Previously, mlx4_mt_rereg_write filled the MPT's entity_size with the
old MTT's page shift, which could result in using an incorrect offset.
Fix the initialization to be after we calculate the new MTT offset.

In addition, assign mtt order to -1 after calling mlx4_mtt_cleanup. This
is necessary in order to mark the MTT as invalid and avoid freeing it later.

Fixes: e630664c ('mlx4_core: Add helper functions to support MR re-registration')
Signed-off-by: Maor Gottlieb <maorg@mellanox.com>
Signed-off-by: Matan Barak <matanb@mellanox.com>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

If the check of adapter fails and goes into the 'else' branch, the
return value 'err' should not still be zero.
Signed-off-by: Yongjian Xu <xuyongjiande@gmail.com>
Acked-by: Shahed Shaikh <shahed.shaikh@qlogic.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Return a negative error code on failure.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@@
identifier ret; expression e1,e2;
@@
(
if (\(ret < 0\|ret != 0\))
 { ... return ret; }
|
ret = 0
)
... when != ret = e1
    when != &ret
*if(...)
{
  ... when != ret = e2
      when forall
 return ret;
}
// </smpl>
Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>

Return a negative error code on failure.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@@
identifier ret; expression e1,e2;
@@
(
if (\(ret < 0\|ret != 0\))
 { ... return ret; }
|
ret = 0
)
... when != ret = e1
    when != &ret
*if(...)
{
  ... when != ret = e2
      when forall
 return ret;
}
// </smpl>
Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>

Return a negative error code on failure.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@@
identifier ret; expression e1,e2;
@@
(
if (\(ret < 0\|ret != 0\))
 { ... return ret; }
|
ret = 0
)
... when != ret = e1
    when != &ret
*if(...)
{
  ... when != ret = e2
      when forall
 return ret;
}
// </smpl>

The patch also modifies the test of mgp->cmd to satisfy checkpatch.
Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>

Return a negative error code on failure.

A simplified version of the semantic match that finds this problem is as
follows: (http://coccinelle.lip6.fr/)

// <smpl>
@@
identifier ret; expression e1,e2;
@@
(
if (\(ret < 0\|ret != 0\))
 { ... return ret; }
|
ret = 0
)
... when != ret = e1
    when != &ret
*if(...)
{
  ... when != ret = e2
      when forall
 return ret;
}
// </smpl>
Signed-off-by: Julia Lawall <Julia.Lawall@lip6.fr>
Signed-off-by: David S. Miller <davem@davemloft.net>

Jeff Kirsher says:

====================
Intel Wired LAN Driver Updates 2014-12-31

This series contains updates to fixes for e100, igb and i40e.

John Linville fixes a typo in e100 that has been around for some time,
where an attempted revert actually inverted the test for eeprom_mdix_enabled.

Todd fixes up a code comment that should have been removed back in 2007.

Joe Perches fixes a possible memory leak in i40e which was reported by
Dan Carpenter using smatch.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>

I didn't notice that return in the code, fix it by
adding a goto out instead to free the memory.

Fixes:

> New smatch warnings:
> drivers/net/ethernet/intel/i40e/i40e_debugfs.c:832 i40e_dbg_dump_desc() warn: possible memory leak of 'ring'
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: Joe Perches <joe@perches.com>
Tested-by: Jim Young <james.m.young@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

Remove a FIXME comment that was missed in a commit on 1/2007.
Signed-off-by: Todd Fujinaka <todd.fujinaka@intel.com>
Reported-by: nick <xerofoify@gmail.com>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

Although it doesn't explicitly say so, commit 60ffa478 ("e100:
Fix MDIO/MDIO-X") appears to be intended to revert the earlier commit
64895145 ("e100: fixed e100 MDI/MDI-X issues").  However,
careful examination reveals that the attempted revert actually
_inverted_ the test for eeprom_mdix_enabled.  That is bound to program
a few PHYs incorrectly...

https://bugzilla.redhat.com/show_bug.cgi?id=1156417Signed-off-by: "John W. Linville" <linville@tuxdriver.com>
Tested-by: Aaron Brown <aaron.f.brown@intel.com>
Signed-off-by: Jeff Kirsher <jeffrey.t.kirsher@intel.com>

Pull networking fixes from David Miller:

 1) Fix double SKB free in bluetooth 6lowpan layer, from Jukka Rissanen.

