Gentoo Archives: gentoo-commits

From: "Mike Pagano (mpagano)" <mpagano@g.o>
To: gentoo-commits@l.g.o
Subject: [gentoo-commits] linux-patches r2800 - genpatches-2.6/trunk/3.10
Date: Sat, 31 May 2014 20:17:17
Message-Id: 20140531201711.8A5722004E@flycatcher.gentoo.org
1 Author: mpagano
2 Date: 2014-05-31 20:17:11 +0000 (Sat, 31 May 2014)
3 New Revision: 2800
4
5 Added:
6 genpatches-2.6/trunk/3.10/1040_linux-3.10.41.patch
7 Modified:
8 genpatches-2.6/trunk/3.10/0000_README
9 Log:
10 Linux patch 3.10.41
11
12 Modified: genpatches-2.6/trunk/3.10/0000_README
13 ===================================================================
14 --- genpatches-2.6/trunk/3.10/0000_README 2014-05-20 00:18:20 UTC (rev 2799)
15 +++ genpatches-2.6/trunk/3.10/0000_README 2014-05-31 20:17:11 UTC (rev 2800)
16 @@ -202,6 +202,10 @@
17 From: http://www.kernel.org
18 Desc: Linux 3.10.40
19
20 +Patch: 1040_linux-3.10.41.patch
21 +From: http://www.kernel.org
22 +Desc: Linux 3.10.41
23 +
24 Patch: 1500_XATTR_USER_PREFIX.patch
25 From: https://bugs.gentoo.org/show_bug.cgi?id=470644
26 Desc: Support for namespace user.pax.* on tmpfs.
27
28 Added: genpatches-2.6/trunk/3.10/1040_linux-3.10.41.patch
29 ===================================================================
30 --- genpatches-2.6/trunk/3.10/1040_linux-3.10.41.patch (rev 0)
31 +++ genpatches-2.6/trunk/3.10/1040_linux-3.10.41.patch 2014-05-31 20:17:11 UTC (rev 2800)
32 @@ -0,0 +1,3336 @@
33 +diff --git a/Makefile b/Makefile
34 +index b2285cababb0..370cc01afb07 100644
35 +--- a/Makefile
36 ++++ b/Makefile
37 +@@ -1,6 +1,6 @@
38 + VERSION = 3
39 + PATCHLEVEL = 10
40 +-SUBLEVEL = 40
41 ++SUBLEVEL = 41
42 + EXTRAVERSION =
43 + NAME = TOSSUG Baby Fish
44 +
45 +diff --git a/arch/arm/configs/multi_v7_defconfig b/arch/arm/configs/multi_v7_defconfig
46 +index 2e67a272df70..9ce8ba1a1433 100644
47 +--- a/arch/arm/configs/multi_v7_defconfig
48 ++++ b/arch/arm/configs/multi_v7_defconfig
49 +@@ -1,6 +1,7 @@
50 + CONFIG_EXPERIMENTAL=y
51 + CONFIG_NO_HZ=y
52 + CONFIG_HIGH_RES_TIMERS=y
53 ++CONFIG_BLK_DEV_INITRD=y
54 + CONFIG_ARCH_MVEBU=y
55 + CONFIG_MACH_ARMADA_370=y
56 + CONFIG_ARCH_SIRF=y
57 +@@ -22,6 +23,7 @@ CONFIG_AEABI=y
58 + CONFIG_HIGHMEM=y
59 + CONFIG_HIGHPTE=y
60 + CONFIG_ARM_APPENDED_DTB=y
61 ++CONFIG_ARM_ATAG_DTB_COMPAT=y
62 + CONFIG_VFP=y
63 + CONFIG_NEON=y
64 + CONFIG_NET=y
65 +diff --git a/arch/parisc/kernel/syscall_table.S b/arch/parisc/kernel/syscall_table.S
66 +index 0c9107285e66..10a0c2aad8cf 100644
67 +--- a/arch/parisc/kernel/syscall_table.S
68 ++++ b/arch/parisc/kernel/syscall_table.S
69 +@@ -392,7 +392,7 @@
70 + ENTRY_COMP(vmsplice)
71 + ENTRY_COMP(move_pages) /* 295 */
72 + ENTRY_SAME(getcpu)
73 +- ENTRY_SAME(epoll_pwait)
74 ++ ENTRY_COMP(epoll_pwait)
75 + ENTRY_COMP(statfs64)
76 + ENTRY_COMP(fstatfs64)
77 + ENTRY_COMP(kexec_load) /* 300 */
78 +diff --git a/arch/powerpc/lib/crtsavres.S b/arch/powerpc/lib/crtsavres.S
79 +index b2c68ce139ae..a5b30c71a8d3 100644
80 +--- a/arch/powerpc/lib/crtsavres.S
81 ++++ b/arch/powerpc/lib/crtsavres.S
82 +@@ -231,6 +231,87 @@ _GLOBAL(_rest32gpr_31_x)
83 + mr 1,11
84 + blr
85 +
86 ++#ifdef CONFIG_ALTIVEC
87 ++/* Called with r0 pointing just beyond the end of the vector save area. */
88 ++
89 ++_GLOBAL(_savevr_20)
90 ++ li r11,-192
91 ++ stvx vr20,r11,r0
92 ++_GLOBAL(_savevr_21)
93 ++ li r11,-176
94 ++ stvx vr21,r11,r0
95 ++_GLOBAL(_savevr_22)
96 ++ li r11,-160
97 ++ stvx vr22,r11,r0
98 ++_GLOBAL(_savevr_23)
99 ++ li r11,-144
100 ++ stvx vr23,r11,r0
101 ++_GLOBAL(_savevr_24)
102 ++ li r11,-128
103 ++ stvx vr24,r11,r0
104 ++_GLOBAL(_savevr_25)
105 ++ li r11,-112
106 ++ stvx vr25,r11,r0
107 ++_GLOBAL(_savevr_26)
108 ++ li r11,-96
109 ++ stvx vr26,r11,r0
110 ++_GLOBAL(_savevr_27)
111 ++ li r11,-80
112 ++ stvx vr27,r11,r0
113 ++_GLOBAL(_savevr_28)
114 ++ li r11,-64
115 ++ stvx vr28,r11,r0
116 ++_GLOBAL(_savevr_29)
117 ++ li r11,-48
118 ++ stvx vr29,r11,r0
119 ++_GLOBAL(_savevr_30)
120 ++ li r11,-32
121 ++ stvx vr30,r11,r0
122 ++_GLOBAL(_savevr_31)
123 ++ li r11,-16
124 ++ stvx vr31,r11,r0
125 ++ blr
126 ++
127 ++_GLOBAL(_restvr_20)
128 ++ li r11,-192
129 ++ lvx vr20,r11,r0
130 ++_GLOBAL(_restvr_21)
131 ++ li r11,-176
132 ++ lvx vr21,r11,r0
133 ++_GLOBAL(_restvr_22)
134 ++ li r11,-160
135 ++ lvx vr22,r11,r0
136 ++_GLOBAL(_restvr_23)
137 ++ li r11,-144
138 ++ lvx vr23,r11,r0
139 ++_GLOBAL(_restvr_24)
140 ++ li r11,-128
141 ++ lvx vr24,r11,r0
142 ++_GLOBAL(_restvr_25)
143 ++ li r11,-112
144 ++ lvx vr25,r11,r0
145 ++_GLOBAL(_restvr_26)
146 ++ li r11,-96
147 ++ lvx vr26,r11,r0
148 ++_GLOBAL(_restvr_27)
149 ++ li r11,-80
150 ++ lvx vr27,r11,r0
151 ++_GLOBAL(_restvr_28)
152 ++ li r11,-64
153 ++ lvx vr28,r11,r0
154 ++_GLOBAL(_restvr_29)
155 ++ li r11,-48
156 ++ lvx vr29,r11,r0
157 ++_GLOBAL(_restvr_30)
158 ++ li r11,-32
159 ++ lvx vr30,r11,r0
160 ++_GLOBAL(_restvr_31)
161 ++ li r11,-16
162 ++ lvx vr31,r11,r0
163 ++ blr
164 ++
165 ++#endif /* CONFIG_ALTIVEC */
166 ++
167 + #else /* CONFIG_PPC64 */
168 +
169 + .section ".text.save.restore","ax",@progbits
170 +@@ -356,6 +437,111 @@ _restgpr0_31:
171 + mtlr r0
172 + blr
173 +
174 ++#ifdef CONFIG_ALTIVEC
175 ++/* Called with r0 pointing just beyond the end of the vector save area. */
176 ++
177 ++.globl _savevr_20
178 ++_savevr_20:
179 ++ li r12,-192
180 ++ stvx vr20,r12,r0
181 ++.globl _savevr_21
182 ++_savevr_21:
183 ++ li r12,-176
184 ++ stvx vr21,r12,r0
185 ++.globl _savevr_22
186 ++_savevr_22:
187 ++ li r12,-160
188 ++ stvx vr22,r12,r0
189 ++.globl _savevr_23
190 ++_savevr_23:
191 ++ li r12,-144
192 ++ stvx vr23,r12,r0
193 ++.globl _savevr_24
194 ++_savevr_24:
195 ++ li r12,-128
196 ++ stvx vr24,r12,r0
197 ++.globl _savevr_25
198 ++_savevr_25:
199 ++ li r12,-112
200 ++ stvx vr25,r12,r0
201 ++.globl _savevr_26
202 ++_savevr_26:
203 ++ li r12,-96
204 ++ stvx vr26,r12,r0
205 ++.globl _savevr_27
206 ++_savevr_27:
207 ++ li r12,-80
208 ++ stvx vr27,r12,r0
209 ++.globl _savevr_28
210 ++_savevr_28:
211 ++ li r12,-64
212 ++ stvx vr28,r12,r0
213 ++.globl _savevr_29
214 ++_savevr_29:
215 ++ li r12,-48
216 ++ stvx vr29,r12,r0
217 ++.globl _savevr_30
218 ++_savevr_30:
219 ++ li r12,-32
220 ++ stvx vr30,r12,r0
221 ++.globl _savevr_31
222 ++_savevr_31:
223 ++ li r12,-16
224 ++ stvx vr31,r12,r0
225 ++ blr
226 ++
227 ++.globl _restvr_20
228 ++_restvr_20:
229 ++ li r12,-192
230 ++ lvx vr20,r12,r0
231 ++.globl _restvr_21
232 ++_restvr_21:
233 ++ li r12,-176
234 ++ lvx vr21,r12,r0
235 ++.globl _restvr_22
236 ++_restvr_22:
237 ++ li r12,-160
238 ++ lvx vr22,r12,r0
239 ++.globl _restvr_23
240 ++_restvr_23:
241 ++ li r12,-144
242 ++ lvx vr23,r12,r0
243 ++.globl _restvr_24
244 ++_restvr_24:
245 ++ li r12,-128
246 ++ lvx vr24,r12,r0
247 ++.globl _restvr_25
248 ++_restvr_25:
249 ++ li r12,-112
250 ++ lvx vr25,r12,r0
251 ++.globl _restvr_26
252 ++_restvr_26:
253 ++ li r12,-96
254 ++ lvx vr26,r12,r0
255 ++.globl _restvr_27
256 ++_restvr_27:
257 ++ li r12,-80
258 ++ lvx vr27,r12,r0
259 ++.globl _restvr_28
260 ++_restvr_28:
261 ++ li r12,-64
262 ++ lvx vr28,r12,r0
263 ++.globl _restvr_29
264 ++_restvr_29:
265 ++ li r12,-48
266 ++ lvx vr29,r12,r0
267 ++.globl _restvr_30
268 ++_restvr_30:
269 ++ li r12,-32
270 ++ lvx vr30,r12,r0
271 ++.globl _restvr_31
272 ++_restvr_31:
273 ++ li r12,-16
274 ++ lvx vr31,r12,r0
275 ++ blr
276 ++
277 ++#endif /* CONFIG_ALTIVEC */
278 ++
279 + #endif /* CONFIG_PPC64 */
280 +
281 + #endif
282 +diff --git a/block/blk-core.c b/block/blk-core.c
283 +index 2c66daba44dd..5a750b18172e 100644
284 +--- a/block/blk-core.c
285 ++++ b/block/blk-core.c
286 +@@ -2299,7 +2299,7 @@ bool blk_update_request(struct request *req, int error, unsigned int nr_bytes)
287 + if (!req->bio)
288 + return false;
289 +
290 +- trace_block_rq_complete(req->q, req);
291 ++ trace_block_rq_complete(req->q, req, nr_bytes);
292 +
293 + /*
294 + * For fs requests, rq is just carrier of independent bio's
295 +diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c
296 +index c421fa528518..1e89a3dd3d51 100644
297 +--- a/drivers/block/rbd.c
298 ++++ b/drivers/block/rbd.c
299 +@@ -2278,7 +2278,7 @@ out_partial:
300 + rbd_obj_request_put(obj_request);
301 + out_unwind:
302 + for_each_obj_request_safe(img_request, obj_request, next_obj_request)
303 +- rbd_obj_request_put(obj_request);
304 ++ rbd_img_obj_request_del(img_request, obj_request);
305 +
306 + return -ENOMEM;
307 + }
308 +diff --git a/drivers/firewire/ohci.c b/drivers/firewire/ohci.c
309 +index afb701ec90ca..0f3e3047e29c 100644
310 +--- a/drivers/firewire/ohci.c
311 ++++ b/drivers/firewire/ohci.c
312 +@@ -271,6 +271,7 @@ static inline struct fw_ohci *fw_ohci(struct fw_card *card)
313 +
314 + static char ohci_driver_name[] = KBUILD_MODNAME;
315 +
316 ++#define PCI_VENDOR_ID_PINNACLE_SYSTEMS 0x11bd
317 + #define PCI_DEVICE_ID_AGERE_FW643 0x5901
318 + #define PCI_DEVICE_ID_CREATIVE_SB1394 0x4001
319 + #define PCI_DEVICE_ID_JMICRON_JMB38X_FW 0x2380
320 +@@ -278,17 +279,15 @@ static char ohci_driver_name[] = KBUILD_MODNAME;
321 + #define PCI_DEVICE_ID_TI_TSB12LV26 0x8020
322 + #define PCI_DEVICE_ID_TI_TSB82AA2 0x8025
323 + #define PCI_DEVICE_ID_VIA_VT630X 0x3044
324 +-#define PCI_VENDOR_ID_PINNACLE_SYSTEMS 0x11bd
325 + #define PCI_REV_ID_VIA_VT6306 0x46
326 +
327 +-#define QUIRK_CYCLE_TIMER 1
328 +-#define QUIRK_RESET_PACKET 2
329 +-#define QUIRK_BE_HEADERS 4
330 +-#define QUIRK_NO_1394A 8
331 +-#define QUIRK_NO_MSI 16
332 +-#define QUIRK_TI_SLLZ059 32
333 +-#define QUIRK_IR_WAKE 64
334 +-#define QUIRK_PHY_LCTRL_TIMEOUT 128
335 ++#define QUIRK_CYCLE_TIMER 0x1
336 ++#define QUIRK_RESET_PACKET 0x2
337 ++#define QUIRK_BE_HEADERS 0x4
338 ++#define QUIRK_NO_1394A 0x8
339 ++#define QUIRK_NO_MSI 0x10
340 ++#define QUIRK_TI_SLLZ059 0x20
341 ++#define QUIRK_IR_WAKE 0x40
342 +
343 + /* In case of multiple matches in ohci_quirks[], only the first one is used. */
344 + static const struct {
345 +@@ -301,10 +300,7 @@ static const struct {
346 + QUIRK_BE_HEADERS},
347 +
348 + {PCI_VENDOR_ID_ATT, PCI_DEVICE_ID_AGERE_FW643, 6,
349 +- QUIRK_PHY_LCTRL_TIMEOUT | QUIRK_NO_MSI},
350 +-
351 +- {PCI_VENDOR_ID_ATT, PCI_ANY_ID, PCI_ANY_ID,
352 +- QUIRK_PHY_LCTRL_TIMEOUT},
353 ++ QUIRK_NO_MSI},
354 +
355 + {PCI_VENDOR_ID_CREATIVE, PCI_DEVICE_ID_CREATIVE_SB1394, PCI_ANY_ID,
356 + QUIRK_RESET_PACKET},
357 +@@ -351,7 +347,6 @@ MODULE_PARM_DESC(quirks, "Chip quirks (default = 0"
358 + ", disable MSI = " __stringify(QUIRK_NO_MSI)
359 + ", TI SLLZ059 erratum = " __stringify(QUIRK_TI_SLLZ059)
360 + ", IR wake unreliable = " __stringify(QUIRK_IR_WAKE)
361 +- ", phy LCtrl timeout = " __stringify(QUIRK_PHY_LCTRL_TIMEOUT)
362 + ")");
363 +
364 + #define OHCI_PARAM_DEBUG_AT_AR 1
365 +@@ -2293,9 +2288,6 @@ static int ohci_enable(struct fw_card *card,
366 + * TI TSB82AA2 + TSB81BA3(A) cards signal LPS enabled early but
367 + * cannot actually use the phy at that time. These need tens of
368 + * millisecods pause between LPS write and first phy access too.
