Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

- Convert the non-trivial ones into WARN_ON_ONCE().
- Remove the trivial refcounting BUGs
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

- Offset bound checks are done in the NFS client code.
- So are filehandle size checks
- The cookie length is a constant
- The utsname()->nodename is already bounded
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

...and ensure that we set the return value for nfs_page_async_flush()
to zero! (Reported-by: Dros Adamson)
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

An EAGAIN return value would be unexpected, but there is no reason to
BUG...
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

Convert the ones that are not trivial to check into WARN_ON_ONCE().
Remove checks for things such as NFS2_MAXPATHLEN, which are trivially
done by the caller.

Add a comment to the case of nfs3_xdr_enc_setacl3args. What is being
done there is just wrong...
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

If the nfs_client fails to initialise correctly, then it will
return an error condition.
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

rpc_shutdown_client should never be called from a workqueue context.
If it is, it could deadlock looping forever trying to kill tasks that are
assigned to the same kworker thread (and will never run rpc_exit_task).
Signed-off-by: Weston Andros Adamson <dros@netapp.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

Pull NFS client bugfixes from Trond Myklebust:

 - Fix a bunch of deadlock situations:
   * State recovery can deadlock if we fail to release sequence ids
     before scheduling the recovery thread.
   * Calling deactivate_super() from an RPC workqueue thread can
     deadlock because of the call to rpc_shutdown_client.

 - Display the device name correctly in /proc/*/mounts

 - Fix a number of incorrect error return values:
   * When NFSv3 mounts fail due to a timeout.
   * On NFSv4.1 backchannel setup failure
   * On NFSv4 open access checks

 - pnfs_find_alloc_layout() must check the layout pointer for NULL

 - Fix a regression in the legacy DNS resolved

* tag 'nfs-for-3.7-4' of git://git.linux-nfs.org/projects/trondmy/linux-nfs:
  NFS4: nfs4_opendata_access should return errno
  NFSv4: Initialise the NFSv4.1 slot table highest_used_slotid correctly
  SUNRPC: return proper errno from backchannel_rqst
  NFS: add nfs_sb_deactive_async to avoid deadlock
  nfs: Show original device name verbatim in /proc/*/mount{s,info}
  nfsv3: Make v3 mounts fail with ETIMEDOUTs instead EIO on mountd timeouts
  nfs: Check whether a layout pointer is NULL before free it
  NFS: fix bug in legacy DNS resolver.
  NFSv4: nfs4_locku_done must release the sequence id
  NFSv4.1: We must release the sequence id when we fail to get a session slot
  NFS: Wait for session recovery to finish before returning

Pull thermal management & ACPI update from Zhang Rui,

Ho humm.  Normally these things go through Len.  But it's just three
small fixes, I guess I can pull directly too.

* 'release' of git://git.kernel.org/pub/scm/linux/kernel/git/rzhang/linux:
  exynos4_tmu_driver_ids should be exynos_tmu_driver_ids.
  ACPI video: Ignore errors after _DOD evaluation.
  thermal: solve compilation errors in rcar_thermal

Pull i2c embedded fixes from Wolfram Sang:
 "Two patches are usual stuff.

  The bigger patch is needed to correct a wrong decision made in this
  merge window.  We hoped to get the PIOQUEUE mode in the mxs driver
  working with DMA, but it turned out to be too broken (leading to data
  loss), so we now think it is best to remove it entirely and work only
  with DMA now.  The patch should be in 3.7.  IMO, so users never get
  the chance to use both modes in parallel."

* 'i2c-embedded/for-current' of git://git.pengutronix.de/git/wsa/linux:
  i2c: tegra: set irq name as device name
  i2c-nomadik: Fixup clock handling
  i2c: mxs: remove broken PIOQUEUE support

Pull drm fixes from Dave Airlie:
 "Scattered selection of fixes:

   - radeon: load detect fixes from SuSE/AMD
   - intel: misc i830, sdvo regression, vesafb kickoff ums fix
   - exynos: maintainers entry update + fixes
   - udl: fix stride scanout issue

  it's slightly bigger than I'd probably like, but nothing looked
  dangerous enough to hold off on."

