kernfs: fix a subdir count leak

Currently kernfs_link_sibling() increates parent->dir.subdirs before
adding the node into parent's chidren rb tree.

Because it is possible that kernfs_link_sibling() couldn't find
a suitable slot and bail out, this leads to a mismatch between
elevated subdir count with actual children node numbers.

This patches fix this problem, by moving the subdir accouting
after the actual addtion happening.

Signed-off-by: Jianyu Zhan <nasa4836@gmail.com>
Acked-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
kernfs: add back missing error check in kernfs_fop_mmap()

While updating how mmap enabled kernfs files are handled by lockdep,
9b2db6e18945 ("sysfs: bail early from kernfs_file_mmap() to avoid
spurious lockdep warning") inadvertently dropped error return check
from kernfs_file_mmap().  The intention was just dropping "if
(ops->mmap)" check as the control won't reach the point if the mmap
callback isn't implemented, but I mistakenly removed the error return
check together with it.

This led to Xorg crash on i810 which was reported and bisected to the
commit and then to the specific change by Tobias.

Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-and-bisected-by: Tobias Powalowski <tobias.powalowski@googlemail.com>
Tested-by: Tobias Powalowski <tobias.powalowski@googlemail.com>
References: http://lkml.kernel.org/g/533D01BD.1010200@googlemail.com
Cc: stable <stable@vger.kernel.org> # 3.14
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
s390/ccwgroup: Fix memory corruption

commit 0b60f9ead5d4816e7e3d6e28f4a0d22d4a1b2513 (s390: use
device_remove_file_self() instead of device_schedule_callback())

caused random memory corruption on my s390 box. Turns out that the
last element of the ccwgroup structure is of dynamic size, so we
must move the newly introduced work structure _before_ the zero
length array.

Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
CC: Tejun Heo <tj@kernel.org>
CC: Martin Schwidefsky <schwidefsky@de.ibm.com>
CC: Heiko Carstens <heiko.carstens@de.ibm.com>
CC: Sebastian Ott <sebott@linux.vnet.ibm.com>
CC: Peter Oberparleiter <oberpar@linux.vnet.ibm.com>
Acked-by: Tejun Heo <tj@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Merge branch 'for-3.15' of git://linux-nfs.org/~bfields/linux

Pull nfsd bugfixes from Bruce Fields:
 "Three small nfsd bugfixes (including one locks.c fix for a bug
  triggered only from nfsd).

  Jeff's patches are for long-existing problems that became easier to
  trigger since the addition of vfs delegation support"

* 'for-3.15' of git://linux-nfs.org/~bfields/linux:
  Revert "nfsd4: fix nfs4err_resource in 4.1 case"
  nfsd: set timeparms.to_maxval in setup_callback_client
  locks: allow __break_lease to sleep even when break_time is 0
Merge tag 'locks-v3.15-2' of git://git.samba.org/jlayton/linux

Pull file locking fixes from Jeff Layton:
 "File locking related bugfixes for v3.15 (pile #2)

   - fix for a long-standing bug in __break_lease that can cause soft
     lockups
   - renaming of file-private locks to "open file description" locks,
     and the command macros to more visually distinct names

  The fix for __break_lease is also in the pile of patches for which
  Bruce sent a pull request, but I assume that your merge procedure will
  handle that correctly.

  For the other patches, I don't like the fact that we need to rename
  this stuff at this late stage, but it should be settled now
  (hopefully)"

* tag 'locks-v3.15-2' of git://git.samba.org/jlayton/linux:
  locks: rename FL_FILE_PVT and IS_FILE_PVT to use "*_OFDLCK" instead
  locks: rename file-private locks to "open file description locks"
  locks: allow __break_lease to sleep even when break_time is 0
Merge tag 'fixes-3.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc

Pull ARM SoC fixes from Arnd Bergmann:
 "Since we didn't get around to collect fixes in time for -rc2 over the
  easter vacation, this one is unfortunately a bit larger than we'd like
  for an -rc3 merge.

