Pull single_open() leak fixes from Al Viro:
 "A bunch of fixes for a moderately common class of bugs: file with
  single_open() done by its ->open() and seq_release as its ->release().

  That leaks; fortunately, it's not _too_ common (either people manage
  to RTFM that says "When using single_open(), the programmer should use
  single_release() instead of seq_release() in the file_operations
  structure to avoid a memory leak", or they just copy a correct
  instance), but grepping through the tree has caught quite a pile.

  All of that is, AFAICS, -stable fodder, for as far as the patches
  apply.  I tried to carve it up into reasonably-sized pieces (more or
  less "comes from the same tree")"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  rcutrace: single_open() leaks
  gadget: single_open() leaks
  staging: single_open() leaks
  megaraid: single_open() leak
  wireless: single_open() leaks
  input: single_open() leak
  rtc: single_open() leaks
  ds1620: single_open() leak
  sh: single_open() leaks
  parisc: single_open() leaks
  mips: single_open() leaks
  ia64: single_open() leaks
  h8300: single_open() leaks
  cris: single_open() leaks
  arm: single_open() leaks

Merge ipc fixes and cleanups from my IPC branch.

The ipc locking has always been pretty ugly, and the scalability fixes
to some degree made it even less readable.  We had two cases of double
unlocks in error paths due to this (one rcu read unlock, one semaphore
unlock), and this fixes the bugs I found while trying to clean things up
a bit so that we are less likely to have more.

* ipc-cleanups:
  ipc: simplify rcu_read_lock() in semctl_nolock()
  ipc: simplify semtimedop/semctl_main() common error path handling
  ipc: move sem_obtain_lock() rcu locking into the only caller
  ipc: fix double sem unlock in semctl error path
  ipc: move the rcu_read_lock() from sem_lock_and_putref() into callers
  ipc: sem_putref() does not need the semaphore lock any more
  ipc: move rcu_read_unlock() out of sem_unlock() and into callers

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Cc: vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Pull networking fixes from David Miller:

 1) Several routines do not use netdev_features_t to hold such bitmasks,
    fixes from Patrick McHardy and Bjørn Mork.

 2) Update cpsw IRQ software state and the actual HW irq enabling in the
    correct order.  From Mugunthan V N.

 3) When sending tipc packets to multiple bearers, we have to make
    copies of the SKB rather than just giving the original SKB directly.
    Fix from Gerlando Falauto.

 4) Fix race with bridging topology change timer, from Stephen
    Hemminger.

 5) Fix TCPv6 segmentation handling in GRE and VXLAN, from Pravin B
    Shelar.

 6) Endian bug in USB pegasus driver, from Dan Carpenter.

 7) Fix crashes on MTU reduction in USB asix driver, from Holger
    Eitzenberger.

 8) Don't allow the kernel to BUG() just because the user puts some crap
    in an AF_PACKET mmap() ring descriptor.  Fix from Daniel Borkmann.

 9) Don't use variable sized arrays on the stack in xen-netback, from
    Wei Liu.

10) Fix stats reporting and an unbalanced napi_disable() in be2net
    driver.  From Somnath Kotur and Ajit Khaparde.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (25 commits)
  cxgb4: fix error recovery when t4_fw_hello returns a positive value
  sky2: Fix crash on receiving VLAN frames
  packet: tpacket_v3: do not trigger bug() on wrong header status
  asix: fix BUG in receive path when lowering MTU
  net: qmi_wwan: Add Telewell TW-LTE 4G
  usbnet: pegasus: endian bug in write_mii_word()
  vxlan: Fix TCPv6 segmentation.
  gre: Fix GREv4 TCPv6 segmentation.
  bridge: fix race with topology change timer
  tipc: pskb_copy() buffers when sending on more than one bearer
  tipc: tipc_bcbearer_send(): simplify bearer selection
  tipc: cosmetic: clean up comments and break a long line
  drivers: net: cpsw: irq not disabled in cpsw isr in particular sequence
  xen-netback: better names for thresholds
  xen-netback: avoid allocating variable size array on stack
  xen-netback: remove redundent parameter in netbk_count_requests
  be2net: Fix to fail probe if MSI-X enable fails for a VF
  be2net: avoid napi_disable() when it has not been enabled
  be2net: Fix firmware download for Lancer
  be2net: Fix to receive Multicast Packets when Promiscuous mode is enabled on certain devices
  ...

