Merge pull request #415 from ertugerata/kernel-4.4

Kernel 4.4.8
2016-04-30 09:52:20 +03:00
parent 47d6f3975b d315eb6f6b
commit 7c179631de
37 changed files with 9842 additions and 11072 deletions
@@ -1,6 +1,6 @@
 #
 # Automatically generated file; DO NOT EDIT.
-# Linux/x86_64 4.4.4 Kernel Configuration
+# Linux/x86_64 4.4.8 Kernel Configuration
 #
 CONFIG_64BIT=y
 CONFIG_X86_64=y
@@ -0,0 +1,197 @@
 From 43034bc4606f1f21186ca6fe27bc0448159d5e00 Mon Sep 17 00:00:00 2001
 From: Thomas Backlund <tmb@mageia.org>
 Date: Thu, 10 Mar 2016 15:44:13 +0200
 Subject: [PATCH] Revert "ipmi: Start the timer and thread on internal msgs"
 This reverts commit 0cfec916e86d881e209de4b4ae9959a6271e6660.
 It's reported on ipmi list that Dell R720xd servers will always panic
 on dell ipmi services load
 Reverting this fixes the issue.
 Signed-off-by: Thomas Backlund <tmb@mageia.org>
 ---
 drivers/char/ipmi/ipmi_si_intf.c | 73 ++++++++++++++++------------------------
 1 file changed, 29 insertions(+), 44 deletions(-)
 diff --git a/drivers/char/ipmi/ipmi_si_intf.c b/drivers/char/ipmi/ipmi_si_intf.c
 index 4cc72fa..f667be8 100644
 --- a/drivers/char/ipmi/ipmi_si_intf.c
 +++ b/drivers/char/ipmi/ipmi_si_intf.c
@@ -412,42 +412,18 @@ static enum si_sm_result start_next_msg(struct smi_info *smi_info)
 	return rv;
 }
 -static void smi_mod_timer(struct smi_info *smi_info, unsigned long new_val)
 -{
 -	smi_info->last_timeout_jiffies = jiffies;
 -	mod_timer(&smi_info->si_timer, new_val);
 -	smi_info->timer_running = true;
 -}
 -
 -/*
 - * Start a new message and (re)start the timer and thread.
 - */
 -static void start_new_msg(struct smi_info *smi_info, unsigned char *msg,
 -			  unsigned int size)
 -{
 -	smi_mod_timer(smi_info, jiffies + SI_TIMEOUT_JIFFIES);
 -
 -	if (smi_info->thread)
 -		wake_up_process(smi_info->thread);
 -
 -	smi_info->handlers->start_transaction(smi_info->si_sm, msg, size);
 -}
 -
 -static void start_check_enables(struct smi_info *smi_info, bool start_timer)
 +static void start_check_enables(struct smi_info *smi_info)
 {
 	unsigned char msg[2];
 	msg[0] = (IPMI_NETFN_APP_REQUEST << 2);
 	msg[1] = IPMI_GET_BMC_GLOBAL_ENABLES_CMD;
 -	if (start_timer)
 -		start_new_msg(smi_info, msg, 2);
 -	else
 -		smi_info->handlers->start_transaction(smi_info->si_sm, msg, 2);
 +	smi_info->handlers->start_transaction(smi_info->si_sm, msg, 2);
 	smi_info->si_state = SI_CHECKING_ENABLES;
 }
 -static void start_clear_flags(struct smi_info *smi_info, bool start_timer)
 +static void start_clear_flags(struct smi_info *smi_info)
 {
 	unsigned char msg[3];
@@ -456,10 +432,7 @@ static void start_clear_flags(struct smi_info *smi_info, bool start_timer)
 	msg[1] = IPMI_CLEAR_MSG_FLAGS_CMD;
 	msg[2] = WDT_PRE_TIMEOUT_INT;
 -	if (start_timer)
 -		start_new_msg(smi_info, msg, 3);
 -	else
 -		smi_info->handlers->start_transaction(smi_info->si_sm, msg, 3);
 +	smi_info->handlers->start_transaction(smi_info->si_sm, msg, 3);
 	smi_info->si_state = SI_CLEARING_FLAGS;
 }
@@ -469,8 +442,10 @@ static void start_getting_msg_queue(struct smi_info *smi_info)
 	smi_info->curr_msg->data[1] = IPMI_GET_MSG_CMD;
 	smi_info->curr_msg->data_size = 2;
 -	start_new_msg(smi_info, smi_info->curr_msg->data,
 -		      smi_info->curr_msg->data_size);
 +	smi_info->handlers->start_transaction(
 +		smi_info->si_sm,
 +		smi_info->curr_msg->data,
 +		smi_info->curr_msg->data_size);
 	smi_info->si_state = SI_GETTING_MESSAGES;
 }
@@ -480,11 +455,20 @@ static void start_getting_events(struct smi_info *smi_info)
 	smi_info->curr_msg->data[1] = IPMI_READ_EVENT_MSG_BUFFER_CMD;
 	smi_info->curr_msg->data_size = 2;
 -	start_new_msg(smi_info, smi_info->curr_msg->data,
 -		      smi_info->curr_msg->data_size);
 +	smi_info->handlers->start_transaction(
 +		smi_info->si_sm,
 +		smi_info->curr_msg->data,
 +		smi_info->curr_msg->data_size);
 	smi_info->si_state = SI_GETTING_EVENTS;
 }
 +static void smi_mod_timer(struct smi_info *smi_info, unsigned long new_val)
 +{
 +	smi_info->last_timeout_jiffies = jiffies;
 +	mod_timer(&smi_info->si_timer, new_val);
 +	smi_info->timer_running = true;
 +}
 +
 /*
  * When we have a situtaion where we run out of memory and cannot
  * allocate messages, we just leave them in the BMC and run the system
@@ -494,11 +478,11 @@ static void start_getting_events(struct smi_info *smi_info)
  * Note that we cannot just use disable_irq(), since the interrupt may
  * be shared.
  */
 -static inline bool disable_si_irq(struct smi_info *smi_info, bool start_timer)
 +static inline bool disable_si_irq(struct smi_info *smi_info)
 {
 	if ((smi_info->irq) && (!smi_info->interrupt_disabled)) {
 		smi_info->interrupt_disabled = true;
 -		start_check_enables(smi_info, start_timer);
 +		start_check_enables(smi_info);
 		return true;
 	}
 	return false;
@@ -508,7 +492,7 @@ static inline bool enable_si_irq(struct smi_info *smi_info)
 {
 	if ((smi_info->irq) && (smi_info->interrupt_disabled)) {
 		smi_info->interrupt_disabled = false;
 -		start_check_enables(smi_info, true);
 +		start_check_enables(smi_info);
 		return true;
 	}
 	return false;
@@ -526,7 +510,7 @@ static struct ipmi_smi_msg *alloc_msg_handle_irq(struct smi_info *smi_info)
 	msg = ipmi_alloc_smi_msg();
 	if (!msg) {
 -		if (!disable_si_irq(smi_info, true))
 +		if (!disable_si_irq(smi_info))
 			smi_info->si_state = SI_NORMAL;
 	} else if (enable_si_irq(smi_info)) {
 		ipmi_free_smi_msg(msg);
@@ -542,7 +526,7 @@ static void handle_flags(struct smi_info *smi_info)
 		/* Watchdog pre-timeout */
 		smi_inc_stat(smi_info, watchdog_pretimeouts);
 -		start_clear_flags(smi_info, true);
 +		start_clear_flags(smi_info);
 		smi_info->msg_flags &= ~WDT_PRE_TIMEOUT_INT;
 		if (smi_info->intf)
 			ipmi_smi_watchdog_pretimeout(smi_info->intf);
@@ -895,7 +879,8 @@ static enum si_sm_result smi_event_handler(struct smi_info *smi_info,
 			msg[0] = (IPMI_NETFN_APP_REQUEST << 2);
 			msg[1] = IPMI_GET_MSG_FLAGS_CMD;
 -			start_new_msg(smi_info, msg, 2);
 +			smi_info->handlers->start_transaction(
 +				smi_info->si_sm, msg, 2);
 			smi_info->si_state = SI_GETTING_FLAGS;
 			goto restart;
 		}
@@ -925,7 +910,7 @@ static enum si_sm_result smi_event_handler(struct smi_info *smi_info,
 		 * disable and messages disabled.
 		 */
 		if (smi_info->supports_event_msg_buff || smi_info->irq) {
 -			start_check_enables(smi_info, true);
 +			start_check_enables(smi_info);
 		} else {
 			smi_info->curr_msg = alloc_msg_handle_irq(smi_info);
 			if (!smi_info->curr_msg)
@@ -3635,7 +3620,7 @@ static int try_smi_init(struct smi_info *new_smi)
 	 * Start clearing the flags before we enable interrupts or the
 	 * timer to avoid racing with the timer.
 	 */
 -	start_clear_flags(new_smi, false);
 +	start_clear_flags(new_smi);
 	/*
 	 * IRQ is defined to be set when non-zero.  req_events will
@@ -3930,7 +3915,7 @@ static void cleanup_one_si(struct smi_info *to_clean)
 		poll(to_clean);
 		schedule_timeout_uninterruptible(1);
 	}
 -	disable_si_irq(to_clean, false);
 +	disable_si_irq(to_clean);
 	while (to_clean->curr_msg || (to_clean->si_state != SI_NORMAL)) {
 		poll(to_clean);
 		schedule_timeout_uninterruptible(1);
 -- 
 2.7.2
@@ -1,44 +0,0 @@
 From f5bdd66c705484b4bc77eb914be15c1b7881fae7 Mon Sep 17 00:00:00 2001
 From: Alexandra Yates <alexandra.yates@linux.intel.com>
 Date: Wed, 17 Feb 2016 19:36:20 -0800
 Subject: [PATCH] Adding Intel Lewisburg device IDs for SATA
 This patch complements the list of device IDs previously
 added for lewisburg sata.
 Signed-off-by: Alexandra Yates <alexandra.yates@linux.intel.com>
 Signed-off-by: Tejun Heo <tj@kernel.org>
 Cc: stable@vger.kernel.org
 ---
 drivers/ata/ahci.c | 6 ++++++
 1 file changed, 6 insertions(+)
 diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
 index 546a369..b6263b3 100644
 --- a/drivers/ata/ahci.c
 +++ b/drivers/ata/ahci.c
@@ -367,15 +367,21 @@ static const struct pci_device_id ahci_pci_tbl[] = {
 	{ PCI_VDEVICE(INTEL, 0xa107), board_ahci }, /* Sunrise Point-H RAID */
 	{ PCI_VDEVICE(INTEL, 0xa10f), board_ahci }, /* Sunrise Point-H RAID */
 	{ PCI_VDEVICE(INTEL, 0x2822), board_ahci }, /* Lewisburg RAID*/
 +	{ PCI_VDEVICE(INTEL, 0x2823), board_ahci }, /* Lewisburg AHCI*/
 	{ PCI_VDEVICE(INTEL, 0x2826), board_ahci }, /* Lewisburg RAID*/
 +	{ PCI_VDEVICE(INTEL, 0x2827), board_ahci }, /* Lewisburg RAID*/
 	{ PCI_VDEVICE(INTEL, 0xa182), board_ahci }, /* Lewisburg AHCI*/
 	{ PCI_VDEVICE(INTEL, 0xa184), board_ahci }, /* Lewisburg RAID*/
 	{ PCI_VDEVICE(INTEL, 0xa186), board_ahci }, /* Lewisburg RAID*/
 	{ PCI_VDEVICE(INTEL, 0xa18e), board_ahci }, /* Lewisburg RAID*/
 +	{ PCI_VDEVICE(INTEL, 0xa1d2), board_ahci }, /* Lewisburg RAID*/
 +	{ PCI_VDEVICE(INTEL, 0xa1d6), board_ahci }, /* Lewisburg RAID*/
 	{ PCI_VDEVICE(INTEL, 0xa202), board_ahci }, /* Lewisburg AHCI*/
 	{ PCI_VDEVICE(INTEL, 0xa204), board_ahci }, /* Lewisburg RAID*/
 	{ PCI_VDEVICE(INTEL, 0xa206), board_ahci }, /* Lewisburg RAID*/
 	{ PCI_VDEVICE(INTEL, 0xa20e), board_ahci }, /* Lewisburg RAID*/
 +	{ PCI_VDEVICE(INTEL, 0xa252), board_ahci }, /* Lewisburg RAID*/
 +	{ PCI_VDEVICE(INTEL, 0xa256), board_ahci }, /* Lewisburg RAID*/
 	/* JMicron 360/1/3/5/6, match class to avoid IDE function */
 	{ PCI_VENDOR_ID_JMICRON, PCI_ANY_ID, PCI_ANY_ID, PCI_ANY_ID,
 -- 
 2.7.2
@@ -1,45 +0,0 @@
 From dc8b4afc4a04fac8ee55a19b59f2356a25e7e778 Mon Sep 17 00:00:00 2001
 From: Manuel Lauss <manuel.lauss@gmail.com>
 Date: Sat, 27 Feb 2016 16:10:05 +0100
 Subject: [PATCH] ata: ahci: don't mark HotPlugCapable Ports as
 external/removable
 The HPCP bit is set by bioses for on-board sata ports either because
 they think sata is hotplug capable in general or to allow Windows
 to display a "device eject" icon on ports which are routed to an
 external connector bracket.
 However in Redhat Bugzilla #1310682, users report that with kernel 4.4,
 where this bit test first appeared, a lot of partitions on sata drives
 are now mounted automatically.
 This patch should fix redhat and a lot of other distros which
 unconditionally automount all devices which have the "removable"
 bit set.
 Signed-off-by: Manuel Lauss <manuel.lauss@gmail.com>
 Signed-off-by: Tejun Heo <tj@kernel.org>
 Fixes: 8a3e33cf92c7 ("ata: ahci: find eSATA ports and flag them as removable" changes userspace behavior)
 Link: http://lkml.kernel.org/g/56CF35FA.1070500@redhat.com
 Cc: stable@vger.kernel.org #v4.4+
 ---
 drivers/ata/libahci.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)
 diff --git a/drivers/ata/libahci.c b/drivers/ata/libahci.c
 index 513b3fa..85ea514 100644
 --- a/drivers/ata/libahci.c
 +++ b/drivers/ata/libahci.c
@@ -1168,8 +1168,7 @@ static void ahci_port_init(struct device *dev, struct ata_port *ap,
 	/* mark esata ports */
 	tmp = readl(port_mmio + PORT_CMD);
 -	if ((tmp & PORT_CMD_HPCP) ||
 -	    ((tmp & PORT_CMD_ESP) && (hpriv->cap & HOST_CAP_SXS)))
 +	if ((tmp & PORT_CMD_ESP) && (hpriv->cap & HOST_CAP_SXS))
 		ap->pflags |= ATA_PFLAG_EXTERNAL;
 }
 -- 
 2.7.2
@@ -1,39 +0,0 @@
 From 4ee34ea3a12396f35b26d90a094c75db95080baa Mon Sep 17 00:00:00 2001
 From: Harvey Hunt <harvey.hunt@imgtec.com>
 Date: Wed, 24 Feb 2016 15:16:43 +0000
 Subject: [PATCH] libata: Align ata_device's id on a cacheline
 The id buffer in ata_device is a DMA target, but it isn't explicitly
 cacheline aligned. Due to this, adjacent fields can be overwritten with
 stale data from memory on non coherent architectures. As a result, the
 kernel is sometimes unable to communicate with an ATA device.
 Fix this by ensuring that the id buffer is cacheline aligned.
 This issue is similar to that fixed by Commit 84bda12af31f
 ("libata: align ap->sector_buf").
