15 Apr, 2016

6 commits

  • Pull crypto fixes from Herbert Xu:
    "This fixes an NFS regression caused by the skcipher/hash conversion in
    sunrpc. It also fixes a build problem in certain configurations with
    bcm63xx"

    * 'linus' of git://git.kernel.org/pub/scm/linux/kernel/git/herbert/crypto-2.6:
    hwrng: bcm63xx - fix device tree compilation
    sunrpc: Fix skcipher/shash conversion

    Linus Torvalds
     
  • Pull keys bugfixes from James Morris:
    "Two bugfixes for Keys related code"

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
    ASN.1: fix open failure check on headername
    assoc_array: don't call compare_object() on a node

    Linus Torvalds
     
  • In commit c4004b02f8e5b ("x86: remove the kernel code/data/bss resources
    from /proc/iomem") I was hoping to remove the phyiscal kernel address
    data from /proc/iomem entirely, but that had to be reverted because some
    system programs actually use it.

    This limits all the detailed resource information to properly
    credentialed users instead.

    Signed-off-by: Linus Torvalds

    Linus Torvalds
     
  • The PCI config access checked the file capabilities correctly, but used
    the itnernal security capability check rather than the helper function
    that is actually meant for that.

    The security_capable() has unusual return values and is not meant to be
    used elsewhere (the only other use is in the capability checking
    functions that we actually intend people to use, and this odd PCI usage
    really stood out when looking around the capability code.

    Signed-off-by: Linus Torvalds

    Linus Torvalds
     
  • A lot of seqfile users seem to be using things like %pK that uses the
    credentials of the current process, but that is actually completely
    wrong for filesystem interfaces.

    The unix semantics for permission checking files is to check permissions
    at _open_ time, not at read or write time, and that is not just a small
    detail: passing off stdin/stdout/stderr to a suid application and making
    the actual IO happen in privileged context is a classic exploit
    technique.

    So if we want to be able to look at permissions at read time, we need to
    use the file open credentials, not the current ones. Normal file
    accesses can just use "f_cred" (or any of the helper functions that do
    that, like file_ns_capable()), but the seqfile interfaces do not have
    any such options.

    It turns out that seq_file _does_ save away the user_ns information of
    the file, though. Since user_ns is just part of the full credential
    information, replace that special case with saving off the cred pointer
    instead, and suddenly seq_file has all the permission information it
    needs.

    Signed-off-by: Linus Torvalds

    Linus Torvalds
     
  • This reverts commit c4004b02f8e5b9ce357a0bb1641756cc86962664.

    Sadly, my hope that nobody would actually use the special kernel entries
    in /proc/iomem were dashed by kexec. Which reads /proc/iomem explicitly
    to find the kernel base address. Nasty.

    Anyway, that means we can't do the sane and simple thing and just remove
    the entries, and we'll instead have to mask them out based on permissions.

    Reported-by: Zhengyu Zhang
    Reported-by: Dave Young
    Reported-by: Freeman Zhang
    Reported-by: Emrah Demir
    Reported-by: Baoquan He
    Signed-off-by: Linus Torvalds

    Linus Torvalds
     

14 Apr, 2016

1 commit

  • Pull arch/sh fixes from Rich Felker:
    "Fixes for two arch/sh build regressions that appeared in 4.6-rc1, one
    introduced by me, and one caused by changes elsewhere"

    * tag 'sh-fixes-4.6-rc1' of git://git.libc.org/linux-sh:
    sh: fix function signature of cpu_coregroup_mask to match pointer type
    sh: fix smp-shx3 build regression from removal of arch localtimer

    Linus Torvalds
     

13 Apr, 2016

10 commits

  • Pull m68knommu/coldfire fix from Greg Ungerer:
    "Only a single change that removes a local arch specific gpio bus sysfs
    device that now clashes with the generic gpio bus sysfs device
    interface"

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/gerg/m68knommu:
    m68k/gpio: remove arch specific sysfs bus device

    Linus Torvalds
     
  • Pull ARM SoC fixes from Olof Johansson:
    "A batch of fixes for -rc4, for various platforms.

