--- /dev/null
+From ad6afbe9578d1fa26680faf78c846bd8c00d1d6e Mon Sep 17 00:00:00 2001
+From: Manish Chopra <Manish.Chopra@qlogic.com>
+Date: Thu, 25 Jun 2015 15:19:24 +0300
+Subject: bnx2x: Don't notify about scratchpad parities
+
+From: Manish Chopra <Manish.Chopra@qlogic.com>
+
+commit ad6afbe9578d1fa26680faf78c846bd8c00d1d6e upstream.
+
+The scratchpad is a shared block between all functions of a given device.
+Due to HW limitations, we can't properly close its parity notifications
+to all functions on legal flows.
+E.g., it's possible that while taking a register dump from one function
+a parity error would be triggered on other functions.
+
+Today driver doesn't consider this parity as a 'real' parity unless its
+being accompanied by additional indications [which would happen in a real
+parity scenario]; But it does print notifications for such events in the
+system logs.
+
+This eliminates such prints - in case of real parities driver would have
+additional indications; But if this is the only signal user will not even
+see a parity being logged in the system.
+
+Signed-off-by: Manish Chopra <Manish.Chopra@qlogic.com>
+Signed-off-by: Yuval Mintz <Yuval.Mintz@qlogic.com>
+Signed-off-by: Ariel Elior <Ariel.Elior@qlogic.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Patrick Schaaf <netdev@bof.de>
+Tested-by: Patrick Schaaf <netdev@bof.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+
+---
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x.h | 11 +++++++----
+ drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c | 20 ++++++++++++++------
+ 2 files changed, 21 insertions(+), 10 deletions(-)
+
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x.h
+@@ -2401,10 +2401,13 @@ void bnx2x_igu_clear_sb_gen(struct bnx2x
+ AEU_INPUTS_ATTN_BITS_IGU_PARITY_ERROR | \
+ AEU_INPUTS_ATTN_BITS_MISC_PARITY_ERROR)
+
+-#define HW_PRTY_ASSERT_SET_3 (AEU_INPUTS_ATTN_BITS_MCP_LATCHED_ROM_PARITY | \
+- AEU_INPUTS_ATTN_BITS_MCP_LATCHED_UMP_RX_PARITY | \
+- AEU_INPUTS_ATTN_BITS_MCP_LATCHED_UMP_TX_PARITY | \
+- AEU_INPUTS_ATTN_BITS_MCP_LATCHED_SCPAD_PARITY)
++#define HW_PRTY_ASSERT_SET_3_WITHOUT_SCPAD \
++ (AEU_INPUTS_ATTN_BITS_MCP_LATCHED_ROM_PARITY | \
++ AEU_INPUTS_ATTN_BITS_MCP_LATCHED_UMP_RX_PARITY | \
++ AEU_INPUTS_ATTN_BITS_MCP_LATCHED_UMP_TX_PARITY)
++
++#define HW_PRTY_ASSERT_SET_3 (HW_PRTY_ASSERT_SET_3_WITHOUT_SCPAD | \
++ AEU_INPUTS_ATTN_BITS_MCP_LATCHED_SCPAD_PARITY)
+
+ #define HW_PRTY_ASSERT_SET_4 (AEU_INPUTS_ATTN_BITS_PGLUE_PARITY_ERROR | \
+ AEU_INPUTS_ATTN_BITS_ATC_PARITY_ERROR)
+--- a/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
++++ b/drivers/net/ethernet/broadcom/bnx2x/bnx2x_main.c
+@@ -4631,9 +4631,7 @@ static bool bnx2x_check_blocks_with_pari
+ res |= true;
+ break;
+ case AEU_INPUTS_ATTN_BITS_MCP_LATCHED_SCPAD_PARITY:
+- if (print)
+- _print_next_block((*par_num)++,
+- "MCP SCPAD");
++ (*par_num)++;
+ /* clear latched SCPAD PATIRY from MCP */
+ REG_WR(bp, MISC_REG_AEU_CLR_LATCH_SIGNAL,
+ 1UL << 10);
+@@ -4695,6 +4693,7 @@ static bool bnx2x_parity_attn(struct bnx
+ (sig[3] & HW_PRTY_ASSERT_SET_3) ||
+ (sig[4] & HW_PRTY_ASSERT_SET_4)) {
+ int par_num = 0;
++
+ DP(NETIF_MSG_HW, "Was parity error: HW block parity attention:\n"
+ "[0]:0x%08x [1]:0x%08x [2]:0x%08x [3]:0x%08x [4]:0x%08x\n",
+ sig[0] & HW_PRTY_ASSERT_SET_0,
+@@ -4702,9 +4701,18 @@ static bool bnx2x_parity_attn(struct bnx
+ sig[2] & HW_PRTY_ASSERT_SET_2,
+ sig[3] & HW_PRTY_ASSERT_SET_3,
+ sig[4] & HW_PRTY_ASSERT_SET_4);
+- if (print)
+- netdev_err(bp->dev,
+- "Parity errors detected in blocks: ");
++ if (print) {
++ if (((sig[0] & HW_PRTY_ASSERT_SET_0) ||
++ (sig[1] & HW_PRTY_ASSERT_SET_1) ||
++ (sig[2] & HW_PRTY_ASSERT_SET_2) ||
++ (sig[4] & HW_PRTY_ASSERT_SET_4)) ||
++ (sig[3] & HW_PRTY_ASSERT_SET_3_WITHOUT_SCPAD)) {
++ netdev_err(bp->dev,
++ "Parity errors detected in blocks: ");
++ } else {
++ print = false;
++ }
++ }
+ res |= bnx2x_check_blocks_with_parity0(bp,
+ sig[0] & HW_PRTY_ASSERT_SET_0, &par_num, print);
+ res |= bnx2x_check_blocks_with_parity1(bp,
--- /dev/null
+From 90cfde46586d2286488d8ed636929e936c0c9ab2 Mon Sep 17 00:00:00 2001
+From: Gerhard Uttenthaler <uttenthaler@ems-wuensche.com>
+Date: Tue, 22 Dec 2015 17:29:16 +0100
+Subject: can: ems_usb: Fix possible tx overflow
+
+From: Gerhard Uttenthaler <uttenthaler@ems-wuensche.com>
+
+commit 90cfde46586d2286488d8ed636929e936c0c9ab2 upstream.
+
+This patch fixes the problem that more CAN messages could be sent to the
+interface as could be send on the CAN bus. This was more likely for slow baud
+rates. The sleeping _start_xmit was woken up in the _write_bulk_callback. Under
+heavy TX load this produced another bulk transfer without checking the
+free_slots variable and hence caused the overflow in the interface.
+
+Signed-off-by: Gerhard Uttenthaler <uttenthaler@ems-wuensche.com>
+Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/net/can/usb/ems_usb.c | 14 ++++++++++----
+ 1 file changed, 10 insertions(+), 4 deletions(-)
+
+--- a/drivers/net/can/usb/ems_usb.c
++++ b/drivers/net/can/usb/ems_usb.c
+@@ -117,6 +117,9 @@ MODULE_LICENSE("GPL v2");
+ */
+ #define EMS_USB_ARM7_CLOCK 8000000
+
++#define CPC_TX_QUEUE_TRIGGER_LOW 25
++#define CPC_TX_QUEUE_TRIGGER_HIGH 35
++
+ /*
+ * CAN-Message representation in a CPC_MSG. Message object type is
+ * CPC_MSG_TYPE_CAN_FRAME or CPC_MSG_TYPE_RTR_FRAME or
+@@ -278,6 +281,11 @@ static void ems_usb_read_interrupt_callb
+ switch (urb->status) {
+ case 0:
+ dev->free_slots = dev->intr_in_buffer[1];
++ if(dev->free_slots > CPC_TX_QUEUE_TRIGGER_HIGH){
++ if (netif_queue_stopped(netdev)){
++ netif_wake_queue(netdev);
++ }
++ }
+ break;
+
+ case -ECONNRESET: /* unlink */
+@@ -529,8 +537,6 @@ static void ems_usb_write_bulk_callback(
+ /* Release context */
+ context->echo_index = MAX_TX_URBS;
+
+- if (netif_queue_stopped(netdev))
+- netif_wake_queue(netdev);
+ }
+
+ /*
+@@ -590,7 +596,7 @@ static int ems_usb_start(struct ems_usb
+ int err, i;
+
+ dev->intr_in_buffer[0] = 0;
+- dev->free_slots = 15; /* initial size */
++ dev->free_slots = 50; /* initial size */
+
+ for (i = 0; i < MAX_RX_URBS; i++) {
+ struct urb *urb = NULL;
+@@ -841,7 +847,7 @@ static netdev_tx_t ems_usb_start_xmit(st
+
+ /* Slow down tx path */
+ if (atomic_read(&dev->active_tx_urbs) >= MAX_TX_URBS ||
+- dev->free_slots < 5) {
++ dev->free_slots < CPC_TX_QUEUE_TRIGGER_LOW) {
+ netif_stop_queue(netdev);
+ }
+ }
--- /dev/null
+From 9f12600fe425bc28f0ccba034a77783c09c15af4 Mon Sep 17 00:00:00 2001
+From: Linus Torvalds <torvalds@linux-foundation.org>
+Date: Sat, 31 May 2014 09:13:21 -0700
+Subject: dcache: add missing lockdep annotation
+
+From: Linus Torvalds <torvalds@linux-foundation.org>
+
+commit 9f12600fe425bc28f0ccba034a77783c09c15af4 upstream.
+
+lock_parent() very much on purpose does nested locking of dentries, and
+is careful to maintain the right order (lock parent first). But because
+it didn't annotate the nested locking order, lockdep thought it might be
+a deadlock on d_lock, and complained.
+
+Add the proper annotation for the inner locking of the child dentry to
+make lockdep happy.
+
+Introduced by commit 046b961b45f9 ("shrink_dentry_list(): take parent's
+->d_lock earlier").
+
+Reported-and-tested-by: Josh Boyer <jwboyer@fedoraproject.org>
+Cc: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/dcache.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -551,7 +551,7 @@ again:
+ }
+ rcu_read_unlock();
+ if (parent != dentry)
+- spin_lock(&dentry->d_lock);
++ spin_lock_nested(&dentry->d_lock, DENTRY_D_LOCK_NESTED);
+ else
+ parent = NULL;
+ return parent;
--- /dev/null
+From b2b80195d8829921506880f6dccd21cabd163d0d Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Thu, 29 May 2014 09:11:45 -0400
+Subject: dealing with the rest of shrink_dentry_list() livelock
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit b2b80195d8829921506880f6dccd21cabd163d0d upstream.
+
+We have the same problem with ->d_lock order in the inner loop, where
+we are dropping references to ancestors. Same solution, basically -
+instead of using dentry_kill() we use lock_parent() (introduced in the
+previous commit) to get that lock in a safe way, recheck ->d_count
+(in case if lock_parent() has ended up dropping and retaking ->d_lock
+and somebody managed to grab a reference during that window), trylock
+the inode->i_lock and use __dentry_kill() to do the rest.
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/dcache.c | 22 ++++++++++++++++++++--
+ 1 file changed, 20 insertions(+), 2 deletions(-)
+
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -886,8 +886,26 @@ static void shrink_dentry_list(struct li
+ * fragmentation.
