works for kernel-4.2.4

2015-10-26 16:11:53 +02:00
parent bafa03ea9c
commit 01bac5e427
59 changed files with 2859 additions and 1036 deletions
@@ -1,81 +0,0 @@
-From 2110d70c5e58326a10e93cfefdc0b3686e2ada12 Mon Sep 17 00:00:00 2001
-From: Borislav Petkov <bp@suse.de>
-Date: Sat, 8 Aug 2015 10:46:02 +0200
-Subject: cpu/cacheinfo: Fix teardown path
-MIME-Version: 1.0
-Content-Type: text/plain; charset=UTF-8
-Content-Transfer-Encoding: 8bit
-
-Philip Müller reported a hang when booting 32-bit 4.1 kernel on an AMD
-box. A fragment of the splat was enough to pinpoint the issue:
-
-  task: f58e0000 ti: f58e8000 task.ti: f58e800
-  EIP: 0060:[<c135a903>] EFLAGS: 00010206 CPU: 0
-  EIP is at free_cache_attributes+0x83/0xd0
-  EAX: 00000001 EBX: f589d46c ECX: 00000090 EDX: 360c2000
-  ESI: 00000000 EDI: c1724a80 EBP: f58e9ec0 ESP: f58e9ea0
-   DS: 007b ES: 007b FS: 00d8 GS: 00e0 SS: 0068
-  CR0: 8005003b CR2: 000000ac CR3: 01731000 CR4: 000006d0
-
-cache_shared_cpu_map_setup() did check sibling CPUs cacheinfo descriptor
-while the respective teardown path cache_shared_cpu_map_remove() didn't.
-Fix that.
-
->From tglx's version: to be on the safe side, move the cacheinfo
-descriptor check to free_cache_attributes(), thus cleaning up the
-hotplug path a little and making this even more robust.
-
-Reported-and-tested-by: Philip Müller <philm@manjaro.org>
-Reviewed-by: Thomas Gleixner <tglx@linutronix.de>
-Acked-by: Sudeep Holla <sudeep.holla@arm.com>
-Cc: <stable@vger.kernel.org> # 4.1
-Cc: Andre Przywara <andre.przywara@arm.com>
-Cc: Guenter Roeck <linux@roeck-us.net>
-Cc: "H. Peter Anvin" <hpa@zytor.com>
-Cc: Ingo Molnar <mingo@redhat.com>
-Cc: linux-kernel@vger.kernel.org
-Cc: manjaro-dev@manjaro.org
-Cc: Philip Müller <philm@manjaro.org>
-Link: https://lkml.kernel.org/r/55B47BB8.6080202@manjaro.org
-Signed-off-by: Borislav Petkov <bp@suse.de>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
-
-diff --git a/drivers/base/cacheinfo.c b/drivers/base/cacheinfo.c
-index 764280a..e9fd32e 100644
--- a/drivers/base/cacheinfo.c
-+++ b/drivers/base/cacheinfo.c
-@@ -148,7 +148,11 @@ static void cache_shared_cpu_map_remove(unsigned int cpu)
- 
- 			if (sibling == cpu) /* skip itself */
- 				continue;
-+
- 			sib_cpu_ci = get_cpu_cacheinfo(sibling);
-+			if (!sib_cpu_ci->info_list)
-+				continue;
-+
- 			sib_leaf = sib_cpu_ci->info_list + index;
- 			cpumask_clear_cpu(cpu, &sib_leaf->shared_cpu_map);
- 			cpumask_clear_cpu(sibling, &this_leaf->shared_cpu_map);
-@@ -159,6 +163,9 @@ static void cache_shared_cpu_map_remove(unsigned int cpu)
- 
- static void free_cache_attributes(unsigned int cpu)
- {
-+	if (!per_cpu_cacheinfo(cpu))
-+		return;
-+
- 	cache_shared_cpu_map_remove(cpu);
- 
- 	kfree(per_cpu_cacheinfo(cpu));
-@@ -514,8 +521,7 @@ static int cacheinfo_cpu_callback(struct notifier_block *nfb,
- 		break;
- 	case CPU_DEAD:
- 		cache_remove_dev(cpu);
-		if (per_cpu_cacheinfo(cpu))
-			free_cache_attributes(cpu);
-+		free_cache_attributes(cpu);
- 		break;
- 	}
- 	return notifier_from_errno(rc);
-- 
-cgit v0.10.2
-
@@ -0,0 +1,53 @@
+From 0f89abf56abbd0e1c6e3cef9813e6d9f05383c1e Mon Sep 17 00:00:00 2001
+From: Christian Engelmayer <cengelma@gmx.at>
+Date: Wed, 21 Oct 2015 00:50:06 +0200
+Subject: btrfs: fix possible leak in btrfs_ioctl_balance()
+
+Commit 8eb934591f8b ("btrfs: check unsupported filters in balance
+arguments") adds a jump to exit label out_bargs in case the argument
+check fails. At this point in addition to the bargs memory, the
+memory for struct btrfs_balance_control has already been allocated.
+Ownership of bctl is passed to btrfs_balance() in the good case,
+thus the memory is not freed due to the introduced jump. Make sure
+that the memory gets freed in any case as necessary. Detected by
+Coverity CID 1328378.
+
+Signed-off-by: Christian Engelmayer <cengelma@gmx.at>
+Reviewed-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Chris Mason <clm@fb.com>
+---
+ fs/btrfs/ioctl.c | 5 ++++-
+ 1 file changed, 4 insertions(+), 1 deletion(-)
+
+diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
+index 3e3e613..8d20f3b 100644
+--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
+@@ -4641,7 +4641,7 @@ locked:
+ 
+ 	if (bctl->flags & ~(BTRFS_BALANCE_ARGS_MASK | BTRFS_BALANCE_TYPE_MASK)) {
+ 		ret = -EINVAL;
+-		goto out_bargs;
+		goto out_bctl;
+ 	}
+ 
+ do_balance:
+@@ -4655,12 +4655,15 @@ do_balance:
+ 	need_unlock = false;
+ 
+ 	ret = btrfs_balance(bctl, bargs);
+	bctl = NULL;
+ 
+ 	if (arg) {
+ 		if (copy_to_user(arg, bargs, sizeof(*bargs)))
+ 			ret = -EFAULT;
+ 	}
+ 
+out_bctl:
+	kfree(bctl);
+ out_bargs:
+ 	kfree(bargs);
+ out_unlock:
+-- 
+cgit v0.11.2
+
@@ -1,64 +0,0 @@
-From 143081a13f31bcf05cb5685f628b6fda65d05237 Mon Sep 17 00:00:00 2001
-From: "Eric W. Biederman" <ebiederm@xmission.com>
-Date: Sat, 15 Aug 2015 13:36:12 -0500
-Subject: [PATCH 1/2] dcache: Handle escaped paths in prepend_path
-
-commit cde93be45a8a90d8c264c776fab63487b5038a65 upstream.
-
-A rename can result in a dentry that by walking up d_parent
-will never reach it's mnt_root.  For lack of a better term
-I call this an escaped path.
-
-prepend_path is called by four different functions __d_path,
-d_absolute_path, d_path, and getcwd.
-
-__d_path only wants to see paths are connected to the root it passes
-in.  So __d_path needs prepend_path to return an error.
-
-d_absolute_path similarly wants to see paths that are connected to
-some root.  Escaped paths are not connected to any mnt_root so
-d_absolute_path needs prepend_path to return an error greater
-than 1.  So escaped paths will be treated like paths on lazily
-unmounted mounts.
-
-getcwd needs to prepend "(unreachable)" so getcwd also needs
-prepend_path to return an error.
-
-d_path is the interesting hold out.  d_path just wants to print
-something, and does not care about the weird cases.  Which raises
-the question what should be printed?
-
-Given that <escaped_path>/<anything> should result in -ENOENT I
-believe it is desirable for escaped paths to be printed as empty
-paths.  As there are not really any meaninful path components when
-considered from the perspective of a mount tree.
-
-So tweak prepend_path to return an empty path with an new error
-code of 3 when it encounters an escaped path.
-
-Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
-Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
- fs/dcache.c | 7 +++++++
- 1 file changed, 7 insertions(+)
-
-diff --git a/fs/dcache.c b/fs/dcache.c
-index 9b5fe503f6cb..e3b44ca75a1b 100644
--- a/fs/dcache.c
-+++ b/fs/dcache.c
-@@ -2926,6 +2926,13 @@ restart:
- 
- 		if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
- 			struct mount *parent = ACCESS_ONCE(mnt->mnt_parent);
-+			/* Escaped? */
-+			if (dentry != vfsmnt->mnt_root) {
-+				bptr = *buffer;
-+				blen = *buflen;
-+				error = 3;
-+				break;
-+			}
- 			/* Global root? */
- 			if (mnt != parent) {
- 				dentry = ACCESS_ONCE(mnt->mnt_mountpoint);
-- 
-2.2.1
@@ -1,110 +0,0 @@
-From 701cf206d76af24fc948b3a798c4ee6b7f149910 Mon Sep 17 00:00:00 2001
-From: "Eric W. Biederman" <ebiederm@xmission.com>
-Date: Sat, 15 Aug 2015 20:27:13 -0500
-Subject: [PATCH 2/2] vfs: Test for and handle paths that are unreachable from
- their mnt_root
-
-commit 397d425dc26da728396e66d392d5dcb8dac30c37 upstream.
-
-In rare cases a directory can be renamed out from under a bind mount.
-In those cases without special handling it becomes possible to walk up
-the directory tree to the root dentry of the filesystem and down
-from the root dentry to every other file or directory on the filesystem.
-
-Like division by zero .. from an unconnected path can not be given
-a useful semantic as there is no predicting at which path component
-the code will realize it is unconnected.  We certainly can not match
-the current behavior as the current behavior is a security hole.
-
-Therefore when encounting .. when following an unconnected path
-return -ENOENT.
-
- Add a function path_connected to verify path->dentry is reachable
-  from path->mnt.mnt_root.  AKA to validate that rename did not do
-  something nasty to the bind mount.
-
-  To avoid races path_connected must be called after following a path
-  component to it's next path component.
-
-Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
-Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
---
- fs/namei.c | 27 +++++++++++++++++++++++++--
- 1 file changed, 25 insertions(+), 2 deletions(-)
-
-diff --git a/fs/namei.c b/fs/namei.c
-index 1c2105ed20c5..29b927938b8c 100644
--- a/fs/namei.c
-+++ b/fs/namei.c
-@@ -560,6 +560,24 @@ static int __nd_alloc_stack(struct nameidata *nd)
- 	return 0;
- }
- 
-+/**
-+ * path_connected - Verify that a path->dentry is below path->mnt.mnt_root
-+ * @path: nameidate to verify
-+ *
-+ * Rename can sometimes move a file or directory outside of a bind
-+ * mount, path_connected allows those cases to be detected.
-+ */
-+static bool path_connected(const struct path *path)
-+{
-+	struct vfsmount *mnt = path->mnt;
-+
-+	/* Only bind mounts can have disconnected paths */
-+	if (mnt->mnt_root == mnt->mnt_sb->s_root)
-+		return true;
-+
-+	return is_subdir(path->dentry, mnt->mnt_root);
-+}
-+
- static inline int nd_alloc_stack(struct nameidata *nd)
- {
- 	if (likely(nd->depth != EMBEDDED_LEVELS))
-@@ -1296,6 +1314,8 @@ static int follow_dotdot_rcu(struct nameidata *nd)
- 				return -ECHILD;
- 			nd->path.dentry = parent;
- 			nd->seq = seq;
-+			if (unlikely(!path_connected(&nd->path)))
-+				return -ENOENT;
- 			break;
- 		} else {
- 			struct mount *mnt = real_mount(nd->path.mnt);
-@@ -1396,7 +1416,7 @@ static void follow_mount(struct path *path)
- 	}
- }
- 
-static void follow_dotdot(struct nameidata *nd)
-+static int follow_dotdot(struct nameidata *nd)
- {
- 	if (!nd->root.mnt)
- 		set_root(nd);
-@@ -1412,6 +1432,8 @@ static void follow_dotdot(struct nameidata *nd)
- 			/* rare case of legitimate dget_parent()... */
- 			nd->path.dentry = dget_parent(nd->path.dentry);
- 			dput(old);
-+			if (unlikely(!path_connected(&nd->path)))
-+				return -ENOENT;
- 			break;
- 		}
- 		if (!follow_up(&nd->path))
-@@ -1419,6 +1441,7 @@ static void follow_dotdot(struct nameidata *nd)
- 	}
- 	follow_mount(&nd->path);
- 	nd->inode = nd->path.dentry->d_inode;
-+	return 0;
- }
- 
- /*
-@@ -1634,7 +1657,7 @@ static inline int handle_dots(struct nameidata *nd, int type)
- 		if (nd->flags & LOOKUP_RCU) {
- 			return follow_dotdot_rcu(nd);
- 		} else
-			follow_dotdot(nd);
-+			return follow_dotdot(nd);
- 	}
- 	return 0;
- }
-- 
-2.2.1
-
@@ -0,0 +1,115 @@
+From: Hans de Goede <hdegoede@redhat.com>
+Subject: [PATCH] alps: Only the Dell Latitude D420/430/620/630 have separate stick button bits
+Date: Wed, 21 Oct 2015 10:16:18 +0200
+
+commit 92bac83dd79e ("Input: alps - non interleaved V2 dualpoint has
+separate stick button bits") assumes that all alps v2 non-interleaved
+dual point setups have the separate stick button bits.
+
+Later we limited this to Dell laptops only because of reports that this
+broke things on non Dell laptops. Now it turns out that this breaks things
+on the Dell Latitude D600 too. So it seems that only the Dell Latitude
+D420/430/620/630, which all share the same touchpad / stick combo,
+have these separate bits.
+
+This patch limits the checking of the separate bits to only these models
+fixing regressions with other models.
+
+Reported-and-tested-by: Larry Finger <Larry.Finger@lwfinger.net>
+Cc: stable@vger.kernel.org
+Tested-by: Hans de Goede <hdegoede@redhat.com>
+Signed-off-by: Hans de Goede <hdegoede@redhat.com>
+---
+ drivers/input/mouse/alps.c | 48 ++++++++++++++++++++++++++++++++++++++++------
+ 1 file changed, 42 insertions(+), 6 deletions(-)
+
+diff --git a/drivers/input/mouse/alps.c b/drivers/input/mouse/alps.c
+index 4d24686..41e6cb5 100644
+--- a/drivers/input/mouse/alps.c
+++ b/drivers/input/mouse/alps.c
+@@ -100,7 +100,7 @@ static const struct alps_nibble_commands alps_v6_nibble_commands[] = {
+ #define ALPS_FOUR_BUTTONS	0x40	/* 4 direction button present */
+ #define ALPS_PS2_INTERLEAVED	0x80	/* 3-byte PS/2 packet interleaved with
+ 					   6-byte ALPS packet */
+-#define ALPS_DELL		0x100	/* device is a Dell laptop */
+#define ALPS_STICK_BITS		0x100	/* separate stick button bits */
+ #define ALPS_BUTTONPAD		0x200	/* device is a clickpad */
+ 
+ static const struct alps_model_info alps_model_data[] = {
+@@ -159,6 +159,43 @@ static const struct alps_protocol_info alps_v8_protocol_data = {
+ 	ALPS_PROTO_V8, 0x18, 0x18, 0
+ };
+ 
+/*
+ * Some v2 models report the stick buttons in separate bits
+ */
+static const struct dmi_system_id alps_dmi_has_separate_stick_buttons[] = {
+#if defined(CONFIG_DMI) && defined(CONFIG_X86)
+	{
+		/* Extrapolated from other entries */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Latitude D420"),
+		},
+	},
+	{
+		/* Reported-by: Hans de Bruin <jmdebruin@xmsnet.nl> */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Latitude D430"),
+		},
+	},
+	{
+		/* Reported-by: Hans de Goede <hdegoede@redhat.com> */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Latitude D620"),
+		},
+	},
+	{
+		/* Extrapolated from other entries */
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Latitude D630"),
+		},
+	},
+#endif
+	{ }
+};
+
+ static void alps_set_abs_params_st(struct alps_data *priv,
+ 				   struct input_dev *dev1);
+ static void alps_set_abs_params_semi_mt(struct alps_data *priv,
+@@ -253,9 +290,8 @@ static void alps_process_packet_v1_v2(struct psmouse *psmouse)
+ 		return;
+ 	}
+ 
+-	/* Dell non interleaved V2 dualpoint has separate stick button bits */
+-	if (priv->proto_version == ALPS_PROTO_V2 &&
+-	    priv->flags == (ALPS_DELL | ALPS_PASS | ALPS_DUALPOINT)) {
+	/* Some models have separate stick button bits */
+	if (priv->flags & ALPS_STICK_BITS) {
+ 		left |= packet[0] & 1;
+ 		right |= packet[0] & 2;
+ 		middle |= packet[0] & 4;
+@@ -2552,8 +2588,6 @@ static int alps_set_protocol(struct psmouse *psmouse,
+ 	priv->byte0 = protocol->byte0;
+ 	priv->mask0 = protocol->mask0;
+ 	priv->flags = protocol->flags;
+-	if (dmi_name_in_vendors("Dell"))
+-		priv->flags |= ALPS_DELL;
+ 
+ 	priv->x_max = 2000;
+ 	priv->y_max = 1400;
+@@ -2568,6 +2602,8 @@ static int alps_set_protocol(struct psmouse *psmouse,
+ 		priv->set_abs_params = alps_set_abs_params_st;
+ 		priv->x_max = 1023;
+ 		priv->y_max = 767;
+		if (dmi_check_system(alps_dmi_has_separate_stick_buttons))
+			priv->flags |= ALPS_STICK_BITS;
+ 		break;
+ 
+ 	case ALPS_PROTO_V3:
+-- 
+2.5.0
+
@@ -1,42 +0,0 @@
-From 18e1db67e93ed75d9dc0d34c8d783ccf10547c2b Mon Sep 17 00:00:00 2001
-From: Bernhard Thaler <bernhard.thaler@wvnet.at>
-Date: Thu, 13 Aug 2015 08:58:15 +0200
-Subject: [PATCH] netfilter: bridge: fix IPv6 packets not being bridged with
- CONFIG_IPV6=n
-
-230ac490f7fba introduced a dependency to CONFIG_IPV6 which breaks bridging
-of IPv6 packets on a bridge with CONFIG_IPV6=n.
-
-Sysctl entry /proc/sys/net/bridge/bridge-nf-call-ip6tables defaults to 1,
-for this reason packets are handled by br_nf_pre_routing_ipv6(). When compiled
-with CONFIG_IPV6=n this function returns NF_DROP but should return NF_ACCEPT
-to let packets through.
-
-Change CONFIG_IPV6=n br_nf_pre_routing_ipv6() return value to NF_ACCEPT.
-
-Tested with a simple bridge with two interfaces and IPv6 packets trying
-to pass from host on left side to host on right side of the bridge.
-
-Fixes: 230ac490f7fba ("netfilter: bridge: split ipv6 code into separated file")
-Signed-off-by: Bernhard Thaler <bernhard.thaler@wvnet.at>
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
- include/net/netfilter/br_netfilter.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/include/net/netfilter/br_netfilter.h b/include/net/netfilter/br_netfilter.h
-index bab824b..d4c6b5f 100644
--- a/include/net/netfilter/br_netfilter.h
-+++ b/include/net/netfilter/br_netfilter.h
-@@ -59,7 +59,7 @@ static inline unsigned int
- br_nf_pre_routing_ipv6(const struct nf_hook_ops *ops, struct sk_buff *skb,
- 		       const struct nf_hook_state *state)
- {
-	return NF_DROP;
-+	return NF_ACCEPT;
- }
- #endif
- 
-- 
-2.6.0
-
@@ -1,103 +0,0 @@
-From 9cf94eab8b309e8bcc78b41dd1561c75b537dd0b Mon Sep 17 00:00:00 2001
-From: Daniel Borkmann <daniel@iogearbox.net>
-Date: Mon, 31 Aug 2015 19:11:02 +0200
-Subject: [PATCH] netfilter: conntrack: use nf_ct_tmpl_free in CT/synproxy
- error paths
-
-Commit 0838aa7fcfcd ("netfilter: fix netns dependencies with conntrack
-templates") migrated templates to the new allocator api, but forgot to
-update error paths for them in CT and synproxy to use nf_ct_tmpl_free()
-instead of nf_conntrack_free().
-
-Due to that, memory is being freed into the wrong kmemcache, but also
-we drop the per net reference count of ct objects causing an imbalance.
-
-In Brad's case, this leads to a wrap-around of net->ct.count and thus
-lets __nf_conntrack_alloc() refuse to create a new ct object:
-
-  [   10.340913] xt_addrtype: ipv6 does not support BROADCAST matching
-  [   10.810168] nf_conntrack: table full, dropping packet
-  [   11.917416] r8169 0000:07:00.0 eth0: link up
-  [   11.917438] IPv6: ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready
-  [   12.815902] nf_conntrack: table full, dropping packet
-  [   15.688561] nf_conntrack: table full, dropping packet
-  [   15.689365] nf_conntrack: table full, dropping packet
-  [   15.690169] nf_conntrack: table full, dropping packet
-  [   15.690967] nf_conntrack: table full, dropping packet
-  [...]
-
-With slab debugging, it also reports the wrong kmemcache (kmalloc-512 vs.
-nf_conntrack_ffffffff81ce75c0) and reports poison overwrites, etc. Thus,
-to fix the problem, export and use nf_ct_tmpl_free() instead.
