tipc: fix race/inefficiencies in poll/wait behaviour

When an application blocks at poll/select on a TIPC socket
while requesting a specific event mask, both the filter_rcv() and
wakeupdispatch() case will wake it up unconditionally whenever
the state changes (i.e an incoming message arrives, or congestion
has subsided).  No mask is used.

To avoid this, we populate sk->sk_data_ready and sk->sk_write_space
with tipc_data_ready and tipc_write_space respectively, which makes
tipc more in alignment with the rest of the networking code.  These
pass the exact set of possible events to the waker in fs/select.c
hence avoiding waking up blocked processes unnecessarily.

In doing so, we uncover another issue -- that there needs to be a
memory barrier in these poll/receive callbacks, otherwise we are
subject to the the same race as documented above wq_has_sleeper()
[in commit a57de0b4 "net: adding memory barrier to the poll and
receive callbacks"].  So we need to replace poll_wait() with
sock_poll_wait() and use rcu protection for the sk->sk_wq pointer
in these two new functions.

Signed-off-by: Ying Xue <[email protected]>
Signed-off-by: Paul Gortmaker <[email protected]>

team: bcast: convert return value of team_dev_queue_xmit() to bool correctly

The thing is that team_dev_queue_xmit() returns NET_XMIT_* or -E*.
bc_trasmit() should return true in case all went well. So use ! to get
correct retval from team_dev_queue_xmit() result.
This bug caused iface statistics to be badly computed.

This bug was introduced by:
team: add broadcast mode (5fc889911a99043a97da1daa0d010ad72cbc3042)

Reported-by: Dan Carpenter <[email protected]>
Signed-off-by: Jiri Pirko <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

Merge tag 'pinctrl-for-v3.7-late' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl

Pull pinctrl fix from Linus Walleij:
 "A simple pinctrl Kconfig oneliner arriving late.

  Final (hopefully) oneliner for the pinctrl subsystem targeted at v3.7"

* tag 'pinctrl-for-v3.7-late' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl:
  pinctrl/samsung: don't allow enabling pinctrl-samsung standalone

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security

Pull selinux RCU fixlet from James Morris.

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  selinux: fix sel_netnode_insert() suspicious rcu dereference

sign-file: fix the perl warning message when extracting ASN.1

There have the following warning message when running modules install
for sign ko files:

  # make modules_install
  ...
    INSTALL drivers/input/touchscreen/pcap_ts.ko
  Found = in conditional, should be == at scripts/sign-file line 164.
  Found = in conditional, should be == at scripts/sign-file line 161.
  Found = in conditional, should be == at scripts/sign-file line 159.

This patch change replace '=' by '==' in elsif conditions for avoid the
above warning messages.

Signed-off-by: Chun-Yi Lee <[email protected]>
Signed-off-by: David Howells <[email protected]>
Signed-off-by: Linus Torvalds <[email protected]>

bonding: Bonding driver does not consider the gso_max_size/gso_max_segs setting of slave devices.

Patch sets the lowest gso_max_size and gso_max_segs values of the slave devices during enslave and detach.

Signed-off-by: Sarveshwar Bandi <[email protected]>
Acked-by: Eric Dumazet <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

xen/netfront: handle compound page fragments on transmit

An SKB paged fragment can consist of a compound page with order > 0.
However the netchannel protocol deals only in PAGE_SIZE frames.

Handle this in xennet_make_frags by iterating over the frames which
make up the page.

This is the netfront equivalent to 6a8ed462f16b for netback.

Signed-off-by: Ian Campbell <[email protected]>
Cc: [email protected]
Cc: [email protected]
Cc: Eric Dumazet <[email protected]>
Cc: Konrad Rzeszutek Wilk <[email protected]>
Cc: ANNIE LI <[email protected]>
Cc: Sander Eikelenboom <[email protected]>
Cc: Stefan Bader <[email protected]>
Acked-by: Eric Dumazet <[email protected]>
Acked-by: Konrad Rzeszutek Wilk <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless into for-davem

John W. Linville says:

====================
This is a batch of fixes intended for 3.7...

Included are two pulls.  Regarding the mac80211 tree, Johannes says:

"Please pull my mac80211.git tree (see below) to get two more fixes for
3.7. Both fix regressions introduced *before* this cycle that weren't
noticed until now, one for IBSS not cleaning up properly and the other
to add back the "wireless" sysfs directory for Fedora's startup scripts."

Regarding the iwlwifi tree, Johannes says:

"Please also pull my iwlwifi.git tree, I have two fixes: one to remove a
spurious warning that can actually trigger in legitimate situations, and
the other to fix a regression from when monitor mode was changed to use
the "sniffer" firmware mode."

Also included is an nfc tree pull.  Samuel says:

"We mostly have pn533 fixes here, 2 memory leaks and an early unlocking fix.
Moreover, we also have an LLCP adapter linked list insertion fix."

On top of that, a few more bits...  Albert Pool adds a USB ID
to rtlwifi.  Bing Zhao provides two mwifiex fixes -- one to fix
a system hang during a command timeout, and the other to properly
report a suspend error to the MMC core.  Finally, Sujith Manoharan
fixes a thinko that would trigger an ath9k hang during device reset.
====================

Signed-off-by: David S. Miller <[email protected]>

batman-adv: Use packing of 2 for all headers before an ethernet header

All packet headers in front of an ethernet header have to be completely
divisible by 2 but not by 4 to make the payload after the ethernet header again
4 bytes boundary aligned.

A packing of 2 is necessary to avoid extra padding at the end of the struct
caused by a structure member which is larger than two bytes. Otherwise the
structure would not fulfill the previously mentioned rule to avoid the
misalignment of the payload after the ethernet header. It may also lead to
leakage of information when the padding it not initialized before sending.

