--- /dev/null
+From 378d0aee3b53bd8549b29dcc75f2bf47ee446e8f Mon Sep 17 00:00:00 2001
+From: Maxime Ripard <maxime.ripard@free-electrons.com>
+Date: Tue, 10 Dec 2013 19:37:21 +0100
+Subject: ARM: sun7i: dt: Fix interrupt trigger types
+
+From: Maxime Ripard <maxime.ripard@free-electrons.com>
+
+commit 378d0aee3b53bd8549b29dcc75f2bf47ee446e8f upstream.
+
+The Allwinner A20 uses the ARM GIC as its internal interrupts controller. The
+GIC can work on several interrupt triggers, and the A20 was actually setting it
+up to use a rising edge as a trigger, while it was actually a level high
+trigger, leading to some interrupts that would be completely ignored if the
+edge was missed.
+
+Signed-off-by: Maxime Ripard <maxime.ripard@free-electrons.com>
+Acked-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/sun7i-a20.dtsi | 32 ++++++++++++++++----------------
+ 1 file changed, 16 insertions(+), 16 deletions(-)
+
+--- a/arch/arm/boot/dts/sun7i-a20.dtsi
++++ b/arch/arm/boot/dts/sun7i-a20.dtsi
+@@ -170,7 +170,7 @@
+ emac: ethernet@01c0b000 {
+ compatible = "allwinner,sun4i-emac";
+ reg = <0x01c0b000 0x1000>;
+- interrupts = <0 55 1>;
++ interrupts = <0 55 4>;
+ clocks = <&ahb_gates 17>;
+ status = "disabled";
+ };
+@@ -186,7 +186,7 @@
+ pio: pinctrl@01c20800 {
+ compatible = "allwinner,sun7i-a20-pinctrl";
+ reg = <0x01c20800 0x400>;
+- interrupts = <0 28 1>;
++ interrupts = <0 28 4>;
+ clocks = <&apb0_gates 5>;
+ gpio-controller;
+ interrupt-controller;
+@@ -230,12 +230,12 @@
+ timer@01c20c00 {
+ compatible = "allwinner,sun4i-timer";
+ reg = <0x01c20c00 0x90>;
+- interrupts = <0 22 1>,
+- <0 23 1>,
+- <0 24 1>,
+- <0 25 1>,
+- <0 67 1>,
+- <0 68 1>;
++ interrupts = <0 22 4>,
++ <0 23 4>,
++ <0 24 4>,
++ <0 25 4>,
++ <0 67 4>,
++ <0 68 4>;
+ clocks = <&osc24M>;
+ };
+
+@@ -247,7 +247,7 @@
+ uart0: serial@01c28000 {
+ compatible = "snps,dw-apb-uart";
+ reg = <0x01c28000 0x400>;
+- interrupts = <0 1 1>;
++ interrupts = <0 1 4>;
+ reg-shift = <2>;
+ reg-io-width = <4>;
+ clocks = <&apb1_gates 16>;
+@@ -257,7 +257,7 @@
+ uart1: serial@01c28400 {
+ compatible = "snps,dw-apb-uart";
+ reg = <0x01c28400 0x400>;
+- interrupts = <0 2 1>;
++ interrupts = <0 2 4>;
+ reg-shift = <2>;
+ reg-io-width = <4>;
+ clocks = <&apb1_gates 17>;
+@@ -267,7 +267,7 @@
+ uart2: serial@01c28800 {
+ compatible = "snps,dw-apb-uart";
+ reg = <0x01c28800 0x400>;
+- interrupts = <0 3 1>;
++ interrupts = <0 3 4>;
+ reg-shift = <2>;
+ reg-io-width = <4>;
+ clocks = <&apb1_gates 18>;
+@@ -277,7 +277,7 @@
+ uart3: serial@01c28c00 {
+ compatible = "snps,dw-apb-uart";
+ reg = <0x01c28c00 0x400>;
+- interrupts = <0 4 1>;
++ interrupts = <0 4 4>;
+ reg-shift = <2>;
+ reg-io-width = <4>;
+ clocks = <&apb1_gates 19>;
