commit: b85fca43d17ff0cd99bfa0a19e75c1029836ccb7 Author: Mike Pagano <mpagano <AT> gentoo <DOT> org> AuthorDate: Thu Dec 13 11:34:58 2018 +0000 Commit: Mike Pagano <mpagano <AT> gentoo <DOT> org> CommitDate: Thu Dec 13 11:34:58 2018 +0000 URL: https://gitweb.gentoo.org/proj/linux-patches.git/commit/?id=b85fca43
proj/linux-patchs: Linux patch 4.4.167 Signed-off-by: Mike Pagano <mpagano <AT> gentoo.org> 0000_README | 4 + 1166_linux-4.4.167.patch | 2689 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 2693 insertions(+) diff --git a/0000_README b/0000_README index d122069..eefc9a1 100644 --- a/0000_README +++ b/0000_README @@ -707,6 +707,10 @@ Patch: 1165_linux-4.4.166.patch From: http://www.kernel.org Desc: Linux 4.4.166 +Patch: 1166_linux-4.4.167.patch +From: http://www.kernel.org +Desc: Linux 4.4.167 + Patch: 1500_XATTR_USER_PREFIX.patch From: https://bugs.gentoo.org/show_bug.cgi?id=470644 Desc: Support for namespace user.pax.* on tmpfs. diff --git a/1166_linux-4.4.167.patch b/1166_linux-4.4.167.patch new file mode 100644 index 0000000..de3a7c4 --- /dev/null +++ b/1166_linux-4.4.167.patch @@ -0,0 +1,2689 @@ +diff --git a/Makefile b/Makefile +index 64521458d35e..6b30551caee4 100644 +--- a/Makefile ++++ b/Makefile +@@ -1,6 +1,6 @@ + VERSION = 4 + PATCHLEVEL = 4 +-SUBLEVEL = 166 ++SUBLEVEL = 167 + EXTRAVERSION = + NAME = Blurry Fish Butt + +@@ -793,6 +793,9 @@ KBUILD_CFLAGS += $(call cc-option,-Wdeclaration-after-statement,) + # disable pointer signed / unsigned warnings in gcc 4.0 + KBUILD_CFLAGS += $(call cc-disable-warning, pointer-sign) + ++# disable stringop warnings in gcc 8+ ++KBUILD_CFLAGS += $(call cc-disable-warning, stringop-truncation) ++ + # disable invalid "can't wrap" optimizations for signed / pointers + KBUILD_CFLAGS += $(call cc-option,-fno-strict-overflow) + +diff --git a/arch/arc/Kconfig b/arch/arc/Kconfig +index c4ee25e88a7b..e983f410135a 100644 +--- a/arch/arc/Kconfig ++++ b/arch/arc/Kconfig +@@ -96,7 +96,7 @@ endmenu + + choice + prompt "ARC Instruction Set" +- default ISA_ARCOMPACT ++ default ISA_ARCV2 + + config ISA_ARCOMPACT + bool "ARCompact ISA" +diff --git a/arch/arc/Makefile b/arch/arc/Makefile +index 9d64eacdd2aa..fffaff9c7b2c 100644 +--- a/arch/arc/Makefile ++++ b/arch/arc/Makefile +@@ -12,7 +12,7 @@ ifeq ($(CROSS_COMPILE),) + CROSS_COMPILE := arc-linux- + endif + +-KBUILD_DEFCONFIG := nsim_700_defconfig ++KBUILD_DEFCONFIG := nsim_hs_defconfig + + cflags-y += -fno-common -pipe -fno-builtin -mmedium-calls -D__linux__ + cflags-$(CONFIG_ISA_ARCOMPACT) += -mA7 +diff --git a/arch/arc/configs/axs101_defconfig b/arch/arc/configs/axs101_defconfig +index dbee1934dfc6..3023f91c77c2 100644 +--- a/arch/arc/configs/axs101_defconfig ++++ b/arch/arc/configs/axs101_defconfig +@@ -17,6 +17,7 @@ CONFIG_PERF_EVENTS=y + # CONFIG_VM_EVENT_COUNTERS is not set + # CONFIG_SLUB_DEBUG is not set + # CONFIG_COMPAT_BRK is not set ++CONFIG_ISA_ARCOMPACT=y + CONFIG_MODULES=y + CONFIG_PARTITION_ADVANCED=y + CONFIG_ARC_PLAT_AXS10X=y +@@ -97,6 +98,7 @@ CONFIG_NTFS_FS=y + CONFIG_TMPFS=y + CONFIG_JFFS2_FS=y + CONFIG_NFS_FS=y ++CONFIG_NFS_V3_ACL=y + CONFIG_NLS_CODEPAGE_437=y + CONFIG_NLS_ISO8859_1=y + # CONFIG_ENABLE_WARN_DEPRECATED is not set +diff --git a/arch/arc/configs/axs103_defconfig b/arch/arc/configs/axs103_defconfig +index 561eac854cc3..f18107185f53 100644 +--- a/arch/arc/configs/axs103_defconfig ++++ b/arch/arc/configs/axs103_defconfig +@@ -103,6 +103,7 @@ CONFIG_NTFS_FS=y + CONFIG_TMPFS=y + CONFIG_JFFS2_FS=y + CONFIG_NFS_FS=y ++CONFIG_NFS_V3_ACL=y + CONFIG_NLS_CODEPAGE_437=y + CONFIG_NLS_ISO8859_1=y + # CONFIG_ENABLE_WARN_DEPRECATED is not set +diff --git a/arch/arc/configs/axs103_smp_defconfig b/arch/arc/configs/axs103_smp_defconfig +index aa4f261b6508..6e1dd8521d2a 100644 +--- a/arch/arc/configs/axs103_smp_defconfig ++++ b/arch/arc/configs/axs103_smp_defconfig +@@ -104,6 +104,7 @@ CONFIG_NTFS_FS=y + CONFIG_TMPFS=y + CONFIG_JFFS2_FS=y + CONFIG_NFS_FS=y ++CONFIG_NFS_V3_ACL=y + CONFIG_NLS_CODEPAGE_437=y + CONFIG_NLS_ISO8859_1=y + # CONFIG_ENABLE_WARN_DEPRECATED is not set +diff --git a/arch/arc/configs/nsim_700_defconfig b/arch/arc/configs/nsim_700_defconfig +index 138f9d887957..86e5a62556a8 100644 +--- a/arch/arc/configs/nsim_700_defconfig ++++ b/arch/arc/configs/nsim_700_defconfig +@@ -16,6 +16,7 @@ CONFIG_KALLSYMS_ALL=y + CONFIG_EMBEDDED=y + # CONFIG_SLUB_DEBUG is not set + # CONFIG_COMPAT_BRK is not set ++CONFIG_ISA_ARCOMPACT=y + CONFIG_KPROBES=y + CONFIG_MODULES=y + # CONFIG_LBDAF is not set +diff --git a/arch/arc/configs/nsimosci_defconfig b/arch/arc/configs/nsimosci_defconfig +index 31e1d95764ff..a4d7b919224a 100644 +--- a/arch/arc/configs/nsimosci_defconfig ++++ b/arch/arc/configs/nsimosci_defconfig +@@ -17,6 +17,7 @@ CONFIG_KALLSYMS_ALL=y + CONFIG_EMBEDDED=y + # CONFIG_SLUB_DEBUG is not set + # CONFIG_COMPAT_BRK is not set ++CONFIG_ISA_ARCOMPACT=y + CONFIG_KPROBES=y + CONFIG_MODULES=y + # CONFIG_LBDAF is not set +@@ -69,5 +70,6 @@ CONFIG_EXT2_FS_XATTR=y + CONFIG_TMPFS=y + # CONFIG_MISC_FILESYSTEMS is not set + CONFIG_NFS_FS=y ++CONFIG_NFS_V3_ACL=y + # CONFIG_ENABLE_WARN_DEPRECATED is not set + # CONFIG_ENABLE_MUST_CHECK is not set +diff --git a/arch/arc/configs/nsimosci_hs_defconfig b/arch/arc/configs/nsimosci_hs_defconfig +index fcae66683ca0..b3fb49c8bd14 100644 +--- a/arch/arc/configs/nsimosci_hs_defconfig ++++ b/arch/arc/configs/nsimosci_hs_defconfig +@@ -69,5 +69,6 @@ CONFIG_EXT2_FS_XATTR=y + CONFIG_TMPFS=y + # CONFIG_MISC_FILESYSTEMS is not set + CONFIG_NFS_FS=y ++CONFIG_NFS_V3_ACL=y + # CONFIG_ENABLE_WARN_DEPRECATED is not set + # CONFIG_ENABLE_MUST_CHECK is not set +diff --git a/arch/arc/configs/nsimosci_hs_smp_defconfig b/arch/arc/configs/nsimosci_hs_smp_defconfig +index b01b659168ea..710c167bbdd8 100644 +--- a/arch/arc/configs/nsimosci_hs_smp_defconfig ++++ b/arch/arc/configs/nsimosci_hs_smp_defconfig +@@ -88,6 +88,7 @@ CONFIG_EXT2_FS_XATTR=y + CONFIG_TMPFS=y + # CONFIG_MISC_FILESYSTEMS is not set + CONFIG_NFS_FS=y ++CONFIG_NFS_V3_ACL=y + # CONFIG_ENABLE_WARN_DEPRECATED is not set + # CONFIG_ENABLE_MUST_CHECK is not set + CONFIG_FTRACE=y +diff --git a/arch/arc/configs/tb10x_defconfig b/arch/arc/configs/tb10x_defconfig +index 3b4dc9cebcf1..7469b754ac77 100644 +--- a/arch/arc/configs/tb10x_defconfig ++++ b/arch/arc/configs/tb10x_defconfig +@@ -19,6 +19,7 @@ CONFIG_KALLSYMS_ALL=y + # CONFIG_AIO is not set + CONFIG_EMBEDDED=y + # CONFIG_COMPAT_BRK is not set ++CONFIG_ISA_ARCOMPACT=y + CONFIG_SLAB=y + CONFIG_MODULES=y + CONFIG_MODULE_FORCE_LOAD=y +diff --git a/arch/arc/configs/vdk_hs38_defconfig b/arch/arc/configs/vdk_hs38_defconfig +index a07f20de221b..772073e5ba04 100644 +--- a/arch/arc/configs/vdk_hs38_defconfig ++++ b/arch/arc/configs/vdk_hs38_defconfig +@@ -89,6 +89,7 @@ CONFIG_NTFS_FS=y + CONFIG_TMPFS=y + CONFIG_JFFS2_FS=y + CONFIG_NFS_FS=y ++CONFIG_NFS_V3_ACL=y + CONFIG_NLS_CODEPAGE_437=y + CONFIG_NLS_ISO8859_1=y + # CONFIG_ENABLE_WARN_DEPRECATED is not set +diff --git a/arch/arc/configs/vdk_hs38_smp_defconfig b/arch/arc/configs/vdk_hs38_smp_defconfig +index f36c047b33ca..50e215a163ff 100644 +--- a/arch/arc/configs/vdk_hs38_smp_defconfig ++++ b/arch/arc/configs/vdk_hs38_smp_defconfig +@@ -91,6 +91,7 @@ CONFIG_NTFS_FS=y + CONFIG_TMPFS=y + CONFIG_JFFS2_FS=y + CONFIG_NFS_FS=y ++CONFIG_NFS_V3_ACL=y + CONFIG_NLS_CODEPAGE_437=y + CONFIG_NLS_ISO8859_1=y + # CONFIG_ENABLE_WARN_DEPRECATED is not set +diff --git a/arch/mips/include/asm/syscall.h b/arch/mips/include/asm/syscall.h +index 47bc45a67e9b..032a497356f3 100644 +--- a/arch/mips/include/asm/syscall.h ++++ b/arch/mips/include/asm/syscall.h +@@ -51,7 +51,7 @@ static inline unsigned long mips_get_syscall_arg(unsigned long *arg, + #ifdef CONFIG_64BIT + case 4: case 5: case 6: case 7: + #ifdef CONFIG_MIPS32_O32 +- if (test_thread_flag(TIF_32BIT_REGS)) ++ if (test_tsk_thread_flag(task, TIF_32BIT_REGS)) + return get_user(*arg, (int *)usp + n); + else + #endif +diff --git a/arch/mips/ralink/mt7620.c b/arch/mips/ralink/mt7620.c +index c5f45fc96c74..9c19f5493b85 100644 +--- a/arch/mips/ralink/mt7620.c ++++ b/arch/mips/ralink/mt7620.c +@@ -81,7 +81,7 @@ static struct rt2880_pmx_func pcie_rst_grp[] = { + }; + static struct rt2880_pmx_func nd_sd_grp[] = { + FUNC("nand", MT7620_GPIO_MODE_NAND, 45, 15), +- FUNC("sd", MT7620_GPIO_MODE_SD, 45, 15) ++ FUNC("sd", MT7620_GPIO_MODE_SD, 47, 13) + }; + + static struct rt2880_pmx_group mt7620a_pinmux_data[] = { +diff --git a/arch/x86/kvm/mmu.c b/arch/x86/kvm/mmu.c +index 2b71f2c03b9e..a5b533aea958 100644 +--- a/arch/x86/kvm/mmu.c ++++ b/arch/x86/kvm/mmu.c +@@ -4174,9 +4174,9 @@ static void mmu_pte_write_flush_tlb(struct kvm_vcpu *vcpu, bool zap_page, + } + + static u64 mmu_pte_write_fetch_gpte(struct kvm_vcpu *vcpu, gpa_t *gpa, +- const u8 *new, int *bytes) ++ int *bytes) + { +- u64 gentry; ++ u64 gentry = 0; + int r; + + /* +@@ -4188,22 +4188,12 @@ static u64 mmu_pte_write_fetch_gpte(struct kvm_vcpu *vcpu, gpa_t *gpa, + /* Handle a 32-bit guest writing two halves of a 64-bit gpte */ + *gpa &= ~(gpa_t)7; + *bytes = 8; +- r = kvm_vcpu_read_guest(vcpu, *gpa, &gentry, 8); +- if (r) +- gentry = 0; +- new = (const u8 *)&gentry; + } + +- switch (*bytes) { +- case 4: +- gentry = *(const u32 *)new; +- break; +- case 8: +- gentry = *(const u64 *)new; +- break; +- default: +- gentry = 0; +- break; ++ if (*bytes == 4 || *bytes == 8) { ++ r = kvm_vcpu_read_guest_atomic(vcpu, *gpa, &gentry, *bytes); ++ if (r) ++ gentry = 0; + } + + return gentry; +@@ -4313,8 +4303,6 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa, + + pgprintk("%s: gpa %llx bytes %d\n", __func__, gpa, bytes); + +- gentry = mmu_pte_write_fetch_gpte(vcpu, &gpa, new, &bytes); +- + /* + * No need to care whether allocation memory is successful + * or not since pte prefetch is skiped if it does not have +@@ -4323,6 +4311,9 @@ void kvm_mmu_pte_write(struct kvm_vcpu *vcpu, gpa_t gpa, + mmu_topup_memory_caches(vcpu); + + spin_lock(&vcpu->kvm->mmu_lock); ++ ++ gentry = mmu_pte_write_fetch_gpte(vcpu, &gpa, &bytes); ++ + ++vcpu->kvm->stat.mmu_pte_write; + kvm_mmu_audit(vcpu, AUDIT_PRE_PTE_WRITE); + +diff --git a/arch/xtensa/kernel/asm-offsets.c b/arch/xtensa/kernel/asm-offsets.c +index b123ace3b67c..cbefed1800c1 100644 +--- a/arch/xtensa/kernel/asm-offsets.c ++++ b/arch/xtensa/kernel/asm-offsets.c +@@ -90,14 +90,14 @@ int main(void) + DEFINE(THREAD_SP, offsetof (struct task_struct, thread.sp)); + DEFINE(THREAD_CPENABLE, offsetof (struct thread_info, cpenable)); + #if XTENSA_HAVE_COPROCESSORS +- DEFINE(THREAD_XTREGS_CP0, offsetof (struct thread_info, xtregs_cp)); +- DEFINE(THREAD_XTREGS_CP1, offsetof (struct thread_info, xtregs_cp)); +- DEFINE(THREAD_XTREGS_CP2, offsetof (struct thread_info, xtregs_cp)); +- DEFINE(THREAD_XTREGS_CP3, offsetof (struct thread_info, xtregs_cp)); +- DEFINE(THREAD_XTREGS_CP4, offsetof (struct thread_info, xtregs_cp)); +- DEFINE(THREAD_XTREGS_CP5, offsetof (struct thread_info, xtregs_cp)); +- DEFINE(THREAD_XTREGS_CP6, offsetof (struct thread_info, xtregs_cp)); +- DEFINE(THREAD_XTREGS_CP7, offsetof (struct thread_info, xtregs_cp)); ++ DEFINE(THREAD_XTREGS_CP0, offsetof(struct thread_info, xtregs_cp.cp0)); ++ DEFINE(THREAD_XTREGS_CP1, offsetof(struct thread_info, xtregs_cp.cp1)); ++ DEFINE(THREAD_XTREGS_CP2, offsetof(struct thread_info, xtregs_cp.cp2)); ++ DEFINE(THREAD_XTREGS_CP3, offsetof(struct thread_info, xtregs_cp.cp3)); ++ DEFINE(THREAD_XTREGS_CP4, offsetof(struct thread_info, xtregs_cp.cp4)); ++ DEFINE(THREAD_XTREGS_CP5, offsetof(struct thread_info, xtregs_cp.cp5)); ++ DEFINE(THREAD_XTREGS_CP6, offsetof(struct thread_info, xtregs_cp.cp6)); ++ DEFINE(THREAD_XTREGS_CP7, offsetof(struct thread_info, xtregs_cp.cp7)); + #endif + DEFINE(THREAD_XTREGS_USER, offsetof (struct thread_info, xtregs_user)); + DEFINE(XTREGS_USER_SIZE, sizeof(xtregs_user_t)); +diff --git a/arch/xtensa/kernel/process.c b/arch/xtensa/kernel/process.c +index 1c85323f01d7..df70d47d14ab 100644 +--- a/arch/xtensa/kernel/process.c ++++ b/arch/xtensa/kernel/process.c +@@ -83,18 +83,21 @@ void coprocessor_release_all(struct thread_info *ti) + + void coprocessor_flush_all(struct thread_info *ti) + { +- unsigned long cpenable; ++ unsigned long cpenable, old_cpenable; + int i; + + preempt_disable(); + ++ RSR_CPENABLE(old_cpenable); + cpenable = ti->cpenable; ++ WSR_CPENABLE(cpenable); + + for (i = 0; i < XCHAL_CP_MAX; i++) { + if ((cpenable & 1) != 0 && coprocessor_owner[i] == ti) + coprocessor_flush(ti, i); + cpenable >>= 1; + } ++ WSR_CPENABLE(old_cpenable); + + preempt_enable(); + } +diff --git a/drivers/dma/at_hdmac.c b/drivers/dma/at_hdmac.c +index be26f625bb3e..941ace052130 100644 +--- a/drivers/dma/at_hdmac.c ++++ b/drivers/dma/at_hdmac.c +@@ -1781,6 +1781,12 @@ static void atc_free_chan_resources(struct dma_chan *chan) + atchan->descs_allocated = 0; + atchan->status = 0; + ++ /* ++ * Free atslave allocated in at_dma_xlate() ++ */ ++ kfree(chan->private); ++ chan->private = NULL; ++ + dev_vdbg(chan2dev(chan), "free_chan_resources: done\n"); + } + +@@ -1815,7 +1821,7 @@ static struct dma_chan *at_dma_xlate(struct of_phandle_args *dma_spec, + dma_cap_zero(mask); + dma_cap_set(DMA_SLAVE, mask); + +- atslave = devm_kzalloc(&dmac_pdev->dev, sizeof(*atslave), GFP_KERNEL); ++ atslave = kzalloc(sizeof(*atslave), GFP_KERNEL); + if (!atslave) + return NULL; + +@@ -2146,6 +2152,8 @@ static int at_dma_remove(struct platform_device *pdev) + struct resource *io; + + at_dma_off(atdma); ++ if (pdev->dev.of_node) ++ of_dma_controller_free(pdev->dev.of_node); + dma_async_device_unregister(&atdma->dma_common); + + dma_pool_destroy(atdma->memset_pool); +diff --git a/drivers/gpu/drm/ast/ast_main.c b/drivers/gpu/drm/ast/ast_main.c +index 498a94069e6b..1acebd64fded 100644 +--- a/drivers/gpu/drm/ast/ast_main.c ++++ b/drivers/gpu/drm/ast/ast_main.c +@@ -557,7 +557,8 @@ int ast_driver_unload(struct drm_device *dev) + drm_mode_config_cleanup(dev); + + ast_mm_fini(ast); +- pci_iounmap(dev->pdev, ast->ioregs); ++ if (ast->ioregs != ast->regs + AST_IO_MM_OFFSET) ++ pci_iounmap(dev->pdev, ast->ioregs); + pci_iounmap(dev->pdev, ast->regs); + kfree(ast); + return 0; +diff --git a/drivers/gpu/drm/gma500/mdfld_intel_display.c b/drivers/gpu/drm/gma500/mdfld_intel_display.c +index acd38344b302..764094dd30dd 100644 +--- a/drivers/gpu/drm/gma500/mdfld_intel_display.c ++++ b/drivers/gpu/drm/gma500/mdfld_intel_display.c +@@ -99,7 +99,7 @@ void mdfldWaitForPipeEnable(struct drm_device *dev, int pipe) + /* Wait for for the pipe enable to take effect. */ + for (count = 0; count < COUNT_MAX; count++) { + temp = REG_READ(map->conf); +- if ((temp & PIPEACONF_PIPE_STATE) == 1) ++ if (temp & PIPEACONF_PIPE_STATE) + break; + } + } +diff --git a/drivers/infiniband/ulp/iser/iser_verbs.c b/drivers/infiniband/ulp/iser/iser_verbs.c +index 0cbc7ceb9a55..1610accfed0b 100644 +--- a/drivers/infiniband/ulp/iser/iser_verbs.c ++++ b/drivers/infiniband/ulp/iser/iser_verbs.c +@@ -1289,7 +1289,9 @@ u8 iser_check_task_pi_status(struct iscsi_iser_task *iser_task, + IB_MR_CHECK_SIG_STATUS, &mr_status); + if (ret) { + pr_err("ib_check_mr_status failed, ret %d\n", ret); +- goto err; ++ /* Not a lot we can do, return ambiguous guard error */ ++ *sector = 0; ++ return 0x1; + } + + if (mr_status.fail_status & IB_MR_CHECK_SIG_STATUS) { +@@ -1317,7 +1319,4 @@ u8 iser_check_task_pi_status(struct iscsi_iser_task *iser_task, + } + + return 0; +-err: +- /* Not alot we can do here, return ambiguous guard error */ +- return 0x1; + } +diff --git a/drivers/input/joystick/xpad.c b/drivers/input/joystick/xpad.c +index 2e52015634f9..f55dcdf99bc5 100644 +--- a/drivers/input/joystick/xpad.c ++++ b/drivers/input/joystick/xpad.c +@@ -483,18 +483,18 @@ static const u8 xboxone_hori_init[] = { + }; + + /* +- * This packet is required for some of the PDP pads to start ++ * This packet is required for most (all?) of the PDP pads to start + * sending input reports. These pads include: (0x0e6f:0x02ab), +- * (0x0e6f:0x02a4). ++ * (0x0e6f:0x02a4), (0x0e6f:0x02a6). + */ + static const u8 xboxone_pdp_init1[] = { + 0x0a, 0x20, 0x00, 0x03, 0x00, 0x01, 0x14 + }; + + /* +- * This packet is required for some of the PDP pads to start ++ * This packet is required for most (all?) of the PDP pads to start + * sending input reports. These pads include: (0x0e6f:0x02ab), +- * (0x0e6f:0x02a4). ++ * (0x0e6f:0x02a4), (0x0e6f:0x02a6). + */ + static const u8 xboxone_pdp_init2[] = { + 0x06, 0x20, 0x00, 0x02, 0x01, 0x00 +@@ -530,12 +530,8 @@ static const struct xboxone_init_packet xboxone_init_packets[] = { + XBOXONE_INIT_PKT(0x0e6f, 0x0165, xboxone_hori_init), + XBOXONE_INIT_PKT(0x0f0d, 0x0067, xboxone_hori_init), + XBOXONE_INIT_PKT(0x0000, 0x0000, xboxone_fw2015_init), +- XBOXONE_INIT_PKT(0x0e6f, 0x02ab, xboxone_pdp_init1), +- XBOXONE_INIT_PKT(0x0e6f, 0x02ab, xboxone_pdp_init2), +- XBOXONE_INIT_PKT(0x0e6f, 0x02a4, xboxone_pdp_init1), +- XBOXONE_INIT_PKT(0x0e6f, 0x02a4, xboxone_pdp_init2), +- XBOXONE_INIT_PKT(0x0e6f, 0x02a6, xboxone_pdp_init1), +- XBOXONE_INIT_PKT(0x0e6f, 0x02a6, xboxone_pdp_init2), ++ XBOXONE_INIT_PKT(0x0e6f, 0x0000, xboxone_pdp_init1), ++ XBOXONE_INIT_PKT(0x0e6f, 0x0000, xboxone_pdp_init2), + XBOXONE_INIT_PKT(0x24c6, 0x541a, xboxone_rumblebegin_init), + XBOXONE_INIT_PKT(0x24c6, 0x542a, xboxone_rumblebegin_init), + XBOXONE_INIT_PKT(0x24c6, 0x543a, xboxone_rumblebegin_init), +diff --git a/drivers/input/keyboard/matrix_keypad.c b/drivers/input/keyboard/matrix_keypad.c +index 795fa353de7c..c64d87442a62 100644 +--- a/drivers/input/keyboard/matrix_keypad.c ++++ b/drivers/input/keyboard/matrix_keypad.c +@@ -405,7 +405,7 @@ matrix_keypad_parse_dt(struct device *dev) + struct matrix_keypad_platform_data *pdata; + struct device_node *np = dev->of_node; + unsigned int *gpios; +- int i, nrow, ncol; ++ int ret, i, nrow, ncol; + + if (!np) { + dev_err(dev, "device lacks DT data\n"); +@@ -447,12 +447,19 @@ matrix_keypad_parse_dt(struct device *dev) + return ERR_PTR(-ENOMEM); + } + +- for (i = 0; i < pdata->num_row_gpios; i++) +- gpios[i] = of_get_named_gpio(np, "row-gpios", i); ++ for (i = 0; i < nrow; i++) { ++ ret = of_get_named_gpio(np, "row-gpios", i); ++ if (ret < 0) ++ return ERR_PTR(ret); ++ gpios[i] = ret; ++ } + +- for (i = 0; i < pdata->num_col_gpios; i++) +- gpios[pdata->num_row_gpios + i] = +- of_get_named_gpio(np, "col-gpios", i); ++ for (i = 0; i < ncol; i++) { ++ ret = of_get_named_gpio(np, "col-gpios", i); ++ if (ret < 0) ++ return ERR_PTR(ret); ++ gpios[nrow + i] = ret; ++ } + + pdata->row_gpios = gpios; + pdata->col_gpios = &gpios[pdata->num_row_gpios]; +@@ -479,10 +486,8 @@ static int matrix_keypad_probe(struct platform_device *pdev) + pdata = dev_get_platdata(&pdev->dev); + if (!pdata) { + pdata = matrix_keypad_parse_dt(&pdev->dev); +- if (IS_ERR(pdata)) { +- dev_err(&pdev->dev, "no platform data defined\n"); ++ if (IS_ERR(pdata)) + return PTR_ERR(pdata); +- } + } else if (!pdata->keymap_data) { + dev_err(&pdev->dev, "no keymap data defined\n"); + return -EINVAL; +diff --git a/drivers/input/mouse/elan_i2c_core.c b/drivers/input/mouse/elan_i2c_core.c +index b3119589a444..471984ec2db0 100644 +--- a/drivers/input/mouse/elan_i2c_core.c ++++ b/drivers/input/mouse/elan_i2c_core.c +@@ -1253,6 +1253,9 @@ static const struct acpi_device_id elan_acpi_id[] = { + { "ELAN0618", 0 }, + { "ELAN061C", 0 }, + { "ELAN061D", 0 }, ++ { "ELAN061E", 0 }, ++ { "ELAN0620", 0 }, ++ { "ELAN0621", 0 }, + { "ELAN0622", 0 }, + { "ELAN1000", 0 }, + { } +diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c +index 49b266433f4c..7feaa82f8c7c 100644 +--- a/drivers/iommu/intel-iommu.c ++++ b/drivers/iommu/intel-iommu.c +@@ -2977,7 +2977,7 @@ static int copy_context_table(struct intel_iommu *iommu, + } + + if (old_ce) +- iounmap(old_ce); ++ memunmap(old_ce); + + ret = 0; + if (devfn < 0x80) +diff --git a/drivers/iommu/intel-svm.c b/drivers/iommu/intel-svm.c +index 10068a481e22..cbde03e509c1 100644 +--- a/drivers/iommu/intel-svm.c ++++ b/drivers/iommu/intel-svm.c +@@ -558,7 +558,7 @@ static irqreturn_t prq_event_thread(int irq, void *d) + pr_err("%s: Page request without PASID: %08llx %08llx\n", + iommu->name, ((unsigned long long *)req)[0], + ((unsigned long long *)req)[1]); +- goto bad_req; ++ goto no_pasid; + } + + if (!svm || svm->pasid != req->pasid) { +diff --git a/drivers/iommu/ipmmu-vmsa.c b/drivers/iommu/ipmmu-vmsa.c +index 624e7ff76166..9101be1a6b59 100644 +--- a/drivers/iommu/ipmmu-vmsa.c ++++ b/drivers/iommu/ipmmu-vmsa.c +@@ -372,6 +372,9 @@ static int ipmmu_domain_init_context(struct ipmmu_vmsa_domain *domain) + + static void ipmmu_domain_destroy_context(struct ipmmu_vmsa_domain *domain) + { ++ if (!domain->mmu) ++ return; ++ + /* + * Disable the context. Flush the TLB as required when modifying the + * context registers. +diff --git a/drivers/leds/led-class.c b/drivers/leds/led-class.c +index 7385f98dd54b..51a5b51ec467 100644 +--- a/drivers/leds/led-class.c ++++ b/drivers/leds/led-class.c +@@ -247,12 +247,13 @@ void led_classdev_unregister(struct led_classdev *led_cdev) + up_write(&led_cdev->trigger_lock); + #endif + +- cancel_work_sync(&led_cdev->set_brightness_work); +- + /* Stop blinking */ + led_stop_software_blink(led_cdev); ++ + led_set_brightness(led_cdev, LED_OFF); + ++ flush_work(&led_cdev->set_brightness_work); ++ + device_unregister(led_cdev->dev); + + down_write(&leds_list_lock); +diff --git a/drivers/leds/leds-gpio.c b/drivers/leds/leds-gpio.c +index 5db4515a4fd7..df186b38da78 100644 +--- a/drivers/leds/leds-gpio.c ++++ b/drivers/leds/leds-gpio.c +@@ -118,8 +118,8 @@ static int create_gpio_led(const struct gpio_led *template, + return ret; + + led_dat->gpiod = gpio_to_desc(template->gpio); +- if (IS_ERR(led_dat->gpiod)) +- return PTR_ERR(led_dat->gpiod); ++ if (!led_dat->gpiod) ++ return -EINVAL; + } + + led_dat->cdev.name = template->name; +diff --git a/drivers/leds/leds-pwm.c b/drivers/leds/leds-pwm.c +index 1d07e3e83d29..3149dbece146 100644 +--- a/drivers/leds/leds-pwm.c ++++ b/drivers/leds/leds-pwm.c +@@ -132,6 +132,7 @@ static int led_pwm_add(struct device *dev, struct led_pwm_priv *priv, + ret = led_classdev_register(dev, &led_data->cdev); + if (ret == 0) { + priv->num_leds++; ++ led_pwm_set(&led_data->cdev, led_data->cdev.brightness); + } else { + dev_err(dev, "failed to register PWM led for %s: %d\n", + led->name, ret); +diff --git a/drivers/media/usb/em28xx/em28xx-dvb.c b/drivers/media/usb/em28xx/em28xx-dvb.c +index 357be76c7a55..5502a0fb94fd 100644 +--- a/drivers/media/usb/em28xx/em28xx-dvb.c ++++ b/drivers/media/usb/em28xx/em28xx-dvb.c +@@ -1806,6 +1806,8 @@ static int em28xx_dvb_fini(struct em28xx *dev) + } + } + ++ em28xx_unregister_dvb(dvb); ++ + /* remove I2C SEC */ + client = dvb->i2c_client_sec; + if (client) { +@@ -1827,7 +1829,6 @@ static int em28xx_dvb_fini(struct em28xx *dev) + i2c_unregister_device(client); + } + +- em28xx_unregister_dvb(dvb); + kfree(dvb); + dev->dvb = NULL; + kref_put(&dev->ref, em28xx_free_device); +diff --git a/drivers/misc/mic/scif/scif_rma.c b/drivers/misc/mic/scif/scif_rma.c +index 6a451bd65bf3..8bd63128d536 100644 +--- a/drivers/misc/mic/scif/scif_rma.c ++++ b/drivers/misc/mic/scif/scif_rma.c +@@ -414,7 +414,7 @@ static int scif_create_remote_lookup(struct scif_dev *remote_dev, + if (err) + goto error_window; + err = scif_map_page(&window->num_pages_lookup.lookup[j], +- vmalloc_dma_phys ? ++ vmalloc_num_pages ? + vmalloc_to_page(&window->num_pages[i]) : + virt_to_page(&window->num_pages[i]), + remote_dev); +diff --git a/drivers/net/can/rcar_can.c b/drivers/net/can/rcar_can.c +index bc46be39549d..9d93492ddfcc 100644 +--- a/drivers/net/can/rcar_can.c ++++ b/drivers/net/can/rcar_can.c +@@ -24,6 +24,9 @@ + + #define RCAR_CAN_DRV_NAME "rcar_can" + ++#define RCAR_SUPPORTED_CLOCKS (BIT(CLKR_CLKP1) | BIT(CLKR_CLKP2) | \ ++ BIT(CLKR_CLKEXT)) ++ + /* Mailbox configuration: + * mailbox 60 - 63 - Rx FIFO mailboxes + * mailbox 56 - 59 - Tx FIFO mailboxes +@@ -789,7 +792,7 @@ static int rcar_can_probe(struct platform_device *pdev) + goto fail_clk; + } + +- if (clock_select >= ARRAY_SIZE(clock_names)) { ++ if (!