With the changes in life time management between the cfq IO contexts
and the cfq queues, we now risk having cfqd->active_queue being
freed when cfq_slice_expired() is being called. cfq_preempt_queue()
caches this queue and uses it after calling said function, causing
a use-after-free condition. This triggers the following oops,
when cfqq_type() attempts to dereference it:

BUG: unable to handle kernel paging request at ffff8800746c4f0c
IP: [<ffffffff81266d59>] cfqq_type+0xb/0x20
PGD 18d4063 PUD 1fe15067 PMD 1ffb9067 PTE 80000000746c4160
Oops: 0000 [#1] SMP DEBUG_PAGEALLOC
CPU 3
Modules linked in:

Pid: 1, comm: init Not tainted 3.2.0-josef+ #367 Bochs Bochs
RIP: 0010:[<ffffffff81266d59>]  [<ffffffff81266d59>] cfqq_type+0xb/0x20
RSP: 0018:ffff880079c11778  EFLAGS: 00010046
RAX: 0000000000000000 RBX: ffff880076f3df08 RCX: 0000000000000000
RDX: 0000000000000006 RSI: ffff880074271888 RDI: ffff8800746c4f08
RBP: ffff880079c11778 R08: 0000000000000078 R09: 0000000000000001
R10: 09f911029d74e35b R11: 09f911029d74e35b R12: ffff880076f337f0
R13: ffff8800746c4f08 R14: ffff8800746c4f08 R15: 0000000000000002
FS:  00007f62fd44f700(0000) GS:ffff88007cd80000(0000) knlGS:0000000000000000
CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff8800746c4f0c CR3: 0000000076c21000 CR4: 00000000000006e0
DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
Process init (pid: 1, threadinfo ffff880079c10000, task ffff880079c0a040)
Stack:
 ffff880079c117c8 ffffffff812683d8 ffff880079c117a8 ffffffff8125de43
 ffff8800744fcf48 ffff880074b43e98 ffff8800770c8828 ffff880074b43e98
 0000000000000003 0000000000000000 ffff880079c117f8 ffffffff81254149
Call Trace:
 [<ffffffff812683d8>] cfq_insert_request+0x3f5/0x47c
 [<ffffffff8125de43>] ? blk_recount_segments+0x20/0x31
 [<ffffffff81254149>] __elv_add_request+0x1ca/0x200
 [<ffffffff8125aa99>] blk_queue_bio+0x2ef/0x312
 [<ffffffff81258f7b>] generic_make_request+0x9f/0xe0
 [<ffffffff8125907b>] submit_bio+0xbf/0xca
 [<ffffffff81136ec7>] submit_bh+0xdf/0xfe
 [<ffffffff81176d04>] ext3_bread+0x50/0x99
 [<ffffffff811785b3>] dx_probe+0x38/0x291
 [<ffffffff81178864>] ext3_dx_find_entry+0x58/0x219
 [<ffffffff81178ad5>] ext3_find_entry+0xb0/0x406
 [<ffffffff8110c4d5>] ? cache_alloc_debugcheck_after.isra.46+0x14d/0x1a0
 [<ffffffff8110cfbd>] ? kmem_cache_alloc+0xef/0x191
 [<ffffffff8117a330>] ext3_lookup+0x39/0xe1
 [<ffffffff81119461>] d_alloc_and_lookup+0x45/0x6c
 [<ffffffff8111ac41>] do_lookup+0x1e4/0x2f5
 [<ffffffff8111aef6>] link_path_walk+0x1a4/0x6ef
 [<ffffffff8111b557>] path_lookupat+0x59/0x5ea
 [<ffffffff8127406c>] ? __strncpy_from_user+0x30/0x5a
 [<ffffffff8111bce0>] do_path_lookup+0x23/0x59
 [<ffffffff8111cfd6>] user_path_at_empty+0x53/0x99
 [<ffffffff8107b37b>] ? remove_wait_queue+0x51/0x56
 [<ffffffff8111d02d>] user_path_at+0x11/0x13
 [<ffffffff811141f5>] vfs_fstatat+0x3a/0x64
 [<ffffffff8111425a>] vfs_stat+0x1b/0x1d
 [<ffffffff81114359>] sys_newstat+0x1a/0x33
 [<ffffffff81060e12>] ? task_stopped_code+0x42/0x42
 [<ffffffff815d6712>] system_call_fastpath+0x16/0x1b
Code: 89 e6 48 89 c7 e8 fa ca fe ff 85 c0 74 06 4c 89 2b 41 b6 01 5b 44 89 f0 41 5c 41 5d 41 5e 5d c3 55 48 89 e5 66 66 66 66 90 31 c0 <8b> 57 04 f6 c6 01 74 0b 83 e2 20 83 fa 01 19 c0 83 c0 02 5d c3
RIP  [<ffffffff81266d59>] cfqq_type+0xb/0x20
 RSP <ffff880079c11778>
CR2: ffff8800746c4f0c

