The of_node_put() function tests whether its argument is NULL and then
returns immediately. Thus the test around the call is not needed.

This issue was detected by using the Coccinelle software.
Signed-off-by: Markus Elfring <elfring@users.sourceforge.net>
Signed-off-by: Grant Likely <grant.likely@linaro.org>

The ->next pointer in struct device_node is a hanger-on from when it was
used to iterate over the whole tree by a particular device_type property
value. Those days are long over, but the fdt unflattening code still
uses it to put nodes in the unflattened tree into the same order as node
in the flat tree. By reworking the unflattening code to reverse the list
after unflattening all the children of a node, the pointer can be
dropped which gives a small amount of memory savings.
Signed-off-by: Grant Likely <grant.likely@linaro.org>
Acked-by: Frank Rowand <frank.rowand@sonymobile.com>
Cc: Gaurav Minocha <gaurav.minocha.os@gmail.com>

Since commit ce79d54a ("spi/of: Add OF notifier handler") the
following warning is seen on a imx53 system that has CONFIG_OF_DYNAMIC=n:

[    0.048119] ------------[ cut here ]------------
[    0.048146] WARNING: CPU: 0 PID: 1 at drivers/spi/spi.c:2419 spi_init+0x60/0xa8()
[    0.048158] Modules linked in:
[    0.048183] CPU: 0 PID: 1 Comm: swapper/0 Not tainted 3.18.0-rc6-next-20141126-00003-g9388e85 #2080
[    0.048193] Hardware name: Freescale i.MX53 (Device Tree Support)
[    0.048203] Backtrace:
[    0.048235] [<80011f74>] (dump_backtrace) from [<80012110>] (show_stack+0x18/0x1c)
[    0.048246]  r6:00000973 r5:00000000 r4:00000000 r3:00000000
[    0.048284] [<800120f8>] (show_stack) from [<806b3ad8>] (dump_stack+0x88/0xa4)
[    0.048312] [<806b3a50>] (dump_stack) from [<8002a55c>] (warn_slowpath_common+0x80/0xbc)
[    0.048320]  r5:8096cfcc r4:00000000
[    0.048343] [<8002a4dc>] (warn_slowpath_common) from [<8002a5bc>] (warn_slowpath_null+0x24/0x2c)
[    0.048354]  r8:8096cf6c r7:809355ec r6:ddcd7c00 r5:812029e4 r4:00000000
[    0.048389] [<8002a598>] (warn_slowpath_null) from [<8096cfcc>] (spi_init+0x60/0xa8)
[    0.048405] [<8096cf6c>] (spi_init) from [<80008a7c>] (do_one_initcall+0x88/0x1e0)
[    0.048415]  r5:8099e018 r4:8099e018
[    0.048438] [<800089f4>] (do_one_initcall) from [<80935e38>] (kernel_init_freeable+0x110/0x1e0)
[    0.048448]  r10:80980700 r9:809806e4 r8:000000cc r7:809355ec r6:809f8940 r5:00000002
[    0.048478]  r4:8098d744
[    0.048508] [<80935d28>] (kernel_init_freeable) from [<806ae574>] (kernel_init+0x10/0xf4)
[    0.048517]  r10:00000000 r9:00000000 r8:00000000 r7:00000000 r6:00000000 r5:806ae564
[    0.048547]  r4:00000000
[    0.048565] [<806ae564>] (kernel_init) from [<8000ed68>] (ret_from_fork+0x14/0x2c)
[    0.048574]  r4:00000000 r3:00000000
[    0.048616] ---[ end trace 405a65d177dae4fd ]---

Only check of_reconfig_notifier_register() in the CONFIG_OF_DYNAMIC=y case,
as intended by commit ce79d54a.
Signed-off-by: Fabio Estevam <fabio.estevam@freescale.com>
Signed-off-by: Grant Likely <grant.likely@linaro.org>

Support specifying console options (like with console=ttyXN,<options>)
by appending them to the stdout-path property after a separating ':'.