 Signed-off-by: Harvey Hunt <harvey.hunt@imgtec.com>
 Cc: linux-kernel@vger.kernel.org
 Cc: <stable@vger.kernel.org> # 2.6.18
 Signed-off-by: Tejun Heo <tj@kernel.org>
 ---
 include/linux/libata.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/include/linux/libata.h b/include/linux/libata.h
 index bec2abb..2c4ebef 100644
 --- a/include/linux/libata.h
 +++ b/include/linux/libata.h
@@ -720,7 +720,7 @@ struct ata_device {
 	union {
 		u16		id[ATA_ID_WORDS]; /* IDENTIFY xxx DEVICE data */
 		u32		gscr[SATA_PMP_GSCR_DWORDS]; /* PMP GSCR block */
 -	};
 +	} ____cacheline_aligned;
 	/* DEVSLP Timing Variables from Identify Device Data Log */
 	u8			devslp_timing[ATA_LOG_DEVSLP_SIZE];
 -- 
 2.7.2
@@ -1,98 +0,0 @@
 From 287e6611ab1eac76c2c5ebf6e345e04c80ca9c61 Mon Sep 17 00:00:00 2001
 From: Arnd Bergmann <arnd@arndb.de>
 Date: Thu, 11 Feb 2016 14:16:27 +0100
 Subject: [PATCH] libata: fix HDIO_GET_32BIT ioctl
 As reported by Soohoon Lee, the HDIO_GET_32BIT ioctl does not
 work correctly in compat mode with libata.
 I have investigated the issue further and found multiple problems
 that all appeared with the same commit that originally introduced
 HDIO_GET_32BIT handling in libata back in linux-2.6.8 and presumably
 also linux-2.4, as the code uses "copy_to_user(arg, &val, 1)" to copy
 a 'long' variable containing either 0 or 1 to user space.
 The problems with this are:
 * On big-endian machines, this will always write a zero because it
  stores the wrong byte into user space.
 * In compat mode, the upper three bytes of the variable are updated
  by the compat_hdio_ioctl() function, but they now contain
  uninitialized stack data.
 * The hdparm tool calling this ioctl uses a 'static long' variable
  to store the result. This means at least the upper bytes are
  initialized to zero, but calling another ioctl like HDIO_GET_MULTCOUNT
  would fill them with data that remains stale when the low byte
  is overwritten. Fortunately libata doesn't implement any of the
  affected ioctl commands, so this would only happen when we query
  both an IDE and an ATA device in the same command such as
  "hdparm -N -c /dev/hda /dev/sda"
 * The libata code for unknown reasons started using ATA_IOC_GET_IO32
  and ATA_IOC_SET_IO32 as aliases for HDIO_GET_32BIT and HDIO_SET_32BIT,
  while the ioctl commands that were added later use the normal
  HDIO_* names. This is harmless but rather confusing.
 This addresses all four issues by changing the code to use put_user()
 on an 'unsigned long' variable in HDIO_GET_32BIT, like the IDE subsystem
 does, and by clarifying the names of the ioctl commands.
 Signed-off-by: Arnd Bergmann <arnd@arndb.de>
 Reported-by: Soohoon Lee <Soohoon.Lee@f5.com>
 Tested-by: Soohoon Lee <Soohoon.Lee@f5.com>
 Cc: stable@vger.kernel.org
 Signed-off-by: Tejun Heo <tj@kernel.org>
 ---
 drivers/ata/libata-scsi.c | 11 +++++------
 include/linux/ata.h       |  4 ++--
 2 files changed, 7 insertions(+), 8 deletions(-)
 diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
 index 7e959f9..e417e1a 100644
 --- a/drivers/ata/libata-scsi.c
 +++ b/drivers/ata/libata-scsi.c
@@ -675,19 +675,18 @@ static int ata_ioc32(struct ata_port *ap)
 int ata_sas_scsi_ioctl(struct ata_port *ap, struct scsi_device *scsidev,
 		     int cmd, void __user *arg)
 {
 -	int val = -EINVAL, rc = -EINVAL;
 +	unsigned long val;
 +	int rc = -EINVAL;
 	unsigned long flags;
 	switch (cmd) {
 -	case ATA_IOC_GET_IO32:
 +	case HDIO_GET_32BIT:
 		spin_lock_irqsave(ap->lock, flags);
 		val = ata_ioc32(ap);
 		spin_unlock_irqrestore(ap->lock, flags);
 -		if (copy_to_user(arg, &val, 1))
 -			return -EFAULT;
 -		return 0;
 +		return put_user(val, (unsigned long __user *)arg);
 -	case ATA_IOC_SET_IO32:
 +	case HDIO_SET_32BIT:
 		val = (unsigned long) arg;
 		rc = 0;
 		spin_lock_irqsave(ap->lock, flags);
 diff --git a/include/linux/ata.h b/include/linux/ata.h
 index d2992bf..c1a2f34 100644
 --- a/include/linux/ata.h
 +++ b/include/linux/ata.h
@@ -487,8 +487,8 @@ enum ata_tf_protocols {
 };
 enum ata_ioctls {
 -	ATA_IOC_GET_IO32	= 0x309,
 -	ATA_IOC_SET_IO32	= 0x324,
 +	ATA_IOC_GET_IO32	= 0x309, /* HDIO_GET_32BIT */
 +	ATA_IOC_SET_IO32	= 0x324, /* HDIO_SET_32BIT */
 };
 /* core structures */
 -- 
 2.7.2
@@ -0,0 +1,32 @@
 List:       netfilter-devel
 Subject:    [PATCH nf] netfilter: x_tables: check for size overflow
 From:       Florian Westphal <fw () strlen ! de>
 Date:       2016-03-10 0:56:23
 Message-ID: 1457571383-25520-1-git-send-email-fw () strlen ! de
 Ben Hawkes says:
 integer overflow in xt_alloc_table_info, which on 32-bit systems can
 lead to small structure allocation and a copy_from_user based heap
 corruption.
 Reported-by: Ben Hawkes <hawkes@google.com>
 Signed-off-by: Florian Westphal <fw@strlen.de>
 ---
 net/netfilter/x_tables.c | 3 +++
 1 file changed, 3 insertions(+)
 diff --git a/net/netfilter/x_tables.c b/net/netfilter/x_tables.c
 index c8a0b7d..17a9a9f 100644
 --- a/net/netfilter/x_tables.c
 +++ b/net/netfilter/x_tables.c
@@ -659,6 +659,9 @@ struct xt_table_info *xt_alloc_table_info(unsigned int size)
 	struct xt_table_info *info = NULL;
 	size_t sz = sizeof(*info) + size;
 +	if (sz < size || sz < sizeof(*info))
 +		return NULL;
 +
 	/* Pedantry: prevent them from hitting BUG() in vmalloc.c --RR */
 	if ((SMP_ALIGN(size) >> PAGE_SHIFT) + 2 > totalram_pages)
 		return NULL;
 -- 
 2.4.10
@@ -0,0 +1,152 @@
 List:       netfilter-devel
 Subject:    [PATCH nf] netfilter: x_tables: deal with bogus nextoffset values
 From:       Florian Westphal <fw () strlen ! de>
 Date:       2016-03-10 0:56:02
 Message-ID: 1457571362-25441-1-git-send-email-fw () strlen ! de
 Ben Hawkes says:
 In the mark_source_chains function (net/ipv4/netfilter/ip_tables.c) it
 is possible for a user-supplied ipt_entry structure to have a large
 next_offset field. This field is not bounds checked prior to writing a
 counter value at the supplied offset.
 Problem is that xt_entry_foreach() macro stops iterating once e->next_offset
 is out of bounds, assuming this is the last entry.
 With malformed data thats not necessarily the case so we can
 write outside of allocated area later as we might not have walked the
 entire blob.
 Fix this by simplifying mark_source_chains -- it already has to check
 if nextoff is in range to catch invalid jumps, so just do the check
 when we move to a next entry as well.
 Signed-off-by: Florian Westphal <fw@strlen.de>
 ---
 net/ipv4/netfilter/arp_tables.c | 16 ++++++++--------
 net/ipv4/netfilter/ip_tables.c  | 15 ++++++++-------
 net/ipv6/netfilter/ip6_tables.c | 13 ++++++-------
 3 files changed, 22 insertions(+), 22 deletions(-)
 diff --git a/net/ipv4/netfilter/arp_tables.c b/net/ipv4/netfilter/arp_tables.c
 index b488cac..5a0b591 100644
 --- a/net/ipv4/netfilter/arp_tables.c
 +++ b/net/ipv4/netfilter/arp_tables.c
@@ -437,6 +437,10 @@ static int mark_source_chains(const struct xt_table_info *newinfo,
 				/* Move along one */
 				size = e->next_offset;
 +
 +				if (pos + size > newinfo->size - sizeof(*e))
 +					return 0;
 +
 				e = (struct arpt_entry *)
 					(entry0 + pos + size);
 				e->counters.pcnt = pos;
@@ -447,14 +451,6 @@ static int mark_source_chains(const struct xt_table_info *newinfo,
 				if (strcmp(t->target.u.user.name,
 					   XT_STANDARD_TARGET) == 0 &&
 				    newpos >= 0) {
 -					if (newpos > newinfo->size -
 -						sizeof(struct arpt_entry)) {
 -						duprintf("mark_source_chains: "
 -							"bad verdict (%i)\n",
 -								newpos);
 -						return 0;
 -					}
 -
 					/* This a jump; chase it. */
 					duprintf("Jump rule %u -> %u\n",
 						 pos, newpos);
@@ -462,6 +458,10 @@ static int mark_source_chains(const struct xt_table_info *newinfo,
 					/* ... this is a fallthru */
 					newpos = pos + e->next_offset;
 				}
 +
 +				if (newpos > newinfo->size - sizeof(*e))
 +					return 0;
 +
 				e = (struct arpt_entry *)
 					(entry0 + newpos);
 				e->counters.pcnt = pos;
 diff --git a/net/ipv4/netfilter/ip_tables.c b/net/ipv4/netfilter/ip_tables.c
 index b99affa..ceb995f 100644
 --- a/net/ipv4/netfilter/ip_tables.c
 +++ b/net/ipv4/netfilter/ip_tables.c
@@ -519,6 +519,10 @@ mark_source_chains(const struct xt_table_info *newinfo,
 				/* Move along one */
 				size = e->next_offset;
 +
 +				if (pos + size > newinfo->size - sizeof(*e))
 +					return 0;
 +
 				e = (struct ipt_entry *)
 					(entry0 + pos + size);
 				e->counters.pcnt = pos;
@@ -529,13 +533,6 @@ mark_source_chains(const struct xt_table_info *newinfo,
 				if (strcmp(t->target.u.user.name,
 					   XT_STANDARD_TARGET) == 0 &&
 				    newpos >= 0) {
 -					if (newpos > newinfo->size -
 -						sizeof(struct ipt_entry)) {
 -						duprintf("mark_source_chains: "
 -							"bad verdict (%i)\n",
 -								newpos);
 -						return 0;
 -					}
 					/* This a jump; chase it. */
 					duprintf("Jump rule %u -> %u\n",
 						 pos, newpos);
@@ -543,6 +540,10 @@ mark_source_chains(const struct xt_table_info *newinfo,
 					/* ... this is a fallthru */
 					newpos = pos + e->next_offset;
 				}
 +
 +				if (newpos > newinfo->size - sizeof(*e))
 +					return 0;
 +
 				e = (struct ipt_entry *)
 					(entry0 + newpos);
 				e->counters.pcnt = pos;
 diff --git a/net/ipv6/netfilter/ip6_tables.c b/net/ipv6/netfilter/ip6_tables.c
 index 99425cf..d88a794 100644
 --- a/net/ipv6/netfilter/ip6_tables.c
 +++ b/net/ipv6/netfilter/ip6_tables.c
@@ -531,6 +531,8 @@ mark_source_chains(const struct xt_table_info *newinfo,
 				/* Move along one */
 				size = e->next_offset;
 +				if (pos + size > newinfo->size - sizeof(*e))
 +					return 0;
 				e = (struct ip6t_entry *)
 					(entry0 + pos + size);
 				e->counters.pcnt = pos;
@@ -541,13 +543,6 @@ mark_source_chains(const struct xt_table_info *newinfo,
 				if (strcmp(t->target.u.user.name,
 					   XT_STANDARD_TARGET) == 0 &&
 				    newpos >= 0) {
 -					if (newpos > newinfo->size -
 -						sizeof(struct ip6t_entry)) {
 -						duprintf("mark_source_chains: "
 -							"bad verdict (%i)\n",
 -								newpos);
 -						return 0;
 -					}
 					/* This a jump; chase it. */
 					duprintf("Jump rule %u -> %u\n",
 						 pos, newpos);
@@ -555,6 +550,10 @@ mark_source_chains(const struct xt_table_info *newinfo,
 					/* ... this is a fallthru */
 					newpos = pos + e->next_offset;
 				}
 +
 +				if (newpos > newinfo->size - sizeof(*e))
 +					return 0;
 +
 				e = (struct ip6t_entry *)
 					(entry0 + newpos);
 				e->counters.pcnt = pos;
 -- 
 2.4.10
@@ -0,0 +1,250 @@
 From 759c01142a5d0f364a462346168a56de28a80f52 Mon Sep 17 00:00:00 2001
 From: Willy Tarreau <w@1wt.eu>
 Date: Mon, 18 Jan 2016 16:36:09 +0100
 Subject: [PATCH] pipe: limit the per-user amount of pages allocated in pipes
 On no-so-small systems, it is possible for a single process to cause an
 OOM condition by filling large pipes with data that are never read. A
 typical process filling 4000 pipes with 1 MB of data will use 4 GB of
 memory. On small systems it may be tricky to set the pipe max size to
 prevent this from happening.
 This patch makes it possible to enforce a per-user soft limit above
 which new pipes will be limited to a single page, effectively limiting
 them to 4 kB each, as well as a hard limit above which no new pipes may
 be created for this user. This has the effect of protecting the system
 against memory abuse without hurting other users, and still allowing
 pipes to work correctly though with less data at once.
 The limit are controlled by two new sysctls : pipe-user-pages-soft, and
 pipe-user-pages-hard. Both may be disabled by setting them to zero. The
 default soft limit allows the default number of FDs per process (1024)
 to create pipes of the default size (64kB), thus reaching a limit of 64MB
 before starting to create only smaller pipes. With 256 processes limited
 to 1024 FDs each, this results in 1024*64kB + (256*1024 - 1024) * 4kB =
 1084 MB of memory allocated for a user. The hard limit is disabled by
 default to avoid breaking existing applications that make intensive use
 of pipes (eg: for splicing).
 Reported-by: socketpair@gmail.com
 Reported-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
 Mitigates: CVE-2013-4312 (Linux 2.0+)
 Suggested-by: Linus Torvalds <torvalds@linux-foundation.org>
 Signed-off-by: Willy Tarreau <w@1wt.eu>
 Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
 ---
 Documentation/sysctl/fs.txt | 23 ++++++++++++++++++++++
 fs/pipe.c                   | 47 +++++++++++++++++++++++++++++++++++++++++++--
 include/linux/pipe_fs_i.h   |  4 ++++
 include/linux/sched.h       |  1 +
 kernel/sysctl.c             | 14 ++++++++++++++
 5 files changed, 87 insertions(+), 2 deletions(-)
 diff --git a/Documentation/sysctl/fs.txt b/Documentation/sysctl/fs.txt
 index 88152f2..302b5ed 100644
 --- a/Documentation/sysctl/fs.txt
 +++ b/Documentation/sysctl/fs.txt
@@ -32,6 +32,8 @@ Currently, these files are in /proc/sys/fs:
 - nr_open
 - overflowuid
 - overflowgid
 +- pipe-user-pages-hard
 +- pipe-user-pages-soft
 - protected_hardlinks
 - protected_symlinks
 - suid_dumpable
@@ -159,6 +161,27 @@ The default is 65534.
 ==============================================================
 +pipe-user-pages-hard:
 +
 +Maximum total number of pages a non-privileged user may allocate for pipes.
 +Once this limit is reached, no new pipes may be allocated until usage goes
 +below the limit again. When set to 0, no limit is applied, which is the default
 +setting.
 +
 +==============================================================
 +
 +pipe-user-pages-soft:
 +
 +Maximum total number of pages a non-privileged user may allocate for pipes
 +before the pipe size gets limited to a single page. Once this limit is reached,
 +new pipes will be limited to a single page in size for this user in order to
 +limit total memory usage, and trying to increase them using fcntl() will be
 +denied until usage goes below the limit again. The default value allows to
 +allocate up to 1024 pipes at their default size. When set to 0, no limit is
 +applied.
