Pull misc kbuild changes from Michal Marek:
 "This is the non-critical part of kbuild for v3.6-rc1:

   - Two new coccinelle semantic patches
   - New scripts/tags.sh regexp
   - scripts/config improvements that I mistakenly applied here instead
     of in the kconfig branch (but there are no conflicts)
   - Debian packaging fixes"

* 'misc' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild:
  scripts/tags.sh: Teach [ce]tags about libtraceeevent error codes
  scripts/coccinelle: list iterator variable semantic patch
  scripts/coccinelle: Find threaded IRQs requests which are missing IRQF_ONESHOT
  deb-pkg: Add all Makefiles to header package
  deb-pkg: Install linux-firmware-image in versioned dir
  scripts/config: add option to undef a symbol
  scripts/config: allow alternate prefix to config option symbol
  scripts/config: add option to not upper-case symbols

Pull kconfig changes from Michal Marek:
 - kconfig Makefile portability fixes
 - menuconfig/nconfig help pager usability fix
 - .gitignore cleanup
 - quoting fix in scripts/config
 - Makefile prints errors to stderr
 - support for arbitrarily log lines in .config
 - fix oldnoconfig description in 'make help'

* 'kconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild:
  kconfig: Document oldnoconfig to what it really does
  nconf: add u, d command keys in scroll windows
  menuconfig: add u, d, q command keys in text boxes
  scripts/config: fix double-quotes un-escaping
  kconfig: Print errors to stderr in the Makefile
  kconfig: allow long lines in config file
  kconfig: remove lkc_defs.h from .gitignore and dontdiff
  xconfig: add quiet rule for moc
  xconfig: use pkgconfig to find moc
  kconfig: fix check-lxdialog for DLL platforms
  kconfig: check ncursesw headers first in check-lxdialog
  kconfig/nconf: fix compile with ncurses reentrant API

Pull kbuild fix from Michal Marek:
 "The main kbuild branch ended up with a single commit this time, a fix
  to send errors to stderr"

* 'kbuild' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild:
  kbuild: Print errors to stderr

Pull security subsystem bugfixes from James Morris.

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  selinux: fix selinux_inode_setxattr oops
  KEYS: linux/key-type.h needs linux/errno.h
  smack: off by one error

Pull device-mapper updates from Alasdair G Kergon:
- Flip the thin target into new read-only or failed modes if errors
  are detected;
- Handle chunk sizes that are not powers of two in the snapshot and
  thin targets;
- Provide a way for userspace to avoid replacing an already-loaded
  multipath hardware handler while booting;
- Reduce dm_thin_endio_hook slab size to avoid allocation failures;
- Numerous small changes and cleanups to the code.

* tag 'dm-3.6-changes' of git://git.kernel.org/pub/scm/linux/kernel/git/agk/linux-dm: (63 commits)
  dm thin: commit before gathering status
  dm thin: add read only and fail io modes
  dm thin metadata: introduce dm_pool_abort_metadata
  dm thin metadata: introduce dm_pool_metadata_set_read_only
  dm persistent data: introduce dm_bm_set_read_only
  dm thin: reduce number of metadata commits
  dm thin metadata: add dm_thin_changed_this_transaction
  dm thin metadata: add format option to dm_pool_metadata_open
  dm thin metadata: tidy up open and format error paths
  dm thin metadata: only check incompat features on open
  dm thin metadata: remove duplicate pmd initialisation
  dm thin metadata: remove create parameter from __create_persistent_data_objects
  dm thin metadata: move __superblock_all_zeroes to __open_or_format_metadata
  dm thin metadata: remove nr_blocks arg from __create_persistent_data_objects
  dm thin metadata: split __open or format metadata
  dm thin metadata: use struct dm_pool_metadata members in __open_or_format_metadata
  dm thin metadata: zero unused superblock uuid
  dm thin metadata: lift __begin_transaction out of __write_initial_superblock
  dm thin metadata: move dm_commit_pool_metadata into __write_initial_superblock
  dm thin metadata: factor out __write_initial_superblock
  ...

Pull DMA-mapping updates from Marek Szyprowski:
 "Those patches are continuation of my earlier work.

  They contains extensions to DMA-mapping framework to remove limitation
  of the current ARM implementation (like limited total size of DMA
  coherent/write combine buffers), improve performance of buffer sharing
  between devices (attributes to skip cpu cache operations or creation
  of additional kernel mapping for some specific use cases) as well as
  some unification of the common code for dma_mmap_attrs() and
  dma_mmap_coherent() functions.  All extensions have been implemented
  and tested for ARM architecture."