Example:
        stdout-path = "uart0:115200";
Signed-off-by: Leif Lindholm <leif.lindholm@linaro.org>
[grant.likely: minor rework to shorten the diffstat]
Signed-off-by: Grant Likely <grant.likely@linaro.org>

Update of_find_node_by_path():
1) Rename function to of_find_node_opts_by_path(), adding an optional
   pointer argument. Provide a static inline wrapper version of
   of_find_node_by_path() which calls the new function with NULL as
   the optional argument.
2) Ignore any part of the path beyond and including the ':' separator.
3) Set the new provided pointer argument to the beginning of the string
   following the ':' separator.
4: Add tests.
Signed-off-by: Leif Lindholm <leif.lindholm@linaro.org>
Signed-off-by: Grant Likely <grant.likely@linaro.org>

Add a global binding for the chosen node.  Include a description of the
stdout-path, and an explicit statement on its extra options in the
context of a UART console.

Opening description stolen from www.devicetree.org, and part of the
remaining text provided by Mark Rutland.
Signed-off-by: Leif Lindholm <leif.lindholm@linaro.org>
[grant.likely: remove reference to uart_parse_options]
Reviewed-by: Mark Rutland <mark.rutland@arm.com>
Signed-off-by: Grant Likely <grant.likely@linaro.org>

The unittest code has a MODULE_DEVICE_TABLE that isn't needed by any of
the unittests, and isn't even correct. Remove it.
Signed-off-by: Grant Likely <grant.likely@linaro.org>
Cc: Pantelis Antoniou <pantelis.antoniou@konsulko.com>

Make the map match the reality, the current binding text is
nonsense:

- The clock required for the clocking of the serial port
  must come first and is not optional (as the driver will
  otherwise proceed to grab and use the apb_pclk as uartclk),
  and the apb_pclk that clocks the logic must come second
  as the code will retrieve the first clock by index,
  whereas the PrimeCell but will explicitly look for
  "apb_pclk" so this can be specified later, as it is
  looked up by name.

- The pin control state "default" is the only mandated
  state, the sleep state is entirely optional.

We also add an example to avoid further confusion.
Reported-by: Arnd Bergmann <arnd@arndb.de>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
Signed-off-by: Grant Likely <grant.likely@linaro.org>

It referenced of_property_read_string_util whereas the function name
is of_property_read_string_helper.

Introduced in a87fa1d8 (of: Fix
overflow bug in string property parsing functions). Found out when
reviewing the stable 3.12 queue.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Signed-off-by: Grant Likely <grant.likely@linaro.org>

The OF_OVERLAY option selects OF_DEVICE, but OF_DEVICE was removed in
commit ba166e90, "of: remove CONFIG_OF_DEVICE". Remove the unnecessary
select.
Signed-off-by: Grant Likely <grant.likely@linaro.org>
Reported-by: Paul Bolle <pebolle@tiscali.nl>
Cc: Pantelis Antoniou <pantelis.antoniou@konsulko.com>

Add OF notifier handler needed for creating/destroying spi devices
according to dynamic runtime changes in the DT live tree. This code is
enabled when CONFIG_OF_DYNAMIC is selected.
Signed-off-by: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
Signed-off-by: Grant Likely <grant.likely@linaro.org>
Reviewed-by: Mark Brown <broonie@kernel.org>
Cc: <linux-spi@vger.kernel.org>

Dynamically inserting spi device nodes requires the use of a single
device registration method. Refactor the existing
of_register_spi_devices() to split out the core functionality for a
single device into a separate function; of_register_spi_device(). This
function will be used by the OF_DYNAMIC overlay code to make live
modifications to the tree.

Methods to lookup a device/master using a device node are added
as well, of_find_spi_master_by_node() & of_find_spi_device_by_node().
Signed-off-by: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
[grant.likely] Split patch into two pieces for clarity
Signed-off-by: Grant Likely <grant.likely@linaro.org>
Reviewed-by: Mark Brown <broonie@kernel.org>
Cc: <linux-spi@vger.kernel.org>

CONFIG_OF_DYNAMIC enables runtime changes to the device tree which in
turn may trigger addition or removal of devices from Linux. Add an
OF_RECONFIG notifier handler to receive tree change events and to
creating or destroy i2c devices as required.
Signed-off-by: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
[grant.likely: clean up #ifdefs and drop unneeded error handling]
Signed-off-by: Grant Likely <grant.likely@linaro.org>
Reviewed-by: Wolfram Sang <wsa@the-dreams.de>
Cc: Rob Herring <robh+dt@kernel.org>
Cc: linux-i2c@vger.kernel.org

Dynamically inserting i2c client device nodes requires the use
of a single device registration method. Factor out the loop body of
of_i2c_register_devices() so that it can be called for individual
device_nodes instead of for all the children of a node.

