82 files changed, 561 insertions, 306 deletions
diff --git a/Documentation/devicetree/bindings/pinctrl/fsl,imx6q-pinctrl.txt b/Documentation/devicetree/bindings/pinctrl/fsl,imx6q-pinctrl.txt
index 82b43f915857..a4119f6422d9 100644
--- a/Documentation/devicetree/bindings/pinctrl/fsl,imx6q-pinctrl.txt
+++ b/Documentation/devicetree/bindings/pinctrl/fsl,imx6q-pinctrl.txt
@@ -1626,3 +1626,5 @@ MX6Q_PAD_SD2_DAT3__PCIE_CTRL_MUX_11		1587
 MX6Q_PAD_SD2_DAT3__GPIO_1_12                    1588
 MX6Q_PAD_SD2_DAT3__SJC_DONE                     1589
 MX6Q_PAD_SD2_DAT3__ANATOP_TESTO_3               1590
+MX6Q_PAD_ENET_RX_ER__ANATOP_USBOTG_ID           1591
+MX6Q_PAD_GPIO_1__ANATOP_USBOTG_ID               1592
diff --git a/MAINTAINERS b/MAINTAINERS
index 1b71f6ceae0a..c82c343168e8 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -3433,13 +3433,14 @@ S:	Supported
 F:      drivers/idle/i7300_idle.c
 IEEE 802.15.4 SUBSYSTEM
+M:      Alexander Smirnov <alex.bluesman.smirnov@gmail.com>
 M:      Dmitry Eremin-Solenikov <dbaryshkov@gmail.com>
-M:      Sergey Lapin <slapin@ossfans.org>
 L:      linux-zigbee-devel@lists.sourceforge.net (moderated for non-subscribers)
 W:      http://apps.sourceforge.net/trac/linux-zigbee
 T:      git git://git.kernel.org/pub/scm/linux/kernel/git/lowpan/lowpan.git
 S:      Maintained
 F:      net/ieee802154/
+F:      net/mac802154/
 F:      drivers/ieee802154/
 IIO SUBSYSTEM AND DRIVERS
diff --git a/arch/arm/mm/dma-mapping.c b/arch/arm/mm/dma-mapping.c
index 4044abcf6f9d..655878bcc96d 100644
--- a/arch/arm/mm/dma-mapping.c
+++ b/arch/arm/mm/dma-mapping.c
@@ -1091,7 +1091,7 @@ error:
        while (--i)
                if (pages[i])
                        __free_pages(pages[i], 0);
-        if (array_size < PAGE_SIZE)
+        if (array_size <= PAGE_SIZE)
                kfree(pages);
        else
                vfree(pages);
@@ -1106,7 +1106,7 @@ static int __iommu_free_buffer(struct device *dev, struct page **pages, size_t s
        for (i = 0; i < count; i++)
                if (pages[i])
                        __free_pages(pages[i], 0);
-        if (array_size < PAGE_SIZE)
+        if (array_size <= PAGE_SIZE)
                kfree(pages);
        else
                vfree(pages);
diff --git a/arch/m32r/boot/compressed/Makefile b/arch/m32r/boot/compressed/Makefile
index 177716b1d613..01729c2979ba 100644
--- a/arch/m32r/boot/compressed/Makefile
+++ b/arch/m32r/boot/compressed/Makefile
@@ -43,9 +43,9 @@ endif
 OBJCOPYFLAGS += -R .empty_zero_page
-suffix_$(CONFIG_KERNEL_GZIP)    = gz
+suffix-$(CONFIG_KERNEL_GZIP)    = gz
-suffix_$(CONFIG_KERNEL_BZIP2)   = bz2
+suffix-$(CONFIG_KERNEL_BZIP2)   = bz2
-suffix_$(CONFIG_KERNEL_LZMA)    = lzma
+suffix-$(CONFIG_KERNEL_LZMA)    = lzma
 $(obj)/piggy.o: $(obj)/vmlinux.scr $(obj)/vmlinux.bin.$(suffix-y) FORCE
        $(call if_changed,ld)
diff --git a/arch/m32r/boot/compressed/misc.c b/arch/m32r/boot/compressed/misc.c
index 370d60881977..28a09529f206 100644
--- a/arch/m32r/boot/compressed/misc.c
+++ b/arch/m32r/boot/compressed/misc.c
@@ -28,7 +28,7 @@ static unsigned long free_mem_ptr;
 static unsigned long free_mem_end_ptr;
 #ifdef CONFIG_KERNEL_BZIP2
-static void *memset(void *s, int c, size_t n)
+void *memset(void *s, int c, size_t n)
 {
        char *ss = s;
@@ -39,6 +39,16 @@ static void *memset(void *s, int c, size_t n)
 #endif
 #ifdef CONFIG_KERNEL_GZIP
+void *memcpy(void *dest, const void *src, size_t n)
+{
+        char *d = dest;
+        const char *s = src;
+        while (n--)
+                *d++ = *s++;
+        return dest;
+}
 #define BOOT_HEAP_SIZE             0x10000
 #include "../../../../lib/decompress_inflate.c"
 #endif
diff --git a/arch/m32r/include/asm/ptrace.h b/arch/m32r/include/asm/ptrace.h
index 527527584dd0..4313aa62b51b 100644
--- a/arch/m32r/include/asm/ptrace.h
+++ b/arch/m32r/include/asm/ptrace.h
@@ -113,9 +113,6 @@ struct pt_regs {
 #define PTRACE_OLDSETOPTIONS    21
-/* options set using PTRACE_SETOPTIONS */
-#define PTRACE_O_TRACESYSGOOD   0x00000001
 #ifdef __KERNEL__
 #include <asm/m32r.h>           /* M32R_PSW_BSM, M32R_PSW_BPM */
diff --git a/arch/m32r/kernel/ptrace.c b/arch/m32r/kernel/ptrace.c
index 4c03361537aa..51f5e9aa4901 100644
--- a/arch/m32r/kernel/ptrace.c
+++ b/arch/m32r/kernel/ptrace.c
@@ -591,17 +591,16 @@ void user_enable_single_step(struct task_struct *child)
        if (access_process_vm(child, pc&~3, &insn, sizeof(insn), 0)
            != sizeof(insn))
-                return -EIO;
+                return;
        compute_next_pc(insn, pc, &next_pc, child);
        if (next_pc & 0x80000000)
-                return -EIO;
+                return;
        if (embed_debug_trap(child, next_pc))
-                return -EIO;
+                return;
        invalidate_cache();
-        return 0;
 }
 void user_disable_single_step(struct task_struct *child)
diff --git a/arch/m32r/kernel/signal.c b/arch/m32r/kernel/signal.c
index f3fb2c029cfc..d0f60b97bbc5 100644
--- a/arch/m32r/kernel/signal.c
+++ b/arch/m32r/kernel/signal.c
@@ -286,7 +286,7 @@ handle_signal(unsigned long sig, struct k_sigaction *ka, siginfo_t *info,
                        case -ERESTARTNOINTR:
                                regs->r0 = regs->orig_r0;
                                if (prev_insn(regs) < 0)
-                                        return -EFAULT;
+                                        return;
                }
        }
diff --git a/arch/mn10300/kernel/signal.c b/arch/mn10300/kernel/signal.c
index 6ab0bee2a54f..4d584ae29ae1 100644
--- a/arch/mn10300/kernel/signal.c
+++ b/arch/mn10300/kernel/signal.c
@@ -459,10 +459,11 @@ static int handle_signal(int sig,
        else
                ret = setup_frame(sig, ka, oldset, regs);
        if (ret)
-                return;
+                return ret;
        signal_delivered(sig, info, ka, regs,
-                                 test_thread_flag(TIF_SINGLESTEP));
+                         test_thread_flag(TIF_SINGLESTEP));
+        return 0;
 }
 /*
diff --git a/drivers/gpu/drm/gma500/cdv_device.c b/drivers/gpu/drm/gma500/cdv_device.c
index 9764045428ce..b7e7b49d8f62 100644
--- a/drivers/gpu/drm/gma500/cdv_device.c
+++ b/drivers/gpu/drm/gma500/cdv_device.c
@@ -78,21 +78,6 @@ static int cdv_backlight_combination_mode(struct drm_device *dev)
        return REG_READ(BLC_PWM_CTL2) & PWM_LEGACY_MODE;
 }
-static int cdv_get_brightness(struct backlight_device *bd)
-{
-        struct drm_device *dev = bl_get_data(bd);
-        u32 val = REG_READ(BLC_PWM_CTL) & BACKLIGHT_DUTY_CYCLE_MASK;
-        if (cdv_backlight_combination_mode(dev)) {
-                u8 lbpc;
-                val &= ~1;
-                pci_read_config_byte(dev->pdev, 0xF4, &lbpc);
-                val *= lbpc;
-        }
-        return val;
-}
 static u32 cdv_get_max_backlight(struct drm_device *dev)
 {
        u32 max = REG_READ(BLC_PWM_CTL);
@@ -110,6 +95,22 @@ static u32 cdv_get_max_backlight(struct drm_device *dev)
        return max;
 }
+static int cdv_get_brightness(struct backlight_device *bd)
+{
+        struct drm_device *dev = bl_get_data(bd);
+        u32 val = REG_READ(BLC_PWM_CTL) & BACKLIGHT_DUTY_CYCLE_MASK;
+        if (cdv_backlight_combination_mode(dev)) {
+                u8 lbpc;
+                val &= ~1;
+                pci_read_config_byte(dev->pdev, 0xF4, &lbpc);
+                val *= lbpc;
+        }
+        return (val * 100)/cdv_get_max_backlight(dev);
+}
 static int cdv_set_brightness(struct backlight_device *bd)
 {
        struct drm_device *dev = bl_get_data(bd);
@@ -120,6 +121,9 @@ static int cdv_set_brightness(struct backlight_device *bd)
        if (level < 1)
                level = 1;
+        level *= cdv_get_max_backlight(dev);
+        level /= 100;
        if (cdv_backlight_combination_mode(dev)) {
                u32 max = cdv_get_max_backlight(dev);
                u8 lbpc;
@@ -157,7 +161,6 @@ static int cdv_backlight_init(struct drm_device *dev)
        cdv_backlight_device->props.brightness =
                        cdv_get_brightness(cdv_backlight_device);
-        cdv_backlight_device->props.max_brightness = cdv_get_max_backlight(dev);
        backlight_update_status(cdv_backlight_device);
        dev_priv->backlight_device = cdv_backlight_device;
        return 0;
diff --git a/drivers/gpu/drm/gma500/opregion.c b/drivers/gpu/drm/gma500/opregion.c
index 4f186eca3a30..c430bd424681 100644
--- a/drivers/gpu/drm/gma500/opregion.c
+++ b/drivers/gpu/drm/gma500/opregion.c
@@ -144,6 +144,8 @@ struct opregion_asle {
 #define ASLE_CBLV_VALID         (1<<31)
+static struct psb_intel_opregion *system_opregion;
 static u32 asle_set_backlight(struct drm_device *dev, u32 bclp)
 {
        struct drm_psb_private *dev_priv = dev->dev_private;
@@ -205,7 +207,7 @@ void psb_intel_opregion_enable_asle(struct drm_device *dev)
        struct drm_psb_private *dev_priv = dev->dev_private;
        struct opregion_asle *asle = dev_priv->opregion.asle;
-        if (asle) {
+        if (asle && system_opregion ) {
                /* Don't do this on Medfield or other non PC like devices, they
                   use the bit for something different altogether */
                psb_enable_pipestat(dev_priv, 0, PIPE_LEGACY_BLC_EVENT_ENABLE);
@@ -221,7 +223,6 @@ void psb_intel_opregion_enable_asle(struct drm_device *dev)
 #define ACPI_EV_LID            (1<<1)
 #define ACPI_EV_DOCK           (1<<2)
-static struct psb_intel_opregion *system_opregion;
 static int psb_intel_opregion_video_event(struct notifier_block *nb,
                                          unsigned long val, void *data)
@@ -266,9 +267,6 @@ void psb_intel_opregion_init(struct drm_device *dev)
                system_opregion = opregion;
                register_acpi_notifier(&psb_intel_opregion_notifier);
        }
-        if (opregion->asle)
-                psb_intel_opregion_enable_asle(dev);
 }
 void psb_intel_opregion_fini(struct drm_device *dev)
diff --git a/drivers/gpu/drm/gma500/opregion.h b/drivers/gpu/drm/gma500/opregion.h
index 72dc6b921265..4a90f8b0e16c 100644
--- a/drivers/gpu/drm/gma500/opregion.h
+++ b/drivers/gpu/drm/gma500/opregion.h
@@ -27,6 +27,7 @@ extern void psb_intel_opregion_asle_intr(struct drm_device *dev);
 extern void psb_intel_opregion_init(struct drm_device *dev);
 extern void psb_intel_opregion_fini(struct drm_device *dev);
 extern int psb_intel_opregion_setup(struct drm_device *dev);
+extern void psb_intel_opregion_enable_asle(struct drm_device *dev);
 #else
@@ -46,4 +47,8 @@ extern inline int psb_intel_opregion_setup(struct drm_device *dev)
 {
        return 0;
 }
+extern inline void psb_intel_opregion_enable_asle(struct drm_device *dev)
+{
+}
 #endif
diff --git a/drivers/gpu/drm/gma500/psb_device.c b/drivers/gpu/drm/gma500/psb_device.c
index eff039bf92d4..5971bc82b765 100644
--- a/drivers/gpu/drm/gma500/psb_device.c
+++ b/drivers/gpu/drm/gma500/psb_device.c
@@ -144,6 +144,10 @@ static int psb_backlight_init(struct drm_device *dev)
        psb_backlight_device->props.max_brightness = 100;
        backlight_update_status(psb_backlight_device);
        dev_priv->backlight_device = psb_backlight_device;
+        /* This must occur after the backlight is properly initialised */
+        psb_lid_timer_init(dev_priv);
        return 0;
 }
@@ -354,13 +358,6 @@ static int psb_chip_setup(struct drm_device *dev)
        return 0;
 }
-/* Not exactly an erratum more an irritation */
-static void psb_chip_errata(struct drm_device *dev)
-{
-        struct drm_psb_private *dev_priv = dev->dev_private;
-        psb_lid_timer_init(dev_priv);
-}
 static void psb_chip_teardown(struct drm_device *dev)
 {
        struct drm_psb_private *dev_priv = dev->dev_private;
@@ -379,7 +376,6 @@ const struct psb_ops psb_chip_ops = {
        .sgx_offset = PSB_SGX_OFFSET,
        .chip_setup = psb_chip_setup,
        .chip_teardown = psb_chip_teardown,
-        .errata = psb_chip_errata,
        .crtc_helper = &psb_intel_helper_funcs,
