[gentoo-commits] linux-patches r2380 - genpatches-2.6/trunk/3.4

[Mike Pagano (mpagano)]

Author: mpagano
Date: 2013-05-19 19:38:03 +0000 (Sun, 19 May 2013)
New Revision: 2380

Added:
   genpatches-2.6/trunk/3.4/1045_linux-3.4.46.patch
Modified:
   genpatches-2.6/trunk/3.4/0000_README
Log:
Linux patch 3.4.46

Modified: genpatches-2.6/trunk/3.4/0000_README
===================================================================
--- genpatches-2.6/trunk/3.4/0000_README	2013-05-19 19:19:44 UTC (rev 2379)
+++ genpatches-2.6/trunk/3.4/0000_README	2013-05-19 19:38:03 UTC (rev 2380)
@@ -219,6 +219,10 @@
 From:   http://www.kernel.org
 Desc:   Linux 3.4.45
 
+Patch:  1045_linux-3.4.46.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.4.46
+
 Patch:  1700_correct-bnx2-firware-ver-mips.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=424609
 Desc:   Correct firmware version for bnx2 on mips

Added: genpatches-2.6/trunk/3.4/1045_linux-3.4.46.patch
===================================================================
--- genpatches-2.6/trunk/3.4/1045_linux-3.4.46.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.4/1045_linux-3.4.46.patch	2013-05-19 19:38:03 UTC (rev 2380)
@@ -0,0 +1,1875 @@
+diff --git a/Makefile b/Makefile
+index 0ec4a35..3d88eb8 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 4
+-SUBLEVEL = 45
++SUBLEVEL = 46
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+ 
+diff --git a/arch/arm/mach-omap2/board-rx51-peripherals.c b/arch/arm/mach-omap2/board-rx51-peripherals.c
+index d87ee06..283a8d0 100644
+--- a/arch/arm/mach-omap2/board-rx51-peripherals.c
++++ b/arch/arm/mach-omap2/board-rx51-peripherals.c
+@@ -63,11 +63,11 @@
+ #define RX51_TSC2005_RESET_GPIO         104
+ #define RX51_TSC2005_IRQ_GPIO           100
+ 
+-/* list all spi devices here */
++/* List all SPI devices here. Note that the list/probe order seems to matter! */
+ enum {
+ 	RX51_SPI_WL1251,
+-	RX51_SPI_MIPID,		/* LCD panel */
+ 	RX51_SPI_TSC2005,	/* Touch Controller */
++	RX51_SPI_MIPID,		/* LCD panel */
+ };
+ 
+ static struct wl12xx_platform_data wl1251_pdata;
+diff --git a/arch/powerpc/include/asm/rtas.h b/arch/powerpc/include/asm/rtas.h
+index 557cff8..5e7e008 100644
+--- a/arch/powerpc/include/asm/rtas.h
++++ b/arch/powerpc/include/asm/rtas.h
+@@ -262,6 +262,8 @@ extern void rtas_progress(char *s, unsigned short hex);
+ extern void rtas_initialize(void);
+ extern int rtas_suspend_cpu(struct rtas_suspend_me_data *data);
+ extern int rtas_suspend_last_cpu(struct rtas_suspend_me_data *data);
++extern int rtas_online_cpus_mask(cpumask_var_t cpus);
++extern int rtas_offline_cpus_mask(cpumask_var_t cpus);
+ extern int rtas_ibm_suspend_me(struct rtas_args *);
+ 
+ struct rtc_time;
+diff --git a/arch/powerpc/kernel/rtas.c b/arch/powerpc/kernel/rtas.c
+index fcec382..225e9f2 100644
+--- a/arch/powerpc/kernel/rtas.c
++++ b/arch/powerpc/kernel/rtas.c
+@@ -19,6 +19,7 @@
+ #include <linux/init.h>
+ #include <linux/capability.h>
+ #include <linux/delay.h>
++#include <linux/cpu.h>
+ #include <linux/smp.h>
+ #include <linux/completion.h>
+ #include <linux/cpumask.h>
+@@ -808,6 +809,95 @@ static void rtas_percpu_suspend_me(void *info)
+ 	__rtas_suspend_cpu((struct rtas_suspend_me_data *)info, 1);
+ }
+ 
++enum rtas_cpu_state {
++	DOWN,
++	UP,
++};
++
++#ifndef CONFIG_SMP
++static int rtas_cpu_state_change_mask(enum rtas_cpu_state state,
++				cpumask_var_t cpus)
++{
++	if (!cpumask_empty(cpus)) {
++		cpumask_clear(cpus);
++		return -EINVAL;
++	} else
++		return 0;
++}
++#else
++/* On return cpumask will be altered to indicate CPUs changed.
++ * CPUs with states changed will be set in the mask,
++ * CPUs with status unchanged will be unset in the mask. */
++static int rtas_cpu_state_change_mask(enum rtas_cpu_state state,
++				cpumask_var_t cpus)
++{
++	int cpu;
++	int cpuret = 0;
++	int ret = 0;
++
++	if (cpumask_empty(cpus))
++		return 0;
++
++	for_each_cpu(cpu, cpus) {
++		switch (state) {
++		case DOWN:
++			cpuret = cpu_down(cpu);
++			break;
++		case UP:
++			cpuret = cpu_up(cpu);
++			break;
++		}
++		if (cpuret) {
++			pr_debug("%s: cpu_%s for cpu#%d returned %d.\n",
++					__func__,
++					((state == UP) ? "up" : "down"),
++					cpu, cpuret);
++			if (!ret)
++				ret = cpuret;
++			if (state == UP) {
++				/* clear bits for unchanged cpus, return */
++				cpumask_shift_right(cpus, cpus, cpu);
++				cpumask_shift_left(cpus, cpus, cpu);
++				break;
++			} else {
++				/* clear bit for unchanged cpu, continue */
++				cpumask_clear_cpu(cpu, cpus);
++			}
++		}
++	}
++
++	return ret;
++}
++#endif
++
++int rtas_online_cpus_mask(cpumask_var_t cpus)
++{
++	int ret;
++
++	ret = rtas_cpu_state_change_mask(UP, cpus);
++
++	if (ret) {
++		cpumask_var_t tmp_mask;
++
++		if (!alloc_cpumask_var(&tmp_mask, GFP_TEMPORARY))
++			return ret;
++
++		/* Use tmp_mask to preserve cpus mask from first failure */
++		cpumask_copy(tmp_mask, cpus);
++		rtas_offline_cpus_mask(tmp_mask);
++		free_cpumask_var(tmp_mask);
++	}
++
++	return ret;
++}
++EXPORT_SYMBOL(rtas_online_cpus_mask);
++
++int rtas_offline_cpus_mask(cpumask_var_t cpus)
++{
++	return rtas_cpu_state_change_mask(DOWN, cpus);
++}
++EXPORT_SYMBOL(rtas_offline_cpus_mask);
++
+ int rtas_ibm_suspend_me(struct rtas_args *args)
+ {
+ 	long state;
+@@ -815,6 +905,8 @@ int rtas_ibm_suspend_me(struct rtas_args *args)
+ 	unsigned long retbuf[PLPAR_HCALL_BUFSIZE];
+ 	struct rtas_suspend_me_data data;
+ 	DECLARE_COMPLETION_ONSTACK(done);
++	cpumask_var_t offline_mask;
++	int cpuret;
+ 
+ 	if (!rtas_service_present("ibm,suspend-me"))
+ 		return -ENOSYS;
+@@ -838,11 +930,24 @@ int rtas_ibm_suspend_me(struct rtas_args *args)
+ 		return 0;
+ 	}
+ 
++	if (!alloc_cpumask_var(&offline_mask, GFP_TEMPORARY))
++		return -ENOMEM;
++
+ 	atomic_set(&data.working, 0);
+ 	atomic_set(&data.done, 0);
+ 	atomic_set(&data.error, 0);
+ 	data.token = rtas_token("ibm,suspend-me");
+ 	data.complete = &done;
++
++	/* All present CPUs must be online */
++	cpumask_andnot(offline_mask, cpu_present_mask, cpu_online_mask);
++	cpuret = rtas_online_cpus_mask(offline_mask);
++	if (cpuret) {
++		pr_err("%s: Could not bring present CPUs online.\n", __func__);
++		atomic_set(&data.error, cpuret);
++		goto out;
++	}
++
+ 	stop_topology_update();
+ 
+ 	/* Call function on all CPUs.  One of us will make the
+@@ -858,6 +963,14 @@ int rtas_ibm_suspend_me(struct rtas_args *args)
+ 
+ 	start_topology_update();
+ 
++	/* Take down CPUs not online prior to suspend */
++	cpuret = rtas_offline_cpus_mask(offline_mask);
++	if (cpuret)
++		pr_warn("%s: Could not restore CPUs to offline state.\n",
++				__func__);
++
++out:
++	free_cpumask_var(offline_mask);
+ 	return atomic_read(&data.error);
+ }
+ #else /* CONFIG_PPC_PSERIES */
+diff --git a/arch/powerpc/platforms/pseries/suspend.c b/arch/powerpc/platforms/pseries/suspend.c
+index 47226e0..5f997e7 100644
+--- a/arch/powerpc/platforms/pseries/suspend.c
++++ b/arch/powerpc/platforms/pseries/suspend.c
+@@ -16,6 +16,7 @@
+   * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307 USA
+   */
+ 
++#include <linux/cpu.h>
+ #include <linux/delay.h>
+ #include <linux/suspend.h>
+ #include <linux/stat.h>
+@@ -126,11 +127,15 @@ static ssize_t store_hibernate(struct device *dev,
+ 			       struct device_attribute *attr,
+ 			       const char *buf, size_t count)
+ {
++	cpumask_var_t offline_mask;
+ 	int rc;
+ 
+ 	if (!capable(CAP_SYS_ADMIN))
+ 		return -EPERM;
+ 
++	if (!alloc_cpumask_var(&offline_mask, GFP_TEMPORARY))
++		return -ENOMEM;
++
+ 	stream_id = simple_strtoul(buf, NULL, 16);
+ 
+ 	do {
+@@ -140,15 +145,32 @@ static ssize_t store_hibernate(struct device *dev,
+ 	} while (rc == -EAGAIN);
+ 
+ 	if (!rc) {
++		/* All present CPUs must be online */
++		cpumask_andnot(offline_mask, cpu_present_mask,
++				cpu_online_mask);
++		rc = rtas_online_cpus_mask(offline_mask);
++		if (rc) {
++			pr_err("%s: Could not bring present CPUs online.\n",
++					__func__);
++			goto out;
++		}
++
+ 		stop_topology_update();
+ 		rc = pm_suspend(PM_SUSPEND_MEM);
+ 		start_topology_update();
++
++		/* Take down CPUs not online prior to suspend */
++		if (!rtas_offline_cpus_mask(offline_mask))
++			pr_warn("%s: Could not restore CPUs to offline "
++					"state.\n", __func__);
+ 	}
+ 
+ 	stream_id = 0;
+ 
+ 	if (!rc)
+ 		rc = count;
++out:
++	free_cpumask_var(offline_mask);
+ 	return rc;
+ }
+ 
+diff --git a/arch/x86/kvm/vmx.c b/arch/x86/kvm/vmx.c
+index 4ff0ab9..90f5c0e 100644
+--- a/arch/x86/kvm/vmx.c
++++ b/arch/x86/kvm/vmx.c
+@@ -4889,6 +4889,12 @@ static int handle_invalid_guest_state(struct kvm_vcpu *vcpu)
+ 		if (err != EMULATE_DONE)
+ 			return 0;
+ 
++		if (vcpu->arch.halt_request) {
++			vcpu->arch.halt_request = 0;
++			ret = kvm_emulate_halt(vcpu);
++			goto out;
++		}
++
+ 		if (signal_pending(current))
+ 			goto out;
+ 		if (need_resched())
+diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
+index 2992678..a7678fa 100644
+--- a/arch/x86/xen/enlighten.c
++++ b/arch/x86/xen/enlighten.c
+@@ -139,6 +139,21 @@ static void xen_vcpu_setup(int cpu)
+ 
+ 	BUG_ON(HYPERVISOR_shared_info == &xen_dummy_shared_info);
+ 
++	/*
++	 * This path is called twice on PVHVM - first during bootup via
++	 * smp_init -> xen_hvm_cpu_notify, and then if the VCPU is being
++	 * hotplugged: cpu_up -> xen_hvm_cpu_notify.