 +
 +==============================================================
 +
 protected_hardlinks:
 A long-standing class of security issues is the hardlink-based
 diff --git a/fs/pipe.c b/fs/pipe.c
 index 42cf8dd..ab8dad3 100644
 --- a/fs/pipe.c
 +++ b/fs/pipe.c
@@ -38,6 +38,12 @@ unsigned int pipe_max_size = 1048576;
  */
 unsigned int pipe_min_size = PAGE_SIZE;
 +/* Maximum allocatable pages per user. Hard limit is unset by default, soft
 + * matches default values.
 + */
 +unsigned long pipe_user_pages_hard;
 +unsigned long pipe_user_pages_soft = PIPE_DEF_BUFFERS * INR_OPEN_CUR;
 +
 /*
  * We use a start+len construction, which provides full use of the 
  * allocated memory.
@@ -583,20 +589,49 @@ pipe_fasync(int fd, struct file *filp, int on)
 	return retval;
 }
 +static void account_pipe_buffers(struct pipe_inode_info *pipe,
 +                                 unsigned long old, unsigned long new)
 +{
 +	atomic_long_add(new - old, &pipe->user->pipe_bufs);
 +}
 +
 +static bool too_many_pipe_buffers_soft(struct user_struct *user)
 +{
 +	return pipe_user_pages_soft &&
 +	       atomic_long_read(&user->pipe_bufs) >= pipe_user_pages_soft;
 +}
 +
 +static bool too_many_pipe_buffers_hard(struct user_struct *user)
 +{
 +	return pipe_user_pages_hard &&
 +	       atomic_long_read(&user->pipe_bufs) >= pipe_user_pages_hard;
 +}
 +
 struct pipe_inode_info *alloc_pipe_info(void)
 {
 	struct pipe_inode_info *pipe;
 	pipe = kzalloc(sizeof(struct pipe_inode_info), GFP_KERNEL);
 	if (pipe) {
 -		pipe->bufs = kzalloc(sizeof(struct pipe_buffer) * PIPE_DEF_BUFFERS, GFP_KERNEL);
 +		unsigned long pipe_bufs = PIPE_DEF_BUFFERS;
 +		struct user_struct *user = get_current_user();
 +
 +		if (!too_many_pipe_buffers_hard(user)) {
 +			if (too_many_pipe_buffers_soft(user))
 +				pipe_bufs = 1;
 +			pipe->bufs = kzalloc(sizeof(struct pipe_buffer) * pipe_bufs, GFP_KERNEL);
 +		}
 +
 		if (pipe->bufs) {
 			init_waitqueue_head(&pipe->wait);
 			pipe->r_counter = pipe->w_counter = 1;
 -			pipe->buffers = PIPE_DEF_BUFFERS;
 +			pipe->buffers = pipe_bufs;
 +			pipe->user = user;
 +			account_pipe_buffers(pipe, 0, pipe_bufs);
 			mutex_init(&pipe->mutex);
 			return pipe;
 		}
 +		free_uid(user);
 		kfree(pipe);
 	}
@@ -607,6 +642,8 @@ void free_pipe_info(struct pipe_inode_info *pipe)
 {
 	int i;
 +	account_pipe_buffers(pipe, pipe->buffers, 0);
 +	free_uid(pipe->user);
 	for (i = 0; i < pipe->buffers; i++) {
 		struct pipe_buffer *buf = pipe->bufs + i;
 		if (buf->ops)
@@ -998,6 +1035,7 @@ static long pipe_set_size(struct pipe_inode_info *pipe, unsigned long nr_pages)
 			memcpy(bufs + head, pipe->bufs, tail * sizeof(struct pipe_buffer));
 	}
 +	account_pipe_buffers(pipe, pipe->buffers, nr_pages);
 	pipe->curbuf = 0;
 	kfree(pipe->bufs);
 	pipe->bufs = bufs;
@@ -1069,6 +1107,11 @@ long pipe_fcntl(struct file *file, unsigned int cmd, unsigned long arg)
 		if (!capable(CAP_SYS_RESOURCE) && size > pipe_max_size) {
 			ret = -EPERM;
 			goto out;
 +		} else if ((too_many_pipe_buffers_hard(pipe->user) ||
 +			    too_many_pipe_buffers_soft(pipe->user)) &&
 +		           !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN)) {
 +			ret = -EPERM;
 +			goto out;
 		}
 		ret = pipe_set_size(pipe, nr_pages);
 		break;
 diff --git a/include/linux/pipe_fs_i.h b/include/linux/pipe_fs_i.h
 index eb8b8ac..24f5470 100644
 --- a/include/linux/pipe_fs_i.h
 +++ b/include/linux/pipe_fs_i.h
@@ -42,6 +42,7 @@ struct pipe_buffer {
  *	@fasync_readers: reader side fasync
  *	@fasync_writers: writer side fasync
  *	@bufs: the circular array of pipe buffers
 + *	@user: the user who created this pipe
  **/
 struct pipe_inode_info {
 	struct mutex mutex;
@@ -57,6 +58,7 @@ struct pipe_inode_info {
 	struct fasync_struct *fasync_readers;
 	struct fasync_struct *fasync_writers;
 	struct pipe_buffer *bufs;
 +	struct user_struct *user;
 };
 /*
@@ -123,6 +125,8 @@ void pipe_unlock(struct pipe_inode_info *);
 void pipe_double_lock(struct pipe_inode_info *, struct pipe_inode_info *);
 extern unsigned int pipe_max_size, pipe_min_size;
 +extern unsigned long pipe_user_pages_hard;
 +extern unsigned long pipe_user_pages_soft;
 int pipe_proc_fn(struct ctl_table *, int, void __user *, size_t *, loff_t *);
 diff --git a/include/linux/sched.h b/include/linux/sched.h
 index 61aa9bb..1589ddc8 100644
 --- a/include/linux/sched.h
 +++ b/include/linux/sched.h
@@ -835,6 +835,7 @@ struct user_struct {
 #endif
 	unsigned long locked_shm; /* How many pages of mlocked shm ? */
 	unsigned long unix_inflight;	/* How many files in flight in unix sockets */
 +	atomic_long_t pipe_bufs;  /* how many pages are allocated in pipe buffers */
 #ifdef CONFIG_KEYS
 	struct key *uid_keyring;	/* UID specific keyring */
 diff --git a/kernel/sysctl.c b/kernel/sysctl.c
 index c810f8a..f6fd236 100644
 --- a/kernel/sysctl.c
 +++ b/kernel/sysctl.c
@@ -1757,6 +1757,20 @@ static struct ctl_table fs_table[] = {
 		.proc_handler	= &pipe_proc_fn,
 		.extra1		= &pipe_min_size,
 	},
 +	{
 +		.procname	= "pipe-user-pages-hard",
 +		.data		= &pipe_user_pages_hard,
 +		.maxlen		= sizeof(pipe_user_pages_hard),
 +		.mode		= 0644,
 +		.proc_handler	= proc_doulongvec_minmax,
 +	},
 +	{
 +		.procname	= "pipe-user-pages-soft",
 +		.data		= &pipe_user_pages_soft,
 +		.maxlen		= sizeof(pipe_user_pages_soft),
 +		.mode		= 0644,
 +		.proc_handler	= proc_doulongvec_minmax,
 +	},
 	{ }
 };
 -- 
 2.7.2
@@ -14,27 +14,6 @@
 ###
 ### Stable Queue
 ###
 stable-use-d_seq-to-get-coherency-between-d_inode-and-d_flags.patch
 stable-drivers-sh-restore-legacy-clock-domain-on-superh-platforms.patch
 stable-btrfs-fix-deadlock-running-delayed-iputs-at-transaction-commit-time.patch
 stable-btrfs-fix-no_space-in-write-and-rm-loop.patch
 stable-btrfs-async-thread-fix-a-use-after-free-error-for-trace.patch
 stable-drm-amdgpu-mask-out-wc-from-bo-on-unsupported-arches.patch
 stable-block-initialize-max_dev_sectors-to-0.patch
 stable-pci-keystone-fix-msi-code-that-retrieves-struct-pcie_port-pointer.patch
 stable-parisc-fix-ptrace-syscall-number-and-return-value-modification.patch
 stable-mips-kvm-fix-ioctl-error-handling.patch
 stable-kvm-x86-update-tsc-multiplier-on-change.patch
 stable-fbcon-set-a-default-value-to-blink-interval.patch
 stable-cifs-fix-out-of-bounds-access-in-lease-parsing.patch
 stable-cifs-fix-smb2-interim-response-processing-for-read-requests.patch
 stable-fix-cifs_uniqueid_to_ino_t-function-for-s390x.patch
 stable-vfio-fix-ioctl-error-handling.patch
 stable-kvm-x86-fix-root-cause-for-missed-hardware-breakpoints.patch
 stable-arm-arm64-kvm-fix-ioctl-error-handling.patch
 stable-iommu-amd-apply-workaround-for-ats-write-permission-check.patch
 stable-iommu-amd-fix-boot-warning-when-device-00-00.0-is-not-iommu-covered.patch
 stable-iommu-vt-d-use-bus_notify_removed_device-in-hotplug-path.patch
 ###
 ### Arch x86
@@ -142,14 +121,13 @@ block-Make-CFQ-default-to-IOPS-mode-on-SSDs.patch
 # ahci ids
 ahci-add-new-Intel-device-IDs.patch
 ata-Adding-Intel-Lewisburg-device-IDs-for-SATA.patch
-# fix unwanted automounting of partitions
+###
-ata-ahci-don-t-mark-HotPlugCapable-Ports-as-external.patch
+### Char
 ###
-# libata fixes
+# hard locks Dell R720xd
-libata-Align-ata_device-s-id-on-a-cacheline.patch
+Revert-ipmi-Start-the-timer-and-thread-on-internal-m.patch
 libata-fix-HDIO_GET_32BIT-ioctl.patch
 ###
 ### File-system
@@ -162,6 +140,9 @@ fs-aufs-4.4-modular.patch
 # ovl fixes
 fs-ovl-move-super-block-magic-number-to-magic.h.patch
 # CVE-2016-2847
 pipe-limit-the-per-user-amount-of-pages-allocated-in-pipes_CVE-2016-2847.patch
 ###
 ### FireWire
 ###
@@ -272,6 +253,10 @@ net-netfilter-psd.patch
 net-netfilter-psd-mdv.patch
 net-netfilter-psd-2.6.35-buildfix.patch
 # CVE pending
 net-netfilter-x_tables-check-for-size-overflow.patch
 net-netfilter-x_tables-deal-with-bogus-nextoffset-values.patch
 ###
 ### Platform drivers
 ###
@@ -1,51 +0,0 @@
 From 4cad67fca3fc952d6f2ed9e799621f07666a560f Mon Sep 17 00:00:00 2001
 From: "Michael S. Tsirkin" <mst@redhat.com>
 Date: Sun, 28 Feb 2016 17:32:07 +0200
 Subject: arm/arm64: KVM: Fix ioctl error handling
 From: Michael S. Tsirkin <mst@redhat.com>
 commit 4cad67fca3fc952d6f2ed9e799621f07666a560f upstream.
 Calling return copy_to_user(...) in an ioctl will not
 do the right thing if there's a pagefault:
 copy_to_user returns the number of bytes not copied
 in this case.
 Fix up kvm to do
 	return copy_to_user(...)) ?  -EFAULT : 0;
 everywhere.
 Acked-by: Christoffer Dall <christoffer.dall@linaro.org>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Marc Zyngier <marc.zyngier@arm.com>
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 ---
 arch/arm/kvm/guest.c   |    2 +-
 arch/arm64/kvm/guest.c |    2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)
 --- a/arch/arm/kvm/guest.c
 +++ b/arch/arm/kvm/guest.c
@@ -155,7 +155,7 @@ static int get_timer_reg(struct kvm_vcpu
 	u64 val;
 	val = kvm_arm_timer_get_reg(vcpu, reg->id);
 -	return copy_to_user(uaddr, &val, KVM_REG_SIZE(reg->id));
 +	return copy_to_user(uaddr, &val, KVM_REG_SIZE(reg->id)) ? -EFAULT : 0;
 }
 static unsigned long num_core_regs(void)
 --- a/arch/arm64/kvm/guest.c
 +++ b/arch/arm64/kvm/guest.c
@@ -186,7 +186,7 @@ static int get_timer_reg(struct kvm_vcpu
 	u64 val;
 	val = kvm_arm_timer_get_reg(vcpu, reg->id);
 -	return copy_to_user(uaddr, &val, KVM_REG_SIZE(reg->id));
 +	return copy_to_user(uaddr, &val, KVM_REG_SIZE(reg->id)) ? -EFAULT : 0;
 }
 /**
@@ -1,36 +0,0 @@
 From 5f009d3f8e6685fe8c6215082c1696a08b411220 Mon Sep 17 00:00:00 2001
 From: Keith Busch <keith.busch@intel.com>
 Date: Wed, 10 Feb 2016 16:52:47 -0700
 Subject: block: Initialize max_dev_sectors to 0
 From: Keith Busch <keith.busch@intel.com>
 commit 5f009d3f8e6685fe8c6215082c1696a08b411220 upstream.
 The new queue limit is not used by the majority of block drivers, and
 should be initialized to 0 for the driver's requested settings to be used.
 Signed-off-by: Keith Busch <keith.busch@intel.com>
 Acked-by: Martin K. Petersen <martin.petersen@oracle.com>
 Reviewed-by: Sagi Grimberg <sagig@mellanox.com>
 Reviewed-by: Christoph Hellwig <hch@lst.de>
 Signed-off-by: Jens Axboe <axboe@fb.com>
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 ---
 block/blk-settings.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 --- a/block/blk-settings.c
 +++ b/block/blk-settings.c
@@ -91,8 +91,8 @@ void blk_set_default_limits(struct queue
 	lim->seg_boundary_mask = BLK_SEG_BOUNDARY_MASK;
 	lim->virt_boundary_mask = 0;
 	lim->max_segment_size = BLK_MAX_SEGMENT_SIZE;
 -	lim->max_sectors = lim->max_dev_sectors = lim->max_hw_sectors =
 -		BLK_SAFE_MAX_SECTORS;
 +	lim->max_sectors = lim->max_hw_sectors = BLK_SAFE_MAX_SECTORS;
 +	lim->max_dev_sectors = 0;
 	lim->chunk_sectors = 0;
 	lim->max_write_same_sectors = 0;
 	lim->max_discard_sectors = 0;
@@ -1,36 +0,0 @@
 From 0a95b851370b84a4b9d92ee6d1fa0926901d0454 Mon Sep 17 00:00:00 2001
 From: Qu Wenruo <quwenruo@cn.fujitsu.com>
 Date: Fri, 22 Jan 2016 09:28:38 +0800
 Subject: btrfs: async-thread: Fix a use-after-free error for trace
 From: Qu Wenruo <quwenruo@cn.fujitsu.com>
 commit 0a95b851370b84a4b9d92ee6d1fa0926901d0454 upstream.
 Parameter of trace_btrfs_work_queued() can be freed in its workqueue.
 So no one use use that pointer after queue_work().
 Fix the user-after-free bug by move the trace line before queue_work().
 Reported-by: Dave Jones <davej@codemonkey.org.uk>
 Signed-off-by: Qu Wenruo <quwenruo@cn.fujitsu.com>
 Reviewed-by: David Sterba <dsterba@suse.com>
 Signed-off-by: Chris Mason <clm@fb.com>
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 ---
 fs/btrfs/async-thread.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 --- a/fs/btrfs/async-thread.c
 +++ b/fs/btrfs/async-thread.c
@@ -328,8 +328,8 @@ static inline void __btrfs_queue_work(st
 		list_add_tail(&work->ordered_list, &wq->ordered_list);
 		spin_unlock_irqrestore(&wq->list_lock, flags);
 	}
 -	queue_work(wq->normal_wq, &work->normal_work);
 	trace_btrfs_work_queued(work);
 +	queue_work(wq->normal_wq, &work->normal_work);
 }
 void btrfs_queue_work(struct btrfs_workqueue *wq,
@@ -1,238 +0,0 @@
 From c2d6cb1636d235257086f939a8194ef0bf93af6e Mon Sep 17 00:00:00 2001
 From: Filipe Manana <fdmanana@suse.com>
 Date: Fri, 15 Jan 2016 11:05:12 +0000
 Subject: Btrfs: fix deadlock running delayed iputs at transaction commit time
 From: Filipe Manana <fdmanana@suse.com>
 commit c2d6cb1636d235257086f939a8194ef0bf93af6e upstream.
