reiserfs: fix corruption introduced by balance_leaf refactor

Commits f1f007c308e (reiserfs: balance_leaf refactor, pull out
balance_leaf_insert_left) and cf22df182bf (reiserfs: balance_leaf
refactor, pull out balance_leaf_paste_left) missed that the `body'
pointer was getting repositioned. Subsequent users of the pointer
would expect it to be repositioned, and as a result, parts of the
tree would get overwritten. The most common observed corruption
is indirect block pointers being overwritten.

Since the body value isn't actually used anymore in the called routines,
we can pass back the offset it should be shifted. We constify the body
and ih pointers in the balance_leaf as a mostly-free preventative measure.

Cc: <stable@vger.kernel.org> # 3.16
Reported-and-tested-by: Jeff Chua <jeff.chua.linux@gmail.com>
Signed-off-by: Jeff Mahoney <jeffm@suse.com>
Signed-off-by: Jan Kara <jack@suse.cz>
Merge branch 'drm-next-3.17' of git://people.freedesktop.org/~agd5f/linux into drm-next

- Additional Hawaii fixes
- Support for using the display scaler on non-fixed mode displays
- Support for new firmware format that makes it easier to update
- Enable dpm by default on additional asics
- GPUVM improvements
- Support for uncached and write combined gtt buffers
- Allow allocation of BOs larger than visible vram
- Various other small fixes and improvements

* 'drm-next-3.17' of git://people.freedesktop.org/~agd5f/linux: (57 commits)
  drm/radeon: Prevent hdmi deep color if max_tmds_clock is undefined.
  drm/radeon: Use pflip irqs for pageflip completion if possible. (v2)
  drm/radeon: tweak ACCEL_WORKING2 query for the new firmware for hawaii
  drm/radeon: use packet3 for nop on hawaii with new firmware
  drm/radeon: tweak ACCEL_WORKING2 query for hawaii
  drm/radeon: use packet2 for nop on hawaii with old firmware
  drm/radeon: update IB size estimation for VM
  drm/radeon: split PT setup in more functions
  drm/radeon: add VM GART copy optimization to NI as well
  drm/radeon: take a BO reference on VM cleanup
  drm/radeon: add radeon_bo_ref function
  drm/radeon: remove taking mclk_lock from radeon_bo_unref
  drm/radeon: adjust default radeon_vm_block_size v2
  drm/radeon: try to enable VM flushing once more
  drm/radeon: use an intervall tree to manage the VMA v2
  drm/radeon: remove radeon_bo_clear_va
  drm/radeon: invalidate moved BOs in the VM (v2)
  drm/radeon: re-enable dpm by default on BTC
  drm/radeon: re-enable dpm by default on cayman
  drm/radeon: Only flush HDP cache from idle ioctl if BO is in VRAM
  ...
Merge tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging

Pull hwmon updates from Guenter Roeck:
 "Notable changes:

   - Heiko Schocher provided a driver for TI TMP103.
   - Kamil Debski provided a driver for pwm-controlled fans.
   - Neelesh Gupta provided a driver for power, fan rpm, voltage and
     temperature reporting on powerpc/powernv systems.
   - Scott Kanowitz provided a driver supporting Lattice's POWR1220
     power manager IC.
   - Richard Zhu provided a pmbus front-end driver for TPS40422.
   - Frans Klaver added support for TMP112 to the lm75 driver.
   - Johannes Pointner added support for EPCOS B57330V2103 to the
     ntc_thermistor driver.
   - Guenter Roeck added support for TMP441 and TMP442 to the tmp421
     driver.
   - Axel Lin converted several drivers to the new hwmon API (36 of
     them, if I counted correctly), and cleaned up many of the drivers
     along the way.

