UBIFS: make space fixup work in the remount case

The UBIFS space fixup is a useful feature which allows to fixup the "broken"
flash space at the time of the first mount. The "broken" space is usually the
result of using a "dumb" industrial flasher which is not able to skip empty
NAND pages and just writes all 0xFFs to the empty space, which has grave
side-effects for UBIFS when UBIFS trise to write useful data to those empty
pages.

The fix-up feature works roughly like this:
1. mkfs.ubifs sets the fixup flag in UBIFS superblock when creating the image
   (see -F option)
2. when the file-system is mounted for the first time, UBIFS notices the fixup
   flag and re-writes the entire media atomically, which may take really a lot
   of time.
3. UBIFS clears the fixup flag in the superblock.

This works fine when the file system is mounted R/W for the very first time.
But it did not really work in the case when we first mount the file-system R/O,
and then re-mount R/W. The reason was that we started the fixup procedure too
late, which we cannot really do because we have to fixup the space before it
starts being used.

Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Reported-by: Mark Jackson <mpfj-list@mimc.co.uk>
Cc: stable@vger.kernel.org # 3.0+
gpio-ich: Fix value returned by ichx_gpio_request

Per Documentation/gpio.txt, gpio_request callbacks should return 0 on
success or a negative value on error. So it is not clear what was
meant by letting ichx_gpio_request return 1 in some cases, nor how a
caller would interpret it.

Align the code with the comment above it and consider pins as
available by default.

Signed-off-by: Jean Delvare <khali@linux-fr.org>
Cc: Grant Likely <grant.likely@secretlab.ca>
Acked-by: Peter Tyser <ptyser@xes-inc.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
gpio: stmpe: pass DT node to irqdomain

The irq domain was implemented but the device tree
node was not transmitted to irq_domain_add_simple().

Cc: stable@vger.kernel.org
Signed-off-by: Gabriel Fernandez <gabriel.fernandez@stericsson.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Merge tag v3.9-rc1 into for-3.9/upstream-fixes

This is done so that I am able to apply fix for commit
0322bd3980b3 ("usb hid quirks for Masterkit MA901 usb radio") which
went into 3.9-rc1.
HID: fix Masterkit MA901 hid quirks

This patch reverts commit 0322bd3980 ("usb hid quirks for Masterkit MA901 usb
radio") and adds checks in hid_ignore() for Masterkit MA901 usb radio device.
This usb radio device shares USB ID with many Atmel V-USB (and probably other)
devices so patch sorts things out by checking name, vendor, product of hid device.

Signed-off-by: Alexey Klimov <klimov.linux@gmail.com>
Acked-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
media: radio-ma901: return ENODEV in probe if usb_device doesn't match

Masterkit MA901 usb radio device shares USB ID with Atmel V-USB devices.
This patch adds additional checks in usb_ma901radio_probe() and if
product or manufacturer doesn't match we return -ENODEV and don't
continue. This allows hid drivers to handle not MA901 device.

Signed-off-by: Alexey Klimov <klimov.linux@gmail.com>
Acked-by: Mauro Carvalho Chehab <mchehab@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
HID: magicmouse: fix race between input_register() and probe()

Since kernel 3.7, it appears that the input registration occured before
the end of magicmouse_setup_input(). This is shown by receiving a lot of
"EV_SYN SYN_REPORT 1" instead of normal "EV_SYN SYN_REPORT 0".
This value means that the output buffer is full, and the user space
is loosing events.

Using .input_configured guarantees that the race is not occuring, and that
the call of "input_set_events_per_packet(input, 60)" is taken into account
by input_register().

Fixes:
https://bugzilla.redhat.com/show_bug.cgi?id=908604

Cc: stable@vger.kernel.org
Reported-and-Tested-By: Clarke Wixon <cwixon@usa.net>
Signed-off-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>
Merge tag 'gpio-fixes-v3.9' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio

Pull GPIO fixes from Linus Walleij:
 "Two GPIO fixes for the v3.9 series:
   - Fix erroneous return value in the ICH driver
   - Make the STMPE driver proper properly on device tree boots"

* tag 'gpio-fixes-v3.9' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
  gpio: stmpe: pass DT node to irqdomain
  gpio-ich: Fix value returned by ichx_gpio_request
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid

Pull HID fixes from Jiri Kosina:

 - Workaround for device ID conflict between Masterkit MA901 usb radio
   device and Atmel V-USB devices, to avoid regressions from older
   kernels, by Alexey Klimov

 - fix for possible race during input device registration in magicmouse
   driver, by Benjamin Tissoires

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
  HID: magicmouse: fix race between input_register() and probe()
  media: radio-ma901: return ENODEV in probe if usb_device doesn't match
  HID: fix Masterkit MA901 hid quirks
Merge tag 'upstream-3.9-rc6' of git://git.infradead.org/linux-ubifs

Pull UBIFS fix from Artem Bityutskiy:
 "Make the space fixup feature work in the case when the file-system is
  first mounted R/O and then remounted R/W."

* tag 'upstream-3.9-rc6' of git://git.infradead.org/linux-ubifs:
  UBIFS: make space fixup work in the remount case
mm: prevent mmap_cache race in find_vma()

find_vma() can be called by multiple threads with read lock
held on mm->mmap_sem and any of them can update mm->mmap_cache.
Prevent compiler from re-fetching mm->mmap_cache, because other
readers could update it in the meantime:

               thread 1                             thread 2
                                        |
  find_vma()                            |  find_vma()
    struct vm_area_struct *vma = NULL;  |
    vma = mm->mmap_cache;               |
    if (!(vma && vma->vm_end > addr     |
        && vma->vm_start <= addr)) {    |
                                        |    mm->mmap_cache = vma;
    return vma;                         |
     ^^ compiler may optimize this      |
        local variable out and re-read  |
        mm->mmap_cache                  |

This issue can be reproduced with gcc-4.8.0-1 on s390x by running
mallocstress testcase from LTP, which triggers:

  kernel BUG at mm/rmap.c:1088!
    Call Trace:
     ([<000003d100c57000>] 0x3d100c57000)
      [<000000000023a1c0>] do_wp_page+0x2fc/0xa88
      [<000000000023baae>] handle_pte_fault+0x41a/0xac8
      [<000000000023d832>] handle_mm_fault+0x17a/0x268
      [<000000000060507a>] do_protection_exception+0x1e2/0x394
      [<0000000000603a04>] pgm_check_handler+0x138/0x13c
      [<000003fffcf1f07a>] 0x3fffcf1f07a
    Last Breaking-Event-Address:
      [<000000000024755e>] page_add_new_anon_rmap+0xc2/0x168

Thanks to Jakub Jelinek for his insight on gcc and helping to
track this down.

Signed-off-by: Jan Stancek <jstancek@redhat.com>
Acked-by: David Rientjes <rientjes@google.com>
Signed-off-by: Hugh Dickins <hughd@google.com>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>