(BIT(clock_select) & RCAR_SUPPORTED_CLOCKS)) { + err = -EINVAL; + dev_err(&pdev->dev, "invalid CAN clock selected\n"); + goto fail_clk; +diff --git a/drivers/net/ethernet/amd/sunlance.c b/drivers/net/ethernet/amd/sunlance.c +index 7847638bdd22..8914170fccff 100644 +--- a/drivers/net/ethernet/amd/sunlance.c ++++ b/drivers/net/ethernet/amd/sunlance.c +@@ -1419,7 +1419,7 @@ static int sparc_lance_probe_one(struct platform_device *op, + + prop = of_get_property(nd, "tpe-link-test?", NULL); + if (!prop) +- goto no_link_test; ++ goto node_put; + + if (strcmp(prop, "true")) { + printk(KERN_NOTICE "SunLance: warning: overriding option " +@@ -1428,6 +1428,8 @@ static int sparc_lance_probe_one(struct platform_device *op, + "to e...@skynet.be\n"); + auxio_set_lte(AUXIO_LTE_ON); + } ++node_put: ++ of_node_put(nd); + no_link_test: + lp->auto_select = 1; + lp->tpe = 0; +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h +index 1ea068815419..2491cdc2535c 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h +@@ -2291,6 +2291,13 @@ void bnx2x_igu_clear_sb_gen(struct bnx2x *bp, u8 func, u8 idu_sb_id, + #define PMF_DMAE_C(bp) (BP_PORT(bp) * MAX_DMAE_C_PER_PORT + \ + E1HVN_MAX) + ++/* Following is the DMAE channel number allocation for the clients. ++ * MFW: OCBB/OCSD implementations use DMAE channels 14/15 respectively. ++ * Driver: 0-3 and 8-11 (for PF dmae operations) ++ * 4 and 12 (for stats requests) ++ */ ++#define BNX2X_FW_DMAE_C 13 /* Channel for FW DMAE operations */ ++ + /* PCIE link and speed */ + #define PCICFG_LINK_WIDTH 0x1f00000 + #define PCICFG_LINK_WIDTH_SHIFT 20 +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c +index ff702a707a91..343e3366d751 100644 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c +@@ -5931,6 +5931,7 @@ static inline int bnx2x_func_send_start(struct bnx2x *bp, + rdata->sd_vlan_tag = cpu_to_le16(start_params->sd_vlan_tag); + rdata->path_id = BP_PATH(bp); + rdata->network_cos_mode = start_params->network_cos_mode; ++ rdata->dmae_cmd_id = BNX2X_FW_DMAE_C; + + rdata->vxlan_dst_port = cpu_to_le16(start_params->vxlan_dst_port); + rdata->geneve_dst_port = cpu_to_le16(start_params->geneve_dst_port); +diff --git a/drivers/net/ethernet/faraday/ftmac100.c b/drivers/net/ethernet/faraday/ftmac100.c +index dce5f7b7f772..05e1f923f49e 100644 +--- a/drivers/net/ethernet/faraday/ftmac100.c ++++ b/drivers/net/ethernet/faraday/ftmac100.c +@@ -865,11 +865,10 @@ static irqreturn_t ftmac100_interrupt(int irq, void *dev_id) + struct net_device *netdev = dev_id; + struct ftmac100 *priv = netdev_priv(netdev); + +- if (likely(netif_running(netdev))) { +- /* Disable interrupts for polling */ +- ftmac100_disable_all_int(priv); ++ /* Disable interrupts for polling */ ++ ftmac100_disable_all_int(priv); ++ if (likely(netif_running(netdev))) + napi_schedule(&priv->napi); +- } + + return IRQ_HANDLED; + } +diff --git a/drivers/net/ethernet/mellanox/mlx4/alloc.c b/drivers/net/ethernet/mellanox/mlx4/alloc.c +index 0c51c69f802f..a4912b11e54f 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/alloc.c ++++ b/drivers/net/ethernet/mellanox/mlx4/alloc.c +@@ -339,7 +339,7 @@ void mlx4_zone_allocator_destroy(struct mlx4_zone_allocator *zone_alloc) + static u32 __mlx4_alloc_from_zone(struct mlx4_zone_entry *zone, int count, + int align, u32 skip_mask, u32 *puid) + { +- u32 uid; ++ u32 uid = 0; + u32 res; + struct mlx4_zone_allocator *zone_alloc = zone->allocator; + struct mlx4_zone_entry *curr_node; +diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4.h b/drivers/net/ethernet/mellanox/mlx4/mlx4.h +index f5fdbd53d052..db40387ffaf6 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/mlx4.h ++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4.h +@@ -537,8 +537,8 @@ struct slave_list { + struct resource_allocator { + spinlock_t alloc_lock; /* protect quotas */ + union { +- int res_reserved; +- int res_port_rsvd[MLX4_MAX_PORTS]; ++ unsigned int res_reserved; ++ unsigned int res_port_rsvd[MLX4_MAX_PORTS]; + }; + union { + int res_free; +diff --git a/drivers/net/ethernet/mellanox/mlx4/mr.c b/drivers/net/ethernet/mellanox/mlx4/mr.c +index 93195191f45b..53833c06696f 100644 +--- a/drivers/net/ethernet/mellanox/mlx4/mr.c ++++ b/drivers/net/ethernet/mellanox/mlx4/mr.c +@@ -366,6 +366,7 @@ int mlx4_mr_hw_write_mpt(struct mlx4_dev *dev, struct mlx4_mr *mmr, + container_of((void *)mpt_entry, struct mlx4_cmd_mailbox, + buf); + ++ (*mpt_entry)->lkey = 0; + err = mlx4_SW2HW_MPT(dev, mailbox, key); + } + +diff --git a/drivers/net/ethernet/qlogic/qed/qed_int.c b/drivers/net/ethernet/qlogic/qed/qed_int.c +index 9cc9d62c1fec..8b15a018d625 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_int.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_int.c +@@ -177,6 +177,8 @@ static int qed_int_attentions(struct qed_hwfn *p_hwfn) + */ + do { + index = p_sb_attn->sb_index; ++ /* finish reading index before the loop condition */ ++ dma_rmb(); + attn_bits = le32_to_cpu(p_sb_attn->atten_bits); + attn_acks = le32_to_cpu(p_sb_attn->atten_ack); + } while (index != p_sb_attn->sb_index); +diff --git a/drivers/net/ethernet/qlogic/qed/qed_main.c b/drivers/net/ethernet/qlogic/qed/qed_main.c +index 35e1468d8196..b8ae6ed5c7ba 100644 +--- a/drivers/net/ethernet/qlogic/qed/qed_main.c ++++ b/drivers/net/ethernet/qlogic/qed/qed_main.c +@@ -1124,9 +1124,9 @@ static int qed_drain(struct qed_dev *cdev) + return -EBUSY; + } + rc = qed_mcp_drain(hwfn, ptt); ++ qed_ptt_release(hwfn, ptt); + if (rc) + return rc; +- qed_ptt_release(hwfn, ptt); + } + + return 0; +diff --git a/drivers/net/rionet.c b/drivers/net/rionet.c +index e7034c55e796..6ef9188384ce 100644 +--- a/drivers/net/rionet.c ++++ b/drivers/net/rionet.c +@@ -215,9 +215,9 @@ static int rionet_start_xmit(struct sk_buff *skb, struct net_device *ndev) + * it just report sending a packet to the target + * (without actual packet transfer). + */ +- dev_kfree_skb_any(skb); + ndev->stats.tx_packets++; + ndev->stats.tx_bytes += skb->len; ++ dev_kfree_skb_any(skb); + } + } + +diff --git a/drivers/net/usb/ipheth.c b/drivers/net/usb/ipheth.c +index 76465b117b72..f1f8227e7342 100644 +--- a/drivers/net/usb/ipheth.c ++++ b/drivers/net/usb/ipheth.c +@@ -140,7 +140,6 @@ struct ipheth_device { + struct usb_device *udev; + struct usb_interface *intf; + struct net_device *net; +- struct sk_buff *tx_skb; + struct urb *tx_urb; + struct urb *rx_urb; + unsigned char *tx_buf; +@@ -229,6 +228,7 @@ static void ipheth_rcvbulk_callback(struct urb *urb) + case -ENOENT: + case -ECONNRESET: + case -ESHUTDOWN: ++ case -EPROTO: + return; + case 0: + break; +@@ -280,7 +280,6 @@ static void ipheth_sndbulk_callback(struct urb *urb) + dev_err(&dev->intf->dev, "%s: urb status: %d\n", + __func__, status); + +- dev_kfree_skb_irq(dev->tx_skb); + netif_wake_queue(dev->net); + } + +@@ -410,7 +409,7 @@ static int ipheth_tx(struct sk_buff *skb, struct net_device *net) + if (skb->len > IPHETH_BUF_SIZE) { + WARN(1, "%s: skb too large: %d bytes\n", __func__, skb->len); + dev->net->stats.tx_dropped++; +- dev_kfree_skb_irq(skb); ++ dev_kfree_skb_any(skb); + return NETDEV_TX_OK; + } + +@@ -430,12 +429,11 @@ static int ipheth_tx(struct sk_buff *skb, struct net_device *net) + dev_err(&dev->intf->dev, "%s: usb_submit_urb: %d\n", + __func__, retval); + dev->net->stats.tx_errors++; +- dev_kfree_skb_irq(skb); ++ dev_kfree_skb_any(skb); + } else { +- dev->tx_skb = skb; +- + dev->net->stats.tx_packets++; + dev->net->stats.tx_bytes += skb->len; ++ dev_consume_skb_any(skb); + netif_stop_queue(net); + } + +diff --git a/drivers/net/wireless/mac80211_hwsim.c b/drivers/net/wireless/mac80211_hwsim.c +index 05413176a5d6..ab480ea6d95a 100644 +--- a/drivers/net/wireless/mac80211_hwsim.c ++++ b/drivers/net/wireless/mac80211_hwsim.c +@@ -2515,6 +2515,10 @@ static int mac80211_hwsim_new_radio(struct genl_info *info, + if (param->no_vif) + ieee80211_hw_set(hw, NO_AUTO_VIF); + ++ tasklet_hrtimer_init(&data->beacon_timer, ++ mac80211_hwsim_beacon, ++ CLOCK_MONOTONIC, HRTIMER_MODE_ABS); ++ + err = ieee80211_register_hw(hw); + if (err < 0) { + printk(KERN_DEBUG "mac80211_hwsim: ieee80211_register_hw failed (%d)\n", +@@ -2539,10 +2543,6 @@ static int mac80211_hwsim_new_radio(struct genl_info *info, + data->debugfs, + data, &hwsim_simulate_radar); + +- tasklet_hrtimer_init(&data->beacon_timer, +- mac80211_hwsim_beacon, +- CLOCK_MONOTONIC, HRTIMER_MODE_ABS); +- + spin_lock_bh(&hwsim_radio_lock); + list_add_tail(&data->list, &hwsim_radios); + spin_unlock_bh(&hwsim_radio_lock); +diff --git a/drivers/net/wireless/ti/wlcore/cmd.c b/drivers/net/wireless/ti/wlcore/cmd.c +index 15dc7a398b90..f01d24baff7c 100644 +--- a/drivers/net/wireless/ti/wlcore/cmd.c ++++ b/drivers/net/wireless/ti/wlcore/cmd.c +@@ -35,7 +35,6 @@ + #include "wl12xx_80211.h" + #include "cmd.h" + #include "event.h" +-#include "ps.h" + #include "tx.h" + #include "hw_ops.h" + +@@ -192,10 +191,6 @@ int wlcore_cmd_wait_for_event_or_timeout(struct wl1271 *wl, + + timeout_time = jiffies + msecs_to_jiffies(WL1271_EVENT_TIMEOUT); + +- ret = wl1271_ps_elp_wakeup(wl); +- if (ret < 0) +- return ret; +- + do { + if (time_after(jiffies, timeout_time)) { + wl1271_debug(DEBUG_CMD, "timeout waiting for event %d", +@@ -227,7 +222,6 @@ int wlcore_cmd_wait_for_event_or_timeout(struct wl1271 *wl, + } while (!event); + + out: +- wl1271_ps_elp_sleep(wl); + kfree(events_vector); + return ret; + } +diff --git a/drivers/s390/net/qeth_core_main.c b/drivers/s390/net/qeth_core_main.c +index 09ac56317f1b..533bd2467910 100644 +--- a/drivers/s390/net/qeth_core_main.c ++++ b/drivers/s390/net/qeth_core_main.c +@@ -4519,8 +4519,8 @@ static int qeth_snmp_command_cb(struct qeth_card *card, + { + struct qeth_ipa_cmd *cmd; + struct qeth_arp_query_info *qinfo; +- struct qeth_snmp_cmd *snmp; + unsigned char *data; ++ void *snmp_data; + __u16 data_len; + + QETH_CARD_TEXT(card, 3, "snpcmdcb"); +@@ -4528,7 +4528,6 @@ static int qeth_snmp_command_cb(struct qeth_card *card, + cmd = (struct qeth_ipa_cmd *) sdata; + data = (unsigned char *)((char *)cmd - reply->offset); + qinfo = (struct qeth_arp_query_info *) reply->param; +- snmp = &cmd->data.setadapterparms.data.snmp; + + if (cmd->hdr.return_code) { + QETH_CARD_TEXT_(card, 4, "scer1%x", cmd->hdr.return_code); +@@ -4541,10 +4540,15 @@ static int qeth_snmp_command_cb(struct qeth_card *card, + return 0; + } + data_len = *((__u16 *)QETH_IPA_PDU_LEN_PDU1(data)); +- if (cmd->data.setadapterparms.hdr.seq_no == 1) +- data_len -= (__u16)((char *)&snmp->data - (char *)cmd); +- else +- data_len -= (__u16)((char *)&snmp->request - (char *)cmd); ++ if (cmd->data.setadapterparms.hdr.seq_no == 1) { ++ snmp_data = &cmd->data.setadapterparms.data.snmp; ++ data_len -= offsetof(struct qeth_ipa_cmd, ++ data.setadapterparms.data.snmp); ++ } else { ++ snmp_data = &cmd->data.setadapterparms.data.snmp.request; ++ data_len -= offsetof(struct qeth_ipa_cmd, ++ data.setadapterparms.data.snmp.request); ++ } + + /* check if there is enough room in userspace */ + if ((qinfo->udata_len - qinfo->udata_offset) < data_len) { +@@ -4557,16 +4561,9 @@ static int qeth_snmp_command_cb(struct qeth_card *card, + QETH_CARD_TEXT_(card, 4, "sseqn%i", + cmd->data.setadapterparms.hdr.seq_no); + /*copy entries to user buffer*/ +- if (cmd->data.setadapterparms.hdr.seq_no == 1) { +- memcpy(qinfo->udata + qinfo->udata_offset, +- (char *)snmp, +- data_len + offsetof(struct qeth_snmp_cmd, data)); +- qinfo->udata_offset += offsetof(struct qeth_snmp_cmd, data); +- } else { +- memcpy(qinfo->udata + qinfo->udata_offset, +- (char *)&snmp->request, data_len); +- } ++ memcpy(qinfo->udata + qinfo->udata_offset, snmp_data, data_len); + qinfo->udata_offset += data_len; ++ + /* check if all replies received ... */ + QETH_CARD_TEXT_(card, 4, "srtot%i", + cmd->data.setadapterparms.hdr.used_total); +diff --git a/drivers/s390/virtio/virtio_ccw.c b/drivers/s390/virtio/virtio_ccw.c +index 1b831598df7c..ff06bdfd2b20 100644 +--- a/drivers/s390/virtio/virtio_ccw.c ++++ b/drivers/s390/virtio/virtio_ccw.c +@@ -59,6 +59,7 @@ struct virtio_ccw_device { + unsigned int revision; /* Transport revision */ + wait_queue_head_t wait_q; + spinlock_t lock; ++ struct mutex io_lock; /* Serializes I/O requests */ + struct list_head virtqueues; + unsigned long indicators; + unsigned long indicators2; +@@ -307,6 +308,7 @@ static int ccw_io_helper(struct virtio_ccw_device *vcdev, + unsigned long flags; + int flag = intparm & VIRTIO_CCW_INTPARM_MASK; + ++ mutex_lock(&vcdev->io_lock); + do { + spin_lock_irqsave(get_ccwdev_lock(vcdev->cdev), flags); + ret = ccw_device_start(vcdev->cdev, ccw, intparm, 0, 0); +@@ -319,7 +321,9 @@ static int ccw_io_helper(struct virtio_ccw_device *vcdev, + cpu_relax(); + } while (ret == -EBUSY); + wait_event(vcdev->wait_q, doing_io(vcdev, flag) == 0); +- return ret ? ret : vcdev->err; ++ ret = ret ? ret : vcdev->err; ++ mutex_unlock(&vcdev->io_lock); ++ return ret; + } + + static void virtio_ccw_drop_indicator(struct virtio_ccw_device *vcdev, +@@ -833,6 +837,7 @@ static void virtio_ccw_get_config(struct virtio_device *vdev, + int ret; + struct ccw1 *ccw; + void *config_area; ++ unsigned long flags; + + ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL); + if (!ccw) +@@ -851,11 +856,13 @@ static void virtio_ccw_get_config(struct virtio_device *vdev, + if (ret) + goto out_free; + ++ spin_lock_irqsave(&vcdev->lock, flags); + memcpy(vcdev->config, config_area, offset + len); +- if (buf) +- memcpy(buf, &vcdev->config[offset], len); + if (vcdev->config_ready < offset + len) + vcdev->config_ready = offset + len; ++ spin_unlock_irqrestore(&vcdev->lock, flags); ++ if (buf) ++ memcpy(buf, config_area + offset, len); + + out_free: + kfree(config_area); +@@ -869,6 +876,7 @@ static void virtio_ccw_set_config(struct virtio_device *vdev, + struct virtio_ccw_device *vcdev = to_vc_device(vdev); + struct ccw1 *ccw; + void *config_area; ++ unsigned long flags; + + ccw = kzalloc(sizeof(*ccw), GFP_DMA | GFP_KERNEL); + if (!ccw) +@@ -881,9 +889,11 @@ static void virtio_ccw_set_config(struct virtio_device *vdev, + /* Make sure we don't overwrite fields. */ + if (vcdev->config_ready < offset) + virtio_ccw_get_config(vdev, 0, NULL, offset); ++ spin_lock_irqsave(&vcdev->lock, flags); + memcpy(&vcdev->config[offset], buf, len); + /* Write the config area to the host. */ + memcpy(config_area, vcdev->config, sizeof(vcdev->config)); ++ spin_unlock_irqrestore(&vcdev->lock, flags); + ccw->cmd_code = CCW_CMD_WRITE_CONF; + ccw->flags = 0; + ccw->count = offset + len; +@@ -1230,6 +1240,7 @@ static int virtio_ccw_online(struct ccw_device *cdev) + init_waitqueue_head(&vcdev->wait_q); + INIT_LIST_HEAD(&vcdev->virtqueues); + spin_lock_init(&vcdev->lock); ++ mutex_init(&vcdev->io_lock); + + spin_lock_irqsave(get_ccwdev_lock(cdev), flags); + dev_set_drvdata(&cdev->dev, vcdev); +diff --git a/drivers/scsi/bfa/bfa_fcbuild.c b/drivers/scsi/bfa/bfa_fcbuild.c +index dce787f6cca2..daade591409a 100644 +--- a/drivers/scsi/bfa/bfa_fcbuild.c ++++ b/drivers/scsi/bfa/bfa_fcbuild.c +@@ -1249,8 +1249,8 @@ fc_rspnid_build(struct fchs_s *fchs, void *pyld, u32 s_id, u16 ox_id, + memset(rspnid, 0, sizeof(struct fcgs_rspnid_req_s)); + + rspnid->dap = s_id; +- rspnid->spn_len = (u8) strlen((char *)name); +- strncpy((char *)rspnid->spn, (char *)name, rspnid->spn_len); ++ strlcpy(rspnid->spn, name, sizeof(rspnid->spn)); ++ rspnid->spn_len = (u8) strlen(rspnid->spn); + + return sizeof(struct fcgs_rspnid_req_s) + sizeof(struct ct_hdr_s); + } +@@ -1270,8 +1270,8 @@ fc_rsnn_nn_build(struct fchs_s *fchs, void *pyld, u32 s_id, + memset(rsnn_nn, 0, sizeof(struct fcgs_rsnn_nn_req_s)); + + rsnn_nn->node_name = node_name; +- rsnn_nn->snn_len = (u8) strlen((char *)name); +- strncpy((char *)rsnn_nn->snn, (char *)name, rsnn_nn->snn_len); ++ strlcpy(rsnn_nn->snn, name, sizeof(rsnn_nn->snn)); ++ rsnn_nn->snn_len = (u8) strlen(rsnn_nn->snn); + + return sizeof(struct fcgs_rsnn_nn_req_s) + sizeof(struct ct_hdr_s); + } +diff --git a/drivers/scsi/bfa/bfa_fcs.c b/drivers/scsi/bfa/bfa_fcs.c +index 0f19455951ec..475470efb7c6 100644 +--- a/drivers/scsi/bfa/bfa_fcs.c ++++ b/drivers/scsi/bfa/bfa_fcs.c +@@ -831,23 +831,23 @@ bfa_fcs_fabric_psymb_init(struct bfa_fcs_fabric_s *fabric) + bfa_ioc_get_adapter_model(&fabric->fcs->bfa->ioc, model); + + /* Model name/number */ +- strncpy((char *)&port_cfg->sym_name, model, +- BFA_FCS_PORT_SYMBNAME_MODEL_SZ); +- strncat((char *)&port_cfg->sym_name, BFA_FCS_PORT_SYMBNAME_SEPARATOR, +- sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR)); ++ strlcpy(port_cfg->sym_name.symname, model, ++ BFA_SYMNAME_MAXLEN); ++ strlcat(port_cfg->sym_name.symname, BFA_FCS_PORT_SYMBNAME_SEPARATOR, ++ BFA_SYMNAME_MAXLEN); + + /* Driver Version */ +- strncat((char *)&port_cfg->sym_name, (char *)driver_info->version, +- BFA_FCS_PORT_SYMBNAME_VERSION_SZ); +- strncat((char *)&port_cfg->sym_name, BFA_FCS_PORT_SYMBNAME_SEPARATOR, +- sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR)); ++ strlcat(port_cfg->sym_name.symname, driver_info->version, ++ BFA_SYMNAME_MAXLEN); ++ strlcat(port_cfg->sym_name.symname, BFA_FCS_PORT_SYMBNAME_SEPARATOR, ++ BFA_SYMNAME_MAXLEN); + + /* Host machine name */ +- strncat((char *)&port_cfg->sym_name, +- (char *)driver_info->host_machine_name, +- BFA_FCS_PORT_SYMBNAME_MACHINENAME_SZ); +- strncat((char *)&port_cfg->sym_name, BFA_FCS_PORT_SYMBNAME_SEPARATOR, +- sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR)); ++ strlcat(port_cfg->sym_name.symname, ++ driver_info->host_machine_name, ++ BFA_SYMNAME_MAXLEN); ++ strlcat(port_cfg->sym_name.symname, BFA_FCS_PORT_SYMBNAME_SEPARATOR, ++ BFA_SYMNAME_MAXLEN); + + /* + * Host OS Info : +@@ -855,24 +855,24 @@ bfa_fcs_fabric_psymb_init(struct bfa_fcs_fabric_s *fabric) + * OS name string and instead copy the entire OS info string (64 bytes). + */ + if (driver_info->host_os_patch[0] == '\0') { +- strncat((char *)&port_cfg->sym_name, +- (char *)driver_info->host_os_name, +- BFA_FCS_OS_STR_LEN); +- strncat((char *)&port_cfg->sym_name, ++ strlcat(port_cfg->sym_name.symname, ++ driver_info->host_os_name, ++ BFA_SYMNAME_MAXLEN); ++ strlcat(port_cfg->sym_name.symname, + BFA_FCS_PORT_SYMBNAME_SEPARATOR, +- sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR)); ++ BFA_SYMNAME_MAXLEN); + } else { +- strncat((char *)&port_cfg->sym_name, +- (char *)driver_info->host_os_name, +- BFA_FCS_PORT_SYMBNAME_OSINFO_SZ); +- strncat((char *)&port_cfg->sym_name, ++ strlcat(port_cfg->sym_name.symname, ++ driver_info->host_os_name, ++ BFA_SYMNAME_MAXLEN); ++ strlcat(port_cfg->sym_name.symname, + BFA_FCS_PORT_SYMBNAME_SEPARATOR, +- sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR)); ++ BFA_SYMNAME_MAXLEN); + + /* Append host OS Patch Info */ +- strncat((char *)&port_cfg->sym_name, +- (char *)driver_info->host_os_patch, +- BFA_FCS_PORT_SYMBNAME_OSPATCH_SZ); ++ strlcat(port_cfg->sym_name.symname, ++ driver_info->host_os_patch, ++ BFA_SYMNAME_MAXLEN); + } + + /* null terminate */ +@@ -892,26 +892,26 @@ bfa_fcs_fabric_nsymb_init(struct bfa_fcs_fabric_s *fabric) + bfa_ioc_get_adapter_model(&fabric->fcs->bfa->ioc, model); + + /* Model name/number */ +- strncpy((char *)&port_cfg->node_sym_name, model, +- BFA_FCS_PORT_SYMBNAME_MODEL_SZ); +- strncat((char *)&port_cfg->node_sym_name, ++ strlcpy(port_cfg->node_sym_name.symname, model, ++ BFA_SYMNAME_MAXLEN); ++ strlcat(port_cfg->node_sym_name.symname, + BFA_FCS_PORT_SYMBNAME_SEPARATOR, +- sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR)); ++ BFA_SYMNAME_MAXLEN); + + /* Driver Version */ +- strncat((char *)&port_cfg->node_sym_name, (char *)driver_info->version, +- BFA_FCS_PORT_SYMBNAME_VERSION_SZ); +- strncat((char *)&port_cfg->node_sym_name, ++ strlcat(port_cfg->node_sym_name.symname, (char *)driver_info->version, ++ BFA_SYMNAME_MAXLEN); ++ strlcat(port_cfg->node_sym_name.symname, + BFA_FCS_PORT_SYMBNAME_SEPARATOR, +- sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR)); ++ BFA_SYMNAME_MAXLEN); + + /* Host machine name */ +- strncat((char *)&port_cfg->node_sym_name, +- (char *)driver_info->host_machine_name, +- BFA_FCS_PORT_SYMBNAME_MACHINENAME_SZ); +- strncat((char *)&port_cfg->node_sym_name, ++ strlcat(port_cfg->node_sym_name.symname, ++ driver_info->host_machine_name, ++ BFA_SYMNAME_MAXLEN); ++ strlcat(port_cfg->node_sym_name.symname, + BFA_FCS_PORT_SYMBNAME_SEPARATOR, +- sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR)); ++ BFA_SYMNAME_MAXLEN); + + /* null terminate */ + port_cfg->node_sym_name.symname[BFA_SYMNAME_MAXLEN - 1] = 0; +diff --git a/drivers/scsi/bfa/bfa_fcs_lport.c b/drivers/scsi/bfa/bfa_fcs_lport.c +index ff75ef891755..aa96f31ebc43 100644 +--- a/drivers/scsi/bfa/bfa_fcs_lport.c ++++ b/drivers/scsi/bfa/bfa_fcs_lport.c +@@ -2630,10 +2630,10 @@ bfa_fcs_fdmi_get_hbaattr(struct bfa_fcs_lport_fdmi_s *fdmi, + bfa_ioc_get_adapter_fw_ver(&port->fcs->bfa->ioc, + hba_attr->fw_version); + +- strncpy(hba_attr->driver_version, (char *)driver_info->version, ++ strlcpy(hba_attr->driver_version, (char *)driver_info->version, + sizeof(hba_attr->driver_version)); + +- strncpy(hba_attr->os_name, driver_info->host_os_name, ++ strlcpy(hba_attr->os_name, driver_info->host_os_name, + sizeof(hba_attr->os_name)); + + /* +@@ -2641,23 +2641,23 @@ bfa_fcs_fdmi_get_hbaattr(struct bfa_fcs_lport_fdmi_s *fdmi, + * to the os name along with a separator + */ + if (driver_info->host_os_patch[0] != '\0') { +- strncat(hba_attr->os_name, BFA_FCS_PORT_SYMBNAME_SEPARATOR, +- sizeof(BFA_FCS_PORT_SYMBNAME_SEPARATOR)); +- strncat(hba_attr->os_name, driver_info->host_os_patch, +- sizeof(driver_info->host_os_patch)); ++ strlcat(hba_attr->os_name, BFA_FCS_PORT_SYMBNAME_SEPARATOR, ++ sizeof(hba_attr->os_name)); ++ strlcat(hba_attr->os_name, driver_info->host_os_patch, ++ sizeof(hba_attr->os_name)); + } + + /* Retrieve the max frame size from the port attr */ + bfa_fcs_fdmi_get_portattr(fdmi, &fcs_port_attr); + hba_attr->max_ct_pyld = fcs_port_attr.max_frm_size; + +- strncpy(hba_attr->node_sym_name.symname, ++ strlcpy(hba_attr->node_sym_name.symname, + port->port_cfg.node_sym_name.symname, BFA_SYMNAME_MAXLEN); + strcpy(hba_attr->vendor_info, "BROCADE"); + hba_attr->num_ports = + cpu_to_be32(bfa_ioc_get_nports(&port->fcs->bfa->ioc)); + hba_attr->fabric_name = port->fabric->lps->pr_nwwn; +- strncpy(hba_attr->bios_ver, hba_attr->option_rom_ver, BFA_VERSION_LEN); ++ strlcpy(hba_attr->bios_ver, hba_attr->option_rom_ver, BFA_VERSION_LEN); + + } + +@@ -2724,20 +2724,20 @@ bfa_fcs_fdmi_get_portattr(struct bfa_fcs_lport_fdmi_s *fdmi, + /* + * OS device Name + */ +- strncpy(port_attr->os_device_name, (char *)driver_info->os_device_name, ++ strlcpy(port_attr->os_device_name, driver_info->os_device_name, + sizeof(port_attr->os_device_name)); + + /* + * Host name + */ +- strncpy(port_attr->host_name, (char *)driver_info->host_machine_name, ++ strlcpy(port_attr->host_name, driver_info->host_machine_name, + sizeof(port_attr->host_name)); + + port_attr->node_name = bfa_fcs_lport_get_nwwn(port); + port_attr->port_name = bfa_fcs_lport_get_pwwn(port); + +- strncpy(port_attr->port_sym_name.symname, +- (char *)&bfa_fcs_lport_get_psym_name(port), BFA_SYMNAME_MAXLEN); ++ strlcpy(port_attr->port_sym_name.symname, ++ bfa_fcs_lport_get_psym_name(port).symname, BFA_SYMNAME_MAXLEN); + bfa_fcs_lport_get_attr(port, &lport_attr); + port_attr->port_type = cpu_to_be32(lport_attr.port_type); + port_attr->scos = pport_attr.cos_supported; +@@ -3217,7 +3217,7 @@ bfa_fcs_lport_ms_gmal_response(void *fcsarg, struct bfa_fcxp_s *fcxp, + rsp_str[gmal_entry->len-1] = 0; + + /* copy IP Address to fabric */ +- strncpy(bfa_fcs_lport_get_fabric_ipaddr(port), ++ strlcpy(bfa_fcs_lport_get_fabric_ipaddr(port), + gmal_entry->ip_addr, + BFA_FCS_FABRIC_IPADDR_SZ); + break; +@@ -4655,21 +4655,13 @@ bfa_fcs_lport_ns_send_rspn_id(void *ns_cbarg, struct bfa_fcxp_s *fcxp_alloced) + * to that of the base port. + */ + +- strncpy((char *)psymbl, +- (char *) & +- (bfa_fcs_lport_get_psym_name ++ strlcpy(symbl, ++ (char *)&(bfa_fcs_lport_get_psym_name + (bfa_fcs_get_base_port(port->fcs))), +- strlen((char *) & +- bfa_fcs_lport_get_psym_name(bfa_fcs_get_base_port +- (port->fcs)))); +- +- /* Ensure we have a null terminating string. */ +- ((char *)psymbl)[strlen((char *) & +- bfa_fcs_lport_get_psym_name(bfa_fcs_get_base_port +- (port->fcs)))] = 0; +- strncat((char *)psymbl, +- (char *) &(bfa_fcs_lport_get_psym_name(port)), +- strlen((char *) &bfa_fcs_lport_get_psym_name(port))); ++ sizeof(symbl)); ++ ++ strlcat(symbl, (char *)&(bfa_fcs_lport_get_psym_name(port)), ++ sizeof(symbl)); + } else { + psymbl = (u8 *) &(bfa_fcs_lport_get_psym_name(port)); + } +@@ -5161,7 +5153,6 @@ bfa_fcs_lport_ns_util_send_rspn_id(void *cbarg, struct bfa_fcxp_s *fcxp_alloced) + struct fchs_s fchs; + struct bfa_fcxp_s *fcxp; + u8 symbl[256]; +- u8 *psymbl = &symbl[0]; + int len; + + /* Avoid sending RSPN in the following states. */ +@@ -5191,22 +5182,17 @@ bfa_fcs_lport_ns_util_send_rspn_id(void *cbarg, struct bfa_fcxp_s *fcxp_alloced) + * For Vports, we append the vport's port symbolic name + * to that of the base port. + */ +- strncpy((char *)psymbl, (char *)&(bfa_fcs_lport_get_psym_name ++ strlcpy(symbl, (char *)&(bfa_fcs_lport_get_psym_name + (bfa_fcs_get_base_port(port->fcs))), +- strlen((char *)&bfa_fcs_lport_get_psym_name( +- bfa_fcs_get_base_port(port->fcs)))); +- +- /* Ensure we have a null terminating string. */ +- ((char *)psymbl)[strlen((char *)&bfa_fcs_lport_get_psym_name( +- bfa_fcs_get_base_port(port->fcs)))] = 0; ++ sizeof(symbl)); + +- strncat((char *)psymbl, ++ strlcat(symbl, + (char *)&(bfa_fcs_lport_get_psym_name(port)), +- strlen((char *)&bfa_fcs_lport_get_psym_name(port))); ++ sizeof(symbl)); + } + + len = fc_rspnid_build(&fchs, bfa_fcxp_get_reqbuf(fcxp), +- bfa_fcs_lport_get_fcid(port), 0, psymbl); ++ bfa_fcs_lport_get_fcid(port), 0, symbl); + + bfa_fcxp_send(fcxp, NULL, port->fabric->vf_id, port->lp_tag, BFA_FALSE, + FC_CLASS_3, len, &fchs, NULL, NULL, FC_MAX_PDUSZ, 0); +diff --git a/drivers/scsi/bfa/bfa_ioc.c b/drivers/scsi/bfa/bfa_ioc.c +index 98f7e8cca52d..e533474748a5 100644 +--- a/drivers/scsi/bfa/bfa_ioc.c ++++ b/drivers/scsi/bfa/bfa_ioc.c +@@ -2802,7 +2802,7 @@ void + bfa_ioc_get_adapter_manufacturer(struct bfa_ioc_s *ioc, char *manufacturer) + { + memset((void *)manufacturer, 0, BFA_ADAPTER_MFG_NAME_LEN); +- memcpy(manufacturer, BFA_MFG_NAME, BFA_ADAPTER_MFG_NAME_LEN); ++ strlcpy(manufacturer, BFA_MFG_NAME, BFA_ADAPTER_MFG_NAME_LEN); + } + + void +diff --git a/drivers/scsi/bfa/bfa_svc.c b/drivers/scsi/bfa/bfa_svc.c +index 625225f31081..15d02eb09476 100644 +--- a/drivers/scsi/bfa/bfa_svc.c ++++ b/drivers/scsi/bfa/bfa_svc.c +@@ -365,8 +365,8 @@ bfa_plog_str(struct bfa_plog_s *plog, enum bfa_plog_mid mid, + lp.eid = event; + lp.log_type = BFA_PL_LOG_TYPE_STRING; + lp.misc = misc; +- strncpy(lp.log_entry.string_log, log_str, +- BFA_PL_STRING_LOG_SZ - 1); ++ strlcpy(lp.log_entry.string_log, log_str, ++ BFA_PL_STRING_LOG_SZ); + lp.log_entry.string_log[BFA_PL_STRING_LOG_SZ - 1] = '\0'; + bfa_plog_add(plog, &lp); + } +diff --git a/drivers/scsi/bfa/bfad.c b/drivers/scsi/bfa/bfad.c +index cc3b9d3d6d40..bfefa2bfde0e 100644 +--- a/drivers/scsi/bfa/bfad.c ++++ b/drivers/scsi/bfa/bfad.c +@@ -987,20 +987,20 @@ bfad_start_ops(struct bfad_s *bfad) { + + /* Fill the driver_info info to fcs*/ + memset(&driver_info, 0, sizeof(driver_info)); +- strncpy(driver_info.version, BFAD_DRIVER_VERSION, +- sizeof(driver_info.version) - 1); ++ strlcpy(driver_info.version, BFAD_DRIVER_VERSION, ++ sizeof(driver_info.version)); + if (host_name) +- strncpy(driver_info.host_machine_name, host_name, +- sizeof(driver_info.host_machine_name) - 1); ++ strlcpy(driver_info.host_machine_name, host_name, ++ sizeof(driver_info.host_machine_name)); + if (os_name) +- strncpy(driver_info.host_os_name, os_name, +- sizeof(driver_info.host_os_name) - 1); ++ strlcpy(driver_info.host_os_name, os_name, ++ sizeof(driver_info.host_os_name)); + if (os_patch) +- strncpy(driver_info.host_os_patch, os_patch, +- sizeof(driver_info.host_os_patch) - 1); ++ strlcpy(driver_info.host_os_patch, os_patch, ++ sizeof(driver_info.host_os_patch)); + +- strncpy(driver_info.os_device_name, bfad->pci_name, +- sizeof(driver_info.os_device_name) - 1); ++ strlcpy(driver_info.os_device_name, bfad->pci_name, ++ sizeof(driver_info.os_device_name)); + + /* FCS driver info init */ + spin_lock_irqsave(&bfad->bfad_lock, flags); +diff --git a/drivers/scsi/bfa/bfad_attr.c b/drivers/scsi/bfa/bfad_attr.c +index 40be670a1cbc..6d21bc6a7713 100644 +--- a/drivers/scsi/bfa/bfad_attr.c ++++ b/drivers/scsi/bfa/bfad_attr.c +@@ -842,7 +842,7 @@ bfad_im_symbolic_name_show(struct device *dev, struct device_attribute *attr, + char symname[BFA_SYMNAME_MAXLEN]; + + bfa_fcs_lport_get_attr(&bfad->bfa_fcs.fabric.bport, &port_attr); +- strncpy(symname, port_attr.port_cfg.sym_name.symname, ++ strlcpy(symname, port_attr.port_cfg.sym_name.symname, + BFA_SYMNAME_MAXLEN); + return snprintf(buf, PAGE_SIZE, "%s\n", symname); + } +diff --git a/drivers/scsi/bfa/bfad_bsg.c b/drivers/scsi/bfa/bfad_bsg.c +index 023b9d42ad9a..be2de04179d0 100644 +--- a/drivers/scsi/bfa/bfad_bsg.c ++++ b/drivers/scsi/bfa/bfad_bsg.c +@@ -126,7 +126,7 @@ bfad_iocmd_ioc_get_attr(struct bfad_s *bfad, void *cmd) + + /* fill in driver attr info */ + strcpy(iocmd->ioc_attr.driver_attr.driver, BFAD_DRIVER_NAME); +- strncpy(iocmd->ioc_attr.driver_attr.driver_ver, ++ strlcpy(iocmd->ioc_attr.driver_attr.driver_ver, + BFAD_DRIVER_VERSION, BFA_VERSION_LEN); + strcpy(iocmd->ioc_attr.driver_attr.fw_ver, + iocmd->ioc_attr.adapter_attr.fw_ver); +@@ -314,9 +314,9 @@ bfad_iocmd_port_get_attr(struct bfad_s *bfad, void *cmd) + iocmd->attr.port_type = port_attr.port_type; + iocmd->attr.loopback = port_attr.loopback; + iocmd->attr.authfail = port_attr.authfail; +- strncpy(iocmd->attr.port_symname.symname, ++ strlcpy(iocmd->attr.port_symname.symname, + port_attr.port_cfg.sym_name.symname, +- sizeof(port_attr.port_cfg.sym_name.symname)); ++ sizeof(iocmd->attr.port_symname.symname)); + + iocmd->status = BFA_STATUS_OK; + return 0; +diff --git a/drivers/scsi/csiostor/csio_lnode.c b/drivers/scsi/csiostor/csio_lnode.c +index c00b2ff72b55..be5ee2d37815 100644 +--- a/drivers/scsi/csiostor/csio_lnode.c ++++ b/drivers/scsi/csiostor/csio_lnode.c +@@ -238,14 +238,23 @@ csio_osname(uint8_t *buf, size_t buf_len) + } + + static inline void +-csio_append_attrib(uint8_t **ptr, uint16_t type, uint8_t *val, uint16_t len) ++csio_append_attrib(uint8_t **ptr, uint16_t type, void *val, size_t val_len) + { ++ uint16_t len; + struct fc_fdmi_attr_entry *ae = (struct fc_fdmi_attr_entry *)*ptr; ++ ++ if (WARN_ON(val_len > U16_MAX)) ++ return; ++ ++ len = val_len; ++ + ae->type = htons(type); + len += 4; /* includes attribute type and length */ + len = (len + 3) & ~3; /* should be multiple of 4 bytes */ + ae->len = htons(len); +- memcpy(ae->value, val, len); ++ memcpy(ae->value, val, val_len); ++ if (len > val_len) ++ memset(ae->value + val_len, 0, len - val_len); + *ptr += len; + } + +@@ -335,7 +344,7 @@ csio_ln_fdmi_rhba_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req) + numattrs++; + val = htonl(FC_PORTSPEED_1GBIT | FC_PORTSPEED_10GBIT); + csio_append_attrib(&pld, FC_FDMI_PORT_ATTR_SUPPORTEDSPEED, +- (uint8_t *)&val, ++ &val, + FC_FDMI_PORT_ATTR_SUPPORTEDSPEED_LEN); + numattrs++; + +@@ -346,23 +355,22 @@ csio_ln_fdmi_rhba_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req) + else + val = htonl(CSIO_HBA_PORTSPEED_UNKNOWN); + csio_append_attrib(&pld, FC_FDMI_PORT_ATTR_CURRENTPORTSPEED, +- (uint8_t *)&val, +- FC_FDMI_PORT_ATTR_CURRENTPORTSPEED_LEN); ++ &val, FC_FDMI_PORT_ATTR_CURRENTPORTSPEED_LEN); + numattrs++; + + mfs = ln->ln_sparm.csp.sp_bb_data; + csio_append_attrib(&pld, FC_FDMI_PORT_ATTR_MAXFRAMESIZE, +- (uint8_t *)&mfs, FC_FDMI_PORT_ATTR_MAXFRAMESIZE_LEN); ++ &mfs, sizeof(mfs)); + numattrs++; + + strcpy(buf, "csiostor"); + csio_append_attrib(&pld, FC_FDMI_PORT_ATTR_OSDEVICENAME, buf, +- (uint16_t)strlen(buf)); ++ strlen(buf)); + numattrs++; + + if (!csio_hostname(buf, sizeof(buf))) { + csio_append_attrib(&pld, FC_FDMI_PORT_ATTR_HOSTNAME, +- buf, (uint16_t)strlen(buf)); ++ buf, strlen(buf)); + numattrs++; + } + attrib_blk->numattrs = htonl(numattrs); +@@ -444,33 +452,32 @@ csio_ln_fdmi_dprt_cbfn(struct csio_hw *hw, struct csio_ioreq *fdmi_req) + + strcpy(buf, "Chelsio Communications"); + csio_append_attrib(&pld, FC_FDMI_HBA_ATTR_MANUFACTURER, buf, +- (uint16_t)strlen(buf)); ++ strlen(buf)); + numattrs++; + csio_append_attrib(&pld, FC_FDMI_HBA_ATTR_SERIALNUMBER, +- hw->vpd.sn, (uint16_t)sizeof(hw->vpd.sn)); ++ hw->vpd.sn, sizeof(hw->vpd.sn)); + numattrs++; + csio_append_attrib(&pld, FC_FDMI_HBA_ATTR_MODEL, hw->vpd.id, +- (uint16_t)sizeof(hw->vpd.id)); ++ sizeof(hw->vpd.id)); + numattrs++; + csio_append_attrib(&pld, FC_FDMI_HBA_ATTR_MODELDESCRIPTION, +- hw->model_desc, (uint16_t)strlen(hw->model_desc)); ++ hw->model_desc, strlen(hw->model_desc)); + numattrs++; + csio_append_attrib(&pld, FC_FDMI_HBA_ATTR_HARDWAREVERSION, +- hw->hw_ver, (uint16_t)sizeof(hw->hw_ver)); ++ hw->hw_ver, sizeof(hw->hw_ver)); + numattrs++; + csio_append_attrib(&pld, FC_FDMI_HBA_ATTR_FIRMWAREVERSION, +- hw->fwrev_str, (uint16_t)strlen(hw->fwrev_str)); ++ hw->fwrev_str, strlen(hw->fwrev_str)); + numattrs++; + + if (!csio_osname(buf, sizeof(buf))) { + csio_append_attrib(&pld, FC_FDMI_HBA_ATTR_OSNAMEVERSION, +- buf, (uint16_t)strlen(buf)); ++ buf, strlen(buf)); + numattrs++; + } + + csio_append_attrib(&pld, FC_FDMI_HBA_ATTR_MAXCTPAYLOAD, +- (uint8_t *)&maxpayload, +- FC_FDMI_HBA_ATTR_MAXCTPAYLOAD_LEN); ++ &maxpayload, FC_FDMI_HBA_ATTR_MAXCTPAYLOAD_LEN); + len = (uint32_t)(pld - (uint8_t *)cmd); + numattrs++; + attrib_blk->numattrs = htonl(numattrs); +@@ -1794,6 +1801,8 @@ csio_ln_mgmt_submit_req(struct csio_ioreq *io_req, + struct csio_mgmtm *mgmtm = csio_hw_to_mgmtm(hw); + int rv; + ++ BUG_ON(pld_len > pld->len); ++ + io_req->io_cbfn = io_cbfn; /* Upper layer callback handler */ + io_req->fw_handle = (uintptr_t) (io_req); + io_req->eq_idx = mgmtm->eq_idx; +diff --git a/drivers/scsi/scsi_devinfo.c b/drivers/scsi/scsi_devinfo.c +index 6b61b09b3226..75f2179860a7 100644 +--- a/drivers/scsi/scsi_devinfo.c ++++ b/drivers/scsi/scsi_devinfo.c +@@ -33,7 +33,6 @@ struct scsi_dev_info_list_table { + }; + + +-static const char spaces[] = " "; /* 16 of them */ + static unsigned scsi_default_dev_flags; + static LIST_HEAD(scsi_dev_info_list); + static char scsi_dev_flags[256]; +@@ -291,20 +290,13 @@ static void scsi_strcpy_devinfo(char *name, char *to, size_t to_length, + size_t from_length; + + from_length = strlen(from); +- strncpy(to, from, min(to_length, from_length)); +- if (from_length < to_length) { +- if (compatible) { +- /* +- * NUL terminate the string if it is short. +- */ +- to[from_length] = '\0'; +- } else { +- /* +- * space pad the string if it is short. +- */ +- strncpy(&to[from_length], spaces, +- to_length - from_length); +- } ++ /* this zero-pads the destination */ ++ strncpy(to, from, to_length); ++ if (from_length < to_length && !compatible) { ++ /* ++ * space pad the string if it is short. ++ */ ++ memset(&to[from_length], ' ', to_length - from_length); + } + if (from_length > to_length) + printk(KERN_WARNING "%s: %s string '%s' is too long\n", +diff --git a/drivers/staging/lustre/lustre/lmv/lmv_obd.c b/drivers/staging/lustre/lustre/lmv/lmv_obd.c +index 635a93cc94de..eed7603db5ec 100644 +--- a/drivers/staging/lustre/lustre/lmv/lmv_obd.c ++++ b/drivers/staging/lustre/lustre/lmv/lmv_obd.c +@@ -700,7 +700,7 @@ repeat_fid2path: + memmove(ptr + strlen(gf->gf_path) + 1, ptr, + strlen(ori_gf->gf_path)); + +- strncpy(ptr, gf->gf_path, strlen(gf->gf_path)); ++ strcpy(ptr, gf->gf_path); + ptr += strlen(gf->gf_path); + *ptr = '/'; + } +diff --git a/drivers/staging/rts5208/sd.c b/drivers/staging/rts5208/sd.c +index 9a876ce92dbd..dc91cd29f1d2 100644 +--- a/drivers/staging/rts5208/sd.c ++++ b/drivers/staging/rts5208/sd.c +@@ -4165,12 +4165,6 @@ RTY_SEND_CMD: + rtsx_trace(chip); + return STATUS_FAIL; + } +- +- } else if (rsp_type == SD_RSP_TYPE_R0) { +- if ((ptr[3] & 0x1E) != 0x03) { +- rtsx_trace(chip); +- return STATUS_FAIL; +- } + } + } + } +diff --git a/drivers/tty/serial/8250/8250_mtk.c b/drivers/tty/serial/8250/8250_mtk.c +index 78883ca64ddd..035810bbcd02 100644 +--- a/drivers/tty/serial/8250/8250_mtk.c ++++ b/drivers/tty/serial/8250/8250_mtk.c +@@ -231,17 +231,17 @@ static int mtk8250_probe(struct platform_device *pdev) + + platform_set_drvdata(pdev, data); + +- pm_runtime_enable(&pdev->dev); +- if (!pm_runtime_enabled(&pdev->dev)) { +- err = mtk8250_runtime_resume(&pdev->dev); +- if (err) +- return err; +- } ++ err = mtk8250_runtime_resume(&pdev->dev); ++ if (err) ++ return err; + + data->line = serial8250_register_8250_port(&uart); + if (data->line < 0) + return data->line; + ++ pm_runtime_set_active(&pdev->dev); ++ pm_runtime_enable(&pdev->dev); ++ + return 0; + } + +@@ -252,13 +252,11 @@ static int mtk8250_remove(struct platform_device *pdev) + pm_runtime_get_sync(&pdev->dev); + + serial8250_unregister_port(data->line); ++ mtk8250_runtime_suspend(&pdev->dev); + + pm_runtime_disable(&pdev->dev); + pm_runtime_put_noidle(&pdev->dev); + +- if (!pm_runtime_status_suspended(&pdev->dev)) +- mtk8250_runtime_suspend(&pdev->dev); +- + return 0; + } + +diff --git a/drivers/tty/serial/kgdboc.c b/drivers/tty/serial/kgdboc.c +index 2db68dfe497d..f2b0d8cee8ef 100644 +--- a/drivers/tty/serial/kgdboc.c ++++ b/drivers/tty/serial/kgdboc.c +@@ -131,24 +131,6 @@ static void kgdboc_unregister_kbd(void) + #define kgdboc_restore_input() + #endif /* ! CONFIG_KDB_KEYBOARD */ + +-static int kgdboc_option_setup(char *opt) +-{ +- if (!opt) { +- pr_err("kgdboc: config string not provided\n"); +- return -EINVAL; +- } +- +- if (strlen(opt) >= MAX_CONFIG_LEN) { +- printk(KERN_ERR "kgdboc: config string too long\n"); +- return -ENOSPC; +- } +- strcpy(config, opt); +- +- return 0; +-} +- +-__setup("kgdboc=", kgdboc_option_setup); +- + static void cleanup_kgdboc(void) + { + if (kgdb_unregister_nmi_console()) +@@ -162,15 +144,13 @@ static int configure_kgdboc(void) + { + struct tty_driver *p; + int tty_line = 0; +- int err; ++ int err = -ENODEV; + char *cptr = config; + struct console *cons; + +- err = kgdboc_option_setup(config); +- if (err || !strlen(config) || isspace(config[0])) ++ if (!strlen(config) || isspace(config[0])) + goto noconfig; + +- err = -ENODEV; + kgdboc_io_ops.is_console = 0; + kgdb_tty_driver = NULL; + +@@ -252,7 +232,7 @@ static void kgdboc_put_char(u8 chr) + + static int param_set_kgdboc_var(const char *kmessage, struct kernel_param *kp) + { +- int len = strlen(kmessage); ++ size_t len = strlen(kmessage); + + if (len >= MAX_CONFIG_LEN) { + printk(KERN_ERR "kgdboc: config string too long\n"); +@@ -274,7 +254,7 @@ static int param_set_kgdboc_var(const char *kmessage, struct kernel_param *kp) + + strcpy(config, kmessage); + /* Chop out \n char as a result of echo */ +- if (config[len - 1] == '\n') ++ if (len && config[len - 1] == '\n') + config[len - 1] = '\0'; + + if (configured == 1) +@@ -318,6 +298,25 @@ static struct kgdb_io kgdboc_io_ops = { + }; + + #ifdef CONFIG_KGDB_SERIAL_CONSOLE ++static int kgdboc_option_setup(char *opt) ++{ ++ if (!opt) { ++ pr_err("config string not provided\n"); ++ return -EINVAL; ++ } ++ ++ if (strlen(opt) >= MAX_CONFIG_LEN) { ++ pr_err("config string too long\n"); ++ return -ENOSPC; ++ } ++ strcpy(config, opt); ++ ++ return 0; ++} ++ ++__setup("kgdboc=", kgdboc_option_setup); ++ ++ + /* This is only available if kgdboc is a built in for early debugging */ + static int __init kgdboc_early_init(char *opt) + { +diff --git a/drivers/usb/core/hub.c b/drivers/usb/core/hub.c +index f7af730aae82..be63db142d3f 100644 +--- a/drivers/usb/core/hub.c ++++ b/drivers/usb/core/hub.c +@@ -2211,7 +2211,7 @@ static int usb_enumerate_device_otg(struct usb_device *udev) + /* descriptor may appear anywhere in config */ + err = __usb_get_extra_descriptor(udev->rawdescriptors[0], + le16_to_cpu(udev->config[0].desc.wTotalLength), +- USB_DT_OTG, (void **) &desc); ++ USB_DT_OTG, (void **) &desc, sizeof(*desc)); + if (err || !(desc->bmAttributes & USB_OTG_HNP)) + return 0; + +diff --git a/drivers/usb/core/quirks.c b/drivers/usb/core/quirks.c +index 1e8f68960014..cf378b1ed373 100644 +--- a/drivers/usb/core/quirks.c ++++ b/drivers/usb/core/quirks.c +@@ -64,6 +64,9 @@ static const struct usb_device_id usb_quirk_list[] = { + /* Microsoft LifeCam-VX700 v2.0 */ + { USB_DEVICE(0x045e, 0x0770), .driver_info = USB_QUIRK_RESET_RESUME }, + ++ /* Cherry Stream G230 2.0 (G85-231) and 3.0 (G85-232) */ ++ { USB_DEVICE(0x046a, 0x0023), .driver_info = USB_QUIRK_RESET_RESUME }, ++ + /* Logitech HD Pro Webcams C920, C920-C, C925e and C930e */ + { USB_DEVICE(0x046d, 0x082d), .driver_info = USB_QUIRK_DELAY_INIT }, + { USB_DEVICE(0x046d, 0x0841), .driver_info = USB_QUIRK_DELAY_INIT }, +@@ -185,6 +188,10 @@ static const struct usb_device_id usb_quirk_list[] = { + /* Midiman M-Audio Keystation 88es */ + { USB_DEVICE(0x0763, 0x0192), .driver_info = USB_QUIRK_RESET_RESUME }, + ++ /* SanDisk Ultra Fit and Ultra Flair */ ++ { USB_DEVICE(0x0781, 0x5583), .driver_info = USB_QUIRK_NO_LPM }, ++ { USB_DEVICE(0x0781, 0x5591), .driver_info = USB_QUIRK_NO_LPM }, ++ + /* M-Systems Flash Disk Pioneers */ + { USB_DEVICE(0x08ec, 0x1000), .driver_info = USB_QUIRK_RESET_RESUME }, + +diff --git a/drivers/usb/core/usb.c b/drivers/usb/core/usb.c +index ad308c8e9af5..36e5098e4e6f 100644 +--- a/drivers/usb/core/usb.c ++++ b/drivers/usb/core/usb.c +@@ -678,14 +678,14 @@ EXPORT_SYMBOL_GPL(usb_get_current_frame_number); + */ + + int __usb_get_extra_descriptor(char *buffer, unsigned size, +- unsigned char type, void **ptr) ++ unsigned char type, void **ptr, size_t minsize) + { + struct usb_descriptor_header *header; + + while (size >= sizeof(struct usb_descriptor_header)) { + header = (struct usb_descriptor_header *)buffer; + +- if (header->bLength < 2) { ++ if (header->bLength < 2 || header->bLength > size) { + printk(KERN_ERR + "%s: bogus descriptor, type %d length %d\n", + usbcore_name, +@@ -694,7 +694,7 @@ int __usb_get_extra_descriptor(char *buffer, unsigned size, + return -1; + } + +- if (header->bDescriptorType == type) { ++ if (header->bDescriptorType == type && header->bLength >= minsize) { + *ptr = header; + return 0; + } +diff --git a/drivers/usb/gadget/udc/dummy_hcd.c b/drivers/usb/gadget/udc/dummy_hcd.c +index eb876ed96861..85f1f282c1d5 100644 +--- a/drivers/usb/gadget/udc/dummy_hcd.c ++++ b/drivers/usb/gadget/udc/dummy_hcd.c +@@ -379,11 +379,10 @@ static void set_link_state_by_speed(struct dummy_hcd *dum_hcd) + USB_PORT_STAT_CONNECTION) == 0) + dum_hcd->port_status |= + (USB_PORT_STAT_C_CONNECTION << 16); +- if ((dum_hcd->port_status & +- USB_PORT_STAT_ENABLE) == 1 && +- (dum_hcd->port_status & +- USB_SS_PORT_LS_U0) == 1 && +- dum_hcd->rh_state != DUMMY_RH_SUSPENDED) ++ if ((dum_hcd->port_status & USB_PORT_STAT_ENABLE) && ++ (dum_hcd->port_status & ++ USB_PORT_STAT_LINK_STATE) == USB_SS_PORT_LS_U0 && ++ dum_hcd->rh_state != DUMMY_RH_SUSPENDED) + dum_hcd->active = 1; + } + } else { +diff --git a/drivers/usb/host/hwa-hc.c b/drivers/usb/host/hwa-hc.c +index 1db0626c8bf4..97750f162f01 100644 +--- a/drivers/usb/host/hwa-hc.c ++++ b/drivers/usb/host/hwa-hc.c +@@ -654,7 +654,7 @@ static int hwahc_security_create(struct hwahc *hwahc) + top = itr + itr_size; + result = __usb_get_extra_descriptor(usb_dev->rawdescriptors[index], + le16_to_cpu(usb_dev->actconfig->desc.wTotalLength), +- USB_DT_SECURITY, (void **) &secd); ++ USB_DT_SECURITY, (void **) &secd, sizeof(*secd)); + if (result == -1) { + dev_warn(dev, "BUG? WUSB host has no security descriptors\n"); + return 0; +diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c +index 9dbf1583bd7a..e3fdc799ad6e 100644 +--- a/drivers/usb/host/xhci.c ++++ b/drivers/usb/host/xhci.c +@@ -4417,6 +4417,14 @@ static u16 xhci_calculate_u1_timeout(struct xhci_hcd *xhci, + { + unsigned long long timeout_ns; + ++ /* Prevent U1 if service interval is shorter than U1 exit latency */ ++ if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) { ++ if (xhci_service_interval_to_ns(desc) <= udev->u1_params.mel) { ++ dev_dbg(&udev->dev, "Disable U1, ESIT shorter than exit latency\n"); ++ return USB3_LPM_DISABLED; ++ } ++ } ++ + if (xhci->quirks & XHCI_INTEL_HOST) + timeout_ns = xhci_calculate_intel_u1_timeout(udev, desc); + else +@@ -4473,6 +4481,14 @@ static u16 xhci_calculate_u2_timeout(struct xhci_hcd *xhci, + { + unsigned long long timeout_ns; + ++ /* Prevent U2 if service interval is shorter than U2 exit latency */ ++ if (usb_endpoint_xfer_int(desc) || usb_endpoint_xfer_isoc(desc)) { ++ if (xhci_service_interval_to_ns(desc) <= udev->u2_params.mel) { ++ dev_dbg(&udev->dev, "Disable U2, ESIT shorter than exit latency\n"); ++ return USB3_LPM_DISABLED; ++ } ++ } ++ + if (xhci->quirks & XHCI_INTEL_HOST) + timeout_ns = xhci_calculate_intel_u2_timeout(udev, desc); + else +diff --git a/drivers/usb/misc/appledisplay.c b/drivers/usb/misc/appledisplay.c +index b15842c6f916..993f4da065c3 100644 +--- a/drivers/usb/misc/appledisplay.c ++++ b/drivers/usb/misc/appledisplay.c +@@ -64,6 +64,7 @@ static const struct usb_device_id appledisplay_table[] = { + { APPLEDISPLAY_DEVICE(0x921c) }, + { APPLEDISPLAY_DEVICE(0x921d) }, + { APPLEDISPLAY_DEVICE(0x9222) }, ++ { APPLEDISPLAY_DEVICE(0x9226) }, + { APPLEDISPLAY_DEVICE(0x9236) }, + + /* Terminating entry */ +diff --git a/drivers/usb/storage/unusual_realtek.h b/drivers/usb/storage/unusual_realtek.h +index e41f50c95ed4..f5fc3271e19c 100644 +--- a/drivers/usb/storage/unusual_realtek.h ++++ b/drivers/usb/storage/unusual_realtek.h +@@ -38,4 +38,14 @@ UNUSUAL_DEV(0x0bda, 0x0159, 0x0000, 0x9999, + "USB Card Reader", + USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0), + ++UNUSUAL_DEV(0x0bda, 0x0177, 0x0000, 0x9999, ++ "Realtek", ++ "USB Card Reader", ++ USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0), ++ ++UNUSUAL_DEV(0x0bda, 0x0184, 0x0000, 0x9999, ++ "Realtek", ++ "USB Card Reader", ++ USB_SC_DEVICE, USB_PR_DEVICE, init_realtek_cr, 0), ++ + #endif /* defined(CONFIG_USB_STORAGE_REALTEK) || ... */ +diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c +index b0875ef48522..1f21c6c33228 100644 +--- a/fs/btrfs/disk-io.c ++++ b/fs/btrfs/disk-io.c +@@ -445,9 +445,9 @@ static int btree_read_extent_buffer_pages(struct btrfs_root *root, + int mirror_num = 0; + int failed_mirror = 0; + +- clear_bit(EXTENT_BUFFER_CORRUPT, &eb->bflags); + io_tree = &BTRFS_I(root->fs_info->btree_inode)->io_tree; + while (1) { ++ clear_bit(EXTENT_BUFFER_CORRUPT, &eb->bflags); + ret = read_extent_buffer_pages(io_tree, eb, start, + WAIT_COMPLETE, + btree_get_extent, mirror_num); +@@ -459,14 +459,6 @@ static int btree_read_extent_buffer_pages(struct btrfs_root *root, + ret = -EIO; + } + +- /* +- * This buffer's crc is fine, but its contents are corrupted, so +- * there is no reason to read the other copies, they won't be +- * any less wrong. +- */ +- if (test_bit(EXTENT_BUFFER_CORRUPT, &eb->bflags)) +- break; +- + num_copies = btrfs_num_copies(root->fs_info, + eb->start, eb->len); + if (num_copies == 1) +diff --git a/fs/btrfs/free-space-cache.c b/fs/btrfs/free-space-cache.c +index 1aa897dd9ce3..6c0161284a9e 100644 +--- a/fs/btrfs/free-space-cache.c ++++ b/fs/btrfs/free-space-cache.c +@@ -2469,6 +2469,7 @@ void btrfs_dump_free_space(struct btrfs_block_group_cache *block_group, + struct rb_node *n; + int count = 0; + ++ spin_lock(&ctl->tree_lock); + for (n = rb_first(&ctl->free_space_offset); n; n = rb_next(n)) { + info = rb_entry(n, struct btrfs_free_space, offset_index); + if (info->bytes >= bytes && !block_group->ro) +@@ -2478,6 +2479,7 @@ void btrfs_dump_free_space(struct btrfs_block_group_cache *block_group, + info->offset, info->bytes, + (info->bitmap) ? "yes" : "no"); + } ++ spin_unlock(&ctl->tree_lock); + btrfs_info(block_group->fs_info, "block