origin

GIT 005f800508eb391480f463dad3d54e5b4ec67d57

commit 35607b02dbef304fa5037236a3b43c1d8ab2aa52
Author: Alexei Starovoitov <ast@plumgrid.com>
Date:   Tue Sep 23 13:50:10 2014 -0700

    sparc: bpf_jit: fix loads from negative offsets
    
    - fix BPF_LD|ABS|IND from negative offsets:
      make sure to sign extend lower 32 bits in 64-bit register
      before calling C helpers from JITed code, otherwise 'int k'
      argument of bpf_internal_load_pointer_neg_helper() function
      will be added as large unsigned integer, causing packet size
      check to trigger and abort the program.
    
      It's worth noting that JITed code for 'A = A op K' will affect
      upper 32 bits differently depending whether K is simm13 or not.
      Since small constants are sign extended, whereas large constants
      are stored in temp register and zero extended.
      That is ok and we don't have to pay a penalty of sign extension
      for every sethi, since all classic BPF instructions have 32-bit
      semantics and we only need to set correct upper bits when
      transitioning from JITed code into C.
    
    - though instructions 'A &= 0' and 'A *= 0' are odd, JIT compiler
      should not optimize them out
    
    Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit c899c3f36458c6af6daf4bb405a715400de39b84
Author: David S. Miller <davem@davemloft.net>
Date:   Wed Sep 24 13:53:53 2014 -0400

    parisc: Update defconfigs which were missing CONFIG_NET.
    
    Commit df568d8e ("scsi: Use 'depends' with LIBFC instead of
    'select'.")  removed what happened to be the only instance of 'select
    NET'. Defconfigs that were relying on the select now lack networking
    support.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 95d77997fd8a2dc1eca9a46cde761ddb0742eec3
Author: David S. Miller <davem@davemloft.net>
Date:   Wed Sep 24 13:53:43 2014 -0400

    powerpc: Update defconfigs which were missing CONFIG_NET.
    
    Commit df568d8e ("scsi: Use 'depends' with LIBFC instead of
    'select'.")  removed what happened to be the only instance of 'select
    NET'. Defconfigs that were relying on the select now lack networking
    support.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit ff408ba1fc97aef86af5715641760a33f0928423
Author: David S. Miller <davem@davemloft.net>
Date:   Wed Sep 24 13:44:32 2014 -0400

    s390: Update defconfigs which were missing CONFIG_NET.
    
    Commit df568d8e ("scsi: Use 'depends' with LIBFC instead of
    'select'.")  removed what happened to be the only instance of 'select
    NET'. Defconfigs that were relying on the select now lack networking
    support.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit af4de1b56816fdde40801d9f6c4a0e251f5f7047
Author: David S. Miller <davem@davemloft.net>
Date:   Wed Sep 24 13:44:16 2014 -0400

    mips: Update some more defconfigs which were missing CONFIG_NET.
    
    Commit df568d8e ("scsi: Use 'depends' with LIBFC instead of
    'select'.")  removed what happened to be the only instance of 'select
    NET'. Defconfigs that were relying on the select now lack networking
    support.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 1ab0b8b200ae54a03aaf63fa8ae5a241dd0cb499
Author: Michal Marek <mmarek@suse.cz>
Date:   Tue Sep 23 17:44:04 2014 +0200

    sparc: Set CONFIG_NET=y in defconfigs
    
    Commit 5d6be6a5 ("scsi_netlink : Make SCSI_NETLINK dependent on NET
    instead of selecting NET") removed what happened to be the only instance
    of 'select NET'. Defconfigs that were relying on the select now lack
    networking support.
    
    Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
    Cc: sparclinux@vger.kernel.org
    Signed-off-by: Michal Marek <mmarek@suse.cz>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 925f7fadadd2fcafa6fea19252e4a1de412b9b85
Author: Michal Marek <mmarek@suse.cz>
Date:   Tue Sep 23 17:44:03 2014 +0200

    sh: Set CONFIG_NET=y in defconfigs
    
    Commit 5d6be6a5 ("scsi_netlink : Make SCSI_NETLINK dependent on NET
    instead of selecting NET") removed what happened to be the only instance
    of 'select NET'. Defconfigs that were relying on the select now lack
    networking support.
    
    Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
    Cc: linux-sh@vger.kernel.org
    Signed-off-by: Michal Marek <mmarek@suse.cz>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 853e3e1d8e2f094cdb29d4a6e2359a96a44be0d8
Author: Michal Marek <mmarek@suse.cz>
Date:   Tue Sep 23 17:44:02 2014 +0200

    powerpc: Set CONFIG_NET=y in defconfigs
    
    Commit 5d6be6a5 ("scsi_netlink : Make SCSI_NETLINK dependent on NET
    instead of selecting NET") removed what happened to be the only instance
    of 'select NET'. Defconfigs that were relying on the select now lack
    networking support.
    
    Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
    Cc: linuxppc-dev@lists.ozlabs.org
    Signed-off-by: Michal Marek <mmarek@suse.cz>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 25fee47f9ccd834bfb95c6f95e07033b0f2d5ddf
Author: Michal Marek <mmarek@suse.cz>
Date:   Tue Sep 23 17:44:01 2014 +0200

    parisc: Set CONFIG_NET=y in defconfigs
    
    Commit 5d6be6a5 ("scsi_netlink : Make SCSI_NETLINK dependent on NET
    instead of selecting NET") removed what happened to be the only instance
    of 'select NET'. Defconfigs that were relying on the select now lack
    networking support.
    
    Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
    Cc: linux-parisc@vger.kernel.org
    Signed-off-by: Michal Marek <mmarek@suse.cz>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit d1630f9ef288978fc5a4cd14a5fdcb7be7a703e4
Author: Michal Marek <mmarek@suse.cz>
Date:   Tue Sep 23 17:44:00 2014 +0200

    mips: Set CONFIG_NET=y in defconfigs
    
    Commit 5d6be6a5 ("scsi_netlink : Make SCSI_NETLINK dependent on NET
    instead of selecting NET") removed what happened to be the only instance
    of 'select NET'. Defconfigs that were relying on the select now lack
    networking support.
    
    Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
    Cc: linux-mips@linux-mips.org
    Signed-off-by: Michal Marek <mmarek@suse.cz>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 0a30288da1aec914e158c2d7a3482a85f632750f
Author: Tejun Heo <tj@kernel.org>
Date:   Tue Sep 23 15:24:32 2014 -0400

    blk-mq, percpu_ref: implement a kludge for SCSI blk-mq stall during probe
    
    blk-mq uses percpu_ref for its usage counter which tracks the number
    of in-flight commands and used to synchronously drain the queue on
    freeze.  percpu_ref shutdown takes measureable wallclock time as it
    involves a sched RCU grace period.  This means that draining a blk-mq
    takes measureable wallclock time.  One would think that this shouldn't
    matter as queue shutdown should be a rare event which takes place
    asynchronously w.r.t. userland.
    
    Unfortunately, SCSI probing involves synchronously setting up and then
    tearing down a lot of request_queues back-to-back for non-existent
    LUNs.  This means that SCSI probing may take more than ten seconds
    when scsi-mq is used.
    
    This will be properly fixed by implementing a mechanism to keep
    q->mq_usage_counter in atomic mode till genhd registration; however,
    that involves rather big updates to percpu_ref which is difficult to
    apply late in the devel cycle (v3.17-rc6 at the moment).  As a
    stop-gap measure till the proper fix can be implemented in the next
    cycle, this patch introduces __percpu_ref_kill_expedited() and makes
    blk_mq_freeze_queue() use it.  This is heavy-handed but should work
    for testing the experimental SCSI blk-mq implementation.
    
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Reported-by: Christoph Hellwig <hch@infradead.org>
    Link: http://lkml.kernel.org/g/20140919113815.GA10791@lst.de
    Fixes: add703fda981 ("blk-mq: use percpu_ref for mq usage count")
    Cc: Kent Overstreet <kmo@daterainc.com>
    Cc: Jens Axboe <axboe@kernel.dk>
    Tested-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Jens Axboe <axboe@fb.com>

commit 7da4b29d496b1389d3a29b55d3668efecaa08ebd
Author: Mathias Krause <minipli@googlemail.com>
Date:   Tue Sep 23 22:31:07 2014 +0200

    crypto: aesni - disable "by8" AVX CTR optimization
    
    The "by8" implementation introduced in commit 22cddcc7df8f ("crypto: aes
    - AES CTR x86_64 "by8" AVX optimization") is failing crypto tests as it
    handles counter block overflows differently. It only accounts the right
    most 32 bit as a counter -- not the whole block as all other
    implementations do. This makes it fail the cryptomgr test #4 that
    specifically tests this corner case.
    
    As we're quite late in the release cycle, just disable the "by8" variant
    for now.
    
    Reported-by: Romain Francoise <romain@orebokech.com>
    Signed-off-by: Mathias Krause <minipli@googlemail.com>
    Cc: Chandramouli Narayanan <mouli@linux.intel.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

commit c9f21cb6388898bfe69886d001316dae7ecc9a4b
Author: Tom Lendacky <thomas.lendacky@amd.com>
Date:   Fri Sep 5 10:31:09 2014 -0500

    crypto: ccp - Check for CCP before registering crypto algs
    
    If the ccp is built as a built-in module, then ccp-crypto (whether
    built as a module or a built-in module) will be able to load and
    it will register its crypto algorithms.  If the system does not have
    a CCP this will result in -ENODEV being returned whenever a command
    is attempted to be queued by the registered crypto algorithms.
    
    Add an API, ccp_present(), that checks for the presence of a CCP
    on the system.  The ccp-crypto module can use this to determine if it
    should register it's crypto alogorithms.
    
    Cc: stable@vger.kernel.org
    Reported-by: Scot Doyle <lkml14@scotdoyle.com>
    Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
    Tested-by: Scot Doyle <lkml14@scotdoyle.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

commit d26a7730b5874a5fa6779c62f4ad7c5065a94723
Author: John David Anglin <dave.anglin@bell.net>
Date:   Mon Sep 22 20:54:50 2014 -0400

    parisc: Only use -mfast-indirect-calls option for 32-bit kernel builds
    
    In spite of what the GCC manual says, the -mfast-indirect-calls has
    never been supported in the 64-bit parisc compiler. Indirect calls have
    always been done using function descriptors irrespective of the
    -mfast-indirect-calls option.
    
    Recently, it was noticed that a function descriptor was always requested
    when the -mfast-indirect-calls option was specified. This caused
    problems when the option was used in  application code and doesn't make
    any sense because the whole point of the option is to avoid using a
    function descriptor for indirect calls.
    
    Fixing this broke 64-bit kernel builds.
    
    I will fix GCC but for now we need the attached change. This results in
    the same kernel code as before.
    
    Signed-off-by: John David Anglin <dave.anglin@bell.net>
    Cc: stable@vger.kernel.org  # v3.0+
    Signed-off-by: Helge Deller <deller@gmx.de>

commit e8ee39e227d72823461907156f0046269d72ff15
Author: Tony Luck <tony.luck@intel.com>
Date:   Mon Sep 22 09:35:11 2014 -0700

    [IA64] refresh arch/ia64/configs/* using "make savedefconfig"
    
    Prompted by a change to drivers/scsi/Kconfig which used to do a
    "select NET" but now does a "depends on NET". This meant that some
    configurations ended up without CONFIG_NET=y
    
    Signed-off-by Tony Luck <tony.luck@intel.com>

commit f8adaf0ae978252c9f7e29e96aefcd8fcaf806ba
Author: Emil Goode <emilgoode@gmail.com>
Date:   Tue Sep 23 00:49:55 2014 +0200

    brcmfmac: Fix off by one bug in brcmf_count_20mhz_channels()
    
    In the brcmf_count_20mhz_channels function we are looping through a list
    of channels received from firmware. Since the index of the first channel
    is 0 the condition leads to an off by one bug. This is causing us to hit
    the WARN_ON_ONCE(1) calls in the brcmu_d11n_decchspec function, which is
    how I discovered the bug.
    
    Introduced by:
    commit b48d891676f756d48b4d0ee131e4a7a5d43ca417
    ("brcmfmac: rework wiphy structure setup")
    
    Acked-by: Arend van Spriel <arend@broadcom.com>
    Signed-off-by: Emil Goode <emilgoode@gmail.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 370ce45b5986118fa496dddbcd7039e1aa1a418f
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Tue Sep 23 10:20:13 2014 -0400

    drm/radeon/cik: use a separate counter for CP init timeout
    
    Otherwise we may fail to init the second compute ring.
    
    Noticed-by: Christian König <christian.koenig@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
    Cc: stable@vger.kernel.org

commit c84db77010877da6c5da119868ed54c43d59e726
Author: Jani Nikula <jani.nikula@intel.com>
Date:   Wed Sep 17 15:34:58 2014 +0300

    drm/i915/hdmi: fix hdmi audio state readout
    
    Check the correct bit for audio. Seems like a copy-paste error from the
    start:
    
    commit 9ed109a7b445e3f073d8ea72f888ec80c0532465
    Author: Daniel Vetter <daniel.vetter@ffwll.ch>
    Date:   Thu Apr 24 23:54:52 2014 +0200
    
        drm/i915: Track has_audio in the pipe config
    
    Reported-by: Martin Andersen <martin.x.andersen@gmail.com>
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=82756
    Cc: stable@vger.kernel.org # 3.16+
    Cc: Daniel Vetter <daniel.vetter@ffwll.ch>
    Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Signed-off-by: Jani Nikula <jani.nikula@intel.com>

commit 22cb99af39b5d4aae075a5bc9da615ba245227cd
Author: Brad Volkin <bradley.d.volkin@intel.com>
Date:   Mon Sep 22 08:25:21 2014 -0700

    drm/i915: Don't leak command parser tables on suspend/resume
    
    Ring init and cleanup are not balanced because we re-init the rings on
    resume without having cleaned them up on suspend. This leads to the
    driver leaking the parser's hash tables with a kmemleak signature such
    as this:
    
    unreferenced object 0xffff880405960980 (size 32):
      comm "systemd-udevd", pid 516, jiffies 4294896961 (age 10202.044s)
      hex dump (first 32 bytes):
        d0 85 46 c0 ff ff ff ff 00 00 00 00 00 00 00 00  ..F.............
        98 60 28 04 04 88 ff ff 00 00 00 00 00 00 00 00  .`(.............
      backtrace:
        [<ffffffff81816f9e>] kmemleak_alloc+0x4e/0xb0
        [<ffffffff811fa678>] kmem_cache_alloc_trace+0x168/0x2f0
        [<ffffffffc03e20a5>] i915_cmd_parser_init_ring+0x2a5/0x3e0 [i915]
        [<ffffffffc04088a2>] intel_init_ring_buffer+0x202/0x470 [i915]
        [<ffffffffc040c998>] intel_init_vebox_ring_buffer+0x1e8/0x2b0 [i915]
        [<ffffffffc03eff59>] i915_gem_init_hw+0x2f9/0x3a0 [i915]
        [<ffffffffc03f0057>] i915_gem_init+0x57/0x1d0 [i915]
        [<ffffffffc045e26a>] i915_driver_load+0xc0a/0x10e0 [i915]
        [<ffffffffc02e0d5d>] drm_dev_register+0xad/0x100 [drm]
        [<ffffffffc02e3b9f>] drm_get_pci_dev+0x8f/0x200 [drm]
        [<ffffffffc03c934b>] i915_pci_probe+0x3b/0x60 [i915]
        [<ffffffff81436725>] local_pci_probe+0x45/0xa0
        [<ffffffff81437a69>] pci_device_probe+0xd9/0x130
        [<ffffffff81524f4d>] driver_probe_device+0x12d/0x3e0
        [<ffffffff815252d3>] __driver_attach+0x93/0xa0
        [<ffffffff81522e1b>] bus_for_each_dev+0x6b/0xb0
    
    This patch extends the current convention of checking whether a
    resource is already allocated before allocating it during ring init.
    Longer term it might make sense to only init the rings once.
    
    Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=83794
    Tested-by: Kari Suvanto <kari.tj.suvanto@gmail.com>
    Signed-off-by: Brad Volkin <bradley.d.volkin@intel.com>
    Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>
    Cc: stable@vger.kernel.org
    Signed-off-by: Jani Nikula <jani.nikula@intel.com>

commit f3670394c29ff3730638762c1760fd2f624e6d7b
Author: Linus Torvalds <torvalds@linux-foundation.org>
Date:   Mon Sep 22 23:05:49 2014 -0700

    Revert "x86/efi: Fixup GOT in all boot code paths"
    
    This reverts commit 9cb0e394234d244fe5a97e743ec9dd7ddff7e64b.
    
    It causes my Sony Vaio Pro 11 to immediately reboot at startup.
    
    Acked-by: Ingo Molnar <mingo@kernel.org>
    Cc: Peter Anvin <hpa@zytor.com>
    Cc: Maarten Lankhorst <maarten.lankhorst@canonical.com>
    Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
    Cc: Matt Fleming <matt.fleming@intel.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 7cbeb9f90db8e56856db7568520b735732d34d86
Author: Yinghai Lu <yinghai@kernel.org>
Date:   Mon Sep 22 20:05:45 2014 -0600

    PCI: pciehp: Fix pcie_wait_cmd() timeout
    
    pcie_poll_cmd() take msecs instead of jiffies, so convert timeout to msecs.
    
    Fixes: 40b960831cfa ("PCI: pciehp: Compute timeout from hotplug command start time")
    Signed-off-by: Yinghai Lu <yinghai@kernel.org>
    Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>

commit 4a0c081eff43a11c65dee3ad6c457f7f58bcebe0
Author: Florian Fainelli <f.fainelli@gmail.com>
Date:   Mon Sep 22 11:54:43 2014 -0700

    net: bcmgenet: call bcmgenet_dma_teardown in bcmgenet_fini_dma
    
    We should not be manipulaging the DMA_CTRL registers directly by writing
    0 to them to disable DMA. This is an operation that needs to be timed to
    make sure the DMA engines have been properly stopped since their state
    machine stops on a packet boundary, not immediately.
    
    Make sure that tha bcmgenet_fini_dma() calls bcmgenet_dma_teardown() to
    ensure a proper DMA engine state. As a result, we need to reorder the
    function bodies to resolve the use dependency.
    
    Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file")
    Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 478a010c9235ca92e66cc5058b42e30e33275ad4
Author: Florian Fainelli <f.fainelli@gmail.com>
Date:   Mon Sep 22 11:54:42 2014 -0700

    net: bcmgenet: fix TX reclaim accounting for fragments
    
    The GENET driver supports SKB fragments, and succeeds in transmitting
    them properly, but when reclaiming these transmitted fragments, we will
    only update the count of free buffer descriptors by 1, even for SKBs
    with fragments. This leads to the networking stack thinking it has more
    room than the hardware has when pushing new SKBs, and backing off
    consequently because we return NETDEV_TX_BUSY.
    
    Fix this by accounting for the SKB nr_frags plus one (itself) and update
    ring->free_bds accordingly with that value for each iteration loop in
    __bcmgenet_tx_reclaim().
    
    Fixes: 1c1008c793fa ("net: bcmgenet: add main driver file")
    Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit a35165ca101695aa2cc5a6300ef69ae60be39a49
Author: Eric Dumazet <edumazet@google.com>
Date:   Mon Sep 22 10:38:16 2014 -0700

    ipv4: do not use this_cpu_ptr() in preemptible context
    
    this_cpu_ptr() in preemptible context is generally bad
    
    Sep 22 05:05:55 br kernel: [   94.608310] BUG: using smp_processor_id()
    in
    preemptible [00000000] code: ip/2261
    Sep 22 05:05:55 br kernel: [   94.608316] caller is
    tunnel_dst_set.isra.28+0x20/0x60 [ip_tunnel]
    Sep 22 05:05:55 br kernel: [   94.608319] CPU: 3 PID: 2261 Comm: ip Not
    tainted
    3.17.0-rc5 #82
    
    We can simply use raw_cpu_ptr(), as preemption is safe in these
    contexts.
    
    Should fix https://bugzilla.kernel.org/show_bug.cgi?id=84991
    
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Reported-by: Joe <joe9mail@gmail.com>
    Fixes: 9a4aa9af447f ("ipv4: Use percpu Cache route in IP tunnels")
    Acked-by: Tom Herbert <therbert@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit ff1b129403aad9a5c7cc9a6eaaffe4bd5fc0c67f
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Mon Sep 22 17:28:29 2014 -0400

    drm/radeon: add PX quirk for asus K53TK
    
    Seems to have problems turning the dGPU on/off.
    
    bug:
    https://bugzilla.kernel.org/show_bug.cgi?id=51381
    
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

commit 8aff6ad5a393b8e2ad00dce4d278ecf41397bf0d
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Wed Sep 17 11:31:02 2014 -0400

    drm/radeon: add a backlight quirk for Amilo Xi 2550
    
    Only the acpi backlight seems to work.  Using the
    radeon backlight controller causes the backlight to
    go off.
    
    bug:
    https://bugs.freedesktop.org/show_bug.cgi?id=81382
    
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

commit bc13018b5eba26ca229b33763c9e61fac31a1925
Author: Alex Deucher <alexander.deucher@amd.com>
Date:   Tue Sep 16 20:57:26 2014 -0400

    drm/radeon: add a module parameter for backlight control (v2)
    
    Add a module parameter to disable the radeon GPU backlight
    controller to override the automatic detection.  Some
    laptops seems to indicate that they use the integrated
    controller, but appear to actually use an external
    controller.
    
    bug:
    https://bugs.freedesktop.org/show_bug.cgi?id=81382
    
    v2: fix module parameter description
    
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

commit f55e03b975c230758c8f164347dfa10103f60e2c
Author: Michel Dänzer <michel.daenzer@amd.com>
Date:   Fri Sep 19 12:22:10 2014 +0900

    drm/radeon: Update IH_RB_RPTR register after each processed interrupt
    
    This might decrease the chance of IH ring buffer overflows.
    
    Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

commit 6cc2fda213d7a939e151ea1b5ec8033cce732c08
Author: Michel Dänzer <michel.daenzer@amd.com>
Date:   Fri Sep 19 12:22:07 2014 +0900

    drm/radeon: Make IH ring overflow debugging output more useful
    
    Use the same format for all ring indices, and fix the calculation of the
    post-overflow RPTR.
    
    Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

commit 11bab0ae9991b165b542294806013d1e06fb3294
Author: Michel Dänzer <michel.daenzer@amd.com>
Date:   Fri Sep 19 12:07:11 2014 +0900

    drm/radeon: Clear RB_OVERFLOW bit earlier
    
    Otherwise the bit remains set in rdev->ih.rptr, so the wptr can never
    match that and we still have an infinite loop.
    
    This fix allows me to successfully recover from an IH ring buffer
    overflow.
    
    Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
    Signed-off-by: Alex Deucher <alexander.deucher@amd.com>

commit 1f2bb4acc125edc2c06db3ad3e8c699bc075ad52
Author: Christoffer Dall <christoffer.dall@linaro.org>
Date:   Mon Sep 22 22:10:36 2014 +0200

    arm/arm64: KVM: Fix unaligned access bug on gicv2 access
    
    We were using an atomic bitop on the vgic_v2.vgic_elrsr field which was
    not aligned to the natural size on 64-bit platforms.  This bug showed up
    after QEMU correctly identifies the pl011 line as being level-triggered,
    and not edge-triggered.
    
    These data structures are protected by a spinlock so simply use a
    non-atomic version of the accessor instead.
    
    Tested-by: Joel Schopp <joel.schopp@amd.com>
    Reported-by: Riku Voipio <riku.voipio@linaro.org>
    Signed-off-by: Christoffer Dall <christoffer.dall@linaro.org>

commit 46f341ffcfb5d8530f7d1e60f3be06cce6661b62
Author: Jens Axboe <axboe@fb.com>
Date:   Tue Sep 16 13:38:51 2014 -0600

    genhd: fix leftover might_sleep() in blk_free_devt()
    
    Commit 2da78092 changed the locking from a mutex to a spinlock,
    so we now longer sleep in this context. But there was a leftover
    might_sleep() in there, which now triggers since we do the final
    free from an RCU callback. Get rid of it.
    
