--- /dev/null
+From 8134233e8d346aaa1c929dc510e75482ae318bce Mon Sep 17 00:00:00 2001
+From: Dan Carpenter <dan.carpenter@oracle.com>
+Date: Thu, 10 Mar 2016 10:45:32 +0300
+Subject: ata: ahci_xgene: dereferencing uninitialized pointer in probe
+
+From: Dan Carpenter <dan.carpenter@oracle.com>
+
+commit 8134233e8d346aaa1c929dc510e75482ae318bce upstream.
+
+If the call to acpi_get_object_info() fails then "info" hasn't been
+initialized. In that situation, we already know that "version" should
+be XGENE_AHCI_V1 so we don't actually need to dereference "info".
+
+Fixes: c9802a4be661 ('ata: ahci_xgene: Add AHCI Support for 2nd HW version of APM X-Gene SoC AHCI SATA Host controller.')
+Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/ata/ahci_xgene.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/ata/ahci_xgene.c
++++ b/drivers/ata/ahci_xgene.c
+@@ -739,9 +739,9 @@ static int xgene_ahci_probe(struct platf
+ dev_warn(&pdev->dev, "%s: Error reading device info. Assume version1\n",
+ __func__);
+ version = XGENE_AHCI_V1;
+- }
+- if (info->valid & ACPI_VALID_CID)
++ } else if (info->valid & ACPI_VALID_CID) {
+ version = XGENE_AHCI_V2;
++ }
+ }
+ }
+ #endif
--- /dev/null
+From 50359819794b4a16ae35051cd80f2dab025f6019 Mon Sep 17 00:00:00 2001
+From: Heiko Stuebner <heiko@sntech.de>
+Date: Thu, 21 Jan 2016 21:53:09 +0100
+Subject: clk-divider: make sure read-only dividers do not write to their register
+
+From: Heiko Stuebner <heiko@sntech.de>
+
+commit 50359819794b4a16ae35051cd80f2dab025f6019 upstream.
+
+Commit e6d5e7d90be9 ("clk-divider: Fix READ_ONLY when divider > 1") removed
+the special ops struct for read-only clocks and instead opted to handle
+them inside the regular ops.
+
+On the rk3368 this results in breakage as aclkm now gets set a value.
+While it is the same divider value, the A53 core still doesn't like it,
+which can result in the cpu ending up in a hang.
+The reason being that "ACLKENMasserts one clock cycle before the rising
+edge of ACLKM" and the clock should only be touched when STANDBYWFIL2
+is asserted.
+
+To fix this, reintroduce the read-only ops but do include the round_rate
+callback. That way no writes that may be unsafe are done to the divider
+register in any case.
+
+The Rockchip use of the clk_divider_ops is adapted to this split again,
+as is the nxp, lpc18xx-ccu driver that was included since the original
+commit. On lpc18xx-ccu the divider seems to always be read-only
+so only uses the new ops now.
+
+Fixes: e6d5e7d90be9 ("clk-divider: Fix READ_ONLY when divider > 1")
+Reported-by: Zhang Qing <zhangqing@rock-chips.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/clk-divider.c | 11 ++++++++++-
+ drivers/clk/nxp/clk-lpc18xx-ccu.c | 2 +-
+ drivers/clk/rockchip/clk.c | 4 +++-
+ include/linux/clk-provider.h | 1 +
+ 4 files changed, 15 insertions(+), 3 deletions(-)
+
+--- a/drivers/clk/clk-divider.c
++++ b/drivers/clk/clk-divider.c
+@@ -422,6 +422,12 @@ const struct clk_ops clk_divider_ops = {
+ };
+ EXPORT_SYMBOL_GPL(clk_divider_ops);
+
++const struct clk_ops clk_divider_ro_ops = {
++ .recalc_rate = clk_divider_recalc_rate,
++ .round_rate = clk_divider_round_rate,
++};
++EXPORT_SYMBOL_GPL(clk_divider_ro_ops);
++
+ static struct clk *_register_divider(struct device *dev, const char *name,
+ const char *parent_name, unsigned long flags,
+ void __iomem *reg, u8 shift, u8 width,
+@@ -445,7 +451,10 @@ static struct clk *_register_divider(str
+ return ERR_PTR(-ENOMEM);
+
+ init.name = name;
+- init.ops = &clk_divider_ops;
++ if (clk_divider_flags & CLK_DIVIDER_READ_ONLY)
++ init.ops = &clk_divider_ro_ops;
++ else
++ init.ops = &clk_divider_ops;
+ init.flags = flags | CLK_IS_BASIC;
+ init.parent_names = (parent_name ? &parent_name: NULL);
+ init.num_parents = (parent_name ? 1 : 0);
+--- a/drivers/clk/nxp/clk-lpc18xx-ccu.c
++++ b/drivers/clk/nxp/clk-lpc18xx-ccu.c
+@@ -222,7 +222,7 @@ static void lpc18xx_ccu_register_branch_
+ div->width = 1;
+
+ div_hw = &div->hw;
+- div_ops = &clk_divider_ops;
++ div_ops = &clk_divider_ro_ops;
+ }
+
+ branch->gate.reg = branch->offset + reg_base;
+--- a/drivers/clk/rockchip/clk.c
++++ b/drivers/clk/rockchip/clk.c
+@@ -90,7 +90,9 @@ static struct clk *rockchip_clk_register
+ div->width = div_width;
+ div->lock = lock;
+ div->table = div_table;
+- div_ops = &clk_divider_ops;
++ div_ops = (div_flags & CLK_DIVIDER_READ_ONLY)
++ ? &clk_divider_ro_ops
++ : &clk_divider_ops;
+ }
+
+ clk = clk_register_composite(NULL, name, parent_names, num_parents,
+--- a/include/linux/clk-provider.h
++++ b/include/linux/clk-provider.h
+@@ -384,6 +384,7 @@ struct clk_divider {
+ #define CLK_DIVIDER_MAX_AT_ZERO BIT(6)
+
+ extern const struct clk_ops clk_divider_ops;
++extern const struct clk_ops clk_divider_ro_ops;
+
+ unsigned long divider_recalc_rate(struct clk_hw *hw, unsigned long parent_rate,
+ unsigned int val, const struct clk_div_table *table,
--- /dev/null
+From bb473593c8099302bfd7befc23de67df907e3a99 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Andreas=20F=C3=A4rber?= <afaerber@suse.de>
+Date: Sun, 7 Feb 2016 22:13:03 +0100
+Subject: clk: meson: Fix meson_clk_register_clks() signature type mismatch
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Andreas Färber <afaerber@suse.de>
+
+commit bb473593c8099302bfd7befc23de67df907e3a99 upstream.