        .crtc_funcs = &psb_intel_crtc_funcs,
diff --git a/drivers/gpu/drm/gma500/psb_drv.c b/drivers/gpu/drm/gma500/psb_drv.c
index caba6e08693c..a8858a907f47 100644
--- a/drivers/gpu/drm/gma500/psb_drv.c
+++ b/drivers/gpu/drm/gma500/psb_drv.c
@@ -374,6 +374,7 @@ static int psb_driver_load(struct drm_device *dev, unsigned long chipset)
        if (ret)
                return ret;
+        psb_intel_opregion_enable_asle(dev);
 #if 0
        /*enable runtime pm at last*/
        pm_runtime_enable(&dev->pdev->dev);
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_ib.c b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
index 5c1bc995e560..f10221f40803 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_ib.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_ib.c
@@ -123,7 +123,7 @@ static void ipoib_ud_skb_put_frags(struct ipoib_dev_priv *priv,
                skb_frag_size_set(frag, size);
                skb->data_len += size;
-                skb->truesize += size;
+                skb->truesize += PAGE_SIZE;
        } else
                skb_put(skb, length);
@@ -156,14 +156,18 @@ static struct sk_buff *ipoib_alloc_rx_skb(struct net_device *dev, int id)
        struct ipoib_dev_priv *priv = netdev_priv(dev);
        struct sk_buff *skb;
        int buf_size;
+        int tailroom;
        u64 *mapping;
-        if (ipoib_ud_need_sg(priv->max_ib_mtu))
+        if (ipoib_ud_need_sg(priv->max_ib_mtu)) {
                buf_size = IPOIB_UD_HEAD_SIZE;
-        else
+                tailroom = 128; /* reserve some tailroom for IP/TCP headers */
+        } else {
                buf_size = IPOIB_UD_BUF_SIZE(priv->max_ib_mtu);
+                tailroom = 0;
+        }
-        skb = dev_alloc_skb(buf_size + 4);
+        skb = dev_alloc_skb(buf_size + tailroom + 4);
        if (unlikely(!skb))
                return NULL;
diff --git a/drivers/isdn/mISDN/stack.c b/drivers/isdn/mISDN/stack.c
index 1a0ae4445ff2..5f21f629b7ae 100644
--- a/drivers/isdn/mISDN/stack.c
+++ b/drivers/isdn/mISDN/stack.c
@@ -135,8 +135,8 @@ send_layer2(struct mISDNstack *st, struct sk_buff *skb)
                        skb = NULL;
                else if (*debug & DEBUG_SEND_ERR)
                        printk(KERN_DEBUG
-                               "%s ch%d mgr prim(%x) addr(%x) err %d\n",
+                               "%s mgr prim(%x) err %d\n",
-                               __func__, ch->nr, hh->prim, ch->addr, ret);
+                               __func__, hh->prim, ret);
        }
 out:
        mutex_unlock(&st->lmutex);
diff --git a/drivers/net/bonding/bond_debugfs.c b/drivers/net/bonding/bond_debugfs.c
index 3680aa251dea..2cf084eb9d52 100644
--- a/drivers/net/bonding/bond_debugfs.c
+++ b/drivers/net/bonding/bond_debugfs.c
@@ -6,7 +6,7 @@
 #include "bonding.h"
 #include "bond_alb.h"
-#ifdef CONFIG_DEBUG_FS
+#if defined(CONFIG_DEBUG_FS) && !defined(CONFIG_NET_NS)
 #include <linux/debugfs.h>
 #include <linux/seq_file.h>
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index b9c2ae62166d..2ee76993f052 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -3227,6 +3227,12 @@ static int bond_master_netdev_event(unsigned long event,
        switch (event) {
        case NETDEV_CHANGENAME:
                return bond_event_changename(event_bond);
+        case NETDEV_UNREGISTER:
+                bond_remove_proc_entry(event_bond);
+                break;
+        case NETDEV_REGISTER:
+                bond_create_proc_entry(event_bond);
+                break;
        default:
                break;
        }
@@ -4411,8 +4417,6 @@ static void bond_uninit(struct net_device *bond_dev)
        bond_work_cancel_all(bond);
-        bond_remove_proc_entry(bond);
        bond_debug_unregister(bond);
        __hw_addr_flush(&bond->mc_list);
@@ -4814,7 +4818,6 @@ static int bond_init(struct net_device *bond_dev)
        bond_set_lockdep_class(bond_dev);
-        bond_create_proc_entry(bond);
        list_add_tail(&bond->bond_list, &bn->dev_list);
        bond_prepare_sysfs_group(bond);
diff --git a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
index 9cc15701101b..1f78b63d5efe 100644
--- a/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
+++ b/drivers/net/ethernet/atheros/atl1c/atl1c_main.c
@@ -261,7 +261,6 @@ static void atl1c_check_link_status(struct atl1c_adapter *adapter)
        if ((phy_data & BMSR_LSTATUS) == 0) {
                /* link down */
                netif_carrier_off(netdev);
-                netif_stop_queue(netdev);
                hw->hibernate = true;
                if (atl1c_reset_mac(hw) != 0)
                        if (netif_msg_hw(adapter))
diff --git a/drivers/net/ethernet/broadcom/b44.c b/drivers/net/ethernet/broadcom/b44.c
index 46b8b7d81633..d09c6b583d17 100644
--- a/drivers/net/ethernet/broadcom/b44.c
+++ b/drivers/net/ethernet/broadcom/b44.c
@@ -656,7 +656,7 @@ static int b44_alloc_rx_skb(struct b44 *bp, int src_idx, u32 dest_idx_unmasked)
                        dma_unmap_single(bp->sdev->dma_dev, mapping,
                                             RX_PKT_BUF_SZ, DMA_FROM_DEVICE);
                dev_kfree_skb_any(skb);
-                skb = __netdev_alloc_skb(bp->dev, RX_PKT_BUF_SZ, GFP_ATOMIC|GFP_DMA);
+                skb = alloc_skb(RX_PKT_BUF_SZ, GFP_ATOMIC | GFP_DMA);
                if (skb == NULL)
                        return -ENOMEM;
                mapping = dma_map_single(bp->sdev->dma_dev, skb->data,
@@ -967,7 +967,7 @@ static netdev_tx_t b44_start_xmit(struct sk_buff *skb, struct net_device *dev)
                        dma_unmap_single(bp->sdev->dma_dev, mapping, len,
                                             DMA_TO_DEVICE);
-                bounce_skb = __netdev_alloc_skb(dev, len, GFP_ATOMIC | GFP_DMA);
+                bounce_skb = alloc_skb(len, GFP_ATOMIC | GFP_DMA);
                if (!bounce_skb)
                        goto err_out;
diff --git a/drivers/net/ethernet/broadcom/bnx2.c b/drivers/net/ethernet/broadcom/bnx2.c
index ac7b74488531..1fa4927a45b1 100644
--- a/drivers/net/ethernet/broadcom/bnx2.c
+++ b/drivers/net/ethernet/broadcom/bnx2.c
@@ -5372,7 +5372,7 @@ bnx2_free_tx_skbs(struct bnx2 *bp)
                        int k, last;
                        if (skb == NULL) {
-                                j++;
+                                j = NEXT_TX_BD(j);
                                continue;
                        }
@@ -5384,8 +5384,8 @@ bnx2_free_tx_skbs(struct bnx2 *bp)
                        tx_buf->skb = NULL;
                        last = tx_buf->nr_frags;
-                        j++;
+                        j = NEXT_TX_BD(j);
-                        for (k = 0; k < last; k++, j++) {
+                        for (k = 0; k < last; k++, j = NEXT_TX_BD(j)) {
                                tx_buf = &txr->tx_buf_ring[TX_RING_IDX(j)];
                                dma_unmap_page(&bp->pdev->dev,
                                        dma_unmap_addr(tx_buf, mapping),
diff --git a/drivers/net/ethernet/broadcom/cnic.c b/drivers/net/ethernet/broadcom/cnic.c
index c95e7b5e2b85..2c89d17cbb29 100644
--- a/drivers/net/ethernet/broadcom/cnic.c
+++ b/drivers/net/ethernet/broadcom/cnic.c
@@ -534,7 +534,8 @@ int cnic_unregister_driver(int ulp_type)
        }
        if (atomic_read(&ulp_ops->ref_count) != 0)
-                netdev_warn(dev->netdev, "Failed waiting for ref count to go to zero\n");
+                pr_warn("%s: Failed waiting for ref count to go to zero\n",
+                        __func__);
        return 0;
 out_unlock:
@@ -1053,12 +1054,13 @@ static int cnic_init_uio(struct cnic_dev *dev)
        uinfo = &udev->cnic_uinfo;
-        uinfo->mem[0].addr = dev->netdev->base_addr;
+        uinfo->mem[0].addr = pci_resource_start(dev->pcidev, 0);
        uinfo->mem[0].internal_addr = dev->regview;
-        uinfo->mem[0].size = dev->netdev->mem_end - dev->netdev->mem_start;
        uinfo->mem[0].memtype = UIO_MEM_PHYS;
        if (test_bit(CNIC_F_BNX2_CLASS, &dev->flags)) {
+                uinfo->mem[0].size = MB_GET_CID_ADDR(TX_TSS_CID +
+                                                     TX_MAX_TSS_RINGS + 1);
                uinfo->mem[1].addr = (unsigned long) cp->status_blk.gen &
                                        PAGE_MASK;
                if (cp->ethdev->drv_state & CNIC_DRV_STATE_USING_MSIX)
@@ -1068,6 +1070,8 @@ static int cnic_init_uio(struct cnic_dev *dev)
                uinfo->name = "bnx2_cnic";
        } else if (test_bit(CNIC_F_BNX2X_CLASS, &dev->flags)) {
+                uinfo->mem[0].size = pci_resource_len(dev->pcidev, 0);
                uinfo->mem[1].addr = (unsigned long) cp->bnx2x_def_status_blk &
                        PAGE_MASK;
                uinfo->mem[1].size = sizeof(*cp->bnx2x_def_status_blk);
diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
index f2db8fca46a1..ab1d80ff0791 100644
--- a/drivers/net/ethernet/freescale/gianfar.c
+++ b/drivers/net/ethernet/freescale/gianfar.c
@@ -2063,10 +2063,9 @@ static int gfar_start_xmit(struct sk_buff *skb, struct net_device *dev)
                        return NETDEV_TX_OK;
                }
-                /* Steal sock reference for processing TX time stamps */
+                if (skb->sk)
-                swap(skb_new->sk, skb->sk);
+                        skb_set_owner_w(skb_new, skb->sk);
-                swap(skb_new->destructor, skb->destructor);
+                consume_skb(skb);
-                kfree_skb(skb);
                skb = skb_new;
        }
diff --git a/drivers/net/ethernet/intel/e1000e/82571.c b/drivers/net/ethernet/intel/e1000e/82571.c
index 36db4df09aed..1f063dcd8f85 100644
--- a/drivers/net/ethernet/intel/e1000e/82571.c
+++ b/drivers/net/ethernet/intel/e1000e/82571.c
@@ -1572,6 +1572,9 @@ static s32 e1000_check_for_serdes_link_82571(struct e1000_hw *hw)
        ctrl = er32(CTRL);
        status = er32(STATUS);
        rxcw = er32(RXCW);
+        /* SYNCH bit and IV bit are sticky */
+        udelay(10);
+        rxcw = er32(RXCW);
        if ((rxcw & E1000_RXCW_SYNCH) && !(rxcw & E1000_RXCW_IV)) {
diff --git a/drivers/net/ethernet/intel/e1000e/ich8lan.c b/drivers/net/ethernet/intel/e1000e/ich8lan.c
index 238ab2f8a5e7..e3a7b07df629 100644
--- a/drivers/net/ethernet/intel/e1000e/ich8lan.c
+++ b/drivers/net/ethernet/intel/e1000e/ich8lan.c
@@ -325,24 +325,46 @@ static inline void __ew32flash(struct e1000_hw *hw, unsigned long reg, u32 val)
 **/
 static bool e1000_phy_is_accessible_pchlan(struct e1000_hw *hw)
 {
-        u16 phy_reg;
+        u16 phy_reg = 0;
-        u32 phy_id;
+        u32 phy_id = 0;
+        s32 ret_val;
+        u16 retry_count;
+        for (retry_count = 0; retry_count < 2; retry_count++) {
+                ret_val = e1e_rphy_locked(hw, PHY_ID1, &phy_reg);
+                if (ret_val || (phy_reg == 0xFFFF))
+                        continue;
+                phy_id = (u32)(phy_reg << 16);
-        e1e_rphy_locked(hw, PHY_ID1, &phy_reg);
+                ret_val = e1e_rphy_locked(hw, PHY_ID2, &phy_reg);
-        phy_id = (u32)(phy_reg << 16);
+                if (ret_val || (phy_reg == 0xFFFF)) {
-        e1e_rphy_locked(hw, PHY_ID2, &phy_reg);
+                        phy_id = 0;
-        phy_id |= (u32)(phy_reg & PHY_REVISION_MASK);
+                        continue;
+                }
+                phy_id |= (u32)(phy_reg & PHY_REVISION_MASK);
+                break;
+        }
        if (hw->phy.id) {
                if (hw->phy.id == phy_id)
                        return true;
-        } else {
+        } else if (phy_id) {
-                if ((phy_id != 0) && (phy_id != PHY_REVISION_MASK))
+                hw->phy.id = phy_id;
-                        hw->phy.id = phy_id;
+                hw->phy.revision = (u32)(phy_reg & ~PHY_REVISION_MASK);
                return true;
        }
-        return false;
+        /*
+         * In case the PHY needs to be in mdio slow mode,
+         * set slow mode and try to get the PHY id again.