369 +- *
370 +- * But do not wait for 50msec on Agere/LSI cards. Their phy
371 +- * arbitration state machine may time out during such a long wait.
372 + */
373 +
374 + reg_write(ohci, OHCI1394_HCControlSet,
375 +@@ -2303,11 +2295,8 @@ static int ohci_enable(struct fw_card *card,
376 + OHCI1394_HCControl_postedWriteEnable);
377 + flush_writes(ohci);
378 +
379 +- if (!(ohci->quirks & QUIRK_PHY_LCTRL_TIMEOUT))
380 ++ for (lps = 0, i = 0; !lps && i < 3; i++) {
381 + msleep(50);
382 +-
383 +- for (lps = 0, i = 0; !lps && i < 150; i++) {
384 +- msleep(1);
385 + lps = reg_read(ohci, OHCI1394_HCControlSet) &
386 + OHCI1394_HCControl_LPS;
387 + }
388 +diff --git a/drivers/gpu/drm/qxl/qxl_ttm.c b/drivers/gpu/drm/qxl/qxl_ttm.c
389 +index 489cb8cece4d..3401eb86786c 100644
390 +--- a/drivers/gpu/drm/qxl/qxl_ttm.c
391 ++++ b/drivers/gpu/drm/qxl/qxl_ttm.c
392 +@@ -431,6 +431,7 @@ static int qxl_sync_obj_flush(void *sync_obj)
393 +
394 + static void qxl_sync_obj_unref(void **sync_obj)
395 + {
396 ++ *sync_obj = NULL;
397 + }
398 +
399 + static void *qxl_sync_obj_ref(void *sync_obj)
400 +diff --git a/drivers/gpu/drm/radeon/radeon_display.c b/drivers/gpu/drm/radeon/radeon_display.c
401 +index eb18bb7af1cc..06ccfe477650 100644
402 +--- a/drivers/gpu/drm/radeon/radeon_display.c
403 ++++ b/drivers/gpu/drm/radeon/radeon_display.c
404 +@@ -729,6 +729,7 @@ int radeon_ddc_get_modes(struct radeon_connector *radeon_connector)
405 + if (radeon_connector->edid) {
406 + drm_mode_connector_update_edid_property(&radeon_connector->base, radeon_connector->edid);
407 + ret = drm_add_edid_modes(&radeon_connector->base, radeon_connector->edid);
408 ++ drm_edid_to_eld(&radeon_connector->base, radeon_connector->edid);
409 + return ret;
410 + }
411 + drm_mode_connector_update_edid_property(&radeon_connector->base, NULL);
412 +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
413 +index 394e6476105b..da068bd13f92 100644
414 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
415 ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
416 +@@ -834,14 +834,36 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv,
417 + SVGA3dCmdSurfaceDMA dma;
418 + } *cmd;
419 + int ret;
420 ++ SVGA3dCmdSurfaceDMASuffix *suffix;
421 ++ uint32_t bo_size;
422 +
423 + cmd = container_of(header, struct vmw_dma_cmd, header);
424 ++ suffix = (SVGA3dCmdSurfaceDMASuffix *)((unsigned long) &cmd->dma +
425 ++ header->size - sizeof(*suffix));
426 ++
427 ++ /* Make sure device and verifier stays in sync. */
428 ++ if (unlikely(suffix->suffixSize != sizeof(*suffix))) {
429 ++ DRM_ERROR("Invalid DMA suffix size.\n");
430 ++ return -EINVAL;
431 ++ }
432 ++
433 + ret = vmw_translate_guest_ptr(dev_priv, sw_context,
434 + &cmd->dma.guest.ptr,
435 + &vmw_bo);
436 + if (unlikely(ret != 0))
437 + return ret;
438 +
439 ++ /* Make sure DMA doesn't cross BO boundaries. */
440 ++ bo_size = vmw_bo->base.num_pages * PAGE_SIZE;
441 ++ if (unlikely(cmd->dma.guest.ptr.offset > bo_size)) {
442 ++ DRM_ERROR("Invalid DMA offset.\n");
443 ++ return -EINVAL;
444 ++ }
445 ++
446 ++ bo_size -= cmd->dma.guest.ptr.offset;
447 ++ if (unlikely(suffix->maximumOffset > bo_size))
448 ++ suffix->maximumOffset = bo_size;
449 ++
450 + ret = vmw_cmd_res_check(dev_priv, sw_context, vmw_res_surface,
451 + user_surface_converter, &cmd->dma.host.sid,
452 + NULL);
453 +diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
454 +index ed5ce2a41bbf..021b5227e783 100644
455 +--- a/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
456 ++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_fb.c
457 +@@ -147,7 +147,7 @@ static int vmw_fb_check_var(struct fb_var_screeninfo *var,
458 + }
459 +
460 + if (!vmw_kms_validate_mode_vram(vmw_priv,
461 +- info->fix.line_length,
462 ++ var->xres * var->bits_per_pixel/8,
463 + var->yoffset + var->yres)) {
464 + DRM_ERROR("Requested geom can not fit in framebuffer\n");
465 + return -EINVAL;
466 +@@ -162,6 +162,8 @@ static int vmw_fb_set_par(struct fb_info *info)
467 + struct vmw_private *vmw_priv = par->vmw_priv;
468 + int ret;
469 +
470 ++ info->fix.line_length = info->var.xres * info->var.bits_per_pixel/8;
471 ++
472 + ret = vmw_kms_write_svga(vmw_priv, info->var.xres, info->var.yres,
473 + info->fix.line_length,
474 + par->bpp, par->depth);
475 +@@ -177,6 +179,7 @@ static int vmw_fb_set_par(struct fb_info *info)
476 + vmw_write(vmw_priv, SVGA_REG_DISPLAY_POSITION_Y, info->var.yoffset);
477 + vmw_write(vmw_priv, SVGA_REG_DISPLAY_WIDTH, info->var.xres);
478 + vmw_write(vmw_priv, SVGA_REG_DISPLAY_HEIGHT, info->var.yres);
479 ++ vmw_write(vmw_priv, SVGA_REG_BYTES_PER_LINE, info->fix.line_length);
480 + vmw_write(vmw_priv, SVGA_REG_DISPLAY_ID, SVGA_ID_INVALID);
481 + }
482 +
483 +diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
484 +index e73740b55aea..75771b2077c0 100644
485 +--- a/drivers/md/raid1.c
486 ++++ b/drivers/md/raid1.c
487 +@@ -94,6 +94,7 @@ static void * r1buf_pool_alloc(gfp_t gfp_flags, void *data)
488 + struct pool_info *pi = data;
489 + struct r1bio *r1_bio;
490 + struct bio *bio;
491 ++ int need_pages;
492 + int i, j;
493 +
494 + r1_bio = r1bio_pool_alloc(gfp_flags, pi);
495 +@@ -116,15 +117,15 @@ static void * r1buf_pool_alloc(gfp_t gfp_flags, void *data)
496 + * RESYNC_PAGES for each bio.
497 + */
498 + if (test_bit(MD_RECOVERY_REQUESTED, &pi->mddev->recovery))
499 +- j = pi->raid_disks;
500 ++ need_pages = pi->raid_disks;
501 + else
502 +- j = 1;
503 +- while(j--) {
504 ++ need_pages = 1;
505 ++ for (j = 0; j < need_pages; j++) {
506 + bio = r1_bio->bios[j];
507 + bio->bi_vcnt = RESYNC_PAGES;
508 +
509 + if (bio_alloc_pages(bio, gfp_flags))
510 +- goto out_free_bio;
511 ++ goto out_free_pages;
512 + }
513 + /* If not user-requests, copy the page pointers to all bios */
514 + if (!test_bit(MD_RECOVERY_REQUESTED, &pi->mddev->recovery)) {
515 +@@ -138,6 +139,14 @@ static void * r1buf_pool_alloc(gfp_t gfp_flags, void *data)
516 +
517 + return r1_bio;
518 +
519 ++out_free_pages:
520 ++ while (--j >= 0) {
521 ++ struct bio_vec *bv;
522 ++
523 ++ bio_for_each_segment_all(bv, r1_bio->bios[j], i)
524 ++ __free_page(bv->bv_page);
525 ++ }
526 ++
527 + out_free_bio:
528 + while (++j < pi->raid_disks)
529 + bio_put(r1_bio->bios[j]);
530 +diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
531 +index 8395b0992a89..b143ce91e081 100644
532 +--- a/drivers/net/bonding/bond_main.c
533 ++++ b/drivers/net/bonding/bond_main.c
534 +@@ -4995,6 +4995,7 @@ static int __init bonding_init(void)
535 + out:
536 + return res;
537 + err:
538 ++ bond_destroy_debugfs();
539 + rtnl_link_unregister(&bond_link_ops);
540 + err_link:
541 + unregister_pernet_subsys(&bond_net_ops);
542 +diff --git a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
543 +index 32a9609cc98b..fd50781e996c 100644
544 +--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
545 ++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_sp.c
546 +@@ -1038,9 +1038,6 @@ static void bnx2x_set_one_vlan_mac_e1h(struct bnx2x *bp,
547 + ETH_VLAN_FILTER_CLASSIFY, config);
548 + }
549 +
550 +-#define list_next_entry(pos, member) \
551 +- list_entry((pos)->member.next, typeof(*(pos)), member)
552 +-
553 + /**
554 + * bnx2x_vlan_mac_restore - reconfigure next MAC/VLAN/VLAN-MAC element
555 + *
556 +diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
557 +index 4a0db617ab64..4942ddf9c8ae 100644
558 +--- a/drivers/net/ethernet/broadcom/tg3.c
559 ++++ b/drivers/net/ethernet/broadcom/tg3.c
560 +@@ -12073,7 +12073,9 @@ static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *e
561 + if (tg3_flag(tp, MAX_RXPEND_64) &&
562 + tp->rx_pending > 63)
563 + tp->rx_pending = 63;
564 +- tp->rx_jumbo_pending = ering->rx_jumbo_pending;
565 ++
566 ++ if (tg3_flag(tp, JUMBO_RING_ENABLE))
567 ++ tp->rx_jumbo_pending = ering->rx_jumbo_pending;
568 +
569 + for (i = 0; i < tp->irq_max; i++)
570 + tp->napi[i].tx_pending = ering->tx_pending;
571 +diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
572 +index 06eba6e480c9..c12aeaee22fa 100644
573 +--- a/drivers/net/macvlan.c
574 ++++ b/drivers/net/macvlan.c
575 +@@ -261,11 +261,9 @@ static int macvlan_queue_xmit(struct sk_buff *skb, struct net_device *dev)
576 + const struct macvlan_dev *vlan = netdev_priv(dev);
577 + const struct macvlan_port *port = vlan->port;
578 + const struct macvlan_dev *dest;
579 +- __u8 ip_summed = skb->ip_summed;
580 +
581 + if (vlan->mode == MACVLAN_MODE_BRIDGE) {
582 + const struct ethhdr *eth = (void *)skb->data;
583 +- skb->ip_summed = CHECKSUM_UNNECESSARY;
584 +
585 + /* send to other bridge ports directly */
586 + if (is_multicast_ether_addr(eth->h_dest)) {
587 +@@ -283,7 +281,6 @@ static int macvlan_queue_xmit(struct sk_buff *skb, struct net_device *dev)
588 + }
589 +
590 + xmit_world:
591 +- skb->ip_summed = ip_summed;
592 + skb->dev = vlan->lowerdev;
593 + return dev_queue_xmit(skb);
594 + }
595 +@@ -423,8 +420,10 @@ static void macvlan_change_rx_flags(struct net_device *dev, int change)
596 + struct macvlan_dev *vlan = netdev_priv(dev);
597 + struct net_device *lowerdev = vlan->lowerdev;
598 +
599 +- if (change & IFF_ALLMULTI)
600 +- dev_set_allmulti(lowerdev, dev->flags & IFF_ALLMULTI ? 1 : -1);
601 ++ if (dev->flags & IFF_UP) {
602 ++ if (change & IFF_ALLMULTI)
603 ++ dev_set_allmulti(lowerdev, dev->flags & IFF_ALLMULTI ? 1 : -1);
604 ++ }
605 + }
606 +
607 + static void macvlan_set_mac_lists(struct net_device *dev)
608 +diff --git a/drivers/net/usb/cdc_mbim.c b/drivers/net/usb/cdc_mbim.c
609 +index 25ba7eca9a13..7cabe4583904 100644
610 +--- a/drivers/net/usb/cdc_mbim.c
611 ++++ b/drivers/net/usb/cdc_mbim.c
612 +@@ -120,6 +120,16 @@ static void cdc_mbim_unbind(struct usbnet *dev, struct usb_interface *intf)
613 + cdc_ncm_unbind(dev, intf);
614 + }
615 +
616 ++/* verify that the ethernet protocol is IPv4 or IPv6 */
617 ++static bool is_ip_proto(__be16 proto)
618 ++{
619 ++ switch (proto) {
620 ++ case htons(ETH_P_IP):
621 ++ case htons(ETH_P_IPV6):
622 ++ return true;
623 ++ }
624 ++ return false;
625 ++}
626 +
627 + static struct sk_buff *cdc_mbim_tx_fixup(struct usbnet *dev, struct sk_buff *skb, gfp_t flags)
628 + {
629 +@@ -128,6 +138,7 @@ static struct sk_buff *cdc_mbim_tx_fixup(struct usbnet *dev, struct sk_buff *skb
630 + struct cdc_ncm_ctx *ctx = info->ctx;
631 + __le32 sign = cpu_to_le32(USB_CDC_MBIM_NDP16_IPS_SIGN);
632 + u16 tci = 0;
633 ++ bool is_ip;
634 + u8 *c;
635 +
636 + if (!ctx)
637 +@@ -137,25 +148,32 @@ static struct sk_buff *cdc_mbim_tx_fixup(struct usbnet *dev, struct sk_buff *skb
638 + if (skb->len <= ETH_HLEN)
639 + goto error;
640 +
641 ++ /* Some applications using e.g. packet sockets will
642 ++ * bypass the VLAN acceleration and create tagged
643 ++ * ethernet frames directly. We primarily look for
644 ++ * the accelerated out-of-band tag, but fall back if
645 ++ * required
646 ++ */
647 ++ skb_reset_mac_header(skb);
648 ++ if (vlan_get_tag(skb, &tci) < 0 && skb->len > VLAN_ETH_HLEN &&
649 ++ __vlan_get_tag(skb, &tci) == 0) {
650 ++ is_ip = is_ip_proto(vlan_eth_hdr(skb)->h_vlan_encapsulated_proto);
651 ++ skb_pull(skb, VLAN_ETH_HLEN);
652 ++ } else {
653 ++ is_ip = is_ip_proto(eth_hdr(skb)->h_proto);
654 ++ skb_pull(skb, ETH_HLEN);
655 ++ }
656 ++
657 + /* mapping VLANs to MBIM sessions:
658 + * no tag => IPS session <0>
659 + * 1 - 255 => IPS session <vlanid>
660 + * 256 - 511 => DSS session <vlanid - 256>
