diff --git a/Makefile b/Makefile
index eadc962a80ab..ace62c12e703 100644
--- a/Makefile
+++ b/Makefile
@@ -1,6 +1,6 @@
 VERSION = 3
 PATCHLEVEL = 18
-SUBLEVEL = 130
+SUBLEVEL = 131
 EXTRAVERSION =
 NAME = Diseased Newt
 
diff --git a/arch/arm/mm/cache-v7.S b/arch/arm/mm/cache-v7.S
index b966656d2c2d..7e98fecff55a 100644
--- a/arch/arm/mm/cache-v7.S
+++ b/arch/arm/mm/cache-v7.S
@@ -359,14 +359,16 @@ v7_dma_inv_range:
        ALT_UP(W(nop))
 #endif
        mcrne   p15, 0, r0, c7, c14, 1          @ clean & invalidate D / U line
+       addne   r0, r0, r2
 
        tst     r1, r3
        bic     r1, r1, r3
        mcrne   p15, 0, r1, c7, c14, 1          @ clean & invalidate D / U line
-1:
-       mcr     p15, 0, r0, c7, c6, 1           @ invalidate D / U line
-       add     r0, r0, r2
        cmp     r0, r1
+1:
+       mcrlo   p15, 0, r0, c7, c6, 1           @ invalidate D / U line
+       addlo   r0, r0, r2
+       cmplo   r0, r1
        blo     1b
        dsb     st
        ret     lr
diff --git a/arch/powerpc/boot/Makefile b/arch/powerpc/boot/Makefile
index 8a5bc1cfc6aa..971ec99838ce 100644
--- a/arch/powerpc/boot/Makefile
+++ b/arch/powerpc/boot/Makefile
@@ -67,7 +67,8 @@ $(addprefix $(obj)/,$(zlib) cuboot-c2k.o gunzip_util.o 
main.o): \
 libfdt       := fdt.c fdt_ro.c fdt_wip.c fdt_sw.c fdt_rw.c fdt_strerror.c
 libfdtheader := fdt.h libfdt.h libfdt_internal.h
 
-$(addprefix $(obj)/,$(libfdt) libfdt-wrapper.o simpleboot.o epapr.o): \
+$(addprefix $(obj)/,$(libfdt) libfdt-wrapper.o simpleboot.o epapr.o \
+       treeboot-akebono.o treeboot-currituck.o treeboot-iss4xx.o): \
        $(addprefix $(obj)/,$(libfdtheader))
 
 src-wlib-y := string.S crt0.S crtsavres.S stdio.c main.c \
diff --git a/arch/powerpc/kernel/legacy_serial.c 
b/arch/powerpc/kernel/legacy_serial.c
index 7b750c4ed5c7..c26229a1dc6f 100644
--- a/arch/powerpc/kernel/legacy_serial.c
+++ b/arch/powerpc/kernel/legacy_serial.c
@@ -370,6 +370,8 @@ void __init find_legacy_serial_ports(void)
 
        /* Now find out if one of these is out firmware console */
        path = of_get_property(of_chosen, "linux,stdout-path", NULL);
+       if (path == NULL)
+               path = of_get_property(of_chosen, "stdout-path", NULL);
        if (path != NULL) {
                stdout = of_find_node_by_path(path);
                if (stdout)
@@ -593,8 +595,10 @@ static int __init check_legacy_serial_console(void)
        /* We are getting a weird phandle from OF ... */
        /* ... So use the full path instead */
        name = of_get_property(of_chosen, "linux,stdout-path", NULL);
+       if (name == NULL)
+               name = of_get_property(of_chosen, "stdout-path", NULL);
        if (name == NULL) {
-               DBG(" no linux,stdout-path !\n");
+               DBG(" no stdout-path !\n");
                return -ENODEV;
        }
        prom_stdout = of_find_node_by_path(name);
diff --git a/arch/x86/platform/efi/early_printk.c 
b/arch/x86/platform/efi/early_printk.c
index 524142117296..82324fc25d5e 100644
--- a/arch/x86/platform/efi/early_printk.c
+++ b/arch/x86/platform/efi/early_printk.c
@@ -179,7 +179,7 @@ early_efi_write(struct console *con, const char *str, 
unsigned int num)
                        num--;
                }
 
-               if (efi_x >= si->lfb_width) {
+               if (efi_x + font->width > si->lfb_width) {
                        efi_x = 0;
                        efi_y += font->height;
                }
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 6629a5deccbd..e155998e4696 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -4295,6 +4295,7 @@ static const struct ata_blacklist_entry 
ata_device_blacklist [] = {
        { "SSD*INTEL*",                 NULL,   ATA_HORKAGE_ZERO_AFTER_TRIM, },
        { "Samsung*SSD*",               NULL,   ATA_HORKAGE_ZERO_AFTER_TRIM, },
        { "SAMSUNG*SSD*",               NULL,   ATA_HORKAGE_ZERO_AFTER_TRIM, },
+       { "SAMSUNG*MZ7KM*",             NULL,   ATA_HORKAGE_ZERO_AFTER_TRIM, },
        { "ST[1248][0248]0[FH]*",       NULL,   ATA_HORKAGE_ZERO_AFTER_TRIM, },
 
        /* devices that don't properly handle TRIM commands */
diff --git a/drivers/i2c/busses/i2c-scmi.c b/drivers/i2c/busses/i2c-scmi.c
index efefcfa24a4c..d2178f701b41 100644
--- a/drivers/i2c/busses/i2c-scmi.c
+++ b/drivers/i2c/busses/i2c-scmi.c
@@ -364,6 +364,7 @@ static int acpi_smbus_cmi_add(struct acpi_device *device)
 {
        struct acpi_smbus_cmi *smbus_cmi;
        const struct acpi_device_id *id;
+       int ret;
 
        smbus_cmi = kzalloc(sizeof(struct acpi_smbus_cmi), GFP_KERNEL);
        if (!smbus_cmi)
@@ -385,8 +386,10 @@ static int acpi_smbus_cmi_add(struct acpi_device *device)
        acpi_walk_namespace(ACPI_TYPE_METHOD, smbus_cmi->handle, 1,
                            acpi_smbus_cmi_query_methods, NULL, smbus_cmi, 
NULL);
 