* 'for-linus-for-3.6-rc1' of git://git.linaro.org/people/mszyprowski/linux-dma-mapping:
  ARM: dma-mapping: add support for DMA_ATTR_SKIP_CPU_SYNC attribute
  common: DMA-mapping: add DMA_ATTR_SKIP_CPU_SYNC attribute
  ARM: dma-mapping: add support for dma_get_sgtable()
  common: dma-mapping: introduce dma_get_sgtable() function
  ARM: dma-mapping: add support for DMA_ATTR_NO_KERNEL_MAPPING attribute
  common: DMA-mapping: add DMA_ATTR_NO_KERNEL_MAPPING attribute
  common: dma-mapping: add support for generic dma_mmap_* calls
  ARM: dma-mapping: fix error path for memory allocation failure
  ARM: dma-mapping: add more sanity checks in arm_dma_mmap()
  ARM: dma-mapping: remove custom consistent dma region
  mm: vmalloc: use const void * for caller argument
  scatterlist: add sg_alloc_table_from_pages function

Pull a howmon update from Jean Delvare.

* 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jdelvare/staging:
  hwmon: struct x86_cpu_id arrays can be __initconst

Pull Exynos DRM changes from Dave Airlie:
 "So I totally missed Inki's pull request for -next, its fully exynos
  self contained."

(I took just the actual commits, not Dave's two extraneous merges)

* 'drm-next' of git://people.freedesktop.org/~airlied/linux: (30 commits)
  drm/exynos: fixed exception to page allocation failure
  drm/exynos: use __free_page() to deallocate memory
  drm/exynos: fixed a comment to gem size.
  drm/exynos: removed unnecessary variable
  drm/exynos: do not release memory region from exporter.
  drm/exynos: set buffer type from exporter.
  drm/exynos: use alloc_page() to allocate pages.
  drm/exynos: fixed build warning.
  drm/exynos: fixed edid data setting at vidi connection request
  drm/exynos: check if raw edid data is fake or not for test
  drm/exynos: set edid fake data only for test.
  drm/exynos: removed unnecessary declaration.
  drm/exynos: fix buffer pitch calculation
  drm/exynos: check for null in return value of dma_buf_map_attachment()
  drm/exynos: return NULL if exynos_pages_to_sg fails
  drm/exynos: Use devm_* functions in exynos_mixer.c
  drm/exynos: Use devm_* functions in exynos_hdmi.c
  drm/exynos: Use devm_* functions in exynos_drm_fimd.c
  drm/exynos: Add missing static storage class specifier
  drm/exynos: add property for crtc mode
  ...

Pull input updates from Dmitry Torokhov:
 "A new driver for FT5x06 based EDT displays and a couple of other
  driver changes"

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: synaptics - handle out of bounds values from the hardware
  Input: wacom - add support to Cintiq 22HD
  Input: add driver for FT5x06 based EDT displays

Pull hwmon fixes from Guenter Roeck:

 - Fix timing problems in applesmc driver

 - Improve device removal in jc42 driver

 - Fix build warning in acp_power_meter driver

* tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  hwmon: (applesmc) Decode and act on read/write status codes
  hwmon: (jc42) Don't reset hysteresis on device removal
  hwmon: (jc42) Simplify hysteresis mask
  hwmon: (acpi_power_meter) Fix build warning

Pull EDAC patches from Mauro Carvalho Chehab:

 - the second part of the EDAC rework:
    - Add the sysfs nodes that exports the real memory layout, instead
      of the fake one (needed to properly represent Intel memory
      controllers since 2002)
    - convert EDAC MC to use "struct device" instead of creating the
      sysfs nodes via the kobj API
    - adds a tracepoint to represent memory errors

 - some cleanup patches

 - some fixes at i5000, i5400 and EDAC core

 - a new EDAC driver for Caldera.

* git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-edac: (33 commits)
  edac i5000, i5400: fix pointer math in i5000_get_mc_regs()
  edac: allow specifying the error count with fake_inject
  edac: add support for Calxeda highbank L2 cache ecc
  edac: add support for Calxeda highbank memory controller
  edac: create top-level debugfs directory
  sb_edac: properly handle error count
  i7core_edac: properly handle error count
  edac: edac_mc_handle_error(): add an error_count parameter
  edac: remove arch-specific parameter for the error handler
  amd64_edac: Don't pass driver name as an error parameter
  edac_mc: check for allocation failure in edac_mc_alloc()
  edac: Increase version to 3.0.0
  edac_mc: Cleanup per-dimm_info debug messages
  edac: Convert debugfX to edac_dbg(X,
  edac: Use more normal debugging macro style
  edac: Don't add __func__ or __FILE__ for debugf[0-9] msgs
  Edac: Add ABI Documentation for the new device nodes
  edac: move documentation ABI to ABI/testing/sysfs-devices-edac
  i7core_edac: change the mem allocation scheme to make Documentation/kobject.txt happy
  edac: change the mem allocation scheme to make Documentation/kobject.txt happy
  ...

