Pull md fixes from NeilBrown:
 "2 fixes for md, tagged for -stable"

* tag 'md-3.6-fixes' of git://neil.brown.name/md:
  md/raid10: fix problem with on-stack allocation of r10bio structure.
  md: Don't truncate size at 4TB for RAID0 and Linear

A 'struct r10bio' has an array of per-copy information at the end.
This array is declared with size [0] and r10bio_pool_alloc allocates
enough extra space to store the per-copy information depending on the
number of copies needed.

So declaring a 'struct r10bio on the stack isn't going to work.  It
won't allocate enough space, and memory corruption will ensue.

So in the two places where this is done, declare a sufficiently large
structure and use that instead.

The two call-sites of this bug were introduced in 3.4 and 3.5
so this is suitable for both those kernels.  The patch will have to
be modified for 3.4 as it only has one bug.

Cc: stable@vger.kernel.org
Reported-by: NIvan Vasilyev <ivan.vasilyev@gmail.com>
Tested-by: NIvan Vasilyev <ivan.vasilyev@gmail.com>
Signed-off-by: NNeilBrown <neilb@suse.de>

Pull infiniband/rdma fixes from Roland Dreier:
 "Grab bag of InfiniBand/RDMA fixes:
   - IPoIB fixes for regressions introduced by path database conversion
   - mlx4 fixes for bugs with large memory systems and regressions from
     SR-IOV patches
   - RDMA CM fix for passing bad event up to userspace
   - Other minor fixes"

* tag 'rdma-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/roland/infiniband:
  IB/mlx4: Check iboe netdev pointer before dereferencing it
  mlx4_core: Clean up buddy bitmap allocation
  mlx4_core: Fix integer overflow issues around MTT table
  mlx4_core: Allow large mlx4_buddy bitmaps
  IB/srp: Fix a race condition
  IB/qib: Fix error return code in qib_init_7322_variables()
  IB: Fix typos in infiniband drivers
  IB/ipoib: Fix RCU pointer dereference of wrong object
  IB/ipoib: Add missing locking when CM object is deleted
  RDMA/ucma.c: Fix for events with wrong context on iWARP
  RDMA/ocrdma: Don't call vlan_dev_real_dev() for non-VLAN netdevs
  IB/mlx4: Fix possible deadlock on sm_lock spinlock

Pull TTY fixes from Greg Kroah-Hartman:
 "Here are 4 tiny patches, each fixing a serial driver problem that
  people have reported.

  Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>"

* tag 'tty-3.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/tty:
  pmac_zilog,kdb: Fix console poll hook to return instead of loop
  serial: mxs-auart: fix the wrong RTS hardware flow control
  serial: ifx6x60: fix paging fault on spi_register_driver
  serial: Change Kconfig entry for CLPS711X-target

Pull staging fixes from Greg Kroah-Hartman:
 "Here are some staging driver fixes (and iio driver fixes, they get
  lumped in with the staging stuff due to dependancies) for your 3.6-rc3
  tree.

  Nothing major, just a bunch of fixes that people have reported.

  Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>"

* tag 'staging-3.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/staging: (26 commits)
  iio: lm3533-als: Fix build warnings
  staging:iio:ad7780: Mark channels as unsigned
  staging:iio:ad7192: Report offset and scale for temperature channel
  staging:iio:ad7192: Report channel offset
  staging:iio:ad7192: Mark channels as unsigned
  staging:iio:ad7192: Fix setting ACX
  staging:iio:ad7192: Add missing break in switch statement
  staging:iio:ad7793: Fix internal reference value
  staging:iio:ad7793: Follow new IIO naming spec
  staging:iio:ad7793: Fix temperature scale and offset
  staging:iio:ad7793: Report channel offset
  staging:iio:ad7793: Mark channels as unsigned
  staging:iio:ad7793: Add missing break in switch statement
  iio/adjd_s311: Fix potential memory leak in adjd_s311_update_scan_mode()
  iio: frequency: ADF4350: Fix potential reference div factor overflow.
  iio: staging: ad7298_ring: Fix maybe-uninitialized warning
  staging: comedi: usbduxfast: Declare MODULE_FIRMWARE usage
  staging: comedi: usbdux: Declare MODULE_FIRMWARE usage
  staging: comedi: usbduxsigma: Declare MODULE_FIRMWARE usage
  staging: csr: add INET dependancy
  ...

Pull driver core fixes from Greg Kroah-Hartman:
 "Here are two tiny patches, one fixing a dynamic debug problem that the
  printk rework turned up, and the other one fixing an extcon problem
  that people reported.

  Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>"

* tag 'driver-core-3.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/driver-core:
  extcon: extcon_gpio: Replace gpio_request_one by devm_gpio_request_one
  drivers-core: make structured logging play nice with dynamic-debug

Pull Char / Misc driver fixes from Greg Kroah-Hartman:
 "Here are some small misc and w1 driver fixes for 3.6-rc3.  Nothing
  major, just some some bugfixes and a new device id for a w1 driver.

  Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>"

* tag 'char-misc-3.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/char-misc:
  1-Wire: Add support for the maxim ds1825 temperature sensor
  ti-st: Fix check for pdata->chip_awake function pointer
  mei: add mei_quirk_probe function
  mei: fix device stall after wd is stopped

Pull USB patches from Greg Kroah-Hartman:
 "Here are a number of small USB patches for 3.6-rc3.

  The "large" one is just a number of device id updates to the option
  driver, done by the manufacturer, properly fixing up the device ids
  based on shipping devices.

  Other than that, some gadget driver fixes, the obligitary XHCI
  patches, and some other device ids and bugs fixed.

  Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>"

* tag 'usb-3.6-rc3' of git://git.kernel.org/pub/scm/linux/kernel/git/gregkh/usb: (26 commits)
  USB: qcserial: fix port handling on Gobi 1K and 2K+
  USB: serial: Fix mos7840 timeout
  USB: option: add ZTE K5006-Z
  usb: gadget: u_ether: fix kworker 100% CPU issue with still used interfaces in eth_stop
  usb: host: tegra: fix warning messages in ehci_remove
  usb: host: mips: sead3: Update for EHCI register structure.
  usb: renesas_usbhs: fixup resume method for autonomy mode
  usb: renesas_usbhs: mod_host: add missing .bus_suspend/resume
  update MAINTAINERS for Oliver Neukum
  usb: usb_wwan: resume/suspend can be called after port is gone
  usb: serial: prevent suspend/resume from racing against probe/remove
  usb: usb_wwan: replace release and disconnect with a port_remove hook
  usb: serial: mos7840: Fixup mos7840_chars_in_buffer()
  USB: isp1362-hcd.c: usb message always saved in case of underrun
  OMAP: USB : Fix the EHCI enumeration and core retention issue
  usb: chipidea: fix and improve dependencies if usb host or gadget support is built as module
  USB: support the new interfaces of Huawei Data Card devices in option driver
  USB: ftdi_sio: Add VID/PID for Kondo Serial USB
  xhci: Switch PPT ports to EHCI on shutdown.
  xhci: Fix bug after deq ptr set to link TRB.
  ...

Fix fatal error in scripts/kernel-doc by ignoring the "__weak" attribute:

  Error(drivers/pci/pci.c:2820): cannot understand prototype: 'char * __weak pcibios_setup(char *str) '
Signed-off-by: NRandy Dunlap <rdunlap@xenotime.net>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Pull a Yama bugfix from James Morris.

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jmorris/linux-security:
  Yama: access task_struct->comm directly

Pull C6X atomic64 support from Mark Salter:
 "Enable atomic64 ops in C6X
   - define L1_CACHE_SHIFT
   - select GENERIC_ATOMIC64"

* tag 'for-linus' of git://linux-c6x.org/git/projects/linux-c6x-upstreaming:
  C6X: select GENERIC_ATOMIC64
  C6X: add Lx_CACHE_SHIFT defines

Pull ext4 bug fixes from Ted Ts'o:
 "The following are all bug fixes and regressions.  The most notable are
  the ones which cause problems for ext4 on RAID --- a performance
  problem when mounting very large filesystems, and a kernel OOPS when
  doing an rm -rf on large directory hierarchies on fast devices."

* tag 'ext4_for_linus_stable' of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:
  ext4: fix kernel BUG on large-scale rm -rf commands
  ext4: fix long mount times on very big file systems
  ext4: don't call ext4_error while block group is locked
  ext4: avoid kmemcheck complaint from reading uninitialized memory
  ext4: make sure the journal sb is written in ext4_clear_journal_err()

In some cases when an autofs indirect mount is contained in a file
system that is marked as shared (such as when systemd does the
equivalent of "mount --make-rshared /" early in the boot), mounts
stop expiring.

When this happens the first expiry check on a mountpoint dentry in
autofs_expire_indirect() sees a mountpoint dentry with a higher
than minimal reference count. Consequently the dentry is condidered
busy and the actual expiry check is never done.

This particular check was originally meant as an optimisation to
detect a path walk in progress but with the addition of rcu-walk
it can be ineffective anyway.