+ */
+ dentry = parent;
+- while (dentry && !lockref_put_or_lock(&dentry->d_lockref))
+- dentry = dentry_kill(dentry, 1);
++ while (dentry && !lockref_put_or_lock(&dentry->d_lockref)) {
++ parent = lock_parent(dentry);
++ if (dentry->d_lockref.count != 1) {
++ dentry->d_lockref.count--;
++ spin_unlock(&dentry->d_lock);
++ if (parent)
++ spin_unlock(&parent->d_lock);
++ break;
++ }
++ inode = dentry->d_inode; /* can't be NULL */
++ if (unlikely(!spin_trylock(&inode->i_lock))) {
++ spin_unlock(&dentry->d_lock);
++ if (parent)
++ spin_unlock(&parent->d_lock);
++ cpu_relax();
++ continue;
++ }
++ __dentry_kill(dentry);
++ dentry = parent;
++ }
+ }
+ }
+
--- /dev/null
+From 8cbf74da435d1bd13dbb790f94c7ff67b2fb6af4 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Thu, 29 May 2014 09:18:26 -0400
+Subject: dentry_kill() doesn't need the second argument now
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit 8cbf74da435d1bd13dbb790f94c7ff67b2fb6af4 upstream.
+
+it's 1 in the only remaining caller.
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/dcache.c | 11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -498,8 +498,7 @@ static void __dentry_kill(struct dentry
+ * If ref is non-zero, then decrement the refcount too.
+ * Returns dentry requiring refcount drop, or NULL if we're done.
+ */
+-static struct dentry *
+-dentry_kill(struct dentry *dentry, int unlock_on_failure)
++static struct dentry *dentry_kill(struct dentry *dentry)
+ __releases(dentry->d_lock)
+ {
+ struct inode *inode = dentry->d_inode;
+@@ -521,10 +520,8 @@ dentry_kill(struct dentry *dentry, int u
+ return parent;
+
+ failed:
+- if (unlock_on_failure) {
+- spin_unlock(&dentry->d_lock);
+- cpu_relax();
+- }
++ spin_unlock(&dentry->d_lock);
++ cpu_relax();
+ return dentry; /* try again with same dentry */
+ }
+
+@@ -616,7 +613,7 @@ repeat:
+ return;
+
+ kill_it:
+- dentry = dentry_kill(dentry, 1);
++ dentry = dentry_kill(dentry);
+ if (dentry)
+ goto repeat;
+ }
--- /dev/null
+From 18d03e8c25f173f4107a40d0b8c24defb6ed69f3 Mon Sep 17 00:00:00 2001
+From: Nikolay Borisov <kernel@kyup.com>
+Date: Thu, 17 Dec 2015 18:03:35 +0200
+Subject: dm thin: fix race condition when destroying thin pool workqueue
+
+From: Nikolay Borisov <kernel@kyup.com>
+
+commit 18d03e8c25f173f4107a40d0b8c24defb6ed69f3 upstream.
+
+When a thin pool is being destroyed delayed work items are
+cancelled using cancel_delayed_work(), which doesn't guarantee that on
+return the delayed item isn't running. This can cause the work item to
+requeue itself on an already destroyed workqueue. Fix this by using
+cancel_delayed_work_sync() which guarantees that on return the work item
+is not running anymore.
+
+Fixes: 905e51b39a555 ("dm thin: commit outstanding data every second")
+Fixes: 85ad643b7e7e5 ("dm thin: add timeout to stop out-of-data-space mode holding IO forever")
+Signed-off-by: Nikolay Borisov <kernel@kyup.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-thin.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -2568,8 +2568,8 @@ static void pool_postsuspend(struct dm_t
+ struct pool_c *pt = ti->private;
+ struct pool *pool = pt->pool;
+
+- cancel_delayed_work(&pool->waker);
+- cancel_delayed_work(&pool->no_space_timeout);
++ cancel_delayed_work_sync(&pool->waker);
++ cancel_delayed_work_sync(&pool->no_space_timeout);
+ flush_workqueue(pool->wq);
+ (void) commit(pool);
+ }
--- /dev/null
+From 49e99fc717f624aa75ca755d6e7bc029efd3f0e9 Mon Sep 17 00:00:00 2001
+From: Joe Thornber <ejt@redhat.com>
+Date: Wed, 9 Dec 2015 16:23:24 +0000
+Subject: dm thin metadata: fix bug when taking a metadata snapshot
+
+From: Joe Thornber <ejt@redhat.com>
+
+commit 49e99fc717f624aa75ca755d6e7bc029efd3f0e9 upstream.
+
+When you take a metadata snapshot the btree roots for the mapping and
+details tree need to have their reference counts incremented so they
+persist for the lifetime of the metadata snap.
+
+The roots being incremented were those currently written in the
+superblock, which could possibly be out of date if concurrent IO is
+triggering new mappings, breaking of sharing, etc.
+
+Fix this by performing a commit with the metadata lock held while taking
+a metadata snapshot.
+
+Signed-off-by: Joe Thornber <ejt@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-thin-metadata.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/drivers/md/dm-thin-metadata.c
++++ b/drivers/md/dm-thin-metadata.c
+@@ -1205,6 +1205,12 @@ static int __reserve_metadata_snap(struc
+ dm_block_t held_root;
+
+ /*
++ * We commit to ensure the btree roots which we increment in a
++ * moment are up to date.
++ */
++ __commit_transaction(pmd);
++
++ /*
+ * Copy the superblock.
+ */
+ dm_sm_inc_block(pmd->metadata_sm, THIN_SUPERBLOCK_LOCATION);
--- /dev/null
+From 172c238612ebf81cabccc86b788c9209af591f61 Mon Sep 17 00:00:00 2001
+From: Mike Snitzer <snitzer@redhat.com>
+Date: Fri, 6 Nov 2015 10:53:01 -0500
+Subject: dm thin: restore requested 'error_if_no_space' setting on OODS to WRITE transition
+
+From: Mike Snitzer <snitzer@redhat.com>
+
+commit 172c238612ebf81cabccc86b788c9209af591f61 upstream.
+
+A thin-pool that is in out-of-data-space (OODS) mode may transition back
+to write mode -- without the admin adding more space to the thin-pool --
+if/when blocks are released (either by deleting thin devices or
+discarding provisioned blocks).
+
+But as part of the thin-pool's earlier transition to out-of-data-space
+mode the thin-pool may have set the 'error_if_no_space' flag to true if
+the no_space_timeout expires without more space having been made
+available. That implementation detail, of changing the pool's
+error_if_no_space setting, needs to be reset back to the default that
+the user specified when the thin-pool's table was loaded.
+
+Otherwise we'll drop the user requested behaviour on the floor when this
+out-of-data-space to write mode transition occurs.
+
+Reported-by: Vivek Goyal <vgoyal@redhat.com>
+Signed-off-by: Mike Snitzer <snitzer@redhat.com>
+Acked-by: Joe Thornber <ejt@redhat.com>
+Fixes: 2c43fd26e4 ("dm thin: fix missing out-of-data-space to write mode transition if blocks are released")
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/md/dm-thin.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/drivers/md/dm-thin.c
++++ b/drivers/md/dm-thin.c
+@@ -1619,6 +1619,7 @@ static void set_pool_mode(struct pool *p
+ case PM_WRITE:
+ if (old_mode != new_mode)
+ notify_of_pool_mode_change(pool, "write");
++ pool->pf.error_if_no_space = pt->requested_pf.error_if_no_space;
+ dm_pool_metadata_read_write(pool->pmd);
+ pool->process_bio = process_bio;
+ pool->process_discard = process_discard;
--- /dev/null
+From 7f98ca454ad373fc1b76be804fa7138ff68c1d27 Mon Sep 17 00:00:00 2001
+From: Dave Airlie <airlied@redhat.com>
+Date: Thu, 20 Aug 2015 10:13:55 +1000
+Subject: drm/radeon: fix hotplug race at startup
+
+From: Dave Airlie <airlied@redhat.com>
+
+commit 7f98ca454ad373fc1b76be804fa7138ff68c1d27 upstream.
+
+We apparantly get a hotplug irq before we've initialised
+modesetting,
+
+[drm] Loading R100 Microcode
+BUG: unable to handle kernel NULL pointer dereference at (null)
+IP: [<c125f56f>] __mutex_lock_slowpath+0x23/0x91
+*pde = 00000000
+Oops: 0002 [#1]
+Modules linked in: radeon(+) drm_kms_helper ttm drm i2c_algo_bit backlight pcspkr psmouse evdev sr_mod input_leds led_class cdrom sg parport_pc parport floppy intel_agp intel_gtt lpc_ich acpi_cpufreq processor button mfd_core agpgart uhci_hcd ehci_hcd rng_core snd_intel8x0 snd_ac97_codec ac97_bus snd_pcm usbcore usb_common i2c_i801 i2c_core snd_timer snd soundcore thermal_sys
+CPU: 0 PID: 15 Comm: kworker/0:1 Not tainted 4.2.0-rc7-00015-gbf67402 #111
+Hardware name: MicroLink /D850MV , BIOS MV85010A.86A.0067.P24.0304081124 04/08/2003
+Workqueue: events radeon_hotplug_work_func [radeon]
+task: f6ca5900 ti: f6d3e000 task.ti: f6d3e000
+EIP: 0060:[<c125f56f>] EFLAGS: 00010282 CPU: 0
+EIP is at __mutex_lock_slowpath+0x23/0x91
+EAX: 00000000 EBX: f5e900fc ECX: 00000000 EDX: fffffffe
+ESI: f6ca5900 EDI: f5e90100 EBP: f5e90000 ESP: f6d3ff0c
+ DS: 007b ES: 007b FS: 0000 GS: 0000 SS: 0068
+CR0: 8005003b CR2: 00000000 CR3: 36f61000 CR4: 000006d0
+Stack:
+ f5e90100 00000000 c103c4c1 f6d2a5a0 f5e900fc f6df394c c125f162 f8b0faca
+ f6d2a5a0 c138ca00 f6df394c f7395600 c1034741 00d40000 00000000 f6d2a5a0
+ c138ca00 f6d2a5b8 c138ca10 c1034b58 00000001 f6d40000 f6ca5900 f6d0c940
+Call Trace:
+ [<c103c4c1>] ? dequeue_task_fair+0xa4/0xb7
+ [<c125f162>] ? mutex_lock+0x9/0xa
+ [<f8b0faca>] ? radeon_hotplug_work_func+0x17/0x57 [radeon]
+ [<c1034741>] ? process_one_work+0xfc/0x194
+ [<c1034b58>] ? worker_thread+0x18d/0x218
+ [<c10349cb>] ? rescuer_thread+0x1d5/0x1d5
+ [<c103742a>] ? kthread+0x7b/0x80
+ [<c12601c0>] ? ret_from_kernel_thread+0x20/0x30
+ [<c10373af>] ? init_completion+0x18/0x18
+Code: 42 08 e8 8e a6 dd ff c3 57 56 53 83 ec 0c 8b 35 48 f7 37 c1 8b 10 4a 74 1a 89 c3 8d 78 04 8b 40 08 89 63
+
+Reported-and-Tested-by: Meelis Roos <mroos@linux.ee>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/radeon/radeon_irq_kms.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/drivers/gpu/drm/radeon/radeon_irq_kms.c
++++ b/drivers/gpu/drm/radeon/radeon_irq_kms.c
+@@ -79,6 +79,11 @@ static void radeon_hotplug_work_func(str
+ struct drm_mode_config *mode_config = &dev->mode_config;
+ struct drm_connector *connector;
+
++ /* we can race here at startup, some boards seem to trigger
++ * hotplug irqs when they shouldn't. */
++ if (!rdev->mode_info.mode_config_initialized)
++ return;
++
+ mutex_lock(&mode_config->mutex);
+ if (mode_config->num_connector) {
+ list_for_each_entry(connector, &mode_config->connector_list, head)
--- /dev/null
+From 23a0d4e8fa6d3a1d7fb819f79bcc0a3739c30ba9 Mon Sep 17 00:00:00 2001
+From: Ingo Molnar <mingo@kernel.org>
+Date: Tue, 3 Mar 2015 07:34:33 +0100
+Subject: efi: Disable interrupts around EFI calls, not in the epilog/prolog calls
+
+From: Ingo Molnar <mingo@kernel.org>
+
+commit 23a0d4e8fa6d3a1d7fb819f79bcc0a3739c30ba9 upstream.
