commit: 1ea8ec206bb391ba233e18afe4f1517e31cef49e Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Tue Jul 8 00:22:06 2014 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Tue Jul 8 00:22:06 2014 +0000 URL: http://git.overlays.gentoo.org/gitweb/?p=proj/linux-patches.git;a=commit;h=1ea8ec20
Linux patch 3.10.47 --- 0000_README | 4 + 1046_linux-3.10.47.patch | 1412 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 1416 insertions(+) diff --git a/0000_README b/0000_README index 6ec8c6d..3f75e5c 100644 --- a/0000_README +++ b/0000_README @@ -226,6 +226,10 @@ Patch: 1045_linux-3.10.46.patch From: http://www.kernel.org Desc: Linux 3.10.46 +Patch: 1046_linux-3.10.47.patch +From: http://www.kernel.org +Desc: Linux 3.10.47 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1046_linux-3.10.47.patch b/1046_linux-3.10.47.patch new file mode 100644 index 0000000..6bbab45 --- /dev/null +++ b/1046_linux-3.10.47.patch @@ -0,0 +1,1412 @@ +diff --git a/Documentation/SubmittingPatches b/Documentation/SubmittingPatches +index 6e97e73d87b5..4dbba7e100a1 100644 +--- a/Documentation/SubmittingPatches ++++ b/Documentation/SubmittingPatches +@@ -131,6 +131,20 @@ If you cannot condense your patch set into a smaller set of patches, + then only post say 15 or so at a time and wait for review and integration. + + ++If your patch fixes a bug in a specific commit, e.g. you found an issue using ++git-bisect, please use the 'Fixes:' tag with the first 12 characters of the ++SHA-1 ID, and the one line summary. ++Example: ++ ++ Fixes: e21d2170f366 ("video: remove unnecessary platform_set_drvdata()") ++ ++The following git-config settings can be used to add a pretty format for ++outputting the above style in the git log or git show commands ++ ++ [core] ++ abbrev = 12 ++ [pretty] ++ fixes = Fixes: %h (\"%s\") + + 4) Style check your changes. + +@@ -420,7 +434,7 @@ person it names. This tag documents that potentially interested parties + have been included in the discussion + + +-14) Using Reported-by:, Tested-by:, Reviewed-by: and Suggested-by: ++14) Using Reported-by:, Tested-by:, Reviewed-by:, Suggested-by: and Fixes: + + If this patch fixes a problem reported by somebody else, consider adding a + Reported-by: tag to credit the reporter for their contribution. Please +@@ -475,6 +489,12 @@ idea was not posted in a public forum. That said, if we diligently credit our + idea reporters, they will, hopefully, be inspired to help us again in the + future. + ++A Fixes: tag indicates that the patch fixes an issue in a previous commit. It ++is used to make it easy to determine where a bug originated, which can help ++review a bug fix. This tag also assists the stable kernel team in determining ++which stable kernel versions should receive your fix. This is the preferred ++method for indicating a bug fixed by the patch. See #2 above for more details. ++ + + 15) The canonical patch format + +diff --git a/Makefile b/Makefile +index c226f110181d..6a3b46d1863c 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 10 +-SUBLEVEL = 46 ++SUBLEVEL = 47 + EXTRAVERSION = + NAME = TOSSUG Baby Fish + +diff --git a/arch/mips/kernel/irq-msc01.c b/arch/mips/kernel/irq-msc01.c +index fab40f7d2e03..ac9facc08694 100644 +--- a/arch/mips/kernel/irq-msc01.c ++++ b/arch/mips/kernel/irq-msc01.c +@@ -131,7 +131,7 @@ void __init init_msc_irqs(unsigned long icubase, unsigned int irqbase, msc_irqma + + board_bind_eic_interrupt = &msc_bind_eic_interrupt; + +- for (; nirq >= 0; nirq--, imp++) { ++ for (; nirq > 0; nirq--, imp++) { + int n = imp->im_irq; + + switch (imp->im_type) { +diff --git a/arch/mips/kvm/kvm_mips.c b/arch/mips/kvm/kvm_mips.c +index 426345ac6f6e..2c7b3ade8ec0 100644 +--- a/arch/mips/kvm/kvm_mips.c ++++ b/arch/mips/kvm/kvm_mips.c +@@ -149,9 +149,7 @@ void kvm_mips_free_vcpus(struct kvm *kvm) + if (kvm->arch.guest_pmap[i] != KVM_INVALID_PAGE) + kvm_mips_release_pfn_clean(kvm->arch.guest_pmap[i]); + } +- +- if (kvm->arch.guest_pmap) +- kfree(kvm->arch.guest_pmap); ++ kfree(kvm->arch.guest_pmap); + + kvm_for_each_vcpu(i, vcpu, kvm) { + kvm_arch_vcpu_free(vcpu); +@@ -384,12 +382,9 @@ void kvm_arch_vcpu_free(struct kvm_vcpu *vcpu) + + kvm_mips_dump_stats(vcpu); + +- if (vcpu->arch.guest_ebase) +- kfree(vcpu->arch.guest_ebase); +- +- if (vcpu->arch.kseg0_commpage) +- kfree(vcpu->arch.kseg0_commpage); +- ++ kfree(vcpu->arch.guest_ebase); ++ kfree(vcpu->arch.kseg0_commpage); ++ kfree(vcpu); + } + + void kvm_arch_vcpu_destroy(struct kvm_vcpu *vcpu) +diff --git a/arch/powerpc/include/asm/systbl.h b/arch/powerpc/include/asm/systbl.h +index 43523fe0d8b4..05fcdd826829 100644 +--- a/arch/powerpc/include/asm/systbl.h ++++ b/arch/powerpc/include/asm/systbl.h +@@ -190,7 +190,7 @@ SYSCALL_SPU(getcwd) + SYSCALL_SPU(capget) + SYSCALL_SPU(capset) + COMPAT_SYS(sigaltstack) +-COMPAT_SYS_SPU(sendfile) ++SYSX_SPU(sys_sendfile64,compat_sys_sendfile,sys_sendfile) + SYSCALL(ni_syscall) + SYSCALL(ni_syscall) + PPC_SYS(vfork) +diff --git a/arch/powerpc/include/uapi/asm/cputable.h b/arch/powerpc/include/uapi/asm/cputable.h +index 5b7657959faa..de2c0e4ee1aa 100644 +--- a/arch/powerpc/include/uapi/asm/cputable.h ++++ b/arch/powerpc/include/uapi/asm/cputable.h +@@ -41,5 +41,6 @@ + #define PPC_FEATURE2_EBB 0x10000000 + #define PPC_FEATURE2_ISEL 0x08000000 + #define PPC_FEATURE2_TAR 0x04000000 ++#define PPC_FEATURE2_VEC_CRYPTO 0x02000000 + + #endif /* _UAPI__ASM_POWERPC_CPUTABLE_H */ +diff --git a/arch/powerpc/kernel/cputable.c b/arch/powerpc/kernel/cputable.c +index 2a45d0f04385..b2dc45522850 100644 +--- a/arch/powerpc/kernel/cputable.c ++++ b/arch/powerpc/kernel/cputable.c +@@ -105,7 +105,8 @@ extern void __restore_cpu_e6500(void); + PPC_FEATURE_PSERIES_PERFMON_COMPAT) + #define COMMON_USER2_POWER8 (PPC_FEATURE2_ARCH_2_07 | \ + PPC_FEATURE2_HTM_COMP | PPC_FEATURE2_DSCR | \ +- PPC_FEATURE2_ISEL | PPC_FEATURE2_TAR) ++ PPC_FEATURE2_ISEL | PPC_FEATURE2_TAR | \ ++ PPC_FEATURE2_VEC_CRYPTO) + #define COMMON_USER_PA6T (COMMON_USER_PPC64 | PPC_FEATURE_PA6T |\ + PPC_FEATURE_TRUE_LE | \ + PPC_FEATURE_HAS_ALTIVEC_COMP) +diff --git a/arch/powerpc/kernel/time.c b/arch/powerpc/kernel/time.c +index 5fc29ad7e26f..57fd5c1e8e89 100644 +--- a/arch/powerpc/kernel/time.c ++++ b/arch/powerpc/kernel/time.c +@@ -512,7 +512,7 @@ void timer_interrupt(struct pt_regs * regs) + + __get_cpu_var(irq_stat).timer_irqs++; + +-#if defined(CONFIG_PPC32) && defined(CONFIG_PMAC) ++#if defined(CONFIG_PPC32) && defined(CONFIG_PPC_PMAC) + if (atomic_read(&ppc_n_lost_interrupts) != 0) + do_IRQ(regs); + #endif +diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c +index e15c521846ca..08490ecc465e 100644 +--- a/arch/powerpc/lib/sstep.c ++++ b/arch/powerpc/lib/sstep.c +@@ -1395,7 +1395,7 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr) + regs->gpr[rd] = byterev_4(val); + goto ldst_done; + +-#ifdef CONFIG_PPC_CPU ++#ifdef CONFIG_PPC_FPU + case 535: /* lfsx */ + case 567: /* lfsux */ + if (!(regs->msr & MSR_FP)) +diff --git a/arch/powerpc/platforms/pseries/eeh_pseries.c b/arch/powerpc/platforms/pseries/eeh_pseries.c +index b456b157d33d..68f97d5a4679 100644 +--- a/arch/powerpc/platforms/pseries/eeh_pseries.c ++++ b/arch/powerpc/platforms/pseries/eeh_pseries.c +@@ -400,6 +400,7 @@ static int pseries_eeh_get_state(struct eeh_pe *pe, int *state) + } else { + result = EEH_STATE_NOT_SUPPORT; + } ++ break; + default: + result = EEH_STATE_NOT_SUPPORT; + } +diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h +index 942a08623a1a..68e9f007cd4a 100644 +--- a/arch/x86/include/asm/ptrace.h ++++ b/arch/x86/include/asm/ptrace.h +@@ -232,6 +232,22 @@ static inline unsigned long regs_get_kernel_stack_nth(struct pt_regs *regs, + + #define ARCH_HAS_USER_SINGLE_STEP_INFO + ++/* ++ * When hitting ptrace_stop(), we cannot return using SYSRET because ++ * that does not restore the full CPU state, only a minimal set. The ++ * ptracer can change arbitrary register values, which is usually okay ++ * because the usual ptrace stops run off the signal delivery path which ++ * forces IRET; however, ptrace_event() stops happen in arbitrary places ++ * in the kernel and don't force IRET path. ++ * ++ * So force IRET path after a ptrace stop. ++ */ ++#define arch_ptrace_stop_needed(code, info) \ ++({ \ ++ set_thread_flag(TIF_NOTIFY_RESUME); \ ++ false; \ ++}) ++ + struct user_desc; + extern int do_get_thread_area(struct task_struct *p, int idx, + struct user_desc __user *info); +diff --git a/drivers/block/mtip32xx/mtip32xx.c b/drivers/block/mtip32xx/mtip32xx.c +index 6e514583aa76..0d94e09221d9 100644 +--- a/drivers/block/mtip32xx/mtip32xx.c ++++ b/drivers/block/mtip32xx/mtip32xx.c +@@ -1493,6 +1493,37 @@ static inline void ata_swap_string(u16 *buf, unsigned int len) + be16_to_cpus(&buf[i]); + } + ++static void mtip_set_timeout(struct driver_data *dd, ++ struct host_to_dev_fis *fis, ++ unsigned int *timeout, u8 erasemode) ++{ ++ switch (fis->command) { ++ case ATA_CMD_DOWNLOAD_MICRO: ++ *timeout = 120000; /* 2 minutes */ ++ break; ++ case ATA_CMD_SEC_ERASE_UNIT: ++ case 0xFC: ++ if (erasemode) ++ *timeout = ((*(dd->port->identify + 90) * 2) * 60000); ++ else ++ *timeout = ((*(dd->port->identify + 89) * 2) * 60000); ++ break; ++ case ATA_CMD_STANDBYNOW1: ++ *timeout = 120000; /* 2 minutes */ ++ break; ++ case 0xF7: ++ case 0xFA: ++ *timeout = 60000; /* 60 seconds */ ++ break; ++ case ATA_CMD_SMART: ++ *timeout = 15000; /* 15 seconds */ ++ break; ++ default: ++ *timeout = MTIP_IOCTL_COMMAND_TIMEOUT_MS; ++ break; ++ } ++} ++ + /* + * Request the device identity information. + * +@@ -1602,6 +1633,7 @@ static int mtip_standby_immediate(struct mtip_port *port) + int rv; + struct host_to_dev_fis fis; + unsigned long start; ++ unsigned int timeout; + + /* Build the FIS. */ + memset(&fis, 0, sizeof(struct host_to_dev_fis)); +@@ -1609,6 +1641,8 @@ static int mtip_standby_immediate(struct mtip_port *port) + fis.opts = 1 << 7; + fis.command = ATA_CMD_STANDBYNOW1; + ++ mtip_set_timeout(port->dd, &fis, &timeout, 0); ++ + start = jiffies; + rv = mtip_exec_internal_command(port, + &fis, +@@ -1617,7 +1651,7 @@ static int mtip_standby_immediate(struct mtip_port *port) + 0, + 0, + GFP_ATOMIC, +- 15000); ++ timeout); + dbg_printk(MTIP_DRV_NAME "Time taken to complete standby cmd: %d ms\n", + jiffies_to_msecs(jiffies - start)); + if (rv) +@@ -2156,36 +2190,6 @@ static unsigned int implicit_sector(unsigned char command, + } + return rv; + } +-static void mtip_set_timeout(struct driver_data *dd, +- struct host_to_dev_fis *fis, +- unsigned int *timeout, u8 erasemode) +-{ +- switch (fis->command) { +- case ATA_CMD_DOWNLOAD_MICRO: +- *timeout = 120000; /* 2 minutes */ +- break; +- case ATA_CMD_SEC_ERASE_UNIT: +- case 0xFC: +- if (erasemode) +- *timeout = ((*(dd->port->identify + 90) * 2) * 60000); +- else +- *timeout = ((*(dd->port->identify + 89) * 2) * 60000); +- break; +- case ATA_CMD_STANDBYNOW1: +- *timeout = 120000; /* 2 minutes */ +- break; +- case 0xF7: +- case 0xFA: +- *timeout = 60000; /* 60 seconds */ +- break; +- case ATA_CMD_SMART: +- *timeout = 15000; /* 15 seconds */ +- break; +- default: +- *timeout = MTIP_IOCTL_COMMAND_TIMEOUT_MS; +- break; +- } +-} + + /* + * Executes a taskfile +@@ -4284,6 +4288,57 @@ static DEFINE_HANDLER(5); + static DEFINE_HANDLER(6); + static DEFINE_HANDLER(7); + ++static void mtip_disable_link_opts(struct driver_data *dd, struct pci_dev *pdev) ++{ ++ int pos; ++ unsigned short pcie_dev_ctrl; ++ ++ pos = pci_find_capability(pdev, PCI_CAP_ID_EXP); ++ if (pos) { ++ pci_read_config_word(pdev, ++ pos + PCI_EXP_DEVCTL, ++ &pcie_dev_ctrl); ++ if (pcie_dev_ctrl & (1 << 11) || ++ pcie_dev_ctrl & (1 << 4)) { ++ dev_info(&dd->pdev->dev, ++ "Disabling ERO/No-Snoop on bridge device %04x:%04x\n", ++ pdev->vendor, pdev->device); ++ pcie_dev_ctrl &= ~(PCI_EXP_DEVCTL_NOSNOOP_EN | ++ PCI_EXP_DEVCTL_RELAX_EN); ++ pci_write_config_word(pdev, ++ pos + PCI_EXP_DEVCTL, ++ pcie_dev_ctrl); ++ } ++ } ++} ++ ++static void mtip_fix_ero_nosnoop(struct driver_data *dd, struct pci_dev *pdev) ++{ ++ /* ++ * This workaround is specific to AMD/ATI chipset with a PCI upstream ++ * device with device id 0x5aXX ++ */ ++ if (pdev->bus && pdev->bus->self) { ++ if (pdev->bus->self->vendor == PCI_VENDOR_ID_ATI && ++ ((pdev->bus->self->device & 0xff00) == 0x5a00)) { ++ mtip_disable_link_opts(dd, pdev->bus->self); ++ } else { ++ /* Check further up the topology */ ++ struct pci_dev *parent_dev = pdev->bus->self; ++ if (parent_dev->bus && ++ parent_dev->bus->parent && ++ parent_dev->bus->parent->self && ++ parent_dev->bus->parent->self->vendor == ++ PCI_VENDOR_ID_ATI && ++ (parent_dev->bus->parent->self->device & ++ 0xff00) == 0x5a00) { ++ mtip_disable_link_opts(dd, ++ parent_dev->bus->parent->self); ++ } ++ } ++ } ++} ++ + /* + * Called for each supported PCI device detected. + * +@@ -4435,6 +4490,8 @@ static int mtip_pci_probe(struct pci_dev *pdev, + goto block_initialize_err; + } + ++ mtip_fix_ero_nosnoop(dd, pdev); ++ + /* Initialize the block layer. */ + rv = mtip_block_initialize(dd); + if (rv < 0) { +@@ -4727,13 +4784,13 @@ static int __init mtip_init(void) + */ + static void __exit mtip_exit(void) + { +- debugfs_remove_recursive(dfs_parent); +- + /* Release the allocated major block device number. */ + unregister_blkdev(mtip_major, MTIP_DRV_NAME); + + /* Unregister the PCI driver. */ + pci_unregister_driver(&mtip_pci_driver); ++ ++ debugfs_remove_recursive(dfs_parent); + } + + MODULE_AUTHOR("Micron Technology, Inc"); +diff --git a/drivers/extcon/extcon-max77693.c b/drivers/extcon/extcon-max77693.c +index b56bdaa27d4b..9966fc0a527f 100644 +--- a/drivers/extcon/extcon-max77693.c ++++ b/drivers/extcon/extcon-max77693.c +@@ -1180,7 +1180,7 @@ static int max77693_muic_probe(struct platform_device *pdev) + + + /* Initialize MUIC register by using platform data or default data */ +- if (pdata->muic_data) { ++ if (pdata && pdata->muic_data) { + init_data = pdata->muic_data->init_data; + num_init_data = pdata->muic_data->num_init_data; + } else { +@@ -1213,7 +1213,7 @@ static int max77693_muic_probe(struct platform_device *pdev) + = init_data[i].data; + } + +- if (pdata->muic_data) { ++ if (pdata && pdata->muic_data) { + struct max77693_muic_platform_data *muic_pdata = pdata->muic_data; + + /* +diff --git a/drivers/infiniband/core/user_mad.c b/drivers/infiniband/core/user_mad.c +index f0d588f8859e..1acb99100556 100644 +--- a/drivers/infiniband/core/user_mad.c ++++ b/drivers/infiniband/core/user_mad.c +@@ -98,7 +98,7 @@ struct ib_umad_port { + + struct ib_umad_device { + int start_port, end_port; +- struct kref ref; ++ struct kobject kobj; + struct ib_umad_port port[0]; + }; + +@@ -134,14 +134,18 @@ static DECLARE_BITMAP(dev_map, IB_UMAD_MAX_PORTS); + static void ib_umad_add_one(struct ib_device *device); + static void ib_umad_remove_one(struct ib_device *device); + +-static void ib_umad_release_dev(struct kref *ref) ++static void ib_umad_release_dev(struct kobject *kobj) + { + struct ib_umad_device *dev = +- container_of(ref, struct ib_umad_device, ref); ++ container_of(kobj, struct ib_umad_device, kobj); + + kfree(dev); + } + ++static struct kobj_type ib_umad_dev_ktype = { ++ .release = ib_umad_release_dev, ++}; ++ + static int hdr_size(struct ib_umad_file *file) + { + return file->use_pkey_index ? sizeof (struct ib_user_mad_hdr) : +@@ -780,27 +784,19 @@ static int ib_umad_open(struct inode *inode, struct file *filp) + { + struct ib_umad_port *port; + struct ib_umad_file *file; +- int ret; ++ int ret = -ENXIO; + + port = container_of(inode->i_cdev, struct ib_umad_port, cdev); +- if (port) +- kref_get(&port->umad_dev->ref); +- else +- return -ENXIO; + + mutex_lock(&port->file_mutex); + +- if (!port->ib_dev) { +- ret = -ENXIO; ++ if (!port->ib_dev) + goto out; +- } + ++ ret = -ENOMEM; + file = kzalloc(sizeof *file, GFP_KERNEL); +- if (!file) { +- kref_put(&port->umad_dev->ref, ib_umad_release_dev); +- ret = -ENOMEM; ++ if (!file) + goto out; +- } + + mutex_init(&file->mutex); + spin_lock_init(&file->send_lock); +@@ -814,6 +810,13 @@ static int ib_umad_open(struct inode *inode, struct file *filp) + list_add_tail(&file->port_list, &port->file_list); + + ret = nonseekable_open(inode, filp); ++ if (ret) { ++ list_del(&file->port_list); ++ kfree(file); ++ goto out; ++ } ++ ++ kobject_get(&port->umad_dev->kobj); + + out: + mutex_unlock(&port->file_mutex); +@@ -852,7 +855,7 @@ static int ib_umad_close(struct inode *inode, struct file *filp) + mutex_unlock(&file->port->file_mutex); + + kfree(file); +- kref_put(&dev->ref, ib_umad_release_dev); ++ kobject_put(&dev->kobj); + + return 0; + } +@@ -880,10 +883,6 @@ static int ib_umad_sm_open(struct inode *inode, struct file *filp) + int ret; + + port = container_of(inode->i_cdev, struct ib_umad_port, sm_cdev); +- if (port) +- kref_get(&port->umad_dev->ref); +- else +- return -ENXIO; + + if (filp->f_flags & O_NONBLOCK) { + if (down_trylock(&port->sm_sem)) { +@@ -898,17 +897,27 @@ static int ib_umad_sm_open(struct inode *inode, struct file *filp) + } + + ret = ib_modify_port(port->ib_dev, port->port_num, 0, &props); +- if (ret) { +- up(&port->sm_sem); +- goto fail; +- } ++ if (ret) ++ goto err_up_sem; + + filp->private_data = port; + +- return nonseekable_open(inode, filp); ++ ret = nonseekable_open(inode, filp); ++ if (ret) ++ goto err_clr_sm_cap; ++ ++ kobject_get(&port->umad_dev->kobj); ++ ++ return 0; ++ ++err_clr_sm_cap: ++ swap(props.set_port_cap_mask, props.clr_port_cap_mask); ++ ib_modify_port(port->ib_dev, port->port_num, 0, &props); ++ ++err_up_sem: ++ up(&port->sm_sem); + + fail: +- kref_put(&port->umad_dev->ref, ib_umad_release_dev); + return ret; + } + +@@ -927,7 +936,7 @@ static int ib_umad_sm_close(struct inode *inode, struct