Signed-off-by: Sven Eckelmann <[email protected]>
Signed-off-by: Marek Lindner <[email protected]>
Signed-off-by: Antonio Quartulli <[email protected]>

batman-adv: Start new development cycle

Signed-off-by: Sven Eckelmann <[email protected]>
Signed-off-by: Antonio Quartulli <[email protected]>

batman-adv: Fix broadcast duplist for fragmentation

If the skb is fragmented, the checksum must be computed on the
individual fragments, just using skb->data may fail on fragmented
data. Instead of doing linearizing the packet, use the new
batadv_crc32 to do that more efficiently- it should not hurt
replacing the old crc16 by the new crc32.

Reported-by: Sven Eckelmann <[email protected]>
Signed-off-by: Simon Wunderlich <[email protected]>
Signed-off-by: Marek Lindner <[email protected]>
Signed-off-by: Antonio Quartulli <[email protected]>

batman-adv: Add function to calculate crc32c for the skb payload

Signed-off-by: Sven Eckelmann <[email protected]>
Signed-off-by: Marek Lindner <[email protected]>
Signed-off-by: Antonio Quartulli <[email protected]>

batman-adv: sysfs documentation should keep alphabetical order

Signed-off-by: Marek Lindner <[email protected]>
Signed-off-by: Antonio Quartulli <[email protected]>

batman-adv: Add wrapper to look up neighbor and send skb

By adding batadv_send_skb_to_orig() in send.c, we can remove duplicate
code that looks up the next hop and then calls batadv_send_skb_packet().

Furthermore, this prepares the upcoming new implementation of
fragmentation, which requires the next hop to route packets.

Please note that this doesn't entirely remove the next-hop lookup in
routing.c and unicast.c, since it is used by the current fragmentation
code.

Also note that the next-hop info is removed from debug messages in
translation-table.c, since it is looked up elsewhere.

Signed-off-by: Martin Hundebøll <[email protected]>
Signed-off-by: Marek Lindner <[email protected]>
Signed-off-by: Antonio Quartulli <[email protected]>

batman-adv: support array of debugfs general attributes

This patch adds support for an array of debugfs general (not soft_iface
specific) attributes. With this change it will be possible to add more general
attributes by simply appending them to the array without touching the rest of
the code.

Reported-by: Marek Lindner <[email protected]>
Signed-off-by: Antonio Quartulli <[email protected]>
Acked-by: Sven Eckelmann <[email protected]>
Signed-off-by: Marek Lindner <[email protected]>

batman-adv: fix bla compare function

The address and the VLAN VID may not be packed in the respective
structs. Fix this by comparing the elements individually.

Reported-by: Marek Lindner <[email protected]>
Reported-by: Sven Eckelmann <[email protected]>
Signed-off-by: Simon Wunderlich <[email protected]>
Signed-off-by: Marek Lindner <[email protected]>
Signed-off-by: Antonio Quartulli <[email protected]>

batman-adv: Mark best gateway in transtable_global debugfs

The transtable_global debug file can show multiple entries for a single client
when multiple gateways exist. The chosen gateway isn't marked in the list and
therefore the user cannot easily debug the situation when there is a problem
with the currently used gateway.

The best gateway is now marked with "*" and secondary gateways are marked with
"+".

Signed-off-by: Sven Eckelmann <[email protected]>
Signed-off-by: Marek Lindner <[email protected]>
Signed-off-by: Antonio Quartulli <[email protected]>

selinux: fix sel_netnode_insert() suspicious rcu dereference

===============================
[ INFO: suspicious RCU usage. ]
3.5.0-rc1+ #63 Not tainted
-------------------------------
security/selinux/netnode.c:178 suspicious rcu_dereference_check() usage!

other info that might help us debug this:

rcu_scheduler_active = 1, debug_locks = 0
1 lock held by trinity-child1/8750:
 #0:  (sel_netnode_lock){+.....}, at: [<ffffffff812d8f8a>] sel_netnode_sid+0x16a/0x3e0

stack backtrace:
Pid: 8750, comm: trinity-child1 Not tainted 3.5.0-rc1+ #63
Call Trace:
 [<ffffffff810cec2d>] lockdep_rcu_suspicious+0xfd/0x130
 [<ffffffff812d91d1>] sel_netnode_sid+0x3b1/0x3e0
 [<ffffffff812d8e20>] ? sel_netnode_find+0x1a0/0x1a0
 [<ffffffff812d24a6>] selinux_socket_bind+0xf6/0x2c0
 [<ffffffff810cd1dd>] ? trace_hardirqs_off+0xd/0x10
 [<ffffffff810cdb55>] ? lock_release_holdtime.part.9+0x15/0x1a0
 [<ffffffff81093841>] ? lock_hrtimer_base+0x31/0x60
 [<ffffffff812c9536>] security_socket_bind+0x16/0x20
 [<ffffffff815550ca>] sys_bind+0x7a/0x100
 [<ffffffff816c03d5>] ? sysret_check+0x22/0x5d
 [<ffffffff810d392d>] ? trace_hardirqs_on_caller+0x10d/0x1a0
 [<ffffffff8133b09e>] ? trace_hardirqs_on_thunk+0x3a/0x3f
 [<ffffffff816c03a9>] system_call_fastpath+0x16/0x1b

This patch below does what Paul McKenney suggested in the previous thread.

Signed-off-by: Dave Jones <[email protected]>
Reviewed-by: Paul E. McKenney <[email protected]>
Acked-by: Paul Moore <[email protected]>
Cc: Eric Paris <[email protected]>
Cc: <[email protected]>
Signed-off-by: Andrew Morton <[email protected]>
Signed-off-by: James Morris <[email protected]>

Merge branch 'for-3.7' of git://git.infradead.org/users/dedekind/l2-mtd

Conflicts:
drivers/mtd/nand/nand_base.c

ALSA: hda - Cirrus: Correctly clear line_out_pins when moving to speaker

If this array is not cleared, the jack related code later might
fail to create "Internal Speaker Phantom Jack" on Dell Inspiron 3420 and
Dell Vostro 2420.