+@@ -287,7 +287,7 @@
+ uart4: serial@01c29000 {
+ compatible = "snps,dw-apb-uart";
+ reg = <0x01c29000 0x400>;
+- interrupts = <0 17 1>;
++ interrupts = <0 17 4>;
+ reg-shift = <2>;
+ reg-io-width = <4>;
+ clocks = <&apb1_gates 20>;
+@@ -297,7 +297,7 @@
+ uart5: serial@01c29400 {
+ compatible = "snps,dw-apb-uart";
+ reg = <0x01c29400 0x400>;
+- interrupts = <0 18 1>;
++ interrupts = <0 18 4>;
+ reg-shift = <2>;
+ reg-io-width = <4>;
+ clocks = <&apb1_gates 21>;
+@@ -307,7 +307,7 @@
+ uart6: serial@01c29800 {
+ compatible = "snps,dw-apb-uart";
+ reg = <0x01c29800 0x400>;
+- interrupts = <0 19 1>;
++ interrupts = <0 19 4>;
+ reg-shift = <2>;
+ reg-io-width = <4>;
+ clocks = <&apb1_gates 22>;
+@@ -317,7 +317,7 @@
+ uart7: serial@01c29c00 {
+ compatible = "snps,dw-apb-uart";
+ reg = <0x01c29c00 0x400>;
+- interrupts = <0 20 1>;
++ interrupts = <0 20 4>;
+ reg-shift = <2>;
+ reg-io-width = <4>;
+ clocks = <&apb1_gates 23>;
--- /dev/null
+From dfe5b9ad83a63180f358b27d1018649a27b394a9 Mon Sep 17 00:00:00 2001
+From: Steven Whitehouse <swhiteho@redhat.com>
+Date: Fri, 6 Dec 2013 11:52:34 +0000
+Subject: GFS2: don't hold s_umount over blkdev_put
+
+From: Steven Whitehouse <swhiteho@redhat.com>
+
+commit dfe5b9ad83a63180f358b27d1018649a27b394a9 upstream.
+
+This is a GFS2 version of Tejun's patch:
+4f331f01b9c43bf001d3ffee578a97a1e0633eac
+vfs: don't hold s_umount over close_bdev_exclusive() call
+
+In this case its blkdev_put itself that is the issue and this
+patch uses the same solution of dropping and retaking s_umount.
+
+Reported-by: Tejun Heo <tj@kernel.org>
+Reported-by: Al Viro <viro@ZenIV.linux.org.uk>
+Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/gfs2/ops_fstype.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/fs/gfs2/ops_fstype.c
++++ b/fs/gfs2/ops_fstype.c
+@@ -1366,8 +1366,18 @@ static struct dentry *gfs2_mount(struct
+ if (IS_ERR(s))
+ goto error_bdev;
+
+- if (s->s_root)
++ if (s->s_root) {
++ /*
++ * s_umount nests inside bd_mutex during
++ * __invalidate_device(). blkdev_put() acquires
++ * bd_mutex and can't be called under s_umount. Drop
++ * s_umount temporarily. This is safe as we're
++ * holding an active reference.
++ */
++ up_write(&s->s_umount);
+ blkdev_put(bdev, mode);
++ down_write(&s->s_umount);
++ }
+
+ memset(&args, 0, sizeof(args));
+ args.ar_quota = GFS2_QUOTA_DEFAULT;
--- /dev/null
+From dfd11184d894cd0a92397b25cac18831a1a6a5bc Mon Sep 17 00:00:00 2001
+From: Steven Whitehouse <swhiteho@redhat.com>
+Date: Wed, 18 Dec 2013 14:14:52 +0000
+Subject: GFS2: Fix incorrect invalidation for DIO/buffered I/O
+
+From: Steven Whitehouse <swhiteho@redhat.com>
+
+commit dfd11184d894cd0a92397b25cac18831a1a6a5bc upstream.
