This reverts commit 60758d66.

Now that libsubcmd makes sure that OPT_UINTEGER options will not
return negative values, we can revert this patch while addressing
the problem it solved:

  # perf bench futex hash -t  -4
  # Running 'futex/hash' benchmark:
   Error: switch `t' expects an unsigned numerical value
   Usage: perf bench futex hash <options>

      -t, --threads <n>     Specify amount of threads
  # perf bench futex hash -t-4
  # Running 'futex/hash' benchmark:
   Error: switch `t' expects an unsigned numerical value
   Usage: perf bench futex hash <options>

      -t, --threads <n>     Specify amount of threads
  #

IMO it is more reasonable to flat out refuse to process a negative
number than to silently turn it into an absolute value.

This also helps in silencing clang's complaint about asking for an
absolute value of an unsigned integer:

  bench/futex-hash.c:133:10: error: taking the absolute value of unsigned type 'unsigned int' has no effect [-Werror,-Wabsolute-value]
          nsecs = futexbench_sanitize_numeric(nsecs);
                ^
  bench/futex.h:104:42: note: expanded from macro 'futexbench_sanitize_numeric'
  #define futexbench_sanitize_numeric(__n) abs((__n))
                                           ^
  bench/futex-hash.c:133:10: note: remove the call to 'abs' since unsigned values cannot be negative

Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: David Ahern <dsahern@gmail.com>
Cc: Davidlohr Bueso <dbueso@suse.de>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Wang Nan <wangnan0@huawei.com>
Link: http://lkml.kernel.org/n/tip-2kl68v22or31vw643m2exz8x@git.kernel.orgSigned-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

Options marked OPTION_UINTEGER or OPTION_U64 clearly indicates that an
unsigned value is expected, so just error out when a negative value is
passed, instead of returning something undesired to the tool.

E.g.:

  # perf bench futex hash -t -4
  # Running 'futex/hash' benchmark:
   Error: switch `t' expects an unsigned numerical value
   Usage: perf bench futex hash <options>

      -t, --threads <n>     Specify amount of threads
  #

Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: David Ahern <dsahern@gmail.com>
Cc: Davidlohr Bueso <dbueso@suse.de>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Josh Poimboeuf <jpoimboe@redhat.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Wang Nan <wangnan0@huawei.com>
Link: http://lkml.kernel.org/n/tip-2mdn8s2raatyhz7tamrsz22r@git.kernel.orgSigned-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

To avoid this when using clang:

  warning: optimization level '-O6' is not supported; using '-O3' instead

Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: David Ahern <dsahern@gmail.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Wang Nan <wangnan0@huawei.com>
Link: http://lkml.kernel.org/n/tip-kaghp8ddvzdsg03putemcq96@git.kernel.orgSigned-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

To allow building with clang, avoiding:

  error: unknown warning option '-Wstrict-aliasing=3'; did you mean '-Wstring-plus-int'? [-Werror,-Wunknown-warning-option]

Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: David Ahern <dsahern@gmail.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Wang Nan <wangnan0@huawei.com>
Link: http://lkml.kernel.org/n/tip-xvthlvmhzfnt7jx73jgmaea1@git.kernel.orgSigned-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

Merge tag 'perf-core-for-mingo-4.11-20170213' of git://git.kernel.org/pub/scm/linux/kernel/git/acme/linux into perf/core

Pull perf/core improvements and fixes from Arnaldo Carvalho de Melo:

New features:

 - Introduce the 'delta-abs' 'perf diff' compute method, that orders the
   histogram entries by the absolute value of the percentage delta for a
   function in two perf.data files, i.e. the functions that changed the
   most (increase or decrease in samples) comes first (Namhyung Kim)

User visible changes:

 - Improve message about tweaking the kernel.perf_event_paranoid setting,
   telling how to make the change permanent by editing /etc/sysctl.conf
   (Arnaldo Carvalho de Melo)

Infrastructure changes:

 - Introduce linux/compiler-gcc.h as a counterpart to the kernel's,
   initially containing the definition of __fallthrough, more to
   come (__maybe_unused, etc) (Arnaldo Carvalho de Melo)

 - Fixes for problems uncovered by building tools/perf with clang, such
   as always true tests of arrays against NULL and variables that sometimes
   were used without being initialized (Arnaldo Carvalho de Melo, Steven Rostedt)

 - Before loading a new ELF, clear global variables set by the
   samples/bpf loader (Mickaël Salaün)

 - Ignore already processed ELF sections in the samples/bpf
   loader (Mickaël Salaün)

 - Fix compile error in the scripting code with some perl5
   versions (Wang YanQing)
Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Ingo Molnar <mingo@kernel.org>

Signed-off-by: Ingo Molnar <mingo@kernel.org>

Before loading a new ELF, clean previous kernel version, license and
processed sections.
Signed-off-by: Mickaël Salaün <mic@digikod.net>
Acked-by: Joe Stringer <joe@ovn.org>
Acked-by: Wang Nan <wangnan0@huawei.com>
Cc: Alexei Starovoitov <ast@fb.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: David S. Miller <davem@davemloft.net>
Cc: netdev@vger.kernel.org
Link: http://lkml.kernel.org/r/20170208202744.16274-3-mic@digikod.netSigned-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

Add a missing check for the map fixup loop.
Signed-off-by: Mickaël Salaün <mic@digikod.net>
Acked-by: Joe Stringer <joe@ovn.org>
Acked-by: Wang Nan <wangnan0@huawei.com>
Cc: Alexei Starovoitov <ast@fb.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: David S. Miller <davem@davemloft.net>
Cc: netdev@vger.kernel.org
Link: http://lkml.kernel.org/r/20170208202744.16274-2-mic@digikod.netSigned-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

Include unistd.h to define __NR_getuid and __NR_getsid.
Signed-off-by: Mickaël Salaün <mic@digikod.net>
Acked-by: Joe Stringer <joe@ovn.org>
Acked-by: Wang Nan <wangnan0@huawei.com>
Cc: Alexei Starovoitov <ast@fb.com>
Cc: Daniel Borkmann <daniel@iogearbox.net>
Cc: David S. Miller <davem@davemloft.net>
Cc: netdev@vger.kernel.org
Link: http://lkml.kernel.org/r/20170208202744.16274-4-mic@digikod.netSigned-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

As it will always evaluate to 'true', as reported by clang:

  util/map.c:390:36: error: address of array 'map->dso->name' will always evaluate to 'true' [-Werror,-Wpointer-bool-conversion]
          if (map && map->dso && (map->dso->name || map->dso->long_name)) {
                                  ~~~~~~~~~~^~~~ ~~
  util/map.c:393:22: error: address of array 'map->dso->name' will always evaluate to 'true' [-Werror,-Wpointer-bool-conversion]
                  else if (map->dso->name)
                     ~~  ~~~~~~~~~~^~~~

Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: David Ahern <dsahern@gmail.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Wang Nan <wangnan0@huawei.com>
Link: http://lkml.kernel.org/n/tip-x8cu007cly40kfp8xnpi9kya@git.kernel.orgSigned-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

It will always evaluate to 'true', as clang warns:

    CC       /tmp/build/perf/tests/perf-record.o
    CC       /tmp/build/perf/tests/evsel-roundtrip-name.o
  tests/perf-record.c:69:24: error: comparison of array 'argv' equal to a null pointer is always false [-Werror,-Wtautological-pointer-compare]
          if (evlist == NULL || argv == NULL) {
                                ^~~~    ~~~~
  1 error generated.

Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: David Ahern <dsahern@gmail.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Wang Nan <wangnan0@huawei.com>
Link: http://lkml.kernel.org/n/tip-o4977g6p9b3peak9ct6ef48q@git.kernel.orgSigned-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

As it is an array, so will always evaluate to 'true', as reported by
clang:

  builtin-sched.c:2070:19: error: address of array 'sym->name' will always evaluate to 'true' [-Werror,-Wpointer-bool-conversion]
                  if (sym && sym->name) {
                          ~~ ~~~~~^~~~
  1 warning generated.