BugLink: https://bugs.launchpad.net/bugs/1076840
Cc: [email protected] (3.6+)
Signed-off-by: David Henningsson <[email protected]>
Signed-off-by: Takashi Iwai <[email protected]>

ALSA: hda - Add support for Realtek ALC292

We found a new codec ID 292, and that just a simple quirk would enable
sound output/input on this ALC292 chip.

BugLink: https://bugs.launchpad.net/bugs/1081466
Cc: [email protected]
Tested-by: Acelan Kao <[email protected]>
Signed-off-by: David Henningsson <[email protected]>
Signed-off-by: Takashi Iwai <[email protected]>

x86-64: Fix ordering of CFI directives and recent ASM_CLAC additions

While these got added in the right place everywhere else, entry_64.S
is the odd one where they ended up before the initial CFI directive(s).
In order to cover the full code ranges, the CFI directive must be
first, though.

Signed-off-by: Jan Beulich <[email protected]>
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: H. Peter Anvin <[email protected]>

x86, microcode, AMD: Add support for family 16h processors

Add valid patch size for family 16h processors.

[ hpa: promoting to urgent/stable since it is hw enabling and trivial ]

Signed-off-by: Boris Ostrovsky <[email protected]>
Acked-by: Andreas Herrmann <[email protected]>
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: H. Peter Anvin <[email protected]>
Cc: <[email protected]>

x86-32: Export kernel_stack_pointer() for modules

Modules, in particular oprofile (and possibly other similar tools)
need kernel_stack_pointer(), so export it using EXPORT_SYMBOL_GPL().

Cc: Yang Wei <[email protected]>
Cc: Robert Richter <[email protected]>
Cc: Jun Zhang <[email protected]>
Cc: <[email protected]>
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: H. Peter Anvin <[email protected]>

x86-32: Fix invalid stack address while in softirq

In 32 bit the stack address provided by kernel_stack_pointer() may
point to an invalid range causing NULL pointer access or page faults
while in NMI (see trace below). This happens if called in softirq
context and if the stack is empty. The address at &regs->sp is then
out of range.

Fixing this by checking if regs and &regs->sp are in the same stack
context. Otherwise return the previous stack pointer stored in struct
thread_info. If that address is invalid too, return address of regs.

 BUG: unable to handle kernel NULL pointer dereference at 0000000a
 IP: [<c1004237>] print_context_stack+0x6e/0x8d
 *pde = 00000000
 Oops: 0000 [#1] SMP
 Modules linked in:
 Pid: 4434, comm: perl Not tainted 3.6.0-rc3-oprofile-i386-standard-g4411a05 #4 Hewlett-Packard HP xw9400 Workstation/0A1Ch
 EIP: 0060:[<c1004237>] EFLAGS: 00010093 CPU: 0
 EIP is at print_context_stack+0x6e/0x8d
 EAX: ffffe000 EBX: 0000000a ECX: f4435f94 EDX: 0000000a
 ESI: f4435f94 EDI: f4435f94 EBP: f5409ec0 ESP: f5409ea0
  DS: 007b ES: 007b FS: 00d8 GS: 0033 SS: 0068
 CR0: 8005003b CR2: 0000000a CR3: 34ac9000 CR4: 000007d0
 DR0: 00000000 DR1: 00000000 DR2: 00000000 DR3: 00000000
 DR6: ffff0ff0 DR7: 00000400
 Process perl (pid: 4434, ti=f5408000 task=f5637850 task.ti=f4434000)
 Stack:
  000003e8 ffffe000 00001ffc f4e39b00 00000000 0000000a f4435f94 c155198c
  f5409ef0 c1003723 c155198c f5409f04 00000000 f5409edc 00000000 00000000
  f5409ee8 f4435f94 f5409fc4 00000001 f5409f1c c12dce1c 00000000 c155198c
 Call Trace:
  [<c1003723>] dump_trace+0x7b/0xa1
  [<c12dce1c>] x86_backtrace+0x40/0x88
  [<c12db712>] ? oprofile_add_sample+0x56/0x84
  [<c12db731>] oprofile_add_sample+0x75/0x84
  [<c12ddb5b>] op_amd_check_ctrs+0x46/0x260
  [<c12dd40d>] profile_exceptions_notify+0x23/0x4c
  [<c1395034>] nmi_handle+0x31/0x4a
  [<c1029dc5>] ? ftrace_define_fields_irq_handler_entry+0x45/0x45
  [<c13950ed>] do_nmi+0xa0/0x2ff
  [<c1029dc5>] ? ftrace_define_fields_irq_handler_entry+0x45/0x45
  [<c13949e5>] nmi_stack_correct+0x28/0x2d
  [<c1029dc5>] ? ftrace_define_fields_irq_handler_entry+0x45/0x45
  [<c1003603>] ? do_softirq+0x4b/0x7f
  <IRQ>
  [<c102a06f>] irq_exit+0x35/0x5b
  [<c1018f56>] smp_apic_timer_interrupt+0x6c/0x7a
  [<c1394746>] apic_timer_interrupt+0x2a/0x30
 Code: 89 fe eb 08 31 c9 8b 45 0c ff 55 ec 83 c3 04 83 7d 10 00 74 0c 3b 5d 10 73 26 3b 5d e4 73 0c eb 1f 3b 5d f0 76 1a 3b 5d e8 73 15 <8b> 13 89 d0 89 55 e0 e8 ad 42 03 00 85 c0 8b 55 e0 75 a6 eb cc
 EIP: [<c1004237>] print_context_stack+0x6e/0x8d SS:ESP 0068:f5409ea0
 CR2: 000000000000000a
 ---[ end trace 62afee3481b00012 ]---
 Kernel panic - not syncing: Fatal exception in interrupt