Get rid of the caching of cfqd->active_queue, and reorder the
check so that it happens before we expire the active queue.

Thanks to Tejun for pin pointing the error location.
Reported-by: Chris Mason <chris.mason@oracle.com>
Tested-by: Chris Mason <chris.mason@oracle.com>
Signed-off-by: Jens Axboe <axboe@kernel.dk>

* 'for-3.3/core' of git://git.kernel.dk/linux-block: (37 commits)
  Revert "block: recursive merge requests"
  block: Stop using macro stubs for the bio data integrity calls
  blockdev: convert some macros to static inlines
  fs: remove unneeded plug in mpage_readpages()
  block: Add BLKROTATIONAL ioctl
  block: Introduce blk_set_stacking_limits function
  block: remove WARN_ON_ONCE() in exit_io_context()
  block: an exiting task should be allowed to create io_context
  block: ioc_cgroup_changed() needs to be exported
  block: recursive merge requests
  block, cfq: fix empty queue crash caused by request merge
  block, cfq: move icq creation and rq->elv.icq association to block core
  block, cfq: restructure io_cq creation path for io_context interface cleanup
  block, cfq: move io_cq exit/release to blk-ioc.c
  block, cfq: move icq cache management to block core
  block, cfq: move io_cq lookup to blk-ioc.c
  block, cfq: move cfqd->icq_list to request_queue and add request->elv.icq
  block, cfq: reorganize cfq_io_context into generic and cfq specific parts
  block: remove elevator_queue->ops
  block: reorder elevator switch sequence
  ...

Fix up conflicts in:
 - block/blk-cgroup.c
	Switch from can_attach_task to can_attach
 - block/cfq-iosched.c
	conflict with now removed cic index changes (we now use q->id instead)

* 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip: (39 commits)
  perf tools: Fix compile error on x86_64 Ubuntu
  perf report: Fix --stdio output alignment when --showcpuutilization used
  perf annotate: Get rid of field_sep check
  perf annotate: Fix usage string
  perf kmem: Fix a memory leak
  perf kmem: Add missing closedir() calls
  perf top: Add error message for EMFILE
  perf test: Change type of '-v' option to INCR
  perf script: Add missing closedir() calls
  tracing: Fix compile error when static ftrace is enabled
  recordmcount: Fix handling of elf64 big-endian objects.
  perf tools: Add const.h to MANIFEST to make perf-tar-src-pkg work again
  perf tools: Add support for guest/host-only profiling
  perf kvm: Do guest-only counting by default
  perf top: Don't update total_period on process_sample
  perf hists: Stop using 'self' for struct hist_entry
  perf hists: Rename total_session to total_period
  x86: Add counter when debug stack is used with interrupts enabled
  x86: Allow NMIs to hit breakpoints in i386
  x86: Keep current stack in NMI breakpoints
  ...

* 'x86-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  x86, atomic: atomic64_read() take a const pointer
  x86, UV: Update Boot messages for SGI UV2 platform

* 'linux-next' of git://git.infradead.org/ubifs-2.6:
  UBI: use own macros for the layout volume
  UBI: fix nameless volumes handling
  UBIFS: fix non-debug configuration build

This is a minor nicification: UBI_LAYOUT_VOLUME_TYPE and
UBI_LAYOUT_VOLUME_ALIGN are currently defined but not used -
use them.
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@linux.intel.com>

Currently it's possible to create a volume without a name. E.g:
ubimkvol -n 32 -s 2MiB -t static /dev/ubi0 -N ""

After that vtbl_check() will always fail because it does not permit
empty strings.

