +- cmd.switch_time = iwl_add_beacon_time(priv, +- priv->ucode_beacon_time, +- ucode_switch_time, +- beacon_interval); ++ cmd->switch_time = iwl_add_beacon_time(priv, ++ priv->ucode_beacon_time, ++ ucode_switch_time, ++ beacon_interval); + } + IWL_DEBUG_11H(priv, "uCode time for the switch is 0x%x\n", +- cmd.switch_time); +- cmd.expect_beacon = ch_switch->channel->flags & IEEE80211_CHAN_RADAR; ++ cmd->switch_time); ++ cmd->expect_beacon = ch_switch->channel->flags & IEEE80211_CHAN_RADAR; + +- return iwl_dvm_send_cmd(priv, &hcmd); ++ err = iwl_dvm_send_cmd(priv, &hcmd); ++ kfree(cmd); ++ return err; + } + + struct iwl_lib_ops iwl6000_lib = { +diff --git a/drivers/rtc/rtc-imxdi.c b/drivers/rtc/rtc-imxdi.c +index 891cd6c..4eed510 100644 +--- a/drivers/rtc/rtc-imxdi.c ++++ b/drivers/rtc/rtc-imxdi.c +@@ -392,6 +392,8 @@ static int dryice_rtc_probe(struct platform_device *pdev) + if (imxdi->ioaddr == NULL) + return -ENOMEM; + ++ spin_lock_init(&imxdi->irq_lock); ++ + imxdi->irq = platform_get_irq(pdev, 0); + if (imxdi->irq < 0) + return imxdi->irq; +diff --git a/drivers/staging/android/binder.c b/drivers/staging/android/binder.c +index 574e992..467d493 100644 +--- a/drivers/staging/android/binder.c ++++ b/drivers/staging/android/binder.c +@@ -655,7 +655,7 @@ static int binder_update_page_range(struct binder_proc *proc, int allocate, + page = &proc->pages[(page_addr - proc->buffer) / PAGE_SIZE]; + + BUG_ON(*page); +- *page = alloc_page(GFP_KERNEL | __GFP_ZERO); ++ *page = alloc_page(GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO); + if (*page == NULL) { + pr_err("binder: %d: binder_alloc_buf failed " + "for page at %p\n", proc->pid, page_addr); +@@ -2507,14 +2507,38 @@ static void binder_release_work(struct list_head *list) + struct binder_transaction *t; + + t = container_of(w, struct binder_transaction, work); +- if (t->buffer->target_node && !(t->flags & TF_ONE_WAY)) ++ if (t->buffer->target_node && ++ !(t->flags & TF_ONE_WAY)) { + binder_send_failed_reply(t, BR_DEAD_REPLY); ++ } else { ++ binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, ++ "binder: undelivered transaction %d\n", ++ t->debug_id); ++ t->buffer->transaction = NULL; ++ kfree(t); ++ binder_stats_deleted(BINDER_STAT_TRANSACTION); ++ } + } break; + case BINDER_WORK_TRANSACTION_COMPLETE: { ++ binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, ++ "binder: undelivered TRANSACTION_COMPLETE\n"); + kfree(w); + binder_stats_deleted(BINDER_STAT_TRANSACTION_COMPLETE); + } break; ++ case BINDER_WORK_DEAD_BINDER_AND_CLEAR: ++ case BINDER_WORK_CLEAR_DEATH_NOTIFICATION: { ++ struct binder_ref_death *death; ++ ++ death = container_of(w, struct binder_ref_death, work); ++ binder_debug(BINDER_DEBUG_DEAD_TRANSACTION, ++ "binder: undelivered death notification, %p\n", ++ death->cookie); ++ kfree(death); ++ binder_stats_deleted(BINDER_STAT_DEATH); ++ } break; + default: ++ pr_err("binder: unexpected work type, %d, not freed\n", ++ w->type); + break; + } + } +@@ -2984,6 +3008,7 @@ static void binder_deferred_release(struct binder_proc *proc) + nodes++; + rb_erase(&node->rb_node, &proc->nodes); + list_del_init(&node->work.entry); ++ binder_release_work(&node->async_todo); + if (hlist_empty(&node->refs)) { + kfree(node); + binder_stats_deleted(BINDER_STAT_NODE); +@@ -3022,6 +3047,7 @@ static void binder_deferred_release(struct binder_proc *proc) + binder_delete_ref(ref); + } + binder_release_work(&proc->todo); ++ binder_release_work(&proc->delivered_death); + buffers = 0; + + while ((n = rb_first(&proc->allocated_buffers))) { +diff --git a/drivers/staging/comedi/drivers/amplc_dio200.c b/drivers/staging/comedi/drivers/amplc_dio200.c +index cc8931f..aee22fd 100644 +--- a/drivers/staging/comedi/drivers/amplc_dio200.c ++++ b/drivers/staging/comedi/drivers/amplc_dio200.c +@@ -1429,6 +1429,8 @@ static void dio200_detach(struct comedi_device *dev) + const struct dio200_layout_struct *layout; + unsigned n; + ++ if (!thisboard) ++ return; + if (dev->irq) + free_irq(dev->irq, dev); + if (dev->subdevices) { +diff --git a/drivers/staging/comedi/drivers/amplc_pc236.c b/drivers/staging/comedi/drivers/amplc_pc236.c +index f502879..b46e663 100644 +--- a/drivers/staging/comedi/drivers/amplc_pc236.c ++++ b/drivers/staging/comedi/drivers/amplc_pc236.c +@@ -577,10 +577,12 @@ static int __devinit pc236_attach_pci(struct comedi_device *dev, + + static void pc236_detach(struct comedi_device *dev) + { +- struct pc236_private *devpriv = dev->private; ++ const struct pc236_board *thisboard = comedi_board(dev); + struct pci_dev *pcidev = comedi_to_pci_dev(dev); + +- if (devpriv) ++ if (!thisboard) ++ return; ++ if (dev->iobase) + pc236_intr_disable(dev); + if (dev->irq) + free_irq(dev->irq, dev); +diff --git a/drivers/staging/comedi/drivers/amplc_pc263.c b/drivers/staging/comedi/drivers/amplc_pc263.c +index 8191c4e..8c0fbd1 100644 +--- a/drivers/staging/comedi/drivers/amplc_pc263.c ++++ b/drivers/staging/comedi/drivers/amplc_pc263.c +@@ -310,8 +310,11 @@ static int __devinit pc263_attach_pci(struct comedi_device *dev, + + static void pc263_detach(struct comedi_device *dev) + { ++ const struct pc263_board *thisboard = comedi_board(dev); + struct pci_dev *pcidev = comedi_to_pci_dev(dev); + ++ if (!thisboard) ++ return; + if (pcidev) { + if (dev->iobase) + comedi_pci_disable(pcidev); +diff --git a/drivers/staging/comedi/drivers/das08.c b/drivers/staging/comedi/drivers/das08.c +index 67a914a..d893e3b 100644 +--- a/drivers/staging/comedi/drivers/das08.c ++++ b/drivers/staging/comedi/drivers/das08.c +@@ -1028,6 +1028,8 @@ static void __maybe_unused das08_detach(struct comedi_device *dev) + const struct das08_board_struct *thisboard = comedi_board(dev); + struct das08_private_struct *devpriv = dev->private; + ++ if (!thisboard) ++ return; + das08_common_detach(dev); + if (IS_ENABLED(CONFIG_COMEDI_DAS08_ISA) && + (thisboard->bustype == isa || thisboard->bustype == pc104)) { +diff --git a/drivers/staging/comedi/drivers/ni_daq_700.c b/drivers/staging/comedi/drivers/ni_daq_700.c +index 83016b4..bcf6a65 100644 +--- a/drivers/staging/comedi/drivers/ni_daq_700.c ++++ b/drivers/staging/comedi/drivers/ni_daq_700.c +@@ -71,7 +71,7 @@ static int subdev_700_insn(struct comedi_device *dev, + } + + data[1] = s->state & 0xff; +- data[1] |= inb(dev->iobase + DIO_R); ++ data[1] |= inb(dev->iobase + DIO_R) << 8; + + return insn->n; + } +diff --git a/drivers/staging/comedi/drivers/ni_labpc.c b/drivers/staging/comedi/drivers/ni_labpc.c +index ab8b787..d3a1d65 100644 +--- a/drivers/staging/comedi/drivers/ni_labpc.c ++++ b/drivers/staging/comedi/drivers/ni_labpc.c +@@ -809,6 +809,8 @@ static int labpc_find_device(struct comedi_device *dev, int bus, int slot) + + void labpc_common_detach(struct comedi_device *dev) + { ++ if (!thisboard) ++ return; + if (dev->subdevices) + subdev_8255_cleanup(dev, dev->subdevices + 2); + #ifdef CONFIG_ISA_DMA_API +diff --git a/drivers/staging/zram/zram_drv.c b/drivers/staging/zram/zram_drv.c +index 653b074..6edefde 100644 +--- a/drivers/staging/zram/zram_drv.c ++++ b/drivers/staging/zram/zram_drv.c +@@ -223,8 +223,13 @@ static int zram_bvec_read(struct zram *zram, struct bio_vec *bvec, + cmem = zs_map_object(zram->mem_pool, zram->table[index].handle, + ZS_MM_RO); + +- ret = lzo1x_decompress_safe(cmem, zram->table[index].size, ++ if (zram->table[index].size == PAGE_SIZE) { ++ memcpy(uncmem, cmem, PAGE_SIZE); ++ ret = LZO_E_OK; ++ } else { ++ ret = lzo1x_decompress_safe(cmem, zram->table[index].size, + uncmem, &clen); ++ } + + if (is_partial_io(bvec)) { + memcpy(user_mem + bvec->bv_offset, uncmem + offset, +@@ -342,8 +347,11 @@ static int zram_bvec_write(struct zram *zram, struct bio_vec *bvec, u32 index, + goto out; + } + +- if (unlikely(clen > max_zpage_size)) ++ if (unlikely(clen > max_zpage_size)) { + zram_stat_inc(&zram->stats.bad_compress); ++ src = uncmem; ++ clen = PAGE_SIZE; ++ } + + handle = zs_malloc(zram->mem_pool, clen); + if (!handle) { +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index bbff143..fe7faf0 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -730,13 +730,16 @@ static void hub_tt_work(struct work_struct *work) + int limit = 100; + + spin_lock_irqsave (&hub->tt.lock, flags); +- while (--limit && !list_empty (&hub->tt.clear_list)) { ++ while (!list_empty(&hub->tt.clear_list)) { + struct list_head *next; + struct usb_tt_clear *clear; + struct usb_device *hdev = hub->hdev; + const struct hc_driver *drv; + int status; + ++ if (!hub->quiescing && --limit < 0) ++ break; ++ + next = hub->tt.clear_list.next; + clear = list_entry (next, struct usb_tt_clear, clear_list); + list_del (&clear->clear_list); +@@ -1201,7 +1204,7 @@ static void hub_quiesce(struct usb_hub *hub, enum hub_quiescing_type type) + if (hub->has_indicators) + cancel_delayed_work_sync(&hub->leds); + if (hub->tt.hub) +- cancel_work_sync(&hub->tt.clear_work); ++ flush_work_sync(&hub->tt.clear_work); + } + + /* caller has locked the hub device */ +diff --git a/drivers/usb/host/pci-quirks.c b/drivers/usb/host/pci-quirks.c +index 966d148..39f9e4a 100644 +--- a/drivers/usb/host/pci-quirks.c ++++ b/drivers/usb/host/pci-quirks.c +@@ -545,7 +545,14 @@ static const struct dmi_system_id __devinitconst ehci_dmi_nohandoff_table[] = { + /* Pegatron Lucid (Ordissimo AIRIS) */ + .matches = { + DMI_MATCH(DMI_BOARD_NAME, "M11JB"), +- DMI_MATCH(DMI_BIOS_VERSION, "Lucid-GE-133"), ++ DMI_MATCH(DMI_BIOS_VERSION, "Lucid-"), ++ }, ++ }, ++ { ++ /* Pegatron Lucid (Ordissimo) */ ++ .matches = { ++ DMI_MATCH(DMI_BOARD_NAME, "Ordissimo"), ++ DMI_MATCH(DMI_BIOS_VERSION, "Lucid-"), + }, + }, + { } +diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c +index a6e18b9..4f1e265 100644 +--- a/drivers/usb/host/xhci-ring.c ++++ b/drivers/usb/host/xhci-ring.c +@@ -1228,6 +1228,17 @@ static void xhci_cmd_to_noop(struct xhci_hcd *xhci, struct xhci_cd *cur_cd) + cur_seg = find_trb_seg(xhci->cmd_ring->first_seg, + xhci->cmd_ring->dequeue, &cycle_state); + ++ if (!cur_seg) { ++ xhci_warn(xhci, "Command ring mismatch, dequeue = %p %llx (dma)\n", ++ xhci->cmd_ring->dequeue, ++ (unsigned long long) ++ xhci_trb_virt_to_dma(xhci->cmd_ring->deq_seg, ++ xhci->cmd_ring->dequeue)); ++ xhci_debug_ring(xhci, xhci->cmd_ring); ++ xhci_dbg_ring_ptrs(xhci, xhci->cmd_ring); ++ return; ++ } ++ + /* find the command trb matched by cd from command ring */ + for (cmd_trb = xhci->cmd_ring->dequeue; + cmd_trb != xhci->cmd_ring->enqueue; +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 0644f65..a6e910b 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -4020,7 +4020,7 @@ int xhci_update_device(struct usb_hcd *hcd, struct usb_device *udev) + static unsigned long long xhci_service_interval_to_ns( + struct usb_endpoint_descriptor *desc) + { +- return (1 << (desc->bInterval - 1)) * 125 * 1000; ++ return (1ULL << (desc->bInterval - 1)) * 125 * 1000; + } + + static u16 xhci_get_timeout_no_hub_lpm(struct usb_device *udev, +@@ -4141,7 +4141,7 @@ static u16 xhci_calculate_intel_u2_timeout(struct usb_device *udev, + (xhci_service_interval_to_ns(desc) > timeout_ns)) + timeout_ns = xhci_service_interval_to_ns(desc); + +- u2_del_ns = udev->bos->ss_cap->bU2DevExitLat * 1000; ++ u2_del_ns = le16_to_cpu(udev->bos->ss_cap->bU2DevExitLat) * 1000ULL; + if (u2_del_ns > timeout_ns) + timeout_ns = u2_del_ns; + +diff --git a/drivers/usb/serial/ch341.c b/drivers/usb/serial/ch341.c +index cabd1b1..8391d30 100644 +--- a/drivers/usb/serial/ch341.c ++++ b/drivers/usb/serial/ch341.c +@@ -241,13 +241,11 @@ out: kfree(buffer); + return r; + } + +-/* allocate private data */ +-static int ch341_attach(struct usb_serial *serial) ++static int ch341_port_probe(struct usb_serial_port *port) + { + struct ch341_private *priv; + int r; + +- /* private data */ + priv = kzalloc(sizeof(struct ch341_private), GFP_KERNEL); + if (!priv) + return -ENOMEM; +@@ -257,17 +255,27 @@ static int ch341_attach(struct usb_serial *serial) + priv->baud_rate = DEFAULT_BAUD_RATE; + priv->line_control = CH341_BIT_RTS | CH341_BIT_DTR; + +- r = ch341_configure(serial->dev, priv); ++ r = ch341_configure(port->serial->dev, priv); + if (r < 0) + goto error; + +- usb_set_serial_port_data(serial->port[0], priv); ++ usb_set_serial_port_data(port, priv); + return 0; + + error: kfree(priv); + return r; + } + ++static int ch341_port_remove(struct usb_serial_port *port) ++{ ++ struct ch341_private *priv; ++ ++ priv = usb_get_serial_port_data(port); ++ kfree(priv); ++ ++ return 0; ++} ++ + static int ch341_carrier_raised(struct usb_serial_port *port) + { + struct ch341_private *priv = usb_get_serial_port_data(port); +@@ -303,7 +311,7 @@ static void ch341_close(struct usb_serial_port *port) + static int ch341_open(struct tty_struct *tty, struct usb_serial_port *port) + { + struct usb_serial *serial = port->serial; +- struct ch341_private *priv = usb_get_serial_port_data(serial->port[0]); ++ struct ch341_private *priv = usb_get_serial_port_data(port); + int r; + + priv->baud_rate = DEFAULT_BAUD_RATE; +@@ -606,7 +614,8 @@ static struct usb_serial_driver ch341_device = { + .tiocmget = ch341_tiocmget, + .tiocmset = ch341_tiocmset, + .read_int_callback = ch341_read_int_callback, +- .attach = ch341_attach, ++ .port_probe = ch341_port_probe, ++ .port_remove = ch341_port_remove, + .reset_resume = ch341_reset_resume, + }; + +diff --git a/drivers/usb/serial/digi_acceleport.c b/drivers/usb/serial/digi_acceleport.c +index b5cd838..06e8bf4 100644 +--- a/drivers/usb/serial/digi_acceleport.c ++++ b/drivers/usb/serial/digi_acceleport.c +@@ -244,6 +244,8 @@ static int digi_startup_device(struct usb_serial *serial); + static int digi_startup(struct usb_serial *serial); + static void digi_disconnect(struct usb_serial *serial); + static void digi_release(struct usb_serial *serial); ++static int digi_port_probe(struct usb_serial_port *port); ++static int digi_port_remove(struct usb_serial_port *port); + static void digi_read_bulk_callback(struct urb *urb); + static int digi_read_inb_callback(struct urb *urb); + static int digi_read_oob_callback(struct urb *urb); +@@ -298,6 +300,8 @@ static struct usb_serial_driver digi_acceleport_2_device = { + .attach = digi_startup, + .disconnect = digi_disconnect, + .release = digi_release, ++ .port_probe = digi_port_probe, ++ .port_remove = digi_port_remove, + }; + + static struct usb_serial_driver digi_acceleport_4_device = { +@@ -324,6 +328,8 @@ static struct usb_serial_driver digi_acceleport_4_device = { + .attach = digi_startup, + .disconnect = digi_disconnect, + .release = digi_release, ++ .port_probe = digi_port_probe, ++ .port_remove = digi_port_remove, + }; + + static struct usb_serial_driver * const serial_drivers[] = { +@@ -1237,59 +1243,50 @@ static int digi_startup_device(struct usb_serial *serial) + return ret; + } + +- +-static int digi_startup(struct usb_serial *serial) ++static int digi_port_init(struct usb_serial_port *port, unsigned port_num) + { +- +- int i; + struct digi_port *priv; +- struct digi_serial *serial_priv; + +- /* allocate the private data structures for all ports */ +- /* number of regular ports + 1 for the out-of-band port */ +- for (i = 0; i < serial->type->num_ports + 1; i++) { +- /* allocate port private structure */ +- priv = kmalloc(sizeof(struct digi_port), GFP_KERNEL); +- if (priv == NULL) { +- while (--i >= 0) +- kfree(usb_get_serial_port_data(serial->port[i])); +- return 1; /* error */ +- } ++ priv = kzalloc(sizeof(*priv), GFP_KERNEL); ++ if (!priv) ++ return -ENOMEM; + +- /* initialize port private structure */ +- spin_lock_init(&priv->dp_port_lock); +- priv->dp_port_num = i; +- priv->dp_out_buf_len = 0; +- priv->dp_write_urb_in_use = 0; +- priv->dp_modem_signals = 0; +- init_waitqueue_head(&priv->dp_modem_change_wait); +- priv->dp_transmit_idle = 