661 + * 512 - 4095 => unsupported, drop
662 + */
663 +- vlan_get_tag(skb, &tci);
664 +-
665 + switch (tci & 0x0f00) {
666 + case 0x0000: /* VLAN ID 0 - 255 */
667 +- /* verify that datagram is IPv4 or IPv6 */
668 +- skb_reset_mac_header(skb);
669 +- switch (eth_hdr(skb)->h_proto) {
670 +- case htons(ETH_P_IP):
671 +- case htons(ETH_P_IPV6):
672 +- break;
673 +- default:
674 ++ if (!is_ip)
675 + goto error;
676 +- }
677 + c = (u8 *)&sign;
678 + c[3] = tci;
679 + break;
680 +@@ -169,7 +187,6 @@ static struct sk_buff *cdc_mbim_tx_fixup(struct usbnet *dev, struct sk_buff *skb
681 + "unsupported tci=0x%04x\n", tci);
682 + goto error;
683 + }
684 +- skb_pull(skb, ETH_HLEN);
685 + }
686 +
687 + spin_lock_bh(&ctx->mtx);
688 +diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
689 +index 37d9785974fc..7be4860ccfd7 100644
690 +--- a/drivers/net/usb/qmi_wwan.c
691 ++++ b/drivers/net/usb/qmi_wwan.c
692 +@@ -649,9 +649,26 @@ static const struct usb_device_id products[] = {
693 + {QMI_FIXED_INTF(0x05c6, 0x920d, 5)},
694 + {QMI_FIXED_INTF(0x12d1, 0x140c, 1)}, /* Huawei E173 */
695 + {QMI_FIXED_INTF(0x12d1, 0x14ac, 1)}, /* Huawei E1820 */
696 ++ {QMI_FIXED_INTF(0x16d8, 0x6003, 0)}, /* CMOTech 6003 */
697 ++ {QMI_FIXED_INTF(0x16d8, 0x6007, 0)}, /* CMOTech CHE-628S */
698 ++ {QMI_FIXED_INTF(0x16d8, 0x6008, 0)}, /* CMOTech CMU-301 */
699 ++ {QMI_FIXED_INTF(0x16d8, 0x6280, 0)}, /* CMOTech CHU-628 */
700 ++ {QMI_FIXED_INTF(0x16d8, 0x7001, 0)}, /* CMOTech CHU-720S */
701 ++ {QMI_FIXED_INTF(0x16d8, 0x7002, 0)}, /* CMOTech 7002 */
702 ++ {QMI_FIXED_INTF(0x16d8, 0x7003, 4)}, /* CMOTech CHU-629K */
703 ++ {QMI_FIXED_INTF(0x16d8, 0x7004, 3)}, /* CMOTech 7004 */
704 ++ {QMI_FIXED_INTF(0x16d8, 0x7006, 5)}, /* CMOTech CGU-629 */
705 ++ {QMI_FIXED_INTF(0x16d8, 0x700a, 4)}, /* CMOTech CHU-629S */
706 ++ {QMI_FIXED_INTF(0x16d8, 0x7211, 0)}, /* CMOTech CHU-720I */
707 ++ {QMI_FIXED_INTF(0x16d8, 0x7212, 0)}, /* CMOTech 7212 */
708 ++ {QMI_FIXED_INTF(0x16d8, 0x7213, 0)}, /* CMOTech 7213 */
709 ++ {QMI_FIXED_INTF(0x16d8, 0x7251, 1)}, /* CMOTech 7251 */
710 ++ {QMI_FIXED_INTF(0x16d8, 0x7252, 1)}, /* CMOTech 7252 */
711 ++ {QMI_FIXED_INTF(0x16d8, 0x7253, 1)}, /* CMOTech 7253 */
712 + {QMI_FIXED_INTF(0x19d2, 0x0002, 1)},
713 + {QMI_FIXED_INTF(0x19d2, 0x0012, 1)},
714 + {QMI_FIXED_INTF(0x19d2, 0x0017, 3)},
715 ++ {QMI_FIXED_INTF(0x19d2, 0x0019, 3)}, /* ONDA MT689DC */
716 + {QMI_FIXED_INTF(0x19d2, 0x0021, 4)},
717 + {QMI_FIXED_INTF(0x19d2, 0x0025, 1)},
718 + {QMI_FIXED_INTF(0x19d2, 0x0031, 4)},
719 +@@ -698,6 +715,7 @@ static const struct usb_device_id products[] = {
720 + {QMI_FIXED_INTF(0x19d2, 0x1255, 3)},
721 + {QMI_FIXED_INTF(0x19d2, 0x1255, 4)},
722 + {QMI_FIXED_INTF(0x19d2, 0x1256, 4)},
723 ++ {QMI_FIXED_INTF(0x19d2, 0x1270, 5)}, /* ZTE MF667 */
724 + {QMI_FIXED_INTF(0x19d2, 0x1401, 2)},
725 + {QMI_FIXED_INTF(0x19d2, 0x1402, 2)}, /* ZTE MF60 */
726 + {QMI_FIXED_INTF(0x19d2, 0x1424, 2)},
727 +@@ -708,12 +726,28 @@ static const struct usb_device_id products[] = {
728 + {QMI_FIXED_INTF(0x114f, 0x68a2, 8)}, /* Sierra Wireless MC7750 */
729 + {QMI_FIXED_INTF(0x1199, 0x68a2, 8)}, /* Sierra Wireless MC7710 in QMI mode */
730 + {QMI_FIXED_INTF(0x1199, 0x68a2, 19)}, /* Sierra Wireless MC7710 in QMI mode */
731 ++ {QMI_FIXED_INTF(0x1199, 0x68c0, 8)}, /* Sierra Wireless MC73xx */
732 ++ {QMI_FIXED_INTF(0x1199, 0x68c0, 10)}, /* Sierra Wireless MC73xx */
733 ++ {QMI_FIXED_INTF(0x1199, 0x68c0, 11)}, /* Sierra Wireless MC73xx */
734 + {QMI_FIXED_INTF(0x1199, 0x901c, 8)}, /* Sierra Wireless EM7700 */
735 ++ {QMI_FIXED_INTF(0x1199, 0x901f, 8)}, /* Sierra Wireless EM7355 */
736 ++ {QMI_FIXED_INTF(0x1199, 0x9041, 8)}, /* Sierra Wireless MC7305/MC7355 */
737 + {QMI_FIXED_INTF(0x1199, 0x9051, 8)}, /* Netgear AirCard 340U */
738 + {QMI_FIXED_INTF(0x1bbb, 0x011e, 4)}, /* Telekom Speedstick LTE II (Alcatel One Touch L100V LTE) */
739 ++ {QMI_FIXED_INTF(0x1bbb, 0x0203, 2)}, /* Alcatel L800MA */
740 + {QMI_FIXED_INTF(0x2357, 0x0201, 4)}, /* TP-LINK HSUPA Modem MA180 */
741 ++ {QMI_FIXED_INTF(0x2357, 0x9000, 4)}, /* TP-LINK MA260 */
742 + {QMI_FIXED_INTF(0x1bc7, 0x1200, 5)}, /* Telit LE920 */
743 +- {QMI_FIXED_INTF(0x1e2d, 0x12d1, 4)}, /* Cinterion PLxx */
744 ++ {QMI_FIXED_INTF(0x1bc7, 0x1201, 2)}, /* Telit LE920 */
745 ++ {QMI_FIXED_INTF(0x0b3c, 0xc005, 6)}, /* Olivetti Olicard 200 */
746 ++ {QMI_FIXED_INTF(0x0b3c, 0xc00b, 4)}, /* Olivetti Olicard 500 */
747 ++ {QMI_FIXED_INTF(0x1e2d, 0x0060, 4)}, /* Cinterion PLxx */
748 ++ {QMI_FIXED_INTF(0x1e2d, 0x0053, 4)}, /* Cinterion PHxx,PXxx */
749 ++ {QMI_FIXED_INTF(0x413c, 0x81a2, 8)}, /* Dell Wireless 5806 Gobi(TM) 4G LTE Mobile Broadband Card */
750 ++ {QMI_FIXED_INTF(0x413c, 0x81a3, 8)}, /* Dell Wireless 5570 HSPA+ (42Mbps) Mobile Broadband Card */
751 ++ {QMI_FIXED_INTF(0x413c, 0x81a4, 8)}, /* Dell Wireless 5570e HSPA+ (42Mbps) Mobile Broadband Card */
752 ++ {QMI_FIXED_INTF(0x413c, 0x81a8, 8)}, /* Dell Wireless 5808 Gobi(TM) 4G LTE Mobile Broadband Card */
753 ++ {QMI_FIXED_INTF(0x413c, 0x81a9, 8)}, /* Dell Wireless 5808e Gobi(TM) 4G LTE Mobile Broadband Card */
754 +
755 + /* 4. Gobi 1000 devices */
756 + {QMI_GOBI1K_DEVICE(0x05c6, 0x9212)}, /* Acer Gobi Modem Device */
757 +@@ -747,6 +781,7 @@ static const struct usb_device_id products[] = {
758 + {QMI_GOBI_DEVICE(0x05c6, 0x9265)}, /* Asus Gobi 2000 Modem device (VR305) */
759 + {QMI_GOBI_DEVICE(0x05c6, 0x9235)}, /* Top Global Gobi 2000 Modem device (VR306) */
760 + {QMI_GOBI_DEVICE(0x05c6, 0x9275)}, /* iRex Technologies Gobi 2000 Modem device (VR307) */
761 ++ {QMI_GOBI_DEVICE(0x0af0, 0x8120)}, /* Option GTM681W */
762 + {QMI_GOBI_DEVICE(0x1199, 0x68a5)}, /* Sierra Wireless Modem */
763 + {QMI_GOBI_DEVICE(0x1199, 0x68a9)}, /* Sierra Wireless Modem */
764 + {QMI_GOBI_DEVICE(0x1199, 0x9001)}, /* Sierra Wireless Gobi 2000 Modem device (VT773) */
765 +@@ -760,7 +795,6 @@ static const struct usb_device_id products[] = {
766 + {QMI_GOBI_DEVICE(0x1199, 0x9009)}, /* Sierra Wireless Gobi 2000 Modem device (VT773) */
767 + {QMI_GOBI_DEVICE(0x1199, 0x900a)}, /* Sierra Wireless Gobi 2000 Modem device (VT773) */
768 + {QMI_GOBI_DEVICE(0x1199, 0x9011)}, /* Sierra Wireless Gobi 2000 Modem device (MC8305) */
769 +- {QMI_FIXED_INTF(0x1199, 0x9011, 5)}, /* alternate interface number!? */
770 + {QMI_GOBI_DEVICE(0x16d8, 0x8002)}, /* CMDTech Gobi 2000 Modem device (VU922) */
771 + {QMI_GOBI_DEVICE(0x05c6, 0x9205)}, /* Gobi 2000 Modem device */
772 + {QMI_GOBI_DEVICE(0x1199, 0x9013)}, /* Sierra Wireless Gobi 3000 Modem device (MC8355) */
773 +diff --git a/drivers/scsi/megaraid/megaraid_mm.c b/drivers/scsi/megaraid/megaraid_mm.c
774 +index 25506c777381..9bec1717047e 100644
775 +--- a/drivers/scsi/megaraid/megaraid_mm.c
776 ++++ b/drivers/scsi/megaraid/megaraid_mm.c
777 +@@ -486,6 +486,8 @@ mimd_to_kioc(mimd_t __user *umimd, mraid_mmadp_t *adp, uioc_t *kioc)
778 +
779 + pthru32->dataxferaddr = kioc->buf_paddr;
780 + if (kioc->data_dir & UIOC_WR) {
781 ++ if (pthru32->dataxferlen > kioc->xferlen)
782 ++ return -EINVAL;
783 + if (copy_from_user(kioc->buf_vaddr, kioc->user_data,
784 + pthru32->dataxferlen)) {
785 + return (-EFAULT);
786 +diff --git a/drivers/scsi/scsi_scan.c b/drivers/scsi/scsi_scan.c
787 +index 3e58b2245f1f..859240408f9e 100644
788 +--- a/drivers/scsi/scsi_scan.c
789 ++++ b/drivers/scsi/scsi_scan.c
790 +@@ -320,6 +320,7 @@ static void scsi_target_destroy(struct scsi_target *starget)
791 + struct Scsi_Host *shost = dev_to_shost(dev->parent);
792 + unsigned long flags;
793 +
794 ++ starget->state = STARGET_DEL;
795 + transport_destroy_device(dev);
796 + spin_lock_irqsave(shost->host_lock, flags);
797 + if (shost->hostt->target_destroy)
798 +@@ -371,6 +372,37 @@ static struct scsi_target *__scsi_find_target(struct device *parent,
799 + }
800 +
801 + /**
802 ++ * scsi_target_reap_ref_release - remove target from visibility
803 ++ * @kref: the reap_ref in the target being released
804 ++ *
805 ++ * Called on last put of reap_ref, which is the indication that no device
806 ++ * under this target is visible anymore, so render the target invisible in
807 ++ * sysfs. Note: we have to be in user context here because the target reaps
808 ++ * should be done in places where the scsi device visibility is being removed.
809 ++ */
810 ++static void scsi_target_reap_ref_release(struct kref *kref)
811 ++{
812 ++ struct scsi_target *starget
813 ++ = container_of(kref, struct scsi_target, reap_ref);
814 ++
815 ++ /*
816 ++ * if we get here and the target is still in the CREATED state that
817 ++ * means it was allocated but never made visible (because a scan
818 ++ * turned up no LUNs), so don't call device_del() on it.
819 ++ */
820 ++ if (starget->state != STARGET_CREATED) {
821 ++ transport_remove_device(&starget->dev);
822 ++ device_del(&starget->dev);
823 ++ }
824 ++ scsi_target_destroy(starget);
825 ++}
826 ++
827 ++static void scsi_target_reap_ref_put(struct scsi_target *starget)
828 ++{
829 ++ kref_put(&starget->reap_ref, scsi_target_reap_ref_release);
830 ++}
831 ++
832 ++/**
833 + * scsi_alloc_target - allocate a new or find an existing target
834 + * @parent: parent of the target (need not be a scsi host)
835 + * @channel: target channel number (zero if no channels)
836 +@@ -392,7 +424,7 @@ static struct scsi_target *scsi_alloc_target(struct device *parent,
837 + + shost->transportt->target_size;
838 + struct scsi_target *starget;
839 + struct scsi_target *found_target;
840 +- int error;
841 ++ int error, ref_got;
842 +
843 + starget = kzalloc(size, GFP_KERNEL);
844 + if (!starget) {
845 +@@ -401,7 +433,7 @@ static struct scsi_target *scsi_alloc_target(struct device *parent,
846 + }
847 + dev = &starget->dev;
848 + device_initialize(dev);
849 +- starget->reap_ref = 1;
850 ++ kref_init(&starget->reap_ref);
851 + dev->parent = get_device(parent);
852 + dev_set_name(dev, "target%d:%d:%d", shost->host_no, channel, id);
853 + dev->bus = &scsi_bus_type;
854 +@@ -441,29 +473,36 @@ static struct scsi_target *scsi_alloc_target(struct device *parent,
855 + return starget;
856 +
857 + found:
858 +- found_target->reap_ref++;
859 ++ /*
860 ++ * release routine already fired if kref is zero, so if we can still
861 ++ * take the reference, the target must be alive. If we can't, it must
862 ++ * be dying and we need to wait for a new target
863 ++ */
864 ++ ref_got = kref_get_unless_zero(&found_target->reap_ref);
865 ++
866 + spin_unlock_irqrestore(shost->host_lock, flags);
867 +- if (found_target->state != STARGET_DEL) {
868 ++ if (ref_got) {
869 + put_device(dev);
870 + return found_target;
871 + }
872 +- /* Unfortunately, we found a dying target; need to
873 +- * wait until it's dead before we can get a new one */
874 ++ /*
875 ++ * Unfortunately, we found a dying target; need to wait until it's
876 ++ * dead before we can get a new one. There is an anomaly here. We
877 ++ * *should* call scsi_target_reap() to balance the kref_get() of the
878 ++ * reap_ref above. However, since the target being released, it's
879 ++ * already invisible and the reap_ref is irrelevant. If we call
880 ++ * scsi_target_reap() we might spuriously do another device_del() on
881 ++ * an already invisible target.
882 ++ */
883 + put_device(&found_target->dev);
884 +- flush_scheduled_work();
885 ++ /*
886 ++ * length of time is irrelevant here, we just want to yield the CPU
887 ++ * for a tick to avoid busy waiting for the target to die.
