commit acd7c63a7e8c375d1b69e66ee036b6618ad1ff2a
Author: Jiri Slaby <jslaby@suse.cz>
Date:   Mon Apr 27 20:39:36 2015 +0200

    Linux 3.12.41

commit 7f41838fc37fefd89dfcb985d37037e1d4cf0180
Author: Rainer Koenig <Rainer.Koenig@ts.fujitsu.com>
Date:   Tue Jan 27 15:15:11 2015 -0800

    Input: elantech - add more Fujtisu notebooks to force crc_enabled
    
    commit 47c1ffb2b6b630894e9a16442611c056ab21c057 upstream.
    
    Add two more Fujitsu LIFEBOOK models that also ship with the Elantech
    touchpad and don't work with crc_disabled to the quirk list.
    
    Signed-off-by: Rainer Koenig <Rainer.Koenig@ts.fujitsu.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 072321081349db237dc23700224ade2b5e43b805
Author: Ulrik De Bie <ulrik.debie-os@e2big.org>
Date:   Fri Nov 7 23:57:34 2014 -0800

    Input: elantech - fix crc_enabled for Fujitsu H730
    
    commit 0dc1587905a50f8f61bbc29e850aa592821e4bea upstream.
    
    The Fujitsu H730 does not work with crc_enabled = 0, even though the
    crc_enabled bit in the firmware version indicated it would. When switching
    this value to crc_enabled to 1, the touchpad works. This patch uses DMI to
    detect H730.
    
    Reported-by: Stefan Valouch <stefan@valouch.com>
    Tested-by: Stefan Valouch <stefan@valouch.com>
    Tested-by: Alfredo Gemma <alfredo.gemma@gmail.com>
    Signed-off-by: Ulrik De Bie <ulrik.debie-os@e2big.org>
    Acked-by: Hans de Goede <hdegoede@redhat.com>
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 8ead83eacb662ddb22a8e8e91b804a49ea182716
Author: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
Date:   Wed Feb 11 15:27:31 2015 -0800

    proc/pagemap: walk page tables under pte lock
    
    commit 05fbf357d94152171bc50f8a369390f1f16efd89 upstream.
    
    Lockless access to pte in pagemap_pte_range() might race with page
    migration and trigger BUG_ON(!PageLocked()) in migration_entry_to_page():
    
    CPU A (pagemap)                           CPU B (migration)
                                              lock_page()
                                              try_to_unmap(page, TTU_MIGRATION...)
                                                   make_migration_entry()
                                                   set_pte_at()
    <read *pte>
    pte_to_pagemap_entry()
                                              remove_migration_ptes()
                                              unlock_page()
        if(is_migration_entry())
            migration_entry_to_page()
                BUG_ON(!PageLocked(page))
    
    Also lockless read might be non-atomic if pte is larger than wordsize.
    Other pte walkers (smaps, numa_maps, clear_refs) already lock ptes.
    
    Fixes: 052fb0d635df ("proc: report file/anon bit in /proc/pid/pagemap")
    Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
    Reported-by: Andrey Ryabinin <a.ryabinin@samsung.com>
    Reviewed-by: Cyrill Gorcunov <gorcunov@openvz.org>
    Acked-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
    Acked-by: Kirill A. Shutemov <kirill.shutemov@linux.intel.com>
    Cc: <stable@vger.kernel.org>	[3.5+]
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit fdfce812d2c6bd0c1eb6ccd3196fe34b5e293c6b
Author: Peter Feiner <pfeiner@google.com>
Date:   Thu Oct 9 15:28:32 2014 -0700

    mm: softdirty: unmapped addresses between VMAs are clean
    
    commit 81d0fa623c5b8dbd5279d9713094b0f9b0a00fb4 upstream.
    
    If a /proc/pid/pagemap read spans a [VMA, an unmapped region, then a
    VM_SOFTDIRTY VMA], the virtual pages in the unmapped region are reported
    as softdirty.  Here's a program to demonstrate the bug:
    
    int main() {
    	const uint64_t PAGEMAP_SOFTDIRTY = 1ul << 55;
    	uint64_t pme[3];
    	int fd = open("/proc/self/pagemap", O_RDONLY);;
    	char *m = mmap(NULL, 3 * getpagesize(), PROT_READ,
    	               MAP_ANONYMOUS | MAP_SHARED, -1, 0);
    	munmap(m + getpagesize(), getpagesize());
    	pread(fd, pme, 24, (unsigned long) m / getpagesize() * 8);
    	assert(pme[0] & PAGEMAP_SOFTDIRTY);    /* passes */
    	assert(!(pme[1] & PAGEMAP_SOFTDIRTY)); /* fails */
    	assert(pme[2] & PAGEMAP_SOFTDIRTY);    /* passes */
    	return 0;
    }
    
    (Note that all pages in new VMAs are softdirty until cleared).
    
    Tested:
    	Used the program given above. I'm going to include this code in
    	a selftest in the future.
    
    [n-horiguchi@ah.jp.nec.com: prevent pagemap_pte_range() from overrunning]
    Signed-off-by: Peter Feiner <pfeiner@google.com>
    Cc: "Kirill A. Shutemov" <kirill@shutemov.name>
    Cc: Cyrill Gorcunov <gorcunov@openvz.org>
    Cc: Pavel Emelyanov <xemul@parallels.com>
    Cc: Jamie Liu <jamieliu@google.com>
    Cc: Hugh Dickins <hughd@google.com>
    Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
    Signed-off-by: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 4483ef98b020b9d4cdafef95ee84b18eaccea61a
Author: Nadav Amit <namit@cs.technion.ac.il>
Date:   Thu Jan 1 23:11:11 2015 +0200

    KVM: x86: SYSENTER emulation is broken
    
    commit f3747379accba8e95d70cec0eae0582c8c182050 upstream.
    
    SYSENTER emulation is broken in several ways:
    1. It misses the case of 16-bit code segments completely (CVE-2015-0239).
    2. MSR_IA32_SYSENTER_CS is checked in 64-bit mode incorrectly (bits 0 and 1 can
       still be set without causing #GP).
    3. MSR_IA32_SYSENTER_EIP and MSR_IA32_SYSENTER_ESP are not masked in
       legacy-mode.
    4. There is some unneeded code.
    
    Fix it.
    
    Signed-off-by: Nadav Amit <namit@cs.technion.ac.il>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    [zhangzhiqiang: backport to 3.10:
     - adjust context
     - in 3.10 context "ctxt->eflags &= ~(EFLG_VM | EFLG_IF | EFLG_RF)" is replaced by
       "ctxt->eflags &= ~(EFLG_VM | EFLG_IF)" in upstream, which was changed by another commit.
     - After the above adjustments, becomes same to the original patch:
           https://github.com/torvalds/linux/commit/f3747379accba8e95d70cec0eae0582c8c182050
    ]
    Signed-off-by: Zhiqiang Zhang <zhangzhiqiang.zhang@huawei.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 2fb11da9d9016f6c0a4fcb99b8ebd63495c79005
Author: Florian Westphal <fw@strlen.de>
Date:   Fri Sep 26 11:35:42 2014 +0200

    netfilter: conntrack: disable generic tracking for known protocols
    
    commit db29a9508a9246e77087c5531e45b2c88ec6988b upstream.
    
    Given following iptables ruleset:
    
    -P FORWARD DROP
    -A FORWARD -m sctp --dport 9 -j ACCEPT
    -A FORWARD -p tcp --dport 80 -j ACCEPT
    -A FORWARD -p tcp -m conntrack -m state ESTABLISHED,RELATED -j ACCEPT
    
    One would assume that this allows SCTP on port 9 and TCP on port 80.
    Unfortunately, if the SCTP conntrack module is not loaded, this allows
    *all* SCTP communication, to pass though, i.e. -p sctp -j ACCEPT,
    which we think is a security issue.
    
    This is because on the first SCTP packet on port 9, we create a dummy
    "generic l4" conntrack entry without any port information (since
    conntrack doesn't know how to extract this information).
    
    All subsequent packets that are unknown will then be in established
    state since they will fallback to proto_generic and will match the
    'generic' entry.
    
    Our originally proposed version [1] completely disabled generic protocol
    tracking, but Jozsef suggests to not track protocols for which a more
    suitable helper is available, hence we now mitigate the issue for in
    tree known ct protocol helpers only, so that at least NAT and direction
    information will still be preserved for others.
    
     [1] http://www.spinics.net/lists/netfilter-devel/msg33430.html
    
    Joint work with Daniel Borkmann.
    
    Fixes CVE-2014-8160.
    
    Signed-off-by: Florian Westphal <fw@strlen.de>
    Signed-off-by: Daniel Borkmann <dborkman@redhat.com>
    Acked-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
    Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
    Signed-off-by: Zhiqiang Zhang <zhangzhiqiang.zhang@huawei.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit d038b8edf931bbd43583207022d897e9991398d5
Author: Janne Heikkinen <janne.m.heikkinen@gmail.com>
Date:   Tue Dec 9 07:44:51 2014 +0200

    Bluetooth: Add USB device 04ca:3010 as Atheros AR3012
    
    commit 134d3b3550f050b9bec37111824452064d1ed928 upstream.
    
    Asus X553MA has USB device 04ca:3010 that is Atheros AR3012
    or compatible.
    
    Device from /sys/kernel/debug/usb/devices:
    
    T:  Bus=01 Lev=02 Prnt=02 Port=03 Cnt=02 Dev#= 27 Spd=12   MxCh= 0
    D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=04ca ProdID=3010 Rev= 0.02
    C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    A:  FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=01
    I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
    E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
    
    Signed-off-by: Janne Heikkinen <janne.m.heikkinen@gmail.com>
    Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit ea7fcda473588c0962e2f9ab778f4ab8a5eea667
Author: Dmitry Tunin <hanipouspilot@gmail.com>
Date:   Sun Jan 18 00:16:51 2015 +0300

    Bluetooth: ath3k: Add support of AR3012 bluetooth 13d3:3423 device
    
    commit 033efa920a7f22a8caf7a38d851a2f451781bbf7 upstream.
    
    Add support of 13d3:3423 device.
    
    BugLink: https://bugs.launchpad.net/bugs/1411193
    
    T: Bus=01 Lev=02 Prnt=03 Port=00 Cnt=01 Dev#= 5 Spd=12 MxCh= 0
    D: Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
    P: Vendor=13d3 ProdID=3423 Rev= 0.01
    C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    A: FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=01
    I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
    E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
    E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
    I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
    E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
    I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
    E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
    I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
    E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
    I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
    E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
    I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
    E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
    I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
    E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
    
    Signed-off-by: Dmitry Tunin <hanipouspilot@gmail.com>
    Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
    Cc: stable@vger.kernel.org
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit ba80d30068f05567992520888543b0b8d97a31bd
Author: Dmitry Tunin <hanipouspilot@gmail.com>
Date:   Tue Nov 25 20:19:52 2014 +0300

    Bluetooth: ath3k: Add support of MCI 13d3:3408 bt device
    
    commit 3bb30a7cdf9242aca90d49aa41baebf9458f96f0 upstream.
    
    Add support for Bluetooth MCI WB335 (AR9565) Wi-Fi+bt module. This
    Bluetooth module requires loading patch and sysconfig by ath3k driver.
    
