diff options
Diffstat (limited to '3.14.51/1050_linux-3.14.51.patch')
| -rw-r--r-- | 3.14.51/1050_linux-3.14.51.patch | 1929 |
1 files changed, 0 insertions, 1929 deletions
diff --git a/3.14.51/1050_linux-3.14.51.patch b/3.14.51/1050_linux-3.14.51.patch deleted file mode 100644 index 8c28a74..0000000 --- a/3.14.51/1050_linux-3.14.51.patch +++ /dev/null @@ -1,1929 +0,0 @@ -diff --git a/Documentation/ABI/testing/ima_policy b/Documentation/ABI/testing/ima_policy -index 4c3efe4..750ab97 100644 ---- a/Documentation/ABI/testing/ima_policy -+++ b/Documentation/ABI/testing/ima_policy -@@ -20,16 +20,18 @@ Description: - action: measure | dont_measure | appraise | dont_appraise | audit - condition:= base | lsm [option] - base: [[func=] [mask=] [fsmagic=] [fsuuid=] [uid=] -- [fowner]] -+ [euid=] [fowner=]] - lsm: [[subj_user=] [subj_role=] [subj_type=] - [obj_user=] [obj_role=] [obj_type=]] - option: [[appraise_type=]] [permit_directio] - - base: func:= [BPRM_CHECK][MMAP_CHECK][FILE_CHECK][MODULE_CHECK] -- mask:= [MAY_READ] [MAY_WRITE] [MAY_APPEND] [MAY_EXEC] -+ mask:= [[^]MAY_READ] [[^]MAY_WRITE] [[^]MAY_APPEND] -+ [[^]MAY_EXEC] - fsmagic:= hex value - fsuuid:= file system UUID (e.g 8bcbe394-4f13-4144-be8e-5aa9ea2ce2f6) - uid:= decimal value -+ euid:= decimal value - fowner:=decimal value - lsm: are LSM specific - option: appraise_type:= [imasig] -diff --git a/Makefile b/Makefile -index d71c40a..83275d8e 100644 ---- a/Makefile -+++ b/Makefile -@@ -1,6 +1,6 @@ - VERSION = 3 - PATCHLEVEL = 14 --SUBLEVEL = 50 -+SUBLEVEL = 51 - EXTRAVERSION = - NAME = Remembering Coco - -diff --git a/arch/arm/include/asm/smp.h b/arch/arm/include/asm/smp.h -index 22a3b9b..4157aec 100644 ---- a/arch/arm/include/asm/smp.h -+++ b/arch/arm/include/asm/smp.h -@@ -74,6 +74,7 @@ struct secondary_data { - }; - extern struct secondary_data secondary_data; - extern volatile int pen_release; -+extern void secondary_startup(void); - - extern int __cpu_disable(void); - -diff --git a/arch/arm/mach-omap2/omap_hwmod.c b/arch/arm/mach-omap2/omap_hwmod.c -index 4551efd..399af1e 100644 ---- a/arch/arm/mach-omap2/omap_hwmod.c -+++ b/arch/arm/mach-omap2/omap_hwmod.c -@@ -2452,6 +2452,9 @@ static int of_dev_hwmod_lookup(struct device_node *np, - * registers. This address is needed early so the OCP registers that - * are part of the device's address space can be ioremapped properly. - * -+ * If SYSC access is not needed, the registers will not be remapped -+ * and non-availability of MPU access is not treated as an error. -+ * - * Returns 0 on success, -EINVAL if an invalid hwmod is passed, and - * -ENXIO on absent or invalid register target address space. - */ -@@ -2466,6 +2469,11 @@ static int __init _init_mpu_rt_base(struct omap_hwmod *oh, void *data, - - _save_mpu_port_index(oh); - -+ /* if we don't need sysc access we don't need to ioremap */ -+ if (!oh->class->sysc) -+ return 0; -+ -+ /* we can't continue without MPU PORT if we need sysc access */ - if (oh->_int_flags & _HWMOD_NO_MPU_PORT) - return -ENXIO; - -@@ -2475,8 +2483,10 @@ static int __init _init_mpu_rt_base(struct omap_hwmod *oh, void *data, - oh->name); - - /* Extract the IO space from device tree blob */ -- if (!np) -+ if (!np) { -+ pr_err("omap_hwmod: %s: no dt node\n", oh->name); - return -ENXIO; -+ } - - va_start = of_iomap(np, index + oh->mpu_rt_idx); - } else { -@@ -2535,13 +2545,11 @@ static int __init _init(struct omap_hwmod *oh, void *data) - oh->name, np->name); - } - -- if (oh->class->sysc) { -- r = _init_mpu_rt_base(oh, NULL, index, np); -- if (r < 0) { -- WARN(1, "omap_hwmod: %s: doesn't have mpu register target base\n", -- oh->name); -- return 0; -- } -+ r = _init_mpu_rt_base(oh, NULL, index, np); -+ if (r < 0) { -+ WARN(1, "omap_hwmod: %s: doesn't have mpu register target base\n", -+ oh->name); -+ return 0; - } - - r = _init_clocks(oh, NULL); -diff --git a/arch/arm/mach-realview/include/mach/memory.h b/arch/arm/mach-realview/include/mach/memory.h -index 2022e09..db09170 100644 ---- a/arch/arm/mach-realview/include/mach/memory.h -+++ b/arch/arm/mach-realview/include/mach/memory.h -@@ -56,6 +56,8 @@ - #define PAGE_OFFSET1 (PAGE_OFFSET + 0x10000000) - #define PAGE_OFFSET2 (PAGE_OFFSET + 0x30000000) - -+#define PHYS_OFFSET PLAT_PHYS_OFFSET -+ - #define __phys_to_virt(phys) \ - ((phys) >= 0x80000000 ? (phys) - 0x80000000 + PAGE_OFFSET2 : \ - (phys) >= 0x20000000 ? (phys) - 0x20000000 + PAGE_OFFSET1 : \ -diff --git a/arch/arm/mach-sunxi/Makefile b/arch/arm/mach-sunxi/Makefile -index d939720..27b168f 100644 ---- a/arch/arm/mach-sunxi/Makefile -+++ b/arch/arm/mach-sunxi/Makefile -@@ -1,2 +1,2 @@ - obj-$(CONFIG_ARCH_SUNXI) += sunxi.o --obj-$(CONFIG_SMP) += platsmp.o headsmp.o -+obj-$(CONFIG_SMP) += platsmp.o -diff --git a/arch/arm/mach-sunxi/headsmp.S b/arch/arm/mach-sunxi/headsmp.S -deleted file mode 100644 -index a10d494..0000000 ---- a/arch/arm/mach-sunxi/headsmp.S -+++ /dev/null -@@ -1,9 +0,0 @@ --#include <linux/linkage.h> --#include <linux/init.h> -- -- .section ".text.head", "ax" -- --ENTRY(sun6i_secondary_startup) -- msr cpsr_fsxc, #0xd3 -- b secondary_startup --ENDPROC(sun6i_secondary_startup) -diff --git a/arch/arm/mach-sunxi/platsmp.c b/arch/arm/mach-sunxi/platsmp.c -index 7b141d8..0c7dbce 100644 ---- a/arch/arm/mach-sunxi/platsmp.c -+++ b/arch/arm/mach-sunxi/platsmp.c -@@ -82,7 +82,7 @@ static int sun6i_smp_boot_secondary(unsigned int cpu, - spin_lock(&cpu_lock); - - /* Set CPU boot address */ -- writel(virt_to_phys(sun6i_secondary_startup), -+ writel(virt_to_phys(secondary_startup), - cpucfg_membase + CPUCFG_PRIVATE0_REG); - - /* Assert the CPU core in reset */ -diff --git a/arch/arm64/kernel/signal32.c b/arch/arm64/kernel/signal32.c -index 7ed72dc..a966bac 100644 ---- a/arch/arm64/kernel/signal32.c -+++ b/arch/arm64/kernel/signal32.c -@@ -165,7 +165,8 @@ int copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from) - * Other callers might not initialize the si_lsb field, - * so check explicitely for the right codes here. - */ -- if (from->si_code == BUS_MCEERR_AR || from->si_code == BUS_MCEERR_AO) -+ if (from->si_signo == SIGBUS && -+ (from->si_code == BUS_MCEERR_AR || from->si_code == BUS_MCEERR_AO)) - err |= __put_user(from->si_addr_lsb, &to->si_addr_lsb); - #endif - break; -@@ -192,8 +193,6 @@ int copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from) - - int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from) - { -- memset(to, 0, sizeof *to); -- - if (copy_from_user(to, from, __ARCH_SI_PREAMBLE_SIZE) || - copy_from_user(to->_sifields._pad, - from->_sifields._pad, SI_PAD_SIZE)) -diff --git a/arch/mips/include/asm/pgtable.h b/arch/mips/include/asm/pgtable.h -index 008324d..b154953 100644 ---- a/arch/mips/include/asm/pgtable.h -+++ b/arch/mips/include/asm/pgtable.h -@@ -150,8 +150,39 @@ static inline void set_pte(pte_t *ptep, pte_t pteval) - * Make sure the buddy is global too (if it's !none, - * it better already be global) - */ -+#ifdef CONFIG_SMP -+ /* -+ * For SMP, multiple CPUs can race, so we need to do -+ * this atomically. -+ */ -+#ifdef CONFIG_64BIT -+#define LL_INSN "lld" -+#define SC_INSN "scd" -+#else /* CONFIG_32BIT */ -+#define LL_INSN "ll" -+#define SC_INSN "sc" -+#endif -+ unsigned long page_global = _PAGE_GLOBAL; -+ unsigned long tmp; -+ -+ __asm__ __volatile__ ( -+ " .set push\n" -+ " .set noreorder\n" -+ "1: " LL_INSN " %[tmp], %[buddy]\n" -+ " bnez %[tmp], 2f\n" -+ " or %[tmp], %[tmp], %[global]\n" -+ " " SC_INSN " %[tmp], %[buddy]\n" -+ " beqz %[tmp], 1b\n" -+ " nop\n" -+ "2:\n" -+ " .set pop" -+ : [buddy] "+m" (buddy->pte), -+ [tmp] "=&r" (tmp) -+ : [global] "r" (page_global)); -+#else /* !CONFIG_SMP */ - if (pte_none(*buddy)) - pte_val(*buddy) = pte_val(*buddy) | _PAGE_GLOBAL; -+#endif /* CONFIG_SMP */ - } - #endif - } -diff --git a/arch/mips/kernel/mips-mt-fpaff.c b/arch/mips/kernel/mips-mt-fpaff.c -index cb09862..ca16964 