0; +- init_waitqueue_head(&priv->dp_transmit_idle_wait); +- priv->dp_throttled = 0; +- priv->dp_throttle_restart = 0; +- init_waitqueue_head(&priv->dp_flush_wait); +- init_waitqueue_head(&priv->dp_close_wait); +- INIT_WORK(&priv->dp_wakeup_work, digi_wakeup_write_lock); +- priv->dp_port = serial->port[i]; +- /* initialize write wait queue for this port */ +- init_waitqueue_head(&serial->port[i]->write_wait); +- +- usb_set_serial_port_data(serial->port[i], priv); +- } ++ spin_lock_init(&priv->dp_port_lock); ++ priv->dp_port_num = port_num; ++ init_waitqueue_head(&priv->dp_modem_change_wait); ++ init_waitqueue_head(&priv->dp_transmit_idle_wait); ++ init_waitqueue_head(&priv->dp_flush_wait); ++ init_waitqueue_head(&priv->dp_close_wait); ++ INIT_WORK(&priv->dp_wakeup_work, digi_wakeup_write_lock); ++ priv->dp_port = port; + +- /* allocate serial private structure */ +- serial_priv = kmalloc(sizeof(struct digi_serial), GFP_KERNEL); +- if (serial_priv == NULL) { +- for (i = 0; i < serial->type->num_ports + 1; i++) +- kfree(usb_get_serial_port_data(serial->port[i])); +- return 1; /* error */ +- } ++ init_waitqueue_head(&port->write_wait); ++ ++ usb_set_serial_port_data(port, priv); ++ ++ return 0; ++} ++ ++static int digi_startup(struct usb_serial *serial) ++{ ++ struct digi_serial *serial_priv; ++ int ret; ++ ++ serial_priv = kzalloc(sizeof(*serial_priv), GFP_KERNEL); ++ if (!serial_priv) ++ return -ENOMEM; + +- /* initialize serial private structure */ + spin_lock_init(&serial_priv->ds_serial_lock); + serial_priv->ds_oob_port_num = serial->type->num_ports; + serial_priv->ds_oob_port = serial->port[serial_priv->ds_oob_port_num]; +- serial_priv->ds_device_started = 0; ++ ++ ret = digi_port_init(serial_priv->ds_oob_port, ++ serial_priv->ds_oob_port_num); ++ if (ret) { ++ kfree(serial_priv); ++ return ret; ++ } ++ + usb_set_serial_data(serial, serial_priv); + + return 0; +@@ -1310,15 +1307,35 @@ static void digi_disconnect(struct usb_serial *serial) + + static void digi_release(struct usb_serial *serial) + { +- int i; ++ struct digi_serial *serial_priv; ++ struct digi_port *priv; ++ ++ serial_priv = usb_get_serial_data(serial); ++ ++ priv = usb_get_serial_port_data(serial_priv->ds_oob_port); ++ kfree(priv); + +- /* free the private data structures for all ports */ +- /* number of regular ports + 1 for the out-of-band port */ +- for (i = 0; i < serial->type->num_ports + 1; i++) +- kfree(usb_get_serial_port_data(serial->port[i])); +- kfree(usb_get_serial_data(serial)); ++ kfree(serial_priv); + } + ++static int digi_port_probe(struct usb_serial_port *port) ++{ ++ unsigned port_num; ++ ++ port_num = port->number - port->serial->minor; ++ ++ return digi_port_init(port, port_num); ++} ++ ++static int digi_port_remove(struct usb_serial_port *port) ++{ ++ struct digi_port *priv; ++ ++ priv = usb_get_serial_port_data(port); ++ kfree(priv); ++ ++ return 0; ++} + + static void digi_read_bulk_callback(struct urb *urb) + { +diff --git a/drivers/usb/serial/ipw.c b/drivers/usb/serial/ipw.c +index 2cb30c5..8df011f 100644 +--- a/drivers/usb/serial/ipw.c ++++ b/drivers/usb/serial/ipw.c +@@ -209,8 +209,7 @@ static int ipw_open(struct tty_struct *tty, struct usb_serial_port *port) + return 0; + } + +-/* fake probe - only to allocate data structures */ +-static int ipw_probe(struct usb_serial *serial, const struct usb_device_id *id) ++static int ipw_attach(struct usb_serial *serial) + { + struct usb_wwan_intf_private *data; + +@@ -310,9 +309,9 @@ static struct usb_serial_driver ipw_device = { + .num_ports = 1, + .open = ipw_open, + .close = ipw_close, +- .probe = ipw_probe, +- .attach = usb_wwan_startup, ++ .attach = ipw_attach, + .release = ipw_release, ++ .port_probe = usb_wwan_port_probe, + .port_remove = usb_wwan_port_remove, + .dtr_rts = ipw_dtr_rts, + .write = usb_wwan_write, +diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c +index af0b70e..f6788d7 100644 +--- a/drivers/usb/serial/keyspan.c ++++ b/drivers/usb/serial/keyspan.c +@@ -1392,13 +1392,9 @@ static struct callbacks { + data in device_details */ + static void keyspan_setup_urbs(struct usb_serial *serial) + { +- int i, j; + struct keyspan_serial_private *s_priv; + const struct keyspan_device_details *d_details; +- struct usb_serial_port *port; +- struct keyspan_port_private *p_priv; + struct callbacks *cback; +- int endp; + + s_priv = usb_get_serial_data(serial); + d_details = s_priv->device_details; +@@ -1422,45 +1418,6 @@ static void keyspan_setup_urbs(struct usb_serial *serial) + (serial, d_details->glocont_endpoint, USB_DIR_OUT, + serial, s_priv->glocont_buf, GLOCONT_BUFLEN, + cback->glocont_callback); +- +- /* Setup endpoints for each port specific thing */ +- for (i = 0; i < d_details->num_ports; i++) { +- port = serial->port[i]; +- p_priv = usb_get_serial_port_data(port); +- +- /* Do indat endpoints first, once for each flip */ +- endp = d_details->indat_endpoints[i]; +- for (j = 0; j <= d_details->indat_endp_flip; ++j, ++endp) { +- p_priv->in_urbs[j] = keyspan_setup_urb +- (serial, endp, USB_DIR_IN, port, +- p_priv->in_buffer[j], 64, +- cback->indat_callback); +- } +- for (; j < 2; ++j) +- p_priv->in_urbs[j] = NULL; +- +- /* outdat endpoints also have flip */ +- endp = d_details->outdat_endpoints[i]; +- for (j = 0; j <= d_details->outdat_endp_flip; ++j, ++endp) { +- p_priv->out_urbs[j] = keyspan_setup_urb +- (serial, endp, USB_DIR_OUT, port, +- p_priv->out_buffer[j], 64, +- cback->outdat_callback); +- } +- for (; j < 2; ++j) +- p_priv->out_urbs[j] = NULL; +- +- /* inack endpoint */ +- p_priv->inack_urb = keyspan_setup_urb +- (serial, d_details->inack_endpoints[i], USB_DIR_IN, +- port, p_priv->inack_buffer, 1, cback->inack_callback); +- +- /* outcont endpoint */ +- p_priv->outcont_urb = keyspan_setup_urb +- (serial, d_details->outcont_endpoints[i], USB_DIR_OUT, +- port, p_priv->outcont_buffer, 64, +- cback->outcont_callback); +- } + } + + /* usa19 function doesn't require prescaler */ +@@ -2422,9 +2379,7 @@ static void keyspan_send_setup(struct usb_serial_port *port, int reset_port) + static int keyspan_startup(struct usb_serial *serial) + { + int i, err; +- struct usb_serial_port *port; + struct keyspan_serial_private *s_priv; +- struct keyspan_port_private *p_priv; + const struct keyspan_device_details *d_details; + + for (i = 0; (d_details = keyspan_devices[i]) != NULL; ++i) +@@ -2448,19 +2403,6 @@ static int keyspan_startup(struct usb_serial *serial) + s_priv->device_details = d_details; + usb_set_serial_data(serial, s_priv); + +- /* Now setup per port private data */ +- for (i = 0; i < serial->num_ports; i++) { +- port = serial->port[i]; +- p_priv = kzalloc(sizeof(struct keyspan_port_private), +- GFP_KERNEL); +- if (!p_priv) { +- dbg("%s - kmalloc for keyspan_port_private (%d) failed!.", __func__, i); +- return 1; +- } +- p_priv->device_details = d_details; +- usb_set_serial_port_data(port, p_priv); +- } +- + keyspan_setup_urbs(serial); + + if (s_priv->instat_urb != NULL) { +@@ -2481,61 +2423,112 @@ static int keyspan_startup(struct usb_serial *serial) + + static void keyspan_disconnect(struct usb_serial *serial) + { +- int i, j; +- struct usb_serial_port *port; +- struct keyspan_serial_private *s_priv; +- struct keyspan_port_private *p_priv; ++ struct keyspan_serial_private *s_priv; + + s_priv = usb_get_serial_data(serial); + +- /* Stop reading/writing urbs */ + stop_urb(s_priv->instat_urb); + stop_urb(s_priv->glocont_urb); + stop_urb(s_priv->indat_urb); +- for (i = 0; i < serial->num_ports; ++i) { +- port = serial->port[i]; +- p_priv = usb_get_serial_port_data(port); +- stop_urb(p_priv->inack_urb); +- stop_urb(p_priv->outcont_urb); +- for (j = 0; j < 2; j++) { +- stop_urb(p_priv->in_urbs[j]); +- stop_urb(p_priv->out_urbs[j]); +- } +- } ++} ++ ++static void keyspan_release(struct usb_serial *serial) ++{ ++ struct keyspan_serial_private *s_priv; ++ ++ s_priv = usb_get_serial_data(serial); + +- /* Now free them */ + usb_free_urb(s_priv->instat_urb); + usb_free_urb(s_priv->indat_urb); + usb_free_urb(s_priv->glocont_urb); +- for (i = 0; i < serial->num_ports; ++i) { +- port = serial->port[i]; +- p_priv = usb_get_serial_port_data(port); +- usb_free_urb(p_priv->inack_urb); +- usb_free_urb(p_priv->outcont_urb); +- for (j = 0; j < 2; j++) { +- usb_free_urb(p_priv->in_urbs[j]); +- usb_free_urb(p_priv->out_urbs[j]); +- } +- } ++ ++ kfree(s_priv); + } + +-static void keyspan_release(struct usb_serial *serial) ++static int keyspan_port_probe(struct usb_serial_port *port) + { +- int i; +- struct usb_serial_port *port; +- struct keyspan_serial_private *s_priv; ++ struct usb_serial *serial = port->serial; ++ struct keyspan_port_private *s_priv; ++ struct keyspan_port_private *p_priv; ++ const struct keyspan_device_details *d_details; ++ struct callbacks *cback; ++ int endp; ++ int port_num; ++ int i; + + s_priv = usb_get_serial_data(serial); ++ d_details = s_priv->device_details; + +- /* dbg("Freeing serial->private."); */ +- kfree(s_priv); ++ p_priv = kzalloc(sizeof(*p_priv), GFP_KERNEL); ++ if (!p_priv) ++ return -ENOMEM; + +- /* dbg("Freeing port->private."); */ +- /* Now free per port private data */ +- for (i = 0; i < serial->num_ports; i++) { +- port = serial->port[i]; +- kfree(usb_get_serial_port_data(port)); ++ s_priv = usb_get_serial_data(port->serial); ++ p_priv->device_details = d_details; ++ ++ /* Setup values for the various callback routines */ ++ cback = &keyspan_callbacks[d_details->msg_format]; ++ ++ port_num = port->number - port->serial->minor; ++ ++ /* Do indat endpoints first, once for each flip */ ++ endp = d_details->indat_endpoints[port_num]; ++ for (i = 0; i <= d_details->indat_endp_flip; ++i, ++endp) { ++ p_priv->in_urbs[i] = keyspan_setup_urb(serial, endp, ++ USB_DIR_IN, port, ++ p_priv->in_buffer[i], 64, ++ cback->indat_callback); ++ } ++ /* outdat endpoints also have flip */ ++ endp = d_details->outdat_endpoints[port_num]; ++ for (i = 0; i <= d_details->outdat_endp_flip; ++i, ++endp) { ++ p_priv->out_urbs[i] = keyspan_setup_urb(serial, endp, ++ USB_DIR_OUT, port, ++ p_priv->out_buffer[i], 64, ++ cback->outdat_callback); ++ } ++ /* inack endpoint */ ++ p_priv->inack_urb = keyspan_setup_urb(serial, ++ d_details->inack_endpoints[port_num], ++ USB_DIR_IN, port, ++ p_priv->inack_buffer, 1, ++ cback->inack_callback); ++ /* outcont endpoint */ ++ p_priv->outcont_urb = keyspan_setup_urb(serial, ++ d_details->outcont_endpoints[port_num], ++ USB_DIR_OUT, port, ++ p_priv->outcont_buffer, 64, ++ cback->outcont_callback); ++ ++ usb_set_serial_port_data(port, p_priv); ++ ++ return 0; ++} ++ ++static int keyspan_port_remove(struct usb_serial_port *port) ++{ ++ struct keyspan_port_private *p_priv; ++ int i; ++ ++ p_priv = usb_get_serial_port_data(port); ++ ++ stop_urb(p_priv->inack_urb); ++ stop_urb(p_priv->outcont_urb); ++ for (i = 0; i < 2; i++) { ++ stop_urb(p_priv->in_urbs[i]); ++ stop_urb(p_priv->out_urbs[i]); ++ } ++ ++ usb_free_urb(p_priv->inack_urb); ++ usb_free_urb(p_priv->outcont_urb); ++ for (i = 0; i < 2; i++) { ++ usb_free_urb(p_priv->in_urbs[i]); ++ usb_free_urb(p_priv->out_urbs[i]); + } ++ ++ kfree(p_priv); ++ ++ return 0; + } + + MODULE_AUTHOR(DRIVER_AUTHOR); +diff --git a/drivers/usb/serial/keyspan.h b/drivers/usb/serial/keyspan.h +index fe1c5d9..90a7b36 100644 +--- a/drivers/usb/serial/keyspan.h ++++ b/drivers/usb/serial/keyspan.h +@@ -42,6 +42,8 @@ static void keyspan_dtr_rts (struct usb_serial_port *port, int on); + static int keyspan_startup (struct usb_serial *serial); + static void keyspan_disconnect (struct usb_serial *serial); + static void keyspan_release (struct usb_serial *serial); ++static int keyspan_port_probe(struct usb_serial_port *port); ++static int keyspan_port_remove(struct usb_serial_port *port); + static int keyspan_write_room (struct tty_struct *tty); + + static int keyspan_write (struct tty_struct *tty, +@@ -562,6 +564,8 @@ static struct usb_serial_driver keyspan_1port_device = { + .attach = keyspan_startup, + .disconnect = keyspan_disconnect, + .release = keyspan_release, ++ .port_probe = keyspan_port_probe, ++ .port_remove = keyspan_port_remove, + }; + + static struct usb_serial_driver keyspan_2port_device = { +@@ -584,6 +588,8 @@ static struct usb_serial_driver keyspan_2port_device = { + .attach = keyspan_startup, + .disconnect = keyspan_disconnect, + .release = keyspan_release, ++ .port_probe = keyspan_port_probe, ++ .port_remove = keyspan_port_remove, + }; + + static struct usb_serial_driver keyspan_4port_device = { +@@ -606,6 +612,8 @@ static struct usb_serial_driver keyspan_4port_device = { + .attach = keyspan_startup, + .disconnect = keyspan_disconnect, + .release = keyspan_release, ++ .port_probe = keyspan_port_probe, ++ .port_remove = keyspan_port_remove, + }; + + static struct usb_serial_driver * const serial_drivers[] = { +diff --git a/drivers/usb/serial/mct_u232.c b/drivers/usb/serial/mct_u232.c +index a71fa0a..c088250 100644 +--- a/drivers/usb/serial/mct_u232.c ++++ b/drivers/usb/serial/mct_u232.c +@@ -51,7 +51,8 @@ static bool debug; + * Function prototypes + */ + static int mct_u232_startup(struct usb_serial *serial); +-static void mct_u232_release(struct usb_serial *serial); ++static int mct_u232_port_probe(struct usb_serial_port *port); ++static int mct_u232_port_remove(struct usb_serial_port *remove); + static int mct_u232_open(struct tty_struct *tty, struct usb_serial_port *port); + static void mct_u232_close(struct usb_serial_port *port); + static void mct_u232_dtr_rts(struct usb_serial_port *port, int on); +@@ -101,7 +102,8 @@ static struct usb_serial_driver mct_u232_device = { + .tiocmget = mct_u232_tiocmget, + .tiocmset = mct_u232_tiocmset, + .attach = mct_u232_startup, +- .release = mct_u232_release, ++ .port_probe = mct_u232_port_probe, ++ .port_remove = mct_u232_port_remove, + .ioctl = mct_u232_ioctl, + .get_icount = mct_u232_get_icount, + }; +@@ -392,18 +394,8 @@ static void mct_u232_msr_to_state(unsigned int *control_state, + + static int mct_u232_startup(struct usb_serial *serial) + { +- struct mct_u232_private *priv; + struct usb_serial_port *port, *rport; + +- priv = kzalloc(sizeof(struct mct_u232_private), GFP_KERNEL); +- if (!priv) +- return -ENOMEM; +- spin_lock_init(&priv->lock); +- init_waitqueue_head(&priv->msr_wait); +- usb_set_serial_port_data(serial->port[0], priv); +- +- init_waitqueue_head(&serial->port[0]->write_wait); +- + /* Puh, that's dirty */ + port = serial->port[0]; + rport = serial->port[1]; +@@ -416,18 +408,31 @@ static int mct_u232_startup(struct usb_serial *serial) + return 0; + } /* mct_u232_startup */ + ++static int mct_u232_port_probe(struct usb_serial_port *port) ++{ ++ struct mct_u232_private *priv; ++ ++ priv = kzalloc(sizeof(*priv), GFP_KERNEL); ++ if (!priv) ++ return -ENOMEM; ++ ++ spin_lock_init(&priv->lock); ++ init_waitqueue_head(&priv->msr_wait); ++ ++ usb_set_serial_port_data(port, priv); + +-static void mct_u232_release(struct usb_serial *serial) ++ return 0; ++} ++ ++static int mct_u232_port_remove(struct usb_serial_port *port) + { + struct mct_u232_private *priv; +- int i; + +- for (i = 0; i < serial->num_ports; ++i) { +- /* My special items, the standard routines free my urbs */ +- priv = usb_get_serial_port_data(serial->port[i]); +- kfree(priv); +- } +-} /* mct_u232_release */ ++ priv = usb_get_serial_port_data(port); ++ kfree(priv); ++ ++ return 0; ++} + + static int mct_u232_open(struct tty_struct *tty, struct usb_serial_port *port) + { +@@ -519,12 +524,14 @@ static void mct_u232_dtr_rts(struct usb_serial_port *port, int on) + + static void mct_u232_close(struct usb_serial_port *port) + { +- if (port->serial->dev) { +- /* shutdown our urbs */ +- usb_kill_urb(port->write_urb); +- usb_kill_urb(port->read_urb); +- usb_kill_urb(port->interrupt_in_urb); +- } ++ /* ++ * Must kill the read urb as it is actually an interrupt urb, which ++ * generic close thus fails to kill. ++ */ ++ usb_kill_urb(port->read_urb); ++ usb_kill_urb(port->interrupt_in_urb); ++ ++ usb_serial_generic_close(port); + } /* mct_u232_close */ + + +diff --git a/drivers/usb/serial/metro-usb.c b/drivers/usb/serial/metro-usb.c +index d47eb06..d284fb8 100644 +--- a/drivers/usb/serial/metro-usb.c ++++ b/drivers/usb/serial/metro-usb.c +@@ -188,16 +188,13 @@ static void metrousb_cleanup(struct usb_serial_port *port) + { + dev_dbg(&port->dev, "%s\n", __func__); + +- if (port->serial->dev) { +- /* Shutdown any interrupt in urbs. */ +- if (port->interrupt_in_urb) { +- usb_unlink_urb(port->interrupt_in_urb); +- usb_kill_urb(port->interrupt_in_urb); +- } +- +- /* Send deactivate cmd to device */ ++ usb_unlink_urb(port->interrupt_in_urb); ++ usb_kill_urb(port->interrupt_in_urb); ++ ++ mutex_lock(&port->serial->disc_mutex); ++ if (!port->serial->disconnected) + metrousb_send_unidirectional_cmd(UNI_CMD_CLOSE, port); +- } ++ mutex_unlock(&port->serial->disc_mutex); + } + + static int metrousb_open(struct tty_struct *tty, struct usb_serial_port *port) +@@ -280,51 +277,27 @@ static int metrousb_set_modem_ctrl(struct usb_serial *serial, unsigned int contr + return retval; + } + +-static void metrousb_shutdown(struct usb_serial *serial) ++static int metrousb_port_probe(struct usb_serial_port *port) + { +- int i = 0; ++ struct metrousb_private *metro_priv; + +- dev_dbg(&serial->dev->dev, "%s\n", __func__); ++ metro_priv = kzalloc(sizeof(*metro_priv), GFP_KERNEL); ++ if (!metro_priv) ++ return -ENOMEM; + +- /* Stop reading and writing on all ports. */ +- for (i = 0; i < serial->num_ports; ++i) { +- /* Close any open urbs. */ +- metrousb_cleanup(serial->port[i]); ++ spin_lock_init(&metro_priv->lock); + +- /* Free memory. */ +- kfree(usb_get_serial_port_data(serial->port[i])); +- usb_set_serial_port_data(serial->port[i], NULL); ++ usb_set_serial_port_data(port, metro_priv); + +- dev_dbg(&serial->dev->dev, "%s - freed port number=%d\n", +- __func__, serial->port[i]->number); +- } ++ return 0; + } + +-static int metrousb_startup(struct usb_serial *serial) ++static int metrousb_port_remove(struct usb_serial_port *port) + { + struct metrousb_private *metro_priv; +- struct usb_serial_port *port; +- int i = 0; + +- dev_dbg(&serial->dev->dev, "%s\n", __func__); +- +- /* Loop through the serial ports setting up the private structures. +- * Currently we only use one port. */ +- for (i = 0; i < serial->num_ports; ++i) { +- port = serial->port[i]; +- +- /* Declare memory. */ +- metro_priv = kzalloc(sizeof(struct metrousb_private), GFP_KERNEL); +- if (!metro_priv) +- return -ENOMEM; +- +- /* Initialize memory. */ +- spin_lock_init(&metro_priv->lock); +- usb_set_serial_port_data(port, metro_priv); +- +- dev_dbg(&serial->dev->dev, "%s - port number=%d\n ", +- __func__, port->number); +- } ++ metro_priv = usb_get_serial_port_data(port); ++ kfree(metro_priv); + + return 0; + } +@@ -423,8 +396,8 @@ static struct usb_serial_driver metrousb_device = { + .close = metrousb_cleanup, + .read_int_callback = metrousb_read_int_callback, + .write_int_callback = metrousb_write_int_callback, +- .attach = metrousb_startup, +- .release = metrousb_shutdown, ++ .port_probe = metrousb_port_probe, ++ .port_remove = metrousb_port_remove, + .throttle = metrousb_throttle, + .unthrottle = metrousb_unthrottle, + .tiocmget = metrousb_tiocmget, +diff --git a/drivers/usb/serial/mos7720.c b/drivers/usb/serial/mos7720.c +index a07dd3c..eb84767 100644 +--- a/drivers/usb/serial/mos7720.c ++++ b/drivers/usb/serial/mos7720.c +@@ -2023,9 +2023,7 @@ static int mos7720_ioctl(struct tty_struct *tty, + + static int mos7720_startup(struct usb_serial *serial) + { +- struct moschip_port *mos7720_port; + struct usb_device *dev; +- int i; + char data; + u16 product; + int ret_val; +@@ -2063,29 +2061,6 @@ static int mos7720_startup(struct usb_serial *serial) + serial->port[1]->interrupt_in_buffer = NULL; + } + +- +- /* set up serial port private structures */ +- for (i = 0; i < serial->num_ports; ++i) { +- mos7720_port = kzalloc(sizeof(struct moschip_port), GFP_KERNEL); +- if (mos7720_port == NULL) { +- dev_err(&dev->dev, "%s - Out of memory\n", __func__); +- return -ENOMEM; +- } +- +- /* Initialize all port interrupt end point to port 0 int +- * endpoint. Our device has only one interrupt endpoint +- * common to all ports */ +- serial->port[i]->interrupt_in_endpointAddress = +- serial->port[0]->interrupt_in_endpointAddress; +- +- mos7720_port->port = serial->port[i]; +- usb_set_serial_port_data(serial->port[i], mos7720_port); +- +- dbg("port number is %d", serial->port[i]->number); +- dbg("serial number is %d", serial->minor); +- } +- +- + /* setting configuration feature to one */ + usb_control_msg(serial->dev, usb_sndctrlpipe(serial->dev, 0), + (__u8)0x03, 0x00, 0x01, 0x00, NULL, 0x00, 5*HZ); +@@ -2113,8 +2088,6 @@ static int mos7720_startup(struct usb_serial *serial) + + static void mos7720_release(struct usb_serial *serial) + { +- int i; +- + #ifdef CONFIG_USB_SERIAL_MOS7715_PARPORT + /* close the parallel port */ + +@@ -2153,9 +2126,36 @@ static void mos7720_release(struct usb_serial *serial) + kref_put(&mos_parport->ref_count, destroy_mos_parport); + } + #endif +- /* free private structure allocated for serial port */ +- for (i = 0; i < serial->num_ports; ++i) +- kfree(usb_get_serial_port_data(serial->port[i])); ++} ++ ++static int mos7720_port_probe(struct usb_serial_port *port) ++{ ++ struct moschip_port *mos7720_port; ++ ++ mos7720_port = kzalloc(sizeof(*mos7720_port), GFP_KERNEL); ++ if (!mos7720_port) ++ return -ENOMEM; ++ ++ /* Initialize all port interrupt end point to port 0 int endpoint. ++ * Our device has only one interrupt endpoint common to all ports. ++ */ ++ port->interrupt_in_endpointAddress = ++ port->serial->port[0]->interrupt_in_endpointAddress; ++ mos7720_port->port = port; ++ ++ usb_set_serial_port_data(port, mos7720_port); ++ ++ return 0; ++} ++ ++static int mos7720_port_remove(struct usb_serial_port *port) ++{ ++ struct moschip_port *mos7720_port; ++ ++ mos7720_port = usb_get_serial_port_data(port); ++ kfree(mos7720_port); ++ ++ return 0; + } + + static struct usb_serial_driver moschip7720_2port_driver = { +@@ -2173,6 +2173,8 @@ static struct usb_serial_driver moschip7720_2port_driver = { + .probe = mos77xx_probe, + .attach = mos7720_startup, + .release = mos7720_release, ++ .port_probe = mos7720_port_probe, ++ .port_remove = mos7720_port_remove, + .ioctl = mos7720_ioctl, + .tiocmget = mos7720_tiocmget, + .tiocmset = mos7720_tiocmset, +diff --git a/drivers/usb/serial/mos7840.c b/drivers/usb/serial/mos7840.c +index 2f6da1e..52e5ca7 100644 +--- a/drivers/usb/serial/mos7840.c ++++ b/drivers/usb/serial/mos7840.c +@@ -218,12 +218,10 @@ struct moschip_port { + int port_num; /*Actual port number in the device(1,2,etc) */ + struct urb *write_urb; /* write URB for this port */ + struct urb *read_urb; /* read URB for this port */ +- struct urb *int_urb; + __u8 shadowLCR; /* last LCR value received */ + __u8 shadowMCR; /* last MCR value received */ + char open; + char open_ports; +- char zombie; + wait_queue_head_t wait_chase; /* for handling sleeping while waiting for chase to finish */ + wait_queue_head_t delta_msr_wait; /* for handling sleeping while waiting for msr change to happen */ + int delta_msr_cond; +@@ -493,7 +491,6 @@ static void mos7840_control_callback(struct urb *urb) + unsigned char *data; + struct moschip_port *mos7840_port; + __u8 regval = 0x0; +- int result = 0; + int status = urb->status; + + mos7840_port = urb->context; +@@ -512,7 +509,7 @@ static void mos7840_control_callback(struct urb *urb) + default: + dbg("%s - nonzero urb status received: %d", __func__, + status); +- goto exit; ++ return; + } + + dbg("%s urb buffer size is %d", __func__, urb->actual_length); +@@ -525,17 +522,6 @@ static void mos7840_control_callback(struct urb *urb) + mos7840_handle_new_msr(mos7840_port, regval); + else if (mos7840_port->MsrLsr == 1) + mos7840_handle_new_lsr(mos7840_port, regval); +- +-exit: +- spin_lock(&mos7840_port->pool_lock); +- if (!mos7840_port->zombie) +- result = usb_submit_urb(mos7840_port->int_urb, GFP_ATOMIC); +- spin_unlock(&mos7840_port->pool_lock); +- if (result) { +- dev_err(&urb->dev->dev, +- "%s - Error %d submitting interrupt urb\n", +- __func__, result); +- } + } + + static int mos7840_get_reg(struct moschip_port *mcs, __u16 Wval, __u16 reg, +@@ -704,14 +690,7 @@ static void mos7840_interrupt_callback(struct urb *urb) + wreg = MODEM_STATUS_REGISTER; + break; + } +- spin_lock(&mos7840_port->pool_lock); +- if (!mos7840_port->zombie) { +- rv = mos7840_get_reg(mos7840_port, wval, wreg, &Data); +- } else { +- spin_unlock(&mos7840_port->pool_lock); +- return; +- } +- spin_unlock(&mos7840_port->pool_lock); ++ rv = mos7840_get_reg(mos7840_port, wval, wreg, &Data); + } + } + } +@@ -2684,7 +2663,6 @@ error: + kfree(mos7840_port->ctrl_buf); + usb_free_urb(mos7840_port->control_urb); + kfree(mos7840_port); +- serial->port[i] = NULL; + } + return status; + } +@@ -2714,9 +2692,6 @@ static void mos7840_disconnect(struct usb_serial *serial) + mos7840_port = mos7840_get_port_private(serial->port[i]); + dbg ("mos7840_port %d = %p", i, mos7840_port); + if (mos7840_port) { +- spin_lock_irqsave(&mos7840_port->pool_lock, flags); +- mos7840_port->zombie = 1; +- spin_unlock_irqrestore(&mos7840_port->pool_lock, flags); + usb_kill_urb(mos7840_port->control_urb); + } + } +@@ -2754,6 +2729,7 @@ static void mos7840_release(struct usb_serial *serial) + del_timer_sync(&mos7840_port->led_timer1); + del_timer_sync(&mos7840_port->led_timer2); + } ++ usb_free_urb(mos7840_port->control_urb); + kfree(mos7840_port->ctrl_buf); + kfree(mos7840_port->dr); + kfree(mos7840_port); +diff --git a/drivers/usb/serial/omninet.c b/drivers/usb/serial/omninet.c +index 6f3d705..27c9d06 100644 +--- a/drivers/usb/serial/omninet.c ++++ b/drivers/usb/serial/omninet.c +@@ -46,8 +46,8 @@ static int omninet_write(struct tty_struct *tty, struct usb_serial_port *port, + const unsigned char *buf, int count); + static int omninet_write_room(struct tty_struct *tty); + static void omninet_disconnect(struct usb_serial *serial); +-static void omninet_release(struct usb_serial *serial); +-static int omninet_attach(struct usb_serial *serial); ++static int omninet_port_probe(struct usb_serial_port *port); ++static int omninet_port_remove(struct usb_serial_port *port); + + static const struct usb_device_id id_table[] = { + { USB_DEVICE(ZYXEL_VENDOR_ID, ZYXEL_OMNINET_ID) }, +@@ -64,7 +64,8 @@ static struct usb_serial_driver zyxel_omninet_device = { + .description = "ZyXEL - omni.net lcd plus usb", + .id_table = id_table, + .num_ports = 1, +- .attach = omninet_attach, ++ .port_probe = omninet_port_probe, ++ .port_remove = omninet_port_remove, + .open = omninet_open, + .close = omninet_close, + .write = omninet_write, +@@ -72,7 +73,6 @@ static struct usb_serial_driver zyxel_omninet_device = { + .read_bulk_callback = omninet_read_bulk_callback, + .write_bulk_callback = omninet_write_bulk_callback, + .disconnect = omninet_disconnect, +- .release = omninet_release, + }; + + static struct usb_serial_driver * const serial_drivers[] = { +@@ -114,18 +114,26 @@ struct omninet_data { + __u8 od_outseq; /* Sequence number for bulk_out URBs */ + }; + +-static int omninet_attach(struct usb_serial *serial) ++static int omninet_port_probe(struct usb_serial_port *port) + { + struct omninet_data *od; +- struct usb_serial_port *port = serial->port[0]; + + od = kmalloc(sizeof(struct omninet_data), GFP_KERNEL); +- if (!od) { +- dev_err(&port->dev, "%s- kmalloc(%Zd) failed.\n", +- __func__, sizeof(struct omninet_data)); ++ if (!od) + return -ENOMEM; +- } ++ + usb_set_serial_port_data(port, od); ++ ++ return 0; ++} ++ ++static int omninet_port_remove(struct usb_serial_port *port) ++{ ++ struct omninet_data *od; ++ ++ od = usb_get_serial_port_data(port); ++ kfree(od); ++ + return 0; + } + +@@ -291,14 +299,6 @@ static void omninet_disconnect(struct usb_serial *serial) + usb_kill_urb(wport->write_urb); + } + +- +-static void omninet_release(struct usb_serial *serial) +-{ +- struct usb_serial_port *port = serial->port[0]; +- +- kfree(usb_get_serial_port_data(port)); +-} +- + module_usb_serial_driver(serial_drivers, id_table); + + MODULE_AUTHOR(DRIVER_AUTHOR); +diff --git a/drivers/usb/serial/opticon.c b/drivers/usb/serial/opticon.c +index 02cb1b7..623358a 100644 +--- a/drivers/usb/serial/opticon.c ++++ b/drivers/usb/serial/opticon.c +@@ -158,7 +158,11 @@ static int send_control_msg(struct usb_serial_port *port, u8 requesttype, + { + struct usb_serial *serial = port->serial; + int retval; +- u8 buffer[2]; ++ u8 *buffer; ++ ++ buffer = kzalloc(1, GFP_KERNEL); ++ if (!buffer) ++ return -ENOMEM; + + buffer[0] = val; + /* Send the message to the vendor control endpoint +@@ -167,6 +171,7 @@ static int send_control_msg(struct usb_serial_port *port, u8 requesttype, + requesttype, + USB_DIR_OUT|USB_TYPE_VENDOR|USB_RECIP_INTERFACE, + 0, 0, buffer, 1, 0); ++ kfree(buffer); + + return retval; + } +@@ -284,7 +289,7 @@ static int opticon_write(struct tty_struct *tty, struct usb_serial_port *port, + if (!dr) { + dev_err(&port->dev, "out of memory\n"); + count = -ENOMEM; +- goto error; ++ goto error_no_dr; + } + + dr->bRequestType = USB_TYPE_VENDOR | USB_RECIP_INTERFACE | USB_DIR_OUT; +@@ -314,6 +319,8 @@ static int opticon_write(struct tty_struct *tty, struct usb_serial_port *port, + + return count; + error: ++ kfree(dr); ++error_no_dr: + usb_free_urb(urb); + error_no_urb: + kfree(buffer); +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index a0542ca..76a48e4 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -47,6 +47,7 @@ + /* Function prototypes */ + static int option_probe(struct usb_serial *serial, + const struct usb_device_id *id); ++static int option_attach(struct usb_serial *serial); + static void option_release(struct usb_serial *serial); + static int option_send_setup(struct usb_serial_port *port); + static void option_instat_callback(struct urb *urb); +@@ -1288,8 +1289,9 @@ static struct usb_serial_driver option_1port_device = { + .tiocmget = usb_wwan_tiocmget, + .tiocmset = usb_wwan_tiocmset, + .ioctl = usb_wwan_ioctl, +- .attach = usb_wwan_startup, ++ .attach = option_attach, + .release = option_release, ++ .port_probe = usb_wwan_port_probe, + .port_remove = usb_wwan_port_remove, + .read_int_callback = option_instat_callback, + #ifdef CONFIG_PM +@@ -1337,8 +1339,6 @@ static bool is_blacklisted(const u8 ifnum, enum option_blacklist_reason reason, + static int option_probe(struct usb_serial *serial, + const struct usb_device_id *id) + { +- struct usb_wwan_intf_private *data; +- struct option_private *priv; + struct usb_interface_descriptor *iface_desc = + &serial->interface->cur_altsetting->desc; + struct usb_device_descriptor *dev_desc = &serial->dev->descriptor; +@@ -1376,6 +1376,19 @@ static int option_probe(struct usb_serial *serial, + iface_desc->bInterfaceClass != USB_CLASS_CDC_DATA) + return -ENODEV; + ++ /* Store device id so we can use it during attach. */ ++ usb_set_serial_data(serial, (void *)id); ++ ++ return 0; ++} ++ ++static int option_attach(struct usb_serial *serial) ++{ ++ struct usb_interface_descriptor *iface_desc; ++ const struct usb_device_id *id; ++ struct usb_wwan_intf_private *data; ++ struct option_private *priv; ++ + data = kzalloc(sizeof(struct usb_wwan_intf_private), GFP_KERNEL); + if (!data) + return -ENOMEM; +@@ -1386,6 +1399,10 @@ static int option_probe(struct usb_serial *serial, + return -ENOMEM; + } + ++ /* Retrieve device id stored at probe. */ ++ id = usb_get_serial_data(serial); ++ iface_desc = &serial->interface->cur_altsetting->desc; ++ + priv->bInterfaceNumber = iface_desc->bInterfaceNumber; + data->private = priv; + +diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c +index bfd5077..93232ca 100644 +--- a/drivers/usb/serial/qcserial.c ++++ b/drivers/usb/serial/qcserial.c +@@ -140,7 +140,6 @@ MODULE_DEVICE_TABLE(usb, id_table); + + static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id) + { +- struct usb_wwan_intf_private *data; + struct usb_host_interface *intf = serial->interface->cur_altsetting; + struct device *dev = &serial->dev->dev; + int retval = -ENODEV; +@@ -156,13 +155,6 @@ static int qcprobe(struct usb_serial *serial, const struct usb_device_id *id) + ifnum = intf->desc.bInterfaceNumber; + dev_dbg(dev, "This Interface = %d\n", ifnum); + +- data = kzalloc(sizeof(struct usb_wwan_intf_private), +- GFP_KERNEL); +- if (!data) +- return -ENOMEM; +- +- spin_lock_init(&data->susp_lock); +- + if (nintf == 1) { + /* QDL mode */ + /* Gobi 2000 has a single altsetting, older ones have two */ +@@ -255,20 +247,28 @@ done: + } + } + +- /* Set serial->private if not returning error */ +- if (retval == 0) +- usb_set_serial_data(serial, data); +- else +- kfree(data); +- + return retval; + } + ++static int qc_attach(struct usb_serial *serial) ++{ ++ struct usb_wwan_intf_private *data; ++ ++ data = kzalloc(sizeof(*data), GFP_KERNEL); ++ if (!data) ++ return -ENOMEM; ++ ++ spin_lock_init(&data->susp_lock); ++ ++ usb_set_serial_data(serial, data); ++ ++ return 0; ++} ++ + static void qc_release(struct usb_serial *serial) + { + struct usb_wwan_intf_private *priv = usb_get_serial_data(serial); + +- /* Free the private data allocated in qcprobe */ + usb_set_serial_data(serial, NULL); + kfree(priv); + } +@@ -287,8 +287,9 @@ static struct usb_serial_driver qcdevice = { + .write = usb_wwan_write, + .write_room = usb_wwan_write_room, + .chars_in_buffer = usb_wwan_chars_in_buffer, +- .attach = usb_wwan_startup, ++ .attach = qc_attach, + .release = qc_release, ++ .port_probe = usb_wwan_port_probe, + .port_remove = usb_wwan_port_remove, + #ifdef CONFIG_PM + .suspend = usb_wwan_suspend, +diff --git a/drivers/usb/serial/quatech2.c b/drivers/usb/serial/quatech2.c +index 151670b..ea69301 100644 +--- a/drivers/usb/serial/quatech2.c ++++ b/drivers/usb/serial/quatech2.c +@@ -145,12 +145,12 @@ static void qt2_read_bulk_callback(struct urb *urb); + + static void qt2_release(struct usb_serial *serial) + { +- int i; ++ struct qt2_serial_private *serial_priv; + +- kfree(usb_get_serial_data(serial)); ++ serial_priv = usb_get_serial_data(serial); + +- for (i = 0; i < serial->num_ports; i++) +- kfree(usb_get_serial_port_data(serial->port[i])); ++ usb_free_urb(serial_priv->read_urb); ++ kfree(serial_priv); + } + + static inline int calc_baud_divisor(int baudrate) +@@ -425,11 +425,16 @@ static void qt2_close(struct usb_serial_port *port) + port_priv->is_open = false; + + spin_lock_irqsave(&port_priv->urb_lock, flags); +- if (port_priv->write_urb->status == -EINPROGRESS) +- usb_kill_urb(port_priv->write_urb); ++ usb_kill_urb(port_priv->write_urb); + port_priv->urb_in_use = false; + spin_unlock_irqrestore(&port_priv->urb_lock, flags); + ++ mutex_lock(&port->serial->disc_mutex); ++ if (port->serial->disconnected) { ++ mutex_unlock(&port->serial->disc_mutex); ++ return; ++ } ++ + /* flush the port transmit buffer */ + i = usb_control_msg(serial->dev, + usb_rcvctrlpipe(serial->dev, 0), +@@ -461,26 +466,14 @@ static void qt2_close(struct usb_serial_port *port) + dev_err(&port->dev, "%s - close port failed %i\n", + __func__, i); + ++ mutex_unlock(&port->serial->disc_mutex); + } + + static void qt2_disconnect(struct usb_serial *serial) + { + struct qt2_serial_private *serial_priv = usb_get_serial_data(serial); +- struct qt2_port_private *port_priv; +- int i; +- +- if (serial_priv->read_urb->status == -EINPROGRESS) +- usb_kill_urb(serial_priv->read_urb); +- +- usb_free_urb(serial_priv->read_urb); + +- for (i = 0; i < serial->num_ports; i++) { +- port_priv = usb_get_serial_port_data(serial->port[i]); +- +- if (port_priv->write_urb->status == -EINPROGRESS) +- usb_kill_urb(port_priv->write_urb); +- usb_free_urb(port_priv->write_urb); +- } ++ usb_kill_urb(serial_priv->read_urb); + } + + static int get_serial_info(struct usb_serial_port *port, +@@ -775,11 +768,9 @@ static void qt2_read_bulk_callback(struct urb *urb) + + static int qt2_setup_urbs(struct usb_serial *serial) + { +- struct usb_serial_port *port; + struct usb_serial_port *port0; + struct qt2_serial_private *serial_priv; +- struct qt2_port_private *port_priv; +- int pcount, status; ++ int status; + + port0 = serial->port[0]; + +@@ -797,46 +788,21 @@ static int qt2_setup_urbs(struct usb_serial *serial) + sizeof(serial_priv->read_buffer), + qt2_read_bulk_callback, serial); + +- /* setup write_urb for each port */ +- for (pcount = 0; pcount < serial->num_ports; pcount++) { +- +- port = serial->port[pcount]; +- port_priv = usb_get_serial_port_data(port); +- +- port_priv->write_urb = usb_alloc_urb(0, GFP_KERNEL); +- if (!port_priv->write_urb) { +- dev_err(&serial->dev->dev, +- "failed to alloc write_urb for port %i\n", +- pcount); +- return -ENOMEM; +- } +- +- usb_fill_bulk_urb(port_priv->write_urb, +- serial->dev, +- usb_sndbulkpipe(serial->dev, +- port0-> +- bulk_out_endpointAddress), +- port_priv->write_buffer, +- sizeof(port_priv->write_buffer), +- qt2_write_bulk_callback, port); +- } +- + status = usb_submit_urb(serial_priv->read_urb, GFP_KERNEL); + if (status != 0) { + dev_err(&serial->dev->dev, + "%s - submit read urb failed %i\n", __func__, status); ++ usb_free_urb(serial_priv->read_urb); + return status; + } + + return 0; +- + } + + static int qt2_attach(struct usb_serial *serial) + { + struct qt2_serial_private *serial_priv; +- struct qt2_port_private *port_priv; +- int status, pcount; ++ int status; + + /* power on unit */ + status = usb_control_msg(serial->dev, usb_rcvctrlpipe(serial->dev, 0), +@@ -856,26 +822,6 @@ static int qt2_attach(struct usb_serial *serial) + + usb_set_serial_data(serial, serial_priv); + +- for (pcount = 0; pcount < serial->num_ports; pcount++) { +- port_priv = kzalloc(sizeof(*port_priv), GFP_KERNEL); +- if (!port_priv) { +- dev_err(&serial->dev->dev, +- "%s- kmalloc(%Zd) failed.\n", __func__, +- sizeof(*port_priv)); +- pcount--; +- status = -ENOMEM; +- goto attach_failed; +- } +- +- spin_lock_init(&port_priv->lock); +- spin_lock_init(&port_priv->urb_lock); +- init_waitqueue_head(&port_priv->delta_msr_wait); +- +- port_priv->port = serial->port[pcount]; +- +- usb_set_serial_port_data(serial->port[pcount], port_priv); +- } +- + status = qt2_setup_urbs(serial); + if (status != 0) + goto attach_failed; +@@ -883,14 +829,53 @@ static int qt2_attach(struct usb_serial *serial) + return 0; + + attach_failed: +- for (/* empty */; pcount >= 0; pcount--) { +- port_priv = usb_get_serial_port_data(serial->port[pcount]); +- kfree(port_priv); +- } + kfree(serial_priv); + return status; + } + ++static int qt2_port_probe(struct usb_serial_port *port) ++{ ++ struct usb_serial *serial = port->serial; ++ struct qt2_port_private *port_priv; ++ u8 bEndpointAddress; ++ ++ port_priv = kzalloc(sizeof(*port_priv), GFP_KERNEL); ++ if (!port_priv) ++ return -ENOMEM; ++ ++ spin_lock_init(&port_priv->lock); ++ spin_lock_init(&port_priv->urb_lock); ++ init_waitqueue_head(&port_priv->delta_msr_wait); ++ port_priv->port = port; ++ ++ port_priv->write_urb = usb_alloc_urb(0, GFP_KERNEL); ++ if (!port_priv->write_urb) { ++ kfree(port_priv); ++ return -ENOMEM; ++ } ++ bEndpointAddress = serial->port[0]->bulk_out_endpointAddress; ++ usb_fill_bulk_urb(port_priv->write_urb, serial->dev, ++ usb_sndbulkpipe(serial->dev, bEndpointAddress), ++ port_priv->write_buffer, ++ sizeof(port_priv->write_buffer), ++ qt2_write_bulk_callback, port); ++ ++ usb_set_serial_port_data(port, port_priv); ++ ++ return 0; ++} ++ ++static int qt2_port_remove(struct usb_serial_port *port) ++{ ++ struct qt2_port_private *port_priv; ++ ++ port_priv = usb_get_serial_port_data(port); ++ usb_free_urb(port_priv->write_urb); ++ kfree(port_priv); ++ ++ return 0; ++} ++ + static int qt2_tiocmget(struct tty_struct *tty) + { + struct usb_serial_port *port = tty->driver_data; +@@ -1129,6 +1114,8 @@ static struct usb_serial_driver qt2_device = { + .attach = qt2_attach, + .release = qt2_release, + .disconnect = qt2_disconnect, ++ .port_probe = qt2_port_probe, ++ .port_remove = qt2_port_remove, + .dtr_rts = qt2_dtr_rts, + .break_ctl = qt2_break_ctl, + .tiocmget = qt2_tiocmget, +diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c +index 0274710..cf6d149 100644 +--- a/drivers/usb/serial/sierra.c ++++ b/drivers/usb/serial/sierra.c +@@ -162,7 +162,6 @@ static int sierra_probe(struct usb_serial *serial, + { + int result = 0; + struct usb_device *udev; +- struct sierra_intf_private *data; + u8 ifnum; + + udev = serial->dev; +@@ -189,11 +188,6 @@ static int sierra_probe(struct usb_serial *serial, + return -ENODEV; + } + +- data = serial->private = kzalloc(sizeof(struct sierra_intf_private), GFP_KERNEL); +- if (!data) +- return -ENOMEM; +- spin_lock_init(&data->susp_lock); +- + return result; + } + +@@ -886,11 +880,15 @@ static void sierra_dtr_rts(struct usb_serial_port *port, int on) + + static int sierra_startup(struct usb_serial *serial) + { +- struct usb_serial_port *port; +- struct sierra_port_private *portdata; +- struct sierra_iface_info *himemoryp = NULL; +- int i; +- u8 ifnum; ++ struct sierra_intf_private *intfdata; ++ ++ intfdata = kzalloc(sizeof(*intfdata), GFP_KERNEL); ++ if (!intfdata) ++ return -ENOMEM; ++ ++ spin_lock_init(&intfdata->susp_lock); ++ ++ usb_set_serial_data(serial, intfdata); + + /* Set Device mode to D0 */ + sierra_set_power_state(serial->dev, 0x0000); +@@ -899,68 +897,71 @@ static int sierra_startup(struct usb_serial *serial) + if (nmea) + sierra_vsc_set_nmea(serial->dev, 1); + +- /* Now setup per port private data */ +- for (i = 0; i < serial->num_ports; i++) { +- port = serial->port[i]; +- portdata = kzalloc(sizeof(*portdata), GFP_KERNEL); +- if (!portdata) { +- dev_dbg(&port->dev, "%s: kmalloc for " +- "sierra_port_private (%d) failed!\n", +- __func__, i); +- return -ENOMEM; +- } +- spin_lock_init(&portdata->lock); +- init_usb_anchor(&portdata->active); +- init_usb_anchor(&portdata->delayed); +- ifnum = i; +- /* Assume low memory requirements */ +- portdata->num_out_urbs = N_OUT_URB; +- portdata->num_in_urbs = N_IN_URB; +- +- /* Determine actual memory requirements */ +- if (serial->num_ports == 1) { +- /* Get interface number for composite device */ +- ifnum = sierra_calc_interface(serial); +- himemoryp = +- (struct sierra_iface_info *)&typeB_interface_list; +- if (is_himemory(ifnum, himemoryp)) { +- portdata->num_out_urbs = N_OUT_URB_HM; +- portdata->num_in_urbs = N_IN_URB_HM; +- } +- } +- else { +- himemoryp = +- (struct sierra_iface_info *)&typeA_interface_list; +- if (is_himemory(i, himemoryp)) { +- portdata->num_out_urbs = N_OUT_URB_HM; +- portdata->num_in_urbs = N_IN_URB_HM; +- } +- } +- dev_dbg(&serial->dev->dev, +- "Memory usage (urbs) interface #%d, in=%d, out=%d\n", +- ifnum,portdata->num_in_urbs, portdata->num_out_urbs ); +- /* Set the port private data pointer */ +- usb_set_serial_port_data(port, portdata); +- } +- + return 0; + } + + static void sierra_release(struct usb_serial *serial) + { +- int i; +- struct usb_serial_port *port; ++ struct sierra_intf_private *intfdata; ++ ++ intfdata = usb_get_serial_data(serial); ++ kfree(intfdata); ++} ++ ++static int sierra_port_probe(struct usb_serial_port *port) ++{ ++ struct usb_serial *serial = port->serial; + struct sierra_port_private *portdata; ++ const struct sierra_iface_info *himemoryp; ++ u8 ifnum; + +- for (i = 0; i < serial->num_ports; ++i) { +- port = serial->port[i]; +- if (!port) +- continue; +- portdata = usb_get_serial_port_data(port); +- if (!portdata) +- continue; +- kfree(portdata); ++ portdata = kzalloc(sizeof(*portdata), GFP_KERNEL); ++ if (!portdata) ++ return -ENOMEM; ++ ++ spin_lock_init(&portdata->lock); ++ init_usb_anchor(&portdata->active); ++ init_usb_anchor(&portdata->delayed); ++ ++ /* Assume low memory requirements */ ++ portdata->num_out_urbs = N_OUT_URB; ++ portdata->num_in_urbs = N_IN_URB; ++ ++ /* Determine actual memory requirements */ ++ if (serial->num_ports == 1) { ++ /* Get interface number for composite device */ ++ ifnum = sierra_calc_interface(serial); ++ himemoryp = &typeB_interface_list; ++ } else { ++ /* This is really the usb-serial port number of the interface ++ * rather than the interface number. ++ */ ++ ifnum = port->number - serial->minor; ++ himemoryp = &typeA_interface_list; + } ++ ++ if (is_himemory(ifnum, himemoryp)) { ++ portdata->num_out_urbs = N_OUT_URB_HM; ++ portdata->num_in_urbs = N_IN_URB_HM; ++ } ++ ++ dev_dbg(&port->dev, ++ "Memory usage (urbs) interface #%d, in=%d, out=%d\n", ++ ifnum, portdata->num_in_urbs, portdata->num_out_urbs); ++ ++ usb_set_serial_port_data(port, portdata); ++ ++ return 0; ++} ++ ++static int sierra_port_remove(struct usb_serial_port *port) ++{ ++ struct sierra_port_private *portdata; ++ ++ portdata = usb_get_serial_port_data(port); ++ kfree(portdata); ++ ++ return 0; + } + + #ifdef CONFIG_PM +@@ -1064,6 +1065,8 @@ static struct usb_serial_driver sierra_device = { + .tiocmset = sierra_tiocmset, + .attach = sierra_startup, + .release = sierra_release, ++ .port_probe = sierra_port_probe, ++ .port_remove = sierra_port_remove, + .suspend = sierra_suspend, + .resume = sierra_resume, + .read_int_callback = sierra_instat_callback, +diff --git a/drivers/usb/serial/usb-wwan.h b/drivers/usb/serial/usb-wwan.h +index 1f034d2..684739b 100644 +--- a/drivers/usb/serial/usb-wwan.h ++++ b/drivers/usb/serial/usb-wwan.h +@@ -8,7 +8,7 @@ + extern void usb_wwan_dtr_rts(struct usb_serial_port *port, int on); + extern int usb_wwan_open(struct tty_struct *tty, struct usb_serial_port *port); + extern void usb_wwan_close(struct usb_serial_port *port); +-extern int usb_wwan_startup(struct usb_serial *serial); ++extern int usb_wwan_port_probe(struct usb_serial_port *port); + extern int usb_wwan_port_remove(struct usb_serial_port *port); + extern int usb_wwan_write_room(struct tty_struct *tty); + extern void usb_wwan_set_termios(struct tty_struct *tty, +diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c +index 6855d5e..2f2d074 100644 +--- a/drivers/usb/serial/usb_wwan.c ++++ b/drivers/usb/serial/usb_wwan.c +@@ -447,10 +447,12 @@ void usb_wwan_close(struct usb_serial_port *port) + EXPORT_SYMBOL(usb_wwan_close); + + /* Helper functions used by usb_wwan_setup_urbs */ +-static struct urb *usb_wwan_setup_urb(struct usb_serial *serial, int endpoint, ++static struct urb *usb_wwan_setup_urb(struct usb_serial_port *port, ++ int endpoint, + int dir, void *ctx, char *buf, int len, + void (*callback) (struct urb *)) + { ++ struct usb_serial *serial = port->serial; + struct urb *urb; + + if (endpoint == -1) +@@ -470,100 +472,74 @@ static struct urb *usb_wwan_setup_urb(struct usb_serial *serial, int endpoint, + return urb; + } + +-/* Setup urbs */ +-static void usb_wwan_setup_urbs(struct usb_serial *serial) ++int usb_wwan_port_probe(struct usb_serial_port *port) + { +- int i, j; +- struct usb_serial_port *port; + struct usb_wwan_port_private *portdata; ++ struct urb *urb; ++ u8 *buffer; ++ int err; ++ int i; + +- for (i = 0; i < serial->num_ports; i++) { +- port = serial->port[i]; +- portdata = usb_get_serial_port_data(port); +- +- /* Do indat endpoints first */ +- for (j = 0; j < N_IN_URB; ++j) { +- portdata->in_urbs[j] = usb_wwan_setup_urb(serial, +- port-> +- bulk_in_endpointAddress, +- USB_DIR_IN, +- port, +- portdata-> +- in_buffer[j], +- IN_BUFLEN, +- usb_wwan_indat_callback); +- } +- +- /* outdat