    T:  Bus=01 Lev=02 Prnt=03 Port=00 Cnt=01 Dev#= 20 Spd=12   MxCh= 0
    D:  Ver= 1.10 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs=  1
    P:  Vendor=13d3 ProdID=3408 Rev= 0.02
    C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=100mA
    A:  FirstIf#= 0 IfCount= 2 Cls=e0(wlcon) Sub=01 Prot=01
    I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=81(I) Atr=03(Int.) MxPS=  16 Ivl=1ms
    E:  Ad=82(I) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    E:  Ad=02(O) Atr=02(Bulk) MxPS=  64 Ivl=0ms
    I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   0 Ivl=1ms
    I:  If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=   9 Ivl=1ms
    I:  If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  17 Ivl=1ms
    I:  If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  25 Ivl=1ms
    I:  If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  33 Ivl=1ms
    I:  If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
    E:  Ad=83(I) Atr=01(Isoc) MxPS=  49 Ivl=1ms
    E:  Ad=03(O) Atr=01(Isoc) MxPS=  49 Ivl=1ms
    
    Signed-off-by: Dmitry Tunin <hanipouspilot@gmail.com>
    Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit d236e5ed00d0921c57dc7b41cde4227af7e3567d
Author: NeilBrown <neilb@suse.de>
Date:   Fri Nov 7 15:46:56 2014 -0800

    Input: twl4030-pwrbutton - ensure a wakeup event is recorded.
    
    commit c42bfd7f6cd26e8f712fc184460e32845d928d17 upstream.
    
    This button is treated as a wakeup source, so we need to initialise it
    correctly.
    
    Without the device_init_wakeup() call, dev->power.wakeup will
    be NULL, and pm_wakeup_event() will do nothing.
    
    Signed-off-by: NeilBrown <neilb@suse.de>
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 5dce3f12f1c3483ce4732f1f6452fbc31d84b3c5
Author: Bjorn Helgaas <bhelgaas@google.com>
Date:   Fri Jul 18 10:05:38 2014 -0700

    Input: sirfsoc-onkey - fix GPL v2 license string typo
    
    commit 67f4aef20055afec73e37e7752bc6cc74fa01dea upstream.
    
    Per license_is_gpl_compatible(), the MODULE_LICENSE() string for GPL v2 is
    "GPL v2", not "GPLv2".  Use "GPL v2" so this module doesn't taint the
    kernel.
    
    Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
    Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 0f497be83e7e0496e39e4d8bf3fc8315d0b960d2
Author: Igor Mammedov <imammedo@redhat.com>
Date:   Fri Mar 20 12:21:37 2015 +0000

    kvm: avoid page allocation failure in kvm_set_memory_region()
    
    commit 744961341d472db6272ed9b42319a90f5a2aa7c4 upstream.
    
    KVM guest can fail to startup with following trace on host:
    
    qemu-system-x86: page allocation failure: order:4, mode:0x40d0
    Call Trace:
      dump_stack+0x47/0x67
      warn_alloc_failed+0xee/0x150
      __alloc_pages_direct_compact+0x14a/0x150
      __alloc_pages_nodemask+0x776/0xb80
      alloc_kmem_pages+0x3a/0x110
      kmalloc_order+0x13/0x50
      kmemdup+0x1b/0x40
      __kvm_set_memory_region+0x24a/0x9f0 [kvm]
      kvm_set_ioapic+0x130/0x130 [kvm]
      kvm_set_memory_region+0x21/0x40 [kvm]
      kvm_vm_ioctl+0x43f/0x750 [kvm]
    
    Failure happens when attempting to allocate pages for
    'struct kvm_memslots', however it doesn't have to be
    present in physically contiguous (kmalloc-ed) address
    space, change allocation to kvm_kvzalloc() so that
    it will be vmalloc-ed when its size is more then a page.
    
    Signed-off-by: Igor Mammedov <imammedo@redhat.com>
    Signed-off-by: Marcelo Tosatti <mtosatti@redhat.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 4b68cd72580b97730a1676c98217077b98c33f08
Author: Paolo Bonzini <pbonzini@redhat.com>
Date:   Fri Nov 14 10:46:45 2014 +0100

    kvm: commonize allocation of the new memory slots
    
    commit f2a81036516e2b97c07c49dd6d51d36bfa43593d upstream.
    
    The two kmemdup invocations can be unified.  I find that the new
    placement of the comment makes it easier to see what happens.
    
    Reviewed-by: Igor Mammedov <imammedo@redhat.com>
    Reviewed-by: Takuya Yoshikawa <yoshikawa_takuya_b1@lab.ntt.co.jp>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 53cc322aa81ff2cdbc37f9a6c9fefe55c04e5765
Author: Christian Borntraeger <borntraeger@de.ibm.com>
Date:   Thu Sep 4 21:13:33 2014 +0200

    KVM: remove redundant assignments in __kvm_set_memory_region
    
    commit f2a25160887e00434ce1361007009120e1fecbda upstream.
    
    __kvm_set_memory_region sets r to EINVAL very early.
    Doing it again is not necessary. The same is true later on, where
    r is assigned -ENOMEM twice.
    
    Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit fb6a2a8ebe2741cd15d9f4c613c6b40cf0e40ea5
Author: Al Viro <viro@zeniv.linux.org.uk>
Date:   Tue May 6 14:02:53 2014 -0400

    nick kvfree() from apparmor
    
    commit 39f1f78d53b9bcbca91967380c5f0f2305a5c55f upstream.
    
    too many places open-code it
    
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 75f208f5585ea8ccd430521355eb7bc6f7775a73
Author: Martin K. Petersen <martin.petersen@oracle.com>
Date:   Fri Mar 27 15:17:21 2015 -0400

    libata: Blacklist queued TRIM on Samsung SSD 850 Pro
    
    commit 6fc4d97a4987c5d247655a157a9377996626221a upstream.
    
    Blacklist queued TRIM on this drive for now.
    
    Reported-by: Stefan Keller <linux-list@zahlenfresser.de>
    Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
    CC: stable@vger.kernel.org
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit e4c218429fb3752cabf96724d60cbeba85e35eb2
Author: Ethan Zhao <ethan.zhao@oracle.com>
Date:   Thu Dec 18 15:28:19 2014 +0900

    cpufreq: fix a NULL pointer dereference in __cpufreq_governor()
    
    commit cb57720bf79688d64854a0a43565aa52303c1f3f upstream.
    
    If ACPI _PPC changed notification happens before governor was initiated
    while kernel is booting, a NULL pointer dereference will be triggered:
    
    BUG: unable to handle kernel NULL pointer dereference at 0000000000000030
     IP: [<ffffffff81470453>] __cpufreq_governor+0x23/0x1e0
     PGD 0
     Oops: 0000 [#1] SMP
     ... ...
     RIP: 0010:[<ffffffff81470453>]  [<ffffffff81470453>]
     __cpufreq_governor+0x23/0x1e0
     RSP: 0018:ffff881fcfbcfbb8  EFLAGS: 00010286
     RAX: 0000000000000000 RBX: ffff881fd11b3980 RCX: ffff88407fc20000
     RDX: 0000000000000000 RSI: 0000000000000000 RDI: ffff881fd11b3980
     RBP: ffff881fcfbcfbd8 R08: 0000000000000000 R09: 000000000000000f
     R10: ffffffff818068d0 R11: 0000000000000043 R12: 0000000000000004
     R13: 0000000000000000 R14: ffffffff8196cae0 R15: 0000000000000000
     FS:  0000000000000000(0000) GS:ffff881fffc00000(0000) knlGS:0000000000000000
     CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
     CR2: 0000000000000030 CR3: 00000000018ae000 CR4: 00000000000407f0
     DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
     DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
     Process kworker/0:3 (pid: 750, threadinfo ffff881fcfbce000, task
     ffff881fcf556400)
     Stack:
      ffff881fffc17d00 ffff881fcfbcfc18 ffff881fd11b3980 0000000000000000
      ffff881fcfbcfc08 ffffffff81470d08 ffff881fd11b3980 0000000000000007
      ffff881fcfbcfc18 ffff881fffc17d00 ffff881fcfbcfd28 ffffffff81472e9a
     Call Trace:
      [<ffffffff81470d08>] __cpufreq_set_policy+0x1b8/0x2e0
      [<ffffffff81472e9a>] cpufreq_update_policy+0xca/0x150
      [<ffffffff81472f20>] ? cpufreq_update_policy+0x150/0x150
      [<ffffffff81324a96>] acpi_processor_ppc_has_changed+0x71/0x7b
      [<ffffffff81320bcd>] acpi_processor_notify+0x55/0x115
      [<ffffffff812f9c29>] acpi_device_notify+0x19/0x1b
      [<ffffffff813084ca>] acpi_ev_notify_dispatch+0x41/0x5f
      [<ffffffff812f64a4>] acpi_os_execute_deferred+0x27/0x34
    
    The root cause is a race conditon -- cpufreq core and acpi-cpufreq driver
    were initiated, but cpufreq_governor wasn't and _PPC changed notification
    happened, __cpufreq_governor() was called within acpi_os_execute_deferred
    kernel thread context.
    
    To fix this panic issue, add pointer checking code in __cpufreq_governor()
    before pointer policy->governor is to be dereferenced.
    
    Signed-off-by: Ethan Zhao <ethan.zhao@oracle.com>
    Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
    Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 59e55dbbf2686e394c5549984eab01862ef3a239
Author: Seth Jennings <sjenning@redhat.com>
Date:   Fri Sep 5 14:28:47 2014 -0500

    sb_edac: avoid INTERNAL ERROR message in EDAC with unspecified channel
    
    commit 351fc4a99d49fde63fe5ab7412beb35c40d27269 upstream.
    
    Intel IA32 SDM Table 15-14 defines channel 0xf as 'not specified', but
    EDAC doesn't know about this and returns and INTERNAL ERROR when the
    channel is greater than NUM_CHANNELS:
    
    kernel: [ 1538.886456] CPU 0: Machine Check Exception: 0 Bank 1: 940000000000009f
    kernel: [ 1538.886669] TSC 2bc68b22e7e812 ADDR 46dae7000 MISC 0 PROCESSOR 0:306e4 TIME 1390414572 SOCKET 0 APIC 0
    kernel: [ 1538.971948] EDAC MC1: INTERNAL ERROR: channel value is out of range (15 >= 4)
    kernel: [ 1538.972203] EDAC MC1: 0 CE memory read error on unknown memory (slot:0 page:0x46dae7 offset:0x0 grain:0 syndrome:0x0 -  area:DRAM err_code:0000:009f socket:1 channel_mask:1 rank:0)
    
    This commit changes sb_edac to forward a channel of -1 to EDAC if the
    channel is not specified.  edac_mc_handle_error() sets the channel to -1
    internally after the error message anyway, so this commit should have no
    effect other than avoiding the INTERNAL ERROR message when the channel
    is not specified.
    
    Signed-off-by: Seth Jennings <sjenning@redhat.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 0fd2dc596b4cbfe1cafc157c2b4ea30dbb95bece
Author: Jim Snow <jim.m.snow@intel.com>
Date:   Tue Nov 18 14:51:09 2014 +0100

    sb_edac: Fix erroneous bytes->gigabytes conversion
    
    commit 8c009100295597f23978c224aec5751a365bc965 upstream.
    