 While running a stress test I ran into a deadlock when running the delayed
 iputs at transaction time, which produced the following report and trace:
 [  886.399989] =============================================
 [  886.400871] [ INFO: possible recursive locking detected ]
 [  886.401663] 4.4.0-rc6-btrfs-next-18+ #1 Not tainted
 [  886.402384] ---------------------------------------------
 [  886.403182] fio/8277 is trying to acquire lock:
 [  886.403568]  (&fs_info->delayed_iput_sem){++++..}, at: [<ffffffffa0538823>] btrfs_run_delayed_iputs+0x36/0xbf [btrfs]
 [  886.403568]
 [  886.403568] but task is already holding lock:
 [  886.403568]  (&fs_info->delayed_iput_sem){++++..}, at: [<ffffffffa0538823>] btrfs_run_delayed_iputs+0x36/0xbf [btrfs]
 [  886.403568]
 [  886.403568] other info that might help us debug this:
 [  886.403568]  Possible unsafe locking scenario:
 [  886.403568]
 [  886.403568]        CPU0
 [  886.403568]        ----
 [  886.403568]   lock(&fs_info->delayed_iput_sem);
 [  886.403568]   lock(&fs_info->delayed_iput_sem);
 [  886.403568]
 [  886.403568]  *** DEADLOCK ***
 [  886.403568]
 [  886.403568]  May be due to missing lock nesting notation
 [  886.403568]
 [  886.403568] 3 locks held by fio/8277:
 [  886.403568]  #0:  (sb_writers#11){.+.+.+}, at: [<ffffffff81174c4c>] __sb_start_write+0x5f/0xb0
 [  886.403568]  #1:  (&sb->s_type->i_mutex_key#15){+.+.+.}, at: [<ffffffffa054620d>] btrfs_file_write_iter+0x73/0x408 [btrfs]
 [  886.403568]  #2:  (&fs_info->delayed_iput_sem){++++..}, at: [<ffffffffa0538823>] btrfs_run_delayed_iputs+0x36/0xbf [btrfs]
 [  886.403568]
 [  886.403568] stack backtrace:
 [  886.403568] CPU: 6 PID: 8277 Comm: fio Not tainted 4.4.0-rc6-btrfs-next-18+ #1
 [  886.403568] Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS by qemu-project.org 04/01/2014
 [  886.403568]  0000000000000000 ffff88009f80f770 ffffffff8125d4fd ffffffff82af1fc0
 [  886.403568]  ffff88009f80f830 ffffffff8108e5f9 0000000200000000 ffff88009fd92290
 [  886.403568]  0000000000000000 ffffffff82af1fc0 ffffffff829cfb01 00042b216d008804
 [  886.403568] Call Trace:
 [  886.403568]  [<ffffffff8125d4fd>] dump_stack+0x4e/0x79
 [  886.403568]  [<ffffffff8108e5f9>] __lock_acquire+0xd42/0xf0b
 [  886.403568]  [<ffffffff810c22db>] ? __module_address+0xdf/0x108
 [  886.403568]  [<ffffffff8108eb77>] lock_acquire+0x10d/0x194
 [  886.403568]  [<ffffffff8108eb77>] ? lock_acquire+0x10d/0x194
 [  886.403568]  [<ffffffffa0538823>] ? btrfs_run_delayed_iputs+0x36/0xbf [btrfs]
 [  886.489542]  [<ffffffff8148556b>] down_read+0x3e/0x4d
 [  886.489542]  [<ffffffffa0538823>] ? btrfs_run_delayed_iputs+0x36/0xbf [btrfs]
 [  886.489542]  [<ffffffffa0538823>] btrfs_run_delayed_iputs+0x36/0xbf [btrfs]
 [  886.489542]  [<ffffffffa0533953>] btrfs_commit_transaction+0x8f5/0x96e [btrfs]
 [  886.489542]  [<ffffffffa0521d7a>] flush_space+0x435/0x44a [btrfs]
 [  886.489542]  [<ffffffffa052218b>] ? reserve_metadata_bytes+0x26a/0x384 [btrfs]
 [  886.489542]  [<ffffffffa05221ae>] reserve_metadata_bytes+0x28d/0x384 [btrfs]
 [  886.489542]  [<ffffffffa052256c>] ? btrfs_block_rsv_refill+0x58/0x96 [btrfs]
 [  886.489542]  [<ffffffffa0522584>] btrfs_block_rsv_refill+0x70/0x96 [btrfs]
 [  886.489542]  [<ffffffffa053d747>] btrfs_evict_inode+0x394/0x55a [btrfs]
 [  886.489542]  [<ffffffff81188e31>] evict+0xa7/0x15c
 [  886.489542]  [<ffffffff81189878>] iput+0x1d3/0x266
 [  886.489542]  [<ffffffffa053887c>] btrfs_run_delayed_iputs+0x8f/0xbf [btrfs]
 [  886.489542]  [<ffffffffa0533953>] btrfs_commit_transaction+0x8f5/0x96e [btrfs]
 [  886.489542]  [<ffffffff81085096>] ? signal_pending_state+0x31/0x31
 [  886.489542]  [<ffffffffa0521191>] btrfs_alloc_data_chunk_ondemand+0x1d7/0x288 [btrfs]
 [  886.489542]  [<ffffffffa0521282>] btrfs_check_data_free_space+0x40/0x59 [btrfs]
 [  886.489542]  [<ffffffffa05228f5>] btrfs_delalloc_reserve_space+0x1e/0x4e [btrfs]
 [  886.489542]  [<ffffffffa053620a>] btrfs_direct_IO+0x10c/0x27e [btrfs]
 [  886.489542]  [<ffffffff8111d9a1>] generic_file_direct_write+0xb3/0x128
 [  886.489542]  [<ffffffffa05463c3>] btrfs_file_write_iter+0x229/0x408 [btrfs]
 [  886.489542]  [<ffffffff8108ae38>] ? __lock_is_held+0x38/0x50
 [  886.489542]  [<ffffffff8117279e>] __vfs_write+0x7c/0xa5
 [  886.489542]  [<ffffffff81172cda>] vfs_write+0xa0/0xe4
 [  886.489542]  [<ffffffff811734cc>] SyS_write+0x50/0x7e
 [  886.489542]  [<ffffffff814872d7>] entry_SYSCALL_64_fastpath+0x12/0x6f
 [ 1081.852335] INFO: task fio:8244 blocked for more than 120 seconds.
 [ 1081.854348]       Not tainted 4.4.0-rc6-btrfs-next-18+ #1
 [ 1081.857560] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
 [ 1081.863227] fio        D ffff880213f9bb28     0  8244   8240 0x00000000
 [ 1081.868719]  ffff880213f9bb28 00ffffff810fc6b0 ffffffff0000000a ffff88023ed55240
 [ 1081.872499]  ffff880206b5d400 ffff880213f9c000 ffff88020a4d5318 ffff880206b5d400
 [ 1081.876834]  ffffffff00000001 ffff880206b5d400 ffff880213f9bb40 ffffffff81482ba4
 [ 1081.880782] Call Trace:
 [ 1081.881793]  [<ffffffff81482ba4>] schedule+0x7f/0x97
 [ 1081.883340]  [<ffffffff81485eb5>] rwsem_down_write_failed+0x2d5/0x325
 [ 1081.895525]  [<ffffffff8108d48d>] ? trace_hardirqs_on_caller+0x16/0x1ab
 [ 1081.897419]  [<ffffffff81269723>] call_rwsem_down_write_failed+0x13/0x20
 [ 1081.899251]  [<ffffffff81269723>] ? call_rwsem_down_write_failed+0x13/0x20
 [ 1081.901063]  [<ffffffff81089fae>] ? __down_write_nested.isra.0+0x1f/0x21
 [ 1081.902365]  [<ffffffff814855bd>] down_write+0x43/0x57
 [ 1081.903846]  [<ffffffffa05211b0>] ? btrfs_alloc_data_chunk_ondemand+0x1f6/0x288 [btrfs]
 [ 1081.906078]  [<ffffffffa05211b0>] btrfs_alloc_data_chunk_ondemand+0x1f6/0x288 [btrfs]
 [ 1081.908846]  [<ffffffff8108d461>] ? mark_held_locks+0x56/0x6c
 [ 1081.910409]  [<ffffffffa0521282>] btrfs_check_data_free_space+0x40/0x59 [btrfs]
 [ 1081.912482]  [<ffffffffa05228f5>] btrfs_delalloc_reserve_space+0x1e/0x4e [btrfs]
 [ 1081.914597]  [<ffffffffa053620a>] btrfs_direct_IO+0x10c/0x27e [btrfs]
 [ 1081.919037]  [<ffffffff8111d9a1>] generic_file_direct_write+0xb3/0x128
 [ 1081.920754]  [<ffffffffa05463c3>] btrfs_file_write_iter+0x229/0x408 [btrfs]
 [ 1081.922496]  [<ffffffff8108ae38>] ? __lock_is_held+0x38/0x50
 [ 1081.923922]  [<ffffffff8117279e>] __vfs_write+0x7c/0xa5
 [ 1081.925275]  [<ffffffff81172cda>] vfs_write+0xa0/0xe4
 [ 1081.926584]  [<ffffffff811734cc>] SyS_write+0x50/0x7e
 [ 1081.927968]  [<ffffffff814872d7>] entry_SYSCALL_64_fastpath+0x12/0x6f
 [ 1081.985293] INFO: lockdep is turned off.
 [ 1081.986132] INFO: task fio:8249 blocked for more than 120 seconds.
 [ 1081.987434]       Not tainted 4.4.0-rc6-btrfs-next-18+ #1
 [ 1081.988534] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
 [ 1081.990147] fio        D ffff880218febbb8     0  8249   8240 0x00000000
 [ 1081.991626]  ffff880218febbb8 00ffffff81486b8e ffff88020000000b ffff88023ed75240
 [ 1081.993258]  ffff8802120a9a00 ffff880218fec000 ffff88020a4d5318 ffff8802120a9a00
 [ 1081.994850]  ffffffff00000001 ffff8802120a9a00 ffff880218febbd0 ffffffff81482ba4
 [ 1081.996485] Call Trace:
 [ 1081.997037]  [<ffffffff81482ba4>] schedule+0x7f/0x97
 [ 1081.998017]  [<ffffffff81485eb5>] rwsem_down_write_failed+0x2d5/0x325
 [ 1081.999241]  [<ffffffff810852a5>] ? finish_wait+0x6d/0x76
 [ 1082.000306]  [<ffffffff81269723>] call_rwsem_down_write_failed+0x13/0x20
 [ 1082.001533]  [<ffffffff81269723>] ? call_rwsem_down_write_failed+0x13/0x20
 [ 1082.002776]  [<ffffffff81089fae>] ? __down_write_nested.isra.0+0x1f/0x21
 [ 1082.003995]  [<ffffffff814855bd>] down_write+0x43/0x57
 [ 1082.005000]  [<ffffffffa05211b0>] ? btrfs_alloc_data_chunk_ondemand+0x1f6/0x288 [btrfs]
 [ 1082.007403]  [<ffffffffa05211b0>] btrfs_alloc_data_chunk_ondemand+0x1f6/0x288 [btrfs]
 [ 1082.008988]  [<ffffffffa0545064>] btrfs_fallocate+0x7c1/0xc2f [btrfs]
 [ 1082.010193]  [<ffffffff8108a1ba>] ? percpu_down_read+0x4e/0x77
 [ 1082.011280]  [<ffffffff81174c4c>] ? __sb_start_write+0x5f/0xb0
 [ 1082.012265]  [<ffffffff81174c4c>] ? __sb_start_write+0x5f/0xb0
 [ 1082.013021]  [<ffffffff811712e4>] vfs_fallocate+0x170/0x1ff
 [ 1082.013738]  [<ffffffff81181ebb>] ioctl_preallocate+0x89/0x9b
 [ 1082.014778]  [<ffffffff811822d7>] do_vfs_ioctl+0x40a/0x4ea
 [ 1082.015778]  [<ffffffff81176ea7>] ? SYSC_newfstat+0x25/0x2e
 [ 1082.016806]  [<ffffffff8118b4de>] ? __fget_light+0x4d/0x71
 [ 1082.017789]  [<ffffffff8118240e>] SyS_ioctl+0x57/0x79
 [ 1082.018706]  [<ffffffff814872d7>] entry_SYSCALL_64_fastpath+0x12/0x6f
 This happens because we can recursively acquire the semaphore
 fs_info->delayed_iput_sem when attempting to allocate space to satisfy
 a file write request as shown in the first trace above - when committing
 a transaction we acquire (down_read) the semaphore before running the
 delayed iputs, and when running a delayed iput() we can end up calling
 an inode's eviction handler, which in turn commits another transaction
 and attempts to acquire (down_read) again the semaphore to run more
 delayed iput operations.
 This results in a deadlock because if a task acquires multiple times a
 semaphore it should invoke down_read_nested() with a different lockdep
 class for each level of recursion.
 Fix this by simplifying the implementation and use a mutex instead that
 is acquired by the cleaner kthread before it runs the delayed iputs
 instead of always acquiring a semaphore before delayed references are
 run from anywhere.
 Fixes: d7c151717a1e (btrfs: Fix NO_SPACE bug caused by delayed-iput)
 Signed-off-by: Filipe Manana <fdmanana@suse.com>
 Signed-off-by: Chris Mason <clm@fb.com>
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 ---
 fs/btrfs/ctree.h       |    2 +-
 fs/btrfs/disk-io.c     |    5 ++++-
 fs/btrfs/extent-tree.c |    9 +++++----
 fs/btrfs/inode.c       |    4 ----
 4 files changed, 10 insertions(+), 10 deletions(-)
 --- a/fs/btrfs/ctree.h
 +++ b/fs/btrfs/ctree.h
@@ -1572,7 +1572,7 @@ struct btrfs_fs_info {
 	spinlock_t delayed_iput_lock;
 	struct list_head delayed_iputs;
 -	struct rw_semaphore delayed_iput_sem;
 +	struct mutex cleaner_delayed_iput_mutex;
 	/* this protects tree_mod_seq_list */
 	spinlock_t tree_mod_seq_lock;
 --- a/fs/btrfs/disk-io.c
 +++ b/fs/btrfs/disk-io.c
@@ -1796,7 +1796,10 @@ static int cleaner_kthread(void *arg)
 			goto sleep;
 		}
 +		mutex_lock(&root->fs_info->cleaner_delayed_iput_mutex);
 		btrfs_run_delayed_iputs(root);
 +		mutex_unlock(&root->fs_info->cleaner_delayed_iput_mutex);
 +
 		again = btrfs_clean_one_deleted_snapshot(root);
 		mutex_unlock(&root->fs_info->cleaner_mutex);
@@ -2556,8 +2559,8 @@ int open_ctree(struct super_block *sb,
 	mutex_init(&fs_info->delete_unused_bgs_mutex);
 	mutex_init(&fs_info->reloc_mutex);
 	mutex_init(&fs_info->delalloc_root_mutex);
 +	mutex_init(&fs_info->cleaner_delayed_iput_mutex);
 	seqlock_init(&fs_info->profiles_lock);
 -	init_rwsem(&fs_info->delayed_iput_sem);
 	INIT_LIST_HEAD(&fs_info->dirty_cowonly_roots);
 	INIT_LIST_HEAD(&fs_info->space_info);
 --- a/fs/btrfs/extent-tree.c
 +++ b/fs/btrfs/extent-tree.c
@@ -4100,11 +4100,12 @@ commit_trans:
 				if (ret)
 					return ret;
 				/*
 -				 * make sure that all running delayed iput are
 -				 * done
 +				 * The cleaner kthread might still be doing iput
 +				 * operations. Wait for it to finish so that
 +				 * more space is released.
