30 files changed, 261 insertions, 88 deletions
diff --git a/Documentation/ABI/testing/sysfs-devices-node b/Documentation/ABI/testing/sysfs-devices-node
deleted file mode 100644
index 453a210c3ceb..000000000000
--- a/Documentation/ABI/testing/sysfs-devices-node
+++ /dev/null
@@ -1,7 +0,0 @@
-What:           /sys/devices/system/node/nodeX/compact
-Date:           February 2010
-Contact:        Mel Gorman <mel@csn.ul.ie>
-Description:
-                When this file is written to, all memory within that node
-                will be compacted. When it completes, memory will be freed
-                into blocks which have as many contiguous pages as possible
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index ddd84d627185..363e348bff9b 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -446,12 +446,6 @@ bytes respectively. Such letter suffixes can also be entirely omitted.
                        possible to determine what the correct size should be.
                        This option provides an override for these situations.
-        capability.disable=
-                        [SECURITY] Disable capabilities.  This would normally
-                        be used only if an alternative security model is to be
-                        configured.  Potentially dangerous and should only be
-                        used if you are entirely sure of the consequences.
        ccw_timeout_log [S390]
                        See Documentation/s390/CommonIO for details.
diff --git a/drivers/firmware/dmi_scan.c b/drivers/firmware/dmi_scan.c
index b298158cb922..fd3ae6290d71 100644
--- a/drivers/firmware/dmi_scan.c
+++ b/drivers/firmware/dmi_scan.c
@@ -16,6 +16,7 @@
 */
 static char dmi_empty_string[] = "        ";
+static u16 __initdata dmi_ver;
 /*
 * Catch too early calls to dmi_check_system():
 */
@@ -118,12 +119,12 @@ static int __init dmi_walk_early(void (*decode)(const struct dmi_header *,
        return 0;
 }
-static int __init dmi_checksum(const u8 *buf)
+static int __init dmi_checksum(const u8 *buf, u8 len)
 {
        u8 sum = 0;
        int a;
-        for (a = 0; a < 15; a++)
+        for (a = 0; a < len; a++)
                sum += buf[a];
        return sum == 0;
@@ -161,8 +162,10 @@ static void __init dmi_save_uuid(const struct dmi_header *dm, int slot, int inde
                return;
        for (i = 0; i < 16 && (is_ff || is_00); i++) {
-                if(d[i] != 0x00) is_ff = 0;
+                if (d[i] != 0x00)
-                if(d[i] != 0xFF) is_00 = 0;
+                        is_00 = 0;
+                if (d[i] != 0xFF)
+                        is_ff = 0;
        }
        if (is_ff || is_00)
@@ -172,7 +175,15 @@ static void __init dmi_save_uuid(const struct dmi_header *dm, int slot, int inde
        if (!s)
                return;
-        sprintf(s, "%pUB", d);
+        /*
+         * As of version 2.6 of the SMBIOS specification, the first 3 fields of
+         * the UUID are supposed to be little-endian encoded.  The specification
+         * says that this is the defacto standard.
+         */
+        if (dmi_ver >= 0x0206)
+                sprintf(s, "%pUL", d);
+        else
+                sprintf(s, "%pUB", d);
        dmi_ident[slot] = s;
 }
@@ -404,29 +415,57 @@ static int __init dmi_present(const char __iomem *p)
        u8 buf[15];
        memcpy_fromio(buf, p, 15);
-        if ((memcmp(buf, "_DMI_", 5) == 0) && dmi_checksum(buf)) {
+        if (dmi_checksum(buf, 15)) {
                dmi_num = (buf[13] << 8) | buf[12];
                dmi_len = (buf[7] << 8) | buf[6];
                dmi_base = (buf[11] << 24) | (buf[10] << 16) |
                        (buf[9] << 8) | buf[8];
-                /*
-                 * DMI version 0.0 means that the real version is taken from
-                 * the SMBIOS version, which we don't know at this point.