+
+In patch 209806aba9d540dde3db0a5ce72307f85f33468f we allowed
+local deferred locks to be granted against a cached exclusive
+lock. That opened up a corner case which this patch now
+fixes.
+
+The solution to the problem is to check whether we have cached
+pages each time we do direct I/O and if so to unmap, flush
+and invalidate those pages. Since the glock state machine
+normally does that for us, mostly the code will be a no-op.
+
+Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/gfs2/aops.c | 30 ++++++++++++++++++++++++++++++
+ 1 file changed, 30 insertions(+)
+
+--- a/fs/gfs2/aops.c
++++ b/fs/gfs2/aops.c
+@@ -984,6 +984,7 @@ static ssize_t gfs2_direct_IO(int rw, st
+ {
+ struct file *file = iocb->ki_filp;
+ struct inode *inode = file->f_mapping->host;
++ struct address_space *mapping = inode->i_mapping;
+ struct gfs2_inode *ip = GFS2_I(inode);
+ struct gfs2_holder gh;
+ int rv;
+@@ -1004,6 +1005,35 @@ static ssize_t gfs2_direct_IO(int rw, st
+ if (rv != 1)
+ goto out; /* dio not valid, fall back to buffered i/o */
+
++ /*
++ * Now since we are holding a deferred (CW) lock at this point, you
++ * might be wondering why this is ever needed. There is a case however
++ * where we've granted a deferred local lock against a cached exclusive
++ * glock. That is ok provided all granted local locks are deferred, but
++ * it also means that it is possible to encounter pages which are
++ * cached and possibly also mapped. So here we check for that and sort
++ * them out ahead of the dio. The glock state machine will take care of
++ * everything else.
++ *
++ * If in fact the cached glock state (gl->gl_state) is deferred (CW) in
++ * the first place, mapping->nr_pages will always be zero.
++ */
++ if (mapping->nrpages) {
++ loff_t lstart = offset & (PAGE_CACHE_SIZE - 1);
++ loff_t len = iov_length(iov, nr_segs);
++ loff_t end = PAGE_ALIGN(offset + len) - 1;
++
++ rv = 0;
++ if (len == 0)
++ goto out;
++ if (test_and_clear_bit(GIF_SW_PAGED, &ip->i_flags))
++ unmap_shared_mapping_range(ip->i_inode.i_mapping, offset, len);
++ rv = filemap_write_and_wait_range(mapping, lstart, end);
++ if (rv)
++ return rv;
++ truncate_inode_pages_range(mapping, lstart, end);
++ }
++
+ rv = __blockdev_direct_IO(rw, iocb, inode, inode->i_sb->s_bdev, iov,
+ offset, nr_segs, gfs2_get_block_direct,
+ NULL, NULL, 0);
--- /dev/null
+From 502be2a32f09f388e4ff34ef2e3ebcabbbb261da Mon Sep 17 00:00:00 2001
+From: Bob Peterson <rpeterso@redhat.com>
+Date: Fri, 13 Dec 2013 08:31:06 -0500
+Subject: GFS2: Fix slab memory leak in gfs2_bufdata
+
+From: Bob Peterson <rpeterso@redhat.com>
+
+commit 502be2a32f09f388e4ff34ef2e3ebcabbbb261da upstream.
+
+This patch fixes a slab memory leak that sometimes can occur
+for files with a very short lifespan. The problem occurs when
+a dinode is deleted before it has gotten to the journal properly.
+In the leak scenario, the bd object is pinned for journal
+committment (queued to the metadata buffers queue: sd_log_le_buf)
+but is subsequently unpinned and dequeued before it finds its way
+to the ail or the revoke queue. In this rare circumstance, the bd
+object needs to be freed from slab memory, or it is forgotten.
+We have to be very careful how we do it, though, because
+multiple processes can call gfs2_remove_from_journal. In order to
+avoid double-frees, only the process that does the unpinning is
+allowed to free the bd.