  A large set of the changes is in the device tree sources, so I'm
  splitting out the description between code changes and DT changes.
  Aside from omap and versatile express, the actual code bugs are and
  trivial.  Here is an overview:

  imx:
   - fix video clock settings
   - fix one clock refcounting bug

  omap:
   - update defconfig for renamed USB PHY driver
   - fix error handling in gpmc
   - fix N900 video initialization regression
   - fix reression in hwmod code from missing braces
   - fix am43xx and omap3 clocks
   - remove bogus write to voltage control register

  pxa:
   - fix build regression from 3.13 header cleanup

  rockchip:
   - fix a misleading printk string

  shmobile:
   - fix incorrect sound setting on multiple machines

  spear:
   - remove incorrect __init section annotation

  tegra:
   - remove a stale Kconfig entry

  u300:
   - update defconfig

  ux500:
   - enable common wireless and sensor drivers in defconfig
   - more defconfig updates

  vexpress:
   - fix voltage calculation for opp
   - fix reboot hang and warning
   - fix out-of-bounds array access
   - improve error handling in clock driver

  overall:
   - always select CLKSRC_OF in multiplatform builds

  And these are the devicetree related changes:

  imx:
   - add missing #clock-cell properties
   - fix pinctrl setting in imx6sl-evk
   - fix video endpoint on imx53
   - remove obsolete lvds-channel nodes (multiple patches)
   - add missing second stmpe node
   - fix usb host mode on dmo-edmqmx6 (multiple patches)
   - fix gic node #address-cells to match usage
   - add missing legacy IRQ map for PCIe
   - fix microsom pincontrol setting for rgmii
   - fix fatal typo in touchscreen DT usage for mx5
   - list all RAM present on m53evk and mx53qsb

  omap:
   - fix bug in DT handling of gpmc external bus
   - add DT for older revision of beagleboard
   - fix regression after DT node name fixes
   - remove obsolete properties for gpmc
   - fix pinmux comment to match DT it refers to
   - fix newly added dra7xx clock node data
   - add missing clock for USB PHY

  mvebu:
   - add missing clock for mdio node
   - fix nonstandard vendor prefixes on i2c nodes

  rockchip:
   - fix pin control setting for uart

  shmobile:
   - fix typo in DT data for pin control (multiple patches)
   - fix gic node #address-cells to match usage

  tegra:
   - fix clock and uart DT representation to match hardware

  zynq:
   - add DT nodes for newly added driver
   - add DT properties required for cpufreq-ondemand

  overall:
   - restore alphabetic order in Makefile
   - grammar fixes in bindings"

* tag 'fixes-3.15-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (66 commits)
  ARM: vexpress/TC2: Convert OPP voltage to uV before storing
  power/reset: vexpress: Fix restart/power off operation
  dt: tegra: remove non-existent clock IDs
  clk: tegra: remove non-existent clocks
  ARM: tegra: remove UART5/UARTE from tegra124.dtsi
  ARM: tegra: remove TEGRA_EMC_SCALING_ENABLE
  ARM: Tidy up DTB Makefile entries
  ARM: fix missing CLKSRC_OF on multi-platform
  ARM: spear: add __init to spear_clocksource_init()
  ARM: pxa: hx4700.h: include "irqs.h" for PXA_NR_BUILTIN_GPIO
  arm/mach-vexpress: array accessed out of bounds
  clk: vexpress: NULL dereference on error path
  ARM: OMAP2+: Fix GPMC remap for devices using an offset
  ARM: zynq: dt: Add I2C nodes to Zynq device tree
  ARM: zynq: DT: Add 'clock-latency' property
  ARM: OMAP2+: Fix oops for GPMC free
  ARM: dts: Add support for the BeagleBoard xM A/B
  ARM: dts: Grammar /that will/it will/
  ARM: dts: Grammar /is uses/ is used/
  ARM: OMAP2+: Fix config name for USB3 PHY
  ...
Merge tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi

Pull SCSI fixes from James Bottomley:
 "This is a set of seven fixes, three (hpsa) and free'd command
  references correcting bugs in the last round of updates and the
  remaining four correcting problems within the SCSI error handler that
  was causing a deadlock within USB"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  [SCSI] More USB deadlock fixes
  [SCSI] Fix USB deadlock caused by SCSI error handling
  [SCSI] Fix command result state propagation
  [SCSI] Fix spurious request sense in error handling
  [SCSI] don't reference freed command in scsi_prep_return
  [SCSI] don't reference freed command in scsi_init_sgtable
  [SCSI] hpsa: fix NULL dereference in hpsa_put_ctlr_into_performant_mode()
Merge tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging

Pull hwmon fixes from Guenter Roeck:
 - ltc2945: Don't unecessarily crash kernel on implementation error
 - vexpress: Fix 'name' and 'label' attributes

* tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  hwmon: (ltc2945) Don't crash the kernel unnecessarily
  hwmon: (vexpress) Avoid creating non-existing attributes
  hwmon: (vexpress) Use legal hwmon device names
ARM: mvebu: fix NOR bus-width in Armada XP GP Device Tree

The mvebu-devbus driver had a serious bug, which lead to a 8 bits bus
width declared in the Device Tree being considered as a 16 bits bus
width when configuring the hardware.

