Since commit 45906855 ("mm/sl[aou]b: Common alignment code"), the
"ralign" automatic variable in __kmem_cache_create() may be used as
uninitialized.

The proper alignment defaults to BYTES_PER_WORD and can be overridden by
SLAB_RED_ZONE or the alignment specified by the caller.

This fixes https://bugzilla.kernel.org/show_bug.cgi?id=85031Signed-off-by: David Rientjes <rientjes@google.com>
Reported-by: Andrei Elovikov <a.elovikov@gmail.com>
Acked-by: Christoph Lameter <cl@linux.com>
Cc: Pekka Enberg <penberg@kernel.org>
Cc: Joonsoo Kim <iamjoonsoo.kim@lge.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

In PTE holes that contain VM_SOFTDIRTY VMAs, unmapped addresses before
VM_SOFTDIRTY VMAs are reported as softdirty by /proc/pid/pagemap.  This
bug was introduced in commit 68b5a652 ("mm: softdirty: respect
VM_SOFTDIRTY in PTE holes").  That commit made /proc/pid/pagemap look at
VM_SOFTDIRTY in PTE holes but neglected to observe the start of VMAs
returned by find_vma.

Tested:
  Wrote a selftest that creates a PMD-sized VMA then unmaps the first
  page and asserts that the page is not softdirty. I'm going to send the
  pagemap selftest in a later commit.
Signed-off-by: Peter Feiner <pfeiner@google.com>
Cc: Cyrill Gorcunov <gorcunov@openvz.org>
Cc: Pavel Emelyanov <xemul@parallels.com>
Cc: Hugh Dickins <hughd@google.com>
Cc: Naoya Horiguchi <n-horiguchi@ah.jp.nec.com>
Cc: "Kirill A. Shutemov" <kirill@shutemov.name>
Cc: Jamie Liu <jamieliu@google.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

There is a deadlock case which reported by Guozhonghua:
  https://oss.oracle.com/pipermail/ocfs2-devel/2014-September/010079.html

This case is caused by &res->spinlock and &dlm->master_lock
misordering in different threads.

It was introduced by commit 8d400b81 ("ocfs2/dlm: Clean up refmap
helpers").  Since lockres is new, it doesn't not require the
&res->spinlock.  So remove it.

Fixes: 8d400b81 ("ocfs2/dlm: Clean up refmap helpers")
Signed-off-by: Joseph Qi <joseph.qi@huawei.com>
Reviewed-by: joyce.xue <xuejiufei@huawei.com>
Reported-by: Guozhonghua <guozhonghua@h3c.com>
Cc: Joel Becker <jlbec@evilplan.org>
Cc: Mark Fasheh <mfasheh@suse.com>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

This bug leads to reproducible silent data loss, despite the use of
msync(), sync() and a clean unmount of the file system.  It is easily
reproducible with the following script:

  ----------------[BEGIN SCRIPT]--------------------
  mkfs.nilfs2 -f /dev/sdb
  mount /dev/sdb /mnt

  dd if=/dev/zero bs=1M count=30 of=/mnt/testfile

  umount /mnt
  mount /dev/sdb /mnt
  CHECKSUM_BEFORE="$(md5sum /mnt/testfile)"

  /root/mmaptest/mmaptest /mnt/testfile 30 10 5

  sync
  CHECKSUM_AFTER="$(md5sum /mnt/testfile)"
  umount /mnt
  mount /dev/sdb /mnt
  CHECKSUM_AFTER_REMOUNT="$(md5sum /mnt/testfile)"
  umount /mnt

  echo "BEFORE MMAP:\t$CHECKSUM_BEFORE"
  echo "AFTER MMAP:\t$CHECKSUM_AFTER"
  echo "AFTER REMOUNT:\t$CHECKSUM_AFTER_REMOUNT"
  ----------------[END SCRIPT]--------------------

The mmaptest tool looks something like this (very simplified, with
error checking removed):

  ----------------[BEGIN mmaptest]--------------------
  data = mmap(NULL, file_size - file_offset, PROT_READ | PROT_WRITE,
              MAP_SHARED, fd, file_offset);

  for (i = 0; i < write_count; ++i) {
        memcpy(data + i * 4096, buf, sizeof(buf));
        msync(data, file_size - file_offset, MS_SYNC))
  }
  ----------------[END mmaptest]--------------------

