Fix a NULL pointer deref in the user-defined key type whereby updating a
negative key into a fully instantiated key will cause an oops to occur
when the code attempts to free the non-existent old payload.

This results in an oops that looks something like the following:

  BUG: unable to handle kernel NULL pointer dereference at 0000000000000008
  IP: [<ffffffff81085fa1>] __call_rcu+0x11/0x13e
  PGD 3391d067 PUD 3894a067 PMD 0
  Oops: 0002 [#1] SMP
  CPU 1
  Pid: 4354, comm: keyctl Not tainted 3.1.0-fsdevel+ #1140                  /DG965RY
  RIP: 0010:[<ffffffff81085fa1>]  [<ffffffff81085fa1>] __call_rcu+0x11/0x13e
  RSP: 0018:ffff88003d591df8  EFLAGS: 00010246
  RAX: 0000000000000000 RBX: 0000000000000000 RCX: 000000000000006e
  RDX: ffffffff8161d0c0 RSI: 0000000000000000 RDI: 0000000000000000
  RBP: ffff88003d591e18 R08: 0000000000000000 R09: ffffffff8152fa6c
  R10: 0000000000000000 R11: 0000000000000300 R12: ffff88003b8f9538
  R13: ffffffff8161d0c0 R14: ffff88003b8f9d50 R15: ffff88003c69f908
  FS:  00007f97eb18c720(0000) GS:ffff88003bd00000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: 0000000000000008 CR3: 000000003d47a000 CR4: 00000000000006e0
  DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
  DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400
  Process keyctl (pid: 4354, threadinfo ffff88003d590000, task ffff88003c78a040)
  Stack:
   ffff88003e0ffde0 ffff88003b8f9538 0000000000000001 ffff88003b8f9d50
   ffff88003d591e28 ffffffff810860f0 ffff88003d591e68 ffffffff8117bfea
   ffff88003d591e68 ffffffff00000000 ffff88003e0ffde1 ffff88003e0ffde0
  Call Trace:
   [<ffffffff810860f0>] call_rcu_sched+0x10/0x12
   [<ffffffff8117bfea>] user_update+0x8d/0xa2
   [<ffffffff8117723a>] key_create_or_update+0x236/0x270
   [<ffffffff811789b1>] sys_add_key+0x123/0x17e
   [<ffffffff813b84bb>] system_call_fastpath+0x16/0x1b
Signed-off-by: David Howells <dhowells@redhat.com>
Acked-by: Jeff Layton <jlayton@redhat.com>
Acked-by: Neil Horman <nhorman@redhat.com>
Acked-by: Steve Dickson <steved@redhat.com>
Acked-by: James Morris <jmorris@namei.org>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'iommu/fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/joro/iommu:
  iommu: omap: Fix compile failure

* 'fixes' of git://git.linaro.org/people/triad/linux-pinctrl:
  pinctrl: hide subsystem from the populace
  pinctrl: fix "warning: 'struct pinctrl_dev' declared inside parameter list"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/paulg/linux:
  fsl-rio: fix compile error

* 'gpio/merge' of git://git.secretlab.ca/git/linux-2.6:
  gpio: pca953x: propagate the errno from the chip_init functions
  gpio: pca953x: remove unneeded check for chip type
  gpio/omap: check return value from irq_alloc_generic_chip
  gpio/omap: replace MOD_REG_BIT macro with static inline

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/lliubbo/blackfin:
  blackfin: Fixup export.h includes
  Blackfin: add serial TX IRQ in individual platform resource

On a corrupted file system the ->len field could be wrong leading to
a buffer overflow.
Reported-and-acked-by: Clement LECIGNE <clement.lecigne@netasq.com>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Cc: stable@kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

The "#include <linux/module.h>" was replaced by "#include <linux/export.h>"
in the patch "powerpc: various straight conversions from module.h --> export.h".
This will cause the following compile problem:
arch/powerpc/sysdev/fsl_rio.c: In function 'fsl_rio_mcheck_exception':
arch/powerpc/sysdev/fsl_rio.c:296: error: implicit declaration of function 'search_exception_tables'.

