--- /dev/null
+From 92788ac1eb06e69a822de45e2a8a63fa45eb5be2 Mon Sep 17 00:00:00 2001
+From: Andrew Morton <akpm@linux-foundation.org>
+Date: Tue, 2 Dec 2014 15:59:31 -0800
+Subject: drivers/input/evdev.c: don't kfree() a vmalloc address
+
+From: Andrew Morton <akpm@linux-foundation.org>
+
+commit 92788ac1eb06e69a822de45e2a8a63fa45eb5be2 upstream.
+
+If kzalloc() failed and then evdev_open_device() fails, evdev_open()
+will pass a vmalloc'ed pointer to kfree.
+
+This might fix https://bugzilla.kernel.org/show_bug.cgi?id=88401, where
+there was a crash in kfree().
+
+Reported-by: Christian Casteyde <casteyde.christian@free.fr>
+Belatedly-Acked-by: Dmitry Torokhov <dmitry.torokhov@gmail.com>
+Cc: Henrik Rydberg <rydberg@euromail.se>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/input/evdev.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/input/evdev.c
++++ b/drivers/input/evdev.c
+@@ -421,7 +421,7 @@ static int evdev_open(struct inode *inod
+
+ err_free_client:
+ evdev_detach_client(evdev, client);
+- kfree(client);
++ kvfree(client);
+ return error;
+ }
+
--- /dev/null
+From b68362278af94e1171f5be9d4e44988601fb0439 Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Mon, 24 Nov 2014 17:02:45 +0100
+Subject: drm/i915: More cautious with pch fifo underruns
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+commit b68362278af94e1171f5be9d4e44988601fb0439 upstream.
+
+Apparently PCH fifo underruns are tricky, we have plenty reports that
+we see the occasional underrun (especially at boot-up).
+
+So for a change let's see what happens when we don't re-enable pch
+fifo underrun reporting when the pipe is disabled. This means that the
+kernel can't catch pch fifo underruns when they happen (except when
+all pipes are on on the pch). But we'll still catch underruns when
+disabling the pipe again. So not a terrible reduction in test
+coverage.
+
+Since the DRM_ERROR is new and hence a regression plan B would be to
+revert it back to a debug output. Which would be a lot worse than this
+hack for underrun test coverage in the wild. See the referenced
+discussions for more.
+
+References: http://mid.gmane.org/CA+gsUGRfGe3t4NcjdeA=qXysrhLY3r4CEu7z4bjTwxi1uOfy+g@mail.gmail.com
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=85898
+References: https://bugs.freedesktop.org/show_bug.cgi?id=85898
+References: https://bugs.freedesktop.org/show_bug.cgi?id=86233
+References: https://bugs.freedesktop.org/show_bug.cgi?id=86478
+Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
+Tested-by: lu hua <huax.lu@intel.com>
+Reviewed-by: Paulo Zanoni <paulo.r.zanoni@intel.com>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_display.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_display.c
++++ b/drivers/gpu/drm/i915/intel_display.c
+@@ -4209,7 +4209,6 @@ static void ironlake_crtc_disable(struct
+ ironlake_fdi_disable(crtc);
+
+ ironlake_disable_pch_transcoder(dev_priv, pipe);
+- intel_set_pch_fifo_underrun_reporting(dev, pipe, true);
+
+ if (HAS_PCH_CPT(dev)) {
+ /* disable TRANS_DP_CTL */
+@@ -4274,7 +4273,6 @@ static void haswell_crtc_disable(struct
+
+ if (intel_crtc->config.has_pch_encoder) {
+ lpt_disable_pch_transcoder(dev_priv);
+- intel_set_pch_fifo_underrun_reporting(dev, TRANSCODER_A, true);
+ intel_ddi_fdi_disable(crtc);
+ }
+
--- /dev/null
+From b0616c5306b342ceca07044dbc4f917d95c4f825 Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Mon, 1 Dec 2014 17:56:54 +0100
+Subject: drm/i915: Unlock panel even when LVDS is disabled
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+commit b0616c5306b342ceca07044dbc4f917d95c4f825 upstream.
+
+Otherwise we'll have backtraces in assert_panel_unlocked because the
+BIOS locks the register. In the reporter's case this regression was
+introduced in
+
+commit c31407a3672aaebb4acddf90944a114fa5c8af7b
+Author: Chris Wilson <chris@chris-wilson.co.uk>
+Date: Thu Oct 18 21:07:01 2012 +0100
+
+ drm/i915: Add no-lvds quirk for Supermicro X7SPA-H
+
+Reported-by: Alexey Orishko <alexey.orishko@gmail.com>
+Cc: Alexey Orishko <alexey.orishko@gmail.com>
+Cc: Chris Wilson <chris@chris-wilson.co.uk>
+Cc: Francois Tigeot <ftigeot@wolfpond.org>
+Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
+Tested-by: Alexey Orishko <alexey.orishko@gmail.com>
+Signed-off-by: Jani Nikula <jani.nikula@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/i915/intel_lvds.c | 22 +++++++++++-----------
+ 1 file changed, 11 insertions(+), 11 deletions(-)
+
+--- a/drivers/gpu/drm/i915/intel_lvds.c
++++ b/drivers/gpu/drm/i915/intel_lvds.c
+@@ -900,6 +900,17 @@ void intel_lvds_init(struct drm_device *
+ int pipe;
+ u8 pin;
+
++ /*
++ * Unlock registers and just leave them unlocked. Do this before
++ * checking quirk lists to avoid bogus WARNINGs.
++ */
++ if (HAS_PCH_SPLIT(dev)) {
++ I915_WRITE(PCH_PP_CONTROL,
++ I915_READ(PCH_PP_CONTROL) | PANEL_UNLOCK_REGS);
++ } else {
++ I915_WRITE(PP_CONTROL,
++ I915_READ(PP_CONTROL) | PANEL_UNLOCK_REGS);
++ }
+ if (!intel_lvds_supported(dev))
+ return;
+
+@@ -1098,17 +1109,6 @@ out:
+ lvds_encoder->a3_power = I915_READ(lvds_encoder->reg) &
+ LVDS_A3_POWER_MASK;
+
+- /*
+- * Unlock registers and just
+- * leave them unlocked
+- */
+- if (HAS_PCH_SPLIT(dev)) {
+- I915_WRITE(PCH_PP_CONTROL,
+- I915_READ(PCH_PP_CONTROL) | PANEL_UNLOCK_REGS);
+- } else {
+- I915_WRITE(PP_CONTROL,
+- I915_READ(PP_CONTROL) | PANEL_UNLOCK_REGS);
+- }
+ lvds_connector->lid_notifier.notifier_call = intel_lid_notify;
+ if (acpi_lid_notifier_register(&lvds_connector->lid_notifier)) {
+ DRM_DEBUG_KMS("lid notifier registration failed\n");
--- /dev/null
+From 226d63a1addea8cbe8fc671978e62dc84927b046 Mon Sep 17 00:00:00 2001
+From: Ilia Mirkin <imirkin@alum.mit.edu>
+Date: Sun, 30 Nov 2014 12:56:18 -0500
+Subject: drm/nouveau/gf116: remove copy1 engine
+
+From: Ilia Mirkin <imirkin@alum.mit.edu>
+
+commit 226d63a1addea8cbe8fc671978e62dc84927b046 upstream.
+
+Indications are that no GF116's actually have a copy engine there, but
+actually have the decompression engine. This engine can be made to do
+copies, but that should be done separately.
+
+Unclear why this didn't turn up on all GF116's, but perhaps the
+non-mobile ones came with enough VRAM to not trigger ttm migrations in
+test scenarios.