++	 * As we can only do the VCPUOP_register_vcpu_info once lets
++	 * not over-write its result.
++	 *
++	 * For PV it is called during restore (xen_vcpu_restore) and bootup
++	 * (xen_setup_vcpu_info_placement). The hotplug mechanism does not
++	 * use this function.
++	 */
++	if (xen_hvm_domain()) {
++		if (per_cpu(xen_vcpu, cpu) == &per_cpu(xen_vcpu_info, cpu))
++			return;
++	}
+ 	if (cpu < MAX_VIRT_CPUS)
+ 		per_cpu(xen_vcpu,cpu) = &HYPERVISOR_shared_info->vcpu_info[cpu];
+ 
+diff --git a/drivers/acpi/acpica/exfldio.c b/drivers/acpi/acpica/exfldio.c
+index 149de45..af9f1f6 100644
+--- a/drivers/acpi/acpica/exfldio.c
++++ b/drivers/acpi/acpica/exfldio.c
+@@ -722,7 +722,19 @@ acpi_ex_extract_from_field(union acpi_operand_object *obj_desc,
+ 
+ 	if ((obj_desc->common_field.start_field_bit_offset == 0) &&
+ 	    (obj_desc->common_field.bit_length == access_bit_width)) {
+-		status = acpi_ex_field_datum_io(obj_desc, 0, buffer, ACPI_READ);
++		if (buffer_length >= sizeof(u64)) {
++			status =
++			    acpi_ex_field_datum_io(obj_desc, 0, buffer,
++						   ACPI_READ);
++		} else {
++			/* Use raw_datum (u64) to handle buffers < 64 bits */
++
++			status =
++			    acpi_ex_field_datum_io(obj_desc, 0, &raw_datum,
++						   ACPI_READ);
++			ACPI_MEMCPY(buffer, &raw_datum, buffer_length);
++		}
++
+ 		return_ACPI_STATUS(status);
+ 	}
+ 
+diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
+index a51df96..f9914e5 100644
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -217,7 +217,7 @@ static int ec_check_sci_sync(struct acpi_ec *ec, u8 state)
+ static int ec_poll(struct acpi_ec *ec)
+ {
+ 	unsigned long flags;
+-	int repeat = 2; /* number of command restarts */
++	int repeat = 5; /* number of command restarts */
+ 	while (repeat--) {
+ 		unsigned long delay = jiffies +
+ 			msecs_to_jiffies(ec_delay);
+@@ -235,8 +235,6 @@ static int ec_poll(struct acpi_ec *ec)
+ 			}
+ 			advance_transaction(ec, acpi_ec_read_status(ec));
+ 		} while (time_before(jiffies, delay));
+-		if (acpi_ec_read_status(ec) & ACPI_EC_FLAG_IBF)
+-			break;
+ 		pr_debug(PREFIX "controller reset, restart transaction\n");
+ 		spin_lock_irqsave(&ec->curr_lock, flags);
+ 		start_transaction(ec);
+diff --git a/drivers/block/drbd/drbd_receiver.c b/drivers/block/drbd/drbd_receiver.c
+index 43beaca..13cbdd3 100644
+--- a/drivers/block/drbd/drbd_receiver.c
++++ b/drivers/block/drbd/drbd_receiver.c
+@@ -2225,7 +2225,6 @@ static int drbd_asb_recover_1p(struct drbd_conf *mdev) __must_hold(local)
+ 		if (hg == -1 && mdev->state.role == R_PRIMARY) {
+ 			enum drbd_state_rv rv2;
+ 
+-			drbd_set_role(mdev, R_SECONDARY, 0);
+ 			 /* drbd_change_state() does not sleep while in SS_IN_TRANSIENT_STATE,
+ 			  * we might be here in C_WF_REPORT_PARAMS which is transient.
+ 			  * we do not need to wait for the after state change work either. */
+diff --git a/drivers/char/ipmi/ipmi_bt_sm.c b/drivers/char/ipmi/ipmi_bt_sm.c
+index cdd4c09f..a22a7a5 100644
+--- a/drivers/char/ipmi/ipmi_bt_sm.c
++++ b/drivers/char/ipmi/ipmi_bt_sm.c
+@@ -95,9 +95,9 @@ struct si_sm_data {
+ 	enum bt_states	state;
+ 	unsigned char	seq;		/* BT sequence number */
+ 	struct si_sm_io	*io;
+-	unsigned char	write_data[IPMI_MAX_MSG_LENGTH];
++	unsigned char	write_data[IPMI_MAX_MSG_LENGTH + 2]; /* +2 for memcpy */
+ 	int		write_count;
+-	unsigned char	read_data[IPMI_MAX_MSG_LENGTH];
++	unsigned char	read_data[IPMI_MAX_MSG_LENGTH + 2]; /* +2 for memcpy */
+ 	int		read_count;
+ 	int		truncated;
+ 	long		timeout;	/* microseconds countdown */
+diff --git a/drivers/char/ipmi/ipmi_devintf.c b/drivers/char/ipmi/ipmi_devintf.c
+index 9eb360f..d5a5f02 100644
+--- a/drivers/char/ipmi/ipmi_devintf.c
++++ b/drivers/char/ipmi/ipmi_devintf.c
+@@ -837,13 +837,25 @@ static long compat_ipmi_ioctl(struct file *filep, unsigned int cmd,
+ 		return ipmi_ioctl(filep, cmd, arg);
+ 	}
+ }
++
++static long unlocked_compat_ipmi_ioctl(struct file *filep, unsigned int cmd,
++				       unsigned long arg)
++{
++	int ret;
++
++	mutex_lock(&ipmi_mutex);
++	ret = compat_ipmi_ioctl(filep, cmd, arg);
++	mutex_unlock(&ipmi_mutex);
++
++	return ret;
++}
+ #endif
+ 
+ static const struct file_operations ipmi_fops = {
+ 	.owner		= THIS_MODULE,
+ 	.unlocked_ioctl	= ipmi_unlocked_ioctl,
+ #ifdef CONFIG_COMPAT
+-	.compat_ioctl   = compat_ipmi_ioctl,
++	.compat_ioctl   = unlocked_compat_ipmi_ioctl,
+ #endif
+ 	.open		= ipmi_open,
+ 	.release	= ipmi_release,
+diff --git a/drivers/dma/pch_dma.c b/drivers/dma/pch_dma.c
+index 65c0495..d05669b 100644
+--- a/drivers/dma/pch_dma.c
++++ b/drivers/dma/pch_dma.c
+@@ -476,7 +476,7 @@ static struct pch_dma_desc *pdc_desc_get(struct pch_dma_chan *pd_chan)
+ 	dev_dbg(chan2dev(&pd_chan->chan), "scanned %d descriptors\n", i);
+ 
+ 	if (!ret) {
+-		ret = pdc_alloc_desc(&pd_chan->chan, GFP_NOIO);
++		ret = pdc_alloc_desc(&pd_chan->chan, GFP_ATOMIC);
+ 		if (ret) {
+ 			spin_lock(&pd_chan->lock);
+ 			pd_chan->descs_allocated++;
+diff --git a/drivers/gpu/drm/drm_mm.c b/drivers/gpu/drm/drm_mm.c
+index 961fb54..7f88de6 100644
+--- a/drivers/gpu/drm/drm_mm.c
++++ b/drivers/gpu/drm/drm_mm.c
+@@ -680,33 +680,35 @@ void drm_mm_debug_table(struct drm_mm *mm, const char *prefix)
+ EXPORT_SYMBOL(drm_mm_debug_table);
+ 
+ #if defined(CONFIG_DEBUG_FS)
+-int drm_mm_dump_table(struct seq_file *m, struct drm_mm *mm)
++static unsigned long drm_mm_dump_hole(struct seq_file *m, struct drm_mm_node *entry)
+ {
+-	struct drm_mm_node *entry;
+-	unsigned long total_used = 0, total_free = 0, total = 0;
+ 	unsigned long hole_start, hole_end, hole_size;
+ 
+-	hole_start = drm_mm_hole_node_start(&mm->head_node);
+-	hole_end = drm_mm_hole_node_end(&mm->head_node);
+-	hole_size = hole_end - hole_start;
+-	if (hole_size)
++	if (entry->hole_follows) {
++		hole_start = drm_mm_hole_node_start(entry);
++		hole_end = drm_mm_hole_node_end(entry);
++		hole_size = hole_end - hole_start;
+ 		seq_printf(m, "0x%08lx-0x%08lx: 0x%08lx: free\n",
+ 				hole_start, hole_end, hole_size);
+-	total_free += hole_size;
++		return hole_size;
++	}
++
++	return 0;
++}
++
++int drm_mm_dump_table(struct seq_file *m, struct drm_mm *mm)
++{
++	struct drm_mm_node *entry;
++	unsigned long total_used = 0, total_free = 0, total = 0;
++
++	total_free += drm_mm_dump_hole(m, &mm->head_node);
+ 
+ 	drm_mm_for_each_node(entry, mm) {
+ 		seq_printf(m, "0x%08lx-0x%08lx: 0x%08lx: used\n",
+ 				entry->start, entry->start + entry->size,
+ 				entry->size);
+ 		total_used += entry->size;
+-		if (entry->hole_follows) {
+-			hole_start = drm_mm_hole_node_start(entry);
+-			hole_end = drm_mm_hole_node_end(entry);
+-			hole_size = hole_end - hole_start;
+-			seq_printf(m, "0x%08lx-0x%08lx: 0x%08lx: free\n",
+-					hole_start, hole_end, hole_size);
+-			total_free += hole_size;
+-		}
++		total_free += drm_mm_dump_hole(m, entry);
+ 	}
+ 	total = total_free + total_used;
+ 
+diff --git a/drivers/gpu/drm/radeon/r300_cmdbuf.c b/drivers/gpu/drm/radeon/r300_cmdbuf.c
+index 1fe98b4..9aa02be 100644
+--- a/drivers/gpu/drm/radeon/r300_cmdbuf.c
++++ b/drivers/gpu/drm/radeon/r300_cmdbuf.c
+@@ -74,7 +74,7 @@ static int r300_emit_cliprects(drm_radeon_private_t *dev_priv,
+ 		OUT_RING(CP_PACKET0(R300_RE_CLIPRECT_TL_0, nr * 2 - 1));
+ 
+ 		for (i = 0; i < nr; ++i) {
+-			if (DRM_COPY_FROM_USER_UNCHECKED
++			if (DRM_COPY_FROM_USER
+ 			    (&box, &cmdbuf->boxes[n + i], sizeof(box))) {
+ 				DRM_ERROR("copy cliprect faulted\n");
+ 				return -EFAULT;
+diff --git a/drivers/md/dm-snap.c b/drivers/md/dm-snap.c
+index 6f75887..ff62ddc 100644
+--- a/drivers/md/dm-snap.c
++++ b/drivers/md/dm-snap.c
+@@ -1117,6 +1117,7 @@ static int snapshot_ctr(struct dm_target *ti, unsigned int argc, char **argv)
+ 	s->pending_pool = mempool_create_slab_pool(MIN_IOS, pending_cache);
+ 	if (!s->pending_pool) {
+ 		ti->error = "Could not allocate mempool for pending exceptions";
++		r = -ENOMEM;
+ 		goto bad_pending_pool;
+ 	}
+ 
+diff --git a/drivers/md/dm-thin.c b/drivers/md/dm-thin.c
+index 1555f0b..7c3ab8f 100644
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -2027,6 +2027,7 @@ static int pool_ctr(struct dm_target *ti, unsigned argc, char **argv)
+ 		 * thin devices' discard limits consistent).
