commit 9db8a8bb98cf75b0a51d66f560c87028e93a8ed8
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Wed Oct 15 12:29:30 2014 +0200

    Linux 3.17.1

commit fd979860f7e04a9028f803b1a79099e05a60f579
Author: Frederic Weisbecker <fweisbec@gmail.com>
Date:   Sat Aug 16 18:48:05 2014 +0200

    arm64: Tell irq work about self IPI support
    
    commit 3631073659d0aafeaa52227bb61a100efaf901dc upstream.
    
    ARM64 irq work self-IPI support depends on __smp_cross_call to point to
    some relevant IRQ controller operations. This information should be
    available after the call to init_IRQ().
    
    Lets implement arch_irq_work_has_interrupt() accordingly.
    
    Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
    Acked-by: Catalin Marinas <catalin.marinas@arm.com>
    Cc: Ingo Molnar <mingo@kernel.org>
    Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Cc: Will Deacon <will.deacon@arm.com>
    Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1063368632f52a61ceb20565501606a090335878
Author: George Spelvin <linux@horizon.com>
Date:   Tue Oct 7 07:26:38 2014 -0400

    libata: Un-break ATA blacklist
    
    commit 1c40279960bcd7d52dbdf1d466b20d24b99176c8 upstream.
    
    lib/glob.c provides a new glob_match() function, with arguments in
    (pattern, string) order.  It replaced a private function with arguments
    in (string, pattern) order, but I didn't swap the call site...
    
    The result was the entire ATA blacklist was effectively disabled.
    
    The lesson for today is "I f***ed up *how* badly *how* many months ago?",
    er, I mean "Nobody Tests RC Kernels On Legacy Hardware".
    
    This was not a subtle break, but it made it through an entire RC
    cycle unreported, presumably because all the people doing testing
    have full-featured hardware.
    
    (FWIW, the reason for the argument swap was because fnmatch() does it that
    way, and for a while implementing a full fnmatch() was being considered.)
    
    Fixes: 428ac5fc056e0 (libata: Use glob_match from lib/glob.c)
    Reported-by: Steven Honeyman <stevenhoneyman@gmail.com>
    Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=71371#c21
    Signed-off-by: George Spelvin <linux@horizon.com>
    Tested-by: Steven Honeyman <stevenhoneyman@gmail.com>
    Signed-off-by: Tejun Heo <tj@kernel.org>
    Cc: Henrique de Moraes Holschuh <hmh@hmh.eng.br>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 5ec101482849be488400b639730a013be2792ec7
Author: Bryan O'Donoghue <pure.logic@nexus-software.ie>
Date:   Tue Sep 23 01:21:11 2014 +0100

    serial: 8250: Add Quark X1000 to 8250_pci.c
    
    commit 1ede7dcca3c4fa15a518ab0473126f9c3e621e4c upstream.
    
    Quark X1000 contains two designware derived 8250 serial ports.
    Each port has a unique PCI configuration space consisting of
    BAR0:UART BAR1:DMA respectively.
    
    Unlike the standard 8250 the register width is 32 bits for RHR,IER etc
    The Quark UART has a fundamental clock @ 44.2368 MHz allowing for a
    bitrate of up to about 2.76 megabits per second.
    
    This patch enables standard 8250 mode
    
    Signed-off-by: Bryan O'Donoghue <pure.logic@nexus-software.ie>
    Reviewed-by: Heikki Krogerus <heikki.krogerus@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 243e25b5170afb2f720b68f5c6af0b979997a746
Author: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
Date:   Fri Oct 3 19:06:03 2014 +0900

    driver/base/node: remove unnecessary kfree of node struct from unregister_one_node
    
    commit 33ead538f642a33b1d658782a5d14a40b5014d1f upstream.
    
    Commit 92d585ef067d ("numa: fix NULL pointer access and memory
    leak in unregister_one_node()") added kfree() of node struct in
    unregister_one_node(). But node struct is freed by node_device_release()
    which is called in  unregister_node(). So by adding the kfree(),
    node struct is freed two times.
    
    While hot removing memory, the commit leads the following BUG_ON():
    
      kernel BUG at mm/slub.c:3346!
      invalid opcode: 0000 [#1] SMP
      [...]
      Call Trace:
       [...] unregister_one_node
       [...] try_offline_node
       [...] remove_memory
       [...] acpi_memory_device_remove
       [...] acpi_bus_trim
       [...] acpi_bus_trim
       [...] acpi_device_hotplug
       [...] acpi_hotplug_work_fn
       [...] process_one_work
       [...] worker_thread
       [...] ? rescuer_thread
       [...] kthread
       [...] ? kthread_create_on_node
       [...] ret_from_fork
       [...] ? kthread_create_on_node
    
    This patch removes unnecessary kfree() from unregister_one_node().
    
