[PATCH 3.10 000/319] 3.10.105-stable review

[Willy Tarreau]

This is the start of the stable review cycle for the 3.10.105 release.

NOTE! This series is quite large as I've caught up with many pending fixes
that were submitted for -stable long ago and that I had been holding on
since 3.10.103 due to limited time. Most fixes address stability issues
in crypto, net, usb, scsi, kvm, random info leaks, and risks of oopses
in various subsystems. My pending queue is now empty.

It builds fine here on i586 and x86_64 for allmodconfig and on armv7 with
mvebu_defconfig.

All patches will be posted as a response to this one. If anyone has any
issue with these being applied, please let me know. If anyone thinks some
important patches are missing and should be added prior to the release,
please report them quickly with their respective mainline commit IDs.

Responses should be made by Fri Feb 10 10:00:00 CET 2017.
Anything received after that time might be too late. If someone
wants a bit more time for a deeper review, please let me know.

The whole patch series can be found in one patch at :
   https://kernel.org/pub/linux/kernel/v3.x/stable-review/patch-3.10.105-rc1.gz

The shortlog and diffstat are appended below.

Thanks,
Willy

===============


Al Viro (28):
  avr32: fix copy_from_user()
  microblaze: fix __get_user()
  microblaze: fix copy_from_user()
  mn10300: failing __get_user() and get_user() should zero
  m32r: fix __get_user()
  sh64: failing __get_user() should zero
  score: fix __get_user/get_user
  s390: get_user() should zero on failure
  asm-generic: make get_user() clear the destination on errors
  frv: fix clear_user()
  cris: buggered copy_from_user/copy_to_user/clear_user
  blackfin: fix copy_from_user()
  score: fix copy_from_user() and friends
  sh: fix copy_from_user()
  hexagon: fix strncpy_from_user() error return
  mips: copy_from_user() must zero the destination on access_ok()
    failure
  asm-generic: make copy_from_user() zero the destination properly
  alpha: fix copy_from_user()
  metag: copy_from_user() should zero the destination on access_ok()
    failure
  parisc: fix copy_from_user()
  openrisc: fix copy_from_user()
  mn10300: copy_from_user() should zero on access_ok() failure...
  sparc32: fix copy_from_user()
  ppc32: fix copy_from_user()
  ia64: copy_from_user() should zero the destination on access_ok()
    failure
  fix fault_in_multipages_...() on architectures with no-op access_ok()
  fix memory leaks in tracing_buffers_splice_read()
  arc: don't leak bits of kernel stack into coredump

Alan Stern (3):
  USB: validate wMaxPacketValue entries in endpoint descriptors
  USB: fix typo in wMaxPacketSize validation
  USB: change bInterval default to 10 ms

Alex Vesker (2):
  IB/ipoib: Don't allow MC joins during light MC flush
  IB/mlx4: Fix incorrect MC join state bit-masking on SR-IOV

Alexander Usyskin (1):
  mei: bus: fix received data size check in NFC fixup

Alexey Khoroshilov (2):
  USB: serial: mos7720: fix non-atomic allocation in write path
  USB: serial: mos7840: fix non-atomic allocation in write path

Alexey Klimov (1):
  USB: serial: fix memleak in driver-registration error path

Andrew Bresticker (1):
  pstore/ram: Use memcpy_fromio() to save old buffer

Andrey Grodzovsky (2):
  scsi: mpt3sas: Fix secure erase premature termination
  mpt2sas: Fix secure erase premature termination

Andrey Ryabinin (2):
  coredump: fix unfreezable coredumping task
  mpi: Fix NULL ptr dereference in mpi_powm() [ver #3]

Andy Lutomirski (1):
  x86/traps: Ignore high word of regs->cs in early_idt_handler_common

Anoob Soman (1):
  packet: call fanout_release, while UNREGISTERING a netdev

Anton Blanchard (1):
  powerpc/vdso64: Use double word compare on pointers

Ard Biesheuvel (1):
  crypto: cryptd - initialize child shash_desc on import

Arend Van Spriel (1):
  brcmfmac: avoid potential stack overflow in brcmf_cfg80211_start_ap()

Arnaldo Carvalho de Melo (1):
  perf symbols: Fixup symbol sizes before picking best ones

Arnd Bergmann (1):
  staging: iio: ad5933: avoid uninitialized variable in error case

Ashish Samant (1):
  ocfs2: fix start offset to ocfs2_zero_range_for_truncate()

Balbir Singh (1):
  sched/core: Fix a race between try_to_wake_up() and a woken up task

Baoquan He (1):
  iommu/amd: Free domain id when free a domain of struct dma_ops_domain

Bart Van Assche (2):
  IB/srpt: Simplify srpt_handle_tsk_mgmt()
  dm: mark request_queue dead before destroying the DM device

Ben Hutchings (1):
  xen-pciback: Add name prefix to global 'permissive' variable

Boris Brezillon (1):
  UBI: fastmap: scrub PEB when bitflips are detected in a free PEB EC
    header

Brian King (1):
  scsi: ibmvfc: Fix I/O hang when port is not mapped

Brian Norris (2):
  mtd: blkdevs: fix potential deadlock + lockdep warnings
  mwifiex: printk() overflow with 32-byte SSIDs

Ching Huang (1):
  scsi: arcmsr: Send SYNCHRONIZE_CACHE command to firmware

Chris Metcalf (1):
  tile: avoid using clocksource_cyc2ns with absolute cycle count

Christian Borntraeger (2):
  kernel: Provide READ_ONCE and ASSIGN_ONCE
  kernel: Change ASSIGN_ONCE(val, x) to WRITE_ONCE(x, val)

Christian Kö (1):
  drm/radeon: fix radeon_move_blit on 32bit systems

Chuck Lever (2):
  NFS: Don't drop CB requests with invalid principals
  svc: Avoid garbage replies when pc_func() returns rpc_drop_reply