-
-Fixes: 0838aa7fcfcd ("netfilter: fix netns dependencies with conntrack templates")
-Reported-by: Brad Jackson <bjackson0971@gmail.com>
-Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
- include/net/netfilter/nf_conntrack.h | 1 +
- net/netfilter/nf_conntrack_core.c    | 3 ++-
- net/netfilter/nf_synproxy_core.c     | 2 +-
- net/netfilter/xt_CT.c                | 2 +-
- 4 files changed, 5 insertions(+), 3 deletions(-)
-
-diff --git a/include/net/netfilter/nf_conntrack.h b/include/net/netfilter/nf_conntrack.h
-index 37cd391..4023c4c 100644
--- a/include/net/netfilter/nf_conntrack.h
-+++ b/include/net/netfilter/nf_conntrack.h
-@@ -292,6 +292,7 @@ extern unsigned int nf_conntrack_hash_rnd;
- void init_nf_conntrack_hash_rnd(void);
- 
- struct nf_conn *nf_ct_tmpl_alloc(struct net *net, u16 zone, gfp_t flags);
-+void nf_ct_tmpl_free(struct nf_conn *tmpl);
- 
- #define NF_CT_STAT_INC(net, count)	  __this_cpu_inc((net)->ct.stat->count)
- #define NF_CT_STAT_INC_ATOMIC(net, count) this_cpu_inc((net)->ct.stat->count)
-diff --git a/net/netfilter/nf_conntrack_core.c b/net/netfilter/nf_conntrack_core.c
-index 3c20d02..0625a42 100644
--- a/net/netfilter/nf_conntrack_core.c
-+++ b/net/netfilter/nf_conntrack_core.c
-@@ -320,12 +320,13 @@ out_free:
- }
- EXPORT_SYMBOL_GPL(nf_ct_tmpl_alloc);
- 
-static void nf_ct_tmpl_free(struct nf_conn *tmpl)
-+void nf_ct_tmpl_free(struct nf_conn *tmpl)
- {
- 	nf_ct_ext_destroy(tmpl);
- 	nf_ct_ext_free(tmpl);
- 	kfree(tmpl);
- }
-+EXPORT_SYMBOL_GPL(nf_ct_tmpl_free);
- 
- static void
- destroy_conntrack(struct nf_conntrack *nfct)
-diff --git a/net/netfilter/nf_synproxy_core.c b/net/netfilter/nf_synproxy_core.c
-index d7f1685..d6ee8f8 100644
--- a/net/netfilter/nf_synproxy_core.c
-+++ b/net/netfilter/nf_synproxy_core.c
-@@ -378,7 +378,7 @@ static int __net_init synproxy_net_init(struct net *net)
- err3:
- 	free_percpu(snet->stats);
- err2:
-	nf_conntrack_free(ct);
-+	nf_ct_tmpl_free(ct);
- err1:
- 	return err;
- }
-diff --git a/net/netfilter/xt_CT.c b/net/netfilter/xt_CT.c
-index 43ddeee..f3377ce 100644
--- a/net/netfilter/xt_CT.c
-+++ b/net/netfilter/xt_CT.c
-@@ -233,7 +233,7 @@ out:
- 	return 0;
- 
- err3:
-	nf_conntrack_free(ct);
-+	nf_ct_tmpl_free(ct);
- err2:
- 	nf_ct_l3proto_module_put(par->family);
- err1:
-- 
-2.6.0
-
@@ -1,155 +0,0 @@
-From 96be5f2806cd65a2ebced3bfcdf7df0116e6c4a6 Mon Sep 17 00:00:00 2001
-From: Elad Raz <eladr@mellanox.com>
-Date: Sat, 22 Aug 2015 08:44:11 +0300
-Subject: [PATCH] netfilter: ipset: Fixing unnamed union init
-
-In continue to proposed Vinson Lee's post [1], this patch fixes compilation
-issues founded at gcc 4.4.7. The initialization of .cidr field of unnamed
-unions causes compilation error in gcc 4.4.x.
-
-References
-
-Visible links
-[1] https://lkml.org/lkml/2015/7/5/74
-
-Signed-off-by: Elad Raz <eladr@mellanox.com>
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
- net/netfilter/ipset/ip_set_hash_netnet.c     | 20 ++++++++++++++++++--
- net/netfilter/ipset/ip_set_hash_netportnet.c | 20 ++++++++++++++++++--
- 2 files changed, 36 insertions(+), 4 deletions(-)
-
-diff --git a/net/netfilter/ipset/ip_set_hash_netnet.c b/net/netfilter/ipset/ip_set_hash_netnet.c
-index 3c862c0..a93dfeb 100644
--- a/net/netfilter/ipset/ip_set_hash_netnet.c
-+++ b/net/netfilter/ipset/ip_set_hash_netnet.c
-@@ -131,6 +131,13 @@ hash_netnet4_data_next(struct hash_netnet4_elem *next,
- #define HOST_MASK	32
- #include "ip_set_hash_gen.h"
- 
-+static void
-+hash_netnet4_init(struct hash_netnet4_elem *e)
-+{
-+	e->cidr[0] = HOST_MASK;
-+	e->cidr[1] = HOST_MASK;
-+}
-+
- static int
- hash_netnet4_kadt(struct ip_set *set, const struct sk_buff *skb,
- 		  const struct xt_action_param *par,
-@@ -160,7 +167,7 @@ hash_netnet4_uadt(struct ip_set *set, struct nlattr *tb[],
- {
- 	const struct hash_netnet *h = set->data;
- 	ipset_adtfn adtfn = set->variant->adt[adt];
-	struct hash_netnet4_elem e = { .cidr = { HOST_MASK, HOST_MASK, }, };
-+	struct hash_netnet4_elem e = { };
- 	struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
- 	u32 ip = 0, ip_to = 0, last;
- 	u32 ip2 = 0, ip2_from = 0, ip2_to = 0, last2;
-@@ -169,6 +176,7 @@ hash_netnet4_uadt(struct ip_set *set, struct nlattr *tb[],
- 	if (tb[IPSET_ATTR_LINENO])
- 		*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
- 
-+	hash_netnet4_init(&e);
- 	if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] ||
- 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS)))
- 		return -IPSET_ERR_PROTOCOL;
-@@ -357,6 +365,13 @@ hash_netnet6_data_next(struct hash_netnet4_elem *next,
- #define IP_SET_EMIT_CREATE
- #include "ip_set_hash_gen.h"
- 
-+static void
-+hash_netnet6_init(struct hash_netnet6_elem *e)
-+{
-+	e->cidr[0] = HOST_MASK;
-+	e->cidr[1] = HOST_MASK;
-+}
-+
- static int
- hash_netnet6_kadt(struct ip_set *set, const struct sk_buff *skb,
- 		  const struct xt_action_param *par,
-@@ -385,13 +400,14 @@ hash_netnet6_uadt(struct ip_set *set, struct nlattr *tb[],
- 		  enum ipset_adt adt, u32 *lineno, u32 flags, bool retried)
- {
- 	ipset_adtfn adtfn = set->variant->adt[adt];
-	struct hash_netnet6_elem e = { .cidr = { HOST_MASK, HOST_MASK, }, };
-+	struct hash_netnet6_elem e = { };
- 	struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
- 	int ret;
- 
- 	if (tb[IPSET_ATTR_LINENO])
- 		*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
- 
-+	hash_netnet6_init(&e);
- 	if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] ||
- 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_CADT_FLAGS)))
- 		return -IPSET_ERR_PROTOCOL;
-diff --git a/net/netfilter/ipset/ip_set_hash_netportnet.c b/net/netfilter/ipset/ip_set_hash_netportnet.c
-index 0c68734..9a14c23 100644
--- a/net/netfilter/ipset/ip_set_hash_netportnet.c
-+++ b/net/netfilter/ipset/ip_set_hash_netportnet.c
-@@ -142,6 +142,13 @@ hash_netportnet4_data_next(struct hash_netportnet4_elem *next,
- #define HOST_MASK	32
- #include "ip_set_hash_gen.h"
- 
-+static void
-+hash_netportnet4_init(struct hash_netportnet4_elem *e)
-+{
-+	e->cidr[0] = HOST_MASK;
-+	e->cidr[1] = HOST_MASK;
-+}
-+
- static int
- hash_netportnet4_kadt(struct ip_set *set, const struct sk_buff *skb,
- 		      const struct xt_action_param *par,
-@@ -175,7 +182,7 @@ hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
- {
- 	const struct hash_netportnet *h = set->data;
- 	ipset_adtfn adtfn = set->variant->adt[adt];
-	struct hash_netportnet4_elem e = { .cidr = { HOST_MASK, HOST_MASK, }, };
-+	struct hash_netportnet4_elem e = { };
- 	struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
- 	u32 ip = 0, ip_to = 0, ip_last, p = 0, port, port_to;
- 	u32 ip2_from = 0, ip2_to = 0, ip2_last, ip2;
-@@ -185,6 +192,7 @@ hash_netportnet4_uadt(struct ip_set *set, struct nlattr *tb[],
- 	if (tb[IPSET_ATTR_LINENO])
- 		*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
- 
-+	hash_netportnet4_init(&e);
- 	if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] ||
- 		     !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
- 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) ||
-@@ -412,6 +420,13 @@ hash_netportnet6_data_next(struct hash_netportnet4_elem *next,
- #define IP_SET_EMIT_CREATE
- #include "ip_set_hash_gen.h"
- 
-+static void
-+hash_netportnet6_init(struct hash_netportnet6_elem *e)
-+{
-+	e->cidr[0] = HOST_MASK;
-+	e->cidr[1] = HOST_MASK;
-+}
-+
- static int
- hash_netportnet6_kadt(struct ip_set *set, const struct sk_buff *skb,
- 		      const struct xt_action_param *par,
-@@ -445,7 +460,7 @@ hash_netportnet6_uadt(struct ip_set *set, struct nlattr *tb[],
- {
- 	const struct hash_netportnet *h = set->data;
- 	ipset_adtfn adtfn = set->variant->adt[adt];
-	struct hash_netportnet6_elem e = { .cidr = { HOST_MASK, HOST_MASK, }, };
-+	struct hash_netportnet6_elem e = { };
- 	struct ip_set_ext ext = IP_SET_INIT_UEXT(set);
- 	u32 port, port_to;
- 	bool with_ports = false;
-@@ -454,6 +469,7 @@ hash_netportnet6_uadt(struct ip_set *set, struct nlattr *tb[],
- 	if (tb[IPSET_ATTR_LINENO])
- 		*lineno = nla_get_u32(tb[IPSET_ATTR_LINENO]);
- 
-+	hash_netportnet6_init(&e);
- 	if (unlikely(!tb[IPSET_ATTR_IP] || !tb[IPSET_ATTR_IP2] ||
- 		     !ip_set_attr_netorder(tb, IPSET_ATTR_PORT) ||
- 		     !ip_set_optattr_netorder(tb, IPSET_ATTR_PORT_TO) ||
-- 
-2.6.0
-
@@ -1,87 +0,0 @@
-From 6fe7ccfd77415a6ba250c10c580eb3f9acf79753 Mon Sep 17 00:00:00 2001
-From: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
-Date: Tue, 25 Aug 2015 11:17:51 +0200
-Subject: [PATCH] netfilter: ipset: Out of bound access in hash:net* types
- fixed
-
-Dave Jones reported that KASan detected out of bounds access in hash:net*
-types:
-
-[   23.139532] ==================================================================
-[   23.146130] BUG: KASan: out of bounds access in hash_net4_add_cidr+0x1db/0x220 at addr ffff8800d4844b58
-[   23.152937] Write of size 4 by task ipset/457
-[   23.159742] =============================================================================
-[   23.166672] BUG kmalloc-512 (Not tainted): kasan: bad access detected
-[   23.173641] -----------------------------------------------------------------------------
-[   23.194668] INFO: Allocated in hash_net_create+0x16a/0x470 age=7 cpu=1 pid=456
-[   23.201836]  __slab_alloc.constprop.66+0x554/0x620
-[   23.208994]  __kmalloc+0x2f2/0x360
-[   23.216105]  hash_net_create+0x16a/0x470
-[   23.223238]  ip_set_create+0x3e6/0x740
-[   23.230343]  nfnetlink_rcv_msg+0x599/0x640
-[   23.237454]  netlink_rcv_skb+0x14f/0x190
-[   23.244533]  nfnetlink_rcv+0x3f6/0x790
-[   23.251579]  netlink_unicast+0x272/0x390
-[   23.258573]  netlink_sendmsg+0x5a1/0xa50
-[   23.265485]  SYSC_sendto+0x1da/0x2c0
-[   23.272364]  SyS_sendto+0xe/0x10
-[   23.279168]  entry_SYSCALL_64_fastpath+0x12/0x6f
-
-The bug is fixed in the patch and the testsuite is extended in ipset
-to check cidr handling more thoroughly.
-
-Signed-off-by: Jozsef Kadlecsik <kadlec@blackhole.kfki.hu>
---
- net/netfilter/ipset/ip_set_hash_gen.h | 12 ++++++++----
- 1 file changed, 8 insertions(+), 4 deletions(-)
-
-diff --git a/net/netfilter/ipset/ip_set_hash_gen.h b/net/netfilter/ipset/ip_set_hash_gen.h
-index afe905c..691b54f 100644
--- a/net/netfilter/ipset/ip_set_hash_gen.h
-+++ b/net/netfilter/ipset/ip_set_hash_gen.h
-@@ -152,9 +152,13 @@ htable_bits(u32 hashsize)
- #define SET_HOST_MASK(family)	(family == AF_INET ? 32 : 128)
- 
- #ifdef IP_SET_HASH_WITH_NET0
-+/* cidr from 0 to SET_HOST_MASK() value and c = cidr + 1 */
- #define NLEN(family)		(SET_HOST_MASK(family) + 1)
-+#define CIDR_POS(c)		((c) - 1)
- #else
-+/* cidr from 1 to SET_HOST_MASK() value and c = cidr + 1 */
- #define NLEN(family)		SET_HOST_MASK(family)
-+#define CIDR_POS(c)		((c) - 2)
- #endif
- 
- #else
-@@ -305,7 +309,7 @@ mtype_add_cidr(struct htype *h, u8 cidr, u8 nets_length, u8 n)
- 		} else if (h->nets[i].cidr[n] < cidr) {
- 			j = i;
- 		} else if (h->nets[i].cidr[n] == cidr) {
-			h->nets[cidr - 1].nets[n]++;
-+			h->nets[CIDR_POS(cidr)].nets[n]++;
- 			return;
- 		}
- 	}
-@@ -314,7 +318,7 @@ mtype_add_cidr(struct htype *h, u8 cidr, u8 nets_length, u8 n)
- 			h->nets[i].cidr[n] = h->nets[i - 1].cidr[n];
- 	}
- 	h->nets[i].cidr[n] = cidr;
-	h->nets[cidr - 1].nets[n] = 1;
-+	h->nets[CIDR_POS(cidr)].nets[n] = 1;
- }
- 
- static void
-@@ -325,8 +329,8 @@ mtype_del_cidr(struct htype *h, u8 cidr, u8 nets_length, u8 n)
- 	for (i = 0; i < nets_length; i++) {
- 		if (h->nets[i].cidr[n] != cidr)
- 			continue;
-		h->nets[cidr - 1].nets[n]--;
-		if (h->nets[cidr - 1].nets[n] > 0)
-+		h->nets[CIDR_POS(cidr)].nets[n]--;
-+		if (h->nets[CIDR_POS(cidr)].nets[n] > 0)
- 			return;
- 		for (j = i; j < net_end && h->nets[j].cidr[n]; j++)
- 			h->nets[j].cidr[n] = h->nets[j + 1].cidr[n];
-- 
-2.6.0
-
@@ -1,32 +0,0 @@
-From bf798657eb5ba57552096843c315f096fdf9b715 Mon Sep 17 00:00:00 2001
-From: Pablo Neira Ayuso <pablo@netfilter.org>
-Date: Wed, 12 Aug 2015 17:41:00 +0200
-Subject: [PATCH] netfilter: nf_tables: Use 32 bit addressing register from
- nft_type_to_reg()
-
-nft_type_to_reg() needs to return the register in the new 32 bit addressing,
-otherwise we hit EINVAL when using mappings.
-
-Fixes: 49499c3 ("netfilter: nf_tables: switch registers to 32 bit addressing")
-Reported-by: Andreas Schultz <aschultz@tpip.net>
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
- include/net/netfilter/nf_tables.h | 2 +-
- 1 file changed, 1 insertion(+), 1 deletion(-)
-
-diff --git a/include/net/netfilter/nf_tables.h b/include/net/netfilter/nf_tables.h
-index 2a24668..aa8bee7 100644
--- a/include/net/netfilter/nf_tables.h
-+++ b/include/net/netfilter/nf_tables.h
-@@ -125,7 +125,7 @@ static inline enum nft_data_types nft_dreg_to_type(enum nft_registers reg)
- 
- static inline enum nft_registers nft_type_to_reg(enum nft_data_types type)
- {
-	return type == NFT_DATA_VERDICT ? NFT_REG_VERDICT : NFT_REG_1;
-+	return type == NFT_DATA_VERDICT ? NFT_REG_VERDICT : NFT_REG_1 * NFT_REG_SIZE / NFT_REG32_SIZE;
- }
- 
- unsigned int nft_parse_register(const struct nlattr *attr);
-- 
-2.6.0
-
@@ -1,54 +0,0 @@
-From a9de9777d613500b089a7416f936bf3ae5f070d2 Mon Sep 17 00:00:00 2001
-From: Pablo Neira Ayuso <pablo@netfilter.org>
-Date: Fri, 28 Aug 2015 21:01:43 +0200
-Subject: [PATCH] netfilter: nfnetlink: work around wrong endianess in res_id
- field
-
-The convention in nfnetlink is to use network byte order in every header field
-as well as in the attribute payload. The initial version of the batching
-infrastructure assumes that res_id comes in host byte order though.
-
-The only client of the batching infrastructure is nf_tables, so let's add a
-workaround to address this inconsistency. We currently have 11 nfnetlink
-subsystems according to NFNL_SUBSYS_COUNT, so we can assume that the subsystem
-2560, ie. htons(10), will not be allocated anytime soon, so it can be an alias
-of nf_tables from the nfnetlink batching path when interpreting the res_id
-field.
-
-Based on original patch from Florian Westphal.
-
-Reported-by: Florian Westphal <fw@strlen.de>
-Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
---
- net/netfilter/nfnetlink.c | 8 +++++++-
- 1 file changed, 7 insertions(+), 1 deletion(-)
-
-diff --git a/net/netfilter/nfnetlink.c b/net/netfilter/nfnetlink.c
-index 0c0e8ec..70277b1 100644
--- a/net/netfilter/nfnetlink.c
-+++ b/net/netfilter/nfnetlink.c
-@@ -444,6 +444,7 @@ done:
- static void nfnetlink_rcv(struct sk_buff *skb)
- {
- 	struct nlmsghdr *nlh = nlmsg_hdr(skb);
-+	u_int16_t res_id;
- 	int msglen;
- 
- 	if (nlh->nlmsg_len < NLMSG_HDRLEN ||
-@@ -468,7 +469,12 @@ static void nfnetlink_rcv(struct sk_buff *skb)
- 
- 		nfgenmsg = nlmsg_data(nlh);
- 		skb_pull(skb, msglen);
-		nfnetlink_rcv_batch(skb, nlh, nfgenmsg->res_id);
-+		/* Work around old nft using host byte order */
-+		if (nfgenmsg->res_id == NFNL_SUBSYS_NFTABLES)
-+			res_id = NFNL_SUBSYS_NFTABLES;
-+		else
-+			res_id = ntohs(nfgenmsg->res_id);
-+		nfnetlink_rcv_batch(skb, nlh, res_id);
- 	} else {
- 		netlink_rcv_skb(skb, &nfnetlink_rcv_msg);
- 	}
-- 
-2.6.0
-
@@ -0,0 +1,32 @@
+From b5a48134f8af08f5243328f8a0b05fc5ae7cf343 Mon Sep 17 00:00:00 2001
+From: Johannes Berg <johannes.berg@intel.com>
+Date: Tue, 22 Sep 2015 10:47:27 +0200
+Subject: [PATCH] iwlwifi: fix firmware filename for 3160
+
+The MODULE_FIRMWARE() for 3160 should be using the 7260 version as
+it's done in the device configuration struct instead of referencing
+IWL3160_UCODE_API_OK which doesn't even exist.
+
+Cc: <stable@vger.kernel.org> [3.8+]
+Reported-by: Hauke Mehrtens <hauke@hauke-m.de>
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Luca Coelho <luciano.coelho@intel.com>
+---
+ drivers/net/wireless/iwlwifi/iwl-7000.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/drivers/net/wireless/iwlwifi/iwl-7000.c b/drivers/net/wireless/iwlwifi/iwl-7000.c
+index 6951aba..3fb327d 100644
+--- a/drivers/net/wireless/iwlwifi/iwl-7000.c
+++ b/drivers/net/wireless/iwlwifi/iwl-7000.c
+@@ -348,6 +348,6 @@ const struct iwl_cfg iwl7265d_n_cfg = {
+ };
+ 
+ MODULE_FIRMWARE(IWL7260_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
+-MODULE_FIRMWARE(IWL3160_MODULE_FIRMWARE(IWL3160_UCODE_API_OK));
+MODULE_FIRMWARE(IWL3160_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
+ MODULE_FIRMWARE(IWL7265_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
+ MODULE_FIRMWARE(IWL7265D_MODULE_FIRMWARE(IWL7260_UCODE_API_OK));
+-- 
+2.6.2
+
@@ -14,6 +14,47 @@
 ###
 ### Stable Queue
 ###
+stable-net-ibm-emac-bump-version-numbers-for-correct-work-with-ethtool.patch
+stable-l2tp-protect-tunnel-del_work-by-ref_count.patch
+stable-af_unix-convert-the-unix_sk-macro-to-an-inline-function-for-type-safety.patch
+stable-af_unix-return-data-from-multiple-skbs-on-recv-with-msg_peek-flag.patch
+stable-net-unix-fix-logic-about-sk_peek_offset.patch
+stable-skbuff-fix-skb-checksum-flag-on-skb-pull.patch
+stable-skbuff-fix-skb-checksum-partial-check.patch
+stable-net-dsa-fix-preparation-of-a-port-stp-update.patch
+stable-inet-fix-races-in-reqsk_queue_hash_req.patch
+stable-net-add-pfmemalloc-check-in-sk_add_backlog.patch
+stable-ppp-don-t-override-sk-sk_state-in-pppoe_flush_dev.patch
+stable-inet-fix-race-in-reqsk_queue_unlink.patch
+stable-bpf-fix-panic-in-so_get_filter-with-native-ebpf-programs.patch
+stable-ovs-do-not-allocate-memory-from-offline-numa-node.patch
+stable-act_mirred-clear-sender-cpu-before-sending-to-tx.patch
+stable-bpf-clear-sender_cpu-before-xmit.patch
+stable-ipv6-don-t-call-with-rt6_uncached_list_flush_dev.patch
+stable-ethtool-use-kcalloc-instead-of-kmalloc-for-ethtool_get_strings.patch
+stable-tipc-move-fragment-importance-field-to-new-header-position.patch
+stable-netlink-trim-skb-to-alloc-size-to-avoid-msg_trunc.patch
+stable-drm-fix-locking-for-sysfs-dpms-file.patch
+stable-crypto-sparc-initialize-blkcipher.ivsize.patch
+stable-crypto-camellia_aesni_avx-fix-cpu-feature-checks.patch
+stable-crypto-ahash-ensure-statesize-is-non-zero.patch
+stable-memcg-convert-threshold-to-bytes.patch
+stable-btrfs-check-unsupported-filters-in-balance-arguments.patch
+stable-btrfs-fix-use-after-free-iterating-extrefs.patch
+stable-arm64-errata-use-kbuild_cflags_module-for-erratum-843419.patch
+stable-arm-ux500-simplify-secondary-cpu-boot.patch
+stable-nfsd-blocklayout-accept-any-minlength.patch
+stable-mfd-max77843-fix-max77843_chg_init-return-on-error.patch
+stable-i2c-rcar-enable-runtimepm-before-registering-to-the-core.patch
+stable-i2c-s3c2410-enable-runtimepm-before-registering-to-the-core.patch
+stable-i2c-designware-do-not-use-parameters-from-acpi-on-dell-inspiron-7348.patch
+stable-i2c-designware-platdrv-enable-runtimepm-before-registering-to-the-core.patch
+stable-workqueue-make-sure-delayed-work-run-in-local-cpu.patch
+stable-kvm-x86-clean-up-kvm_arch_vcpu_runnable.patch
+stable-kvm-x86-fix-smi-to-halted-vcpu.patch
+stable-kvm-x86-fix-rsm-into-64-bit-protected-mode.patch
+stable-drm-qxl-fix-framebuffer-dirty-rectangle-tracking.patch
+stable-drm-nouveau-fbcon-take-runpm-reference-when-userspace-has-an-open-fd.patch

 ###
 ### Arch x86
@@ -38,16 +79,13 @@ x86-increase-default-minimum-vmalloc-area-by-64MB-to-192MB.patch
 # slows down boot
 Revert-cpufreq-pcc-Enable-autoload-of-pcc-cpufreq-fo.patch

-# efi bootfix
-x86-efi-Fix-boot-crash-by-mapping-EFI-memmap-entries.patch
+# EFI
+x86-efi-Fix-multiple-GOP-device-support.patch

 ###
 ### Core
 ###

-# amd cpu boot crash (mga#16527)
-cpu-cacheinfo-Fix-teardown-path.patch
-
 ###
 ### i2c
 ###
@@ -130,9 +168,8 @@ scsi-Fix-NULL-pointer-dereference-in-RTPM-of-block-layer.patch
 fs-aufs4.patch
 fs-aufs4-modular.patch

-# Bind mount escape fixes (CVE-2015-2925)
-fs-dcache-Handle-escaped-paths-in-prepend_path.patch
-fs-vfs-Test-for-and-handle-paths-that-are-unreachable-from-their-mnt_root.patch
+# btrfs memleak
+fs-btrfs-fix-possible-leak-in-btrfs_ioctl_balance.patch

 ###
 ### FireWire
@@ -177,6 +214,9 @@ gpu-drm-mach64-3.18-buildfix.patch

 input-i8042-quirks-for-Fujitsu-Lifebook-A544-and-Lif.patch

+# fix alps breakage
+input-alps-Only-the-Dell-Latitude-D420_430_620_630-have-separate-stick-button-bits.patch
+
 ###
 ### idle
 ###
@@ -217,17 +257,12 @@ net-netfilter-psd.patch
 net-netfilter-psd-mdv.patch
 net-netfilter-psd-2.6.35-buildfix.patch

-# netfilter fixes
-net-netfilter-conntrack-use-nf_ct_tmpl_free-in-CT-synpro.patch
-net-netfilter-nfnetlink-work-around-wrong-endianess-in-r.patch
-net-netfilter-bridge-fix-IPv6-packets-not-being-bridged-.patch
-net-netfilter-nf_tables-Use-32-bit-addressing-register-f.patch
-net-netfilter-ipset-Out-of-bound-access-in-hash-net-type.patch
-net-netfilter-ipset-Fixing-unnamed-union-init.patch
-
 # wireless lockup
 net-wireless-rtlwifi-rtl8821ae-Fix-system-lockups-on-boot.patch

+# iwlwifi borked fw reference
+net-wireless-iwlwifi-fix-firmware-filename-for-3160.patch
+
 ###
 ### Platform drivers
 ###
@@ -275,12 +310,6 @@ hid-usbhid-IBM-BladeCenterHS20-quirk.patch
 usb-storage-unusual_devs-add-id.patch
 usb-storage-unusual_devs-add-id-2.6.37-buildfix.patch

-# boot hang fix
-usb-phy-phy-generic-Fix-reset-behaviour-on-legacy-bo.patch
-
-# xhci 1.1 support
-usb-xhci-change-xhci-1.0-only-restrictions-to-support-xh.patch
-
 ###
 ### V4L
 ###
@@ -0,0 +1,35 @@
+From foo@baz Thu Oct 22 17:25:24 PDT 2015
+From: WANG Cong <xiyou.wangcong@gmail.com>
+Date: Tue, 6 Oct 2015 17:23:47 -0700
+Subject: act_mirred: clear sender cpu before sending to tx
+
+From: WANG Cong <xiyou.wangcong@gmail.com>
+
+[ Upstream commit d40496a56430eac0d330378816954619899fe303 ]
+
+Similar to commit c29390c6dfee ("xps: must clear sender_cpu before forwarding")
+the skb->sender_cpu needs to be cleared when moving from Rx
+Tx, otherwise kernel could crash.