    Reported-by: Pontus Fuchs <pontus.fuchs@gmail.com>
    Signed-off-by: Jens Axboe <axboe@fb.com>

commit 09f3756bb9a82835b0c2a9b50f36b47aa42f2c61
Author: Tobias Klauser <tklauser@distanz.ch>
Date:   Fri Sep 19 16:16:25 2014 +0200

    dm9000: Return an ERR_PTR() in all error conditions of dm9000_parse_dt()
    
    In one error condition dm9000_parse_dt() returns NULL, however the
    return value is checked using IS_ERR() in dm9000_probe(), leading to the
    error not being properly propagated if CONFIG_OF is not enabled or the
    device tree data is not available. Fix this by also returning an
    ERR_PTR() in this case.
    
    Fixes: 0b8bf1baabe5 (net: dm9000: Allow instantiation using device tree)
    Signed-off-by: Tobias Klauser <tklauser@distanz.ch>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 2ba7d144d39a596cf5d09390ee7de21cfb69cf2b
Author: Wojciech Dubowik <Wojciech.Dubowik@neratec.com>
Date:   Thu Sep 18 08:30:41 2014 +0200

    ath9k: Fix NULL pointer dereference on early irq
    
    The ah struct might not have been initialized when
    interrupt comes so check for it.
    
    Signed-off-by: Wojciech Dubowik <Wojciech.Dubowik@neratec.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit fa5c107cc887886a04ee2dbce05af86de220ae48
Author: Loic Poulain <loic.poulain@intel.com>
Date:   Tue Sep 16 14:53:58 2014 +0200

    net: rfkill: gpio: Fix clock status
    
    Clock is disabled when the device is blocked.
    So, clock_enabled is the logical negation of "blocked".
    
    Signed-off-by: Loic Poulain <loic.poulain@intel.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 85911d71109d3dda8bb35515b78bcc1de6837785
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Fri Sep 19 13:40:25 2014 +0300

    r8169: fix an if condition
    
    There is an extra semi-colon so __rtl8169_set_features() is called every
    time.
    
    Fixes: 929a031dfd62 ('r8169: adjust __rtl8169_set_features')
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Acked-by: Hayes Wang <hayeswang@realtek.com>--
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit d70b1137233836be1d71bd53ae60bec6c9e7203c
Author: hayeswang <hayeswang@realtek.com>
Date:   Fri Sep 19 15:17:18 2014 +0800

    r8152: disable ALDPS
    
    If the hw is in ALDPS mode, the hw may have no response for accessing
    the most registers. Therefore, the ALDPS should be disabled before
    accessing the hw in rtl_ops.init(), rtl_ops.disable(), rtl_ops.up(),
    and rtl_ops.down(). Regardless of rtl_ops.enable(), because the hw
    wouldn't enter ALDPS mode when linking on. The hw would enter the
    ALDPS mode after several seconds when link down occurs and the ALDPS
    is enabled.
    
    Signed-off-by: Hayes Wang <hayeswang@realtek.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit b49fe36208b45f76dfbcfcd3afd952a33fa9f5ce
Author: Eric Dumazet <edumazet@google.com>
Date:   Thu Sep 18 11:00:27 2014 -0700

    ipoib: validate struct ipoib_cb size
    
    To catch future errors sooner.
    
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 257117862634d89de33fec74858b1a0ba5ab444b
Author: Eric Dumazet <edumazet@google.com>
Date:   Thu Sep 18 08:02:05 2014 -0700

    net: sched: shrink struct qdisc_skb_cb to 28 bytes
    
    We cannot make struct qdisc_skb_cb bigger without impacting IPoIB,
    or increasing skb->cb[] size.
    
    Commit e0f31d849867 ("flow_keys: Record IP layer protocol in
    skb_flow_dissect()") broke IPoIB.
    
    Only current offender is sch_choke, and this one do not need an
    absolutely precise flow key.
    
    If we store 17 bytes of flow key, its more than enough. (Its the actual
    size of flow_keys if it was a packed structure, but we might add new
    fields at the end of it later)
    
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Fixes: e0f31d849867 ("flow_keys: Record IP layer protocol in skb_flow_dissect()")
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 476c18850c6cbaa3f2bb661ae9710645081563b9
Author: Vlad Yasevich <vyasevich@gmail.com>
Date:   Thu Sep 18 10:31:17 2014 -0400

    tg3: Work around HW/FW limitations with vlan encapsulated frames
    
    TG3 appears to have an issue performing TSO and checksum offloading
    correclty when the frame has been vlan encapsulated (non-accelrated).
    In these cases, tcp checksum is not correctly updated.
    
    This patch attempts to work around this issue.  After the patch,
    802.1ad vlans start working correctly over tg3 devices.
    
    CC: Prashant Sreedharan <prashant@broadcom.com>
    CC: Michael Chan <mchan@broadcom.com>
    Signed-off-by: Vladislav Yasevich <vyasevic@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 4e66cd13ff9cd7eaae69e2fae0335d8d99d8afdf
Author: sundarjdev <sdev@nestlabs.com>
Date:   Mon Sep 22 10:31:39 2014 -0700

    hwmon: (tmp103) Fix resource leak bug in tmp103 temperature sensor driver
    
    tmp103 temperature sensor driver registers with the hwmon framework by calling
    hwmon_device_register_with_groups but does not have a .remove method to call
    hwmon_device_unregister to unregister from the framework when the device is no
    longer needed. Fix this by calling devm_hwmon_device_register_with_groups.
    
    Signed-off-by: Sundar J Dev <sundarjayakumardev@gmail.com>
    Signed-off-by: Guenter Roeck <linux@roeck-us.net>

commit 07d92d5cc977a7fe1e683e1d4a6f723f7f2778cb
Author: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Date:   Wed Sep 17 10:08:08 2014 +0200

    macvlan: allow to enqueue broadcast pkt on virtual device
    
    Since commit 412ca1550cbe ("macvlan: Move broadcasts into a work queue"), the
    driver uses tx_queue_len of the master device as the limit of packets enqueuing.
    Problem is that virtual drivers have this value set to 0, thus all broadcast
    packets were rejected.
    Because tx_queue_len was arbitrarily chosen, I replace it with a static limit
    of 1000 (also arbitrarily chosen).
    
    CC: Herbert Xu <herbert@gondor.apana.org.au>
    Reported-by: Thibaut Collet <thibaut.collet@6wind.com>
    Suggested-by: Thibaut Collet <thibaut.collet@6wind.com>
    Tested-by: Thibaut Collet <thibaut.collet@6wind.com>
    Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
    Acked-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 8b95741569eabc5eb17da71d1d3668cdb0bef86c
Author: Jens Axboe <axboe@fb.com>
Date:   Fri Sep 19 13:10:29 2014 -0600

    blk-mq: use blk_mq_start_hw_queues() when running requeue work
    
    When requests are retried due to hw or sw resource shortages,
    we often stop the associated hardware queue. So ensure that we
    restart the queues when running the requeue work, otherwise the
    queue run will be a no-op.
    
    Signed-off-by: Jens Axboe <axboe@fb.com>

commit 6b55e1f2d0a5e462e52678278ab749468f1db81c
Author: Jens Axboe <axboe@fb.com>
Date:   Fri Sep 19 08:04:53 2014 -0600

    blk-mq: fix potential oops on out-of-memory in __blk_mq_alloc_rq_maps()
    
    __blk_mq_alloc_rq_maps() can be invoked multiple times, if we scale
    back the queue depth if we are low on memory. So don't clear
    set->tags when we fail, this is handled directly in
    the parent function, blk_mq_alloc_tag_set().
    
    Reported-by: Robert Elliott  <Elliott@hp.com>
    Signed-off-by: Jens Axboe <axboe@fb.com>

commit a57a178a490345c7236b0077b3de005754389ed6
Author: Christoph Hellwig <hch@lst.de>
Date:   Tue Sep 16 14:44:07 2014 -0700

    blk-mq: avoid infinite recursion with the FUA flag
    
    We should not insert requests into the flush state machine from
    blk_mq_insert_request.  All incoming flush requests come through
    blk_{m,s}q_make_request and are handled there, while blk_execute_rq_nowait
    should only be called for BLOCK_PC requests.  All other callers
    deal with requests that already went through the flush statemchine
    and shouldn't be reinserted into it.
    
    Reported-by: Robert Elliott  <Elliott@hp.com>
    Debugged-by: Ming Lei <ming.lei@canonical.com>
    Signed-off-by: Christoph Hellwig <hch@lst.de>
    Signed-off-by: Jens Axboe <axboe@fb.com>

commit 683d0e126232d898a481daa3a4ca032c2b1a9660
Author: David Hildenbrand <dahi@linux.vnet.ibm.com>
Date:   Thu Sep 18 11:04:31 2014 +0200

    blk-mq: Avoid race condition with uninitialized requests
    
    This patch should fix the bug reported in
    https://lkml.org/lkml/2014/9/11/249.
    
    We have to initialize at least the atomic_flags and the cmd_flags when
    allocating storage for the requests.
    
    Otherwise blk_mq_timeout_check() might dereference uninitialized
    pointers when racing with the creation of a request.
    
    Also move the reset of cmd_flags for the initializing code to the point
    where a request is freed. So we will never end up with pending flush
    request indicators that might trigger dereferences of invalid pointers
    in blk_mq_timeout_check().
    
    Cc: stable@vger.kernel.org
    Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
    Reported-by: Paulo De Rezende Pinatti <ppinatti@linux.vnet.ibm.com>
    Tested-by: Paulo De Rezende Pinatti <ppinatti@linux.vnet.ibm.com>
    Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
    Signed-off-by: Jens Axboe <axboe@fb.com>

commit 538b75341835e3c2041ff066408de10d24fdc830
Author: Jens Axboe <axboe@fb.com>
Date:   Tue Sep 16 10:37:37 2014 -0600

    blk-mq: request deadline must be visible before marking rq as started
    
    When we start the request, we set the deadline and flip the bits
    marking the request as started and non-complete. However, it's
    important that the deadline store is ordered before flipping the
    bits, otherwise we could have a small window where the request is
    marked started but with an invalid deadline. This can confuse the
    timeout handling.
    
    Suggested-by: Ming Lei <tom.leiming@gmail.com>
    Signed-off-by: Jens Axboe <axboe@fb.com>

commit 4e5f9ef380b00871995d638c03e7ae7c67244e31
Author: David S. Miller <davem@davemloft.net>
Date:   Mon Sep 22 13:25:51 2014 -0400

    pch_gbe: 'select' NET_PTP_CLASSIFY.
    
    Fixes the following randconfig build failure:
    
    > drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c: In function
    > ‘pch_ptp_match’:
    > drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.c:130:2: error:
    > implicit declaration of function ‘ptp_classify_raw’
    > [-Werror=implicit-function-declaration]
    >   if (ptp_classify_raw(skb) == PTP_CLASS_NONE)
    >   ^
    > cc1: some warnings being treated as errors
    > make[5]: *** [drivers/net/ethernet/oki-semi/pch_gbe/pch_gbe_main.o] Error 1
    
    Reported-by: Jim Davis <jim.epost@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit df568d8e5250bf24e38c69ad4374baf0f8d279ba
Author: David S. Miller <davem@davemloft.net>
Date:   Mon Sep 22 13:14:33 2014 -0400

    scsi: Use 'depends' with LIBFC instead of 'select'.
    
    LIBFC depends upon SCSI_FC_ATTRS and select's CRC32C.
    
    The only alternative would be to 'select' CRC32C and all of
    SCSI_FC_ATTRS direct and indirect dependencies in the Kconfig section
    for every LIBFCOE user which makes little sense.
    
    Subsequently, use 'depends' instead of 'select' for LIBFCOE too.
    
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 25476b0209b2e48dfb689e1b4cf7278875082b1f
Author: Jack Morgenstein <jackm@dev.mellanox.co.il>
Date:   Thu Sep 11 14:11:20 2014 +0300

    IB/mlx4: Fix VF mac handling in RoCE
    
    We had several problems here.  First, a race condition on QP1 mac
    handling between mlx4_ib_update_qps and mlx4_ib_modify_qp, which is
    fixed by taking the qp mutex in mlx4_ib_update_qps.
    
    Also, qp->pri.smac_port was not updated in mlx4_ib_update_qps.
    
    Last, in __mlx4_ib_modify_qp we did not properly handle the case where
    the mac is zero, but port is non-zero.
    
    Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
    Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>

commit 3dec48788817fce4a029cbab14f2b407ae78478f
Author: Jack Morgenstein <jackm@dev.mellanox.co.il>
Date:   Thu Sep 11 14:11:19 2014 +0300

    IB/mlx4: Do not allow APM under RoCE
    
    Automatic Path Migration is not supported under RoCE. Therefore,
    return a "not-supported" error if the caller attempts to set an
    alternate path in a QP context.
    
    In addition, if there are no IB ports configured, do not report
    APM capability in the device flags returned by mlx4_ib_query_device.
    
    Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
    Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>

commit d24d9f43384b5933867a5786934e130efa8b5c92
Author: Jack Morgenstein <jackm@dev.mellanox.co.il>
Date:   Thu Sep 11 14:11:18 2014 +0300

    IB/mlx4: Don't update QP1 in native mode
    
    For native functions (non-SR-IOV), there's no reason to update
    the smac_index, as QP1 is a GSI QP.
    
    Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
    Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>

commit 3e0629cb6c0518423c9e2671bbe8ec15dde5dcaf
Author: Jack Morgenstein <jackm@dev.mellanox.co.il>
Date:   Thu Sep 11 14:11:17 2014 +0300

    IB/mlx4: Avoid accessing netdevice when building RoCE qp1 header
    
    The source MAC is needed in RoCE when building the QP1 header.
    
    Currently, this is obtained from the source net device. However, the net
    device may not yet exist, or can be destroyed in parallel to this QP1 send
    operation (e.g through the VPI port change flow) so accessing it may cause
    a kernel crash.
    
    To fix this, we maintain a source MAC cache per port for the net device in
    struct mlx4_ib_roce.  This cached MAC is initialized to be the default MAC
    address obtained during HCA initialization via QUERY_PORT. This cached MAC
    is updated via the netdev event notifier handler.
    
    Since the cached MAC is held in an atomic64 object, we do not need locking
    when accessing it.
    
    Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
    Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>

commit f4fd40b26bd597e203639281859a758402550d62
Author: Jack Morgenstein <jackm@dev.mellanox.co.il>
Date:   Thu Sep 11 14:11:16 2014 +0300

    mlx4: Fix mlx4 reg/unreg mac to work properly with 0-mac addresses
    
    There is a chance that the VF mlx4 RoCE driver (mlx4_ib) may see a 0-mac
    as the current default MAC address when a RoCE interface first comes up.
    
    In this case, the RoCE driver registers the 0-mac to get its MAC index --
    used in the INIT2RTR transition when it creates its proxy Q1 qp's.
    
    If we do not allow QP1 to be created, the RoCE driver will not come up.
    If we do not register the 0-mac, but simply use a random mac-index,
    QP1 will attempt to send packets with an someone's else source MAC which
    will get the system into more troubled.
    
    Since a 0-mac was previously used to indicate a free slot, this leads to
    errors, both when the 0-mac is registered and when it is unregistered.
    
    The required fix is to check in addition that the slot containing the
    0-mac has a reference count of zero.
    
    Additionally, when comparing MAC addresses, need to mask out the 2 MSBs
    of the u64 mac on both sides of the comparison.
    
    Note that when the EN driver (mlx4_en) comes up, it set itself a proper
    mac --> the RoCE driver gets to be notified on that and further handing
    is done with the update qp command, as was added by commit 9433c188915c
    ("IB/mlx4: Invoke UPDATE_QP for proxy QP1 on MAC changes").
    
    Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
    Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>

commit a59c5850f09b4c2d6ad2fc47e5e1be8d654529d6
Author: Matan Barak <matanb@mellanox.com>
Date:   Tue Sep 2 15:32:34 2014 +0300

    IB/core: When marshaling uverbs path, clear unused fields
    
    When marsheling a user path to the kernel struct ib_sa_path, need
    to zero smac, dmac and set the vlan id to the "no vlan" value.
    
    Fixes: dd5f03beb4f7 ("IB/core: Ethernet L2 attributes in verbs/cm structures")
    Reported-by: Aleksey Senin <alekseys@mellanox.com>
    Signed-off-by: Matan Barak <matanb@mellanox.com>
    Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>

commit 4bf9715f184969dc703bde7be94919995024a6a9
Author: Moni Shoua <monis@mellanox.com>
Date:   Thu Aug 21 14:28:42 2014 +0300

    IB/mlx4: Avoid executing gid task when device is being removed
    
    When device is being removed (e.g during VPI port link type change
    from ETH to IB), tasks for gid table changes should not be executed.
    
    Flush the current queue of tasks and block further tasks from entering the queue.
    
    Signed-off-by: Moni Shoua <monis@mellanox.com>
    Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>

commit dba3ad2addcd74ec850e510f3b8a9d046cc24ef3
Author: Jack Morgenstein <jackm@dev.mellanox.co.il>
Date:   Thu Aug 21 14:28:41 2014 +0300

    IB/mlx4: Fix lockdep splat for the iboe lock
    
    Chuck Lever reported the following stack trace:
    
        =================================
        [ INFO: inconsistent lock state ]
        3.16.0-rc2-00024-g2e78883 #17 Tainted: G            E
        ---------------------------------
        inconsistent {SOFTIRQ-ON-W} -> {IN-SOFTIRQ-W} usage.
        swapper/0/0 [HC0[0]:SC1[1]:HE1:SE0] takes:
        (&(&iboe->lock)->rlock){+.?...}, at: [<ffffffffa065f68b>] mlx4_ib_addr_event+0xdb/0x1a0 [mlx4_ib]
        {SOFTIRQ-ON-W} state was registered at:
         [<ffffffff810b3110>] mark_irqflags+0x110/0x170
         [<ffffffff810b4806>] __lock_acquire+0x2c6/0x5b0
         [<ffffffff810b4bd9>] lock_acquire+0xe9/0x120
         [<ffffffff815f7f6e>] _raw_spin_lock+0x3e/0x80
         [<ffffffffa0661084>] mlx4_ib_scan_netdevs+0x34/0x260 [mlx4_ib]
         [<ffffffffa06612db>] mlx4_ib_netdev_event+0x2b/0x40 [mlx4_ib]
         [<ffffffff81522219>] register_netdevice_notifier+0x99/0x1e0
         [<ffffffffa06626e3>] mlx4_ib_add+0x743/0xbc0 [mlx4_ib]
         [<ffffffffa05ec168>] mlx4_add_device+0x48/0xa0 [mlx4_core]
         [<ffffffffa05ec2c3>] mlx4_register_interface+0x73/0xb0 [mlx4_core]
         [<ffffffffa05c505e>] cm_req_handler+0x13e/0x460 [ib_cm]
         [<ffffffff810002e2>] do_one_initcall+0x112/0x1c0
         [<ffffffff810e8264>] do_init_module+0x34/0x190
         [<ffffffff810ea62f>] load_module+0x5cf/0x740
         [<ffffffff810ea939>] SyS_init_module+0x99/0xd0
         [<ffffffff815f8fd2>] system_call_fastpath+0x16/0x1b
        irq event stamp: 336142
        hardirqs last  enabled at (336142): [<ffffffff810612f5>] __local_bh_enable_ip+0xb5/0xc0
        hardirqs last disabled at (336141): [<ffffffff81061296>] __local_bh_enable_ip+0x56/0xc0
        softirqs last  enabled at (336004): [<ffffffff8106123a>] _local_bh_enable+0x4a/0x50
        softirqs last disabled at (336005): [<ffffffff810617a4>] irq_exit+0x44/0xd0
    
        other info that might help us debug this:
        Possible unsafe locking scenario:
    
              CPU0
              ----
         lock(&(&iboe->lock)->rlock);
         <Interrupt>
           lock(&(&iboe->lock)->rlock);
    
        *** DEADLOCK ***
    
    The above problem was caused by the spin lock being taken both in the process
    context and in a soft-irq context (in a netdev notifier handler).
    
    The required fix is to use spin_lock/unlock_bh() instead of spin_lock/unlock
    on the iboe lock.
    
    Reported-by: Chuck Lever <chuck.lever@oracle.com>
    Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
    Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>

commit bccb84f1dfab92ed180adf09c76cfa9ddc90edb9
Author: Moni Shoua <monis@mellanox.com>
Date:   Thu Aug 21 14:28:40 2014 +0300

    IB/mlx4: Get upper dev addresses as RoCE GIDs when port comes up
    
    When a RoCE port becomes active and the netdev of the port has upper
    device (e.g bond/team), GIDs derived from the upper dev should appear
    in the port's RoCE GID table.
    
    Signed-off-by: Moni Shoua <monis@mellanox.com>
    Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>

commit 655b2aaefc353604f9975c31960d9722e6eda449
Author: Moni Shoua <monis@mellanox.com>
Date:   Thu Aug 21 14:28:39 2014 +0300

    IB/mlx4: Reorder steps in RoCE GID table initialization
    
    There's no need to reset the gid table twice and we need to do it only
    for Ethernet ports. Also, no need to actively scan ndetdevs since it's
    being done immediatly after we register netdev notifiers.
    
    Signed-off-by: Moni Shoua <monis@mellanox.com>
    Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>

commit f5c4834d9328c4ed9fe5dcbec6128d6da16db69a
Author: Moni Shoua <monis@mellanox.com>
Date:   Thu Aug 21 14:28:38 2014 +0300

    IB/mlx4: Don't duplicate the default RoCE GID
    
    When reading the IPv6 addresses from the net-device, make sure to
    avoid adding a duplicate entry to the GID table because of equality
    between the default GID we generate and the default IPv6 link-local
    address of the device.
    
    Fixes: acc4fccf4eff ("IB/mlx4: Make sure GID index 0 is always occupied")
    Signed-off-by: Moni Shoua <monis@mellanox.com>
    Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>

commit e381835cf1b8e3b2857277dbc3b77d8c5350f70a
Author: Moni Shoua <monis@mellanox.com>
Date:   Thu Aug 21 14:28:37 2014 +0300

    IB/mlx4: Avoid null pointer dereference in mlx4_ib_scan_netdevs()
    
    When Ethernet netdev is not present for a port (e.g. when the link
    layer type of the port is InfiniBand) it's possible to dereference a
    null pointer when we do netdevice scanning.
    
    To fix that, we move a section of code that needs to run only when
    netdev is present to a proper if () statement.
    
    Fixes: ad4885d279b6 ("IB/mlx4: Build the port IBoE GID table properly under bonding")
    Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Moni Shoua <monis@mellanox.com>
    Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>

commit 61aabb3c91c1b03478ffc1a4a2573f825e7f35f9
Author: Or Gerlitz <ogerlitz@mellanox.com>
Date:   Tue Sep 2 17:08:43 2014 +0300

    IB/iser: Bump version to 1.4.1
    
    Signed-off-by: Roi Dayan <roid@mellanox.com>
    Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>

commit 91eb1df39a1fba21bbc28895a84630782cd442ed
Author: Sagi Grimberg <sagig@mellanox.com>
Date:   Tue Sep 2 17:08:42 2014 +0300

    IB/iser: Allow bind only when connection state is UP
    
    We need to fail the bind operation if the iser connection state != UP
    (started teardown) and this should be done under the state lock.
    
    Signed-off-by: Sagi Grimberg <sagig@mellanox.com>
    Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>

commit c33b15f00bbfb9324dc38e5176f576a0f46e0873
Author: Roi Dayan <roid@mellanox.com>
Date:   Tue Sep 2 17:08:41 2014 +0300

    IB/iser: Fix RX/TX CQ resource leak on error flow
    
    When failing to allocate TX CQ we already allocated RX CQ, so we need to make
    sure we release it. Also, when failing to register notification to the RX CQ
    we currently leak both RX and TX CQs of the current index, fix that too.
    
    Signed-off-by: Roi Dayan <roid@mellanox.com>
    Signed-off-by: Sagi Grimberg <sagig@mellanox.com>
    Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>

commit f0c2c225dfe9dfb668fe72eadabb8a3ec74ca036
Author: devesh.sharma@emulex.com <devesh.sharma@emulex.com>
Date:   Fri Sep 5 15:09:49 2014 +0530

    RDMA/ocrdma: Use right macro in query AH
    
    ocrdma_query_ah() does not use correct macro, and checks the wrong bit
    for the validity of address handle in vector table.  Fix this.
    