V2:
* add comments to kernel_stack_pointer()
* always return a valid stack address by falling back to the address
  of regs

Reported-by: Yang Wei <[email protected]>
Cc: <[email protected]>
Signed-off-by: Robert Richter <[email protected]>
Link: http://lkml.kernel.org/r/[email protected]
Signed-off-by: H. Peter Anvin <[email protected]>
Cc: Jun Zhang <[email protected]>

Merge tag 'asoc-3.7' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus

ASoC: Fixes for v3.7

The biggest batch of fixes here is the Kirkwood DMA fixes, plus a couple
of other small fixes.

Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc

Pull missed powerpc fixes from Benjamin Herrenschmidt:
 "Here are small 52xx fixes that Anatolij asked me to pull a while back
  and that I completely missed.  The stuff is local to that platform
  code, and was in next for a while, so it should still go into 3.7."

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
  powerpc/mpc5200: move lpbfifo node and fix its interrupt property
  powerpc: 52xx: nop out unsupported critical IRQs
  powerpc/pcm030: add pcm030-audio-fabric to dts

Merge tag 'stable/for-linus-3.7-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen

Pull Xen bug-fix from Konrad Rzeszutek Wilk:
 - Fix regression introduced by commit ceb90fa0a800 ("xen/privcmd: add
   PRIVCMD_MMAPBATCH_V2 ioctl").

* tag 'stable/for-linus-3.7-rc6-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
  xen/privcmd: Correctly return success from IOCTL_PRIVCMD_MMAPBATCH

Merge git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull KVM maintainership update from Avi Kivity:
 "After many years of maintaining KVM, I am moving on.  It was a real
  pleasure for me to work with so many talented and dedicated hackers on
  this project.

  Replacing me will be one of those talented and dedicated hackers,
  Gleb, who has authored hundreds of patches in and around KVM."

* git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: taking co-maintenance
  KVM: Retire as maintainer

Merge tag 'iommu-fixes-v3.7-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu

Pull IOMMU fixes from Joerg Roedel:
 "Some fixes and a MAINTAINERS update to remove my lost AMD email
  address from the file.  The fixes take care of a resource leak and a
  problem on VT-d with the new IOMMU group code."

* tag 'iommu-fixes-v3.7-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
  intel-iommu: Fix lookup in add device
  iommu/tegra-smmu.c: fix dentry reference leak in smmu_debugfs_stats_show().
  iommu/amd: Update MAINTAINERS entry

Merge branch 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs

Pull reiserfs and ext3 fixes from Jan Kara:
 "Fixes of reiserfs deadlocks when quotas are enabled (locking there was
  completely busted by BKL conversion) and also one small ext3 fix in
  the trim interface."

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
  ext3: Avoid underflow of in ext3_trim_fs()
  reiserfs: Move quota calls out of write lock
  reiserfs: Protect reiserfs_quota_write() with write lock
  reiserfs: Protect reiserfs_quota_on() with write lock
  reiserfs: Fix lock ordering during remount

Merge branches 'fix/arizona', 'fix/cs4271', 'fix/kirkwood' and 'fix/samsung' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into tmp

xen/privcmd: Correctly return success from IOCTL_PRIVCMD_MMAPBATCH

This is a regression introduced by ceb90fa0 (xen/privcmd: add
PRIVCMD_MMAPBATCH_V2 ioctl).  It broke xentrace as it used
xc_map_foreign() instead of xc_map_foreign_bulk().

Most code-paths prefer the MMAPBATCH_V2, so this wasn't very obvious
that it broke. The return value is set early on to -EINVAL, and if all
goes well, the "set top bits of the MFN's" never gets called, so the
return value is still EINVAL when the function gets to the end, causing
the caller to think it went wrong (which it didn't!)

Now also including Andres "move the ret = -EINVAL into the error handling
path, as this avoids other similar errors in future.

Signed-off-by: Mats Petersson <[email protected]>
Acked-by: Andres Lagar-Cavilla <[email protected]>
Acked-by: David Vrabel <[email protected]>
Signed-off-by: Konrad Rzeszutek Wilk <[email protected]>

Merge remote-tracking branch 'agust/merge' into merge

Anatolij 52xx updates:

Patch for pcm030 device tree fixing the probe() in pcm030-audio-fabric
driver. Changes to this driver have been merged in 3.7-rc1 via ASoC
tree, but this required device tree patch was submitted separately to
the linux-ppc list and is still missing in mainline. Without this patch
the probe() in pcm030-audio-fabric driver wrongly returns -ENODEV.

A patch from Wolfram fixing wrong invalid critical irq warnings for
all mpc5200 boards.

Another patch for all mpc5200 device trees fixing wrong L1 cell in
the LPB FIFO interrupt property and moving the LPB FIFO node to the
common mpc5200b.dtsi file so that this common node will be present
in all mpc5200 device trees.

ASoC: kirkwood-i2s: more pause-mode fixes

Don't even momentarily set the pause status when starting the channel;
if we do, we should check the busy bit to ensure that we comply with
the spec.  In any case, it isn't necessary; we will not active on a
START event so there is no need to pause the DMA.

Signed-off-by: Russell King <[email protected]>
Signed-off-by: Mark Brown <[email protected]>

ASoC: kirkwood-i2s: fix DMA underruns

Stress testing the driver with multiple start/stop events causes
kirkwood-dma to report underrun errors (which used to cause the kernel
to lock up solidly).  This is because kirkwood-i2s is not respecting
the restrictions imposed on clearing the 'pause' bit.  Follow what the
spec says; the busy bit must be read as being clear twice before the
pause bit can be released.  This solves the underruns.