+
+Fixes: 2bd82484bb4c ("xps: fix xps for stacked devices")
+Cc: Eric Dumazet <edumazet@google.com>
+Cc: Jamal Hadi Salim <jhs@mojatatu.com>
+Signed-off-by: Cong Wang <cwang@twopensource.com>
+Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
+Acked-by: Eric Dumazet <edumazet@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/sched/act_mirred.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
+@@ -168,6 +168,7 @@ static int tcf_mirred(struct sk_buff *sk
+ 
+ 	skb2->skb_iif = skb->dev->ifindex;
+ 	skb2->dev = dev;
+	skb_sender_cpu_clear(skb2);
+ 	err = dev_queue_xmit(skb2);
+ 
+ out:
@@ -0,0 +1,35 @@
+From foo@baz Thu Oct 22 17:25:24 PDT 2015
+From: Aaron Conole <aconole@bytheb.org>
+Date: Sat, 26 Sep 2015 18:50:42 -0400
+Subject: af_unix: Convert the unix_sk macro to an inline function for type safety
+
+From: Aaron Conole <aconole@bytheb.org>
+
+[ Upstream commit 4613012db1d911f80897f9446a49de817b2c4c47 ]
+
+As suggested by Eric Dumazet this change replaces the
+#define with a static inline function to enjoy
+complaints by the compiler when misusing the API.
+
+Signed-off-by: Aaron Conole <aconole@bytheb.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/af_unix.h |    6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/include/net/af_unix.h
+++ b/include/net/af_unix.h
+@@ -63,7 +63,11 @@ struct unix_sock {
+ #define UNIX_GC_MAYBE_CYCLE	1
+ 	struct socket_wq	peer_wq;
+ };
+-#define unix_sk(__sk) ((struct unix_sock *)__sk)
+
+static inline struct unix_sock *unix_sk(struct sock *sk)
+{
+	return (struct unix_sock *)sk;
+}
+ 
+ #define peer_wait peer_wq.wait
+ 
@@ -0,0 +1,60 @@
+From foo@baz Thu Oct 22 17:25:24 PDT 2015
+From: Aaron Conole <aconole@bytheb.org>
+Date: Sat, 26 Sep 2015 18:50:43 -0400
+Subject: af_unix: return data from multiple SKBs on recv() with MSG_PEEK flag
+
+From: Aaron Conole <aconole@bytheb.org>
+
+[ Upstream commit 9f389e35674f5b086edd70ed524ca0f287259725 ]
+
+AF_UNIX sockets now return multiple skbs from recv() when MSG_PEEK flag
+is set.
+
+This is referenced in kernel bugzilla #12323 @
+https://bugzilla.kernel.org/show_bug.cgi?id=12323
+
+As described both in the BZ and lkml thread @
+http://lkml.org/lkml/2008/1/8/444 calling recv() with MSG_PEEK on an
+AF_UNIX socket only reads a single skb, where the desired effect is
+to return as much skb data has been queued, until hitting the recv
+buffer size (whichever comes first).
+
+The modified MSG_PEEK path will now move to the next skb in the tree
+and jump to the again: label, rather than following the natural loop
+structure. This requires duplicating some of the loop head actions.
+
+This was tested using the python socketpair python code attached to
+the bugzilla issue.
+
+Signed-off-by: Aaron Conole <aconole@bytheb.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/unix/af_unix.c |   15 ++++++++++++++-
+ 1 file changed, 14 insertions(+), 1 deletion(-)
+
+--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
+@@ -2179,8 +2179,21 @@ unlock:
+ 			if (UNIXCB(skb).fp)
+ 				scm.fp = scm_fp_dup(UNIXCB(skb).fp);
+ 
+-			sk_peek_offset_fwd(sk, chunk);
+			if (skip) {
+				sk_peek_offset_fwd(sk, chunk);
+				skip -= chunk;
+			}
+ 
+			if (UNIXCB(skb).fp)
+				break;
+
+			last = skb;
+			last_len = skb->len;
+			unix_state_lock(sk);
+			skb = skb_peek_next(skb, &sk->sk_receive_queue);
+			if (skb)
+				goto again;
+			unix_state_unlock(sk);
+ 			break;
+ 		}
+ 	} while (size);
@@ -0,0 +1,280 @@
+From c00def71efd919e8ae835a25f4f4c80a4b2d36d3 Mon Sep 17 00:00:00 2001
+From: Linus Walleij <linus.walleij@linaro.org>
+Date: Mon, 3 Aug 2015 09:26:52 +0200
+Subject: ARM: ux500: simplify secondary CPU boot
+
+From: Linus Walleij <linus.walleij@linaro.org>
+
+commit c00def71efd919e8ae835a25f4f4c80a4b2d36d3 upstream.
+
+This removes a lot of ancient cruft from the Ux500 SMP boot.
+Instead of the pen grab/release, just point the ROM to
+secondary_boot() and start the second CPU there, then send
+the IPI.
+
+Use our own SMP enable method. This enables us to remove the
+last static mapping and get both CPUs booting properly.
+
+Tested this and it just works.
+
+Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
+Signed-off-by: Olof Johansson <olof@lixom.net>
+Signed-off-by: Kevin Hilman <khilman@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm/mach-ux500/Makefile     |    2 
+ arch/arm/mach-ux500/cpu-db8500.c |    1 
+ arch/arm/mach-ux500/headsmp.S    |   37 ----------
+ arch/arm/mach-ux500/platsmp.c    |  132 +++++++++++----------------------------
+ arch/arm/mach-ux500/setup.h      |    1 
+ 5 files changed, 40 insertions(+), 133 deletions(-)
+
+--- a/arch/arm/mach-ux500/Makefile
+++ b/arch/arm/mach-ux500/Makefile
+@@ -7,7 +7,7 @@ obj-$(CONFIG_CACHE_L2X0)	+= cache-l2x0.o
+ obj-$(CONFIG_UX500_SOC_DB8500)	+= cpu-db8500.o
+ obj-$(CONFIG_MACH_MOP500)	+= board-mop500-regulators.o \
+ 				board-mop500-audio.o
+-obj-$(CONFIG_SMP)		+= platsmp.o headsmp.o
+obj-$(CONFIG_SMP)		+= platsmp.o
+ obj-$(CONFIG_HOTPLUG_CPU)	+= hotplug.o
+ obj-$(CONFIG_PM_GENERIC_DOMAINS) += pm_domains.o
+ 
+--- a/arch/arm/mach-ux500/cpu-db8500.c
+++ b/arch/arm/mach-ux500/cpu-db8500.c
+@@ -154,7 +154,6 @@ static const char * stericsson_dt_platfo
+ };
+ 
+ DT_MACHINE_START(U8500_DT, "ST-Ericsson Ux5x0 platform (Device Tree Support)")
+-	.smp            = smp_ops(ux500_smp_ops),
+ 	.map_io		= u8500_map_io,
+ 	.init_irq	= ux500_init_irq,
+ 	/* we re-use nomadik timer here */
+--- a/arch/arm/mach-ux500/headsmp.S
+++ /dev/null
+@@ -1,37 +0,0 @@
+-/*
+- *  Copyright (c) 2009 ST-Ericsson
+- *	This file is based  ARM Realview platform
+- *  Copyright (c) 2003 ARM Limited
+- *  All Rights Reserved
+- *
+- * This program is free software; you can redistribute it and/or modify
+- * it under the terms of the GNU General Public License version 2 as
+- * published by the Free Software Foundation.
+- */
+-#include <linux/linkage.h>
+-#include <linux/init.h>
+-
+-/*
+- * U8500 specific entry point for secondary CPUs.
+- */
+-ENTRY(u8500_secondary_startup)
+-	mrc	p15, 0, r0, c0, c0, 5
+-	and	r0, r0, #15
+-	adr	r4, 1f
+-	ldmia	r4, {r5, r6}
+-	sub	r4, r4, r5
+-	add	r6, r6, r4
+-pen:	ldr	r7, [r6]
+-	cmp	r7, r0
+-	bne	pen
+-
+-	/*
+-	 * we've been released from the holding pen: secondary_stack
+-	 * should now contain the SVC stack for this core
+-	 */
+-	b	secondary_startup
+-ENDPROC(u8500_secondary_startup)
+-
+-	.align 2
+-1:	.long	.
+-	.long	pen_release
+--- a/arch/arm/mach-ux500/platsmp.c
+++ b/arch/arm/mach-ux500/platsmp.c
+@@ -28,135 +28,81 @@
+ #include "db8500-regs.h"
+ #include "id.h"
+ 
+-static void __iomem *scu_base;
+-static void __iomem *backupram;
+-
+-/* This is called from headsmp.S to wakeup the secondary core */
+-extern void u8500_secondary_startup(void);
+-
+-/*
+- * Write pen_release in a way that is guaranteed to be visible to all
+- * observers, irrespective of whether they're taking part in coherency
+- * or not.  This is necessary for the hotplug code to work reliably.
+- */
+-static void write_pen_release(int val)
+-{
+-	pen_release = val;
+-	smp_wmb();
+-	sync_cache_w(&pen_release);
+-}
+-
+-static DEFINE_SPINLOCK(boot_lock);
+-
+-static void ux500_secondary_init(unsigned int cpu)
+-{
+-	/*
+-	 * let the primary processor know we're out of the
+-	 * pen, then head off into the C entry point
+-	 */
+-	write_pen_release(-1);
+-
+-	/*
+-	 * Synchronise with the boot thread.
+-	 */
+-	spin_lock(&boot_lock);
+-	spin_unlock(&boot_lock);
+-}
+/* Magic triggers in backup RAM */
+#define UX500_CPU1_JUMPADDR_OFFSET 0x1FF4
+#define UX500_CPU1_WAKEMAGIC_OFFSET 0x1FF0
+ 
+-static int ux500_boot_secondary(unsigned int cpu, struct task_struct *idle)
+static void wakeup_secondary(void)
+ {
+-	unsigned long timeout;
+-
+-	/*
+-	 * set synchronisation state between this boot processor
+-	 * and the secondary one
+-	 */
+-	spin_lock(&boot_lock);
+-
+-	/*
+-	 * The secondary processor is waiting to be released from
+-	 * the holding pen - release it, then wait for it to flag
+-	 * that it has been released by resetting pen_release.
+-	 */
+-	write_pen_release(cpu_logical_map(cpu));
+-
+-	arch_send_wakeup_ipi_mask(cpumask_of(cpu));
+	struct device_node *np;
+	static void __iomem *backupram;
+ 
+-	timeout = jiffies + (1 * HZ);
+-	while (time_before(jiffies, timeout)) {
+-		if (pen_release == -1)
+-			break;
+	np = of_find_compatible_node(NULL, NULL, "ste,dbx500-backupram");
+	if (!np) {
+		pr_err("No backupram base address\n");
+		return;
+	}
+	backupram = of_iomap(np, 0);
+	of_node_put(np);
+	if (!backupram) {
+		pr_err("No backupram remap\n");
+		return;
+ 	}
+ 
+ 	/*
+-	 * now the secondary core is starting up let it run its
+-	 * calibrations, then wait for it to finish
+-	 */
+-	spin_unlock(&boot_lock);
+-
+-	return pen_release != -1 ? -ENOSYS : 0;
+-}
+-
+-static void __init wakeup_secondary(void)
+-{
+-	/*
+ 	 * write the address of secondary startup into the backup ram register
+ 	 * at offset 0x1FF4, then write the magic number 0xA1FEED01 to the
+ 	 * backup ram register at offset 0x1FF0, which is what boot rom code
+-	 * is waiting for. This would wake up the secondary core from WFE
+	 * is waiting for. This will wake up the secondary core from WFE.
+ 	 */
+-#define UX500_CPU1_JUMPADDR_OFFSET 0x1FF4
+-	__raw_writel(virt_to_phys(u8500_secondary_startup),
+-		     backupram + UX500_CPU1_JUMPADDR_OFFSET);
+-
+-#define UX500_CPU1_WAKEMAGIC_OFFSET 0x1FF0
+-	__raw_writel(0xA1FEED01,
+-		     backupram + UX500_CPU1_WAKEMAGIC_OFFSET);
+	writel(virt_to_phys(secondary_startup),
+	       backupram + UX500_CPU1_JUMPADDR_OFFSET);
+	writel(0xA1FEED01,
+	       backupram + UX500_CPU1_WAKEMAGIC_OFFSET);
+ 
+ 	/* make sure write buffer is drained */
+ 	mb();
+	iounmap(backupram);
+ }
+ 
+-/*
+- * Initialise the CPU possible map early - this describes the CPUs
+- * which may be present or become present in the system.
+- */
+-static void __init ux500_smp_init_cpus(void)
+static void __init ux500_smp_prepare_cpus(unsigned int max_cpus)
+ {
+-	unsigned int i, ncores;
+ 	struct device_node *np;
+	static void __iomem *scu_base;
+	unsigned int ncores;
+	int i;
+ 
+ 	np = of_find_compatible_node(NULL, NULL, "arm,cortex-a9-scu");
+	if (!np) {
+		pr_err("No SCU base address\n");
+		return;
+	}
+ 	scu_base = of_iomap(np, 0);
+ 	of_node_put(np);
+-	if (!scu_base)
+	if (!scu_base) {
+		pr_err("No SCU remap\n");
+ 		return;
+-	backupram = ioremap(U8500_BACKUPRAM0_BASE, SZ_8K);
+-	ncores = scu_get_core_count(scu_base);
+-
+-	/* sanity check */
+-	if (ncores > nr_cpu_ids) {
+-		pr_warn("SMP: %u cores greater than maximum (%u), clipping\n",
+-			ncores, nr_cpu_ids);
+-		ncores = nr_cpu_ids;
+ 	}
+ 
+	scu_enable(scu_base);
+	ncores = scu_get_core_count(scu_base);
+ 	for (i = 0; i < ncores; i++)
+ 		set_cpu_possible(i, true);
+	iounmap(scu_base);
+ }
+ 
+-static void __init ux500_smp_prepare_cpus(unsigned int max_cpus)
+static int ux500_boot_secondary(unsigned int cpu, struct task_struct *idle)
+ {
+-	scu_enable(scu_base);
+ 	wakeup_secondary();
+	arch_send_wakeup_ipi_mask(cpumask_of(cpu));
+	return 0;
+ }
+ 
+ struct smp_operations ux500_smp_ops __initdata = {
+-	.smp_init_cpus		= ux500_smp_init_cpus,
+ 	.smp_prepare_cpus	= ux500_smp_prepare_cpus,
+-	.smp_secondary_init	= ux500_secondary_init,
+ 	.smp_boot_secondary	= ux500_boot_secondary,
+ #ifdef CONFIG_HOTPLUG_CPU
+ 	.cpu_die		= ux500_cpu_die,
+ #endif
+ };
+CPU_METHOD_OF_DECLARE(ux500_smp, "ste,dbx500-smp", &ux500_smp_ops);
+--- a/arch/arm/mach-ux500/setup.h
+++ b/arch/arm/mach-ux500/setup.h
+@@ -26,7 +26,6 @@ extern struct device *ux500_soc_device_i
+ 
+ extern void ux500_timer_init(void);
+ 
+-extern struct smp_operations ux500_smp_ops;
+ extern void ux500_cpu_die(unsigned int cpu);
+ 
+ #endif /*  __ASM_ARCH_SETUP_H */
@@ -0,0 +1,39 @@
+From b6dd8e0719c0d2d01429639a11b7bc2677de240c Mon Sep 17 00:00:00 2001
+From: Will Deacon <will.deacon@arm.com>
+Date: Thu, 8 Oct 2015 11:11:17 +0100
+Subject: arm64: errata: use KBUILD_CFLAGS_MODULE for erratum #843419
+
+From: Will Deacon <will.deacon@arm.com>
+
+commit b6dd8e0719c0d2d01429639a11b7bc2677de240c upstream.
+
+Commit df057cc7b4fa ("arm64: errata: add module build workaround for
+erratum #843419") sets CFLAGS_MODULE to ensure that the large memory
+model is used by the compiler when building kernel modules.
+
+However, CFLAGS_MODULE is an environment variable and intended to be
+overridden on the command line, which appears to be the case with the
+Ubuntu kernel packaging system, so use KBUILD_CFLAGS_MODULE instead.
+
+Cc: Ard Biesheuvel <ard.biesheuvel@linaro.org>
+Fixes: df057cc7b4fa ("arm64: errata: add module build workaround for erratum #843419")
+Reported-by: Dann Frazier <dann.frazier@canonical.com>
+Tested-by: Dann Frazier <dann.frazier@canonical.com>
+Signed-off-by: Will Deacon <will.deacon@arm.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/arm64/Makefile |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/arch/arm64/Makefile
+++ b/arch/arm64/Makefile
+@@ -31,7 +31,7 @@ endif
+ CHECKFLAGS	+= -D__aarch64__
+ 
+ ifeq ($(CONFIG_ARM64_ERRATUM_843419), y)
+-CFLAGS_MODULE	+= -mcmodel=large
+KBUILD_CFLAGS_MODULE	+= -mcmodel=large
+ endif
+ 
+ # Default value
@@ -0,0 +1,31 @@
+From foo@baz Thu Oct 22 17:25:24 PDT 2015
+From: Alexei Starovoitov <ast@plumgrid.com>
+Date: Tue, 6 Oct 2015 20:46:07 -0700
+Subject: bpf: clear sender_cpu before xmit
+
+From: Alexei Starovoitov <ast@plumgrid.com>
+
+[ Upstream commit 6bf0577374cfb6c2301dbf4934a4f23ad3d72763 ]
+
+Similar to commit c29390c6dfee ("xps: must clear sender_cpu before forwarding")
+the skb->sender_cpu needs to be cleared before xmit.
+
+Fixes: 3896d655f4d4 ("bpf: introduce bpf_clone_redirect() helper")
+Signed-off-by: Alexei Starovoitov <ast@plumgrid.com>
+Acked-by: Daniel Borkmann <daniel@iogearbox.net>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/filter.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/net/core/filter.c
+++ b/net/core/filter.c
+@@ -1412,6 +1412,7 @@ static u64 bpf_clone_redirect(u64 r1, u6
+ 		return dev_forward_skb(dev, skb2);
+ 
+ 	skb2->dev = dev;
+	skb_sender_cpu_clear(skb2);
+ 	return dev_queue_xmit(skb2);
+ }
+ 
@@ -0,0 +1,65 @@
+From foo@baz Thu Oct 22 17:25:24 PDT 2015
+From: Daniel Borkmann <daniel@iogearbox.net>
+Date: Fri, 2 Oct 2015 12:06:03 +0200
+Subject: bpf: fix panic in SO_GET_FILTER with native ebpf programs
+
+From: Daniel Borkmann <daniel@iogearbox.net>
+
+[ Upstream commit 93d08b6966cf730ea669d4d98f43627597077153 ]
+
+When sockets have a native eBPF program attached through
+setsockopt(sk, SOL_SOCKET, SO_ATTACH_BPF, ...), and then try to
+dump these over getsockopt(sk, SOL_SOCKET, SO_GET_FILTER, ...),
+the following panic appears:
+
+  [49904.178642] BUG: unable to handle kernel NULL pointer dereference at (null)
+  [49904.178762] IP: [<ffffffff81610fd9>] sk_get_filter+0x39/0x90
+  [49904.182000] PGD 86fc9067 PUD 531a1067 PMD 0
+  [49904.185196] Oops: 0000 [#1] SMP
+  [...]