+
+As preparation for arm64 based mesongxbb, which pulls in this code once
+enabling ARCH_MESON, fix a size_t vs. unsigned int type mismatch.
+The loop uses a local unsigned int variable, so adopt that type,
+matching the header.
+
+Fixes: 7a29a869434e ("clk: meson: Add support for Meson clock controller")
+Signed-off-by: Andreas Färber <afaerber@suse.de>
+Acked-by: Carlo Caione <carlo@endlessm.com>
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/meson/clkc.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/meson/clkc.c
++++ b/drivers/clk/meson/clkc.c
+@@ -198,7 +198,7 @@ meson_clk_register_fixed_rate(const stru
+ }
+
+ void __init meson_clk_register_clks(const struct clk_conf *clk_confs,
+- size_t nr_confs,
++ unsigned int nr_confs,
+ void __iomem *clk_base)
+ {
+ unsigned int i;
--- /dev/null
+From 732d6913691848db9fabaa6a25b4d6fad10ddccf Mon Sep 17 00:00:00 2001
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Date: Mon, 22 Feb 2016 11:43:39 +0000
+Subject: clk: qcom: msm8960: fix ce3_core clk enable register
+
+From: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+
+commit 732d6913691848db9fabaa6a25b4d6fad10ddccf upstream.
+
+This patch corrects the enable register offset which is actually 0x36cc
+instead of 0x36c4
+
+Signed-off-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Fixes: 5f775498bdc4 ("clk: qcom: Fully support apq8064 global clock control")
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/qcom/gcc-msm8960.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/qcom/gcc-msm8960.c
++++ b/drivers/clk/qcom/gcc-msm8960.c
+@@ -2769,7 +2769,7 @@ static struct clk_branch ce3_core_clk =
+ .halt_reg = 0x2fdc,
+ .halt_bit = 5,
+ .clkr = {
+- .enable_reg = 0x36c4,
++ .enable_reg = 0x36cc,
+ .enable_mask = BIT(4),
+ .hw.init = &(struct clk_init_data){
+ .name = "ce3_core_clk",
--- /dev/null
+From 0f75e1a370fd843c9e508fc1ccf0662833034827 Mon Sep 17 00:00:00 2001
+From: Stephen Boyd <sboyd@codeaurora.org>
+Date: Tue, 1 Mar 2016 17:26:48 -0800
+Subject: clk: qcom: msm8960: Fix ce3_src register offset
+
+From: Stephen Boyd <sboyd@codeaurora.org>
+
+commit 0f75e1a370fd843c9e508fc1ccf0662833034827 upstream.
+
+The offset seems to have been copied from the sata clk. Fix it so
+that enabling the crypto engine source clk works.
+
+Tested-by: Srinivas Kandagatla <srinivas.kandagatla@linaro.org>
+Tested-by: Bjorn Andersson <bjorn.andersson@linaro.org>
+Fixes: 5f775498bdc4 ("clk: qcom: Fully support apq8064 global clock control")
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/qcom/gcc-msm8960.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/clk/qcom/gcc-msm8960.c
++++ b/drivers/clk/qcom/gcc-msm8960.c
+@@ -2753,7 +2753,7 @@ static struct clk_rcg ce3_src = {
+ },
+ .freq_tbl = clk_tbl_ce3,
+ .clkr = {
+- .enable_reg = 0x2c08,
++ .enable_reg = 0x36c0,
+ .enable_mask = BIT(7),
+ .hw.init = &(struct clk_init_data){
+ .name = "ce3_src",
--- /dev/null
+From 2467b6745e0ae9c6cdccff24c4cceeb14b1cce3f Mon Sep 17 00:00:00 2001
+From: Shawn Lin <shawn.lin@rock-chips.com>
+Date: Tue, 2 Feb 2016 11:37:50 +0800
+Subject: clk: rockchip: free memory in error cases when registering clock branches
+
+From: Shawn Lin <shawn.lin@rock-chips.com>
+
+commit 2467b6745e0ae9c6cdccff24c4cceeb14b1cce3f upstream.
+
+Add free memeory if rockchip_clk_register_branch fails.
+
+Fixes: a245fecbb806 ("clk: rockchip: add basic infrastructure...")
+Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/rockchip/clk.c | 9 +++++++--
+ 1 file changed, 7 insertions(+), 2 deletions(-)
+
+--- a/drivers/clk/rockchip/clk.c
++++ b/drivers/clk/rockchip/clk.c
+@@ -70,7 +70,7 @@ static struct clk *rockchip_clk_register
+ if (gate_offset >= 0) {
+ gate = kzalloc(sizeof(*gate), GFP_KERNEL);
+ if (!gate)
+- return ERR_PTR(-ENOMEM);
++ goto err_gate;
+
+ gate->flags = gate_flags;
+ gate->reg = base + gate_offset;
+@@ -82,7 +82,7 @@ static struct clk *rockchip_clk_register
+ if (div_width > 0) {
+ div = kzalloc(sizeof(*div), GFP_KERNEL);
+ if (!div)
+- return ERR_PTR(-ENOMEM);
++ goto err_div;
+
+ div->flags = div_flags;
+ div->reg = base + muxdiv_offset;
+@@ -102,6 +102,11 @@ static struct clk *rockchip_clk_register
+ flags);
+
+ return clk;
++err_div:
++ kfree(gate);
++err_gate:
++ kfree(mux);
++ return ERR_PTR(-ENOMEM);
+ }
+
+ static struct clk *rockchip_clk_register_frac_branch(const char *name,
--- /dev/null
+From ec7957a6aa0aaf981fb8356dc47a2cdd01cde03c Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Wed, 24 Feb 2016 09:39:11 +0100
+Subject: clk: versatile: sp810: support reentrance
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+commit ec7957a6aa0aaf981fb8356dc47a2cdd01cde03c upstream.