Removing the test allows automounts to expire again since the
actual expire check doesn't rely on the dentry reference count.
Signed-off-by: NIan Kent <raven@themaw.net>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>

Commit 968dee77: "ext4: fix hole punch failure when depth is greater
than 0" introduced a regression in v3.5.1/v3.6-rc1 which caused kernel
crashes when users ran run "rm -rf" on large directory hierarchy on
ext4 filesystems on RAID devices:

    BUG: unable to handle kernel NULL pointer dereference at 0000000000000028

    Process rm (pid: 18229, threadinfo ffff8801276bc000, task ffff880123631710)
    Call Trace:
     [<ffffffff81236483>] ? __ext4_handle_dirty_metadata+0x83/0x110
     [<ffffffff812353d3>] ext4_ext_truncate+0x193/0x1d0
     [<ffffffff8120a8cf>] ? ext4_mark_inode_dirty+0x7f/0x1f0
     [<ffffffff81207e05>] ext4_truncate+0xf5/0x100
     [<ffffffff8120cd51>] ext4_evict_inode+0x461/0x490
     [<ffffffff811a1312>] evict+0xa2/0x1a0
     [<ffffffff811a1513>] iput+0x103/0x1f0
     [<ffffffff81196d84>] do_unlinkat+0x154/0x1c0
     [<ffffffff8118cc3a>] ? sys_newfstatat+0x2a/0x40
     [<ffffffff81197b0b>] sys_unlinkat+0x1b/0x50
     [<ffffffff816135e9>] system_call_fastpath+0x16/0x1b
    Code: 8b 4d 20 0f b7 41 02 48 8d 04 40 48 8d 04 81 49 89 45 18 0f b7 49 02 48 83 c1 01 49 89 4d 00 e9 ae f8 ff ff 0f 1f 00 49 8b 45 28 <48> 8b 40 28 49 89 45 20 e9 85 f8 ff ff 0f 1f 80 00 00 00

    RIP  [<ffffffff81233164>] ext4_ext_remove_space+0xa34/0xdf0

This could be reproduced as follows:

The problem in commit 968dee77 was that caused the variable 'i' to
be left uninitialized if the truncate required more space than was
available in the journal.  This resulted in the function
ext4_ext_truncate_extend_restart() returning -EAGAIN, which caused
ext4_ext_remove_space() to restart the truncate operation after
starting a new jbd2 handle.
Reported-by: NMaciej Żenczykowski <maze@google.com>
Reported-by: NMarti Raudsepp <marti@juffo.org>
Tested-by: NFengguang Wu <fengguang.wu@intel.com>
Signed-off-by: N"Theodore Ts'o" <tytso@mit.edu>
Cc: stable@vger.kernel.org

Commit 8aeb00ff85a: "ext4: fix overhead calculation used by
ext4_statfs()" introduced a O(n**2) calculation which makes very large
file systems take forever to mount.  Fix this with an optimization for
non-bigalloc file systems.  (For bigalloc file systems the overhead
needs to be set in the the superblock.)
Signed-off-by: N"Theodore Ts'o" <tytso@mit.edu>
Cc: stable@vger.kernel.org

While in ext4_validate_block_bitmap(), if an block allocation bitmap
is found to be invalid, we call ext4_error() while the block group is
still locked.  This causes ext4_commit_super() to call a function
which might sleep while in an atomic context.

There's no need to keep the block group locked at this point, so hoist
the ext4_error() call up to ext4_validate_block_bitmap() and release
the block group spinlock before calling ext4_error().

The reported stack trace can be found at:

	http://article.gmane.org/gmane.comp.file-systems.ext4/33731Reported-by: NDave Jones <davej@redhat.com>
Signed-off-by: N"Theodore Ts'o" <tytso@mit.edu>
Cc: stable@vger.kernel.org

The core ptrace access checking routine holds a task lock, and when
reporting a failure, Yama takes a separate task lock. To avoid a
potential deadlock with two ptracers taking the opposite locks, do not
use get_task_comm() and just use ->comm directly since accuracy is not
important for the report.
Reported-by: NFengguang Wu <fengguang.wu@intel.com>
Suggested-by: NOleg Nesterov <oleg@redhat.com>
CC: stable@vger.kernel.org
Signed-off-by: NKees Cook <keescook@chromium.org>
Acked-by: NJohn Johansen <john.johansen@canonical.com>
Signed-off-by: NJames Morris <james.l.morris@oracle.com>

Merge tag 'v3.6-rc1-iio-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/jic23/iio into staging-linus

IIO fixes for v3.6-rc1

These mostly consist of fixes from Lars-Peter Clausen that were
the first part of a large series reworking the drivers concerned.
Turns out these drivers had quite a wealth of minor bugs.