    Signed-off-by: Devesh Sharma <devesh.sharma@emulex.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>

commit 1be528bcb88d0b854dda1d60b31f4f8f7310f034
Author: devesh.sharma@emulex.com <devesh.sharma@emulex.com>
Date:   Fri Sep 5 15:09:48 2014 +0530

    RDMA/ocrdma: Resolve L2 address when creating user AH
    
    Because of IP-based GIDs, userspace AHs must have MAC and VLAN ID
    resolved separately.  Presently, user AHs are broken for ocrdma.  This
    patch resolves L2 addresses while creating user AH and obtains the
    right DMAC and VLAN ID before creating AH.
    
    Signed-off-by: Devesh Sharma <devesh.sharma@emulex.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>

commit 4ff0acca7344c93fd9ed778b4c3ce16d95c594e4
Author: Matan Barak <matanb@mellanox.com>
Date:   Thu Sep 11 13:18:37 2014 +0300

    mlx4: Correct error flows in rereg_mr
    
    This patch addresses feedback from Sagi Grimberg on the rereg_mr
    implementation of mlx4.  The following are fixed:
    
    1. Set the correct pd_flags
    2. Make sure we change the iova and size MR fields only after
       successful write and allocation of the MTTs.
    3. Make the error checking more robust
    
    Fixes: e630664c8383 ("mlx4_core: Add helper functions to support MR re-registration")
    Signed-off-by: Matan Barak <matanb@mellanox.com>
    Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>

commit f2d5a94436cc7cc0221b9a81bba2276a25187dd3
Author: Anton Altaparmakov <aia21@cam.ac.uk>
Date:   Mon Sep 22 01:53:03 2014 +0100

    Fix nasty 32-bit overflow bug in buffer i/o code.
    
    On 32-bit architectures, the legacy buffer_head functions are not always
    handling the sector number with the proper 64-bit types, and will thus
    fail on 4TB+ disks.
    
    Any code that uses __getblk() (and thus bread(), breadahead(),
    sb_bread(), sb_breadahead(), sb_getblk()), and calls it using a 64-bit
    block on a 32-bit arch (where "long" is 32-bit) causes an inifinite loop
    in __getblk_slow() with an infinite stream of errors logged to dmesg
    like this:
    
      __find_get_block_slow() failed. block=6740375944, b_blocknr=2445408648
      b_state=0x00000020, b_size=512
      device sda1 blocksize: 512
    
    Note how in hex block is 0x191C1F988 and b_blocknr is 0x91C1F988 i.e. the
    top 32-bits are missing (in this case the 0x1 at the top).
    
    This is because grow_dev_page() is broken and has a 32-bit overflow due
    to shifting the page index value (a pgoff_t - which is just 32 bits on
    32-bit architectures) left-shifted as the block number.  But the top
    bits to get lost as the pgoff_t is not type cast to sector_t / 64-bit
    before the shift.
    
    This patch fixes this issue by type casting "index" to sector_t before
    doing the left shift.
    
    Note this is not a theoretical bug but has been seen in the field on a
    4TiB hard drive with logical sector size 512 bytes.
    
    This patch has been verified to fix the infinite loop problem on 3.17-rc5
    kernel using a 4TB disk image mounted using "-o loop".  Without this patch
    doing a "find /nt" where /nt is an NTFS volume causes the inifinite loop
    100% reproducibly whilst with the patch it works fine as expected.
    
    Signed-off-by: Anton Altaparmakov <aia21@cantab.net>
    Cc: stable@vger.kernel.org
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

commit 27fbe64bfa63cfb9da025975b59d96568caa2d53
Author: Sam Bobroff <sam.bobroff@au1.ibm.com>
Date:   Fri Sep 19 09:40:41 2014 +1000

    KVM: correct null pid check in kvm_vcpu_yield_to()
    
    Correct a simple mistake of checking the wrong variable
    before a dereference, resulting in the dereference not being
    properly protected by rcu_dereference().
    
    Signed-off-by: Sam Bobroff <sam.bobroff@au1.ibm.com>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

commit e76bf634870e3c5e3a767ad575f1d404c9f1cab8
Author: Daniel Mack <daniel@zonque.org>
Date:   Sun Sep 21 23:55:38 2014 +0200

    ALSA: snd-usb-caiaq: Fix LED commands for Kore controller
    
    KoreController and KoreController2 need an EP1_CMD_DIMM_LEDS command to set
    their LEDs, not EP1_CMD_WRITE_IO.
    
    Signed-off-by: Daniel Mack <daniel@zonque.org>
    Reported-and-tested-by: Brad Wilson <brad.wilson.00@gmail.com>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>

commit a9960e6a293e6fc3ed414643bb4e4106272e4d0a
Author: Clemens Ladisch <clemens@ladisch.de>
Date:   Sun Sep 21 22:50:57 2014 +0200

    ALSA: pcm: fix fifo_size frame calculation
    
    The calculated frame size was wrong because snd_pcm_format_physical_width()
    actually returns the number of bits, not bytes.
    
    Use snd_pcm_format_size() instead, which not only returns bytes, but also
    simplifies the calculation.
    
    Fixes: 8bea869c5e56 ("ALSA: PCM midlevel: improve fifo_size handling")
    Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
    Cc: <stable@vger.kernel.org>
    Signed-off-by: Takashi Iwai <tiwai@suse.de>

commit b8cb6b4c121e1bf1963c16ed69e7adcb1bc301cd
Author: NeilBrown <neilb@suse.de>
Date:   Thu Sep 18 11:09:04 2014 +1000

    md/raid1: fix_read_error should act on all non-faulty devices.
    
    If a devices is being recovered it is not InSync and is not Faulty.
    
    If a read error is experienced on that device, fix_read_error()
    will be called, but it ignores non-InSync devices.  So it will
    neither fix the error nor fail the device.
    
    It is incorrect that fix_read_error() ignores non-InSync devices.
    It should only ignore Faulty devices.  So fix it.
    
    This became a bug when we allowed reading from a device that was being
    recovered.  It is suitable for any subsequent -stable kernel.
    
    Fixes: da8840a747c0dbf49506ec906757a6b87b9741e9
    Cc: stable@vger.kernel.org (v3.5+)
    Reported-by: Alexander Lyakas <alex.bolshoy@gmail.com>
    Tested-by: Alexander Lyakas <alex.bolshoy@gmail.com>
    Signed-off-by: NeilBrown <neilb@suse.de>

commit 34e97f170149bfa14979581c4c748bc9b4b79d5b
Author: NeilBrown <neilb@suse.de>
Date:   Tue Sep 16 12:14:14 2014 +1000

    md/raid1: count resync requests in nr_pending.
    
    Both normal IO and resync IO can be retried with reschedule_retry()
    and so be counted into ->nr_queued, but only normal IO gets counted in
    ->nr_pending.
    
    Before the recent improvement to RAID1 resync there could only
    possibly have been one or the other on the queue.  When handling a
    read failure it could only be normal IO.  So when handle_read_error()
    called freeze_array() the fact that freeze_array only compares
    ->nr_queued against ->nr_pending was safe.
    
    But now that these two types can interleave, we can have both normal
    and resync IO requests queued, so we need to count them both in
    nr_pending.
    
    This error can lead to freeze_array() hanging if there is a read
    error, so it is suitable for -stable.
    
    Fixes: 79ef3a8aa1cb1523cc231c9a90a278333c21f761
    cc: stable@vger.kernel.org (v3.13+)
    Reported-by: Brassow Jonathan <jbrassow@redhat.com>
    Signed-off-by: NeilBrown <neilb@suse.de>

commit c2fd4c94deedb89ac1746c4a53219be499372c06
Author: NeilBrown <neilb@suse.de>
Date:   Wed Sep 10 16:01:24 2014 +1000

    md/raid1: update next_resync under resync_lock.
    
    raise_barrier() uses next_resync as part of its calculations, so it
    really should be updated first, instead of afterwards.
    
    next_resync is always used under resync_lock so update it under
    resync lock to, just before it is used.  That is safest.
    
    This could cause normal IO and resync IO to interact badly so
    it suitable for -stable.
    
    Fixes: 79ef3a8aa1cb1523cc231c9a90a278333c21f761
    cc: stable@vger.kernel.org (v3.13+)
    Signed-off-by: NeilBrown <neilb@suse.de>

commit 235549605eb7f1c5a37cef8b09d12e6d412c5cd6
Author: NeilBrown <neilb@suse.de>
Date:   Wed Sep 10 15:56:57 2014 +1000

    md/raid1: Don't use next_resync to determine how far resync has progressed
    
    next_resync is (approximately) the location for the next resync request.
    However it does *not* reliably determine the earliest location
    at which resync might be happening.
    This is because resync requests can complete out of order, and
    we only limit the number of current requests, not the distance
    from the earliest pending request to the latest.
    
    mddev->curr_resync_completed is a reliable indicator of the earliest
    position at which resync could be happening.   It is updated less
    frequently, but is actually reliable which is more important.
    
    So use it to determine if a write request is before the region
    being resynced and so safe from conflict.
    
    This error can allow resync IO to interfere with normal IO which
    could lead to data corruption. Hence: stable.
    
    Fixes: 79ef3a8aa1cb1523cc231c9a90a278333c21f761
    cc: stable@vger.kernel.org (v3.13+)
    Signed-off-by: NeilBrown <neilb@suse.de>

commit 2f73d3c55d09ce60647b96ad2a9b539c95a530ee
Author: NeilBrown <neilb@suse.de>
Date:   Wed Sep 10 15:01:49 2014 +1000

    md/raid1: make sure resync waits for conflicting writes to complete.
    
    The resync/recovery process for raid1 was recently changed
    so that writes could happen in parallel with resync providing
    they were in different regions of the device.
    
    There is a problem though:  While a write request will always
    wait for conflicting resync to complete, a resync request
    will *not* always wait for conflicting writes to complete.
    
    Two changes are needed to fix this:
    
    1/ raise_barrier (which waits until it is safe to do resync)
       must wait until current_window_requests is zero
    2/ wait_battier (which waits at the start of a new write request)
       must update current_window_requests if the request could
       possible conflict with a concurrent resync.
    
    As concurrent writes and resync can lead to data loss,
    this patch is suitable for -stable.
    
    Fixes: 79ef3a8aa1cb1523cc231c9a90a278333c21f761
    Cc: stable@vger.kernel.org (v3.13+)
    Cc: majianpeng <majianpeng@gmail.com>
    Signed-off-by: NeilBrown <neilb@suse.de>

commit 669cc7ba77864e7b1ac39c9f2b2afb8730f341f4
Author: NeilBrown <neilb@suse.de>
Date:   Thu Sep 4 16:30:38 2014 +1000

    md/raid1: clean up request counts properly in close_sync()
    
    If there are outstanding writes when close_sync is called,
    the change to ->start_next_window might cause them to
    decrement the wrong counter when they complete.  Fix this
    by merging the two counters into the one that will be decremented.
    
    Having an incorrect value in a counter can cause raise_barrier()
    to hangs, so this is suitable for -stable.
    
    Fixes: 79ef3a8aa1cb1523cc231c9a90a278333c21f761
    cc: stable@vger.kernel.org (v3.13+)
    Signed-off-by: NeilBrown <neilb@suse.de>

commit 8e2c8717c1812628b5538c05250057b37c66fdbe
Author: Frank Schaefer <fschaefer.oss@googlemail.com>
Date:   Thu Sep 18 17:55:45 2014 -0300

    [media] em28xx-v4l: get rid of field "users" in struct em28xx_v4l2"
    
    This reverts commit 747dba7de2a51a3db58b665ed3bc8c07921546ec.
    
    It breaks concurrent vbi and video capturing:
    While v4l2->users is the number of users of the whole device (all device nodes),
    v4l2_fh_is_singular() only checks the number of users of a specific device node.
    As a result. if one device node is open and a second device node is opened
    (closed), the device is reinitialized (streaming is stopped).
    
    Reported-by: Hans Verkuil <hans.verkuil@cisco.com>
    Tested-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
    Signed-off-by: Frank Schäfer <fschaefer.oss@googlemail.com>
    Cc: stable@vger.kernel.org
    Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

commit c6d119cf1b5a778e9ed60a006e2a434fcc4471a2
Author: NeilBrown <neilb@suse.de>
Date:   Tue Sep 9 13:49:46 2014 +1000

    md/raid1:  be more cautious where we read-balance during resync.
    
    commit 79ef3a8aa1cb1523cc231c9a90a278333c21f761 made
    it possible for reads to happen concurrently with resync.
    This means that we need to be more careful where read_balancing
    is allowed during resync - we can no longer be sure that any
    resync that has already started will definitely finish.
    
    So keep read_balancing to before recovery_cp, which is conservative
    but safe.
    
    This bug makes it possible to read from a device that doesn't
    have up-to-date data, so it can cause data corruption.
    So it is suitable for any kernel since 3.11.
    
    Fixes: 79ef3a8aa1cb1523cc231c9a90a278333c21f761
    cc: stable@vger.kernel.org (v3.13+)
    Signed-off-by: NeilBrown <neilb@suse.de>

commit f0cc9a057151892b885be21a1d19b0185568281d
Author: NeilBrown <neilb@suse.de>
Date:   Mon Sep 22 10:06:23 2014 +1000

    md/raid1: intialise start_next_window for READ case to avoid hang
    
    r1_bio->start_next_window is not initialised in the READ
    case, so allow_barrier may incorrectly decrement
       conf->current_window_requests
    which can cause raise_barrier() to block forever.
    
    Fixes: 79ef3a8aa1cb1523cc231c9a90a278333c21f761
    cc: stable@vger.kernel.org (v3.13+)
    Reported-by: Brassow Jonathan <jbrassow@redhat.com>
    Signed-off-by: NeilBrown <neilb@suse.de>

commit c7854c2c5d692a329b4d9a9a73bcf36ae137ee7c
Author: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
Date:   Fri Sep 19 13:02:12 2014 -0300

    [media] em28xx: fix VBI handling logic
    
    When both VBI and video are streaming, and video stream is stopped,
    a subsequent trial to restart it will fail, because S_FMT will
    return -EBUSY.
    
    That prevents applications like zvbi to work properly.
    
    Please notice that, while this fix it fully for zvbi, the
    best is to get rid of streaming_users and res_get logic as a hole.
    
    However, this single-line patch is better to be merged at -stable.
    
    Cc: stable@vger.kernel.org
    Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

commit 91235537bc4b53f0b6f953acf963bcbb6215c49c
Author: Hans Verkuil <hans.verkuil@cisco.com>
Date:   Sat Sep 20 16:16:37 2014 -0300

    [media] DocBook media: improve the poll() documentation
    
    The poll documentation was incomplete: document how events (POLLPRI)
    are handled and fix the documentation of what poll does for display devices
    and streaming I/O.
    
    Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
    Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

commit acf92046a0a666051f9c6b4a53d874c618203173
Author: Hans Verkuil <hans.verkuil@cisco.com>
Date:   Sat Sep 20 16:16:36 2014 -0300

    [media] DocBook media: fix the poll() 'no QBUF' documentation
    
    Clarify what poll() returns if STREAMON was called but not QBUF.
    Make explicit the different behavior for this scenario for
    capture and output devices.
    
    Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
    Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

commit 58d75f4b1ce26324b4d809b18f94819843a98731
Author: Hans Verkuil <hans.verkuil@cisco.com>
Date:   Sat Sep 20 16:16:35 2014 -0300

    [media] vb2: fix VBI/poll regression
    
    The recent conversion of saa7134 to vb2 unconvered a poll() bug that
    broke the teletext applications alevt and mtt. These applications
    expect that calling poll() without having called VIDIOC_STREAMON will
    cause poll() to return POLLERR. That did not happen in vb2.
    
    This patch fixes that behavior. It also fixes what should happen when
    poll() is called when STREAMON is called but no buffers have been
    queued. In that case poll() will also return POLLERR, but only for
    capture queues since output queues will always return POLLOUT
    anyway in that situation.
    
    This brings the vb2 behavior in line with the old videobuf behavior.
    
    Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
    Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

commit 50394e7369d519ad0d732cb6913d2bbdf4213e2e
Author: Hans Verkuil <hverkuil@xs4all.nl>
Date:   Sat Sep 20 09:54:06 2014 -0300

    [media] cx2341x: fix kernel oops
    
    The v4l2_ctrl_config struct must be zeroed before passing it to
    v4l2_ctrl_new_custom(). This was always wrong, but with the recent
    v4l2-ctrls.c changes this is now much more likely to lead to a
    kernel bug.
    
    This is the only place where this struct wasn't initialized properly.
    
    Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
    Reported-by: Pridvorov Andrey <ua0lnj@bk.ru>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

commit fdc6b388925e3d0a4b4773ab7d641947fe59ed46
Author: Hans Verkuil <hverkuil@xs4all.nl>
Date:   Sat Sep 20 09:36:26 2014 -0300

    [media] cx24123: fix kernel oops due to missing parent pointer
    
    When I try to set the TV standard to e.g. PAL on my Hauppauge WinTV-HVR3000 I get
    the following oops:
    
     9464.262345] CX24123: detected CX24123
    [ 9464.262526] BUG: unable to handle kernel NULL pointer dereference at 0000000000000230
    [ 9464.262555] IP: [<ffffffff816676b5>] acpi_i2c_install_space_handler+0x15/0xc0
    [ 9464.262576] PGD 0
    [ 9464.262584] Oops: 0000 [#1] PREEMPT SMP
    [ 9464.262597] Modules linked in: cx24123 cx22702 cx88_dvb(+) videobuf_dvb cx88_vp3054_i2c cx88_blackbird cx8802 ir_lirc_codec ir_xmp_decoder ir_sanyo_decoder ir_jvc_decoder ir_mce_kbd_decoder ir_sharp_decoder lirc_dev ir_sony_decoder ir_rc6_decoder ir_nec_decoder ir_rc5_decoder rc_hauppauge wm8775 tuner_simple tuner_types tda9887 cx8800 cx88xx btcx_risc videobuf_dma_sg videobuf_core mt2131 s5h1409 tda8290 tuner cx25840 cx23885 altera_ci tda18271 altera_stapl videobuf2_dvb tveeprom cx2341x videobuf2_dma_sg dvb_core rc_core videobuf2_memops videobuf2_core v4l2_common videodev media nouveau x86_pkg_temp_thermal cfbfillrect cfbimgblt cfbcopyarea ttm drm_kms_helper processor button isci
    [ 9464.262786] CPU: 2 PID: 2417 Comm: modprobe Not tainted 3.17.0-rc1-telek #322
    [ 9464.262796] Hardware name: ASUSTeK COMPUTER INC. Z9PE-D8 WS/Z9PE-D8 WS, BIOS 5404 02/10/2014
    [ 9464.262807] task: ffff881097959ad0 ti: ffff88109967c000 task.ti: ffff88109967c000
    [ 9464.262817] RIP: 0010:[<ffffffff816676b5>]  [<ffffffff816676b5>] acpi_i2c_install_space_handler+0x15/0xc0
    [ 9464.262834] RSP: 0018:ffff88109967fbd8  EFLAGS: 00010246
    [ 9464.262843] RAX: 0000000000000000 RBX: ffff880892a89540 RCX: 0000000000000000
    [ 9464.262853] RDX: 0000000080000001 RSI: ffff880892e75870 RDI: ffff880892a89540
    [ 9464.262862] RBP: ffff88109967fbf8 R08: ffff881099b2ccc0 R09: ffff880891efa088
    [ 9464.262872] R10: 0000000000000000 R11: 0000000000000022 R12: 0000000000000000
    [ 9464.262883] R13: ffff880892a895b0 R14: 00000000ffffffed R15: ffff88089b48f800
    [ 9464.262893] FS:  00007fe42b6d7700(0000) GS:ffff88089fc40000(0000) knlGS:0000000000000000
    [ 9464.262904] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [ 9464.262912] CR2: 0000000000000230 CR3: 0000001094078000 CR4: 00000000000407e0
    [ 9464.262922] Stack:
    [ 9464.262927]  ffff880892a89540 0000000000000000 ffff880892a895b0 ffff88109a155a80
    [ 9464.262944]  ffff88109967fc20 ffffffff81666a36 0000000000000020 ffff880892a89540
    [ 9464.262960]  ffffffffa01c8d40 ffff88109967fc40 ffffffff81666c67 ffff880892a89000
    [ 9464.262977] Call Trace:
    [ 9464.262987]  [<ffffffff81666a36>] i2c_register_adapter+0x166/0x340
    [ 9464.262998]  [<ffffffff81666c67>] i2c_add_adapter+0x57/0x60
    [ 9464.263011]  [<ffffffffa01e2c58>] cx24123_attach+0x108/0x1ba [cx24123]
    [ 9464.263025]  [<ffffffffa01c5a76>] dvb_register+0x404/0x245b [cx88_dvb]
    [ 9464.263039]  [<ffffffffa0059183>] ? videobuf_queue_core_init+0xe3/0x140 [videobuf_core]
    [ 9464.263052]  [<ffffffffa01c54b1>] cx8802_dvb_probe+0x1e1/0x261 [cx88_dvb]
    [ 9464.263066]  [<ffffffffa01a3b00>] cx8802_register_driver+0x190/0x20d [cx8802]
    [ 9464.263077]  [<ffffffffa01cc000>] ? 0xffffffffa01cc000
    [ 9464.263089]  [<ffffffffa01cc025>] dvb_init+0x25/0x27 [cx88_dvb]
    [ 9464.263101]  [<ffffffff810002c4>] do_one_initcall+0x84/0x1c0
    [ 9464.263113]  [<ffffffff811893fa>] ? __vunmap+0x9a/0x100
    [ 9464.263125]  [<ffffffff81122a66>] load_module+0x1216/0x1790
    [ 9464.263134]  [<ffffffff8111ff70>] ? __symbol_put+0x70/0x70
    [ 9464.263145]  [<ffffffff811aa8cc>] ? vfs_read+0x11c/0x170
    [ 9464.263156]  [<ffffffff811201d9>] ? copy_module_from_fd.isra.53+0x119/0x170
    [ 9464.263168]  [<ffffffff81123116>] SyS_finit_module+0x76/0x80
    [ 9464.263181]  [<ffffffff818d19e9>] system_call_fastpath+0x16/0x1b
    [ 9464.263190] Code: 81 31 c0 e8 2e f6 e8 ff 48 83 c4 08 5b 5d eb de 66 0f 1f 44 00 00 55 48 89 e5 41 56 41 55 41 54 53 41 be ed ff ff ff 48 8b 47 70 <48> 8b 80 30 02 00 00 48 85 c0 74 58 4c 8b 68 08 4d 85 ed 74 4f
    [ 9464.263347] RIP  [<ffffffff816676b5>] acpi_i2c_install_space_handler+0x15/0xc0
    [ 9464.263361]  RSP <ffff88109967fbd8>
    [ 9464.263367] CR2: 0000000000000230
    [ 9464.266919] ---[ end trace 57fd490bdb72e733 ]---
    
    I traced this to a NULL i2c_adapter parent pointer when cx24123 creates its own
    i2c adapter. The acpi_i2c_install_space_handler function appeared in 3.17, so
    that's probably why this hasn't been seen before.
    
    Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

commit 77639ff2b3404a913b8037d230a384798b854bae
Author: Hans Verkuil <hverkuil@xs4all.nl>
Date:   Fri Sep 12 06:02:02 2014 -0300

    [media] adv7604: fix inverted condition
    
    The log_status function should show HDMI information, but the test checking for
    an HDMI input was inverted. Fix this.
    
    Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
    Cc: stable@vger.kernel.org      # for v3.12 and up
    Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

commit 7102076c922e310f5a914a21fcd8d65fd8bd2417
Author: Randy Dunlap <rdunlap@infradead.org>
Date:   Thu Aug 28 14:01:26 2014 -0300

    [media] media/radio: fix radio-miropcm20.c build with io.h header file
    
    Fix build errors in radio-miropcm20.c due to missing header file:
    
    drivers/media/radio/radio-miropcm20.c: In function 'rds_waitread':
    drivers/media/radio/radio-miropcm20.c:90:3: error: implicit declaration of function 'inb' [-Werror=implicit-function-declaration]
    drivers/media/radio/radio-miropcm20.c: In function 'rds_rawwrite':
    drivers/media/radio/radio-miropcm20.c:106:3: error: implicit declaration of function 'outb' [-Werror=implicit-function-declaration]
    
    Reported-by: Jim Davis <jim.epost@gmail.com>
    Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
    Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

commit a9ae4692eda4b99f85757b15d60971ff78a0a0e2
Author: Zhaowei Yuan <zhaowei.yuan@samsung.com>
Date:   Thu Aug 21 23:28:21 2014 -0300

    [media] vb2: fix plane index sanity check in vb2_plane_cookie()
    
    It's also invalid when plane_no is equal to vb->num_planes
    
    Signed-off-by: Zhaowei Yuan <zhaowei.yuan@samsung.com>
    Cc: stable@vger.kernel.org      # for v3.7 and up
    Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

commit 983ed755641cfeac99716311f3d3b464d742f304
Author: Hans Verkuil <hans.verkuil@cisco.com>
Date:   Mon Aug 4 06:16:37 2014 -0300

    [media] DocBook media: update version number and V4L2 changes
    
    Note: the revision text for the v4l2_pix_format change from Laurent
    erroneously mentioned 3.16 when it only got merged for 3.17. Fixed
    that as well.
    
    Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

commit 1b88db2f2bed287505e8decea512db5e3fe3929c
Author: Hans Verkuil <hans.verkuil@cisco.com>
Date:   Mon Aug 4 04:51:25 2014 -0300

    [media] DocBook media: fix fieldname in struct v4l2_subdev_selection
    
    Field 'rect' is really named 'r'.
    
    Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

commit bf3593d939520559774cbfee03ba5f314d909620
Author: Hans Verkuil <hans.verkuil@cisco.com>
Date:   Mon Aug 4 07:14:14 2014 -0300

    [media] vb2: fix vb2 state check when start_streaming fails
    
    Commit bd994ddb2a12a3ff48cd549ec82cdceaea9614df (vb2: Fix stream start and
    buffer completion race) broke the buffer state check in vb2_buffer_done.
    
    So accept all three possible states there since I can no longer tell the
    difference between vb2_buffer_done called from start_streaming or from
    elsewhere.
    
    Instead add a WARN_ON at the end of start_streaming that will check whether
    any buffers were added to the done list, since that implies that the wrong
    state was used as well.
    
    Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
    Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
    Cc: stable@vger.kernel.org      # for v3.15 and up
    Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

commit 44e8e69d46db9928cd3b81cbea4ca24257412286
Author: Hans Verkuil <hans.verkuil@cisco.com>
Date:   Mon Aug 4 07:12:32 2014 -0300

    [media] videobuf2-core.h: fix comment
    
    The comment for start_streaming that tells the developer with which vb2 state
    buffers should be returned to vb2 gave the wrong state. Very confusing.
    
    Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
    Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

commit 23cd08c8f72405359862aff2ad2a8be1c232198c
Author: Hans Verkuil <hans.verkuil@cisco.com>
Date:   Mon Aug 4 02:33:53 2014 -0300

    [media] videobuf2-core: add comments before the WARN_ON
    
    Recently WARN_ON() calls have been added to warn if the driver is not
    properly returning buffers to vb2 in start_streaming (if it fails) or
    stop_streaming(). Add comments before those WARN_ON calls that refer
    to the videobuf2-core.h header that explains what drivers are supposed
    to do in these situations. That should help point developers in the
    right direction if they see these warnings.
    
    Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
    Acked-by: Pawel Osciak <pawel@osciak.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

commit 47bc59c52b005f546343c373370a7eec6a2b0f84
Author: Hans Verkuil <hverkuil@xs4all.nl>
Date:   Fri Aug 1 09:18:50 2014 -0300

    [media] videobuf2-dma-sg: fix for wrong GFP mask to sg_alloc_table_from_pages
    
    sg_alloc_table_from_pages() only allocates a sg_table, so it should just use
    GFP_KERNEL, not gfp_flags. If gfp_flags contains __GFP_DMA32 then mm/sl[au]b.c
    will call BUG_ON:
    
    [  358.027515] ------------[ cut here ]------------
    [  358.027546] kernel BUG at mm/slub.c:1416!
    [  358.027558] invalid opcode: 0000 [#1] PREEMPT SMP
    [  358.027576] Modules linked in: mt2131 s5h1409 tda8290 tuner cx25840 cx23885 btcx_risc altera_ci tda18271 altera_stapl videobuf2_dvb tveeprom cx2341x videobuf2_dma_sg dvb_core rc_core videobuf2_memops videobuf2_core nouveau zr36067 videocodec v4l2_common videodev media x86_pkg_temp_thermal cfbfillrect cfbimgblt cfbcopyarea ttm drm_kms_helper processor button isci
    [  358.027712] CPU: 19 PID: 3654 Comm: cat Not tainted 3.16.0-rc6-telek #167
    [  358.027723] Hardware name: ASUSTeK COMPUTER INC. Z9PE-D8 WS/Z9PE-D8 WS, BIOS 5404 02/10/2014
    [  358.027741] task: ffff880897c7d960 ti: ffff88089b4d4000 task.ti: ffff88089b4d4000
    [  358.027753] RIP: 0010:[<ffffffff81196040>]  [<ffffffff81196040>] new_slab+0x280/0x320
    [  358.027776] RSP: 0018:ffff88089b4d7ae8  EFLAGS: 00010002
    [  358.027787] RAX: ffff880897c7d960 RBX: 0000000000000000 RCX: ffff88089b4d7b50
    [  358.027798] RDX: 00000000ffffffff RSI: 0000000000000004 RDI: ffff88089f803b00
    [  358.027809] RBP: ffff88089b4d7bb8 R08: 0000000000000000 R09: 0000000100400040
    [  358.027821] R10: 0000160000000000 R11: ffff88109bc02c40 R12: 0000000000000001
    [  358.027832] R13: ffff88089f8000c0 R14: ffff88089f803b00 R15: ffff8810bfcf4be0
    [  358.027845] FS:  00007f83fe5c0700(0000) GS:ffff8810bfce0000(0000) knlGS:0000000000000000
    [  358.027858] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [  358.027868] CR2: 0000000001dfd568 CR3: 0000001097d5a000 CR4: 00000000000407e0
    [  358.027878] Stack:
    [  358.027885]  ffffffff81198860 ffff8810bfcf4be0 ffff880897c7d960 0000000000001b00
    [  358.027905]  ffff880897c7d960 0000000000000000 ffff8810bfcf4bf0 0000000000000000
    [  358.027924]  0000000000000000 0000000100000100 ffffffff813ef84a 00000004ffffffff
    [  358.027944] Call Trace:
    [  358.027956]  [<ffffffff81198860>] ? __slab_alloc+0x400/0x4e0
    [  358.027973]  [<ffffffff813ef84a>] ? sg_kmalloc+0x1a/0x30
    [  358.027985]  [<ffffffff81198f17>] __kmalloc+0x127/0x150
    [  358.027997]  [<ffffffff813ef84a>] ? sg_kmalloc+0x1a/0x30
    [  358.028009]  [<ffffffff813ef84a>] sg_kmalloc+0x1a/0x30
    [  358.028023]  [<ffffffff813eff84>] __sg_alloc_table+0x74/0x180
    [  358.028035]  [<ffffffff813ef830>] ? sg_kfree+0x20/0x20
    [  358.028048]  [<ffffffff813f00af>] sg_alloc_table+0x1f/0x60
    [  358.028061]  [<ffffffff813f0174>] sg_alloc_table_from_pages+0x84/0x1f0
    [  358.028077]  [<ffffffffa007c3f9>] vb2_dma_sg_alloc+0x159/0x230 [videobuf2_dma_sg]
    [  358.028095]  [<ffffffffa003d55a>] __vb2_queue_alloc+0x10a/0x680 [videobuf2_core]
    [  358.028113]  [<ffffffffa003e110>] __reqbufs.isra.14+0x220/0x3e0 [videobuf2_core]
    [  358.028130]  [<ffffffffa003e79d>] __vb2_init_fileio+0xbd/0x380 [videobuf2_core]
    [  358.028147]  [<ffffffffa003f563>] __vb2_perform_fileio+0x5b3/0x6e0 [videobuf2_core]
    [  358.028164]  [<ffffffffa003f871>] vb2_fop_read+0xb1/0x100 [videobuf2_core]
    [  358.028184]  [<ffffffffa06dd2e5>] v4l2_read+0x65/0xb0 [videodev]
    [  358.028198]  [<ffffffff811a243f>] vfs_read+0x8f/0x170
    [  358.028210]  [<ffffffff811a30a1>] SyS_read+0x41/0xb0
    [  358.028224]  [<ffffffff818f02e9>] system_call_fastpath+0x16/0x1b
    [  358.028234] Code: 66 90 e9 dc fd ff ff 0f 1f 40 00 41 8b 4d 68 e9 d5 fe ff ff 0f 1f 80 00 00 00 00 f0 41 80 4d 00 40 e9 03 ff ff ff 0f 1f 44 00 00 <0f> 0b 66 0f 1f 44 00 00 44 89 c6 4c 89 45 d0 e8 0c 82 ff ff 48
    [  358.028415] RIP  [<ffffffff81196040>] new_slab+0x280/0x320
    [  358.028432]  RSP <ffff88089b4d7ae8>
    [  358.032208] ---[ end trace 6443240199c706e4 ]---
    
    Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
    Cc: stable@vger.kernel.org      # for v3.13 and up
    Acked-by: Marek Szyprowski <m.szyprowski@samsung.com>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>

commit c735483de1a2cd5d6c6b67bf49cfb2991eae6ea6
Author: Helge Deller <deller@gmx.de>
Date:   Sun Sep 21 22:31:08 2014 +0200

    parisc: pdc_stable.c: Avoid potential stack overflows
    
    Signed-off-by: Helge Deller <deller@gmx.de>

commit 94c457deff2a211f8372f69a4d7b0d288183756a
Author: Rickard Strandqvist <rickard_strandqvist@spectrumdigital.se>
Date:   Sun Sep 14 18:02:12 2014 +0200

    parisc: pdc_stable.c: Cleaning up unnecessary use of memset in conjunction with strncpy
    
    Using memset before strncpy just to ensure a trailing null character is
    an unnecessary double writing of a string
    
    Patch modified by Helge Deller to additionally reduce stack usage.
    
    Signed-off-by: Rickard Strandqvist <rickard_strandqvist@spectrumdigital.se>
    Signed-off-by: Helge Deller <deller@gmx.de>

commit fe5c873459a973e59854bd235a7e6b3eaa8e5fe0
Author: Helge Deller <deller@gmx.de>
Date:   Sun Sep 21 21:01:15 2014 +0200

    parisc: ptrace: use secure_computing_strict()
    
    Signed-off-by: Helge Deller <deller@gmx.de>

commit 9b67aa4a82492f128adfccc63e61ab57c1ce1dfd
Author: Samuel Gauthier <samuel.gauthier@6wind.com>
Date:   Thu Sep 18 10:31:04 2014 +0200

    openvswitch: restore OVS_FLOW_CMD_NEW notifications
    
    Since commit fb5d1e9e127a ("openvswitch: Build flow cmd netlink reply only if needed."),
    the new flows are not notified to the listeners of OVS_FLOW_MCGROUP.
    
    This commit fixes the problem by using the genl function, ie
    genl_has_listerners() instead of netlink_has_listeners().
    
    Signed-off-by: Samuel Gauthier <samuel.gauthier@6wind.com>
    Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
    Acked-by: Pravin B Shelar <pshelar@nicira.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 0d566379c5e15a2922dc6bb2ee6a4b7f7a3a0786
Author: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Date:   Thu Sep 18 10:31:03 2014 +0200

    genetlink: add function genl_has_listeners()
    
    This function is the counterpart of the function netlink_has_listeners().
    
    Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
    Acked-by: Pravin B Shelar <pshelar@nicira.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit b3f2512ecdb3561ffa44737f370fdb78e1febf6b
Author: Fabian Frederick <fabf@skynet.be>
Date:   Wed Sep 17 21:07:19 2014 +0200

    lib: rhashtable: remove second linux/log2.h inclusion
    
    linux/log2.h was included twice.
    
    Signed-off-by: Fabian Frederick <fabf@skynet.be>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 0d0162e7a33d3710b9604e7c68c0f31f5c457428
Author: Francesco Ruggeri <fruggeri@arista.com>
Date:   Wed Sep 17 10:40:44 2014 -0700

    net: allow macvlans to move to net namespace
    
    I cannot move a macvlan interface created on top of a bonding interface
    to a different namespace:
    
    % ip netns add dummy0
    % ip link add link bond0 mac0 type macvlan
    % ip link set mac0 netns dummy0
    RTNETLINK answers: Invalid argument
    %
    
    The problem seems to be that commit f9399814927a ("bonding: Don't allow
    bond devices to change network namespaces.") sets NETIF_F_NETNS_LOCAL
    on bonding interfaces, and commit 797f87f83b60 ("macvlan: fix netdev
    feature propagation from lower device") causes macvlan interfaces
    to inherit its features from the lower device.
    
    NETIF_F_NETNS_LOCAL should not be inherited from the lower device
    by a macvlan.
    Patch tested on 3.16.
    
    Signed-off-by: Francesco Ruggeri <fruggeri@arista.com>
    Acked-by: Cong Wang <cwang@twopensource.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 8400dd029e764e30361a51a7ae35900ae0032b43
Author: Neil Horman <nhorman@tuxdriver.com>
Date:   Wed Sep 17 09:04:45 2014 -0400

    3c59x: Fix bad offset spec in skb_frag_dma_map
    
    Recently aded the use of skb_frag_dma_map to 3c59x, but didn't realize it
    automatically included the frag_offset internally, as well as provided an option
    to specify an extra offset in the parameter list.  We need to specify an offset
    of 0 in the parameter list to avoid skb corruption that results in lost
    connections.
    
    Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
    CC: Linux Kernel list <linux-kernel@vger.kernel.org>
    CC: "David S. Miller" <davem@davemloft.net>
    CC: Meelis Roos <mroos@linux.ee>
    Tested-by: Meelis Roos <mroos@linux.ee>

commit 6f2b6a3005b2c34c39f207a87667564f64f2f91a
Author: Neil Horman <nhorman@tuxdriver.com>
Date:   Wed Sep 17 09:04:44 2014 -0400

    3c59x: Add dma error checking and recovery
    
    Noted that 3c59x has no checks on transmit for failed DMA mappings, and no
    ability to unmap fragments when a single map fails in the middle of a transmit.
    This patch provides error checking to ensure that dma mappings work properly,
    and unrolls an skb mapping if a fragmented skb transmission has a mapping
    failure to prevent leaks.
    
    Signed-off-by: Neil Horman <nhorman@tuxdriver.com>
    CC: Linux Kernel list <linux-kernel@vger.kernel.org>
    CC: "David S. Miller" <davem@davemloft.net>
    CC: Meelis Roos <mroos@linux.ee>
    Tested-by: Meelis Roos <mroos@linux.ee>

commit f6f2332dce0efeea8c5653b6e9d1e8c379ace65c
Author: Alexei Starovoitov <ast@plumgrid.com>
Date:   Tue Sep 16 18:32:58 2014 -0700

    sparc: bpf_jit: fix support for ldx/stx mem and SKF_AD_VLAN_TAG
    
    fix several issues in sparc BPF JIT compiler.
    
    ldx/stx related:
    . classic BPF instructions that access mem[] slots were not setting
      SEEN_MEM flag, so stack wasn't allocated. Fix that by advertising
      correct flags
    
    . LDX/STX instructions were missing SEEN_XREG, so register value
      could have leaked to user space. Fix it.
    
    . since stack for mem[] slots is allocated with 'sub %sp' instead
      of 'save %sp', use %sp as base register instead of %fp.
    
    . ldx mem[0] means first slot in classic BPF which should have
      -4 offset instead of 0.
    
    . sparc64 needs 2047 stack bias as per ABI to access stack
    
    . emit_stmem() was using LD32I macro instead of ST32I
    
    SKF_AD_VLAN_TAG* related:
    . SKF_AD_VLAN_TAG_PRESENT must return 1 or 0 instead of '> 0' or 0
      as per classic BPF de facto standard
    
    . SKF_AD_VLAN_TAG needs to mask the field correctly
    
    Fixes: 2809a2087cc4 ("net: filter: Just In Time compiler for sparc")
    Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 85cbb7c728bf39c45a9789b88c9471c0d7a58b0e
Author: Mike Marciniszyn <mike.marciniszyn@intel.com>
Date:   Fri Sep 19 08:32:19 2014 -0400

    IB/qib: Correct reference counting in debugfs qp_stats
    
    This particular reference count is not needed with the rcu protection,
    and the current code leaks a reference count, causing a hang in
    qib_qp_destroy().
    
    Cc: <stable@vger.kernel.org>
    Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
    Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>

commit 68f9d83c7765b110de54677573e9538f3ca6ca04
Author: Alex Estrin <alex.estrin@intel.com>
Date:   Wed Aug 20 11:15:08 2014 -0400

    IPoIB: Remove unnecessary port query
    
    There are two queries for port attributes one after another. A second
    call is not needed since port_attr structure already holds the data.
    
    Reviewed-by: Ira Weiny <ira.weiny@intel.com>
    Signed-off-by: Alex Estrin <alex.estrin@intel.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>

commit 12d8706963f073fffad16c7c24160ef20d9aeaff
Author: Bjorn Helgaas <bhelgaas@google.com>
Date:   Fri Sep 19 11:08:40 2014 -0600

    Revert "PCI: Make sure bus number resources stay within their parents bounds"
    
    This reverts commit 1820ffdccb9b ("PCI: Make sure bus number resources stay
    within their parents bounds") because it breaks some systems with LSI Logic
    FC949ES Fibre Channel Adapters, apparently by exposing a defect in those
    adapters.
    
    Dirk tested a Tyan VX50 (B4985) with this device that worked like this
    prior to 1820ffdccb9b:
    
        bus: [bus 00-7f] on node 0 link 1
        ACPI: PCI Root Bridge [PCI0] (domain 0000 [bus 00-07])
        pci 0000:00:0e.0: PCI bridge to [bus 0a]
        pci_bus 0000:0a: busn_res: can not insert [bus 0a] under [bus 00-07] (conflicts with (null) [bus 00-07])
        pci 0000:0a:00.0: [1000:0646] type 00 class 0x0c0400 (FC adapter)
    
    Note that the root bridge [bus 00-07] aperture is wrong; this is a BIOS
    defect in the PCI0 _CRS method.  But prior to 1820ffdccb9b, we didn't
    enforce that aperture, and the FC adapter worked fine at 0a:00.0.
    
    After 1820ffdccb9b, we notice that 00:0e.0's aperture is not contained in
    the root bridge's aperture, so we reconfigure it so it *is* contained:
    
        pci 0000:00:0e.0: bridge configuration invalid ([bus 0a-0a]), reconfiguring
        pci 0000:00:0e.0: PCI bridge to [bus 06-07]
    
    This effectively moves the FC device from 0a:00.0 to 07:00.0, which should
    be legal.  But when we enumerate bus 06, the FC device doesn't respond, so
    we don't find anything.  This is probably a defect in the FC device.
    
    Possible fixes (due to Yinghai):
    
        1) Add a quirk to fix the _CRS information based on what amd_bus.c read
           from the hardware
    
        2) Reset the FC device after we change its bus number
    
        3) Revert 1820ffdccb9b
    
    Fix 1 would be relatively easy, but it does sweep the LSI FC issue under
    the rug.  We might want to reconfigure bus numbers in the future for some
    other reason, e.g., hotplug, and then we could trip over this again.
    
    For that reason, I like fix 2, but we don't know whether it actually works,
    and we don't have a patch for it yet.
    
    This revert is fix 3, which also sweeps the LSI FC issue under the rug.
    
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=84281
    Reported-by: Dirk Gouders <dirk@gouders.net>
    Tested-by: Dirk Gouders <dirk@gouders.net>
    Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
    CC: stable@vger.kernel.org	# v3.15+
    CC: Yinghai Lu <yinghai@kernel.org>

commit 50e2ec9105fe1045298924a6c7b9ce870a0b6c13
Author: Markus Stockhausen <stockhausen@collogia.de>
Date:   Wed Aug 13 14:07:30 2014 +0000

    IB/mlx4: Disable TSO for Connect-X rev. A0 HCAs
    
    According to <http://marc.info/?t=138347640900004&r=1&w=2>, revision
    A0 of Connect-X does not correctly assemble TSO packets.  Disable that
    feature on that hardware revision.
    
    Signed-off-by: Roland Dreier <roland@purestorage.com>

commit f5c4984e065556b81edf3c9dadfbc8750de690fc
Author: Mike Marciniszyn <mike.marciniszyn@intel.com>
Date:   Mon Sep 15 11:42:53 2014 -0400

    IB/qib: Change get_user_pages() usage to always NULL vmas
    
    The static helper routine, __qib_get_user_pages(), accepts a vma arg,
    but current use always passes NULL.
    
    This has caused some confusion associated with the correct use of this
    argument, but since the current use case doesn't require the
    flexiblity, the best thing to do is to simplfy the code to always pass
    NULL to get_user_pages().
    
    Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
    Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>

commit 3033771febebf2c66d5146624746ebc4a3d79314
Author: Mike Marciniszyn <mike.marciniszyn@intel.com>
Date:   Mon Sep 15 11:43:06 2014 -0400

    IB/ipath: Change get_user_pages() usage to always NULL vmas
    
    The static helper routine, __ipath_get_user_pages(), accepts a vma
    arg, but current use always passes NULL.
    
    This has caused some confusion associated with the correct use of this
    argument, but since the current use case doesn't require the
    flexiblity, the best thing to do is to simplfy the code to always pass
    NULL to get_user_pages().
    
    Reviewed-by: Dennis Dalessandro <dennis.dalessandro@intel.com>
    Signed-off-by: Mike Marciniszyn <mike.marciniszyn@intel.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>

commit 7a0b33d4a45d30b9a838fba4efcd80b7b57d4d16
Author: Bjorn Helgaas <bhelgaas@google.com>
Date:   Fri Sep 19 10:56:06 2014 -0600

    Revert "PCI: Don't scan random busses in pci_scan_bridge()"
    
    This reverts commit fc1b253141b3 ("PCI: Don't scan random busses in
    pci_scan_bridge()") because it breaks CardBus on some machines.
    
    David tested a Dell Latitude D505 that worked like this prior to
    fc1b253141b3:
    
        pci 0000:00:1e.0: PCI bridge to [bus 01]
        pci 0000:01:01.0: CardBus bridge to [bus 02-05]
    
    Note that the 01:01.0 CardBus bridge has a bus number aperture of
    [bus 02-05], but those buses are all outside the 00:1e.0 PCI bridge bus
    number aperture, so accesses to buses 02-05 never reach CardBus.  This is
    later patched up by yenta_fixup_parent_bridge(), which changes the
    subordinate bus number of the 00:1e.0 PCI bridge:
    
        pci_bus 0000:01: Raising subordinate bus# of parent bus (#01) from #01 to #05
    
    With fc1b253141b3, pci_scan_bridge() fails immediately when it notices that
    we can't allocate a valid secondary bus number for the CardBus bridge, and
    CardBus doesn't work at all:
    
        pci 0000:01:01.0: can't allocate child bus 01 from [bus 01]
    
    I'd prefer to fix this by integrating the yenta_fixup_parent_bridge() logic
    into pci_scan_bridge() so we fix the bus number apertures up front.  But
    I don't think we can do that before v3.17, so I'm going to revert this to
    avoid the problem while we're working on the long-term fix.
    
    Link: https://bugzilla.kernel.org/show_bug.cgi?id=83441
    Link: http://lkml.kernel.org/r/1409303414-5196-1-git-send-email-david.henningsson@canonical.com
    Reported-by: David Henningsson <david.henningsson@canonical.com>
    Tested-by: David Henningsson <david.henningsson@canonical.com>
    Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
    CC: stable@vger.kernel.org	# v3.15+

commit 87773dd56d5405ac28119fcfadacefd35877c18f
Author: Shawn Bohrer <sbohrer@rgmadvisors.com>
Date:   Wed Sep 3 12:13:57 2014 -0500

    IB: ib_umem_release() should decrement mm->pinned_vm from ib_umem_get
    
    In debugging an application that receives -ENOMEM from ib_reg_mr(), I
    found that ib_umem_get() can fail because the pinned_vm count has
    wrapped causing it to always be larger than the lock limit even with
    RLIMIT_MEMLOCK set to RLIM_INFINITY.
    
    The wrapping of pinned_vm occurs because the process that calls
    ib_reg_mr() will have its mm->pinned_vm count incremented.  Later a
    different process with a different mm_struct than the one that
    allocated the ib_umem struct ends up releasing it which results in
    decrementing the new processes mm->pinned_vm count past zero and
    wrapping.
    