+ 		 */
+ 		ti->discards_supported = 1;
++		ti->discard_zeroes_data_unsupported = 1;
+ 	}
+ 	ti->private = pt;
+ 
+@@ -2443,7 +2444,6 @@ static void set_discard_limits(struct pool *pool, struct queue_limits *limits)
+ 	 * bios that overlap 2 blocks.
+ 	 */
+ 	limits->discard_granularity = pool->sectors_per_block << SECTOR_SHIFT;
+-	limits->discard_zeroes_data = pool->pf.zero_new_blocks;
+ }
+ 
+ static void pool_io_hints(struct dm_target *ti, struct queue_limits *limits)
+diff --git a/drivers/net/ethernet/3com/3c509.c b/drivers/net/ethernet/3com/3c509.c
+index 41719da..9040a62 100644
+--- a/drivers/net/ethernet/3com/3c509.c
++++ b/drivers/net/ethernet/3com/3c509.c
+@@ -309,6 +309,7 @@ static int __devinit el3_isa_match(struct device *pdev,
+ 	if (!dev)
+ 		return -ENOMEM;
+ 
++	SET_NETDEV_DEV(dev, pdev);
+ 	netdev_boot_setup_check(dev);
+ 
+ 	if (!request_region(ioaddr, EL3_IO_EXTENT, "3c509-isa")) {
+@@ -704,6 +705,7 @@ static int __init el3_eisa_probe (struct device *device)
+ 		return -ENOMEM;
+ 	}
+ 
++	SET_NETDEV_DEV(dev, device);
+ 	netdev_boot_setup_check(dev);
+ 
+ 	el3_dev_fill(dev, phys_addr, ioaddr, irq, if_port, EL3_EISA);
+diff --git a/drivers/net/ethernet/3com/3c59x.c b/drivers/net/ethernet/3com/3c59x.c
+index e463d10..5673d6e 100644
+--- a/drivers/net/ethernet/3com/3c59x.c
++++ b/drivers/net/ethernet/3com/3c59x.c
+@@ -632,7 +632,6 @@ struct vortex_private {
+ 		pm_state_valid:1,				/* pci_dev->saved_config_space has sane contents */
+ 		open:1,
+ 		medialock:1,
+-		must_free_region:1,				/* Flag: if zero, Cardbus owns the I/O region */
+ 		large_frames:1,			/* accept large frames */
+ 		handling_irq:1;			/* private in_irq indicator */
+ 	/* {get|set}_wol operations are already serialized by rtnl.
+@@ -951,7 +950,7 @@ static int __devexit vortex_eisa_remove(struct device *device)
+ 
+ 	unregister_netdev(dev);
+ 	iowrite16(TotalReset|0x14, ioaddr + EL3_CMD);
+-	release_region(dev->base_addr, VORTEX_TOTAL_SIZE);
++	release_region(edev->base_addr, VORTEX_TOTAL_SIZE);
+ 
+ 	free_netdev(dev);
+ 	return 0;
+@@ -1012,6 +1011,12 @@ static int __devinit vortex_init_one(struct pci_dev *pdev,
+ 	if (rc < 0)
+ 		goto out;
+ 
++	rc = pci_request_regions(pdev, DRV_NAME);
++	if (rc < 0) {
++		pci_disable_device(pdev);
++		goto out;
++	}
++
+ 	unit = vortex_cards_found;
+ 
+ 	if (global_use_mmio < 0 && (unit >= MAX_UNITS || use_mmio[unit] < 0)) {
+@@ -1027,6 +1032,7 @@ static int __devinit vortex_init_one(struct pci_dev *pdev,
+ 	if (!ioaddr) /* If mapping fails, fall-back to BAR 0... */
+ 		ioaddr = pci_iomap(pdev, 0, 0);
+ 	if (!ioaddr) {
++		pci_release_regions(pdev);
+ 		pci_disable_device(pdev);
+ 		rc = -ENOMEM;
+ 		goto out;
+@@ -1036,6 +1042,7 @@ static int __devinit vortex_init_one(struct pci_dev *pdev,
+ 			   ent->driver_data, unit);
+ 	if (rc < 0) {
+ 		pci_iounmap(pdev, ioaddr);
++		pci_release_regions(pdev);
+ 		pci_disable_device(pdev);
+ 		goto out;
+ 	}
+@@ -1179,11 +1186,6 @@ static int __devinit vortex_probe1(struct device *gendev,
+ 
+ 	/* PCI-only startup logic */
+ 	if (pdev) {
+-		/* EISA resources already marked, so only PCI needs to do this here */
+-		/* Ignore return value, because Cardbus drivers already allocate for us */
+-		if (request_region(dev->base_addr, vci->io_size, print_name) != NULL)
+-			vp->must_free_region = 1;
+-
+ 		/* enable bus-mastering if necessary */
+ 		if (vci->flags & PCI_USES_MASTER)
+ 			pci_set_master(pdev);
+@@ -1221,7 +1223,7 @@ static int __devinit vortex_probe1(struct device *gendev,
+ 					   &vp->rx_ring_dma);
+ 	retval = -ENOMEM;
+ 	if (!vp->rx_ring)
+-		goto free_region;
++		goto free_device;
+ 
+ 	vp->tx_ring = (struct boom_tx_desc *)(vp->rx_ring + RX_RING_SIZE);
+ 	vp->tx_ring_dma = vp->rx_ring_dma + sizeof(struct boom_rx_desc) * RX_RING_SIZE;
+@@ -1486,9 +1488,7 @@ free_ring:
+ 							+ sizeof(struct boom_tx_desc) * TX_RING_SIZE,
+ 						vp->rx_ring,
+ 						vp->rx_ring_dma);
+-free_region:
+-	if (vp->must_free_region)
+-		release_region(dev->base_addr, vci->io_size);
++free_device:
+ 	free_netdev(dev);
+ 	pr_err(PFX "vortex_probe1 fails.  Returns %d\n", retval);
+ out:
+@@ -3256,8 +3256,9 @@ static void __devexit vortex_remove_one(struct pci_dev *pdev)
+ 							+ sizeof(struct boom_tx_desc) * TX_RING_SIZE,
+ 						vp->rx_ring,
+ 						vp->rx_ring_dma);
+-	if (vp->must_free_region)
+-		release_region(dev->base_addr, vp->io_size);
++
++	pci_release_regions(pdev);
++
+ 	free_netdev(dev);
+ }
+ 
+diff --git a/drivers/net/ethernet/realtek/r8169.c b/drivers/net/ethernet/realtek/r8169.c
+index dd037dd..cf20388 100644
+--- a/drivers/net/ethernet/realtek/r8169.c
++++ b/drivers/net/ethernet/realtek/r8169.c
+@@ -1690,8 +1690,6 @@ static void rtl8169_rx_vlan_tag(struct RxDesc *desc, struct sk_buff *skb)
+ 
+ 	if (opts2 & RxVlanTag)
+ 		__vlan_hwaccel_put_tag(skb, swab16(opts2 & 0xffff));
+-
+-	desc->opts2 = 0;
+ }
+ 
+ static int rtl8169_gset_tbi(struct net_device *dev, struct ethtool_cmd *cmd)
+@@ -5434,8 +5432,6 @@ static int rtl_rx(struct net_device *dev, struct rtl8169_private *tp, u32 budget
+ 			    !(status & (RxRWT | RxFOVF)) &&
+ 			    (dev->features & NETIF_F_RXALL))
+ 				goto process_pkt;
+-
+-			rtl8169_mark_to_asic(desc, rx_buf_sz);
+ 		} else {
+ 			struct sk_buff *skb;
+ 			dma_addr_t addr;
+@@ -5456,16 +5452,14 @@ process_pkt:
+ 			if (unlikely(rtl8169_fragmented_frame(status))) {
+ 				dev->stats.rx_dropped++;
+ 				dev->stats.rx_length_errors++;
+-				rtl8169_mark_to_asic(desc, rx_buf_sz);
+-				continue;
++				goto release_descriptor;
+ 			}
+ 
+ 			skb = rtl8169_try_rx_copy(tp->Rx_databuff[entry],
+ 						  tp, pkt_size, addr);
+-			rtl8169_mark_to_asic(desc, rx_buf_sz);
+ 			if (!skb) {
+ 				dev->stats.rx_dropped++;
+-				continue;
++				goto release_descriptor;
+ 			}
+ 
+ 			rtl8169_rx_csum(skb, status);
+@@ -5481,6 +5475,10 @@ process_pkt:
+ 			tp->rx_stats.bytes += pkt_size;
+ 			u64_stats_update_end(&tp->rx_stats.syncp);
+ 		}
++release_descriptor:
++		desc->opts2 = 0;
++		wmb();
++		rtl8169_mark_to_asic(desc, rx_buf_sz);
+ 	}
+ 
+ 	count = cur_rx - tp->cur_rx;
+diff --git a/drivers/net/ethernet/sfc/mcdi.c b/drivers/net/ethernet/sfc/mcdi.c
+index eb85217..192026f 100644
+--- a/drivers/net/ethernet/sfc/mcdi.c
++++ b/drivers/net/ethernet/sfc/mcdi.c
+@@ -640,7 +640,7 @@ fail:
+ int efx_mcdi_get_board_cfg(struct efx_nic *efx, u8 *mac_address,
+ 			   u16 *fw_subtype_list, u32 *capabilities)
+ {
+-	uint8_t outbuf[MC_CMD_GET_BOARD_CFG_OUT_LENMIN];
++	uint8_t outbuf[MC_CMD_GET_BOARD_CFG_OUT_LENMAX];
+ 	size_t outlen, offset, i;
+ 	int port_num = efx_port_num(efx);
+ 	int rc;
+diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
+index 956a5ed..7160523 100644
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -205,7 +205,8 @@ static rx_handler_result_t macvlan_handle_frame(struct sk_buff **pskb)
+ 	}
+ 
+ 	if (port->passthru)
+-		vlan = list_first_entry(&port->vlans, struct macvlan_dev, list);
++		vlan = list_first_or_null_rcu(&port->vlans,
++					      struct macvlan_dev, list);
+ 	else
+ 		vlan = macvlan_hash_lookup(port, eth->h_dest);
+ 	if (vlan == NULL)
+@@ -724,7 +725,7 @@ int macvlan_common_newlink(struct net *src_net, struct net_device *dev,
+ 	if (err < 0)
+ 		goto destroy_port;
+ 
+-	list_add_tail(&vlan->list, &port->vlans);
++	list_add_tail_rcu(&vlan->list, &port->vlans);
+ 	netif_stacked_transfer_operstate(lowerdev, dev);
+ 
+ 	return 0;
+@@ -750,7 +751,7 @@ void macvlan_dellink(struct net_device *dev, struct list_head *head)
+ {
+ 	struct macvlan_dev *vlan = netdev_priv(dev);
+ 
+-	list_del(&vlan->list);
++	list_del_rcu(&vlan->list);
+ 	unregister_netdevice_queue(dev, head);
+ }
+ EXPORT_SYMBOL_GPL(macvlan_dellink);
+diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
+index 8669c77..3b6e932 100644
+--- a/drivers/net/usb/qmi_wwan.c
++++ b/drivers/net/usb/qmi_wwan.c
+@@ -9,6 +9,7 @@
+ #include <linux/module.h>
+ #include <linux/netdevice.h>
+ #include <linux/ethtool.h>
++#include <linux/etherdevice.h>
+ #include <linux/mii.h>
+ #include <linux/usb.h>
+ #include <linux/usb/cdc.h>
+@@ -174,6 +175,93 @@ err:
+ 	return status;
+ }
+ 
++/* default ethernet address used by the modem */
++static const u8 default_modem_addr[ETH_ALEN] = {0x02, 0x50, 0xf3};
++
++/* Make up an ethernet header if the packet doesn't have one.
