drivers: apanic: Android kernel panic handler.

This driver triggers when the kernel panics and attempts to
write critical debug data to the flash.

Signed-off-by: San Mehat <san@google.com>

drivers: apanic: checkpatch fixes

Signed-off-by: San Mehat <san@google.com>

apanic: Fix a few cases of calling non-atomic things from atomic

We need to pay special care to not enrage cond_resched(), and the
base nand bb stuff calls schedule() so thats out.

Change-Id: I2f57b5666b3e575bf88bec4b8bbd1da1b4701a13
Signed-off-by: San Mehat <san@google.com>
Reviewed-on: http://git-master/r/111036
Reviewed-by: Prashant Malani <pmalani@nvidia.com>
Tested-by: Prashant Malani <pmalani@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Bo Yan <byan@nvidia.com>

mtd: nand: Add naieve panic_write support for generic nand devices.

Signed-off-by: San Mehat <san@google.com>

mtd: nand_base: fix nand_panic_wait

fix the problem of nand_panic_wait

Change-Id: Iafa9faa60d99b7df429bd01dad5599bbafb3c245
Signed-off-by: Tom Zhu <a2289c@android-hal-04.(none)>
Signed-off-by: San Mehat <san@google.com>
Reviewed-on: http://git-master/r/111035
Reviewed-by: Prashant Malani <pmalani@nvidia.com>
Tested-by: Prashant Malani <pmalani@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Bo Yan <byan@nvidia.com>

kernel_debugger_core: add interrupt-context debugger core

This provides kernel_debugger() which can be called from an interrupt
context low level debugger wedge to execute commands that inspect
kernel state.  It doesn't do much on its own.

Signed-off-by: Brian Swetland <swetland@google.com>

kernel_debugger_core: Add sysrq command.

sysrq <c> will run the sysrq command <c> and dump what
was added to the kernel log while the command ran.

Signed-off-by: Brian Swetland <swetland@google.com>
Signed-off-by: Arve Hjønnevåg <arve@android.com>
Change-Id: I7d260f89595f18638bcedc90d27471b840957631
Reviewed-on: http://git-master/r/111034
Reviewed-by: Prashant Malani <pmalani@nvidia.com>
Tested-by: Prashant Malani <pmalani@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Bo Yan <byan@nvidia.com>

cgroup: Add generic cgroup subsystem permission checks.

    Rather than using explicit euid == 0 checks when trying to move
tasks into a cgroup via CFS, move permission checks into each
specific cgroup subsystem. If a subsystem does not specify a
'can_attach' handler, then we fall back to doing our checks the old way.

    This way non-root processes can add arbitrary processes to
a cgroup if all the registered subsystems on that cgroup agree.

    Also change explicit euid == 0 check to CAP_SYS_ADMIN

Change-Id: Ife77a6dca056cce4eb922d447a809189234a1549
Signed-off-by: San Mehat <san@google.com>
Reviewed-on: http://git-master/r/111033
Reviewed-by: Prashant Malani <pmalani@nvidia.com>
Tested-by: Prashant Malani <pmalani@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Bo Yan <byan@nvidia.com>

ARM: tegra: Add ARCH_TEGRA_11x_SOC configuration parameter

Change-Id: I3e35e7fbaead99717ad7e0f6d565f85f4d36bb45
Signed-off-by: Scott Williams <scwilliams@nvidia.com>
Reviewed-on: http://git-master/r/77170
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Mark Stadler <mastadler@nvidia.com>
Reviewed-by: Jeff Smith <jsmith@nvidia.com>
Tested-by: Mark Stadler <mastadler@nvidia.com>
(cherry picked from commit 9337774d2e55d95d3af400be9bef8c57d3de653b)

Conflicts:

arch/arm/mach-tegra/Kconfig

Signed-off-by: Bo Yan <byan@nvidia.com>
Change-Id: If017ff9e3678304a0ce574d84c796c76034962b9
Reviewed-on: http://git-master/r/110713
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Mark Stadler <mastadler@nvidia.com>

ARM: tegra: Add Tegra11x basic clock tables

This is essentially a copy of the Tegra3 clocks with some
non-existent clock table entries removed.

Signed-off-by: Scott Williams <scwilliams@nvidia.com>
Reviewed-on: http://git-master/r/77173
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Mark Stadler <mastadler@nvidia.com>
Reviewed-by: Jeff Smith <jsmith@nvidia.com>
Tested-by: Mark Stadler <mastadler@nvidia.com>
(cherry picked from commit f08c328dda9833e009c4210345254b30889e1fd9)

[Bo Yan]: Fix the merge error due to file name change, remove
          file name from comments in file header.
Signed-off-by: Bo Yan <byan@nvidia.com>

Change-Id: I7fe640faa1e1a04dcd154d2499565ebd89b4d876
Reviewed-on: http://git-master/r/110708
Tested-by: Bo Yan <byan@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Mark Stadler <mastadler@nvidia.com>
Reviewed-by: Prashant Gaikwad <pgaikwad@nvidia.com>
Reviewed-by: Bo Yan <byan@nvidia.com>

ARM: tegra: Add Tegra11x IRQ map

Change-Id: I28522d6fd07394454850e8b74840d03f7ac410e0
Signed-off-by: Scott Williams <scwilliams@nvidia.com>
Reviewed-on: http://git-master/r/77175
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Mark Stadler <mastadler@nvidia.com>
Reviewed-by: Jeff Smith <jsmith@nvidia.com>
Tested-by: Mark Stadler <mastadler@nvidia.com>
(cherry picked from commit f39a92bbe8536b19e4ea240c073ac2133e892d19)

Conflicts:

arch/arm/mach-tegra/include/mach/irqs.h

Signed-off-by: Bo Yan <byan@nvidia.com>
Change-Id: I382df060d7a7fccfc592c7f1fbfc5b7c5fa0b633
Reviewed-on: http://git-master/r/110710
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Mark Stadler <mastadler@nvidia.com>

tegra3: clock: Support for divisor 15.1

Uart clock source has divisor of 16 bits where
LSB is 0.5.
Adding support for divisor 15.1 and configuring uart
for use the 15.1 type divisor.

Signed-off-by: Laxman Dewangan <ldewangan@nvidia.com>

Reviewed-on: http://git-master/r/70324
Reviewed-by: Laxman Dewangan <ldewangan@nvidia.com>
Tested-by: Laxman Dewangan <ldewangan@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Bitan Biswas <bbiswas@nvidia.com>

Conflicts:

arch/arm/mach-tegra/clock.h
arch/arm/mach-tegra/tegra3_clocks.c

Signed-off-by: Bo Yan <byan@nvidia.com>
Change-Id: I917d1d5011bc741c81f34dc657bb9a7a5ff5c9a4
Reviewed-on: http://git-master/r/110716
Reviewed-by: Aleksandr Frid <afrid@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User

USB: gadget: adb: Queue read requests with length specified by client.

Previously we queued 4K requests rather than the count passed into read().

Change-Id: I1d80dad0e2385a1683270d973a3d4c00fb9b7c34
Signed-off-by: Mike Lockwood <lockwood@android.com>
Reviewed-on: http://git-master/r/110675
Reviewed-by: Prashant Malani <pmalani@nvidia.com>
Tested-by: Prashant Malani <pmalani@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Bo Yan <byan@nvidia.com>

USB: composite: Allow configurations to handle unhandled setup requests

Signed-off-by: Mike Lockwood <lockwood@android.com>
Change-Id: I5b5ffd02578ccd92e6909735f259e39f5143339b
Reviewed-on: http://git-master/r/110674
Reviewed-by: Prashant Malani <pmalani@nvidia.com>
Tested-by: Prashant Malani <pmalani@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Bo Yan <byan@nvidia.com>

USB: composite: Add flag to usb_function to hide its interface during enumeration

Change-Id: Ie999b5190e3e2b6fd23015b8e796cdd178829929

Signed-off-by: Mike Lockwood <lockwood@android.com>
Change-Id: Ie84b8a1bf8e81458716b9ae21002d1e6cc6ffffa
Reviewed-on: http://git-master/r/110670
Reviewed-by: Prashant Malani <pmalani@nvidia.com>
Tested-by: Prashant Malani <pmalani@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Bo Yan <byan@nvidia.com>
Tested-by: Bo Yan <byan@nvidia.com>

USB: composite: Fix USB WHQL Certification Issues

Submitted on behalf of RaviKumar Vembu <ravi.v@motorola.com>
Signed-off-by: Jared Suttles <jared.suttles@motorola.com>
Signed-off-by: Mike Lockwood <lockwood@android.com>
Change-Id: I0f286a428e8a1df5f173873233fadea987775f6b
Reviewed-on: http://git-master/r/110669
Reviewed-by: Prashant Malani <pmalani@nvidia.com>
Tested-by: Prashant Malani <pmalani@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Bo Yan <byan@nvidia.com>

drivers: usb: gadget: Add helper function for installing ACM gadget function.