 2) Fix receive checksum handling in enic driver, from Govindarajulu
    Varadarajan.

 3) Fix NAPI poll list corruption in virtio_net and caif_virtio, from
    Herbert Xu.  Also, add code to detect drivers that have this mistake
    in the future.

 4) Fix doorbell endianness handling in mlx4 driver, from Amir Vadai.

 5) Don't clobber IP6CB() before xfrm6_policy_check() is called in TCP
    input path,f rom Nicolas Dichtel.

 6) Fix MPLS action validation in openvswitch, from Pravin B Shelar.

 7) Fix double SKB free in vxlan driver, also from Pravin.

 8) When we scrub a packet, which happens when we are switching the
    context of the packet (namespace, etc.), we should reset the
    secmark.  From Thomas Graf.

 9) ->ndo_gso_check() needs to do more than return true/false, it also
    has to allow the driver to clear netdev feature bits in order for
    the caller to be able to proceed properly.  From Jesse Gross.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (62 commits)
  genetlink: A genl_bind() to an out-of-range multicast group should not WARN().
  netlink/genetlink: pass network namespace to bind/unbind
  ne2k-pci: Add pci_disable_device in error handling
  bonding: change error message to debug message in __bond_release_one()
  genetlink: pass multicast bind/unbind to families
  netlink: call unbind when releasing socket
  netlink: update listeners directly when removing socket
  genetlink: pass only network namespace to genl_has_listeners()
  netlink: rename netlink_unbind() to netlink_undo_bind()
  net: Generalize ndo_gso_check to ndo_features_check
  net: incorrect use of init_completion fixup
  neigh: remove next ptr from struct neigh_table
  net: xilinx: Remove unnecessary temac_property in the driver
  net: phy: micrel: use generic config_init for KSZ8021/KSZ8031
  net/core: Handle csum for CHECKSUM_COMPLETE VXLAN forwarding
  openvswitch: fix odd_ptr_err.cocci warnings
  Bluetooth: Fix accepting connections when not using mgmt
  Bluetooth: Fix controller configuration with HCI_QUIRK_INVALID_BDADDR
  brcmfmac: Do not crash if platform data is not populated
  ipw2200: select CFG80211_WEXT
  ...

Merge tag 'linux-kselftest-3.19-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest

Pull kselftest fix from Shuah Khan:
 "Fix exec test compile warnings"

* tag 'linux-kselftest-3.19-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
  selftests/exec: Use %zu to format size_t

Pull CIFS fixes from Steve French:
 "A set of three minor cifs fixes"

* 'for-linus' of git://git.samba.org/sfrench/cifs-2.6:
  cifs: make new inode cache when file type is different
  Fix signed/unsigned pointer warning
  Convert MessageID in smb2_hdr to LE

Pull UDF & isofs fixes from Jan Kara:
 "A couple of UDF fixes of handling of corrupted media and one iso9660
  fix of the same"

* 'for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jack/linux-fs:
  udf: Reduce repeated dereferences
  udf: Check component length before reading it
  udf: Check path length when reading symlink
  udf: Verify symlink size before loading it
  udf: Verify i_size when loading inode
  isofs: Fix unchecked printing of ER records

Pull power management and ACPI material from Rafael J Wysocki:
 "These are fixes (operating performance points library, cpufreq-dt
  driver, cpufreq core, ACPI backlight, cpupower tool), cleanups
  (cpuidle), new processor IDs for the RAPL (Running Average Power
  Limit) power capping driver, and a modification of the generic power
  domains framework allowing modular drivers to call one of its helper
  functions.

  Specifics:

   - Fix for a potential NULL pointer dereference in the cpufreq core
     due to an initialization race condition (Ethan Zhao).

   - Fixes for abuse of the OPP (Operating Performance Points) API
     related to RCU and other minor issues in the OPP library and the
     cpufreq-dt driver (Dmitry Torokhov).

   - cpuidle governors cleanup making them measure idle duration in a
     better way without using the CPUIDLE_FLAG_TIME_INVALID flag which
     allows that flag to be dropped from the ACPI cpuidle driver and
     from the core too (Len Brown).

   - New ACPI backlight blacklist entries for Samsung machines without a
     working native backlight interface that need to use the ACPI
     backlight instead (Aaron Lu).