  There are also a number of patches fixing bugs discovered while
  testing Axel's changes"

* tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (88 commits)
  hwmon: (g762) Use of_property_read_u32 at appropriate place
  hwmon: (sis5595) Prevent overflow problem when writing large limits
  hwmon: (gpio-fan) Prevent overflow problem when writing large limits
  hwmon: (ibmpowernv) Use of_property_read_u32 at appropriate place
  hwmon: (lm85) Convert to devm_hwmon_device_register_with_groups
  hwmon: (lm85) Avoid forward declaration
  hwmon: (lm78) Convert to devm_hwmon_device_register_with_groups
  hwmon: (max6697) Use of_property_read_bool at appropriate places
  hwmon: (pwm-fan) Make SENSORS_PWM_FAN depend on OF
  hwmon: (pwm-fan) Remove duplicate dev_set_drvdata call
  hwmon: (nct6775) Remove num_attr_groups from struct nct6775_data
  hwmon: (nct6775) Update module description and Kconfig for NCT6106D and NCT6791D
  hwmon: (adt7411) Convert to devm_hwmon_device_register_with_groups
  hwmon: (g762) Convert to hwmon_device_register_with_groups
  hwmon: (emc2103) Convert to devm_hwmon_device_register_with_groups
  hwmon: (smsc47m1) Avoid forward declaration
  hwmon: (smsc47m192) Convert to devm_hwmon_device_register_with_groups
  hwmon: (smsc47m192) Avoid forward declaration
  hwmon: (max1668) Make max1668_addr_list array const
  hwmon: (max6639) Make normal_i2c array const
  ...
Merge tag 'iommu-updates-v3.17' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu

Pull iommu updates from Joerg Roedel:
 "This time with:

   - support for the generic PCI device alias code in x86 IOMMU drivers

   - a new sysfs interface for IOMMUs

   - preparations for hotplug support in the Intel IOMMU driver

   - change the AMD IOMMUv2 driver to not hold references to core data
     structures like mm_struct or task_struct.  Rely on mmu_notifers
     instead.

   - removal of the OMAP IOVMM interface, all users of it are converted
     to DMA-API now

   - make the struct iommu_ops const everywhere

   - initial PCI support for the ARM SMMU driver

   - there is now a generic device tree binding documented for ARM
     IOMMUs

   - various fixes and cleanups all over the place

  Also included are some changes to the OMAP code, which are acked by
  the maintainer"

* tag 'iommu-updates-v3.17' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu: (67 commits)
  devicetree: Add generic IOMMU device tree bindings
  iommu/vt-d: Fix race setting IRQ CPU affinity while freeing IRQ
  iommu/amd: Fix 2 typos in comments
  iommu/amd: Fix device_state reference counting
  iommu/amd: Remove change_pte mmu_notifier call-back
  iommu/amd: Don't set pasid_state->mm to NULL in unbind_pasid
  iommu/exynos: Select ARM_DMA_USE_IOMMU
  iommu/vt-d: Exclude devices using RMRRs from IOMMU API domains
  iommu/omap: Remove platform data da_start and da_end fields
  ARM: omap: Don't set iommu pdata da_start and da_end fields
  iommu/omap: Remove virtual memory manager
  iommu/vt-d: Fix issue in computing domain's iommu_snooping flag
  iommu/vt-d: Introduce helper function iova_size() to improve code readability
  iommu/vt-d: Introduce helper domain_pfn_within_range() to simplify code
  iommu/vt-d: Simplify intel_unmap_sg() and kill duplicated code
  iommu/vt-d: Change iommu_enable/disable_translation to return void
  iommu/vt-d: Simplify include/linux/dmar.h
  iommu/vt-d: Avoid freeing virtual machine domain in free_dmar_iommu()
  iommu/vt-d: Fix possible invalid memory access caused by free_dmar_iommu()
  iommu/vt-d: Allocate dynamic domain id for virtual domains only
  ...
xen-netback: Using a new state bit instead of carrier

This patch introduces a new state bit VIF_STATUS_CONNECTED to track whether the
vif is in a connected state. Using carrier will not work with the next patch
in this series, which aims to turn the carrier temporarily off if the guest
doesn't seem to be able to receive packets.