+
+Signed-off-by: Bob Peterson <rpeterso@redhat.com>
+Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/gfs2/meta_io.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/fs/gfs2/meta_io.c
++++ b/fs/gfs2/meta_io.c
+@@ -258,6 +258,7 @@ void gfs2_remove_from_journal(struct buf
+ struct address_space *mapping = bh->b_page->mapping;
+ struct gfs2_sbd *sdp = gfs2_mapping2sbd(mapping);
+ struct gfs2_bufdata *bd = bh->b_private;
++ int was_pinned = 0;
+
+ if (test_clear_buffer_pinned(bh)) {
+ trace_gfs2_pin(bd, 0);
+@@ -273,12 +274,16 @@ void gfs2_remove_from_journal(struct buf
+ tr->tr_num_databuf_rm++;
+ }
+ tr->tr_touched = 1;
++ was_pinned = 1;
+ brelse(bh);
+ }
+ if (bd) {
+ spin_lock(&sdp->sd_ail_lock);
+ if (bd->bd_tr) {
+ gfs2_trans_add_revoke(sdp, bd);
++ } else if (was_pinned) {
++ bh->b_private = NULL;
++ kmem_cache_free(gfs2_bufdata_cachep, bd);
+ }
+ spin_unlock(&sdp->sd_ail_lock);
+ }
--- /dev/null
+From 9290a9a7c0bcf5400e8dbfbf9707fa68ea3fb338 Mon Sep 17 00:00:00 2001
+From: Bob Peterson <rpeterso@redhat.com>
+Date: Tue, 10 Dec 2013 12:06:35 -0500
+Subject: GFS2: Fix use-after-free race when calling gfs2_remove_from_ail
+
+From: Bob Peterson <rpeterso@redhat.com>
+
+commit 9290a9a7c0bcf5400e8dbfbf9707fa68ea3fb338 upstream.
+
+Function gfs2_remove_from_ail drops the reference on the bh via
+brelse. This patch fixes a race condition whereby bh is deferenced
+after the brelse when setting bd->bd_blkno = bh->b_blocknr;
+Under certain rare circumstances, bh might be gone or reused,
+and bd->bd_blkno is set to whatever that memory happens to be,
+which is often 0. Later, in gfs2_trans_add_unrevoke, that bd fails
+the test "bd->bd_blkno >= blkno" which causes it to never be freed.
+The end result is that the bd is never freed from the bufdata cache,
+which results in this error:
+slab error in kmem_cache_destroy(): cache `gfs2_bufdata': Can't free all objects
+
+Signed-off-by: Bob Peterson <rpeterso@redhat.com>
+Signed-off-by: Steven Whitehouse <swhiteho@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/gfs2/log.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/fs/gfs2/log.c
++++ b/fs/gfs2/log.c
+@@ -551,10 +551,10 @@ void gfs2_add_revoke(struct gfs2_sbd *sd
+ struct buffer_head *bh = bd->bd_bh;
+ struct gfs2_glock *gl = bd->bd_gl;
+
+- gfs2_remove_from_ail(bd);
+- bd->bd_bh = NULL;
+ bh->b_private = NULL;
+ bd->bd_blkno = bh->b_blocknr;
++ gfs2_remove_from_ail(bd); /* drops ref on bh */
++ bd->bd_bh = NULL;
+ bd->bd_ops = &gfs2_revoke_lops;
+ sdp->sd_log_num_revoke++;
+ atomic_inc(&gl->gl_revokes);
--- /dev/null
+From 4cc629b7a20945ce35628179180329b6bc9e552b Mon Sep 17 00:00:00 2001
+From: Stephen Boyd <sboyd@codeaurora.org>
+Date: Tue, 10 Dec 2013 15:19:03 -0800
+Subject: gpio: msm: Fix irq mask/unmask by writing bits instead of numbers
+
+From: Stephen Boyd <sboyd@codeaurora.org>
+
+commit 4cc629b7a20945ce35628179180329b6bc9e552b upstream.
+
+We should be writing bits here but instead we're writing the
+numbers that correspond to the bits we want to write. Fix it by
+wrapping the numbers in the BIT() macro. This fixes gpios acting
+as interrupts.
