13 files changed, 124 insertions, 56 deletions

diff --git a/drivers/gpu/drm/radeon/atom.c b/drivers/gpu/drm/radeon/atom.c
index e88c64417a8a..14cc88aaf3a7 100644
--- a/drivers/gpu/drm/radeon/atom.c
+++ b/drivers/gpu/drm/radeon/atom.c
@@ -277,7 +277,12 @@ static uint32_t atom_get_src_int(atom_exec_context *ctx, uint8_t attr,
         case ATOM_ARG_FB:
                 idx = U8(*ptr);
                 (*ptr)++;
-                val = gctx->scratch[((gctx->fb_base + idx) / 4)];
+                if ((gctx->fb_base + (idx * 4)) > gctx->scratch_size_bytes) {
+                        DRM_ERROR("ATOM: fb read beyond scratch region: %d vs. %d\n",
+                                  gctx->fb_base + (idx * 4), gctx->scratch_size_bytes);
+                        val = 0;
+                } else
+                        val = gctx->scratch[(gctx->fb_base / 4) + idx];
                 if (print)
                         DEBUG("FB[0x%02X]", idx);
                 break;
@@ -531,7 +536,11 @@ static void atom_put_dst(atom_exec_context *ctx, int arg, uint8_t attr,
         case ATOM_ARG_FB:
                 idx = U8(*ptr);
                 (*ptr)++;
-                gctx->scratch[((gctx->fb_base + idx) / 4)] = val;
+                if ((gctx->fb_base + (idx * 4)) > gctx->scratch_size_bytes) {
+                        DRM_ERROR("ATOM: fb write beyond scratch region: %d vs. %d\n",
+                                  gctx->fb_base + (idx * 4), gctx->scratch_size_bytes);
+                } else
+                        gctx->scratch[(gctx->fb_base / 4) + idx] = val;
                 DEBUG("FB[0x%02X]", idx);
                 break;
         case ATOM_ARG_PLL:
@@ -1370,11 +1379,13 @@ int atom_allocate_fb_scratch(struct atom_context *ctx)
 
                 usage_bytes = firmware_usage->asFirmwareVramReserveInfo[0].usFirmwareUseInKb * 1024;
         }
+        ctx->scratch_size_bytes = 0;
         if (usage_bytes == 0)
                 usage_bytes = 20 * 1024;
         /* allocate some scratch memory */
         ctx->scratch = kzalloc(usage_bytes, GFP_KERNEL);
         if (!ctx->scratch)
                 return -ENOMEM;
+        ctx->scratch_size_bytes = usage_bytes;
         return 0;
 }
diff --git a/drivers/gpu/drm/radeon/atom.h b/drivers/gpu/drm/radeon/atom.h
index a589a55b223e..93cfe2086ba0 100644
--- a/drivers/gpu/drm/radeon/atom.h
+++ b/drivers/gpu/drm/radeon/atom.h
@@ -137,6 +137,7 @@ struct atom_context {
         int cs_equal, cs_above;
         int io_mode;
         uint32_t *scratch;
+        int scratch_size_bytes;
 };
 