Signed-off-by: Zoltan Kiss <zoltan.kiss@citrix.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Cc: netdev@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: xen-devel@lists.xenproject.org

v2:
- rename the bitshift type to "enum state_bit_shift" here, not in the next patch
Signed-off-by: David S. Miller <davem@davemloft.net>
xen-netback: Turn off the carrier if the guest is not able to receive

Currently when the guest is not able to receive more packets, qdisc layer starts
a timer, and when it goes off, qdisc is started again to deliver a packet again.
This is a very slow way to drain the queues, consumes unnecessary resources and
slows down other guests shutdown.
This patch change the behaviour by turning the carrier off when that timer
fires, so all the packets are freed up which were stucked waiting for that vif.
Instead of the rx_queue_purge bool it uses the VIF_STATUS_RX_PURGE_EVENT bit to
signal the thread that either the timeout happened or an RX interrupt arrived,
so the thread can check what it should do. It also disables NAPI, so the guest
can't transmit, but leaves the interrupts on, so it can resurrect.
Only the queues which brought down the interface can enable it again, the bit
QUEUE_STATUS_RX_STALLED makes sure of that.

Signed-off-by: Zoltan Kiss <zoltan.kiss@citrix.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Cc: netdev@vger.kernel.org
Cc: linux-kernel@vger.kernel.org
Cc: xen-devel@lists.xenproject.org
Signed-off-by: David S. Miller <davem@davemloft.net>
Merge branch 'xen-netback-next'

Zoltan Kiss says:

====================
xen-netback: Changes around carrier handling

This series starts using carrier off as a way to purge packets when the guest is
not able (or willing) to receive them. It is a much faster way to get rid of
packets waiting for an overwhelmed guest.
The first patch changes current netback code where it relies currently on
netif_carrier_ok.
The second turns off the carrier if the guest times out on a queue, and only
turn it on again if that queue (or queues) resurrects.
====================

Signed-off-by: Zoltan Kiss <zoltan.kiss@citrix.com>
Signed-off-by: David Vrabel <david.vrabel@citrix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Merge tag 'spi-v3.17' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi

Pull spi updates from Mark Brown:
 "A quiet release, more bug fixes than anything else.  A few things do
  stand out though:

   - updates to several drivers to move towards the standard GPIO chip
     select handling in the core.
   - DMA support for the SH MSIOF driver.
   - support for Rockchip SPI controllers (their first mainline
     submission)"

* tag 'spi-v3.17' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (64 commits)
  spi: davinci: use spi_device.cs_gpio to store gpio cs per spi device
  spi: davinci: add support to configure gpio cs through dt
  spi/pl022: Explicitly truncate large bitmask
  spi/atmel: Fix pointer to int conversion warnings on 64 bit builds
  spi: davinci: fix to support more than 2 chip selects
  spi: topcliff-pch: don't hardcode PCI slot to get DMA device
  spi: orion: fix incorrect handling of cell-index DT property
  spi: orion: Fix error return code in orion_spi_probe()
  spi/rockchip: fix error return code in rockchip_spi_probe()
  spi/rockchip: remove redundant dev_err call in rockchip_spi_probe()
  spi/rockchip: remove duplicated include from spi-rockchip.c
  ARM: dts: fix the chip select gpios definition in the SPI nodes
  spi: s3c64xx: Update binding documentation
  spi: s3c64xx: use the generic SPI "cs-gpios" property
  spi: s3c64xx: Revert "spi: s3c64xx: Added provision for dedicated cs pin"
  spi: atmel: Use dmaengine_prep_slave_sg() API
  spi: topcliff-pch: Update error messages for dmaengine_prep_slave_sg() API
  spi: sh-msiof: Use correct device for DMA mapping with IOMMU
  spi: sh-msiof: Handle dmaengine_prep_slave_single() failures gracefully
  spi: rspi: Handle dmaengine_prep_slave_sg() failures gracefully
  ...
Merge tag 'regulator-v3.17' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator

Pull regulator updates from Mark Brown:
 "A couple of nice new features this month, the ability to map
  regulators in order to allow voltage control by external coprocessors
  is something people have been asking for for a long time.

   - improved support for switch only "regulators", allowing current
     state to be read from the parent regulator but no setting.

   - support for obtaining the register access method used to set
     voltages, for use in systems which can offload control of this to a
     coprocessor (typically for DVFS).