file *filp) + + up(&port->sm_sem); + +- kref_put(&port->umad_dev->ref, ib_umad_release_dev); ++ kobject_put(&port->umad_dev->kobj); + + return ret; + } +@@ -995,6 +1004,7 @@ static int find_overflow_devnum(void) + } + + static int ib_umad_init_port(struct ib_device *device, int port_num, ++ struct ib_umad_device *umad_dev, + struct ib_umad_port *port) + { + int devnum; +@@ -1027,6 +1037,7 @@ static int ib_umad_init_port(struct ib_device *device, int port_num, + + cdev_init(&port->cdev, &umad_fops); + port->cdev.owner = THIS_MODULE; ++ port->cdev.kobj.parent = &umad_dev->kobj; + kobject_set_name(&port->cdev.kobj, "umad%d", port->dev_num); + if (cdev_add(&port->cdev, base, 1)) + goto err_cdev; +@@ -1045,6 +1056,7 @@ static int ib_umad_init_port(struct ib_device *device, int port_num, + base += IB_UMAD_MAX_PORTS; + cdev_init(&port->sm_cdev, &umad_sm_fops); + port->sm_cdev.owner = THIS_MODULE; ++ port->sm_cdev.kobj.parent = &umad_dev->kobj; + kobject_set_name(&port->sm_cdev.kobj, "issm%d", port->dev_num); + if (cdev_add(&port->sm_cdev, base, 1)) + goto err_sm_cdev; +@@ -1138,7 +1150,7 @@ static void ib_umad_add_one(struct ib_device *device) + if (!umad_dev) + return; + +- kref_init(&umad_dev->ref); ++ kobject_init(&umad_dev->kobj, &ib_umad_dev_ktype); + + umad_dev->start_port = s; + umad_dev->end_port = e; +@@ -1146,7 +1158,8 @@ static void ib_umad_add_one(struct ib_device *device) + for (i = s; i <= e; ++i) { + umad_dev->port[i - s].umad_dev = umad_dev; + +- if (ib_umad_init_port(device, i, &umad_dev->port[i - s])) ++ if (ib_umad_init_port(device, i, umad_dev, ++ &umad_dev->port[i - s])) + goto err; + } + +@@ -1158,7 +1171,7 @@ err: + while (--i >= s) + ib_umad_kill_port(&umad_dev->port[i - s]); + +- kref_put(&umad_dev->ref, ib_umad_release_dev); ++ kobject_put(&umad_dev->kobj); + } + + static void ib_umad_remove_one(struct ib_device *device) +@@ -1172,7 +1185,7 @@ static void ib_umad_remove_one(struct ib_device *device) + for (i = 0; i <= umad_dev->end_port - umad_dev->start_port; ++i) + ib_umad_kill_port(&umad_dev->port[i]); + +- kref_put(&umad_dev->ref, ib_umad_release_dev); ++ kobject_put(&umad_dev->kobj); + } + + static char *umad_devnode(struct device *dev, umode_t *mode) +diff --git a/drivers/infiniband/hw/ipath/ipath_diag.c b/drivers/infiniband/hw/ipath/ipath_diag.c +index e2f9a51f4a38..45802e97332e 100644 +--- a/drivers/infiniband/hw/ipath/ipath_diag.c ++++ b/drivers/infiniband/hw/ipath/ipath_diag.c +@@ -346,6 +346,10 @@ static ssize_t ipath_diagpkt_write(struct file *fp, + ret = -EFAULT; + goto bail; + } ++ dp.len = odp.len; ++ dp.unit = odp.unit; ++ dp.data = odp.data; ++ dp.pbc_wd = 0; + } else { + ret = -EINVAL; + goto bail; +diff --git a/drivers/infiniband/hw/qib/qib_mad.c b/drivers/infiniband/hw/qib/qib_mad.c +index ccb119143d20..1dd9fcbb7c9a 100644 +--- a/drivers/infiniband/hw/qib/qib_mad.c ++++ b/drivers/infiniband/hw/qib/qib_mad.c +@@ -1028,7 +1028,7 @@ static int set_pkeys(struct qib_devdata *dd, u8 port, u16 *pkeys) + + event.event = IB_EVENT_PKEY_CHANGE; + event.device = &dd->verbs_dev.ibdev; +- event.element.port_num = 1; ++ event.element.port_num = port; + ib_dispatch_event(&event); + } + return 0; +diff --git a/drivers/infiniband/ulp/srp/ib_srp.c b/drivers/infiniband/ulp/srp/ib_srp.c +index 793ac5dcee71..1954daac0b59 100644 +--- a/drivers/infiniband/ulp/srp/ib_srp.c ++++ b/drivers/infiniband/ulp/srp/ib_srp.c +@@ -1409,6 +1409,12 @@ err_unmap: + err_iu: + srp_put_tx_iu(target, iu, SRP_IU_CMD); + ++ /* ++ * Avoid that the loops that iterate over the request ring can ++ * encounter a dangling SCSI command pointer. ++ */ ++ req->scmnd = NULL; ++ + spin_lock_irqsave(&target->lock, flags); + list_add(&req->list, &target->free_reqs); + +diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c +index 76f1d37ac0ff..1913301df08f 100644 +--- a/drivers/input/mouse/elantech.c ++++ b/drivers/input/mouse/elantech.c +@@ -473,8 +473,15 @@ static void elantech_report_absolute_v3(struct psmouse *psmouse, + input_report_key(dev, BTN_TOOL_FINGER, fingers == 1); + input_report_key(dev, BTN_TOOL_DOUBLETAP, fingers == 2); + input_report_key(dev, BTN_TOOL_TRIPLETAP, fingers == 3); +- input_report_key(dev, BTN_LEFT, packet[0] & 0x01); +- input_report_key(dev, BTN_RIGHT, packet[0] & 0x02); ++ ++ /* For clickpads map both buttons to BTN_LEFT */ ++ if (etd->fw_version & 0x001000) { ++ input_report_key(dev, BTN_LEFT, packet[0] & 0x03); ++ } else { ++ input_report_key(dev, BTN_LEFT, packet[0] & 0x01); ++ input_report_key(dev, BTN_RIGHT, packet[0] & 0x02); ++ } ++ + input_report_abs(dev, ABS_PRESSURE, pres); + input_report_abs(dev, ABS_TOOL_WIDTH, width); + +@@ -484,10 +491,17 @@ static void elantech_report_absolute_v3(struct psmouse *psmouse, + static void elantech_input_sync_v4(struct psmouse *psmouse) + { + struct input_dev *dev = psmouse->dev; ++ struct elantech_data *etd = psmouse->private; + unsigned char *packet = psmouse->packet; + +- input_report_key(dev, BTN_LEFT, packet[0] & 0x01); +- input_report_key(dev, BTN_RIGHT, packet[0] & 0x02); ++ /* For clickpads map both buttons to BTN_LEFT */ ++ if (etd->fw_version & 0x001000) { ++ input_report_key(dev, BTN_LEFT, packet[0] & 0x03); ++ } else { ++ input_report_key(dev, BTN_LEFT, packet[0] & 0x01); ++ input_report_key(dev, BTN_RIGHT, packet[0] & 0x02); ++ } ++ + input_mt_report_pointer_emulation(dev, true); + input_sync(dev); + } +@@ -805,7 +819,7 @@ static int elantech_set_absolute_mode(struct psmouse *psmouse) + if (etd->set_hw_resolution) + etd->reg_10 = 0x0b; + else +- etd->reg_10 = 0x03; ++ etd->reg_10 = 0x01; + + if (elantech_write_reg(psmouse, 0x10, etd->reg_10)) + rc = -1; +@@ -1306,7 +1320,8 @@ static int elantech_reconnect(struct psmouse *psmouse) + } + + /* +- * Some hw_version 3 models go into error state when we try to set bit 3 of r10 ++ * Some hw_version 3 models go into error state when we try to set ++ * bit 3 