Pull arm-soc board updates from Olof Johansson:
 "This branch contains board updates, mostly for shmobile, but also a
  couple for PXA.

  The shmobile platforms are still in the early stages of DT enablement,
  so there's a bit more updates here than we'd ideally want to see:
   - regulator updates to provide some fixed regulators on several
     boards
   - gpio support updates for multiple boards
   - misc updates for recently-introduced boards armadillo800eva and
     kzm9g
   - defconfig updates"

* tag 'boards2' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (37 commits)
  ARM: shmobile: kzm9g: defconfig enable INOTIFY_USER
  ARM: mach-shmobile: armadillo800eva: defconfig Allow use of armhf userspace
  ARM: shmobile: armadillo800eva: A3SP domain includes USB
  ARM: shmobile: armadillo800eva: A4LC domain includes LCDC
  ARM: shmobile: armadillo800eva: USB Func enables external IRQ mode
  ARM: mach-shmobile: kzm9d: Add defconfig
  ARM: mach-shmobile: select the fixed regulator driver on several boards
  ARM: mach-shmobile: add SDHI2 to the 2.8V fixed regulator consumers on kzm9g
  ARM: pxa: hx4700: Use DEFINE_RES_* macros consistently
  ARM: pxa: remove eseries.h
  ARM: mach-shmobile: add fixed voltage regulators to marzen
  ARM: mach-shmobile: add fixed voltage regulators to kzm9g
  ARM: mach-shmobile: add fixed voltage regulators to kzm9d
  ARM: mach-shmobile: add fixed voltage regulators to kota2
  ARM: mach-shmobile: add fixed voltage regulators to g4evm
  ARM: mach-shmobile: add fixed voltage regulators to bonito
  ARM: mach-shmobile: add fixed voltage regulators to armadillo800eva
  ARM: mach-shmobile: add fixed voltage regulators to ap4evb
  ARM: mach-shmobile: add fixed voltage regulators to ag5evm
  ARM: mach-shmobile: add 3.3V and 1.8V fixed regulators to mackerel
  ...

Pull arm-soc soc updates from Olof Johansson:
 "This is the second batch of SoC updates for the 3.6 merge window,
  containing parts that arrived close to the merge window opening and
  thus needed to sit in linux-next for a while.

  Most contents is updates of Renesas shmobile, with a couple of Samsung
  Exynos patches in the mix."

* tag 'soc2' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc: (39 commits)
  ARM: S3C64XX: Add header file protection macros in pm-core.h
  [CPUFREQ] EXYNOS5250: Add support max 1.7GHz for EXYNOS5250
  ARM: EXYNOS: Add G2D related clock entries for SMDK4X12
  ARM: EXYNOS: Move G2D clock entries to clock-exynos4210.c file
  ARM: shmobile: Fix build problem in pm-sh7372.c for unusual .config
  ARM: shmobile: Take cpuidle dependencies into account correctly
  ARM: mach-shmobile: sh7377 generic board support via DT
  ARM: mach-shmobile: r8a7740 generic board support via DT
  ARM: shmobile: sh7372: completely switch over to using pm-rmobile API
  ARM: shmobile: ap4evb: switch to using pm-rmobile API
  ARM: shmobile: mackerel: switch to using pm-rmobile API
  ARM: shmobile: sh7372: add pm-rmobile domain support
  ARM: shmobile: r8a7740: add A4LC pm domain support
  ARM: shmobile: r8a7740: add A3SP pm domain support
  ARM: shmobile: r8a7740: add A4S pm domain support
  ARM: shmobile: r8a7740: fixup: MSEL1CR 7bit control
  ARM: shmobile: soc-core: add R-mobile PM domain common APIs
  ARM: shmobile: sh7372 A3SM CPUIdle support
  ARM: shmobile: Use INTCA with sh7372 A3SM power domain
  ARM: mach-shmobile: Convert sh_clk_mstp32_register to sh_clk_mstp_register
  ...

Pull firewire updates from Stefan Richter:

 - Small fixes and optimizations.