+         */
+        hw->phy.ops.release(hw);
+        ret_val = e1000_set_mdio_slow_mode_hv(hw);
+        if (!ret_val)
+                ret_val = e1000e_get_phy_id(hw);
+        hw->phy.ops.acquire(hw);
+        return !ret_val;
 }
 /**
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 18ca3bcadf0c..e242104ab471 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -6647,6 +6647,11 @@ int ixgbe_setup_tc(struct net_device *dev, u8 tc)
                return -EINVAL;
        }
+        if (adapter->flags & IXGBE_FLAG_SRIOV_ENABLED) {
+                e_err(drv, "Enable failed, SR-IOV enabled\n");
+                return -EINVAL;
+        }
        /* Hardware supports up to 8 traffic classes */
        if (tc > adapter->dcb_cfg.num_tcs.pg_tcs ||
            (hw->mac.type == ixgbe_mac_82598EB &&
diff --git a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
index f69ec4288b10..41e32257a4e8 100644
--- a/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
+++ b/drivers/net/ethernet/intel/ixgbevf/ixgbevf_main.c
@@ -201,6 +201,9 @@ static bool ixgbevf_clean_tx_irq(struct ixgbevf_adapter *adapter,
        unsigned int i, eop, count = 0;
        unsigned int total_bytes = 0, total_packets = 0;
+        if (test_bit(__IXGBEVF_DOWN, &adapter->state))
+                return true;
        i = tx_ring->next_to_clean;
        eop = tx_ring->tx_buffer_info[i].next_to_watch;
        eop_desc = IXGBE_TX_DESC_ADV(*tx_ring, eop);
@@ -969,8 +972,6 @@ static irqreturn_t ixgbevf_msix_clean_tx(int irq, void *data)
        r_idx = find_first_bit(q_vector->txr_idx, adapter->num_tx_queues);
        for (i = 0; i < q_vector->txr_count; i++) {
                tx_ring = &(adapter->tx_ring[r_idx]);
-                tx_ring->total_bytes = 0;
-                tx_ring->total_packets = 0;
                ixgbevf_clean_tx_irq(adapter, tx_ring);
                r_idx = find_next_bit(q_vector->txr_idx, adapter->num_tx_queues,
                                      r_idx + 1);
@@ -994,16 +995,6 @@ static irqreturn_t ixgbevf_msix_clean_rx(int irq, void *data)
        struct ixgbe_hw *hw = &adapter->hw;
        struct ixgbevf_ring  *rx_ring;
        int r_idx;
-        int i;
-        r_idx = find_first_bit(q_vector->rxr_idx, adapter->num_rx_queues);
-        for (i = 0; i < q_vector->rxr_count; i++) {
-                rx_ring = &(adapter->rx_ring[r_idx]);
-                rx_ring->total_bytes = 0;
-                rx_ring->total_packets = 0;
-                r_idx = find_next_bit(q_vector->rxr_idx, adapter->num_rx_queues,
-                                      r_idx + 1);
-        }
        if (!q_vector->rxr_count)
                return IRQ_HANDLED;
diff --git a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
index fb8377da1687..4b785e10f2ed 100644
--- a/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
+++ b/drivers/net/ethernet/stmicro/stmmac/ring_mode.c
@@ -51,7 +51,7 @@ static unsigned int stmmac_jumbo_frm(void *p, struct sk_buff *skb, int csum)
                desc->des3 = desc->des2 + BUF_SIZE_4KiB;
                priv->hw->desc->prepare_tx_desc(desc, 1, bmax,
                                                csum);
+                wmb();
                entry = (++priv->cur_tx) % txsize;
                desc = priv->dma_tx + entry;
@@ -59,6 +59,7 @@ static unsigned int stmmac_jumbo_frm(void *p, struct sk_buff *skb, int csum)
                                            len, DMA_TO_DEVICE);
                desc->des3 = desc->des2 + BUF_SIZE_4KiB;
                priv->hw->desc->prepare_tx_desc(desc, 0, len, csum);
+                wmb();
                priv->hw->desc->set_tx_owner(desc);
                priv->tx_skbuff[entry] = NULL;
        } else {
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 51b3b68528ee..ea3003edde18 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -1212,6 +1212,7 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
                priv->hw->desc->prepare_tx_desc(desc, 0, len, csum_insertion);
                wmb();
                priv->hw->desc->set_tx_owner(desc);
+                wmb();
        }
        /* Interrupt on completition only for the latest segment */
@@ -1227,6 +1228,7 @@ static netdev_tx_t stmmac_xmit(struct sk_buff *skb, struct net_device *dev)
        /* To avoid raise condition */
        priv->hw->desc->set_tx_owner(first);
+        wmb();
        priv->cur_tx++;
@@ -1290,6 +1292,7 @@ static inline void stmmac_rx_refill(struct stmmac_priv *priv)
                }
                wmb();
                priv->hw->desc->set_rx_owner(p + entry);
+                wmb();
        }
 }
diff --git a/drivers/net/phy/mdio-mux.c b/drivers/net/phy/mdio-mux.c
index 39ea0674dcde..5c120189ec86 100644
--- a/drivers/net/phy/mdio-mux.c
+++ b/drivers/net/phy/mdio-mux.c
@@ -46,7 +46,13 @@ static int mdio_mux_read(struct mii_bus *bus, int phy_id, int regnum)
        struct mdio_mux_parent_bus *pb = cb->parent;
        int r;
-        mutex_lock(&pb->mii_bus->mdio_lock);
+        /* In theory multiple mdio_mux could be stacked, thus creating
+         * more than a single level of nesting.  But in practice,
+         * SINGLE_DEPTH_NESTING will cover the vast majority of use
+         * cases.  We use it, instead of trying to handle the general
+         * case.
+         */
+        mutex_lock_nested(&pb->mii_bus->mdio_lock, SINGLE_DEPTH_NESTING);
        r = pb->switch_fn(pb->current_child, cb->bus_number, pb->switch_data);
        if (r)
                goto out;
@@ -71,7 +77,7 @@ static int mdio_mux_write(struct mii_bus *bus, int phy_id,
        int r;
-        mutex_lock(&pb->mii_bus->mdio_lock);
+        mutex_lock_nested(&pb->mii_bus->mdio_lock, SINGLE_DEPTH_NESTING);
        r = pb->switch_fn(pb->current_child, cb->bus_number, pb->switch_data);
        if (r)
                goto out;
diff --git a/drivers/net/usb/qmi_wwan.c b/drivers/net/usb/qmi_wwan.c
index b01960fcfbc9..a051cedd64bd 100644
--- a/drivers/net/usb/qmi_wwan.c
+++ b/drivers/net/usb/qmi_wwan.c
@@ -346,6 +346,15 @@ static const struct driver_info	qmi_wwan_force_int1 = {
        .data           = BIT(1), /* interface whitelist bitmap */
 };
+static const struct driver_info qmi_wwan_force_int2 = {
+        .description    = "Qualcomm WWAN/QMI device",
+        .flags          = FLAG_WWAN,
+        .bind           = qmi_wwan_bind_shared,
+        .unbind         = qmi_wwan_unbind_shared,
+        .manage_power   = qmi_wwan_manage_power,
+        .data           = BIT(2), /* interface whitelist bitmap */
+};
 static const struct driver_info qmi_wwan_force_int3 = {
        .description    = "Qualcomm WWAN/QMI device",
        .flags          = FLAG_WWAN,
@@ -498,6 +507,15 @@ static const struct usb_device_id products[] = {
                .bInterfaceProtocol = 0xff,
                .driver_info        = (unsigned long)&qmi_wwan_force_int4,
        },
+        {       /* ZTE MF60 */
+                .match_flags        = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
+                .idVendor           = 0x19d2,
+                .idProduct          = 0x1402,
+                .bInterfaceClass    = 0xff,
+                .bInterfaceSubClass = 0xff,
+                .bInterfaceProtocol = 0xff,
+                .driver_info        = (unsigned long)&qmi_wwan_force_int2,
+        },
        {       /* Sierra Wireless MC77xx in QMI mode */
                .match_flags        = USB_DEVICE_ID_MATCH_DEVICE | USB_DEVICE_ID_MATCH_INT_INFO,
                .idVendor           = 0x1199,
diff --git a/drivers/net/wireless/b43legacy/dma.c b/drivers/net/wireless/b43legacy/dma.c
index f1f8bd09bd87..c8baf020c20f 100644
--- a/drivers/net/wireless/b43legacy/dma.c
+++ b/drivers/net/wireless/b43legacy/dma.c
@@ -1072,7 +1072,7 @@ static int dma_tx_fragment(struct b43legacy_dmaring *ring,
        meta->dmaaddr = map_descbuffer(ring, skb->data, skb->len, 1);
        /* create a bounce buffer in zone_dma on mapping failure. */
        if (b43legacy_dma_mapping_error(ring, meta->dmaaddr, skb->len, 1)) {
-                bounce_skb = __dev_alloc_skb(skb->len, GFP_ATOMIC | GFP_DMA);
+                bounce_skb = alloc_skb(skb->len, GFP_ATOMIC | GFP_DMA);
                if (!bounce_skb) {
                        ring->current_slot = old_top_slot;
                        ring->used_slots = old_used_slots;
diff --git a/drivers/net/wireless/iwlegacy/4965-mac.c b/drivers/net/wireless/iwlegacy/4965-mac.c
index 509301a5e7e2..ff5d689e13f3 100644
--- a/drivers/net/wireless/iwlegacy/4965-mac.c
+++ b/drivers/net/wireless/iwlegacy/4965-mac.c
@@ -3405,7 +3405,7 @@ il4965_remove_dynamic_key(struct il_priv *il,
                return 0;
        }
-        if (il->stations[sta_id].sta.key.key_offset == WEP_INVALID_OFFSET) {
+        if (il->stations[sta_id].sta.key.key_flags & STA_KEY_FLG_INVALID) {
                IL_WARN("Removing wrong key %d 0x%x\n", keyconf->keyidx,
                        key_flags);
                spin_unlock_irqrestore(&il->sta_lock, flags);
@@ -3420,7 +3420,7 @@ il4965_remove_dynamic_key(struct il_priv *il,
        memset(&il->stations[sta_id].sta.key, 0, sizeof(struct il4965_keyinfo));
        il->stations[sta_id].sta.key.key_flags =
            STA_KEY_FLG_NO_ENC | STA_KEY_FLG_INVALID;
-        il->stations[sta_id].sta.key.key_offset = WEP_INVALID_OFFSET;
+        il->stations[sta_id].sta.key.key_offset = keyconf->hw_key_idx;
        il->stations[sta_id].sta.sta.modify_mask = STA_MODIFY_KEY_MASK;
        il->stations[sta_id].sta.mode = STA_CONTROL_MODIFY_MSK;
diff --git a/drivers/net/wireless/iwlegacy/common.c b/drivers/net/wireless/iwlegacy/common.c
index cbf2dc18341f..5d4807c2b56d 100644
--- a/drivers/net/wireless/iwlegacy/common.c
+++ b/drivers/net/wireless/iwlegacy/common.c
@@ -4767,14 +4767,12 @@ il_bg_watchdog(unsigned long data)
                return;
        /* monitor and check for other stuck queues */
-        if (il_is_any_associated(il)) {
+        for (cnt = 0; cnt < il->hw_params.max_txq_num; cnt++) {
-                for (cnt = 0; cnt < il->hw_params.max_txq_num; cnt++) {
+                /* skip as we already checked the command queue */
-                        /* skip as we already checked the command queue */
+                if (cnt == il->cmd_queue)
-                        if (cnt == il->cmd_queue)
+                        continue;
-                                continue;
+                if (il_check_stuck_queue(il, cnt))
-                        if (il_check_stuck_queue(il, cnt))
+                        return;
-                                return;
-                }
        }
        mod_timer(&il->watchdog,
diff --git a/drivers/net/wireless/mwifiex/cfg80211.c b/drivers/net/wireless/mwifiex/cfg80211.c
index ce61b6fae1c9..5c7fd185373c 100644
--- a/drivers/net/wireless/mwifiex/cfg80211.c
+++ b/drivers/net/wireless/mwifiex/cfg80211.c
@@ -958,6 +958,7 @@ static int mwifiex_cfg80211_start_ap(struct wiphy *wiphy,
        case NL80211_HIDDEN_SSID_ZERO_CONTENTS:
                /* firmware doesn't support this type of hidden SSID */
        default:
+                kfree(bss_cfg);
                return -EINVAL;
        }
diff --git a/drivers/net/wireless/rt2x00/rt2x00usb.c b/drivers/net/wireless/rt2x00/rt2x00usb.c
index d357d1ed92f6..74ecc33fdd90 100644
--- a/drivers/net/wireless/rt2x00/rt2x00usb.c
+++ b/drivers/net/wireless/rt2x00/rt2x00usb.c
@@ -436,8 +436,8 @@ void rt2x00usb_kick_queue(struct data_queue *queue)
        case QID_RX:
                if (!rt2x00queue_full(queue))
                        rt2x00queue_for_each_entry(queue,
-                                                   Q_INDEX_DONE,
                                                   Q_INDEX,
+                                                   Q_INDEX_DONE,
                                                   NULL,
                                                   rt2x00usb_kick_rx_entry);
                break;