    Signed-off-by: Jim Snow <jim.snow@intel.com>
    Signed-off-by: Lukasz Anaczkowski <lukasz.anaczkowski@intel.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 764dcf7b83098c83fd366eade51a59d1f54ce589
Author: Lennart Sorensen <lsorense@csclub.uwaterloo.ca>
Date:   Tue Apr 21 12:31:13 2015 -0400

    crypto: testmgr - fix 3.12.40 regression
    
    commit ace3fc1e3f3a85ec705805146247231b11e1babe in 3.12.40 missed two
    lines while pulling in commit 8a45ac12ec5b6ee67f8559c78ae11d9af8b821ee
    from upstream.  This causes the tests to fail in some cases.
    
    With the two missing lines added in, the tests pass again.
    
    Tested with omap-aes, omap-sham and talitos.
    
    Signed-off-by: Len Sorensen <lsorense@csclub.uwaterloo.ca>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit ca88808c9e3af223f4665a14166e6cf863831864
Author: Eric W. Biederman <ebiederm@xmission.com>
Date:   Tue Mar 11 14:19:50 2014 -0700

    benet: Call dev_kfree_skby_any instead of kfree_skb.
    
    commit d8ec2c02caa3515f35d6c33eedf529394c419298 upstream.
    
    Replace free_skb with dev_kfree_skb_any in be_tx_compl_process as
    which can be called in hard irq by netpoll, softirq context
    by normal napi polling, and in normal sleepable context
    by the network device close method.
    
    Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 09dacf0ddaecb8407de04971a4ce285eeb0846bc
Author: Eric W. Biederman <ebiederm@xmission.com>
Date:   Tue Mar 11 14:18:42 2014 -0700

    ixgb: Call dev_kfree_skby_any instead of dev_kfree_skb.
    
    commit f7e79913a1d6a6139211ead3b03579b317d25a1f upstream.
    
    Replace dev_kfree_skb with dev_kfree_skb_any in functions that can
    be called in hard irq and other contexts.
    
    Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit d352f46df355894bdc76cd3a4049deee802a1aba
Author: Eric W. Biederman <ebiederm@xmission.com>
Date:   Tue Mar 11 14:18:14 2014 -0700

    tg3: Call dev_kfree_skby_any instead of dev_kfree_skb.
    
    commit 497a27b9e1bcf6dbaea7a466cfcd866927e1b431 upstream.
    
    Replace dev_kfree_skb with dev_kfree_skb_any in functions that can
    be called in hard irq and other contexts.
    
    Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 3e8225c1b1be80f776306a9373e2e40237c7ef3a
Author: Eric W. Biederman <ebiederm@xmission.com>
Date:   Tue Mar 11 14:17:41 2014 -0700

    bnx2: Call dev_kfree_skby_any instead of dev_kfree_skb.
    
    commit f458b2ee93ee3606c83f76213fbe49e026bac754 upstream.
    
    Replace dev_kfree_skb with dev_kfree_skb_any in functions that can
    be called in hard irq and other contexts.
    
    Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 7bdd0c4713725faa303be905741b71ae919b10e3
Author: Eric W. Biederman <ebiederm@xmission.com>
Date:   Tue Mar 11 14:16:58 2014 -0700

    bonding: Call dev_kfree_skby_any instead of kfree_skb.
    
    commit 2bb77ab42a6a40162a367b80394b96bb756ad5f1 upstream.
    
    Replace kfree_skb with dev_kfree_skb_any in functions that can
    be called in hard irq and other contexts.
    
    Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 939393d35352e30eae6ac3480733f5924eecf648
Author: Eric W. Biederman <ebiederm@xmission.com>
Date:   Tue Mar 11 14:16:14 2014 -0700

    r8169: Call dev_kfree_skby_any instead of dev_kfree_skb.
    
    commit 989c9ba104d9ce53c1ca918262f3fdfb33aca12a upstream.
    
    Replace dev_kfree_skb with dev_kfree_skb_any in functions that can
    be called in hard irq and other contexts.
    
    Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 2cbe2be162e6c964ae2a75adb74488d105f47998
Author: Eric W. Biederman <ebiederm@xmission.com>
Date:   Tue Mar 11 14:15:36 2014 -0700

    8139too: Call dev_kfree_skby_any instead of dev_kfree_skb.
    
    commit a2ccd2e4bd70122523a7bf21cec4dd6e34427089 upstream.
    
    Replace dev_kfree_skb with dev_kfree_skb_any in functions that can
    be called in hard irq and other contexts.
    
    Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 9e79d937532bef40ba091309948c50f64ec4a2a0
Author: Eric W. Biederman <ebiederm@xmission.com>
Date:   Tue Mar 11 14:14:58 2014 -0700

    8139cp: Call dev_kfree_skby_any instead of kfree_skb.
    
    commit 508f81d517ed1f3f0197df63ea7ab5cd91b6f3b3 upstream.
    
    Replace kfree_skb with dev_kfree_skb_any in cp_start_xmit
    as it can be called in both hard irq and other contexts.
    
    Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit e9cd7c29500abf8ecd6de85100f54430e4a46f1d
Author: Eric Dumazet <edumazet@google.com>
Date:   Thu Apr 9 13:31:56 2015 -0700

    tcp: tcp_make_synack() should clear skb->tstamp
    
    [ Upstream commit b50edd7812852d989f2ef09dcfc729690f54a42d ]
    
    I noticed tcpdump was giving funky timestamps for locally
    generated SYNACK messages on loopback interface.
    
    11:42:46.938990 IP 127.0.0.1.48245 > 127.0.0.2.23850: S
    945476042:945476042(0) win 43690 <mss 65495,nop,nop,sackOK,nop,wscale 7>
    
    20:28:58.502209 IP 127.0.0.2.23850 > 127.0.0.1.48245: S
    3160535375:3160535375(0) ack 945476043 win 43690 <mss
    65495,nop,nop,sackOK,nop,wscale 7>
    
    This is because we need to clear skb->tstamp before
    entering lower stack, otherwise net_timestamp_check()
    does not set skb->tstamp.
    
    Fixes: 7faee5c0d514 ("tcp: remove TCP_SKB_CB(skb)->when")
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit d170fbc221539c90d48fa4163f141ad948fb6c2c
Author: Neal Cardwell <ncardwell@google.com>
Date:   Wed Apr 1 20:26:46 2015 -0400

    tcp: fix FRTO undo on cumulative ACK of SACKed range
    
    [ Upstream commit 666b805150efd62f05810ff0db08f44a2370c937 ]
    
    On processing cumulative ACKs, the FRTO code was not checking the
    SACKed bit, meaning that there could be a spurious FRTO undo on a
    cumulative ACK of a previously SACKed skb.
    
    The FRTO code should only consider a cumulative ACK to indicate that
    an original/unretransmitted skb is newly ACKed if the skb was not yet
    SACKed.
    
    The effect of the spurious FRTO undo would typically be to make the
    connection think that all previously-sent packets were in flight when
    they really weren't, leading to a stall and an RTO.
    
    Signed-off-by: Neal Cardwell <ncardwell@google.com>
    Signed-off-by: Yuchung Cheng <ycheng@google.com>
    Fixes: e33099f96d99c ("tcp: implement RFC5682 F-RTO")
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit ac12ff18b11259e10c2d543aa58c73ff88a68e77
Author: D.S. Ljungmark <ljungmark@modio.se>
Date:   Wed Mar 25 09:28:15 2015 +0100

    ipv6: Don't reduce hop limit for an interface
    
    [ Upstream commit 6fd99094de2b83d1d4c8457f2c83483b2828e75a ]
    
    A local route may have a lower hop_limit set than global routes do.
    
    RFC 3756, Section 4.2.7, "Parameter Spoofing"
    
    >   1.  The attacker includes a Current Hop Limit of one or another small
    >       number which the attacker knows will cause legitimate packets to
    >       be dropped before they reach their destination.
    
    >   As an example, one possible approach to mitigate this threat is to
    >   ignore very small hop limits.  The nodes could implement a
    >   configurable minimum hop limit, and ignore attempts to set it below
    >   said limit.
    
    Signed-off-by: D.S. Ljungmark <ljungmark@modio.se>
    Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 83df7c74b178e4835d0541745fd251fef4670aec
Author: Michal Kubeček <mkubecek@suse.cz>
Date:   Mon Mar 23 15:14:00 2015 +0100

    tcp: prevent fetching dst twice in early demux code
    
    [ Upstream commit d0c294c53a771ae7e84506dfbd8c18c30f078735 ]
    
    On s390x, gcc 4.8 compiles this part of tcp_v6_early_demux()
    
            struct dst_entry *dst = sk->sk_rx_dst;
    
            if (dst)
                    dst = dst_check(dst, inet6_sk(sk)->rx_dst_cookie);
    
    to code reading sk->sk_rx_dst twice, once for the test and once for
    the argument of ip6_dst_check() (dst_check() is inline). This allows
    ip6_dst_check() to be called with null first argument, causing a crash.
    
    Protect sk->sk_rx_dst access by ACCESS_ONCE() both in IPv4 and IPv6
    TCP early demux code.
    
    Fixes: 41063e9dd119 ("ipv4: Early TCP socket demux.")
    Fixes: c7109986db3c ("ipv6: Early TCP socket demux")
    Signed-off-by: Michal Kubecek <mkubecek@suse.cz>
    Acked-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 1d458a6ccc6c610cc8ae46a96c20fc0b9cdce4e2
Author: Mark Brown <broonie@linaro.org>
Date:   Tue Dec 17 23:37:01 2013 +0000

    video: vgacon: Don't build on arm64
    
    commit ee23794b86689e655cedd616e98c03bc3c74f5ec upstream.
    
    arm64 is unlikely to have a VGA console and does not export screen_info
    causing build failures if the driver is build, for example in all*config.
    Add a dependency on !ARM64 to prevent this.
    
    This list is getting quite long, it may be easier to depend on a symbol
    which architectures that do support the driver can select.
    
    Signed-off-by: Mark Brown <broonie@linaro.org>
    [tomi.valkeinen@ti.com: moved && to first modified line]
    Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
    
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 147ff1a3401cc7060ee047d102df04c4e64d73b6
Author: Chen Gang <gang.chen@asianux.com>
Date:   Sun Sep 22 23:20:48 2013 -0300

    [media] drivers: media: usb: b2c2: use usb_*_coherent() instead of pci_*_consistent() in flexcop-usb.c
    
    commit 6c7e346974ad6d20898026f209581fb6dd8ce3f0 upstream.
    
    Some architectures do not support PCI, but still support USB, so need
    let our usb driver try to use usb_* instead of pci_* to support these
    architectures, or can not pass compiling.
    The related error (with allmodconfig for arc):
        CC [M]  drivers/media/usb/b2c2/flexcop-usb.o
      drivers/media/usb/b2c2/flexcop-usb.c: In function ‘flexcop_usb_transfer_exit’:
      drivers/media/usb/b2c2/flexcop-usb.c:393: error: implicit declaration of function ‘pci_free_consistent’
      drivers/media/usb/b2c2/flexcop-usb.c: In function ‘flexcop_usb_transfer_init’:
      drivers/media/usb/b2c2/flexcop-usb.c:410: error: implicit declaration of function ‘pci_alloc_consistent’
    
    Signed-off-by: Chen Gang <gang.chen@asianux.com>
    Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit c2b885aeb3b33fefd9ff2b46b5156cc65b7dbbe7
Author: Majd Dibbiny <majd@mellanox.com>
Date:   Wed Mar 18 16:51:37 2015 +0200

    IB/mlx4: Saturate RoCE port PMA counters in case of overflow
    
    commit 61a3855bb726cbb062ef02a31a832dea455456e0 upstream.
    
