The bounds check for nodeid in ____cache_alloc_node gives false
positives on machines where the node IDs are not contiguous, leading to
a panic at boot time.  For example, on a POWER8 machine the node IDs are
typically 0, 1, 16 and 17.  This means that num_online_nodes() returns
4, so when ____cache_alloc_node is called with nodeid = 16 the VM_BUG_ON
triggers, like this:

  kernel BUG at /home/paulus/kernel/kvm/mm/slab.c:3079!
  Call Trace:
    .____cache_alloc_node+0x5c/0x270 (unreliable)
    .kmem_cache_alloc_node_trace+0xdc/0x360
    .init_list+0x3c/0x128
    .kmem_cache_init+0x1dc/0x258
    .start_kernel+0x2a0/0x568
    start_here_common+0x20/0xa8

To fix this, we instead compare the nodeid with MAX_NUMNODES, and
additionally make sure it isn't negative (since nodeid is an int).  The
check is there mainly to protect the array dereference in the get_node()
call in the next line, and the array being dereferenced is of size
MAX_NUMNODES.  If the nodeid is in range but invalid (for example if the
node is off-line), the BUG_ON in the next line will catch that.

Fixes: 14e50c6a ("mm: slab: Verify the nodeid passed to ____cache_alloc_node")
Signed-off-by: Paul Mackerras <paulus@samba.org>
Reviewed-by: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
Reviewed-by: Pekka Enberg <penberg@kernel.org>
Acked-by: David Rientjes <rientjes@google.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Modules can use this function for creating pool.
Signed-off-by: Michal Simek <michal.simek@xilinx.com>
Acked-by: Lad, Prabhakar <prabhakar.csengg@gmail.com>
Cc: Laura Abbott <lauraa@codeaurora.org>
Cc: Olof Johansson <olof@lixom.net>
Cc: Catalin Marinas <catalin.marinas@arm.com>
Cc: Will Deacon <will.deacon@arm.com>
Cc: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
Cc: Philipp Zabel <p.zabel@pengutronix.de>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Andrew Morton noticed that the error return from anon_vma_clone() was
being dropped and replaced with -ENOMEM (which is not itself a bug
because the only error return value from anon_vma_clone() is -ENOMEM).

I did an audit of callers of anon_vma_clone() and discovered an actual
bug where the error return was being lost.  In __split_vma(), between
Linux 3.11 and 3.12 the code was changed so the err variable is used
before the call to anon_vma_clone() and the default initial value of
-ENOMEM is overwritten.  So a failure of anon_vma_clone() will return
success since err at this point is now zero.

Below is a patch which fixes this bug and also propagates the error
return value from anon_vma_clone() in all cases.

Fixes: ef0855d3 ("mm: mempolicy: turn vma_set_policy() into vma_dup_policy()")
Signed-off-by: Daniel Forrest <dan.forrest@ssec.wisc.edu>
Reviewed-by: Michal Hocko <mhocko@suse.cz>
Cc: Konstantin Khlebnikov <koct9i@gmail.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Rik van Riel <riel@redhat.com>
Cc: Tim Hartrick <tim@edgecast.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Michel Lespinasse <walken@google.com>
Cc: Vlastimil Babka <vbabka@suse.cz>
Cc: <stable@vger.kernel.org>	[3.12+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

I've been seeing swapoff hangs in recent testing: it's cycling around
trying unsuccessfully to find an mm for some remaining pages of swap.

I have been exercising swap and page migration more heavily recently,
and now notice a long-standing error in copy_one_pte(): it's trying to
add dst_mm to swapoff's mmlist when it finds a swap entry, but is doing
so even when it's a migration entry or an hwpoison entry.

Which wouldn't matter much, except it adds dst_mm next to src_mm,
assuming src_mm is already on the mmlist: which may not be so.  Then if
pages are later swapped out from dst_mm, swapoff won't be able to find
where to replace them.

