commit 4d29e8c0e9319ce9d391c57d3133306c05b6cef5
Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Date:   Sat Jul 15 10:24:32 2017 +0200

    Linux 3.18.61

commit 4f072edd030b7061564f69e0045b5a2c39b04bbd
Author: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
Date:   Sat Jul 2 20:27:46 2016 -0300

    saa7134: fix warm Medion 7134 EEPROM read
    
    commit 5a91206ff0d0548939f3e85a65fb76b400fb0e89 upstream.
    
    When saa7134 module driving a Medion 7134 card is reloaded reads of this
    card EEPROM (required for automatic detection of tuner model) will be
    corrupted due to I2C gate in DVB-T demod being left closed.
    This sometimes also happens on first saa7134 module load after a warm
    reboot.
    
    Fix this by opening this I2C gate before doing EEPROM read during i2c
    initialization.
    
    Signed-off-by: Maciej S. Szmigiero <mail@maciej.szmigiero.name>
    Signed-off-by: Mauro Carvalho Chehab <mchehab@s-opensource.com>
    Cc: Oliver Hartkopp <socketcan@hartkopp.net>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit a4436f8eee67e2196eb18e827509027171df8932
Author: Ian Abbott <abbotti@mev.co.uk>
Date:   Fri Jun 16 19:35:34 2017 +0100

    staging: comedi: fix clean-up of comedi_class in comedi_init()
    
    commit a9332e9ad09c2644c99058fcf6ae2f355e93ce74 upstream.
    
    There is a clean-up bug in the core comedi module initialization
    functions, `comedi_init()`.  If the `comedi_num_legacy_minors` module
    parameter is non-zero (and valid), it creates that many "legacy" devices
    and registers them in SysFS.  A failure causes the function to clean up
    and return an error.  Unfortunately, it fails to destroy the "comedi"
    class that was created earlier.  Fix it by adding a call to
    `class_destroy(comedi_class)` at the appropriate place in the clean-up
    sequence.
    
    Signed-off-by: Ian Abbott <abbotti@mev.co.uk>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit f1fbb849f3e7daa154e64290c21418c44bcf80b5
Author: Malcolm Priestley <tvboxspy@gmail.com>
Date:   Sat Apr 29 13:03:44 2017 +0100

    staging: vt6556: vnt_start Fix missing call to vnt_key_init_table.
    
    commit dc32190f2cd41c7dba25363ea7d618d4f5172b4e upstream.
    
    The key table is not intialized correctly without this call.
    
    Signed-off-by: Malcolm Priestley <tvboxspy@gmail.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 96b50797868b81096b1149c3ab26b71a2a749d72
Author: Jason Yan <yanaijie@huawei.com>
Date:   Fri Mar 10 11:27:23 2017 +0800

    md: fix super_offset endianness in super_1_rdev_size_change
    
    commit 3fb632e40d7667d8bedfabc28850ac06d5493f54 upstream.
    
    The sb->super_offset should be big-endian, but the rdev->sb_start is in
    host byte order, so fix this by adding cpu_to_le64.
    
    Signed-off-by: Jason Yan <yanaijie@huawei.com>
    Signed-off-by: Shaohua Li <shli@fb.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 7eaa7e5baa0ffb3b6ca28798f0e014f43c004f47
Author: Cong Wang <xiyou.wangcong@gmail.com>
Date:   Sun Jul 9 13:19:55 2017 -0700

    mqueue: fix a use-after-free in sys_mq_notify()
    
    commit f991af3daabaecff34684fd51fac80319d1baad1 upstream.
    
    The retry logic for netlink_attachskb() inside sys_mq_notify()
    is nasty and vulnerable:
    
    1) The sock refcnt is already released when retry is needed
    2) The fd is controllable by user-space because we already
       release the file refcnt
    
    so we when retry but the fd has been just closed by user-space
    during this small window, we end up calling netlink_detachskb()
    on the error path which releases the sock again, later when
    the user-space closes this socket a use-after-free could be
    triggered.
    
    Setting 'sock' to NULL here should be sufficient to fix it.
    
    Reported-by: GeneBlue <geneblue.mail@gmail.com>
    Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
    Cc: Andrew Morton <akpm@linux-foundation.org>
    Cc: Manfred Spraul <manfred@colorfullife.com>
    Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9c2586ce3255d1d2153c0c67687fcfdc223284e0
Author: Dan Carpenter <dan.carpenter@oracle.com>
Date:   Thu Feb 9 17:17:52 2017 +0000

    KEYS: Fix an error code in request_master_key()
    
    commit 57cb17e764ba0aaa169d07796acce54ccfbc6cae upstream.
    
