Pull KVM fixes from Radim Krčmář:
 "ARM:
   - Fix for timer setup on VHE machines
   - Drop spurious warning when the timer races against the vcpu running
     again
   - Prevent a vgic deadlock when the initialization fails (for stable)

  s390:
   - Fix a kernel memory exposure (for stable)

  x86:
   - Fix exception injection when hypercall instruction cannot be
     patched"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  KVM: s390: do not expose random data via facility bitmap
  KVM: x86: fix fixing of hypercalls
  KVM: arm/arm64: vgic: Fix deadlock on error handling
  KVM: arm64: Access CNTHCTL_EL2 bit fields correctly on VHE systems
  KVM: arm/arm64: Fix occasional warning from the timer work function

Merge branch 'scsi-target-for-v4.10' of git://git.kernel.org/pub/scm/linux/kernel/git/bvanassche/linux

Pull SCSI target fixes from Bart Van Assche:

 - two small fixes for the ibmvscsis driver

 - ten patches with bug fixes for the target mode of the qla2xxx driver

 - four patches that avoid that the "sparse" and "smatch" static
   analyzer tools report false positives for the qla2xxx code base

* 'scsi-target-for-v4.10' of git://git.kernel.org/pub/scm/linux/kernel/git/bvanassche/linux:
  qla2xxx: Disable out-of-order processing by default in firmware
  qla2xxx: Fix erroneous invalid handle message
  qla2xxx: Reduce exess wait during chip reset
  qla2xxx: Terminate exchange if corrupted
  qla2xxx: Fix crash due to null pointer access
  qla2xxx: Collect additional information to debug fw dump
  qla2xxx: Reset reserved field in firmware options to 0
  qla2xxx: Set tcm_qla2xxx version to automatically track qla2xxx version
  qla2xxx: Include ATIO queue in firmware dump when in target mode
  qla2xxx: Fix wrong IOCB type assumption
  qla2xxx: Avoid that building with W=1 triggers complaints about set-but-not-used variables
  qla2xxx: Move two arrays from header files to .c files
  qla2xxx: Declare an array with file scope static
  qla2xxx: Fix indentation
  ibmvscsis: Fix sleeping in interrupt context
  ibmvscsis: Fix max transfer length

Pull block fixes from Jens Axboe:
 "Just two small fixes for this -rc.

  One is just killing an unused variable from Keith, but the other
  fixes a performance regression for nbd in this series, where we
  inadvertently flipped when we set MSG_MORE when outputting data"

* 'for-linus' of git://git.kernel.dk/linux-block:
  nbd: only set MSG_MORE when we have more to send
  blk-mq: Remove unused variable

Pull spi fixes from Mark Brown:
 "The usual small smattering of driver specific fixes. A few bits that
  stand out here:

   - the R-Car patches adding fallbacks are just adding new compatible
     strings to the driver so that device trees are written in a more
     robustly future proof fashion, this isn't strictly a fix but it's
     just new IDs and it's better to get it into mainline sooner to
     improve the ABI

   - the DesignWare "switch to new API part 2" patch is actually a
     misleadingly titled fix for a bit that got missed in the original
     conversion"

* tag 'spi-fix-v4.10-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: davinci: use dma_mapping_error()
  spi: spi-axi: Free resources on error path
  spi: pxa2xx: add missed break
  spi: dw-mid: switch to new dmaengine_terminate_* API (part 2)
  spi: dw: Make debugfs name unique between instances
  spi: sh-msiof: Do not use C++ style comment
  spi: armada-3700: Set mode bits correctly
  spi: armada-3700: fix unsigned compare than zero on irq
  spi: sh-msiof: Add R-Car Gen 2 and 3 fallback bindings
  spi: SPI_FSL_DSPI should depend on HAS_DMA

Pull ceph fixes from Ilya Dryomov:
 "Three filesystem endianness fixes (one goes back to the 2.6 era, all
  marked for stable) and two fixups for this merge window's patches"

* tag 'ceph-for-4.10-rc5' of git://github.com/ceph/ceph-client:
  ceph: fix bad endianness handling in parse_reply_info_extra
  ceph: fix endianness bug in frag_tree_split_cmp
  ceph: fix endianness of getattr mask in ceph_d_revalidate
  libceph: make sure ceph_aes_crypt() IV is aligned
  ceph: fix ceph_get_caps() interruption

Pull overlayfs fix from Miklos Szeredi:
 "This fixes a regression introduced in this cycle"

* 'overlayfs-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/vfs:
  ovl: fix possible use after free on redirect dir lookup

Pull fuse fixes from Miklos Szeredi:
 "Fix two regressions, one introduced in 4.9 and a less recent one in
  4.2"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse:
  fuse: fix time_to_jiffies nsec sanity check
  fuse: clear FR_PENDING flag when moving requests out of pending queue

Pull SCSI fixes from James Bottomley:
 "This is a set of 12 fixes including the mpt3sas one that was causing
  hangs on ATA passthrough.