Submitted on behalf of James Luan <James.Luan@motorola.com>

Signed-off-by: Joe Swantek <joseph.swantek@motorola.com>
Signed-off-by: Mike Lockwood <lockwood@android.com>
Change-Id: I9de983ede21f779811aaf0ab50a850f271025b83
Reviewed-on: http://git-master/r/110668
Reviewed-by: Prashant Malani <pmalani@nvidia.com>
Tested-by: Prashant Malani <pmalani@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Bo Yan <byan@nvidia.com>

drivers: usb: gadget: handle NULL descriptors in composite config_buf

This fixes a problem in enumeration after a gadget function is removed.

Submitted on behalf of RaviKumar Vembu <ravi.v@motorola.com>

Signed-off-by: Jared Suttles <jared.suttles@motorola.com>
Signed-off-by: Mike Lockwood <lockwood@android.com>
Change-Id: I96d0a8a8881d948c6623f17fb6efad511906d272
Reviewed-on: http://git-master/r/110667
Reviewed-by: Prashant Malani <pmalani@nvidia.com>
Tested-by: Prashant Malani <pmalani@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Bo Yan <byan@nvidia.com>

Input: synaptics_i2c_rmi: Send new multi touch events

Send both fingers using the new multitouch protocol in addition to
the old single finger event and second finger ABS_HAT* hack.

The new protocol does not specify how to report up events. To make
sure the user-space frameworks can generate up events, we send at
least one event where ABS_MT_TOUCH_MAJOR is zero before we stop
sending events for a finger.

Change-Id: I05680de839899d68f66c9eecbd053f26171ab2e4
Signed-off-by: Arve Hjønnevåg <arve@android.com>
Reviewed-on: http://git-master/r/110666
Reviewed-by: Prashant Malani <pmalani@nvidia.com>
Tested-by: Prashant Malani <pmalani@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Bo Yan <byan@nvidia.com>

ARM: tegra: Add Tegra11x I/O map

Signed-off-by: Scott Williams <scwilliams@nvidia.com>
Reviewed-on: http://git-master/r/77176
Reviewed-by: Mark Stadler <mastadler@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User
Tested-by: Mark Stadler <mastadler@nvidia.com>
(cherry picked from commit 362774cb81ef3846e374675a7f7304989789b174)

Signed-off-by: Bo Yan <byan@nvidia.com>
Change-Id: If0b81a97922756caf218d3d2cf3b0d25ca21d8c8
Reviewed-on: http://git-master/r/110711
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Mark Stadler <mastadler@nvidia.com>

ARM: tegra: Add Curacao board files

Change-Id: I20d01bf58d5dc3812cee8f72cc73e509fd2a6421
Signed-off-by: Scott Williams <scwilliams@nvidia.com>
Reviewed-on: http://git-master/r/77181
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Mark Stadler <mastadler@nvidia.com>
Tested-by: Mark Stadler <mastadler@nvidia.com>
(cherry picked from commit 0df3fc70d988b80d943bbc11adc28eb59aaa17de)

Signed-off-by: Bo Yan <byan@nvidia.com>
Change-Id: I093ee24693b526427651e3fe45152dab71311cc1
Reviewed-on: http://git-master/r/110707
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Mark Stadler <mastadler@nvidia.com>

ARM: tegra: curacao: Enable PM_RUNTIME

Change-Id: I52e3570e0fa41c6d0a19fb2446d5c6e665bc268c
Signed-off-by: Scott Williams <scwilliams@nvidia.com>
Reviewed-on: http://git-master/r/79093
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Chao Xu <cxu@nvidia.com>
Reviewed-on: http://git-master/r/110652
Reviewed-by: Bo Yan <byan@nvidia.com>
Tested-by: Bo Yan <byan@nvidia.com>

HACK! Revert "ARM: tegra: curacao: Enable MMC and SDHCI"

The MMC driver is spewing lots timeouts.
BUG 934982

This reverts commit dd292913ce0819b0b9292f7c6b136f236c97c579.

Change-Id: Icae34e5e4d5b0ef188b95ebb15e5b3c7269b5ec7
Reviewed-on: http://git-master/r/79100
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Scott Williams <scwilliams@nvidia.com>
Tested-by: Scott Williams <scwilliams@nvidia.com>
Reviewed-on: http://git-master/r/110651
Reviewed-by: Bo Yan <byan@nvidia.com>
Tested-by: Bo Yan <byan@nvidia.com>

HACK! ARM: tegra: curacao: Temporarily disable TEGRA_DC

BUG 933602

Change-Id: I27ce235aaeb43426f85fe8c534404fbdb73900a7
Signed-off-by: Scott Williams <scwilliams@nvidia.com>
Reviewed-on: http://git-master/r/78510
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Kevin Huang (Eng-SW) <kevinh@nvidia.com>
Reviewed-on: http://git-master/r/110647
Reviewed-by: Bo Yan <byan@nvidia.com>
Tested-by: Bo Yan <byan@nvidia.com>

ARM: tegra: curacao: Update default command line

Change the default command line to make simplify the booting
on QuickTurn.

Signed-off-by: Bo Yan <byan@nvidia.com>

Reviewed-on: http://git-master/r/76661
Reviewed-by: Bo Yan <byan@nvidia.com>
Tested-by: Bo Yan <byan@nvidia.com>
Reviewed-by: Scott Williams <scwilliams@nvidia.com>
(cherry picked from commit 7b8dd26422c7573fc18e6d70519c5fa3f2baddd7)

Change-Id: Idc0b71fff33e07f0ec84c5485a6466cf6163f317
Signed-off-by: Scott Williams <scwilliams@nvidia.com>
Reviewed-on: http://git-master/r/78270
Reviewed-by: Jin Qian <jqian@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Chao Xu <cxu@nvidia.com>
Reviewed-on: http://git-master/r/110646
Reviewed-by: Bo Yan <byan@nvidia.com>
Tested-by: Bo Yan <byan@nvidia.com>

ARM: tegra: curacao: Enable I2C

bug 837139

Reviewed-on: http://git-master/r/66385
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Laxman Dewangan <ldewangan@nvidia.com>
Reviewed-by: Scott Williams <scwilliams@nvidia.com>
Tested-by: Alok Chauhan <alokc@nvidia.com>
(cherry picked from commit c90c6358b14f0f30d796f4c42bd3a195750c00b9)

Change-Id: I23ff58de2c3a36bcff14e26aa1c0d2297619af18
Signed-off-by: Scott Williams <scwilliams@nvidia.com>
Reviewed-on: http://git-master/r/77916
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Alok Chauhan <alokc@nvidia.com>
Reviewed-by: Mark Stadler <mastadler@nvidia.com>
Reviewed-on: http://git-master/r/110645
Reviewed-by: Bo Yan <byan@nvidia.com>
Tested-by: Bo Yan <byan@nvidia.com>

ARM: tegra: curacao: Enable MMC and SDHCI

Bug 837103

Signed-off-by: naveenk <naveenk@nvidia.com>
Reviewed-on: http://git-master/r/70336
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Laxman Dewangan <ldewangan@nvidia.com>
(cherry picked from commit 712f9d9c7b0ac8b4dd61662183459623320dbc5f)