++ *
++ * A firmware bug common among several devices cause them to send raw
++ * IP packets under some circumstances.  There is no way for the
++ * driver/host to know when this will happen.  And even when the bug
++ * hits, some packets will still arrive with an intact header.
++ *
++ * The supported devices are only capably of sending IPv4, IPv6 and
++ * ARP packets on a point-to-point link. Any packet with an ethernet
++ * header will have either our address or a broadcast/multicast
++ * address as destination.  ARP packets will always have a header.
++ *
++ * This means that this function will reliably add the appropriate
++ * header iff necessary, provided our hardware address does not start
++ * with 4 or 6.
++ *
++ * Another common firmware bug results in all packets being addressed
++ * to 00:a0:c6:00:00:00 despite the host address being different.
++ * This function will also fixup such packets.
++ */
++static int qmi_wwan_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
++{
++	__be16 proto;
++
++	/* usbnet rx_complete guarantees that skb->len is at least
++	 * hard_header_len, so we can inspect the dest address without
++	 * checking skb->len
++	 */
++	switch (skb->data[0] & 0xf0) {
++	case 0x40:
++		proto = htons(ETH_P_IP);
++		break;
++	case 0x60:
++		proto = htons(ETH_P_IPV6);
++		break;
++	case 0x00:
++		if (is_multicast_ether_addr(skb->data))
++			return 1;
++		/* possibly bogus destination - rewrite just in case */
++		skb_reset_mac_header(skb);
++		goto fix_dest;
++	default:
++		/* pass along other packets without modifications */
++		return 1;
++	}
++	if (skb_headroom(skb) < ETH_HLEN)
++		return 0;
++	skb_push(skb, ETH_HLEN);
++	skb_reset_mac_header(skb);
++	eth_hdr(skb)->h_proto = proto;
++	memset(eth_hdr(skb)->h_source, 0, ETH_ALEN);
++fix_dest:
++	memcpy(eth_hdr(skb)->h_dest, dev->net->dev_addr, ETH_ALEN);
++	return 1;
++}
++
++/* very simplistic detection of IPv4 or IPv6 headers */
++static bool possibly_iphdr(const char *data)
++{
++	return (data[0] & 0xd0) == 0x40;
++}
++
++/* disallow addresses which may be confused with IP headers */
++static int qmi_wwan_mac_addr(struct net_device *dev, void *p)
++{
++	struct sockaddr *addr = p;
++
++	if (!is_valid_ether_addr(addr->sa_data) ||
++	    possibly_iphdr(addr->sa_data))
++		return -EADDRNOTAVAIL;
++	memcpy(dev->dev_addr, addr->sa_data, ETH_ALEN);
++	return 0;
++}
++
++static const struct net_device_ops qmi_wwan_netdev_ops = {
++	.ndo_open		= usbnet_open,
++	.ndo_stop		= usbnet_stop,
++	.ndo_start_xmit		= usbnet_start_xmit,
++	.ndo_tx_timeout		= usbnet_tx_timeout,
++	.ndo_change_mtu		= usbnet_change_mtu,
++	.ndo_set_mac_address	= qmi_wwan_mac_addr,
++	.ndo_validate_addr	= eth_validate_addr,
++};
++
+ /* using a counter to merge subdriver requests with our own into a combined state */
+ static int qmi_wwan_manage_power(struct usbnet *dev, int on)
+ {
+@@ -257,6 +345,18 @@ static int qmi_wwan_bind_shared(struct usbnet *dev, struct usb_interface *intf)
+ 	/* save subdriver struct for suspend/resume wrappers */
+ 	dev->data[0] = (unsigned long)subdriver;
+ 
++	/* Never use the same address on both ends of the link, even
++	 * if the buggy firmware told us to.
++	 */
++	if (!compare_ether_addr(dev->net->dev_addr, default_modem_addr))
++		eth_hw_addr_random(dev->net);
++
++	/* make MAC addr easily distinguishable from an IP header */
++	if (possibly_iphdr(dev->net->dev_addr)) {
++		dev->net->dev_addr[0] |= 0x02;	/* set local assignment bit */
++		dev->net->dev_addr[0] &= 0xbf;	/* clear "IP" bit */
++	}
++	dev->net->netdev_ops = &qmi_wwan_netdev_ops;
+ err:
+ 	return rv;
+ }
+@@ -326,6 +426,7 @@ static const struct driver_info	qmi_wwan_shared = {
+ 	.bind		= qmi_wwan_bind_shared,
+ 	.unbind		= qmi_wwan_unbind_shared,
+ 	.manage_power	= qmi_wwan_manage_power,
++	.rx_fixup       = qmi_wwan_rx_fixup,
+ };
+ 
+ static const struct driver_info	qmi_wwan_force_int0 = {
+diff --git a/drivers/net/wireless/ath/ath9k/main.c b/drivers/net/wireless/ath/ath9k/main.c
+index 91e2c4f..f6a095f 100644
+--- a/drivers/net/wireless/ath/ath9k/main.c
++++ b/drivers/net/wireless/ath/ath9k/main.c
+@@ -1711,6 +1711,7 @@ static int ath9k_sta_add(struct ieee80211_hw *hw,
+ 	struct ath_common *common = ath9k_hw_common(sc->sc_ah);
+ 	struct ath_node *an = (struct ath_node *) sta->drv_priv;
+ 	struct ieee80211_key_conf ps_key = { };
++	int key;
+ 
+ 	ath_node_attach(sc, sta, vif);
+ 
+@@ -1718,7 +1719,9 @@ static int ath9k_sta_add(struct ieee80211_hw *hw,
+ 	    vif->type != NL80211_IFTYPE_AP_VLAN)
+ 		return 0;
+ 
+-	an->ps_key = ath_key_config(common, vif, sta, &ps_key);
++	key = ath_key_config(common, vif, sta, &ps_key);
++	if (key > 0)
++		an->ps_key = key;
+ 
+ 	return 0;
+ }
+@@ -1735,6 +1738,7 @@ static void ath9k_del_ps_key(struct ath_softc *sc,
+ 	    return;
+ 
+ 	ath_key_delete(common, &ps_key);
++	an->ps_key = 0;
+ }
+ 
+ static int ath9k_sta_remove(struct ieee80211_hw *hw,
+diff --git a/drivers/net/wireless/b43/dma.c b/drivers/net/wireless/b43/dma.c
+index bb2848a..448f545 100644
+--- a/drivers/net/wireless/b43/dma.c
++++ b/drivers/net/wireless/b43/dma.c
+@@ -1733,6 +1733,25 @@ drop_recycle_buffer:
+ 	sync_descbuffer_for_device(ring, dmaaddr, ring->rx_buffersize);
+ }
+ 
++void b43_dma_handle_rx_overflow(struct b43_dmaring *ring)
++{
++	int current_slot, previous_slot;
++
++	B43_WARN_ON(ring->tx);
++
++	/* Device has filled all buffers, drop all packets and let TCP
++	 * decrease speed.
++	 * Decrement RX index by one will let the device to see all slots
++	 * as free again
++	 */
++	/*
++	*TODO: How to increase rx_drop in mac80211?