 - A new sysfs attribute to tell local and remote nodes apart.
   Useful to set special permissions/ ownership of local nodes'
   /dev/fw*, to start daemons on them (for diagnostics, management,
   AV targets, VersaPHY initiator or targets...), to pick up their
   GUID to use it as GUID of an SBP2 target instance, and of course
   for informational purposes.

* tag 'firewire-updates' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394:
  firewire: core: document is_local sysfs attribute
  firewire: core: add is_local sysfs device attribute
  firewire: ohci: initialize multiChanMode bits after reset
  firewire: core: fix multichannel IR with buffers larger than 2 GB
  firewire: ohci: sanity-check MMIO resource
  firewire: ohci: lazy bus time initialization
  firewire: core: allocate the low memory region
  firewire: core: make address handler length 64 bits

Pull PWM subsystem from Thierry Reding:
 "The new PWM subsystem aims at collecting all implementations of the
  legacy PWM API and to eventually replace it completely.

  The subsystem has been in development for over half a year now and
  many drivers have already been converted.  It has been in linux-next
  for a couple of weeks and there have been no major issues so I think
  it is ready for inclusion in your tree."

Arnd Bergmann <arnd@arndb.de>:
 "Very much Ack on the new subsystem.  It uses the interface
  declarations as the previously separate pwm drivers, so nothing
  changes for now in the drivers using it, although it enables us to
  change those more easily in the future if we want to.

  This work is also one of the missing pieces that are required to
  eventually build ARM kernels for multiple platforms, which is
  currently prohibited (amongs other things) by the fact that you cannot
  have more than one driver exporting the pwm functions."
Tested-and-acked-by: Alexandre Courbot <acourbot@nvidia.com>
Acked-by: Mark Brown <broonie@opensource.wolfsonmicro.com>
Acked-by: Philip, Avinash <avinashphilip@ti.com> # TI's AM33xx platforms
Acked-By: Alexandre Pereira da Silva <aletes.xgr@gmail.com> # LPC32XX
Acked-by: Arnd Bergmann <arnd@arndb.de>
Acked-by: Sachin Kamat <sachin.kamat@linaro.org>

Fix up trivial conflicts with other cleanups and DT updates.

* 'for-3.6' of git://gitorious.org/linux-pwm/linux-pwm: (36 commits)
  pwm: pwm-tiehrpwm: PWM driver support for EHRPWM
  pwm: pwm-tiecap: PWM driver support for ECAP APWM
  pwm: fix used-uninitialized warning in pwm_get()
  pwm: add lpc32xx PWM support
  pwm_backlight: pass correct brightness to callback
  pwm: Use pr_* functions in pwm-samsung.c file
  pwm: Convert pwm-samsung to use devm_* APIs
  pwm: Convert pwm-tegra to use devm_clk_get()
  pwm: pwm-mxs: Return proper error if pwmchip_remove() fails
  pwm: pwm-bfin: Return proper error if pwmchip_remove() fails
  pwm: pxa: Propagate pwmchip_remove() error
  pwm: Convert pwm-pxa to use devm_* APIs
  pwm: Convert pwm-vt8500 to use devm_* APIs
  pwm: Convert pwm-imx to use devm_* APIs
  pwm: Conflict with legacy PWM API
  pwm: pwm-mxs: add pinctrl support
  pwm: pwm-mxs: use devm_* managed functions
  pwm: pwm-mxs: use global reset function stmp_reset_block
  pwm: pwm-mxs: encode soc name in compatible string
  pwm: Take over maintainership of the PWM subsystem
  ...

This patch adds support for DMA_ATTR_SKIP_CPU_SYNC attribute for
dma_(un)map_(single,page,sg) functions family. It lets dma mapping clients
to create a mapping for the buffer for the given device without performing
a CPU cache synchronization. CPU cache synchronization can be skipped for
the buffers which it is known that they are already in 'device' domain (CPU
caches have been already synchronized or there are only coherent mappings
for the buffer). For advanced users only, please use it with care.
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: Kyungmin Park <kyungmin.park@samsung.com>

This patch adds DMA_ATTR_SKIP_CPU_SYNC attribute to the DMA-mapping
subsystem.