 extern int atom_debug;
diff --git a/drivers/gpu/drm/radeon/atombios_crtc.c b/drivers/gpu/drm/radeon/atombios_crtc.c
index c742944d3805..a515b2a09d85 100644
--- a/drivers/gpu/drm/radeon/atombios_crtc.c
+++ b/drivers/gpu/drm/radeon/atombios_crtc.c
@@ -466,7 +466,7 @@ static void atombios_crtc_program_ss(struct drm_crtc *crtc,
                         return;
                 }
                 args.v2.ucEnable = enable;
-                if ((ss->percentage == 0) || (ss->type & ATOM_EXTERNAL_SS_MASK))
+                if ((ss->percentage == 0) || (ss->type & ATOM_EXTERNAL_SS_MASK) || ASIC_IS_DCE41(rdev))
                         args.v2.ucEnable = ATOM_DISABLE;
         } else if (ASIC_IS_DCE3(rdev)) {
                 args.v1.usSpreadSpectrumPercentage = cpu_to_le16(ss->percentage);
diff --git a/drivers/gpu/drm/radeon/radeon_encoders.c b/drivers/gpu/drm/radeon/radeon_encoders.c
index 8a171b21b453..eb3f6dc6df83 100644
--- a/drivers/gpu/drm/radeon/radeon_encoders.c
+++ b/drivers/gpu/drm/radeon/radeon_encoders.c
@@ -1638,7 +1638,17 @@ atombios_set_encoder_crtc_source(struct drm_encoder *encoder)
                         break;
                 case 2:
                         args.v2.ucCRTC = radeon_crtc->crtc_id;
-                        args.v2.ucEncodeMode = atombios_get_encoder_mode(encoder);
+                        if (radeon_encoder_is_dp_bridge(encoder)) {
+                                struct drm_connector *connector = radeon_get_connector_for_encoder(encoder);
+
+                                if (connector->connector_type == DRM_MODE_CONNECTOR_LVDS)
+                                        args.v2.ucEncodeMode = ATOM_ENCODER_MODE_LVDS;
+                                else if (connector->connector_type == DRM_MODE_CONNECTOR_VGA)
+                                        args.v2.ucEncodeMode = ATOM_ENCODER_MODE_CRT;
+                                else
+                                        args.v2.ucEncodeMode = atombios_get_encoder_mode(encoder);
+                        } else
+                                args.v2.ucEncodeMode = atombios_get_encoder_mode(encoder);
                         switch (radeon_encoder->encoder_id) {
                         case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:
                         case ENCODER_OBJECT_ID_INTERNAL_UNIPHY1:
@@ -1756,10 +1766,15 @@ static int radeon_atom_pick_dig_encoder(struct drm_encoder *encoder)
         if (ASIC_IS_DCE4(rdev)) {
                 dig = radeon_encoder->enc_priv;
                 if (ASIC_IS_DCE41(rdev)) {
-                        if (dig->linkb)
-                                return 1;
-                        else
-                                return 0;
+                        /* ontario follows DCE4 */
+                        if (rdev->family == CHIP_PALM) {
+                                if (dig->linkb)
+                                        return 1;
+                                else
+                                        return 0;
+                        } else
+                                /* llano follows DCE3.2 */
+                                return radeon_crtc->crtc_id;
                 } else {
                         switch (radeon_encoder->encoder_id) {
                         case ENCODER_OBJECT_ID_INTERNAL_UNIPHY:
diff --git a/drivers/gpu/drm/ttm/ttm_bo_util.c b/drivers/gpu/drm/ttm/ttm_bo_util.c
index ae3c6f5dd2b7..082fcaea583f 100644
--- a/drivers/gpu/drm/ttm/ttm_bo_util.c
+++ b/drivers/gpu/drm/ttm/ttm_bo_util.c
@@ -321,7 +321,7 @@ int ttm_bo_move_memcpy(struct ttm_buffer_object *bo,
         struct ttm_mem_type_manager *man = &bdev->man[new_mem->mem_type];
         struct ttm_tt *ttm = bo->ttm;
         struct ttm_mem_reg *old_mem = &bo->mem;
-        struct ttm_mem_reg old_copy;
+        struct ttm_mem_reg old_copy = *old_mem;
         void *old_iomap;
         void *new_iomap;
         int ret;
diff --git a/drivers/hwmon/w83627ehf.c b/drivers/hwmon/w83627ehf.c
index 7b0260dc76fb..36d7f270b14d 100644
--- a/drivers/hwmon/w83627ehf.c
+++ b/drivers/hwmon/w83627ehf.c
@@ -390,7 +390,7 @@ temp_from_reg(u16 reg, s16 regval)
 {
         if (is_word_sized(reg))
                 return LM75_TEMP_FROM_REG(regval);
-        return regval * 1000;
+        return ((s8)regval) * 1000;
 }
 
 static inline u16
@@ -398,7 +398,8 @@ temp_to_reg(u16 reg, long temp)
 {
         if (is_word_sized(reg))
                 return LM75_TEMP_TO_REG(temp);
-        return DIV_ROUND_CLOSEST(SENSORS_LIMIT(temp, -127000, 128000), 1000);
+        return (s8)DIV_ROUND_CLOSEST(SENSORS_LIMIT(temp, -127000, 128000),
+                                     1000);
 }
 