-                 */
-                if (buf[14] != 0)
-                        printk(KERN_INFO "DMI %d.%d present.\n",
-                               buf[14] >> 4, buf[14] & 0xF);
-                else
-                        printk(KERN_INFO "DMI present.\n");
                if (dmi_walk_early(dmi_decode) == 0) {
+                        if (dmi_ver)
+                                pr_info("SMBIOS %d.%d present.\n",
+                                       dmi_ver >> 8, dmi_ver & 0xFF);
+                        else {
+                                dmi_ver = (buf[14] & 0xF0) << 4 |
+                                           (buf[14] & 0x0F);
+                                pr_info("Legacy DMI %d.%d present.\n",
+                                       dmi_ver >> 8, dmi_ver & 0xFF);
+                        }
                        dmi_dump_ids();
                        return 0;
                }
        }
+        dmi_ver = 0;
        return 1;
 }
+static int __init smbios_present(const char __iomem *p)
+{
+        u8 buf[32];
+        int offset = 0;
+        memcpy_fromio(buf, p, 32);
+        if ((buf[5] < 32) && dmi_checksum(buf, buf[5])) {
+                dmi_ver = (buf[6] << 8) + buf[7];
+                /* Some BIOS report weird SMBIOS version, fix that up */
+                switch (dmi_ver) {
+                case 0x021F:
+                case 0x0221:
+                        pr_debug("SMBIOS version fixup(2.%d->2.%d)\n",
+                               dmi_ver & 0xFF, 3);
+                        dmi_ver = 0x0203;
+                        break;
+                case 0x0233:
+                        pr_debug("SMBIOS version fixup(2.%d->2.%d)\n", 51, 6);
+                        dmi_ver = 0x0206;
+                        break;
+                }
+                offset = 16;
+        }
+        return dmi_present(buf + offset);
+}
 void __init dmi_scan_machine(void)
 {
        char __iomem *p, *q;
@@ -444,7 +483,7 @@ void __init dmi_scan_machine(void)
                if (p == NULL)
                        goto error;
-                rc = dmi_present(p + 0x10); /* offset of _DMI_ string */
+                rc = smbios_present(p);
                dmi_iounmap(p, 32);
                if (!rc) {
                        dmi_available = 1;
@@ -462,7 +501,12 @@ void __init dmi_scan_machine(void)
                        goto error;
                for (q = p; q < p + 0x10000; q += 16) {
-                        rc = dmi_present(q);
+                        if (memcmp(q, "_SM_", 4) == 0 && q - p <= 0xFFE0)
+                                rc = smbios_present(q);
+                        else if (memcmp(q, "_DMI_", 5) == 0)
+                                rc = dmi_present(q);
+                        else
+                                continue;
                        if (!rc) {
                                dmi_available = 1;
                                dmi_iounmap(p, 0x10000);
diff --git a/drivers/misc/sgi-xp/xpc_main.c b/drivers/misc/sgi-xp/xpc_main.c
index 8d082b46426b..d971817182f7 100644
--- a/drivers/misc/sgi-xp/xpc_main.c
+++ b/drivers/misc/sgi-xp/xpc_main.c
@@ -53,6 +53,10 @@
 #include <linux/kthread.h>
 #include "xpc.h"
+#ifdef CONFIG_X86_64
+#include <asm/traps.h>
+#endif
 /* define two XPC debug device structures to be used with dev_dbg() et al */
 struct device_driver xpc_dbg_name = {
@@ -1079,6 +1083,9 @@ xpc_system_reboot(struct notifier_block *nb, unsigned long event, void *unused)
        return NOTIFY_DONE;
 }
+/* Used to only allow one cpu to complete disconnect */
+static unsigned int xpc_die_disconnecting;
 /*
 * Notify other partitions to deactivate from us by first disengaging from all
 * references to our memory.
@@ -1092,6 +1099,9 @@ xpc_die_deactivate(void)
        long keep_waiting;
        long wait_to_print;
+        if (cmpxchg(&xpc_die_disconnecting, 0, 1))
+                return;
        /* keep xpc_hb_checker thread from doing anything (just in case) */
        xpc_exiting = 1;
@@ -1159,7 +1169,7 @@ xpc_die_deactivate(void)
 * about the lack of a heartbeat.