  The others are a couple of zoned block device fixes, a SAS device
  detection bug which lead to SATA drives not being matched to bays, two
  qla2xxx MSI fixes, a qla2xxx req for rsp confusion caused by cut and
  paste, and a few other minor fixes"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: mpt3sas: fix hang on ata passthrough commands
  scsi: lpfc: Set elsiocb contexts to NULL after freeing it
  scsi: sd: Ignore zoned field for host-managed devices
  scsi: sd: Fix wrong DPOFUA disable in sd_read_cache_type
  scsi: bfa: fix wrongly initialized variable in bfad_im_bsg_els_ct_request()
  scsi: ses: Fix SAS device detection in enclosure
  scsi: libfc: Fix variable name in fc_set_wwpn
  scsi: lpfc: avoid double free of resource identifiers
  scsi: qla2xxx: remove irq_affinity_notifier
  scsi: qla2xxx: fix MSI-X vector affinity
  scsi: qla2xxx: Fix apparent cut-n-paste error.
  scsi: qla2xxx: Get mutex lock before checking optrom_state

Pull arm64 fixes from Catalin Marinas:

 - avoid potential stack information leak via the ptrace ABI caused by
   uninitialised variables

 - SWIOTLB DMA API fall-back allocation fix when the SWIOTLB buffer is
   not initialised (all RAM is suitable for 32-bit DMA masks)

 - fix the bad_mode function returning for unhandled exceptions coming
   from user space

 - fix name clash in __page_to_voff()

* tag 'arm64-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm64/linux:
  arm64: avoid returning from bad_mode
  arm64/ptrace: Reject attempts to set incomplete hardware breakpoint fields
  arm64/ptrace: Avoid uninitialised struct padding in fpr_set()
  arm64/ptrace: Preserve previous registers for short regset write
  arm64/ptrace: Preserve previous registers for short regset write
  arm64/ptrace: Preserve previous registers for short regset write
  arm64: mm: avoid name clash in __page_to_voff()
  arm64: Fix swiotlb fallback allocation

KVM: s390: Fix for 4.10 (via kvm/master)

Fix a kernel memory exposure.

kvm_s390_get_machine() populates the facility bitmap by copying bytes
from the host results that are stored in a 256 byte array in the prefix
page. The KVM code does use the size of the target buffer (2k), thus
copying and exposing unrelated kernel memory (mostly machine check
related logout data).

Let's use the size of the source buffer instead.  This is ok, as the
target buffer will always be greater or equal than the source buffer as
the KVM internal buffers (and thus S390_ARCH_FAC_LIST_SIZE_BYTE) cover
the maximum possible size that is allowed by STFLE, which is 256
doublewords. All structures are zero allocated so we can leave bytes
256-2047 unchanged.

Add a similar fix for kvm_arch_init_vm().
Reported-by: Heiko Carstens <heiko.carstens@de.ibm.com>
[found with smatch]
Signed-off-by: Christian Borntraeger <borntraeger@de.ibm.com>
CC: stable@vger.kernel.org
Acked-by: Cornelia Huck <cornelia.huck@de.ibm.com>

Pull ARM SoC fixes from Olof Johansson:
 "We've been sitting on fixes for a while, and they keep trickling in at
  a low rate. Nothing in here comes across as particularly scary or
  noteworthy, for the most part it's a large collection of small DT
  tweaks"

* tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (24 commits)
  ARM: dts: da850-evm: fix read access to SPI flash
  ARM: dts: omap3: Fix Card Detect and Write Protect on Logic PD SOM-LV
  ARM64: dts: meson-gxbb-odroidc2: Disable SCPI DVFS
  ARM: dts: OMAP5 / DRA7: indicate that SATA port 0 is available.
  ARM: dts: NSP: Fix DT ranges error
  ARM: multi_v7_defconfig: set bcm47xx watchdog
  ARM: multi_v7_defconfig: fix config typo
  ARM: dts: dra72-evm-revc: fix typo in ethernet-phy node
  soc: ti: wkup_m3_ipc: Fix error return code in wkup_m3_ipc_probe()
  ARM: ux500: fix prcmu_is_cpu_in_wfi() calculation
  ARM: dts: sunxi: Change node name for pwrseq pin on Olinuxino-lime2-emmc
  ARM: dts: sun8i: Support DTB build for NanoPi M1
  ARM: dts: sun6i: hummingbird: Enable display engine again
  ARM: dts: sun6i: Disable display pipeline by default
  ARM, ARM64: dts: drop "arm,amba-bus" in favor of "simple-bus" part 3
  ARM: dts: imx6qdl-nitrogen6_som2: fix sgtl5000 pinctrl init
  ARM: dts: imx6qdl-nitrogen6_max: fix sgtl5000 pinctrl init
  ARM: OMAP1: DMA: Correct the number of logical channels
  ARM: dts: am335x-icev2: Remove the duplicated pinmux setting
  ARM: OMAP2+: Fix WL1283 Bluetooth Baud Rate
  ...

Pull xfs fixes from Darrick Wong:
 "I have a few more patches this week -- one to make the behavior of a
  quota id ioctl consistent with the other filesystems, and the rest
  improve validation of i_mode & i_size values coming into xfs so that
  we don't read off the ends of arrays or crash when handed garbage disk
  data.

  Summary:
   - inode i_mode sanitization
   - prevent overflows in getnextquota
   - minor build fixes"

* tag 'xfs-for-linux-4.10-rc5-1' of git://git.kernel.org/pub/scm/fs/xfs/xfs-linux:
  xfs: fix xfs_mode_to_ftype() prototype
  xfs: don't wrap ID in xfs_dq_get_next_id
  xfs: sanity check inode di_mode
  xfs: sanity check inode mode when creating new dentry
  xfs: replace xfs_mode_to_ftype table with switch statement
  xfs: add missing include dependencies to xfs_dir2.h
  xfs: sanity check directory inode di_size
  xfs: make the ASSERT() condition likely

Read access to the SPI flash are broken on da850-evm, i.e. the data
read is not what is actually programmed on the flash.
According to the datasheet for the M25P64 part present on the da850-evm,
if the SPI frequency is higher than 20MHz then the READ command is not
usable anymore and only the FAST_READ command can be used to read data.

This commit specifies in the DTS that we should use FAST_READ command
instead of the READ command.

Cc: stable@vger.kernel.org
Tested-by: Kevin Hilman <khilman@baylibre.com>
Signed-off-by: Fabien Parent <fparent@baylibre.com>
[nsekhar@ti.com: subject line adjustment]
Signed-off-by: Sekhar Nori <nsekhar@ti.com>
Signed-off-by: Olof Johansson <olof@lixom.net>

A user noticed that write performance was horrible over loopback and we
traced it to an inversion of when we need to set MSG_MORE.  It should be
set when we have more bvec's to send, not when we are on the last bvec.
This patch made the test go from 20 iops to 78k iops.
Signed-off-by: Josef Bacik <jbacik@fb.com>
Fixes: 429a787b ("nbd: fix use-after-free of rq/bio in the xmit path")
Signed-off-by: Jens Axboe <axboe@fb.com>

Pull PCI fixes from Bjorn Helgaas:

 - recognize that a PCI-to-PCIe bridge originates a PCIe hierarchy, so
   we enumerate that hierarchy correctly

 - X-Gene: fix a change merged for v4.10 that broke MSI

 - Keystone: avoid reading undefined registers, which can cause
   asynchronous external aborts

 - Supermicro X8DTH-i/6/iF/6F: ignore broken _CRS that caused us to
   change (and break) existing I/O port assignments

* tag 'pci-v4.10-fixes-1' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
  PCI/MSI: pci-xgene-msi: Fix CPU hotplug registration handling
  PCI: Enumerate switches below PCI-to-PCIe bridges
  x86/PCI: Ignore _CRS on Supermicro X8DTH-i/6/iF/6F
  PCI: designware: Check for iATU unroll only on platforms that use ATU

Pull HID fixes from Jiri Kosina:

 - regression fix for generic Wacom devices, from Jason Gerecke

 - DMA-on-stack fixes for hid-corsair driver, from Johan Hovold

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
  HID: wacom: Fix sibling detection regression
  HID: corsair: fix control-transfer error handling
  HID: corsair: fix DMA buffers on stack

Pull two s390 bug fixes from Martin Schwidefsky:
 "Two changes, the first is a fix to add a missing memory clobber to the
  inline assembly to load control registers. This has not caused any
  issues so far, but who knows what code gcc will generate in future
  versions.

