15 files changed, 53 insertions, 56 deletions

diff --git a/arch/x86/.gitignore b/arch/x86/.gitignore
index 028079065af6..7cab8c08e6d1 100644
--- a/arch/x86/.gitignore
+++ b/arch/x86/.gitignore
@@ -1,3 +1,4 @@
 boot/compressed/vmlinux
 tools/test_get_len
+tools/insn_sanity
 
diff --git a/arch/x86/lib/x86-opcode-map.txt b/arch/x86/lib/x86-opcode-map.txt
index 4c8010d4f5e6..819137904428 100644
--- a/arch/x86/lib/x86-opcode-map.txt
+++ b/arch/x86/lib/x86-opcode-map.txt
@@ -219,7 +219,9 @@ ab: STOS/W/D/Q Yv,rAX
 ac: LODS/B AL,Xb
 ad: LODS/W/D/Q rAX,Xv
 ae: SCAS/B AL,Yb
-af: SCAS/W/D/Q rAX,Xv
+# Note: The May 2011 Intel manual shows Xv for the second parameter of the
+# next instruction but Yv is correct
+af: SCAS/W/D/Q rAX,Yv
 # 0xb0 - 0xbf
 b0: MOV AL/R8L,Ib
 b1: MOV CL/R9L,Ib
diff --git a/drivers/gpio/Kconfig b/drivers/gpio/Kconfig
index 37c4bd1cacd5..d0c41188d4e5 100644
--- a/drivers/gpio/Kconfig
+++ b/drivers/gpio/Kconfig
@@ -87,6 +87,7 @@ config GPIO_GENERIC_PLATFORM
 
 config GPIO_IT8761E
         tristate "IT8761E GPIO support"
+        depends on X86  # unconditional access to IO space.
         help
           Say yes here to support GPIO functionality of IT8761E super I/O chip.
 
diff --git a/drivers/gpio/gpio-ml-ioh.c b/drivers/gpio/gpio-ml-ioh.c
index 461958fc2264..03d6dd5dcb77 100644
--- a/drivers/gpio/gpio-ml-ioh.c
+++ b/drivers/gpio/gpio-ml-ioh.c
@@ -248,7 +248,7 @@ static void ioh_gpio_setup(struct ioh_gpio *chip, int num_port)
 static int ioh_irq_type(struct irq_data *d, unsigned int type)
 {
         u32 im;
-        u32 *im_reg;
+        void __iomem *im_reg;
         u32 ien;
         u32 im_pos;
         int ch;
@@ -412,7 +412,7 @@ static int __devinit ioh_gpio_probe(struct pci_dev *pdev,
         int i, j;
         struct ioh_gpio *chip;
         void __iomem *base;
-        void __iomem *chip_save;
+        void *chip_save;
         int irq_base;
 
         ret = pci_enable_device(pdev);
@@ -428,7 +428,7 @@ static int __devinit ioh_gpio_probe(struct pci_dev *pdev,
         }
 
         base = pci_iomap(pdev, 1, 0);
-        if (base == 0) {
+        if (!base) {
                 dev_err(&pdev->dev, "%s : pci_iomap failed", __func__);
                 ret = -ENOMEM;
                 goto err_iomap;
@@ -521,7 +521,7 @@ static void __devexit ioh_gpio_remove(struct pci_dev *pdev)
         int err;
         int i;
         struct ioh_gpio *chip = pci_get_drvdata(pdev);
-        void __iomem *chip_save;
+        void *chip_save;
 
         chip_save = chip;
 
diff --git a/drivers/gpio/gpio-pch.c b/drivers/gpio/gpio-pch.c
index f0603297f829..68fa55e86eb1 100644
--- a/drivers/gpio/gpio-pch.c
+++ b/drivers/gpio/gpio-pch.c
@@ -231,7 +231,7 @@ static void pch_gpio_setup(struct pch_gpio *chip)
 static int pch_irq_type(struct irq_data *d, unsigned int type)
 {
         u32 im;
-        u32 *im_reg;
+        u32 __iomem *im_reg;
         u32 ien;
         u32 im_pos;
         int ch;
@@ -376,7 +376,7 @@ static int __devinit pch_gpio_probe(struct pci_dev *pdev,
         }
 