The file fsl_rio.c needs the declaration of function "search_exception_tables"
in the header file "linux/module.h".
Signed-off-by: Liu Gang <Gang.Liu@freescale.com>
Signed-off-by: Paul Gortmaker <paul.gortmaker@windriver.com>

Commit 8dc7a9c8 ("blackfin: Add export.h to files using
EXPORT_SYMBOL/THIS_MODULE") inserted some of the include statements into
sections protected by an unrelated #if CONFIG_... statement. This can cause,
depending on the configuration used, warnings like this one:

	arch/blackfin/mach-bf537/boards/stamp.c:2940: warning: data definition has no type or storage class
	arch/blackfin/mach-bf537/boards/stamp.c:2940: warning: type defaults to ‘int’ in declaration of ‘EXPORT_SYMBOL’
	arch/blackfin/mach-bf537/boards/stamp.c:2940: warning: parameter names (without types) in function declaration

This patch fixes it by moving the includes out of the #if protected sections.
Signed-off-by: Lars-Peter Clausen <lars@metafoo.de>
Acked-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Bob Liu <lliubbo@gmail.com>

The serial TX IRQ is not simply (RX IRQ + 1) on some Blackfin chips,
so move the values to the platform resources.
Signed-off-by: Sonic Zhang <sonic.zhang@analog.com>
Signed-off-by: Mike Frysinger <vapier@gentoo.org>
Signed-off-by: Bob Liu <lliubbo@gmail.com>

* 'rmobile-fixes-for-linus' of git://github.com/pmundt/linux-sh:
  ARM: mach-shmobile: cpuidle single/global and last_state fixes
  ARM: mach-shmobile: move helper macro PORTCR to sh_pfc.h
  ARM: mach-shmobile: move helper macro PORT_xx to sh_pfc.h
  ARM: mach-shmobile: move helper macro PORT_DATA_xx to sh_pfc.h
  ARM: mach-shmobile: ap4evb: remove white space from end of line
  ARM: mach-shmobile: clock-sh7372: remove un-necessary index
  ARM: mach-shmobile: kota2: add comment out separator
  ARM: mach-shmobile: sh73a0: add MMC data pin pull-up

* 'sh-fixes-for-linus' of git://github.com/pmundt/linux-sh:
  mailmap: Fix up some renesas attributions
  sh: clkfwk: Kill off remaining debugfs cruft.
  drivers: sh: Kill off dead pathname for runtime PM stub.
  drivers: sh: Generalize runtime PM platform stub.
  sh: Wire up process_vm syscalls.
  sh: clkfwk: add clk_rate_mult_range_round()
  serial: sh-sci: Fix up SH-2A SCIF support.
  sh: Fix cached/uncaced address calculation in 29bit mode

* git://github.com/rustyrussell/linux:
  virtio-pci: fix use after free

Commit 31a3ddda introduced
a use after free in virtio-pci. The main issue is
that the release method signals removal of the virtio device,
while remove signals removal of the pci device.

For example, on driver removal or hot-unplug,
virtio_pci_release_dev is called before virtio_pci_remove.
We then might get a crash as virtio_pci_remove tries to use the
device freed by virtio_pci_release_dev.

We allocate/free all resources together with the
pci device, so we can leave the release method empty.
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Amit Shah <amit.shah@redhat.com>
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Cc: stable@kernel.org

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
  drm/radeon/kms/combios: fix dynamic allocation of PM clock modes

After commit e978aa7d ("cpuidle: Move dev->last_residency update to
driver enter routine; remove dev->last_state") setting acpi_idle_suspend
to 1 by acpi_processor_suspend() causes the ACPI cpuidle routines to
return error codes continuously, which in turn causes cpuidle to lock up
(hard).

However, acpi_idle_suspend doesn't appear to be useful for any
particular purpose (it's racy and doesn't really provide any real
protection), so it can be removed, which makes the problem go away.
Reported-and-tested-by: Tomas M. <tmezzadra@gmail.com>
Reported-and-tested-by: Ferenc Wagner <wferi@niif.hu>
Tested-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Rafael J. Wysocki <rjw@sisk.pl>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

I missed the combios path when I updated the atombios pm code.

