[gentoo-commits] linux-patches r2823 - genpatches-2.6/trunk/3.2

[Mike Pagano (mpagano)]

Author: mpagano
Date: 2014-06-09 18:29:31 +0000 (Mon, 09 Jun 2014)
New Revision: 2823

Added:
   genpatches-2.6/trunk/3.2/1058_linux-3.2.59.patch
   genpatches-2.6/trunk/3.2/1059_linux-3.2.60.patch
Removed:
   genpatches-2.6/trunk/3.2/1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch
   genpatches-2.6/trunk/3.2/1501-futex-add-another-early-deadlock-detection-check.patch
   genpatches-2.6/trunk/3.2/1502-futex-prevent-attaching-to-kernel-threads.patch
   genpatches-2.6/trunk/3.2/1503-futex-prevent-requeue-pi-on-same-futex-patch-futex-forbid-uaddr-uaddr2-in-futex_requeue-requeue_pi-1.patch
   genpatches-2.6/trunk/3.2/1504-futex-validate-atomic-acquisition-in-futex_lock_pi_atomic.patch
   genpatches-2.6/trunk/3.2/1505-futex-always-cleanup-owner-tid-in-unlock_pi.patch
   genpatches-2.6/trunk/3.2/1506-futex-make-lookup_pi_state-more-robust.patch
Modified:
   genpatches-2.6/trunk/3.2/0000_README
Log:
Linux patch 3.2.59. Linux patch 3.2.60. Removal of redundant patches

Modified: genpatches-2.6/trunk/3.2/0000_README
===================================================================
--- genpatches-2.6/trunk/3.2/0000_README	2014-06-09 17:57:46 UTC (rev 2822)
+++ genpatches-2.6/trunk/3.2/0000_README	2014-06-09 18:29:31 UTC (rev 2823)
@@ -272,10 +272,14 @@
 From:   http://www.kernel.org
 Desc:   Linux 3.2.58
 
-Patch:  1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch
-From:   https://git.kernel.org/cgit/linux/kernel/git/stable/stable-queue.git/commit/?id=19f9438d73833ed532c3ba4955f9c981c9af16f2
-Desc:   n_tty: Fix n_tty_write crash when echoing in raw mode
+Patch:  1058_linux-3.2.59.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.2.59
 
+Patch:  1059_linux-3.2.60.patch
+From:   http://www.kernel.org
+Desc:   Linux 3.2.60
+
 Patch:  1500_XATTR_USER_PREFIX.patch
 From:   https://bugs.gentoo.org/show_bug.cgi?id=470644
 Desc:   Support for namespace user.pax.* on tmpfs.
@@ -284,30 +288,6 @@
 From:   https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6a96e15096da6e7491107321cfa660c7c2aa119d
 Desc:   selinux: add SOCK_DIAG_BY_FAMILY to the list of netlink message types
 
-Patch:  1501-futex-add-another-early-deadlock-detection-check.patch
-From:   https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=866293ee54227584ffcb4a42f69c1f365974ba7f
-Desc:   CVE-2014-3153
-
-Patch:  1502-futex-prevent-attaching-to-kernel-threads.patch
-From:   https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f0d71b3dcb8332f7971b5f2363632573e6d9486a
-Desc:   CVE-2014-3153
-
-Patch:  1503-futex-prevent-requeue-pi-on-same-futex-patch-futex-forbid-uaddr-uaddr2-in-futex_requeue-requeue_pi-1.patch
-From:   https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=e9c243a5a6de0be8e584c604d353412584b592f8
-Desc:   CVE-2014-3153
-
-Patch:  1504-futex-validate-atomic-acquisition-in-futex_lock_pi_atomic.patch
-From:   https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b3eaa9fc5cd0a4d74b18f6b8dc617aeaf1873270
-Desc:   CVE-2014-3153
-
-Patch:  1505-futex-always-cleanup-owner-tid-in-unlock_pi.patch
-From:   https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=13fbca4c6ecd96ec1a1cfa2e4f2ce191fe928a5e
-Desc:   CVE-2014-3153
-
-Patch:  1506-futex-make-lookup_pi_state-more-robust.patch
-From:   https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=54a217887a7b658e2650c3feff22756ab80c7339
-Desc:   CVE-2014-3153
-
 Patch:  1512_af_key-initialize-satype-in-key_notify_policy_flush.patch
 From:   https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=85dfb745ee40232876663ae206cba35f24ab2a40
 Desc:   af_key: initialize satype in key_notify_policy_flush()