Change-Id: Iacf26fbaac6551060347ff7e960c72632ee0f898
Signed-off-by: Scott Williams <scwilliams@nvidia.com>
Reviewed-on: http://git-master/r/77914
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Mark Stadler <mastadler@nvidia.com>
Reviewed-on: http://git-master/r/110644
Reviewed-by: Bo Yan <byan@nvidia.com>
Tested-by: Bo Yan <byan@nvidia.com>

ARM: tegra: curacao: Enable Security Engine

Change-Id: Ia15c41d0c0205dfc87102120dd5f849b8c0676e7
Signed-off-by: Scott Williams <scwilliams@nvidia.com>
Reviewed-on: http://git-master/r/77667
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Mallikarjun Kasoju <mkasoju@nvidia.com>
Reviewed-by: Mark Stadler <mastadler@nvidia.com>
Reviewed-on: http://git-master/r/110643
Reviewed-by: Bo Yan <byan@nvidia.com>
Tested-by: Bo Yan <byan@nvidia.com>

ARM: tegra: curacao: Add Curacao board defconfig

Change-Id: Ic7b113973c5e19e50623509ca4637092aadebfdf
Signed-off-by: Scott Williams <scwilliams@nvidia.com>
Reviewed-on: http://git-master/r/77182
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Mark Stadler <mastadler@nvidia.com>
Tested-by: Mark Stadler <mastadler@nvidia.com>
Reviewed-on: http://git-master/r/110641
Reviewed-by: Bo Yan <byan@nvidia.com>
Tested-by: Bo Yan <byan@nvidia.com>

input: evdev: Use unique wakelock names

wakelock names are now contain evdev->name and pid

Change-Id: I66960ab2460ca46fcdbff34e53367879c105770e
Signed-off-by: Mike Chan <mike@android.com>
Reviewed-on: http://git-master/r/110419
Reviewed-by: Automatic_Commit_Validation_User
Tested-by: Prashant Malani <pmalani@nvidia.com>
Reviewed-by: Prashant Malani <pmalani@nvidia.com>
Reviewed-by: Bo Yan <byan@nvidia.com>

Input: Hold wake lock while event queue is not empty.

Allows userspace code to process input events while
the device appears to be asleep.

Change-Id: I506fec24e3ebaba5ec5916d13987209047bb1c36
Signed-off-by: Arve Hjønnevåg <arve@android.com>
Reviewed-on: http://git-master/r/110418
Reviewed-by: Automatic_Commit_Validation_User
Tested-by: Prashant Malani <pmalani@nvidia.com>
Reviewed-by: Prashant Malani <pmalani@nvidia.com>
Reviewed-by: Bo Yan <byan@nvidia.com>

Merge branch 'vwadekar-rebased' into tot

The branch 'vwadekar-rebased' has the necessary cherry-picks from
origin/android-t114-3.1 up to tag "daily-2012.02.09.0-dev-t114"

Change-Id: Id43d7e8f04a705b225d64358fb354d41ee7c6a20

Revert "USB: EHCI: fix HUB TT scheduling issue with iso transfer"

This reverts commit f0cc710a6dec5b808a6f13f1f8853c094fce5f12.

Change-Id: I1547640e9a205a8a43ecde531a5cda7a5de0321a
Cc: Matthieu Castet <matthieu.castet@parrot.com>
Cc: Thomas Poussevin <thomas.poussevin@parrot.com>
Cc: Alan Stern <stern@rowland.harvard.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Reviewed-on: http://git-master/r/110206
Reviewed-by: Prashant Malani <pmalani@nvidia.com>
Tested-by: Prashant Malani <pmalani@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Bo Yan <byan@nvidia.com>

b43: refuse to load unsupported firmware

[This patch is supposed to be applied in 3.1 (and maybe older) branches only.]

New kernels support newer firmware that users may try to incorrectly use
with older kernels. Display error and explain the problem in such a case

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Change-Id: I95169723e14aa845ce6f760cea18c0171cdd452e
Reviewed-on: http://git-master/r/110205
Reviewed-by: Prashant Malani <pmalani@nvidia.com>
Tested-by: Prashant Malani <pmalani@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Bo Yan <byan@nvidia.com>

ALSA: hda - Add missing static ADC tables for ALC269 quirks

[There is no upstream commit for this patch since the corresponding
code was removed from 3.2 kernel.  This is a regression found only in
3.1 kernel, so please apply this only to 3.1.x series.]

Some ALC269 quirks define their own .cap_mixer field but without the
static adc_nids[].  This resulted in the mismatch of ADC because ALC269
may have the widget 0x07 for another audio-in, and the auto-parser picks
this up instead.

This patch fixes the problem by adding the static adc_nids[] and co
again to these entries.

Change-Id: Ibb253b0ceb24b88d44e1f4563f3e1d41a132f85e
Tested-by: Chris Vine <chris@cvine.freeserve.co.uk>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
Reviewed-on: http://git-master/r/110186
Reviewed-by: Prashant Malani <pmalani@nvidia.com>
Tested-by: Prashant Malani <pmalani@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Bo Yan <byan@nvidia.com>

ARM: mm: ensure TTBR0 is restored when changing ASID on rollover

In 52af9c6c ("ARM: 6943/1: mm: use TTBR1 instead of reserved context ID")
I updated the ASID rollover code to use only the kernel page tables
whilst updating the ASID.

Unfortunately, the code to restore the user page tables was part of a
later patch which isn't yet in mainline, so this leaves the code
quite broken.

This patch fixes the issue by calling cpu_switch_mm to change the ASID
which has the side-effect of setting up TTBR0 to point to the user
tables.

Change-Id: I89c0db50fb0a8831f8fb2aea0e7037b3c9297257
Reported-by: Marc Zyngier <marc.zyngier@arm.com>
Signed-off-by: Will Deacon <will.deacon@arm.com>
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Reviewed-on: http://git-master/r/110185
Reviewed-by: Prashant Malani <pmalani@nvidia.com>
Tested-by: Prashant Malani <pmalani@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Bo Yan <byan@nvidia.com>

ARM: Set bit 22 in the PL310 (cache controller) AuxCtlr register

Clearing bit 22 in the PL310 Auxiliary Control register (shared
attribute override enable) has the side effect of transforming Normal
Shared Non-cacheable reads into Cacheable no-allocate reads.

Coherent DMA buffers in Linux always have a Cacheable alias via the
kernel linear mapping and the processor can speculatively load cache
lines into the PL310 controller. With bit 22 cleared, Non-cacheable
reads would unexpectedly hit such cache lines leading to buffer
corruption.

This patch ensures that bit 22 is set in the l2x0_init() function if
PL310 and not rely on the platform code to specify it. It also modifies
the 'aux' variable only if the actual register is written so that the
final printk displays the real hardware value.

Change-Id: Idfad30519697ca7cac352f5ff205d40ac68bc50a
Signed-off-by: Catalin Marinas <catalin.marinas@arm.com>
Tested-by: Kyungmin Park <kyungmin.park@samsung.com>
Reviewed-on: http://git-master/r/110184
Reviewed-by: Prashant Malani <pmalani@nvidia.com>
Tested-by: Prashant Malani <pmalani@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Bo Yan <byan@nvidia.com>

ARM: tegra: enterprise: enable auto hotplug

Enabling hotplug detection support for baseband
when it is crashed.

Bug 995784

Reviewed on: http://git-master/r/#change,108284
(cherry picked from commit 0cc4e037d1253ce65a404fe6429709d9172d6ea6)

Change-Id: If95f000e77c7f83a2120233b91a0c099e9bce204
Signed-off-by: Rakesh Bodla <rbodla@nvidia.com>
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
Reviewed-on: http://git-master/r/109449
Reviewed-by: Automatic_Commit_Validation_User

ARM: tegra: defconfig: disable CONFIG_EARLYSUSPEND for L4T

Change-Id: I58b0947bd08b0d6650b57d917279fd709bfb6390
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
Reviewed-on: http://git-master/r/108169
Reviewed-on: http://git-master/r/109029
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Bo Yan <byan@nvidia.com>
Tested-by: Bo Yan <byan@nvidia.com>

Revert "bluetooth: bluesleep: remove hci_(un)register_notifier"

This reverts commit 5a0db58b39c53e9d7da6a6e7a5e024fc5e125a46.
remove compilation errors.