         chip->base = pci_iomap(pdev, 1, 0);
-        if (chip->base == 0) {
+        if (!chip->base) {
                 dev_err(&pdev->dev, "%s : pci_iomap FAILED", __func__);
                 ret = -ENOMEM;
                 goto err_iomap;
diff --git a/drivers/gpio/gpio-tps65910.c b/drivers/gpio/gpio-tps65910.c
index b9c1c297669e..91f45b965d1e 100644
--- a/drivers/gpio/gpio-tps65910.c
+++ b/drivers/gpio/gpio-tps65910.c
@@ -52,7 +52,7 @@ static int tps65910_gpio_output(struct gpio_chip *gc, unsigned offset,
         struct tps65910 *tps65910 = container_of(gc, struct tps65910, gpio);
 
         /* Set the initial value */
-        tps65910_gpio_set(gc, 0, value);
+        tps65910_gpio_set(gc, offset, value);
 
         return tps65910_set_bits(tps65910, TPS65910_GPIO0 + offset,
                                                 GPIO_CFG_MASK);
diff --git a/fs/inode.c b/fs/inode.c
index 4fa4f0916af9..fb10d86ffad7 100644
--- a/fs/inode.c
+++ b/fs/inode.c
@@ -322,9 +322,6 @@ EXPORT_SYMBOL(clear_nlink);
 void set_nlink(struct inode *inode, unsigned int nlink)
 {
         if (!nlink) {
-                printk_ratelimited(KERN_INFO
-                        "set_nlink() clearing i_nlink on %s inode %li\n",
-                        inode->i_sb->s_type->name, inode->i_ino);
                 clear_nlink(inode);
         } else {
                 /* Yes, some filesystems do change nlink from zero to one */
diff --git a/fs/proc/stat.c b/fs/proc/stat.c
index d76ca6ae2b1b..121f77cfef76 100644
--- a/fs/proc/stat.c
+++ b/fs/proc/stat.c
@@ -77,6 +77,8 @@ static int show_stat(struct seq_file *p, void *v)
                 steal += kcpustat_cpu(i).cpustat[CPUTIME_STEAL];
                 guest += kcpustat_cpu(i).cpustat[CPUTIME_GUEST];
                 guest_nice += kcpustat_cpu(i).cpustat[CPUTIME_GUEST_NICE];
+                sum += kstat_cpu_irqs_sum(i);
+                sum += arch_irq_stat_cpu(i);
 
                 for (j = 0; j < NR_SOFTIRQS; j++) {
                         unsigned int softirq_stat = kstat_softirqs_cpu(j, i);
diff --git a/fs/qnx4/inode.c b/fs/qnx4/inode.c
index 2bfd987f4853..6b009548d2e0 100644
--- a/fs/qnx4/inode.c
+++ b/fs/qnx4/inode.c
@@ -179,47 +179,33 @@ static const char *qnx4_checkroot(struct super_block *sb)
         struct qnx4_inode_entry *rootdir;
         int rd, rl;
         int i, j;
-        int found = 0;
 