-       if (smbus_cmi->cap_info == 0)
+       if (smbus_cmi->cap_info == 0) {
+               ret = -ENODEV;
                goto err;
+       }
 
        snprintf(smbus_cmi->adapter.name, sizeof(smbus_cmi->adapter.name),
                "SMBus CMI adapter %s",
@@ -397,7 +400,8 @@ static int acpi_smbus_cmi_add(struct acpi_device *device)
        smbus_cmi->adapter.class = I2C_CLASS_HWMON | I2C_CLASS_SPD;
        smbus_cmi->adapter.dev.parent = &device->dev;
 
-       if (i2c_add_adapter(&smbus_cmi->adapter)) {
+       ret = i2c_add_adapter(&smbus_cmi->adapter);
+       if (ret) {
                dev_err(&device->dev, "Couldn't register adapter!\n");
                goto err;
        }
@@ -407,7 +411,7 @@ static int acpi_smbus_cmi_add(struct acpi_device *device)
 err:
        kfree(smbus_cmi);
        device->driver_data = NULL;
-       return -EIO;
+       return ret;
 }
 
 static int acpi_smbus_cmi_remove(struct acpi_device *device)
diff --git a/drivers/ide/pmac.c b/drivers/ide/pmac.c
index 2db803cd095c..57a0bd00789f 100644
--- a/drivers/ide/pmac.c
+++ b/drivers/ide/pmac.c
@@ -920,6 +920,7 @@ static u8 pmac_ide_cable_detect(ide_hwif_t *hwif)
        struct device_node *root = of_find_node_by_path("/");
        const char *model = of_get_property(root, "model", NULL);
 
+       of_node_put(root);
        /* Get cable type from device-tree. */
        if (cable && !strncmp(cable, "80-", 3)) {
                /* Some drives fail to detect 80c cable in PowerBook */
diff --git a/drivers/input/keyboard/omap4-keypad.c 
b/drivers/input/keyboard/omap4-keypad.c
index 3ab045369c0c..1739221aa5fa 100644
--- a/drivers/input/keyboard/omap4-keypad.c
+++ b/drivers/input/keyboard/omap4-keypad.c
@@ -60,8 +60,18 @@
 
 /* OMAP4 values */
 #define OMAP4_VAL_IRQDISABLE           0x0
-#define OMAP4_VAL_DEBOUNCINGTIME       0x7
-#define OMAP4_VAL_PVT                  0x7
+
+/*
+ * Errata i689: If a key is released for a time shorter than debounce time,
+ * the keyboard will idle and never detect the key release. The workaround
+ * is to use at least a 12ms debounce time. See omap5432 TRM chapter
+ * "26.4.6.2 Keyboard Controller Timer" for more information.
+ */
+#define OMAP4_KEYPAD_PTV_DIV_128        0x6
+#define OMAP4_KEYPAD_DEBOUNCINGTIME_MS(dbms, ptv)     \
+       ((((dbms) * 1000) / ((1 << ((ptv) + 1)) * (1000000 / 32768))) - 1)
+#define OMAP4_VAL_DEBOUNCINGTIME_16MS                                  \
+       OMAP4_KEYPAD_DEBOUNCINGTIME_MS(16, OMAP4_KEYPAD_PTV_DIV_128)
 
 enum {
        KBD_REVISION_OMAP4 = 0,
@@ -181,9 +191,9 @@ static int omap4_keypad_open(struct input_dev *input)
 
        kbd_writel(keypad_data, OMAP4_KBD_CTRL,
                        OMAP4_DEF_CTRL_NOSOFTMODE |
-                       (OMAP4_VAL_PVT << OMAP4_DEF_CTRL_PTV_SHIFT));
+                       (OMAP4_KEYPAD_PTV_DIV_128 << OMAP4_DEF_CTRL_PTV_SHIFT));
        kbd_writel(keypad_data, OMAP4_KBD_DEBOUNCINGTIME,
-                       OMAP4_VAL_DEBOUNCINGTIME);
+                       OMAP4_VAL_DEBOUNCINGTIME_16MS);
        /* clear pending interrupts */
        kbd_write_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS,
                         kbd_read_irqreg(keypad_data, OMAP4_KBD_IRQSTATUS));
diff --git a/drivers/mmc/host/omap.c b/drivers/mmc/host/omap.c
index 68dd6c79c378..11e5bfedab70 100644
--- a/drivers/mmc/host/omap.c
+++ b/drivers/mmc/host/omap.c
@@ -105,6 +105,7 @@ struct mmc_omap_slot {
        unsigned int            vdd;
        u16                     saved_con;
        u16                     bus_mode;
+       u16                     power_mode;
        unsigned int            fclk_freq;
 
        struct tasklet_struct   cover_tasklet;
@@ -1155,7 +1156,7 @@ static void mmc_omap_set_ios(struct mmc_host *mmc, struct 
mmc_ios *ios)
        struct mmc_omap_slot *slot = mmc_priv(mmc);
        struct mmc_omap_host *host = slot->host;
        int i, dsor;
-       int clk_enabled;
+       int clk_enabled, init_stream;
 
        mmc_omap_select_slot(slot, 0);
 