group has cluster?: %s", + list_empty(&block_group->cluster_list) ? "no" : "yes"); + btrfs_info(block_group->fs_info, +diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c +index 3bd2233737ac..0f99336c37eb 100644 +--- a/fs/btrfs/super.c ++++ b/fs/btrfs/super.c +@@ -2104,6 +2104,7 @@ static long btrfs_control_ioctl(struct file *file, unsigned int cmd, + vol = memdup_user((void __user *)arg, sizeof(*vol)); + if (IS_ERR(vol)) + return PTR_ERR(vol); ++ vol->name[BTRFS_PATH_NAME_MAX] = '\0'; + + switch (cmd) { + case BTRFS_IOC_SCAN_DEV: +diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c +index be8eae80ff65..098016338f98 100644 +--- a/fs/btrfs/transaction.c ++++ b/fs/btrfs/transaction.c +@@ -1821,6 +1821,9 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans, + return ret; + } + ++ btrfs_trans_release_metadata(trans, root); ++ trans->block_rsv = NULL; ++ + /* make a pass through all the delayed refs we have so far + * any runnings procs may add more while we are here + */ +@@ -1830,9 +1833,6 @@ int btrfs_commit_transaction(struct btrfs_trans_handle *trans, + return ret; + } + +- btrfs_trans_release_metadata(trans, root); +- trans->block_rsv = NULL; +- + cur_trans = trans->transaction; + + /* +diff --git a/fs/cifs/dir.c b/fs/cifs/dir.c +index 76dacd5307b9..afd317eb9db9 100644 +--- a/fs/cifs/dir.c ++++ b/fs/cifs/dir.c +@@ -163,7 +163,7 @@ cifs_bp_rename_retry: + + cifs_dbg(FYI, "using cifs_sb prepath <%s>\n", cifs_sb->prepath); + memcpy(full_path+dfsplen+1, cifs_sb->prepath, pplen-1); +- full_path[dfsplen] = '\\'; ++ full_path[dfsplen] = dirsep; + for (i = 0; i < pplen-1; i++) + if (full_path[dfsplen+1+i] == '/') + full_path[dfsplen+1+i] = CIFS_DIR_SEP(cifs_sb); +diff --git a/fs/exec.c b/fs/exec.c +index 9c5ee2a880aa..910fc70c4542 100644 +--- a/fs/exec.c ++++ b/fs/exec.c +@@ -1077,15 +1077,14 @@ killed: + return -EAGAIN; + } + +-char *get_task_comm(char *buf, struct task_struct *tsk) ++char *__get_task_comm(char *buf, size_t buf_size, struct task_struct *tsk) + { +- /* buf must be at least sizeof(tsk->comm) in size */ + task_lock(tsk); +- strncpy(buf, tsk->comm, sizeof(tsk->comm)); ++ strncpy(buf, tsk->comm, buf_size); + task_unlock(tsk); + return buf; + } +-EXPORT_SYMBOL_GPL(get_task_comm); ++EXPORT_SYMBOL_GPL(__get_task_comm); + + /* + * These functions flushes out all traces of the currently running executable +diff --git a/fs/ext2/xattr.c b/fs/ext2/xattr.c +index fa70848afa8f..22d817dc821e 100644 +--- a/fs/ext2/xattr.c ++++ b/fs/ext2/xattr.c +@@ -605,9 +605,9 @@ skip_replace: + } + + cleanup: +- brelse(bh); + if (!(bh && header == HDR(bh))) + kfree(header); ++ brelse(bh); + up_write(&EXT2_I(inode)->xattr_sem); + + return error; +diff --git a/fs/kernfs/symlink.c b/fs/kernfs/symlink.c +index db272528ab5b..b3b293e2c099 100644 +--- a/fs/kernfs/symlink.c ++++ b/fs/kernfs/symlink.c +@@ -88,7 +88,7 @@ static int kernfs_get_target_path(struct kernfs_node *parent, + int slen = strlen(kn->name); + + len -= slen; +- strncpy(s + len, kn->name, slen); ++ memcpy(s + len, kn->name, slen); + if (len) + s[--len] = '/'; + +diff --git a/include/linux/sched.h b/include/linux/sched.h +index b30540d6d125..48a59f731406 100644 +--- a/include/linux/sched.h ++++ b/include/linux/sched.h +@@ -2668,7 +2668,12 @@ static inline void set_task_comm(struct task_struct *tsk, const char *from) + { + __set_task_comm(tsk, from, false); + } +-extern char *get_task_comm(char *to, struct task_struct *tsk); ++ ++extern char *__get_task_comm(char *to, size_t len, struct task_struct *tsk); ++#define get_task_comm(buf, tsk) ({ \ ++ BUILD_BUG_ON(sizeof(buf) != TASK_COMM_LEN); \ ++ __get_task_comm(buf, sizeof(buf), tsk); \ ++}) + + #ifdef CONFIG_SMP + void scheduler_ipi(void); +diff --git a/include/linux/usb.h b/include/linux/usb.h +index 092b5658b9c3..5c03ebc6dfa0 100644 +--- a/include/linux/usb.h ++++ b/include/linux/usb.h +@@ -334,11 +334,11 @@ struct usb_host_bos { + }; + + int __usb_get_extra_descriptor(char *buffer, unsigned size, +- unsigned char type, void **ptr); ++ unsigned char type, void **ptr, size_t min); + #define usb_get_extra_descriptor(ifpoint, type, ptr) \ + __usb_get_extra_descriptor((ifpoint)->extra, \ + (ifpoint)->extralen, \ +- type, (void **)ptr) ++ type, (void **)ptr, sizeof(**(ptr))) + + /* ----------------------------------------------------------------------- */ + +diff --git a/include/sound/pcm_params.h b/include/sound/pcm_params.h +index c704357775fc..2af7bb3ee57d 100644 +--- a/include/sound/pcm_params.h ++++ b/include/sound/pcm_params.h +@@ -247,11 +247,13 @@ static inline int snd_interval_empty(const struct snd_interval *i) + static inline int snd_interval_single(const struct snd_interval *i) + { + return (i->min == i->max || +- (i->min + 1 == i->max && i->openmax)); ++ (i->min + 1 == i->max && (i->openmin || i->openmax))); + } + + static inline int snd_interval_value(const struct snd_interval *i) + { ++ if (i->openmin && !i->openmax) ++ return i->max; + return i->min; + } + +diff --git a/kernel/debug/kdb/kdb_support.c b/kernel/debug/kdb/kdb_support.c +index 2aed4a33521b..61cd704a21c8 100644 +--- a/kernel/debug/kdb/kdb_support.c ++++ b/kernel/debug/kdb/kdb_support.c +@@ -129,13 +129,13 @@ int kdbnearsym(unsigned long addr, kdb_symtab_t *symtab) + } + if (i >= ARRAY_SIZE(kdb_name_table)) { + debug_kfree(kdb_name_table[0]); +- memcpy(kdb_name_table, kdb_name_table+1, ++ memmove(kdb_name_table, kdb_name_table+1, + sizeof(kdb_name_table[0]) * + (ARRAY_SIZE(kdb_name_table)-1)); + } else { + debug_kfree(knt1); + knt1 = kdb_name_table[i]; +- memcpy(kdb_name_table+i, kdb_name_table+i+1, ++ memmove(kdb_name_table+i, kdb_name_table+i+1, + sizeof(kdb_name_table[0]) * + (ARRAY_SIZE(kdb_name_table)-i-1)); + } +diff --git a/kernel/events/uprobes.c b/kernel/events/uprobes.c +index da0c09ff6112..7108097fa2f2 100644 +--- a/kernel/events/uprobes.c ++++ b/kernel/events/uprobes.c +@@ -606,7 +606,7 @@ static int prepare_uprobe(struct uprobe *uprobe, struct file *file, + BUG_ON((uprobe->offset & ~PAGE_MASK) + + UPROBE_SWBP_INSN_SIZE > PAGE_SIZE); + +- smp_wmb(); /* pairs with rmb() in find_active_uprobe() */ ++ smp_wmb(); /* pairs with the smp_rmb() in handle_swbp() */ + set_bit(UPROBE_COPY_INSN, &uprobe->flags); + + out: +@@ -1892,10 +1892,18 @@ static void handle_swbp(struct pt_regs *regs) + * After we hit the bp, _unregister + _register can install the + * new and not-yet-analyzed uprobe at the same address, restart. + */ +- smp_rmb(); /* pairs with wmb() in install_breakpoint() */ + if (unlikely(!test_bit(UPROBE_COPY_INSN, &uprobe->flags))) + goto out; + ++ /* ++ * Pairs with the smp_wmb() in prepare_uprobe(). ++ * ++ * Guarantees that if we see the UPROBE_COPY_INSN bit set, then ++ * we must also see the stores to &uprobe->arch performed by the ++ * prepare_uprobe() call. ++ */ ++ smp_rmb(); ++ + /* Tracing handlers use ->utask to communicate with fetch methods */ + if (!get_utask()) + goto out; +diff --git a/lib/kobject.c b/lib/kobject.c +index 895edb63fba4..35d490b02cdd 100644 +--- a/lib/kobject.c ++++ b/lib/kobject.c +@@ -127,7 +127,7 @@ static void fill_kobj_path(struct kobject *kobj, char *path, int length) + int cur = strlen(kobject_name(parent)); + /* back up enough to print this name with '/' */ + length -= cur; +- strncpy(path + length, kobject_name(parent), cur); ++ memcpy(path + length, kobject_name(parent), cur); + *(path + --length) = '/'; + } + +diff --git a/mm/mlock.c b/mm/mlock.c +index 9d2e773f3a95..b03f160c1bdd 100644 +--- a/mm/mlock.c ++++ b/mm/mlock.c +@@ -504,6 +504,7 @@ static int mlock_fixup(struct vm_area_struct *vma, struct vm_area_struct **prev, + int nr_pages; + int ret = 0; + int lock = !!(newflags & VM_LOCKED); ++ vm_flags_t old_flags = vma->vm_flags; + + if (newflags == vma->vm_flags || (vma->vm_flags & VM_SPECIAL) || + is_vm_hugetlb_page(vma) || vma == get_gate_vma(current->mm)) +@@ -538,6 +539,8 @@ success: + nr_pages = (end - start) >> PAGE_SHIFT; + if (!lock) + nr_pages = -nr_pages; ++ else if (old_flags & VM_LOCKED) ++ nr_pages = 0; + mm->locked_vm += nr_pages; + + /* +diff --git a/mm/truncate.c b/mm/truncate.c +index f4c8270f7b84..aeb1adba329e 100644 +--- a/mm/truncate.c ++++ b/mm/truncate.c +@@ -432,9 +432,13 @@ void truncate_inode_pages_final(struct address_space *mapping) + */ + spin_lock_irq(&mapping->tree_lock); + spin_unlock_irq(&mapping->tree_lock); +- +- truncate_inode_pages(mapping, 0); + } ++ ++ /* ++ * Cleancache needs notification even if there are no pages or shadow ++ * entries. ++ */ ++ truncate_inode_pages(mapping, 0); + } + EXPORT_SYMBOL(truncate_inode_pages_final); + +diff --git a/net/batman-adv/fragmentation.c b/net/batman-adv/fragmentation.c +index 5d2f9d4879b2..d50c3b003dc9 100644 +--- a/net/batman-adv/fragmentation.c ++++ b/net/batman-adv/fragmentation.c +@@ -266,7 +266,7 @@ batadv_frag_merge_packets(struct hlist_head *chain) + kfree(entry); + + packet = (struct batadv_frag_packet *)skb_out->data; +- size = ntohs(packet->total_size); ++ size = ntohs(packet->total_size) + hdr_size; + + /* Make room for the rest of the fragments. */ + if (pskb_expand_head(skb_out, 0, size - skb_out->len, GFP_ATOMIC) < 0) { +diff --git a/net/ipv4/ip_tunnel.c b/net/ipv4/ip_tunnel.c +index 9d3176b080a4..91ae061d46ac 100644 +--- a/net/ipv4/ip_tunnel.c ++++ b/net/ipv4/ip_tunnel.c +@@ -261,8 +261,8 @@ static struct net_device *__ip_tunnel_create(struct net *net, + } else { + if (strlen(ops->kind) > (IFNAMSIZ - 3)) + goto failed; +- strlcpy(name, ops->kind, IFNAMSIZ); +- strncat(name, "%d", 2); ++ strcpy(name, ops->kind); ++ strcat(name, "%d"); + } + + ASSERT_RTNL(); +diff --git a/net/mac80211/iface.c b/net/mac80211/iface.c +index 58588a610b05..519def0e15f1 100644 +--- a/net/mac80211/iface.c ++++ b/net/mac80211/iface.c +@@ -987,6 +987,8 @@ static void ieee80211_do_stop(struct ieee80211_sub_if_data *sdata, + if (local->open_count == 0) + ieee80211_clear_tx_pending(local); + ++ sdata->vif.bss_conf.beacon_int = 0; ++ + /* + * If the interface goes down while suspended, presumably because + * the device was unplugged and that happens before our resume, +diff --git a/net/mac80211/rx.c b/net/mac80211/rx.c +index f8406c37fc1d..64f76f88f819 100644 +--- a/net/mac80211/rx.c ++++ b/net/mac80211/rx.c +@@ -1109,6 +1109,7 @@ ieee80211_rx_h_check_dup(struct ieee80211_rx_data *rx) + return RX_CONTINUE; + + if (ieee80211_is_ctl(hdr->frame_control) || ++ ieee80211_is_nullfunc(hdr->frame_control) || + ieee80211_is_qos_nullfunc(hdr->frame_control) || + is_multicast_ether_addr(hdr->addr1)) + return RX_CONTINUE; +diff --git a/net/mac80211/status.c b/net/mac80211/status.c +index 2731cf5bf052..d221300e59e5 100644 +--- a/net/mac80211/status.c ++++ b/net/mac80211/status.c +@@ -648,6 +648,8 @@ void ieee80211_tx_status_noskb(struct ieee80211_hw *hw, + /* Track when last TDLS packet was ACKed */ + if (test_sta_flag(sta, WLAN_STA_TDLS_PEER_AUTH)) + sta->status_stats.last_tdls_pkt_time = jiffies; ++ } else if (test_sta_flag(sta, WLAN_STA_PS_STA)) { ++ return; + } else { + ieee80211_lost_packet(sta, info); + } +diff --git a/net/mac80211/tx.c b/net/mac80211/tx.c +index ea5dfefd765a..c1c27a516e45 100644 +--- a/net/mac80211/tx.c ++++ b/net/mac80211/tx.c +@@ -431,8 +431,8 @@ ieee80211_tx_h_multicast_ps_buf(struct ieee80211_tx_data *tx) + if (ieee80211_hw_check(&tx->local->hw, QUEUE_CONTROL)) + info->hw_queue = tx->sdata->vif.cab_queue; + +- /* no stations in PS mode */ +- if (!atomic_read(&ps->num_sta_ps)) ++ /* no stations in PS mode and no buffered packets */ ++ if (!atomic_read(&ps->num_sta_ps) && skb_queue_empty(&ps->bc_buf)) + return TX_CONTINUE; + + info->flags |= IEEE80211_TX_CTL_SEND_AFTER_DTIM; +diff --git a/net/sunrpc/auth_gss/auth_gss.c b/net/sunrpc/auth_gss/auth_gss.c +index 1f0687d8e3d7..62fca77bf3c7 100644 +--- a/net/sunrpc/auth_gss/auth_gss.c ++++ b/net/sunrpc/auth_gss/auth_gss.c +@@ -1722,6 +1722,7 @@ priv_release_snd_buf(struct rpc_rqst *rqstp) + for (i=0; i < rqstp->rq_enc_pages_num; i++) + __free_page(rqstp->rq_enc_pages[i]); + kfree(rqstp->rq_enc_pages); ++ rqstp->rq_release_snd_buf = NULL; + } + + static int +@@ -1730,6 +1731,9 @@ alloc_enc_pages(struct rpc_rqst *rqstp) + struct xdr_buf *snd_buf = &rqstp->rq_snd_buf; + int first, last, i; + ++ if (rqstp->rq_release_snd_buf) ++ rqstp->rq_release_snd_buf(rqstp); ++ + if (snd_buf->page_len == 0) { + rqstp->rq_enc_pages_num = 0; + return 0; +diff --git a/scripts/Makefile.extrawarn b/scripts/Makefile.extrawarn +index abe5f47b1ab0..93e23a73b232 100644 +--- a/scripts/Makefile.extrawarn ++++ b/scripts/Makefile.extrawarn +@@ -10,6 +10,8 @@ + # are not supported by all versions of the compiler + # ========================================================================== + ++KBUILD_CFLAGS += $(call cc-disable-warning, packed-not-aligned) ++ + ifeq ("$(origin W)", "command line") + export KBUILD_ENABLE_EXTRA_GCC_CHECKS := $(W) + endif +@@ -25,6 +27,7 @@ warning-1 += -Wold-style-definition + warning-1 += $(call cc-option, -Wmissing-include-dirs) + warning-1 += $(call cc-option, -Wunused-but-set-variable) + warning-1 += $(call cc-option, -Wunused-const-variable) ++warning-1 += $(call cc-option, -Wpacked-not-aligned) + warning-1 += $(call cc-disable-warning, missing-field-initializers) + + warning-2 := -Waggregate-return +diff --git a/scripts/unifdef.c b/scripts/unifdef.c +index 7493c0ee51cc..db00e3e30a59 100644 +--- a/scripts/unifdef.c ++++ b/scripts/unifdef.c +@@ -395,7 +395,7 @@ usage(void) + * When we have processed a group that starts off with a known-false + * #if/#elif sequence (which has therefore been deleted) followed by a + * #elif that we don't understand and therefore must keep, we edit the +- * latter into a #if to keep the nesting correct. We use strncpy() to ++ * latter into a #if to keep the nesting correct. We use memcpy() to + * overwrite the 4 byte token "elif" with "if " without a '\0' byte. + * + * When we find a true #elif in a group, the following block will +@@ -450,7 +450,7 @@ static void Idrop (void) { Fdrop(); ignoreon(); } + static void Itrue (void) { Ftrue(); ignoreon(); } + static void Ifalse(void) { Ffalse(); ignoreon(); } + /* modify this line */ +-static void Mpass (void) { strncpy(keyword, "if ", 4); Pelif(); } ++static void Mpass (void) { memcpy(keyword, "if ", 4); Pelif(); } + static void Mtrue (void) { keywordedit("else"); state(IS_TRUE_MIDDLE); } + static void Melif (void) { keywordedit("endif"); state(IS_FALSE_TRAILER); } + static void Melse (void) { keywordedit("endif"); state(IS_FALSE_ELSE); } +diff --git a/sound/core/control.c b/sound/core/control.c +index bd01d492f46a..2be860a446a2 100644 +--- a/sound/core/control.c ++++ b/sound/core/control.c +@@ -346,6 +346,40 @@ static int snd_ctl_find_hole(struct snd_card *card, unsigned int count) + return 0; + } + ++/* add a new kcontrol object; call with card->controls_rwsem locked */ ++static int __snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol) ++{ ++ struct snd_ctl_elem_id id; ++ unsigned int idx; ++ unsigned int count; ++ ++ id = kcontrol->id; ++ if (id.index > UINT_MAX - kcontrol->count) ++ return -EINVAL; ++ ++ if (snd_ctl_find_id(card, &id)) { ++ dev_err(card->dev, ++ "control %i:%i:%i:%s:%i is already present\n", ++ id.iface, id.device, id.subdevice, id.name, id.index); ++ return -EBUSY; ++ } ++ ++ if (snd_ctl_find_hole(card, kcontrol->count) < 0) ++ return -ENOMEM; ++ ++ list_add_tail(&kcontrol->list, &card->controls); ++ card->controls_count += kcontrol->count; ++ kcontrol->id.numid = card->last_numid + 1; ++ card->last_numid += kcontrol->count; ++ ++ id = kcontrol->id; ++ count = kcontrol->count; ++ for (idx = 0; idx < count; idx++, id.index++, id.numid++) ++ snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id); ++ ++ return 0; ++} ++ + /** + * snd_ctl_add - add the control instance to the card + * @card: the card instance +@@ -362,45 +396,18 @@ static int snd_ctl_find_hole(struct snd_card *card, unsigned int count) + */ + int snd_ctl_add(struct snd_card *card, struct snd_kcontrol *kcontrol) + { +- struct snd_ctl_elem_id id; +- unsigned int idx; +- unsigned int count; + int err = -EINVAL; + + if (! kcontrol) + return err; + if (snd_BUG_ON(!card || !kcontrol->info)) + goto error; +- id = kcontrol->id; +- if (id.index > UINT_MAX - kcontrol->count) +- goto error; + + down_write(&card->controls_rwsem); +- if (snd_ctl_find_id(card, &id)) { +- up_write(&card->controls_rwsem); +- dev_err(card->dev, "control %i:%i:%i:%s:%i is already present\n", +- id.iface, +- id.device, +- id.subdevice, +- id.name, +- id.index); +- err = -EBUSY; +- goto error; +- } +- if (snd_ctl_find_hole(card, kcontrol->count) < 0) { +- up_write(&card->controls_rwsem); +- err = -ENOMEM; +- goto error; +- } +- list_add_tail(&kcontrol->list, &card->controls); +- card->controls_count += kcontrol->count; +- kcontrol->id.numid = card->last_numid + 1; +- card->last_numid += kcontrol->count; +- id = kcontrol->id; +- count = kcontrol->count; ++ err = __snd_ctl_add(card, kcontrol); + up_write(&card->controls_rwsem); +- for (idx = 0; idx < count; idx++, id.index++, id.numid++) +- snd_ctl_notify(card, SNDRV_CTL_EVENT_MASK_ADD, &id); ++ if (err < 0) ++ goto error; + return 0; + + error: +@@ -1322,9 +1329,12 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file, + kctl->tlv.c = snd_ctl_elem_user_tlv; + + /* This function manage to free the instance on failure. */ +- err = snd_ctl_add(card, kctl); +- if (err < 0) +- return err; ++ down_write(&card->controls_rwsem); ++ err = __snd_ctl_add(card, kctl); ++ if (err < 0) { ++ snd_ctl_free_one(kctl); ++ goto unlock; ++ } + offset = snd_ctl_get_ioff(kctl, &info->id); + snd_ctl_build_ioff(&info->id, kctl, offset); + /* +@@ -1335,10 +1345,10 @@ static int snd_ctl_elem_add(struct snd_ctl_file *file, + * which locks the element. + */ + +- down_write(&card->controls_rwsem); + card->user_ctl_count++; +- up_write(&card->controls_rwsem); + ++ unlock: ++ up_write(&card->controls_rwsem); + return 0; + } + +diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c +index 3de88974eeb6..0ad194002c0c 100644 +--- a/sound/core/pcm_native.c ++++ b/sound/core/pcm_native.c +@@ -35,6 +35,7 @@ + #include <sound/timer.h> + #include <sound/minors.h> + #include <linux/uio.h> ++#include <linux/delay.h> + + /* + * Compatibility +@@ -78,12 +79,12 @@ static DECLARE_RWSEM(snd_pcm_link_rwsem); + * and this may lead to a deadlock when the code path takes read sem + * twice (e.g. one in snd_pcm_action_nonatomic() and another in + * snd_pcm_stream_lock()). As a (suboptimal) workaround, let writer to +- * spin until it gets the lock. ++ * sleep until all the readers are completed without blocking by writer. + */ +-static inline void down_write_nonblock(struct rw_semaphore *lock) ++static inline void down_write_nonfifo(struct rw_semaphore *lock) + { + while (!down_write_trylock(lock)) +- cond_resched(); ++ msleep(1); + } + + /** +@@ -1825,7 +1826,7 @@ static int snd_pcm_link(struct snd_pcm_substream *substream, int fd) + res = -ENOMEM; + goto _nolock; + } +- down_write_nonblock(&snd_pcm_link_rwsem); ++ down_write_nonfifo(&snd_pcm_link_rwsem); + write_lock_irq(&snd_pcm_link_rwlock); + if (substream->runtime->status->state == SNDRV_PCM_STATE_OPEN || + substream->runtime->status->state != substream1->runtime->status->state || +@@ -1872,7 +1873,7 @@ static int snd_pcm_unlink(struct snd_pcm_substream *substream) + struct snd_pcm_substream *s; + int res = 0; + +- down_write_nonblock(&snd_pcm_link_rwsem); ++ down_write_nonfifo(&snd_pcm_link_rwsem); + write_lock_irq(&snd_pcm_link_rwlock); + if (!snd_pcm_stream_linked(substream)) { + res = -EALREADY; +@@ -2224,7 +2225,8 @@ int snd_pcm_hw_constraints_complete(struct snd_pcm_substream *substream) + + static void pcm_release_private(struct snd_pcm_substream *substream) + { +- snd_pcm_unlink(substream); ++ if (snd_pcm_stream_linked(substream)) ++ snd_pcm_unlink(substream); + } + + void snd_pcm_release_substream(struct snd_pcm_substream *substream) +diff --git a/sound/isa/wss/wss_lib.c b/sound/isa/wss/wss_lib.c +index 913b731d2236..f40330ddb9b2 100644 +--- a/sound/isa/wss/wss_lib.c ++++ b/sound/isa/wss/wss_lib.c +@@ -1531,7 +1531,6 @@ static int snd_wss_playback_open(struct snd_pcm_substream *substream) + if (err < 0) { + if (chip->release_dma) + chip->release_dma(chip, chip->dma_private_data, chip->dma1); +- snd_free_pages(runtime->dma_area, runtime->dma_bytes); + return err; + } + chip->playback_substream = substream; +@@ -1572,7 +1571,6 @@ static int snd_wss_capture_open(struct snd_pcm_substream *substream) + if (err < 0) { + if (chip->release_dma) + chip->release_dma(chip, chip->dma_private_data, chip->dma2); +- snd_free_pages(runtime->dma_area, runtime->dma_bytes); + return err; + } + chip->capture_substream = substream; +diff --git a/sound/pci/ac97/ac97_codec.c b/sound/pci/ac97/ac97_codec.c +index 82259ca61e64..c4840fda44b4 100644 +--- a/sound/pci/ac97/ac97_codec.c ++++ b/sound/pci/ac97/ac97_codec.c +@@ -824,7 +824,7 @@ static int snd_ac97_put_spsa(struct snd_kcontrol *kcontrol, struct snd_ctl_elem_ + { + struct snd_ac97 *ac97 = snd_kcontrol_chip(kcontrol); + int reg = kcontrol->private_value & 0xff; +- int shift = (kcontrol->private_value >> 8) & 0xff; ++ int shift = (kcontrol->private_value >> 8) & 0x0f; + int mask = (kcontrol->private_value >> 16) & 0xff; + // int invert = (kcontrol->private_value >> 24) & 0xff; + unsigned short value, old, new; +diff --git a/sound/pci/hda/hda_intel.c b/sound/pci/hda/hda_intel.c +index ecb07fb036af..f964743b104c 100644 +--- a/sound/pci/hda/hda_intel.c ++++ b/sound/pci/hda/hda_intel.c +@@ -2363,6 +2363,10 @@ static const struct pci_device_id azx_ids[] = { + /* AMD Hudson */ + { PCI_DEVICE(0x1022, 0x780d), + .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB }, ++ /* AMD Stoney */ ++ { PCI_DEVICE(0x1022, 0x157a), ++ .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB | ++ AZX_DCAPS_PM_RUNTIME }, + /* AMD Raven */ + { PCI_DEVICE(0x1022, 0x15e3), + .driver_data = AZX_DRIVER_GENERIC | AZX_DCAPS_PRESET_ATI_SB | +diff --git a/sound/pci/trident/trident.c b/sound/pci/trident/trident.c +index cedf13b64803..2f18b1cdc2cd 100644 +--- a/sound/pci/trident/trident.c ++++ b/sound/pci/trident/trident.c +@@ -123,7 +123,7 @@ static int snd_trident_probe(struct pci_dev *pci, + } else { + strcpy(card->shortname, "Trident "); + } +- strcat(card->shortname, card->driver); ++ strcat(card->shortname, str); + sprintf(card->longname, "%s PCI Audio at 0x%lx, irq %d", + card->shortname, trident->port, trident->irq); + +diff --git a/sound/sparc/cs4231.c b/sound/sparc/cs4231.c +index 30bdc971883b..017e241b0ec9 100644 +--- a/sound/sparc/cs4231.c ++++ b/sound/sparc/cs4231.c +@@ -1146,10 +1146,8 @@ static int snd_cs4231_playback_open(struct snd_pcm_substream *substream) + runtime->hw = snd_cs4231_playback; + + err = snd_cs4231_open(chip, CS4231_MODE_PLAY); +- if (err < 0) { +- snd_free_pages(runtime->dma_area, runtime->dma_bytes); ++ if (err < 0) + return err; +- } + chip->playback_substream = substream; + chip->p_periods_sent = 0; + snd_pcm_set_sync(substream); +@@ -1167,10 +1165,8 @@ static int snd_cs4231_capture_open(struct snd_pcm_substream *substream) + runtime->hw = snd_cs4231_capture; + + err = snd_cs4231_open(chip, CS4231_MODE_RECORD); +- if (err < 0) { +- snd_free_pages(runtime->dma_area, runtime->dma_bytes); ++ if (err < 0) + return err; +- } + chip->capture_substream = substream; + chip->c_periods_sent = 0; + snd_pcm_set_sync(substream); +diff --git a/sound/usb/card.c b/sound/usb/card.c +index 83336bb6333e..084d413d7a37 100644 +--- a/sound/usb/card.c ++++ b/sound/usb/card.c +@@ -589,9 +589,12 @@ static int usb_audio_probe(struct usb_interface *intf, + + __error: + if (chip) { ++ /* chip->active is inside the chip->card object, ++ * decrement before memory is possibly returned. ++ */ ++ atomic_dec(&chip->active); + if (!chip->num_interfaces) + snd_card_free(chip->card); +- atomic_dec(&chip->active); + } + mutex_unlock(®ister_mutex); + return err;
