--- /dev/null
+From 683d0e126232d898a481daa3a4ca032c2b1a9660 Mon Sep 17 00:00:00 2001
+From: David Hildenbrand <dahi@linux.vnet.ibm.com>
+Date: Thu, 18 Sep 2014 11:04:31 +0200
+Subject: blk-mq: Avoid race condition with uninitialized requests
+
+From: David Hildenbrand <dahi@linux.vnet.ibm.com>
+
+commit 683d0e126232d898a481daa3a4ca032c2b1a9660 upstream.
+
+This patch should fix the bug reported in
+https://lkml.org/lkml/2014/9/11/249.
+
+We have to initialize at least the atomic_flags and the cmd_flags when
+allocating storage for the requests.
+
+Otherwise blk_mq_timeout_check() might dereference uninitialized
+pointers when racing with the creation of a request.
+
+Also move the reset of cmd_flags for the initializing code to the point
+where a request is freed. So we will never end up with pending flush
+request indicators that might trigger dereferences of invalid pointers
+in blk_mq_timeout_check().
+
+Signed-off-by: David Hildenbrand <dahi@linux.vnet.ibm.com>
+Reported-by: Paulo De Rezende Pinatti <ppinatti@linux.vnet.ibm.com>
+Tested-by: Paulo De Rezende Pinatti <ppinatti@linux.vnet.ibm.com>
+Acked-by: Christian Borntraeger <borntraeger@de.ibm.com>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ block/blk-mq.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/block/blk-mq.c
++++ b/block/blk-mq.c
+@@ -219,7 +219,6 @@ __blk_mq_alloc_request(struct blk_mq_all
+ if (tag != BLK_MQ_TAG_FAIL) {
+ rq = data->hctx->tags->rqs[tag];
+
+- rq->cmd_flags = 0;
+ if (blk_mq_tag_busy(data->hctx)) {
+ rq->cmd_flags = REQ_MQ_INFLIGHT;
+ atomic_inc(&data->hctx->nr_active);
+@@ -274,6 +273,7 @@ static void __blk_mq_free_request(struct
+
+ if (rq->cmd_flags & REQ_MQ_INFLIGHT)
+ atomic_dec(&hctx->nr_active);
++ rq->cmd_flags = 0;
+
+ clear_bit(REQ_ATOM_STARTED, &rq->atomic_flags);
+ blk_mq_put_tag(hctx, tag, &ctx->last_tag);
+@@ -1411,6 +1411,8 @@ static struct blk_mq_tags *blk_mq_init_r
+ left -= to_do * rq_size;
+ for (j = 0; j < to_do; j++) {
+ tags->rqs[i] = p;
++ tags->rqs[i]->atomic_flags = 0;
++ tags->rqs[i]->cmd_flags = 0;
+ if (set->ops->init_request) {
+ if (set->ops->init_request(set->driver_data,
+ tags->rqs[i], hctx_idx, i,
--- /dev/null
+From 8e30444e153008e8eb3e74cbcb7a865bfcfb04a0 Mon Sep 17 00:00:00 2001
+From: Lan Tianyu <tianyu.lan@intel.com>
+Date: Thu, 18 Sep 2014 15:03:07 +0800
+Subject: cpufreq: fix cpufreq suspend/resume for intel_pstate
+
+From: Lan Tianyu <tianyu.lan@intel.com>
+
+commit 8e30444e153008e8eb3e74cbcb7a865bfcfb04a0 upstream.
+
+Cpufreq core introduces cpufreq_suspended flag to let cpufreq sysfs nodes
+across S2RAM/S2DISK. But the flag is only set in the cpufreq_suspend()
+for cpufreq drivers which have target or target_index callback. This
+skips intel_pstate driver. This patch is to set the flag before checking
+target or target_index callback.
+
+Fixes: 2f0aea936360 (cpufreq: suspend governors on system suspend/hibernate)
+Signed-off-by: Lan Tianyu <tianyu.lan@intel.com>
+[rjw: Subject]
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/cpufreq.c | 8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -1666,6 +1666,8 @@ void cpufreq_suspend(void)
+ if (!cpufreq_driver)
+ return;
+
++ cpufreq_suspended = true;
++
+ if (!has_target())
+ return;
+
+@@ -1680,8 +1682,6 @@ void cpufreq_suspend(void)
+ pr_err("%s: Failed to suspend driver: %p\n", __func__,
+ policy);
+ }
+-
+- cpufreq_suspended = true;
+ }
+
+ /**
+@@ -1697,13 +1697,13 @@ void cpufreq_resume(void)
+ if (!cpufreq_driver)
+ return;
+
++ cpufreq_suspended = false;
++
+ if (!has_target())
+ return;
+
+ pr_debug("%s: Resuming Governors\n", __func__);
+
+- cpufreq_suspended = false;
+-
+ list_for_each_entry(policy, &cpufreq_policy_list, policy_list) {
+ if (cpufreq_driver->resume && cpufreq_driver->resume(policy))
+ pr_err("%s: Failed to resume driver: %p\n", __func__,
--- /dev/null
+From 7106e02baed4a72fb23de56b02ad4d31daa74d95 Mon Sep 17 00:00:00 2001
+From: Prarit Bhargava <prarit@redhat.com>
+Date: Wed, 10 Sep 2014 10:12:08 -0400
+Subject: cpufreq: release policy->rwsem on error
+
+From: Prarit Bhargava <prarit@redhat.com>
+
+commit 7106e02baed4a72fb23de56b02ad4d31daa74d95 upstream.
+
+While debugging a cpufreq-related hardware failure on a system I saw the
+following lockdep warning:
+
+ =========================
+ [ BUG: held lock freed! ] 3.17.0-rc4+ #1 Tainted: G E
+ -------------------------
+ insmod/2247 is freeing memory ffff88006e1b1400-ffff88006e1b17ff, with a lock still held there!