Note: The diff of this commit looks far more complicated than it
actually is due the indentation being changed for a large block of code.
When viewed using the diff -w flag to ignore whitespace changes it can
be seen that the change is actually quite simple.
Signed-off-by: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
[grant.likely: Made new function static and removed changes to header]
Signed-off-by: Grant Likely <grant.likely@linaro.org>
Reviewed-by: Wolfram Sang <wsa@the-dreams.de>
Cc: Rob Herring <robh+dt@kernel.org>
Cc: linux-i2c@vger.kernel.org

Add unittests for OF overlays.

It tests overlay device addition/removal and whether
the apply revert sequence is correct.

Changes since V1:
* Added local fixups entries.
Signed-off-by: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
Signed-off-by: Grant Likely <grant.likely@linaro.org>

Overlays are a method to dynamically modify part of the kernel's
device tree with dynamically loaded data. Add the core functionality to
parse, apply and remove an overlay changeset. The core functionality
takes care of managing the overlay data format and performing the add
and remove. Drivers are expected to use the overlay functionality to
support custom expansion busses commonly found on consumer development
boards like the BeagleBone or Raspberry Pi.

The overlay code uses CONFIG_OF_DYNAMIC changesets to perform the low
level work of modifying the devicetree.

Documentation about internal and APIs is provided in
	Documentation/devicetree/overlay-notes.txt

v2:
- Switch from __of_node_alloc() to __of_node_dup()
- Documentation fixups
- Remove 2-pass processing of properties
- Remove separate ov_lock; just use the DT mutex.
v1:
- Drop delete capability using '-' prefix. The '-' prefixed names
are valid properties and nodes and there is no need for it just yet.
- Do not update special properties - name & phandle ones.
- Change order of node attachment, so that the special property update
works.
Signed-off-by: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
Signed-off-by: Grant Likely <grant.likely@linaro.org>

Add OF notifier handler needed for creating/destroying platform devices
according to dynamic runtime changes in the DT live tree.
Signed-off-by: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
Signed-off-by: Grant Likely <grant.likely@linaro.org>

The OF_RECONFIG notifier callback uses a different structure depending
on whether it is a node change or a property change. This is silly, and
not very safe. Rework the code to use the same data structure regardless
of the type of notifier.
Signed-off-by: Grant Likely <grant.likely@linaro.org>
Cc: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Cc: Rob Herring <robh+dt@kernel.org>
Cc: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
Cc: <linuxppc-dev@lists.ozlabs.org>

Add some additional debug output to cover OF_RECONFIG notifier activity.
At the same time, refactor the changeset debug output to use the same
strings as the notifier debug output.
Signed-off-by: Grant Likely <grant.likely@linaro.org>

To simplify subsystem setup code, make empty stubs for the
of_reconfig_*() methods. This is particularly useful for registering and
unregistering the notifiers so that it doesn't impact the flow of the
subsystem setup code.
Signed-off-by: Grant Likely <grant.likely@linaro.org>

Introduce of_reconfig_get_state_change() which allows an of notifier
to query about device state changes.
Signed-off-by: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
Signed-off-by: Grant Likely <grant.likely@linaro.org>

The original resolver format is way too cryptic, switch
to using a tree based format that gets rid of repetitions,
is more compact and readable.

At the same time, update the selftests to using the new local fixups
format.
Signed-off-by: Pantelis Antoniou <pantelis.antoniou@konsulko.com>
[grant.likely: Squashed in testcase changes and merged similar functions]
Signed-off-by: Grant Likely <grant.likely@linaro.org>

Add a node argument to __of_node_alloc() and rename it to
__of_node_dup() so that it can also be used to duplicate a node with
its properties. This is important for the overlay code so that it can
create new nodes without using separate changeset items for every single
property.

At the same time rework the overlay code to use the new function and
drop the extra changeset items.
Signed-off-by: Grant Likely <grant.likely@linaro.org>

The overlay code needs to construct a new full_name from the parent name
and the node name, but the current method has to allocate and then free
an temporary string which is wasteful. Fix this problem by using vargs
to pass in a format and arguments into __of_node_alloc().

