commit: e65b826c5b6d4f93e10e568d082bb7e45b80805a Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Mon Jun 20 19:58:48 2016 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Mon Jun 20 19:58:48 2016 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=e65b826c
Linux patch 3.12.61 0000_README | 4 + 1060_linux-3.12.61.patch | 1697 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 1701 insertions(+) diff --git a/0000_README b/0000_README index b2378f8..d9fd762 100644 --- a/0000_README +++ b/0000_README @@ -282,6 +282,10 @@ Patch: 1059_linux-3.12.60.patch From: http://www.kernel.org Desc: Linux 3.12.60 +Patch: 1060_linux-3.12.61.patch +From: http://www.kernel.org +Desc: Linux 3.12.61 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1060_linux-3.12.61.patch b/1060_linux-3.12.61.patch new file mode 100644 index 0000000..8caea85 --- /dev/null +++ b/1060_linux-3.12.61.patch @@ -0,0 +1,1697 @@ +diff --git a/Makefile b/Makefile +index 8dedf316dd48..59cb9a750d78 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 3 + PATCHLEVEL = 12 +-SUBLEVEL = 60 ++SUBLEVEL = 61 + EXTRAVERSION = + NAME = One Giant Leap for Frogkind + +diff --git a/arch/arc/mm/tlbex.S b/arch/arc/mm/tlbex.S +index cf7d7d9ad695..98837a2bfd5e 100644 +--- a/arch/arc/mm/tlbex.S ++++ b/arch/arc/mm/tlbex.S +@@ -89,7 +89,7 @@ ex_saved_reg1: + #ifdef CONFIG_SMP + sr r0, [ARC_REG_SCRATCH_DATA0] ; freeup r0 to code with + GET_CPU_ID r0 ; get to per cpu scratch mem, +- lsl r0, r0, L1_CACHE_SHIFT ; cache line wide per cpu ++ asl r0, r0, L1_CACHE_SHIFT ; cache line wide per cpu + add r0, @ex_saved_reg1, r0 + #else + st r0, [@ex_saved_reg1] +@@ -108,7 +108,7 @@ ex_saved_reg1: + .macro TLBMISS_RESTORE_REGS + #ifdef CONFIG_SMP + GET_CPU_ID r0 ; get to per cpu scratch mem +- lsl r0, r0, L1_CACHE_SHIFT ; each is cache line wide ++ asl r0, r0, L1_CACHE_SHIFT ; each is cache line wide + add r0, @ex_saved_reg1, r0 + ld_s r3, [r0,12] + ld_s r2, [r0, 8] +@@ -220,7 +220,7 @@ ex_saved_reg1: + + .macro CONV_PTE_TO_TLB + and r3, r0, PTE_BITS_RWX ; r w x +- lsl r2, r3, 3 ; r w x 0 0 0 ++ asl r2, r3, 3 ; Kr Kw Kx 0 0 0 (GLOBAL, kernel only) + and.f 0, r0, _PAGE_GLOBAL + or.z r2, r2, r3 ; r w x r w x + +diff --git a/arch/mips/ath79/early_printk.c b/arch/mips/ath79/early_printk.c +index b955fafc58ba..d1adc59af5bf 100644 +--- a/arch/mips/ath79/early_printk.c ++++ b/arch/mips/ath79/early_printk.c +@@ -31,13 +31,15 @@ static inline void prom_putchar_wait(void __iomem *reg, u32 mask, u32 val) + } while (1); + } + ++#define BOTH_EMPTY (UART_LSR_TEMT | UART_LSR_THRE) ++ + static void prom_putchar_ar71xx(unsigned char ch) + { + void __iomem *base = (void __iomem *)(KSEG1ADDR(AR71XX_UART_BASE)); + +- prom_putchar_wait(base + UART_LSR * 4, UART_LSR_THRE, UART_LSR_THRE); ++ prom_putchar_wait(base + UART_LSR * 4, BOTH_EMPTY, BOTH_EMPTY); + __raw_writel(ch, base + UART_TX * 4); +- prom_putchar_wait(base + UART_LSR * 4, UART_LSR_THRE, UART_LSR_THRE); ++ prom_putchar_wait(base + UART_LSR * 4, BOTH_EMPTY, BOTH_EMPTY); + } + + static void prom_putchar_ar933x(unsigned char ch) +diff --git a/arch/mips/include/uapi/asm/siginfo.h b/arch/mips/include/uapi/asm/siginfo.h +index 88e292b7719e..9997e4d48d70 100644 +--- a/arch/mips/include/uapi/asm/siginfo.h ++++ b/arch/mips/include/uapi/asm/siginfo.h +@@ -46,13 +46,13 @@ typedef struct siginfo { + + /* kill() */ + struct { +- pid_t _pid; /* sender's pid */ ++ __kernel_pid_t _pid; /* sender's pid */ + __ARCH_SI_UID_T _uid; /* sender's uid */ + } _kill; + + /* POSIX.1b timers */ + struct { +- timer_t _tid; /* timer id */ ++ __kernel_timer_t _tid; /* timer id */ + int _overrun; /* overrun count */ + char _pad[sizeof( __ARCH_SI_UID_T) - sizeof(int)]; + sigval_t _sigval; /* same as below */ +@@ -61,26 +61,26 @@ typedef struct siginfo { + + /* POSIX.1b signals */ + struct { +- pid_t _pid; /* sender's pid */ ++ __kernel_pid_t _pid; /* sender's pid */ + __ARCH_SI_UID_T _uid; /* sender's uid */ + sigval_t _sigval; + } _rt; + + /* SIGCHLD */ + struct { +- pid_t _pid; /* which child */ ++ __kernel_pid_t _pid; /* which child */ + __ARCH_SI_UID_T _uid; /* sender's uid */ + int _status; /* exit code */ +- clock_t _utime; +- clock_t _stime; ++ __kernel_clock_t _utime; ++ __kernel_clock_t _stime; + } _sigchld; + + /* IRIX SIGCHLD */ + struct { +- pid_t _pid; /* which child */ +- clock_t _utime; ++ __kernel_pid_t _pid; /* which child */ ++ __kernel_clock_t _utime; + int _status; /* exit code */ +- clock_t _stime; ++ __kernel_clock_t _stime; + } _irix_sigchld; + + /* SIGILL, SIGFPE, SIGSEGV, SIGBUS */ +diff --git a/arch/mips/math-emu/cp1emu.c b/arch/mips/math-emu/cp1emu.c +index efe008846ed0..95745858a694 100644 +--- a/arch/mips/math-emu/cp1emu.c ++++ b/arch/mips/math-emu/cp1emu.c +@@ -670,9 +670,11 @@ static int isBranchInstr(struct pt_regs *regs, struct mm_decoded_insn dec_insn, + case spec_op: + switch (insn.r_format.func) { + case jalr_op: +- regs->regs[insn.r_format.rd] = +- regs->cp0_epc + dec_insn.pc_inc + +- dec_insn.next_pc_inc; ++ if (insn.r_format.rd != 0) { ++ regs->regs[insn.r_format.rd] = ++ regs->cp0_epc + dec_insn.pc_inc + ++ dec_insn.next_pc_inc; ++ } + /* Fall through */ + case jr_op: + *contpc = regs->regs[insn.r_format.rs]; +diff --git a/arch/powerpc/kernel/exceptions-64s.S b/arch/powerpc/kernel/exceptions-64s.S +index 3a9ed6ac224b..3aaf76fd7975 100644 +--- a/arch/powerpc/kernel/exceptions-64s.S ++++ b/arch/powerpc/kernel/exceptions-64s.S +@@ -864,11 +864,6 @@ hv_facility_unavailable_relon_trampoline: + #endif + STD_RELON_EXCEPTION_PSERIES(0x5700, 0x1700, altivec_assist) + +- /* Other future vectors */ +- .align 7 +- .globl __end_interrupts +-__end_interrupts: +- + .align 7 + system_call_entry_direct: + #if defined(CONFIG_RELOCATABLE) +@@ -1198,6 +1193,17 @@ __end_handlers: + STD_RELON_EXCEPTION_PSERIES_OOL(0xf60, facility_unavailable) + STD_RELON_EXCEPTION_HV_OOL(0xf80, hv_facility_unavailable) + ++ /* ++ * The __end_interrupts marker must be past the out-of-line (OOL) ++ * handlers, so that they are copied to real address 0x100 when running ++ * a relocatable kernel. This ensures they can be reached from the short ++ * trampoline handlers (like 0x4f00, 0x4f20, etc.) which branch ++ * directly, without using LOAD_HANDLER(). ++ */ ++ .align 7 ++ .globl __end_interrupts ++__end_interrupts: ++ + #if defined(CONFIG_PPC_PSERIES) || defined(CONFIG_PPC_POWERNV) + /* + * Data area reserved for FWNMI option. +diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c +index 91f850585960..72eb7aaf9e8b 100644 +--- a/drivers/acpi/osl.c ++++ b/drivers/acpi/osl.c +@@ -143,7 +143,7 @@ static struct osi_linux { + unsigned int enable:1; + unsigned int dmi:1; + unsigned int cmdline:1; +- unsigned int default_disabling:1; ++ u8 default_disabling; + } osi_linux = {0, 0, 0, 0}; + + static u32 acpi_osi_handler(acpi_string interface, u32 supported) +@@ -1382,10 +1382,13 @@ void __init acpi_osi_setup(char *str) + if (*str == '!') { + str++; + if (*str == '\0') { +- osi_linux.default_disabling = 1; ++ /* Do not override acpi_osi=!