 */
 static int
-xpc_system_die(struct notifier_block *nb, unsigned long event, void *unused)
+xpc_system_die(struct notifier_block *nb, unsigned long event, void *_die_args)
 {
 #ifdef CONFIG_IA64              /* !!! temporary kludge */
        switch (event) {
@@ -1191,7 +1201,27 @@ xpc_system_die(struct notifier_block *nb, unsigned long event, void *unused)
                break;
        }
 #else
-        xpc_die_deactivate();
+        struct die_args *die_args = _die_args;
+        switch (event) {
+        case DIE_TRAP:
+                if (die_args->trapnr == X86_TRAP_DF)
+                        xpc_die_deactivate();
+                if (((die_args->trapnr == X86_TRAP_MF) ||
+                     (die_args->trapnr == X86_TRAP_XF)) &&
+                    !user_mode_vm(die_args->regs))
+                        xpc_die_deactivate();
+                break;
+        case DIE_INT3:
+        case DIE_DEBUG:
+                break;
+        case DIE_OOPS:
+        case DIE_GPF:
+        default:
+                xpc_die_deactivate();
+        }
 #endif
        return NOTIFY_DONE;
diff --git a/drivers/rtc/class.c b/drivers/rtc/class.c
index f8a0aab218cb..5143629dedbd 100644
--- a/drivers/rtc/class.c
+++ b/drivers/rtc/class.c
@@ -244,7 +244,6 @@ void rtc_device_unregister(struct rtc_device *rtc)
                rtc_proc_del_device(rtc);
                device_unregister(&rtc->dev);
                rtc->ops = NULL;
-                ida_simple_remove(&rtc_ida, rtc->id);
                mutex_unlock(&rtc->ops_lock);
                put_device(&rtc->dev);
        }
diff --git a/drivers/rtc/rtc-imxdi.c b/drivers/rtc/rtc-imxdi.c
index 18a4f0dd78a3..8da7a5cf83c6 100644
--- a/drivers/rtc/rtc-imxdi.c
+++ b/drivers/rtc/rtc-imxdi.c
@@ -36,6 +36,7 @@
 #include <linux/platform_device.h>
 #include <linux/rtc.h>
 #include <linux/sched.h>
+#include <linux/spinlock.h>
 #include <linux/workqueue.h>
 #include <linux/of.h>
diff --git a/fs/binfmt_misc.c b/fs/binfmt_misc.c
index 9be335fb8a7c..0c8869fdd14e 100644
--- a/fs/binfmt_misc.c
+++ b/fs/binfmt_misc.c
@@ -172,7 +172,10 @@ static int load_misc_binary(struct linux_binprm *bprm)
                goto _error;
        bprm->argc ++;
-        bprm->interp = iname;   /* for binfmt_script */
+        /* Update interp in case binfmt_script needs it. */
+        retval = bprm_change_interp(iname, bprm);
+        if (retval < 0)
+                goto _error;
        interp_file = open_exec (iname);
        retval = PTR_ERR (interp_file);
diff --git a/fs/binfmt_script.c b/fs/binfmt_script.c
index 1610a91637e5..5027a3e14922 100644
--- a/fs/binfmt_script.c
+++ b/fs/binfmt_script.c
@@ -80,7 +80,9 @@ static int load_script(struct linux_binprm *bprm)
        retval = copy_strings_kernel(1, &i_name, bprm);
        if (retval) return retval; 
        bprm->argc++;
-        bprm->interp = interp;
+        retval = bprm_change_interp(interp, bprm);
+        if (retval < 0)
+                return retval;
        /*
         * OK, now restart the process with the interpreter's dentry.
diff --git a/fs/exec.c b/fs/exec.c
index af8ec80f816d..18c45cac368f 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1175,9 +1175,24 @@ void free_bprm(struct linux_binprm *bprm)
                mutex_unlock(&current->signal->cred_guard_mutex);
                abort_creds(bprm->cred);
        }
+        /* If a binfmt changed the interp, free it. */
+        if (bprm->interp != bprm->filename)
+                kfree(bprm->interp);
        kfree(bprm);
 }
+int bprm_change_interp(char *interp, struct linux_binprm *bprm)
+{
+        /* If a binfmt changed the interp, free it first. */
+        if (bprm->interp != bprm->filename)
+                kfree(bprm->interp);
+        bprm->interp = kstrdup(interp, GFP_KERNEL);
+        if (!bprm->interp)
+                return -ENOMEM;
+        return 0;
+}
+EXPORT_SYMBOL(bprm_change_interp);
 /*
 * install the new credentials for this executable
 */
diff --git a/fs/fat/dir.c b/fs/fat/dir.c
index 2a182342442e..58bf744dbf39 100644
--- a/fs/fat/dir.c
+++ b/fs/fat/dir.c
@@ -461,8 +461,7 @@ static int fat_parse_short(struct super_block *sb,
 }
 /*
- * Return values: negative -> error, 0 -> not found, positive -> found,
+ * Return values: negative -> error/not found, 0 -> found.
- * value is the total amount of slots, including the shortname entry.