    Nothing really substantial and worth pointing out in particular; small
    fixes for various bugs, see shortlog for details"

    * tag 'armsoc-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/arm/arm-soc:
    ARM: sa1100: remove references to the defunct handhelds.org
    bus: uniphier-system-bus: fix condition of overlap check
    ARM: uniphier: drop weird sizeof()
    ARM: dts: am335x-baltos-ir5221: fix cpsw_emac0 link type
    ARM: OMAP: Correct interrupt type for ARM TWD
    ARM: DRA722: Add ID detect for Silicon Rev 2.0
    ARM: dts: am43xx: fix edma memcpy channel allocation
    ARM: dts: AM43x-epos: Fix clk parent for synctimer
    ARM: OMAP2: Fix up interconnect barrier initialization for DRA7
    documentation: Fix pinctrl documentation for Meson8 / Meson8b
    ARM: dts: amlogic: Split pinctrl device for Meson8 / Meson8b
    ARM: mvebu: Correct unit address for linksys
    bus: mvebu-mbus: use %pa to print phys_addr_t
    arm64: dts: vulcan: Update PCI ranges
    ARM: u8500_defconfig: turn on the Synaptics RMI4 driver
    ARM: pxa: fix the number of DMA requestor lines
    ARM: OMAP2+: hwmod: Fix updating of sysconfig register
    ARM: OMAP2+: Use srst_udelay for USB on dm814x

    Linus Torvalds
     
  • Pull KVM fixes from Radim Krčmář:
    "ARM fixes:
    - Wrong indentation in the PMU code from the merge window
    - A long-time bug occuring with running ntpd on the host, candidate
    for stable
    - Properly handle (and warn about) the unsupported configuration of
    running on systems with less than 40 bits of PA space
    - More fixes to the PM and hotplug notifier stuff from the merge
    window

    x86:
    - leak of guest xcr0 (typically shows up as SIGILL)
    - new maintainer (who is sending the pull request too)
    - fix for merge window regression
    - fix for guest CPUID"

    Paolo Bonzini points out:
    "For the record, this tag is signed by me because I prepared the pull
    request. Further pull requests for 4.6 will be signed and sent out by
    Radim directly"

    * tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm:
    KVM: x86: mask CPUID(0xD,0x1).EAX against host value
    kvm: x86: do not leak guest xcr0 into host interrupt handlers
    KVM: MMU: fix permission_fault()
    KVM: new maintainer on the block
    arm64: KVM: unregister notifiers in hyp mode teardown path
    arm64: KVM: Warn when PARange is less than 40 bits
    KVM: arm/arm64: Handle forward time correction gracefully
    arm64: KVM: Add braces to multi-line if statement in virtual PMU code

    Linus Torvalds
     
  • …/dhowells/linux-fs into for-linus

    James Morris
     
  • mvebu fixes for 4.6 (part 1)

    - fix USB adress register for Linksys Armada 388 based boards
    - fix build warning in mvebu-mbus

    * tag 'mvebu-fixes-4.6-1' of git://git.infradead.org/linux-mvebu:
    ARM: mvebu: Correct unit address for linksys
    bus: mvebu-mbus: use %pa to print phys_addr_t

    Signed-off-by: Olof Johansson

    Olof Johansson
     
  • The website handhelds.org has been down for a long time and is
    likely never coming back online.

    Signed-off-by: Linus Walleij
    Signed-off-by: Olof Johansson

    Linus Walleij
     
  • ARM: pxa: fixes for v4.6

    There is only a single fix for dma requestor lines initial
    setup, triggered by dmaengine previous fix.

    * tag 'pxa-fixes-v4.6' of https://github.com/rjarzmik/linux:
    ARM: pxa: fix the number of DMA requestor lines

    Signed-off-by: Olof Johansson

    Olof Johansson
     
  • …/git/tmlind/linux-omap into fixes

    Fixes for omaps against v4.6-rc1. Mostly minor fixes for the newer
    SoCs with few board fixes and a fix for a long time hwmod bug:

    - Fix cpsw_emac0 link type for baltos-ir5221
    - Fix interrupt type for TWD
    - Fix edma memcpy channel allocation for am43x
    - Fix am43x-epos sycntimer32k by using the correct assigned clock
    - Fix interconnect barrier for dra7
    - Fix a long time hwmod bug for updating sysconfig register properly
    - Fix flakey booting on dm814x where USB reset needs a delay

    And there is one minor change that is not strictly a fix, but is
    good to have for proper hardware detection:

    - Detect dra7 silicon revision 2.0 properly

    * tag 'omap-for-v4.6/fixes-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/tmlind/linux-omap:
    ARM: dts: am335x-baltos-ir5221: fix cpsw_emac0 link type
    ARM: OMAP: Correct interrupt type for ARM TWD
    ARM: DRA722: Add ID detect for Silicon Rev 2.0
    ARM: dts: am43xx: fix edma memcpy channel allocation
    ARM: dts: AM43x-epos: Fix clk parent for synctimer
    ARM: OMAP2: Fix up interconnect barrier initialization for DRA7
    ARM: OMAP2+: hwmod: Fix updating of sysconfig register
    ARM: OMAP2+: Use srst_udelay for USB on dm814x

    Signed-off-by: Olof Johansson <olof@lixom.net>

    Olof Johansson
     
  • This patch fixes condition whether the specified address ranges
    overlap each other.

    Fixes: 4b7f48d395a7 ("bus: uniphier-system-bus: add UniPhier System Bus driver")
    Signed-off-by: Kunihiko Hayashi
    Acked-by: Masahiro Yamada
    Signed-off-by: Olof Johansson

    Kunihiko Hayashi
     
  • My intention was to ioremap a 4-byte register. Coincidentally enough,
    sizeof(SZ_4) equals to SZ_4, but this code is weird anyway.

    Signed-off-by: Masahiro Yamada
    Signed-off-by: Olof Johansson

    Masahiro Yamada
     

12 Apr, 2016

3 commits

  • Pull HID fixes from Jiri Kosina:

    - fix for how scaling linearization is computed in wiimote driver, by
    Cyan Ogilvie

    - endless retry loop fix in generic USB HID core reset-resume handling,
    by Alan Stern

    - two functional fixes affecting particular devices, and oops fix for
    wacom driver, by Jason Gerecke

    - multitouch slot numbering fix from Gabriele Mazzotta

    - a couple more small fixes on top

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/hid:
    HID: wacom: Support switching from vendor-defined device mode on G9 and G11
    HID: wacom: Initialize hid_data.inputmode to -1
    HID: microsoft: add support for 3 more devices
    HID: multitouch: Synchronize MT frame on reset_resume
    HID: wacom: fix Bamboo ONE oops
    HID: lenovo: Don't use stack variables for DMA buffers
    HID: usbhid: fix inconsistent reset/resume/reset-resume behavior
    HID: wiimote: Fix wiimote mp scale linearization

    Linus Torvalds
     
  • Pull m68k update from Geert Uytterhoeven.

    * 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/geert/linux-m68k:
    m68k/defconfig: Update defconfigs for v4.6-rc2
    m68k: Wire up preadv2 and pwritev2

    Linus Torvalds
     
  • Pull ARC fixes from Vineet Gupta:
    - fix Kconfig splat due to pcie rework
    - make ethernet work again on axs103
    - provide fb_pgprotect() for future video driver integration

    * tag 'arc-4.6-rc4-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc:
    ARC: [plat-axs103] Enable loop block devices
    Revert "ARC: [plat-axs10x] add Ethernet PHY description in .dts"
    arc: Add our own implementation of fb_pgprotect()
    ARC: Don't source drivers/pci/pcie/Kconfig ourselves

    Linus Torvalds
     

11 Apr, 2016

9 commits

  • The ColdFire architecture specific gpio support code registers a sysfs
    bus device named "gpio". This clashes with the new generic API device
    added in commit 3c702e99 ("gpio: add a userspace chardev ABI for GPIOs").

    The old ColdFire sysfs gpio device was never used for anything specific,
    and no links or other nodes were created under it. The new API sysfs gpio
    device has all the same default sysfs links (device, drivers, etc) and
    they are properly populated.

    Remove the old ColdFire sysfs gpio registration.

