intel-iommu: Fix use after release during device attach

Obtain the new pgd pointer before releasing the page containing this
value.

Cc: stable@kernel.org
Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Reviewed-by: Sheng Yang <sheng@linux.intel.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
intel-iommu: Unlink domain from iommu

When we remove a device, we unlink the iommu from the domain, but
we never do the reverse unlinking of the domain from the iommu.
This means that we never clear iommu->domain_ids, eventually leading
to resource exhaustion if we repeatedly bind and unbind a device
to a driver.  Also free empty domains to avoid a resource leak.

Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Acked-by: Donald Dutile <ddutile@redhat.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Cc: stable@kernel.org
intel-iommu: Fix get_domain_for_dev() error path

If we run out of domain_ids and fail iommu_attach_domain(), we
fall into domain_exit() without having setup enough of the
domain structure for this to do anything useful.  In fact, it
typically runs off into the weeds walking the bogus domain->devices
list.  Just free the domain.

Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
Acked-by: Donald Dutile <ddutile@redhat.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Cc: stable@kernel.org
nfsd: fix auth_domain reference leak on nlm operations

This was noticed by users who performed more than 2^32 lock operations
and hence made this counter overflow (eventually leading to
use-after-free's).  Setting rq_client to NULL here means that it won't
later get auth_domain_put() when it should be.

Appears to have been introduced in 2.5.42 by "[PATCH] kNFSd: Move auth
domain lookup into svcauth" which moved most of the rq_client handling
to common svcauth code, but left behind this one line.

Cc: Neil Brown <neilb@suse.de>
Cc: stable@kernel.org
Signed-off-by: J. Bruce Fields <bfields@redhat.com>
netfilter: ipset: list:set timeout variant fixes

- the timeout value was actually not set
- the garbage collector was broken

The variant is fixed, the tests to the ipset testsuite are added.

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
netfilter: ipset: References are protected by rwlock instead of mutex

The timeout variant of the list:set type must reference the member sets.
However, its garbage collector runs at timer interrupt so the mutex protection
of the references is a no go. Therefore the reference protection
is converted to rwlock.

Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
Signed-off-by: Patrick McHardy <kaber@trash.net>
ASoC: zylonite: set .codec_dai_name in initializer

Fix the initialization of .codec_dai_name in zylonite_dai initializer,
do not mix it with the initialization of .codec_name which is set
already a few lines above.

Signed-off-by: Antonio Ospite <ospite@studenti.unina.it>
Acked-by: Eric Miao <eric.y.miao@gmail.com>
Acked-by: Liam Girdwood <lrg@slimlogic.co.uk>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
RTC: Fix early irqs caused by calling rtc_set_alarm too early

When we register an rtc device at boot, we read the alarm value
in hardware and set the rtc device's aie_timer to that value.

The initial method to do this was to simply call rtc_set_alarm()
with the value read from hardware. However, this may cause problems
as rtc_set_alarm may enable interupts, and the RTC alarm might fire,
which can cause invalid pointer dereferencing since the RTC registration
is not complete.

This patch solves the issue by initializing the rtc_device.aie_timer
y hand via rtc_initialize_alarm(). This avoids any calls to the RTC
hardware which might enable interrupts too early.

CC: Thomas Gleixner <tglx@linutronix.de>
CC: Alessandro Zummo <a.zummo@towertech.it>
Reported-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Tested-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Signed-off-by: John Stultz <john.stultz@linaro.org>
RTC: Fix s3c compile error due to missing s3c_rtc_setpie

s3c_rtc_setpie was removed, and it resulted in compiler error:

drivers/rtc/rtc-s3c.c: In function s3c_rtc_release
drivers/rtc/rtc-s3c.c:339:2: error: implicit declaration of function
s3c_rtc_setpie

Fix it by removing s3c_rtc_release calls.

[jstultz: An identical fix was also sent in by Jiri Pinkava
 <jiri.pinkava@vscht.cz>]

CC: Thomas Gleixner <tglx@linutronix.de>
CC: Alessandro Zummo <a.zummo@towertech.it>
Signed-off-by: Vasily Khoruzhick <anarsoul@gmail.com>
Signed-off-by: John Stultz <john.stultz@linaro.org>
RTC: add missing "return 0" in new alarm func for rtc-bfin.c

The new bfin_rtc_alarm_irq_enable function forgot to add a "return 0" to
the end leading to the build warning:
	drivers/rtc/rtc-bfin.c: In function 'bfin_rtc_alarm_irq_enable':
	drivers/rtc/rtc-bfin.c:253: warning: control reaches end of non-void function

CC: stable@kernel.org
CC: Thomas Gleixner <tglx@linutronix.de>
CC: Alessandro Zummo <a.zummo@towertech.it>
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: John Stultz <john.stultz@linaro.org>
xen: events: fix error checks in bind_*_to_irqhandler()

Checking 'irq < 0' doesn't work when 'irq' is unsigned.