 */
 int fat_search_long(struct inode *inode, const unsigned char *name,
                    int name_len, struct fat_slot_info *sinfo)
@@ -1255,7 +1254,7 @@ int fat_add_entries(struct inode *dir, void *slots, int nr_slots,
        sinfo->nr_slots = nr_slots;
-        /* First stage: search free direcotry entries */
+        /* First stage: search free directory entries */
        free_slots = nr_bhs = 0;
        bh = prev = NULL;
        pos = 0;
diff --git a/fs/fat/inode.c b/fs/fat/inode.c
index 35806813ea4e..f8f491677a4a 100644
--- a/fs/fat/inode.c
+++ b/fs/fat/inode.c
@@ -1344,7 +1344,7 @@ int fat_fill_super(struct super_block *sb, void *data, int silent, int isvfat,
        sbi->dir_entries = get_unaligned_le16(&b->dir_entries);
        if (sbi->dir_entries & (sbi->dir_per_block - 1)) {
                if (!silent)
-                        fat_msg(sb, KERN_ERR, "bogus directroy-entries per block"
+                        fat_msg(sb, KERN_ERR, "bogus directory-entries per block"
                               " (%u)", sbi->dir_entries);
                brelse(bh);
                goto out_invalid;
diff --git a/fs/fat/misc.c b/fs/fat/misc.c
index 5eb600dc43a9..359d307b5507 100644
--- a/fs/fat/misc.c
+++ b/fs/fat/misc.c
@@ -135,6 +135,10 @@ int fat_chain_add(struct inode *inode, int new_dclus, int nr_cluster)
                }
                if (ret < 0)
                        return ret;
+                /*
+                 * FIXME:Although we can add this cache, fat_cache_add() is
+                 * assuming to be called after linear search with fat_cache_id.
+                 */
 //              fat_cache_add(inode, new_fclus, new_dclus);
        } else {
                MSDOS_I(inode)->i_start = new_dclus;
diff --git a/fs/hfsplus/bitmap.c b/fs/hfsplus/bitmap.c
index 4cfbe2edd296..6feefc0cb48a 100644
--- a/fs/hfsplus/bitmap.c
+++ b/fs/hfsplus/bitmap.c
@@ -176,12 +176,14 @@ int hfsplus_block_free(struct super_block *sb, u32 offset, u32 count)
        dprint(DBG_BITMAP, "block_free: %u,%u\n", offset, count);
        /* are all of the bits in range? */
        if ((offset + count) > sbi->total_blocks)
-                return -2;
+                return -ENOENT;
        mutex_lock(&sbi->alloc_mutex);
        mapping = sbi->alloc_file->i_mapping;
        pnr = offset / PAGE_CACHE_BITS;
        page = read_mapping_page(mapping, pnr, NULL);
+        if (IS_ERR(page))
+                goto kaboom;
        pptr = kmap(page);
        curr = pptr + (offset & (PAGE_CACHE_BITS - 1)) / 32;
        end = pptr + PAGE_CACHE_BITS / 32;
@@ -214,6 +216,8 @@ int hfsplus_block_free(struct super_block *sb, u32 offset, u32 count)
                set_page_dirty(page);
                kunmap(page);
                page = read_mapping_page(mapping, ++pnr, NULL);
+                if (IS_ERR(page))
+                        goto kaboom;
                pptr = kmap(page);
                curr = pptr;
                end = pptr + PAGE_CACHE_BITS / 32;
@@ -232,4 +236,11 @@ out:
        mutex_unlock(&sbi->alloc_mutex);
        return 0;
+kaboom:
+        printk(KERN_CRIT "hfsplus: unable to mark blocks free: error %ld\n",
+                        PTR_ERR(page));
+        mutex_unlock(&sbi->alloc_mutex);
+        return -EIO;
 }
diff --git a/fs/hfsplus/btree.c b/fs/hfsplus/btree.c
index 21023d9f8ff3..685d07d0ed18 100644
--- a/fs/hfsplus/btree.c
+++ b/fs/hfsplus/btree.c
@@ -159,7 +159,7 @@ void hfs_btree_close(struct hfs_btree *tree)
        kfree(tree);
 }
-void hfs_btree_write(struct hfs_btree *tree)
+int hfs_btree_write(struct hfs_btree *tree)
 {
        struct hfs_btree_header_rec *head;
        struct hfs_bnode *node;
@@ -168,7 +168,7 @@ void hfs_btree_write(struct hfs_btree *tree)
        node = hfs_bnode_find(tree, 0);
        if (IS_ERR(node))
                /* panic? */
-                return;
+                return -EIO;
        /* Load the header */
        page = node->page[0];
        head = (struct hfs_btree_header_rec *)(kmap(page) +
@@ -186,6 +186,7 @@ void hfs_btree_write(struct hfs_btree *tree)
        kunmap(page);
        set_page_dirty(page);
        hfs_bnode_put(node);
+        return 0;
 }
 static struct hfs_bnode *hfs_bmap_new_bmap(struct hfs_bnode *prev, u32 idx)
diff --git a/fs/hfsplus/extents.c b/fs/hfsplus/extents.c
index 5849e3ef35cc..eba76eab6d62 100644
--- a/fs/hfsplus/extents.c
