18 files changed, 112 insertions, 88 deletions

diff --git a/arch/x86/pci/acpi.c b/arch/x86/pci/acpi.c
index 0972315c3860..68c3c1395202 100644
--- a/arch/x86/pci/acpi.c
+++ b/arch/x86/pci/acpi.c
@@ -188,7 +188,7 @@ static bool resource_contains(struct resource *res, resource_size_t point)
         return false;
 }
 
-static void coalesce_windows(struct pci_root_info *info, int type)
+static void coalesce_windows(struct pci_root_info *info, unsigned long type)
 {
         int i, j;
         struct resource *res1, *res2;
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 5f10c23dff94..2c5b9b991279 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -3284,7 +3284,7 @@ static int pci_set_vga_state_arch(struct pci_dev *dev, bool decode,
  * @dev: the PCI device
  * @decode: true = enable decoding, false = disable decoding
  * @command_bits: PCI_COMMAND_IO and/or PCI_COMMAND_MEMORY
- * @change_bridge_flags: traverse ancestors and change bridges
+ * @flags: traverse ancestors and change bridges
  * CHANGE_BRIDGE_ONLY / CHANGE_BRIDGE
  */
 int pci_set_vga_state(struct pci_dev *dev, bool decode,
diff --git a/drivers/pci/probe.c b/drivers/pci/probe.c
index 48849ffdd672..bafb3c3d4a89 100644
--- a/drivers/pci/probe.c
+++ b/drivers/pci/probe.c
@@ -168,7 +168,7 @@ int __pci_read_base(struct pci_dev *dev, enum pci_bar_type type,
                 res->flags |= pci_calc_resource_flags(l) | IORESOURCE_SIZEALIGN;
                 if (type == pci_bar_io) {
                         l &= PCI_BASE_ADDRESS_IO_MASK;
-                        mask = PCI_BASE_ADDRESS_IO_MASK & IO_SPACE_LIMIT;
+                        mask = PCI_BASE_ADDRESS_IO_MASK & (u32) IO_SPACE_LIMIT;
                 } else {
                         l &= PCI_BASE_ADDRESS_MEM_MASK;
                         mask = (u32)PCI_BASE_ADDRESS_MEM_MASK;
diff --git a/drivers/target/loopback/tcm_loop.c b/drivers/target/loopback/tcm_loop.c
index dee2a2c909f5..70c2e7fa6664 100644
--- a/drivers/target/loopback/tcm_loop.c
+++ b/drivers/target/loopback/tcm_loop.c
@@ -386,7 +386,7 @@ static int tcm_loop_device_reset(struct scsi_cmnd *sc)
          */
         se_cmd->se_tmr_req = core_tmr_alloc_req(se_cmd, (void *)tl_tmr,
                                 TMR_LUN_RESET);
-        if (!se_cmd->se_tmr_req)
+        if (IS_ERR(se_cmd->se_tmr_req))
                 goto release;
         /*
          * Locate the underlying TCM struct se_lun from sc->device->lun
@@ -1017,6 +1017,7 @@ static int tcm_loop_make_nexus(
         struct se_portal_group *se_tpg;
         struct tcm_loop_hba *tl_hba = tl_tpg->tl_hba;
         struct tcm_loop_nexus *tl_nexus;
+        int ret = -ENOMEM;
 
         if (tl_tpg->tl_hba->tl_nexus) {
                 printk(KERN_INFO "tl_tpg->tl_hba->tl_nexus already exists\n");
@@ -1033,8 +1034,10 @@ static int tcm_loop_make_nexus(
          * Initialize the struct se_session pointer
          */
         tl_nexus->se_sess = transport_init_session();
-        if (!tl_nexus->se_sess)
+        if (IS_ERR(tl_nexus->se_sess)) {
+                ret = PTR_ERR(tl_nexus->se_sess);
                 goto out;
+        }
         /*
          * Since we are running in 'demo mode' this call with generate a
          * struct se_node_acl for the tcm_loop struct se_portal_group with the SCSI
@@ -1060,7 +1063,7 @@ static int tcm_loop_make_nexus(
 