    Signed-off-by: Yasuaki Ishimatsu <isimatu.yasuaki@jp.fujitsu.com>
    Cc: Xishi Qiu <qiuxishi@huawei.com>
    Fixes: 92d585ef067d "numa: fix NULL pointer access and memory leak in unregister_one_node()"
    Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 26ad374b2e70043b1b5951599d0dffc41b94e8e1
Author: Cristian Stoica <cristian.stoica@freescale.com>
Date:   Thu Aug 14 13:51:57 2014 +0300

    crypto: caam - fix addressing of struct member
    
    commit 4451d494b1910bf7b7f8381a637d0fe6d2142467 upstream.
    
    buf_0 and buf_1 in caam_hash_state are not next to each other.
    Accessing buf_1 is incorrect from &buf_0 with an offset of only
    size_of(buf_0). The same issue is also with buflen_0 and buflen_1
    
    Signed-off-by: Cristian Stoica <cristian.stoica@freescale.com>
    Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3cd99033c7ffd72c18a29ae4abefb80bfa89c3a4
Author: Lu Baolu <baolu.lu@linux.intel.com>
Date:   Fri Sep 19 10:13:50 2014 +0800

    USB: Add device quirk for ASUS T100 Base Station keyboard
    
    commit ddbe1fca0bcb87ca8c199ea873a456ca8a948567 upstream.
    
    This full-speed USB device generates spurious remote wakeup event
    as soon as USB_DEVICE_REMOTE_WAKEUP feature is set. As the result,
    Linux can't enter system suspend and S0ix power saving modes once
    this keyboard is used.
    
    This patch tries to introduce USB_QUIRK_IGNORE_REMOTE_WAKEUP quirk.
    With this quirk set, wakeup capability will be ignored during
    device configure.
    
    This patch could be back-ported to kernels as old as 2.6.39.
    
    Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b2dd17bca11cdcc294c177435a834650be972139
Author: Felipe Balbi <balbi@ti.com>
Date:   Mon Sep 15 09:03:24 2014 -0500

    usb: musb: dsps: kill OTG timer on suspend
    
    commit 468bcc2a2ca071f652009d2d20d97f2437630cae upstream.
    
    if we don't make sure to kill the timer, it could
    expire after we have already gated our clocks.
    
    That will trigger a Data Abort exception because
    we would try to access register while clock is gated.
    
    Fix that bug.
    
    Fixes 869c597 (usb: musb: dsps: add support for suspend and resume)
    Tested-by: Dave Gerlach <d-gerlach@ti.com>
    Signed-off-by: Felipe Balbi <balbi@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 17ea14cd58b617339a754e1c61de06175f152941
Author: Andreas Bomholtz <andreas@seluxit.com>
Date:   Mon Sep 22 09:50:43 2014 +0200

    USB: cp210x: add support for Seluxit USB dongle
    
    commit dee80ad12d2b1b304286a707fde7ab05d1fc7bab upstream.
    
    Added the Seluxit ApS USB Serial Dongle to cp210x driver.
    
    Signed-off-by: Andreas Bomholtz <andreas@seluxit.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 4aaf2c94cbd1b2d73976709f8d037354a8838b29
Author: Joe Savage <joe.savage@goketra.com>
Date:   Sat Sep 20 08:01:16 2014 -0500

    USB: serial: cp210x: added Ketra N1 wireless interface support
    
    commit bfc2d7dfdd761ae3beccdb26abebe03cef042f46 upstream.
    
    Added support for Ketra N1 wireless interface, which uses the
    Silicon Labs' CP2104 USB to UART bridge with customized PID 8946.
    
    Signed-off-by: Joe Savage <joe.savage@goketra.com>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 2d8b382aca6d7a158c27b4e0c2eb8896dee866b4
Author: Felipe Balbi <balbi@ti.com>
Date:   Thu Sep 18 09:31:32 2014 -0500

    Revert "usb: gadget: composite: dequeue cdev->req before free it in composite_dev_cleanup"
    
    commit bf17eba7ae1e813b0ad67cb1078dcbd7083b906e upstream.
    