Cc: stable@kernel.org
Signed-off-by: Richard Weinberger <richard@nod.at>
Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@linux.intel.com>

Fix a brown paperbag bug introduced by me in the previous commit. I was
in hurry and forgot about the non-debug case completely.

Artem: amend the commit message and tweak the patch to preserve alignment.
       This made the patch a bit less readable, though.
Signed-off-by: Artem Bityutskiy <Artem.Bityutskiy@linux.intel.com>

This reverts commit 27419322.

We have some problems related to selection of empty queues
that need to be resolved, evidence so far points to the
recursive merge logic making either being the cause or at
least the accelerator for this. So revert it for now, until
we figure this out.
Signed-off-by: Jens Axboe <axboe@kernel.dk>

* 'for-linus' of git://selinuxproject.org/~jmorris/linux-security:
  capabilities: remove __cap_full_set definition
  security: remove the security_netlink_recv hook as it is equivalent to capable()
  ptrace: do not audit capability check when outputing /proc/pid/stat
  capabilities: remove task_ns_* functions
  capabitlies: ns_capable can use the cap helpers rather than lsm call
  capabilities: style only - move capable below ns_capable
  capabilites: introduce new has_ns_capabilities_noaudit
  capabilities: call has_ns_capability from has_capability
  capabilities: remove all _real_ interfaces
  capabilities: introduce security_capable_noaudit
  capabilities: reverse arguments to security_capable
  capabilities: remove the task from capable LSM hook entirely
  selinux: sparse fix: fix several warnings in the security server cod
  selinux: sparse fix: fix warnings in netlink code
  selinux: sparse fix: eliminate warnings for selinuxfs
  selinux: sparse fix: declare selinux_disable() in security.h
  selinux: sparse fix: move selinux_complete_init
  selinux: sparse fix: make selinux_secmark_refcount static
  SELinux: Fix RCU deref check warning in sel_netport_insert()

Manually fix up a semantic mis-merge wrt security_netlink_recv():

 - the interface was removed in commit fd778461 ("security: remove
   the security_netlink_recv hook as it is equivalent to capable()")

 - a new user of it appeared in commit a38f7907 ("crypto: Add
   userspace configuration API")

causing no automatic merge conflict, but Eric Paris pointed out the
issue.

Kmemleak patches

Main features:
- Handle percpu memory allocations (only scanning them, not actually
  reporting).
- Memory hotplug support.

Usability improvements:
- Show the origin of early allocations.
- Report previously found leaks even if kmemleak has been disabled by
  some error.

* tag 'kmemleak' of git://git.kernel.org/pub/scm/linux/kernel/git/cmarinas/linux:
  kmemleak: Add support for memory hotplug
  kmemleak: Handle percpu memory allocation
  kmemleak: Report previously found leaks even after an error
  kmemleak: When the early log buffer is exceeded, report the actual number
  kmemleak: Show where early_log issues come from

* 'for-next' of git://git.infradead.org/users/dhowells/linux-headers:
  UAPI: Split trivial #if defined(__KERNEL__) && X conditionals
  UAPI: Don't have a #elif clause in a __KERNEL__ guard in linux/soundcard.h
  UAPI: Fix AHZ multiple inclusion when __KERNEL__ is removed
  UAPI: Make linux/patchkey.h easier to parse
  UAPI: Fix nested __KERNEL__ guards in video/edid.h
  UAPI: Alter the S390 asm include guards to be recognisable by the UAPI splitter
  UAPI: Guard linux/cuda.h
  UAPI: Guard linux/pmu.h
  UAPI: Guard linux/isdn_divertif.h
  UAPI: Guard linux/sound.h
  UAPI: Rearrange definition of HZ in asm-generic/param.h
  UAPI: Make FRV use asm-generic/param.h
  UAPI: Make M32R use asm-generic/param.h
  UAPI: Make MN10300 use asm-generic/param.h
  UAPI: elf_read_implies_exec() is a kernel-only feature - so hide from userspace
  UAPI: Don't include linux/compat.h in sparc's asm/siginfo.h
  UAPI: Fix arch/mips/include/asm/Kbuild to have separate header-y lines

Removing the parent of a watched file results in "kernel BUG at
fs/notify/mark.c:139".