100644 ---- a/arch/mips/kernel/mips-mt-fpaff.c -+++ b/arch/mips/kernel/mips-mt-fpaff.c -@@ -154,7 +154,7 @@ asmlinkage long mipsmt_sys_sched_getaffinity(pid_t pid, unsigned int len, - unsigned long __user *user_mask_ptr) - { - unsigned int real_len; -- cpumask_t mask; -+ cpumask_t allowed, mask; - int retval; - struct task_struct *p; - -@@ -173,7 +173,8 @@ asmlinkage long mipsmt_sys_sched_getaffinity(pid_t pid, unsigned int len, - if (retval) - goto out_unlock; - -- cpumask_and(&mask, &p->thread.user_cpus_allowed, cpu_possible_mask); -+ cpumask_or(&allowed, &p->thread.user_cpus_allowed, &p->cpus_allowed); -+ cpumask_and(&mask, &allowed, cpu_active_mask); - - out_unlock: - read_unlock(&tasklist_lock); -diff --git a/arch/mips/kernel/signal32.c b/arch/mips/kernel/signal32.c -index 3d60f77..ea585cf 100644 ---- a/arch/mips/kernel/signal32.c -+++ b/arch/mips/kernel/signal32.c -@@ -370,8 +370,6 @@ int copy_siginfo_to_user32(compat_siginfo_t __user *to, const siginfo_t *from) - - int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from) - { -- memset(to, 0, sizeof *to); -- - if (copy_from_user(to, from, 3*sizeof(int)) || - copy_from_user(to->_sifields._pad, - from->_sifields._pad, SI_PAD_SIZE32)) -diff --git a/arch/mips/mti-malta/malta-time.c b/arch/mips/mti-malta/malta-time.c -index 3190099..d4ab447 100644 ---- a/arch/mips/mti-malta/malta-time.c -+++ b/arch/mips/mti-malta/malta-time.c -@@ -168,14 +168,17 @@ unsigned int get_c0_compare_int(void) - - static void __init init_rtc(void) - { -- /* stop the clock whilst setting it up */ -- CMOS_WRITE(RTC_SET | RTC_24H, RTC_CONTROL); -+ unsigned char freq, ctrl; - -- /* 32KHz time base */ -- CMOS_WRITE(RTC_REF_CLCK_32KHZ, RTC_FREQ_SELECT); -+ /* Set 32KHz time base if not already set */ -+ freq = CMOS_READ(RTC_FREQ_SELECT); -+ if ((freq & RTC_DIV_CTL) != RTC_REF_CLCK_32KHZ) -+ CMOS_WRITE(RTC_REF_CLCK_32KHZ, RTC_FREQ_SELECT); - -- /* start the clock */ -- CMOS_WRITE(RTC_24H, RTC_CONTROL); -+ /* Ensure SET bit is clear so RTC can run */ -+ ctrl = CMOS_READ(RTC_CONTROL); -+ if (ctrl & RTC_SET) -+ CMOS_WRITE(ctrl & ~RTC_SET, RTC_CONTROL); - } - - void __init plat_time_init(void) -diff --git a/arch/powerpc/kernel/signal_32.c b/arch/powerpc/kernel/signal_32.c -index 4e47db6..e881e3f 100644 ---- a/arch/powerpc/kernel/signal_32.c -+++ b/arch/powerpc/kernel/signal_32.c -@@ -967,8 +967,6 @@ int copy_siginfo_to_user32(struct compat_siginfo __user *d, const siginfo_t *s) - - int copy_siginfo_from_user32(siginfo_t *to, struct compat_siginfo __user *from) - { -- memset(to, 0, sizeof *to); -- - if (copy_from_user(to, from, 3*sizeof(int)) || - copy_from_user(to->_sifields._pad, - from->_sifields._pad, SI_PAD_SIZE32)) -diff --git a/arch/sparc/include/asm/visasm.h b/arch/sparc/include/asm/visasm.h -index 11fdf0e..50d6f16 100644 ---- a/arch/sparc/include/asm/visasm.h -+++ b/arch/sparc/include/asm/visasm.h -@@ -28,16 +28,10 @@ - * Must preserve %o5 between VISEntryHalf and VISExitHalf */ - - #define VISEntryHalf \ -- rd %fprs, %o5; \ -- andcc %o5, FPRS_FEF, %g0; \ -- be,pt %icc, 297f; \ -- sethi %hi(298f), %g7; \ -- sethi %hi(VISenterhalf), %g1; \ -- jmpl %g1 + %lo(VISenterhalf), %g0; \ -- or %g7, %lo(298f), %g7; \ -- clr %o5; \ --297: wr %o5, FPRS_FEF, %fprs; \ --298: -+ VISEntry -+ -+#define VISExitHalf \ -+ VISExit - - #define VISEntryHalfFast(fail_label) \ - rd %fprs, %o5; \ -@@ -47,7 +41,7 @@ - ba,a,pt %xcc, fail_label; \ - 297: wr %o5, FPRS_FEF, %fprs; - --#define VISExitHalf \ -+#define VISExitHalfFast \ - wr %o5, 0, %fprs; - - #ifndef __ASSEMBLY__ -diff --git a/arch/sparc/lib/NG4memcpy.S b/arch/sparc/lib/NG4memcpy.S -index 140527a..83aeeb1 100644 ---- a/arch/sparc/lib/NG4memcpy.S -+++ b/arch/sparc/lib/NG4memcpy.S -@@ -240,8 +240,11 @@ FUNC_NAME: /* %o0=dst, %o1=src, %o2=len */ - add %o0, 0x40, %o0 - bne,pt %icc, 1b - LOAD(prefetch, %g1 + 0x200, #n_reads_strong) -+#ifdef NON_USER_COPY -+ VISExitHalfFast -+#else - VISExitHalf -- -+#endif - brz,pn %o2, .Lexit - cmp %o2, 19 - ble,pn %icc, .Lsmall_unaligned -diff --git a/arch/sparc/lib/VISsave.S b/arch/sparc/lib/VISsave.S -index b320ae9..a063d84 100644 ---- a/arch/sparc/lib/VISsave.S -+++ b/arch/sparc/lib/VISsave.S -@@ -44,9 +44,8 @@ vis1: ldub [%g6 + TI_FPSAVED], %g3 - - stx %g3, [%g6 + TI_GSR] - 2: add %g6, %g1, %g3 -- cmp %o5, FPRS_DU -- be,pn %icc, 6f -- sll %g1, 3, %g1 -+ mov FPRS_DU | FPRS_DL | FPRS_FEF, %o5 -+ sll %g1, 3, %g1 - stb %o5, [%g3 + TI_FPSAVED] - rd %gsr, %g2 - add %g6, %g1, %g3 -@@ -80,65 +79,3 @@ vis1: ldub [%g6 + TI_FPSAVED], %g3 - .align 32 - 80: jmpl %g7 + %g0, %g0 - nop -- --6: ldub [%g3 + TI_FPSAVED], %o5 -- or %o5, FPRS_DU, %o5 -- add %g6, TI_FPREGS+0x80, %g2 -- stb %o5, [%g3 + TI_FPSAVED] -- -- sll %g1, 5, %g1 -- add %g6, TI_FPREGS+0xc0, %g3 -- wr %g0, FPRS_FEF, %fprs -- membar #Sync -- stda %f32, [%g2 + %g1] ASI_BLK_P -- stda %f48, [%g3 + %g1] ASI_BLK_P -- membar #Sync -- ba,pt %xcc, 80f -- nop -- -- .align 32 --80: jmpl %g7 + %g0, %g0 -- nop -- -- .align 32 --VISenterhalf: -- ldub [%g6 + TI_FPDEPTH], %g1 -- brnz,a,pn %g1, 1f -- cmp %g1, 1 -- stb %g0, [%g6 + TI_FPSAVED] -- stx %fsr, [%g6 + TI_XFSR] -- clr %o5 -- jmpl %g7 + %g0, %g0 -- wr %g0, FPRS_FEF, %fprs -- --1: bne,pn %icc, 2f -- srl %g1, 1, %g1 -- ba,pt %xcc, vis1 -- sub %g7, 8, %g7 --2: addcc %g6, %g1, %g3 -- sll %g1, 3, %g1 -- andn %o5, FPRS_DU, %g2 -- stb %g2, [%g3 + TI_FPSAVED] -- -- rd %gsr, %g2 -- add %g6, %g1, %g3 -- stx %g2, [%g3 + TI_GSR] -- add %g6, %g1, %g2 -- stx %fsr, [%g2 + TI_XFSR] -- sll %g1, 5, %g1 --3: andcc %o5, FPRS_DL, %g0 -- be,pn %icc, 4f -- add %g6, TI_FPREGS, %g2 -- -- add %g6, TI_FPREGS+0x40, %g3 -- membar #Sync -- stda %f0, [%g2 + %g1] ASI_BLK_P -- stda %f16, [%g3 + %g1] ASI_BLK_P -- membar #Sync -- ba,pt %xcc, 4f -- nop -- -- .align 32 --4: and %o5, FPRS_DU, %o5 -- jmpl %g7 + %g0, %g0 -- wr %o5, FPRS_FEF, %fprs -diff --git a/arch/sparc/lib/ksyms.c b/arch/sparc/lib/ksyms.c -index 323335b..ac094de 100644 ---- a/arch/sparc/lib/ksyms.c -+++ b/arch/sparc/lib/ksyms.c -@@ -126,10 +126,6 @@ EXPORT_SYMBOL(copy_user_page); - void VISenter(void); - EXPORT_SYMBOL(VISenter); - --/* CRYPTO code needs this */ --void VISenterhalf(void); --EXPORT_SYMBOL(VISenterhalf); -- - extern void xor_vis_2(unsigned long, unsigned long *, unsigned long *); - extern void xor_vis_3(unsigned long, unsigned long *, unsigned long *, - unsigned long *); -diff --git a/arch/x86/kvm/lapic.h b/arch/x86/kvm/lapic.h -index 6a11845..7205173 100644 ---- a/arch/x86/kvm/lapic.h -+++ b/arch/x86/kvm/lapic.h -@@ -165,7 +165,7 @@ static inline u16 apic_logical_id(struct kvm_apic_map *map, u32 ldr) - - static inline bool kvm_apic_has_events(struct kvm_vcpu *vcpu) - { -- return vcpu->arch.apic->pending_events; -+ return kvm_vcpu_has_lapic(vcpu) && vcpu->arch.apic->pending_events; - } - - bool kvm_apic_pending_eoi(struct kvm_vcpu *vcpu, int vector); -diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c -index 201d09a..2302f10 100644 ---- a/arch/x86/xen/enlighten.c -+++ b/arch/x86/xen/enlighten.c -@@ -481,6 +481,7 @@ static void set_aliased_prot(void *v, pgprot_t prot) - pte_t pte; - unsigned long pfn; - struct page *page; -+ unsigned char dummy; - - ptep = lookup_address((unsigned long)v, &level); - BUG_ON(ptep == NULL); -@@ -490,6 +491,32 @@ static void set_aliased_prot(void *v, pgprot_t prot) - - pte = pfn_pte(pfn, prot); - -+ /* -+ * Careful: update_va_mapping() will fail if the virtual address -+ * we're poking isn't populated in the page tables. We don't -+ * need to worry about the direct map (that's always in the page -+ * tables), but we need to be careful about vmap space. In -+ * particular, the top level page table can lazily propagate -+ * entries between processes, so if we've switched mms since we -+ * vmapped the target in the first place, we might not have the -+ * top-level page table entry populated. -+ * -+ * We disable preemption because we