@@ -1165,6 +1166,7 @@ static void mmc_omap_set_ios(struct mmc_host *mmc, struct 
mmc_ios *ios)
                slot->vdd = ios->vdd;
 
        clk_enabled = 0;
+       init_stream = 0;
        switch (ios->power_mode) {
        case MMC_POWER_OFF:
                mmc_omap_set_power(slot, 0, ios->vdd);
@@ -1172,13 +1174,17 @@ static void mmc_omap_set_ios(struct mmc_host *mmc, 
struct mmc_ios *ios)
        case MMC_POWER_UP:
                /* Cannot touch dsor yet, just power up MMC */
                mmc_omap_set_power(slot, 1, ios->vdd);
+               slot->power_mode = ios->power_mode;
                goto exit;
        case MMC_POWER_ON:
                mmc_omap_fclk_enable(host, 1);
                clk_enabled = 1;
                dsor |= 1 << 11;
+               if (slot->power_mode != MMC_POWER_ON)
+                       init_stream = 1;
                break;
        }
+       slot->power_mode = ios->power_mode;
 
        if (slot->bus_mode != ios->bus_mode) {
                if (slot->pdata->set_bus_mode != NULL)
@@ -1194,7 +1200,7 @@ static void mmc_omap_set_ios(struct mmc_host *mmc, struct 
mmc_ios *ios)
        for (i = 0; i < 2; i++)
                OMAP_MMC_WRITE(host, CON, dsor);
        slot->saved_con = dsor;
-       if (ios->power_mode == MMC_POWER_ON) {
+       if (init_stream) {
                /* worst case at 400kHz, 80 cycles makes 200 microsecs */
                int usecs = 250;
 
@@ -1232,6 +1238,7 @@ static int mmc_omap_new_slot(struct mmc_omap_host *host, 
int id)
        slot->host = host;
        slot->mmc = mmc;
        slot->id = id;
+       slot->power_mode = MMC_POWER_UNDEFINED;
        slot->pdata = &host->pdata->slots[id];
 
        host->slots[id] = slot;
diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
index 2110215f3528..371cbaa82608 100644
--- a/drivers/net/bonding/bond_3ad.c
+++ b/drivers/net/bonding/bond_3ad.c
@@ -1906,6 +1906,9 @@ void bond_3ad_unbind_slave(struct slave *slave)
                   aggregator->aggregator_identifier);
 
        /* Tell the partner that this port is not suitable for aggregation */
+       port->actor_oper_port_state &= ~AD_STATE_SYNCHRONIZATION;
+       port->actor_oper_port_state &= ~AD_STATE_COLLECTING;
+       port->actor_oper_port_state &= ~AD_STATE_DISTRIBUTING;
        port->actor_oper_port_state &= ~AD_STATE_AGGREGATION;
        __update_lacpdu_from_port(port);
        ad_lacpdu_send(port);
diff --git a/drivers/net/wireless/ath/wil6210/wmi.c 
b/drivers/net/wireless/ath/wil6210/wmi.c
index 4311df982c60..eaf720679ba3 100644
--- a/drivers/net/wireless/ath/wil6210/wmi.c
+++ b/drivers/net/wireless/ath/wil6210/wmi.c
@@ -969,7 +969,12 @@ int wmi_set_ie(struct wil6210_priv *wil, u8 type, u16 
ie_len, const void *ie)
 {
        int rc;
        u16 len = sizeof(struct wmi_set_appie_cmd) + ie_len;
-       struct wmi_set_appie_cmd *cmd = kzalloc(len, GFP_KERNEL);
+       struct wmi_set_appie_cmd *cmd;
+
+       if (len < ie_len)
+               return -EINVAL;
+
+       cmd = kzalloc(len, GFP_KERNEL);
 
        if (!cmd)
                return -ENOMEM;
diff --git a/drivers/sbus/char/display7seg.c b/drivers/sbus/char/display7seg.c
index 2b0ce7c350ee..98661714688b 100644
--- a/drivers/sbus/char/display7seg.c
+++ b/drivers/sbus/char/display7seg.c
@@ -221,6 +221,7 @@ static int d7s_probe(struct platform_device *op)
        dev_set_drvdata(&op->dev, p);
        d7s_device = p;
        err = 0;
+       of_node_put(opts);
 
 out:
        return err;
diff --git a/drivers/sbus/char/envctrl.c b/drivers/sbus/char/envctrl.c
index af15a2fdab5e..3d36fa025a5a 100644
--- a/drivers/sbus/char/envctrl.c
+++ b/drivers/sbus/char/envctrl.c
@@ -910,8 +910,10 @@ static void envctrl_init_i2c_child(struct device_node *dp,
                        for (len = 0; len < PCF8584_MAX_CHANNELS; ++len) {
                                pchild->mon_type[len] = ENVCTRL_NOMON;
                        }
+                       of_node_put(root_node);
                        return;
                }
+               of_node_put(root_node);
        }
 
        /* Get the monitor channels. */
diff --git a/drivers/scsi/libiscsi.c b/drivers/scsi/libiscsi.c
index 857bf9417817..56441a5ec3d7 100644
--- a/drivers/scsi/libiscsi.c
+++ b/drivers/scsi/libiscsi.c
@@ -2433,8 +2433,8 @@ int iscsi_eh_session_reset(struct scsi_cmnd *sc)
 failed:
                ISCSI_DBG_EH(session,
                             "failing session reset: Could not log back into "
-                            "%s, %s [age %d]\n", session->targetname,
-                            conn->persistent_address, session->age);
+                            "%s [age %d]\n", session->targetname,
+                            session->age);
                spin_unlock_bh(&session->frwd_lock);
                mutex_unlock(&session->eh_mutex);
                return FAILED;
diff --git a/drivers/scsi/sr_ioctl.c b/drivers/scsi/sr_ioctl.c
index 6389fcff12ec..5982a41df6a2 100644
--- a/drivers/scsi/sr_ioctl.c
+++ b/drivers/scsi/sr_ioctl.c
@@ -187,30 +187,25 @@ int sr_do_ioctl(Scsi_CD *cd, struct packet_command *cgc)
        struct scsi_device *SDev;
        struct scsi_sense_hdr sshdr;
        int result, err = 0, retries = 0;
-       struct request_sense *sense = cgc->sense;
+       unsigned char sense_buffer[SCSI_SENSE_BUFFERSIZE];
 