The output of the script looks something like this:

  BEFORE MMAP:    281ed1d5ae50e8419f9b978aab16de83  /mnt/testfile
  AFTER MMAP:     6604a1c31f10780331a6850371b3a313  /mnt/testfile
  AFTER REMOUNT:  281ed1d5ae50e8419f9b978aab16de83  /mnt/testfile

So it is clear, that the changes done using mmap() do not survive a
remount.  This can be reproduced a 100% of the time.  The problem was
introduced in commit 136e8770 ("nilfs2: fix issue of
nilfs_set_page_dirty() for page at EOF boundary").

If the page was read with mpage_readpage() or mpage_readpages() for
example, then it has no buffers attached to it.  In that case
page_has_buffers(page) in nilfs_set_page_dirty() will be false.
Therefore nilfs_set_file_dirty() is never called and the pages are never
collected and never written to disk.

This patch fixes the problem by also calling nilfs_set_file_dirty() if the
page has no buffers attached to it.

[akpm@linux-foundation.org: s/PAGE_SHIFT/PAGE_CACHE_SHIFT/]
Signed-off-by: Andreas Rohner <andreas.rohner@gmx.net>
Tested-by: Andreas Rohner <andreas.rohner@gmx.net>
Signed-off-by: Ryusuke Konishi <konishi.ryusuke@lab.ntt.co.jp>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

osb->vol_label is malloced in ocfs2_initialize_super but not freed if
error occurs or during umount, thus causing a memory leak.
Signed-off-by: Joseph Qi <joseph.qi@huawei.com>
Reviewed-by: joyce.xue <xuejiufei@huawei.com>
Cc: Mark Fasheh <mfasheh@suse.com>
Cc: Joel Becker <jlbec@evilplan.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>

Pull drm fixes from Dave Airlie:
 "Some final radeon and i915 fixes, black screens mostly"

* 'drm-fixes' of git://people.freedesktop.org/~airlied/linux:
  drm/radeon/cik: use a separate counter for CP init timeout
  drm/i915/hdmi: fix hdmi audio state readout
  drm/i915: Don't leak command parser tables on suspend/resume
  drm/radeon: add PX quirk for asus K53TK
  drm/radeon: add a backlight quirk for Amilo Xi 2550
  drm/radeon: add a module parameter for backlight control (v2)
  drm/radeon: Update IH_RB_RPTR register after each processed interrupt
  drm/radeon: Make IH ring overflow debugging output more useful
  drm/radeon: Clear RB_OVERFLOW bit earlier

- fix a backlight regression resulting in dark screen
- add a PX quirk to avoid a hang with runtime pm
- fix an init issue on the CIK compute rings
- fix IH ring buffer overflows gracefully

* 'drm-fixes-3.17' of git://people.freedesktop.org/~agd5f/linux:
  drm/radeon/cik: use a separate counter for CP init timeout
  drm/radeon: add PX quirk for asus K53TK
  drm/radeon: add a backlight quirk for Amilo Xi 2550
  drm/radeon: add a module parameter for backlight control (v2)
  drm/radeon: Update IH_RB_RPTR register after each processed interrupt
  drm/radeon: Make IH ring overflow debugging output more useful
  drm/radeon: Clear RB_OVERFLOW bit earlier

a couple of small fixes for 3.17 still.

* tag 'drm-intel-fixes-2014-09-24' of git://anongit.freedesktop.org/drm-intel:
  drm/i915/hdmi: fix hdmi audio state readout
  drm/i915: Don't leak command parser tables on suspend/resume

Pull networking fixes from David Miller:
 "Here is a quick pull request primarily meant to address the deconfig
  fallout from changing SCSI_NETLINK from being used via 'select' to
  being used via 'depends'.

  I applied a set of 5 patches written by Michal Marek, and then I
  carefully audited all of the remaining config files, basically:

   1) I scanned every arch config file, and if it mentioned CONFIG_INET
      or CONFIG_UNIX, I made sure it had CONFIG_NET=y

   2) After that, I scanned every arch config file, and if it did not
      have CONFIG_NET=y I made sure it did not reference any networking
      config options.