want the same mm active when -+ * we probe the target and when we issue the hypercall. We'll -+ * have the same nominal mm, but if we're a kernel thread, lazy -+ * mm dropping could change our pgd. -+ * -+ * Out of an abundance of caution, this uses __get_user() to fault -+ * in the target address just in case there's some obscure case -+ * in which the target address isn't readable. -+ */ -+ -+ preempt_disable(); -+ -+ pagefault_disable(); /* Avoid warnings due to being atomic. */ -+ __get_user(dummy, (unsigned char __user __force *)v); -+ pagefault_enable(); -+ - if (HYPERVISOR_update_va_mapping((unsigned long)v, pte, 0)) - BUG(); - -@@ -501,6 +528,8 @@ static void set_aliased_prot(void *v, pgprot_t prot) - BUG(); - } else - kmap_flush_unused(); -+ -+ preempt_enable(); - } - - static void xen_alloc_ldt(struct desc_struct *ldt, unsigned entries) -@@ -508,6 +537,17 @@ static void xen_alloc_ldt(struct desc_struct *ldt, unsigned entries) - const unsigned entries_per_page = PAGE_SIZE / LDT_ENTRY_SIZE; - int i; - -+ /* -+ * We need to mark the all aliases of the LDT pages RO. We -+ * don't need to call vm_flush_aliases(), though, since that's -+ * only responsible for flushing aliases out the TLBs, not the -+ * page tables, and Xen will flush the TLB for us if needed. -+ * -+ * To avoid confusing future readers: none of this is necessary -+ * to load the LDT. The hypervisor only checks this when the -+ * LDT is faulted in due to subsequent descriptor access. -+ */ -+ - for(i = 0; i < entries; i += entries_per_page) - set_aliased_prot(ldt + i, PAGE_KERNEL_RO); - } -diff --git a/drivers/block/rbd.c b/drivers/block/rbd.c -index 12be7cb..b583773 100644 ---- a/drivers/block/rbd.c -+++ b/drivers/block/rbd.c -@@ -508,6 +508,7 @@ void rbd_warn(struct rbd_device *rbd_dev, const char *fmt, ...) - # define rbd_assert(expr) ((void) 0) - #endif /* !RBD_DEBUG */ - -+static void rbd_osd_copyup_callback(struct rbd_obj_request *obj_request); - static int rbd_img_obj_request_submit(struct rbd_obj_request *obj_request); - static void rbd_img_parent_read(struct rbd_obj_request *obj_request); - static void rbd_dev_remove_parent(struct rbd_device *rbd_dev); -@@ -1651,6 +1652,16 @@ static void rbd_osd_stat_callback(struct rbd_obj_request *obj_request) - obj_request_done_set(obj_request); - } - -+static void rbd_osd_call_callback(struct rbd_obj_request *obj_request) -+{ -+ dout("%s: obj %p\n", __func__, obj_request); -+ -+ if (obj_request_img_data_test(obj_request)) -+ rbd_osd_copyup_callback(obj_request); -+ else -+ obj_request_done_set(obj_request); -+} -+ - static void rbd_osd_req_callback(struct ceph_osd_request *osd_req, - struct ceph_msg *msg) - { -@@ -1689,6 +1700,8 @@ static void rbd_osd_req_callback(struct ceph_osd_request *osd_req, - rbd_osd_stat_callback(obj_request); - break; - case CEPH_OSD_OP_CALL: -+ rbd_osd_call_callback(obj_request); -+ break; - case CEPH_OSD_OP_NOTIFY_ACK: - case CEPH_OSD_OP_WATCH: - rbd_osd_trivial_callback(obj_request); -@@ -2275,13 +2288,15 @@ out_unwind: - } - - static void --rbd_img_obj_copyup_callback(struct rbd_obj_request *obj_request) -+rbd_osd_copyup_callback(struct rbd_obj_request *obj_request) - { - struct rbd_img_request *img_request; - struct rbd_device *rbd_dev; - struct page **pages; - u32 page_count; - -+ dout("%s: obj %p\n", __func__, obj_request); -+ - rbd_assert(obj_request->type == OBJ_REQUEST_BIO); - rbd_assert(obj_request_img_data_test(obj_request)); - img_request = obj_request->img_request; -@@ -2307,9 +2322,7 @@ rbd_img_obj_copyup_callback(struct rbd_obj_request *obj_request) - if (!obj_request->result) - obj_request->xferred = obj_request->length; - -- /* Finish up with the normal image object callback */ -- -- rbd_img_obj_callback(obj_request); -+ obj_request_done_set(obj_request); - } - - static void -@@ -2406,7 +2419,6 @@ rbd_img_obj_parent_read_full_callback(struct rbd_img_request *img_request) - - /* All set, send it off. */ - -- orig_request->callback = rbd_img_obj_copyup_callback; - osdc = &rbd_dev->rbd_client->client->osdc; - img_result = rbd_obj_request_submit(osdc, orig_request); - if (!img_result) -diff --git a/drivers/crypto/ixp4xx_crypto.c b/drivers/crypto/ixp4xx_crypto.c -index f757a0f..3beed38 100644 ---- a/drivers/crypto/ixp4xx_crypto.c -+++ b/drivers/crypto/ixp4xx_crypto.c -@@ -904,7 +904,6 @@ static int ablk_perform(struct ablkcipher_request *req, int encrypt) - crypt->mode |= NPE_OP_NOT_IN_PLACE; - /* This was never tested by Intel - * for more than one dst buffer, I think. */ -- BUG_ON(req->dst->length < nbytes); - req_ctx->dst = NULL; - if (!chainup_buffers(dev, req->dst, nbytes, &dst_hook, - flags, DMA_FROM_DEVICE)) -diff --git a/drivers/gpu/drm/radeon/radeon_combios.c b/drivers/gpu/drm/radeon/radeon_combios.c -index 6651177..79a2669 100644 ---- a/drivers/gpu/drm/radeon/radeon_combios.c -+++ b/drivers/gpu/drm/radeon/radeon_combios.c -@@ -1255,10 +1255,15 @@ struct radeon_encoder_lvds *radeon_combios_get_lvds_info(struct radeon_encoder - - if ((RBIOS16(tmp) == lvds->native_mode.hdisplay) && - (RBIOS16(tmp + 2) == lvds->native_mode.vdisplay)) { -+ u32 hss = (RBIOS16(tmp + 21) - RBIOS16(tmp + 19) - 1) * 8; -+ -+ if (hss > lvds->native_mode.hdisplay) -+ hss = (10 - 1) * 8; -+ - lvds->native_mode.htotal = lvds->native_mode.hdisplay + - (RBIOS16(tmp + 17) - RBIOS16(tmp + 19)) * 8; - lvds->native_mode.hsync_start = lvds->native_mode.hdisplay + -- (RBIOS16(tmp + 21) - RBIOS16(tmp + 19) - 1) * 8; -+ hss; - lvds->native_mode.hsync_end = lvds->native_mode.hsync_start + - (RBIOS8(tmp + 23) * 8); - -diff --git a/drivers/md/bitmap.c b/drivers/md/bitmap.c -index 8e51b3a..cc3dc0c 100644 ---- a/drivers/md/bitmap.c -+++ b/drivers/md/bitmap.c -@@ -564,6 +564,8 @@ static int bitmap_read_sb(struct bitmap *bitmap) - if (err) - return err; - -+ err = -EINVAL; -+ - sb = kmap_atomic(sb_page); - - chunksize = le32_to_cpu(sb->chunksize); -diff --git a/drivers/md/md.c b/drivers/md/md.c -index b4067b9..2ffd277 100644 ---- a/drivers/md/md.c -+++ b/drivers/md/md.c -@@ -5645,8 +5645,7 @@ static int get_bitmap_file(struct mddev * mddev, void __user * arg) - char *ptr, *buf = NULL; - int err = -ENOMEM; - -- file = kmalloc(sizeof(*file), GFP_NOIO); -- -+ file = kzalloc(sizeof(*file), GFP_NOIO); - if (!file) - goto out; - -diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c -index 9be97e0..47b7c31 100644 ---- a/drivers/md/raid1.c -+++ b/drivers/md/raid1.c -@@ -1477,6 +1477,7 @@ static void error(struct mddev *mddev, struct md_rdev *rdev) - { - char b[BDEVNAME_SIZE]; - struct r1conf *conf = mddev->private; -+ unsigned long flags; - - /* - * If it is not operational, then we have already marked it as dead -@@ -1496,14 +1497,13 @@ static void error(struct mddev *mddev, struct md_rdev *rdev) - return; - } - set_bit(Blocked, &rdev->flags); -+ spin_lock_irqsave(&conf->device_lock, flags); - if (test_and_clear_bit(In_sync, &rdev->flags)) { -- unsigned long flags; -- spin_lock_irqsave(&conf->device_lock, flags); - mddev->degraded++; - set_bit(Faulty, &rdev->flags); -- spin_unlock_irqrestore(&conf->device_lock, flags); - } else - set_bit(Faulty, &rdev->flags); -+ spin_unlock_irqrestore(&conf->device_lock, flags); - /* - * if recovery is running, make sure it aborts. - */ -@@ -1569,7 +1569,10 @@ static int raid1_spare_active(struct mddev *mddev) - * Find all failed disks within the RAID1 configuration - * and mark them readable. - * Called under mddev lock, so rcu protection not needed. -+ * device_lock used to avoid races with raid1_end_read_request -+ * which expects 'In_sync' flags and ->degraded to be consistent. - */ -+ spin_lock_irqsave(&conf->device_lock, flags); - for (i = 0; i < conf->raid_disks; i++) { - struct md_rdev *rdev = conf->mirrors[i].rdev; - struct md_rdev *repl = conf->mirrors[conf->raid_disks + i].rdev; -@@ -1599,7 +1602,6 @@ static int raid1_spare_active(struct