+
+Tapasweni Pathak reported that we do a kmalloc() in efi_call_phys_prolog()
+on x86-64 while having interrupts disabled, which is a big no-no, as
+kmalloc() can sleep.
+
+Solve this by removing the irq disabling from the prolog/epilog calls
+around EFI calls: it's unnecessary, as in this stage we are single
+threaded in the boot thread, and we don't ever execute this from
+interrupt contexts.
+
+Reported-by: Tapasweni Pathak <tapaswenipathak@gmail.com>
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Signed-off-by: Matt Fleming <matt.fleming@intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/platform/efi/efi.c | 7 +++++++
+ arch/x86/platform/efi/efi_32.c | 11 +++--------
+ arch/x86/platform/efi/efi_64.c | 3 ---
+ 3 files changed, 10 insertions(+), 11 deletions(-)
+
+--- a/arch/x86/platform/efi/efi.c
++++ b/arch/x86/platform/efi/efi.c
+@@ -248,12 +248,19 @@ static efi_status_t __init phys_efi_set_
+ efi_memory_desc_t *virtual_map)
+ {
+ efi_status_t status;
++ unsigned long flags;
+
+ efi_call_phys_prelog();
++
++ /* Disable interrupts around EFI calls: */
++ local_irq_save(flags);
+ status = efi_call_phys4(efi_phys.set_virtual_address_map,
+ memory_map_size, descriptor_size,
+ descriptor_version, virtual_map);
++ local_irq_restore(flags);
++
+ efi_call_phys_epilog();
++
+ return status;
+ }
+
+--- a/arch/x86/platform/efi/efi_32.c
++++ b/arch/x86/platform/efi/efi_32.c
+@@ -33,11 +33,10 @@
+
+ /*
+ * To make EFI call EFI runtime service in physical addressing mode we need
+- * prelog/epilog before/after the invocation to disable interrupt, to
+- * claim EFI runtime service handler exclusively and to duplicate a memory in
+- * low memory space say 0 - 3G.
++ * prolog/epilog before/after the invocation to claim the EFI runtime service
++ * handler exclusively and to duplicate a memory mapping in low memory space,
++ * say 0 - 3G.
+ */
+-static unsigned long efi_rt_eflags;
+
+ void efi_sync_low_kernel_mappings(void) {}
+ void __init efi_dump_pagetable(void) {}
+@@ -59,8 +58,6 @@ void efi_call_phys_prelog(void)
+ {
+ struct desc_ptr gdt_descr;
+
+- local_irq_save(efi_rt_eflags);
+-
+ load_cr3(initial_page_table);
+ __flush_tlb_all();
+
+@@ -79,8 +76,6 @@ void efi_call_phys_epilog(void)
+
+ load_cr3(swapper_pg_dir);
+ __flush_tlb_all();
+-
+- local_irq_restore(efi_rt_eflags);
+ }
+
+ void __init efi_runtime_mkexec(void)
+--- a/arch/x86/platform/efi/efi_64.c
++++ b/arch/x86/platform/efi/efi_64.c
+@@ -41,7 +41,6 @@
+ #include <asm/realmode.h>
+
+ static pgd_t *save_pgd __initdata;
+-static unsigned long efi_flags __initdata;
+
+ /*
+ * We allocate runtime services regions bottom-up, starting from -4G, i.e.
+@@ -87,7 +86,6 @@ void __init efi_call_phys_prelog(void)
+ return;
+
+ early_code_mapping_set_exec(1);
+- local_irq_save(efi_flags);
+
+ n_pgds = DIV_ROUND_UP((max_pfn << PAGE_SHIFT), PGDIR_SIZE);
+ save_pgd = kmalloc(n_pgds * sizeof(pgd_t), GFP_KERNEL);
+@@ -115,7 +113,6 @@ void __init efi_call_phys_epilog(void)
+ set_pgd(pgd_offset_k(pgd * PGDIR_SIZE), save_pgd[pgd]);
+ kfree(save_pgd);
+ __flush_tlb_all();
+- local_irq_restore(efi_flags);
+ early_code_mapping_set_exec(0);
+ }
+
--- /dev/null
+From ff2fde9929feb2aef45377ce56b8b12df85dda69 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Wed, 28 May 2014 13:59:13 -0400
+Subject: expand dentry_kill(dentry, 0) in shrink_dentry_list()
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit ff2fde9929feb2aef45377ce56b8b12df85dda69 upstream.
+
+Result will be massaged to saner shape in the next commits. It is
+ugly, no questions - the point of that one is to be a provably
+equivalent transformation (and it might be worth splitting a bit
+more).
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/dcache.c | 30 +++++++++++++++++-------------
+ 1 file changed, 17 insertions(+), 13 deletions(-)
+
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -802,6 +802,7 @@ static void shrink_dentry_list(struct li
+ struct dentry *dentry, *parent;
+
+ while (!list_empty(list)) {
++ struct inode *inode;
+ dentry = list_entry(list->prev, struct dentry, d_lru);
+ spin_lock(&dentry->d_lock);
+ /*
+@@ -829,23 +830,26 @@ static void shrink_dentry_list(struct li
+ continue;
+ }
+
+- parent = dentry_kill(dentry, 0);
+- /*
+- * If dentry_kill returns NULL, we have nothing more to do.
+- */
+- if (!parent)
+- continue;
+-
+- if (unlikely(parent == dentry)) {
+- /*
+- * trylocks have failed and d_lock has been held the
+- * whole time, so it could not have been added to any
+- * other lists. Just add it back to the shrink list.
+- */
++ inode = dentry->d_inode;
++ if (inode && unlikely(!spin_trylock(&inode->i_lock))) {
+ d_shrink_add(dentry, list);
+ spin_unlock(&dentry->d_lock);
+ continue;
+ }
++
++ parent = NULL;
++ if (!IS_ROOT(dentry)) {
++ parent = dentry->d_parent;
++ if (unlikely(!spin_trylock(&parent->d_lock))) {
++ if (inode)
++ spin_unlock(&inode->i_lock);
++ d_shrink_add(dentry, list);
++ spin_unlock(&dentry->d_lock);
++ continue;
++ }
++ }
++
++ __dentry_kill(dentry);
+ /*
+ * We need to prune ancestors too. This is necessary to prevent
+ * quadratic behavior of shrink_dcache_parent(), but is also
--- /dev/null
+From a41cbe86df3afbc82311a1640e20858c0cd7e065 Mon Sep 17 00:00:00 2001
+From: Olga Kornievskaia <aglo@umich.edu>
+Date: Mon, 14 Sep 2015 19:54:36 -0400
+Subject: Failing to send a CLOSE if file is opened WRONLY and server reboots on a 4.x mount
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Olga Kornievskaia <aglo@umich.edu>
+
+commit a41cbe86df3afbc82311a1640e20858c0cd7e065 upstream.
+
+A test case is as the description says:
+open(foobar, O_WRONLY);
+sleep() --> reboot the server
+close(foobar)
+
+The bug is because in nfs4state.c in nfs4_reclaim_open_state() a few
+line before going to restart, there is
+clear_bit(NFS4CLNT_RECLAIM_NOGRACE, &state->flags).
+
+NFS4CLNT_RECLAIM_NOGRACE is a flag for the client states not open
+owner states. Value of NFS4CLNT_RECLAIM_NOGRACE is 4 which is the
+value of NFS_O_WRONLY_STATE in nfs4_state->flags. So clearing it wipes
+out state and when we go to close it, “call_close” doesn’t get set as
+state flag is not set and CLOSE doesn’t go on the wire.
+
+Signed-off-by: Olga Kornievskaia <aglo@umich.edu>
+Signed-off-by: Trond Myklebust <trond.myklebust@primarydata.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfs/nfs4state.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/fs/nfs/nfs4state.c
++++ b/fs/nfs/nfs4state.c
+@@ -1482,7 +1482,7 @@ restart:
+ spin_unlock(&state->state_lock);
+ }
+ nfs4_put_open_state(state);
+- clear_bit(NFS4CLNT_RECLAIM_NOGRACE,
++ clear_bit(NFS_STATE_RECLAIM_NOGRACE,
+ &state->flags);
+ spin_lock(&sp->so_lock);
+ goto restart;
--- /dev/null
+From 77751427a1ff25b27d47a4c36b12c3c8667855ac Mon Sep 17 00:00:00 2001
+From: Marcelo Leitner <mleitner@redhat.com>
+Date: Mon, 23 Feb 2015 11:17:13 -0300
+Subject: ipv6: addrconf: validate new MTU before applying it
+
+From: Marcelo Leitner <mleitner@redhat.com>
+
+commit 77751427a1ff25b27d47a4c36b12c3c8667855ac upstream.
+
+Currently we don't check if the new MTU is valid or not and this allows
+one to configure a smaller than minimum allowed by RFCs or even bigger
+than interface own MTU, which is a problem as it may lead to packet
+drops.
+
+If you have a daemon like NetworkManager running, this may be exploited
+by remote attackers by forging RA packets with an invalid MTU, possibly
+leading to a DoS. (NetworkManager currently only validates for values
+too small, but not for too big ones.)
+
+The fix is just to make sure the new value is valid. That is, between
+IPV6_MIN_MTU and interface's MTU.
+
+Note that similar check is already performed at
+ndisc_router_discovery(), for when kernel itself parses the RA.