  The second change is an update for the default configurations. This
  includes CONFIG_BUG_ON_DATA_CORRUPTION=y, we want this to be enabled
  for s390. The usual approach to debug problems on production systems
  is to use crash on a system dump and for us avoiding data corruptions
  is priority one"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:
  s390: update defconfigs
  s390/ctl_reg: make __ctl_load a full memory barrier

Pull xen fix from Juergen Gross:
 "A fix for Xen running in nested virtualization environment"

* tag 'for-linus-4.10-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/xen/tip:
  partially revert "xen: Remove event channel notification through Xen PCI platform device"

Generally, taking an unexpected exception should be a fatal event, and
bad_mode is intended to cater for this. However, it should be possible
to contain unexpected synchronous exceptions from EL0 without bringing
the kernel down, by sending a SIGILL to the task.

We tried to apply this approach in commit 9955ac47 ("arm64:
don't kill the kernel on a bad esr from el0"), by sending a signal for
any bad_mode call resulting from an EL0 exception.

However, this also applies to other unexpected exceptions, such as
SError and FIQ. The entry paths for these exceptions branch to bad_mode
without configuring the link register, and have no kernel_exit. Thus, if
we take one of these exceptions from EL0, bad_mode will eventually
return to the original user link register value.

This patch fixes this by introducing a new bad_el0_sync handler to cater
for the recoverable case, and restoring bad_mode to its original state,
whereby it calls panic() and never returns. The recoverable case
branches to bad_el0_sync with a bl, and returns to userspace via the
usual ret_to_user mechanism.
Signed-off-by: Mark Rutland <mark.rutland@arm.com>
Fixes: 9955ac47 ("arm64: don't kill the kernel on a bad esr from el0")
Reported-by: Mark Salter <msalter@redhat.com>
Cc: Will Deacon <will.deacon@arm.com>
Cc: stable@vger.kernel.org
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>

Commit 345857bb ("HID: wacom: generic: Add support for sensor offsets") included
a change to the operation and location of the call to 'wacom_add_shared_data'
in 'wacom_parse_and_register'. The modifications included moving it higher up
so that it would occur before the call to 'wacom_retrieve_hid_descriptor'. This
was done to prevent a crash that would have occured when the report containing
tablet offsets was fed into the driver with 'wacom_hid_report_raw_event'
(specifically: the various 'wacom_wac_*_report' functions were written with the
assumption that they would only be called once tablet setup had completed;
'wacom_wac_pen_report' in particular dereferences 'shared' which wasn't yet
allocated).

Moving the call to 'wacom_add_shared_data' effectively prevented the crash but
also broke the sibiling detection code which assumes that the HID descriptor
has been read and the various device_type flags set.

To fix this situation, we restore the original 'wacom_add_shared_data'
operation and location and instead implement an alternative change that can
also prevent the crash. Specifically, we notice that the report functions
mentioned above expect to be called only for input reports.  By adding a check,
we can prevent feature reports (such as the offset report) from
causing trouble.

Fixes: 345857bb ("HID: wacom: generic: Add support for sensor offsets")
Signed-off-by: Jason Gerecke <jason.gerecke@wacom.com>
Tested-by: Ping Cheng <pingc@wacom.com>
Reviewed-by: Benjamin Tissoires <benjamin.tissoires@redhat.com>
Signed-off-by: Jiri Kosina <jkosina@suse.cz>

Merge tag 'omap-for-v4.10/fixes-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap into fixes

Fixes for omaps for v4.10-rc cycle. Mostly a DMA regression fix for
omap1, and then a handful of trivial fixes for boards and devices to
work:

- Fixes TI wilink bluetooth strange platform data baud rate
- Remove duplicate pinmux line for am335x-icev2
- Fix omap1 dma regression
- Fix uninitialized return value for wkup_m3_ipc_probe()
- Fix Ethernet PHY binding typo for dra72-evm
- Fix init for omap5 and dra7 sata ports
- Fix mmc card detect pin for Logic PD SOM-LV

* tag 'omap-for-v4.10/fixes-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap:
  ARM: dts: omap3: Fix Card Detect and Write Protect on Logic PD SOM-LV
  ARM: dts: OMAP5 / DRA7: indicate that SATA port 0 is available.
  ARM: dts: dra72-evm-revc: fix typo in ethernet-phy node
  soc: ti: wkup_m3_ipc: Fix error return code in wkup_m3_ipc_probe()
  ARM: OMAP1: DMA: Correct the number of logical channels
  ARM: dts: am335x-icev2: Remove the duplicated pinmux setting
  ARM: OMAP2+: Fix WL1283 Bluetooth Baud Rate
Signed-off-by: Olof Johansson <olof@lixom.net>