To reproduce

  add "-w /tmp/audit/dir/watched_file" to audit.rules
  rm -rf /tmp/audit/dir

This is caused by fsnotify_destroy_mark() being called without an
extra reference taken by the caller.

Reported by Francesco Cosoleto here:

  https://bugzilla.novell.com/show_bug.cgi?id=689860

Fix by removing the BUG_ON and adding a comment about not accessing mark after
the iput.
Signed-off-by: Miklos Szeredi <mszeredi@suse.cz>
CC: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rostedt/linux-kconfig:
  kconfig/streamline-config.pl: Fix parsing Makefile with variables
  kconfig/streamline-config.pl: Simplify backslash line concatination

* 'fbdev-next' of git://github.com/schandinat/linux-2.6: (175 commits)
  module_param: make bool parameters really bool (drivers/video/i810)
  Revert "atmel_lcdfb: Adjust HFP calculation so it matches the manual."
  OMAPDSS: HDMI: Disable DDC internal pull up
  OMAPDSS: HDMI: Move duplicate code from boardfile
  OMAPDSS: add OrtusTech COM43H4M10XTC display support
  OMAP: DSS2: Support for UMSH-8173MD TFT panel
  ASoC: OMAP: HDMI: Move HDMI codec trigger function to generic HDMI driver
  OMAPDSS: HDMI: Create function to enable HDMI audio
  ASoC: OMAP: HDMI: Correct signature of ASoC functions
  ASoC: OMAP: HDMI: Introduce driver data for audio codec
  grvga: fix section mismatch warnings
  video: s3c-fb: Don't keep device runtime active when open
  video: s3c-fb: Hold runtime PM references when touching registers
  video: s3c-fb: Take a runtime PM reference when unblanked
  video: s3c-fb: Disable runtime PM in error paths from probe
  video: s3c-fb: Use s3c_fb_enable() to enable the framebuffer
  video: s3c-fb: Make runtime PM functional again
  drivers/video: fsl-diu-fb: merge fsl_diu_alloc() into map_video_memory()
  drivers/video: fsl-diu-fb: add default platform ops functions
  drivers/video: fsl-diu-fb: remove broken reference count enabling the display
  ...

A logical volume can map to just part of underlying physical volume.
In this case, it must be treated like a partition.

Based on a patch from Alasdair G Kergon.

Cc: Alasdair G Kergon <agk@redhat.com>
Cc: dm-devel@redhat.com
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Linux allows executing the SG_IO ioctl on a partition or LVM volume, and
will pass the command to the underlying block device.  This is
well-known, but it is also a large security problem when (via Unix
permissions, ACLs, SELinux or a combination thereof) a program or user
needs to be granted access only to part of the disk.

This patch lets partitions forward a small set of harmless ioctls;
others are logged with printk so that we can see which ioctls are
actually sent.  In my tests only CDROM_GET_CAPABILITY actually occurred.
Of course it was being sent to a (partition on a) hard disk, so it would
have failed with ENOTTY and the patch isn't changing anything in
practice.  Still, I'm treating it specially to avoid spamming the logs.

In principle, this restriction should include programs running with
CAP_SYS_RAWIO.  If for example I let a program access /dev/sda2 and
/dev/sdb, it still should not be able to read/write outside the
boundaries of /dev/sda2 independent of the capabilities.  However, for
now programs with CAP_SYS_RAWIO will still be allowed to send the
ioctls.  Their actions will still be logged.

This patch does not affect the non-libata IDE driver.  That driver
however already tests for bd != bd->bd_contains before issuing some
ioctl; it could be restricted further to forbid these ioctls even for
programs running with CAP_SYS_ADMIN/CAP_SYS_RAWIO.