+  [49904.224677] Call Trace:
+  [49904.226090]  [<ffffffff815e3d49>] sock_getsockopt+0x319/0x740
+  [49904.227535]  [<ffffffff812f59e3>] ? sock_has_perm+0x63/0x70
+  [49904.228953]  [<ffffffff815e2fc8>] ? release_sock+0x108/0x150
+  [49904.230380]  [<ffffffff812f5a43>] ? selinux_socket_getsockopt+0x23/0x30
+  [49904.231788]  [<ffffffff815dff36>] SyS_getsockopt+0xa6/0xc0
+  [49904.233267]  [<ffffffff8171b9ae>] entry_SYSCALL_64_fastpath+0x12/0x71
+
+The underlying issue is the very same as in commit b382c0865600
+("sock, diag: fix panic in sock_diag_put_filterinfo"), that is,
+native eBPF programs don't store an original program since this
+is only needed in cBPF ones.
+
+However, sk_get_filter() wasn't updated to test for this at the
+time when eBPF could be attached. Just throw an error to the user
+to indicate that eBPF cannot be dumped over this interface.
+That way, it can also be known that a program _is_ attached (as
+opposed to just return 0), and a different (future) method needs
+to be consulted for a dump.
+
+Fixes: 89aa075832b0 ("net: sock: allow eBPF programs to be attached to sockets")
+Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
+Acked-by: Alexei Starovoitov <ast@plumgrid.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/filter.c |    6 +++++-
+ 1 file changed, 5 insertions(+), 1 deletion(-)
+
+--- a/net/core/filter.c
+++ b/net/core/filter.c
+@@ -1701,9 +1701,13 @@ int sk_get_filter(struct sock *sk, struc
+ 		goto out;
+ 
+ 	/* We're copying the filter that has been originally attached,
+-	 * so no conversion/decode needed anymore.
+	 * so no conversion/decode needed anymore. eBPF programs that
+	 * have no original program cannot be dumped through this.
+ 	 */
+	ret = -EACCES;
+ 	fprog = filter->prog->orig_prog;
+	if (!fprog)
+		goto out;
+ 
+ 	ret = fprog->len;
+ 	if (!len)
@@ -0,0 +1,57 @@
+From 8eb934591f8bf584969454a658f629cd06e59f3a Mon Sep 17 00:00:00 2001
+From: David Sterba <dsterba@suse.com>
+Date: Mon, 12 Oct 2015 16:55:54 +0200
+Subject: btrfs: check unsupported filters in balance arguments
+
+From: David Sterba <dsterba@suse.com>
+
+commit 8eb934591f8bf584969454a658f629cd06e59f3a upstream.
+
+We don't verify that all the balance filter arguments supplemented by
+the flags are actually known to the kernel. Thus we let it silently pass
+and do nothing.
+
+At the moment this means only the 'limit' filter, but we're going to add
+a few more soon so it's better to have that fixed. Also in older stable
+kernels so that it works with newer userspace tools.
+
+Signed-off-by: David Sterba <dsterba@suse.com>
+Signed-off-by: Chris Mason <clm@fb.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/btrfs/ioctl.c   |    5 +++++
+ fs/btrfs/volumes.h |    8 ++++++++
+ 2 files changed, 13 insertions(+)
+
+--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
+@@ -4647,6 +4647,11 @@ locked:
+ 		bctl->flags |= BTRFS_BALANCE_TYPE_MASK;
+ 	}
+ 
+	if (bctl->flags & ~(BTRFS_BALANCE_ARGS_MASK | BTRFS_BALANCE_TYPE_MASK)) {
+		ret = -EINVAL;
+		goto out_bargs;
+	}
+
+ do_balance:
+ 	/*
+ 	 * Ownership of bctl and mutually_exclusive_operation_running
+--- a/fs/btrfs/volumes.h
+++ b/fs/btrfs/volumes.h
+@@ -376,6 +376,14 @@ struct map_lookup {
+ #define BTRFS_BALANCE_ARGS_VRANGE	(1ULL << 4)
+ #define BTRFS_BALANCE_ARGS_LIMIT	(1ULL << 5)
+ 
+#define BTRFS_BALANCE_ARGS_MASK			\
+	(BTRFS_BALANCE_ARGS_PROFILES |		\
+	 BTRFS_BALANCE_ARGS_USAGE |		\
+	 BTRFS_BALANCE_ARGS_DEVID | 		\
+	 BTRFS_BALANCE_ARGS_DRANGE |		\
+	 BTRFS_BALANCE_ARGS_VRANGE |		\
+	 BTRFS_BALANCE_ARGS_LIMIT)
+
+ /*
+  * Profile changing flags.  When SOFT is set we won't relocate chunk if
+  * it already has the target profile (even though it may be
@@ -0,0 +1,61 @@
+From dc6c5fb3b514221f2e9d21ee626a9d95d3418dff Mon Sep 17 00:00:00 2001
+From: Chris Mason <clm@fb.com>
+Date: Tue, 13 Oct 2015 14:06:48 -0400
+Subject: btrfs: fix use after free iterating extrefs
+
+From: Chris Mason <clm@fb.com>
+
+commit dc6c5fb3b514221f2e9d21ee626a9d95d3418dff upstream.
+
+The code for btrfs inode-resolve has never worked properly for
+files with enough hard links to trigger extrefs.  It was trying to
+get the leaf out of a path after freeing the path:
+
+	btrfs_release_path(path);
+	leaf = path->nodes[0];
+	item_size = btrfs_item_size_nr(leaf, slot);
+
+The fix here is to use the extent buffer we cloned just a little higher
+up to avoid deadlocks caused by using the leaf in the path.
+
+Signed-off-by: Chris Mason <clm@fb.com>
+cc: Mark Fasheh <mfasheh@suse.de>
+Reviewed-by: Filipe Manana <fdmanana@suse.com>
+Reviewed-by: Mark Fasheh <mfasheh@suse.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/btrfs/backref.c |    8 +++-----
+ 1 file changed, 3 insertions(+), 5 deletions(-)
+
+--- a/fs/btrfs/backref.c
+++ b/fs/btrfs/backref.c
+@@ -1809,7 +1809,6 @@ static int iterate_inode_extrefs(u64 inu
+ 	int found = 0;
+ 	struct extent_buffer *eb;
+ 	struct btrfs_inode_extref *extref;
+-	struct extent_buffer *leaf;
+ 	u32 item_size;
+ 	u32 cur_offset;
+ 	unsigned long ptr;
+@@ -1837,9 +1836,8 @@ static int iterate_inode_extrefs(u64 inu
+ 		btrfs_set_lock_blocking_rw(eb, BTRFS_READ_LOCK);
+ 		btrfs_release_path(path);
+ 
+-		leaf = path->nodes[0];
+-		item_size = btrfs_item_size_nr(leaf, slot);
+-		ptr = btrfs_item_ptr_offset(leaf, slot);
+		item_size = btrfs_item_size_nr(eb, slot);
+		ptr = btrfs_item_ptr_offset(eb, slot);
+ 		cur_offset = 0;
+ 
+ 		while (cur_offset < item_size) {
+@@ -1853,7 +1851,7 @@ static int iterate_inode_extrefs(u64 inu
+ 			if (ret)
+ 				break;
+ 
+-			cur_offset += btrfs_inode_extref_name_len(leaf, extref);
+			cur_offset += btrfs_inode_extref_name_len(eb, extref);
+ 			cur_offset += sizeof(*extref);
+ 		}
+ 		btrfs_tree_read_unlock_blocking(eb);
@@ -0,0 +1,37 @@
+From 8996eafdcbad149ac0f772fb1649fbb75c482a6a Mon Sep 17 00:00:00 2001
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+Date: Fri, 9 Oct 2015 20:43:33 +0100
+Subject: crypto: ahash - ensure statesize is non-zero
+
+From: Russell King <rmk+kernel@arm.linux.org.uk>
+
+commit 8996eafdcbad149ac0f772fb1649fbb75c482a6a upstream.
+
+Unlike shash algorithms, ahash drivers must implement export
+and import as their descriptors may contain hardware state and
+cannot be exported as is.  Unfortunately some ahash drivers did
+not provide them and end up causing crashes with algif_hash.
+
+This patch adds a check to prevent these drivers from registering
+ahash algorithms until they are fixed.
+
+Signed-off-by: Russell King <rmk+kernel@arm.linux.org.uk>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ crypto/ahash.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/crypto/ahash.c
+++ b/crypto/ahash.c
+@@ -544,7 +544,8 @@ static int ahash_prepare_alg(struct ahas
+ 	struct crypto_alg *base = &alg->halg.base;
+ 
+ 	if (alg->halg.digestsize > PAGE_SIZE / 8 ||
+-	    alg->halg.statesize > PAGE_SIZE / 8)
+	    alg->halg.statesize > PAGE_SIZE / 8 ||
+	    alg->halg.statesize == 0)
+ 		return -EINVAL;
+ 
+ 	base->cra_type = &crypto_ahash_type;
@@ -0,0 +1,42 @@
+From 92b279070dd6c94265db32748bbeb5b583588de9 Mon Sep 17 00:00:00 2001
+From: Ben Hutchings <ben@decadent.org.uk>
+Date: Tue, 6 Oct 2015 12:31:33 +0100
+Subject: crypto: camellia_aesni_avx - Fix CPU feature checks
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Ben Hutchings <ben@decadent.org.uk>
+
+commit 92b279070dd6c94265db32748bbeb5b583588de9 upstream.
+
+We need to explicitly check the AVX and AES CPU features, as we can't
+infer them from the related XSAVE feature flags.  For example, the
+Core i3 2310M passes the XSAVE feature test but does not implement
+AES-NI.
+
+Reported-and-tested-by: Stéphane Glondu <glondu@debian.org>
+References: https://bugs.debian.org/800934
+Fixes: ce4f5f9b65ae ("x86/fpu, crypto x86/camellia_aesni_avx: Simplify...")
+Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/crypto/camellia_aesni_avx_glue.c |    5 +++++
+ 1 file changed, 5 insertions(+)
+
+--- a/arch/x86/crypto/camellia_aesni_avx_glue.c
+++ b/arch/x86/crypto/camellia_aesni_avx_glue.c
+@@ -554,6 +554,11 @@ static int __init camellia_aesni_init(vo
+ {
+ 	const char *feature_name;
+ 
+	if (!cpu_has_avx || !cpu_has_aes || !cpu_has_osxsave) {
+		pr_info("AVX or AES-NI instructions are not detected.\n");
+		return -ENODEV;
+	}
+
+ 	if (!cpu_has_xfeatures(XSTATE_SSE | XSTATE_YMM, &feature_name)) {
+ 		pr_info("CPU feature '%s' is not supported.\n", feature_name);
+ 		return -ENODEV;
@@ -0,0 +1,68 @@
+From a66d7f724a96d6fd279bfbd2ee488def6b081bea Mon Sep 17 00:00:00 2001
+From: Dave Kleikamp <dave.kleikamp@oracle.com>
+Date: Mon, 5 Oct 2015 10:08:51 -0500
+Subject: crypto: sparc - initialize blkcipher.ivsize
+
+From: Dave Kleikamp <dave.kleikamp@oracle.com>
+
+commit a66d7f724a96d6fd279bfbd2ee488def6b081bea upstream.
+
+Some of the crypto algorithms write to the initialization vector,
+but no space has been allocated for it. This clobbers adjacent memory.
+
+Signed-off-by: Dave Kleikamp <dave.kleikamp@oracle.com>
+Signed-off-by: Herbert Xu <herbert@gondor.apana.org.au>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/sparc/crypto/aes_glue.c      |    2 ++
+ arch/sparc/crypto/camellia_glue.c |    1 +
+ arch/sparc/crypto/des_glue.c      |    2 ++
+ 3 files changed, 5 insertions(+)
+
+--- a/arch/sparc/crypto/aes_glue.c
+++ b/arch/sparc/crypto/aes_glue.c
+@@ -433,6 +433,7 @@ static struct crypto_alg algs[] = { {
+ 		.blkcipher = {
+ 			.min_keysize	= AES_MIN_KEY_SIZE,
+ 			.max_keysize	= AES_MAX_KEY_SIZE,
+			.ivsize		= AES_BLOCK_SIZE,
+ 			.setkey		= aes_set_key,
+ 			.encrypt	= cbc_encrypt,
+ 			.decrypt	= cbc_decrypt,
+@@ -452,6 +453,7 @@ static struct crypto_alg algs[] = { {
+ 		.blkcipher = {
+ 			.min_keysize	= AES_MIN_KEY_SIZE,
+ 			.max_keysize	= AES_MAX_KEY_SIZE,
+			.ivsize		= AES_BLOCK_SIZE,
+ 			.setkey		= aes_set_key,
+ 			.encrypt	= ctr_crypt,
+ 			.decrypt	= ctr_crypt,
+--- a/arch/sparc/crypto/camellia_glue.c
+++ b/arch/sparc/crypto/camellia_glue.c
+@@ -274,6 +274,7 @@ static struct crypto_alg algs[] = { {
+ 		.blkcipher = {
+ 			.min_keysize	= CAMELLIA_MIN_KEY_SIZE,
+ 			.max_keysize	= CAMELLIA_MAX_KEY_SIZE,
+			.ivsize		= CAMELLIA_BLOCK_SIZE,
+ 			.setkey		= camellia_set_key,
+ 			.encrypt	= cbc_encrypt,
+ 			.decrypt	= cbc_decrypt,
+--- a/arch/sparc/crypto/des_glue.c
+++ b/arch/sparc/crypto/des_glue.c
+@@ -429,6 +429,7 @@ static struct crypto_alg algs[] = { {
+ 		.blkcipher = {
+ 			.min_keysize	= DES_KEY_SIZE,
+ 			.max_keysize	= DES_KEY_SIZE,
+			.ivsize		= DES_BLOCK_SIZE,
+ 			.setkey		= des_set_key,
+ 			.encrypt	= cbc_encrypt,
+ 			.decrypt	= cbc_decrypt,
+@@ -485,6 +486,7 @@ static struct crypto_alg algs[] = { {
+ 		.blkcipher = {
+ 			.min_keysize	= DES3_EDE_KEY_SIZE,
+ 			.max_keysize	= DES3_EDE_KEY_SIZE,
+			.ivsize		= DES3_EDE_BLOCK_SIZE,
+ 			.setkey		= des3_ede_set_key,
+ 			.encrypt	= cbc3_encrypt,
+ 			.decrypt	= cbc3_decrypt,
@@ -0,0 +1,72 @@
+From 621bd0f6982badd6483acb191eb7b6226a578328 Mon Sep 17 00:00:00 2001
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+Date: Tue, 29 Sep 2015 09:56:53 +0200
+Subject: drm: Fix locking for sysfs dpms file
+
+From: Daniel Vetter <daniel.vetter@ffwll.ch>
+
+commit 621bd0f6982badd6483acb191eb7b6226a578328 upstream.
+
+With atomic drivers we need to make sure that (at least in general)
+property reads hold the right locks. But the legacy dpms property is
+special and can be read locklessly. Since userspace loves to just
+randomly look at that all the time (like with "status") do that.
+
+To make it clear that we play tricks use the READ_ONCE compiler
+barrier (and also for paranoia).
+
+Note that there's not really anything bad going on since even with the
+new atomic paths we eventually end up not chasing any pointers (and
+hence possibly freed memory and other fun stuff). The locking WARNING
+has been added in
+
+commit 88a48e297b3a3bac6022c03babfb038f1a886cea
+Author: Rob Clark <robdclark@gmail.com>
+Date:   Thu Dec 18 16:01:50 2014 -0500
+
+    drm: add atomic properties
+
+but since drivers are converting not everyone will have seen this from
+the start.
+
+Jens reported this and submitted a patch to just grab the
+mode_config.connection_mutex, but we can do a bit better.
+
+v2: Remove unused variables I failed to git add for real.
+
+Reference: http://mid.gmane.org/20150928194822.GA3930@kernel.dk
+Reported-by: Jens Axboe <axboe@fb.com>
+Tested-by: Jens Axboe <axboe@fb.com>
+Cc: Rob Clark <robdclark@gmail.com>
+Signed-off-by: Daniel Vetter <daniel.vetter@intel.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/drm_sysfs.c |   12 +++---------
+ 1 file changed, 3 insertions(+), 9 deletions(-)
+
+--- a/drivers/gpu/drm/drm_sysfs.c
+++ b/drivers/gpu/drm/drm_sysfs.c
+@@ -235,18 +235,12 @@ static ssize_t dpms_show(struct device *
+ 			   char *buf)
+ {
+ 	struct drm_connector *connector = to_drm_connector(device);
+-	struct drm_device *dev = connector->dev;
+-	uint64_t dpms_status;
+-	int ret;
+	int dpms;
+ 
+-	ret = drm_object_property_get_value(&connector->base,
+-					    dev->mode_config.dpms_property,
+-					    &dpms_status);
+-	if (ret)
+-		return 0;
+	dpms = READ_ONCE(connector->dpms);
+ 
+ 	return snprintf(buf, PAGE_SIZE, "%s\n",
+-			drm_get_dpms_name((int)dpms_status));
+			drm_get_dpms_name(dpms));
+ }
+ 
+ static ssize_t enabled_show(struct device *device,
@@ -0,0 +1,65 @@
+From f231976c2e8964ceaa9250e57d27c35ff03825c2 Mon Sep 17 00:00:00 2001
+From: Ben Skeggs <bskeggs@redhat.com>
+Date: Fri, 2 Oct 2015 14:03:19 +1000
+Subject: drm/nouveau/fbcon: take runpm reference when userspace has an open fd
+
+From: Ben Skeggs <bskeggs@redhat.com>
+
+commit f231976c2e8964ceaa9250e57d27c35ff03825c2 upstream.
+
+We need to do this in order to prevent accesses to the device while it's
+powered down.  Userspace may have an mmap of the fb, and there's no good
+way (that I know of) to prevent it from touching the device otherwise.
+
+This fixes some nasty races between runpm and plymouth on some systems,
+which result in the GPU getting very upset and hanging the boot.
+
+Signed-off-by: Ben Skeggs <bskeggs@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/nouveau/nouveau_fbcon.c |   24 ++++++++++++++++++++++++
+ 1 file changed, 24 insertions(+)
+
+--- a/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+++ b/drivers/gpu/drm/nouveau/nouveau_fbcon.c
+@@ -178,8 +178,30 @@ nouveau_fbcon_sync(struct fb_info *info)
+ 	return 0;
+ }
+ 
+static int
+nouveau_fbcon_open(struct fb_info *info, int user)
+{
+	struct nouveau_fbdev *fbcon = info->par;
+	struct nouveau_drm *drm = nouveau_drm(fbcon->dev);
+	int ret = pm_runtime_get_sync(drm->dev->dev);
+	if (ret < 0 && ret != -EACCES)
+		return ret;
+	return 0;
+}
+
+static int
+nouveau_fbcon_release(struct fb_info *info, int user)
+{
+	struct nouveau_fbdev *fbcon = info->par;
+	struct nouveau_drm *drm = nouveau_drm(fbcon->dev);
+	pm_runtime_put(drm->dev->dev);
+	return 0;
+}
+
+ static struct fb_ops nouveau_fbcon_ops = {
+ 	.owner = THIS_MODULE,
+	.fb_open = nouveau_fbcon_open,
+	.fb_release = nouveau_fbcon_release,
+ 	.fb_check_var = drm_fb_helper_check_var,
+ 	.fb_set_par = drm_fb_helper_set_par,
+ 	.fb_fillrect = nouveau_fbcon_fillrect,
+@@ -195,6 +217,8 @@ static struct fb_ops nouveau_fbcon_ops =
+ 
+ static struct fb_ops nouveau_fbcon_sw_ops = {
+ 	.owner = THIS_MODULE,
+	.fb_open = nouveau_fbcon_open,
+	.fb_release = nouveau_fbcon_release,
+ 	.fb_check_var = drm_fb_helper_check_var,
+ 	.fb_set_par = drm_fb_helper_set_par,
+ 	.fb_fillrect = cfb_fillrect,
@@ -0,0 +1,50 @@
+From 60906529bec506a4bde93f04eb5e7a9dd9c42a3b Mon Sep 17 00:00:00 2001
+From: Gerd Hoffmann <kraxel@redhat.com>
+Date: Mon, 5 Oct 2015 12:20:26 +0200
+Subject: drm/qxl: fix framebuffer dirty rectangle tracking.
+
+From: Gerd Hoffmann <kraxel@redhat.com>
+
+commit 60906529bec506a4bde93f04eb5e7a9dd9c42a3b upstream.
+
+Commit "c0fe07a drm/qxl: rewrite framebuffer support" has a bug in the
+dirty rectangle tracking:  Instead of ignoring an empty dirty rectangle
+when adding a new dirty region the dirty region gets extended to the
+upper left corner.  Fix it.
+
+Signed-off-by: Gerd Hoffmann <kraxel@redhat.com>
+Signed-off-by: Dave Airlie <airlied@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/gpu/drm/qxl/qxl_fb.c |   19 +++++++++++--------
+ 1 file changed, 11 insertions(+), 8 deletions(-)
+
+--- a/drivers/gpu/drm/qxl/qxl_fb.c
+++ b/drivers/gpu/drm/qxl/qxl_fb.c
+@@ -144,14 +144,17 @@ static void qxl_dirty_update(struct qxl_
+ 
+ 	spin_lock_irqsave(&qfbdev->dirty.lock, flags);
+ 
+-	if (qfbdev->dirty.y1 < y)
+-		y = qfbdev->dirty.y1;
+-	if (qfbdev->dirty.y2 > y2)
+-		y2 = qfbdev->dirty.y2;
+-	if (qfbdev->dirty.x1 < x)
+-		x = qfbdev->dirty.x1;
+-	if (qfbdev->dirty.x2 > x2)
+-		x2 = qfbdev->dirty.x2;
+	if ((qfbdev->dirty.y2 - qfbdev->dirty.y1) &&
+	    (qfbdev->dirty.x2 - qfbdev->dirty.x1)) {
+		if (qfbdev->dirty.y1 < y)
+			y = qfbdev->dirty.y1;
+		if (qfbdev->dirty.y2 > y2)
+			y2 = qfbdev->dirty.y2;
+		if (qfbdev->dirty.x1 < x)
+			x = qfbdev->dirty.x1;
+		if (qfbdev->dirty.x2 > x2)
+			x2 = qfbdev->dirty.x2;
+	}
+ 
+ 	qfbdev->dirty.x1 = x;
+ 	qfbdev->dirty.x2 = x2;
@@ -0,0 +1,33 @@
+From foo@baz Thu Oct 22 17:25:24 PDT 2015
+From: Joe Perches <joe@perches.com>
+Date: Wed, 14 Oct 2015 01:09:40 -0700
+Subject: ethtool: Use kcalloc instead of kmalloc for ethtool_get_strings
+
+From: Joe Perches <joe@perches.com>
+
+[ Upstream commit 077cb37fcf6f00a45f375161200b5ee0cd4e937b ]
+
+It seems that kernel memory can leak into userspace by a
+kmalloc, ethtool_get_strings, then copy_to_user sequence.
+
+Avoid this by using kcalloc to zero fill the copied buffer.