 out:
         kfree(tl_nexus);
-        return -ENOMEM;
+        return ret;
 }
 
 static int tcm_loop_drop_nexus(
@@ -1140,7 +1143,7 @@ static ssize_t tcm_loop_tpg_store_nexus(
          * the fabric protocol_id set in tcm_loop_make_scsi_hba(), and call
          * tcm_loop_make_nexus()
          */
-        if (strlen(page) > TL_WWN_ADDR_LEN) {
+        if (strlen(page) >= TL_WWN_ADDR_LEN) {
                 printk(KERN_ERR "Emulated NAA Sas Address: %s, exceeds"
                                 " max: %d\n", page, TL_WWN_ADDR_LEN);
                 return -EINVAL;
@@ -1321,7 +1324,7 @@ struct se_wwn *tcm_loop_make_scsi_hba(
         return ERR_PTR(-EINVAL);
 
 check_len:
-        if (strlen(name) > TL_WWN_ADDR_LEN) {
+        if (strlen(name) >= TL_WWN_ADDR_LEN) {
                 printk(KERN_ERR "Emulated NAA %s Address: %s, exceeds"
                         " max: %d\n", name, tcm_loop_dump_proto_id(tl_hba),
                         TL_WWN_ADDR_LEN);
diff --git a/drivers/target/target_core_configfs.c b/drivers/target/target_core_configfs.c
index ee6fad979b50..25c1f49a7d8b 100644
--- a/drivers/target/target_core_configfs.c
+++ b/drivers/target/target_core_configfs.c
@@ -304,7 +304,7 @@ struct target_fabric_configfs *target_fabric_configfs_init(
                 printk(KERN_ERR "Unable to locate passed fabric name\n");
                 return NULL;
         }
-        if (strlen(name) > TARGET_FABRIC_NAME_SIZE) {
+        if (strlen(name) >= TARGET_FABRIC_NAME_SIZE) {
                 printk(KERN_ERR "Passed name: %s exceeds TARGET_FABRIC"
                         "_NAME_SIZE\n", name);
                 return NULL;
@@ -312,7 +312,7 @@ struct target_fabric_configfs *target_fabric_configfs_init(
 
         tf = kzalloc(sizeof(struct target_fabric_configfs), GFP_KERNEL);
         if (!(tf))
-                return ERR_PTR(-ENOMEM);
+                return NULL;
 
         INIT_LIST_HEAD(&tf->tf_list);
         atomic_set(&tf->tf_access_cnt, 0);
@@ -851,7 +851,7 @@ static ssize_t target_core_dev_wwn_store_attr_vpd_unit_serial(
                 return -EOPNOTSUPP;
         }
 
-        if ((strlen(page) + 1) > INQUIRY_VPD_SERIAL_LEN) {
+        if (strlen(page) >= INQUIRY_VPD_SERIAL_LEN) {
                 printk(KERN_ERR "Emulated VPD Unit Serial exceeds"
                 " INQUIRY_VPD_SERIAL_LEN: %d\n", INQUIRY_VPD_SERIAL_LEN);
                 return -EOVERFLOW;
@@ -917,7 +917,7 @@ static ssize_t target_core_dev_wwn_show_attr_vpd_protocol_identifier(
 
                 transport_dump_vpd_proto_id(vpd, buf, VPD_TMP_BUF_SIZE);
 
-                if ((len + strlen(buf) > PAGE_SIZE))
+                if ((len + strlen(buf) >= PAGE_SIZE))
                         break;
 