However, it has been noticed that the busy bit occasionally does not
clear itself, hence the waiting is bounded to 5ms maximum to avoid a
new reason for the kernel to lockup.

Signed-off-by: Russell King <[email protected]>
Signed-off-by: Mark Brown <[email protected]>

ASoC: kirkwood-i2s: fix DCO lock detection

This is part of a patch found in Rabeeh Khoury's git tree for the
cubox, which is further attributed to Sebastian Hesselbrath.

Rather than masking the KIRKWOOD_DCO_SPCR_STATUS register contents
against the registers virtual address, let's actually use the bit
definition for the locked status, as required in the documentation.

Signed-off-by: Russell King <[email protected]>
Signed-off-by: Mark Brown <[email protected]>

ASoC: kirkwood-dma: don't ignore other irq causes on error

Ignoring the real cause of the interrupt is not a good idea; this
behaviour has been observed to bring Dove platforms to silently
lockup.  Instead, on error fall through to the normal interrupt
processing.

This is especially important on Dove platforms as errors are
handled separately, and allows us to clear down the real cause of
the interrupt.

Signed-off-by: Russell King <[email protected]>
Signed-off-by: Mark Brown <[email protected]>

ASoC: kirkwood-dma: fix use of virt_to_phys()

This is part of a patch found in Rabeeh Khoury's git tree for the
cubox.

You can not use virt_to_phys() on the address returned from
dma_alloc_coherent(); it may not be part of the kernel direct-mapped
memory.  Fix this to use the DMA address instead.

Signed-off-by: Russell King <[email protected]>
Signed-off-by: Mark Brown <[email protected]>

Merge commit 'efi-for-3.7-v2' into x86/urgent

x86, efi: Fix processor-specific memcpy() build error

Building for Athlon/Duron/K7 results in the following build error,

arch/x86/boot/compressed/eboot.o: In function `__constant_memcpy3d':
eboot.c:(.text+0x385): undefined reference to `_mmx_memcpy'
arch/x86/boot/compressed/eboot.o: In function `efi_main':
eboot.c:(.text+0x1a22): undefined reference to `_mmx_memcpy'

because the boot stub code doesn't link with the kernel proper, and
therefore doesn't have access to the 3DNow version of memcpy. So,
follow the example of misc.c and #undef memcpy so that we use the
version provided by misc.c.

See https://bugzilla.kernel.org/show_bug.cgi?id=50391

Reported-by: Al Viro <[email protected]>
Reported-by: Ryan Underwood <[email protected]>
Cc: H. Peter Anvin <[email protected]>
Cc: [email protected]
Signed-off-by: Matt Fleming <[email protected]>

net: fix build failure in xilinx

Commit 71c6c837 (drivers/net: fix tasklet misuse issue) introduced a
build failure in the xilinx driver. axienet_dma_err_handler isn't
declared before its use in axienet_open.

This patch provides the prototype before axienet_open.

Cc: Xiaotian Feng <[email protected]>
Signed-off-by: Jeff Mahoney <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

irda: sir_dev: Fix copy/paste typo

Signed-off-by: Alexander Shiyan <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

sctp: send abort chunk when max_retrans exceeded

In the event that an association exceeds its max_retrans attempts, we should
send an ABORT chunk indicating that we are closing the assocation as a result.
Because of the nature of the error, its unlikely to be received, but its a nice
clean way to close the association if it does make it through, and it will give
anyone watching via tcpdump a clue as to what happened.

Change notes:
v2)
* Removed erroneous changes from sctp_make_violation_parmlen

Signed-off-by: Neil Horman <[email protected]>
CC: Vlad Yasevich <[email protected]>
CC: "David S. Miller" <[email protected]>
CC: [email protected]
Acked-by: Vlad Yasevich <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

x86: remove dummy long from EFI stub

Commit 2e064b1 (x86, efi: Fix issue of overlapping .reloc section for
EFI_STUB) removed a dummy reloc added by commit 291f363 (x86, efi: EFI
boot stub support), but forgot to remove the dummy long used by that
reloc.

Reviewed-by: Jordan Justen <[email protected]>
Tested-by: Lee G Rosenbaum <[email protected]>
Cc: "H. Peter Anvin" <[email protected]>
Cc: Thomas Gleixner <[email protected]>
Cc: Ingo Molnar <[email protected]>
Signed-off-by: Cesar Eduardo Barros <[email protected]>
Signed-off-by: Matt Fleming <[email protected]>

ipv6: fix inet6_csk_update_pmtu() return value

In case of error, inet6_csk_update_pmtu() should consistently
return NULL.

Bug added in commit 35ad9b9cf7d8a
(ipv6: Add helper inet6_csk_update_pmtu().)

Reported-by: Lluís Batlle i Rossell <[email protected]>
Signed-off-by: Eric Dumazet <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

ixp4xx_hss: avoid calling dma_pool_create() with NULL dev

Use &port->netdev->dev instead of NULL since dma_pool_create() doesn't
allow NULL dev.

Signed-off-by: Xi Wang <[email protected]>
Cc: Andrew Morton <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

ixp4xx_eth: avoid calling dma_pool_create() with NULL dev

Use &port->netdev->dev instead of NULL since dma_pool_create() doesn't
allow NULL dev.

Signed-off-by: Xi Wang <[email protected]>
Cc: Andrew Morton <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

ne2000: add the right platform device

Without this udev doesn't have a way to key the ne device to the platform
device.

Signed-off-by: Alan Cox <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

net: Remove redundant null check before kfree in dev.c

kfree on a null pointer is a no-op.

Signed-off-by: Sachin Kamat <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

caif: Remove redundant null check before kfree in cfctrl.c

kfree on a null pointer is a no-op.