  Finally, we have some late breaking wireless fixes in here from John
  Linville and co"

[ And there's a sparc bpf fix snuck in too ]

* git://git.kernel.org/pub/scm/linux/kernel/git/davem/net:
  sparc: bpf_jit: fix loads from negative offsets
  parisc: Update defconfigs which were missing CONFIG_NET.
  powerpc: Update defconfigs which were missing CONFIG_NET.
  s390: Update defconfigs which were missing CONFIG_NET.
  mips: Update some more defconfigs which were missing CONFIG_NET.
  sparc: Set CONFIG_NET=y in defconfigs
  sh: Set CONFIG_NET=y in defconfigs
  powerpc: Set CONFIG_NET=y in defconfigs
  parisc: Set CONFIG_NET=y in defconfigs
  mips: Set CONFIG_NET=y in defconfigs
  brcmfmac: Fix off by one bug in brcmf_count_20mhz_channels()
  ath9k: Fix NULL pointer dereference on early irq
  net: rfkill: gpio: Fix clock status
  NFC: st21nfca: Fix potential depmod dependency cycle
  NFC: st21nfcb: Fix depmod dependency cycle
  NFC: microread: Potential overflows in microread_target_discovered()

- fix BPF_LD|ABS|IND from negative offsets:
  make sure to sign extend lower 32 bits in 64-bit register
  before calling C helpers from JITed code, otherwise 'int k'
  argument of bpf_internal_load_pointer_neg_helper() function
  will be added as large unsigned integer, causing packet size
  check to trigger and abort the program.

  It's worth noting that JITed code for 'A = A op K' will affect
  upper 32 bits differently depending whether K is simm13 or not.
  Since small constants are sign extended, whereas large constants
  are stored in temp register and zero extended.
  That is ok and we don't have to pay a penalty of sign extension
  for every sethi, since all classic BPF instructions have 32-bit
  semantics and we only need to set correct upper bits when
  transitioning from JITed code into C.

- though instructions 'A &= 0' and 'A *= 0' are odd, JIT compiler
  should not optimize them out
Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

John W. Linville says:

====================
pull request: wireless 2014-09-23

Please consider pulling this one last batch of fixes intended for the 3.17 stream!

For the NFC bits, Samuel says:

"Hopefully not too late for a handful of NFC fixes:

- 2 potential build failures for ST21NFCA and ST21NFCB, triggered by a
  depmod dependenyc cycle.
- One potential buffer overflow in the microread driver."

On top of that...

Emil Goode provides a fix for a brcmfmac off-by-one regression which
was introduced in the 3.17 cycle.

Loic Poulain fixes a polarity mismatch for a variable assignment
inside of rfkill-gpio.

Wojciech Dubowik prevents a NULL pointer dereference in ath9k.
====================
Signed-off-by: David S. Miller <davem@davemloft.net>

Commit df568d8e ("scsi: Use 'depends' with LIBFC instead of
'select'.")  removed what happened to be the only instance of 'select
NET'. Defconfigs that were relying on the select now lack networking
support.
Signed-off-by: David S. Miller <davem@davemloft.net>

Commit df568d8e ("scsi: Use 'depends' with LIBFC instead of
'select'.")  removed what happened to be the only instance of 'select
NET'. Defconfigs that were relying on the select now lack networking
support.
Signed-off-by: David S. Miller <davem@davemloft.net>

Commit df568d8e ("scsi: Use 'depends' with LIBFC instead of
'select'.")  removed what happened to be the only instance of 'select
NET'. Defconfigs that were relying on the select now lack networking
support.
Signed-off-by: David S. Miller <davem@davemloft.net>

Commit df568d8e ("scsi: Use 'depends' with LIBFC instead of
'select'.")  removed what happened to be the only instance of 'select
NET'. Defconfigs that were relying on the select now lack networking
support.
Signed-off-by: David S. Miller <davem@davemloft.net>

Commit 5d6be6a5 ("scsi_netlink : Make SCSI_NETLINK dependent on NET
instead of selecting NET") removed what happened to be the only instance
of 'select NET'. Defconfigs that were relying on the select now lack
networking support.
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Cc: sparclinux@vger.kernel.org
Signed-off-by: Michal Marek <mmarek@suse.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>