                 len += sprintf(page+len, "%s", buf);
@@ -962,19 +962,19 @@ static ssize_t target_core_dev_wwn_show_attr_##_name(			\
                                                                         \
                 memset(buf, 0, VPD_TMP_BUF_SIZE);                       \
                 transport_dump_vpd_assoc(vpd, buf, VPD_TMP_BUF_SIZE);   \
-                if ((len + strlen(buf) > PAGE_SIZE))                    \
+                if ((len + strlen(buf) >= PAGE_SIZE))                   \
                         break;                                          \
                 len += sprintf(page+len, "%s", buf);                    \
                                                                         \
                 memset(buf, 0, VPD_TMP_BUF_SIZE);                       \
                 transport_dump_vpd_ident_type(vpd, buf, VPD_TMP_BUF_SIZE); \
-                if ((len + strlen(buf) > PAGE_SIZE))                    \
+                if ((len + strlen(buf) >= PAGE_SIZE))                   \
                         break;                                          \
                 len += sprintf(page+len, "%s", buf);                    \
                                                                         \
                 memset(buf, 0, VPD_TMP_BUF_SIZE);                       \
                 transport_dump_vpd_ident(vpd, buf, VPD_TMP_BUF_SIZE); \
-                if ((len + strlen(buf) > PAGE_SIZE))                    \
+                if ((len + strlen(buf) >= PAGE_SIZE))                   \
                         break;                                          \
                 len += sprintf(page+len, "%s", buf);                    \
         }                                                               \
@@ -1299,7 +1299,7 @@ static ssize_t target_core_dev_pr_show_attr_res_pr_registered_i_pts(
                         &i_buf[0] : "", pr_reg->pr_res_key,
                         pr_reg->pr_res_generation);
 
-                if ((len + strlen(buf) > PAGE_SIZE))
+                if ((len + strlen(buf) >= PAGE_SIZE))
                         break;
 
                 len += sprintf(page+len, "%s", buf);
@@ -1496,7 +1496,7 @@ static ssize_t target_core_dev_pr_store_attr_res_aptpl_metadata(
                                 ret = -ENOMEM;
                                 goto out;
                         }
-                        if (strlen(i_port) > PR_APTPL_MAX_IPORT_LEN) {
+                        if (strlen(i_port) >= PR_APTPL_MAX_IPORT_LEN) {
                                 printk(KERN_ERR "APTPL metadata initiator_node="
                                         " exceeds PR_APTPL_MAX_IPORT_LEN: %d\n",
                                         PR_APTPL_MAX_IPORT_LEN);
@@ -1510,7 +1510,7 @@ static ssize_t target_core_dev_pr_store_attr_res_aptpl_metadata(
                                 ret = -ENOMEM;
                                 goto out;
                         }
-                        if (strlen(isid) > PR_REG_ISID_LEN) {
+                        if (strlen(isid) >= PR_REG_ISID_LEN) {
                                 printk(KERN_ERR "APTPL metadata initiator_isid"
                                         "= exceeds PR_REG_ISID_LEN: %d\n",
                                         PR_REG_ISID_LEN);
@@ -1571,7 +1571,7 @@ static ssize_t target_core_dev_pr_store_attr_res_aptpl_metadata(
                                 ret = -ENOMEM;
                                 goto out;
                         }
-                        if (strlen(t_port) > PR_APTPL_MAX_TPORT_LEN) {
+                        if (strlen(t_port) >= PR_APTPL_MAX_TPORT_LEN) {
                                 printk(KERN_ERR "APTPL metadata target_node="
                                         " exceeds PR_APTPL_MAX_TPORT_LEN: %d\n",
                                         PR_APTPL_MAX_TPORT_LEN);
@@ -3052,7 +3052,7 @@ static struct config_group *target_core_call_addhbatotarget(
         int ret;
 
         memset(buf, 0, TARGET_CORE_NAME_MAX_LEN);
-        if (strlen(name) > TARGET_CORE_NAME_MAX_LEN) {
+        if (strlen(name) >= TARGET_CORE_NAME_MAX_LEN) {
                 printk(KERN_ERR "Passed *name strlen(): %d exceeds"
                         " TARGET_CORE_NAME_MAX_LEN: %d\n", (int)strlen(name),
                         TARGET_CORE_NAME_MAX_LEN);
diff --git a/drivers/target/target_core_device.c b/drivers/target/target_core_device.c
index 8407f9ca2b31..ba698ea62bb2 100644
--- a/drivers/target/target_core_device.c
+++ b/drivers/target/target_core_device.c
@@ -192,7 +192,7 @@ int transport_get_lun_for_tmr(
                         &SE_NODE_ACL(se_sess)->device_list[unpacked_lun];
         if (deve->lun_flags & TRANSPORT_LUNFLAGS_INITIATOR_ACCESS) {
                 se_lun = se_cmd->se_lun = se_tmr->tmr_lun = deve->se_lun;
-                dev = se_tmr->tmr_dev = se_lun->lun_se_dev;
+                dev = se_lun->lun_se_dev;
                 se_cmd->pr_res_key = deve->pr_res_key;
                 se_cmd->orig_fe_lun = unpacked_lun;
                 se_cmd->se_orig_obj_ptr = SE_LUN(se_cmd)->lun_se_dev;
@@ -216,6 +216,7 @@ int transport_get_lun_for_tmr(
                 se_cmd->se_cmd_flags |= SCF_SCSI_CDB_EXCEPTION;
                 return -1;
         }
+        se_tmr->tmr_dev = dev;
 