endpoints */ +- for (j = 0; j < N_OUT_URB; ++j) { +- portdata->out_urbs[j] = usb_wwan_setup_urb(serial, +- port-> +- bulk_out_endpointAddress, +- USB_DIR_OUT, +- port, +- portdata-> +- out_buffer +- [j], +- OUT_BUFLEN, +- usb_wwan_outdat_callback); +- } +- } +-} ++ portdata = kzalloc(sizeof(*portdata), GFP_KERNEL); ++ if (!portdata) ++ return -ENOMEM; + +-int usb_wwan_startup(struct usb_serial *serial) +-{ +- int i, j, err; +- struct usb_serial_port *port; +- struct usb_wwan_port_private *portdata; +- u8 *buffer; ++ init_usb_anchor(&portdata->delayed); + +- /* Now setup per port private data */ +- for (i = 0; i < serial->num_ports; i++) { +- port = serial->port[i]; +- portdata = kzalloc(sizeof(*portdata), GFP_KERNEL); +- if (!portdata) { +- dbg("%s: kmalloc for usb_wwan_port_private (%d) failed!.", +- __func__, i); +- return 1; +- } +- init_usb_anchor(&portdata->delayed); ++ for (i = 0; i < N_IN_URB; i++) { ++ buffer = (u8 *)__get_free_page(GFP_KERNEL); ++ if (!buffer) ++ goto bail_out_error; ++ portdata->in_buffer[i] = buffer; ++ ++ urb = usb_wwan_setup_urb(port, port->bulk_in_endpointAddress, ++ USB_DIR_IN, port, ++ buffer, IN_BUFLEN, ++ usb_wwan_indat_callback); ++ portdata->in_urbs[i] = urb; ++ } ++ for (i = 0; i < N_OUT_URB; i++) { ++ if (port->bulk_out_endpointAddress == -1) ++ continue; + +- for (j = 0; j < N_IN_URB; j++) { +- buffer = (u8 *) __get_free_page(GFP_KERNEL); +- if (!buffer) +- goto bail_out_error; +- portdata->in_buffer[j] = buffer; +- } ++ buffer = kmalloc(OUT_BUFLEN, GFP_KERNEL); ++ if (!buffer) ++ goto bail_out_error2; ++ portdata->out_buffer[i] = buffer; + +- for (j = 0; j < N_OUT_URB; j++) { +- buffer = kmalloc(OUT_BUFLEN, GFP_KERNEL); +- if (!buffer) +- goto bail_out_error2; +- portdata->out_buffer[j] = buffer; +- } ++ urb = usb_wwan_setup_urb(port, port->bulk_out_endpointAddress, ++ USB_DIR_OUT, port, ++ buffer, OUT_BUFLEN, ++ usb_wwan_outdat_callback); ++ portdata->out_urbs[i] = urb; ++ } + +- usb_set_serial_port_data(port, portdata); ++ usb_set_serial_port_data(port, portdata); + +- if (!port->interrupt_in_urb) +- continue; ++ if (port->interrupt_in_urb) { + err = usb_submit_urb(port->interrupt_in_urb, GFP_KERNEL); + if (err) +- dbg("%s: submit irq_in urb failed %d", __func__, err); ++ dev_dbg(&port->dev, "%s: submit irq_in urb failed %d\n", ++ __func__, err); + } +- usb_wwan_setup_urbs(serial); ++ + return 0; + + bail_out_error2: +- for (j = 0; j < N_OUT_URB; j++) +- kfree(portdata->out_buffer[j]); ++ for (i = 0; i < N_OUT_URB; i++) { ++ usb_free_urb(portdata->out_urbs[i]); ++ kfree(portdata->out_buffer[i]); ++ } + bail_out_error: +- for (j = 0; j < N_IN_URB; j++) +- if (portdata->in_buffer[j]) +- free_page((unsigned long)portdata->in_buffer[j]); ++ for (i = 0; i < N_IN_URB; i++) { ++ usb_free_urb(portdata->in_urbs[i]); ++ free_page((unsigned long)portdata->in_buffer[i]); ++ } + kfree(portdata); +- return 1; ++ ++ return -ENOMEM; + } +-EXPORT_SYMBOL(usb_wwan_startup); ++EXPORT_SYMBOL_GPL(usb_wwan_port_probe); + + int usb_wwan_port_remove(struct usb_serial_port *port) + { +diff --git a/drivers/usb/serial/whiteheat.c b/drivers/usb/serial/whiteheat.c +index 473635e..bd36321 100644 +--- a/drivers/usb/serial/whiteheat.c ++++ b/drivers/usb/serial/whiteheat.c +@@ -86,6 +86,8 @@ static int whiteheat_firmware_attach(struct usb_serial *serial); + /* function prototypes for the Connect Tech WhiteHEAT serial converter */ + static int whiteheat_attach(struct usb_serial *serial); + static void whiteheat_release(struct usb_serial *serial); ++static int whiteheat_port_probe(struct usb_serial_port *port); ++static int whiteheat_port_remove(struct usb_serial_port *port); + static int whiteheat_open(struct tty_struct *tty, + struct usb_serial_port *port); + static void whiteheat_close(struct usb_serial_port *port); +@@ -120,6 +122,8 @@ static struct usb_serial_driver whiteheat_device = { + .num_ports = 4, + .attach = whiteheat_attach, + .release = whiteheat_release, ++ .port_probe = whiteheat_port_probe, ++ .port_remove = whiteheat_port_remove, + .open = whiteheat_open, + .close = whiteheat_close, + .ioctl = whiteheat_ioctl, +@@ -290,15 +294,12 @@ static int whiteheat_attach(struct usb_serial *serial) + { + struct usb_serial_port *command_port; + struct whiteheat_command_private *command_info; +- struct usb_serial_port *port; +- struct whiteheat_private *info; + struct whiteheat_hw_info *hw_info; + int pipe; + int ret; + int alen; + __u8 *command; + __u8 *result; +- int i; + + command_port = serial->port[COMMAND_PORT]; + +@@ -357,22 +358,6 @@ static int whiteheat_attach(struct usb_serial *serial) + serial->type->description, + hw_info->sw_major_rev, hw_info->sw_minor_rev); + +- for (i = 0; i < serial->num_ports; i++) { +- port = serial->port[i]; +- +- info = kmalloc(sizeof(struct whiteheat_private), GFP_KERNEL); +- if (info == NULL) { +- dev_err(&port->dev, +- "%s: Out of memory for port structures\n", +- serial->type->description); +- goto no_private; +- } +- +- info->mcr = 0; +- +- usb_set_serial_port_data(port, info); +- } +- + command_info = kmalloc(sizeof(struct whiteheat_command_private), + GFP_KERNEL); + if (command_info == NULL) { +@@ -405,16 +390,10 @@ no_firmware: + "%s: please contact support@connecttech.com\n", + serial->type->description); + kfree(result); ++ kfree(command); + return -ENODEV; + + no_command_private: +- for (i = serial->num_ports - 1; i >= 0; i--) { +- port = serial->port[i]; +- info = usb_get_serial_port_data(port); +- kfree(info); +-no_private: +- ; +- } + kfree(result); + no_result_buffer: + kfree(command); +@@ -422,21 +401,36 @@ no_command_buffer: + return -ENOMEM; + } + +- + static void whiteheat_release(struct usb_serial *serial) + { + struct usb_serial_port *command_port; +- struct whiteheat_private *info; +- int i; + + /* free up our private data for our command port */ + command_port = serial->port[COMMAND_PORT]; + kfree(usb_get_serial_port_data(command_port)); ++} + +- for (i = 0; i < serial->num_ports; i++) { +- info = usb_get_serial_port_data(serial->port[i]); +- kfree(info); +- } ++static int whiteheat_port_probe(struct usb_serial_port *port) ++{ ++ struct whiteheat_private *info; ++ ++ info = kzalloc(sizeof(*info), GFP_KERNEL); ++ if (!info) ++ return -ENOMEM; ++ ++ usb_set_serial_port_data(port, info); ++ ++ return 0; ++} ++ ++static int whiteheat_port_remove(struct usb_serial_port *port) ++{ ++ struct whiteheat_private *info; ++ ++ info = usb_get_serial_port_data(port); ++ kfree(info); ++ ++ return 0; + } + + static int whiteheat_open(struct tty_struct *tty, struct usb_serial_port *port) +diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h +index 62a31be..8f98c9a 100644 +--- a/drivers/usb/storage/unusual_devs.h ++++ b/drivers/usb/storage/unusual_devs.h +@@ -1004,6 +1004,12 @@ UNUSUAL_DEV( 0x07cf, 0x1001, 0x1000, 0x9999, + USB_SC_8070, USB_PR_CB, NULL, + US_FL_NEED_OVERRIDE | US_FL_FIX_INQUIRY ), + ++/* Submitted by Oleksandr Chumachenko <ledest@gmail.com> */ ++UNUSUAL_DEV( 0x07cf, 0x1167, 0x0100, 0x0100, ++ "Casio", ++ "EX-N1 DigitalCamera", ++ USB_SC_8070, USB_PR_DEVICE, NULL, 0), ++ + /* Submitted by Hartmut Wahl <hwahl@hwahl.de>*/ + UNUSUAL_DEV( 0x0839, 0x000a, 0x0001, 0x0001, + "Samsung", +diff --git a/drivers/vhost/net.c b/drivers/vhost/net.c +index 072cbba..7f93f34 100644 +--- a/drivers/vhost/net.c ++++ b/drivers/vhost/net.c +@@ -379,7 +379,8 @@ static void handle_rx(struct vhost_net *net) + .hdr.gso_type = VIRTIO_NET_HDR_GSO_NONE + }; + size_t total_len = 0; +- int err, headcount, mergeable; ++ int err, mergeable; ++ s16 headcount; + size_t vhost_hlen, sock_hlen; + size_t vhost_len, sock_len; + /* TODO: check that we are running from vhost_worker? */ +diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c +index debdfe0..5d2069f 100644 +--- a/fs/compat_ioctl.c ++++ b/fs/compat_ioctl.c +@@ -210,6 +210,8 @@ static int do_video_set_spu_palette(unsigned int fd, unsigned int cmd, + + err = get_user(palp, &up->palette); + err |= get_user(length, &up->length); ++ if (err) ++ return -EFAULT; + + up_native = compat_alloc_user_space(sizeof(struct video_spu_palette)); + err = put_user(compat_ptr(palp), &up_native->palette); +diff --git a/fs/exec.c b/fs/exec.c +index 574cf4d..fab2c6d 100644 +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -1110,7 +1110,8 @@ int flush_old_exec(struct linux_binprm * bprm) + bprm->mm = NULL; /* We're using it now */ + + set_fs(USER_DS); +- current->flags &= ~(PF_RANDOMIZE | PF_FORKNOEXEC | PF_KTHREAD); ++ current->flags &= ++ ~(PF_RANDOMIZE | PF_FORKNOEXEC | PF_KTHREAD | PF_NOFREEZE); + flush_thread(); + current->personality &= ~bprm->per_clear; + +diff --git a/fs/lockd/mon.c b/fs/lockd/mon.c +index e4fb3ba..3d7e09b 100644 +--- a/fs/lockd/mon.c ++++ b/fs/lockd/mon.c +@@ -85,29 +85,38 @@ static struct rpc_clnt *nsm_create(struct net *net) + return rpc_create(&args); + } + ++static struct rpc_clnt *nsm_client_set(struct lockd_net *ln, ++ struct rpc_clnt *clnt) ++{ ++ spin_lock(&ln->nsm_clnt_lock); ++ if (ln->nsm_users == 0) { ++ if (clnt == NULL) ++ goto out; ++ ln->nsm_clnt = clnt; ++ } ++ clnt = ln->nsm_clnt; ++ ln->nsm_users++; ++out: ++ spin_unlock(&ln->nsm_clnt_lock); ++ return clnt; ++} ++ + static struct rpc_clnt *nsm_client_get(struct net *net) + { +- static DEFINE_MUTEX(nsm_create_mutex); +- struct rpc_clnt *clnt; ++ struct rpc_clnt *clnt, *new; + struct lockd_net *ln = net_generic(net, lockd_net_id); + +- spin_lock(&ln->nsm_clnt_lock); +- if (ln->nsm_users) { +- ln->nsm_users++; +- clnt = ln->nsm_clnt; +- spin_unlock(&ln->nsm_clnt_lock); ++ clnt = nsm_client_set(ln, NULL); ++ if (clnt != NULL) + goto out; +- } +- spin_unlock(&ln->nsm_clnt_lock); + +- mutex_lock(&nsm_create_mutex); +- clnt = nsm_create(net); +- if (!IS_ERR(clnt)) { +- ln->nsm_clnt = clnt; +- smp_wmb(); +- ln->nsm_users = 1; +- } +- mutex_unlock(&nsm_create_mutex); ++ clnt = new = nsm_create(net); ++ if (IS_ERR(clnt)) ++ goto out; ++ ++ clnt = nsm_client_set(ln, new); ++ if (clnt != new) ++ rpc_shutdown_client(new); + out: + return clnt; + } +@@ -115,18 +124,16 @@ out: + static void nsm_client_put(struct net *net) + { + struct lockd_net *ln = net_generic(net, lockd_net_id); +- struct rpc_clnt *clnt = ln->nsm_clnt; +- int shutdown = 0; ++ struct rpc_clnt *clnt = NULL; + + spin_lock(&ln->nsm_clnt_lock); +- if (ln->nsm_users) { +- if (--ln->nsm_users) +- ln->nsm_clnt = NULL; +- shutdown = !ln->nsm_users; ++ ln->nsm_users--; ++ if (ln->nsm_users == 0) { ++ clnt = ln->nsm_clnt; ++ ln->nsm_clnt = NULL; + } + spin_unlock(&ln->nsm_clnt_lock); +- +- if (shutdown) ++ if (clnt != NULL) + rpc_shutdown_client(clnt); + } + +diff --git a/fs/namei.c b/fs/namei.c +index 81bd546..091c4b7 100644 +--- a/fs/namei.c ++++ b/fs/namei.c +@@ -651,8 +651,8 @@ static inline void put_link(struct nameidata *nd, struct path *link, void *cooki + path_put(link); + } + +-int sysctl_protected_symlinks __read_mostly = 1; +-int sysctl_protected_hardlinks __read_mostly = 1; ++int sysctl_protected_symlinks __read_mostly = 0; ++int sysctl_protected_hardlinks __read_mostly = 0; + + /** + * may_follow_link - Check symlink following for unsafe situations +diff --git a/fs/nfs/blocklayout/blocklayout.c b/fs/nfs/blocklayout/blocklayout.c +index f3d16ad..1093968 100644 +--- a/fs/nfs/blocklayout/blocklayout.c ++++ b/fs/nfs/blocklayout/blocklayout.c +@@ -242,14 +242,6 @@ bl_end_par_io_read(void *data, int unused) + schedule_work(&rdata->task.u.tk_work); + } + +-static bool +-bl_check_alignment(u64 offset, u32 len, unsigned long blkmask) +-{ +- if ((offset & blkmask) || (len & blkmask)) +- return false; +- return true; +-} +- + static enum pnfs_try_status + bl_read_pagelist(struct nfs_read_data *rdata) + { +@@ -260,15 +252,15 @@ bl_read_pagelist(struct nfs_read_data *rdata) + sector_t isect, extent_length = 0; + struct parallel_io *par; + loff_t f_offset = rdata->args.offset; ++ size_t bytes_left = rdata->args.count; ++ unsigned int pg_offset, pg_len; + struct page **pages = rdata->args.pages; + int pg_index = rdata->args.pgbase >> PAGE_CACHE_SHIFT; ++ const bool is_dio = (header->dreq != NULL); + + dprintk("%s enter nr_pages %u offset %lld count %u\n", __func__, + rdata->pages.npages, f_offset, (unsigned int)rdata->args.count); + +- if (!bl_check_alignment(f_offset, rdata->args.count, PAGE_CACHE_MASK)) +- goto use_mds; +- + par = alloc_parallel(rdata); + if (!par) + goto use_mds; +@@ -298,36 +290,53 @@ bl_read_pagelist(struct nfs_read_data *rdata) + extent_length = min(extent_length, cow_length); + } + } ++ ++ if (is_dio) { ++ pg_offset = f_offset & ~PAGE_CACHE_MASK; ++ if (pg_offset + bytes_left > PAGE_CACHE_SIZE) ++ pg_len = PAGE_CACHE_SIZE - pg_offset; ++ else ++ pg_len = bytes_left; ++ ++ f_offset += pg_len; ++ bytes_left -= pg_len; ++ isect += (pg_offset >> SECTOR_SHIFT); ++ } else { ++ pg_offset = 0; ++ pg_len = PAGE_CACHE_SIZE; ++ } ++ + hole = is_hole(be, isect); + if (hole && !cow_read) { + bio = bl_submit_bio(READ, bio); + /* Fill hole w/ zeroes w/o accessing device */ + dprintk("%s Zeroing page for hole\n", __func__); +- zero_user_segment(pages[i], 0, PAGE_CACHE_SIZE); ++ zero_user_segment(pages[i], pg_offset, pg_len); + print_page(pages[i]); + SetPageUptodate(pages[i]); + } else { + struct pnfs_block_extent *be_read; + + be_read = (hole && cow_read) ? cow_read : be; +- bio = bl_add_page_to_bio(bio, rdata->pages.npages - i, ++ bio = do_add_page_to_bio(bio, rdata->pages.npages - i, + READ, + isect, pages[i], be_read, +- bl_end_io_read, par); ++ bl_end_io_read, par, ++ pg_offset, pg_len); + if (IS_ERR(bio)) { + header->pnfs_error = PTR_ERR(bio); + bio = NULL; + goto out; + } + } +- isect += PAGE_CACHE_SECTORS; ++ isect += (pg_len >> SECTOR_SHIFT); + extent_length -= PAGE_CACHE_SECTORS; + } + if ((isect << SECTOR_SHIFT) >= header->inode->i_size) { + rdata->res.eof = 1; +- rdata->res.count = header->inode->i_size - f_offset; ++ rdata->res.count = header->inode->i_size - rdata->args.offset; + } else { +- rdata->res.count = (isect << SECTOR_SHIFT) - f_offset; ++ rdata->res.count = (isect << SECTOR_SHIFT) - rdata->args.offset; + } + out: + bl_put_extent(be); +@@ -688,10 +697,13 @@ bl_write_pagelist(struct nfs_write_data *wdata, int sync) + NFS_SERVER(header->inode)->pnfs_blksize >> PAGE_CACHE_SHIFT; + + dprintk("%s enter, %Zu@%lld\n", __func__, count, offset); +- /* Check for alignment first */ +- if (!bl_check_alignment(offset, count, PAGE_CACHE_MASK)) +- goto out_mds; + ++ if (header->dreq != NULL && ++ (!IS_ALIGNED(offset, NFS_SERVER(header->inode)->pnfs_blksize) || ++ !IS_ALIGNED(count, NFS_SERVER(header->inode)->pnfs_blksize))) { ++ dprintk("pnfsblock nonblock aligned DIO writes. Resend MDS\n"); ++ goto out_mds; ++ } + /* At this point, wdata->pages is a (sequential) list of nfs_pages. + * We want to write each, and if there is an error set pnfs_error + * to have it redone using nfs. +@@ -1164,33 +1176,64 @@ bl_clear_layoutdriver(struct nfs_server *server) + return 0; + } + ++static bool ++is_aligned_req(struct nfs_page *req, unsigned int alignment) ++{ ++ return IS_ALIGNED(req->wb_offset, alignment) && ++ IS_ALIGNED(req->wb_bytes, alignment); ++} ++ + static void + bl_pg_init_read(struct nfs_pageio_descriptor *pgio, struct nfs_page *req) + { +- if (!bl_check_alignment(req->wb_offset, req->wb_bytes, PAGE_CACHE_MASK)) ++ if (pgio->pg_dreq != NULL && ++ !is_aligned_req(req, SECTOR_SIZE)) + nfs_pageio_reset_read_mds(pgio); + else + pnfs_generic_pg_init_read(pgio, req); + } + +-static void ++static bool ++bl_pg_test_read(struct nfs_pageio_descriptor *pgio, struct nfs_page *prev, ++ struct nfs_page *req) ++{ ++ if (pgio->pg_dreq != NULL && ++ !is_aligned_req(req, SECTOR_SIZE)) ++ return false; ++ ++ return pnfs_generic_pg_test(pgio, prev, req); ++} ++ ++void + bl_pg_init_write(struct