+ (&policy->rwsem){+.+...}, at: [<ffffffff8156d37d>] __cpufreq_add_dev.isra.21+0x47d/0xb80
+ 3 locks held by insmod/2247:
+ #0: (subsys mutex#5){+.+.+.}, at: [<ffffffff81485579>] subsys_interface_register+0x69/0x120
+ #1: (cpufreq_rwsem){.+.+.+}, at: [<ffffffff8156cf73>] __cpufreq_add_dev.isra.21+0x73/0xb80
+ #2: (&policy->rwsem){+.+...}, at: [<ffffffff8156d37d>] __cpufreq_add_dev.isra.21+0x47d/0xb80
+
+ stack backtrace:
+ CPU: 0 PID: 2247 Comm: insmod Tainted: G E 3.17.0-rc4+ #1
+ Hardware name: HP ProLiant MicroServer Gen8, BIOS J06 08/24/2013
+ 0000000000000000 000000008f3063c4 ffff88006f87bb30 ffffffff8171b358
+ ffff88006bcf3750 ffff88006f87bb68 ffffffff810e09e1 ffff88006e1b1400
+ ffffea0001b86c00 ffffffff8156d327 ffff880073003500 0000000000000246
+ Call Trace:
+ [<ffffffff8171b358>] dump_stack+0x4d/0x66
+ [<ffffffff810e09e1>] debug_check_no_locks_freed+0x171/0x180
+ [<ffffffff8156d327>] ? __cpufreq_add_dev.isra.21+0x427/0xb80
+ [<ffffffff8121412b>] kfree+0xab/0x2b0
+ [<ffffffff8156d327>] __cpufreq_add_dev.isra.21+0x427/0xb80
+ [<ffffffff81724cf7>] ? _raw_spin_unlock+0x27/0x40
+ [<ffffffffa003517f>] ? pcc_cpufreq_do_osc+0x17f/0x17f [pcc_cpufreq]
+ [<ffffffff8156da8e>] cpufreq_add_dev+0xe/0x10
+ [<ffffffff814855d1>] subsys_interface_register+0xc1/0x120
+ [<ffffffff8156bcf2>] cpufreq_register_driver+0x112/0x340
+ [<ffffffff8121415a>] ? kfree+0xda/0x2b0
+ [<ffffffffa003517f>] ? pcc_cpufreq_do_osc+0x17f/0x17f [pcc_cpufreq]
+ [<ffffffffa003562e>] pcc_cpufreq_init+0x4af/0xe81 [pcc_cpufreq]
+ [<ffffffffa003517f>] ? pcc_cpufreq_do_osc+0x17f/0x17f [pcc_cpufreq]
+ [<ffffffff81002144>] do_one_initcall+0xd4/0x210
+ [<ffffffff811f7472>] ? __vunmap+0xd2/0x120
+ [<ffffffff81127155>] load_module+0x1315/0x1b70
+ [<ffffffff811222a0>] ? store_uevent+0x70/0x70
+ [<ffffffff811229d9>] ? copy_module_from_fd.isra.44+0x129/0x180
+ [<ffffffff81127b86>] SyS_finit_module+0xa6/0xd0
+ [<ffffffff81725b69>] system_call_fastpath+0x16/0x1b
+ cpufreq: __cpufreq_add_dev: ->get() failed
+insmod: ERROR: could not insert module pcc-cpufreq.ko: No such device
+
+The warning occurs in the __cpufreq_add_dev() code which does
+
+ down_write(&policy->rwsem);
+ ...
+ if (cpufreq_driver->get && !cpufreq_driver->setpolicy) {
+ policy->cur = cpufreq_driver->get(policy->cpu);
+ if (!policy->cur) {
+ pr_err("%s: ->get() failed\n", __func__);
+ goto err_get_freq;
+ }
+
+If cpufreq_driver->get(policy->cpu) returns an error we execute the
+code at err_get_freq, which does not up the policy->rwsem. This causes
+the lockdep warning.
+
+Trivial patch to up the policy->rwsem in the error path.
+
+After the patch has been applied, and an error occurs in the
+cpufreq_driver->get(policy->cpu) call we will now see
+
+cpufreq: __cpufreq_add_dev: ->get() failed
+cpufreq: __cpufreq_add_dev: ->get() failed
+modprobe: ERROR: could not insert 'pcc_cpufreq': No such device
+
+Fixes: 4e97b631f24c (cpufreq: Initialize governor for a new policy under policy->rwsem)
+Signed-off-by: Prarit Bhargava <prarit@redhat.com>
+Acked-by: Viresh Kumar <viresh.kumar@linaro.org>
+Signed-off-by: Rafael J. Wysocki <rafael.j.wysocki@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/cpufreq/cpufreq.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/cpufreq/cpufreq.c
++++ b/drivers/cpufreq/cpufreq.c
+@@ -1279,6 +1279,8 @@ err_get_freq:
+ per_cpu(cpufreq_cpu_data, j) = NULL;
+ write_unlock_irqrestore(&cpufreq_driver_lock, flags);
+
++ up_write(&policy->rwsem);
++
+ if (cpufreq_driver->exit)
+ cpufreq_driver->exit(policy);
+ err_set_policy_cpu:
--- /dev/null
+From c9f21cb6388898bfe69886d001316dae7ecc9a4b Mon Sep 17 00:00:00 2001
+From: Tom Lendacky <thomas.lendacky@amd.com>
+Date: Fri, 5 Sep 2014 10:31:09 -0500
+Subject: crypto: ccp - Check for CCP before registering crypto algs
+
+From: Tom Lendacky <thomas.lendacky@amd.com>
+
+commit c9f21cb6388898bfe69886d001316dae7ecc9a4b upstream.
+
+If the ccp is built as a built-in module, then ccp-crypto (whether
+built as a module or a built-in module) will be able to load and
+it will register its crypto algorithms. If the system does not have
+a CCP this will result in -ENODEV being returned whenever a command
+is attempted to be queued by the registered crypto algorithms.
+
+Add an API, ccp_present(), that checks for the presence of a CCP
+on the system. The ccp-crypto module can use this to determine if it
+should register it's crypto alogorithms.
+
+Reported-by: Scot Doyle <lkml14@scotdoyle.com>
+Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
+Tested-by: Scot Doyle <lkml14@scotdoyle.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/crypto/ccp/ccp-crypto-main.c | 4 ++++
+ drivers/crypto/ccp/ccp-dev.c | 14 ++++++++++++++
+ include/linux/ccp.h | 12 ++++++++++++
+ 3 files changed, 30 insertions(+)
+
+--- a/drivers/crypto/ccp/ccp-crypto-main.c
++++ b/drivers/crypto/ccp/ccp-crypto-main.c
+@@ -367,6 +367,10 @@ static int ccp_crypto_init(void)
+ {
+ int ret;
+
++ ret = ccp_present();
++ if (ret)
++ return ret;
++
+ spin_lock_init(&req_queue_lock);
+ INIT_LIST_HEAD(&req_queue.cmds);
+ req_queue.backlog = &req_queue.cmds;
+--- a/drivers/crypto/ccp/ccp-dev.c
++++ b/drivers/crypto/ccp/ccp-dev.c
+@@ -53,6 +53,20 @@ static inline void ccp_del_device(struct
+ }
+
+ /**
++ * ccp_present - check if a CCP device is present
++ *
++ * Returns zero if a CCP device is present, -ENODEV otherwise.