++	*/
++	current_slot = ring->ops->get_current_rxslot(ring);
++	previous_slot = prev_slot(ring, current_slot);
++	ring->ops->set_current_rxslot(ring, previous_slot);
++}
++
+ void b43_dma_rx(struct b43_dmaring *ring)
+ {
+ 	const struct b43_dma_ops *ops = ring->ops;
+diff --git a/drivers/net/wireless/b43/dma.h b/drivers/net/wireless/b43/dma.h
+index 9fdd198..df8c8cd 100644
+--- a/drivers/net/wireless/b43/dma.h
++++ b/drivers/net/wireless/b43/dma.h
+@@ -9,7 +9,7 @@
+ /* DMA-Interrupt reasons. */
+ #define B43_DMAIRQ_FATALMASK	((1 << 10) | (1 << 11) | (1 << 12) \
+ 					 | (1 << 14) | (1 << 15))
+-#define B43_DMAIRQ_NONFATALMASK	(1 << 13)
++#define B43_DMAIRQ_RDESC_UFLOW		(1 << 13)
+ #define B43_DMAIRQ_RX_DONE		(1 << 16)
+ 
+ /*** 32-bit DMA Engine. ***/
+@@ -295,6 +295,8 @@ int b43_dma_tx(struct b43_wldev *dev,
+ void b43_dma_handle_txstatus(struct b43_wldev *dev,
+ 			     const struct b43_txstatus *status);
+ 
++void b43_dma_handle_rx_overflow(struct b43_dmaring *ring);
++
+ void b43_dma_rx(struct b43_dmaring *ring);
+ 
+ void b43_dma_direct_fifo_rx(struct b43_wldev *dev,
+diff --git a/drivers/net/wireless/b43/main.c b/drivers/net/wireless/b43/main.c
+index 14fd2ca..b54c750 100644
+--- a/drivers/net/wireless/b43/main.c
++++ b/drivers/net/wireless/b43/main.c
+@@ -1895,30 +1895,18 @@ static void b43_do_interrupt_thread(struct b43_wldev *dev)
+ 		}
+ 	}
+ 
+-	if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK |
+-					  B43_DMAIRQ_NONFATALMASK))) {
+-		if (merged_dma_reason & B43_DMAIRQ_FATALMASK) {
+-			b43err(dev->wl, "Fatal DMA error: "
+-			       "0x%08X, 0x%08X, 0x%08X, "
+-			       "0x%08X, 0x%08X, 0x%08X\n",
+-			       dma_reason[0], dma_reason[1],
+-			       dma_reason[2], dma_reason[3],
+-			       dma_reason[4], dma_reason[5]);
+-			b43err(dev->wl, "This device does not support DMA "
++	if (unlikely(merged_dma_reason & (B43_DMAIRQ_FATALMASK))) {
++		b43err(dev->wl,
++			"Fatal DMA error: 0x%08X, 0x%08X, 0x%08X, 0x%08X, 0x%08X, 0x%08X\n",
++			dma_reason[0], dma_reason[1],
++			dma_reason[2], dma_reason[3],
++			dma_reason[4], dma_reason[5]);
++		b43err(dev->wl, "This device does not support DMA "
+ 			       "on your system. It will now be switched to PIO.\n");
+-			/* Fall back to PIO transfers if we get fatal DMA errors! */
+-			dev->use_pio = true;
+-			b43_controller_restart(dev, "DMA error");
+-			return;
+-		}
+-		if (merged_dma_reason & B43_DMAIRQ_NONFATALMASK) {
+-			b43err(dev->wl, "DMA error: "
+-			       "0x%08X, 0x%08X, 0x%08X, "
+-			       "0x%08X, 0x%08X, 0x%08X\n",
+-			       dma_reason[0], dma_reason[1],
+-			       dma_reason[2], dma_reason[3],
+-			       dma_reason[4], dma_reason[5]);
+-		}
++		/* Fall back to PIO transfers if we get fatal DMA errors! */
++		dev->use_pio = true;
++		b43_controller_restart(dev, "DMA error");
++		return;
+ 	}
+ 
+ 	if (unlikely(reason & B43_IRQ_UCODE_DEBUG))
+@@ -1937,6 +1925,11 @@ static void b43_do_interrupt_thread(struct b43_wldev *dev)
+ 		handle_irq_noise(dev);
+ 
+ 	/* Check the DMA reason registers for received data. */
++	if (dma_reason[0] & B43_DMAIRQ_RDESC_UFLOW) {
++		if (B43_DEBUG)
++			b43warn(dev->wl, "RX descriptor underrun\n");
++		b43_dma_handle_rx_overflow(dev->dma.rx_ring);
++	}
+ 	if (dma_reason[0] & B43_DMAIRQ_RX_DONE) {
+ 		if (b43_using_pio_transfers(dev))
+ 			b43_pio_rx(dev->pio.rx_queue);
+@@ -1994,7 +1987,7 @@ static irqreturn_t b43_do_interrupt(struct b43_wldev *dev)
+ 		return IRQ_NONE;
+ 
+ 	dev->dma_reason[0] = b43_read32(dev, B43_MMIO_DMA0_REASON)
+-	    & 0x0001DC00;
++	    & 0x0001FC00;
+ 	dev->dma_reason[1] = b43_read32(dev, B43_MMIO_DMA1_REASON)
+ 	    & 0x0000DC00;
+ 	dev->dma_reason[2] = b43_read32(dev, B43_MMIO_DMA2_REASON)
+@@ -3122,7 +3115,7 @@ static int b43_chip_init(struct b43_wldev *dev)
+ 		b43_write32(dev, 0x018C, 0x02000000);
+ 	}
+ 	b43_write32(dev, B43_MMIO_GEN_IRQ_REASON, 0x00004000);
+-	b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001DC00);
++	b43_write32(dev, B43_MMIO_DMA0_IRQ_MASK, 0x0001FC00);
+ 	b43_write32(dev, B43_MMIO_DMA1_IRQ_MASK, 0x0000DC00);
+ 	b43_write32(dev, B43_MMIO_DMA2_IRQ_MASK, 0x0000DC00);
+ 	b43_write32(dev, B43_MMIO_DMA3_IRQ_MASK, 0x0001DC00);
+diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c
+index 2977a12..3050b6a 100644
+--- a/drivers/net/wireless/mwifiex/cmdevt.c
++++ b/drivers/net/wireless/mwifiex/cmdevt.c
+@@ -1084,6 +1084,7 @@ mwifiex_process_hs_config(struct mwifiex_adapter *adapter)
+ 	adapter->if_ops.wakeup(adapter);
+ 	adapter->hs_activated = false;
+ 	adapter->is_hs_configured = false;
++	adapter->is_suspended = false;
+ 	mwifiex_hs_activated_event(mwifiex_get_priv(adapter,
+ 						    MWIFIEX_BSS_ROLE_ANY),
+ 				   false);
+diff --git a/drivers/net/wireless/mwifiex/sta_ioctl.c b/drivers/net/wireless/mwifiex/sta_ioctl.c
+index 4fb146a..dc70c0f 100644
+--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
++++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
+@@ -105,7 +105,7 @@ int mwifiex_request_set_multicast_list(struct mwifiex_private *priv,
+ 	} else {
+ 		/* Multicast */
+ 		priv->curr_pkt_filter &= ~HostCmd_ACT_MAC_PROMISCUOUS_ENABLE;
+-		if (mcast_list->mode == MWIFIEX_MULTICAST_MODE) {
++		if (mcast_list->mode == MWIFIEX_ALL_MULTI_MODE) {
+ 			dev_dbg(priv->adapter->dev,
+ 				"info: Enabling All Multicast!\n");
+ 			priv->curr_pkt_filter |=
+@@ -117,20 +117,11 @@ int mwifiex_request_set_multicast_list(struct mwifiex_private *priv,
+ 				dev_dbg(priv->adapter->dev,
+ 					"info: Set multicast list=%d\n",
+ 				       mcast_list->num_multicast_addr);
+-				/* Set multicast addresses to firmware */
+-				if (old_pkt_filter == priv->curr_pkt_filter) {
+-					/* Send request to firmware */
+-					ret = mwifiex_send_cmd_async(priv,
+-						HostCmd_CMD_MAC_MULTICAST_ADR,
+-						HostCmd_ACT_GEN_SET, 0,
+-						mcast_list);
+-				} else {
+-					/* Send request to firmware */
+-					ret = mwifiex_send_cmd_async(priv,
+-						HostCmd_CMD_MAC_MULTICAST_ADR,
+-						HostCmd_ACT_GEN_SET, 0,
+-						mcast_list);
+-				}
++				/* Send multicast addresses to firmware */
++				ret = mwifiex_send_cmd_async(priv,
++					HostCmd_CMD_MAC_MULTICAST_ADR,
++					HostCmd_ACT_GEN_SET, 0,
++					mcast_list);
+ 			}
+ 		}
+ 	}
+diff --git a/drivers/platform/x86/hp_accel.c b/drivers/platform/x86/hp_accel.c
+index 22b2dfa..fdacfce 100644
+--- a/drivers/platform/x86/hp_accel.c
++++ b/drivers/platform/x86/hp_accel.c
+@@ -362,7 +362,8 @@ static int lis3lv02d_suspend(struct acpi_device *device, pm_message_t state)
+ 
+ static int lis3lv02d_resume(struct acpi_device *device)
+ {
+-	return lis3lv02d_poweron(&lis3_dev);
++	lis3lv02d_poweron(&lis3_dev);
++	return 0;
+ }
+ #else
+ #define lis3lv02d_suspend NULL
+diff --git a/drivers/rtc/rtc-pcf2123.c b/drivers/rtc/rtc-pcf2123.c
+index 8361187..9ea2555 100644
+--- a/drivers/rtc/rtc-pcf2123.c
++++ b/drivers/rtc/rtc-pcf2123.c
+@@ -264,6 +264,7 @@ static int __devinit pcf2123_probe(struct spi_device *spi)
+ 
+ 	if (!(rxbuf[0] & 0x20)) {
+ 		dev_err(&spi->dev, "chip not found\n");
++		ret = -ENODEV;
+ 		goto kfree_exit;
+ 	}
+ 
+diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
+index 5b3cadb..2bbb845 100644
+--- a/drivers/scsi/sd.c
++++ b/drivers/scsi/sd.c
+@@ -140,6 +140,7 @@ sd_store_cache_type(struct device *dev, struct device_attribute *attr,
+ 	char *buffer_data;
+ 	struct scsi_mode_data data;
+ 	struct scsi_sense_hdr sshdr;
++	const char *temp = "temporary ";
+ 	int len;
+ 
+ 	if (sdp->type != TYPE_DISK)
+@@ -148,6 +149,13 @@ sd_store_cache_type(struct device *dev, struct device_attribute *attr,
+ 		 * it's not worth the risk */
+ 		return -EINVAL;
+ 
++	if (strncmp(buf, temp, sizeof(temp) - 1) == 0) {
++		buf += sizeof(temp) - 1;
++		sdkp->cache_override = 1;
++	} else {
++		sdkp->cache_override = 0;
++	}
++
+ 	for (i = 0; i < ARRAY_SIZE(sd_cache_types); i++) {
+ 		len = strlen(sd_cache_types[i]);
+ 		if (strncmp(sd_cache_types[i], buf, len) == 0 &&
+@@ -160,6 +168,13 @@ sd_store_cache_type(struct device *dev, struct device_attribute *attr,
+ 		return -EINVAL;
+ 	rcd = ct & 0x01 ? 1 : 0;
+ 	wce = ct & 0x02 ? 1 : 0;
++
++	if (sdkp->cache_override) {
++		sdkp->WCE = wce;
++		sdkp->RCD = rcd;
++		return count;
++	}
++
+ 	if (scsi_mode_sense(sdp, 0x08, 8, buffer, sizeof(buffer), SD_TIMEOUT,
+ 			    SD_MAX_RETRIES, &data, NULL))
+ 		return -EINVAL;
+@@ -2126,6 +2141,10 @@ sd_read_cache_type(struct scsi_disk *sdkp, unsigned char *buffer)
+ 	int old_rcd = sdkp->RCD;
+ 	int old_dpofua = sdkp->DPOFUA;
+ 
++
++	if (sdkp->cache_override)
++		return;
++
+ 	first_len = 4;
+ 	if (sdp->skip_ms_page_8) {
+ 		if (sdp->type == TYPE_RBC)
+@@ -2607,6 +2626,7 @@ static void sd_probe_async(void *data, async_cookie_t cookie)
+ 	sdkp->capacity = 0;
+ 	sdkp->media_present = 1;
+ 	sdkp->write_prot = 0;
++	sdkp->cache_override = 0;
+ 	sdkp->WCE = 0;
+ 	sdkp->RCD = 0;
+ 	sdkp->ATO = 0;
+diff --git a/drivers/scsi/sd.h b/drivers/scsi/sd.h
+index f703f48..e2b2956 100644
+--- a/drivers/scsi/sd.h
++++ b/drivers/scsi/sd.h
+@@ -67,6 +67,7 @@ struct scsi_disk {
+ 	u8		protection_type;/* Data Integrity Field */
+ 	u8		provisioning_mode;
+ 	unsigned	ATO : 1;	/* state of disk ATO bit */
++	unsigned	cache_override : 1; /* temp override of WCE,RCD */
+ 	unsigned	WCE : 1;	/* state of disk WCE bit */
+ 	unsigned	RCD : 1;	/* state of disk RCD bit, unused */
+ 	unsigned	DPOFUA : 1;	/* state of disk DPOFUA bit */
+diff --git a/drivers/target/iscsi/iscsi_target_erl1.c b/drivers/target/iscsi/iscsi_target_erl1.c
+index 006f605..fd669b5 100644
+--- a/drivers/target/iscsi/iscsi_target_erl1.c
++++ b/drivers/target/iscsi/iscsi_target_erl1.c
+@@ -824,7 +824,7 @@ static int iscsit_attach_ooo_cmdsn(
+ 		/*
+ 		 * CmdSN is greater than the tail of the list.