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
  drm/udl: fix stride issues scanning out stride != width*bpp
  drm/radeon: add load detection support for ext DAC on R200 (v2)
  DRM/radeon: For single CRTC GPUs move handling of CRTC_CRT_ON to crtc_dpms().
  DRM/Radeon: Fix TV DAC Load Detection for single CRTC chips.
  DRM/Radeon: Clean up code in TV DAC load detection.
  drm/radeon: fix ATPX function documentation
  drivers/gpu/drm/radeon/evergreen_cs.c: Remove unnecessary semicolon
  DRM/Radeon: On DVI-I use Load Detection when EDID is bogus.
  DRM/Radeon: Fix primary DAC Load Detection for RV100 chips.
  DRM/Radeon: Fix Load Detection on legacy primary DAC.
  drm: exynos: removed warning due to missing typecast for mixer driver data
  drm/exynos: add support for ARCH_MULTIPLATFORM
  MAINTAINERS: Add git repository for Exynos DRM
  drm/exynos: fix display on issue
  drm/i915: Only kick out vesafb if we takeover the fbcon with KMS
  drm/i915: be less verbose about inability to provide vendor backlight
  drm/i915: clear the entire sdvo infoframe buffer
  drm/i915: VGA needs to be on pipe A on i830M
  drm/i915: fix overlay on i830M

Pull networking fixes from David Miller:
 "First post-Sandy pull request"

 1) Fix antenna gain handling and initialization of chan->max_reg_power
    in wireless, from Felix Fietkau.

 2) Fix nexthop handling in H.232 conntrack helper, from Julian
    Anastasov.

 3) Only process 80211 mesh config header in certain kinds of frames,
    from Javier Cardona.

 4) 80211 management frame header length needs to be validated, from
    Johannes Berg.

 5) Don't access free'd SKBs in ath9k driver, from Felix Fietkay.

 6) Test for permanent state correctly in VXLAN driver, from Stephen
    Hemminger.

 7) BNX2X bug fixes from Yaniv Rosner and Dmitry Kravkov.

 8) Fix off by one errors in bonding, from Nikolay ALeksandrov.

 9) Fix divide by zero in TCP-Illinois congestion control.  From Jesper
    Dangaard Brouer.

10) TCP metrics code says "Yo dawg, I heard you like sizeof, so I did a
    sizeof of a sizeof, so you can size your size" Fix from Julian
    Anastasov.

11) Several drivers do mdiobus_free without first doing an
    mdiobus_unregister leading to stray pointer references.  Fix from
    Peter Senna Tschudin.

12) Fix OOPS in l2tp_eth_create() error path, it's another danling
    pointer kinda situation.  Fix from Tom Parkin.

13) Hardware driven by the vmxnet driver can't handle larger than 16K
    fragments, so split them up when necessary.  From Eric Dumazet.

14) Handle zero length data length in tcp_send_rcvq() properly.  Fix
    from Pavel Emelyanov.

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (38 commits)
  tcp-repair: Handle zero-length data put in rcv queue
  vmxnet3: must split too big fragments
  l2tp: fix oops in l2tp_eth_create() error path
  cxgb4: Fix unable to get UP event from the LLD
  drivers/net/phy/mdio-bitbang.c: Call mdiobus_unregister before mdiobus_free
  drivers/net/ethernet/nxp/lpc_eth.c: Call mdiobus_unregister before mdiobus_free
  bnx2x: fix HW initialization using fw 7.8.x
  tcp: Fix double sizeof in new tcp_metrics code
  net: fix divide by zero in tcp algorithm illinois
  net: sctp: Fix typo in net/sctp
  bonding: fix second off-by-one error
  bonding: fix off-by-one error
  bnx2x: Disable FCoE for 57840 since not yet supported by FW
  bnx2x: Fix no link on 577xx 10G-baseT
  bnx2x: Fix unrecognized SFP+ module after driver is loaded
  bnx2x: Fix potential incorrect link speed provision
  bnx2x: Restore global registers back to default.
  bnx2x: Fix link down in 57712 following LFA
  bnx2x: Fix 57810 1G-KR link against certain switches.
  ixgbe: PTP get_ts_info missing software support
  ...

When sending data into a tcp socket in repair state we should check
for the amount of data being 0 explicitly. Otherwise we'll have an skb
with seq == end_seq in rcv queue, but tcp doesn't expect this to happen
(in particular a warn_on in tcp_recvmsg shoots).
Signed-off-by: Pavel Emelyanov <xemul@parallels.com>
Reported-by: Giorgos Mavrikas <gmavrikas@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

vmxnet3 has a 16Kbytes limit per tx descriptor, that happened to work
as long as we provided PAGE_SIZE fragments.