++ */
++int ccp_present(void)
++{
++ if (ccp_get_device())
++ return 0;
++
++ return -ENODEV;
++}
++EXPORT_SYMBOL_GPL(ccp_present);
++
++/**
+ * ccp_enqueue_cmd - queue an operation for processing by the CCP
+ *
+ * @cmd: ccp_cmd struct to be processed
+--- a/include/linux/ccp.h
++++ b/include/linux/ccp.h
+@@ -27,6 +27,13 @@ struct ccp_cmd;
+ defined(CONFIG_CRYPTO_DEV_CCP_DD_MODULE)
+
+ /**
++ * ccp_present - check if a CCP device is present
++ *
++ * Returns zero if a CCP device is present, -ENODEV otherwise.
++ */
++int ccp_present(void);
++
++/**
+ * ccp_enqueue_cmd - queue an operation for processing by the CCP
+ *
+ * @cmd: ccp_cmd struct to be processed
+@@ -53,6 +60,11 @@ int ccp_enqueue_cmd(struct ccp_cmd *cmd)
+
+ #else /* CONFIG_CRYPTO_DEV_CCP_DD is not enabled */
+
++static inline int ccp_present(void)
++{
++ return -ENODEV;
++}
++
+ static inline int ccp_enqueue_cmd(struct ccp_cmd *cmd)
+ {
+ return -ENODEV;
--- /dev/null
+From f2d5a94436cc7cc0221b9a81bba2276a25187dd3 Mon Sep 17 00:00:00 2001
+From: Anton Altaparmakov <aia21@cam.ac.uk>
+Date: Mon, 22 Sep 2014 01:53:03 +0100
+Subject: Fix nasty 32-bit overflow bug in buffer i/o code.
+
+From: Anton Altaparmakov <aia21@cam.ac.uk>
+
+commit f2d5a94436cc7cc0221b9a81bba2276a25187dd3 upstream.
+
+On 32-bit architectures, the legacy buffer_head functions are not always
+handling the sector number with the proper 64-bit types, and will thus
+fail on 4TB+ disks.
+
+Any code that uses __getblk() (and thus bread(), breadahead(),
+sb_bread(), sb_breadahead(), sb_getblk()), and calls it using a 64-bit
+block on a 32-bit arch (where "long" is 32-bit) causes an inifinite loop
+in __getblk_slow() with an infinite stream of errors logged to dmesg
+like this:
+
+ __find_get_block_slow() failed. block=6740375944, b_blocknr=2445408648
+ b_state=0x00000020, b_size=512
+ device sda1 blocksize: 512
+
+Note how in hex block is 0x191C1F988 and b_blocknr is 0x91C1F988 i.e. the
+top 32-bits are missing (in this case the 0x1 at the top).
+
+This is because grow_dev_page() is broken and has a 32-bit overflow due
+to shifting the page index value (a pgoff_t - which is just 32 bits on
+32-bit architectures) left-shifted as the block number. But the top
+bits to get lost as the pgoff_t is not type cast to sector_t / 64-bit
+before the shift.
+
+This patch fixes this issue by type casting "index" to sector_t before
+doing the left shift.
+
+Note this is not a theoretical bug but has been seen in the field on a
+4TiB hard drive with logical sector size 512 bytes.
+
+This patch has been verified to fix the infinite loop problem on 3.17-rc5
+kernel using a 4TB disk image mounted using "-o loop". Without this patch
+doing a "find /nt" where /nt is an NTFS volume causes the inifinite loop
+100% reproducibly whilst with the patch it works fine as expected.
+
+Signed-off-by: Anton Altaparmakov <aia21@cantab.net>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/buffer.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/fs/buffer.c
++++ b/fs/buffer.c
+@@ -1029,7 +1029,8 @@ grow_dev_page(struct block_device *bdev,
+ bh = page_buffers(page);
+ if (bh->b_size == size) {
+ end_block = init_page_buffers(page, bdev,
+- index << sizebits, size);
++ (sector_t)index << sizebits,
++ size);
+ goto done;
+ }
+ if (!try_to_free_buffers(page))
+@@ -1050,7 +1051,8 @@ grow_dev_page(struct block_device *bdev,
+ */
+ spin_lock(&inode->i_mapping->private_lock);
+ link_dev_buffers(page, bh);
+- end_block = init_page_buffers(page, bdev, index << sizebits, size);
++ end_block = init_page_buffers(page, bdev, (sector_t)index << sizebits,
++ size);
+ spin_unlock(&inode->i_mapping->private_lock);
+ done:
+ ret = (block < end_block) ? 1 : -ENXIO;
--- /dev/null
+From 77639ff2b3404a913b8037d230a384798b854bae Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hverkuil@xs4all.nl>
+Date: Fri, 12 Sep 2014 06:02:02 -0300
+Subject: media: adv7604: fix inverted condition
+
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+commit 77639ff2b3404a913b8037d230a384798b854bae upstream.
+
+The log_status function should show HDMI information, but the test checking for
+an HDMI input was inverted. Fix this.
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/i2c/adv7604.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/adv7604.c
++++ b/drivers/media/i2c/adv7604.c
+@@ -2325,7 +2325,7 @@ static int adv7604_log_status(struct v4l
+ v4l2_info(sd, "HDCP keys read: %s%s\n",
+ (hdmi_read(sd, 0x04) & 0x20) ? "yes" : "no",
+ (hdmi_read(sd, 0x04) & 0x10) ? "ERROR" : "");
+- if (!is_hdmi(sd)) {
++ if (is_hdmi(sd)) {
+ bool audio_pll_locked = hdmi_read(sd, 0x04) & 0x01;
+ bool audio_sample_packet_detect = hdmi_read(sd, 0x18) & 0x01;
+ bool audio_mute = io_read(sd, 0x65) & 0x40;
--- /dev/null
+From 9dc0f3fe3fe6b83b44e5920a0b143b4f96755b59 Mon Sep 17 00:00:00 2001
+From: Antti Palosaari <crope@iki.fi>
+Date: Sat, 9 Aug 2014 01:03:14 -0300
+Subject: media: af9033: feed clock to RF tuner
+
+From: Antti Palosaari <crope@iki.fi>
+
+commit 9dc0f3fe3fe6b83b44e5920a0b143b4f96755b59 upstream.
