--- /dev/null
+From af92305e567b7f4c9cf48b9e46c1f48ec9ffb1fb Mon Sep 17 00:00:00 2001
+From: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
+Date: Thu, 17 Nov 2016 03:30:51 +0200
+Subject: ARM: dts: imx31: fix AVIC base address
+
+From: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
+
+commit af92305e567b7f4c9cf48b9e46c1f48ec9ffb1fb upstream.
+
+On i.MX31 AVIC interrupt controller base address is at 0x68000000.
+
+The problem was shadowed by the AVIC driver, which takes the correct
+base address from a SoC specific header file.
+
+Fixes: d2a37b3d91f4 ("ARM i.MX31: Add devicetree support")
+Signed-off-by: Vladimir Zapolskiy <vladimir_zapolskiy@mentor.com>
+Reviewed-by: Fabio Estevam <fabio.estevam@nxp.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/imx31.dtsi | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/arch/arm/boot/dts/imx31.dtsi
++++ b/arch/arm/boot/dts/imx31.dtsi
+@@ -30,11 +30,11 @@
+ };
+ };
+
+- avic: avic-interrupt-controller@60000000 {
++ avic: interrupt-controller@68000000 {
+ compatible = "fsl,imx31-avic", "fsl,avic";
+ interrupt-controller;
+ #interrupt-cells = <1>;
+- reg = <0x60000000 0x100000>;
++ reg = <0x68000000 0x100000>;
+ };
+
+ soc {
--- /dev/null
+From 2e575cbc930901718cc18e084566ecbb9a4b5ebb Mon Sep 17 00:00:00 2001
+From: Vladimir Zapolskiy <vz@mleia.com>
+Date: Mon, 26 Sep 2016 03:03:40 +0300
+Subject: ARM: dts: imx31: fix clock control module interrupts description
+
+From: Vladimir Zapolskiy <vz@mleia.com>
+
+commit 2e575cbc930901718cc18e084566ecbb9a4b5ebb upstream.
+
+The type of AVIC interrupt controller found on i.MX31 is one-cell,
+namely 31 for CCM DVFS and 53 for CCM, however for clock control
+module its interrupts are specified as 3-cells, fix it.
+
+Fixes: ef0e4a606fb6 ("ARM: mx31: Replace clk_register_clkdev with clock DT lookup")
+Acked-by: Rob Herring <robh@kernel.org>
+Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ Documentation/devicetree/bindings/clock/imx31-clock.txt | 2 +-
+ arch/arm/boot/dts/imx31.dtsi | 2 +-
+ 2 files changed, 2 insertions(+), 2 deletions(-)
+
+--- a/Documentation/devicetree/bindings/clock/imx31-clock.txt
++++ b/Documentation/devicetree/bindings/clock/imx31-clock.txt
+@@ -77,7 +77,7 @@ Examples:
+ clks: ccm@53f80000{
+ compatible = "fsl,imx31-ccm";
+ reg = <0x53f80000 0x4000>;
+- interrupts = <0 31 0x04 0 53 0x04>;
++ interrupts = <31>, <53>;
+ #clock-cells = <1>;
+ };
+
+--- a/arch/arm/boot/dts/imx31.dtsi
++++ b/arch/arm/boot/dts/imx31.dtsi
+@@ -114,7 +114,7 @@
+ clks: ccm@53f80000{
+ compatible = "fsl,imx31-ccm";
+ reg = <0x53f80000 0x4000>;
+- interrupts = <0 31 0x04 0 53 0x04>;
++ interrupts = <31>, <53>;
+ #clock-cells = <1>;
+ };
+ };
--- /dev/null
+From 1f87aee6a2e55eda466a43ba6248a8b75eede153 Mon Sep 17 00:00:00 2001
+From: Vladimir Zapolskiy <vz@mleia.com>
+Date: Mon, 26 Sep 2016 03:03:41 +0300
+Subject: ARM: dts: imx31: move CCM device node to AIPS2 bus devices
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Vladimir Zapolskiy <vz@mleia.com>
+
+commit 1f87aee6a2e55eda466a43ba6248a8b75eede153 upstream.