and/or bit 1 of r10. + */ + static const struct dmi_system_id no_hw_res_dmi_table[] = { + #if defined(CONFIG_DMI) && defined(CONFIG_X86) +diff --git a/drivers/misc/mei/hw-me.c b/drivers/misc/mei/hw-me.c +index 06311c5ada36..297cc10a26da 100644 +--- a/drivers/misc/mei/hw-me.c ++++ b/drivers/misc/mei/hw-me.c +@@ -164,6 +164,9 @@ static void mei_me_hw_reset_release(struct mei_device *dev) + hcsr |= H_IG; + hcsr &= ~H_RST; + mei_hcsr_set(hw, hcsr); ++ ++ /* complete this write before we set host ready on another CPU */ ++ mmiowb(); + } + /** + * mei_me_hw_reset - resets fw via mei csr register. +@@ -186,7 +189,19 @@ static void mei_me_hw_reset(struct mei_device *dev, bool intr_enable) + dev->recvd_hw_ready = false; + mei_me_reg_write(hw, H_CSR, hcsr); + +- if (dev->dev_state == MEI_DEV_POWER_DOWN) ++ /* ++ * Host reads the H_CSR once to ensure that the ++ * posted write to H_CSR completes. ++ */ ++ hcsr = mei_hcsr_read(hw); ++ ++ if ((hcsr & H_RST) == 0) ++ dev_warn(&dev->pdev->dev, "H_RST is not set = 0x%08X", hcsr); ++ ++ if ((hcsr & H_RDY) == H_RDY) ++ dev_warn(&dev->pdev->dev, "H_RDY is not cleared 0x%08X", hcsr); ++ ++ if (intr_enable == false) + mei_me_hw_reset_release(dev); + + dev_dbg(&dev->pdev->dev, "current HCSR = 0x%08x.\n", mei_hcsr_read(hw)); +@@ -202,6 +217,7 @@ static void mei_me_hw_reset(struct mei_device *dev, bool intr_enable) + static void mei_me_host_set_ready(struct mei_device *dev) + { + struct mei_me_hw *hw = to_me_hw(dev); ++ hw->host_hw_state = mei_hcsr_read(hw); + hw->host_hw_state |= H_IE | H_IG | H_RDY; + mei_hcsr_set(hw, hw->host_hw_state); + } +@@ -494,19 +510,15 @@ irqreturn_t mei_me_irq_thread_handler(int irq, void *dev_id) + /* check if we need to start the dev */ + if (!mei_host_is_ready(dev)) { + if (mei_hw_is_ready(dev)) { ++ mei_me_hw_reset_release(dev); + dev_dbg(&dev->pdev->dev, "we need to start the dev.\n"); + + dev->recvd_hw_ready = true; + wake_up_interruptible(&dev->wait_hw_ready); +- +- mutex_unlock(&dev->device_lock); +- return IRQ_HANDLED; + } else { +- dev_dbg(&dev->pdev->dev, "Reset Completed.\n"); +- mei_me_hw_reset_release(dev); +- mutex_unlock(&dev->device_lock); +- return IRQ_HANDLED; ++ dev_dbg(&dev->pdev->dev, "Spurious Interrupt\n"); + } ++ goto end; + } + /* check slots available for reading */ + slots = mei_count_full_read_slots(dev); +diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c +index f30acaa84037..d6ceb2e45c59 100644 +--- a/drivers/pci/pci.c ++++ b/drivers/pci/pci.c +@@ -3659,7 +3659,7 @@ int pci_set_vga_state(struct pci_dev *dev, bool decode, + u16 cmd; + int rc; + +- WARN_ON((flags & PCI_VGA_STATE_CHANGE_DECODES) & (command_bits & ~(PCI_COMMAND_IO|PCI_COMMAND_MEMORY))); ++ WARN_ON((flags & PCI_VGA_STATE_CHANGE_DECODES) && (command_bits & ~(PCI_COMMAND_IO|PCI_COMMAND_MEMORY))); + + /* ARCH specific VGA enables */ + rc = pci_set_vga_state_arch(dev, decode, command_bits, flags); +diff --git a/drivers/pci/quirks.c b/drivers/pci/quirks.c +index df4655c5c138..4510279e28dc 100644 +--- a/drivers/pci/quirks.c ++++ b/drivers/pci/quirks.c +@@ -2930,6 +2930,7 @@ static void disable_igfx_irq(struct pci_dev *dev) + } + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0102, disable_igfx_irq); + DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x010a, disable_igfx_irq); ++DECLARE_PCI_FIXUP_FINAL(PCI_VENDOR_ID_INTEL, 0x0152, disable_igfx_irq); + + /* + * Some devices may pass our check in pci_intx_mask_supported if +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index 72663ba228dc..799f84e686b5 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -1313,7 +1313,7 @@ iscsit_check_dataout_hdr(struct iscsi_conn *conn, unsigned char *buf, + if (cmd->data_direction != DMA_TO_DEVICE) { + pr_err("Command ITT: 0x%08x received DataOUT for a" + " NON-WRITE command.\n", cmd->init_task_tag); +- return iscsit_reject_cmd(cmd, ISCSI_REASON_PROTOCOL_ERROR, buf); ++ return iscsit_dump_data_payload(conn, payload_length, 1); + } + se_cmd = &cmd->se_cmd; + iscsit_mod_dataout_timer(cmd); +diff --git a/drivers/target/iscsi/iscsi_target_util.c b/drivers/target/iscsi/iscsi_target_util.c +index 77dad2474c8c..c9790f6fdd89 100644 +--- a/drivers/target/iscsi/iscsi_target_util.c ++++ b/drivers/target/iscsi/iscsi_target_util.c +@@ -1288,6 +1288,8 @@ int iscsit_tx_login_rsp(struct iscsi_conn *conn, u8 status_class, u8 status_deta + login->login_failed = 1; + iscsit_collect_login_stats(conn, status_class, status_detail); + ++ memset(&login->rsp[0], 0, ISCSI_HDR_LEN); ++ + hdr = (struct iscsi_login_rsp *)&login->rsp[0]; + hdr->opcode = ISCSI_OP_LOGIN_RSP; + hdr->status_class = status_class; +diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c +index 8032917b6636..68398753eb82 100644 +--- a/drivers/target/target_core_device.c ++++ b/drivers/target/target_core_device.c +@@ -614,6 +614,7 @@ void core_dev_unexport( + dev->export_count--; + spin_unlock(&hba->device_lock); + ++ lun->lun_sep = NULL; + lun->lun_se_dev = NULL; + } + +diff --git a/drivers/watchdog/ath79_wdt.c b/drivers/watchdog/ath79_wdt.c +index 37cb09b27b63..c97a47ca8971 100644 +--- a/drivers/watchdog/ath79_wdt.c ++++ b/drivers/watchdog/ath79_wdt.c +@@ -20,6 +20,7 @@ + #define pr_fmt(fmt) KBUILD_MODNAME ": " fmt + + #include <linux/bitops.h> ++#include <linux/delay.h> + #include <linux/errno.h> + #include <linux/fs.h> + #include <linux/init.h> +@@ -91,6 +92,15 @@ static inline void ath79_wdt_keepalive(void) + static inline void ath79_wdt_enable(void) + { + ath79_wdt_keepalive(); ++ ++ /* ++ * Updating the TIMER register requires a few microseconds ++ * on the AR934x SoCs at least. Use a small delay to ensure ++ * that the TIMER register is updated within the hardware ++ * before enabling the watchdog. ++ */ ++ udelay(2); ++ + ath79_wdt_wr(WDOG_REG_CTRL, WDOG_CTRL_ACTION_FCR); + /* flush write */ + ath79_wdt_rr(WDOG_REG_CTRL); +diff --git a/drivers/watchdog/sp805_wdt.c