Bug 999221

Change-Id: I8733308f50dc57bb71d5bd640f78574b070831ca
Signed-off-by: Nagarjuna Kristam <nkristam@nvidia.com>
Reviewed-on: http://git-master/r/108187
Reviewed-by: Varun Wadekar <vwadekar@nvidia.com>

ARM: tegra: set correct path for bcm module

- Changing the path of the BCM wifi module and enabling applicable
directives.

Original change: http://git-master/r/#change,105073

Bug 976783

Change-Id: I1baec0c986b12651424d047b7d4daea34ea3b31e
Signed-off-by: Sanjay Singh Rawat <srawat@nvidia.com>
Reviewed-on: http://git-master/r/105634
Reviewed-by: Varun Wadekar <vwadekar@nvidia.com>

bluetooth: Re-add HCI notifier handling

Perform partial revert of 040030ef7d907107e6489b39da518bdf94136d68
(Bluetooth: Remove HCI notifier handling). HCI notifier is being used by
bluetooth power management driver(bluesleep).

Re-use atomic notifier chain to notify HCI events

bug 999221

Change-Id: Ifbd95f7e679d3cac577785cb7a9eda5736e1fa7b
Signed-off-by: Nagarjuna Kristam <nkristam@nvidia.com>
Reviewed-on: http://git-master/r/106729
Reviewed-by: Varun Wadekar <vwadekar@nvidia.com>

usb: otg: tegra: fix otg driver loading crash

Commit dcf283126bd9001bc29c5b38dbaf24dddbe919e9 changed the way we store device node.
Do not use dev_info since we do not have a valid device node during bootup.

Change-Id: Ia4c83ad914379f0b3a777d4e800cf0eb03236d6c
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

usb: otg: tegra: do no assign pdev in _probe

This part of the code is not required because in tegra_start_host we
are creating pdev once after inserting the OTG cable in instance 1.

Bug 988807
Bug 988880

Change-Id: I47ce98b6fee7552812c31c32ae3e3c1e59dca393
Signed-off-by: Venkata Jagadish <vjagadish@nvidia.com>
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
Reviewed-on: http://git-master/r/108202
Reviewed-by: Automatic_Commit_Validation_User

ARM: Tegra30: defconfig: enable CONFIG_USB_EHCI_TEGRA

Bug 988880
Bug 988807

Change-Id: Ibe16a421e25cc8167a0624562a6074aa9744b90a
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
Reviewed-on: http://git-master/r/108204
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Venkata Jagadish <vjagadish@nvidia.com>

ARM: tegra: defconfig: disable CONFIG_EARLYSUSPEND for L4T

Change-Id: I58b0947bd08b0d6650b57d917279fd709bfb6390
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
Reviewed-on: http://git-master/r/108169

ARM: tegra: Fix PLL locking

Tegra30 PLL locking uses lock bits.
Also, reduce delay as per K3.1.

Bug 998506

Change-Id: Ic1d27ff30df454dbeaae897df39082a433c34ccb
Signed-off-by: Prashant Gaikwad <pgaikwad@nvidia.com>
Reviewed-on: http://git-master/r/107853
Reviewed-by: Automatic_Commit_Validation_User
GVS: Gerrit_Virtual_Submit
Reviewed-by: Bharat Nihalani <bnihalani@nvidia.com>
Reviewed-by: Varun Wadekar <vwadekar@nvidia.com>

video: tegra: update nvmap_alloc_handle interface

Add kind and comp_tag fields

Change-Id: I1fe1c3212bdc4a942b80c9895532de01e889d487
Reviewed-on: http://git-master/r/79595
Reviewed-by: Mark Stadler <mastadler@nvidia.com>
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Acorn Pooley <apooley@nvidia.com>
Reviewed-by: Jeff Smith <jsmith@nvidia.com>
Reviewed-by: Terje Bergstrom <tbergstrom@nvidia.com>
Tested-by: Mark Stadler <mastadler@nvidia.com>
Reviewed-by: Bo Yan <byan@nvidia.com>
Reviewed-by: Scott Williams <scwilliams@nvidia.com>
(cherry picked from commit e4a0dc94cee8e042350002e058dc24e0589a2fa5)
Reviewed-on: http://git-master/r/107434
Tested-by: Bo Yan <byan@nvidia.com>

Merge commit 'v3.4.2' into android-tegra-nv-3.4

Conflicts:
drivers/i2c/busses/i2c-tegra.c
drivers/usb/gadget/fsl_udc_core.c

Change-Id: Ibfc3a8edc3665b832ddc94f89fc17b556629d104
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>

ARM: tegra: iomap: change io aperture base address to 0xfb000000

This effectively reverts commit cbb367a2bc93d6b8cc407bcc76fd29560e4d1858,
which originally changed the io aperture base to 0xfa000000.

Bug 971673

Change-Id: I9af397e4e9ce6b0545f6b5b0becb951737e55349
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
Reviewed-on: http://git-master/r/107849

mm: fix faulty initialization in vmalloc_init()

The transfer of ->flags causes some of the static mapping virtual
addresses to be prematurely freed (before the mapping is removed) because
VM_LAZY_FREE gets "set" if tmp->flags has VM_IOREMAP set.  This might
cause subsequent vmalloc/ioremap calls to fail because it might allocate
one of the freed virtual address ranges that aren't unmapped.

va->flags has different types of flags from tmp->flags.  If a region with
VM_IOREMAP set is registered with vm_area_add_early(), it will be removed
by __purge_vmap_area_lazy().

Fix vmalloc_init() to correctly initialize vmap_area for the given
vm_struct.

Also initialise va->vm.  If it is not set, find_vm_area() for the early
vm regions will always fail.

Bug 971673

Change-Id: Id81dd38846bad454c1d420b398af0bb8b42cf1e2
Signed-off-by: KyongHo Cho <pullip.cho@samsung.com>
Cc: "Olav Haugan" <ohaugan@codeaurora.org>
Cc: <stable@vger.kernel.org>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
Reviewed-on: http://git-master/r/107848

Revert "Revert "ARM: move iotable mappings within the vmalloc region""

This reverts commit c58f0f01cf4a4f09b7d9c2dae1353b302d0dfd98.

Signed-off-by: Varun Wadekar <vwadekar@nvidia.com>
Change-Id: I56df8c8f3a1902061fce0d969602d6ea06e72a3d
Reviewed-on: http://git-master/r/107847

arm: tegra: disable config PL310_ERRATA_727915 for tegra2

bug 996355

Change-Id: I68439422f004004a1af88c7004cfe5b559a19ca9
Signed-off-by: Mayuresh Kulkarni <mkulkarni@nvidia.com>
Reviewed-on: http://git-master/r/107790
Reviewed-by: Automatic_Commit_Validation_User
Reviewed-by: Varun Wadekar <vwadekar@nvidia.com>
Tested-by: Varun Wadekar <vwadekar@nvidia.com>

Linux 3.4.2

ext4: don't set i_flags in EXT4_IOC_SETFLAGS

commit b22b1f178f6799278d3178d894f37facb2085765 upstream.

Commit 7990696 uses the ext4_{set,clear}_inode_flags() functions to
change the i_flags automatically but fails to remove the error setting
of i_flags.  So we still have the problem of trashing state flags.
Fix this by removing the assignment.

Signed-off-by: Tao Ma <boyu.mt@taobao.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

IA64: Add cmpxchg.h to exported userspace headers

commit 98e4cff73a18af27f0d40d0b0d37f105dfc1994a upstream.

Fixes klibc build on ia64 after 85f8f7759e418c814ee2ceacf73eddb9bed39492.

Cc: Paul Gortmaker <paul.gortmaker@windriver.com>
Signed-off-by: maximilian attems <max@stro.at>
Signed-off-by: Tony Luck <tony.luck@intel.com>
Cc: Ben Hutchings <ben@decadent.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/i915: enable vdd when switching off the eDP panel

commit 6cb49835da0426f69a2931bc2a0a8156344b0e41 upstream.