+
+i.MX31 Clock Control Module controller is found on AIPS2 bus, move it
+there from SPBA bus to avoid a conflict of device IO space mismatch.
+
+Fixes: ef0e4a606fb6 ("ARM: mx31: Replace clk_register_clkdev with clock DT lookup")
+Signed-off-by: Vladimir Zapolskiy <vz@mleia.com>
+Acked-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
+Signed-off-by: Shawn Guo <shawnguo@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/boot/dts/imx31.dtsi | 14 +++++++-------
+ 1 file changed, 7 insertions(+), 7 deletions(-)
+
+--- a/arch/arm/boot/dts/imx31.dtsi
++++ b/arch/arm/boot/dts/imx31.dtsi
+@@ -110,13 +110,6 @@
+ interrupts = <19>;
+ clocks = <&clks 25>;
+ };
+-
+- clks: ccm@53f80000{
+- compatible = "fsl,imx31-ccm";
+- reg = <0x53f80000 0x4000>;
+- interrupts = <31>, <53>;
+- #clock-cells = <1>;
+- };
+ };
+
+ aips@53f00000 { /* AIPS2 */
+@@ -126,6 +119,13 @@
+ reg = <0x53f00000 0x100000>;
+ ranges;
+
++ clks: ccm@53f80000{
++ compatible = "fsl,imx31-ccm";
++ reg = <0x53f80000 0x4000>;
++ interrupts = <31>, <53>;
++ #clock-cells = <1>;
++ };
++
+ gpt: timer@53f90000 {
+ compatible = "fsl,imx31-gpt";
+ reg = <0x53f90000 0x4000>;
--- /dev/null
+From 8329e818f14926a6040df86b2668568bde342ebf Mon Sep 17 00:00:00 2001
+From: Steven Rostedt <rostedt@goodmis.org>
+Date: Mon, 16 May 2016 23:00:35 -0400
+Subject: ftrace/x86: Set ftrace_stub to weak to prevent gcc from using short jumps to it
+
+From: Steven Rostedt <rostedt@goodmis.org>
+
+commit 8329e818f14926a6040df86b2668568bde342ebf upstream.
+
+Matt Fleming reported seeing crashes when enabling and disabling
+function profiling which uses function graph tracer. Later Namhyung Kim
+hit a similar issue and he found that the issue was due to the jmp to
+ftrace_stub in ftrace_graph_call was only two bytes, and when it was
+changed to jump to the tracing code, it overwrote the ftrace_stub that
+was after it.
+
+Masami Hiramatsu bisected this down to a binutils change:
+
+8dcea93252a9ea7dff57e85220a719e2a5e8ab41 is the first bad commit
+commit 8dcea93252a9ea7dff57e85220a719e2a5e8ab41
+Author: H.J. Lu <hjl.tools@gmail.com>
+Date: Fri May 15 03:17:31 2015 -0700
+
+ Add -mshared option to x86 ELF assembler
+
+ This patch adds -mshared option to x86 ELF assembler. By default,
+ assembler will optimize out non-PLT relocations against defined non-weak
+ global branch targets with default visibility. The -mshared option tells
+ the assembler to generate code which may go into a shared library
+ where all non-weak global branch targets with default visibility can
+ be preempted. The resulting code is slightly bigger. This option
+ only affects the handling of branch instructions.
+
+Declaring ftrace_stub as a weak call prevents gas from using two byte
+jumps to it, which would be converted to a jump to the function graph
+code.