diff --git a/drivers/pinctrl/pinctrl-imx.c b/drivers/pinctrl/pinctrl-imx.c
index dd6d93aa5334..90c837f469a6 100644
--- a/drivers/pinctrl/pinctrl-imx.c
+++ b/drivers/pinctrl/pinctrl-imx.c
@@ -474,7 +474,9 @@ static int __devinit imx_pinctrl_parse_groups(struct device_node *np,
                grp->configs[j] = config & ~IMX_PAD_SION;
        }
+#ifdef DEBUG
        IMX_PMX_DUMP(info, grp->pins, grp->mux_mode, grp->configs, grp->npins);
+#endif
        return 0;
 }
diff --git a/drivers/pinctrl/pinctrl-imx6q.c b/drivers/pinctrl/pinctrl-imx6q.c
index 7737d4d71a3c..e9bf71fbedca 100644
--- a/drivers/pinctrl/pinctrl-imx6q.c
+++ b/drivers/pinctrl/pinctrl-imx6q.c
@@ -1950,6 +1950,8 @@ static struct imx_pin_reg imx6q_pin_regs[] = {
        IMX_PIN_REG(MX6Q_PAD_SD2_DAT3, 0x0744, 0x035C, 5, 0x0000, 0), /* MX6Q_PAD_SD2_DAT3__GPIO_1_12 */
        IMX_PIN_REG(MX6Q_PAD_SD2_DAT3, 0x0744, 0x035C, 6, 0x0000, 0), /* MX6Q_PAD_SD2_DAT3__SJC_DONE */
        IMX_PIN_REG(MX6Q_PAD_SD2_DAT3, 0x0744, 0x035C, 7, 0x0000, 0), /* MX6Q_PAD_SD2_DAT3__ANATOP_TESTO_3 */
+        IMX_PIN_REG(MX6Q_PAD_ENET_RX_ER, 0x04EC, 0x01D8, 0, 0x0000, 0), /* MX6Q_PAD_ENET_RX_ER__ANATOP_USBOTG_ID */
+        IMX_PIN_REG(MX6Q_PAD_GPIO_1, 0x05F4, 0x0224, 3, 0x0000, 0), /* MX6Q_PAD_GPIO_1__ANATOP_USBOTG_ID */
 };
 /* Pad names for the pinmux subsystem */
diff --git a/drivers/platform/x86/ideapad-laptop.c b/drivers/platform/x86/ideapad-laptop.c
index 4f20f8dd3d7c..17f6dfd8dbfb 100644
--- a/drivers/platform/x86/ideapad-laptop.c
+++ b/drivers/platform/x86/ideapad-laptop.c
@@ -694,10 +694,10 @@ MODULE_DEVICE_TABLE(acpi, ideapad_device_ids);
 static int __devinit ideapad_acpi_add(struct acpi_device *adevice)
 {
        int ret, i;
-        unsigned long cfg;
+        int cfg;
        struct ideapad_private *priv;
-        if (read_method_int(adevice->handle, "_CFG", (int *)&cfg))
+        if (read_method_int(adevice->handle, "_CFG", &cfg))
                return -ENODEV;
        priv = kzalloc(sizeof(*priv), GFP_KERNEL);
@@ -721,7 +721,7 @@ static int __devinit ideapad_acpi_add(struct acpi_device *adevice)
                goto input_failed;
        for (i = 0; i < IDEAPAD_RFKILL_DEV_NUM; i++) {
-                if (test_bit(ideapad_rfk_data[i].cfgbit, &cfg))
+                if (test_bit(ideapad_rfk_data[i].cfgbit, &priv->cfg))
                        ideapad_register_rfkill(adevice, i);
                else
                        priv->rfk[i] = NULL;
diff --git a/drivers/platform/x86/intel_ips.c b/drivers/platform/x86/intel_ips.c
index 0ffdb3cde2bb..9af4257d4901 100644
--- a/drivers/platform/x86/intel_ips.c
+++ b/drivers/platform/x86/intel_ips.c
@@ -72,6 +72,7 @@
 #include <linux/string.h>
 #include <linux/tick.h>
 #include <linux/timer.h>
+#include <linux/dmi.h>
 #include <drm/i915_drm.h>
 #include <asm/msr.h>
 #include <asm/processor.h>
@@ -1485,6 +1486,24 @@ static DEFINE_PCI_DEVICE_TABLE(ips_id_table) = {
 MODULE_DEVICE_TABLE(pci, ips_id_table);
+static int ips_blacklist_callback(const struct dmi_system_id *id)
+{
+        pr_info("Blacklisted intel_ips for %s\n", id->ident);
+        return 1;
+}
+static const struct dmi_system_id ips_blacklist[] = {
+        {
+                .callback = ips_blacklist_callback,
+                .ident = "HP ProBook",
+                .matches = {
+                        DMI_MATCH(DMI_SYS_VENDOR, "Hewlett-Packard"),
+                        DMI_MATCH(DMI_PRODUCT_NAME, "HP ProBook"),
+                },
+        },
+        { }     /* terminating entry */
+};
 static int ips_probe(struct pci_dev *dev, const struct pci_device_id *id)
 {
        u64 platform_info;
@@ -1494,6 +1513,9 @@ static int ips_probe(struct pci_dev *dev, const struct pci_device_id *id)
        u16 htshi, trc, trc_required_mask;
        u8 tse;
+        if (dmi_check_system(ips_blacklist))
+                return -ENODEV;
        ips = kzalloc(sizeof(struct ips_driver), GFP_KERNEL);
        if (!ips)
                return -ENOMEM;
diff --git a/drivers/platform/x86/sony-laptop.c b/drivers/platform/x86/sony-laptop.c
index 210d4ae547c2..d456ff0c73b7 100644
--- a/drivers/platform/x86/sony-laptop.c
+++ b/drivers/platform/x86/sony-laptop.c
@@ -973,7 +973,7 @@ static ssize_t sony_nc_sysfs_store(struct device *dev,
                               struct device_attribute *attr,
                               const char *buffer, size_t count)
 {
-        unsigned long value = 0;
+        int value;
        int ret = 0;
        struct sony_nc_value *item =
            container_of(attr, struct sony_nc_value, devattr);
@@ -984,7 +984,7 @@ static ssize_t sony_nc_sysfs_store(struct device *dev,
        if (count > 31)
                return -EINVAL;
-        if (kstrtoul(buffer, 10, &value))
+        if (kstrtoint(buffer, 10, &value))
                return -EINVAL;
        if (item->validate)
@@ -994,7 +994,7 @@ static ssize_t sony_nc_sysfs_store(struct device *dev,
                return value;
        ret = sony_nc_int_call(sony_nc_acpi_handle, *item->acpiset,
-                        (int *)&value, NULL);
+                               &value, NULL);
        if (ret < 0)
                return -EIO;
@@ -1010,6 +1010,7 @@ static ssize_t sony_nc_sysfs_store(struct device *dev,
 struct sony_backlight_props {
        struct backlight_device *dev;
        int                     handle;
+        int                     cmd_base;
        u8                      offset;
        u8                      maxlvl;
 };
@@ -1037,7 +1038,7 @@ static int sony_nc_get_brightness_ng(struct backlight_device *bd)
        struct sony_backlight_props *sdev =
                (struct sony_backlight_props *)bl_get_data(bd);
-        sony_call_snc_handle(sdev->handle, 0x0200, &result);
+        sony_call_snc_handle(sdev->handle, sdev->cmd_base + 0x100, &result);
        return (result & 0xff) - sdev->offset;
 }
@@ -1049,7 +1050,8 @@ static int sony_nc_update_status_ng(struct backlight_device *bd)
                (struct sony_backlight_props *)bl_get_data(bd);
        value = bd->props.brightness + sdev->offset;
-        if (sony_call_snc_handle(sdev->handle, 0x0100 | (value << 16), &result))
+        if (sony_call_snc_handle(sdev->handle, sdev->cmd_base | (value << 0x10),
+                                &result))
                return -EIO;
        return value;
@@ -1172,6 +1174,11 @@ static int sony_nc_hotkeys_decode(u32 event, unsigned int handle)
 /*
 * ACPI callbacks
 */
+enum event_types {
+        HOTKEY = 1,
+        KILLSWITCH,
+        GFX_SWITCH
+};
 static void sony_nc_notify(struct acpi_device *device, u32 event)
 {
        u32 real_ev = event;
@@ -1196,7 +1203,7 @@ static void sony_nc_notify(struct acpi_device *device, u32 event)
                /* hotkey event */
                case 0x0100:
                case 0x0127:
-                        ev_type = 1;
+                        ev_type = HOTKEY;
                        real_ev = sony_nc_hotkeys_decode(event, handle);
                        if (real_ev > 0)
@@ -1216,7 +1223,7 @@ static void sony_nc_notify(struct acpi_device *device, u32 event)
                         * update the rfkill device status when the
                         * switch is moved.
                         */
-                        ev_type = 2;
+                        ev_type = KILLSWITCH;
                        sony_call_snc_handle(handle, 0x0100, &result);
                        real_ev = result & 0x03;
@@ -1226,6 +1233,24 @@ static void sony_nc_notify(struct acpi_device *device, u32 event)
                        break;
+                case 0x0128:
+                case 0x0146:
+                        /* Hybrid GFX switching */
+                        sony_call_snc_handle(handle, 0x0000, &result);
+                        dprintk("GFX switch event received (reason: %s)\n",
+                                        (result & 0x01) ?
+                                        "switch change" : "unknown");
+                        /* verify the switch state
+                         * 1: discrete GFX
+                         * 0: integrated GFX
+                         */
+                        sony_call_snc_handle(handle, 0x0100, &result);
+                        ev_type = GFX_SWITCH;
+                        real_ev = result & 0xff;
+                        break;
                default:
                        dprintk("Unknown event 0x%x for handle 0x%x\n",
                                        event, handle);
@@ -1238,7 +1263,7 @@ static void sony_nc_notify(struct acpi_device *device, u32 event)
        } else {
                /* old style event */
-                ev_type = 1;
+                ev_type = HOTKEY;
                sony_laptop_report_input_event(real_ev);
        }
@@ -1893,32 +1918,33 @@ static ssize_t sony_nc_battery_care_limit_store(struct device *dev,
         *  bits 4,5: store the limit into the EC
         *  bits 6,7: store the limit into the battery
         */
+        cmd = 0;
-        /*
+        if (value > 0) {
-         * handle 0x0115 should allow storing on battery too;
+                if (value <= 50)
-         * handle 0x0136 same as 0x0115 + health status;
+                        cmd = 0x20;
-         * handle 0x013f, same as 0x0136 but no storing on the battery
-         *
-         * Store only inside the EC for now, regardless the handle number
-         */
-        if (value == 0)
-                /* disable limits */
-                cmd = 0x0;
-        else if (value <= 50)
+                else if (value <= 80)
-                cmd = 0x21;
+                        cmd = 0x10;
-        else if (value <= 80)
+                else if (value <= 100)
-                cmd = 0x11;
+                        cmd = 0x30;
-        else if (value <= 100)
+                else
-                cmd = 0x31;
+                        return -EINVAL;
-        else
+                /*
-                return -EINVAL;
+                 * handle 0x0115 should allow storing on battery too;
+                 * handle 0x0136 same as 0x0115 + health status;
+                 * handle 0x013f, same as 0x0136 but no storing on the battery
+                 */
+                if (bcare_ctl->handle != 0x013f)
+                        cmd = cmd | (cmd << 2);
-        if (sony_call_snc_handle(bcare_ctl->handle, (cmd << 0x10) | 0x0100,
+                cmd = (cmd | 0x1) << 0x10;
-                                &result))
+        }
+        if (sony_call_snc_handle(bcare_ctl->handle, cmd | 0x0100, &result))
                return -EIO;
        return count;
@@ -2113,7 +2139,7 @@ static ssize_t sony_nc_thermal_mode_show(struct device *dev,
                struct device_attribute *attr, char *buffer)
 {
        ssize_t count = 0;
-        unsigned int mode = sony_nc_thermal_mode_get();
+        int mode = sony_nc_thermal_mode_get();
        if (mode < 0)
                return mode;
@@ -2472,6 +2498,7 @@ static void sony_nc_backlight_ng_read_limits(int handle,
 {
        u64 offset;
        int i;
+        int lvl_table_len = 0;
        u8 min = 0xff, max = 0x00;
        unsigned char buffer[32] = { 0 };
@@ -2480,8 +2507,6 @@ static void sony_nc_backlight_ng_read_limits(int handle,
        props->maxlvl = 0xff;
        offset = sony_find_snc_handle(handle);
-        if (offset < 0)
-                return;
        /* try to read the boundaries from ACPI tables, if we fail the above
         * defaults should be reasonable
@@ -2491,11 +2516,21 @@ static void sony_nc_backlight_ng_read_limits(int handle,
        if (i < 0)
                return;
+        switch (handle) {
+        case 0x012f:
+        case 0x0137:
+                lvl_table_len = 9;
+                break;
+        case 0x143:
+                lvl_table_len = 16;
+                break;
+        }
        /* the buffer lists brightness levels available, brightness levels are
         * from position 0 to 8 in the array, other values are used by ALS
         * control.