+
+IT9135 RF tuner clock is coming from demodulator. We need enable it
+early in demod init, before any tuner I/O. Currently it is enabled
+by tuner driver itself, but it is too late and performance will be
+reduced as some registers are not updated correctly. Clock is
+disabled automatically when demod is put onto sleep.
+
+Cc: Bimow Chen <Bimow.Chen@ite.com.tw>
+Signed-off-by: Antti Palosaari <crope@iki.fi>
+Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/dvb-frontends/af9033.c | 13 +++++++++++++
+ 1 file changed, 13 insertions(+)
+
+--- a/drivers/media/dvb-frontends/af9033.c
++++ b/drivers/media/dvb-frontends/af9033.c
+@@ -314,6 +314,19 @@ static int af9033_init(struct dvb_fronte
+ goto err;
+ }
+
++ /* feed clock to RF tuner */
++ switch (state->cfg.tuner) {
++ case AF9033_TUNER_IT9135_38:
++ case AF9033_TUNER_IT9135_51:
++ case AF9033_TUNER_IT9135_52:
++ case AF9033_TUNER_IT9135_60:
++ case AF9033_TUNER_IT9135_61:
++ case AF9033_TUNER_IT9135_62:
++ ret = af9033_wr_reg(state, 0x80fba8, 0x00);
++ if (ret < 0)
++ goto err;
++ }
++
+ /* settings for TS interface */
+ if (state->cfg.ts_mode == AF9033_TS_MODE_USB) {
+ ret = af9033_wr_reg_mask(state, 0x80f9a5, 0x00, 0x01);
--- /dev/null
+From 0df6580c5fc115034de29aa52af5cf6bd83d37d8 Mon Sep 17 00:00:00 2001
+From: Bimow Chen <Bimow.Chen@ite.com.tw>
+Date: Mon, 4 Aug 2014 23:31:46 -0300
+Subject: media: af9033: update IT9135 tuner inittabs
+
+From: Bimow Chen <Bimow.Chen@ite.com.tw>
+
+commit 0df6580c5fc115034de29aa52af5cf6bd83d37d8 upstream.
+
+Update IT9135 BX tuner config 60 and 61 inittabs.
+
+[crope@iki.fi: removed two reg writes from driver init itself]
+Signed-off-by: Bimow Chen <Bimow.Chen@ite.com.tw>
+Signed-off-by: Antti Palosaari <crope@iki.fi>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
+
+---
+ drivers/media/dvb-frontends/af9033_priv.h | 20 +++++++++-----------
+ 1 file changed, 9 insertions(+), 11 deletions(-)
+
+--- a/drivers/media/dvb-frontends/af9033_priv.h
++++ b/drivers/media/dvb-frontends/af9033_priv.h
+@@ -1418,7 +1418,7 @@ static const struct reg_val tuner_init_i
+ { 0x800068, 0x0a },
+ { 0x80006a, 0x03 },
+ { 0x800070, 0x0a },
+- { 0x800071, 0x05 },
++ { 0x800071, 0x0a },
+ { 0x800072, 0x02 },
+ { 0x800075, 0x8c },
+ { 0x800076, 0x8c },
+@@ -1484,7 +1484,6 @@ static const struct reg_val tuner_init_i
+ { 0x800104, 0x02 },
+ { 0x800105, 0xbe },
+ { 0x800106, 0x00 },
+- { 0x800109, 0x02 },
+ { 0x800115, 0x0a },
+ { 0x800116, 0x03 },
+ { 0x80011a, 0xbe },
+@@ -1510,7 +1509,6 @@ static const struct reg_val tuner_init_i
+ { 0x80014b, 0x8c },
+ { 0x80014d, 0xac },
+ { 0x80014e, 0xc6 },
+- { 0x80014f, 0x03 },
+ { 0x800151, 0x1e },
+ { 0x800153, 0xbc },
+ { 0x800178, 0x09 },
+@@ -1522,9 +1520,10 @@ static const struct reg_val tuner_init_i
+ { 0x80018d, 0x5f },
+ { 0x80018f, 0xa0 },
+ { 0x800190, 0x5a },
+- { 0x80ed02, 0xff },
+- { 0x80ee42, 0xff },
+- { 0x80ee82, 0xff },
++ { 0x800191, 0x00 },
++ { 0x80ed02, 0x40 },
++ { 0x80ee42, 0x40 },
++ { 0x80ee82, 0x40 },
+ { 0x80f000, 0x0f },
+ { 0x80f01f, 0x8c },
+ { 0x80f020, 0x00 },
+@@ -1699,7 +1698,6 @@ static const struct reg_val tuner_init_i
+ { 0x800104, 0x02 },
+ { 0x800105, 0xc8 },
+ { 0x800106, 0x00 },
+- { 0x800109, 0x02 },
+ { 0x800115, 0x0a },
+ { 0x800116, 0x03 },
+ { 0x80011a, 0xc6 },
+@@ -1725,7 +1723,6 @@ static const struct reg_val tuner_init_i
+ { 0x80014b, 0x8c },
+ { 0x80014d, 0xa8 },
+ { 0x80014e, 0xc6 },
+- { 0x80014f, 0x03 },
+ { 0x800151, 0x28 },
+ { 0x800153, 0xcc },
+ { 0x800178, 0x09 },
+@@ -1737,9 +1734,10 @@ static const struct reg_val tuner_init_i
+ { 0x80018d, 0x5f },
+ { 0x80018f, 0xfb },
+ { 0x800190, 0x5c },
+- { 0x80ed02, 0xff },
+- { 0x80ee42, 0xff },
+- { 0x80ee82, 0xff },
++ { 0x800191, 0x00 },
++ { 0x80ed02, 0x40 },
++ { 0x80ee42, 0x40 },
++ { 0x80ee82, 0x40 },
+ { 0x80f000, 0x0f },
+ { 0x80f01f, 0x8c },
+ { 0x80f020, 0x00 },
--- /dev/null
+From a04646c045cab08a9e62b9be8f01ecbb0632d24e Mon Sep 17 00:00:00 2001
+From: Malcolm Priestley <tvboxspy@gmail.com>
+Date: Tue, 5 Aug 2014 06:19:16 -0300
+Subject: media: af9035: new IDs: add support for PCTV 78e and PCTV 79e
+
+From: Malcolm Priestley <tvboxspy@gmail.com>
+
+commit a04646c045cab08a9e62b9be8f01ecbb0632d24e upstream.
+
+add the following IDs
+USB_PID_PCTV_78E (0x025a) for PCTV 78e
+USB_PID_PCTV_79E (0x0262) for PCTV 79e
+
+For these it9135 devices.