+
+Despite care take to allocate clocks state containers the
+SP810 driver actually just supports creating one instance:
+all clocks registered for every instance will end up with the
+exact same name and __clk_init() will fail.
+
+Rename the timclken<0> .. timclken<n> to sp810_<instance>_<n>
+so every clock on every instance gets a unique name.
+
+This is necessary for the RealView PBA8 which has two SP810
+blocks: the second block will not register its clocks unless
+every clock on every instance is unique and results in boot
+logs like this:
+
+------------[ cut here ]------------
+WARNING: CPU: 0 PID: 0 at ../drivers/clk/versatile/clk-sp810.c:137
+ clk_sp810_of_setup+0x110/0x154()
+Modules linked in:
+CPU: 0 PID: 0 Comm: swapper/0 Not tainted
+4.5.0-rc2-00030-g352718fc39f6-dirty #225
+Hardware name: ARM RealView Machine (Device Tree Support)
+[<c00167f8>] (unwind_backtrace) from [<c0013204>]
+ (show_stack+0x10/0x14)
+[<c0013204>] (show_stack) from [<c01a049c>]
+ (dump_stack+0x84/0x9c)
+[<c01a049c>] (dump_stack) from [<c0024990>]
+ (warn_slowpath_common+0x74/0xb0)
+[<c0024990>] (warn_slowpath_common) from [<c0024a68>]
+ (warn_slowpath_null+0x1c/0x24)
+[<c0024a68>] (warn_slowpath_null) from [<c051eb44>]
+ (clk_sp810_of_setup+0x110/0x154)
+[<c051eb44>] (clk_sp810_of_setup) from [<c051e3a4>]
+ (of_clk_init+0x12c/0x1c8)
+[<c051e3a4>] (of_clk_init) from [<c0504714>]
+ (time_init+0x20/0x2c)
+[<c0504714>] (time_init) from [<c0501b18>]
+ (start_kernel+0x244/0x3c4)
+[<c0501b18>] (start_kernel) from [<7000807c>] (0x7000807c)
+---[ end trace cb88537fdc8fa200 ]---
+
+Cc: Michael Turquette <mturquette@baylibre.com>
+Cc: Pawel Moll <pawel.moll@arm.com>
+Fixes: 6e973d2c4385 "clk: vexpress: Add separate SP810 driver"
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Stephen Boyd <sboyd@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/clk/versatile/clk-sp810.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/drivers/clk/versatile/clk-sp810.c
++++ b/drivers/clk/versatile/clk-sp810.c
+@@ -92,6 +92,7 @@ static void __init clk_sp810_of_setup(st
+ int num = ARRAY_SIZE(parent_names);
+ char name[12];
+ struct clk_init_data init;
++ static int instance;
+ int i;
+ bool deprecated;
+
+@@ -118,7 +119,7 @@ static void __init clk_sp810_of_setup(st
+ deprecated = !of_find_property(node, "assigned-clock-parents", NULL);
+
+ for (i = 0; i < ARRAY_SIZE(sp810->timerclken); i++) {
+- snprintf(name, ARRAY_SIZE(name), "timerclken%d", i);
++ snprintf(name, sizeof(name), "sp810_%d_%d", instance, i);
+
+ sp810->timerclken[i].sp810 = sp810;
+ sp810->timerclken[i].channel = i;
+@@ -139,5 +140,6 @@ static void __init clk_sp810_of_setup(st
+ }
+
+ of_clk_add_provider(node, clk_sp810_timerclken_of_get, sp810);
++ instance++;
+ }
+ CLK_OF_DECLARE(sp810, "arm,sp810", clk_sp810_of_setup);
--- /dev/null
+From 88e9da9a2a70b6f1a171fbf30a681d6bc4031c4d Mon Sep 17 00:00:00 2001
+From: Krzysztof Halasa <khalasa@piap.pl>
+Date: Fri, 11 Mar 2016 12:32:14 +0100
+Subject: CNS3xxx: Fix PCI cns3xxx_write_config()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Krzysztof Halasa <khalasa@piap.pl>
+
+commit 88e9da9a2a70b6f1a171fbf30a681d6bc4031c4d upstream.
+
+The "where" offset was added twice, fix it.
+
+Signed-off-by: Krzysztof Hałasa <khalasa@piap.pl>
+Fixes: 498a92d42596 ("ARM: cns3xxx: pci: avoid potential stack overflow")
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-cns3xxx/pcie.c | 6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/arch/arm/mach-cns3xxx/pcie.c
++++ b/arch/arm/mach-cns3xxx/pcie.c
+@@ -220,13 +220,13 @@ static void cns3xxx_write_config(struct
+ u32 mask = (0x1ull << (size * 8)) - 1;
+ int shift = (where % 4) * 8;
+
+- v = readl_relaxed(base + (where & 0xffc));
++ v = readl_relaxed(base);
+
+ v &= ~(mask << shift);
+ v |= (val & mask) << shift;
+
+- writel_relaxed(v, base + (where & 0xffc));
+- readl_relaxed(base + (where & 0xffc));
++ writel_relaxed(v, base);
++ readl_relaxed(base);
+ }
+
+ static void __init cns3xxx_pcie_hw_init(struct cns3xxx_pcie *cnspci)
--- /dev/null
+From 7617a24f83b5d67f4dab1844956be1cebc44aec8 Mon Sep 17 00:00:00 2001
+From: Marco Angaroni <marcoangaroni@gmail.com>
+Date: Sat, 5 Mar 2016 12:10:02 +0100
+Subject: ipvs: correct initial offset of Call-ID header search in SIP persistence engine
+
+From: Marco Angaroni <marcoangaroni@gmail.com>
+
+commit 7617a24f83b5d67f4dab1844956be1cebc44aec8 upstream.