Added: genpatches-2.6/trunk/3.2/1058_linux-3.2.59.patch
===================================================================
--- genpatches-2.6/trunk/3.2/1058_linux-3.2.59.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.2/1058_linux-3.2.59.patch	2014-06-09 18:29:31 UTC (rev 2823)
@@ -0,0 +1,1213 @@
+diff --git a/Makefile b/Makefile
+index d59b394ba6cd..1be3414a141f 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 58
++SUBLEVEL = 59
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+ 
+diff --git a/arch/arm/include/asm/div64.h b/arch/arm/include/asm/div64.h
+index d3f0a9eee9f6..506e33baabd3 100644
+--- a/arch/arm/include/asm/div64.h
++++ b/arch/arm/include/asm/div64.h
+@@ -156,7 +156,7 @@
+ 		/* Select the best insn combination to perform the   */	\
+ 		/* actual __m * __n / (__p << 64) operation.         */	\
+ 		if (!__c) {						\
+-			asm (	"umull	%Q0, %R0, %1, %Q2\n\t"		\
++			asm (	"umull	%Q0, %R0, %Q1, %Q2\n\t"		\
+ 				"mov	%Q0, #0"			\
+ 				: "=&r" (__res)				\
+ 				: "r" (__m), "r" (__n)			\
+diff --git a/arch/parisc/kernel/syscall_table.S b/arch/parisc/kernel/syscall_table.S
+index 3735abd7f8f6..4014d9064be1 100644
+--- a/arch/parisc/kernel/syscall_table.S
++++ b/arch/parisc/kernel/syscall_table.S
+@@ -395,7 +395,7 @@
+ 	ENTRY_COMP(vmsplice)
+ 	ENTRY_COMP(move_pages)		/* 295 */
+ 	ENTRY_SAME(getcpu)
+-	ENTRY_SAME(epoll_pwait)
++	ENTRY_COMP(epoll_pwait)
+ 	ENTRY_COMP(statfs64)
+ 	ENTRY_COMP(fstatfs64)
+ 	ENTRY_COMP(kexec_load)		/* 300 */
+diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
+index b3f0f5ad8c41..2b662725fd90 100644
+--- a/drivers/ata/libata-core.c
++++ b/drivers/ata/libata-core.c
+@@ -4718,21 +4718,26 @@ void swap_buf_le16(u16 *buf, unsigned int buf_words)
+ static struct ata_queued_cmd *ata_qc_new(struct ata_port *ap)
+ {
+ 	struct ata_queued_cmd *qc = NULL;
+-	unsigned int i;
++	unsigned int i, tag;
+ 
+ 	/* no command while frozen */
+ 	if (unlikely(ap->pflags & ATA_PFLAG_FROZEN))
+ 		return NULL;
+ 
+-	/* the last tag is reserved for internal command. */
+-	for (i = 0; i < ATA_MAX_QUEUE - 1; i++)
+-		if (!test_and_set_bit(i, &ap->qc_allocated)) {
+-			qc = __ata_qc_from_tag(ap, i);
++	for (i = 0; i < ATA_MAX_QUEUE; i++) {
++		tag = (i + ap->last_tag + 1) % ATA_MAX_QUEUE;
++
++		/* the last tag is reserved for internal command. */
++		if (tag == ATA_TAG_INTERNAL)
++			continue;
++
++		if (!test_and_set_bit(tag, &ap->qc_allocated)) {
++			qc = __ata_qc_from_tag(ap, tag);
++			qc->tag = tag;
++			ap->last_tag = tag;
+ 			break;
+ 		}
+-
+-	if (qc)
+-		qc->tag = i;
++	}
+ 
+ 	return qc;
+ }
+diff --git a/drivers/block/floppy.c b/drivers/block/floppy.c
+index 7a90d4ae6e52..6d0f3e138221 100644
+--- a/drivers/block/floppy.c
++++ b/drivers/block/floppy.c
+@@ -3060,7 +3060,10 @@ static int raw_cmd_copyout(int cmd, void __user *param,
+ 	int ret;
+ 
+ 	while (ptr) {
+-		ret = copy_to_user(param, ptr, sizeof(*ptr));
++		struct floppy_raw_cmd cmd = *ptr;
++		cmd.next = NULL;
++		cmd.kernel_data = NULL;
++		ret = copy_to_user(param, &cmd, sizeof(cmd));
+ 		if (ret)
+ 			return -EFAULT;
+ 		param += sizeof(struct floppy_raw_cmd);
+@@ -3114,10 +3117,11 @@ loop:
+ 		return -ENOMEM;
+ 	*rcmd = ptr;
+ 	ret = copy_from_user(ptr, param, sizeof(*ptr));
+-	if (ret)
+-		return -EFAULT;
+ 	ptr->next = NULL;
+ 	ptr->buffer_length = 0;
++	ptr->kernel_data = NULL;
++	if (ret)
++		return -EFAULT;
+ 	param += sizeof(struct floppy_raw_cmd);
+ 	if (ptr->cmd_count > 33)
+ 			/* the command may now also take up the space
+@@ -3133,7 +3137,6 @@ loop:
+ 	for (i = 0; i < 16; i++)
+ 		ptr->reply[i] = 0;
+ 	ptr->resultcode = 0;
+-	ptr->kernel_data = NULL;
+ 
+ 	if (ptr->flags & (FD_RAW_READ | FD_RAW_WRITE)) {
+ 		if (ptr->length <= 0)
+diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
+index 4cd392dbf115..2861ef4570fc 100644
+--- a/drivers/firmware/dmi_scan.c
++++ b/drivers/firmware/dmi_scan.c
+@@ -534,9 +534,15 @@ static bool dmi_matches(const struct dmi_system_id *dmi)
+ 		int s = dmi->matches[i].slot;
+ 		if (s == DMI_NONE)
+ 			break;
+-		if (dmi_ident[s]
+-		    && strstr(dmi_ident[s], dmi->matches[i].substr))
+-			continue;
++		if (dmi_ident[s]) {
++			if (!dmi->matches[i].exact_match &&
++			    strstr(dmi_ident[s], dmi->matches[i].substr))
++				continue;
++			else if (dmi->matches[i].exact_match &&
++				 !strcmp(dmi_ident[s], dmi->matches[i].substr))
++				continue;
++		}
++
+ 		/* No match */
+ 		return false;
+ 	}
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index bc35070daf78..886c1914146b 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -1394,6 +1394,14 @@ static const struct dmi_system_id min_max_dmi_table[] __initconst = {
+ 		.driver_data = (int []){1232, 5710, 1156, 4696},
+ 	},
+ 	{
++		/* Lenovo ThinkPad T431s */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++			DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad T431"),
++		},
++		.driver_data = (int []){1024, 5112, 2024, 4832},
++	},
++	{
+ 		/* Lenovo ThinkPad T440s */
+ 		.matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+@@ -1402,6 +1410,14 @@ static const struct dmi_system_id min_max_dmi_table[] __initconst = {
+ 		.driver_data = (int []){1024, 5112, 2024, 4832},
+ 	},
+ 	{
++		/* Lenovo ThinkPad L440 */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++			DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad L440"),
++		},
++		.driver_data = (int []){1024, 5112, 2024, 4832},
++	},
++	{
+ 		/* Lenovo ThinkPad T540p */
+ 		.matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+@@ -1409,6 +1425,32 @@ static const struct dmi_system_id min_max_dmi_table[] __initconst = {
+ 		},
+ 		.driver_data = (int []){1024, 5056, 2058, 4832},
+ 	},
++	{
++		/* Lenovo ThinkPad L540 */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++			DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad L540"),
++		},
++		.driver_data = (int []){1024, 5112, 2024, 4832},
++	},
++	{
++		/* Lenovo Yoga S1 */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++			DMI_EXACT_MATCH(DMI_PRODUCT_VERSION,
++					"ThinkPad S1 Yoga"),
++		},
++		.driver_data = (int []){1232, 5710, 1156, 4696},
++	},
++	{
++		/* Lenovo ThinkPad X1 Carbon Haswell (3rd generation) */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++			DMI_MATCH(DMI_PRODUCT_VERSION,
++					"ThinkPad X1 Carbon 2nd"),
++		},
++		.driver_data = (int []){1024, 5112, 2024, 4832},
++	},
+ #endif
+ 	{ }
+ };
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_cq.c b/drivers/net/ethernet/mellanox/mlx4/en_cq.c
+index 5829e0b47e7e..ba7c861e2b93 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_cq.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_cq.c
+@@ -58,7 +58,6 @@ int mlx4_en_create_cq(struct mlx4_en_priv *priv,
+ 
+ 	cq->ring = ring;
+ 	cq->is_tx = mode;
+-	spin_lock_init(&cq->lock);
+ 
+ 	err = mlx4_alloc_hwq_res(mdev->dev, &cq->wqres,
+ 				cq->buf_size, 2 * PAGE_SIZE);
+diff --git a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+index 78d776bc355c..308349a43d60 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
++++ b/drivers/net/ethernet/mellanox/mlx4/en_netdev.c
+@@ -355,15 +355,11 @@ static void mlx4_en_netpoll(struct net_device *dev)
+ {
+ 	struct mlx4_en_priv *priv = netdev_priv(dev);
+ 	struct mlx4_en_cq *cq;
+-	unsigned long flags;
+ 	int i;
+ 
+ 	for (i = 0; i < priv->rx_ring_num; i++) {
+ 		cq = &priv->rx_cq[i];
+-		spin_lock_irqsave(&cq->lock, flags);
+-		napi_synchronize(&cq->napi);
+-		mlx4_en_process_rx_cq(dev, cq, 0);
+-		spin_unlock_irqrestore(&cq->lock, flags);
++		napi_schedule(&cq->napi);
+ 	}
+ }
+ #endif
+diff --git a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+index 207b5add3ca8..492055885109 100644
+--- a/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
++++ b/drivers/net/ethernet/mellanox/mlx4/mlx4_en.h
+@@ -300,7 +300,6 @@ struct mlx4_en_cq {
+ 	struct mlx4_cq          mcq;
+ 	struct mlx4_hwq_resources wqres;
+ 	int                     ring;
+-	spinlock_t              lock;
+ 	struct net_device      *dev;
+ 	struct napi_struct	napi;
+ 	/* Per-core Tx cq processing support */
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
+index a004ad75d568..ba7ef2fd4997 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192c/dm_common.c
+@@ -1228,11 +1228,14 @@ static void rtl92c_dm_refresh_rate_adaptive_mask(struct ieee80211_hw *hw)
+ 			if (rtlhal->interface == INTF_PCI) {
+ 				rcu_read_lock();
+ 				sta = ieee80211_find_sta(mac->vif, mac->bssid);
++				if (!sta)
++					goto out_unlock;
+ 			}
+ 			rtlpriv->cfg->ops->update_rate_tbl(hw, sta,
+ 					p_ra->ratr_state);
+ 
+ 			p_ra->pre_ratr_state = p_ra->ratr_state;
++		out_unlock:
+ 			if (rtlhal->interface == INTF_PCI)
+ 				rcu_read_unlock();
+ 		}
+diff --git a/drivers/staging/rtl8712/rtl871x_recv.c b/drivers/staging/rtl8712/rtl871x_recv.c
+index 7069f06d9b5d..4cc68d1b5069 100644
+--- a/drivers/staging/rtl8712/rtl871x_recv.c
++++ b/drivers/staging/rtl8712/rtl871x_recv.c
+@@ -254,7 +254,7 @@ union recv_frame *r8712_portctrl(struct _adapter *adapter,
+ 	struct sta_info *psta;
+ 	struct	sta_priv *pstapriv;
+ 	union recv_frame *prtnframe;
+-	u16 ether_type = 0;
++	u16 ether_type;
+ 
+ 	pstapriv = &adapter->stapriv;
+ 	ptr = get_recvframe_data(precv_frame);
+@@ -263,15 +263,14 @@ union recv_frame *r8712_portctrl(struct _adapter *adapter,
+ 	psta = r8712_get_stainfo(pstapriv, psta_addr);
+ 	auth_alg = adapter->securitypriv.AuthAlgrthm;
+ 	if (auth_alg == 2) {
++		/* get ether_type */
++		ptr = ptr + pfhdr->attrib.hdrlen + LLC_HEADER_SIZE;
++		memcpy(&ether_type, ptr, 2);
++		ether_type = ntohs((unsigned short)ether_type);
++
+ 		if ((psta != NULL) && (psta->ieee8021x_blocked)) {
+ 			/* blocked
+ 			 * only accept EAPOL frame */
+-			prtnframe = precv_frame;
+-			/*get ether_type */
+-			ptr = ptr + pfhdr->attrib.hdrlen +
+-			      pfhdr->attrib.iv_len + LLC_HEADER_SIZE;
+-			memcpy(&ether_type, ptr, 2);
+-			ether_type = ntohs((unsigned short)ether_type);
+ 			if (ether_type == 0x888e)
+ 				prtnframe = precv_frame;
+ 			else {
+diff --git a/drivers/tty/n_tty.c b/drivers/tty/n_tty.c
+index 0f8a785a5f60..bac83d82c117 100644
+--- a/drivers/tty/n_tty.c
++++ b/drivers/tty/n_tty.c
+@@ -1997,7 +1997,9 @@ static ssize_t n_tty_write(struct tty_struct *tty, struct file *file,
+ 				tty->ops->flush_chars(tty);
+ 		} else {
+ 			while (nr > 0) {
++				mutex_lock(&tty->output_lock);
+ 				c = tty->ops->write(tty, b, nr);
++				mutex_unlock(&tty->output_lock);
+ 				if (c < 0) {
+ 					retval = c;
+ 					goto break_out;
+diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
+index 636ee9e5ff39..320db2a585ad 100644
+--- a/drivers/usb/class/cdc-acm.c
++++ b/drivers/usb/class/cdc-acm.c
+@@ -1493,13 +1493,27 @@ static const struct usb_device_id acm_ids[] = {
+ 	},
+ 	/* Motorola H24 HSPA module: */
+ 	{ USB_DEVICE(0x22b8, 0x2d91) }, /* modem                                */
+-	{ USB_DEVICE(0x22b8, 0x2d92) }, /* modem           + diagnostics        */
+-	{ USB_DEVICE(0x22b8, 0x2d93) }, /* modem + AT port                      */
+-	{ USB_DEVICE(0x22b8, 0x2d95) }, /* modem + AT port + diagnostics        */
+-	{ USB_DEVICE(0x22b8, 0x2d96) }, /* modem                         + NMEA */
+-	{ USB_DEVICE(0x22b8, 0x2d97) }, /* modem           + diagnostics + NMEA */
+-	{ USB_DEVICE(0x22b8, 0x2d99) }, /* modem + AT port               + NMEA */
+-	{ USB_DEVICE(0x22b8, 0x2d9a) }, /* modem + AT port + diagnostics + NMEA */
++	{ USB_DEVICE(0x22b8, 0x2d92),   /* modem           + diagnostics        */
++	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
++	},
++	{ USB_DEVICE(0x22b8, 0x2d93),   /* modem + AT port                      */
++	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
++	},
++	{ USB_DEVICE(0x22b8, 0x2d95),   /* modem + AT port + diagnostics        */
++	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
++	},
++	{ USB_DEVICE(0x22b8, 0x2d96),   /* modem                         + NMEA */
++	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
++	},
++	{ USB_DEVICE(0x22b8, 0x2d97),   /* modem           + diagnostics + NMEA */
++	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
++	},
++	{ USB_DEVICE(0x22b8, 0x2d99),   /* modem + AT port               + NMEA */
++	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
++	},
++	{ USB_DEVICE(0x22b8, 0x2d9a),   /* modem + AT port + diagnostics + NMEA */
++	.driver_info = NO_UNION_NORMAL, /* handle only modem interface          */
++	},
+ 
+ 	{ USB_DEVICE(0x0572, 0x1329), /* Hummingbird huc56s (Conexant) */
+ 	.driver_info = NO_UNION_NORMAL, /* union descriptor misplaced on
+diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
+index 2b4f42bac98f..188654458c2e 100644
+--- a/drivers/usb/host/xhci-ring.c
++++ b/drivers/usb/host/xhci-ring.c
+@@ -570,10 +570,11 @@ void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
+ 		struct xhci_dequeue_state *state)
+ {
+ 	struct xhci_virt_device *dev = xhci->devs[slot_id];
++	struct xhci_virt_ep *ep = &dev->eps[ep_index];
+ 	struct xhci_ring *ep_ring;
+ 	struct xhci_generic_trb *trb;
+-	struct xhci_ep_ctx *ep_ctx;
+ 	dma_addr_t addr;
++	u64 hw_dequeue;
+ 
+ 	ep_ring = xhci_triad_to_transfer_ring(xhci, slot_id,
+ 			ep_index, stream_id);
+@@ -583,52 +584,62 @@ void xhci_find_new_dequeue_state(struct xhci_hcd *xhci,
+ 				stream_id);
+ 		return;
+ 	}
+-	state->new_cycle_state = 0;
+-	xhci_dbg(xhci, "Finding segment containing stopped TRB.\n");
+-	state->new_deq_seg = find_trb_seg(cur_td->start_seg,
+-			dev->eps[ep_index].stopped_trb,
+-			&state->new_cycle_state);
+-	if (!state->new_deq_seg) {
+-		WARN_ON(1);
+-		return;
+-	}
+ 
+ 	/* Dig out the cycle state saved by the xHC during the stop ep cmd */
+ 	xhci_dbg(xhci, "Finding endpoint context\n");
+-	ep_ctx = xhci_get_ep_ctx(xhci, dev->out_ctx, ep_index);
+-	state->new_cycle_state = 0x1 & le64_to_cpu(ep_ctx->deq);
++	/* 4.6.9 the css flag is written to the stream context for streams */
++	if (ep->ep_state & EP_HAS_STREAMS) {
++		struct xhci_stream_ctx *ctx =
++			&ep->stream_info->stream_ctx_array[stream_id];
++		hw_dequeue = le64_to_cpu(ctx->stream_ring);
++	} else {
++		struct xhci_ep_ctx *ep_ctx
++			= xhci_get_ep_ctx(xhci, dev->out_ctx, ep_index);
++		hw_dequeue = le64_to_cpu(ep_ctx->deq);
++	}
++
++	/* Find virtual address and segment of hardware dequeue pointer */
++	state->new_deq_seg = ep_ring->deq_seg;
++	state->new_deq_ptr = ep_ring->dequeue;
++	while (xhci_trb_virt_to_dma(state->new_deq_seg, state->new_deq_ptr)
++			!= (dma_addr_t)(hw_dequeue & ~0xf)) {
++		next_trb(xhci, ep_ring, &state->new_deq_seg,
++					&state->new_deq_ptr);
++		if (state->new_deq_ptr == ep_ring->dequeue) {
++			WARN_ON(1);
++			return;
++		}
++	}
++	/*
++	 * Find cycle state for last_trb, starting at old cycle state of
++	 * hw_dequeue. If there is only one segment ring, find_trb_seg() will
++	 * return immediately and cannot toggle the cycle state if this search
++	 * wraps around, so add one more toggle manually in that case.
++	 */
++	state->new_cycle_state = hw_dequeue & 0x1;
++	if (ep_ring->first_seg == ep_ring->first_seg->next &&
++			cur_td->last_trb < state->new_deq_ptr)
++		state->new_cycle_state ^= 0x1;
+ 
+ 	state->new_deq_ptr = cur_td->last_trb;
+ 	xhci_dbg(xhci, "Finding segment containing last TRB in TD.\n");
+ 	state->new_deq_seg = find_trb_seg(state->new_deq_seg,
+-			state->new_deq_ptr,
+-			&state->new_cycle_state);
++			state->new_deq_ptr, &state->new_cycle_state);
+ 	if (!state->new_deq_seg) {
+ 		WARN_ON(1);
+ 		return;
+ 	}
+ 
++	/* Increment to find next TRB after last_trb. Cycle if appropriate. */
+ 	trb = &state->new_deq_ptr->generic;
+ 	if (TRB_TYPE_LINK_LE32(trb->field[3]) &&
+ 	    (trb->field[3] & cpu_to_le32(LINK_TOGGLE)))
+ 		state->new_cycle_state ^= 0x1;
+ 	next_trb(xhci, ep_ring, &state->new_deq_seg, &state->new_deq_ptr);
+ 
+-	/*
+-	 * If there is only one segment in a ring, find_trb_seg()'s while loop
+-	 * will not run, and it will return before it has a chance to see if it
+-	 * needs to toggle the cycle bit.  It can't tell if the stalled transfer
+-	 * ended just before the link TRB on a one-segment ring, or if the TD
+-	 * wrapped around the top of the ring, because it doesn't have the TD in
+-	 * question.  Look for the one-segment case where stalled TRB's address
+-	 * is greater than the new dequeue pointer address.
+-	 */
+-	if (ep_ring->first_seg == ep_ring->first_seg->next &&
+-			state->new_deq_ptr < dev->eps[ep_index].stopped_trb)
+-		state->new_cycle_state ^= 0x1;
++	/* Don't update the ring cycle state for the producer (us). */
+ 	xhci_dbg(xhci, "Cycle state = 0x%x\n", state->new_cycle_state);
+ 
+-	/* Don't update the ring cycle state for the producer (us). */
+ 	xhci_dbg(xhci, "New dequeue segment = %p (virtual)\n",
+ 			state->new_deq_seg);
+ 	addr = xhci_trb_virt_to_dma(state->new_deq_seg, state->new_deq_ptr);
+@@ -813,7 +824,6 @@ static void handle_stopped_endpoint(struct xhci_hcd *xhci,
+ 	if (list_empty(&ep->cancelled_td_list)) {
+ 		xhci_stop_watchdog_timer_in_irq(xhci, ep);
+ 		ep->stopped_td = NULL;
+-		ep->stopped_trb = NULL;
+ 		ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
+ 		return;
+ 	}
+@@ -880,11 +890,9 @@ remove_finished_td:
+ 		ring_doorbell_for_active_rings(xhci, slot_id, ep_index);
+ 	}
+ 
+-	/* Clear stopped_td and stopped_trb if endpoint is not halted */
+-	if (!(ep->ep_state & EP_HALTED)) {
++	/* Clear stopped_td if endpoint is not halted */
++	if (!(ep->ep_state & EP_HALTED))
+ 		ep->stopped_td = NULL;
+-		ep->stopped_trb = NULL;
+-	}
+ 
+ 	/*
+ 	 * Drop the lock and complete the URBs in the cancelled TD list.
+@@ -1744,14 +1752,12 @@ static void xhci_cleanup_halted_endpoint(struct xhci_hcd *xhci,
+ 	struct xhci_virt_ep *ep = &xhci->devs[slot_id]->eps[ep_index];
+ 	ep->ep_state |= EP_HALTED;
+ 	ep->stopped_td = td;
+-	ep->stopped_trb = event_trb;
+ 	ep->stopped_stream = stream_id;
+ 
+ 	xhci_queue_reset_ep(xhci, slot_id, ep_index);
+ 	xhci_cleanup_stalled_ring(xhci, td->urb->dev, ep_index);
+ 
+ 	ep->stopped_td = NULL;
+-	ep->stopped_trb = NULL;
+ 	ep->stopped_stream = 0;
+ 
+ 	xhci_ring_cmd_db(xhci);
+@@ -1833,7 +1839,6 @@ static int finish_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ 		 * the ring dequeue pointer or take this TD off any lists yet.
+ 		 */
+ 		ep->stopped_td = td;
+-		ep->stopped_trb = event_trb;
+ 		return 0;
+ 	} else {
+ 		if (trb_comp_code == COMP_STALL) {
+@@ -1845,7 +1850,6 @@ static int finish_td(struct xhci_hcd *xhci, struct xhci_td *td,
+ 			 * USB class driver clear the stall later.
+ 			 */
+ 			ep->stopped_td = td;
+-			ep->stopped_trb = event_trb;
+ 			ep->stopped_stream = ep_ring->stream_id;
+ 		} else if (xhci_requires_manual_halt_cleanup(xhci,
+ 					ep_ctx, trb_comp_code)) {
+diff --git a/drivers/usb/host/xhci.c b/drivers/usb/host/xhci.c
+index 03c35da16e48..b2eac8db55e8 100644
+--- a/drivers/usb/host/xhci.c
++++ b/drivers/usb/host/xhci.c
+@@ -378,16 +378,16 @@ static int xhci_try_enable_msi(struct usb_hcd *hcd)
+ 
+ #else
+ 
+-static int xhci_try_enable_msi(struct usb_hcd *hcd)
++static inline int xhci_try_enable_msi(struct usb_hcd *hcd)
+ {
+ 	return 0;
+ }
+ 
+-static void xhci_cleanup_msix(struct xhci_hcd *xhci)
++static inline void xhci_cleanup_msix(struct xhci_hcd *xhci)
+ {
+ }
+ 
+-static void xhci_msix_sync_irqs(struct xhci_hcd *xhci)
++static inline void xhci_msix_sync_irqs(struct xhci_hcd *xhci)
+ {
+ }
+ 
+@@ -2884,7 +2884,6 @@ void xhci_endpoint_reset(struct usb_hcd *hcd,
+ 		xhci_ring_cmd_db(xhci);
+ 	}
+ 	virt_ep->stopped_td = NULL;
+-	virt_ep->stopped_trb = NULL;
+ 	virt_ep->stopped_stream = 0;
+ 	spin_unlock_irqrestore(&xhci->lock, flags);
+ 
+diff --git a/drivers/usb/host/xhci.h b/drivers/usb/host/xhci.h
+index cf4fd241fc77..1bc91c8927aa 100644
+--- a/drivers/usb/host/xhci.h
++++ b/drivers/usb/host/xhci.h
+@@ -835,8 +835,6 @@ struct xhci_virt_ep {
+ #define EP_GETTING_NO_STREAMS	(1 << 5)
+ 	/* ----  Related to URB cancellation ---- */
+ 	struct list_head	cancelled_td_list;
+-	/* The TRB that was last reported in a stopped endpoint ring */
+-	union xhci_trb		*stopped_trb;
+ 	struct xhci_td		*stopped_td;
+ 	unsigned int		stopped_stream;
+ 	/* Watchdog timer for stop endpoint command to cancel URBs */
+diff --git a/drivers/usb/serial/cp210x.c b/drivers/usb/serial/cp210x.c
+index c408ff73e99d..01fd64a0a9ee 100644
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -110,6 +110,7 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(0x10C4, 0x8218) }, /* Lipowsky Industrie Elektronik GmbH, HARP-1 */
+ 	{ USB_DEVICE(0x10C4, 0x822B) }, /* Modem EDGE(GSM) Comander 2 */
+ 	{ USB_DEVICE(0x10C4, 0x826B) }, /* Cygnal Integrated Products, Inc., Fasttrax GPS demonstration module */
++	{ USB_DEVICE(0x10C4, 0x8281) }, /* Nanotec Plug & Drive */
+ 	{ USB_DEVICE(0x10C4, 0x8293) }, /* Telegesis ETRX2USB */
+ 	{ USB_DEVICE(0x10C4, 0x82F9) }, /* Procyon AVS */
+ 	{ USB_DEVICE(0x10C4, 0x8341) }, /* Siemens MC35PU GPRS Modem */
+diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
+index 5c97d9fcc613..332f04d76bd9 100644
+--- a/drivers/usb/serial/ftdi_sio.c
++++ b/drivers/usb/serial/ftdi_sio.c
+@@ -920,6 +920,39 @@ static struct usb_device_id id_table_combined [] = {
+ 	{ USB_DEVICE(FTDI_VID, FTDI_Z3X_PID) },
+ 	/* Cressi Devices */
+ 	{ USB_DEVICE(FTDI_VID, FTDI_CRESSI_PID) },
++	/* Brainboxes Devices */
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_001_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_012_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_023_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_VX_034_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_101_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_1_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_2_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_3_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_4_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_5_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_6_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_7_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_160_8_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_257_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_1_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_2_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_3_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_279_4_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_313_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_324_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_346_1_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_346_2_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_357_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_606_1_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_606_2_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_606_3_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_701_1_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_701_2_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_1_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_2_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_3_PID) },
++	{ USB_DEVICE(BRAINBOXES_VID, BRAINBOXES_US_842_4_PID) },
+ 	{ },					/* Optional parameter entry */
+ 	{ }					/* Terminating entry */
+ };
+diff --git a/drivers/usb/serial/ftdi_sio_ids.h b/drivers/usb/serial/ftdi_sio_ids.h
+index 71fe2de79bab..83a440fd28d6 100644
+--- a/drivers/usb/serial/ftdi_sio_ids.h
++++ b/drivers/usb/serial/ftdi_sio_ids.h
+@@ -1326,3 +1326,40 @@
+  * Manufacturer: Cressi
+  */
+ #define FTDI_CRESSI_PID		0x87d0
++
++/*
++ * Brainboxes devices
++ */
++#define BRAINBOXES_VID			0x05d1
++#define BRAINBOXES_VX_001_PID		0x1001 /* VX-001 ExpressCard 1 Port RS232 */
++#define BRAINBOXES_VX_012_PID		0x1002 /* VX-012 ExpressCard 2 Port RS232 */
++#define BRAINBOXES_VX_023_PID		0x1003 /* VX-023 ExpressCard 1 Port RS422/485 */
++#define BRAINBOXES_VX_034_PID		0x1004 /* VX-034 ExpressCard 2 Port RS422/485 */
++#define BRAINBOXES_US_101_PID		0x1011 /* US-101 1xRS232 */
++#define BRAINBOXES_US_324_PID		0x1013 /* US-324 1xRS422/485 1Mbaud */
++#define BRAINBOXES_US_606_1_PID		0x2001 /* US-606 6 Port RS232 Serial Port 1 and 2 */
++#define BRAINBOXES_US_606_2_PID		0x2002 /* US-606 6 Port RS232 Serial Port 3 and 4 */
++#define BRAINBOXES_US_606_3_PID		0x2003 /* US-606 6 Port RS232 Serial Port 4 and 6 */
++#define BRAINBOXES_US_701_1_PID		0x2011 /* US-701 4xRS232 1Mbaud Port 1 and 2 */
++#define BRAINBOXES_US_701_2_PID		0x2012 /* US-701 4xRS422 1Mbaud Port 3 and 4 */
++#define BRAINBOXES_US_279_1_PID		0x2021 /* US-279 8xRS422 1Mbaud Port 1 and 2 */
++#define BRAINBOXES_US_279_2_PID		0x2022 /* US-279 8xRS422 1Mbaud Port 3 and 4 */
++#define BRAINBOXES_US_279_3_PID		0x2023 /* US-279 8xRS422 1Mbaud Port 5 and 6 */
++#define BRAINBOXES_US_279_4_PID		0x2024 /* US-279 8xRS422 1Mbaud Port 7 and 8 */
++#define BRAINBOXES_US_346_1_PID		0x3011 /* US-346 4xRS422/485 1Mbaud Port 1 and 2 */
++#define BRAINBOXES_US_346_2_PID		0x3012 /* US-346 4xRS422/485 1Mbaud Port 3 and 4 */
++#define BRAINBOXES_US_257_PID		0x5001 /* US-257 2xRS232 1Mbaud */
++#define BRAINBOXES_US_313_PID		0x6001 /* US-313 2xRS422/485 1Mbaud */
++#define BRAINBOXES_US_357_PID		0x7001 /* US_357 1xRS232/422/485 */
++#define BRAINBOXES_US_842_1_PID		0x8001 /* US-842 8xRS422/485 1Mbaud Port 1 and 2 */
++#define BRAINBOXES_US_842_2_PID		0x8002 /* US-842 8xRS422/485 1Mbaud Port 3 and 4 */
++#define BRAINBOXES_US_842_3_PID		0x8003 /* US-842 8xRS422/485 1Mbaud Port 5 and 6 */
++#define BRAINBOXES_US_842_4_PID		0x8004 /* US-842 8xRS422/485 1Mbaud Port 7 and 8 */
++#define BRAINBOXES_US_160_1_PID		0x9001 /* US-160 16xRS232 1Mbaud Port 1 and 2 */
++#define BRAINBOXES_US_160_2_PID		0x9002 /* US-160 16xRS232 1Mbaud Port 3 and 4 */
++#define BRAINBOXES_US_160_3_PID		0x9003 /* US-160 16xRS232 1Mbaud Port 5 and 6 */
++#define BRAINBOXES_US_160_4_PID		0x9004 /* US-160 16xRS232 1Mbaud Port 7 and 8 */
++#define BRAINBOXES_US_160_5_PID		0x9005 /* US-160 16xRS232 1Mbaud Port 9 and 10 */
++#define BRAINBOXES_US_160_6_PID		0x9006 /* US-160 16xRS232 1Mbaud Port 11 and 12 */
++#define BRAINBOXES_US_160_7_PID		0x9007 /* US-160 16xRS232 1Mbaud Port 13 and 14 */
++#define BRAINBOXES_US_160_8_PID		0x9008 /* US-160 16xRS232 1Mbaud Port 15 and 16 */
+diff --git a/drivers/usb/serial/io_ti.c b/drivers/usb/serial/io_ti.c
+index f42119d22467..c575e0a17270 100644
+--- a/drivers/usb/serial/io_ti.c
++++ b/drivers/usb/serial/io_ti.c
+@@ -36,6 +36,7 @@
+ #include <linux/spinlock.h>
+ #include <linux/mutex.h>
+ #include <linux/serial.h>
++#include <linux/swab.h>
+ #include <linux/kfifo.h>
+ #include <linux/ioctl.h>
+ #include <linux/firmware.h>
+@@ -306,7 +307,7 @@ static int read_download_mem(struct usb_device *dev, int start_address,
+ {
+ 	int status = 0;
+ 	__u8 read_length;
+-	__be16 be_start_address;
++	u16 be_start_address;
+ 
+ 	dbg("%s - @ %x for %d", __func__, start_address, length);
+ 
+@@ -323,10 +324,14 @@ static int read_download_mem(struct usb_device *dev, int start_address,
+ 			dbg("%s - @ %x for %d", __func__,
+ 			     start_address, read_length);
+ 		}
+-		be_start_address = cpu_to_be16(start_address);
++		/*
++		 * NOTE: Must use swab as wIndex is sent in little-endian
++		 *       byte order regardless of host byte order.
++		 */
++		be_start_address = swab16((u16)start_address);
+ 		status = ti_vread_sync(dev, UMPC_MEMORY_READ,
+ 					(__u16)address_type,
+-					(__force __u16)be_start_address,
++					be_start_address,
+ 					buffer, read_length);
+ 
+ 		if (status) {
+@@ -426,7 +431,7 @@ static int write_i2c_mem(struct edgeport_serial *serial,
+ {
+ 	int status = 0;
+ 	int write_length;
+-	__be16 be_start_address;
++	u16 be_start_address;
+ 
+ 	/* We can only send a maximum of 1 aligned byte page at a time */
+ 
+@@ -442,11 +447,16 @@ static int write_i2c_mem(struct edgeport_serial *serial,
+ 	usb_serial_debug_data(debug, &serial->serial->dev->dev,
+ 						__func__, write_length, buffer);
+ 
+-	/* Write first page */
+-	be_start_address = cpu_to_be16(start_address);
++	/*
++	 * Write first page.
++	 *
++	 * NOTE: Must use swab as wIndex is sent in little-endian byte order
++	 *       regardless of host byte order.
++	 */
++	be_start_address = swab16((u16)start_address);
+ 	status = ti_vsend_sync(serial->serial->dev,
+ 				UMPC_MEMORY_WRITE, (__u16)address_type,
+-				(__force __u16)be_start_address,
++				be_start_address,
+ 				buffer,	write_length);
+ 	if (status) {
+ 		dbg("%s - ERROR %d", __func__, status);
+@@ -470,11 +480,16 @@ static int write_i2c_mem(struct edgeport_serial *serial,
+ 		usb_serial_debug_data(debug, &serial->serial->dev->dev,
+ 					__func__, write_length, buffer);
+ 
+-		/* Write next page */
+-		be_start_address = cpu_to_be16(start_address);
++		/*
++		 * Write next page.
++		 *
++		 * NOTE: Must use swab as wIndex is sent in little-endian byte
++		 *       order regardless of host byte order.
++		 */
++		be_start_address = swab16((u16)start_address);
+ 		status = ti_vsend_sync(serial->serial->dev, UMPC_MEMORY_WRITE,
+ 				(__u16)address_type,
+-				(__force __u16)be_start_address,
++				be_start_address,
+ 				buffer, write_length);
+ 		if (status) {
+ 			dev_err(&serial->serial->dev->dev, "%s - ERROR %d\n",
+@@ -681,8 +696,8 @@ static int get_descriptor_addr(struct edgeport_serial *serial,
+ 		if (rom_desc->Type == desc_type)
+ 			return start_address;
+ 
+-		start_address = start_address + sizeof(struct ti_i2c_desc)
+-							+ rom_desc->Size;
++		start_address = start_address + sizeof(struct ti_i2c_desc) +
++						le16_to_cpu(rom_desc->Size);
+ 
+ 	} while ((start_address < TI_MAX_I2C_SIZE) && rom_desc->Type);
+ 
+@@ -695,7 +710,7 @@ static int valid_csum(struct ti_i2c_desc *rom_desc, __u8 *buffer)
+ 	__u16 i;
+ 	__u8 cs = 0;
+ 
+-	for (i = 0; i < rom_desc->Size; i++)
++	for (i = 0; i < le16_to_cpu(rom_desc->Size); i++)
+ 		cs = (__u8)(cs + buffer[i]);
+ 
+ 	if (cs != rom_desc->CheckSum) {
+@@ -749,7 +764,7 @@ static int check_i2c_image(struct edgeport_serial *serial)
+ 			break;
+ 
+ 		if ((start_address + sizeof(struct ti_i2c_desc) +
+-					rom_desc->Size) > TI_MAX_I2C_SIZE) {
++			le16_to_cpu(rom_desc->Size)) > TI_MAX_I2C_SIZE) {
+ 			status = -ENODEV;
+ 			dbg("%s - structure too big, erroring out.", __func__);
+ 			break;
+@@ -764,7 +779,8 @@ static int check_i2c_image(struct edgeport_serial *serial)
+ 			/* Read the descriptor data */
+ 			status = read_rom(serial, start_address +
+ 						sizeof(struct ti_i2c_desc),
+-						rom_desc->Size, buffer);
++						le16_to_cpu(rom_desc->Size),
++						buffer);
+ 			if (status)
+ 				break;
+ 
+@@ -773,7 +789,7 @@ static int check_i2c_image(struct edgeport_serial *serial)
+ 				break;
+ 		}
+ 		start_address = start_address + sizeof(struct ti_i2c_desc) +
+-								rom_desc->Size;
++						le16_to_cpu(rom_desc->Size);
+ 
+ 	} while ((rom_desc->Type != I2C_DESC_TYPE_ION) &&
+ 				(start_address < TI_MAX_I2C_SIZE));
+@@ -812,7 +828,7 @@ static int get_manuf_info(struct edgeport_serial *serial, __u8 *buffer)
+ 
+ 	/* Read the descriptor data */
+ 	status = read_rom(serial, start_address+sizeof(struct ti_i2c_desc),
+-						rom_desc->Size, buffer);
++					le16_to_cpu(rom_desc->Size), buffer);
+ 	if (status)
+ 		goto exit;
+ 
+diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
+index 5f5047fcfecf..9823e79e9f56 100644
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -234,8 +234,31 @@ static void option_instat_callback(struct urb *urb);
+ #define QUALCOMM_VENDOR_ID			0x05C6
+ 
+ #define CMOTECH_VENDOR_ID			0x16d8
+-#define CMOTECH_PRODUCT_6008			0x6008
+-#define CMOTECH_PRODUCT_6280			0x6280
++#define CMOTECH_PRODUCT_6001			0x6001
++#define CMOTECH_PRODUCT_CMU_300			0x6002
++#define CMOTECH_PRODUCT_6003			0x6003
++#define CMOTECH_PRODUCT_6004			0x6004
++#define CMOTECH_PRODUCT_6005			0x6005
++#define CMOTECH_PRODUCT_CGU_628A		0x6006
++#define CMOTECH_PRODUCT_CHE_628S		0x6007
++#define CMOTECH_PRODUCT_CMU_301			0x6008
++#define CMOTECH_PRODUCT_CHU_628			0x6280
++#define CMOTECH_PRODUCT_CHU_628S		0x6281
++#define CMOTECH_PRODUCT_CDU_680			0x6803
++#define CMOTECH_PRODUCT_CDU_685A		0x6804
++#define CMOTECH_PRODUCT_CHU_720S		0x7001
++#define CMOTECH_PRODUCT_7002			0x7002
++#define CMOTECH_PRODUCT_CHU_629K		0x7003
++#define CMOTECH_PRODUCT_7004			0x7004
++#define CMOTECH_PRODUCT_7005			0x7005
++#define CMOTECH_PRODUCT_CGU_629			0x7006
++#define CMOTECH_PRODUCT_CHU_629S		0x700a
++#define CMOTECH_PRODUCT_CHU_720I		0x7211
++#define CMOTECH_PRODUCT_7212			0x7212
++#define CMOTECH_PRODUCT_7213			0x7213
++#define CMOTECH_PRODUCT_7251			0x7251
++#define CMOTECH_PRODUCT_7252			0x7252
++#define CMOTECH_PRODUCT_7253			0x7253
+ 
+ #define TELIT_VENDOR_ID				0x1bc7
+ #define TELIT_PRODUCT_UC864E			0x1003
+@@ -243,6 +266,7 @@ static void option_instat_callback(struct urb *urb);
+ #define TELIT_PRODUCT_CC864_DUAL		0x1005
+ #define TELIT_PRODUCT_CC864_SINGLE		0x1006
+ #define TELIT_PRODUCT_DE910_DUAL		0x1010
++#define TELIT_PRODUCT_UE910_V2			0x1012
+ #define TELIT_PRODUCT_LE920			0x1200
+ 
+ /* ZTE PRODUCTS */
+@@ -291,6 +315,7 @@ static void option_instat_callback(struct urb *urb);
+ #define ALCATEL_PRODUCT_X060S_X200		0x0000
+ #define ALCATEL_PRODUCT_X220_X500D		0x0017
+ #define ALCATEL_PRODUCT_L100V			0x011e
++#define ALCATEL_PRODUCT_L800MA			0x0203
+ 
+ #define PIRELLI_VENDOR_ID			0x1266
+ #define PIRELLI_PRODUCT_C100_1			0x1002
+@@ -353,6 +378,7 @@ static void option_instat_callback(struct urb *urb);
+ #define OLIVETTI_PRODUCT_OLICARD100		0xc000
+ #define OLIVETTI_PRODUCT_OLICARD145		0xc003
+ #define OLIVETTI_PRODUCT_OLICARD200		0xc005
++#define OLIVETTI_PRODUCT_OLICARD500		0xc00b
+ 
+ /* Celot products */
+ #define CELOT_VENDOR_ID				0x211f
+@@ -514,6 +540,10 @@ static const struct option_blacklist_info huawei_cdc12_blacklist = {
+ 	.reserved = BIT(1) | BIT(2),
+ };
+ 
++static const struct option_blacklist_info net_intf0_blacklist = {
++	.reserved = BIT(0),
++};
++
+ static const struct option_blacklist_info net_intf1_blacklist = {
+ 	.reserved = BIT(1),
+ };
+@@ -1048,13 +1078,53 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
+ 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
+ 	{ USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
+-	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6280) }, /* BP3-USB & BP3-EXT HSDPA */
+-	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6008) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6001) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_300) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6003),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6004) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_6005) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CGU_628A) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHE_628S),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CMU_301),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_628),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_628S) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CDU_680) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CDU_685A) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_720S),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7002),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_629K),
++	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7004),
++	  .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7005) },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CGU_629),
++	  .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_629S),
++	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_CHU_720I),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7212),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7213),
++	  .driver_info = (kernel_ulong_t)&net_intf0_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7251),
++	  .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7252),
++	  .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
++	{ USB_DEVICE(CMOTECH_VENDOR_ID, CMOTECH_PRODUCT_7253),
++	  .driver_info = (kernel_ulong_t)&net_intf1_blacklist },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864E) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UC864G) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_DUAL) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_CC864_SINGLE) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_DE910_DUAL) },
++	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_UE910_V2) },
+ 	{ USB_DEVICE(TELIT_VENDOR_ID, TELIT_PRODUCT_LE920),
+ 		.driver_info = (kernel_ulong_t)&telit_le920_blacklist },
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(ZTE_VENDOR_ID, ZTE_PRODUCT_MF622, 0xff, 0xff, 0xff) }, /* ZTE WCDMA products */
+@@ -1518,6 +1588,8 @@ static const struct usb_device_id option_ids[] = {
+ 	  .driver_info = (kernel_ulong_t)&net_intf5_blacklist },
+ 	{ USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_L100V),
+ 	  .driver_info = (kernel_ulong_t)&net_intf4_blacklist },
++	{ USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_L800MA),
++	  .driver_info = (kernel_ulong_t)&net_intf2_blacklist },
+ 	{ USB_DEVICE(AIRPLUS_VENDOR_ID, AIRPLUS_PRODUCT_MCD650) },
+ 	{ USB_DEVICE(TLAYTECH_VENDOR_ID, TLAYTECH_PRODUCT_TEU800) },
+ 	{ USB_DEVICE(LONGCHEER_VENDOR_ID, FOUR_G_SYSTEMS_PRODUCT_W14),
+@@ -1563,6 +1635,9 @@ static const struct usb_device_id option_ids[] = {
+ 	{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD200),
+ 		.driver_info = (kernel_ulong_t)&net_intf6_blacklist
+ 	},
++	{ USB_DEVICE(OLIVETTI_VENDOR_ID, OLIVETTI_PRODUCT_OLICARD500),
++		.driver_info = (kernel_ulong_t)&net_intf4_blacklist
++	},
+ 	{ USB_DEVICE(CELOT_VENDOR_ID, CELOT_PRODUCT_CT680M) }, /* CT-650 CDMA 450 1xEVDO modem */
+ 	{ USB_DEVICE_AND_INTERFACE_INFO(SAMSUNG_VENDOR_ID, SAMSUNG_PRODUCT_GT_B3730, USB_CLASS_CDC_DATA, 0x00, 0x00) }, /* Samsung GT-B3730 LTE USB modem.*/
+ 	{ USB_DEVICE(YUGA_VENDOR_ID, YUGA_PRODUCT_CEM600) },
+diff --git a/drivers/usb/serial/pl2303.c b/drivers/usb/serial/pl2303.c
+index 7b293178e8a6..45a288cc423c 100644
+--- a/drivers/usb/serial/pl2303.c
++++ b/drivers/usb/serial/pl2303.c
+@@ -86,6 +86,9 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(YCCABLE_VENDOR_ID, YCCABLE_PRODUCT_ID) },
+ 	{ USB_DEVICE(SUPERIAL_VENDOR_ID, SUPERIAL_PRODUCT_ID) },
+ 	{ USB_DEVICE(HP_VENDOR_ID, HP_LD220_PRODUCT_ID) },
++	{ USB_DEVICE(HP_VENDOR_ID, HP_LD960_PRODUCT_ID) },
++	{ USB_DEVICE(HP_VENDOR_ID, HP_LCM220_PRODUCT_ID) },
++	{ USB_DEVICE(HP_VENDOR_ID, HP_LCM960_PRODUCT_ID) },
+ 	{ USB_DEVICE(CRESSI_VENDOR_ID, CRESSI_EDY_PRODUCT_ID) },
+ 	{ USB_DEVICE(ZEAGLE_VENDOR_ID, ZEAGLE_N2ITION3_PRODUCT_ID) },
+ 	{ USB_DEVICE(SONY_VENDOR_ID, SONY_QN3USB_PRODUCT_ID) },
+diff --git a/drivers/usb/serial/pl2303.h b/drivers/usb/serial/pl2303.h
+index c38b8c00c06f..42bc082896ac 100644
+--- a/drivers/usb/serial/pl2303.h
++++ b/drivers/usb/serial/pl2303.h
+@@ -121,8 +121,11 @@
+ #define SUPERIAL_VENDOR_ID	0x5372
+ #define SUPERIAL_PRODUCT_ID	0x2303
+ 
+-/* Hewlett-Packard LD220-HP POS Pole Display */
++/* Hewlett-Packard POS Pole Displays */
+ #define HP_VENDOR_ID		0x03f0
++#define HP_LD960_PRODUCT_ID	0x0b39
++#define HP_LCM220_PRODUCT_ID	0x3139
++#define HP_LCM960_PRODUCT_ID	0x3239
+ #define HP_LD220_PRODUCT_ID	0x3524
+ 
+ /* Cressi Edy (diving computer) PC interface */
+diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c
+index a7fa673466ce..dbdfeb4647ee 100644
+--- a/drivers/usb/serial/sierra.c
++++ b/drivers/usb/serial/sierra.c
+@@ -305,7 +305,6 @@ static const struct usb_device_id id_table[] = {
+ 	{ USB_DEVICE(0x0f3d, 0x68A3), 	/* Airprime/Sierra Wireless Direct IP modems */
+ 	  .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist
+ 	},
+-       { USB_DEVICE(0x413C, 0x08133) }, /* Dell Computer Corp. Wireless 5720 VZW Mobile Broadband (EVDO Rev-A) Minicard GPS Port */
+ 
+ 	{ }
+ };
+diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
+index 850faa447000..8f76a2b1d721 100644
+--- a/drivers/usb/serial/usb-serial.c
++++ b/drivers/usb/serial/usb-serial.c
+@@ -1400,10 +1400,12 @@ void usb_serial_deregister(struct usb_serial_driver *device)
+ 	/* must be called with BKL held */
+ 	printk(KERN_INFO "USB Serial deregistering driver %s\n",
+ 	       device->description);
++
+ 	mutex_lock(&table_lock);
+ 	list_del(&device->driver_list);
+-	usb_serial_bus_deregister(device);
+ 	mutex_unlock(&table_lock);
++
++	usb_serial_bus_deregister(device);
+ }
+ EXPORT_SYMBOL_GPL(usb_serial_deregister);
+ 
+diff --git a/fs/btrfs/inode-map.c b/fs/btrfs/inode-map.c
+index f8962a957d65..a1fee6f1546a 100644
+--- a/fs/btrfs/inode-map.c
++++ b/fs/btrfs/inode-map.c
+@@ -207,24 +207,14 @@ again:
+ 
+ void btrfs_return_ino(struct btrfs_root *root, u64 objectid)
+ {
+-	struct btrfs_free_space_ctl *ctl = root->free_ino_ctl;
+ 	struct btrfs_free_space_ctl *pinned = root->free_ino_pinned;
+ 
+ 	if (!btrfs_test_opt(root, INODE_MAP_CACHE))
+ 		return;
+-
+ again:
+ 	if (root->cached == BTRFS_CACHE_FINISHED) {
+-		__btrfs_add_free_space(ctl, objectid, 1);
++		__btrfs_add_free_space(pinned, objectid, 1);
+ 	} else {
+-		/*
+-		 * If we are in the process of caching free ino chunks,
+-		 * to avoid adding the same inode number to the free_ino
+-		 * tree twice due to cross transaction, we'll leave it
+-		 * in the pinned tree until a transaction is committed
+-		 * or the caching work is done.
+-		 */
+-
+ 		mutex_lock(&root->fs_commit_mutex);
+ 		spin_lock(&root->cache_lock);
+ 		if (root->cached == BTRFS_CACHE_FINISHED) {
+@@ -236,11 +226,7 @@ again:
+ 
+ 		start_caching(root);
+ 
+-		if (objectid <= root->cache_progress ||
+-		    objectid > root->highest_objectid)
+-			__btrfs_add_free_space(ctl, objectid, 1);
+-		else
+-			__btrfs_add_free_space(pinned, objectid, 1);
++		__btrfs_add_free_space(pinned, objectid, 1);
+ 
+ 		mutex_unlock(&root->fs_commit_mutex);
+ 	}
+diff --git a/fs/ext4/file.c b/fs/ext4/file.c
+index cb70f1812a70..61999221fbfa 100644
+--- a/fs/ext4/file.c
++++ b/fs/ext4/file.c
+@@ -80,7 +80,7 @@ ext4_unaligned_aio(struct inode *inode, const struct iovec *iov,
+ 	size_t count = iov_length(iov, nr_segs);
+ 	loff_t final_size = pos + count;
+ 
+-	if (pos >= inode->i_size)
++	if (pos >= i_size_read(inode))
+ 		return 0;
+ 
+ 	if ((pos & blockmask) || (final_size & blockmask))
+diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
+index dc9f0ecd8f4a..55d4f461992c 100644
+--- a/fs/ext4/inode.c
++++ b/fs/ext4/inode.c
+@@ -481,6 +481,11 @@ int ext4_map_blocks(handle_t *handle, struct inode *inode,
+ 	ext_debug("ext4_map_blocks(): inode %lu, flag %d, max_blocks %u,"
+ 		  "logical block %lu\n", inode->i_ino, flags, map->m_len,
+ 		  (unsigned long) map->m_lblk);
++
++	/* We can handle the block number less than EXT_MAX_BLOCKS */
++	if (unlikely(map->m_lblk >= EXT_MAX_BLOCKS))
++		return -EIO;
++
+ 	/*
+ 	 * Try to see if we can get the block without requesting a new
+ 	 * file system block.
+diff --git a/fs/ext4/page-io.c b/fs/ext4/page-io.c
+index 54f566d97176..b46a675e7704 100644
+--- a/fs/ext4/page-io.c
++++ b/fs/ext4/page-io.c
+@@ -241,13 +241,14 @@ static void ext4_end_bio(struct bio *bio, int error)
+ 
+ 	if (error) {
+ 		io_end->flag |= EXT4_IO_END_ERROR;
+-		ext4_warning(inode->i_sb, "I/O error writing to inode %lu "
++		ext4_warning(inode->i_sb, "I/O error %d writing to inode %lu "
+ 			     "(offset %llu size %ld starting block %llu)",
+-			     inode->i_ino,
++			     error, inode->i_ino,
+ 			     (unsigned long long) io_end->offset,
+ 			     (long) io_end->size,
+ 			     (unsigned long long)
+ 			     bi_sector >> (inode->i_blkbits - 9));
++		mapping_set_error(inode->i_mapping, error);
+ 	}
+ 
+ 	if (!(io_end->flag & EXT4_IO_END_UNWRITTEN)) {
+diff --git a/fs/locks.c b/fs/locks.c
+index fcc50ab71cc6..d4f1d89d9bc6 100644
+--- a/fs/locks.c
++++ b/fs/locks.c
+@@ -1253,11 +1253,10 @@ int __break_lease(struct inode *inode, unsigned int mode)
+ 
+ restart:
+ 	break_time = flock->fl_break_time;
+-	if (break_time != 0) {
++	if (break_time != 0)
+ 		break_time -= jiffies;
+-		if (break_time == 0)
+-			break_time++;
+-	}
++	if (break_time == 0)
++		break_time++;
+ 	locks_insert_block(flock, new_fl);
+ 	unlock_flocks();
+ 	error = wait_event_interruptible_timeout(new_fl->fl_wait,
+diff --git a/fs/nfsd/nfs4callback.c b/fs/nfsd/nfs4callback.c
+index 7748d6a18d97..809a38ad96aa 100644
+--- a/fs/nfsd/nfs4callback.c
++++ b/fs/nfsd/nfs4callback.c
+@@ -633,9 +633,11 @@ static int max_cb_time(void)
+ 
+ static int setup_callback_client(struct nfs4_client *clp, struct nfs4_cb_conn *conn, struct nfsd4_session *ses)
+ {
++	int maxtime = max_cb_time();
+ 	struct rpc_timeout	timeparms = {
+-		.to_initval	= max_cb_time(),
++		.to_initval	= maxtime,
+ 		.to_retries	= 0,
++		.to_maxval	= maxtime,
+ 	};
+ 	struct rpc_create_args args = {
+ 		.net		= &init_net,
+diff --git a/include/linux/libata.h b/include/linux/libata.h
+index b1fcdba2cfbe..375dfdf0f397 100644
+--- a/include/linux/libata.h
++++ b/include/linux/libata.h
+@@ -763,6 +763,7 @@ struct ata_port {
+ 	unsigned long		qc_allocated;
+ 	unsigned int		qc_active;
+ 	int			nr_active_links; /* #links with active qcs */
++	unsigned int		last_tag;	/* track next tag hw expects */
+ 
+ 	struct ata_link		link;		/* host default link */
+ 	struct ata_link		*slave_link;	/* see ata_slave_link_init() */
+diff --git a/include/linux/mod_devicetable.h b/include/linux/mod_devicetable.h
+index 468819cdde87..226e0ff90e61 100644
+--- a/include/linux/mod_devicetable.h
++++ b/include/linux/mod_devicetable.h
+@@ -461,7 +461,8 @@ enum dmi_field {
+ };
+ 
+ struct dmi_strmatch {
+-	unsigned char slot;
++	unsigned char slot:7;
++	unsigned char exact_match:1;
+ 	char substr[79];
+ };
+ 
+@@ -489,7 +490,8 @@ struct dmi_system_id {
+ #define dmi_device_id dmi_system_id
+ #endif
+ 
+-#define DMI_MATCH(a, b)	{ a, b }
++#define DMI_MATCH(a, b)	{ .slot = a, .substr = b }
++#define DMI_EXACT_MATCH(a, b)	{ .slot = a, .substr = b, .exact_match = 1 }
+ 
+ #define PLATFORM_NAME_SIZE	20
+ #define PLATFORM_MODULE_PREFIX	"platform:"
+diff --git a/mm/hugetlb.c b/mm/hugetlb.c
+index d399f5ff5d9c..cac2441956dc 100644
+--- a/mm/hugetlb.c
++++ b/mm/hugetlb.c
+@@ -1078,6 +1078,7 @@ static void return_unused_surplus_pages(struct hstate *h,
+ 	while (nr_pages--) {
+ 		if (!free_pool_huge_page(h, &node_states[N_HIGH_MEMORY], 1))
+ 			break;
++		cond_resched_lock(&hugetlb_lock);
+ 	}
+ }
+ 
+diff --git a/mm/memory.c b/mm/memory.c
+index d5f913b9fae4..483e6650593e 100644
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -1852,12 +1852,17 @@ int fixup_user_fault(struct task_struct *tsk, struct mm_struct *mm,
+ 		     unsigned long address, unsigned int fault_flags)
+ {
+ 	struct vm_area_struct *vma;
++	vm_flags_t vm_flags;
+ 	int ret;
+ 
+ 	vma = find_extend_vma(mm, address);
+ 	if (!vma || address < vma->vm_start)
+ 		return -EFAULT;
+ 
++	vm_flags = (fault_flags & FAULT_FLAG_WRITE) ? VM_WRITE : VM_READ;
++	if (!(vm_flags & vma->vm_flags))
++		return -EFAULT;
++
+ 	ret = handle_mm_fault(mm, vma, address, fault_flags);
+ 	if (ret & VM_FAULT_ERROR) {
+ 		if (ret & VM_FAULT_OOM)