    For RoCE ports, we set the u32 PMA values based on u64 HCA counters. In case of
    overflow, according to the IB spec, we have to saturate a counter to its
    max value, do that.
    
    Fixes: c37791349cc7 ('IB/mlx4: Support PMA counters for IBoE')
    Signed-off-by: Majd Dibbiny <majd@mellanox.com>
    Signed-off-by: Eran Ben Elisha <eranbe@mellanox.com>
    Signed-off-by: Hadar Hen Zion <hadarh@mellanox.com>
    Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 553dd569ff29bc38cebbf9f9dd7c791863ee9113
Author: Sasha Levin <sasha.levin@oracle.com>
Date:   Fri Jan 23 20:47:00 2015 -0500

    net: llc: use correct size for sysctl timeout entries
    
    commit 6b8d9117ccb4f81b1244aafa7bc70ef8fa45fc49 upstream.
    
    The timeout entries are sizeof(int) rather than sizeof(long), which
    means that when they were getting read we'd also leak kernel memory
    to userspace along with the timeout values.
    
    Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit b4482b533bfb54232f31d72c8ab70c1400385040
Author: Sasha Levin <sasha.levin@oracle.com>
Date:   Tue Feb 3 08:55:58 2015 -0500

    net: rds: use correct size for max unacked packets and bytes
    
    commit db27ebb111e9f69efece08e4cb6a34ff980f8896 upstream.
    
    Max unacked packets/bytes is an int while sizeof(long) was used in the
    sysctl table.
    
    This means that when they were getting read we'd also leak kernel memory
    to userspace along with the timeout values.
    
    Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 95ed43f190b8894b4681ed78c0272f9d87015a69
Author: Marek Szyprowski <m.szyprowski@samsung.com>
Date:   Wed Mar 4 05:55:21 2015 -0800

    media: s5p-mfc: fix mmap support for 64bit arch
    
    commit 05b676ab42f624425d5f6519276e506b812fa058 upstream.
    
    TASK_SIZE is depends on the systems architecture (32 or 64 bits) and it
    should not be used for defining offset boundary for mmaping buffers for
    CAPTURE and OUTPUT queues. This patch fixes support for MMAP calls on
    the CAPTURE queue on 64bit architectures (like ARM64).
    
    Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
    Signed-off-by: Kamil Debski <k.debski@samsung.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 145fc8e8592d963fffae195e54989d396c225057
Author: Hans Verkuil <hverkuil@xs4all.nl>
Date:   Wed Dec 10 12:35:34 2014 -0300

    sh_veu: v4l2_dev wasn't set
    
    commit ab3120300be067a2d41a027c41db0b2c662ab200 upstream.
    
    The v4l2_dev field of struct video_device must be set correctly.
    This was never done for this driver, so no video nodes were created
    anymore.
    
    Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit e0e2e64bfcd2974dbaab7d3e4bdbf15cd9b0d107
Author: Mike Christie <michaelc@cs.wisc.edu>
Date:   Fri Apr 10 02:47:27 2015 -0500

    iscsi target: fix oops when adding reject pdu
    
    commit b815fc12d4dd2b5586184fb4f867caff05a810d4 upstream.
    
    This fixes a oops due to a double list add when adding a reject PDU for
    iscsit_allocate_iovecs allocation failures. The cmd has already been
    added to the conn_cmd_list in iscsit_setup_scsi_cmd, so this has us call
    iscsit_reject_cmd.
    
    Note that for ERL0 the reject PDU is not actually sent, so this patch
    is not completely tested. Just verified we do not oops. The problem is the
    add reject functions return -1 which is returned all the way up to
    iscsi_target_rx_thread which for ERL0 will drop the connection.
    
    Signed-off-by: Mike Christie <michaelc@cs.wisc.edu>
    Signed-off-by: Nicholas Bellinger <nab@linux-iscsi.org>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit f93249794846f36c887803570f524968568c76ee
Author: Al Viro <viro@zeniv.linux.org.uk>
Date:   Mon Apr 6 17:57:44 2015 -0400

    ioctx_alloc(): fix vma (and file) leak on failure
    
    commit deeb8525f9bcea60f5e86521880c1161de7a5829 upstream.
    
    If we fail past the aio_setup_ring(), we need to destroy the
    mapping.  We don't need to care about anybody having found ctx,
    or added requests to it, since the last failure exit is exactly
    the failure to make ctx visible to lookups.
    
    Reproducer (based on one by Joe Mario <jmario@redhat.com>):
    
    void count(char *p)
    {
    	char s[80];
    	printf("%s: ", p);
    	fflush(stdout);
    	sprintf(s, "/bin/cat /proc/%d/maps|/bin/fgrep -c '/[aio] (deleted)'", getpid());
    	system(s);
    }
    
    int main()
    {
    	io_context_t *ctx;
    	int created, limit, i, destroyed;
    	FILE *f;
    
    	count("before");
    	if ((f = fopen("/proc/sys/fs/aio-max-nr", "r")) == NULL)
    		perror("opening aio-max-nr");
    	else if (fscanf(f, "%d", &limit) != 1)
    		fprintf(stderr, "can't parse aio-max-nr\n");
    	else if ((ctx = calloc(limit, sizeof(io_context_t))) == NULL)
    		perror("allocating aio_context_t array");
    	else {
    		for (i = 0, created = 0; i < limit; i++) {
    			if (io_setup(1000, ctx + created) == 0)
    				created++;
    		}
    		for (i = 0, destroyed = 0; i < created; i++)
    			if (io_destroy(ctx[i]) == 0)
    				destroyed++;
    		printf("created %d, failed %d, destroyed %d\n",
    			created, limit - created, destroyed);
    		count("after");
    	}
    }
    
    Found-by: Joe Mario <jmario@redhat.com>
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 6b71b6af84eb77a0466a57b8ae617f0fdfc4c21f
Author: Al Viro <viro@zeniv.linux.org.uk>
Date:   Wed Apr 8 17:00:32 2015 -0400

    ocfs2: _really_ sync the right range
    
    commit 64b4e2526d1cf6e6a4db6213d6e2b6e6ab59479a upstream.
    
    "ocfs2 syncs the wrong range" had been broken; prior to it the
    code was doing the wrong thing in case of O_APPEND, all right,
    but _after_ it we were syncing the wrong range in 100% cases.
    *ppos, aka iocb->ki_pos is incremented prior to that point,
    so we are always doing sync on the area _after_ the one we'd
    written to.
    
    Spotted by Joseph Qi <joseph.qi@huawei.com> back in January;
    unfortunately, I'd missed his mail back then ;-/
    
    Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit b76a04136cc3403dfa844773e56b5d575ffa4841
Author: John Soni Jose <sony.john-n@emulex.com>
Date:   Thu Feb 12 06:45:47 2015 +0530

    be2iscsi: Fix kernel panic when device initialization fails
    
    commit 2e7cee027b26cbe7e6685a7a14bd2850bfe55d33 upstream.
    
    Kernel panic was happening as iscsi_host_remove() was called on
    a host which was not yet added.
    
    Signed-off-by: John Soni Jose <sony.john-n@emulex.com>
    Reviewed-by: Mike Christie <michaelc@cs.wisc.edu>
    Signed-off-by: James Bottomley <JBottomley@Odin.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 175bf82c7ffccba4f5bde967f810a59382d4b75b
Author: David Disseldorp <ddiss@suse.de>
Date:   Fri Mar 13 14:20:29 2015 +0100

    cifs: fix use-after-free bug in find_writable_file
    
    commit e1e9bda22d7ddf88515e8fe401887e313922823e upstream.
    
    Under intermittent network outages, find_writable_file() is susceptible
    to the following race condition, which results in a user-after-free in
    the cifs_writepages code-path:
    
    Thread 1                                        Thread 2
    ========                                        ========
    
    inv_file = NULL
    refind = 0
    spin_lock(&cifs_file_list_lock)
    
    // invalidHandle found on openFileList
    
    inv_file = open_file
    // inv_file->count currently 1
    
    cifsFileInfo_get(inv_file)
    // inv_file->count = 2
    
    spin_unlock(&cifs_file_list_lock);
    
    cifs_reopen_file()                            cifs_close()
    // fails (rc != 0)                            ->cifsFileInfo_put()
                                           spin_lock(&cifs_file_list_lock)
                                           // inv_file->count = 1
                                           spin_unlock(&cifs_file_list_lock)
    
    spin_lock(&cifs_file_list_lock);
    list_move_tail(&inv_file->flist,
          &cifs_inode->openFileList);
    spin_unlock(&cifs_file_list_lock);
    
    cifsFileInfo_put(inv_file);
    ->spin_lock(&cifs_file_list_lock)
    
      // inv_file->count = 0
      list_del(&cifs_file->flist);
      // cleanup!!
      kfree(cifs_file);
    
      spin_unlock(&cifs_file_list_lock);
    
    spin_lock(&cifs_file_list_lock);
    ++refind;
    // refind = 1
    goto refind_writable;
    
    At this point we loop back through with an invalid inv_file pointer
    and a refind value of 1. On second pass, inv_file is not overwritten on
    openFileList traversal, and is subsequently dereferenced.
    
    Signed-off-by: David Disseldorp <ddiss@suse.de>
    Reviewed-by: Jeff Layton <jlayton@samba.org>
    Signed-off-by: Steve French <smfrench@gmail.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit ac02633dfae27c01b74a47f03dfa2a4a372f3f69
Author: Peter Hurley <peter@hurleysoftware.com>
Date:   Fri Jan 16 15:05:39 2015 -0500

    n_tty: Fix read buffer overwrite when no newline
    
    commit fb5ef9e7da39968fec6d6f37f20a23d23740c75e upstream.
    
    In canon mode, the read buffer head will advance over the buffer tail
    if the input > 4095 bytes without receiving a line termination char.
    
    Discard additional input until a line termination is received.
    Before evaluating for overflow, the 'room' value is normalized for
    I_PARMRK and 1 byte is reserved for line termination (even in !icanon
    mode, in case the mode is switched). The following table shows the
    transform:
    
     actual buffer |  'room' value before overflow calc
      space avail  |    !I_PARMRK    |    I_PARMRK
     --------------------------------------------------
          0        |       -1        |       -1
          1        |        0        |        0
          2        |        1        |        0
          3        |        2        |        0
          4+       |        3        |        1
    
    When !icanon or when icanon and the read buffer contains newlines,
    normalized 'room' values of -1 and 0 are clamped to 0, and
    'overflow' is 0, so read_head is not adjusted and the input i/o loop
    exits (setting no_room if called from flush_to_ldisc()). No input
    is discarded since the reader does have input available to read
    which ensures forward progress.
    