   - support for Active-Semi AC8846, Dialog DA9211 and Texas Instruments
     TPS65917"

* tag 'regulator-v3.17' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator: (58 commits)
  regulator: act8865: fix build when OF is not enabled
  regulator: act8865: add act8846 to DT binding documentation
  regulator: act8865: add support for act8846
  regulator: act8865: prepare support for other act88xx devices
  regulator: act8865: set correct number of regulators in pdata
  regulator: act8865: Remove error variable in act8865_pmic_probe
  regulator: act8865: fix parsing of platform data
  regulator: tps65090: Set voltage for fixed regulators
  regulator: core: Allow to get voltage count and list from parent
  regulator: core: Get voltage from parent if not available
  regulator: Add missing statics and inlines for stub functions
  regulator: lp872x: Don't set constraints within the regulator driver
  regmap: Fix return code for stub regmap_get_device()
  regulator: s2mps11: Update module description and Kconfig to add S2MPU02 support
  regulator: Add helpers for low-level register access
  regmap: Allow regmap_get_device() to be used by modules
  regmap: Add regmap_get_device
  regulator: da9211: Remove unnecessary devm_regulator_unregister() calls
  regulator: Add DT bindings for tps65218 PMIC regulators.
  regulator: da9211: new regulator driver
  ...
Merge tag 'batman-adv-fix-for-davem' of git://git.open-mesh.org/linux-merge

Antonio Quartulli says:

====================
pull request net: batman-adv 2014-08-04

this is a pull request intended for net.

It just contains a patch by Sven Eckelmann that fixes the
reception of out-of-order fragments. As explained in the
commit message, the issue was due to a wrong assumption
about hlist_for_each_entry() in batadv_frag_insert_packet().
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
qlcnic: Fix update of ethtool stats.

o Aggregating tx stats in adapter variable was resulting in
  an increase in stats even after no traffic was run and
  user runs ifconfig/ethtool command.
o qlcnic_update_stats used to accumulate stats in adapter
  struct at each function call, instead accumulate tx stats
  in local variable and then assign it to adapter structure.

Reported-by: Holger Kiehl <holger.kiehl@dwd.de>
Signed-off-by: Rajesh Borundia <rajesh.borundia@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
qlcnic: Set driver version before registering netdev

o Earlier, set_drv_version was getting called after register_netdev.
  This was resulting in a race between set_drv_version and FLR called
  from open(). Moving set_drv_version before register_netdev avoids
  the race.

o Log response code in error message on CDRP failure.

Signed-off-by: Rajesh Borundia <rajesh.borundia@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
qlcnic: Initialize dcbnl_ops before register_netdev

o Initialization of dcbnl_ops after register netdev may result in
  dcbnl_ops not getting set before it is being accessed from open.
  So, moving it before register_netdev.

Signed-off-by: Rajesh Borundia <rajesh.borundia@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Merge branch 'qlcnic'

Rajesh Borundia says:

====================
qlcnic: Bug fixes

The patch series contains following bug fixes.

* Aggregating tx stats in adapter variable was resulting
  in increase of stats when user runs ifconfig command
  and no traffic is running. Instead aggregate tx stats
  in local variable and then assign it to adapter struct
  variable.
* Set_driver_version was called after registering netdev
  which was resulting in a race between FLR in open
  handler and set_driver_version command as open handler
  can be called simulatneously on another cpu even if probe
  is not complete. So call this command before registering
  netdev.
* dcbnl_ops should be initialized before registering netdev
  as they are referenced in open handler.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
tcp: reduce spurious retransmits due to transient SACK reneging

This commit reduces spurious retransmits due to apparent SACK reneging
by only reacting to SACK reneging that persists for a short delay.

When a sequence space hole at snd_una is filled, some TCP receivers
send a series of ACKs as they apparently scan their out-of-order queue
and cumulatively ACK all the packets that have now been consecutiveyly
received. This is essentially misbehavior B in "Misbehaviors in TCP
SACK generation" ACM SIGCOMM Computer Communication Review, April
2011, so we suspect that this is from several common OSes (Windows
2000, Windows Server 2003, Windows XP). However, this issue has also
been seen in other cases, e.g. the netdev thread "TCP being hoodwinked
into spurious retransmissions by lack of timestamps?" from March 2014,
where the receiver was thought to be a BSD box.

Since snd_una would temporarily be adjacent to a previously SACKed
range in these scenarios, this receiver behavior triggered the Linux
SACK reneging code path in the sender. This led the sender to clear
the SACK scoreboard, enter CA_Loss, and spuriously retransmit
(potentially) every packet from the entire write queue at line rate
just a few milliseconds before the ACK for each packet arrives at the
sender.