Signed-off-by: Sachin Kamat <[email protected]>
Acked-by: Sjur Brændeland <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

bnx2x: Remove duplicate inclusion of bnx2x_hsi.h

bnx2x_hsi.h was included twice.

Signed-off-by: Sachin Kamat <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

sit: allow to configure 6rd tunnels via netlink

This patch add the support of 6RD tunnels management via netlink.
Note that netdev_state_change() is now called when 6RD parameters are updated.

6RD parameters are updated only if there is at least one 6RD attribute.

Signed-off-by: Nicolas Dichtel <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

add DOVE extensions for VXLAN

This patch provides extensions to VXLAN for supporting Distributed
Overlay Virtual Ethernet (DOVE) networks. The patch includes:

+ a dove flag per VXLAN device to enable DOVE extensions
+ ARP reduction, whereby a bridge-connected VXLAN tunnel endpoint
answers ARP requests from the local bridge on behalf of
remote DOVE clients
+ route short-circuiting (aka L3 switching). Known destination IP
addresses use the corresponding destination MAC address for
switching rather than going to a (possibly remote) router first.
+ netlink notification messages for forwarding table and L3 switching
misses

Changes since v2
- combined bools into "u32 flags"
- replaced loop with !is_zero_ether_addr()

Signed-off-by: David L Stevens <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

Merge tag 'nfc-fixes-3.7-1' of git://git.kernel.org/pub/scm/linux/kernel/git/sameo/nfc-3.0

Samuel says:

"This is the first pull request for 3.7 NFC fixes.

We mostly have pn533 fixes here, 2 memory leaks and an early unlocking fix.
Moreover, we also have an LLCP adapter linked list insertion fix."

Signed-off-by: John W. Linville <[email protected]>

radeon: add AGPMode 1 quirk for RV250

The Intel 82855PM host bridge / Mobility FireGL 9000 RV250 combination
in an (outdated) ThinkPad T41 needs AGPMode 1 for suspend/resume (under
KMS, that is). So add a quirk for it.

(Change R250 to RV250 in comment for preceding quirk too.)

Signed-off-by: Paul Bolle <[email protected]>
Signed-off-by: Alex Deucher <[email protected]>
Cc: [email protected]

drm/radeon: properly track the crtc not_enabled case evergreen_mc_stop()

The save struct is not initialized previously so explicitly
mark the crtcs as not used when they are not in use.

Signed-off-by: Alex Deucher <[email protected]>
Cc: [email protected]

KVM: taking co-maintenance

Updating MAINTAINERS file.

Signed-off-by: Gleb Natapov <[email protected]>
Signed-off-by: Avi Kivity <[email protected]>

KVM: Retire as maintainer

After six and a half years of writing and maintaining KVM, it is time to
move to new things.  Update my MAINTAINERS entry to reflect that.

Signed-off-by: Avi Kivity <[email protected]>

ARM: EXYNOS: PL330 MDMA1 fix for revision 0 of Exynos4210 SOC

Commit 8214513 ("ARM: EXYNOS: fix address for EXYNOS4 MDMA1")
changed EXYNOS specific setup of PL330 DMA engine to use 'non-secure'
mdma1 address instead of 'secure' one (from 0x12840000 to 0x12850000)
to fix issue with some Exynos4212 SOCs.  Unfortunately it brakes
PL330 setup for revision 0 of Exynos4210 SOC (mdma1 device cannot
be found at 'non-secure' address):

[    0.566245] dma-pl330 dma-pl330.2: PERIPH_ID 0x0, PCELL_ID 0x0 !
[    0.566278] dma-pl330: probe of dma-pl330.2 failed with error -22

Fix it by using 'secure' mdma1 address on Exynos4210 revision 0 SOC.

Reviewed-by: Tomasz Figa <[email protected]>
Signed-off-by: Bartlomiej Zolnierkiewicz <[email protected]>
Signed-off-by: Kyungmin Park <[email protected]>
Signed-off-by: Kukjin Kim <[email protected]>

md/raid5: round discard alignment up to power of 2.

blkdev_issue_discard currently assumes that the granularity
is a power of 2.  So in raid5, round the chosen number up to
avoid embarrassment.

Cc: Shaohua Li <[email protected]>
Signed-off-by: NeilBrown <[email protected]>

net: Remove bogus dependencies on INET

Various drivers depend on INET because they used to select INET_LRO,
but they have all been converted to use GRO which has no such
dependency.

Signed-off-by: Ben Hutchings <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

ehea: Remove remnants of LRO support

Commit 2cb1deb56f5bf413da83491e0cb5a0474393c8ef ('ehea: Remove LRO
support') left behind the Kconfig depends/select and feature flag.

Signed-off-by: Ben Hutchings <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

mlx4_en: Remove remnants of LRO support

Commit fa37a9586f92051de03a13e55e5ec3880bb6783e ('mlx4_en: Moving to
work with GRO') left behind the Kconfig depends/select, some dead
code and comments referring to LRO.

Signed-off-by: Ben Hutchings <[email protected]>
Acked-by: Amir Vadai <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

net: remove unnecessary wireless includes

The wireless and wext includes in net-sysfs.c aren't
needed, so remove them.

Signed-off-by: Johannes Berg <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

net/ethernet: remove useless is_valid_ether_addr from drivers ndo_open

If ndo_validate_addr is set to the generic eth_validate_addr
function there is no point in calling is_valid_ether_addr
from driver ndo_open if ndo_open is not used elsewhere in
the driver.

With this change is_valid_ether_addr will be called from the
generic eth_validate_addr function. So there should be no change
in the actual behavior.