At the same time remove the allocflags argument to __of_node_alloc().
The only users all use GFP_KERNEL, so there is no need to provide it as
an option. If there is ever a need later it can be added back.
Signed-off-by: Grant Likely <grant.likely@linaro.org>

v3.18-rc6 contains an important DT bug fix, c1a2086e, "of/selftest:
Fix off-by-one error in removal path" which affects testing of the
overlay patch series. Merge it into the devicetree/next staging branch
so that the overlay patches are applied on top of a known working tree.

Linux 3.18-rc6

Conflicts:
	drivers/of/address.c

x86 call do_notify_resume on paranoid returns if TIF_UPROBE is set but
not on non-paranoid returns.  I suspect that this is a mistake and that
the code only works because int3 is paranoid.

Setting _TIF_NOTIFY_RESUME in the uprobe code was probably a workaround
for the x86 bug.  With that bug fixed, we can remove _TIF_NOTIFY_RESUME
from the uprobes code.
Reported-by: Oleg Nesterov <oleg@redhat.com>
Acked-by: Srikar Dronamraju <srikar@linux.vnet.ibm.com>
Acked-by: Borislav Petkov <bp@suse.de>
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Chris bisected a NULL pointer deference in task_sched_runtime() to
commit 6e998916 'sched/cputime: Fix clock_nanosleep()/clock_gettime()
inconsistency'.

Chris observed crashes in atop or other /proc walking programs when he
started fork bombs on his machine.  He assumed that this is a new exit
race, but that does not make any sense when looking at that commit.

What's interesting is that, the commit provides update_curr callbacks
for all scheduling classes except stop_task and idle_task.

While nothing can ever hit that via the clock_nanosleep() and
clock_gettime() interfaces, which have been the target of the commit in
question, the author obviously forgot that there are other code paths
which invoke task_sched_runtime()

do_task_stat(()
 thread_group_cputime_adjusted()
   thread_group_cputime()
     task_cputime()
       task_sched_runtime()
        if (task_current(rq, p) && task_on_rq_queued(p)) {
          update_rq_clock(rq);
          up->sched_class->update_curr(rq);
        }

If the stats are read for a stomp machine task, aka 'migration/N' and
that task is current on its cpu, this will happily call the NULL pointer
of stop_task->update_curr.  Ooops.

Chris observation that this happens faster when he runs the fork bomb
makes sense as the fork bomb will kick migration threads more often so
the probability to hit the issue will increase.

Add the missing update_curr callbacks to the scheduler classes stop_task
and idle_task.  While idle tasks cannot be monitored via /proc we have
other means to hit the idle case.

Fixes: 6e998916 'sched/cputime: Fix clock_nanosleep()/clock_gettime() inconsistency'
Reported-by: Chris Mason <clm@fb.com>
Reported-and-tested-by: Borislav Petkov <bp@alien8.de>
Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
Cc: Ingo Molnar <mingo@kernel.org>
Cc: Stanislaw Gruszka <sgruszka@redhat.com>
Cc: Peter Zijlstra <peterz@infradead.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Merge x86-64 iret fixes from Andy Lutomirski:
 "This addresses the following issues:

   - an unrecoverable double-fault triggerable with modify_ldt.
   - invalid stack usage in espfix64 failed IRET recovery from IST
     context.
   - invalid stack usage in non-espfix64 failed IRET recovery from IST
     context.

  It also makes a good but IMO scary change: non-espfix64 failed IRET
  will now report the correct error.  Hopefully nothing depended on the
  old incorrect behavior, but maybe Wine will get confused in some
  obscure corner case"

* emailed patches from Andy Lutomirski <luto@amacapital.net>:
  x86_64, traps: Rework bad_iret
  x86_64, traps: Stop using IST for #SS
  x86_64, traps: Fix the espfix64 #DF fixup and rewrite it in C

It's possible for iretq to userspace to fail.  This can happen because
of a bad CS, SS, or RIP.

Historically, we've handled it by fixing up an exception from iretq to
land at bad_iret, which pretends that the failed iret frame was really
the hardware part of #GP(0) from userspace.  To make this work, there's
an extra fixup to fudge the gs base into a usable state.

This is suboptimal because it loses the original exception.  It's also
buggy because there's no guarantee that we were on the kernel stack to
begin with.  For example, if the failing iret happened on return from an
NMI, then we'll end up executing general_protection on the NMI stack.
This is bad for several reasons, the most immediate of which is that
general_protection, as a non-paranoid idtentry, will try to deliver
signals and/or schedule from the wrong stack.