+
+Signed-off-by: Joe Perches <joe@perches.com>
+Acked-by: Ben Hutchings <ben@decadent.org.uk>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/core/ethtool.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/net/core/ethtool.c
+++ b/net/core/ethtool.c
+@@ -1284,7 +1284,7 @@ static int ethtool_get_strings(struct ne
+ 
+ 	gstrings.len = ret;
+ 
+-	data = kmalloc(gstrings.len * ETH_GSTRING_LEN, GFP_USER);
+	data = kcalloc(gstrings.len, ETH_GSTRING_LEN, GFP_USER);
+ 	if (!data)
+ 		return -ENOMEM;
+ 
@@ -0,0 +1,108 @@
+From 56d4b8a24cef5d66f0d10ac778a520d3c2c68a48 Mon Sep 17 00:00:00 2001
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+Date: Thu, 24 Sep 2015 12:06:54 +0300
+Subject: i2c: designware: Do not use parameters from ACPI on Dell Inspiron 7348
+
+From: Mika Westerberg <mika.westerberg@linux.intel.com>
+
+commit 56d4b8a24cef5d66f0d10ac778a520d3c2c68a48 upstream.
+
+ACPI SSCN/FMCN methods were originally added because then the platform can
+provide the most accurate HCNT/LCNT values to the driver. However, this
+seems not to be true for Dell Inspiron 7348 where using these causes the
+touchpad to fail in boot:
+
+  i2c_hid i2c-DLL0675:00: failed to retrieve report from device.
+  i2c_designware INT3433:00: i2c_dw_handle_tx_abort: lost arbitration
+  i2c_hid i2c-DLL0675:00: failed to retrieve report from device.
+  i2c_designware INT3433:00: controller timed out
+
+The values received from ACPI are (in fast mode):
+
+  HCNT: 72
+  LCNT: 160
+
+this translates to following timings (input clock is 100MHz on Broadwell):
+
+  tHIGH: 720 ns (spec min 600 ns)
+  tLOW: 1600 ns (spec min 1300 ns)
+  Bus period: 2920 ns (assuming 300 ns tf and tr)
+  Bus speed: 342.5 kHz
+
+Both tHIGH and tLOW are within the I2C specification.
+
+The calculated values when ACPI parameters are not used are (in fast mode):
+
+  HCNT: 87
+  LCNT: 159
+
+which translates to:
+
+  tHIGH: 870 ns (spec min 600 ns)
+  tLOW: 1590 ns (spec min 1300 ns)
+  Bus period 3060 ns (assuming 300 ns tf and tr)
+  Bus speed 326.8 kHz
+
+These values are also within the I2C specification.
+
+Since both ACPI and calculated values meet the I2C specification timing
+requirements it is hard to say why the touchpad does not function properly
+with the ACPI values except that the bus speed is higher in this case (but
+still well below the max 400kHz).
+
+Solve this by adding DMI quirk to the driver that disables using ACPI
+parameters on this particulare machine.
+
+Reported-by: Pavel Roskin <plroskin@gmail.com>
+Signed-off-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Tested-by: Pavel Roskin <plroskin@gmail.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-designware-platdrv.c |   20 ++++++++++++++++++++
+ 1 file changed, 20 insertions(+)
+
+--- a/drivers/i2c/busses/i2c-designware-platdrv.c
+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
+@@ -24,6 +24,7 @@
+ #include <linux/kernel.h>
+ #include <linux/module.h>
+ #include <linux/delay.h>
+#include <linux/dmi.h>
+ #include <linux/i2c.h>
+ #include <linux/clk.h>
+ #include <linux/clk-provider.h>
+@@ -51,6 +52,22 @@ static u32 i2c_dw_get_clk_rate_khz(struc
+ }
+ 
+ #ifdef CONFIG_ACPI
+/*
+ * The HCNT/LCNT information coming from ACPI should be the most accurate
+ * for given platform. However, some systems get it wrong. On such systems
+ * we get better results by calculating those based on the input clock.
+ */
+static const struct dmi_system_id dw_i2c_no_acpi_params[] = {
+	{
+		.ident = "Dell Inspiron 7348",
+		.matches = {
+			DMI_MATCH(DMI_SYS_VENDOR, "Dell Inc."),
+			DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 7348"),
+		},
+	},
+	{ }
+};
+
+ static void dw_i2c_acpi_params(struct platform_device *pdev, char method[],
+ 			       u16 *hcnt, u16 *lcnt, u32 *sda_hold)
+ {
+@@ -58,6 +75,9 @@ static void dw_i2c_acpi_params(struct pl
+ 	acpi_handle handle = ACPI_HANDLE(&pdev->dev);
+ 	union acpi_object *obj;
+ 
+	if (dmi_check_system(dw_i2c_no_acpi_params))
+		return;
+
+ 	if (ACPI_FAILURE(acpi_evaluate_object(handle, method, NULL, &buf)))
+ 		return;
+ 
@@ -0,0 +1,51 @@
+From 36d48fb5766aee9717e429f772046696b215282d Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Date: Fri, 9 Oct 2015 10:39:24 +0100
+Subject: i2c: designware-platdrv: enable RuntimePM before registering to the core
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+commit 36d48fb5766aee9717e429f772046696b215282d upstream.
+
+The core may register clients attached to this master which may use
+funtionality from the master. So, RuntimePM must be enabled before, otherwise
+this will fail.
+
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Acked-by: Mika Westerberg <mika.westerberg@linux.intel.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-designware-platdrv.c |   13 +++++++------
+ 1 file changed, 7 insertions(+), 6 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-designware-platdrv.c
+++ b/drivers/i2c/busses/i2c-designware-platdrv.c
+@@ -273,12 +273,6 @@ static int dw_i2c_probe(struct platform_
+ 	adap->dev.parent = &pdev->dev;
+ 	adap->dev.of_node = pdev->dev.of_node;
+ 
+-	r = i2c_add_numbered_adapter(adap);
+-	if (r) {
+-		dev_err(&pdev->dev, "failure adding adapter\n");
+-		return r;
+-	}
+-
+ 	if (dev->pm_runtime_disabled) {
+ 		pm_runtime_forbid(&pdev->dev);
+ 	} else {
+@@ -288,6 +282,13 @@ static int dw_i2c_probe(struct platform_
+ 		pm_runtime_enable(&pdev->dev);
+ 	}
+ 
+	r = i2c_add_numbered_adapter(adap);
+	if (r) {
+		dev_err(&pdev->dev, "failure adding adapter\n");
+		pm_runtime_disable(&pdev->dev);
+		return r;
+	}
+
+ 	return 0;
+ }
+ 
@@ -0,0 +1,44 @@
+From 4f7effddf4549d57114289f273710f077c4c330a Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Date: Fri, 9 Oct 2015 10:39:25 +0100
+Subject: i2c: rcar: enable RuntimePM before registering to the core
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+commit 4f7effddf4549d57114289f273710f077c4c330a upstream.
+
+The core may register clients attached to this master which may use
+funtionality from the master. So, RuntimePM must be enabled before, otherwise
+this will fail. While here, move drvdata, too.
+
+Reported-by: Geert Uytterhoeven <geert+renesas@glider.be>
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-rcar.c |    7 ++++---
+ 1 file changed, 4 insertions(+), 3 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-rcar.c
+++ b/drivers/i2c/busses/i2c-rcar.c
+@@ -690,15 +690,16 @@ static int rcar_i2c_probe(struct platfor
+ 		return ret;
+ 	}
+ 
+	pm_runtime_enable(dev);
+	platform_set_drvdata(pdev, priv);
+
+ 	ret = i2c_add_numbered_adapter(adap);
+ 	if (ret < 0) {
+ 		dev_err(dev, "reg adap failed: %d\n", ret);
+		pm_runtime_disable(dev);
+ 		return ret;
+ 	}
+ 
+-	pm_runtime_enable(dev);
+-	platform_set_drvdata(pdev, priv);
+-
+ 	dev_info(dev, "probed\n");
+ 
+ 	return 0;
@@ -0,0 +1,48 @@
+From eadd709f5d2e8aebb1b7bf49460e97a68d81a9b0 Mon Sep 17 00:00:00 2001
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Date: Sat, 10 Oct 2015 08:24:23 +0100
+Subject: i2c: s3c2410: enable RuntimePM before registering to the core
+
+From: Wolfram Sang <wsa+renesas@sang-engineering.com>
+
+commit eadd709f5d2e8aebb1b7bf49460e97a68d81a9b0 upstream.
+
+The core may register clients attached to this master which may use
+funtionality from the master. So, RuntimePM must be enabled before, otherwise
+this will fail. While here, move drvdata, too.
+
+Signed-off-by: Wolfram Sang <wsa+renesas@sang-engineering.com>
+Tested-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Acked-by: Kukjin Kim <kgene@kernel.org>
+Signed-off-by: Wolfram Sang <wsa@the-dreams.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/i2c/busses/i2c-s3c2410.c |    8 +++++---
+ 1 file changed, 5 insertions(+), 3 deletions(-)
+
+--- a/drivers/i2c/busses/i2c-s3c2410.c
+++ b/drivers/i2c/busses/i2c-s3c2410.c
+@@ -1243,17 +1243,19 @@ static int s3c24xx_i2c_probe(struct plat
+ 	i2c->adap.nr = i2c->pdata->bus_num;
+ 	i2c->adap.dev.of_node = pdev->dev.of_node;
+ 
+	platform_set_drvdata(pdev, i2c);
+
+	pm_runtime_enable(&pdev->dev);
+
+ 	ret = i2c_add_numbered_adapter(&i2c->adap);
+ 	if (ret < 0) {
+ 		dev_err(&pdev->dev, "failed to add bus to i2c core\n");
+		pm_runtime_disable(&pdev->dev);
+ 		s3c24xx_i2c_deregister_cpufreq(i2c);
+ 		clk_unprepare(i2c->clk);
+ 		return ret;
+ 	}
+ 
+-	platform_set_drvdata(pdev, i2c);
+-
+-	pm_runtime_enable(&pdev->dev);
+ 	pm_runtime_enable(&i2c->adap.dev);
+ 
+ 	dev_info(&pdev->dev, "%s: S3C I2C adapter\n", dev_name(&i2c->adap.dev));
@@ -0,0 +1,64 @@
+From foo@baz Thu Oct 22 17:25:24 PDT 2015
+From: Eric Dumazet <edumazet@google.com>
+Date: Thu, 1 Oct 2015 05:39:26 -0700
+Subject: inet: fix race in reqsk_queue_unlink()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 2306c704ce280c97a60d1f45333b822b40281dea ]
+
+reqsk_timer_handler() tests if icsk_accept_queue.listen_opt
+is NULL at its beginning.
+
+By the time it calls inet_csk_reqsk_queue_drop() and
+reqsk_queue_unlink(), listener might have been closed and
+inet_csk_listen_stop() had called reqsk_queue_yank_acceptq()
+which sets icsk_accept_queue.listen_opt to NULL
+
+We therefore need to correctly check listen_opt being NULL
+after holding syn_wait_lock for proper synchronization.
+
+Fixes: fa76ce7328b2 ("inet: get rid of central tcp/dccp listener timer")
+Fixes: b357a364c57c ("inet: fix possible panic in reqsk_queue_unlink()")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Yuchung Cheng <ycheng@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/inet_connection_sock.c |   19 ++++++++++---------
+ 1 file changed, 10 insertions(+), 9 deletions(-)
+
+--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
+@@ -577,21 +577,22 @@ EXPORT_SYMBOL(inet_rtx_syn_ack);
+ static bool reqsk_queue_unlink(struct request_sock_queue *queue,
+ 			       struct request_sock *req)
+ {
+-	struct listen_sock *lopt = queue->listen_opt;
+ 	struct request_sock **prev;
+	struct listen_sock *lopt;
+ 	bool found = false;
+ 
+ 	spin_lock(&queue->syn_wait_lock);
+-
+-	for (prev = &lopt->syn_table[req->rsk_hash]; *prev != NULL;
+-	     prev = &(*prev)->dl_next) {
+-		if (*prev == req) {
+-			*prev = req->dl_next;
+-			found = true;
+-			break;
+	lopt = queue->listen_opt;
+	if (lopt) {
+		for (prev = &lopt->syn_table[req->rsk_hash]; *prev != NULL;
+		     prev = &(*prev)->dl_next) {
+			if (*prev == req) {
+				*prev = req->dl_next;
+				found = true;
+				break;
+			}
+ 		}
+ 	}
+-
+ 	spin_unlock(&queue->syn_wait_lock);
+ 	if (timer_pending(&req->rsk_timer) && del_timer_sync(&req->rsk_timer))
+ 		reqsk_put(req);
@@ -0,0 +1,52 @@
+From foo@baz Thu Oct 22 17:25:24 PDT 2015
+From: Eric Dumazet <edumazet@google.com>
+Date: Sat, 19 Sep 2015 09:48:04 -0700
+Subject: inet: fix races in reqsk_queue_hash_req()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit 29c6852602e259d2c1882f320b29d5c3fec0de04 ]
+
+Before allowing lockless LISTEN processing, we need to make
+sure to arm the SYN_RECV timer before the req socket is visible
+in hash tables.
+
+Also, req->rsk_hash should be written before we set rsk_refcnt
+to a non zero value.
+
+Fixes: fa76ce7328b2 ("inet: get rid of central tcp/dccp listener timer")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Cc: Ying Cai <ycai@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv4/inet_connection_sock.c |    8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/net/ipv4/inet_connection_sock.c
+++ b/net/ipv4/inet_connection_sock.c
+@@ -685,20 +685,20 @@ void reqsk_queue_hash_req(struct request
+ 	req->num_timeout = 0;
+ 	req->sk = NULL;
+ 
+	setup_timer(&req->rsk_timer, reqsk_timer_handler, (unsigned long)req);
+	mod_timer_pinned(&req->rsk_timer, jiffies + timeout);
+	req->rsk_hash = hash;
+
+ 	/* before letting lookups find us, make sure all req fields
+ 	 * are committed to memory and refcnt initialized.
+ 	 */
+ 	smp_wmb();
+ 	atomic_set(&req->rsk_refcnt, 2);
+-	setup_timer(&req->rsk_timer, reqsk_timer_handler, (unsigned long)req);
+-	req->rsk_hash = hash;
+ 
+ 	spin_lock(&queue->syn_wait_lock);
+ 	req->dl_next = lopt->syn_table[hash];
+ 	lopt->syn_table[hash] = req;
+ 	spin_unlock(&queue->syn_wait_lock);
+-
+-	mod_timer_pinned(&req->rsk_timer, jiffies + timeout);
+ }
+ EXPORT_SYMBOL(reqsk_queue_hash_req);
+ 
@@ -0,0 +1,72 @@
+From foo@baz Thu Oct 22 17:25:24 PDT 2015
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+Date: Mon, 12 Oct 2015 11:02:08 -0500
+Subject: ipv6: Don't call with rt6_uncached_list_flush_dev
+
+From: "Eric W. Biederman" <ebiederm@xmission.com>
+
+[ Upstream commit e332bc67cf5e5e5b71a1aec9750d0791aac65183 ]
+
+As originally written rt6_uncached_list_flush_dev makes no sense when
+called with dev == NULL as it attempts to flush all uncached routes
+regardless of network namespace when dev == NULL.  Which is simply
+incorrect behavior.
+
+Furthermore at the point rt6_ifdown is called with dev == NULL no more
+network devices exist in the network namespace so even if the code in
+rt6_uncached_list_flush_dev were to attempt something sensible it
+would be meaningless.
+
+Therefore remove support in rt6_uncached_list_flush_dev for handling
+network devices where dev == NULL, and only call rt6_uncached_list_flush_dev
+ when rt6_ifdown is called with a network device.
+
+Fixes: 8d0b94afdca8 ("ipv6: Keep track of DST_NOCACHE routes in case of iface down/unregister")
+Signed-off-by: "Eric W. Biederman" <ebiederm@xmission.com>
+Reviewed-by: Martin KaFai Lau <kafai@fb.com>
+Tested-by: Martin KaFai Lau <kafai@fb.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/ipv6/route.c |   12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
+@@ -139,6 +139,9 @@ static void rt6_uncached_list_flush_dev(
+ 	struct net_device *loopback_dev = net->loopback_dev;
+ 	int cpu;
+ 
+	if (dev == loopback_dev)
+		return;
+
+ 	for_each_possible_cpu(cpu) {
+ 		struct uncached_list *ul = per_cpu_ptr(&rt6_uncached_list, cpu);
+ 		struct rt6_info *rt;
+@@ -148,14 +151,12 @@ static void rt6_uncached_list_flush_dev(
+ 			struct inet6_dev *rt_idev = rt->rt6i_idev;
+ 			struct net_device *rt_dev = rt->dst.dev;
+ 
+-			if (rt_idev && (rt_idev->dev == dev || !dev) &&
+-			    rt_idev->dev != loopback_dev) {
+			if (rt_idev->dev == dev) {
+ 				rt->rt6i_idev = in6_dev_get(loopback_dev);
+ 				in6_dev_put(rt_idev);
+ 			}
+ 
+-			if (rt_dev && (rt_dev == dev || !dev) &&
+-			    rt_dev != loopback_dev) {
+			if (rt_dev == dev) {
+ 				rt->dst.dev = loopback_dev;
+ 				dev_hold(rt->dst.dev);
+ 				dev_put(rt_dev);
+@@ -2577,7 +2578,8 @@ void rt6_ifdown(struct net *net, struct
+ 
+ 	fib6_clean_all(net, fib6_ifdown, &adn);
+ 	icmp6_clean_all(fib6_ifdown, &adn);
+-	rt6_uncached_list_flush_dev(net, dev);
+	if (dev)
+		rt6_uncached_list_flush_dev(net, dev);
+ }
+ 
+ struct rt6_mtu_change_arg {
@@ -0,0 +1,90 @@
+From 5d9bc648b94dd719022343b8675e6c4381f0c45f Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Tue, 13 Oct 2015 10:18:53 +0200
+Subject: KVM: x86: clean up kvm_arch_vcpu_runnable
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+From: Paolo Bonzini <pbonzini@redhat.com>
+
+commit 5d9bc648b94dd719022343b8675e6c4381f0c45f upstream.
+
+Split the huge conditional in two functions.
+
+Fixes: 64d6067057d9658acb8675afcfba549abdb7fc16
+Reviewed-by: Radim Krčmář <rkrcmar@redhat.com>
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kvm/x86.c |   39 +++++++++++++++++++++++++++++----------
+ 1 file changed, 29 insertions(+), 10 deletions(-)
+
+--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
+@@ -6706,6 +6706,12 @@ static inline int vcpu_block(struct kvm
+ 	return 1;
+ }
+ 
+static inline bool kvm_vcpu_running(struct kvm_vcpu *vcpu)
+{
+	return (vcpu->arch.mp_state == KVM_MP_STATE_RUNNABLE &&
+		!vcpu->arch.apf.halted);
+}
+
+ static int vcpu_run(struct kvm_vcpu *vcpu)
+ {
+ 	int r;
+@@ -6714,8 +6720,7 @@ static int vcpu_run(struct kvm_vcpu *vcp
+ 	vcpu->srcu_idx = srcu_read_lock(&kvm->srcu);
+ 
+ 	for (;;) {
+-		if (vcpu->arch.mp_state == KVM_MP_STATE_RUNNABLE &&
+-		    !vcpu->arch.apf.halted)
+		if (kvm_vcpu_running(vcpu))
+ 			r = vcpu_enter_guest(vcpu);
+ 		else
+ 			r = vcpu_block(kvm, vcpu);
+@@ -8011,19 +8016,33 @@ void kvm_arch_flush_shadow_memslot(struc
+ 	kvm_mmu_invalidate_zap_all_pages(kvm);
+ }
+ 
+static inline bool kvm_vcpu_has_events(struct kvm_vcpu *vcpu)
+{
+	if (!list_empty_careful(&vcpu->async_pf.done))
+		return true;
+
+	if (kvm_apic_has_events(vcpu))
+		return true;
+
+	if (vcpu->arch.pv.pv_unhalted)
+		return true;
+
+	if (atomic_read(&vcpu->arch.nmi_queued))
+		return true;
+
+	if (kvm_arch_interrupt_allowed(vcpu) &&
+	    kvm_cpu_has_interrupt(vcpu))
+		return true;
+
+	return false;
+}
+
+ int kvm_arch_vcpu_runnable(struct kvm_vcpu *vcpu)
+ {
+ 	if (is_guest_mode(vcpu) && kvm_x86_ops->check_nested_events)
+ 		kvm_x86_ops->check_nested_events(vcpu, false);
+ 
+-	return (vcpu->arch.mp_state == KVM_MP_STATE_RUNNABLE &&
+-		!vcpu->arch.apf.halted)
+-		|| !list_empty_careful(&vcpu->async_pf.done)
+-		|| kvm_apic_has_events(vcpu)
+-		|| vcpu->arch.pv.pv_unhalted
+-		|| atomic_read(&vcpu->arch.nmi_queued) ||
+-		(kvm_arch_interrupt_allowed(vcpu) &&
+-		 kvm_cpu_has_interrupt(vcpu));
+	return kvm_vcpu_running(vcpu) || kvm_vcpu_has_events(vcpu);
+ }
+ 
+ int kvm_arch_vcpu_should_kick(struct kvm_vcpu *vcpu)
@@ -0,0 +1,58 @@
+From b10d92a54dac25a6152f1aa1ffc95c12908035ce Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Wed, 14 Oct 2015 15:25:52 +0200
+Subject: KVM: x86: fix RSM into 64-bit protected mode
+
+From: Paolo Bonzini <pbonzini@redhat.com>
+
+commit b10d92a54dac25a6152f1aa1ffc95c12908035ce upstream.
+
+In order to get into 64-bit protected mode, you need to enable
+paging while EFER.LMA=1.  For this to work, CS.L must be 0.
+Currently, we load the segments before CR0 and CR4, which means
+that if RSM returns into 64-bit protected mode CS.L is already 1
+and everything breaks.
+
+Luckily, CS.L=0 is always the case when executing RSM, because it
+is forbidden to execute RSM from 64-bit protected mode.  Hence it
+is enough to load CR0 and CR4 first, and only then the segments.
+
+Fixes: 660a5d517aaab9187f93854425c4c63f4a09195c
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kvm/emulate.c |   10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+--- a/arch/x86/kvm/emulate.c
+++ b/arch/x86/kvm/emulate.c
+@@ -2418,7 +2418,7 @@ static int rsm_load_state_64(struct x86_
+ 	u64 val, cr0, cr4;
+ 	u32 base3;
+ 	u16 selector;
+-	int i;
+	int i, r;
+ 
+ 	for (i = 0; i < 16; i++)
+ 		*reg_write(ctxt, i) = GET_SMSTATE(u64, smbase, 0x7ff8 - i * 8);
+@@ -2460,13 +2460,17 @@ static int rsm_load_state_64(struct x86_
+ 	dt.address =                GET_SMSTATE(u64, smbase, 0x7e68);
+ 	ctxt->ops->set_gdt(ctxt, &dt);
+ 
+	r = rsm_enter_protected_mode(ctxt, cr0, cr4);
+	if (r != X86EMUL_CONTINUE)
+		return r;
+
+ 	for (i = 0; i < 6; i++) {
+-		int r = rsm_load_seg_64(ctxt, smbase, i);
+		r = rsm_load_seg_64(ctxt, smbase, i);
+ 		if (r != X86EMUL_CONTINUE)
+ 			return r;
+ 	}
+ 
+-	return rsm_enter_protected_mode(ctxt, cr0, cr4);
+	return X86EMUL_CONTINUE;
+ }
+ 
+ static int em_rsm(struct x86_emulate_ctxt *ctxt)
@@ -0,0 +1,32 @@
+From 73917739334c6509833b0403b81d4a04a8784bdf Mon Sep 17 00:00:00 2001
+From: Paolo Bonzini <pbonzini@redhat.com>
+Date: Tue, 13 Oct 2015 10:19:35 +0200
+Subject: KVM: x86: fix SMI to halted VCPU
+
+From: Paolo Bonzini <pbonzini@redhat.com>
+
+commit 73917739334c6509833b0403b81d4a04a8784bdf upstream.