    I'm not entirely sure what circumstances cause a different process to
    release the ib_umem than the one that allocated it but the kernel
    stack trace of the freeing process from my situation looks like the
    following:
    
        Call Trace:
         [<ffffffff814d64b1>] dump_stack+0x19/0x1b
         [<ffffffffa0b522a5>] ib_umem_release+0x1f5/0x200 [ib_core]
         [<ffffffffa0b90681>] mlx4_ib_destroy_qp+0x241/0x440 [mlx4_ib]
         [<ffffffffa0b4d93c>] ib_destroy_qp+0x12c/0x170 [ib_core]
         [<ffffffffa0cc7129>] ib_uverbs_close+0x259/0x4e0 [ib_uverbs]
         [<ffffffff81141cba>] __fput+0xba/0x240
         [<ffffffff81141e4e>] ____fput+0xe/0x10
         [<ffffffff81060894>] task_work_run+0xc4/0xe0
         [<ffffffff810029e5>] do_notify_resume+0x95/0xa0
         [<ffffffff814e3dd0>] int_signal+0x12/0x17
    
    The following patch fixes the issue by storing the pid struct of the
    process that calls ib_umem_get() so that ib_umem_release and/or
    ib_umem_account() can properly decrement the pinned_vm count of the
    correct mm_struct.
    
    Signed-off-by: Shawn Bohrer <sbohrer@rgmadvisors.com>
    Reviewed-by: Shachar Raindel <raindel@mellanox.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>

commit f93439e476d012b2503dbb07fe0fc675bcbff099
Author: Devesh Sharma <devesh.sharma@emulex.com>
Date:   Mon Jun 9 10:52:38 2014 +0530

    RDMA/ocrdma: Do not skip setting deferred_arm
    
    When ib_request_notify_cq() is called for the first time, ocrdma tries
    to skip setting deffered_arm flag. This may lead CQ to an un-armed
    state thus never generating a CQ event and leaving consumer hung.
    
    This patch removes the part of code that skips setting deferred_arm.
    
    Signed-off-by: Devesh Sharma <devesh.sharma@emulex.com>
    Signed-off-by: Selvin Xavier <selvin.xavier@emulex.com>
    Signed-off-by: Mitesh Ahuja <mitesh.ahuja@emulex.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>

commit d6a488f21c0f3c44bfbb2339a75159ee55aa2b6f
Author: Devesh Sharma <devesh.sharma@emulex.com>
Date:   Mon Jun 9 10:52:37 2014 +0530

    RDMA/ocrdma: Report correct value of max_fast_reg_page_list_len
    
    Fix ocrdma_query_device() to report correct value of max_fast_reg_page_list_len.
    
    Signed-off-by: Devesh Sharma <devesh.sharma@emulex.com>
    Signed-off-by: Selvin Xavier <selvin.xavier@emulex.com>
    Signed-off-by: Mitesh Ahuja <mitesh.ahuja@emulex.com>
    Signed-off-by: Roland Dreier <roland@purestorage.com>

commit 8245b3634516e6b7eb1c94594c0fd41d233502aa
Author: Huacai Chen <chenhc@lemote.com>
Date:   Fri Sep 19 14:57:02 2014 +0800

    ALSA: hda - Add fixup model name lookup for Lemote A1205
    
    Lemote A1004 is already added in commit a2dd933d01f (ALSA: hda - Add
    fixup name lookup for CX5051 and 5066 codecs), but Lemote A1205 has
    missing.
    
    Signed-off-by: Huacai Chen <chenhc@lemote.com>
    Cc: <stable@vger.kernel.org> # 3.15+
    Signed-off-by: Takashi Iwai <tiwai@suse.de>

commit eb4aec84d6bdf98d00cedb41c18000f7a31e648a
Author: Zefan Li <lizefan@huawei.com>
Date:   Thu Sep 18 17:28:46 2014 +0800

    cgroup: fix unbalanced locking
    
    cgroup_pidlist_start() holds cgrp->pidlist_mutex and then calls
    pidlist_array_load(), and cgroup_pidlist_stop() releases the mutex.
    
    It is wrong that we release the mutex in the failure path in
    pidlist_array_load(), because cgroup_pidlist_stop() will be called
    no matter if cgroup_pidlist_start() returns errno or not.
    
    Fixes: 4bac00d16a8760eae7205e41d2c246477d42a210
    Cc: <stable@vger.kernel.org> # 3.14+
    Signed-off-by: Zefan Li <lizefan@huawei.com>
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Acked-by: Cong Wang <xiyou.wangcong@gmail.com>

commit 413e55742a4f18da6173271ca66748e690997f30
Author: Tadeusz Struk <tadeusz.struk@intel.com>
Date:   Wed Sep 10 14:07:25 2014 -0700

    crypto: qat - Enable all 32 IRQs
    
    Enable interrupts from all 32 bundles.
    
    Signed-off-by: Conor McLoughlin <conor.mcloughlin@intel.com>
    Signed-off-by: Tadeusz Struk <tadeusz.struk@intel.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

commit e77980e50bc2850599d4d9c0192b67a9ffd6daac
Author: David Dueck <davidcdueck@googlemail.com>
Date:   Wed Sep 17 14:26:48 2014 +0200

    can: at91_can: add missing prepare and unprepare of the clock
    
    In order to make the driver work with the common clock framework, this patch
    converts the clk_enable()/clk_disable() to
    clk_prepare_enable()/clk_disable_unprepare(). While there, add the missing
    error handling.
    
    Signed-off-by: David Dueck <davidcdueck@googlemail.com>
    Signed-off-by: Anthony Harivel <anthony.harivel@emtrion.de>
    Acked-by: Boris Brezillon <boris.brezillon@free-electrons.com>
    Cc: linux-stable <stable@vger.kernel.org>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit 4c728d804c4b9d1ae7f76e8f32c419bc21a6e540
Author: Marc Kleine-Budde <mkl@pengutronix.de>
Date:   Tue Sep 2 16:54:17 2014 +0200

    can: flexcan: increase FLEXCAN_MCR_MAXMB() macro to 7 bits
    
    This patch increases the mask in the FLEXCAN_MCR_MAXMB() to 7 bits as in the
    newer flexcan cores the MAXMB field is 7 bits wide.
    
    Reported-by: David Jander <david@protonic.nl>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit de5944883ebbedbf5adc8497659772f5da7b7d72
Author: Marc Kleine-Budde <mkl@pengutronix.de>
Date:   Tue Sep 16 15:31:27 2014 +0200

    can: flexcan: put TX mailbox into TX_INACTIVE mode after tx-complete
    
    After sending a RTR frame the TX mailbox becomes a RX_EMPTY mailbox. To avoid
    side effects when the RX-FIFO is full, this patch puts the TX mailbox into
    TX_INACTIVE mode in the transmission complete interrupt handler. This, of
    course, leaves a race window between the actual completion of the transmission
    and the handling of tx-complete interrupt. However this is the best we can do
    without busy polling the tx complete interrupt.
    
    Cc: linux-stable <stable@vger.kernel.org>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit 25e924450fcb23c11c07c95ea8964dd9f174652e
Author: David Jander <david@protonic.nl>
Date:   Wed Sep 3 16:47:22 2014 +0200

    can: flexcan: implement workaround for errata ERR005829
    
    This patch implements the workaround mentioned in ERR005829:
    
        ERR005829: FlexCAN: FlexCAN does not transmit a message that is enabled to
        be transmitted in a specific moment during the arbitration process.
    
    Workaround: The workaround consists of two extra steps after setting up a
    message for transmission:
    
    Step 8: Reserve the first valid mailbox as an inactive mailbox (CODE=0b1000).
    If RX FIFO is disabled, this mailbox must be message buffer 0. Otherwise, the
    first valid mailbox can be found using the "RX FIFO filters" table in the
    FlexCAN chapter of the chip reference manual.
    
    Step 9: Write twice INACTIVE code (0b1000) into the first valid mailbox.
    
    Signed-off-by: David Jander <david@protonic.nl>
    Cc: linux-stable <stable@vger.kernel.org>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit fc05b884a31dbf259cc73cc856e634ec3acbebb6
Author: David Jander <david@protonic.nl>
Date:   Wed Aug 27 11:58:05 2014 +0200

    can: flexcan: correctly initialize mailboxes
    
    Apparently mailboxes may contain random data at startup, causing some of them
    being prepared for message reception. This causes overruns being missed or even
    confusing the IRQ check for trasmitted messages, increasing the transmit
    counter instead of the error counter.
    
    This patch initializes all mailboxes after the FIFO as RX_INACTIVE.
    
    Signed-off-by: David Jander <david@protonic.nl>
    Cc: linux-stable <stable@vger.kernel.org>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit c32fe4ad3e4861b2bfa1f44114c564935a123dda
Author: Marc Kleine-Budde <mkl@pengutronix.de>
Date:   Tue Sep 16 12:39:28 2014 +0200

    can: flexcan: mark TX mailbox as TX_INACTIVE
    
    This patch fixes the initialization of the TX mailbox. It is now correctly
    initialized as TX_INACTIVE not RX_EMPTY.
    
    Cc: linux-stable <stable@vger.kernel.org>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit 4be0015c955a9a6e26395dbaba4bfdedf8f755ca
Author: Oliver Hartkopp <socketcan@hartkopp.net>
Date:   Tue Sep 16 10:05:41 2014 +0200

    can: peak_pci: add PCI ID definition pcie card variant
    
    Add PCI ID definition for the single channel PCAN ExpressCard 34 adapter. Due
    to the subsystem id evaluation the correct number of channels (here 1) is
    created at initialization time. Tested including the LED functionality.
    
    Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
    Acked-by: Stephane Grosjean <s.grosjean@peak-system.com>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit a7380db5f0d6dd94981e73da08d8fa863ee72235
Author: Roger Quadros <rogerq@ti.com>
Date:   Tue Sep 9 17:31:08 2014 +0300

    can: c_can_platform: fix parameters of c_can_hw_raminit_ti()
    
    Pass the correct 'mask' and 'value' bits to c_can_hw_raminit_wait_ti(). They
    seem to have been swapped in the usage instances.
    
    Reported-by: Jay Schroeder <jay.schroeder@garmin.com>
    Signed-off-by: Roger Quadros <rogerq@ti.com>
    Cc: linux-stable <stable@vger.kernel.org>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit e2cf1f1cc7636bd860e47cd0ad6194da8975f8b5
Author: David Howells <dhowells@redhat.com>
Date:   Wed Sep 17 23:28:38 2014 +0100

    CacheFiles: Handle rename2
    
    Not all filesystems now provide the rename i_op - ext4 for one - but rather
    provide the rename2 i_op.  CacheFiles checks that the filesystem has rename
    and so will reject ext4 now with EPERM:
    
    	CacheFiles: Failed to register: -1
    
    Fix this by checking for rename2 as an alternative.  The call to vfs_rename()
    actually handles selection of the appropriate function, so we needn't worry
    about that.
    
    Turning on debugging shows:
    
    	[cachef] ==> cachefiles_get_directory(,,cache)
    	[cachef] subdir -> ffff88000b22b778 positive
    	[cachef] <== cachefiles_get_directory() = -1 [check]
    
    where -1 is EPERM.
    
    Signed-off-by: David Howells <dhowells@redhat.com>

commit 696382f938d22597f4945865ed8e3f25e240cd41
Author: NeilBrown <neilb@suse.de>
Date:   Wed Aug 27 15:06:20 2014 +0100

    cachefiles: remove two unused pagevecs.
    
    
    These two have been unused since
    
    commit c4d6d8dbf335c7fa47341654a37c53a512b519bb
        CacheFiles: Fix the marking of cached pages
    
    in 3.8.
    
    Signed-off-by: NeilBrown <neilb@suse.de>
    Signed-off-by: David Howells <dhowells@redhat.com>

commit 3e1199dcad004a40b55297a4736ccd1b9b81a952
Author: Milosz Tanski <milosz@adfin.com>
Date:   Wed Aug 13 12:58:26 2014 -0400

    FS-Cache: refcount becomes corrupt under vma pressure.
    
    In rare cases under heavy VMA pressure the ref count for a fscache cookie
    becomes corrupt. In this case we decrement ref count even if we fail before
    incrementing the refcount.
    
    FS-Cache: Assertion failed bnode-eca5f9c6/syslog
    0 > 0 is false
    ------------[ cut here ]------------
    kernel BUG at fs/fscache/cookie.c:519!
    invalid opcode: 0000 [#1] SMP
    Call Trace:
    [<ffffffffa01ba060>] __fscache_relinquish_cookie+0x50/0x220 [fscache]
    [<ffffffffa02d64ce>] ceph_fscache_unregister_inode_cookie+0x3e/0x50 [ceph]
    [<ffffffffa02ae1d3>] ceph_destroy_inode+0x33/0x200 [ceph]
    [<ffffffff811cf67e>] ? __fsnotify_inode_delete+0xe/0x10
    [<ffffffff811a9e0c>] destroy_inode+0x3c/0x70
    [<ffffffff811a9f51>] evict+0x111/0x180
    [<ffffffff811aa763>] iput+0x103/0x190
    [<ffffffff811a5de8>] __dentry_kill+0x1c8/0x220
    [<ffffffff811a5f31>] shrink_dentry_list+0xf1/0x250
    [<ffffffff811a762c>] prune_dcache_sb+0x4c/0x60
    [<ffffffff811930af>] super_cache_scan+0xff/0x170
    [<ffffffff8113d7a0>] shrink_slab_node+0x140/0x2c0
    [<ffffffff8113f2da>] shrink_slab+0x8a/0x130
    [<ffffffff81142572>] balance_pgdat+0x3e2/0x5d0
    [<ffffffff811428ca>] kswapd+0x16a/0x4a0
    [<ffffffff810a43f0>] ? __wake_up_sync+0x20/0x20
    [<ffffffff81142760>] ? balance_pgdat+0x5d0/0x5d0
    [<ffffffff81083e09>] kthread+0xc9/0xe0
    [<ffffffff81010000>] ? ftrace_raw_event_xen_mmu_release_ptpage+0x70/0x90
    [<ffffffff81083d40>] ? flush_kthread_worker+0xb0/0xb0
    [<ffffffff8159f63c>] ret_from_fork+0x7c/0xb0
    [<ffffffff81083d40>] ? flush_kthread_worker+0xb0/0xb0
    RIP [<ffffffffa01b984b>] __fscache_disable_cookie+0x1db/0x210 [fscache]
    RSP <ffff8803bc85f9b8>
    ---[ end trace 254d0d7c74a01f25 ]---
    
    Signed-off-by: Milosz Tanski <milosz@adfin.com>
    Signed-off-by: David Howells <dhowells@redhat.com>

commit 0a0039ad541d6ecdb4028e77ac6eae49a36af82b
Author: Aravind Gopalakrishnan <Aravind.Gopalakrishnan@amd.com>
Date:   Tue Sep 16 14:58:16 2014 -0500

    hwmon: (fam15h_power) Add support for two more processors
    
    Fam16h,M30h(Mullins) and Fam15hM30h(Kaveri) processors can
    report 'power_crit' value. So, adding their respective device ids.
    
    Signed-off-by: Aravind Gopalakrishnan <Aravind.Gopalakrishnan@amd.com>
    Signed-off-by: Guenter Roeck <linux@roeck-us.net>

commit 961a23788c3448eec7906bd74c64c01c54fba80e
Author: Aravind Gopalakrishnan <Aravind.Gopalakrishnan@amd.com>
Date:   Tue Sep 16 14:58:04 2014 -0500

    hwmon: (fam15h_power) Make actual power reporting conditional
    
    power1_input should only be reported for Fam15h, Models 00h-0fh
    So, introduce a is_visible function to take care of this.
    
    As suggested by Guenter here:
    http://marc.info/?l=linux-kernel&m=141038145616437&w=2
    
    Suggested-by: Guenter Roeck <linux@roeck-us.net>
    Fixes: 22e32f4f5777 ('x86,AMD: Power driver support for AMD's family 16h processors')
    Signed-off-by: Aravind Gopalakrishnan <Aravind.Gopalakrishnan@amd.com>
    Signed-off-by: Guenter Roeck <linux@roeck-us.net>

commit 6a38792ca8a5da28f65dc42eeb73d9a431f8d0fd
Author: Randy Dunlap <rdunlap@infradead.org>
Date:   Tue Sep 16 13:47:41 2014 -0700

    scsi: use 'depends' instead of 'select' for SCSI_FC_ATTRS
    
    There are other kconfig symbols which use SCSI_FC_ATTRS.
    In order to maintain sanity and prevent kconfig warnings, change
    all of these from using 'select' to using 'depends on' so that
    proper symbol dependencies will be honored and circular depends
    problems will be avoided.
    This fixes kconfig warnings and build errors:
    
    warning: (LIBFC && SCSI_IBMVFC && SCSI_QLA_FC && SCSI_LPFC && ZFCP && SCSI_BFA_FC && SCSI_CHELSIO_FCOE && FUSION_FC) selects SCSI_FC_ATTRS which has unmet direct dependencies (SCSI && NET)
    drivers/scsi/scsi_transport_fc.c: In function 'fc_host_post_event':
    drivers/scsi/scsi_transport_fc.c:543:7: error: 'scsi_nl_sock' undeclared (first use in this function)
    drivers/scsi/scsi_transport_fc.c: In function 'fc_host_post_vendor_event':
    drivers/scsi/scsi_transport_fc.c:611:7: error: 'scsi_nl_sock' undeclared (first use in this function)
    
    Reported-by: Fengguang Wu <fengguang.wu@intel.com> [0-day test robot]
    Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit f650fb456f2079b762c131a11397c0a966e2bfe4
Author: Edward Cree <ecree@solarflare.com>
Date:   Tue Sep 16 17:05:21 2014 +0100

    sfc: fix addr_list_lock spinlock use before init
    
    Reported by Nikolay Aleksandrov.  In efx_init_port() we call
     efx_mac_reconfigure() to work around a Falcon/A1 limitation, and this calls
     efx_{arch}_filter_sync_rx_mode(), which takes the addr_list_lock; but this
     lock is uninitialised, because we haven't called register_netdevice() yet.
    So, in efx_farch_filter_sync_rx_mode(), check efx_dev_registered() before
     doing anything else.
    The EF10 equivalent, efx_ef10_filter_sync_rx_mode(), already has the
     corresponding check.
    
    Signed-off-by: Edward Cree <ecree@solarflare.com>
    Tested-by: Nikolay Aleksandrov <nikolay@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit dda3b191eb6c5a56d443723dcb71ade60d97c04f
Author: Marcel Holtmann <marcel@holtmann.org>
Date:   Fri Sep 12 21:49:28 2014 +0200

    net: rfkill: gpio: Enable module auto-loading for ACPI based switches
    
    For the ACPI based switches the MODULE_DEVICE_TABLE is missing to
    export the entries for module auto-loading.
    
    Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 929a031dfd62aae34bf8e728f712e6751e416d1f
Author: hayeswang <hayeswang@realtek.com>
Date:   Tue Sep 16 11:40:47 2014 +0800

    r8169: adjust __rtl8169_set_features
    
    Remove the "changed" test in __rtl8169_set_features(). Instead, do
    simple test in rtl8169_set_features().
    
    Set the RxChkSum and RxVlan through __rtl8169_set_features() in
    rtl_open().
    
    Signed-off-by: Francois Romieu <romieu@fr.zoreil.com>
    Signed-off-by: Hayes Wang <hayeswang@realtek.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit b8c203b2d2fc961bafd53b41d5396bbcdec55998
Author: Steffen Klassert <steffen.klassert@secunet.com>
Date:   Tue Sep 16 10:08:49 2014 +0200

    xfrm: Generate queueing routes only from route lookup functions
    
    Currently we genarate a queueing route if we have matching policies
    but can not resolve the states and the sysctl xfrm_larval_drop is
    disabled. Here we assume that dst_output() is called to kill the
    queued packets. Unfortunately this assumption is not true in all
    cases, so it is possible that these packets leave the system unwanted.
    
    We fix this by generating queueing routes only from the
    route lookup functions, here we can guarantee a call to
    dst_output() afterwards.
    
    Fixes: a0073fe18e71 ("xfrm: Add a state resolution packet queue")
    Reported-by: Konstantinos Kolelis <k.kolelis@sirrix.com>
    Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

commit f92ee61982d6da15a9e49664ecd6405a15a2ee56
Author: Steffen Klassert <steffen.klassert@secunet.com>
Date:   Tue Sep 16 10:08:40 2014 +0200

    xfrm: Generate blackhole routes only from route lookup functions
    
    Currently we genarate a blackhole route route whenever we have
    matching policies but can not resolve the states. Here we assume
    that dst_output() is called to kill the balckholed packets.
    Unfortunately this assumption is not true in all cases, so
    it is possible that these packets leave the system unwanted.
    
    We fix this by generating blackhole routes only from the
    route lookup functions, here we can guarantee a call to
    dst_output() afterwards.
    
    Fixes: 2774c131b1d ("xfrm: Handle blackhole route creation via afinfo.")
    Reported-by: Konstantinos Kolelis <k.kolelis@sirrix.com>
    Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>

commit 95cd6f488d164de462a8279e802a0ad05c33d167
Author: Randy Dunlap <rdunlap@infradead.org>
Date:   Mon Sep 15 17:20:42 2014 -0700

    scsi: fix build errors, SCSI_FC_ATTRS needs to depend on SCSI && NET
    
    Fix build errors when CONFIG_SCSI_NETLINK is enabled but
    CONFIG_NET is not enabled:
    
    drivers/built-in.o: In function `scsi_nl_rcv_msg':
    scsi_netlink.c:(.text+0x1850fa): undefined reference to `netlink_ack'
    scsi_netlink.c:(.text+0x185105): undefined reference to `skb_pull'
    scsi_netlink.c:(.text+0x18515d): undefined reference to `netlink_capable'
    drivers/built-in.o: In function `scsi_netlink_init':
    (.text+0x185244): undefined reference to `init_net'
    drivers/built-in.o: In function `scsi_netlink_init':
    (.text+0x185258): undefined reference to `__netlink_kernel_create'
    drivers/built-in.o: In function `scsi_netlink_exit':
    (.text+0x185291): undefined reference to `netlink_kernel_release'
    
    Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
    Tested-by: Anish Bhatt <anish@chelsio.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 23a3c99201954d8ffe92e599e3c3039985280f1b
Author: Anish Bhatt <anish@chelsio.com>
Date:   Mon Sep 15 13:45:21 2014 -0700

    bnx2i/bnx2fc : fix randconfig error in next-20140909
    
    Just like CNIC, tristate of these two modules is also dependent on IPV6.
    These need to be handled separately as they select CNIC, which can override
    tristate for CNIC from 'm' to 'y', which can cause build failures when ipv6 is
     compiled as a module even if CNIC's Kconfig will only 'm' or 'n' when ipv6 is
    compiled as a module.
    
    Fixes: c99d667e8527 ("cnic : Cleanup CONFIG_IPV6 & VLAN check")
    Signed-off-by: Anish Bhatt <anish@chelsio.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 5d6be6a5d4864712832822efeb9c2d54e4063949
Author: Anish Bhatt <anish@chelsio.com>
Date:   Mon Sep 15 13:45:20 2014 -0700

    scsi_netlink : Make SCSI_NETLINK dependent on NET instead of selecting NET
    
    Required for avoiding recursive dependencies in the Kconfig, brought out
    by fixing randconfig error for bnx2i/bnx2fc in the patch that follows.
    As suggested by Randy Dunlap
    
    Signed-off-by: Anish Bhatt <anish@chelsio.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit d6ce2628f32271c037a8c12e1994c9fba3a4af49
Author: Hariprasad Shenai <hariprasad@chelsio.com>
Date:   Tue Sep 16 02:58:46 2014 +0530

    cxgb4: Don't allocate adapter structure for all PF's
    
    commit 35b1de557970 ("rdma/cxgb4: Fixes cxgb4 probe failure in VM when PF is
    exposed through PCI Passthrough") moved the code to check for SR-IOV PF[0..3]
    much further down in init_one() past the point where we allocate a (struct
    adapter) for PF[0..3]. As a result, we left four of these on ever module remove.
    
    Fix: Allocate adapter structure only for PF4
    
    Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit c095f248e63ada504dd90c90baae673ae10ee3fe
Author: Vlad Yasevich <vyasevich@gmail.com>
Date:   Mon Sep 15 15:24:26 2014 -0400

    bridge: Fix br_should_learn to check vlan_enabled
    
    As Toshiaki Makita pointed out, the BRIDGE_INPUT_SKB_CB will
    not be initialized in br_should_learn() as that function
    is called only from br_handle_local_finish().  That is
    an input handler for link-local ethernet traffic so it perfectly
    correct to check br->vlan_enabled here.
    