Also here are some build warning fixes for lm3533-als and
adjd_s111 (both new drives in this cycle).
Final elements are a a div factor overflow and a warning
related fix in a couple of Analog Devices drivers.

All in all nothing major, but a worthwhile bunch of short
fixes.

This patch adds support for maxim ds1825 based 1-wire temperature sensors.
Signed-off-by: NRaphael Assenat <raph@8d.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

ll_device_want_to_wakeup(): Fix the NULL pointer check on pdata->chip_awake,
which is performed on the wrong function pointer
Signed-off-by: NMatthias Kaehlcke <matthias@kaehlcke.net>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Fix below build warnings:
  CC [M]  drivers/iio/light/lm3533-als.o
drivers/iio/light/lm3533-als.c:667:8: warning: initialization from incompatible pointer type [enabled by default]
drivers/iio/light/lm3533-als.c:667:8: warning: (near initialization for 'dev_attr_in_illuminance0_thresh_either_en.show') [enabled by default]
drivers/iio/light/lm3533-als.c:667:8: warning: initialization from incompatible pointer type [enabled by default]
drivers/iio/light/lm3533-als.c:667:8: warning: (near initialization for 'dev_attr_in_illuminance0_thresh_either_en.store') [enabled by default]
Signed-off-by: NAxel Lin <axel.lin@gmail.com>

The values reported by the AD7780 are unsigned with a binary offset:

	0x000000 is negative fullscale
	0x800000 is zeroscale
	0xffffff is positive fullscale

So mark the channel in the channel spec as unsigned rather than signed.
Signed-off-by: NLars-Peter Clausen <lars@metafoo.de>
Signed-off-by: NJonathan Cameron <jic23@kernel.org>

The temperature channel reports values in degree Kelvin with sensitivity of 5630
codes per degree. If the chip is configured in bipolar mode there is an
additional binary offset of 0x800000 and the sensitivity is divided by two.

Currently the driver does the mapping from the raw value to degree Celsius when
doing a manual conversion. This has several disadvantages, the major one being
that it does not work for buffered mode, also by doing the division by the
sensitivity in the driver the precession of the reported value is needlessly
reduced.

Furthermore the current calculation only works in bipolar mode and the current
scale is of by a factor of 1000.

This patch modifies the driver to report correct offset and scale values in
both unipolar and bipolar mode and to report the raw temperature value
for manual conversions.
Signed-off-by: NLars-Peter Clausen <lars@metafoo.de>
Signed-off-by: NJonathan Cameron <jic23@kernel.org>

In bipolar mode there is a a binary offset of 2**(N-1) (with N being the number
of bits) on the reported value. Currently this value is subtracted when doing a
manual read. While this works for manual channel readings it does not work for
buffered mode. So report the offset in the channels offset property, which will
work in both modes.
Signed-off-by: NLars-Peter Clausen <lars@metafoo.de>

The values reported by the AD7793 are unsigned.
	In uniploar mode:
			0x000000 is zeroscale
			0xffffff is fullscale
	In bipolar mode:
			0x000000 is negative fullscale
			0x800000 is zeroscale
			0xffffff is positive fullscale

In bipolar mode there is a binary offset, but the values are still unsigned.
Signed-off-by: NLars-Peter Clausen <lars@metafoo.de>
Signed-off-by: NJonathan Cameron <jic23@kernel.org>

Write to the correct register when setting the ACX bit.
Signed-off-by: NLars-Peter Clausen <lars@metafoo.de>
Signed-off-by: NJonathan Cameron <jic23@kernel.org>

Without the break statement we fall right through to the default case and return
an error value.
Signed-off-by: NLars-Peter Clausen <lars@metafoo.de>
Signed-off-by: NJonathan Cameron <jic23@kernel.org>

The internal reference for the ad7793 and similar is 1.17V
Signed-off-by: NLars-Peter Clausen <lars@metafoo.de>
Signed-off-by: NJonathan Cameron <jic23@kernel.org>

Make the "in-in_scale_available" attribute follow the new naming spec and
rename it to "in_voltage-voltage_scale_available".
Signed-off-by: NLars-Peter Clausen <lars@metafoo.de>
Signed-off-by: NJonathan Cameron <jic23@kernel.org>

