8 files changed, 36 insertions, 13 deletions

diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index 96316fd47233..33fbeb664f08 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -3427,7 +3427,7 @@ i915_gem_attach_phys_object(struct drm_device *dev,
                 ret = i915_gem_init_phys_object(dev, id,
                                                 obj->size);
                 if (ret) {
-                        DRM_ERROR("failed to init phys object %d size: %d\n", id, obj->size);
+                        DRM_ERROR("failed to init phys object %d size: %zu\n", id, obj->size);
                         goto out;
                 }
         }
diff --git a/drivers/ide/falconide.c b/drivers/ide/falconide.c
index a5ba820d69bb..a638e952d67a 100644
--- a/drivers/ide/falconide.c
+++ b/drivers/ide/falconide.c
@@ -82,7 +82,7 @@ static const struct ide_tp_ops falconide_tp_ops = {
 
 static const struct ide_port_info falconide_port_info = {
         .tp_ops                 = &falconide_tp_ops,
-        .host_flags             = IDE_HFLAG_NO_DMA,
+        .host_flags             = IDE_HFLAG_NO_DMA | IDE_HFLAG_SERIALIZE,
 };
 
 static void __init falconide_setup_ports(hw_regs_t *hw)
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index 312127ea443a..0db1ed9f5fc2 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -649,7 +649,8 @@ static int ide_register_port(ide_hwif_t *hwif)
         /* register with global device tree */
         dev_set_name(&hwif->gendev, hwif->name);
         hwif->gendev.driver_data = hwif;
-        hwif->gendev.parent = hwif->dev;
+        if (hwif->gendev.parent == NULL)
+                hwif->gendev.parent = hwif->dev;
         hwif->gendev.release = hwif_release_dev;
 
         ret = device_register(&hwif->gendev);
diff --git a/drivers/ide/palm_bk3710.c b/drivers/ide/palm_bk3710.c
index a7ac490c9ae3..f38aac78044c 100644
--- a/drivers/ide/palm_bk3710.c
+++ b/drivers/ide/palm_bk3710.c
@@ -346,7 +346,8 @@ static int __init palm_bk3710_probe(struct platform_device *pdev)
 {
         struct clk *clk;
         struct resource *mem, *irq;
-        unsigned long base, rate;
+        void __iomem *base;
+        unsigned long rate;
         int i, rc;
         hw_regs_t hw, *hws[] = { &hw, NULL, NULL, NULL };
 
@@ -382,11 +383,13 @@ static int __init palm_bk3710_probe(struct platform_device *pdev)
         base = IO_ADDRESS(mem->start);
 
         /* Configure the Palm Chip controller */
-        palm_bk3710_chipinit((void __iomem *)base);
+        palm_bk3710_chipinit(base);
 
         for (i = 0; i < IDE_NR_PORTS - 2; i++)
-                hw.io_ports_array[i] = base + IDE_PALM_ATA_PRI_REG_OFFSET + i;
-        hw.io_ports.ctl_addr = base + IDE_PALM_ATA_PRI_CTL_OFFSET;
+                hw.io_ports_array[i] = (unsigned long)
+                                (base + IDE_PALM_ATA_PRI_REG_OFFSET + i);
+        hw.io_ports.ctl_addr = (unsigned long)
+                        (base + IDE_PALM_ATA_PRI_CTL_OFFSET);
         hw.irq = irq->start;
         hw.dev = &pdev->dev;
         hw.chipset = ide_palm3710;
diff --git a/drivers/oprofile/cpu_buffer.c b/drivers/oprofile/cpu_buffer.c
index 2e03b6d796d3..e76d715e4342 100644
--- a/drivers/oprofile/cpu_buffer.c
+++ b/drivers/oprofile/cpu_buffer.c
@@ -393,16 +393,21 @@ oprofile_write_reserve(struct op_entry *entry, struct pt_regs * const regs,
         return;
 
 fail:
+        entry->event = NULL;
         cpu_buf->sample_lost_overflow++;
 }
 
 int oprofile_add_data(struct op_entry *entry, unsigned long val)
 {
+        if (!entry->event)
+                return 0;
         return op_cpu_buffer_add_data(entry, val);
 }
 
 int oprofile_write_commit(struct op_entry *entry)
 {
+        if (!entry->event)
+                return -EINVAL;
         return op_cpu_buffer_write_commit(entry);
 }
 
diff --git a/drivers/oprofile/cpu_buffer.h b/drivers/oprofile/cpu_buffer.h
index 63f81c44846a..272995d20293 100644
--- a/drivers/oprofile/cpu_buffer.h
+++ b/drivers/oprofile/cpu_buffer.h
@@ -66,6 +66,13 @@ static inline void op_cpu_buffer_reset(int cpu)
         cpu_buf->last_task = NULL;
 }
 
+/*
+ * op_cpu_buffer_add_data() and op_cpu_buffer_write_commit() may be
+ * called only if op_cpu_buffer_write_reserve() did not return NULL or
+ * entry->event != NULL, otherwise entry->size or entry->event will be
+ * used uninitialized.
+ */
+
 struct op_sample
 *op_cpu_buffer_write_reserve(struct op_entry *entry, unsigned long size);
 int op_cpu_buffer_write_commit(struct op_entry *entry);
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index 8dc7109d61b7..2ba8f95516a0 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -298,6 +298,14 @@ static int decrease_reservation(unsigned long nr_pages)
                 frame_list[i] = pfn_to_mfn(pfn);
 
                 scrub_page(page);
+
+                if (!PageHighMem(page)) {
+                        ret = HYPERVISOR_update_va_mapping(
+                                (unsigned long)__va(pfn << PAGE_SHIFT),
+                                __pte_ma(0), 0);
+                        BUG_ON(ret);
+                }
+
         }
 
         /* Ensure that ballooned highmem pages don't have kmaps. */
diff --git a/drivers/xen/xenfs/xenbus.c b/drivers/xen/xenfs/xenbus.c
index 875a4c59c594..a9592d981b10 100644
--- a/drivers/xen/xenfs/xenbus.c
+++ b/drivers/xen/xenfs/xenbus.c
@@ -291,7 +291,7 @@ static void watch_fired(struct xenbus_watch *watch,
 static int xenbus_write_transaction(unsigned msg_type,
                                     struct xenbus_file_priv *u)
 {
-        int rc, ret;
+        int rc;
         void *reply;
         struct xenbus_transaction_holder *trans = NULL;
         LIST_HEAD(staging_q);
@@ -326,15 +326,14 @@ static int xenbus_write_transaction(unsigned msg_type,
         }
 
         mutex_lock(&u->reply_mutex);
-        ret = queue_reply(&staging_q, &u->u.msg, sizeof(u->u.msg));
-        if (!ret)
-                ret = queue_reply(&staging_q, reply, u->u.msg.len);
-        if (!ret) {
+        rc = queue_reply(&staging_q, &u->u.msg, sizeof(u->u.msg));
+        if (!rc)
+                rc = queue_reply(&staging_q, reply, u->u.msg.len);
+        if (!rc) {
                 list_splice_tail(&staging_q, &u->read_buffers);
                 wake_up(&u->read_waitq);
         } else {
                 queue_cleanup(&staging_q);
-                rc = ret;
         }
         mutex_unlock(&u->reply_mutex);