+
+Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
+Cc: Antti Palosaari <crope@iki.fi>
+Signed-off-by: Antti Palosaari <crope@iki.fi>
+Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/dvb-core/dvb-usb-ids.h | 2 ++
+ drivers/media/usb/dvb-usb-v2/af9035.c | 4 ++++
+ 2 files changed, 6 insertions(+)
+
+--- a/drivers/media/dvb-core/dvb-usb-ids.h
++++ b/drivers/media/dvb-core/dvb-usb-ids.h
+@@ -279,6 +279,8 @@
+ #define USB_PID_PCTV_400E 0x020f
+ #define USB_PID_PCTV_450E 0x0222
+ #define USB_PID_PCTV_452E 0x021f
++#define USB_PID_PCTV_78E 0x025a
++#define USB_PID_PCTV_79E 0x0262
+ #define USB_PID_REALTEK_RTL2831U 0x2831
+ #define USB_PID_REALTEK_RTL2832U 0x2832
+ #define USB_PID_TECHNOTREND_CONNECT_S2_3600 0x3007
+--- a/drivers/media/usb/dvb-usb-v2/af9035.c
++++ b/drivers/media/usb/dvb-usb-v2/af9035.c
+@@ -1555,6 +1555,10 @@ static const struct usb_device_id af9035
+ &af9035_props, "Leadtek WinFast DTV Dongle Dual", NULL) },
+ { DVB_USB_DEVICE(USB_VID_HAUPPAUGE, 0xf900,
+ &af9035_props, "Hauppauge WinTV-MiniStick 2", NULL) },
++ { DVB_USB_DEVICE(USB_VID_PCTV, USB_PID_PCTV_78E,
++ &af9035_props, "PCTV 78e", RC_MAP_IT913X_V1) },
++ { DVB_USB_DEVICE(USB_VID_PCTV, USB_PID_PCTV_79E,
++ &af9035_props, "PCTV 79e", RC_MAP_IT913X_V2) },
+ { }
+ };
+ MODULE_DEVICE_TABLE(usb, af9035_id_table);
--- /dev/null
+From 6a03dc92cc2edfa2257502557b9f714893987383 Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hans.verkuil@cisco.com>
+Date: Tue, 26 Aug 2014 02:59:53 -0300
+Subject: media: cx18: fix kernel oops with tda8290 tuner
+
+From: Hans Verkuil <hans.verkuil@cisco.com>
+
+commit 6a03dc92cc2edfa2257502557b9f714893987383 upstream.
+
+This was caused by an uninitialized setup.config field.
+
+Based on a suggestion from Devin Heitmueller.
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Thanks-to: Devin Heitmueller <dheitmueller@kernellabs.com>
+Reported-by: Scott Robinson <scott.robinson55@gmail.com>
+Tested-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/pci/cx18/cx18-driver.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/media/pci/cx18/cx18-driver.c
++++ b/drivers/media/pci/cx18/cx18-driver.c
+@@ -1091,6 +1091,7 @@ static int cx18_probe(struct pci_dev *pc
+ setup.addr = ADDR_UNSET;
+ setup.type = cx->options.tuner;
+ setup.mode_mask = T_ANALOG_TV; /* matches TV tuners */
++ setup.config = NULL;
+ if (cx->options.radio > 0)
+ setup.mode_mask |= T_RADIO;
+ setup.tuner_callback = (setup.type == TUNER_XC2028) ?
--- /dev/null
+From c7854c2c5d692a329b4d9a9a73bcf36ae137ee7c Mon Sep 17 00:00:00 2001
+From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Date: Fri, 19 Sep 2014 13:02:12 -0300
+Subject: media: em28xx: fix VBI handling logic
+
+From: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+
+commit c7854c2c5d692a329b4d9a9a73bcf36ae137ee7c upstream.
+
+When both VBI and video are streaming, and video stream is stopped,
+a subsequent trial to restart it will fail, because S_FMT will
+return -EBUSY.
+
+That prevents applications like zvbi to work properly.
+
+Please notice that, while this fix it fully for zvbi, the
+best is to get rid of streaming_users and res_get logic as a hole.
+
+However, this single-line patch is better to be merged at -stable.
+
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/em28xx/em28xx-video.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/usb/em28xx/em28xx-video.c
++++ b/drivers/media/usb/em28xx/em28xx-video.c
+@@ -1344,7 +1344,7 @@ static int vidioc_s_fmt_vid_cap(struct f
+ struct em28xx *dev = video_drvdata(file);
+ struct em28xx_v4l2 *v4l2 = dev->v4l2;
+
+- if (v4l2->streaming_users > 0)
++ if (vb2_is_busy(&v4l2->vb_vidq))
+ return -EBUSY;
+
+ vidioc_try_fmt_vid_cap(file, priv, f);
--- /dev/null
+From 01b461bbe74b89da8941f4c95711777d87b9172e Mon Sep 17 00:00:00 2001
+From: Bimow Chen <Bimow.Chen@ite.com.tw>
+Date: Tue, 5 Aug 2014 00:14:47 -0300
+Subject: media: it913x: init tuner on attach
+
+From: Bimow Chen <Bimow.Chen@ite.com.tw>
+
+commit 01b461bbe74b89da8941f4c95711777d87b9172e upstream.
+
+That register is needed to program very first in order to operate
+correctly.
+
+[crope@iki.fi: returned sequence back, removed sleep, moved reg
+write earlier to prevent populating tuner ops in case of failure]
+
+Signed-off-by: Bimow Chen <Bimow.Chen@ite.com.tw>
+Signed-off-by: Antti Palosaari <crope@iki.fi>
+Signed-off-by: Mauro Carvalho Chehab <m.chehab@samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/tuners/tuner_it913x.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/media/tuners/tuner_it913x.c
++++ b/drivers/media/tuners/tuner_it913x.c
+@@ -396,6 +396,7 @@ struct dvb_frontend *it913x_attach(struc
+ struct i2c_adapter *i2c_adap, u8 i2c_addr, u8 config)
+ {
+ struct it913x_state *state = NULL;
++ int ret;
+
+ /* allocate memory for the internal state */
+ state = kzalloc(sizeof(struct it913x_state), GFP_KERNEL);
+@@ -425,6 +426,11 @@ struct dvb_frontend *it913x_attach(struc
+ state->tuner_type = config;
+ state->firmware_ver = 1;
+
++ /* tuner RF initial */
++ ret = it913x_wr_reg(state, PRO_DMOD, 0xec4c, 0x68);
++ if (ret < 0)
++ goto error;
++
+ fe->tuner_priv = state;
+ memcpy(&fe->ops.tuner_ops, &it913x_tuner_ops,
+ sizeof(struct dvb_tuner_ops));
--- /dev/null
+From a9ae4692eda4b99f85757b15d60971ff78a0a0e2 Mon Sep 17 00:00:00 2001
+From: Zhaowei Yuan <zhaowei.yuan@samsung.com>
+Date: Thu, 21 Aug 2014 23:28:21 -0300
+Subject: media: vb2: fix plane index sanity check in vb2_plane_cookie()
+
+From: Zhaowei Yuan <zhaowei.yuan@samsung.com>
+
+commit a9ae4692eda4b99f85757b15d60971ff78a0a0e2 upstream.