+
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpio/gpio-msm-v2.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/gpio/gpio-msm-v2.c
++++ b/drivers/gpio/gpio-msm-v2.c
+@@ -252,7 +252,7 @@ static void msm_gpio_irq_mask(struct irq
+
+ spin_lock_irqsave(&tlmm_lock, irq_flags);
+ writel(TARGET_PROC_NONE, GPIO_INTR_CFG_SU(gpio));
+- clear_gpio_bits(INTR_RAW_STATUS_EN | INTR_ENABLE, GPIO_INTR_CFG(gpio));
++ clear_gpio_bits(BIT(INTR_RAW_STATUS_EN) | BIT(INTR_ENABLE), GPIO_INTR_CFG(gpio));
+ __clear_bit(gpio, msm_gpio.enabled_irqs);
+ spin_unlock_irqrestore(&tlmm_lock, irq_flags);
+ }
+@@ -264,7 +264,7 @@ static void msm_gpio_irq_unmask(struct i
+
+ spin_lock_irqsave(&tlmm_lock, irq_flags);
+ __set_bit(gpio, msm_gpio.enabled_irqs);
+- set_gpio_bits(INTR_RAW_STATUS_EN | INTR_ENABLE, GPIO_INTR_CFG(gpio));
++ set_gpio_bits(BIT(INTR_RAW_STATUS_EN) | BIT(INTR_ENABLE), GPIO_INTR_CFG(gpio));
+ writel(TARGET_PROC_SCORPION, GPIO_INTR_CFG_SU(gpio));
+ spin_unlock_irqrestore(&tlmm_lock, irq_flags);
+ }
--- /dev/null
+From f5837ec11f8cfa6d53ebc5806582771b2c9988c6 Mon Sep 17 00:00:00 2001
+From: Roger Quadros <rogerq@ti.com>
+Date: Thu, 5 Dec 2013 11:23:35 +0200
+Subject: gpio: twl4030: Fix regression for twl gpio LED output
+
+From: Roger Quadros <rogerq@ti.com>
+
+commit f5837ec11f8cfa6d53ebc5806582771b2c9988c6 upstream.
+
+Commit 0b2aa8be introduced a regression that causes failure
+in setting LED GPO direction to OUT.
+
+This causes USB host probe failures for Beagleboard C4.
+
+platform usb_phy_gen_xceiv.2: Driver usb_phy_gen_xceiv requests probe deferral
+hsusb2_vcc: Failed to request enable GPIO510: -22
+reg-fixed-voltage reg-fixed-voltage.0.auto: Failed to register regulator: -22
+reg-fixed-voltage: probe of reg-fixed-voltage.0.auto failed with error -22
+
+direction_out/direction_in must return 0 if the operation succeeded.
+
+Also, don't update direction flag and output data if twl4030_set_gpio_direction()
+failed inside twl_direction_out();
+
+Signed-off-by: Roger Quadros <rogerq@ti.com>
+Acked-by: Tony Lindgren <tony@atomide.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpio/gpio-twl4030.c | 15 ++++++++++++---
+ 1 file changed, 12 insertions(+), 3 deletions(-)
+
+--- a/drivers/gpio/gpio-twl4030.c
++++ b/drivers/gpio/gpio-twl4030.c
+@@ -300,7 +300,7 @@ static int twl_direction_in(struct gpio_
+ if (offset < TWL4030_GPIO_MAX)
+ ret = twl4030_set_gpio_direction(offset, 1);
+ else
+- ret = -EINVAL;
++ ret = -EINVAL; /* LED outputs can't be set as input */
+
+ if (!ret)
+ priv->direction &= ~BIT(offset);
+@@ -354,11 +354,20 @@ static void twl_set(struct gpio_chip *ch
+ static int twl_direction_out(struct gpio_chip *chip, unsigned offset, int value)
+ {
+ struct gpio_twl4030_priv *priv = to_gpio_twl4030(chip);
+- int ret = -EINVAL;
++ int ret = 0;
+
+ mutex_lock(&priv->mutex);
+- if (offset < TWL4030_GPIO_MAX)
++ if (offset < TWL4030_GPIO_MAX) {
+ ret = twl4030_set_gpio_direction(offset, 0);
++ if (ret) {
++ mutex_unlock(&priv->mutex);
++ return ret;
++ }
++ }
++
++ /*
++ * LED gpios i.e. offset >= TWL4030_GPIO_MAX are always output
++ */
+
+ priv->direction |= BIT(offset);
+ mutex_unlock(&priv->mutex);
--- /dev/null
+From 28a2a2e1aedbe2d8b2301e6e0e4e63f6e4177aca Mon Sep 17 00:00:00 2001
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Date: Thu, 26 Dec 2013 17:44:29 -0800
+Subject: Input: allocate absinfo data when setting ABS capability
+
+From: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+
+commit 28a2a2e1aedbe2d8b2301e6e0e4e63f6e4177aca upstream.