888 ++ */
889 ++ msleep(1);
890 + goto retry;
891 + }
892 +
893 +-static void scsi_target_reap_usercontext(struct work_struct *work)
894 +-{
895 +- struct scsi_target *starget =
896 +- container_of(work, struct scsi_target, ew.work);
897 +-
898 +- transport_remove_device(&starget->dev);
899 +- device_del(&starget->dev);
900 +- scsi_target_destroy(starget);
901 +-}
902 +-
903 + /**
904 + * scsi_target_reap - check to see if target is in use and destroy if not
905 + * @starget: target to be checked
906 +@@ -474,28 +513,13 @@ static void scsi_target_reap_usercontext(struct work_struct *work)
907 + */
908 + void scsi_target_reap(struct scsi_target *starget)
909 + {
910 +- struct Scsi_Host *shost = dev_to_shost(starget->dev.parent);
911 +- unsigned long flags;
912 +- enum scsi_target_state state;
913 +- int empty = 0;
914 +-
915 +- spin_lock_irqsave(shost->host_lock, flags);
916 +- state = starget->state;
917 +- if (--starget->reap_ref == 0 && list_empty(&starget->devices)) {
918 +- empty = 1;
919 +- starget->state = STARGET_DEL;
920 +- }
921 +- spin_unlock_irqrestore(shost->host_lock, flags);
922 +-
923 +- if (!empty)
924 +- return;
925 +-
926 +- BUG_ON(state == STARGET_DEL);
927 +- if (state == STARGET_CREATED)
928 +- scsi_target_destroy(starget);
929 +- else
930 +- execute_in_process_context(scsi_target_reap_usercontext,
931 +- &starget->ew);
932 ++ /*
933 ++ * serious problem if this triggers: STARGET_DEL is only set in the if
934 ++ * the reap_ref drops to zero, so we're trying to do another final put
935 ++ * on an already released kref
936 ++ */
937 ++ BUG_ON(starget->state == STARGET_DEL);
938 ++ scsi_target_reap_ref_put(starget);
939 + }
940 +
941 + /**
942 +@@ -1527,6 +1551,10 @@ struct scsi_device *__scsi_add_device(struct Scsi_Host *shost, uint channel,
943 + }
944 + mutex_unlock(&shost->scan_mutex);
945 + scsi_autopm_put_target(starget);
946 ++ /*
947 ++ * paired with scsi_alloc_target(). Target will be destroyed unless
948 ++ * scsi_probe_and_add_lun made an underlying device visible
949 ++ */
950 + scsi_target_reap(starget);
951 + put_device(&starget->dev);
952 +
953 +@@ -1607,8 +1635,10 @@ static void __scsi_scan_target(struct device *parent, unsigned int channel,
954 +
955 + out_reap:
956 + scsi_autopm_put_target(starget);
957 +- /* now determine if the target has any children at all
958 +- * and if not, nuke it */
959 ++ /*
960 ++ * paired with scsi_alloc_target(): determine if the target has
961 ++ * any children at all and if not, nuke it
962 ++ */
963 + scsi_target_reap(starget);
964 +
965 + put_device(&starget->dev);
966 +diff --git a/drivers/scsi/scsi_sysfs.c b/drivers/scsi/scsi_sysfs.c
967 +index 931a7d954203..9e2dd478dd15 100644
968 +--- a/drivers/scsi/scsi_sysfs.c
969 ++++ b/drivers/scsi/scsi_sysfs.c
970 +@@ -332,17 +332,14 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
971 + {
972 + struct scsi_device *sdev;
973 + struct device *parent;
974 +- struct scsi_target *starget;
975 + struct list_head *this, *tmp;
976 + unsigned long flags;
977 +
978 + sdev = container_of(work, struct scsi_device, ew.work);
979 +
980 + parent = sdev->sdev_gendev.parent;
981 +- starget = to_scsi_target(parent);
982 +
983 + spin_lock_irqsave(sdev->host->host_lock, flags);
984 +- starget->reap_ref++;
985 + list_del(&sdev->siblings);
986 + list_del(&sdev->same_target_siblings);
987 + list_del(&sdev->starved_entry);
988 +@@ -362,8 +359,6 @@ static void scsi_device_dev_release_usercontext(struct work_struct *work)
989 + /* NULL queue means the device can't be used */
990 + sdev->request_queue = NULL;
991 +
992 +- scsi_target_reap(scsi_target(sdev));
993 +-
994 + kfree(sdev->inquiry);
995 + kfree(sdev);
996 +
997 +@@ -978,6 +973,13 @@ void __scsi_remove_device(struct scsi_device *sdev)
998 + sdev->host->hostt->slave_destroy(sdev);
999 + transport_destroy_device(dev);
1000 +
1001 ++ /*
1002 ++ * Paired with the kref_get() in scsi_sysfs_initialize(). We have
1003 ++ * remoed sysfs visibility from the device, so make the target
1004 ++ * invisible if this was the last device underneath it.
1005 ++ */
1006 ++ scsi_target_reap(scsi_target(sdev));
1007 ++
1008 + put_device(dev);
1009 + }
1010 +
1011 +@@ -1040,7 +1042,7 @@ void scsi_remove_target(struct device *dev)
1012 + continue;
1013 + if (starget->dev.parent == dev || &starget->dev == dev) {
1014 + /* assuming new targets arrive at the end */
1015 +- starget->reap_ref++;
1016 ++ kref_get(&starget->reap_ref);
1017 + spin_unlock_irqrestore(shost->host_lock, flags);
1018 + if (last)
1019 + scsi_target_reap(last);
1020 +@@ -1124,6 +1126,12 @@ void scsi_sysfs_device_initialize(struct scsi_device *sdev)
1021 + list_add_tail(&sdev->same_target_siblings, &starget->devices);
1022 + list_add_tail(&sdev->siblings, &shost->__devices);
1023 + spin_unlock_irqrestore(shost->host_lock, flags);
1024 ++ /*
1025 ++ * device can now only be removed via __scsi_remove_device() so hold
1026 ++ * the target. Target will be held in CREATED state until something
1027 ++ * beneath it becomes visible (in which case it moves to RUNNING)
1028 ++ */
1029 ++ kref_get(&starget->reap_ref);
1030 + }
1031 +
1032 + int scsi_is_sdev_device(const struct device *dev)
1033 +diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
1034 +index 81f59e8b7521..89cce1a32059 100644
1035 +--- a/drivers/usb/class/cdc-acm.c
1036 ++++ b/drivers/usb/class/cdc-acm.c
1037 +@@ -1574,13 +1574,27 @@ static const struct usb_device_id acm_ids[] = {
1038 + },
1039 + /* Motorola H24 HSPA module: */
1040 + { USB_DEVICE(0x22b8, 0x2d91) }, /* modem */
1041 +- { USB_DEVICE(0x22b8, 0x2d92) }, /* modem + diagnostics */
1042 +- { USB_DEVICE(0x22b8, 0x2d93) }, /* modem + AT port */
1043 +- { USB_DEVICE(0x22b8, 0x2d95) }, /* modem + AT port + diagnostics */
1044 +- { USB_DEVICE(0x22b8, 0x2d96) }, /* modem + NMEA */
1045 +- { USB_DEVICE(0x22b8, 0x2d97) }, /* modem + diagnostics + NMEA */
1046 +- { USB_DEVICE(0x22b8, 0x2d99) }, /* modem + AT port + NMEA */
1047 +- { USB_DEVICE(0x22b8, 0x2d9a) }, /* modem + AT port + diagnostics + NMEA */
1048 ++ { USB_DEVICE(0x22b8, 0x2d92), /* modem + diagnostics */
1049 ++ .driver_info = NO_UNION_NORMAL, /* handle only modem interface */
1050 ++ },
1051 ++ { USB_DEVICE(0x22b8, 0x2d93), /* modem + AT port */
1052 ++ .driver_info = NO_UNION_NORMAL, /* handle only modem interface */
1053 ++ },
1054 ++ { USB_DEVICE(0x22b8, 0x2d95), /* modem + AT port + diagnostics */
1055 ++ .driver_info = NO_UNION_NORMAL, /* handle only modem interface */
1056 ++ },
1057 ++ { USB_DEVICE(0x22b8, 0x2d96), /* modem + NMEA */
1058 ++ .driver_info = NO_UNION_NORMAL, /* handle only modem interface */
1059 ++ },
1060 ++ { USB_DEVICE(0x22b8, 0x2d97), /* modem + diagnostics + NMEA */
1061 ++ .driver_info = NO_UNION_NORMAL, /* handle only modem interface */
1062 ++ },
1063 ++ { USB_DEVICE(0x22b8, 0x2d99), /* modem + AT port + NMEA */
1064 ++ .driver_info = NO_UNION_NORMAL, /* handle only modem interface */
1065 ++ },
1066 ++ { USB_DEVICE(0x22b8, 0x2d9a), /* modem + AT port + diagnostics + NMEA */
1067 ++ .driver_info = NO_UNION_NORMAL, /* handle only modem interface */
1068 ++ },
1069 +
1070 + { USB_DEVICE(0x0572, 0x1329), /* Hummingbird huc56s (Conexant) */
1071 + .driver_info = NO_UNION_NORMAL, /* union descriptor misplaced on
1072 +diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
1073 +index c90d960e091b..ded751ca104a 100644
1074 +--- a/drivers/usb/serial/cp210x.c
1075 ++++ b/drivers/usb/serial/cp210x.c
1076 +@@ -104,6 +104,7 @@ static const struct usb_device_id id_table[] = {
1077 + { USB_DEVICE(0x10C4, 0x8218) }, /* Lipowsky Industrie Elektronik GmbH, HARP-1 */
1078 + { USB_DEVICE(0x10C4, 0x822B) }, /* Modem EDGE(GSM) Comander 2 */
1079 + { USB_DEVICE(0x10C4, 0x826B) }, /* Cygnal Integrated Products, Inc., Fasttrax GPS demonstration module */
1080 ++ { USB_DEVICE(0x10C4, 0x8281) }, /* Nanotec Plug & Drive */
1081 + { USB_DEVICE(0x10C4, 0x8293) }, /* Telegesis ETRX2USB */
1082 + { USB_DEVICE(0x10C4, 0x82F9) }, /* Procyon AVS */
1083 + { USB_DEVICE(0x10C4, 0x8341) }, /* Siemens MC35PU GPRS Modem */
1084 +diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
1085 +index b83da38bc915..2c635bd9c185 100644
1086 +--- a/drivers/usb/serial/ftdi_sio.c
1087 ++++ b/drivers/usb/serial/ftdi_sio.c
1088 +@@ -912,6 +912,39 @@ static struct usb_device_id id_table_combined [] = {
1089 + { USB_DEVICE(FTDI_VID, FTDI_Z3X_PID) },
1090 + /* Cressi Devices */
1091 + { USB_DEVICE(FTDI_VID, FTDI_CRESSI_PID) },
1092 ++ /* Brainboxes Devices */
1093 ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_001_PID) },
1094 ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_012_PID) },
1095 ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_023_PID) },
1096 ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_034_PID) },
1097 ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_101_PID) },
1098 ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_1_PID) },
1099 ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_2_PID) },
1100 ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_3_PID) },
1101 ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_4_PID) },
1102 ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_5_PID) },
1103 ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_6_PID) },
1104 ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_7_PID) },
1105 ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_8_PID) },
1106 ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_257_PID) },
1107 ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_1_PID) },
1108 ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_2_PID) },
1109 ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_3_PID) },
1110 ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_4_PID) },
1111 ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_313_PID) },
1112 ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_324_PID) },
1113 ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_346_1_PID) },
1114 ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_346_2_PID) },
1115 ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_357_PID) },
1116 ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_606_1_PID) },
1117 ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_606_2_PID) },
1118 ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_606_3_PID) },
1119 ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_701_1_PID) },
1120 ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_701_2_PID) },
1121 ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_1_PID) },
1122 ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_2_PID) },
1123 ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_3_PID) },
1124 ++ { USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_4_PID) },
1125 + { }, /* Optional parameter entry */
1126 + { } /* Terminating entry */
1127 + };
1128 +diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
1129 +index e599fbfcde5f..993c93df6874 100644
1130 +--- a/drivers/usb/serial/ftdi_sio_ids.h
1131 ++++ b/drivers/usb/serial/ftdi_sio_ids.h
1132 +@@ -1326,3 +1326,40 @@
1133 + * Manufacturer: Cressi
1134 + */
1135 + #define FTDI_CRESSI_PID 0x87d0
1136 ++
1137 ++/*
1138 ++ * Brainboxes devices
1139 ++ */
1140 ++#define BRAINBOXES_VID 0x05d1
1141 ++#define BRAINBOXES_VX_001_PID 0x1001 /* VX-001 ExpressCard 1 Port RS232 */
1142 ++#define BRAINBOXES_VX_012_PID 0x1002 /* VX-012 ExpressCard 2 Port RS232 */
1143 ++#define BRAINBOXES_VX_023_PID 0x1003 /* VX-023 ExpressCard 1 Port RS422/485 */
1144 ++#define BRAINBOXES_VX_034_PID 0x1004 /* VX-034 ExpressCard 2 Port RS422/485 */
1145 ++#define BRAINBOXES_US_101_PID 0x1011 /* US-101 1xRS232 */
1146 ++#define BRAINBOXES_US_324_PID 0x1013 /* US-324 1xRS422/485 1Mbaud */
1147 ++#define BRAINBOXES_US_606_1_PID 0x2001 /* US-606 6 Port RS232 Serial Port 1 and 2 */
1148 ++#define BRAINBOXES_US_606_2_PID 0x2002 /* US-606 6 Port RS232 Serial Port 3 and 4 */
1149 ++#define BRAINBOXES_US_606_3_PID 0x2003 /* US-606 6 Port RS232 Serial Port 4 and 6 */
1150 ++#define BRAINBOXES_US_701_1_PID 0x2011 /* US-701 4xRS232 1Mbaud Port 1 and 2 */
1151 ++#define BRAINBOXES_US_701_2_PID 0x2012 /* US-701 4xRS422 1Mbaud Port 3 and 4 */
1152 ++#define BRAINBOXES_US_279_1_PID 0x2021 /* US-279 8xRS422 1Mbaud Port 1 and 2 */
1153 ++#define BRAINBOXES_US_279_2_PID 0x2022 /* US-279 8xRS422 1Mbaud Port 3 and 4 */
1154 ++#define BRAINBOXES_US_279_3_PID 0x2023 /* US-279 8xRS422 1Mbaud Port 5 and 6 */
1155 ++#define BRAINBOXES_US_279_4_PID 0x2024 /* US-279 8xRS422 1Mbaud Port 7 and 8 */
1156 ++#define BRAINBOXES_US_346_1_PID 0x3011 /* US-346 4xRS422/485 1Mbaud Port 1 and 2 */
1157 ++#define BRAINBOXES_US_346_2_PID 0x3012 /* US-346 4xRS422/485 1Mbaud Port 3 and 4 */
1158 ++#define BRAINBOXES_US_257_PID 0x5001 /* US-257 2xRS232 1Mbaud */
1159 ++#define BRAINBOXES_US_313_PID 0x6001 /* US-313 2xRS422/485 1Mbaud */
1160 ++#define BRAINBOXES_US_357_PID 0x7001 /* US_357 1xRS232/422/485 */
1161 ++#define BRAINBOXES_US_842_1_PID 0x8001 /* US-842 8xRS422/485 1Mbaud Port 1 and 2 */
1162 ++#define BRAINBOXES_US_842_2_PID 0x8002 /* US-842 8xRS422/485 1Mbaud Port 3 and 4 */
1163 ++#define BRAINBOXES_US_842_3_PID 0x8003 /* US-842 8xRS422/485 1Mbaud Port 5 and 6 */
1164 ++#define BRAINBOXES_US_842_4_PID 0x8004 /* US-842 8xRS422/485 1Mbaud Port 7 and 8 */
1165 ++#define BRAINBOXES_US_160_1_PID 0x9001 /* US-160 16xRS232 1Mbaud Port 1 and 2 */
1166 ++#define BRAINBOXES_US_160_2_PID 0x9002 /* US-160 16xRS232 1Mbaud Port 3 and 4 */
1167 ++#define BRAINBOXES_US_160_3_PID 0x9003 /* US-160 16xRS232 1Mbaud Port 5 and 6 */
1168 ++#define BRAINBOXES_US_160_4_PID 0x9004 /* US-160 16xRS232 1Mbaud Port 7 and 8 */
1169 ++#define BRAINBOXES_US_160_5_PID 0x9005 /* US-160 16xRS232 1Mbaud Port 9 and 10 */
1170 ++#define BRAINBOXES_US_160_6_PID 0x9006 /* US-160 16xRS232 1Mbaud Port 11 and 12 */
1171 ++#define BRAINBOXES_US_160_7_PID 0x9007 /* US-160 16xRS232 1Mbaud Port 13 and 14 */
1172 ++#define BRAINBOXES_US_160_8_PID 0x9008 /* US-160 16xRS232 1Mbaud Port 15 and 16 */
1173 +diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
1174 +index 1be6ba7bee27..c5c9cbf107d1 100644
1175 +--- a/drivers/usb/serial/io_ti.c
1176 ++++ b/drivers/usb/serial/io_ti.c
1177 +@@ -29,6 +29,7 @@
1178 + #include <linux/spinlock.h>
1179 + #include <linux/mutex.h>
1180 + #include <linux/serial.h>
1181 ++#include <linux/swab.h>
1182 + #include <linux/kfifo.h>
1183 + #include <linux/ioctl.h>
1184 + #include <linux/firmware.h>
1185 +@@ -284,7 +285,7 @@ static int read_download_mem(struct usb_device *dev, int start_address,
1186 + {
1187 + int status = 0;
1188 + __u8 read_length;
1189 +- __be16 be_start_address;
1190 ++ u16 be_start_address;
1191 +
1192 + dev_dbg(&dev->dev, "%s - @ %x for %d\n", __func__, start_address, length);
1193 +
1194 +@@ -300,10 +301,14 @@ static int read_download_mem(struct usb_device *dev, int start_address,
1195 + if (read_length > 1) {
1196 + dev_dbg(&dev->dev, "%s - @ %x for %d\n", __func__, start_address, read_length);
1197 + }
1198 +- be_start_address = cpu_to_be16(start_address);
1199 ++ /*
1200 ++ * NOTE: Must use swab as wIndex is sent in little-endian
1201 ++ * byte order regardless of host byte order.