Added: genpatches-2.6/trunk/3.2/1059_linux-3.2.60.patch
===================================================================
--- genpatches-2.6/trunk/3.2/1059_linux-3.2.60.patch	                        (rev 0)
+++ genpatches-2.6/trunk/3.2/1059_linux-3.2.60.patch	2014-06-09 18:29:31 UTC (rev 2823)
@@ -0,0 +1,2964 @@
+diff --git a/Documentation/input/elantech.txt b/Documentation/input/elantech.txt
+index 5602eb71ad5d..e1ae127ed099 100644
+--- a/Documentation/input/elantech.txt
++++ b/Documentation/input/elantech.txt
+@@ -504,9 +504,12 @@ byte 5:
+ * reg_10
+ 
+    bit   7   6   5   4   3   2   1   0
+-         0   0   0   0   0   0   0   A
++         0   0   0   0   R   F   T   A
+ 
+          A: 1 = enable absolute tracking
++         T: 1 = enable two finger mode auto correct
++         F: 1 = disable ABS Position Filter
++         R: 1 = enable real hardware resolution
+ 
+ 6.2 Native absolute mode 6 byte packet format
+     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+diff --git a/Makefile b/Makefile
+index 1be3414a141f..317d5eab3c66 100644
+--- a/Makefile
++++ b/Makefile
+@@ -1,6 +1,6 @@
+ VERSION = 3
+ PATCHLEVEL = 2
+-SUBLEVEL = 59
++SUBLEVEL = 60
+ EXTRAVERSION =
+ NAME = Saber-toothed Squirrel
+ 
+diff --git a/arch/powerpc/lib/crtsavres.S b/arch/powerpc/lib/crtsavres.S
+index 1c893f05d224..21ecdf5e55f9 100644
+--- a/arch/powerpc/lib/crtsavres.S
++++ b/arch/powerpc/lib/crtsavres.S
+@@ -230,6 +230,87 @@ _GLOBAL(_rest32gpr_31_x)
+ 	mr	1,11
+ 	blr
+ 
++#ifdef CONFIG_ALTIVEC
++/* Called with r0 pointing just beyond the end of the vector save area.  */
++
++_GLOBAL(_savevr_20)
++	li	r11,-192
++	stvx	vr20,r11,r0
++_GLOBAL(_savevr_21)
++	li	r11,-176
++	stvx	vr21,r11,r0
++_GLOBAL(_savevr_22)
++	li	r11,-160
++	stvx	vr22,r11,r0
++_GLOBAL(_savevr_23)
++	li	r11,-144
++	stvx	vr23,r11,r0
++_GLOBAL(_savevr_24)
++	li	r11,-128
++	stvx	vr24,r11,r0
++_GLOBAL(_savevr_25)
++	li	r11,-112
++	stvx	vr25,r11,r0
++_GLOBAL(_savevr_26)
++	li	r11,-96
++	stvx	vr26,r11,r0
++_GLOBAL(_savevr_27)
++	li	r11,-80
++	stvx	vr27,r11,r0
++_GLOBAL(_savevr_28)
++	li	r11,-64
++	stvx	vr28,r11,r0
++_GLOBAL(_savevr_29)
++	li	r11,-48
++	stvx	vr29,r11,r0
++_GLOBAL(_savevr_30)
++	li	r11,-32
++	stvx	vr30,r11,r0
++_GLOBAL(_savevr_31)
++	li	r11,-16
++	stvx	vr31,r11,r0
++	blr
++
++_GLOBAL(_restvr_20)
++	li	r11,-192
++	lvx	vr20,r11,r0
++_GLOBAL(_restvr_21)
++	li	r11,-176
++	lvx	vr21,r11,r0
++_GLOBAL(_restvr_22)
++	li	r11,-160
++	lvx	vr22,r11,r0
++_GLOBAL(_restvr_23)
++	li	r11,-144
++	lvx	vr23,r11,r0
++_GLOBAL(_restvr_24)
++	li	r11,-128
++	lvx	vr24,r11,r0
++_GLOBAL(_restvr_25)
++	li	r11,-112
++	lvx	vr25,r11,r0
++_GLOBAL(_restvr_26)
++	li	r11,-96
++	lvx	vr26,r11,r0
++_GLOBAL(_restvr_27)
++	li	r11,-80
++	lvx	vr27,r11,r0
++_GLOBAL(_restvr_28)
++	li	r11,-64
++	lvx	vr28,r11,r0
++_GLOBAL(_restvr_29)
++	li	r11,-48
++	lvx	vr29,r11,r0
++_GLOBAL(_restvr_30)
++	li	r11,-32
++	lvx	vr30,r11,r0
++_GLOBAL(_restvr_31)
++	li	r11,-16
++	lvx	vr31,r11,r0
++	blr
++
++#endif /* CONFIG_ALTIVEC */
++
+ #else /* CONFIG_PPC64 */
+ 
+ .globl	_savegpr0_14
+@@ -353,6 +434,111 @@ _restgpr0_31:
+ 	mtlr	r0
+ 	blr
+ 
++#ifdef CONFIG_ALTIVEC
++/* Called with r0 pointing just beyond the end of the vector save area.  */
++
++.globl	_savevr_20
++_savevr_20:
++	li	r12,-192
++	stvx	vr20,r12,r0
++.globl	_savevr_21
++_savevr_21:
++	li	r12,-176
++	stvx	vr21,r12,r0
++.globl	_savevr_22
++_savevr_22:
++	li	r12,-160
++	stvx	vr22,r12,r0
++.globl	_savevr_23
++_savevr_23:
++	li	r12,-144
++	stvx	vr23,r12,r0
++.globl	_savevr_24
++_savevr_24:
++	li	r12,-128
++	stvx	vr24,r12,r0
++.globl	_savevr_25
++_savevr_25:
++	li	r12,-112
++	stvx	vr25,r12,r0
++.globl	_savevr_26
++_savevr_26:
++	li	r12,-96
++	stvx	vr26,r12,r0
++.globl	_savevr_27
++_savevr_27:
++	li	r12,-80
++	stvx	vr27,r12,r0
++.globl	_savevr_28
++_savevr_28:
++	li	r12,-64
++	stvx	vr28,r12,r0
++.globl	_savevr_29
++_savevr_29:
++	li	r12,-48
++	stvx	vr29,r12,r0
++.globl	_savevr_30
++_savevr_30:
++	li	r12,-32
++	stvx	vr30,r12,r0
++.globl	_savevr_31
++_savevr_31:
++	li	r12,-16
++	stvx	vr31,r12,r0
++	blr
++
++.globl	_restvr_20
++_restvr_20:
++	li	r12,-192
++	lvx	vr20,r12,r0
++.globl	_restvr_21
++_restvr_21:
++	li	r12,-176
++	lvx	vr21,r12,r0
++.globl	_restvr_22
++_restvr_22:
++	li	r12,-160
++	lvx	vr22,r12,r0
++.globl	_restvr_23
++_restvr_23:
++	li	r12,-144
++	lvx	vr23,r12,r0
++.globl	_restvr_24
++_restvr_24:
++	li	r12,-128
++	lvx	vr24,r12,r0
++.globl	_restvr_25
++_restvr_25:
++	li	r12,-112
++	lvx	vr25,r12,r0
++.globl	_restvr_26
++_restvr_26:
++	li	r12,-96
++	lvx	vr26,r12,r0
++.globl	_restvr_27
++_restvr_27:
++	li	r12,-80
++	lvx	vr27,r12,r0
++.globl	_restvr_28
++_restvr_28:
++	li	r12,-64
++	lvx	vr28,r12,r0
++.globl	_restvr_29
++_restvr_29:
++	li	r12,-48
++	lvx	vr29,r12,r0
++.globl	_restvr_30
++_restvr_30:
++	li	r12,-32
++	lvx	vr30,r12,r0
++.globl	_restvr_31
++_restvr_31:
++	li	r12,-16
++	lvx	vr31,r12,r0
++	blr
++
++#endif /* CONFIG_ALTIVEC */
++
+ #endif /* CONFIG_PPC64 */
+ 
+ #endif
+diff --git a/arch/x86/include/asm/hugetlb.h b/arch/x86/include/asm/hugetlb.h
+index 439a9acc132d..48fa3915fd02 100644
+--- a/arch/x86/include/asm/hugetlb.h
++++ b/arch/x86/include/asm/hugetlb.h
+@@ -51,6 +51,7 @@ static inline pte_t huge_ptep_get_and_clear(struct mm_struct *mm,
+ static inline void huge_ptep_clear_flush(struct vm_area_struct *vma,
+ 					 unsigned long addr, pte_t *ptep)
+ {
++	ptep_clear_flush(vma, addr, ptep);
+ }
+ 
+ static inline int huge_pte_none(pte_t pte)
+diff --git a/arch/x86/kernel/ldt.c b/arch/x86/kernel/ldt.c
+index 4ac453114d7e..3e0ccbffff6b 100644
+--- a/arch/x86/kernel/ldt.c
++++ b/arch/x86/kernel/ldt.c
+@@ -21,6 +21,8 @@
+ #include <asm/mmu_context.h>
+ #include <asm/syscalls.h>
+ 
++int sysctl_ldt16 = 0;
++
+ #ifdef CONFIG_SMP
+ static void flush_ldt(void *current_mm)
+ {
+@@ -235,7 +237,7 @@ static int write_ldt(void __user *ptr, unsigned long bytecount, int oldmode)
+ 	 * IRET leaking the high bits of the kernel stack address.
+ 	 */
+ #ifdef CONFIG_X86_64
+-	if (!ldt_info.seg_32bit) {
++	if (!ldt_info.seg_32bit && !sysctl_ldt16) {
+ 		error = -EINVAL;
+ 		goto out_unlock;
+ 	}
+diff --git a/arch/x86/vdso/vdso32-setup.c b/arch/x86/vdso/vdso32-setup.c
+index 468d591dde31..51bdc0546733 100644
+--- a/arch/x86/vdso/vdso32-setup.c
++++ b/arch/x86/vdso/vdso32-setup.c
+@@ -41,6 +41,7 @@ enum {
+ #ifdef CONFIG_X86_64
+ #define vdso_enabled			sysctl_vsyscall32
+ #define arch_setup_additional_pages	syscall32_setup_pages
++extern int sysctl_ldt16;
+ #endif
+ 
+ /*
+@@ -388,6 +389,13 @@ static ctl_table abi_table2[] = {
+ 		.mode		= 0644,
+ 		.proc_handler	= proc_dointvec
+ 	},
++	{
++		.procname	= "ldt16",
++		.data		= &sysctl_ldt16,
++		.maxlen		= sizeof(int),
++		.mode		= 0644,
++		.proc_handler	= proc_dointvec
++	},
+ 	{}
+ };
+ 
+diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
+index 8176b82b2e4c..392306472e5e 100644
+--- a/drivers/acpi/ec.c
++++ b/drivers/acpi/ec.c
+@@ -70,6 +70,8 @@ enum ec_command {
+ #define ACPI_EC_DELAY		500	/* Wait 500ms max. during EC ops */
+ #define ACPI_EC_UDELAY_GLK	1000	/* Wait 1ms max. to get global lock */
+ #define ACPI_EC_MSI_UDELAY	550	/* Wait 550us for MSI EC */
++#define ACPI_EC_CLEAR_MAX	100	/* Maximum number of events to query
++					 * when trying to clear the EC */
+ 
+ enum {
+ 	EC_FLAGS_QUERY_PENDING,		/* Query is pending */
+@@ -123,6 +125,7 @@ EXPORT_SYMBOL(first_ec);
+ static int EC_FLAGS_MSI; /* Out-of-spec MSI controller */
+ static int EC_FLAGS_VALIDATE_ECDT; /* ASUStec ECDTs need to be validated */
+ static int EC_FLAGS_SKIP_DSDT_SCAN; /* Not all BIOS survive early DSDT scan */
++static int EC_FLAGS_CLEAR_ON_RESUME; /* Needs acpi_ec_clear() on boot/resume */
+ 
+ /* --------------------------------------------------------------------------
+                              Transaction Management
+@@ -203,13 +206,13 @@ unlock:
+ 	spin_unlock_irqrestore(&ec->curr_lock, flags);
+ }
+ 
+-static int acpi_ec_sync_query(struct acpi_ec *ec);
++static int acpi_ec_sync_query(struct acpi_ec *ec, u8 *data);
+ 
+ static int ec_check_sci_sync(struct acpi_ec *ec, u8 state)
+ {
+ 	if (state & ACPI_EC_FLAG_SCI) {
+ 		if (!test_and_set_bit(EC_FLAGS_QUERY_PENDING, &ec->flags))
+-			return acpi_ec_sync_query(ec);
++			return acpi_ec_sync_query(ec, NULL);
+ 	}
+ 	return 0;
+ }
+@@ -449,6 +452,27 @@ int ec_transaction(u8 command,
+ 
+ EXPORT_SYMBOL(ec_transaction);
+ 
++/*
++ * Process _Q events that might have accumulated in the EC.
++ * Run with locked ec mutex.
++ */
++static void acpi_ec_clear(struct acpi_ec *ec)
++{
++	int i, status;
++	u8 value = 0;
++
++	for (i = 0; i < ACPI_EC_CLEAR_MAX; i++) {
++		status = acpi_ec_sync_query(ec, &value);
++		if (status || !value)
++			break;
++	}
++
++	if (unlikely(i == ACPI_EC_CLEAR_MAX))
++		pr_warn("Warning: Maximum of %d stale EC events cleared\n", i);
++	else
++		pr_info("%d stale EC events cleared\n", i);
++}
++
+ void acpi_ec_block_transactions(void)
+ {
+ 	struct acpi_ec *ec = first_ec;
+@@ -472,6 +496,10 @@ void acpi_ec_unblock_transactions(void)
+ 	mutex_lock(&ec->lock);
+ 	/* Allow transactions to be carried out again */
+ 	clear_bit(EC_FLAGS_BLOCKED, &ec->flags);
++
++	if (EC_FLAGS_CLEAR_ON_RESUME)
++		acpi_ec_clear(ec);
++
+ 	mutex_unlock(&ec->lock);
+ }
+ 
+@@ -561,13 +589,18 @@ static void acpi_ec_run(void *cxt)
+ 	kfree(handler);
+ }
+ 
+-static int acpi_ec_sync_query(struct acpi_ec *ec)
++static int acpi_ec_sync_query(struct acpi_ec *ec, u8 *data)
+ {
+ 	u8 value = 0;
+ 	int status;
+ 	struct acpi_ec_query_handler *handler, *copy;
+-	if ((status = acpi_ec_query_unlocked(ec, &value)))
++
++	status = acpi_ec_query_unlocked(ec, &value);
++	if (data)
++		*data = value;
++	if (status)
+ 		return status;
++
+ 	list_for_each_entry(handler, &ec->list, node) {
+ 		if (value == handler->query_bit) {
+ 			/* have custom handler for this bit */
+@@ -590,7 +623,7 @@ static void acpi_ec_gpe_query(void *ec_cxt)
+ 	if (!ec)
+ 		return;
+ 	mutex_lock(&ec->lock);
+-	acpi_ec_sync_query(ec);
++	acpi_ec_sync_query(ec, NULL);
+ 	mutex_unlock(&ec->lock);
+ }
+ 
+@@ -828,6 +861,13 @@ static int acpi_ec_add(struct acpi_device *device)
+ 
+ 	/* EC is fully operational, allow queries */
+ 	clear_bit(EC_FLAGS_QUERY_PENDING, &ec->flags);
++
++	/* Clear stale _Q events if hardware might require that */
++	if (EC_FLAGS_CLEAR_ON_RESUME) {
++		mutex_lock(&ec->lock);
++		acpi_ec_clear(ec);
++		mutex_unlock(&ec->lock);
++	}
+ 	return ret;
+ }
+ 
+@@ -929,6 +969,30 @@ static int ec_enlarge_storm_threshold(const struct dmi_system_id *id)
+ 	return 0;
+ }
+ 
++/*
++ * On some hardware it is necessary to clear events accumulated by the EC during
++ * sleep. These ECs stop reporting GPEs until they are manually polled, if too
++ * many events are accumulated. (e.g. Samsung Series 5/9 notebooks)
++ *
++ * https://bugzilla.kernel.org/show_bug.cgi?id=44161
++ *
++ * Ideally, the EC should also be instructed NOT to accumulate events during
++ * sleep (which Windows seems to do somehow), but the interface to control this
++ * behaviour is not known at this time.
++ *
++ * Models known to be affected are Samsung 530Uxx/535Uxx/540Uxx/550Pxx/900Xxx,
++ * however it is very likely that other Samsung models are affected.
++ *
++ * On systems which don't accumulate _Q events during sleep, this extra check
++ * should be harmless.
++ */
++static int ec_clear_on_resume(const struct dmi_system_id *id)
++{
++	pr_debug("Detected system needing EC poll on resume.\n");
++	EC_FLAGS_CLEAR_ON_RESUME = 1;
++	return 0;
++}
++
+ static struct dmi_system_id __initdata ec_dmi_table[] = {
+ 	{
+ 	ec_skip_dsdt_scan, "Compal JFL92", {
+@@ -968,6 +1032,9 @@ static struct dmi_system_id __initdata ec_dmi_table[] = {
+ 	ec_validate_ecdt, "ASUS hardware", {
+ 	DMI_MATCH(DMI_SYS_VENDOR, "ASUSTek Computer Inc."),
+ 	DMI_MATCH(DMI_PRODUCT_NAME, "L4R"),}, NULL},
++	{
++	ec_clear_on_resume, "Samsung hardware", {
++	DMI_MATCH(DMI_SYS_VENDOR, "SAMSUNG ELECTRONICS CO., LTD.")}, NULL},
+ 	{},
+ };
+ 
+diff --git a/drivers/atm/ambassador.c b/drivers/atm/ambassador.c
+index f8f41e0e8a8c..89b30f32ba68 100644
+--- a/drivers/atm/ambassador.c
++++ b/drivers/atm/ambassador.c
+@@ -802,7 +802,7 @@ static void fill_rx_pool (amb_dev * dev, unsigned char pool,
+     }
+     // cast needed as there is no %? for pointer differences
+     PRINTD (DBG_SKB, "allocated skb at %p, head %p, area %li",
+-	    skb, skb->head, (long) (skb_end_pointer(skb) - skb->head));
++	    skb, skb->head, (long) skb_end_offset(skb));
+     rx.handle = virt_to_bus (skb);
+     rx.host_address = cpu_to_be32 (virt_to_bus (skb->data));
+     if (rx_give (dev, &rx, pool))
+diff --git a/drivers/atm/idt77252.c b/drivers/atm/idt77252.c
+index b0e75ce3c8fc..81845fa2a9cd 100644
+--- a/drivers/atm/idt77252.c
++++ b/drivers/atm/idt77252.c
+@@ -1258,7 +1258,7 @@ idt77252_rx_raw(struct idt77252_dev *card)
+ 	tail = readl(SAR_REG_RAWCT);
+ 
+ 	pci_dma_sync_single_for_cpu(card->pcidev, IDT77252_PRV_PADDR(queue),
+-				    skb_end_pointer(queue) - queue->head - 16,
++				    skb_end_offset(queue) - 16,
+ 				    PCI_DMA_FROMDEVICE);
+ 
+ 	while (head != tail) {
+diff --git a/drivers/bluetooth/ath3k.c b/drivers/bluetooth/ath3k.c
+index 3539f9b1e002..6fe003a2fca8 100644
+--- a/drivers/bluetooth/ath3k.c
++++ b/drivers/bluetooth/ath3k.c
+@@ -81,6 +81,7 @@ static struct usb_device_id ath3k_table[] = {
+ 	{ USB_DEVICE(0x04CA, 0x3004) },
+ 	{ USB_DEVICE(0x04CA, 0x3005) },
+ 	{ USB_DEVICE(0x04CA, 0x3006) },
++	{ USB_DEVICE(0x04CA, 0x3007) },
+ 	{ USB_DEVICE(0x04CA, 0x3008) },
+ 	{ USB_DEVICE(0x13d3, 0x3362) },
+ 	{ USB_DEVICE(0x0CF3, 0xE004) },
+@@ -123,6 +124,7 @@ static struct usb_device_id ath3k_blist_tbl[] = {
+ 	{ USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
+diff --git a/drivers/bluetooth/btusb.c b/drivers/bluetooth/btusb.c
+index f18b5a28f10c..dddcb1dc6065 100644
+--- a/drivers/bluetooth/btusb.c
++++ b/drivers/bluetooth/btusb.c
+@@ -152,6 +152,7 @@ static struct usb_device_id blacklist_table[] = {
+ 	{ USB_DEVICE(0x04ca, 0x3004), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x3005), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x3006), .driver_info = BTUSB_ATH3012 },
++	{ USB_DEVICE(0x04ca, 0x3007), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x04ca, 0x3008), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x13d3, 0x3362), .driver_info = BTUSB_ATH3012 },
+ 	{ USB_DEVICE(0x0cf3, 0xe004), .driver_info = BTUSB_ATH3012 },
+diff --git a/drivers/crypto/caam/error.c b/drivers/crypto/caam/error.c
+index 7e2d54bffad6..9b8d231b1da6 100644
+--- a/drivers/crypto/caam/error.c
++++ b/drivers/crypto/caam/error.c
+@@ -16,9 +16,13 @@
+ 	char *tmp;						\
+ 								\
+ 	tmp = kmalloc(sizeof(format) + max_alloc, GFP_ATOMIC);	\
+-	sprintf(tmp, format, param);				\
+-	strcat(str, tmp);					\
+-	kfree(tmp);						\
++	if (likely(tmp)) {					\
++		sprintf(tmp, format, param);			\
++		strcat(str, tmp);				\
++		kfree(tmp);					\
++	} else {						\
++		strcat(str, "kmalloc failure in SPRINTFCAT");	\
++	}							\
+ }
+ 
+ static void report_jump_idx(u32 status, char *outstr)
+diff --git a/drivers/dma/mv_xor.c b/drivers/dma/mv_xor.c
+index 9a353c2216d0..9b01145e6723 100644
+--- a/drivers/dma/mv_xor.c
++++ b/drivers/dma/mv_xor.c
+@@ -218,12 +218,10 @@ static void mv_set_mode(struct mv_xor_chan *chan,
+ 
+ static void mv_chan_activate(struct mv_xor_chan *chan)
+ {
+-	u32 activation;
+-
+ 	dev_dbg(chan->device->common.dev, " activate chan.\n");
+-	activation = __raw_readl(XOR_ACTIVATION(chan));
+-	activation |= 0x1;
+-	__raw_writel(activation, XOR_ACTIVATION(chan));
++
++	/* writel ensures all descriptors are flushed before activation */
++	writel(BIT(0), XOR_ACTIVATION(chan));
+ }
+ 
+ static char mv_chan_is_busy(struct mv_xor_chan *chan)
+diff --git a/drivers/gpu/drm/nouveau/nouveau_acpi.c b/drivers/gpu/drm/nouveau/nouveau_acpi.c
+index 3df56c7c692f..5ee8cca9ee6c 100644
+--- a/drivers/gpu/drm/nouveau/nouveau_acpi.c
++++ b/drivers/gpu/drm/nouveau/nouveau_acpi.c
+@@ -332,9 +332,6 @@ bool nouveau_acpi_rom_supported(struct pci_dev *pdev)
+ 	acpi_status status;
+ 	acpi_handle dhandle, rom_handle;
+ 
+-	if (!nouveau_dsm_priv.dsm_detected && !nouveau_dsm_priv.optimus_detected)
+-		return false;
+-
+ 	dhandle = DEVICE_ACPI_HANDLE(&pdev->dev);
+ 	if (!dhandle)
+ 		return false;
+diff --git a/drivers/gpu/drm/radeon/radeon_bios.c b/drivers/gpu/drm/radeon/radeon_bios.c
+index d306cc8fdeaa..ccf324b451c4 100644
+--- a/drivers/gpu/drm/radeon/radeon_bios.c
++++ b/drivers/gpu/drm/radeon/radeon_bios.c
+@@ -173,6 +173,20 @@ static bool radeon_atrm_get_bios(struct radeon_device *rdev)
+ 		}
+ 	}
+ 
++	if (!found) {
++		while ((pdev = pci_get_class(PCI_CLASS_DISPLAY_OTHER << 8, pdev)) != NULL) {
++			dhandle = DEVICE_ACPI_HANDLE(&pdev->dev);
++			if (!dhandle)
++				continue;
++
++			status = acpi_get_handle(dhandle, "ATRM", &atrm_handle);
++			if (!ACPI_FAILURE(status)) {
++				found = true;
++				break;
++			}
++		}
++	}
++
+ 	if (!found)
+ 		return false;
+ 
+diff --git a/drivers/gpu/drm/radeon/radeon_object.c b/drivers/gpu/drm/radeon/radeon_object.c
+index f3ae60759c5f..3e35bbe96e3a 100644
+--- a/drivers/gpu/drm/radeon/radeon_object.c
++++ b/drivers/gpu/drm/radeon/radeon_object.c
+@@ -513,22 +513,30 @@ int radeon_bo_fault_reserve_notify(struct ttm_buffer_object *bo)
+ 	rbo = container_of(bo, struct radeon_bo, tbo);
+ 	radeon_bo_check_tiling(rbo, 0, 0);
+ 	rdev = rbo->rdev;
+-	if (bo->mem.mem_type == TTM_PL_VRAM) {
+-		size = bo->mem.num_pages << PAGE_SHIFT;
+-		offset = bo->mem.start << PAGE_SHIFT;
+-		if ((offset + size) > rdev->mc.visible_vram_size) {
+-			/* hurrah the memory is not visible ! */
+-			radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_VRAM);
+-			rbo->placement.lpfn = rdev->mc.visible_vram_size >> PAGE_SHIFT;
+-			r = ttm_bo_validate(bo, &rbo->placement, false, true, false);
+-			if (unlikely(r != 0))
+-				return r;
+-			offset = bo->mem.start << PAGE_SHIFT;
+-			/* this should not happen */
+-			if ((offset + size) > rdev->mc.visible_vram_size)
+-				return -EINVAL;
+-		}
++	if (bo->mem.mem_type != TTM_PL_VRAM)
++		return 0;
++
++	size = bo->mem.num_pages << PAGE_SHIFT;
++	offset = bo->mem.start << PAGE_SHIFT;
++	if ((offset + size) <= rdev->mc.visible_vram_size)
++		return 0;
++
++	/* hurrah the memory is not visible ! */
++	radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_VRAM);
++	rbo->placement.lpfn = rdev->mc.visible_vram_size >> PAGE_SHIFT;
++	r = ttm_bo_validate(bo, &rbo->placement, false, true, false);
++	if (unlikely(r == -ENOMEM)) {
++		radeon_ttm_placement_from_domain(rbo, RADEON_GEM_DOMAIN_GTT);
++		return ttm_bo_validate(bo, &rbo->placement, false, true, false);
++	} else if (unlikely(r != 0)) {
++		return r;
+ 	}
++
++	offset = bo->mem.start << PAGE_SHIFT;
++	/* this should never happen */
++	if ((offset + size) > rdev->mc.visible_vram_size)
++		return -EINVAL;
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+index 40932fbdac0f..84ba033dd68a 100644
+--- a/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
++++ b/drivers/gpu/drm/vmwgfx/vmwgfx_execbuf.c
+@@ -558,14 +558,36 @@ static int vmw_cmd_dma(struct vmw_private *dev_priv,
+ 	} *cmd;
+ 	int ret;
+ 	struct vmw_resource *res;
++	SVGA3dCmdSurfaceDMASuffix *suffix;
++	uint32_t bo_size;
+ 
+ 	cmd = container_of(header, struct vmw_dma_cmd, header);
++	suffix = (SVGA3dCmdSurfaceDMASuffix *)((unsigned long) &cmd->dma +
++					       header->size - sizeof(*suffix));
++
++	/* Make sure device and verifier stays in sync. */
++	if (unlikely(suffix->suffixSize != sizeof(*suffix))) {
++		DRM_ERROR("Invalid DMA suffix size.\n");
++		return -EINVAL;
++	}
++
+ 	ret = vmw_translate_guest_ptr(dev_priv, sw_context,
+ 				      &cmd->dma.guest.ptr,
+ 				      &vmw_bo);
+ 	if (unlikely(ret != 0))
+ 		return ret;
+ 
++	/* Make sure DMA doesn't cross BO boundaries. */
++	bo_size = vmw_bo->base.num_pages * PAGE_SIZE;
++	if (unlikely(cmd->dma.guest.ptr.offset > bo_size)) {
++		DRM_ERROR("Invalid DMA offset.\n");
++		return -EINVAL;
++	}
++
++	bo_size -= cmd->dma.guest.ptr.offset;
++	if (unlikely(suffix->maximumOffset > bo_size))
++		suffix->maximumOffset = bo_size;
++
+ 	bo = &vmw_bo->base;
+ 	ret = vmw_user_surface_lookup_handle(dev_priv, sw_context->tfile,
+ 					     cmd->dma.host.sid, &srf);
+diff --git a/drivers/hid/hid-ids.h b/drivers/hid/hid-ids.h
+index ca2b3e6c4e9f..ccc89b0e14d9 100644
+--- a/drivers/hid/hid-ids.h
++++ b/drivers/hid/hid-ids.h
+@@ -678,6 +678,13 @@
+ #define USB_DEVICE_ID_SYMBOL_SCANNER_1	0x0800
+ #define USB_DEVICE_ID_SYMBOL_SCANNER_2	0x1300
+ 
++#define USB_VENDOR_ID_SYNAPTICS		0x06cb
++#define USB_DEVICE_ID_SYNAPTICS_LTS1	0x0af8
++#define USB_DEVICE_ID_SYNAPTICS_LTS2	0x1d10
++#define USB_DEVICE_ID_SYNAPTICS_HD	0x0ac3
++#define USB_DEVICE_ID_SYNAPTICS_QUAD_HD	0x1ac3
++#define USB_DEVICE_ID_SYNAPTICS_TP_V103	0x5710
++
+ #define USB_VENDOR_ID_THRUSTMASTER	0x044f
+ 
+ #define USB_VENDOR_ID_TOPSEED		0x0766
+diff --git a/drivers/hid/usbhid/hid-quirks.c b/drivers/hid/usbhid/hid-quirks.c
+index f98fbad966e7..71c258295045 100644
+--- a/drivers/hid/usbhid/hid-quirks.c
++++ b/drivers/hid/usbhid/hid-quirks.c
+@@ -100,6 +100,11 @@ static const struct hid_blacklist {
+ 	{ USB_VENDOR_ID_CHICONY, USB_DEVICE_ID_CHICONY_WIRELESS, HID_QUIRK_MULTI_INPUT },
+ 	{ USB_VENDOR_ID_SIGMA_MICRO, USB_DEVICE_ID_SIGMA_MICRO_KEYBOARD, HID_QUIRK_NO_INIT_REPORTS },
+ 	{ USB_VENDOR_ID_NTRIG, USB_DEVICE_ID_NTRIG_DUOSENSE, HID_QUIRK_NO_INIT_REPORTS },
++	{ USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS1, HID_QUIRK_NO_INIT_REPORTS },
++	{ USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_LTS2, HID_QUIRK_NO_INIT_REPORTS },
++	{ USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_HD, HID_QUIRK_NO_INIT_REPORTS },
++	{ USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_QUAD_HD, HID_QUIRK_NO_INIT_REPORTS },
++	{ USB_VENDOR_ID_SYNAPTICS, USB_DEVICE_ID_SYNAPTICS_TP_V103, HID_QUIRK_NO_INIT_REPORTS },
+ 
+ 	{ 0, 0 }
+ };
+diff --git a/drivers/hwmon/emc1403.c b/drivers/hwmon/emc1403.c
+index cd2a6e437aec..7da08accab8b 100644
+--- a/drivers/hwmon/emc1403.c
++++ b/drivers/hwmon/emc1403.c
+@@ -159,7 +159,7 @@ static ssize_t store_hyst(struct device *dev,
+ 	if (retval < 0)
+ 		goto fail;
+ 
+-	hyst = val - retval * 1000;
++	hyst = retval * 1000 - val;
+ 	hyst = DIV_ROUND_CLOSEST(hyst, 1000);
+ 	if (hyst < 0 || hyst > 255) {
+ 		retval = -ERANGE;
+@@ -290,7 +290,7 @@ static int emc1403_detect(struct i2c_client *client,
+ 	}
+ 
+ 	id = i2c_smbus_read_byte_data(client, THERMAL_REVISION_REG);
+-	if (id != 0x01)
++	if (id < 0x01 || id > 0x04)
+ 		return -ENODEV;
+ 
+ 	return 0;
+diff --git a/drivers/i2c/busses/i2c-designware-core.c b/drivers/i2c/busses/i2c-designware-core.c
+index 3c2812f13d96..aadb3984f0d3 100644
+--- a/drivers/i2c/busses/i2c-designware-core.c
++++ b/drivers/i2c/busses/i2c-designware-core.c
+@@ -346,6 +346,9 @@ static void i2c_dw_xfer_init(struct dw_i2c_dev *dev)
+ 		ic_con &= ~DW_IC_CON_10BITADDR_MASTER;
+ 	dw_writel(dev, ic_con, DW_IC_CON);
+ 
++	/* enforce disabled interrupts (due to HW issues) */
++	i2c_dw_disable_int(dev);
++
+ 	/* Enable the adapter */
+ 	dw_writel(dev, 1, DW_IC_ENABLE);
+ 
+diff --git a/drivers/i2c/busses/i2c-s3c2410.c b/drivers/i2c/busses/i2c-s3c2410.c
+index 4c1718081685..7d6d2b76b92e 100644
+--- a/drivers/i2c/busses/i2c-s3c2410.c
++++ b/drivers/i2c/busses/i2c-s3c2410.c
+@@ -1082,10 +1082,10 @@ static int s3c24xx_i2c_resume(struct device *dev)
+ 	struct platform_device *pdev = to_platform_device(dev);
+ 	struct s3c24xx_i2c *i2c = platform_get_drvdata(pdev);
+ 
+-	i2c->suspended = 0;
+ 	clk_enable(i2c->clk);
+ 	s3c24xx_i2c_init(i2c);
+ 	clk_disable(i2c->clk);
++	i2c->suspended = 0;
+ 
+ 	return 0;
+ }
+diff --git a/drivers/input/mouse/elantech.c b/drivers/input/mouse/elantech.c
+index e2a9867c19d5..342a059184a3 100644
+--- a/drivers/input/mouse/elantech.c
++++ b/drivers/input/mouse/elantech.c
+@@ -11,6 +11,7 @@
+  */
+ 
+ #include <linux/delay.h>
++#include <linux/dmi.h>
+ #include <linux/slab.h>
+ #include <linux/module.h>
+ #include <linux/input.h>
+@@ -783,7 +784,11 @@ static int elantech_set_absolute_mode(struct psmouse *psmouse)
+ 		break;
+ 
+ 	case 3:
+-		etd->reg_10 = 0x0b;
++		if (etd->set_hw_resolution)
++			etd->reg_10 = 0x0b;
++		else
++			etd->reg_10 = 0x03;
++
+ 		if (elantech_write_reg(psmouse, 0x10, etd->reg_10))
+ 			rc = -1;
+ 
+@@ -1206,6 +1211,22 @@ static int elantech_reconnect(struct psmouse *psmouse)
+ }
+ 
+ /*
++ * Some hw_version 3 models go into error state when we try to set bit 3 of r10
++ */
++static const struct dmi_system_id no_hw_res_dmi_table[] = {
++#if defined(CONFIG_DMI) && defined(CONFIG_X86)
++	{
++		/* Gigabyte U2442 */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "GIGABYTE"),
++			DMI_MATCH(DMI_PRODUCT_NAME, "U2442"),
++		},
++	},
++#endif
++	{ }
++};
++
++/*
+  * determine hardware version and set some properties according to it.
+  */
+ static int elantech_set_properties(struct elantech_data *etd)
+@@ -1254,6 +1275,9 @@ static int elantech_set_properties(struct elantech_data *etd)
+ 			etd->reports_pressure = true;
+ 	}
+ 
++	/* Enable real hardware resolution on hw_version 3 ? */
++	etd->set_hw_resolution = !dmi_check_system(no_hw_res_dmi_table);
++
+ 	return 0;
+ }
+ 
+diff --git a/drivers/input/mouse/elantech.h b/drivers/input/mouse/elantech.h
+index 9e5f1aabea7e..3569bed80a28 100644
+--- a/drivers/input/mouse/elantech.h
++++ b/drivers/input/mouse/elantech.h
+@@ -128,6 +128,7 @@ struct elantech_data {
+ 	bool paritycheck;
+ 	bool jumpy_cursor;
+ 	bool reports_pressure;
++	bool set_hw_resolution;
+ 	unsigned char hw_version;
+ 	unsigned int fw_version;
+ 	unsigned int single_finger_reports;
+diff --git a/drivers/input/mouse/synaptics.c b/drivers/input/mouse/synaptics.c
+index 886c1914146b..8a398076d1e5 100644
+--- a/drivers/input/mouse/synaptics.c
++++ b/drivers/input/mouse/synaptics.c
+@@ -1394,6 +1394,14 @@ static const struct dmi_system_id min_max_dmi_table[] __initconst = {
+ 		.driver_data = (int []){1232, 5710, 1156, 4696},
+ 	},
+ 	{
++		/* Lenovo ThinkPad Edge E431 */
++		.matches = {
++			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
++			DMI_MATCH(DMI_PRODUCT_VERSION, "ThinkPad Edge E431"),
++		},
++		.driver_data = (int []){1024, 5022, 2508, 4832},
++	},
++	{
+ 		/* Lenovo ThinkPad T431s */
+ 		.matches = {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "LENOVO"),
+diff --git a/drivers/md/md.c b/drivers/md/md.c
+index 2d0544c92737..db4b4a82843a 100644
+--- a/drivers/md/md.c
++++ b/drivers/md/md.c
+@@ -8122,7 +8122,8 @@ static int md_notify_reboot(struct notifier_block *this,
+ 		if (mddev_trylock(mddev)) {
+ 			if (mddev->pers)
+ 				__md_stop_writes(mddev);
+-			mddev->safemode = 2;
++			if (mddev->persistent)
++				mddev->safemode = 2;
+ 			mddev_unlock(mddev);
+ 		}
+ 		need_delay = 1;
+diff --git a/drivers/media/media-device.c b/drivers/media/media-device.c
+index 6edc9ba81203..298703fca3b5 100644
+--- a/drivers/media/media-device.c
++++ b/drivers/media/media-device.c
+@@ -90,6 +90,7 @@ static long media_device_enum_entities(struct media_device *mdev,
+ 	struct media_entity *ent;
+ 	struct media_entity_desc u_ent;
+ 
++	memset(&u_ent, 0, sizeof(u_ent));
+ 	if (copy_from_user(&u_ent.id, &uent->id, sizeof(u_ent.id)))
+ 		return -EFAULT;
+ 
+diff --git a/drivers/media/video/ov7670.c b/drivers/media/video/ov7670.c
+index 8aa058531280..17125d96297b 100644
+--- a/drivers/media/video/ov7670.c
++++ b/drivers/media/video/ov7670.c
+@@ -937,7 +937,7 @@ static int ov7670_enum_framesizes(struct v4l2_subdev *sd,
+ 	 * windows that fall outside that.
+ 	 */
+ 	for (i = 0; i < N_WIN_SIZES; i++) {
+-		struct ov7670_win_size *win = &ov7670_win_sizes[index];
++		struct ov7670_win_size *win = &ov7670_win_sizes[i];
+ 		if (info->min_width && win->width < info->min_width)
+ 			continue;
+ 		if (info->min_height && win->height < info->min_height)
+diff --git a/drivers/media/video/v4l2-compat-ioctl32.c b/drivers/media/video/v4l2-compat-ioctl32.c
+index c68531b88279..2671959f01bb 100644
+--- a/drivers/media/video/v4l2-compat-ioctl32.c
++++ b/drivers/media/video/v4l2-compat-ioctl32.c
+@@ -178,6 +178,9 @@ struct v4l2_create_buffers32 {
+ 
+ static int __get_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __user *up)
+ {
++	if (get_user(kp->type, &up->type))
++		return -EFAULT;
++
+ 	switch (kp->type) {
+ 	case V4L2_BUF_TYPE_VIDEO_CAPTURE:
+ 	case V4L2_BUF_TYPE_VIDEO_OUTPUT:
+@@ -208,17 +211,16 @@ static int __get_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __us
+ 
+ static int get_v4l2_format32(struct v4l2_format *kp, struct v4l2_format32 __user *up)
+ {
+-	if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_format32)) ||
+-			get_user(kp->type, &up->type))
+-			return -EFAULT;
++	if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_format32)))
++		return -EFAULT;
+ 	return __get_v4l2_format32(kp, up);
+ }
+ 
+ static int get_v4l2_create32(struct v4l2_create_buffers *kp, struct v4l2_create_buffers32 __user *up)
+ {
+ 	if (!access_ok(VERIFY_READ, up, sizeof(struct v4l2_create_buffers32)) ||
+-	    copy_from_user(kp, up, offsetof(struct v4l2_create_buffers32, format.fmt)))
+-			return -EFAULT;
++	    copy_from_user(kp, up, offsetof(struct v4l2_create_buffers32, format)))
++		return -EFAULT;
+ 	return __get_v4l2_format32(&kp->format, &up->format);
+ }
+ 
+diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
+index 1bf36ac44a10..5af2a8f29bc0 100644
+--- a/drivers/net/bonding/bond_main.c
++++ b/drivers/net/bonding/bond_main.c
+@@ -4914,6 +4914,7 @@ static int __init bonding_init(void)
+ out:
+ 	return res;
+ err:
++	bond_destroy_debugfs();
+ 	rtnl_link_unregister(&bond_link_ops);
+ err_link:
+ 	unregister_pernet_subsys(&bond_net_ops);
+diff --git a/drivers/net/can/sja1000/peak_pci.c b/drivers/net/can/sja1000/peak_pci.c
+index 2c7f5036f570..5192f8615258 100644
+--- a/drivers/net/can/sja1000/peak_pci.c
++++ b/drivers/net/can/sja1000/peak_pci.c
+@@ -39,9 +39,9 @@ MODULE_LICENSE("GPL v2");
+ #define DRV_NAME  "peak_pci"
+ 
+ struct peak_pci_chan {
+-	void __iomem *cfg_base;	     /* Common for all channels */
+-	struct net_device *next_dev; /* Chain of network devices */
+-	u16 icr_mask;		     /* Interrupt mask for fast ack */
++	void __iomem *cfg_base;		/* Common for all channels */
++	struct net_device *prev_dev;	/* Chain of network devices */
++	u16 icr_mask;			/* Interrupt mask for fast ack */
+ };
+ 
+ #define PEAK_PCI_CAN_CLOCK	(16000000 / 2)
+@@ -98,7 +98,7 @@ static int __devinit peak_pci_probe(struct pci_dev *pdev,
+ {
+ 	struct sja1000_priv *priv;
+ 	struct peak_pci_chan *chan;
+-	struct net_device *dev, *dev0 = NULL;
++	struct net_device *dev, *prev_dev;
+ 	void __iomem *cfg_base, *reg_base;
+ 	u16 sub_sys_id, icr;
+ 	int i, err, channels;
+@@ -196,18 +196,14 @@ static int __devinit peak_pci_probe(struct pci_dev *pdev,
+ 		}
+ 
+ 		/* Create chain of SJA1000 devices */
+-		if (i == 0)
+-			dev0 = dev;
+-		else
+-			chan->next_dev = dev;
++		chan->prev_dev = pci_get_drvdata(pdev);
++		pci_set_drvdata(pdev, dev);
+ 
+ 		dev_info(&pdev->dev,
+ 			 "%s at reg_base=0x%p cfg_base=0x%p irq=%d\n",
+ 			 dev->name, priv->reg_base, chan->cfg_base, dev->irq);
+ 	}
+ 
+-	pci_set_drvdata(pdev, dev0);
+-
+ 	/* Enable interrupts */
+ 	writew(icr, cfg_base + PITA_ICR + 2);
+ 
+@@ -217,12 +213,13 @@ failure_remove_channels:
+ 	/* Disable interrupts */
+ 	writew(0x0, cfg_base + PITA_ICR + 2);
+ 
+-	for (dev = dev0; dev; dev = chan->next_dev) {
+-		unregister_sja1000dev(dev);
+-		free_sja1000dev(dev);
++	for (dev = pci_get_drvdata(pdev); dev; dev = prev_dev) {
+ 		priv = netdev_priv(dev);
+ 		chan = priv->priv;
+-		dev = chan->next_dev;
++		prev_dev = chan->prev_dev;
++
++		unregister_sja1000dev(dev);
++		free_sja1000dev(dev);
+ 	}
+ 
+ 	pci_iounmap(pdev, reg_base);
+@@ -241,7 +238,7 @@ failure_disable_pci:
+ 
+ static void __devexit peak_pci_remove(struct pci_dev *pdev)
+ {
+-	struct net_device *dev = pci_get_drvdata(pdev); /* First device */
++	struct net_device *dev = pci_get_drvdata(pdev); /* Last device */
+ 	struct sja1000_priv *priv = netdev_priv(dev);
+ 	struct peak_pci_chan *chan = priv->priv;
+ 	void __iomem *cfg_base = chan->cfg_base;
+@@ -252,10 +249,12 @@ static void __devexit peak_pci_remove(struct pci_dev *pdev)
+ 
+ 	/* Loop over all registered devices */
+ 	while (1) {
++		struct net_device *prev_dev = chan->prev_dev;
++
+ 		dev_info(&pdev->dev, "removing device %s\n", dev->name);
+ 		unregister_sja1000dev(dev);
+ 		free_sja1000dev(dev);
+-		dev = chan->next_dev;
++		dev = prev_dev;
+ 		if (!dev)
+ 			break;
+ 		priv = netdev_priv(dev);
+diff --git a/drivers/net/ethernet/broadcom/tg3.c b/drivers/net/ethernet/broadcom/tg3.c
+index c77c462bcee5..2615433b279f 100644
+--- a/drivers/net/ethernet/broadcom/tg3.c
++++ b/drivers/net/ethernet/broadcom/tg3.c
+@@ -10656,7 +10656,9 @@ static int tg3_set_ringparam(struct net_device *dev, struct ethtool_ringparam *e
+ 	if (tg3_flag(tp, MAX_RXPEND_64) &&
+ 	    tp->rx_pending > 63)
+ 		tp->rx_pending = 63;
+-	tp->rx_jumbo_pending = ering->rx_jumbo_pending;
++
++	if (tg3_flag(tp, JUMBO_RING_ENABLE))
++		tp->rx_jumbo_pending = ering->rx_jumbo_pending;
+ 
+ 	for (i = 0; i < tp->irq_max; i++)
+ 		tp->napi[i].tx_pending = ering->tx_pending;
+diff --git a/drivers/net/macvlan.c b/drivers/net/macvlan.c
+index 301b39ed96ce..b74cdf6a0d7d 100644
+--- a/drivers/net/macvlan.c
++++ b/drivers/net/macvlan.c
+@@ -236,11 +236,9 @@ static int macvlan_queue_xmit(struct sk_buff *skb, struct net_device *dev)
+ 	const struct macvlan_dev *vlan = netdev_priv(dev);
+ 	const struct macvlan_port *port = vlan->port;
+ 	const struct macvlan_dev *dest;
+-	__u8 ip_summed = skb->ip_summed;
+ 
+ 	if (vlan->mode == MACVLAN_MODE_BRIDGE) {
+ 		const struct ethhdr *eth = (void *)skb->data;
+-		skb->ip_summed = CHECKSUM_UNNECESSARY;
+ 
+ 		/* send to other bridge ports directly */
+ 		if (is_multicast_ether_addr(eth->h_dest)) {
+@@ -258,7 +256,6 @@ static int macvlan_queue_xmit(struct sk_buff *skb, struct net_device *dev)
+ 	}
+ 
+ xmit_world:
+-	skb->ip_summed = ip_summed;
+ 	skb->dev = vlan->lowerdev;
+ 	return dev_queue_xmit(skb);
+ }
+@@ -394,8 +391,10 @@ static void macvlan_change_rx_flags(struct net_device *dev, int change)
+ 	struct macvlan_dev *vlan = netdev_priv(dev);
+ 	struct net_device *lowerdev = vlan->lowerdev;
+ 
+-	if (change & IFF_ALLMULTI)
+-		dev_set_allmulti(lowerdev, dev->flags & IFF_ALLMULTI ? 1 : -1);
++	if (dev->flags & IFF_UP) {
++		if (change & IFF_ALLMULTI)
++			dev_set_allmulti(lowerdev, dev->flags & IFF_ALLMULTI ? 1 : -1);
++	}
+ }
+ 
+ static void macvlan_set_multicast_list(struct net_device *dev)
+diff --git a/drivers/net/wimax/i2400m/usb-rx.c b/drivers/net/wimax/i2400m/usb-rx.c
+index e3257681e360..b78ee676e102 100644
+--- a/drivers/net/wimax/i2400m/usb-rx.c
++++ b/drivers/net/wimax/i2400m/usb-rx.c
+@@ -277,7 +277,7 @@ retry:
+ 		d_printf(1, dev, "RX: size changed to %d, received %d, "
+ 			 "copied %d, capacity %ld\n",
+ 			 rx_size, read_size, rx_skb->len,
+-			 (long) (skb_end_pointer(new_skb) - new_skb->head));
++			 (long) skb_end_offset(new_skb));
+ 		goto retry;
+ 	}
+ 		/* In most cases, it happens due to the hardware scheduling a
+diff --git a/drivers/net/wireless/rt2x00/rt2x00mac.c b/drivers/net/wireless/rt2x00/rt2x00mac.c
+index 5c38281955d4..1d4c579178f3 100644
+--- a/drivers/net/wireless/rt2x00/rt2x00mac.c
++++ b/drivers/net/wireless/rt2x00/rt2x00mac.c
+@@ -651,20 +651,18 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
+ 				      bss_conf->bssid);
+ 
+ 	/*
+-	 * Update the beacon. This is only required on USB devices. PCI
+-	 * devices fetch beacons periodically.
+-	 */
+-	if (changes & BSS_CHANGED_BEACON && rt2x00_is_usb(rt2x00dev))
+-		rt2x00queue_update_beacon(rt2x00dev, vif);
+-
+-	/*
+ 	 * Start/stop beaconing.
+ 	 */
+ 	if (changes & BSS_CHANGED_BEACON_ENABLED) {
+ 		if (!bss_conf->enable_beacon && intf->enable_beacon) {
+-			rt2x00queue_clear_beacon(rt2x00dev, vif);
+ 			rt2x00dev->intf_beaconing--;
+ 			intf->enable_beacon = false;
++			/*
++			 * Clear beacon in the H/W for this vif. This is needed
++			 * to disable beaconing on this particular interface
++			 * and keep it running on other interfaces.
++			 */
++			rt2x00queue_clear_beacon(rt2x00dev, vif);
+ 
+ 			if (rt2x00dev->intf_beaconing == 0) {
+ 				/*
+@@ -675,11 +673,15 @@ void rt2x00mac_bss_info_changed(struct ieee80211_hw *hw,
+ 				rt2x00queue_stop_queue(rt2x00dev->bcn);
+ 				mutex_unlock(&intf->beacon_skb_mutex);
+ 			}
+-
+-
+ 		} else if (bss_conf->enable_beacon && !intf->enable_beacon) {
+ 			rt2x00dev->intf_beaconing++;
+ 			intf->enable_beacon = true;
++			/*
++			 * Upload beacon to the H/W. This is only required on
++			 * USB devices. PCI devices fetch beacons periodically.
++			 */
++			if (rt2x00_is_usb(rt2x00dev))
++				rt2x00queue_update_beacon(rt2x00dev, vif);
+ 
+ 			if (rt2x00dev->intf_beaconing == 1) {
+ 				/*
+diff --git a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
+index d3920daa3c32..79fc4b770500 100644
+--- a/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
++++ b/drivers/net/wireless/rtlwifi/rtl8192cu/hw.c
+@@ -1158,12 +1158,23 @@ int rtl92cu_hw_init(struct ieee80211_hw *hw)
+ 	struct rtl_ps_ctl *ppsc = rtl_psc(rtl_priv(hw));
+ 	int err = 0;
+ 	static bool iqk_initialized;
++	unsigned long flags;
++
++	/* As this function can take a very long time (up to 350 ms)
++	 * and can be called with irqs disabled, reenable the irqs
++	 * to let the other devices continue being serviced.
++	 *
++	 * It is safe doing so since our own interrupts will only be enabled
++	 * in a subsequent step.
++	 */
++	local_save_flags(flags);
++	local_irq_enable();
+ 
+ 	rtlhal->hw_type = HARDWARE_TYPE_RTL8192CU;
+ 	err = _rtl92cu_init_mac(hw);
+ 	if (err) {
+ 		RT_TRACE(rtlpriv, COMP_ERR, DBG_EMERG, ("init mac failed!\n"));
+-		return err;
++		goto exit;
+ 	}
+ 	err = rtl92c_download_fw(hw);
+ 	if (err) {
+@@ -1171,7 +1182,7 @@ int rtl92cu_hw_init(struct ieee80211_hw *hw)
+ 			 ("Failed to download FW. Init HW without FW now..\n"));
+ 		err = 1;
+ 		rtlhal->fw_ready = false;
+-		return err;
++		goto exit;
+ 	} else {
+ 		rtlhal->fw_ready = true;
+ 	}
+@@ -1212,6 +1223,8 @@ int rtl92cu_hw_init(struct ieee80211_hw *hw)
+ 	_update_mac_setting(hw);
+ 	rtl92c_dm_init(hw);
+ 	_dump_registers(hw);
++exit:
++	local_irq_restore(flags);
+ 	return err;
+ }
+ 
+diff --git a/drivers/pci/hotplug/shpchp_ctrl.c b/drivers/pci/hotplug/shpchp_ctrl.c
+index 3ffc1b2b3932..b888675a228a 100644
+--- a/drivers/pci/hotplug/shpchp_ctrl.c
++++ b/drivers/pci/hotplug/shpchp_ctrl.c
+@@ -285,8 +285,8 @@ static int board_added(struct slot *p_slot)
+ 		return WRONG_BUS_FREQUENCY;
+ 	}
+ 
+-	bsp = ctrl->pci_dev->bus->cur_bus_speed;
+-	msp = ctrl->pci_dev->bus->max_bus_speed;
++	bsp = ctrl->pci_dev->subordinate->cur_bus_speed;
++	msp = ctrl->pci_dev->subordinate->max_bus_speed;
+ 
+ 	/* Check if there are other slots or devices on the same bus */
+ 	if (!list_empty(&ctrl->pci_dev->subordinate->devices))
+diff --git a/drivers/platform/x86/thinkpad_acpi.c b/drivers/platform/x86/thinkpad_acpi.c
+index 8e6c4fafb3eb..2a8d6aa441c3 100644
+--- a/drivers/platform/x86/thinkpad_acpi.c
++++ b/drivers/platform/x86/thinkpad_acpi.c
+@@ -3405,7 +3405,7 @@ static int __init hotkey_init(struct ibm_init_struct *iibm)
+ 	/* Do not issue duplicate brightness change events to
+ 	 * userspace. tpacpi_detect_brightness_capabilities() must have
+ 	 * been called before this point  */
+-	if (tp_features.bright_acpimode && acpi_video_backlight_support()) {
++	if (acpi_video_backlight_support()) {
+ 		pr_info("This ThinkPad has standard ACPI backlight "
+ 			"brightness control, supported by the ACPI "
+ 			"video driver\n");
+diff --git a/drivers/scsi/mpt2sas/mpt2sas_scsih.c b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+index 987c6d6adb76..01780a963181 100644
+--- a/drivers/scsi/mpt2sas/mpt2sas_scsih.c
++++ b/drivers/scsi/mpt2sas/mpt2sas_scsih.c
+@@ -8166,7 +8166,6 @@ _scsih_suspend(struct pci_dev *pdev, pm_message_t state)
+ 
+ 	mpt2sas_base_free_resources(ioc);
+ 	pci_save_state(pdev);
+-	pci_disable_device(pdev);
+ 	pci_set_power_state(pdev, device_state);
+ 	return 0;
+ }
+diff --git a/drivers/staging/octeon/ethernet-tx.c b/drivers/staging/octeon/ethernet-tx.c
+index 2542c3743904..c5da0d24b4aa 100644
+--- a/drivers/staging/octeon/ethernet-tx.c
++++ b/drivers/staging/octeon/ethernet-tx.c
+@@ -344,7 +344,7 @@ int cvm_oct_xmit(struct sk_buff *skb, struct net_device *dev)
+ 	}
+ 	if (unlikely
+ 	    (skb->truesize !=
+-	     sizeof(*skb) + skb_end_pointer(skb) - skb->head)) {
++	     sizeof(*skb) + skb_end_offset(skb))) {
+ 		/*
+ 		   printk("TX buffer truesize has been changed\n");
+ 		 */
+diff --git a/drivers/tty/hvc/hvc_console.c b/drivers/tty/hvc/hvc_console.c
+index 7b97e7e3ede4..443547bf5407 100644
+--- a/drivers/tty/hvc/hvc_console.c
++++ b/drivers/tty/hvc/hvc_console.c
+@@ -190,7 +190,7 @@ static struct tty_driver *hvc_console_device(struct console *c, int *index)
+ 	return hvc_driver;
+ }
+ 
+-static int __init hvc_console_setup(struct console *co, char *options)
++static int hvc_console_setup(struct console *co, char *options)
+ {	
+ 	if (co->index < 0 || co->index >= MAX_NR_HVC_CONSOLES)
+ 		return -ENODEV;
+diff --git a/drivers/usb/storage/shuttle_usbat.c b/drivers/usb/storage/shuttle_usbat.c
+index 0b00091d2ae9..ff8aeeebe5fa 100644
+--- a/drivers/usb/storage/shuttle_usbat.c
++++ b/drivers/usb/storage/shuttle_usbat.c
+@@ -1846,7 +1846,7 @@ static int usbat_probe(struct usb_interface *intf,
+ 	us->transport_name = "Shuttle USBAT";
+ 	us->transport = usbat_flash_transport;
+ 	us->transport_reset = usb_stor_CB_reset;
+-	us->max_lun = 1;
++	us->max_lun = 0;
+ 
+ 	result = usb_stor_probe2(us);
+ 	return result;
+diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
+index 08711bc24124..49d222d965da 100644
+--- a/drivers/usb/storage/unusual_devs.h
++++ b/drivers/usb/storage/unusual_devs.h
+@@ -226,6 +226,20 @@ UNUSUAL_DEV(  0x0421, 0x0495, 0x0370, 0x0370,
+ 		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
+ 		US_FL_MAX_SECTORS_64 ),
+ 
++/* Reported by Daniele Forsi <dforsi@×××××.com> */
++UNUSUAL_DEV(  0x0421, 0x04b9, 0x0350, 0x0350,
++		"Nokia",
++		"5300",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_MAX_SECTORS_64 ),
++
++/* Patch submitted by Victor A. Santos <victoraur.santos@×××××.com> */
++UNUSUAL_DEV(  0x0421, 0x05af, 0x0742, 0x0742,
++		"Nokia",
++		"305",
++		USB_SC_DEVICE, USB_PR_DEVICE, NULL,
++		US_FL_MAX_SECTORS_64),
++
+ /* Patch submitted by Mikhail Zolotaryov <lebon@×××××××××.ua> */
+ UNUSUAL_DEV(  0x0421, 0x06aa, 0x1110, 0x1110,
+ 		"Nokia",
+diff --git a/drivers/video/tgafb.c b/drivers/video/tgafb.c
+index ac2cf6dcc598..3b15bcac3766 100644
+--- a/drivers/video/tgafb.c
++++ b/drivers/video/tgafb.c
+@@ -192,6 +192,8 @@ tgafb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
+ 
+ 	if (var->xres_virtual != var->xres || var->yres_virtual != var->yres)
+ 		return -EINVAL;
++	if (var->xres * var->yres * (var->bits_per_pixel >> 3) > info->fix.smem_len)
++		return -EINVAL;
+ 	if (var->nonstd)
+ 		return -EINVAL;
+ 	if (1000000000 / var->pixclock > TGA_PLL_MAX_FREQ)
+@@ -272,6 +274,7 @@ tgafb_set_par(struct fb_info *info)
+ 	par->yres = info->var.yres;
+ 	par->pll_freq = pll_freq = 1000000000 / info->var.pixclock;
+ 	par->bits_per_pixel = info->var.bits_per_pixel;
++	info->fix.line_length = par->xres * (par->bits_per_pixel >> 3);
+ 
+ 	tga_type = par->tga_type;
+ 
+@@ -1318,6 +1321,7 @@ tgafb_init_fix(struct fb_info *info)
+ 	int tga_bus_tc = TGA_BUS_TC(par->dev);
+ 	u8 tga_type = par->tga_type;
+ 	const char *tga_type_name = NULL;
++	unsigned memory_size;
+ 
+ 	switch (tga_type) {
+ 	case TGA_TYPE_8PLANE:
+@@ -1325,21 +1329,25 @@ tgafb_init_fix(struct fb_info *info)
+ 			tga_type_name = "Digital ZLXp-E1";
+ 		if (tga_bus_tc)
+ 			tga_type_name = "Digital ZLX-E1";
++		memory_size = 2097152;
+ 		break;
+ 	case TGA_TYPE_24PLANE:
+ 		if (tga_bus_pci)
+ 			tga_type_name = "Digital ZLXp-E2";
+ 		if (tga_bus_tc)
+ 			tga_type_name = "Digital ZLX-E2";
++		memory_size = 8388608;
+ 		break;
+ 	case TGA_TYPE_24PLUSZ:
+ 		if (tga_bus_pci)
+ 			tga_type_name = "Digital ZLXp-E3";
+ 		if (tga_bus_tc)
+ 			tga_type_name = "Digital ZLX-E3";
++		memory_size = 16777216;
+ 		break;
+ 	default:
+ 		tga_type_name = "Unknown";
++		memory_size = 16777216;
+ 		break;
+ 	}
+ 
+@@ -1351,9 +1359,8 @@ tgafb_init_fix(struct fb_info *info)
+ 			    ? FB_VISUAL_PSEUDOCOLOR
+ 			    : FB_VISUAL_DIRECTCOLOR);
+ 
+-	info->fix.line_length = par->xres * (par->bits_per_pixel >> 3);
+ 	info->fix.smem_start = (size_t) par->tga_fb_base;
+-	info->fix.smem_len = info->fix.line_length * par->yres;
++	info->fix.smem_len = memory_size;
+ 	info->fix.mmio_start = (size_t) par->tga_regs_base;
+ 	info->fix.mmio_len = 512;
+ 
+@@ -1478,6 +1485,9 @@ tgafb_register(struct device *dev)
+ 		modedb_tga = &modedb_tc;
+ 		modedbsize_tga = 1;
+ 	}
++
++	tgafb_init_fix(info);
++
+ 	ret = fb_find_mode(&info->var, info,
+ 			   mode_option ? mode_option : mode_option_tga,
+ 			   modedb_tga, modedbsize_tga, NULL,
+@@ -1495,7 +1505,6 @@ tgafb_register(struct device *dev)
+ 	}
+ 
+ 	tgafb_set_par(info);
+-	tgafb_init_fix(info);
+ 
+ 	if (register_framebuffer(info) < 0) {
+ 		printk(KERN_ERR "tgafb: Could not register framebuffer\n");
+diff --git a/fs/nfsd/nfs4acl.c b/fs/nfsd/nfs4acl.c
+index 9c51aff02ae2..435a9be1265e 100644
+--- a/fs/nfsd/nfs4acl.c
++++ b/fs/nfsd/nfs4acl.c
+@@ -373,8 +373,10 @@ sort_pacl(struct posix_acl *pacl)
+ 	 * by uid/gid. */
+ 	int i, j;
+ 
+-	if (pacl->a_count <= 4)
+-		return; /* no users or groups */
++	/* no users or groups */
++	if (!pacl || pacl->a_count <= 4)
++		return;
++
+ 	i = 1;
+ 	while (pacl->a_entries[i].e_tag == ACL_USER)
+ 		i++;
+@@ -498,13 +500,12 @@ posix_state_to_acl(struct posix_acl_state *state, unsigned int flags)
+ 
+ 	/*
+ 	 * ACLs with no ACEs are treated differently in the inheritable
+-	 * and effective cases: when there are no inheritable ACEs, we
+-	 * set a zero-length default posix acl:
++	 * and effective cases: when there are no inheritable ACEs,
++	 * calls ->set_acl with a NULL ACL structure.
+ 	 */
+-	if (state->empty && (flags & NFS4_ACL_TYPE_DEFAULT)) {
+-		pacl = posix_acl_alloc(0, GFP_KERNEL);
+-		return pacl ? pacl : ERR_PTR(-ENOMEM);
+-	}
++	if (state->empty && (flags & NFS4_ACL_TYPE_DEFAULT))
++		return NULL;
++
+ 	/*
+ 	 * When there are no effective ACEs, the following will end
+ 	 * up setting a 3-element effective posix ACL with all
+diff --git a/fs/nfsd/nfs4state.c b/fs/nfsd/nfs4state.c
+index 4cef99ff2408..b2e0a5585aed 100644
+--- a/fs/nfsd/nfs4state.c
++++ b/fs/nfsd/nfs4state.c
+@@ -986,6 +986,18 @@ static struct nfs4_client *alloc_client(struct xdr_netobj name)
+ 	}
+ 	memcpy(clp->cl_name.data, name.data, name.len);
+ 	clp->cl_name.len = name.len;
++	INIT_LIST_HEAD(&clp->cl_sessions);
++	idr_init(&clp->cl_stateids);
++	atomic_set(&clp->cl_refcount, 0);
++	clp->cl_cb_state = NFSD4_CB_UNKNOWN;
++	INIT_LIST_HEAD(&clp->cl_idhash);
++	INIT_LIST_HEAD(&clp->cl_strhash);
++	INIT_LIST_HEAD(&clp->cl_openowners);
++	INIT_LIST_HEAD(&clp->cl_delegations);
++	INIT_LIST_HEAD(&clp->cl_lru);
++	INIT_LIST_HEAD(&clp->cl_callbacks);
++	spin_lock_init(&clp->cl_lock);
++	rpc_init_wait_queue(&clp->cl_cb_waitq, "Backchannel slot table");
+ 	return clp;
+ }
+ 
+@@ -999,6 +1011,7 @@ free_client(struct nfs4_client *clp)
+ 		list_del(&ses->se_perclnt);
+ 		nfsd4_put_session(ses);
+ 	}
++	rpc_destroy_wait_queue(&clp->cl_cb_waitq);
+ 	if (clp->cl_cred.cr_group_info)
+ 		put_group_info(clp->cl_cred.cr_group_info);
+ 	kfree(clp->cl_principal);
+@@ -1163,7 +1176,6 @@ static struct nfs4_client *create_client(struct xdr_netobj name, char *recdir,
+ 	if (clp == NULL)
+ 		return NULL;
+ 
+-	INIT_LIST_HEAD(&clp->cl_sessions);
+ 
+ 	princ = svc_gss_principal(rqstp);
+ 	if (princ) {
+@@ -1174,21 +1186,10 @@ static struct nfs4_client *create_client(struct xdr_netobj name, char *recdir,
+ 		}
+ 	}
+ 
+-	idr_init(&clp->cl_stateids);
+ 	memcpy(clp->cl_recdir, recdir, HEXDIR_LEN);
+-	atomic_set(&clp->cl_refcount, 0);
+-	clp->cl_cb_state = NFSD4_CB_UNKNOWN;
+-	INIT_LIST_HEAD(&clp->cl_idhash);
+-	INIT_LIST_HEAD(&clp->cl_strhash);
+-	INIT_LIST_HEAD(&clp->cl_openowners);
+-	INIT_LIST_HEAD(&clp->cl_delegations);
+-	INIT_LIST_HEAD(&clp->cl_lru);
+-	INIT_LIST_HEAD(&clp->cl_callbacks);
+-	spin_lock_init(&clp->cl_lock);
+ 	INIT_WORK(&clp->cl_cb_null.cb_work, nfsd4_do_callback_rpc);
+ 	clp->cl_time = get_seconds();
+ 	clear_bit(0, &clp->cl_cb_slot_busy);
+-	rpc_init_wait_queue(&clp->cl_cb_waitq, "Backchannel slot table");
+ 	copy_verf(clp, verf);
+ 	rpc_copy_addr((struct sockaddr *) &clp->cl_addr, sa);
+ 	clp->cl_flavor = rqstp->rq_flavor;
+@@ -3375,9 +3376,16 @@ out:
+ static __be32
+ nfsd4_free_lock_stateid(struct nfs4_ol_stateid *stp)
+ {
+-	if (check_for_locks(stp->st_file, lockowner(stp->st_stateowner)))
++	struct nfs4_lockowner *lo = lockowner(stp->st_stateowner);
++
++	if (check_for_locks(stp->st_file, lo))
+ 		return nfserr_locks_held;
+-	release_lock_stateid(stp);
++	/*
++	 * Currently there's a 1-1 lock stateid<->lockowner
++	 * correspondance, and we have to delete the lockowner when we
++	 * delete the lock stateid:
++	 */
++	unhash_lockowner(lo);
+ 	return nfs_ok;
+ }
+ 
+@@ -3812,6 +3820,10 @@ static bool same_lockowner_ino(struct nfs4_lockowner *lo, struct inode *inode, c
+ 
+ 	if (!same_owner_str(&lo->lo_owner, owner, clid))
+ 		return false;
++	if (list_empty(&lo->lo_owner.so_stateids)) {
++		WARN_ON_ONCE(1);
++		return false;
++	}
+ 	lst = list_first_entry(&lo->lo_owner.so_stateids,
+ 			       struct nfs4_ol_stateid, st_perstateowner);
+ 	return lst->st_file->fi_inode == inode;
+diff --git a/fs/posix_acl.c b/fs/posix_acl.c
+index cea4623f1ed6..6c70ab22a3e3 100644
+--- a/fs/posix_acl.c
++++ b/fs/posix_acl.c
+@@ -155,6 +155,12 @@ posix_acl_equiv_mode(const struct posix_acl *acl, umode_t *mode_p)
+ 	umode_t mode = 0;
+ 	int not_equiv = 0;
+ 
++	/*
++	 * A null ACL can always be presented as mode bits.
++	 */
++	if (!acl)
++		return 0;
++
+ 	FOREACH_ACL_ENTRY(pa, acl, pe) {
+ 		switch (pa->e_tag) {
+ 			case ACL_USER_OBJ:
+diff --git a/include/linux/ftrace.h b/include/linux/ftrace.h
+index 26eafcef75be..a3ebb09d4283 100644
+--- a/include/linux/ftrace.h
++++ b/include/linux/ftrace.h
+@@ -260,6 +260,7 @@ extern int ftrace_make_call(struct dyn_ftrace *rec, unsigned long addr);
+ extern int ftrace_arch_read_dyn_info(char *buf, int size);
+ 
+ extern int skip_trace(unsigned long ip);
++extern void ftrace_module_init(struct module *mod);
+ 
+ extern void ftrace_disable_daemon(void);
+ extern void ftrace_enable_daemon(void);
+@@ -272,6 +273,7 @@ static inline void ftrace_set_filter(unsigned char *buf, int len, int reset)
+ static inline void ftrace_disable_daemon(void) { }
+ static inline void ftrace_enable_daemon(void) { }
+ static inline void ftrace_release_mod(struct module *mod) {}
++static inline void ftrace_module_init(struct module *mod) {}
+ static inline int register_ftrace_command(struct ftrace_func_command *cmd)
+ {
+ 	return -EINVAL;
+diff --git a/include/linux/kvm_host.h b/include/linux/kvm_host.h
+index e6796c19dc62..f93d8c11e085 100644
+--- a/include/linux/kvm_host.h
++++ b/include/linux/kvm_host.h
+@@ -95,7 +95,6 @@ struct kvm_async_pf {
+ 	unsigned long addr;
+ 	struct kvm_arch_async_pf arch;
+ 	struct page *page;
+-	bool done;
+ };
+ 
+ void kvm_clear_async_pf_completion_queue(struct kvm_vcpu *vcpu);
+diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
+index 13bd6d0e43c5..c445e5221d49 100644
+--- a/include/linux/skbuff.h
++++ b/include/linux/skbuff.h
+@@ -617,11 +617,21 @@ static inline unsigned char *skb_end_pointer(const struct sk_buff *skb)
+ {
+ 	return skb->head + skb->end;
+ }
++
++static inline unsigned int skb_end_offset(const struct sk_buff *skb)
++{
++	return skb->end;
++}
+ #else
+ static inline unsigned char *skb_end_pointer(const struct sk_buff *skb)
+ {
+ 	return skb->end;
+ }
++
++static inline unsigned int skb_end_offset(const struct sk_buff *skb)
++{
++	return skb->end - skb->head;
++}
+ #endif
+ 
+ /* Internal */
+@@ -2549,7 +2559,7 @@ static inline bool skb_is_recycleable(const struct sk_buff *skb, int skb_size)
+ 		return false;
+ 
+ 	skb_size = SKB_DATA_ALIGN(skb_size + NET_SKB_PAD);
+-	if (skb_end_pointer(skb) - skb->head < skb_size)
++	if (skb_end_offset(skb) < skb_size)
+ 		return false;
+ 
+ 	if (skb_shared(skb) || skb_cloned(skb))
+diff --git a/include/net/ip6_route.h b/include/net/ip6_route.h
+index 5e91b72fc718..4913dacd1333 100644
+--- a/include/net/ip6_route.h
++++ b/include/net/ip6_route.h
+@@ -34,6 +34,11 @@ struct route_info {
+ #define RT6_LOOKUP_F_SRCPREF_PUBLIC	0x00000010
+ #define RT6_LOOKUP_F_SRCPREF_COA	0x00000020
+ 
++/* We do not (yet ?) support IPv6 jumbograms (RFC 2675)
++ * Unlike IPv4, hdr->seg_len doesn't include the IPv6 header
++ */
++#define IP6_MAX_MTU (0xFFFF + sizeof(struct ipv6hdr))
++
+ /*
+  * rt6_srcprefs2flags() and rt6_flags2srcprefs() translate
+  * between IPV6_ADDR_PREFERENCES socket option values
+diff --git a/include/trace/events/module.h b/include/trace/events/module.h
+index 161932737416..ca298c7157ae 100644
+--- a/include/trace/events/module.h
++++ b/include/trace/events/module.h
+@@ -78,7 +78,7 @@ DECLARE_EVENT_CLASS(module_refcnt,
+ 
+ 	TP_fast_assign(
+ 		__entry->ip	= ip;
+-		__entry->refcnt	= __this_cpu_read(mod->refptr->incs) + __this_cpu_read(mod->refptr->decs);
++		__entry->refcnt	= __this_cpu_read(mod->refptr->incs) - __this_cpu_read(mod->refptr->decs);
+ 		__assign_str(name, mod->name);
+ 	),
+ 
+diff --git a/kernel/events/core.c b/kernel/events/core.c
+index b15b4f75131d..1d1edcb2d9a2 100644
+--- a/kernel/events/core.c
++++ b/kernel/events/core.c
+@@ -4899,6 +4899,9 @@ struct swevent_htable {
+ 
+ 	/* Recursion avoidance in each contexts */
+ 	int				recursion[PERF_NR_CONTEXTS];
++
++	/* Keeps track of cpu being initialized/exited */
++	bool				online;
+ };
+ 
+ static DEFINE_PER_CPU(struct swevent_htable, swevent_htable);
+@@ -5141,8 +5144,14 @@ static int perf_swevent_add(struct perf_event *event, int flags)
+ 	hwc->state = !(flags & PERF_EF_START);
+ 
+ 	head = find_swevent_head(swhash, event);
+-	if (WARN_ON_ONCE(!head))
++	if (!head) {
++		/*
++		 * We can race with cpu hotplug code. Do not
++		 * WARN if the cpu just got unplugged.
++		 */
++		WARN_ON_ONCE(swhash->online);
+ 		return -EINVAL;
++	}
+ 
+ 	hlist_add_head_rcu(&event->hlist_entry, head);
+ 
+@@ -6301,6 +6310,9 @@ SYSCALL_DEFINE5(perf_event_open,
+ 	if (attr.freq) {
+ 		if (attr.sample_freq > sysctl_perf_event_sample_rate)
+ 			return -EINVAL;
++	} else {
++		if (attr.sample_period & (1ULL << 63))
++			return -EINVAL;
+ 	}
+ 
+ 	/*
+@@ -7078,6 +7090,7 @@ static void __cpuinit perf_event_init_cpu(int cpu)
+ 	struct swevent_htable *swhash = &per_cpu(swevent_htable, cpu);
+ 
+ 	mutex_lock(&swhash->hlist_mutex);
++	swhash->online = true;
+ 	if (swhash->hlist_refcount > 0) {
+ 		struct swevent_hlist *hlist;
+ 
+@@ -7135,6 +7148,7 @@ static void perf_event_exit_cpu(int cpu)
+ 	perf_event_exit_cpu_context(cpu);
+ 
+ 	mutex_lock(&swhash->hlist_mutex);
++	swhash->online = false;
+ 	swevent_hlist_release(swhash);
+ 	mutex_unlock(&swhash->hlist_mutex);
+ }
+diff --git a/kernel/futex.c b/kernel/futex.c
+index 8888815c578b..1bb37d0f3d7a 100644
+--- a/kernel/futex.c
++++ b/kernel/futex.c
+@@ -588,6 +588,55 @@ void exit_pi_state_list(struct task_struct *curr)
+ 	raw_spin_unlock_irq(&curr->pi_lock);
+ }
+ 
++/*
++ * We need to check the following states:
++ *
++ *      Waiter | pi_state | pi->owner | uTID      | uODIED | ?
++ *
++ * [1]  NULL   | ---      | ---       | 0         | 0/1    | Valid
++ * [2]  NULL   | ---      | ---       | >0        | 0/1    | Valid
++ *
++ * [3]  Found  | NULL     | --        | Any       | 0/1    | Invalid
++ *
++ * [4]  Found  | Found    | NULL      | 0         | 1      | Valid
++ * [5]  Found  | Found    | NULL      | >0        | 1      | Invalid
++ *
++ * [6]  Found  | Found    | task      | 0         | 1      | Valid
++ *
++ * [7]  Found  | Found    | NULL      | Any       | 0      | Invalid
++ *
++ * [8]  Found  | Found    | task      | ==taskTID | 0/1    | Valid
++ * [9]  Found  | Found    | task      | 0         | 0      | Invalid
++ * [10] Found  | Found    | task      | !=taskTID | 0/1    | Invalid
++ *
++ * [1]	Indicates that the kernel can acquire the futex atomically. We
++ *	came came here due to a stale FUTEX_WAITERS/FUTEX_OWNER_DIED bit.
++ *
++ * [2]	Valid, if TID does not belong to a kernel thread. If no matching
++ *      thread is found then it indicates that the owner TID has died.
++ *
++ * [3]	Invalid. The waiter is queued on a non PI futex
++ *
++ * [4]	Valid state after exit_robust_list(), which sets the user space
++ *	value to FUTEX_WAITERS | FUTEX_OWNER_DIED.
++ *
++ * [5]	The user space value got manipulated between exit_robust_list()
++ *	and exit_pi_state_list()
++ *
++ * [6]	Valid state after exit_pi_state_list() which sets the new owner in
++ *	the pi_state but cannot access the user space value.
++ *
++ * [7]	pi_state->owner can only be NULL when the OWNER_DIED bit is set.
++ *
++ * [8]	Owner and user space value match
++ *
++ * [9]	There is no transient state which sets the user space TID to 0
++ *	except exit_robust_list(), but this is indicated by the
++ *	FUTEX_OWNER_DIED bit. See [4]
++ *
++ * [10] There is no transient state which leaves owner and user space
++ *	TID out of sync.
++ */
+ static int
+ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
+ 		union futex_key *key, struct futex_pi_state **ps)
+@@ -603,12 +652,13 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
+ 	plist_for_each_entry_safe(this, next, head, list) {
+ 		if (match_futex(&this->key, key)) {
+ 			/*
+-			 * Another waiter already exists - bump up
+-			 * the refcount and return its pi_state:
++			 * Sanity check the waiter before increasing
++			 * the refcount and attaching to it.
+ 			 */
+ 			pi_state = this->pi_state;
+ 			/*
+-			 * Userspace might have messed up non-PI and PI futexes
++			 * Userspace might have messed up non-PI and
++			 * PI futexes [3]
+ 			 */
+ 			if (unlikely(!pi_state))
+ 				return -EINVAL;
+@@ -616,34 +666,70 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
+ 			WARN_ON(!atomic_read(&pi_state->refcount));
+ 
+ 			/*
+-			 * When pi_state->owner is NULL then the owner died
+-			 * and another waiter is on the fly. pi_state->owner
+-			 * is fixed up by the task which acquires
+-			 * pi_state->rt_mutex.
+-			 *
+-			 * We do not check for pid == 0 which can happen when
+-			 * the owner died and robust_list_exit() cleared the
+-			 * TID.
++			 * Handle the owner died case:
+ 			 */
+-			if (pid && pi_state->owner) {
++			if (uval & FUTEX_OWNER_DIED) {
++				/*
++				 * exit_pi_state_list sets owner to NULL and
++				 * wakes the topmost waiter. The task which
++				 * acquires the pi_state->rt_mutex will fixup
++				 * owner.
++				 */
++				if (!pi_state->owner) {
++					/*
++					 * No pi state owner, but the user
++					 * space TID is not 0. Inconsistent
++					 * state. [5]
++					 */
++					if (pid)
++						return -EINVAL;
++					/*
++					 * Take a ref on the state and
++					 * return. [4]
++					 */
++					goto out_state;
++				}
++
+ 				/*
+-				 * Bail out if user space manipulated the
+-				 * futex value.
++				 * If TID is 0, then either the dying owner
++				 * has not yet executed exit_pi_state_list()
++				 * or some waiter acquired the rtmutex in the
++				 * pi state, but did not yet fixup the TID in
++				 * user space.
++				 *
++				 * Take a ref on the state and return. [6]
+ 				 */
+-				if (pid != task_pid_vnr(pi_state->owner))
++				if (!pid)
++					goto out_state;
++			} else {
++				/*
++				 * If the owner died bit is not set,
++				 * then the pi_state must have an
++				 * owner. [7]
++				 */
++				if (!pi_state->owner)
+ 					return -EINVAL;
+ 			}
+ 
++			/*
++			 * Bail out if user space manipulated the
++			 * futex value. If pi state exists then the
++			 * owner TID must be the same as the user
++			 * space TID. [9/10]
++			 */
++			if (pid != task_pid_vnr(pi_state->owner))
++				return -EINVAL;
++
++		out_state:
+ 			atomic_inc(&pi_state->refcount);
+ 			*ps = pi_state;
+-
+ 			return 0;
+ 		}
+ 	}
+ 
+ 	/*
+ 	 * We are the first waiter - try to look up the real owner and attach
+-	 * the new pi_state to it, but bail out when TID = 0
++	 * the new pi_state to it, but bail out when TID = 0 [1]
+ 	 */
+ 	if (!pid)
+ 		return -ESRCH;
+@@ -651,6 +737,11 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
+ 	if (!p)
+ 		return -ESRCH;
+ 
++	if (!p->mm) {
++		put_task_struct(p);
++		return -EPERM;
++	}
++
+ 	/*
+ 	 * We need to look at the task state flags to figure out,
+ 	 * whether the task is exiting. To protect against the do_exit
+@@ -671,6 +762,9 @@ lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
+ 		return ret;
+ 	}
+ 
++	/*
++	 * No existing pi state. First waiter. [2]
++	 */
+ 	pi_state = alloc_pi_state();
+ 
+ 	/*
+@@ -742,10 +836,18 @@ retry:
+ 		return -EDEADLK;
+ 
+ 	/*
+-	 * Surprise - we got the lock. Just return to userspace:
++	 * Surprise - we got the lock, but we do not trust user space at all.
+ 	 */
+-	if (unlikely(!curval))
+-		return 1;
++	if (unlikely(!curval)) {
++		/*
++		 * We verify whether there is kernel state for this
++		 * futex. If not, we can safely assume, that the 0 ->
++		 * TID transition is correct. If state exists, we do
++		 * not bother to fixup the user space state as it was
++		 * corrupted already.
++		 */
++		return futex_top_waiter(hb, key) ? -EINVAL : 1;
++	}
+ 
+ 	uval = curval;
+ 
+@@ -875,6 +977,7 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this)
+ 	struct task_struct *new_owner;
+ 	struct futex_pi_state *pi_state = this->pi_state;
+ 	u32 uninitialized_var(curval), newval;
++	int ret = 0;
+ 
+ 	if (!pi_state)
+ 		return -EINVAL;
+@@ -898,23 +1001,19 @@ static int wake_futex_pi(u32 __user *uaddr, u32 uval, struct futex_q *this)
+ 		new_owner = this->task;
+ 
+ 	/*
+-	 * We pass it to the next owner. (The WAITERS bit is always
+-	 * kept enabled while there is PI state around. We must also
+-	 * preserve the owner died bit.)
++	 * We pass it to the next owner. The WAITERS bit is always
++	 * kept enabled while there is PI state around. We cleanup the
++	 * owner died bit, because we are the owner.
+ 	 */
+-	if (!(uval & FUTEX_OWNER_DIED)) {
+-		int ret = 0;
++	newval = FUTEX_WAITERS | task_pid_vnr(new_owner);
+ 
+-		newval = FUTEX_WAITERS | task_pid_vnr(new_owner);
+-
+-		if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval))
+-			ret = -EFAULT;
+-		else if (curval != uval)
+-			ret = -EINVAL;
+-		if (ret) {
+-			raw_spin_unlock(&pi_state->pi_mutex.wait_lock);
+-			return ret;
+-		}
++	if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval))
++		ret = -EFAULT;
++	else if (curval != uval)
++		ret = -EINVAL;
++	if (ret) {
++		raw_spin_unlock(&pi_state->pi_mutex.wait_lock);
++		return ret;
+ 	}
+ 
+ 	raw_spin_lock_irq(&pi_state->owner->pi_lock);
+@@ -1193,7 +1292,7 @@ void requeue_pi_wake_futex(struct futex_q *q, union futex_key *key,
+  *
+  * Returns:
+  *  0 - failed to acquire the lock atomicly
+- *  1 - acquired the lock
++ * >0 - acquired the lock, return value is vpid of the top_waiter
+  * <0 - error
+  */
+ static int futex_proxy_trylock_atomic(u32 __user *pifutex,
+@@ -1204,7 +1303,7 @@ static int futex_proxy_trylock_atomic(u32 __user *pifutex,
+ {
+ 	struct futex_q *top_waiter = NULL;
+ 	u32 curval;
+-	int ret;
++	int ret, vpid;
+ 
+ 	if (get_futex_value_locked(&curval, pifutex))
+ 		return -EFAULT;
+@@ -1232,11 +1331,13 @@ static int futex_proxy_trylock_atomic(u32 __user *pifutex,
+ 	 * the contended case or if set_waiters is 1.  The pi_state is returned
+ 	 * in ps in contended cases.
+ 	 */
++	vpid = task_pid_vnr(top_waiter->task);
+ 	ret = futex_lock_pi_atomic(pifutex, hb2, key2, ps, top_waiter->task,
+ 				   set_waiters);
+-	if (ret == 1)
++	if (ret == 1) {
+ 		requeue_pi_wake_futex(top_waiter, key2, hb2);
+-
++		return vpid;
++	}
+ 	return ret;
+ }
+ 
+@@ -1268,10 +1369,16 @@ static int futex_requeue(u32 __user *uaddr1, unsigned int flags,
+ 	struct futex_hash_bucket *hb1, *hb2;
+ 	struct plist_head *head1;
+ 	struct futex_q *this, *next;
+-	u32 curval2;
+ 
+ 	if (requeue_pi) {
+ 		/*
++		 * Requeue PI only works on two distinct uaddrs. This
++		 * check is only valid for private futexes. See below.
++		 */
++		if (uaddr1 == uaddr2)
++			return -EINVAL;
++
++		/*
+ 		 * requeue_pi requires a pi_state, try to allocate it now
+ 		 * without any locks in case it fails.
+ 		 */
+@@ -1309,6 +1416,15 @@ retry:
+ 	if (unlikely(ret != 0))
+ 		goto out_put_key1;
+ 
++	/*
++	 * The check above which compares uaddrs is not sufficient for
++	 * shared futexes. We need to compare the keys:
++	 */
++	if (requeue_pi && match_futex(&key1, &key2)) {
++		ret = -EINVAL;
++		goto out_put_keys;
++	}
++
+ 	hb1 = hash_futex(&key1);
+ 	hb2 = hash_futex(&key2);
+ 
+@@ -1354,16 +1470,25 @@ retry_private:
+ 		 * At this point the top_waiter has either taken uaddr2 or is
+ 		 * waiting on it.  If the former, then the pi_state will not
+ 		 * exist yet, look it up one more time to ensure we have a
+-		 * reference to it.
++		 * reference to it. If the lock was taken, ret contains the
++		 * vpid of the top waiter task.
+ 		 */
+-		if (ret == 1) {
++		if (ret > 0) {
+ 			WARN_ON(pi_state);
+ 			drop_count++;
+ 			task_count++;
+-			ret = get_futex_value_locked(&curval2, uaddr2);
+-			if (!ret)
+-				ret = lookup_pi_state(curval2, hb2, &key2,
+-						      &pi_state);
++			/*
++			 * If we acquired the lock, then the user
++			 * space value of uaddr2 should be vpid. It
++			 * cannot be changed by the top waiter as it
++			 * is blocked on hb2 lock if it tries to do
++			 * so. If something fiddled with it behind our
++			 * back the pi state lookup might unearth
++			 * it. So we rather use the known value than
++			 * rereading and handing potential crap to
++			 * lookup_pi_state.
++			 */
++			ret = lookup_pi_state(ret, hb2, &key2, &pi_state);
+ 		}
+ 
+ 		switch (ret) {
+@@ -2133,9 +2258,10 @@ retry:
+ 	/*
+ 	 * To avoid races, try to do the TID -> 0 atomic transition
+ 	 * again. If it succeeds then we can return without waking
+-	 * anyone else up:
++	 * anyone else up. We only try this if neither the waiters nor
++	 * the owner died bit are set.
+ 	 */
+-	if (!(uval & FUTEX_OWNER_DIED) &&
++	if (!(uval & ~FUTEX_TID_MASK) &&
+ 	    cmpxchg_futex_value_locked(&uval, uaddr, vpid, 0))
+ 		goto pi_faulted;
+ 	/*
+@@ -2167,11 +2293,9 @@ retry:
+ 	/*
+ 	 * No waiters - kernel unlocks the futex:
+ 	 */
+-	if (!(uval & FUTEX_OWNER_DIED)) {
+-		ret = unlock_futex_pi(uaddr, uval);
+-		if (ret == -EFAULT)
+-			goto pi_faulted;
+-	}
++	ret = unlock_futex_pi(uaddr, uval);
++	if (ret == -EFAULT)
++		goto pi_faulted;
+ 
+ out_unlock:
+ 	spin_unlock(&hb->lock);
+@@ -2331,6 +2455,15 @@ static int futex_wait_requeue_pi(u32 __user *uaddr, unsigned int flags,
+ 	if (ret)
+ 		goto out_key2;
+ 
++	/*
++	 * The check above which compares uaddrs is not sufficient for
++	 * shared futexes. We need to compare the keys:
++	 */
++	if (match_futex(&q.key, &key2)) {
++		ret = -EINVAL;
++		goto out_put_keys;
++	}
++
+ 	/* Queue the futex_q, drop the hb lock, wait for wakeup. */
+ 	futex_wait_queue_me(hb, &q, to);
+ 
+diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
+index 60f7e326b6c8..20e88afba69b 100644
+--- a/kernel/hrtimer.c
++++ b/kernel/hrtimer.c
+@@ -232,6 +232,11 @@ again:
+ 			goto again;
+ 		}
+ 		timer->base = new_base;
++	} else {
++		if (cpu != this_cpu && hrtimer_check_target(timer, new_base)) {
++			cpu = this_cpu;
++			goto again;
++		}
+ 	}
+ 	return new_base;
+ }
+@@ -567,6 +572,23 @@ hrtimer_force_reprogram(struct hrtimer_cpu_base *cpu_base, int skip_equal)
+ 
+ 	cpu_base->expires_next.tv64 = expires_next.tv64;
+ 
++	/*
++	 * If a hang was detected in the last timer interrupt then we
++	 * leave the hang delay active in the hardware. We want the
++	 * system to make progress. That also prevents the following
++	 * scenario:
++	 * T1 expires 50ms from now
++	 * T2 expires 5s from now
++	 *
++	 * T1 is removed, so this code is called and would reprogram
++	 * the hardware to 5s from now. Any hrtimer_start after that
++	 * will not reprogram the hardware due to hang_detected being
++	 * set. So we'd effectivly block all timers until the T2 event
++	 * fires.
++	 */
++	if (cpu_base->hang_detected)
++		return;
++
+ 	if (cpu_base->expires_next.tv64 != KTIME_MAX)
+ 		tick_program_event(cpu_base->expires_next, 1);
+ }
+@@ -958,11 +980,8 @@ int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim,
+ 	/* Remove an active timer from the queue: */
+ 	ret = remove_hrtimer(timer, base);
+ 
+-	/* Switch the timer base, if necessary: */
+-	new_base = switch_hrtimer_base(timer, base, mode & HRTIMER_MODE_PINNED);
+-
+ 	if (mode & HRTIMER_MODE_REL) {
+-		tim = ktime_add_safe(tim, new_base->get_time());
++		tim = ktime_add_safe(tim, base->get_time());
+ 		/*
+ 		 * CONFIG_TIME_LOW_RES is a temporary way for architectures
+ 		 * to signal that they simply return xtime in
+@@ -977,6 +996,9 @@ int __hrtimer_start_range_ns(struct hrtimer *timer, ktime_t tim,
+ 
+ 	hrtimer_set_expires_range_ns(timer, tim, delta_ns);
+ 
++	/* Switch the timer base, if necessary: */
++	new_base = switch_hrtimer_base(timer, base, mode & HRTIMER_MODE_PINNED);
++
+ 	timer_stats_hrtimer_set_start_info(timer);
+ 
+ 	leftmost = enqueue_hrtimer(timer, new_base);
+diff --git a/kernel/module.c b/kernel/module.c
+index 65362d9ab783..95ecd9ffc91f 100644
+--- a/kernel/module.c
++++ b/kernel/module.c
+@@ -2888,6 +2888,9 @@ static struct module *load_module(void __user *umod,
+ 	/* This has to be done once we're sure module name is unique. */
+ 	dynamic_debug_setup(info.debug, info.num_debug);
+ 
++	/* Ftrace init must be called in the MODULE_STATE_UNFORMED state */
++	ftrace_module_init(mod);
++
+ 	/* Find duplicate symbols */
+ 	err = verify_export_symbols(mod);
+ 	if (err < 0)
+diff --git a/kernel/sched_cpupri.c b/kernel/sched_cpupri.c
+index a86cf9d9eb11..1f4afddf158a 100644
+--- a/kernel/sched_cpupri.c
++++ b/kernel/sched_cpupri.c
+@@ -68,8 +68,7 @@ int cpupri_find(struct cpupri *cp, struct task_struct *p,
+ 	int                  idx      = 0;
+ 	int                  task_pri = convert_prio(p->prio);
+ 
+-	if (task_pri >= MAX_RT_PRIO)
+-		return 0;
++	BUG_ON(task_pri >= CPUPRI_NR_PRIORITIES);
+ 
+ 	for (idx = 0; idx < task_pri; idx++) {
+ 		struct cpupri_vec *vec  = &cp->pri_to_cpu[idx];
+diff --git a/kernel/timer.c b/kernel/timer.c
+index f8b05a467883..349953ee9027 100644
+--- a/kernel/timer.c
++++ b/kernel/timer.c
+@@ -769,7 +769,7 @@ unsigned long apply_slack(struct timer_list *timer, unsigned long expires)
+ 
+ 	bit = find_last_bit(&mask, BITS_PER_LONG);
+ 
+-	mask = (1 << bit) - 1;
++	mask = (1UL << bit) - 1;
+ 
+ 	expires_limit = expires_limit & ~(mask);
+ 
+diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
+index a65fa363c024..dcbafedc38ae 100644
+--- a/kernel/trace/ftrace.c
++++ b/kernel/trace/ftrace.c
+@@ -3542,16 +3542,11 @@ static void ftrace_init_module(struct module *mod,
+ 	ftrace_process_locs(mod, start, end);
+ }
+ 
+-static int ftrace_module_notify_enter(struct notifier_block *self,
+-				      unsigned long val, void *data)
++void ftrace_module_init(struct module *mod)
+ {
+-	struct module *mod = data;
+-
+-	if (val == MODULE_STATE_COMING)
+-		ftrace_init_module(mod, mod->ftrace_callsites,
+-				   mod->ftrace_callsites +
+-				   mod->num_ftrace_callsites);
+-	return 0;
++	ftrace_init_module(mod, mod->ftrace_callsites,
++			   mod->ftrace_callsites +
++			   mod->num_ftrace_callsites);
+ }
+ 
+ static int ftrace_module_notify_exit(struct notifier_block *self,
+@@ -3565,11 +3560,6 @@ static int ftrace_module_notify_exit(struct notifier_block *self,
+ 	return 0;
+ }
+ #else
+-static int ftrace_module_notify_enter(struct notifier_block *self,
+-				      unsigned long val, void *data)
+-{
+-	return 0;
+-}
+ static int ftrace_module_notify_exit(struct notifier_block *self,
+ 				     unsigned long val, void *data)
+ {
+@@ -3577,11 +3567,6 @@ static int ftrace_module_notify_exit(struct notifier_block *self,
+ }
+ #endif /* CONFIG_MODULES */
+ 
+-struct notifier_block ftrace_module_enter_nb = {
+-	.notifier_call = ftrace_module_notify_enter,
+-	.priority = INT_MAX,	/* Run before anything that can use kprobes */
+-};
+-
+ struct notifier_block ftrace_module_exit_nb = {
+ 	.notifier_call = ftrace_module_notify_exit,
+ 	.priority = INT_MIN,	/* Run after anything that can remove kprobes */
+@@ -3618,10 +3603,6 @@ void __init ftrace_init(void)
+ 				  __start_mcount_loc,
+ 				  __stop_mcount_loc);
+ 
+-	ret = register_module_notifier(&ftrace_module_enter_nb);
+-	if (ret)
+-		pr_warning("Failed to register trace ftrace module enter notifier\n");
+-
+ 	ret = register_module_notifier(&ftrace_module_exit_nb);
+ 	if (ret)
+ 		pr_warning("Failed to register trace ftrace module exit notifier\n");
+diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
+index 41b25a0ed616..088fbc525ef4 100644
+--- a/kernel/tracepoint.c
++++ b/kernel/tracepoint.c
+@@ -638,6 +638,9 @@ static int tracepoint_module_coming(struct module *mod)
+ 	struct tp_module *tp_mod, *iter;
+ 	int ret = 0;
+ 
++	if (!mod->num_tracepoints)
++		return 0;
++
+ 	/*
+ 	 * We skip modules that taint the kernel, especially those with different
+ 	 * module headers (for forced load), to make sure we don't cause a crash.
+@@ -681,6 +684,9 @@ static int tracepoint_module_going(struct module *mod)
+ {
+ 	struct tp_module *pos;
+ 
++	if (!mod->num_tracepoints)
++		return 0;
++
+ 	mutex_lock(&tracepoints_mutex);
+ 	tracepoint_update_probe_range(mod->tracepoints_ptrs,
+ 		mod->tracepoints_ptrs + mod->num_tracepoints);
+diff --git a/mm/memory-failure.c b/mm/memory-failure.c
+index 96c4bcf188b1..51901b184872 100644
+--- a/mm/memory-failure.c
++++ b/mm/memory-failure.c
+@@ -1033,15 +1033,16 @@ int __memory_failure(unsigned long pfn, int trapno, int flags)
+ 			return 0;
+ 		} else if (PageHuge(hpage)) {
+ 			/*
+-			 * Check "just unpoisoned", "filter hit", and
+-			 * "race with other subpage."
++			 * Check "filter hit" and "race with other subpage."
+ 			 */
+ 			lock_page(hpage);
+-			if (!PageHWPoison(hpage)
+-			    || (hwpoison_filter(p) && TestClearPageHWPoison(p))
+-			    || (p != hpage && TestSetPageHWPoison(hpage))) {
+-				atomic_long_sub(nr_pages, &mce_bad_pages);
+-				return 0;
++			if (PageHWPoison(hpage)) {
++				if ((hwpoison_filter(p) && TestClearPageHWPoison(p))
++				    || (p != hpage && TestSetPageHWPoison(hpage))) {
++					atomic_long_sub(nr_pages, &mce_bad_pages);
++					unlock_page(hpage);
++					return 0;
++				}
+ 			}
+ 			set_page_hwpoison_huge_page(hpage);
+ 			res = dequeue_hwpoisoned_huge_page(hpage);
+@@ -1093,6 +1094,8 @@ int __memory_failure(unsigned long pfn, int trapno, int flags)
+ 	 */
+ 	if (!PageHWPoison(p)) {
+ 		printk(KERN_ERR "MCE %#lx: just unpoisoned\n", pfn);
++		atomic_long_sub(nr_pages, &mce_bad_pages);
++		put_page(hpage);
+ 		res = 0;
+ 		goto out;
+ 	}
+diff --git a/mm/page-writeback.c b/mm/page-writeback.c
+index b5cd796fcd6c..d2ac057008f2 100644
+--- a/mm/page-writeback.c
++++ b/mm/page-writeback.c
+@@ -559,7 +559,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi,
+ 	 *     => fast response on large errors; small oscillation near setpoint
+ 	 */
+ 	setpoint = (freerun + limit) / 2;
+-	x = div_s64((setpoint - dirty) << RATELIMIT_CALC_SHIFT,
++	x = div64_s64(((s64)setpoint - (s64)dirty) << RATELIMIT_CALC_SHIFT,
+ 		    limit - setpoint + 1);
+ 	pos_ratio = x;
+ 	pos_ratio = pos_ratio * x >> RATELIMIT_CALC_SHIFT;
+@@ -625,7 +625,7 @@ static unsigned long bdi_position_ratio(struct backing_dev_info *bdi,
+ 	x_intercept = bdi_setpoint + span;
+ 
+ 	if (bdi_dirty < x_intercept - span / 4) {
+-		pos_ratio = div_u64(pos_ratio * (x_intercept - bdi_dirty),
++		pos_ratio = div64_u64(pos_ratio * (x_intercept - bdi_dirty),
+ 				    x_intercept - bdi_setpoint + 1);
+ 	} else
+ 		pos_ratio /= 4;
+diff --git a/net/bluetooth/hci_conn.c b/net/bluetooth/hci_conn.c
+index aa1264910c4e..4d99d42f30ff 100644
+--- a/net/bluetooth/hci_conn.c
++++ b/net/bluetooth/hci_conn.c
+@@ -610,14 +610,17 @@ static int hci_conn_auth(struct hci_conn *conn, __u8 sec_level, __u8 auth_type)
+ 	if (!test_and_set_bit(HCI_CONN_AUTH_PEND, &conn->pend)) {
+ 		struct hci_cp_auth_requested cp;
+ 
+-		/* encrypt must be pending if auth is also pending */
+-		set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
+-
+ 		cp.handle = cpu_to_le16(conn->handle);
+ 		hci_send_cmd(conn->hdev, HCI_OP_AUTH_REQUESTED,
+ 							sizeof(cp), &cp);
++
++		/* If we're already encrypted set the REAUTH_PEND flag,
++		 * otherwise set the ENCRYPT_PEND.
++		 */
+ 		if (conn->key_type != 0xff)
+ 			set_bit(HCI_CONN_REAUTH_PEND, &conn->pend);
++		else
++			set_bit(HCI_CONN_ENCRYPT_PEND, &conn->pend);
+ 	}
+ 
+ 	return 0;
+diff --git a/net/bridge/br_netlink.c b/net/bridge/br_netlink.c
+index cbf9ccd45784..99a48a39c009 100644
+--- a/net/bridge/br_netlink.c
++++ b/net/bridge/br_netlink.c
+@@ -211,11 +211,26 @@ static int br_validate(struct nlattr *tb[], struct nlattr *data[])
+ 	return 0;
+ }
+ 
++static int br_dev_newlink(struct net *src_net, struct net_device *dev,
++			  struct nlattr *tb[], struct nlattr *data[])
++{
++	struct net_bridge *br = netdev_priv(dev);
++
++	if (tb[IFLA_ADDRESS]) {
++		spin_lock_bh(&br->lock);
++		br_stp_change_bridge_id(br, nla_data(tb[IFLA_ADDRESS]));
++		spin_unlock_bh(&br->lock);
++	}
++
++	return register_netdevice(dev);
++}
++
+ struct rtnl_link_ops br_link_ops __read_mostly = {
+ 	.kind		= "bridge",
+ 	.priv_size	= sizeof(struct net_bridge),
+ 	.setup		= br_dev_setup,
+ 	.validate	= br_validate,
++	.newlink	= br_dev_newlink,
+ 	.dellink	= br_dev_delete,
+ };
+ 
+diff --git a/net/bridge/netfilter/ebtables.c b/net/bridge/netfilter/ebtables.c
+index 5864cc491369..45f93f8a10c8 100644
+--- a/net/bridge/netfilter/ebtables.c
++++ b/net/bridge/netfilter/ebtables.c
+@@ -1044,10 +1044,9 @@ static int do_replace_finish(struct net *net, struct ebt_replace *repl,
+ 	if (repl->num_counters &&
+ 	   copy_to_user(repl->counters, counterstmp,
+ 	   repl->num_counters * sizeof(struct ebt_counter))) {
+-		ret = -EFAULT;
++		/* Silent error, can't fail, new table is already in place */
++		net_warn_ratelimited("ebtables: counters copy to user failed while replacing table\n");
+ 	}
+-	else
+-		ret = 0;
+ 
+ 	/* decrease module count and free resources */
+ 	EBT_ENTRY_ITERATE(table->entries, table->entries_size,
+diff --git a/net/ceph/messenger.c b/net/ceph/messenger.c
+index ad5b70801f37..20ba2d59dc23 100644
+--- a/net/ceph/messenger.c
++++ b/net/ceph/messenger.c
+@@ -284,6 +284,37 @@ static int ceph_tcp_sendmsg(struct socket *sock, struct kvec *iov,
+ 	return r;
+ }
+ 
++static int __ceph_tcp_sendpage(struct socket *sock, struct page *page,
++		     int offset, size_t size, bool more)
++{
++	int flags = MSG_DONTWAIT | MSG_NOSIGNAL | (more ? MSG_MORE : MSG_EOR);
++	int ret;
++
++	ret = kernel_sendpage(sock, page, offset, size, flags);
++	if (ret == -EAGAIN)
++		ret = 0;
++
++	return ret;
++}
++
++static int ceph_tcp_sendpage(struct socket *sock, struct page *page,
++		     int offset, size_t size, bool more)
++{
++	int ret;
++	struct kvec iov;
++
++	/* sendpage cannot properly handle pages with page_count == 0,
++	 * we need to fallback to sendmsg if that's the case */
++	if (page_count(page) >= 1)
++		return __ceph_tcp_sendpage(sock, page, offset, size, more);
++
++	iov.iov_base = kmap(page) + offset;
++	iov.iov_len = size;
++	ret = ceph_tcp_sendmsg(sock, &iov, 1, size, more);
++	kunmap(page);
++
++	return ret;
++}
+ 
+ /*
+  * Shutdown/close the socket for the given connection.
+@@ -851,18 +882,14 @@ static int write_partial_msg_pages(struct ceph_connection *con)
+ 				cpu_to_le32(crc32c(tmpcrc, base, len));
+ 			con->out_msg_pos.did_page_crc = 1;
+ 		}
+-		ret = kernel_sendpage(con->sock, page,
++		ret = ceph_tcp_sendpage(con->sock, page,
+ 				      con->out_msg_pos.page_pos + page_shift,
+-				      len,
+-				      MSG_DONTWAIT | MSG_NOSIGNAL |
+-				      MSG_MORE);
++				      len, 1);
+ 
+ 		if (crc &&
+ 		    (msg->pages || msg->pagelist || msg->bio || in_trail))
+ 			kunmap(page);
+ 
+-		if (ret == -EAGAIN)
+-			ret = 0;
+ 		if (ret <= 0)
+ 			goto out;
+ 
+diff --git a/net/core/dev.c b/net/core/dev.c
+index 7bcf37df0ce9..854da1571997 100644
+--- a/net/core/dev.c
++++ b/net/core/dev.c
+@@ -3648,6 +3648,7 @@ static void napi_reuse_skb(struct napi_struct *napi, struct sk_buff *skb)
+ 	skb->vlan_tci = 0;
+ 	skb->dev = napi->dev;
+ 	skb->skb_iif = 0;
++	skb->truesize = SKB_TRUESIZE(skb_end_offset(skb));
+ 
+ 	napi->skb = skb;
+ }
+diff --git a/net/core/filter.c b/net/core/filter.c
+index 5dea45279215..9c88080e4049 100644
+--- a/net/core/filter.c
++++ b/net/core/filter.c
+@@ -320,6 +320,8 @@ load_b:
+ 
+ 			if (skb_is_nonlinear(skb))
+ 				return 0;
++			if (skb->len < sizeof(struct nlattr))
++				return 0;
+ 			if (A > skb->len - sizeof(struct nlattr))
+ 				return 0;
+ 
+@@ -336,11 +338,13 @@ load_b:
+ 
+ 			if (skb_is_nonlinear(skb))
+ 				return 0;
++			if (skb->len < sizeof(struct nlattr))
++				return 0;
+ 			if (A > skb->len - sizeof(struct nlattr))
+ 				return 0;
+ 
+ 			nla = (struct nlattr *)&skb->data[A];
+-			if (nla->nla_len > A - skb->len)
++			if (nla->nla_len > skb->len - A)
+ 				return 0;
+ 
+ 			nla = nla_find_nested(nla, X);
+diff --git a/net/core/rtnetlink.c b/net/core/rtnetlink.c
+index 5b7d5f25d43e..7beaf10cc837 100644
+--- a/net/core/rtnetlink.c
++++ b/net/core/rtnetlink.c
+@@ -744,7 +744,8 @@ static inline int rtnl_vfinfo_size(const struct net_device *dev,
+ 		return 0;
+ }
+ 
+-static size_t rtnl_port_size(const struct net_device *dev)
++static size_t rtnl_port_size(const struct net_device *dev,
++			     u32 ext_filter_mask)
+ {
+ 	size_t port_size = nla_total_size(4)		/* PORT_VF */
+ 		+ nla_total_size(PORT_PROFILE_MAX)	/* PORT_PROFILE */
+@@ -760,7 +761,8 @@ static size_t rtnl_port_size(const struct net_device *dev)
+ 	size_t port_self_size = nla_total_size(sizeof(struct nlattr))
+ 		+ port_size;
+ 
+-	if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent)
++	if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent ||
++	    !(ext_filter_mask & RTEXT_FILTER_VF))
+ 		return 0;
+ 	if (dev_num_vf(dev->dev.parent))
+ 		return port_self_size + vf_ports_size +
+@@ -791,7 +793,7 @@ static noinline size_t if_nlmsg_size(const struct net_device *dev,
+ 	       + nla_total_size(ext_filter_mask
+ 			        & RTEXT_FILTER_VF ? 4 : 0) /* IFLA_NUM_VF */
+ 	       + rtnl_vfinfo_size(dev, ext_filter_mask) /* IFLA_VFINFO_LIST */
+-	       + rtnl_port_size(dev) /* IFLA_VF_PORTS + IFLA_PORT_SELF */
++	       + rtnl_port_size(dev, ext_filter_mask) /* IFLA_VF_PORTS + IFLA_PORT_SELF */
+ 	       + rtnl_link_get_size(dev) /* IFLA_LINKINFO */
+ 	       + rtnl_link_get_af_size(dev); /* IFLA_AF_SPEC */
+ }
+@@ -851,11 +853,13 @@ static int rtnl_port_self_fill(struct sk_buff *skb, struct net_device *dev)
+ 	return 0;
+ }
+ 
+-static int rtnl_port_fill(struct sk_buff *skb, struct net_device *dev)
++static int rtnl_port_fill(struct sk_buff *skb, struct net_device *dev,
++			  u32 ext_filter_mask)
+ {
+ 	int err;
+ 
+-	if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent)
++	if (!dev->netdev_ops->ndo_get_vf_port || !dev->dev.parent ||
++	    !(ext_filter_mask & RTEXT_FILTER_VF))
+ 		return 0;
+ 
+ 	err = rtnl_port_self_fill(skb, dev);
+@@ -1002,7 +1006,7 @@ static int rtnl_fill_ifinfo(struct sk_buff *skb, struct net_device *dev,
+ 		nla_nest_end(skb, vfinfo);
+ 	}
+ 
+-	if (rtnl_port_fill(skb, dev))
++	if (rtnl_port_fill(skb, dev, ext_filter_mask))
+ 		goto nla_put_failure;
+ 
+ 	if (dev->rtnl_link_ops) {
+@@ -1057,6 +1061,7 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
+ 	struct hlist_node *node;
+ 	struct nlattr *tb[IFLA_MAX+1];
+ 	u32 ext_filter_mask = 0;
++	int err;
+ 
+ 	s_h = cb->args[0];
+ 	s_idx = cb->args[1];
+@@ -1077,11 +1082,17 @@ static int rtnl_dump_ifinfo(struct sk_buff *skb, struct netlink_callback *cb)
+ 		hlist_for_each_entry_rcu(dev, node, head, index_hlist) {
+ 			if (idx < s_idx)
+ 				goto cont;
+-			if (rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
+-					     NETLINK_CB(cb->skb).pid,
+-					     cb->nlh->nlmsg_seq, 0,
+-					     NLM_F_MULTI,
+-					     ext_filter_mask) <= 0)
++			err = rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
++					       NETLINK_CB(cb->skb).pid,
++					       cb->nlh->nlmsg_seq, 0,
++					       NLM_F_MULTI,
++					       ext_filter_mask);
++			/* If we ran out of room on the first message,
++			 * we're in trouble
++			 */
++			WARN_ON((err == -EMSGSIZE) && (skb->len == 0));
++
++			if (err <= 0)
+ 				goto out;
+ 
+ 			nl_dump_check_consistent(cb, nlmsg_hdr(skb));
+diff --git a/net/core/skbuff.c b/net/core/skbuff.c
+index 8ac4a0f3e869..9204d9b747f2 100644
+--- a/net/core/skbuff.c
++++ b/net/core/skbuff.c
+@@ -743,7 +743,7 @@ static void copy_skb_header(struct sk_buff *new, const struct sk_buff *old)
+ struct sk_buff *skb_copy(const struct sk_buff *skb, gfp_t gfp_mask)
+ {
+ 	int headerlen = skb_headroom(skb);
+-	unsigned int size = (skb_end_pointer(skb) - skb->head) + skb->data_len;
++	unsigned int size = skb_end_offset(skb) + skb->data_len;
+ 	struct sk_buff *n = alloc_skb(size, gfp_mask);
+ 
+ 	if (!n)
+@@ -843,7 +843,7 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
+ {
+ 	int i;
+ 	u8 *data;
+-	int size = nhead + (skb_end_pointer(skb) - skb->head) + ntail;
++	int size = nhead + skb_end_offset(skb) + ntail;
+ 	long off;
+ 	bool fastpath;
+ 
+@@ -2642,14 +2642,13 @@ struct sk_buff *skb_segment(struct sk_buff *skb, u32 features)
+ 			if (unlikely(!nskb))
+ 				goto err;
+ 
+-			hsize = skb_end_pointer(nskb) - nskb->head;
++			hsize = skb_end_offset(nskb);
+ 			if (skb_cow_head(nskb, doffset + headroom)) {
+ 				kfree_skb(nskb);
+ 				goto err;
+ 			}
+ 
+-			nskb->truesize += skb_end_pointer(nskb) - nskb->head -
+-					  hsize;
++			nskb->truesize += skb_end_offset(nskb) - hsize;
+ 			skb_release_head_state(nskb);
+ 			__skb_push(nskb, doffset);
+ 		} else {
+@@ -3197,12 +3196,14 @@ EXPORT_SYMBOL(__skb_warn_lro_forwarding);
+ unsigned int skb_gso_transport_seglen(const struct sk_buff *skb)
+ {
+ 	const struct skb_shared_info *shinfo = skb_shinfo(skb);
+-	unsigned int hdr_len;
+ 
+ 	if (likely(shinfo->gso_type & (SKB_GSO_TCPV4 | SKB_GSO_TCPV6)))
+-		hdr_len = tcp_hdrlen(skb);
+-	else
+-		hdr_len = sizeof(struct udphdr);
+-	return hdr_len + shinfo->gso_size;
++		return tcp_hdrlen(skb) + shinfo->gso_size;
++
++	/* UFO sets gso_size to the size of the fragmentation
++	 * payload, i.e. the size of the L4 (UDP) header is already
++	 * accounted for.
++	 */
++	return shinfo->gso_size;
+ }
+ EXPORT_SYMBOL_GPL(skb_gso_transport_seglen);
+diff --git a/net/ipv4/fib_semantics.c b/net/ipv4/fib_semantics.c
+index d01f9c658dec..76da979baed0 100644
+--- a/net/ipv4/fib_semantics.c
++++ b/net/ipv4/fib_semantics.c
+@@ -752,13 +752,13 @@ struct fib_info *fib_create_info(struct fib_config *cfg)
+ 	fi = kzalloc(sizeof(*fi)+nhs*sizeof(struct fib_nh), GFP_KERNEL);
+ 	if (fi == NULL)
+ 		goto failure;
++	fib_info_cnt++;
+ 	if (cfg->fc_mx) {
+ 		fi->fib_metrics = kzalloc(sizeof(u32) * RTAX_MAX, GFP_KERNEL);
+ 		if (!fi->fib_metrics)
+ 			goto failure;
+ 	} else
+ 		fi->fib_metrics = (u32 *) dst_default_metrics;
+-	fib_info_cnt++;
+ 
+ 	fi->fib_net = hold_net(net);
+ 	fi->fib_protocol = cfg->fc_protocol;
+diff --git a/net/ipv4/ip_forward.c b/net/ipv4/ip_forward.c
+index e0d9f02fec11..7593f3a46035 100644
+--- a/net/ipv4/ip_forward.c
++++ b/net/ipv4/ip_forward.c
+@@ -42,12 +42,12 @@
+ static bool ip_may_fragment(const struct sk_buff *skb)
+ {
+ 	return unlikely((ip_hdr(skb)->frag_off & htons(IP_DF)) == 0) ||
+-	       !skb->local_df;
++		skb->local_df;
+ }
+ 
+ static bool ip_exceeds_mtu(const struct sk_buff *skb, unsigned int mtu)
+ {
+-	if (skb->len <= mtu || skb->local_df)
++	if (skb->len <= mtu)
+ 		return false;
+ 
+ 	if (skb_is_gso(skb) && skb_gso_network_seglen(skb) <= mtu)
+diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
+index fd7a3f68917f..bcb6e6197595 100644
+--- a/net/ipv4/netfilter/arp_tables.c
++++ b/net/ipv4/netfilter/arp_tables.c
+@@ -1039,8 +1039,10 @@ static int __do_replace(struct net *net, const char *name,
+ 
+ 	xt_free_table_info(oldinfo);
+ 	if (copy_to_user(counters_ptr, counters,
+-			 sizeof(struct xt_counters) * num_counters) != 0)
+-		ret = -EFAULT;
++			 sizeof(struct xt_counters) * num_counters) != 0) {
++		/* Silent error, can't fail, new table is already in place */
++		net_warn_ratelimited("arptables: counters copy to user failed while replacing table\n");
++	}
+ 	vfree(counters);
+ 	xt_table_unlock(t);
+ 	return ret;
+diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
+index 24e556e83a3b..f98a1cf54c5b 100644
+--- a/net/ipv4/netfilter/ip_tables.c
++++ b/net/ipv4/netfilter/ip_tables.c
+@@ -1227,8 +1227,10 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
+ 
+ 	xt_free_table_info(oldinfo);
+ 	if (copy_to_user(counters_ptr, counters,
+-			 sizeof(struct xt_counters) * num_counters) != 0)
+-		ret = -EFAULT;
++			 sizeof(struct xt_counters) * num_counters) != 0) {
++		/* Silent error, can't fail, new table is already in place */
++		net_warn_ratelimited("iptables: counters copy to user failed while replacing table\n");
++	}
+ 	vfree(counters);
+ 	xt_table_unlock(t);
+ 	return ret;
+diff --git a/net/ipv4/ping.c b/net/ipv4/ping.c
+index 00975b6db7e9..d495d4bcd745 100644
+--- a/net/ipv4/ping.c
++++ b/net/ipv4/ping.c
+@@ -203,26 +203,33 @@ static int ping_init_sock(struct sock *sk)
+ 	struct net *net = sock_net(sk);
+ 	gid_t group = current_egid();
+ 	gid_t range[2];
+-	struct group_info *group_info = get_current_groups();
+-	int i, j, count = group_info->ngroups;
++	struct group_info *group_info;
++	int i, j, count;
++	int ret = 0;
+ 
+ 	inet_get_ping_group_range_net(net, range, range+1);
+ 	if (range[0] <= group && group <= range[1])
+ 		return 0;
+ 
++	group_info = get_current_groups();
++	count = group_info->ngroups;
+ 	for (i = 0; i < group_info->nblocks; i++) {
+ 		int cp_count = min_t(int, NGROUPS_PER_BLOCK, count);
+ 
+ 		for (j = 0; j < cp_count; j++) {
+ 			group = group_info->blocks[i][j];
+ 			if (range[0] <= group && group <= range[1])
+-				return 0;
++				goto out_release_group;
+ 		}
+ 
+ 		count -= cp_count;
+ 	}
+ 
+-	return -EACCES;
++	ret = -EACCES;
++
++out_release_group:
++	put_group_info(group_info);
++	return ret;
+ }
+ 
+ static void ping_close(struct sock *sk, long timeout)
+diff --git a/net/ipv4/route.c b/net/ipv4/route.c
+index 6768ce2f50b1..6526110ba784 100644
+--- a/net/ipv4/route.c
++++ b/net/ipv4/route.c
+@@ -2142,7 +2142,7 @@ static int __mkroute_input(struct sk_buff *skb,
+ 	struct in_device *out_dev;
+ 	unsigned int flags = 0;
+ 	__be32 spec_dst;
+-	u32 itag;
++	u32 itag = 0;
+ 
+ 	/* get a working reference to the output device */
+ 	out_dev = __in_dev_get_rcu(FIB_RES_DEV(*res));
+diff --git a/net/ipv4/tcp_cubic.c b/net/ipv4/tcp_cubic.c
+index b78eac2b7079..ed3d6d4a6d65 100644
+--- a/net/ipv4/tcp_cubic.c
++++ b/net/ipv4/tcp_cubic.c
+@@ -406,7 +406,7 @@ static void bictcp_acked(struct sock *sk, u32 cnt, s32 rtt_us)
+ 		ratio -= ca->delayed_ack >> ACK_RATIO_SHIFT;
+ 		ratio += cnt;
+ 
+-		ca->delayed_ack = min(ratio, ACK_RATIO_LIMIT);
++		ca->delayed_ack = clamp(ratio, 1U, ACK_RATIO_LIMIT);
+ 	}
+ 
+ 	/* Some calls are for duplicates without timetamps */
+diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
+index 94874b0bdcdc..2e752b2f5b30 100644
+--- a/net/ipv6/netfilter/ip6_tables.c
++++ b/net/ipv6/netfilter/ip6_tables.c
+@@ -1249,8 +1249,10 @@ __do_replace(struct net *net, const char *name, unsigned int valid_hooks,
+ 
+ 	xt_free_table_info(oldinfo);
+ 	if (copy_to_user(counters_ptr, counters,
+-			 sizeof(struct xt_counters) * num_counters) != 0)
+-		ret = -EFAULT;
++			 sizeof(struct xt_counters) * num_counters) != 0) {
++		/* Silent error, can't fail, new table is already in place */
++		net_warn_ratelimited("ip6tables: counters copy to user failed while replacing table\n");
++	}
+ 	vfree(counters);
+ 	xt_table_unlock(t);
+ 	return ret;
+diff --git a/net/ipv6/route.c b/net/ipv6/route.c
+index 39e11f923a73..782f67a4f568 100644
+--- a/net/ipv6/route.c
++++ b/net/ipv6/route.c
+@@ -1056,7 +1056,7 @@ static unsigned int ip6_mtu(const struct dst_entry *dst)
+ 	unsigned int mtu = dst_metric_raw(dst, RTAX_MTU);
+ 
+ 	if (mtu)
+-		return mtu;
++		goto out;
+ 
+ 	mtu = IPV6_MIN_MTU;
+ 
+@@ -1066,7 +1066,8 @@ static unsigned int ip6_mtu(const struct dst_entry *dst)
+ 		mtu = idev->cnf.mtu6;
+ 	rcu_read_unlock();
+ 
+-	return mtu;
++out:
++	return min_t(unsigned int, mtu, IP6_MAX_MTU);
+ }
+ 
+ static struct dst_entry *icmp6_dst_gc_list;
+diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
+index 969cd3eacd2b..e0f0934d6c39 100644
+--- a/net/l2tp/l2tp_ppp.c
++++ b/net/l2tp/l2tp_ppp.c
+@@ -772,9 +772,9 @@ static int pppol2tp_connect(struct socket *sock, struct sockaddr *uservaddr,
+ 	session->deref = pppol2tp_session_sock_put;
+ 
+ 	/* If PMTU discovery was enabled, use the MTU that was discovered */
+-	dst = sk_dst_get(sk);
++	dst = sk_dst_get(tunnel->sock);
+ 	if (dst != NULL) {
+-		u32 pmtu = dst_mtu(__sk_dst_get(sk));
++		u32 pmtu = dst_mtu(__sk_dst_get(tunnel->sock));
+ 		if (pmtu != 0)
+ 			session->mtu = session->mru = pmtu -
+ 				PPPOL2TP_HEADER_OVERHEAD;
+diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
+index e051398fdf6b..d067ed16bab1 100644
+--- a/net/sched/act_mirred.c
++++ b/net/sched/act_mirred.c
+@@ -201,13 +201,12 @@ static int tcf_mirred(struct sk_buff *skb, const struct tc_action *a,
+ out:
+ 	if (err) {
+ 		m->tcf_qstats.overlimits++;
+-		/* should we be asking for packet to be dropped?
+-		 * may make sense for redirect case only
+-		 */
+-		retval = TC_ACT_SHOT;
+-	} else {
++		if (m->tcfm_eaction != TCA_EGRESS_MIRROR)
++			retval = TC_ACT_SHOT;
++		else
++			retval = m->tcf_action;
++	} else
+ 		retval = m->tcf_action;
+-	}
+ 	spin_unlock(&m->tcf_lock);
+ 
+ 	return retval;
+diff --git a/net/sctp/protocol.c b/net/sctp/protocol.c
+index 6f6ad8686833..de35e01f03a9 100644
+--- a/net/sctp/protocol.c
++++ b/net/sctp/protocol.c
+@@ -528,8 +528,13 @@ static void sctp_v4_get_dst(struct sctp_transport *t, union sctp_addr *saddr,
+ 			continue;
+ 		if ((laddr->state == SCTP_ADDR_SRC) &&
+ 		    (AF_INET == laddr->a.sa.sa_family)) {
+-			fl4->saddr = laddr->a.v4.sin_addr.s_addr;
+ 			fl4->fl4_sport = laddr->a.v4.sin_port;
++			flowi4_update_output(fl4,
++					     asoc->base.sk->sk_bound_dev_if,
++					     RT_CONN_FLAGS(asoc->base.sk),
++					     daddr->v4.sin_addr.s_addr,
++					     laddr->a.v4.sin_addr.s_addr);
++
+ 			rt = ip_route_output_key(&init_net, fl4);
+ 			if (!IS_ERR(rt)) {
+ 				dst = &rt->dst;
+diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
+index 619228d156c4..dc5748f3e384 100644
+--- a/scripts/mod/modpost.c
++++ b/scripts/mod/modpost.c
+@@ -569,12 +569,16 @@ static int ignore_undef_symbol(struct elf_info *info, const char *symname)
+ 		if (strncmp(symname, "_restgpr_", sizeof("_restgpr_") - 1) == 0 ||
+ 		    strncmp(symname, "_savegpr_", sizeof("_savegpr_") - 1) == 0 ||
+ 		    strncmp(symname, "_rest32gpr_", sizeof("_rest32gpr_") - 1) == 0 ||
+-		    strncmp(symname, "_save32gpr_", sizeof("_save32gpr_") - 1) == 0)
++		    strncmp(symname, "_save32gpr_", sizeof("_save32gpr_") - 1) == 0 ||
++		    strncmp(symname, "_restvr_", sizeof("_restvr_") - 1) == 0 ||
++		    strncmp(symname, "_savevr_", sizeof("_savevr_") - 1) == 0)
+ 			return 1;
+ 	if (info->hdr->e_machine == EM_PPC64)
+ 		/* Special register function linked on all modules during final link of .ko */
+ 		if (strncmp(symname, "_restgpr0_", sizeof("_restgpr0_") - 1) == 0 ||
+-		    strncmp(symname, "_savegpr0_", sizeof("_savegpr0_") - 1) == 0)
++		    strncmp(symname, "_savegpr0_", sizeof("_savegpr0_") - 1) == 0 ||
++		    strncmp(symname, "_restvr_", sizeof("_restvr_") - 1) == 0 ||
++		    strncmp(symname, "_savevr_", sizeof("_savevr_") - 1) == 0)
+ 			return 1;
+ 	/* Do not ignore this symbol */
+ 	return 0;
+diff --git a/virt/kvm/async_pf.c b/virt/kvm/async_pf.c
+index 74268b4c2ee1..bdd2c0d690d6 100644
+--- a/virt/kvm/async_pf.c
++++ b/virt/kvm/async_pf.c
+@@ -75,7 +75,6 @@ static void async_pf_execute(struct work_struct *work)
+ 	spin_lock(&vcpu->async_pf.lock);
+ 	list_add_tail(&apf->link, &vcpu->async_pf.done);
+ 	apf->page = page;
+-	apf->done = true;
+ 	spin_unlock(&vcpu->async_pf.lock);
+ 
+ 	/*
+@@ -88,7 +87,7 @@ static void async_pf_execute(struct work_struct *work)
+ 	if (waitqueue_active(&vcpu->wq))
+ 		wake_up_interruptible(&vcpu->wq);
+ 
+-	mmdrop(mm);
++	mmput(mm);
+ 	kvm_put_kvm(vcpu->kvm);
+ }
+ 
+@@ -99,10 +98,12 @@ void kvm_clear_async_pf_completion_queue(struct kvm_vcpu *vcpu)
+ 		struct kvm_async_pf *work =
+ 			list_entry(vcpu->async_pf.queue.next,
+ 				   typeof(*work), queue);
+-		cancel_work_sync(&work->work);
+ 		list_del(&work->queue);
+-		if (!work->done) /* work was canceled */
++		if (cancel_work_sync(&work->work)) {
++			mmput(work->mm);
++			kvm_put_kvm(vcpu->kvm); /* == work->vcpu->kvm */
+ 			kmem_cache_free(async_pf_cache, work);
++		}
+ 	}
+ 
+ 	spin_lock(&vcpu->async_pf.lock);
+@@ -163,13 +164,12 @@ int kvm_setup_async_pf(struct kvm_vcpu *vcpu, gva_t gva, gfn_t gfn,
+ 		return 0;
+ 
+ 	work->page = NULL;
+-	work->done = false;
+ 	work->vcpu = vcpu;
+ 	work->gva = gva;
+ 	work->addr = gfn_to_hva(vcpu->kvm, gfn);
+ 	work->arch = *arch;
+ 	work->mm = current->mm;
+-	atomic_inc(&work->mm->mm_count);
++	atomic_inc(&work->mm->mm_users);
+ 	kvm_get_kvm(work->vcpu->kvm);
+ 
+ 	/* this can't really happen otherwise gfn_to_pfn_async
+@@ -187,7 +187,7 @@ int kvm_setup_async_pf(struct kvm_vcpu *vcpu, gva_t gva, gfn_t gfn,
+ 	return 1;
+ retry_sync:
+ 	kvm_put_kvm(work->vcpu->kvm);
+-	mmdrop(work->mm);
++	mmput(work->mm);
+ 	kmem_cache_free(async_pf_cache, work);
+ 	return 0;
+ }