+
+It's also invalid when plane_no is equal to vb->num_planes
+
+Signed-off-by: Zhaowei Yuan <zhaowei.yuan@samsung.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/v4l2-core/videobuf2-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/v4l2-core/videobuf2-core.c
++++ b/drivers/media/v4l2-core/videobuf2-core.c
+@@ -1126,7 +1126,7 @@ EXPORT_SYMBOL_GPL(vb2_plane_vaddr);
+ */
+ void *vb2_plane_cookie(struct vb2_buffer *vb, unsigned int plane_no)
+ {
+- if (plane_no > vb->num_planes || !vb->planes[plane_no].mem_priv)
++ if (plane_no >= vb->num_planes || !vb->planes[plane_no].mem_priv)
+ return NULL;
+
+ return call_ptr_memop(vb, cookie, vb->planes[plane_no].mem_priv);
--- /dev/null
+From bf3593d939520559774cbfee03ba5f314d909620 Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hans.verkuil@cisco.com>
+Date: Mon, 4 Aug 2014 07:14:14 -0300
+Subject: media: vb2: fix vb2 state check when start_streaming fails
+
+From: Hans Verkuil <hans.verkuil@cisco.com>
+
+commit bf3593d939520559774cbfee03ba5f314d909620 upstream.
+
+Commit bd994ddb2a12a3ff48cd549ec82cdceaea9614df (vb2: Fix stream start and
+buffer completion race) broke the buffer state check in vb2_buffer_done.
+
+So accept all three possible states there since I can no longer tell the
+difference between vb2_buffer_done called from start_streaming or from
+elsewhere.
+
+Instead add a WARN_ON at the end of start_streaming that will check whether
+any buffers were added to the done list, since that implies that the wrong
+state was used as well.
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/v4l2-core/videobuf2-core.c | 17 ++++++++++-------
+ 1 file changed, 10 insertions(+), 7 deletions(-)
+
+--- a/drivers/media/v4l2-core/videobuf2-core.c
++++ b/drivers/media/v4l2-core/videobuf2-core.c
+@@ -1161,13 +1161,10 @@ void vb2_buffer_done(struct vb2_buffer *
+ if (WARN_ON(vb->state != VB2_BUF_STATE_ACTIVE))
+ return;
+
+- if (!q->start_streaming_called) {
+- if (WARN_ON(state != VB2_BUF_STATE_QUEUED))
+- state = VB2_BUF_STATE_QUEUED;
+- } else if (WARN_ON(state != VB2_BUF_STATE_DONE &&
+- state != VB2_BUF_STATE_ERROR)) {
+- state = VB2_BUF_STATE_ERROR;
+- }
++ if (WARN_ON(state != VB2_BUF_STATE_DONE &&
++ state != VB2_BUF_STATE_ERROR &&
++ state != VB2_BUF_STATE_QUEUED))
++ state = VB2_BUF_STATE_ERROR;
+
+ #ifdef CONFIG_VIDEO_ADV_DEBUG
+ /*
+@@ -1774,6 +1771,12 @@ static int vb2_start_streaming(struct vb
+ /* Must be zero now */
+ WARN_ON(atomic_read(&q->owned_by_drv_count));
+ }
++ /*
++ * If done_list is not empty, then start_streaming() didn't call
++ * vb2_buffer_done(vb, VB2_BUF_STATE_QUEUED) but STATE_ERROR or
++ * STATE_DONE.
++ */
++ WARN_ON(!list_empty(&q->done_list));
+ return ret;
+ }
+
--- /dev/null
+From 47bc59c52b005f546343c373370a7eec6a2b0f84 Mon Sep 17 00:00:00 2001
+From: Hans Verkuil <hverkuil@xs4all.nl>
+Date: Fri, 1 Aug 2014 09:18:50 -0300
+Subject: media: videobuf2-dma-sg: fix for wrong GFP mask to sg_alloc_table_from_pages
+
+From: Hans Verkuil <hverkuil@xs4all.nl>
+
+commit 47bc59c52b005f546343c373370a7eec6a2b0f84 upstream.
+
+sg_alloc_table_from_pages() only allocates a sg_table, so it should just use
+GFP_KERNEL, not gfp_flags. If gfp_flags contains __GFP_DMA32 then mm/sl[au]b.c
+will call BUG_ON:
+
+[ 358.027515] ------------[ cut here ]------------
+[ 358.027546] kernel BUG at mm/slub.c:1416!