1202 ++ */
1203 ++ be_start_address = swab16((u16)start_address);
1204 + status = ti_vread_sync(dev, UMPC_MEMORY_READ,
1205 + (__u16)address_type,
1206 +- (__force __u16)be_start_address,
1207 ++ be_start_address,
1208 + buffer, read_length);
1209 +
1210 + if (status) {
1211 +@@ -400,7 +405,7 @@ static int write_i2c_mem(struct edgeport_serial *serial,
1212 + struct device *dev = &serial->serial->dev->dev;
1213 + int status = 0;
1214 + int write_length;
1215 +- __be16 be_start_address;
1216 ++ u16 be_start_address;
1217 +
1218 + /* We can only send a maximum of 1 aligned byte page at a time */
1219 +
1220 +@@ -415,11 +420,16 @@ static int write_i2c_mem(struct edgeport_serial *serial,
1221 + __func__, start_address, write_length);
1222 + usb_serial_debug_data(dev, __func__, write_length, buffer);
1223 +
1224 +- /* Write first page */
1225 +- be_start_address = cpu_to_be16(start_address);
1226 ++ /*
1227 ++ * Write first page.
1228 ++ *
1229 ++ * NOTE: Must use swab as wIndex is sent in little-endian byte order
1230 ++ * regardless of host byte order.
1231 ++ */
1232 ++ be_start_address = swab16((u16)start_address);
1233 + status = ti_vsend_sync(serial->serial->dev,
1234 + UMPC_MEMORY_WRITE, (__u16)address_type,
1235 +- (__force __u16)be_start_address,
1236 ++ be_start_address,
1237 + buffer, write_length);
1238 + if (status) {
1239 + dev_dbg(dev, "%s - ERROR %d\n", __func__, status);
1240 +@@ -442,11 +452,16 @@ static int write_i2c_mem(struct edgeport_serial *serial,
1241 + __func__, start_address, write_length);
1242 + usb_serial_debug_data(dev, __func__, write_length, buffer);
1243 +
1244 +- /* Write next page */
1245 +- be_start_address = cpu_to_be16(start_address);
1246 ++ /*
1247 ++ * Write next page.
1248 ++ *
1249 ++ * NOTE: Must use swab as wIndex is sent in little-endian byte
1250 ++ * order regardless of host byte order.
1251 ++ */
1252 ++ be_start_address = swab16((u16)start_address);
1253 + status = ti_vsend_sync(serial->serial->dev, UMPC_MEMORY_WRITE,
1254 + (__u16)address_type,
1255 +- (__force __u16)be_start_address,
1256 ++ be_start_address,
1257 + buffer, write_length);
1258 + if (status) {
1259 + dev_err(dev, "%s - ERROR %d\n", __func__, status);
1260 +@@ -593,8 +608,8 @@ static int get_descriptor_addr(struct edgeport_serial *serial,
1261 + if (rom_desc->Type == desc_type)
1262 + return start_address;
1263 +
1264 +- start_address = start_address + sizeof(struct ti_i2c_desc)
1265 +- + rom_desc->Size;
1266 ++ start_address = start_address + sizeof(struct ti_i2c_desc) +
1267 ++ le16_to_cpu(rom_desc->Size);
1268 +
1269 + } while ((start_address < TI_MAX_I2C_SIZE) && rom_desc->Type);
1270 +
1271 +@@ -607,7 +622,7 @@ static int valid_csum(struct ti_i2c_desc *rom_desc, __u8 *buffer)
1272 + __u16 i;
1273 + __u8 cs = 0;
1274 +
1275 +- for (i = 0; i < rom_desc->Size; i++)
1276 ++ for (i = 0; i < le16_to_cpu(rom_desc->Size); i++)
1277 + cs = (__u8)(cs + buffer[i]);
1278 +
1279 + if (cs != rom_desc->CheckSum) {
1280 +@@ -661,7 +676,7 @@ static int check_i2c_image(struct edgeport_serial *serial)
1281 + break;
1282 +
1283 + if ((start_address + sizeof(struct ti_i2c_desc) +
1284 +- rom_desc->Size) > TI_MAX_I2C_SIZE) {
1285 ++ le16_to_cpu(rom_desc->Size)) > TI_MAX_I2C_SIZE) {
1286 + status = -ENODEV;
1287 + dev_dbg(dev, "%s - structure too big, erroring out.\n", __func__);
1288 + break;
1289 +@@ -676,7 +691,8 @@ static int check_i2c_image(struct edgeport_serial *serial)
1290 + /* Read the descriptor data */
1291 + status = read_rom(serial, start_address +
1292 + sizeof(struct ti_i2c_desc),
1293 +- rom_desc->Size, buffer);
1294 ++ le16_to_cpu(rom_desc->Size),
1295 ++ buffer);
1296 + if (status)
1297 + break;
1298 +
1299 +@@ -685,7 +701,7 @@ static int check_i2c_image(struct edgeport_serial *serial)
1300 + break;
1301 + }
1302 + start_address = start_address + sizeof(struct ti_i2c_desc) +
1303 +- rom_desc->Size;
1304 ++ le16_to_cpu(rom_desc->Size);
1305 +
1306 + } while ((rom_desc->Type != I2C_DESC_TYPE_ION) &&
1307 + (start_address < TI_MAX_I2C_SIZE));
1308 +@@ -724,7 +740,7 @@ static int get_manuf_info(struct edgeport_serial *serial, __u8 *buffer)
1309 +
1310 + /* Read the descriptor data */
1311 + status = read_rom(serial, start_address+sizeof(struct ti_i2c_desc),
1312 +- rom_desc->Size, buffer);
1313 ++ le16_to_cpu(rom_desc->Size), buffer);
1314 + if (status)
1315 + goto exit;
1316 +
1317 +diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
1318 +index 68fc9fe65936..f213ee978516 100644
1319 +--- a/drivers/usb/serial/option.c
1320 ++++ b/drivers/usb/serial/option.c
1321 +@@ -234,8 +234,31 @@ static void option_instat_callback(struct urb *urb);
1322 + #define QUALCOMM_VENDOR_ID 0x05C6
1323 +
1324 + #define CMOTECH_VENDOR_ID 0x16d8
1325 +-#define CMOTECH_PRODUCT_6008 0x6008
1326 +-#define CMOTECH_PRODUCT_6280 0x6280
1327 ++#define CMOTECH_PRODUCT_6001 0x6001
1328 ++#define CMOTECH_PRODUCT_CMU_300 0x6002
1329 ++#define CMOTECH_PRODUCT_6003 0x6003
1330 ++#define CMOTECH_PRODUCT_6004 0x6004
1331 ++#define CMOTECH_PRODUCT_6005 0x6005
1332 ++#define CMOTECH_PRODUCT_CGU_628A 0x6006
1333 ++#define CMOTECH_PRODUCT_CHE_628S 0x6007
1334 ++#define CMOTECH_PRODUCT_CMU_301 0x6008
1335 ++#define CMOTECH_PRODUCT_CHU_628 0x6280
1336 ++#define CMOTECH_PRODUCT_CHU_628S 0x6281
1337 ++#define CMOTECH_PRODUCT_CDU_680 0x6803
1338 ++#define CMOTECH_PRODUCT_CDU_685A 0x6804
1339 ++#define CMOTECH_PRODUCT_CHU_720S 0x7001
1340 ++#define CMOTECH_PRODUCT_7002 0x7002
1341 ++#define CMOTECH_PRODUCT_CHU_629K 0x7003
1342 ++#define CMOTECH_PRODUCT_7004 0x7004
1343 ++#define CMOTECH_PRODUCT_7005 0x7005
1344 ++#define CMOTECH_PRODUCT_CGU_629 0x7006
1345 ++#define CMOTECH_PRODUCT_CHU_629S 0x700a
1346 ++#define CMOTECH_PRODUCT_CHU_720I 0x7211
1347 ++#define CMOTECH_PRODUCT_7212 0x7212
1348 ++#define CMOTECH_PRODUCT_7213 0x7213
1349 ++#define CMOTECH_PRODUCT_7251 0x7251
1350 ++#define CMOTECH_PRODUCT_7252 0x7252
1351 ++#define CMOTECH_PRODUCT_7253 0x7253
1352 +
1353 + #define TELIT_VENDOR_ID 0x1bc7
1354 + #define TELIT_PRODUCT_UC864E 0x1003
1355 +@@ -243,6 +266,7 @@ static void option_instat_callback(struct urb *urb);
1356 + #define TELIT_PRODUCT_CC864_DUAL 0x1005
1357 + #define TELIT_PRODUCT_CC864_SINGLE 0x1006
1358 + #define TELIT_PRODUCT_DE910_DUAL 0x1010
1359 ++#define TELIT_PRODUCT_UE910_V2 0x1012
1360 + #define TELIT_PRODUCT_LE920 0x1200
1361 +
1362 + /* ZTE PRODUCTS */
1363 +@@ -286,6 +310,7 @@ static void option_instat_callback(struct urb *urb);
1364 + #define ALCATEL_PRODUCT_X060S_X200 0x0000
1365 + #define ALCATEL_PRODUCT_X220_X500D 0x0017
1366 + #define ALCATEL_PRODUCT_L100V 0x011e
1367 ++#define ALCATEL_PRODUCT_L800MA 0x0203
1368 +
1369 + #define PIRELLI_VENDOR_ID 0x1266
1370 + #define PIRELLI_PRODUCT_C100_1 0x1002
1371 +@@ -348,6 +373,7 @@ static void option_instat_callback(struct urb *urb);
1372 + #define OLIVETTI_PRODUCT_OLICARD100 0xc000
1373 + #define OLIVETTI_PRODUCT_OLICARD145 0xc003
1374 + #define OLIVETTI_PRODUCT_OLICARD200 0xc005
1375 ++#define OLIVETTI_PRODUCT_OLICARD500 0xc00b
1376 +
1377 + /* Celot products */
1378 + #define CELOT_VENDOR_ID 0x211f
1379 +@@ -501,6 +527,10 @@ static const struct option_blacklist_info huawei_cdc12_blacklist = {
1380 + .reserved = BIT(1) | BIT(2),
1381 + };
1382 +
1383 ++static const struct option_blacklist_info net_intf0_blacklist = {
1384 ++ .reserved = BIT(0),
1385 ++};
1386 ++
1387 + static const struct option_blacklist_info net_intf1_blacklist = {
1388 + .reserved = BIT(1),
1389 + };
1390 +@@ -1034,13 +1064,53 @@ static const struct usb_device_id option_ids[] = {
1391 + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
1392 + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
1393 + { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
1394 +- { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6280) }, /* BP3-USB & BP3-EXT HSDPA */
1395 +- { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6008) },
1396 ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
1397 ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
1398 ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003),
1399 ++ .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
1400 ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6004) },
1401 ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6005) },
1402 ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CGU_628A) },
1403 ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHE_628S),
1404 ++ .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
1405 ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_301),
1406 ++ .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
1407 ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_628),
1408 ++ .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
1409 ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_628S) },
1410 ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CDU_680) },
1411 ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CDU_685A) },
1412 ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_720S),
1413 ++ .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
1414 ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7002),
1415 ++ .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
1416 ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_629K),
1417 ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
1418 ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7004),
1419 ++ .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
1420 ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7005) },
1421 ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CGU_629),
1422 ++ .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
1423 ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_629S),
1424 ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
1425 ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_720I),
1426 ++ .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
1427 ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7212),
1428 ++ .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
1429 ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7213),
1430 ++ .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
1431 ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7251),
1432 ++ .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
1433 ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7252),
1434 ++ .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
1435 ++ { USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7253),
1436 ++ .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
1437 + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864E) },
1438 + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864G) },
1439 + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_DUAL) },
1440 + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) },
1441 + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) },
1442 ++ { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) },
1443 + { USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
1444 + .driver_info = (kernel_ulong_t)&telit_le920_blacklist },
1445 + { USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
1446 +@@ -1498,6 +1568,8 @@ static const struct usb_device_id option_ids[] = {
1447 + .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
1448 + { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_L100V),
1449 + .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
1450 ++ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_L800MA),
1451 ++ .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
1452 + { USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) },
1453 + { USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) },
1454 + { USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14),
1455 +@@ -1543,6 +1615,9 @@ static const struct usb_device_id option_ids[] = {
1456 + { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200),
1457 + .driver_info = (kernel_ulong_t)&net_intf6_blacklist
1458 + },
1459 ++ { USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD500),
1460 ++ .driver_info = (kernel_ulong_t)&net_intf4_blacklist
1461 ++ },
1462 + { USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
1463 + { USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/
1464 + { USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) },
1465 +diff --git a/drivers/usb/serial/qcserial.c b/drivers/usb/serial/qcserial.c
1466 +index 968a40201e5f..7ed681a714a5 100644
1467 +--- a/drivers/usb/serial/qcserial.c
1468 ++++ b/drivers/usb/serial/qcserial.c
1469 +@@ -136,9 +136,18 @@ static const struct usb_device_id id_table[] = {
1470 + {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x68a2, 0)}, /* Sierra Wireless MC7710 Device Management */
1471 + {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x68a2, 2)}, /* Sierra Wireless MC7710 NMEA */
1472 + {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x68a2, 3)}, /* Sierra Wireless MC7710 Modem */
1473 ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x68c0, 0)}, /* Sierra Wireless MC73xx Device Management */
1474 ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x68c0, 2)}, /* Sierra Wireless MC73xx NMEA */
1475 ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x68c0, 3)}, /* Sierra Wireless MC73xx Modem */
1476 + {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901c, 0)}, /* Sierra Wireless EM7700 Device Management */
1477 + {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901c, 2)}, /* Sierra Wireless EM7700 NMEA */
1478 + {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901c, 3)}, /* Sierra Wireless EM7700 Modem */
1479 ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901f, 0)}, /* Sierra Wireless EM7355 Device Management */
1480 ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901f, 2)}, /* Sierra Wireless EM7355 NMEA */
1481 ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x901f, 3)}, /* Sierra Wireless EM7355 Modem */
1482 ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9041, 0)}, /* Sierra Wireless MC7305/MC7355 Device Management */
1483 ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9041, 2)}, /* Sierra Wireless MC7305/MC7355 NMEA */
1484 ++ {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9041, 3)}, /* Sierra Wireless MC7305/MC7355 Modem */
1485 + {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 0)}, /* Netgear AirCard 340U Device Management */
1486 + {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 2)}, /* Netgear AirCard 340U NMEA */
1487 + {USB_DEVICE_INTERFACE_NUMBER(0x1199, 0x9051, 3)}, /* Netgear AirCard 340U Modem */
1488 +diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
1489 +index 8894665cd610..2df566c0e9e8 100644
1490 +--- a/drivers/usb/serial/sierra.c
1491 ++++ b/drivers/usb/serial/sierra.c
1492 +@@ -291,7 +291,6 @@ static const struct usb_device_id id_table[] = {
1493 + { USB_DEVICE(0x0f3d, 0x68A3), /* Airprime/Sierra Wireless Direct IP modems */
1494 + .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
1495 + },