    Reported-by: Toshiaki Makita<toshiaki.makita1@gmail.com>
    Fixes: 20adfa1 bridge: Check if vlan filtering is enabled only once.
    Signed-off-by: Vladislav Yasevich <vyasevic@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit d21ccfd0a60ea3dece3e1d142f52694abf87a0b1
Author: Johannes Stezenbach <js@sig21.net>
Date:   Fri Sep 12 22:36:51 2014 +0200

    ath9k_htc: fix random decryption failure
    
    In v3.15 the driver stopped to accept network packets after successful
    authentification, which could be worked around by passing the
    nohwcrypt=1 module parameter.  This was not reproducible by
    everyone, and showed random behaviour in some tests.
    It was caused by an uninitialized variable introduced
    in 4ed1a8d4a257 ("ath9k_htc: use ath9k_cmn_rx_accept") and
    used in 341b29b9cd2f ("ath9k_htc: use ath9k_cmn_rx_skb_postprocess").
    
    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=78581
    Fixes: 341b29b9cd2f ("ath9k_htc: use ath9k_cmn_rx_skb_postprocess")
    Signed-off-by: Johannes Stezenbach <js@sig21.net>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 87c4790330810fe5caf0172d9320cf24ef19cebe
Author: Arend van Spriel <arend@broadcom.com>
Date:   Fri Sep 12 16:19:30 2014 +0200

    brcmfmac: handle IF event for P2P_DEVICE interface
    
    The firmware notifies about interface changes through the IF event
    which has a NO_IF flag that means host can ignore the event. This
    behaviour was introduced in the driver by:
    
      commit 2ee8382fc6c763c76396a6aaff77a27089eed3aa
      Author: Arend van Spriel <arend@broadcom.com>
      Date:   Sat Aug 10 12:27:24 2013 +0200
    
          brcmfmac: ignore IF event if firmware indicates it
    
    It turns out that the IF event for the P2P_DEVICE also has this
    flag set, but the event should not be ignored in this scenario.
    The mentioned commit caused a regression in 3.12 kernel in creation
    of the P2P_DEVICE interface.
    
    Cc: <stable@vger.kernel.org> # 3.14, 3.16
    Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
    Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
    Reviewed-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
    Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
    Signed-off-by: Arend van Spriel <arend@broadcom.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 8f2b45971b32824b830a544ed1d179215770b1eb
Author: Arend van Spriel <arend@broadcom.com>
Date:   Thu Sep 11 22:51:32 2014 +0200

    brcmfmac: obtain ifp through wdev structure
    
    For P2P_DEVICE interface the function brcmf_cfg80211_update_proto_addr_mode()
    resulted in a crash, because it assumed wdev->netdev would be valid. The
    ifp should be obtained through the driver vif structure which contains the
    wireless_dev.
    
    Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
    Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
    Reviewed-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
    Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
    Signed-off-by: Arend van Spriel <arend@broadcom.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit f1d56039b58f6f786450a858b2c8d2459a3382cc
Author: Arend van Spriel <arend@broadcom.com>
Date:   Thu Sep 11 22:51:31 2014 +0200

    brcmfmac: conditionally compile firmware protocol source code
    
    The host-interface can select which protocol implementation it
    needs. Selecting PCIe will include the msgbuf protocol and selecting
    USB and/or SDIO will include the bcdc protocol. The PCIe kconfig
    option assures the dependencies for msgbuf are met, ie. HAS_DMA.
    
    Reported-by: Geert Uytterhoeven <geert@linux-m68k.org>
    Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
    Reviewed-by: Hante Meuleman <meuleman@broadcom.com>
    Reviewed-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
    Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
    Signed-off-by: Arend van Spriel <arend@broadcom.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit fac7d2a3b8798f8b58004c74c4b37b9643b5897a
Author: Hante Meuleman <meuleman@broadcom.com>
Date:   Thu Sep 11 22:51:30 2014 +0200

    brcmfmac: Fix memory leak and missing assignment.
    
    The function brcmf_enable_bw40_2g contains a memory leak. The
    function is also missing initialisation of one of the members of
    ch struct, which can lead to warning but this has no impact on
    result.
    
    Reviewed-by: Arend Van Spriel <arend@broadcom.com>
    Reviewed-by: Franky (Zhenhui) Lin <frankyl@broadcom.com>
    Reviewed-by: Pieter-Paul Giesberts <pieterpg@broadcom.com>
    Reviewed-by: Daniel (Deognyoun) Kim <dekim@broadcom.com>
    Signed-off-by: Hante Meuleman <meuleman@broadcom.com>
    Signed-off-by: Arend van Spriel <arend@broadcom.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 7ce64c79c4decdeb1afe0bf2f6ef834b382871d1
Author: Alexander Y. Fomichev <git.user@gmail.com>
Date:   Mon Sep 15 14:22:35 2014 +0400

    net: fix creation adjacent device symlinks
    
    __netdev_adjacent_dev_insert may add adjust device of different net
    namespace, without proper check it leads to emergence of broken
    sysfs links from/to devices in another namespace.
    Fix: rewrite netdev_adjacent_is_neigh_list macro as a function,
         move net_eq check into netdev_adjacent_is_neigh_list.
         (thanks David)
         related to: 4c75431ac3520631f1d9e74aa88407e6374dbbc4
    
    Signed-off-by: Alexander Fomichev <git.user@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 95e8b10393f88a0db88d97e9d1953f01c854315a
Author: Mike Looijmans <mike.looijmans@topic.nl>
Date:   Mon Sep 15 12:06:33 2014 +0200

    net/phy: micrel: Disable asymmetric pause for KSZ9031
    
    The KSZ9031 appears to suffer from the same hardware bug as described
    for the KSZ9021 in commit 32fcafbcd1c9f6c7013016a22a5369b4acb93577
    ("net/phy: micrel: Disable asymmetric pause for KSZ9021")
    you have to unplug the cable and plug it back to get it to work.
    
    Remove the SUPPORTED_Asym_Pause flag for the KSZ9031 to fix this.
    
    Signed-off-by: Mike Looijmans <mike.looijmans@topic.nl>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 85c8555ff07ef09261bd50d603cd4290cff5a8cc
Author: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Date:   Fri Sep 12 15:16:00 2014 +0200

    KVM: check for !is_zero_pfn() in kvm_is_mmio_pfn()
    
    Read-only memory ranges may be backed by the zero page, so avoid
    misidentifying it a a MMIO pfn.
    
    This fixes another issue I identified when testing QEMU+KVM_UEFI, where
    a read to an uninitialized emulated NOR flash brought in the zero page,
    but mapped as a read-write device region, because kvm_is_mmio_pfn()
    misidentifies it as a MMIO pfn due to its PG_reserved bit being set.
    
    Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
    Fixes: b88657674d39 ("ARM: KVM: user_mem_abort: support stage 2 MMIO page mapping")
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

commit 0b70068e47e8f0c813a902dc3d6def601fd15acb
Author: Ard Biesheuvel <ard.biesheuvel@linaro.org>
Date:   Fri Sep 12 22:17:23 2014 +0200

    mm: export symbol dependencies of is_zero_pfn()
    
    In order to make the static inline function is_zero_pfn() callable by
    modules, export its symbol dependencies 'zero_pfn' and (for s390 and
    mips) 'zero_page_mask'.
    
    We need this for KVM, as CONFIG_KVM is a tristate for all supported
    architectures except ARM and arm64, and testing a pfn whether it refers
    to the zero page is required to correctly distinguish the zero page
    from other special RAM ranges that may also have the PG_reserved bit
    set, but need to be treated as MMIO memory.
    
    Signed-off-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
    Acked-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

commit 635126b7ca13a01d6322fbf7bdc5d1c738d26807
Author: Vlad Yasevich <vyasevic@redhat.com>
Date:   Fri Sep 12 16:26:17 2014 -0400

    bridge: Allow clearing of pvid and untagged bitmap
    
    Currently, it is possible to modify the vlan filter
    configuration to add pvid or untagged support.
    For example:
      bridge vlan add vid 10 dev eth0
      bridge vlan add vid 10 dev eth0 untagged pvid
    
    The second statement will modify vlan 10 to
    include untagged and pvid configuration.
    However, it is currently impossible to go backwards
      bridge vlan add vid 10 dev eth0 untagged pvid
      bridge vlan add vid 10 dev eth0
    
    Here nothing happens.  This patch correct this so
    that any modifiers not supplied are removed from
    the configuration.
    
    Signed-off-by: Vlad Yasevich <vyasevic@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 20adfa1a81af00bf2027644507ad4fa9cd2849cf
Author: Vlad Yasevich <vyasevich@gmail.com>
Date:   Fri Sep 12 16:26:16 2014 -0400

    bridge: Check if vlan filtering is enabled only once.
    
    The bridge code checks if vlan filtering is enabled on both
    ingress and egress.   When the state flip happens, it
    is possible for the bridge to currently be forwarding packets
    and forwarding behavior becomes non-deterministic.  Bridge
    may drop packets on some interfaces, but not others.
    
    This patch solves this by caching the filtered state of the
    packet into skb_cb on ingress.  The skb_cb is guaranteed to
    not be over-written between the time packet entres bridge
    forwarding path and the time it leaves it.  On egress, we
    can then check the cached state to see if we need to
    apply filtering information.
    
    Signed-off-by: Vladislav Yasevich <vyasevic@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 9a72c2da690d78e93cff24b9f616412508678dd5
Author: Nikolay Aleksandrov <nikolay@redhat.com>
Date:   Fri Sep 12 17:38:18 2014 +0200

    bonding: fix div by zero while enslaving and transmitting
    
    The problem is that the slave is first linked and slave_cnt is
    incremented afterwards leading to a div by zero in the modes that use it
    as a modulus. What happens is that in bond_start_xmit()
    bond_has_slaves() is used to evaluate further transmission and it becomes
    true after the slave is linked in, but when slave_cnt is used in the xmit
    path it is still 0, so fetch it once and transmit based on that. Since
    it is used only in round-robin and XOR modes, the fix is only for them.
    Thanks to Eric Dumazet for pointing out the fault in my first try to fix
    this.
    
    Call trace (took it out of net-next kernel, but it's the same with net):
    [46934.330038] divide error: 0000 [#1] SMP
    [46934.330041] Modules linked in: bonding(O) 9p fscache
    snd_hda_codec_generic crct10dif_pclmul
    [46934.330041] bond0: Enslaving eth1 as an active interface with an up
    link
    [46934.330051]  ppdev joydev crc32_pclmul crc32c_intel 9pnet_virtio
    ghash_clmulni_intel snd_hda_intel 9pnet snd_hda_controller parport_pc
    serio_raw pcspkr snd_hda_codec parport virtio_balloon virtio_console
    snd_hwdep snd_pcm pvpanic i2c_piix4 snd_timer i2ccore snd soundcore
    virtio_blk virtio_net virtio_pci virtio_ring virtio ata_generic
    pata_acpi floppy [last unloaded: bonding]
    [46934.330053] CPU: 1 PID: 3382 Comm: ping Tainted: G           O
    3.17.0-rc4+ #27
    [46934.330053] Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
    [46934.330054] task: ffff88005aebf2c0 ti: ffff88005b728000 task.ti:
    ffff88005b728000
    [46934.330059] RIP: 0010:[<ffffffffa0198c33>]  [<ffffffffa0198c33>]
    bond_start_xmit+0x1c3/0x450 [bonding]
    [46934.330060] RSP: 0018:ffff88005b72b7f8  EFLAGS: 00010246
    [46934.330060] RAX: 0000000000000679 RBX: ffff88004b077000 RCX:
    000000000000002a
    [46934.330061] RDX: 0000000000000000 RSI: ffff88004b3f0500 RDI:
    ffff88004b077940
    [46934.330061] RBP: ffff88005b72b830 R08: 00000000000000c0 R09:
    ffff88004a83e000
    [46934.330062] R10: 000000000000ffff R11: ffff88004b1f12c0 R12:
    ffff88004b3f0500
    [46934.330062] R13: ffff88004b3f0500 R14: 000000000000002a R15:
    ffff88004b077940
    [46934.330063] FS:  00007fbd91a4c740(0000) GS:ffff88005f080000(0000)
    knlGS:0000000000000000
    [46934.330064] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
    [46934.330064] CR2: 00007f803a8bb000 CR3: 000000004b2c9000 CR4:
    00000000000406e0
    [46934.330069] Stack:
    [46934.330071]  ffffffff811e6169 00000000e772fa05 ffff88004b077000
    ffff88004b3f0500
    [46934.330072]  ffffffff81d17d18 000000000000002a 0000000000000000
    ffff88005b72b8a0
    [46934.330073]  ffffffff81620108 ffffffff8161fe0e ffff88005b72b8c4
    ffff88005b302000
    [46934.330073] Call Trace:
    [46934.330077]  [<ffffffff811e6169>] ?
    __kmalloc_node_track_caller+0x119/0x300
    [46934.330084]  [<ffffffff81620108>] dev_hard_start_xmit+0x188/0x410
    [46934.330086]  [<ffffffff8161fe0e>] ? harmonize_features+0x2e/0x90
    [46934.330088]  [<ffffffff81620b06>] __dev_queue_xmit+0x456/0x590
    [46934.330089]  [<ffffffff81620c50>] dev_queue_xmit+0x10/0x20
    [46934.330090]  [<ffffffff8168f022>] arp_xmit+0x22/0x60
    [46934.330091]  [<ffffffff8168f090>] arp_send.part.16+0x30/0x40
    [46934.330092]  [<ffffffff8168f1e5>] arp_solicit+0x115/0x2b0
    [46934.330094]  [<ffffffff8160b5d7>] ? copy_skb_header+0x17/0xa0
    [46934.330096]  [<ffffffff8162875a>] neigh_probe+0x4a/0x70
    [46934.330097]  [<ffffffff8162979c>] __neigh_event_send+0xac/0x230
    [46934.330098]  [<ffffffff8162a00b>] neigh_resolve_output+0x13b/0x220
    [46934.330100]  [<ffffffff8165f120>] ? ip_forward_options+0x1c0/0x1c0
    [46934.330101]  [<ffffffff81660478>] ip_finish_output+0x1f8/0x860
    [46934.330102]  [<ffffffff81661f08>] ip_output+0x58/0x90
    [46934.330103]  [<ffffffff81661602>] ? __ip_local_out+0xa2/0xb0
    [46934.330104]  [<ffffffff81661640>] ip_local_out_sk+0x30/0x40
    [46934.330105]  [<ffffffff81662a66>] ip_send_skb+0x16/0x50
    [46934.330106]  [<ffffffff81662ad3>] ip_push_pending_frames+0x33/0x40
    [46934.330107]  [<ffffffff8168854c>] raw_sendmsg+0x88c/0xa30
    [46934.330110]  [<ffffffff81612b31>] ? skb_recv_datagram+0x41/0x60
    [46934.330111]  [<ffffffff816875a9>] ? raw_recvmsg+0xa9/0x1f0
    [46934.330113]  [<ffffffff816978d4>] inet_sendmsg+0x74/0xc0
    [46934.330114]  [<ffffffff81697a9b>] ? inet_recvmsg+0x8b/0xb0
    [46934.330115] bond0: Adding slave eth2
    [46934.330116]  [<ffffffff8160357c>] sock_sendmsg+0x9c/0xe0
    [46934.330118]  [<ffffffff81603248>] ?
    move_addr_to_kernel.part.20+0x28/0x80
    [46934.330121]  [<ffffffff811b4477>] ? might_fault+0x47/0x50
    [46934.330122]  [<ffffffff816039b9>] ___sys_sendmsg+0x3a9/0x3c0
    [46934.330125]  [<ffffffff8144a14a>] ? n_tty_write+0x3aa/0x530
    [46934.330127]  [<ffffffff810d1ae4>] ? __wake_up+0x44/0x50
    [46934.330129]  [<ffffffff81242b38>] ? fsnotify+0x238/0x310
    [46934.330130]  [<ffffffff816048a1>] __sys_sendmsg+0x51/0x90
    [46934.330131]  [<ffffffff816048f2>] SyS_sendmsg+0x12/0x20
    [46934.330134]  [<ffffffff81738b29>] system_call_fastpath+0x16/0x1b
    [46934.330144] Code: 48 8b 10 4c 89 ee 4c 89 ff e8 aa bc ff ff 31 c0 e9
    1a ff ff ff 0f 1f 00 4c 89 ee 4c 89 ff e8 65 fb ff ff 31 d2 4c 89 ee 4c
    89 ff <f7> b3 64 09 00 00 e8 02 bd ff ff 31 c0 e9 f2 fe ff ff 0f 1f 00
    [46934.330146] RIP  [<ffffffffa0198c33>] bond_start_xmit+0x1c3/0x450
    [bonding]
    [46934.330146]  RSP <ffff88005b72b7f8>
    
    CC: Eric Dumazet <eric.dumazet@gmail.com>
    CC: Andy Gospodarek <andy@greyhouse.net>
    CC: Jay Vosburgh <j.vosburgh@gmail.com>
    CC: Veaceslav Falico <vfalico@gmail.com>
    Fixes: 278b208375 ("bonding: initial RCU conversion")
    Signed-off-by: Nikolay Aleksandrov <nikolay@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 36d8e82541c4be8f529dce9efbcefd504e085ccf
Author: hayeswang <hayeswang@realtek.com>
Date:   Fri Sep 12 11:35:12 2014 +0800

    r8169: fix setting rx vlan
    
    The setting should depend on the new features not the current one.
    
    Signed-off-by: Hayes Wang <hayeswang@realtek.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 48c20407f49039d8da155ca00877ec5f057799e6
Author: hayeswang <hayeswang@realtek.com>
Date:   Fri Sep 12 11:35:11 2014 +0800

    r8169: fix the default setting of rx vlan
    
    If the parameter "features" of __rtl8169_set_features() is equal to
    dev->features, the variable "changed" is alwayes 0, and nothing would
    be changed.
    
    Signed-off-by: Hayes Wang <hayeswang@realtek.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 618073e30c225ddaef086c030a5f0a3c7ef2d323
Author: Mugunthan V N <mugunthanvnm@ti.com>
Date:   Thu Sep 11 22:52:38 2014 +0530

    drivers: net: cpsw: dual_emac: in suspend/resume bring down/up all the netdev
    
    During suspend and resume in Dual EMAC, second port is not working as in
    suspend/resume only the first slave netdev is closed and opened. So bring
    down and up all the interfaces that are up during suspend/resume.
    
    Signed-off-by: Mugunthan V N <mugunthanvnm@ti.com>
    Tested-by: Nishanth Menon <nm@ti.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 0bc9b73be43b21838973e80ddeb5250f0310ebf7
Author: Mark Einon <mark.einon@gmail.com>
Date:   Thu Sep 11 23:19:49 2014 +0100

    drivers: net: b44: Fix typo in returning multicast stats
    
    nstat->multicast refers to received packets, not transmitted as
    is returned here. Change it so that received packet stats are
    given.
    
    Signed-off-by: Mark Einon <mark.einon@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 381f4dca48d23e155b936b86ccd3ff12f073cf0f
Author: Sabrina Dubroca <sd@queasysnail.net>
Date:   Wed Sep 10 23:23:02 2014 +0200

    ipv6: clean up anycast when an interface is destroyed
    
    If we try to rmmod the driver for an interface while sockets with
    setsockopt(JOIN_ANYCAST) are alive, some refcounts aren't cleaned up
    and we get stuck on:
    
      unregister_netdevice: waiting for ens3 to become free. Usage count = 1
    
    If we LEAVE_ANYCAST/close everything before rmmod'ing, there is no
    problem.
    
    We need to perform a cleanup similar to the one for multicast in
    addrconf_ifdown(how == 1).
    
    Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
    Acked-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 74dd40bca95f9968e368751ea81f3b98471109ce
Author: Beniamino Galvani <b.galvani@gmail.com>
Date:   Wed Sep 10 22:50:03 2014 +0200

    net: arc_emac: prevent reuse of unreclaimed tx descriptors
    
    This patch changes the logic in tx path to ensure that tx descriptors
    are reused for transmission only after they have been reclaimed by
    arc_emac_tx_clean().
    
    Signed-off-by: Beniamino Galvani <b.galvani@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 7ce7679d6bbd1715799a9cf17b9b558bc2d962b7
Author: Beniamino Galvani <b.galvani@gmail.com>
Date:   Wed Sep 10 22:50:02 2014 +0200

    net: arc_emac: enable tx interrupts
    
    In the current implementation the cleaning of tx ring is done by the
    NAPI poll handler, which is scheduled after rx interrupts. Thus, in
    absence of received packets the reclaim of used tx buffers is never
    executed, blocking further transmission.
    
    This can be easily reproduced starting the transmission of a UDP flow
    with iperf, which blocks almost immediately because skbs are not
    returned to the stack and the socket send buffer becomes full.
    
    The patch enables tx interrupts so that the tx reclaim is scheduled
    after completed transmissions.
    
    Signed-off-by: Beniamino Galvani <b.galvani@gmail.com>
    Reviewed-by: Florian Fainelli <f.fainelli@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit e09c2c295468476a239d13324ce9042ec4de05eb
Author: Tejun Heo <tj@kernel.org>
Date:   Sat Sep 13 04:14:30 2014 +0900

    workqueue: apply __WQ_ORDERED to create_singlethread_workqueue()
    
    create_singlethread_workqueue() is a compat interface for single
    threaded workqueue which maps to ordered workqueue w/ rescuer in the
    current implementation.  create_singlethread_workqueue() currently
    implemented by invoking alloc_workqueue() w/ appropriate parameters.
    
    8719dceae2f9 ("workqueue: reject adjusting max_active or applying
    attrs to ordered workqueues") introduced __WQ_ORDERED to protect
    ordered workqueues against dynamic attribute changes which can break
    ordering guarantees but forgot to apply it to
    create_singlethread_workqueue().  This in itself is okay as nobody
    currently uses dynamic attribute change on workqueues created with
    create_singlethread_workqueue().
    
    However, 4c16bd327c ("workqueue: implement NUMA affinity for unbound
    workqueues") broke singlethreaded guarantee for ordered workqueues
    through allocating a separate pool_workqueue on each NUMA node by
    default.  A later change 8a2b75384444 ("workqueue: fix ordered
    workqueues in NUMA setups") fixed it by allocating only one global
    pool_workqueue if __WQ_ORDERED is set.
    
    Combined, the __WQ_ORDERED omission in create_singlethread_workqueue()
    became critical breaking its single threadedness and ordering
    guarantee.
    
    Let's make create_singlethread_workqueue() wrap
    alloc_ordered_workqueue() instead so that it inherits __WQ_ORDERED and
    can implicitly track future ordered_workqueue changes.
    
    v2: I missed that __WQ_ORDERED now protects against pwq splitting
        across NUMA nodes and incorrectly described the patch as a
        nice-to-have fix to protect against future dynamic attribute
        usages.  Oleg pointed out that this is actually a critical
        breakage due to 8a2b75384444 ("workqueue: fix ordered workqueues
        in NUMA setups").
    
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Reported-by: Mike Anderson <mike.anderson@us.ibm.com>
    Cc: Oleg Nesterov <onestero@redhat.com>
    Cc: Gustavo Luiz Duarte <gduarte@redhat.com>
    Cc: Tomas Henzl <thenzl@redhat.com>
    Cc: stable@vger.kernel.org
    Fixes: 4c16bd327c ("workqueue: implement NUMA affinity for unbound workqueues")

commit ae0fd6354134e63aa3e62456e2080c430287144d
Author: Sujith Manoharan <c_manoha@qca.qualcomm.com>
Date:   Thu Sep 11 19:05:48 2014 +0530

    Revert "ath9k: Calculate sleep duration"
    
    This reverts commit 09ebb810927a110e4c354beb20308830d108a54b.
    
    ath9k_hw_set_sta_beacon_timers() configures AR_TIM_PERIOD with
    the beacon interval. Before this commit, the sleepduration was
    never greater than the beacon interval. But now, the behavior
    has changed. For example, with an AP that uses a beacon interval of 100:
    
    ath: phy9: next beacon 61128704
    ath: phy9: beacon period 204800
    ath: phy9: DTIM period 204800
    
    If the sleepduration is calculated based on the listen time, then
    the bmiss threshold should also be changed since the HW would
    be in sleep state for a longer time, but that is not done currently.
    