Cyrille Pitchen (1):
  i2c: at91: fix write transfers by clearing pending interrupt first

Daeho Jeong (2):
  ext4: avoid modifying checksum fields directly during checksum
    verification
  ext4: reinforce check of i_dtime when clearing high fields of uid and
    gid

Dan Carpenter (10):
  avr32: off by one in at32_init_pio()
  usb: gadget: fsl_qe_udc: signedness bug in qe_get_frame()
  scsi: zfcp: spin_lock_irqsave() is not nestable
  scsi: arcmsr: Buffer overflow in arcmsr_iop_message_xfer()
  hostfs: Freeing an ERR_PTR in hostfs_fill_sb_common()
  qxl: check for kmap failures
  em28xx-i2c: rt_mutex_trylock() returns zero on failure
  mtd: pmcmsp-flash: Allocating too much in init_msp_flash()
  tools/vm/slabinfo: fix an unintentional printf
  mfd: 88pm80x: Double shifting bug in suspend/resume

Daniel Glöer (1):
  mmc: block: don't use CMD23 with very old MMC cards

Daniel Mentz (1):
  lib/genalloc.c: start search from start of chunk

Daniel Vetter (1):
  drm: Reject page_flip for !DRIVER_MODESET

Darrick J. Wong (1):
  libxfs: clean up _calc_dquots_per_chunk

Dave Chinner (1):
  xfs: fix superblock inprogress check

Dave Gerlach (1):
  hwrng: omap - Only fail if pm_runtime_get_sync returns < 0

David Howells (1):
  KEYS: Fix short sprintf buffer in /proc/keys show function

David Vrabel (3):
  xen: Add RING_COPY_REQUEST()
  xen-netback: don't use last request to determine minimum Tx credit
  xen-netback: use RING_COPY_REQUEST() throughout

Denys Vlasenko (1):
  include/stddef.h: Move offsetofend() from vfio.h to a generic kernel
    header

Ding Tianhong (1):
  rcu: Fix soft lockup for rcu_nocb_kthread

Dmitry Torokhov (3):
  Input: i8042 - break load dependency between atkbd/psmouse and i8042
  Input: i8042 - set up shared ps2_cmd_mutex for AUX ports
  Input: ili210x - fix permissions on "calibrate" attribute

Dmitry Vyukov (1):
  tty: limit terminal size to 4M chars

Douglas Caetano dos Santos (1):
  tcp: fix wrong checksum calculation on MTU probing

Eli Cooper (2):
  ip6_tunnel: Clear IP6CB in ip6tunnel_xmit()
  ipv4: Set skb->protocol properly for local output

Emmanouil Maroudas (1):
  EDAC: Increment correct counter in edac_inc_ue_error()

Emrah Demir (1):
  mISDN: Fixing missing validation in base_sock_bind()

Erez Shitrit (2):
  IB/ipoib: Fix memory corruption in ipoib cm mode connect flow
  IB/core: Fix use after free in send_leave function

Eric Dumazet (12):
  ipv6: dccp: fix out of bound access in dccp_v6_err()
  ipv6: dccp: add missing bind_conflict to dccp_ipv6_mapped
  tcp: fix use after free in tcp_xmit_retransmit_queue()
  tcp: properly scale window in tcp_v[46]_reqsk_send_ack()
  tcp: fix overflow in __tcp_retransmit_skb()
  tcp: take care of truncations done by sk_filter()
  net: fix sk_mem_reclaim_partial()
  net: avoid sk_forward_alloc overflows
  net: clear sk_err_soft in sk_clone_lock()
  net: mangle zero checksum in skb_checksum_help()
  dccp: do not send reset to already closed sockets
  dccp: fix out of bound access in dccp_v4_err()

Ewan D. Milne (1):
  scsi: scsi_debug: Fix memory leak if LBP enabled and module is
    unloaded

Fabio Estevam (1):
  mmc: mxs: Initialize the spinlock prior to using it

Felipe Balbi (3):
  usb: dwc3: gadget: increment request->actual once
  usb: gadget: function: u_ether: don't starve tx request queue
  usb: gadget: u_ether: remove interrupt throttling

Felix Fietkau (1):
  mac80211: fix purging multicast PS buffer queue

Florian Fainelli (2):
  brcmsmac: Free packet if dma_mapping_error() fails in dma_rxfill
  brcmsmac: Initialize power in brcms_c_stf_ss_algo_channel_get()

Furquan Shaikh (1):
  pstore/ram: Use memcpy_toio instead of memcpy

Gavin Li (1):
  cdc-acm: fix wrong pipe type on rx interrupt xfers

Gavin Shan (2):
  powerpc/powernv: Use CPU-endian PEST in pnv_pci_dump_p7ioc_diag_data()
  drivers/vfio: Rework offsetofend()

Glauber Costa (1):
  cfq: fix starvation of asynchronous writes

Greg Kroah-Hartman (1):
  usb: misc: legousbtower: Fix NULL pointer deference

Guenter Roeck (3):
  avr32: fix 'undefined reference to `___copy_from_user'
  openrisc: fix the fix of copy_from_user()
  metag: Only define atomic_dec_if_positive conditionally

H.J. Lu (1):
  x86/build: Build compressed x86 kernels as PIE

Hannes Frederic Sowa (2):
  ipv6: split duplicate address detection and router solicitation timer
  ipv6: move DAD and addrconf_verify processing to workqueue