-        if (*(qnx4_sb(sb)->sb->RootDir.di_fname) != '/') {
+        if (*(qnx4_sb(sb)->sb->RootDir.di_fname) != '/')
                 return "no qnx4 filesystem (no root dir).";
-        } else {
-                QNX4DEBUG((KERN_NOTICE "QNX4 filesystem found on dev %s.\n", sb->s_id));
-                rd = le32_to_cpu(qnx4_sb(sb)->sb->RootDir.di_first_xtnt.xtnt_blk) - 1;
-                rl = le32_to_cpu(qnx4_sb(sb)->sb->RootDir.di_first_xtnt.xtnt_size);
-                for (j = 0; j < rl; j++) {
-                        bh = sb_bread(sb, rd + j);      /* root dir, first block */
-                        if (bh == NULL) {
-                                return "unable to read root entry.";
-                        }
-                        for (i = 0; i < QNX4_INODES_PER_BLOCK; i++) {
-                                rootdir = (struct qnx4_inode_entry *) (bh->b_data + i * QNX4_DIR_ENTRY_SIZE);
-                                if (rootdir->di_fname != NULL) {
-                                        QNX4DEBUG((KERN_INFO "rootdir entry found : [%s]\n", rootdir->di_fname));
-                                        if (!strcmp(rootdir->di_fname,
-                                                    QNX4_BMNAME)) {
-                                                found = 1;
-                                                qnx4_sb(sb)->BitMap = kmemdup(rootdir,
-                                                                              sizeof(struct qnx4_inode_entry),
-                                                                              GFP_KERNEL);
-                                                if (!qnx4_sb(sb)->BitMap) {
-                                                        brelse (bh);
-                                                        return "not enough memory for bitmap inode";
-                                                }/* keep bitmap inode known */
-                                                break;
-                                        }
-                                }
-                        }
+        QNX4DEBUG((KERN_NOTICE "QNX4 filesystem found on dev %s.\n", sb->s_id));
+        rd = le32_to_cpu(qnx4_sb(sb)->sb->RootDir.di_first_xtnt.xtnt_blk) - 1;
+        rl = le32_to_cpu(qnx4_sb(sb)->sb->RootDir.di_first_xtnt.xtnt_size);
+        for (j = 0; j < rl; j++) {
+                bh = sb_bread(sb, rd + j);      /* root dir, first block */
+                if (bh == NULL)
+                        return "unable to read root entry.";
+                rootdir = (struct qnx4_inode_entry *) bh->b_data;
+                for (i = 0; i < QNX4_INODES_PER_BLOCK; i++, rootdir++) {
+                        QNX4DEBUG((KERN_INFO "rootdir entry found : [%s]\n", rootdir->di_fname));
+                        if (strcmp(rootdir->di_fname, QNX4_BMNAME) != 0)
+                                continue;
+                        qnx4_sb(sb)->BitMap = kmemdup(rootdir,
+                                                      sizeof(struct qnx4_inode_entry),
+                                                      GFP_KERNEL);
                         brelse(bh);
-                        if (found != 0) {
-                                break;
-                        }
-                }
-                if (found == 0) {
-                        return "bitmap file not found.";
+                        if (!qnx4_sb(sb)->BitMap)
+                                return "not enough memory for bitmap inode";
+                        /* keep bitmap inode known */
+                        return NULL;
                 }
+                brelse(bh);
         }
-        return NULL;
+        return "bitmap file not found.";
 }
 
 static int qnx4_fill_super(struct super_block *s, void *data, int silent)
@@ -270,7 +256,7 @@ static int qnx4_fill_super(struct super_block *s, void *data, int silent)
         if (IS_ERR(root)) {
                 printk(KERN_ERR "qnx4: get inode failed\n");
                 ret = PTR_ERR(root);
-                goto out;
+                goto outb;
         }
 
         ret = -ENOMEM;
@@ -283,6 +269,8 @@ static int qnx4_fill_super(struct super_block *s, void *data, int silent)
 
       outi:
         iput(root);
+      outb:
+        kfree(qs->BitMap);
       out:
         brelse(bh);
       outnobh:
diff --git a/fs/super.c b/fs/super.c
index de41e1e46f09..6015c02296b7 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -1186,6 +1186,8 @@ int freeze_super(struct super_block *sb)
                         printk(KERN_ERR
                                 "VFS:Filesystem freeze failed\n");
                         sb->s_frozen = SB_UNFROZEN;
+                        smp_wmb();
+                        wake_up(&sb->s_wait_unfrozen);
                         deactivate_locked_super(sb);
                         return ret;
                 }
diff --git a/include/linux/key.h b/include/linux/key.h
index bfc014c57351..5253471cd2ea 100644
--- a/include/linux/key.h
+++ b/include/linux/key.h
@@ -271,7 +271,7 @@ extern int keyring_add_key(struct key *keyring,
 
 extern struct key *key_lookup(key_serial_t id);
 