    Signed-off-by: Greg Ungerer
    Acked-by: Linus Walleij

    Greg Ungerer
     
  • Linus Torvalds
     
  • Pull ARM fixes from Russell King:
    "A couple of small fixes, and wiring up the new syscalls which appeared
    during the merge window"

    * 'fixes' of git://ftp.arm.linux.org.uk/~rmk/linux-arm:
    ARM: 8550/1: protect idiv patching against undefined gcc behavior
    ARM: wire up preadv2 and pwritev2 syscalls
    ARM: SMP enable of cache maintanence broadcast

    Linus Torvalds
     
  • Pull MMC fixes from Ulf Hansson:
    "Here are a couple of mmc fixes intended for v4.6 rc3:

    MMC host:
    - sdhci: Fix regression setting power on Trats2 board
    - sdhci-pci: Add support and PCI IDs for more Broxton host controllers"

    * tag 'mmc-v4.6-rc1' of git://git.linaro.org/people/ulf.hansson/mmc:
    mmc: sdhci-pci: Add support and PCI IDs for more Broxton host controllers
    mmc: sdhci: Fix regression setting power on Trats2 board

    Linus Torvalds
     
  • Pull i2c fixes from Wolfram Sang:
    "Some bugfixes from I2C:

    - fix a uevent triggered boot problem by removing a useless debug
    print

    - fix sysfs-attributes of the new i2c-demux-pinctrl driver to follow
    standard kernel behaviour

    - fix a potential division-by-zero error (needed two takes)"

    * 'i2c/for-current' of git://git.kernel.org/pub/scm/linux/kernel/git/wsa/linux:
    i2c: jz4780: really prevent potential division by zero
    Revert "i2c: jz4780: prevent potential division by zero"
    i2c: jz4780: prevent potential division by zero
    i2c: mux: demux-pinctrl: Update docs to new sysfs-attributes
    i2c: mux: demux-pinctrl: Clean up sysfs attributes
    i2c: prevent endless uevent loop with CONFIG_I2C_DEBUG_CORE

    Linus Torvalds
     
  • This reverts commit 1028b55bafb7611dda1d8fed2aeca16a436b7dff.

    It's broken: it makes ext4 return an error at an invalid point, causing
    the readdir wrappers to write the the position of the last successful
    directory entry into the position field, which means that the next
    readdir will now return that last successful entry _again_.

    You can only return fatal errors (that terminate the readdir directory
    walk) from within the filesystem readdir functions, the "normal" errors
    (that happen when the readdir buffer fills up, for example) happen in
    the iterorator where we know the position of the actual failing entry.

    I do have a very different patch that does the "signal_pending()"
    handling inside the iterator function where it is allowable, but while
    that one passes all the sanity checks, I screwed up something like four
    times while emailing it out, so I'm not going to commit it today.

    So my track record is not good enough, and the stars will have to align
    better before that one gets committed. And it would be good to get some
    review too, of course, since celestial alignments are always an iffy
    debugging model.

    IOW, let's just revert the commit that caused the problem for now.

    Reported-by: Greg Thelen
    Cc: Theodore Ts'o
    Signed-off-by: Linus Torvalds

    Linus Torvalds
     
  • This ensures that the guest doesn't see XSAVE extensions
    (e.g. xgetbv1 or xsavec) that the host lacks.

    Cc: stable@vger.kernel.org
    Reviewed-by: Radim Krčmář
    Signed-off-by: Paolo Bonzini

    Paolo Bonzini
     
  • An interrupt handler that uses the fpu can kill a KVM VM, if it runs
    under the following conditions:
    - the guest's xcr0 register is loaded on the cpu
    - the guest's fpu context is not loaded
    - the host is using eagerfpu

    Note that the guest's xcr0 register and fpu context are not loaded as
    part of the atomic world switch into "guest mode". They are loaded by
    KVM while the cpu is still in "host mode".