 /* Some of analog inputs have internal scaling (2x), 8mV is ADC LSB */
diff --git a/drivers/media/video/v4l2-dev.c b/drivers/media/video/v4l2-dev.c
index d72156517726..a5c9ed128b97 100644
--- a/drivers/media/video/v4l2-dev.c
+++ b/drivers/media/video/v4l2-dev.c
@@ -181,7 +181,7 @@ static void v4l2_device_release(struct device *cd)
          * TODO: In the long run all drivers that use v4l2_device should use the
          * v4l2_device release callback. This check will then be unnecessary.
          */
-        if (v4l2_dev->release == NULL)
+        if (v4l2_dev && v4l2_dev->release == NULL)
                 v4l2_dev = NULL;
 
         /* Release video_device and perform other
diff --git a/drivers/net/bonding/bond_main.c b/drivers/net/bonding/bond_main.c
index 6d79b78cfc75..de3d351ccb6b 100644
--- a/drivers/net/bonding/bond_main.c
+++ b/drivers/net/bonding/bond_main.c
@@ -1435,6 +1435,8 @@ static rx_handler_result_t bond_handle_frame(struct sk_buff **pskb)
         struct sk_buff *skb = *pskb;
         struct slave *slave;
         struct bonding *bond;
+        void (*recv_probe)(struct sk_buff *, struct bonding *,
+                                struct slave *);
 
         skb = skb_share_check(skb, GFP_ATOMIC);
         if (unlikely(!skb))
@@ -1448,11 +1450,12 @@ static rx_handler_result_t bond_handle_frame(struct sk_buff **pskb)
         if (bond->params.arp_interval)
                 slave->dev->last_rx = jiffies;
 
-        if (bond->recv_probe) {
+        recv_probe = ACCESS_ONCE(bond->recv_probe);
+        if (recv_probe) {
                 struct sk_buff *nskb = skb_clone(skb, GFP_ATOMIC);
 
                 if (likely(nskb)) {
-                        bond->recv_probe(nskb, bond, slave);
+                        recv_probe(nskb, bond, slave);
                         dev_kfree_skb(nskb);
                 }
         }
diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index ed2a3977c6e7..e8882023576b 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -307,6 +307,11 @@ static ssize_t store_enabled(struct netconsole_target *nt,
                 return err;
         if (enabled < 0 || enabled > 1)
                 return -EINVAL;
+        if (enabled == nt->enabled) {
+                printk(KERN_INFO "netconsole: network logging has already %s\n",
+                                nt->enabled ? "started" : "stopped");
+                return -EINVAL;
+        }
 
         if (enabled) {  /* 1 */
 
diff --git a/drivers/net/pptp.c b/drivers/net/pptp.c
index eae542a7e987..89f829f5f725 100644
--- a/drivers/net/pptp.c
+++ b/drivers/net/pptp.c
@@ -285,8 +285,10 @@ static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
         ip_send_check(iph);
 
         ip_local_out(skb);
+        return 1;
 
 tx_error:
+        kfree_skb(skb);
         return 1;
 }
 
@@ -305,11 +307,18 @@ static int pptp_rcv_core(struct sock *sk, struct sk_buff *skb)
         }
 
         header = (struct pptp_gre_header *)(skb->data);
+        headersize  = sizeof(*header);
 
         /* test if acknowledgement present */
         if (PPTP_GRE_IS_A(header->ver)) {
-                __u32 ack = (PPTP_GRE_IS_S(header->flags)) ?
-                                header->ack : header->seq; /* ack in different place if S = 0 */
+                __u32 ack;
+
+                if (!pskb_may_pull(skb, headersize))
+                        goto drop;
+                header = (struct pptp_gre_header *)(skb->data);
+
+                /* ack in different place if S = 0 */
+                ack = PPTP_GRE_IS_S(header->flags) ? header->ack : header->seq;
 
                 ack = ntohl(ack);
 
@@ -318,21 +327,18 @@ static int pptp_rcv_core(struct sock *sk, struct sk_buff *skb)
                 /* also handle sequence number wrap-around  */
                 if (WRAPPED(ack, opt->ack_recv))
                         opt->ack_recv = ack;
+        } else {
+                headersize -= sizeof(header->ack);
         }
-
         /* test if payload present */
         if (!PPTP_GRE_IS_S(header->flags))
                 goto drop;
 
