cgroup: fix cgroup post-order descendant walk of empty subtree

bd8815a6d8 ("cgroup: make css_for_each_descendant() and friends
include the origin css in the iteration") updated cgroup descendant
iterators to include the origin css; unfortuantely, it forgot to drop
special case handling in css_next_descendant_post() for empty subtree
leading to failure to visit the origin css without any child.

Fix it by dropping the special case handling and always returning the
leftmost descendant on the first iteration.

Signed-off-by: Tejun Heo <tj@kernel.org>
Acked-by: Li Zefan <lizefan@huawei.com>
xfrm: Fix replay size checking on async events

We pass the wrong netlink attribute to xfrm_replay_verify_len().
It should be XFRMA_REPLAY_ESN_VAL and not XFRMA_REPLAY_VAL as
we currently doing. This causes memory corruptions if the
replay esn attribute has incorrect length. Fix this by passing
the right attribute to xfrm_replay_verify_len().

Reported-by: Michael Rossberg <michael.rossberg@tu-ilmenau.de>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
xfrm: Decode sessions with output interface.

The output interface matching does not work on forward
policy lookups, the output interface of the flowi is
always 0. Fix this by setting the output interface when
we decode the session.

Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
ipsec: Don't update the pmtu on ICMPV6_DEST_UNREACH

Currently we update the pmtu in the IPsec protocol error handlers
if icmpv6 message type is either ICMPV6_DEST_UNREACH or
ICMPV6_PKT_TOOBIG. Updating the pmtu on ICMPV6_DEST_UNREACH
is wrong in any case, it causes strangely fragmented packets.
Only ICMPV6_PKT_TOOBIG signalizes pmtu discovery, so remove the
ICMPV6_DEST_UNREACH check in the IPsec protocol error handlers.

Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
xfrm: Guard IPsec anti replay window against replay bitmap

For legacy IPsec anti replay mechanism:

bitmap in struct xfrm_replay_state could only provide a 32 bits
window size limit in current design, thus user level parameter
sadb_sa_replay should honor this limit, otherwise misleading
outputs("replay=244") by setkey -D will be:

192.168.25.2 192.168.22.2
	esp mode=transport spi=147561170(0x08cb9ad2) reqid=0(0x00000000)
	E: aes-cbc  9a8d7468 7655cf0b 719d27be b0ddaac2
	A: hmac-sha1  2d2115c2 ebf7c126 1c54f186 3b139b58 264a7331
	seq=0x00000000 replay=244 flags=0x00000000 state=mature
	created: Sep 17 14:00:00 2013	current: Sep 17 14:00:22 2013
	diff: 22(s)	hard: 30(s)	soft: 26(s)
	last: Sep 17 14:00:00 2013	hard: 0(s)	soft: 0(s)
	current: 1408(bytes)	hard: 0(bytes)	soft: 0(bytes)
	allocated: 22	hard: 0	soft: 0
	sadb_seq=1 pid=4854 refcnt=0
192.168.22.2 192.168.25.2
	esp mode=transport spi=255302123(0x0f3799eb) reqid=0(0x00000000)
	E: aes-cbc  6485d990 f61a6bd5 e5660252 608ad282
	A: hmac-sha1  0cca811a eb4fa893 c47ae56c 98f6e413 87379a88
	seq=0x00000000 replay=244 flags=0x00000000 state=mature
	created: Sep 17 14:00:00 2013	current: Sep 17 14:00:22 2013
	diff: 22(s)	hard: 30(s)	soft: 26(s)
	last: Sep 17 14:00:00 2013	hard: 0(s)	soft: 0(s)
	current: 1408(bytes)	hard: 0(bytes)	soft: 0(bytes)
	allocated: 22	hard: 0	soft: 0
	sadb_seq=0 pid=4854 refcnt=0

And also, optimizing xfrm_replay_check window checking by setting the
desirable x->props.replay_window with only doing the comparison once
for all when xfrm_state is first born.

Signed-off-by: Fan Du <fan.du@windriver.com>
Signed-off-by: Steffen Klassert <steffen.klassert@secunet.com>
jfs: fix error path in ialloc

If insert_inode_locked() fails, we shouldn't be calling
unlock_new_inode().

Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
Tested-by: Michael L. Semon <mlsemon35@gmail.com>
Cc: stable@vger.kernel.org
Input: pxa27x_keypad - fix NULL pointer dereference

A NULL pointer dereference exception occurs in the driver probe function when
device tree is used.  The pdata pointer will be NULL in this case, but the code
dereferences it in all cases.  When device tree is used, a platform data
structure is allocated and initialized, and in all cases this pointer is copied
to the driver's private data, so the variable being tested should be accessed
through the driver's private data structure.

Signed-off-by: Mike Dunn <mikedunn@newsguy.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Input: i8042 - i8042_flush fix for a full 8042 buffer

When 8042 internal data buffer is full, the driver
erroneously decides that the controller is not present.

i8042_flush returns the number of flushed bytes, which is
in 0 - I8042_BUFFER_SIZE range inclusive. Therefore, i8042_flush
has no way to indicate an error. Moreover i8042_controller_check
takes initially full buffer (i8042_flush returned
I8042_BUFFER_SIZE) as a sign of absence of the controller.

Let's change i8042 to return success/error instead and make sure
we do not return error prematurely.

