Author: mpagano Date: 2014-05-07 00:24:59 +0000 (Wed, 07 May 2014) New Revision: 2777
Added: genpatches-2.6/trunk/3.4/1088_linux-3.4.89.patch Modified: genpatches-2.6/trunk/3.4/0000_README Log: Linux patch 3.4.89 Modified: genpatches-2.6/trunk/3.4/0000_README =================================================================== --- genpatches-2.6/trunk/3.4/0000_README 2014-05-06 23:17:20 UTC (rev 2776) +++ genpatches-2.6/trunk/3.4/0000_README 2014-05-07 00:24:59 UTC (rev 2777) @@ -391,6 +391,10 @@ From: http://www.kernel.org Desc: Linux 3.4.88 +Patch: 1088_linux-3.4.89.patch +From: http://www.kernel.org +Desc: Linux 3.4.89 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. Added: genpatches-2.6/trunk/3.4/1088_linux-3.4.89.patch =================================================================== --- genpatches-2.6/trunk/3.4/1088_linux-3.4.89.patch (rev 0) +++ genpatches-2.6/trunk/3.4/1088_linux-3.4.89.patch 2014-05-07 00:24:59 UTC (rev 2777) @@ -0,0 +1,1310 @@ +diff --git a/Makefile b/Makefile +index b2192326e7f9..2c2ec2cedd52 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 4 +-SUBLEVEL = 88 ++SUBLEVEL = 89 + EXTRAVERSION = + NAME = Saber-toothed Squirrel + +diff --git a/arch/arm/include/asm/div64.h b/arch/arm/include/asm/div64.h +index fe92ccf1d0b0..a66061aef29c 100644 +--- a/arch/arm/include/asm/div64.h ++++ b/arch/arm/include/asm/div64.h +@@ -156,7 +156,7 @@ + /* Select the best insn combination to perform the */ \ + /* actual __m * __n / (__p << 64) operation. */ \ + if (!__c) { \ +- asm ( "umull %Q0, %R0, %1, %Q2\n\t" \ ++ asm ( "umull %Q0, %R0, %Q1, %Q2\n\t" \ + "mov %Q0, #0" \ + : "=&r" (__res) \ + : "r" (__m), "r" (__n) \ +diff --git a/arch/arm/kernel/machine_kexec.c b/arch/arm/kernel/machine_kexec.c +index dfcdb9f7c126..5f104b8eddd9 100644 +--- a/arch/arm/kernel/machine_kexec.c ++++ b/arch/arm/kernel/machine_kexec.c +@@ -138,3 +138,10 @@ void machine_kexec(struct kimage *image) + + soft_restart(reboot_code_buffer_phys); + } ++ ++void arch_crash_save_vmcoreinfo(void) ++{ ++#ifdef CONFIG_ARM_LPAE ++ VMCOREINFO_CONFIG(ARM_LPAE); ++#endif ++} +diff --git a/arch/arm/mach-omap2/irq.c b/arch/arm/mach-omap2/irq.c +index 65f0d2571c9a..ccc9bcbf1540 100644 +--- a/arch/arm/mach-omap2/irq.c ++++ b/arch/arm/mach-omap2/irq.c +@@ -220,6 +220,7 @@ void __init ti81xx_init_irq(void) + static inline void omap_intc_handle_irq(void __iomem *base_addr, struct pt_regs *regs) + { + u32 irqnr; ++ int handled_irq = 0; + + do { + irqnr = readl_relaxed(base_addr + 0x98); +@@ -247,8 +248,15 @@ out: + if (irqnr) { + irqnr = irq_find_mapping(domain, irqnr); + handle_IRQ(irqnr, regs); ++ handled_irq = 1; + } + } while (irqnr); ++ ++ /* If an irq is masked or deasserted while active, we will ++ * keep ending up here with no irq handled. So remove it from ++ * the INTC with an ack.*/ ++ if (!handled_irq) ++ omap_ack_irq(NULL); + } + + asmlinkage void __exception_irq_entry omap2_intc_handle_irq(struct pt_regs *regs) +diff --git a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c +index a875de49aa9c..f71d09a620f4 100644 +--- a/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c ++++ b/arch/arm/mach-omap2/omap_hwmod_3xxx_data.c +@@ -3408,7 +3408,7 @@ static struct omap_hwmod_irq_info omap3xxx_usb_host_hs_irqs[] = { + static struct omap_hwmod omap3xxx_usb_host_hs_hwmod = { + .name = "usb_host_hs", + .class = &omap3xxx_usb_host_hs_hwmod_class, +- .clkdm_name = "l3_init_clkdm", ++ .clkdm_name = "usbhost_clkdm", + .mpu_irqs = omap3xxx_usb_host_hs_irqs, + .main_clk = "usbhost_48m_fck", + .prcm = { +@@ -3519,7 +3519,7 @@ static struct omap_hwmod_ocp_if *omap3xxx_usb_tll_hs_slaves[] = { + static struct omap_hwmod omap3xxx_usb_tll_hs_hwmod = { + .name = "usb_tll_hs", + .class = &omap3xxx_usb_tll_hs_hwmod_class, +- .clkdm_name = "l3_init_clkdm", ++ .clkdm_name = "core_l4_clkdm", + .mpu_irqs = omap3xxx_usb_tll_hs_irqs, + .main_clk = "usbtll_fck", + .prcm = { +diff --git a/arch/sh/kernel/dumpstack.c b/arch/sh/kernel/dumpstack.c +index 694158b9a50f..3a6528c1b1cd 100644 +--- a/arch/sh/kernel/dumpstack.c ++++ b/arch/sh/kernel/dumpstack.c +@@ -80,7 +80,7 @@ static int print_trace_stack(void *data, char *name) + */ + static void print_trace_address(void *data, unsigned long addr, int reliable) + { +- printk(data); ++ printk("%s", (char *)data); + printk_address(addr, reliable); + } + +diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c +index ebc987398923..af1d14a9ebda 100644 +--- a/arch/x86/kernel/ldt.c ++++ b/arch/x86/kernel/ldt.c +@@ -229,6 +229,17 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode) + } + } + ++ /* ++ * On x86-64 we do not support 16-bit segments due to ++ * IRET leaking the high bits of the kernel stack address. ++ */ ++#ifdef CONFIG_X86_64 ++ if (!ldt_info.seg_32bit) { ++ error = -EINVAL; ++ goto out_unlock; ++ } ++#endif ++ + fill_ldt(&ldt, &ldt_info); + if (oldmode) + ldt.avl = 0; +diff --git a/drivers/infiniband/hw/ehca/ehca_cq.c b/drivers/infiniband/hw/ehca/ehca_cq.c +index d9b0ebcb67d7..6eeb84d6e5cf 100644 +--- a/drivers/infiniband/hw/ehca/ehca_cq.c ++++ b/drivers/infiniband/hw/ehca/ehca_cq.c +@@ -296,6 +296,7 @@ struct ib_cq *ehca_create_cq(struct ib_device *device, int cqe, int comp_vector, + (my_cq->galpas.user.fw_handle & (PAGE_SIZE - 1)); + if (ib_copy_to_udata(udata, &resp, sizeof(resp))) { + ehca_err(device, "Copy to udata failed."); ++ cq = ERR_PTR(-EFAULT); + goto create_cq_exit4; + } + } +diff --git a/drivers/infiniband/hw/ipath/ipath_diag.c b/drivers/infiniband/hw/ipath/ipath_diag.c +index 714293b78518..e2f9a51f4a38 100644 +--- a/drivers/infiniband/hw/ipath/ipath_diag.c ++++ b/drivers/infiniband/hw/ipath/ipath_diag.c +@@ -326,7 +326,7 @@ static ssize_t ipath_diagpkt_write(struct file *fp, + size_t count, loff_t *off) + { + u32 __iomem *piobuf; +- u32 plen, clen, pbufn; ++ u32 plen, pbufn, maxlen_reserve; + struct ipath_diag_pkt odp; + struct ipath_diag_xpkt dp; + u32 *tmpbuf = NULL; +@@ -335,51 +335,29 @@ static ssize_t ipath_diagpkt_write(struct file *fp, + u64 val; + u32 l_state, lt_state; /* LinkState, LinkTrainingState */ + +- if (count < sizeof(odp)) { +- ret = -EINVAL; +- goto bail; +- } + + if (count == sizeof(dp)) { + if (copy_from_user(&dp, data, sizeof(dp))) { + ret = -EFAULT; + goto bail; + } +- } else if (copy_from_user(&odp, data, sizeof(odp))) { +- ret = -EFAULT; ++ } else if (count == sizeof(odp)) { ++ if (copy_from_user(&odp, data, sizeof(odp))) { ++ ret = -EFAULT; ++ goto bail; ++ } ++ } else { ++ ret = -EINVAL; + goto bail; + } + +- /* +- * Due to padding/alignment issues (lessened with new struct) +- * the old and new structs are the same length. We need to +- * disambiguate them, which we can do because odp.len has never +- * been less than the total of LRH+BTH+DETH so far, while +- * dp.unit (same offset) unit is unlikely to get that high. +- * Similarly, dp.data, the pointer to user at the same offset +- * as odp.unit, is almost certainly at least one (512byte)page +- * "above" NULL. The if-block below can be omitted if compatibility +- * between a new driver and older diagnostic code is unimportant. +- * compatibility the other direction (new diags, old driver) is +- * handled in the diagnostic code, with a warning. +- */ +- if (dp.unit >= 20 && dp.data < 512) { +- /* very probable version mismatch. Fix it up */ +- memcpy(&odp, &dp, sizeof(odp)); +- /* We got a legacy dp, copy elements to dp */ +- dp.unit = odp.unit; +- dp.data = odp.data; +- dp.len = odp.len; +- dp.pbc_wd = 0; /* Indicate we need to compute PBC wd */ +- } +- + /* send count must be an exact number of dwords */ + if (dp.len & 3) { + ret = -EINVAL; + goto bail; + } + +- clen = dp.len >> 2; ++ plen = dp.len >> 2; + + dd = ipath_lookup(dp.unit); + if (!dd || !(dd->ipath_flags & IPATH_PRESENT) || +@@ -422,16 +400,22 @@ static ssize_t ipath_diagpkt_write(struct file *fp, + goto bail; + } + +- /* need total length before first word written */ +- /* +1 word is for the qword padding */ +- plen = sizeof(u32) + dp.len; +- +- if ((plen + 4) > dd->ipath_ibmaxlen) { ++ /* ++ * need total length before first word written, plus 2 Dwords. One Dword ++ * is for padding so we get the full user data when not aligned on ++ * a word boundary. The other Dword is to make sure we have room for the ++ * ICRC which gets tacked on later. ++ */ ++ maxlen_reserve = 2 * sizeof(u32); ++ if (dp.len > dd->ipath_ibmaxlen - maxlen_reserve) { + ipath_dbg("Pkt len 0x%x > ibmaxlen %x\n", +- plen - 4, dd->ipath_ibmaxlen); ++ dp.len, dd->ipath_ibmaxlen); + ret = -EINVAL; +- goto bail; /* before writing pbc */ ++ goto bail; + } ++ ++ plen = sizeof(u32) + dp.len; ++ + tmpbuf = vmalloc(plen); + if (!tmpbuf) { + dev_info(&dd->pcidev->dev, "Unable to allocate tmp buffer, " +@@ -473,11 +457,11 @@ static ssize_t ipath_diagpkt_write(struct file *fp, + */ + if (dd->ipath_flags & IPATH_PIO_FLUSH_WC) { + ipath_flush_wc(); +- __iowrite32_copy(piobuf + 2, tmpbuf, clen - 1); ++ __iowrite32_copy(piobuf + 2, tmpbuf, plen - 1); + ipath_flush_wc(); +- __raw_writel(tmpbuf[clen - 1], piobuf + clen + 1); ++ __raw_writel(tmpbuf[plen - 1], piobuf + plen + 1); + } else +- __iowrite32_copy(piobuf + 2, tmpbuf, clen); ++ __iowrite32_copy(piobuf + 2, tmpbuf, plen); + + ipath_flush_wc(); + +diff --git a/drivers/infiniband/hw/mthca/mthca_provider.c b/drivers/infiniband/hw/mthca/mthca_provider.c +index 5b71d43bd89c..42dde06fdb91 100644 +--- a/drivers/infiniband/hw/mthca/mthca_provider.c ++++ b/drivers/infiniband/hw/mthca/mthca_provider.c +@@ -695,6 +695,7 @@ static struct ib_cq *mthca_create_cq(struct ib_device *ibdev, int entries, + + if (context && ib_copy_to_udata(udata, &cq->cqn, sizeof (__u32))) { + mthca_free_cq(to_mdev(ibdev), cq); ++ err = -EFAULT; + goto err_free; + } + +diff --git a/drivers/infiniband/hw/nes/nes_verbs.c b/drivers/infiniband/hw/nes/nes_verbs.c +index da84ea383f93..daf70d37a6b1 100644 +--- a/drivers/infiniband/hw/nes/nes_verbs.c ++++ b/drivers/infiniband/hw/nes/nes_verbs.c +@@ -1183,7 +1183,7 @@ static struct ib_qp *nes_create_qp(struct ib_pd *ibpd, + nes_free_resource(nesadapter, nesadapter->allocated_qps, qp_num); + kfree(nesqp->allocated_buffer); + nes_debug(NES_DBG_QP, "ib_copy_from_udata() Failed \n"); +- return NULL; ++ return ERR_PTR(-EFAULT); + } + if (req.user_wqe_buffers) { + virt_wqs = 1; +diff --git a/drivers/infiniband/ulp/srpt/ib_srpt.c b/drivers/infiniband/ulp/srpt/ib_srpt.c +index 2309f2eeaabd..ff0b71a7e8e1 100644 +--- a/drivers/infiniband/ulp/srpt/ib_srpt.c ++++ b/drivers/infiniband/ulp/srpt/ib_srpt.c +@@ -1078,6 +1078,7 @@ static void srpt_unmap_sg_to_ib_sge(struct srpt_rdma_ch *ch, + static int srpt_map_sg_to_ib_sge(struct srpt_rdma_ch *ch, + struct srpt_send_ioctx *ioctx) + { ++ struct ib_device *dev = ch->sport->sdev->device; + struct se_cmd *cmd; + struct scatterlist *sg, *sg_orig; + int sg_cnt; +@@ -1125,7 +1126,7 @@ static int srpt_map_sg_to_ib_sge(struct srpt_rdma_ch *ch, + + db = ioctx->rbufs; + tsize = cmd->data_length; +- dma_len = sg_dma_len(&sg[0]); ++ dma_len = ib_sg_dma_len(dev, &sg[0]); + riu = ioctx->rdma_ius; + + /* +@@ -1156,7 +1157,8 @@ static int srpt_map_sg_to_ib_sge(struct srpt_rdma_ch *ch, + ++j; + if (j < count) { + sg = sg_next(sg); +- dma_len = sg_dma_len(sg); ++ dma_len = ib_sg_dma_len( ++ dev, sg); + } + } + } else { +@@ -1193,8 +1195,8 @@ static int srpt_map_sg_to_ib_sge(struct srpt_rdma_ch *ch, + tsize = cmd->data_length; + riu = ioctx->rdma_ius; + sg = sg_orig; +- dma_len = sg_dma_len(&sg[0]); +- dma_addr = sg_dma_address(&sg[0]); ++ dma_len = ib_sg_dma_len(dev, &sg[0]); ++ dma_addr = ib_sg_dma_address(dev, &sg[0]); + + /* this second loop is really mapped sg_addres to rdma_iu->ib_sge */ + for (i = 0, j = 0; +@@ -1217,8 +1219,10 @@ static int srpt_map_sg_to_ib_sge(struct srpt_rdma_ch *ch, + ++j; + if (j < count) { + sg = sg_next(sg); +- dma_len = sg_dma_len(sg); +- dma_addr = sg_dma_address(sg); ++ dma_len = ib_sg_dma_len( ++ dev, sg); ++ dma_addr = ib_sg_dma_address( ++ dev, sg); + } + } + } else { +diff --git a/drivers/mfd/max8925-i2c.c b/drivers/mfd/max8925-i2c.c +index d9e4b36edee9..6d710677e023 100644 +--- a/drivers/mfd/max8925-i2c.c ++++ b/drivers/mfd/max8925-i2c.c +@@ -156,9 +156,18 @@ static int __devinit max8925_probe(struct i2c_client *client, + mutex_init(&chip->io_lock); + + chip->rtc = i2c_new_dummy(chip->i2c->adapter, RTC_I2C_ADDR); ++ if (!chip->rtc) { ++ dev_err(chip->dev, "Failed to allocate I2C device for RTC\n"); ++ return -ENODEV; ++ } + i2c_set_clientdata(chip->rtc, chip); + + chip->adc = i2c_new_dummy(chip->i2c->adapter, ADC_I2C_ADDR); ++ if (!chip->adc) { ++ dev_err(chip->dev, "Failed to allocate I2C device for ADC\n"); ++ i2c_unregister_device(chip->rtc); ++ return -ENODEV; ++ } + i2c_set_clientdata(chip->adc, chip); + + device_init_wakeup(&client->dev, 1); +diff --git a/drivers/mfd/max8997.c b/drivers/mfd/max8997.c +index cb83a7ab53e7..b4d48aff7de5 100644 +--- a/drivers/mfd/max8997.c ++++ b/drivers/mfd/max8997.c +@@ -149,10 +149,26 @@ static int max8997_i2c_probe(struct i2c_client *i2c, + mutex_init(&max8997->iolock); + + max8997->rtc = i2c_new_dummy(i2c->adapter, I2C_ADDR_RTC); ++ if (!max8997->rtc) { ++ dev_err(max8997->dev, "Failed to allocate I2C device for RTC\n"); ++ return -ENODEV; ++ } + i2c_set_clientdata(max8997->rtc, max8997); ++ + max8997->haptic = i2c_new_dummy(i2c->adapter, I2C_ADDR_HAPTIC); ++ if (!max8997->haptic) { ++ dev_err(max8997->dev, "Failed to allocate I2C device for Haptic\n"); ++ ret = -ENODEV; ++ goto err_i2c_haptic; ++ } + i2c_set_clientdata(max8997->haptic, max8997); ++ + max8997->muic = i2c_new_dummy(i2c->adapter, I2C_ADDR_MUIC); ++ if (!max8997->muic) { ++ dev_err(max8997->dev, "Failed to allocate I2C device for MUIC\n"); ++ ret = -ENODEV; ++ goto err_i2c_muic; ++ } + i2c_set_clientdata(max8997->muic, max8997); + + pm_runtime_set_active(max8997->dev); +@@ -179,7 +195,9 @@ static int max8997_i2c_probe(struct i2c_client *i2c, + err_mfd: + mfd_remove_devices(max8997->dev); + i2c_unregister_device(max8997->muic); ++err_i2c_muic: + i2c_unregister_device(max8997->haptic); ++err_i2c_haptic: + i2c_unregister_device(max8997->rtc); + err: + kfree(max8997); +diff --git a/drivers/mfd/max8998.c b/drivers/mfd/max8998.c +index 6ef56d28c056..0a4481600952 100644 +--- a/drivers/mfd/max8998.c ++++ b/drivers/mfd/max8998.c +@@ -152,6 +152,10 @@ static int max8998_i2c_probe(struct i2c_client *i2c, + mutex_init(&max8998->iolock); + + max8998->rtc = i2c_new_dummy(i2c->adapter, RTC_I2C_ADDR); ++ if (!max8998->rtc) { ++ dev_err(&i2c->dev, "Failed to allocate I2C device for RTC\n"); ++ return -ENODEV; ++ } + i2c_set_clientdata(max8998->rtc, max8998); + + max8998_irq_init(max8998); +diff --git a/drivers/scsi/arcmsr/arcmsr_hba.c b/drivers/scsi/arcmsr/arcmsr_hba.c +index cbde1dca45ad..937561fdb32a 100644 +--- a/drivers/scsi/arcmsr/arcmsr_hba.c ++++ b/drivers/scsi/arcmsr/arcmsr_hba.c +@@ -2500,16 +2500,15 @@ static int arcmsr_polling_ccbdone(struct AdapterControlBlock *acb, + static int arcmsr_iop_confirm(struct AdapterControlBlock *acb) + { + uint32_t cdb_phyaddr, cdb_phyaddr_hi32; +- dma_addr_t dma_coherent_handle; ++ + /* + ******************************************************************** + ** here we need to tell iop 331 our freeccb.HighPart + ** if freeccb.HighPart is not zero + ******************************************************************** + */ +- dma_coherent_handle = acb->dma_coherent_handle; +- cdb_phyaddr = (uint32_t)(dma_coherent_handle); +- cdb_phyaddr_hi32 = (uint32_t)((cdb_phyaddr >> 16) >> 16); ++ cdb_phyaddr = lower_32_bits(acb->dma_coherent_handle); ++ cdb_phyaddr_hi32 = upper_32_bits(acb->dma_coherent_handle); + acb->cdb_phyaddr_hi32 = cdb_phyaddr_hi32; + /* + *********************************************************************** +diff --git a/drivers/staging/rtl8712/rtl871x_recv.c b/drivers/staging/rtl8712/rtl871x_recv.c +index 5b03b405883e..79f3b97f17de 100644 +--- a/drivers/staging/rtl8712/rtl871x_recv.c ++++ b/drivers/staging/rtl8712/rtl871x_recv.c +@@ -253,7 +253,7 @@ union recv_frame *r8712_portctrl(struct _adapter *adapter, + struct sta_info *psta; + struct sta_priv *pstapriv; + union recv_frame *prtnframe; +- u16 ether_type = 0; ++ u16 ether_type; + + pstapriv = &adapter->stapriv; + ptr = get_recvframe_data(precv_frame); +@@ -262,15 +262,14 @@ union recv_frame *r8712_portctrl(struct _adapter *adapter, + psta = r8712_get_stainfo(pstapriv, psta_addr); + auth_alg = adapter->securitypriv.AuthAlgrthm; + if (auth_alg == 2) { ++ /* get ether_type */ ++ ptr = ptr + pfhdr->attrib.hdrlen + LLC_HEADER_SIZE; ++ memcpy(ðer_type, ptr, 2); ++ ether_type = ntohs((unsigned short)ether_type); ++ + if ((psta != NULL) && (psta->ieee8021x_blocked)) { + /* blocked + * only accept EAPOL frame */ +- prtnframe = precv_frame; +- /*get ether_type */ +- ptr = ptr + pfhdr->attrib.hdrlen + +- pfhdr->attrib.iv_len + LLC_HEADER_SIZE; +- memcpy(ðer_type, ptr, 2); +- ether_type = ntohs((unsigned