So just ditch all those useless checks.

Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: David Ahern <dsahern@gmail.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Wang Nan <wangnan0@huawei.com>
Link: http://lkml.kernel.org/n/tip-ydpm927col06paixb775jjx5@git.kernel.orgSigned-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

When a tool can't open counters due to the kernel.perf_event_paranoit
sysctl setting, we inform how to tweak it to allow the operation to
succeed, in addition to that, suggest setting /etc/sysctl.conf to
make the setting permanent.
Suggested-by: Ingo Molnar <mingo@kernel.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: David Ahern <dsahern@gmail.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Wang Nan <wangnan0@huawei.com>
Link: http://lkml.kernel.org/n/tip-4gwe99k4a6p12d4u8bbyttj2@git.kernel.orgSigned-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

Detected with clang:

    CC       /tmp/build/perf/plugin_function.o
  plugin_function.c:145:6: warning: variable 'index' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized]
          if (parent && ftrace_indent->set)
              ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
  plugin_function.c:148:29: note: uninitialized use occurs here
          trace_seq_printf(s, "%*s", index*3, "");
                                     ^~~~~
  plugin_function.c:145:2: note: remove the 'if' if its condition is always true
          if (parent && ftrace_indent->set)
          ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
  plugin_function.c:145:6: warning: variable 'index' is used uninitialized whenever '&&' condition is false [-Wsometimes-uninitialized]
          if (parent && ftrace_indent->set)
              ^~~~~~
  plugin_function.c:148:29: note: uninitialized use occurs here
          trace_seq_printf(s, "%*s", index*3, "");
                                     ^~~~~
  plugin_function.c:145:6: note: remove the '&&' if its condition is always true
          if (parent && ftrace_indent->set)
              ^~~~~~~~~
  plugin_function.c:133:11: note: initialize the variable 'index' to silence this warning
          int index;
                   ^
                    = 0
  2 warnings generated.
Reviewed-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: David Ahern <dsahern@gmail.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Wang Nan <wangnan0@huawei.com>
Link: http://lkml.kernel.org/n/tip-b5wyjocel55gorl2jq2cbxrr@git.kernel.orgSigned-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

A undefined value was being used for the OLD_RING_BUFFER_TYPE_TIME_STAMP
case entry, as the 'length' variable was not being initialized, fix it.

Caught by the reporter when building tools/perf/ using clang, which emmitted
this warning:

  kbuffer-parse.c:312:7: warning: variable 'length' is used uninitialized whenever switch case is taken [-Wsometimes-uninitialized]
          case OLD_RINGBUF_TYPE_TIME_EXTEND:
               ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
  kbuffer-parse.c:339:29: note: uninitialized use occurs here
          kbuf->next = kbuf->index + length;
                                   ^~~~~~
  kbuffer-parse.c:297:21: note: initialize the variable 'length' to silence this warning
          unsigned int length;
                             ^
                              = 0
Reported-by: Arnaldo Carvalho de Melo <acme@redhat.com>
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: David Ahern <dsahern@gmail.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Wang Nan <wangnan0@huawei.com>
Link: http://lkml.kernel.org/r/20170213121418.47f279e8@gandalf.local.homeSigned-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

Fix below compile error:

  CC       util/scripting-engines/trace-event-perl.o
  In file included from /usr/lib/perl5/5.22.2/i686-linux/CORE/perl.h:5673:0,
                   from util/scripting-engines/trace-event-perl.c:31:
  /usr/lib/perl5/5.22.2/i686-linux/CORE/inline.h: In function 'S__is_utf8_char_slow':
  /usr/lib/perl5/5.22.2/i686-linux/CORE/inline.h:270:5: error: nested extern declaration of 'Perl___notused' [-Werror=nested-externs]
          dTHX;   /* The function called below requires thread context */
			     ^
  cc1: all warnings being treated as errors