+
+An SMI to a halted VCPU must wake it up, hence a VCPU with a pending
+SMI must be considered runnable.
+
+Fixes: 64d6067057d9658acb8675afcfba549abdb7fc16
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ arch/x86/kvm/x86.c |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
+@@ -8030,6 +8030,9 @@ static inline bool kvm_vcpu_has_events(s
+ 	if (atomic_read(&vcpu->arch.nmi_queued))
+ 		return true;
+ 
+	if (test_bit(KVM_REQ_SMI, &vcpu->requests))
+		return true;
+
+ 	if (kvm_arch_interrupt_allowed(vcpu) &&
+ 	    kvm_cpu_has_interrupt(vcpu))
+ 		return true;
@@ -0,0 +1,55 @@
+From foo@baz Thu Oct 22 17:25:24 PDT 2015
+From: Alexander Couzens <lynxis@fe80.eu>
+Date: Mon, 28 Sep 2015 11:32:42 +0200
+Subject: l2tp: protect tunnel->del_work by ref_count
+
+From: Alexander Couzens <lynxis@fe80.eu>
+
+[ Upstream commit 06a15f51cf3618e32a73871ee6a547ef7fd902b5 ]
+
+There is a small chance that tunnel_free() is called before tunnel->del_work scheduled
+resulting in a zero pointer dereference.
+
+Signed-off-by: Alexander Couzens <lynxis@fe80.eu>
+Acked-by: James Chapman <jchapman@katalix.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/l2tp/l2tp_core.c |   11 +++++++++--
+ 1 file changed, 9 insertions(+), 2 deletions(-)
+
+--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
+@@ -1319,7 +1319,7 @@ static void l2tp_tunnel_del_work(struct
+ 	tunnel = container_of(work, struct l2tp_tunnel, del_work);
+ 	sk = l2tp_tunnel_sock_lookup(tunnel);
+ 	if (!sk)
+-		return;
+		goto out;
+ 
+ 	sock = sk->sk_socket;
+ 
+@@ -1341,6 +1341,8 @@ static void l2tp_tunnel_del_work(struct
+ 	}
+ 
+ 	l2tp_tunnel_sock_put(sk);
+out:
+	l2tp_tunnel_dec_refcount(tunnel);
+ }
+ 
+ /* Create a socket for the tunnel, if one isn't set up by
+@@ -1636,8 +1638,13 @@ EXPORT_SYMBOL_GPL(l2tp_tunnel_create);
+  */
+ int l2tp_tunnel_delete(struct l2tp_tunnel *tunnel)
+ {
+	l2tp_tunnel_inc_refcount(tunnel);
+ 	l2tp_tunnel_closeall(tunnel);
+-	return (false == queue_work(l2tp_wq, &tunnel->del_work));
+	if (false == queue_work(l2tp_wq, &tunnel->del_work)) {
+		l2tp_tunnel_dec_refcount(tunnel);
+		return 1;
+	}
+	return 0;
+ }
+ EXPORT_SYMBOL_GPL(l2tp_tunnel_delete);
+ 
@@ -0,0 +1,35 @@
+From 424cdc14138088ada1b0e407a2195b2783c6e5ef Mon Sep 17 00:00:00 2001
+From: Shaohua Li <shli@fb.com>
+Date: Thu, 15 Oct 2015 15:28:29 -0700
+Subject: memcg: convert threshold to bytes
+
+From: Shaohua Li <shli@fb.com>
+
+commit 424cdc14138088ada1b0e407a2195b2783c6e5ef upstream.
+
+page_counter_memparse() returns pages for the threshold, while
+mem_cgroup_usage() returns bytes for memory usage.  Convert the
+threshold to bytes.
+
+Fixes: 3e32cb2e0a12b6915 ("memcg: rename cgroup_event to mem_cgroup_event").
+Signed-off-by: Shaohua Li <shli@fb.com>
+Cc: Johannes Weiner <hannes@cmpxchg.org>
+Acked-by: Michal Hocko <mhocko@suse.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ mm/memcontrol.c |    1 +
+ 1 file changed, 1 insertion(+)
+
+--- a/mm/memcontrol.c
+++ b/mm/memcontrol.c
+@@ -3687,6 +3687,7 @@ static int __mem_cgroup_usage_register_e
+ 	ret = page_counter_memparse(args, "-1", &threshold);
+ 	if (ret)
+ 		return ret;
+	threshold <<= PAGE_SHIFT;
+ 
+ 	mutex_lock(&memcg->thresholds_lock);
+ 
@@ -0,0 +1,34 @@
+From 1b52e50f2a402a266f1ba2281f0a57e87637a047 Mon Sep 17 00:00:00 2001
+From: Javier Martinez Canillas <javier@osg.samsung.com>
+Date: Mon, 21 Sep 2015 14:26:54 +0200
+Subject: mfd: max77843: Fix max77843_chg_init() return on error
+
+From: Javier Martinez Canillas <javier@osg.samsung.com>
+
+commit 1b52e50f2a402a266f1ba2281f0a57e87637a047 upstream.
+
+If i2c_new_dummy() fails in max77843_chg_init(), an PTR_ERR(NULL) is
+returned which is 0. So the function was wrongly returning a success
+value instead of an error code.
+
+Fixes: c7f585fe46d8 ("mfd: max77843: Add max77843 MFD driver core driver")
+Signed-off-by: Javier Martinez Canillas <javier@osg.samsung.com>
+Reviewed-by: Krzysztof Kozlowski <k.kozlowski@samsung.com>
+Signed-off-by: Lee Jones <lee.jones@linaro.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ drivers/mfd/max77843.c |    2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+--- a/drivers/mfd/max77843.c
+++ b/drivers/mfd/max77843.c
+@@ -79,7 +79,7 @@ static int max77843_chg_init(struct max7
+ 	if (!max77843->i2c_chg) {
+ 		dev_err(&max77843->i2c->dev,
+ 				"Cannot allocate I2C device for Charger\n");
+-		return PTR_ERR(max77843->i2c_chg);
+		return -ENODEV;
+ 	}
+ 	i2c_set_clientdata(max77843->i2c_chg, max77843);
+ 
@@ -0,0 +1,49 @@
+From foo@baz Thu Oct 22 17:25:24 PDT 2015
+From: Eric Dumazet <edumazet@google.com>
+Date: Tue, 29 Sep 2015 18:52:25 -0700
+Subject: net: add pfmemalloc check in sk_add_backlog()
+
+From: Eric Dumazet <edumazet@google.com>
+
+[ Upstream commit c7c49b8fde26b74277188bdc6c9dca38db6fa35b ]
+
+Greg reported crashes hitting the following check in __sk_backlog_rcv()
+
+	BUG_ON(!sock_flag(sk, SOCK_MEMALLOC));
+
+The pfmemalloc bit is currently checked in sk_filter().
+
+This works correctly for TCP, because sk_filter() is ran in
+tcp_v[46]_rcv() before hitting the prequeue or backlog checks.
+
+For UDP or other protocols, this does not work, because the sk_filter()
+is ran from sock_queue_rcv_skb(), which might be called _after_ backlog
+queuing if socket is owned by user by the time packet is processed by
+softirq handler.
+
+Fixes: b4b9e35585089 ("netvm: set PF_MEMALLOC as appropriate during SKB processing")
+Signed-off-by: Eric Dumazet <edumazet@google.com>
+Reported-by: Greg Thelen <gthelen@google.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/net/sock.h |    8 ++++++++
+ 1 file changed, 8 insertions(+)
+
+--- a/include/net/sock.h
+++ b/include/net/sock.h
+@@ -826,6 +826,14 @@ static inline __must_check int sk_add_ba
+ 	if (sk_rcvqueues_full(sk, limit))
+ 		return -ENOBUFS;
+ 
+	/*
+	 * If the skb was allocated from pfmemalloc reserves, only
+	 * allow SOCK_MEMALLOC sockets to use it as this socket is
+	 * helping free memory
+	 */
+	if (skb_pfmemalloc(skb) && !sock_flag(sk, SOCK_MEMALLOC))
+		return -ENOMEM;
+
+ 	__sk_add_backlog(sk, skb);
+ 	sk->sk_backlog.len += skb->truesize;
+ 	return 0;
@@ -0,0 +1,47 @@
+From foo@baz Thu Oct 22 17:25:24 PDT 2015
+From: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
+Date: Tue, 29 Sep 2015 14:17:54 -0400
+Subject: net: dsa: fix preparation of a port STP update
+
+From: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
+
+[ Upstream commit 57a47532c4312159935c98b7f1cf0e62296b9171 ]
+
+Because of the default 0 value of ret in dsa_slave_port_attr_set, a
+driver may return -EOPNOTSUPP from the commit phase of a STP state,
+which triggers a WARN() from switchdev.
+
+This happened on a 6185 switch which does not support hardware bridging.
+
+Fixes: 3563606258cf ("switchdev: convert STP update to switchdev attr set")
+Reported-by: Andrew Lunn <andrew@lunn.ch>
+Signed-off-by: Vivien Didelot <vivien.didelot@savoirfairelinux.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/dsa/slave.c |   11 ++++++++---
+ 1 file changed, 8 insertions(+), 3 deletions(-)
+
+--- a/net/dsa/slave.c
+++ b/net/dsa/slave.c
+@@ -348,12 +348,17 @@ static int dsa_slave_stp_update(struct n
+ static int dsa_slave_port_attr_set(struct net_device *dev,
+ 				   struct switchdev_attr *attr)
+ {
+-	int ret = 0;
+	struct dsa_slave_priv *p = netdev_priv(dev);
+	struct dsa_switch *ds = p->parent;
+	int ret;
+ 
+ 	switch (attr->id) {
+ 	case SWITCHDEV_ATTR_PORT_STP_STATE:
+-		if (attr->trans == SWITCHDEV_TRANS_COMMIT)
+-			ret = dsa_slave_stp_update(dev, attr->u.stp_state);
+		if (attr->trans == SWITCHDEV_TRANS_PREPARE)
+			ret = ds->drv->port_stp_update ? 0 : -EOPNOTSUPP;
+		else
+			ret = ds->drv->port_stp_update(ds, p->port,
+						       attr->u.stp_state);
+ 		break;
+ 	default:
+ 		ret = -EOPNOTSUPP;
@@ -0,0 +1,40 @@
+From foo@baz Thu Oct 22 17:25:24 PDT 2015
+From: Ivan Mikhaylov <ivan@ru.ibm.com>
+Date: Fri, 25 Sep 2015 11:52:27 +0400
+Subject: net/ibm/emac: bump version numbers for correct work with ethtool
+
+From: Ivan Mikhaylov <ivan@ru.ibm.com>
+
+[ Upstream commit 661dfc65f7981481ba2e31aaa702371e82336e56 ]
+
+The size of the MAC register dump used to be the size specified by the
+reg property in the device tree.  Userland has no good way of finding
+out that size, and it was not specified consistently for each MAC type,
+so ethtool would end up printing junk at the end of the register dump
+if the device tree didn't match the size it assumed.
+
+Using the new version numbers indicates unambiguously that the size of
+the MAC register dump is dependent only on the MAC type.
+
+Fixes: 5369c71f7ca2 ("net/ibm/emac: fix size of emac dump memory areas")
+Signed-off-by: Ivan Mikhaylov <ivan@ru.ibm.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ethernet/ibm/emac/core.h |    6 +++---
+ 1 file changed, 3 insertions(+), 3 deletions(-)
+
+--- a/drivers/net/ethernet/ibm/emac/core.h
+++ b/drivers/net/ethernet/ibm/emac/core.h
+@@ -460,8 +460,8 @@ struct emac_ethtool_regs_subhdr {
+ 	u32 index;
+ };
+ 
+-#define EMAC_ETHTOOL_REGS_VER		0
+-#define EMAC4_ETHTOOL_REGS_VER		1
+-#define EMAC4SYNC_ETHTOOL_REGS_VER	2
+#define EMAC_ETHTOOL_REGS_VER		3
+#define EMAC4_ETHTOOL_REGS_VER		4
+#define EMAC4SYNC_ETHTOOL_REGS_VER	5
+ 
+ #endif /* __IBM_NEWEMAC_CORE_H */
@@ -0,0 +1,67 @@
+From foo@baz Thu Oct 22 17:25:24 PDT 2015
+From: Andrey Vagin <avagin@openvz.org>
+Date: Fri, 2 Oct 2015 00:05:36 +0300
+Subject: net/unix: fix logic about sk_peek_offset
+
+From: Andrey Vagin <avagin@openvz.org>
+
+[ Upstream commit e9193d60d363e4dff75ff6d43a48f22be26d59c7 ]
+
+Now send with MSG_PEEK can return data from multiple SKBs.
+
+Unfortunately we take into account the peek offset for each skb,
+that is wrong. We need to apply the peek offset only once.
+
+In addition, the peek offset should be used only if MSG_PEEK is set.
+
+Cc: "David S. Miller" <davem@davemloft.net> (maintainer:NETWORKING
+Cc: Eric Dumazet <edumazet@google.com> (commit_signer:1/14=7%)
+Cc: Aaron Conole <aconole@bytheb.org>
+Fixes: 9f389e35674f ("af_unix: return data from multiple SKBs on recv() with MSG_PEEK flag")
+Signed-off-by: Andrey Vagin <avagin@openvz.org>
+Tested-by: Aaron Conole <aconole@bytheb.org>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/unix/af_unix.c |   12 +++++++-----
+ 1 file changed, 7 insertions(+), 5 deletions(-)
+
+--- a/net/unix/af_unix.c
+++ b/net/unix/af_unix.c
+@@ -2064,6 +2064,11 @@ static int unix_stream_read_generic(stru
+ 		goto out;
+ 	}
+ 
+	if (flags & MSG_PEEK)
+		skip = sk_peek_offset(sk, flags);
+	else
+		skip = 0;
+
+ 	do {
+ 		int chunk;
+ 		struct sk_buff *skb, *last;
+@@ -2112,7 +2117,6 @@ unlock:
+ 			break;
+ 		}
+ 
+-		skip = sk_peek_offset(sk, flags);
+ 		while (skip >= unix_skb_len(skb)) {
+ 			skip -= unix_skb_len(skb);
+ 			last = skb;
+@@ -2179,14 +2183,12 @@ unlock:
+ 			if (UNIXCB(skb).fp)
+ 				scm.fp = scm_fp_dup(UNIXCB(skb).fp);
+ 
+-			if (skip) {
+-				sk_peek_offset_fwd(sk, chunk);
+-				skip -= chunk;
+-			}
+			sk_peek_offset_fwd(sk, chunk);
+ 
+ 			if (UNIXCB(skb).fp)
+ 				break;
+ 
+			skip = 0;
+ 			last = skb;
+ 			last_len = skb->len;
+ 			unix_state_lock(sk);
@@ -0,0 +1,107 @@
+From foo@baz Thu Oct 22 17:25:24 PDT 2015
+From: "Arad, Ronen" <ronen.arad@intel.com>
+Date: Thu, 15 Oct 2015 01:55:17 -0700
+Subject: netlink: Trim skb to alloc size to avoid MSG_TRUNC
+
+From: "Arad, Ronen" <ronen.arad@intel.com>
+
+[ Upstream commit db65a3aaf29ecce2e34271d52e8d2336b97bd9fe ]
+
+netlink_dump() allocates skb based on the calculated min_dump_alloc or
+a per socket max_recvmsg_len.
+min_alloc_size is maximum space required for any single netdev
+attributes as calculated by rtnl_calcit().
+max_recvmsg_len tracks the user provided buffer to netlink_recvmsg.
+It is capped at 16KiB.
+The intention is to avoid small allocations and to minimize the number
+of calls required to obtain dump information for all net devices.
+
+netlink_dump packs as many small messages as could fit within an skb
+that was sized for the largest single netdev information. The actual
+space available within an skb is larger than what is requested. It could
+be much larger and up to near 2x with align to next power of 2 approach.
+
+Allowing netlink_dump to use all the space available within the
+allocated skb increases the buffer size a user has to provide to avoid
+truncaion (i.e. MSG_TRUNG flag set).
+
+It was observed that with many VLANs configured on at least one netdev,
+a larger buffer of near 64KiB was necessary to avoid "Message truncated"
+error in "ip link" or "bridge [-c[ompressvlans]] vlan show" when
+min_alloc_size was only little over 32KiB.
+
+This patch trims skb to allocated size in order to allow the user to
+avoid truncation with more reasonable buffer size.
+
+Signed-off-by: Ronen Arad <ronen.arad@intel.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/netlink/af_netlink.c |   34 ++++++++++++++++++++++------------
+ 1 file changed, 22 insertions(+), 12 deletions(-)
+
+--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
+@@ -2750,6 +2750,7 @@ static int netlink_dump(struct sock *sk)
+ 	struct sk_buff *skb = NULL;
+ 	struct nlmsghdr *nlh;
+ 	int len, err = -ENOBUFS;
+	int alloc_min_size;
+ 	int alloc_size;
+ 
+ 	mutex_lock(nlk->cb_mutex);
+@@ -2758,9 +2759,6 @@ static int netlink_dump(struct sock *sk)
+ 		goto errout_skb;
+ 	}
+ 
+-	cb = &nlk->cb;
+-	alloc_size = max_t(int, cb->min_dump_alloc, NLMSG_GOODSIZE);
+-
+ 	if (!netlink_rx_is_mmaped(sk) &&
+ 	    atomic_read(&sk->sk_rmem_alloc) >= sk->sk_rcvbuf)
+ 		goto errout_skb;
+@@ -2770,23 +2768,35 @@ static int netlink_dump(struct sock *sk)
+ 	 * to reduce number of system calls on dump operations, if user
+ 	 * ever provided a big enough buffer.
+ 	 */
+-	if (alloc_size < nlk->max_recvmsg_len) {
+-		skb = netlink_alloc_skb(sk,
+-					nlk->max_recvmsg_len,
+-					nlk->portid,
+	cb = &nlk->cb;
+	alloc_min_size = max_t(int, cb->min_dump_alloc, NLMSG_GOODSIZE);
+
+	if (alloc_min_size < nlk->max_recvmsg_len) {
+		alloc_size = nlk->max_recvmsg_len;
+		skb = netlink_alloc_skb(sk, alloc_size, nlk->portid,
+ 					GFP_KERNEL |
+ 					__GFP_NOWARN |
+ 					__GFP_NORETRY);
+-		/* available room should be exact amount to avoid MSG_TRUNC */
+-		if (skb)
+-			skb_reserve(skb, skb_tailroom(skb) -
+-					 nlk->max_recvmsg_len);
+ 	}
+-	if (!skb)
+	if (!skb) {
+		alloc_size = alloc_min_size;
+ 		skb = netlink_alloc_skb(sk, alloc_size, nlk->portid,
+ 					GFP_KERNEL);
+	}
+ 	if (!skb)
+ 		goto errout_skb;
+
+	/* Trim skb to allocated size. User is expected to provide buffer as
+	 * large as max(min_dump_alloc, 16KiB (mac_recvmsg_len capped at
+	 * netlink_recvmsg())). dump will pack as many smaller messages as
+	 * could fit within the allocated skb. skb is typically allocated
+	 * with larger space than required (could be as much as near 2x the
+	 * requested size with align to next power of 2 approach). Allowing
+	 * dump to use the excess space makes it difficult for a user to have a
+	 * reasonable static buffer based on the expected largest dump of a
+	 * single netdev. The outcome is MSG_TRUNC error.
+	 */
+	skb_reserve(skb, skb_tailroom(skb) - alloc_size);
+ 	netlink_skb_set_owner_r(skb, sk);
+ 
+ 	len = cb->dump(skb, cb);
@@ -0,0 +1,43 @@
+From 8c3ad9cb7343dc5f61b8cf3cdbe1016c5e7c2c8b Mon Sep 17 00:00:00 2001
+From: Christoph Hellwig <hch@lst.de>
+Date: Fri, 9 Oct 2015 15:03:26 +0200
+Subject: nfsd/blocklayout: accept any minlength
+
+From: Christoph Hellwig <hch@lst.de>
+
+commit 8c3ad9cb7343dc5f61b8cf3cdbe1016c5e7c2c8b upstream.
+
+Recent Linux clients have started to send GETLAYOUT requests with
+minlength less than blocksize.
+
+Servers aren't really allowed to impose this kind of restriction on
+layouts; see RFC 5661 section 18.43.3 for details.
+
+This has been observed to cause indefinite hangs on fsx runs on some
+clients.
+
+Signed-off-by: Christoph Hellwig <hch@lst.de>
+Signed-off-by: J. Bruce Fields <bfields@redhat.com>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ fs/nfsd/blocklayout.c |    8 --------
+ 1 file changed, 8 deletions(-)
+
+--- a/fs/nfsd/blocklayout.c
+++ b/fs/nfsd/blocklayout.c
+@@ -56,14 +56,6 @@ nfsd4_block_proc_layoutget(struct inode
+ 	u32 device_generation = 0;
+ 	int error;
+ 
+-	/*
+-	 * We do not attempt to support I/O smaller than the fs block size,
+-	 * or not aligned to it.
+-	 */
+-	if (args->lg_minlength < block_size) {
+-		dprintk("pnfsd: I/O too small\n");
+-		goto out_layoutunavailable;
+-	}
+ 	if (seg->offset & (block_size - 1)) {
+ 		dprintk("pnfsd: I/O misaligned\n");
+ 		goto out_layoutunavailable;
@@ -0,0 +1,35 @@
+From foo@baz Thu Oct 22 17:25:24 PDT 2015
+From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Date: Fri, 2 Oct 2015 13:18:22 +0300
+Subject: ovs: do not allocate memory from offline numa node
+
+From: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+
+[ Upstream commit 598c12d0ba6de9060f04999746eb1e015774044b ]
+
+When openvswitch tries allocate memory from offline numa node 0:
+stats = kmem_cache_alloc_node(flow_stats_cache, GFP_KERNEL | __GFP_ZERO, 0)
+It catches VM_BUG_ON(nid < 0 || nid >= MAX_NUMNODES || !node_online(nid))
+[ replaced with VM_WARN_ON(!node_online(nid)) recently ] in linux/gfp.h
+This patch disables numa affinity in this case.