By default dma_map_{single,page,sg} functions family transfer a given
buffer from CPU domain to device domain. Some advanced use cases might
require sharing a buffer between more than one device. This requires
having a mapping created separately for each device and is usually
performed by calling dma_map_{single,page,sg} function more than once
for the given buffer with device pointer to each device taking part in
the buffer sharing. The first call transfers a buffer from 'CPU' domain
to 'device' domain, what synchronizes CPU caches for the given region
(usually it means that the cache has been flushed or invalidated
depending on the dma direction). However, next calls to
dma_map_{single,page,sg}() for other devices will perform exactly the
same sychronization operation on the CPU cache. CPU cache sychronization
might be a time consuming operation, especially if the buffers are
large, so it is highly recommended to avoid it if possible.
DMA_ATTR_SKIP_CPU_SYNC allows platform code to skip synchronization of
the CPU cache for the given buffer assuming that it has been already
transferred to 'device' domain. This attribute can be also used for
dma_unmap_{single,page,sg} functions family to force buffer to stay in
device domain after releasing a mapping for it. Use this attribute with
care!
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: Kyungmin Park <kyungmin.park@samsung.com>

This patch adds support for dma_get_sgtable() function which is required
to let drivers to share the buffers allocated by DMA-mapping subsystem.

Generic implementation based on virt_to_page() is not suitable for ARM
dma-mapping subsystem.
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: Kyungmin Park <kyungmin.park@samsung.com>

This patch adds dma_get_sgtable() function which is required to let
drivers to share the buffers allocated by DMA-mapping subsystem. Right
now the driver gets a dma address of the allocated buffer and the kernel
virtual mapping for it. If it wants to share it with other device (= map
into its dma address space) it usually hacks around kernel virtual
addresses to get pointers to pages or assumes that both devices share
the DMA address space. Both solutions are just hacks for the special
cases, which should be avoided in the final version of buffer sharing.

To solve this issue in a generic way, a new call to DMA mapping has been
introduced - dma_get_sgtable(). It allocates a scatter-list which
describes the allocated buffer and lets the driver(s) to use it with
other device(s) by calling dma_map_sg() on it.

This patch provides a generic implementation based on virt_to_page()
call. Architectures which require more sophisticated translation might
provide their own get_sgtable() methods.
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: Kyungmin Park <kyungmin.park@samsung.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>

This patch adds support for DMA_ATTR_NO_KERNEL_MAPPING attribute for
IOMMU allocations, what let drivers to save precious kernel virtual
address space for large buffers that are intended to be accessed only
from userspace.

This patch is heavily based on initial work kindly provided by Abhinav
Kochhar <abhinav.k@samsung.com>.
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: Kyungmin Park <kyungmin.park@samsung.com>

This patch adds DMA_ATTR_NO_KERNEL_MAPPING attribute which lets the
platform to avoid creating a kernel virtual mapping for the allocated
buffer. On some architectures creating such mapping is non-trivial task
and consumes very limited resources (like kernel virtual address space
or dma consistent address space). Buffers allocated with this attribute
can be only passed to user space by calling dma_mmap_attrs().
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: Kyungmin Park <kyungmin.park@samsung.com>
Reviewed-by: Daniel Vetter <daniel.vetter@ffwll.ch>

Commit 9adc5374 ('common: dma-mapping: introduce mmap method') added a
generic method for implementing mmap user call to dma_map_ops structure.

This patch converts ARM and PowerPC architectures (the only providers of
dma_mmap_coherent/dma_mmap_writecombine calls) to use this generic
dma_map_ops based call and adds a generic cross architecture
definition for dma_mmap_attrs, dma_mmap_coherent, dma_mmap_writecombine
functions.

The generic mmap virt_to_page-based fallback implementation is provided for
architectures which don't provide their own implementation for mmap method.
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: Kyungmin Park <kyungmin.park@samsung.com>

This patch fixes incorrect check in error path. When the allocation of
first page fails, the kernel ops appears due to accessing -1 element of
the pages array.
Reported-by: Sylwester Nawrocki <s.nawrocki@samsung.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>

Add some sanity checks and forbid mmaping of buffers into vma areas larger
than allocated dma buffer.
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>

This patch changes dma-mapping subsystem to use generic vmalloc areas
for all consistent dma allocations. This increases the total size limit
of the consistent allocations and removes platform hacks and a lot of
duplicated code.

Atomic allocations are served from special pool preallocated on boot,
because vmalloc areas cannot be reliably created in atomic context.
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: Kyungmin Park <kyungmin.park@samsung.com>
Reviewed-by: Minchan Kim <minchan@kernel.org>

'const void *' is a safer type for caller function type. This patch
updates all references to caller function type.
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
Reviewed-by: Kyungmin Park <kyungmin.park@samsung.com>
Reviewed-by: Minchan Kim <minchan@kernel.org>

This patch adds a new constructor for an sg table. The table is constructed
from an array of struct pages. All contiguous chunks of the pages are merged
into a single sg nodes. A user may provide an offset and a size of a buffer if
the buffer is not page-aligned.