+ 		 */
+-		if (ooo_tail->cmdsn < ooo_cmdsn->cmdsn)
++		if (iscsi_sna_lt(ooo_tail->cmdsn, ooo_cmdsn->cmdsn))
+ 			list_add_tail(&ooo_cmdsn->ooo_list,
+ 					&sess->sess_ooo_cmdsn_list);
+ 		else {
+@@ -834,11 +834,12 @@ static int iscsit_attach_ooo_cmdsn(
+ 			 */
+ 			list_for_each_entry(ooo_tmp, &sess->sess_ooo_cmdsn_list,
+ 						ooo_list) {
+-				if (ooo_tmp->cmdsn < ooo_cmdsn->cmdsn)
++				if (iscsi_sna_lt(ooo_tmp->cmdsn, ooo_cmdsn->cmdsn))
+ 					continue;
+ 
++				/* Insert before this entry */
+ 				list_add(&ooo_cmdsn->ooo_list,
+-					&ooo_tmp->ooo_list);
++					ooo_tmp->ooo_list.prev);
+ 				break;
+ 			}
+ 		}
+diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
+index ec970cb..19e4518 100644
+--- a/fs/ext4/mballoc.c
++++ b/fs/ext4/mballoc.c
+@@ -1980,7 +1980,11 @@ repeat:
+ 		group = ac->ac_g_ex.fe_group;
+ 
+ 		for (i = 0; i < ngroups; group++, i++) {
+-			if (group == ngroups)
++			/*
++			 * Artificially restricted ngroups for non-extent
++			 * files makes group > ngroups possible on first loop.
++			 */
++			if (group >= ngroups)
+ 				group = 0;
+ 
+ 			/* This now checks without needing the buddy page */
+diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
+index 001ef01..36ad5b4 100644
+--- a/fs/hugetlbfs/inode.c
++++ b/fs/hugetlbfs/inode.c
+@@ -927,9 +927,13 @@ static int can_do_hugetlb_shm(void)
+ 	return capable(CAP_IPC_LOCK) || in_group_p(sysctl_hugetlb_shm_group);
+ }
+ 
+-struct file *hugetlb_file_setup(const char *name, unsigned long addr,
+-				size_t size, vm_flags_t acctflag,
+-				struct user_struct **user, int creat_flags)
++/*
++ * Note that size should be aligned to proper hugepage size in caller side,
++ * otherwise hugetlb_reserve_pages reserves one less hugepages than intended.
++ */
++struct file *hugetlb_file_setup(const char *name, size_t size,
++				vm_flags_t acctflag, struct user_struct **user,
++				int creat_flags)
+ {
+ 	int error = -ENOMEM;
+ 	struct file *file;
+@@ -937,8 +941,6 @@ struct file *hugetlb_file_setup(const char *name, unsigned long addr,
+ 	struct path path;
+ 	struct dentry *root;
+ 	struct qstr quick_string;
+-	struct hstate *hstate;
+-	unsigned long num_pages;
+ 
+ 	*user = NULL;
+ 	if (!hugetlbfs_vfsmount)
+@@ -972,12 +974,10 @@ struct file *hugetlb_file_setup(const char *name, unsigned long addr,
+ 	if (!inode)
+ 		goto out_dentry;
+ 
+-	hstate = hstate_inode(inode);
+-	size += addr & ~huge_page_mask(hstate);
+-	num_pages = ALIGN(size, huge_page_size(hstate)) >>
+-			huge_page_shift(hstate);
+ 	error = -ENOMEM;
+-	if (hugetlb_reserve_pages(inode, 0, num_pages, NULL, acctflag))
++	if (hugetlb_reserve_pages(inode, 0,
++			size >> huge_page_shift(hstate_inode(inode)), NULL,
++			acctflag))
+ 		goto out_inode;
+ 
+ 	d_instantiate(path.dentry, inode);
+diff --git a/fs/nfsd/nfs4proc.c b/fs/nfsd/nfs4proc.c
+index dd0308d..64198ed 100644
+--- a/fs/nfsd/nfs4proc.c
++++ b/fs/nfsd/nfs4proc.c
+@@ -270,6 +270,7 @@ static __be32
+ do_open_fhandle(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_open *open)
+ {
+ 	__be32 status;
++	int accmode = 0;
+ 
+ 	/* We don't know the target directory, and therefore can not
+ 	* set the change info
+@@ -283,9 +284,19 @@ do_open_fhandle(struct svc_rqst *rqstp, struct svc_fh *current_fh, struct nfsd4_
+ 
+ 	open->op_truncate = (open->op_iattr.ia_valid & ATTR_SIZE) &&
+ 		(open->op_iattr.ia_size == 0);
++	/*
++	 * In the delegation case, the client is telling us about an
++	 * open that it *already* performed locally, some time ago.  We
++	 * should let it succeed now if possible.
++	 *
++	 * In the case of a CLAIM_FH open, on the other hand, the client
++	 * may be counting on us to enforce permissions (the Linux 4.1
++	 * client uses this for normal opens, for example).
++	 */
++	if (open->op_claim_type == NFS4_OPEN_CLAIM_DELEG_CUR_FH)
++		accmode = NFSD_MAY_OWNER_OVERRIDE;
+ 
+-	status = do_open_permission(rqstp, current_fh, open,
+-				    NFSD_MAY_OWNER_OVERRIDE);
++	status = do_open_permission(rqstp, current_fh, open, accmode);
+ 
+ 	return status;
+ }
+diff --git a/include/linux/audit.h b/include/linux/audit.h
+index ed3ef19..4f334d5 100644
+--- a/include/linux/audit.h
++++ b/include/linux/audit.h
+@@ -480,7 +480,7 @@ static inline void audit_syscall_entry(int arch, int major, unsigned long a0,
+ 				       unsigned long a1, unsigned long a2,
+ 				       unsigned long a3)
+ {
+-	if (unlikely(!audit_dummy_context()))
++	if (unlikely(current->audit_context))
+ 		__audit_syscall_entry(arch, major, a0, a1, a2, a3);
+ }
+ static inline void audit_syscall_exit(void *pt_regs)
+diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
+index 000837e..2c36a71 100644
+--- a/include/linux/hugetlb.h
++++ b/include/linux/hugetlb.h
+@@ -152,8 +152,7 @@ static inline struct hugetlbfs_sb_info *HUGETLBFS_SB(struct super_block *sb)
+ 
+ extern const struct file_operations hugetlbfs_file_operations;
+ extern const struct vm_operations_struct hugetlb_vm_ops;
+-struct file *hugetlb_file_setup(const char *name, unsigned long addr,
+-				size_t size, vm_flags_t acct,
++struct file *hugetlb_file_setup(const char *name, size_t size, vm_flags_t acct,
+ 				struct user_struct **user, int creat_flags);
+ 
+ static inline int is_file_hugepages(struct file *file)
+@@ -170,8 +169,8 @@ static inline int is_file_hugepages(struct file *file)
+ 
+ #define is_file_hugepages(file)			0
+ static inline struct file *
+-hugetlb_file_setup(const char *name, unsigned long addr, size_t size,
+-		vm_flags_t acctflag, struct user_struct **user, int creat_flags)
++hugetlb_file_setup(const char *name, size_t size, vm_flags_t acctflag,
++		struct user_struct **user, int creat_flags)
+ {
+ 	return ERR_PTR(-ENOSYS);
+ }
+@@ -294,7 +293,7 @@ static inline unsigned hstate_index_to_shift(unsigned index)
+ 	return hstates[index].order + PAGE_SHIFT;
+ }
+ 
+-#else
++#else	/* CONFIG_HUGETLB_PAGE */
+ struct hstate {};
+ #define alloc_huge_page_node(h, nid) NULL
+ #define alloc_bootmem_huge_page(h) NULL
+diff --git a/include/linux/if_cablemodem.h b/include/linux/if_cablemodem.h
+index 9ca1007..ee6b3c4 100644
+--- a/include/linux/if_cablemodem.h
++++ b/include/linux/if_cablemodem.h
+@@ -12,11 +12,11 @@
+  */
+ 
+ /* some useful defines for sb1000.c e cmconfig.c - fv */
+-#define SIOCGCMSTATS		SIOCDEVPRIVATE+0	/* get cable modem stats */
+-#define SIOCGCMFIRMWARE		SIOCDEVPRIVATE+1	/* get cm firmware version */
+-#define SIOCGCMFREQUENCY	SIOCDEVPRIVATE+2	/* get cable modem frequency */
+-#define SIOCSCMFREQUENCY	SIOCDEVPRIVATE+3	/* set cable modem frequency */
+-#define SIOCGCMPIDS			SIOCDEVPRIVATE+4	/* get cable modem PIDs */
+-#define SIOCSCMPIDS			SIOCDEVPRIVATE+5	/* set cable modem PIDs */
++#define SIOCGCMSTATS		(SIOCDEVPRIVATE+0)	/* get cable modem stats */
++#define SIOCGCMFIRMWARE		(SIOCDEVPRIVATE+1)	/* get cm firmware version */
++#define SIOCGCMFREQUENCY	(SIOCDEVPRIVATE+2)	/* get cable modem frequency */
++#define SIOCSCMFREQUENCY	(SIOCDEVPRIVATE+3)	/* set cable modem frequency */
++#define SIOCGCMPIDS			(SIOCDEVPRIVATE+4)	/* get cable modem PIDs */
++#define SIOCSCMPIDS			(SIOCDEVPRIVATE+5)	/* set cable modem PIDs */
+ 
+ #endif
+diff --git a/include/linux/rculist.h b/include/linux/rculist.h
+index d079290..6f95e24 100644
+--- a/include/linux/rculist.h
++++ b/include/linux/rculist.h
+@@ -242,6 +242,23 @@ static inline void list_splice_init_rcu(struct list_head *list,
+ 	list_entry_rcu((ptr)->next, type, member)
+ 
+ /**
++ * list_first_or_null_rcu - get the first element from a list
++ * @ptr:        the list head to take the element from.
++ * @type:       the type of the struct this is embedded in.
++ * @member:     the name of the list_struct within the struct.
++ *
++ * Note that if the list is empty, it returns NULL.
++ *
++ * This primitive may safely run concurrently with the _rcu list-mutation
++ * primitives such as list_add_rcu() as long as it's guarded by rcu_read_lock().