+
+The IPVS SIP persistence engine is not able to parse the SIP header
+"Call-ID" when such header is inserted in the first positions of
+the SIP message.
+
+When IPVS is configured with "--pe sip" option, like for example:
+ipvsadm -A -u 1.2.3.4:5060 -s rr --pe sip -p 120 -o
+some particular messages (see below for details) do not create entries
+in the connection template table, which can be listed with:
+ipvsadm -Lcn --persistent-conn
+
+Problematic SIP messages are SIP responses having "Call-ID" header
+positioned just after message first line:
+SIP/2.0 200 OK
+[Call-ID header here]
+[rest of the headers]
+
+When "Call-ID" header is positioned down (after a few other headers)
+it is correctly recognized.
+
+This is due to the data offset used in get_callid function call inside
+ip_vs_pe_sip.c file: since dptr already points to the start of the
+SIP message, the value of dataoff should be initially 0.
+Otherwise the header is searched starting from some bytes after the
+first character of the SIP message.
+
+Fixes: 758ff0338722 ("IPVS: sip persistence engine")
+Signed-off-by: Marco Angaroni <marcoangaroni@gmail.com>
+Acked-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Simon Horman <horms@verge.net.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/netfilter/ipvs/ip_vs_pe_sip.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/netfilter/ipvs/ip_vs_pe_sip.c
++++ b/net/netfilter/ipvs/ip_vs_pe_sip.c
+@@ -88,7 +88,7 @@ ip_vs_sip_fill_param(struct ip_vs_conn_p
+ dptr = skb->data + dataoff;
+ datalen = skb->len - dataoff;
+
+- if (get_callid(dptr, dataoff, datalen, &matchoff, &matchlen))
++ if (get_callid(dptr, 0, datalen, &matchoff, &matchlen))
+ return -EINVAL;
+
+ /* N.B: pe_data is only set on success,
--- /dev/null
+From f719e3754ee2f7275437e61a6afd520181fdd43b Mon Sep 17 00:00:00 2001
+From: Julian Anastasov <ja@ssi.bg>
+Date: Sat, 5 Mar 2016 15:03:22 +0200
+Subject: ipvs: drop first packet to redirect conntrack
+
+From: Julian Anastasov <ja@ssi.bg>
+
+commit f719e3754ee2f7275437e61a6afd520181fdd43b upstream.
+
+Jiri Bohac is reporting for a problem where the attempt
+to reschedule existing connection to another real server
+needs proper redirect for the conntrack used by the IPVS
+connection. For example, when IPVS connection is created
+to NAT-ed real server we alter the reply direction of
+conntrack. If we later decide to select different real
+server we can not alter again the conntrack. And if we
+expire the old connection, the new connection is left
+without conntrack.
+
+So, the only way to redirect both the IPVS connection and
+the Netfilter's conntrack is to drop the SYN packet that
+hits existing connection, to wait for the next jiffie
+to expire the old connection and its conntrack and to rely
+on client's retransmission to create new connection as
+usually.
+
+Jiri Bohac provided a fix that drops all SYNs on rescheduling,
+I extended his patch to do such drops only for connections
+that use conntrack. Here is the original report from Jiri Bohac:
+
+Since commit dc7b3eb900aa ("ipvs: Fix reuse connection if real server
+is dead"), new connections to dead servers are redistributed
+immediately to new servers. The old connection is expired using
+ip_vs_conn_expire_now() which sets the connection timer to expire
+immediately.
+
+However, before the timer callback, ip_vs_conn_expire(), is run
+to clean the connection's conntrack entry, the new redistributed
+connection may already be established and its conntrack removed
+instead.
+
+Fix this by dropping the first packet of the new connection
+instead, like we do when the destination server is not available.
+The timer will have deleted the old conntrack entry long before
+the first packet of the new connection is retransmitted.
+
+Fixes: dc7b3eb900aa ("ipvs: Fix reuse connection if real server is dead")
+Signed-off-by: Jiri Bohac <jbohac@suse.cz>
+Signed-off-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Simon Horman <horms@verge.net.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/net/ip_vs.h | 17 +++++++++++++++++
+ net/netfilter/ipvs/ip_vs_core.c | 37 ++++++++++++++++++++++++++++---------
+ 2 files changed, 45 insertions(+), 9 deletions(-)
+
+--- a/include/net/ip_vs.h
++++ b/include/net/ip_vs.h
+@@ -1588,6 +1588,23 @@ static inline void ip_vs_conn_drop_connt
+ }
+ #endif /* CONFIG_IP_VS_NFCT */
+
++/* Really using conntrack? */
++static inline bool ip_vs_conn_uses_conntrack(struct ip_vs_conn *cp,
++ struct sk_buff *skb)
++{
++#ifdef CONFIG_IP_VS_NFCT
++ enum ip_conntrack_info ctinfo;
++ struct nf_conn *ct;
++
++ if (!(cp->flags & IP_VS_CONN_F_NFCT))
++ return false;
++ ct = nf_ct_get(skb, &ctinfo);
++ if (ct && !nf_ct_is_untracked(ct))
++ return true;
++#endif
++ return false;
++}
++
+ static inline int
+ ip_vs_dest_conn_overhead(struct ip_vs_dest *dest)
+ {
+--- a/net/netfilter/ipvs/ip_vs_core.c
++++ b/net/netfilter/ipvs/ip_vs_core.c
+@@ -1757,15 +1757,34 @@ ip_vs_in(struct netns_ipvs *ipvs, unsign
+ cp = pp->conn_in_get(ipvs, af, skb, &iph);
+
+ conn_reuse_mode = sysctl_conn_reuse_mode(ipvs);
+- if (conn_reuse_mode && !iph.fragoffs &&
+- is_new_conn(skb, &iph) && cp &&
+- ((unlikely(sysctl_expire_nodest_conn(ipvs)) && cp->dest &&
+- unlikely(!atomic_read(&cp->dest->weight))) ||
+- unlikely(is_new_conn_expected(cp, conn_reuse_mode)))) {
+- if (!atomic_read(&cp->n_control))
+- ip_vs_conn_expire_now(cp);
+- __ip_vs_conn_put(cp);
+- cp = NULL;
++ if (conn_reuse_mode && !iph.fragoffs && is_new_conn(skb, &iph) && cp) {
++ bool uses_ct = false, resched = false;
++
++ if (unlikely(sysctl_expire_nodest_conn(ipvs)) && cp->dest &&
++ unlikely(!atomic_read(&cp->dest->weight))) {
++ resched = true;
++ uses_ct = ip_vs_conn_uses_conntrack(cp, skb);
++ } else if (is_new_conn_expected(cp, conn_reuse_mode)) {
++ uses_ct = ip_vs_conn_uses_conntrack(cp, skb);
++ if (!atomic_read(&cp->n_control)) {
++ resched = true;
++ } else {
++ /* Do not reschedule controlling connection
++ * that uses conntrack while it is still
++ * referenced by controlled connection(s).