There's already a !non_swap_entry() test for stats: move that up before
the swap_duplicate() and the addition to mmlist.
Signed-off-by: Hugh Dickins <hughd@google.com>
Cc: Kelley Nielsen <kelleynnn@gmail.com>
Cc: <stable@vger.kernel.org>	[2.6.18+]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

a) don't bother with ->d_time for positives - we only check it for
   negatives anyway.

b) make sure to set it at unlink and rmdir time - at *that* point
   soon-to-be negative dentry matches then-current directory contents

c) don't go into renaming of old alias in vfat_lookup() unless it
   has the same parent (which it will, unless we are seeing corrupted
   image)

[hirofumi@mail.parknet.co.jp: make change minimum, don't call d_move() for dir]
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
Cc: <stable@vger.kernel.org>	[3.17.x]
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

ipc_addid() makes a new ipc identifier visible to everyone.  New objects
start as locked, so that the caller can complete the initialization
after the call.  Within struct sem_array, at least sma->sem_base and
sma->sem_nsems are accessed without any locks, therefore this approach
doesn't work.

Thus: Move the ipc_addid() to the end of the initialization.
Signed-off-by: Manfred Spraul <manfred@colorfullife.com>
Reported-by: Rik van Riel <riel@redhat.com>
Acked-by: Rik van Riel <riel@redhat.com>
Acked-by: Davidlohr Bueso <dave@stgolabs.net>
Acked-by: Rafael Aquini <aquini@redhat.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

If kzalloc() failed and then evdev_open_device() fails, evdev_open()
will pass a vmalloc'ed pointer to kfree.

This might fix https://bugzilla.kernel.org/show_bug.cgi?id=88401, where
there was a crash in kfree().
Reported-by: Christian Casteyde <casteyde.christian@free.fr>
Belatedly-Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
Cc: Henrik Rydberg <rydberg@euromail.se>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

In some android devices, there will be a "divide by zero" exception.
vmpr->scanned could be zero before spin_lock(&vmpr->sr_lock).

Addresses https://bugzilla.kernel.org/show_bug.cgi?id=88051

[akpm@linux-foundation.org: neaten]
Reported-by: ji_ang <ji_ang@163.com>
Cc: Anton Vorontsov <anton.vorontsov@linaro.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

If a frontswap dup-store failed, it should invalidate the expired page
in the backend, or it could trigger some data corruption issue.
Such as:
 1. use zswap as the frontswap backend with writeback feature
 2. store a swap page(version_1) to entry A, success
 3. dup-store a newer page(version_2) to the same entry A, fail
 4. use __swap_writepage() write version_2 page to swapfile, success
 5. zswap do shrink, writeback version_1 page to swapfile
 6. version_2 page is overwrited by version_1, data corrupt.

This patch fixes this issue by invalidating expired data immediately
when meet a dup-store failure.
Signed-off-by: Weijie Yang <weijie.yang@samsung.com>
Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Cc: Seth Jennings <sjennings@variantweb.net>
Cc: Dan Streetman <ddstreet@ieee.org>
Cc: Minchan Kim <minchan@kernel.org>
Cc: Bob Liu <bob.liu@oracle.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Minor fixlet to perform the reserved pages counter aggregation for each
node, at show_mem()
Signed-off-by: Rafael Aquini <aquini@redhat.com>
Acked-by: Rik van Riel <riel@redhat.com>
Acked-by: Johannes Weiner <jweiner@redhat.com>
Acked-by: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Pull ext4 bugfix from Ted Ts'o:
 "Fix an ext4 metadata checksum regression introduced in v3.18-rc3"

* tag 'ext4_for_linus_urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
  jbd2: fix regression where we fail to initialize checksum seed when loading

When we're enabling journal features, we cannot use the predicate
jbd2_journal_has_csum_v2or3() because we haven't yet set the sb
feature flag fields!  Moreover, we just finished loading the shash
driver, so the test is unnecessary; calculate the seed always.

Without this patch, we fail to initialize the checksum seed the first
time we turn on journal_checksum, which means that all journal blocks
written during that first mount are corrupt.  Transactions written
after the second mount will be fine, since the feature flag will be
set in the journal superblock.  xfstests generic/{034,321,322} are the
regression tests.