        SDev = cd->device;
 
-       if (!sense) {
-               sense = kmalloc(SCSI_SENSE_BUFFERSIZE, GFP_KERNEL);
-               if (!sense) {
-                       err = -ENOMEM;
-                       goto out;
-               }
-       }
-
       retry:
        if (!scsi_block_when_processing_errors(SDev)) {
                err = -ENODEV;
                goto out;
        }
 
-       memset(sense, 0, sizeof(*sense));
+       memset(sense_buffer, 0, sizeof(sense_buffer));
        result = scsi_execute(SDev, cgc->cmd, cgc->data_direction,
-                             cgc->buffer, cgc->buflen, (char *)sense,
+                             cgc->buffer, cgc->buflen, sense_buffer,
                              cgc->timeout, IOCTL_RETRIES, 0, NULL);
 
-       scsi_normalize_sense((char *)sense, sizeof(*sense), &sshdr);
+       scsi_normalize_sense(sense_buffer, sizeof(sense_buffer), &sshdr);
+
+       if (cgc->sense)
+               memcpy(cgc->sense, sense_buffer, sizeof(*cgc->sense));
 
        /* Minimal error checking.  Ignore cases we know about, and report the 
rest. */
        if (driver_byte(result) != 0) {
@@ -272,8 +267,6 @@ int sr_do_ioctl(Scsi_CD *cd, struct packet_command *cgc)
 
        /* Wake up a process waiting for device */
       out:
-       if (!cgc->sense)
-               kfree(sense);
        cgc->stat = err;
        return err;
 }
diff --git a/drivers/scsi/vmw_pvscsi.c b/drivers/scsi/vmw_pvscsi.c
index d5dd70049f81..25119780edae 100644
--- a/drivers/scsi/vmw_pvscsi.c
+++ b/drivers/scsi/vmw_pvscsi.c
@@ -1225,8 +1225,6 @@ static void pvscsi_shutdown_intr(struct pvscsi_adapter 
*adapter)
 
 static void pvscsi_release_resources(struct pvscsi_adapter *adapter)
 {
-       pvscsi_shutdown_intr(adapter);
-
        if (adapter->workqueue)
                destroy_workqueue(adapter->workqueue);
 
@@ -1555,6 +1553,7 @@ static int pvscsi_probe(struct pci_dev *pdev, const 
struct pci_device_id *id)
 out_reset_adapter:
        ll_adapter_reset(adapter);
 out_release_resources:
+       pvscsi_shutdown_intr(adapter);
        pvscsi_release_resources(adapter);
        scsi_host_put(host);
 out_disable_device:
@@ -1563,6 +1562,7 @@ out_disable_device:
        return error;
 
 out_release_resources_and_disable:
+       pvscsi_shutdown_intr(adapter);
        pvscsi_release_resources(adapter);
        goto out_disable_device;
 }
diff --git a/drivers/tty/serial/suncore.c b/drivers/tty/serial/suncore.c
index 6e4ac8db2d79..2b06c1603f23 100644
--- a/drivers/tty/serial/suncore.c
+++ b/drivers/tty/serial/suncore.c
@@ -112,6 +112,7 @@ void sunserial_console_termios(struct console *con, struct 
device_node *uart_dp)
                mode = of_get_property(dp, mode_prop, NULL);
                if (!mode)
                        mode = "9600,8,n,1,-";
+               of_node_put(dp);
        }
 
        cflag = CREAD | HUPCL | CLOCAL;
diff --git a/fs/cifs/Kconfig b/fs/cifs/Kconfig
index a2172f3f69e3..35bbf6b64982 100644
--- a/fs/cifs/Kconfig
+++ b/fs/cifs/Kconfig
@@ -111,7 +111,7 @@ config CIFS_XATTR
 
 config CIFS_POSIX
         bool "CIFS POSIX Extensions"
-        depends on CIFS_XATTR
+        depends on CIFS && CIFS_ALLOW_INSECURE_LEGACY && CIFS_XATTR
         help
           Enabling this option will cause the cifs client to attempt to
          negotiate a newer dialect with servers, such as Samba 3.0.5
diff --git a/include/linux/posix-timers.h b/include/linux/posix-timers.h
index 907f3fd191ac..3e28a1a8d823 100644
--- a/include/linux/posix-timers.h
+++ b/include/linux/posix-timers.h
@@ -65,8 +65,8 @@ struct k_itimer {
        spinlock_t it_lock;
        clockid_t it_clock;             /* which timer type */
        timer_t it_id;                  /* timer id */
-       int it_overrun;                 /* overrun on pending signal  */
-       int it_overrun_last;            /* overrun on last delivered signal */
+       s64 it_overrun;                 /* overrun on pending signal  */
+       s64 it_overrun_last;            /* overrun on last delivered signal */
        int it_requeue_pending;         /* waiting to requeue this timer */
 #define REQUEUE_PENDING 1
        int it_sigev_notify;            /* notify word of sigevent struct */
diff --git a/include/sound/pcm.h b/include/sound/pcm.h
index e02b1b8d8ee4..21b0129c1850 100644
--- a/include/sound/pcm.h
+++ b/include/sound/pcm.h
@@ -98,7 +98,7 @@ struct snd_pcm_ops {
 #define SNDRV_PCM_IOCTL1_TRUE          ((void *)1)
 