The function is dedicated for DMABUF exporters which often perform conversion
from an page array to a scatterlist. Moreover the scatterlist should be
squashed in order to save memory and to speed-up the process of DMA mapping
using dma_map_sg.

The code is based on the patch 'v4l: vb2-dma-contig: add support for
scatterlist in userptr mode' and hints from Laurent Pinchart.
Signed-off-by: Tomasz Stanislawski <t.stanislaws@samsung.com>
Signed-off-by: Kyungmin Park <kyungmin.park@samsung.com>
Acked-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Acked-by: Laurent Pinchart <laurent.pinchart@ideasonboard.com>
Signed-off-by: Marek Szyprowski <m.szyprowski@samsung.com>
CC: Andrew Morton <akpm@linux-foundation.org>

... as being referenced from __init code only.
Signed-off-by: Jan Beulich <jbeulich@suse.com>
Signed-off-by: Jean Delvare <khali@linux-fr.org>

OK, what we have so far is e.g.
	setxattr(path, name, whatever, 0, XATTR_REPLACE)
with name being good enough to get through xattr_permission().
Then we reach security_inode_setxattr() with the desired value and size.
Aha.  name should begin with "security.selinux", or we won't get that
far in selinux_inode_setxattr().  Suppose we got there and have enough
permissions to relabel that sucker.  We call security_context_to_sid()
with value == NULL, size == 0.  OK, we want ss_initialized to be non-zero.
I.e. after everything had been set up and running.  No problem...

We do 1-byte kmalloc(), zero-length memcpy() (which doesn't oops, even
thought the source is NULL) and put a NUL there.  I.e. form an empty
string.  string_to_context_struct() is called and looks for the first
':' in there.  Not found, -EINVAL we get.  OK, security_context_to_sid_core()
has rc == -EINVAL, force == 0, so it silently returns -EINVAL.
All it takes now is not having CAP_MAC_ADMIN and we are fucked.

All right, it might be a different bug (modulo strange code quoted in the
report), but it's real.  Easily fixed, AFAICS:

Deal with size == 0, value == NULL case in selinux_inode_setxattr()

Cc: stable@vger.kernel.org
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Tested-by: Dave Jones <davej@redhat.com>
Reported-by: Dave Jones <davej@redhat.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>

Prepare second set of changes for 3.6 merge window.

linux/key-type.h needs to #include linux/errno.h as it refers to ENOKEY.
Without this, with sparc's allmodconfig in one of my test trees, the following
error occurs:

include/linux/key-type.h: In function 'key_negate_and_link':
include/linux/key-type.h:122:43: error: 'ENOKEY' undeclared (first use in this function)
include/linux/key-type.h:122:43: note: each undeclared identifier is reported only once for each fun
Reported-by: Fengguang Wu <fengguang.wu@intel.com>
Signed-off-by: David Howells <dhowells@redhat.com>
Signed-off-by: James Morris <james.l.morris@oracle.com>

Consider the input case of a rule that consists entirely of non space
symbols followed by a \0. Say 64 + \0

In this case strlen(data) = 64
kzalloc of subject and object are 64 byte objects
sscanfdata, "%s %s %s", subject, ...)

will put 65 bytes into subject.
Signed-off-by: Alan Cox <alan@linux.intel.com>
Acked-by: Casey Schaufler <casey@schaufler-ca.com>
Cc: stable@vger.kernel.org
Signed-off-by: James Morris <james.l.morris@oracle.com>

* devel: (33 commits)
  edac i5000, i5400: fix pointer math in i5000_get_mc_regs()
  edac: allow specifying the error count with fake_inject
  edac: add support for Calxeda highbank L2 cache ecc
  edac: add support for Calxeda highbank memory controller
  edac: create top-level debugfs directory
  sb_edac: properly handle error count
  i7core_edac: properly handle error count
  edac: edac_mc_handle_error(): add an error_count parameter
  edac: remove arch-specific parameter for the error handler
  amd64_edac: Don't pass driver name as an error parameter
  edac_mc: check for allocation failure in edac_mc_alloc()
  edac: Increase version to 3.0.0
  edac_mc: Cleanup per-dimm_info debug messages
  edac: Convert debugfX to edac_dbg(X,
  edac: Use more normal debugging macro style
  edac: Don't add __func__ or __FILE__ for debugf[0-9] msgs
  Edac: Add ABI Documentation for the new device nodes
  edac: move documentation ABI to ABI/testing/sysfs-devices-edac
  i7core_edac: change the mem allocation scheme to make Documentation/kobject.txt happy
  edac: change the mem allocation scheme to make Documentation/kobject.txt happy
  ...