After digging perl5 repository, I find out that we will meet this
compile error with perl from v5.21.1 to v5.25.4
Signed-off-by: Wang YanQing <udknight@gmail.com>
Acked-by: Jiri Olsa <jolsa@kernel.org>
Link: http://lkml.kernel.org/r/20170212024655.GA15997@udknightSigned-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

The "delta-abs" compute method will show most changed entries on top.
So users can easily see how much effect between the data.  Note that it
also changes the default of -o option to 1 in order to apply the compute
method.  To see original-style (sorted by baseline) use -o 0 option.
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Peter Zijlstra <peterz@infradead.org>
Link: http://lkml.kernel.org/r/20170210161856.18422-1-namhyung@kernel.orgSigned-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

The diff.compute config variable is to set the default compute method of
perf diff command (-c option).  Possible values 'delta' (default),
'delta-abs', 'ratio' and 'wdiff'.
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Taeung Song <treeze.taeung@gmail.com>
Link: http://lkml.kernel.org/r/20170210073614.24584-4-namhyung@kernel.orgSigned-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

In many cases, I need to look at differences between two data so I often
used the -o option to sort the result base on the difference first.
It'd be nice to have a config option to set it by default.

The diff.order config option is to set the default value of -o/--order
option.
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Cc: Taeung Song <treeze.taeung@gmail.com>
Link: http://lkml.kernel.org/r/20170210073614.24584-3-namhyung@kernel.orgSigned-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

The 'delta-abs' compute method is same as 'delta' but shows entries with
bigger absolute delta first instead of sorting numerically.  This is
only useful together with -o option.

Below is default output (-c delta):

  $ perf diff -o 1 -c delta | grep -v ^# | head
    42.22%   +4.97%  [kernel.kallsyms]  [k] cfb_imageblit
     0.62%   +1.23%  [kernel.kallsyms]  [k] mutex_lock
             +1.15%  [kernel.kallsyms]  [k] copy_user_generic_string
     2.40%   +0.95%  [kernel.kallsyms]  [k] bit_putcs
     0.31%   +0.79%  [kernel.kallsyms]  [k] link_path_walk
             +0.64%  [kernel.kallsyms]  [k] kmem_cache_alloc
     0.00%   +0.57%  [kernel.kallsyms]  [k] __rcu_read_unlock
             +0.45%  [kernel.kallsyms]  [k] alloc_set_pte
     0.16%   +0.45%  [kernel.kallsyms]  [k] menu_select
             +0.41%  ld-2.24.so         [.] do_lookup_x

Now with 'delta-abs' it shows entries have bigger delta value either
positive or negative.

  $ perf diff -o 1 -c delta-abs | grep -v ^# | head
    42.22%   +4.97%  [kernel.kallsyms]  [k] cfb_imageblit
    12.72%   -3.01%  [kernel.kallsyms]  [k] intel_idle
     9.72%   -1.31%  [unknown]          [.] 0x0000000000411343
     0.62%   +1.23%  [kernel.kallsyms]  [k] mutex_lock
     2.40%   +0.95%  [kernel.kallsyms]  [k] bit_putcs
     0.31%   +0.79%  [kernel.kallsyms]  [k] link_path_walk
     1.35%   -0.71%  [kernel.kallsyms]  [k] smp_call_function_single
     0.00%   +0.57%  [kernel.kallsyms]  [k] __rcu_read_unlock
     0.16%   +0.45%  [kernel.kallsyms]  [k] menu_select
     0.72%   -0.44%  [kernel.kallsyms]  [k] lookup_fast
Signed-off-by: Namhyung Kim <namhyung@kernel.org>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Peter Zijlstra <a.p.zijlstra@chello.nl>
Link: http://lkml.kernel.org/r/20170210073614.24584-2-namhyung@kernel.orgSigned-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

To match the kernel headers structure, setting up things that are
specific to gcc or to some specific version of gcc.

It gets included by linux/compiler.h when gcc is the compiler being
used.