To avoid such situations, now when a sender sees apparent reneging it
does not yet retransmit, but rather adjusts the RTO timer to give the
receiver a little time (max(RTT/2, 10ms)) to send us some more ACKs
that will restore sanity to the SACK scoreboard. If the reneging
persists until this RTO then, as before, we clear the SACK scoreboard
and enter CA_Loss.

A 10ms delay tolerates a receiver sending such a stream of ACKs at
56Kbit/sec. And to allow for receivers with slower or more congested
paths, we wait for at least RTT/2.

We validated the resulting max(RTT/2, 10ms) delay formula with a mix
of North American and South American Google web server traffic, and
found that for ACKs displaying transient reneging:

 (1) 90% of inter-ACK delays were less than 10ms
 (2) 99% of inter-ACK delays were less than RTT/2

In tests on Google web servers this commit reduced reneging events by
75%-90% (as measured by the TcpExtTCPSACKReneging counter), without
any measurable impact on latency for user HTTP and SPDY requests.

Signed-off-by: Neal Cardwell <ncardwell@google.com>
Signed-off-by: Yuchung Cheng <ycheng@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
cxgb4i : Move stray CPL definitions to cxgb4 driver

These belong to the t4 msg header, will ensure there is no accidental code
duplication in the future

Signed-off-by: Anish Bhatt <anish@chelsio.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net-timestamp: extend SCM_TIMESTAMPING ancillary data struct

Applications that request kernel tx timestamps with SO_TIMESTAMPING
read timestamps as recvmsg() ancillary data. The response is defined
implicitly as timespec[3].

1) define struct scm_timestamping explicitly and

2) add support for new tstamp types. On tx, scm_timestamping always
   accompanies a sock_extended_err. Define previously unused field
   ee_info to signal the type of ts[0]. Introduce SCM_TSTAMP_SND to
   define the existing behavior.

The reception path is not modified. On rx, no struct similar to
sock_extended_err is passed along with SCM_TIMESTAMPING.

Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net-timestamp: move timestamp flags out of sk_flags

sk_flags is reaching its limit. New timestamping options will not fit.
Move all of them into a new field sk->sk_tsflags.

Added benefit is that this removes boilerplate code to convert between
SOF_TIMESTAMPING_.. and SOCK_TIMESTAMPING_.. in getsockopt/setsockopt.

SOCK_TIMESTAMPING_RX_SOFTWARE is also used to toggle the receive
timestamp logic (netstamp_needed). That can be simplified and this
last key removed, but will leave that for a separate patch.

Signed-off-by: Willem de Bruijn <willemb@google.com>

----

The u16 in sock can be moved into a 16-bit hole below sk_gso_max_segs,
though that scatters tstamp fields throughout the struct.
Signed-off-by: David S. Miller <davem@davemloft.net>
net-timestamp: add key to disambiguate concurrent datagrams

Datagrams timestamped on transmission can coexist in the kernel stack
and be reordered in packet scheduling. When reading looped datagrams
from the socket error queue it is not always possible to unique
correlate looped data with original send() call (for application
level retransmits). Even if possible, it may be expensive and complex,
requiring packet inspection.

Introduce a data-independent ID mechanism to associate timestamps with
send calls. Pass an ID alongside the timestamp in field ee_data of
sock_extended_err.

The ID is a simple 32 bit unsigned int that is associated with the
socket and incremented on each send() call for which software tx
timestamp generation is enabled.

The feature is enabled only if SOF_TIMESTAMPING_OPT_ID is set, to
avoid changing ee_data for existing applications that expect it 0.
The counter is reset each time the flag is reenabled. Reenabling
does not change the ID of already submitted data. It is possible
to receive out of order IDs if the timestamp stream is not quiesced
first.

Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
net-timestamp: SCHED timestamp on entering packet scheduler

Kernel transmit latency is often incurred in the packet scheduler.
Introduce a new timestamp on transmission just before entering the
scheduler. When data travels through multiple devices (bonding,
tunneling, ...) each device will export an individual timestamp.

Signed-off-by: Willem de Bruijn <willemb@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>