-        headersize  = sizeof(*header);
         payload_len = ntohs(header->payload_len);
         seq         = ntohl(header->seq);
 
-        /* no ack present? */
-        if (!PPTP_GRE_IS_A(header->ver))
-                headersize -= sizeof(header->ack);
         /* check for incomplete packet (length smaller than expected) */
-        if (skb->len - headersize < payload_len)
+        if (!pskb_may_pull(skb, headersize + payload_len))
                 goto drop;
 
         payload = skb->data + headersize;
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index c23667017922..6d657cabb951 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -2859,7 +2859,7 @@ static void rtl8168e_2_hw_phy_config(struct rtl8169_private *tp)
         rtl_writephy(tp, 0x1f, 0x0004);
         rtl_writephy(tp, 0x1f, 0x0007);
         rtl_writephy(tp, 0x1e, 0x0020);
-        rtl_w1w0_phy(tp, 0x06, 0x0000, 0x0100);
+        rtl_w1w0_phy(tp, 0x15, 0x0000, 0x0100);
         rtl_writephy(tp, 0x1f, 0x0002);
         rtl_writephy(tp, 0x1f, 0x0000);
         rtl_writephy(tp, 0x0d, 0x0007);
@@ -3316,6 +3316,37 @@ static void __devinit rtl_init_mdio_ops(struct rtl8169_private *tp)
         }
 }
 
+static void rtl_wol_suspend_quirk(struct rtl8169_private *tp)
+{
+        void __iomem *ioaddr = tp->mmio_addr;
+
+        switch (tp->mac_version) {
+        case RTL_GIGA_MAC_VER_29:
+        case RTL_GIGA_MAC_VER_30:
+        case RTL_GIGA_MAC_VER_32:
+        case RTL_GIGA_MAC_VER_33:
+        case RTL_GIGA_MAC_VER_34:
+                RTL_W32(RxConfig, RTL_R32(RxConfig) |
+                        AcceptBroadcast | AcceptMulticast | AcceptMyPhys);
+                break;
+        default:
+                break;
+        }
+}
+
+static bool rtl_wol_pll_power_down(struct rtl8169_private *tp)
+{
+        if (!(__rtl8169_get_wol(tp) & WAKE_ANY))
+                return false;
+
+        rtl_writephy(tp, 0x1f, 0x0000);
+        rtl_writephy(tp, MII_BMCR, 0x0000);
+
+        rtl_wol_suspend_quirk(tp);
+
+        return true;
+}
+
 static void r810x_phy_power_down(struct rtl8169_private *tp)
 {
         rtl_writephy(tp, 0x1f, 0x0000);
@@ -3330,18 +3361,8 @@ static void r810x_phy_power_up(struct rtl8169_private *tp)
 
 static void r810x_pll_power_down(struct rtl8169_private *tp)
 {
-        void __iomem *ioaddr = tp->mmio_addr;
-
-        if (__rtl8169_get_wol(tp) & WAKE_ANY) {
-                rtl_writephy(tp, 0x1f, 0x0000);
-                rtl_writephy(tp, MII_BMCR, 0x0000);
-
-                if (tp->mac_version == RTL_GIGA_MAC_VER_29 ||
-                    tp->mac_version == RTL_GIGA_MAC_VER_30)
-                        RTL_W32(RxConfig, RTL_R32(RxConfig) | AcceptBroadcast |
-                                AcceptMulticast | AcceptMyPhys);
+        if (rtl_wol_pll_power_down(tp))
                 return;
-        }
 
         r810x_phy_power_down(tp);
 }
@@ -3430,17 +3451,8 @@ static void r8168_pll_power_down(struct rtl8169_private *tp)
             tp->mac_version == RTL_GIGA_MAC_VER_33)
                 rtl_ephy_write(ioaddr, 0x19, 0xff64);
 