Pull sparc updates from David Miller:

 1) Hibernation support, as well as removal of excess interrupt
    twiddling in MMU context allocation on sparc64 from Kirill Tkhai.

 2) Kill references to __ARCH_WANT_UNLOCKED_CTXSW.

 3) Sparc32 LEON bug fixes from Daniel Hellstrom and Andreas Larsson.

 4) Provide cmpxchg64(), from Geert Uytterhoeven.

 5) Device refcount and registry bug fixes from Federico Vaga and Wei
    Yongjun.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc-next:
  serial: sunsu: add missing platform_driver_unregister() when module exit
  sparc32, leon: Do not overwrite previously set irq flow handlers
  sparc/kernel/vio.c: add put_device() after device_find_child()
  sparc64: Do not save/restore interrupts in get_new_mmu_context()
  sparc: Consistently use 'wr' and 'rd' instructions for ASRs.
  sparc64: Kill __ARCH_WANT_UNLOCKED_CTXSW
  sparc64: Provide cmpxchg64()
  sparc64: Do not change num_physpages during initmem freeing
  sparc64: Hibernation support
  sparc,leon: updated GRPCI2 config name
  sparc,leon: support for GRPCI1 PCI host bridge controller
  sparc32,leon: add support for PCI busn resource for GRPCI2

Merge sparc bug fixes that didn't make it into v3.9 into
sparc-next.
Signed-off-by: David S. Miller <davem@davemloft.net>

We have registered platform driver when module init, and
need unregister it when module exit.
Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: David S. Miller <davem@davemloft.net>

This is needed because when scan_of_devices finds the GAISLER_GPTIMER
core that corresponds to the SMP "ticker" timer, the previously set
proper irq flow handler gets overwritten with an incorrect one. This
leads to very flaky timer interrupt handling on some hardware. Proper
updates to handlers can still be done using leon_update_virq_handling.
Signed-off-by: Andreas Larsson <andreas@gaisler.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

The vio_remove() function uses device_find_child() but it does not drop
the reference of the retrieved child.
Signed-off-by: Federico Vaga <federico.vaga@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

This trivially combines two rcu_read_lock() calls in both sides of a
if-statement into one single one in front of the if-statement.

Split out as an independent cleanup from the previous commit.
Acked-by: Davidlohr Bueso <davidlohr.bueso@hp.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

With various straight RCU lock/unlock movements, one common exit path
pattern had become

	rcu_read_unlock();
	goto out_wakeup;

and in fact there were no cases where we wanted to exit to out_wakeup
_without_ releasing the RCU read lock.

So replace that pattern with "goto out_rcu_wakeup", and remove the old
out_wakeup.
Acked-by: Davidlohr Bueso <davidlohr.bueso@hp.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

sem_obtain_lock() was another of those functions that returned with the
RCU lock held for reading in the success case.  Move the RCU locking to
the caller (semtimedop()), making it more obvious.  We already did RCU
locking elsewhere in that function.

Side note: why does semtimedop() re-do the semphore lookup after the
sleep, rather than just getting a reference to the semaphore it already
looked up originally?
Acked-by: Davidlohr Bueso <davidlohr.bueso@hp.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Fix another ipc locking buglet introduced by the scalability patches:
when semctl_down() was changed to delay the semaphore locking, one error
path for security_sem_semctl() went through the semaphore unlock logic
even though the semaphore had never been locked.

Introduced by commit 16df3674 ("ipc,sem: do not hold ipc lock more
than necessary")
Acked-by: Davidlohr Bueso <davidlohr.bueso@hp.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

This is another ipc semaphore locking cleanup, trying to make the
locking more straightforward.  We move the rcu read locking into the
callers of sem_lock_and_putref(), which in general means that we now
mostly do the rcu_read_lock() and rcu_read_unlock() in the same
function.