mddev *mddev) - sysfs_notify_dirent_safe(rdev->sysfs_state); - } - } -- spin_lock_irqsave(&conf->device_lock, flags); - mddev->degraded -= count; - spin_unlock_irqrestore(&conf->device_lock, flags); - -diff --git a/drivers/scsi/ipr.c b/drivers/scsi/ipr.c -index b4ddb73..128dc2f 100644 ---- a/drivers/scsi/ipr.c -+++ b/drivers/scsi/ipr.c -@@ -592,9 +592,10 @@ static void ipr_trc_hook(struct ipr_cmnd *ipr_cmd, - { - struct ipr_trace_entry *trace_entry; - struct ipr_ioa_cfg *ioa_cfg = ipr_cmd->ioa_cfg; -+ unsigned int trace_index; - -- trace_entry = &ioa_cfg->trace[atomic_add_return -- (1, &ioa_cfg->trace_index)%IPR_NUM_TRACE_ENTRIES]; -+ trace_index = atomic_add_return(1, &ioa_cfg->trace_index) & IPR_TRACE_INDEX_MASK; -+ trace_entry = &ioa_cfg->trace[trace_index]; - trace_entry->time = jiffies; - trace_entry->op_code = ipr_cmd->ioarcb.cmd_pkt.cdb[0]; - trace_entry->type = type; -@@ -1044,10 +1045,15 @@ static void ipr_send_blocking_cmd(struct ipr_cmnd *ipr_cmd, - - static int ipr_get_hrrq_index(struct ipr_ioa_cfg *ioa_cfg) - { -+ unsigned int hrrq; -+ - if (ioa_cfg->hrrq_num == 1) -- return 0; -- else -- return (atomic_add_return(1, &ioa_cfg->hrrq_index) % (ioa_cfg->hrrq_num - 1)) + 1; -+ hrrq = 0; -+ else { -+ hrrq = atomic_add_return(1, &ioa_cfg->hrrq_index); -+ hrrq = (hrrq % (ioa_cfg->hrrq_num - 1)) + 1; -+ } -+ return hrrq; - } - - /** -@@ -6179,21 +6185,23 @@ static void ipr_scsi_done(struct ipr_cmnd *ipr_cmd) - struct ipr_ioa_cfg *ioa_cfg = ipr_cmd->ioa_cfg; - struct scsi_cmnd *scsi_cmd = ipr_cmd->scsi_cmd; - u32 ioasc = be32_to_cpu(ipr_cmd->s.ioasa.hdr.ioasc); -- unsigned long hrrq_flags; -+ unsigned long lock_flags; - - scsi_set_resid(scsi_cmd, be32_to_cpu(ipr_cmd->s.ioasa.hdr.residual_data_len)); - - if (likely(IPR_IOASC_SENSE_KEY(ioasc) == 0)) { - scsi_dma_unmap(scsi_cmd); - -- spin_lock_irqsave(ipr_cmd->hrrq->lock, hrrq_flags); -+ spin_lock_irqsave(ipr_cmd->hrrq->lock, lock_flags); - list_add_tail(&ipr_cmd->queue, &ipr_cmd->hrrq->hrrq_free_q); - scsi_cmd->scsi_done(scsi_cmd); -- spin_unlock_irqrestore(ipr_cmd->hrrq->lock, hrrq_flags); -+ spin_unlock_irqrestore(ipr_cmd->hrrq->lock, lock_flags); - } else { -- spin_lock_irqsave(ipr_cmd->hrrq->lock, hrrq_flags); -+ spin_lock_irqsave(ioa_cfg->host->host_lock, lock_flags); -+ spin_lock(&ipr_cmd->hrrq->_lock); - ipr_erp_start(ioa_cfg, ipr_cmd); -- spin_unlock_irqrestore(ipr_cmd->hrrq->lock, hrrq_flags); -+ spin_unlock(&ipr_cmd->hrrq->_lock); -+ spin_unlock_irqrestore(ioa_cfg->host->host_lock, lock_flags); - } - } - -diff --git a/drivers/scsi/ipr.h b/drivers/scsi/ipr.h -index 02edae7..694ec20 100644 ---- a/drivers/scsi/ipr.h -+++ b/drivers/scsi/ipr.h -@@ -1459,6 +1459,7 @@ struct ipr_ioa_cfg { - - #define IPR_NUM_TRACE_INDEX_BITS 8 - #define IPR_NUM_TRACE_ENTRIES (1 << IPR_NUM_TRACE_INDEX_BITS) -+#define IPR_TRACE_INDEX_MASK (IPR_NUM_TRACE_ENTRIES - 1) - #define IPR_TRACE_SIZE (sizeof(struct ipr_trace_entry) * IPR_NUM_TRACE_ENTRIES) - char trace_start[8]; - #define IPR_TRACE_START_LABEL "trace" -diff --git a/drivers/scsi/sg.c b/drivers/scsi/sg.c -index eb81c98..721d839 100644 ---- a/drivers/scsi/sg.c -+++ b/drivers/scsi/sg.c -@@ -1694,6 +1694,9 @@ static int sg_start_req(Sg_request *srp, unsigned char *cmd) - md->from_user = 0; - } - -+ if (unlikely(iov_count > UIO_MAXIOV)) -+ return -EINVAL; -+ - if (iov_count) { - int len, size = sizeof(struct sg_iovec) * iov_count; - struct iovec *iov; -diff --git a/drivers/target/iscsi/iscsi_target.c b/drivers/target/iscsi/iscsi_target.c -index 55ec9b4..9dbf176 100644 ---- a/drivers/target/iscsi/iscsi_target.c -+++ b/drivers/target/iscsi/iscsi_target.c -@@ -3937,7 +3937,13 @@ get_immediate: - } - - transport_err: -- iscsit_take_action_for_connection_exit(conn); -+ /* -+ * Avoid the normal connection failure code-path if this connection -+ * is still within LOGIN mode, and iscsi_np process context is -+ * responsible for cleaning up the early connection failure. -+ */ -+ if (conn->conn_state != TARG_CONN_STATE_IN_LOGIN) -+ iscsit_take_action_for_connection_exit(conn); - out: - return 0; - } -@@ -4023,7 +4029,7 @@ reject: - - int iscsi_target_rx_thread(void *arg) - { -- int ret; -+ int ret, rc; - u8 buffer[ISCSI_HDR_LEN], opcode; - u32 checksum = 0, digest = 0; - struct iscsi_conn *conn = arg; -@@ -4033,10 +4039,16 @@ int iscsi_target_rx_thread(void *arg) - * connection recovery / failure event can be triggered externally. - */ - allow_signal(SIGINT); -+ /* -+ * Wait for iscsi_post_login_handler() to complete before allowing -+ * incoming iscsi/tcp socket I/O, and/or failing the connection. -+ */ -+ rc = wait_for_completion_interruptible(&conn->rx_login_comp); -+ if (rc < 0) -+ return 0; - - if (conn->conn_transport->transport_type == ISCSI_INFINIBAND) { - struct completion comp; -- int rc; - - init_completion(&comp); - rc = wait_for_completion_interruptible(&comp); -diff --git a/drivers/target/iscsi/iscsi_target_core.h b/drivers/target/iscsi/iscsi_target_core.h -index 825b579..92abbe2 100644 ---- a/drivers/target/iscsi/iscsi_target_core.h -+++ b/drivers/target/iscsi/iscsi_target_core.h -@@ -604,6 +604,7 @@ struct iscsi_conn { - int bitmap_id; - int rx_thread_active; - struct task_struct *rx_thread; -+ struct completion rx_login_comp; - int tx_thread_active; - struct task_struct *tx_thread; - /* list_head for session connection list */ -diff --git a/drivers/target/iscsi/iscsi_target_login.c b/drivers/target/iscsi/iscsi_target_login.c -index 449df09..01c27aa 100644 ---- a/drivers/target/iscsi/iscsi_target_login.c -+++ b/drivers/target/iscsi/iscsi_target_login.c -@@ -83,6 +83,7 @@ static struct iscsi_login *iscsi_login_init_conn(struct iscsi_conn *conn) - init_completion(&conn->conn_logout_comp); - init_completion(&conn->rx_half_close_comp); - init_completion(&conn->tx_half_close_comp); -+ init_completion(&conn->rx_login_comp); - spin_lock_init(&conn->cmd_lock); - spin_lock_init(&conn->conn_usage_lock); - spin_lock_init(&conn->immed_queue_lock); -@@ -716,6 +717,7 @@ int iscsit_start_kthreads(struct iscsi_conn *conn) - - return 0; - out_tx: -+ send_sig(SIGINT, conn->tx_thread, 1); - kthread_stop(conn->tx_thread); - conn->tx_thread_active = false; - out_bitmap: -@@ -726,7 +728,7 @@ out_bitmap: - return ret; - } - --int iscsi_post_login_handler( -+void iscsi_post_login_handler( - struct iscsi_np *np, - struct iscsi_conn *conn, - u8 zero_tsih) -@@ -736,7 +738,6 @@ int iscsi_post_login_handler( - struct se_session *se_sess = sess->se_sess; - struct iscsi_portal_group *tpg = sess->tpg; - struct se_portal_group *se_tpg = &tpg->tpg_se_tpg; -- int rc; - - iscsit_inc_conn_usage_count(conn); - -@@ -777,10 +778,6 @@ int iscsi_post_login_handler( - sess->sess_ops->InitiatorName); - spin_unlock_bh(&sess->conn_lock); - -- rc = iscsit_start_kthreads(conn); -- if (rc) -- return rc; -- - iscsi_post_login_start_timers(conn); - /* - * Determine CPU mask to ensure connection's RX and TX kthreads -@@ -789,15 +786,20 @@ int iscsi_post_login_handler( - iscsit_thread_get_cpumask(conn); - conn->conn_rx_reset_cpumask = 1; - conn->conn_tx_reset_cpumask = 1; -- -+ /* -+ * Wakeup the sleeping iscsi_target_rx_thread() now that -+ * iscsi_conn is in TARG_CONN_STATE_LOGGED_IN state. -+ */ -+ complete(&conn->rx_login_comp); - iscsit_dec_conn_usage_count(conn); -+ - if (stop_timer) { - spin_lock_bh(&se_tpg->session_lock); - iscsit_stop_time2retain_timer(sess); - spin_unlock_bh(&se_tpg->session_lock); - } - iscsit_dec_session_usage_count(sess); -- return 0; -+ return; - } - - iscsi_set_session_parameters(sess->sess_ops, conn->param_list, 1); -@@ -838,10 +840,6 @@ int iscsi_post_login_handler( - " iSCSI Target Portal Group: %hu\n", tpg->nsessions, tpg->tpgt); - spin_unlock_bh(&se_tpg->session_lock); - -- rc = iscsit_start_kthreads(conn); -- if (rc) -- return rc; -- - iscsi_post_login_start_timers(conn); - /* - * Determine CPU mask to ensure connection's RX and TX kthreads -@@ -850,10 +848,12 @@ int iscsi_post_login_handler( - iscsit_thread_get_cpumask(conn); - conn->conn_rx_reset_cpumask = 1; - conn->conn_tx_reset_cpumask = 1; -- -+ /* -+ * Wakeup the sleeping iscsi_target_rx_thread() now that -+ * iscsi_conn is in TARG_CONN_STATE_LOGGED_IN state. -+ */ -+ complete(&conn->rx_login_comp); - iscsit_dec_conn_usage_count(conn); -- -- return 0; - } - - static void iscsi_handle_login_thread_timeout(unsigned long data) -@@ -1418,23 +1418,12 @@ static int __iscsi_target_login_thread(struct iscsi_np *np) - if (ret < 0) - goto new_sess_out; - -- if (!conn->sess) { -- pr_err("struct iscsi_conn session pointer is NULL!