nfs_pageio_descriptor *pgio, struct nfs_page *req) + { +- if (!bl_check_alignment(req->wb_offset, req->wb_bytes, PAGE_CACHE_MASK)) ++ if (pgio->pg_dreq != NULL && ++ !is_aligned_req(req, PAGE_CACHE_SIZE)) + nfs_pageio_reset_write_mds(pgio); + else + pnfs_generic_pg_init_write(pgio, req); + } + ++static bool ++bl_pg_test_write(struct nfs_pageio_descriptor *pgio, struct nfs_page *prev, ++ struct nfs_page *req) ++{ ++ if (pgio->pg_dreq != NULL && ++ !is_aligned_req(req, PAGE_CACHE_SIZE)) ++ return false; ++ ++ return pnfs_generic_pg_test(pgio, prev, req); ++} ++ + static const struct nfs_pageio_ops bl_pg_read_ops = { + .pg_init = bl_pg_init_read, +- .pg_test = pnfs_generic_pg_test, ++ .pg_test = bl_pg_test_read, + .pg_doio = pnfs_generic_pg_readpages, + }; + + static const struct nfs_pageio_ops bl_pg_write_ops = { + .pg_init = bl_pg_init_write, +- .pg_test = pnfs_generic_pg_test, ++ .pg_test = bl_pg_test_write, + .pg_doio = pnfs_generic_pg_writepages, + }; + +diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c +index 6b0bb00..2fbdff6 100644 +--- a/fs/sysfs/dir.c ++++ b/fs/sysfs/dir.c +@@ -485,20 +485,18 @@ int __sysfs_add_one(struct sysfs_addrm_cxt *acxt, struct sysfs_dirent *sd) + /** + * sysfs_pathname - return full path to sysfs dirent + * @sd: sysfs_dirent whose path we want +- * @path: caller allocated buffer ++ * @path: caller allocated buffer of size PATH_MAX + * + * Gives the name "/" to the sysfs_root entry; any path returned + * is relative to wherever sysfs is mounted. +- * +- * XXX: does no error checking on @path size + */ + static char *sysfs_pathname(struct sysfs_dirent *sd, char *path) + { + if (sd->s_parent) { + sysfs_pathname(sd->s_parent, path); +- strcat(path, "/"); ++ strlcat(path, "/", PATH_MAX); + } +- strcat(path, sd->s_name); ++ strlcat(path, sd->s_name, PATH_MAX); + return path; + } + +@@ -531,9 +529,11 @@ int sysfs_add_one(struct sysfs_addrm_cxt *acxt, struct sysfs_dirent *sd) + char *path = kzalloc(PATH_MAX, GFP_KERNEL); + WARN(1, KERN_WARNING + "sysfs: cannot create duplicate filename '%s'\n", +- (path == NULL) ? sd->s_name : +- strcat(strcat(sysfs_pathname(acxt->parent_sd, path), "/"), +- sd->s_name)); ++ (path == NULL) ? sd->s_name ++ : (sysfs_pathname(acxt->parent_sd, path), ++ strlcat(path, "/", PATH_MAX), ++ strlcat(path, sd->s_name, PATH_MAX), ++ path)); + kfree(path); + } + +diff --git a/include/drm/drm_pciids.h b/include/drm/drm_pciids.h +index c78bb99..af1cbaf 100644 +--- a/include/drm/drm_pciids.h ++++ b/include/drm/drm_pciids.h +@@ -205,6 +205,8 @@ + {0x1002, 0x6788, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x678A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6790, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \ ++ {0x1002, 0x6791, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \ ++ {0x1002, 0x6792, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6798, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6799, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x679A, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_TAHITI|RADEON_NEW_MEMMAP}, \ +@@ -217,6 +219,7 @@ + {0x1002, 0x6808, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6809, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6810, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \ ++ {0x1002, 0x6811, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6816, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6817, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \ + {0x1002, 0x6818, PCI_ANY_ID, PCI_ANY_ID, 0, 0, CHIP_PITCAIRN|RADEON_NEW_MEMMAP}, \ +diff --git a/include/linux/efi.h b/include/linux/efi.h +index ec45ccd..5782114 100644 +--- a/include/linux/efi.h ++++ b/include/linux/efi.h +@@ -496,6 +496,11 @@ extern void efi_map_pal_code (void); + extern void efi_memmap_walk (efi_freemem_callback_t callback, void *arg); + extern void efi_gettimeofday (struct timespec *ts); + extern void efi_enter_virtual_mode (void); /* switch EFI to virtual mode, if possible */ ++#ifdef CONFIG_X86 ++extern void efi_free_boot_services(void); ++#else ++static inline void efi_free_boot_services(void) {} ++#endif + extern u64 efi_get_iobase (void); + extern u32 efi_mem_type (unsigned long phys_addr); + extern u64 efi_mem_attributes (unsigned long phys_addr); +diff --git a/include/linux/memblock.h b/include/linux/memblock.h +index 19dc455..c948c44 100644 +--- a/include/linux/memblock.h ++++ b/include/linux/memblock.h +@@ -57,6 +57,7 @@ int memblock_add(phys_addr_t base, phys_addr_t size); + int memblock_remove(phys_addr_t base, phys_addr_t size); + int memblock_free(phys_addr_t base, phys_addr_t size); + int memblock_reserve(phys_addr_t base, phys_addr_t size); ++void memblock_trim_memory(phys_addr_t align); + + #ifdef CONFIG_HAVE_MEMBLOCK_NODE_MAP + void __next_mem_pfn_range(int *idx, int nid, unsigned long *out_start_pfn, +diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h +index 3d254e1..f10553c 100644 +--- a/include/net/cfg80211.h ++++ b/include/net/cfg80211.h +@@ -1217,6 +1217,7 @@ struct cfg80211_deauth_request { + const u8 *ie; + size_t ie_len; + u16 reason_code; ++ bool local_state_change; + }; + + /** +diff --git a/init/main.c b/init/main.c +index b286730..d61ec54 100644 +--- a/init/main.c ++++ b/init/main.c +@@ -631,6 +631,9 @@ asmlinkage void __init start_kernel(void) + acpi_early_init(); /* before LAPIC and SMP init */ + sfi_init_late(); + ++ if (efi_enabled) ++ efi_free_boot_services(); ++ + ftrace_init(); + + /* Do the rest non-__init'ed, we're now alive */ +diff --git a/lib/genalloc.c b/lib/genalloc.c +index 6bc04aa..7cb7a5d 100644 +--- a/lib/genalloc.c ++++ b/lib/genalloc.c +@@ -176,7 +176,7 @@ int gen_pool_add_virt(struct gen_pool *pool, unsigned long virt, phys_addr_t phy + struct gen_pool_chunk *chunk; + int nbits = size >> pool->min_alloc_order; + int nbytes = sizeof(struct gen_pool_chunk) + +- (nbits + BITS_PER_BYTE - 1) / BITS_PER_BYTE; ++ BITS_TO_LONGS(nbits) * sizeof(long); + + chunk = kmalloc_node(nbytes, GFP_KERNEL | __GFP_ZERO, nid); + if (unlikely(chunk == NULL)) +diff --git a/mm/memblock.c b/mm/memblock.c +index 82aa349..0e490e8 100644 +--- a/mm/memblock.c ++++ b/mm/memblock.c +@@ -929,6 +929,30 @@ int __init_memblock memblock_is_region_reserved(phys_addr_t base, phys_addr_t si + return memblock_overlaps_region(&memblock.reserved, base, size) >= 0; + } + ++void __init_memblock memblock_trim_memory(phys_addr_t align) ++{ ++ int i; ++ phys_addr_t start, end, orig_start, orig_end; ++ struct memblock_type *mem = &memblock.memory; ++ ++ for (i = 0; i < mem->cnt; i++) { ++ orig_start = mem->regions[i].base; ++ orig_end = mem->regions[i].base + mem->regions[i].size; ++ start = round_up(orig_start, align); ++ end = round_down(orig_end, align); ++ ++ if (start == orig_start && end == orig_end) ++ continue; ++ ++ if (start < end) { ++ mem->regions[i].base = start; ++ mem->regions[i].size = end - start; ++ } else { ++ memblock_remove_region(mem, i); ++ i--; ++ } ++ } ++} + + void __init_memblock memblock_set_current_limit(phys_addr_t limit) + { +diff --git a/mm/rmap.c b/mm/rmap.c +index 0f3b7cd..aa95e59 100644 +--- a/mm/rmap.c ++++ b/mm/rmap.c +@@ -56,6 +56,7 @@ + #include <linux/mmu_notifier.h> + #include <linux/migrate.h> + #include <linux/hugetlb.h> ++#include <linux/backing-dev.h> + + #include <asm/tlbflush.h> + +@@ -971,11 +972,8 @@ int page_mkclean(struct page *page) + + if (page_mapped(page)) { + struct address_space *mapping = page_mapping(page); +- if (mapping) { ++ if (mapping) + ret = page_mkclean_file(mapping, page); +- if (page_test_and_clear_dirty(page_to_pfn(page), 1)) +- ret = 1; +- } + } + + return ret; +@@ -1161,6 +1159,7 @@ void page_add_file_rmap(struct page *page) + */ + void page_remove_rmap(struct page *page) + { ++ struct address_space *mapping = page_mapping(page); + bool anon = PageAnon(page); + bool locked; + unsigned long flags; +@@ -1183,8 +1182,19 @@ void page_remove_rmap(struct page *page) + * this if the page is anon, so about to be freed; but perhaps + * not if it's in swapcache - there might be another pte slot + * containing the swap entry, but page not yet written to swap. ++ * ++ * And we can skip it on file pages, so long as the filesystem ++ * participates in dirty tracking; but need to catch shm and tmpfs ++ * and ramfs pages which have been modified since creation by read ++ * fault. ++ * ++ * Note that mapping must be decided above, before decrementing ++ * mapcount (which luckily provides a barrier): once page is unmapped, ++ * it could be truncated and page->mapping reset to NULL at any moment. ++ * Note also that we are relying on page_mapping(page) to set mapping ++ * to &swapper_space when PageSwapCache(page). + */ +- if ((!anon || PageSwapCache(page)) && ++ if (mapping && !mapping_cap_account_dirty(mapping) && + page_test_and_clear_dirty(page_to_pfn(page), 1)) + set_page_dirty(page); + /* +diff --git a/net/bluetooth/smp.c b/net/bluetooth/smp.c +index 8c225ef..2ac8d50 100644 +--- a/net/bluetooth/smp.c ++++ b/net/bluetooth/smp.c +@@ -32,6 +32,8 @@ + + #define SMP_TIMEOUT msecs_to_jiffies(30000) + ++#define AUTH_REQ_MASK 0x07 ++ + static inline void swap128(u8 src[16], u8 dst[16]) + { + int i; +@@ -230,7 +232,7 @@ static void build_pairing_cmd(struct l2cap_conn *conn, + req->max_key_size = SMP_MAX_ENC_KEY_SIZE; + req->init_key_dist = 0; + req->resp_key_dist = dist_keys; +- req->auth_req = authreq; ++ req->auth_req = (authreq & AUTH_REQ_MASK); + return; + } + +@@ -239,7 +241,7 @@ static void build_pairing_cmd(struct l2cap_conn *conn, + rsp->max_key_size = SMP_MAX_ENC_KEY_SIZE; + rsp->init_key_dist = 0; + rsp->resp_key_dist = req->resp_key_dist & dist_keys; +- rsp->auth_req = authreq; ++ rsp->auth_req = (authreq & AUTH_REQ_MASK); + } + + static u8 check_enc_key_size(struct l2cap_conn *conn, __u8 max_key_size) +diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c +index bfb57dc..c93d395 100644 +--- a/net/mac80211/iface.c ++++ b/net/mac80211/iface.c +@@ -822,7 +822,7 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, + struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); + if (info->control.vif == &sdata->vif) { + __skb_unlink(skb, &local->pending[i]); +- dev_kfree_skb_irq(skb); ++ ieee80211_free_txskb(&local->hw, skb); + } + } + } +diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c +index f76b833..b71d466 100644 +--- a/net/mac80211/mlme.c ++++ b/net/mac80211/mlme.c +@@ -3065,22 +3065,32 @@ static int ieee80211_prep_connection(struct ieee80211_sub_if_data *sdata, + ht_cfreq, ht_oper->primary_chan, + cbss->channel->band); + ht_oper = NULL; ++ } else { ++ channel_type = NL80211_CHAN_HT20; + } + } + +- if (ht_oper) { +- channel_type = NL80211_CHAN_HT20; ++ if (ht_oper && sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) { ++ /* ++ * cfg80211 already verified that the channel itself can ++ * be used, but it didn't check that we can do the right ++ * HT type, so do that here as well. If HT40 isn't allowed ++ * on this channel, disable 40 MHz operation. ++ */ + +- if (sband->ht_cap.cap & IEEE80211_HT_CAP_SUP_WIDTH_20_40) { +- switch (ht_oper->ht_param & +- IEEE80211_HT_PARAM_CHA_SEC_OFFSET) { +- case IEEE80211_HT_PARAM_CHA_SEC_ABOVE: ++ switch (ht_oper->ht_param & IEEE80211_HT_PARAM_CHA_SEC_OFFSET) { ++ case IEEE80211_HT_PARAM_CHA_SEC_ABOVE: ++ if (cbss->channel->flags & IEEE80211_CHAN_NO_HT40PLUS) ++ ifmgd->flags |= IEEE80211_STA_DISABLE_40MHZ; ++ else + channel_type = NL80211_CHAN_HT40PLUS; +- break; +- case IEEE80211_HT_PARAM_CHA_SEC_BELOW: ++ break; ++ case IEEE80211_HT_PARAM_CHA_SEC_BELOW: ++ if (cbss->channel->flags & IEEE80211_CHAN_NO_HT40MINUS) ++ ifmgd->flags |= IEEE80211_STA_DISABLE_40MHZ; ++ else + channel_type = NL80211_CHAN_HT40MINUS; +- break; +- } ++ break; + } + } + +@@ -3457,6 +3467,7 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata, + { + struct ieee80211_if_managed *ifmgd = &sdata->u.mgd; + u8 frame_buf[DEAUTH_DISASSOC_LEN]; ++ bool tx = !req->local_state_change; + + mutex_lock(&ifmgd->mtx); + +@@ -3473,11 +3484,11 @@ int ieee80211_mgd_deauth(struct ieee80211_sub_if_data *sdata, + if (ifmgd->associated && + ether_addr_equal(ifmgd->associated->bssid, req->bssid)) + ieee80211_set_disassoc(sdata, IEEE80211_STYPE_DEAUTH, +- req->reason_code, true, frame_buf); ++ req->reason_code, tx, frame_buf); + else + ieee80211_send_deauth_disassoc(sdata, req->bssid, + IEEE80211_STYPE_DEAUTH, +- req->reason_code, true, ++ req->reason_code, tx, + frame_buf); + mutex_unlock(&ifmgd->mtx); + +diff --git a/net/mac80211/sta_info.c b/net/mac80211/sta_info.c +index 06fa75c..63882b9 100644 +--- a/net/mac80211/sta_info.c ++++ b/net/mac80211/sta_info.c +@@ -585,7 +585,7 @@ static bool sta_info_cleanup_expire_buffered_ac(struct ieee80211_local *local, + */ + if (!skb) + break; +- dev_kfree_skb(skb); ++ ieee80211_free_txskb(&local->hw, skb); + } + + /* +@@ -614,7 +614,7 @@ static bool sta_info_cleanup_expire_buffered_ac(struct ieee80211_local *local, + local->total_ps_buffered--; + ps_dbg(sta->sdata, "Buffered frame expired (STA %pM)\n", + sta->sta.addr); +- dev_kfree_skb(skb); ++ ieee80211_free_txskb(&local->hw, skb); + } + + /* +diff --git a/net/mac80211/util.c b/net/mac80211/util.c +index 39b82fe..c9b52f7 100644 +--- a/net/mac80211/util.c ++++ b/net/mac80211/util.c +@@ -400,7 +400,7 @@ void ieee80211_add_pending_skb(struct ieee80211_local *local, + int queue = info->hw_queue; + + if (WARN_ON(!info->control.vif)) { +- kfree_skb(skb); ++ ieee80211_free_txskb(&local->hw, skb); + return; + } + +@@ -425,7 +425,7 @@ void ieee80211_add_pending_skbs_fn(struct ieee80211_local *local, + struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb); + + if (WARN_ON(!info->control.vif)) { +- kfree_skb(skb); ++ ieee80211_free_txskb(&local->hw, skb); + continue; + } + +diff --git a/net/mac80211/wpa.c b/net/mac80211/wpa.c +index bdb53ab..e72562a 100644 +--- a/net/mac80211/wpa.c ++++ b/net/mac80211/wpa.c +@@ -106,7 +106,8 @@ ieee80211_rx_h_michael_mic_verify(struct ieee80211_rx_data *rx) + if (status->flag & RX_FLAG_MMIC_ERROR) + goto mic_fail; + +- if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key) ++ if (!(status->flag & RX_FLAG_IV_STRIPPED) && rx->key && ++ rx->key->conf.cipher == WLAN_CIPHER_SUITE_TKIP) + goto update_iv; + + return RX_CONTINUE; +diff --git a/net/sunrpc/xprtsock.c b/net/sunrpc/xprtsock.c +index 97f8918..6a70db4 100644 +--- a/net/sunrpc/xprtsock.c ++++ b/net/sunrpc/xprtsock.c +@@ -254,7 +254,6 @@ struct sock_xprt { + void (*old_data_ready)(struct sock *, int); + void (*old_state_change)(struct sock *); + void (*old_write_space)(struct sock *); +- void (*old_error_report)(struct sock *); + }; + + /* +@@ -737,10 +736,10 @@ static int xs_tcp_send_request(struct rpc_task *task) + dprintk("RPC: sendmsg returned unrecognized error %d\n", + -status); + case -ECONNRESET: +- case -EPIPE: + xs_tcp_shutdown(xprt); + case -ECONNREFUSED: + case -ENOTCONN: ++ case -EPIPE: + clear_bit(SOCK_ASYNC_NOSPACE, &transport->sock->flags); + } + +@@ -781,7 +780,6 @@ static void xs_save_old_callbacks(struct sock_xprt *transport, struct sock *sk) + transport->old_data_ready = sk->sk_data_ready; + transport->old_state_change = sk->sk_state_change; + transport->old_write_space = sk->sk_write_space; +- transport->old_error_report = sk->sk_error_report; + } + + static void xs_restore_old_callbacks(struct sock_xprt *transport, struct sock *sk) +@@ -789,7 +787,6 @@ static void xs_restore_old_callbacks(struct sock_xprt *transport, struct sock *s + sk->sk_data_ready = transport->old_data_ready; + sk->sk_state_change = transport->old_state_change; + sk->sk_write_space = transport->old_write_space; +- sk->sk_error_report = transport->old_error_report; + } + + static void xs_reset_transport(struct sock_xprt *transport) +@@ -1462,7 +1459,7 @@ static void xs_tcp_cancel_linger_timeout(struct rpc_xprt *xprt) + xprt_clear_connecting(xprt); + } + +-static void xs_sock_mark_closed(struct rpc_xprt *xprt) ++static void xs_sock_reset_connection_flags(struct rpc_xprt *xprt) + { + smp_mb__before_clear_bit(); + clear_bit(XPRT_CONNECTION_ABORT, &xprt->state); +@@ -1470,6 +1467,11 @@ static void xs_sock_mark_closed(struct rpc_xprt *xprt) + clear_bit(XPRT_CLOSE_WAIT, &xprt->state); + clear_bit(XPRT_CLOSING, &xprt->state); + smp_mb__after_clear_bit(); ++} ++ ++static void xs_sock_mark_closed(struct rpc_xprt *xprt) ++{ ++ xs_sock_reset_connection_flags(xprt); + /* Mark transport as closed and wake up all pending tasks */ + xprt_disconnect_done(xprt); + } +@@ -1525,6 +1527,7 @@ static void xs_tcp_state_change(struct sock *sk) + case TCP_CLOSE_WAIT: + /* The server initiated a shutdown of the socket */ + xprt->connect_cookie++; ++ clear_bit(XPRT_CONNECTED, &xprt->state); + xs_tcp_force_close(xprt); + case TCP_CLOSING: + /* +@@ -1549,25 +1552,6 @@ static void xs_tcp_state_change(struct sock *sk) + read_unlock_bh(&sk->sk_callback_lock); + } + +-/** +- * xs_error_report - callback mainly for catching socket errors +- * @sk: socket +- */ +-static void xs_error_report(struct sock *sk) +-{ +- struct rpc_xprt *xprt; +- +- read_lock_bh(&sk->sk_callback_lock); +- if (!