* */ ++ if (!osi_linux.default_disabling) ++ osi_linux.default_disabling = ++ ACPI_DISABLE_ALL_VENDOR_STRINGS; + return; + } else if (*str == '*') { +- acpi_update_interfaces(ACPI_DISABLE_ALL_STRINGS); ++ osi_linux.default_disabling = ACPI_DISABLE_ALL_STRINGS; + for (i = 0; i < OSI_STRING_ENTRIES_MAX; i++) { + osi = &osi_setup_entries[i]; + osi->enable = false; +@@ -1458,10 +1461,13 @@ static void __init acpi_osi_setup_late(void) + acpi_status status; + + if (osi_linux.default_disabling) { +- status = acpi_update_interfaces(ACPI_DISABLE_ALL_VENDOR_STRINGS); ++ status = acpi_update_interfaces(osi_linux.default_disabling); + + if (ACPI_SUCCESS(status)) +- printk(KERN_INFO PREFIX "Disabled all _OSI OS vendors\n"); ++ printk(KERN_INFO PREFIX "Disabled all _OSI OS vendors%s\n", ++ osi_linux.default_disabling == ++ ACPI_DISABLE_ALL_STRINGS ? ++ " and feature groups" : ""); + } + + for (i = 0; i < OSI_STRING_ENTRIES_MAX; i++) { +diff --git a/drivers/bluetooth/btmrvl_sdio.c b/drivers/bluetooth/btmrvl_sdio.c +index 00da6df9f71e..65c5f256a5d5 100644 +--- a/drivers/bluetooth/btmrvl_sdio.c ++++ b/drivers/bluetooth/btmrvl_sdio.c +@@ -269,7 +269,7 @@ static int btmrvl_sdio_verify_fw_download(struct btmrvl_sdio_card *card, + if (firmwarestat == FIRMWARE_READY) + return 0; + +- msleep(10); ++ msleep(100); + } + + return -ETIMEDOUT; +diff --git a/drivers/bluetooth/hci_ldisc.c b/drivers/bluetooth/hci_ldisc.c +index c4d2f0e48685..3f6074f7d4bc 100644 +--- a/drivers/bluetooth/hci_ldisc.c ++++ b/drivers/bluetooth/hci_ldisc.c +@@ -225,7 +225,7 @@ static int hci_uart_flush(struct hci_dev *hdev) + tty_ldisc_flush(tty); + tty_driver_flush_buffer(tty); + +- if (test_bit(HCI_UART_PROTO_SET, &hu->flags)) ++ if (test_bit(HCI_UART_PROTO_READY, &hu->flags)) + hu->proto->flush(hu); + + return 0; +@@ -340,7 +340,7 @@ static void hci_uart_tty_close(struct tty_struct *tty) + + cancel_work_sync(&hu->write_work); + +- if (test_and_clear_bit(HCI_UART_PROTO_SET, &hu->flags)) { ++ if (test_and_clear_bit(HCI_UART_PROTO_READY, &hu->flags)) { + if (hdev) { + if (test_bit(HCI_UART_REGISTERED, &hu->flags)) + hci_unregister_dev(hdev); +@@ -348,6 +348,7 @@ static void hci_uart_tty_close(struct tty_struct *tty) + } + hu->proto->close(hu); + } ++ clear_bit(HCI_UART_PROTO_SET, &hu->flags); + + kfree(hu); + } +@@ -374,7 +375,7 @@ static void hci_uart_tty_wakeup(struct tty_struct *tty) + if (tty != hu->tty) + return; + +- if (test_bit(HCI_UART_PROTO_SET, &hu->flags)) ++ if (test_bit(HCI_UART_PROTO_READY, &hu->flags)) + hci_uart_tx_wakeup(hu); + } + +@@ -397,7 +398,7 @@ static void hci_uart_tty_receive(struct tty_struct *tty, const u8 *data, char *f + if (!hu || tty != hu->tty) + return; + +- if (!test_bit(HCI_UART_PROTO_SET, &hu->flags)) ++ if (!test_bit(HCI_UART_PROTO_READY, &hu->flags)) + return; + + spin_lock(&hu->rx_lock); +@@ -474,9 +475,11 @@ static int hci_uart_set_proto(struct hci_uart *hu, int id) + return err; + + hu->proto = p; ++ set_bit(HCI_UART_PROTO_READY, &hu->flags); + + err = hci_uart_register_dev(hu); + if (err) { ++ clear_bit(HCI_UART_PROTO_READY, &hu->flags); + p->close(hu); + return err; + } +diff --git a/drivers/bluetooth/hci_uart.h b/drivers/bluetooth/hci_uart.h +index 12df101ca942..51ecb664d961 100644 +--- a/drivers/bluetooth/hci_uart.h ++++ b/drivers/bluetooth/hci_uart.h +@@ -81,6 +81,7 @@ struct hci_uart { + /* HCI_UART proto flag bits */ + #define HCI_UART_PROTO_SET 0 + #define HCI_UART_REGISTERED 1 ++#define HCI_UART_PROTO_READY 2 + + /* TX states */ + #define HCI_UART_SENDING 1 +diff --git a/drivers/cpuidle/cpuidle.c b/drivers/cpuidle/cpuidle.c +index ef44248a5c37..8626c4761e4d 100644 +--- a/drivers/cpuidle/cpuidle.c ++++ b/drivers/cpuidle/cpuidle.c +@@ -359,6 +359,8 @@ static void __cpuidle_unregister_device(struct cpuidle_device *dev) + list_del(&dev->device_list); + per_cpu(cpuidle_devices, dev->cpu) = NULL; + module_put(drv->owner); ++ ++ dev->registered = 0; + } + + static int __cpuidle_device_init(struct cpuidle_device *dev) +diff --git a/drivers/gpu/drm/drm_fb_helper.c b/drivers/gpu/drm/drm_fb_helper.c +index 49557c957be8..1965b8963606 100644 +--- a/drivers/gpu/drm/drm_fb_helper.c ++++ b/drivers/gpu/drm/drm_fb_helper.c +@@ -1359,7 +1359,6 @@ static int drm_pick_crtcs(struct drm_fb_helper *fb_helper, + int n, int width, int height) + { + int c, o; +- struct drm_device *dev = fb_helper->dev; + struct drm_connector *connector; + struct drm_connector_helper_funcs *connector_funcs; + struct drm_encoder *encoder; +@@ -1380,7 +1379,7 @@ static int drm_pick_crtcs(struct drm_fb_helper *fb_helper, + if (modes[n] == NULL) + return best_score; + +- crtcs = kzalloc(dev->mode_config.num_connector * ++ crtcs = kzalloc(fb_helper->connector_count * + sizeof(struct drm_fb_helper_crtc *), GFP_KERNEL); + if (!crtcs) + return best_score; +@@ -1427,7 +1426,7 @@ static int drm_pick_crtcs(struct drm_fb_helper *fb_helper, + best_crtc = crtc; + best_score = score; + memcpy(best_crtcs, crtcs, +- dev->mode_config.num_connector * ++ fb_helper->connector_count * + sizeof(struct drm_fb_helper_crtc *)); + } + } +diff --git a/drivers/gpu/drm/gma500/mdfld_dsi_pkg_sender.c b/drivers/gpu/drm/gma500/mdfld_dsi_pkg_sender.c +index 489ffd2c66e5..a3d37e4a84ae 100644 +--- a/drivers/gpu/drm/gma500/mdfld_dsi_pkg_sender.c ++++ b/drivers/gpu/drm/gma500/mdfld_dsi_pkg_sender.c +@@ -85,7 +85,7 @@ static const char *const dsi_errors[] = { + "RX Prot Violation", + "HS Generic Write FIFO Full", + "LP Generic Write FIFO Full", +- "Generic Read Data Avail" ++ "Generic Read Data Avail", + "Special Packet Sent", + "Tearing Effect", + }; +diff --git a/drivers/hid/hid-chicony.c b/drivers/hid/hid-chicony.c +index b613d5a79684..bc3cec199fee 100644 +--- a/drivers/hid/hid-chicony.c ++++ b/drivers/hid/hid-chicony.c +@@ -20,6 +20,7 @@ + #include <linux/input.h> + #include <linux/hid.h> + #include <linux/module.h> ++#include <linux/usb.h> + + #include "hid-ids.h" + +@@ -57,10 +58,34 @@ static int ch_input_mapping(struct hid_device *hdev, struct hid_input *hi, + return 1; + } + ++static __u8 *ch_switch12_report_fixup(struct hid_device *hdev, __u8 *rdesc, ++ unsigned int *rsize) ++{ ++ struct usb_interface *intf = to_usb_interface(hdev->dev.parent); ++ ++ if (intf->cur_altsetting->desc.bInterfaceNumber == 1) { ++ /* Change usage maximum and logical maximum from 0x7fff to ++ * 0x2fff, so they don't exceed HID_MAX_USAGES */ ++ switch (hdev->product) { ++ case USB_DEVICE_ID_CHICONY_ACER_SWITCH12: ++ if (*rsize >= 128 && rdesc[64] == 0xff && rdesc[65] == 0x7f ++ && rdesc[69] == 0xff && rdesc[70] == 0x7f) { ++ hid_info(hdev, "Fixing up report descriptor\n"); ++ rdesc[65] = rdesc[70] = 0x2f; ++ } ++ break; ++ } ++ ++ } ++ return rdesc; ++} ++ ++ + static const struct hid_device_id ch_devices[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_TACTICAL_PAD) }, + { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS2) }, + { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_AK1D) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_ACER_SWITCH12) }, + { } + }; + MODULE_DEVICE_TABLE(hid, ch_devices); +@@ -68,6 +93,7 @@ MODULE_DEVICE_TABLE(hid, ch_devices); + static struct hid_driver ch_driver = { + .name = "chicony", + .id_table = ch_devices, ++ .report_fixup = ch_switch12_report_fixup, + .input_mapping = ch_input_mapping, + }; + module_hid_driver(ch_driver); +diff --git a/drivers/hid/hid-core.c b/drivers/hid/hid-core.c +index 7ca1b4a97a14..178651fe449b 100644 +--- a/drivers/hid/hid-core.c ++++ b/drivers/hid/hid-core.c +@@ -704,8 +704,11 @@ static void hid_scan_collection(struct hid_parser *parser, unsigned type) + hid->group = HID_GROUP_SENSOR_HUB; + + if (hid->vendor == USB_VENDOR_ID_MICROSOFT && +- (hid->product == USB_DEVICE_ID_MS_TYPE_COVER_3 || +- hid->product == USB_DEVICE_ID_MS_TYPE_COVER_3_JP) && ++ (hid->product == USB_DEVICE_ID_MS_TYPE_COVER_PRO_3 || ++ hid->product == USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_2 || ++ hid->product == USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_JP || ++ hid->product == USB_DEVICE_ID_MS_TYPE_COVER_3 || ++ hid->product == USB_DEVICE_ID_MS_POWER_COVER) && + hid->group == HID_GROUP_MULTITOUCH) + hid->group = HID_GROUP_GENERIC; + } +@@ -1716,6 +1719,7 @@ static const struct hid_device_id hid_have_special_driver[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS) }, + { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS2) }, + { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_AK1D) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_ACER_SWITCH12) }, + { HID_USB_DEVICE(USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_PRODIKEYS_PCMIDI) }, + { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_1) }, + { HID_USB_DEVICE(USB_VENDOR_ID_CYPRESS, USB_DEVICE_ID_CYPRESS_BARCODE_2) }, +@@ -1800,6 +1804,7 @@ static const struct hid_device_id