Deleted: genpatches-2.6/trunk/3.2/1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch
===================================================================
--- genpatches-2.6/trunk/3.2/1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch	2014-06-09 17:57:46 UTC (rev 2822)
+++ genpatches-2.6/trunk/3.2/1500_CVE-2014-0196-n_tty-Fix-n_tty_write-crash-when-echoing-in-raw-mode.patch	2014-06-09 18:29:31 UTC (rev 2823)
@@ -1,77 +0,0 @@
-From: Peter Hurley <peter@××××××××××××××.com>
-Date: Sat, 3 May 2014 14:04:59 +0200
-Subject: n_tty: Fix n_tty_write crash when echoing in raw mode
-
-commit 4291086b1f081b869c6d79e5b7441633dc3ace00 upstream.
-
-The tty atomic_write_lock does not provide an exclusion guarantee for
-the tty driver if the termios settings are LECHO & !OPOST.  And since
-it is unexpected and not allowed to call TTY buffer helpers like
-tty_insert_flip_string concurrently, this may lead to crashes when
-concurrect writers call pty_write. In that case the following two
-writers:
-* the ECHOing from a workqueue and
-* pty_write from the process
-race and can overflow the corresponding TTY buffer like follows.
-
-If we look into tty_insert_flip_string_fixed_flag, there is:
-  int space = __tty_buffer_request_room(port, goal, flags);
-  struct tty_buffer *tb = port->buf.tail;
-  ...
-  memcpy(char_buf_ptr(tb, tb->used), chars, space);
-  ...
-  tb->used += space;
-
-so the race of the two can result in something like this:
-              A                                B
-__tty_buffer_request_room
-                                  __tty_buffer_request_room
-memcpy(buf(tb->used), ...)
-tb->used += space;
-                                  memcpy(buf(tb->used), ...) ->BOOM
-
-B's memcpy is past the tty_buffer due to the previous A's tb->used
-increment.
-
-Since the N_TTY line discipline input processing can output
-concurrently with a tty write, obtain the N_TTY ldisc output_lock to
-serialize echo output with normal tty writes.  This ensures the tty
-buffer helper tty_insert_flip_string is not called concurrently and
-everything is fine.
-
-Note that this is nicely reproducible by an ordinary user using
-forkpty and some setup around that (raw termios + ECHO). And it is
-present in kernels at least after commit
-d945cb9cce20ac7143c2de8d88b187f62db99bdc (pty: Rework the pty layer to
-use the normal buffering logic) in 2.6.31-rc3.
-
-js: add more info to the commit log
-js: switch to bool
-js: lock unconditionally
-js: lock only the tty->ops->write call
-
-References: CVE-2014-0196
-Reported-and-tested-by: Jiri Slaby <jslaby@××××.cz>
-Signed-off-by: Peter Hurley <peter@××××××××××××××.com>
-Signed-off-by: Jiri Slaby <jslaby@××××.cz>
-Cc: Linus Torvalds <torvalds@××××××××××××××××.org>
-Cc: Alan Cox <alan@××××××××××××××××.uk>
-Signed-off-by: Greg Kroah-Hartman <gregkh@×××××××××××××××.org>
-[bwh: Backported to 3.2: output_lock is a member of struct tty_struct]
-Signed-off-by: Ben Hutchings <ben@××××××××××××.uk>
----
- drivers/tty/n_tty.c |    2 ++
- 1 file changed, 2 insertions(+)
-
---- a/drivers/tty/n_tty.c
-+++ b/drivers/tty/n_tty.c
-@@ -1996,7 +1996,9 @@ static ssize_t n_tty_write(struct tty_st
- 				tty->ops->flush_chars(tty);
- 		} else {
- 			while (nr > 0) {
-+				mutex_lock(&tty->output_lock);
- 				c = tty->ops->write(tty, b, nr);
-+				mutex_unlock(&tty->output_lock);
- 				if (c < 0) {
- 					retval = c;
- 					goto break_out;