Cc: linux-scsi@vger.kernel.org
Cc: Jens Axboe <axboe@kernel.dk>
Cc: James Bottomley <JBottomley@parallels.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
[ Make it also print the command name when warning - Linus ]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Introduce a wrapper around scsi_cmd_ioctl that takes a block device.

The function will then be enhanced to detect partition block devices
and, in that case, subject the ioctls to whitelisting.

Cc: linux-scsi@vger.kernel.org
Cc: Jens Axboe <axboe@kernel.dk>
Cc: James Bottomley <JBottomley@parallels.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

2nd set of device tree changes and SPI bug fixes for v3.3

* tag 'devicetree-for-linus' of git://git.secretlab.ca/git/linux-2.6:
  of/irq: Add interrupts-names property to name an irq resource
  of/address: Add reg-names property to name an iomem resource

* tag 'spi-for-linus' of git://git.secretlab.ca/git/linux-2.6:
  spi/tegra: depend instead of select TEGRA_SYSTEM_DMA

2nd round of GPIO changes for v3.3 merge window

* tag 'gpio-for-linus' of git://git.secretlab.ca/git/linux-2.6:
  GPIO: sa1100: implement proper gpiolib gpio_to_irq conversion
  gpio: pl061: remove combined interrupt
  gpio: pl061: convert to use generic irq chip
  GPIO: add bindings for managed devices
  ARM: realview: convert pl061 no irq to 0 instead of -1
  gpio: pl061: convert to use 0 for no irq
  gpio: pl061: use chained_irq_* functions in irq handler
  GPIO/pl061: Add suspend resume capability
  drivers/gpio/gpio-tegra.c: use devm_request_and_ioremap

* 'upstream' of git://git.linux-mips.org/pub/scm/ralf/upstream-linus: (119 commits)
  MIPS: Delete unused function add_temporary_entry.
  MIPS: Set default pci cache line size.
  MIPS: Flush huge TLB
  MIPS: Octeon: Remove SYS_SUPPORTS_HIGHMEM.
  MIPS: Octeon: Add support for OCTEON II PCIe
  MIPS: Octeon: Update PCI Latency timer and enable more error reporting.
  MIPS: Alchemy: Update cpu-feature-overrides
  MIPS: Alchemy: db1200: Improve PB1200 detection.
  MIPS: Alchemy: merge Au1000 and Au1300-style IRQ controller code.
  MIPS: Alchemy: chain IRQ controllers to MIPS IRQ controller
  MIPS: Alchemy: irq: register pm at irq init time
  MIPS: Alchemy: Touchscreen support on DB1100
  MIPS: Alchemy: Hook up IrDA on DB1000/DB1100
  net/irda: convert au1k_ir to platform driver.
  MIPS: Alchemy: remove unused board headers
  MTD: nand: make au1550nd.c a platform_driver
  MIPS: Netlogic: Mark Netlogic chips as SMT capable
  MIPS: Netlogic: Add support for XLP 3XX cores
  MIPS: Netlogic: Merge some of XLR/XLP wakup code
  MIPS: Netlogic: Add default XLP config.
  ...

Fix up trivial conflicts in arch/mips/kernel/{perf_event_mipsxx.c,
traps.c} and drivers/tty/serial/Makefile

Autogenerated GPG tag for Rusty D1ADB8F1: 15EE 8D6C AB0E 7F0C F999  BFCB D920 0E6C D1AD B8F1

* tag 'for-linus' of git://github.com/rustyrussell/linux:
  module_param: check that bool parameters really are bool.
  intelfbdrv.c: bailearly is an int module_param
  paride/pcd: fix bool verbose module parameter.
  module_param: make bool parameters really bool (drivers & misc)
  module_param: make bool parameters really bool (arch)
  module_param: make bool parameters really bool (core code)
  kernel/async: remove redundant declaration.
  printk: fix unnecessary module_param_name.
  lirc_parallel: fix module parameter description.
  module_param: avoid bool abuse, add bint for special cases.
  module_param: check type correctness for module_param_array
  modpost: use linker section to generate table.
  modpost: use a table rather than a giant if/else statement.
  modules: sysfs - export: taint, coresize, initsize
  kernel/params: replace DEBUGP with pr_debug
  module: replace DEBUGP with pr_debug
  module: struct module_ref should contains long fields
  module: Fix performance regression on modules with large symbol tables
  module: Add comments describing how the "strmap" logic works

Fix up conflicts in scripts/mod/file2alias.c due to the new linker-
generated table approach to adding __mod_*_device_table entries.  The
ARM sa11x0 mcp bus needed to be converted to that too.