+
+Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=85465
+Fixes: https://bugs.freedesktop.org/show_bug.cgi?id=59168
+Signed-off-by: Ilia Mirkin <imirkin@alum.mit.edu>
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/nouveau/core/engine/device/nvc0.c | 1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c
++++ b/drivers/gpu/drm/nouveau/core/engine/device/nvc0.c
+@@ -212,7 +212,6 @@ nvc0_identify(struct nouveau_device *dev
+ device->oclass[NVDEV_ENGINE_BSP ] = &nvc0_bsp_oclass;
+ device->oclass[NVDEV_ENGINE_PPP ] = &nvc0_ppp_oclass;
+ device->oclass[NVDEV_ENGINE_COPY0 ] = &nvc0_copy0_oclass;
+- device->oclass[NVDEV_ENGINE_COPY1 ] = &nvc0_copy1_oclass;
+ device->oclass[NVDEV_ENGINE_DISP ] = nva3_disp_oclass;
+ device->oclass[NVDEV_ENGINE_PERFMON] = &nvc0_perfmon_oclass;
+ break;
--- /dev/null
+From a08b588e4199e4200d26027ffcdf3ab2fa906412 Mon Sep 17 00:00:00 2001
+From: Michel Dänzer <michel.daenzer@amd.com>
+Date: Thu, 27 Nov 2014 18:00:54 +0900
+Subject: drm/radeon: Ignore RADEON_GEM_GTT_WC on 32-bit x86
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Michel Dänzer <michel.daenzer@amd.com>
+
+commit a08b588e4199e4200d26027ffcdf3ab2fa906412 upstream.
+
+Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=84627
+Signed-off-by: Michel Dänzer <michel.daenzer@amd.com>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_object.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_object.c
++++ b/drivers/gpu/drm/radeon/radeon_object.c
+@@ -187,6 +187,13 @@ int radeon_bo_create(struct radeon_devic
+ if (!(rdev->flags & RADEON_IS_PCIE))
+ bo->flags &= ~(RADEON_GEM_GTT_WC | RADEON_GEM_GTT_UC);
+
++#ifdef CONFIG_X86_32
++ /* XXX: Write-combined CPU mappings of GTT seem broken on 32-bit
++ * See https://bugs.freedesktop.org/show_bug.cgi?id=84627
++ */
++ bo->flags &= ~RADEON_GEM_GTT_WC;
++#endif
++
+ radeon_ttm_placement_from_domain(bo, domain);
+ /* Kernel allocation are uninterruptible */
+ down_read(&rdev->pm.mclk_lock);
--- /dev/null
+From f5475cc43c899e33098d4db44b7c5e710f16589d Mon Sep 17 00:00:00 2001
+From: Petr Mladek <pmladek@suse.cz>
+Date: Thu, 27 Nov 2014 16:57:21 +0100
+Subject: drm/radeon: kernel panic in drm_calc_vbltimestamp_from_scanoutpos with 3.18.0-rc6
+
+From: Petr Mladek <pmladek@suse.cz>
+
+commit f5475cc43c899e33098d4db44b7c5e710f16589d upstream.
+
+I was unable too boot 3.18.0-rc6 because of the following kernel
+panic in drm_calc_vbltimestamp_from_scanoutpos():
+
+ [drm] Initialized drm 1.1.0 20060810
+ [drm] radeon kernel modesetting enabled.
+ [drm] initializing kernel modesetting (RV100 0x1002:0x515E 0x15D9:0x8080).
+ [drm] register mmio base: 0xC8400000
+ [drm] register mmio size: 65536
+ radeon 0000:0b:01.0: VRAM: 128M 0x00000000D0000000 - 0x00000000D7FFFFFF (16M used)
+ radeon 0000:0b:01.0: GTT: 512M 0x00000000B0000000 - 0x00000000CFFFFFFF
+ [drm] Detected VRAM RAM=128M, BAR=128M
+ [drm] RAM width 16bits DDR
+ [TTM] Zone kernel: Available graphics memory: 3829346 kiB
+ [TTM] Zone dma32: Available graphics memory: 2097152 kiB
+ [TTM] Initializing pool allocator
+ [TTM] Initializing DMA pool allocator
+ [drm] radeon: 16M of VRAM memory ready
+ [drm] radeon: 512M of GTT memory ready.
+ [drm] GART: num cpu pages 131072, num gpu pages 131072
+ [drm] PCI GART of 512M enabled (table at 0x0000000037880000).
+ radeon 0000:0b:01.0: WB disabled
+ radeon 0000:0b:01.0: fence driver on ring 0 use gpu addr 0x00000000b0000000 and cpu addr 0xffff8800bbbfa000
+ [drm] Supports vblank timestamp caching Rev 2 (21.10.2013).
+ [drm] Driver supports precise vblank timestamp query.
+ [drm] radeon: irq initialized.
+ [drm] Loading R100 Microcode
+ radeon 0000:0b:01.0: Direct firmware load for radeon/R100_cp.bin failed with error -2
+ radeon_cp: Failed to load firmware "radeon/R100_cp.bin"
+ [drm:r100_cp_init] *ERROR* Failed to load firmware!
+ radeon 0000:0b:01.0: failed initializing CP (-2).
+ radeon 0000:0b:01.0: Disabling GPU acceleration
+ [drm] radeon: cp finalized
+ BUG: unable to handle kernel NULL pointer dereference at 000000000000025c
+ IP: [<ffffffff8150423b>] drm_calc_vbltimestamp_from_scanoutpos+0x4b/0x320
+ PGD 0
+ Oops: 0000 [#1] SMP
+ Modules linked in:
+ CPU: 1 PID: 1 Comm: swapper/0 Not tainted 3.18.0-rc6-4-default #2649
+ Hardware name: Supermicro X7DB8/X7DB8, BIOS 6.00 07/26/2006
+ task: ffff880234da2010 ti: ffff880234da4000 task.ti: ffff880234da4000
+ RIP: 0010:[<ffffffff8150423b>] [<ffffffff8150423b>] drm_calc_vbltimestamp_from_scanoutpos+0x4b/0x320
+ RSP: 0000:ffff880234da7918 EFLAGS: 00010086
+ RAX: ffffffff81557890 RBX: 0000000000000000 RCX: ffff880234da7a48
+ RDX: ffff880234da79f4 RSI: 0000000000000000 RDI: ffff880232e15000
+ RBP: ffff880234da79b8 R08: 0000000000000000 R09: 0000000000000000
+ R10: 000000000000000a R11: 0000000000000001 R12: ffff880232dda1c0
+ R13: ffff880232e1518c R14: 0000000000000292 R15: ffff880232e15000
+ FS: 0000000000000000(0000) GS:ffff88023fc40000(0000) knlGS:0000000000000000
+ CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
+ CR2: 000000000000025c CR3: 0000000002014000 CR4: 00000000000007e0
+ Stack:
+ ffff880234da79d8 0000000000000286 ffff880232dcbc00 0000000000002480
+ ffff880234da7958 0000000000000296 ffff880234da7998 ffffffff8151b51d
+ ffff880234da7a48 0000000032dcbeb0 ffff880232dcbc00 ffff880232dcbc58
+ Call Trace:
+ [<ffffffff8151b51d>] ? drm_vma_offset_remove+0x1d/0x110
+ [<ffffffff8152dc98>] radeon_get_vblank_timestamp_kms+0x38/0x60
+ [<ffffffff8152076a>] ? ttm_bo_release_list+0xba/0x180
+ [<ffffffff81503751>] drm_get_last_vbltimestamp+0x41/0x70
+ [<ffffffff81503933>] vblank_disable_and_save+0x73/0x1d0
+ [<ffffffff81106b2f>] ? try_to_del_timer_sync+0x4f/0x70
+ [<ffffffff81505245>] drm_vblank_cleanup+0x65/0xa0
+ [<ffffffff815604fa>] radeon_irq_kms_fini+0x1a/0x70
+ [<ffffffff8156c07e>] r100_init+0x26e/0x410
+ [<ffffffff8152ae3e>] radeon_device_init+0x7ae/0xb50
+ [<ffffffff8152d57f>] radeon_driver_load_kms+0x8f/0x210
+ [<ffffffff81506965>] drm_dev_register+0xb5/0x110