We have one bug report from a validation team that we get the eDP
panel sequencing still somewhat wrong: We need to enable VDD while
switching off the panel and backlight. Unfortunately that reporter
seems to have fallen off the earth :(

For another reporter this actually fixes a black panel issue because
without this the backlight/panel gets confused and doesn't light up
again.

v2: I've forgotten to remove the vdd_off call in panel_off which is
now bogus. This essentially reverts

commit 17038de5f16569a25343cf68668f3b657eafb00e
Author: Chris Wilson <chris@chris-wilson.co.uk>
Date:   Mon Apr 16 22:43:42 2012 +0100

    drm/i915/dp: Flush any outstanding work to turn the VDD off

v3: the current panel_off code forces off the vdd power, too. Which is
bogus and resulted in some funny warnings later on when we've tried to
do aux channel communications with just the vdd forced on. Fix this,
too.

Bugzilla: https://bugs.freedesktop.org/show_bug.cgi?id=46312
Bugzilla: https://bugzilla.kernel.org/show_bug.cgi?id=43163
Tested-by: Vincent Frentzel <zcecc22@gmail.com>
Reviewed-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Signed-Off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/i915/dp: Flush any outstanding work to turn the VDD off

commit 17038de5f16569a25343cf68668f3b657eafb00e upstream.

As we may kick off a delayed workqueue task to switch of the VDD lines, we
need to complete that task prior to turning off the panel (which itself
depends upon VDD being off).

v2: Don't cancel the outstanding work as this may trigger a deadlock

Signed-off-by: Chris Wilson <chris@chris-wilson.co.uk>
Cc: Keith Packard <keithp@keithp.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/i915: always use RPNSWREQ for turbo change requests

commit 89ba829e38bd500f438bc08af4229204c8ed7f35 upstream.

Media turbo requests can either use RPVSWREQ or RPNSWREQ to indicate
what the interrupt handler should do.  Since we only deal with the
latter in our turbo code, make the media engine use that for turbo
requests.

Tested-by: Joe Bloggsian <joebloggsian@gmail.com>
Signed-off-by: Jesse Barnes <jbarnes@virtuousgeek.org>
Reviewed-by: Eugeni Dodonov <eugeni.dodonov@intel.com>
Signed-off-by: Daniel Vetter <daniel.vetter@ffwll.ch>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

wl1251: fix oops on early interrupt

commit f380f2c4a12e913356bd49f8790ec1063c4fe9f8 upstream.

This driver disables interrupt just after requesting it and enables it
later, after interface is up. However currently there is a time window
between request_irq() and disable_irq() where if interrupt arrives, the
driver oopses because it's not yet ready to process it. This can be
reproduced by inserting the module, associating and removing the module
multiple times.

Eliminate this race by setting IRQF_NOAUTOEN flag before request_irq().

Signed-off-by: Grazvydas Ignotas <notasas@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

md: raid1/raid10: fix problem with merge_bvec_fn

commit aba336bd1d46d6b0404b06f6915ed76150739057 upstream.

The new merge_bvec_fn which calls the corresponding function
in subsidiary devices requires that mddev->merge_check_needed
be set if any child has a merge_bvec_fn.

However were were only setting that when a device was hot-added,
not when a device was present from the start.

This bug was introduced in 3.4 so patch is suitable for 3.4.y
kernels.  However that are conflicts in raid10.c so a separate
patch will be needed for 3.4.y.

Reported-by: Sebastian Riemer <sebastian.riemer@profitbricks.com>
Signed-off-by: NeilBrown <neilb@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

vfs: Fix /proc/<tid>/fdinfo/<fd> file handling

commit 0640113be25d283e0ff77a9f041e1242182387f0 upstream.

Cyrill Gorcunov reports that I broke the fdinfo files with commit
30a08bf2d31d ("proc: move fd symlink i_mode calculations into
tid_fd_revalidate()"), and he's quite right.

The tid_fd_revalidate() function is not just used for the <tid>/fd
symlinks, it's also used for the <tid>/fdinfo/<fd> files, and the
permission model for those are different.

So do the dynamic symlink permission handling just for symlinks, making
the fdinfo files once more appear as the proper regular files they are.

Of course, Al Viro argued (probably correctly) that we shouldn't do the
symlink permission games at all, and make the symlinks always just be
the normal 'lrwxrwxrwx'.  That would have avoided this issue too, but
since somebody noticed that the permissions had changed (which was the
reason for that original commit 30a08bf2d31d in the first place), people
do apparently use this feature.

[ Basically, you can use the symlink permission data as a cheap "fdinfo"
  replacement, since you see whether the file is open for reading and/or
  writing by just looking at st_mode of the symlink.  So the feature
  does make sense, even if the pain it has caused means we probably
  shouldn't have done it to begin with. ]

Reported-and-tested-by: Cyrill Gorcunov <gorcunov@openvz.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ACPI battery: only refresh the sysfs files when pertinent information changes

commit c5971456964290da7e98222892797b71ef793e62 upstream.

We only need to regenerate the sysfs files when the capacity units
change, avoid the update otherwise.

The origin of this issue is dates way back to 2.6.38:
da8aeb92d4853f37e281f11fddf61f9c7d84c3cd
(ACPI / Battery: Update information on info notification and resume)

Signed-off-by: Andy Whitcroft <apw@canonical.com>
Tested-by: Ralf Jung <post@ralfj.de>
Signed-off-by: Len Brown <len.brown@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

iommu/amd: Fix deadlock in ppr-handling error path

commit eee53537c476c947bf7faa1c916d2f5a0ae8ec93 upstream.

In the error path of the ppr_notifer it can happen that the
iommu->lock is taken recursivly. This patch fixes the
problem by releasing the iommu->lock before any notifier is
invoked. This also requires to move the erratum workaround
for the ppr-log (interrupt may be faster than data in the log)
one function up.

Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

iommu/amd: Cache pdev pointer to root-bridge

commit c1bf94ec1e12d76838ad485158aecf208ebd8fb9 upstream.

At some point pci_get_bus_and_slot started to enable
interrupts. Since this function is used in the
amd_iommu_resume path it will enable interrupts on resume
which causes a warning. The fix will use a cached pointer
to the root-bridge to re-enable the IOMMU in case the BIOS
is broken.

Signed-off-by: Joerg Roedel <joerg.roedel@amd.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/radeon/kms: add new SI PCI ids

commit 7aaa61b3476462b69f1ac7669fcca8d608ce3cb5 upstream.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/radeon/kms: add new BTC PCI ids

commit a2bef8ce826dd1e787fd8ad9b6e0566ba59dab43 upstream.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/radeon/kms: add new Palm, Sumo PCI ids

commit 4a6991cc1fad514745b79181df3ace72d561e7aa upstream.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/radeon/kms: add new Trinity PCI ids

commit d430f7dbf7bd6aaaa40c0660b3204df8cf07b22b upstream.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/radeon: fix vm deadlocks on cayman

commit bb4091558228ff4a3e02328c931e683fc7f08722 upstream.

Locking mutex in different orders just screams for
deadlocks, and some testing showed that it is actually
quite easy to trigger them.

Signed-off-by: Christian König <deathsimple@vodafone.de>
Reviewed-by: Jerome Glisse <jglisse@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/radeon/audio: don't hardcode CRTC id

commit 0aecb5a4ba1ea4167f31d1790eec027f1e658f2d upstream.

This is based on info released by AMD, should allow using audio in much
more cases.

Signed-off-by: Rafał Miłecki <zajec5@gmail.com>
Reviewed-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

radix-tree: fix contiguous iterator

commit fffaee365fded09f9ebf2db19066065fa54323c3 upstream.

This patch fixes bug in macro radix_tree_for_each_contig().

If radix_tree_next_slot() sees NULL in next slot it returns NULL, but following
radix_tree_next_chunk() switches iterating into next chunk. As result iterating
becomes non-contiguous and breaks vfs "splice" and all its users.