This patch throws out bad_iret entirely.  As a replacement, it augments
the existing swapgs fudge into a full-blown iret fixup, mostly written
in C.  It's should be clearer and more correct.
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

On a 32-bit kernel, this has no effect, since there are no IST stacks.

On a 64-bit kernel, #SS can only happen in user code, on a failed iret
to user space, a canonical violation on access via RSP or RBP, or a
genuine stack segment violation in 32-bit kernel code.  The first two
cases don't need IST, and the latter two cases are unlikely fatal bugs,
and promoting them to double faults would be fine.

This fixes a bug in which the espfix64 code mishandles a stack segment
violation.

This saves 4k of memory per CPU and a tiny bit of code.
Signed-off-by: Andy Lutomirski <luto@amacapital.net>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

There's nothing special enough about the espfix64 double fault fixup to
justify writing it in assembly.  Move it to C.

This also fixes a bug: if the double fault came from an IST stack, the
old asm code would return to a partially uninitialized stack frame.

Fixes: 3891a04aSigned-off-by: Andy Lutomirski <luto@amacapital.net>
Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
Cc: stable@vger.kernel.org
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Pull ARM SoC fixes from Olof Johansson:
 "A collection of fixes this week:

   - A set of clock fixes for shmobile platforms
   - A fix for tegra that moves serial port labels to be per board.
     We're choosing to merge this for 3.18 because the labels will start
     being parsed in 3.19, and without this change serial port numbers
     that used to be stable since the dawn of time will change numbers.
   - A few other DT tweaks for Tegra.
   - A fix for multi_v7_defconfig that makes it stop spewing cpufreq
     errors on Arndale (Exynos)"

* tag 'armsoc-for-rc6' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
  ARM: multi_v7_defconfig: fix failure setting CPU voltage by enabling dependent I2C controller
  ARM: tegra: roth: Fix SD card VDD_IO regulator
  ARM: tegra: Remove eMMC vmmc property for roth/tn7
  ARM: dts: tegra: move serial aliases to per-board
  ARM: tegra: Add serial port labels to Tegra124 DT
  ARM: shmobile: kzm9g legacy: Set i2c clks_per_count to 2
  ARM: shmobile: r8a7740 dtsi: Correct IIC0 parent clock
  ARM: shmobile: r8a7790: Fix SD3CKCR address to device tree
  ARM: shmobile: r8a7740 legacy: Correct IIC0 parent clock
  ARM: shmobile: r8a7740 legacy: Add missing INTCA clock for irqpin module
  ARM: shmobile: r8a7790: Fix SD3CKCR address
  ARM: dts: sun6i: Re-parent ahb1_mux to pll6 as required by dma controller

Pull percpu fix from Tejun Heo:
 "This contains one patch to fix a race condition which can lead to
  percpu_ref using a percpu pointer which is corrupted with a set DEAD
  bit.  The bug was introduced while separating out the ATOMIC mode flag
  from the DEAD flag.  The fix is pretty straight forward.

  I just committed the patch to the percpu tree but am sending out the
  pull request early as I'll be on vacation for a week.  The patch
  should be fairly safe and while the latency will be higher I'll be
  checking emails"

* 'for-3.18-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/percpu:
  percpu-ref: fix DEAD flag contamination of percpu pointer

Pull btrfs deadlock fix from Chris Mason:
 "This has a fix for a long standing deadlock that we've been trying to
  nail down for a while.  It ended up being a bad interaction with the
  fair reader/writer locks and the order btrfs reacquires locks in the
  btree"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
  btrfs: fix lockups from btrfs_clear_path_blocking

While decoupling ATOMIC and DEAD flags, f47ad457 ("percpu_ref:
decouple switching to percpu mode and reinit") updated
__ref_is_percpu() so that it only tests ATOMIC flag to determine
whether the ref is in percpu mode or not; however, while DEAD implies
ATOMIC, the two flags are set separately during percpu_ref_kill() and
if __ref_is_percpu() races percpu_ref_kill(), it may see DEAD w/o
ATOMIC.  Because __ref_is_percpu() returns @ref->percpu_count_ptr
value verbatim as the percpu pointer after testing ATOMIC, the pointer
may now be contaminated with the DEAD flag.

This can be fixed by clearing the flag bits before returning the
pointer which was the fix proposed by Shaohua; however, as DEAD
implies ATOMIC, we can just test for both flags at once and avoid the
explicit masking.