1496 +- { USB_DEVICE(0x413C, 0x08133) }, /* Dell Computer Corp. Wireless 5720 VZW Mobile Broadband (EVDO Rev-A) Minicard GPS Port */
1497 +
1498 + { }
1499 + };
1500 +diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
1501 +index 5f6b1ff9d29e..c1032d42b9d5 100644
1502 +--- a/drivers/usb/serial/usb-serial.c
1503 ++++ b/drivers/usb/serial/usb-serial.c
1504 +@@ -1367,10 +1367,12 @@ static int usb_serial_register(struct usb_serial_driver *driver)
1505 + static void usb_serial_deregister(struct usb_serial_driver *device)
1506 + {
1507 + pr_info("USB Serial deregistering driver %s\n", device->description);
1508 ++
1509 + mutex_lock(&table_lock);
1510 + list_del(&device->driver_list);
1511 +- usb_serial_bus_deregister(device);
1512 + mutex_unlock(&table_lock);
1513 ++
1514 ++ usb_serial_bus_deregister(device);
1515 + }
1516 +
1517 + /**
1518 +diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c
1519 +index db0cf536de18..11952b6dc224 100644
1520 +--- a/drivers/usb/serial/usb_wwan.c
1521 ++++ b/drivers/usb/serial/usb_wwan.c
1522 +@@ -470,6 +470,9 @@ int usb_wwan_port_probe(struct usb_serial_port *port)
1523 + int err;
1524 + int i;
1525 +
1526 ++ if (!port->bulk_in_size || !port->bulk_out_size)
1527 ++ return -ENODEV;
1528 ++
1529 + portdata = kzalloc(sizeof(*portdata), GFP_KERNEL);
1530 + if (!portdata)
1531 + return -ENOMEM;
1532 +@@ -477,9 +480,6 @@ int usb_wwan_port_probe(struct usb_serial_port *port)
1533 + init_usb_anchor(&portdata->delayed);
1534 +
1535 + for (i = 0; i < N_IN_URB; i++) {
1536 +- if (!port->bulk_in_size)
1537 +- break;
1538 +-
1539 + buffer = (u8 *)__get_free_page(GFP_KERNEL);
1540 + if (!buffer)
1541 + goto bail_out_error;
1542 +@@ -493,9 +493,6 @@ int usb_wwan_port_probe(struct usb_serial_port *port)
1543 + }
1544 +
1545 + for (i = 0; i < N_OUT_URB; i++) {
1546 +- if (!port->bulk_out_size)
1547 +- break;
1548 +-
1549 + buffer = kmalloc(OUT_BUFLEN, GFP_KERNEL);
1550 + if (!buffer)
1551 + goto bail_out_error2;
1552 +diff --git a/drivers/video/tgafb.c b/drivers/video/tgafb.c
1553 +index ba77f753649c..a78ca6a01094 100644
1554 +--- a/drivers/video/tgafb.c
1555 ++++ b/drivers/video/tgafb.c
1556 +@@ -188,6 +188,8 @@ tgafb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
1557 +
1558 + if (var->xres_virtual != var->xres || var->yres_virtual != var->yres)
1559 + return -EINVAL;
1560 ++ if (var->xres * var->yres * (var->bits_per_pixel >> 3) > info->fix.smem_len)
1561 ++ return -EINVAL;
1562 + if (var->nonstd)
1563 + return -EINVAL;
1564 + if (1000000000 / var->pixclock > TGA_PLL_MAX_FREQ)
1565 +@@ -268,6 +270,7 @@ tgafb_set_par(struct fb_info *info)
1566 + par->yres = info->var.yres;
1567 + par->pll_freq = pll_freq = 1000000000 / info->var.pixclock;
1568 + par->bits_per_pixel = info->var.bits_per_pixel;
1569 ++ info->fix.line_length = par->xres * (par->bits_per_pixel >> 3);
1570 +
1571 + tga_type = par->tga_type;
1572 +
1573 +@@ -1314,6 +1317,7 @@ tgafb_init_fix(struct fb_info *info)
1574 + int tga_bus_tc = TGA_BUS_TC(par->dev);
1575 + u8 tga_type = par->tga_type;
1576 + const char *tga_type_name = NULL;
1577 ++ unsigned memory_size;
1578 +
1579 + switch (tga_type) {
1580 + case TGA_TYPE_8PLANE:
1581 +@@ -1321,21 +1325,25 @@ tgafb_init_fix(struct fb_info *info)
1582 + tga_type_name = "Digital ZLXp-E1";
1583 + if (tga_bus_tc)
1584 + tga_type_name = "Digital ZLX-E1";
1585 ++ memory_size = 2097152;
1586 + break;
1587 + case TGA_TYPE_24PLANE:
1588 + if (tga_bus_pci)
1589 + tga_type_name = "Digital ZLXp-E2";
1590 + if (tga_bus_tc)
1591 + tga_type_name = "Digital ZLX-E2";
1592 ++ memory_size = 8388608;
1593 + break;
1594 + case TGA_TYPE_24PLUSZ:
1595 + if (tga_bus_pci)
1596 + tga_type_name = "Digital ZLXp-E3";
1597 + if (tga_bus_tc)
1598 + tga_type_name = "Digital ZLX-E3";
1599 ++ memory_size = 16777216;
1600 + break;
1601 + default:
1602 + tga_type_name = "Unknown";
1603 ++ memory_size = 16777216;
1604 + break;
1605 + }
1606 +
1607 +@@ -1347,9 +1355,8 @@ tgafb_init_fix(struct fb_info *info)
1608 + ? FB_VISUAL_PSEUDOCOLOR
1609 + : FB_VISUAL_DIRECTCOLOR);
1610 +
1611 +- info->fix.line_length = par->xres * (par->bits_per_pixel >> 3);
1612 + info->fix.smem_start = (size_t) par->tga_fb_base;
1613 +- info->fix.smem_len = info->fix.line_length * par->yres;
1614 ++ info->fix.smem_len = memory_size;
1615 + info->fix.mmio_start = (size_t) par->tga_regs_base;
1616 + info->fix.mmio_len = 512;
1617 +
1618 +@@ -1473,6 +1480,9 @@ static int tgafb_register(struct device *dev)
1619 + modedb_tga = &modedb_tc;
1620 + modedbsize_tga = 1;
1621 + }
1622 ++
1623 ++ tgafb_init_fix(info);
1624 ++
1625 + ret = fb_find_mode(&info->var, info,
1626 + mode_option ? mode_option : mode_option_tga,
1627 + modedb_tga, modedbsize_tga, NULL,
1628 +@@ -1490,7 +1500,6 @@ static int tgafb_register(struct device *dev)
1629 + }
1630 +
1631 + tgafb_set_par(info);
1632 +- tgafb_init_fix(info);
1633 +
1634 + if (register_framebuffer(info) < 0) {
1635 + printk(KERN_ERR "tgafb: Could not register framebuffer\n");
1636 +diff --git a/fs/file_table.c b/fs/file_table.c
1637 +index 485dc0eddd67..54a34be444f9 100644
1638 +--- a/fs/file_table.c
1639 ++++ b/fs/file_table.c
1640 +@@ -211,10 +211,10 @@ static void drop_file_write_access(struct file *file)
1641 + struct dentry *dentry = file->f_path.dentry;
1642 + struct inode *inode = dentry->d_inode;
1643 +
1644 +- put_write_access(inode);
1645 +-
1646 + if (special_file(inode->i_mode))
1647 + return;
1648 ++
1649 ++ put_write_access(inode);
1650 + if (file_check_writeable(file) != 0)
1651 + return;
1652 + __mnt_drop_write(mnt);
1653 +diff --git a/fs/open.c b/fs/open.c
1654 +index 8c741002f947..86092bde31f4 100644
1655 +--- a/fs/open.c
1656 ++++ b/fs/open.c
1657 +@@ -628,23 +628,12 @@ out:
1658 + static inline int __get_file_write_access(struct inode *inode,
1659 + struct vfsmount *mnt)
1660 + {
1661 +- int error;
1662 +- error = get_write_access(inode);
1663 ++ int error = get_write_access(inode);
1664 + if (error)
1665 + return error;
1666 +- /*
1667 +- * Do not take mount writer counts on
1668 +- * special files since no writes to
1669 +- * the mount itself will occur.
1670 +- */
1671 +- if (!special_file(inode->i_mode)) {
1672 +- /*
1673 +- * Balanced in __fput()
1674 +- */
1675 +- error = __mnt_want_write(mnt);
1676 +- if (error)
1677 +- put_write_access(inode);
1678 +- }
1679 ++ error = __mnt_want_write(mnt);
1680 ++ if (error)
1681 ++ put_write_access(inode);
1682 + return error;
1683 + }
1684 +
1685 +@@ -677,12 +666,11 @@ static int do_dentry_open(struct file *f,
1686 +
1687 + path_get(&f->f_path);
1688 + inode = f->f_inode = f->f_path.dentry->d_inode;
1689 +- if (f->f_mode & FMODE_WRITE) {
1690 ++ if (f->f_mode & FMODE_WRITE && !special_file(inode->i_mode)) {
1691 + error = __get_file_write_access(inode, f->f_path.mnt);
1692 + if (error)
1693 + goto cleanup_file;
1694 +- if (!special_file(inode->i_mode))
1695 +- file_take_write(f);
1696 ++ file_take_write(f);
1697 + }
1698 +
1699 + f->f_mapping = inode->i_mapping;
1700 +@@ -723,7 +711,6 @@ cleanup_all:
1701 + fops_put(f->f_op);
1702 + file_sb_list_del(f);
1703 + if (f->f_mode & FMODE_WRITE) {
1704 +- put_write_access(inode);
1705 + if (!special_file(inode->i_mode)) {
1706 + /*
1707 + * We don't consider this a real
1708 +@@ -731,6 +718,7 @@ cleanup_all:
1709 + * because it all happenend right
1710 + * here, so just reset the state.
1711 + */
1712 ++ put_write_access(inode);
1713 + file_reset_write(f);
1714 + __mnt_drop_write(f->f_path.mnt);
1715 + }
1716 +diff --git a/include/asm-generic/pgtable.h b/include/asm-generic/pgtable.h
1717 +index b58268a5ddd4..17bccd3a4b03 100644
1718 +--- a/include/asm-generic/pgtable.h
1719 ++++ b/include/asm-generic/pgtable.h
1720 +@@ -620,32 +620,47 @@ static inline int pmd_numa(pmd_t pmd)
1721 + #ifndef pte_mknonnuma
1722 + static inline pte_t pte_mknonnuma(pte_t pte)
1723 + {
1724 +- pte = pte_clear_flags(pte, _PAGE_NUMA);
1725 +- return pte_set_flags(pte, _PAGE_PRESENT|_PAGE_ACCESSED);
1726 ++ pteval_t val = pte_val(pte);
1727 ++
1728 ++ val &= ~_PAGE_NUMA;
1729 ++ val |= (_PAGE_PRESENT|_PAGE_ACCESSED);
1730 ++ return __pte(val);
1731 + }
1732 + #endif
1733 +
1734 + #ifndef pmd_mknonnuma
1735 + static inline pmd_t pmd_mknonnuma(pmd_t pmd)
1736 + {
1737 +- pmd = pmd_clear_flags(pmd, _PAGE_NUMA);
1738 +- return pmd_set_flags(pmd, _PAGE_PRESENT|_PAGE_ACCESSED);
1739 ++ pmdval_t val = pmd_val(pmd);
1740 ++
1741 ++ val &= ~_PAGE_NUMA;
1742 ++ val |= (_PAGE_PRESENT|_PAGE_ACCESSED);
1743 ++
1744 ++ return __pmd(val);
1745 + }
1746 + #endif
1747 +
1748 + #ifndef pte_mknuma
1749 + static inline pte_t pte_mknuma(pte_t pte)
1750 + {
1751 +- pte = pte_set_flags(pte, _PAGE_NUMA);
1752 +- return pte_clear_flags(pte, _PAGE_PRESENT);
1753 ++ pteval_t val = pte_val(pte);
1754 ++
1755 ++ val &= ~_PAGE_PRESENT;
1756 ++ val |= _PAGE_NUMA;
1757 ++
1758 ++ return __pte(val);
1759 + }
1760 + #endif
1761 +
1762 + #ifndef pmd_mknuma
1763 + static inline pmd_t pmd_mknuma(pmd_t pmd)
1764 + {
1765 +- pmd = pmd_set_flags(pmd, _PAGE_NUMA);
1766 +- return pmd_clear_flags(pmd, _PAGE_PRESENT);
1767 ++ pmdval_t val = pmd_val(pmd);
1768 ++
1769 ++ val &= ~_PAGE_PRESENT;
1770 ++ val |= _PAGE_NUMA;
1771 ++
1772 ++ return __pmd(val);
1773 + }
1774 + #endif
1775 + #else
1776 +diff --git a/include/linux/list.h b/include/linux/list.h
1777 +index b83e5657365a..83a9576f479f 100644
1778 +--- a/include/linux/list.h
1779 ++++ b/include/linux/list.h
1780 +@@ -373,6 +373,22 @@ static inline void list_splice_tail_init(struct list_head *list,
1781 + (!list_empty(ptr) ? list_first_entry(ptr, type, member) : NULL)
1782 +
1783 + /**
1784 ++ * list_next_entry - get the next element in list
1785 ++ * @pos: the type * to cursor
1786 ++ * @member: the name of the list_struct within the struct.
1787 ++ */
1788 ++#define list_next_entry(pos, member) \
1789 ++ list_entry((pos)->member.next, typeof(*(pos)), member)
1790 ++
1791 ++/**
1792 ++ * list_prev_entry - get the prev element in list
1793 ++ * @pos: the type * to cursor
1794 ++ * @member: the name of the list_struct within the struct.
1795 ++ */
1796 ++#define list_prev_entry(pos, member) \
1797 ++ list_entry((pos)->member.prev, typeof(*(pos)), member)
1798 ++
1799 ++/**
1800 + * list_for_each - iterate over a list
1801 + * @pos: the &struct list_head to use as a loop cursor.
1802 + * @head: the head for your list.
1803 +diff --git a/include/linux/sock_diag.h b/include/linux/sock_diag.h
1804 +index 54f91d35e5fd..302ab805b0bb 100644
1805 +--- a/include/linux/sock_diag.h
1806 ++++ b/include/linux/sock_diag.h
1807 +@@ -23,7 +23,7 @@ int sock_diag_check_cookie(void *sk, __u32 *cookie);
1808 + void sock_diag_save_cookie(void *sk, __u32 *cookie);
1809 +
1810 + int sock_diag_put_meminfo(struct sock *sk, struct sk_buff *skb, int attr);
1811 +-int sock_diag_put_filterinfo(struct user_namespace *user_ns, struct sock *sk,
1812 ++int sock_diag_put_filterinfo(struct sock *sk,
1813 + struct sk_buff *skb, int attrtype);
1814 +
1815 + #endif
1816 +diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
1817 +index b906f4a131a4..8d977b343647 100644
1818 +--- a/include/net/ip6_route.h
1819 ++++ b/include/net/ip6_route.h
1820 +@@ -32,6 +32,11 @@ struct route_info {
1821 + #define RT6_LOOKUP_F_SRCPREF_PUBLIC 0x00000010
1822 + #define RT6_LOOKUP_F_SRCPREF_COA 0x00000020
1823 +
1824 ++/* We do not (yet ?) support IPv6 jumbograms (RFC 2675)
1825 ++ * Unlike IPv4, hdr->seg_len doesn't include the IPv6 header
1826 ++ */
1827 ++#define IP6_MAX_MTU (0xFFFF + sizeof(struct ipv6hdr))
1828 ++
1829 + /*
1830 + * rt6_srcprefs2flags() and rt6_flags2srcprefs() translate
1831 + * between IPV6_ADDR_PREFERENCES socket option values
1832 +diff --git a/include/net/netfilter/nf_conntrack_extend.h b/include/net/netfilter/nf_conntrack_extend.h
1833 +index 331310851cfb..86dd7dd3d617 100644
1834 +--- a/include/net/netfilter/nf_conntrack_extend.h
1835 ++++ b/include/net/netfilter/nf_conntrack_extend.h
1836 +@@ -41,8 +41,8 @@ enum nf_ct_ext_id {
1837 + /* Extensions: optional stuff which isn't permanently in struct. */
1838 + struct nf_ct_ext {
1839 + struct rcu_head rcu;
1840 +- u8 offset[NF_CT_EXT_NUM];
1841 +- u8 len;
1842 ++ u16 offset[NF_CT_EXT_NUM];
1843 ++ u16 len;
1844 + char data[0];
1845 + };
1846 +
1847 +diff --git a/include/net/sctp/structs.h b/include/net/sctp/structs.h
1848 +index 1bd4c4144fe8..da6b9a01ff75 100644
1849 +--- a/include/net/sctp/structs.h
1850 ++++ b/include/net/sctp/structs.h
1851 +@@ -1252,6 +1252,7 @@ struct sctp_endpoint {
1852 + /* SCTP-AUTH: endpoint shared keys */
1853 + struct list_head endpoint_shared_keys;
1854 + __u16 active_key_id;
1855 ++ __u8 auth_enable;
1856 + };
1857 +
1858 + /* Recover the outter endpoint structure. */
1859 +@@ -1280,7 +1281,8 @@ struct sctp_endpoint *sctp_endpoint_is_match(struct sctp_endpoint *,
1860 + int sctp_has_association(struct net *net, const union sctp_addr *laddr,
1861 + const union sctp_addr *paddr);
1862 +
1863 +-int sctp_verify_init(struct net *net, const struct sctp_association *asoc,
1864 ++int sctp_verify_init(struct net *net, const struct sctp_endpoint *ep,
1865 ++ const struct sctp_association *asoc,
1866 + sctp_cid_t, sctp_init_chunk_t *peer_init,
1867 + struct sctp_chunk *chunk, struct sctp_chunk **err_chunk);
1868 + int sctp_process_init(struct sctp_association *, struct sctp_chunk *chunk,
1869 +diff --git a/include/scsi/scsi_device.h b/include/scsi/scsi_device.h
1870 +index cc645876d147..cc92ef3df62e 100644
1871 +--- a/include/scsi/scsi_device.h
1872 ++++ b/include/scsi/scsi_device.h
1873 +@@ -248,7 +248,7 @@ struct scsi_target {
1874 + struct list_head siblings;
1875 + struct list_head devices;
1876 + struct device dev;
1877 +- unsigned int reap_ref; /* protected by the host lock */
1878 ++ struct kref reap_ref; /* last put renders target invisible */
1879 + unsigned int channel;
1880 + unsigned int id; /* target id ... replace
1881 + * scsi_device.id eventually */
1882 +@@ -272,7 +272,6 @@ struct scsi_target {
1883 + #define SCSI_DEFAULT_TARGET_BLOCKED 3
1884 +
1885 + char scsi_level;
1886 +- struct execute_work ew;
1887 + enum scsi_target_state state;
1888 + void *hostdata; /* available to low-level driver */
1889 + unsigned long starget_data[0]; /* for the transport */
1890 +diff --git a/include/trace/events/block.h b/include/trace/events/block.h
1891 +index 60ae7c3db912..2e96e2bb1529 100644
1892 +--- a/include/trace/events/block.h
1893 ++++ b/include/trace/events/block.h
1894 +@@ -132,6 +132,7 @@ DEFINE_EVENT(block_rq_with_error, block_rq_requeue,
1895 + * block_rq_complete - block IO operation completed by device driver
1896 + * @q: queue containing the block operation request
1897 + * @rq: block operations request
1898 ++ * @nr_bytes: number of completed bytes
1899 + *
1900 + * The block_rq_complete tracepoint event indicates that some portion
1901 + * of operation request has been completed by the device driver. If
1902 +@@ -139,11 +140,37 @@ DEFINE_EVENT(block_rq_with_error, block_rq_requeue,
1903 + * do for the request. If @rq->bio is non-NULL then there is
1904 + * additional work required to complete the request.