+[ 358.027558] invalid opcode: 0000 [#1] PREEMPT SMP
+[ 358.027576] Modules linked in: mt2131 s5h1409 tda8290 tuner cx25840 cx23885 btcx_risc altera_ci tda18271 altera_stapl videobuf2_dvb tveeprom cx2341x videobuf2_dma_sg dvb_core rc_core videobuf2_memops videobuf2_core nouveau zr36067 videocodec v4l2_common videodev media x86_pkg_temp_thermal cfbfillrect cfbimgblt cfbcopyarea ttm drm_kms_helper processor button isci
+[ 358.027712] CPU: 19 PID: 3654 Comm: cat Not tainted 3.16.0-rc6-telek #167
+[ 358.027723] Hardware name: ASUSTeK COMPUTER INC. Z9PE-D8 WS/Z9PE-D8 WS, BIOS 5404 02/10/2014
+[ 358.027741] task: ffff880897c7d960 ti: ffff88089b4d4000 task.ti: ffff88089b4d4000
+[ 358.027753] RIP: 0010:[<ffffffff81196040>] [<ffffffff81196040>] new_slab+0x280/0x320
+[ 358.027776] RSP: 0018:ffff88089b4d7ae8 EFLAGS: 00010002
+[ 358.027787] RAX: ffff880897c7d960 RBX: 0000000000000000 RCX: ffff88089b4d7b50
+[ 358.027798] RDX: 00000000ffffffff RSI: 0000000000000004 RDI: ffff88089f803b00
+[ 358.027809] RBP: ffff88089b4d7bb8 R08: 0000000000000000 R09: 0000000100400040
+[ 358.027821] R10: 0000160000000000 R11: ffff88109bc02c40 R12: 0000000000000001
+[ 358.027832] R13: ffff88089f8000c0 R14: ffff88089f803b00 R15: ffff8810bfcf4be0
+[ 358.027845] FS: 00007f83fe5c0700(0000) GS:ffff8810bfce0000(0000) knlGS:0000000000000000
+[ 358.027858] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[ 358.027868] CR2: 0000000001dfd568 CR3: 0000001097d5a000 CR4: 00000000000407e0
+[ 358.027878] Stack:
+[ 358.027885] ffffffff81198860 ffff8810bfcf4be0 ffff880897c7d960 0000000000001b00
+[ 358.027905] ffff880897c7d960 0000000000000000 ffff8810bfcf4bf0 0000000000000000
+[ 358.027924] 0000000000000000 0000000100000100 ffffffff813ef84a 00000004ffffffff
+[ 358.027944] Call Trace:
+[ 358.027956] [<ffffffff81198860>] ? __slab_alloc+0x400/0x4e0
+[ 358.027973] [<ffffffff813ef84a>] ? sg_kmalloc+0x1a/0x30
+[ 358.027985] [<ffffffff81198f17>] __kmalloc+0x127/0x150
+[ 358.027997] [<ffffffff813ef84a>] ? sg_kmalloc+0x1a/0x30
+[ 358.028009] [<ffffffff813ef84a>] sg_kmalloc+0x1a/0x30
+[ 358.028023] [<ffffffff813eff84>] __sg_alloc_table+0x74/0x180
+[ 358.028035] [<ffffffff813ef830>] ? sg_kfree+0x20/0x20
+[ 358.028048] [<ffffffff813f00af>] sg_alloc_table+0x1f/0x60
+[ 358.028061] [<ffffffff813f0174>] sg_alloc_table_from_pages+0x84/0x1f0
+[ 358.028077] [<ffffffffa007c3f9>] vb2_dma_sg_alloc+0x159/0x230 [videobuf2_dma_sg]
+[ 358.028095] [<ffffffffa003d55a>] __vb2_queue_alloc+0x10a/0x680 [videobuf2_core]
+[ 358.028113] [<ffffffffa003e110>] __reqbufs.isra.14+0x220/0x3e0 [videobuf2_core]
+[ 358.028130] [<ffffffffa003e79d>] __vb2_init_fileio+0xbd/0x380 [videobuf2_core]
+[ 358.028147] [<ffffffffa003f563>] __vb2_perform_fileio+0x5b3/0x6e0 [videobuf2_core]
+[ 358.028164] [<ffffffffa003f871>] vb2_fop_read+0xb1/0x100 [videobuf2_core]
+[ 358.028184] [<ffffffffa06dd2e5>] v4l2_read+0x65/0xb0 [videodev]
+[ 358.028198] [<ffffffff811a243f>] vfs_read+0x8f/0x170
+[ 358.028210] [<ffffffff811a30a1>] SyS_read+0x41/0xb0
+[ 358.028224] [<ffffffff818f02e9>] system_call_fastpath+0x16/0x1b
+[ 358.028234] Code: 66 90 e9 dc fd ff ff 0f 1f 40 00 41 8b 4d 68 e9 d5 fe ff ff 0f 1f 80 00 00 00 00 f0 41 80 4d 00 40 e9 03 ff ff ff 0f 1f 44 00 00 <0f> 0b 66 0f 1f 44 00 00 44 89 c6 4c 89 45 d0 e8 0c 82 ff ff 48
+[ 358.028415] RIP [<ffffffff81196040>] new_slab+0x280/0x320
+[ 358.028432] RSP <ffff88089b4d7ae8>
+[ 358.032208] ---[ end trace 6443240199c706e4 ]---
+
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Acked-by: Marek Szyprowski <m.szyprowski@samsung.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/v4l2-core/videobuf2-dma-sg.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/v4l2-core/videobuf2-dma-sg.c
++++ b/drivers/media/v4l2-core/videobuf2-dma-sg.c
+@@ -113,7 +113,7 @@ static void *vb2_dma_sg_alloc(void *allo
+ goto fail_pages_alloc;
+
+ ret = sg_alloc_table_from_pages(&buf->sg_table, buf->pages,
+- buf->num_pages, 0, size, gfp_flags);
++ buf->num_pages, 0, size, GFP_KERNEL);
+ if (ret)
+ goto fail_table_alloc;
+
--- /dev/null
+From bd8c78e78d5011d8111bc2533ee73b13a3bd6c42 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Wed, 30 Jul 2014 14:55:26 +0200
+Subject: nl80211: clear skb cb before passing to netlink
+
+From: Johannes Berg <johannes.berg@intel.com>
+
+commit bd8c78e78d5011d8111bc2533ee73b13a3bd6c42 upstream.
+
+In testmode and vendor command reply/event SKBs we use the
+skb cb data to store nl80211 parameters between allocation
+and sending. This causes the code for CONFIG_NETLINK_MMAP
+to get confused, because it takes ownership of the skb cb
+data when the SKB is handed off to netlink, and it doesn't
+explicitly clear it.
+
+Clear the skb cb explicitly when we're done and before it
+gets passed to netlink to avoid this issue.
+
+Reported-by: Assaf Azulay <assaf.azulay@intel.com>
+Reported-by: David Spinadel <david.spinadel@intel.com>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/wireless/nl80211.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/net/wireless/nl80211.c
++++ b/net/wireless/nl80211.c
+@@ -6978,6 +6978,9 @@ void __cfg80211_send_event_skb(struct sk
+ struct nlattr *data = ((void **)skb->cb)[2];
+ enum nl80211_multicast_groups mcgrp = NL80211_MCGRP_TESTMODE;
+
++ /* clear CB data for netlink core to own from now on */
++ memset(skb->cb, 0, sizeof(skb->cb));
++
+ nla_nest_end(skb, data);
+ genlmsg_end(skb, hdr);
+
+@@ -9300,6 +9303,9 @@ int cfg80211_vendor_cmd_reply(struct sk_
+ void *hdr = ((void **)skb->cb)[1];
+ struct nlattr *data = ((void **)skb->cb)[2];
+
++ /* clear CB data for netlink core to own from now on */
++ memset(skb->cb, 0, sizeof(skb->cb));
++
+ if (WARN_ON(!rdev->cur_cmd_info)) {
+ kfree_skb(skb);
+ return -EINVAL;
--- /dev/null
+From 12d8706963f073fffad16c7c24160ef20d9aeaff Mon Sep 17 00:00:00 2001
+From: Bjorn Helgaas <bhelgaas@google.com>
+Date: Fri, 19 Sep 2014 11:08:40 -0600
+Subject: Revert "PCI: Make sure bus number resources stay within their parents bounds"
+
+From: Bjorn Helgaas <bhelgaas@google.com>
+
+commit 12d8706963f073fffad16c7c24160ef20d9aeaff upstream.