+ [<ffffffff8150998f>] drm_get_pci_dev+0x8f/0x200
+ [<ffffffff815291cd>] radeon_pci_probe+0xad/0xe0
+ [<ffffffff8141a365>] local_pci_probe+0x45/0xa0
+ [<ffffffff8141b741>] pci_device_probe+0xd1/0x130
+ [<ffffffff81633dad>] driver_probe_device+0x12d/0x3e0
+ [<ffffffff8163413b>] __driver_attach+0x9b/0xa0
+ [<ffffffff816340a0>] ? __device_attach+0x40/0x40
+ [<ffffffff81631cd3>] bus_for_each_dev+0x63/0xa0
+ [<ffffffff8163378e>] driver_attach+0x1e/0x20
+ [<ffffffff81633390>] bus_add_driver+0x180/0x240
+ [<ffffffff81634914>] driver_register+0x64/0xf0
+ [<ffffffff81419cac>] __pci_register_driver+0x4c/0x50
+ [<ffffffff81509bf5>] drm_pci_init+0xf5/0x120
+ [<ffffffff821dc871>] ? ttm_init+0x6a/0x6a
+ [<ffffffff821dc908>] radeon_init+0x97/0xb5
+ [<ffffffff810002fc>] do_one_initcall+0xbc/0x1f0
+ [<ffffffff810e3278>] ? __wake_up+0x48/0x60
+ [<ffffffff8218e256>] kernel_init_freeable+0x18a/0x215
+ [<ffffffff8218d983>] ? initcall_blacklist+0xc0/0xc0
+ [<ffffffff818a78f0>] ? rest_init+0x80/0x80
+ [<ffffffff818a78fe>] kernel_init+0xe/0xf0
+ [<ffffffff818c0c3c>] ret_from_fork+0x7c/0xb0
+ [<ffffffff818a78f0>] ? rest_init+0x80/0x80
+ Code: 45 ac 0f 88 a8 01 00 00 3b b7 d0 01 00 00 49 89 ff 0f 83 99 01 00 00 48 8b 47 20 48 8b 80 88 00 00 00 48 85 c0 0f 84 cd 01 00 00 <41> 8b b1 5c 02 00 00 41 8b 89 58 02 00 00 89 75 98 41 8b b1 60
+ RIP [<ffffffff8150423b>] drm_calc_vbltimestamp_from_scanoutpos+0x4b/0x320
+ RSP <ffff880234da7918>
+ CR2: 000000000000025c
+ ---[ end trace ad2c0aadf48e2032 ]---
+ Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000009
+
+It has helped me to add a NULL pointer check that was suggested at
+http://lists.freedesktop.org/archives/dri-devel/2014-October/070663.html
+
+I am not familiar with the code. But the change looks sane
+and we need something fast at this stage of 3.18 development.
+
+Suggested-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Petr Mladek <pmladek@suse.cz>
+Tested-by: Petr Mladek <pmladek@suse.cz>
+Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_kms.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_kms.c
++++ b/drivers/gpu/drm/radeon/radeon_kms.c
+@@ -795,6 +795,8 @@ int radeon_get_vblank_timestamp_kms(stru
+
+ /* Get associated drm_crtc: */
+ drmcrtc = &rdev->mode_info.crtcs[crtc]->base;
++ if (!drmcrtc)
++ return -EINVAL;
+
+ /* Helper routine in DRM core does all the work: */
+ return drm_calc_vbltimestamp_from_scanoutpos(dev, crtc, max_error,
--- /dev/null
+From 1ead0e79bfedd4b563b8ea7c585ca3884b0c89a7 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Tue, 2 Dec 2014 15:59:37 -0800
+Subject: fat: fix oops on corrupted vfat fs
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit 1ead0e79bfedd4b563b8ea7c585ca3884b0c89a7 upstream.
+
+a) don't bother with ->d_time for positives - we only check it for
+ negatives anyway.
+
+b) make sure to set it at unlink and rmdir time - at *that* point
+ soon-to-be negative dentry matches then-current directory contents
+
+c) don't go into renaming of old alias in vfat_lookup() unless it
+ has the same parent (which it will, unless we are seeing corrupted
+ image)
+
+[hirofumi@mail.parknet.co.jp: make change minimum, don't call d_move() for dir]
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: OGAWA Hirofumi <hirofumi@mail.parknet.co.jp>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/fat/namei_vfat.c | 20 +++++++++++---------
+ 1 file changed, 11 insertions(+), 9 deletions(-)
+
+--- a/fs/fat/namei_vfat.c
++++ b/fs/fat/namei_vfat.c
+@@ -736,7 +736,12 @@ static struct dentry *vfat_lookup(struct
+ }
+
+ alias = d_find_alias(inode);
+- if (alias && !vfat_d_anon_disconn(alias)) {
++ /*
++ * Checking "alias->d_parent == dentry->d_parent" to make sure
++ * FS is not corrupted (especially double linked dir).
++ */
++ if (alias && alias->d_parent == dentry->d_parent &&
++ !vfat_d_anon_disconn(alias)) {
+ /*
+ * This inode has non anonymous-DCACHE_DISCONNECTED
+ * dentry. This means, the user did ->lookup() by an
+@@ -755,12 +760,9 @@ static struct dentry *vfat_lookup(struct
+
+ out:
+ mutex_unlock(&MSDOS_SB(sb)->s_lock);
+- dentry->d_time = dentry->d_parent->d_inode->i_version;
+- dentry = d_splice_alias(inode, dentry);
+- if (dentry)
+- dentry->d_time = dentry->d_parent->d_inode->i_version;
+- return dentry;
+-
++ if (!inode)
++ dentry->d_time = dir->i_version;
++ return d_splice_alias(inode, dentry);
+ error:
+ mutex_unlock(&MSDOS_SB(sb)->s_lock);
+ return ERR_PTR(err);
+@@ -793,7 +795,6 @@ static int vfat_create(struct inode *dir
+ inode->i_mtime = inode->i_atime = inode->i_ctime = ts;
+ /* timestamp is already written, so mark_inode_dirty() is unneeded. */
+
+- dentry->d_time = dentry->d_parent->d_inode->i_version;
+ d_instantiate(dentry, inode);
+ out:
+ mutex_unlock(&MSDOS_SB(sb)->s_lock);
+@@ -824,6 +825,7 @@ static int vfat_rmdir(struct inode *dir,
+ clear_nlink(inode);
+ inode->i_mtime = inode->i_atime = CURRENT_TIME_SEC;
+ fat_detach(inode);
++ dentry->d_time = dir->i_version;
+ out:
+ mutex_unlock(&MSDOS_SB(sb)->s_lock);
+
+@@ -849,6 +851,7 @@ static int vfat_unlink(struct inode *dir
+ clear_nlink(inode);
+ inode->i_mtime = inode->i_atime = CURRENT_TIME_SEC;
+ fat_detach(inode);
++ dentry->d_time = dir->i_version;
+ out:
+ mutex_unlock(&MSDOS_SB(sb)->s_lock);
+
+@@ -889,7 +892,6 @@ static int vfat_mkdir(struct inode *dir,
+ inode->i_mtime = inode->i_atime = inode->i_ctime = ts;
+ /* timestamp is already written, so mark_inode_dirty() is unneeded. */
+
+- dentry->d_time = dentry->d_parent->d_inode->i_version;
+ d_instantiate(dentry, inode);
+
+ mutex_unlock(&MSDOS_SB(sb)->s_lock);
--- /dev/null
+From 681d15a0f527af7ab3a783e1037de86fbcb136ac Mon Sep 17 00:00:00 2001
+From: Vishnu Motghare <vishnum@xilinx.com>
+Date: Wed, 3 Dec 2014 18:05:25 +0530
+Subject: i2c: cadence: Set the hardware time-out register to maximum value
+
+From: Vishnu Motghare <vishnum@xilinx.com>
+
+commit 681d15a0f527af7ab3a783e1037de86fbcb136ac upstream.