* 'for-3.3' of git://linux-nfs.org/~bfields/linux: (31 commits)
  nfsd4: nfsd4_create_clid_dir return value is unused
  NFSD: Change name of extended attribute containing junction
  svcrpc: don't revert to SVC_POOL_DEFAULT on nfsd shutdown
  svcrpc: fix double-free on shutdown of nfsd after changing pool mode
  nfsd4: be forgiving in the absence of the recovery directory
  nfsd4: fix spurious 4.1 post-reboot failures
  NFSD: forget_delegations should use list_for_each_entry_safe
  NFSD: Only reinitilize the recall_lru list under the recall lock
  nfsd4: initialize special stateid's at compile time
  NFSd: use network-namespace-aware cache registering routines
  SUNRPC: create svc_xprt in proper network namespace
  svcrpc: update outdated BKL comment
  nfsd41: allow non-reclaim open-by-fh's in 4.1
  svcrpc: avoid memory-corruption on pool shutdown
  svcrpc: destroy server sockets all at once
  svcrpc: make svc_delete_xprt static
  nfsd: Fix oops when parsing a 0 length export
  nfsd4: Use kmemdup rather than duplicating its implementation
  nfsd4: add a separate (lockowner, inode) lookup
  nfsd4: fix CONFIG_NFSD_FAULT_INJECTION compile error
  ...

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
  powerpc: Fix unpaired __trace_hcall_entry and __trace_hcall_exit
  powerpc: Fix RCU idle and hcall tracing

* 'i2c-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging:
  MAINTAINERS: List i2c-omap and i2c-davinci drivers
  MAINTAINERS: i2c: Add third maintainer
  i2c/gpio-i2cmux: Convert to use module_platform_driver()
  i2c/busses: Use module_platform_driver()
  i2c-dev: Use memdup_user
  i2c: Convert to DEFINE_PCI_DEVICE_TABLE
  i2c-ali1535: enable SPARC support
  i2c: Fix error value returned by several bus drivers

The existing gpio_to_irq() implementation on sa1100 only translates
validly for internal GPIOs.  Since this sub-arch enables GPIOLIB
support, this results in buggy translations for non-internal GPIOs.

Get rid of the private gpio_to_irq() implementation, replacing it
with the .to_irq method in the sa1100 gpio chip instead.
Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Grant Likely <grant.likely@secretlab.ca>

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
  dma-buf: Documentation update for Kconfig select
  nouveau: Support Optimus models for vga_switcheroo
  nouveau: properly check for _DSM function support
  dma-buf: drop option text so users don't select it.
  radeon: Call pci_clear_master() instead of open-coding it.
  gma500: Discard modes that don't fit in stolen memory
  drm: bump DRM_CONNECTOR_MAX_ENCODER from 2 to 3
  drm/radeon/kms: Fix module parameter description format
  drm/radeon/kms/ni: fix packet2 handling for VM IB parser
  ttm/dma: Remove the WARN() which is not useful.

* 'for-next' of git://git.kernel.org/pub/scm/linux/kernel/git/sameo/mfd-2.6: (59 commits)
  rtc: max8925: Add function to work as wakeup source
  mfd: Add pm ops to max8925
  mfd: Convert aat2870 to dev_pm_ops
  mfd: Still check other interrupts if we get a wm831x touchscreen IRQ
  mfd: Introduce missing kfree in 88pm860x probe routine
  mfd: Add S5M series configuration
  mfd: Add s5m series irq driver
  mfd: Add S5M core driver
  mfd: Improve mc13xxx dt binding document
  mfd: Fix stmpe section mismatch
  mfd: Fix stmpe build warning
  mfd: Fix STMPE I2c build failure
  mfd: Constify aat2870-core i2c_device_id table
  gpio: Add support for stmpe variant 801
  mfd: Add support for stmpe variant 801
  mfd: Add support for stmpe variant 610
  mfd: Add support for STMPE SPI interface
  mfd: Separate out STMPE controller and interface specific code
  misc: Remove max8997-muic sysfs attributes
  mfd: Remove unused wm831x_irq_data_to_mask_reg()
  ...