++ */
++ resched = !uses_ct;
++ }
++ }
++
++ if (resched) {
++ if (!atomic_read(&cp->n_control))
++ ip_vs_conn_expire_now(cp);
++ __ip_vs_conn_put(cp);
++ if (uses_ct)
++ return NF_DROP;
++ cp = NULL;
++ }
+ }
+
+ if (unlikely(!cp)) {
--- /dev/null
+From 3f20efba41916ee17ce82f0fdd02581ada2872b2 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Wed, 27 Jan 2016 14:52:02 +0100
+Subject: ipvs: handle ip_vs_fill_iph_skb_off failure
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit 3f20efba41916ee17ce82f0fdd02581ada2872b2 upstream.
+
+ip_vs_fill_iph_skb_off() may not find an IP header, and gcc has
+determined that ip_vs_sip_fill_param() then incorrectly accesses
+the protocol fields:
+
+net/netfilter/ipvs/ip_vs_pe_sip.c: In function 'ip_vs_sip_fill_param':
+net/netfilter/ipvs/ip_vs_pe_sip.c:76:5: error: 'iph.protocol' may be used uninitialized in this function [-Werror=maybe-uninitialized]
+ if (iph.protocol != IPPROTO_UDP)
+ ^
+net/netfilter/ipvs/ip_vs_pe_sip.c:81:10: error: 'iph.len' may be used uninitialized in this function [-Werror=maybe-uninitialized]
+ dataoff = iph.len + sizeof(struct udphdr);
+ ^
+
+This adds a check for the ip_vs_fill_iph_skb_off() return code
+before looking at the ip header data returned from it.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Fixes: b0e010c527de ("ipvs: replace ip_vs_fill_ip4hdr with ip_vs_fill_iph_skb_off")
+Acked-by: Julian Anastasov <ja@ssi.bg>
+Signed-off-by: Simon Horman <horms@verge.net.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/netfilter/ipvs/ip_vs_pe_sip.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/netfilter/ipvs/ip_vs_pe_sip.c
++++ b/net/netfilter/ipvs/ip_vs_pe_sip.c
+@@ -70,10 +70,10 @@ ip_vs_sip_fill_param(struct ip_vs_conn_p
+ const char *dptr;
+ int retc;
+
+- ip_vs_fill_iph_skb(p->af, skb, false, &iph);
++ retc = ip_vs_fill_iph_skb(p->af, skb, false, &iph);
+
+ /* Only useful with UDP */
+- if (iph.protocol != IPPROTO_UDP)
++ if (!retc || iph.protocol != IPPROTO_UDP)
+ return -EINVAL;
+ /* todo: IPv6 fragments:
+ * I think this only should be done for the first fragment. /HS
--- /dev/null
+From aeb6641f8ebdd61939f462a8255b316f9bfab707 Mon Sep 17 00:00:00 2001
+From: Arnd Bergmann <arnd@arndb.de>
+Date: Mon, 14 Mar 2016 15:29:44 +0100
+Subject: lpfc: fix misleading indentation
+
+From: Arnd Bergmann <arnd@arndb.de>
+
+commit aeb6641f8ebdd61939f462a8255b316f9bfab707 upstream.
+
+gcc-6 complains about the indentation of the lpfc_destroy_vport_work_array()
+call in lpfc_online(), which clearly doesn't look right:
+
+drivers/scsi/lpfc/lpfc_init.c: In function 'lpfc_online':
+drivers/scsi/lpfc/lpfc_init.c:2880:3: warning: statement is indented as if it were guarded by... [-Wmisleading-indentation]
+ lpfc_destroy_vport_work_array(phba, vports);
+ ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+drivers/scsi/lpfc/lpfc_init.c:2863:2: note: ...this 'if' clause, but it is not
+ if (vports != NULL)
+ ^~
+
+Looking at the patch that introduced this code, it's clear that the
+behavior is correct and the indentation is wrong.
+
+This fixes the indentation and adds curly braces around the previous
+if() block for clarity, as that is most likely what caused the code
+to be misindented in the first place.