Mostly.  We still have the ipc_addid/newary/freeary mess, and things
like ipcctl_pre_down_nolock().
Acked-by: Davidlohr Bueso <davidlohr.bueso@hp.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Pull MMC update from Chris Ball:
 "MMC highlights for 3.10:

  Core:
   - Introduce MMC_CAP2_NO_PRESCAN_POWERUP to allow skipping
     mmc_power_up() at boot/initialization time if it's already
     happened, for performance (faster boot time) reasons.
   - Fix a bit width test failure that resulted in old eMMC cards being
     put into 1-bit mode when 4-bit mode was available.
   - Expose fwrev/hwrev for MMCv4 parts.
   - Improve card removal logic in the case where the card's removed
     slowly; we were missing card removal events if the card retained
     contact with the slot pads for long enough to reply to a CMD13
     while being removed.

  Drivers:
   - davinci_mmc: Support using PIO instead of DMA.
   - dw_mmc: Add support for Exynos4412.
   - mxcmmc: DT support, use slot-gpio API.
   - mxs-mmc: Add broken-cd/cd-inverted/non-removable DT property
     support.
   - sdhci-sirf: New sdhci-pltfm driver for CSR SiRF SoCs:
       SiRFprimaII: unicore ARM Cortex-A9
       SiRFatlas6: unicore ARM Cortex-A9
       SiRFmarco: dual core ARM Cortex-A9 SMP
   - sdhci-tegra: Add support for Tegra114 platforms, use
     mmc_of_parse()"

* tag 'mmc-updates-for-3.10-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc: (66 commits)
  mmc: sdhci-tegra: fix MODULE_DEVICE_TABLE
  mmc: core: fix init controller performance regression, updated patch
  mmc: mxcmmc: enable DMA support on mpc512x
  mmc: mxcmmc: constify mxcmci_devtype
  mmc: mxcmmc: use slot-gpio API for write-protect detection
  mmc: mxcmmc: add mpc512x SDHC support
  mmc: mxcmmc: fix race conditions for host->req and host->data access
  mmc: mxcmmc: DT support
  mmc: dw_mmc: let device core setup the default pin configuration
  mmc: mxs-mmc: add broken-cd property
  mmc: mxs-mmc: add non-removable property
  mmc: mxs-mmc: add cd-inverted property
  mmc: core: call pm_runtime_put_noidle in pm_runtime_get_sync failed case
  mmc: mxcmmc: Fix bug when card is present during boot
  mmc: core: fix performance regression initializing MMC host controllers
  Revert "mmc: core: wait while adding MMC host to ensure root mounts successfully"
  mmc: atmel-mci: pio hang on block errors
  mmc: core: Fix bit width test failing on old eMMC cards
  mmc: dw_mmc: Use pr_info instead of printk
  mmc: dw_mmc: Check return value of regulator_enable
  ...

Pull hwmon update from Jean Delvare:
 "Only lm75 driver updates this time"

* 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging:
  hwmon: (lm75) Add support for the Dallas/Maxim DS7505
  hwmon: (lm75) Tune resolution and sample time per chip
  hwmon: (lm75) Prepare to support per-chip resolution and sample time
  hwmon: (lm75) Per-chip configuration register initialization

Pull second round of VFS updates from Al Viro:
 "Assorted fixes"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  xtensa simdisk: fix braino in "xtensa simdisk: switch to proc_create_data()"
  hostfs: use kmalloc instead of kzalloc
  hostfs: move HOSTFS_SUPER_MAGIC to <linux/magic.h>
  hostfs: remove "will unlock" comment
  vfs: use list_move instead of list_del/list_add
  proc_devtree: Replace include linux/module.h with linux/export.h
  create_mnt_ns: unidiomatic use of list_add()
  fs: remove dentry_lru_prune()
  Removed unused typedef to avoid "unused local typedef" warnings.
  kill fs/read_write.h
  fs: Fix hang with BSD accounting on frozen filesystem
  sun3_scsi: add ->show_info()
  nubus: Kill nubus_proc_detach_device()
  more mode_t whack-a-mole...
  do_coredump(): don't wait for thaw if coredump has already been interrupted
  do_mount(): fix a leak introduced in 3.9 ("mount: consolidate permission checks")

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

The inode info structure is zeroed at allocation with kzalloc, and then
all but one of the fields (including the largest, vfs_inode) are
initialised explicitly. Switch to using kmalloc and initialise the
remaining field too.
Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Move HOSTFS_SUPER_MAGIC to <linux/magic.h> to be with it's magical
friends from other file systems.
Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

A "will unlock" comment was added to hostfs in the following commit,
along with a spinlock:

Commit e9193059 ("hostfs: fix races in
dentry_name() and inode_name()").