    When icanon and the read buffer does not contain newlines and the
    normalized 'room' value is 0, then overflow and room are reset to 1,
    so that the i/o loop will process the next input char normally
    (except for parity errors which are ignored). Thus, erasures, signalling
    chars, 7-bit mode, etc. will continue to be handled properly.
    
    If the input char processed was not a line termination char, then
    the canon_head index will not have advanced, so the normalized 'room'
    value will now be -1 and 'overflow' will be set, which indicates the
    read_head can safely be reset, effectively erasing the last char
    processed.
    
    If the input char processed was a line termination, then the
    canon_head index will have advanced, so 'overflow' is cleared to 0,
    the read_head is not reset, and 'room' is cleared to 0, which exits
    the i/o loop (because the reader now have input available to read
    which ensures forward progress).
    
    Note that it is possible for a line termination to be received, and
    for the reader to copy the line to the user buffer before the
    input i/o loop is ready to process the next input char. This is
    why the i/o loop recomputes the room/overflow state with every
    input char while handling overflow.
    
    Finally, if the input data was processed without receiving
    a line termination (so that overflow is still set), the pty
    driver must receive a write wakeup. A pty writer may be waiting
    to write more data in n_tty_write() but without unthrottling
    here that wakeup will not arrive, and forward progress will halt.
    (Normally, the pty writer is woken when the reader reads data out
    of the buffer and more space become available).
    
    Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>
    (backported from commit fb5ef9e7da39968fec6d6f37f20a23d23740c75e)
    Signed-off-by: Joseph Salisbury <joseph.salisbury@canonical.com>

commit dabdec3b92b1da15cf89f6140d33c6e7744c1c94
Author: Stefan Agner <stefan@agner.ch>
Date:   Fri Mar 13 14:51:51 2015 +0100

    tty: serial: fsl_lpuart: clear receive flag on FIFO flush
    
    commit 8e4934c6d6c659e22b1b746af4196683e77ce6ca upstream.
    
    When the receiver was enabled during startup, a character could
    have been in the FIFO when the UART get initially used. The
    driver configures the (receive) watermark level, and flushes the
    FIFO. However, the receive flag (RDRF) could still be set at that
    stage (as mentioned in the register description of UARTx_RWFIFO).
    This leads to an interrupt which won't be handled properly in
    interrupt mode: The receive interrupt function lpuart_rxint checks
    the FIFO count, which is 0 at that point (due to the flush
    during initialization). The problem does not manifest when using
    DMA to receive characters.
    
    Fix this situation by explicitly read the status register, which
    leads to clearing of the RDRF flag. Due to the flush just after
    the status flag read, a explicit data read is not to required.
    
    Signed-off-by: Stefan Agner <stefan@agner.ch>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 0bd2650374e49b61e9cac8e22ae6ee3ed847b355
Author: Lu Baolu <baolu.lu@linux.intel.com>
Date:   Mon Mar 23 18:27:42 2015 +0200

    usb: xhci: apply XHCI_AVOID_BEI quirk to all Intel xHCI controllers
    
    commit 227a4fd801c8a9fa2c4700ab98ec1aec06e3b44d upstream.
    
    When a device with an isochronous endpoint is plugged into the Intel
    xHCI host controller, and the driver submits multiple frames per URB,
    the xHCI driver will set the Block Event Interrupt (BEI) flag on all
    but the last TD for the URB. This causes the host controller to place
    an event on the event ring, but not send an interrupt. When the last
    TD for the URB completes, BEI is cleared, and we get an interrupt for
    the whole URB.
    
    However, under Intel xHCI host controllers, if the event ring is full
    of events from transfers with BEI set,  an "Event Ring is Full" event
    will be posted to the last entry of the event ring,  but no interrupt
    is generated. Host will cease all transfer and command executions and
    wait until software completes handling the pending events in the event
    ring.  That means xHC stops, but event of "event ring is full" is not
    notified. As the result, the xHC looks like dead to user.
    
    This patch is to apply XHCI_AVOID_BEI quirk to Intel xHC devices. And
    it should be backported to kernels as old as 3.0, that contains the
    commit 69e848c2090a ("Intel xhci: Support EHCI/xHCI port switching.").
    
    Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
    Tested-by: Alistair Grant <akgrant0710@gmail.com>
    Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 55d572b94414646ebcd04840f28a8681fe50059e
Author: Lu Baolu <baolu.lu@linux.intel.com>
Date:   Mon Mar 23 18:27:41 2015 +0200

    usb: xhci: handle Config Error Change (CEC) in xhci driver
    
    commit 9425183d177aa4a2f09d01a74925124f0778b595 upstream.
    
    Linux xHCI driver doesn't report and handle port cofig error change.
    If Port Configure Error for root hub port occurs, CEC bit in PORTSC
    would be set by xHC and remains 1. This happends when the root port
    fails to configure its link partner, e.g. the port fails to exchange
    port capabilities information using Port Capability LMPs.
    
    Then the Port Status Change Events will be blocked until all status
    change bits(CEC is one of the change bits) are cleared('0') (refer to
    xHCI spec 4.19.2). Otherwise, the port status change event for this
    root port will not be generated anymore, then root port would look
    like dead for user and can't be recovered until a Host Controller
    Reset(HCRST).
    
    This patch is to check CEC bit in PORTSC in xhci_get_port_status()
    and set a Config Error in the return status if CEC is set. This will
    cause a ClearPortFeature request, where CEC bit is cleared in
    xhci_clear_port_change_bit().
    
    [The commit log is based on initial Marvell patch posted at
    http://marc.info/?l=linux-kernel&m=142323612321434&w=2]
    
    Reported-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
    Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
    Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit a261251a900fb771ff427834a71c481e22d219a6
Author: Andreas Werner <kernel@andy89.org>
Date:   Sun Mar 22 17:35:52 2015 +0100

    can: flexcan: Deferred on Regulator return EPROBE_DEFER
    
    commit 555828ef45f825d6ee06559f0304163550eed380 upstream.
    
    Return EPROBE_DEFER if Regulator returns EPROBE_DEFER
    
    If the Flexcan driver is built into kernel and a regulator is used to
    enable the CAN transceiver, the Flexcan driver may not use the regulator.
    
    When initializing the Flexcan device with a regulator defined in the device
    tree, but not initialized, the regulator subsystem returns EPROBE_DEFER, hence
    the Flexcan init fails.
    
    The solution for this is to return EPROBE_DEFER if regulator is not initialized
    and wait until the regulator is initialized.
    
    Signed-off-by: Andreas Werner <kernel@andy89.org>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit fb2f660d6cf94ca97bcbe712e324d6e6e2605bca
Author: Stefan Lippers-Hollmann <s.l-h@gmx.de>
Date:   Mon Mar 30 22:44:27 2015 +0200

    x86/reboot: Add ASRock Q1900DC-ITX mainboard reboot quirk
    
    commit 80313b3078fcd2ca51970880d90757f05879a193 upstream.
    
    The ASRock Q1900DC-ITX mainboard (Baytrail-D) hangs randomly in
    both BIOS and UEFI mode while rebooting unless reboot=pci is
    used. Add a quirk to reboot via the pci method.
    
    The problem is very intermittent and hard to debug, it might succeed
    rebooting just fine 40 times in a row - but fails half a dozen times
    the next day. It seems to be slightly less common in BIOS CSM mode
    than native UEFI (with the CSM disabled), but it does happen in either
    mode. Since I've started testing this patch in late january, rebooting
    has been 100% reliable.
    
    Most of the time it already hangs during POST, but occasionally it
    might even make it through the bootloader and the kernel might even
    start booting, but then hangs before the mode switch. The same symptoms
    occur with grub-efi, gummiboot and grub-pc, just as well as (at least)
    kernel 3.16-3.19 and 4.0-rc6 (I haven't tried older kernels than 3.16).
    Upgrading to the most current mainboard firmware of the ASRock
    Q1900DC-ITX, version 1.20, does not improve the situation.
    
    ( Searching the web seems to suggest that other Bay Trail-D mainboards
      might be affected as well. )
    --
    Signed-off-by: Stefan Lippers-Hollmann <s.l-h@gmx.de>
    Cc: Matt Fleming <matt.fleming@intel.com>
    Link: http://lkml.kernel.org/r/20150330224427.0fb58e42@mir
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit c38aa9bba28f912bf2eaea861c0ddf541af75606
Author: Peter Ujfalusi <peter.ujfalusi@ti.com>
Date:   Fri Mar 27 13:35:52 2015 +0200

    dmaengine: omap-dma: Fix memory leak when terminating running transfer
    
    commit 02d88b735f5a60f04dbf6d051b76e1877a0d0844 upstream.
    
    In omap_dma_start_desc the vdesc->node is removed from the virt-dma
    framework managed lists (to be precise from the desc_issued list).
    If a terminate_all comes before the transfer finishes the omap_desc will
    not be freed up because it is not in any of the lists and we stopped the
    DMA channel so the transfer will not going to complete.
    There is no special sequence for leaking memory when using cyclic (audio)
    transfer: with every start and stop of a cyclic transfer the driver leaks
    struct omap_desc worth of memory.
    
    Free up the allocated memory directly in omap_dma_terminate_all() since the
    framework will not going to do that for us.
    
    Signed-off-by: Peter Ujfalusi <peter.ujfalusi@ti.com>
    CC: <linux-omap@vger.kernel.org>
    Signed-off-by: Vinod Koul <vinod.koul@intel.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit d85168be83070a890e8bba49cbfe0a20238154db
Author: Darshana Padmadas <darshanapadmadas@gmail.com>
Date:   Sat Mar 28 12:07:14 2015 +0530

    iio: imu: Use iio_trigger_get for indio_dev->trig assignment
    
    commit 4ce7ca89d6e8eae9e201cd0e972ba323f33e2fb4 upstream.
    
    This patch uses iio_trigger_get to increment the reference
    count of trigger device, to avoid incorrect assignment.
    Can result in a null pointer dereference during removal if the
    trigger has been changed before removal.
    
    This patch refers to a similar situation encountered through the
    following discussion:
    http://www.spinics.net/lists/linux-iio/msg13669.html
    
    Signed-off-by: Darshana Padmadas <darshanapadmadas@gmail.com>
    Signed-off-by: Jonathan Cameron <jic23@kernel.org>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 6e106485980c6a4776a38a3941130f623e0b54db
Author: Viorel Suman <viorel.suman@gmail.com>
Date:   Wed Feb 18 20:05:21 2015 +0200

    iio: inv_mpu6050: Clear timestamps fifo while resetting hardware fifo
    
    commit 4dac0a8eefd55bb1f157d1a5a084531334a2d74c upstream.
    
    A hardware fifo reset always imply an invalidation of the
    existing timestamps, so we'll clear timestamps fifo on
    successfull hardware fifo reset.
    
    Signed-off-by: Viorel Suman <viorel.suman@gmail.com>
    Signed-off-by: Jonathan Cameron <jic23@kernel.org>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit b71eafb8217c2006b45a4a056b0421870d16a6c4
Author: Bart Van Assche <bart.vanassche@sandisk.com>
Date:   Wed Mar 4 10:31:47 2015 +0100

    Defer processing of REQ_PREEMPT requests for blocked devices
    
    commit bba0bdd7ad4713d82338bcd9b72d57e9335a664b upstream.
    