+
+We need to make sure we allocate absinfo data when we are setting one of
+EV_ABS/ABS_XXX capabilities, otherwise we may bomb when we try to emit this
+event.
+
+Rested-by: Paul Cercueil <pcercuei@gmail.com>
+Signed-off-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/input.c | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+--- a/drivers/input/input.c
++++ b/drivers/input/input.c
+@@ -1871,6 +1871,10 @@ void input_set_capability(struct input_d
+ break;
+
+ case EV_ABS:
++ input_alloc_absinfo(dev);
++ if (!dev->absinfo)
++ return;
++
+ __set_bit(code, dev->absbit);
+ break;
+
--- /dev/null
+From f6c07cad081ba222d63623d913aafba5586c1d2c Mon Sep 17 00:00:00 2001
+From: Theodore Ts'o <tytso@mit.edu>
+Date: Sun, 8 Dec 2013 21:12:59 -0500
+Subject: jbd2: don't BUG but return ENOSPC if a handle runs out of space
+
+From: Theodore Ts'o <tytso@mit.edu>
+
+commit f6c07cad081ba222d63623d913aafba5586c1d2c upstream.
+
+If a handle runs out of space, we currently stop the kernel with a BUG
+in jbd2_journal_dirty_metadata(). This makes it hard to figure out
+what might be going on. So return an error of ENOSPC, so we can let
+the file system layer figure out what is going on, to make it more
+likely we can get useful debugging information). This should make it
+easier to debug problems such as the one which was reported by:
+
+ https://bugzilla.kernel.org/show_bug.cgi?id=44731
+
+The only two callers of this function are ext4_handle_dirty_metadata()
+and ocfs2_journal_dirty(). The ocfs2 function will trigger a
+BUG_ON(), which means there will be no change in behavior. The ext4
+function will call ext4_error_inode() which will print the useful
+debugging information and then handle the situation using ext4's error
+handling mechanisms (i.e., which might mean halting the kernel or
+remounting the file system read-only).
+
+Also, since both file systems already call WARN_ON(), drop the WARN_ON
+from jbd2_journal_dirty_metadata() to avoid two stack traces from
+being displayed.
+
+Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
+Cc: ocfs2-devel@oss.oracle.com
+Acked-by: Joel Becker <jlbec@evilplan.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/jbd2/transaction.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/fs/jbd2/transaction.c
++++ b/fs/jbd2/transaction.c
+@@ -1290,7 +1290,10 @@ int jbd2_journal_dirty_metadata(handle_t
+ * once a transaction -bzzz
+ */
+ jh->b_modified = 1;
+- J_ASSERT_JH(jh, handle->h_buffer_credits > 0);
++ if (handle->h_buffer_credits <= 0) {
++ ret = -ENOSPC;
++ goto out_unlock_bh;
++ }
+ handle->h_buffer_credits--;
+ }
+
+@@ -1373,7 +1376,6 @@ out_unlock_bh:
+ jbd2_journal_put_journal_head(jh);
+ out:
+ JBUFFER_TRACE(jh, "exit");
+- WARN_ON(ret); /* All errors are bugs, so dump the stack */
+ return ret;
+ }
+
--- /dev/null
+From 695c60830764945cf61a2cc623eb1392d137223e Mon Sep 17 00:00:00 2001
+From: Vladimir Davydov <vdavydov@parallels.com>
+Date: Thu, 2 Jan 2014 12:58:47 -0800
+Subject: memcg: fix memcg_size() calculation
+
+From: Vladimir Davydov <vdavydov@parallels.com>
+
+commit 695c60830764945cf61a2cc623eb1392d137223e upstream.