+
+Signed-off-by: Marcelo Ricardo Leitner <mleitner@redhat.com>
+Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Cc: "Charles (Chas) Williams" <3chas3@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/ipv6/addrconf.c | 17 ++++++++++++++++-
+ 1 file changed, 16 insertions(+), 1 deletion(-)
+
+--- a/net/ipv6/addrconf.c
++++ b/net/ipv6/addrconf.c
+@@ -4793,6 +4793,21 @@ int addrconf_sysctl_forward(struct ctl_t
+ return ret;
+ }
+
++static
++int addrconf_sysctl_mtu(struct ctl_table *ctl, int write,
++ void __user *buffer, size_t *lenp, loff_t *ppos)
++{
++ struct inet6_dev *idev = ctl->extra1;
++ int min_mtu = IPV6_MIN_MTU;
++ struct ctl_table lctl;
++
++ lctl = *ctl;
++ lctl.extra1 = &min_mtu;
++ lctl.extra2 = idev ? &idev->dev->mtu : NULL;
++
++ return proc_dointvec_minmax(&lctl, write, buffer, lenp, ppos);
++}
++
+ static void dev_disable_change(struct inet6_dev *idev)
+ {
+ struct netdev_notifier_info info;
+@@ -4944,7 +4959,7 @@ static struct addrconf_sysctl_table
+ .data = &ipv6_devconf.mtu6,
+ .maxlen = sizeof(int),
+ .mode = 0644,
+- .proc_handler = proc_dointvec,
++ .proc_handler = addrconf_sysctl_mtu,
+ },
+ {
+ .procname = "accept_ra",
--- /dev/null
+From 67f1aee6f45059fd6b0f5b0ecb2c97ad0451f6b3 Mon Sep 17 00:00:00 2001
+From: Hariprasad S <hariprasad@chelsio.com>
+Date: Fri, 11 Dec 2015 13:59:17 +0530
+Subject: iw_cxgb3: Fix incorrectly returning error on success
+
+From: Hariprasad S <hariprasad@chelsio.com>
+
+commit 67f1aee6f45059fd6b0f5b0ecb2c97ad0451f6b3 upstream.
+
+The cxgb3_*_send() functions return NET_XMIT_ values, which are
+positive integers values. So don't treat positive return values
+as an error.
+
+Signed-off-by: Steve Wise <swise@opengridcomputing.com>
+Signed-off-by: Hariprasad Shenai <hariprasad@chelsio.com>
+Signed-off-by: Doug Ledford <dledford@redhat.com>
+[a pox on developers and maintainers who do not cc: stable for bug fixes like this - gregkh]
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/infiniband/hw/cxgb3/iwch_cm.c | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/drivers/infiniband/hw/cxgb3/iwch_cm.c
++++ b/drivers/infiniband/hw/cxgb3/iwch_cm.c
+@@ -149,7 +149,7 @@ static int iwch_l2t_send(struct t3cdev *
+ error = l2t_send(tdev, skb, l2e);
+ if (error < 0)
+ kfree_skb(skb);
+- return error;
++ return error < 0 ? error : 0;
+ }
+
+ int iwch_cxgb3_ofld_send(struct t3cdev *tdev, struct sk_buff *skb)
+@@ -165,7 +165,7 @@ int iwch_cxgb3_ofld_send(struct t3cdev *
+ error = cxgb3_ofld_send(tdev, skb);
+ if (error < 0)
+ kfree_skb(skb);
+- return error;
++ return error < 0 ? error : 0;
+ }
+
+ static void release_tid(struct t3cdev *tdev, u32 hwtid, struct sk_buff *skb)
--- /dev/null
+From 64fd72e0a44bdd62c5ca277cb24d0d02b2d8e9dc Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Wed, 28 May 2014 09:48:44 -0400
+Subject: lift the "already marked killed" case into shrink_dentry_list()
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit 64fd72e0a44bdd62c5ca277cb24d0d02b2d8e9dc upstream.
+
+It can happen only when dentry_kill() is called with unlock_on_failure
+equal to 0 - other callers had dentry pinned until the moment they've
+got ->d_lock and DCACHE_DENTRY_KILLED is set only after lockref_mark_dead().
+
+IOW, only one of three call sites of dentry_kill() might end up reaching
+that code. Just move it there.
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/dcache.c | 15 +++++++++------
+ 1 file changed, 9 insertions(+), 6 deletions(-)
+
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -453,12 +453,6 @@ dentry_kill(struct dentry *dentry, int u
+ struct dentry *parent = NULL;
+ bool can_free = true;
+
+- if (unlikely(dentry->d_flags & DCACHE_DENTRY_KILLED)) {
+- can_free = dentry->d_flags & DCACHE_MAY_FREE;
+- spin_unlock(&dentry->d_lock);
+- goto out;
+- }
+-
+ inode = dentry->d_inode;
+ if (inode && !spin_trylock(&inode->i_lock)) {
+ relock:
+@@ -816,6 +810,15 @@ static void shrink_dentry_list(struct li
+ continue;
+ }
+
++
++ if (unlikely(dentry->d_flags & DCACHE_DENTRY_KILLED)) {
++ bool can_free = dentry->d_flags & DCACHE_MAY_FREE;
++ spin_unlock(&dentry->d_lock);
++ if (can_free)
++ dentry_free(dentry);
++ continue;
++ }
++
+ parent = dentry_kill(dentry, 0);
+ /*
+ * If dentry_kill returns NULL, we have nothing more to do.
--- /dev/null
+From c2338f2dc7c1e9f6202f370c64ffd7f44f3d4b51 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Thu, 12 Jun 2014 00:29:13 -0400
+Subject: lock_parent: don't step on stale ->d_parent of all-but-freed one
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit c2338f2dc7c1e9f6202f370c64ffd7f44f3d4b51 upstream.
+
+Dentry that had been through (or into) __dentry_kill() might be seen
+by shrink_dentry_list(); that's normal, it'll be taken off the shrink
+list and freed if __dentry_kill() has already finished. The problem
+is, its ->d_parent might be pointing to already freed dentry, so
+lock_parent() needs to be careful.
+
+We need to check that dentry hasn't already gone into __dentry_kill()
+*and* grab rcu_read_lock() before dropping ->d_lock - the latter makes
+sure that whatever we see in ->d_parent after dropping ->d_lock it
+won't be freed until we drop rcu_read_lock().
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/dcache.c | 4 +++-
+ 1 file changed, 3 insertions(+), 1 deletion(-)
+
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -530,10 +530,12 @@ static inline struct dentry *lock_parent
+ struct dentry *parent = dentry->d_parent;
+ if (IS_ROOT(dentry))
+ return NULL;
++ if (unlikely((int)dentry->d_lockref.count < 0))
++ return NULL;
+ if (likely(spin_trylock(&parent->d_lock)))
+ return parent;
+- spin_unlock(&dentry->d_lock);
+ rcu_read_lock();
++ spin_unlock(&dentry->d_lock);
+ again:
+ parent = ACCESS_ONCE(dentry->d_parent);
+ spin_lock(&parent->d_lock);
--- /dev/null
+From 002374f371bd02df864cce1fe85d90dc5b292837 Mon Sep 17 00:00:00 2001
+From: James Hogan <james.hogan@imgtec.com>
+Date: Wed, 11 Nov 2015 14:21:18 +0000
+Subject: MIPS: KVM: Fix ASID restoration logic
+
+From: James Hogan <james.hogan@imgtec.com>
+
+commit 002374f371bd02df864cce1fe85d90dc5b292837 upstream.
+
+ASID restoration on guest resume should determine the guest execution
+mode based on the guest Status register rather than bit 30 of the guest
+PC.
+
+Fix the two places in locore.S that do this, loading the guest status
+from the cop0 area. Note, this assembly is specific to the trap &
+emulate implementation of KVM, so it doesn't need to check the
+supervisor bit as that mode is not implemented in the guest.
+
+Fixes: b680f70fc111 ("KVM/MIPS32: Entry point for trampolining to...")
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Gleb Natapov <gleb@kernel.org>
+Cc: linux-mips@linux-mips.org
+Cc: kvm@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/mips/kvm/kvm_locore.S | 16 ++++++++++------
+ 1 file changed, 10 insertions(+), 6 deletions(-)
+
+--- a/arch/mips/kvm/kvm_locore.S
++++ b/arch/mips/kvm/kvm_locore.S
+@@ -159,9 +159,11 @@ FEXPORT(__kvm_mips_vcpu_run)
+
+ FEXPORT(__kvm_mips_load_asid)
+ /* Set the ASID for the Guest Kernel */
+- INT_SLL t0, t0, 1 /* with kseg0 @ 0x40000000, kernel */
+- /* addresses shift to 0x80000000 */
+- bltz t0, 1f /* If kernel */
++ PTR_L t0, VCPU_COP0(k1)
++ LONG_L t0, COP0_STATUS(t0)
++ andi t0, KSU_USER | ST0_ERL | ST0_EXL
++ xori t0, KSU_USER
++ bnez t0, 1f /* If kernel */
+ INT_ADDIU t1, k1, VCPU_GUEST_KERNEL_ASID /* (BD) */
+ INT_ADDIU t1, k1, VCPU_GUEST_USER_ASID /* else user */
+ 1:
+@@ -438,9 +440,11 @@ __kvm_mips_return_to_guest:
+ mtc0 t0, CP0_EPC
+
+ /* Set the ASID for the Guest Kernel */
+- INT_SLL t0, t0, 1 /* with kseg0 @ 0x40000000, kernel */
+- /* addresses shift to 0x80000000 */
+- bltz t0, 1f /* If kernel */
++ PTR_L t0, VCPU_COP0(k1)
++ LONG_L t0, COP0_STATUS(t0)
++ andi t0, KSU_USER | ST0_ERL | ST0_EXL
++ xori t0, KSU_USER
++ bnez t0, 1f /* If kernel */
+ INT_ADDIU t1, k1, VCPU_GUEST_KERNEL_ASID /* (BD) */
+ INT_ADDIU t1, k1, VCPU_GUEST_USER_ASID /* else user */
+ 1:
--- /dev/null
+From c5c2a3b998f1ff5a586f9d37e154070b8d550d17 Mon Sep 17 00:00:00 2001
+From: James Hogan <james.hogan@imgtec.com>
+Date: Wed, 11 Nov 2015 14:21:19 +0000
+Subject: MIPS: KVM: Fix CACHE immediate offset sign extension
+
+From: James Hogan <james.hogan@imgtec.com>
+
+commit c5c2a3b998f1ff5a586f9d37e154070b8d550d17 upstream.
+
+The immediate field of the CACHE instruction is signed, so ensure that
+it gets sign extended by casting it to an int16_t rather than just
+masking the low 16 bits.
+
+Fixes: e685c689f3a8 ("KVM/MIPS32: Privileged instruction/target branch emulation.")
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Gleb Natapov <gleb@kernel.org>
+Cc: linux-mips@linux-mips.org
+Cc: kvm@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/mips/kvm/kvm_mips_emul.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/mips/kvm/kvm_mips_emul.c
++++ b/arch/mips/kvm/kvm_mips_emul.c
+@@ -935,7 +935,7 @@ kvm_mips_emulate_cache(uint32_t inst, ui
+
+ base = (inst >> 21) & 0x1f;
+ op_inst = (inst >> 16) & 0x1f;
+- offset = inst & 0xffff;
++ offset = (int16_t)inst;
+ cache = (inst >> 16) & 0x3;
+ op = (inst >> 18) & 0x7;
+
--- /dev/null
+From 585bb8f9a5e592f2ce7abbe5ed3112d5438d2754 Mon Sep 17 00:00:00 2001
+From: James Hogan <james.hogan@imgtec.com>
+Date: Wed, 11 Nov 2015 14:21:20 +0000
+Subject: MIPS: KVM: Uninit VCPU in vcpu_create error path
+
+From: James Hogan <james.hogan@imgtec.com>
+
+commit 585bb8f9a5e592f2ce7abbe5ed3112d5438d2754 upstream.