Cc: Adrian Hunter <adrian.hunter@intel.com>
Cc: David Ahern <dsahern@gmail.com>
Cc: Jiri Olsa <jolsa@kernel.org>
Cc: Joe Perches <joe@perches.com>
Cc: Namhyung Kim <namhyung@kernel.org>
Cc: Wang Nan <wangnan0@huawei.com>
Link: http://lkml.kernel.org/n/tip-fabcqfq4asodq9t158hcs8t3@git.kernel.orgSigned-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>

Add Kaby Lake mobile and desktop models for RAPL, CSTATE and UNCORE
matching Skylake.
Signed-off-by: Srinivas Pandruvada <srinivas.pandruvada@linux.intel.com>
Cc: peterz@infradead.org
Cc: kan.liang@intel.com
Cc: bigeasy@linutronix.de
Cc: dave.hansen@linux.intel.com
Cc: piotr.luc@intel.com
Cc: davidcc@google.com
Cc: bp@suse.de
Link: http://lkml.kernel.org/r/1486755517-17812-1-git-send-email-srinivas.pandruvada@linux.intel.comSigned-off-by: Thomas Gleixner <tglx@linutronix.de>

Pull x86 fixes from Ingo Molnar:
 "Last minute x86 fixes:

   - Fix a softlockup detector warning and long delays if using ptdump
     with KASAN enabled.

   - Two more TSC-adjust fixes for interesting firmware interactions.

   - Two commits to fix an AMD CPU topology enumeration bug that caused
     a measurable gaming performance regression"

* 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86/mm/ptdump: Fix soft lockup in page table walker
  x86/tsc: Make the TSC ADJUST sanitizing work for tsc_reliable
  x86/tsc: Avoid the large time jump when sanitizing TSC ADJUST
  x86/CPU/AMD: Fix Zen SMT topology
  x86/CPU/AMD: Bring back Compute Unit ID

Pull timer fix from Ingo Molnar:
 "Fix a sporadic missed timer hw reprogramming bug that can result in
  random delays"

* 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  tick/nohz: Fix possible missing clock reprog after tick soft restart

Pull perf fixes from Ingo Molnar:
 "A kernel crash fix plus three tooling fixes"

* 'perf-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  perf/core: Fix crash in perf_event_read()
  perf callchain: Reference count maps
  perf diff: Fix -o/--order option behavior (again)
  perf diff: Fix segfault on 'perf diff -o N' option

Pull lockdep fix from Ingo Molnar:
 "This fixes an ugly lockdep stack trace output regression. (But also
  affects other stacktrace users such as kmemleak, KASAN, etc)"

* 'locking-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  stacktrace, lockdep: Fix address, newline ugliness

Pull irq fixes from Ingo Molnar:
 "Two last minute ARM irqchip driver fixes"

* 'irq-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  irqchip/mxs: Enable SKIP_SET_WAKE and MASK_ON_SUSPEND
  irqchip/keystone: Fix "scheduling while atomic" on rt

Pull btrfs fixes from Chris Mason:
 "This has two last minute fixes. The highest priority here is a
  regression fix for the decompression code, but we also fixed up a
  problem with the 32-bit compat ioctls.

  The decompression bug could hand back the wrong data on big reads when
  zlib was used. I have a larger cleanup to make the math here less
  error prone, but at this stage in the release Omar's patch is the best
  choice"

* 'for-linus-4.10' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
  btrfs: fix btrfs_decompress_buf2page()
  btrfs: fix btrfs_compat_ioctl failures on non-compat ioctls

Pull SCSI fixes from James Bottomley:
 "Six fairly small fixes. None is a real show stopper, two automation
  detected problems: one memory leak, one use after free and four others
  each of which fixes something that has been a significant source of
  annoyance to someone"

* tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
  scsi: zfcp: fix use-after-free by not tracing WKA port open/close on failed send
  scsi: aacraid: Fix INTx/MSI-x issue with older controllers
  scsi: mpt3sas: disable ASPM for MPI2 controllers
  scsi: mpt3sas: Force request partial completion alignment
  scsi: qla2xxx: Avoid that issuing a LIP triggers a kernel crash
  scsi: qla2xxx: Fix a recently introduced memory leak