 				 */
 -				down_write(&root->fs_info->delayed_iput_sem);
 -				up_write(&root->fs_info->delayed_iput_sem);
 +				mutex_lock(&root->fs_info->cleaner_delayed_iput_mutex);
 +				mutex_unlock(&root->fs_info->cleaner_delayed_iput_mutex);
 				goto again;
 			} else {
 				btrfs_end_transaction(trans, root);
 --- a/fs/btrfs/inode.c
 +++ b/fs/btrfs/inode.c
@@ -3142,8 +3142,6 @@ void btrfs_run_delayed_iputs(struct btrf
 	if (empty)
 		return;
 -	down_read(&fs_info->delayed_iput_sem);
 -
 	spin_lock(&fs_info->delayed_iput_lock);
 	list_splice_init(&fs_info->delayed_iputs, &list);
 	spin_unlock(&fs_info->delayed_iput_lock);
@@ -3154,8 +3152,6 @@ void btrfs_run_delayed_iputs(struct btrf
 		iput(delayed->inode);
 		kfree(delayed);
 	}
 -
 -	up_read(&root->fs_info->delayed_iput_sem);
 }
 /*
@@ -1,47 +0,0 @@
 From e1746e8381cd2af421f75557b5cae3604fc18b35 Mon Sep 17 00:00:00 2001
 From: Zhao Lei <zhaolei@cn.fujitsu.com>
 Date: Tue, 1 Dec 2015 18:39:40 +0800
 Subject: btrfs: Fix no_space in write and rm loop
 From: Zhao Lei <zhaolei@cn.fujitsu.com>
 commit e1746e8381cd2af421f75557b5cae3604fc18b35 upstream.
 I see no_space in v4.4-rc1 again in xfstests generic/102.
 It happened randomly in some node only.
 (one of 4 phy-node, and a kvm with non-virtio block driver)
 By bisect, we can found the first-bad is:
 commit bdced438acd8 ("block: setup bi_phys_segments after splitting")'
 But above patch only triggered the bug by making bio operation
 faster(or slower).
 Main reason is in our space_allocating code, we need to commit
 page writeback before wait it complish, this patch fixed above
 bug.
 BTW, there is another reason for generic/102 fail, caused by
 disable default mixed-blockgroup, I'll fix it in xfstests.
 Signed-off-by: Zhao Lei <zhaolei@cn.fujitsu.com>
 Signed-off-by: Chris Mason <clm@fb.com>
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 ---
 fs/btrfs/extent-tree.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)
 --- a/fs/btrfs/extent-tree.c
 +++ b/fs/btrfs/extent-tree.c
@@ -4086,8 +4086,10 @@ commit_trans:
 		    !atomic_read(&root->fs_info->open_ioctl_trans)) {
 			need_commit--;
 -			if (need_commit > 0)
 +			if (need_commit > 0) {
 +				btrfs_start_delalloc_roots(fs_info, 0, -1);
 				btrfs_wait_ordered_roots(fs_info, -1);
 +			}
 			trans = btrfs_join_transaction(root);
 			if (IS_ERR(trans))
@@ -1,104 +0,0 @@
 From deb7deff2f00bdbbcb3d560dad2a89ef37df837d Mon Sep 17 00:00:00 2001
 From: Justin Maggard <jmaggard10@gmail.com>
 Date: Tue, 9 Feb 2016 15:52:08 -0800
 Subject: cifs: fix out-of-bounds access in lease parsing
 From: Justin Maggard <jmaggard10@gmail.com>
 commit deb7deff2f00bdbbcb3d560dad2a89ef37df837d upstream.
 When opening a file, SMB2_open() attempts to parse the lease state from the
 SMB2 CREATE Response.  However, the parsing code was not careful to ensure
 that the create contexts are not empty or invalid, which can lead to out-
 of-bounds memory access.  This can be seen easily by trying
 to read a file from a OSX 10.11 SMB3 server.  Here is sample crash output:
 BUG: unable to handle kernel paging request at ffff8800a1a77cc6
 IP: [<ffffffff8828a734>] SMB2_open+0x804/0x960
 PGD 8f77067 PUD 0
 Oops: 0000 [#1] SMP
 Modules linked in:
 CPU: 3 PID: 2876 Comm: cp Not tainted 4.5.0-rc3.x86_64.1+ #14
 Hardware name: NETGEAR ReadyNAS 314          /ReadyNAS 314          , BIOS 4.6.5 10/11/2012
 task: ffff880073cdc080 ti: ffff88005b31c000 task.ti: ffff88005b31c000
 RIP: 0010:[<ffffffff8828a734>]  [<ffffffff8828a734>] SMB2_open+0x804/0x960
 RSP: 0018:ffff88005b31fa08  EFLAGS: 00010282
 RAX: 0000000000000015 RBX: 0000000000000000 RCX: 0000000000000006
 RDX: 0000000000000000 RSI: 0000000000000246 RDI: ffff88007eb8c8b0
 RBP: ffff88005b31fad8 R08: 666666203d206363 R09: 6131613030383866
 R10: 3030383866666666 R11: 00000000000002b0 R12: ffff8800660fd800
 R13: ffff8800a1a77cc2 R14: 00000000424d53fe R15: ffff88005f5a28c0
 FS:  00007f7c8a2897c0(0000) GS:ffff88007eb80000(0000) knlGS:0000000000000000
 CS:  0010 DS: 0000 ES: 0000 CR0: 000000008005003b
 CR2: ffff8800a1a77cc6 CR3: 000000005b281000 CR4: 00000000000006e0
 Stack:
 ffff88005b31fa70 ffffffff88278789 00000000000001d3 ffff88005f5a2a80
 ffffffff00000003 ffff88005d029d00 ffff88006fde05a0 0000000000000000
 ffff88005b31fc78 ffff88006fde0780 ffff88005b31fb2f 0000000100000fe0
 Call Trace:
 [<ffffffff88278789>] ? cifsConvertToUTF16+0x159/0x2d0
 [<ffffffff8828cf68>] smb2_open_file+0x98/0x210
 [<ffffffff8811e80c>] ? __kmalloc+0x1c/0xe0
 [<ffffffff882685f4>] cifs_open+0x2a4/0x720
 [<ffffffff88122cef>] do_dentry_open+0x1ff/0x310
 [<ffffffff88268350>] ? cifsFileInfo_get+0x30/0x30
 [<ffffffff88123d92>] vfs_open+0x52/0x60
 [<ffffffff88131dd0>] path_openat+0x170/0xf70
 [<ffffffff88097d48>] ? remove_wait_queue+0x48/0x50
 [<ffffffff88133a29>] do_filp_open+0x79/0xd0
 [<ffffffff8813f2ca>] ? __alloc_fd+0x3a/0x170
 [<ffffffff881240c4>] do_sys_open+0x114/0x1e0
 [<ffffffff881241a9>] SyS_open+0x19/0x20
 [<ffffffff8896e257>] entry_SYSCALL_64_fastpath+0x12/0x6a
 Code: 4d 8d 6c 07 04 31 c0 4c 89 ee e8 47 6f e5 ff 31 c9 41 89 ce 44 89 f1 48 c7 c7 28 b1 bd 88 31 c0 49 01 cd 4c 89 ee e8 2b 6f e5 ff <45> 0f b7 75 04 48 c7 c7 31 b1 bd 88 31 c0 4d 01 ee 4c 89 f6 e8
 RIP  [<ffffffff8828a734>] SMB2_open+0x804/0x960
 RSP <ffff88005b31fa08>
 CR2: ffff8800a1a77cc6
 ---[ end trace d9f69ba64feee469 ]---
 Signed-off-by: Justin Maggard <jmaggard@netgear.com>
 Signed-off-by: Steve French <smfrench@gmail.com>
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 ---
 fs/cifs/smb2pdu.c |   24 ++++++++++++++----------
 1 file changed, 14 insertions(+), 10 deletions(-)
 --- a/fs/cifs/smb2pdu.c
 +++ b/fs/cifs/smb2pdu.c
@@ -1109,21 +1109,25 @@ parse_lease_state(struct TCP_Server_Info
 {
 	char *data_offset;
 	struct create_context *cc;
 -	unsigned int next = 0;
 +	unsigned int next;
 +	unsigned int remaining;
 	char *name;
 	data_offset = (char *)rsp + 4 + le32_to_cpu(rsp->CreateContextsOffset);
 +	remaining = le32_to_cpu(rsp->CreateContextsLength);
 	cc = (struct create_context *)data_offset;
 -	do {
 -		cc = (struct create_context *)((char *)cc + next);
 +	while (remaining >= sizeof(struct create_context)) {
 		name = le16_to_cpu(cc->NameOffset) + (char *)cc;
 -		if (le16_to_cpu(cc->NameLength) != 4 ||
 -		    strncmp(name, "RqLs", 4)) {
 -			next = le32_to_cpu(cc->Next);
 -			continue;
 -		}
 -		return server->ops->parse_lease_buf(cc, epoch);
 -	} while (next != 0);
 +		if (le16_to_cpu(cc->NameLength) == 4 &&
 +		    strncmp(name, "RqLs", 4) == 0)
 +			return server->ops->parse_lease_buf(cc, epoch);
 +
 +		next = le32_to_cpu(cc->Next);
 +		if (!next)
 +			break;
 +		remaining -= next;
 +		cc = (struct create_context *)((char *)cc + next);
 +	}
 	return 0;
 }
@@ -1,72 +0,0 @@
 From 6cc3b24235929b54acd5ecc987ef11a425bd209e Mon Sep 17 00:00:00 2001
 From: Pavel Shilovsky <pshilovsky@samba.org>
 Date: Sat, 27 Feb 2016 11:58:18 +0300
 Subject: CIFS: Fix SMB2+ interim response processing for read requests
 From: Pavel Shilovsky <pshilovsky@samba.org>
 commit 6cc3b24235929b54acd5ecc987ef11a425bd209e upstream.
 For interim responses we only need to parse a header and update
 a number credits. Now it is done for all SMB2+ command except
 SMB2_READ which is wrong. Fix this by adding such processing.
 Signed-off-by: Pavel Shilovsky <pshilovsky@samba.org>
 Tested-by: Shirish Pargaonkar <shirishpargaonkar@gmail.com>
 Signed-off-by: Steve French <smfrench@gmail.com>
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 ---
 fs/cifs/cifssmb.c |   21 ++++++++++++++++++---
 1 file changed, 18 insertions(+), 3 deletions(-)
 --- a/fs/cifs/cifssmb.c
 +++ b/fs/cifs/cifssmb.c
@@ -1396,11 +1396,10 @@ openRetry:
  * current bigbuf.
  */
 static int
 -cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid)
 +discard_remaining_data(struct TCP_Server_Info *server)
 {
 	unsigned int rfclen = get_rfc1002_length(server->smallbuf);
 	int remaining = rfclen + 4 - server->total_read;
 -	struct cifs_readdata *rdata = mid->callback_data;
 	while (remaining > 0) {
 		int length;
@@ -1414,10 +1413,20 @@ cifs_readv_discard(struct TCP_Server_Inf
 		remaining -= length;
 	}
 -	dequeue_mid(mid, rdata->result);
 	return 0;
 }
 +static int
 +cifs_readv_discard(struct TCP_Server_Info *server, struct mid_q_entry *mid)
 +{
 +	int length;
 +	struct cifs_readdata *rdata = mid->callback_data;
 +
 +	length = discard_remaining_data(server);
 +	dequeue_mid(mid, rdata->result);
 +	return length;
 +}
 +
 int
 cifs_readv_receive(struct TCP_Server_Info *server, struct mid_q_entry *mid)
 {
@@ -1446,6 +1455,12 @@ cifs_readv_receive(struct TCP_Server_Inf
 		return length;
 	server->total_read += length;
 +	if (server->ops->is_status_pending &&
 +	    server->ops->is_status_pending(buf, server, 0)) {
 +		discard_remaining_data(server);
 +		return -1;
 +	}
 +
 	/* Was the SMB read successful? */
 	rdata->result = server->ops->map_error(buf, false);
 	if (rdata->result != 0) {
@@ -1,39 +0,0 @@
 From 0378ba4899d5fbd8494ed6580cbc81d7b44dbac6 Mon Sep 17 00:00:00 2001
 From: Geert Uytterhoeven <geert+renesas@glider.be>
 Date: Wed, 24 Feb 2016 09:43:23 +0100
 Subject: drivers: sh: Restore legacy clock domain on SuperH platforms
 From: Geert Uytterhoeven <geert+renesas@glider.be>
 commit 0378ba4899d5fbd8494ed6580cbc81d7b44dbac6 upstream.
 CONFIG_ARCH_SHMOBILE is not only enabled for Renesas ARM platforms
 (which are DT based and multi-platform), but also on a select set of
 Renesas SuperH platforms (SH7722/SH7723/SH7724/SH7343/SH7366). Hence
 since commit 0ba58de231066e47 ("drivers: sh: Get rid of
 CONFIG_ARCH_SHMOBILE_MULTI"), the legacy clock domain is no longer
 installed on these SuperH platforms, and module clocks may not be
 enabled when needed, leading to driver failures.
 To fix this, add an additional check for CONFIG_OF.
 Fixes: 0ba58de231066e47 ("drivers: sh: Get rid of CONFIG_ARCH_SHMOBILE_MULTI").
 Signed-off-by: Geert Uytterhoeven <geert+renesas@glider.be>
 Signed-off-by: Simon Horman <horms+renesas@verge.net.au>
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 ---
 drivers/sh/pm_runtime.c |    2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)
 --- a/drivers/sh/pm_runtime.c
 +++ b/drivers/sh/pm_runtime.c
@@ -34,7 +34,7 @@ static struct pm_clk_notifier_block plat
 static int __init sh_pm_runtime_init(void)
 {
 -	if (IS_ENABLED(CONFIG_ARCH_SHMOBILE)) {
 +	if (IS_ENABLED(CONFIG_OF) && IS_ENABLED(CONFIG_ARCH_SHMOBILE)) {
 		if (!of_find_compatible_node(NULL, NULL,
 					     "renesas,cpg-mstp-clocks"))
 			return 0;
@@ -1,46 +0,0 @@
 From a187f17f0e15a046aa5d7263b35df55230d92779 Mon Sep 17 00:00:00 2001
 From: Oded Gabbay <oded.gabbay@gmail.com>
 Date: Sat, 30 Jan 2016 07:59:34 +0200
 Subject: drm/amdgpu: mask out WC from BO on unsupported arches
 MIME-Version: 1.0
 Content-Type: text/plain; charset=UTF-8
 Content-Transfer-Encoding: 8bit
 From: Oded Gabbay <oded.gabbay@gmail.com>
 commit a187f17f0e15a046aa5d7263b35df55230d92779 upstream.
 Reviewed-by: Christian König <christian.koenig@amd.com>
 Reviewed-by: Michel Dänzer <michel.daenzer@amd.com>
 Signed-off-by: Oded Gabbay <oded.gabbay@gmail.com>
 Signed-off-by: Alex Deucher <alexander.deucher@amd.com>
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 ---
 drivers/gpu/drm/amd/amdgpu/amdgpu_object.c |    8 ++++++++
 1 file changed, 8 insertions(+)
 --- a/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
 +++ b/drivers/gpu/drm/amd/amdgpu/amdgpu_object.c
@@ -33,6 +33,7 @@
 #include <linux/slab.h>
 #include <drm/drmP.h>
 #include <drm/amdgpu_drm.h>
 +#include <drm/drm_cache.h>
 #include "amdgpu.h"
 #include "amdgpu_trace.h"
@@ -261,6 +262,13 @@ int amdgpu_bo_create_restricted(struct a
 				       AMDGPU_GEM_DOMAIN_OA);
 	bo->flags = flags;
 +
 +	/* For architectures that don't support WC memory,
 +	 * mask out the WC flag from the BO
 +	 */
 +	if (!drm_arch_can_wc_memory())
 +		bo->flags &= ~AMDGPU_GEM_CREATE_CPU_GTT_USWC;
 +
 	amdgpu_fill_placement_to_bo(bo, placement);
 	/* Kernel allocation are uninterruptible */
 	r = ttm_bo_init(&adev->mman.bdev, &bo->tbo, size, type,
@@ -1,66 +0,0 @@
 From a1e533ec07d583d01349ef13c0c965b8633e1b91 Mon Sep 17 00:00:00 2001
 From: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
 Date: Mon, 15 Feb 2016 18:41:33 +0000
 Subject: fbcon: set a default value to blink interval
 From: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
 commit a1e533ec07d583d01349ef13c0c965b8633e1b91 upstream.
 Since commit 27a4c827c34ac4256a190cc9d24607f953c1c459
 	fbcon: use the cursor blink interval provided by vt
 two attempts have been made at fixing a possible hang caused by
 cursor_timer_handler. That function registers a timer to be triggered at
 "jiffies + fbcon_ops.cur_blink_jiffies".