    This reverts commit f2267089ea17fa97b796b1b4247e3f8957655df3.
    
    That commit causes more problem than fixes. Firstly, kfree()
    should be called after usb_ep_dequeue() and secondly, the way
    things are, we will try to dequeue a request that has already
    completed much more frequently than one which is pending.
    
    Cc: Li Jun <b47624@freescale.com>
    Signed-off-by: Felipe Balbi <balbi@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6ed8a450f618ebca47b03c59c6975cfd76790542
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Tue Sep 9 15:06:09 2014 +0300

    usb: gadget: f_fs: signedness bug in __ffs_func_bind_do_descs()
    
    commit 85b06f5e53d17c15844ef3cd45d0c7107f0ae45c upstream.
    
    We need "idx" to be signed for the error handling to work.
    
    Fixes: 6d5c1c77bbf9 ('usb: gadget: f_fs: fix the redundant ep files problem')
    Acked-by: Michal Nazarewicz <mina86@mina86.com>
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Signed-off-by: Felipe Balbi <balbi@ti.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3842f8ec4ac6df95afbbed484d7701f2caf6bf86
Author: Hans de Goede <hdegoede@redhat.com>
Date:   Tue Sep 23 15:48:50 2014 +0200

    uas: Add another ASM1051 usb-id to the uas blacklist
    
    commit 710f1bf16ab1b1558f099b62c5011c4cbba6a7bb upstream.
    
    As most ASM1051 based devices, this one has unfixable issues with uas too.
    
    Signed-off-by: Hans de Goede <hdegoede@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit de3af5fefe6f76102b21a5b596d11f245810d2c4
Author: Hans de Goede <hdegoede@redhat.com>
Date:   Wed Sep 17 10:10:58 2014 +0200

    uas: Add US_FL_NO_ATA_1X quirk for Seagate (0bc2:ab20) drives
    
    commit f9554a6b199360c2f888173fd600e1eb7ff165ef upstream.
    
    https://bbs.archlinux.org/viewtopic.php?pid=1457492
    
    Signed-off-by: Hans de Goede <hdegoede@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c0f5e44c171ed08de0929f83ff6f8faf912bb109
Author: Hans de Goede <hdegoede@redhat.com>
Date:   Tue Sep 16 18:36:52 2014 +0200

    uas: Add no-report-opcodes quirk
    
    commit 734016b00b50a3c6a0e1fc1b7b217e783f5123a1 upstream.
    
    Besides the ASM1051 (*) needing sdev->no_report_opcodes = 1, it turns out that
    the JMicron JMS567 also needs it to work properly with uas (usb-storage always
    sets it). Since some of the scsi devs were not to keen on the idea to
    outrightly set sdev->no_report_opcodes = 1 for all uas devices, so add a quirk
    for this, and set it for the JMS567.
    
    *) Which has become a non-issue since we've completely blacklisted uas on
    the ASM1051 for other reasons
    
    Reported-and-tested-by: Claudio Bizzarri <claudio.bizzarri@gmail.com>
    Signed-off-by: Hans de Goede <hdegoede@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c36cac9f20886a5a60d4f9388f6faef547d78d61
Author: Hans de Goede <hdegoede@redhat.com>
Date:   Mon Sep 15 16:04:12 2014 +0200

    uas: Add a quirk for rejecting ATA_12 and ATA_16 commands
    
    commit 593078525c8b234a35a36ff551b8716464e86481 upstream.
    
    And set this quirk for the Seagate Expansion Desk (0bc2:2312), as that one
    seems to hang upon receiving an ATA_12 or ATA_16 command.
    
    https://bugzilla.kernel.org/show_bug.cgi?id=79511
    https://bbs.archlinux.org/viewtopic.php?id=183190
    
    While at it also add missing documentation for the u value for usb-storage
    quirks.
    
    Signed-off-by: Hans de Goede <hdegoede@redhat.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 117ef0db3c7f8e218ebb3bd9dfbf3856a0320e4d
Author: Yinghai Lu <yinghai@kernel.org>
Date:   Mon Sep 22 20:07:35 2014 -0600

    PCI: pciehp: Fix wait time in timeout message
    
    commit d433889cd5a0933fbd90f1e65bff5a8d7963cc52 upstream.
    