++ */
++#define list_first_or_null_rcu(ptr, type, member) \
++	({struct list_head *__ptr = (ptr); \
++	  struct list_head __rcu *__next = list_next_rcu(__ptr); \
++	  likely(__ptr != __next) ? container_of(__next, type, member) : NULL; \
++	})
++
++/**
+  * list_for_each_entry_rcu	-	iterate over rcu list of given type
+  * @pos:	the type * to use as a loop cursor.
+  * @head:	the head for your list.
+diff --git a/include/net/sock.h b/include/net/sock.h
+index 59a8947..f673ba5 100644
+--- a/include/net/sock.h
++++ b/include/net/sock.h
+@@ -793,6 +793,18 @@ struct inet_hashinfo;
+ struct raw_hashinfo;
+ struct module;
+ 
++/*
++ * caches using SLAB_DESTROY_BY_RCU should let .next pointer from nulls nodes
++ * un-modified. Special care is taken when initializing object to zero.
++ */
++static inline void sk_prot_clear_nulls(struct sock *sk, int size)
++{
++	if (offsetof(struct sock, sk_node.next) != 0)
++		memset(sk, 0, offsetof(struct sock, sk_node.next));
++	memset(&sk->sk_node.pprev, 0,
++	       size - offsetof(struct sock, sk_node.pprev));
++}
++
+ /* Networking protocol blocks we attach to sockets.
+  * socket layer -> transport layer interface
+  * transport -> network interface is defined by struct inet_proto
+diff --git a/include/net/tcp.h b/include/net/tcp.h
+index 2757a11..8376a6a 100644
+--- a/include/net/tcp.h
++++ b/include/net/tcp.h
+@@ -948,6 +948,7 @@ static inline int tcp_prequeue(struct sock *sk, struct sk_buff *skb)
+ 	if (sysctl_tcp_low_latency || !tp->ucopy.task)
+ 		return 0;
+ 
++	skb_dst_force(skb);
+ 	__skb_queue_tail(&tp->ucopy.prequeue, skb);
+ 	tp->ucopy.memory += skb->truesize;
+ 	if (tp->ucopy.memory > sk->sk_rcvbuf) {
+diff --git a/ipc/shm.c b/ipc/shm.c
+index 85d81b4..a02ef57 100644
+--- a/ipc/shm.c
++++ b/ipc/shm.c
+@@ -479,10 +479,12 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
+ 
+ 	sprintf (name, "SYSV%08x", key);
+ 	if (shmflg & SHM_HUGETLB) {
++		size_t hugesize = ALIGN(size, huge_page_size(&default_hstate));
++
+ 		/* hugetlb_file_setup applies strict accounting */
+ 		if (shmflg & SHM_NORESERVE)
+ 			acctflag = VM_NORESERVE;
+-		file = hugetlb_file_setup(name, 0, size, acctflag,
++		file = hugetlb_file_setup(name, hugesize, acctflag,
+ 					&shp->mlock_user, HUGETLB_SHMFS_INODE);
+ 	} else {
+ 		/*
+diff --git a/kernel/kmod.c b/kernel/kmod.c
+index 05698a7..f2490e1 100644
+--- a/kernel/kmod.c
++++ b/kernel/kmod.c
+@@ -541,6 +541,11 @@ int call_usermodehelper_exec(struct subprocess_info *sub_info, int wait)
+ 	int retval = 0;
+ 
+ 	helper_lock();
++	if (!sub_info->path) {
++		retval = -EINVAL;
++		goto out;
++	}
++
+ 	if (sub_info->path[0] == '\0')
+ 		goto out;
+ 
+diff --git a/kernel/time/tick-sched.c b/kernel/time/tick-sched.c
+index 01d8e62..6570548 100644
+--- a/kernel/time/tick-sched.c
++++ b/kernel/time/tick-sched.c
+@@ -866,7 +866,7 @@ void tick_cancel_sched_timer(int cpu)
+ 		hrtimer_cancel(&ts->sched_timer);
+ # endif
+ 
+-	ts->nohz_mode = NOHZ_MODE_INACTIVE;
++	memset(ts, 0, sizeof(*ts));
+ }
+ #endif
+ 
+diff --git a/kernel/timer.c b/kernel/timer.c
+index 6dfdb72..dd93d90 100644
+--- a/kernel/timer.c
++++ b/kernel/timer.c
+@@ -1680,12 +1680,12 @@ static int __cpuinit init_timers_cpu(int cpu)
+ 			boot_done = 1;
+ 			base = &boot_tvec_bases;
+ 		}
++		spin_lock_init(&base->lock);
+ 		tvec_base_done[cpu] = 1;
+ 	} else {
+ 		base = per_cpu(tvec_bases, cpu);
+ 	}
+ 
+-	spin_lock_init(&base->lock);
+ 
+ 	for (j = 0; j < TVN_SIZE; j++) {
+ 		INIT_LIST_HEAD(base->tv5.vec + j);
+diff --git a/kernel/trace/trace_events_filter.c b/kernel/trace/trace_events_filter.c
+index 431dba8..289197a 100644
+--- a/kernel/trace/trace_events_filter.c
++++ b/kernel/trace/trace_events_filter.c
+@@ -777,7 +777,11 @@ static int filter_set_pred(struct event_filter *filter,
+ 
+ static void __free_preds(struct event_filter *filter)
+ {
++	int i;
++
+ 	if (filter->preds) {
++		for (i = 0; i < filter->n_preds; i++)
++			kfree(filter->preds[i].ops);
+ 		kfree(filter->preds);
+ 		filter->preds = NULL;
+ 	}
+diff --git a/mm/mmap.c b/mm/mmap.c
+index 3635d47..ed884dd 100644
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -1130,15 +1130,19 @@ SYSCALL_DEFINE6(mmap_pgoff, unsigned long, addr, unsigned long, len,
+ 		file = fget(fd);
+ 		if (!file)
+ 			goto out;
++		if (is_file_hugepages(file))
++			len = ALIGN(len, huge_page_size(hstate_file(file)));
+ 	} else if (flags & MAP_HUGETLB) {
+ 		struct user_struct *user = NULL;
++
++		len = ALIGN(len, huge_page_size(&default_hstate));
+ 		/*
+ 		 * VM_NORESERVE is used because the reservations will be
+ 		 * taken when vm_ops->mmap() is called
+ 		 * A dummy user value is used because we are not locking
+ 		 * memory so no accounting is necessary
+ 		 */
+-		file = hugetlb_file_setup(HUGETLB_ANON_FILE, addr, len,
++		file = hugetlb_file_setup(HUGETLB_ANON_FILE, len,
+ 						VM_NORESERVE, &user,
+ 						HUGETLB_ANONHUGE_INODE);
+ 		if (IS_ERR(file))
+diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
+index 9757c19..daeb19d 100644
+--- a/net/8021q/vlan_dev.c
++++ b/net/8021q/vlan_dev.c
+@@ -598,7 +598,7 @@ static netdev_features_t vlan_dev_fix_features(struct net_device *dev,
+ 	netdev_features_t features)
+ {
+ 	struct net_device *real_dev = vlan_dev_priv(dev)->real_dev;
+-	u32 old_features = features;
++	netdev_features_t old_features = features;
+ 
+ 	features &= real_dev->vlan_features;
+ 	features |= NETIF_F_RXCSUM;
+diff --git a/net/bridge/br_stp_timer.c b/net/bridge/br_stp_timer.c
+index 58de2a0..c83ee79 100644
+--- a/net/bridge/br_stp_timer.c
++++ b/net/bridge/br_stp_timer.c
+@@ -107,7 +107,7 @@ static void br_tcn_timer_expired(unsigned long arg)
+ 
+ 	br_debug(br, "tcn timer expired\n");
+ 	spin_lock(&br->lock);
+-	if (br->dev->flags & IFF_UP) {
++	if (!br_is_root_bridge(br) && (br->dev->flags & IFF_UP)) {
+ 		br_transmit_tcn(br);
+ 
+ 		mod_timer(&br->tcn_timer,jiffies + br->bridge_hello_time);
+diff --git a/net/core/dev.c b/net/core/dev.c
+index dd12421..7db83d6 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -2170,7 +2170,7 @@ EXPORT_SYMBOL(netif_skb_features);
+  *	   support DMA from it.
+  */
+ static inline int skb_needs_linearize(struct sk_buff *skb,
+-				      int features)
++				      netdev_features_t features)
+ {
+ 	return skb_is_nonlinear(skb) &&
+ 			((skb_has_frag_list(skb) &&
+diff --git a/net/core/ethtool.c b/net/core/ethtool.c
+index 6d6d7d2..7becb3f 100644
+--- a/net/core/ethtool.c
++++ b/net/core/ethtool.c
+@@ -1286,7 +1286,7 @@ int dev_ethtool(struct net *net, struct ifreq *ifr)
+ 	void __user *useraddr = ifr->ifr_data;
+ 	u32 ethcmd;
+ 	int rc;
+-	u32 old_features;
++	netdev_features_t old_features;
+ 
+ 	if (!dev || !netif_device_present(dev))
+ 		return -ENODEV;
+diff --git a/net/core/sock.c b/net/core/sock.c
+index f8b5030..561eb57 100644
+--- a/net/core/sock.c
++++ b/net/core/sock.c
+@@ -1093,18 +1093,6 @@ static void sock_copy(struct sock *nsk, const struct sock *osk)
+ #endif
+ }
+ 
+-/*
+- * caches using SLAB_DESTROY_BY_RCU should let .next pointer from nulls nodes
+- * un-modified. Special care is taken when initializing object to zero.