 A new case had been encountered during initialisation of clcd-pl11x:
    fbcon_fb_registered
    do_fbcon_takeover
    ->  do_register_con_driver
        fbcon_startup
    (A) add_cursor_timer (with cur_blink_jiffies = 0)
    ->  do_bind_con_driver
        visual_init
        fbcon_init
    (B) cur_blink_jiffies = msecs_to_jiffies(vc->vc_cur_blink_ms);
 If we take an softirq anywhere between A and B (and we do),
 cursor_timer_handler executes indefinitely.
 Instead of patching all possible paths that lead to this case one at a
 time, fix the issue at the source and initialise cur_blink_jiffies to
 200ms when allocating fbcon_ops. This was its default value before
 aforesaid commit. fbcon_cursor or fbcon_init will refine this value
 downstream.
 Signed-off-by: Jean-Philippe Brucker <jean-philippe.brucker@arm.com>
 Tested-by: Scot Doyle <lkml14@scotdoyle.com>
 Signed-off-by: Tomi Valkeinen <tomi.valkeinen@ti.com>
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 ---
 drivers/video/console/fbcon.c |    2 ++
 1 file changed, 2 insertions(+)
 --- a/drivers/video/console/fbcon.c
 +++ b/drivers/video/console/fbcon.c
@@ -709,6 +709,7 @@ static int con2fb_acquire_newinfo(struct
 	}
 	if (!err) {
 +		ops->cur_blink_jiffies = HZ / 5;
 		info->fbcon_par = ops;
 		if (vc)
@@ -956,6 +957,7 @@ static const char *fbcon_startup(void)
 	ops->currcon = -1;
 	ops->graphics = 1;
 	ops->cur_rotate = -1;
 +	ops->cur_blink_jiffies = HZ / 5;
 	info->fbcon_par = ops;
 	p->con_rotate = initial_rotation;
 	set_blitting_type(vc, info);
@@ -1,63 +0,0 @@
 From 1ee9f4bd1a97026a7b2d7ae9f1f74b45680d0003 Mon Sep 17 00:00:00 2001
 From: Yadan Fan <ydfan@novell.com>
 Date: Mon, 29 Feb 2016 14:44:57 +0800
 Subject: Fix cifs_uniqueid_to_ino_t() function for s390x
 From: Yadan Fan <ydfan@novell.com>
 commit 1ee9f4bd1a97026a7b2d7ae9f1f74b45680d0003 upstream.
 This issue is caused by commit 02323db17e3a7 ("cifs: fix
 cifs_uniqueid_to_ino_t not to ever return 0"), when BITS_PER_LONG
 is 64 on s390x, the corresponding cifs_uniqueid_to_ino_t()
 function will cast 64-bit fileid to 32-bit by using (ino_t)fileid,
 because ino_t (typdefed __kernel_ino_t) is int type.
 It's defined in arch/s390/include/uapi/asm/posix_types.h
    #ifndef __s390x__
    typedef unsigned long   __kernel_ino_t;
    ...
    #else /* __s390x__ */
    typedef unsigned int    __kernel_ino_t;
 So the #ifdef condition is wrong for s390x, we can just still use
 one cifs_uniqueid_to_ino_t() function with comparing sizeof(ino_t)
 and sizeof(u64) to choose the correct execution accordingly.
 Signed-off-by: Yadan Fan <ydfan@suse.com>
 Signed-off-by: Steve French <smfrench@gmail.com>
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 ---
 fs/cifs/cifsfs.h |   12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)
 --- a/fs/cifs/cifsfs.h
 +++ b/fs/cifs/cifsfs.h
@@ -31,19 +31,15 @@
  * so that it will fit. We use hash_64 to convert the value to 31 bits, and
  * then add 1, to ensure that we don't end up with a 0 as the value.
  */
 -#if BITS_PER_LONG == 64
 static inline ino_t
 cifs_uniqueid_to_ino_t(u64 fileid)
 {
 +	if ((sizeof(ino_t)) < (sizeof(u64)))
 +		return (ino_t)hash_64(fileid, (sizeof(ino_t) * 8) - 1) + 1;
 +
 	return (ino_t)fileid;
 +
 }
 -#else
 -static inline ino_t
 -cifs_uniqueid_to_ino_t(u64 fileid)
 -{
 -	return (ino_t)hash_64(fileid, (sizeof(ino_t) * 8) - 1) + 1;
 -}
 -#endif
 extern struct file_system_type cifs_fs_type;
 extern const struct address_space_operations cifs_addr_ops;
@@ -1,78 +0,0 @@
 From 358875fd52ab8f00f66328cbf1a1d2486f265829 Mon Sep 17 00:00:00 2001
 From: Jay Cornwall <jay@jcornwall.me>
 Date: Wed, 10 Feb 2016 15:48:01 -0600
 Subject: iommu/amd: Apply workaround for ATS write permission check
 From: Jay Cornwall <jay@jcornwall.me>
 commit 358875fd52ab8f00f66328cbf1a1d2486f265829 upstream.
 The AMD Family 15h Models 30h-3Fh (Kaveri) BIOS and Kernel Developer's
 Guide omitted part of the BIOS IOMMU L2 register setup specification.
 Without this setup the IOMMU L2 does not fully respect write permissions
 when handling an ATS translation request.
 The IOMMU L2 will set PTE dirty bit when handling an ATS translation with
 write permission request, even when PTE RW bit is clear. This may occur by
 direct translation (which would cause a PPR) or by prefetch request from
 the ATC.
 This is observed in practice when the IOMMU L2 modifies a PTE which maps a
 pagecache page. The ext4 filesystem driver BUGs when asked to writeback
 these (non-modified) pages.
 Enable ATS write permission check in the Kaveri IOMMU L2 if BIOS has not.
 Signed-off-by: Jay Cornwall <jay@jcornwall.me>
 Signed-off-by: Joerg Roedel <jroedel@suse.de>
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 ---
 drivers/iommu/amd_iommu_init.c |   29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)
 --- a/drivers/iommu/amd_iommu_init.c
 +++ b/drivers/iommu/amd_iommu_init.c
@@ -1016,6 +1016,34 @@ static void amd_iommu_erratum_746_workar
 }
 /*
 + * Family15h Model 30h-3fh (IOMMU Mishandles ATS Write Permission)
 + * Workaround:
 + *     BIOS should enable ATS write permission check by setting
 + *     L2_DEBUG_3[AtsIgnoreIWDis](D0F2xF4_x47[0]) = 1b
 + */
 +static void amd_iommu_ats_write_check_workaround(struct amd_iommu *iommu)
 +{
 +	u32 value;
 +
 +	if ((boot_cpu_data.x86 != 0x15) ||
 +	    (boot_cpu_data.x86_model < 0x30) ||
 +	    (boot_cpu_data.x86_model > 0x3f))
 +		return;
 +
 +	/* Test L2_DEBUG_3[AtsIgnoreIWDis] == 1 */
 +	value = iommu_read_l2(iommu, 0x47);
 +
 +	if (value & BIT(0))
 +		return;
 +
 +	/* Set L2_DEBUG_3[AtsIgnoreIWDis] = 1 */
 +	iommu_write_l2(iommu, 0x47, value | BIT(0));
 +
 +	pr_info("AMD-Vi: Applying ATS write check workaround for IOMMU at %s\n",
 +		dev_name(&iommu->dev->dev));
 +}
 +
 +/*
  * This function clues the initialization function for one IOMMU
  * together and also allocates the command buffer and programs the
  * hardware. It does NOT enable the IOMMU. This is done afterwards.
@@ -1284,6 +1312,7 @@ static int iommu_init_pci(struct amd_iom
 	}
 	amd_iommu_erratum_746_workaround(iommu);
 +	amd_iommu_ats_write_check_workaround(iommu);
 	iommu->iommu_dev = iommu_device_create(&iommu->dev->dev, iommu,
 					       amd_iommu_groups, "ivhd%d",
@@ -1,92 +0,0 @@
 From 38e45d02ea9f194b89d6bf41e52ccafc8e2c2b47 Mon Sep 17 00:00:00 2001
 From: Suravee Suthikulpanit <Suravee.Suthikulpanit@amd.com>
 Date: Tue, 23 Feb 2016 13:03:30 +0100
 Subject: iommu/amd: Fix boot warning when device 00:00.0 is not iommu covered
 From: Suravee Suthikulpanit <Suravee.Suthikulpanit@amd.com>
 commit 38e45d02ea9f194b89d6bf41e52ccafc8e2c2b47 upstream.
 The setup code for the performance counters in the AMD IOMMU driver
 tests whether the counters can be written. It tests to setup a counter
 for device 00:00.0, which fails on systems where this particular device
 is not covered by the IOMMU.
 Fix this by not relying on device 00:00.0 but only on the IOMMU being
 present.
 Signed-off-by: Suravee Suthikulpanit <Suravee.Suthikulpanit@amd.com>
 Signed-off-by: Joerg Roedel <jroedel@suse.de>
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 ---
 drivers/iommu/amd_iommu_init.c |   34 ++++++++++++++++++++++------------
 1 file changed, 22 insertions(+), 12 deletions(-)
 --- a/drivers/iommu/amd_iommu_init.c
 +++ b/drivers/iommu/amd_iommu_init.c
@@ -228,6 +228,10 @@ static int amd_iommu_enable_interrupts(v
 static int __init iommu_go_to_state(enum iommu_init_state state);
 static void init_device_table_dma(void);
 +static int iommu_pc_get_set_reg_val(struct amd_iommu *iommu,
 +				    u8 bank, u8 cntr, u8 fxn,
 +				    u64 *value, bool is_write);
 +
 static inline void update_last_devid(u16 devid)
 {
 	if (devid > amd_iommu_last_bdf)
@@ -1170,8 +1174,8 @@ static void init_iommu_perf_ctr(struct a
 	amd_iommu_pc_present = true;
 	/* Check if the performance counters can be written to */
 -	if ((0 != amd_iommu_pc_get_set_reg_val(0, 0, 0, 0, &val, true)) ||
 -	    (0 != amd_iommu_pc_get_set_reg_val(0, 0, 0, 0, &val2, false)) ||
 +	if ((0 != iommu_pc_get_set_reg_val(iommu, 0, 0, 0, &val, true)) ||
 +	    (0 != iommu_pc_get_set_reg_val(iommu, 0, 0, 0, &val2, false)) ||
 	    (val != val2)) {
 		pr_err("AMD-Vi: Unable to write to IOMMU perf counter.\n");
 		amd_iommu_pc_present = false;
@@ -2312,22 +2316,15 @@ u8 amd_iommu_pc_get_max_counters(u16 dev
 }
 EXPORT_SYMBOL(amd_iommu_pc_get_max_counters);
 -int amd_iommu_pc_get_set_reg_val(u16 devid, u8 bank, u8 cntr, u8 fxn,
 +static int iommu_pc_get_set_reg_val(struct amd_iommu *iommu,
 +				    u8 bank, u8 cntr, u8 fxn,
 				    u64 *value, bool is_write)
 {
 -	struct amd_iommu *iommu;
 	u32 offset;
 	u32 max_offset_lim;
 -	/* Make sure the IOMMU PC resource is available */
 -	if (!amd_iommu_pc_present)
 -		return -ENODEV;
 -
 -	/* Locate the iommu associated with the device ID */
 -	iommu = amd_iommu_rlookup_table[devid];
 -
 	/* Check for valid iommu and pc register indexing */
 -	if (WARN_ON((iommu == NULL) || (fxn > 0x28) || (fxn & 7)))
 +	if (WARN_ON((fxn > 0x28) || (fxn & 7)))
 		return -ENODEV;
 	offset = (u32)(((0x40|bank) << 12) | (cntr << 8) | fxn);
@@ -2351,3 +2348,16 @@ int amd_iommu_pc_get_set_reg_val(u16 dev
 	return 0;
 }
 EXPORT_SYMBOL(amd_iommu_pc_get_set_reg_val);
 +
 +int amd_iommu_pc_get_set_reg_val(u16 devid, u8 bank, u8 cntr, u8 fxn,
 +				    u64 *value, bool is_write)
 +{
 +	struct amd_iommu *iommu = amd_iommu_rlookup_table[devid];
 +
 +	/* Make sure the IOMMU PC resource is available */
 +	if (!amd_iommu_pc_present || iommu == NULL)
 +		return -ENODEV;
 +
 +	return iommu_pc_get_set_reg_val(iommu, bank, cntr, fxn,
 +					value, is_write);
 +}
@@ -1,68 +0,0 @@
 From e6a8c9b337eed56eb481e1b4dd2180c25a1e5310 Mon Sep 17 00:00:00 2001
 From: Joerg Roedel <jroedel@suse.de>
 Date: Mon, 29 Feb 2016 23:49:47 +0100
 Subject: iommu/vt-d: Use BUS_NOTIFY_REMOVED_DEVICE in hotplug path
 From: Joerg Roedel <jroedel@suse.de>
 commit e6a8c9b337eed56eb481e1b4dd2180c25a1e5310 upstream.
 In the PCI hotplug path of the Intel IOMMU driver, replace
 the usage of the BUS_NOTIFY_DEL_DEVICE notifier, which is
 executed before the driver is unbound from the device, with
 BUS_NOTIFY_REMOVED_DEVICE, which runs after that.
 This fixes a kernel BUG being triggered in the VT-d code
 when the device driver tries to unmap DMA buffers and the
 VT-d driver already destroyed all mappings.
 Reported-by: Stefani Seibold <stefani@seibold.net>
 Signed-off-by: Joerg Roedel <jroedel@suse.de>
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 ---
 drivers/iommu/dmar.c        |    5 +++--
 drivers/iommu/intel-iommu.c |    4 ++--
 2 files changed, 5 insertions(+), 4 deletions(-)
 --- a/drivers/iommu/dmar.c
 +++ b/drivers/iommu/dmar.c
@@ -329,7 +329,8 @@ static int dmar_pci_bus_notifier(struct
 	/* Only care about add/remove events for physical functions */
 	if (pdev->is_virtfn)
 		return NOTIFY_DONE;
 -	if (action != BUS_NOTIFY_ADD_DEVICE && action != BUS_NOTIFY_DEL_DEVICE)
 +	if (action != BUS_NOTIFY_ADD_DEVICE &&
 +	    action != BUS_NOTIFY_REMOVED_DEVICE)
 		return NOTIFY_DONE;
 	info = dmar_alloc_pci_notify_info(pdev, action);
@@ -339,7 +340,7 @@ static int dmar_pci_bus_notifier(struct
 	down_write(&dmar_global_lock);
 	if (action == BUS_NOTIFY_ADD_DEVICE)
 		dmar_pci_bus_add_dev(info);
 -	else if (action == BUS_NOTIFY_DEL_DEVICE)
 +	else if (action == BUS_NOTIFY_REMOVED_DEVICE)
 		dmar_pci_bus_del_dev(info);
 	up_write(&dmar_global_lock);
 --- a/drivers/iommu/intel-iommu.c
 +++ b/drivers/iommu/intel-iommu.c
@@ -4367,7 +4367,7 @@ int dmar_iommu_notify_scope_dev(struct d
 				rmrru->devices_cnt);
 			if(ret < 0)
 				return ret;
 -		} else if (info->event == BUS_NOTIFY_DEL_DEVICE) {
 +		} else if (info->event == BUS_NOTIFY_REMOVED_DEVICE) {
 			dmar_remove_dev_scope(info, rmrr->segment,
 				rmrru->devices, rmrru->devices_cnt);
 		}
@@ -4387,7 +4387,7 @@ int dmar_iommu_notify_scope_dev(struct d
 				break;
 			else if(ret < 0)
 				return ret;
 -		} else if (info->event == BUS_NOTIFY_DEL_DEVICE) {
 +		} else if (info->event == BUS_NOTIFY_REMOVED_DEVICE) {
 			if (dmar_remove_dev_scope(info, atsr->segment,
 					atsru->devices, atsru->devices_cnt))
 				break;
@@ -1,56 +0,0 @@
 From 70e4da7a8ff62f2775337b705f45c804bb450454 Mon Sep 17 00:00:00 2001
 From: Paolo Bonzini <pbonzini@redhat.com>
 Date: Fri, 26 Feb 2016 12:28:40 +0100
 Subject: KVM: x86: fix root cause for missed hardware breakpoints
 From: Paolo Bonzini <pbonzini@redhat.com>
 commit 70e4da7a8ff62f2775337b705f45c804bb450454 upstream.