 #define SNDRV_PCM_IOCTL1_RESET         0
-#define SNDRV_PCM_IOCTL1_INFO          1
+/* 1 is absent slot. */
 #define SNDRV_PCM_IOCTL1_CHANNEL_INFO  2
 #define SNDRV_PCM_IOCTL1_GSTATE                3
 #define SNDRV_PCM_IOCTL1_FIFO_SIZE     4
diff --git a/kernel/time/posix-cpu-timers.c b/kernel/time/posix-cpu-timers.c
index 731d7a342670..44c4e338f30e 100644
--- a/kernel/time/posix-cpu-timers.c
+++ b/kernel/time/posix-cpu-timers.c
@@ -103,7 +103,7 @@ static void bump_cpu_timer(struct k_itimer *timer,
                        continue;
 
                timer->it.cpu.expires += incr;
-               timer->it_overrun += 1 << i;
+               timer->it_overrun += 1LL << i;
                delta -= incr;
        }
 }
diff --git a/kernel/time/posix-timers.c b/kernel/time/posix-timers.c
index 2cca2e79c643..c9e2c8d25289 100644
--- a/kernel/time/posix-timers.c
+++ b/kernel/time/posix-timers.c
@@ -348,6 +348,17 @@ static __init int init_posix_timers(void)
 
 __initcall(init_posix_timers);
 
+/*
+ * The siginfo si_overrun field and the return value of timer_getoverrun(2)
+ * are of type int. Clamp the overrun value to INT_MAX
+ */
+static inline int timer_overrun_to_int(struct k_itimer *timr, int baseval)
+{
+       s64 sum = timr->it_overrun_last + (s64)baseval;
+
+       return sum > (s64)INT_MAX ? INT_MAX : (int)sum;
+}
+
 static void schedule_next_timer(struct k_itimer *timr)
 {
        struct hrtimer *timer = &timr->it.real.timer;
@@ -355,12 +366,11 @@ static void schedule_next_timer(struct k_itimer *timr)
        if (timr->it.real.interval.tv64 == 0)
                return;
 
-       timr->it_overrun += (unsigned int) hrtimer_forward(timer,
-                                               timer->base->get_time(),
-                                               timr->it.real.interval);
+       timr->it_overrun += hrtimer_forward(timer, timer->base->get_time(),
+                                           timr->it.real.interval);
 
        timr->it_overrun_last = timr->it_overrun;
-       timr->it_overrun = -1;
+       timr->it_overrun = -1LL;
        ++timr->it_requeue_pending;
        hrtimer_restart(timer);
 }
@@ -389,7 +399,7 @@ void do_schedule_next_timer(struct siginfo *info)
                else
                        schedule_next_timer(timr);
 
-               info->si_overrun += timr->it_overrun_last;
+               info->si_overrun = timer_overrun_to_int(timr, info->si_overrun);
        }
 
        if (timr)
@@ -484,8 +494,7 @@ static enum hrtimer_restart posix_timer_fn(struct hrtimer 
*timer)
                                        now = ktime_add(now, kj);
                        }
 #endif
-                       timr->it_overrun += (unsigned int)
-                               hrtimer_forward(timer, now,
+                       timr->it_overrun += hrtimer_forward(timer, now,
                                                timr->it.real.interval);
                        ret = HRTIMER_RESTART;
                        ++timr->it_requeue_pending;
@@ -626,7 +635,7 @@ SYSCALL_DEFINE3(timer_create, const clockid_t, which_clock,
        it_id_set = IT_ID_SET;
        new_timer->it_id = (timer_t) new_timer_id;
        new_timer->it_clock = which_clock;
-       new_timer->it_overrun = -1;
+       new_timer->it_overrun = -1LL;
 
        if (timer_event_spec) {
                if (copy_from_user(&event, timer_event_spec, sizeof (event))) {
@@ -755,7 +764,7 @@ common_timer_get(struct k_itimer *timr, struct itimerspec 
*cur_setting)
         */
        if (iv.tv64 && (timr->it_requeue_pending & REQUEUE_PENDING ||
                        timr->it_sigev_notify == SIGEV_NONE))
-               timr->it_overrun += (unsigned int) hrtimer_forward(timer, now, 
iv);
+               timr->it_overrun += hrtimer_forward(timer, now, iv);
 
        remaining = ktime_sub(hrtimer_get_expires(timer), now);
        /* Return 0 only, when the timer is expired and not pending */
@@ -817,7 +826,7 @@ SYSCALL_DEFINE1(timer_getoverrun, timer_t, timer_id)
        if (!timr)
                return -EINVAL;
 
-       overrun = timr->it_overrun_last;
+       overrun = timer_overrun_to_int(timr, 0);
        unlock_timer(timr, flags);
 
        return overrun;
diff --git a/kernel/time/timer_list.c b/kernel/time/timer_list.c
index 61ed862cdd37..37d7e4d29e5f 100644
--- a/kernel/time/timer_list.c
+++ b/kernel/time/timer_list.c
@@ -362,7 +362,7 @@ static int __init init_timer_list_procfs(void)
 {
        struct proc_dir_entry *pe;
 
-       pe = proc_create("timer_list", 0444, NULL, &timer_list_fops);
+       pe = proc_create("timer_list", 0400, NULL, &timer_list_fops);
        if (!pe)
                return -ENOMEM;
        return 0;
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index f01d4ecdf5ab..11d860f16a73 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -4496,6 +4496,7 @@ void ftrace_destroy_filter_files(struct ftrace_ops *ops)
        if (ops->flags & FTRACE_OPS_FL_ENABLED)
                ftrace_shutdown(ops, 0);
        ops->flags |= FTRACE_OPS_FL_DELETED;
+       ftrace_free_filter(ops);
        mutex_unlock(&ftrace_lock);
 }
 
diff --git a/kernel/trace/trace_events_trigger.c 
b/kernel/trace/trace_events_trigger.c
index a958d3397a52..909502d8710f 100644
--- a/kernel/trace/trace_events_trigger.c
+++ b/kernel/trace/trace_events_trigger.c
@@ -727,8 +727,10 @@ static int set_trigger_filter(char *filter_str,
 