Update __ref_is_percpu() so that it tests that both ATOMIC and DEAD
are clear before returning @ref->percpu_count_ptr as the percpu
pointer.
Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-and-Reviewed-by: Shaohua Li <shli@kernel.org>
Link: http://lkml.kernel.org/r/995deb699f5b873c45d667df4add3b06f73c2c25.1416638887.git.shli@kernel.org
Fixes: f47ad457 ("percpu_ref: decouple switching to percpu mode and reinit")

Pull timer fix from Thomas Gleixner:
 "A single bugfix for an init order problem in the sun4i subarch
  clockevents code"

* 'timers-urgent-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  clockevent: sun4i: Fix race condition in the probe code

Pull vfs fixes from Al Viro:
 "Assorted fixes, most in overlayfs land"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/viro/vfs:
  ovl: ovl_dir_fsync() cleanup
  ovl: update MAINTAINERS
  ovl: pass dentry into ovl_dir_read_merged()
  ovl: use lockless_dereference() for upperdentry
  ovl: allow filenames with comma
  ovl: fix race in private xattr checks
  ovl: fix remove/copy-up race
  ovl: rename filesystem type to "overlay"
  isofs: avoid unused function warning
  vfs: fix reference leak in d_prune_aliases()

Pull networking fixes from David Miller:

 1) Fix BUG when decrypting empty packets in mac80211, from Ronald Wahl.

 2) nf_nat_range is not fully initialized and this is copied back to
    userspace, from Daniel Borkmann.

 3) Fix read past end of b uffer in netfilter ipset, also from Dan
    Carpenter.

 4) Signed integer overflow in ipv4 address mask creation helper
    inet_make_mask(), from Vincent BENAYOUN.

 5) VXLAN, be2net, mlx4_en, and qlcnic need ->ndo_gso_check() methods to
    properly describe the device's capabilities, from Joe Stringer.

 6) Fix memory leaks and checksum miscalculations in openvswitch, from
    Pravin B SHelar and Jesse Gross.

 7) FIB rules passes back ambiguous error code for unreachable routes,
    making behavior confusing for userspace.  Fix from Panu Matilainen.

 8) ieee802154fake_probe() doesn't release resources properly on error,
    from Alexey Khoroshilov.

 9) Fix skb_over_panic in add_grhead(), from Daniel Borkmann.

10) Fix access of stale slave pointers in bonding code, from Nikolay
    Aleksandrov.

11) Fix stack info leak in PPP pptp code, from Mathias Krause.

12) Cure locking bug in IPX stack, from Jiri Bohac.

13) Revert SKB fclone memory freeing optimization that is racey and can
    allow accesses to freed up memory, from Eric Dumazet.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (71 commits)
  tcp: Restore RFC5961-compliant behavior for SYN packets
  net: Revert "net: avoid one atomic operation in skb_clone()"
  virtio-net: validate features during probe
  cxgb4 : Fix DCB priority groups being returned in wrong order
  ipx: fix locking regression in ipx_sendmsg and ipx_recvmsg
  openvswitch: Don't validate IPv6 label masks.
  pptp: fix stack info leak in pptp_getname()
  brcmfmac: don't include linux/unaligned/access_ok.h
  cxgb4i : Don't block unload/cxgb4 unload when remote closes TCP connection
  ipv6: delete protocol and unregister rtnetlink when cleanup
  net/mlx4_en: Add VXLAN ndo calls to the PF net device ops too
  bonding: fix curr_active_slave/carrier with loadbalance arp monitoring
  mac80211: minstrel_ht: fix a crash in rate sorting
  vxlan: Inline vxlan_gso_check().
  can: m_can: update to support CAN FD features
  can: m_can: fix incorrect error messages
  can: m_can: add missing delay after setting CCCR_INIT bit
  can: m_can: fix not set can_dlc for remote frame
  can: m_can: fix possible sleep in napi poll
  can: m_can: add missing message RAM initialization
  ...

Pull drm fixes from Dave Airlie:
 "Just two radeon and two intel fixes: endian and regression fixes"

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
  drm/radeon: fix endian swapping in vbios fetch for tdp table
  drm/radeon: disable native backlight control on pre-r6xx asics (v2)
  drm/i915: Kick fbdev before vgacon
  drm/i915: drop WaSetupGtModeTdRowDispatch:snb