Signed-off-by: Joachim Eastwood <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

net: rds: use this_cpu_* per-cpu helper

Signed-off-by: Shan Wei <[email protected]>
Reviewed-by: Christoph Lameter <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

net: core: use this_cpu_ptr per-cpu helper

flush_tasklet is a struct, not a pointer in percpu var.
so use this_cpu_ptr to get the member pointer.

Signed-off-by: Shan Wei <[email protected]>
Reviewed-by: Christoph Lameter <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

of/net/mdio-gpio: Fix pdev->id issue when using devicetrees.

When the mdio-gpio driver is probed via device trees, the platform
device id is set as -1, However the pdev->id is re-used as bus-id for
while creating mdio gpio bus.
So
For device tree case the mdio-gpio bus name appears as "gpio-ffffffff"
where as
for non-device tree case the bus name appears as "gpio-<bus-num>"

Which means the bus_id is fixed in device tree case, so we can't have
two mdio gpio buses via device trees. Assigning a logical bus number
via device tree solves the problem and the bus name is much consistent
with non-device tree bus name.

Without this patch
1. we can't support two mdio-gpio buses via device trees.
2. we should always pass gpio-ffffffff as bus name to phy_connect, very
different to non-device tree bus name.

So, setting up the bus_id via aliases from device tree is the right
solution and other drivers do similar thing.

Signed-off-by: Srinivas Kandagatla <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

md: make sure everything is freed when dm-raid stops an array.

md_stop() would stop an array, but not free various attached
data structures.
For internal arrays, these are freed later in do_md_stop() or
mddev_put(), but they don't apply for dm-raid arrays.
So get md_stop() to free them, and only all it from dm-raid.
For internal arrays we now call __md_stop.

Reported-by: majianpeng <[email protected]>
Signed-off-by: NeilBrown <[email protected]>

md: Avoid write invalid address if read_seqretry returned true.

If read_seqretry returned true and bbp was changed, it will write
invalid address which can cause some serious problem.

This bug was introduced by commit v3.0-rc7-130-g2699b67.
So fix is suitable for 3.0.y thru 3.6.y.

Reported-by: [email protected]
Tested-by: [email protected]
Cc: [email protected]
Signed-off-by: Jianpeng Ma <[email protected]>
Signed-off-by: NeilBrown <[email protected]>

md: Reassigned the parameters if read_seqretry returned true in func md_is_badblock.

This bug was introduced by commit(v3.0-rc7-126-g2230dfe).
So fix is suitable for 3.0.y thru 3.6.y.

Cc: [email protected]
Signed-off-by: Jianpeng Ma <[email protected]>
Signed-off-by: NeilBrown <[email protected]>

NFC: Fix pn533 target mode memory leak

In target mode, sent sk_buff were not freed in pn533_tm_send_complete

Signed-off-by: Thierry Escande <[email protected]>
Signed-off-by: Samuel Ortiz <[email protected]>

NFC: pn533: Fix mem leak in pn533_in_dep_link_up

cmd is allocated in pn533_dep_link_up and passed as an arg to
pn533_send_cmd_frame_async together with a complete cb.

arg is passed to the cb and must be kfreed there.

Signed-off-by: Waldemar Rymarkiewicz <[email protected]>
Signed-off-by: Samuel Ortiz <[email protected]>

NFC: pn533: Fix use after free

cmd was freed in pn533_dep_link_up regardless of
pn533_send_cmd_frame_async return code. Cmd is passed as argument to
pn533_in_dep_link_up_complete callback and should be freed there.

Signed-off-by: Szymon Janc <[email protected]>
Signed-off-by: Samuel Ortiz <[email protected]>

NFC: pn533: Fix missing lock while operating on commands list

In pn533_wq_cmd command was removed from list without cmd_lock held
(race with pn533_send_cmd_frame_async) which could lead to list
corruption. Delete command from list before releasing lock.

Signed-off-by: Szymon Janc <[email protected]>
Signed-off-by: Samuel Ortiz <[email protected]>

NFC: Fix nfc_llcp_local chained list insertion

list_add was called with swapped parameters

Signed-off-by: Thierry Escande <[email protected]>
Signed-off-by: Samuel Ortiz <[email protected]>

ext3: Avoid underflow of in ext3_trim_fs()

Currently if len argument in ext3_trim_fs() is smaller than one block,
the 'end' variable underflow. Avoid that by returning EINVAL if len is
smaller than file system block.

Also remove useless unlikely().

Signed-off-by: Lukas Czerner <[email protected]>
Signed-off-by: Jan Kara <[email protected]>

reiserfs: Move quota calls out of write lock

Calls into highlevel quota code cannot happen under the write lock. These
calls take dqio_mutex which ranks above write lock. So drop write lock
before calling back into quota code.

CC: [email protected] # >= 3.0
Signed-off-by: Jan Kara <[email protected]>

reiserfs: Protect reiserfs_quota_write() with write lock

Calls into reiserfs journalling code and reiserfs_get_block() need to
be protected with write lock. We remove write lock around calls to high
level quota code in the next patch so these paths would suddently become
unprotected.

CC: [email protected] # >= 3.0
Signed-off-by: Jan Kara <[email protected]>

reiserfs: Protect reiserfs_quota_on() with write lock

In reiserfs_quota_on() we do quite some work - for example unpacking
tail of a quota file. Thus we have to hold write lock until a moment
we call back into the quota code.

CC: [email protected] # >= 3.0
Signed-off-by: Jan Kara <[email protected]>

reiserfs: Fix lock ordering during remount

When remounting reiserfs dquot_suspend() or dquot_resume() can be called.
These functions take dqonoff_mutex which ranks above write lock so we have
to drop it before calling into quota code.