Signed-off-by: Keith Busch <keith.busch@intel.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Sagi Grimberg <sagi@grimberg.me>
Signed-off-by: Jens Axboe <axboe@fb.com>

Pull UBIFS fixes from Richard Weinberger:
 "This contains fixes for UBIFS:

   - a long standing issue in UBIFS journal replay code

   - fallout from the merge window"

* tag 'upstream-4.10-rc5' of git://git.infradead.org/linux-ubifs:
  ubifs: Fix journal replay wrt. xattr nodes
  ubifs: remove redundant checks for encryption key
  ubifs: allow encryption ioctls in compat mode
  ubifs: add CONFIG_BLOCK dependency for encryption
  ubifs: fix unencrypted journal write
  ubifs: ensure zero err is returned on successful return

A harmless warning just got introduced:

fs/xfs/libxfs/xfs_dir2.h:40:8: error: type qualifiers ignored on function return type [-Werror=ignored-qualifiers]

Removing the 'const' modifier avoids the warning and has no
other effect.

Fixes: 1fc4d33f ("xfs: replace xfs_mode_to_ftype table with switch statement")
Signed-off-by: Arnd Bergmann <arnd@arndb.de>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Darrick J. Wong <darrick.wong@oracle.com>
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.com>

Pull ARM fixes from Russell King:
 "A few ARM fixes:

   - fix a crash while performing TLB maintanence on early ARM SMP cores

   - blacklist Scorpion CPUs for hardware breakpoints

   - ARMs asm/types.h has been included as part of the UAPI due to the
     way the makefiles work, move it to uapi/asm/types.h to make it
     official

   - fix up ftrace syscall name matching"

* 'fixes' of git://git.armlinux.org.uk/~rmk/linux-arm:
  ARM: 8613/1: Fix the uaccess crash on PB11MPCore
  MAINTAINERS: update rmk's entries
  ARM: put types.h in uapi
  ARM: 8634/1: hw_breakpoint: blacklist Scorpion CPUs
  ARM: 8632/1: ftrace: fix syscall name matching

Pull SMP hotplug update from Thomas Gleixner:
 "This contains a trivial typo fix and an extension to the core code for
  dynamically allocating states in the prepare stage.

  The extension is necessary right now because we need a proper way to
  unbreak LTTNG, which iscurrently non functional due to the removal of
  the notifiers. Surely it's out of tree, but it's widely used by
  distros.

  The simple solution would have been to reserve a state for LTTNG, but
  I'm not fond about unused crap in the kernel and the dynamic range,
  which we admittedly should have done right away, allows us to remove
  quite some of the hardcoded states, i.e. those which have no ordering
  requirements. So doing the right thing now is better than having an
  smaller intermediate solution which needs to be reworked anyway"

* 'smp-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  cpu/hotplug: Provide dynamic range for prepare stage
  perf/x86/amd/ibs: Fix typo after cleanup state names in cpu/hotplug

Pull timer fix from Ingo Molnar:
 "Fix a crash in the ARM-Exynos clocksource driver, triggered by CPU
  hotplug operations"

* 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  clocksource/exynos_mct: Clear interrupt when cpu is shut down

Pull RCU fixes from Ingo Molnar:
 "This fixes sporadic ACPI related hangs in synchronize_rcu() that were
  caused by the ACPI code mistakenly relying on an aspect of RCU that
  was neither promised to work nor reliable but which happened to work -
  until in v4.9 we changed the RCU implementation, which made the hangs
  more prominent.

  Since the mis-use of the RCU facility wasn't properly detected and
  prevented either, these fixes make the RCU side work reliably instead
  of working around the problem in the ACPI code.

  Hence the slightly larger diffstat that goes beyond the normal scope
  of RCU fixes in -rc kernels"

* 'rcu-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  rcu: Narrow early boot window of illegal synchronous grace periods
  rcu: Remove cond_resched() from Tiny synchronize_sched()

Pull perf fixes from Ingo Molnar:
 "An Intel PMU driver hotplug fix and three 'perf probe' tooling fixes"

* 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf/x86/intel: Handle exclusive threadid correctly on CPU hotplug
  perf probe: Fix to probe on gcc generated functions in modules
  perf probe: Add error checks to offline probe post-processing
  perf probe: Fix to show correct locations for events on modules

We cannot preserve partial fields for hardware breakpoints, because
the values written by userspace to the hardware breakpoint
registers can't subsequently be recovered intact from the hardware.