Herbert Xu (17):
  crypto: algif_skcipher - Require setkey before accept(2)
  crypto: af_alg - Disallow bind/setkey/... after accept(2)
  crypto: af_alg - Add nokey compatibility path
  crypto: algif_skcipher - Add nokey compatibility path
  crypto: hash - Add crypto_ahash_has_setkey
  crypto: shash - Fix has_key setting
  crypto: algif_hash - Require setkey before accept(2)
  crypto: skcipher - Add crypto_skcipher_has_setkey
  crypto: algif_skcipher - Add key check exception for cipher_null
  crypto: af_alg - Allow af_af_alg_release_parent to be called on nokey
    path
  crypto: algif_hash - Remove custom release parent function
  crypto: algif_skcipher - Remove custom release parent function
  crypto: af_alg - Forbid bind(2) when nokey child sockets are present
  crypto: algif_hash - Fix race condition in hash_check_key
  crypto: algif_skcipher - Fix race condition in skcipher_check_key
  crypto: algif_skcipher - Load TX SG list after waiting
  crypto: skcipher - Fix blkcipher walk OOM crash

Ido Yariv (1):
  KVM: x86: fix wbinvd_dirty_mask use-after-free

Ignacio Alvarado (1):
  KVM: Disable irq while unregistering user notifier

Jack Morgenstein (1):
  net/mlx4_core: Allow resetting VF admin mac to zero

Jaewon Kim (1):
  ratelimit: fix bug in time interval by resetting right begin time

James Hogan (4):
  KVM: MIPS: Precalculate MMIO load resume PC
  KVM: MIPS: Drop other CPU ASIDs on guest MMU changes
  KVM: MIPS: Make ERET handle ERL before EXL
  arm64: Define AT_VECTOR_SIZE_ARCH for ARCH_DLINFO

Jan Beulich (1):
  x86/mm/xen: Suppress hugetlbfs in PV guests

Jan Kara (1):
  isofs: Do not return EACCES for unknown filesystems

Jan Remmet (1):
  regulator: tps65910: Work around silicon erratum SWCZ010

Jan Viktorin (1):
  uio: fix dmem_region_start computation

Jann Horn (2):
  swapfile: fix memory corruption via malformed swapfile
  netfilter: fix namespace handling in nf_log_proc_dostring

Jeff Mahoney (2):
  reiserfs: fix "new_insert_key may be used uninitialized ..."
  btrfs: ensure that file descriptor used with subvol ioctls is a dir

Jeremy Linton (1):
  net: sky2: Fix shutdown crash

Jim Lin (1):
  usb: xhci: Fix panic if disconnect

Jiri Kosina (1):
  x86/mm/pat, /dev/mem: Remove superfluous error message

Jiri Slaby (2):
  tty: vt, fix bogus division in csi_J
  net: sctp, forbid negative length

Joe Perches (2):
  stddef.h: move offsetofend inside #ifndef/#endif guard, neaten
  ipc: remove use of seq_printf return value

Joerg Roedel (1):
  iommu/amd: Update Alias-DTE in update_device_table()

Johan Hovold (4):
  USB: kobil_sct: fix non-atomic allocation in write path
  USB: serial: cp210x: fix tiocmget error handling
  mfd: core: Fix device reference leak in mfd_clone_cell
  PM / sleep: fix device reference leak in test_suspend

Johannes Berg (2):
  mac80211: discard multicast and 4-addr A-MSDUs
  cfg80211: limit scan results cache size

John David Anglin (1):
  parisc: Ensure consistent state when switching to kernel stack at
    syscall entry

Joseph Qi (1):
  ocfs2/dlm: fix race between convert and migration

Juergen Gross (1):
  x86/xen: fix upper bound of pmd loop in xen_cleanhighmap()

Karl Beldan (1):
  mtd: nand: davinci: Reinitialize the HW ECC engine in 4bit hwctl

Kashyap Desai (1):
  scsi: megaraid_sas: Fix data integrity failure for JBOD (passthrough)
    devices

Kinglong Mee (1):
  NFSD: Using free_conn free connection

Konrad Rzeszutek Wilk (6):
  xen/pciback: Save xen_pci_op commands before processing it
  xen/pciback: Return error on XEN_PCI_OP_enable_msi when device has MSI
    or MSI-X enabled
  xen/pciback: Return error on XEN_PCI_OP_enable_msix when device has
    MSI or MSI-X enabled
  xen/pciback: Do not install an IRQ handler for MSI interrupts.
  xen/pciback: For XEN_PCI_OP_disable_msi[|x] only disable if device has
    MSI(X) enabled.
  xen/pciback: Don't allow MSI-X ops if PCI_COMMAND_MEMORY is not set.

Konstantin Khlebnikov (2):
  ext4: use __GFP_NOFAIL in ext4_free_blocks()
  net: ratelimit warnings about dst entry refcount underflow or overflow

Konstantin Shkolnyy (1):
  USB: serial: cp210x: fix hardware flow-control disable

Krzysztof Kozlowski (2):
  hwrng: exynos - Disable runtime PM on probe failure
  thermal: hwmon: Properly report critical temperature in sysfs

Lance Richardson (1):
  ip6_gre: fix flowi6_proto value in ip6gre_xmit_other()

Linus Torvalds (2):
  Fix potential infoleak in older kernels
  kernel: make READ_ONCE() valid on const arguments

Linus Walleij (2):
  iio: accel: kxsd9: Fix raw read return
  iio: accel: kxsd9: Fix scaling bug

Liu Gang (1):
  gpio: mpc8xxx: Correct irq handler function

Liu ShuoX (1):
  pstore: Fix buffer overflow while write offset equal to buffer size

Long Li (1):
  hv: do not lose pending heartbeat vmbus packets

Maciej S. Szmigiero (1):
  mISDN: Support DR6 indication in mISDNipac driver

Mahesh Bandewar (1):
  bonding: Fix bonding crash

Manfred Spraul (1):
  ipc/sem.c: fix complex_count vs. simple op race

Marcelo Ricardo Leitner (2):
  sctp: validate chunk len before actually using it
  sctp: assign assoc_id earlier in __sctp_connect