    SCSI transport drivers and SCSI LLDs block a SCSI device if the
    transport layer is not operational. This means that in this state
    no requests should be processed, even if the REQ_PREEMPT flag has
    been set. This patch avoids that a rescan shortly after a cable
    pull sporadically triggers the following kernel oops:
    
    BUG: unable to handle kernel paging request at ffffc9001a6bc084
    IP: [<ffffffffa04e08f2>] mlx4_ib_post_send+0xd2/0xb30 [mlx4_ib]
    Process rescan-scsi-bus (pid: 9241, threadinfo ffff88053484a000, task ffff880534aae100)
    Call Trace:
     [<ffffffffa0718135>] srp_post_send+0x65/0x70 [ib_srp]
     [<ffffffffa071b9df>] srp_queuecommand+0x1cf/0x3e0 [ib_srp]
     [<ffffffffa0001ff1>] scsi_dispatch_cmd+0x101/0x280 [scsi_mod]
     [<ffffffffa0009ad1>] scsi_request_fn+0x411/0x4d0 [scsi_mod]
     [<ffffffff81223b37>] __blk_run_queue+0x27/0x30
     [<ffffffff8122a8d2>] blk_execute_rq_nowait+0x82/0x110
     [<ffffffff8122a9c2>] blk_execute_rq+0x62/0xf0
     [<ffffffffa000b0e8>] scsi_execute+0xe8/0x190 [scsi_mod]
     [<ffffffffa000b2f3>] scsi_execute_req+0xa3/0x130 [scsi_mod]
     [<ffffffffa000c1aa>] scsi_probe_lun+0x17a/0x450 [scsi_mod]
     [<ffffffffa000ce86>] scsi_probe_and_add_lun+0x156/0x480 [scsi_mod]
     [<ffffffffa000dc2f>] __scsi_scan_target+0xdf/0x1f0 [scsi_mod]
     [<ffffffffa000dfa3>] scsi_scan_host_selected+0x183/0x1c0 [scsi_mod]
     [<ffffffffa000edfb>] scsi_scan+0xdb/0xe0 [scsi_mod]
     [<ffffffffa000ee13>] store_scan+0x13/0x20 [scsi_mod]
     [<ffffffff811c8d9b>] sysfs_write_file+0xcb/0x160
     [<ffffffff811589de>] vfs_write+0xce/0x140
     [<ffffffff81158b53>] sys_write+0x53/0xa0
     [<ffffffff81464592>] system_call_fastpath+0x16/0x1b
     [<00007f611c9d9300>] 0x7f611c9d92ff
    
    Reported-by: Max Gurtuvoy <maxg@mellanox.com>
    Signed-off-by: Bart Van Assche <bart.vanassche@sandisk.com>
    Reviewed-by: Mike Christie <michaelc@cs.wisc.edu>
    Signed-off-by: James Bottomley <JBottomley@Odin.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 708d0b8820cbf11df7a7dc2003c950c733bad2b6
Author: Doug Goldstein <cardoe@cardoe.com>
Date:   Mon Mar 23 20:34:48 2015 -0500

    USB: ftdi_sio: Use jtag quirk for SNAP Connect E10
    
    commit b229a0f840f774d29d8fedbf5deb344ca36b7f1a upstream.
    
    This patch uses the existing CALAO Systems ftdi_8u2232c_probe in order
    to avoid attaching a TTY to the JTAG port as this board is based on the
    CALAO Systems reference design and needs the same fix up.
    
    Signed-off-by: Doug Goldstein <cardoe@cardoe.com>
    [johan: clean up probe logic ]
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 4b54431d13031c3eec8102859e3413b06e322569
Author: Doug Goldstein <cardoe@cardoe.com>
Date:   Sun Mar 15 21:56:04 2015 -0500

    USB: ftdi_sio: Added custom PID for Synapse Wireless product
    
    commit 4899c054a90439477b24da8977db8d738376fe90 upstream.
    
    Synapse Wireless uses the FTDI VID with a custom PID of 0x9090 for their
    SNAP Stick 200 product.
    
    Signed-off-by: Doug Goldstein <cardoe@cardoe.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 7854b0fb24bbc26a8077188bbe619f5726c84dcd
Author: David Miller <davem@davemloft.net>
Date:   Wed Mar 18 23:18:40 2015 -0400

    radeon: Do not directly dereference pointers to BIOS area.
    
    commit f2c9e560b406f2f6b14b345c7da33467dee9cdf2 upstream.
    
    Use readb() and memcpy_fromio() accessors instead.
    
    Reviewed-by: Christian König <christian.koenig@amd.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit c75b0a8bac60682488393cddbb46959d37c1816e
Author: Tejun Heo <tj@kernel.org>
Date:   Mon Mar 23 00:18:48 2015 -0400

    writeback: fix possible underflow in write bandwidth calculation
    
    commit c72efb658f7c8b27ca3d0efb5cfd5ded9fcac89e upstream.
    
    From 1ebf33901ecc75d9496862dceb1ef0377980587c Mon Sep 17 00:00:00 2001
    From: Tejun Heo <tj@kernel.org>
    Date: Mon, 23 Mar 2015 00:08:19 -0400
    
    2f800fbd777b ("writeback: fix dirtied pages accounting on redirty")
    introduced account_page_redirty() which reverts stat updates for a
    redirtied page, making BDI_DIRTIED no longer monotonically increasing.
    
    bdi_update_write_bandwidth() uses the delta in BDI_DIRTIED as the
    basis for bandwidth calculation.  While unlikely, since the above
    patch, the newer value may be lower than the recorded past value and
    underflow the bandwidth calculation leading to a wild result.
    
    Fix it by subtracing min of the old and new values when calculating
    delta.  AFAIK, there hasn't been any report of it happening but the
    resulting erratic behavior would be non-critical and temporary, so
    it's possible that the issue is happening without being reported.  The
    risk of the fix is very low, so tagged for -stable.
    
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Cc: Jens Axboe <axboe@kernel.dk>
    Cc: Jan Kara <jack@suse.cz>
    Cc: Wu Fengguang <fengguang.wu@intel.com>
    Cc: Greg Thelen <gthelen@google.com>
    Fixes: 2f800fbd777b ("writeback: fix dirtied pages accounting on redirty")
    Signed-off-by: Jens Axboe <axboe@fb.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 0d4958ffdbf7a14e58ea822968a40c05b3c9de0f
Author: Tejun Heo <tj@kernel.org>
Date:   Wed Mar 4 10:37:43 2015 -0500

    writeback: add missing INITIAL_JIFFIES init in global_update_bandwidth()
    
    commit 7d70e15480c0450d2bfafaad338a32e884fc215e upstream.
    
    global_update_bandwidth() uses static variable update_time as the
    timestamp for the last update but forgets to initialize it to
    INITIALIZE_JIFFIES.
    
    This means that global_dirty_limit will be 5 mins into the future on
    32bit and some large amount jiffies into the past on 64bit.  This
    isn't critical as the only effect is that global_dirty_limit won't be
    updated for the first 5 mins after booting on 32bit machines,
    especially given the auxiliary nature of global_dirty_limit's role -
    protecting against global dirty threshold's sudden dips; however, it
    does lead to unintended suboptimal behavior.  Fix it.
    
    Fixes: c42843f2f0bb ("writeback: introduce smoothed global dirty limit")
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Acked-by: Jan Kara <jack@suse.cz>
    Cc: Wu Fengguang <fengguang.wu@intel.com>
    Cc: Jens Axboe <axboe@kernel.dk>
    Signed-off-by: Jens Axboe <axboe@fb.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit f9212814b6925eaba8f089bcc110ba5aec1ef13d
Author: Brian Silverman <brian@peloton-tech.com>
Date:   Wed Feb 18 16:23:56 2015 -0800

    sched: Fix RLIMIT_RTTIME when PI-boosting to RT
    
    commit 746db9443ea57fd9c059f62c4bfbf41cf224fe13 upstream.
    
    When non-realtime tasks get priority-inheritance boosted to a realtime
    scheduling class, RLIMIT_RTTIME starts to apply to them. However, the
    counter used for checking this (the same one used for SCHED_RR
    timeslices) was not getting reset. This meant that tasks running with a
    non-realtime scheduling class which are repeatedly boosted to a realtime
    one, but never block while they are running realtime, eventually hit the
    timeout without ever running for a time over the limit. This patch
    resets the realtime timeslice counter when un-PI-boosting from an RT to
    a non-RT scheduling class.
    
    I have some test code with two threads and a shared PTHREAD_PRIO_INHERIT
    mutex which induces priority boosting and spins while boosted that gets
    killed by a SIGXCPU on non-fixed kernels but doesn't with this patch
    applied. It happens much faster with a CONFIG_PREEMPT_RT kernel, and
    does happen eventually with PREEMPT_VOLUNTARY kernels.
    
    Signed-off-by: Brian Silverman <brian@peloton-tech.com>
    Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
    Cc: austin@peloton-tech.com
    Link: http://lkml.kernel.org/r/1424305436-6716-1-git-send-email-brian@peloton-tech.com
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit f875b0d329823b41e4b0c47176bc25ab24d9bbc8
Author: Gu Zheng <guz.fnst@cn.fujitsu.com>
Date:   Wed Mar 25 15:55:20 2015 -0700

    mm/memory hotplug: postpone the reset of obsolete pgdat
    
    commit b0dc3a342af36f95a68fe229b8f0f73552c5ca08 upstream.
    
    Qiu Xishi reported the following BUG when testing hot-add/hot-remove node under
    stress condition:
    
      BUG: unable to handle kernel paging request at 0000000000025f60
      IP: next_online_pgdat+0x1/0x50
      PGD 0
      Oops: 0000 [#1] SMP
      ACPI: Device does not support D3cold
      Modules linked in: fuse nls_iso8859_1 nls_cp437 vfat fat loop dm_mod coretemp mperf crc32c_intel ghash_clmulni_intel aesni_intel ablk_helper cryptd lrw gf128mul glue_helper aes_x86_64 pcspkr microcode igb dca i2c_algo_bit ipv6 megaraid_sas iTCO_wdt i2c_i801 i2c_core iTCO_vendor_support tg3 sg hwmon ptp lpc_ich pps_core mfd_core acpi_pad rtc_cmos button ext3 jbd mbcache sd_mod crc_t10dif scsi_dh_alua scsi_dh_rdac scsi_dh_hp_sw scsi_dh_emc scsi_dh ahci libahci libata scsi_mod [last unloaded: rasf]
      CPU: 23 PID: 238 Comm: kworker/23:1 Tainted: G           O 3.10.15-5885-euler0302 #1
      Hardware name: HUAWEI TECHNOLOGIES CO.,LTD. Huawei N1/Huawei N1, BIOS V100R001 03/02/2015
      Workqueue: events vmstat_update
      task: ffffa800d32c0000 ti: ffffa800d32ae000 task.ti: ffffa800d32ae000
      RIP: 0010: next_online_pgdat+0x1/0x50
      RSP: 0018:ffffa800d32afce8  EFLAGS: 00010286
      RAX: 0000000000001440 RBX: ffffffff81da53b8 RCX: 0000000000000082
      RDX: 0000000000000000 RSI: 0000000000000082 RDI: 0000000000000000
      RBP: ffffa800d32afd28 R08: ffffffff81c93bfc R09: ffffffff81cbdc96
      R10: 00000000000040ec R11: 00000000000000a0 R12: ffffa800fffb3440
      R13: ffffa800d32afd38 R14: 0000000000000017 R15: ffffa800e6616800
      FS:  0000000000000000(0000) GS:ffffa800e6600000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 0000000000025f60 CR3: 0000000001a0b000 CR4: 00000000001407e0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      Call Trace:
        refresh_cpu_vm_stats+0xd0/0x140
        vmstat_update+0x11/0x50
        process_one_work+0x194/0x3d0
        worker_thread+0x12b/0x410
        kthread+0xc6/0xd0
        ret_from_fork+0x7c/0xb0
    