1905 + */
1906 +-DEFINE_EVENT(block_rq_with_error, block_rq_complete,
1907 ++TRACE_EVENT(block_rq_complete,
1908 +
1909 +- TP_PROTO(struct request_queue *q, struct request *rq),
1910 ++ TP_PROTO(struct request_queue *q, struct request *rq,
1911 ++ unsigned int nr_bytes),
1912 +
1913 +- TP_ARGS(q, rq)
1914 ++ TP_ARGS(q, rq, nr_bytes),
1915 ++
1916 ++ TP_STRUCT__entry(
1917 ++ __field( dev_t, dev )
1918 ++ __field( sector_t, sector )
1919 ++ __field( unsigned int, nr_sector )
1920 ++ __field( int, errors )
1921 ++ __array( char, rwbs, RWBS_LEN )
1922 ++ __dynamic_array( char, cmd, blk_cmd_buf_len(rq) )
1923 ++ ),
1924 ++
1925 ++ TP_fast_assign(
1926 ++ __entry->dev = rq->rq_disk ? disk_devt(rq->rq_disk) : 0;
1927 ++ __entry->sector = blk_rq_pos(rq);
1928 ++ __entry->nr_sector = nr_bytes >> 9;
1929 ++ __entry->errors = rq->errors;
1930 ++
1931 ++ blk_fill_rwbs(__entry->rwbs, rq->cmd_flags, nr_bytes);
1932 ++ blk_dump_cmd(__get_str(cmd), rq);
1933 ++ ),
1934 ++
1935 ++ TP_printk("%d,%d %s (%s) %llu + %u [%d]",
1936 ++ MAJOR(__entry->dev), MINOR(__entry->dev),
1937 ++ __entry->rwbs, __get_str(cmd),
1938 ++ (unsigned long long)__entry->sector,
1939 ++ __entry->nr_sector, __entry->errors)
1940 + );
1941 +
1942 + DECLARE_EVENT_CLASS(block_rq,
1943 +diff --git a/kernel/events/core.c b/kernel/events/core.c
1944 +index f8eb2b154bdb..ac9b8cce3df2 100644
1945 +--- a/kernel/events/core.c
1946 ++++ b/kernel/events/core.c
1947 +@@ -2016,9 +2016,6 @@ static void __perf_event_sync_stat(struct perf_event *event,
1948 + perf_event_update_userpage(next_event);
1949 + }
1950 +
1951 +-#define list_next_entry(pos, member) \
1952 +- list_entry(pos->member.next, typeof(*pos), member)
1953 +-
1954 + static void perf_event_sync_stat(struct perf_event_context *ctx,
1955 + struct perf_event_context *next_ctx)
1956 + {
1957 +diff --git a/kernel/trace/blktrace.c b/kernel/trace/blktrace.c
1958 +index b8b8560bfb95..686417ba5cd1 100644
1959 +--- a/kernel/trace/blktrace.c
1960 ++++ b/kernel/trace/blktrace.c
1961 +@@ -685,6 +685,7 @@ void blk_trace_shutdown(struct request_queue *q)
1962 + * blk_add_trace_rq - Add a trace for a request oriented action
1963 + * @q: queue the io is for
1964 + * @rq: the source request
1965 ++ * @nr_bytes: number of completed bytes
1966 + * @what: the action
1967 + *
1968 + * Description:
1969 +@@ -692,7 +693,7 @@ void blk_trace_shutdown(struct request_queue *q)
1970 + *
1971 + **/
1972 + static void blk_add_trace_rq(struct request_queue *q, struct request *rq,
1973 +- u32 what)
1974 ++ unsigned int nr_bytes, u32 what)
1975 + {
1976 + struct blk_trace *bt = q->blk_trace;
1977 +
1978 +@@ -701,11 +702,11 @@ static void blk_add_trace_rq(struct request_queue *q, struct request *rq,
1979 +
1980 + if (rq->cmd_type == REQ_TYPE_BLOCK_PC) {
1981 + what |= BLK_TC_ACT(BLK_TC_PC);
1982 +- __blk_add_trace(bt, 0, blk_rq_bytes(rq), rq->cmd_flags,
1983 ++ __blk_add_trace(bt, 0, nr_bytes, rq->cmd_flags,
1984 + what, rq->errors, rq->cmd_len, rq->cmd);
1985 + } else {
1986 + what |= BLK_TC_ACT(BLK_TC_FS);
1987 +- __blk_add_trace(bt, blk_rq_pos(rq), blk_rq_bytes(rq),
1988 ++ __blk_add_trace(bt, blk_rq_pos(rq), nr_bytes,
1989 + rq->cmd_flags, what, rq->errors, 0, NULL);
1990 + }
1991 + }
1992 +@@ -713,33 +714,34 @@ static void blk_add_trace_rq(struct request_queue *q, struct request *rq,
1993 + static void blk_add_trace_rq_abort(void *ignore,
1994 + struct request_queue *q, struct request *rq)
1995 + {
1996 +- blk_add_trace_rq(q, rq, BLK_TA_ABORT);
1997 ++ blk_add_trace_rq(q, rq, blk_rq_bytes(rq), BLK_TA_ABORT);
1998 + }
1999 +
2000 + static void blk_add_trace_rq_insert(void *ignore,
2001 + struct request_queue *q, struct request *rq)
2002 + {
2003 +- blk_add_trace_rq(q, rq, BLK_TA_INSERT);
2004 ++ blk_add_trace_rq(q, rq, blk_rq_bytes(rq), BLK_TA_INSERT);
2005 + }
2006 +
2007 + static void blk_add_trace_rq_issue(void *ignore,
2008 + struct request_queue *q, struct request *rq)
2009 + {
2010 +- blk_add_trace_rq(q, rq, BLK_TA_ISSUE);
2011 ++ blk_add_trace_rq(q, rq, blk_rq_bytes(rq), BLK_TA_ISSUE);
2012 + }
2013 +
2014 + static void blk_add_trace_rq_requeue(void *ignore,
2015 + struct request_queue *q,
2016 + struct request *rq)
2017 + {
2018 +- blk_add_trace_rq(q, rq, BLK_TA_REQUEUE);
2019 ++ blk_add_trace_rq(q, rq, blk_rq_bytes(rq), BLK_TA_REQUEUE);
2020 + }
2021 +
2022 + static void blk_add_trace_rq_complete(void *ignore,
2023 + struct request_queue *q,
2024 +- struct request *rq)
2025 ++ struct request *rq,
2026 ++ unsigned int nr_bytes)
2027 + {
2028 +- blk_add_trace_rq(q, rq, BLK_TA_COMPLETE);
2029 ++ blk_add_trace_rq(q, rq, nr_bytes, BLK_TA_COMPLETE);
2030 + }
2031 +
2032 + /**
2033 +diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
2034 +index 031cc5655a51..63630aef3bd3 100644
2035 +--- a/kernel/tracepoint.c
2036 ++++ b/kernel/tracepoint.c
2037 +@@ -641,6 +641,9 @@ static int tracepoint_module_coming(struct module *mod)
2038 + struct tp_module *tp_mod, *iter;
2039 + int ret = 0;
2040 +
2041 ++ if (!mod->num_tracepoints)
2042 ++ return 0;
2043 ++
2044 + /*
2045 + * We skip modules that taint the kernel, especially those with different
2046 + * module headers (for forced load), to make sure we don't cause a crash.
2047 +@@ -684,6 +687,9 @@ static int tracepoint_module_going(struct module *mod)
2048 + {
2049 + struct tp_module *pos;
2050 +
2051 ++ if (!mod->num_tracepoints)
2052 ++ return 0;
2053 ++
2054 + mutex_lock(&tracepoints_mutex);
2055 + tracepoint_update_probe_range(mod->tracepoints_ptrs,
2056 + mod->tracepoints_ptrs + mod->num_tracepoints);
2057 +diff --git a/mm/hugetlb.c b/mm/hugetlb.c
2058 +index 8a7f27b42131..de73c9d144e1 100644
2059 +--- a/mm/hugetlb.c
2060 ++++ b/mm/hugetlb.c
2061 +@@ -1100,6 +1100,7 @@ static void return_unused_surplus_pages(struct hstate *h,
2062 + while (nr_pages--) {
2063 + if (!free_pool_huge_page(h, &node_states[N_MEMORY], 1))
2064 + break;
2065 ++ cond_resched_lock(&hugetlb_lock);
2066 + }
2067 + }
2068 +
2069 +diff --git a/net/8021q/vlan_dev.c b/net/8021q/vlan_dev.c
2070 +index cf35f383db4c..698e922f41ea 100644
2071 +--- a/net/8021q/vlan_dev.c
2072 ++++ b/net/8021q/vlan_dev.c
2073 +@@ -512,10 +512,48 @@ static void vlan_dev_change_rx_flags(struct net_device *dev, int change)
2074 + }
2075 + }
2076 +
2077 ++static int vlan_calculate_locking_subclass(struct net_device *real_dev)
2078 ++{
2079 ++ int subclass = 0;
2080 ++
2081 ++ while (is_vlan_dev(real_dev)) {
2082 ++ subclass++;
2083 ++ real_dev = vlan_dev_priv(real_dev)->real_dev;
2084 ++ }
2085 ++
2086 ++ return subclass;
2087 ++}
2088 ++
2089 ++static void vlan_dev_mc_sync(struct net_device *to, struct net_device *from)
2090 ++{
2091 ++ int err = 0, subclass;
2092 ++
2093 ++ subclass = vlan_calculate_locking_subclass(to);
2094 ++
2095 ++ spin_lock_nested(&to->addr_list_lock, subclass);
2096 ++ err = __hw_addr_sync(&to->mc, &from->mc, to->addr_len);
2097 ++ if (!err)
2098 ++ __dev_set_rx_mode(to);
2099 ++ spin_unlock(&to->addr_list_lock);
2100 ++}
2101 ++
2102 ++static void vlan_dev_uc_sync(struct net_device *to, struct net_device *from)
2103 ++{
2104 ++ int err = 0, subclass;
2105 ++
2106 ++ subclass = vlan_calculate_locking_subclass(to);
2107 ++
2108 ++ spin_lock_nested(&to->addr_list_lock, subclass);
2109 ++ err = __hw_addr_sync(&to->uc, &from->uc, to->addr_len);
2110 ++ if (!err)
2111 ++ __dev_set_rx_mode(to);
2112 ++ spin_unlock(&to->addr_list_lock);
2113 ++}
2114 ++
2115 + static void vlan_dev_set_rx_mode(struct net_device *vlan_dev)
2116 + {
2117 +- dev_mc_sync(vlan_dev_priv(vlan_dev)->real_dev, vlan_dev);
2118 +- dev_uc_sync(vlan_dev_priv(vlan_dev)->real_dev, vlan_dev);
2119 ++ vlan_dev_mc_sync(vlan_dev_priv(vlan_dev)->real_dev, vlan_dev);
2120 ++ vlan_dev_uc_sync(vlan_dev_priv(vlan_dev)->real_dev, vlan_dev);
2121 + }
2122 +
2123 + /*
2124 +@@ -624,9 +662,7 @@ static int vlan_dev_init(struct net_device *dev)
2125 +
2126 + SET_NETDEV_DEVTYPE(dev, &vlan_type);
2127 +
2128 +- if (is_vlan_dev(real_dev))
2129 +- subclass = 1;
2130 +-
2131 ++ subclass = vlan_calculate_locking_subclass(dev);
2132 + vlan_dev_set_lockdep_class(dev, subclass);
2133 +
2134 + vlan_dev_priv(dev)->vlan_pcpu_stats = alloc_percpu(struct vlan_pcpu_stats);
2135 +diff --git a/net/bridge/br_input.c b/net/bridge/br_input.c
2136 +index 828e2bcc1f52..0a3bc82782cf 100644
2137 +--- a/net/bridge/br_input.c
2138 ++++ b/net/bridge/br_input.c
2139 +@@ -71,7 +71,7 @@ int br_handle_frame_finish(struct sk_buff *skb)
2140 + goto drop;
2141 +
2142 + if (!br_allowed_ingress(p->br, nbp_get_vlan_info(p), skb, &vid))
2143 +- goto drop;
2144 ++ goto out;
2145 +
2146 + /* insert into forwarding database after filtering to avoid spoofing */
2147 + br = p->br;
2148 +diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
2149 +index 06873e80a432..f16e9e487750 100644
2150 +--- a/net/bridge/br_netlink.c
2151 ++++ b/net/bridge/br_netlink.c
2152 +@@ -438,6 +438,20 @@ static int br_validate(struct nlattr *tb[], struct nlattr *data[])
2153 + return 0;
2154 + }
2155 +
2156 ++static int br_dev_newlink(struct net *src_net, struct net_device *dev,
2157 ++ struct nlattr *tb[], struct nlattr *data[])
2158 ++{
2159 ++ struct net_bridge *br = netdev_priv(dev);
2160 ++
2161 ++ if (tb[IFLA_ADDRESS]) {
2162 ++ spin_lock_bh(&br->lock);
2163 ++ br_stp_change_bridge_id(br, nla_data(tb[IFLA_ADDRESS]));
2164 ++ spin_unlock_bh(&br->lock);
2165 ++ }
2166 ++
2167 ++ return register_netdevice(dev);
2168 ++}
2169 ++
2170 + static size_t br_get_link_af_size(const struct net_device *dev)
2171 + {
2172 + struct net_port_vlans *pv;
2173 +@@ -466,6 +480,7 @@ struct rtnl_link_ops br_link_ops __read_mostly = {
2174 + .priv_size = sizeof(struct net_bridge),
2175 + .setup = br_dev_setup,
2176 + .validate = br_validate,
2177 ++ .newlink = br_dev_newlink,
2178 + .dellink = br_dev_delete,
2179 + };
2180 +
2181 +diff --git a/net/bridge/br_vlan.c b/net/bridge/br_vlan.c
2182 +index 9a9ffe7e4019..d8deb8bda736 100644
2183 +--- a/net/bridge/br_vlan.c
2184 ++++ b/net/bridge/br_vlan.c
2185 +@@ -202,7 +202,7 @@ bool br_allowed_ingress(struct net_bridge *br, struct net_port_vlans *v,
2186 + * rejected.
2187 + */
2188 + if (!v)
2189 +- return false;
2190 ++ goto drop;
2191 +
2192 + if (br_vlan_get_tag(skb, vid)) {
2193 + u16 pvid = br_get_pvid(v);
2194 +@@ -212,7 +212,7 @@ bool br_allowed_ingress(struct net_bridge *br, struct net_port_vlans *v,
2195 + * traffic belongs to.
2196 + */
2197 + if (pvid == VLAN_N_VID)
2198 +- return false;
2199 ++ goto drop;
2200 +
2201 + /* PVID is set on this port. Any untagged ingress
2202 + * frame is considered to belong to this vlan.