Marcin Nowakowski (1):
  MIPS: ptrace: Fix regs_return_value for kernel context

Mark Bloch (1):
  IB/cm: Mark stale CM id's whenever the mad agent was unregistered

Mark Rutland (1):
  arm64: avoid returning from bad_mode

Markus Elfring (1):
  driver core: Delete an unnecessary check before the function call
    "put_device"

Matan Barak (1):
  IB/mlx4: Fix create CQ error flow

Mauro Carvalho Chehab (4):
  mb86a20s: fix the locking logic
  mb86a20s: fix demod settings
  cx231xx: don't return error on success
  cx231xx: fix GPIOs for Pixelview SBTVD hybrid

Max Staudt (1):
  fbdev/efifb: Fix 16 color palette entry calculation

Michael S. Tsirkin (1):
  x86/um: reuse asm-generic/barrier.h

Michael Walle (1):
  hwmon: (adt7411) set bit 3 in CFG1 register

Michal Hocko (1):
  kernel/fork: fix CLONE_CHILD_CLEARTID regression in nscd

Michal Kubecek (2):
  net: disable fragment reassembly if high_thresh is set to zero
  ipvs: count pre-established TCP states as active

Michal KubeÄek (1):
  ipv6: don't call fib6_run_gc() until routing is ready

Michel Däer (1):
  drm/radeon: Ensure vblank interrupt is enabled on DPMS transition to
    on

Mike Galbraith (1):
  reiserfs: Unlock superblock before calling reiserfs_quota_on_mount()

Mike Snitzer (1):
  dm flakey: fix reads to be issued if drop_writes configured

Ming Lei (2):
  scsi: Fix use-after-free
  driver core: fix race between creating/querying glue dir and its
    cleanup

Myron Stowe (1):
  PCI: Handle read-only BARs on AMD CS553x devices

Nicholas Mc Guire (1):
  MIPS: KVM: Fix unused variable build warning

Nicolas Dichtel (1):
  ipv6: correctly add local routes when lo goes up

Nikolay Aleksandrov (1):
  ipmr, ip6mr: fix scheduling while atomic and a deadlock with
    ipmr_get_route

Nishanth Menon (1):
  hwrng: omap - Fix assumption that runtime_get_sync will always succeed

Oleg Nesterov (1):
  fs/super.c: fix race between freeze_super() and thaw_super()

Oliver Hartkopp (1):
  can: bcm: fix warning in bcm_connect/proc_register

Oliver Neukum (1):
  kaweth: fix firmware download

Ondrej MosnÃÄek (1):
  crypto: gcm - Fix IV buffer size in crypto_gcm_setkey

Pan Xinhui (1):
  powerpc/nvram: Fix an incorrect partition merge

Paolo Abeni (1):
  ip6_tunnel: disable caching when the traffic class is inherited

Paolo Bonzini (1):
  KVM: x86: fix missed SRCU usage in kvm_lapic_set_vapic_addr

Paul Burton (1):
  MIPS: Malta: Fix IOCU disable switch read for MIPS64

Paul E. McKenney (1):
  compiler: Allow 1- and 2-byte smp_load_acquire() and
    smp_store_release()

Paul Mackerras (2):
  powerpc/mm: Don't alias user region to other regions below PAGE_OFFSET
  powerpc/64: Fix incorrect return value from __copy_tofrom_user

Peter Chen (1):
  usb: chipidea: move the lock initialization to core file

Peter Hurley (1):
  tty: Prevent ldisc drivers from re-using stale tty fields

Peter Ujfalusi (1):
  ASoC: omap-mcpdm: Fix irq resource handling

Peter Zijlstra (4):
  sched/core: Fix an SMP ordering race in try_to_wake_up() vs.
    schedule()
  perf: Tighten (and fix) the grouping condition
  arch: Introduce smp_load_acquire(), smp_store_release()
  locking: Remove atomicy checks from {READ,WRITE}_ONCE

Petr Vandrovec (1):
  Fix USB CB/CBI storage devices with CONFIG_VMAP_STACK=y

Punit Agrawal (1):
  ACPI / APEI: Fix incorrect return value of ghes_proc()

Radim KrÄmÃÅ (1):
  KVM: nVMX: postpone VMCS changes on MSR_IA32_APICBASE write

Richard Weinberger (5):
  ubifs: Fix xattr_names length in exit paths
  UBIFS: Fix possible memory leak in ubifs_readdir()
  ubifs: Abort readdir upon error
  ubifs: Fix regression in ubifs_readdir()
  drbd: Fix kernel_sendmsg() usage - potential NULL deref

Robin Murphy (1):
  ARM: 8616/1: dt: Respect property size when parsing CPUs

Roger Pau Monné1):
  xen-blkback: only read request operation from shared ring once

Ross Zwisler (1):
  ext4: allow DAX writeback for hole punch

Russell King (2):
  ARM: sa1100: clear reset status prior to reboot
  ARM: sa1111: fix pcmcia suspend/resume

Sabrina Dubroca (1):
  ipv6: fix rtnl locking in setsockopt for anycast and multicast

Sara Sharon (1):
  iwlwifi: pcie: fix access to scratch buffer

Scot Doyle (1):
  vt: clear selection before resizing

Sebastian Andrzej Siewior (2):
  x86/mm: Disable preemption during CR3 read+write
  pstore/core: drop cmpxchg based updates

Sergei Miroshnichenko (1):
  can: dev: fix deadlock reported after bus-off

Srinivas Ramana (1):
  ARM: 8618/1: decompressor: reset ttbcr fields to use TTBR0 on ARMv7

Stefan Haberland (1):
  s390/dasd: fix hanging device after clear subchannel

Stefan Richter (2):
  firewire: net: guard against rx buffer overflows
  firewire: net: fix fragmented datagram_size off-by-one