hid_have_special_driver[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICOLCD) }, + { HID_USB_DEVICE(USB_VENDOR_ID_MICROCHIP, USB_DEVICE_ID_PICOLCD_BOOTLOADER) }, + { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_COMFORT_MOUSE_4500) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_COMFORT_KEYBOARD) }, + { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_SIDEWINDER_GV) }, + { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_NE4K) }, + { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_NE4K_JP) }, +@@ -1809,8 +1814,14 @@ static const struct hid_device_id hid_have_special_driver[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_DIGITAL_MEDIA_3K) }, + { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_WIRELESS_OPTICAL_DESKTOP_3_0) }, + { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_OFFICE_KB) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_2) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_JP) }, + { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3) }, +- { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3_JP) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_DIGITAL_MEDIA_7K) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_DIGITAL_MEDIA_600) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_DIGITAL_MEDIA_3KV1) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_POWER_COVER) }, + { HID_USB_DEVICE(USB_VENDOR_ID_MONTEREY, USB_DEVICE_ID_GENIUS_KB29E) }, + { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN) }, + { HID_USB_DEVICE(USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_TOUCH_SCREEN_1) }, +@@ -1898,6 +1909,7 @@ static const struct hid_device_id hid_have_special_driver[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP_LTD, USB_DEVICE_ID_SUPER_JOY_BOX_5_PRO) }, + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_GRAPHIRE_BLUETOOTH) }, + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_WACOM, USB_DEVICE_ID_WACOM_INTUOS4_BLUETOOTH) }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_PLAYDOTCOM, USB_DEVICE_ID_PLAYDOTCOM_EMS_USBII) }, + { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SLIM_TABLET_5_8_INCH) }, + { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_SLIM_TABLET_12_1_INCH) }, + { HID_USB_DEVICE(USB_VENDOR_ID_WALTOP, USB_DEVICE_ID_WALTOP_Q_PAD) }, +diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h +index 50b25fad982d..8a33a5967917 100644 +--- a/drivers/hid/hid-ids.h ++++ b/drivers/hid/hid-ids.h +@@ -224,6 +224,7 @@ + #define USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE 0x1053 + #define USB_DEVICE_ID_CHICONY_WIRELESS2 0x1123 + #define USB_DEVICE_ID_CHICONY_AK1D 0x1125 ++#define USB_DEVICE_ID_CHICONY_ACER_SWITCH12 0x1421 + + #define USB_VENDOR_ID_CHUNGHWAT 0x2247 + #define USB_DEVICE_ID_CHUNGHWAT_MULTITOUCH 0x0001 +@@ -237,7 +238,17 @@ + #define USB_DEVICE_ID_CODEMERCS_IOW_FIRST 0x1500 + #define USB_DEVICE_ID_CODEMERCS_IOW_LAST 0x15ff + ++#define USB_VENDOR_ID_CORSAIR 0x1b1c ++ ++#define USB_VENDOR_ID_CORSAIR 0x1b1c ++#define USB_DEVICE_ID_CORSAIR_K70R 0x1b09 ++#define USB_DEVICE_ID_CORSAIR_K95RGB 0x1b11 ++#define USB_DEVICE_ID_CORSAIR_M65RGB 0x1b12 ++#define USB_DEVICE_ID_CORSAIR_K70RGB 0x1b13 ++#define USB_DEVICE_ID_CORSAIR_K65RGB 0x1b17 ++ + #define USB_VENDOR_ID_CREATIVELABS 0x041e ++#define USB_DEVICE_ID_CREATIVE_SB_OMNI_SURROUND_51 0x322c + #define USB_DEVICE_ID_PRODIKEYS_PCMIDI 0x2801 + + #define USB_VENDOR_ID_CVTOUCH 0x1ff7 +@@ -631,6 +642,7 @@ + #define USB_DEVICE_ID_SIDEWINDER_GV 0x003b + #define USB_DEVICE_ID_MS_OFFICE_KB 0x0048 + #define USB_DEVICE_ID_WIRELESS_OPTICAL_DESKTOP_3_0 0x009d ++#define USB_DEVICE_ID_MS_DIGITAL_MEDIA_7K 0x00b4 + #define USB_DEVICE_ID_MS_NE4K 0x00db + #define USB_DEVICE_ID_MS_NE4K_JP 0x00dc + #define USB_DEVICE_ID_MS_LK6K 0x00f9 +@@ -638,9 +650,18 @@ + #define USB_DEVICE_ID_MS_PRESENTER_8K_USB 0x0713 + #define USB_DEVICE_ID_MS_NE7K 0x071d + #define USB_DEVICE_ID_MS_DIGITAL_MEDIA_3K 0x0730 ++#define USB_DEVICE_ID_MS_DIGITAL_MEDIA_3KV1 0x0732 ++#define USB_DEVICE_ID_MS_DIGITAL_MEDIA_600 0x0750 + #define USB_DEVICE_ID_MS_COMFORT_MOUSE_4500 0x076c +-#define USB_DEVICE_ID_MS_TYPE_COVER_3 0x07dc +-#define USB_DEVICE_ID_MS_TYPE_COVER_3_JP 0x07dd ++#define USB_DEVICE_ID_MS_COMFORT_KEYBOARD 0x00e3 ++#define USB_DEVICE_ID_MS_SURFACE_PRO_2 0x0799 ++#define USB_DEVICE_ID_MS_TOUCH_COVER_2 0x07a7 ++#define USB_DEVICE_ID_MS_TYPE_COVER_2 0x07a9 ++#define USB_DEVICE_ID_MS_TYPE_COVER_PRO_3 0x07dc ++#define USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_2 0x07e2 ++#define USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_JP 0x07dd ++#define USB_DEVICE_ID_MS_TYPE_COVER_3 0x07de ++#define USB_DEVICE_ID_MS_POWER_COVER 0x07da + + #define USB_VENDOR_ID_MOJO 0x8282 + #define USB_DEVICE_ID_RETRO_ADAPTER 0x3201 +@@ -781,6 +802,7 @@ + + #define USB_VENDOR_ID_SEMICO 0x1a2c + #define USB_DEVICE_ID_SEMICO_USB_KEYKOARD 0x0023 ++#define USB_DEVICE_ID_SEMICO_USB_KEYKOARD2 0x0027 + + #define USB_VENDOR_ID_SENNHEISER 0x1395 + #define USB_DEVICE_ID_SENNHEISER_BTD500USB 0x002c +diff --git a/drivers/hid/hid-microsoft.c b/drivers/hid/hid-microsoft.c +index 7e56e18665da..8dfc58ac9d52 100644 +--- a/drivers/hid/hid-microsoft.c ++++ b/drivers/hid/hid-microsoft.c +@@ -252,14 +252,28 @@ static const struct hid_device_id ms_devices[] = { + .driver_data = MS_PRESENTER }, + { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_DIGITAL_MEDIA_3K), + .driver_data = MS_ERGONOMY | MS_RDESC_3K }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_DIGITAL_MEDIA_7K), ++ .driver_data = MS_ERGONOMY }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_DIGITAL_MEDIA_600), ++ .driver_data = MS_ERGONOMY }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_DIGITAL_MEDIA_3KV1), ++ .driver_data = MS_ERGONOMY }, + { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_WIRELESS_OPTICAL_DESKTOP_3_0), + .driver_data = MS_NOGET }, + { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_COMFORT_MOUSE_4500), + .driver_data = MS_DUPLICATE_USAGES }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3), ++ .driver_data = MS_HIDINPUT }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_2), ++ .driver_data = MS_HIDINPUT }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_JP), ++ .driver_data = MS_HIDINPUT }, + { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3), + .driver_data = MS_HIDINPUT }, +- { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3_JP), ++ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_POWER_COVER), + .driver_data = MS_HIDINPUT }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_COMFORT_KEYBOARD), ++ .driver_data = MS_ERGONOMY}, + + { HID_BLUETOOTH_DEVICE(USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_PRESENTER_8K_BT), + .driver_data = MS_PRESENTER }, +diff --git a/drivers/hid/hid-sjoy.c b/drivers/hid/hid-sjoy.c +index 37845eccddb5..36b6470af947 100644 +--- a/drivers/hid/hid-sjoy.c ++++ b/drivers/hid/hid-sjoy.c +@@ -166,6 +166,9 @@ static const struct hid_device_id sjoy_devices[] = { + { HID_USB_DEVICE(USB_VENDOR_ID_WISEGROUP, USB_DEVICE_ID_DUAL_USB_JOYPAD), + .driver_data = HID_QUIRK_MULTI_INPUT | + HID_QUIRK_SKIP_OUTPUT_REPORTS }, ++ { HID_USB_DEVICE(USB_VENDOR_ID_PLAYDOTCOM, USB_DEVICE_ID_PLAYDOTCOM_EMS_USBII), ++ .driver_data = HID_QUIRK_MULTI_INPUT | ++ HID_QUIRK_SKIP_OUTPUT_REPORTS }, + { } + }; + MODULE_DEVICE_TABLE(hid, sjoy_devices); +diff --git a/drivers/hid/hid-wiimote-modules.c b/drivers/hid/hid-wiimote-modules.c +index e30567af42ed..20e102866549 100644 +--- a/drivers/hid/hid-wiimote-modules.c ++++ b/drivers/hid/hid-wiimote-modules.c +@@ -1951,9 +1951,11 @@ static void wiimod_mp_in_mp(struct wiimote_data *wdata, const __u8 *ext) + * -----+------------------------------+-----+-----+ + * The single bits Yaw, Roll, Pitch in the lower right corner specify + * whether the wiimote is rotating fast (0) or slow (1). Speed for slow +- * roation is 440 deg/s and for fast rotation 2000 deg/s. To get a +- * linear scale we multiply by 2000/440 = ~4.5454 which is 18 for fast +- * and 9 for slow. ++ * roation is 8192/440 units / deg/s and for fast rotation 8192/2000 ++ * units / deg/s. To get a linear scale for fast rotation we multiply ++ * by 2000/440 = ~4.5454 and scale both fast and slow by 9 to match the ++ * previous scale reported by this driver. ++ * This leaves a linear scale with 8192*9/440 (~167.564) units / deg/s. + * If the wiimote is not rotating the sensor reports 2^13 = 8192. + * Ext specifies whether an extension is connected to the motionp. + * which is parsed by wiimote-core. +@@ -1972,15 +1974,15 @@ static void wiimod_mp_in_mp(struct wiimote_data *wdata, const __u8 *ext) + z -= 8192; + + if (!