(This is important for 3.18.)
Signed-off-by: Darrick J. Wong <darrick.wong@oracle.coM>
Reported-by: Eric Whitney <enwlinux@gmail.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>

Commit eb7e7d76 "s390: Replace __get_cpu_var uses" broke machine check
handling.

We copy machine check information from per-cpu to a stack variable for
local processing. Next we should zap the per-cpu variable, not the
stack variable.
Signed-off-by: Sebastian Ott <sebott@linux.vnet.ibm.com>
Reviewed-by: Heiko Carstens <heiko.carstens@de.ibm.com>
Acked-by: Christoph Lameter <cl@linux.com>
Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>

Pull drm fixes from Dave Airlie:
 "Two i915 regressions and one dual-gpu laptop radeon fix"

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
  drm/radeon: report disconnected for LVDS/eDP with PX if ddc fails
  drm/i915: Cancel vdd off work before suspend
  drm/i915: Ignore SURFLIVE and flip counter when the GPU gets reset

Don Bailey noticed that our page zeroing for compression at end-io time
isn't complete.  This reworks a patch from Linus to push the zeroing
into the zlib and lzo specific functions instead of trying to handle the
corners inside btrfs_decompress_buf2page
Signed-off-by: Chris Mason <clm@fb.com>
Reviewed-by: Josef Bacik <jbacik@fb.com>
Reported-by: Don A. Bailey <donb@securitymouse.com>
cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Pull irq fixes from Thomas Gleixner:
 "Three fixlets from the ARM SoC camp:
   - correct irqdomain initialization for atmel-aic
   - correct error handling for device tree parsing in bcm controllers"

* 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  irqchip: brcmstb-l2: Fix error handling of irq_of_parse_and_map
  irqchip: bcm7120-l2: Fix error handling of irq_of_parse_and_map
  irqchip: atmel-aic: Fix irqdomain initialization

Pull SCSI fixes from James Bottomley:
 "This is a set of ten fixes: 8 for UFS including four static checker
  warnings, a potential null deref in the voltage regulator code, a race
  on module unload, a ref counting fix on the well known LUNs which made
  it impossible to remove the ufs module and fix to correct the
  information in pwr_info.

  In addition to UFS, there's a blacklist for the Intel Multi-Flex array
  which chokes on report supported operation codes and a fix to an oops
  in bnx2fc caused by shared skbs"

[ For us non-SCSI people: "UFS" here is "Universal Flash Storage" not
  the filesystem.  - Linus ]

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  ufs: fix NULL dereference when no regulators are defined
  ufs: ensure clk gating work is finished before module unloading
  scsi: ufs: fix static checker warning in ufshcd_parse_clock_info
  scsi: ufs: fix static checker warning in __ufshcd_setup_clocks
  scsi: ufs: fix static checker warning in ufshcd_populate_vreg
  scsi: ufs: fix static checker errors in ufshcd_system_suspend
  ufs: fix power info after link start-up
  ufs: fix reference counting of W-LUs
  scsi: add Intel Multi-Flex to scsi scan blacklist
  bnx2fc: do not add shared skbs to the fcoe_rx_list

Pull staging/IIO driver fixes from Greg KH:
 "Here are some staging and IIO driver fixes for 3.18-rc7 that resolve a
  number of reported issues, and a new device id for a staging wireless
  driver.

  All of these have been in linux-next"

* tag 'staging-3.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
  staging: r8188eu: Add new device ID for DLink GO-USB-N150
  staging: r8188eu: Fix scheduling while atomic error introduced in commit fadbe0cd
  iio: accel: bmc150: set low default thresholds
  iio: accel: bmc150: Fix iio_event_spec direction
  iio: accel: bmc150: Send x, y and z motion separately
  iio: accel: bmc150: Error handling when mode set fails
  iio: gyro: bmg160: Fix iio_event_spec direction
  iio: gyro: bmg160: Send x, y and z motion separately
  iio: gyro: bmg160: Don't let interrupt mode to be open drain
  iio: gyro: bmg160: Error handling when mode set fails
  iio: adc: men_z188_adc: Add terminating entry for men_z188_ids
  iio: accel: kxcjk-1013: Fix kxcjk10013_set_range
  iio: Fix IIO_EVENT_CODE_EXTRACT_DIR bit mask

Pull tty/serial fix from Greg KH:
 "Here is a single revert for the of-serial driver that resolves a
  reported issue.