Commit 5d6be6a5 ("scsi_netlink : Make SCSI_NETLINK dependent on NET
instead of selecting NET") removed what happened to be the only instance
of 'select NET'. Defconfigs that were relying on the select now lack
networking support.
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Cc: linux-sh@vger.kernel.org
Signed-off-by: Michal Marek <mmarek@suse.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>

Commit 5d6be6a5 ("scsi_netlink : Make SCSI_NETLINK dependent on NET
instead of selecting NET") removed what happened to be the only instance
of 'select NET'. Defconfigs that were relying on the select now lack
networking support.
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Cc: linuxppc-dev@lists.ozlabs.org
Signed-off-by: Michal Marek <mmarek@suse.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>

Commit 5d6be6a5 ("scsi_netlink : Make SCSI_NETLINK dependent on NET
instead of selecting NET") removed what happened to be the only instance
of 'select NET'. Defconfigs that were relying on the select now lack
networking support.
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Cc: linux-parisc@vger.kernel.org
Signed-off-by: Michal Marek <mmarek@suse.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>

Commit 5d6be6a5 ("scsi_netlink : Make SCSI_NETLINK dependent on NET
instead of selecting NET") removed what happened to be the only instance
of 'select NET'. Defconfigs that were relying on the select now lack
networking support.
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Cc: linux-mips@linux-mips.org
Signed-off-by: Michal Marek <mmarek@suse.cz>
Signed-off-by: David S. Miller <davem@davemloft.net>

Pull one last block fix from Jens Axboe:
 "We've had an issue with scsi-mq where probing takes forever.  This was
  bisected down to the percpu changes for blk_mq_queue_enter(), and the
  fact we now suffer an RCU grace period when killing a queue.  SCSI
  creates and destroys tons of queues, so this let to 10s of seconds of
  stalls at boot for some.

  Tejun has a real fix for this, but it's too involved for 3.17.  So
  this is a temporary workaround to expedite the queue killing until we
  can fold in the real fix for 3.18 when that merge window opens"

* 'for-linus' of git://git.kernel.dk/linux-block:
  blk-mq, percpu_ref: implement a kludge for SCSI blk-mq stall during probe

Pull PCI fixes from Bjorn Helgaas:
 "Here are a few fixes that should be in v3.17.

   - Reverting "Don't scan random busses" covers up a CardBus regression
     having to do with allocating CardBus bus numbers.

   - Reverting "Make sure bus numbers stay within parents bounds" covers
     up an ACPI _CRS bug that makes us reconfigure a bridge, causing a
     broken device behind it to stop responding.

   - The pciehp timeout change fixes some code we added in v3.17.
     Without the fix, we can send a new hotplug command too early,
     before the timeout has expired.

  I hope for better fixes for the reverts, but those will have to come
  after v3.17"

* tag 'pci-v3.17-fixes-3' of git://git.kernel.org/pub/scm/linux/kernel/git/helgaas/pci:
  PCI: pciehp: Fix pcie_wait_cmd() timeout
  Revert "PCI: Make sure bus number resources stay within their parents bounds"
  Revert "PCI: Don't scan random busses in pci_scan_bridge()"

Pull crypto fixes from Herbert Xu:
 "This fixes three issues:

   - if ccp is loaded on a machine without ccp, it will incorrectly
     activate causing all requests to fail.  Fixed by preventing ccp
     from loading if hardware isn't available.

   - not all IRQs were enabled for the qat driver, leading to potential
     stalls when it is used

   - disabled buggy AVX CTR implementation in aesni"

* git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
  crypto: aesni - disable "by8" AVX CTR optimization
  crypto: ccp - Check for CCP before registering crypto algs
  crypto: qat - Enable all 32 IRQs

Pull media fixes from Mauro Carvalho Chehab:
 "For some last time fixes:
   - a regression detected on Kernel 3.16 related to VBI Teletext
     application breakage on drivers using videobuf2 (see
     https://bugzilla.kernel.org/show_bug.cgi?id=84401).  The bug was
     noticed on saa7134 (migrated to VB2 on 3.16), but also affects
     em28xx (migrated on 3.9 to VB2);
   - two additional sanity checks at videobuf2;
   - two fixups to restore proper VBI support at the em28xx driver;
   - two Kernel oops fixups (at cx24123 and cx2341x drivers);
   - a bug at adv7604 where an if was doing just the opposite as it
     would be expected;
   - some documentation fixups to match the behavior defined at the
     Kernel"