This bug in mvebu-devbus driver was compensated by a symetric mistake
in the Armada XP GP Device Tree: a 8 bits bus width was declared, even
though the hardware actually has a 16 bits bus width connection with
the NOR flash.

Now that we have fixed the mvebu-devbus driver to behave according to
its Device Tree binding, this commit fixes the problematic Device Tree
files as well.

This bug was introduced in commit
da8d1b38356853c37116f9afa29f15648d7fb159 ('ARM: mvebu: Add support for
NOR flash device on Armada XP-GP board') which was merged in v3.10.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Link: https://lkml.kernel.org/r/1397489361-5833-3-git-send-email-thomas.petazzoni@free-electrons.com
Fixes: da8d1b383568 ('ARM: mvebu: Add support for NOR flash device on Armada XP-GP board')
Cc: stable@vger.kernel.org # v3.10+
Acked-by: Ezequiel Garcia <ezequiel.garcia@free-electrons.com>
Acked-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: Jason Cooper <jason@lakedaemon.net>
ARM: mvebu: fix NOR bus-width in Armada XP DB Device Tree

The mvebu-devbus driver had a serious bug, which lead to a 8 bits bus
width declared in the Device Tree being considered as a 16 bits bus
width when configuring the hardware.

This bug in mvebu-devbus driver was compensated by a symetric mistake
in the Armada XP DB Device Tree: a 8 bits bus width was declared, even
though the hardware actually has a 16 bits bus width connection with
the NOR flash.

Now that we have fixed the mvebu-devbus driver to behave according to
its Device Tree binding, this commit fixes the problematic Device Tree
files as well.

This bug was introduced in commit
b484ff42df475c5087d614c4d477273e1906bcb9 ('ARM: mvebu: Add support for
NOR flash device on Armada XP-DB board') which was merged in v3.11.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Link: https://lkml.kernel.org/r/1397489361-5833-4-git-send-email-thomas.petazzoni@free-electrons.com
Fixes: b484ff42df47 ('ARM: mvebu: Add support for NOR flash device on Armada XP-DB board')
Cc: stable@vger.kernel.org # v3.11+
Acked-by: Ezequiel Garcia <ezequiel.garcia@free-electrons.com>
Acked-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: Jason Cooper <jason@lakedaemon.net>
ARM: mvebu: fix NOR bus-width in Armada XP OpenBlocks AX3 Device Tree

The mvebu-devbus driver had a serious bug, which lead to a 8 bits bus
width declared in the Device Tree being considered as a 16 bits bus
width when configuring the hardware.

This bug in mvebu-devbus driver was compensated by a symetric mistake
in the Armada XP OpenBlocks AX3 Device Tree: a 8 bits bus width was
declared, even though the hardware actually has a 16 bits bus width
connection with the NOR flash.

Now that we have fixed the mvebu-devbus driver to behave according to
its Device Tree binding, this commit fixes the problematic Device Tree
files as well.

This bug was introduced in commit
a7d4f81821f7eec3175f8e23dd6949c71ab2da43 ('ARM: mvebu: Add support for
NOR flash device on Openblocks AX3 board') which was merged in v3.10.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Link: https://lkml.kernel.org/r/1397489361-5833-5-git-send-email-thomas.petazzoni@free-electrons.com
Fixes: a7d4f81821f7 ('ARM: mvebu: Add support for NOR flash device on Openblocks AX3 board')
Cc: stable@vger.kernel.org # v3.10+
Acked-by: Ezequiel Garcia <ezequiel.garcia@free-electrons.com>
Acked-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Signed-off-by: Jason Cooper <jason@lakedaemon.net>
ARM: mvebu: use qsgmii phy-mode for Armada XP GP interfaces

The Armada XP GP isn't using rgmii-id connections between the MAC and
PHY, but instead a single QSGMII connection, which is a quad-SGMII
connection: a double pair of differential lines that are multiplexed
to convey the traffic of four network interfaces between a MAC and a
PHY.