Steffen Maier (10):
  zfcp: fix fc_host port_type with NPIV
  zfcp: fix ELS/GS request&response length for hardware data router
  zfcp: close window with unblocked rport during rport gone
  zfcp: retain trace level for SCSI and HBA FSF response records
  zfcp: restore: Dont use 0 to indicate invalid LUN in rec trace
  zfcp: trace on request for open and close of WKA port
  zfcp: restore tracing of handle for port and LUN with HBA records
  zfcp: fix D_ID field with actual value on tracing SAN responses
  zfcp: fix payload trace length for SAN request&response
  zfcp: trace full payload of all SAN records (req,resp,iels)

Stephen Suryaputra Lin (1):
  ipv4: use new_gw for redirect neigh lookup

Steven Rostedt (1):
  x86/paravirt: Do not trace _paravirt_ident_*() functions

Steven Rostedt (Red Hat) (1):
  tracing: Move mutex to protect against resetting of seq data

Sumit Saxena (1):
  scsi: megaraid_sas: fix macro MEGASAS_IS_LOGICAL to avoid regression

Takashi Iwai (3):
  ALSA: rawmidi: Fix possible deadlock with virmidi registration
  ALSA: ali5451: Fix out-of-bound position reporting
  ALSA: pcm : Call kill_fasync() in stream lock

Tariq Toukan (1):
  IB/uverbs: Fix leak of XRC target QPs

Tejun Heo (1):
  timers: Use proper base migration in add_timer_on()

Theodore Ts'o (2):
  ext4: validate that metadata blocks do not overlap superblock
  ext4: sanity check the block and cluster size at mount time

Trond Myklebust (2):
  NFSv4.x: Fix a refcount leak in nfs_callback_up_net
  NFSv4: Open state recovery must account for file permission changes

Vegard Nossum (5):
  ALSA: timer: fix NULL pointer dereference in read()/ioctl() race
  ALSA: timer: fix division by zero after SNDRV_TIMER_IOCTL_CONTINUE
  ALSA: timer: fix NULL pointer dereference on memory allocation failure
  fs/seq_file: fix out-of-bounds read
  net/irda: handle iriap_register_lsap() allocation failure

Vincent Stehlé1):
  ubifs: Fix assertion in layout_in_gaps()

Vineet Gupta (1):
  ARC: uaccess: get_user to zero out dest in cause of fault

Vladimir Zapolskiy (1):
  i2c: core: fix NULL pointer dereference under race condition

WANG Cong (2):
  ppp: defer netns reference release for ppp channel
  neigh: check error pointer instead of NULL for ipv4_neigh_lookup()

Wanpeng Li (1):
  x86/apic: Do not init irq remapping if ioapic is disabled

Wei Yongjun (1):
  ipv6: addrconf: fix dev refcont leak when DAD failed

Will Deacon (2):
  arm64: spinlocks: implement smp_mb__before_spinlock() as smp_mb()
  arm64: debug: avoid resetting stepping state machine when
    TIF_SINGLESTEP

Xiaolong Ye (1):
  PM / devfreq: Fix incorrect type issue.

Yadi.hu (1):
  i2c-eg20t: fix race between i2c init and interrupt enable

Yoshihiro Shimoda (1):
  usb: renesas_usbhs: fix clearing the {BRDY,BEMP}STS condition

zhong jiang (1):
  mm,ksm: fix endless looping in allocating memory when ksm enable