Deleted: genpatches-2.6/trunk/3.2/1501-futex-add-another-early-deadlock-detection-check.patch
===================================================================
--- genpatches-2.6/trunk/3.2/1501-futex-add-another-early-deadlock-detection-check.patch	2014-06-09 17:57:46 UTC (rev 2822)
+++ genpatches-2.6/trunk/3.2/1501-futex-add-another-early-deadlock-detection-check.patch	2014-06-09 18:29:31 UTC (rev 2823)
@@ -1,160 +0,0 @@
-From: Thomas Gleixner <tglx@××××××××××.de>
-Date: Mon, 12 May 2014 20:45:34 +0000
-Subject: futex: Add another early deadlock detection check
-Git-commit: 866293ee54227584ffcb4a42f69c1f365974ba7f
-
-Dave Jones trinity syscall fuzzer exposed an issue in the deadlock
-detection code of rtmutex:
-  http://lkml.kernel.org/r/20140429151655.GA14277@××××××.com
-
-That underlying issue has been fixed with a patch to the rtmutex code,
-but the futex code must not call into rtmutex in that case because
-    - it can detect that issue early
-    - it avoids a different and more complex fixup for backing out
-
-If the user space variable got manipulated to 0x80000000 which means
-no lock holder, but the waiters bit set and an active pi_state in the
-kernel is found we can figure out the recursive locking issue by
-looking at the pi_state owner. If that is the current task, then we
-can safely return -EDEADLK.
-
-The check should have been added in commit 59fa62451 (futex: Handle
-futex_pi OWNER_DIED take over correctly) already, but I did not see
-the above issue caused by user space manipulation back then.
-
-Signed-off-by: Thomas Gleixner <tglx@××××××××××.de>
-Cc: Dave Jones <davej@××××××.com>
-Cc: Linus Torvalds <torvalds@××××××××××××××××.org>
-Cc: Peter Zijlstra <peterz@×××××××××.org>
-Cc: Darren Hart <darren@××××××.com>
-Cc: Davidlohr Bueso <davidlohr@××.com>
-Cc: Steven Rostedt <rostedt@×××××××.org>
-Cc: Clark Williams <williams@××××××.com>
-Cc: Paul McKenney <paulmck@××××××××××××××.com>
-Cc: Lai Jiangshan <laijs@××××××××××.com>
-Cc: Roland McGrath <roland@×××××××××.com>
-Cc: Carlos ODonell <carlos@××××××.com>
-Cc: Jakub Jelinek <jakub@××××××.com>
-Cc: Michael Kerrisk <mtk.manpages@×××××.com>
-Cc: Sebastian Andrzej Siewior <bigeasy@××××××××××.de>
-Link: http://lkml.kernel.org/r/20140512201701.097349971@××××××××××.de
-Signed-off-by: Thomas Gleixner <tglx@××××××××××.de>
-Cc: stable@×××××××××××.org
----
- kernel/futex.c | 47 ++++++++++++++++++++++++++++++++++-------------
- 1 file changed, 34 insertions(+), 13 deletions(-)
-
-Index: linux-3.4/kernel/futex.c
-===================================================================
---- linux-3.4.orig/kernel/futex.c
-+++ linux-3.4/kernel/futex.c
-@@ -590,7 +590,8 @@ void exit_pi_state_list(struct task_stru
- 
- static int
- lookup_pi_state(u32 uval, struct futex_hash_bucket *hb,
--		union futex_key *key, struct futex_pi_state **ps)
-+		union futex_key *key, struct futex_pi_state **ps,
-+		struct task_struct *task)
- {
- 	struct futex_pi_state *pi_state = NULL;
- 	struct futex_q *this, *next;
-@@ -634,6 +635,16 @@ lookup_pi_state(u32 uval, struct futex_h
- 					return -EINVAL;
- 			}
- 
-+			/*
-+			 * Protect against a corrupted uval. If uval
-+			 * is 0x80000000 then pid is 0 and the waiter
-+			 * bit is set. So the deadlock check in the
-+			 * calling code has failed and we did not fall
-+			 * into the check above due to !pid.
-+			 */
-+			if (task && pi_state->owner == task)
-+				return -EDEADLK;
-+
- 			atomic_inc(&pi_state->refcount);
- 			*ps = pi_state;
- 
-@@ -783,7 +794,7 @@ retry:
- 	 * We dont have the lock. Look up the PI state (or create it if
- 	 * we are the first waiter):
- 	 */
--	ret = lookup_pi_state(uval, hb, key, ps);
-+	ret = lookup_pi_state(uval, hb, key, ps, task);
- 
- 	if (unlikely(ret)) {
- 		switch (ret) {
-@@ -1193,7 +1204,7 @@ void requeue_pi_wake_futex(struct futex_
-  *
-  * Returns:
-  *  0 - failed to acquire the lock atomicly
-- *  1 - acquired the lock
-+ * >0 - acquired the lock, return value is vpid of the top_waiter
-  * <0 - error
-  */
- static int futex_proxy_trylock_atomic(u32 __user *pifutex,
-@@ -1204,7 +1215,7 @@ static int futex_proxy_trylock_atomic(u3
- {
- 	struct futex_q *top_waiter = NULL;
- 	u32 curval;
--	int ret;
-+	int ret, vpid;
- 
- 	if (get_futex_value_locked(&curval, pifutex))
- 		return -EFAULT;
-@@ -1232,11 +1243,13 @@ static int futex_proxy_trylock_atomic(u3
- 	 * the contended case or if set_waiters is 1.  The pi_state is returned
- 	 * in ps in contended cases.
- 	 */
-+	vpid = task_pid_vnr(top_waiter->task);
- 	ret = futex_lock_pi_atomic(pifutex, hb2, key2, ps, top_waiter->task,
- 				   set_waiters);
--	if (ret == 1)
-+	if (ret == 1) {
- 		requeue_pi_wake_futex(top_waiter, key2, hb2);
--
-+		return vpid;
-+	}
- 	return ret;
- }
- 
-@@ -1268,7 +1281,6 @@ static int futex_requeue(u32 __user *uad
- 	struct futex_hash_bucket *hb1, *hb2;
- 	struct plist_head *head1;
- 	struct futex_q *this, *next;
--	u32 curval2;
- 
- 	if (requeue_pi) {
- 		/*
-@@ -1354,16 +1366,25 @@ retry_private:
- 		 * At this point the top_waiter has either taken uaddr2 or is
- 		 * waiting on it.  If the former, then the pi_state will not
- 		 * exist yet, look it up one more time to ensure we have a
--		 * reference to it.
-+		 * reference to it. If the lock was taken, ret contains the
-+		 * vpid of the top waiter task.
- 		 */
--		if (ret == 1) {
-+		if (ret > 0) {
- 			WARN_ON(pi_state);
- 			drop_count++;
- 			task_count++;
--			ret = get_futex_value_locked(&curval2, uaddr2);
--			if (!ret)
--				ret = lookup_pi_state(curval2, hb2, &key2,
--						      &pi_state);
-+			/*
-+			 * If we acquired the lock, then the user
-+			 * space value of uaddr2 should be vpid. It
-+			 * cannot be changed by the top waiter as it
-+			 * is blocked on hb2 lock if it tries to do
-+			 * so. If something fiddled with it behind our
-+			 * back the pi state lookup might unearth
-+			 * it. So we rather use the known value than
-+			 * rereading and handing potential crap to
-+			 * lookup_pi_state.
-+			 */
-+			ret = lookup_pi_state(ret, hb2, &key2, &pi_state, NULL);
- 		}
- 
- 		switch (ret) {