Signed-off-by: Konstantin Khlebnikov <khlebnikov@openvz.org>
Reported-and-bisected-by: Hans de Bruin <jmdebruin@xmsnet.nl>
Reported-and-bisected-by: Ondrej Zary <linux@rainbow-software.org>
Reported-bisected-and-tested-by: Toralf Förster <toralf.foerster@gmx.de>
Link: https://lkml.org/lkml/2012/6/5/64
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ext4: remove mb_groups before tearing down the buddy_cache

commit 95599968d19db175829fb580baa6b68939b320fb upstream.

We can't have references held on pages in the s_buddy_cache while we are
trying to truncate its pages and put the inode.  All the pages must be
gone before we reach clear_inode.  This can only be gauranteed if we
can prevent new users from grabbing references to s_buddy_cache's pages.

The original bug can be reproduced and the bug fix can be verified by:

while true; do mount -t ext4 /dev/ram0 /export/hda3/ram0; \
umount /export/hda3/ram0; done &

while true; do cat /proc/fs/ext4/ram0/mb_groups; done

Signed-off-by: Salman Qazi <sqazi@google.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ext4: add ext4_mb_unload_buddy in the error path

commit 02b7831019ea4e7994968c84b5826fa8b248ffc8 upstream.

ext4_free_blocks fails to pair an ext4_mb_load_buddy with a matching
ext4_mb_unload_buddy when it fails a memory allocation.

Signed-off-by: Salman Qazi <sqazi@google.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ext4: don't trash state flags in EXT4_IOC_SETFLAGS

commit 79906964a187c405db72a3abc60eb9b50d804fbc upstream.

In commit 353eb83c we removed i_state_flags with 64-bit longs, But
when handling the EXT4_IOC_SETFLAGS ioctl, we replace i_flags
directly, which trashes the state flags which are stored in the high
32-bits of i_flags on 64-bit platforms.  So use the the
ext4_{set,clear}_inode_flags() functions which use atomic bit
manipulation functions instead.

Reported-by: Tao Ma <boyu.mt@taobao.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ext4: add missing save_error_info() to ext4_error()

commit f3fc0210c0fc91900766c995f089c39170e68305 upstream.

The ext4_error() function is missing a call to save_error_info().
Since this is the function which marks the file system as containing
an error, this oversight (which was introduced in 2.6.36) is quite
significant, and should be backported to older stable kernels with
high urgency.

Reported-by: Ken Sumrall <ksumrall@google.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Cc: ksumrall@google.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ext4: disallow hard-linked directory in ext4_lookup

commit 7e936b737211e6b54e34b71a827e56b872e958d8 upstream.

A hard-linked directory to its parent can cause the VFS to deadlock,
and is a sign of a corrupted file system.  So detect this case in
ext4_lookup(), before the rmdir() lockup scenario can take place.

Signed-off-by: Andreas Dilger <adilger@dilger.ca>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ext4: fix potential integer overflow in alloc_flex_gd()

commit 967ac8af4475ce45474800709b12137aa7634c77 upstream.

In alloc_flex_gd(), when flexbg_size is large, kmalloc size would
overflow and flex_gd->groups would point to a buffer smaller than
expected, causing OOB accesses when it is used.

Note that in ext4_resize_fs(), flexbg_size is calculated using
sbi->s_log_groups_per_flex, which is read from the disk and only bounded
to [1, 31]. The patch returns NULL for too large flexbg_size.

Reviewed-by: Eric Sandeen <sandeen@redhat.com>
Signed-off-by: Haogang Chen <haogangchen@gmail.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ext4: force ro mount if ext4_setup_super() fails

commit 7e84b6216467b84cd332c8e567bf5aa113fd2f38 upstream.

If ext4_setup_super() fails i.e. due to a too-high revision,
the error is logged in dmesg but the fs is not mounted RO as
indicated.

Tested by:

# mkfs.ext4 -r 4 /dev/sdb6
# mount /dev/sdb6 /mnt/test
# dmesg | grep "too high"
[164919.759248] EXT4-fs (sdb6): revision level too high, forcing read-only mode
# grep sdb6 /proc/mounts
/dev/sdb6 /mnt/test2 ext4 rw,seclabel,relatime,data=ordered 0 0

Reviewed-by: Andreas Dilger <adilger@whamcloud.com>
Signed-off-by: Eric Sandeen <sandeen@redhat.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ext4: fix potential NULL dereference in ext4_free_inodes_counts()

commit bb3d132a24cd8bf5e7773b2d9f9baa58b07a7dae upstream.

The ext4_get_group_desc() function returns NULL on error, and
ext4_free_inodes_count() function dereferences it without checking.
There is a check on the next line, but it's too late.

Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Dan Carpenter <dan.carpenter@oracle.com>
Signed-off-by: "Theodore Ts'o" <tytso@mit.edu>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

xfrm: take net hdr len into account for esp payload size calculation

[ Upstream commit 91657eafb64b4cb53ec3a2fbc4afc3497f735788 ]

Corrects the function that determines the esp payload size. The calculations
done in esp{4,6}_get_mtu() lead to overlength frames in transport mode for
certain mtu values and suboptimal frames for others.

According to what is done, mainly in esp{,6}_output() and tcp_mtu_to_mss(),
net_header_len must be taken into account before doing the alignment
calculation.

Signed-off-by: Benjamin Poirier <bpoirier@suse.de>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

skb: avoid unnecessary reallocations in __skb_cow

[ Upstream commit 617c8c11236716dcbda877e764b7bf37c6fd8063 ]

At the beginning of __skb_cow, headroom gets set to a minimum of
NET_SKB_PAD. This causes unnecessary reallocations if the buffer was not
cloned and the headroom is just below NET_SKB_PAD, but still more than the
amount requested by the caller.
This was showing up frequently in my tests on VLAN tx, where
vlan_insert_tag calls skb_cow_head(skb, VLAN_HLEN).

Locally generated packets should have enough headroom, and for forward
paths, we already have NET_SKB_PAD bytes of headroom, so we don't need to
add any extra space here.

Signed-off-by: Felix Fietkau <nbd@openwrt.org>
Signed-off-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

l2tp: fix oops in L2TP IP sockets for connect() AF_UNSPEC case

[ Upstream commit c51ce49735c183ef2592db70f918ee698716276b ]

An application may call connect() to disconnect a socket using an
address with family AF_UNSPEC. The L2TP IP sockets were not handling
this case when the socket is not bound and an attempt to connect()
using AF_UNSPEC in such cases would result in an oops. This patch
addresses the problem by protecting the sk_prot->disconnect() call
against trying to unhash the socket before it is bound.

The patch also adds more checks that the sockaddr supplied to bind()
and connect() calls is valid.

 RIP: 0010:[<ffffffff82e133b0>]  [<ffffffff82e133b0>] inet_unhash+0x50/0xd0
 RSP: 0018:ffff88001989be28  EFLAGS: 00010293
 Stack:
  ffff8800407a8000 0000000000000000 ffff88001989be78 ffffffff82e3a249
  ffffffff82e3a050 ffff88001989bec8 ffff88001989be88 ffff8800407a8000
  0000000000000010 ffff88001989bec8 ffff88001989bea8 ffffffff82e42639
 Call Trace:
 [<ffffffff82e3a249>] udp_disconnect+0x1f9/0x290
 [<ffffffff82e42639>] inet_dgram_connect+0x29/0x80
 [<ffffffff82d012fc>] sys_connect+0x9c/0x100

Reported-by: Sasha Levin <levinsasha928@gmail.com>
Signed-off-by: James Chapman <jchapman@katalix.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ipv6: fix incorrect ipsec fragment

[ Upstream commit 0c1833797a5a6ec23ea9261d979aa18078720b74 ]

Since commit ad0081e43a
"ipv6: Fragment locally generated tunnel-mode IPSec6 packets as needed"
the fragment of packets is incorrect.
because tunnel mode needs IPsec headers and trailer for all fragments,
while on transport mode it is sufficient to add the headers to the
first fragment and the trailer to the last.

so modify mtu and maxfraglen base on ipsec mode and if fragment is first
or last.

with my test,it work well(every fragment's size is the mtu)
and does not trigger slow fragment path.