    The cause is the "memset(pgdat, 0, sizeof(*pgdat))" at the end of
    try_offline_node, which will reset all the content of pgdat to 0, as the
    pgdat is accessed lock-free, so that the users still using the pgdat
    will panic, such as the vmstat_update routine.
    
    process A:				offline node XX:
    
    vmstat_updat()
       refresh_cpu_vm_stats()
         for_each_populated_zone()
           find online node XX
         cond_resched()
    					offline cpu and memory, then try_offline_node()
    					node_set_offline(nid), and memset(pgdat, 0, sizeof(*pgdat))
           zone = next_zone(zone)
             pg_data_t *pgdat = zone->zone_pgdat;  // here pgdat is NULL now
               next_online_pgdat(pgdat)
                 next_online_node(pgdat->node_id);  // NULL pointer access
    
    So the solution here is postponing the reset of obsolete pgdat from
    try_offline_node() to hotadd_new_pgdat(), and just resetting
    pgdat->nr_zones and pgdat->classzone_idx to be 0 rather than the memset
    0 to avoid breaking pointer information in pgdat.
    
    Signed-off-by: Gu Zheng <guz.fnst@cn.fujitsu.com>
    Reported-by: Xishi Qiu <qiuxishi@huawei.com>
    Suggested-by: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
    Cc: David Rientjes <rientjes@google.com>
    Cc: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
    Cc: Taku Izumi <izumi.taku@jp.fujitsu.com>
    Cc: Tang Chen <tangchen@cn.fujitsu.com>
    Cc: Xie XiuQi <xiexiuqi@huawei.com>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit dc74756d4a5693e07bf03ef56e71e10c4ea38ff9
Author: Sudip Mukherjee <sudipm.mukherjee@gmail.com>
Date:   Tue Jan 27 18:08:22 2015 +0530

    nbd: fix possible memory leak
    
    commit ff6b8090e26ef7649ef0cc6b42389141ef48b0cf upstream.
    
    we have already allocated memory for nbd_dev, but we were not
    releasing that memory and just returning the error value.
    
    Signed-off-by: Sudip Mukherjee <sudip@vectorindia.org>
    Acked-by: Paul Clements <Paul.Clements@SteelEye.com>
    Signed-off-by: Markus Pargmann <mpa@pengutronix.de>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit c866e10c0f627583cee48fe8c2ab104c599a4cc7
Author: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Date:   Mon Mar 16 09:08:07 2015 +0200

    iwlwifi: dvm: run INIT firmware again upon .start()
    
    commit 9c8928f5176766bec79f272bd47b7124e11cccbd upstream.
    
    The assumption before this patch was that we don't need to
    run again the INIT firmware after the system booted. The
    INIT firmware runs calibrations which impact the physical
    layer's behavior.
    Users reported that it may be helpful to run these
    calibrations again every time the interface is brought up.
    The penatly is minimal, since the calibrations run fast.
    This fixes:
    https://bugzilla.kernel.org/show_bug.cgi?id=94341
    
    Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit f6094cbab915952132434cc50d738c2976cb4457
Author: Shachar Raindel <raindel@mellanox.com>
Date:   Wed Mar 18 17:39:08 2015 +0000

    IB/uverbs: Prevent integer overflow in ib_umem_get address arithmetic
    
    commit 8494057ab5e40df590ef6ef7d66324d3ae33356b upstream.
    
    Properly verify that the resulting page aligned end address is larger
    than both the start address and the length of the memory area requested.
    
    Both the start and length arguments for ib_umem_get are controlled by
    the user. A misbehaving user can provide values which will cause an
    integer overflow when calculating the page aligned end address.
    
    This overflow can cause also miscalculation of the number of pages
    mapped, and additional logic issues.
    
    Addresses: CVE-2014-8159
    Signed-off-by: Shachar Raindel <raindel@mellanox.com>
    Signed-off-by: Jack Morgenstein <jackm@mellanox.com>
    Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 221ff9c56696e9e02d39ecb844528ebb4f8abf0f
Author: Ben Hutchings <ben@decadent.org.uk>
Date:   Wed Apr 15 19:00:32 2015 +0100

    tcp: Fix crash in TCP Fast Open
    
    Commit 355a901e6cf1 ("tcp: make connect() mem charging friendly")
    changed tcp_send_syn_data() to perform an open-coded copy of the 'syn'
    skb rather than using skb_copy_expand().
    
    The open-coded copy does not cover the skb_shared_info::gso_segs
    field, so in the new skb it is left set to 0.  When this commit was
    backported into stable branches between 3.10.y and 3.16.7-ckty
    inclusive, it triggered the BUG() in tcp_transmit_skb().
    
    Since Linux 3.18 the GSO segment count is kept in the
    tcp_skb_cb::tcp_gso_segs field and tcp_send_syn_data() does copy the
    tcp_skb_cb structure to the new skb, so mainline and newer stable
    branches are not affected.
    
    Set skb_shared_info::gso_segs to the correct value of 1.
    
    Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
    Acked-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 9647fcfbcad58f58edfa9f94aa691106ec29ff9a
Author: Joe Perches <joe@perches.com>
Date:   Mon Mar 23 18:01:35 2015 -0700

    selinux: fix sel_write_enforce broken return value
    
    commit 6436a123a147db51a0b06024a8350f4c230e73ff upstream.
    
    Return a negative error value like the rest of the entries in this function.
    
    Signed-off-by: Joe Perches <joe@perches.com>
    Acked-by:  Stephen Smalley <sds@tycho.nsa.gov>
    [PM: tweaked subject line]
    Signed-off-by: Paul Moore <pmoore@redhat.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 29b7448e685aa06dbe689855a943a8487c042350
Author: Vineet Gupta <vgupta@synopsys.com>
Date:   Thu Mar 26 09:25:44 2015 +0530

    ARC: SA_SIGINFO ucontext regs off-by-one
    
    commit 6914e1e3f63caa829431160f0f7093292daef2d5 upstream.
    
    The regfile provided to SA_SIGINFO signal handler as ucontext was off by
    one due to pt_regs gutter cleanups in 2013.
    
    Before handling signal, user pt_regs are copied onto user_regs_struct and copied
    back later. Both structs are binary compatible. This was all fine until
    commit 2fa919045b72 (ARC: pt_regs update #2) which removed the empty stack slot
    at top of pt_regs (corresponding to first pad) and made the corresponding
    fixup in struct user_regs_struct (the pad in there was moved out of
    @scratch - not removed altogether as it is part of ptrace ABI)
    
     struct user_regs_struct {
    +       long pad;
            struct {
    -               long pad;
                    long bta, lp_start, lp_end,....
            } scratch;
     ...
     }
    
    This meant that now user_regs_struct was off by 1 reg w.r.t pt_regs and
    signal code needs to user_regs_struct.scratch to reflect it as pt_regs,
    which is what this commit does.
    
    This problem was hidden for 2 years, because both save/restore, despite
    using wrong location, were using the same location. Only an interim
    inspection (reproducer below) exposed the issue.
    
         void handle_segv(int signo, siginfo_t *info, void *context)
         {
     	ucontext_t *uc = context;
    	struct user_regs_struct *regs = &(uc->uc_mcontext.regs);
    
    	printf("regs %x %x\n",               <=== prints 7 8 (vs. 8 9)
                   regs->scratch.r8, regs->scratch.r9);
         }
    
         int main()
         {
    	struct sigaction sa;
    
    	sa.sa_sigaction = handle_segv;
    	sa.sa_flags = SA_SIGINFO;
    	sigemptyset(&sa.sa_mask);
    	sigaction(SIGSEGV, &sa, NULL);
    
    	asm volatile(
    	"mov	r7, 7	\n"
    	"mov	r8, 8	\n"
    	"mov	r9, 9	\n"
    	"mov	r10, 10	\n"
    	:::"r7","r8","r9","r10");
    
    	*((unsigned int*)0x10) = 0;
         }
    
    Fixes: 2fa919045b72ec892e "ARC: pt_regs update #2: Remove unused gutter at start of pt_regs"
    Signed-off-by: Vineet Gupta <vgupta@synopsys.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit a045d4ae42c4dce895b0c4e43fa54f5a9640d7ae
Author: Takashi Iwai <tiwai@suse.de>
Date:   Wed Apr 8 20:47:55 2015 +0200

    ALSA: hda - Fix headphone pin config for Lifebook T731
    
    commit cc7016ab1a22fb26f388c2fb2b692b89897cbc3e upstream.
    
    Some BIOS version of Fujitsu Lifebook T731 seems to set up the
    headphone pin (0x21) without the assoc number 0x0f while it's set only
    to the output on the docking port (0x1a).  With the recent commit
    [03ad6a8c93b6: ALSA: hda - Fix "PCM" name being used on one DAC when
     there are two DACs], this resulted in the weird mixer element
    mapping where the headphone on the laptop is assigned as a shared
    volume with the speaker and the docking port is assigned as an
    individual headphone.
    
    This patch improves the situation by correcting the headphone pin
    config to the more appropriate value.
    
    Reported-and-tested-by: Taylor Smock <smocktaylor@gmail.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 791054ac25b7b8a7a92af2a050b2319c1dc78240
Author: Kailang Yang <kailang@realtek.com>
Date:   Wed Apr 8 16:34:00 2015 +0800

    ALSA: hda/realtek - Make more stable to get pin sense for ALC283
    
    commit a59d7199f62b8336570972dcc288321d0ec999fe upstream.
    
    Pin sense will active when power pin is wake up.
    Power pin will not wake up immediately during resume state.
    Add some delay to wait for power pin activated.
    
    Signed-off-by: Kailang Yang <kailang@realtek.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit bdf9a3dae6d602af0b5a3ed32d1022a555bb661c
Author: Dmitry M. Fedin <dmitry.fedin@gmail.com>
Date:   Thu Apr 9 17:37:03 2015 +0300

    ALSA: usb - Creative USB X-Fi Pro SB1095 volume knob support
    
    commit 3dc8523fa7412e731441c01fb33f003eb3cfece1 upstream.
    
    Adds an entry for Creative USB X-Fi to the rc_config array in
    mixer_quirks.c to allow use of volume knob on the device.
    Adds support for newer X-Fi Pro card, known as "Model No. SB1095"
    with USB ID "041e:3237"
    
    Signed-off-by: Dmitry M. Fedin <dmitry.fedin@gmail.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 351bd2c8818daee7934eadafe91a164870979093
Author: Hui Wang <hui.wang@canonical.com>
Date:   Thu Mar 26 17:14:55 2015 +0800

    ALSA: hda - Add one more node in the EAPD supporting candidate list
    
    commit af95b41426e0b58279f8ff0ebe420df49a4e96b8 upstream.
    