   - New CPU IDs of future Intel Xeon CPUs for the Intel RAPL power
     capping driver (Jacob Pan).

   - Generic power domains framework modification to export the
     of_genpd_get_from_provider() function to modular drivers that will
     allow future driver modifications to be based on the mainline (Amit
     Daniel Kachhap).

   - Two fixes for the cpupower tool (Michal Privoznik, Prarit
     Bhargava)"

* tag 'pm+acpi-3.19-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  ACPI / video: Add some Samsung models to disable_native_backlight list
  tools / cpupower: Fix no idle state information return value
  tools / cpupower: Correctly detect if running as root
  cpufreq: fix a NULL pointer dereference in __cpufreq_governor()
  cpufreq-dt: defer probing if OPP table is not ready
  PM / OPP: take RCU lock in dev_pm_opp_get_opp_count
  PM / OPP: fix warning in of_free_opp_table()
  PM / OPP: add some lockdep annotations
  powercap / RAPL: add IDs for future Xeon CPUs
  PM / Domains: Export of_genpd_get_from_provider function
  cpuidle / ACPI: remove unused CPUIDLE_FLAG_TIME_INVALID
  cpuidle: ladder: Better idle duration measurement without using CPUIDLE_FLAG_TIME_INVALID
  cpuidle: menu: Better idle duration measurement without using CPUIDLE_FLAG_TIME_INVALID

Users can request to bind to arbitrary multicast groups, so warning
when the requested group number is out of range is not appropriate.

And with the warning removed, and the 'err' variable properly given
an initial value, we can remove 'found' altogether.
Reported-by: Sedat Dilek <sedat.dilek@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Pull spi fixes from Mark Brown:
 "A few driver specific fixes here, the DMA burst size increase in the
  spfi driver is a fix to make the hardware happier in some situations"

* tag 'spi-v3.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/spi:
  spi: img-spfi: Increase DMA burst size
  spi: img-spfi: Enable controller before starting TX DMA
  spi: sh-msiof: Add runtime PM lock in initializing

Pull one regulator fix from Mark Brown:
 "One fix here, a fix for the voltage mapping on one of the s2mps11
  regulators which broke systems using it including apparently the
  Gear 2 smartwatches"

* tag 'regulator-v3.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/broonie/regulator:
  regulator: s2mps11: Fix dw_mmc failure on Gear 2

Pull one MMC fix from Ulf Hansson:
 "MMC core:

   - Fix selection of buswidth for mmc hosts supporting 1-bit only"

* tag 'mmc-v3.19-2' of git://git.linaro.org/people/ulf.hansson/mmc:
  mmc: core: stop trying to switch width when only one bit is supported

Pull thermal management updates from Zhang Rui:
 "First of all, the most important change is the thermal cpu cooling
  fixes.  The major fix here is to have proper sequencing between
  cpufreq layer and thermal cpu cooling registration.  A take away of
  this fix is an improvement in the thermal drivers code.  Thermal
  drivers that require cpu cooling do not need to check for cpufreq
  layer.  The requirement now is to propagate the error code, if any,
  while registering cpu cooling device.  Thanks to Viresh for
  implementing the required CPUfreq changes.

  Second, a new driver is introduced for int340x processor thermal
  device.  Given that int340x thermal is disabled by default, and this
  processor thermal device is only available on limited platforms, plus
  the driver does nothing but exposes some thermal limitation
  information for user space to use, thus I think it is safe to include
  it in this pull request after missing 3.19-rc2.

  Specifics:

   - Thermal cpu cooling fixes and cleanups.

   - introduce INT340X processor thermal reporting device driver.

   - several small fixes and cleanups for int340x thermal drivers"