Deleted: genpatches-2.6/trunk/3.2/1502-futex-prevent-attaching-to-kernel-threads.patch
===================================================================
--- genpatches-2.6/trunk/3.2/1502-futex-prevent-attaching-to-kernel-threads.patch	2014-06-09 17:57:46 UTC (rev 2822)
+++ genpatches-2.6/trunk/3.2/1502-futex-prevent-attaching-to-kernel-threads.patch	2014-06-09 18:29:31 UTC (rev 2823)
@@ -1,52 +0,0 @@
-From: Thomas Gleixner <tglx@××××××××××.de>
-Date: Mon, 12 May 2014 20:45:35 +0000
-Subject: futex: Prevent attaching to kernel threads
-Git-commit: f0d71b3dcb8332f7971b5f2363632573e6d9486a
-
-We happily allow userspace to declare a random kernel thread to be the
-owner of a user space PI futex.
-
-Found while analysing the fallout of Dave Jones syscall fuzzer.
-
-We also should validate the thread group for private futexes and find
-some fast way to validate whether the "alleged" owner has RW access on
-the file which backs the SHM, but that's a separate issue.
-
-Signed-off-by: Thomas Gleixner <tglx@××××××××××.de>
-Cc: Dave Jones <davej@××××××.com>
-Cc: Linus Torvalds <torvalds@××××××××××××××××.org>
-Cc: Peter Zijlstra <peterz@×××××××××.org>
-Cc: Darren Hart <darren@××××××.com>
-Cc: Davidlohr Bueso <davidlohr@××.com>
-Cc: Steven Rostedt <rostedt@×××××××.org>
-Cc: Clark Williams <williams@××××××.com>
-Cc: Paul McKenney <paulmck@××××××××××××××.com>
-Cc: Lai Jiangshan <laijs@××××××××××.com>
-Cc: Roland McGrath <roland@×××××××××.com>
-Cc: Carlos ODonell <carlos@××××××.com>
-Cc: Jakub Jelinek <jakub@××××××.com>
-Cc: Michael Kerrisk <mtk.manpages@×××××.com>
-Cc: Sebastian Andrzej Siewior <bigeasy@××××××××××.de>
-Link: http://lkml.kernel.org/r/20140512201701.194824402@××××××××××.de
-Signed-off-by: Thomas Gleixner <tglx@××××××××××.de>
-Cc: stable@×××××××××××.org
----
- kernel/futex.c | 5 +++++
- 1 file changed, 5 insertions(+)
-
-Index: linux-3.4/kernel/futex.c
-===================================================================
---- linux-3.4.orig/kernel/futex.c
-+++ linux-3.4/kernel/futex.c
-@@ -662,6 +662,11 @@ lookup_pi_state(u32 uval, struct futex_h
- 	if (!p)
- 		return -ESRCH;
- 
-+	if (!p->mm) {
-+		put_task_struct(p);
-+		return -EPERM;
-+	}
-+
- 	/*
- 	 * We need to look at the task state flags to figure out,
- 	 * whether the task is exiting. To protect against the do_exit