  This revert has been in linux-next for a while"

* tag 'tty-3.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  Revert "serial: of-serial: add PM suspend/resume support"

Pull USB fixes from Greg KH:
 "Here are some USB driver fixes and new device ids for 3.18-rc7.

  Full details are in the shortlog, and all of these have been in the
  linux-next tree for a while"

* tag 'usb-3.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb:
  usb-quirks: Add reset-resume quirk for MS Wireless Laser Mouse 6000
  usb: xhci: rework root port wake bits if controller isn't allowed to wakeup
  USB: xhci: Reset a halted endpoint immediately when we encounter a stall.
  Revert "xhci: clear root port wake on bits if controller isn't wake-up capable"
  USB: xhci: don't start a halted endpoint before its new dequeue is set
  USB: uas: Add no-uas quirk for Hitachi usb-3 enclosures 4971:1012
  USB: ssu100: fix overrun-error reporting
  USB: keyspan: fix overrun-error reporting
  USB: keyspan: fix tty line-status reporting
  usb: serial: ftdi_sio: add PIDs for Matrix Orbital products
  usb: dwc3: ep0: fix for dead code
  USB: serial: cp210x: add IDs for CEL MeshConnect USB Stick

Pull thermal fixes from Eduardo Valentin:
 "In this -rc still very minor changes:

   - Lee Jones fixes compilation warning in sti thermal driver
   - Marjus Elfring removes unnecessary checks in exynos thermal driver
     (as per coccinelle)
   - Now we always update cpufreq policies, and thus get (hopefully)
     always in sync with cpufreq, thanks to Yadwinder"

* 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/evalenti/linux-soc-thermal:
  thermal: Exynos: Deletion of unnecessary checks before two function calls
  thermal: sti: Ignore suspend/resume functions when !PM_SLEEP
  thermal: cpu_cooling: Update always cpufreq policy with thermal constraints

Pull sound fixes from Takashi Iwai:
 "No excitement, here are only minor fixes: an endian fix for the new
  DSD format we added in 3.18, a fix for HP mute LED, and a fix for
  Native Instrument quirk"

* tag 'sound-3.18-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: pcm: Add big-endian DSD sample formats and fix XMOS DSD sample format
  ALSA: hda - One more HP machine needs to change mute led quirk
  ALSA: usb-audio: Use snd_usb_ctl_msg() for Native Instruments quirk

Pull ARM SoC fixes from Arnd Bergmann:
 "Not much interesting going on fixes-wise for us this week, as it
  should be for an -rc7.  I'm not expecting Olof to work much over
  Thanksgiving weekend, so I decided to take over again and push these
  out to you.

  Just four simple fixes this week:

   - one missing of_node_put() on armv7 based mvebu
   - forcing the USB host into the right mode on Chromebook
     (exynos5-snow)
   - enabling two important drivers for exynos_defconfig
   - fixing a noncritical bug for tegra that would cause a regression
     with common code patches queued for 3.19"

* tag 'armsoc-for-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
  ARM: tegra: irq: fix buggy usage of irq_data irq field
  ARM: exynos_defconfig: Enable max77802 rtc and clock drivers
  ARM: dts: Explicitly set dr_mode on exynos5250-snow
  ARM: mvebu: add missing of_node_put() call in coherency.c

Pull ARM fixes from Russell King:
 "Another round of relatively small ARM fixes.