+
+This reverts commit 1820ffdccb9b ("PCI: Make sure bus number resources stay
+within their parents bounds") because it breaks some systems with LSI Logic
+FC949ES Fibre Channel Adapters, apparently by exposing a defect in those
+adapters.
+
+Dirk tested a Tyan VX50 (B4985) with this device that worked like this
+prior to 1820ffdccb9b:
+
+ bus: [bus 00-7f] on node 0 link 1
+ ACPI: PCI Root Bridge [PCI0] (domain 0000 [bus 00-07])
+ pci 0000:00:0e.0: PCI bridge to [bus 0a]
+ pci_bus 0000:0a: busn_res: can not insert [bus 0a] under [bus 00-07] (conflicts with (null) [bus 00-07])
+ pci 0000:0a:00.0: [1000:0646] type 00 class 0x0c0400 (FC adapter)
+
+Note that the root bridge [bus 00-07] aperture is wrong; this is a BIOS
+defect in the PCI0 _CRS method. But prior to 1820ffdccb9b, we didn't
+enforce that aperture, and the FC adapter worked fine at 0a:00.0.
+
+After 1820ffdccb9b, we notice that 00:0e.0's aperture is not contained in
+the root bridge's aperture, so we reconfigure it so it *is* contained:
+
+ pci 0000:00:0e.0: bridge configuration invalid ([bus 0a-0a]), reconfiguring
+ pci 0000:00:0e.0: PCI bridge to [bus 06-07]
+
+This effectively moves the FC device from 0a:00.0 to 07:00.0, which should
+be legal. But when we enumerate bus 06, the FC device doesn't respond, so
+we don't find anything. This is probably a defect in the FC device.
+
+Possible fixes (due to Yinghai):
+
+ 1) Add a quirk to fix the _CRS information based on what amd_bus.c read
+ from the hardware
+
+ 2) Reset the FC device after we change its bus number
+
+ 3) Revert 1820ffdccb9b
+
+Fix 1 would be relatively easy, but it does sweep the LSI FC issue under
+the rug. We might want to reconfigure bus numbers in the future for some
+other reason, e.g., hotplug, and then we could trip over this again.
+
+For that reason, I like fix 2, but we don't know whether it actually works,
+and we don't have a patch for it yet.
+
+This revert is fix 3, which also sweeps the LSI FC issue under the rug.
+
+Link: https://bugzilla.kernel.org/show_bug.cgi?id=84281
+Reported-by: Dirk Gouders <dirk@gouders.net>
+Tested-by: Dirk Gouders <dirk@gouders.net>
+Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
+CC: Yinghai Lu <yinghai@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pci/probe.c | 10 ++--------
+ 1 file changed, 2 insertions(+), 8 deletions(-)
+
+--- a/drivers/pci/probe.c
++++ b/drivers/pci/probe.c
+@@ -775,7 +775,7 @@ int pci_scan_bridge(struct pci_bus *bus,
+ /* Check if setup is sensible at all */
+ if (!pass &&
+ (primary != bus->number || secondary <= bus->number ||
+- secondary > subordinate || subordinate > bus->busn_res.end)) {
++ secondary > subordinate)) {
+ dev_info(&dev->dev, "bridge configuration invalid ([bus %02x-%02x]), reconfiguring\n",
+ secondary, subordinate);
+ broken = 1;
+@@ -849,8 +849,7 @@ int pci_scan_bridge(struct pci_bus *bus,
+ child = pci_add_new_bus(bus, dev, max+1);
+ if (!child)
+ goto out;
+- pci_bus_insert_busn_res(child, max+1,
+- bus->busn_res.end);
++ pci_bus_insert_busn_res(child, max+1, 0xff);
+ }
+ max++;
+ buses = (buses & 0xff000000)
+@@ -909,11 +908,6 @@ int pci_scan_bridge(struct pci_bus *bus,
+ /*
+ * Set the subordinate bus number to its real value.
+ */
+- if (max > bus->busn_res.end) {
+- dev_warn(&dev->dev, "max busn %02x is outside %pR\n",
+- max, &bus->busn_res);
+- max = bus->busn_res.end;
+- }
+ pci_bus_update_busn_res_end(child, max);
+ pci_write_config_byte(dev, PCI_SUBORDINATE_BUS, max);
+ }
vgaswitcheroo-add-vga_switcheroo_fini_domain_pm_ops.patch
drm-nouveau-runpm-fix-module-unload.patch
drm-radeon-px-fix-module-unload.patch
+fix-nasty-32-bit-overflow-bug-in-buffer-i-o-code.patch
+blk-mq-avoid-race-condition-with-uninitialized-requests.patch
+crypto-ccp-check-for-ccp-before-registering-crypto-algs.patch
+nl80211-clear-skb-cb-before-passing-to-netlink.patch
+revert-pci-make-sure-bus-number-resources-stay-within-their-parents-bounds.patch
+cpufreq-release-policy-rwsem-on-error.patch
+cpufreq-fix-cpufreq-suspend-resume-for-intel_pstate.patch
+media-it913x-init-tuner-on-attach.patch
+media-af9035-new-ids-add-support-for-pctv-78e-and-pctv-79e.patch
+media-af9033-feed-clock-to-rf-tuner.patch
+media-cx18-fix-kernel-oops-with-tda8290-tuner.patch
+media-af9033-update-it9135-tuner-inittabs.patch
+media-adv7604-fix-inverted-condition.patch
+media-em28xx-fix-vbi-handling-logic.patch
+media-videobuf2-dma-sg-fix-for-wrong-gfp-mask-to-sg_alloc_table_from_pages.patch
+media-vb2-fix-vb2-state-check-when-start_streaming-fails.patch
+media-vb2-fix-plane-index-sanity-check-in-vb2_plane_cookie.patch
projects / thirdparty / kernel / stable-queue.git / commitdiff