\n"); -- goto new_sess_out; -- } -- - iscsi_stop_login_thread_timer(np); - -- if (signal_pending(current)) -- goto new_sess_out; -- - if (ret == 1) { - tpg_np = conn->tpg_np; - -- ret = iscsi_post_login_handler(np, conn, zero_tsih); -- if (ret < 0) -- goto new_sess_out; -- -+ iscsi_post_login_handler(np, conn, zero_tsih); - iscsit_deaccess_np(np, tpg, tpg_np); - } - -diff --git a/drivers/target/iscsi/iscsi_target_login.h b/drivers/target/iscsi/iscsi_target_login.h -index 29d0983..55cbf45 100644 ---- a/drivers/target/iscsi/iscsi_target_login.h -+++ b/drivers/target/iscsi/iscsi_target_login.h -@@ -12,7 +12,8 @@ extern int iscsit_accept_np(struct iscsi_np *, struct iscsi_conn *); - extern int iscsit_get_login_rx(struct iscsi_conn *, struct iscsi_login *); - extern int iscsit_put_login_tx(struct iscsi_conn *, struct iscsi_login *, u32); - extern void iscsit_free_conn(struct iscsi_np *, struct iscsi_conn *); --extern int iscsi_post_login_handler(struct iscsi_np *, struct iscsi_conn *, u8); -+extern int iscsit_start_kthreads(struct iscsi_conn *); -+extern void iscsi_post_login_handler(struct iscsi_np *, struct iscsi_conn *, u8); - extern void iscsi_target_login_sess_out(struct iscsi_conn *, struct iscsi_np *, - bool, bool); - extern int iscsi_target_login_thread(void *); -diff --git a/drivers/target/iscsi/iscsi_target_nego.c b/drivers/target/iscsi/iscsi_target_nego.c -index 582ba84..25ad113 100644 ---- a/drivers/target/iscsi/iscsi_target_nego.c -+++ b/drivers/target/iscsi/iscsi_target_nego.c -@@ -17,6 +17,7 @@ - ******************************************************************************/ - - #include <linux/ctype.h> -+#include <linux/kthread.h> - #include <scsi/iscsi_proto.h> - #include <target/target_core_base.h> - #include <target/target_core_fabric.h> -@@ -361,10 +362,24 @@ static int iscsi_target_do_tx_login_io(struct iscsi_conn *conn, struct iscsi_log - ntohl(login_rsp->statsn), login->rsp_length); - - padding = ((-login->rsp_length) & 3); -+ /* -+ * Before sending the last login response containing the transition -+ * bit for full-feature-phase, go ahead and start up TX/RX threads -+ * now to avoid potential resource allocation failures after the -+ * final login response has been sent. -+ */ -+ if (login->login_complete) { -+ int rc = iscsit_start_kthreads(conn); -+ if (rc) { -+ iscsit_tx_login_rsp(conn, ISCSI_STATUS_CLS_TARGET_ERR, -+ ISCSI_LOGIN_STATUS_NO_RESOURCES); -+ return -1; -+ } -+ } - - if (conn->conn_transport->iscsit_put_login_tx(conn, login, - login->rsp_length + padding) < 0) -- return -1; -+ goto err; - - login->rsp_length = 0; - mutex_lock(&sess->cmdsn_mutex); -@@ -373,6 +388,23 @@ static int iscsi_target_do_tx_login_io(struct iscsi_conn *conn, struct iscsi_log - mutex_unlock(&sess->cmdsn_mutex); - - return 0; -+ -+err: -+ if (login->login_complete) { -+ if (conn->rx_thread && conn->rx_thread_active) { -+ send_sig(SIGINT, conn->rx_thread, 1); -+ kthread_stop(conn->rx_thread); -+ } -+ if (conn->tx_thread && conn->tx_thread_active) { -+ send_sig(SIGINT, conn->tx_thread, 1); -+ kthread_stop(conn->tx_thread); -+ } -+ spin_lock(&iscsit_global->ts_bitmap_lock); -+ bitmap_release_region(iscsit_global->ts_bitmap, conn->bitmap_id, -+ get_order(1)); -+ spin_unlock(&iscsit_global->ts_bitmap_lock); -+ } -+ return -1; - } - - static void iscsi_target_sk_data_ready(struct sock *sk, int count) -diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c -index bcc43a2..a365e97 100644 ---- a/drivers/usb/host/xhci-ring.c -+++ b/drivers/usb/host/xhci-ring.c -@@ -86,7 +86,7 @@ dma_addr_t xhci_trb_virt_to_dma(struct xhci_segment *seg, - return 0; - /* offset in TRBs */ - segment_offset = trb - seg->trbs; -- if (segment_offset > TRBS_PER_SEGMENT) -+ if (segment_offset >= TRBS_PER_SEGMENT) - return 0; - return seg->dma + (segment_offset * sizeof(*trb)); - } -diff --git a/drivers/usb/serial/sierra.c b/drivers/usb/serial/sierra.c -index 74a9375..89c55d4 100644 ---- a/drivers/usb/serial/sierra.c -+++ b/drivers/usb/serial/sierra.c -@@ -289,6 +289,7 @@ static const struct usb_device_id id_table[] = { - { USB_DEVICE_AND_INTERFACE_INFO(0x1199, 0x68AA, 0xFF, 0xFF, 0xFF), - .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist - }, -+ { USB_DEVICE(0x1199, 0x68AB) }, /* Sierra Wireless AR8550 */ - /* AT&T Direct IP LTE modems */ - { USB_DEVICE_AND_INTERFACE_INFO(0x0F3D, 0x68AA, 0xFF, 0xFF, 0xFF), - .driver_info = (kernel_ulong_t)&direct_ip_interface_blacklist -diff --git a/drivers/xen/gntdev.c b/drivers/xen/gntdev.c -index 073b4a1..ff3c98f 100644 ---- a/drivers/xen/gntdev.c -+++ b/drivers/xen/gntdev.c -@@ -529,12 +529,14 @@ static int gntdev_release(struct inode *inode, struct file *flip) - - pr_debug("priv %p\n", priv); - -+ mutex_lock(&priv->lock); - while (!list_empty(&priv->maps)) { - map = list_entry(priv->maps.next, struct grant_map, next); - list_del(&map->next); - gntdev_put_map(NULL /* already removed */, map); - } - WARN_ON(!list_empty(&priv->freeable_maps)); -+ mutex_unlock(&priv->lock); - - if (use_ptemod) - mmu_notifier_unregister(&priv->mn, priv->mm); -diff --git a/fs/dcache.c b/fs/dcache.c -index 3d2f27b..df323f8 100644 ---- a/fs/dcache.c -+++ b/fs/dcache.c -@@ -244,17 +244,8 @@ static void __d_free(struct rcu_head *head) - kmem_cache_free(dentry_cache, dentry); - } - --/* -- * no locks, please. -- */ --static void d_free(struct dentry *dentry) -+static void dentry_free(struct dentry *dentry) - { -- WARN_ON(!hlist_unhashed(&dentry->d_u.d_alias)); -- BUG_ON((int)dentry->d_lockref.count > 0); -- this_cpu_dec(nr_dentry); -- if (dentry->d_op && dentry->d_op->d_release) -- dentry->d_op->d_release(dentry); -- - /* if dentry was never visible to RCU, immediate free is OK */ - if (!(dentry->d_flags & DCACHE_RCUACCESS)) - __d_free(&dentry->d_u.d_rcu); -@@ -402,56 +393,6 @@ static void dentry_lru_add(struct dentry *dentry) - d_lru_add(dentry); - } - --/* -- * Remove a dentry with references from the LRU. -- * -- * If we are on the shrink list, then we can get to try_prune_one_dentry() and -- * lose our last reference through the parent walk. In this case, we need to -- * remove ourselves from the shrink list, not the LRU. -- */ --static void dentry_lru_del(struct dentry *dentry) --{ -- if (dentry->d_flags & DCACHE_LRU_LIST) { -- if (dentry->d_flags & DCACHE_SHRINK_LIST) -- return d_shrink_del(dentry); -- d_lru_del(dentry); -- } --} -- --/** -- * d_kill - kill dentry and return parent -- * @dentry: dentry to kill -- * @parent: parent dentry -- * -- * The dentry must already be unhashed and removed from the LRU. -- * -- * If this is the root of the dentry tree, return NULL. -- * -- * dentry->d_lock and parent->d_lock must be held by caller, and are dropped by -- * d_kill. -- */ --static struct dentry *d_kill(struct dentry *dentry, struct dentry *parent) -- __releases(dentry->d_lock) -- __releases(parent->d_lock) -- __releases(dentry->d_inode->i_lock) --{ -- __list_del_entry(&dentry->d_child); -- /* -- * Inform d_walk() that we are no longer attached to the -- * dentry tree -- */ -- dentry->d_flags |= DCACHE_DENTRY_KILLED; -- if (parent) -- spin_unlock(&parent->d_lock); -- dentry_iput(dentry); -- /* -- * dentry_iput drops the locks, at which point nobody (except -- * transient RCU lookups) can reach this dentry. -- */ -- d_free(dentry); -- return parent; --} -- - /** - * d_drop - drop a dentry - * @dentry: dentry to drop -@@ -509,7 +450,14 @@ dentry_kill(struct dentry *dentry, int unlock_on_failure) - __releases(dentry->d_lock) - { - struct inode *inode; -- struct dentry *parent; -+ struct dentry *parent = NULL; -+ bool can_free = true; -+ -+ if (unlikely(dentry->d_flags & DCACHE_DENTRY_KILLED)) { -+ can_free = dentry->d_flags & DCACHE_MAY_FREE; -+ spin_unlock(&dentry->d_lock); -+ goto out; -+ } - - inode = dentry->d_inode; - if (inode && !spin_trylock(&inode->i_lock)) { -@@ -520,9 +468,7 @@ relock: - } - return dentry; /* try again with same dentry */ - } -- if (IS_ROOT(dentry)) -- parent = NULL; -- else -+ if (!IS_ROOT(dentry)) - parent = dentry->d_parent; - if (parent && !spin_trylock(&parent->d_lock)) { - if (inode) -@@ -542,10 +488,40 @@ relock: - if ((dentry->d_flags & DCACHE_OP_PRUNE) && !d_unhashed(dentry)) - dentry->d_op->d_prune(dentry); - -- dentry_lru_del(dentry); -+ if (dentry->d_flags & DCACHE_LRU_LIST) { -+ if (!