    This function has two callers and neither are able to handle a NULL
    return.  Really, -EINVAL is the correct thing return here anyway.  This
    fixes some static checker warnings like:
    
            security/keys/encrypted-keys/encrypted.c:709 encrypted_key_decrypt()
            error: uninitialized symbol 'master_key'.
    
    Fixes: 7e70cb497850 ("keys: add new key-type encrypted")
    Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
    Acked-by: Mimi Zohar <zohar@linux.vnet.ibm.com>
    Signed-off-by: James Morris <james.l.morris@oracle.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 02de02fe2b90be589615c8ed5c8ecc07f28b9a9d
Author: Bjørn Mork <bjorn@mork.no>
Date:   Tue Jun 13 19:11:42 2017 +0200

    USB: serial: qcserial: new Sierra Wireless EM7305 device ID
    
    commit 996fab55d864ed604158f71724ff52db1c2454a3 upstream.
    
    A new Sierra Wireless EM7305 device ID used in a Toshiba laptop.
    
    Reported-by: Petr Kloc <petr_kloc@yahoo.com>
    Signed-off-by: Bjørn Mork <bjorn@mork.no>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 79fc0784b6271ca16ab3d1b637cd6fb432c123a1
Author: Johan Hovold <johan@kernel.org>
Date:   Mon Jun 12 16:30:16 2017 +0200

    USB: serial: option: add two Longcheer device ids
    
    commit 8fb060da715ad10fe956d7c0077b2fb0c12bb9d7 upstream.
    
    Add two Longcheer device-id entries which specifically enables a
    Telewell TW-3G HSPA+ branded modem (0x9801).
    
    Reported-by: Teemu Likonen <tlikonen@iki.fi>
    Reported-by: Bjørn Mork <bjorn@mork.no>
    Reported-by: Lars Melin <larsm17@gmail.com>
    Tested-by: Teemu Likonen <tlikonen@iki.fi>
    Signed-off-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 9331bfbad071e6e0bfdce7394094b62f2047a8d9
Author: Geert Uytterhoeven <geert+renesas@glider.be>
Date:   Thu Mar 9 19:20:48 2017 +0100

    pinctrl: sh-pfc: Update info pointer after SoC-specific init
    
    commit 3091ae775fae17084013021d01513bc1ad274e6a upstream.
    
    Update the sh_pfc_soc_info pointer after calling the SoC-specific
    initialization function, as it may have been updated to e.g. handle
    different SoC revisions.  This makes sure the correct subdriver name is
    printed later.
    
    Fixes: 0c151062f32c9db8 ("sh-pfc: Add support for SoC-specific initialization")
    Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 16f79326d90ade1ae8102f170fee2ad4f957bd38
Author: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
Date:   Thu May 18 11:23:55 2017 +0200

    pinctrl: mxs: atomically switch mux and drive strength config
    
    commit da6c2addf66d7ff7d0b090d6267d4292f951e4e6 upstream.
    
    To set the mux mode of a pin two bits must be set. Up to now this is
    implemented using the following idiom:
    
            writel(mask, reg + CLR);
            writel(value, reg + SET);
    
    . This however results in the mux mode being 0 between the two writes.
    
    On my machine there is an IC's reset pin connected to LCD_D20. The
    bootloader configures this pin as GPIO output-high (i.e. not holding the
    IC in reset). When Linux reconfigures the pin to GPIO the short time
    LCD_D20 is muxed as LCD_D20 instead of GPIO_1_20 is enough to confuse
    the connected IC.
    
    The same problem is present for the pin's drive strength setting which is
    reset to low drive strength before using the right value.
    
    So instead of relying on the hardware to modify the register setting
    using two writes implement the bit toggling using read-modify-write.
    
    Fixes: 17723111e64f ("pinctrl: add pinctrl-mxs support")
    Signed-off-by: Uwe Kleine-König <u.kleine-koenig@pengutronix.de>
    Acked-by: Shawn Guo <shawnguo@kernel.org>
    Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit e7ce85766bdda03194e33f2e5c2e8a959ed818b9
Author: Benjamin Herrenschmidt <benh@kernel.crashing.org>
Date:   Tue Jun 13 16:01:13 2017 +1000

    usb: Fix typo in the definition of Endpoint[out]Request
    
    commit 7cf916bd639bd26db7214f2205bccdb4b9306256 upstream.
    