    Usage of the fpu in interrupt context is gated by irq_fpu_usable(). The
    interrupt handler will look something like this:

    if (irq_fpu_usable()) {
    kernel_fpu_begin();

    [... code that uses the fpu ...]

    kernel_fpu_end();
    }

    As long as the guest's fpu is not loaded and the host is using eager
    fpu, irq_fpu_usable() returns true (interrupted_kernel_fpu_idle()
    returns true). The interrupt handler proceeds to use the fpu with
    the guest's xcr0 live.

    kernel_fpu_begin() saves the current fpu context. If this uses
    XSAVE[OPT], it may leave the xsave area in an undesirable state.
    According to the SDM, during XSAVE bit i of XSTATE_BV is not modified
    if bit i is 0 in xcr0. So it's possible that XSTATE_BV[i] == 1 and
    xcr0[i] == 0 following an XSAVE.

    kernel_fpu_end() restores the fpu context. Now if any bit i in
    XSTATE_BV == 1 while xcr0[i] == 0, XRSTOR generates a #GP. The
    fault is trapped and SIGSEGV is delivered to the current process.

    Only pre-4.2 kernels appear to be vulnerable to this sequence of
    events. Commit 653f52c ("kvm,x86: load guest FPU context more eagerly")
    from 4.2 forces the guest's fpu to always be loaded on eagerfpu hosts.

    This patch fixes the bug by keeping the host's xcr0 loaded outside
    of the interrupts-disabled region where KVM switches into guest mode.

    Cc: stable@vger.kernel.org
    Suggested-by: Andy Lutomirski
    Signed-off-by: David Matlack
    [Move load after goto cancel_injection. - Paolo]
    Signed-off-by: Paolo Bonzini

    David Matlack
     
  • kvm-unit-tests complained about the PFEC is not set properly, e.g,:
    test pte.rw pte.d pte.nx pde.p pde.rw pde.pse user fetch: FAIL: error code 15
    expected 5
    Dump mapping: address: 0x123400000000
    ------L4: 3e95007
    ------L3: 3e96007
    ------L2: 2000083

    It's caused by the reason that PFEC returned to guest is copied from the
    PFEC triggered by shadow page table

    This patch fixes it and makes the logic of updating errcode more clean

    Signed-off-by: Xiao Guangrong
    [Do not assume pfec.p=1. - Paolo]
    Signed-off-by: Paolo Bonzini

    Xiao Guangrong
     

10 Apr, 2016

11 commits

  • Pull parisc fixes from Helge Deller:
    "Since commit 0de798584bde ("parisc: Use generic extable search and
    sort routines") module loading is boken on parisc, because the parisc
    module loader wasn't prepared for the new R_PARISC_PCREL32 relocations.

    In addition, due to that breakage, Mikulas Patocka noticed that
    handling exceptions from modules probably never worked on parisc. It
    was just masked by the fact that exceptions from modules don't happen
    during normal use.

    This patch series fixes those issues and survives the tests of the
    lib/test_user_copy kernel module test. Some patches are tagged for
    stable"

    * 'parisc-4.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/deller/parisc-linux:
    parisc: Update comment regarding relative extable support
    parisc: Unbreak handling exceptions from kernel modules
    parisc: Fix kernel crash with reversed copy_from_user()
    parisc: Avoid function pointers for kernel exception routines
    parisc: Handle R_PARISC_PCREL32 relocations in kernel modules

    Linus Torvalds
     
  • Pull libnvdimm fixes from Dan Williams:
    "Three fixes, the first two are tagged for -stable:

    - The ndctl utility/library gained expanded unit tests illuminating a
    long standing bug in the libnvdimm SMART data retrieval
    implementation.

    It has been broken since its initial implementation, now fixed.

    - Another one line fix for the detection of stale info blocks.

    Without this change userspace can get into a situation where it is
    unable to reconfigure a namespace.

    - Fix the badblock initialization path in the presence of the new (in
    v4.6-rc1) section alignment workarounds.

    Without this change badblocks will be reported at the wrong offset.

    These have received a build success report from the kbuild robot and
    have appeared in -next with no reported issues"

    * 'libnvdimm-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/nvdimm/nvdimm:
    libnvdimm, pfn: fix nvdimm_namespace_add_poison() vs section alignment
    libnvdimm, pfn: fix uuid validation
    libnvdimm: fix smart data retrieval

    Linus Torvalds
     
  • Pull GPIO fixes from Linus Walleij:
    "Here is a set of four GPIO fixes. The two fixes to the core are
    serious as they are regressing minor architectures.

