Merge branch 'kvms390-irqfd' of git://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into kvm-next
cgroup: Use RCU_INIT_POINTER(x, NULL) in cgroup.c

This patch replaces rcu_assign_pointer(x, NULL) with
RCU_INIT_POINTER(x, NULL)

The rcu_assign_pointer() ensures that the initialization of a
structure is carried out before storing a pointer to that structure.
And in the case of the NULL pointer, there is no structure to
initialize.  So, rcu_assign_pointer(p, NULL) can be safely converted
to RCU_INIT_POINTER(p, NULL)

Signed-off-by: Monam Agarwal <monamagarwal123@gmail.com>
Signed-off-by: Tejun Heo <tj@kernel.org>
tracing: Add BUG_ON when stack end location is over written

It is difficult to detect a stack overrun when it
actually occurs.

We have observed that this type of corruption is often
silent and can go unnoticed. Once the corrupted region
is examined, the outcome is undefined and often
results in sporadic system crashes.

When the stack tracing feature is enabled, let's check
for this condition and take appropriate action.

Note: init_task doesn't get its stack end location
set to STACK_END_MAGIC.

Link: http://lkml.kernel.org/r/1395669837-30209-1-git-send-email-atomlin@redhat.com

Signed-off-by: Aaron Tomlin <atomlin@redhat.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Bluetooth: Fix potential NULL pointer dereference in SMP

If a sudden disconnection happens the l2cap_conn pointer may already
have been cleaned up by the time hci_conn_security gets called,
resulting in the following oops if we don't have a proper NULL check:

BUG: unable to handle kernel NULL pointer dereference at 000000c8
IP: [<c132e2ed>] smp_conn_security+0x26/0x151
*pde = 00000000
Oops: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC
CPU: 1 PID: 673 Comm: memcheck-x86-li Not tainted 3.14.0-rc2+ #437
Hardware name: Bochs Bochs, BIOS Bochs 01/01/2011
task: f0ef0520 ti: f0d6a000 task.ti: f0d6a000
EIP: 0060:[<c132e2ed>] EFLAGS: 00010246 CPU: 1
EIP is at smp_conn_security+0x26/0x151
EAX: f0ec1770 EBX: f0ec1770 ECX: 00000002 EDX: 00000002
ESI: 00000002 EDI: 00000000 EBP: f0d6bdc0 ESP: f0d6bda0
 DS: 007b ES: 007b FS: 00d8 GS: 0000 SS: 0068
CR0: 80050033 CR2: 000000c8 CR3: 30f0f000 CR4: 00000690
Stack:
 f4f55000 00000002 f0d6bdcc c1097a2b c1319f40 f0ec1770 00000002 f0d6bdd0
 f0d6bde8 c1312a82 f0d6bdfc c1312a82 c1319f84 00000008 f4d81c20 f0e5fd86
 f0ec1770 f0d6bdfc f0d6be28 c131be3b c131bdc1 f0d25270 c131be3b 00000008
Call Trace:
 [<c1097a2b>] ? __kmalloc+0x118/0x128
 [<c1319f40>] ? mgmt_pending_add+0x49/0x9b
 [<c1312a82>] hci_conn_security+0x4a/0x1dd
 [<c1312a82>] ? hci_conn_security+0x4a/0x1dd
 [<c1319f84>] ? mgmt_pending_add+0x8d/0x9b
 [<c131be3b>] pair_device+0x1e1/0x206
 [<c131bdc1>] ? pair_device+0x167/0x206
 [<c131be3b>] ? pair_device+0x1e1/0x206
 [<c131ed44>] mgmt_control+0x275/0x2d6

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Bluetooth: Add missing cmd_status handler for LE_Start_Encryption

It is possible that the HCI_LE_Start_Encryption command fails in an
early stage and triggers a command status event with the failure code.
In such a case we need to properly notify the hci_conn object and
cleanly bring the connection down. This patch adds the missing command
status handler for this HCI command.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Bluetooth: Fix SMP confirmation callback handling