short)ether_type); + if (ether_type == 0x888e) + prtnframe = precv_frame; + else { +diff --git a/drivers/staging/serqt_usb2/serqt_usb2.c b/drivers/staging/serqt_usb2/serqt_usb2.c +index ae1d815e2a53..a85d5c9cf7a1 100644 +--- a/drivers/staging/serqt_usb2/serqt_usb2.c ++++ b/drivers/staging/serqt_usb2/serqt_usb2.c +@@ -771,7 +771,7 @@ static int qt_startup(struct usb_serial *serial) + goto startup_error; + } + +- switch (serial->dev->descriptor.idProduct) { ++ switch (le16_to_cpu(serial->dev->descriptor.idProduct)) { + case QUATECH_DSU100: + case QUATECH_QSU100: + case QUATECH_ESU100A: +diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c +index 8d9100321474..d7ac2c095cc9 100644 +--- a/drivers/target/iscsi/iscsi_target.c ++++ b/drivers/target/iscsi/iscsi_target.c +@@ -2352,6 +2352,7 @@ static void iscsit_build_conn_drop_async_message(struct iscsi_conn *conn) + { + struct iscsi_cmd *cmd; + struct iscsi_conn *conn_p; ++ bool found = false; + + /* + * Only send a Asynchronous Message on connections whos network +@@ -2360,11 +2361,12 @@ static void iscsit_build_conn_drop_async_message(struct iscsi_conn *conn) + list_for_each_entry(conn_p, &conn->sess->sess_conn_list, conn_list) { + if (conn_p->conn_state == TARG_CONN_STATE_LOGGED_IN) { + iscsit_inc_conn_usage_count(conn_p); ++ found = true; + break; + } + } + +- if (!conn_p) ++ if (!found) + return; + + cmd = iscsit_allocate_cmd(conn_p, GFP_ATOMIC); +diff --git a/drivers/target/tcm_fc/tfc_sess.c b/drivers/target/tcm_fc/tfc_sess.c +index 9249998a837a..5ac8d5610a4a 100644 +--- a/drivers/target/tcm_fc/tfc_sess.c ++++ b/drivers/target/tcm_fc/tfc_sess.c +@@ -69,6 +69,7 @@ static struct ft_tport *ft_tport_create(struct fc_lport *lport) + + if (tport) { + tport->tpg = tpg; ++ tpg->tport = tport; + return tport; + } + +diff --git a/drivers/tty/hvc/hvc_console.c b/drivers/tty/hvc/hvc_console.c +index 8880adf5fc6f..1fbffaa9958e 100644 +--- a/drivers/tty/hvc/hvc_console.c ++++ b/drivers/tty/hvc/hvc_console.c +@@ -31,6 +31,7 @@ + #include <linux/list.h> + #include <linux/module.h> + #include <linux/major.h> ++#include <linux/atomic.h> + #include <linux/sysrq.h> + #include <linux/tty.h> + #include <linux/tty_flip.h> +@@ -70,6 +71,9 @@ static struct task_struct *hvc_task; + /* Picks up late kicks after list walk but before schedule() */ + static int hvc_kicked; + ++/* hvc_init is triggered from hvc_alloc, i.e. only when actually used */ ++static atomic_t hvc_needs_init __read_mostly = ATOMIC_INIT(-1); ++ + static int hvc_init(void); + + #ifdef CONFIG_MAGIC_SYSRQ +@@ -825,7 +829,7 @@ struct hvc_struct *hvc_alloc(uint32_t vtermno, int data, + int i; + + /* We wait until a driver actually comes along */ +- if (!hvc_driver) { ++ if (atomic_inc_not_zero(&hvc_needs_init)) { + int err = hvc_init(); + if (err) + return ERR_PTR(err); +diff --git a/drivers/usb/core/driver.c b/drivers/usb/core/driver.c +index 4c96c6f3f324..c4d894a95701 100644 +--- a/drivers/usb/core/driver.c ++++ b/drivers/usb/core/driver.c +@@ -914,8 +914,7 @@ EXPORT_SYMBOL_GPL(usb_deregister); + * it doesn't support pre_reset/post_reset/reset_resume or + * because it doesn't support suspend/resume. + * +- * The caller must hold @intf's device's lock, but not its pm_mutex +- * and not @intf->dev.sem. ++ * The caller must hold @intf's device's lock, but not @intf's lock. + */ + void usb_forced_unbind_intf(struct usb_interface *intf) + { +@@ -928,16 +927,37 @@ void usb_forced_unbind_intf(struct usb_interface *intf) + intf->needs_binding = 1; + } + ++/* ++ * Unbind drivers for @udev's marked interfaces. These interfaces have ++ * the needs_binding flag set, for example by usb_resume_interface(). ++ * ++ * The caller must hold @udev's device lock. ++ */ ++static void unbind_marked_interfaces(struct usb_device *udev) ++{ ++ struct usb_host_config *config; ++ int i; ++ struct usb_interface *intf; ++ ++ config = udev->actconfig; ++ if (config) { ++ for (i = 0; i < config->desc.bNumInterfaces; ++i) { ++ intf = config->interface[i]; ++ if (intf->dev.driver && intf->needs_binding) ++ usb_forced_unbind_intf(intf); ++ } ++ } ++} ++ + /* Delayed forced unbinding of a USB interface driver and scan + * for rebinding. + * +- * The caller must hold @intf's device's lock, but not its pm_mutex +- * and not @intf->dev.sem. ++ * The caller must hold @intf's device's lock, but not @intf's lock. + * + * Note: Rebinds will be skipped if a system sleep transition is in + * progress and the PM "complete" callback hasn't occurred yet. + */ +-void usb_rebind_intf(struct usb_interface *intf) ++static void usb_rebind_intf(struct usb_interface *intf) + { + int rc; + +@@ -954,68 +974,66 @@ void usb_rebind_intf(struct usb_interface *intf) + } + } + +-#ifdef CONFIG_PM +- +-/* Unbind drivers for @udev's interfaces that don't support suspend/resume +- * There is no check for reset_resume here because it can be determined +- * only during resume whether reset_resume is needed. ++/* ++ * Rebind drivers to @udev's marked interfaces. These interfaces have ++ * the needs_binding flag set. + * + * The caller must hold @udev's device lock. + */ +-static void unbind_no_pm_drivers_interfaces(struct usb_device *udev) ++static void rebind_marked_interfaces(struct usb_device *udev) + { + struct usb_host_config *config; + int i; + struct usb_interface *intf; +- struct usb_driver *drv; + + config = udev->actconfig; + if (config) { + for (i = 0; i < config->desc.bNumInterfaces; ++i) { + intf = config->interface[i]; +- +- if (intf->dev.driver) { +- drv = to_usb_driver(intf->dev.driver); +- if (!drv->suspend || !drv->resume) +- usb_forced_unbind_intf(intf); +- } ++ if (intf->needs_binding) ++ usb_rebind_intf(intf); + } + } + } + +-/* Unbind drivers for @udev's interfaces that failed to support reset-resume. +- * These interfaces have the needs_binding flag set by usb_resume_interface(). ++/* ++ * Unbind all of @udev's marked interfaces and then rebind all of them. ++ * This ordering is necessary because some drivers claim several interfaces ++ * when they are first probed. + * + * The caller must hold @udev's device lock. + */ +-static void unbind_no_reset_resume_drivers_interfaces(struct usb_device *udev) ++void usb_unbind_and_rebind_marked_interfaces(struct usb_device *udev) + { +- struct usb_host_config *config; +- int i; +- struct usb_interface *intf; +- +- config = udev->actconfig; +- if (config) { +- for (i = 0; i < config->desc.bNumInterfaces; ++i) { +- intf = config->interface[i]; +- if (intf->dev.driver && intf->needs_binding) +- usb_forced_unbind_intf(intf); +- } +- } ++ unbind_marked_interfaces(udev); ++ rebind_marked_interfaces(udev); + } + +-static void do_rebind_interfaces(struct usb_device *udev) ++#ifdef CONFIG_PM ++ ++/* Unbind drivers for @udev's interfaces that don't support suspend/resume ++ * There is no check for reset_resume here because it can be determined ++ * only during resume whether reset_resume is needed. ++ * ++ * The caller must hold @udev's device lock. ++ */ ++static void unbind_no_pm_drivers_interfaces(struct usb_device *udev) + { + struct usb_host_config *config; + int i; + struct usb_interface *intf; ++ struct usb_driver *drv; + + config = udev->actconfig; + if (config) { + for (i = 0; i < config->desc.bNumInterfaces; ++i) { + intf = config->interface[i]; +- if (intf->needs_binding) +- usb_rebind_intf(intf); ++ ++ if (intf->dev.driver) { ++ drv = to_usb_driver(intf->dev.driver); ++ if (!drv->suspend || !drv->resume) ++ usb_forced_unbind_intf(intf); ++ } + } + } + } +@@ -1333,7 +1351,7 @@ int usb_resume_complete(struct device *dev) + * whose needs_binding flag is set + */ + if (udev->state != USB_STATE_NOTATTACHED) +- do_rebind_interfaces(udev); ++ rebind_marked_interfaces(udev); + return 0; + } + +@@ -1355,7 +1373,7 @@ int usb_resume(struct device *dev, pm_message_t msg) + pm_runtime_disable(dev); + pm_runtime_set_active(dev); + pm_runtime_enable(dev); +- unbind_no_reset_resume_drivers_interfaces(udev); ++ unbind_marked_interfaces(udev); + } + + /* Avoid PM error messages for devices disconnected while suspended +diff --git a/drivers/usb/core/hcd-pci.c b/drivers/usb/core/hcd-pci.c +index 2b487d4797bd..50ebe6cf4648 100644 +--- a/drivers/usb/core/hcd-pci.c ++++ b/drivers/usb/core/hcd-pci.c +@@ -71,7 +71,7 @@ static void companion_common(struct pci_dev *pdev, struct usb_hcd *hcd, + continue; + + companion_hcd = pci_get_drvdata(companion); +- if (!companion_hcd) ++ if (!companion_hcd || !companion_hcd->self.root_hub) + continue; + + /* For SET_HS_COMPANION, store a pointer to the EHCI bus in +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index f65a1c654b42..d2b7327d9de3 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -4313,10 +4313,11 @@ int usb_reset_device(struct usb_device *udev) + else if (cintf->condition == + USB_INTERFACE_BOUND) + rebind = 1; ++ if (rebind) ++ cintf->needs_binding = 1; + } +- if (ret == 0 && rebind) +- usb_rebind_intf(cintf); + } ++ usb_unbind_and_rebind_marked_interfaces(udev); + } + + usb_autosuspend_device(udev); +diff --git a/drivers/usb/core/usb.h b/drivers/usb/core/usb.h +index f7f87e717e79..645278fb5c88 100644 +--- a/drivers/usb/core/usb.h ++++ b/drivers/usb/core/usb.h +@@ -42,7 +42,7 @@ extern int usb_match_one_id_intf(struct usb_device *dev, + extern int usb_match_device(struct usb_device *dev, + const struct usb_device_id *id); + extern void usb_forced_unbind_intf(struct usb_interface *intf); +-extern void usb_rebind_intf(struct usb_interface *intf); ++extern void usb_unbind_and_rebind_marked_interfaces(struct usb_device *udev); + + extern int usb_hub_claim_port(struct usb_device *hdev, unsigned port, + void *owner); +diff --git a/drivers/usb/dwc3/core.h b/drivers/usb/dwc3/core.h +index 29a68f0a9765..194cafdac16a 100644 +--- a/drivers/usb/dwc3/core.h ++++ b/drivers/usb/dwc3/core.h +@@ -719,15 +719,15 @@ struct dwc3_event_depevt { + * 12 - VndrDevTstRcved + * @reserved15_12: Reserved, not used + * @event_info: Information about this event +- * @reserved31_24: Reserved, not used ++ * @reserved31_25: Reserved, not used + */ + struct dwc3_event_devt { + u32 one_bit:1; + u32 device_event:7; + u32 type:4; + u32 reserved15_12:4; +- u32 event_info:8; +- u32 reserved31_24:8; ++ u32 event_info:9; ++ u32 reserved31_25:7; + } __packed; + + /** +diff --git a/drivers/usb/host/xhci-pci.c b/drivers/usb/host/xhci-pci.c +index f37e5c8d1a9a..33cff0153b25 100644 +--- a/drivers/usb/host/xhci-pci.c ++++ b/drivers/usb/host/xhci-pci.c +@@ -135,9 +135,7 @@ static void xhci_pci_quirks(struct device *dev, struct xhci_hcd *xhci) + xhci->quirks |= XHCI_TRUST_TX_LENGTH; + } + if (pdev->vendor == PCI_VENDOR_ID_RENESAS && +- pdev->device == 0x0015 && +- pdev->subsystem_vendor == PCI_VENDOR_ID_SAMSUNG && +- pdev->subsystem_device == 0xc0cd) ++ pdev->device == 0x0015) + xhci->quirks |= XHCI_RESET_ON_RESUME; + if (pdev->vendor == PCI_VENDOR_ID_VIA) + xhci->quirks |= XHCI_RESET_ON_RESUME; +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index f1897d9c4116..7299a06af9db 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -394,16 +394,16 @@ static int xhci_try_enable_msi(struct usb_hcd *hcd) + + #else + +-static int xhci_try_enable_msi(struct usb_hcd *hcd) ++static inline int xhci_try_enable_msi(struct usb_hcd *hcd) + { + return 