        /* The filter is for the 'trigger' event, not the triggered event */
        ret = create_event_filter(file->event_call, filter_str, false, &filter);
-       if (ret)
-               goto out;
+       /*
+        * If create_event_filter() fails, filter still needs to be freed.
+        * Which the calling code will do with data->filter.
+        */
  assign:
        tmp = rcu_access_pointer(data->filter);
 
diff --git a/lib/interval_tree_test.c b/lib/interval_tree_test.c
index 245900b98c8e..222c8010bda0 100644
--- a/lib/interval_tree_test.c
+++ b/lib/interval_tree_test.c
@@ -1,27 +1,38 @@
 #include <linux/module.h>
+#include <linux/moduleparam.h>
 #include <linux/interval_tree.h>
 #include <linux/random.h>
+#include <linux/slab.h>
 #include <asm/timex.h>
 
-#define NODES        100
-#define PERF_LOOPS   100000
-#define SEARCHES     100
-#define SEARCH_LOOPS 10000
+#define __param(type, name, init, msg)         \
+       static type name = init;                \
+       module_param(name, type, 0444);         \
+       MODULE_PARM_DESC(name, msg);
+
+__param(int, nnodes, 100, "Number of nodes in the interval tree");
+__param(int, perf_loops, 1000, "Number of iterations modifying the tree");
+
+__param(int, nsearches, 100, "Number of searches to the interval tree");
+__param(int, search_loops, 1000, "Number of iterations searching the tree");
+__param(bool, search_all, false, "Searches will iterate all nodes in the 
tree");
+
+__param(uint, max_endpoint, ~0, "Largest value for the interval's endpoint");
 
 static struct rb_root root = RB_ROOT;
-static struct interval_tree_node nodes[NODES];
-static u32 queries[SEARCHES];
+static struct interval_tree_node *nodes = NULL;
+static u32 *queries = NULL;
 
 static struct rnd_state rnd;
 
 static inline unsigned long
-search(unsigned long query, struct rb_root *root)
+search(struct rb_root *root, unsigned long start, unsigned long last)
 {
        struct interval_tree_node *node;
        unsigned long results = 0;
 
-       for (node = interval_tree_iter_first(root, query, query); node;
-            node = interval_tree_iter_next(node, query, query))
+       for (node = interval_tree_iter_first(root, start, last); node;
+            node = interval_tree_iter_next(node, start, last))
                results++;
        return results;
 }
@@ -29,19 +40,22 @@ search(unsigned long query, struct rb_root *root)
 static void init(void)
 {
        int i;
-       for (i = 0; i < NODES; i++) {
-               u32 a = prandom_u32_state(&rnd);
-               u32 b = prandom_u32_state(&rnd);
-               if (a <= b) {
-                       nodes[i].start = a;
-                       nodes[i].last = b;
-               } else {
-                       nodes[i].start = b;
-                       nodes[i].last = a;
-               }
+
+       for (i = 0; i < nnodes; i++) {
+               u32 b = (prandom_u32_state(&rnd) >> 4) % max_endpoint;
+               u32 a = (prandom_u32_state(&rnd) >> 4) % b;
+
+               nodes[i].start = a;
+               nodes[i].last = b;
        }
-       for (i = 0; i < SEARCHES; i++)
-               queries[i] = prandom_u32_state(&rnd);
+
+       /*
+        * Limit the search scope to what the user defined.
+        * Otherwise we are merely measuring empty walks,
+        * which is pointless.
+        */
+       for (i = 0; i < nsearches; i++)
+               queries[i] = (prandom_u32_state(&rnd) >> 4) % max_endpoint;
 }
 
 static int interval_tree_test_init(void)
@@ -50,6 +64,16 @@ static int interval_tree_test_init(void)
        unsigned long results;
        cycles_t time1, time2, time;
 
+       nodes = kmalloc(nnodes * sizeof(struct interval_tree_node), GFP_KERNEL);
+       if (!nodes)
+               return -ENOMEM;
+
+       queries = kmalloc(nsearches * sizeof(int), GFP_KERNEL);
+       if (!queries) {
+               kfree(nodes);
+               return -ENOMEM;
+       }
+
        printk(KERN_ALERT "interval tree insert/remove");
 
        prandom_seed_state(&rnd, 3141592653589793238ULL);
@@ -57,39 +81,46 @@ static int interval_tree_test_init(void)
 
        time1 = get_cycles();
 
-       for (i = 0; i < PERF_LOOPS; i++) {
-               for (j = 0; j < NODES; j++)
+       for (i = 0; i < perf_loops; i++) {
+               for (j = 0; j < nnodes; j++)
                        interval_tree_insert(nodes + j, &root);
-               for (j = 0; j < NODES; j++)
+               for (j = 0; j < nnodes; j++)
                        interval_tree_remove(nodes + j, &root);
        }
 
        time2 = get_cycles();
        time = time2 - time1;
 
-       time = div_u64(time, PERF_LOOPS);
+       time = div_u64(time, perf_loops);
        printk(" -> %llu cycles\n", (unsigned long long)time);
 
        printk(KERN_ALERT "interval tree search");
 
-       for (j = 0; j < NODES; j++)
+       for (j = 0; j < nnodes; j++)
                interval_tree_insert(nodes + j, &root);
 
        time1 = get_cycles();
 
        results = 0;
-       for (i = 0; i < SEARCH_LOOPS; i++)
-               for (j = 0; j < SEARCHES; j++)
-                       results += search(queries[j], &root);
+       for (i = 0; i < search_loops; i++)
+               for (j = 0; j < nsearches; j++) {
+                       unsigned long start = search_all ? 0 : queries[j];
+                       unsigned long last = search_all ? max_endpoint : 
queries[j];
+
+                       results += search(&root, start, last);
+               }
 
        time2 = get_cycles();
        time = time2 - time1;
 