    Core fixes:

    - Defer GPIO device setup until after gpiolib is initialized.

    It turns out that a few very tightly integrated GPIO platform
    drivers initialize so early (befor core_initcall()) so that the
    gpiolib isn't even initialized itself. That limits what the
    library can do, and we cannot reference uninitialized fields until
    later.

    Defer some of the initialization until right after the gpiolib is
    initialized in these (rare) cases.

    - As a consequence: do not use devm_* resources when allocating the
    states in the initial set-up of the gpiochip.

    Driver fixes:

    - In ACPI retrieveal: ignore GpioInt when looking for output GPIOs.

    - Fix legacy builds on the PXA without a backing pin controller.

    - Use correct datatype on pca953x register writes"

    * tag 'gpio-v4.6-3' of git://git.kernel.org/pub/scm/linux/kernel/git/linusw/linux-gpio:
    gpio: pca953x: Use correct u16 value for register word write
    gpiolib: Defer gpio device setup until after gpiolib initialization
    gpiolib: Do not use devm functions when registering gpio chip
    gpio: pxa: fix legacy non pinctrl aware builds
    gpio / ACPI: ignore GpioInt() GPIOs when requesting GPIO_OUT_*

    Linus Torvalds
     
  • Pull tty fixes from Greg KH:
    "Here are two tty fixes for issues found.

    One was due to a merge error in 4.6-rc1, and the other a regression
    fix for UML consoles that broke in 4.6-rc1.

    Both have been in linux-next for a while"

    * tag 'tty-4.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
    tty: Fix merge of "tty: Refactor tty_open()"
    tty: Fix UML console breakage

    Linus Torvalds
     
  • Pull USB fixes from Greg KH:
    "Here are some USB fixes and new device ids for 4.6-rc3.

    Nothing major, the normal USB gadget fixes and usb-serial driver ids,
    along with some other fixes mixed in. All except the USB serial ids
    have been tested in linux-next, the id additions should be fine as
    they are 'trivial'"

    * tag 'usb-4.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (25 commits)
    USB: option: add "D-Link DWM-221 B1" device id
    USB: serial: cp210x: Adding GE Healthcare Device ID
    USB: serial: ftdi_sio: Add support for ICP DAS I-756xU devices
    usb: dwc3: keystone: drop dma_mask configuration
    usb: gadget: udc-core: remove manual dma configuration
    usb: dwc3: pci: add ID for one more Intel Broxton platform
    usb: renesas_usbhs: fix to avoid using a disabled ep in usbhsg_queue_done()
    usb: dwc2: do not override forced dr_mode in gadget setup
    usb: gadget: f_midi: unlock on error
    USB: digi_acceleport: do sanity checking for the number of ports
    USB: cypress_m8: add endpoint sanity check
    USB: mct_u232: add sanity checking in probe
    usb: fix regression in SuperSpeed endpoint descriptor parsing
    USB: usbip: fix potential out-of-bounds write
    usb: renesas_usbhs: disable TX IRQ before starting TX DMAC transfer
    usb: renesas_usbhs: avoid NULL pointer derefernce in usbhsf_pkt_handler()
    usb: gadget: f_midi: Fixed a bug when buflen was smaller than wMaxPacketSize
    usb: phy: qcom-8x16: fix regulator API abuse
    usb: ch9: Fix SSP Device Cap wFunctionalitySupport type
    usb: gadget: composite: Access SSP Dev Cap fields properly
    ...

    Linus Torvalds
     
  • Pull staging and IIO driver fixes from Greg KH:
    "Here are some IIO driver fixes, along with two staging driver fixes
    for 4.6-rc3.

    One staging driver patch reverts the deletion of a driver that
    happened in 4.6-rc1. We thought that laptop.org was dead, but it's
    still alive and kicking, and has users that were mad we broke their
    hardware by deleting a driver for their machines. So that driver is
    added back and everyone is happy again.