+
+Link: http://lkml.kernel.org/r/20160516230035.1dbae571@gandalf.local.home
+
+Reported-by: Matt Fleming <matt@codeblueprint.co.uk>
+Reported-by: Namhyung Kim <namhyung@kernel.org>
+Tested-by: Matt Fleming <matt@codeblueprint.co.uk>
+Reviewed-by: Masami Hiramatsu <mhiramat@kernel.org>
+Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
+Cc: Jiri Slaby <jslaby@suse.cz>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kernel/mcount_64.S | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/arch/x86/kernel/mcount_64.S
++++ b/arch/x86/kernel/mcount_64.S
+@@ -180,7 +180,8 @@ GLOBAL(ftrace_graph_call)
+ jmp ftrace_stub
+ #endif
+
+-GLOBAL(ftrace_stub)
++/* This is weak to keep gas from relaxing the jumps */
++WEAK(ftrace_stub)
+ retq
+ END(ftrace_caller)
+
--- /dev/null
+From 0b59970e7d96edcb3c7f651d9d48e1a59af3c3b0 Mon Sep 17 00:00:00 2001
+From: Kamal Heib <kamalh@mellanox.com>
+Date: Thu, 10 Nov 2016 10:16:48 +0200
+Subject: IB/IPoIB: Remove can't use GFP_NOIO warning
+
+From: Kamal Heib <kamalh@mellanox.com>
+
+commit 0b59970e7d96edcb3c7f651d9d48e1a59af3c3b0 upstream.
+
+Remove the warning print of "can't use of GFP_NOIO" to avoid prints in
+each QP creation when devices aren't supporting IB_QP_CREATE_USE_GFP_NOIO.
+
+This print become more annoying when the IPoIB interface is configured
+to work in connected mode.
+
+Fixes: 09b93088d750 ('IB: Add a QP creation flag to use GFP_NOIO allocations')
+Signed-off-by: Kamal Heib <kamalh@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Reviewed-by: Yuval Shaia <yuval.shaia@oracle.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/ulp/ipoib/ipoib_cm.c | 2 --
+ 1 file changed, 2 deletions(-)
+
+--- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
++++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
+@@ -1035,8 +1035,6 @@ static struct ib_qp *ipoib_cm_create_tx_
+
+ tx_qp = ib_create_qp(priv->pd, &attr);
+ if (PTR_ERR(tx_qp) == -EINVAL) {
+- ipoib_warn(priv, "can't use GFP_NOIO for QPs on device %s, using GFP_KERNEL\n",
+- priv->ca->name);
+ attr.create_flags &= ~IB_QP_CREATE_USE_GFP_NOIO;
+ tx_qp = ib_create_qp(priv->pd, &attr);
+ }
--- /dev/null
+From c482af646d0809a8d5e1b7f4398cce3592589b98 Mon Sep 17 00:00:00 2001
+From: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Date: Sun, 27 Nov 2016 15:18:19 +0200
+Subject: IB/mlx4: Fix out-of-range array index in destroy qp flow
+
+From: Jack Morgenstein <jackm@dev.mellanox.co.il>
+
+commit c482af646d0809a8d5e1b7f4398cce3592589b98 upstream.
+
+For non-special QPs, the port value becomes non-zero only at the
+RESET-to-INIT transition. If the QP has not undergone that transition,
+its port number value is still zero.
+
+If such a QP is destroyed before being moved out of the RESET state,
+subtracting one from the qp port number results in a negative value.
+Using that negative value as an index into the qp1_proxy array
+results in an out-of-bounds array reference.
+
+Fix this by testing that the QP type is one that uses qp1_proxy before
+using the port number. For special QPs of all types, the port number is
+specified at QP creation time.