-       time = div_u64(time, SEARCH_LOOPS);
-       results = div_u64(results, SEARCH_LOOPS);
+       time = div_u64(time, search_loops);
+       results = div_u64(results, search_loops);
        printk(" -> %llu cycles (%lu results)\n",
               (unsigned long long)time, results);
 
+       kfree(queries);
+       kfree(nodes);
+
        return -EAGAIN; /* Fail will directly unload the module */
 }
 
diff --git a/lib/rbtree_test.c b/lib/rbtree_test.c
index 8b3c9dc88262..afedd3770562 100644
--- a/lib/rbtree_test.c
+++ b/lib/rbtree_test.c
@@ -1,11 +1,18 @@
 #include <linux/module.h>
+#include <linux/moduleparam.h>
 #include <linux/rbtree_augmented.h>
 #include <linux/random.h>
+#include <linux/slab.h>
 #include <asm/timex.h>
 
-#define NODES       100
-#define PERF_LOOPS  100000
-#define CHECK_LOOPS 100
+#define __param(type, name, init, msg)         \
+       static type name = init;                \
+       module_param(name, type, 0444);         \
+       MODULE_PARM_DESC(name, msg);
+
+__param(int, nnodes, 100, "Number of nodes in the rb-tree");
+__param(int, perf_loops, 1000, "Number of iterations modifying the rb-tree");
+__param(int, check_loops, 100, "Number of iterations modifying and verifying 
the rb-tree");
 
 struct test_node {
        u32 key;
@@ -17,7 +24,7 @@ struct test_node {
 };
 
 static struct rb_root root = RB_ROOT;
-static struct test_node nodes[NODES];
+static struct test_node *nodes = NULL;
 
 static struct rnd_state rnd;
 
@@ -95,7 +102,7 @@ static void erase_augmented(struct test_node *node, struct 
rb_root *root)
 static void init(void)
 {
        int i;
-       for (i = 0; i < NODES; i++) {
+       for (i = 0; i < nnodes; i++) {
                nodes[i].key = prandom_u32_state(&rnd);
                nodes[i].val = prandom_u32_state(&rnd);
        }
@@ -177,6 +184,10 @@ static int __init rbtree_test_init(void)
        int i, j;
        cycles_t time1, time2, time;
 
+       nodes = kmalloc(nnodes * sizeof(*nodes), GFP_KERNEL);
+       if (!nodes)
+               return -ENOMEM;
+
        printk(KERN_ALERT "rbtree testing");
 
        prandom_seed_state(&rnd, 3141592653589793238ULL);
@@ -184,27 +195,27 @@ static int __init rbtree_test_init(void)
 
        time1 = get_cycles();
 
-       for (i = 0; i < PERF_LOOPS; i++) {
-               for (j = 0; j < NODES; j++)
+       for (i = 0; i < perf_loops; i++) {
+               for (j = 0; j < nnodes; j++)
                        insert(nodes + j, &root);
-               for (j = 0; j < NODES; j++)
+               for (j = 0; j < nnodes; j++)
                        erase(nodes + j, &root);
        }
 
        time2 = get_cycles();
        time = time2 - time1;
 
-       time = div_u64(time, PERF_LOOPS);
+       time = div_u64(time, perf_loops);
        printk(" -> %llu cycles\n", (unsigned long long)time);
 
-       for (i = 0; i < CHECK_LOOPS; i++) {
+       for (i = 0; i < check_loops; i++) {
                init();
-               for (j = 0; j < NODES; j++) {
+               for (j = 0; j < nnodes; j++) {
                        check(j);
                        insert(nodes + j, &root);
                }
-               for (j = 0; j < NODES; j++) {
-                       check(NODES - j);
+               for (j = 0; j < nnodes; j++) {
+                       check(nnodes - j);
                        erase(nodes + j, &root);
                }
                check(0);
@@ -216,32 +227,34 @@ static int __init rbtree_test_init(void)
 
        time1 = get_cycles();
 
-       for (i = 0; i < PERF_LOOPS; i++) {
-               for (j = 0; j < NODES; j++)
+       for (i = 0; i < perf_loops; i++) {
+               for (j = 0; j < nnodes; j++)
                        insert_augmented(nodes + j, &root);
-               for (j = 0; j < NODES; j++)
+               for (j = 0; j < nnodes; j++)
                        erase_augmented(nodes + j, &root);
        }
 
        time2 = get_cycles();
        time = time2 - time1;
 
-       time = div_u64(time, PERF_LOOPS);
+       time = div_u64(time, perf_loops);
        printk(" -> %llu cycles\n", (unsigned long long)time);
 
-       for (i = 0; i < CHECK_LOOPS; i++) {
+       for (i = 0; i < check_loops; i++) {
                init();
-               for (j = 0; j < NODES; j++) {
+               for (j = 0; j < nnodes; j++) {
                        check_augmented(j);
                        insert_augmented(nodes + j, &root);
                }
-               for (j = 0; j < NODES; j++) {
-                       check_augmented(NODES - j);
+               for (j = 0; j < nnodes; j++) {
+                       check_augmented(nnodes - j);
                        erase_augmented(nodes + j, &root);
                }
                check_augmented(0);
        }
 
+       kfree(nodes);
+
        return -EAGAIN; /* Fail will directly unload the module */
 }
 
diff --git a/lib/swiotlb.c b/lib/swiotlb.c
index 4abda074ea45..54179db71ab4 100644
--- a/lib/swiotlb.c
+++ b/lib/swiotlb.c
@@ -17,6 +17,8 @@
  * 08/12/11 beckyb     Add highmem support
  */
 
+#define pr_fmt(fmt) "software IO TLB: " fmt
+
 #include <linux/cache.h>
 #include <linux/dma-mapping.h>
 #include <linux/mm.h>
@@ -143,20 +145,16 @@ static bool no_iotlb_memory;
 void swiotlb_print_info(void)
 {
        unsigned long bytes = io_tlb_nslabs << IO_TLB_SHIFT;
-       unsigned char *vstart, *vend;
 
        if (no_iotlb_memory) {
-               pr_warn("software IO TLB: No low mem\n");
+               pr_warn("No low mem\n");
                return;
        }
 