(dentry->d_flags & DCACHE_SHRINK_LIST)) -+ d_lru_del(dentry); -+ } - /* if it was on the hash then remove it */ - __d_drop(dentry); -- return d_kill(dentry, parent); -+ __list_del_entry(&dentry->d_child); -+ /* -+ * Inform d_walk() that we are no longer attached to the -+ * dentry tree -+ */ -+ dentry->d_flags |= DCACHE_DENTRY_KILLED; -+ if (parent) -+ spin_unlock(&parent->d_lock); -+ dentry_iput(dentry); -+ /* -+ * dentry_iput drops the locks, at which point nobody (except -+ * transient RCU lookups) can reach this dentry. -+ */ -+ BUG_ON((int)dentry->d_lockref.count > 0); -+ this_cpu_dec(nr_dentry); -+ if (dentry->d_op && dentry->d_op->d_release) -+ dentry->d_op->d_release(dentry); -+ -+ spin_lock(&dentry->d_lock); -+ if (dentry->d_flags & DCACHE_SHRINK_LIST) { -+ dentry->d_flags |= DCACHE_MAY_FREE; -+ can_free = false; -+ } -+ spin_unlock(&dentry->d_lock); -+out: -+ if (likely(can_free)) -+ dentry_free(dentry); -+ return parent; - } - - /* -@@ -817,65 +793,13 @@ restart: - } - EXPORT_SYMBOL(d_prune_aliases); - --/* -- * Try to throw away a dentry - free the inode, dput the parent. -- * Requires dentry->d_lock is held, and dentry->d_count == 0. -- * Releases dentry->d_lock. -- * -- * This may fail if locks cannot be acquired no problem, just try again. -- */ --static struct dentry * try_prune_one_dentry(struct dentry *dentry) -- __releases(dentry->d_lock) --{ -- struct dentry *parent; -- -- parent = dentry_kill(dentry, 0); -- /* -- * If dentry_kill returns NULL, we have nothing more to do. -- * if it returns the same dentry, trylocks failed. In either -- * case, just loop again. -- * -- * Otherwise, we need to prune ancestors too. This is necessary -- * to prevent quadratic behavior of shrink_dcache_parent(), but -- * is also expected to be beneficial in reducing dentry cache -- * fragmentation. -- */ -- if (!parent) -- return NULL; -- if (parent == dentry) -- return dentry; -- -- /* Prune ancestors. */ -- dentry = parent; -- while (dentry) { -- if (lockref_put_or_lock(&dentry->d_lockref)) -- return NULL; -- dentry = dentry_kill(dentry, 1); -- } -- return NULL; --} -- - static void shrink_dentry_list(struct list_head *list) - { -- struct dentry *dentry; -+ struct dentry *dentry, *parent; - -- rcu_read_lock(); -- for (;;) { -- dentry = list_entry_rcu(list->prev, struct dentry, d_lru); -- if (&dentry->d_lru == list) -- break; /* empty */ -- -- /* -- * Get the dentry lock, and re-verify that the dentry is -- * this on the shrinking list. If it is, we know that -- * DCACHE_SHRINK_LIST and DCACHE_LRU_LIST are set. -- */ -+ while (!list_empty(list)) { -+ dentry = list_entry(list->prev, struct dentry, d_lru); - spin_lock(&dentry->d_lock); -- if (dentry != list_entry(list->prev, struct dentry, d_lru)) { -- spin_unlock(&dentry->d_lock); -- continue; -- } -- - /* - * The dispose list is isolated and dentries are not accounted - * to the LRU here, so we can simply remove it from the list -@@ -887,30 +811,38 @@ static void shrink_dentry_list(struct list_head *list) - * We found an inuse dentry which was not removed from - * the LRU because of laziness during lookup. Do not free it. - */ -- if (dentry->d_lockref.count) { -+ if ((int)dentry->d_lockref.count > 0) { - spin_unlock(&dentry->d_lock); - continue; - } -- rcu_read_unlock(); - -+ parent = dentry_kill(dentry, 0); - /* -- * If 'try_to_prune()' returns a dentry, it will -- * be the same one we passed in, and d_lock will -- * have been held the whole time, so it will not -- * have been added to any other lists. We failed -- * to get the inode lock. -- * -- * We just add it back to the shrink list. -+ * If dentry_kill returns NULL, we have nothing more to do. - */ -- dentry = try_prune_one_dentry(dentry); -+ if (!parent) -+ continue; - -- rcu_read_lock(); -- if (dentry) { -+ if (unlikely(parent == dentry)) { -+ /* -+ * trylocks have failed and d_lock has been held the -+ * whole time, so it could not have been added to any -+ * other lists. Just add it back to the shrink list. -+ */ - d_shrink_add(dentry, list); - spin_unlock(&dentry->d_lock); -+ continue; - } -+ /* -+ * We need to prune ancestors too. This is necessary to prevent -+ * quadratic behavior of shrink_dcache_parent(), but is also -+ * expected to be beneficial in reducing dentry cache -+ * fragmentation. -+ */ -+ dentry = parent; -+ while (dentry && !lockref_put_or_lock(&dentry->d_lockref)) -+ dentry = dentry_kill(dentry, 1); - } -- rcu_read_unlock(); - } - - static enum lru_status -@@ -1264,34 +1196,23 @@ static enum d_walk_ret select_collect(void *_data, struct dentry *dentry) - if (data->start == dentry) - goto out; - -- /* -- * move only zero ref count dentries to the dispose list. -- * -- * Those which are presently on the shrink list, being processed -- * by shrink_dentry_list(), shouldn't be moved. Otherwise the -- * loop in shrink_dcache_parent() might not make any progress -- * and loop forever. -- */ -- if (dentry->d_lockref.count) { -- dentry_lru_del(dentry); -- } else if (!(dentry->d_flags & DCACHE_SHRINK_LIST)) { -- /* -- * We can't use d_lru_shrink_move() because we -- * need to get the global LRU lock and do the -- * LRU accounting. -- */ -- d_lru_del(dentry); -- d_shrink_add(dentry, &data->dispose); -+ if (dentry->d_flags & DCACHE_SHRINK_LIST) { - data->found++; -- ret = D_WALK_NORETRY; -+ } else { -+ if (dentry->d_flags & DCACHE_LRU_LIST) -+ d_lru_del(dentry); -+ if (!dentry->d_lockref.count) { -+ d_shrink_add(dentry, &data->dispose); -+ data->found++; -+ } - } - /* - * We can return to the caller if we have found some (this - * ensures forward progress). We'll be coming back to find - * the rest. - */ -- if (data->found && need_resched()) -- ret = D_WALK_QUIT; -+ if (!list_empty(&data->dispose)) -+ ret = need_resched() ? D_WALK_QUIT : D_WALK_NORETRY; - out: - return ret; - } -@@ -1321,45 +1242,35 @@ void shrink_dcache_parent(struct dentry *parent) - } - EXPORT_SYMBOL(shrink_dcache_parent); - --static enum d_walk_ret umount_collect(void *_data, struct dentry *dentry) -+static enum d_walk_ret umount_check(void *_data, struct dentry *dentry) - { -- struct select_data *data = _data; -- enum d_walk_ret ret = D_WALK_CONTINUE; -+ /* it has busy descendents; complain about those instead */ -+ if (!list_empty(&dentry->d_subdirs)) -+ return D_WALK_CONTINUE; - -- if (dentry->d_lockref.count) { -- dentry_lru_del(dentry); -- if (likely(!list_empty(&dentry->d_subdirs))) -- goto out; -- if (dentry == data->start && dentry->d_lockref.count == 1) -- goto out; -- printk(KERN_ERR -- "BUG: Dentry %p{i=%lx,n=%s}" -- " still in use (%d)" -- " [unmount of %s %s]\n", -+ /* root with refcount 1 is fine */ -+ if (dentry == _data && dentry->d_lockref.count == 1) -+ return D_WALK_CONTINUE; -+ -+ printk(KERN_ERR "BUG: Dentry %p{i=%lx,n=%pd} " -+ " still in use (%d) [unmount of %s %s]\n", - dentry, - dentry->d_inode ? - dentry->d_inode->i_ino : 0UL, -- dentry->d_name.name, -+ dentry, - dentry->d_lockref.count, - dentry->d_sb->s_type->name, - dentry->d_sb->s_id); -- BUG(); -- } else if (!