    When we warned about a timeout on a hotplug command, we previously printed
    the time between calls to pcie_write_cmd(), without accounting for any time
    spent actually waiting.  Consider this sequence:
    
      pcie_write_cmd
        write SLTCTL
        cmd_started = jiffies          # T1
    
      pcie_write_cmd
        pcie_wait_cmd
          now = jiffies                # T2
          wait_event_timeout           # we may wait here
          if (timeout)
            ctrl_info("Timeout on command issued %u msec ago",
                      jiffies_to_msecs(now - cmd_started))
    
    We previously printed (T2 - T1), but that doesn't include the time spent in
    wait_event_timeout().
    
    Fix this by using the current jiffies value, not the one cached before
    calling wait_event_timeout().
    
    [bhelgaas: changelog, use current jiffies instead of adding timeout]
    Fixes: 40b960831cfa ("PCI: pciehp: Compute timeout from hotplug command start time")
    Signed-off-by: Yinghai Lu <yinghai@kernel.org>
    Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6c3dfd886da9fd6529693fd0b2cd5f9fb8acd298
Author: Frederic Weisbecker <fweisbec@gmail.com>
Date:   Sat Aug 16 18:47:53 2014 +0200

    arm: Tell irq work about self IPI support
    
    commit 09f6edd424218eb69078551b2ecfada1f2d098eb upstream.
    
    ARM irq work IPI support depends on SMP support. That information is
    partly known at early boottime. Lets implement
    arch_irq_work_has_interrupt() accordingly.
    
    Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
    Cc: Ingo Molnar <mingo@kernel.org>
    Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Russell King <linux@arm.linux.org.uk>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 1d3408209d43d2e72b5d8dbfb9b60fece399d75b
Author: Frederic Weisbecker <fweisbec@gmail.com>
Date:   Sat Aug 16 18:47:15 2014 +0200

    x86: Tell irq work about self IPI support
    
    commit 3010279f0fc36f0388872203e63ca49912f648fd upstream.
    
    x86 supports irq work self-IPIs when local apic is available. This is
    partly known on runtime so lets implement arch_irq_work_has_interrupt()
    accordingly.
    
    This should be safely called after setup_arch().
    
    Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
    Cc: Ingo Molnar <mingo@kernel.org>
    Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 6fd5de08a5337d0d601f6361671813df4f013da9
Author: Frederic Weisbecker <fweisbec@gmail.com>
Date:   Sat Aug 16 18:37:19 2014 +0200

    irq_work: Force raised irq work to run on irq work interrupt
    
    commit 76a33061b9323b7fdb220ae5fa116c10833ec22e upstream.
    
    The nohz full kick, which restarts the tick when any resource depend
    on it, can't be executed anywhere given the operation it does on timers.
    If it is called from the scheduler or timers code, chances are that
    we run into a deadlock.
    
    This is why we run the nohz full kick from an irq work. That way we make
    sure that the kick runs on a virgin context.
    
    However if that's the case when irq work runs in its own dedicated
    self-ipi, things are different for the big bunch of archs that don't
    support the self triggered way. In order to support them, irq works are
    also handled by the timer interrupt as fallback.
    
    Now when irq works run on the timer interrupt, the context isn't blank.
    More precisely, they can run in the context of the hrtimer that runs the
    tick. But the nohz kick cancels and restarts this hrtimer and cancelling
    an hrtimer from itself isn't allowed. This is why we run in an endless
    loop:
    