+
+Signed-off-by: Konstantin Khlebnikov <khlebnikov@yandex-team.ru>
+Acked-by: Pravin B Shelar <pshelar@nicira.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/openvswitch/flow_table.c |    3 ++-
+ 1 file changed, 2 insertions(+), 1 deletion(-)
+
+--- a/net/openvswitch/flow_table.c
+++ b/net/openvswitch/flow_table.c
+@@ -92,7 +92,8 @@ struct sw_flow *ovs_flow_alloc(void)
+ 
+ 	/* Initialize the default stat node. */
+ 	stats = kmem_cache_alloc_node(flow_stats_cache,
+-				      GFP_KERNEL | __GFP_ZERO, 0);
+				      GFP_KERNEL | __GFP_ZERO,
+				      node_online(0) ? 0 : NUMA_NO_NODE);
+ 	if (!stats)
+ 		goto err;
+ 
@@ -0,0 +1,76 @@
+From foo@baz Thu Oct 22 17:25:24 PDT 2015
+From: Guillaume Nault <g.nault@alphalink.fr>
+Date: Wed, 30 Sep 2015 11:45:33 +0200
+Subject: ppp: don't override sk->sk_state in pppoe_flush_dev()
+
+From: Guillaume Nault <g.nault@alphalink.fr>
+
+[ Upstream commit e6740165b8f7f06d8caee0fceab3fb9d790a6fed ]
+
+Since commit 2b018d57ff18 ("pppoe: drop PPPOX_ZOMBIEs in pppoe_release"),
+pppoe_release() calls dev_put(po->pppoe_dev) if sk is in the
+PPPOX_ZOMBIE state. But pppoe_flush_dev() can set sk->sk_state to
+PPPOX_ZOMBIE _and_ reset po->pppoe_dev to NULL. This leads to the
+following oops:
+
+[  570.140800] BUG: unable to handle kernel NULL pointer dereference at 00000000000004e0
+[  570.142931] IP: [<ffffffffa018c701>] pppoe_release+0x50/0x101 [pppoe]
+[  570.144601] PGD 3d119067 PUD 3dbc1067 PMD 0
+[  570.144601] Oops: 0000 [#1] SMP
+[  570.144601] Modules linked in: l2tp_ppp l2tp_netlink l2tp_core ip6_udp_tunnel udp_tunnel pppoe pppox ppp_generic slhc loop crc32c_intel ghash_clmulni_intel jitterentropy_rng sha256_generic hmac drbg ansi_cprng aesni_intel aes_x86_64 ablk_helper cryptd lrw gf128mul glue_helper acpi_cpufreq evdev serio_raw processor button ext4 crc16 mbcache jbd2 virtio_net virtio_blk virtio_pci virtio_ring virtio
+[  570.144601] CPU: 1 PID: 15738 Comm: ppp-apitest Not tainted 4.2.0 #1
+[  570.144601] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS Debian-1.8.2-1 04/01/2014
+[  570.144601] task: ffff88003d30d600 ti: ffff880036b60000 task.ti: ffff880036b60000
+[  570.144601] RIP: 0010:[<ffffffffa018c701>]  [<ffffffffa018c701>] pppoe_release+0x50/0x101 [pppoe]
+[  570.144601] RSP: 0018:ffff880036b63e08  EFLAGS: 00010202
+[  570.144601] RAX: 0000000000000000 RBX: ffff880034340000 RCX: 0000000000000206
+[  570.144601] RDX: 0000000000000006 RSI: ffff88003d30dd20 RDI: ffff88003d30dd20
+[  570.144601] RBP: ffff880036b63e28 R08: 0000000000000001 R09: 0000000000000000
+[  570.144601] R10: 00007ffee9b50420 R11: ffff880034340078 R12: ffff8800387ec780
+[  570.144601] R13: ffff8800387ec7b0 R14: ffff88003e222aa0 R15: ffff8800387ec7b0
+[  570.144601] FS:  00007f5672f48700(0000) GS:ffff88003fc80000(0000) knlGS:0000000000000000
+[  570.144601] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
+[  570.144601] CR2: 00000000000004e0 CR3: 0000000037f7e000 CR4: 00000000000406a0
+[  570.144601] Stack:
+[  570.144601]  ffffffffa018f240 ffff8800387ec780 ffffffffa018f240 ffff8800387ec7b0
+[  570.144601]  ffff880036b63e48 ffffffff812caabe ffff880039e4e000 0000000000000008
+[  570.144601]  ffff880036b63e58 ffffffff812cabad ffff880036b63ea8 ffffffff811347f5
+[  570.144601] Call Trace:
+[  570.144601]  [<ffffffff812caabe>] sock_release+0x1a/0x75
+[  570.144601]  [<ffffffff812cabad>] sock_close+0xd/0x11
+[  570.144601]  [<ffffffff811347f5>] __fput+0xff/0x1a5
+[  570.144601]  [<ffffffff811348cb>] ____fput+0x9/0xb
+[  570.144601]  [<ffffffff81056682>] task_work_run+0x66/0x90
+[  570.144601]  [<ffffffff8100189e>] prepare_exit_to_usermode+0x8c/0xa7
+[  570.144601]  [<ffffffff81001a26>] syscall_return_slowpath+0x16d/0x19b
+[  570.144601]  [<ffffffff813babb1>] int_ret_from_sys_call+0x25/0x9f
+[  570.144601] Code: 48 8b 83 c8 01 00 00 a8 01 74 12 48 89 df e8 8b 27 14 e1 b8 f7 ff ff ff e9 b7 00 00 00 8a 43 12 a8 0b 74 1c 48 8b 83 a8 04 00 00 <48> 8b 80 e0 04 00 00 65 ff 08 48 c7 83 a8 04 00 00 00 00 00 00
+[  570.144601] RIP  [<ffffffffa018c701>] pppoe_release+0x50/0x101 [pppoe]
+[  570.144601]  RSP <ffff880036b63e08>
+[  570.144601] CR2: 00000000000004e0
+[  570.200518] ---[ end trace 46956baf17349563 ]---
+
+pppoe_flush_dev() has no reason to override sk->sk_state with
+PPPOX_ZOMBIE. pppox_unbind_sock() already sets sk->sk_state to
+PPPOX_DEAD, which is the correct state given that sk is unbound and
+po->pppoe_dev is NULL.
+
+Fixes: 2b018d57ff18 ("pppoe: drop PPPOX_ZOMBIEs in pppoe_release")
+Tested-by: Oleksii Berezhniak <core@irc.lg.ua>
+Signed-off-by: Guillaume Nault <g.nault@alphalink.fr>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ drivers/net/ppp/pppoe.c |    1 -
+ 1 file changed, 1 deletion(-)
+
+--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
+@@ -313,7 +313,6 @@ static void pppoe_flush_dev(struct net_d
+ 			if (po->pppoe_dev == dev &&
+ 			    sk->sk_state & (PPPOX_CONNECTED | PPPOX_BOUND | PPPOX_ZOMBIE)) {
+ 				pppox_unbind_sock(sk);
+-				sk->sk_state = PPPOX_ZOMBIE;
+ 				sk->sk_state_change(sk);
+ 				po->pppoe_dev = NULL;
+ 				dev_put(dev);
@@ -0,0 +1,68 @@
+From foo@baz Thu Oct 22 17:25:24 PDT 2015
+From: Pravin B Shelar <pshelar@nicira.com>
+Date: Tue, 22 Sep 2015 12:57:53 -0700
+Subject: skbuff: Fix skb checksum flag on skb pull
+
+From: Pravin B Shelar <pshelar@nicira.com>
+
+[ Upstream commit 6ae459bdaaeebc632b16e54dcbabb490c6931d61 ]
+
+VXLAN device can receive skb with checksum partial. But the checksum
+offset could be in outer header which is pulled on receive. This results
+in negative checksum offset for the skb. Such skb can cause the assert
+failure in skb_checksum_help(). Following patch fixes the bug by setting
+checksum-none while pulling outer header.
+
+Following is the kernel panic msg from old kernel hitting the bug.
+
+------------[ cut here ]------------
+kernel BUG at net/core/dev.c:1906!
+RIP: 0010:[<ffffffff81518034>] skb_checksum_help+0x144/0x150
+Call Trace:
+<IRQ>
+[<ffffffffa0164c28>] queue_userspace_packet+0x408/0x470 [openvswitch]
+[<ffffffffa016614d>] ovs_dp_upcall+0x5d/0x60 [openvswitch]
+[<ffffffffa0166236>] ovs_dp_process_packet_with_key+0xe6/0x100 [openvswitch]
+[<ffffffffa016629b>] ovs_dp_process_received_packet+0x4b/0x80 [openvswitch]
+[<ffffffffa016c51a>] ovs_vport_receive+0x2a/0x30 [openvswitch]
+[<ffffffffa0171383>] vxlan_rcv+0x53/0x60 [openvswitch]
+[<ffffffffa01734cb>] vxlan_udp_encap_recv+0x8b/0xf0 [openvswitch]
+[<ffffffff8157addc>] udp_queue_rcv_skb+0x2dc/0x3b0
+[<ffffffff8157b56f>] __udp4_lib_rcv+0x1cf/0x6c0
+[<ffffffff8157ba7a>] udp_rcv+0x1a/0x20
+[<ffffffff8154fdbd>] ip_local_deliver_finish+0xdd/0x280
+[<ffffffff81550128>] ip_local_deliver+0x88/0x90
+[<ffffffff8154fa7d>] ip_rcv_finish+0x10d/0x370
+[<ffffffff81550365>] ip_rcv+0x235/0x300
+[<ffffffff8151ba1d>] __netif_receive_skb+0x55d/0x620
+[<ffffffff8151c360>] netif_receive_skb+0x80/0x90
+[<ffffffff81459935>] virtnet_poll+0x555/0x6f0
+[<ffffffff8151cd04>] net_rx_action+0x134/0x290
+[<ffffffff810683d8>] __do_softirq+0xa8/0x210
+[<ffffffff8162fe6c>] call_softirq+0x1c/0x30
+[<ffffffff810161a5>] do_softirq+0x65/0xa0
+[<ffffffff810687be>] irq_exit+0x8e/0xb0
+[<ffffffff81630733>] do_IRQ+0x63/0xe0
+[<ffffffff81625f2e>] common_interrupt+0x6e/0x6e
+
+Reported-by: Anupam Chanda <achanda@vmware.com>
+Signed-off-by: Pravin B Shelar <pshelar@nicira.com>
+Acked-by: Tom Herbert <tom@herbertland.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/skbuff.h |    3 +++
+ 1 file changed, 3 insertions(+)
+
+--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
+@@ -2601,6 +2601,9 @@ static inline void skb_postpull_rcsum(st
+ {
+ 	if (skb->ip_summed == CHECKSUM_COMPLETE)
+ 		skb->csum = csum_sub(skb->csum, csum_partial(start, len, 0));
+	else if (skb->ip_summed == CHECKSUM_PARTIAL &&
+		 skb_checksum_start_offset(skb) <= len)
+		skb->ip_summed = CHECKSUM_NONE;
+ }
+ 
+ unsigned char *skb_pull_rcsum(struct sk_buff *skb, unsigned int len);
@@ -0,0 +1,58 @@
+From foo@baz Thu Oct 22 17:25:24 PDT 2015
+From: Pravin B Shelar <pshelar@nicira.com>
+Date: Mon, 28 Sep 2015 17:24:25 -0700
+Subject: skbuff: Fix skb checksum partial check.
+
+From: Pravin B Shelar <pshelar@nicira.com>
+
+[ Upstream commit 31b33dfb0a144469dd805514c9e63f4993729a48 ]
+
+Earlier patch 6ae459bda tried to detect void ckecksum partial
+skb by comparing pull length to checksum offset. But it does
+not work for all cases since checksum-offset depends on
+updates to skb->data.
+
+Following patch fixes it by validating checksum start offset
+after skb-data pointer is updated. Negative value of checksum
+offset start means there is no need to checksum.
+
+Fixes: 6ae459bda ("skbuff: Fix skb checksum flag on skb pull")
+Reported-by: Andrew Vagin <avagin@odin.com>
+Signed-off-by: Pravin B Shelar <pshelar@nicira.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ include/linux/skbuff.h |    2 +-
+ net/core/skbuff.c      |    9 +++++----
+ 2 files changed, 6 insertions(+), 5 deletions(-)
+
+--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
+@@ -2602,7 +2602,7 @@ static inline void skb_postpull_rcsum(st
+ 	if (skb->ip_summed == CHECKSUM_COMPLETE)
+ 		skb->csum = csum_sub(skb->csum, csum_partial(start, len, 0));
+ 	else if (skb->ip_summed == CHECKSUM_PARTIAL &&
+-		 skb_checksum_start_offset(skb) <= len)
+		 skb_checksum_start_offset(skb) < 0)
+ 		skb->ip_summed = CHECKSUM_NONE;
+ }
+ 
+--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
+@@ -2958,11 +2958,12 @@ EXPORT_SYMBOL_GPL(skb_append_pagefrags);
+  */
+ unsigned char *skb_pull_rcsum(struct sk_buff *skb, unsigned int len)
+ {
+	unsigned char *data = skb->data;
+
+ 	BUG_ON(len > skb->len);
+-	skb->len -= len;
+-	BUG_ON(skb->len < skb->data_len);
+-	skb_postpull_rcsum(skb, skb->data, len);
+-	return skb->data += len;
+	__skb_pull(skb, len);
+	skb_postpull_rcsum(skb, data, len);
+	return skb->data;
+ }
+ EXPORT_SYMBOL_GPL(skb_pull_rcsum);
+ 
@@ -0,0 +1,57 @@
+From foo@baz Thu Oct 22 17:25:24 PDT 2015
+From: Jon Paul Maloy <jon.maloy@ericsson.com>
+Date: Wed, 14 Oct 2015 09:23:18 -0400
+Subject: tipc: move fragment importance field to new header position
+
+From: Jon Paul Maloy <jon.maloy@ericsson.com>
+
+[ Upstream commit dde4b5ae65de659b9ec64bafdde0430459fcb495 ]
+
+In commit e3eea1eb47a ("tipc: clean up handling of message priorities")
+we introduced a field in the packet header for keeping track of the
+priority of fragments, since this value is not present in the specified
+protocol header. Since the value so far only is used at the transmitting
+end of the link, we have not yet officially defined it as part of the
+protocol.
+
+Unfortunately, the field we use for keeping this value, bits 13-15 in
+in word 5, has turned out to be a poor choice; it is already used by the
+broadcast protocol for carrying the 'network id' field of the sending
+node. Since packet fragments also need to be transported across the
+broadcast protocol, the risk of conflict is obvious, and we see this
+happen when we use network identities larger than 2^13-1. This has
+escaped our testing because we have so far only been using small network
+id values.
+
+We now move this field to bits 0-2 in word 9, a field that is guaranteed
+to be unused by all involved protocols.
+
+Fixes: e3eea1eb47a ("tipc: clean up handling of message priorities")
+Signed-off-by: Jon Maloy <jon.maloy@ericsson.com>
+Acked-by: Ying Xue <ying.xue@windriver.com>
+Signed-off-by: David S. Miller <davem@davemloft.net>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+---
+ net/tipc/msg.h |    4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+--- a/net/tipc/msg.h
+++ b/net/tipc/msg.h
+@@ -357,7 +357,7 @@ static inline u32 msg_importance(struct
+ 	if (likely((usr <= TIPC_CRITICAL_IMPORTANCE) && !msg_errcode(m)))
+ 		return usr;
+ 	if ((usr == MSG_FRAGMENTER) || (usr == MSG_BUNDLER))
+-		return msg_bits(m, 5, 13, 0x7);
+		return msg_bits(m, 9, 0, 0x7);
+ 	return TIPC_SYSTEM_IMPORTANCE;
+ }
+ 
+@@ -366,7 +366,7 @@ static inline void msg_set_importance(st
+ 	int usr = msg_user(m);
+ 
+ 	if (likely((usr == MSG_FRAGMENTER) || (usr == MSG_BUNDLER)))
+-		msg_set_bits(m, 5, 13, 0x7, i);
+		msg_set_bits(m, 9, 0, 0x7, i);
+ 	else if (i < TIPC_SYSTEM_IMPORTANCE)
+ 		msg_set_user(m, i);
+ 	else
@@ -0,0 +1,78 @@
+From 874bbfe600a660cba9c776b3957b1ce393151b76 Mon Sep 17 00:00:00 2001
+From: Shaohua Li <shli@fb.com>
+Date: Wed, 30 Sep 2015 09:05:30 -0700
+Subject: workqueue: make sure delayed work run in local cpu
+
+From: Shaohua Li <shli@fb.com>
+
+commit 874bbfe600a660cba9c776b3957b1ce393151b76 upstream.
+
+My system keeps crashing with below message. vmstat_update() schedules a delayed
+work in current cpu and expects the work runs in the cpu.
+schedule_delayed_work() is expected to make delayed work run in local cpu. The
+problem is timer can be migrated with NO_HZ. __queue_work() queues work in
+timer handler, which could run in a different cpu other than where the delayed
+work is scheduled. The end result is the delayed work runs in different cpu.
+The patch makes __queue_delayed_work records local cpu earlier. Where the timer
+runs doesn't change where the work runs with the change.
+
+[   28.010131] ------------[ cut here ]------------
+[   28.010609] kernel BUG at ../mm/vmstat.c:1392!
+[   28.011099] invalid opcode: 0000 [#1] PREEMPT SMP DEBUG_PAGEALLOC KASAN
+[   28.011860] Modules linked in:
+[   28.012245] CPU: 0 PID: 289 Comm: kworker/0:3 Tainted: G        W4.3.0-rc3+ #634
+[   28.013065] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.7.5-20140709_153802- 04/01/2014
+[   28.014160] Workqueue: events vmstat_update
+[   28.014571] task: ffff880117682580 ti: ffff8800ba428000 task.ti: ffff8800ba428000
+[   28.015445] RIP: 0010:[<ffffffff8115f921>]  [<ffffffff8115f921>]vmstat_update+0x31/0x80
+[   28.016282] RSP: 0018:ffff8800ba42fd80  EFLAGS: 00010297
+[   28.016812] RAX: 0000000000000000 RBX: ffff88011a858dc0 RCX:0000000000000000
+[   28.017585] RDX: ffff880117682580 RSI: ffffffff81f14d8c RDI:ffffffff81f4df8d
+[   28.018366] RBP: ffff8800ba42fd90 R08: 0000000000000001 R09:0000000000000000
+[   28.019169] R10: 0000000000000000 R11: 0000000000000121 R12:ffff8800baa9f640
+[   28.019947] R13: ffff88011a81e340 R14: ffff88011a823700 R15:0000000000000000
+[   28.020071] FS:  0000000000000000(0000) GS:ffff88011a800000(0000)knlGS:0000000000000000
+[   28.020071] CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
+[   28.020071] CR2: 00007ff6144b01d0 CR3: 00000000b8e93000 CR4:00000000000006f0
+[   28.020071] Stack:
+[   28.020071]  ffff88011a858dc0 ffff8800baa9f640 ffff8800ba42fe00ffffffff8106bd88
+[   28.020071]  ffffffff8106bd0b 0000000000000096 0000000000000000ffffffff82f9b1e8
+[   28.020071]  ffffffff829f0b10 0000000000000000 ffffffff81f18460ffff88011a81e340
+[   28.020071] Call Trace:
+[   28.020071]  [<ffffffff8106bd88>] process_one_work+0x1c8/0x540
+[   28.020071]  [<ffffffff8106bd0b>] ? process_one_work+0x14b/0x540
+[   28.020071]  [<ffffffff8106c214>] worker_thread+0x114/0x460
+[   28.020071]  [<ffffffff8106c100>] ? process_one_work+0x540/0x540
+[   28.020071]  [<ffffffff81071bf8>] kthread+0xf8/0x110
+[   28.020071]  [<ffffffff81071b00>] ?kthread_create_on_node+0x200/0x200
+[   28.020071]  [<ffffffff81a6522f>] ret_from_fork+0x3f/0x70
+[   28.020071]  [<ffffffff81071b00>] ?kthread_create_on_node+0x200/0x200
+
+Signed-off-by: Shaohua Li <shli@fb.com>
+Signed-off-by: Tejun Heo <tj@kernel.org>
+Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+
+---
+ kernel/workqueue.c |    8 ++++----
+ 1 file changed, 4 insertions(+), 4 deletions(-)
+
+--- a/kernel/workqueue.c
+++ b/kernel/workqueue.c
+@@ -1458,13 +1458,13 @@ static void __queue_delayed_work(int cpu
+ 	timer_stats_timer_set_start_info(&dwork->timer);
+ 
+ 	dwork->wq = wq;
+	/* timer isn't guaranteed to run in this cpu, record earlier */
+	if (cpu == WORK_CPU_UNBOUND)
+		cpu = raw_smp_processor_id();
+ 	dwork->cpu = cpu;
+ 	timer->expires = jiffies + delay;
+ 
+-	if (unlikely(cpu != WORK_CPU_UNBOUND))
+-		add_timer_on(timer, cpu);
+-	else
+-		add_timer(timer);
+	add_timer_on(timer, cpu);
+ }
+ 
+ /**
@@ -1,38 +0,0 @@
-From 762982db33b23029e98c844611e2e8beeb75bc0d Mon Sep 17 00:00:00 2001
-From: Roger Quadros <rogerq@ti.com>
-Date: Thu, 13 Aug 2015 13:28:42 +0300
-Subject: [PATCH] usb: phy: phy-generic: Fix reset behaviour on legacy boot
-
-The gpio-desc migration done in v4.0 caused a regression
-with legacy boots due to reversed reset logic.
-e.g. omap3-beagle USB host breaks on legacy boot.
-
-Request the reset GPIO with GPIOF_ACTIVE_LOW flag so that
-it matches the driver logic and pin behaviour.
-
-Fixes: e9f2cefb0cdc ("usb: phy: generic: migrate to gpio_desc")
-Cc: <stable@vger.kernel.org> # 4.0+
-Tested-by: Fabio Estevam <fabio.estevam@freescale.com>
-Signed-off-by: Roger Quadros <rogerq@ti.com>
-Signed-off-by: Felipe Balbi <balbi@ti.com>
---
- drivers/usb/phy/phy-generic.c | 3 ++-
- 1 file changed, 2 insertions(+), 1 deletion(-)
-
-diff --git a/drivers/usb/phy/phy-generic.c b/drivers/usb/phy/phy-generic.c
-index ec6ecd0..5320cb8 100644
--- a/drivers/usb/phy/phy-generic.c
-+++ b/drivers/usb/phy/phy-generic.c
-@@ -232,7 +232,8 @@ int usb_phy_gen_create_phy(struct device *dev, struct usb_phy_generic *nop,
- 		clk_rate = pdata->clk_rate;
- 		needs_vcc = pdata->needs_vcc;
- 		if (gpio_is_valid(pdata->gpio_reset)) {
-			err = devm_gpio_request_one(dev, pdata->gpio_reset, 0,
-+			err = devm_gpio_request_one(dev, pdata->gpio_reset,
-+						    GPIOF_ACTIVE_LOW,
- 						    dev_name(dev));
- 			if (!err)
- 				nop->gpiod_reset =
-- 
-2.6.0
-
@@ -1,56 +0,0 @@
-From dca7794539eff04b786fb6907186989e5eaaa9c2 Mon Sep 17 00:00:00 2001
-From: Mathias Nyman <mathias.nyman@linux.intel.com>
-Date: Mon, 21 Sep 2015 17:46:16 +0300
-Subject: [PATCH] xhci: change xhci 1.0 only restrictions to support xhci 1.1
-
-Some changes between xhci 0.96 and xhci 1.0 specifications forced us to
-check the hci version in code, some of these checks were implemented as
-hci_version == 1.0, which will not work with new xhci 1.1 controllers.