(dentry->d_flags & DCACHE_SHRINK_LIST)) { -- /* -- * We can't use d_lru_shrink_move() because we -- * need to get the global LRU lock and do the -- * LRU accounting. -- */ -- if (dentry->d_flags & DCACHE_LRU_LIST) -- d_lru_del(dentry); -- d_shrink_add(dentry, &data->dispose); -- data->found++; -- ret = D_WALK_NORETRY; -- } --out: -- if (data->found && need_resched()) -- ret = D_WALK_QUIT; -- return ret; -+ WARN_ON(1); -+ return D_WALK_CONTINUE; -+} -+ -+static void do_one_tree(struct dentry *dentry) -+{ -+ shrink_dcache_parent(dentry); -+ d_walk(dentry, dentry, umount_check, NULL); -+ d_drop(dentry); -+ dput(dentry); - } - - /* -@@ -1369,40 +1280,15 @@ void shrink_dcache_for_umount(struct super_block *sb) - { - struct dentry *dentry; - -- if (down_read_trylock(&sb->s_umount)) -- BUG(); -+ WARN(down_read_trylock(&sb->s_umount), "s_umount should've been locked"); - - dentry = sb->s_root; - sb->s_root = NULL; -- for (;;) { -- struct select_data data; -- -- INIT_LIST_HEAD(&data.dispose); -- data.start = dentry; -- data.found = 0; -- -- d_walk(dentry, &data, umount_collect, NULL); -- if (!data.found) -- break; -- -- shrink_dentry_list(&data.dispose); -- cond_resched(); -- } -- d_drop(dentry); -- dput(dentry); -+ do_one_tree(dentry); - - while (!hlist_bl_empty(&sb->s_anon)) { -- struct select_data data; -- dentry = hlist_bl_entry(hlist_bl_first(&sb->s_anon), struct dentry, d_hash); -- -- INIT_LIST_HEAD(&data.dispose); -- data.start = NULL; -- data.found = 0; -- -- d_walk(dentry, &data, umount_collect, NULL); -- if (data.found) -- shrink_dentry_list(&data.dispose); -- cond_resched(); -+ dentry = dget(hlist_bl_entry(hlist_bl_first(&sb->s_anon), struct dentry, d_hash)); -+ do_one_tree(dentry); - } - } - -diff --git a/fs/namei.c b/fs/namei.c -index ccb8000..c6fa079 100644 ---- a/fs/namei.c -+++ b/fs/namei.c -@@ -3171,7 +3171,7 @@ static struct file *path_openat(int dfd, struct filename *pathname, - - if (unlikely(file->f_flags & __O_TMPFILE)) { - error = do_tmpfile(dfd, pathname, nd, flags, op, file, &opened); -- goto out; -+ goto out2; - } - - error = path_init(dfd, pathname->name, flags | LOOKUP_PARENT, nd, &base); -@@ -3209,6 +3209,7 @@ out: - path_put(&nd->root); - if (base) - fput(base); -+out2: - if (!(opened & FILE_OPENED)) { - BUG_ON(!error); - put_filp(file); -diff --git a/fs/notify/mark.c b/fs/notify/mark.c -index 923fe4a..6bffc33 100644 ---- a/fs/notify/mark.c -+++ b/fs/notify/mark.c -@@ -293,16 +293,36 @@ void fsnotify_clear_marks_by_group_flags(struct fsnotify_group *group, - unsigned int flags) - { - struct fsnotify_mark *lmark, *mark; -+ LIST_HEAD(to_free); - -+ /* -+ * We have to be really careful here. Anytime we drop mark_mutex, e.g. -+ * fsnotify_clear_marks_by_inode() can come and free marks. Even in our -+ * to_free list so we have to use mark_mutex even when accessing that -+ * list. And freeing mark requires us to drop mark_mutex. So we can -+ * reliably free only the first mark in the list. That's why we first -+ * move marks to free to to_free list in one go and then free marks in -+ * to_free list one by one. -+ */ - mutex_lock_nested(&group->mark_mutex, SINGLE_DEPTH_NESTING); - list_for_each_entry_safe(mark, lmark, &group->marks_list, g_list) { -- if (mark->flags & flags) { -- fsnotify_get_mark(mark); -- fsnotify_destroy_mark_locked(mark, group); -- fsnotify_put_mark(mark); -- } -+ if (mark->flags & flags) -+ list_move(&mark->g_list, &to_free); - } - mutex_unlock(&group->mark_mutex); -+ -+ while (1) { -+ mutex_lock_nested(&group->mark_mutex, SINGLE_DEPTH_NESTING); -+ if (list_empty(&to_free)) { -+ mutex_unlock(&group->mark_mutex); -+ break; -+ } -+ mark = list_first_entry(&to_free, struct fsnotify_mark, g_list); -+ fsnotify_get_mark(mark); -+ fsnotify_destroy_mark_locked(mark, group); -+ mutex_unlock(&group->mark_mutex); -+ fsnotify_put_mark(mark); -+ } - } - - /* -diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c -index 1998695..fa74259 100644 ---- a/fs/ocfs2/dlmglue.c -+++ b/fs/ocfs2/dlmglue.c -@@ -3973,9 +3973,13 @@ static void ocfs2_downconvert_thread_do_work(struct ocfs2_super *osb) - osb->dc_work_sequence = osb->dc_wake_sequence; - - processed = osb->blocked_lock_count; -- while (processed) { -- BUG_ON(list_empty(&osb->blocked_lock_list)); -- -+ /* -+ * blocked lock processing in this loop might call iput which can -+ * remove items off osb->blocked_lock_list. Downconvert up to -+ * 'processed' number of locks, but stop short if we had some -+ * removed in ocfs2_mark_lockres_freeing when downconverting. -+ */ -+ while (processed && !list_empty(&osb->blocked_lock_list)) { - lockres = list_entry(osb->blocked_lock_list.next, - struct ocfs2_lock_res, l_blocked_list); - list_del_init(&lockres->l_blocked_list); -diff --git a/fs/signalfd.c b/fs/signalfd.c -index 424b7b6..148f8e7 100644 ---- a/fs/signalfd.c -+++ b/fs/signalfd.c -@@ -121,8 +121,9 @@ static int signalfd_copyinfo(struct signalfd_siginfo __user *uinfo, - * Other callers might not initialize the si_lsb field, - * so check explicitly for the right codes here. - */ -- if (kinfo->si_code == BUS_MCEERR_AR || -- kinfo->si_code == BUS_MCEERR_AO) -+ if (kinfo->si_signo == SIGBUS && -+ (kinfo->si_code == BUS_MCEERR_AR || -+ kinfo->si_code == BUS_MCEERR_AO)) - err |= __put_user((short) kinfo->si_addr_lsb, - &uinfo->ssi_addr_lsb); - #endif -diff --git a/include/linux/dcache.h b/include/linux/dcache.h -index 0f0eb1c..2a23ecb 100644 ---- a/include/linux/dcache.h -+++ b/include/linux/dcache.h -@@ -221,6 +221,8 @@ struct dentry_operations { - #define DCACHE_SYMLINK_TYPE 0x00300000 /* Symlink */ - #define DCACHE_FILE_TYPE 0x00400000 /* Other file type */ - -+#define DCACHE_MAY_FREE 0x00800000 -+ - extern seqlock_t rename_lock; - - static inline int dname_external(const struct dentry *dentry) -diff --git a/include/uapi/linux/pci_regs.h b/include/uapi/linux/pci_regs.h -index 30db069..788c5aa 100644 ---- a/include/uapi/linux/pci_regs.h -+++ b/include/uapi/linux/pci_regs.h -@@ -319,6 +319,7 @@ - #define PCI_MSIX_PBA 8 /* Pending Bit Array offset */ - #define PCI_MSIX_PBA_BIR 0x00000007 /* BAR index */ - #define PCI_MSIX_PBA_OFFSET 0xfffffff8 /* Offset into specified BAR */ -+#define PCI_MSIX_FLAGS_BIRMASK PCI_MSIX_PBA_BIR /* deprecated */ - #define PCI_CAP_MSIX_SIZEOF 12 /* size of MSIX registers */ - - /* MSI-X Table entry format */ -diff --git a/ipc/mqueue.c b/ipc/mqueue.c -index c3b3117..9699d3f 100644 ---- a/ipc/mqueue.c -+++ b/ipc/mqueue.c -@@ -143,7 +143,6 @@ static int msg_insert(struct msg_msg *msg, struct mqueue_inode_info *info) - if (!leaf) - return -ENOMEM; - INIT_LIST_HEAD(&leaf->msg_list); -- info->qsize += sizeof(*leaf); - } - leaf->priority = msg->m_type; - rb_link_node(&leaf->rb_node, parent, p); -@@ -188,7 +187,6 @@ try_again: - "lazy leaf delete!