CC: [email protected] # >= 3.0
Signed-off-by: Jan Kara <[email protected]>

ALSA: hda - Limit runtime PM support only to known Intel chips

We've got a report that the runtime PM may make the codec the
unresponsive on AMD platforms.  Since the feature has been tested only
on the recent Intel platforms, it's safer to limit the support to such
devices for now.

This patch adds a new DCAPS bit flag indicating the runtime PM
support, and mark it for Intel controllers.

Reported-and-tested-by: Julian Wollrath <[email protected]>
Signed-off-by: Takashi Iwai <[email protected]>

vhost: Remove duplicate inclusion of linux/vhost.h

linux/vhost.h was included twice.

Signed-off-by: Sachin Kamat <[email protected]>
Acked-by: Michael S. Tsirkin <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

Merge branch 'for-john' of git://git.kernel.org/pub/scm/linux/kernel/git/iwlwifi/iwlwifi-fixes

Merge branch 'for-john' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211

net/macb: move to circ_buf macros and fix initial condition

Move to circular buffers management macro and correct an error
with circular buffer initial condition.

Without this patch, the macb_tx_ring_avail() function was
not reporting the proper ring availability at startup:
macb macb: eth0: BUG! Tx Ring full when queue awake!
macb macb: eth0: tx_head = 0, tx_tail = 0
And hanginig forever...

I remove the macb_tx_ring_avail() function and use the
proven macros from circ_buf.h. CIRC_CNT() is used in the
"consumer" part of the driver: macb_tx_interrupt() to match
advice from Documentation/circular-buffers.txt.

Reported-by: Jean-Christophe PLAGNIOL-VILLARD <[email protected]>
Signed-off-by: Nicolas Ferre <[email protected]>
Tested-by: Jean-Christophe PLAGNIOL-VILLARD <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

netfilter: Remove the spurious \ in __ip_vs_lblc_init

In (464dc801c76a net: Don't export sysctls to unprivileged users)
I typoed and introduced a spurious backslash.  Delete it.

Signed-off-by: "Eric W. Biederman" <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

qeth: Remove BUG_ONs

Remove BUG_ONs or convert to WARN_ON_ONCE/WARN_ONs since a failure within a
networking device driver is no reason to shut down the entire machine.

Signed-off-by: Stefan Raspl <[email protected]>
Signed-off-by: Frank Blaschka <[email protected]>
Reviewed-by: Ursula Braun <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

qeth: Consolidate tracing of card features

Trace all supported and enabled card features to s390dbf.

Signed-off-by: Stefan Raspl <[email protected]>
Signed-off-by: Frank Blaschka <[email protected]>
Reviewed-by: Ursula Braun <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

qeth: Clarify card type naming for virtual NICs

So far, virtual NICs whether attached to a VSWITCH or a guest LAN were always
displayed as guest LANs in the device driver attributes and messages, while
in fact it is a virtual NIC.

Signed-off-by: Stefan Raspl <[email protected]>
Signed-off-by: Frank Blaschka <[email protected]>
Reviewed-by: Ursula Braun <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

claw: remove BUG_ONs

Remove BUG_ON's in claw driver, since the checked error conditions
are null pointer accesses.

Signed-off-by: Ursula Braun <[email protected]>
Signed-off-by: Frank Blaschka <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

ctcm: remove BUG_ONs

Remove BUG_ON's in ctcm driver, since the checked error conditions
are null pointer accesses.

Signed-off-by: Ursula Braun <[email protected]>
Signed-off-by: Frank Blaschka <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

qeth: Remove unused variable

Eliminate a variable that is never modified.

Signed-off-by: Stefan Raspl <[email protected]>
Signed-off-by: Frank Blaschka <[email protected]>
Reviewed-by: Ursula Braun <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

net: Allow userns root to control tun and tap devices

Allow an unpriviled user who has created a user namespace, and then
created a network namespace to effectively use the new network
namespace, by reducing capable(CAP_NET_ADMIN) calls to
ns_capable(net->user_ns,CAP_NET_ADMIN) calls.

Allow setting of the tun iff flags.
Allow creating of tun devices.
Allow adding a new queue to a tun device.

Signed-off-by: "Eric W. Biederman" <[email protected]>
Acked-by: Serge Hallyn <[email protected]>
Signed-off-by: David S. Miller <[email protected]>

Merge tag 'davinci-fixes-for-v3.7' of git://gitorious.org/linux-davinci/linux-davinci into fixes

From Sekhar Nori:

Fixes an "signal out of range" error when using enhanced
definition display with a DaVinci DM644x device.

* tag 'davinci-fixes-for-v3.7' of git://gitorious.org/linux-davinci/linux-davinci:
  ARM: davinci: dm644x: fix out range signal for ED

ath9k_hw: Fix regression in device reset

Commit "ath9k: improve suspend/resume reliability" broke ath9k_htc
and bringing up the device would hang indefinitely. Fix this.

Cc: [email protected]
Signed-off-by: Sujith Manoharan <[email protected]>
Signed-off-by: John W. Linville <[email protected]>

ALSA: hda - Fix recursive suspend/resume call

When the bus reset is performed during the suspend/resume (including
the power-saving too), it calls snd_hda_suspend() and
snd_hda_resume() again, and deadlocks eventually.

For avoiding the recursive call, add a new flag indicating that the PM
is being performed, and don't go to the bus reset mode when it's on.

Reported-and-tested-by: Julian Wollrath <[email protected]>
Signed-off-by: Takashi Iwai <[email protected]>

i2c: s3c2410: Fix code to free gpios

Store the requested gpios so that they can be freed on error/removal.

Signed-off-by: Abhilash Kesavan <[email protected]>
Signed-off-by: Wolfram Sang <[email protected]>

Merge branch 'usb-midi-fix-3.7' of git://git.alsa-project.org/alsa-kprivate into for-linus

Merge a regression fix for USB MIDI on non-standard usb-audio drivers
by Clemens.