+
+Signed-off-by: Arnd Bergmann <arnd@arndb.de>
+Fixes: 549e55cd2a1b ("[SCSI] lpfc 8.2.2 : Fix locking around HBA's port_list")
+Reviewed-by: Sebastian Herbszt <herbszt@gmx.de>
+Reviewed-by: Hannes Reinecke <hare@suse.com>
+Reviewed-by: Ewan D. Milne <emilne@redhat.com>
+Signed-off-by: Martin K. Petersen <martin.petersen@oracle.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/scsi/lpfc/lpfc_init.c | 5 +++--
+ 1 file changed, 3 insertions(+), 2 deletions(-)
+
+--- a/drivers/scsi/lpfc/lpfc_init.c
++++ b/drivers/scsi/lpfc/lpfc_init.c
+@@ -2855,7 +2855,7 @@ lpfc_online(struct lpfc_hba *phba)
+ }
+
+ vports = lpfc_create_vport_work_array(phba);
+- if (vports != NULL)
++ if (vports != NULL) {
+ for (i = 0; i <= phba->max_vports && vports[i] != NULL; i++) {
+ struct Scsi_Host *shost;
+ shost = lpfc_shost_from_vport(vports[i]);
+@@ -2872,7 +2872,8 @@ lpfc_online(struct lpfc_hba *phba)
+ }
+ spin_unlock_irq(shost->host_lock);
+ }
+- lpfc_destroy_vport_work_array(phba, vports);
++ }
++ lpfc_destroy_vport_work_array(phba, vports);
+
+ lpfc_unblock_mgmt_io(phba);
+ return 0;
--- /dev/null
+From 84cb36cac581c915ef4e8b70abb73e084325df92 Mon Sep 17 00:00:00 2001
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Date: Fri, 22 Jan 2016 16:48:46 +0200
+Subject: mfd: intel-lpss: Remove clock tree on error path
+
+From: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+
+commit 84cb36cac581c915ef4e8b70abb73e084325df92 upstream.
+
+We forgot to remove the clock tree if something goes wrong in ->probe(). Add a
+call to intel_lpss_unregister_clock() on error path in ->probe() to fix the
+potential issue.
+
+Fixes: 4b45efe85263 (mfd: Add support for Intel Sunrisepoint LPSS devices)
+Signed-off-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mfd/intel-lpss.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/mfd/intel-lpss.c
++++ b/drivers/mfd/intel-lpss.c
+@@ -445,6 +445,7 @@ int intel_lpss_probe(struct device *dev,
+ err_remove_ltr:
+ intel_lpss_debugfs_remove(lpss);
+ intel_lpss_ltr_hide(lpss);
++ intel_lpss_unregister_clock(lpss);
+
+ err_clk_register:
+ ida_simple_remove(&intel_lpss_devid_ida, lpss->devid);
--- /dev/null
+From a6139b6271f9f95377fe3486aed6120c9142779b Mon Sep 17 00:00:00 2001
+From: Amitkumar Karwar <akarwar@marvell.com>
+Date: Tue, 23 Feb 2016 05:16:17 -0800
+Subject: mwifiex: fix corner case association failure
+
+From: Amitkumar Karwar <akarwar@marvell.com>
+
+commit a6139b6271f9f95377fe3486aed6120c9142779b upstream.
+
+This patch corrects the error case in association path by returning
+-1. Earlier "media_connected" used to remain on in this error case
+causing failure for further association attempts.
+
+Signed-off-by: Amitkumar Karwar <akarwar@marvell.com>
+Fixes: b887664d882ee4 ('mwifiex: channel switch handling for station')
+Signed-off-by: Cathy Luo <cluo@marvell.com>
+Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/wireless/mwifiex/sta_ioctl.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/net/wireless/mwifiex/sta_ioctl.c
++++ b/drivers/net/wireless/mwifiex/sta_ioctl.c
+@@ -313,6 +313,7 @@ int mwifiex_bss_start(struct mwifiex_pri
+ mwifiex_dbg(adapter, ERROR,
+ "Attempt to reconnect on csa closed chan(%d)\n",
+ bss_desc->channel);
++ ret = -1;
+ goto done;
+ }
+
--- /dev/null
+From da6ccaaa79caca4f38b540b651238f87215217a2 Mon Sep 17 00:00:00 2001
+From: Dan Streetman <dan.streetman@canonical.com>
+Date: Thu, 14 Jan 2016 13:42:32 -0500
+Subject: nbd: ratelimit error msgs after socket close
+
+From: Dan Streetman <dan.streetman@canonical.com>
+
+commit da6ccaaa79caca4f38b540b651238f87215217a2 upstream.
+
+Make the "Attempted send on closed socket" error messages generated in
+nbd_request_handler() ratelimited.
+
+When the nbd socket is shutdown, the nbd_request_handler() function emits
+an error message for every request remaining in its queue. If the queue
+is large, this will spam a large amount of messages to the log. There's
+no need for a separate error message for each request, so this patch
+ratelimits it.
+
+In the specific case this was found, the system was virtual and the error
+messages were logged to the serial port, which overwhelmed it.
+
+Fixes: 4d48a542b427 ("nbd: fix I/O hang on disconnected nbds")
+Signed-off-by: Dan Streetman <dan.streetman@canonical.com>
+Signed-off-by: Markus Pargmann <mpa@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/block/nbd.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/block/nbd.c
++++ b/drivers/block/nbd.c
+@@ -618,8 +618,8 @@ static void nbd_request_handler(struct r
+ req, req->cmd_type);
+
+ if (unlikely(!nbd->sock)) {
+- dev_err(disk_to_dev(nbd->disk),
+- "Attempted send on closed socket\n");
++ dev_err_ratelimited(disk_to_dev(nbd->disk),
++ "Attempted send on closed socket\n");
+ req->errors++;
+ nbd_end_request(nbd, req);
+ spin_lock_irq(q->queue_lock);
--- /dev/null
+From 32cc92c7b5e52357a0a24010bae9eb257fa75d3e Mon Sep 17 00:00:00 2001
+From: Hariprasad S <hariprasad@chelsio.com>
+Date: Tue, 5 Apr 2016 10:23:48 +0530
+Subject: RDMA/iw_cxgb4: Fix bar2 virt addr calculation for T4 chips
+
+From: Hariprasad S <hariprasad@chelsio.com>
+
+commit 32cc92c7b5e52357a0a24010bae9eb257fa75d3e upstream.