* 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux: (43 commits)
  Thermal/int340x/int3403: Free acpi notification handler
  Thermal/int340x/processor_thermal: Fix memory leak
  Thermal/int340x/int3403: Fix memory leak
  thermal: int340x: Introduce processor reporting device
  thermal: int340x_thermal: drop owner assignment from platform_drivers
  thermal: drop owner assignment from platform_drivers
  thermal: cpu_cooling: document node in struct cpufreq_cooling_device
  thermal/powerclamp: add ids for future xeon cpus
  Thermal/int340x: Handle properly the case when _trt or _art acpi entry is missing
  thermal: cpu_cooling: return ERR_PTR() for !CPU_THERMAL or !THERMAL_OF
  thermal: cpu_cooling: small memory leak on error
  thermal: ti-soc-thermal: Do not print error message in the EPROBE_DEFER case
  thermal: db8500: Do not print error message in the EPROBE_DEFER case
  thermal: imx: Do not print error message in the EPROBE_DEFER case
  thermal: Fix cdev registration with THERMAL_NO_LIMIT on 64bit
  drivers: thermal: Remove ARCH_HAS_BANDGAP dependency for samsung
  thermal:core:fix: Check return code of the ->get_max_state() callback
  thermal: cpu_cooling: update copyright tags
  thermal: cpu_cooling: Use cpufreq_dev->freq_table for finding level/freq
  thermal: cpu_cooling: Store frequencies in descending order
  ...

Commit 2457aec6 ("mm: non-atomically mark page accessed during page
cache allocation where possible") has added a separate parameter for
specifying gfp mask for radix tree allocations.

Not only this is less than optimal from the API point of view because it
is error prone, it is also buggy currently because
grab_cache_page_write_begin is using GFP_KERNEL for radix tree and if
fgp_flags doesn't contain FGP_NOFS (mostly controlled by fs by
AOP_FLAG_NOFS flag) but the mapping_gfp_mask has __GFP_FS cleared then
the radix tree allocation wouldn't obey the restriction and might
recurse into filesystem and cause deadlocks.  This is the case for most
filesystems unfortunately because only ext4 and gfs2 are using
AOP_FLAG_NOFS.

Let's simply remove radix_gfp_mask parameter because the allocation
context is same for both page cache and for the radix tree.  Just make
sure that the radix tree gets only the sane subset of the mask (e.g.  do
not pass __GFP_WRITE).

Long term it is more preferable to convert remaining users of
AOP_FLAG_NOFS to use mapping_gfp_mask instead and simplify this
interface even further.
Reported-by: Dave Chinner <david@fromorbit.com>
Signed-off-by: Michal Hocko <mhocko@suse.cz>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

* acpi-video:
  ACPI / video: Add some Samsung models to disable_native_backlight list

* pm-domains:
  PM / Domains: Export of_genpd_get_from_provider function

* powercap:
  powercap / RAPL: add IDs for future Xeon CPUs

* pm-tools:
  tools / cpupower: Fix no idle state information return value
  tools / cpupower: Correctly detect if running as root

* pm-cpufreq:
  cpufreq: fix a NULL pointer dereference in __cpufreq_governor()
  cpufreq-dt: defer probing if OPP table is not ready

* pm-cpuidle:
  cpuidle / ACPI: remove unused CPUIDLE_FLAG_TIME_INVALID
  cpuidle: ladder: Better idle duration measurement without using CPUIDLE_FLAG_TIME_INVALID
  cpuidle: menu: Better idle duration measurement without using CPUIDLE_FLAG_TIME_INVALID

* pm-opp:
  PM / OPP: take RCU lock in dev_pm_opp_get_opp_count
  PM / OPP: fix warning in of_free_opp_table()
  PM / OPP: add some lockdep annotations

mmc_select_bus_width() will try to switch to MMC_BUS_WIDTH_4 even if
MMC_CAP_4_BIT_DATA and MMC_CAP_8_BIT_DATA are not set in host->caps.
Return as soon as possible when those flags are not set

Fixes: 577fb131 (mmc: rework selection of bus speed mode)
Signed-off-by: Alexandre Belloni <alexandre.belloni@free-electrons.com>
Cc: <stable@vger.kernel.org> # 3.17
Signed-off-by: Ulf Hansson <ulf.hansson@linaro.org>

Pull KVM fixes from Paolo Bonzini:
 "The important fixes are for two bugs introduced by the merge window.

  On top of this, add a couple of WARN_ONs and stop spamming dmesg on
  pretty much every boot of a virtual machine"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  kvm: warn on more invariant breakage
  kvm: fix sorting of memslots with base_gfn == 0
  kvm: x86: drop severity of "generation wraparound" message
  kvm: x86: vmx: reorder some msr writing

Pull vfs fix from Al Viro:
 "An embarrassing bug in lustre patches from this cycle ;-/"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  [regression] braino in "lustre: use is_root_inode()"

Modifying a non-existent slot is not allowed.  Also check that the
first loop doesn't move a deleted slot beyond the used part of
the mslots array.
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Before commit 0e60b079 (kvm: change memslot sorting rule from size
to GFN, 2014-12-01), the memslots' sorting key was npages, meaning
that a valid memslot couldn't have its sorting key equal to zero.
On the other hand, a valid memslot can have base_gfn == 0, and invalid
memslots are identified by base_gfn == npages == 0.