 Commit 172b2386ed16 ("KVM: x86: fix missed hardware breakpoints",
 2016-02-10) worked around a case where the debug registers are not loaded
 correctly on preemption and on the first entry to KVM_RUN.
 However, Xiao Guangrong pointed out that the root cause must be that
 KVM_DEBUGREG_BP_ENABLED is not being set correctly.  This can indeed
 happen due to the lazy debug exit mechanism, which does not call
 kvm_update_dr7.  Fix it by replacing the existing loop (more or less
 equivalent to kvm_update_dr0123) with calls to all the kvm_update_dr*
 functions.
 Fixes: 172b2386ed16a9143d9a456aae5ec87275c61489
 Reviewed-by: Xiao Guangrong <guangrong.xiao@linux.intel.com>
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 ---
 arch/x86/kvm/x86.c |    9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)
 --- a/arch/x86/kvm/x86.c
 +++ b/arch/x86/kvm/x86.c
@@ -2736,7 +2736,6 @@ void kvm_arch_vcpu_load(struct kvm_vcpu
 	}
 	kvm_make_request(KVM_REQ_STEAL_UPDATE, vcpu);
 -	vcpu->arch.switch_db_regs |= KVM_DEBUGREG_RELOAD;
 }
 void kvm_arch_vcpu_put(struct kvm_vcpu *vcpu)
@@ -6545,12 +6544,12 @@ static int vcpu_enter_guest(struct kvm_v
 	 * KVM_DEBUGREG_WONT_EXIT again.
 	 */
 	if (unlikely(vcpu->arch.switch_db_regs & KVM_DEBUGREG_WONT_EXIT)) {
 -		int i;
 -
 		WARN_ON(vcpu->guest_debug & KVM_GUESTDBG_USE_HW_BP);
 		kvm_x86_ops->sync_dirty_debug_regs(vcpu);
 -		for (i = 0; i < KVM_NR_DB_REGS; i++)
 -			vcpu->arch.eff_db[i] = vcpu->arch.db[i];
 +		kvm_update_dr0123(vcpu);
 +		kvm_update_dr6(vcpu);
 +		kvm_update_dr7(vcpu);
 +		vcpu->arch.switch_db_regs &= ~KVM_DEBUGREG_RELOAD;
 	}
 	/*
@@ -1,56 +0,0 @@
 From 2680d6da455b636dd006636780c0f235c6561d70 Mon Sep 17 00:00:00 2001
 From: Owen Hofmann <osh@google.com>
 Date: Tue, 1 Mar 2016 13:36:13 -0800
 Subject: kvm: x86: Update tsc multiplier on change.
 From: Owen Hofmann <osh@google.com>
 commit 2680d6da455b636dd006636780c0f235c6561d70 upstream.
 vmx.c writes the TSC_MULTIPLIER field in vmx_vcpu_load, but only when a
 vcpu has migrated physical cpus. Record the last value written and
 update in vmx_vcpu_load on any change, otherwise a cpu migration must
 occur for TSC frequency scaling to take effect.
 Fixes: ff2c3a1803775cc72dc6f624b59554956396b0ee
 Signed-off-by: Owen Hofmann <osh@google.com>
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 ---
 arch/x86/kvm/vmx.c |   14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)
 --- a/arch/x86/kvm/vmx.c
 +++ b/arch/x86/kvm/vmx.c
@@ -595,6 +595,8 @@ struct vcpu_vmx {
 	/* Support for PML */
 #define PML_ENTITY_NUM		512
 	struct page *pml_pg;
 +
 +	u64 current_tsc_ratio;
 };
 enum segment_cache_field {
@@ -2062,14 +2064,16 @@ static void vmx_vcpu_load(struct kvm_vcp
 		rdmsrl(MSR_IA32_SYSENTER_ESP, sysenter_esp);
 		vmcs_writel(HOST_IA32_SYSENTER_ESP, sysenter_esp); /* 22.2.3 */
 -		/* Setup TSC multiplier */
 -		if (cpu_has_vmx_tsc_scaling())
 -			vmcs_write64(TSC_MULTIPLIER,
 -				     vcpu->arch.tsc_scaling_ratio);
 -
 		vmx->loaded_vmcs->cpu = cpu;
 	}
 +	/* Setup TSC multiplier */
 +	if (kvm_has_tsc_control &&
 +	    vmx->current_tsc_ratio != vcpu->arch.tsc_scaling_ratio) {
 +		vmx->current_tsc_ratio = vcpu->arch.tsc_scaling_ratio;
 +		vmcs_write64(TSC_MULTIPLIER, vmx->current_tsc_ratio);
 +	}
 +
 	vmx_vcpu_pi_load(vcpu, cpu);
 }
@@ -1,49 +0,0 @@
 From 0178fd7dcc4451fcb90bec5e91226586962478d2 Mon Sep 17 00:00:00 2001
 From: "Michael S. Tsirkin" <mst@redhat.com>
 Date: Sun, 28 Feb 2016 17:35:59 +0200
 Subject: mips/kvm: fix ioctl error handling
 From: Michael S. Tsirkin <mst@redhat.com>
 commit 0178fd7dcc4451fcb90bec5e91226586962478d2 upstream.
 Returning directly whatever copy_to_user(...) or copy_from_user(...)
 returns may not do the right thing if there's a pagefault:
 copy_to_user/copy_from_user return the number of bytes not copied in
 this case, but ioctls need to return -EFAULT instead.
 Fix up kvm on mips to do
 	return copy_to_user(...)) ?  -EFAULT : 0;
 and
 	return copy_from_user(...)) ?  -EFAULT : 0;
 everywhere.
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 ---
 arch/mips/kvm/mips.c |    4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)
 --- a/arch/mips/kvm/mips.c
 +++ b/arch/mips/kvm/mips.c
@@ -702,7 +702,7 @@ static int kvm_mips_get_reg(struct kvm_v
 	} else if ((reg->id & KVM_REG_SIZE_MASK) == KVM_REG_SIZE_U128) {
 		void __user *uaddr = (void __user *)(long)reg->addr;
 -		return copy_to_user(uaddr, vs, 16);
 +		return copy_to_user(uaddr, vs, 16) ? -EFAULT : 0;
 	} else {
 		return -EINVAL;
 	}
@@ -732,7 +732,7 @@ static int kvm_mips_set_reg(struct kvm_v
 	} else if ((reg->id & KVM_REG_SIZE_MASK) == KVM_REG_SIZE_U128) {
 		void __user *uaddr = (void __user *)(long)reg->addr;
 -		return copy_from_user(vs, uaddr, 16);
 +		return copy_from_user(vs, uaddr, 16) ? -EFAULT : 0;
 	} else {
 		return -EINVAL;
 	}
@@ -1,94 +0,0 @@
 From 98e8b6c9ac9d1b1e9d1122dfa6783d5d566bb8f7 Mon Sep 17 00:00:00 2001
 From: Helge Deller <deller@gmx.de>
 Date: Tue, 19 Jan 2016 16:08:49 +0100
 Subject: parisc: Fix ptrace syscall number and return value modification
 From: Helge Deller <deller@gmx.de>
 commit 98e8b6c9ac9d1b1e9d1122dfa6783d5d566bb8f7 upstream.
 Mike Frysinger reported that his ptrace testcase showed strange
 behaviour on parisc: It was not possible to avoid a syscall and the
 return value of a syscall couldn't be changed.
 To modify a syscall number, we were missing to save the new syscall
 number to gr20 which is then picked up later in assembly again.
 The effect that the return value couldn't be changed is a side-effect of
 another bug in the assembly code. When a process is ptraced, userspace
 expects each syscall to report entrance and exit of a syscall.  If a
 syscall number was given which doesn't exist, we jumped to the normal
 syscall exit code instead of informing userspace that the (non-existant)
 syscall exits. This unexpected behaviour confuses userspace and thus the
 bug was misinterpreted as if we can't change the return value.
 This patch fixes both problems and was tested on 64bit kernel with
 32bit userspace.
 Signed-off-by: Helge Deller <deller@gmx.de>
 Cc: Mike Frysinger <vapier@gentoo.org>
 Tested-by: Mike Frysinger <vapier@gentoo.org>
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 ---
 arch/parisc/kernel/ptrace.c  |   16 +++++++++++-----
 arch/parisc/kernel/syscall.S |    5 ++++-
 2 files changed, 15 insertions(+), 6 deletions(-)
 --- a/arch/parisc/kernel/ptrace.c
 +++ b/arch/parisc/kernel/ptrace.c
@@ -269,14 +269,19 @@ long compat_arch_ptrace(struct task_stru
 long do_syscall_trace_enter(struct pt_regs *regs)
 {
 -	long ret = 0;
 -
 	/* Do the secure computing check first. */
 	secure_computing_strict(regs->gr[20]);
 	if (test_thread_flag(TIF_SYSCALL_TRACE) &&
 -	    tracehook_report_syscall_entry(regs))
 -		ret = -1L;
 +	    tracehook_report_syscall_entry(regs)) {
 +		/*
 +		 * Tracing decided this syscall should not happen or the
 +		 * debugger stored an invalid system call number. Skip
 +		 * the system call and the system call restart handling.
 +		 */
 +		regs->gr[20] = -1UL;
 +		goto out;
 +	}
 #ifdef CONFIG_64BIT
 	if (!is_compat_task())
@@ -290,7 +295,8 @@ long do_syscall_trace_enter(struct pt_re
 			regs->gr[24] & 0xffffffff,
 			regs->gr[23] & 0xffffffff);
 -	return ret ? : regs->gr[20];
 +out:
 +	return regs->gr[20];
 }
 void do_syscall_trace_exit(struct pt_regs *regs)
 --- a/arch/parisc/kernel/syscall.S
 +++ b/arch/parisc/kernel/syscall.S
@@ -343,7 +343,7 @@ tracesys_next:
 #endif
 	comiclr,>>=	__NR_Linux_syscalls, %r20, %r0
 -	b,n	.Lsyscall_nosys
 +	b,n	.Ltracesys_nosys
 	LDREGX  %r20(%r19), %r19
@@ -359,6 +359,9 @@ tracesys_next:
 	be      0(%sr7,%r19)
 	ldo	R%tracesys_exit(%r2),%r2
 +.Ltracesys_nosys:
 +	ldo	-ENOSYS(%r0),%r28		/* set errno */
 +
 	/* Do *not* call this function on the gateway page, because it
 	makes a direct call to syscall_trace. */
@@ -1,78 +0,0 @@
 From 79e3f4a853ed161cd4c06d84b50beebf961a47c6 Mon Sep 17 00:00:00 2001
 From: Murali Karicheri <m-karicheri2@ti.com>
 Date: Mon, 29 Feb 2016 17:18:22 -0600
 Subject: PCI: keystone: Fix MSI code that retrieves struct pcie_port pointer
 From: Murali Karicheri <m-karicheri2@ti.com>
 commit 79e3f4a853ed161cd4c06d84b50beebf961a47c6 upstream.
 Commit cbce7900598c ("PCI: designware: Make driver arch-agnostic") changed
 the host bridge sysdata pointer from the ARM pci_sys_data to the DesignWare
 pcie_port structure, and changed pcie-designware.c to reflect that.  But it
 did not change the corresponding code in pci-keystone-dw.c, so it caused
 crashes on Keystone:
  Unable to handle kernel NULL pointer dereference at virtual address 00000030
  pgd = c0003000
  [00000030] *pgd=80000800004003, *pmd=00000000
  Internal error: Oops: 206 [#1] PREEMPT SMP ARM
  CPU: 0 PID: 1 Comm: swapper/0 Not tainted 4.4.2-00139-gb74f926 #2
  Hardware name: Keystone
  PC is at ks_dw_pcie_msi_irq_unmask+0x24/0x58
 Change pci-keystone-dw.c to expect sysdata to be the struct pcie_port
 pointer.
 [bhelgaas: changelog]
 Fixes: cbce7900598c ("PCI: designware: Make driver arch-agnostic")
 Signed-off-by: Murali Karicheri <m-karicheri2@ti.com>
 Signed-off-by: Bjorn Helgaas <bhelgaas@google.com>
 CC: Zhou Wang <wangzhou1@hisilicon.com>
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 ---
 drivers/pci/host/pci-keystone-dw.c |   11 +++--------
 1 file changed, 3 insertions(+), 8 deletions(-)
 --- a/drivers/pci/host/pci-keystone-dw.c
 +++ b/drivers/pci/host/pci-keystone-dw.c
@@ -58,11 +58,6 @@
 #define to_keystone_pcie(x)	container_of(x, struct keystone_pcie, pp)
 -static inline struct pcie_port *sys_to_pcie(struct pci_sys_data *sys)
 -{
 -	return sys->private_data;
 -}
 -
 static inline void update_reg_offset_bit_pos(u32 offset, u32 *reg_offset,
 					     u32 *bit_pos)
 {
@@ -108,7 +103,7 @@ static void ks_dw_pcie_msi_irq_ack(struc
 	struct pcie_port *pp;
 	msi = irq_data_get_msi_desc(d);
 -	pp = sys_to_pcie(msi_desc_to_pci_sysdata(msi));
 +	pp = (struct pcie_port *) msi_desc_to_pci_sysdata(msi);
 	ks_pcie = to_keystone_pcie(pp);
 	offset = d->irq - irq_linear_revmap(pp->irq_domain, 0);
 	update_reg_offset_bit_pos(offset, &reg_offset, &bit_pos);
@@ -146,7 +141,7 @@ static void ks_dw_pcie_msi_irq_mask(stru
 	u32 offset;
 	msi = irq_data_get_msi_desc(d);
 -	pp = sys_to_pcie(msi_desc_to_pci_sysdata(msi));
 +	pp = (struct pcie_port *) msi_desc_to_pci_sysdata(msi);
 	ks_pcie = to_keystone_pcie(pp);
 	offset = d->irq - irq_linear_revmap(pp->irq_domain, 0);
@@ -167,7 +162,7 @@ static void ks_dw_pcie_msi_irq_unmask(st
 	u32 offset;
 	msi = irq_data_get_msi_desc(d);
 -	pp = sys_to_pcie(msi_desc_to_pci_sysdata(msi));
 +	pp = (struct pcie_port *) msi_desc_to_pci_sysdata(msi);
 	ks_pcie = to_keystone_pcie(pp);
 	offset = d->irq - irq_linear_revmap(pp->irq_domain, 0);
@@ -1,100 +0,0 @@
 From a528aca7f359f4b0b1d72ae406097e491a5ba9ea Mon Sep 17 00:00:00 2001
 From: Al Viro <viro@zeniv.linux.org.uk>
 Date: Mon, 29 Feb 2016 12:12:46 -0500
 Subject: use ->d_seq to get coherency between ->d_inode and ->d_flags
 From: Al Viro <viro@zeniv.linux.org.uk>
 commit a528aca7f359f4b0b1d72ae406097e491a5ba9ea upstream.
 Games with ordering and barriers are way too brittle.  Just
 bump ->d_seq before and after updating ->d_inode and ->d_flags
 type bits, so that verifying ->d_seq would guarantee they are
 coherent.
 Signed-off-by: Al Viro <viro@zeniv.linux.org.uk>
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 ---
 fs/dcache.c            |   20 +++++---------------
 include/linux/dcache.h |    4 +---
 2 files changed, 6 insertions(+), 18 deletions(-)
 --- a/fs/dcache.c
 +++ b/fs/dcache.c
@@ -269,9 +269,6 @@ static inline int dname_external(const s
 	return dentry->d_name.name != dentry->d_iname;
 }
 -/*
 - * Make sure other CPUs see the inode attached before the type is set.
 - */
 static inline void __d_set_inode_and_type(struct dentry *dentry,
 					  struct inode *inode,
 					  unsigned type_flags)
@@ -279,28 +276,18 @@ static inline void __d_set_inode_and_typ
 	unsigned flags;
 	dentry->d_inode = inode;
 -	smp_wmb();
 	flags = READ_ONCE(dentry->d_flags);
 	flags &= ~(DCACHE_ENTRY_TYPE | DCACHE_FALLTHRU);
 	flags |= type_flags;
 	WRITE_ONCE(dentry->d_flags, flags);
 }
 -/*
 - * Ideally, we want to make sure that other CPUs see the flags cleared before
 - * the inode is detached, but this is really a violation of RCU principles
 - * since the ordering suggests we should always set inode before flags.