+
+For T4, kernel mode qps don't use the user doorbell. User mode qps during
+flow control db ringing are forced into kernel, where user doorbell is
+treated as kernel doorbell and proper bar2 offset in bar2 virtual space is
+calculated, which incase of T4 is a bogus address, causing a kernel panic
+due to illegal write during doorbell ringing.
+In case of T4, kernel mode qp bar2 virtual address should be 0. Added T4
+check during bar2 virtual address calculation to return 0. Fixed Bar2
+range checks based on bar2 physical address.
+
+The below oops will be fixed
+
+ <1>BUG: unable to handle kernel paging request at 000000000002aa08
+ <1>IP: [<ffffffffa011d800>] c4iw_uld_control+0x4e0/0x880 [iw_cxgb4]
+ <4>PGD 1416a8067 PUD 15bf35067 PMD 0
+ <4>Oops: 0002 [#1] SMP
+ <4>last sysfs file:
+ /sys/devices/pci0000:00/0000:00:03.0/0000:02:00.4/infiniband/cxgb4_0/node_guid
+ <4>CPU 5
+ <4>Modules linked in: rdma_ucm rdma_cm ib_cm ib_sa ib_mad ib_uverbs
+ ip6table_filter ip6_tables ebtable_nat ebtables ipt_MASQUERADE
+ iptable_nat nf_nat nf_conntrack_ipv4 nf_defrag_ipv4 xt_state nf_conntrack
+ ipt_REJECT xt_CHECKSUM iptable_mangle iptable_filter ip_tables bridge autofs4
+ target_core_iblock target_core_file target_core_pscsi target_core_mod
+ configfs bnx2fc cnic uio fcoe libfcoe libfc scsi_transport_fc scsi_tgt 8021q
+ garp stp llc cpufreq_ondemand acpi_cpufreq freq_table mperf vhost_net macvtap
+ macvlan tun kvm uinput microcode iTCO_wdt iTCO_vendor_support sg joydev
+ serio_raw i2c_i801 i2c_core lpc_ich mfd_core e1000e ptp pps_core ioatdma dca
+ i7core_edac edac_core shpchp ext3 jbd mbcache sd_mod crc_t10dif pata_acpi
+ ata_generic ata_piix iw_cxgb4 iw_cm ib_core ib_addr cxgb4 ipv6 dm_mirror
+ dm_region_hash dm_log dm_mod [last unloaded: scsi_wait_scan]
+ <4>
+ Supermicro X8ST3/X8ST3
+ <4>RIP: 0010:[<ffffffffa011d800>] [<ffffffffa011d800>]
+ c4iw_uld_control+0x4e0/0x880 [iw_cxgb4]
+ <4>RSP: 0000:ffff880155a03db0 EFLAGS: 00010006
+ <4>RAX: 000000000000001d RBX: ffff88013ae5fc00 RCX: ffff880155adb180
+ <4>RDX: 000000000002aa00 RSI: 0000000000000001 RDI: ffff88013ae5fdf8
+ <4>RBP: ffff880155a03e10 R08: 0000000000000000 R09: 0000000000000001
+ <4>R10: 0000000000000000 R11: 0000000000000000 R12: 0000000000000000
+ <4>R13: 000000000000001d R14: ffff880156414ab0 R15: ffffe8ffffc05b88
+ <4>FS: 0000000000000000(0000) GS:ffff8800282a0000(0000) knlGS:0000000000000000
+ <4>CS: 0010 DS: 0018 ES: 0018 CR0: 000000008005003b
+ <4>CR2: 000000000002aa08 CR3: 000000015bd0e000 CR4: 00000000000007e0
+ <4>DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
+ <4>DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
+ <4>Process cxgb4 (pid: 394, threadinfo ffff880155a00000, task ffff880156414ab0)
+ <4>Stack:
+ <4> ffff880156415068 ffff880155adb180 ffff880155a03df0 ffffffffa00a344b
+ <4><d> 00000000000003e8 ffff880155920000 0000000000000004 ffff880155920000
+ <4><d> ffff88015592d438 ffffffffa00a3860 ffff880155a03fd8 ffffe8ffffc05b88
+ <4>Call Trace:
+ <4> [<ffffffffa00a344b>] ? enable_txq_db+0x2b/0x80 [cxgb4]
+ <4> [<ffffffffa00a3860>] ? process_db_full+0x0/0xa0 [cxgb4]
+ <4> [<ffffffffa00a38a6>] process_db_full+0x46/0xa0 [cxgb4]
+ <4> [<ffffffff8109fda0>] worker_thread+0x170/0x2a0
+ <4> [<ffffffff810a6aa0>] ? autoremove_wake_function+0x0/0x40
+ <4> [<ffffffff8109fc30>] ? worker_thread+0x0/0x2a0
+ <4> [<ffffffff810a660e>] kthread+0x9e/0xc0
+ <4> [<ffffffff8100c28a>] child_rip+0xa/0x20
+ <4> [<ffffffff810a6570>] ? kthread+0x0/0xc0
+ <4> [<ffffffff8100c280>] ? child_rip+0x0/0x20
+ <4>Code: e9 ba 00 00 00 66 0f 1f 44 00 00 44 8b 05 29 07 02 00 45 85 c0 0f 85
+ 71 02 00 00 8b 83 70 01 00 00 45 0f b7 ed c1 e0 0f 44 09 e8 <89> 42 08 0f ae f8
+ 66 c7 83 82 01 00 00 00 00 44 0f b7 ab dc 01
+ <1>RIP [<ffffffffa011d800>] c4iw_uld_control+0x4e0/0x880 [iw_cxgb4]
+ <4> RSP <ffff880155a03db0>
+ <4>CR2: 000000000002aa08`
+
+Based on original work by Bharat Potnuri <bharat@chelsio.com>
+
+Fixes: 74217d4c6a4fb0d8 ("iw_cxgb4: support for bar2 qid densities exceeding the page size")
+
+Signed-off-by: Steve Wise <swise@opengridcomputing.com>
+Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com>
+Reviewed-by: Leon Romanovsky <leon@leon.nu>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/cxgb4/cq.c | 2 +-
+ drivers/infiniband/hw/cxgb4/qp.c | 6 +++++-
+ 2 files changed, 6 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/hw/cxgb4/cq.c
++++ b/drivers/infiniband/hw/cxgb4/cq.c
+@@ -162,7 +162,7 @@ static int create_cq(struct c4iw_rdev *r
+ cq->bar2_va = c4iw_bar2_addrs(rdev, cq->cqid, T4_BAR2_QTYPE_INGRESS,
+ &cq->bar2_qid,
+ user ? &cq->bar2_pa : NULL);
+- if (user && !cq->bar2_va) {
++ if (user && !cq->bar2_pa) {
+ pr_warn(MOD "%s: cqid %u not in BAR2 range.\n",
+ pci_name(rdev->lldi.pdev), cq->cqid);
+ ret = -EINVAL;
+--- a/drivers/infiniband/hw/cxgb4/qp.c
++++ b/drivers/infiniband/hw/cxgb4/qp.c
+@@ -185,6 +185,10 @@ void __iomem *c4iw_bar2_addrs(struct c4i
+
+ if (pbar2_pa)
+ *pbar2_pa = (rdev->bar2_pa + bar2_qoffset) & PAGE_MASK;
++
++ if (is_t4(rdev->lldi.adapter_type))
++ return NULL;
++
+ return rdev->bar2_kva + bar2_qoffset;
+ }
+
+@@ -270,7 +274,7 @@ static int create_qp(struct c4iw_rdev *r
+ /*
+ * User mode must have bar2 access.