+
+Fixes: 9433c188915c ("IB/mlx4: Invoke UPDATE_QP for proxy QP1 on MAC changes")
+Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/mlx4/qp.c | 3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/drivers/infiniband/hw/mlx4/qp.c
++++ b/drivers/infiniband/hw/mlx4/qp.c
+@@ -1207,7 +1207,8 @@ int mlx4_ib_destroy_qp(struct ib_qp *qp)
+ if (is_qp0(dev, mqp))
+ mlx4_CLOSE_PORT(dev->dev, mqp->port);
+
+- if (dev->qp1_proxy[mqp->port - 1] == mqp) {
++ if (mqp->mlx4_ib_qp_type == MLX4_IB_QPT_PROXY_GSI &&
++ dev->qp1_proxy[mqp->port - 1] == mqp) {
+ mutex_lock(&dev->qp1_proxy_lock[mqp->port - 1]);
+ dev->qp1_proxy[mqp->port - 1] = NULL;
+ mutex_unlock(&dev->qp1_proxy_lock[mqp->port - 1]);
--- /dev/null
+From 6fa26208206c406fa529cd73f7ae6bf4181e270b Mon Sep 17 00:00:00 2001
+From: Saeed Mahameed <saeedm@mellanox.com>
+Date: Thu, 10 Nov 2016 11:30:59 +0200
+Subject: IB/mlx4: Fix port query for 56Gb Ethernet links
+
+From: Saeed Mahameed <saeedm@mellanox.com>
+
+commit 6fa26208206c406fa529cd73f7ae6bf4181e270b upstream.
+
+Report the correct speed in the port attributes when using a 56Gbps
+ethernet link. Without this change the field is incorrectly set to 10.
+
+Fixes: a9c766bb75ee ('IB/mlx4: Fix info returned when querying IBoE ports')
+Fixes: 2e96691c31ec ('IB: Use central enum for speed instead of hard-coded values')
+Signed-off-by: Saeed Mahameed <saeedm@mellanox.com>
+Signed-off-by: Yishai Hadas <yishaih@mellanox.com>
+Signed-off-by: Daniel Jurgens <danielj@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/mlx4/main.c | 8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/infiniband/hw/mlx4/main.c
++++ b/drivers/infiniband/hw/mlx4/main.c
+@@ -630,9 +630,11 @@ static int eth_link_query_port(struct ib
+ if (err)
+ goto out;
+
+- props->active_width = (((u8 *)mailbox->buf)[5] == 0x40) ?
+- IB_WIDTH_4X : IB_WIDTH_1X;
+- props->active_speed = IB_SPEED_QDR;
++ props->active_width = (((u8 *)mailbox->buf)[5] == 0x40) ||
++ (((u8 *)mailbox->buf)[5] == 0x20 /*56Gb*/) ?
++ IB_WIDTH_4X : IB_WIDTH_1X;
++ props->active_speed = (((u8 *)mailbox->buf)[5] == 0x20 /*56Gb*/) ?
++ IB_SPEED_FDR : IB_SPEED_QDR;
+ props->port_cap_flags = IB_PORT_CM_SUP | IB_PORT_IP_BASED_GIDS;
+ props->gid_tbl_len = mdev->dev->caps.gid_table_len[port];
+ props->max_msg_sz = mdev->dev->caps.max_msg_sz;
--- /dev/null
+From af4295c117b82a521b05d0daf39ce879d26e6cb1 Mon Sep 17 00:00:00 2001
+From: Maor Gottlieb <maorg@mellanox.com>
+Date: Thu, 10 Nov 2016 11:30:53 +0200
+Subject: IB/mlx4: Set traffic class in AH
+
+From: Maor Gottlieb <maorg@mellanox.com>
+
+commit af4295c117b82a521b05d0daf39ce879d26e6cb1 upstream.
+
+Set traffic class within sl_tclass_flowlabel when create iboe AH.
+Without this the TOS value will be empty when running VLAN tagged
+traffic, because the TOS value is taken from the traffic class in the
+address handle attributes.