         */
-        for (i = 0; i < 9 && i < ARRAY_SIZE(buffer); i++) {
+        for (i = 0; i < lvl_table_len && i < ARRAY_SIZE(buffer); i++) {
                dprintk("Brightness level: %d\n", buffer[i]);
@@ -2520,16 +2555,24 @@ static void sony_nc_backlight_setup(void)
        const struct backlight_ops *ops = NULL;
        struct backlight_properties props;
-        if (sony_find_snc_handle(0x12f) != -1) {
+        if (sony_find_snc_handle(0x12f) >= 0) {
                ops = &sony_backlight_ng_ops;
+                sony_bl_props.cmd_base = 0x0100;
                sony_nc_backlight_ng_read_limits(0x12f, &sony_bl_props);
                max_brightness = sony_bl_props.maxlvl - sony_bl_props.offset;
-        } else if (sony_find_snc_handle(0x137) != -1) {
+        } else if (sony_find_snc_handle(0x137) >= 0) {
                ops = &sony_backlight_ng_ops;
+                sony_bl_props.cmd_base = 0x0100;
                sony_nc_backlight_ng_read_limits(0x137, &sony_bl_props);
                max_brightness = sony_bl_props.maxlvl - sony_bl_props.offset;
+        } else if (sony_find_snc_handle(0x143) >= 0) {
+                ops = &sony_backlight_ng_ops;
+                sony_bl_props.cmd_base = 0x3000;
+                sony_nc_backlight_ng_read_limits(0x143, &sony_bl_props);
+                max_brightness = sony_bl_props.maxlvl - sony_bl_props.offset;
        } else if (ACPI_SUCCESS(acpi_get_handle(sony_nc_acpi_handle, "GBRT",
                                                &unused))) {
                ops = &sony_backlight_ops;
@@ -2597,6 +2640,12 @@ static int sony_nc_add(struct acpi_device *device)
                }
        }
+        result = sony_laptop_setup_input(device);
+        if (result) {
+                pr_err("Unable to create input devices\n");
+                goto outplatform;
+        }
        if (ACPI_SUCCESS(acpi_get_handle(sony_nc_acpi_handle, "ECON",
                                         &handle))) {
                int arg = 1;
@@ -2614,12 +2663,6 @@ static int sony_nc_add(struct acpi_device *device)
        }
        /* setup input devices and helper fifo */
-        result = sony_laptop_setup_input(device);
-        if (result) {
-                pr_err("Unable to create input devices\n");
-                goto outsnc;
-        }
        if (acpi_video_backlight_support()) {
                pr_info("brightness ignored, must be controlled by ACPI video driver\n");
        } else {
@@ -2667,22 +2710,21 @@ static int sony_nc_add(struct acpi_device *device)
        return 0;
-      out_sysfs:
+out_sysfs:
        for (item = sony_nc_values; item->name; ++item) {
                device_remove_file(&sony_pf_device->dev, &item->devattr);
        }
        sony_nc_backlight_cleanup();
-        sony_laptop_remove_input();
-      outsnc:
        sony_nc_function_cleanup(sony_pf_device);
        sony_nc_handles_cleanup(sony_pf_device);
-      outpresent:
+outplatform:
+        sony_laptop_remove_input();
+outpresent:
        sony_pf_remove();
-      outwalk:
+outwalk:
        sony_nc_rfkill_cleanup();
        return result;
 }
diff --git a/drivers/rpmsg/virtio_rpmsg_bus.c b/drivers/rpmsg/virtio_rpmsg_bus.c
index 39d3aa41adda..f56c8ba3a861 100644
--- a/drivers/rpmsg/virtio_rpmsg_bus.c
+++ b/drivers/rpmsg/virtio_rpmsg_bus.c
@@ -1085,7 +1085,7 @@ static int __init rpmsg_init(void)
        return ret;
 }
-module_init(rpmsg_init);
+subsys_initcall(rpmsg_init);
 static void __exit rpmsg_fini(void)
 {
diff --git a/fs/cifs/cifssmb.c b/fs/cifs/cifssmb.c
index 5b400730c213..4ee522b3f66f 100644
--- a/fs/cifs/cifssmb.c
+++ b/fs/cifs/cifssmb.c
@@ -86,7 +86,31 @@ static struct {
 #endif /* CONFIG_CIFS_WEAK_PW_HASH */
 #endif /* CIFS_POSIX */
-/* Forward declarations */
+#ifdef CONFIG_HIGHMEM
+/*
+ * On arches that have high memory, kmap address space is limited. By
+ * serializing the kmap operations on those arches, we ensure that we don't
+ * end up with a bunch of threads in writeback with partially mapped page
+ * arrays, stuck waiting for kmap to come back. That situation prevents
+ * progress and can deadlock.
+ */
+static DEFINE_MUTEX(cifs_kmap_mutex);
+static inline void
+cifs_kmap_lock(void)
+{
+        mutex_lock(&cifs_kmap_mutex);
+}
+static inline void
+cifs_kmap_unlock(void)
+{
+        mutex_unlock(&cifs_kmap_mutex);
+}
+#else /* !CONFIG_HIGHMEM */
+#define cifs_kmap_lock() do { ; } while(0)
+#define cifs_kmap_unlock() do { ; } while(0)
+#endif /* CONFIG_HIGHMEM */
 /* Mark as invalid, all open files on tree connections since they
   were closed when session to server was lost */
@@ -1503,7 +1527,9 @@ cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid)
        }
        /* marshal up the page array */
+        cifs_kmap_lock();
        len = rdata->marshal_iov(rdata, data_len);
+        cifs_kmap_unlock();
        data_len -= len;
        /* issue the read if we have any iovecs left to fill */
@@ -2069,7 +2095,9 @@ cifs_async_writev(struct cifs_writedata *wdata)
         * and set the iov_len properly for each one. It may also set
         * wdata->bytes too.
         */
+        cifs_kmap_lock();
        wdata->marshal_iov(iov, wdata);
+        cifs_kmap_unlock();
        cFYI(1, "async write at %llu %u bytes", wdata->offset, wdata->bytes);
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 0ae86ddf2213..94b7788c3189 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -3445,6 +3445,18 @@ void cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
 #define CIFS_DEFAULT_NON_POSIX_RSIZE (60 * 1024)
 #define CIFS_DEFAULT_NON_POSIX_WSIZE (65536)
+/*
+ * On hosts with high memory, we can't currently support wsize/rsize that are
+ * larger than we can kmap at once. Cap the rsize/wsize at
+ * LAST_PKMAP * PAGE_SIZE. We'll never be able to fill a read or write request
+ * larger than that anyway.
+ */
+#ifdef CONFIG_HIGHMEM
+#define CIFS_KMAP_SIZE_LIMIT    (LAST_PKMAP * PAGE_CACHE_SIZE)
+#else /* CONFIG_HIGHMEM */
+#define CIFS_KMAP_SIZE_LIMIT    (1<<24)
+#endif /* CONFIG_HIGHMEM */
 static unsigned int
 cifs_negotiate_wsize(struct cifs_tcon *tcon, struct smb_vol *pvolume_info)
 {
@@ -3475,6 +3487,9 @@ cifs_negotiate_wsize(struct cifs_tcon *tcon, struct smb_vol *pvolume_info)
                wsize = min_t(unsigned int, wsize,
                                server->maxBuf - sizeof(WRITE_REQ) + 4);
+        /* limit to the amount that we can kmap at once */
+        wsize = min_t(unsigned int, wsize, CIFS_KMAP_SIZE_LIMIT);
        /* hard limit of CIFS_MAX_WSIZE */
        wsize = min_t(unsigned int, wsize, CIFS_MAX_WSIZE);
@@ -3516,6 +3531,9 @@ cifs_negotiate_rsize(struct cifs_tcon *tcon, struct smb_vol *pvolume_info)
        if (!(server->capabilities & CAP_LARGE_READ_X))
                rsize = min_t(unsigned int, CIFSMaxBufSize, rsize);
+        /* limit to the amount that we can kmap at once */
+        rsize = min_t(unsigned int, rsize, CIFS_KMAP_SIZE_LIMIT);
        /* hard limit of CIFS_MAX_RSIZE */
        rsize = min_t(unsigned int, rsize, CIFS_MAX_RSIZE);
diff --git a/fs/cifs/readdir.c b/fs/cifs/readdir.c
index 0a8224d1c4c5..a4217f02fab2 100644
--- a/fs/cifs/readdir.c
+++ b/fs/cifs/readdir.c
@@ -86,9 +86,12 @@ cifs_readdir_lookup(struct dentry *parent, struct qstr *name,
        dentry = d_lookup(parent, name);
        if (dentry) {
-                /* FIXME: check for inode number changes? */
+                inode = dentry->d_inode;
-                if (dentry->d_inode != NULL)
+                /* update inode in place if i_ino didn't change */
+                if (inode && CIFS_I(inode)->uniqueid == fattr->cf_uniqueid) {
+                        cifs_fattr_to_inode(inode, fattr);
                        return dentry;
+                }
                d_drop(dentry);
                dput(dentry);
        }
diff --git a/fs/cifs/transport.c b/fs/cifs/transport.c
index 3097ee58fd7d..f25d4ea14be4 100644
--- a/fs/cifs/transport.c
+++ b/fs/cifs/transport.c
@@ -365,16 +365,14 @@ cifs_setup_async_request(struct TCP_Server_Info *server, struct kvec *iov,
        if (mid == NULL)
                return -ENOMEM;
-        /* put it on the pending_mid_q */
-        spin_lock(&GlobalMid_Lock);
-        list_add_tail(&mid->qhead, &server->pending_mid_q);
-        spin_unlock(&GlobalMid_Lock);
        rc = cifs_sign_smb2(iov, nvec, server, &mid->sequence_number);
-        if (rc)
+        if (rc) {
-                delete_mid(mid);
+                DeleteMidQEntry(mid);
+                return rc;
+        }
        *ret_mid = mid;
-        return rc;
+        return 0;
 }
 /*
@@ -407,17 +405,21 @@ cifs_call_async(struct TCP_Server_Info *server, struct kvec *iov,
        mid->callback_data = cbdata;
        mid->mid_state = MID_REQUEST_SUBMITTED;
+        /* put it on the pending_mid_q */
+        spin_lock(&GlobalMid_Lock);
+        list_add_tail(&mid->qhead, &server->pending_mid_q);
+        spin_unlock(&GlobalMid_Lock);
        cifs_in_send_inc(server);
        rc = smb_sendv(server, iov, nvec);
        cifs_in_send_dec(server);
        cifs_save_when_sent(mid);
        mutex_unlock(&server->srv_mutex);
-        if (rc)
+        if (rc == 0)
-                goto out_err;
+                return 0;
-        return rc;
-out_err:
        delete_mid(mid);
        add_credits(server, 1);
        wake_up(&server->request_q);
diff --git a/fs/eventpoll.c b/fs/eventpoll.c
index 74598f67efeb..1c8b55670804 100644
--- a/fs/eventpoll.c
+++ b/fs/eventpoll.c
@@ -1710,7 +1710,7 @@ SYSCALL_DEFINE4(epoll_ctl, int, epfd, int, op, int, fd,
                goto error_tgt_fput;
        /* Check if EPOLLWAKEUP is allowed */
-        if ((epds.events & EPOLLWAKEUP) && !capable(CAP_EPOLLWAKEUP))
+        if ((epds.events & EPOLLWAKEUP) && !capable(CAP_BLOCK_SUSPEND))
                epds.events &= ~EPOLLWAKEUP;
        /*
diff --git a/fs/ext4/ioctl.c b/fs/ext4/ioctl.c
index e34deac3f366..6ec6f9ee2fec 100644
--- a/fs/ext4/ioctl.c
+++ b/fs/ext4/ioctl.c
@@ -268,7 +268,6 @@ group_extend_out:
                err = ext4_move_extents(filp, donor_filp, me.orig_start,
                                        me.donor_start, me.len, &me.moved_len);
                mnt_drop_write_file(filp);
-                mnt_drop_write(filp->f_path.mnt);
                if (copy_to_user((struct move_extent __user *)arg,
                                 &me, sizeof(me)))
diff --git a/fs/fifo.c b/fs/fifo.c
index b1a524d798e7..cf6f4345ceb0 100644
--- a/fs/fifo.c
+++ b/fs/fifo.c
@@ -14,7 +14,7 @@
 #include <linux/sched.h>
 #include <linux/pipe_fs_i.h>
-static void wait_for_partner(struct inode* inode, unsigned int *cnt)
+static int wait_for_partner(struct inode* inode, unsigned int *cnt)
 {
        int cur = *cnt; 
@@ -23,6 +23,7 @@ static void wait_for_partner(struct inode* inode, unsigned int *cnt)
                if (signal_pending(current))
                        break;
        }
+        return cur == *cnt ? -ERESTARTSYS : 0;
 }
 static void wake_up_partner(struct inode* inode)
@@ -67,8 +68,7 @@ static int fifo_open(struct inode *inode, struct file *filp)
                                 * seen a writer */
                                filp->f_version = pipe->w_counter;
                        } else {
-                                wait_for_partner(inode, &pipe->w_counter);
+                                if (wait_for_partner(inode, &pipe->w_counter))
-                                if(signal_pending(current))
                                        goto err_rd;
                        }
                }
@@ -90,8 +90,7 @@ static int fifo_open(struct inode *inode, struct file *filp)
                        wake_up_partner(inode);
                if (!pipe->readers) {
-                        wait_for_partner(inode, &pipe->r_counter);
+                        if (wait_for_partner(inode, &pipe->r_counter))
-                        if (signal_pending(current))
                                goto err_wr;
                }
                break;
diff --git a/fs/xfs/xfs_alloc.c b/fs/xfs/xfs_alloc.c
index 9d1aeb7e2734..4f33c32affe3 100644
--- a/fs/xfs/xfs_alloc.c
+++ b/fs/xfs/xfs_alloc.c
@@ -1074,13 +1074,13 @@ restart:
         * If we couldn't get anything, give up.