+
+Cadence I2C controller has bug wherein it generates invalid read transactions
+after timeout in master receiver mode. This driver does not use the HW
+timeout and this interrupt is disabled but the feature itself cannot be
+disabled. Hence, this patch writes the maximum value (0xFF) to this register.
+This is one of the workarounds to this bug and it will not avoid the issue
+completely but reduces the chances of error.
+
+Signed-off-by: Vishnu Motghare <vishnum@xilinx.com>
+Signed-off-by: Harini Katakam <harinik@xilinx.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-cadence.c | 11 +++++++++++
+ 1 file changed, 11 insertions(+)
+
+--- a/drivers/i2c/busses/i2c-cadence.c
++++ b/drivers/i2c/busses/i2c-cadence.c
+@@ -111,6 +111,8 @@
+ #define CDNS_I2C_DIVA_MAX 4
+ #define CDNS_I2C_DIVB_MAX 64
+
++#define CDNS_I2C_TIMEOUT_MAX 0xFF
++
+ #define cdns_i2c_readreg(offset) readl_relaxed(id->membase + offset)
+ #define cdns_i2c_writereg(val, offset) writel_relaxed(val, id->membase + offset)
+
+@@ -852,6 +854,15 @@ static int cdns_i2c_probe(struct platfor
+ goto err_clk_dis;
+ }
+
++ /*
++ * Cadence I2C controller has a bug wherein it generates
++ * invalid read transaction after HW timeout in master receiver mode.
++ * HW timeout is not used by this driver and the interrupt is disabled.
++ * But the feature itself cannot be disabled. Hence maximum value
++ * is written to this register to reduce the chances of error.
++ */
++ cdns_i2c_writereg(CDNS_I2C_TIMEOUT_MAX, CDNS_I2C_TIME_OUT_OFFSET);
++
+ dev_info(&pdev->dev, "%u kHz mmio %08lx irq %d\n",
+ id->i2c_clk / 1000, (unsigned long)r_mem->start, id->irq);
+
--- /dev/null
+From 9ea359f7314132cbcb5a502d2d8ef095be1f45e4 Mon Sep 17 00:00:00 2001
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+Date: Mon, 1 Dec 2014 17:34:04 +0200
+Subject: i2c: davinci: generate STP always when NACK is received
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Grygorii Strashko <grygorii.strashko@ti.com>
+
+commit 9ea359f7314132cbcb5a502d2d8ef095be1f45e4 upstream.
+
+According to I2C specification the NACK should be handled as follows:
+"When SDA remains HIGH during this ninth clock pulse, this is defined as the Not
+Acknowledge signal. The master can then generate either a STOP condition to
+abort the transfer, or a repeated START condition to start a new transfer."
+[I2C spec Rev. 6, 3.1.6: http://www.nxp.com/documents/user_manual/UM10204.pdf]
+
+Currently the Davinci i2c driver interrupts the transfer on receipt of a
+NACK but fails to send a STOP in some situations and so makes the bus
+stuck until next I2C IP reset (idle/enable).
+
+For example, the issue will happen during SMBus read transfer which
+consists from two i2c messages write command/address and read data:
+
+S Slave Address Wr A Command Code A Sr Slave Address Rd A D1..Dn A P
+<--- write -----------------------> <--- read --------------------->
+
+The I2C client device will send NACK if it can't recognize "Command Code"
+and it's expected from I2C master to generate STP in this case.
+But now, Davinci i2C driver will just exit with -EREMOTEIO and STP will
+not be generated.
+
+Hence, fix it by generating Stop condition (STP) always when NACK is received.
+
+This patch fixes Davinci I2C in the same way it was done for OMAP I2C
+commit cda2109a26eb ("i2c: omap: query STP always when NACK is received").
+
+Reviewed-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Reported-by: Hein Tibosch <hein_tibosch@yahoo.es>
+Signed-off-by: Grygorii Strashko <grygorii.strashko@ti.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-davinci.c | 8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-davinci.c
++++ b/drivers/i2c/busses/i2c-davinci.c
+@@ -411,11 +411,9 @@ i2c_davinci_xfer_msg(struct i2c_adapter
+ if (dev->cmd_err & DAVINCI_I2C_STR_NACK) {
+ if (msg->flags & I2C_M_IGNORE_NAK)
+ return msg->len;
+- if (stop) {
+- w = davinci_i2c_read_reg(dev, DAVINCI_I2C_MDR_REG);
+- w |= DAVINCI_I2C_MDR_STP;
+- davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, w);
+- }
++ w = davinci_i2c_read_reg(dev, DAVINCI_I2C_MDR_REG);
++ w |= DAVINCI_I2C_MDR_STP;
++ davinci_i2c_write_reg(dev, DAVINCI_I2C_MDR_REG, w);
+ return -EREMOTEIO;
+ }
+ return -EIO;
--- /dev/null
+From ccfc866356674cb3a61829d239c685af6e85f197 Mon Sep 17 00:00:00 2001
+From: Alexander Kochetkov <al.kochet@gmail.com>
+Date: Fri, 21 Nov 2014 04:16:51 +0400
+Subject: i2c: omap: fix i207 errata handling
+
+From: Alexander Kochetkov <al.kochet@gmail.com>
+
+commit ccfc866356674cb3a61829d239c685af6e85f197 upstream.
+
+commit 6d9939f651419a63e091105663821f9c7d3fec37 (i2c: omap: split out [XR]DR
+and [XR]RDY) changed the way how errata i207 (I2C: RDR Flag May Be Incorrectly
+Set) get handled. 6d9939f6514 code doesn't correspond to workaround provided by
+errata.
+
+According to errata ISR must filter out spurious RDR before data read not after.
+ISR must read RXSTAT to get number of bytes available to read. Because RDR
+could be set while there could no data in the receive FIFO.
+
+Restored pre 6d9939f6514 way of handling errata.
+
+Found by code review. Real impact haven't seen.
+Tested on Beagleboard XM C.