(ext[3] & 0x02)) +- x *= 18; ++ x = (x * 2000 * 9) / 440; + else + x *= 9; + if (!(ext[4] & 0x02)) +- y *= 18; ++ y = (y * 2000 * 9) / 440; + else + y *= 9; + if (!(ext[3] & 0x01)) +- z *= 18; ++ z = (z * 2000 * 9) / 440; + else + z *= 9; + +diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c +index 7166d7fb43de..d63f7e45b539 100644 +--- a/drivers/hid/usbhid/hid-quirks.c ++++ b/drivers/hid/usbhid/hid-quirks.c +@@ -52,7 +52,6 @@ static const struct hid_blacklist { + { USB_VENDOR_ID_ETURBOTOUCH, USB_DEVICE_ID_ETURBOTOUCH_2968, HID_QUIRK_MULTI_INPUT }, + { USB_VENDOR_ID_GREENASIA, USB_DEVICE_ID_GREENASIA_DUAL_USB_JOYPAD, HID_QUIRK_MULTI_INPUT }, + { USB_VENDOR_ID_PANTHERLORD, USB_DEVICE_ID_PANTHERLORD_TWIN_USB_JOYSTICK, HID_QUIRK_MULTI_INPUT | HID_QUIRK_SKIP_OUTPUT_REPORTS }, +- { USB_VENDOR_ID_PLAYDOTCOM, USB_DEVICE_ID_PLAYDOTCOM_EMS_USBII, HID_QUIRK_MULTI_INPUT }, + { USB_VENDOR_ID_TOUCHPACK, USB_DEVICE_ID_TOUCHPACK_RTS, HID_QUIRK_MULTI_INPUT }, + + { USB_VENDOR_ID_AIREN, USB_DEVICE_ID_AIREN_SLIMPLUS, HID_QUIRK_NOGET }, +@@ -70,6 +69,12 @@ static const struct hid_blacklist { + { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_3AXIS_5BUTTON_STICK, HID_QUIRK_NOGET }, + { USB_VENDOR_ID_CH, USB_DEVICE_ID_CH_AXIS_295, HID_QUIRK_NOGET }, + { USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_PIXART_USB_OPTICAL_MOUSE, HID_QUIRK_ALWAYS_POLL }, ++ { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70R, HID_QUIRK_NO_INIT_REPORTS }, ++ { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_M65RGB, HID_QUIRK_NO_INIT_REPORTS }, ++ { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K95RGB, HID_QUIRK_NO_INIT_REPORTS | HID_QUIRK_ALWAYS_POLL }, ++ { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K70RGB, HID_QUIRK_NO_INIT_REPORTS }, ++ { USB_VENDOR_ID_CORSAIR, USB_DEVICE_ID_CORSAIR_K65RGB, HID_QUIRK_NO_INIT_REPORTS }, ++ { USB_VENDOR_ID_CREATIVELABS, USB_DEVICE_ID_CREATIVE_SB_OMNI_SURROUND_51, HID_QUIRK_NOGET }, + { USB_VENDOR_ID_DMI, USB_DEVICE_ID_DMI_ENC, HID_QUIRK_NOGET }, + { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN, HID_QUIRK_ALWAYS_POLL }, + { USB_VENDOR_ID_ELAN, USB_DEVICE_ID_ELAN_TOUCHSCREEN_009B, HID_QUIRK_ALWAYS_POLL }, +@@ -81,8 +86,11 @@ static const struct hid_blacklist { + { USB_VENDOR_ID_FREESCALE, USB_DEVICE_ID_FREESCALE_MX28, HID_QUIRK_NOGET }, + { USB_VENDOR_ID_LOGITECH, USB_DEVICE_ID_LOGITECH_C077, HID_QUIRK_ALWAYS_POLL }, + { USB_VENDOR_ID_MGE, USB_DEVICE_ID_MGE_UPS, HID_QUIRK_NOGET }, ++ { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3, HID_QUIRK_NO_INIT_REPORTS }, ++ { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_2, HID_QUIRK_NO_INIT_REPORTS }, ++ { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_PRO_3_JP, HID_QUIRK_NO_INIT_REPORTS }, + { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3, HID_QUIRK_NO_INIT_REPORTS }, +- { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_TYPE_COVER_3_JP, HID_QUIRK_NO_INIT_REPORTS }, ++ { USB_VENDOR_ID_MICROSOFT, USB_DEVICE_ID_MS_POWER_COVER, HID_QUIRK_NO_INIT_REPORTS }, + { USB_VENDOR_ID_MSI, USB_DEVICE_ID_MSI_GX680R_LED_PANEL, HID_QUIRK_NO_INIT_REPORTS }, + { USB_VENDOR_ID_NEXIO, USB_DEVICE_ID_NEXIO_MULTITOUCH_PTI0750, HID_QUIRK_NO_INIT_REPORTS }, + { USB_VENDOR_ID_NOVATEK, USB_DEVICE_ID_NOVATEK_MOUSE, HID_QUIRK_NO_INIT_REPORTS }, +@@ -133,6 +141,7 @@ static const struct hid_blacklist { + { USB_VENDOR_ID_KYE, USB_DEVICE_ID_KYE_PENSKETCH_M912, HID_QUIRK_MULTI_INPUT }, + { USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_DUOSENSE, HID_QUIRK_NO_INIT_REPORTS }, + { USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD, HID_QUIRK_NO_INIT_REPORTS }, ++ { USB_VENDOR_ID_SEMICO, USB_DEVICE_ID_SEMICO_USB_KEYKOARD2, HID_QUIRK_NO_INIT_REPORTS }, + { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS1, HID_QUIRK_NO_INIT_REPORTS }, + { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS2, HID_QUIRK_NO_INIT_REPORTS }, + { USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_HD, HID_QUIRK_NO_INIT_REPORTS }, +diff --git a/drivers/infiniband/core/ucm.c b/drivers/infiniband/core/ucm.c +index f2f63933e8a9..5befec118a18 100644 +--- a/drivers/infiniband/core/ucm.c ++++ b/drivers/infiniband/core/ucm.c +@@ -48,6 +48,7 @@ + + #include <asm/uaccess.h> + ++#include <rdma/ib.h> + #include <rdma/ib_cm.h> + #include <rdma/ib_user_cm.h> + #include <rdma/ib_marshall.h> +@@ -1104,6 +1105,9 @@ static ssize_t ib_ucm_write(struct file *filp, const char __user *buf, + struct ib_ucm_cmd_hdr hdr; + ssize_t result; + ++ if (WARN_ON_ONCE(!ib_safe_file_access(filp))) ++ return -EACCES; ++ + if (len < sizeof(hdr)) + return -EINVAL; + +diff --git a/drivers/infiniband/core/ucma.c b/drivers/infiniband/core/ucma.c +index b0f189be543b..da67839fc451 100644 +--- a/drivers/infiniband/core/ucma.c ++++ b/drivers/infiniband/core/ucma.c +@@ -1494,6 +1494,9 @@ static ssize_t ucma_write(struct file *filp, const char __user *buf, + struct rdma_ucm_cmd_hdr hdr; + ssize_t ret; + ++ if (WARN_ON_ONCE(!ib_safe_file_access(filp))) ++ return -EACCES; ++ + if (len < sizeof(hdr)) + return -EINVAL; + +diff --git a/drivers/infiniband/core/uverbs_main.c b/drivers/infiniband/core/uverbs_main.c +index 68e5496c5d58..ee5222168b68 100644 +--- a/drivers/infiniband/core/uverbs_main.c ++++ b/drivers/infiniband/core/uverbs_main.c +@@ -48,6 +48,8 @@ + + #include <asm/uaccess.h> + ++#include <rdma/ib.h> ++ + #include "uverbs.h" + + MODULE_AUTHOR("Roland Dreier"); +@@ -601,6 +603,9 @@ static ssize_t ib_uverbs_write(struct file *filp, const char __user *buf, + struct ib_uverbs_file *file = filp->private_data; + struct ib_uverbs_cmd_hdr hdr; + ++ if (WARN_ON_ONCE(!ib_safe_file_access(filp))) ++ return -EACCES; ++ + if (count < sizeof hdr) + return -EINVAL; + +diff --git a/drivers/infiniband/hw/ipath/ipath_file_ops.c b/drivers/infiniband/hw/ipath/ipath_file_ops.c +index 6d7f453b4d05..a0626b8c61c5 100644 +--- a/drivers/infiniband/hw/ipath/ipath_file_ops.c ++++ b/drivers/infiniband/hw/ipath/ipath_file_ops.c +@@ -45,6 +45,8 @@ + #include <linux/cpu.h> + #include <asm/pgtable.h> + ++#include <rdma/ib.h> ++ + #include "ipath_kernel.h" + #include "ipath_common.h" + #include "ipath_user_sdma.h" +@@ -2240,6 +2242,9 @@ static ssize_t ipath_write(struct file *fp, const char __user *data, + ssize_t ret = 0; + void *dest; + ++ if (WARN_ON_ONCE(!ib_safe_file_access(fp))) ++ return -EACCES; ++ + if (count < sizeof(cmd.type)) { + ret = -EINVAL; + goto bail; +diff --git a/drivers/infiniband/hw/qib/qib_file_ops.c b/drivers/infiniband/hw/qib/qib_file_ops.c +index 2023cd61b897..3c089ca85c64 100644 +--- a/drivers/infiniband/hw/qib/qib_file_ops.c ++++ b/drivers/infiniband/hw/qib/qib_file_ops.c +@@ -45,6 +45,8 @@ + #include <linux/delay.h> + #include <linux/export.h> + ++#include <rdma/ib.h> ++ + #include "qib.h" + #include "qib_common.h" + #include "qib_user_sdma.h" +@@ -2058,6 +2060,9 @@ static ssize_t qib_write(struct file *fp, const char __user *data, + ssize_t ret = 0; + void *dest; + ++ if (WARN_ON_ONCE(!ib_safe_file_access(fp))) ++ return -EACCES; ++ + if (count < sizeof(cmd.type)) { + ret = -EINVAL; + goto bail; +diff --git a/drivers/input/misc/uinput.c b/drivers/input/misc/uinput.c +index a0a4bbaef02c..3f2f3ac96a55 100644 +--- a/drivers/input/misc/uinput.c ++++ b/drivers/input/misc/uinput.c +@@ -835,9 +835,15 @@ static long uinput_ioctl(struct file *file, unsigned int cmd, unsigned long arg) + } + + #ifdef CONFIG_COMPAT ++ ++#define UI_SET_PHYS_COMPAT _IOW(UINPUT_IOCTL_BASE, 108, compat_uptr_t) ++ + static long uinput_compat_ioctl(struct file *file, + unsigned int cmd, unsigned long arg) + { ++ if (cmd == UI_SET_PHYS_COMPAT) ++ cmd = UI_SET_PHYS; ++ + return uinput_ioctl_handler(file, cmd, arg, compat_ptr(arg)); + } + #endif +diff --git a/drivers/media/usb/usbvision/usbvision-video.c b/drivers/media/usb/usbvision/usbvision-video.c +index d4a222ea8197..bd8f4151884b 100644 +--- a/drivers/media/usb/usbvision/usbvision-video.c ++++ b/drivers/media/usb/usbvision/usbvision-video.c +@@ -1539,13 +1539,6 @@ static int usbvision_probe(struct usb_interface *intf, + printk(KERN_INFO "%s: %s found\n", __func__, + usbvision_device_data[model].model_string); + +- /* +- * this is a security check. +- * an exploit using an incorrect bInterfaceNumber is known +- */ +- if (ifnum >= USB_MAXINTERFACES || !dev->actconfig->interface[ifnum]) +- return -ENODEV; +- + if (usbvision_device_data[model].interface >= 0) + interface = &dev->actconfig->interface[usbvision_device_data[model].interface]->altsetting[0]; + else if (ifnum < dev->actconfig->desc.bNumInterfaces) +diff --git a/drivers/misc/ad525x_dpot.c b/drivers/misc/ad525x_dpot.c +index 65fb74402c37..49811a8a1b07 100644 +--- a/drivers/misc/ad525x_dpot.c ++++ b/drivers/misc/ad525x_dpot.c +@@ -458,7 +458,7 @@ static ssize_t sysfs_set_reg(struct device *dev, + int err; + + if (reg & DPOT_ADDR_OTP_EN) { +- if (!strncmp(buf, "enabled", sizeof("enabled"))) ++ if (sysfs_streq(buf, "enabled")) + set_bit(DPOT_RDAC_MASK & reg, data->otp_en_mask); + else + clear_bit(DPOT_RDAC_MASK & reg, data->otp_en_mask); +diff --git a/drivers/misc/pch_phub.c b/drivers/misc/pch_phub.c +index a5925f7f17f6..829ca77c143e 100644 +--- a/drivers/misc/pch_phub.c ++++ b/drivers/misc/pch_phub.c +@@ -512,8 +512,10 @@ static ssize_t pch_phub_bin_read(struct file *filp, struct kobject *kobj, + + /* Get Rom signature */ + chip->pch_phub_extrom_base_address = pci_map_rom(chip->pdev, &rom_size); +- if (!chip->pch_phub_extrom_base_address) ++ if (!chip->pch_phub_extrom_base_address) { ++ err = -ENODATA; + goto exrom_map_err; ++ } + + pch_phub_read_serial_rom(chip, chip->pch_opt_rom_start_address, + (unsigned char *)&rom_signature); +diff --git a/drivers/mmc/card/block.c b/drivers/mmc/card/block.c +index 30076b4f3fee..ee76ff2af935 100644 +--- a/drivers/mmc/card/block.c ++++ b/drivers/mmc/card/block.c +@@ -2352,11 +2352,12 @@ static const struct mmc_fixup blk_fixups[] = + MMC_QUIRK_BLK_NO_CMD23), + + /* +- * Some Micron MMC cards needs longer data read timeout than +- * indicated in CSD. ++ * Some MMC cards need longer data read timeout than indicated in CSD. + */ + MMC_FIXUP(CID_NAME_ANY, CID_MANFID_MICRON, 0x200, add_quirk_mmc, + MMC_QUIRK_LONG_READ_TIME), ++ MMC_FIXUP("008GE0", CID_MANFID_TOSHIBA, CID_OEMID_ANY, add_quirk_mmc, ++ MMC_QUIRK_LONG_READ_TIME), + + /* + * On these Samsung MoviNAND parts, performing secure erase or +diff --git a/drivers/mmc/core/core.c b/drivers/mmc/core/core.c +index 4b12543b0826..3513a5a91c2a 100644 +--- a/drivers/mmc/core/core.c ++++ b/drivers/mmc/core/core.c +@@ -821,11 +821,11 @@ void mmc_set_data_timeout(struct mmc_data *data, const struct mmc_card *card) + /* + * Some cards require longer data read timeout than indicated in CSD. + * Address this by setting the read timeout to a "reasonably high" +- * value. For the cards tested, 300ms has proven enough. If necessary, ++ * value. For the cards tested, 600ms has proven enough. If necessary, + * this value can be increased if other problematic cards require this. + */ + if (mmc_card_long_read_time(card) && data->flags & MMC_DATA_READ) { +- data->timeout_ns = 300000000; ++ data->timeout_ns = 600000000; + data->timeout_clks = 0; + } + +diff --git a/drivers/mmc/core/mmc.c b/drivers/mmc/core/mmc.c +index 36d6701de972..21fdf157d8f7 100644 +--- a/drivers/mmc/core/mmc.c ++++ b/drivers/mmc/core/mmc.c +@@ -266,6 +266,9 @@ static void mmc_select_card_type(struct mmc_card *card) + card->ext_csd.card_type = card_type; + } + ++/* Minimum partition switch timeout in milliseconds */ ++#define MMC_MIN_PART_SWITCH_TIME 300 ++ + /* + * Decode extended CSD. + */ +@@ -329,6 +332,10 @@ static int mmc_read_ext_csd(struct mmc_card *card, u8 *ext_csd) + + /* EXT_CSD value is in units of 10ms, but we store in ms */ + card->ext_csd.part_time = 10 * ext_csd[EXT_CSD_PART_SWITCH_TIME]; ++ /* Some eMMC set the value too low so set a minimum */ ++ if (card->ext_csd.part_time && ++ card->ext_csd.part_time < MMC_MIN_PART_SWITCH_TIME) ++ card->ext_csd.part_time = MMC_MIN_PART_SWITCH_TIME; + + /* Sleep / awake timeout in 100ns units */ + if (sa_shift > 0 && sa_shift <= 0x17) +diff --git a/drivers/net/wireless/ath/ath5k/led.c b/drivers/net/wireless/ath/ath5k/led.c +index f77ef36acf87..61879b1f7083 100644 +--- a/drivers/net/wireless/ath/ath5k/led.c ++++ b/drivers/net/wireless/ath/ath5k/led.c +@@ -77,7 +77,7 @@ static DEFINE_PCI_DEVICE_TABLE(ath5k_led_devices) = { + /* HP Compaq CQ60-206US (ddregg...@jumptv.com) */ + { ATH_SDEVICE(PCI_VENDOR_ID_HP, 0x0137a), ATH_LED(3, 1) }, + /* HP Compaq C700 (nitrous...@gmail.com) */ +- { ATH_SDEVICE(PCI_VENDOR_ID_HP, 0x0137b), ATH_LED(3, 1) }, ++ { ATH_SDEVICE(PCI_VENDOR_ID_HP, 0x0137b), ATH_LED(3, 0) }, + /* LiteOn AR5BXB63 (mag...@salug.it) */ + { ATH_SDEVICE(PCI_VENDOR_ID_ATHEROS, 0x3067), ATH_LED(3, 0) }, + /* IBM-specific AR5212 (all others) */ +diff --git a/drivers/net/wireless/rtlwifi/base.c b/drivers/net/wireless/rtlwifi/base.c +index e99d8b1aa3bd..3fd83a87194f 100644 +--- a/drivers/net/wireless/rtlwifi/base.c ++++ b/drivers/net/wireless/rtlwifi/base.c +@@ -1402,9 +1402,9 @@ void rtl_watchdog_wq_callback(void *data) + if (((rtlpriv->link_info.num_rx_inperiod + + rtlpriv->link_info.num_tx_inperiod) > 8) || + (rtlpriv->link_info.num_rx_inperiod > 2)) +- rtlpriv->enter_ps = true; +- else + rtlpriv->enter_ps = false; ++ else ++ rtlpriv->enter_ps = true; + + /* LeisurePS only work in infra mode. */ + schedule_work(&rtlpriv->works.lps_change_work); +diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c +index 51379906c69c..53b23ff577b4 100644 +--- a/drivers/pci/probe.c ++++ b/drivers/pci/probe.c +@@ -175,9 +175,6 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type, + struct pci_bus_region region, inverted_region; + bool bar_too_big = false, bar_disabled = false; + +- if (dev->non_compliant_bars) +- return 0; +- + mask = type ? PCI_ROM_ADDRESS_MASK : ~0; + + /* No printks while decoding is disabled! */ +@@ -319,6 +316,9 @@ static void pci_read_bases(struct pci_dev *dev, unsigned int howmany, int rom) + { + unsigned int pos, reg; + ++ if (dev->non_compliant_bars) ++ return; ++ + for (pos = 0; pos < howmany; pos++) { + struct resource *res = &dev->resource[pos]; + reg = PCI_BASE_ADDRESS_0 + (pos << 2); +diff --git a/drivers/scsi/aacraid/commsup.c b/drivers/scsi/aacraid/commsup.c +index 6b32ddcefc11..ce177a50ec05 100644 +--- a/drivers/scsi/aacraid/commsup.c ++++ b/drivers/scsi/aacraid/commsup.c +@@ -590,10 +590,10 @@ int aac_fib_send(u16 command, struct fib *fibptr, unsigned long size, + } + return -EFAULT; + } +- /* We used to udelay() here but that absorbed +- * a CPU when a timeout occured. Not very +- * useful. */ +- cpu_relax(); ++ /* ++ * Allow other processes / CPUS to use core ++ */ ++ schedule(); + } + } else if (down_interruptible(&fibptr->event_wait)) { + /* Do nothing ... satisfy +@@ -1921,6 +1921,10 @@ int aac_command_thread(void *data) + if (difference <= 0) + difference = 1; + set_current_state(TASK_INTERRUPTIBLE); ++ ++ if (kthread_should_stop()) ++ break; ++ + schedule_timeout(difference); + + if (kthread_should_stop()) +diff --git a/drivers/tty/serial/samsung.c