* tag 'media/v3.17-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:
  [media] em28xx-v4l: get rid of field "users" in struct em28xx_v4l2"
  [media] em28xx: fix VBI handling logic
  [media] DocBook media: improve the poll() documentation
  [media] DocBook media: fix the poll() 'no QBUF' documentation
  [media] vb2: fix VBI/poll regression
  [media] cx2341x: fix kernel oops
  [media] cx24123: fix kernel oops due to missing parent pointer
  [media] adv7604: fix inverted condition
  [media] media/radio: fix radio-miropcm20.c build with io.h header file
  [media] vb2: fix plane index sanity check in vb2_plane_cookie()
  [media] DocBook media: update version number and V4L2 changes
  [media] DocBook media: fix fieldname in struct v4l2_subdev_selection
  [media] vb2: fix vb2 state check when start_streaming fails
  [media] videobuf2-core.h: fix comment
  [media] videobuf2-core: add comments before the WARN_ON
  [media] videobuf2-dma-sg: fix for wrong GFP mask to sg_alloc_table_from_pages

Pull bugfixes for md/raid1 from Neil Brown:
 "It is amazing how much easier it is to find bugs when you know one is
  there.  Two bug reports resulted in finding 7 bugs!

  All are tagged for -stable.  Those that can't cause (rare) data
  corruption, cause lockups.

  Particularly, but not only, fixing new "resync" code"

* tag 'md/3.17-more-fixes' of git://git.neil.brown.name/md:
  md/raid1: fix_read_error should act on all non-faulty devices.
  md/raid1: count resync requests in nr_pending.
  md/raid1: update next_resync under resync_lock.
  md/raid1: Don't use next_resync to determine how far resync has progressed
  md/raid1: make sure resync waits for conflicting writes to complete.
  md/raid1: clean up request counts properly in close_sync()
  md/raid1:  be more cautious where we read-balance during resync.
  md/raid1: intialise start_next_window for READ case to avoid hang

blk-mq uses percpu_ref for its usage counter which tracks the number
of in-flight commands and used to synchronously drain the queue on
freeze.  percpu_ref shutdown takes measureable wallclock time as it
involves a sched RCU grace period.  This means that draining a blk-mq
takes measureable wallclock time.  One would think that this shouldn't
matter as queue shutdown should be a rare event which takes place
asynchronously w.r.t. userland.

Unfortunately, SCSI probing involves synchronously setting up and then
tearing down a lot of request_queues back-to-back for non-existent
LUNs.  This means that SCSI probing may take more than ten seconds
when scsi-mq is used.

This will be properly fixed by implementing a mechanism to keep
q->mq_usage_counter in atomic mode till genhd registration; however,
that involves rather big updates to percpu_ref which is difficult to
apply late in the devel cycle (v3.17-rc6 at the moment).  As a
stop-gap measure till the proper fix can be implemented in the next
cycle, this patch introduces __percpu_ref_kill_expedited() and makes
blk_mq_freeze_queue() use it.  This is heavy-handed but should work
for testing the experimental SCSI blk-mq implementation.
Signed-off-by: Tejun Heo <tj@kernel.org>
Reported-by: Christoph Hellwig <hch@infradead.org>
Link: http://lkml.kernel.org/g/20140919113815.GA10791@lst.de
Fixes: add703fd ("blk-mq: use percpu_ref for mq usage count")
Cc: Kent Overstreet <kmo@daterainc.com>
Cc: Jens Axboe <axboe@kernel.dk>
Tested-by: Christoph Hellwig <hch@lst.de>
Signed-off-by: Jens Axboe <axboe@fb.com>

The "by8" implementation introduced in commit 22cddcc7 ("crypto: aes
- AES CTR x86_64 "by8" AVX optimization") is failing crypto tests as it
handles counter block overflows differently. It only accounts the right
most 32 bit as a counter -- not the whole block as all other
implementations do. This makes it fail the cryptomgr test #4 that
specifically tests this corner case.