Reported by amarsh04 on IRC.
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>

* 'fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
  arm/imx: fix imx6q mmc error when mounting rootfs
  arm/imx: fix AUTO_ZRELADDR selection
  arm/imx: fix the references to ARCH_MX3
  ARM: mx51/53: set pwm clock parent to ipg_perclk
  arm/tegra: enable headphone detection gpio on seaboard
  arm/dt: Fix ventana SDHCI power-gpios
  arm/tegra: Don't create duplicate gpio and pinmux devices
  ARM: at91: Fix USBA gadget registration
  atmel/spi: fix missing probe
  at91/yl-9200: Fix section mismatch
  at91: vmalloc fix missing AT91_VIRT_BASE define
  ARM: at91: usart: drop static map regs for dbgu
  ARM: picoxcell: add extra temp register to addruart
  ARM: msm: fix compilation flags for MSM_SCM
  arm/mxs: fix mmc device adding for mach-mx28evk
  ARM: mxc: Remove test_for_ltirq
  ARM:i.MX: fix build error in clock-mx51-mx53.c
  ARM:i.MX: fix build error in tzic/avic.c
  ARM: mxc: fix local timer interrupt handling
  msm: boards: Fix fallout from removal of machine_desc in fixup

The variable i is removed by commit ded84337
"[CPUFREQ] db8500: remove unneeded for loop iteration over freq_table",
but current code to print available frequencies still uses the i variable.
Thus add the i variable back to fix below buld error:

  CC      drivers/cpufreq/db8500-cpufreq.o
drivers/cpufreq/db8500-cpufreq.c: In function 'db8500_cpufreq_init':
drivers/cpufreq/db8500-cpufreq.c:123: error: 'i' undeclared (first use in this function)
drivers/cpufreq/db8500-cpufreq.c:123: error: (Each undeclared identifier is reported only once
drivers/cpufreq/db8500-cpufreq.c:123: error: for each function it appears in.)
make[2]: *** [drivers/cpufreq/db8500-cpufreq.o] Error 1
make[1]: *** [drivers/cpufreq] Error 2
make: *** [drivers] Error 2

This patch also fixes using uninitialized i variable as array index.
Signed-off-by: Axel Lin <axel.lin@gmail.com>
Acked-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Dave Jones <davej@redhat.com>

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k: (29 commits)
  m68k/mac: Remove mac_irq_{en,dis}able() wrappers
  m68k/irq: Remove obsolete support for user vector interrupt fixups
  m68k/irq: Remove obsolete m68k irq framework
  m68k/q40: Convert Q40/Q60 to genirq
  m68k/sun3: Convert Sun3/3x to genirq
  m68k/sun3: Use the kstat_irqs_cpu() wrapper
  m68k/apollo: Convert Apollo to genirq
  m68k/vme: Convert VME to genirq
  m68k/hp300: Convert HP9000/300 and HP9000/400 to genirq
  m68k/mac: Optimize interrupts using chain handlers
  m68k/mac: Convert Mac to genirq
  m68k/amiga: Optimize interrupts using chain handlers
  m68k/amiga: Convert Amiga to genirq
  m68k/amiga: Refactor amiints.c
  m68k/atari: Remove code and comments about different irq types
  m68k/atari: Convert Atari to genirq
  m68k/irq: Add genirq support
  m68k/irq: Remove obsolete IRQ_FLG_* users
  m68k/irq: Rename {,__}m68k_handle_int()
  m68k/irq: Add m68k_setup_irq_controller()
  ...

* 'v4l_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
  [media] v4l2-ctrl: Send change events to all fh for auto cluster slave controls
  [media] v4l2-event: Don't set sev->fh to NULL on unsubscribe
  [media] v4l2-event: Remove pending events from fh event queue when unsubscribing
  [media] v4l2-event: Deny subscribing with a type of V4L2_EVENT_ALL
  [media] MAINTAINERS: add a maintainer for s5p-mfc driver
  [media] v4l: s5p-mfc: fix reported capabilities
  [media] media: vb2: reset queued list on REQBUFS(0) call
  [media] media: vb2: set buffer length correctly for all buffer types
  [media] media: vb2: add a check for uninitialized buffer
  [media] mxl111sf: fix build warning
  [media] mxl111sf: remove pointless if condition in mxl111sf_config_spi
  [media] mxl111sf: check for errors after mxl111sf_write_reg in mxl111sf_idac_config
  [media] mxl111sf: fix return value of mxl111sf_idac_config
  [media] uvcvideo: GET_RES should only be checked for BITMAP type menu controls