+
+Signed-off-by: Alexander Kochetkov <al.kochet@gmail.com>
+Fixes: 6d9939f651419a63e09110 i2c: omap: split out [XR]DR and [XR]RDY
+Tested-by: Felipe Balbi <balbi@ti.com>
+Reviewed-by: Felipe Balbi <balbi@ti.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-omap.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-omap.c
++++ b/drivers/i2c/busses/i2c-omap.c
+@@ -956,11 +956,13 @@ omap_i2c_isr_thread(int this_irq, void *
+ if (dev->fifo_size)
+ num_bytes = dev->buf_len;
+
+- omap_i2c_receive_data(dev, num_bytes, true);
+-
+- if (dev->errata & I2C_OMAP_ERRATA_I207)
++ if (dev->errata & I2C_OMAP_ERRATA_I207) {
+ i2c_omap_errata_i207(dev, stat);
++ num_bytes = (omap_i2c_read_reg(dev,
++ OMAP_I2C_BUFSTAT_REG) >> 8) & 0x3F;
++ }
+
++ omap_i2c_receive_data(dev, num_bytes, true);
+ omap_i2c_ack_stat(dev, OMAP_I2C_STAT_RDR);
+ continue;
+ }
--- /dev/null
+From 27caca9d2e01c92b26d0690f065aad093fea01c7 Mon Sep 17 00:00:00 2001
+From: Alexander Kochetkov <al.kochet@gmail.com>
+Date: Tue, 18 Nov 2014 21:00:58 +0400
+Subject: i2c: omap: fix NACK and Arbitration Lost irq handling
+
+From: Alexander Kochetkov <al.kochet@gmail.com>
+
+commit 27caca9d2e01c92b26d0690f065aad093fea01c7 upstream.
+
+commit 1d7afc95946487945cc7f5019b41255b72224b70 (i2c: omap: ack IRQ in parts)
+changed the interrupt handler to complete transfers without clearing
+XRDY (AL case) and ARDY (NACK case) flags. XRDY or ARDY interrupts will be
+fired again. As a result, ISR keep processing transfer after it was already
+complete (from the driver code point of view).
+
+A didn't see real impacts of the 1d7afc9, but it is really bad idea to
+have ISR running on user data after transfer was complete.
+
+It looks, what 1d7afc9 violate TI specs in what how AL and NACK should be
+handled (see Note 1, sprugn4r, Figure 17-31 and Figure 17-32).
+
+According to specs (if I understood correctly), in case of NACK and AL driver
+must reset NACK, AL, ARDY, RDR, and RRDY (Master Receive Mode), and
+NACK, AL, ARDY, and XDR (Master Transmitter Mode).
+
+All that is done down the code under the if condition:
+if (stat & (OMAP_I2C_STAT_ARDY | OMAP_I2C_STAT_NACK | OMAP_I2C_STAT_AL)) ...
+
+The patch restore pre 1d7afc9 logic of handling NACK and AL interrupts, so
+no interrupts is fired after ISR informs the rest of driver what transfer
+complete.
+
+Note: instead of removing break under NACK case, we could just replace 'break'
+with 'continue' and allow NACK transfer to finish using ARDY event. I found
+that NACK and ARDY bits usually set together. That case confirm TI wiki:
+http://processors.wiki.ti.com/index.php/I2C_Tips#Detecting_and_handling_NACK
+
+In order if someone interested in the event traces for NACK and AL cases,
+I sent them to mailing list.
+
+Tested on Beagleboard XM C.
+
+Signed-off-by: Alexander Kochetkov <al.kochet@gmail.com>
+Fixes: 1d7afc9 i2c: omap: ack IRQ in parts
+Acked-by: Felipe Balbi <balbi@ti.com>
+Tested-by: Aaro Koskinen <aaro.koskinen@iki.fi>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-omap.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-omap.c
++++ b/drivers/i2c/busses/i2c-omap.c
+@@ -926,14 +926,12 @@ omap_i2c_isr_thread(int this_irq, void *
+ if (stat & OMAP_I2C_STAT_NACK) {
+ err |= OMAP_I2C_STAT_NACK;
+ omap_i2c_ack_stat(dev, OMAP_I2C_STAT_NACK);
+- break;
+ }
+
+ if (stat & OMAP_I2C_STAT_AL) {
+ dev_err(dev->dev, "Arbitration lost\n");
+ err |= OMAP_I2C_STAT_AL;
+ omap_i2c_ack_stat(dev, OMAP_I2C_STAT_AL);
+- break;
+ }
+
+ /*
--- /dev/null
+From d2a74581390d8e5ed09b12c9d4736847d918dfa6 Mon Sep 17 00:00:00 2001
+From: David Härdeman <david@hardeman.nu>
+Date: Thu, 20 Nov 2014 18:09:54 -0300
+Subject: media: rc-core: fix toggle handling in the rc6 decoder
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: David Härdeman <david@hardeman.nu>
+
+commit d2a74581390d8e5ed09b12c9d4736847d918dfa6 upstream.
+
+The toggle bit shouldn't be cleared before the toggle value is calculated.
+
+This should probably go into 3.17.x as well.
+
+Fixes: 120703f9eb32 ([media] rc-core: document the protocol type)
+
+Tested-by: Stephan Raue <mailinglists@openelec.tv>
+Signed-off-by: David Härdeman <david@hardeman.nu>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/rc/ir-rc6-decoder.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/rc/ir-rc6-decoder.c
++++ b/drivers/media/rc/ir-rc6-decoder.c
+@@ -259,8 +259,8 @@ again:
+ case 32:
+ if ((scancode & RC6_6A_LCC_MASK) == RC6_6A_MCE_CC) {
+ protocol = RC_TYPE_RC6_MCE;
+- scancode &= ~RC6_6A_MCE_TOGGLE_MASK;
+ toggle = !!(scancode & RC6_6A_MCE_TOGGLE_MASK);
++ scancode &= ~RC6_6A_MCE_TOGGLE_MASK;
+ } else {
+ protocol = RC_BIT_RC6_6A_32;
+ toggle = 0;
--- /dev/null
+From 1f391217ad8d7cd7b1e48e6e2abf49970cd91d18 Mon Sep 17 00:00:00 2001
+From: sensoray-dev <linux-dev@sensoray.com>
+Date: Mon, 17 Nov 2014 19:50:36 -0300
+Subject: media: s2255drv: fix payload size for JPG, MJPEG
+
+From: sensoray-dev <linux-dev@sensoray.com>
+
+commit 1f391217ad8d7cd7b1e48e6e2abf49970cd91d18 upstream.
+
+length is the size of the buffer, not the payload. That's set using
+vb2_set_plane_payload().
+
+Signed-off-by: Dean Anderson <linux-dev@sensoray.com>
+Signed-off-by: Hans Verkuil <hans.verkuil@cisco.com>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/usb/s2255/s2255drv.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/usb/s2255/s2255drv.c
++++ b/drivers/media/usb/s2255/s2255drv.c
+@@ -632,7 +632,7 @@ static void s2255_fillbuff(struct s2255_
+ break;
+ case V4L2_PIX_FMT_JPEG:
+ case V4L2_PIX_FMT_MJPEG:
+- buf->vb.v4l2_buf.length = jpgsize;
++ vb2_set_plane_payload(&buf->vb, 0, jpgsize);
+ memcpy(vbuf, tmpbuf, jpgsize);
+ break;
+ case V4L2_PIX_FMT_YUV422P:
--- /dev/null
+From b31eb901c4e5eeef4c83c43dfbc7fe0d4348cb21 Mon Sep 17 00:00:00 2001
+From: Sakari Ailus <sakari.ailus@iki.fi>
+Date: Thu, 6 Nov 2014 17:49:45 -0300
+Subject: media: smiapp: Only some selection targets are settable
+
+From: Sakari Ailus <sakari.ailus@iki.fi>
+
+commit b31eb901c4e5eeef4c83c43dfbc7fe0d4348cb21 upstream.