Our stack can now build larger fragments, so we need to split them to
the 16kbytes boundary.
Signed-off-by: Eric Dumazet <edumazet@google.com>
Reported-by: jongman heo <jongman.heo@samsung.com>
Tested-by: jongman heo <jongman.heo@samsung.com>
Cc: Shreyas Bhatewara <sbhatewara@vmware.com>
Reviewed-by: Bhavesh Davda <bhavesh@vmware.com>
Signed-off-by: Shreyas Bhatewara <sbhatewara@vmware.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

When creating an L2TPv3 Ethernet session, if register_netdev() should fail for
any reason (for example, automatic naming for "l2tpeth%d" interfaces hits the
32k-interface limit), the netdev is freed in the error path.  However, the
l2tp_eth_sess structure's dev pointer is left uncleared, and this results in
l2tp_eth_delete() then attempting to unregister the same netdev later in the
session teardown.  This results in an oops.

To avoid this, clear the session dev pointer in the error path.
Signed-off-by: Tom Parkin <tparkin@katalix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Signed-off-by: Jonghwan Choi <jhbird.choi@samsung.com>
Reviewed-by: Amit Daniel Kachhap <amit.kachhap@linaro.org>
Signed-off-by: Zhang Rui <rui.zhang@intel.com>

There are systems where video module known to work fine regardless
of broken _DOD and ignoring returned value here doesn't cause
any issues later. This should fix brightness controls on some laptops.

Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=47861Signed-off-by: Igor Murzov <e-mail@date.by>
Reviewed-by: Sergey V <sftp.mtuci@gmail.com>
Signed-off-by: Zhang Rui <rui.zhang@intel.com>

following were the errors reported

drivers/thermal/rcar_thermal.c: In function ‘rcar_thermal_probe’:
drivers/thermal/rcar_thermal.c:214:10: warning: passing argument 3 of ‘thermal_zone_device_register’ makes integer from pointer without a cast [enabled by default]
include/linux/thermal.h:166:29: note: expected ‘int’ but argument is of type ‘struct rcar_thermal_priv *’
drivers/thermal/rcar_thermal.c:214:10: error: too few arguments to function ‘thermal_zone_device_register’
include/linux/thermal.h:166:29: note: declared here
make[1]: *** [drivers/thermal/rcar_thermal.o] Error 1
make: *** [drivers/thermal/rcar_thermal.o] Error 2

with gcc version 4.6.3 (Ubuntu/Linaro 4.6.3-1ubuntu5)
Signed-off-by: Devendra Naga <develkernel412222@gmail.com>
Signed-off-by: Kuninori Morimoto <kuninori.morimoto.gx@renesas.com>
Signed-off-by: Zhang Rui <rui.zhang@intel.com>

If T4 configuration file gets loaded from the /lib/firmware/cxgb4/ directory
then offload capabilities of the cards were getting disabled during
initialization. Hence ULDs do not get an UP event from the LLD.
Signed-off-by: Jay Hernandez <jay@chelsio.com>
Signed-off-by: Vipul Pandya <vipul@chelsio.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Based on commit b27393ae

Calling mdiobus_free without calling mdiobus_unregister causes
BUG_ON(). This patch fixes the issue.

The semantic patch that found this issue(http://coccinelle.lip6.fr/):
// <smpl>
@@
expression E;
@@
  ... when != mdiobus_unregister(E);

+ mdiobus_unregister(E);
  mdiobus_free(E);
// </smpl>
Signed-off-by: Peter Senna Tschudin <peter.senna@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Based on commit b27393ae

Calling mdiobus_free without calling mdiobus_unregister causes
BUG_ON(). This patch fixes the issue.

The semantic patch that found this issue(http://coccinelle.lip6.fr/):
// <smpl>
@@
expression E;
@@
  ... when != mdiobus_unregister(E);

+ mdiobus_unregister(E);
  mdiobus_free(E);
// </smpl>
Signed-off-by: Peter Senna Tschudin <peter.senna@gmail.com>
Tested-by: Roland Stigge <stigge@antcom.de>
Tested-by: Alexandre Pereira da Silva <aletes.xgr@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Since commit 96bed4b9 (use FW 7.8.2) BRB HW block needs to be
initialized using fw values for all devices.
Otherwise ETS on 57712/578xx will not work.
Signed-off-by: Dmitry Kravkov <dmitry@broadcom.com>
Signed-off-by: Ariel Elior <ariele@broadcom.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

Pull power management update from Rafael J. Wysocki:
 "Change the email address of the powernow-k8 maintainer."

* tag 'pm-for-3.7-rc4' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:
  cpufreq / powernow-k8: Change maintainer's email address

Pull input subsystem fixes from Dmitry Torokhov:
 "Just a few driver fixes."