    	Kernel panic - not syncing: Watchdog detected hard LOCKUP on cpu 2
    	CPU: 2 PID: 7538 Comm: kworker/u8:8 Not tainted 3.16.0+ #34
    	Workqueue: btrfs-endio-write normal_work_helper [btrfs]
    	 ffff880244c06c88 000000001b486fe1 ffff880244c06bf0 ffffffff8a7f1e37
    	 ffffffff8ac52a18 ffff880244c06c78 ffffffff8a7ef928 0000000000000010
    	 ffff880244c06c88 ffff880244c06c20 000000001b486fe1 0000000000000000
    	Call Trace:
    	 <NMI[<ffffffff8a7f1e37>] dump_stack+0x4e/0x7a
    	 [<ffffffff8a7ef928>] panic+0xd4/0x207
    	 [<ffffffff8a1450e8>] watchdog_overflow_callback+0x118/0x120
    	 [<ffffffff8a186b0e>] __perf_event_overflow+0xae/0x350
    	 [<ffffffff8a184f80>] ? perf_event_task_disable+0xa0/0xa0
    	 [<ffffffff8a01a4cf>] ? x86_perf_event_set_period+0xbf/0x150
    	 [<ffffffff8a187934>] perf_event_overflow+0x14/0x20
    	 [<ffffffff8a020386>] intel_pmu_handle_irq+0x206/0x410
    	 [<ffffffff8a01937b>] perf_event_nmi_handler+0x2b/0x50
    	 [<ffffffff8a007b72>] nmi_handle+0xd2/0x390
    	 [<ffffffff8a007aa5>] ? nmi_handle+0x5/0x390
    	 [<ffffffff8a0cb7f8>] ? match_held_lock+0x8/0x1b0
    	 [<ffffffff8a008062>] default_do_nmi+0x72/0x1c0
    	 [<ffffffff8a008268>] do_nmi+0xb8/0x100
    	 [<ffffffff8a7ff66a>] end_repeat_nmi+0x1e/0x2e
    	 [<ffffffff8a0cb7f8>] ? match_held_lock+0x8/0x1b0
    	 [<ffffffff8a0cb7f8>] ? match_held_lock+0x8/0x1b0
    	 [<ffffffff8a0cb7f8>] ? match_held_lock+0x8/0x1b0
    	 <<EOE><IRQ[<ffffffff8a0ccd2f>] lock_acquired+0xaf/0x450
    	 [<ffffffff8a0f74c5>] ? lock_hrtimer_base.isra.20+0x25/0x50
    	 [<ffffffff8a7fc678>] _raw_spin_lock_irqsave+0x78/0x90
    	 [<ffffffff8a0f74c5>] ? lock_hrtimer_base.isra.20+0x25/0x50
    	 [<ffffffff8a0f74c5>] lock_hrtimer_base.isra.20+0x25/0x50
    	 [<ffffffff8a0f7723>] hrtimer_try_to_cancel+0x33/0x1e0
    	 [<ffffffff8a0f78ea>] hrtimer_cancel+0x1a/0x30
    	 [<ffffffff8a109237>] tick_nohz_restart+0x17/0x90
    	 [<ffffffff8a10a213>] __tick_nohz_full_check+0xc3/0x100
    	 [<ffffffff8a10a25e>] nohz_full_kick_work_func+0xe/0x10
    	 [<ffffffff8a17c884>] irq_work_run_list+0x44/0x70
    	 [<ffffffff8a17c8da>] irq_work_run+0x2a/0x50
    	 [<ffffffff8a0f700b>] update_process_times+0x5b/0x70
    	 [<ffffffff8a109005>] tick_sched_handle.isra.21+0x25/0x60
    	 [<ffffffff8a109b81>] tick_sched_timer+0x41/0x60
    	 [<ffffffff8a0f7aa2>] __run_hrtimer+0x72/0x470
    	 [<ffffffff8a109b40>] ? tick_sched_do_timer+0xb0/0xb0
    	 [<ffffffff8a0f8707>] hrtimer_interrupt+0x117/0x270
    	 [<ffffffff8a034357>] local_apic_timer_interrupt+0x37/0x60
    	 [<ffffffff8a80010f>] smp_apic_timer_interrupt+0x3f/0x50
    	 [<ffffffff8a7fe52f>] apic_timer_interrupt+0x6f/0x80
    
    To fix this we force non-lazy irq works to run on irq work self-IPIs
    when available. That ability of the arch to trigger irq work self IPIs
    is available with arch_irq_work_has_interrupt().
    
    Reported-by: Catalin Iacob <iacobcatalin@gmail.com>
    Reported-by: Dave Jones <davej@redhat.com>
    Acked-by: Peter Zijlstra (Intel) <peterz@infradead.org>
    Cc: Ingo Molnar <mingo@kernel.org>
    Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit b677a767bcb3b9fbb4c7f921e5ba9577f1577049
Author: Peter Zijlstra <peterz@infradead.org>
Date:   Sat Sep 6 15:43:02 2014 +0200

    irq_work: Introduce arch_irq_work_has_interrupt()
    
    commit c5c38ef3d70377dc504a6a3f611a3ec814bc757b upstream.
    
    The nohz full code needs irq work to trigger its own interrupt so that
    the subsystem can work even when the tick is stopped.
    
    Lets introduce arch_irq_work_has_interrupt() that archs can override to
    tell about their support for this ability.
    