         spin_lock(&dev->se_tmr_lock);
         list_add_tail(&se_tmr->tmr_list, &dev->dev_tmr_list);
@@ -1430,7 +1431,7 @@ struct se_lun_acl *core_dev_init_initiator_node_lun_acl(
         struct se_lun_acl *lacl;
         struct se_node_acl *nacl;
 
-        if (strlen(initiatorname) > TRANSPORT_IQN_LEN) {
+        if (strlen(initiatorname) >= TRANSPORT_IQN_LEN) {
                 printk(KERN_ERR "%s InitiatorName exceeds maximum size.\n",
                         TPG_TFO(tpg)->get_fabric_name());
                 *ret = -EOVERFLOW;
diff --git a/drivers/target/target_core_pr.c b/drivers/target/target_core_pr.c
index a79f518ca6e2..b662db3a320b 100644
--- a/drivers/target/target_core_pr.c
+++ b/drivers/target/target_core_pr.c
@@ -1916,7 +1916,7 @@ static int __core_scsi3_update_aptpl_buf(
                                 pr_reg->pr_res_mapped_lun);
                 }
 
-                if ((len + strlen(tmp) > pr_aptpl_buf_len)) {
+                if ((len + strlen(tmp) >= pr_aptpl_buf_len)) {
                         printk(KERN_ERR "Unable to update renaming"
                                 " APTPL metadata\n");
                         spin_unlock(&T10_RES(su_dev)->registration_lock);
@@ -1934,7 +1934,7 @@ static int __core_scsi3_update_aptpl_buf(
                         TPG_TFO(tpg)->tpg_get_tag(tpg),
                         lun->lun_sep->sep_rtpi, lun->unpacked_lun, reg_count);
 
-                if ((len + strlen(tmp) > pr_aptpl_buf_len)) {
+                if ((len + strlen(tmp) >= pr_aptpl_buf_len)) {
                         printk(KERN_ERR "Unable to update renaming"
                                 " APTPL metadata\n");
                         spin_unlock(&T10_RES(su_dev)->registration_lock);
@@ -1986,7 +1986,7 @@ static int __core_scsi3_write_aptpl_to_file(
         memset(iov, 0, sizeof(struct iovec));
         memset(path, 0, 512);
 
-        if (strlen(&wwn->unit_serial[0]) > 512) {
+        if (strlen(&wwn->unit_serial[0]) >= 512) {
                 printk(KERN_ERR "WWN value for struct se_device does not fit"
                         " into path buffer\n");
                 return -1;
diff --git a/drivers/target/target_core_tmr.c b/drivers/target/target_core_tmr.c
index 59b8b9c5ad72..179063d81cdd 100644
--- a/drivers/target/target_core_tmr.c
+++ b/drivers/target/target_core_tmr.c
@@ -75,10 +75,16 @@ void core_tmr_release_req(
 {
         struct se_device *dev = tmr->tmr_dev;
 
+        if (!dev) {
+                kmem_cache_free(se_tmr_req_cache, tmr);
+                return;
+        }
+
         spin_lock(&dev->se_tmr_lock);
         list_del(&tmr->tmr_list);
-        kmem_cache_free(se_tmr_req_cache, tmr);
         spin_unlock(&dev->se_tmr_lock);
+
+        kmem_cache_free(se_tmr_req_cache, tmr);
 }
 