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/dtor/input:
  Input: tsc40 - remove wrong announcement of pressure support
  Input: lpc32xx-keys - select INPUT_MATRIXKMAP
  Input: pxa27x_keypad - clear pending interrupts on keypad config
  Input: wacom - correct bad Cintiq 24HD check
  Input: wacom - add INPUT_PROP_DIRECT flag to Cintiq 24HD
  Input: egalax_ts - get gpio from devicetree

Return errno - not an NFS4ERR_. This worked because NFS4ERR_ACCESS == EACCES.
Signed-off-by: Weston Andros Adamson <dros@netapp.com>
Signed-off-by: Trond Myklebust <Trond.Myklebust@netapp.com>

Pull more scsi target fixes from Nicholas Bellinger:
 "This series is a second round of target fixes for v3.7-rc4 that have
  come into target-devel over the last days, and are important enough to
  be applied ASAP.

  All are being CC'ed to stable.  The most important two are:

   - target: Re-add explict zeroing of INQUIRY bounce buffer memory to
     fix a regression for handling zero-length payloads, a bug that went
     during v3.7-rc1, and hit >= v3.6.3 stable.  (nab + paolo)

   - iscsi-target: Fix a long-standing missed R2T wakeup race in TX
     thread processing when using a single queue slot.  (Roland)

  Thanks to Roland & PureStorage team for helping to track down this
  long standing race with iscsi-target single queue slot operation.

  Also, the tcm_fc(FCoE) regression bug that was observed recently with
  -rc2 code has also been resolved with the cancel_delayed_work() return
  bugfix (commit c0158ca6: "workqueue: cancel_delayed_work() should
  return %false if work item is idle") now in -rc3.  Thanks again to Yi
  Zou, MDR, Robert Love @ Intel for helping to track this down."

* git://git.kernel.org/pub/scm/linux/kernel/git/nab/target-pending:
  target: Fix incorrect usage of nested IRQ spinlocks in ABORT_TASK path
  iscsi-target: Fix missed wakeup race in TX thread
  target: Avoid integer overflow in se_dev_align_max_sectors()
  target: Don't return success from module_init() if setup fails
  target: Re-add explict zeroing of INQUIRY bounce buffer memory

Pull hwmon fixes from Guenter Roeck:
 "An e-mail address update, and fix a compile error on SPARC"

* tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  hwmon: Only include of_match_table with CONFIG_OF_GPIO
  hwmon, fam15h_power: Change email address, MAINTAINERS entry

Pull FRV fixes from David Howells:
 "A collection of small fixes for the FRV architecture."

* tag 'frv-fixes-20121102' of git://git.kernel.org/pub/scm/linux/kernel/git/dhowells/linux-frv:
  frv: fix the broken preempt
  frv: switch to saner kernel_execve() semantics
  FRV: Fix the new-style kernel_thread() stuff
  FRV: Fix the preemption handling
  FRV: gcc-4.1.2 also inlines weak functions
  FRV: Don't objcopy the GNU build_id note
  FRV: Add missing linux/export.h #inclusions

Merge tag 'stable/for-linus-3.7-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen

Pull Xen bugfixes from Konrad Rzeszutek Wilk:
 - Use appropriate macros instead of hand-rolling our own (ARM).
 - Fixes if FB/KBD closed unexpectedly.
 - Fix memory leak in /dev/gntdev ioctl calls.
 - Fix overflow check in xenbus_file_write.
 - Document cleanup.
 - Performance optimization when migrating guests.

* tag 'stable/for-linus-3.7-rc4-tag' of git://git.kernel.org/pub/scm/linux/kernel/git/konrad/xen:
  xen/mmu: Use Xen specific TLB flush instead of the generic one.
  xen/arm: use the __HVC macro
  xen/xenbus: fix overflow check in xenbus_file_write()
  xen-kbdfront: handle backend CLOSED without CLOSING
  xen-fbfront: handle backend CLOSED without CLOSING
  xen/gntdev: don't leak memory from IOCTL_GNTDEV_MAP_GRANT_REF
  x86: remove obsolete comment from asm/xen/hypervisor.h

This hashtable implementation is using hlist buckets to provide a simple
hashtable to prevent it from getting reimplemented all over the kernel.
Signed-off-by: Sasha Levin <levinsasha928@gmail.com>
[ Merging this now, so that subsystems can start applying Sasha's
  patches that use this   - Linus ]
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Just get %icc2 into the state we would have after local_irq_disable()
and physical IRQ having happened since then.  Then we can simply
use preempt_schedule_irq() and be done with the whole mess.
Acked-by: David Howells <dhowells@redhat.com>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>