-       vstart = phys_to_virt(io_tlb_start);
-       vend = phys_to_virt(io_tlb_end);
-
-       printk(KERN_INFO "software IO TLB [mem %#010llx-%#010llx] (%luMB) 
mapped at [%p-%p]\n",
+       pr_info("mapped [mem %#010llx-%#010llx] (%luMB)\n",
               (unsigned long long)io_tlb_start,
               (unsigned long long)io_tlb_end,
-              bytes >> 20, vstart, vend - 1);
+              bytes >> 20);
 }
 
 int __init swiotlb_init_with_tbl(char *tlb, unsigned long nslabs, int verbose)
@@ -230,7 +228,7 @@ swiotlb_init(int verbose)
        if (io_tlb_start)
                memblock_free_early(io_tlb_start,
                                    PAGE_ALIGN(io_tlb_nslabs << IO_TLB_SHIFT));
-       pr_warn("Cannot allocate SWIOTLB buffer");
+       pr_warn("Cannot allocate buffer");
        no_iotlb_memory = true;
 }
 
@@ -272,8 +270,8 @@ swiotlb_late_init_with_default_size(size_t default_size)
                return -ENOMEM;
        }
        if (order != get_order(bytes)) {
-               printk(KERN_WARNING "Warning: only able to allocate %ld MB "
-                      "for software IO TLB\n", (PAGE_SIZE << order) >> 20);
+               pr_warn("only able to allocate %ld MB\n",
+                       (PAGE_SIZE << order) >> 20);
                io_tlb_nslabs = SLABS_PER_PAGE << order;
        }
        rc = swiotlb_late_init_with_tbl(vstart, io_tlb_nslabs);
diff --git a/net/sunrpc/xprt.c b/net/sunrpc/xprt.c
index 56e4e150e80e..dca234b1f77d 100644
--- a/net/sunrpc/xprt.c
+++ b/net/sunrpc/xprt.c
@@ -721,8 +721,15 @@ void xprt_connect(struct rpc_task *task)
                        return;
                if (xprt_test_and_set_connecting(xprt))
                        return;
-               xprt->stat.connect_start = jiffies;
-               xprt->ops->connect(xprt, task);
+               /* Race breaker */
+               if (!xprt_connected(xprt)) {
+                       xprt->stat.connect_start = jiffies;
+                       xprt->ops->connect(xprt, task);
+               } else {
+                       xprt_clear_connecting(xprt);
+                       task->tk_status = 0;
+                       rpc_wake_up_queued_task(&xprt->pending, task);
+               }
        }
 }
 
diff --git a/sound/core/pcm_lib.c b/sound/core/pcm_lib.c
index 25d4d20138fe..e3382fbaf58d 100644
--- a/sound/core/pcm_lib.c
+++ b/sound/core/pcm_lib.c
@@ -1818,8 +1818,6 @@ int snd_pcm_lib_ioctl(struct snd_pcm_substream *substream,
                      unsigned int cmd, void *arg)
 {
        switch (cmd) {
-       case SNDRV_PCM_IOCTL1_INFO:
-               return 0;
        case SNDRV_PCM_IOCTL1_RESET:
                return snd_pcm_lib_ioctl_reset(substream, arg);
        case SNDRV_PCM_IOCTL1_CHANNEL_INFO:
diff --git a/sound/core/pcm_native.c b/sound/core/pcm_native.c
index 7b6139917655..afdb678cc757 100644
--- a/sound/core/pcm_native.c
+++ b/sound/core/pcm_native.c
@@ -216,11 +216,7 @@ int snd_pcm_info(struct snd_pcm_substream *substream, 
struct snd_pcm_info *info)
        info->subdevices_avail = pstr->substream_count - pstr->substream_opened;
        strlcpy(info->subname, substream->name, sizeof(info->subname));
        runtime = substream->runtime;
-       /* AB: FIXME!!! This is definitely nonsense */
-       if (runtime) {
-               info->sync = runtime->sync;
-               substream->ops->ioctl(substream, SNDRV_PCM_IOCTL1_INFO, info);
-       }
+
        return 0;
 }
 
diff --git a/sound/isa/wavefront/wavefront_synth.c 
b/sound/isa/wavefront/wavefront_synth.c
index e5db001363ee..b5fde9fd1ae9 100644
--- a/sound/isa/wavefront/wavefront_synth.c
+++ b/sound/isa/wavefront/wavefront_synth.c
@@ -785,6 +785,9 @@ wavefront_send_patch (snd_wavefront_t *dev, 
wavefront_patch_info *header)
        DPRINT (WF_DEBUG_LOAD_PATCH, "downloading patch %d\n",
                                      header->number);
 
+       if (header->number >= ARRAY_SIZE(dev->patch_status))
+               return -EINVAL;
+
        dev->patch_status[header->number] |= WF_SLOT_FILLED;
 
        bptr = buf;
@@ -809,6 +812,9 @@ wavefront_send_program (snd_wavefront_t *dev, 
wavefront_patch_info *header)
        DPRINT (WF_DEBUG_LOAD_PATCH, "downloading program %d\n",
                header->number);
 
+       if (header->number >= ARRAY_SIZE(dev->prog_status))
+               return -EINVAL;
+
        dev->prog_status[header->number] = WF_SLOT_USED;
 
        /* XXX need to zero existing SLOT_USED bit for program_status[i]
@@ -898,6 +904,9 @@ wavefront_send_sample (snd_wavefront_t *dev,
                header->number = x;
        }
 
+       if (header->number >= WF_MAX_SAMPLE)
+               return -EINVAL;
+
        if (header->size) {
 
                /* XXX it's a debatable point whether or not RDONLY semantics

Reply via email to