b/drivers/tty/serial/samsung.c +index 6b0adfbfacaf..663508b760d8 100644 +--- a/drivers/tty/serial/samsung.c ++++ b/drivers/tty/serial/samsung.c +@@ -727,6 +727,8 @@ static void s3c24xx_serial_set_termios(struct uart_port *port, + /* check to see if we need to change clock source */ + + if (ourport->baudclk != clk) { ++ clk_prepare_enable(clk); ++ + s3c24xx_serial_setsource(port, clk_sel); + + if (!IS_ERR(ourport->baudclk)) { +@@ -734,8 +736,6 @@ static void s3c24xx_serial_set_termios(struct uart_port *port, + ourport->baudclk = ERR_PTR(-EINVAL); + } + +- clk_prepare_enable(clk); +- + ourport->baudclk = clk; + ourport->baudclk_rate = clk ? clk_get_rate(clk) : 0; + } +diff --git a/drivers/tty/vt/vt.c b/drivers/tty/vt/vt.c +index e341fd52a80d..19aba5091408 100644 +--- a/drivers/tty/vt/vt.c ++++ b/drivers/tty/vt/vt.c +@@ -3503,9 +3503,10 @@ static int do_register_con_driver(const struct consw *csw, int first, int last) + goto err; + + desc = csw->con_startup(); +- +- if (!desc) ++ if (!desc) { ++ retval = -ENODEV; + goto err; ++ } + + retval = -EINVAL; + +diff --git a/drivers/usb/serial/io_edgeport.c b/drivers/usb/serial/io_edgeport.c +index c91481d74a14..0d037cc40e51 100644 +--- a/drivers/usb/serial/io_edgeport.c ++++ b/drivers/usb/serial/io_edgeport.c +@@ -2879,14 +2879,15 @@ static int edge_startup(struct usb_serial *serial) + usb_alloc_urb(0, GFP_KERNEL); + if (!edge_serial->interrupt_read_urb) { + dev_err(ddev, "out of memory\n"); +- return -ENOMEM; ++ response = -ENOMEM; ++ break; + } + edge_serial->interrupt_in_buffer = + kmalloc(buffer_size, GFP_KERNEL); + if (!edge_serial->interrupt_in_buffer) { + dev_err(ddev, "out of memory\n"); +- usb_free_urb(edge_serial->interrupt_read_urb); +- return -ENOMEM; ++ response = -ENOMEM; ++ break; + } + edge_serial->interrupt_in_endpoint = + endpoint->bEndpointAddress; +@@ -2916,14 +2917,15 @@ static int edge_startup(struct usb_serial *serial) + usb_alloc_urb(0, GFP_KERNEL); + if (!edge_serial->read_urb) { + dev_err(ddev, "out of memory\n"); +- return -ENOMEM; ++ response = -ENOMEM; ++ break; + } + edge_serial->bulk_in_buffer = + kmalloc(buffer_size, GFP_KERNEL); + if (!edge_serial->bulk_in_buffer) { + dev_err(&dev->dev, "out of memory\n"); +- usb_free_urb(edge_serial->read_urb); +- return -ENOMEM; ++ response = -ENOMEM; ++ break; + } + edge_serial->bulk_in_endpoint = + endpoint->bEndpointAddress; +@@ -2949,9 +2951,22 @@ static int edge_startup(struct usb_serial *serial) + } + } + +- if (!interrupt_in_found || !bulk_in_found || !bulk_out_found) { +- dev_err(ddev, "Error - the proper endpoints were not found!\n"); +- return -ENODEV; ++ if (response || !interrupt_in_found || !bulk_in_found || ++ !bulk_out_found) { ++ if (!response) { ++ dev_err(ddev, "expected endpoints not found\n"); ++ response = -ENODEV; ++ } ++ ++ usb_free_urb(edge_serial->interrupt_read_urb); ++ kfree(edge_serial->interrupt_in_buffer); ++ ++ usb_free_urb(edge_serial->read_urb); ++ kfree(edge_serial->bulk_in_buffer); ++ ++ kfree(edge_serial); ++ ++ return response; + } + + /* start interrupt read for this edgeport this interrupt will +@@ -2974,16 +2989,9 @@ static void edge_disconnect(struct usb_serial *serial) + { + struct edgeport_serial *edge_serial = usb_get_serial_data(serial); + +- /* stop reads and writes on all ports */ +- /* free up our endpoint stuff */ + if (edge_serial->is_epic) { + usb_kill_urb(edge_serial->interrupt_read_urb); +- usb_free_urb(edge_serial->interrupt_read_urb); +- kfree(edge_serial->interrupt_in_buffer); +- + usb_kill_urb(edge_serial->read_urb); +- usb_free_urb(edge_serial->read_urb); +- kfree(edge_serial->bulk_in_buffer); + } + } + +@@ -2996,6 +3004,16 @@ static void edge_release(struct usb_serial *serial) + { + struct edgeport_serial *edge_serial = usb_get_serial_data(serial); + ++ if (edge_serial->is_epic) { ++ usb_kill_urb(edge_serial->interrupt_read_urb); ++ usb_free_urb(edge_serial->interrupt_read_urb); ++ kfree(edge_serial->interrupt_in_buffer); ++ ++ usb_kill_urb(edge_serial->read_urb); ++ usb_free_urb(edge_serial->read_urb); ++ kfree(edge_serial->bulk_in_buffer); ++ } ++ + kfree(edge_serial); + } + +diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c +index e58e21b46ef0..5419ccc72428 100644 +--- a/drivers/usb/serial/keyspan.c ++++ b/drivers/usb/serial/keyspan.c +@@ -2411,6 +2411,10 @@ static void keyspan_release(struct usb_serial *serial) + + s_priv = usb_get_serial_data(serial); + ++ /* Make sure to unlink the URBs submitted in attach. */ ++ usb_kill_urb(s_priv->instat_urb); ++ usb_kill_urb(s_priv->indat_urb); ++ + usb_free_urb(s_priv->instat_urb); + usb_free_urb(s_priv->indat_urb); + usb_free_urb(s_priv->glocont_urb); +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c +index 99c89d7fa1ad..bcb6f5c2bae4 100644 +--- a/drivers/usb/serial/option.c ++++ b/drivers/usb/serial/option.c +@@ -375,18 +375,22 @@ static void option_instat_callback(struct urb *urb); + #define HAIER_PRODUCT_CE81B 0x10f8 + #define HAIER_PRODUCT_CE100 0x2009 + +-/* Cinterion (formerly Siemens) products */ +-#define SIEMENS_VENDOR_ID 0x0681 +-#define CINTERION_VENDOR_ID 0x1e2d ++/* Gemalto's Cinterion products (formerly Siemens) */ ++#define SIEMENS_VENDOR_ID 0x0681 ++#define CINTERION_VENDOR_ID 0x1e2d ++#define CINTERION_PRODUCT_HC25_MDMNET 0x0040 + #define CINTERION_PRODUCT_HC25_MDM 0x0047 +-#define CINTERION_PRODUCT_HC25_MDMNET 0x0040 ++#define CINTERION_PRODUCT_HC28_MDMNET 0x004A /* same for HC28J */ + #define CINTERION_PRODUCT_HC28_MDM 0x004C +-#define CINTERION_PRODUCT_HC28_MDMNET 0x004A /* same for HC28J */ + #define CINTERION_PRODUCT_EU3_E 0x0051 + #define CINTERION_PRODUCT_EU3_P 0x0052 + #define CINTERION_PRODUCT_PH8 0x0053 + #define CINTERION_PRODUCT_AHXX 0x0055 + #define CINTERION_PRODUCT_PLXX 0x0060 ++#define CINTERION_PRODUCT_PH8_2RMNET 0x0082 ++#define CINTERION_PRODUCT_PH8_AUDIO 0x0083 ++#define CINTERION_PRODUCT_AHXX_2RMNET 0x0084 ++#define CINTERION_PRODUCT_AHXX_AUDIO 0x0085 + + /* Olivetti products */ + #define OLIVETTI_VENDOR_ID 0x0b3c +@@ -641,6 +645,10 @@ static const struct option_blacklist_info telit_le922_blacklist_usbcfg3 = { + .reserved = BIT(1) | BIT(2) | BIT(3), + }; + ++static const struct option_blacklist_info cinterion_rmnet2_blacklist = { ++ .reserved = BIT(4) | BIT(5), ++}; ++ + static const struct usb_device_id option_ids[] = { + { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) }, + { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) }, +@@ -1712,7 +1720,13 @@ static const struct usb_device_id option_ids[] = { + { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX, 0xff) }, + { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PLXX), + .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, +- { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, ++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8_2RMNET, 0xff), ++ .driver_info = (kernel_ulong_t)&cinterion_rmnet2_blacklist }, ++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_PH8_AUDIO, 0xff), ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist }, ++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX_2RMNET, 0xff) }, ++ { USB_DEVICE_INTERFACE_CLASS(CINTERION_VENDOR_ID, CINTERION_PRODUCT_AHXX_AUDIO, 0xff) }, ++ { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDM) }, + { USB_DEVICE(CINTERION_VENDOR_ID, CINTERION_PRODUCT_HC28_MDMNET) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDM) }, + { USB_DEVICE(SIEMENS_VENDOR_ID, CINTERION_PRODUCT_HC25_MDMNET) }, +diff --git a/drivers/usb/serial/quatech2.c b/drivers/usb/serial/quatech2.c +index a24d59ae4032..58ab9e52a938 100644 +--- a/drivers/usb/serial/quatech2.c ++++ b/drivers/usb/serial/quatech2.c +@@ -142,6 +142,7 @@ static void qt2_release(struct usb_serial *serial) + + serial_priv = usb_get_serial_data(serial); + ++ usb_kill_urb(serial_priv->read_urb); + usb_free_urb(serial_priv->read_urb); + kfree(serial_priv->read_buffer); + kfree(serial_priv); +diff --git a/drivers/xen/events.c