 arch/alpha/include/asm/uaccess.h                   |  19 +-
 arch/arc/include/asm/uaccess.h                     |  11 +-
 arch/arc/kernel/signal.c                           |  11 +-
 arch/arm/boot/compressed/head.S                    |   2 +-
 arch/arm/common/sa1111.c                           |  22 +-
 arch/arm/include/asm/barrier.h                     |  15 ++
 arch/arm/kernel/devtree.c                          |  14 +-
 arch/arm/mach-sa1100/generic.c                     |   2 +
 arch/arm64/include/asm/barrier.h                   |  50 ++++
 arch/arm64/include/asm/elf.h                       |   1 +
 arch/arm64/include/asm/spinlock.h                  |  10 +
 arch/arm64/include/uapi/asm/auxvec.h               |   2 +
 arch/arm64/kernel/debug-monitors.c                 |   6 +-
 arch/arm64/kernel/entry.S                          |   2 +-
 arch/arm64/kernel/traps.c                          |  25 +-
 arch/avr32/include/asm/uaccess.h                   |  11 +-
 arch/avr32/kernel/avr32_ksyms.c                    |   2 +-
 arch/avr32/lib/copy_user.S                         |   8 +-
 arch/avr32/mach-at32ap/pio.c                       |   2 +-
 arch/blackfin/include/asm/uaccess.h                |   9 +-
 arch/cris/include/asm/uaccess.h                    |  71 +++---
 arch/frv/include/asm/uaccess.h                     |  12 +-
 arch/hexagon/include/asm/uaccess.h                 |   3 +-
 arch/ia64/include/asm/barrier.h                    |  23 ++
 arch/ia64/include/asm/uaccess.h                    |  20 +-
 arch/m32r/include/asm/uaccess.h                    |   2 +-
 arch/metag/include/asm/atomic.h                    |   3 +-
 arch/metag/include/asm/barrier.h                   |  15 ++
 arch/metag/include/asm/uaccess.h                   |   3 +-
 arch/microblaze/include/asm/uaccess.h              |  11 +-
 arch/mips/include/asm/barrier.h                    |  15 ++
 arch/mips/include/asm/kvm_host.h                   |   7 +-
 arch/mips/include/asm/ptrace.h                     |   2 +-
 arch/mips/include/asm/uaccess.h                    |   3 +
 arch/mips/kvm/kvm_mips_emul.c                      | 100 ++++++--
 arch/mips/mti-malta/malta-setup.c                  |   8 +-
 arch/mn10300/include/asm/uaccess.h                 |   1 +
 arch/mn10300/lib/usercopy.c                        |   4 +-
 arch/openrisc/include/asm/uaccess.h                |  35 +--
 arch/parisc/include/asm/uaccess.h                  |   7 +-
 arch/parisc/kernel/syscall.S                       |  11 +-
 arch/powerpc/include/asm/barrier.h                 |  21 +-
 arch/powerpc/include/asm/uaccess.h                 |  21 +-
 arch/powerpc/kernel/nvram_64.c                     |   6 +-
 arch/powerpc/kernel/vdso64/datapage.S              |   2 +-
 arch/powerpc/kernel/vdso64/gettimeofday.S          |   2 +-
 arch/powerpc/lib/copyuser_64.S                     |   2 +-
 arch/powerpc/mm/slb_low.S                          |   7 +-
 arch/powerpc/platforms/powernv/pci.c               |   4 +-
 arch/s390/include/asm/barrier.h                    |  15 ++
 arch/s390/include/asm/uaccess.h                    |   8 +-
 arch/score/include/asm/uaccess.h                   |  46 ++--
 arch/sh/include/asm/uaccess.h                      |   5 +-
 arch/sh/include/asm/uaccess_64.h                   |   1 +
 arch/sparc/include/asm/barrier_64.h                |  15 ++
 arch/sparc/include/asm/uaccess_32.h                |   4 +-
 arch/tile/kernel/time.c                            |   4 +-
 arch/x86/boot/compressed/Makefile                  |  14 +-
 arch/x86/boot/compressed/head_32.S                 |  28 ++
 arch/x86/boot/compressed/head_64.S                 |   8 +
 arch/x86/include/asm/barrier.h                     |  43 +++-
 arch/x86/include/asm/hugetlb.h                     |   1 +
 arch/x86/include/asm/tlbflush.h                    |   7 +
 arch/x86/include/asm/uaccess.h                     |   2 +-
 arch/x86/kernel/apic/apic.c                        |   3 +
 arch/x86/kernel/head_32.S                          |   2 +-
 arch/x86/kernel/paravirt.c                         |   4 +-
 arch/x86/kvm/vmx.c                                 |  13 +
 arch/x86/kvm/x86.c                                 |  20 +-
 arch/x86/mm/pat.c                                  |   5 +-
 arch/x86/um/asm/barrier.h                          |   6 +-
 arch/x86/xen/mmu.c                                 |   2 +-
 block/cfq-iosched.c                                |  13 +-
 crypto/ablkcipher.c                                |   2 +
 crypto/af_alg.c                                    |  51 +++-
 crypto/ahash.c                                     |   5 +-
 crypto/algif_hash.c                                | 165 +++++++++++-
 crypto/algif_skcipher.c                            | 172 +++++++++++--
 crypto/blkcipher.c                                 |   4 +-
 crypto/cryptd.c                                    |   9 +-
 crypto/gcm.c                                       |   2 +-
 crypto/shash.c                                     |   5 +-
 drivers/acpi/apei/ghes.c                           |   2 +-
 drivers/base/core.c                                |  42 ++-
 drivers/block/drbd/drbd_main.c                     |   2 +-
 drivers/block/xen-blkback/common.h                 |   8 +-
 drivers/char/hw_random/exynos-rng.c                |   9 +-
 drivers/char/hw_random/omap-rng.c                  |  16 +-
 drivers/char/mem.c                                 |   6 +-
 drivers/devfreq/devfreq.c                          |   2 +-
 drivers/edac/edac_mc.c                             |   2 +-
 drivers/firewire/net.c                             |  59 +++--
 drivers/gpio/gpio-mpc8xxx.c                        |   2 +-
 drivers/gpu/drm/drm_crtc.c                         |   3 +
 drivers/gpu/drm/qxl/qxl_draw.c                     |   2 +
 drivers/gpu/drm/radeon/atombios_crtc.c             |   2 +
 drivers/gpu/drm/radeon/radeon_legacy_crtc.c        |   2 +
 drivers/gpu/drm/radeon/radeon_ttm.c                |   4 +-
 drivers/hv/hv_util.c                               |  10 +-
 drivers/hwmon/adt7411.c                            |   5 +-
 drivers/i2c/busses/i2c-at91.c                      |  58 ++++-
 drivers/i2c/busses/i2c-eg20t.c                     |  18 +-
 drivers/i2c/i2c-core.c                             |   2 +-