+
+Fixes: 9106c4106974 ('IB/mlx4: Fix SL to 802.1Q priority-bits mapping for IBoE')
+Signed-off-by: Maor Gottlieb <maorg@mellanox.com>
+Signed-off-by: Daniel Jurgens <danielj@mellanox.com>
+Reviewed-by: Mark Bloch <markb@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/mlx4/ah.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/hw/mlx4/ah.c
++++ b/drivers/infiniband/hw/mlx4/ah.c
+@@ -113,7 +113,9 @@ static struct ib_ah *create_iboe_ah(stru
+ !(1 << ah->av.eth.stat_rate & dev->caps.stat_rate_support))
+ --ah->av.eth.stat_rate;
+ }
+-
++ ah->av.eth.sl_tclass_flowlabel |=
++ cpu_to_be32((ah_attr->grh.traffic_class << 20) |
++ ah_attr->grh.flow_label);
+ /*
+ * HW requires multicast LID so we just choose one.
+ */
+@@ -121,7 +123,7 @@ static struct ib_ah *create_iboe_ah(stru
+ ah->av.ib.dlid = cpu_to_be16(0xc000);
+
+ memcpy(ah->av.eth.dgid, ah_attr->grh.dgid.raw, 16);
+- ah->av.eth.sl_tclass_flowlabel = cpu_to_be32(ah_attr->sl << 29);
++ ah->av.eth.sl_tclass_flowlabel |= cpu_to_be32(ah_attr->sl << 29);
+
+ return &ah->ibah;
+ }
--- /dev/null
+From 1f22e454df2eb99ba6b7ace3f594f6805cdf5cbc Mon Sep 17 00:00:00 2001
+From: Eran Ben Elisha <eranbe@mellanox.com>
+Date: Thu, 10 Nov 2016 11:31:00 +0200
+Subject: IB/mlx4: When no DMFS for IPoIB, don't allow NET_IF QPs
+
+From: Eran Ben Elisha <eranbe@mellanox.com>
+
+commit 1f22e454df2eb99ba6b7ace3f594f6805cdf5cbc upstream.
+
+According to the firmware spec, FLOW_STEERING_IB_UC_QP_RANGE command is
+supported only if dmfs_ipoib bit is set.
+
+If it isn't set we want to ensure allocating NET_IF QPs fail. We do so
+by filling out the allocation bitmap. By thus, the NET_IF QPs allocating
+function won't find any free QP and will fail.
+
+Fixes: c1c98501121e ('IB/mlx4: Add support for steerable IB UD QPs')
+Signed-off-by: Eran Ben Elisha <eranbe@mellanox.com>
+Signed-off-by: Daniel Jurgens <danielj@mellanox.com>
+Reviewed-by: Mark Bloch <markb@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/mlx4/main.c | 21 +++++++++++++--------
+ 1 file changed, 13 insertions(+), 8 deletions(-)
+
+--- a/drivers/infiniband/hw/mlx4/main.c
++++ b/drivers/infiniband/hw/mlx4/main.c
+@@ -2403,14 +2403,19 @@ static void *mlx4_ib_add(struct mlx4_dev
+ goto err_steer_qp_release;
+ }
+
+- bitmap_zero(ibdev->ib_uc_qpns_bitmap, ibdev->steer_qpn_count);
+-
+- err = mlx4_FLOW_STEERING_IB_UC_QP_RANGE(
+- dev, ibdev->steer_qpn_base,
+- ibdev->steer_qpn_base +
+- ibdev->steer_qpn_count - 1);
+- if (err)
+- goto err_steer_free_bitmap;
++ if (dev->caps.flags2 & MLX4_DEV_CAP_FLAG2_DMFS_IPOIB) {
++ bitmap_zero(ibdev->ib_uc_qpns_bitmap,
++ ibdev->steer_qpn_count);
++ err = mlx4_FLOW_STEERING_IB_UC_QP_RANGE(
++ dev, ibdev->steer_qpn_base,
++ ibdev->steer_qpn_base +
++ ibdev->steer_qpn_count - 1);
++ if (err)
++ goto err_steer_free_bitmap;
++ } else {
++ bitmap_fill(ibdev->ib_uc_qpns_bitmap,
++ ibdev->steer_qpn_count);
++ }
+ }
+
+ for (j = 1; j <= ibdev->dev->caps.num_ports; j++)
--- /dev/null
+From acbda523884dcf45613bf6818d8ead5180df35c2 Mon Sep 17 00:00:00 2001
+From: Eli Cohen <eli@mellanox.com>
+Date: Thu, 27 Oct 2016 16:36:43 +0300
+Subject: IB/mlx5: Wait for all async command completions to complete
+
+From: Eli Cohen <eli@mellanox.com>
+
+commit acbda523884dcf45613bf6818d8ead5180df35c2 upstream.