(xprt = xprt_from_sock(sk))) +- goto out; +- dprintk("RPC: %s client %p...\n" +- "RPC: error %d\n", +- __func__, xprt, sk->sk_err); +- xprt_wake_pending_tasks(xprt, -EAGAIN); +-out: +- read_unlock_bh(&sk->sk_callback_lock); +-} +- + static void xs_write_space(struct sock *sk) + { + struct socket *sock; +@@ -1867,7 +1851,6 @@ static int xs_local_finish_connecting(struct rpc_xprt *xprt, + sk->sk_user_data = xprt; + sk->sk_data_ready = xs_local_data_ready; + sk->sk_write_space = xs_udp_write_space; +- sk->sk_error_report = xs_error_report; + sk->sk_allocation = GFP_ATOMIC; + + xprt_clear_connected(xprt); +@@ -1995,7 +1978,6 @@ static void xs_udp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock) + sk->sk_user_data = xprt; + sk->sk_data_ready = xs_udp_data_ready; + sk->sk_write_space = xs_udp_write_space; +- sk->sk_error_report = xs_error_report; + sk->sk_no_check = UDP_CSUM_NORCV; + sk->sk_allocation = GFP_ATOMIC; + +@@ -2065,10 +2047,8 @@ static void xs_abort_connection(struct sock_xprt *transport) + any.sa_family = AF_UNSPEC; + result = kernel_connect(transport->sock, &any, sizeof(any), 0); + if (!result) +- xs_sock_mark_closed(&transport->xprt); +- else +- dprintk("RPC: AF_UNSPEC connect return code %d\n", +- result); ++ xs_sock_reset_connection_flags(&transport->xprt); ++ dprintk("RPC: AF_UNSPEC connect return code %d\n", result); + } + + static void xs_tcp_reuse_connection(struct sock_xprt *transport) +@@ -2113,7 +2093,6 @@ static int xs_tcp_finish_connecting(struct rpc_xprt *xprt, struct socket *sock) + sk->sk_data_ready = xs_tcp_data_ready; + sk->sk_state_change = xs_tcp_state_change; + sk->sk_write_space = xs_tcp_write_space; +- sk->sk_error_report = xs_error_report; + sk->sk_allocation = GFP_ATOMIC; + + /* socket options */ +diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c +index 1cdb1d5..9ea174f 100644 +--- a/net/wireless/mlme.c ++++ b/net/wireless/mlme.c +@@ -457,20 +457,14 @@ int __cfg80211_mlme_deauth(struct cfg80211_registered_device *rdev, + .reason_code = reason, + .ie = ie, + .ie_len = ie_len, ++ .local_state_change = local_state_change, + }; + + ASSERT_WDEV_LOCK(wdev); + +- if (local_state_change) { +- if (wdev->current_bss && +- ether_addr_equal(wdev->current_bss->pub.bssid, bssid)) { +- cfg80211_unhold_bss(wdev->current_bss); +- cfg80211_put_bss(&wdev->current_bss->pub); +- wdev->current_bss = NULL; +- } +- ++ if (local_state_change && (!wdev->current_bss || ++ !ether_addr_equal(wdev->current_bss->pub.bssid, bssid))) + return 0; +- } + + return rdev->ops->deauth(&rdev->wiphy, dev, &req); + } +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 155cbd2..70ce60f 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -5704,6 +5704,7 @@ static const struct hda_verb alc268_beep_init_verbs[] = { + + enum { + ALC268_FIXUP_INV_DMIC, ++ ALC268_FIXUP_HP_EAPD, + }; + + static const struct alc_fixup alc268_fixups[] = { +@@ -5711,10 +5712,26 @@ static const struct alc_fixup alc268_fixups[] = { + .type = ALC_FIXUP_FUNC, + .v.func = alc_fixup_inv_dmic_0x12, + }, ++ [ALC268_FIXUP_HP_EAPD] = { ++ .type = ALC_FIXUP_VERBS, ++ .v.verbs = (const struct hda_verb[]) { ++ {0x15, AC_VERB_SET_EAPD_BTLENABLE, 0}, ++ {} ++ } ++ }, + }; + + static const struct alc_model_fixup alc268_fixup_models[] = { + {.id = ALC268_FIXUP_INV_DMIC, .name = "inv-dmic"}, ++ {.id = ALC268_FIXUP_HP_EAPD, .name = "hp-eapd"}, ++ {} ++}; ++ ++static const struct snd_pci_quirk alc268_fixup_tbl[] = { ++ /* below is codec SSID since multiple Toshiba laptops have the ++ * same PCI SSID 1179:ff00 ++ */ ++ SND_PCI_QUIRK(0x1179, 0xff06, "Toshiba P200", ALC268_FIXUP_HP_EAPD), + {} + }; + +@@ -5749,7 +5766,7 @@ static int patch_alc268(struct hda_codec *codec) + + spec = codec->spec; + +- alc_pick_fixup(codec, alc268_fixup_models, NULL, alc268_fixups); ++ alc_pick_fixup(codec, alc268_fixup_models, alc268_fixup_tbl, alc268_fixups); + alc_apply_fixup(codec, ALC_FIXUP_ACT_PRE_PROBE); + + /* automatic parse from the BIOS config */ +@@ -6214,6 +6231,7 @@ static const struct snd_pci_quirk alc269_fixup_tbl[] = { + SND_PCI_QUIRK(0x17aa, 0x21e9, "Thinkpad Edge 15", ALC269_FIXUP_SKU_IGNORE), + SND_PCI_QUIRK(0x17aa, 0x21f6, "Thinkpad T530", ALC269_FIXUP_LENOVO_DOCK), + SND_PCI_QUIRK(0x17aa, 0x21fa, "Thinkpad X230", ALC269_FIXUP_LENOVO_DOCK), ++ SND_PCI_QUIRK(0x17aa, 0x21f3, "Thinkpad T430", ALC269_FIXUP_LENOVO_DOCK), + SND_PCI_QUIRK(0x17aa, 0x21fb, "Thinkpad T430s", ALC269_FIXUP_LENOVO_DOCK), + SND_PCI_QUIRK(0x17aa, 0x2203, "Thinkpad X230 Tablet", ALC269_FIXUP_LENOVO_DOCK), + SND_PCI_QUIRK(0x17aa, 0x3bf8, "Quanta FL1", ALC269_FIXUP_PCM_44K), +diff --git a/usr/gen_init_cpio.c b/usr/gen_init_cpio.c +index af0f22f..aca6edc 100644 +--- a/usr/gen_init_cpio.c ++++ b/usr/gen_init_cpio.c +@@ -303,7 +303,7 @@ static int cpio_mkfile(const char *name, const char *location, + int retval; + int rc = -1; + int namesize; +- int i; ++ unsigned int i; + + mode |= S_IFREG; + +@@ -381,25 +381,28 @@ error: + + static char *cpio_replace_env(char *new_location) + { +- char expanded[PATH_MAX + 1]; +- char env_var[PATH_MAX + 1]; +- char *start; +- char *end; +- +- for (start = NULL; (start = strstr(new_location, "${")); ) { +- end = strchr(start, '}'); +- if (start < end) { +- *env_var = *expanded = '\0'; +- strncat(env_var, start + 2, end - start - 2); +- strncat(expanded, new_location, start - new_location); +- strncat(expanded, getenv(env_var), PATH_MAX); +- strncat(expanded, end + 1, PATH_MAX); +- strncpy(new_location, expanded, PATH_MAX); +- } else +- break; +- } +- +- return new_location; ++ char expanded[PATH_MAX + 1]; ++ char env_var[PATH_MAX + 1]; ++ char *start; ++ char *end; ++ ++ for (start = NULL; (start = strstr(new_location, "${")); ) { ++ end = strchr(start, '}'); ++ if (start < end) { ++ *env_var = *expanded = '\0'; ++ strncat(env_var, start + 2, end - start - 2); ++ strncat(expanded, new_location, start - new_location); ++ strncat(expanded, getenv(env_var), ++ PATH_MAX - strlen(expanded)); ++ strncat(expanded, end + 1, ++ PATH_MAX - strlen(expanded)); ++ strncpy(new_location, expanded, PATH_MAX); ++ new_location[PATH_MAX] = 0; ++ } else ++ break; ++ } ++ ++ return new_location; + } + + diff --git a/3.6.4/4420_grsecurity-2.9.1-3.6.4-201210291446.patch b/3.6.5/4420_grsecurity-2.9.1-3.6.5-201210312121.patch index 08c581d..c2276e8 100644 --- a/3.6.4/4420_grsecurity-2.9.1-3.6.4-201210291446.patch +++ b/3.6.5/4420_grsecurity-2.9.1-3.6.5-201210312121.patch @@ -251,7 +251,7 @@ index ad7e2e5..199f49e 100644 pcd. [PARIDE] diff --git a/Makefile b/Makefile -index dcf132a..db194e3 100644 +index 6e4a00d..4c7aa4f 100644 --- a/Makefile +++ b/Makefile @@ -241,8 +241,9 @@ CONFIG_SHELL := $(shell if [ -x "$$BASH" ]; then echo $$BASH; \ @@ -19013,7 +19013,7 @@ index 7a6f3b3..bed145d7 100644 1: diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c -index 198e774..e880f29 100644 +index 5cee802..bc22bc3 100644 --- a/arch/x86/kernel/setup.c +++ b/arch/x86/kernel/setup.c @@ -440,7 +440,7 @@ static void __init parse_setup_data(void) @@ -24577,7 +24577,7 @@ index b91e485..d00e7c9 100644 } if (mm->get_unmapped_area == arch_get_unmapped_area) diff --git a/arch/x86/mm/init.c b/arch/x86/mm/init.c -index ab1f6a9..23030ba 100644 +index d7aea41..f753ad2 100644 --- a/arch/x86/mm/init.c +++ b/arch/x86/mm/init.c @@ -16,6 +16,8 @@ @@ -24589,16 +24589,16 @@ index ab1f6a9..23030ba 100644 unsigned long __initdata pgt_buf_start; unsigned long __meminitdata pgt_buf_end; -@@ -38,7 +40,7 @@ struct map_range { - static void __init find_early_table_space(struct map_range *mr, unsigned long end, - int use_pse, int use_gbpages) +@@ -44,7 +46,7 @@ static void __init find_early_table_space(struct map_range *mr, int nr_range) { -- unsigned long puds, pmds, ptes, tables, start = 0, good_end = end; -+ unsigned long puds, pmds, ptes, tables, start = 0x100000, good_end = end; + int i; + unsigned long puds = 0, pmds = 0, ptes = 0, tables; +- unsigned long start = 0, good_end; ++ unsigned long start = 0x100000, good_end; phys_addr_t base; - puds = (end + PUD_SIZE - 1) >> PUD_SHIFT; -@@ -317,10 +319,37 @@ unsigned long __init_refok init_memory_mapping(unsigned long start, + for (i = 0; i < nr_range; i++) { +@@ -321,10 +323,37 @@ unsigned long __init_refok init_memory_mapping(unsigned long start, * Access has to be given to non-kernel-ram areas as well, these contain the PCI * mmio resources as well as potential bios/acpi data regions. */ @@ -24637,7 +24637,7 @@ index ab1f6a9..23030ba 100644 if (iomem_is_exclusive(pagenr << PAGE_SHIFT)) return 0; if (!page_is_ram(pagenr)) -@@ -377,8 +406,117 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end) +@@ -381,8 +410,117 @@ void free_init_pages(char *what, unsigned long begin, unsigned long end) #endif } @@ -25034,7 +25034,7 @@ index 575d86f..4987469 100644 printk(KERN_INFO "Write protecting the kernel text: %luk\n", size >> 10); diff --git a/arch/x86/mm/init_64.c b/arch/x86/mm/init_64.c -index 2b6b4a3..c17210d 100644 +index 3baff25..8b37564 100644 --- a/arch/x86/mm/init_64.c +++ b/arch/x86/mm/init_64.c @@ -74,7 +74,7 @@ early_param("gbpages", parse_direct_gbpages_on); @@ -25151,7 +25151,7 @@ index 2b6b4a3..c17210d 100644 adr = (void *)(((unsigned long)adr) | left); return adr; -@@ -548,7 +562,7 @@ phys_pud_init(pud_t *pud_page, unsigned long addr, unsigned long end, +@@ -553,7 +567,7 @@ phys_pud_init(pud_t *pud_page, unsigned long addr, unsigned long end, unmap_low_page(pmd); spin_lock(&init_mm.page_table_lock); @@ -25160,7 +25160,7 @@ index 2b6b4a3..c17210d 100644 spin_unlock(&init_mm.page_table_lock); } __flush_tlb_all(); -@@ -594,7 +608,7 @@ kernel_physical_mapping_init(unsigned long start, +@@ -599,7 +613,7 @@ kernel_physical_mapping_init(unsigned long start, unmap_low_page(pud); spin_lock(&init_mm.page_table_lock); @@ -25169,7 +25169,7 @@ index 2b6b4a3..c17210d 100644 spin_unlock(&init_mm.page_table_lock); pgd_changed = true; } -@@ -686,6 +700,12 @@ void __init mem_init(void) +@@ -691,6 +705,12 @@ void __init mem_init(void) pci_iommu_alloc(); @@ -25182,7 +25182,7 @@ index 2b6b4a3..c17210d 100644 /* clear_bss() already clear the empty_zero_page */ reservedpages = 0; -@@ -846,8 +866,8 @@ int kern_addr_valid(unsigned long addr) +@@ -851,8 +871,8 @@ int kern_addr_valid(unsigned long addr) static struct vm_area_struct gate_vma = { .vm_start = VSYSCALL_START, .vm_end = VSYSCALL_START + (VSYSCALL_MAPPED_PAGES * PAGE_SIZE), @@ -25193,7 +25193,7 @@ index 2b6b4a3..c17210d 100644 }; struct vm_area_struct *get_gate_vma(struct mm_struct *mm) -@@ -881,7 +901,7 @@ int in_gate_area_no_mm(unsigned long addr) +@@ -886,7 +906,7 @@ int in_gate_area_no_mm(unsigned long addr) const char *arch_vma_name(struct vm_area_struct *vma) { @@ -30813,7 +30813,7 @@ index 73fa3e1..ab2e9b9 100644 iir = I915_READ(IIR); diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c -index b634f6f..84bb8ba 100644 +index b634f6f..43c62f5 100644 --- a/drivers/gpu/drm/i915/intel_display.c +++ b/drivers/gpu/drm/i915/intel_display.c @@ -2182,7 +2182,7 @@ intel_finish_fb(struct drm_framebuffer *old_fb) @@ -30825,16 +30825,17 @@ index b634f6f..84bb8ba 100644 /* Big Hammer, we also need to ensure that any pending * MI_WAIT_FOR_EVENT inside a user batch buffer on the -@@ -6168,7 +6168,7 @@ static void do_intel_finish_page_flip(struct drm_device *dev, +@@ -6168,8 +6168,7 @@ static void do_intel_finish_page_flip(struct drm_device *dev, obj = work->old_fb_obj; - atomic_clear_mask(1 << intel_crtc->plane, -+ atomic_clear_mask_unchecked(1 << intel_crtc->plane, - &obj->pending_flip.counter); +- &obj->pending_flip.counter); ++ atomic_clear_mask_unchecked(1 << intel_crtc->plane, &obj->pending_flip); wake_up(&dev_priv->pending_flip_queue); -@@ -6515,7 +6515,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc, + schedule_work(&work->work); +@@ -6515,7 +6514,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc, /* Block clients from rendering to the new back buffer until * the flip occurs and the object is no longer visible. */ @@ -30843,7 +30844,7 @@ index b634f6f..84bb8ba 100644 ret = dev_priv->display.queue_flip(dev, crtc, fb, obj); if (ret) -@@ -6530,7 +6530,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc, +@@ -6530,7 +6529,7 @@ static int intel_crtc_page_flip(struct drm_crtc *crtc, return 0; cleanup_pending: @@ -31504,10 +31505,10 @@ index 14599e2..711c965 100644 for (i = 0; i < hid->maxcollection; i++) diff --git a/drivers/hv/channel.c b/drivers/hv/channel.c -index 4065374..10ed7dc 100644 +index f4c3d28..82f45a9 100644 --- a/drivers/hv/channel.c +++ b/drivers/hv/channel.c -@@ -400,8 +400,8 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer, +@@ -402,8 +402,8 @@ int vmbus_establish_gpadl(struct vmbus_channel *channel, void *kbuffer, int ret = 0; int t; @@ -44624,19 +44625,10 @@ index 112e45a..b59845b 100644 /* diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c -index debdfe0..75d31d4 100644 +index 5d2069f..75d31d4 100644 --- a/fs/compat_ioctl.c +++ b/fs/compat_ioctl.c -@@ -210,6 +210,8 @@ static int do_video_set_spu_palette(unsigned int fd, unsigned int cmd, - - err = get_user(palp, &up->palette); - err |= get_user(length, &up->length); -+ if (err) -+ return -EFAULT; - - up_native = compat_alloc_user_space(sizeof(struct video_spu_palette)); - err = put_user(compat_ptr(palp), &up_native->palette); -@@ -621,7 +623,7 @@ static int serial_struct_ioctl(unsigned fd, unsigned cmd, +@@ -623,7 +623,7 @@ static int serial_struct_ioctl(unsigned fd, unsigned cmd, return -EFAULT; if (__get_user(udata, &ss32->iomem_base)) return -EFAULT; @@ -44645,7 +44637,7 @@ index debdfe0..75d31d4 100644 if (__get_user(ss.iomem_reg_shift, &ss32->iomem_reg_shift) || __get_user(ss.port_high, &ss32->port_high)) return -EFAULT; -@@ -796,7 +798,7 @@ static int compat_ioctl_preallocate(struct file *file, +@@ -798,7 +798,7 @@ static int compat_ioctl_preallocate(struct file *file, copy_in_user(&p->l_len, &p32->l_len, sizeof(s64)) || copy_in_user(&p->l_sysid, &p32->l_sysid, sizeof(s32)) || copy_in_user(&p->l_pid, &p32->l_pid, sizeof(u32)) || @@ -44654,7 +44646,7 @@ index debdfe0..75d31d4 100644 return -EFAULT; return ioctl_preallocate(file, p); -@@ -1610,8 +1612,8 @@ asmlinkage long compat_sys_ioctl(unsigned int fd, unsigned int cmd, +@@ -1612,8 +1612,8 @@ asmlinkage long compat_sys_ioctl(unsigned int fd, unsigned int cmd, static int __init init_sys32_ioctl_cmp(const void *p, const void *q) { unsigned int a, b; @@ -44780,7 +44772,7 @@ index b2a34a1..162fa69 100644 return rc; } diff --git a/fs/exec.c b/fs/exec.c -index 574cf4d..dfe774a 100644 +index fab2c6d..4fa20c0 100644 --- a/fs/exec.c +++ b/fs/exec.c @@ -55,6 +55,15 @@ @@ -45050,7 +45042,7 @@ index 574cf4d..dfe774a 100644 set_fs(old_fs); return result; } -@@ -1257,7 +1296,7 @@ static int check_unsafe_exec(struct linux_binprm *bprm) +@@ -1258,7 +1297,7 @@ static int check_unsafe_exec(struct linux_binprm *bprm) } rcu_read_unlock(); @@ -45059,7 +45051,7 @@ index 574cf4d..dfe774a 100644 bprm->unsafe |= LSM_UNSAFE_SHARE; } else { res = -EAGAIN; -@@ -1460,6 +1499,28 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs) +@@ -1461,6 +1500,28 @@ int search_binary_handler(struct linux_binprm *bprm,struct pt_regs *regs) EXPORT_SYMBOL(search_binary_handler); @@ -45088,7 +45080,7 @@ index 574cf4d..dfe774a 100644 /* * sys_execve() executes a new program. */ -@@ -1468,6 +1529,11 @@ static int do_execve_common(const char *filename, +@@ -1469,6 +1530,11 @@ static int do_execve_common(const char *filename, struct user_arg_ptr envp, struct pt_regs *regs) { @@ -45100,7 +45092,7 @@ index 574cf4d..dfe774a 100644 struct linux_binprm *bprm; struct file *file; struct files_struct *displaced; -@@ -1475,6 +1541,8 @@ static int do_execve_common(const char *filename, +@@ -1476,6 +1542,8 @@ static int do_execve_common(const char *filename, int retval; const struct cred *cred = current_cred(); @@ -45109,7 +45101,7 @@ index 574cf4d..dfe774a 100644 /* * We move the actual failure in case of RLIMIT_NPROC excess from * set*uid() to execve() because too many poorly written programs -@@ -1515,12 +1583,27 @@ static int do_execve_common(const char *filename, +@@ -1516,12 +1584,27 @@ static int do_execve_common(const char *filename, if (IS_ERR(file)) goto out_unmark; @@ -45137,7 +45129,7 @@ index 574cf4d..dfe774a 100644 retval = bprm_mm_init(bprm); if (retval) goto out_file; -@@ -1537,24 +1620,65 @@ static int do_execve_common(const char *filename, +@@ -1538,24 +1621,65 @@ static int do_execve_common(const char *filename, if (retval < 0) goto out; @@ -45207,7 +45199,7 @@ index 574cf4d..dfe774a 100644 current->fs->in_exec = 0; current->in_execve = 0; acct_update_integrals(current); -@@ -1563,6 +1687,14 @@ static int do_execve_common(const char *filename, +@@ -1564,6 +1688,14 @@ static int do_execve_common(const char *filename, put_files_struct(displaced); return retval; @@ -45222,7 +45214,7 @@ index 574cf4d..dfe774a 100644 out: if (bprm->mm) { acct_arg_size(bprm, 0); -@@ -1636,7 +1768,7 @@ static int expand_corename(struct core_name *cn) +@@ -1637,7 +1769,7 @@ static int expand_corename(struct core_name *cn) { char *old_corename = cn->corename; @@ -45231,7 +45223,7 @@ index 574cf4d..dfe774a 100644 cn->corename = krealloc(old_corename, cn->size, GFP_KERNEL); if (!cn->corename) { -@@ -1733,7 +1865,7 @@ static int format_corename(struct core_name *cn, long signr) +@@ -1734,7 +1866,7 @@ static int format_corename(struct core_name *cn, long signr) int pid_in_pattern = 0; int err = 0; @@ -45240,7 +45232,7 @@ index 574cf4d..dfe774a 100644 cn->corename = kmalloc(cn->size, GFP_KERNEL); cn->used = 0; -@@ -1830,6 +1962,250 @@ out: +@@ -1831,6 +1963,250 @@ out: return ispipe; } @@ -45491,7 +45483,7 @@ index 574cf4d..dfe774a 100644 static int zap_process(struct task_struct *start, int exit_code) { struct task_struct *t; -@@ -2040,17 +2416,17 @@ static void wait_for_dump_helpers(struct file *file) +@@ -2041,17 +2417,17 @@ static void wait_for_dump_helpers(struct file *file) pipe = file->f_path.dentry->d_inode->i_pipe; pipe_lock(pipe); @@ -45514,7 +45506,7 @@ index 574cf4d..dfe774a 100644 pipe_unlock(pipe); } -@@ -2105,7 +2481,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs) +@@ -2106,7 +2482,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs) int flag = 0; int ispipe; bool need_nonrelative = false; @@ -45523,7 +45515,7 @@ index 574cf4d..dfe774a 100644 struct coredump_params cprm = { .signr = signr, .regs = regs, -@@ -2120,6 +2496,9 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs) +@@ -2121,6 +2497,9 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs) audit_core_dumps(signr); @@ -45533,7 +45525,7 @@ index 574cf4d..dfe774a 100644 binfmt = mm->binfmt; if (!binfmt || !binfmt->core_dump) goto fail; -@@ -2190,7 +2569,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs) +@@ -2191,7 +2570,7 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs) } cprm.limit = RLIM_INFINITY; @@ -45542,7 +45534,7 @@ index 574cf4d..dfe774a 100644 if (core_pipe_limit && (core_pipe_limit < dump_count)) { printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n", task_tgid_vnr(current), current->comm); -@@ -2217,6 +2596,8 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs) +@@ -2218,6 +2597,8 @@ void do_coredump(long signr, int exit_code, struct pt_regs *regs) } else { struct inode *inode; @@ -45551,7 +45543,7 @@ index 574cf4d..dfe774a 100644 if (cprm.limit < binfmt->min_coredump) goto fail_unlock; -@@ -2268,7 +2649,7 @@ close_fail: +@@ -2269,7 +2650,7 @@ close_fail: filp_close(cprm.file, NULL); fail_dropcount: if (ispipe) @@ -45560,7 +45552,7 @@ index 574cf4d..dfe774a 100644 fail_unlock: kfree(cn.corename); fail_corename: -@@ -2287,7 +2668,7 @@ fail: +@@ -2288,7 +2669,7 @@ fail: */ int dump_write(struct file *file, const void *addr, int nr) { @@ -47551,7 +47543,7 @@ index 7e81bfc..c3649aa 100644 lock_flocks(); diff --git a/fs/namei.c b/fs/namei.c -index 81bd546..80149d9 100644 +index 091c4b7..c6d7e26 100644 --- a/fs/namei.c +++ b/fs/namei.c @@ -265,16 +265,32 @@ int generic_permission(struct inode *inode, int mask) @@ -50292,7 +50284,7 @@ index 41514dd..6564a93 100644 pipe_unlock(ipipe); diff --git a/fs/sysfs/dir.c b/fs/sysfs/dir.c -index 6b0bb00..75db2fe 100644 +index 2fbdff6..5530a61 100644 --- a/fs/sysfs/dir.c +++ b/fs/sysfs/dir.c @@ -685,6 +685,18 @@ static int create_dir(struct kobject *kobj, struct sysfs_dirent *parent_sd, @@ -61439,10 +61431,10 @@ index 9c02a45..89fdd73 100644 unsigned int offset, size_t len); diff --git a/include/linux/efi.h b/include/linux/efi.h -index ec45ccd..9923c32 100644 +index 5782114..e9b1ba1 100644 --- a/include/linux/efi.h +++ b/include/linux/efi.h -@@ -635,7 +635,7 @@ struct efivar_operations { +@@ -640,7 +640,7 @@ struct efivar_operations { efi_get_variable_t *get_variable; efi_get_next_variable_t *get_next_variable; efi_set_variable_t *set_variable; @@ -66039,7 +66031,7 @@ index 84c6bf1..8899338 100644 next_state = Reset; return 0; diff --git a/init/main.c b/init/main.c -index b286730..9ff6135 100644 +index d61ec54..bd3144f 100644 --- a/init/main.c +++ b/init/main.c @@ -96,6 +96,8 @@ static inline void mark_rodata_ro(void) { } @@ -66113,7 +66105,7 @@ index b286730..9ff6135 100644 static const char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, }; const char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, }; static const char *panic_later, *panic_param; -@@ -675,6 +732,7 @@ int __init_or_module do_one_initcall(initcall_t fn) +@@ -678,6 +735,7 @@ int __init_or_module do_one_initcall(initcall_t fn) { int count = preempt_count(); int ret; @@ -66121,7 +66113,7 @@ index b286730..9ff6135 100644 if (initcall_debug) ret = do_one_initcall_debug(fn); -@@ -687,15 +745,15 @@ int __init_or_module do_one_initcall(initcall_t fn) +@@ -690,15 +748,15 @@ int __init_or_module do_one_initcall(initcall_t fn) sprintf(msgbuf, "error code %d ", ret); if (preempt_count() != count) { @@ -66141,7 +66133,7 @@ index b286730..9ff6135 100644 } return ret; -@@ -749,8 +807,14 @@ static void __init do_initcall_level(int level) +@@ -752,8 +810,14 @@ static void __init do_initcall_level(int level) level, level, &repair_env_string); @@ -66157,7 +66149,7 @@ index b286730..9ff6135 100644 } static void __init do_initcalls(void) -@@ -784,8 +848,14 @@ static void __init do_pre_smp_initcalls(void) +@@ -787,8 +851,14 @@ static void __init do_pre_smp_initcalls(void) { initcall_t *fn; @@ -66173,7 +66165,7 @@ index b286730..9ff6135 100644 } static void run_init_process(const char *init_filename) -@@ -867,7 +937,7 @@ static int __init kernel_init(void * unused) +@@ -870,7 +940,7 @@ static int __init kernel_init(void * unused) do_basic_setup(); /* Open the /dev/console on the rootfs, this should never fail */ @@ -66182,7 +66174,7 @@ index b286730..9ff6135 100644 printk(KERN_WARNING "Warning: unable to open an initial console.\n"); (void) sys_dup(0); -@@ -880,11 +950,13 @@ static int __init kernel_init(void * unused) +@@ -883,11 +953,13 @@ static int __init kernel_init(void * unused) if (!ramdisk_execute_command) ramdisk_execute_command = "/init"; @@ -72430,7 +72422,7 @@ index 5736170..8e04800 100644 return 0; } diff --git a/mm/mempolicy.c b/mm/mempolicy.c -index 3d64b36..dbab433 100644 +index 3d64b36..c6ab69c 100644 --- a/mm/mempolicy.c +++ b/mm/mempolicy.c @@ -655,6 +655,10 @@ static int mbind_range(struct mm_struct *mm, unsigned long start, @@ -72444,7 +72436,7 @@ index 3d64b36..dbab433 100644 vma = find_vma(mm, start); if (!vma || vma->vm_start > start) return -EFAULT; -@@ -691,9 +695,18 @@ static int mbind_range(struct mm_struct *mm, unsigned long start, +@@ -691,9 +695,20 @@ static int mbind_range(struct mm_struct *mm, unsigned long start, if (err) goto out; } @@ -72455,15 +72447,17 @@ index 3d64b36..dbab433 100644 + +#ifdef CONFIG_PAX_SEGMEXEC + vma_m = pax_find_mirror_vma(vma); -+ err = vma_replace_policy(vma_m, new_pol); -+ if (err) -+ goto out; ++ if (vma_m) { ++ err = vma_replace_policy(vma_m, new_pol); ++ if (err) ++ goto out; ++ } +#endif + } out: -@@ -1147,6 +1160,17 @@ static long do_mbind(unsigned long start, unsigned long len, +@@ -1147,6 +1162,17 @@ static long do_mbind(unsigned long start, unsigned long len, if (end < start) return -EINVAL; @@ -72481,7 +72475,7 @@ index 3d64b36..dbab433 100644 if (end == start) return 0; -@@ -1370,8 +1394,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode, +@@ -1370,8 +1396,7 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode, */ tcred = __task_cred(task); if (!uid_eq(cred->euid, tcred->suid) && !uid_eq(cred->euid, tcred->uid) && @@ -72491,7 +72485,7 @@ index 3d64b36..dbab433 100644 rcu_read_unlock(); err = -EPERM; goto out_put; -@@ -1402,6 +1425,15 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode, +@@ -1402,6 +1427,15 @@ SYSCALL_DEFINE4(migrate_pages, pid_t, pid, unsigned long, maxnode, goto out; } @@ -74365,10 +74359,10 @@ index 926b466..b23df53 100644 if (!mm || IS_ERR(mm)) { rc = IS_ERR(mm) ? PTR_ERR(mm) : -ESRCH; diff --git a/mm/rmap.c b/mm/rmap.c -index 0f3b7cd..c5652b6 100644 +index aa95e59..b681a63 100644 --- a/mm/rmap.c +++ b/mm/rmap.c -@@ -167,6 +167,10 @@ int anon_vma_prepare(struct vm_area_struct *vma) +@@ -168,6 +168,10 @@ int anon_vma_prepare(struct vm_area_struct *vma) struct anon_vma *anon_vma = vma->anon_vma; struct anon_vma_chain *avc; @@ -74379,7 +74373,7 @@ index 0f3b7cd..c5652b6 100644 might_sleep(); if (unlikely(!anon_vma)) { struct mm_struct *mm = vma->vm_mm; -@@ -176,6 +180,12 @@ int anon_vma_prepare(struct vm_area_struct *vma) +@@ -177,6 +181,12 @@ int anon_vma_prepare(struct vm_area_struct *vma) if (!avc) goto out_enomem; @@ -74392,7 +74386,7 @@ index 0f3b7cd..c5652b6 100644 anon_vma = find_mergeable_anon_vma(vma); allocated = NULL; if (!anon_vma) { -@@ -189,6 +199,18 @@ int anon_vma_prepare(struct vm_area_struct *vma) +@@ -190,6 +200,18 @@ int anon_vma_prepare(struct vm_area_struct *vma) /* page_table_lock to protect against threads */ spin_lock(&mm->page_table_lock); if (likely(!vma->anon_vma)) { @@ -74411,7 +74405,7 @@ index 0f3b7cd..c5652b6 100644 vma->anon_vma = anon_vma; anon_vma_chain_link(vma, avc, anon_vma); allocated = NULL; -@@ -199,12 +221,24 @@ int anon_vma_prepare(struct vm_area_struct *vma) +@@ -200,12 +222,24 @@ int anon_vma_prepare(struct vm_area_struct *vma) if (unlikely(allocated)) put_anon_vma(allocated); @@ -74436,7 +74430,7 @@ index 0f3b7cd..c5652b6 100644 anon_vma_chain_free(avc); out_enomem: return -ENOMEM; -@@ -240,7 +274,7 @@ static inline void unlock_anon_vma_root(struct anon_vma *root) +@@ -241,7 +275,7 @@ static inline void unlock_anon_vma_root(struct anon_vma *root) * Attach the anon_vmas from src to dst. * Returns 0 on success, -ENOMEM on failure. */ @@ -74445,7 +74439,7 @@ index 0f3b7cd..c5652b6 100644 { struct anon_vma_chain *avc, *pavc; struct anon_vma *root = NULL; -@@ -318,7 +352,7 @@ void anon_vma_moveto_tail(struct vm_area_struct *dst) +@@ -319,7 +353,7 @@ void anon_vma_moveto_tail(struct vm_area_struct *dst) * the corresponding VMA in the parent process is attached to. * Returns 0 on success, non-zero on failure. */ @@ -77901,7 +77895,7 @@ index bb61f77..3788d63 100644 /* number of interfaces with corresponding FIF_ flags */ int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll, diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c -index bfb57dc..77c4b81 100644 +index c93d395..a305570 100644 --- a/net/mac80211/iface.c +++ b/net/mac80211/iface.c @@ -454,7 +454,7 @@ static int ieee80211_do_open(struct net_device *dev, bool coming_up) @@ -78038,7 +78032,7 @@ index c97a065..ff61928 100644 return p; diff --git a/net/mac80211/util.c b/net/mac80211/util.c -index 39b82fe..5469ef4 100644 +index c9b52f7..4da1014 100644 --- a/net/mac80211/util.c +++ b/net/mac80211/util.c @@ -1251,7 +1251,7 @@ int ieee80211_reconfig(struct ieee80211_local *local) @@ -89442,32 +89436,6 @@ index 6789d78..4afd019e 100644 + .endm + #endif -diff --git a/usr/gen_init_cpio.c b/usr/gen_init_cpio.c -index af0f22f..9a7d479 100644 ---- a/usr/gen_init_cpio.c -+++ b/usr/gen_init_cpio.c -@@ -303,7 +303,7 @@ static int cpio_mkfile(const char *name, const char *location, - int retval; - int rc = -1; - int namesize; -- int i; -+ unsigned int i; - - mode |= S_IFREG; - -@@ -392,9 +392,10 @@ static char *cpio_replace_env(char *new_location) - *env_var = *expanded = '\0'; - strncat(env_var, start + 2, end - start - 2); - strncat(expanded, new_location, start - new_location); -- strncat(expanded, getenv(env_var), PATH_MAX); -- strncat(expanded, end + 1, PATH_MAX); -+ strncat(expanded, getenv(env_var), PATH_MAX - strlen(expanded)); -+ strncat(expanded, end + 1, PATH_MAX - strlen(expanded)); - strncpy(new_location, expanded, PATH_MAX); -+ new_location[PATH_MAX] = 0; - } else - break; - } diff --git a/virt/kvm/kvm_main.c b/virt/kvm/kvm_main.c index d617f69..6b445d2 100644 --- a/virt/kvm/kvm_main.c diff --git a/3.6.4/4430_grsec-remove-localversion-grsec.patch b/3.6.5/4430_grsec-remove-localversion-grsec.patch index 31cf878..31cf878 100644 --- a/3.6.4/4430_grsec-remove-localversion-grsec.patch +++ b/3.6.5/4430_grsec-remove-localversion-grsec.patch diff --git a/3.6.4/4435_grsec-mute-warnings.patch b/3.6.5/4435_grsec-mute-warnings.patch index e1a7a3c..e1a7a3c 100644 --- a/3.6.4/4435_grsec-mute-warnings.patch +++ b/3.6.5/4435_grsec-mute-warnings.patch diff --git a/3.6.4/4440_grsec-remove-protected-paths.patch b/3.6.5/4440_grsec-remove-protected-paths.patch index 637934a..637934a 100644 --- a/3.6.4/4440_grsec-remove-protected-paths.patch +++ b/3.6.5/4440_grsec-remove-protected-paths.patch diff --git a/3.6.4/4450_grsec-kconfig-default-gids.patch b/3.6.5/4450_grsec-kconfig-default-gids.patch index d4b0b7e..d4b0b7e 100644 --- a/3.6.4/4450_grsec-kconfig-default-gids.patch +++ b/3.6.5/4450_grsec-kconfig-default-gids.patch diff --git a/3.6.4/4465_selinux-avc_audit-log-curr_ip.patch b/3.6.5/4465_selinux-avc_audit-log-curr_ip.patch index 4fb50f4..4fb50f4 100644 --- a/3.6.4/4465_selinux-avc_audit-log-curr_ip.patch +++ b/3.6.5/4465_selinux-avc_audit-log-curr_ip.patch diff --git a/3.6.4/4470_disable-compat_vdso.patch b/3.6.5/4470_disable-compat_vdso.patch index 4a1947b..4a1947b 100644 --- a/3.6.4/4470_disable-compat_vdso.patch +++ b/3.6.5/4470_disable-compat_vdso.patch |