Changes from v1:
though optimization, mtu_prev and maxfraglen_prev can be delete.
replace xfrm mode codes with dst_entry's new frag DST_XFRM_TUNNEL.
add fuction ip6_append_data_mtu to make codes clearer.

Signed-off-by: Gao feng <gaofeng@cn.fujitsu.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ipv4: fix the rcu race between free_fib_info and ip_route_output_slow

[ Upstream commit e49cc0da7283088c5e03d475ffe2fdcb24a6d5b1 ]

We hit a kernel OOPS.

<3>[23898.789643] BUG: sleeping function called from invalid context at
/data/buildbot/workdir/ics/hardware/intel/linux-2.6/arch/x86/mm/fault.c:1103
<3>[23898.862215] in_atomic(): 0, irqs_disabled(): 0, pid: 10526, name:
Thread-6683
<4>[23898.967805] HSU serial 0000:00:05.1: 0000:00:05.2:HSU serial prevented me
to suspend...
<4>[23899.258526] Pid: 10526, comm: Thread-6683 Tainted: G        W
3.0.8-137685-ge7742f9 #1
<4>[23899.357404] HSU serial 0000:00:05.1: 0000:00:05.2:HSU serial prevented me
to suspend...
<4>[23899.904225] Call Trace:
<4>[23899.989209]  [<c1227f50>] ? pgtable_bad+0x130/0x130
<4>[23900.000416]  [<c1238c2a>] __might_sleep+0x10a/0x110
<4>[23900.007357]  [<c1228021>] do_page_fault+0xd1/0x3c0
<4>[23900.013764]  [<c18e9ba9>] ? restore_all+0xf/0xf
<4>[23900.024024]  [<c17c007b>] ? napi_complete+0x8b/0x690
<4>[23900.029297]  [<c1227f50>] ? pgtable_bad+0x130/0x130
<4>[23900.123739]  [<c1227f50>] ? pgtable_bad+0x130/0x130
<4>[23900.128955]  [<c18ea0c3>] error_code+0x5f/0x64
<4>[23900.133466]  [<c1227f50>] ? pgtable_bad+0x130/0x130
<4>[23900.138450]  [<c17f6298>] ? __ip_route_output_key+0x698/0x7c0
<4>[23900.144312]  [<c17f5f8d>] ? __ip_route_output_key+0x38d/0x7c0
<4>[23900.150730]  [<c17f63df>] ip_route_output_flow+0x1f/0x60
<4>[23900.156261]  [<c181de58>] ip4_datagram_connect+0x188/0x2b0
<4>[23900.161960]  [<c18e981f>] ? _raw_spin_unlock_bh+0x1f/0x30
<4>[23900.167834]  [<c18298d6>] inet_dgram_connect+0x36/0x80
<4>[23900.173224]  [<c14f9e88>] ? _copy_from_user+0x48/0x140
<4>[23900.178817]  [<c17ab9da>] sys_connect+0x9a/0xd0
<4>[23900.183538]  [<c132e93c>] ? alloc_file+0xdc/0x240
<4>[23900.189111]  [<c123925d>] ? sub_preempt_count+0x3d/0x50

Function free_fib_info resets nexthop_nh->nh_dev to NULL before releasing
fi. Other cpu might be accessing fi. Fixing it by delaying the releasing.

With the patch, we ran MTBF testing on Android mobile for 12 hours
and didn't trigger the issue.

Thank Eric for very detailed review/checking the issue.

Signed-off-by: Yanmin Zhang <yanmin_zhang@linux.intel.com>
Signed-off-by: Kun Jiang <kunx.jiang@intel.com>
Acked-by: Eric Dumazet <edumazet@google.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

asix: allow full size 8021Q frames to be received

[ Upstream commit 9dae31009b1a00d926c6fe032d5a88099620adc3 ]

asix driver drops 8021Q full size frames because it doesn't take into
account VLAN header size.

Tested on AX88772 adapter.

Signed-off-by: Eric Dumazet <edumazet@google.com>
CC: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
CC: Allan Chou <allan@asix.com.tw>
CC: Trond Wuellner <trond@chromium.org>
CC: Grant Grundler <grundler@chromium.org>
CC: Paul Stewart <pstew@chromium.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/vmwgfx: Fix nasty write past alloced memory area

commit 0824db38e515644f8d1bfd64adbd7cb2c6ea7c62 upstream.

Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Reviewed-by: Jakob Bornecrantz <jakob@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/ttm: Fix spinlock imbalance

commit a8ff3ee211fccf708e1911bbc096625453ebf759 upstream.

This imbalance may cause hangs when TTM is trying to swap out a buffer
that is already on the delayed delete list.

Signed-off-by: Thomas Hellstrom <thellstrom@vmware.com>
Reviewed-by: Jakob Bornecrantz <jakob@vmware.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/radeon: fix HD6790, HD6570 backend programming

commit 95c4b23ec4e2fa5604df229ddf134e31d7b3b378 upstream.

Without this bit sets we get broken rendering and
lockups.

fglrx sets this bit.

Bugs that should be fixed by this patch :
https://bugs.freedesktop.org/show_bug.cgi?id=49792
https://bugzilla.kernel.org/show_bug.cgi?id=43207
https://bugs.freedesktop.org/show_bug.cgi?id=39282

Signed-off-by: Jerome Glisse <jglisse@redhat.com>
Acked-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/radeon: properly program gart on rv740, juniper, cypress, barts, hemlock

commit 0b8c30bc4943137a4a36b9cb059b1cc684f5d702 upstream.

Need to program an additional VM register.  This doesn't not currently
cause any problems, but allows us to program the proper backend
map in a subsequent patch which should improve performance on these
asics.

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/radeon: fix bank information in tiling config

commit 29d654067a98c1cb8874c774e5fd799a038af8a6 upstream.

While there are cards with more than 8 mem banks, the max
number of banks from a tiling perspective is 8, so cap
the tiling config at 8 banks.

Fixes:
https://bugs.freedesktop.org/show_bug.cgi?id=43448

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

drm/radeon: fix regression in UMS CS ioctl

commit 9b00147d9f2ba137ce74b66b768a8312be0b6781 upstream.

radeon_cs_parser_init is called by both the legacy UMS
CS ioctl and the KMS CS ioctl.  Protect KMS specific
pieces of the code by checking that rdev is not NULL.

Reported-by: Michael Burian <michael.burian@sbg.at>

Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
Reviewed-by: Jerome Glisse <jglisse@redhat.com>
Signed-off-by: Dave Airlie <airlied@redhat.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mtd: mxc_nand: move ecc strengh setup before nand_scan_tail

commit 4a43faf54e9173b6acce37cf7f053fc9515a2cdf upstream.

Since commit 6a918bade9dab40aaef80559bd1169c69e8d69cb, the mxc_nand driver
fails with:

Driver must set ecc.strength when using hardware ECC

This is because nand_scan_tail checks for correct ecc strength
settings, so we must set them up before nand_scan_tail.

Signed-off-by: Sascha Hauer <s.hauer@pengutronix.de>
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mtd: block2mtd: fix recursive call of mtd_writev

commit 2e24e32e2759348c9290404abad4f729f791bfad upstream.

The 'mtd_writev' interface calls the function assigned
to the '_write' field of a given mtd device if that is
not NULL. The block2mtd driver sets the '_writev' field
to the 'mtd_writev' function itself and thus causes a
endless loop.

This is caused by 1dbebd32562b3c2caeca35960e5cb00bfcc12900
(mtd: harmonize mtd_writev usage).

Remove the assignment from the block2mtd driver to fix the
issue.

Signed-off-by: Gabor Juhos <juhosg@openwrt.org>
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mtd: of_parts: fix breakage in Kconfig

commit 2e929d001e85126d9267de373d4b76014789661d upstream.

MTD_OF_PARTS and the default setting is not working due to using 'Y'
instead of 'y', introduced in commit
d6137badeff1ef64b4e0092ec249ebdeaeb3ff37. This made our board, and
possibly other boards using DTS defined partitions and not having
CONFIG_MTD_OF_PARTS=y defined in the defconfig, fail to mount root.