 drivers/iio/accel/kxsd9.c                          |   2 +
 drivers/infiniband/core/cm.c                       | 127 +++++++--
 drivers/infiniband/core/multicast.c                |  13 +-
 drivers/infiniband/core/uverbs_main.c              |   7 +-
 drivers/infiniband/hw/mlx4/cq.c                    |   5 +-
 drivers/infiniband/hw/mlx4/mcg.c                   |  14 +-
 drivers/infiniband/ulp/ipoib/ipoib.h               |   1 +
 drivers/infiniband/ulp/ipoib/ipoib_cm.c            |  16 ++
 drivers/infiniband/ulp/ipoib/ipoib_ib.c            |   9 +
 drivers/infiniband/ulp/ipoib/ipoib_main.c          |   2 +-
 drivers/infiniband/ulp/srpt/ib_srpt.c              |  59 +----
 drivers/input/serio/i8042.c                        |  17 +-
 drivers/input/serio/libps2.c                       |  10 +-
 drivers/input/touchscreen/ili210x.c                |   2 +-
 drivers/iommu/amd_iommu.c                          |  13 +-
 drivers/isdn/hardware/mISDN/ipac.h                 |   1 +
 drivers/isdn/hardware/mISDN/mISDNipac.c            |   2 +
 drivers/isdn/mISDN/socket.c                        |   3 +
 drivers/md/dm-flakey.c                             |  27 +-
 drivers/md/dm.c                                    |   5 +
 drivers/media/dvb-frontends/mb86a20s.c             | 104 ++++----
 drivers/media/usb/cx231xx/cx231xx-avcore.c         |   5 +-
 drivers/media/usb/cx231xx/cx231xx-cards.c          |   2 +-
 drivers/media/usb/cx231xx/cx231xx-core.c           |   3 +-
 drivers/media/usb/em28xx/em28xx-i2c.c              |   5 +-
 drivers/mfd/mfd-core.c                             |   2 +
 drivers/misc/mei/nfc.c                             |   2 +-
 drivers/mmc/card/block.c                           |   3 +-
 drivers/mmc/host/mxs-mmc.c                         |   4 +-
 drivers/mtd/maps/pmcmsp-flash.c                    |   6 +-
 drivers/mtd/mtd_blkdevs.c                          |  10 +-
 drivers/mtd/nand/davinci_nand.c                    |   3 +
 drivers/mtd/ubi/fastmap.c                          |   7 +-
 drivers/net/bonding/bond_main.c                    |   7 +-
 drivers/net/can/dev.c                              |  27 +-
 drivers/net/ethernet/marvell/sky2.c                |  13 +
 drivers/net/ethernet/mellanox/mlx4/en_netdev.c     |   2 +-
 drivers/net/ppp/ppp_generic.c                      |   5 +-
 drivers/net/usb/kaweth.c                           |   3 +-
 .../net/wireless/brcm80211/brcmfmac/wl_cfg80211.c  |   2 +-
 drivers/net/wireless/brcm80211/brcmsmac/dma.c      |   4 +-
 drivers/net/wireless/brcm80211/brcmsmac/stf.c      |   2 +-
 drivers/net/wireless/iwlwifi/pcie/tx.c             |   4 +-
 drivers/net/wireless/mwifiex/cfg80211.c            |  13 +-
 drivers/net/xen-netback/netback.c                  |  34 ++-
 drivers/pci/quirks.c                               |  41 ++-
 drivers/regulator/tps65910-regulator.c             |   6 +
 drivers/s390/block/dasd.c                          |  10 +-
 drivers/s390/scsi/zfcp_dbf.c                       | 162 ++++++++++--
 drivers/s390/scsi/zfcp_dbf.h                       |  14 +-
 drivers/s390/scsi/zfcp_erp.c                       |  12 +-
 drivers/s390/scsi/zfcp_ext.h                       |   8 +-
 drivers/s390/scsi/zfcp_fsf.c                       |  22 +-
 drivers/s390/scsi/zfcp_fsf.h                       |   4 +-
 drivers/s390/scsi/zfcp_scsi.c                      |   8 +-
 drivers/scsi/arcmsr/arcmsr_hba.c                   |  17 +-
 drivers/scsi/ibmvscsi/ibmvfc.c                     |   1 -
 drivers/scsi/megaraid/megaraid_sas.h               |   2 +-
 drivers/scsi/megaraid/megaraid_sas_base.c          |  13 +-
 drivers/scsi/mpt2sas/mpt2sas_scsih.c               |  15 ++
 drivers/scsi/mpt3sas/mpt3sas_scsih.c               |  14 +
 drivers/scsi/scsi_debug.c                          |   1 +
 drivers/scsi/scsi_scan.c                           |   2 +-
 drivers/staging/iio/impedance-analyzer/ad5933.c    |  17 +-
 drivers/thermal/thermal_core.c                     |   2 +-
 drivers/tty/tty_ldisc.c                            |   7 +
 drivers/tty/vt/vt.c                                |   7 +-
 drivers/uio/uio_dmem_genirq.c                      |   2 +-
 drivers/usb/chipidea/core.c                        |   1 +
 drivers/usb/chipidea/udc.c                         |   2 -
 drivers/usb/class/cdc-acm.c                        |   5 +-
 drivers/usb/class/cdc-acm.h                        |   1 -
 drivers/usb/core/config.c                          |  93 ++++++-
 drivers/usb/dwc3/gadget.c                          |  19 +-
 drivers/usb/gadget/fsl_qe_udc.c                    |   7 +-
 drivers/usb/gadget/u_ether.c                       |   7 -
 drivers/usb/host/xhci-hub.c                        |   3 +
 drivers/usb/misc/legousbtower.c                    |  35 ++-
 drivers/usb/renesas_usbhs/mod.c                    |  11 +-
 drivers/usb/serial/cp210x.c                        |   6 +-
 drivers/usb/serial/kobil_sct.c                     |   5 +-
 drivers/usb/serial/mos7720.c                       |   2 +-
 drivers/usb/serial/mos7840.c                       |   4 +-
 drivers/usb/serial/usb-serial.c                    |   4 +-
 drivers/usb/storage/transport.c                    |   7 +-
 drivers/video/efifb.c                              |   6 +-
 drivers/xen/xen-pciback/conf_space.c               |   6 +-
 drivers/xen/xen-pciback/conf_space.h               |   2 +-
 drivers/xen/xen-pciback/conf_space_header.c        |   2 +-
 drivers/xen/xen-pciback/pciback.h                  |   1 +
 drivers/xen/xen-pciback/pciback_ops.c              |  75 ++++--
 fs/btrfs/ioctl.c                                   |  12 +
 fs/coredump.c                                      |   3 +
 fs/ext4/ext4.h                                     |   1 +
 fs/ext4/inode.c                                    |  50 ++--
 fs/ext4/mballoc.c                                  |  47 ++--
 fs/ext4/namei.c                                    |   9 +-
 fs/ext4/super.c                                    |  53 +++-
 fs/ext4/xattr.c                                    |  13 +-
 fs/hostfs/hostfs_kern.c                            |   7 +-
 fs/isofs/inode.c                                   |   8 +-
 fs/nfs/callback.c                                  |   1 +
 fs/nfs/callback_xdr.c                              |   6 +-