b/drivers/xen/events.c +index 3715a54117bb..19bd74cf0aba 100644 +--- a/drivers/xen/events.c ++++ b/drivers/xen/events.c +@@ -576,7 +576,8 @@ static void eoi_pirq(struct irq_data *data) + if (!VALID_EVTCHN(evtchn)) + return; + +- if (unlikely(irqd_is_setaffinity_pending(data))) { ++ if (unlikely(irqd_is_setaffinity_pending(data)) && ++ likely(!irqd_irq_disabled(data))) { + int masked = test_and_set_mask(evtchn); + + clear_evtchn(evtchn); +@@ -1616,7 +1617,8 @@ static void ack_dynirq(struct irq_data *data) + if (!VALID_EVTCHN(evtchn)) + return; + +- if (unlikely(irqd_is_setaffinity_pending(data))) { ++ if (unlikely(irqd_is_setaffinity_pending(data)) && ++ likely(!irqd_irq_disabled(data))) { + int masked = test_and_set_mask(evtchn); + + clear_evtchn(evtchn); +diff --git a/fs/cifs/sess.c b/fs/cifs/sess.c +index e87387dbf39f..bbb50be00ef5 100644 +--- a/fs/cifs/sess.c ++++ b/fs/cifs/sess.c +@@ -399,19 +399,27 @@ int build_ntlmssp_auth_blob(unsigned char *pbuffer, + sec_blob->LmChallengeResponse.MaximumLength = 0; + + sec_blob->NtChallengeResponse.BufferOffset = cpu_to_le32(tmp - pbuffer); +- rc = setup_ntlmv2_rsp(ses, nls_cp); +- if (rc) { +- cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc); +- goto setup_ntlmv2_ret; +- } +- memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE, +- ses->auth_key.len - CIFS_SESS_KEY_SIZE); +- tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE; ++ if (ses->user_name != NULL) { ++ rc = setup_ntlmv2_rsp(ses, nls_cp); ++ if (rc) { ++ cifs_dbg(VFS, "Error %d during NTLMSSP authentication\n", rc); ++ goto setup_ntlmv2_ret; ++ } ++ memcpy(tmp, ses->auth_key.response + CIFS_SESS_KEY_SIZE, ++ ses->auth_key.len - CIFS_SESS_KEY_SIZE); ++ tmp += ses->auth_key.len - CIFS_SESS_KEY_SIZE; + +- sec_blob->NtChallengeResponse.Length = +- cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); +- sec_blob->NtChallengeResponse.MaximumLength = +- cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); ++ sec_blob->NtChallengeResponse.Length = ++ cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); ++ sec_blob->NtChallengeResponse.MaximumLength = ++ cpu_to_le16(ses->auth_key.len - CIFS_SESS_KEY_SIZE); ++ } else { ++ /* ++ * don't send an NT Response for anonymous access ++ */ ++ sec_blob->NtChallengeResponse.Length = 0; ++ sec_blob->NtChallengeResponse.MaximumLength = 0; ++ } + + if (ses->domainName == NULL) { + sec_blob->DomainName.BufferOffset = cpu_to_le32(tmp - pbuffer); +diff --git a/fs/cifs/smb2glob.h b/fs/cifs/smb2glob.h +index bc0bb9c34f72..0ffa18094335 100644 +--- a/fs/cifs/smb2glob.h ++++ b/fs/cifs/smb2glob.h +@@ -44,6 +44,7 @@ + #define SMB2_OP_DELETE 7 + #define SMB2_OP_HARDLINK 8 + #define SMB2_OP_SET_EOF 9 ++#define SMB2_OP_RMDIR 10 + + /* Used when constructing chained read requests. */ + #define CHAINED_REQUEST 1 +diff --git a/fs/cifs/smb2inode.c b/fs/cifs/smb2inode.c +index 215f8d3e3e53..f970c5d5b253 100644 +--- a/fs/cifs/smb2inode.c ++++ b/fs/cifs/smb2inode.c +@@ -80,6 +80,10 @@ smb2_open_op_close(const unsigned int xid, struct cifs_tcon *tcon, + * SMB2_open() call. + */ + break; ++ case SMB2_OP_RMDIR: ++ tmprc = SMB2_rmdir(xid, tcon, fid.persistent_fid, ++ fid.volatile_fid); ++ break; + case SMB2_OP_RENAME: + tmprc = SMB2_rename(xid, tcon, fid.persistent_fid, + fid.volatile_fid, (__le16 *)data); +@@ -191,8 +195,8 @@ smb2_rmdir(const unsigned int xid, struct cifs_tcon *tcon, const char *name, + struct cifs_sb_info *cifs_sb) + { + return smb2_open_op_close(xid, tcon, cifs_sb, name, DELETE, FILE_OPEN, +- CREATE_NOT_FILE | CREATE_DELETE_ON_CLOSE, +- NULL, SMB2_OP_DELETE); ++ CREATE_NOT_FILE, ++ NULL, SMB2_OP_RMDIR); + } + + int +diff --git a/fs/cifs/smb2pdu.c b/fs/cifs/smb2pdu.c +index a47ac835145b..439cb86ed488 100644 +--- a/fs/cifs/smb2pdu.c ++++ b/fs/cifs/smb2pdu.c +@@ -2254,6 +2254,22 @@ SMB2_rename(const unsigned int xid, struct cifs_tcon *tcon, + } + + int ++SMB2_rmdir(const unsigned int xid, struct cifs_tcon *tcon, ++ u64 persistent_fid, u64 volatile_fid) ++{ ++ __u8 delete_pending = 1; ++ void *data; ++ unsigned int size; ++ ++ data = &delete_pending; ++ size = 1; /* sizeof __u8 */ ++ ++ return send_set_info(xid, tcon, persistent_fid, volatile_fid, ++ current->tgid, FILE_DISPOSITION_INFORMATION, 1, &data, ++ &size); ++} ++ ++int + SMB2_set_hardlink(const unsigned int xid, struct cifs_tcon *tcon, + u64 persistent_fid, u64 volatile_fid, __le16 *target_file) + { +diff --git a/fs/cifs/smb2proto.h b/fs/cifs/smb2proto.h +index d18b19ec1145..5793f3e39a31 100644 +--- a/fs/cifs/smb2proto.h ++++ b/fs/cifs/smb2proto.h +@@ -133,6 +133,8 @@ extern int SMB2_query_directory(const unsigned int xid, struct cifs_tcon *tcon, + extern int SMB2_rename(const unsigned int xid, struct cifs_tcon *tcon, + u64 persistent_fid, u64 volatile_fid, + __le16 *target_file); ++extern int SMB2_rmdir(const unsigned int xid, struct cifs_tcon *tcon, ++ u64 persistent_fid, u64 volatile_fid); + extern int SMB2_set_hardlink(const unsigned int xid, struct cifs_tcon *tcon, + u64 persistent_fid, u64 volatile_fid, + __le16 *target_file); +diff --git a/fs/ext4/ialloc.c b/fs/ext4/ialloc.c +index fbc6df7b895d..f49349dfebcc 100644 +--- a/fs/ext4/ialloc.c ++++ b/fs/ext4/ialloc.c +@@ -1097,11 +1097,13 @@ struct inode *ext4_orphan_get(struct super_block *sb, unsigned long ino) + goto iget_failed; + + /* +- * If the orphans has i_nlinks > 0 then it should be able to be +- * truncated, otherwise it won't be removed from the orphan list +- * during processing and an infinite loop will result. ++ * If the orphans has i_nlinks > 0 then it should be able to ++ * be truncated, otherwise it won't be removed from the orphan ++ * list during processing and an infinite loop will result. ++ * Similarly, it must not be a bad inode. + */ +- if (inode->i_nlink && !ext4_can_truncate(inode)) ++ if ((inode->i_nlink && !ext4_can_truncate(inode)) || ++ is_bad_inode(inode)) + goto bad_orphan; + + if (NEXT_ORPHAN(inode) > max_ino) +diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c +index c4a5e4df8ca3..4a79ce1ecaa1 100644 +--- a/fs/ext4/mballoc.c ++++ b/fs/ext4/mballoc.c +@@ -1236,6 +1236,7 @@ static void ext4_mb_unload_buddy(struct ext4_buddy *e4b) + static int mb_find_order_for_block(struct ext4_buddy *e4b, int block) + { + int order = 1; ++ int bb_incr = 1 << (e4b->bd_blkbits - 1); + void *bb; + + BUG_ON(e4b->bd_bitmap == e4b->bd_buddy); +@@ -1248,7 +1249,8 @@ static int mb_find_order_for_block(struct ext4_buddy *e4b, int block) + /* this block is part of buddy of order 'order' */ + return order; + } +- bb += 1 << (e4b->bd_blkbits - order); ++ bb += bb_incr; ++ bb_incr >>= 1; + order++; + } + return 0; +@@ -2535,7 +2537,7 @@ int ext4_mb_init(struct super_block *sb) + { + struct ext4_sb_info *sbi = EXT4_SB(sb); + unsigned i, j; +- unsigned offset; ++ unsigned offset, offset_incr; + unsigned max; + int ret; + +@@ -2564,11 +2566,13 @@ int ext4_mb_init(struct super_block *sb) + + i = 1; + offset = 0; ++ offset_incr = 1 << (sb->s_blocksize_bits - 1); + max = sb->s_blocksize << 2; + do { + sbi->s_mb_offsets[i] = offset; + sbi->s_mb_maxs[i] = max; +- offset += 1 << (sb->s_blocksize_bits - i); ++ offset += offset_incr; ++ offset_incr = offset_incr >> 1; + max = max >> 1; + i++; + } while (i <= sb->s_blocksize_bits + 1); +diff --git a/fs/nfs/dir.c b/fs/nfs/dir.c +index 140280623348..cf6ede69a2e2 100644 +--- a/fs/nfs/dir.c ++++ b/fs/nfs/dir.c +@@ -510,6 +510,9 @@ int nfs_readdir_page_filler(nfs_readdir_descriptor_t *desc, struct nfs_entry *en + if (scratch == NULL) + return -ENOMEM; + ++ if (buflen == 0) ++ goto out_nopages; ++ + xdr_init_decode_pages(&stream, &buf, xdr_pages, buflen); + xdr_set_scratch_buffer(&stream, page_address(scratch), PAGE_SIZE); + +@@ -531,6 +534,7 @@ int nfs_readdir_page_filler(nfs_readdir_descriptor_t *desc, struct nfs_entry *en + break; + } while (!entry->eof); + ++out_nopages: + if (count == 0 || (status == -EBADCOOKIE && entry->eof != 0)) { + array = nfs_readdir_get_array(page); + if (!IS_ERR(array)) { +diff --git a/fs/xfs/xfs_inode.c b/fs/xfs/xfs_inode.c +index e3606f26f82d..5d667f740eff 100644 +--- a/fs/xfs/xfs_inode.c ++++ b/fs/xfs/xfs_inode.c +@@ -2900,13 +2900,14 @@ xfs_iflush_cluster( + * We need to check under the i_flags_lock for a valid inode + * here. Skip it if it is not valid or the wrong inode. + */ +- spin_lock(&ip->i_flags_lock); +- if (!ip->i_ino || ++ spin_lock(&iq->i_flags_lock); ++ if (!iq->i_ino || ++ __xfs_iflags_test(iq, XFS_ISTALE) || + (XFS_INO_TO_AGINO(mp, iq->i_ino) & mask) != first_index) { +- spin_unlock(&ip->i_flags_lock); ++ spin_unlock(&iq->i_flags_lock); + continue; + } +- spin_unlock(&ip->i_flags_lock); ++ spin_unlock(&iq->i_flags_lock); + + /* + * Do an un-protected check to see if the inode is dirty and +@@ -3022,7 +3023,7 @@ xfs_iflush( + struct xfs_buf **bpp) + { + struct xfs_mount *mp = ip->i_mount; +- struct xfs_buf *bp; ++ struct xfs_buf *bp = NULL; + struct xfs_dinode *dip; + int error; + +@@ -3064,14 +3065,22 @@ xfs_iflush( + } + + /* +- * Get the buffer containing the on-disk inode. ++ * Get the buffer containing the on-disk inode. We are doing a try-lock ++ * operation here, so we may get an EAGAIN error. In that case, we ++ * simply want to return with the inode still dirty. ++ * ++ * If we get any other error, we effectively have a corruption situation ++ * and we cannot flush the inode, so we treat it the same as failing ++ * xfs_iflush_int(). + */ + error = xfs_imap_to_bp(mp, NULL, &ip->i_imap, &dip, &bp, XBF_TRYLOCK, + 0); +- if (error || !bp) { ++ if (error == EAGAIN) { + xfs_ifunlock(ip); + return error; + } ++ if (error) ++ goto corrupt_out; + + /* + * First flush out the inode that xfs_iflush was called with. +@@ -3099,7 +3108,8 @@ xfs_iflush( + return 0; + + corrupt_out: +- xfs_buf_relse(bp); ++ if (bp) ++ xfs_buf_relse(bp); + xfs_force_shutdown(mp, SHUTDOWN_CORRUPT_INCORE); + cluster_corrupt_out: + error = XFS_ERROR(EFSCORRUPTED); +diff --git a/include/rdma/ib.h b/include/rdma/ib.h +index cf8f9e700e48..a6b93706b0fc 100644 +--- a/include/rdma/ib.h ++++ b/include/rdma/ib.h +@@ -34,6 +34,7 @@ + #define _RDMA_IB_H + + #include <linux/types.h> ++#include <linux/sched.h> + + struct ib_addr { + union { +@@ -86,4 +87,19 @@ struct sockaddr_ib { + __u64 sib_scope_id; + }; + ++/* ++ * The IB interfaces that use write() as bi-directional ioctl() are ++ * fundamentally unsafe, since there are lots of ways to trigger "write()" ++ * calls from various contexts with elevated privileges. That includes the ++ * traditional suid executable error message writes, but also various kernel ++ * interfaces that can write to file descriptors. ++ * ++ * This function provides protection for the legacy API by restricting the ++ * calling context. ++ */ ++static inline bool ib_safe_file_access(struct file *filp) ++{ ++ return filp->f_cred == current_cred() && segment_eq(get_fs(), USER_DS); ++} ++ + #endif /* _RDMA_IB_H */ +diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c +index 321ee4205160..f100767c8e0b 100644 +--- a/kernel/trace/ring_buffer.c ++++ b/kernel/trace/ring_buffer.c +@@ -463,7 +463,7 @@ struct ring_buffer_per_cpu { + raw_spinlock_t reader_lock; /* serialize readers */ + arch_spinlock_t lock; + struct lock_class_key lock_key; +- unsigned int nr_pages; ++ unsigned long nr_pages; + struct list_head *pages; + struct buffer_page *head_page; /* read from head */ + struct buffer_page *tail_page; /* write to tail */ +@@ -483,7 +483,7 @@ struct ring_buffer_per_cpu { + u64 write_stamp; + u64 read_stamp; + /* ring buffer pages to update, > 0 to add, < 0 to remove */ +- int nr_pages_to_update; ++ long nr_pages_to_update; + struct list_head new_pages; /* new pages to add */ + struct work_struct update_pages_work; + struct completion update_done; +@@ -1120,10 +1120,10 @@ static int rb_check_pages(struct ring_buffer_per_cpu *cpu_buffer) + return 0; + } + +-static int __rb_allocate_pages(int nr_pages, struct list_head *pages, int cpu) ++static int __rb_allocate_pages(long nr_pages, struct list_head *pages, int cpu) + { +- int i; + struct buffer_page *bpage, *tmp; ++ long i; + + for (i = 0; i < nr_pages; i++) { + struct page *page; +@@ -1160,7 +1160,7 @@ free_pages: + } + + static int rb_allocate_pages(struct ring_buffer_per_cpu *cpu_buffer, +- unsigned nr_pages) ++ unsigned long nr_pages) + { + LIST_HEAD(pages); + +@@ -1185,7 +1185,7 @@ static int rb_allocate_pages(struct ring_buffer_per_cpu *cpu_buffer, + } + + static struct ring_buffer_per_cpu * +-rb_allocate_cpu_buffer(struct ring_buffer *buffer, int nr_pages, int cpu) ++rb_allocate_cpu_buffer(struct ring_buffer *buffer, long nr_pages, int cpu) + { + struct ring_buffer_per_cpu *cpu_buffer; + struct buffer_page *bpage; +@@ -1284,8 +1284,9 @@ struct ring_buffer *__ring_buffer_alloc(unsigned long size, unsigned flags, + struct lock_class_key *key) + { + struct ring_buffer *buffer; ++ long nr_pages; + int bsize; +- int cpu, nr_pages; ++ int cpu; + + /* keep it in its own cache line */ + buffer = kzalloc(ALIGN(sizeof(*buffer), cache_line_size()), +@@ -1408,12 +1409,12 @@ static inline unsigned long rb_page_write(struct buffer_page *bpage) + } + + static int +-rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned int nr_pages) ++rb_remove_pages(struct ring_buffer_per_cpu *cpu_buffer, unsigned long nr_pages) + { + struct list_head *tail_page, *to_remove, *next_page; + struct buffer_page *to_remove_page, *tmp_iter_page; + struct buffer_page *last_page, *first_page; +- unsigned int nr_removed; ++ unsigned long nr_removed; + unsigned long head_bit; + int page_entries; + +@@ -1630,7 +1631,7 @@ int ring_buffer_resize(struct ring_buffer *buffer, unsigned long size, + int cpu_id) + { + struct ring_buffer_per_cpu *cpu_buffer; +- unsigned nr_pages; ++ unsigned long nr_pages; + int cpu, err = 0; + + /* +@@ -1644,14 +1645,13 @@ int ring_buffer_resize(struct ring_buffer *buffer, unsigned long size, + !cpumask_test_cpu(cpu_id, buffer->cpumask)) + return size; + +- size = DIV_ROUND_UP(size, BUF_PAGE_SIZE); +- size *= BUF_PAGE_SIZE; ++ nr_pages = DIV_ROUND_UP(size, BUF_PAGE_SIZE); + + /* we need a minimum of two pages */ +- if (size < BUF_PAGE_SIZE * 2) +- size = BUF_PAGE_SIZE * 2; ++ if (nr_pages < 2) ++ nr_pages = 2; + +- nr_pages = DIV_ROUND_UP(size, BUF_PAGE_SIZE); ++ size = nr_pages * BUF_PAGE_SIZE; + + /* + * Don't succeed if resizing is disabled, as a reader might be +@@ -4593,8 +4593,9 @@ static int rb_cpu_notify(struct notifier_block *self, + struct ring_buffer *buffer = + container_of(self, struct ring_buffer, cpu_notify); + long cpu = (long)hcpu; +- int cpu_i, nr_pages_same; +- unsigned int nr_pages; ++ long nr_pages_same; ++ int cpu_i; ++ unsigned long nr_pages; + + switch (action) { + case CPU_UP_PREPARE: +diff --git a/lib/dma-debug.c b/lib/dma-debug.c +index eb43517bf261..c32437f6be61 100644 +--- a/lib/dma-debug.c ++++ b/lib/dma-debug.c +@@ -445,9 +445,9 @@ static struct dma_debug_entry *dma_entry_alloc(void) + spin_lock_irqsave(&free_entries_lock, flags); + + if (list_empty(&free_entries)) { +- pr_err("DMA-API: debugging out of memory - disabling\n"); + global_disable = true; + spin_unlock_irqrestore(&free_entries_lock, flags); ++ pr_err("DMA-API: debugging out of memory - disabling\n"); + return NULL; + } + +diff --git a/net/sunrpc/auth_gss/svcauth_gss.c b/net/sunrpc/auth_gss/svcauth_gss.c +index e18be86dc486..9d7e6097ef5b 100644 +--- a/net/sunrpc/auth_gss/svcauth_gss.c ++++ b/net/sunrpc/auth_gss/svcauth_gss.c +@@ -855,8 +855,8 @@ unwrap_integ_data(struct svc_rqst *rqstp, struct xdr_buf *buf, u32 seq, struct g + goto out; + if (svc_getnl(&buf->head[0]) != seq) + goto out; +- /* trim off the mic at the end before returning */ +- xdr_buf_trim(buf, mic.len + 4); ++ /* trim off the mic and padding at the end before returning */ ++ xdr_buf_trim(buf, round_up_to_quad(mic.len) + 4); + stat = 0; + out: + kfree(mic.data);