  Thomas spotted that the strex backoff delay bit was a disable bit, so
  it needed to be clear for this to work.  Vladimir spotted that using a
  restart block for the cache flush operation would return -EINTR, which
  userspace was not expecting.  Dmitry spotted that the auxiliary
  control register accesses for Xscale were not correct"

* 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm:
  ARM: 8226/1: cacheflush: get rid of restarting block
  ARM: 8222/1: mvebu: enable strex backoff delay
  ARM: 8216/1: xscale: correct auxiliary register in suspend/resume

Two regression fixes from Ville.

* tag 'drm-intel-fixes-2014-11-27' of git://anongit.freedesktop.org/drm-intel:
  drm/i915: Cancel vdd off work before suspend
  drm/i915: Ignore SURFLIVE and flip counter when the GPU gets reset

Pull mips fixes from Ralf Baechle:
 "The hopefully final round of fixes for 3.18:

   - Fix a number of build errors affecting particular configurations.
   - Handle EVA correctly when flushing a signal trampoline and dcache
     lines.
   - Fix printks printing jibberish.
   - Handle 64 bit memory addresses correctly when adding memory chunk
     on 32 bit kernels.
   - Fix a race condition in the hardware tablewalker code"

* 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus:
  MIPS: tlbex: Fix potential HTW race on TLBL/M/S handlers
  MIPS: Fix address type used for early memory detection.
  MIPS: Kconfig: Don't allow both microMIPS and SmartMIPS to be selected.
  MIPS: kernel: cps-vec: Set ISA level to mips32r2 for the MIPS MT ASE
  MIPS: Netlogic: handle modular AHCI builds
  MIPS: Netlogic: handle modular USB case
  MIPS: Loongson: Make platform serial setup always built-in.
  MIPS: fix EVA & non-SMP non-FPU FP context signal handling
  MIPS: cpu-probe: Set the FTLB probability bit on supported cores
  MIPS: BMIPS: Fix ".previous without corresponding .section" warnings
  MIPS: uaccess.h: Fix strnlen_user comment.
  MIPS: r4kcache: Add EVA case for protected_writeback_dcache_line
  MIPS: Fix info about plat_setup in arch_mem_init comment
  MIPS: rtlx: Remove KERN_DEBUG from pr_debug() arguments in rtlx.c
  MIPS: SEAD3: Fix LED device registration.
  MIPS: Fix a copy & paste error in unistd.h

Pull powerpc fixes from Michael Ellerman:
 "Here are five fixes for you to pull please.

  They're all CC'ed to stable except the "Fix PE state format" one which
  went in this release"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mpe/linux:
  powerpc: 32 bit getcpu VDSO function uses 64 bit instructions
  powerpc/powernv: Replace OPAL_DEASSERT_RESET with EEH_RESET_DEACTIVATE
  powerpc/eeh: Fix PE state format
  powerpc/pseries: Fix endiannes issue in RTAS call from xmon
  powerpc/powernv: Fix the hmi event version check.

Pull sparc fixlet from David Miller:
 "Aparc fix to add dma_cache_sync(), even if a nop it should be provided
  if dma_{alloc,free}_noncoherent() is provided too"

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/sparc:
  sparc: Add NOP dma_cache_sync() implementation.

Pull networking fixes from David Miller:
 "Several small fixes here:

   1) Don't crash in tg3 driver when the number of tx queues has been
      configured to be different from the number of rx queues.  From
      Thadeu Lima de Souza Cascardo.

   2) VLAN filter not disabled properly in promisc mode in ixgbe driver,
      from Vlad Yasevich.

   3) Fix OOPS on dellink op in VTI tunnel driver, from Xin Long.

   4) IPV6 GRE driver WCCP code checks skb->protocol for ETH_P_IP
      instead of ETH_P_IPV6, whoops.  From Yuri Chislov.

   5) Socket matching in ping driver is buggy when packet AF does not
      match socket's AF.  Fix from Jane Zhou.

   6) Fix checksum calculation errors in VXLAN due to where the
      udp_tunnel6_xmit_skb() helper gets it's saddr/daddr from.  From
      Alexander Duyck.

   7) Fix 5G detection problem in rtlwifi driver, from Larry Finger.