But the spinlock was subsequently removed in the following commit:

Commit ec2447c2 ("hostfs: simplify
locking").

Since the comment is no longer applicable, remove it.
Reported-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: James Hogan <james.hogan@imgtec.com>
Cc: Nick Piggin <npiggin@kernel.dk>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Using list_move() instead of list_del() + list_add().
Signed-off-by: Wei Yongjun <yongjun_wei@trendmicro.com.cn>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Pull ARM SoC board specific changes (part 1) from Olof Johansson:
 "These changes are all for board specific files.  These used to make up
  a large portion of the ARM changes in the past, but as we are
  generalizing the support and moving to device tree probing, this has
  gotten significantly smaller.

  The only platform actually adding new code here at the moment is
  Renesas shmobile, as they are still busy converting their code to
  device tree and have not come far enough to not need it."

* tag 'boards-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (43 commits)
  ARM: msm: USB_MSM_OTG needs USB_PHY
  ARM: davinci: da850 evm: fix const qualifier placement
  ARM: davinci: da850 board: add remoteproc support
  ARM: pxa: move debug uart code
  ARM: pxa: select PXA935 on saar & tavorevb
  ARM: mmp: add more compatible names in gpio driver
  ARM: pxa: move PXA_GPIO_TO_IRQ macro
  ARM: pxa: remove cpu_is_xxx in gpio driver
  ARM: Kirkwood: update Network Space Mini v2 description
  ARM: Kirkwood: DT board setup for CloudBox
  ARM: Kirkwood: sort board entries by ASCII-code order
  ARM: OMAP: board-4430sdp: Provide regulator to pwm-backlight
  ARM: OMAP: zoom: Use pwm stack for lcd and keyboard backlight
  ARM: OMAP2+: omap2plus_defconfig: Add support for BMP085 pressure sensor
  omap2+: Remove useless Makefile line
  omap2+: Remove useless Makefile line
  ARM: OMAP: RX-51: add missing regulator supply definitions for lis3lv02d
  ARM: OMAP1: fix omap_udc registration
  ARM: davinci: use is IS_ENABLED macro
  ARM: kirkwood: add MACH_GURUPLUG_DT to defconfig
  ...

Pull ARM platform specific firmware interfaces from Olof Johansson:
 "Two platforms, bcm and exynos have their own firmware interfaces using
  the "secure monitor call", this adds support for those.

  We had originally planned to have a third set of patches in here,
  which would extend support for the existing generic "psci" call that
  is used on multiple platforms as well as Xen and KVM guests, but that
  ended up getting dropped because the patches were not ready in time."

* tag 'firmware-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
  ARM: bcm: mark bcm_kona_smc_init as __init
  ARM: bcm281xx: Add DT support for SMC handler
  ARM: bcm281xx: Add L2 cache enable code
  ARM: EXYNOS: Add secure firmware support to secondary CPU bring-up
  ARM: EXYNOS: Add IO mapping for non-secure SYSRAM.
  ARM: EXYNOS: Add support for Exynos secure firmware
  ARM: EXYNOS: Add support for secure monitor calls
  ARM: Add interface for registering and calling firmware-specific operations

Pull ARM SoC pinctrl changes for Renesas from Olof Johansson:
 "This is yet another driver change, which is split out just because of
  its size.  As already in 3.9, a lot of changes are going on here, as
  the shmobile platform gets converted from its own pin control API to
  the generic drivers/pinctrl subsystem.