If btrfs_decompress_buf2page() is handed a bio with its page in the
middle of the working buffer, then we adjust the offset into the working
buffer. After we copy into the bio, we advance the iterator by the
number of bytes we copied. Then, we have some logic to handle the case
of discontiguous pages and adjust the offset into the working buffer
again. However, if we didn't advance the bio to a new page, we may enter
this case in error, essentially repeating the adjustment that we already
made when we entered the function. The end result is bogus data in the
bio.

Previously, we only checked for this case when we advanced to a new
page, but the conversion to bio iterators changed that. This restores
the old, correct behavior.

A case I saw when testing with zlib was:

    buf_start = 42769
    total_out = 46865
    working_bytes = total_out - buf_start = 4096
    start_byte = 45056

The condition (total_out > start_byte && buf_start < start_byte) is
true, so we adjust the offset:

    buf_offset = start_byte - buf_start = 2287
    working_bytes -= buf_offset = 1809
    current_buf_start = buf_start = 42769

Then, we copy

    bytes = min(bvec.bv_len, PAGE_SIZE - buf_offset, working_bytes) = 1809
    buf_offset += bytes = 4096
    working_bytes -= bytes = 0
    current_buf_start += bytes = 44578

After bio_advance(), we are still in the same page, so start_byte is the
same. Then, we check (total_out > start_byte && current_buf_start < start_byte),
which is true! So, we adjust the values again:

    buf_offset = start_byte - buf_start = 2287
    working_bytes = total_out - start_byte = 1809
    current_buf_start = buf_start + buf_offset = 45056

But note that working_bytes was already zero before this, so we should
have stopped copying.

Fixes: 974b1adc ("btrfs: use bio iterators for the decompression handlers")
Reported-by: Pat Erley <pat-lkml@erley.org>
Reviewed-by: Chris Mason <clm@fb.com>
Signed-off-by: Omar Sandoval <osandov@fb.com>
Signed-off-by: Chris Mason <clm@fb.com>
Reviewed-by: Liu Bo <bo.li.liu@oracle.com>
Tested-by: Liu Bo <bo.li.liu@oracle.com>

Pull networking fixes from David Miller:

 1) If the timing is wrong we can indefinitely stop generating new ipv6
    temporary addresses, from Marcus Huewe.

 2) Don't double free per-cpu stats in ipv6 SIT tunnel driver, from Cong
    Wang.

 3) Put protections in place so that AF_PACKET is not able to submit
    packets which don't even have a link level header to drivers. From
    Willem de Bruijn.

 4) Fix memory leaks in ipv4 and ipv6 multicast code, from Hangbin Liu.

 5) Don't use udp_ioctl() in l2tp code, UDP version expects a UDP socket
    and that doesn't go over very well when it is passed an L2TP one.
    Fix from Eric Dumazet.

 6) Don't crash on NULL pointer in phy_attach_direct(), from Florian
    Fainelli.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
  l2tp: do not use udp_ioctl()
  xen-netfront: Delete rx_refill_timer in xennet_disconnect_backend()
  NET: mkiss: Fix panic
  net: hns: Fix the device being used for dma mapping during TX
  net: phy: Initialize mdio clock at probe function
  igmp, mld: Fix memory leak in igmpv3/mld_del_delrec()
  xen-netfront: Improve error handling during initialization
  sierra_net: Skip validating irrelevant fields for IDLE LSIs
  sierra_net: Add support for IPv6 and Dual-Stack Link Sense Indications
  kcm: fix 0-length case for kcm_sendmsg()
  xen-netfront: Rework the fix for Rx stall during OOM and network stress
  net: phy: Fix PHY module checks and NULL deref in phy_attach_direct()
  net: thunderx: Fix PHY autoneg for SGMII QLM mode
  net: dsa: Do not destroy invalid network devices
  ping: fix a null pointer dereference
  packet: round up linear to header len
  net: introduce device min_header_len
  sit: fix a double free on error path
  lwtunnel: valid encap attr check should return 0 when lwtunnel is disabled
  ipv6: addrconf: fix generation of new temporary addresses