Signed-off-by: Andrey Moiseev <o2g.org.ru@gmail.com>
Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
[media] uvcvideo: quirk PROBE_DEF for Dell SP2008WFP monitor

BugLink: http://bugs.launchpad.net/bugs/1217957
Add quirk for Dell SP2008WFP monitor: 05a9:2641

Signed-off-by: Joseph Salisbury <joseph.salisbury@canonical.com>
Tested-by: Christopher Townsend <christopher.townsend@canonical.com>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
[media] uvcvideo: quirk PROBE_DEF for Microsoft Lifecam NX-3000

The camera doesn't implement GET_DEF on the video probe control and
can crash when it receives the request depending on timings. Set the
PROBE_DEF quirk to work around the problem.

Reported-by: Jürgen Liebmann <info@pirna-esw6.de>
Signed-off-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
[media] e4000: fix PLL calc bug on 32-bit arch

Fix long-lasting bug that causes tuning failure of some frequencies
on 32-bit arch.
Special thanks goes to Damien CABROL who finally find root of the bug.
Also big thanks to Jacek Konieczny for donating "non-working" device.

[crope@iki.fi: fix trivial merge conflict]
[m.chehab@samsung.com: add missing header file]
Reported-by: Jacek Konieczny <jajcus@jajcus.net>
Reported-by: Torsten Seyffarth <t.seyffarth@gmx.de>
Reported-by: Jan Taegert <jantaegert@gmx.net>
Reported-by: Damien CABROL <cabrol.damien@free.fr>
Tested-by: Damien CABROL <cabrol.damien@free.fr>
Tested-by: Jan Taegert <jantaegert@gmx.net>
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
[media] msi3101: msi3101_ioctl_ops can be static

Signed-off-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
[media] msi3101: Kconfig select VIDEOBUF2_VMALLOC

[linuxtv-media:master 395/499] sdr-msi3101.c:undefined reference to
`vb2_vmalloc_memops'

Reported-by: kbuild test robot <fengguang.wu@intel.com>
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
[media] Add HCL T12Rg-H to STK webcam upside-down table

The owner knows the system as "LX INFINITI Powerlite".
DMI information for this system:
System Information
        Manufacturer: HCL Infosystems Limited
        Product Name: T12Rg-H
        Version: 1.0
        Serial Number: B073A1189988
        UUID: 326B3F00-001D-602F-CFD2-4E45435F4349
        Wake-up Type: Power Switch
        SKU Number:
        Family:
Handle 0x0002, DMI type 2, 15 bytes
Base Board Information
        Manufacturer: HCL Infosystems Limited
        Product Name: T12Rg-H
        Version: 1.0
        Serial Number: BSN12345678901234567
        Asset Tag: ATN12345678901234567
        Features:
                Board is a hosting board
                Board is replaceable
        Location In Chassis:
        Chassis Handle: 0x0003
        Type: Motherboard
        Contained Object Handles: 0
Bus 001 Device 003: ID 05e1:0501 Syntek Semiconductor Co., Ltd DC-1125 Webcam

Signed-off-by: Gregor Jasny <gjasny@googlemail.com>
Reported-by: Noopur Srivastava <noopur.018@gmail.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
[media] msi3101: correct max videobuf2 alloc

There was too small buffers requested in worst case.

Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
[media] tda10071: change firmware download condition

Reading firmware status register to detect whether firmware is
running or not didn't worked 100% reliably. That register was
likely set by firmware itself which means it could not contain
reasonable values until firmware is up and running. Usually it
just worked as some garbage value was returned accidentally but it
appears that in some cases returned garbage value was 0x00 which
was considered "firmware is up and running" by the driver and
firmware loading was skipped leaving device to non-working state.
Fix problem by removing unreliable check and let the driver keep
count whether firmware is loaded or not.

Signed-off-by: Andreas Matthies <a.matthies@gmx.net>
Signed-off-by: Antti Palosaari <crope@iki.fi>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
[media] sh_vou: almost forever loop in sh_vou_try_fmt_vid_out()

The "i < " part of the "i < ARRAY_SIZE()" condition was missing.

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
[g.liakhovetski@gmx.de: remove unrelated superfluous braces]
Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>

Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
[media] mx3-camera: locking cleanup in mx3_videobuf_queue()

Smatch complains about the locking here because we mix spin_lock_irq()
with spin_lock_irqsave() in an unusual way.  According to Smatch, it's
not always clear if the IRQs are enabled or disabled when we return.  It
turns out this function is always called with IRQs enabled and we can
just use spin_lock_irq().
It's called from __enqueue_in_driver().

Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Guennadi Liakhovetski <g.liakhovetski@gmx.de>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
[media] vb2: Allow queuing OUTPUT buffers with zeroed 'bytesused'

Modify the bytesused/data_offset check to not fail if both bytesused
and data_offset is set to 0. This should minimize possible issues in
existing applications which worked before we enforced the plane lengths
for output buffers checks introduced in commit 8023ed09cb278004a2
"videobuf2-core: Verify planes lengths for output buffers"

Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Acked-by: Marek Szyprowski <m.szyprowski@samsung.com>
Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
[media] videobuf2-dc: Fix support for mappings without struct page in userptr mode

Earlier version of dma-contig allocator in user ptr mode assumed that in
all cases DMA address equals physical address. This was just a special case.
Commit e15dab752d4c588544ccabdbe020a7cc092e23c8 introduced correct support
for converting userpage to dma address, but unfortunately it broke the
support for simple dma address = physical address for the case, when given
physical frame has no struct page associated with it (this happens if one
use for example dma_declare_coherent api or other reserved memory approach).
This commit restores support for such cases.

Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
[s.nawrocki@samsung.com: replaced #elsif with #elif]
Signed-off-by: Sylwester Nawrocki <s.nawrocki@samsung.com>

Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>