Fix up trivial conflict in drivers/leds/Kconfig due to addition of
LEDS_MAX8997 and LEDS_TCA6507 next to each other.

MMC highlights for 3.3:

Core:
 * Support for the HS200 high-speed eMMC mode.
 * Support SDIO 3.0 Ultra High Speed cards.
 * Kill pending block requests immediately if card is removed.
 * Enable the eMMC feature for locking boot partitions read-only
   until next power on, exposed via sysfs.

Drivers:
 * Runtime PM support for Intel Medfield SDIO.
 * Suspend/resume support for sdhci-spear.
 * sh-mmcif now processes requests asynchronously.

* tag 'mmc-merge-for-3.3-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc: (58 commits)
  mmc: fix a deadlock between system suspend and MMC block IO
  mmc: sdhci: restore the enabled dma when do reset all
  mmc: dw_mmc: miscaculated the fifo-depth with wrong bit operation
  mmc: host: Adds support for eMMC 4.5 HS200 mode
  mmc: core: HS200 mode support for eMMC 4.5
  mmc: dw_mmc: fixed wrong bit operation for SDMMC_GET_FCNT()
  mmc: core: Separate the timeout value for cache-ctrl
  mmc: sdhci-spear: Fix compilation error
  mmc: sdhci: Deal with failure case in sdhci_suspend_host
  mmc: dw_mmc: Clear the DDR mode for non-DDR
  mmc: sd: Fix SDR12 timing regression
  mmc: sdhci: Fix tuning timer incorrect setting when suspending host
  mmc: core: Add option to prevent eMMC sleep command
  mmc: omap_hsmmc: use threaded irq handler for card-detect.
  mmc: sdhci-pci: enable runtime PM for Medfield SDIO
  mmc: sdhci: Always pass clock request value zero to set_clock host op
  mmc: sdhci-pci: remove SDHCI_QUIRK2_OWN_CARD_DETECTION
  mmc: sdhci-pci: get gpio numbers from platform data
  mmc: sdhci-pci: add platform data
  mmc: sdhci: prevent card detection activity for non-removable cards
  ...

* 'wire-accept4' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux:
  ia64: Add accept4() syscall

Since commit 080d676d ("aio: allocate kiocbs in batches") iocbs are
allocated in a batch during processing of first iocbs.  All iocbs in a
batch are automatically added to ctx->active_reqs list and accounted in
ctx->reqs_active.

If one (not the last one) of iocbs submitted by an user fails, further
iocbs are not processed, but they are still present in ctx->active_reqs
and accounted in ctx->reqs_active.  This causes process to stuck in a D
state in wait_for_all_aios() on exit since ctx->reqs_active will never
go down to zero.  Furthermore since kiocb_batch_free() frees iocb
without removing it from active_reqs list the list become corrupted
which may cause oops.

Fix this by removing iocb from ctx->active_reqs and updating
ctx->reqs_active in kiocb_batch_free().
Signed-off-by: Gleb Natapov <gleb@redhat.com>
Reviewed-by: Jeff Moyer <jmoyer@redhat.com>
Cc: stable@kernel.org   # 3.2
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Commit 8a25a2fd ("cpu: convert 'cpu' and 'machinecheck' sysdev_class
to a regular subsystem") changed how things are dealt with in the MCE
subsystem.  Some of the things that got broken due to this are CPU
hotplug and suspend/hibernate.

MCE uses per_cpu allocations of struct device.  So, when a CPU goes
offline and comes back online, in order to ensure that we start from a
clean slate with respect to the MCE subsystem, zero out the entire
per_cpu device structure to 0 before using it.
Signed-off-by: Srivatsa S. Bhat <srivatsa.bhat@linux.vnet.ibm.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Thomas Lange reported that when he did a 'make localmodconfig', his
config was missing the brcmsmac driver, even though he had the module
loaded.