 - *
 - * We should instead replace or discard the entire dentry - but that sucks
 - * performancewise on mass deletion/rename.
 - */
 static inline void __d_clear_type_and_inode(struct dentry *dentry)
 {
 	unsigned flags = READ_ONCE(dentry->d_flags);
 	flags &= ~(DCACHE_ENTRY_TYPE | DCACHE_FALLTHRU);
 	WRITE_ONCE(dentry->d_flags, flags);
 -	smp_wmb();
 	dentry->d_inode = NULL;
 }
@@ -370,9 +357,11 @@ static void dentry_unlink_inode(struct d
 	__releases(dentry->d_inode->i_lock)
 {
 	struct inode *inode = dentry->d_inode;
 +
 +	raw_write_seqcount_begin(&dentry->d_seq);
 	__d_clear_type_and_inode(dentry);
 	hlist_del_init(&dentry->d_u.d_alias);
 -	dentry_rcuwalk_invalidate(dentry);
 +	raw_write_seqcount_end(&dentry->d_seq);
 	spin_unlock(&dentry->d_lock);
 	spin_unlock(&inode->i_lock);
 	if (!inode->i_nlink)
@@ -1757,8 +1746,9 @@ static void __d_instantiate(struct dentr
 	spin_lock(&dentry->d_lock);
 	if (inode)
 		hlist_add_head(&dentry->d_u.d_alias, &inode->i_dentry);
 +	raw_write_seqcount_begin(&dentry->d_seq);
 	__d_set_inode_and_type(dentry, inode, add_flags);
 -	dentry_rcuwalk_invalidate(dentry);
 +	raw_write_seqcount_end(&dentry->d_seq);
 	spin_unlock(&dentry->d_lock);
 	fsnotify_d_instantiate(dentry, inode);
 }
 --- a/include/linux/dcache.h
 +++ b/include/linux/dcache.h
@@ -409,9 +409,7 @@ static inline bool d_mountpoint(const st
  */
 static inline unsigned __d_entry_type(const struct dentry *dentry)
 {
 -	unsigned type = READ_ONCE(dentry->d_flags);
 -	smp_rmb();
 -	return type & DCACHE_ENTRY_TYPE;
 +	return dentry->d_flags & DCACHE_ENTRY_TYPE;
 }
 static inline bool d_is_miss(const struct dentry *dentry)
@@ -1,116 +0,0 @@
 From 8160c4e455820d5008a1116d2dca35f0363bb062 Mon Sep 17 00:00:00 2001
 From: "Michael S. Tsirkin" <mst@redhat.com>
 Date: Sun, 28 Feb 2016 16:31:39 +0200
 Subject: vfio: fix ioctl error handling
 From: Michael S. Tsirkin <mst@redhat.com>
 commit 8160c4e455820d5008a1116d2dca35f0363bb062 upstream.
 Calling return copy_to_user(...) in an ioctl will not
 do the right thing if there's a pagefault:
 copy_to_user returns the number of bytes not copied
 in this case.
 Fix up vfio to do
 	return copy_to_user(...)) ?
 		-EFAULT : 0;
 everywhere.
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
 ---
 drivers/vfio/pci/vfio_pci.c                  |    9 ++++++---
 drivers/vfio/platform/vfio_platform_common.c |    9 ++++++---
 drivers/vfio/vfio_iommu_type1.c              |    6 ++++--
 3 files changed, 16 insertions(+), 8 deletions(-)
 --- a/drivers/vfio/pci/vfio_pci.c
 +++ b/drivers/vfio/pci/vfio_pci.c
@@ -446,7 +446,8 @@ static long vfio_pci_ioctl(void *device_
 		info.num_regions = VFIO_PCI_NUM_REGIONS;
 		info.num_irqs = VFIO_PCI_NUM_IRQS;
 -		return copy_to_user((void __user *)arg, &info, minsz);
 +		return copy_to_user((void __user *)arg, &info, minsz) ?
 +			-EFAULT : 0;
 	} else if (cmd == VFIO_DEVICE_GET_REGION_INFO) {
 		struct pci_dev *pdev = vdev->pdev;
@@ -520,7 +521,8 @@ static long vfio_pci_ioctl(void *device_
 			return -EINVAL;
 		}
 -		return copy_to_user((void __user *)arg, &info, minsz);
 +		return copy_to_user((void __user *)arg, &info, minsz) ?
 +			-EFAULT : 0;
 	} else if (cmd == VFIO_DEVICE_GET_IRQ_INFO) {
 		struct vfio_irq_info info;
@@ -555,7 +557,8 @@ static long vfio_pci_ioctl(void *device_
 		else
 			info.flags |= VFIO_IRQ_INFO_NORESIZE;
 -		return copy_to_user((void __user *)arg, &info, minsz);
 +		return copy_to_user((void __user *)arg, &info, minsz) ?
 +			-EFAULT : 0;
 	} else if (cmd == VFIO_DEVICE_SET_IRQS) {
 		struct vfio_irq_set hdr;
 --- a/drivers/vfio/platform/vfio_platform_common.c
 +++ b/drivers/vfio/platform/vfio_platform_common.c
@@ -219,7 +219,8 @@ static long vfio_platform_ioctl(void *de
 		info.num_regions = vdev->num_regions;
 		info.num_irqs = vdev->num_irqs;
 -		return copy_to_user((void __user *)arg, &info, minsz);
 +		return copy_to_user((void __user *)arg, &info, minsz) ?
 +			-EFAULT : 0;
 	} else if (cmd == VFIO_DEVICE_GET_REGION_INFO) {
 		struct vfio_region_info info;
@@ -240,7 +241,8 @@ static long vfio_platform_ioctl(void *de
 		info.size = vdev->regions[info.index].size;
 		info.flags = vdev->regions[info.index].flags;
 -		return copy_to_user((void __user *)arg, &info, minsz);
 +		return copy_to_user((void __user *)arg, &info, minsz) ?
 +			-EFAULT : 0;
 	} else if (cmd == VFIO_DEVICE_GET_IRQ_INFO) {
 		struct vfio_irq_info info;
@@ -259,7 +261,8 @@ static long vfio_platform_ioctl(void *de
 		info.flags = vdev->irqs[info.index].flags;
 		info.count = vdev->irqs[info.index].count;
 -		return copy_to_user((void __user *)arg, &info, minsz);
 +		return copy_to_user((void __user *)arg, &info, minsz) ?
 +			-EFAULT : 0;
 	} else if (cmd == VFIO_DEVICE_SET_IRQS) {
 		struct vfio_irq_set hdr;
 --- a/drivers/vfio/vfio_iommu_type1.c
 +++ b/drivers/vfio/vfio_iommu_type1.c
@@ -999,7 +999,8 @@ static long vfio_iommu_type1_ioctl(void
 		info.iova_pgsizes = vfio_pgsize_bitmap(iommu);
 -		return copy_to_user((void __user *)arg, &info, minsz);
 +		return copy_to_user((void __user *)arg, &info, minsz) ?
 +			-EFAULT : 0;
 	} else if (cmd == VFIO_IOMMU_MAP_DMA) {
 		struct vfio_iommu_type1_dma_map map;
@@ -1032,7 +1033,8 @@ static long vfio_iommu_type1_ioctl(void
 		if (ret)
 			return ret;
 -		return copy_to_user((void __user *)arg, &unmap, minsz);
 +		return copy_to_user((void __user *)arg, &unmap, minsz) ?
 +			-EFAULT : 0;
 	}
 	return -ENOTTY;
@@ -28,35 +28,11 @@
        </BuildDependencies>
        <Patches>
            <!-- Linux patches -->
-            <Patch level="1" compressionType="xz">patches/linux/patch-4.4.4.xz</Patch>
+            <Patch level="1" compressionType="xz">patches/linux/patch-4.4.8.xz</Patch>
-            <!-- Mageia Linux patches // compatible with http://svnweb.mageia.org/packages/cauldron/kernel/releases/4.4.4/1.mga6/PATCHES/patches/series-->
+            <!-- Mageia Linux patches // compatible with http://svnweb.mageia.org/packages/cauldron/kernel/releases/4.4.6/1.mga6/PATCHES/patches/series-->
            <!--stable patches-->
            <Patch level="1">patches/mageia/stable-use-d_seq-to-get-coherency-between-d_inode-and-d_flags.patch</Patch>
            <Patch level="1">patches/mageia/stable-drivers-sh-restore-legacy-clock-domain-on-superh-platforms.patch</Patch>
            <Patch level="1">patches/mageia/stable-btrfs-fix-deadlock-running-delayed-iputs-at-transaction-commit-time.patch</Patch>
            <Patch level="1">patches/mageia/stable-btrfs-fix-no_space-in-write-and-rm-loop.patch</Patch>
            <Patch level="1">patches/mageia/stable-btrfs-async-thread-fix-a-use-after-free-error-for-trace.patch</Patch>
            <Patch level="1">patches/mageia/stable-drm-amdgpu-mask-out-wc-from-bo-on-unsupported-arches.patch</Patch>
            <Patch level="1">patches/mageia/stable-block-initialize-max_dev_sectors-to-0.patch</Patch>
            <Patch level="1">patches/mageia/stable-pci-keystone-fix-msi-code-that-retrieves-struct-pcie_port-pointer.patch</Patch>
            <Patch level="1">patches/mageia/stable-parisc-fix-ptrace-syscall-number-and-return-value-modification.patch</Patch>
            <Patch level="1">patches/mageia/stable-mips-kvm-fix-ioctl-error-handling.patch</Patch>
            <Patch level="1">patches/mageia/stable-kvm-x86-update-tsc-multiplier-on-change.patch</Patch>
            <Patch level="1">patches/mageia/stable-fbcon-set-a-default-value-to-blink-interval.patch</Patch>
            <Patch level="1">patches/mageia/stable-cifs-fix-out-of-bounds-access-in-lease-parsing.patch</Patch>
            <Patch level="1">patches/mageia/stable-cifs-fix-smb2-interim-response-processing-for-read-requests.patch</Patch>
            <Patch level="1">patches/mageia/stable-fix-cifs_uniqueid_to_ino_t-function-for-s390x.patch</Patch>
            <Patch level="1">patches/mageia/stable-vfio-fix-ioctl-error-handling.patch</Patch>
            <Patch level="1">patches/mageia/stable-kvm-x86-fix-root-cause-for-missed-hardware-breakpoints.patch</Patch>
            <Patch level="1">patches/mageia/stable-arm-arm64-kvm-fix-ioctl-error-handling.patch</Patch>
            <Patch level="1">patches/mageia/stable-iommu-amd-apply-workaround-for-ats-write-permission-check.patch</Patch>
            <Patch level="1">patches/mageia/stable-iommu-amd-fix-boot-warning-when-device-00-00.0-is-not-iommu-covered.patch</Patch>
            <Patch level="1">patches/mageia/stable-iommu-vt-d-use-bus_notify_removed_device-in-hotplug-path.patch</Patch>
            <!--other patches-->
-            <Patch level="1">patches/mageia/ata-Adding-Intel-Lewisburg-device-IDs-for-SATA.patch</Patch>
+            <Patch level="1">patches/mageia/Revert-ipmi-Start-the-timer-and-thread-on-internal-m.patch</Patch>
            <Patch level="1">patches/mageia/ata-ahci-don-t-mark-HotPlugCapable-Ports-as-external.patch</Patch>
            <Patch level="1">patches/mageia/libata-Align-ata_device-s-id-on-a-cacheline.patch</Patch>
            <Patch level="1">patches/mageia/libata-fix-HDIO_GET_32BIT-ioctl.patch</Patch>
            <Patch level="1">patches/mageia/x86-pci-toshiba-equium-a60-assign-busses.patch</Patch>
            <Patch level="1">patches/mageia/x86-boot-video-80x25-if-break.patch</Patch>
            <Patch level="1">patches/mageia/x86-default_poweroff_up_machines.patch</Patch>
@@ -85,6 +61,7 @@
            <Patch level="1">patches/mageia/fs-aufs-4.4.patch</Patch>
            <Patch level="1">patches/mageia/fs-aufs-4.4-modular.patch</Patch>
            <Patch level="1">patches/mageia/fs-ovl-move-super-block-magic-number-to-magic.h.patch</Patch>
            <Patch level="1">patches/mageia/pipe-limit-the-per-user-amount-of-pages-allocated-in-pipes_CVE-2016-2847.patch</Patch>
            <Patch level="1">patches/mageia/firewire-ieee1394-module-aliases.patch</Patch>
            <Patch level="1">patches/mageia/char-agp-intel-new-Q57-id.patch</Patch>
            <Patch level="1">patches/mageia/gpu-drm-mach64.patch</Patch>
@@ -134,6 +111,8 @@
            <Patch level="1">patches/mageia/net-netfilter-psd.patch</Patch>
            <Patch level="1">patches/mageia/net-netfilter-psd-mdv.patch</Patch>
            <Patch level="1">patches/mageia/net-netfilter-psd-2.6.35-buildfix.patch</Patch>
            <Patch level="1">patches/mageia/net-netfilter-x_tables-check-for-size-overflow.patch</Patch>
            <Patch level="1">patches/mageia/net-netfilter-x_tables-deal-with-bogus-nextoffset-values.patch</Patch>
            <Patch level="1">patches/mageia/platform-x86-add-shuttle-wmi-driver.patch</Patch>
            <Patch level="1">patches/mageia/platform-x86-shuttle-wmi-drop-devinit-exit.patch</Patch>
            <Patch level="1">patches/mageia/platform-x86-shuttle-wmi-4.2-buildfix.patch</Patch>
@@ -182,7 +161,6 @@
            <Patch level="1">patches/mageia/arm-0024-ARM-bcm2835-Add-the-auxiliary-clocks-to-the-device-t.patch</Patch>
            <Patch level="1">patches/mageia/arm-0031-ARM-bcm2835-enable-all-bcm2835-relevant-in-defconfig.patch</Patch>
            <Patch level="1">patches/mageia/arm-0032-ARM-bcm2835-enable-auxiliary-spi-driver-in-defconfig.patch</Patch>
        mageia/net-netfilter-IFWLOG-remove-unused-label.patch
        </Patches>
    </Source>
@@ -197,7 +175,7 @@
            <Path fileType="executable" permanent="true">/boot</Path>
            <Path fileType="library" permanent="true">/lib/modules</Path>
            <Path fileType="data">/etc/kernel</Path>
-            <Path fileType="data">/etc/mkinitcpio.d</Path>
+            <Path fileType="config">/etc/mkinitcpio.d</Path>
        </Files>
        <Provides>
            <COMAR script="package.py">System.Package</COMAR>
@@ -239,10 +217,14 @@
    <History>
        <Update release="2">
            <Date>2016-04-27</Date>
-            <Version>4.4.4</Version>
+            <Version>4.4.8</Version>
-            <Comment>Release Bump</Comment>
+            <Comment>Version Bump.</Comment>
-            <Name>PisiLinux Community</Name>
+            <Type package="kernel">security</Type>
-            <Email>admin@pisilinux.org</Email>
+            <Requires>
                <Action package="kernel">systemRestart</Action>
            </Requires>
            <Name>Ertuğrul Erata</Name>
            <Email>ertugrulerata@gmail.com</Email>
        </Update>
        <Update release="1">
            <Date>2016-03-06</Date>
@@ -1 +1 @@
-11f7965b4c0e48e8a888c4174228518341866008
+563e1420ed6d751126341076008ef9dda4a78b5b
@@ -1 +1 @@
-8e0dbc0411a894763c38f38b3aeda489b3a215d4
+ed562c0211cd53d631aec9e877d2d8adf9367c00
		`@@ -1 +1 @@`
			`11f7965b4c0e48e8a888c4174228518341866008`				`563e1420ed6d751126341076008ef9dda4a78b5b`
		`@@ -1 +1 @@`
			`8e0dbc0411a894763c38f38b3aeda489b3a215d4`				`ed562c0211cd53d631aec9e877d2d8adf9367c00`