-
-xhci 1.1 behaves similar to xhci 1.0 in these cases, so change these
-checks to hci_version >= 1.0
-
-Cc: <stable@vger.kernel.org>
-Signed-off-by: Mathias Nyman <mathias.nyman@linux.intel.com>
-Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
- drivers/usb/host/xhci-mem.c  | 6 +++---
- drivers/usb/host/xhci-ring.c | 4 ++--
- 2 files changed, 5 insertions(+), 5 deletions(-)
-
-diff --git a/drivers/usb/host/xhci-mem.c b/drivers/usb/host/xhci-mem.c
-index 9a8c936..8497fb8 100644
--- a/drivers/usb/host/xhci-mem.c
-+++ b/drivers/usb/host/xhci-mem.c
-@@ -1498,10 +1498,10 @@ int xhci_endpoint_init(struct xhci_hcd *xhci,
- 	 * use Event Data TRBs, and we don't chain in a link TRB on short
- 	 * transfers, we're basically dividing by 1.
- 	 *
-	 * xHCI 1.0 specification indicates that the Average TRB Length should
-	 * be set to 8 for control endpoints.
-+	 * xHCI 1.0 and 1.1 specification indicates that the Average TRB Length
-+	 * should be set to 8 for control endpoints.
- 	 */
-	if (usb_endpoint_xfer_control(&ep->desc) && xhci->hci_version == 0x100)
-+	if (usb_endpoint_xfer_control(&ep->desc) && xhci->hci_version >= 0x100)
- 		ep_ctx->tx_info |= cpu_to_le32(AVG_TRB_LENGTH_FOR_EP(8));
- 	else
- 		ep_ctx->tx_info |=
-diff --git a/drivers/usb/host/xhci-ring.c b/drivers/usb/host/xhci-ring.c
-index 1c61e5e..43291f9 100644
--- a/drivers/usb/host/xhci-ring.c
-+++ b/drivers/usb/host/xhci-ring.c
-@@ -3470,8 +3470,8 @@ int xhci_queue_ctrl_tx(struct xhci_hcd *xhci, gfp_t mem_flags,
- 	if (start_cycle == 0)
- 		field |= 0x1;
- 
-	/* xHCI 1.0 6.4.1.2.1: Transfer Type field */
-	if (xhci->hci_version == 0x100) {
-+	/* xHCI 1.0/1.1 6.4.1.2.1: Transfer Type field */
-+	if (xhci->hci_version >= 0x100) {
- 		if (urb->transfer_buffer_length > 0) {
- 			if (setup->bRequestType & USB_DIR_IN)
- 				field |= TRB_TX_TYPE(TRB_DATA_IN);
-- 
-2.6.0
-
@@ -1,174 +0,0 @@
-From a5caa209ba9c29c6421292e7879d2387a2ef39c9 Mon Sep 17 00:00:00 2001
-From: Matt Fleming <matt.fleming@intel.com>
-Date: Fri, 25 Sep 2015 23:02:18 +0100
-Subject: [PATCH] x86/efi: Fix boot crash by mapping EFI memmap entries
- bottom-up at runtime, instead of top-down
-
-Beginning with UEFI v2.5 EFI_PROPERTIES_TABLE was introduced
-that signals that the firmware PE/COFF loader supports splitting
-code and data sections of PE/COFF images into separate EFI
-memory map entries. This allows the kernel to map those regions
-with strict memory protections, e.g. EFI_MEMORY_RO for code,
-EFI_MEMORY_XP for data, etc.
-
-Unfortunately, an unwritten requirement of this new feature is
-that the regions need to be mapped with the same offsets
-relative to each other as observed in the EFI memory map. If
-this is not done crashes like this may occur,
-
-  BUG: unable to handle kernel paging request at fffffffefe6086dd
-  IP: [<fffffffefe6086dd>] 0xfffffffefe6086dd
-  Call Trace:
-   [<ffffffff8104c90e>] efi_call+0x7e/0x100
-   [<ffffffff81602091>] ? virt_efi_set_variable+0x61/0x90
-   [<ffffffff8104c583>] efi_delete_dummy_variable+0x63/0x70
-   [<ffffffff81f4e4aa>] efi_enter_virtual_mode+0x383/0x392
-   [<ffffffff81f37e1b>] start_kernel+0x38a/0x417
-   [<ffffffff81f37495>] x86_64_start_reservations+0x2a/0x2c
-   [<ffffffff81f37582>] x86_64_start_kernel+0xeb/0xef
-
-Here 0xfffffffefe6086dd refers to an address the firmware
-expects to be mapped but which the OS never claimed was mapped.
-The issue is that included in these regions are relative
-addresses to other regions which were emitted by the firmware
-toolchain before the "splitting" of sections occurred at
-runtime.
-
-Needless to say, we don't satisfy this unwritten requirement on
-x86_64 and instead map the EFI memory map entries in reverse
-order. The above crash is almost certainly triggerable with any
-kernel newer than v3.13 because that's when we rewrote the EFI
-runtime region mapping code, in commit d2f7cbe7b26a ("x86/efi:
-Runtime services virtual mapping"). For kernel versions before
-v3.13 things may work by pure luck depending on the
-fragmentation of the kernel virtual address space at the time we
-map the EFI regions.
-
-Instead of mapping the EFI memory map entries in reverse order,
-where entry N has a higher virtual address than entry N+1, map
-them in the same order as they appear in the EFI memory map to
-preserve this relative offset between regions.
-
-This patch has been kept as small as possible with the intention
-that it should be applied aggressively to stable and
-distribution kernels. It is very much a bugfix rather than
-support for a new feature, since when EFI_PROPERTIES_TABLE is
-enabled we must map things as outlined above to even boot - we
-have no way of asking the firmware not to split the code/data
-regions.
-
-In fact, this patch doesn't even make use of the more strict
-memory protections available in UEFI v2.5. That will come later.
-
-Suggested-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
-Reported-by: Ard Biesheuvel <ard.biesheuvel@linaro.org>
-Signed-off-by: Matt Fleming <matt.fleming@intel.com>
-Cc: <stable@vger.kernel.org>
-Cc: Borislav Petkov <bp@suse.de>
-Cc: Chun-Yi <jlee@suse.com>
-Cc: Dave Young <dyoung@redhat.com>
-Cc: H. Peter Anvin <hpa@zytor.com>
-Cc: James Bottomley <JBottomley@Odin.com>
-Cc: Lee, Chun-Yi <jlee@suse.com>
-Cc: Leif Lindholm <leif.lindholm@linaro.org>
-Cc: Linus Torvalds <torvalds@linux-foundation.org>
-Cc: Matthew Garrett <mjg59@srcf.ucam.org>
-Cc: Mike Galbraith <efault@gmx.de>
-Cc: Peter Jones <pjones@redhat.com>
-Cc: Peter Zijlstra <peterz@infradead.org>
-Cc: Thomas Gleixner <tglx@linutronix.de>
-Cc: linux-kernel@vger.kernel.org
-Link: http://lkml.kernel.org/r/1443218539-7610-2-git-send-email-matt@codeblueprint.co.uk
-Signed-off-by: Ingo Molnar <mingo@kernel.org>
---
- arch/x86/platform/efi/efi.c | 67 ++++++++++++++++++++++++++++++++++++++++++++-
- 1 file changed, 66 insertions(+), 1 deletion(-)
-
-diff --git a/arch/x86/platform/efi/efi.c b/arch/x86/platform/efi/efi.c
-index 1db84c0..6a28ded 100644
--- a/arch/x86/platform/efi/efi.c
-+++ b/arch/x86/platform/efi/efi.c
-@@ -705,6 +705,70 @@ out:
- }
- 
- /*
-+ * Iterate the EFI memory map in reverse order because the regions
-+ * will be mapped top-down. The end result is the same as if we had
-+ * mapped things forward, but doesn't require us to change the
-+ * existing implementation of efi_map_region().
-+ */
-+static inline void *efi_map_next_entry_reverse(void *entry)
-+{
-+	/* Initial call */
-+	if (!entry)
-+		return memmap.map_end - memmap.desc_size;
-+
-+	entry -= memmap.desc_size;
-+	if (entry < memmap.map)
-+		return NULL;
-+
-+	return entry;
-+}
-+
-+/*
-+ * efi_map_next_entry - Return the next EFI memory map descriptor
-+ * @entry: Previous EFI memory map descriptor
-+ *
-+ * This is a helper function to iterate over the EFI memory map, which
-+ * we do in different orders depending on the current configuration.
-+ *
-+ * To begin traversing the memory map @entry must be %NULL.
-+ *
-+ * Returns %NULL when we reach the end of the memory map.
-+ */
-+static void *efi_map_next_entry(void *entry)
-+{
-+	if (!efi_enabled(EFI_OLD_MEMMAP) && efi_enabled(EFI_64BIT)) {
-+		/*
-+		 * Starting in UEFI v2.5 the EFI_PROPERTIES_TABLE
-+		 * config table feature requires us to map all entries
-+		 * in the same order as they appear in the EFI memory
-+		 * map. That is to say, entry N must have a lower
-+		 * virtual address than entry N+1. This is because the
-+		 * firmware toolchain leaves relative references in
-+		 * the code/data sections, which are split and become
-+		 * separate EFI memory regions. Mapping things
-+		 * out-of-order leads to the firmware accessing
-+		 * unmapped addresses.
-+		 *
-+		 * Since we need to map things this way whether or not
-+		 * the kernel actually makes use of
-+		 * EFI_PROPERTIES_TABLE, let's just switch to this
-+		 * scheme by default for 64-bit.
-+		 */
-+		return efi_map_next_entry_reverse(entry);
-+	}
-+
-+	/* Initial call */
-+	if (!entry)
-+		return memmap.map;
-+
-+	entry += memmap.desc_size;
-+	if (entry >= memmap.map_end)
-+		return NULL;
-+
-+	return entry;
-+}
-+
-+/*
-  * Map the efi memory ranges of the runtime services and update new_mmap with
-  * virtual addresses.
-  */
-@@ -714,7 +778,8 @@ static void * __init efi_map_regions(int *count, int *pg_shift)
- 	unsigned long left = 0;
- 	efi_memory_desc_t *md;
- 
-	for (p = memmap.map; p < memmap.map_end; p += memmap.desc_size) {
-+	p = NULL;
-+	while ((p = efi_map_next_entry(p))) {
- 		md = p;
- 		if (!(md->attribute & EFI_MEMORY_RUNTIME)) {
- #ifdef CONFIG_X86_64
-- 
-2.6.0
-
@@ -0,0 +1,92 @@
+From 8a53554e12e98d1759205afd7b8e9e2ea0936f48 Mon Sep 17 00:00:00 2001
+From: =?UTF-8?q?K=C5=91v=C3=A1g=C3=B3=2C=20Zolt=C3=A1n?=
+ <dirty.ice.hu@gmail.com>
+Date: Mon, 12 Oct 2015 15:13:56 +0100
+Subject: [PATCH] x86/efi: Fix multiple GOP device support
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+When multiple GOP devices exists, but none of them implements
+ConOut, the code should just choose the first GOP (according to
+the comments). But currently 'fb_base' will refer to the last GOP,
+while other parameters to the first GOP, which will likely
+result in a garbled display.
+
+I can reliably reproduce this bug using my ASRock Z87M Extreme4
+motherboard with CSM and integrated GPU disabled, and two PCIe
+video cards (NVidia GT640 and GTX980), booting from efi-stub
+(booting from grub works fine).  On the primary display the
+ASRock logo remains and on the secondary screen it is garbled
+up completely.
+
+Signed-off-by: Kővágó, Zoltán <DirtY.iCE.hu@gmail.com>
+Signed-off-by: Matt Fleming <matt.fleming@intel.com>
+Cc: <stable@vger.kernel.org>
+Cc: Linus Torvalds <torvalds@linux-foundation.org>
+Cc: Matthew Garrett <mjg59@srcf.ucam.org>
+Cc: Peter Zijlstra <peterz@infradead.org>
+Cc: Thomas Gleixner <tglx@linutronix.de>
+Link: http://lkml.kernel.org/r/1444659236-24837-2-git-send-email-matt@codeblueprint.co.uk
+Signed-off-by: Ingo Molnar <mingo@kernel.org>
+---
+ arch/x86/boot/compressed/eboot.c | 8 ++++++--
+ 1 file changed, 6 insertions(+), 2 deletions(-)
+
+diff --git a/arch/x86/boot/compressed/eboot.c b/arch/x86/boot/compressed/eboot.c
+index ee1b6d3..db51c1f 100644
+--- a/arch/x86/boot/compressed/eboot.c
+++ b/arch/x86/boot/compressed/eboot.c
+@@ -667,6 +667,7 @@ setup_gop32(struct screen_info *si, efi_guid_t *proto,
+ 		bool conout_found = false;
+ 		void *dummy = NULL;
+ 		u32 h = handles[i];
+		u32 current_fb_base;
+ 
+ 		status = efi_call_early(handle_protocol, h,
+ 					proto, (void **)&gop32);
+@@ -678,7 +679,7 @@ setup_gop32(struct screen_info *si, efi_guid_t *proto,
+ 		if (status == EFI_SUCCESS)
+ 			conout_found = true;
+ 
+-		status = __gop_query32(gop32, &info, &size, &fb_base);
+		status = __gop_query32(gop32, &info, &size, &current_fb_base);
+ 		if (status == EFI_SUCCESS && (!first_gop || conout_found)) {
+ 			/*
+ 			 * Systems that use the UEFI Console Splitter may
+@@ -692,6 +693,7 @@ setup_gop32(struct screen_info *si, efi_guid_t *proto,
+ 			pixel_format = info->pixel_format;
+ 			pixel_info = info->pixel_information;
+ 			pixels_per_scan_line = info->pixels_per_scan_line;
+			fb_base = current_fb_base;
+ 
+ 			/*
+ 			 * Once we've found a GOP supporting ConOut,
+@@ -770,6 +772,7 @@ setup_gop64(struct screen_info *si, efi_guid_t *proto,
+ 		bool conout_found = false;
+ 		void *dummy = NULL;
+ 		u64 h = handles[i];
+		u32 current_fb_base;
+ 
+ 		status = efi_call_early(handle_protocol, h,
+ 					proto, (void **)&gop64);
+@@ -781,7 +784,7 @@ setup_gop64(struct screen_info *si, efi_guid_t *proto,
+ 		if (status == EFI_SUCCESS)
+ 			conout_found = true;
+ 
+-		status = __gop_query64(gop64, &info, &size, &fb_base);
+		status = __gop_query64(gop64, &info, &size, &current_fb_base);
+ 		if (status == EFI_SUCCESS && (!first_gop || conout_found)) {
+ 			/*
+ 			 * Systems that use the UEFI Console Splitter may
+@@ -795,6 +798,7 @@ setup_gop64(struct screen_info *si, efi_guid_t *proto,
+ 			pixel_format = info->pixel_format;
+ 			pixel_info = info->pixel_information;
+ 			pixels_per_scan_line = info->pixels_per_scan_line;
+			fb_base = current_fb_base;
+ 
+ 			/*
+ 			 * Once we've found a GOP supporting ConOut,
+-- 
+2.6.2
+
@@ -28,15 +28,14 @@
        </BuildDependencies>
        <Patches>
            <!-- Linux patches -->
-            <Patch level="1" compressionType="xz">patches/linux/patch-4.2.3.xz</Patch>
-            <!-- Mageia Linux patches // compatible with http://svnweb.mageia.org/packages/cauldron/kernel/releases/4.2.3/1.mga6/PATCHES/patches/series-->
+            <Patch level="1" compressionType="xz">patches/linux/patch-4.2.4.xz</Patch>
+            <!-- Mageia Linux patches // compatible with http://svnweb.mageia.org/packages/cauldron/kernel/releases/4.2.4/1.mga6/PATCHES/patches/series-->
            <Patch level="1">patches/mageia/x86-pci-toshiba-equium-a60-assign-busses.patch</Patch>
            <Patch level="1">patches/mageia/x86-boot-video-80x25-if-break.patch</Patch>
            <Patch level="1">patches/mageia/x86-default_poweroff_up_machines.patch</Patch>
            <Patch level="1">patches/mageia/x86-increase-default-minimum-vmalloc-area-by-64MB-to-192MB.patch</Patch>
            <Patch level="1">patches/mageia/Revert-cpufreq-pcc-Enable-autoload-of-pcc-cpufreq-fo.patch</Patch>
-            <Patch level="1">patches/mageia/x86-efi-Fix-boot-crash-by-mapping-EFI-memmap-entries.patch</Patch>
-            <Patch level="1">patches/mageia/cpu-cacheinfo-Fix-teardown-path.patch</Patch>
+            <Patch level="1">patches/mageia/x86-efi-Fix-multiple-GOP-device-support.patch</Patch>
            <Patch level="1">patches/mageia/pci-add-ALI-M5229-ide-compatibility-mode-quirk.patch</Patch>
            <Patch level="1">patches/mageia/pci-quirks-drop-devinit-exit.patch</Patch>
            <Patch level="1">patches/mageia/acpi-CLEVO-M360S-disable_acpi_irq.patch</Patch>
@@ -56,8 +55,7 @@
            <Patch level="1">patches/mageia/block-Make-CFQ-default-to-IOPS-mode-on-SSDs.patch</Patch>
            <Patch level="1">patches/mageia/fs-aufs4.patch</Patch>
            <Patch level="1">patches/mageia/fs-aufs4-modular.patch</Patch>
-            <Patch level="1">patches/mageia/fs-dcache-Handle-escaped-paths-in-prepend_path.patch</Patch>
-            <Patch level="1">patches/mageia/fs-vfs-Test-for-and-handle-paths-that-are-unreachable-from-their-mnt_root.patch</Patch>
+            <Patch level="1">patches/mageia/fs-btrfs-fix-possible-leak-in-btrfs_ioctl_balance.patch</Patch>
            <Patch level="1">patches/mageia/firewire-ieee1394-module-aliases.patch</Patch>
            <Patch level="1">patches/mageia/char-agp-intel-new-Q57-id.patch</Patch>
            <Patch level="1">patches/mageia/gpu-drm-mach64.patch</Patch>
@@ -73,11 +71,12 @@
            <Patch level="1">patches/mageia/gpu-drm-mach64-3.6-buildfix.patch</Patch>
            <Patch level="1">patches/mageia/gpu-drm-mach64-3.7-buildfix.patch</Patch>
            <Patch level="1">patches/mageia/gpu-drm-mach64-3.12-buildfix.patch</Patch>
-            <Patch level="1">patches/mageia/gpu-drm-mach64-restore-mach64_PCI_IDS.patch</Patch><!--deneme-->
+            <Patch level="1">patches/mageia/gpu-drm-mach64-restore-mach64_PCI_IDS.patch</Patch>
            <Patch level="1">patches/mageia/gpu-drm-mach64-linux-3.14-buildfix.patch</Patch>
            <Patch level="1">patches/mageia/gpu-drm-mach64-3.17-buildfix.patch</Patch>
            <Patch level="1">patches/mageia/gpu-drm-mach64-3.18-buildfix.patch</Patch>
            <Patch level="1">patches/mageia/input-i8042-quirks-for-Fujitsu-Lifebook-A544-and-Lif.patch</Patch>
+            <Patch level="1">patches/mageia/input-alps-Only-the-Dell-Latitude-D420_430_620_630-have-separate-stick-button-bits.patch</Patch>           
            <Patch level="1">patches/mageia/net-sis190-fix-list-usage.patch</Patch>
            <Patch level="1">patches/mageia/net-netfilter-IFWLOG.patch</Patch>
            <Patch level="1">patches/mageia/net-netfilter-IFWLOG-mdv.patch</Patch>
@@ -87,14 +86,9 @@
            <Patch level="1">patches/mageia/net-netfilter-IFWLOG-3.7-buildfix.patch</Patch>
            <Patch level="1">patches/mageia/net-netfilter-psd.patch</Patch>
            <Patch level="1">patches/mageia/net-netfilter-psd-mdv.patch</Patch>
-            <Patch level="1">patches/mageia/net-netfilter-psd-2.6.35-buildfix.patch</Patch>
-            <Patch level="1">patches/mageia/net-netfilter-conntrack-use-nf_ct_tmpl_free-in-CT-synpro.patch</Patch>
-            <Patch level="1">patches/mageia/net-netfilter-nfnetlink-work-around-wrong-endianess-in-r.patch</Patch>
-            <Patch level="1">patches/mageia/net-netfilter-bridge-fix-IPv6-packets-not-being-bridged-.patch</Patch>
-            <Patch level="1">patches/mageia/net-netfilter-nf_tables-Use-32-bit-addressing-register-f.patch</Patch>
-            <Patch level="1">patches/mageia/net-netfilter-ipset-Out-of-bound-access-in-hash-net-type.patch</Patch>
-            <Patch level="1">patches/mageia/net-netfilter-ipset-Fixing-unnamed-union-init.patch</Patch>
-            <Patch level="1">patches/mageia/net-wireless-rtlwifi-rtl8821ae-Fix-system-lockups-on-boot.patch</Patch>
+            <Patch level="1">patches/mageia/net-netfilter-psd-2.6.35-buildfix.patch</Patch>            
+            <Patch level="1">patches/mageia/net-wireless-rtlwifi-rtl8821ae-Fix-system-lockups-on-boot.patch</Patch>            
+            <Patch level="1">patches/mageia/net-wireless-iwlwifi-fix-firmware-filename-for-3160.patch</Patch>            
            <Patch level="1">patches/mageia/platform-x86-add-shuttle-wmi-driver.patch</Patch>
            <Patch level="1">patches/mageia/platform-x86-shuttle-wmi-drop-devinit-exit.patch</Patch>
            <Patch level="1">patches/mageia/platform-x86-shuttle-wmi-4.2-buildfix.patch</Patch>
@@ -103,8 +97,6 @@
            <Patch level="1">patches/mageia/hid-usbhid-IBM-BladeCenterHS20-quirk.patch</Patch>
            <Patch level="1">patches/mageia/usb-storage-unusual_devs-add-id.patch</Patch>
            <Patch level="1">patches/mageia/usb-storage-unusual_devs-add-id-2.6.37-buildfix.patch</Patch>
-            <Patch level="1">patches/mageia/usb-phy-phy-generic-Fix-reset-behaviour-on-legacy-bo.patch</Patch>
-            <Patch level="1">patches/mageia/usb-xhci-change-xhci-1.0-only-restrictions-to-support-xh.patch</Patch>
            <Patch level="1">patches/mageia/media-usb-pwc-lie-in-proc-usb-devices.patch</Patch>
            <Patch level="1">patches/mageia/3rd-3rdparty-1.0-tree.patch</Patch>
            <Patch level="1">patches/mageia/3rd-3rdparty-merge.patch</Patch>
@@ -191,7 +183,15 @@
        </Files>
    </Package>

-    <History>
+    <History>        
+         <Update release="64">
+            <Date>2015-11-26</Date>
+            <Version>4.2.4</Version>
+            <Comment>Version bump to 4.2.4 https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.2.4</Comment>
+            <Type package="kernel">security</Type>
+            <Name>Ertuğrul Erata</Name>
+            <Email>ertugrulerata@gmail.com</Email>
+         </Update>
         <Update release="63">
            <Date>2015-10-04</Date>
            <Version>4.2.3</Version>