2203 +@@ -224,7 +224,8 @@ bool br_allowed_ingress(struct net_bridge *br, struct net_port_vlans *v,
2204 + /* Frame had a valid vlan tag. See if vlan is allowed */
2205 + if (test_bit(*vid, v->vlan_bitmap))
2206 + return true;
2207 +-
2208 ++drop:
2209 ++ kfree_skb(skb);
2210 + return false;
2211 + }
2212 +
2213 +diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
2214 +index 3d110c4fc787..6651a7797d46 100644
2215 +--- a/net/bridge/netfilter/ebtables.c
2216 ++++ b/net/bridge/netfilter/ebtables.c
2217 +@@ -1044,10 +1044,9 @@ static int do_replace_finish(struct net *net, struct ebt_replace *repl,
2218 + if (repl->num_counters &&
2219 + copy_to_user(repl->counters, counterstmp,
2220 + repl->num_counters * sizeof(struct ebt_counter))) {
2221 +- ret = -EFAULT;
2222 ++ /* Silent error, can't fail, new table is already in place */
2223 ++ net_warn_ratelimited("ebtables: counters copy to user failed while replacing table\n");
2224 + }
2225 +- else
2226 +- ret = 0;
2227 +
2228 + /* decrease module count and free resources */
2229 + EBT_ENTRY_ITERATE(table->entries, table->entries_size,
2230 +diff --git a/net/core/dev.c b/net/core/dev.c
2231 +index a0e55ffc03c9..56383a3e5d71 100644
2232 +--- a/net/core/dev.c
2233 ++++ b/net/core/dev.c
2234 +@@ -3898,6 +3898,7 @@ static void napi_reuse_skb(struct napi_struct *napi, struct sk_buff *skb)
2235 + skb->vlan_tci = 0;
2236 + skb->dev = napi->dev;
2237 + skb->skb_iif = 0;
2238 ++ skb->truesize = SKB_TRUESIZE(skb_end_offset(skb));
2239 +
2240 + napi->skb = skb;
2241 + }
2242 +@@ -4634,6 +4635,7 @@ void __dev_set_rx_mode(struct net_device *dev)
2243 + if (ops->ndo_set_rx_mode)
2244 + ops->ndo_set_rx_mode(dev);
2245 + }
2246 ++EXPORT_SYMBOL(__dev_set_rx_mode);
2247 +
2248 + void dev_set_rx_mode(struct net_device *dev)
2249 + {
2250 +diff --git a/net/core/filter.c b/net/core/filter.c
2251 +index 52f01229ee01..c6c18d8a2d88 100644
2252 +--- a/net/core/filter.c
2253 ++++ b/net/core/filter.c
2254 +@@ -355,6 +355,8 @@ load_b:
2255 +
2256 + if (skb_is_nonlinear(skb))
2257 + return 0;
2258 ++ if (skb->len < sizeof(struct nlattr))
2259 ++ return 0;
2260 + if (A > skb->len - sizeof(struct nlattr))
2261 + return 0;
2262 +
2263 +@@ -371,11 +373,13 @@ load_b:
2264 +
2265 + if (skb_is_nonlinear(skb))
2266 + return 0;
2267 ++ if (skb->len < sizeof(struct nlattr))
2268 ++ return 0;
2269 + if (A > skb->len - sizeof(struct nlattr))
2270 + return 0;
2271 +
2272 + nla = (struct nlattr *)&skb->data[A];
2273 +- if (nla->nla_len > A - skb->len)
2274 ++ if (nla->nla_len > skb->len - A)
2275 + return 0;
2276 +
2277 + nla = nla_find_nested(nla, X);
2278 +diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
2279 +index 4c3087dffe78..87ec574ffac8 100644
2280 +--- a/net/core/rtnetlink.c
2281 ++++ b/net/core/rtnetlink.c
2282 +@@ -714,7 +714,8 @@ static inline int rtnl_vfinfo_size(const struct net_device *dev,
2283 + return 0;
2284 + }
2285 +
2286 +-static size_t rtnl_port_size(const struct net_device *dev)
2287 ++static size_t rtnl_port_size(const struct net_device *dev,
2288 ++ u32 ext_filter_mask)
2289 + {
2290 + size_t port_size = nla_total_size(4) /* PORT_VF */
2291 + + nla_total_size(PORT_PROFILE_MAX) /* PORT_PROFILE */
2292 +@@ -730,7 +731,8 @@ static size_t rtnl_port_size(const struct net_device *dev)
2293 + size_t port_self_size = nla_total_size(sizeof(struct nlattr))
2294 + + port_size;
2295 +
2296 +- if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent)
2297 ++ if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent ||
2298 ++ !(ext_filter_mask & RTEXT_FILTER_VF))
2299 + return 0;
2300 + if (dev_num_vf(dev->dev.parent))
2301 + return port_self_size + vf_ports_size +
2302 +@@ -765,7 +767,7 @@ static noinline size_t if_nlmsg_size(const struct net_device *dev,
2303 + + nla_total_size(ext_filter_mask
2304 + & RTEXT_FILTER_VF ? 4 : 0) /* IFLA_NUM_VF */
2305 + + rtnl_vfinfo_size(dev, ext_filter_mask) /* IFLA_VFINFO_LIST */
2306 +- + rtnl_port_size(dev) /* IFLA_VF_PORTS + IFLA_PORT_SELF */
2307 ++ + rtnl_port_size(dev, ext_filter_mask) /* IFLA_VF_PORTS + IFLA_PORT_SELF */
2308 + + rtnl_link_get_size(dev) /* IFLA_LINKINFO */
2309 + + rtnl_link_get_af_size(dev); /* IFLA_AF_SPEC */
2310 + }
2311 +@@ -826,11 +828,13 @@ static int rtnl_port_self_fill(struct sk_buff *skb, struct net_device *dev)
2312 + return 0;
2313 + }
2314 +
2315 +-static int rtnl_port_fill(struct sk_buff *skb, struct net_device *dev)
2316 ++static int rtnl_port_fill(struct sk_buff *skb, struct net_device *dev,
2317 ++ u32 ext_filter_mask)
2318 + {
2319 + int err;
2320 +
2321 +- if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent)
2322 ++ if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent ||
2323 ++ !(ext_filter_mask & RTEXT_FILTER_VF))
2324 + return 0;
2325 +
2326 + err = rtnl_port_self_fill(skb, dev);
2327 +@@ -985,7 +989,7 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
2328 + nla_nest_end(skb, vfinfo);
2329 + }
2330 +
2331 +- if (rtnl_port_fill(skb, dev))
2332 ++ if (rtnl_port_fill(skb, dev, ext_filter_mask))
2333 + goto nla_put_failure;
2334 +
2335 + if (dev->rtnl_link_ops) {
2336 +@@ -1039,6 +1043,7 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
2337 + struct hlist_head *head;
2338 + struct nlattr *tb[IFLA_MAX+1];
2339 + u32 ext_filter_mask = 0;
2340 ++ int err;
2341 +
2342 + s_h = cb->args[0];
2343 + s_idx = cb->args[1];
2344 +@@ -1059,11 +1064,17 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
2345 + hlist_for_each_entry_rcu(dev, head, index_hlist) {
2346 + if (idx < s_idx)
2347 + goto cont;
2348 +- if (rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
2349 +- NETLINK_CB(cb->skb).portid,
2350 +- cb->nlh->nlmsg_seq, 0,
2351 +- NLM_F_MULTI,
2352 +- ext_filter_mask) <= 0)
2353 ++ err = rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
2354 ++ NETLINK_CB(cb->skb).portid,
2355 ++ cb->nlh->nlmsg_seq, 0,
2356 ++ NLM_F_MULTI,
2357 ++ ext_filter_mask);
2358 ++ /* If we ran out of room on the first message,
2359 ++ * we're in trouble
2360 ++ */
2361 ++ WARN_ON((err == -EMSGSIZE) && (skb->len == 0));
2362 ++
2363 ++ if (err <= 0)
2364 + goto out;
2365 +
2366 + nl_dump_check_consistent(cb, nlmsg_hdr(skb));
2367 +diff --git a/net/core/skbuff.c b/net/core/skbuff.c
2368 +index 79143b7af7e5..66f722b5052a 100644
2369 +--- a/net/core/skbuff.c
2370 ++++ b/net/core/skbuff.c
2371 +@@ -3487,12 +3487,14 @@ EXPORT_SYMBOL(skb_try_coalesce);
2372 + unsigned int skb_gso_transport_seglen(const struct sk_buff *skb)
2373 + {
2374 + const struct skb_shared_info *shinfo = skb_shinfo(skb);
2375 +- unsigned int hdr_len;
2376 +
2377 + if (likely(shinfo->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)))
2378 +- hdr_len = tcp_hdrlen(skb);
2379 +- else
2380 +- hdr_len = sizeof(struct udphdr);
2381 +- return hdr_len + shinfo->gso_size;
2382 ++ return tcp_hdrlen(skb) + shinfo->gso_size;
2383 ++
2384 ++ /* UFO sets gso_size to the size of the fragmentation
2385 ++ * payload, i.e. the size of the L4 (UDP) header is already
2386 ++ * accounted for.
2387 ++ */
2388 ++ return shinfo->gso_size;
2389 + }
2390 + EXPORT_SYMBOL_GPL(skb_gso_transport_seglen);
2391 +diff --git a/net/core/sock_diag.c b/net/core/sock_diag.c
2392 +index a0e9cf6379de..6a7fae228634 100644
2393 +--- a/net/core/sock_diag.c
2394 ++++ b/net/core/sock_diag.c
2395 +@@ -49,7 +49,7 @@ int sock_diag_put_meminfo(struct sock *sk, struct sk_buff *skb, int attrtype)
2396 + }
2397 + EXPORT_SYMBOL_GPL(sock_diag_put_meminfo);
2398 +
2399 +-int sock_diag_put_filterinfo(struct user_namespace *user_ns, struct sock *sk,
2400 ++int sock_diag_put_filterinfo(struct sock *sk,
2401 + struct sk_buff *skb, int attrtype)
2402 + {
2403 + struct nlattr *attr;
2404 +@@ -57,7 +57,7 @@ int sock_diag_put_filterinfo(struct user_namespace *user_ns, struct sock *sk,
2405 + unsigned int len;
2406 + int err = 0;
2407 +
2408 +- if (!ns_capable(user_ns, CAP_NET_ADMIN)) {
2409 ++ if (!ns_capable(sock_net(sk)->user_ns, CAP_NET_ADMIN)) {
2410 + nla_reserve(skb, attrtype, 0);
2411 + return 0;
2412 + }
2413 +diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
2414 +index 8f6cb7a87cd6..9c3979a50804 100644
2415 +--- a/net/ipv4/fib_semantics.c
2416 ++++ b/net/ipv4/fib_semantics.c
2417 +@@ -818,13 +818,13 @@ struct fib_info *fib_create_info(struct fib_config *cfg)
2418 + fi = kzalloc(sizeof(*fi)+nhs*sizeof(struct fib_nh), GFP_KERNEL);
2419 + if (fi == NULL)
2420 + goto failure;
2421 ++ fib_info_cnt++;
2422 + if (cfg->fc_mx) {
2423 + fi->fib_metrics = kzalloc(sizeof(u32) * RTAX_MAX, GFP_KERNEL);
2424 + if (!fi->fib_metrics)
2425 + goto failure;
2426 + } else
2427 + fi->fib_metrics = (u32 *) dst_default_metrics;
2428 +- fib_info_cnt++;
2429 +
2430 + fi->fib_net = hold_net(net);
2431 + fi->fib_protocol = cfg->fc_protocol;
2432 +diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
2433 +index 98d7e53d2afd..bd1c5baf69be 100644
2434 +--- a/net/ipv4/ip_forward.c
2435 ++++ b/net/ipv4/ip_forward.c
2436 +@@ -42,12 +42,12 @@
2437 + static bool ip_may_fragment(const struct sk_buff *skb)
2438 + {
2439 + return unlikely((ip_hdr(skb)->frag_off & htons(IP_DF)) == 0) ||
2440 +- !skb->local_df;
2441 ++ skb->local_df;
2442 + }
2443 +
2444 + static bool ip_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
2445 + {
2446 +- if (skb->len <= mtu || skb->local_df)
2447 ++ if (skb->len <= mtu)
2448 + return false;
2449 +
2450 + if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu)
2451 +diff --git a/net/ipv4/ip_gre.c b/net/ipv4/ip_gre.c
2452 +index 828b2e8631e7..fae5a8459538 100644
2453 +--- a/net/ipv4/ip_gre.c
2454 ++++ b/net/ipv4/ip_gre.c
2455 +@@ -652,6 +652,7 @@ static const struct net_device_ops ipgre_netdev_ops = {
2456 + static void ipgre_tunnel_setup(struct net_device *dev)
2457 + {
2458 + dev->netdev_ops = &ipgre_netdev_ops;
2459 ++ dev->type = ARPHRD_IPGRE;
2460 + ip_tunnel_setup(dev, ipgre_net_id);
2461 + }
2462 +
2463 +@@ -690,7 +691,6 @@ static int ipgre_tunnel_init(struct net_device *dev)
2464 + memcpy(dev->dev_addr, &iph->saddr, 4);
2465 + memcpy(dev->broadcast, &iph->daddr, 4);
2466 +
2467 +- dev->type = ARPHRD_IPGRE;
2468 + dev->flags = IFF_NOARP;
2469 + dev->priv_flags &= ~IFF_XMIT_DST_RELEASE;
2470 + dev->addr_len = 4;
2471 +diff --git a/net/ipv4/ip_vti.c b/net/ipv4/ip_vti.c
2472 +index feb19db62359..4ec34275160b 100644
2473 +--- a/net/ipv4/ip_vti.c
2474 ++++ b/net/ipv4/ip_vti.c
2475 +@@ -579,9 +579,9 @@ static void vti_dev_free(struct net_device *dev)
2476 + static void vti_tunnel_setup(struct net_device *dev)
2477 + {
2478 + dev->netdev_ops = &vti_netdev_ops;
2479 ++ dev->type = ARPHRD_TUNNEL;
2480 + dev->destructor = vti_dev_free;
2481 +
2482 +- dev->type = ARPHRD_TUNNEL;
2483 + dev->hard_header_len = LL_MAX_HEADER + sizeof(struct iphdr);
2484 + dev->mtu = ETH_DATA_LEN;
2485 + dev->flags = IFF_NOARP;
2486 +diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
2487 +index 85a4f21aac1a..c8abe31961ed 100644
2488 +--- a/net/ipv4/netfilter/arp_tables.c
2489 ++++ b/net/ipv4/netfilter/arp_tables.c
2490 +@@ -1039,8 +1039,10 @@ static int __do_replace(struct net *net, const char *name,
2491 +
2492 + xt_free_table_info(oldinfo);
2493 + if (copy_to_user(counters_ptr, counters,
2494 +- sizeof(struct xt_counters) * num_counters) != 0)
2495 +- ret = -EFAULT;
2496 ++ sizeof(struct xt_counters) * num_counters) != 0) {
2497 ++ /* Silent error, can't fail, new table is already in place */
2498 ++ net_warn_ratelimited("arptables: counters copy to user failed while replacing table\n");
2499 ++ }
2500 + vfree(counters);
2501 + xt_table_unlock(t);
2502 + return ret;
2503 +diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
2504 +index d23118d95ff9..651c10774d58 100644
2505 +--- a/net/ipv4/netfilter/ip_tables.c
2506 ++++ b/net/ipv4/netfilter/ip_tables.c
2507 +@@ -1226,8 +1226,10 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
2508 +
2509 + xt_free_table_info(oldinfo);
2510 + if (copy_to_user(counters_ptr, counters,
2511 +- sizeof(struct xt_counters) * num_counters) != 0)
2512 +- ret = -EFAULT;
2513 ++ sizeof(struct xt_counters) * num_counters) != 0) {
2514 ++ /* Silent error, can't fail, new table is already in place */
2515 ++ net_warn_ratelimited("iptables: counters copy to user failed while replacing table\n");
2516 ++ }
2517 + vfree(counters);
2518 + xt_table_unlock(t);
2519 + return ret;
2520 +diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
2521 +index 8cae28f5c3cf..aa857a4a06a8 100644
2522 +--- a/net/ipv4/ping.c
2523 ++++ b/net/ipv4/ping.c
2524 +@@ -204,26 +204,33 @@ static int ping_init_sock(struct sock *sk)
2525 + {
2526 + struct net *net = sock_net(sk);
2527 + kgid_t group = current_egid();
2528 +- struct group_info *group_info = get_current_groups();
2529 +- int i, j, count = group_info->ngroups;
2530 ++ struct group_info *group_info;
2531 ++ int i, j, count;
2532 + kgid_t low, high;
2533 ++ int ret = 0;
2534 +
2535 + inet_get_ping_group_range_net(net, &low, &high);
2536 + if (gid_lte(low, group) && gid_lte(group, high))
2537 + return 0;
2538 +
2539 ++ group_info = get_current_groups();
2540 ++ count = group_info->ngroups;
2541 + for (i = 0; i < group_info->nblocks; i++) {