As we're quite late in the release cycle, just disable the "by8" variant
for now.
Reported-by: Romain Francoise <romain@orebokech.com>
Signed-off-by: Mathias Krause <minipli@googlemail.com>
Cc: Chandramouli Narayanan <mouli@linux.intel.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

If the ccp is built as a built-in module, then ccp-crypto (whether
built as a module or a built-in module) will be able to load and
it will register its crypto algorithms.  If the system does not have
a CCP this will result in -ENODEV being returned whenever a command
is attempted to be queued by the registered crypto algorithms.

Add an API, ccp_present(), that checks for the presence of a CCP
on the system.  The ccp-crypto module can use this to determine if it
should register it's crypto alogorithms.

Cc: stable@vger.kernel.org
Reported-by: Scot Doyle <lkml14@scotdoyle.com>
Signed-off-by: Tom Lendacky <thomas.lendacky@amd.com>
Tested-by: Scot Doyle <lkml14@scotdoyle.com>
Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>

Pull infiniband/rdma fixes from Roland Dreier:
 "Last late set of InfiniBand/RDMA fixes for 3.17:

   - fixes for the new memory region re-registration support
   - iSER initiator error path fixes
   - grab bag of small fixes for the qib and ocrdma hardware drivers
   - larger set of fixes for mlx4, especially in RoCE mode"

* tag 'rdma-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband: (26 commits)
  IB/mlx4: Fix VF mac handling in RoCE
  IB/mlx4: Do not allow APM under RoCE
  IB/mlx4: Don't update QP1 in native mode
  IB/mlx4: Avoid accessing netdevice when building RoCE qp1 header
  mlx4: Fix mlx4 reg/unreg mac to work properly with 0-mac addresses
  IB/core: When marshaling uverbs path, clear unused fields
  IB/mlx4: Avoid executing gid task when device is being removed
  IB/mlx4: Fix lockdep splat for the iboe lock
  IB/mlx4: Get upper dev addresses as RoCE GIDs when port comes up
  IB/mlx4: Reorder steps in RoCE GID table initialization
  IB/mlx4: Don't duplicate the default RoCE GID
  IB/mlx4: Avoid null pointer dereference in mlx4_ib_scan_netdevs()
  IB/iser: Bump version to 1.4.1
  IB/iser: Allow bind only when connection state is UP
  IB/iser: Fix RX/TX CQ resource leak on error flow
  RDMA/ocrdma: Use right macro in query AH
  RDMA/ocrdma: Resolve L2 address when creating user AH
  mlx4: Correct error flows in rereg_mr
  IB/qib: Correct reference counting in debugfs qp_stats
  IPoIB: Remove unnecessary port query
  ...

Pull sound fixes from Takashi Iwai:
 "One fix is about a buggy computation in PCM API function Clemens
  spotted out, but the impact must be really small as no one really uses
  it in user-space side.

  The rest are a trivial fix for a HD-audio model and a USB-audio
  device-specific regression fix, so all look fairly safe to apply"

* tag 'sound-3.17-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound:
  ALSA: snd-usb-caiaq: Fix LED commands for Kore controller
  ALSA: pcm: fix fifo_size frame calculation
  ALSA: hda - Add fixup model name lookup for Lemote A1205

Pull final block fixes from Jens Axboe:
 "This week and last we've been fixing some corner cases related to
  blk-mq, mostly.  I ended up pulling most of that out of for-linus
  yesterday, which is why the branch looks fresh.  The rest were
  postponed for 3.18.

  This pull request contains:

   - Fix from Christoph, avoiding a stack overflow when FUA insertion
     would recursive infinitely.

   - Fix from David Hildenbrand on races between the timeout handler and
     uninitialized requests.  Fixes a real issue that virtio_blk has run
     into.

   - A few fixes from me:

        - Ensure that request deadline/timeout is ordered before the
          request is marked as started.

        - A potential oops on out-of-memory, when we scale the queue
          depth of the device and retry.

        - A hang fix on requeue from SCSI, where the hardware queue
          would be stopped when we attempt to re-run it (and hence
          nothing would happen, stalling progress).