0; + } + +-static void xhci_cleanup_msix(struct xhci_hcd *xhci) ++static inline void xhci_cleanup_msix(struct xhci_hcd *xhci) + { + } + +-static void xhci_msix_sync_irqs(struct xhci_hcd *xhci) ++static inline void xhci_msix_sync_irqs(struct xhci_hcd *xhci) + { + } + +diff --git a/drivers/usb/musb/musb_gadget.c b/drivers/usb/musb/musb_gadget.c +index 95918dacc99a..49e3728e1e69 100644 +--- a/drivers/usb/musb/musb_gadget.c ++++ b/drivers/usb/musb/musb_gadget.c +@@ -401,7 +401,19 @@ static void txstate(struct musb *musb, struct musb_request *req) + csr |= (MUSB_TXCSR_DMAENAB + | MUSB_TXCSR_DMAMODE + | MUSB_TXCSR_MODE); +- if (!musb_ep->hb_mult) ++ /* ++ * Enable Autoset according to table ++ * below ++ * bulk_split hb_mult Autoset_Enable ++ * 0 0 Yes(Normal) ++ * 0 >0 No(High BW ISO) ++ * 1 0 Yes(HS bulk) ++ * 1 >0 Yes(FS bulk) ++ */ ++ if (!musb_ep->hb_mult || ++ (musb_ep->hb_mult && ++ can_bulk_split(musb, ++ musb_ep->type))) + csr |= MUSB_TXCSR_AUTOSET; + } + csr &= ~MUSB_TXCSR_P_UNDERRUN; +@@ -1100,11 +1112,15 @@ static int musb_gadget_enable(struct usb_ep *ep, + /* Set TXMAXP with the FIFO size of the endpoint + * to disable double buffering mode. + */ +- if (musb->double_buffer_not_ok) ++ if (musb->double_buffer_not_ok) { + musb_writew(regs, MUSB_TXMAXP, hw_ep->max_packet_sz_tx); +- else ++ } else { ++ if (can_bulk_split(musb, musb_ep->type)) ++ musb_ep->hb_mult = (hw_ep->max_packet_sz_tx / ++ musb_ep->packet_sz) - 1; + musb_writew(regs, MUSB_TXMAXP, musb_ep->packet_sz + | (musb_ep->hb_mult << 11)); ++ } + + csr = MUSB_TXCSR_MODE | MUSB_TXCSR_CLRDATATOG; + if (musb_readw(regs, MUSB_TXCSR) +diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c +index b9f6d1a91f03..9d768ac5a60a 100644 +--- a/drivers/usb/serial/pl2303.c ++++ b/drivers/usb/serial/pl2303.c +@@ -86,6 +86,9 @@ static const struct usb_device_id id_table[] = { + { USB_DEVICE(YCCABLE_VENDOR_ID, YCCABLE_PRODUCT_ID) }, + { USB_DEVICE(SUPERIAL_VENDOR_ID, SUPERIAL_PRODUCT_ID) }, + { USB_DEVICE(HP_VENDOR_ID, HP_LD220_PRODUCT_ID) }, ++ { USB_DEVICE(HP_VENDOR_ID, HP_LD960_PRODUCT_ID) }, ++ { USB_DEVICE(HP_VENDOR_ID, HP_LCM220_PRODUCT_ID) }, ++ { USB_DEVICE(HP_VENDOR_ID, HP_LCM960_PRODUCT_ID) }, + { USB_DEVICE(CRESSI_VENDOR_ID, CRESSI_EDY_PRODUCT_ID) }, + { USB_DEVICE(ZEAGLE_VENDOR_ID, ZEAGLE_N2ITION3_PRODUCT_ID) }, + { USB_DEVICE(SONY_VENDOR_ID, SONY_QN3USB_PRODUCT_ID) }, +diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h +index c38b8c00c06f..42bc082896ac 100644 +--- a/drivers/usb/serial/pl2303.h ++++ b/drivers/usb/serial/pl2303.h +@@ -121,8 +121,11 @@ + #define SUPERIAL_VENDOR_ID 0x5372 + #define SUPERIAL_PRODUCT_ID 0x2303 + +-/* Hewlett-Packard LD220-HP POS Pole Display */ ++/* Hewlett-Packard POS Pole Displays */ + #define HP_VENDOR_ID 0x03f0 ++#define HP_LD960_PRODUCT_ID 0x0b39 ++#define HP_LCM220_PRODUCT_ID 0x3139 ++#define HP_LCM960_PRODUCT_ID 0x3239 + #define HP_LD220_PRODUCT_ID 0x3524 + + /* Cressi Edy (diving computer) PC interface */ +diff --git a/drivers/w1/w1_netlink.c b/drivers/w1/w1_netlink.c +index 40788c925d1c..73705aff53cb 100644 +--- a/drivers/w1/w1_netlink.c ++++ b/drivers/w1/w1_netlink.c +@@ -54,28 +54,29 @@ static void w1_send_slave(struct w1_master *dev, u64 rn) + struct w1_netlink_msg *hdr = (struct w1_netlink_msg *)(msg + 1); + struct w1_netlink_cmd *cmd = (struct w1_netlink_cmd *)(hdr + 1); + int avail; ++ u64 *data; + + /* update kernel slave list */ + w1_slave_found(dev, rn); + + avail = dev->priv_size - cmd->len; + +- if (avail > 8) { +- u64 *data = (void *)(cmd + 1) + cmd->len; ++ if (avail < 8) { ++ msg->ack++; ++ cn_netlink_send(msg, 0, GFP_KERNEL); + +- *data = rn; +- cmd->len += 8; +- hdr->len += 8; +- msg->len += 8; +- return; ++ msg->len = sizeof(struct w1_netlink_msg) + ++ sizeof(struct w1_netlink_cmd); ++ hdr->len = sizeof(struct w1_netlink_cmd); ++ cmd->len = 0; + } + +- msg->ack++; +- cn_netlink_send(msg, 0, GFP_KERNEL); ++ data = (void *)(cmd + 1) + cmd->len; + +- msg->len = sizeof(struct w1_netlink_msg) + sizeof(struct w1_netlink_cmd); +- hdr->len = sizeof(struct w1_netlink_cmd); +- cmd->len = 0; ++ *data = rn; ++ cmd->len += 8; ++ hdr->len += 8; ++ msg->len += 8; + } + + static int w1_process_search_command(struct w1_master *dev, struct cn_msg *msg, +diff --git a/fs/ext4/file.c b/fs/ext4/file.c +index cb70f1812a70..61999221fbfa 100644 +--- a/fs/ext4/file.c ++++ b/fs/ext4/file.c +@@ -80,7 +80,7 @@ ext4_unaligned_aio(struct inode *inode, const struct iovec *iov, + size_t count = iov_length(iov, nr_segs); + loff_t final_size = pos + count; + +- if (pos >= inode->i_size) ++ if (pos >= i_size_read(inode)) + return 0; + + if ((pos & blockmask) || (final_size & blockmask)) +diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c +index 64198ed1d64a..e5404945f854 100644 +--- a/fs/nfsd/nfs4proc.c ++++ b/fs/nfsd/nfs4proc.c +@@ -1245,6 +1245,12 @@ nfsd4_proc_compound(struct svc_rqst *rqstp, + /* If op is non-idempotent */ + if (opdesc->op_flags & OP_MODIFIES_SOMETHING) { + plen = opdesc->op_rsize_bop(rqstp, op); ++ /* ++ * If there's still another operation, make sure ++ * we'll have space to at least encode an error: ++ */ ++ if (resp->opcnt < args->opcnt) ++ plen += COMPOUND_ERR_SLACK_SPACE; + op->status = nfsd4_check_resp_size(resp, plen); + } + +@@ -1412,7 +1418,8 @@ static inline u32 nfsd4_setattr_rsize(struct svc_rqst *rqstp, struct nfsd4_op *o + + static inline u32 nfsd4_setclientid_rsize(struct svc_rqst *rqstp, struct nfsd4_op *op) + { +- return (op_encode_hdr_size + 2 + 1024) * sizeof(__be32); ++ return (op_encode_hdr_size + 2 + XDR_QUADLEN(NFS4_VERIFIER_SIZE)) * ++ sizeof(__be32); + } + + static inline u32 