-        if (__rtl8169_get_wol(tp) & WAKE_ANY) {
-                rtl_writephy(tp, 0x1f, 0x0000);
-                rtl_writephy(tp, MII_BMCR, 0x0000);
-
-                if (tp->mac_version == RTL_GIGA_MAC_VER_32 ||
-                    tp->mac_version == RTL_GIGA_MAC_VER_33 ||
-                    tp->mac_version == RTL_GIGA_MAC_VER_34)
-                        RTL_W32(RxConfig, RTL_R32(RxConfig) | AcceptBroadcast |
-                                AcceptMulticast | AcceptMyPhys);
+        if (rtl_wol_pll_power_down(tp))
                 return;
-        }
 
         r8168_phy_power_down(tp);
 
@@ -5788,11 +5800,30 @@ static const struct dev_pm_ops rtl8169_pm_ops = {
 
 #endif /* !CONFIG_PM */
 
+static void rtl_wol_shutdown_quirk(struct rtl8169_private *tp)
+{
+        void __iomem *ioaddr = tp->mmio_addr;
+
+        /* WoL fails with 8168b when the receiver is disabled. */
+        switch (tp->mac_version) {
+        case RTL_GIGA_MAC_VER_11:
+        case RTL_GIGA_MAC_VER_12:
+        case RTL_GIGA_MAC_VER_17:
+                pci_clear_master(tp->pci_dev);
+
+                RTL_W8(ChipCmd, CmdRxEnb);
+                /* PCI commit */
+                RTL_R8(ChipCmd);
+                break;
+        default:
+                break;
+        }
+}
+
 static void rtl_shutdown(struct pci_dev *pdev)
 {
         struct net_device *dev = pci_get_drvdata(pdev);
         struct rtl8169_private *tp = netdev_priv(dev);
-        void __iomem *ioaddr = tp->mmio_addr;
 
         rtl8169_net_suspend(dev);
 
@@ -5806,16 +5837,9 @@ static void rtl_shutdown(struct pci_dev *pdev)
         spin_unlock_irq(&tp->lock);
 
         if (system_state == SYSTEM_POWER_OFF) {
-                /* WoL fails with 8168b when the receiver is disabled. */
-                if ((tp->mac_version == RTL_GIGA_MAC_VER_11 ||
-                     tp->mac_version == RTL_GIGA_MAC_VER_12 ||
-                     tp->mac_version == RTL_GIGA_MAC_VER_17) &&
-                    (tp->features & RTL_FEATURE_WOL)) {
-                        pci_clear_master(pdev);
-
-                        RTL_W8(ChipCmd, CmdRxEnb);
-                        /* PCI commit */
-                        RTL_R8(ChipCmd);
+                if (__rtl8169_get_wol(tp) & WAKE_ANY) {
+                        rtl_wol_suspend_quirk(tp);
+                        rtl_wol_shutdown_quirk(tp);
                 }
 
                 pci_wake_from_d3(pdev, true);
diff --git a/drivers/net/smsc911x.c b/drivers/net/smsc911x.c
index b9016a30cdc5..c90ddb61cc56 100644
--- a/drivers/net/smsc911x.c
+++ b/drivers/net/smsc911x.c
@@ -26,6 +26,7 @@
  *   LAN9215, LAN9216, LAN9217, LAN9218
  *   LAN9210, LAN9211
  *   LAN9220, LAN9221
+ *   LAN89218
  *
  */
 
@@ -1983,6 +1984,7 @@ static int __devinit smsc911x_init(struct net_device *dev)
         case 0x01170000:
         case 0x01160000:
         case 0x01150000:
+        case 0x218A0000:
                 /* LAN911[5678] family */
                 pdata->generation = pdata->idrev & 0x0000FFFF;
                 break;
diff --git a/drivers/net/tg3.c b/drivers/net/tg3.c
index 4a1374df6084..c11a2b8327f3 100644
--- a/drivers/net/tg3.c
+++ b/drivers/net/tg3.c
@@ -15577,7 +15577,7 @@ static void __devexit tg3_remove_one(struct pci_dev *pdev)
 
                 cancel_work_sync(&tp->reset_task);
 
-                if (!tg3_flag(tp, USE_PHYLIB)) {
+                if (tg3_flag(tp, USE_PHYLIB)) {
                         tg3_phy_fini(tp);
                         tg3_mdio_fini(tp);
                 }