   8) Fix NULL deref in tcp_v{4,6}_send_reset, from Eric Dumazet.

   9) Various missing netlink attribute verifications in bridging code,
      from Thomas Graf.

  10) tcp_recvmsg() unconditionally calls ipv4 ip_recv_error even for
      ipv6 sockets, whoops.  Fix from Willem de Bruijn"

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (29 commits)
  net-timestamp: make tcp_recvmsg call ipv6_recv_error for AF_INET6 socks
  bridge: Sanitize IFLA_EXT_MASK for AF_BRIDGE:RTM_GETLINK
  bridge: Add missing policy entry for IFLA_BRPORT_FAST_LEAVE
  net: Check for presence of IFLA_AF_SPEC
  net: Validate IFLA_BRIDGE_MODE attribute length
  bridge: Validate IFLA_BRIDGE_FLAGS attribute length
  stmmac: platform: fix default values of the filter bins setting
  net/mlx4_core: Limit count field to 24 bits in qp_alloc_res
  net: dsa: bcm_sf2: reset switch prior to initialization
  net: dsa: bcm_sf2: fix unmapping registers in case of errors
  tg3: fix ring init when there are more TX than RX channels
  tcp: fix possible NULL dereference in tcp_vX_send_reset()
  rtlwifi: Change order in device startup
  rtlwifi: rtl8821ae: Fix 5G detection problem
  Revert "netfilter: conntrack: fix race in __nf_conntrack_confirm against get_next_corpse"
  vxlan: Fix boolean flip in VXLAN_F_UDP_ZERO_CSUM6_[TX|RX]
  ip6_udp_tunnel: Fix checksum calculation
  net-timestamp: Fix a documentation typo
  net/ping: handle protocol mismatching scenario
  af_packet: fix sparse warning
  ...

Pull spi fixes from Mark Brown:
 "There's a couple of driver fixes here, plus one core fix for the DMA
  mapping which wasn't doing the right thing for vmalloc()ed addresses
  that hadn't been through kmap().  It's fairly rare to use vmalloc()
  with SPI and it's a subset of those users who might fail so it's
  unsurprising that this wasn't noticed sooner"

* tag 'spi-v3.18-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: sirf: fix word width configuration
  spi: Fix mapping from vmalloc-ed buffer to scatter list
  spi: dw: Fix dynamic speed change.

Pull input layer fixes from Dmitry Torokhov:
 "The main change is to fix breakage in Elantech driver introduced by
  the recent commit adding trackpoint reporting to protocol v4.  Now we
  are trusting the hardware to advertise the trackpoint properly and do
  not try to decode the data as trackpoint if firmware told us it is not
  present"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: xpad - use proper endpoint type
  Input: elantech - trust firmware about trackpoint presence
  Input: synaptics - adjust min/max on Thinkpad E540

The DLink GO-USB-N150 with revision B1 uses this driver.
Signed-off-by: Larry Finger <Larry.Finger@lwfinger.net>
Cc: stable <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

There is a potential race when probing the TLB in TLBL/M/S exception
handlers for a matching entry. Between the time we hit a TLBL/S/M
exception and the time we get to execute the TLBP instruction, the
HTW may have replaced the TLB entry we are interested in hence the TLB
probe may fail. However, in the existing handlers, we never checked the
status of the TLBP (ie check the result in the C0/Index register). We
fix this by adding such a check when the core implements the HTW. If
we couldn't find a matching entry, we return back and try again.
Signed-off-by: Leonid Yegoshin <Leonid.Yegoshin@imgtec.com>
Signed-off-by: Markos Chandras <markos.chandras@imgtec.com>
Reviewed-by: James Hogan <james.hogan@imgtec.com>
Cc: <stable@vger.kernel.org> # v3.17+
Cc: linux-mips@linux-mips.org
Patchwork: https://patchwork.linux-mips.org/patch/8599/Signed-off-by: Ralf Baechle <ralf@linux-mips.org>

We cannot restart cacheflush safely if a process provides user-defined
signal handler and signal is pending. In this case -EINTR is returned
and it is expected that process re-invokes syscall. However, there are
a few problems with that:
 * looks like nobody bothers checking return value from cacheflush
 * but if it did, we don't provide the restart address for that, so the
   process has to use the same range again
 * ...and again, what might lead to looping forever

So, remove cacheflush restarting code and terminate cache flushing
as early as fatal signal is pending.