+
+If either of the memory allocations in kvm_arch_vcpu_create() fail, the
+vcpu which has been allocated and kvm_vcpu_init'd doesn't get uninit'd
+in the error handling path. Add a call to kvm_vcpu_uninit() to fix this.
+
+Fixes: 669e846e6c4e ("KVM/MIPS32: MIPS arch specific APIs for KVM")
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Cc: Ralf Baechle <ralf@linux-mips.org>
+Cc: Paolo Bonzini <pbonzini@redhat.com>
+Cc: Gleb Natapov <gleb@kernel.org>
+Cc: linux-mips@linux-mips.org
+Cc: kvm@vger.kernel.org
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: James Hogan <james.hogan@imgtec.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ arch/mips/kvm/kvm_mips.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+--- a/arch/mips/kvm/kvm_mips.c
++++ b/arch/mips/kvm/kvm_mips.c
+@@ -313,7 +313,7 @@ struct kvm_vcpu *kvm_arch_vcpu_create(st
+
+ if (!gebase) {
+ err = -ENOMEM;
+- goto out_free_cpu;
++ goto out_uninit_cpu;
+ }
+ kvm_info("Allocated %d bytes for KVM Exception Handlers @ %p\n",
+ ALIGN(size, PAGE_SIZE), gebase);
+@@ -373,6 +373,9 @@ struct kvm_vcpu *kvm_arch_vcpu_create(st
+ out_free_gebase:
+ kfree(gebase);
+
++out_uninit_cpu:
++ kvm_vcpu_uninit(vcpu);
++
+ out_free_cpu:
+ kfree(vcpu);
+
--- /dev/null
+From undefined@pobox.com Mon Feb 29 22:02:13 2016
+From: Corey Wright <undefined@pobox.com>
+Date: Sun, 28 Feb 2016 02:42:39 -0600
+Subject: proc: Fix ptrace-based permission checks for accessing task maps
+To: stable@vger.kernel.org
+Cc: Jann Horn <jann@thejh.net>
+Message-ID: <20160228024239.c82b6c2db17c670611ee6b16@pobox.com>
+
+From: Corey Wright <undefined@pobox.com>
+
+Modify mm_access() calls in fs/proc/task_mmu.c and fs/proc/task_nommu.c to
+have the mode include PTRACE_MODE_FSCREDS so accessing /proc/pid/maps and
+/proc/pid/pagemap is not denied to all users.
+
+In backporting upstream commit caaee623 to pre-3.18 kernel versions it was
+overlooked that mm_access() is used in fs/proc/task_*mmu.c as those calls
+were removed in 3.18 (by upstream commit 29a40ace) and did not exist at the
+time of the original commit.
+
+Signed-off-by: Corey Wright <undefined@pobox.com>
+Acked-by: Jann Horn <jann@thejh.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ fs/proc/task_mmu.c | 4 ++--
+ fs/proc/task_nommu.c | 2 +-
+ 2 files changed, 3 insertions(+), 3 deletions(-)
+
+--- a/fs/proc/task_mmu.c
++++ b/fs/proc/task_mmu.c
+@@ -165,7 +165,7 @@ static void *m_start(struct seq_file *m,
+ if (!priv->task)
+ return ERR_PTR(-ESRCH);
+
+- mm = mm_access(priv->task, PTRACE_MODE_READ);
++ mm = mm_access(priv->task, PTRACE_MODE_READ_FSCREDS);
+ if (!mm || IS_ERR(mm))
+ return mm;
+ down_read(&mm->mmap_sem);
+@@ -1182,7 +1182,7 @@ static ssize_t pagemap_read(struct file
+ if (!pm.buffer)
+ goto out_task;
+
+- mm = mm_access(task, PTRACE_MODE_READ);
++ mm = mm_access(task, PTRACE_MODE_READ_FSCREDS);
+ ret = PTR_ERR(mm);
+ if (!mm || IS_ERR(mm))
+ goto out_free;
+--- a/fs/proc/task_nommu.c
++++ b/fs/proc/task_nommu.c
+@@ -216,7 +216,7 @@ static void *m_start(struct seq_file *m,
+ if (!priv->task)
+ return ERR_PTR(-ESRCH);
+
+- mm = mm_access(priv->task, PTRACE_MODE_READ);
++ mm = mm_access(priv->task, PTRACE_MODE_READ_FSCREDS);
+ if (!mm || IS_ERR(mm)) {
+ put_task_struct(priv->task);
+ priv->task = NULL;
--- /dev/null
+From 74e98eb085889b0d2d4908f59f6e00026063014f Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sasha.levin@oracle.com>
+Date: Tue, 8 Sep 2015 10:53:40 -0400
+Subject: RDS: verify the underlying transport exists before creating a connection
+
+From: Sasha Levin <sasha.levin@oracle.com>
+
+commit 74e98eb085889b0d2d4908f59f6e00026063014f upstream.
+
+There was no verification that an underlying transport exists when creating
+a connection, this would cause dereferencing a NULL ptr.
+
+It might happen on sockets that weren't properly bound before attempting to
+send a message, which will cause a NULL ptr deref:
+
+[135546.047719] kasan: GPF could be caused by NULL-ptr deref or user memory accessgeneral protection fault: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC KASAN
+[135546.051270] Modules linked in:
+[135546.051781] CPU: 4 PID: 15650 Comm: trinity-c4 Not tainted 4.2.0-next-20150902-sasha-00041-gbaa1222-dirty #2527
+[135546.053217] task: ffff8800835bc000 ti: ffff8800bc708000 task.ti: ffff8800bc708000
+[135546.054291] RIP: __rds_conn_create (net/rds/connection.c:194)
+[135546.055666] RSP: 0018:ffff8800bc70fab0 EFLAGS: 00010202
+[135546.056457] RAX: dffffc0000000000 RBX: 0000000000000f2c RCX: ffff8800835bc000
+[135546.057494] RDX: 0000000000000007 RSI: ffff8800835bccd8 RDI: 0000000000000038
+[135546.058530] RBP: ffff8800bc70fb18 R08: 0000000000000001 R09: 0000000000000000
+[135546.059556] R10: ffffed014d7a3a23 R11: ffffed014d7a3a21 R12: 0000000000000000
+[135546.060614] R13: 0000000000000001 R14: ffff8801ec3d0000 R15: 0000000000000000
+[135546.061668] FS: 00007faad4ffb700(0000) GS:ffff880252000000(0000) knlGS:0000000000000000
+[135546.062836] CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
+[135546.063682] CR2: 000000000000846a CR3: 000000009d137000 CR4: 00000000000006a0
+[135546.064723] Stack:
+[135546.065048] ffffffffafe2055c ffffffffafe23fc1 ffffed00493097bf ffff8801ec3d0008
+[135546.066247] 0000000000000000 00000000000000d0 0000000000000000 ac194a24c0586342
+[135546.067438] 1ffff100178e1f78 ffff880320581b00 ffff8800bc70fdd0 ffff880320581b00
+[135546.068629] Call Trace:
+[135546.069028] ? __rds_conn_create (include/linux/rcupdate.h:856 net/rds/connection.c:134)
+[135546.069989] ? rds_message_copy_from_user (net/rds/message.c:298)
+[135546.071021] rds_conn_create_outgoing (net/rds/connection.c:278)
+[135546.071981] rds_sendmsg (net/rds/send.c:1058)
+[135546.072858] ? perf_trace_lock (include/trace/events/lock.h:38)
+[135546.073744] ? lockdep_init (kernel/locking/lockdep.c:3298)
+[135546.074577] ? rds_send_drop_to (net/rds/send.c:976)
+[135546.075508] ? __might_fault (./arch/x86/include/asm/current.h:14 mm/memory.c:3795)
+[135546.076349] ? __might_fault (mm/memory.c:3795)
+[135546.077179] ? rds_send_drop_to (net/rds/send.c:976)
+[135546.078114] sock_sendmsg (net/socket.c:611 net/socket.c:620)
+[135546.078856] SYSC_sendto (net/socket.c:1657)
+[135546.079596] ? SYSC_connect (net/socket.c:1628)
+[135546.080510] ? trace_dump_stack (kernel/trace/trace.c:1926)
+[135546.081397] ? ring_buffer_unlock_commit (kernel/trace/ring_buffer.c:2479 kernel/trace/ring_buffer.c:2558 kernel/trace/ring_buffer.c:2674)
+[135546.082390] ? trace_buffer_unlock_commit (kernel/trace/trace.c:1749)
+[135546.083410] ? trace_event_raw_event_sys_enter (include/trace/events/syscalls.h:16)
+[135546.084481] ? do_audit_syscall_entry (include/trace/events/syscalls.h:16)
+[135546.085438] ? trace_buffer_unlock_commit (kernel/trace/trace.c:1749)
+[135546.085515] rds_ib_laddr_check(): addr 36.74.25.172 ret -99 node type -1
+
+Acked-by: Santosh Shilimkar <santosh.shilimkar@oracle.com>
+Signed-off-by: Sasha Levin <sasha.levin@oracle.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Cc: "Charles (Chas) Williams" <3chas3@gmail.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ net/rds/connection.c | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+--- a/net/rds/connection.c
++++ b/net/rds/connection.c
+@@ -189,6 +189,12 @@ static struct rds_connection *__rds_conn
+ goto out;
+ }
+
++ if (trans == NULL) {
++ kmem_cache_free(rds_conn_slab, conn);
++ conn = ERR_PTR(-ENODEV);
++ goto out;
++ }
++
+ conn->c_trans = trans;
+
+ ret = trans->conn_alloc(conn, gfp);
--- /dev/null
+From 6c3b4d44ba2838f00614a5a2d777d4401e0bfd71 Mon Sep 17 00:00:00 2001
+From: Peter Zijlstra <peterz@infradead.org>
+Date: Fri, 17 Jan 2014 15:09:39 +0100
+Subject: sched: Clean up idle task SMP logic
+
+From: Peter Zijlstra <peterz@infradead.org>
+
+commit 6c3b4d44ba2838f00614a5a2d777d4401e0bfd71 upstream.
+
+The idle post_schedule flag is just a vile waste of time, furthermore
+it appears unneeded, move the idle_enter_fair() call into
+pick_next_task_idle().