The assigned bind_evtchn_to_irq() and bind_virq_to_irq()
return int, so using int appears appropriate.

Signed-off-by: Nicolas Kaiser <nikai@nikai.net>
Signed-off-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
ARM: tegra: gpio: Fix unused variable warnings

Change b0f18edaf6ee4e6fac89cae63a90bd38ad2a3418
(arm: tegra: Remove unused bogus irq enable/disable magic)
introduces warnings:
arch/arm/mach-tegra/gpio.c: In function 'tegra_gpio_resume':
arch/arm/mach-tegra/gpio.c:260: warning: unused variable 'i'
arch/arm/mach-tegra/gpio.c: In function 'tegra_gpio_suspend':
arch/arm/mach-tegra/gpio.c:283: warning: unused variable 'i'

Fix them, and fix a coding style issue on the same lines.

Signed-off-by: Colin Cross <ccross@android.com>
Acked-by: Erik Gilling <konkers@konkers.net>
gpio/pca953x: fix error handling path in probe() call

If the device fails to respond, then the error path tries to remove an
interrupt that never got registered, which causes an backtrace from the
interrupt handling code.

Fix this by ensuring that the cleanup path has two labels and use the
correct path as needed.

fixes the following error:

WARNING: at kernel/irq/manage.c:908 __free_irq+0x80/0x160()
Trying to free already-free IRQ 0

Signed-off-by: Ben Dooks <ben-linux@fluff.org>
Signed-off-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
xfs: fix unreferenced var error in xfs_buf.c

Signed-off-by: Dave Chinner <dchinner@redhat.com>
Signed-off-by: Alex Elder <aelder@sgi.com>
msm: Remove extraneous ffa device check

The qsd8x50 board file contains a few references to machine_is_...
macros that are otherwise unused, and contain no machine definition.
The recent purge of unused machine definitions breaks the compilation
of this target.

Since the machine cannot ever be used, just remove the bogus checks.

Signed-off-by: David Brown <davidb@codeaurora.org>
msm: timer: fix missing return value

Change af90f10d38 "ARM: 6759/1: smp: Select local timers vs broadcast
timer support runtime" missed a return statement, causing a compile
warning:

  arch/arm/mach-msm/timer.c:272: warning: 'return' with no value, in
  function returning non-void

Trivially return 0 for success when running on cpu 0 (to match the
comment and previous behavior).

Signed-off-by: David Brown <davidb@codeaurora.org>
gpio/ml_ioh_gpio: Fix output value of ioh_gpio_direction_output()

The ioh_gpio_direction_output() function was missing a write to set the
desired output value.  The function would properly set the GPIO
direction, but not the output value.  The value would have to manually
be set with a follow up call to ioh_gpio_set().

Add the missing write so that ioh_gpio_direction_output() sets both the
GPIO direction and value.

Signed-off-by: Peter Tyser <ptyser@xes-inc.com>
Tested-by: Tomoya MORINAGA <tomoya-linux@dsn.okisemi.com>
Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
gpio/pch_gpio: Fix output value of pch_gpio_direction_output()

The pch_gpio_direction_output() function was missing a write to set the
desired output value.  The function would properly set the GPIO
direction, but not the output value.  The value would have to manually
be set with a follow up call to pch_gpio_set().

Add the missing write so that pch_gpio_direction_output() sets both the
GPIO direction and value.

Signed-off-by: Peter Tyser <ptyser@xes-inc.com>
Tested-by: Tomoya MORINAGA <tomoya-linux@dsn.okisemi.com>
Signed-off-by: Grant Likely <grant.likely@secretlab.ca>
mtd: mtdswap: fix printk format warning

The number is actually a sizeof(), so using %zu for it builds
cleanly on 32-bit or 64-bit.

drivers/mtd/mtdswap.c:1456: warning: format '%lu' expects type 'long unsigned int', but argument 4 has type 'unsigned int'

Signed-off-by: Randy Dunlap <randy.dunlap@oracle.com>
Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>
mtd: atmel_nand: trivial: change DMA usage information trace

Signed-off-by: Nicolas Ferre <nicolas.ferre@atmel.com>
Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@nokia.com>