+
+The mem_cgroup structure contains nr_node_ids pointers to
+mem_cgroup_per_node objects, not the objects themselves.
+
+Signed-off-by: Vladimir Davydov <vdavydov@parallels.com>
+Acked-by: Michal Hocko <mhocko@suse.cz>
+Cc: Glauber Costa <glommer@openvz.org>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Cc: Balbir Singh <bsingharora@gmail.com>
+Cc: KAMEZAWA Hiroyuki <kamezawa.hiroyu@jp.fujitsu.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/memcontrol.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/memcontrol.c
++++ b/mm/memcontrol.c
+@@ -337,7 +337,7 @@ struct mem_cgroup {
+ static size_t memcg_size(void)
+ {
+ return sizeof(struct mem_cgroup) +
+- nr_node_ids * sizeof(struct mem_cgroup_per_node);
++ nr_node_ids * sizeof(struct mem_cgroup_per_node *);
+ }
+
+ /* internal only representation about the status of kmem accounting. */
--- /dev/null
+From 36d9f4d3b68c7035ead3850dc85f310a579ed0eb Mon Sep 17 00:00:00 2001
+From: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Date: Wed, 18 Dec 2013 14:36:18 +0100
+Subject: s390/3270: fix allocation of tty3270_screen structure
+
+From: Martin Schwidefsky <schwidefsky@de.ibm.com>
+
+commit 36d9f4d3b68c7035ead3850dc85f310a579ed0eb upstream.
+
+The tty3270_alloc_screen function is called from tty3270_install with
+swapped arguments, the number of columns instead of rows and vice versa.
+The number of rows is typically smaller than the number of columns which
+makes the screen array too big but the individual cell arrays for the
+lines too small. Creating lines longer than the number of rows will
+clobber the memory after the end of the cell array.
+The fix is simple, call tty3270_alloc_screen with the correct argument
+order.
+
+Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/s390/char/tty3270.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/s390/char/tty3270.c
++++ b/drivers/s390/char/tty3270.c
+@@ -942,7 +942,7 @@ static int tty3270_install(struct tty_dr
+ return rc;
+ }
+
+- tp->screen = tty3270_alloc_screen(tp->view.cols, tp->view.rows);
++ tp->screen = tty3270_alloc_screen(tp->view.rows, tp->view.cols);
+ if (IS_ERR(tp->screen)) {
+ rc = PTR_ERR(tp->screen);
+ raw3270_put_view(&tp->view);
mm-munlock-fix-deadlock-in-__munlock_pagevec.patch
mm-fix-use-after-free-in-sys_remap_file_pages.patch
mm-memory-failure.c-transfer-page-count-from-head-page-to-tail-page-after-split-thp.patch
+input-allocate-absinfo-data-when-setting-abs-capability.patch
+gfs2-don-t-hold-s_umount-over-blkdev_put.patch
+gfs2-fix-use-after-free-race-when-calling-gfs2_remove_from_ail.patch
+gfs2-fix-slab-memory-leak-in-gfs2_bufdata.patch
+gfs2-fix-incorrect-invalidation-for-dio-buffered-i-o.patch
+memcg-fix-memcg_size-calculation.patch
+arm-sun7i-dt-fix-interrupt-trigger-types.patch
+s390-3270-fix-allocation-of-tty3270_screen-structure.patch
+jbd2-don-t-bug-but-return-enospc-if-a-handle-runs-out-of-space.patch
+sh-pfc-fix-pinmux_gpio-macro.patch
+gpio-twl4030-fix-regression-for-twl-gpio-led-output.patch
+gpio-msm-fix-irq-mask-unmask-by-writing-bits-instead-of-numbers.patch
+sh-always-link-in-helper-functions-extracted-from-libgcc.patch
--- /dev/null
+From 84ed8a99058e61567f495cc43118344261641c5f Mon Sep 17 00:00:00 2001
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+Date: Wed, 18 Dec 2013 17:08:48 -0800
+Subject: sh: always link in helper functions extracted from libgcc
+
+From: Geert Uytterhoeven <geert@linux-m68k.org>
+
+commit 84ed8a99058e61567f495cc43118344261641c5f upstream.