In the case that a local pairing confirmation (JUST_CFM) has been
selected as the method we need to use the user confirm request mgmt
event for it with the confirm_hint set to 1 (to indicate confirmation
without any specific passkey value). Without this (if passkey_notify was
used) the pairing would never proceed. This patch adds the necessary
call to mgmt_user_confirm_request in this scenario.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Bluetooth: Add SMP flag to track which side is the initiator

For remotely initiated just-works pairings we want to show the user a
confirmation dialog for the pairing. However, we can only know which
side was the initiator by tracking which side sends the first Security
Request or Pairing Request PDU. This patch adds a new SMP flag to
indicate whether our side was the initiator for the pairing.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Bluetooth: Don't try to confirm locally initiated SMP pairing

In the case that the just-works model would be triggered we only want to
confirm remotely initiated pairings (i.e. those triggered by a Security
Request or Pairing Request). This patch adds the necessary check to the
tk_request function to fall back to the JUST_WORKS method in the case of
a locally initiated pairing.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Bluetooth: Remove LTK re-encryption procedure

Due to several devices being unable to handle this procedure reliably
(resulting in forced disconnections before pairing completes) it's
better to remove it altogether.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Bluetooth: Fix potential NULL pointer dereference in smp_conn_security

The smp pointer might not be initialized for jumps to the "done" label
in the smp_conn_security function. Furthermore doing the set_bit after
done might "overwrite" a previous value of the flag in case pairing was
already in progress. This patch moves the call to set_bit before the
label so that it is only done for a newly created smp context (as
returned by smp_chan_create).

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
Bluetooth: Remove unnecessary assignment in SMP

The smp variable in smp_conn_security is not used anywhere before the
smp = smp_chan_create() call in the smp_conn_security function so it
makes no sense to assign any other value to it before that.

Signed-off-by: Johan Hedberg <johan.hedberg@intel.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
x86, vdso: Fix size of get_unmapped_area()

The size of the reserved memory for a 32 bit vdso must be the size of the
32 bit vDSO in pages + HPET page + VVAR page.

One page is not enough for this. Grrrr.... silly copy and paste bug,
was right in previous patch.

Signed-off-by: Stefani Seibold <stefani@seibold.net>
Cc: Andy Lutomirski <luto@amacapital.net>
Link: http://lkml.kernel.org/r/1395592694-20571-1-git-send-email-stefani@seibold.net
Signed-off-by: H. Peter Anvin <hpa@linux.intel.com>
Altera TSE: Set version number by driver's get regs

Set the version number returned by the driver's get regs routine
invoked by ethtool so formatting can be dependent on the version
number returned, and any interesting formatted output can check
the version number for specific types of register data returned.

Signed-off-by: Vince Bridgers <vbridgers2013@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Altera TSE: Correct typecast issue detected by kbuild test robot

This patch addresses a portable pointer arithmetic issue in the
original submission found by the kbuild test robot.

config: make ARCH=i386 allyesconfig

   altera_sgdma.c: In function 'sgdma_txphysaddr':
>> altera_sgdma.c:393:33: warning: cast from
>> pointer to integer of different size [-Wpointer-to-int-cast]
     dma_addr_t offs = (dma_addr_t)((dma_addr_t)desc -
                                    ^
>> altera_sgdma.c:394:5: warning: cast from
>> pointer to integer of different size [-Wpointer-to-int-cast]
        (dma_addr_t)priv->tx_dma_desc);
        ^
   altera_sgdma.c: In function 'sgdma_rxphysaddr':
>> altera_sgdma.c:403:33: warning: cast from
>> pointer to integer of different size [-Wpointer-to-int-cast]
     dma_addr_t offs = (dma_addr_t)((dma_addr_t)desc -
                                    ^
>> altera_sgdma.c:404:5: warning: cast from
>> pointer to integer of different size [-Wpointer-to-int-cast]
        (dma_addr_t)priv->rx_dma_desc);
        ^

Reported-by: kbuild test robot <fengguang.wu@intel.com>
Signed-off-by: Vince Bridgers <vbridgers2013@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Altera TSE: Correct two typos in original submission

This patch addresses two typos in the original driver submission. One derived
from a cut & paste error, and another is a misspelling.