\n"); - rb_erase(&leaf->rb_node, &info->msg_tree); - if (info->node_cache) { -- info->qsize -= sizeof(*leaf); - kfree(leaf); - } else { - info->node_cache = leaf; -@@ -201,7 +199,6 @@ try_again: - if (list_empty(&leaf->msg_list)) { - rb_erase(&leaf->rb_node, &info->msg_tree); - if (info->node_cache) { -- info->qsize -= sizeof(*leaf); - kfree(leaf); - } else { - info->node_cache = leaf; -@@ -1026,7 +1023,6 @@ SYSCALL_DEFINE5(mq_timedsend, mqd_t, mqdes, const char __user *, u_msg_ptr, - /* Save our speculative allocation into the cache */ - INIT_LIST_HEAD(&new_leaf->msg_list); - info->node_cache = new_leaf; -- info->qsize += sizeof(*new_leaf); - new_leaf = NULL; - } else { - kfree(new_leaf); -@@ -1133,7 +1129,6 @@ SYSCALL_DEFINE5(mq_timedreceive, mqd_t, mqdes, char __user *, u_msg_ptr, - /* Save our speculative allocation into the cache */ - INIT_LIST_HEAD(&new_leaf->msg_list); - info->node_cache = new_leaf; -- info->qsize += sizeof(*new_leaf); - } else { - kfree(new_leaf); - } -diff --git a/kernel/signal.c b/kernel/signal.c -index 52f881d..15c22ee 100644 ---- a/kernel/signal.c -+++ b/kernel/signal.c -@@ -2768,7 +2768,8 @@ int copy_siginfo_to_user(siginfo_t __user *to, const siginfo_t *from) - * Other callers might not initialize the si_lsb field, - * so check explicitly for the right codes here. - */ -- if (from->si_code == BUS_MCEERR_AR || from->si_code == BUS_MCEERR_AO) -+ if (from->si_signo == SIGBUS && -+ (from->si_code == BUS_MCEERR_AR || from->si_code == BUS_MCEERR_AO)) - err |= __put_user(from->si_addr_lsb, &to->si_addr_lsb); - #endif - break; -@@ -3035,7 +3036,7 @@ COMPAT_SYSCALL_DEFINE3(rt_sigqueueinfo, - int, sig, - struct compat_siginfo __user *, uinfo) - { -- siginfo_t info; -+ siginfo_t info = {}; - int ret = copy_siginfo_from_user32(&info, uinfo); - if (unlikely(ret)) - return ret; -@@ -3081,7 +3082,7 @@ COMPAT_SYSCALL_DEFINE4(rt_tgsigqueueinfo, - int, sig, - struct compat_siginfo __user *, uinfo) - { -- siginfo_t info; -+ siginfo_t info = {}; - - if (copy_siginfo_from_user32(&info, uinfo)) - return -EFAULT; -diff --git a/mm/vmscan.c b/mm/vmscan.c -index b850ced6..88edf53 100644 ---- a/mm/vmscan.c -+++ b/mm/vmscan.c -@@ -871,21 +871,17 @@ static unsigned long shrink_page_list(struct list_head *page_list, - * - * 2) Global reclaim encounters a page, memcg encounters a - * page that is not marked for immediate reclaim or -- * the caller does not have __GFP_IO. In this case mark -+ * the caller does not have __GFP_FS (or __GFP_IO if it's -+ * simply going to swap, not to fs). In this case mark - * the page for immediate reclaim and continue scanning. - * -- * __GFP_IO is checked because a loop driver thread might -+ * Require may_enter_fs because we would wait on fs, which -+ * may not have submitted IO yet. And the loop driver might - * enter reclaim, and deadlock if it waits on a page for - * which it is needed to do the write (loop masks off - * __GFP_IO|__GFP_FS for this reason); but more thought - * would probably show more reasons. - * -- * Don't require __GFP_FS, since we're not going into the -- * FS, just waiting on its writeback completion. Worryingly, -- * ext4 gfs2 and xfs allocate pages with -- * grab_cache_page_write_begin(,,AOP_FLAG_NOFS), so testing -- * may_enter_fs here is liable to OOM on them. -- * - * 3) memcg encounters a page that is not already marked - * PageReclaim. memcg does not have any dirty pages - * throttling so we could easily OOM just because too many -@@ -902,7 +898,7 @@ static unsigned long shrink_page_list(struct list_head *page_list, - - /* Case 2 above */ - } else if (global_reclaim(sc) || -- !PageReclaim(page) || !(sc->gfp_mask & __GFP_IO)) { -+ !PageReclaim(page) || !may_enter_fs) { - /* - * This is slightly racy - end_page_writeback() - * might have just cleared PageReclaim, then -diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c -index 085c496..9d8e420 100644 ---- a/security/integrity/ima/ima_policy.c -+++ b/security/integrity/ima/ima_policy.c -@@ -27,6 +27,8 @@ - #define IMA_UID 0x0008 - #define IMA_FOWNER 0x0010 - #define IMA_FSUUID 0x0020 -+#define IMA_INMASK 0x0040 -+#define IMA_EUID 0x0080 - - #define UNKNOWN 0 - #define MEASURE 0x0001 /* same as IMA_MEASURE */ -@@ -171,6 +173,9 @@ static bool ima_match_rules(struct ima_rule_entry *rule, - return false; - if ((rule->flags & IMA_MASK) && rule->mask != mask) - return false; -+ if ((rule->flags & IMA_INMASK) && -+ (!(rule->mask & mask) && func != POST_SETATTR)) -+ return false; - if ((rule->flags & IMA_FSMAGIC) - && rule->fsmagic != inode->i_sb->s_magic) - return false; -@@ -179,6 +184,16 @@ static bool ima_match_rules(struct ima_rule_entry *rule, - return false; - if ((rule->flags & IMA_UID) && !uid_eq(rule->uid, cred->uid)) - return false; -+ if (rule->flags & IMA_EUID) { -+ if (has_capability_noaudit(current, CAP_SETUID)) { -+ if (!uid_eq(rule->uid, cred->euid) -+ && !uid_eq(rule->uid, cred->suid) -+ && !uid_eq(rule->uid, cred->uid)) -+ return false; -+ } else if (!uid_eq(rule->uid, cred->euid)) -+ return false; -+ } -+ - if ((rule->flags & IMA_FOWNER) && !uid_eq(rule->fowner, inode->i_uid)) - return false; - for (i = 0; i < MAX_LSM_RULES; i++) { -@@ -350,7 +365,8 @@ enum { - Opt_audit, - Opt_obj_user, Opt_obj_role, Opt_obj_type, - Opt_subj_user, Opt_subj_role, Opt_subj_type, -- Opt_func, Opt_mask, Opt_fsmagic, Opt_uid, Opt_fowner, -+ Opt_func, Opt_mask, Opt_fsmagic, -+ Opt_uid, Opt_euid, Opt_fowner, - Opt_appraise_type, Opt_fsuuid, Opt_permit_directio - }; - -@@ -371,6 +387,7 @@ static match_table_t policy_tokens = { - {Opt_fsmagic, "fsmagic=%s"}, - {Opt_fsuuid, "fsuuid=%s"}, - {Opt_uid, "uid=%s"}, -+ {Opt_euid, "euid=%s"}, - {Opt_fowner, "fowner=%s"}, - {Opt_appraise_type, "appraise_type=%s"}, - {Opt_permit_directio, "permit_directio"}, -@@ -412,6 +429,7 @@ static void ima_log_string(struct audit_buffer *ab, char *key, char *value) - static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) - { - struct audit_buffer *ab; -+ char *from; - char *p; - int result = 0; - -@@ -500,18 +518,23 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) - if (entry->mask) - result = -EINVAL; - -- if ((strcmp(args[0].from, "MAY_EXEC")) == 0) -+ from = args[0].from; -+ if (*from == '^') -+ from++; -+ -+ if ((strcmp(from, "MAY_EXEC")) == 0) - entry->mask = MAY_EXEC; -- else if (strcmp(args[0].from, "MAY_WRITE") == 0) -+ else if (strcmp(from, "MAY_WRITE") == 0) - entry->mask = MAY_WRITE; -- else if (strcmp(args[0].from, "MAY_READ") == 0) -+ else if (strcmp(from, "MAY_READ") == 0) - entry->mask = MAY_READ; -- else if (strcmp(args[0].from, "MAY_APPEND") == 0) -+ else if (strcmp(from, "MAY_APPEND") == 0) - entry->mask = MAY_APPEND; - else - result = -EINVAL; - if (!result) -- entry->flags |= IMA_MASK; -+ entry->flags |= (*args[0].from == '^') -+ ? IMA_INMASK : IMA_MASK; - break; - case Opt_fsmagic: - ima_log_string(ab, "fsmagic", args[0].from); -@@ -542,6 +565,9 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) - break; - case Opt_uid: - ima_log_string(ab, "uid", args[0].from); -+ case Opt_euid: -+ if (token == Opt_euid) -+ ima_log_string(ab, "euid", args[0].from); - - if (uid_valid(entry->uid)) { - result = -EINVAL; -@@ -550,11 +576,14 @@ static int ima_parse_rule(char *rule, struct ima_rule_entry *entry) - - result = strict_strtoul(args[0].from, 10, &lnum); - if (!result) { -- entry->uid = make_kuid(current_user_ns(), (uid_t)lnum); -- if (!uid_valid(entry->uid) || (((uid_t)lnum) != lnum)) -+ entry->uid = make_kuid(current_user_ns(), -+ (uid_t) lnum); -+ if (!uid_valid(entry->uid) || -+ (uid_t)lnum != lnum) - result = -EINVAL; - else -- entry->flags |= IMA_UID; -+ entry->flags |= (token == Opt_uid) -+ ? IMA_UID : IMA_EUID; - } - break; - case Opt_fowner: -diff --git a/sound/pci/hda/patch_cirrus.c b/sound/pci/hda/patch_cirrus.c -index 51e2080..7b0aac9 100644 ---- a/sound/pci/hda/patch_cirrus.c -+++ b/sound/pci/hda/patch_cirrus.c -@@ -1002,9 +1002,7 @@ static void cs4210_spdif_automute(struct hda_codec *codec, - - spec->spdif_present = spdif_present; - /* SPDIF TX on/off */ -- if (spdif_present) -- snd_hda_set_pin_ctl(codec, spdif_pin, -- spdif_present ? PIN_OUT : 0); -+ snd_hda_set_pin_ctl(codec, spdif_pin, spdif_present ? PIN_OUT : 0); - - cs_automute(codec); - } -diff --git a/sound/soc/codecs/pcm1681.c b/sound/soc/codecs/pcm1681.c -index 651e2fe..dfa9755 100644 ---- a/sound/soc/codecs/pcm1681.c -+++ b/sound/soc/codecs/pcm1681.c -@@ -102,7 +102,7 @@ static int pcm1681_set_deemph(struct snd_soc_codec *codec) - - if (val != -1) { - regmap_update_bits(priv->regmap, PCM1681_DEEMPH_CONTROL, -- PCM1681_DEEMPH_RATE_MASK, val); -+ PCM1681_DEEMPH_RATE_MASK, val << 3); - enable = 1; - } else - enable = 0; |