So, just reject attempts to write incomplete fields with -EINVAL.

Cc: <stable@vger.kernel.org> # 3.7.x-
Fixes: 478fcb2c ("arm64: Debugging support")
Signed-off-by: Dave Martin <Dave.Martin@arm.com>
Acked-by: Will Deacon <Will.Deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>

This patch adds an explicit __reserved[] field to user_fpsimd_state
to replace what was previously unnamed padding.

This ensures that data in this region are propagated across
assignment rather than being left possibly uninitialised at the
destination.

Cc: <stable@vger.kernel.org> # 3.7.x-
Fixes: 60ffc30d ("arm64: Exception handling")
Signed-off-by: Dave Martin <Dave.Martin@arm.com>
Acked-by: Will Deacon <Will.Deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>

Ensure that if userspace supplies insufficient data to
PTRACE_SETREGSET to fill all the registers, the thread's old
registers are preserved.

Cc: <stable@vger.kernel.org> # 4.3.x-
Fixes: 5d220ff9 ("arm64: Better native ptrace support for compat tasks")
Signed-off-by: Dave Martin <Dave.Martin@arm.com>
Acked-by: Will Deacon <Will.Deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>

Ensure that if userspace supplies insufficient data to
PTRACE_SETREGSET to fill all the registers, the thread's old
registers are preserved.

Cc: <stable@vger.kernel.org> # 3.19.x-
Fixes: 766a85d7 ("arm64: ptrace: add NT_ARM_SYSTEM_CALL regset")
Signed-off-by: Dave Martin <Dave.Martin@arm.com>
Acked-by: Will Deacon <Will.Deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>

Ensure that if userspace supplies insufficient data to
PTRACE_SETREGSET to fill all the registers, the thread's old
registers are preserved.

Cc: <stable@vger.kernel.org> # 3.7.x-
Fixes: 478fcb2c ("arm64: Debugging support")
Signed-off-by: Dave Martin <Dave.Martin@arm.com>
Acked-by: Will Deacon <Will.Deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>

sparse says:

    fs/ceph/mds_client.c:291:23: warning: restricted __le32 degrades to integer
    fs/ceph/mds_client.c:293:28: warning: restricted __le32 degrades to integer
    fs/ceph/mds_client.c:294:28: warning: restricted __le32 degrades to integer
    fs/ceph/mds_client.c:296:28: warning: restricted __le32 degrades to integer

The op value is __le32, so we need to convert it before comparing it.

Cc: stable@vger.kernel.org # needs backporting for < 3.14
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Reviewed-by: Sage Weil <sage@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>

sparse says:

    fs/ceph/inode.c:308:36: warning: incorrect type in argument 1 (different base types)
    fs/ceph/inode.c:308:36:    expected unsigned int [unsigned] [usertype] a
    fs/ceph/inode.c:308:36:    got restricted __le32 [usertype] frag
    fs/ceph/inode.c:308:46: warning: incorrect type in argument 2 (different base types)
    fs/ceph/inode.c:308:46:    expected unsigned int [unsigned] [usertype] b
    fs/ceph/inode.c:308:46:    got restricted __le32 [usertype] frag

We need to convert these values to host-endian before calling the
comparator.

Fixes: a407846e ("ceph: don't assume frag tree splits in mds reply are sorted")
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Reviewed-by: Sage Weil <sage@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>

sparse says:

    fs/ceph/dir.c:1248:50: warning: incorrect type in assignment (different base types)
    fs/ceph/dir.c:1248:50:    expected restricted __le32 [usertype] mask
    fs/ceph/dir.c:1248:50:    got int [signed] [assigned] mask

Fixes: 200fd27c ("ceph: use lookup request to revalidate dentry")
Signed-off-by: Jeff Layton <jlayton@redhat.com>
Reviewed-by: Sage Weil <sage@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>

... otherwise the crypto stack will align it for us with a GFP_ATOMIC
allocation and a memcpy() -- see skcipher_walk_first().
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>

Commit 5c341ee3 ("ceph: fix scheduler warning due to nested
blocking") causes infinite loop when process is interrupted.  Fix it.
Signed-off-by: Yan, Zheng <zyan@redhat.com>
Signed-off-by: Ilya Dryomov <idryomov@gmail.com>