    To avoid configuring a higher beacon interval based on the sleepduration,
    revert to the original behavior. Power consumption is not a
    problem since PS is disabled in ath9k anyway.
    
    Cc: stable@vger.kernel.org
    Cc: Rajkumar Manoharan <rmanohar@qti.qualcomm.com>
    Signed-off-by: Sujith Manoharan <c_manoha@qca.qualcomm.com>
    Signed-off-by: John W. Linville <linville@tuxdriver.com>

commit 8badd65e48c90d66587359d5329c2813088c0f50
Author: David Jander <david@protonic.nl>
Date:   Wed Aug 27 12:02:16 2014 +0200

    can: flexcan: avoid calling usleep_range from interrupt context
    
    Apparently can_restart() runs from a (timer-) interrupt and can call
    flexcan_chip_[en|dis]able(), so avoid using usleep_range()
    
    Signed-off-by: David Jander <david@protonic.nl>
    Cc: linux-stable <stable@vger.kernel.org>
    Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>

commit 1d7efe9dfaa6025acd29a726315f6f7d30a9f1ca
Author: Markos Chandras <markos.chandras@imgtec.com>
Date:   Wed Sep 10 14:51:44 2014 +0100

    Documentation: filter: Add MIPS to architectures with BPF JIT
    
    MIPS supports BPF JIT since v3.16-rc1
    
    Cc: Randy Dunlap <rdunlap@infradead.org>
    Cc: "David S. Miller" <davem@davemloft.net>
    Cc: Daniel Borkmann <dborkman@redhat.com>
    Cc: Alexei Starovoitov <ast@plumgrid.com>
    Cc: linux-doc@vger.kernel.org
    Cc: linux-kernel@vger.kernel.org
    Acked-by: Daniel Borkmann <dborkman@redhat.com>
    Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
    Acked-by: Alexei Starovoitov <ast@plumgrid.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 8e1a03b63c62bfa622c3989f8aead17ea845db7d
Author: Or Gerlitz <ogerlitz@mellanox.com>
Date:   Wed Sep 10 17:15:11 2014 +0300

    mlx4: Fix wrong endianess access with QP context flags
    
    We wrongly tested QP context bits without BE conversion
    as was spotted by sparse...
    
    drivers/infiniband/hw/mlx4/qp.c:1685:38: sparse: restricted __be32 degrades to integer
    
    Fix that!
    
    Fixes: d2fce8a ('mlx4: Set user-space raw Ethernet QPs to properly handle VXLAN traffic')
    Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 09e05c3f78e9e82bda5958eb95bbf719f7a0ed6b
Author: Matan Barak <matanb@mellanox.com>
Date:   Wed Sep 10 16:41:56 2014 +0300

    net/mlx4: Set vlan stripping policy by the right command
    
    Changing the vlan stripping policy of the QP isn't supported by older
    firmware versions for the INIT2RTR command. Nevertheless, we've used it.
    
    Fix that by doing this policy change using INIT2RTR only if the firmware
    supports it, otherwise, we call UPDATE_QP command to do the task.
    
    Fixes: 7677fc9 ('net/mlx4: Strengthen VLAN tags/priorities enforcement in VST mode')
    Signed-off-by: Matan Barak <matanb@mellanox.com>
    Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit b7834758e6f33da401f584035f1b6b62d0672aab
Author: Matan Barak <matanb@mellanox.com>
Date:   Wed Sep 10 16:41:55 2014 +0300

    net/mlx4: Avoid dealing with MAC index in UPDATE_QP wrapper if not needed
    
    The current wrapper implementation of the UPDATE_QP command tries to get
    the MAC index, even if MAC wasn't set by the VF. Fix it up to only handle
    the MAC field if it's valid.
    
    Fixes: ce8d9e0 ('net/mlx4_core: Add UPDATE_QP SRIOV wrapper support')
    Signed-off-by: Matan Barak <matanb@mellanox.com>
    Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 311be98a3cca6469adf369714d689f9bbf286190
Author: Matan Barak <matanb@mellanox.com>
Date:   Wed Sep 10 16:41:54 2014 +0300

    net/mlx4: Use the correct VSD mask in UPDATE_QP
    
    When doing VGT->VST->VGT state changes, we used an incorrect mask
    for the vlan-stripping-disable (VSD) flag, hence the vlan related policy
    for user-space Raw Ethernet QPs open by VFs wasn't really applied.
    
    Fix that, by using the correct mask.
    
    Fixes: f0f829b ('net/mlx4_core: Add immediate activate for VGT->VST->VGT')
    Signed-off-by: Matan Barak <matanb@mellanox.com>
    Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit a91c772fa0275163508e1078ff6d474d423244fb
Author: Matan Barak <matanb@mellanox.com>
Date:   Wed Sep 10 16:41:53 2014 +0300

    net/mlx4: Correctly configure single ported VFs from the host
    
    Single port VFs are seen PCI wise on both ports of the PF (we don't have
    single port PFs with ConnectX). With this in mind, it's possible for
    virtualization tools to try and configure a single ported VF through
    the "wrong" PF port.
    
    To handle that, we use the PF driver mapping of single port VFs to NIC
    ports and adjust the port value before calling into the low level
    code that does the actual VF configuration
    
    Fixes: 449fc48 ('net/mlx4: Adapt code for N-Port VF')
    Signed-off-by: Matan Barak <matanb@mellanox.com>
    Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit a0e2c822bf0a1095dc250b5875e39ac0662a5df6
Author: Mugunthan V N <mugunthanvnm@ti.com>
Date:   Wed Sep 10 16:38:09 2014 +0530

    drivers: net: cpsw: dual_emac: fix reducing of rx descriptor during ifdown
    
    In Dual EMAC, when both interface are up and while doing ifdown with heavy
    traffic then skbs already processed by DMA from that slave emac has to be
    requeued as still the other interface is up and running.
    
    Signed-off-by: Mugunthan V N <mugunthanvnm@ti.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit ed3bfdfdced76aa7edb0b05c0d739ee3a2a6e619
Author: David Howells <dhowells@redhat.com>
Date:   Tue Sep 9 15:19:44 2014 +0100

    RxRPC: Fix missing __user annotation
    
    Fix a missing __user annotation in a cast of a user space pointer (found by
    checker).
    
    Signed-off-by: David Howells <dhowells@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 37b7021d9d713964482faeb9e0935f458a1a4016
Author: Masanari Iida <standby24x7@gmail.com>
Date:   Tue Sep 9 18:07:55 2014 +0900

    net:bonding: Add missing space in bonding driver parameter description
    
    This patch adds missing space between "interface" and "by"
    in bonding module parameter description.
    
    Signed-off-by: Masanari Iida <standby24x7@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 6a2a2b3ae0759843b22c929881cc184b00cc63ff
Author: Ani Sinha <ani@arista.com>
Date:   Mon Sep 8 14:49:59 2014 -0700

    net:socket: set msg_namelen to 0 if msg_name is passed as NULL in msghdr struct from userland.
    
    Linux manpage for recvmsg and sendmsg calls does not explicitly mention setting msg_namelen to 0 when
    msg_name passed set as NULL. When developers don't set msg_namelen member in msghdr, it might contain garbage
    value which will fail the validation check and sendmsg and recvmsg calls from kernel will return EINVAL. This will
    break old binaries and any code for which there is no access to source code.
    To fix this, we set msg_namelen to 0 when msg_name is passed as NULL from userland.
    
    Signed-off-by: Ani Sinha <ani@arista.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 8ce8ebeb572d70e672a8d158e93ffaac80ea7576
Author: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Date:   Mon Jul 28 16:38:21 2014 +0200

    clk/efm32gg: fix dt init prototype
    
    Since commit 54196ccbe0ba (of: consolidate linker section OF match table
    declarations) which went into 3.16-rc1 the following compiler warning is
    generated:
    
    	In file included from drivers/clk/clk-efm32gg.c:12:0: include/linux/of.h:772:20:
    	warning: comparison of distinct pointer types lacks a cast [enabled by default]
    		.data = (fn == (fn_type)NULL) ? fn : fn  }
    			    ^
    	include/linux/of.h:785:3: note: in expansion of macro '_OF_DECLARE'
    	   _OF_DECLARE(table, name, compat, fn, of_init_fn_1)
    	   ^
    	include/linux/clk-provider.h:545:42: note: in expansion of macro 'OF_DECLARE_1'
    	 #define CLK_OF_DECLARE(name, compat, fn) OF_DECLARE_1(clk, name, compat, fn)
    						  ^
    	drivers/clk/clk-efm32gg.c:81:1: note: in expansion of macro 'CLK_OF_DECLARE'
    	 CLK_OF_DECLARE(efm32ggcmu, "efm32gg,cmu", efm32gg_cmu_init);
    	 ^
    
    Fix it by making efm32gg_cmu_init return void.
    
    Cc: Rob Herring <robh@kernel.org>
    Reported-by: Bryan Hundven <bryanhundven@gmail.com>
    Reviewed-by: Arnd Bergmann <arnd@arndb.de>
    Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
    Signed-off-by: Mike Turquette <mturquette@linaro.org>

commit b629be5c8399d7c423b92135eb43a86c924d1cbc
Author: Florian Fainelli <f.fainelli@gmail.com>
Date:   Mon Sep 8 11:37:52 2014 -0700

    net: bcmgenet: check harder for out of memory conditions
    
    There is a potential case where we might be failing to refill a
    control block, leaving it with both a NULL skb pointer *and* a NULL
    dma_unmap_addr.
    
    The way we process incoming packets, by first calling
    dma_unmap_single(), and then only checking for a potential NULL skb can
    lead to situations where do pass a NULL dma_unmap_addr() to
    dma_unmap_single(), resulting in an oops.
    
    Fix this my moving the NULL skb check earlier, since no backing skb
    also means no corresponding DMA mapping for this packet.
    
    Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit fe24ba082b8483c81f546d24e40a55624295b85d
Author: Florian Fainelli <f.fainelli@gmail.com>
Date:   Mon Sep 8 11:37:51 2014 -0700

    net: systemport: check harder for out of memory conditions
    
    There is a potential case where we might be failing to refill a
    control block, leaving it with both a NULL skb pointer *and* a NULL
    dma_unmap_addr.
    
    The way we process incoming packets, by first calling
    dma_unmap_single(), and then only checking for a potential NULL skb can
    lead to situations where do pass a NULL dma_unmap_addr() to
    dma_unmap_single(), resulting in an oops.
    
    Fix this my moving the NULL skb check earlier, since no backing skb
    also means no corresponding DMA mapping for this packet.
    
    Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 278d436a476f69fc95d5c82bf61b6c2d02f4d44e
Author: Ivan Vecera <ivecera@redhat.com>
Date:   Mon Sep 8 18:46:53 2014 +0200

    net/mlx4_en: do not ignore autoneg in mlx4_en_set_pauseparam()
    
    The driver does not support pause autonegotiation so it should return
    -EINVAL when the function is called with non-zero autoneg.
    
    Cc: Amir Vadai <amirv@mellanox.com>
    Signed-off-by: Ivan Vecera <ivecera@redhat.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 208f7ca4d4a6886256763c9c073775c5fdaf47eb
Author: Aaro Koskinen <aaro.koskinen@nsn.com>
Date:   Mon Sep 8 18:01:53 2014 +0300

    drivers: net: ethernet: octeon_mgmt: fix a compiler warning
    
    Fix the following compiler warning:
    
    drivers/net/ethernet/octeon/octeon_mgmt.c: In function 'octeon_mgmt_clean_tx_buffers':
    drivers/net/ethernet/octeon/octeon_mgmt.c:295:4: warning: ISO C90 forbids mixed declarations and code [-Wdeclaration-after-statement]
        u64 ns = cvmx_read_csr(CVMX_MIXX_TSTAMP(p->port));
        ^
    
    Signed-off-by: Aaro Koskinen <aaro.koskinen@nsn.com>
    Acked-by: David Daney <david.daney@cavium.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 82d5e2b8b466d5bfc7c6278a7c04a53b9b287673
Author: Eric Dumazet <edumazet@google.com>
Date:   Mon Sep 8 04:00:00 2014 -0700

    net: fix skb_page_frag_refill() kerneldoc
    
    In commit d9b2938aabf7 ("net: attempt a single high order allocation)
    I forgot to update kerneldoc, as @prio parameter was renamed to @gfp
    
    Signed-off-by: Eric Dumazet <edumazet@google.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 78dcff7b73ad1c9052f0b5999f9aaab7648ba2ef
Author: David L Stevens <david.stevens@oracle.com>
Date:   Mon Sep 8 16:23:01 2014 -0400

    sunvnet - add missing rmb() for sunvnet driver
    
    The sunvnet driver does not have an rmb() in the ring consumer corresponding
    to the wmb() in the producer. According to Documentation/memory-barriers.txt:
    
    "When dealing with CPU-CPU interactions, certain types of memory barrier should
    always be paired.  A lack of appropriate pairing is almost certainly an error."
    
    In cases where an rmb() is not a no-op and a consumer is removing data from
    the ring while a producer is adding new entries, a load reorder would allow
    
    CPU1						CPU2
    ----						----
    						LOAD desc.size [e.g]
    STORE desc.size
    <wmb>
    set desc.hdr.state = VIO_DESC_READY
    						LOAD desc.hdr.state
    						[because VIO_DESC_READY, use
    						 old desc.size, already loaded
    						 out of order]
    
    [CPU2 has reordered apparently unrelated LOADs]
    
    To ensure other desc fields are not loaded before checking VIO_DESC_READY, we
    need an rmb() between the check and desc data accesses.
    
    I've also moved the viodbg() call to after the rmb() so that it, too, has
    current descriptor data even with reordering, which has the side effect that
    it won't print anything for descriptors that are not VIO_DESC_READY as before.
    That's a) probably a good thing, since the fields are not necessarily set and,
    b) better than adding another rmb() just for viodbg().
    
    This would not be possible if strict-ordering is enforced, but then the
    memory barriers should be no-ops in that case.
    
    Signed-off-by: David L Stevens <david.stevens@oracle.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>

commit 2cddddc56a1179aa71b460ad616176c237d4a243
Author: Eyal Shapira <eyal@wizery.com>
Date:   Wed Aug 13 00:26:17 2014 +0300

    iwlwifi: mvm: fix an overflow in iwl_mvm_get_signal_strength
    
    The idea here is to translate a value of 0 received from
    the firmware to the lowest rssi figure. As rx_status->chain_signal
    is a signed byte the lowest possible value is -128 and not -256.
    -256 was causing 0 to get stored in the signed byte.
    
    Signed-off-by: Eyal Shapira <eyalx.shapira@intel.com>
    Reviewed-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

commit 498abba6a0b2bc7ed0b57772d664a549dcabc4d7
Author: Oren Givon <oren.givon@intel.com>
Date:   Mon Sep 8 08:57:05 2014 +0300

    iwlwifi: add PCI IDs and add then new 3165 series
    
    This change does the following:
    1) Add a new 7265 series PCI ID
    2) Add two new 3160 series PCI IDs
    3) Add the new 3165 series PCI IDs and configurations
    
    Signed-off-by: Oren Givon <oren.givon@intel.com>
    Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

commit f8dfc607b2b460e8e8adfdfb3c5f5bba3a4ad01b
Author: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Date:   Sun Sep 7 21:33:53 2014 +0300

    iwlwifi: dvm: disable power save by default
    
    In
    https://bugzilla.kernel.org/show_bug.cgi?id=84031,
    the submitter said that disabling power saving helped,
    do just that.
    
    Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

commit 582de30afa13dbc20c8b654ac8f93d32dbef99ce
Author: Johannes Berg <johannes.berg@intel.com>
Date:   Thu Aug 21 19:08:44 2014 +0200

    iwlwifi: mvm: BT Coex - always initialize smps_mode
    
    smps_mode is used uninitialized in a debug statement in AP
    mode, so always initialize it.
    
    While at it, fix a typo.
    
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Reviewed-by: Luciano Coelho <luciano.coelho@intel.com>
    Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

commit 717e2390dc72e87380d6ccf62134b0ab84ee43d2
Author: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Date:   Thu Jul 31 14:39:40 2014 +0300

    iwlwiwi: mvm: use bss_conf->dtim_period instead of conf.ps_dtim_period
    
    The latter is meant for software implementation of power
    save and is not per-virtual interface. Since our driver
    supports multiple virtual interfaces, we need to use
    vif->bss_conf.dtim_period.
    
    Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

commit aa11bbf3df026d6b1c6b528bef634fd9de7c2619
Author: Eyal Shapira <eyal@wizery.com>
Date:   Tue Sep 2 18:39:21 2014 +0300

    iwlwifi: mvm: treat EAPOLs like mgmt frames wrt rate
    
    Using the LQ table which is initially set according to
    the rssi could lead to EAPOLs being sent in high legacy
    rates like 54mbps.
    It's better to avoid sending EAPOLs in high rates as it reduces
    the chances of a successful 4-Way handshake.
    Avoid this and treat them like other mgmt frames which would
    initially get sent at the basic rate.
    
    Cc: <stable@vger.kernel.org> [3.13+]
    Signed-off-by: Eyal Shapira <eyalx.shapira@intel.com>
    Reviewed-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

commit 1bc10d3b509cf9f55a516c1e6dd0716f5e8fefd7
Author: Johannes Berg <johannes.berg@intel.com>
Date:   Tue Aug 26 14:25:46 2014 +0200

    iwlwifi: mvm: correctly handle PM/QoS changes from mac80211
    
    When mac80211 requests multiple BSS config changes, as for example
    while associating, we ignore power management and QoS changes and
    only apply them later. Fix that by removing the "else" and making
    the conditions independent.
    
    Also move it after (potential) beacon filter enablement to have
    that already enabled when going into power management code.
    
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

commit 22d059a5c7c5de61e53c88e30b65e55fbfd91e91
Author: Eliad Peller <eliad@wizery.com>
Date:   Tue Aug 26 11:23:11 2014 +0300

    iwlwifi: increase DEFAULT_MAX_TX_POWER
    
    The chip is able to transmit up to 22dBm, so set
    the constant appropriately.
    
    CC: <stable@vger.kernel.org> [3.13+]
    Signed-off-by: Eliad Peller <eliadx.peller@intel.com>
    Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

commit 86974bff066dd8b98be46d7c7d3aba89034f0833
Author: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Date:   Thu Jul 31 14:32:37 2014 +0300

    iwlwifi: mvm: fix endianity issues with Smart Fifo commands
    
    This code was broken on big endian systems. Sparse didn't
    catch the bug since the firmware command was not tagged as
    little endian.
    Fix the bug for big endian systems and tag the field in the
    firmware command to prevent such issues in the future.
    
    Cc: stable@vger.kernel.org [3.14+]
    Fixes: 1f3b0ff8ec ("iwlwifi: mvm: Add Smart FIFO support")
    Reviewed-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

commit 7c8b3bc688bdcfd7789efbd17da4d85b104ad351
Author: Luciano Coelho <luciano.coelho@intel.com>
Date:   Wed Jul 30 15:04:08 2014 +0300

    iwlwifi: mvm: set MAC_FILTER_IN_BEACON correctly for STA/P2P client
    
    In commit cad3f08c (iwlwifi: mvm: enable MAC_FILTER_IN_BEACON when
    forced_assoc_off is set) the code to set the MAC_FILTER_IN_BEACON flag
    was accidentally moved to the main block of the if statement, while it
    should be in the else block instead.  Move it to the right place.
    
    Fixes: cad3f08c23de ("iwlwifi: mvm: enable MAC_FILTER_IN_BEACON when forced_assoc_off is set")
    Reviewed-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Luciano Coelho <luciano.coelho@intel.com>
    Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

commit 787d6c1f17eae41429d35eb0f1b38f44659f5f1d
Author: Johannes Berg <johannes.berg@intel.com>
Date:   Fri Jul 25 14:49:59 2014 +0200

    iwlwifi: mvm: BT Coex - remove shadowing variable
    
    The variable 'u32 mode' exists twice, the latter shadowing
    the former - remove the latter since there's no need for
    two variables.
    
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>
    Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

commit 300c627fbc52aa5b2117ca267907ab8d7b990ead
Author: Christophe Ricard <christophe.ricard@gmail.com>
Date:   Wed Sep 3 23:30:31 2014 +0200

    NFC: st21nfca: Fix potential depmod dependency cycle
    
    In the previous makefile 2 modules were generated for CONFIG_NFC_ST21NFCA
    (st21nfca.ko and st21nfca_dep.ko). Merge both of them into st21nfca_hci.ko
    and fix a potential depmod dependency cycle, similar to the one we saw
    on st21nfcb:
    
    depmod: WARNING: found 6 modules in dependency cycles!
    depmod: WARNING:
    /lib/modules/3.17.0-rc3-00002-g7505cea/kernel/drivers/nfc/st21nfcb/st21nfcb.ko
    in dependency cycle!
    depmod: WARNING:
    /lib/modules/3.17.0-rc3-00002-g7505cea/kernel/drivers/nfc/st21nfcb/ndlc.ko
    in dependency cycle!
    depmod: WARNING:
    /lib/modules/3.17.0-rc3-00002-g7505cea/kernel/net/rfkill/rfkill.ko in
    dependency cycle!
    depmod: WARNING:
    /lib/modules/3.17.0-rc3-00002-g7505cea/kernel/net/nfc/nfc.ko in
    dependency cycle!
    depmod: WARNING:
    /lib/modules/3.17.0-rc3-00002-g7505cea/kernel/net/nfc/nci/nci.ko in
    dependency cycle!
    depmod: WARNING:
    /lib/modules/3.17.0-rc3-00002-g7505cea/kernel/lib/crc-ccitt.ko in
    dependency cycle!
    ./scripts/depmod.sh: line 57: 23387 Segmentation fault      (core
    dumped) "$DEPMOD" "$@" "$KERNELRELEASE" $SYMBOL_PREFIX
    make: *** [_modinst_post] Error 139
    
    Reported-by: Daniel Wagner <wagi@monom.org>
    Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com>
    Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

commit a1b27b3867b17356089e2906c538a1049873ab42
Author: Christophe Ricard <christophe.ricard@gmail.com>
Date:   Wed Sep 3 23:30:33 2014 +0200

    NFC: st21nfcb: Fix depmod dependency cycle
    
    This fix issue reported here:
    https://lists.01.org/pipermail/linux-nfc/2014-September/002871.html
    
    depmod: WARNING: found 6 modules in dependency cycles!
    depmod: WARNING:
    /lib/modules/3.17.0-rc3-00002-g7505cea/kernel/drivers/nfc/st21nfcb/st21nfcb.ko
    in dependency cycle!
    depmod: WARNING:
    /lib/modules/3.17.0-rc3-00002-g7505cea/kernel/drivers/nfc/st21nfcb/ndlc.ko
    in dependency cycle!
    depmod: WARNING:
    /lib/modules/3.17.0-rc3-00002-g7505cea/kernel/net/rfkill/rfkill.ko in
    dependency cycle!
    depmod: WARNING:
    /lib/modules/3.17.0-rc3-00002-g7505cea/kernel/net/nfc/nfc.ko in
    dependency cycle!
    depmod: WARNING:
    /lib/modules/3.17.0-rc3-00002-g7505cea/kernel/net/nfc/nci/nci.ko in
    dependency cycle!
    depmod: WARNING:
    /lib/modules/3.17.0-rc3-00002-g7505cea/kernel/lib/crc-ccitt.ko in
    dependency cycle!
    ./scripts/depmod.sh: line 57: 23387 Segmentation fault      (core
    dumped) "$DEPMOD" "$@" "$KERNELRELEASE" $SYMBOL_PREFIX
    make: *** [_modinst_post] Error 139
    
    Reported-by: Daniel Wagner <wagi@monom.org>
    Signed-off-by: Christophe Ricard <christophe-h.ricard@st.com>
    Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

commit 785e21a89d77923852869f83ebd2689ec4d5ce54
Author: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Date:   Wed Sep 3 15:25:04 2014 +0300

    mac80211: use bss_conf->dtim_period instead of conf.ps_dtim_period
    
    sta_set_sinfo is obviously takes data for specific station.
    This specific station is attached to a specific virtual
    interface. Hence we should use the dtim_period from this
    virtual interface rather than the system wide dtim_period.
    
    Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>

commit d07f1e8600ccb885c8f4143402b8912f7d827bcb
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Mon Sep 1 20:27:29 2014 +0300

    NFC: microread: Potential overflows in microread_target_discovered()
    
    Smatch says that skb->data is untrusted so we need to check to make sure
    that the memcpy() doesn't overflow.
    
    Fixes: cfad1ba87150 ('NFC: Initial support for Inside Secure microread')
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>

commit 067bb1741c27c8d3b74ac98c0b8fc12b31e67005
Author: Tero Kristo <t-kristo@ti.com>
Date:   Thu Aug 21 16:47:45 2014 +0300

    clk: prevent erronous parsing of children during rate change
    
    In some cases, clocks can switch their parent with clk_set_rate, for
    example clk_mux can do this in some cases. Current implementation of
    clk_change_rate uses un-safe list iteration on the clock children, which
    will cause wrong clocks to be parsed in case any of the clock children
    change their parents during the change rate operation. Fixed by using
    the safe list iterator instead.
    
    The problem was detected due to some divide by zero errors generated
    by clock init on dra7-evm board, see discussion under
    http://article.gmane.org/gmane.linux.ports.arm.kernel/349180 for details.
    
    Fixes: 71472c0c06cf ("clk: add support for clock reparent on set_rate")
    Signed-off-by: Tero Kristo <t-kristo@ti.com>
    Reported-by: Nishanth Menon <nm@ti.com>
    Signed-off-by: Mike Turquette <mturquette@linaro.org>

commit f4ee3c8446d55ef426965abccbbc195e0f157e73
Author: Doug Anderson <dianders@chromium.org>
Date:   Fri Aug 22 09:49:29 2014 -0700

    clk: rockchip: Fix the clocks for i2c1 and i2c2
    
    The clocks for i2c1 and i2c2 are flipped.  The clock tree matched the
    Technical Reference Manual (TRM) but the TRM was wrong.  Swap them in
    the clock tree.  This was determined experimentally (by Addy) and
    confirmed by the Rockchip IC team.
    
    Signed-off-by: Doug Anderson <dianders@chromium.org>
    Reported-by: Addy Ke <addy.ke@rock-chips.com>
    Reviewed-by: Heiko Stuebner <heiko@sntech.de>
    Signed-off-by: Mike Turquette <mturquette@linaro.org>

commit bd8c78e78d5011d8111bc2533ee73b13a3bd6c42
Author: Johannes Berg <johannes.berg@intel.com>
Date:   Wed Jul 30 14:55:26 2014 +0200

    nl80211: clear skb cb before passing to netlink
    
    In testmode and vendor command reply/event SKBs we use the
    skb cb data to store nl80211 parameters between allocation
    and sending. This causes the code for CONFIG_NETLINK_MMAP
    to get confused, because it takes ownership of the skb cb
    data when the SKB is handed off to netlink, and it doesn't
    explicitly clear it.
    
    Clear the skb cb explicitly when we're done and before it
    gets passed to netlink to avoid this issue.
    
    Cc: stable@vger.kernel.org [this goes way back]
    Reported-by: Assaf Azulay <assaf.azulay@intel.com>
    Reported-by: David Spinadel <david.spinadel@intel.com>
    Signed-off-by: Johannes Berg <johannes.berg@intel.com>

commit d8210e28e5807091f38d064142223e8787cc9883
Author: Stephen Boyd <sboyd@codeaurora.org>
Date:   Fri Aug 29 12:49:26 2014 -0700

    clk: qcom: Fix sdc 144kHz frequency entry
    
    The pre-divider for the sdc clocks only has 2 bits in it, so we
    can't possibly divide by anything larger than 4 here.
    Furthermore, we program the value of ~(n - m) and the n value is
    larger than 8 bits (max of 256). Replace this entry with 200kHz
    which is close enough to 144kHz to be usable.
    
    Cc: Kumar Gala <galak@codeaurora.org>
    Cc: Andy Gross <agross@codeaurora.org>
    Fixes: 24d8fba44af3 "clk: qcom: Add support for IPQ8064's global clock controller (GCC)"
    Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
    Signed-off-by: Mike Turquette <mturquette@linaro.org>

commit e8531ac8b21a3e89db8729d2cd9de43b09818092
Author: Boris BREZILLON <boris.brezillon@free-electrons.com>
Date:   Tue Sep 2 17:27:51 2014 +0200

    clk: at91: fix num_parents test in at91sam9260 slow clk implementation
    
    The slow clk block provided by at91sam9260 and derived SoCs should always
    have 2 parents.
    
    Signed-off-by: Boris BREZILLON <boris.brezillon@free-electrons.com>
    Signed-off-by: Mike Turquette <mturquette@linaro.org>

commit 6efaaf33bece53a842cb1cc71971a05216d81473
Author: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
Date:   Mon Sep 1 10:03:21 2014 +0300

    iwlwifi: mvm: enable scheduled scan on newest firmware
    
    Scheduled scan was disabled because of a bug in the firmware.
    The firmware reported support for this feature, but enabling
    it led to assertions.
    The bugs have been fixes in latest firmware versions, so that
    we can re-enable the feature on latest firmwares only.
    
    Signed-off-by: Emmanuel Grumbach <emmanuel.grumbach@intel.com>

commit 920bce20d74817bdd8bfcbc28ecb1179c9e01081
Author: Milosz Tanski <milosz@adfin.com>
Date:   Wed Aug 13 12:58:21 2014 -0400

    FS-Cache: Reduce cookie ref count if submit fails.
    
    I've been seeing issues with disposing cookies under vma pressure. The symptom
    is that the refcount gets out of sync. In this case we fail to decrement the
    refcount if submit fails. I found this while auditing the error in and around
    cookie operations.
    
    Signed-off-by: Milosz Tanski <milosz@adfin.com>
    Signed-off-by: David Howells <dhowells@redhat.com>

commit 9776de96e51565286da25c74d6f631abc50c63ef
Author: Milosz Tanski <milosz@adfin.com>
Date:   Wed Aug 13 12:58:16 2014 -0400

    FS-Cache: Timeout for releasepage()
    
    This is meant to avoid a recusive hang caused by underlying filesystem trying
    to grab a free page and causing a write-out.
    
    INFO: task kworker/u30:7:28375 blocked for more than 120 seconds.
          Not tainted 3.15.0-virtual #74
    "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
    kworker/u30:7   D 0000000000000000     0 28375      2 0x00000000
    Workqueue: fscache_operation fscache_op_work_func [fscache]
     ffff88000b147148 0000000000000046 0000000000000000 ffff88000b1471c8
     ffff8807aa031820 0000000000014040 ffff88000b147fd8 0000000000014040
     ffff880f0c50c860 ffff8807aa031820 ffff88000b147158 ffff88007be59cd0
    Call Trace:
     [<ffffffff815930e9>] schedule+0x29/0x70
     [<ffffffffa018bed5>] __fscache_wait_on_page_write+0x55/0x90 [fscache]
     [<ffffffff810a4350>] ? __wake_up_sync+0x20/0x20
     [<ffffffffa018c135>] __fscache_maybe_release_page+0x65/0x1e0 [fscache]
     [<ffffffffa02ad813>] ceph_releasepage+0x83/0x100 [ceph]
     [<ffffffff811635b0>] ? anon_vma_fork+0x130/0x130
     [<ffffffff8112cdd2>] try_to_release_page+0x32/0x50
     [<ffffffff81140096>] shrink_page_list+0x7e6/0x9d0
     [<ffffffff8113f278>] ? isolate_lru_pages.isra.73+0x78/0x1e0
     [<ffffffff81140932>] shrink_inactive_list+0x252/0x4c0
     [<ffffffff811412b1>] shrink_lruvec+0x3e1/0x670
     [<ffffffff8114157f>] shrink_zone+0x3f/0x110
     [<ffffffff81141b06>] do_try_to_free_pages+0x1d6/0x450
     [<ffffffff8114a939>] ? zone_statistics+0x99/0xc0
     [<ffffffff81141e44>] try_to_free_pages+0xc4/0x180
     [<ffffffff81136982>] __alloc_pages_nodemask+0x6b2/0xa60
     [<ffffffff811c1d4e>] ? __find_get_block+0xbe/0x250
     [<ffffffff810a405e>] ? wake_up_bit+0x2e/0x40
     [<ffffffff811740c3>] alloc_pages_current+0xb3/0x180
     [<ffffffff8112cf07>] __page_cache_alloc+0xb7/0xd0
     [<ffffffff8112da6c>] grab_cache_page_write_begin+0x7c/0xe0
     [<ffffffff81214072>] ? ext4_mark_inode_dirty+0x82/0x220
     [<ffffffff81214a89>] ext4_da_write_begin+0x89/0x2d0
     [<ffffffff8112c6ee>] generic_perform_write+0xbe/0x1d0
     [<ffffffff811a96b1>] ? update_time+0x81/0xc0
     [<ffffffff811ad4c2>] ? mnt_clone_write+0x12/0x30
     [<ffffffff8112e80e>] __generic_file_aio_write+0x1ce/0x3f0
     [<ffffffff8112ea8e>] generic_file_aio_write+0x5e/0xe0
     [<ffffffff8120b94f>] ext4_file_write+0x9f/0x410
     [<ffffffff8120af56>] ? ext4_file_open+0x66/0x180
     [<ffffffff8118f0da>] do_sync_write+0x5a/0x90
     [<ffffffffa025c6c9>] cachefiles_write_page+0x149/0x430 [cachefiles]
     [<ffffffff812cf439>] ? radix_tree_gang_lookup_tag+0x89/0xd0
     [<ffffffffa018c512>] fscache_write_op+0x222/0x3b0 [fscache]
     [<ffffffffa018b35a>] fscache_op_work_func+0x3a/0x100 [fscache]
     [<ffffffff8107bfe9>] process_one_work+0x179/0x4a0
     [<ffffffff8107d47b>] worker_thread+0x11b/0x370
     [<ffffffff8107d360>] ? manage_workers.isra.21+0x2e0/0x2e0
     [<ffffffff81083d69>] kthread+0xc9/0xe0
     [<ffffffff81010000>] ? ftrace_raw_event_xen_mmu_release_ptpage+0x70/0x90
     [<ffffffff81083ca0>] ? flush_kthread_worker+0xb0/0xb0
     [<ffffffff8159eefc>] ret_from_fork+0x7c/0xb0
     [<ffffffff81083ca0>] ? flush_kthread_worker+0xb0/0xb0
    
    Signed-off-by: Milosz Tanski <milosz@adfin.com>
    Signed-off-by: David Howells <dhowells@redhat.com>

commit 20411dad75ece9a613af715df4489e60990c4017
Author: Nishanth Menon <nm@ti.com>
Date:   Mon Aug 18 11:56:55 2014 -0500

    clk: ti: dra7-atl: Provide error check for incoming parameters in set_rate
    
    Check for valid parameters in check rate. Else, we end up getting
    errors.
    
    This occurs as part of the inital clock tree update of child clock
    nodes where new_rate could be 0 for non functional clocks.
    
    Fixes: 9ac33b0ce81fa48 (" CLK: TI: Driver for DRA7 ATL (Audio Tracking Logic)")
    Signed-off-by: Nishanth Menon <nm@ti.com>
    Signed-off-by: Tero Kristo <t-kristo@ti.com>

commit 2f1032517623b70920d99529e5c87c8c680ab8bf
Author: Nishanth Menon <nm@ti.com>
Date:   Mon Aug 18 11:56:54 2014 -0500

    clk: ti: divider: Provide error check for incoming parameters in set_rate
    
    Check for valid parameters in check rate. Else, we end up getting errors
    like:
    [    0.000000] Division by zero in kernel.
    [    0.000000] CPU: 0 PID: 0 Comm: swapper/0 Not tainted 3.17.0-rc1 #1
    [    0.000000] [<c0015160>] (unwind_backtrace) from [<c0011978>] (show_stack+0x10/0x14)
    [    0.000000] [<c0011978>] (show_stack) from [<c055f5f4>] (dump_stack+0x78/0x94)
    [    0.000000] [<c055f5f4>] (dump_stack) from [<c02e17cc>] (Ldiv0+0x8/0x10)
    [    0.000000] [<c02e17cc>] (Ldiv0) from [<c047d228>] (ti_clk_divider_set_rate+0x14/0x14c)
    [    0.000000] [<c047d228>] (ti_clk_divider_set_rate) from [<c047a938>] (clk_change_rate+0x138/0x180)
    [    0.000000] [<c047a938>] (clk_change_rate) from [<c047a908>] (clk_change_rate+0x108/0x180)
    
    This occurs as part of the inital clock tree update of child clock nodes
    where new_rate could be 0 for non functional clocks.
    
    Fixes: b4761198bfaf296 ("CLK: ti: add support for ti divider-clock")
    Signed-off-by: Nishanth Menon <nm@ti.com>
    Signed-off-by: Tero Kristo <t-kristo@ti.com>
I need old gcc

Old, unsupported cross-compiler :(

Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
arch/alpha/kernel/systbls.S: remove debug check

-mm only patch, I guess.

My old gas-2.16.1 says

arch/alpha/kernel/systbls.S: Assembler messages:
arch/alpha/kernel/systbls.S:523: Error: non-constant expression in ".if" statement
arch/alpha/kernel/systbls.S:524: Error: .err encountered

Cc: Richard Henderson <rth@twiddle.net>
Cc: Ivan Kokshaysky <ink@jurassic.park.msu.ru>
Cc: Matt Turner <mattst88@gmail.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
ocfs2: free vol_label in ocfs2_delete_osb()

osb->vol_label is malloced in ocfs2_initialize_super but not freed if
error occurs or during umount, thus causing a memory leak.

Signed-off-by: Joseph Qi <joseph.qi@huawei.com>
Reviewed-by: joyce.xue <xuejiufei@huawei.com>
Cc: Mark Fasheh <mfasheh@suse.com>
Cc: Joel Becker <jlbec@evilplan.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
nilfs2: fix data loss with mmap()

This bug leads to reproducible silent data loss, despite the use of
msync(), sync() and a clean unmount of the file system.  It is easily
reproducible with the following script:

----------------[BEGIN SCRIPT]--------------------
mkfs.nilfs2 -f /dev/sdb
mount /dev/sdb /mnt

dd if=/dev/zero bs=1M count=30 of=/mnt/testfile

umount /mnt
mount /dev/sdb /mnt
CHECKSUM_BEFORE="$(md5sum /mnt/testfile)"

/root/mmaptest/mmaptest /mnt/testfile 30 10 5

sync
CHECKSUM_AFTER="$(md5sum /mnt/testfile)"
umount /mnt
mount /dev/sdb /mnt
CHECKSUM_AFTER_REMOUNT="$(md5sum /mnt/testfile)"
umount /mnt

echo "BEFORE MMAP:\t$CHECKSUM_BEFORE"
echo "AFTER MMAP:\t$CHECKSUM_AFTER"
echo "AFTER REMOUNT:\t$CHECKSUM_AFTER_REMOUNT"
----------------[END SCRIPT]--------------------

The mmaptest tool looks something like this (very simplified, with
error checking removed):

----------------[BEGIN mmaptest]--------------------
data = mmap(NULL, file_size - file_offset, PROT_READ | PROT_WRITE,
		MAP_SHARED, fd, file_offset);

for (i = 0; i < write_count; ++i) {
	memcpy(data + i * 4096, buf, sizeof(buf));
	msync(data, file_size - file_offset, MS_SYNC))
}
----------------[END mmaptest]--------------------

The output of the script looks something like this:

BEFORE MMAP:    281ed1d5ae50e8419f9b978aab16de83  /mnt/testfile
AFTER MMAP:     6604a1c31f10780331a6850371b3a313  /mnt/testfile
AFTER REMOUNT:  281ed1d5ae50e8419f9b978aab16de83  /mnt/testfile

So it is clear, that the changes done using mmap() do not survive a
remount.  This can be reproduced a 100% of the time.  The problem was
introduced with 136e877 ("nilfs2: fix issue of nilfs_set_page_dirty() for
page at EOF boundary").

If the page was read with mpage_readpage() or mpage_readpages() for
example, then it has no buffers attached to it.  In that case
page_has_buffers(page) in nilfs_set_page_dirty() will be false.  Therefore
nilfs_set_file_dirty() is never called and the pages are never collected
and never written to disk.

This patch fixes the problem by also calling nilfs_set_file_dirty() if the
page has no buffers attached to it.

[akpm@linux-foundation.org: s/PAGE_SHIFT/PAGE_CACHE_SHIFT/]
Signed-off-by: Andreas Rohner <andreas.rohner@gmx.net>
Tested-by: Andreas Rohner <andreas.rohner@gmx.net>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
ocfs2/dlm: do not get resource spinlock if lockres is new

There is a deadlock case which reported by Guozhonghua:
https://oss.oracle.com/pipermail/ocfs2-devel/2014-September/010079.html

This case is caused by &res->spinlock and &dlm->master_lock
misordering in different threads.

It was introduced by commit 8d400b81cc83 ("ocfs2/dlm: Clean up refmap
helpers").  Since lockres is new, it doesn't not require the
&res->spinlock.  So remove it.

Fixes: 8d400b81cc83 ("ocfs2/dlm: Clean up refmap helpers")
Signed-off-by: Joseph Qi <joseph.qi@huawei.com>
Reviewed-by: joyce.xue <xuejiufei@huawei.com>
Reported-by: Guozhonghua <guozhonghua@h3c.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Mark Fasheh <mfasheh@suse.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
mm: softdirty: addresses before VMAs in PTE holes aren't softdirty

In PTE holes that contain VM_SOFTDIRTY VMAs, unmapped addresses before
VM_SOFTDIRTY VMAs are reported as softdirty by /proc/pid/pagemap.  This
bug was introduced in 68b5a652485682f67eacdee3deae640fb7845b63.  The
aforementioned patch made /proc/pid/pagemap look at VM_SOFTDIRTY in PTE
holes but neglected to observe the start of VMAs returned by find_vma.

Tested:
  Wrote a selftest that creates a PMD-sized VMA then unmaps the first
  page and asserts that the page is not softdirty. I'm going to send the
  pagemap selftest in a later commit.

Signed-off-by: Peter Feiner <pfeiner@google.com>
Cc: Cyrill Gorcunov <gorcunov@openvz.org>
Cc: Pavel Emelyanov <xemul@parallels.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Cc: "Kirill A. Shutemov" <kirill@shutemov.name>
Cc: Jamie Liu <jamieliu@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
mm, slab: initialize object alignment on cache creation

Since 4590685546a3 ("mm/sl[aou]b: Common alignment code"), the "ralign"
automatic variable in __kmem_cache_create() may be used as uninitialized.

The proper alignment defaults to BYTES_PER_WORD and can be overridden by
SLAB_RED_ZONE or the alignment specified by the caller.

This fixes https://bugzilla.kernel.org/show_bug.cgi?id=85031

Signed-off-by: David Rientjes <rientjes@google.com>
Reported-by: Andrei Elovikov <a.elovikov@gmail.com>
Acked-by: Christoph Lameter <cl@linux.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
drivers/rtc/rtc-efi.c: add missing module alias

Without proper alias kernel module is not loaded for rtc-efi driver.

Signed-off-by: Pali Rohár <pali.rohar@gmail.com>
Cc: dann frazier <dannf@dannf.org>
Cc: Alessandro Zummo <a.zummo@towertech.it>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
genalloc: fix device node resource counter

Decrement the np_pool device_node refcount, which was incremented on
the preceding of_parse_phandle() call.

Signed-off-by: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
Cc: Will Deacon <will.deacon@arm.com>
Cc: Olof Johansson <olof@lixom.net>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
fs/cachefiles: add missing \n to kerror conversions

Commit 0227d6abb378 ("fs/cachefiles: replace kerror by pr_err") didn't
include newline featuring in original kerror definition

Signed-off-by: Fabian Frederick <fabf@skynet.be>
Reported-by: David Howells <dhowells@redhat.com>
Acked-by: David Howells <dhowells@redhat.com>
Cc: <stable@vger.kernel.org>	[3.16.x]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
mm: softdirty: keep bit when zapping file pte

Fixes the same bug as b43790eedd31e9 ("mm: softdirty: don't forget to save
file map softdiry bit on unmap") and 9aed8614af5a05cd ("mm/memory.c: don't
forget to set softdirty on file mapped fault") where the return value of
pte_*mksoft_dirty was being ignored.

To be sure that no other pte/pmd "mk" function return values were being
ignored, I annotated the functions in arch/x86/include/asm/pgtable.h with
__must_check and rebuilt.

The userspace effect of this bug is that the softdirty mark might be
lost if a file mapped pte get zapped.

Signed-off-by: Peter Feiner <pfeiner@google.com>
Acked-by: Cyrill Gorcunov <gorcunov@openvz.org>
Cc: Pavel Emelyanov <xemul@parallels.com>
Cc: Jamie Liu <jamieliu@google.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: <stable@vger.kernel.org>	[3.12+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
ocfs2/dlm: should put mle when goto kill in dlm_assert_master_handler

In dlm_assert_master_handler, the mle is get in dlm_find_mle, should be
put when goto kill, otherwise, this mle will never be released.

Signed-off-by: Alex Chen <alex.chen@huawei.com>
Reviewed-by: Joseph Qi <joseph.qi@huawei.com>
Reviewed-by: joyce.xue <xuejiufei@huawei.com>
Cc: Mark Fasheh <mfasheh@suse.com>
Cc: Joel Becker <jlbec@evilplan.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
mm: page_alloc: fix zone allocation fairness on UP

The zone allocation batches can easily underflow due to higher-order
allocations or spills to remote nodes.  On SMP that's fine, because
underflows are expected from concurrency and dealt with by returning 0. 
But on UP, zone_page_state will just return a wrapped unsigned long, which
will get past the <= 0 check and then consider the zone eligible until its
watermarks are hit.

3a025760fc15 ("mm: page_alloc: spill to remote nodes before waking
kswapd") already made the counter-resetting use atomic_long_read() to
accomodate underflows from remote spills, but it didn't go all the way
with it.  Make it clear that these batches are expected to go negative
regardless of concurrency, and use atomic_long_read() everywhere.

Fixes: 81c0a2bb515f ("mm: page_alloc: fair zone allocator policy")
Reported-by: Vlastimil Babka <vbabka@suse.cz>
Reported-by: Leon Romanovsky <leon@leon.nu>
Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
Acked-by: Mel Gorman <mgorman@suse.de>
Cc: <stable@vger.kenrel.org>	[3.12+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
MAINTAINERS: new Documentation maintainer

Transfer Documentation maintainership to Jiri Kosina.  Thanks, Jiri.

I'll still be reviewing and working on documentation.

Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Acked-by: Jiri Kosina <jkosina@suse.cz>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
mm: memcontrol: do not iterate uninitialized memcgs

The cgroup iterators yield css objects that have not yet gone through
css_online(), but they are not complete memcgs at this point and so the
memcg iterators should not return them.  d8ad30559715 ("mm/memcg:
iteration skip memcgs not yet fully initialized") set out to implement
exactly this, but it uses CSS_ONLINE, a cgroup-internal flag that does not
meet the ordering requirements for memcg, and so the iterator may skip
over initialized groups, or return partially initialized memcgs.

The cgroup core can not reasonably provide a clear answer on whether the
object around the css has been fully initialized, as that depends on
controller-specific locking and lifetime rules.  Thus, introduce a
memcg-specific flag that is set after the memcg has been initialized in
css_online(), and read before mem_cgroup_iter() callers access the memcg
members.

Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: Tejun Heo <tj@kernel.org>
Acked-by: Michal Hocko <mhocko@suse.cz>
Cc: Hugh Dickins <hughd@google.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Cc: <stable@vger.kernel.org>	[3.12+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
mn10300: use Kbuild logic to include <asm-generic/sections.h>

Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Acked-by: David Howells <dhowells@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
cris: use Kbuild logic to include <asm-generic/sections.h>

Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
Acked-by: Jesper Nilsson <jesper.nilsson@axis.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
fs/cifs: remove obsolete __constant

Replace all __constant_foo to foo() except in smb2status.h (1700 lines to
update).

Signed-off-by: Fabian Frederick <fabf@skynet.be>
Cc: Steve French <sfrench@samba.org>
Cc: Jeff Layton <jlayton@poochiereds.net>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
fs/cifs/file.c: replace count*size kzalloc by kcalloc

kcalloc manages count*sizeof overflow.

Signed-off-by: Fabian Frederick <fabf@skynet.be>
Cc: Steve French <sfrench@samba.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>