Linux 3.5

* tag 'v3.5': (1242 commits)
  Linux 3.5
  Remove SYSTEM_SUSPEND_DISK system state
  kdb: Switch to nolock variants of kmsg_dump functions
  printk: Implement some unlocked kmsg_dump functions
  printk: Remove kdb_syslog_data
  kdb: Revive dmesg command
  dm raid1: set discard_zeroes_data_unsupported
  dm thin: do not send discards to shared blocks
  dm raid1: fix crash with mirror recovery and discard
  pnfs-obj: Fix __r4w_get_page when offset is beyond i_size
  pnfs-obj: don't leak objio_state if ore_write/read fails
  ore: Unlock r4w pages in exact reverse order of locking
  ore: Remove support of partial IO request (NFS crash)
  ore: Fix NFS crash by supporting any unaligned RAID IO
  UBIFS: fix a bug in empty space fix-up
  cx25821: Remove bad strcpy to read-only char*
  HID: hid-multitouch: add support for Zytronic panels
  MIPS: PCI: Move fixups from __init to __devinit.
  MIPS: Fix bug.h MIPS build regression
  MIPS: sync-r4k: remove redundant irq operation
  ...

Pull embedded i2c changes from Wolfram Sang:
 "Changes for the "embedded" part of the I2C subsystem:

   - lots of devicetree conversions of drivers (and preparations for
     that)
   - big cleanups for drivers for OMAP, Tegra, Nomadik, Blackfin
   - Rafael's struct dev_pm_ops conversion patches for I2C
   - usual driver cleanups and fixes

  All patches have been in linux-next for an apropriate time and all
  patches touching files outside of i2c-folders should have proper acks
  from the maintainers."

* 'i2c-embedded/for-next' of git://git.pengutronix.de/git/wsa/linux: (60 commits)
  Revert "i2c: tegra: convert normal suspend/resume to *_noirq"
  I2C: MV64XYZ: Add Device Tree support
  i2c: stu300: use devm managed resources
  i2c: i2c-ocores: support for 16bit and 32bit IO
  V4L/DVB: mfd: use reg_shift instead of regstep
  i2c: i2c-ocores: Use reg-shift property
  i2c: i2c-ocores: DT bindings and minor fixes.
  i2c: mv64xxxx: remove EXPERIMENTAL tag
  i2c-s3c2410: Use plain pm_runtime_put()
  i2c: s3c2410: Fix pointer type passed to of_match_node()
  i2c: mxs: Set I2C timing registers for mxs-i2c
  i2c: i2c-bfin-twi: Move blackfin TWI register access Macro to head file.
  i2c: i2c-bfin-twi: Move TWI peripheral pin request array to platform data.
  i2c:i2c-bfin-twi: include twi head file
  i2c:i2c-bfin-twi: TWI fails to restart next transfer in high system load.
  i2c: i2c-bfin-twi: Tighten condition when failing I2C transfer if MEN bit is reset unexpectedly.
  i2c: i2c-bfin-twi: Break dead waiting loop if i2c device misbehaves.
  i2c: i2c-bfin-twi: Improve the patch for bug "Illegal i2c bus lock upon certain transfer scenarios".
  i2c: i2c-bfin-twi: Illegal i2c bus lock upon certain transfer scenarios.
  i2c-mv64xxxx: allow more than one driver instance
  ...

Conflicts:
	drivers/i2c/busses/i2c-nomadik.c

Pull networking fixes from David Miller:
 "Several bug fixes, some to new features appearing in this merge
  window, some that have been around for a while.

  I have a short list of known problems that need to be sorted out, but
  all of them can be solved easily during the run up to 3.6-final.

  I'll be offline until Sunday afternoon, but nothing need hold up
  3.6-rc1 and the close of the merge window, networking wise, at this
  point.

  1) Fix interface check in ipv4 TCP early demux, from Eric Dumazet.

  2) Fix a long standing bug in TCP DMA to userspace offload that can
     hang applications using MSG_TRUNC, from Jiri Kosina.

  3) Don't allow TCP_USER_TIMEOUT to be negative, from Hangbin Liu.