+++ b/fs/hfsplus/extents.c
@@ -329,6 +329,7 @@ static int hfsplus_free_extents(struct super_block *sb,
 {
        u32 count, start;
        int i;
+        int err = 0;
        hfsplus_dump_extent(extent);
        for (i = 0; i < 8; extent++, i++) {
@@ -345,18 +346,33 @@ found:
        for (;;) {
                start = be32_to_cpu(extent->start_block);
                if (count <= block_nr) {
-                        hfsplus_block_free(sb, start, count);
+                        err = hfsplus_block_free(sb, start, count);
+                        if (err) {
+                                printk(KERN_ERR "hfs: can't free extent\n");
+                                dprint(DBG_EXTENT, " start: %u count: %u\n",
+                                        start, count);
+                        }
                        extent->block_count = 0;
                        extent->start_block = 0;
                        block_nr -= count;
                } else {
                        count -= block_nr;
-                        hfsplus_block_free(sb, start + count, block_nr);
+                        err = hfsplus_block_free(sb, start + count, block_nr);
+                        if (err) {
+                                printk(KERN_ERR "hfs: can't free extent\n");
+                                dprint(DBG_EXTENT, " start: %u count: %u\n",
+                                        start, count);
+                        }
                        extent->block_count = cpu_to_be32(count);
                        block_nr = 0;
                }
-                if (!block_nr || !i)
+                if (!block_nr || !i) {
-                        return 0;
+                        /*
+                         * Try to free all extents and
+                         * return only last error
+                         */
+                        return err;
+                }
                i--;
                extent--;
                count = be32_to_cpu(extent->block_count);
diff --git a/fs/hfsplus/hfsplus_fs.h b/fs/hfsplus/hfsplus_fs.h
index c571de224b15..a6da86b1b4c1 100644
--- a/fs/hfsplus/hfsplus_fs.h
+++ b/fs/hfsplus/hfsplus_fs.h
@@ -335,7 +335,7 @@ int hfsplus_block_free(struct super_block *, u32, u32);
 /* btree.c */
 struct hfs_btree *hfs_btree_open(struct super_block *, u32);
 void hfs_btree_close(struct hfs_btree *);
-void hfs_btree_write(struct hfs_btree *);
+int hfs_btree_write(struct hfs_btree *);
 struct hfs_bnode *hfs_bmap_alloc(struct hfs_btree *);
 void hfs_bmap_free(struct hfs_bnode *);
diff --git a/fs/hfsplus/super.c b/fs/hfsplus/super.c
index 811a84d2d964..796198d26553 100644
--- a/fs/hfsplus/super.c
+++ b/fs/hfsplus/super.c
@@ -127,8 +127,14 @@ static int hfsplus_system_write_inode(struct inode *inode)
                hfsplus_mark_mdb_dirty(inode->i_sb);
        }
        hfsplus_inode_write_fork(inode, fork);
-        if (tree)
+        if (tree) {
-                hfs_btree_write(tree);
+                int err = hfs_btree_write(tree);
+                if (err) {
+                        printk(KERN_ERR "hfs: b-tree write err: %d, ino %lu\n",
+                                        err, inode->i_ino);
+                        return err;
+                }
+        }
        return 0;
 }
@@ -226,6 +232,7 @@ out:
 static void delayed_sync_fs(struct work_struct *work)
 {
+        int err;
        struct hfsplus_sb_info *sbi;
        sbi = container_of(work, struct hfsplus_sb_info, sync_work.work);
@@ -234,7 +241,9 @@ static void delayed_sync_fs(struct work_struct *work)
        sbi->work_queued = 0;
        spin_unlock(&sbi->work_lock);
-        hfsplus_sync_fs(sbi->alloc_file->i_sb, 1);
+        err = hfsplus_sync_fs(sbi->alloc_file->i_sb, 1);
+        if (err)
+                printk(KERN_ERR "hfs: delayed sync fs err %d\n", err);
 }
 void hfsplus_mark_mdb_dirty(struct super_block *sb)
diff --git a/fs/proc/generic.c b/fs/proc/generic.c
index 2e4ed13b9eed..e064f562b1f7 100644
--- a/fs/proc/generic.c
+++ b/fs/proc/generic.c
@@ -352,18 +352,18 @@ retry:
        if (!ida_pre_get(&proc_inum_ida, GFP_KERNEL))
                return -ENOMEM;
-        spin_lock(&proc_inum_lock);
+        spin_lock_bh(&proc_inum_lock);
        error = ida_get_new(&proc_inum_ida, &i);
-        spin_unlock(&proc_inum_lock);
+        spin_unlock_bh(&proc_inum_lock);
        if (error == -EAGAIN)