        - A fix for commit 2da78092, where the cleanup path was moved
          to RCU, but a debug might_sleep() was inadvertently left in
          the code.  This causes warnings for people"

* 'for-linus' of git://git.kernel.dk/linux-block:
  genhd: fix leftover might_sleep() in blk_free_devt()
  blk-mq: use blk_mq_start_hw_queues() when running requeue work
  blk-mq: fix potential oops on out-of-memory in __blk_mq_alloc_rq_maps()
  blk-mq: avoid infinite recursion with the FUA flag
  blk-mq: Avoid race condition with uninitialized requests
  blk-mq: request deadline must be visible before marking rq as started

Pull parisc fixes from Helge Deller:
 "We avoid using -mfast-indirect-calls for 64bit kernel builds to
  prevent building an unbootable kernel due to latest gcc changes.

  In the pdc_stable/firmware-access driver we fix a few possible stack
  overflows and we now call secure_computing_strict() instead of
  secure_computing() which fixes upcoming SECCOMP patches in the
  for-next trees"

* 'parisc-3.17-7' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
  parisc: Only use -mfast-indirect-calls option for 32-bit kernel builds
  parisc: pdc_stable.c: Avoid potential stack overflows
  parisc: pdc_stable.c: Cleaning up unnecessary use of memset in conjunction with strncpy
  parisc: ptrace: use secure_computing_strict()

In spite of what the GCC manual says, the -mfast-indirect-calls has
never been supported in the 64-bit parisc compiler. Indirect calls have
always been done using function descriptors irrespective of the
-mfast-indirect-calls option.

Recently, it was noticed that a function descriptor was always requested
when the -mfast-indirect-calls option was specified. This caused
problems when the option was used in  application code and doesn't make
any sense because the whole point of the option is to avoid using a
function descriptor for indirect calls.

Fixing this broke 64-bit kernel builds.

I will fix GCC but for now we need the attached change. This results in
the same kernel code as before.
Signed-off-by: John David Anglin <dave.anglin@bell.net>
Cc: stable@vger.kernel.org  # v3.0+
Signed-off-by: Helge Deller <deller@gmx.de>

Pull ia64 defconfig update from Tony Luck:
 "Need to rebuild defconfig files to cope with removal of "select NET"
  in drivers/scsi/Kconfig"

* tag 'please-pull-defconfig' of git://git.kernel.org/pub/scm/linux/kernel/git/aegl/linux:
  [IA64] refresh arch/ia64/configs/* using "make savedefconfig"

Pull hwmon fixes from Guenter Roeck:
 - Fix a resource leak in tmp103 driver
 - Add support for two more processors to fam15h_power driver
 - Also fix a bug in the same driver to only report the power level on
   chips which actually support reporting it

* tag 'hwmon-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:
  hwmon: (tmp103) Fix resource leak bug in tmp103 temperature sensor driver
  hwmon: (fam15h_power) Add support for two more processors
  hwmon: (fam15h_power) Make actual power reporting conditional

Prompted by a change to drivers/scsi/Kconfig which used to do a
"select NET" but now does a "depends on NET". This meant that some
configurations ended up without CONFIG_NET=y

Signed-off-by Tony Luck <tony.luck@intel.com>

Pull another kvm fix from Paolo Bonzini:
 "Another fix for 3.17 arrived at just the wrong time, after I had sent
  yesterday's pull request.  Normally I would have waited for some other
  patches to pile up, but since 3.17 might be short here it is"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
  arm/arm64: KVM: Fix unaligned access bug on gicv2 access

Pull cgroup fix from Tejun Heo:
 "One late fix for cgroup.

  I was waiting for another set of fixes for a long-standing obscure
   cpuset bug but am not sure whether they'll be ready before v3.17
  release.  This one is a simple fix for a mutex unlock balance bug in
  an allocation failure path in pidlist_array_load().

  The bug was introduced in v3.14 and the fix is tagged for -stable"

* 'for-3.17-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:
  cgroup: fix unbalanced locking

In the brcmf_count_20mhz_channels function we are looping through a list
of channels received from firmware. Since the index of the first channel
is 0 the condition leads to an off by one bug. This is causing us to hit
the WARN_ON_ONCE(1) calls in the brcmu_d11n_decchspec function, which is
how I discovered the bug.

Introduced by:
commit b48d8916
("brcmfmac: rework wiphy structure setup")
Acked-by: Arend van Spriel <arend@broadcom.com>
Signed-off-by: Emil Goode <emilgoode@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>

Otherwise we may fail to init the second compute ring.
Noticed-by: Christian König <christian.koenig@amd.com>
Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Cc: stable@vger.kernel.org