    All of these have been in linux-next for a while with no reported
    issues"

    * tag 'staging-4.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging:
    Revert "Staging: olpc_dcon: Remove obsolete driver"
    staging/rdma/hfi1: select CRC32
    iio: gyro: bmg160: fix buffer read values
    iio: gyro: bmg160: fix endianness when reading axes
    iio: accel: bmc150: fix endianness when reading axes
    iio: st_magn: always define ST_MAGN_TRIGGER_SET_STATE
    iio: fix config watermark initial value
    iio: health: max30100: correct FIFO check condition
    iio: imu: Fix inv_mpu6050 dependencies
    iio: adc: Fix build error of missing devm_ioremap_resource on UM
    iio: light: apds9960: correct FIFO check condition
    iio: adc: max1363: correct reference voltage
    iio: adc: max1363: add missing adc to max1363_id

    Linus Torvalds
     
  • Pull SCSI fixes from James Bottomley:
    "This is a set of eight fixes.

    Two are trivial gcc-6 updates (brace additions and unused variable
    removal). There's a couple of cxlflash regressions, a correction for
    sd being overly chatty on revalidation (causing excess log increases).
    A VPD issue which could crash USB devices because they seem very
    intolerant to VPD inquiries, an ALUA deadlock fix and a mpt3sas buffer
    overrun fix"

    * tag 'scsi-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jejb/scsi:
    scsi: Do not attach VPD to devices that don't support it
    sd: Fix excessive capacity printing on devices with blocks bigger than 512 bytes
    scsi_dh_alua: Fix a recently introduced deadlock
    scsi: Declare local symbols static
    cxlflash: Move to exponential back-off when cmd_room is not available
    cxlflash: Fix regression issue with re-ordering patch
    mpt3sas: Don't overreach ioc->reply_post[] during initialization
    aacraid: add missing curly braces

    Linus Torvalds
     
  • Pull MD fixes from Shaohua Li:
    "This update mainly fixes bugs:

    - fix error handling (Guoqing)
    - fix a crash when a disk is hotremoved (me)
    - fix a dead loop (Wei Fang)"

    * tag 'md/4.6-rc2-fix' of git://git.kernel.org/pub/scm/linux/kernel/git/shli/md:
    md/bitmap: clear bitmap if bitmap_create failed
    MD: add rdev reference for super write
    md: fix a trivial typo in comments
    md:raid1: fix a dead loop when read from a WriteMostly disk

    Linus Torvalds
     
  • Pull power management and ACPI fixes from Rafael Wysocki:
    "Fixes for some issues discovered after recent changes and for some
    that have just been found lately regardless of those changes
    (intel_pstate, intel_idle, PM core, mailbox/pcc, turbostat) plus
    support for some new CPU models (intel_idle, Intel RAPL driver,
    turbostat) and documentation updates (intel_pstate, PM core).

    Specifics:

    - intel_pstate fixes for two issues exposed by the recent switch over
    from using timers and for one issue introduced during the 4.4 cycle
    plus new comments describing data structures used by the driver
    (Rafael Wysocki, Srinivas Pandruvada).

    - intel_idle fixes related to CPU offline/online (Richard Cochran).

    - intel_idle support (new CPU IDs and state definitions mostly) for
    Skylake-X and Kabylake processors (Len Brown).

    - PCC mailbox driver fix for an out-of-bounds memory access that may
    cause the kernel to panic() (Shanker Donthineni).

    - New (missing) CPU ID for one apparently overlooked Haswell model in
    the Intel RAPL power capping driver (Srinivas Pandruvada).

    - Fix for the PM core's wakeup IRQs framework to make it work after
    wakeup settings reconfiguration from sysfs (Grygorii Strashko).

    - Runtime PM documentation update to make it describe what needs to
    be done during device removal more precisely (Krzysztof Kozlowski).

    - Stale comment removal cleanup in the cpufreq-dt driver (Viresh
    Kumar).