         */
        if (bno_cur_lt == NULL && bno_cur_gt == NULL) {
+                xfs_btree_del_cursor(cnt_cur, XFS_BTREE_NOERROR);
                if (!forced++) {
                        trace_xfs_alloc_near_busy(args);
                        xfs_log_force(args->mp, XFS_LOG_SYNC);
                        goto restart;
                }
-                xfs_btree_del_cursor(cnt_cur, XFS_BTREE_NOERROR);
                trace_xfs_alloc_size_neither(args);
                args->agbno = NULLAGBLOCK;
                return 0;
@@ -2434,13 +2434,22 @@ xfs_alloc_vextent_worker(
        current_restore_flags_nested(&pflags, PF_FSTRANS);
 }
+/*
-int                             /* error */
+ * Data allocation requests often come in with little stack to work on. Push
+ * them off to a worker thread so there is lots of stack to use. Metadata
+ * requests, OTOH, are generally from low stack usage paths, so avoid the
+ * context switch overhead here.
+ */
+int
 xfs_alloc_vextent(
-        xfs_alloc_arg_t *args)  /* allocation argument structure */
+        struct xfs_alloc_arg    *args)
 {
        DECLARE_COMPLETION_ONSTACK(done);
+        if (!args->userdata)
+                return __xfs_alloc_vextent(args);
        args->done = &done;
        INIT_WORK_ONSTACK(&args->work, xfs_alloc_vextent_worker);
        queue_work(xfs_alloc_wq, &args->work);
diff --git a/fs/xfs/xfs_buf.c b/fs/xfs/xfs_buf.c
index a4beb421018a..269b35c084da 100644
--- a/fs/xfs/xfs_buf.c
+++ b/fs/xfs/xfs_buf.c
@@ -989,27 +989,6 @@ xfs_buf_ioerror_alert(
                (__uint64_t)XFS_BUF_ADDR(bp), func, bp->b_error, bp->b_length);
 }
-int
-xfs_bwrite(
-        struct xfs_buf          *bp)
-{
-        int                     error;
-        ASSERT(xfs_buf_islocked(bp));
-        bp->b_flags |= XBF_WRITE;
-        bp->b_flags &= ~(XBF_ASYNC | XBF_READ | _XBF_DELWRI_Q);
-        xfs_bdstrat_cb(bp);
-        error = xfs_buf_iowait(bp);
-        if (error) {
-                xfs_force_shutdown(bp->b_target->bt_mount,
-                                   SHUTDOWN_META_IO_ERROR);
-        }
-        return error;
-}
 /*
 * Called when we want to stop a buffer from getting written or read.
 * We attach the EIO error, muck with its flags, and call xfs_buf_ioend
@@ -1079,14 +1058,7 @@ xfs_bioerror_relse(
        return EIO;
 }
+STATIC int
-/*
- * All xfs metadata buffers except log state machine buffers
- * get this attached as their b_bdstrat callback function.
- * This is so that we can catch a buffer
- * after prematurely unpinning it to forcibly shutdown the filesystem.
- */
-int
 xfs_bdstrat_cb(
        struct xfs_buf  *bp)
 {
@@ -1107,6 +1079,27 @@ xfs_bdstrat_cb(
        return 0;
 }
+int
+xfs_bwrite(
+        struct xfs_buf          *bp)
+{
+        int                     error;
+        ASSERT(xfs_buf_islocked(bp));
+        bp->b_flags |= XBF_WRITE;
+        bp->b_flags &= ~(XBF_ASYNC | XBF_READ | _XBF_DELWRI_Q);
+        xfs_bdstrat_cb(bp);
+        error = xfs_buf_iowait(bp);
+        if (error) {
+                xfs_force_shutdown(bp->b_target->bt_mount,
+                                   SHUTDOWN_META_IO_ERROR);
+        }
+        return error;
+}
 /*
 * Wrapper around bdstrat so that we can stop data from going to disk in case
 * we are shutting down the filesystem.  Typically user data goes thru this
@@ -1243,7 +1236,7 @@ xfs_buf_iorequest(
         */
        atomic_set(&bp->b_io_remaining, 1);
        _xfs_buf_ioapply(bp);
-        _xfs_buf_ioend(bp, 0);
+        _xfs_buf_ioend(bp, 1);
        xfs_buf_rele(bp);
 }
diff --git a/fs/xfs/xfs_buf.h b/fs/xfs/xfs_buf.h
index 7f1d1392ce37..79344c48008e 100644
--- a/fs/xfs/xfs_buf.h
+++ b/fs/xfs/xfs_buf.h
@@ -180,7 +180,6 @@ extern void xfs_buf_unlock(xfs_buf_t *);
 extern int xfs_bwrite(struct xfs_buf *bp);
 extern void xfsbdstrat(struct xfs_mount *, struct xfs_buf *);
-extern int xfs_bdstrat_cb(struct xfs_buf *);
 extern void xfs_buf_ioend(xfs_buf_t *,  int);
 extern void xfs_buf_ioerror(xfs_buf_t *, int);
diff --git a/fs/xfs/xfs_buf_item.c b/fs/xfs/xfs_buf_item.c
index 45df2b857d48..d9e451115f98 100644
--- a/fs/xfs/xfs_buf_item.c
+++ b/fs/xfs/xfs_buf_item.c
@@ -954,7 +954,7 @@ xfs_buf_iodone_callbacks(
                if (!XFS_BUF_ISSTALE(bp)) {
                        bp->b_flags |= XBF_WRITE | XBF_ASYNC | XBF_DONE;
-                        xfs_bdstrat_cb(bp);
+                        xfs_buf_iorequest(bp);
                } else {
                        xfs_buf_relse(bp);
                }
diff --git a/include/asm-generic/dma-contiguous.h b/include/asm-generic/dma-contiguous.h
index c544356b374b..294b1e755ab2 100644
--- a/include/asm-generic/dma-contiguous.h
+++ b/include/asm-generic/dma-contiguous.h
@@ -18,7 +18,7 @@ static inline void dev_set_cma_area(struct device *dev, struct cma *cma)
 {
        if (dev)
                dev->cma_area = cma;
-        if (!dev || !dma_contiguous_default_area)
+        if (!dev && !dma_contiguous_default_area)
                dma_contiguous_default_area = cma;
 }
diff --git a/include/linux/capability.h b/include/linux/capability.h
index 68d56effc328..d10b7ed595b1 100644
--- a/include/linux/capability.h
+++ b/include/linux/capability.h
@@ -360,11 +360,11 @@ struct cpu_vfs_cap_data {
 #define CAP_WAKE_ALARM            35
-/* Allow preventing system suspends while epoll events are pending */
+/* Allow preventing system suspends */
-#define CAP_EPOLLWAKEUP      36
+#define CAP_BLOCK_SUSPEND    36
-#define CAP_LAST_CAP         CAP_EPOLLWAKEUP
+#define CAP_LAST_CAP         CAP_BLOCK_SUSPEND
 #define cap_valid(x) ((x) >= 0 && (x) <= CAP_LAST_CAP)
diff --git a/include/linux/eventpoll.h b/include/linux/eventpoll.h
index 6f8be328770a..f4bb378ccf6a 100644
--- a/include/linux/eventpoll.h
+++ b/include/linux/eventpoll.h
@@ -34,7 +34,7 @@
 * re-allowed until epoll_wait is called again after consuming the wakeup
 * event(s).
 *
- * Requires CAP_EPOLLWAKEUP
+ * Requires CAP_BLOCK_SUSPEND
 */
 #define EPOLLWAKEUP (1 << 29)
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index d6146b4811c2..95374d1696a1 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -1425,7 +1425,7 @@ static inline void ip_vs_notrack(struct sk_buff *skb)
        struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
        if (!ct || !nf_ct_is_untracked(ct)) {
-                nf_reset(skb);
+                nf_conntrack_put(skb->nfct);
                skb->nfct = &nf_ct_untracked_get()->ct_general;
                skb->nfctinfo = IP_CT_NEW;
                nf_conntrack_get(skb->nfct);
diff --git a/include/net/netfilter/nf_conntrack_ecache.h b/include/net/netfilter/nf_conntrack_ecache.h
index a88fb6939387..e1ce1048fe5f 100644
--- a/include/net/netfilter/nf_conntrack_ecache.h
+++ b/include/net/netfilter/nf_conntrack_ecache.h
@@ -78,7 +78,7 @@ nf_conntrack_event_cache(enum ip_conntrack_events event, struct nf_conn *ct)
        struct net *net = nf_ct_net(ct);
        struct nf_conntrack_ecache *e;
-        if (net->ct.nf_conntrack_event_cb == NULL)
+        if (!rcu_access_pointer(net->ct.nf_conntrack_event_cb))
                return;
        e = nf_ct_ecache_find(ct);
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index 269b1fe5f2ae..3447cfaf11e7 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -717,6 +717,7 @@ static void timekeeping_resume(void)
        timekeeper.clock->cycle_last = timekeeper.clock->read(timekeeper.clock);
        timekeeper.ntp_error = 0;
        timekeeping_suspended = 0;
+        timekeeping_update(false);
        write_sequnlock_irqrestore(&timekeeper.lock, flags);
        touch_softlockup_watchdog();
diff --git a/mm/bootmem.c b/mm/bootmem.c
index 73096630cb35..bcb63ac48cc5 100644
--- a/mm/bootmem.c
+++ b/mm/bootmem.c
@@ -710,6 +710,10 @@ again:
        if (ptr)
                return ptr;
+        /* do not panic in alloc_bootmem_bdata() */
+        if (limit && goal + size > limit)
+                limit = 0;
        ptr = alloc_bootmem_bdata(pgdat->bdata, size, align, goal, limit);
        if (ptr)
                return ptr;
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 44030096da63..4a4f9219683f 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -5635,7 +5635,12 @@ static struct page *
 __alloc_contig_migrate_alloc(struct page *page, unsigned long private,
                             int **resultp)
 {
-        return alloc_page(GFP_HIGHUSER_MOVABLE);
+        gfp_t gfp_mask = GFP_USER | __GFP_MOVABLE;
+        if (PageHighMem(page))
+                gfp_mask |= __GFP_HIGHMEM;
+        return alloc_page(gfp_mask);
 }
 /* [start, end) must belong to a single zone. */
diff --git a/mm/vmscan.c b/mm/vmscan.c
index 661576324c7f..66e431060c05 100644
--- a/mm/vmscan.c
+++ b/mm/vmscan.c
@@ -2688,7 +2688,10 @@ static void kswapd_try_to_sleep(pg_data_t *pgdat, int order, int classzone_idx)
                 * them before going back to sleep.