    The current definition is wrong. This breaks my upcoming
    Aspeed virtual hub driver.
    
    Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c8432af134b0e03b3f7cc22e145faca35a48999b
Author: Michael Grzeschik <m.grzeschik@pengutronix.de>
Date:   Mon May 22 13:02:44 2017 +0200

    usb: usbip: set buffer pointers to NULL after free
    
    commit b3b51417d0af63fb9a06662dc292200aed9ea53f upstream.
    
    The usbip stack dynamically allocates the transfer_buffer and
    setup_packet of each urb that got generated by the tcp to usb stub code.
    As these pointers are always used only once we will set them to NULL
    after use. This is done likewise to the free_urb code in vudc_dev.c.
    This patch fixes double kfree situations where the usbip remote side
    added the URB_FREE_BUFFER.
    
    Signed-off-by: Michael Grzeschik <m.grzeschik@pengutronix.de>
    Acked-by: Shuah Khan <shuahkh@osg.samsung.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit d085cd019747cc551608074fec95a30442bc8e8b
Author: Devin Heitmueller <dheitmueller@kernellabs.com>
Date:   Tue Jun 27 13:08:51 2017 -0400

    Add USB quirk for HVR-950q to avoid intermittent device resets
    
    commit 6836796de4019944f4ba4c99a360e8250fd2e735 upstream.
    
    The USB core and sysfs will attempt to enumerate certain parameters
    which are unsupported by the au0828 - causing inconsistent behavior
    and sometimes causing the chip to reset.  Avoid making these calls.
    
    This problem manifested as intermittent cases where the au8522 would
    be reset on analog video startup, in particular when starting up ALSA
    audio streaming in parallel - the sysfs entries created by
    snd-usb-audio on streaming startup would result in unsupported control
    messages being sent during tuning which would put the chip into an
    unknown state.
    
    Signed-off-by: Devin Heitmueller <dheitmueller@kernellabs.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit dc75a5984dd14aa71c7aa76bb6f0333f6361bc43
Author: Jeremie Rapin <rapinj@gmail.com>
Date:   Wed Jun 28 18:23:25 2017 +0200

    USB: serial: cp210x: add ID for CEL EM3588 USB ZigBee stick
    
    commit fd90f73a9925f248d696bde1cfc836d9fda5570d upstream.
    
    Added the USB serial device ID for the CEL ZigBee EM3588
    radio stick.
    
    Signed-off-by: Jeremie Rapin <rapinj@gmail.com>
    Acked-by: Johan Hovold <johan@kernel.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 05d219d0d58c203a72f46bce92378c51feb1fc67
Author: Felipe Balbi <felipe.balbi@linux.intel.com>
Date:   Wed May 17 15:57:45 2017 +0300

    usb: dwc3: replace %p with %pK
    
    commit 04fb365c453e14ff9e8a28f1c46050d920a27a4a upstream.
    
    %p will leak kernel pointers, so let's not expose the information on
    dmesg and instead use %pK. %pK will only show the actual addresses if
    explicitly enabled under /proc/sys/kernel/kptr_restrict.
    
    Acked-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
    Signed-off-by: Felipe Balbi <felipe.balbi@linux.intel.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 927935772efa9faaa3e104eddc454c254a1ce65e
Author: Sabrina Dubroca <sd@queasysnail.net>
Date:   Thu Jun 22 11:24:42 2017 +0200

    tracing/kprobes: Allow to create probe with a module name starting with a digit
    
    commit 9e52b32567126fe146f198971364f68d3bc5233f upstream.
    
    Always try to parse an address, since kstrtoul() will safely fail when
    given a symbol as input. If that fails (which will be the case for a
    symbol), try to parse a symbol instead.
    
    This allows creating a probe such as:
    
        p:probe/vlan_gro_receive 8021q:vlan_gro_receive+0
    
    Which is necessary for this command to work:
    
        perf probe -m 8021q -a vlan_gro_receive
    
    Link: http://lkml.kernel.org/r/fd72d666f45b114e2c5b9cf7e27b91de1ec966f1.1498122881.git.sd@queasysnail.net
    
    Fixes: 413d37d1e ("tracing: Add kprobe-based event tracer")
    Acked-by: Masami Hiramatsu <mhiramat@kernel.org>
    Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
    Signed-off-by: Steven Rostedt (VMware) <rostedt@goodmis.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 92c414a143539f9f4abfd385288e0e86056653f5
Author: Jonas Gorski <jogo@openwrt.org>
Date:   Sun Aug 23 15:01:08 2015 +0200

    usb: ehci-orion: fix probe for !GENERIC_PHY
    
    commit db1319e166c5e872c4be54eac4e47454133708cf upstream.
    