nfsd4_write_rsize(struct svc_rqst *rqstp, struct nfsd4_op *op) +diff --git a/fs/nfsd/nfs4xdr.c b/fs/nfsd/nfs4xdr.c +index cb997b1bb398..a0f92ec4b38e 100644 +--- a/fs/nfsd/nfs4xdr.c ++++ b/fs/nfsd/nfs4xdr.c +@@ -2410,6 +2410,8 @@ out_acl: + WRITE64(stat.ino); + } + if (bmval2 & FATTR4_WORD2_SUPPATTR_EXCLCREAT) { ++ if ((buflen -= 16) < 0) ++ goto out_resource; + WRITE32(3); + WRITE32(NFSD_SUPPATTR_EXCLCREAT_WORD0); + WRITE32(NFSD_SUPPATTR_EXCLCREAT_WORD1); +@@ -3406,6 +3408,9 @@ nfsd4_encode_test_stateid(struct nfsd4_compoundres *resp, int nfserr, + struct nfsd4_test_stateid_id *stateid, *next; + __be32 *p; + ++ if (nfserr) ++ return nfserr; ++ + RESERVE_SPACE(4 + (4 * test_stateid->ts_num_ids)); + *p++ = htonl(test_stateid->ts_num_ids); + +diff --git a/fs/nfsd/vfs.c b/fs/nfsd/vfs.c +index 026a873e3f6c..638306219ae8 100644 +--- a/fs/nfsd/vfs.c ++++ b/fs/nfsd/vfs.c +@@ -406,6 +406,7 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap, + umode_t ftype = 0; + __be32 err; + int host_err; ++ bool get_write_count; + int size_change = 0; + + if (iap->ia_valid & (ATTR_ATIME | ATTR_MTIME | ATTR_SIZE)) +@@ -413,10 +414,18 @@ nfsd_setattr(struct svc_rqst *rqstp, struct svc_fh *fhp, struct iattr *iap, + if (iap->ia_valid & ATTR_SIZE) + ftype = S_IFREG; + ++ /* Callers that do fh_verify should do the fh_want_write: */ ++ get_write_count = !fhp->fh_dentry; ++ + /* Get inode */ + err = fh_verify(rqstp, fhp, ftype, accmode); + if (err) + goto out; ++ if (get_write_count) { ++ host_err = fh_want_write(fhp); ++ if (host_err) ++ return nfserrno(host_err); ++ } + + dentry = fhp->fh_dentry; + inode = dentry->d_inode; +diff --git a/fs/ocfs2/buffer_head_io.c b/fs/ocfs2/buffer_head_io.c +index 5d18ad10c27f..4f66e007dae1 100644 +--- a/fs/ocfs2/buffer_head_io.c ++++ b/fs/ocfs2/buffer_head_io.c +@@ -90,7 +90,6 @@ int ocfs2_write_block(struct ocfs2_super *osb, struct buffer_head *bh, + * information for this bh as it's not marked locally + * uptodate. */ + ret = -EIO; +- put_bh(bh); + mlog_errno(ret); + } + +@@ -420,7 +419,6 @@ int ocfs2_write_super_or_backup(struct ocfs2_super *osb, + + if (!buffer_uptodate(bh)) { + ret = -EIO; +- put_bh(bh); + mlog_errno(ret); + } + +diff --git a/fs/ocfs2/dlm/dlmrecovery.c b/fs/ocfs2/dlm/dlmrecovery.c +index 01ebfd0bdad7..d15b0714ee3e 100644 +--- a/fs/ocfs2/dlm/dlmrecovery.c ++++ b/fs/ocfs2/dlm/dlmrecovery.c +@@ -540,7 +540,10 @@ master_here: + /* success! see if any other nodes need recovery */ + mlog(0, "DONE mastering recovery of %s:%u here(this=%u)!\n", + dlm->name, dlm->reco.dead_node, dlm->node_num); +- dlm_reset_recovery(dlm); ++ spin_lock(&dlm->spinlock); ++ __dlm_reset_recovery(dlm); ++ dlm->reco.state &= ~DLM_RECO_STATE_FINALIZE; ++ spin_unlock(&dlm->spinlock); + } + dlm_end_recovery(dlm); + +@@ -698,6 +701,14 @@ static int dlm_remaster_locks(struct dlm_ctxt *dlm, u8 dead_node) + if (all_nodes_done) { + int ret; + ++ /* Set this flag on recovery master to avoid ++ * a new recovery for another dead node start ++ * before the recovery is not done. That may ++ * cause recovery hung.*/ ++ spin_lock(&dlm->spinlock); ++ dlm->reco.state |= DLM_RECO_STATE_FINALIZE; ++ spin_unlock(&dlm->spinlock); ++ + /* all nodes are now in DLM_RECO_NODE_DATA_DONE state + * just send a finalize message to everyone and + * clean up */ +@@ -1752,13 +1763,13 @@ static int dlm_process_recovery_data(struct dlm_ctxt *dlm, + struct dlm_migratable_lockres *mres) + { + struct dlm_migratable_lock *ml; +- struct list_head *queue; ++ struct list_head *queue, *iter; + struct list_head *tmpq = NULL; + struct dlm_lock *newlock = NULL; + struct dlm_lockstatus *lksb = NULL; + int ret = 0; + int i, j, bad; +- struct dlm_lock *lock = NULL; ++ struct dlm_lock *lock; + u8 from = O2NM_MAX_NODES; + unsigned int added = 0; + __be64 c; +@@ -1793,14 +1804,16 @@ static int dlm_process_recovery_data(struct dlm_ctxt *dlm, + /* MIGRATION ONLY! */ + BUG_ON(!(mres->flags & DLM_MRES_MIGRATION)); + ++ lock = NULL; + spin_lock(&res->spinlock); + for (j = DLM_GRANTED_LIST; j <= DLM_BLOCKED_LIST; j++) { + tmpq = dlm_list_idx_to_ptr(res, j); +- list_for_each_entry(lock, tmpq, list) { +- if (lock->ml.cookie != ml->cookie) +- lock = NULL; +- else ++ list_for_each(iter, tmpq) { ++ lock = list_entry(iter, ++ struct dlm_lock, list); ++ if (lock->ml.cookie == ml->cookie) + break; ++ lock = NULL; + } + if (lock) + break; +@@ -2870,8 +2883,8 @@ int dlm_finalize_reco_handler(struct o2net_msg *msg, u32 len, void *data, + BUG(); + } + dlm->reco.state &= ~DLM_RECO_STATE_FINALIZE; ++ __dlm_reset_recovery(dlm); + spin_unlock(&dlm->spinlock); +- dlm_reset_recovery(dlm); + dlm_kick_recovery_thread(dlm); + break; + default: +diff --git a/fs/reiserfs/dir.c b/fs/reiserfs/dir.c +index 66c53b642a88..7c431ed5cc79 100644 +--- a/fs/reiserfs/dir.c ++++ b/fs/reiserfs/dir.c +@@ -128,6 +128,7 @@ int reiserfs_readdir_dentry(struct dentry *dentry, void *dirent, + char *d_name; + off_t d_off; + ino_t d_ino; ++ loff_t cur_pos = deh_offset(deh); + + if (!de_visible(deh)) + /* it is hidden entry */ +@@ -200,8 +201,9 @@ int reiserfs_readdir_dentry(struct dentry *dentry, void *dirent, + if (local_buf != small_buf) { + kfree(local_buf); + } +- // next entry should be looked for with such offset +- next_pos = deh_offset(deh) + 1; ++ ++ /* deh_offset(deh) may be invalid now. */ ++ next_pos = cur_pos + 1; + + if (item_moved(&tmp_ih, &path_to_entry)) { + goto research; +diff --git a/kernel/sysctl.c b/kernel/sysctl.c +index 4ab11879aeb4..e2772e13e81c 100644 +--- a/kernel/sysctl.c ++++ b/kernel/sysctl.c +@@ -142,6 +142,11 @@ static int min_percpu_pagelist_fract = 8; + static int ngroups_max = NGROUPS_MAX; + static