+
+Wait before continuing unload till all pending mkey async creation requests
+are done.
+
+Fixes: e126ba97dba9 ('mlx5: Add driver for Mellanox Connect-IB adapters')
+Signed-off-by: Eli Cohen <eli@mellanox.com>
+Signed-off-by: Maor Gottlieb <maorg@mellanox.com>
+Signed-off-by: Leon Romanovsky <leon@kernel.org>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/mlx5/mr.c | 28 ++++++++++++++++++++++++++++
+ 1 file changed, 28 insertions(+)
+
+--- a/drivers/infiniband/hw/mlx5/mr.c
++++ b/drivers/infiniband/hw/mlx5/mr.c
+@@ -614,6 +614,33 @@ int mlx5_mr_cache_init(struct mlx5_ib_de
+ return 0;
+ }
+
++static void wait_for_async_commands(struct mlx5_ib_dev *dev)
++{
++ struct mlx5_mr_cache *cache = &dev->cache;
++ struct mlx5_cache_ent *ent;
++ int total = 0;
++ int i;
++ int j;
++
++ for (i = 0; i < MAX_MR_CACHE_ENTRIES; i++) {
++ ent = &cache->ent[i];
++ for (j = 0 ; j < 1000; j++) {
++ if (!ent->pending)
++ break;
++ msleep(50);
++ }
++ }
++ for (i = 0; i < MAX_MR_CACHE_ENTRIES; i++) {
++ ent = &cache->ent[i];
++ total += ent->pending;
++ }
++
++ if (total)
++ mlx5_ib_warn(dev, "aborted while there are %d pending mr requests\n", total);
++ else
++ mlx5_ib_warn(dev, "done with all pending requests\n");
++}
++
+ int mlx5_mr_cache_cleanup(struct mlx5_ib_dev *dev)
+ {
+ int i;
+@@ -627,6 +654,7 @@ int mlx5_mr_cache_cleanup(struct mlx5_ib
+ clean_keys(dev, i);
+
+ destroy_workqueue(dev->cache.wq);
++ wait_for_async_commands(dev);
+ del_timer_sync(&dev->delay_timer);
+
+ return 0;
--- /dev/null
+From cf346d5bd4b9d61656df2f72565c9b354ef3ca0d Mon Sep 17 00:00:00 2001
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+Date: Tue, 25 Oct 2016 17:20:47 -0300
+Subject: perf scripting: Avoid leaking the scripting_context variable
+
+From: Arnaldo Carvalho de Melo <acme@redhat.com>
+
+commit cf346d5bd4b9d61656df2f72565c9b354ef3ca0d upstream.
+
+Both register_perl_scripting() and register_python_scripting() allocate
+this variable, fix it by checking if it already was.