 static void core_tmr_handle_tas_abort(
diff --git a/drivers/target/target_core_transport.c b/drivers/target/target_core_transport.c
index 4dafeb8b5638..4b9b7169bdd9 100644
--- a/drivers/target/target_core_transport.c
+++ b/drivers/target/target_core_transport.c
@@ -536,13 +536,13 @@ EXPORT_SYMBOL(transport_register_session);
 void transport_deregister_session_configfs(struct se_session *se_sess)
 {
         struct se_node_acl *se_nacl;
-
+        unsigned long flags;
         /*
          * Used by struct se_node_acl's under ConfigFS to locate active struct se_session
          */
         se_nacl = se_sess->se_node_acl;
         if ((se_nacl)) {
-                spin_lock_irq(&se_nacl->nacl_sess_lock);
+                spin_lock_irqsave(&se_nacl->nacl_sess_lock, flags);
                 list_del(&se_sess->sess_acl_list);
                 /*
                  * If the session list is empty, then clear the pointer.
@@ -556,7 +556,7 @@ void transport_deregister_session_configfs(struct se_session *se_sess)
                                         se_nacl->acl_sess_list.prev,
                                         struct se_session, sess_acl_list);
                 }
-                spin_unlock_irq(&se_nacl->nacl_sess_lock);
+                spin_unlock_irqrestore(&se_nacl->nacl_sess_lock, flags);
         }
 }
 EXPORT_SYMBOL(transport_deregister_session_configfs);
diff --git a/drivers/target/tcm_fc/tcm_fc.h b/drivers/target/tcm_fc/tcm_fc.h
index defff32b7880..7b82f1b7fef8 100644
--- a/drivers/target/tcm_fc/tcm_fc.h
+++ b/drivers/target/tcm_fc/tcm_fc.h
@@ -144,7 +144,7 @@ enum ft_cmd_state {
  */
 struct ft_cmd {
         enum ft_cmd_state state;
-        u16 lun;                        /* LUN from request */
+        u32 lun;                        /* LUN from request */
         struct ft_sess *sess;           /* session held for cmd */
         struct fc_seq *seq;             /* sequence in exchange mgr */
         struct se_cmd se_cmd;           /* Local TCM I/O descriptor */
diff --git a/drivers/target/tcm_fc/tfc_cmd.c b/drivers/target/tcm_fc/tfc_cmd.c
index c056a1132ae1..b2a106729d49 100644
--- a/drivers/target/tcm_fc/tfc_cmd.c
+++ b/drivers/target/tcm_fc/tfc_cmd.c
@@ -94,29 +94,6 @@ void ft_dump_cmd(struct ft_cmd *cmd, const char *caller)
                 16, 4, cmd->cdb, MAX_COMMAND_SIZE, 0);
 }
 
-/*
- * Get LUN from CDB.
- */
-static int ft_get_lun_for_cmd(struct ft_cmd *cmd, u8 *lunp)
-{
-        u64 lun;
-
-        lun = lunp[1];
-        switch (lunp[0] >> 6) {
-        case 0:
-                break;
-        case 1:
-                lun |= (lunp[0] & 0x3f) << 8;
-                break;
-        default:
-                return -1;
-        }
-        if (lun >= TRANSPORT_MAX_LUNS_PER_TPG)
-                return -1;
-        cmd->lun = lun;
-        return transport_get_lun_for_cmd(&cmd->se_cmd, NULL, lun);
-}
-
 static void ft_queue_cmd(struct ft_sess *sess, struct ft_cmd *cmd)
 {
         struct se_queue_obj *qobj;
@@ -418,6 +395,7 @@ static void ft_send_tm(struct ft_cmd *cmd)
 {
         struct se_tmr_req *tmr;
         struct fcp_cmnd *fcp;
+        struct ft_sess *sess;
         u8 tm_func;
 