    Signed-off-by: Peter Zijlstra <peterz@infradead.org>
    Cc: Ingo Molnar <mingo@kernel.org>
    Cc: Paul E. McKenney <paulmck@linux.vnet.ibm.com>
    Cc: Peter Zijlstra <peterz@infradead.org>
    Cc: Thomas Gleixner <tglx@linutronix.de>
    Signed-off-by: Frederic Weisbecker <fweisbec@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 3bc0d3356f30096b610e027a70dcf3445f8c4a38
Author: WANG Cong <xiyou.wangcong@gmail.com>
Date:   Mon Oct 6 17:21:54 2014 -0700

    net_sched: copy exts->type in tcf_exts_change()
    
    [ Upstream commit 5301e3e117d88ef0967ce278912e54757f1a31a2 ]
    
    We need to copy exts->type when committing the change, otherwise
    it would be always 0. This is a quick fix for -net and -stable,
    for net-next tcf_exts will be removed.
    
    Fixes: commit 33be627159913b094bb578e83 ("net_sched: act: use standard struct list_head")
    Reported-by: Jamal Hadi Salim <jhs@mojatatu.com>
    Cc: Jamal Hadi Salim <jhs@mojatatu.com>
    Cc: John Fastabend <john.fastabend@gmail.com>
    Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
    Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f823cda9b841d142930e3de51dfda6cd245a2f83
Author: Sylvain \\\"ythier\\\" Hitier <sylvain.hitier@gmail.com>
Date:   Tue Oct 7 13:40:34 2014 +0000

    3c59x: fix bad split of cpu_to_le32(pci_map_single())
    
    [ Upstream commit 88b09a6d958af6c458acf055ee2eb5bc9564efda ]
    
    In commit 6f2b6a3005b2c34c39f207a87667564f64f2f91a,
      # 3c59x: Add dma error checking and recovery
    the intent is to split out the mapping from the byte-swapping in order to
    insert a dma_mapping_error() check.
    
    Kinda this semantic patch:
    
        // See http://coccinelle.lip6.fr/
        //
        // Beware, grouik-and-dirty!
        @@
        expression DEV, X, Y, Z;
        @@
        -   cpu_to_le32(pci_map_single(DEV, X, Y, Z))
        +   dma_addr_t addr = pci_map_single(DEV, X, Y, Z);
        +   if (dma_mapping_error(&DEV->dev, addr))
        +       /* snip */;
        +   cpu_to_le32(addr)
    
    However, the #else part (of the #if DO_ZEROCOPY test) is changed this way:
    
        -   cpu_to_le32(pci_map_single(DEV, X, Y, Z))
        +   dma_addr_t addr = cpu_to_le32(pci_map_single(DEV, X, Y, Z));
        //                    ^^^^^^^^^^^
        //                    That mismatches the 3 other changes!
        +   if (dma_mapping_error(&DEV->dev, addr))
        +       /* snip */;
        +   cpu_to_le32(addr)
    
    Let's remove the leftover cpu_to_le32() for coherency.
    
    v2: Better changelog.
    v3: Add Acked-by
    
    Fixes: 6f2b6a3005b2c34c39f207a87667564f64f2f91a
      # 3c59x: Add dma error checking and recovery
    Acked-by: Neil Horman <nhorman@tuxdriver.com>
    Signed-off-by: Sylvain "ythier" Hitier <sylvain.hitier@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 404db05025f2fb873b0569a99cf541519fec607f
Author: Vlad Yasevich <vyasevich@gmail.com>
Date:   Fri Oct 3 18:16:20 2014 -0400

    sctp: handle association restarts when the socket is closed.
    
    [ Upstream commit bdf6fa52f01b941d4a80372d56de465bdbbd1d23 ]
    
    Currently association restarts do not take into consideration the
    state of the socket.  When a restart happens, the current assocation
    simply transitions into established state.  This creates a condition
    where a remote system, through a the restart procedure, may create a
    local association that is no way reachable by user.  The conditions
    to trigger this are as follows:
      1) Remote does not acknoledge some data causing data to remain
         outstanding.
      2) Local application calls close() on the socket.  Since data
         is still outstanding, the association is placed in SHUTDOWN_PENDING
         state.  However, the socket is closed.
      3) The remote tries to create a new association, triggering a restart
         on the local system.  The association moves from SHUTDOWN_PENDING
         to ESTABLISHED.  At this point, it is no longer reachable by
         any socket on the local system.
    