+- */
+-static inline void sk_prot_clear_nulls(struct sock *sk, int size)
+-{
+-	if (offsetof(struct sock, sk_node.next) != 0)
+-		memset(sk, 0, offsetof(struct sock, sk_node.next));
+-	memset(&sk->sk_node.pprev, 0,
+-	       size - offsetof(struct sock, sk_node.pprev));
+-}
+-
+ void sk_prot_clear_portaddr_nulls(struct sock *sk, int size)
+ {
+ 	unsigned long nulls1, nulls2;
+diff --git a/net/ipv6/tcp_ipv6.c b/net/ipv6/tcp_ipv6.c
+index 3889e02..7ee7121 100644
+--- a/net/ipv6/tcp_ipv6.c
++++ b/net/ipv6/tcp_ipv6.c
+@@ -2079,6 +2079,17 @@ void tcp6_proc_exit(struct net *net)
+ }
+ #endif
+ 
++static void tcp_v6_clear_sk(struct sock *sk, int size)
++{
++	struct inet_sock *inet = inet_sk(sk);
++
++	/* we do not want to clear pinet6 field, because of RCU lookups */
++	sk_prot_clear_nulls(sk, offsetof(struct inet_sock, pinet6));
++
++	size -= offsetof(struct inet_sock, pinet6) + sizeof(inet->pinet6);
++	memset(&inet->pinet6 + 1, 0, size);
++}
++
+ struct proto tcpv6_prot = {
+ 	.name			= "TCPv6",
+ 	.owner			= THIS_MODULE,
+@@ -2120,6 +2131,7 @@ struct proto tcpv6_prot = {
+ #ifdef CONFIG_CGROUP_MEM_RES_CTLR_KMEM
+ 	.proto_cgroup		= tcp_proto_cgroup,
+ #endif
++	.clear_sk		= tcp_v6_clear_sk,
+ };
+ 
+ static const struct inet6_protocol tcpv6_protocol = {
+diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
+index 37b0699..aa2f18b 100644
+--- a/net/ipv6/udp.c
++++ b/net/ipv6/udp.c
+@@ -1457,6 +1457,17 @@ void udp6_proc_exit(struct net *net) {
+ }
+ #endif /* CONFIG_PROC_FS */
+ 
++void udp_v6_clear_sk(struct sock *sk, int size)
++{
++	struct inet_sock *inet = inet_sk(sk);
++
++	/* we do not want to clear pinet6 field, because of RCU lookups */
++	sk_prot_clear_portaddr_nulls(sk, offsetof(struct inet_sock, pinet6));
++
++	size -= offsetof(struct inet_sock, pinet6) + sizeof(inet->pinet6);
++	memset(&inet->pinet6 + 1, 0, size);
++}
++
+ /* ------------------------------------------------------------------------ */
+ 
+ struct proto udpv6_prot = {
+@@ -1487,7 +1498,7 @@ struct proto udpv6_prot = {
+ 	.compat_setsockopt = compat_udpv6_setsockopt,
+ 	.compat_getsockopt = compat_udpv6_getsockopt,
+ #endif
+-	.clear_sk	   = sk_prot_clear_portaddr_nulls,
++	.clear_sk	   = udp_v6_clear_sk,
+ };
+ 
+ static struct inet_protosw udpv6_protosw = {
+diff --git a/net/ipv6/udp_impl.h b/net/ipv6/udp_impl.h
+index d757104..4691ed5 100644
+--- a/net/ipv6/udp_impl.h
++++ b/net/ipv6/udp_impl.h
+@@ -31,6 +31,8 @@ extern int	udpv6_recvmsg(struct kiocb *iocb, struct sock *sk,
+ extern int	udpv6_queue_rcv_skb(struct sock * sk, struct sk_buff *skb);
+ extern void	udpv6_destroy_sock(struct sock *sk);
+ 
++extern void udp_v6_clear_sk(struct sock *sk, int size);
++
+ #ifdef CONFIG_PROC_FS
+ extern int	udp6_seq_show(struct seq_file *seq, void *v);
+ #endif
+diff --git a/net/ipv6/udplite.c b/net/ipv6/udplite.c
+index 1d08e21..dfcc4be 100644
+--- a/net/ipv6/udplite.c
++++ b/net/ipv6/udplite.c
+@@ -56,7 +56,7 @@ struct proto udplitev6_prot = {
+ 	.compat_setsockopt = compat_udpv6_setsockopt,
+ 	.compat_getsockopt = compat_udpv6_getsockopt,
+ #endif
+-	.clear_sk	   = sk_prot_clear_portaddr_nulls,
++	.clear_sk	   = udp_v6_clear_sk,
+ };
+ 
+ static struct inet_protosw udplite6_protosw = {
+diff --git a/net/ipv6/xfrm6_policy.c b/net/ipv6/xfrm6_policy.c
+index 8ea65e0..808fd08 100644
+--- a/net/ipv6/xfrm6_policy.c
++++ b/net/ipv6/xfrm6_policy.c
+@@ -96,8 +96,10 @@ static int xfrm6_fill_dst(struct xfrm_dst *xdst, struct net_device *dev,
+ 	dev_hold(dev);
+ 
+ 	xdst->u.rt6.rt6i_idev = in6_dev_get(dev);
+-	if (!xdst->u.rt6.rt6i_idev)
++	if (!xdst->u.rt6.rt6i_idev) {
++		dev_put(dev);
+ 		return -ENODEV;
++	}
+ 
+ 	xdst->u.rt6.rt6i_peer = rt->rt6i_peer;
+ 	if (rt->rt6i_peer)
+diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
+index 38ca5e0..cfcd783 100644
+--- a/net/packet/af_packet.c
++++ b/net/packet/af_packet.c
+@@ -812,37 +812,27 @@ static void prb_open_block(struct tpacket_kbdq_core *pkc1,
+ 
+ 	smp_rmb();
+ 
+-	if (likely(TP_STATUS_KERNEL == BLOCK_STATUS(pbd1))) {
+-
+-		/* We could have just memset this but we will lose the
+-		 * flexibility of making the priv area sticky
+-		 */
+-		BLOCK_SNUM(pbd1) = pkc1->knxt_seq_num++;
+-		BLOCK_NUM_PKTS(pbd1) = 0;
+-		BLOCK_LEN(pbd1) = BLK_PLUS_PRIV(pkc1->blk_sizeof_priv);
+-		getnstimeofday(&ts);
+-		h1->ts_first_pkt.ts_sec = ts.tv_sec;
+-		h1->ts_first_pkt.ts_nsec = ts.tv_nsec;
+-		pkc1->pkblk_start = (char *)pbd1;
+-		pkc1->nxt_offset = (char *)(pkc1->pkblk_start +
+-		BLK_PLUS_PRIV(pkc1->blk_sizeof_priv));
+-		BLOCK_O2FP(pbd1) = (__u32)BLK_PLUS_PRIV(pkc1->blk_sizeof_priv);
+-		BLOCK_O2PRIV(pbd1) = BLK_HDR_LEN;
+-		pbd1->version = pkc1->version;
+-		pkc1->prev = pkc1->nxt_offset;
+-		pkc1->pkblk_end = pkc1->pkblk_start + pkc1->kblk_size;
+-		prb_thaw_queue(pkc1);
+-		_prb_refresh_rx_retire_blk_timer(pkc1);
+-
+-		smp_wmb();
+-
+-		return;
+-	}
++	/* We could have just memset this but we will lose the
++	 * flexibility of making the priv area sticky
++	 */
++	BLOCK_SNUM(pbd1) = pkc1->knxt_seq_num++;
++	BLOCK_NUM_PKTS(pbd1) = 0;
++	BLOCK_LEN(pbd1) = BLK_PLUS_PRIV(pkc1->blk_sizeof_priv);
++	getnstimeofday(&ts);
++	h1->ts_first_pkt.ts_sec = ts.tv_sec;
++	h1->ts_first_pkt.ts_nsec = ts.tv_nsec;
++	pkc1->pkblk_start = (char *)pbd1;
++	pkc1->nxt_offset = (char *)(pkc1->pkblk_start +
++				    BLK_PLUS_PRIV(pkc1->blk_sizeof_priv));
++	BLOCK_O2FP(pbd1) = (__u32)BLK_PLUS_PRIV(pkc1->blk_sizeof_priv);
++	BLOCK_O2PRIV(pbd1) = BLK_HDR_LEN;
++	pbd1->version = pkc1->version;
++	pkc1->prev = pkc1->nxt_offset;
++	pkc1->pkblk_end = pkc1->pkblk_start + pkc1->kblk_size;
++	prb_thaw_queue(pkc1);
++	_prb_refresh_rx_retire_blk_timer(pkc1);
+ 
+-	WARN(1, "ERROR block:%p is NOT FREE status:%d kactive_blk_num:%d\n",
+-		pbd1, BLOCK_STATUS(pbd1), pkc1->kactive_blk_num);
+-	dump_stack();
+-	BUG();
++	smp_wmb();
+ }
+ 
+ /*
+@@ -933,10 +923,6 @@ static void prb_retire_current_block(struct tpacket_kbdq_core *pkc,
+ 		prb_close_block(pkc, pbd, po, status);
+ 		return;
+ 	}
+-
+-	WARN(1, "ERROR-pbd[%d]:%p\n", pkc->kactive_blk_num, pbd);
+-	dump_stack();
+-	BUG();
+ }
+ 
+ static int prb_curr_blk_in_use(struct tpacket_kbdq_core *pkc,
+diff --git a/net/sched/act_ipt.c b/net/sched/act_ipt.c
+index 60f8f61..57827bf 100644
+--- a/net/sched/act_ipt.c
++++ b/net/sched/act_ipt.c
+@@ -8,7 +8,7 @@
+  *		as published by the Free Software Foundation; either version
+  *		2 of the License, or (at your option) any later version.
+  *
+- * Copyright:	Jamal Hadi Salim (2002-4)
++ * Copyright:	Jamal Hadi Salim (2002-13)
+  */
+ 
+ #include <linux/types.h>
+@@ -299,17 +299,44 @@ static struct tc_action_ops act_ipt_ops = {
+ 	.walk		=	tcf_generic_walker
+ };
+ 
+-MODULE_AUTHOR("Jamal Hadi Salim(2002-4)");
++static struct tc_action_ops act_xt_ops = {
++	.kind		=	"xt",
++	.hinfo		=	&ipt_hash_info,
++	.type		=	TCA_ACT_IPT,
++	.capab		=	TCA_CAP_NONE,
++	.owner		=	THIS_MODULE,
++	.act		=	tcf_ipt,
++	.dump		=	tcf_ipt_dump,
++	.cleanup	=	tcf_ipt_cleanup,
++	.lookup		=	tcf_hash_search,
++	.init		=	tcf_ipt_init,
++	.walk		=	tcf_generic_walker
++};
++
++MODULE_AUTHOR("Jamal Hadi Salim(2002-13)");
+ MODULE_DESCRIPTION("Iptables target actions");
+ MODULE_LICENSE("GPL");
++MODULE_ALIAS("act_xt");
+ 
+ static int __init ipt_init_module(void)
+ {
+-	return tcf_register_action(&act_ipt_ops);
++	int ret1, ret2;
++	ret1 = tcf_register_action(&act_xt_ops);
++	if (ret1 < 0)
++		printk("Failed to load xt action\n");
++	ret2 = tcf_register_action(&act_ipt_ops);
++	if (ret2 < 0)
++		printk("Failed to load ipt action\n");
++
++	if (ret1 < 0 && ret2 < 0)
++		return ret1;
++	else
++		return 0;
+ }
+ 
+ static void __exit ipt_cleanup_module(void)
+ {
++	tcf_unregister_action(&act_xt_ops);
+ 	tcf_unregister_action(&act_ipt_ops);
+ }
+ 
+diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
+index c72dce0..c74a044 100644
+--- a/sound/pci/hda/hda_codec.c
++++ b/sound/pci/hda/hda_codec.c
+@@ -617,6 +617,9 @@ int snd_hda_queue_unsol_event(struct hda_bus *bus, u32 res, u32 res_ex)
+ 	struct hda_bus_unsolicited *unsol;
+ 	unsigned int wp;
+ 
++	if (!bus || !bus->workq)
++		return 0;
++
+ 	trace_hda_unsol_event(bus, res, res_ex);
+ 	unsol = bus->unsol;
+ 	if (!unsol)
+diff --git a/sound/soc/codecs/wm8994.c b/sound/soc/codecs/wm8994.c
+index 4c471a5..d9924d7 100644
+--- a/sound/soc/codecs/wm8994.c
++++ b/sound/soc/codecs/wm8994.c
+@@ -2824,6 +2824,7 @@ static int wm8994_aif3_hw_params(struct snd_pcm_substream *substream,
+ 		default:
+ 			return 0;
+ 		}
++		break;
+ 	default:
+ 		return 0;
+ 	}