+
+Signed-off-by: Peter Zijlstra <peterz@infradead.org>
+Cc: Daniel Lezcano <daniel.lezcano@linaro.org>
+Cc: Vincent Guittot <vincent.guittot@linaro.org>
+Cc: alex.shi@linaro.org
+Cc: mingo@kernel.org
+Cc: Steven Rostedt <rostedt@goodmis.org>
+Link: http://lkml.kernel.org/n/tip-aljykihtxJt3mkokxi0qZurb@git.kernel.org
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+Cc: Byungchul Park <byungchul.park@lge.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/sched/idle_task.c | 9 +--------
+ 1 file changed, 1 insertion(+), 8 deletions(-)
+
+--- a/kernel/sched/idle_task.c
++++ b/kernel/sched/idle_task.c
+@@ -19,11 +19,6 @@ static void pre_schedule_idle(struct rq
+ idle_exit_fair(rq);
+ rq_last_tick_reset(rq);
+ }
+-
+-static void post_schedule_idle(struct rq *rq)
+-{
+- idle_enter_fair(rq);
+-}
+ #endif /* CONFIG_SMP */
+ /*
+ * Idle tasks are unconditionally rescheduled:
+@@ -37,8 +32,7 @@ static struct task_struct *pick_next_tas
+ {
+ schedstat_inc(rq, sched_goidle);
+ #ifdef CONFIG_SMP
+- /* Trigger the post schedule to do an idle_enter for CFS */
+- rq->post_schedule = 1;
++ idle_enter_fair(rq);
+ #endif
+ return rq->idle;
+ }
+@@ -102,7 +96,6 @@ const struct sched_class idle_sched_clas
+ #ifdef CONFIG_SMP
+ .select_task_rq = select_task_rq_idle,
+ .pre_schedule = pre_schedule_idle,
+- .post_schedule = post_schedule_idle,
+ #endif
+
+ .set_curr_task = set_curr_task_idle,
bcache-unregister-reboot-notifier-if-bcache-fails-to-unregister-device.patch
bcache-prevent-crash-on-changing-writeback_running.patch
bcache-change-refill_dirty-to-always-scan-entire-disk-if-necessary.patch
+tools-add-a-make-all-rule.patch
+drm-radeon-fix-hotplug-race-at-startup.patch
+efi-disable-interrupts-around-efi-calls-not-in-the-epilog-prolog-calls.patch
+dm-thin-restore-requested-error_if_no_space-setting-on-oods-to-write-transition.patch
+dm-thin-metadata-fix-bug-when-taking-a-metadata-snapshot.patch
+dm-thin-fix-race-condition-when-destroying-thin-pool-workqueue.patch
+can-ems_usb-fix-possible-tx-overflow.patch
+usb-cp210x-add-ids-for-ge-b650v3-and-b850v3-boards.patch
+usb-option-add-support-for-sim7100e.patch
+usb-option-add-4g-lte-usb-modem-u901.patch
+proc-fix-ptrace-based-permission-checks-for-accessing-task-maps.patch
+iw_cxgb3-fix-incorrectly-returning-error-on-success.patch
+lift-the-already-marked-killed-case-into-shrink_dentry_list.patch
+split-dentry_kill.patch
+expand-dentry_kill-dentry-0-in-shrink_dentry_list.patch
+shrink_dentry_list-take-parent-s-d_lock-earlier.patch
+dealing-with-the-rest-of-shrink_dentry_list-livelock.patch
+dentry_kill-doesn-t-need-the-second-argument-now.patch
+dcache-add-missing-lockdep-annotation.patch
+lock_parent-don-t-step-on-stale-d_parent-of-all-but-freed-one.patch
+mips-kvm-fix-asid-restoration-logic.patch
+mips-kvm-fix-cache-immediate-offset-sign-extension.patch
+mips-kvm-uninit-vcpu-in-vcpu_create-error-path.patch
+ipv6-addrconf-validate-new-mtu-before-applying-it.patch
+rds-verify-the-underlying-transport-exists-before-creating-a-connection.patch
+splice-sendfile-at-once-fails-for-big-files.patch
+failing-to-send-a-close-if-file-is-opened-wronly-and-server-reboots-on-a-4.x-mount.patch
+bnx2x-don-t-notify-about-scratchpad-parities.patch
+unix-correctly-track-in-flight-fds-in-sending-process-user_struct.patch
+sched-clean-up-idle-task-smp-logic.patch
--- /dev/null
+From 046b961b45f93a92e4c70525a12f3d378bced130 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Thu, 29 May 2014 08:54:52 -0400
+Subject: shrink_dentry_list(): take parent's ->d_lock earlier
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit 046b961b45f93a92e4c70525a12f3d378bced130 upstream.
+
+The cause of livelocks there is that we are taking ->d_lock on
+dentry and its parent in the wrong order, forcing us to use
+trylock on the parent's one. d_walk() takes them in the right
+order, and unfortunately it's not hard to create a situation
+when shrink_dentry_list() can't make progress since trylock
+keeps failing, and shrink_dcache_parent() or check_submounts_and_drop()
+keeps calling d_walk() disrupting the very shrink_dentry_list() it's
+waiting for.
+
+Solution is straightforward - if that trylock fails, let's unlock
+the dentry itself and take locks in the right order. We need to
+stabilize ->d_parent without holding ->d_lock, but that's doable
+using RCU. And we'd better do that in the very beginning of the
+loop in shrink_dentry_list(), since the checks on refcount, etc.
+would need to be redone anyway.
+
+That deals with a half of the problem - killing dentries on the
+shrink list itself. Another one (dropping their parents) is
+in the next commit.
+
+locking parent is interesting - it would be easy to do rcu_read_lock(),
+lock whatever we think is a parent, lock dentry itself and check
+if the parent is still the right one. Except that we need to check
+that *before* locking the dentry, or we are risking taking ->d_lock
+out of order. Fortunately, once the D1 is locked, we can check if
+D2->d_parent is equal to D1 without the need to lock D2; D2->d_parent
+can start or stop pointing to D1 only under D1->d_lock, so taking
+D1->d_lock is enough. In other words, the right solution is
+rcu_read_lock/lock what looks like parent right now/check if it's
+still our parent/rcu_read_unlock/lock the child.
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/dcache.c | 53 +++++++++++++++++++++++++++++++++++++++++------------
+ 1 file changed, 41 insertions(+), 12 deletions(-)
+
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -528,6 +528,38 @@ failed:
+ return dentry; /* try again with same dentry */
+ }
+
++static inline struct dentry *lock_parent(struct dentry *dentry)
++{
++ struct dentry *parent = dentry->d_parent;
++ if (IS_ROOT(dentry))
++ return NULL;
++ if (likely(spin_trylock(&parent->d_lock)))
++ return parent;
++ spin_unlock(&dentry->d_lock);
++ rcu_read_lock();
++again:
++ parent = ACCESS_ONCE(dentry->d_parent);
++ spin_lock(&parent->d_lock);
++ /*
++ * We can't blindly lock dentry until we are sure
++ * that we won't violate the locking order.
++ * Any changes of dentry->d_parent must have
++ * been done with parent->d_lock held, so
++ * spin_lock() above is enough of a barrier
++ * for checking if it's still our child.
++ */
++ if (unlikely(parent != dentry->d_parent)) {
++ spin_unlock(&parent->d_lock);
++ goto again;
++ }
++ rcu_read_unlock();
++ if (parent != dentry)
++ spin_lock(&dentry->d_lock);
++ else
++ parent = NULL;
++ return parent;
++}
++
+ /*
+ * This is dput
+ *
+@@ -805,6 +837,8 @@ static void shrink_dentry_list(struct li
+ struct inode *inode;
+ dentry = list_entry(list->prev, struct dentry, d_lru);
+ spin_lock(&dentry->d_lock);
++ parent = lock_parent(dentry);
++
+ /*
+ * The dispose list is isolated and dentries are not accounted
+ * to the LRU here, so we can simply remove it from the list
+@@ -818,6 +852,8 @@ static void shrink_dentry_list(struct li
+ */
+ if ((int)dentry->d_lockref.count > 0) {
+ spin_unlock(&dentry->d_lock);
++ if (parent)
++ spin_unlock(&parent->d_lock);
+ continue;
+ }
+
+@@ -825,6 +861,8 @@ static void shrink_dentry_list(struct li
+ if (unlikely(dentry->d_flags & DCACHE_DENTRY_KILLED)) {
+ bool can_free = dentry->d_flags & DCACHE_MAY_FREE;
+ spin_unlock(&dentry->d_lock);
++ if (parent)
++ spin_unlock(&parent->d_lock);
+ if (can_free)
+ dentry_free(dentry);
+ continue;
+@@ -834,22 +872,13 @@ static void shrink_dentry_list(struct li
+ if (inode && unlikely(!spin_trylock(&inode->i_lock))) {
+ d_shrink_add(dentry, list);
+ spin_unlock(&dentry->d_lock);
++ if (parent)
++ spin_unlock(&parent->d_lock);
+ continue;
+ }
+
+- parent = NULL;
+- if (!IS_ROOT(dentry)) {
+- parent = dentry->d_parent;
+- if (unlikely(!spin_trylock(&parent->d_lock))) {
+- if (inode)
+- spin_unlock(&inode->i_lock);
+- d_shrink_add(dentry, list);
+- spin_unlock(&dentry->d_lock);
+- continue;
+- }
+- }
+-
+ __dentry_kill(dentry);
++
+ /*
+ * We need to prune ancestors too. This is necessary to prevent
+ * quadratic behavior of shrink_dcache_parent(), but is also
--- /dev/null
+From 0ff28d9f4674d781e492bcff6f32f0fe48cf0fed Mon Sep 17 00:00:00 2001
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+Date: Wed, 6 May 2015 17:26:47 +0200
+Subject: splice: sendfile() at once fails for big files
+
+From: Christophe Leroy <christophe.leroy@c-s.fr>
+
+commit 0ff28d9f4674d781e492bcff6f32f0fe48cf0fed upstream.
+
+Using sendfile with below small program to get MD5 sums of some files,
+it appear that big files (over 64kbytes with 4k pages system) get a
+wrong MD5 sum while small files get the correct sum.
+This program uses sendfile() to send a file to an AF_ALG socket
+for hashing.
+
+/* md5sum2.c */
+#include <stdio.h>
+#include <stdlib.h>
+#include <unistd.h>
+#include <string.h>
+#include <fcntl.h>
+#include <sys/socket.h>
+#include <sys/stat.h>
+#include <sys/types.h>
+#include <linux/if_alg.h>
+
+int main(int argc, char **argv)
+{
+ int sk = socket(AF_ALG, SOCK_SEQPACKET, 0);
+ struct stat st;
+ struct sockaddr_alg sa = {
+ .salg_family = AF_ALG,
+ .salg_type = "hash",
+ .salg_name = "md5",
+ };
+ int n;
+
+ bind(sk, (struct sockaddr*)&sa, sizeof(sa));
+
+ for (n = 1; n < argc; n++) {
+ int size;
+ int offset = 0;
+ char buf[4096];
+ int fd;
+ int sko;
+ int i;
+
+ fd = open(argv[n], O_RDONLY);
+ sko = accept(sk, NULL, 0);
+ fstat(fd, &st);
+ size = st.st_size;
+ sendfile(sko, fd, &offset, size);
+ size = read(sko, buf, sizeof(buf));
+ for (i = 0; i < size; i++)
+ printf("%2.2x", buf[i]);
+ printf(" %s\n", argv[n]);
+ close(fd);
+ close(sko);
+ }
+ exit(0);
+}
+
+Test below is done using official linux patch files. First result is
+with a software based md5sum. Second result is with the program above.