Until now, the Armada XP GP was relying on the bootloader setting the
correct values in various configuration registers. With this change,
the mvneta driver can be used as a module on this platform.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Link: https://lkml.kernel.org/r/1397569821-5530-4-git-send-email-thomas.petazzoni@free-electrons.com
Tested-by: Arnaud Ebalard <arno@natisbad.org>
Tested-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Jason Cooper <jason@lakedaemon.net>
ARM: mvebu: specify I2C bus frequency on Armada 370 DB

In commit 249f3822509b74f8c8d0731aeb7ccea065376c9b ('ARM: mvebu: add
audio support to Armada 370 DB'), the I2C bus 0 was enabled on the
Armada 370 DB board, and an I2C codec was described as being connected
on this bus.

However, this commit forgot to define the I2C bus frequency, which
leads the i2c-mv64xxx to fail probing, as it cannot calculate the baud
rate multiplier/divisor to derive the I2C bus frequency from the core
SoC frequency. It makes audio completely unusable, as the I2C bus is
not probed, and therefore the audio codec is not probed either.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Acked-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Link: https://lkml.kernel.org/r/1397806908-7550-2-git-send-email-thomas.petazzoni@free-electrons.com
Signed-off-by: Jason Cooper <jason@lakedaemon.net>
ARM: mvebu: enable the SATA interface on Armada 375 DB

The Armada 375 SoC has a dual-port SATA interface, which is exposed on
the Armada 375 DB board. This commit therefore enables this interface
on the Armada 375 DB board.

Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Acked-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Link: https://lkml.kernel.org/r/1397806908-7550-3-git-send-email-thomas.petazzoni@free-electrons.com
Signed-off-by: Jason Cooper <jason@lakedaemon.net>
ARM: Kirkwood: T5325: Fix double probe of Codec

The codec is defined both in DT and the board file. The board file
however contains platform data which is required in order that the
codec works. When the DT instantiates the codec before the board files
does, it is missing the platform data and so fails. Remove the DT node
until we have a binding which can pass the additional data.

Signed-off-by: Andrew Lunn <andrew@lunn.ch>
Link: https://lkml.kernel.org/r/1397565608-1830-1-git-send-email-andrew@lunn.ch
Signed-off-by: Jason Cooper <jason@lakedaemon.net>
Merge branches 'pnp' and 'acpi-hotplug'

* pnp:
  PNP: Work around BIOS defects in Intel MCH area reporting

* acpi-hotplug:
  ACPI / notify: Do not block unknown type notifications in root handler
mm: split 'tlb_flush_mmu()' into tlb flushing and memory freeing parts

The mmu-gather operation 'tlb_flush_mmu()' has done two things: the
actual tlb flush operation, and the batched freeing of the pages that
the TLB entries pointed at.

This splits the operation into separate phases, so that the forced
batched flushing done by zap_pte_range() can now do the actual TLB flush
while still holding the page table lock, but delay the batched freeing
of all the pages to after the lock has been dropped.

This in turn allows us to avoid a race condition between
set_page_dirty() (as called by zap_pte_range() when it finds a dirty
shared memory pte) and page_mkclean(): because we now flush all the
dirty page data from the TLB's while holding the pte lock,
page_mkclean() will be held up walking the (recently cleaned) page
tables until after the TLB entries have been flushed from all CPU's.

Reported-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Tested-by: Dave Hansen <dave.hansen@intel.com>
Acked-by: Hugh Dickins <hughd@google.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: Russell King - ARM Linux <linux@arm.linux.org.uk>
Cc: Tony Luck <tony.luck@intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Merge tag 'at91-fixes' of git://github.com/at91linux/linux-at91 into fixes

3.15 fixes for AT91
- one little DT fix
- the use of proper directory for clock in include/dt-bindings
  it allows to remove the now empty include/dt-bindings/clk

* tag 'at91-fixes' of git://github.com/at91linux/linux-at91:
  dt-bindings: clock: Move at91.h to dt-bindigs/clock
  ARM: at91: fix spi cs on sama5d3 Xplained board

Signed-off-by: Arnd Bergmann <arnd@arndb.de>
staging:iio:ad2s1200 fix missing parenthesis in a for statment.

Signed-off-by: Jimmy Li <coder.liss@gmail.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
iio:imu:mpu6050: Fixed segfault in Invensens MPU driver due to null dereference

The driver segfaults when the kernel boots with device tree as the
platform data is then not present and the pointer is deferenced without
checking it is not null.  This patch introduces such a check avoiding the
crash.

Signed-off-by: Atilla Filiz <atilla.filiz@essensium.com>
Signed-off-by: Jonathan Cameron <jic23@kernel.org>
Cc: Stable@vger.kernel.org