Cc: stable@vger.kernel.org # 3.12+
Reported-by: Chanho Min <chanho.min@lge.com>
Signed-off-by: Vladimir Murzin <vladimir.murzin@arm.com>
Acked-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Under extremely rare conditions, in an MPCore node consisting of at
least 3 CPUs, two CPUs trying to perform a STREX to data on the same
shared cache line can enter a livelock situation.

This patch enables the HW mechanism that overcomes the bug. This fixes
the incorrect setup of the STREX backoff delay bit due to a wrong
description in the specification.

Note that enabling the STREX backoff delay mechanism is done by
leaving the bit *cleared*, while the bit was currently being set by
the proc-v7.S code.

[Thomas: adapt to latest mainline, slightly reword the commit log, add
stable markers.]

Fixes: de490193 ("arm: mm: Add support for PJ4B cpu and init routines")

Cc: <stable@vger.kernel.org> # v3.8+
Signed-off-by: Nadav Haklai <nadavh@marvell.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@free-electrons.com>
Acked-by: Gregory CLEMENT <gregory.clement@free-electrons.com>
Acked-by: Jason Cooper <jason@lakedaemon.net>
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>

Pull "mvebu fixes for v3.18 (round 2)" frm Jason Cooper:

 - mvebu
    - coherency.c needed an of_node_put()

* tag 'mvebu-fixes-3.18-2' of git://git.infradead.org/linux-mvebu:
  ARM: mvebu: add missing of_node_put() call in coherency.c
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

Merge tag 'samsung-defconfig-v3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung into fixes

Pull "Samsung defconfig update for v3.18" from Kukjin Kim:

- enable max77802 rtc and clock drivers for exynos_defconfig
  : enable the kernel config options to have the drivers for
    max77802 including rtc and 2-ch 32kHz clock outputs

* tag 'samsung-defconfig-v3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung:
  ARM: exynos_defconfig: Enable max77802 rtc and clock drivers
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

Merge tag 'samsung-fixes-v3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung into fixes

Pull "Samsung fixes for v3.18" from Kukjin Kim:

- explicitly set dr_mode on exynos5250-snow
  this is required when kernel is built with USB gadget support.

* tag 'samsung-fixes-v3.18' of git://git.kernel.org/pub/scm/linux/kernel/git/kgene/linux-samsung:
  ARM: dts: Explicitly set dr_mode on exynos5250-snow
Signed-off-by: Arnd Bergmann <arnd@arndb.de>

The crazy gic_arch_extn thing that Tegra uses contains multiple
references to the irq field in struct irq_data, and uses this
to directly poke hardware register.

But irq is the *virtual* irq number, something that has nothing
to do with the actual HW irq (stored in the hwirq field). And once
we put the stacked domain code in action, the whole thing explodes,
as these two values are *very* different:

root@bacon-fat:~# cat /proc/interrupts
            CPU0       CPU1
 16:      25801       2075       GIC  29  twd
 17:          0          0       GIC  73  timer0
112:          0          0      GPIO  58  c8000600.sdhci cd
123:          0          0      GPIO  69  c8000200.sdhci cd
279:       1126          0       GIC 122  serial
281:          0          0       GIC  70  7000c000.i2c
282:          0          0       GIC 116  7000c400.i2c
283:          0          0       GIC 124  7000c500.i2c
284:        300          0       GIC  85  7000d000.i2c
[...]

Just replacing all instances of irq with hwirq fixes the issue.
Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
Acked-by: Thierry Reding <treding@nvidia.com>
Signed-off-by: Arnd Bergmann <arnd@arndb.de>