+ */
+- if (user && (!wq->sq.bar2_va || !wq->rq.bar2_va)) {
++ if (user && (!wq->sq.bar2_pa || !wq->rq.bar2_pa)) {
+ pr_warn(MOD "%s: sqid %u or rqid %u not in BAR2 range.\n",
+ pci_name(rdev->lldi.pdev), wq->sq.qid, wq->rq.qid);
+ goto free_dma;
--- /dev/null
+From foo@baz Fri May 6 12:03:29 EDT 2016
+Date: Fri, 06 May 2016 12:03:29 -0400
+To: Greg KH <gregkh@linuxfoundation.org>
+From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+Subject: Revert: "powerpc/tm: Check for already reclaimed tasks"
+
+This reverts commit e924c60db1b4891e45d15a33474ac5fab62cf029 which was
+commit 7f821fc9c77a9b01fe7b1d6e72717b33d8d64142 upstream.
+
+It shouldn't have been applied as the original was already in 4.4.
+
+Reported-by: Jiri Slaby <jslaby@suse.cz>
+Cc: Michael Neuling <mikey@neuling.org>
+Cc: Michael Ellerman <mpe@ellerman.id.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/powerpc/kernel/process.c | 18 ------------------
+ 1 file changed, 18 deletions(-)
+
+--- a/arch/powerpc/kernel/process.c
++++ b/arch/powerpc/kernel/process.c
+@@ -569,24 +569,6 @@ static void tm_reclaim_thread(struct thr
+ if (!MSR_TM_SUSPENDED(mfmsr()))
+ return;
+
+- /*
+- * Use the current MSR TM suspended bit to track if we have
+- * checkpointed state outstanding.
+- * On signal delivery, we'd normally reclaim the checkpointed
+- * state to obtain stack pointer (see:get_tm_stackpointer()).
+- * This will then directly return to userspace without going
+- * through __switch_to(). However, if the stack frame is bad,
+- * we need to exit this thread which calls __switch_to() which
+- * will again attempt to reclaim the already saved tm state.
+- * Hence we need to check that we've not already reclaimed
+- * this state.
+- * We do this using the current MSR, rather tracking it in
+- * some specific thread_struct bit, as it has the additional
+- * benifit of checking for a potential TM bad thing exception.
+- */
+- if (!MSR_TM_SUSPENDED(mfmsr()))
+- return;
+-
+ tm_reclaim(thr, thr->regs->msr, cause);
+
+ /* Having done the reclaim, we now have the checkpointed
revert-powerpc-tm-check-for-already-reclaimed-tasks.patch
rdma-iw_cxgb4-fix-bar2-virt-addr-calculation-for-t4-chips.patch
-xprtrdma-clean-up-unused-rpcrdma_inline_pad_thresh-macro.patch
ipvs-handle-ip_vs_fill_iph_skb_off-failure.patch
ipvs-correct-initial-offset-of-call-id-header-search-in-sip-persistence-engine.patch
ipvs-drop-first-packet-to-redirect-conntrack.patch
--- /dev/null
+From 1d961f11a108af9f7fbe89cc950a8d16ddbdbb28 Mon Sep 17 00:00:00 2001
+From: Shawn Lin <shawn.lin@rock-chips.com>
+Date: Mon, 1 Feb 2016 16:18:40 +0800
+Subject: soc: rockchip: power-domain: fix err handle while probing
+
+From: Shawn Lin <shawn.lin@rock-chips.com>
+
+commit 1d961f11a108af9f7fbe89cc950a8d16ddbdbb28 upstream.
+
+If we fail to probe the driver, we should not directly break
+from the for_each_available_child_of_node since it calls of_node_get
+while iterating. This patch add of_node_put to fix the unbalanced
+call pair.
+
+Fixes: 7c696693a4f5 ("soc: rockchip: power-domain: Add power domain driver")
+Signed-off-by: Shawn Lin <shawn.lin@rock-chips.com>
+Signed-off-by: Heiko Stuebner <heiko@sntech.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/soc/rockchip/pm_domains.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/soc/rockchip/pm_domains.c
++++ b/drivers/soc/rockchip/pm_domains.c
+@@ -419,6 +419,7 @@ static int rockchip_pm_domain_probe(stru
+ if (error) {
+ dev_err(dev, "failed to handle node %s: %d\n",
+ node->name, error);
++ of_node_put(node);
+ goto err_out;
+ }
+ }
projects / thirdparty / kernel / stable-queue.git / commitdiff