                goto retry;
        else if (error)
                return error;
        if (i > UINT_MAX - PROC_DYNAMIC_FIRST) {
-                spin_lock(&proc_inum_lock);
+                spin_lock_bh(&proc_inum_lock);
                ida_remove(&proc_inum_ida, i);
-                spin_unlock(&proc_inum_lock);
+                spin_unlock_bh(&proc_inum_lock);
                return -ENOSPC;
        }
        *inum = PROC_DYNAMIC_FIRST + i;
@@ -372,9 +372,9 @@ retry:
 void proc_free_inum(unsigned int inum)
 {
-        spin_lock(&proc_inum_lock);
+        spin_lock_bh(&proc_inum_lock);
        ida_remove(&proc_inum_ida, inum - PROC_DYNAMIC_FIRST);
-        spin_unlock(&proc_inum_lock);
+        spin_unlock_bh(&proc_inum_lock);
 }
 static void *proc_follow_link(struct dentry *dentry, struct nameidata *nd)
diff --git a/fs/read_write.c b/fs/read_write.c
index 1edaf099ddd7..bb34af315280 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -935,6 +935,8 @@ ssize_t do_sendfile(int out_fd, int in_fd, loff_t *ppos, size_t count,
        if (retval > 0) {
                add_rchar(current, retval);
                add_wchar(current, retval);
+                fsnotify_access(in.file);
+                fsnotify_modify(out.file);
        }
        inc_syscr(current);
diff --git a/include/linux/binfmts.h b/include/linux/binfmts.h
index cf3eae0b4f59..0530b9860359 100644
--- a/include/linux/binfmts.h
+++ b/include/linux/binfmts.h
@@ -112,6 +112,7 @@ extern int setup_arg_pages(struct linux_binprm * bprm,
                           unsigned long stack_top,
                           int executable_stack);
 extern int bprm_mm_init(struct linux_binprm *bprm);
+extern int bprm_change_interp(char *interp, struct linux_binprm *bprm);
 extern int copy_strings_kernel(int argc, const char *const *argv,
                               struct linux_binprm *bprm);
 extern int prepare_bprm_creds(struct linux_binprm *bprm);
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index d140e8fb075f..c566927efcbd 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -77,13 +77,15 @@
 /*
 * Divide positive or negative dividend by positive divisor and round
- * to closest integer. Result is undefined for negative divisors.
+ * to closest integer. Result is undefined for negative divisors and
+ * for negative dividends if the divisor variable type is unsigned.
 */
 #define DIV_ROUND_CLOSEST(x, divisor)(                  \
 {                                                       \
        typeof(x) __x = x;                              \
        typeof(divisor) __d = divisor;                  \
-        (((typeof(x))-1) > 0 || (__x) > 0) ?            \
+        (((typeof(x))-1) > 0 ||                         \
+         ((typeof(divisor))-1) > 0 || (__x) > 0) ?      \
                (((__x) + ((__d) / 2)) / (__d)) :       \
                (((__x) - ((__d) / 2)) / (__d));        \
 }                                                       \
diff --git a/kernel/kcmp.c b/kernel/kcmp.c
index 30b7b225306c..e30ac0fe61c3 100644
--- a/kernel/kcmp.c
+++ b/kernel/kcmp.c
@@ -4,6 +4,7 @@
 #include <linux/string.h>
 #include <linux/random.h>
 #include <linux/module.h>
+#include <linux/ptrace.h>
 #include <linux/init.h>
 #include <linux/errno.h>
 #include <linux/cache.h>
diff --git a/kernel/modsign_pubkey.c b/kernel/modsign_pubkey.c
index 045504fffbb2..2b6e69909c39 100644
--- a/kernel/modsign_pubkey.c
+++ b/kernel/modsign_pubkey.c
@@ -34,18 +34,15 @@ static __init int module_verify_init(void)
 {
        pr_notice("Initialise module verification\n");
-        modsign_keyring = key_alloc(&key_type_keyring, ".module_sign",
+        modsign_keyring = keyring_alloc(".module_sign",
-                                    KUIDT_INIT(0), KGIDT_INIT(0),
+                                        KUIDT_INIT(0), KGIDT_INIT(0),
-                                    current_cred(),
+                                        current_cred(),
-                                    (KEY_POS_ALL & ~KEY_POS_SETATTR) |
+                                        ((KEY_POS_ALL & ~KEY_POS_SETATTR) |
-                                    KEY_USR_VIEW | KEY_USR_READ,
+                                         KEY_USR_VIEW | KEY_USR_READ),
-                                    KEY_ALLOC_NOT_IN_QUOTA);
+                                        KEY_ALLOC_NOT_IN_QUOTA, NULL);