b/drivers/watchdog/sp805_wdt.c +index 8872642505c0..e42118213ba5 100644 +--- a/drivers/watchdog/sp805_wdt.c ++++ b/drivers/watchdog/sp805_wdt.c +@@ -60,7 +60,6 @@ + * @adev: amba device structure of wdt + * @status: current status of wdt + * @load_val: load value to be set for current timeout +- * @timeout: current programmed timeout + */ + struct sp805_wdt { + struct watchdog_device wdd; +@@ -69,7 +68,6 @@ struct sp805_wdt { + struct clk *clk; + struct amba_device *adev; + unsigned int load_val; +- unsigned int timeout; + }; + + static bool nowayout = WATCHDOG_NOWAYOUT; +@@ -99,7 +97,7 @@ static int wdt_setload(struct watchdog_device *wdd, unsigned int timeout) + spin_lock(&wdt->lock); + wdt->load_val = load; + /* roundup timeout to closest positive integer value */ +- wdt->timeout = div_u64((load + 1) * 2 + (rate / 2), rate); ++ wdd->timeout = div_u64((load + 1) * 2 + (rate / 2), rate); + spin_unlock(&wdt->lock); + + return 0; +diff --git a/fs/nfs/inode.c b/fs/nfs/inode.c +index c1c7a9d78722..cd4b9073dd20 100644 +--- a/fs/nfs/inode.c ++++ b/fs/nfs/inode.c +@@ -1382,18 +1382,20 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr) + inode->i_version = fattr->change_attr; + } + } else if (server->caps & NFS_CAP_CHANGE_ATTR) +- invalid |= save_cache_validity; ++ nfsi->cache_validity |= save_cache_validity; + + if (fattr->valid & NFS_ATTR_FATTR_MTIME) { + memcpy(&inode->i_mtime, &fattr->mtime, sizeof(inode->i_mtime)); + } else if (server->caps & NFS_CAP_MTIME) +- invalid |= save_cache_validity & (NFS_INO_INVALID_ATTR ++ nfsi->cache_validity |= save_cache_validity & ++ (NFS_INO_INVALID_ATTR + | NFS_INO_REVAL_FORCED); + + if (fattr->valid & NFS_ATTR_FATTR_CTIME) { + memcpy(&inode->i_ctime, &fattr->ctime, sizeof(inode->i_ctime)); + } else if (server->caps & NFS_CAP_CTIME) +- invalid |= save_cache_validity & (NFS_INO_INVALID_ATTR ++ nfsi->cache_validity |= save_cache_validity & ++ (NFS_INO_INVALID_ATTR + | NFS_INO_REVAL_FORCED); + + /* Check if our cached file size is stale */ +@@ -1416,7 +1418,8 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr) + (long long)new_isize); + } + } else +- invalid |= save_cache_validity & (NFS_INO_INVALID_ATTR ++ nfsi->cache_validity |= save_cache_validity & ++ (NFS_INO_INVALID_ATTR + | NFS_INO_REVAL_PAGECACHE + | NFS_INO_REVAL_FORCED); + +@@ -1424,7 +1427,8 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr) + if (fattr->valid & NFS_ATTR_FATTR_ATIME) + memcpy(&inode->i_atime, &fattr->atime, sizeof(inode->i_atime)); + else if (server->caps & NFS_CAP_ATIME) +- invalid |= save_cache_validity & (NFS_INO_INVALID_ATIME ++ nfsi->cache_validity |= save_cache_validity & ++ (NFS_INO_INVALID_ATIME + | NFS_INO_REVAL_FORCED); + + if (fattr->valid & NFS_ATTR_FATTR_MODE) { +@@ -1435,7 +1439,8 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr) + invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL; + } + } else if (server->caps & NFS_CAP_MODE) +- invalid |= save_cache_validity & (NFS_INO_INVALID_ATTR ++ nfsi->cache_validity |= save_cache_validity & ++ (NFS_INO_INVALID_ATTR + | NFS_INO_INVALID_ACCESS + | NFS_INO_INVALID_ACL + | NFS_INO_REVAL_FORCED); +@@ -1446,7 +1451,8 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr) + inode->i_uid = fattr->uid; + } + } else if (server->caps & NFS_CAP_OWNER) +- invalid |= save_cache_validity & (NFS_INO_INVALID_ATTR ++ nfsi->cache_validity |= save_cache_validity & ++ (NFS_INO_INVALID_ATTR + | NFS_INO_INVALID_ACCESS + | NFS_INO_INVALID_ACL + | NFS_INO_REVAL_FORCED); +@@ -1457,7 +1463,8 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr) + inode->i_gid = fattr->gid; + } + } else if (server->caps & NFS_CAP_OWNER_GROUP) +- invalid |= save_cache_validity & (NFS_INO_INVALID_ATTR ++ nfsi->cache_validity |= save_cache_validity & ++ (NFS_INO_INVALID_ATTR + | NFS_INO_INVALID_ACCESS + | NFS_INO_INVALID_ACL + | NFS_INO_REVAL_FORCED); +@@ -1470,7 +1477,8 @@ static int nfs_update_inode(struct inode *inode, struct nfs_fattr *fattr) + set_nlink(inode, fattr->nlink); + } + } else if (server->caps & NFS_CAP_NLINK) +- invalid |= save_cache_validity & (NFS_INO_INVALID_ATTR ++ nfsi->cache_validity |= save_cache_validity & ++ (NFS_INO_INVALID_ATTR + | NFS_INO_REVAL_FORCED); + + if (fattr->valid & NFS_ATTR_FATTR_SPACE_USED) { +diff --git a/fs/nfs/nfs4filelayout.c b/fs/nfs/nfs4filelayout.c +index 22d10623f5ee..b039f7f26d95 100644 +--- a/fs/nfs/nfs4filelayout.c ++++ b/fs/nfs/nfs4filelayout.c +@@ -1300,7 +1300,7 @@ filelayout_alloc_layout_hdr(struct inode *inode, gfp_t gfp_flags) + struct nfs4_filelayout *flo; + + flo = kzalloc(sizeof(*flo), gfp_flags); +- return &flo->generic_hdr; ++ return flo != NULL ? &flo->generic_hdr : NULL; + } + + static void +diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c +index ae6a50b7a617..bdff771057d3 100644 +--- a/fs/nfsd/nfs4state.c ++++ b/fs/nfsd/nfs4state.c +@@ -3608,7 +3608,7 @@ nfsd4_free_lock_stateid(struct nfs4_ol_stateid *stp) + * correspondance, and we have to delete the lockowner when we + * delete the lock stateid: + */ +- unhash_lockowner(lo); ++ release_lockowner(lo); + return nfs_ok; + } + +diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c +index 5188a38fef06..d4890a96421e 100644 +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -2035,8 +2035,8 @@ nfsd4_encode_fattr(struct svc_fh *fhp, struct svc_export *exp, + err = vfs_getattr(&path, &stat); + if (err) + goto out_nfserr; +- if ((bmval0 & (FATTR4_WORD0_FILES_FREE | FATTR4_WORD0_FILES_TOTAL | +- FATTR4_WORD0_MAXNAME)) || ++ if ((bmval0 & (FATTR4_WORD0_FILES_AVAIL | FATTR4_WORD0_FILES_FREE | ++ FATTR4_WORD0_FILES_TOTAL | FATTR4_WORD0_MAXNAME)) || + (bmval1 & (FATTR4_WORD1_SPACE_AVAIL | FATTR4_WORD1_SPACE_FREE | + FATTR4_WORD1_SPACE_TOTAL))) { + err = vfs_statfs(&path, &statfs); +diff --git a/fs/nfsd/nfscache.c b/fs/nfsd/nfscache.c +index ec8d97ddc635..e5e4675b7e75 100644 +--- a/fs/nfsd/nfscache.c ++++ b/fs/nfsd/nfscache.c +@@ -129,13 +129,6 @@ nfsd_reply_cache_alloc(void) + } + + static void +-nfsd_reply_cache_unhash(struct svc_cacherep *rp) +-{ +- hlist_del_init(&rp->c_hash); +- list_del_init(&rp->c_lru); +-} +- +-static void + nfsd_reply_cache_free_locked(struct svc_cacherep *rp) + { + if (rp->c_type == RC_REPLBUFF && rp->c_replvec.iov_base) { +@@ -228,13 +221,6 @@ hash_refile(struct svc_cacherep *rp) + hlist_add_head(&rp->c_hash, cache_hash + hash_32(rp->c_xid, maskbits)); + } + +-static inline bool +-nfsd_cache_entry_expired(struct svc_cacherep *rp) +-{ +- return rp->c_state != RC_INPROG && +- time_after(jiffies, rp->c_timestamp + RC_EXPIRE); +-} +- + /* + * Walk the LRU list and prune off entries that are older than RC_EXPIRE. + * Also prune the oldest ones when the total exceeds the max number of entries. +@@ -245,8 +231,14 @@ prune_cache_entries(void) + struct svc_cacherep *rp, *tmp; + + list_for_each_entry_safe(rp, tmp, &lru_head, c_lru) { +- if (!nfsd_cache_entry_expired(rp) && +- num_drc_entries <= max_drc_entries) ++ /* ++ * Don't free entries attached to calls that are still ++ * in-progress, but do keep scanning the list. ++ */ ++ if (rp->c_state == RC_INPROG) ++ continue; ++ if (num_drc_entries <= max_drc_entries && ++ time_before(jiffies, rp->c_timestamp + RC_EXPIRE)) + break; + nfsd_reply_cache_free_locked(rp); + } +@@ -402,22 +394,8 @@ nfsd_cache_lookup(struct svc_rqst *rqstp) + + /* + * Since the common case is a cache miss followed by an insert, +- * preallocate an entry. First, try to reuse the first entry on the LRU +- * if it works, then go ahead and prune the LRU list. ++ * preallocate an entry. + */ +- spin_lock(&cache_lock); +- if (!list_empty(&lru_head)) { +- rp = list_first_entry(&lru_head, struct svc_cacherep, c_lru); +- if (nfsd_cache_entry_expired(rp) || +- num_drc_entries >= max_drc_entries) { +- nfsd_reply_cache_unhash(rp); +- prune_cache_entries(); +- goto search_cache; +- } +- } +- +- /* No expired ones available, allocate a new one. */ +- spin_unlock(&cache_lock); + rp = nfsd_reply_cache_alloc(); + spin_lock(&cache_lock); + if (likely(rp)) { +@@ -425,7 +403,9 @@ nfsd_cache_lookup(struct svc_rqst *rqstp) + drc_mem_usage += sizeof(*rp); + } + +-search_cache: ++ /* go ahead and prune the cache */ ++ prune_cache_entries(); ++ + found = nfsd_cache_search(rqstp, csum); + if (found) { + if (likely(rp)) +@@ -439,15 +419,6 @@ search_cache: + goto out; + } + +- /* +- * We're keeping the one we just allocated. Are we now over the +- * limit? Prune one off the tip of the LRU in trade for the one we +- * just allocated if so. +- */ +- if (num_drc_entries >= max_drc_entries) +- nfsd_reply_cache_free_locked(list_first_entry(&lru_head, +- struct svc_cacherep, c_lru)); +- + nfsdstats.rcmisses++; + rqstp->rq_cacherep = rp; + rp->c_state = RC_INPROG; +diff --git a/fs/reiserfs/inode.c b/fs/reiserfs/inode.c +index f844533792ee..36166443bc45 100644 +--- a/fs/reiserfs/inode.c ++++ b/fs/reiserfs/inode.c +@@ -3211,8 +3211,14 @@ int reiserfs_setattr(struct dentry *dentry, struct iattr *attr) + attr->ia_size != i_size_read(inode)) { + error = inode_newsize_ok(inode, attr->ia_size); + if (!error) { ++ /* ++ * Could race against reiserfs_file_release ++ * if called from NFS, so take tailpack mutex. ++ */ ++ mutex_lock(&REISERFS_I(inode)->tailpack); + truncate_setsize(inode, attr->ia_size); +- reiserfs_vfs_truncate_file(inode); ++ reiserfs_truncate_file(inode, 1); ++ mutex_unlock(&REISERFS_I(inode)->tailpack); + } + } + +diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c +index 14374530784c..881324c08430 100644 +--- a/fs/ubifs/file.c ++++ b/fs/ubifs/file.c +@@ -1524,8 +1524,7 @@ static int ubifs_vm_page_mkwrite(struct vm_area_struct *vma, + } + + wait_for_stable_page(page); +- unlock_page(page); +- return 0; ++ return VM_FAULT_LOCKED; + + out_unlock: + unlock_page(page); +diff --git a/fs/ubifs/shrinker.c b/fs/ubifs/shrinker.c +index 9e1d05666fed..e0a7a764a903 100644 +--- a/fs/ubifs/shrinker.c ++++ b/fs/ubifs/shrinker.c +@@ -128,7 +128,6 @@ static int shrink_tnc(struct ubifs_info *c, int nr, int age, int *contention) + freed = ubifs_destroy_tnc_subtree(znode); + atomic_long_sub(freed, &ubifs_clean_zn_cnt); + atomic_long_sub(freed, &c->clean_zn_cnt); +- ubifs_assert(atomic_long_read(&c->clean_zn_cnt) >= 0); + total_freed += freed; + znode = zprev; + } +diff --git a/include/linux/ptrace.h b/include/linux/ptrace.h +index 2e99b8e08770..bb980ae6d9d3 100644 +--- a/include/linux/ptrace.h ++++ b/include/linux/ptrace.h +@@ -337,6 +337,9 @@ static inline void user_single_step_siginfo(struct task_struct *tsk, + * calling arch_ptrace_stop() when it would be superfluous. For example, + * if the thread has not been back to user mode since the last stop, the + * thread state might indicate that nothing needs to be done. ++ * ++ * This is guaranteed to be invoked once before a task stops for ptrace and ++ * may include arch-specific operations necessary prior to a ptrace stop. + */ + #define arch_ptrace_stop_needed(code, info) (0) + #endif +diff --git a/include/trace/syscall.h b/include/trace/syscall.h +index 84bc4197e736..0a5b4952aa30 100644 +--- a/include/trace/syscall.h ++++ b/include/trace/syscall.h +@@ -4,6 +4,7 @@ + #include <linux/tracepoint.h> + #include <linux/unistd.h> + #include <linux/ftrace_event.h> ++#include <linux/thread_info.h> + + #include <asm/ptrace.h> + +@@ -31,4 +32,18 @@ struct syscall_metadata { + struct ftrace_event_call *exit_event; + }; + ++#if defined(CONFIG_TRACEPOINTS) && defined(CONFIG_HAVE_SYSCALL_TRACEPOINTS) ++static inline void syscall_tracepoint_update(struct task_struct *p) ++{ ++ if (test_thread_flag(TIF_SYSCALL_TRACEPOINT)) ++ set_tsk_thread_flag(p, TIF_SYSCALL_TRACEPOINT); ++ else ++ clear_tsk_thread_flag(p, TIF_SYSCALL_TRACEPOINT); ++} ++#else ++static inline void syscall_tracepoint_update(struct task_struct *p) ++{ ++} ++#endif ++ + #endif /* _TRACE_SYSCALL_H */ +diff --git a/kernel/fork.c b/kernel/fork.c +index 270c1dab674a..814363a69b80 100644 +--- a/kernel/fork.c ++++ b/kernel/fork.c +@@ -1479,7 +1479,9 @@ static struct task_struct *copy_process(unsigned long clone_flags, + + total_forks++; + spin_unlock(¤t->sighand->siglock); ++ syscall_tracepoint_update(p); + write_unlock_irq(&tasklist_lock); ++ + proc_fork_connector(p); + cgroup_post_fork(p); + if (clone_flags & CLONE_THREAD) +diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c +index 6dbdf277c8fe..60f49637b4d5 100644 +--- a/kernel/trace/trace.c ++++ b/kernel/trace/trace.c +@@ -1400,12 +1400,12 @@ static void tracing_stop_tr(struct trace_array *tr) + + void trace_stop_cmdline_recording(void); + +-static void trace_save_cmdline(struct task_struct *tsk) ++static int trace_save_cmdline(struct task_struct *tsk) + { + unsigned pid, idx; + + if (!tsk->pid || unlikely(tsk->pid > PID_MAX_DEFAULT)) +- return; ++ return 0; + + /* + * It's not the end of the world if we don't get +@@ -1414,7 +1414,7 @@ static void trace_save_cmdline(struct task_struct *tsk) + * so if we miss here, then better luck next time. + */ + if (!arch_spin_trylock(&trace_cmdline_lock)) +- return; ++ return 0; + + idx = map_pid_to_cmdline[tsk->pid]; + if (idx == NO_CMDLINE_MAP) { +@@ -1439,6 +1439,8 @@ static void trace_save_cmdline(struct task_struct *tsk) + memcpy(&saved_cmdlines[idx], tsk->comm, TASK_COMM_LEN); + + arch_spin_unlock(&trace_cmdline_lock); ++ ++ return 1; + } + + void trace_find_cmdline(int pid, char comm[]) +@@ -1480,9 +1482,8 @@ void tracing_record_cmdline(struct task_struct *tsk) + if (!__this_cpu_read(trace_cmdline_save)) + return; + +- __this_cpu_write(trace_cmdline_save, false); +- +- trace_save_cmdline(tsk); ++ if (trace_save_cmdline(tsk)) ++ __this_cpu_write(trace_cmdline_save, false); + } + + void +diff --git a/net/ipv4/netfilter/ipt_ULOG.c b/net/ipv4/netfilter/ipt_ULOG.c +index 32b0e978c8e0..f8629c04f35b 100644 +--- a/net/ipv4/netfilter/ipt_ULOG.c ++++ b/net/ipv4/netfilter/ipt_ULOG.c +@@ -220,6 +220,7 @@ static void ipt_ulog_packet(struct net *net, + ub->qlen++; + + pm = nlmsg_data(nlh); ++ memset(pm, 0, sizeof(*pm)); + + /* We might not have a timestamp, get one */ + if (skb->tstamp.tv64 == 0) +@@ -238,8 +239,6 @@ static void ipt_ulog_packet(struct net *net, + } + else if (loginfo->prefix[0] != '\0') + strncpy(pm->prefix, loginfo->prefix, sizeof(pm->prefix)); +- else +- *(pm->prefix) = '\0'; + + if (in && in->hard_header_len > 0 && + skb->mac_header != skb->network_header && +@@ -251,13 +250,9 @@ static void ipt_ulog_packet(struct net *net, + + if (in) + strncpy(pm->indev_name, in->name, sizeof(pm->indev_name)); +- else +- pm->indev_name[0] = '\0'; + + if (out) + strncpy(pm->outdev_name, out->name, sizeof(pm->outdev_name)); +- else +- pm->outdev_name[0] = '\0'; + + /* copy_len <= skb->len, so can't fail. */ + if (skb_copy_bits(skb, 0, pm->payload, copy_len) < 0) +diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c +index 21a3a475d7cd..663042e84e81 100644 +--- a/net/netfilter/ipvs/ip_vs_core.c ++++ b/net/netfilter/ipvs/ip_vs_core.c +@@ -1384,15 +1384,19 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum) + + if (ipip) { + __be32 info = ic->un.gateway; ++ __u8 type = ic->type; ++ __u8 code = ic->code; + + /* Update the MTU */ + if (ic->type == ICMP_DEST_UNREACH && + ic->code == ICMP_FRAG_NEEDED) { + struct ip_vs_dest *dest = cp->dest; + u32 mtu = ntohs(ic->un.frag.mtu); ++ __be16 frag_off = cih->frag_off; + + /* Strip outer IP and ICMP, go to IPIP header */ +- __skb_pull(skb, ihl + sizeof(_icmph)); ++ if (pskb_pull(skb, ihl + sizeof(_icmph)) == NULL) ++ goto ignore_ipip; + offset2 -= ihl + sizeof(_icmph); + skb_reset_network_header(skb); + IP_VS_DBG(12, "ICMP for IPIP %pI4->%pI4: mtu=%u\n", +@@ -1400,7 +1404,7 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum) + ipv4_update_pmtu(skb, dev_net(skb->dev), + mtu, 0, 0, 0, 0); + /* Client uses PMTUD? */ +- if (!(cih->frag_off & htons(IP_DF))) ++ if (!(frag_off & htons(IP_DF))) + goto ignore_ipip; + /* Prefer the resulting PMTU */ + if (dest) { +@@ -1419,12 +1423,13 @@ ip_vs_in_icmp(struct sk_buff *skb, int *related, unsigned int hooknum) + /* Strip outer IP, ICMP and IPIP, go to IP header of + * original request. + */ +- __skb_pull(skb, offset2); ++ if (pskb_pull(skb, offset2) == NULL) ++ goto ignore_ipip; + skb_reset_network_header(skb); + IP_VS_DBG(12, "Sending ICMP for %pI4->%pI4: t=%u, c=%u, i=%u\n", + &ip_hdr(skb)->saddr, &ip_hdr(skb)->daddr, +- ic->type, ic->code, ntohl(info)); +- icmp_send(skb, ic->type, ic->code, info); ++ type, code, ntohl(info)); ++ icmp_send(skb, type, code, info); + /* ICMP can be shorter but anyways, account it */ + ip_vs_out_stats(cp, skb); + +diff --git a/net/sunrpc/svc_xprt.c b/net/sunrpc/svc_xprt.c +index 80a6640f329b..b9aad4723a9d 100644 +--- a/net/sunrpc/svc_xprt.c ++++ b/net/sunrpc/svc_xprt.c +@@ -730,6 +730,8 @@ static int svc_handle_xprt(struct svc_rqst *rqstp, struct svc_xprt *xprt) + newxpt = xprt->xpt_ops->xpo_accept(xprt); + if (newxpt) + svc_add_new_temp_xprt(serv, newxpt); ++ else ++ module_put(xprt->xpt_class->xcl_owner); + } else if (xprt->xpt_ops->xpo_has_wspace(xprt)) { + /* XPT_DATA|XPT_DEFERRED case: */ + dprintk("svc: server %p, pool %u, transport %p, inuse=%d\n", +diff --git a/scripts/recordmcount.h b/scripts/recordmcount.h +index 9d1421e63ff8..49b582a225b0 100644 +--- a/scripts/recordmcount.h ++++ b/scripts/recordmcount.h +@@ -163,11 +163,11 @@ static int mcount_adjust = 0; + + static int MIPS_is_fake_mcount(Elf_Rel const *rp) + { +- static Elf_Addr old_r_offset; ++ static Elf_Addr old_r_offset = ~(Elf_Addr)0; + Elf_Addr current_r_offset = _w(rp->r_offset); + int is_fake; + +- is_fake = old_r_offset && ++ is_fake = (old_r_offset != ~(Elf_Addr)0) && + (current_r_offset - old_r_offset == MIPS_FAKEMCOUNT_OFFSET); + old_r_offset = current_r_offset; +