+
+Setting a non-settable selection target caused BUG() to be called. The check
+for valid selections only takes the selection target into account, but does
+not tell whether it may be set, or only get. Fix the issue by simply
+returning an error to the user.
+
+Signed-off-by: Sakari Ailus <sakari.ailus@iki.fi>
+Signed-off-by: Mauro Carvalho Chehab <mchehab@osg.samsung.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/media/i2c/smiapp/smiapp-core.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/media/i2c/smiapp/smiapp-core.c
++++ b/drivers/media/i2c/smiapp/smiapp-core.c
+@@ -2133,7 +2133,7 @@ static int smiapp_set_selection(struct v
+ ret = smiapp_set_compose(subdev, fh, sel);
+ break;
+ default:
+- BUG();
++ ret = -EINVAL;
+ }
+
+ mutex_unlock(&sensor->mutex);
--- /dev/null
+From c4ea95d7cd08d9ffd7fa75e6c5e0332d596dd11e Mon Sep 17 00:00:00 2001
+From: Daniel Forrest <dan.forrest@ssec.wisc.edu>
+Date: Tue, 2 Dec 2014 15:59:42 -0800
+Subject: mm: fix anon_vma_clone() error treatment
+
+From: Daniel Forrest <dan.forrest@ssec.wisc.edu>
+
+commit c4ea95d7cd08d9ffd7fa75e6c5e0332d596dd11e upstream.
+
+Andrew Morton noticed that the error return from anon_vma_clone() was
+being dropped and replaced with -ENOMEM (which is not itself a bug
+because the only error return value from anon_vma_clone() is -ENOMEM).
+
+I did an audit of callers of anon_vma_clone() and discovered an actual
+bug where the error return was being lost. In __split_vma(), between
+Linux 3.11 and 3.12 the code was changed so the err variable is used
+before the call to anon_vma_clone() and the default initial value of
+-ENOMEM is overwritten. So a failure of anon_vma_clone() will return
+success since err at this point is now zero.
+
+Below is a patch which fixes this bug and also propagates the error
+return value from anon_vma_clone() in all cases.
+
+Fixes: ef0855d334e1 ("mm: mempolicy: turn vma_set_policy() into vma_dup_policy()")
+Signed-off-by: Daniel Forrest <dan.forrest@ssec.wisc.edu>
+Reviewed-by: Michal Hocko <mhocko@suse.cz>
+Cc: Konstantin Khlebnikov <koct9i@gmail.com>
+Cc: Andrea Arcangeli <aarcange@redhat.com>
+Cc: Rik van Riel <riel@redhat.com>
+Cc: Tim Hartrick <tim@edgecast.com>
+Cc: Hugh Dickins <hughd@google.com>
+Cc: Michel Lespinasse <walken@google.com>
+Cc: Vlastimil Babka <vbabka@suse.cz>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/mmap.c | 10 +++++++---
+ mm/rmap.c | 6 ++++--
+ 2 files changed, 11 insertions(+), 5 deletions(-)
+
+--- a/mm/mmap.c
++++ b/mm/mmap.c
+@@ -752,8 +752,11 @@ again: remove_next = 1 + (end > next->
+ * shrinking vma had, to cover any anon pages imported.
+ */
+ if (exporter && exporter->anon_vma && !importer->anon_vma) {
+- if (anon_vma_clone(importer, exporter))
+- return -ENOMEM;
++ int error;
++
++ error = anon_vma_clone(importer, exporter);
++ if (error)
++ return error;
+ importer->anon_vma = exporter->anon_vma;
+ }
+ }
+@@ -2453,7 +2456,8 @@ static int __split_vma(struct mm_struct
+ if (err)
+ goto out_free_vma;
+
+- if (anon_vma_clone(new, vma))
++ err = anon_vma_clone(new, vma);
++ if (err)
+ goto out_free_mpol;
+
+ if (new->vm_file)
+--- a/mm/rmap.c
++++ b/mm/rmap.c
+@@ -274,6 +274,7 @@ int anon_vma_fork(struct vm_area_struct
+ {
+ struct anon_vma_chain *avc;
+ struct anon_vma *anon_vma;
++ int error;
+
+ /* Don't bother if the parent process has no anon_vma here. */
+ if (!pvma->anon_vma)
+@@ -283,8 +284,9 @@ int anon_vma_fork(struct vm_area_struct
+ * First, attach the new VMA to the parent VMA's anon_vmas,
+ * so rmap can find non-COWed pages in child processes.
+ */
+- if (anon_vma_clone(vma, pvma))
+- return -ENOMEM;
++ error = anon_vma_clone(vma, pvma);
++ if (error)
++ return error;
+
+ /* Then add our own anon_vma. */
+ anon_vma = anon_vma_alloc();
--- /dev/null
+From 2022b4d18a491a578218ce7a4eca8666db895a73 Mon Sep 17 00:00:00 2001
+From: Hugh Dickins <hughd@google.com>
+Date: Tue, 2 Dec 2014 15:59:39 -0800
+Subject: mm: fix swapoff hang after page migration and fork
+
+From: Hugh Dickins <hughd@google.com>
+
+commit 2022b4d18a491a578218ce7a4eca8666db895a73 upstream.
+
+I've been seeing swapoff hangs in recent testing: it's cycling around
+trying unsuccessfully to find an mm for some remaining pages of swap.
+
+I have been exercising swap and page migration more heavily recently,
+and now notice a long-standing error in copy_one_pte(): it's trying to
+add dst_mm to swapoff's mmlist when it finds a swap entry, but is doing
+so even when it's a migration entry or an hwpoison entry.
+
+Which wouldn't matter much, except it adds dst_mm next to src_mm,
+assuming src_mm is already on the mmlist: which may not be so. Then if
+pages are later swapped out from dst_mm, swapoff won't be able to find
+where to replace them.
+
+There's already a !non_swap_entry() test for stats: move that up before
+the swap_duplicate() and the addition to mmlist.
+
+Signed-off-by: Hugh Dickins <hughd@google.com>
+Cc: Kelley Nielsen <kelleynnn@gmail.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/memory.c | 24 ++++++++++++------------
+ 1 file changed, 12 insertions(+), 12 deletions(-)
+
+--- a/mm/memory.c
++++ b/mm/memory.c
+@@ -815,20 +815,20 @@ copy_one_pte(struct mm_struct *dst_mm, s
+ if (!pte_file(pte)) {
+ swp_entry_t entry = pte_to_swp_entry(pte);
+
+- if (swap_duplicate(entry) < 0)
+- return entry.val;
++ if (likely(!non_swap_entry(entry))) {
++ if (swap_duplicate(entry) < 0)
++ return entry.val;
+
+- /* make sure dst_mm is on swapoff's mmlist. */
+- if (unlikely(list_empty(&dst_mm->mmlist))) {
+- spin_lock(&mmlist_lock);
+- if (list_empty(&dst_mm->mmlist))
+- list_add(&dst_mm->mmlist,
+- &src_mm->mmlist);
+- spin_unlock(&mmlist_lock);
+- }
+- if (likely(!non_swap_entry(entry)))
++ /* make sure dst_mm is on swapoff's mmlist. */
++ if (unlikely(list_empty(&dst_mm->mmlist))) {
++ spin_lock(&mmlist_lock);
++ if (list_empty(&dst_mm->mmlist))
++ list_add(&dst_mm->mmlist,
++ &src_mm->mmlist);
++ spin_unlock(&mmlist_lock);
++ }
+ rss[MM_SWAPENTS]++;
+- else if (is_migration_entry(entry)) {
++ } else if (is_migration_entry(entry)) {
+ page = migration_entry_to_page(entry);
+
+ if (PageAnon(page))
--- /dev/null
+From fb993fa1a2f669215fa03a09eed7848f2663e336 Mon Sep 17 00:00:00 2001
+From: Weijie Yang <weijie.yang@samsung.com>
+Date: Tue, 2 Dec 2014 15:59:25 -0800
+Subject: mm: frontswap: invalidate expired data on a dup-store failure
+
+From: Weijie Yang <weijie.yang@samsung.com>
+
+commit fb993fa1a2f669215fa03a09eed7848f2663e336 upstream.