Signed-off-by: Vince Bridgers <vbridgers2013@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
atheros/atlx: use SET_ETHTOOL_OPS directly

As commit a6e28b34205b("staging/et131x: use SET_ETHTOOL_OPS
directly"), using a wrapper around SET_ETHTOOL_OPS macro is
not actually required, remove and use SET_ETHTOOL_OPS directly.

Signed-off-by: Wang Weidong <wangweidong1@huawei.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
ipv4: remove ip_rt_dump from route.c

ip_rt_dump do nothing after IPv4 route caches removal, so we can remove it.

Signed-off-by: Li RongQing <roy.qing.li@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Merge git://git.kernel.org/pub/scm/linux/kernel/git/jkirsher/net-next

Jeff Kirsher says:

====================
Intel Wired LAN Driver Updates

This series contains updates to igb, ixgbe, ixgbevf, i40e and i40evf.

Anjali provides a i40e/i40evf patch to add Energy Efficient Ethernet
Low Power Idle stats and a fix for i40e to change the string
"Side Band" to "Sideband" for consistency.

Mitch provides 2 patches for i40evf to fix if the driver encounters
an error while communicating with the PF driver, do not shut down the
admin queue unconditionally.  Add an error message when the admin
queue message never completes and fix formatting on another message
that was unnecessarily wrapped.

Mark provides a ixgbe patch and five ixgbevf patches.  Fix a possible
infinite recursion when an adapter is removed and registers all read
as all one's in ixgbe_clear_vmdq_generic() and ixgbe_clear_rar_generic().
Converts macros to static inline functions to align kernel coding standard
and prepare for adding Live Error Recovery (LER) to ixgbevf.  Change the
ethtool register test to use the normal register accessor functions and
eliminate macors used for calling register test functions to make error
exits more clear.  Checks all register reads for adapter removal by checking
the status register after any register read that returns all F's since the
status register will never return 0xFFFFFFFF unless the adapter is removed.

Jacob implements SIOCGHWTSTAMP ioctl for igb which enables user processes
to read the current hardware stamp config settings non-destructively.

Todd adds the initial register read and write for surprise removal (LER)
for igb.

Christian Engelmayer fixes an igb memory leak in the igb_get_module_eeprom()
error handling path.

Ken Ichikawa provides a fix for igb, specifically for 82575 hardware to
specify -1 to the phc_index for ethtool's get_ts_info, otherwise a wrong
value will be set to the phc_index.

Christopher Paasch fixes a null pointer dereference in igb and makes sure
to unset the HAS_MSIX flag when the driver falls back to MSI only.
====================

Signed-off-by: David S. Miller <davem@davemloft.net>
scsi_transport_srp: Fix two kernel-doc warnings

This patch fixes the following two kernel-doc warnings:

    Warning(drivers/scsi/scsi_transport_srp.c:819): No description found for parameter 'rport'
    Warning(include/scsi/scsi_transport_srp.h:75): Excess struct/union/enum/typedef member 'deleted' description in 'srp_rport'

Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Reported-by: Masanari Iida <standby24x7@gmail.com>
Acked-by: Sebastian Riemer <sebastian.riemer@profitbricks.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
IB/srp: Check ib_query_gid return value

Detected by Coverity.

Signed-off-by: Sagi Grimberg <sagig@mellanox.com>
Signed-off-by: Bart Van Assche <bvanassche@acm.org>
Signed-off-by: Roland Dreier <roland@purestorage.com>