+
+E.g. landisk_defconfig, which has CONFIG_NTFS_FS=m:
+
+ ERROR: "__ashrdi3" [fs/ntfs/ntfs.ko] undefined!
+
+For "lib-y", if no symbols in a compilation unit are referenced by other
+units, the compilation unit will not be included in vmlinux. This
+breaks modules that do reference those symbols.
+
+Use "obj-y" instead to fix this.
+
+http://kisskb.ellerman.id.au/kisskb/buildresult/8838077/
+
+This doesn't fix all cases. There are others, e.g. udivsi3.
+This is also not limited to sh, many architectures handle this in the
+same way.
+
+A simple solution is to unconditionally include all helper functions.
+A more complex solution is to make the choice of "lib-y" or "obj-y" depend
+on CONFIG_MODULES:
+
+ obj-$(CONFIG_MODULES) += ...
+ lib-y($CONFIG_MODULES) += ...
+
+Signed-off-by: Geert Uytterhoeven <geert@linux-m68k.org>
+Cc: Paul Mundt <lethal@linux-sh.org>
+Tested-by: Nobuhiro Iwamatsu <nobuhiro.iwamatsu.yj@renesas.com>
+Reviewed-by: Nobuhiro Iwamatsu <nobuhiro.iwamatsu.yj@renesas.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/sh/lib/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/sh/lib/Makefile
++++ b/arch/sh/lib/Makefile
+@@ -6,7 +6,7 @@ lib-y = delay.o memmove.o memchr.o \
+ checksum.o strlen.o div64.o div64-generic.o
+
+ # Extracted from libgcc
+-lib-y += movmem.o ashldi3.o ashrdi3.o lshrdi3.o \
++obj-y += movmem.o ashldi3.o ashrdi3.o lshrdi3.o \
+ ashlsi3.o ashrsi3.o ashiftrt.o lshrsi3.o \
+ udiv_qrnnd.o
+
--- /dev/null
+From 8620f394c4f9abd13e4fdf927d9c2bbeda74cde7 Mon Sep 17 00:00:00 2001
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Date: Tue, 26 Nov 2013 02:45:34 +0100
+Subject: sh-pfc: Fix PINMUX_GPIO macro
+
+From: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+
+commit 8620f394c4f9abd13e4fdf927d9c2bbeda74cde7 upstream.
+
+Commit 7cbb0e55e27e ("sh-pfc: Don't duplicate argument to PINMUX_GPIO
+macro") erronesouly modified the PINMUX_GPIO macro in a way that
+resulted in all pins being named "name". Fix the macro to name the pins
+correctly.
+
+Cc: stable@vger.kernel.org
+Signed-off-by: Laurent Pinchart <laurent.pinchart+renesas@ideasonboard.com>
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/pinctrl/sh-pfc/sh_pfc.h | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/pinctrl/sh-pfc/sh_pfc.h
++++ b/drivers/pinctrl/sh-pfc/sh_pfc.h
+@@ -254,7 +254,7 @@ struct sh_pfc_soc_info {
+ #define PINMUX_GPIO(_pin) \
+ [GPIO_##_pin] = { \
+ .pin = (u16)-1, \
+- .name = __stringify(name), \
++ .name = __stringify(GPIO_##_pin), \
+ .enum_id = _pin##_DATA, \
+ }
+
projects / thirdparty / kernel / stable-queue.git / commitdiff