         fcp = fc_frame_payload_get(cmd->req_frame, sizeof(*fcp));
@@ -425,13 +403,6 @@ static void ft_send_tm(struct ft_cmd *cmd)
         switch (fcp->fc_tm_flags) {
         case FCP_TMF_LUN_RESET:
                 tm_func = TMR_LUN_RESET;
-                if (ft_get_lun_for_cmd(cmd, fcp->fc_lun) < 0) {
-                        ft_dump_cmd(cmd, __func__);
-                        transport_send_check_condition_and_sense(&cmd->se_cmd,
-                                cmd->se_cmd.scsi_sense_reason, 0);
-                        ft_sess_put(cmd->sess);
-                        return;
-                }
                 break;
         case FCP_TMF_TGT_RESET:
                 tm_func = TMR_TARGET_WARM_RESET;
@@ -463,6 +434,36 @@ static void ft_send_tm(struct ft_cmd *cmd)
                 return;
         }
         cmd->se_cmd.se_tmr_req = tmr;
+
+        switch (fcp->fc_tm_flags) {
+        case FCP_TMF_LUN_RESET:
+                cmd->lun = scsilun_to_int((struct scsi_lun *)fcp->fc_lun);
+                if (transport_get_lun_for_tmr(&cmd->se_cmd, cmd->lun) < 0) {
+                        /*
+                         * Make sure to clean up newly allocated TMR request
+                         * since "unable to  handle TMR request because failed
+                         * to get to LUN"
+                         */
+                        FT_TM_DBG("Failed to get LUN for TMR func %d, "
+                                  "se_cmd %p, unpacked_lun %d\n",
+                                  tm_func, &cmd->se_cmd, cmd->lun);
+                        ft_dump_cmd(cmd, __func__);
+                        sess = cmd->sess;
+                        transport_send_check_condition_and_sense(&cmd->se_cmd,
+                                cmd->se_cmd.scsi_sense_reason, 0);
+                        transport_generic_free_cmd(&cmd->se_cmd, 0, 1, 0);
+                        ft_sess_put(sess);
+                        return;
+                }
+                break;
+        case FCP_TMF_TGT_RESET:
+        case FCP_TMF_CLR_TASK_SET:
+        case FCP_TMF_ABT_TASK_SET:
+        case FCP_TMF_CLR_ACA:
+                break;
+        default:
+                return;
+        }
         transport_generic_handle_tmr(&cmd->se_cmd);
 }
 
@@ -635,7 +636,8 @@ static void ft_send_cmd(struct ft_cmd *cmd)
 
         fc_seq_exch(cmd->seq)->lp->tt.seq_set_resp(cmd->seq, ft_recv_seq, cmd);
 
-        ret = ft_get_lun_for_cmd(cmd, fcp->fc_lun);
+        cmd->lun = scsilun_to_int((struct scsi_lun *)fcp->fc_lun);
+        ret = transport_get_lun_for_cmd(&cmd->se_cmd, NULL, cmd->lun);
         if (ret < 0) {
                 ft_dump_cmd(cmd, __func__);
                 transport_send_check_condition_and_sense(&cmd->se_cmd,
diff --git a/drivers/target/tcm_fc/tfc_io.c b/drivers/target/tcm_fc/tfc_io.c
index 4c3c0efbe13f..8c4a24077d9d 100644
--- a/drivers/target/tcm_fc/tfc_io.c
+++ b/drivers/target/tcm_fc/tfc_io.c
@@ -203,7 +203,7 @@ int ft_queue_data_in(struct se_cmd *se_cmd)
                         /* XXX For now, initiator will retry */
                         if (printk_ratelimit())
                                 printk(KERN_ERR "%s: Failed to send frame %p, "
-                                                "xid <0x%x>, remaining <0x%x>, "
+                                                "xid <0x%x>, remaining %zu, "
                                                 "lso_max <0x%x>\n",
                                                 __func__, fp, ep->xid,
                                                 remaining, lport->lso_max);
diff --git a/drivers/target/tcm_fc/tfc_sess.c b/drivers/target/tcm_fc/tfc_sess.c
index a3bd57f2ea32..7491e21cc6ae 100644
--- a/drivers/target/tcm_fc/tfc_sess.c
+++ b/drivers/target/tcm_fc/tfc_sess.c
@@ -229,7 +229,7 @@ static struct ft_sess *ft_sess_create(struct ft_tport *tport, u32 port_id,
                 return NULL;
 