The temperature channel uses the internal 1.17V reference with 0.81 mv/C. The
reported temperature is in Kevlin, so we need to add the Kelvin to Celcius
offset when reporting the offset for the temperature channel.
Signed-off-by: NLars-Peter Clausen <lars@metafoo.de>
Signed-off-by: NJonathan Cameron <jic23@kernel.org>

In bipolar mode there is a a binary offset of 2**(N-1) (with N being the number
of bits) on the reported value. Currently this value is subtracted when doing a
manual read. While this works for manual channel readings it does not work for
buffered mode. So report the offset in the channels offset property, which will
work in both modes.
Signed-off-by: NLars-Peter Clausen <lars@metafoo.de>
Signed-off-by: NJonathan Cameron <jic23@kernel.org>

The values reported by the AD7793 are unsigned.
	In uniploar mode:
			0x000000 is zeroscale
			0xffffff is fullscale
	In bipolar mode:
			0x000000 is negative fullscale
			0x800000 is zeroscale
			0xffffff is positive fullscale

In bipolar mode there is a binary offset, but the values are still unsigned.
Signed-off-by: NLars-Peter Clausen <lars@metafoo.de>
Signed-off-by: NJonathan Cameron <jic23@kernel.org>

Without the break statement we fall right through to the default case and return
an error value.
Signed-off-by: NLars-Peter Clausen <lars@metafoo.de>
Signed-off-by: NJonathan Cameron <jic23@kernel.org>

Do not leak memory by updating pointer with potentially NULL realloc return value.
There is no need to preserve data in the buffer,
so replace krealloc() by kfree()-kmalloc() pair.

Found by Linux Driver Verification project (linuxtesting.org).
Signed-off-by: NAlexey Khoroshilov <khoroshilov@ispras.ru>
Acked-by: NPeter Meerwald <pmeerw@pmeerw.net>
Signed-off-by: NJonathan Cameron <jic23@kernel.org>

With small channel spacing values and high reference frequencies it is
possible to exceed the range of the 10-bit counter.
Workaround by checking the range and widening some constrains.

We don't use the REG1_PHASE value in this case the datasheet recommends to set
it to 1 if not used.
Signed-off-by: NMichael Hennerich <michael.hennerich@analog.com>
Signed-off-by: NJonathan Cameron <jic23@kernel.org>

drivers/staging/iio/adc/ad7298_ring.c:97:37: warning: 'time_ns' may
be used uninitialized in this function [-Wmaybe-uninitialized]
Reported-by: NFengguang Wu <fengguang.wu@intel.com>
Signed-off-by: NMichael Hennerich <michael.hennerich@analog.com>
Signed-off-by: NJonathan Cameron <jic23@kernel.org>

kdb <-> kgdb transitioning does not work properly with this UART
driver because the get character routine loops indefinitely as opposed
to returning NO_POLL_CHAR per the expectation of the KDB I/O driver
API.

The symptom is a kernel hang when trying to switch debug modes.

Cc: Alan Cox <alan@linux.intel.com>
Signed-off-by: NJason Wessel <jason.wessel@windriver.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Without checking if the auart supports the hardware flow control or not,
the old mxs_auart_set_mctrl() asserted the RTS pin blindly.

This will causes the auart receives wrong data in the following case:
   The far-end has already started the write operation, and wait for
the auart asserts the RTS pin. Then the auart starts the read operation,
but mxs_auart_set_mctrl() may be called before we set the RTSCTS in the
mxs_auart_settermios(). So the RTS pin is asserted in a wrong situation,
and we get the wrong data in the end.

This bug has been catched when I connect the mx23(DTE) to the mx53(DCE).

This patch also replaces the AUART_CTRL2_RTS with AUART_CTRL2_RTSEN.
We should use the real the hardware flow control, not the software-controled
hardware flow control.
Signed-off-by: NHuang Shijie <b32955@freescale.com>
Signed-off-by: NGreg Kroah-Hartman <gregkh@linuxfoundation.org>

Following a report of a crash during an automount expire I found that
the locking in fs/autofs4/expire.c:get_next_positive_subdir() was wrong.
Not only is the locking wrong but the function is more complex than it
needs to be.

The function is meant to calculate (and dget) the next entry in the list
of directories contained in the root of an autofs mount point (an autofs
indirect mount to be precise). The main problem was that the d_lock of
the owner of the list was not being taken when walking the list, which
lead to list corruption under load. The only other lock that needs to
be taken is against the next dentry candidate so it can be checked for
usability.
Signed-off-by: NIan Kent <raven@themaw.net>
Signed-off-by: NLinus Torvalds <torvalds@linux-foundation.org>