Because of this, commit 0e60b079 broke the invariant that invalid
memslots are at the end of the mslots array.  When a memslot with
base_gfn == 0 was created, any invalid memslot before it were left
in place.

This can be fixed by changing the insertion to use a ">=" comparison
instead of "<=", but some care is needed to avoid breaking the case
of deleting a memslot; see the comment in update_memslots.

Thanks to Tiejun Chen for posting an initial patch for this bug.
Reported-by: Jamie Heilman <jamie@audible.transient.net>
Reported-by: Andy Lutomirski <luto@amacapital.net>
Tested-by: Jamie Heilman <jamie@audible.transient.net>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Pull sound fixes from Takashi Iwai:
 "Just a couple of fixes for the new Intel Skylake HD-audio support"

* tag 'sound-3.19-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: hda_intel: apply the Seperate stream_tag for Skylake
  ALSA: hda_controller: Separate stream_tag for input and output streams.

Since most virtual machines raise this message once, it is a bit annoying.
Make it KERN_DEBUG severity.

Cc: stable@vger.kernel.org
Fixes: 7a2e8aafSigned-off-by: Paolo Bonzini <pbonzini@redhat.com>

The commit 34a1cd60, "x86: vmx: move some vmx setting from
vmx_init() to hardware_setup()", tried to refactor some codes
specific to vmx hardware setting into hardware_setup(), but some
msr writing should depend on our previous setting condition like
enable_apicv, enable_ept and so on.
Reported-by: Jamie Heilman <jamie@audible.transient.net>
Tested-by: Jamie Heilman <jamie@audible.transient.net>
Signed-off-by: Tiejun Chen <tiejun.chen@intel.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Netlink families can exist in multiple namespaces, and for the most
part multicast subscriptions are per network namespace. Thus it only
makes sense to have bind/unbind notifications per network namespace.

To achieve this, pass the network namespace of a given client socket
to the bind/unbind functions.

Also do this in generic netlink, and there also make sure that any
bind for multicast groups that only exist in init_net is rejected.
This isn't really a problem if it is accepted since a client in a
different namespace will never receive any notifications from such
a group, but it can confuse the family if not rejected (it's also
possible to silently (without telling the family) accept it, but it
would also have to be ignored on unbind so families that take any
kind of action on bind/unbind won't do unnecessary work for invalid
clients like that.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

For linux-3.18.0
The driver lacks pci_disable_device in error handling code of
ne2k_pci_init_one, so the device enabled by pci_enable_device is not
disabled when errors occur.
This patch fixes this problem.
Signed-off-by: Jia-Ju Bai <baijiaju1990@163.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

In __bond_release_one(), when the interface is not a slave or not a slave of
"this" master, it log error message.

The message actually should be a debug message matching what bond_enslave()
does.
Signed-off-by: Wengang Wang <wen.gang.wang@oracle.com>
Acked-by: Ding Tianhong <dingtianhong@huawei.com>
Signed-off-by: Andy Gospodarek <gospo@cumulusnetworks.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Johannes Berg says:

====================
netlink/genetlink cleanups & multicast improvements

I'm looking at using the multicast group functionality in a way that would
benefit from knowing when there are subscribers to avoid collecting the
required data when there aren't any. During this I noticed that the unbind
for multicast groups doesn't actually work - it's never called when sockets
are closed. Luckily, nobody actually uses the functionality.

While looking at the code trying to find why it's not called and where the
multicast listeners are actually removed, I found the potential cleanup in
patch 3. Patch 2 also has a cleanup for a generic netlink API in this area.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>

In order to make the newly fixed multicast bind/unbind
functionality in generic netlink, pass them down to the
appropriate family.
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Currently, netlink_unbind() is only called when the socket
explicitly unbinds, which limits its usefulness (luckily
there are no users of it yet anyway.)

Call netlink_unbind() also when a socket is released, so it
becomes possible to track listeners with this callback and
without also implementing a netlink notifier (and checking
netlink_has_listeners() in there.)
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>