Looking into this, I found the file:
drivers/net/wireless/brcm80211/brcmsmac/Makefile
had the following in the Makefile:

MODULEPFX := brcmsmac

obj-$(CONFIG_BRCMSMAC)  += $(MODULEPFX).o

The way streamline-config.pl works, is parsing all the
 obj-$(CONFIG_FOO) += foo.o
lines to find that CONFIG_FOO belongs to the module foo.ko.

But in this case, the brcmsmac.o was not used, but a variable in its place.

By changing streamline-config.pl to remember defined variables in Makefiles
and substituting them when they are used in the obj-X lines, allows
Thomas (and others) to have their brcmsmac module stay configured
when it is loaded and running "make localmodconfig".
Reported-by: Thomas Lange <thomas-lange2@gmx.de>
Tested-by: Thomas Lange <thomas-lange2@gmx.de>
Cc: Arend van Spriel <arend@broadcom.com>
Cc: stable@vger.kernel.org
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>

Simplify the way lines ending with backslashes (continuation) in Makefiles
is parsed. This is needed to implement a necessary fix.
Tested-by: Thomas Lange <thomas-lange2@gmx.de>
Cc: stable@vger.kernel.org
Signed-off-by: Steven Rostedt <rostedt@goodmis.org>

* git://git.kernel.org/pub/scm/linux/kernel/git/pkl/squashfs-next:
  Squashfs: fix i_blocks calculation with extended regular files
  Squashfs: fix mount time sanity check for corrupted superblock
  Squashfs: optimise squashfs_cache_get entry search
  Squashfs: Update documentation to include xattrs
  Squashfs: add missing block release on error condition

* git://git.kernel.org/pub/scm/linux/kernel/git/steve/gfs2-3.0-nmw:
  GFS2: Fix nlink setting on inode creation
  GFS2: fail mount if journal recovery fails
  GFS2: let spectator mount do read only recovery
  GFS2: Fix a use-after-free that coverity spotted
  GFS2: dlm based recovery coordination

* 'linux-next' of git://git.infradead.org/ubifs-2.6:
  UBIFS: fix key printing
  UBIFS: use snprintf instead of sprintf when printing keys
  UBIFS: fix debugging messages
  UBIFS: make debugging messages light again
  UBI: fix debugging messages
  UBI: make vid_hdr non-static

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/sage/ceph-client:
  ceph: ensure prealloc_blob is in place when removing xattr
  rbd: initialize snap_rwsem in rbd_add()
  ceph: enable/disable dentry complete flags via mount option
  vfs: export symbol d_find_any_alias()
  ceph: always initialize the dentry in open_root_dentry()
  libceph: remove useless return value for osd_client __send_request()
  ceph: avoid iput() while holding spinlock in ceph_dir_fsync
  ceph: avoid useless dget/dput in encode_fh
  ceph: dereference pointer after checking for NULL
  crush: fix force for non-root TAKE
  ceph: remove unnecessary d_fsdata conditional checks
  ceph: Use kmemdup rather than duplicating its implementation

Fix up conflicts in fs/ceph/super.c (d_alloc_root() failure handling vs
always initialize the dentry in open_root_dentry)

I don't know how I missed this obvious mistake when I
reviewed Als' patches, sorry.

[ Quoting Al:

	Grr...  Note to self: do git status *and* git stash show -p
	before git push.  Nothing like "WTF? I'd fixed that braino"
	feeling ;-/

  Al sent the same patch - it got broken in commit d668dc56:
  "autofs4: deal with autofs4_write/autofs4_write races". ]
Reported-and-tested-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Ian Kent <raven@themaw.net>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Before commit 56e46742 we have had locking
around all printing macros and we could use static buffers for creating
key strings and printing them. However, now we do not have that locking and
we cannot use static buffers. This commit removes the old DBGKEY() macros
and introduces few new helper macros for printing debugging messages plus
a key at the end. Thankfully, all the messages are already structures in
a way that the key is printed in the end.
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>