  4) Don't use GFP_KERNEL under spinlock in kaweth driver, from Dan
     Carpenter"

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
  tcp: perform DMA to userspace only if there is a task waiting for it
  Revert "openvswitch: potential NULL deref in sample()"
  ipv4: fix TCP early demux
  net: fix rtnetlink IFF_PROMISC and IFF_ALLMULTI handling
  USB: kaweth.c: use GFP_ATOMIC under spin_lock
  tcp: Add TCP_USER_TIMEOUT negative value check
  bcma: add missing iounmap on error path
  bcma: fix regression in interrupt assignment on mips
  mac80211_hwsim: fix possible race condition in usage of info->control.sta & control.vif

Pull ext4 updates from Ted Ts'o:
 "The usual collection of bug fixes and optimizations.  Perhaps of
  greatest note is a speed up for parallel, non-allocating DIO writes,
  since we no longer take the i_mutex lock in that case.

  For bug fixes, we fix an incorrect overhead calculation which caused
  slightly incorrect results for df(1) and statfs(2).  We also fixed
  bugs in the metadata checksum feature."

* tag 'ext4_for_linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4: (23 commits)
  ext4: undo ext4_calc_metadata_amount if we fail to claim space
  ext4: don't let i_reserved_meta_blocks go negative
  ext4: fix hole punch failure when depth is greater than 0
  ext4: remove unnecessary argument from __ext4_handle_dirty_metadata()
  ext4: weed out ext4_write_super
  ext4: remove unnecessary superblock dirtying
  ext4: convert last user of ext4_mark_super_dirty() to ext4_handle_dirty_super()
  ext4: remove useless marking of superblock dirty
  ext4: fix ext4 mismerge back in January
  ext4: remove dynamic array size in ext4_chksum()
  ext4: remove unused variable in ext4_update_super()
  ext4: make quota as first class supported feature
  ext4: don't take the i_mutex lock when doing DIO overwrites
  ext4: add a new nolock flag in ext4_map_blocks
  ext4: split ext4_file_write into buffered IO and direct IO
  ext4: remove an unused statement in ext4_mb_get_buddy_page_lock()
  ext4: fix out-of-date comments in extents.c
  ext4: use s_csum_seed instead of i_csum_seed for xattr block
  ext4: use proper csum calculation in ext4_rename
  ext4: fix overhead calculation used by ext4_statfs()
  ...

Pull ARM updates from Russell King:
 "First ARM push of this merge window, post me coming back from holiday.
  This is what has been in linux-next for the last few weeks.  Not much
  to say which isn't described by the commit summaries."

* 'for-linus' of git://git.linaro.org/people/rmk/linux-arm: (32 commits)
  ARM: 7463/1: topology: Update cpu_power according to DT information
  ARM: 7462/1: topology: factorize the update of sibling masks
  ARM: 7461/1: topology: Add arch_scale_freq_power function
  ARM: 7456/1: ptrace: provide separate functions for tracing syscall {entry,exit}
  ARM: 7455/1: audit: move syscall auditing until after ptrace SIGTRAP handling
  ARM: 7454/1: entry: don't bother with syscall tracing on ret_from_fork path
  ARM: 7453/1: audit: only allow syscall auditing for pure EABI userspace
  ARM: 7452/1: delay: allow timer-based delay implementation to be selected
  ARM: 7451/1: arch timer: implement read_current_timer and get_cycles
  ARM: 7450/1: dcache: select DCACHE_WORD_ACCESS for little-endian ARMv6+ CPUs
  ARM: 7449/1: use generic strnlen_user and strncpy_from_user functions
  ARM: 7448/1: perf: remove arm_perf_pmu_ids global enumeration
  ARM: 7447/1: rwlocks: remove unused branch labels from trylock routines
  ARM: 7446/1: spinlock: use ticket algorithm for ARMv6+ locking implementation
  ARM: 7445/1: mm: update CONTEXTIDR register to contain PID of current process
  ARM: 7444/1: kernel: add arch-timer C3STOP feature
  ARM: 7460/1: remove asm/locks.h
  ARM: 7439/1: head.S: simplify initial page table mapping
  ARM: 7437/1: zImage: Allow DTB command line concatenation with ATAG_CMDLINE
  ARM: 7436/1: Do not map the vectors page as write-through on UP systems
  ...

John W. Linville says:

====================
These fixes are intended for the 3.6 stream.

Hauke Mehrtens provides a pair of bcma fixes, one to fix a build
regression on mips and another to correct a pair of missing iounmap
calls.

Thomas Huehn offers a mac80211_hwsim fix to avoid a possible
use-after-free bug.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>