Signed-off-by: Frank Svendsboe <frank.svendsboe@gmail.com>
Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Signed-off-by: David Woodhouse <David.Woodhouse@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mtd: nand: fix scan_read_raw_oob

commit 34a5704d91d6f8376a4c0a0143a1dd3eb3ccb37e upstream.

It seems there is a bug in scan_read_raw_oob() in nand_bbt.c which
should cause wrong functioning of NAND_BBT_SCANALLPAGES option.

Artem: the patch did not apply and I had to amend it a bit.

Signed-off-by: Artem Bityutskiy <artem.bityutskiy@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

x86: Reset the debug_stack update counter

commit c0525a6972d3f1fb83058ef503e183475d6e4e26 upstream.

When an NMI goes off and it sees that it preempted the debug stack,
to keep the debug stack safe, it changes the IDT to point to one that
does not modify the stack on breakpoint (to allow breakpoints in NMIs).

But the variable that gets set to know to undo it on exit never gets
cleared on exit. Thus every NMI will reset it on exit the first time
it is done even if it does not need to be reset.

[ Added H. Peter Anvin's suggestion to use this_cpu_read/write ]

Signed-off-by: Steven Rostedt <rostedt@goodmis.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

x86, x32, ptrace: Remove PTRACE_ARCH_PRCTL for x32

commit bad1a753d4d4deb09d4bc0bac1dd4fc3298502e9 upstream.

When I added x32 ptrace to 3.4 kernel, I also include PTRACE_ARCH_PRCTL
support for x32 GDB  For ARCH_GET_FS/GS, it takes a pointer to int64.  But
at user level, ARCH_GET_FS/GS takes a pointer to int32.  So I have to add
x32 ptrace to glibc to handle it with a temporary int64 passed to kernel and
copy it back to GDB as int32.  Roland suggested that PTRACE_ARCH_PRCTL
is obsolete and x32 GDB should use fs_base and gs_base fields of
user_regs_struct instead.

Accordingly, remove PTRACE_ARCH_PRCTL completely from the x32 code to
avoid possible memory overrun when pointer to int32 is passed to
kernel.

Link: http://lkml.kernel.org/r/CAMe9rOpDzHfS7NH7m1vmD9QRw8SSj4Sc%2BaNOgcWm_WJME2eRsQ@mail.gmail.com
Signed-off-by: H. Peter Anvin <hpa@zytor.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

fec_mpc52xx: fix timestamp filtering

commit 9ca3cc6f3026946ba655e863ca2096339e667639 upstream.

skb_defer_rx_timestamp was called with a freshly allocated skb but must
be called with rskb instead.

Signed-off-by: Stephan Gatzka <stephan@gatzka.org>
Acked-by: Richard Cochran <richardcochran@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

vfs: increment iversion when a file is truncated

commit 799243a389bde0de10fa21ca1ca453d2fe538b85 upstream.

When a file is truncated with truncate()/ftruncate() and then closed,
iversion is not updated.  This patch uses ATTR_SIZE flag as an indication
to increment iversion.

Mimi said:

On fput(), i_version is used to detect and flag files that have changed
and need to be re-measured in the IMA measurement policy.  When a file
is truncated with truncate()/ftruncate() and then closed, i_version is
not updated.  As a result, although the file has changed, it will not be
re-measured and added to the IMA measurement list on subsequent access.

Signed-off-by: Dmitry Kasatkin <dmitry.kasatkin@intel.com>
Acked-by: Mimi Zohar <zohar@us.ibm.com>
Cc: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

vfs: umount_tree() might be called on subtree that had never made it

commit 63d37a84ab6004c235314ffd7a76c5eb28c2fae0 upstream.

__mnt_make_shortterm() in there undoes the effect of __mnt_make_longterm()
we'd done back when we set ->mnt_ns non-NULL; it should not be done to
vfsmounts that had never gone through commit_tree() and friends.  Kudos to
lczerner for catching that one...

Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

slub: fix a memory leak in get_partial_node()

commit 02d7633fa567be7bf55a993b79d2a31b95ce2227 upstream.

In the case which is below,

1. acquire slab for cpu partial list
2. free object to it by remote cpu
3. page->freelist = t

then memory leak is occurred.

Change acquire_slab() not to zap freelist when it works for cpu partial list.
I think it is a sufficient solution for fixing a memory leak.

Below is output of 'slabinfo -r kmalloc-256'
when './perf stat -r 30 hackbench 50 process 4000 > /dev/null' is done.

***Vanilla***
Sizes (bytes)     Slabs              Debug                Memory
------------------------------------------------------------------------
Object :     256  Total  :     468   Sanity Checks : Off  Total: 3833856
SlabObj:     256  Full   :     111   Redzoning     : Off  Used : 2004992
SlabSiz:    8192  Partial:     302   Poisoning     : Off  Loss : 1828864
Loss   :       0  CpuSlab:      55   Tracking      : Off  Lalig:       0
Align  :       8  Objects:      32   Tracing       : Off  Lpadd:       0

***Patched***
Sizes (bytes)     Slabs              Debug                Memory
------------------------------------------------------------------------
Object :     256  Total  :     300   Sanity Checks : Off  Total: 2457600
SlabObj:     256  Full   :     204   Redzoning     : Off  Used : 2348800
SlabSiz:    8192  Partial:      33   Poisoning     : Off  Loss :  108800
Loss   :       0  CpuSlab:      63   Tracking      : Off  Lalig:       0
Align  :       8  Objects:      32   Tracing       : Off  Lpadd:       0

Total and loss number is the impact of this patch.

Acked-by: Christoph Lameter <cl@linux.com>
Signed-off-by: Joonsoo Kim <js1304@gmail.com>
Signed-off-by: Pekka Enberg <penberg@kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

ALSA: usb-audio: fix rate_list memory leak

commit 5cd5d7c44990658df6ab49f6253c39617c53b03d upstream.

The array of sample rates is reallocated every time when opening
the PCM device, but was freed only once when unplugging the device.

Reported-by: "Alexander E. Patrakov" <patrakov@gmail.com>
Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

mm: fix vma_resv_map() NULL pointer

commit 4523e1458566a0e8ecfaff90f380dd23acc44d27 upstream.

hugetlb_reserve_pages() can be used for either normal file-backed
hugetlbfs mappings, or MAP_HUGETLB.  In the MAP_HUGETLB, semi-anonymous
mode, there is not a VMA around.  The new call to resv_map_put() assumed
that there was, and resulted in a NULL pointer dereference:

  BUG: unable to handle kernel NULL pointer dereference at 0000000000000030
  IP: vma_resv_map+0x9/0x30
  PGD 141453067 PUD 1421e1067 PMD 0
  Oops: 0000 [#1] PREEMPT SMP
  ...
  Pid: 14006, comm: trinity-child6 Not tainted 3.4.0+ #36
  RIP: vma_resv_map+0x9/0x30
  ...
  Process trinity-child6 (pid: 14006, threadinfo ffff8801414e0000, task ffff8801414f26b0)
  Call Trace:
    resv_map_put+0xe/0x40
    hugetlb_reserve_pages+0xa6/0x1d0
    hugetlb_file_setup+0x102/0x2c0
    newseg+0x115/0x360
    ipcget+0x1ce/0x310
    sys_shmget+0x5a/0x60
    system_call_fastpath+0x16/0x1b

This was reported by Dave Jones, but was reproducible with the
libhugetlbfs test cases, so shame on me for not running them in the
first place.

With this, the oops is gone, and the output of libhugetlbfs's
run_tests.py is identical to plain 3.4 again.

[ Marked for stable, since this was introduced by commit c50ac050811d
  ("hugetlb: fix resv_map leak in error path") which was also marked for
  stable ]

Reported-by: Dave Jones <davej@redhat.com>
Cc: Mel Gorman <mel@csn.ul.ie>
Cc: KOSAKI Motohiro <kosaki.motohiro@jp.fujitsu.com>
Cc: Christoph Lameter <cl@linux.com>
Cc: Andrea Arcangeli <aarcange@redhat.com>
Cc: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>