Deleted: genpatches-2.6/trunk/3.2/1503-futex-prevent-requeue-pi-on-same-futex-patch-futex-forbid-uaddr-uaddr2-in-futex_requeue-requeue_pi-1.patch
===================================================================
--- genpatches-2.6/trunk/3.2/1503-futex-prevent-requeue-pi-on-same-futex-patch-futex-forbid-uaddr-uaddr2-in-futex_requeue-requeue_pi-1.patch	2014-06-09 17:57:46 UTC (rev 2822)
+++ genpatches-2.6/trunk/3.2/1503-futex-prevent-requeue-pi-on-same-futex-patch-futex-forbid-uaddr-uaddr2-in-futex_requeue-requeue_pi-1.patch	2014-06-09 18:29:31 UTC (rev 2823)
@@ -1,81 +0,0 @@
-From: Thomas Gleixner <tglx@××××××××××.de>
-Date: Tue, 3 Jun 2014 12:27:06 +0000
-Subject: futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr ==
- uaddr2 in futex_requeue(..., requeue_pi=1)
-Git-commit: e9c243a5a6de0be8e584c604d353412584b592f8
-
-If uaddr == uaddr2, then we have broken the rule of only requeueing from
-a non-pi futex to a pi futex with this call.  If we attempt this, then
-dangling pointers may be left for rt_waiter resulting in an exploitable
-condition.
-
-This change brings futex_requeue() in line with futex_wait_requeue_pi()
-which performs the same check as per commit 6f7b0a2a5c0f ("futex: Forbid
-uaddr == uaddr2 in futex_wait_requeue_pi()")
-
-[ tglx: Compare the resulting keys as well, as uaddrs might be
-  	different depending on the mapping ]
-
-Fixes CVE-2014-3153.
-
-Reported-by: Pinkie Pie
-Signed-off-by: Will Drewry <wad@××××××××.org>
-Signed-off-by: Kees Cook <keescook@××××××××.org>
-Cc: stable@×××××××××××.org
-Signed-off-by: Thomas Gleixner <tglx@××××××××××.de>
-Reviewed-by: Darren Hart <dvhart@×××××××××××.com>
-Signed-off-by: Linus Torvalds <torvalds@××××××××××××××××.org>
----
- kernel/futex.c | 25 +++++++++++++++++++++++++
- 1 file changed, 25 insertions(+)
-
-Index: linux-3.4/kernel/futex.c
-===================================================================
---- linux-3.4.orig/kernel/futex.c
-+++ linux-3.4/kernel/futex.c
-@@ -1289,6 +1289,13 @@ static int futex_requeue(u32 __user *uad
- 
- 	if (requeue_pi) {
- 		/*
-+		 * Requeue PI only works on two distinct uaddrs. This
-+		 * check is only valid for private futexes. See below.
-+		 */
-+		if (uaddr1 == uaddr2)
-+			return -EINVAL;
-+
-+		/*
- 		 * requeue_pi requires a pi_state, try to allocate it now
- 		 * without any locks in case it fails.
- 		 */
-@@ -1326,6 +1333,15 @@ retry:
- 	if (unlikely(ret != 0))
- 		goto out_put_key1;
- 
-+	/*
-+	 * The check above which compares uaddrs is not sufficient for
-+	 * shared futexes. We need to compare the keys:
-+	 */
-+	if (requeue_pi && match_futex(&key1, &key2)) {
-+		ret = -EINVAL;
-+		goto out_put_keys;
-+	}
-+
- 	hb1 = hash_futex(&key1);
- 	hb2 = hash_futex(&key2);
- 
-@@ -2357,6 +2373,15 @@ static int futex_wait_requeue_pi(u32 __u
- 	if (ret)
- 		goto out_key2;
- 
-+	/*
-+	 * The check above which compares uaddrs is not sufficient for
-+	 * shared futexes. We need to compare the keys:
-+	 */
-+	if (match_futex(&q.key, &key2)) {
-+		ret = -EINVAL;
-+		goto out_put_keys;
-+	}
-+
- 	/* Queue the futex_q, drop the hb lock, wait for wakeup. */
- 	futex_wait_queue_me(hb, &q, to);
- 