+
+Cc: Adrian Hunter <adrian.hunter@intel.com>
+Cc: David Ahern <dsahern@gmail.com>
+Cc: Frederic Weisbecker <fweisbec@gmail.com>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Namhyung Kim <namhyung@kernel.org>
+Cc: Tom Zanussi <tzanussi@gmail.com>
+Cc: Wang Nan <wangnan0@huawei.com>
+Fixes: 7e4b21b84c43 ("perf/scripts: Add Python scripting engine")
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ tools/perf/util/trace-event-scripting.c | 6 ++++--
+ 1 file changed, 4 insertions(+), 2 deletions(-)
+
+--- a/tools/perf/util/trace-event-scripting.c
++++ b/tools/perf/util/trace-event-scripting.c
+@@ -95,7 +95,8 @@ static void register_python_scripting(st
+ if (err)
+ die("error registering py script extension");
+
+- scripting_context = malloc(sizeof(struct scripting_context));
++ if (scripting_context == NULL)
++ scripting_context = malloc(sizeof(*scripting_context));
+ }
+
+ #ifdef NO_LIBPYTHON
+@@ -159,7 +160,8 @@ static void register_perl_scripting(stru
+ if (err)
+ die("error registering pl script extension");
+
+- scripting_context = malloc(sizeof(struct scripting_context));
++ if (scripting_context == NULL)
++ scripting_context = malloc(sizeof(*scripting_context));
+ }
+
+ #ifdef NO_LIBPERL
ftrace-x86-set-ftrace_stub-to-weak-to-prevent-gcc-from-using-short-jumps-to-it.patch
-ib-mlx5-avoid-system-crash-when-enabling-many-vfs.patch
-ib-mlx5-fix-reported-max-sge-calculation.patch
ib-mlx5-wait-for-all-async-command-completions-to-complete.patch
ib-mlx4-set-traffic-class-in-ah.patch
ib-mlx4-fix-out-of-range-array-index-in-destroy-qp-flow.patch
-ib-mlx4-handle-well-known-gid-in-mad_demux-processing.patch
ib-mlx4-fix-port-query-for-56gb-ethernet-links.patch
ib-mlx4-when-no-dmfs-for-ipoib-don-t-allow-net_if-qps.patch
ib-ipoib-remove-can-t-use-gfp_noio-warning.patch
arm-dts-imx31-fix-clock-control-module-interrupts-description.patch
arm-dts-imx31-move-ccm-device-node-to-aips2-bus-devices.patch
arm-dts-imx31-fix-avic-base-address.patch
+tmpfs-clear-s_isgid-when-setting-posix-acls.patch
--- /dev/null
+From 497de07d89c1410d76a15bec2bb41f24a2a89f31 Mon Sep 17 00:00:00 2001
+From: Gu Zheng <guzheng1@huawei.com>
+Date: Mon, 9 Jan 2017 09:34:48 +0800
+Subject: tmpfs: clear S_ISGID when setting posix ACLs
+
+From: Gu Zheng <guzheng1@huawei.com>
+
+commit 497de07d89c1410d76a15bec2bb41f24a2a89f31 upstream.
+
+This change was missed the tmpfs modification in In CVE-2016-7097
+commit 073931017b49 ("posix_acl: Clear SGID bit when setting
+file permissions")
+It can test by xfstest generic/375, which failed to clear
+setgid bit in the following test case on tmpfs:
+
+ touch $testfile
+ chown 100:100 $testfile
+ chmod 2755 $testfile
+ _runas -u 100 -g 101 -- setfacl -m u::rwx,g::rwx,o::rwx $testfile
+
+Signed-off-by: Gu Zheng <guzheng1@huawei.com>
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Cc: Brad Spengler <spender@grsecurity.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/posix_acl.c | 9 ++++-----
+ 1 file changed, 4 insertions(+), 5 deletions(-)
+
+--- a/fs/posix_acl.c
++++ b/fs/posix_acl.c
+@@ -903,11 +903,10 @@ int simple_set_acl(struct inode *inode,
+ int error;
+
+ if (type == ACL_TYPE_ACCESS) {
+- error = posix_acl_equiv_mode(acl, &inode->i_mode);
+- if (error < 0)
+- return 0;
+- if (error == 0)
+- acl = NULL;
++ error = posix_acl_update_mode(inode,
++ &inode->i_mode, &acl);
++ if (error)
++ return error;
+ }
+
+ inode->i_ctime = CURRENT_TIME;
projects / thirdparty / kernel / stable-queue.git / commitdiff