         sess->se_sess = transport_init_session();
-        if (!sess->se_sess) {
+        if (IS_ERR(sess->se_sess)) {
                 kfree(sess);
                 return NULL;
         }
@@ -332,7 +332,7 @@ void ft_sess_close(struct se_session *se_sess)
         lport = sess->tport->lport;
         port_id = sess->port_id;
         if (port_id == -1) {
-                mutex_lock(&ft_lport_lock);
+                mutex_unlock(&ft_lport_lock);
                 return;
         }
         FT_SESS_DBG("port_id %x\n", port_id);
diff --git a/drivers/tty/serial/mrst_max3110.c b/drivers/tty/serial/mrst_max3110.c
index 1bd28450ca40..a764bf99743b 100644
--- a/drivers/tty/serial/mrst_max3110.c
+++ b/drivers/tty/serial/mrst_max3110.c
@@ -421,7 +421,6 @@ static int max3110_main_thread(void *_max)
         int ret = 0;
         struct circ_buf *xmit = &max->con_xmit;
 
-        init_waitqueue_head(wq);
         pr_info(PR_FMT "start main thread\n");
 
         do {
@@ -823,7 +822,7 @@ static int __devinit serial_m3110_probe(struct spi_device *spi)
         res = RC_TAG;
         ret = max3110_write_then_read(max, (u8 *)&res, (u8 *)&res, 2, 0);
         if (ret < 0 || res == 0 || res == 0xffff) {
-                printk(KERN_ERR "MAX3111 deemed not present (conf reg %04x)",
+                dev_dbg(&spi->dev, "MAX3111 deemed not present (conf reg %04x)",
                                                                         res);
                 ret = -ENODEV;
                 goto err_get_page;
@@ -838,6 +837,8 @@ static int __devinit serial_m3110_probe(struct spi_device *spi)
         max->con_xmit.head = 0;
         max->con_xmit.tail = 0;
 
+        init_waitqueue_head(&max->wq);
+
         max->main_thread = kthread_run(max3110_main_thread,
                                         max, "max3110_main");
         if (IS_ERR(max->main_thread)) {
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index 300628795fdb..f30ac05dbda7 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -19,7 +19,6 @@
 #ifndef __BTRFS_CTREE__
 #define __BTRFS_CTREE__
 
-#include <linux/version.h>
 #include <linux/mm.h>
 #include <linux/highmem.h>
 #include <linux/fs.h>
diff --git a/fs/cifs/connect.c b/fs/cifs/connect.c
index 12cf72dd0c42..c761935eab8c 100644
--- a/fs/cifs/connect.c
+++ b/fs/cifs/connect.c
@@ -2750,21 +2750,21 @@ void cifs_setup_cifs_sb(struct smb_vol *pvolume_info,
 
 /*
  * When the server supports very large writes via POSIX extensions, we can
- * allow up to 2^24 - PAGE_CACHE_SIZE.
+ * allow up to 2^24-1, minus the size of a WRITE_AND_X header, not including
+ * the RFC1001 length.
  *
  * Note that this might make for "interesting" allocation problems during
- * writeback however (as we have to allocate an array of pointers for the
- * pages). A 16M write means ~32kb page array with PAGE_CACHE_SIZE == 4096.
+ * writeback however as we have to allocate an array of pointers for the
+ * pages. A 16M write means ~32kb page array with PAGE_CACHE_SIZE == 4096.
  */
-#define CIFS_MAX_WSIZE ((1<<24) - PAGE_CACHE_SIZE)
+#define CIFS_MAX_WSIZE ((1<<24) - 1 - sizeof(WRITE_REQ) + 4)
 
 /*
- * When the server doesn't allow large posix writes, default to a wsize of
- * 128k - PAGE_CACHE_SIZE -- one page less than the largest frame size
- * described in RFC1001. This allows space for the header without going over
- * that by default.
+ * When the server doesn't allow large posix writes, only allow a wsize of
+ * 128k minus the size of the WRITE_AND_X header. That allows for a write up
+ * to the maximum size described by RFC1002.
  */
-#define CIFS_MAX_RFC1001_WSIZE (128 * 1024 - PAGE_CACHE_SIZE)
+#define CIFS_MAX_RFC1002_WSIZE (128 * 1024 - sizeof(WRITE_REQ) + 4)
 
 /*
  * The default wsize is 1M. find_get_pages seems to return a maximum of 256
@@ -2783,11 +2783,18 @@ cifs_negotiate_wsize(struct cifs_tcon *tcon, struct smb_vol *pvolume_info)
 