+
+If a frontswap dup-store failed, it should invalidate the expired page
+in the backend, or it could trigger some data corruption issue.
+Such as:
+ 1. use zswap as the frontswap backend with writeback feature
+ 2. store a swap page(version_1) to entry A, success
+ 3. dup-store a newer page(version_2) to the same entry A, fail
+ 4. use __swap_writepage() write version_2 page to swapfile, success
+ 5. zswap do shrink, writeback version_1 page to swapfile
+ 6. version_2 page is overwrited by version_1, data corrupt.
+
+This patch fixes this issue by invalidating expired data immediately
+when meet a dup-store failure.
+
+Signed-off-by: Weijie Yang <weijie.yang@samsung.com>
+Cc: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
+Cc: Seth Jennings <sjennings@variantweb.net>
+Cc: Dan Streetman <ddstreet@ieee.org>
+Cc: Minchan Kim <minchan@kernel.org>
+Cc: Bob Liu <bob.liu@oracle.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/frontswap.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/mm/frontswap.c
++++ b/mm/frontswap.c
+@@ -244,8 +244,10 @@ int __frontswap_store(struct page *page)
+ the (older) page from frontswap
+ */
+ inc_frontswap_failed_stores();
+- if (dup)
++ if (dup) {
+ __frontswap_clear(sis, offset);
++ frontswap_ops->invalidate_page(type, offset);
++ }
+ }
+ if (frontswap_writethrough_enabled)
+ /* report failure so swap also writes to swap device */
--- /dev/null
+From 91b57191cfd152c02ded0745250167d0263084f8 Mon Sep 17 00:00:00 2001
+From: Andrew Morton <akpm@linux-foundation.org>
+Date: Tue, 2 Dec 2014 15:59:28 -0800
+Subject: mm/vmpressure.c: fix race in vmpressure_work_fn()
+
+From: Andrew Morton <akpm@linux-foundation.org>
+
+commit 91b57191cfd152c02ded0745250167d0263084f8 upstream.
+
+In some android devices, there will be a "divide by zero" exception.
+vmpr->scanned could be zero before spin_lock(&vmpr->sr_lock).
+
+Addresses https://bugzilla.kernel.org/show_bug.cgi?id=88051
+
+[akpm@linux-foundation.org: neaten]
+Reported-by: ji_ang <ji_ang@163.com>
+Cc: Anton Vorontsov <anton.vorontsov@linaro.org>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/vmpressure.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/mm/vmpressure.c
++++ b/mm/vmpressure.c
+@@ -165,6 +165,7 @@ static void vmpressure_work_fn(struct wo
+ unsigned long scanned;
+ unsigned long reclaimed;
+
++ spin_lock(&vmpr->sr_lock);
+ /*
+ * Several contexts might be calling vmpressure(), so it is
+ * possible that the work was rescheduled again before the old
+@@ -173,11 +174,12 @@ static void vmpressure_work_fn(struct wo
+ * here. No need for any locks here since we don't care if
+ * vmpr->reclaimed is in sync.
+ */
+- if (!vmpr->scanned)
++ scanned = vmpr->scanned;
++ if (!scanned) {
++ spin_unlock(&vmpr->sr_lock);
+ return;
++ }
+
+- spin_lock(&vmpr->sr_lock);
+- scanned = vmpr->scanned;
+ reclaimed = vmpr->reclaimed;
+ vmpr->scanned = 0;
+ vmpr->reclaimed = 0;
--- /dev/null
+From 8b62c8c6df08ca567c78afa51aa7bbc554cede06 Mon Sep 17 00:00:00 2001
+From: Dave Airlie <airlied@redhat.com>
+Date: Tue, 2 Dec 2014 16:27:25 +1000
+Subject: nouveau: move the hotplug ignore to correct place.
+
+From: Dave Airlie <airlied@redhat.com>
+
+commit 8b62c8c6df08ca567c78afa51aa7bbc554cede06 upstream.
+
+Introduced in b440bde74f, however it was added to
+the wrong function in nouveau.
+
+https://bugzilla.kernel.org/show_bug.cgi?id=86011
+Cc: Bjorn Helgaas <bhelgaas@google.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/nouveau/nouveau_drm.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/gpu/drm/nouveau/nouveau_drm.c
++++ b/drivers/gpu/drm/nouveau/nouveau_drm.c
+@@ -626,7 +626,6 @@ int nouveau_pmops_suspend(struct device
+
+ pci_save_state(pdev);
+ pci_disable_device(pdev);
+- pci_ignore_hotplug(pdev);
+ pci_set_power_state(pdev, PCI_D3hot);
+ return 0;
+ }
+@@ -930,6 +929,7 @@ static int nouveau_pmops_runtime_suspend
+ ret = nouveau_do_suspend(drm_dev, true);
+ pci_save_state(pdev);
+ pci_disable_device(pdev);
++ pci_ignore_hotplug(pdev);
+ pci_set_power_state(pdev, PCI_D3cold);
+ drm_dev->switch_power_state = DRM_SWITCH_POWER_DYNAMIC_OFF;
+ return ret;
--- /dev/null
+From 094cb98179f19b75acf9ff471daabf3948ce98e6 Mon Sep 17 00:00:00 2001
+From: Ian Campbell <ian.campbell@citrix.com>
+Date: Tue, 25 Nov 2014 15:05:13 +0000
+Subject: of/fdt: memblock_reserve /memreserve/ regions in the case of partial overlap
+
+From: Ian Campbell <ian.campbell@citrix.com>
+
+commit 094cb98179f19b75acf9ff471daabf3948ce98e6 upstream.
+
+memblock_is_region_reserved() returns true in the case of a partial
+overlap, meaning that the current code fails to reserve the
+non-overlapping portion.
+
+This call was introduced as part of d1552ce449eb "of/fdt: move
+memreserve and dtb memory reservations into core" which went into
+v3.16.
+
+I observed this causing a Midway system with a buggy fdt (the header
+declares itself to be larger than it really is) failing to boot
+because the over-inflated size of the fdt was causing it to seem to
+run into the swapper_pg_dir region, meaning the DT wasn't reserved.
+The symptoms were failing to find an disks or network and failing to
+boot.
+
+However given the ambiguity of whether things like the initrd are
+covered by /memreserve/ and similar I think it is best to also
+register the region rather than just ignoring it.
+
+Since memblock_reserve() handles overlaps just fine lets just warn and
+carry on.