* 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc:
  powerpc/kvm: Fix build failure with HV KVM and CBE
  powerpc/ps3: Fix lv1_gpu_attribute hcall
  powerpc/ps3: Fix PS3 repository build warnings
  powerpc/ps3: irq: Remove IRQF_DISABLED
  powerpc/irq: Remove IRQF_DISABLED
  powerpc/numa: NUMA topology support for PowerNV
  powerpc: Add System RAM to /proc/iomem
  powerpc: Add KVM as module to defconfigs
  powerpc/kvm: Fix build with older toolchains
  powerpc, tqm5200: update tqm5200_defconfig to fit for charon board.
  powerpc/5200: add support for charon board

* 'rc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild:
  kbuild: Fix missing system calls check on mips.

This needed the sfi IRQ 0xFF fix to go in first. It simply plumbs in the
bma023 driver with the firmware naming of it.
Signed-off-by: William Douglas <william.douglas@intel.com>
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Real world year equals the value in vrtc YEAR register plus an offset.
We used 1960 as the offset to make leap year consistent, but for a
device's first use, its YEAR register is 0 and the system year will
be parsed as 1960 which is not a valid UNIX time and will cause many
applications to fail mysteriously. So we use 1972 instead to fix this
issue.

Updated patch which adds a sanity check suggested by Mathias

This isn't a change in behaviour for systems, because 1972 is the one we
actually use. It's the old version in upstream which is out of sync with
all devices.
Signed-off-by: Feng Tang <feng.tang@intel.com>
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Fix a build error. CE4100 with no serial errors because the alternate
function is only a prototype not a null function as intended.
Signed-off-by: Zhang Rui <rui.zhang@intel.com>
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* 'upstream-linus' of git://github.com/jgarzik/libata-dev:
  pata_of_platform: Don't use NO_IRQ
  [libata] ahci: Add ASMedia ASM1061 support
  [libata] Issue SRST to Sil3726 PMP
  sata_sis.c: trivial spelling fix
  ahci_platform: use dev_get_platdata()
  [libata] libata-scsi.c: Add function parameter documentation

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
  btrfs: rename the option to nospace_cache
  Btrfs: handle bio_add_page failure gracefully in scrub
  Btrfs: fix deadlock caused by the race between relocation
  Btrfs: only map pages if we know we need them when reading the space cache
  Btrfs: fix orphan backref nodes
  Btrfs: Abstract similar code for btrfs_block_rsv_add{, _noflush}
  Btrfs: fix unreleased path in btrfs_orphan_cleanup()
  Btrfs: fix no reserved space for writing out inode cache
  Btrfs: fix nocow when deleting the item
  Btrfs: tweak the delayed inode reservations again
  Btrfs: rework error handling in btrfs_mount()
  Btrfs: close devices on all error paths in open_ctree()
  Btrfs: avoid null dereference and leaks when bailing from open_ctree()
  Btrfs: fix subvol_name leak on error in btrfs_mount()
  Btrfs: fix memory leak in btrfs_parse_early_options()
  Btrfs: fix our reservations for updating an inode when completing io
  Btrfs: fix oops on NULL trans handle in btrfs_truncate
  btrfs: fix double-free 'tree_root' in 'btrfs_mount()'

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: usb-audio: Use kmemdup rather than duplicating its implementation
  ALSA: hda - Re-enable the check NO_PRESENCE misc bit
  ALSA: vmaster - Free slave-links when freeing the master element
  ALSA: hda - Don't add elements of other codecs to vmaster slave
  ALSA: intel8x0: improve virtual environment detection
  ALSA: intel8x0: move virtual environment detection code into one place
  ALSA: snd_usb_audio: add Logitech HD Webcam c510 to quirk-384
  ALSA: hda - fix internal mic on Dell Vostro 3500 laptop
  ALSA: HDA: Remove quirk for Toshiba T110
  ALSA: usb-audio - Fix the missing volume quirks at delayed init
  ALSA: hda - Mute unused capture sources for Realtek codecs
  ALSA: intel8x0: Improve comments for VM optimization
  ASoC: Ensure we get an impedence reported for WM8958 jack detect
  ASoC: Don't use wm8994->control_data when requesting IRQs
  ASoC: Don't use wm8994->control_data in wm8994_readable_register()
  ASoC: Update git repository URL