+
+root@vgoip:~# ls -l patch-3.6.*
+-rw-r--r-- 1 root root 64011 Aug 24 12:01 patch-3.6.2.gz
+-rw-r--r-- 1 root root 94131 Aug 24 12:01 patch-3.6.3.gz
+
+root@vgoip:~# md5sum patch-3.6.*
+b3ffb9848196846f31b2ff133d2d6443 patch-3.6.2.gz
+c5e8f687878457db77cb7158c38a7e43 patch-3.6.3.gz
+
+root@vgoip:~# ./md5sum2 patch-3.6.*
+b3ffb9848196846f31b2ff133d2d6443 patch-3.6.2.gz
+5fd77b24e68bb24dcc72d6e57c64790e patch-3.6.3.gz
+
+After investivation, it appears that sendfile() sends the files by blocks
+of 64kbytes (16 times PAGE_SIZE). The problem is that at the end of each
+block, the SPLICE_F_MORE flag is missing, therefore the hashing operation
+is reset as if it was the end of the file.
+
+This patch adds SPLICE_F_MORE to the flags when more data is pending.
+
+With the patch applied, we get the correct sums:
+
+root@vgoip:~# md5sum patch-3.6.*
+b3ffb9848196846f31b2ff133d2d6443 patch-3.6.2.gz
+c5e8f687878457db77cb7158c38a7e43 patch-3.6.3.gz
+
+root@vgoip:~# ./md5sum2 patch-3.6.*
+b3ffb9848196846f31b2ff133d2d6443 patch-3.6.2.gz
+c5e8f687878457db77cb7158c38a7e43 patch-3.6.3.gz
+
+Signed-off-by: Christophe Leroy <christophe.leroy@c-s.fr>
+Signed-off-by: Jens Axboe <axboe@fb.com>
+Cc: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/splice.c | 12 +++++++++++-
+ 1 file changed, 11 insertions(+), 1 deletion(-)
+
+--- a/fs/splice.c
++++ b/fs/splice.c
+@@ -1175,7 +1175,7 @@ ssize_t splice_direct_to_actor(struct fi
+ long ret, bytes;
+ umode_t i_mode;
+ size_t len;
+- int i, flags;
++ int i, flags, more;
+
+ /*
+ * We require the input being a regular file, as we don't want to
+@@ -1218,6 +1218,7 @@ ssize_t splice_direct_to_actor(struct fi
+ * Don't block on output, we have to drain the direct pipe.
+ */
+ sd->flags &= ~SPLICE_F_NONBLOCK;
++ more = sd->flags & SPLICE_F_MORE;
+
+ while (len) {
+ size_t read_len;
+@@ -1231,6 +1232,15 @@ ssize_t splice_direct_to_actor(struct fi
+ sd->total_len = read_len;
+
+ /*
++ * If more data is pending, set SPLICE_F_MORE
++ * If this is the last data and SPLICE_F_MORE was not set
++ * initially, clears it.
++ */
++ if (read_len < len)
++ sd->flags |= SPLICE_F_MORE;
++ else if (!more)
++ sd->flags &= ~SPLICE_F_MORE;
++ /*
+ * NOTE: nonblocking mode only applies to the input. We
+ * must not do the output in nonblocking mode as then we
+ * could get stuck data in the internal pipe:
--- /dev/null
+From e55fd011549eae01a230e3cace6f4d031b6a3453 Mon Sep 17 00:00:00 2001
+From: Al Viro <viro@zeniv.linux.org.uk>
+Date: Wed, 28 May 2014 13:51:12 -0400
+Subject: split dentry_kill()
+
+From: Al Viro <viro@zeniv.linux.org.uk>
+
+commit e55fd011549eae01a230e3cace6f4d031b6a3453 upstream.
+
+... into trylocks and everything else. The latter (actual killing)
+is __dentry_kill().
+
+Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/dcache.c | 62 ++++++++++++++++++++++++++++++++++--------------------------
+ 1 file changed, 36 insertions(+), 26 deletions(-)
+
+--- a/fs/dcache.c
++++ b/fs/dcache.c
+@@ -439,36 +439,12 @@ void d_drop(struct dentry *dentry)
+ }
+ EXPORT_SYMBOL(d_drop);
+
+-/*
+- * Finish off a dentry we've decided to kill.
+- * dentry->d_lock must be held, returns with it unlocked.
+- * If ref is non-zero, then decrement the refcount too.
+- * Returns dentry requiring refcount drop, or NULL if we're done.
+- */
+-static struct dentry *
+-dentry_kill(struct dentry *dentry, int unlock_on_failure)
+- __releases(dentry->d_lock)
++static void __dentry_kill(struct dentry *dentry)
+ {
+- struct inode *inode;
+ struct dentry *parent = NULL;
+ bool can_free = true;
+-
+- inode = dentry->d_inode;
+- if (inode && !spin_trylock(&inode->i_lock)) {
+-relock:
+- if (unlock_on_failure) {
+- spin_unlock(&dentry->d_lock);
+- cpu_relax();
+- }
+- return dentry; /* try again with same dentry */
+- }
+ if (!IS_ROOT(dentry))
+ parent = dentry->d_parent;
+- if (parent && !spin_trylock(&parent->d_lock)) {
+- if (inode)
+- spin_unlock(&inode->i_lock);
+- goto relock;
+- }
+
+ /*
+ * The dentry is now unrecoverably dead to the world.
+@@ -512,10 +488,44 @@ relock:
+ can_free = false;
+ }
+ spin_unlock(&dentry->d_lock);
+-out:
+ if (likely(can_free))
+ dentry_free(dentry);
++}
++
++/*
++ * Finish off a dentry we've decided to kill.
++ * dentry->d_lock must be held, returns with it unlocked.
++ * If ref is non-zero, then decrement the refcount too.
++ * Returns dentry requiring refcount drop, or NULL if we're done.
++ */
++static struct dentry *
++dentry_kill(struct dentry *dentry, int unlock_on_failure)
++ __releases(dentry->d_lock)
++{
++ struct inode *inode = dentry->d_inode;
++ struct dentry *parent = NULL;
++
++ if (inode && unlikely(!spin_trylock(&inode->i_lock)))
++ goto failed;
++
++ if (!IS_ROOT(dentry)) {
++ parent = dentry->d_parent;
++ if (unlikely(!spin_trylock(&parent->d_lock))) {
++ if (inode)
++ spin_unlock(&inode->i_lock);
++ goto failed;
++ }
++ }
++
++ __dentry_kill(dentry);
+ return parent;
++
++failed:
++ if (unlock_on_failure) {
++ spin_unlock(&dentry->d_lock);
++ cpu_relax();
++ }
++ return dentry; /* try again with same dentry */
+ }
+
+ /*
--- /dev/null
+From f6ba98c5dc78708cb7fd29950c4a50c4c7e88f95 Mon Sep 17 00:00:00 2001
+From: Kamal Mostafa <kamal@canonical.com>
+Date: Wed, 11 Nov 2015 14:25:34 -0800
+Subject: tools: Add a "make all" rule
+
+From: Kamal Mostafa <kamal@canonical.com>
+
+commit f6ba98c5dc78708cb7fd29950c4a50c4c7e88f95 upstream.
+
+
+Signed-off-by: Kamal Mostafa <kamal@canonical.com>
+Acked-by: Pavel Machek <pavel@ucw.cz>
+Cc: Jiri Olsa <jolsa@kernel.org>
+Cc: Jonathan Cameron <jic23@kernel.org>
+Cc: Pali Rohar <pali.rohar@gmail.com>
+Cc: Roberta Dobrescu <roberta.dobrescu@gmail.com>
+Link: http://lkml.kernel.org/r/1447280736-2161-2-git-send-email-kamal@canonical.com
+Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
+[ kamal: backport to 3.14-stable: build all tools for this version ]
+Signed-off-by: Kamal Mostafa <kamal@canonical.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ tools/Makefile | 9 +++++++++
+ 1 file changed, 9 insertions(+)
+
+--- a/tools/Makefile
++++ b/tools/Makefile
+@@ -24,6 +24,10 @@ help:
+ @echo ' from the kernel command line to build and install one of'
+ @echo ' the tools above'
+ @echo ''
++ @echo ' $$ make tools/all'
++ @echo ''
++ @echo ' builds all tools.'
++ @echo ''
+ @echo ' $$ make tools/install'
+ @echo ''
+ @echo ' installs all tools.'
+@@ -58,6 +62,11 @@ turbostat x86_energy_perf_policy: FORCE
+ tmon: FORCE
+ $(call descend,thermal/$@)
+
++all: acpi cgroup cpupower firewire lguest \
++ perf selftests turbostat usb \
++ virtio vm net x86_energy_perf_policy \
++ tmon
++
+ acpi_install:
+ $(call descend,power/$(@:_install=),install)
+
--- /dev/null
+From 415e3d3e90ce9e18727e8843ae343eda5a58fad6 Mon Sep 17 00:00:00 2001
+From: Hannes Frederic Sowa <hannes@stressinduktion.org>
+Date: Wed, 3 Feb 2016 02:11:03 +0100
+Subject: unix: correctly track in-flight fds in sending process user_struct
+
+From: Hannes Frederic Sowa <hannes@stressinduktion.org>
+
+commit 415e3d3e90ce9e18727e8843ae343eda5a58fad6 upstream.
+
+The commit referenced in the Fixes tag incorrectly accounted the number
+of in-flight fds over a unix domain socket to the original opener
+of the file-descriptor. This allows another process to arbitrary
+deplete the original file-openers resource limit for the maximum of
+open files. Instead the sending processes and its struct cred should
+be credited.
+
+To do so, we add a reference counted struct user_struct pointer to the
+scm_fp_list and use it to account for the number of inflight unix fds.