    - turbostat utility fixes and support for Broxton, Skylake-X and
    Kabylake processors (Len Brown)"

    * tag 'pm+acpi-4.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm: (28 commits)
    PM / wakeirq: fix wakeirq setting after wakup re-configuration from sysfs
    tools/power turbostat: work around RC6 counter wrap
    tools/power turbostat: initial KBL support
    tools/power turbostat: initial SKX support
    tools/power turbostat: decode BXT TSC frequency via CPUID
    tools/power turbostat: initial BXT support
    tools/power turbostat: print IRTL MSRs
    tools/power turbostat: SGX state should print only if --debug
    intel_idle: Add KBL support
    intel_idle: Add SKX support
    intel_idle: Clean up all registered devices on exit.
    intel_idle: Propagate hot plug errors.
    intel_idle: Don't overreact to a cpuidle registration failure.
    intel_idle: Setup the timer broadcast only on successful driver load.
    intel_idle: Avoid a double free of the per-CPU data.
    intel_idle: Fix dangling registration on error path.
    intel_idle: Fix deallocation order on the driver exit path.
    intel_idle: Remove redundant initialization calls.
    intel_idle: Fix a helper function's return value.
    intel_idle: remove useless return from void function.
    ...

    Linus Torvalds
     
  • Pull networking fixes from David Miller:

    1) Stale SKB data pointer access across pskb_may_pull() calls in L2TP,
    from Haishuang Yan.

    2) Fix multicast frame handling in mac80211 AP code, from Felix
    Fietkau.

    3) mac80211 station hashtable insert errors not handled properly, fix
    from Johannes Berg.

    4) Fix TX descriptor count limit handling in e1000, from Alexander
    Duyck.

    5) Revert a buggy netdev refcount fix in netpoll, from Bjorn Helgaas.

    6) Must assign rtnl_link_ops of the device before registering it, fix
    in ip6_tunnel from Thadeu Lima de Souza Cascardo.

    7) Memory leak fix in tc action net exit, from WANG Cong.

    8) Add missing AF_KCM entries to name tables, from Dexuan Cui.

    9) Fix regression in GRE handling of csums wrt. FOU, from Alexander
    Duyck.

    10) Fix memory allocation alignment and congestion map corruption in
    RDS, from Shamir Rabinovitch.

    11) Fix default qdisc regression in tuntap driver, from Jason Wang.

    * git://git.kernel.org/pub/scm/linux/kernel/git/davem/net: (44 commits)
    bridge, netem: mark mailing lists as moderated
    tuntap: restore default qdisc
    mpls: find_outdev: check for err ptr in addition to NULL check
    ipv6: Count in extension headers in skb->network_header
    RDS: fix congestion map corruption for PAGE_SIZE > 4k
    RDS: memory allocated must be align to 8
    GRE: Disable segmentation offloads w/ CSUM and we are encapsulated via FOU
    net: add the AF_KCM entries to family name tables
    MAINTAINERS: intel-wired-lan list is moderated
    lib/test_bpf: Add additional BPF_ADD tests
    lib/test_bpf: Add test to check for result of 32-bit add that overflows
    lib/test_bpf: Add tests for unsigned BPF_JGT
    lib/test_bpf: Fix JMP_JSET tests
    VSOCK: Detach QP check should filter out non matching QPs.
    stmmac: fix adjust link call in case of a switch is attached
    af_packet: tone down the Tx-ring unsupported spew.
    net_sched: fix a memory leak in tc action
    samples/bpf: Enable powerpc support
    samples/bpf: Use llc in PATH, rather than a hardcoded value
    samples/bpf: Fix build breakage with map_perf_test_user.c
    ...

    Linus Torvalds
     
  • Pull btrfs fixes from Chris Mason:
    "These are bug fixes, including a really old fsync bug, and a few trace
    points to help us track down problems in the quota code"

    * 'for-linus-4.6' of git://git.kernel.org/pub/scm/linux/kernel/git/mason/linux-btrfs:
    Btrfs: fix file/data loss caused by fsync after rename and new inode
    btrfs: Reset IO error counters before start of device replacing
    btrfs: Add qgroup tracing
    Btrfs: don't use src fd for printk
    btrfs: fallback to vmalloc in btrfs_compare_tree
    btrfs: handle non-fatal errors in btrfs_qgroup_inherit()
    btrfs: Output more info for enospc_debug mount option
    Btrfs: fix invalid reference in replace_path
    Btrfs: Improve FL_KEEP_SIZE handling in fallocate

    Linus Torvalds