    This patch addresses the above situation by moving the newly ESTABLISHED
    association into SHUTDOWN-SENT state and bundling a SHUTDOWN after
    the COOKIE-ACK chunk.  This way, the restarted associate immidiately
    enters the shutdown procedure and forces the termination of the
    unreachable association.
    
    Reported-by: David Laight <David.Laight@aculab.com>
    Signed-off-by: Vlad Yasevich <vyasevich@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit ed54569e2b2be022e8e155e23fdca672690b6642
Author: KY Srinivasan <kys@microsoft.com>
Date:   Sun Oct 5 10:42:51 2014 -0700

    hyperv: Fix a bug in netvsc_send()
    
    [ Upstream commit 3a67c9ccad926a168d8b7891537a452018368a5b ]
    
    After the packet is successfully sent, we should not touch the packet
    as it may have been freed. This patch is based on the work done by
    Long Li <longli@microsoft.com>.
    
    David, please queue this up for stable.
    
    Signed-off-by: K. Y. Srinivasan <kys@microsoft.com>
    Reported-by: Sitsofe Wheeler <sitsofe@yahoo.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c96de3dca9d548b56d07e27500ba33a5462a7931
Author: Joe Lawrence <Joe.Lawrence@stratus.com>
Date:   Fri Oct 3 09:58:34 2014 -0400

    team: avoid race condition in scheduling delayed work
    
    [ Upstream commit 47549650abd13d873fd2e5fc218db19e21031074 ]
    
    When team_notify_peers and team_mcast_rejoin are called, they both reset
    their respective .count_pending atomic variable. Then when the actual
    worker function is executed, the variable is atomically decremented.
    This pattern introduces a potential race condition where the
    .count_pending rolls over and the worker function keeps rescheduling
    until .count_pending decrements to zero again:
    
    THREAD 1                           THREAD 2
    
    ========                           ========
    team_notify_peers(teamX)
      atomic_set count_pending = 1
      schedule_delayed_work
                                       team_notify_peers(teamX)
                                       atomic_set count_pending = 1
    team_notify_peers_work
      atomic_dec_and_test
        count_pending = 0
      (return)
                                       schedule_delayed_work
                                       team_notify_peers_work
                                       atomic_dec_and_test
                                         count_pending = -1
                                       schedule_delayed_work
                                       (repeat until count_pending = 0)
    
    Instead of assigning a new value to .count_pending, use atomic_add to
    tack-on the additional desired worker function invocations.
    
    Signed-off-by: Joe Lawrence <joe.lawrence@stratus.com>
    Acked-by: Jiri Pirko <jiri@resnulli.us>
    Fixes: fc423ff00df3a19554414ee ("team: add peer notification")
    Fixes: 492b200efdd20b8fcfdac87 ("team: add support for sending multicast rejoins")
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e0ff82758ea34358e50b1c954e1d1851d38489a6
Author: Florian Fainelli <f.fainelli@gmail.com>
Date:   Thu Oct 2 09:43:16 2014 -0700

    net: systemport: fix bcm_sysport_insert_tsb()
    
    [ Upstream commit e87474a6e697857df21cff0707a2472abceca8b3 ]
    
    Similar to commit bc23333ba11fb7f959b7e87e121122f5a0fbbca8 ("net:
    bcmgenet: fix bcmgenet_put_tx_csum()"), we need to return the skb
    pointer in case we had to reallocate the SKB headroom.
    
    Fixes: 80105befdb4b8 ("net: systemport: add Broadcom SYSTEMPORT Ethernet MAC driver")
    Signed-off-by: Florian Fainelli <f.fainelli@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 570f480a5498a7d86d8ca0717f354bcb08c17fdb
Author: Nicolas Dichtel <nicolas.dichtel@6wind.com>
Date:   Thu Oct 2 18:26:49 2014 +0200

    ip6_gre: fix flowi6_proto value in xmit path
    
    [ Upstream commit 3be07244b7337760a3269d56b2f4a63e72218648 ]
    
    In xmit path, we build a flowi6 which will be used for the output route lookup.
    We are sending a GRE packet, neither IPv4 nor IPv6 encapsulated packet, thus the
    protocol should be IPPROTO_GRE.
    
    Fixes: c12b395a4664 ("gre: Support GRE over IPv6")
    Reported-by: Matthieu Ternisien d'Ouville <matthieu.tdo@6wind.com>
    Signed-off-by: Nicolas Dichtel <nicolas.dichtel@6wind.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>