    We have a HP machine which use the codec node 0x17 connecting the
    internal speaker, and from the node capability, we saw the EAPD,
    if we don't set the EAPD on for this node, the internal speaker
    can't output any sound.
    
    BugLink: https://bugs.launchpad.net/bugs/1436745
    Signed-off-by: Hui Wang <hui.wang@canonical.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit dc8adb882d40ca75c28e0e4b3ec7e9fd3386acd9
Author: Alex Elder <alex.elder@linaro.org>
Date:   Thu Jan 23 15:54:01 2014 -0800

    remove extra definitions of U32_MAX
    
    commit 04f9b74e4d96d349de12fdd4e6626af4a9f75e09 upstream.
    
    Now that the definition is centralized in <linux/kernel.h>, the
    definitions of U32_MAX (and related) elsewhere in the kernel can be
    removed.
    
    Signed-off-by: Alex Elder <elder@linaro.org>
    Acked-by: Sage Weil <sage@inktank.com>
    Acked-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 70f9463cdf882d4f04bbf7f5e13c893a2efe07e0
Author: Alex Elder <alex.elder@linaro.org>
Date:   Thu Jan 23 15:54:00 2014 -0800

    kernel.h: define u8, s8, u32, etc. limits
    
    commit 89a0714106aac7309c7dfa0f004b39e1e89d2942 upstream.
    
    Create constants that define the maximum and minimum values
    representable by the kernel types u8, s8, u16, s16, and so on.
    
    Signed-off-by: Alex Elder <elder@linaro.org>
    Cc: Sage Weil <sage@inktank.com>
    Cc: David Miller <davem@davemloft.net>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit dd86ca3aae59e2f48512805e6df06a5070632730
Author: Alex Elder <alex.elder@linaro.org>
Date:   Thu Jan 23 15:53:59 2014 -0800

    conditionally define U32_MAX
    
    commit 77719536dc00f8fd8f5abe6dadbde5331c37f996 upstream.
    
    The symbol U32_MAX is defined in several spots.  Change these
    definitions to be conditional.  This is in preparation for the next
    patch, which centralizes the definition in <linux/kernel.h>.
    
    Signed-off-by: Alex Elder <elder@linaro.org>
    Cc: Sage Weil <sage@inktank.com>
    Cc: David Miller <davem@davemloft.net>
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit d4e321fcbe3bb0a755a8fa69fdeca7e7f0fe6fdb
Author: Peter Hurley <peter@hurleysoftware.com>
Date:   Mon Dec 2 14:24:41 2013 -0500

    n_tty: Merge .receive_buf() flavors
    
    commit 5c32d12378313e0096ea0d450462aa638a90fb6e upstream.
    
    N_TTY's direct and flow-controlled flavors of the .receive_buf()
    method are nearly identical; fold together.
    
    Signed-off-by: Peter Hurley <peter@hurleysoftware.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 362771fbc89c0ce2607576796f7479d9340bb1bc
Author: Christian Gmeiner <christian.gmeiner@gmail.com>
Date:   Wed May 7 09:01:54 2014 +0200

    x86/reboot: Add reboot quirk for Certec BPC600
    
    commit aadca6fa4068ad1f92c492bc8507b7ed350825a2 upstream.
    
    Certec BPC600 needs reboot=pci to actually reboot.
    
    Signed-off-by: Christian Gmeiner <christian.gmeiner@gmail.com>
    Cc: Matthew Garrett <mjg59@srcf.ucam.org>
    Cc: Li Aubrey <aubrey.li@linux.intel.com>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Cc: Dave Jones <davej@redhat.com>
    Cc: Fenghua Yu <fenghua.yu@intel.com>
    Cc: Linus Torvalds <torvalds@linux-foundation.org>
    Link: http://lkml.kernel.org/r/1399446114-2147-1-git-send-email-christian.gmeiner@gmail.com
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 83de40cb96942c13b10eec939e8781fb6e352ec9
Author: Jiri Slaby <jslaby@suse.cz>
Date:   Tue Apr 21 17:31:18 2015 +0200

    x86/reboot: Sort reboot DMI quirks by vendor
    
    commit e56e57f6613d5ed5c3127419341d1aa989a11971 upstream.
    
    Grouping them by vendor should make it easier to spot duplicates.
    
    Signed-off-by: Dave Jones <davej@fedoraproject.org>
    Link: http://lkml.kernel.org/r/20131001203655.GA10719@redhat.com
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit a5c378285ff5f2b62e5c9525dcb43e78480ef5e9
Author: Masoud Sharbiani <msharbiani@twitter.com>
Date:   Thu Sep 26 10:30:43 2013 -0700

    x86/reboot: Remove the duplicate C6100 entry in the reboot quirks list
    
    commit b5eafc6f07c95e9f3dd047e72737449cb03c9956 upstream.
    
    Two entries for the same system type were added, with two different vendor
    names: 'Dell' and 'Dell, Inc.'.
    
    Since a prefix match is being used by the DMI parsing code, we can eliminate
    the latter as redundant.
    
    Reported-by: "H. Peter Anvin" <hpa@zytor.com>
    Signed-off-by: Masoud Sharbiani <msharbiani@twitter.com>
    Cc: holt@sgi.com
    Link: http://lkml.kernel.org/r/1380216643-4683-1-git-send-email-masoud.sharbiani@gmail.com
    Signed-off-by: Ingo Molnar <mingo@kernel.org>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit f06798119a36f014e744e677a20a4b4818a9ddb3
Author: Ameya Palande <2ameya@gmail.com>
Date:   Thu Feb 26 12:05:51 2015 -0800

    mfd: kempld-core: Fix callback return value check
    
    commit c8648508ebfc597058d2cd00b6c539110264a167 upstream.
    
    On success, callback function returns 0. So invert the if condition
    check so that we can break out of loop.
    
    Signed-off-by: Ameya Palande <2ameya@gmail.com>
    Signed-off-by: Lee Jones <lee.jones@linaro.org>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit cff7c16575024195708bc209a5ab0aa81ff07188
Author: Markos Chandras <markos.chandras@imgtec.com>
Date:   Thu Mar 19 10:28:14 2015 +0000

    net: ethernet: pcnet32: Setup the SRAM and NOUFLO on Am79C97{3, 5}
    
    commit 87f966d97b89774162df04d2106c6350c8fe4cb3 upstream.
    
    On a MIPS Malta board, tons of fifo underflow errors have been observed
    when using u-boot as bootloader instead of YAMON. The reason for that
    is that YAMON used to set the pcnet device to SRAM mode but u-boot does
    not. As a result, the default Tx threshold (64 bytes) is now too small to
    keep the fifo relatively used and it can result to Tx fifo underflow errors.
    As a result of which, it's best to setup the SRAM on supported controllers
    so we can always use the NOUFLO bit.
    
    Cc: <netdev@vger.kernel.org>
    Cc: <linux-kernel@vger.kernel.org>
    Cc: Don Fry <pcnet32@frontier.com>
    Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 5e840e1c726bbcf80ef6310e576a121a68f999f5
Author: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
Date:   Wed Mar 4 11:59:33 2015 -0800

    powerpc/pseries: Little endian fixes for post mobility device tree update
    
    commit f6ff04149637723261aa4738958b0098b929ee9e upstream.
    
    We currently use the device tree update code in the kernel after resuming
    from a suspend operation to re-sync the kernels view of the device tree with
    that of the hypervisor. The code as it stands is not endian safe as it relies
    on parsing buffers returned by RTAS calls that thusly contains data in big
    endian format.
    
    This patch annotates variables and structure members with __be types as well
    as performing necessary byte swaps to cpu endian for data that needs to be
    parsed.
    
    Signed-off-by: Tyrel Datwyler <tyreld@linux.vnet.ibm.com>
    Cc: Nathan Fontenot <nfont@linux.vnet.ibm.com>
    Cc: Cyril Bur <cyrilbur@gmail.com>
    Signed-off-by: Michael Ellerman <mpe@ellerman.id.au>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 20554b14c96113c351088dd26de76d4d214796a1
Author: Catalin Marinas <catalin.marinas@arm.com>
Date:   Mon Mar 23 15:06:50 2015 +0000

    arm64: Use the reserved TTBR0 if context switching to the init_mm
    
    commit e53f21bce4d35a93b23d8fa1a840860f6c74f59e upstream.
    
    The idle_task_exit() function may call switch_mm() with next ==
    &init_mm. On arm64, init_mm.pgd cannot be used for user mappings, so
    this patch simply sets the reserved TTBR0.
    
    Reported-by: Jon Medhurst (Tixy) <tixy@linaro.org>
    Tested-by: Jon Medhurst (Tixy) <tixy@linaro.org>
    Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>

commit 3426bb8de3a655aa6668e92ee92eb35f0db86582
Author: Jiri Slaby <jslaby@suse.cz>
Date:   Mon Apr 13 16:29:33 2015 +0200

    core, nfqueue, openvswitch: fix compilation warning
    
    Stable commit "core, nfqueue, openvswitch: Orphan frags in
    skb_zerocopy and handle errors", upstream commit
    36d5fe6a000790f56039afe26834265db0a3ad4c, was not correctly backported
    and missed to change a const 'from' parameter to non-const.  This
    results in a new batch of warnings:
    
    net/netfilter/nfnetlink_queue_core.c: In function ‘nfqnl_zcopy’:
    net/netfilter/nfnetlink_queue_core.c:272:2: warning: passing argument 1 of ‘skb_orphan_frags’ discards ‘const’ qualifier from pointer target type [enabled by default]
      if (unlikely(skb_orphan_frags(from, GFP_ATOMIC))) {
      ^
    In file included from net/netfilter/nfnetlink_queue_core.c:18:0:
    include/linux/skbuff.h:1822:19: note: expected ‘struct sk_buff *’ but argument is of type ‘const struct sk_buff *’
     static inline int skb_orphan_frags(struct sk_buff *skb, gfp_t gfp_mask)
                       ^
    net/netfilter/nfnetlink_queue_core.c:273:3: warning: passing argument 1 of ‘skb_tx_error’ discards ‘const’ qualifier from pointer target type [enabled by default]
       skb_tx_error(from);
       ^
    In file included from net/netfilter/nfnetlink_queue_core.c:18:0:
    include/linux/skbuff.h:630:13: note: expected ‘struct sk_buff *’ but argument is of type ‘const struct sk_buff *’
     extern void skb_tx_error(struct sk_buff *skb);
    
    Remove const from the 'from' parameter, the same as in the upstream
    commit.
    
    As far as I can see, this leaked into 3.10, 3.12, and 3.13 already.
    
    Cc: Zoltan Kiss <zoltan.kiss@citrix.com>
    Cc: David S. Miller <davem@davemloft.net>
    Cc: Ben Hutchings <ben@decadent.org.uk>
    Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Cc: stable@vger.kernel.org # v3.10, v3.12, v3.13
    Signed-off-by: Jiri Slaby <jslaby@suse.cz>