commit: 21904dbecf9856d0db372b0afd8437dcc81c2990 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Wed Apr 20 10:10:24 2016 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Wed Apr 20 10:10:24 2016 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=21904dbe
Linux patch 3.14.67 0000_README | 4 + 1066_linux-3.14.67.patch | 1001 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 1005 insertions(+) diff --git a/0000_README b/0000_README index ef1c717..b3e38b1 100644 --- a/0000_README +++ b/0000_README @@ -306,6 +306,10 @@ Patch: 1065_linux-3.14.66.patch From: http://www.kernel.org Desc: Linux 3.14.66 +Patch: 1066_linux-3.14.67.patch +From: http://www.kernel.org +Desc: Linux 3.14.67 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1066_linux-3.14.67.patch b/1066_linux-3.14.67.patch new file mode 100644 index 0000000..c87578d --- /dev/null +++ b/1066_linux-3.14.67.patch @@ -0,0 +1,1001 @@ +diff --git a/Makefile b/Makefile +index 9053bda13f60..0a28325ef49c 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 14 +-SUBLEVEL = 66 ++SUBLEVEL = 67 + EXTRAVERSION = + NAME = Remembering Coco + +diff --git a/arch/parisc/kernel/parisc_ksyms.c b/arch/parisc/kernel/parisc_ksyms.c +index 568b2c61ea02..3cad8aadc69e 100644 +--- a/arch/parisc/kernel/parisc_ksyms.c ++++ b/arch/parisc/kernel/parisc_ksyms.c +@@ -47,11 +47,11 @@ EXPORT_SYMBOL(__cmpxchg_u64); + EXPORT_SYMBOL(lclear_user); + EXPORT_SYMBOL(lstrnlen_user); + +-/* Global fixups */ +-extern void fixup_get_user_skip_1(void); +-extern void fixup_get_user_skip_2(void); +-extern void fixup_put_user_skip_1(void); +-extern void fixup_put_user_skip_2(void); ++/* Global fixups - defined as int to avoid creation of function pointers */ ++extern int fixup_get_user_skip_1; ++extern int fixup_get_user_skip_2; ++extern int fixup_put_user_skip_1; ++extern int fixup_put_user_skip_2; + EXPORT_SYMBOL(fixup_get_user_skip_1); + EXPORT_SYMBOL(fixup_get_user_skip_2); + EXPORT_SYMBOL(fixup_put_user_skip_1); +diff --git a/arch/parisc/kernel/traps.c b/arch/parisc/kernel/traps.c +index 47ee620d15d2..05aab1333dfa 100644 +--- a/arch/parisc/kernel/traps.c ++++ b/arch/parisc/kernel/traps.c +@@ -802,6 +802,9 @@ void notrace handle_interruption(int code, struct pt_regs *regs) + + if (fault_space == 0 && !in_atomic()) + { ++ /* Clean up and return if in exception table. */ ++ if (fixup_exception(regs)) ++ return; + pdc_chassis_send_status(PDC_CHASSIS_DIRECT_PANIC); + parisc_terminate("Kernel Fault", regs, code, fault_address); + } +diff --git a/drivers/gpu/drm/radeon/radeon_sa.c b/drivers/gpu/drm/radeon/radeon_sa.c +index a1d684266549..d92ab57bffaf 100644 +--- a/drivers/gpu/drm/radeon/radeon_sa.c ++++ b/drivers/gpu/drm/radeon/radeon_sa.c +@@ -349,8 +349,10 @@ int radeon_sa_bo_new(struct radeon_device *rdev, + /* see if we can skip over some allocations */ + } while (radeon_sa_bo_next_hole(sa_manager, fences, tries)); + +- for (i = 0; i < RADEON_NUM_RINGS; ++i) +- radeon_fence_ref(fences[i]); ++ for (i = 0; i < RADEON_NUM_RINGS; ++i) { ++ if (fences[i]) ++ radeon_fence_ref(fences[i]); ++ } + + spin_unlock(&sa_manager->wq.lock); + r = radeon_fence_wait_any(rdev, fences, false); +diff --git a/drivers/gpu/drm/radeon/si_dpm.c b/drivers/gpu/drm/radeon/si_dpm.c +index c9053f799abe..93abc111307f 100644 +--- a/drivers/gpu/drm/radeon/si_dpm.c ++++ b/drivers/gpu/drm/radeon/si_dpm.c +@@ -2914,6 +2914,7 @@ static struct si_dpm_quirk si_dpm_quirk_list[] = { + /* PITCAIRN - https://bugs.freedesktop.org/show_bug.cgi?id=76490 */ + { PCI_VENDOR_ID_ATI, 0x6810, 0x1462, 0x3036, 0, 120000 }, + { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0xe271, 0, 120000 }, ++ { PCI_VENDOR_ID_ATI, 0x6811, 0x174b, 0x2015, 0, 120000 }, + { PCI_VENDOR_ID_ATI, 0x6810, 0x174b, 0xe271, 85000, 90000 }, + { 0, 0, 0, 0 }, + }; +@@ -3006,6 +3007,10 @@ static void si_apply_state_adjust_rules(struct radeon_device *rdev, + ps->performance_levels[i].sclk = max_sclk; + } + } ++ /* limit mclk on all R7 370 parts for stability */ ++ if (rdev->pdev->device == 0x6811 && ++ rdev->pdev->revision == 0x81) ++ max_mclk = 120000; + + /* XXX validate the min clocks required for display */ + +diff --git a/drivers/hid/usbhid/hid-core.c b/drivers/hid/usbhid/hid-core.c +index ced6d61c1787..63de05743259 100644 +--- a/drivers/hid/usbhid/hid-core.c ++++ b/drivers/hid/usbhid/hid-core.c +@@ -940,14 +940,6 @@ static int usbhid_output_raw_report(struct hid_device *hid, __u8 *buf, size_t co + return ret; + } + +-static void usbhid_restart_queues(struct usbhid_device *usbhid) +-{ +- if (usbhid->urbout && !test_bit(HID_OUT_RUNNING, &usbhid->iofl)) +- usbhid_restart_out_queue(usbhid); +- if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl)) +- usbhid_restart_ctrl_queue(usbhid); +-} +- + static void hid_free_buffers(struct usb_device *dev, struct hid_device *hid) + { + struct usbhid_device *usbhid = hid->driver_data; +@@ -1376,6 +1368,37 @@ static void hid_cease_io(struct usbhid_device *usbhid) + usb_kill_urb(usbhid->urbout); + } + ++static void hid_restart_io(struct hid_device *hid) ++{ ++ struct usbhid_device *usbhid = hid->driver_data; ++ int clear_halt = test_bit(HID_CLEAR_HALT, &usbhid->iofl); ++ int reset_pending = test_bit(HID_RESET_PENDING, &usbhid->iofl); ++ ++ spin_lock_irq(&usbhid->lock); ++ clear_bit(HID_SUSPENDED, &usbhid->iofl); ++ usbhid_mark_busy(usbhid); ++ ++ if (clear_halt || reset_pending) ++ schedule_work(&usbhid->reset_work); ++ usbhid->retry_delay = 0; ++ spin_unlock_irq(&usbhid->lock); ++ ++ if (reset_pending || !test_bit(HID_STARTED, &usbhid->iofl)) ++ return; ++ ++ if (!clear_halt) { ++ if (hid_start_in(hid) < 0) ++ hid_io_error(hid); ++ } ++ ++ spin_lock_irq(&usbhid->lock); ++ if (usbhid->urbout && !test_bit(HID_OUT_RUNNING, &usbhid->iofl)) ++ usbhid_restart_out_queue(usbhid); ++ if (!test_bit(HID_CTRL_RUNNING, &usbhid->iofl)) ++ usbhid_restart_ctrl_queue(usbhid); ++ spin_unlock_irq(&usbhid->lock); ++} ++ + /* Treat USB reset pretty much the same as suspend/resume */ + static int hid_pre_reset(struct usb_interface *intf) + { +@@ -1425,14 +1448,14 @@ static int hid_post_reset(struct usb_interface *intf) + return 1; + } + ++ /* No need to do another reset or clear a halted endpoint */ + spin_lock_irq(&usbhid->lock); + clear_bit(HID_RESET_PENDING, &usbhid->iofl); ++ clear_bit(HID_CLEAR_HALT, &usbhid->iofl); + spin_unlock_irq(&usbhid->lock); + hid_set_idle(dev, intf->cur_altsetting->desc.bInterfaceNumber, 0, 0); +- status = hid_start_in(hid); +- if (status < 0) +- hid_io_error(hid); +- usbhid_restart_queues(usbhid); ++ ++ hid_restart_io(hid); + + return 0; + } +@@ -1455,25 +1478,9 @@ void usbhid_put_power(struct hid_device *hid) + #ifdef CONFIG_PM + static int hid_resume_common(struct hid_device *hid, bool driver_suspended) + { +- struct usbhid_device *usbhid = hid->driver_data; +- int status; +- +- spin_lock_irq(&usbhid->lock); +- clear_bit(HID_SUSPENDED, &usbhid->iofl); +- usbhid_mark_busy(usbhid); +- +- if (test_bit(HID_CLEAR_HALT, &usbhid->iofl) || +- test_bit(HID_RESET_PENDING, &usbhid->iofl)) +- schedule_work(&usbhid->reset_work); +- usbhid->retry_delay = 0; +- +- usbhid_restart_queues(usbhid); +- spin_unlock_irq(&usbhid->lock); +- +- status = hid_start_in(hid); +- if (status < 0) +- hid_io_error(hid); ++ int status = 0; + ++ hid_restart_io(hid); + if (driver_suspended && hid->driver && hid->driver->resume) + status = hid->driver->resume(hid); + return status; +@@ -1542,12 +1549,8 @@ static int hid_suspend(struct usb_interface *intf, pm_message_t message) + static int hid_resume(struct usb_interface *intf) + { + struct hid_device *hid = usb_get_intfdata (intf); +- struct usbhid_device *usbhid = hid->driver_data; + int status; + +- if (!test_bit(HID_STARTED, &usbhid->iofl)) +- return 0; +- + status = hid_resume_common(hid, true); + dev_dbg(&intf->dev, "resume status %d\n", status); + return 0; +@@ -1556,10 +1559,8 @@ static int hid_resume(struct usb_interface *intf) + static int hid_reset_resume(struct usb_interface *intf) + { + struct hid_device *hid = usb_get_intfdata(intf); +- struct usbhid_device *usbhid = hid->driver_data; + int status; + +- clear_bit(HID_SUSPENDED, &usbhid->iofl); + status = hid_post_reset(intf); + if (status >= 0 && hid->driver && hid->driver->reset_resume) { + int ret = hid->driver->reset_resume(hid); +diff --git a/drivers/hwmon/max1111.c b/drivers/hwmon/max1111.c +index eda077de8a9f..f787f04a0d1a 100644 +--- a/drivers/hwmon/max1111.c ++++ b/drivers/hwmon/max1111.c +@@ -85,6 +85,9 @@ static struct max1111_data *the_max1111; + + int max1111_read_channel(int channel) + { ++ if (!the_max1111 || !the_max1111->spi) ++ return -ENODEV; ++ + return max1111_read(&the_max1111->spi->dev, channel); + } + EXPORT_SYMBOL(max1111_read_channel); +@@ -260,6 +263,9 @@ static int max1111_remove(struct spi_device *spi) + { + struct max1111_data *data = spi_get_drvdata(spi); + ++#ifdef CONFIG_SHARPSL_PM ++ the_max1111 = NULL; ++#endif + hwmon_device_unregister(data->hwmon_dev); + sysfs_remove_group(&spi->dev.kobj, &max1110_attr_group); + sysfs_remove_group(&spi->dev.kobj, &max1111_attr_group); +diff --git a/drivers/media/usb/usbvision/usbvision-video.c b/drivers/media/usb/usbvision/usbvision-video.c +index 5c9e3123ad2e..6bc70ce564b5 100644 +--- a/drivers/media/usb/usbvision/usbvision-video.c ++++ b/drivers/media/usb/usbvision/usbvision-video.c +@@ -1522,7 +1522,7 @@ static int usbvision_probe(struct usb_interface *intf, + const struct usb_host_interface *interface; + struct usb_usbvision *usbvision = NULL; + const struct usb_endpoint_descriptor *endpoint; +- int model, i; ++ int model, i, ret; + + PDEBUG(DBG_PROBE, "VID=%#04x, PID=%#04x, ifnum=%u", + dev->descriptor.idVendor, +@@ -1531,33 +1531,51 @@ static int usbvision_probe(struct usb_interface *intf, + model = devid->driver_info; + if (model < 0 || model >= usbvision_device_data_size) { + PDEBUG(DBG_PROBE, "model out of bounds %d", model); +- return -ENODEV; ++ ret = -ENODEV; ++ goto err_usb; + } + printk(KERN_INFO "%s: %s found\n", __func__, + usbvision_device_data[model].model_string); + + if (usbvision_device_data[model].interface >= 0) + interface = &dev->actconfig->interface[usbvision_device_data[model].interface]->altsetting[0]; +- else ++ else if (ifnum < dev->actconfig->desc.bNumInterfaces) + interface = &dev->actconfig->interface[ifnum]->altsetting[0]; ++ else { ++ dev_err(&intf->dev, "interface %d is invalid, max is %d\n", ++ ifnum, dev->actconfig->desc.bNumInterfaces - 1); ++ ret = -ENODEV; ++ goto err_usb; ++ } ++ ++ if (interface->desc.bNumEndpoints < 2) { ++ dev_err(&intf->dev, "interface %d has %d endpoints, but must" ++ " have minimum 2\n", ifnum, interface->desc.bNumEndpoints); ++ ret = -ENODEV; ++ goto err_usb; ++ } + endpoint = &interface->endpoint[1].desc; ++ + if (!usb_endpoint_xfer_isoc(endpoint)) { + dev_err(&intf->dev, "%s: interface %d. has non-ISO endpoint!\n", + __func__, ifnum); + dev_err(&intf->dev, "%s: Endpoint attributes %d", + __func__, endpoint->bmAttributes); +- return -ENODEV; ++ ret = -ENODEV; ++ goto err_usb; + } + if (usb_endpoint_dir_out(endpoint)) { + dev_err(&intf->dev, "%s: interface %d. has ISO OUT endpoint!\n", + __func__, ifnum); +- return -ENODEV; ++ ret = -ENODEV; ++ goto err_usb; + } + + usbvision = usbvision_alloc(dev, intf); + if (usbvision == NULL) { + dev_err(&intf->dev, "%s: couldn't allocate USBVision struct\n", __func__); +- return -ENOMEM; ++ ret = -ENOMEM; ++ goto err_usb; + } + + if (dev->descriptor.bNumConfigurations > 1) +@@ -1576,8 +1594,8 @@ static int usbvision_probe(struct usb_interface *intf, + usbvision->alt_max_pkt_size = kmalloc(32 * usbvision->num_alt, GFP_KERNEL); + if (usbvision->alt_max_pkt_size == NULL) { + dev_err(&intf->dev, "usbvision: out of memory!\n"); +- usbvision_release(usbvision); +- return -ENOMEM; ++ ret = -ENOMEM; ++ goto err_pkt; + } + + for (i = 0; i < usbvision->num_alt; i++) { +@@ -1612,6 +1630,12 @@ static int usbvision_probe(struct usb_interface *intf, + + PDEBUG(DBG_PROBE, "success"); + return 0; ++ ++err_pkt: ++ usbvision_release(usbvision); ++err_usb: ++ usb_put_dev(dev); ++ return ret; + } + + +diff --git a/drivers/net/ethernet/jme.c b/drivers/net/ethernet/jme.c +index f5685c0d0579..2b20e2368fca 100644 +--- a/drivers/net/ethernet/jme.c ++++ b/drivers/net/ethernet/jme.c +@@ -3287,13 +3287,14 @@ jme_resume(struct device *dev) + jme_reset_phy_processor(jme); + jme_phy_calibration(jme); + jme_phy_setEA(jme); +- jme_start_irq(jme); + netif_device_attach(netdev); + + atomic_inc(&jme->link_changing); + + jme_reset_link(jme); + ++ jme_start_irq(jme); ++ + return 0; + } + +diff --git a/drivers/net/ethernet/qlogic/qlge/qlge_main.c b/drivers/net/ethernet/qlogic/qlge/qlge_main.c +index 656c65ddadb4..e845eadaf8d0 100644 +--- a/drivers/net/ethernet/qlogic/qlge/qlge_main.c ++++ b/drivers/net/ethernet/qlogic/qlge/qlge_main.c +@@ -1648,7 +1648,18 @@ static void ql_process_mac_rx_skb(struct ql_adapter *qdev, + return; + } + skb_reserve(new_skb, NET_IP_ALIGN); ++ ++ pci_dma_sync_single_for_cpu(qdev->pdev, ++ dma_unmap_addr(sbq_desc, mapaddr), ++ dma_unmap_len(sbq_desc, maplen), ++ PCI_DMA_FROMDEVICE); ++ + memcpy(skb_put(new_skb, length), skb->data, length); ++ ++ pci_dma_sync_single_for_device(qdev->pdev, ++ dma_unmap_addr(sbq_desc, mapaddr), ++ dma_unmap_len(sbq_desc, maplen), ++ PCI_DMA_FROMDEVICE); + skb = new_skb; + + /* Frame error, so drop the packet. */ +diff --git a/drivers/net/ethernet/renesas/sh_eth.c b/drivers/net/ethernet/renesas/sh_eth.c +index 58f1a09d6f1d..43b142a2ee79 100644 +--- a/drivers/net/ethernet/renesas/sh_eth.c ++++ b/drivers/net/ethernet/renesas/sh_eth.c +@@ -1156,7 +1156,8 @@ static void sh_eth_ring_format(struct net_device *ndev) + mdp->dirty_rx = (u32) (i - mdp->num_rx_ring); + + /* Mark the last entry as wrapping the ring. */ +- rxdesc->status |= cpu_to_edmac(mdp, RD_RDEL); ++ if (rxdesc) ++ rxdesc->status |= cpu_to_edmac(mdp, RD_RDEL); + + memset(mdp->tx_ring, 0, tx_ringsize); + +diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c +index a2d7d5f066f1..14a8d2958698 100644 +--- a/drivers/net/ppp/ppp_generic.c ++++ b/drivers/net/ppp/ppp_generic.c +@@ -2220,7 +2220,7 @@ int ppp_register_net_channel(struct net *net, struct ppp_channel *chan) + + pch->ppp = NULL; + pch->chan = chan; +- pch->chan_net = net; ++ pch->chan_net = get_net(net); + chan->ppp = pch; + init_ppp_file(&pch->file, CHANNEL); + pch->file.hdrlen = chan->hdrlen; +@@ -2317,6 +2317,8 @@ ppp_unregister_channel(struct ppp_channel *chan) + spin_lock_bh(&pn->all_channels_lock); + list_del(&pch->list); + spin_unlock_bh(&pn->all_channels_lock); ++ put_net(pch->chan_net); ++ pch->chan_net = NULL; + + pch->file.dead = 1; + wake_up_interruptible(&pch->file.rwait); +diff --git a/drivers/net/usb/cdc_ncm.c b/drivers/net/usb/cdc_ncm.c +index 75d7d9dbbe35..c6637229bdb8 100644 +--- a/drivers/net/usb/cdc_ncm.c ++++ b/drivers/net/usb/cdc_ncm.c +@@ -423,7 +423,11 @@ advance: + + iface_no = ctx->data->cur_altsetting->desc.bInterfaceNumber; + +- /* reset data interface */ ++ /* Reset data interface. Some devices will not reset properly ++ * unless they are configured first. Toggle the altsetting to ++ * force a reset ++ */ ++ usb_set_interface(dev->udev, iface_no, data_altsetting); + temp = usb_set_interface(dev->udev, iface_no, 0); + if (temp) { + dev_dbg(&intf->dev, "set interface failed\n"); +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c +index 3580938246b0..f2307bb3cb07 100644 +--- a/drivers/net/usb/qmi_wwan.c ++++ b/drivers/net/usb/qmi_wwan.c +@@ -737,6 +737,7 @@ static const struct usb_device_id products[] = { + {QMI_FIXED_INTF(0x19d2, 0x1426, 2)}, /* ZTE MF91 */ + {QMI_FIXED_INTF(0x19d2, 0x1428, 2)}, /* Telewell TW-LTE 4G v2 */ + {QMI_FIXED_INTF(0x19d2, 0x2002, 4)}, /* ZTE (Vodafone) K3765-Z */ ++ {QMI_FIXED_INTF(0x2001, 0x7e19, 4)}, /* D-Link DWM-221 B1 */ + {QMI_FIXED_INTF(0x0f3d, 0x68a2, 8)}, /* Sierra Wireless MC7700 */ + {QMI_FIXED_INTF(0x114f, 0x68a2, 8)}, /* Sierra Wireless MC7750 */ + {QMI_FIXED_INTF(0x1199, 0x68a2, 8)}, /* Sierra Wireless MC7710 in QMI mode */ +diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c +index 23dc1316c1c2..28ecd7573624 100644 +--- a/drivers/net/usb/usbnet.c ++++ b/drivers/net/usb/usbnet.c +@@ -1718,6 +1718,13 @@ out3: + if (info->unbind) + info->unbind (dev, udev); + out1: ++ /* subdrivers must undo all they did in bind() if they ++ * fail it, but we may fail later and a deferred kevent ++ * may trigger an error resubmitting itself and, worse, ++ * schedule a timer. So we kill it all just in case. ++ */ ++ cancel_work_sync(&dev->kevent); ++ del_timer_sync(&dev->delay); + free_netdev(net); + out: + return status; +diff --git a/drivers/net/wan/farsync.c b/drivers/net/wan/farsync.c +index bcfff0d62de4..2dfa1478d7d1 100644 +--- a/drivers/net/wan/farsync.c ++++ b/drivers/net/wan/farsync.c +@@ -2545,7 +2545,7 @@ fst_add_one(struct pci_dev *pdev, const struct pci_device_id *ent) + dev->mem_start = card->phys_mem + + BUF_OFFSET ( txBuffer[i][0][0]); + dev->mem_end = card->phys_mem +- + BUF_OFFSET ( txBuffer[i][NUM_TX_BUFFER][0]); ++ + BUF_OFFSET ( txBuffer[i][NUM_TX_BUFFER - 1][LEN_RX_BUFFER - 1]); + dev->base_addr = card->pci_conf; + dev->irq = card->irq; + +diff --git a/drivers/net/wireless/ath/ath9k/eeprom.c b/drivers/net/wireless/ath/ath9k/eeprom.c +index 971d770722cf..2ac05486424b 100644 +--- a/drivers/net/wireless/ath/ath9k/eeprom.c ++++ b/drivers/net/wireless/ath/ath9k/eeprom.c +@@ -408,10 +408,9 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah, + + if (match) { + if (AR_SREV_9287(ah)) { +- /* FIXME: array overrun? */ + for (i = 0; i < numXpdGains; i++) { + minPwrT4[i] = data_9287[idxL].pwrPdg[i][0]; +- maxPwrT4[i] = data_9287[idxL].pwrPdg[i][4]; ++ maxPwrT4[i] = data_9287[idxL].pwrPdg[i][intercepts - 1]; + ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i], + data_9287[idxL].pwrPdg[i], + data_9287[idxL].vpdPdg[i], +@@ -421,7 +420,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah, + } else if (eeprom_4k) { + for (i = 0; i < numXpdGains; i++) { + minPwrT4[i] = data_4k[idxL].pwrPdg[i][0]; +- maxPwrT4[i] = data_4k[idxL].pwrPdg[i][4]; ++ maxPwrT4[i] = data_4k[idxL].pwrPdg[i][intercepts - 1]; + ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i], + data_4k[idxL].pwrPdg[i], + data_4k[idxL].vpdPdg[i], +@@ -431,7 +430,7 @@ void ath9k_hw_get_gain_boundaries_pdadcs(struct ath_hw *ah, + } else { + for (i = 0; i < numXpdGains; i++) { + minPwrT4[i] = data_def[idxL].pwrPdg[i][0]; +- maxPwrT4[i] = data_def[idxL].pwrPdg[i][4]; ++ maxPwrT4[i] = data_def[idxL].pwrPdg[i][intercepts - 1]; + ath9k_hw_fill_vpd_table(minPwrT4[i], maxPwrT4[i], + data_def[idxL].pwrPdg[i], + data_def[idxL].vpdPdg[i], +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index f7fdc2c4f8b7..dcee3f09793d 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -5231,6 +5231,7 @@ static int usb_reset_and_verify_device(struct usb_device *udev) + usb_set_usb2_hardware_lpm(udev, 0); + + bos = udev->bos; ++ udev->bos = NULL; + + /* Disable LPM and LTM while we reset the device and reinstall the alt + * settings. Device-initiated LPM settings, and system exit latency +@@ -5339,11 +5340,8 @@ done: + usb_set_usb2_hardware_lpm(udev, 1); + usb_unlocked_enable_lpm(udev); + usb_enable_ltm(udev); +- /* release the new BOS descriptor allocated by hub_port_init() */ +- if (udev->bos != bos) { +- usb_release_bos_descriptor(udev); +- udev->bos = bos; +- } ++ usb_release_bos_descriptor(udev); ++ udev->bos = bos; + return 0; + + re_enumerate: +diff --git a/drivers/usb/renesas_usbhs/fifo.c b/drivers/usb/renesas_usbhs/fifo.c +index d49f9c326035..c116faed35ea 100644 +--- a/drivers/usb/renesas_usbhs/fifo.c ++++ b/drivers/usb/renesas_usbhs/fifo.c +@@ -166,7 +166,8 @@ static int usbhsf_pkt_handler(struct usbhs_pipe *pipe, int type) + goto __usbhs_pkt_handler_end; + } + +- ret = func(pkt, &is_done); ++ if (likely(func)) ++ ret = func(pkt, &is_done); + + if (is_done) + __usbhsf_pkt_del(pkt); +@@ -933,6 +934,7 @@ static int usbhsf_dma_try_pop(struct usbhs_pkt *pkt, int *is_done) + + pkt->trans = len; + ++ usbhsf_tx_irq_ctrl(pipe, 0); + INIT_WORK(&pkt->work, xfer_work); + schedule_work(&pkt->work); + +diff --git a/drivers/xen/events/events_base.c b/drivers/xen/events/events_base.c +index 5af64e966ed6..082b23be5409 100644 +--- a/drivers/xen/events/events_base.c ++++ b/drivers/xen/events/events_base.c +@@ -503,9 +503,19 @@ static void eoi_pirq(struct irq_data *data) + struct physdev_eoi eoi = { .irq = pirq_from_irq(data->irq) }; + int rc = 0; + +- irq_move_irq(data); ++ if (!VALID_EVTCHN(evtchn)) ++ return; + +- if (VALID_EVTCHN(evtchn)) ++ if (unlikely(irqd_is_setaffinity_pending(data))) { ++ int masked = test_and_set_mask(evtchn); ++ ++ clear_evtchn(evtchn); ++ ++ irq_move_masked_irq(data); ++ ++ if (!masked) ++ unmask_evtchn(evtchn); ++ } else + clear_evtchn(evtchn); + + if (pirq_needs_eoi(data->irq)) { +@@ -1395,9 +1405,19 @@ static void ack_dynirq(struct irq_data *data) + { + int evtchn = evtchn_from_irq(data->irq); + +- irq_move_irq(data); ++ if (!VALID_EVTCHN(evtchn)) ++ return; + +- if (VALID_EVTCHN(evtchn)) ++ if (unlikely(irqd_is_setaffinity_pending(data))) { ++ int masked = test_and_set_mask(evtchn); ++ ++ clear_evtchn(evtchn); ++ ++ irq_move_masked_irq(data); ++ ++ if (!masked) ++ unmask_evtchn(evtchn); ++ } else + clear_evtchn(evtchn); + } + +diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h +index 96fe2c175a73..bb39399f3ef7 100644 +--- a/fs/ext4/ext4.h ++++ b/fs/ext4/ext4.h +@@ -847,6 +847,29 @@ do { \ + #include "extents_status.h" + + /* ++ * Lock subclasses for i_data_sem in the ext4_inode_info structure. ++ * ++ * These are needed to avoid lockdep false positives when we need to ++ * allocate blocks to the quota inode during ext4_map_blocks(), while ++ * holding i_data_sem for a normal (non-quota) inode. Since we don't ++ * do quota tracking for the quota inode, this avoids deadlock (as ++ * well as infinite recursion, since it isn't turtles all the way ++ * down...) ++ * ++ * I_DATA_SEM_NORMAL - Used for most inodes ++ * I_DATA_SEM_OTHER - Used by move_inode.c for the second normal inode ++ * where the second inode has larger inode number ++ * than the first ++ * I_DATA_SEM_QUOTA - Used for quota inodes only ++ */ ++enum { ++ I_DATA_SEM_NORMAL = 0, ++ I_DATA_SEM_OTHER, ++ I_DATA_SEM_QUOTA, ++}; ++ ++ ++/* + * fourth extended file system inode data in memory + */ + struct ext4_inode_info { +diff --git a/fs/ext4/move_extent.c b/fs/ext4/move_extent.c +index 773b503bd18c..12a8148f9c58 100644 +--- a/fs/ext4/move_extent.c ++++ b/fs/ext4/move_extent.c +@@ -154,10 +154,10 @@ ext4_double_down_write_data_sem(struct inode *first, struct inode *second) + { + if (first < second) { + down_write(&EXT4_I(first)->i_data_sem); +- down_write_nested(&EXT4_I(second)->i_data_sem, SINGLE_DEPTH_NESTING); ++ down_write_nested(&EXT4_I(second)->i_data_sem, I_DATA_SEM_OTHER); + } else { + down_write(&EXT4_I(second)->i_data_sem); +- down_write_nested(&EXT4_I(first)->i_data_sem, SINGLE_DEPTH_NESTING); ++ down_write_nested(&EXT4_I(first)->i_data_sem, I_DATA_SEM_OTHER); + + } + } +@@ -1114,6 +1114,13 @@ mext_check_arguments(struct inode *orig_inode, + return -EINVAL; + } + ++ if (IS_NOQUOTA(orig_inode) || IS_NOQUOTA(donor_inode)) { ++ ext4_debug("ext4 move extent: The argument files should " ++ "not be quota files [ino:orig %lu, donor %lu]\n", ++ orig_inode->i_ino, donor_inode->i_ino); ++ return -EBUSY; ++ } ++ + /* Ext4 move extent supports only extent based file */ + if (!(ext4_test_inode_flag(orig_inode, EXT4_INODE_EXTENTS))) { + ext4_debug("ext4 move extent: orig file is not extents " +diff --git a/fs/ext4/super.c b/fs/ext4/super.c +index c05fc3aef69f..64cd8114f75d 100644 +--- a/fs/ext4/super.c ++++ b/fs/ext4/super.c +@@ -5123,6 +5123,20 @@ static int ext4_quota_on_mount(struct super_block *sb, int type) + EXT4_SB(sb)->s_jquota_fmt, type); + } + ++static void lockdep_set_quota_inode(struct inode *inode, int subclass) ++{ ++ struct ext4_inode_info *ei = EXT4_I(inode); ++ ++ /* The first argument of lockdep_set_subclass has to be ++ * *exactly* the same as the argument to init_rwsem() --- in ++ * this case, in init_once() --- or lockdep gets unhappy ++ * because the name of the lock is set using the ++ * stringification of the argument to init_rwsem(). ++ */ ++ (void) ei; /* shut up clang warning if !CONFIG_LOCKDEP */ ++ lockdep_set_subclass(&ei->i_data_sem, subclass); ++} ++ + /* + * Standard function to be called on quota_on + */ +@@ -5162,8 +5176,12 @@ static int ext4_quota_on(struct super_block *sb, int type, int format_id, + if (err) + return err; + } +- +- return dquot_quota_on(sb, type, format_id, path); ++ lockdep_set_quota_inode(path->dentry->d_inode, I_DATA_SEM_QUOTA); ++ err = dquot_quota_on(sb, type, format_id, path); ++ if (err) ++ lockdep_set_quota_inode(path->dentry->d_inode, ++ I_DATA_SEM_NORMAL); ++ return err; + } + + static int ext4_quota_enable(struct super_block *sb, int type, int format_id, +@@ -5189,8 +5207,11 @@ static int ext4_quota_enable(struct super_block *sb, int type, int format_id, + + /* Don't account quota for quota files to avoid recursion */ + qf_inode->i_flags |= S_NOQUOTA; ++ lockdep_set_quota_inode(qf_inode, I_DATA_SEM_QUOTA); + err = dquot_enable(qf_inode, type, format_id, flags); + iput(qf_inode); ++ if (err) ++ lockdep_set_quota_inode(qf_inode, I_DATA_SEM_NORMAL); + + return err; + } +diff --git a/kernel/events/core.c b/kernel/events/core.c +index bfd91336e888..cbd549ee09e4 100644 +--- a/kernel/events/core.c ++++ b/kernel/events/core.c +@@ -1400,14 +1400,14 @@ event_sched_out(struct perf_event *event, + + perf_pmu_disable(event->pmu); + ++ event->tstamp_stopped = tstamp; ++ event->pmu->del(event, 0); ++ event->oncpu = -1; + event->state = PERF_EVENT_STATE_INACTIVE; + if (event->pending_disable) { + event->pending_disable = 0; + event->state = PERF_EVENT_STATE_OFF; + } +- event->tstamp_stopped = tstamp; +- event->pmu->del(event, 0); +- event->oncpu = -1; + + if (!is_software_event(event)) + cpuctx->active_oncpu--; +diff --git a/mm/page_isolation.c b/mm/page_isolation.c +index d1473b2e9481..88bdbf48cf6c 100644 +--- a/mm/page_isolation.c ++++ b/mm/page_isolation.c +@@ -259,11 +259,11 @@ struct page *alloc_migrate_target(struct page *page, unsigned long private, + * now as a simple work-around, we use the next node for destination. + */ + if (PageHuge(page)) { +- nodemask_t src = nodemask_of_node(page_to_nid(page)); +- nodemask_t dst; +- nodes_complement(dst, src); ++ int node = next_online_node(page_to_nid(page)); ++ if (node == MAX_NUMNODES) ++ node = first_online_node; + return alloc_huge_page_node(page_hstate(compound_head(page)), +- next_node(page_to_nid(page), dst)); ++ node); + } + + if (PageHighMem(page)) +diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c +index 6970e36ad7b8..b0fe13529033 100644 +--- a/net/ipv4/udp.c ++++ b/net/ipv4/udp.c +@@ -1939,10 +1939,14 @@ void udp_v4_early_demux(struct sk_buff *skb) + if (!in_dev) + return; + +- ours = ip_check_mc_rcu(in_dev, iph->daddr, iph->saddr, +- iph->protocol); +- if (!ours) +- return; ++ /* we are supposed to accept bcast packets */ ++ if (skb->pkt_type == PACKET_MULTICAST) { ++ ours = ip_check_mc_rcu(in_dev, iph->daddr, iph->saddr, ++ iph->protocol); ++ if (!ours) ++ return; ++ } ++ + sk = __udp4_lib_mcast_demux_lookup(net, uh->dest, iph->daddr, + uh->source, iph->saddr, dif); + } else if (skb->pkt_type == PACKET_HOST) { +diff --git a/net/ipv6/exthdrs_core.c b/net/ipv6/exthdrs_core.c +index 8af3eb57f438..c7c8f71d0d48 100644 +--- a/net/ipv6/exthdrs_core.c ++++ b/net/ipv6/exthdrs_core.c +@@ -257,7 +257,11 @@ int ipv6_find_hdr(const struct sk_buff *skb, unsigned int *offset, + *fragoff = _frag_off; + return hp->nexthdr; + } +- return -ENOENT; ++ if (!found) ++ return -ENOENT; ++ if (fragoff) ++ *fragoff = _frag_off; ++ break; + } + hdrlen = 8; + } else if (nexthdr == NEXTHDR_AUTH) { +diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c +index 657639d39f70..57011ec645ea 100644 +--- a/net/ipv6/ip6_tunnel.c ++++ b/net/ipv6/ip6_tunnel.c +@@ -273,12 +273,12 @@ static int ip6_tnl_create2(struct net_device *dev) + + t = netdev_priv(dev); + ++ dev->rtnl_link_ops = &ip6_link_ops; + err = register_netdevice(dev); + if (err < 0) + goto out; + + strcpy(t->parms.name, dev->name); +- dev->rtnl_link_ops = &ip6_link_ops; + + dev_hold(dev); + ip6_tnl_link(ip6n, t); +diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c +index 38625a91ec94..d2013c718112 100644 +--- a/net/ipv6/udp.c ++++ b/net/ipv6/udp.c +@@ -868,11 +868,9 @@ int __udp6_lib_rcv(struct sk_buff *skb, struct udp_table *udptable, + ret = udpv6_queue_rcv_skb(sk, skb); + sock_put(sk); + +- /* a return value > 0 means to resubmit the input, but +- * it wants the return to be -protocol, or 0 +- */ ++ /* a return value > 0 means to resubmit the input */ + if (ret > 0) +- return -ret; ++ return ret; + + return 0; + } +diff --git a/net/l2tp/l2tp_ip.c b/net/l2tp/l2tp_ip.c +index 0b44d855269c..0693f019fb0f 100644 +--- a/net/l2tp/l2tp_ip.c ++++ b/net/l2tp/l2tp_ip.c +@@ -123,12 +123,11 @@ static int l2tp_ip_recv(struct sk_buff *skb) + struct l2tp_tunnel *tunnel = NULL; + int length; + +- /* Point to L2TP header */ +- optr = ptr = skb->data; +- + if (!pskb_may_pull(skb, 4)) + goto discard; + ++ /* Point to L2TP header */ ++ optr = ptr = skb->data; + session_id = ntohl(*((__be32 *) ptr)); + ptr += 4; + +@@ -156,6 +155,9 @@ static int l2tp_ip_recv(struct sk_buff *skb) + if (!pskb_may_pull(skb, length)) + goto discard; + ++ /* Point to L2TP header */ ++ optr = ptr = skb->data; ++ ptr += 4; + pr_debug("%s: ip recv\n", tunnel->name); + print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length); + } +diff --git a/net/l2tp/l2tp_ip6.c b/net/l2tp/l2tp_ip6.c +index 7704ea9502fd..15f1e4479926 100644 +--- a/net/l2tp/l2tp_ip6.c ++++ b/net/l2tp/l2tp_ip6.c +@@ -135,12 +135,11 @@ static int l2tp_ip6_recv(struct sk_buff *skb) + struct l2tp_tunnel *tunnel = NULL; + int length; + +- /* Point to L2TP header */ +- optr = ptr = skb->data; +- + if (!pskb_may_pull(skb, 4)) + goto discard; + ++ /* Point to L2TP header */ ++ optr = ptr = skb->data; + session_id = ntohl(*((__be32 *) ptr)); + ptr += 4; + +@@ -168,6 +167,9 @@ static int l2tp_ip6_recv(struct sk_buff *skb) + if (!pskb_may_pull(skb, length)) + goto discard; + ++ /* Point to L2TP header */ ++ optr = ptr = skb->data; ++ ptr += 4; + pr_debug("%s: ip recv\n", tunnel->name); + print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, ptr, length); + } +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index 9abb445ea261..8a87e78b269f 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -2087,7 +2087,7 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) + struct ieee80211_sub_if_data *sdata = rx->sdata; + struct ieee80211_rx_status *status = IEEE80211_SKB_RXCB(skb); + struct ieee80211_if_mesh *ifmsh = &sdata->u.mesh; +- u16 q, hdrlen; ++ u16 ac, q, hdrlen; + + hdr = (struct ieee80211_hdr *) skb->data; + hdrlen = ieee80211_hdrlen(hdr->frame_control); +@@ -2157,7 +2157,8 @@ ieee80211_rx_h_mesh_fwding(struct ieee80211_rx_data *rx) + ether_addr_equal(sdata->vif.addr, hdr->addr3)) + return RX_CONTINUE; + +- q = ieee80211_select_queue_80211(sdata, skb, hdr); ++ ac = ieee80211_select_queue_80211(sdata, skb, hdr); ++ q = sdata->vif.hw_queue[ac]; + if (ieee80211_queue_stopped(&local->hw, q)) { + IEEE80211_IFSTA_MESH_CTR_INC(ifmsh, dropped_frames_congestion); + return RX_DROP_MONITOR; +diff --git a/net/sctp/ipv6.c b/net/sctp/ipv6.c +index 1b9b4528b5f3..4395f295446d 100644 +--- a/net/sctp/ipv6.c ++++ b/net/sctp/ipv6.c +@@ -519,6 +519,8 @@ static int sctp_v6_cmp_addr(const union sctp_addr *addr1, + } + return 0; + } ++ if (addr1->v6.sin6_port != addr2->v6.sin6_port) ++ return 0; + if (!ipv6_addr_equal(&addr1->v6.sin6_addr, &addr2->v6.sin6_addr)) + return 0; + /* If this is a linklocal address, compare the scope_id. */ +diff --git a/net/socket.c b/net/socket.c +index b72fc137e1a6..5940690476c9 100644 +--- a/net/socket.c ++++ b/net/socket.c +@@ -2400,31 +2400,31 @@ int __sys_recvmmsg(int fd, struct mmsghdr __user *mmsg, unsigned int vlen, + break; + } + +-out_put: +- fput_light(sock->file, fput_needed); +- + if (err == 0) +- return datagrams; ++ goto out_put; + +- if (datagrams != 0) { ++ if (datagrams == 0) { ++ datagrams = err; ++ goto out_put; ++ } ++ ++ /* ++ * We may return less entries than requested (vlen) if the ++ * sock is non block and there aren't enough datagrams... ++ */ ++ if (err != -EAGAIN) { + /* +- * We may return less entries than requested (vlen) if the +- * sock is non block and there aren't enough datagrams... ++ * ... or if recvmsg returns an error after we ++ * received some datagrams, where we record the ++ * error to return on the next call or if the ++ * app asks about it using getsockopt(SO_ERROR). + */ +- if (err != -EAGAIN) { +- /* +- * ... or if recvmsg returns an error after we +- * received some datagrams, where we record the +- * error to return on the next call or if the +- * app asks about it using getsockopt(SO_ERROR). +- */ +- sock->sk->sk_err = -err; +- } +- +- return datagrams; ++ sock->sk->sk_err = -err; + } ++out_put: ++ fput_light(sock->file, fput_needed); + +- return err; ++ return datagrams; + } + + SYSCALL_DEFINE5(recvmmsg, int, fd, struct mmsghdr __user *, mmsg, +diff --git a/sound/core/timer.c b/sound/core/timer.c +index d90d8f4b85fe..38742e826900 100644 +--- a/sound/core/timer.c ++++ b/sound/core/timer.c +@@ -1012,8 +1012,8 @@ static int snd_timer_s_start(struct snd_timer * timer) + njiff += timer->sticks - priv->correction; + priv->correction = 0; + } +- priv->last_expires = priv->tlist.expires = njiff; +- add_timer(&priv->tlist); ++ priv->last_expires = njiff; ++ mod_timer(&priv->tlist, njiff); + return 0; + } +