-static inline key_serial_t key_serial(struct key *key)
+static inline key_serial_t key_serial(const struct key *key)
 {
         return key ? key->serial : 0;
 }
diff --git a/kernel/tracepoint.c b/kernel/tracepoint.c
index db110b8ae030..f1539decd99d 100644
--- a/kernel/tracepoint.c
+++ b/kernel/tracepoint.c
@@ -634,10 +634,11 @@ static int tracepoint_module_coming(struct module *mod)
         int ret = 0;
 
         /*
-         * We skip modules that tain the kernel, especially those with different
-         * module header (for forced load), to make sure we don't cause a crash.
+         * We skip modules that taint the kernel, especially those with different
+         * module headers (for forced load), to make sure we don't cause a crash.
+         * Staging and out-of-tree GPL modules are fine.
          */
-        if (mod->taints)
+        if (mod->taints & ~((1 << TAINT_OOT_MODULE) | (1 << TAINT_CRAP)))
                 return 0;
         mutex_lock(&tracepoints_mutex);
         tp_mod = kmalloc(sizeof(struct tp_module), GFP_KERNEL);
diff --git a/lib/mpi/mpicoder.c b/lib/mpi/mpicoder.c
index fe84bb978e3b..716802b774ea 100644
--- a/lib/mpi/mpicoder.c
+++ b/lib/mpi/mpicoder.c
@@ -255,6 +255,8 @@ void *mpi_get_buffer(MPI a, unsigned *nbytes, int *sign)
         if (!n)
                 n++;            /* avoid zero length allocation */
         p = buffer = kmalloc(n, GFP_KERNEL);
+        if (!p)
+                return NULL;
 
         for (i = a->nlimbs - 1; i >= 0; i--) {
                 alimb = a->d[i];
diff --git a/security/integrity/ima/ima_policy.c b/security/integrity/ima/ima_policy.c
index d661afbe474c..d45061d02fee 100644
--- a/security/integrity/ima/ima_policy.c
+++ b/security/integrity/ima/ima_policy.c
@@ -99,6 +99,7 @@ static bool ima_match_rules(struct ima_measure_rule_entry *rule,
                             struct inode *inode, enum ima_hooks func, int mask)
 {
         struct task_struct *tsk = current;
+        const struct cred *cred = current_cred();
         int i;
 
         if ((rule->flags & IMA_FUNC) && rule->func != func)
@@ -108,7 +109,7 @@ static bool ima_match_rules(struct ima_measure_rule_entry *rule,
         if ((rule->flags & IMA_FSMAGIC)
             && rule->fsmagic != inode->i_sb->s_magic)
                 return false;
-        if ((rule->flags & IMA_UID) && rule->uid != tsk->cred->uid)
+        if ((rule->flags & IMA_UID) && rule->uid != cred->uid)
                 return false;
         for (i = 0; i < MAX_LSM_RULES; i++) {
                 int rc = 0;
diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c
index 69ff52c08e97..2aee3c5a3b99 100644
--- a/security/keys/user_defined.c
+++ b/security/keys/user_defined.c
@@ -59,7 +59,7 @@ int user_instantiate(struct key *key, const void *data, size_t datalen)
         /* attach the data */
         upayload->datalen = datalen;
         memcpy(upayload->data, data, datalen);
-        rcu_assign_pointer(key->payload.data, upayload);
+        rcu_assign_keypointer(key, upayload);
         ret = 0;
 
 error:
@@ -98,7 +98,7 @@ int user_update(struct key *key, const void *data, size_t datalen)
         if (ret == 0) {
                 /* attach the new data, displacing the old */
                 zap = key->payload.data;
-                rcu_assign_pointer(key->payload.data, upayload);
+                rcu_assign_keypointer(key, upayload);
                 key->expiry = 0;
         }
 
@@ -133,7 +133,7 @@ void user_revoke(struct key *key)
         key_payload_reserve(key, 0);
 
         if (upayload) {
-                rcu_assign_pointer(key->payload.data, NULL);
+                rcu_assign_keypointer(key, NULL);
                 kfree_rcu(upayload, rcu);
         }
 }