         /* can server support 24-bit write sizes? (via UNIX extensions) */
         if (!tcon->unix_ext || !(unix_cap & CIFS_UNIX_LARGE_WRITE_CAP))
-                wsize = min_t(unsigned int, wsize, CIFS_MAX_RFC1001_WSIZE);
+                wsize = min_t(unsigned int, wsize, CIFS_MAX_RFC1002_WSIZE);
 
-        /* no CAP_LARGE_WRITE_X? Limit it to 16 bits */
-        if (!(server->capabilities & CAP_LARGE_WRITE_X))
-                wsize = min_t(unsigned int, wsize, USHRT_MAX);
+        /*
+         * no CAP_LARGE_WRITE_X or is signing enabled without CAP_UNIX set?
+         * Limit it to max buffer offered by the server, minus the size of the
+         * WRITEX header, not including the 4 byte RFC1001 length.
+         */
+        if (!(server->capabilities & CAP_LARGE_WRITE_X) ||
+            (!(server->capabilities & CAP_UNIX) &&
+             (server->sec_mode & (SECMODE_SIGN_ENABLED|SECMODE_SIGN_REQUIRED))))
+                wsize = min_t(unsigned int, wsize,
+                                server->maxBuf - sizeof(WRITE_REQ) + 4);
 
         /* hard limit of CIFS_MAX_WSIZE */
         wsize = min_t(unsigned int, wsize, CIFS_MAX_WSIZE);
@@ -2937,7 +2944,11 @@ int cifs_setup_volume_info(struct smb_vol **pvolume_info, char *mount_data,
 
         if (volume_info->nullauth) {
                 cFYI(1, "null user");
-                volume_info->username = "";
+                volume_info->username = kzalloc(1, GFP_KERNEL);
+                if (volume_info->username == NULL) {
+                        rc = -ENOMEM;
+                        goto out;
+                }
         } else if (volume_info->username) {
                 /* BB fixme parse for domain name here */
                 cFYI(1, "Username: %s", volume_info->username);
diff --git a/fs/omfs/file.c b/fs/omfs/file.c
index d738a7e493dd..2c6d95257a4d 100644
--- a/fs/omfs/file.c
+++ b/fs/omfs/file.c
@@ -4,7 +4,6 @@
  * Released under GPL v2.
  */
 
-#include <linux/version.h>
 #include <linux/module.h>
 #include <linux/fs.h>
 #include <linux/buffer_head.h>
diff --git a/init/calibrate.c b/init/calibrate.c
index 2568d22a304e..aae2f40fea4c 100644
--- a/init/calibrate.c
+++ b/init/calibrate.c
@@ -245,30 +245,32 @@ recalibrate:
 
 void __cpuinit calibrate_delay(void)
 {
+        unsigned long lpj;
         static bool printed;
 
         if (preset_lpj) {
-                loops_per_jiffy = preset_lpj;
+                lpj = preset_lpj;
                 if (!printed)
                         pr_info("Calibrating delay loop (skipped) "
                                 "preset value.. ");
         } else if ((!printed) && lpj_fine) {
-                loops_per_jiffy = lpj_fine;
+                lpj = lpj_fine;
                 pr_info("Calibrating delay loop (skipped), "
                         "value calculated using timer frequency.. ");
-        } else if ((loops_per_jiffy = calibrate_delay_direct()) != 0) {
+        } else if ((lpj = calibrate_delay_direct()) != 0) {
                 if (!printed)
                         pr_info("Calibrating delay using timer "
                                 "specific routine.. ");
         } else {
                 if (!printed)
                         pr_info("Calibrating delay loop... ");
-                loops_per_jiffy = calibrate_delay_converge();
+                lpj = calibrate_delay_converge();
         }
         if (!printed)
                 pr_cont("%lu.%02lu BogoMIPS (lpj=%lu)\n",
-                        loops_per_jiffy/(500000/HZ),
-                        (loops_per_jiffy/(5000/HZ)) % 100, loops_per_jiffy);
+                        lpj/(500000/HZ),
+                        (lpj/(5000/HZ)) % 100, lpj);
 
+        loops_per_jiffy = lpj;
         printed = true;
 }