+
+Fixes: 712f4aad406bb1 ("unix: properly account for FDs passed over unix sockets")
+Reported-by: David Herrmann <dh.herrmann@gmail.com>
+Cc: David Herrmann <dh.herrmann@gmail.com>
+Cc: Willy Tarreau <w@1wt.eu>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Hannes Frederic Sowa <hannes@stressinduktion.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ include/net/af_unix.h | 4 ++--
+ include/net/scm.h | 1 +
+ net/core/scm.c | 7 +++++++
+ net/unix/af_unix.c | 4 ++--
+ net/unix/garbage.c | 8 ++++----
+ 5 files changed, 16 insertions(+), 8 deletions(-)
+
+--- a/include/net/af_unix.h
++++ b/include/net/af_unix.h
+@@ -6,8 +6,8 @@
+ #include <linux/mutex.h>
+ #include <net/sock.h>
+
+-void unix_inflight(struct file *fp);
+-void unix_notinflight(struct file *fp);
++void unix_inflight(struct user_struct *user, struct file *fp);
++void unix_notinflight(struct user_struct *user, struct file *fp);
+ void unix_gc(void);
+ void wait_for_unix_gc(void);
+ struct sock *unix_get_socket(struct file *filp);
+--- a/include/net/scm.h
++++ b/include/net/scm.h
+@@ -21,6 +21,7 @@ struct scm_creds {
+ struct scm_fp_list {
+ short count;
+ short max;
++ struct user_struct *user;
+ struct file *fp[SCM_MAX_FD];
+ };
+
+--- a/net/core/scm.c
++++ b/net/core/scm.c
+@@ -87,6 +87,7 @@ static int scm_fp_copy(struct cmsghdr *c
+ *fplp = fpl;
+ fpl->count = 0;
+ fpl->max = SCM_MAX_FD;
++ fpl->user = NULL;
+ }
+ fpp = &fpl->fp[fpl->count];
+
+@@ -107,6 +108,10 @@ static int scm_fp_copy(struct cmsghdr *c
+ *fpp++ = file;
+ fpl->count++;
+ }
++
++ if (!fpl->user)
++ fpl->user = get_uid(current_user());
++
+ return num;
+ }
+
+@@ -119,6 +124,7 @@ void __scm_destroy(struct scm_cookie *sc
+ scm->fp = NULL;
+ for (i=fpl->count-1; i>=0; i--)
+ fput(fpl->fp[i]);
++ free_uid(fpl->user);
+ kfree(fpl);
+ }
+ }
+@@ -337,6 +343,7 @@ struct scm_fp_list *scm_fp_dup(struct sc
+ for (i = 0; i < fpl->count; i++)
+ get_file(fpl->fp[i]);
+ new_fpl->max = new_fpl->count;
++ new_fpl->user = get_uid(fpl->user);
+ }
+ return new_fpl;
+ }
+--- a/net/unix/af_unix.c
++++ b/net/unix/af_unix.c
+@@ -1469,7 +1469,7 @@ static void unix_detach_fds(struct scm_c
+ UNIXCB(skb).fp = NULL;
+
+ for (i = scm->fp->count-1; i >= 0; i--)
+- unix_notinflight(scm->fp->fp[i]);
++ unix_notinflight(scm->fp->user, scm->fp->fp[i]);
+ }
+
+ static void unix_destruct_scm(struct sk_buff *skb)
+@@ -1534,7 +1534,7 @@ static int unix_attach_fds(struct scm_co
+ return -ENOMEM;
+
+ for (i = scm->fp->count - 1; i >= 0; i--)
+- unix_inflight(scm->fp->fp[i]);
++ unix_inflight(scm->fp->user, scm->fp->fp[i]);
+ return max_level;
+ }
+
+--- a/net/unix/garbage.c
++++ b/net/unix/garbage.c
+@@ -122,7 +122,7 @@ struct sock *unix_get_socket(struct file
+ * descriptor if it is for an AF_UNIX socket.
+ */
+
+-void unix_inflight(struct file *fp)
++void unix_inflight(struct user_struct *user, struct file *fp)
+ {
+ struct sock *s = unix_get_socket(fp);
+
+@@ -139,11 +139,11 @@ void unix_inflight(struct file *fp)
+ }
+ unix_tot_inflight++;
+ }
+- fp->f_cred->user->unix_inflight++;
++ user->unix_inflight++;
+ spin_unlock(&unix_gc_lock);
+ }
+
+-void unix_notinflight(struct file *fp)
++void unix_notinflight(struct user_struct *user, struct file *fp)
+ {
+ struct sock *s = unix_get_socket(fp);
+
+@@ -157,7 +157,7 @@ void unix_notinflight(struct file *fp)
+ list_del_init(&u->link);
+ unix_tot_inflight--;
+ }
+- fp->f_cred->user->unix_inflight--;
++ user->unix_inflight--;
+ spin_unlock(&unix_gc_lock);
+ }
+
--- /dev/null
+From 6627ae19385283b89356a199d7f03c75ba35fb29 Mon Sep 17 00:00:00 2001
+From: Ken Lin <ken.lin@advantech.com.tw>
+Date: Mon, 1 Feb 2016 14:57:25 -0500
+Subject: USB: cp210x: add IDs for GE B650V3 and B850V3 boards
+
+From: Ken Lin <ken.lin@advantech.com.tw>
+
+commit 6627ae19385283b89356a199d7f03c75ba35fb29 upstream.
+
+Add USB ID for cp2104/5 devices on GE B650v3 and B850v3 boards.
+
+Signed-off-by: Ken Lin <ken.lin@advantech.com.tw>
+Signed-off-by: Akshay Bhat <akshay.bhat@timesys.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/cp210x.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/cp210x.c
++++ b/drivers/usb/serial/cp210x.c
+@@ -162,6 +162,8 @@ static const struct usb_device_id id_tab
+ { USB_DEVICE(0x1843, 0x0200) }, /* Vaisala USB Instrument Cable */
+ { USB_DEVICE(0x18EF, 0xE00F) }, /* ELV USB-I2C-Interface */
+ { USB_DEVICE(0x18EF, 0xE025) }, /* ELV Marble Sound Board 1 */
++ { USB_DEVICE(0x1901, 0x0190) }, /* GE B850 CP2105 Recorder interface */
++ { USB_DEVICE(0x1901, 0x0193) }, /* GE B650 CP2104 PMC interface */
+ { USB_DEVICE(0x1ADB, 0x0001) }, /* Schweitzer Engineering C662 Cable */
+ { USB_DEVICE(0x1B1C, 0x1C00) }, /* Corsair USB Dongle */
+ { USB_DEVICE(0x1BA4, 0x0002) }, /* Silicon Labs 358x factory default */
--- /dev/null
+From d061c1caa31d4d9792cfe48a2c6b309a0e01ef46 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?Bj=C3=B8rn=20Mork?= <bjorn@mork.no>
+Date: Fri, 12 Feb 2016 16:40:00 +0100
+Subject: USB: option: add "4G LTE usb-modem U901"
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Bjørn Mork <bjorn@mork.no>
+
+commit d061c1caa31d4d9792cfe48a2c6b309a0e01ef46 upstream.
+
+Thomas reports:
+
+T: Bus=01 Lev=01 Prnt=01 Port=03 Cnt=01 Dev#= 4 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 1
+P: Vendor=05c6 ProdID=6001 Rev=00.00
+S: Manufacturer=USB Modem
+S: Product=USB Modem
+S: SerialNumber=1234567890ABCDEF
+C: #Ifs= 5 Cfg#= 1 Atr=e0 MxPwr=500mA
+I: If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 2 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I: If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
+I: If#= 4 Alt= 0 #EPs= 2 Cls=08(stor.) Sub=06 Prot=50 Driver=usb-storage
+
+Reported-by: Thomas Schäfer <tschaefer@t-online.de>
+Signed-off-by: Bjørn Mork <bjorn@mork.no>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -1135,6 +1135,8 @@ static const struct usb_device_id option
+ { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC650) },
+ { USB_DEVICE(KYOCERA_VENDOR_ID, KYOCERA_PRODUCT_KPC680) },
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6000)}, /* ZTE AC8700 */
++ { USB_DEVICE_AND_INTERFACE_INFO(QUALCOMM_VENDOR_ID, 0x6001, 0xff, 0xff, 0xff), /* 4G LTE usb-modem U901 */
++ .driver_info = (kernel_ulong_t)&net_intf3_blacklist },
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x6613)}, /* Onda H600/ZTE MF330 */
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x0023)}, /* ONYX 3G device */
+ { USB_DEVICE(QUALCOMM_VENDOR_ID, 0x9000)}, /* SIMCom SIM5218 */
--- /dev/null
+From 3158a8d416f4e1b79dcc867d67cb50013140772c Mon Sep 17 00:00:00 2001
+From: Andrey Skvortsov <andrej.skvortzov@gmail.com>
+Date: Fri, 29 Jan 2016 00:07:30 +0300
+Subject: USB: option: add support for SIM7100E
+
+From: Andrey Skvortsov <andrej.skvortzov@gmail.com>
+
+commit 3158a8d416f4e1b79dcc867d67cb50013140772c upstream.
+
+$ lsusb:
+Bus 001 Device 101: ID 1e0e:9001 Qualcomm / Option
+
+$ usb-devices:
+T: Bus=01 Lev=02 Prnt=02 Port=00 Cnt=01 Dev#=101 Spd=480 MxCh= 0
+D: Ver= 2.00 Cls=00(>ifc ) Sub=00 Prot=00 MxPS=64 #Cfgs= 2
+P: Vendor=1e0e ProdID=9001 Rev= 2.32
+S: Manufacturer=SimTech, Incorporated
+S: Product=SimTech, Incorporated
+S: SerialNumber=0123456789ABCDEF
+C:* #Ifs= 7 Cfg#= 1 Atr=80 MxPwr=500mA
+I:* If#= 0 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=ff Prot=ff Driver=option
+I:* If#= 1 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I:* If#= 2 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I:* If#= 3 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I:* If#= 4 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=00 Prot=00 Driver=option
+I:* If#= 5 Alt= 0 #EPs= 3 Cls=ff(vend.) Sub=ff Prot=ff Driver=qmi_wwan
+I:* If#= 6 Alt= 0 #EPs= 2 Cls=ff(vend.) Sub=42 Prot=01 Driver=(none)
+
+The last interface (6) is used for Android Composite ADB interface.
+
+Serial port layout:
+0: QCDM/DIAG
+1: NMEA
+2: AT
+3: AT/PPP
+4: audio
+
+Signed-off-by: Andrey Skvortsov <andrej.skvortzov@gmail.com>
+Signed-off-by: Johan Hovold <johan@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/usb/serial/option.c | 7 +++++++
+ 1 file changed, 7 insertions(+)
+
+--- a/drivers/usb/serial/option.c
++++ b/drivers/usb/serial/option.c
+@@ -315,6 +315,7 @@ static void option_instat_callback(struc
+ #define TOSHIBA_PRODUCT_G450 0x0d45
+
+ #define ALINK_VENDOR_ID 0x1e0e
++#define SIMCOM_PRODUCT_SIM7100E 0x9001 /* Yes, ALINK_VENDOR_ID */
+ #define ALINK_PRODUCT_PH300 0x9100
+ #define ALINK_PRODUCT_3GU 0x9200
+
+@@ -615,6 +616,10 @@ static const struct option_blacklist_inf
+ .reserved = BIT(3) | BIT(4),
+ };
+
++static const struct option_blacklist_info simcom_sim7100e_blacklist = {
++ .reserved = BIT(5) | BIT(6),
++};
++
+ static const struct option_blacklist_info telit_le910_blacklist = {
+ .sendsetup = BIT(0),
+ .reserved = BIT(1) | BIT(2),
+@@ -1645,6 +1650,8 @@ static const struct usb_device_id option
+ { USB_DEVICE(ALINK_VENDOR_ID, 0x9000) },
+ { USB_DEVICE(ALINK_VENDOR_ID, ALINK_PRODUCT_PH300) },
+ { USB_DEVICE_AND_INTERFACE_INFO(ALINK_VENDOR_ID, ALINK_PRODUCT_3GU, 0xff, 0xff, 0xff) },
++ { USB_DEVICE(ALINK_VENDOR_ID, SIMCOM_PRODUCT_SIM7100E),
++ .driver_info = (kernel_ulong_t)&simcom_sim7100e_blacklist },
+ { USB_DEVICE(ALCATEL_VENDOR_ID, ALCATEL_PRODUCT_X060S_X200),
+ .driver_info = (kernel_ulong_t)&alcatel_x200_blacklist
+ },
projects / thirdparty / kernel / stable-queue.git / commitdiff