const int cap_last_cap = CAP_LAST_CAP; + ++/*this is needed for proc_doulongvec_minmax of sysctl_hung_task_timeout_secs */ ++#ifdef CONFIG_DETECT_HUNG_TASK ++static unsigned long hung_task_timeout_max = (LONG_MAX/HZ); ++#endif ++ + #ifdef CONFIG_INOTIFY_USER + #include <linux/inotify.h> + #endif +@@ -897,6 +902,7 @@ static struct ctl_table kern_table[] = { + .maxlen = sizeof(unsigned long), + .mode = 0644, + .proc_handler = proc_dohung_task_timeout_secs, ++ .extra2 = &hung_task_timeout_max, + }, + { + .procname = "hung_task_warnings", +diff --git a/mm/hugetlb.c b/mm/hugetlb.c +index 7111f2f5af68..c8eed94343e0 100644 +--- a/mm/hugetlb.c ++++ b/mm/hugetlb.c +@@ -1451,6 +1451,7 @@ static unsigned long set_max_huge_pages(struct hstate *h, unsigned long count, + while (min_count < persistent_huge_pages(h)) { + if (!free_pool_huge_page(h, nodes_allowed, 0)) + break; ++ cond_resched_lock(&hugetlb_lock); + } + while (count < persistent_huge_pages(h)) { + if (!adjust_pool_surplus(h, nodes_allowed, 1)) +diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c +index 87680c58bce8..2a122954d2a6 100644 +--- a/sound/pci/hda/patch_realtek.c ++++ b/sound/pci/hda/patch_realtek.c +@@ -4323,6 +4323,7 @@ static void alc_auto_init_std(struct hda_codec *codec) + + static const struct snd_pci_quirk beep_white_list[] = { + SND_PCI_QUIRK(0x1043, 0x103c, "ASUS", 1), ++ SND_PCI_QUIRK(0x1043, 0x115d, "ASUS", 1), + SND_PCI_QUIRK(0x1043, 0x829f, "ASUS", 1), + SND_PCI_QUIRK(0x1043, 0x83ce, "EeePC", 1), + SND_PCI_QUIRK(0x1043, 0x831a, "EeePC", 1), +diff --git a/sound/pci/ice1712/ice1712.c b/sound/pci/ice1712/ice1712.c +index 08c7f3a91a81..8fd8ecf1ec37 100644 +--- a/sound/pci/ice1712/ice1712.c ++++ b/sound/pci/ice1712/ice1712.c +@@ -686,9 +686,10 @@ static snd_pcm_uframes_t snd_ice1712_playback_pointer(struct snd_pcm_substream * + if (!(snd_ice1712_read(ice, ICE1712_IREG_PBK_CTRL) & 1)) + return 0; + ptr = runtime->buffer_size - inw(ice->ddma_port + 4); ++ ptr = bytes_to_frames(substream->runtime, ptr); + if (ptr == runtime->buffer_size) + ptr = 0; +- return bytes_to_frames(substream->runtime, ptr); ++ return ptr; + } + + static snd_pcm_uframes_t snd_ice1712_playback_ds_pointer(struct snd_pcm_substream *substream) +@@ -705,9 +706,10 @@ static snd_pcm_uframes_t snd_ice1712_playback_ds_pointer(struct snd_pcm_substrea + addr = ICE1712_DSC_ADDR0; + ptr = snd_ice1712_ds_read(ice, substream->number * 2, addr) - + ice->playback_con_virt_addr[substream->number]; ++ ptr = bytes_to_frames(substream->runtime, ptr); + if (ptr == substream->runtime->buffer_size) + ptr = 0; +- return bytes_to_frames(substream->runtime, ptr); ++ return ptr; + } + + static snd_pcm_uframes_t snd_ice1712_capture_pointer(struct snd_pcm_substream *substream) +@@ -718,9 +720,10 @@ static snd_pcm_uframes_t snd_ice1712_capture_pointer(struct snd_pcm_substream *s + if (!(snd_ice1712_read(ice, ICE1712_IREG_CAP_CTRL) & 1)) + return 0; + ptr = inl(ICEREG(ice, CONCAP_ADDR)) - ice->capture_con_virt_addr; ++ ptr = bytes_to_frames(substream->runtime, ptr); + if (ptr == substream->runtime->buffer_size) + ptr = 0; +- return bytes_to_frames(substream->runtime, ptr); ++ return ptr; + } + + static const struct snd_pcm_hardware snd_ice1712_playback = { +@@ -1114,9 +1117,10 @@ static snd_pcm_uframes_t snd_ice1712_playback_pro_pointer(struct snd_pcm_substre + if (!(inl(ICEMT(ice, PLAYBACK_CONTROL)) & ICE1712_PLAYBACK_START)) + return 0; + ptr = ice->playback_pro_size - (inw(ICEMT(ice, PLAYBACK_SIZE)) << 2); ++ ptr = bytes_to_frames(substream->runtime, ptr); + if (ptr == substream->runtime->buffer_size) + ptr = 0; +- return bytes_to_frames(substream->runtime, ptr); ++ return ptr; + } + + static snd_pcm_uframes_t snd_ice1712_capture_pro_pointer(struct snd_pcm_substream *substream) +@@ -1127,9 +1131,10 @@ static snd_pcm_uframes_t snd_ice1712_capture_pro_pointer(struct snd_pcm_substrea + if (!(inl(ICEMT(ice, PLAYBACK_CONTROL)) & ICE1712_CAPTURE_START_SHADOW)) + return 0; + ptr = ice->capture_pro_size - (inw(ICEMT(ice, CAPTURE_SIZE)) << 2); ++ ptr = bytes_to_frames(substream->runtime, ptr); + if (ptr == substream->runtime->buffer_size) + ptr = 0; +- return bytes_to_frames(substream->runtime, ptr); ++ return ptr; + } + + static const struct snd_pcm_hardware snd_ice1712_playback_pro = { +diff --git a/sound/soc/codecs/cs42l73.c b/sound/soc/codecs/cs42l73.c +index 3686417f5ea5..9c784c7b07d1 100644 +--- a/sound/soc/codecs/cs42l73.c ++++ b/sound/soc/codecs/cs42l73.c +@@ -327,7 +327,7 @@ static const char * const cs42l73_mono_mix_texts[] = { + static const unsigned int cs42l73_mono_mix_values[] = { 0, 1, 2 }; + + static const struct soc_enum spk_asp_enum = +- SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 6, 1, ++ SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 6, 3, + ARRAY_SIZE(cs42l73_mono_mix_texts), + cs42l73_mono_mix_texts, + cs42l73_mono_mix_values); +@@ -345,7 +345,7 @@ static const struct snd_kcontrol_new spk_xsp_mixer = + SOC_DAPM_ENUM("Route", spk_xsp_enum); + + static const struct soc_enum esl_asp_enum = +- SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 2, 5, ++ SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 2, 3, + ARRAY_SIZE(cs42l73_mono_mix_texts), + cs42l73_mono_mix_texts, + cs42l73_mono_mix_values); +@@ -354,7 +354,7 @@ static const struct snd_kcontrol_new esl_asp_mixer = + SOC_DAPM_ENUM("Route", esl_asp_enum); + + static const struct soc_enum esl_xsp_enum = +- SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 0, 7, ++ SOC_VALUE_ENUM_SINGLE(CS42L73_MMIXCTL, 0, 3, + ARRAY_SIZE(cs42l73_mono_mix_texts), + cs42l73_mono_mix_texts, + cs42l73_mono_mix_values);