Deleted: genpatches-2.6/trunk/3.2/1504-futex-validate-atomic-acquisition-in-futex_lock_pi_atomic.patch
===================================================================
--- genpatches-2.6/trunk/3.2/1504-futex-validate-atomic-acquisition-in-futex_lock_pi_atomic.patch	2014-06-09 17:57:46 UTC (rev 2822)
+++ genpatches-2.6/trunk/3.2/1504-futex-validate-atomic-acquisition-in-futex_lock_pi_atomic.patch	2014-06-09 18:29:31 UTC (rev 2823)
@@ -1,53 +0,0 @@
-From: Thomas Gleixner <tglx@××××××××××.de>
-Date: Tue, 3 Jun 2014 12:27:06 +0000
-Subject: futex: Validate atomic acquisition in futex_lock_pi_atomic()
-Git-commit: b3eaa9fc5cd0a4d74b18f6b8dc617aeaf1873270
-
-We need to protect the atomic acquisition in the kernel against rogue
-user space which sets the user space futex to 0, so the kernel side
-acquisition succeeds while there is existing state in the kernel
-associated to the real owner.
-
-Verify whether the futex has waiters associated with kernel state.  If
-it has, return -EINVAL.  The state is corrupted already, so no point in
-cleaning it up.  Subsequent calls will fail as well.  Not our problem.
-
-[ tglx: Use futex_top_waiter() and explain why we do not need to try
-  	restoring the already corrupted user space state. ]
-
-Signed-off-by: Darren Hart <dvhart@×××××××××××.com>
-Cc: Kees Cook <keescook@××××××××.org>
-Cc: Will Drewry <wad@××××××××.org>
-Cc: stable@×××××××××××.org
-Signed-off-by: Thomas Gleixner <tglx@××××××××××.de>
-Signed-off-by: Linus Torvalds <torvalds@××××××××××××××××.org>
----
- kernel/futex.c | 14 +++++++++++---
- 1 file changed, 11 insertions(+), 3 deletions(-)
-
-Index: linux-3.4/kernel/futex.c
-===================================================================
---- linux-3.4.orig/kernel/futex.c
-+++ linux-3.4/kernel/futex.c
-@@ -758,10 +758,18 @@ retry:
- 		return -EDEADLK;
- 
- 	/*
--	 * Surprise - we got the lock. Just return to userspace:
-+	 * Surprise - we got the lock, but we do not trust user space at all.
- 	 */
--	if (unlikely(!curval))
--		return 1;
-+	if (unlikely(!curval)) {
-+		/*
-+		 * We verify whether there is kernel state for this
-+		 * futex. If not, we can safely assume, that the 0 ->
-+		 * TID transition is correct. If state exists, we do
-+		 * not bother to fixup the user space state as it was
-+		 * corrupted already.
-+		 */
-+		return futex_top_waiter(hb, key) ? -EINVAL : 1;
-+	}
- 
- 	uval = curval;
- 

Deleted: genpatches-2.6/trunk/3.2/1505-futex-always-cleanup-owner-tid-in-unlock_pi.patch
===================================================================
--- genpatches-2.6/trunk/3.2/1505-futex-always-cleanup-owner-tid-in-unlock_pi.patch	2014-06-09 17:57:46 UTC (rev 2822)
+++ genpatches-2.6/trunk/3.2/1505-futex-always-cleanup-owner-tid-in-unlock_pi.patch	2014-06-09 18:29:31 UTC (rev 2823)
@@ -1,99 +0,0 @@
-From: Thomas Gleixner <tglx@××××××××××.de>
-Date: Tue, 3 Jun 2014 12:27:07 +0000
-Subject: futex: Always cleanup owner tid in unlock_pi
-Git-commit: 13fbca4c6ecd96ec1a1cfa2e4f2ce191fe928a5e
-
-If the owner died bit is set at futex_unlock_pi, we currently do not
-cleanup the user space futex.  So the owner TID of the current owner
-(the unlocker) persists.  That's observable inconsistant state,
-especially when the ownership of the pi state got transferred.
-
-Clean it up unconditionally.
-
-Signed-off-by: Thomas Gleixner <tglx@××××××××××.de>
-Cc: Kees Cook <keescook@××××××××.org>
-Cc: Will Drewry <wad@××××××××.org>
-Cc: Darren Hart <dvhart@×××××××××××.com>
-Cc: stable@×××××××××××.org
-Signed-off-by: Linus Torvalds <torvalds@××××××××××××××××.org>
----
- kernel/futex.c | 40 ++++++++++++++++++----------------------
- 1 file changed, 18 insertions(+), 22 deletions(-)
-
-Index: linux-3.4/kernel/futex.c
-===================================================================
---- linux-3.4.orig/kernel/futex.c
-+++ linux-3.4/kernel/futex.c
-@@ -899,6 +899,7 @@ static int wake_futex_pi(u32 __user *uad
- 	struct task_struct *new_owner;
- 	struct futex_pi_state *pi_state = this->pi_state;
- 	u32 uninitialized_var(curval), newval;
-+	int ret = 0;
- 
- 	if (!pi_state)
- 		return -EINVAL;
-@@ -922,23 +923,19 @@ static int wake_futex_pi(u32 __user *uad
- 		new_owner = this->task;
- 
- 	/*
--	 * We pass it to the next owner. (The WAITERS bit is always
--	 * kept enabled while there is PI state around. We must also
--	 * preserve the owner died bit.)
--	 */
--	if (!(uval & FUTEX_OWNER_DIED)) {
--		int ret = 0;
--
--		newval = FUTEX_WAITERS | task_pid_vnr(new_owner);
--
--		if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval))
--			ret = -EFAULT;
--		else if (curval != uval)
--			ret = -EINVAL;
--		if (ret) {
--			raw_spin_unlock(&pi_state->pi_mutex.wait_lock);
--			return ret;
--		}
-+	 * We pass it to the next owner. The WAITERS bit is always
-+	 * kept enabled while there is PI state around. We cleanup the
-+	 * owner died bit, because we are the owner.
-+	 */
-+	newval = FUTEX_WAITERS | task_pid_vnr(new_owner);
-+
-+	if (cmpxchg_futex_value_locked(&curval, uaddr, uval, newval))
-+		ret = -EFAULT;
-+	else if (curval != uval)
-+		ret = -EINVAL;
-+	if (ret) {
-+		raw_spin_unlock(&pi_state->pi_mutex.wait_lock);
-+		return ret;
- 	}
- 
- 	raw_spin_lock_irq(&pi_state->owner->pi_lock);
-@@ -2183,9 +2180,10 @@ retry:
- 	/*
- 	 * To avoid races, try to do the TID -> 0 atomic transition
- 	 * again. If it succeeds then we can return without waking
--	 * anyone else up:
-+	 * anyone else up. We only try this if neither the waiters nor
-+	 * the owner died bit are set.
- 	 */
--	if (!(uval & FUTEX_OWNER_DIED) &&
-+	if (!(uval & ~FUTEX_TID_MASK) &&
- 	    cmpxchg_futex_value_locked(&uval, uaddr, vpid, 0))
- 		goto pi_faulted;
- 	/*
-@@ -2217,11 +2215,9 @@ retry:
- 	/*
- 	 * No waiters - kernel unlocks the futex:
- 	 */
--	if (!(uval & FUTEX_OWNER_DIED)) {
--		ret = unlock_futex_pi(uaddr, uval);
--		if (ret == -EFAULT)
--			goto pi_faulted;
--	}
-+	ret = unlock_futex_pi(uaddr, uval);
-+	if (ret == -EFAULT)
-+		goto pi_faulted;
- 
- out_unlock:
- 	spin_unlock(&hb->lock);

Deleted: genpatches-2.6/trunk/3.2/1506-futex-make-lookup_pi_state-more-robust.patch
===================================================================
(Binary files differ)