 fs/nfs/nfs4state.c                                 |   3 +
 fs/nfsd/nfs4state.c                                |   3 +-
 fs/ocfs2/dlm/dlmconvert.c                          |  12 +-
 fs/ocfs2/file.c                                    |  34 ++-
 fs/pstore/ram_core.c                               |  51 +---
 fs/reiserfs/ibalance.c                             |   3 +-
 fs/reiserfs/super.c                                |  12 +-
 fs/seq_file.c                                      |   4 +-
 fs/super.c                                         |   6 +-
 fs/ubifs/dir.c                                     |  22 +-
 fs/ubifs/tnc_commit.c                              |   2 +-
 fs/ubifs/xattr.c                                   |   2 +
 fs/xfs/xfs_dquot.c                                 |   3 +-
 fs/xfs/xfs_mount.c                                 |   3 +-
 include/asm-generic/barrier.h                      |  15 ++
 include/asm-generic/uaccess.h                      |  20 +-
 include/crypto/hash.h                              |   6 +
 include/crypto/if_alg.h                            |  11 +-
 include/linux/can/dev.h                            |   3 +-
 include/linux/compiler.h                           |  67 +++++
 include/linux/crypto.h                             |   8 +
 include/linux/filter.h                             |   6 +-
 include/linux/i8042.h                              |   6 -
 include/linux/mfd/88pm80x.h                        |   4 +-
 include/linux/mroute.h                             |   2 +-
 include/linux/mroute6.h                            |   2 +-
 include/linux/netdevice.h                          |   1 +
 include/linux/pagemap.h                            |  38 +--
 include/linux/perf_event.h                         |   6 -
 include/linux/sem.h                                |   1 +
 include/linux/serio.h                              |  24 +-
 include/linux/stddef.h                             |  15 +-
 include/linux/vfio.h                               |  14 -
 include/net/if_inet6.h                             |  10 +-
 include/net/ip6_tunnel.h                           |   1 +
 include/net/ndisc.h                                |   2 +
 include/net/sock.h                                 |  16 +-
 include/net/tcp.h                                  |   3 +
 include/xen/interface/io/ring.h                    |  14 +
 ipc/msg.c                                          |  34 +--
 ipc/sem.c                                          | 155 ++++++-----
 ipc/shm.c                                          |  42 +--
 ipc/util.c                                         |   6 +-
 kernel/events/core.c                               |  15 +-
 kernel/fork.c                                      |  10 +-
 kernel/power/suspend_test.c                        |   4 +-
 kernel/rcutree_plugin.h                            |   1 +
 kernel/sched/core.c                                |  41 +++
 kernel/timer.c                                     |  19 +-
 kernel/trace/trace.c                               |  32 +--
 lib/genalloc.c                                     |   3 +-
 lib/mpi/mpi-pow.c                                  |   7 +-
 lib/ratelimit.c                                    |   2 +-
 mm/ksm.c                                           |   3 +-
 mm/swapfile.c                                      |   2 +
 net/can/bcm.c                                      |  32 ++-
 net/core/dev.c                                     |  18 +-
 net/core/dst.c                                     |   4 +-
 net/core/filter.c                                  |  10 +-
 net/core/sock.c                                    |  10 +-
 net/dccp/ipv4.c                                    |  14 +-
 net/dccp/ipv6.c                                    |  16 +-
 net/dccp/proto.c                                   |   4 +
 net/ipv4/ip_fragment.c                             |   4 +
 net/ipv4/ip_output.c                               |   3 +
 net/ipv4/ipmr.c                                    |   3 +-
 net/ipv4/route.c                                   |   9 +-
 net/ipv4/tcp_ipv4.c                                |  22 +-
 net/ipv4/tcp_output.c                              |  15 +-
 net/ipv6/addrconf.c                                | 283 ++++++++++++++-------
 net/ipv6/af_inet6.c                                |   6 +
 net/ipv6/anycast.c                                 |  12 +
 net/ipv6/ip6_gre.c                                 |   1 -
 net/ipv6/ip6_tunnel.c                              |  13 +-
 net/ipv6/ip6mr.c                                   |   5 +-
 net/ipv6/mcast.c                                   |  14 +
 net/ipv6/ndisc.c                                   |  18 +-
 net/ipv6/netfilter/nf_conntrack_reasm.c            |   3 +
 net/ipv6/reassembly.c                              |   4 +
 net/ipv6/route.c                                   |   4 +-
 net/ipv6/tcp_ipv6.c                                |  14 +-
 net/irda/iriap.c                                   |   8 +-
 net/mac80211/cfg.c                                 |   2 +-
 net/mac80211/rx.c                                  |  24 +-
 net/mac80211/tx.c                                  |   6 +-
 net/netfilter/ipvs/ip_vs_proto_tcp.c               |  25 +-
 net/netfilter/nf_log.c                             |   6 +-
 net/packet/af_packet.c                             |   1 +
 net/sctp/sm_statefuns.c                            |  12 +-
 net/sctp/socket.c                                  |  12 +-
 net/sunrpc/svc.c                                   |   8 +-
 net/wireless/core.h                                |   1 +
 net/wireless/scan.c                                |  69 +++++
 security/keys/proc.c                               |   2 +-
 sound/core/pcm_lib.c                               |   2 +-
 sound/core/rawmidi.c                               |   4 +-
 sound/core/timer.c                                 |  20 +-
 sound/pci/ali5451/ali5451.c                        |   2 +
 sound/soc/omap/omap-mcpdm.c                        |   5 +-
 tools/perf/util/symbol-elf.c                       |   2 +-
 tools/perf/util/symbol.c                           |   2 +-
 tools/vm/slabinfo.c                                |   3 +-
 308 files changed, 3354 insertions(+), 1327 deletions(-)

-- 
2.8.0.rc2.1.gbe9624a