  Based on agreements with Paul Mundt, we are merging the sh-arch-side
  changes here as well"

* tag 'renesas-pinctrl-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (142 commits)
  ARM: shmobile: r8a7779: Remove INTC function GPIOs
  ARM: shmobile: r8a7779: Remove LBSC function GPIOs
  ARM: shmobile: r8a7779: Remove USB function GPIOs
  ARM: shmobile: r8a7779: Remove HSPI function GPIOs
  ARM: shmobile: r8a7779: Remove SCIF function GPIOs
  ARM: shmobile: r8a7779: Remove SDHI and MMCIF function GPIOs
  ARM: shmobile: r8a7779: Remove DU function GPIOs
  ARM: shmobile: r8a7779: Remove DU1_DOTCLKOUT1 GPIO
  ARM: shmobile: r8a7740: Remove SDHI and MMCIF function GPIOs
  ARM: shmobile: r8a7740: Remove LCD0 and LCD1 function GPIOs
  ARM: shmobile: sh73a0: Remove IrDA function GPIOs
  ARM: shmobile: sh73a0: Remove USB function GPIOs
  ARM: shmobile: sh73a0: Remove BSC function GPIOs
  ARM: shmobile: sh73a0: Remove KEYSC function GPIOs
  ARM: shmobile: sh73a0: Remove pull-up function GPIOS
  ARM: shmobile: sh73a0: Remove FSI function GPIOs
  ARM: shmobile: sh73a0: Remove I2C function GPIOs
  ARM: shmobile: sh73a0: Remove SCIFA and SCIFB function GPIOs
  ARM: shmobile: sh73a0: Remove LCDC and LCDC2 function GPIOs
  ARM: shmobile: sh7372: Remove SDHI and MMCIF function GPIOs
  ...

Pull ARM SoC driver changes from Olof Johansson:
 "This is a rather large set of patches for device drivers that for one
  reason or another the subsystem maintainer preferred to get merged
  through the arm-soc tree.  There are both new drivers as well as
  existing drivers that are getting converted from platform-specific
  code into standalone drivers using the appropriate subsystem specific
  interfaces.

  In particular, we can now have pinctrl, clk, clksource and irqchip
  drivers in one file per driver, without the need to call into platform
  specific interface, or to get called from platform specific code, as
  long as all information about the hardware is provided through a
  device tree.

  Most of the drivers we touch this time are for clocksource.  Since now
  most of them are part of drivers/clocksource, I expect that we won't
  have to touch these again from arm-soc and can let the clocksource
  maintainers take care of these in the future.

  Another larger part of this series is specific to the exynos platform,
  which is seeing some significant effort in upstreaming and
  modernization of its device drivers this time around, which
  unfortunately is also the cause for the churn and a lot of the merge
  conflicts.

  There is one new subsystem that gets merged as part of this series:
  the reset controller interface, which is a very simple interface for
  taking devices on the SoC out of reset or back into reset.  Patches to
  use this interface on i.MX follow later in this merge window, and we
  are going to have other platforms (at least tegra and sirf) get
  converted in 3.11.  This will let us get rid of platform specific
  callbacks in a number of platform independent device drivers."

* tag 'drivers-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (256 commits)
  irqchip: s3c24xx: add missing __init annotations
  ARM: dts: Disable the RTC by default on exynos5
  clk: exynos5250: Fix parent clock for sclk_mmc{0,1,2,3}
  ARM: exynos: restore mach/regs-clock.h for exynos5
  clocksource: exynos_mct: fix build error on non-DT
  pinctrl: vt8500: wmt: Fix checking return value of pinctrl_register()
  irqchip: vt8500: Convert arch-vt8500 to new irqchip infrastructure
  reset: NULL deref on allocation failure
  reset: Add reset controller API
  dt: describe base reset signal binding
  ARM: EXYNOS: Add arm-pmu DT binding for exynos421x
  ARM: EXYNOS: Add arm-pmu DT binding for exynos5250
  ARM: EXYNOS: Enable PMUs for exynos4
  irqchip: exynos-combiner: Correct combined IRQs for exynos4
  irqchip: exynos-combiner: Add set_irq_affinity function for combiner_irq
  ARM: EXYNOS: fix compilation error introduced due to common clock migration
  clk: exynos5250: Fix divider values for sclk_mmc{0,1,2,3}
  clk: exynos4: export clocks required for fimc-is
  clk: samsung: Fix compilation error
  clk: tegra: fix enum tegra114_clk to match binding
  ...