Pull rdma fixes from Doug Ledford:
 "Third round of -rc fixes for 4.10 kernel:

   - two security related issues in the rxe driver

   - one compile issue in the RDMA uapi header"

* tag 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dledford/rdma:
  RDMA: Don't reference kernel private header from UAPI header
  IB/rxe: Fix mem_check_range integer overflow
  IB/rxe: Fix resid update

Pull i2c bugfixes from Wolfram Sang:
 "Two bugfixes (proper IO mapping and use of mutex) for a driver feature
  we introduced in this cycle"

* 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
  i2c: piix4: Request the SMBUS semaphore inside the mutex
  i2c: piix4: Fix request_region size

Pull MMC host fix from Ulf Hansson:
 "mmci: Fix hang while waiting for busy-end interrupt"

* tag 'mmc-v4.10-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/ulfh/mmc:
  mmc: mmci: avoid clearing ST Micro busy end interrupt mistakenly

Pull sound fixes from Takashi Iwai:
 "Here are some last-minute fixes: two fixes for races in ALSA sequencer
  queue spotted by syzkaller, a revert for a regression of LINE6 driver
  (since 4.9), and a trivial new codec ID addition for Nvidia HDMI"

* tag 'sound-4.10' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: hda - adding a new NV HDMI/DP codec ID in the driver
  ALSA: seq: Fix race at creating a queue
  Revert "ALSA: line6: Only determine control port properties if needed"
  ALSA: seq: Don't handle loop timeout at snd_seq_pool_done()

Pull nfsd revert from Bruce Fields:
 "This patch turned out to have a couple problems. The problems are
  fixable, but at least one of the fixes is a little ugly. The original
  bug has always been there, so we can wait another week or two to get
  this right"

* tag 'nfsd-4.10-3' of git://linux-nfs.org/~bfields/linux:
  nfsd: Revert "nfsd: special case truncates some more"

Pull powerpc fixes friom Michael Ellerman:
 "Apologies for the late pull request, but Ben has been busy finding bugs.

   - Userspace was semi-randomly segfaulting on radix due to us
     incorrectly handling a fault triggered by autonuma, caused by a
     patch we merged earlier in v4.10 to prevent the kernel executing
     userspace.

   - We weren't marking host IPIs properly for KVM in the OPAL ICP
     backend.

   - The ERAT flushing on radix was missing an isync and was incorrectly
     marked as DD1 only.

   - The powernv CPU hotplug code was missing a wakeup type and failing
     to flush the interrupt correctly when using OPAL ICP

  Thanks to Benjamin Herrenschmidt"

* tag 'powerpc-4.10-4' of git://git.kernel.org/pub/scm/linux/kernel/git/powerpc/linux:
  powerpc/powernv: Properly set "host-ipi" on IPIs
  powerpc/powernv: Fix CPU hotplug to handle waking on HVI
  powerpc/mm/radix: Update ERAT flushes when invalidating TLB
  powerpc/mm: Fix spurrious segfaults on radix with autonuma

udp_ioctl(), as its name suggests, is used by UDP protocols,
but is also used by L2TP :(

L2TP should use its own handler, because it really does not
look the same.

SIOCINQ for instance should not assume UDP checksum or headers.

Thanks to Andrey and syzkaller team for providing the report
and a nice reproducer.

While crashes only happen on recent kernels (after commit
7c13f97f ("udp: do fwd memory scheduling on dequeue")), this
probably needs to be backported to older kernels.

Fixes: 7c13f97f ("udp: do fwd memory scheduling on dequeue")
Fixes: 85584672 ("udp: Fix udp_poll() and ioctl()")
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: Andrey Konovalov <andreyknvl@google.com>
Acked-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Merge branch 'for-chris' of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux into for-linus-4.10