    Commit d445913ce0ab7f ("usb: ehci-orion: add optional PHY support")
    added support for optional phys, but devm_phy_optional_get returns
    -ENOSYS if GENERIC_PHY is not enabled.
    
    This causes probe failures, even when there are no phys specified:
    
    [    1.443365] orion-ehci f1058000.usb: init f1058000.usb fail, -38
    [    1.449403] orion-ehci: probe of f1058000.usb failed with error -38
    
    Similar to dwc3, treat -ENOSYS as no phy.
    
    Fixes: d445913ce0ab7f ("usb: ehci-orion: add optional PHY support")
    
    Signed-off-by: Jonas Gorski <jogo@openwrt.org>
    Acked-by: Alan Stern <stern@rowland.harvard.edu>
    Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c3a247e00b4024812ce4574c30c95fcdf5d28973
Author: Rafał Miłecki <zajec5@gmail.com>
Date:   Tue Apr 12 13:30:45 2016 +0200

    bgmac: reset & enable Ethernet core before using it
    
    commit b4dfd8e92956b396d3438212bc9a0be6267b8b34 upstream.
    
    This fixes Ethernet on D-Link DIR-885L with BCM47094 SoC. Felix reported
    similar fix was needed for his BCM4709 device (Buffalo WXR-1900DHP?).
    I tested this for regressions on BCM4706, BCM4708A0 and BCM47081A0.
    
    Cc: Felix Fietkau <nbd@openwrt.org>
    Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit c43a7c782f4e8de5100fe2983e0c3bb3f7e8a002
Author: Rafał Miłecki <zajec5@gmail.com>
Date:   Wed Feb 11 18:06:34 2015 +0100

    bgmac: fix device initialization on Northstar SoCs (condition typo)
    
    commit 21697336d46b71dd031f29e426dda0b1e7f06cc0 upstream.
    
    On Northstar (Broadcom's ARM architecture) we need to manually enable
    all cores. Code for that is already in place, but the condition for it
    was wrong.
    
    Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
    Signed-off-by: David S. Miller <davem@davemloft.net>
    Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 8f0f9e09aaa7fc885e234c7e29da3dbee5fcf794
Author: Yousong Zhou <yszhou4tech@gmail.com>
Date:   Sat Sep 26 13:41:43 2015 +0800

    MIPS: UAPI: Ignore __arch_swab{16,32,64} when using MIPS16
    
    commit 71a0a72456b48de972d7ed613b06a22a3aa9057f upstream.
    
    Some GCC versions (e.g. 4.8.3) can incorrectly inline a function with
    MIPS32 instructions into another function with MIPS16 code [1], causing
    the assembler to genereate incorrect binary code or fail right away
    complaining about unrecognized opcode.
    
    In the case of __arch_swab{16,32}, when inlined by the compiler with
    flags `-mips32r2 -mips16 -Os', the assembler can fail with the following
    error.
    
        {standard input}:79: Error: unrecognized opcode `wsbh $2,$2'
    
    For performance concerns and to workaround the issue already existing in
    older compilers, just ignore these 2 functions when compiling with
    mips16 enabled.
    
     [1] Inlining nomips16 function into mips16 function can result in
         undefined builtins, https://gcc.gnu.org/bugzilla/show_bug.cgi?id=55777
    
    Signed-off-by: Yousong Zhou <yszhou4tech@gmail.com>
    Cc: Maciej W. Rozycki <macro@linux-mips.org>
    Cc: linux-mips@linux-mips.org
    Patchwork: https://patchwork.linux-mips.org/patch/11241/
    Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
    Signed-off-by: Amit Pundir <amit.pundir@linaro.org>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

commit 61b0972bd40ae77fabb019e26402ac17906fcb15
Author: Adrian Salido <salidoa@google.com>
Date:   Tue Apr 25 16:55:26 2017 -0700

    driver core: platform: fix race condition with driver_override
    
    commit 6265539776a0810b7ce6398c27866ddb9c6bd154 upstream.
    
    The driver_override implementation is susceptible to race condition when
    different threads are reading vs storing a different driver override.
    Add locking to avoid race condition.
    
    Fixes: 3d713e0e382e ("driver core: platform: add device binding path 'driver_override'")
    Cc: stable@vger.kernel.org
    Signed-off-by: Adrian Salido <salidoa@google.com>
    Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>