        if (IS_ERR(modsign_keyring))
                panic("Can't allocate module signing keyring\n");
-        if (key_instantiate_and_link(modsign_keyring, NULL, 0, NULL, NULL) < 0)
-                panic("Can't instantiate module signing keyring\n");
        return 0;
 }
diff --git a/mm/compaction.c b/mm/compaction.c
index 5ad7f4f4d6f7..6b807e466497 100644
--- a/mm/compaction.c
+++ b/mm/compaction.c
@@ -17,6 +17,21 @@
 #include <linux/balloon_compaction.h>
 #include "internal.h"
+#ifdef CONFIG_COMPACTION
+static inline void count_compact_event(enum vm_event_item item)
+{
+        count_vm_event(item);
+}
+static inline void count_compact_events(enum vm_event_item item, long delta)
+{
+        count_vm_events(item, delta);
+}
+#else
+#define count_compact_event(item) do { } while (0)
+#define count_compact_events(item, delta) do { } while (0)
+#endif
 #if defined CONFIG_COMPACTION || defined CONFIG_CMA
 #define CREATE_TRACE_POINTS
@@ -303,10 +318,9 @@ static unsigned long isolate_freepages_block(struct compact_control *cc,
        if (blockpfn == end_pfn)
                update_pageblock_skip(cc, valid_page, total_isolated, false);
-        count_vm_events(COMPACTFREE_SCANNED, nr_scanned);
+        count_compact_events(COMPACTFREE_SCANNED, nr_scanned);
        if (total_isolated)
-                count_vm_events(COMPACTISOLATED, total_isolated);
+                count_compact_events(COMPACTISOLATED, total_isolated);
        return total_isolated;
 }
@@ -613,9 +627,9 @@ next_pageblock:
        trace_mm_compaction_isolate_migratepages(nr_scanned, nr_isolated);
-        count_vm_events(COMPACTMIGRATE_SCANNED, nr_scanned);
+        count_compact_events(COMPACTMIGRATE_SCANNED, nr_scanned);
        if (nr_isolated)
-                count_vm_events(COMPACTISOLATED, nr_isolated);
+                count_compact_events(COMPACTISOLATED, nr_isolated);
        return low_pfn;
 }
@@ -1110,7 +1124,7 @@ unsigned long try_to_compact_pages(struct zonelist *zonelist,
        if (!order || !may_enter_fs || !may_perform_io)
                return rc;
-        count_vm_event(COMPACTSTALL);
+        count_compact_event(COMPACTSTALL);
 #ifdef CONFIG_CMA
        if (allocflags_to_migratetype(gfp_mask) == MIGRATE_MOVABLE)
diff --git a/mm/huge_memory.c b/mm/huge_memory.c
index 32754eece63e..9e894edc7811 100644
--- a/mm/huge_memory.c
+++ b/mm/huge_memory.c
@@ -574,19 +574,19 @@ static int __init hugepage_init_sysfs(struct kobject **hugepage_kobj)
        *hugepage_kobj = kobject_create_and_add("transparent_hugepage", mm_kobj);
        if (unlikely(!*hugepage_kobj)) {
-                printk(KERN_ERR "hugepage: failed kobject create\n");
+                printk(KERN_ERR "hugepage: failed to create transparent hugepage kobject\n");
                return -ENOMEM;
        }
        err = sysfs_create_group(*hugepage_kobj, &hugepage_attr_group);
        if (err) {
-                printk(KERN_ERR "hugepage: failed register hugeage group\n");
+                printk(KERN_ERR "hugepage: failed to register transparent hugepage group\n");
                goto delete_obj;
        }
        err = sysfs_create_group(*hugepage_kobj, &khugepaged_attr_group);
        if (err) {
-                printk(KERN_ERR "hugepage: failed register hugeage group\n");
+                printk(KERN_ERR "hugepage: failed to register transparent hugepage group\n");
                goto remove_hp_group;
        }
diff --git a/mm/memcontrol.c b/mm/memcontrol.c
index f3009b4bae51..09255ec8159c 100644
--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
@@ -6090,7 +6090,6 @@ mem_cgroup_css_alloc(struct cgroup *cont)
                                                &per_cpu(memcg_stock, cpu);
                        INIT_WORK(&stock->work, drain_local_stock);
                }
-                hotcpu_notifier(memcg_cpu_hotplug_callback, 0);
        } else {
                parent = mem_cgroup_from_cont(cont->parent);
                memcg->use_hierarchy = parent->use_hierarchy;
@@ -6756,6 +6755,19 @@ struct cgroup_subsys mem_cgroup_subsys = {
        .use_id = 1,
 };
+/*
+ * The rest of init is performed during ->css_alloc() for root css which
+ * happens before initcalls.  hotcpu_notifier() can't be done together as
+ * it would introduce circular locking by adding cgroup_lock -> cpu hotplug
+ * dependency.  Do it from a subsys_initcall().