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux: (42 commits)
  drm/radeon/kms/pm: switch to dynamically allocating clock mode array
  drm/radeon/kms: optimize r600_pm_profile_init
  drm/radeon/kms/pm: add a proper pm profile init function for fusion
  drm/radeon/kms: remove extraneous calls to radeon_pm_compute_clocks()
  drm/exynos: added padding to be 64-bit align.
  drm: fix kconfig unmet dependency warning
  drm: add some comments to drm_wait_vblank and drm_queue_vblank_event
  drm/radeon/benchmark: signedness bug in radeon_benchmark_move()
  drm: do not sleep on vblank while holding a mutex
  MAINTAINERS: exynos: Add EXYNOS DRM maintainer entry
  drm: try to restore previous CRTC config if mode set fails
  drm/radeon/kms: make an aux failure debug only
  drm: drop select of SLOW_WORK
  drm: serialize access to list of debugfs files
  drm/radeon/kms: fix use of vram scratch page on evergreen/ni
  drm/radeon: Make sure CS mutex is held across GPU reset.
  drm: Ensure string is null terminated.
  vmwgfx: Only allow 64x64 cursors
  vmwgfx: Initialize clip rect loop correctly in surface dirty
  vmwgfx: Close screen object system
  ...

* git://github.com/herbertx/crypto:
  crypto: algapi - Fix build problem with NET disabled
  crypto: user - Fix rwsem leak in crypto_user

* 'for-linus' of git://oss.sgi.com/xfs/xfs:
  xfs: fix force shutdown handling in xfs_end_io
  xfs: constify xfs_item_ops
  xfs: Fix possible memory corruption in xfs_readlink

The following error is seen in some case when mounting rootfs from
SD/MMC cards.

  Waiting for root device /dev/mmcblk0p1...
  mmc1: host does not support reading read-only switch. assuming write-enable.
  mmc1: new high speed SDHC card at address b368
  mmcblk0: mmc1:b368 SDC   3.74 GiB
   mmcblk0: p1
  mmc1: Timeout waiting for hardware interrupt.
  mmcblk0: error -110 transferring data, sector 3678224, nr 40, cmd response 0x900, card status 0xc00
  end_request: I/O error, dev mmcblk0, sector 3678225
  Buffer I/O error on device mmcblk0p1, logical block 458754
  lost page write due to I/O error on mmcblk0p1

This patch fixes the problem by lowering the usdhc clock and correcting
watermark configuration.
Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
Cc: Chris Ball <cjb@laptop.org>
Cc: Sascha Hauer <s.hauer@pengutronix.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

The AUTO_ZRELADDR selection for ARCH_IMX_V4_V5 and ARCH_MX5 should
really be mutually exclusive to ZBOOT_ROM just like what ARCH_IMX_V6_V7
does.
Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
Cc: Sascha Hauer <s.hauer@pengutronix.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

The config symbol ARCH_MX3 has been removed by commit 'a89cf59b
arm/imx: merge i.MX3 and i.MX6', and it should not be referenced
any more.

The patch also change ARCH_MX* to SOC_IMX* for other platforms.
Signed-off-by: Shawn Guo <shawn.guo@linaro.org>
Cc: Sascha Hauer <s.hauer@pengutronix.de>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

Signed-off-by: Richard Zhao <richard.zhao@linaro.org>
Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>

Rename no_space_cache option to nospace_cache to be more consistent with
the rest, where the simple prefix 'no' is used to negate an option.

The option has been introduced during the -rc1 cycle and there are has not been
widely used, so it's safe.
Signed-off-by: David Sterba <dsterba@suse.cz>
Signed-off-by: Chris Mason <chris.mason@oracle.com>