                 */
                set_pgdat_percpu_threshold(pgdat, calculate_normal_threshold);
-                schedule();
+                if (!kthread_should_stop())
+                        schedule();
                set_pgdat_percpu_threshold(pgdat, calculate_pressure_threshold);
        } else {
                if (remaining)
diff --git a/net/8021q/vlan.c b/net/8021q/vlan.c
index 6089f0cf23b4..9096bcb08132 100644
--- a/net/8021q/vlan.c
+++ b/net/8021q/vlan.c
@@ -403,6 +403,9 @@ static int vlan_device_event(struct notifier_block *unused, unsigned long event,
                break;
        case NETDEV_DOWN:
+                if (dev->features & NETIF_F_HW_VLAN_FILTER)
+                        vlan_vid_del(dev, 0);
                /* Put all VLANs for this dev in the down state too.  */
                for (i = 0; i < VLAN_N_VID; i++) {
                        vlandev = vlan_group_get_device(grp, i);
diff --git a/net/ax25/af_ax25.c b/net/ax25/af_ax25.c
index 051f7abae66d..779095ded689 100644
--- a/net/ax25/af_ax25.c
+++ b/net/ax25/af_ax25.c
@@ -842,6 +842,7 @@ static int ax25_create(struct net *net, struct socket *sock, int protocol,
                case AX25_P_NETROM:
                        if (ax25_protocol_is_registered(AX25_P_NETROM))
                                return -ESOCKTNOSUPPORT;
+                        break;
 #endif
 #ifdef CONFIG_ROSE_MODULE
                case AX25_P_ROSE:
diff --git a/net/batman-adv/bridge_loop_avoidance.c b/net/batman-adv/bridge_loop_avoidance.c
index 8bf97515a77d..c5863f499133 100644
--- a/net/batman-adv/bridge_loop_avoidance.c
+++ b/net/batman-adv/bridge_loop_avoidance.c
@@ -1351,6 +1351,7 @@ void bla_free(struct bat_priv *bat_priv)
 * @bat_priv: the bat priv with all the soft interface information
 * @skb: the frame to be checked
 * @vid: the VLAN ID of the frame
+ * @is_bcast: the packet came in a broadcast packet type.
 *
 * bla_rx avoidance checks if:
 *  * we have to race for a claim
@@ -1361,7 +1362,8 @@ void bla_free(struct bat_priv *bat_priv)
 * process the skb.
 *
 */
-int bla_rx(struct bat_priv *bat_priv, struct sk_buff *skb, short vid)
+int bla_rx(struct bat_priv *bat_priv, struct sk_buff *skb, short vid,
+           bool is_bcast)
 {
        struct ethhdr *ethhdr;
        struct claim search_claim, *claim = NULL;
@@ -1380,7 +1382,7 @@ int bla_rx(struct bat_priv *bat_priv, struct sk_buff *skb, short vid)
        if (unlikely(atomic_read(&bat_priv->bla_num_requests)))
                /* don't allow broadcasts while requests are in flight */
-                if (is_multicast_ether_addr(ethhdr->h_dest))
+                if (is_multicast_ether_addr(ethhdr->h_dest) && is_bcast)
                        goto handled;
        memcpy(search_claim.addr, ethhdr->h_source, ETH_ALEN);
@@ -1406,8 +1408,13 @@ int bla_rx(struct bat_priv *bat_priv, struct sk_buff *skb, short vid)
        }
        /* if it is a broadcast ... */
-        if (is_multicast_ether_addr(ethhdr->h_dest)) {
+        if (is_multicast_ether_addr(ethhdr->h_dest) && is_bcast) {
-                /* ... drop it. the responsible gateway is in charge. */
+                /* ... drop it. the responsible gateway is in charge.
+                 *
+                 * We need to check is_bcast because with the gateway
+                 * feature, broadcasts (like DHCP requests) may be sent
+                 * using a unicast packet type.
+                 */
                goto handled;
        } else {
                /* seems the client considers us as its best gateway.
diff --git a/net/batman-adv/bridge_loop_avoidance.h b/net/batman-adv/bridge_loop_avoidance.h
index e39f93acc28f..dc5227b398d4 100644
--- a/net/batman-adv/bridge_loop_avoidance.h
+++ b/net/batman-adv/bridge_loop_avoidance.h
@@ -23,7 +23,8 @@
 #define _NET_BATMAN_ADV_BLA_H_
 #ifdef CONFIG_BATMAN_ADV_BLA
-int bla_rx(struct bat_priv *bat_priv, struct sk_buff *skb, short vid);
+int bla_rx(struct bat_priv *bat_priv, struct sk_buff *skb, short vid,
+           bool is_bcast);
 int bla_tx(struct bat_priv *bat_priv, struct sk_buff *skb, short vid);
 int bla_is_backbone_gw(struct sk_buff *skb,
                       struct orig_node *orig_node, int hdr_size);
@@ -41,7 +42,7 @@ void bla_free(struct bat_priv *bat_priv);
 #else /* ifdef CONFIG_BATMAN_ADV_BLA */
 static inline int bla_rx(struct bat_priv *bat_priv, struct sk_buff *skb,
-                         short vid)
+                         short vid, bool is_bcast)
 {
        return 0;
 }
diff --git a/net/batman-adv/soft-interface.c b/net/batman-adv/soft-interface.c
index 6e2530b02043..a0ec0e4ada4c 100644
--- a/net/batman-adv/soft-interface.c
+++ b/net/batman-adv/soft-interface.c
@@ -256,7 +256,11 @@ void interface_rx(struct net_device *soft_iface,
        struct bat_priv *bat_priv = netdev_priv(soft_iface);
        struct ethhdr *ethhdr;
        struct vlan_ethhdr *vhdr;
+        struct batman_header *batadv_header = (struct batman_header *)skb->data;
        short vid __maybe_unused = -1;
+        bool is_bcast;
+        is_bcast = (batadv_header->packet_type == BAT_BCAST);
        /* check if enough space is available for pulling, and pull */
        if (!pskb_may_pull(skb, hdr_size))
@@ -302,7 +306,7 @@ void interface_rx(struct net_device *soft_iface,
        /* Let the bridge loop avoidance check the packet. If will
         * not handle it, we can safely push it up.
         */
-        if (bla_rx(bat_priv, skb, vid))
+        if (bla_rx(bat_priv, skb, vid, is_bcast))
                goto out;
        netif_rx(skb);
diff --git a/net/caif/caif_dev.c b/net/caif/caif_dev.c
index 554b31289607..8c83c175b03a 100644
--- a/net/caif/caif_dev.c
+++ b/net/caif/caif_dev.c
@@ -561,9 +561,9 @@ static int __init caif_device_init(void)
 static void __exit caif_device_exit(void)
 {
-        unregister_pernet_subsys(&caif_net_ops);
        unregister_netdevice_notifier(&caif_device_notifier);
        dev_remove_pack(&caif_packet_type);
+        unregister_pernet_subsys(&caif_net_ops);
 }
 module_init(caif_device_init);
diff --git a/net/core/dev.c b/net/core/dev.c
index 84f01ba81a34..0f28a9e0b8ad 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -2444,8 +2444,12 @@ static void skb_update_prio(struct sk_buff *skb)
 {
        struct netprio_map *map = rcu_dereference_bh(skb->dev->priomap);
-        if ((!skb->priority) && (skb->sk) && map)
+        if (!skb->priority && skb->sk && map) {
-                skb->priority = map->priomap[skb->sk->sk_cgrp_prioidx];
+                unsigned int prioidx = skb->sk->sk_cgrp_prioidx;
+                if (prioidx < map->priomap_len)
+                        skb->priority = map->priomap[prioidx];
+        }
 }
 #else
 #define skb_update_prio(skb)
diff --git a/net/core/netprio_cgroup.c b/net/core/netprio_cgroup.c
index 5b8aa2fae48b..b2e9caa1ad1a 100644
--- a/net/core/netprio_cgroup.c
+++ b/net/core/netprio_cgroup.c
@@ -49,8 +49,9 @@ static int get_prioidx(u32 *prio)
                return -ENOSPC;
        }
        set_bit(prioidx, prioidx_map);
+        if (atomic_read(&max_prioidx) < prioidx)
+                atomic_set(&max_prioidx, prioidx);
        spin_unlock_irqrestore(&prioidx_map_lock, flags);
-        atomic_set(&max_prioidx, prioidx);
        *prio = prioidx;
        return 0;
 }
@@ -64,7 +65,7 @@ static void put_prioidx(u32 idx)
        spin_unlock_irqrestore(&prioidx_map_lock, flags);
 }
-static void extend_netdev_table(struct net_device *dev, u32 new_len)
+static int extend_netdev_table(struct net_device *dev, u32 new_len)
 {
        size_t new_size = sizeof(struct netprio_map) +
                           ((sizeof(u32) * new_len));
@@ -76,7 +77,7 @@ static void extend_netdev_table(struct net_device *dev, u32 new_len)
        if (!new_priomap) {
                pr_warn("Unable to alloc new priomap!\n");
-                return;
+                return -ENOMEM;
        }
        for (i = 0;
@@ -89,46 +90,79 @@ static void extend_netdev_table(struct net_device *dev, u32 new_len)
        rcu_assign_pointer(dev->priomap, new_priomap);
        if (old_priomap)
                kfree_rcu(old_priomap, rcu);
+        return 0;
 }
-static void update_netdev_tables(void)
+static int write_update_netdev_table(struct net_device *dev)
 {
+        int ret = 0;
+        u32 max_len;
+        struct netprio_map *map;
+        rtnl_lock();
+        max_len = atomic_read(&max_prioidx) + 1;
+        map = rtnl_dereference(dev->priomap);
+        if (!map || map->priomap_len < max_len)
+                ret = extend_netdev_table(dev, max_len);
+        rtnl_unlock();
+        return ret;
+}
+static int update_netdev_tables(void)
+{
+        int ret = 0;
        struct net_device *dev;
-        u32 max_len = atomic_read(&max_prioidx) + 1;
+        u32 max_len;
        struct netprio_map *map;
        rtnl_lock();
+        max_len = atomic_read(&max_prioidx) + 1;
        for_each_netdev(&init_net, dev) {
                map = rtnl_dereference(dev->priomap);
-                if ((!map) ||
+                /*
-                    (map->priomap_len < max_len))
+                 * don't allocate priomap if we didn't
-                        extend_netdev_table(dev, max_len);
+                 * change net_prio.ifpriomap (map == NULL),
+                 * this will speed up skb_update_prio.