+ */
+static int __init mem_cgroup_init(void)
+{
+        hotcpu_notifier(memcg_cpu_hotplug_callback, 0);
+        return 0;
+}
+subsys_initcall(mem_cgroup_init);
 #ifdef CONFIG_MEMCG_SWAP
 static int __init enable_swap_account(char *s)
 {
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index 6f4271224493..0713bfbf0954 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -201,6 +201,18 @@ static unsigned long highmem_dirtyable_memory(unsigned long total)
                     zone_reclaimable_pages(z) - z->dirty_balance_reserve;
        }
        /*
+         * Unreclaimable memory (kernel memory or anonymous memory
+         * without swap) can bring down the dirtyable pages below
+         * the zone's dirty balance reserve and the above calculation
+         * will underflow.  However we still want to add in nodes
+         * which are below threshold (negative values) to get a more
+         * accurate calculation but make sure that the total never
+         * underflows.
+         */
+        if ((long)x < 0)
+                x = 0;
+        /*
         * Make sure that the number of highmem pages is never larger
         * than the number of the total dirtyable memory. This can only
         * occur in very strange VM situations but we want to make sure
@@ -222,8 +234,8 @@ static unsigned long global_dirtyable_memory(void)
 {
        unsigned long x;
-        x = global_page_state(NR_FREE_PAGES) + global_reclaimable_pages() -
+        x = global_page_state(NR_FREE_PAGES) + global_reclaimable_pages();
-            dirty_balance_reserve;
+        x -= min(x, dirty_balance_reserve);
        if (!vm_highmem_is_dirtyable)
                x -= highmem_dirtyable_memory(x);
@@ -290,9 +302,12 @@ static unsigned long zone_dirtyable_memory(struct zone *zone)
         * highmem zone can hold its share of dirty pages, so we don't
         * care about vm_highmem_is_dirtyable here.
         */
-        return zone_page_state(zone, NR_FREE_PAGES) +
+        unsigned long nr_pages = zone_page_state(zone, NR_FREE_PAGES) +
-               zone_reclaimable_pages(zone) -
+                zone_reclaimable_pages(zone);
-               zone->dirty_balance_reserve;
+        /* don't allow this to underflow */
+        nr_pages -= min(nr_pages, zone->dirty_balance_reserve);
+        return nr_pages;
 }
 /**
diff --git a/mm/page_alloc.c b/mm/page_alloc.c
index 2ad2ad168efe..4ba5e37127fc 100644
--- a/mm/page_alloc.c
+++ b/mm/page_alloc.c
@@ -5978,8 +5978,15 @@ done:
 void free_contig_range(unsigned long pfn, unsigned nr_pages)
 {
-        for (; nr_pages--; ++pfn)
+        unsigned int count = 0;
-                __free_page(pfn_to_page(pfn));
+        for (; nr_pages--; pfn++) {
+                struct page *page = pfn_to_page(pfn);
+                count += page_count(page) != 1;
+                __free_page(page);
+        }
+        WARN(count != 0, "%d pages are still in use!\n", count);
 }
 #endif
diff --git a/scripts/checkpatch.pl b/scripts/checkpatch.pl
index 1d6e4c541370..4d2c7dfdaabd 100755
--- a/scripts/checkpatch.pl
+++ b/scripts/checkpatch.pl
@@ -2226,8 +2226,11 @@ sub process {
                        my $path = $1;
                        if ($path =~ m{//}) {
                                ERROR("MALFORMED_INCLUDE",
-                                      "malformed #include filename\n" .
+                                      "malformed #include filename\n" . $herecurr);
-                                        $herecurr);
+                        }
+                        if ($path =~ "^uapi/" && $realfile =~ m@\binclude/uapi/@) {
+                                ERROR("UAPI_INCLUDE",
+                                      "No #include in ...include/uapi/... should use a uapi/ path prefix\n" . $herecurr);
                        }
                }
diff --git a/security/keys/process_keys.c b/security/keys/process_keys.c
index 58dfe0890947..20e4bf57aec8 100644
--- a/security/keys/process_keys.c
+++ b/security/keys/process_keys.c
@@ -367,8 +367,6 @@ key_ref_t search_my_process_keyrings(struct key_type *type,
                switch (PTR_ERR(key_ref)) {
                case -EAGAIN: /* no key */
-                        if (ret)
-                                break;
                case -ENOKEY: /* negative key */
                        ret = key_ref;
                        break;