+
+Signed-off-by: Ian Campbell <ian.campbell@citrix.com>
+Signed-off-by: Grant Likely <grant.likely@linaro.org>
+Cc: Rob Herring <robh+dt@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/of/fdt.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/of/fdt.c
++++ b/drivers/of/fdt.c
+@@ -964,8 +964,6 @@ void __init __weak early_init_dt_add_mem
+ int __init __weak early_init_dt_reserve_memory_arch(phys_addr_t base,
+ phys_addr_t size, bool nomap)
+ {
+- if (memblock_is_region_reserved(base, size))
+- return -EBUSY;
+ if (nomap)
+ return memblock_remove(base, size);
+ return memblock_reserve(base, size);
of-fdt-memblock_reserve-memreserve-regions-in-the-case-of-partial-overlap.patch
drm-i915-more-cautious-with-pch-fifo-underruns.patch
drm-i915-unlock-panel-even-when-lvds-is-disabled.patch
+x86-use-objdump-instead-of-plain-objdump.patch
+media-rc-core-fix-toggle-handling-in-the-rc6-decoder.patch
+media-s2255drv-fix-payload-size-for-jpg-mjpeg.patch
+media-smiapp-only-some-selection-targets-are-settable.patch
--- /dev/null
+From 7c3fbbdd04a681a1992ad6a3d7a36a63ff668753 Mon Sep 17 00:00:00 2001
+From: Paul Mackerras <paulus@samba.org>
+Date: Tue, 2 Dec 2014 15:59:48 -0800
+Subject: slab: fix nodeid bounds check for non-contiguous node IDs
+
+From: Paul Mackerras <paulus@samba.org>
+
+commit 7c3fbbdd04a681a1992ad6a3d7a36a63ff668753 upstream.
+
+The bounds check for nodeid in ____cache_alloc_node gives false
+positives on machines where the node IDs are not contiguous, leading to
+a panic at boot time. For example, on a POWER8 machine the node IDs are
+typically 0, 1, 16 and 17. This means that num_online_nodes() returns
+4, so when ____cache_alloc_node is called with nodeid = 16 the VM_BUG_ON
+triggers, like this:
+
+ kernel BUG at /home/paulus/kernel/kvm/mm/slab.c:3079!
+ Call Trace:
+ .____cache_alloc_node+0x5c/0x270 (unreliable)
+ .kmem_cache_alloc_node_trace+0xdc/0x360
+ .init_list+0x3c/0x128
+ .kmem_cache_init+0x1dc/0x258
+ .start_kernel+0x2a0/0x568
+ start_here_common+0x20/0xa8
+
+To fix this, we instead compare the nodeid with MAX_NUMNODES, and
+additionally make sure it isn't negative (since nodeid is an int). The
+check is there mainly to protect the array dereference in the get_node()
+call in the next line, and the array being dereferenced is of size
+MAX_NUMNODES. If the nodeid is in range but invalid (for example if the
+node is off-line), the BUG_ON in the next line will catch that.
+
+Fixes: 14e50c6a9bc2 ("mm: slab: Verify the nodeid passed to ____cache_alloc_node")
+Signed-off-by: Paul Mackerras <paulus@samba.org>
+Reviewed-by: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
+Reviewed-by: Pekka Enberg <penberg@kernel.org>
+Acked-by: David Rientjes <rientjes@google.com>
+Cc: Christoph Lameter <cl@linux.com>
+Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/slab.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/mm/slab.c
++++ b/mm/slab.c
+@@ -3108,7 +3108,7 @@ static void *____cache_alloc_node(struct
+ void *obj;
+ int x;
+
+- VM_BUG_ON(nodeid > num_online_nodes());
++ VM_BUG_ON(nodeid < 0 || nodeid >= MAX_NUMNODES);
+ n = get_node(cachep, nodeid);
+ BUG_ON(!n);
+
--- /dev/null
+From e2e68ae688b0a3766cd75aedf4ed4e39be402009 Mon Sep 17 00:00:00 2001
+From: Chris Clayton <chris2553@googlemail.com>
+Date: Sat, 22 Nov 2014 09:51:10 +0000
+Subject: x86: Use $(OBJDUMP) instead of plain objdump
+
+From: Chris Clayton <chris2553@googlemail.com>
+
+commit e2e68ae688b0a3766cd75aedf4ed4e39be402009 upstream.
+
+commit e6023367d779 'x86, kaslr: Prevent .bss from overlaping initrd'
+broke the cross compile of x86. It added a objdump invocation, which
+invokes the host native objdump and ignores an active cross tool
+chain.
+
+Use $(OBJDUMP) instead which takes the CROSS_COMPILE prefix into
+account.
+
+[ tglx: Massage changelog and use $(OBJDUMP) ]
+
+Fixes: e6023367d779 'x86, kaslr: Prevent .bss from overlaping initrd'
+Signed-off-by: Chris Clayton <chris2553@googlemail.com>
+Acked-by: Kees Cook <keescook@chromium.org>
+Acked-by: Borislav Petkov <bp@suse.de>
+Cc: Junjie Mao <eternal.n08@gmail.com>
+Cc: Ingo Molnar <mingo@kernel.org>
+Cc: H. Peter Anvin <hpa@linux.intel.com>
+Link: http://lkml.kernel.org/r/54705C8E.1080400@googlemail.com
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/boot/compressed/Makefile | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/x86/boot/compressed/Makefile
++++ b/arch/x86/boot/compressed/Makefile
+@@ -75,7 +75,7 @@ suffix-$(CONFIG_KERNEL_XZ) := xz
+ suffix-$(CONFIG_KERNEL_LZO) := lzo
+ suffix-$(CONFIG_KERNEL_LZ4) := lz4
+
+-RUN_SIZE = $(shell objdump -h vmlinux | \
++RUN_SIZE = $(shell $(OBJDUMP) -h vmlinux | \
+ perl $(srctree)/arch/x86/tools/calc_run_size.pl)
+ quiet_cmd_mkpiggy = MKPIGGY $@
+ cmd_mkpiggy = $(obj)/mkpiggy $< $(RUN_SIZE) > $@ || ( rm -f $@ ; false )
--- /dev/null
+From 8d609725d4357f499e2103e46011308b32f53513 Mon Sep 17 00:00:00 2001
+From: Seth Forshee <seth.forshee@canonical.com>
+Date: Tue, 25 Nov 2014 20:28:24 -0600
+Subject: xen-netfront: Remove BUGs on paged skb data which crosses a page boundary
+
+From: Seth Forshee <seth.forshee@canonical.com>
+
+commit 8d609725d4357f499e2103e46011308b32f53513 upstream.
+
+These BUGs can be erroneously triggered by frags which refer to
+tail pages within a compound page. The data in these pages may
+overrun the hardware page while still being contained within the
+compound page, but since compound_order() evaluates to 0 for tail
+pages the assertion fails. The code already iterates through
+subsequent pages correctly in this scenario, so the BUGs are
+unnecessary and can be removed.
+
+Fixes: f36c374782e4 ("xen/netfront: handle compound page fragments on transmit")
+Signed-off-by: Seth Forshee <seth.forshee@canonical.com>
+Reviewed-by: David Vrabel <david.vrabel@citrix.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/xen-netfront.c | 5 -----
+ 1 file changed, 5 deletions(-)
+
+--- a/drivers/net/xen-netfront.c
++++ b/drivers/net/xen-netfront.c
+@@ -496,9 +496,6 @@ static void xennet_make_frags(struct sk_
+ len = skb_frag_size(frag);
+ offset = frag->page_offset;
+
+- /* Data must not cross a page boundary. */
+- BUG_ON(len + offset > PAGE_SIZE<<compound_order(page));
+-
+ /* Skip unused frames from start of page */
+ page += offset >> PAGE_SHIFT;
+ offset &= ~PAGE_MASK;
+@@ -506,8 +503,6 @@ static void xennet_make_frags(struct sk_
+ while (len > 0) {
+ unsigned long bytes;
+
+- BUG_ON(offset >= PAGE_SIZE);
+-
+ bytes = PAGE_SIZE - offset;
+ if (bytes > len)
+ bytes = len;
projects / thirdparty / kernel / stable-queue.git / commitdiff
