Merge branch 'linus' into smp/hotplug

Apply upstream changes to avoid conflicts with pending patches.

3 files changed, 14 insertions, 28 deletions

diff --git a/drivers/infiniband/hw/qib/qib_debugfs.c b/drivers/infiniband/hw/qib/qib_debugfs.c
index 5e75b43c596b..5bad8e3b40bb 100644
--- a/drivers/infiniband/hw/qib/qib_debugfs.c
+++ b/drivers/infiniband/hw/qib/qib_debugfs.c
@@ -189,27 +189,32 @@ static int _ctx_stats_seq_show(struct seq_file *s, void *v)
 DEBUGFS_FILE(ctx_stats)
 
 static void *_qp_stats_seq_start(struct seq_file *s, loff_t *pos)
+        __acquires(RCU)
 {
         struct qib_qp_iter *iter;
         loff_t n = *pos;
 
-        rcu_read_lock();
         iter = qib_qp_iter_init(s->private);
+
+        /* stop calls rcu_read_unlock */
+        rcu_read_lock();
+
         if (!iter)
                 return NULL;
 
-        while (n--) {
+        do {
                 if (qib_qp_iter_next(iter)) {
                         kfree(iter);
                         return NULL;
                 }
-        }
+        } while (n--);
 
         return iter;
 }
 
 static void *_qp_stats_seq_next(struct seq_file *s, void *iter_ptr,
                                    loff_t *pos)
+        __must_hold(RCU)
 {
         struct qib_qp_iter *iter = iter_ptr;
 
@@ -224,6 +229,7 @@ static void *_qp_stats_seq_next(struct seq_file *s, void *iter_ptr,
 }
 
 static void _qp_stats_seq_stop(struct seq_file *s, void *iter_ptr)
+        __releases(RCU)
 {
         rcu_read_unlock();
 }
diff --git a/drivers/infiniband/hw/qib/qib_fs.c b/drivers/infiniband/hw/qib/qib_fs.c
index fcdf37913a26..c3edc033f7c4 100644
--- a/drivers/infiniband/hw/qib/qib_fs.c
+++ b/drivers/infiniband/hw/qib/qib_fs.c
@@ -328,26 +328,12 @@ static ssize_t flash_write(struct file *file, const char __user *buf,
 
         pos = *ppos;
 
-        if (pos != 0) {
-                ret = -EINVAL;
-                goto bail;
-        }
-
-        if (count != sizeof(struct qib_flash)) {
-                ret = -EINVAL;
-                goto bail;
-        }
-
-        tmp = kmalloc(count, GFP_KERNEL);
-        if (!tmp) {
-                ret = -ENOMEM;
-                goto bail;
-        }
+        if (pos != 0 || count != sizeof(struct qib_flash))
+                return -EINVAL;
 
-        if (copy_from_user(tmp, buf, count)) {
-                ret = -EFAULT;
-                goto bail_tmp;
-        }
+        tmp = memdup_user(buf, count);
+        if (IS_ERR(tmp))
+                return PTR_ERR(tmp);
 
         dd = private2dd(file);
         if (qib_eeprom_write(dd, pos, tmp, count)) {
@@ -361,8 +347,6 @@ static ssize_t flash_write(struct file *file, const char __user *buf,
 
 bail_tmp:
         kfree(tmp);
-
-bail:
         return ret;
 }
 
diff --git a/drivers/infiniband/hw/qib/qib_qp.c b/drivers/infiniband/hw/qib/qib_qp.c
index 9cc0aae1d781..f9b8cd2354d1 100644
--- a/drivers/infiniband/hw/qib/qib_qp.c
+++ b/drivers/infiniband/hw/qib/qib_qp.c
@@ -573,10 +573,6 @@ struct qib_qp_iter *qib_qp_iter_init(struct qib_ibdev *dev)
                 return NULL;
 
         iter->dev = dev;
-        if (qib_qp_iter_next(iter)) {
-                kfree(iter);
-                return NULL;
-        }
 
         return iter;
 }