+                 */
+                if (map && map->priomap_len < max_len) {
+                        ret = extend_netdev_table(dev, max_len);
+                        if (ret < 0)
+                                break;
+                }
        }
        rtnl_unlock();
+        return ret;
 }
 static struct cgroup_subsys_state *cgrp_create(struct cgroup *cgrp)
 {
        struct cgroup_netprio_state *cs;
-        int ret;
+        int ret = -EINVAL;
        cs = kzalloc(sizeof(*cs), GFP_KERNEL);
        if (!cs)
                return ERR_PTR(-ENOMEM);
-        if (cgrp->parent && cgrp_netprio_state(cgrp->parent)->prioidx) {
+        if (cgrp->parent && cgrp_netprio_state(cgrp->parent)->prioidx)
-                kfree(cs);
+                goto out;
-                return ERR_PTR(-EINVAL);
-        }
        ret = get_prioidx(&cs->prioidx);
-        if (ret != 0) {
+        if (ret < 0) {
                pr_warn("No space in priority index array\n");
-                kfree(cs);
+                goto out;
-                return ERR_PTR(ret);
+        }
+        ret = update_netdev_tables();
+        if (ret < 0) {
+                put_prioidx(cs->prioidx);
+                goto out;
        }
        return &cs->css;
+out:
+        kfree(cs);
+        return ERR_PTR(ret);
 }
 static void cgrp_destroy(struct cgroup *cgrp)
@@ -141,7 +175,7 @@ static void cgrp_destroy(struct cgroup *cgrp)
        rtnl_lock();
        for_each_netdev(&init_net, dev) {
                map = rtnl_dereference(dev->priomap);
-                if (map)
+                if (map && cs->prioidx < map->priomap_len)
                        map->priomap[cs->prioidx] = 0;
        }
        rtnl_unlock();
@@ -165,7 +199,7 @@ static int read_priomap(struct cgroup *cont, struct cftype *cft,
        rcu_read_lock();
        for_each_netdev_rcu(&init_net, dev) {
                map = rcu_dereference(dev->priomap);
-                priority = map ? map->priomap[prioidx] : 0;
+                priority = (map && prioidx < map->priomap_len) ? map->priomap[prioidx] : 0;
                cb->fill(cb, dev->name, priority);
        }
        rcu_read_unlock();
@@ -220,13 +254,17 @@ static int write_priomap(struct cgroup *cgrp, struct cftype *cft,
        if (!dev)
                goto out_free_devname;
-        update_netdev_tables();
+        ret = write_update_netdev_table(dev);
-        ret = 0;
+        if (ret < 0)
+                goto out_put_dev;
        rcu_read_lock();
        map = rcu_dereference(dev->priomap);
        if (map)
                map->priomap[prioidx] = priority;
        rcu_read_unlock();
+out_put_dev:
        dev_put(dev);
 out_free_devname:
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 46a3d23d259e..d124306b81fd 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -353,7 +353,7 @@ struct sk_buff *__netdev_alloc_skb(struct net_device *dev,
        unsigned int fragsz = SKB_DATA_ALIGN(length + NET_SKB_PAD) +
                              SKB_DATA_ALIGN(sizeof(struct skb_shared_info));
-        if (fragsz <= PAGE_SIZE && !(gfp_mask & __GFP_WAIT)) {
+        if (fragsz <= PAGE_SIZE && !(gfp_mask & (__GFP_WAIT | GFP_DMA))) {
                void *data = netdev_alloc_frag(fragsz);
                if (likely(data)) {
diff --git a/net/ieee802154/dgram.c b/net/ieee802154/dgram.c
index 6fbb2ad7bb6d..16705611589a 100644
--- a/net/ieee802154/dgram.c
+++ b/net/ieee802154/dgram.c
@@ -230,6 +230,12 @@ static int dgram_sendmsg(struct kiocb *iocb, struct sock *sk,
        mtu = dev->mtu;
        pr_debug("name = %s, mtu = %u\n", dev->name, mtu);
+        if (size > mtu) {
+                pr_debug("size = %Zu, mtu = %u\n", size, mtu);
+                err = -EINVAL;
+                goto out_dev;
+        }
        hlen = LL_RESERVED_SPACE(dev);
        tlen = dev->needed_tailroom;
        skb = sock_alloc_send_skb(sk, hlen + tlen + size,
@@ -258,12 +264,6 @@ static int dgram_sendmsg(struct kiocb *iocb, struct sock *sk,
        if (err < 0)
                goto out_skb;
-        if (size > mtu) {
-                pr_debug("size = %Zu, mtu = %u\n", size, mtu);
-                err = -EINVAL;
-                goto out_skb;
-        }
        skb->dev = dev;
        skb->sk  = sk;
        skb->protocol = htons(ETH_P_IEEE802154);
diff --git a/net/mac80211/mlme.c b/net/mac80211/mlme.c
index a4bb856de08f..0db5d34a06b6 100644
--- a/net/mac80211/mlme.c
+++ b/net/mac80211/mlme.c
@@ -2174,15 +2174,13 @@ ieee80211_rx_mgmt_assoc_resp(struct ieee80211_sub_if_data *sdata,
                       sdata->name, mgmt->sa, status_code);
                ieee80211_destroy_assoc_data(sdata, false);
        } else {
-                printk(KERN_DEBUG "%s: associated\n", sdata->name);
                if (!ieee80211_assoc_success(sdata, *bss, mgmt, len)) {
                        /* oops -- internal error -- send timeout for now */
-                        ieee80211_destroy_assoc_data(sdata, true);
+                        ieee80211_destroy_assoc_data(sdata, false);
-                        sta_info_destroy_addr(sdata, mgmt->bssid);
                        cfg80211_put_bss(*bss);
                        return RX_MGMT_CFG80211_ASSOC_TIMEOUT;
                }
+                printk(KERN_DEBUG "%s: associated\n", sdata->name);
                /*
                 * destroy assoc_data afterwards, as otherwise an idle
diff --git a/net/mac80211/rc80211_minstrel_ht.c b/net/mac80211/rc80211_minstrel_ht.c
index 2d1acc6c5445..f9e51ef8dfa2 100644
--- a/net/mac80211/rc80211_minstrel_ht.c
+++ b/net/mac80211/rc80211_minstrel_ht.c
@@ -809,7 +809,7 @@ minstrel_ht_alloc_sta(void *priv, struct ieee80211_sta *sta, gfp_t gfp)
                        max_rates = sband->n_bitrates;
        }
-        msp = kzalloc(sizeof(struct minstrel_ht_sta), gfp);
+        msp = kzalloc(sizeof(*msp), gfp);
        if (!msp)
                return NULL;
diff --git a/net/netfilter/ipvs/ip_vs_ctl.c b/net/netfilter/ipvs/ip_vs_ctl.c
index d43e3c122f7b..84444dda194b 100644
--- a/net/netfilter/ipvs/ip_vs_ctl.c
+++ b/net/netfilter/ipvs/ip_vs_ctl.c
@@ -1521,11 +1521,12 @@ static int ip_vs_dst_event(struct notifier_block *this, unsigned long event,
 {
        struct net_device *dev = ptr;
        struct net *net = dev_net(dev);
+        struct netns_ipvs *ipvs = net_ipvs(net);
        struct ip_vs_service *svc;
        struct ip_vs_dest *dest;
        unsigned int idx;
-        if (event != NETDEV_UNREGISTER)
+        if (event != NETDEV_UNREGISTER || !ipvs)
                return NOTIFY_DONE;
        IP_VS_DBG(3, "%s() dev=%s\n", __func__, dev->name);
        EnterFunction(2);
@@ -1551,7 +1552,7 @@ static int ip_vs_dst_event(struct notifier_block *this, unsigned long event,
                }
        }
-        list_for_each_entry(dest, &net_ipvs(net)->dest_trash, n_list) {
+        list_for_each_entry(dest, &ipvs->dest_trash, n_list) {
                __ip_vs_dev_reset(dest, dev);
        }
        mutex_unlock(&__ip_vs_mutex);
diff --git a/net/netfilter/xt_set.c b/net/netfilter/xt_set.c
index 035960ec5cb9..c6f7db720d84 100644
--- a/net/netfilter/xt_set.c
+++ b/net/netfilter/xt_set.c
@@ -16,6 +16,7 @@
 #include <linux/netfilter/x_tables.h>
 #include <linux/netfilter/xt_set.h>
+#include <linux/netfilter/ipset/ip_set_timeout.h>
 MODULE_LICENSE("GPL");
 MODULE_AUTHOR("Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>");
@@ -310,7 +311,8 @@ set_target_v2(struct sk_buff *skb, const struct xt_action_param *par)
                info->del_set.flags, 0, UINT_MAX);
        /* Normalize to fit into jiffies */
-        if (add_opt.timeout > UINT_MAX/MSEC_PER_SEC)
+        if (add_opt.timeout != IPSET_NO_TIMEOUT &&
+            add_opt.timeout > UINT_MAX/MSEC_PER_SEC)
                add_opt.timeout = UINT_MAX/MSEC_PER_SEC;
        if (info->add_set.index != IPSET_INVALID_ID)
                ip_set_add(info->add_set.index, skb, par, &add_opt);
diff --git a/net/nfc/llcp/sock.c b/net/nfc/llcp/sock.c
index 17a707db40eb..e06d458fc719 100644
--- a/net/nfc/llcp/sock.c
+++ b/net/nfc/llcp/sock.c
@@ -292,7 +292,7 @@ static int llcp_sock_getname(struct socket *sock, struct sockaddr *addr,
        pr_debug("%p\n", sk);
-        if (llcp_sock == NULL)
+        if (llcp_sock == NULL || llcp_sock->dev == NULL)
                return -EBADFD;
        addr->sa_family = AF_NFC;
diff --git a/net/rxrpc/ar-peer.c b/net/rxrpc/ar-peer.c
index 2754f098d436..bebaa43484bc 100644
--- a/net/rxrpc/ar-peer.c
+++ b/net/rxrpc/ar-peer.c
@@ -229,7 +229,7 @@ found_UDP_peer:
        return peer;
 new_UDP_peer:
-        _net("Rx UDP DGRAM from NEW peer %d", peer->debug_id);
+        _net("Rx UDP DGRAM from NEW peer");
        read_unlock_bh(&rxrpc_peer_lock);
        _leave(" = -EBUSY [new]");
        return ERR_PTR(-EBUSY);
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index a2a95aabf9c2..c412ad0d0308 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -331,29 +331,22 @@ static psched_time_t packet_len_2_sched_time(unsigned int len, struct netem_sche
        return PSCHED_NS2TICKS(ticks);
 }
-static int tfifo_enqueue(struct sk_buff *nskb, struct Qdisc *sch)
+static void tfifo_enqueue(struct sk_buff *nskb, struct Qdisc *sch)
 {
        struct sk_buff_head *list = &sch->q;
        psched_time_t tnext = netem_skb_cb(nskb)->time_to_send;
-        struct sk_buff *skb;
+        struct sk_buff *skb = skb_peek_tail(list);
-        if (likely(skb_queue_len(list) < sch->limit)) {
-                skb = skb_peek_tail(list);
-                /* Optimize for add at tail */
-                if (likely(!skb || tnext >= netem_skb_cb(skb)->time_to_send))
-                        return qdisc_enqueue_tail(nskb, sch);
-                skb_queue_reverse_walk(list, skb) {
+        /* Optimize for add at tail */
-                        if (tnext >= netem_skb_cb(skb)->time_to_send)
+        if (likely(!skb || tnext >= netem_skb_cb(skb)->time_to_send))
-                                break;
+                return __skb_queue_tail(list, nskb);
-                }
-                __skb_queue_after(list, skb, nskb);
+        skb_queue_reverse_walk(list, skb) {
-                sch->qstats.backlog += qdisc_pkt_len(nskb);
+                if (tnext >= netem_skb_cb(skb)->time_to_send)
-                return NET_XMIT_SUCCESS;
+                        break;
        }
-        return qdisc_reshape_fail(nskb, sch);
+        __skb_queue_after(list, skb, nskb);
 }
 /*
@@ -368,7 +361,6 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
        /* We don't fill cb now as skb_unshare() may invalidate it */
        struct netem_skb_cb *cb;
        struct sk_buff *skb2;
-        int ret;
        int count = 1;
        /* Random duplication */
@@ -419,6 +411,11 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                skb->data[net_random() % skb_headlen(skb)] ^= 1<<(net_random() % 8);
        }
+        if (unlikely(skb_queue_len(&sch->q) >= sch->limit))
+                return qdisc_reshape_fail(skb, sch);
+        sch->qstats.backlog += qdisc_pkt_len(skb);
        cb = netem_skb_cb(skb);
        if (q->gap == 0 ||              /* not doing reordering */
            q->counter < q->gap - 1 ||  /* inside last reordering gap */
@@ -450,7 +447,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                cb->time_to_send = now + delay;
                ++q->counter;
-                ret = tfifo_enqueue(skb, sch);
+                tfifo_enqueue(skb, sch);
        } else {
                /*
                 * Do re-ordering by putting one out of N packets at the front
@@ -460,16 +457,7 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch)
                q->counter = 0;
                __skb_queue_head(&sch->q, skb);
-                sch->qstats.backlog += qdisc_pkt_len(skb);
                sch->qstats.requeues++;
-                ret = NET_XMIT_SUCCESS;
-        }
-        if (ret != NET_XMIT_SUCCESS) {
-                if (net_xmit_drop_count(ret)) {
-                        sch->qstats.drops++;
-                        return ret;
-                }
        }
        return NET_XMIT_SUCCESS;
diff --git a/net/sched/sch_sfb.c b/net/sched/sch_sfb.c
index 74305c883bd3..30ea4674cabd 100644
--- a/net/sched/sch_sfb.c
+++ b/net/sched/sch_sfb.c
@@ -570,6 +570,8 @@ static int sfb_dump(struct Qdisc *sch, struct sk_buff *skb)
        sch->qstats.backlog = q->qdisc->qstats.backlog;
        opts = nla_nest_start(skb, TCA_OPTIONS);
+        if (opts == NULL)
+                goto nla_put_failure;
        if (nla_put(skb, TCA_SFB_PARMS, sizeof(opt), &opt))
                goto nla_put_failure;
        return nla_nest_end(skb, opts);
diff --git a/net/sctp/input.c b/net/sctp/input.c
index 80564fe03024..8b9b6790a3df 100644
--- a/net/sctp/input.c
+++ b/net/sctp/input.c
@@ -736,15 +736,12 @@ static void __sctp_unhash_endpoint(struct sctp_endpoint *ep)
        epb = &ep->base;
-        if (hlist_unhashed(&epb->node))
-                return;
        epb->hashent = sctp_ep_hashfn(epb->bind_addr.port);
        head = &sctp_ep_hashtable[epb->hashent];
        sctp_write_lock(&head->lock);
-        __hlist_del(&epb->node);
+        hlist_del_init(&epb->node);
        sctp_write_unlock(&head->lock);
 }
@@ -825,7 +822,7 @@ static void __sctp_unhash_established(struct sctp_association *asoc)
        head = &sctp_assoc_hashtable[epb->hashent];
        sctp_write_lock(&head->lock);
-        __hlist_del(&epb->node);
+        hlist_del_init(&epb->node);
        sctp_write_unlock(&head->lock);
 }
diff --git a/net/sctp/socket.c b/net/sctp/socket.c
index b3b8a8d813eb..31c7bfcd9b58 100644
--- a/net/sctp/socket.c
+++ b/net/sctp/socket.c
@@ -1231,8 +1231,14 @@ out_free:
        SCTP_DEBUG_PRINTK("About to exit __sctp_connect() free asoc: %p"
                          " kaddrs: %p err: %d\n",
                          asoc, kaddrs, err);
-        if (asoc)
+        if (asoc) {
+                /* sctp_primitive_ASSOCIATE may have added this association
+                 * To the hash table, try to unhash it, just in case, its a noop
+                 * if it wasn't hashed so we're safe
+                 */
+                sctp_unhash_established(asoc);
                sctp_association_free(asoc);
+        }
        return err;
 }
@@ -1942,8 +1948,10 @@ SCTP_STATIC int sctp_sendmsg(struct kiocb *iocb, struct sock *sk,
        goto out_unlock;
 out_free:
-        if (new_asoc)
+        if (new_asoc) {
+                sctp_unhash_established(asoc);
                sctp_association_free(asoc);
+        }
 out_unlock:
        sctp_release_sock(sk);